mlx.c revision 281826
1/*-
2 * Copyright (c) 1999 Michael Smith
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in the
12 *    documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24 * SUCH DAMAGE.
25 *
26 *	$FreeBSD: stable/10/sys/dev/mlx/mlx.c 281826 2015-04-21 11:27:50Z mav $
27 */
28
29/*
30 * Driver for the Mylex DAC960 family of RAID controllers.
31 */
32
33#include <sys/param.h>
34#include <sys/systm.h>
35#include <sys/bio.h>
36#include <sys/lock.h>
37#include <sys/malloc.h>
38#include <sys/mutex.h>
39#include <sys/kernel.h>
40#include <sys/sx.h>
41
42#include <sys/bus.h>
43#include <sys/conf.h>
44#include <sys/stat.h>
45
46#include <machine/resource.h>
47#include <machine/bus.h>
48#include <machine/clock.h>
49#include <sys/rman.h>
50
51#include <geom/geom_disk.h>
52
53#include <dev/mlx/mlxio.h>
54#include <dev/mlx/mlxvar.h>
55#include <dev/mlx/mlxreg.h>
56
57static struct cdevsw mlx_cdevsw = {
58	.d_version =	D_VERSION,
59	.d_open =	mlx_open,
60	.d_close =	mlx_close,
61	.d_ioctl =	mlx_ioctl,
62	.d_name =	"mlx",
63};
64
65devclass_t	mlx_devclass;
66
67/*
68 * Per-interface accessor methods
69 */
70static int			mlx_v3_tryqueue(struct mlx_softc *sc, struct mlx_command *mc);
71static int			mlx_v3_findcomplete(struct mlx_softc *sc, u_int8_t *slot, u_int16_t *status);
72static void			mlx_v3_intaction(struct mlx_softc *sc, int action);
73static int			mlx_v3_fw_handshake(struct mlx_softc *sc, int *error, int *param1, int *param2, int first);
74
75static int			mlx_v4_tryqueue(struct mlx_softc *sc, struct mlx_command *mc);
76static int			mlx_v4_findcomplete(struct mlx_softc *sc, u_int8_t *slot, u_int16_t *status);
77static void			mlx_v4_intaction(struct mlx_softc *sc, int action);
78static int			mlx_v4_fw_handshake(struct mlx_softc *sc, int *error, int *param1, int *param2, int first);
79
80static int			mlx_v5_tryqueue(struct mlx_softc *sc, struct mlx_command *mc);
81static int			mlx_v5_findcomplete(struct mlx_softc *sc, u_int8_t *slot, u_int16_t *status);
82static void			mlx_v5_intaction(struct mlx_softc *sc, int action);
83static int			mlx_v5_fw_handshake(struct mlx_softc *sc, int *error, int *param1, int *param2, int first);
84
85/*
86 * Status monitoring
87 */
88static void			mlx_periodic(void *data);
89static void			mlx_periodic_enquiry(struct mlx_command *mc);
90static void			mlx_periodic_eventlog_poll(struct mlx_softc *sc);
91static void			mlx_periodic_eventlog_respond(struct mlx_command *mc);
92static void			mlx_periodic_rebuild(struct mlx_command *mc);
93
94/*
95 * Channel Pause
96 */
97static void			mlx_pause_action(struct mlx_softc *sc);
98static void			mlx_pause_done(struct mlx_command *mc);
99
100/*
101 * Command submission.
102 */
103static void			*mlx_enquire(struct mlx_softc *sc, int command, size_t bufsize,
104					     void (*complete)(struct mlx_command *mc));
105static int			mlx_flush(struct mlx_softc *sc);
106static int			mlx_check(struct mlx_softc *sc, int drive);
107static int			mlx_rebuild(struct mlx_softc *sc, int channel, int target);
108static int			mlx_wait_command(struct mlx_command *mc);
109static int			mlx_poll_command(struct mlx_command *mc);
110void				mlx_startio_cb(void *arg,
111					       bus_dma_segment_t *segs,
112					       int nsegments, int error);
113static void			mlx_startio(struct mlx_softc *sc);
114static void			mlx_completeio(struct mlx_command *mc);
115static int			mlx_user_command(struct mlx_softc *sc,
116						 struct mlx_usercommand *mu);
117void				mlx_user_cb(void *arg, bus_dma_segment_t *segs,
118					    int nsegments, int error);
119
120/*
121 * Command buffer allocation.
122 */
123static struct mlx_command	*mlx_alloccmd(struct mlx_softc *sc);
124static void			mlx_releasecmd(struct mlx_command *mc);
125static void			mlx_freecmd(struct mlx_command *mc);
126
127/*
128 * Command management.
129 */
130static int			mlx_getslot(struct mlx_command *mc);
131static void			mlx_setup_dmamap(struct mlx_command *mc,
132						 bus_dma_segment_t *segs,
133						 int nsegments, int error);
134static void			mlx_unmapcmd(struct mlx_command *mc);
135static int			mlx_shutdown_locked(struct mlx_softc *sc);
136static int			mlx_start(struct mlx_command *mc);
137static int			mlx_done(struct mlx_softc *sc, int startio);
138static void			mlx_complete(struct mlx_softc *sc);
139
140/*
141 * Debugging.
142 */
143static char			*mlx_diagnose_command(struct mlx_command *mc);
144static void			mlx_describe_controller(struct mlx_softc *sc);
145static int			mlx_fw_message(struct mlx_softc *sc, int status, int param1, int param2);
146
147/*
148 * Utility functions.
149 */
150static struct mlx_sysdrive	*mlx_findunit(struct mlx_softc *sc, int unit);
151
152/********************************************************************************
153 ********************************************************************************
154                                                                Public Interfaces
155 ********************************************************************************
156 ********************************************************************************/
157
158/********************************************************************************
159 * Free all of the resources associated with (sc)
160 *
161 * Should not be called if the controller is active.
162 */
163void
164mlx_free(struct mlx_softc *sc)
165{
166    struct mlx_command	*mc;
167
168    debug_called(1);
169
170    /* destroy control device */
171    if (sc->mlx_dev_t != NULL)
172	destroy_dev(sc->mlx_dev_t);
173
174    if (sc->mlx_intr)
175	bus_teardown_intr(sc->mlx_dev, sc->mlx_irq, sc->mlx_intr);
176
177    /* cancel status timeout */
178    MLX_IO_LOCK(sc);
179    callout_stop(&sc->mlx_timeout);
180
181    /* throw away any command buffers */
182    while ((mc = TAILQ_FIRST(&sc->mlx_freecmds)) != NULL) {
183	TAILQ_REMOVE(&sc->mlx_freecmds, mc, mc_link);
184	mlx_freecmd(mc);
185    }
186    MLX_IO_UNLOCK(sc);
187    callout_drain(&sc->mlx_timeout);
188
189    /* destroy data-transfer DMA tag */
190    if (sc->mlx_buffer_dmat)
191	bus_dma_tag_destroy(sc->mlx_buffer_dmat);
192
193    /* free and destroy DMA memory and tag for s/g lists */
194    if (sc->mlx_sgtable)
195	bus_dmamem_free(sc->mlx_sg_dmat, sc->mlx_sgtable, sc->mlx_sg_dmamap);
196    if (sc->mlx_sg_dmat)
197	bus_dma_tag_destroy(sc->mlx_sg_dmat);
198
199    /* disconnect the interrupt handler */
200    if (sc->mlx_irq != NULL)
201	bus_release_resource(sc->mlx_dev, SYS_RES_IRQ, 0, sc->mlx_irq);
202
203    /* destroy the parent DMA tag */
204    if (sc->mlx_parent_dmat)
205	bus_dma_tag_destroy(sc->mlx_parent_dmat);
206
207    /* release the register window mapping */
208    if (sc->mlx_mem != NULL)
209	bus_release_resource(sc->mlx_dev, sc->mlx_mem_type, sc->mlx_mem_rid, sc->mlx_mem);
210
211    /* free controller enquiry data */
212    if (sc->mlx_enq2 != NULL)
213	free(sc->mlx_enq2, M_DEVBUF);
214
215    sx_destroy(&sc->mlx_config_lock);
216    mtx_destroy(&sc->mlx_io_lock);
217}
218
219/********************************************************************************
220 * Map the scatter/gather table into bus space
221 */
222static void
223mlx_dma_map_sg(void *arg, bus_dma_segment_t *segs, int nseg, int error)
224{
225    struct mlx_softc	*sc = (struct mlx_softc *)arg;
226
227    debug_called(1);
228
229    /* save base of s/g table's address in bus space */
230    sc->mlx_sgbusaddr = segs->ds_addr;
231}
232
233static int
234mlx_sglist_map(struct mlx_softc *sc)
235{
236    size_t	segsize;
237    int		error, ncmd;
238
239    debug_called(1);
240
241    /* destroy any existing mappings */
242    if (sc->mlx_sgtable)
243	bus_dmamem_free(sc->mlx_sg_dmat, sc->mlx_sgtable, sc->mlx_sg_dmamap);
244    if (sc->mlx_sg_dmat)
245	bus_dma_tag_destroy(sc->mlx_sg_dmat);
246
247    /*
248     * Create a single tag describing a region large enough to hold all of
249     * the s/g lists we will need.  If we're called early on, we don't know how
250     * many commands we're going to be asked to support, so only allocate enough
251     * for a couple.
252     */
253    if (sc->mlx_enq2 == NULL) {
254	ncmd = 2;
255    } else {
256	ncmd = sc->mlx_enq2->me_max_commands;
257    }
258    segsize = sizeof(struct mlx_sgentry) * MLX_NSEG * ncmd;
259    error = bus_dma_tag_create(sc->mlx_parent_dmat, 	/* parent */
260			       1, 0, 			/* alignment,boundary */
261			       BUS_SPACE_MAXADDR,	/* lowaddr */
262			       BUS_SPACE_MAXADDR, 	/* highaddr */
263			       NULL, NULL, 		/* filter, filterarg */
264			       segsize, 1,		/* maxsize, nsegments */
265			       BUS_SPACE_MAXSIZE_32BIT,	/* maxsegsize */
266			       0,			/* flags */
267			       NULL, NULL,		/* lockfunc, lockarg */
268			       &sc->mlx_sg_dmat);
269    if (error != 0) {
270	device_printf(sc->mlx_dev, "can't allocate scatter/gather DMA tag\n");
271	return(ENOMEM);
272    }
273
274    /*
275     * Allocate enough s/g maps for all commands and permanently map them into
276     * controller-visible space.
277     *
278     * XXX this assumes we can get enough space for all the s/g maps in one
279     * contiguous slab.  We may need to switch to a more complex arrangement
280     * where we allocate in smaller chunks and keep a lookup table from slot
281     * to bus address.
282     */
283    error = bus_dmamem_alloc(sc->mlx_sg_dmat, (void **)&sc->mlx_sgtable,
284			     BUS_DMA_NOWAIT, &sc->mlx_sg_dmamap);
285    if (error) {
286	device_printf(sc->mlx_dev, "can't allocate s/g table\n");
287	return(ENOMEM);
288    }
289    (void)bus_dmamap_load(sc->mlx_sg_dmat, sc->mlx_sg_dmamap, sc->mlx_sgtable,
290			  segsize, mlx_dma_map_sg, sc, 0);
291    return(0);
292}
293
294/********************************************************************************
295 * Initialise the controller and softc
296 */
297int
298mlx_attach(struct mlx_softc *sc)
299{
300    struct mlx_enquiry_old	*meo;
301    int				rid, error, fwminor, hscode, hserror, hsparam1, hsparam2, hsmsg;
302
303    debug_called(1);
304
305    /*
306     * Initialise per-controller queues.
307     */
308    TAILQ_INIT(&sc->mlx_work);
309    TAILQ_INIT(&sc->mlx_freecmds);
310    bioq_init(&sc->mlx_bioq);
311
312    /*
313     * Select accessor methods based on controller interface type.
314     */
315    switch(sc->mlx_iftype) {
316    case MLX_IFTYPE_2:
317    case MLX_IFTYPE_3:
318	sc->mlx_tryqueue	= mlx_v3_tryqueue;
319	sc->mlx_findcomplete	= mlx_v3_findcomplete;
320	sc->mlx_intaction	= mlx_v3_intaction;
321	sc->mlx_fw_handshake	= mlx_v3_fw_handshake;
322	break;
323    case MLX_IFTYPE_4:
324	sc->mlx_tryqueue	= mlx_v4_tryqueue;
325	sc->mlx_findcomplete	= mlx_v4_findcomplete;
326	sc->mlx_intaction	= mlx_v4_intaction;
327	sc->mlx_fw_handshake	= mlx_v4_fw_handshake;
328	break;
329    case MLX_IFTYPE_5:
330	sc->mlx_tryqueue	= mlx_v5_tryqueue;
331	sc->mlx_findcomplete	= mlx_v5_findcomplete;
332	sc->mlx_intaction	= mlx_v5_intaction;
333	sc->mlx_fw_handshake	= mlx_v5_fw_handshake;
334	break;
335    default:
336	return(ENXIO);		/* should never happen */
337    }
338
339    /* disable interrupts before we start talking to the controller */
340    MLX_IO_LOCK(sc);
341    sc->mlx_intaction(sc, MLX_INTACTION_DISABLE);
342    MLX_IO_UNLOCK(sc);
343
344    /*
345     * Wait for the controller to come ready, handshake with the firmware if required.
346     * This is typically only necessary on platforms where the controller BIOS does not
347     * run.
348     */
349    hsmsg = 0;
350    DELAY(1000);
351    while ((hscode = sc->mlx_fw_handshake(sc, &hserror, &hsparam1, &hsparam2,
352	hsmsg == 0)) != 0) {
353	/* report first time around... */
354	if (hsmsg == 0) {
355	    device_printf(sc->mlx_dev, "controller initialisation in progress...\n");
356	    hsmsg = 1;
357	}
358	/* did we get a real message? */
359	if (hscode == 2) {
360	    hscode = mlx_fw_message(sc, hserror, hsparam1, hsparam2);
361	    /* fatal initialisation error? */
362	    if (hscode != 0) {
363		return(ENXIO);
364	    }
365	}
366    }
367    if (hsmsg == 1)
368	device_printf(sc->mlx_dev, "initialisation complete.\n");
369
370    /*
371     * Allocate and connect our interrupt.
372     */
373    rid = 0;
374    sc->mlx_irq = bus_alloc_resource_any(sc->mlx_dev, SYS_RES_IRQ, &rid,
375        RF_SHAREABLE | RF_ACTIVE);
376    if (sc->mlx_irq == NULL) {
377	device_printf(sc->mlx_dev, "can't allocate interrupt\n");
378	return(ENXIO);
379    }
380    error = bus_setup_intr(sc->mlx_dev, sc->mlx_irq, INTR_TYPE_BIO |
381	INTR_ENTROPY | INTR_MPSAFE, NULL, mlx_intr, sc, &sc->mlx_intr);
382    if (error) {
383	device_printf(sc->mlx_dev, "can't set up interrupt\n");
384	return(ENXIO);
385    }
386
387    /*
388     * Create DMA tag for mapping buffers into controller-addressable space.
389     */
390    error = bus_dma_tag_create(sc->mlx_parent_dmat, 	/* parent */
391			       1, 0, 			/* align, boundary */
392			       BUS_SPACE_MAXADDR,	/* lowaddr */
393			       BUS_SPACE_MAXADDR, 	/* highaddr */
394			       NULL, NULL, 		/* filter, filterarg */
395			       MLX_MAXPHYS,		/* maxsize */
396			       MLX_NSEG,		/* nsegments */
397			       BUS_SPACE_MAXSIZE_32BIT,	/* maxsegsize */
398			       0,			/* flags */
399			       busdma_lock_mutex,	/* lockfunc */
400			       &sc->mlx_io_lock,	/* lockarg */
401			       &sc->mlx_buffer_dmat);
402    if (error != 0) {
403	device_printf(sc->mlx_dev, "can't allocate buffer DMA tag\n");
404	return(ENOMEM);
405    }
406
407    /*
408     * Create some initial scatter/gather mappings so we can run the probe
409     * commands.
410     */
411    error = mlx_sglist_map(sc);
412    if (error != 0) {
413	device_printf(sc->mlx_dev, "can't make initial s/g list mapping\n");
414	return(error);
415    }
416
417    /*
418     * We don't (yet) know where the event log is up to.
419     */
420    sc->mlx_currevent = -1;
421
422    /*
423     * Obtain controller feature information
424     */
425    MLX_IO_LOCK(sc);
426    if ((sc->mlx_enq2 = mlx_enquire(sc, MLX_CMD_ENQUIRY2, sizeof(struct mlx_enquiry2), NULL)) == NULL) {
427	MLX_IO_UNLOCK(sc);
428	device_printf(sc->mlx_dev, "ENQUIRY2 failed\n");
429	return(ENXIO);
430    }
431
432    /*
433     * Do quirk/feature related things.
434     */
435    fwminor = (sc->mlx_enq2->me_firmware_id >> 8) & 0xff;
436    switch(sc->mlx_iftype) {
437    case MLX_IFTYPE_2:
438	/* These controllers don't report the firmware version in the ENQUIRY2 response */
439	if ((meo = mlx_enquire(sc, MLX_CMD_ENQUIRY_OLD, sizeof(struct mlx_enquiry_old), NULL)) == NULL) {
440	    MLX_IO_UNLOCK(sc);
441	    device_printf(sc->mlx_dev, "ENQUIRY_OLD failed\n");
442	    return(ENXIO);
443	}
444	sc->mlx_enq2->me_firmware_id = ('0' << 24) | (0 << 16) | (meo->me_fwminor << 8) | meo->me_fwmajor;
445
446	/* XXX require 2.42 or better (PCI) or 2.14 or better (EISA) */
447	if (meo->me_fwminor < 42) {
448	    device_printf(sc->mlx_dev, " *** WARNING *** This firmware revision is not recommended\n");
449	    device_printf(sc->mlx_dev, " *** WARNING *** Use revision 2.42 or later\n");
450	}
451	free(meo, M_DEVBUF);
452	break;
453    case MLX_IFTYPE_3:
454	/* XXX certify 3.52? */
455	if (fwminor < 51) {
456	    device_printf(sc->mlx_dev, " *** WARNING *** This firmware revision is not recommended\n");
457	    device_printf(sc->mlx_dev, " *** WARNING *** Use revision 3.51 or later\n");
458	}
459	break;
460    case MLX_IFTYPE_4:
461	/* XXX certify firmware versions? */
462	if (fwminor < 6) {
463	    device_printf(sc->mlx_dev, " *** WARNING *** This firmware revision is not recommended\n");
464	    device_printf(sc->mlx_dev, " *** WARNING *** Use revision 4.06 or later\n");
465	}
466	break;
467    case MLX_IFTYPE_5:
468	if (fwminor < 7) {
469	    device_printf(sc->mlx_dev, " *** WARNING *** This firmware revision is not recommended\n");
470	    device_printf(sc->mlx_dev, " *** WARNING *** Use revision 5.07 or later\n");
471	}
472	break;
473    default:
474	MLX_IO_UNLOCK(sc);
475	return(ENXIO);		/* should never happen */
476    }
477    MLX_IO_UNLOCK(sc);
478
479    /*
480     * Create the final scatter/gather mappings now that we have characterised the controller.
481     */
482    error = mlx_sglist_map(sc);
483    if (error != 0) {
484	device_printf(sc->mlx_dev, "can't make final s/g list mapping\n");
485	return(error);
486    }
487
488    /*
489     * No user-requested background operation is in progress.
490     */
491    sc->mlx_background = 0;
492    sc->mlx_rebuildstat.rs_code = MLX_REBUILDSTAT_IDLE;
493
494    /*
495     * Create the control device.
496     */
497    sc->mlx_dev_t = make_dev(&mlx_cdevsw, 0, UID_ROOT, GID_OPERATOR,
498			     S_IRUSR | S_IWUSR, "mlx%d", device_get_unit(sc->mlx_dev));
499    sc->mlx_dev_t->si_drv1 = sc;
500
501    /*
502     * Start the timeout routine.
503     */
504    callout_reset(&sc->mlx_timeout, hz, mlx_periodic, sc);
505
506    /* print a little information about the controller */
507    mlx_describe_controller(sc);
508
509    return(0);
510}
511
512/********************************************************************************
513 * Locate disk resources and attach children to them.
514 */
515void
516mlx_startup(struct mlx_softc *sc)
517{
518    struct mlx_enq_sys_drive	*mes;
519    struct mlx_sysdrive		*dr;
520    int				i, error;
521
522    debug_called(1);
523
524    /*
525     * Scan all the system drives and attach children for those that
526     * don't currently have them.
527     */
528    MLX_IO_LOCK(sc);
529    mes = mlx_enquire(sc, MLX_CMD_ENQSYSDRIVE, sizeof(*mes) * MLX_MAXDRIVES, NULL);
530    MLX_IO_UNLOCK(sc);
531    if (mes == NULL) {
532	device_printf(sc->mlx_dev, "error fetching drive status\n");
533	return;
534    }
535
536    /* iterate over drives returned */
537    MLX_CONFIG_LOCK(sc);
538    for (i = 0, dr = &sc->mlx_sysdrive[0];
539	 (i < MLX_MAXDRIVES) && (mes[i].sd_size != 0xffffffff);
540	 i++, dr++) {
541	/* are we already attached to this drive? */
542    	if (dr->ms_disk == 0) {
543	    /* pick up drive information */
544	    dr->ms_size = mes[i].sd_size;
545	    dr->ms_raidlevel = mes[i].sd_raidlevel & 0xf;
546	    dr->ms_state = mes[i].sd_state;
547
548	    /* generate geometry information */
549	    if (sc->mlx_geom == MLX_GEOM_128_32) {
550		dr->ms_heads = 128;
551		dr->ms_sectors = 32;
552		dr->ms_cylinders = dr->ms_size / (128 * 32);
553	    } else {        /* MLX_GEOM_255/63 */
554		dr->ms_heads = 255;
555		dr->ms_sectors = 63;
556		dr->ms_cylinders = dr->ms_size / (255 * 63);
557	    }
558	    dr->ms_disk =  device_add_child(sc->mlx_dev, /*"mlxd"*/NULL, -1);
559	    if (dr->ms_disk == 0)
560		device_printf(sc->mlx_dev, "device_add_child failed\n");
561	    device_set_ivars(dr->ms_disk, dr);
562	}
563    }
564    free(mes, M_DEVBUF);
565    if ((error = bus_generic_attach(sc->mlx_dev)) != 0)
566	device_printf(sc->mlx_dev, "bus_generic_attach returned %d", error);
567
568    /* mark controller back up */
569    MLX_IO_LOCK(sc);
570    sc->mlx_state &= ~MLX_STATE_SHUTDOWN;
571
572    /* enable interrupts */
573    sc->mlx_intaction(sc, MLX_INTACTION_ENABLE);
574    MLX_IO_UNLOCK(sc);
575    MLX_CONFIG_UNLOCK(sc);
576}
577
578/********************************************************************************
579 * Disconnect from the controller completely, in preparation for unload.
580 */
581int
582mlx_detach(device_t dev)
583{
584    struct mlx_softc	*sc = device_get_softc(dev);
585    struct mlxd_softc	*mlxd;
586    int			i, error;
587
588    debug_called(1);
589
590    error = EBUSY;
591    MLX_CONFIG_LOCK(sc);
592    if (sc->mlx_state & MLX_STATE_OPEN)
593	goto out;
594
595    for (i = 0; i < MLX_MAXDRIVES; i++) {
596	if (sc->mlx_sysdrive[i].ms_disk != 0) {
597	    mlxd = device_get_softc(sc->mlx_sysdrive[i].ms_disk);
598	    if (mlxd->mlxd_flags & MLXD_OPEN) {		/* drive is mounted, abort detach */
599		device_printf(sc->mlx_sysdrive[i].ms_disk, "still open, can't detach\n");
600		goto out;
601	    }
602	}
603    }
604    if ((error = mlx_shutdown(dev)))
605	goto out;
606    MLX_CONFIG_UNLOCK(sc);
607
608    mlx_free(sc);
609
610    return (0);
611 out:
612    MLX_CONFIG_UNLOCK(sc);
613    return(error);
614}
615
616/********************************************************************************
617 * Bring the controller down to a dormant state and detach all child devices.
618 *
619 * This function is called before detach, system shutdown, or before performing
620 * an operation which may add or delete system disks.  (Call mlx_startup to
621 * resume normal operation.)
622 *
623 * Note that we can assume that the bioq on the controller is empty, as we won't
624 * allow shutdown if any device is open.
625 */
626int
627mlx_shutdown(device_t dev)
628{
629    struct mlx_softc	*sc = device_get_softc(dev);
630    int			error;
631
632    MLX_CONFIG_LOCK(sc);
633    error = mlx_shutdown_locked(sc);
634    MLX_CONFIG_UNLOCK(sc);
635    return (error);
636}
637
638static int
639mlx_shutdown_locked(struct mlx_softc *sc)
640{
641    int			i, error;
642
643    debug_called(1);
644
645    MLX_CONFIG_ASSERT_LOCKED(sc);
646
647    MLX_IO_LOCK(sc);
648    sc->mlx_state |= MLX_STATE_SHUTDOWN;
649    sc->mlx_intaction(sc, MLX_INTACTION_DISABLE);
650
651    /* flush controller */
652    device_printf(sc->mlx_dev, "flushing cache...");
653    if (mlx_flush(sc)) {
654	printf("failed\n");
655    } else {
656	printf("done\n");
657    }
658    MLX_IO_UNLOCK(sc);
659
660    /* delete all our child devices */
661    for (i = 0; i < MLX_MAXDRIVES; i++) {
662	if (sc->mlx_sysdrive[i].ms_disk != 0) {
663	    if ((error = device_delete_child(sc->mlx_dev, sc->mlx_sysdrive[i].ms_disk)) != 0)
664		return (error);
665	    sc->mlx_sysdrive[i].ms_disk = 0;
666	}
667    }
668
669    return (0);
670}
671
672/********************************************************************************
673 * Bring the controller to a quiescent state, ready for system suspend.
674 */
675int
676mlx_suspend(device_t dev)
677{
678    struct mlx_softc	*sc = device_get_softc(dev);
679
680    debug_called(1);
681
682    MLX_IO_LOCK(sc);
683    sc->mlx_state |= MLX_STATE_SUSPEND;
684
685    /* flush controller */
686    device_printf(sc->mlx_dev, "flushing cache...");
687    printf("%s\n", mlx_flush(sc) ? "failed" : "done");
688
689    sc->mlx_intaction(sc, MLX_INTACTION_DISABLE);
690    MLX_IO_UNLOCK(sc);
691
692    return(0);
693}
694
695/********************************************************************************
696 * Bring the controller back to a state ready for operation.
697 */
698int
699mlx_resume(device_t dev)
700{
701    struct mlx_softc	*sc = device_get_softc(dev);
702
703    debug_called(1);
704
705    MLX_IO_LOCK(sc);
706    sc->mlx_state &= ~MLX_STATE_SUSPEND;
707    sc->mlx_intaction(sc, MLX_INTACTION_ENABLE);
708    MLX_IO_UNLOCK(sc);
709
710    return(0);
711}
712
713/*******************************************************************************
714 * Take an interrupt, or be poked by other code to look for interrupt-worthy
715 * status.
716 */
717void
718mlx_intr(void *arg)
719{
720    struct mlx_softc	*sc = (struct mlx_softc *)arg;
721
722    debug_called(1);
723
724    /* collect finished commands, queue anything waiting */
725    MLX_IO_LOCK(sc);
726    mlx_done(sc, 1);
727    MLX_IO_UNLOCK(sc);
728};
729
730/*******************************************************************************
731 * Receive a buf structure from a child device and queue it on a particular
732 * disk resource, then poke the disk resource to start as much work as it can.
733 */
734int
735mlx_submit_buf(struct mlx_softc *sc, struct bio *bp)
736{
737
738    debug_called(1);
739
740    MLX_IO_ASSERT_LOCKED(sc);
741    bioq_insert_tail(&sc->mlx_bioq, bp);
742    sc->mlx_waitbufs++;
743    mlx_startio(sc);
744    return(0);
745}
746
747/********************************************************************************
748 * Accept an open operation on the control device.
749 */
750int
751mlx_open(struct cdev *dev, int flags, int fmt, struct thread *td)
752{
753    struct mlx_softc	*sc = dev->si_drv1;
754
755    MLX_CONFIG_LOCK(sc);
756    MLX_IO_LOCK(sc);
757    sc->mlx_state |= MLX_STATE_OPEN;
758    MLX_IO_UNLOCK(sc);
759    MLX_CONFIG_UNLOCK(sc);
760    return(0);
761}
762
763/********************************************************************************
764 * Accept the last close on the control device.
765 */
766int
767mlx_close(struct cdev *dev, int flags, int fmt, struct thread *td)
768{
769    struct mlx_softc	*sc = dev->si_drv1;
770
771    MLX_CONFIG_LOCK(sc);
772    MLX_IO_LOCK(sc);
773    sc->mlx_state &= ~MLX_STATE_OPEN;
774    MLX_IO_UNLOCK(sc);
775    MLX_CONFIG_UNLOCK(sc);
776    return (0);
777}
778
779/********************************************************************************
780 * Handle controller-specific control operations.
781 */
782int
783mlx_ioctl(struct cdev *dev, u_long cmd, caddr_t addr, int32_t flag, struct thread *td)
784{
785    struct mlx_softc		*sc = dev->si_drv1;
786    struct mlx_rebuild_request	*rb = (struct mlx_rebuild_request *)addr;
787    struct mlx_rebuild_status	*rs = (struct mlx_rebuild_status *)addr;
788    int				*arg = (int *)addr;
789    struct mlx_pause		*mp;
790    struct mlx_sysdrive		*dr;
791    struct mlxd_softc		*mlxd;
792    int				i, error;
793
794    switch(cmd) {
795	/*
796	 * Enumerate connected system drives; returns the first system drive's
797	 * unit number if *arg is -1, or the next unit after *arg if it's
798	 * a valid unit on this controller.
799	 */
800    case MLX_NEXT_CHILD:
801	/* search system drives */
802	MLX_CONFIG_LOCK(sc);
803	for (i = 0; i < MLX_MAXDRIVES; i++) {
804	    /* is this one attached? */
805	    if (sc->mlx_sysdrive[i].ms_disk != 0) {
806		/* looking for the next one we come across? */
807		if (*arg == -1) {
808		    *arg = device_get_unit(sc->mlx_sysdrive[i].ms_disk);
809		    MLX_CONFIG_UNLOCK(sc);
810		    return(0);
811		}
812		/* we want the one after this one */
813		if (*arg == device_get_unit(sc->mlx_sysdrive[i].ms_disk))
814		    *arg = -1;
815	    }
816	}
817	MLX_CONFIG_UNLOCK(sc);
818	return(ENOENT);
819
820	/*
821	 * Scan the controller to see whether new drives have appeared.
822	 */
823    case MLX_RESCAN_DRIVES:
824	mtx_lock(&Giant);
825	mlx_startup(sc);
826	mtx_unlock(&Giant);
827	return(0);
828
829	/*
830	 * Disconnect from the specified drive; it may be about to go
831	 * away.
832	 */
833    case MLX_DETACH_DRIVE:			/* detach one drive */
834	MLX_CONFIG_LOCK(sc);
835	if (((dr = mlx_findunit(sc, *arg)) == NULL) ||
836	    ((mlxd = device_get_softc(dr->ms_disk)) == NULL)) {
837	    MLX_CONFIG_UNLOCK(sc);
838	    return(ENOENT);
839	}
840
841	device_printf(dr->ms_disk, "detaching...");
842	error = 0;
843	if (mlxd->mlxd_flags & MLXD_OPEN) {
844	    error = EBUSY;
845	    goto detach_out;
846	}
847
848	/* flush controller */
849	MLX_IO_LOCK(sc);
850	if (mlx_flush(sc)) {
851	    MLX_IO_UNLOCK(sc);
852	    error = EBUSY;
853	    goto detach_out;
854	}
855	MLX_IO_UNLOCK(sc);
856
857	/* nuke drive */
858	if ((error = device_delete_child(sc->mlx_dev, dr->ms_disk)) != 0)
859	    goto detach_out;
860	dr->ms_disk = 0;
861
862    detach_out:
863	MLX_CONFIG_UNLOCK(sc);
864	if (error) {
865	    printf("failed\n");
866	} else {
867	    printf("done\n");
868	}
869	return(error);
870
871	/*
872	 * Pause one or more SCSI channels for a period of time, to assist
873	 * in the process of hot-swapping devices.
874	 *
875	 * Note that at least the 3.51 firmware on the DAC960PL doesn't seem
876	 * to do this right.
877	 */
878    case MLX_PAUSE_CHANNEL:			/* schedule a channel pause */
879	/* Does this command work on this firmware? */
880	if (!(sc->mlx_feature & MLX_FEAT_PAUSEWORKS))
881	    return(EOPNOTSUPP);
882
883	/* check time values */
884	mp = (struct mlx_pause *)addr;
885	if ((mp->mp_when < 0) || (mp->mp_when > 3600))
886	    return(EINVAL);
887	if ((mp->mp_howlong < 1) || (mp->mp_howlong > (0xf * 30)))
888	    return(EINVAL);
889
890	MLX_IO_LOCK(sc);
891	if ((mp->mp_which == MLX_PAUSE_CANCEL) && (sc->mlx_pause.mp_when != 0)) {
892	    /* cancel a pending pause operation */
893	    sc->mlx_pause.mp_which = 0;
894	} else {
895	    /* fix for legal channels */
896	    mp->mp_which &= ((1 << sc->mlx_enq2->me_actual_channels) -1);
897
898	    /* check for a pause currently running */
899	    if ((sc->mlx_pause.mp_which != 0) && (sc->mlx_pause.mp_when == 0)) {
900		MLX_IO_UNLOCK(sc);
901		return(EBUSY);
902	    }
903
904	    /* looks ok, go with it */
905	    sc->mlx_pause.mp_which = mp->mp_which;
906	    sc->mlx_pause.mp_when = time_second + mp->mp_when;
907	    sc->mlx_pause.mp_howlong = sc->mlx_pause.mp_when + mp->mp_howlong;
908	}
909	MLX_IO_UNLOCK(sc);
910	return(0);
911
912	/*
913	 * Accept a command passthrough-style.
914	 */
915    case MLX_COMMAND:
916	return(mlx_user_command(sc, (struct mlx_usercommand *)addr));
917
918	/*
919	 * Start a rebuild on a given SCSI disk
920	 */
921    case MLX_REBUILDASYNC:
922	MLX_IO_LOCK(sc);
923	if (sc->mlx_background != 0) {
924	    MLX_IO_UNLOCK(sc);
925	    rb->rr_status = 0x0106;
926	    return(EBUSY);
927	}
928	rb->rr_status = mlx_rebuild(sc, rb->rr_channel, rb->rr_target);
929	switch (rb->rr_status) {
930	case 0:
931	    error = 0;
932	    break;
933	case 0x10000:
934	    error = ENOMEM;		/* couldn't set up the command */
935	    break;
936	case 0x0002:
937	    error = EBUSY;
938	    break;
939	case 0x0104:
940	    error = EIO;
941	    break;
942	case 0x0105:
943	    error = ERANGE;
944	    break;
945	case 0x0106:
946	    error = EBUSY;
947	    break;
948	default:
949	    error = EINVAL;
950	    break;
951	}
952	if (error == 0)
953	    sc->mlx_background = MLX_BACKGROUND_REBUILD;
954	MLX_IO_UNLOCK(sc);
955	return(error);
956
957	/*
958	 * Get the status of the current rebuild or consistency check.
959	 */
960    case MLX_REBUILDSTAT:
961	MLX_IO_LOCK(sc);
962	*rs = sc->mlx_rebuildstat;
963	MLX_IO_UNLOCK(sc);
964	return(0);
965
966	/*
967	 * Return the per-controller system drive number matching the
968	 * disk device number in (arg), if it happens to belong to us.
969	 */
970    case MLX_GET_SYSDRIVE:
971	error = ENOENT;
972	MLX_CONFIG_LOCK(sc);
973	mtx_lock(&Giant);
974	mlxd = (struct mlxd_softc *)devclass_get_softc(mlxd_devclass, *arg);
975	mtx_unlock(&Giant);
976	if ((mlxd != NULL) && (mlxd->mlxd_drive >= sc->mlx_sysdrive) &&
977	    (mlxd->mlxd_drive < (sc->mlx_sysdrive + MLX_MAXDRIVES))) {
978	    error = 0;
979	    *arg = mlxd->mlxd_drive - sc->mlx_sysdrive;
980	}
981	MLX_CONFIG_UNLOCK(sc);
982	return(error);
983
984    default:
985	return(ENOTTY);
986    }
987}
988
989/********************************************************************************
990 * Handle operations requested by a System Drive connected to this controller.
991 */
992int
993mlx_submit_ioctl(struct mlx_softc *sc, struct mlx_sysdrive *drive, u_long cmd,
994		caddr_t addr, int32_t flag, struct thread *td)
995{
996    int				*arg = (int *)addr;
997    int				error, result;
998
999    switch(cmd) {
1000	/*
1001	 * Return the current status of this drive.
1002	 */
1003    case MLXD_STATUS:
1004	MLX_IO_LOCK(sc);
1005	*arg = drive->ms_state;
1006	MLX_IO_UNLOCK(sc);
1007	return(0);
1008
1009	/*
1010	 * Start a background consistency check on this drive.
1011	 */
1012    case MLXD_CHECKASYNC:		/* start a background consistency check */
1013	MLX_IO_LOCK(sc);
1014	if (sc->mlx_background != 0) {
1015	    MLX_IO_UNLOCK(sc);
1016	    *arg = 0x0106;
1017	    return(EBUSY);
1018	}
1019	result = mlx_check(sc, drive - &sc->mlx_sysdrive[0]);
1020	switch (result) {
1021	case 0:
1022	    error = 0;
1023	    break;
1024	case 0x10000:
1025	    error = ENOMEM;		/* couldn't set up the command */
1026	    break;
1027	case 0x0002:
1028	    error = EIO;
1029	    break;
1030	case 0x0105:
1031	    error = ERANGE;
1032	    break;
1033	case 0x0106:
1034	    error = EBUSY;
1035	    break;
1036	default:
1037	    error = EINVAL;
1038	    break;
1039	}
1040	if (error == 0)
1041	    sc->mlx_background = MLX_BACKGROUND_CHECK;
1042	MLX_IO_UNLOCK(sc);
1043	*arg = result;
1044	return(error);
1045
1046    }
1047    return(ENOIOCTL);
1048}
1049
1050
1051/********************************************************************************
1052 ********************************************************************************
1053                                                                Status Monitoring
1054 ********************************************************************************
1055 ********************************************************************************/
1056
1057/********************************************************************************
1058 * Fire off commands to periodically check the status of connected drives.
1059 */
1060static void
1061mlx_periodic(void *data)
1062{
1063    struct mlx_softc *sc = (struct mlx_softc *)data;
1064
1065    debug_called(1);
1066    MLX_IO_ASSERT_LOCKED(sc);
1067
1068    /*
1069     * Run a bus pause?
1070     */
1071    if ((sc->mlx_pause.mp_which != 0) &&
1072	(sc->mlx_pause.mp_when > 0) &&
1073	(time_second >= sc->mlx_pause.mp_when)){
1074
1075	mlx_pause_action(sc);		/* pause is running */
1076	sc->mlx_pause.mp_when = 0;
1077	sysbeep(500, hz);
1078
1079	/*
1080	 * Bus pause still running?
1081	 */
1082    } else if ((sc->mlx_pause.mp_which != 0) &&
1083	       (sc->mlx_pause.mp_when == 0)) {
1084
1085	/* time to stop bus pause? */
1086	if (time_second >= sc->mlx_pause.mp_howlong) {
1087	    mlx_pause_action(sc);
1088	    sc->mlx_pause.mp_which = 0;	/* pause is complete */
1089	    sysbeep(500, hz);
1090	} else {
1091	    sysbeep((time_second % 5) * 100 + 500, hz/8);
1092	}
1093
1094	/*
1095	 * Run normal periodic activities?
1096	 */
1097    } else if (time_second > (sc->mlx_lastpoll + 10)) {
1098	sc->mlx_lastpoll = time_second;
1099
1100	/*
1101	 * Check controller status.
1102	 *
1103	 * XXX Note that this may not actually launch a command in situations of high load.
1104	 */
1105	mlx_enquire(sc, (sc->mlx_iftype == MLX_IFTYPE_2) ? MLX_CMD_ENQUIRY_OLD : MLX_CMD_ENQUIRY,
1106		    imax(sizeof(struct mlx_enquiry), sizeof(struct mlx_enquiry_old)), mlx_periodic_enquiry);
1107
1108	/*
1109	 * Check system drive status.
1110	 *
1111	 * XXX This might be better left to event-driven detection, eg. I/O to an offline
1112	 *     drive will detect it's offline, rebuilds etc. should detect the drive is back
1113	 *     online.
1114	 */
1115	mlx_enquire(sc, MLX_CMD_ENQSYSDRIVE, sizeof(struct mlx_enq_sys_drive) * MLX_MAXDRIVES,
1116			mlx_periodic_enquiry);
1117
1118    }
1119
1120    /* get drive rebuild/check status */
1121    /* XXX should check sc->mlx_background if this is only valid while in progress */
1122    mlx_enquire(sc, MLX_CMD_REBUILDSTAT, sizeof(struct mlx_rebuild_stat), mlx_periodic_rebuild);
1123
1124    /* deal with possibly-missed interrupts and timed-out commands */
1125    mlx_done(sc, 1);
1126
1127    /* reschedule another poll next second or so */
1128    callout_reset(&sc->mlx_timeout, hz, mlx_periodic, sc);
1129}
1130
1131/********************************************************************************
1132 * Handle the result of an ENQUIRY command instigated by periodic status polling.
1133 */
1134static void
1135mlx_periodic_enquiry(struct mlx_command *mc)
1136{
1137    struct mlx_softc		*sc = mc->mc_sc;
1138
1139    debug_called(1);
1140    MLX_IO_ASSERT_LOCKED(sc);
1141
1142    /* Command completed OK? */
1143    if (mc->mc_status != 0) {
1144	device_printf(sc->mlx_dev, "periodic enquiry failed - %s\n", mlx_diagnose_command(mc));
1145	goto out;
1146    }
1147
1148    /* respond to command */
1149    switch(mc->mc_mailbox[0]) {
1150	/*
1151	 * This is currently a bit fruitless, as we don't know how to extract the eventlog
1152	 * pointer yet.
1153	 */
1154    case MLX_CMD_ENQUIRY_OLD:
1155    {
1156	struct mlx_enquiry		*me = (struct mlx_enquiry *)mc->mc_data;
1157	struct mlx_enquiry_old		*meo = (struct mlx_enquiry_old *)mc->mc_data;
1158	int				i;
1159
1160	/* convert data in-place to new format */
1161	for (i = (sizeof(me->me_dead) / sizeof(me->me_dead[0])) - 1; i >= 0; i--) {
1162	    me->me_dead[i].dd_chan = meo->me_dead[i].dd_chan;
1163	    me->me_dead[i].dd_targ = meo->me_dead[i].dd_targ;
1164	}
1165	me->me_misc_flags        = 0;
1166	me->me_rebuild_count     = meo->me_rebuild_count;
1167	me->me_dead_count        = meo->me_dead_count;
1168	me->me_critical_sd_count = meo->me_critical_sd_count;
1169	me->me_event_log_seq_num = 0;
1170	me->me_offline_sd_count  = meo->me_offline_sd_count;
1171	me->me_max_commands      = meo->me_max_commands;
1172	me->me_rebuild_flag      = meo->me_rebuild_flag;
1173	me->me_fwmajor           = meo->me_fwmajor;
1174	me->me_fwminor           = meo->me_fwminor;
1175	me->me_status_flags      = meo->me_status_flags;
1176	me->me_flash_age         = meo->me_flash_age;
1177	for (i = (sizeof(me->me_drvsize) / sizeof(me->me_drvsize[0])) - 1; i >= 0; i--) {
1178	    if (i > ((sizeof(meo->me_drvsize) / sizeof(meo->me_drvsize[0])) - 1)) {
1179		me->me_drvsize[i] = 0;		/* drive beyond supported range */
1180	    } else {
1181		me->me_drvsize[i] = meo->me_drvsize[i];
1182	    }
1183	}
1184	me->me_num_sys_drvs = meo->me_num_sys_drvs;
1185    }
1186    /* FALLTHROUGH */
1187
1188	/*
1189	 * Generic controller status update.  We could do more with this than just
1190	 * checking the event log.
1191	 */
1192    case MLX_CMD_ENQUIRY:
1193    {
1194	struct mlx_enquiry		*me = (struct mlx_enquiry *)mc->mc_data;
1195
1196	if (sc->mlx_currevent == -1) {
1197	    /* initialise our view of the event log */
1198	    sc->mlx_currevent = sc->mlx_lastevent = me->me_event_log_seq_num;
1199	} else if ((me->me_event_log_seq_num != sc->mlx_lastevent) && !(sc->mlx_flags & MLX_EVENTLOG_BUSY)) {
1200	    /* record where current events are up to */
1201	    sc->mlx_currevent = me->me_event_log_seq_num;
1202	    debug(1, "event log pointer was %d, now %d\n", sc->mlx_lastevent, sc->mlx_currevent);
1203
1204	    /* mark the event log as busy */
1205	    sc->mlx_flags |= MLX_EVENTLOG_BUSY;
1206
1207	    /* drain new eventlog entries */
1208	    mlx_periodic_eventlog_poll(sc);
1209	}
1210	break;
1211    }
1212    case MLX_CMD_ENQSYSDRIVE:
1213    {
1214	struct mlx_enq_sys_drive	*mes = (struct mlx_enq_sys_drive *)mc->mc_data;
1215	struct mlx_sysdrive		*dr;
1216	int				i;
1217
1218	for (i = 0, dr = &sc->mlx_sysdrive[0];
1219	     (i < MLX_MAXDRIVES) && (mes[i].sd_size != 0xffffffff);
1220	     i++) {
1221
1222	    /* has state been changed by controller? */
1223	    if (dr->ms_state != mes[i].sd_state) {
1224		switch(mes[i].sd_state) {
1225		case MLX_SYSD_OFFLINE:
1226		    device_printf(dr->ms_disk, "drive offline\n");
1227		    break;
1228		case MLX_SYSD_ONLINE:
1229		    device_printf(dr->ms_disk, "drive online\n");
1230		    break;
1231		case MLX_SYSD_CRITICAL:
1232		    device_printf(dr->ms_disk, "drive critical\n");
1233		    break;
1234		}
1235		/* save new state */
1236		dr->ms_state = mes[i].sd_state;
1237	    }
1238	}
1239	break;
1240    }
1241    default:
1242	device_printf(sc->mlx_dev, "%s: unknown command 0x%x", __func__, mc->mc_mailbox[0]);
1243	break;
1244    }
1245
1246 out:
1247    free(mc->mc_data, M_DEVBUF);
1248    mlx_releasecmd(mc);
1249}
1250
1251static void
1252mlx_eventlog_cb(void *arg, bus_dma_segment_t *segs, int nsegments, int error)
1253{
1254    struct mlx_command *mc;
1255
1256    mc = (struct mlx_command *)arg;
1257    mlx_setup_dmamap(mc, segs, nsegments, error);
1258
1259    /* build the command to get one entry */
1260    mlx_make_type3(mc, MLX_CMD_LOGOP, MLX_LOGOP_GET, 1,
1261		   mc->mc_sc->mlx_lastevent, 0, 0, mc->mc_dataphys, 0);
1262    mc->mc_complete = mlx_periodic_eventlog_respond;
1263    mc->mc_private = mc;
1264
1265    /* start the command */
1266    if (mlx_start(mc) != 0) {
1267	mlx_releasecmd(mc);
1268	free(mc->mc_data, M_DEVBUF);
1269	mc->mc_data = NULL;
1270    }
1271
1272}
1273
1274/********************************************************************************
1275 * Instigate a poll for one event log message on (sc).
1276 * We only poll for one message at a time, to keep our command usage down.
1277 */
1278static void
1279mlx_periodic_eventlog_poll(struct mlx_softc *sc)
1280{
1281    struct mlx_command	*mc;
1282    void		*result = NULL;
1283    int			error = 0;
1284
1285    debug_called(1);
1286    MLX_IO_ASSERT_LOCKED(sc);
1287
1288    /* get ourselves a command buffer */
1289    error = 1;
1290    if ((mc = mlx_alloccmd(sc)) == NULL)
1291	goto out;
1292
1293    /* allocate the response structure */
1294    if ((result = malloc(/*sizeof(struct mlx_eventlog_entry)*/1024, M_DEVBUF,
1295			 M_NOWAIT)) == NULL)
1296	goto out;
1297
1298    /* get a command slot */
1299    if (mlx_getslot(mc))
1300	goto out;
1301
1302    /* map the command so the controller can see it */
1303    mc->mc_data = result;
1304    mc->mc_length = /*sizeof(struct mlx_eventlog_entry)*/1024;
1305    error = bus_dmamap_load(sc->mlx_buffer_dmat, mc->mc_dmamap, mc->mc_data,
1306			    mc->mc_length, mlx_eventlog_cb, mc, BUS_DMA_NOWAIT);
1307
1308 out:
1309    if (error != 0) {
1310	if (mc != NULL)
1311	    mlx_releasecmd(mc);
1312	if ((result != NULL) && (mc->mc_data != NULL))
1313	    free(result, M_DEVBUF);
1314    }
1315}
1316
1317/********************************************************************************
1318 * Handle the result of polling for a log message, generate diagnostic output.
1319 * If this wasn't the last message waiting for us, we'll go collect another.
1320 */
1321static char *mlx_sense_messages[] = {
1322    "because write recovery failed",
1323    "because of SCSI bus reset failure",
1324    "because of double check condition",
1325    "because it was removed",
1326    "because of gross error on SCSI chip",
1327    "because of bad tag returned from drive",
1328    "because of timeout on SCSI command",
1329    "because of reset SCSI command issued from system",
1330    "because busy or parity error count exceeded limit",
1331    "because of 'kill drive' command from system",
1332    "because of selection timeout",
1333    "due to SCSI phase sequence error",
1334    "due to unknown status"
1335};
1336
1337static void
1338mlx_periodic_eventlog_respond(struct mlx_command *mc)
1339{
1340    struct mlx_softc		*sc = mc->mc_sc;
1341    struct mlx_eventlog_entry	*el = (struct mlx_eventlog_entry *)mc->mc_data;
1342    char			*reason;
1343
1344    debug_called(1);
1345    MLX_IO_ASSERT_LOCKED(sc);
1346
1347    sc->mlx_lastevent++;		/* next message... */
1348    if (mc->mc_status == 0) {
1349
1350	/* handle event log message */
1351	switch(el->el_type) {
1352	    /*
1353	     * This is the only sort of message we understand at the moment.
1354	     * The tests here are probably incomplete.
1355	     */
1356	case MLX_LOGMSG_SENSE:	/* sense data */
1357	    /* Mylex vendor-specific message indicating a drive was killed? */
1358	    if ((el->el_sensekey == 9) &&
1359		(el->el_asc == 0x80)) {
1360		if (el->el_asq < (sizeof(mlx_sense_messages) / sizeof(mlx_sense_messages[0]))) {
1361		    reason = mlx_sense_messages[el->el_asq];
1362		} else {
1363		    reason = "for unknown reason";
1364		}
1365		device_printf(sc->mlx_dev, "physical drive %d:%d killed %s\n",
1366			      el->el_channel, el->el_target, reason);
1367	    }
1368	    /* SCSI drive was reset? */
1369	    if ((el->el_sensekey == 6) && (el->el_asc == 0x29)) {
1370		device_printf(sc->mlx_dev, "physical drive %d:%d reset\n",
1371			      el->el_channel, el->el_target);
1372	    }
1373	    /* SCSI drive error? */
1374	    if (!((el->el_sensekey == 0) ||
1375		  ((el->el_sensekey == 2) &&
1376		   (el->el_asc == 0x04) &&
1377		   ((el->el_asq == 0x01) ||
1378		    (el->el_asq == 0x02))))) {
1379		device_printf(sc->mlx_dev, "physical drive %d:%d error log: sense = %d asc = %x asq = %x\n",
1380			      el->el_channel, el->el_target, el->el_sensekey, el->el_asc, el->el_asq);
1381		device_printf(sc->mlx_dev, "  info %4D csi %4D\n", el->el_information, ":", el->el_csi, ":");
1382	    }
1383	    break;
1384
1385	default:
1386	    device_printf(sc->mlx_dev, "unknown log message type 0x%x\n", el->el_type);
1387	    break;
1388	}
1389    } else {
1390	device_printf(sc->mlx_dev, "error reading message log - %s\n", mlx_diagnose_command(mc));
1391	/* give up on all the outstanding messages, as we may have come unsynched */
1392	sc->mlx_lastevent = sc->mlx_currevent;
1393    }
1394
1395    /* dispose of command and data */
1396    free(mc->mc_data, M_DEVBUF);
1397    mlx_releasecmd(mc);
1398
1399    /* is there another message to obtain? */
1400    if (sc->mlx_lastevent != sc->mlx_currevent) {
1401	mlx_periodic_eventlog_poll(sc);
1402    } else {
1403	/* clear log-busy status */
1404	sc->mlx_flags &= ~MLX_EVENTLOG_BUSY;
1405    }
1406}
1407
1408/********************************************************************************
1409 * Handle check/rebuild operations in progress.
1410 */
1411static void
1412mlx_periodic_rebuild(struct mlx_command *mc)
1413{
1414    struct mlx_softc		*sc = mc->mc_sc;
1415    struct mlx_rebuild_status	*mr = (struct mlx_rebuild_status *)mc->mc_data;
1416
1417    MLX_IO_ASSERT_LOCKED(sc);
1418    switch(mc->mc_status) {
1419    case 0:				/* operation running, update stats */
1420	sc->mlx_rebuildstat = *mr;
1421
1422	/* spontaneous rebuild/check? */
1423	if (sc->mlx_background == 0) {
1424	    sc->mlx_background = MLX_BACKGROUND_SPONTANEOUS;
1425	    device_printf(sc->mlx_dev, "background check/rebuild operation started\n");
1426	}
1427	break;
1428
1429    case 0x0105:			/* nothing running, finalise stats and report */
1430	switch(sc->mlx_background) {
1431	case MLX_BACKGROUND_CHECK:
1432	    device_printf(sc->mlx_dev, "consistency check completed\n");	/* XXX print drive? */
1433	    break;
1434	case MLX_BACKGROUND_REBUILD:
1435	    device_printf(sc->mlx_dev, "drive rebuild completed\n");	/* XXX print channel/target? */
1436	    break;
1437	case MLX_BACKGROUND_SPONTANEOUS:
1438	default:
1439	    /* if we have previously been non-idle, report the transition */
1440	    if (sc->mlx_rebuildstat.rs_code != MLX_REBUILDSTAT_IDLE) {
1441		device_printf(sc->mlx_dev, "background check/rebuild operation completed\n");
1442	    }
1443	}
1444	sc->mlx_background = 0;
1445	sc->mlx_rebuildstat.rs_code = MLX_REBUILDSTAT_IDLE;
1446	break;
1447    }
1448    free(mc->mc_data, M_DEVBUF);
1449    mlx_releasecmd(mc);
1450}
1451
1452/********************************************************************************
1453 ********************************************************************************
1454                                                                    Channel Pause
1455 ********************************************************************************
1456 ********************************************************************************/
1457
1458/********************************************************************************
1459 * It's time to perform a channel pause action for (sc), either start or stop
1460 * the pause.
1461 */
1462static void
1463mlx_pause_action(struct mlx_softc *sc)
1464{
1465    struct mlx_command	*mc;
1466    int			failsafe, i, command;
1467
1468    MLX_IO_ASSERT_LOCKED(sc);
1469
1470    /* What are we doing here? */
1471    if (sc->mlx_pause.mp_when == 0) {
1472	command = MLX_CMD_STARTCHANNEL;
1473	failsafe = 0;
1474
1475    } else {
1476	command = MLX_CMD_STOPCHANNEL;
1477
1478	/*
1479	 * Channels will always start again after the failsafe period,
1480	 * which is specified in multiples of 30 seconds.
1481	 * This constrains us to a maximum pause of 450 seconds.
1482	 */
1483	failsafe = ((sc->mlx_pause.mp_howlong - time_second) + 5) / 30;
1484	if (failsafe > 0xf) {
1485	    failsafe = 0xf;
1486	    sc->mlx_pause.mp_howlong = time_second + (0xf * 30) - 5;
1487	}
1488    }
1489
1490    /* build commands for every channel requested */
1491    for (i = 0; i < sc->mlx_enq2->me_actual_channels; i++) {
1492	if ((1 << i) & sc->mlx_pause.mp_which) {
1493
1494	    /* get ourselves a command buffer */
1495	    if ((mc = mlx_alloccmd(sc)) == NULL)
1496		goto fail;
1497	    /* get a command slot */
1498	    mc->mc_flags |= MLX_CMD_PRIORITY;
1499	    if (mlx_getslot(mc))
1500		goto fail;
1501
1502	    /* build the command */
1503	    mlx_make_type2(mc, command, (failsafe << 4) | i, 0, 0, 0, 0, 0, 0, 0);
1504	    mc->mc_complete = mlx_pause_done;
1505	    mc->mc_private = sc;		/* XXX not needed */
1506	    if (mlx_start(mc))
1507		goto fail;
1508	    /* command submitted OK */
1509	    return;
1510
1511	fail:
1512	    device_printf(sc->mlx_dev, "%s failed for channel %d\n",
1513			  command == MLX_CMD_STOPCHANNEL ? "pause" : "resume", i);
1514	    if (mc != NULL)
1515		mlx_releasecmd(mc);
1516	}
1517    }
1518}
1519
1520static void
1521mlx_pause_done(struct mlx_command *mc)
1522{
1523    struct mlx_softc	*sc = mc->mc_sc;
1524    int			command = mc->mc_mailbox[0];
1525    int			channel = mc->mc_mailbox[2] & 0xf;
1526
1527    MLX_IO_ASSERT_LOCKED(sc);
1528    if (mc->mc_status != 0) {
1529	device_printf(sc->mlx_dev, "%s command failed - %s\n",
1530		      command == MLX_CMD_STOPCHANNEL ? "pause" : "resume", mlx_diagnose_command(mc));
1531    } else if (command == MLX_CMD_STOPCHANNEL) {
1532	device_printf(sc->mlx_dev, "channel %d pausing for %ld seconds\n",
1533		      channel, (long)(sc->mlx_pause.mp_howlong - time_second));
1534    } else {
1535	device_printf(sc->mlx_dev, "channel %d resuming\n", channel);
1536    }
1537    mlx_releasecmd(mc);
1538}
1539
1540/********************************************************************************
1541 ********************************************************************************
1542                                                               Command Submission
1543 ********************************************************************************
1544 ********************************************************************************/
1545
1546static void
1547mlx_enquire_cb(void *arg, bus_dma_segment_t *segs, int nsegments, int error)
1548{
1549    struct mlx_softc *sc;
1550    struct mlx_command *mc;
1551
1552    mc = (struct mlx_command *)arg;
1553    if (error)
1554	return;
1555
1556    mlx_setup_dmamap(mc, segs, nsegments, error);
1557
1558    /* build an enquiry command */
1559    sc = mc->mc_sc;
1560    mlx_make_type2(mc, mc->mc_command, 0, 0, 0, 0, 0, 0, mc->mc_dataphys, 0);
1561
1562    /* do we want a completion callback? */
1563    if (mc->mc_complete != NULL) {
1564	if ((error = mlx_start(mc)) != 0)
1565	    return;
1566    } else {
1567	/* run the command in either polled or wait mode */
1568	if ((sc->mlx_state & MLX_STATE_INTEN) ? mlx_wait_command(mc) :
1569						mlx_poll_command(mc))
1570	    return;
1571
1572	/* command completed OK? */
1573	if (mc->mc_status != 0) {
1574	    device_printf(sc->mlx_dev, "ENQUIRY failed - %s\n",
1575			  mlx_diagnose_command(mc));
1576	    return;
1577	}
1578    }
1579}
1580
1581/********************************************************************************
1582 * Perform an Enquiry command using a type-3 command buffer and a return a single
1583 * linear result buffer.  If the completion function is specified, it will
1584 * be called with the completed command (and the result response will not be
1585 * valid until that point).  Otherwise, the command will either be busy-waited
1586 * for (interrupts not enabled), or slept for.
1587 */
1588static void *
1589mlx_enquire(struct mlx_softc *sc, int command, size_t bufsize, void (* complete)(struct mlx_command *mc))
1590{
1591    struct mlx_command	*mc;
1592    void		*result;
1593    int			error;
1594
1595    debug_called(1);
1596    MLX_IO_ASSERT_LOCKED(sc);
1597
1598    /* get ourselves a command buffer */
1599    error = 1;
1600    result = NULL;
1601    if ((mc = mlx_alloccmd(sc)) == NULL)
1602	goto out;
1603    /* allocate the response structure */
1604    if ((result = malloc(bufsize, M_DEVBUF, M_NOWAIT)) == NULL)
1605	goto out;
1606    /* get a command slot */
1607    mc->mc_flags |= MLX_CMD_PRIORITY | MLX_CMD_DATAOUT;
1608    if (mlx_getslot(mc))
1609	goto out;
1610
1611    /* map the command so the controller can see it */
1612    mc->mc_data = result;
1613    mc->mc_length = bufsize;
1614    mc->mc_command = command;
1615
1616    if (complete != NULL) {
1617	mc->mc_complete = complete;
1618	mc->mc_private = mc;
1619    }
1620
1621    error = bus_dmamap_load(sc->mlx_buffer_dmat, mc->mc_dmamap, mc->mc_data,
1622			    mc->mc_length, mlx_enquire_cb, mc, BUS_DMA_NOWAIT);
1623
1624 out:
1625    /* we got a command, but nobody else will free it */
1626    if ((mc != NULL) && (mc->mc_complete == NULL))
1627	mlx_releasecmd(mc);
1628    /* we got an error, and we allocated a result */
1629    if ((error != 0) && (result != NULL)) {
1630	free(result, M_DEVBUF);
1631	result = NULL;
1632    }
1633    return(result);
1634}
1635
1636
1637/********************************************************************************
1638 * Perform a Flush command on the nominated controller.
1639 *
1640 * May be called with interrupts enabled or disabled; will not return until
1641 * the flush operation completes or fails.
1642 */
1643static int
1644mlx_flush(struct mlx_softc *sc)
1645{
1646    struct mlx_command	*mc;
1647    int			error;
1648
1649    debug_called(1);
1650    MLX_IO_ASSERT_LOCKED(sc);
1651
1652    /* get ourselves a command buffer */
1653    error = 1;
1654    if ((mc = mlx_alloccmd(sc)) == NULL)
1655	goto out;
1656    /* get a command slot */
1657    if (mlx_getslot(mc))
1658	goto out;
1659
1660    /* build a flush command */
1661    mlx_make_type2(mc, MLX_CMD_FLUSH, 0, 0, 0, 0, 0, 0, 0, 0);
1662
1663    /* can't assume that interrupts are going to work here, so play it safe */
1664    if (mlx_poll_command(mc))
1665	goto out;
1666
1667    /* command completed OK? */
1668    if (mc->mc_status != 0) {
1669	device_printf(sc->mlx_dev, "FLUSH failed - %s\n", mlx_diagnose_command(mc));
1670	goto out;
1671    }
1672
1673    error = 0;			/* success */
1674 out:
1675    if (mc != NULL)
1676	mlx_releasecmd(mc);
1677    return(error);
1678}
1679
1680/********************************************************************************
1681 * Start a background consistency check on (drive).
1682 *
1683 * May be called with interrupts enabled or disabled; will return as soon as the
1684 * operation has started or been refused.
1685 */
1686static int
1687mlx_check(struct mlx_softc *sc, int drive)
1688{
1689    struct mlx_command	*mc;
1690    int			error;
1691
1692    debug_called(1);
1693    MLX_IO_ASSERT_LOCKED(sc);
1694
1695    /* get ourselves a command buffer */
1696    error = 0x10000;
1697    if ((mc = mlx_alloccmd(sc)) == NULL)
1698	goto out;
1699    /* get a command slot */
1700    if (mlx_getslot(mc))
1701	goto out;
1702
1703    /* build a checkasync command, set the "fix it" flag */
1704    mlx_make_type2(mc, MLX_CMD_CHECKASYNC, 0, 0, 0, 0, 0, drive | 0x80, 0, 0);
1705
1706    /* start the command and wait for it to be returned */
1707    if (mlx_wait_command(mc))
1708	goto out;
1709
1710    /* command completed OK? */
1711    if (mc->mc_status != 0) {
1712	device_printf(sc->mlx_dev, "CHECK ASYNC failed - %s\n", mlx_diagnose_command(mc));
1713    } else {
1714	device_printf(sc->mlx_sysdrive[drive].ms_disk, "consistency check started");
1715    }
1716    error = mc->mc_status;
1717
1718 out:
1719    if (mc != NULL)
1720	mlx_releasecmd(mc);
1721    return(error);
1722}
1723
1724/********************************************************************************
1725 * Start a background rebuild of the physical drive at (channel),(target).
1726 *
1727 * May be called with interrupts enabled or disabled; will return as soon as the
1728 * operation has started or been refused.
1729 */
1730static int
1731mlx_rebuild(struct mlx_softc *sc, int channel, int target)
1732{
1733    struct mlx_command	*mc;
1734    int			error;
1735
1736    debug_called(1);
1737    MLX_IO_ASSERT_LOCKED(sc);
1738
1739    /* get ourselves a command buffer */
1740    error = 0x10000;
1741    if ((mc = mlx_alloccmd(sc)) == NULL)
1742	goto out;
1743    /* get a command slot */
1744    if (mlx_getslot(mc))
1745	goto out;
1746
1747    /* build a checkasync command, set the "fix it" flag */
1748    mlx_make_type2(mc, MLX_CMD_REBUILDASYNC, channel, target, 0, 0, 0, 0, 0, 0);
1749
1750    /* start the command and wait for it to be returned */
1751    if (mlx_wait_command(mc))
1752	goto out;
1753
1754    /* command completed OK? */
1755    if (mc->mc_status != 0) {
1756	device_printf(sc->mlx_dev, "REBUILD ASYNC failed - %s\n", mlx_diagnose_command(mc));
1757    } else {
1758	device_printf(sc->mlx_dev, "drive rebuild started for %d:%d\n", channel, target);
1759    }
1760    error = mc->mc_status;
1761
1762 out:
1763    if (mc != NULL)
1764	mlx_releasecmd(mc);
1765    return(error);
1766}
1767
1768/********************************************************************************
1769 * Run the command (mc) and return when it completes.
1770 *
1771 * Interrupts need to be enabled; returns nonzero on error.
1772 */
1773static int
1774mlx_wait_command(struct mlx_command *mc)
1775{
1776    struct mlx_softc	*sc = mc->mc_sc;
1777    int			error, count;
1778
1779    debug_called(1);
1780    MLX_IO_ASSERT_LOCKED(sc);
1781
1782    mc->mc_complete = NULL;
1783    mc->mc_private = mc;		/* wake us when you're done */
1784    if ((error = mlx_start(mc)) != 0)
1785	return(error);
1786
1787    count = 0;
1788    /* XXX better timeout? */
1789    while ((mc->mc_status == MLX_STATUS_BUSY) && (count < 30)) {
1790	mtx_sleep(mc->mc_private, &sc->mlx_io_lock, PRIBIO | PCATCH, "mlxwcmd", hz);
1791    }
1792
1793    if (mc->mc_status != 0) {
1794	device_printf(sc->mlx_dev, "command failed - %s\n", mlx_diagnose_command(mc));
1795	return(EIO);
1796    }
1797    return(0);
1798}
1799
1800
1801/********************************************************************************
1802 * Start the command (mc) and busy-wait for it to complete.
1803 *
1804 * Should only be used when interrupts can't be relied upon. Returns 0 on
1805 * success, nonzero on error.
1806 * Successfully completed commands are dequeued.
1807 */
1808static int
1809mlx_poll_command(struct mlx_command *mc)
1810{
1811    struct mlx_softc	*sc = mc->mc_sc;
1812    int			error, count;
1813
1814    debug_called(1);
1815    MLX_IO_ASSERT_LOCKED(sc);
1816
1817    mc->mc_complete = NULL;
1818    mc->mc_private = NULL;	/* we will poll for it */
1819    if ((error = mlx_start(mc)) != 0)
1820	return(error);
1821
1822    count = 0;
1823    do {
1824	/* poll for completion */
1825	mlx_done(mc->mc_sc, 1);
1826
1827    } while ((mc->mc_status == MLX_STATUS_BUSY) && (count++ < 15000000));
1828    if (mc->mc_status != MLX_STATUS_BUSY) {
1829	TAILQ_REMOVE(&sc->mlx_work, mc, mc_link);
1830	return(0);
1831    }
1832    device_printf(sc->mlx_dev, "command failed - %s\n", mlx_diagnose_command(mc));
1833    return(EIO);
1834}
1835
1836void
1837mlx_startio_cb(void *arg, bus_dma_segment_t *segs, int nsegments, int error)
1838{
1839    struct mlx_command	*mc;
1840    struct mlxd_softc	*mlxd;
1841    struct mlx_softc	*sc;
1842    struct bio		*bp;
1843    int			blkcount;
1844    int			driveno;
1845    int			cmd;
1846
1847    mc = (struct mlx_command *)arg;
1848    mlx_setup_dmamap(mc, segs, nsegments, error);
1849
1850    sc = mc->mc_sc;
1851    bp = mc->mc_private;
1852
1853    if (bp->bio_cmd == BIO_READ) {
1854	mc->mc_flags |= MLX_CMD_DATAIN;
1855	cmd = MLX_CMD_READSG;
1856    } else {
1857	mc->mc_flags |= MLX_CMD_DATAOUT;
1858	cmd = MLX_CMD_WRITESG;
1859    }
1860
1861    /* build a suitable I/O command (assumes 512-byte rounded transfers) */
1862    mlxd = bp->bio_disk->d_drv1;
1863    driveno = mlxd->mlxd_drive - sc->mlx_sysdrive;
1864    blkcount = (bp->bio_bcount + MLX_BLKSIZE - 1) / MLX_BLKSIZE;
1865
1866    if ((bp->bio_pblkno + blkcount) > sc->mlx_sysdrive[driveno].ms_size)
1867	device_printf(sc->mlx_dev,
1868		      "I/O beyond end of unit (%lld,%d > %lu)\n",
1869		      (long long)bp->bio_pblkno, blkcount,
1870		      (u_long)sc->mlx_sysdrive[driveno].ms_size);
1871
1872    /*
1873     * Build the I/O command.  Note that the SG list type bits are set to zero,
1874     * denoting the format of SG list that we are using.
1875     */
1876    if (sc->mlx_iftype == MLX_IFTYPE_2) {
1877	mlx_make_type1(mc, (cmd == MLX_CMD_WRITESG) ? MLX_CMD_WRITESG_OLD :
1878						      MLX_CMD_READSG_OLD,
1879		       blkcount & 0xff, 	/* xfer length low byte */
1880		       bp->bio_pblkno,		/* physical block number */
1881		       driveno,			/* target drive number */
1882		       mc->mc_sgphys,		/* location of SG list */
1883		       mc->mc_nsgent & 0x3f);	/* size of SG list */
1884	} else {
1885	mlx_make_type5(mc, cmd,
1886		       blkcount & 0xff, 	/* xfer length low byte */
1887		       (driveno << 3) | ((blkcount >> 8) & 0x07),
1888						/* target+length high 3 bits */
1889		       bp->bio_pblkno,		/* physical block number */
1890		       mc->mc_sgphys,		/* location of SG list */
1891		       mc->mc_nsgent & 0x3f);	/* size of SG list */
1892    }
1893
1894    /* try to give command to controller */
1895    if (mlx_start(mc) != 0) {
1896	/* fail the command */
1897	mc->mc_status = MLX_STATUS_WEDGED;
1898	mlx_completeio(mc);
1899    }
1900
1901    sc->mlx_state &= ~MLX_STATE_QFROZEN;
1902}
1903
1904/********************************************************************************
1905 * Pull as much work off the softc's work queue as possible and give it to the
1906 * controller.  Leave a couple of slots free for emergencies.
1907 */
1908static void
1909mlx_startio(struct mlx_softc *sc)
1910{
1911    struct mlx_command	*mc;
1912    struct bio		*bp;
1913    int			error;
1914
1915    MLX_IO_ASSERT_LOCKED(sc);
1916
1917    /* spin until something prevents us from doing any work */
1918    for (;;) {
1919	if (sc->mlx_state & MLX_STATE_QFROZEN)
1920	    break;
1921
1922	/* see if there's work to be done */
1923	if ((bp = bioq_first(&sc->mlx_bioq)) == NULL)
1924	    break;
1925	/* get a command */
1926	if ((mc = mlx_alloccmd(sc)) == NULL)
1927	    break;
1928	/* get a slot for the command */
1929	if (mlx_getslot(mc) != 0) {
1930	    mlx_releasecmd(mc);
1931	    break;
1932	}
1933	/* get the buf containing our work */
1934	bioq_remove(&sc->mlx_bioq, bp);
1935	sc->mlx_waitbufs--;
1936
1937	/* connect the buf to the command */
1938	mc->mc_complete = mlx_completeio;
1939	mc->mc_private = bp;
1940	mc->mc_data = bp->bio_data;
1941	mc->mc_length = bp->bio_bcount;
1942
1943	/* map the command so the controller can work with it */
1944	error = bus_dmamap_load(sc->mlx_buffer_dmat, mc->mc_dmamap, mc->mc_data,
1945				mc->mc_length, mlx_startio_cb, mc, 0);
1946	if (error == EINPROGRESS) {
1947	    sc->mlx_state |= MLX_STATE_QFROZEN;
1948	    break;
1949	}
1950    }
1951}
1952
1953/********************************************************************************
1954 * Handle completion of an I/O command.
1955 */
1956static void
1957mlx_completeio(struct mlx_command *mc)
1958{
1959    struct mlx_softc	*sc = mc->mc_sc;
1960    struct bio		*bp = mc->mc_private;
1961    struct mlxd_softc	*mlxd = bp->bio_disk->d_drv1;
1962
1963    MLX_IO_ASSERT_LOCKED(sc);
1964    if (mc->mc_status != MLX_STATUS_OK) {	/* could be more verbose here? */
1965	bp->bio_error = EIO;
1966	bp->bio_flags |= BIO_ERROR;
1967
1968	switch(mc->mc_status) {
1969	case MLX_STATUS_RDWROFFLINE:		/* system drive has gone offline */
1970	    device_printf(mlxd->mlxd_dev, "drive offline\n");
1971	    /* should signal this with a return code */
1972	    mlxd->mlxd_drive->ms_state = MLX_SYSD_OFFLINE;
1973	    break;
1974
1975	default:				/* other I/O error */
1976	    device_printf(sc->mlx_dev, "I/O error - %s\n", mlx_diagnose_command(mc));
1977#if 0
1978	    device_printf(sc->mlx_dev, "  b_bcount %ld  blkcount %ld  b_pblkno %d\n",
1979			  bp->bio_bcount, bp->bio_bcount / MLX_BLKSIZE, bp->bio_pblkno);
1980	    device_printf(sc->mlx_dev, "  %13D\n", mc->mc_mailbox, " ");
1981#endif
1982	    break;
1983	}
1984    }
1985    mlx_releasecmd(mc);
1986    mlxd_intr(bp);
1987}
1988
1989void
1990mlx_user_cb(void *arg, bus_dma_segment_t *segs, int nsegments, int error)
1991{
1992    struct mlx_usercommand *mu;
1993    struct mlx_command *mc;
1994    struct mlx_dcdb	*dcdb;
1995
1996    mc = (struct mlx_command *)arg;
1997    if (error)
1998	return;
1999
2000    mlx_setup_dmamap(mc, segs, nsegments, error);
2001
2002    mu = (struct mlx_usercommand *)mc->mc_private;
2003    dcdb = NULL;
2004
2005    /*
2006     * If this is a passthrough SCSI command, the DCDB is packed at the
2007     * beginning of the data area.  Fix up the DCDB to point to the correct
2008     * physical address and override any bufptr supplied by the caller since
2009     * we know what it's meant to be.
2010     */
2011    if (mc->mc_mailbox[0] == MLX_CMD_DIRECT_CDB) {
2012	dcdb = (struct mlx_dcdb *)mc->mc_data;
2013	dcdb->dcdb_physaddr = mc->mc_dataphys + sizeof(*dcdb);
2014	mu->mu_bufptr = 8;
2015    }
2016
2017    /*
2018     * If there's a data buffer, fix up the command's buffer pointer.
2019     */
2020    if (mu->mu_datasize > 0) {
2021	mc->mc_mailbox[mu->mu_bufptr    ] =  mc->mc_dataphys        & 0xff;
2022	mc->mc_mailbox[mu->mu_bufptr + 1] = (mc->mc_dataphys >> 8)  & 0xff;
2023	mc->mc_mailbox[mu->mu_bufptr + 2] = (mc->mc_dataphys >> 16) & 0xff;
2024	mc->mc_mailbox[mu->mu_bufptr + 3] = (mc->mc_dataphys >> 24) & 0xff;
2025    }
2026    debug(0, "command fixup");
2027
2028    /* submit the command and wait */
2029    if (mlx_wait_command(mc) != 0)
2030	return;
2031
2032}
2033
2034/********************************************************************************
2035 * Take a command from user-space and try to run it.
2036 *
2037 * XXX Note that this can't perform very much in the way of error checking, and
2038 *     as such, applications _must_ be considered trustworthy.
2039 * XXX Commands using S/G for data are not supported.
2040 */
2041static int
2042mlx_user_command(struct mlx_softc *sc, struct mlx_usercommand *mu)
2043{
2044    struct mlx_command	*mc;
2045    void		*kbuf;
2046    int			error;
2047
2048    debug_called(0);
2049
2050    kbuf = NULL;
2051    mc = NULL;
2052    error = ENOMEM;
2053
2054    /* get ourselves a command and copy in from user space */
2055    MLX_IO_LOCK(sc);
2056    if ((mc = mlx_alloccmd(sc)) == NULL) {
2057	MLX_IO_UNLOCK(sc);
2058	return(error);
2059    }
2060    bcopy(mu->mu_command, mc->mc_mailbox, sizeof(mc->mc_mailbox));
2061    debug(0, "got command buffer");
2062
2063    /*
2064     * if we need a buffer for data transfer, allocate one and copy in its
2065     * initial contents
2066     */
2067    if (mu->mu_datasize > 0) {
2068	if (mu->mu_datasize > MLX_MAXPHYS) {
2069	    error = EINVAL;
2070	    goto out;
2071	}
2072	MLX_IO_UNLOCK(sc);
2073	if (((kbuf = malloc(mu->mu_datasize, M_DEVBUF, M_WAITOK)) == NULL) ||
2074	    (error = copyin(mu->mu_buf, kbuf, mu->mu_datasize))) {
2075	    MLX_IO_LOCK(sc);
2076	    goto out;
2077	}
2078	MLX_IO_LOCK(sc);
2079	debug(0, "got kernel buffer");
2080    }
2081
2082    /* get a command slot */
2083    if (mlx_getslot(mc))
2084	goto out;
2085    debug(0, "got a slot");
2086
2087    if (mu->mu_datasize > 0) {
2088
2089	/* range check the pointer to physical buffer address */
2090	if ((mu->mu_bufptr < 0) || (mu->mu_bufptr > (sizeof(mu->mu_command) -
2091						     sizeof(u_int32_t)))) {
2092	    error = EINVAL;
2093	    goto out;
2094	}
2095    }
2096
2097    /* map the command so the controller can see it */
2098    mc->mc_data = kbuf;
2099    mc->mc_length = mu->mu_datasize;
2100    mc->mc_private = mu;
2101    error = bus_dmamap_load(sc->mlx_buffer_dmat, mc->mc_dmamap, mc->mc_data,
2102			    mc->mc_length, mlx_user_cb, mc, BUS_DMA_NOWAIT);
2103    if (error)
2104	goto out;
2105
2106    /* copy out status and data */
2107    mu->mu_status = mc->mc_status;
2108    if (mu->mu_datasize > 0) {
2109	MLX_IO_UNLOCK(sc);
2110	error = copyout(kbuf, mu->mu_buf, mu->mu_datasize);
2111	MLX_IO_LOCK(sc);
2112    }
2113
2114 out:
2115    mlx_releasecmd(mc);
2116    MLX_IO_UNLOCK(sc);
2117    if (kbuf != NULL)
2118	free(kbuf, M_DEVBUF);
2119    return(error);
2120}
2121
2122/********************************************************************************
2123 ********************************************************************************
2124                                                        Command I/O to Controller
2125 ********************************************************************************
2126 ********************************************************************************/
2127
2128/********************************************************************************
2129 * Find a free command slot for (mc).
2130 *
2131 * Don't hand out a slot to a normal-priority command unless there are at least
2132 * 4 slots free for priority commands.
2133 */
2134static int
2135mlx_getslot(struct mlx_command *mc)
2136{
2137    struct mlx_softc	*sc = mc->mc_sc;
2138    int			slot, limit;
2139
2140    debug_called(1);
2141
2142    MLX_IO_ASSERT_LOCKED(sc);
2143
2144    /*
2145     * Enforce slot-usage limit, if we have the required information.
2146     */
2147    if (sc->mlx_enq2 != NULL) {
2148	limit = sc->mlx_enq2->me_max_commands;
2149    } else {
2150	limit = 2;
2151    }
2152    if (sc->mlx_busycmds >= ((mc->mc_flags & MLX_CMD_PRIORITY) ? limit : limit - 4))
2153	return(EBUSY);
2154
2155    /*
2156     * Allocate an outstanding command slot
2157     *
2158     * XXX linear search is slow
2159     */
2160    for (slot = 0; slot < limit; slot++) {
2161	debug(2, "try slot %d", slot);
2162	if (sc->mlx_busycmd[slot] == NULL)
2163	    break;
2164    }
2165    if (slot < limit) {
2166	sc->mlx_busycmd[slot] = mc;
2167	sc->mlx_busycmds++;
2168    }
2169
2170    /* out of slots? */
2171    if (slot >= limit)
2172	return(EBUSY);
2173
2174    debug(2, "got slot %d", slot);
2175    mc->mc_slot = slot;
2176    return(0);
2177}
2178
2179/********************************************************************************
2180 * Map/unmap (mc)'s data in the controller's addressable space.
2181 */
2182static void
2183mlx_setup_dmamap(struct mlx_command *mc, bus_dma_segment_t *segs, int nsegments,
2184		 int error)
2185{
2186    struct mlx_softc	*sc = mc->mc_sc;
2187    struct mlx_sgentry	*sg;
2188    int			i;
2189
2190    debug_called(1);
2191
2192    /* XXX should be unnecessary */
2193    if (sc->mlx_enq2 && (nsegments > sc->mlx_enq2->me_max_sg))
2194	panic("MLX: too many s/g segments (%d, max %d)", nsegments,
2195	      sc->mlx_enq2->me_max_sg);
2196
2197    /* get base address of s/g table */
2198    sg = sc->mlx_sgtable + (mc->mc_slot * MLX_NSEG);
2199
2200    /* save s/g table information in command */
2201    mc->mc_nsgent = nsegments;
2202    mc->mc_sgphys = sc->mlx_sgbusaddr +
2203		   (mc->mc_slot * MLX_NSEG * sizeof(struct mlx_sgentry));
2204    mc->mc_dataphys = segs[0].ds_addr;
2205
2206    /* populate s/g table */
2207    for (i = 0; i < nsegments; i++, sg++) {
2208	sg->sg_addr = segs[i].ds_addr;
2209	sg->sg_count = segs[i].ds_len;
2210    }
2211
2212    /* Make sure the buffers are visible on the bus. */
2213    if (mc->mc_flags & MLX_CMD_DATAIN)
2214	bus_dmamap_sync(sc->mlx_buffer_dmat, mc->mc_dmamap,
2215			BUS_DMASYNC_PREREAD);
2216    if (mc->mc_flags & MLX_CMD_DATAOUT)
2217	bus_dmamap_sync(sc->mlx_buffer_dmat, mc->mc_dmamap,
2218			BUS_DMASYNC_PREWRITE);
2219}
2220
2221static void
2222mlx_unmapcmd(struct mlx_command *mc)
2223{
2224    struct mlx_softc	*sc = mc->mc_sc;
2225
2226    debug_called(1);
2227
2228    /* if the command involved data at all */
2229    if (mc->mc_data != NULL) {
2230
2231	if (mc->mc_flags & MLX_CMD_DATAIN)
2232	    bus_dmamap_sync(sc->mlx_buffer_dmat, mc->mc_dmamap, BUS_DMASYNC_POSTREAD);
2233	if (mc->mc_flags & MLX_CMD_DATAOUT)
2234	    bus_dmamap_sync(sc->mlx_buffer_dmat, mc->mc_dmamap, BUS_DMASYNC_POSTWRITE);
2235
2236	bus_dmamap_unload(sc->mlx_buffer_dmat, mc->mc_dmamap);
2237    }
2238}
2239
2240/********************************************************************************
2241 * Try to deliver (mc) to the controller.
2242 *
2243 * Can be called at any interrupt level, with or without interrupts enabled.
2244 */
2245static int
2246mlx_start(struct mlx_command *mc)
2247{
2248    struct mlx_softc	*sc = mc->mc_sc;
2249    int			i;
2250
2251    debug_called(1);
2252
2253    /* save the slot number as ident so we can handle this command when complete */
2254    mc->mc_mailbox[0x1] = mc->mc_slot;
2255
2256    /* mark the command as currently being processed */
2257    mc->mc_status = MLX_STATUS_BUSY;
2258
2259    /* set a default 60-second timeout  XXX tunable?  XXX not currently used */
2260    mc->mc_timeout = time_second + 60;
2261
2262    /* spin waiting for the mailbox */
2263    for (i = 100000; i > 0; i--) {
2264	if (sc->mlx_tryqueue(sc, mc)) {
2265	    /* move command to work queue */
2266	    TAILQ_INSERT_TAIL(&sc->mlx_work, mc, mc_link);
2267	    return (0);
2268	} else if (i > 1)
2269	    mlx_done(sc, 0);
2270    }
2271
2272    /*
2273     * We couldn't get the controller to take the command.  Revoke the slot
2274     * that the command was given and return it with a bad status.
2275     */
2276    sc->mlx_busycmd[mc->mc_slot] = NULL;
2277    device_printf(sc->mlx_dev, "controller wedged (not taking commands)\n");
2278    mc->mc_status = MLX_STATUS_WEDGED;
2279    mlx_complete(sc);
2280    return(EIO);
2281}
2282
2283/********************************************************************************
2284 * Poll the controller (sc) for completed commands.
2285 * Update command status and free slots for reuse.  If any slots were freed,
2286 * new commands may be posted.
2287 *
2288 * Returns nonzero if one or more commands were completed.
2289 */
2290static int
2291mlx_done(struct mlx_softc *sc, int startio)
2292{
2293    struct mlx_command	*mc;
2294    int			result;
2295    u_int8_t		slot;
2296    u_int16_t		status;
2297
2298    debug_called(2);
2299    MLX_IO_ASSERT_LOCKED(sc);
2300
2301    result = 0;
2302
2303    /* loop collecting completed commands */
2304    for (;;) {
2305	/* poll for a completed command's identifier and status */
2306	if (sc->mlx_findcomplete(sc, &slot, &status)) {
2307	    result = 1;
2308	    mc = sc->mlx_busycmd[slot];			/* find command */
2309	    if (mc != NULL) {				/* paranoia */
2310		if (mc->mc_status == MLX_STATUS_BUSY) {
2311		    mc->mc_status = status;		/* save status */
2312
2313		    /* free slot for reuse */
2314		    sc->mlx_busycmd[slot] = NULL;
2315		    sc->mlx_busycmds--;
2316		} else {
2317		    device_printf(sc->mlx_dev, "duplicate done event for slot %d\n", slot);
2318		}
2319	    } else {
2320		device_printf(sc->mlx_dev, "done event for nonbusy slot %d\n", slot);
2321	    }
2322	} else {
2323	    break;
2324	}
2325    }
2326
2327    /* if we've completed any commands, try posting some more */
2328    if (result && startio)
2329	mlx_startio(sc);
2330
2331    /* handle completion and timeouts */
2332    mlx_complete(sc);
2333
2334    return(result);
2335}
2336
2337/********************************************************************************
2338 * Perform post-completion processing for commands on (sc).
2339 */
2340static void
2341mlx_complete(struct mlx_softc *sc)
2342{
2343    struct mlx_command	*mc, *nc;
2344
2345    debug_called(2);
2346    MLX_IO_ASSERT_LOCKED(sc);
2347
2348    /* scan the list of busy/done commands */
2349    mc = TAILQ_FIRST(&sc->mlx_work);
2350    while (mc != NULL) {
2351	nc = TAILQ_NEXT(mc, mc_link);
2352
2353	/* Command has been completed in some fashion */
2354	if (mc->mc_status != MLX_STATUS_BUSY) {
2355
2356	    /* unmap the command's data buffer */
2357	    mlx_unmapcmd(mc);
2358	    /*
2359	     * Does the command have a completion handler?
2360	     */
2361	    if (mc->mc_complete != NULL) {
2362		/* remove from list and give to handler */
2363		TAILQ_REMOVE(&sc->mlx_work, mc, mc_link);
2364		mc->mc_complete(mc);
2365
2366		/*
2367		 * Is there a sleeper waiting on this command?
2368		 */
2369	    } else if (mc->mc_private != NULL) {	/* sleeping caller wants to know about it */
2370
2371		/* remove from list and wake up sleeper */
2372		TAILQ_REMOVE(&sc->mlx_work, mc, mc_link);
2373		wakeup_one(mc->mc_private);
2374
2375		/*
2376		 * Leave the command for a caller that's polling for it.
2377		 */
2378	    } else {
2379	    }
2380	}
2381	mc = nc;
2382    }
2383}
2384
2385/********************************************************************************
2386 ********************************************************************************
2387                                                        Command Buffer Management
2388 ********************************************************************************
2389 ********************************************************************************/
2390
2391/********************************************************************************
2392 * Get a new command buffer.
2393 *
2394 * This may return NULL in low-memory cases.
2395 *
2396 * Note that using malloc() is expensive (the command buffer is << 1 page) but
2397 * necessary if we are to be a loadable module before the zone allocator is fixed.
2398 *
2399 * If possible, we recycle a command buffer that's been used before.
2400 *
2401 * XXX Note that command buffers are not cleaned out - it is the caller's
2402 *     responsibility to ensure that all required fields are filled in before
2403 *     using a buffer.
2404 */
2405static struct mlx_command *
2406mlx_alloccmd(struct mlx_softc *sc)
2407{
2408    struct mlx_command	*mc;
2409    int			error;
2410
2411    debug_called(1);
2412
2413    MLX_IO_ASSERT_LOCKED(sc);
2414    if ((mc = TAILQ_FIRST(&sc->mlx_freecmds)) != NULL)
2415	TAILQ_REMOVE(&sc->mlx_freecmds, mc, mc_link);
2416
2417    /* allocate a new command buffer? */
2418    if (mc == NULL) {
2419	mc = (struct mlx_command *)malloc(sizeof(*mc), M_DEVBUF, M_NOWAIT | M_ZERO);
2420	if (mc != NULL) {
2421	    mc->mc_sc = sc;
2422	    error = bus_dmamap_create(sc->mlx_buffer_dmat, 0, &mc->mc_dmamap);
2423	    if (error) {
2424		free(mc, M_DEVBUF);
2425		return(NULL);
2426	    }
2427	}
2428    }
2429    return(mc);
2430}
2431
2432/********************************************************************************
2433 * Release a command buffer for recycling.
2434 *
2435 * XXX It might be a good idea to limit the number of commands we save for reuse
2436 *     if it's shown that this list bloats out massively.
2437 */
2438static void
2439mlx_releasecmd(struct mlx_command *mc)
2440{
2441
2442    debug_called(1);
2443
2444    MLX_IO_ASSERT_LOCKED(mc->mc_sc);
2445    TAILQ_INSERT_HEAD(&mc->mc_sc->mlx_freecmds, mc, mc_link);
2446}
2447
2448/********************************************************************************
2449 * Permanently discard a command buffer.
2450 */
2451static void
2452mlx_freecmd(struct mlx_command *mc)
2453{
2454    struct mlx_softc	*sc = mc->mc_sc;
2455
2456    debug_called(1);
2457    bus_dmamap_destroy(sc->mlx_buffer_dmat, mc->mc_dmamap);
2458    free(mc, M_DEVBUF);
2459}
2460
2461
2462/********************************************************************************
2463 ********************************************************************************
2464                                                Type 3 interface accessor methods
2465 ********************************************************************************
2466 ********************************************************************************/
2467
2468/********************************************************************************
2469 * Try to give (mc) to the controller.  Returns 1 if successful, 0 on failure
2470 * (the controller is not ready to take a command).
2471 */
2472static int
2473mlx_v3_tryqueue(struct mlx_softc *sc, struct mlx_command *mc)
2474{
2475    int		i;
2476
2477    debug_called(2);
2478    MLX_IO_ASSERT_LOCKED(sc);
2479
2480    /* ready for our command? */
2481    if (!(MLX_V3_GET_IDBR(sc) & MLX_V3_IDB_FULL)) {
2482	/* copy mailbox data to window */
2483	for (i = 0; i < 13; i++)
2484	    MLX_V3_PUT_MAILBOX(sc, i, mc->mc_mailbox[i]);
2485
2486	/* post command */
2487	MLX_V3_PUT_IDBR(sc, MLX_V3_IDB_FULL);
2488	return(1);
2489    }
2490    return(0);
2491}
2492
2493/********************************************************************************
2494 * See if a command has been completed, if so acknowledge its completion
2495 * and recover the slot number and status code.
2496 */
2497static int
2498mlx_v3_findcomplete(struct mlx_softc *sc, u_int8_t *slot, u_int16_t *status)
2499{
2500
2501    debug_called(2);
2502    MLX_IO_ASSERT_LOCKED(sc);
2503
2504    /* status available? */
2505    if (MLX_V3_GET_ODBR(sc) & MLX_V3_ODB_SAVAIL) {
2506	*slot = MLX_V3_GET_STATUS_IDENT(sc);		/* get command identifier */
2507	*status = MLX_V3_GET_STATUS(sc);		/* get status */
2508
2509	/* acknowledge completion */
2510	MLX_V3_PUT_ODBR(sc, MLX_V3_ODB_SAVAIL);
2511	MLX_V3_PUT_IDBR(sc, MLX_V3_IDB_SACK);
2512	return(1);
2513    }
2514    return(0);
2515}
2516
2517/********************************************************************************
2518 * Enable/disable interrupts as requested. (No acknowledge required)
2519 */
2520static void
2521mlx_v3_intaction(struct mlx_softc *sc, int action)
2522{
2523    debug_called(1);
2524    MLX_IO_ASSERT_LOCKED(sc);
2525
2526    switch(action) {
2527    case MLX_INTACTION_DISABLE:
2528	MLX_V3_PUT_IER(sc, 0);
2529	sc->mlx_state &= ~MLX_STATE_INTEN;
2530	break;
2531    case MLX_INTACTION_ENABLE:
2532	MLX_V3_PUT_IER(sc, 1);
2533	sc->mlx_state |= MLX_STATE_INTEN;
2534	break;
2535    }
2536}
2537
2538/********************************************************************************
2539 * Poll for firmware error codes during controller initialisation.
2540 * Returns 0 if initialisation is complete, 1 if still in progress but no
2541 * error has been fetched, 2 if an error has been retrieved.
2542 */
2543static int
2544mlx_v3_fw_handshake(struct mlx_softc *sc, int *error, int *param1, int *param2,
2545    int first)
2546{
2547    u_int8_t	fwerror;
2548
2549    debug_called(2);
2550
2551    /* first time around, clear any hardware completion status */
2552    if (first) {
2553	MLX_V3_PUT_IDBR(sc, MLX_V3_IDB_SACK);
2554	DELAY(1000);
2555    }
2556
2557    /* init in progress? */
2558    if (!(MLX_V3_GET_IDBR(sc) & MLX_V3_IDB_INIT_BUSY))
2559	return(0);
2560
2561    /* test error value */
2562    fwerror = MLX_V3_GET_FWERROR(sc);
2563    if (!(fwerror & MLX_V3_FWERROR_PEND))
2564	return(1);
2565
2566    /* mask status pending bit, fetch status */
2567    *error = fwerror & ~MLX_V3_FWERROR_PEND;
2568    *param1 = MLX_V3_GET_FWERROR_PARAM1(sc);
2569    *param2 = MLX_V3_GET_FWERROR_PARAM2(sc);
2570
2571    /* acknowledge */
2572    MLX_V3_PUT_FWERROR(sc, 0);
2573
2574    return(2);
2575}
2576
2577/********************************************************************************
2578 ********************************************************************************
2579                                                Type 4 interface accessor methods
2580 ********************************************************************************
2581 ********************************************************************************/
2582
2583/********************************************************************************
2584 * Try to give (mc) to the controller.  Returns 1 if successful, 0 on failure
2585 * (the controller is not ready to take a command).
2586 */
2587static int
2588mlx_v4_tryqueue(struct mlx_softc *sc, struct mlx_command *mc)
2589{
2590    int		i;
2591
2592    debug_called(2);
2593    MLX_IO_ASSERT_LOCKED(sc);
2594
2595    /* ready for our command? */
2596    if (!(MLX_V4_GET_IDBR(sc) & MLX_V4_IDB_FULL)) {
2597	/* copy mailbox data to window */
2598	for (i = 0; i < 13; i++)
2599	    MLX_V4_PUT_MAILBOX(sc, i, mc->mc_mailbox[i]);
2600
2601	/* memory-mapped controller, so issue a write barrier to ensure the mailbox is filled */
2602	bus_barrier(sc->mlx_mem, MLX_V4_MAILBOX, MLX_V4_MAILBOX_LENGTH,
2603			  BUS_SPACE_BARRIER_WRITE);
2604
2605	/* post command */
2606	MLX_V4_PUT_IDBR(sc, MLX_V4_IDB_HWMBOX_CMD);
2607	return(1);
2608    }
2609    return(0);
2610}
2611
2612/********************************************************************************
2613 * See if a command has been completed, if so acknowledge its completion
2614 * and recover the slot number and status code.
2615 */
2616static int
2617mlx_v4_findcomplete(struct mlx_softc *sc, u_int8_t *slot, u_int16_t *status)
2618{
2619
2620    debug_called(2);
2621    MLX_IO_ASSERT_LOCKED(sc);
2622
2623    /* status available? */
2624    if (MLX_V4_GET_ODBR(sc) & MLX_V4_ODB_HWSAVAIL) {
2625	*slot = MLX_V4_GET_STATUS_IDENT(sc);		/* get command identifier */
2626	*status = MLX_V4_GET_STATUS(sc);		/* get status */
2627
2628	/* acknowledge completion */
2629	MLX_V4_PUT_ODBR(sc, MLX_V4_ODB_HWMBOX_ACK);
2630	MLX_V4_PUT_IDBR(sc, MLX_V4_IDB_SACK);
2631	return(1);
2632    }
2633    return(0);
2634}
2635
2636/********************************************************************************
2637 * Enable/disable interrupts as requested.
2638 */
2639static void
2640mlx_v4_intaction(struct mlx_softc *sc, int action)
2641{
2642    debug_called(1);
2643    MLX_IO_ASSERT_LOCKED(sc);
2644
2645    switch(action) {
2646    case MLX_INTACTION_DISABLE:
2647	MLX_V4_PUT_IER(sc, MLX_V4_IER_MASK | MLX_V4_IER_DISINT);
2648	sc->mlx_state &= ~MLX_STATE_INTEN;
2649	break;
2650    case MLX_INTACTION_ENABLE:
2651	MLX_V4_PUT_IER(sc, MLX_V4_IER_MASK & ~MLX_V4_IER_DISINT);
2652	sc->mlx_state |= MLX_STATE_INTEN;
2653	break;
2654    }
2655}
2656
2657/********************************************************************************
2658 * Poll for firmware error codes during controller initialisation.
2659 * Returns 0 if initialisation is complete, 1 if still in progress but no
2660 * error has been fetched, 2 if an error has been retrieved.
2661 */
2662static int
2663mlx_v4_fw_handshake(struct mlx_softc *sc, int *error, int *param1, int *param2,
2664    int first)
2665{
2666    u_int8_t	fwerror;
2667
2668    debug_called(2);
2669
2670    /* first time around, clear any hardware completion status */
2671    if (first) {
2672	MLX_V4_PUT_IDBR(sc, MLX_V4_IDB_SACK);
2673	DELAY(1000);
2674    }
2675
2676    /* init in progress? */
2677    if (!(MLX_V4_GET_IDBR(sc) & MLX_V4_IDB_INIT_BUSY))
2678	return(0);
2679
2680    /* test error value */
2681    fwerror = MLX_V4_GET_FWERROR(sc);
2682    if (!(fwerror & MLX_V4_FWERROR_PEND))
2683	return(1);
2684
2685    /* mask status pending bit, fetch status */
2686    *error = fwerror & ~MLX_V4_FWERROR_PEND;
2687    *param1 = MLX_V4_GET_FWERROR_PARAM1(sc);
2688    *param2 = MLX_V4_GET_FWERROR_PARAM2(sc);
2689
2690    /* acknowledge */
2691    MLX_V4_PUT_FWERROR(sc, 0);
2692
2693    return(2);
2694}
2695
2696/********************************************************************************
2697 ********************************************************************************
2698                                                Type 5 interface accessor methods
2699 ********************************************************************************
2700 ********************************************************************************/
2701
2702/********************************************************************************
2703 * Try to give (mc) to the controller.  Returns 1 if successful, 0 on failure
2704 * (the controller is not ready to take a command).
2705 */
2706static int
2707mlx_v5_tryqueue(struct mlx_softc *sc, struct mlx_command *mc)
2708{
2709    int		i;
2710
2711    debug_called(2);
2712    MLX_IO_ASSERT_LOCKED(sc);
2713
2714    /* ready for our command? */
2715    if (MLX_V5_GET_IDBR(sc) & MLX_V5_IDB_EMPTY) {
2716	/* copy mailbox data to window */
2717	for (i = 0; i < 13; i++)
2718	    MLX_V5_PUT_MAILBOX(sc, i, mc->mc_mailbox[i]);
2719
2720	/* post command */
2721	MLX_V5_PUT_IDBR(sc, MLX_V5_IDB_HWMBOX_CMD);
2722	return(1);
2723    }
2724    return(0);
2725}
2726
2727/********************************************************************************
2728 * See if a command has been completed, if so acknowledge its completion
2729 * and recover the slot number and status code.
2730 */
2731static int
2732mlx_v5_findcomplete(struct mlx_softc *sc, u_int8_t *slot, u_int16_t *status)
2733{
2734
2735    debug_called(2);
2736    MLX_IO_ASSERT_LOCKED(sc);
2737
2738    /* status available? */
2739    if (MLX_V5_GET_ODBR(sc) & MLX_V5_ODB_HWSAVAIL) {
2740	*slot = MLX_V5_GET_STATUS_IDENT(sc);		/* get command identifier */
2741	*status = MLX_V5_GET_STATUS(sc);		/* get status */
2742
2743	/* acknowledge completion */
2744	MLX_V5_PUT_ODBR(sc, MLX_V5_ODB_HWMBOX_ACK);
2745	MLX_V5_PUT_IDBR(sc, MLX_V5_IDB_SACK);
2746	return(1);
2747    }
2748    return(0);
2749}
2750
2751/********************************************************************************
2752 * Enable/disable interrupts as requested.
2753 */
2754static void
2755mlx_v5_intaction(struct mlx_softc *sc, int action)
2756{
2757    debug_called(1);
2758    MLX_IO_ASSERT_LOCKED(sc);
2759
2760    switch(action) {
2761    case MLX_INTACTION_DISABLE:
2762	MLX_V5_PUT_IER(sc, 0xff & MLX_V5_IER_DISINT);
2763	sc->mlx_state &= ~MLX_STATE_INTEN;
2764	break;
2765    case MLX_INTACTION_ENABLE:
2766	MLX_V5_PUT_IER(sc, 0xff & ~MLX_V5_IER_DISINT);
2767	sc->mlx_state |= MLX_STATE_INTEN;
2768	break;
2769    }
2770}
2771
2772/********************************************************************************
2773 * Poll for firmware error codes during controller initialisation.
2774 * Returns 0 if initialisation is complete, 1 if still in progress but no
2775 * error has been fetched, 2 if an error has been retrieved.
2776 */
2777static int
2778mlx_v5_fw_handshake(struct mlx_softc *sc, int *error, int *param1, int *param2,
2779    int first)
2780{
2781    u_int8_t	fwerror;
2782
2783    debug_called(2);
2784
2785    /* first time around, clear any hardware completion status */
2786    if (first) {
2787	MLX_V5_PUT_IDBR(sc, MLX_V5_IDB_SACK);
2788	DELAY(1000);
2789    }
2790
2791    /* init in progress? */
2792    if (MLX_V5_GET_IDBR(sc) & MLX_V5_IDB_INIT_DONE)
2793	return(0);
2794
2795    /* test for error value */
2796    fwerror = MLX_V5_GET_FWERROR(sc);
2797    if (!(fwerror & MLX_V5_FWERROR_PEND))
2798	return(1);
2799
2800    /* mask status pending bit, fetch status */
2801    *error = fwerror & ~MLX_V5_FWERROR_PEND;
2802    *param1 = MLX_V5_GET_FWERROR_PARAM1(sc);
2803    *param2 = MLX_V5_GET_FWERROR_PARAM2(sc);
2804
2805    /* acknowledge */
2806    MLX_V5_PUT_FWERROR(sc, 0xff);
2807
2808    return(2);
2809}
2810
2811/********************************************************************************
2812 ********************************************************************************
2813                                                                        Debugging
2814 ********************************************************************************
2815 ********************************************************************************/
2816
2817/********************************************************************************
2818 * Return a status message describing (mc)
2819 */
2820static char *mlx_status_messages[] = {
2821    "normal completion",			/* 00 */
2822    "irrecoverable data error",			/* 01 */
2823    "drive does not exist, or is offline",	/* 02 */
2824    "attempt to write beyond end of drive",	/* 03 */
2825    "bad data encountered",			/* 04 */
2826    "invalid log entry request",		/* 05 */
2827    "attempt to rebuild online drive",		/* 06 */
2828    "new disk failed during rebuild",		/* 07 */
2829    "invalid channel/target",			/* 08 */
2830    "rebuild/check already in progress",	/* 09 */
2831    "one or more disks are dead",		/* 10 */
2832    "invalid or non-redundant drive",		/* 11 */
2833    "channel is busy",				/* 12 */
2834    "channel is not stopped",			/* 13 */
2835    "rebuild successfully terminated",		/* 14 */
2836    "unsupported command",			/* 15 */
2837    "check condition received",			/* 16 */
2838    "device is busy",				/* 17 */
2839    "selection or command timeout",		/* 18 */
2840    "command terminated abnormally",		/* 19 */
2841    ""
2842};
2843
2844static struct
2845{
2846    int		command;
2847    u_int16_t	status;
2848    int		msg;
2849} mlx_messages[] = {
2850    {MLX_CMD_READSG,		0x0001,	 1},
2851    {MLX_CMD_READSG,		0x0002,	 1},
2852    {MLX_CMD_READSG,		0x0105,	 3},
2853    {MLX_CMD_READSG,		0x010c,	 4},
2854    {MLX_CMD_WRITESG,		0x0001,	 1},
2855    {MLX_CMD_WRITESG,		0x0002,	 1},
2856    {MLX_CMD_WRITESG,		0x0105,	 3},
2857    {MLX_CMD_READSG_OLD,	0x0001,	 1},
2858    {MLX_CMD_READSG_OLD,	0x0002,	 1},
2859    {MLX_CMD_READSG_OLD,	0x0105,	 3},
2860    {MLX_CMD_WRITESG_OLD,	0x0001,	 1},
2861    {MLX_CMD_WRITESG_OLD,	0x0002,	 1},
2862    {MLX_CMD_WRITESG_OLD,	0x0105,	 3},
2863    {MLX_CMD_LOGOP,		0x0105,	 5},
2864    {MLX_CMD_REBUILDASYNC,	0x0002,  6},
2865    {MLX_CMD_REBUILDASYNC,	0x0004,  7},
2866    {MLX_CMD_REBUILDASYNC,	0x0105,  8},
2867    {MLX_CMD_REBUILDASYNC,	0x0106,  9},
2868    {MLX_CMD_REBUILDASYNC,	0x0107, 14},
2869    {MLX_CMD_CHECKASYNC,	0x0002, 10},
2870    {MLX_CMD_CHECKASYNC,	0x0105, 11},
2871    {MLX_CMD_CHECKASYNC,	0x0106,  9},
2872    {MLX_CMD_STOPCHANNEL,	0x0106, 12},
2873    {MLX_CMD_STOPCHANNEL,	0x0105,  8},
2874    {MLX_CMD_STARTCHANNEL,	0x0005, 13},
2875    {MLX_CMD_STARTCHANNEL,	0x0105,  8},
2876    {MLX_CMD_DIRECT_CDB,	0x0002, 16},
2877    {MLX_CMD_DIRECT_CDB,	0x0008, 17},
2878    {MLX_CMD_DIRECT_CDB,	0x000e, 18},
2879    {MLX_CMD_DIRECT_CDB,	0x000f, 19},
2880    {MLX_CMD_DIRECT_CDB,	0x0105,  8},
2881
2882    {0,				0x0104, 14},
2883    {-1, 0, 0}
2884};
2885
2886static char *
2887mlx_diagnose_command(struct mlx_command *mc)
2888{
2889    static char	unkmsg[80];
2890    int		i;
2891
2892    /* look up message in table */
2893    for (i = 0; mlx_messages[i].command != -1; i++)
2894	if (((mc->mc_mailbox[0] == mlx_messages[i].command) || (mlx_messages[i].command == 0)) &&
2895	    (mc->mc_status == mlx_messages[i].status))
2896	    return(mlx_status_messages[mlx_messages[i].msg]);
2897
2898    sprintf(unkmsg, "unknown response 0x%x for command 0x%x", (int)mc->mc_status, (int)mc->mc_mailbox[0]);
2899    return(unkmsg);
2900}
2901
2902/*******************************************************************************
2903 * Print a string describing the controller (sc)
2904 */
2905static struct
2906{
2907    int		hwid;
2908    char	*name;
2909} mlx_controller_names[] = {
2910    {0x01,	"960P/PD"},
2911    {0x02,	"960PL"},
2912    {0x10,	"960PG"},
2913    {0x11,	"960PJ"},
2914    {0x12,	"960PR"},
2915    {0x13,	"960PT"},
2916    {0x14,	"960PTL0"},
2917    {0x15,	"960PRL"},
2918    {0x16,	"960PTL1"},
2919    {0x20,	"1164PVX"},
2920    {-1, NULL}
2921};
2922
2923static void
2924mlx_describe_controller(struct mlx_softc *sc)
2925{
2926    static char		buf[80];
2927    char		*model;
2928    int			i;
2929
2930    for (i = 0, model = NULL; mlx_controller_names[i].name != NULL; i++) {
2931	if ((sc->mlx_enq2->me_hardware_id & 0xff) == mlx_controller_names[i].hwid) {
2932	    model = mlx_controller_names[i].name;
2933	    break;
2934	}
2935    }
2936    if (model == NULL) {
2937	sprintf(buf, " model 0x%x", sc->mlx_enq2->me_hardware_id & 0xff);
2938	model = buf;
2939    }
2940    device_printf(sc->mlx_dev, "DAC%s, %d channel%s, firmware %d.%02d-%c-%02d, %dMB RAM\n",
2941		  model,
2942		  sc->mlx_enq2->me_actual_channels,
2943		  sc->mlx_enq2->me_actual_channels > 1 ? "s" : "",
2944		  sc->mlx_enq2->me_firmware_id & 0xff,
2945		  (sc->mlx_enq2->me_firmware_id >> 8) & 0xff,
2946		  (sc->mlx_enq2->me_firmware_id >> 24) & 0xff,
2947		  (sc->mlx_enq2->me_firmware_id >> 16) & 0xff,
2948		  sc->mlx_enq2->me_mem_size / (1024 * 1024));
2949
2950    if (bootverbose) {
2951	device_printf(sc->mlx_dev, "  Hardware ID                 0x%08x\n", sc->mlx_enq2->me_hardware_id);
2952	device_printf(sc->mlx_dev, "  Firmware ID                 0x%08x\n", sc->mlx_enq2->me_firmware_id);
2953	device_printf(sc->mlx_dev, "  Configured/Actual channels  %d/%d\n", sc->mlx_enq2->me_configured_channels,
2954		      sc->mlx_enq2->me_actual_channels);
2955	device_printf(sc->mlx_dev, "  Max Targets                 %d\n", sc->mlx_enq2->me_max_targets);
2956	device_printf(sc->mlx_dev, "  Max Tags                    %d\n", sc->mlx_enq2->me_max_tags);
2957	device_printf(sc->mlx_dev, "  Max System Drives           %d\n", sc->mlx_enq2->me_max_sys_drives);
2958	device_printf(sc->mlx_dev, "  Max Arms                    %d\n", sc->mlx_enq2->me_max_arms);
2959	device_printf(sc->mlx_dev, "  Max Spans                   %d\n", sc->mlx_enq2->me_max_spans);
2960	device_printf(sc->mlx_dev, "  DRAM/cache/flash/NVRAM size %d/%d/%d/%d\n", sc->mlx_enq2->me_mem_size,
2961		      sc->mlx_enq2->me_cache_size, sc->mlx_enq2->me_flash_size, sc->mlx_enq2->me_nvram_size);
2962	device_printf(sc->mlx_dev, "  DRAM type                   %d\n", sc->mlx_enq2->me_mem_type);
2963	device_printf(sc->mlx_dev, "  Clock Speed                 %dns\n", sc->mlx_enq2->me_clock_speed);
2964	device_printf(sc->mlx_dev, "  Hardware Speed              %dns\n", sc->mlx_enq2->me_hardware_speed);
2965	device_printf(sc->mlx_dev, "  Max Commands                %d\n", sc->mlx_enq2->me_max_commands);
2966	device_printf(sc->mlx_dev, "  Max SG Entries              %d\n", sc->mlx_enq2->me_max_sg);
2967	device_printf(sc->mlx_dev, "  Max DP                      %d\n", sc->mlx_enq2->me_max_dp);
2968	device_printf(sc->mlx_dev, "  Max IOD                     %d\n", sc->mlx_enq2->me_max_iod);
2969	device_printf(sc->mlx_dev, "  Max Comb                    %d\n", sc->mlx_enq2->me_max_comb);
2970	device_printf(sc->mlx_dev, "  Latency                     %ds\n", sc->mlx_enq2->me_latency);
2971	device_printf(sc->mlx_dev, "  SCSI Timeout                %ds\n", sc->mlx_enq2->me_scsi_timeout);
2972	device_printf(sc->mlx_dev, "  Min Free Lines              %d\n", sc->mlx_enq2->me_min_freelines);
2973	device_printf(sc->mlx_dev, "  Rate Constant               %d\n", sc->mlx_enq2->me_rate_const);
2974	device_printf(sc->mlx_dev, "  MAXBLK                      %d\n", sc->mlx_enq2->me_maxblk);
2975	device_printf(sc->mlx_dev, "  Blocking Factor             %d sectors\n", sc->mlx_enq2->me_blocking_factor);
2976	device_printf(sc->mlx_dev, "  Cache Line Size             %d blocks\n", sc->mlx_enq2->me_cacheline);
2977	device_printf(sc->mlx_dev, "  SCSI Capability             %s%dMHz, %d bit\n",
2978		      sc->mlx_enq2->me_scsi_cap & (1<<4) ? "differential " : "",
2979		      (1 << ((sc->mlx_enq2->me_scsi_cap >> 2) & 3)) * 10,
2980		      8 << (sc->mlx_enq2->me_scsi_cap & 0x3));
2981	device_printf(sc->mlx_dev, "  Firmware Build Number       %d\n", sc->mlx_enq2->me_firmware_build);
2982	device_printf(sc->mlx_dev, "  Fault Management Type       %d\n", sc->mlx_enq2->me_fault_mgmt_type);
2983	device_printf(sc->mlx_dev, "  Features                    %b\n", sc->mlx_enq2->me_firmware_features,
2984		      "\20\4Background Init\3Read Ahead\2MORE\1Cluster\n");
2985
2986    }
2987}
2988
2989/*******************************************************************************
2990 * Emit a string describing the firmware handshake status code, and return a flag
2991 * indicating whether the code represents a fatal error.
2992 *
2993 * Error code interpretations are from the Linux driver, and don't directly match
2994 * the messages printed by Mylex's BIOS.  This may change if documentation on the
2995 * codes is forthcoming.
2996 */
2997static int
2998mlx_fw_message(struct mlx_softc *sc, int error, int param1, int param2)
2999{
3000    switch(error) {
3001    case 0x00:
3002	device_printf(sc->mlx_dev, "physical drive %d:%d not responding\n", param2, param1);
3003	break;
3004    case 0x08:
3005	/* we could be neater about this and give some indication when we receive more of them */
3006	if (!(sc->mlx_flags & MLX_SPINUP_REPORTED)) {
3007	    device_printf(sc->mlx_dev, "spinning up drives...\n");
3008	    sc->mlx_flags |= MLX_SPINUP_REPORTED;
3009	}
3010	break;
3011    case 0x30:
3012	device_printf(sc->mlx_dev, "configuration checksum error\n");
3013	break;
3014    case 0x60:
3015	device_printf(sc->mlx_dev, "mirror race recovery failed\n");
3016	break;
3017    case 0x70:
3018	device_printf(sc->mlx_dev, "mirror race recovery in progress\n");
3019	break;
3020    case 0x90:
3021	device_printf(sc->mlx_dev, "physical drive %d:%d COD mismatch\n", param2, param1);
3022	break;
3023    case 0xa0:
3024	device_printf(sc->mlx_dev, "logical drive installation aborted\n");
3025	break;
3026    case 0xb0:
3027	device_printf(sc->mlx_dev, "mirror race on a critical system drive\n");
3028	break;
3029    case 0xd0:
3030	device_printf(sc->mlx_dev, "new controller configuration found\n");
3031	break;
3032    case 0xf0:
3033	device_printf(sc->mlx_dev, "FATAL MEMORY PARITY ERROR\n");
3034	return(1);
3035    default:
3036	device_printf(sc->mlx_dev, "unknown firmware initialisation error %02x:%02x:%02x\n", error, param1, param2);
3037	break;
3038    }
3039    return(0);
3040}
3041
3042/********************************************************************************
3043 ********************************************************************************
3044                                                                Utility Functions
3045 ********************************************************************************
3046 ********************************************************************************/
3047
3048/********************************************************************************
3049 * Find the disk whose unit number is (unit) on this controller
3050 */
3051static struct mlx_sysdrive *
3052mlx_findunit(struct mlx_softc *sc, int unit)
3053{
3054    int		i;
3055
3056    /* search system drives */
3057    MLX_CONFIG_ASSERT_LOCKED(sc);
3058    for (i = 0; i < MLX_MAXDRIVES; i++) {
3059	/* is this one attached? */
3060	if (sc->mlx_sysdrive[i].ms_disk != 0) {
3061	    /* is this the one? */
3062	    if (unit == device_get_unit(sc->mlx_sysdrive[i].ms_disk))
3063		return(&sc->mlx_sysdrive[i]);
3064	}
3065    }
3066    return(NULL);
3067}
3068