xref: /netbsd-src/sys/dev/pci/amr.c (revision 6cf6fe02a981b55727c49c3d37b0d8191a98c0ee)
1 /*	$NetBSD: amr.c,v 1.58 2014/07/25 08:10:38 dholland Exp $	*/
2 
3 /*-
4  * Copyright (c) 2002, 2003 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Andrew Doran.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29  * POSSIBILITY OF SUCH DAMAGE.
30  */
31 
32 /*-
33  * Copyright (c) 1999,2000 Michael Smith
34  * Copyright (c) 2000 BSDi
35  * All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  *
46  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
47  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
48  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
49  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
50  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
51  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
52  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
53  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
54  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
55  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
56  * SUCH DAMAGE.
57  *
58  * from FreeBSD: amr_pci.c,v 1.5 2000/08/30 07:52:40 msmith Exp
59  * from FreeBSD: amr.c,v 1.16 2000/08/30 07:52:40 msmith Exp
60  */
61 
62 /*
63  * Driver for AMI RAID controllers.
64  */
65 
66 #include <sys/cdefs.h>
67 __KERNEL_RCSID(0, "$NetBSD: amr.c,v 1.58 2014/07/25 08:10:38 dholland Exp $");
68 
69 #include <sys/param.h>
70 #include <sys/systm.h>
71 #include <sys/kernel.h>
72 #include <sys/device.h>
73 #include <sys/queue.h>
74 #include <sys/proc.h>
75 #include <sys/buf.h>
76 #include <sys/malloc.h>
77 #include <sys/conf.h>
78 #include <sys/kthread.h>
79 #include <sys/kauth.h>
80 
81 #include <machine/endian.h>
82 #include <sys/bus.h>
83 
84 #include <dev/pci/pcidevs.h>
85 #include <dev/pci/pcivar.h>
86 #include <dev/pci/amrreg.h>
87 #include <dev/pci/amrvar.h>
88 #include <dev/pci/amrio.h>
89 
90 #include "locators.h"
91 
92 static void	amr_attach(device_t, device_t, void *);
93 static void	amr_ccb_dump(struct amr_softc *, struct amr_ccb *);
94 static void	*amr_enquire(struct amr_softc *, u_int8_t, u_int8_t, u_int8_t,
95 			     void *);
96 static int	amr_init(struct amr_softc *, const char *,
97 			 struct pci_attach_args *pa);
98 static int	amr_intr(void *);
99 static int	amr_match(device_t, cfdata_t, void *);
100 static int	amr_print(void *, const char *);
101 static void	amr_shutdown(void *);
102 static void	amr_teardown(struct amr_softc *);
103 static void	amr_thread(void *);
104 
105 static int	amr_quartz_get_work(struct amr_softc *,
106 				    struct amr_mailbox_resp *);
107 static int	amr_quartz_submit(struct amr_softc *, struct amr_ccb *);
108 static int	amr_std_get_work(struct amr_softc *, struct amr_mailbox_resp *);
109 static int	amr_std_submit(struct amr_softc *, struct amr_ccb *);
110 
111 static dev_type_open(amropen);
112 static dev_type_close(amrclose);
113 static dev_type_ioctl(amrioctl);
114 
115 CFATTACH_DECL_NEW(amr, sizeof(struct amr_softc),
116     amr_match, amr_attach, NULL, NULL);
117 
118 const struct cdevsw amr_cdevsw = {
119 	.d_open = amropen,
120 	.d_close = amrclose,
121 	.d_read = noread,
122 	.d_write = nowrite,
123 	.d_ioctl = amrioctl,
124 	.d_stop = nostop,
125 	.d_tty = notty,
126 	.d_poll = nopoll,
127 	.d_mmap = nommap,
128 	.d_kqfilter = nokqfilter,
129 	.d_discard = nodiscard,
130 	.d_flag = D_OTHER
131 };
132 
133 extern struct   cfdriver amr_cd;
134 
135 #define AT_QUARTZ	0x01	/* `Quartz' chipset */
136 #define	AT_SIG		0x02	/* Check for signature */
137 
138 static struct amr_pci_type {
139 	u_short	apt_vendor;
140 	u_short	apt_product;
141 	u_short	apt_flags;
142 } const amr_pci_type[] = {
143 	{ PCI_VENDOR_AMI,   PCI_PRODUCT_AMI_MEGARAID,  0 },
144 	{ PCI_VENDOR_AMI,   PCI_PRODUCT_AMI_MEGARAID2, 0 },
145 	{ PCI_VENDOR_AMI,   PCI_PRODUCT_AMI_MEGARAID3, AT_QUARTZ },
146 	{ PCI_VENDOR_SYMBIOS, PCI_PRODUCT_AMI_MEGARAID3, AT_QUARTZ },
147 	{ PCI_VENDOR_INTEL, PCI_PRODUCT_AMI_MEGARAID3, AT_QUARTZ | AT_SIG },
148 	{ PCI_VENDOR_INTEL,  PCI_PRODUCT_SYMBIOS_MEGARAID_320X, AT_QUARTZ },
149 	{ PCI_VENDOR_INTEL,  PCI_PRODUCT_SYMBIOS_MEGARAID_320E, AT_QUARTZ },
150 	{ PCI_VENDOR_SYMBIOS,  PCI_PRODUCT_SYMBIOS_MEGARAID_300X, AT_QUARTZ },
151 	{ PCI_VENDOR_DELL,  PCI_PRODUCT_DELL_PERC_4DI, AT_QUARTZ },
152 	{ PCI_VENDOR_DELL,  PCI_PRODUCT_DELL_PERC_4DI_2, AT_QUARTZ },
153 	{ PCI_VENDOR_DELL,  PCI_PRODUCT_DELL_PERC_4ESI, AT_QUARTZ },
154 	{ PCI_VENDOR_SYMBIOS,  PCI_PRODUCT_SYMBIOS_PERC_4SC, AT_QUARTZ },
155 	{ PCI_VENDOR_SYMBIOS,  PCI_PRODUCT_SYMBIOS_MEGARAID_320X, AT_QUARTZ },
156 	{ PCI_VENDOR_SYMBIOS,  PCI_PRODUCT_SYMBIOS_MEGARAID_320E, AT_QUARTZ },
157 	{ PCI_VENDOR_SYMBIOS,  PCI_PRODUCT_SYMBIOS_MEGARAID_300X, AT_QUARTZ },
158 };
159 
160 static struct amr_typestr {
161 	const char	*at_str;
162 	int		at_sig;
163 } const amr_typestr[] = {
164 	{ "Series 431",			AMR_SIG_431 },
165 	{ "Series 438",			AMR_SIG_438 },
166 	{ "Series 466",			AMR_SIG_466 },
167 	{ "Series 467",			AMR_SIG_467 },
168 	{ "Series 490",			AMR_SIG_490 },
169 	{ "Series 762",			AMR_SIG_762 },
170 	{ "HP NetRAID (T5)",		AMR_SIG_T5 },
171 	{ "HP NetRAID (T7)",		AMR_SIG_T7 },
172 };
173 
174 static struct {
175 	const char	*ds_descr;
176 	int	ds_happy;
177 } const amr_dstate[] = {
178 	{ "offline",	0 },
179 	{ "degraded",	1 },
180 	{ "optimal",	1 },
181 	{ "online",	1 },
182 	{ "failed",	0 },
183 	{ "rebuilding",	1 },
184 	{ "hotspare",	0 },
185 };
186 
187 static void	*amr_sdh;
188 
189 static int	amr_max_segs;
190 int		amr_max_xfer;
191 
192 static inline u_int8_t
193 amr_inb(struct amr_softc *amr, int off)
194 {
195 
196 	bus_space_barrier(amr->amr_iot, amr->amr_ioh, off, 1,
197 	    BUS_SPACE_BARRIER_WRITE | BUS_SPACE_BARRIER_READ);
198 	return (bus_space_read_1(amr->amr_iot, amr->amr_ioh, off));
199 }
200 
201 static inline u_int32_t
202 amr_inl(struct amr_softc *amr, int off)
203 {
204 
205 	bus_space_barrier(amr->amr_iot, amr->amr_ioh, off, 4,
206 	    BUS_SPACE_BARRIER_WRITE | BUS_SPACE_BARRIER_READ);
207 	return (bus_space_read_4(amr->amr_iot, amr->amr_ioh, off));
208 }
209 
210 static inline void
211 amr_outb(struct amr_softc *amr, int off, u_int8_t val)
212 {
213 
214 	bus_space_write_1(amr->amr_iot, amr->amr_ioh, off, val);
215 	bus_space_barrier(amr->amr_iot, amr->amr_ioh, off, 1,
216 	    BUS_SPACE_BARRIER_WRITE);
217 }
218 
219 static inline void
220 amr_outl(struct amr_softc *amr, int off, u_int32_t val)
221 {
222 
223 	bus_space_write_4(amr->amr_iot, amr->amr_ioh, off, val);
224 	bus_space_barrier(amr->amr_iot, amr->amr_ioh, off, 4,
225 	    BUS_SPACE_BARRIER_WRITE);
226 }
227 
228 /*
229  * Match a supported device.
230  */
231 static int
232 amr_match(device_t parent, cfdata_t match, void *aux)
233 {
234 	struct pci_attach_args *pa;
235 	pcireg_t s;
236 	int i;
237 
238 	pa = (struct pci_attach_args *)aux;
239 
240 	/*
241 	 * Don't match the device if it's operating in I2O mode.  In this
242 	 * case it should be handled by the `iop' driver.
243 	 */
244 	if (PCI_CLASS(pa->pa_class) == PCI_CLASS_I2O)
245 		return (0);
246 
247 	for (i = 0; i < sizeof(amr_pci_type) / sizeof(amr_pci_type[0]); i++)
248 		if (PCI_VENDOR(pa->pa_id) == amr_pci_type[i].apt_vendor &&
249 		    PCI_PRODUCT(pa->pa_id) == amr_pci_type[i].apt_product)
250 		    	break;
251 
252 	if (i == sizeof(amr_pci_type) / sizeof(amr_pci_type[0]))
253 		return (0);
254 
255 	if ((amr_pci_type[i].apt_flags & AT_SIG) == 0)
256 		return (1);
257 
258 	s = pci_conf_read(pa->pa_pc, pa->pa_tag, AMR_QUARTZ_SIG_REG) & 0xffff;
259 	return (s == AMR_QUARTZ_SIG0 || s == AMR_QUARTZ_SIG1);
260 }
261 
262 /*
263  * Attach a supported device.
264  */
265 static void
266 amr_attach(device_t parent, device_t self, void *aux)
267 {
268 	struct pci_attach_args *pa;
269 	struct amr_attach_args amra;
270 	const struct amr_pci_type *apt;
271 	struct amr_softc *amr;
272 	pci_chipset_tag_t pc;
273 	pci_intr_handle_t ih;
274 	const char *intrstr;
275 	pcireg_t reg;
276 	int rseg, i, j, size, rv, memreg, ioreg;
277 	struct amr_ccb *ac;
278 	int locs[AMRCF_NLOCS];
279 	char intrbuf[PCI_INTRSTR_LEN];
280 
281 	aprint_naive(": RAID controller\n");
282 
283 	amr = device_private(self);
284 	amr->amr_dv = self;
285 	pa = (struct pci_attach_args *)aux;
286 	pc = pa->pa_pc;
287 
288 	for (i = 0; i < sizeof(amr_pci_type) / sizeof(amr_pci_type[0]); i++)
289 		if (PCI_VENDOR(pa->pa_id) == amr_pci_type[i].apt_vendor &&
290 		    PCI_PRODUCT(pa->pa_id) == amr_pci_type[i].apt_product)
291 			break;
292 	apt = amr_pci_type + i;
293 
294 	memreg = ioreg = 0;
295 	for (i = 0x10; i <= 0x14; i += 4) {
296 		reg = pci_conf_read(pc, pa->pa_tag, i);
297 		switch (PCI_MAPREG_TYPE(reg)) {
298 		case PCI_MAPREG_TYPE_MEM:
299 			if (PCI_MAPREG_MEM_SIZE(reg) != 0)
300 				memreg = i;
301 			break;
302 		case PCI_MAPREG_TYPE_IO:
303 			if (PCI_MAPREG_IO_SIZE(reg) != 0)
304 				ioreg = i;
305 			break;
306 
307 		}
308 	}
309 
310 	if (memreg && pci_mapreg_map(pa, memreg, PCI_MAPREG_TYPE_MEM, 0,
311 	    &amr->amr_iot, &amr->amr_ioh, NULL, &amr->amr_ios) == 0)
312 		;
313 	else if (ioreg && pci_mapreg_map(pa, ioreg, PCI_MAPREG_TYPE_IO, 0,
314 	    &amr->amr_iot, &amr->amr_ioh, NULL, &amr->amr_ios) == 0)
315 		;
316 	else {
317 		aprint_error("can't map control registers\n");
318 		amr_teardown(amr);
319 		return;
320 	}
321 
322 	amr->amr_flags |= AMRF_PCI_REGS;
323 	amr->amr_dmat = pa->pa_dmat;
324 	amr->amr_pc = pa->pa_pc;
325 
326 	/* Enable the device. */
327 	reg = pci_conf_read(pa->pa_pc, pa->pa_tag, PCI_COMMAND_STATUS_REG);
328 	pci_conf_write(pa->pa_pc, pa->pa_tag, PCI_COMMAND_STATUS_REG,
329 	    reg | PCI_COMMAND_MASTER_ENABLE);
330 
331 	/* Map and establish the interrupt. */
332 	if (pci_intr_map(pa, &ih)) {
333 		aprint_error("can't map interrupt\n");
334 		amr_teardown(amr);
335 		return;
336 	}
337 	intrstr = pci_intr_string(pc, ih, intrbuf, sizeof(intrbuf));
338 	amr->amr_ih = pci_intr_establish(pc, ih, IPL_BIO, amr_intr, amr);
339 	if (amr->amr_ih == NULL) {
340 		aprint_error("can't establish interrupt");
341 		if (intrstr != NULL)
342 			aprint_error(" at %s", intrstr);
343 		aprint_error("\n");
344 		amr_teardown(amr);
345 		return;
346 	}
347 	amr->amr_flags |= AMRF_PCI_INTR;
348 
349 	/*
350 	 * Allocate space for the mailbox and S/G lists.  Some controllers
351 	 * don't like S/G lists to be located below 0x2000, so we allocate
352 	 * enough slop to enable us to compensate.
353 	 *
354 	 * The standard mailbox structure needs to be aligned on a 16-byte
355 	 * boundary.  The 64-bit mailbox has one extra field, 4 bytes in
356 	 * size, which precedes the standard mailbox.
357 	 */
358 	size = AMR_SGL_SIZE * AMR_MAX_CMDS + 0x2000;
359 	amr->amr_dmasize = size;
360 
361 	if ((rv = bus_dmamem_alloc(amr->amr_dmat, size, PAGE_SIZE, 0,
362 	    &amr->amr_dmaseg, 1, &rseg, BUS_DMA_NOWAIT)) != 0) {
363 		aprint_error_dev(amr->amr_dv, "unable to allocate buffer, rv = %d\n",
364 		    rv);
365 		amr_teardown(amr);
366 		return;
367 	}
368 	amr->amr_flags |= AMRF_DMA_ALLOC;
369 
370 	if ((rv = bus_dmamem_map(amr->amr_dmat, &amr->amr_dmaseg, rseg, size,
371 	    (void **)&amr->amr_mbox,
372 	    BUS_DMA_NOWAIT | BUS_DMA_COHERENT)) != 0) {
373 		aprint_error_dev(amr->amr_dv, "unable to map buffer, rv = %d\n",
374 		    rv);
375 		amr_teardown(amr);
376 		return;
377 	}
378 	amr->amr_flags |= AMRF_DMA_MAP;
379 
380 	if ((rv = bus_dmamap_create(amr->amr_dmat, size, 1, size, 0,
381 	    BUS_DMA_NOWAIT, &amr->amr_dmamap)) != 0) {
382 		aprint_error_dev(amr->amr_dv, "unable to create buffer DMA map, rv = %d\n",
383 		    rv);
384 		amr_teardown(amr);
385 		return;
386 	}
387 	amr->amr_flags |= AMRF_DMA_CREATE;
388 
389 	if ((rv = bus_dmamap_load(amr->amr_dmat, amr->amr_dmamap,
390 	    amr->amr_mbox, size, NULL, BUS_DMA_NOWAIT)) != 0) {
391 		aprint_error_dev(amr->amr_dv, "unable to load buffer DMA map, rv = %d\n",
392 		    rv);
393 		amr_teardown(amr);
394 		return;
395 	}
396 	amr->amr_flags |= AMRF_DMA_LOAD;
397 
398 	memset(amr->amr_mbox, 0, size);
399 
400 	amr->amr_mbox_paddr = amr->amr_dmamap->dm_segs[0].ds_addr;
401 	amr->amr_sgls_paddr = (amr->amr_mbox_paddr + 0x1fff) & ~0x1fff;
402 	amr->amr_sgls = (struct amr_sgentry *)((char *)amr->amr_mbox +
403 	    amr->amr_sgls_paddr - amr->amr_dmamap->dm_segs[0].ds_addr);
404 
405 	/*
406 	 * Allocate and initalise the command control blocks.
407 	 */
408 	ac = malloc(sizeof(*ac) * AMR_MAX_CMDS, M_DEVBUF, M_NOWAIT | M_ZERO);
409 	amr->amr_ccbs = ac;
410 	SLIST_INIT(&amr->amr_ccb_freelist);
411 	TAILQ_INIT(&amr->amr_ccb_active);
412 	amr->amr_flags |= AMRF_CCBS;
413 
414 	if (amr_max_xfer == 0) {
415 		amr_max_xfer = min(((AMR_MAX_SEGS - 1) * PAGE_SIZE), MAXPHYS);
416 		amr_max_segs = (amr_max_xfer + (PAGE_SIZE * 2) - 1) / PAGE_SIZE;
417 	}
418 
419 	for (i = 0; i < AMR_MAX_CMDS; i++, ac++) {
420 		rv = bus_dmamap_create(amr->amr_dmat, amr_max_xfer,
421 		    amr_max_segs, amr_max_xfer, 0,
422 		    BUS_DMA_NOWAIT | BUS_DMA_ALLOCNOW, &ac->ac_xfer_map);
423 		if (rv != 0)
424 			break;
425 
426 		ac->ac_ident = i;
427 		amr_ccb_free(amr, ac);
428 	}
429 	if (i != AMR_MAX_CMDS) {
430 		aprint_error_dev(amr->amr_dv, "memory exhausted\n");
431 		amr_teardown(amr);
432 		return;
433 	}
434 
435 	/*
436 	 * Take care of model-specific tasks.
437 	 */
438 	if ((apt->apt_flags & AT_QUARTZ) != 0) {
439 		amr->amr_submit = amr_quartz_submit;
440 		amr->amr_get_work = amr_quartz_get_work;
441 	} else {
442 		amr->amr_submit = amr_std_submit;
443 		amr->amr_get_work = amr_std_get_work;
444 
445 		/* Notify the controller of the mailbox location. */
446 		amr_outl(amr, AMR_SREG_MBOX, (u_int32_t)amr->amr_mbox_paddr + 16);
447 		amr_outb(amr, AMR_SREG_MBOX_ENABLE, AMR_SMBOX_ENABLE_ADDR);
448 
449 		/* Clear outstanding interrupts and enable interrupts. */
450 		amr_outb(amr, AMR_SREG_CMD, AMR_SCMD_ACKINTR);
451 		amr_outb(amr, AMR_SREG_TOGL,
452 		    amr_inb(amr, AMR_SREG_TOGL) | AMR_STOGL_ENABLE);
453 	}
454 
455 	/*
456 	 * Retrieve parameters, and tell the world about us.
457 	 */
458 	amr->amr_enqbuf = malloc(AMR_ENQUIRY_BUFSIZE, M_DEVBUF, M_NOWAIT);
459 	amr->amr_flags |= AMRF_ENQBUF;
460 	amr->amr_maxqueuecnt = i;
461 	aprint_normal(": AMI RAID ");
462 	if (amr_init(amr, intrstr, pa) != 0) {
463 		amr_teardown(amr);
464 		return;
465 	}
466 
467 	/*
468 	 * Cap the maximum number of outstanding commands.  AMI's Linux
469 	 * driver doesn't trust the controller's reported value, and lockups
470 	 * have been seen when we do.
471 	 */
472 	amr->amr_maxqueuecnt = min(amr->amr_maxqueuecnt, AMR_MAX_CMDS);
473 	if (amr->amr_maxqueuecnt > i)
474 		amr->amr_maxqueuecnt = i;
475 
476 	/* Set our `shutdownhook' before we start any device activity. */
477 	if (amr_sdh == NULL)
478 		amr_sdh = shutdownhook_establish(amr_shutdown, NULL);
479 
480 	/* Attach sub-devices. */
481 	for (j = 0; j < amr->amr_numdrives; j++) {
482 		if (amr->amr_drive[j].al_size == 0)
483 			continue;
484 		amra.amra_unit = j;
485 
486 		locs[AMRCF_UNIT] = j;
487 
488 		amr->amr_drive[j].al_dv = config_found_sm_loc(amr->amr_dv,
489 			"amr", locs, &amra, amr_print, config_stdsubmatch);
490 	}
491 
492 	SIMPLEQ_INIT(&amr->amr_ccb_queue);
493 
494 	/* XXX This doesn't work for newer boards yet. */
495 	if ((apt->apt_flags & AT_QUARTZ) == 0) {
496 		rv = kthread_create(PRI_NONE, 0, NULL, amr_thread, amr,
497 		    &amr->amr_thread, "%s", device_xname(amr->amr_dv));
498  		if (rv != 0)
499 			aprint_error_dev(amr->amr_dv, "unable to create thread (%d)",
500  			    rv);
501  		else
502  			amr->amr_flags |= AMRF_THREAD;
503 	}
504 }
505 
506 /*
507  * Free up resources.
508  */
509 static void
510 amr_teardown(struct amr_softc *amr)
511 {
512 	struct amr_ccb *ac;
513 	int fl;
514 
515 	fl = amr->amr_flags;
516 
517 	if ((fl & AMRF_THREAD) != 0) {
518 		amr->amr_flags |= AMRF_THREAD_EXIT;
519 		wakeup(amr_thread);
520 		while ((amr->amr_flags & AMRF_THREAD_EXIT) != 0)
521 			tsleep(&amr->amr_flags, PWAIT, "amrexit", 0);
522 	}
523 	if ((fl & AMRF_CCBS) != 0) {
524 		SLIST_FOREACH(ac, &amr->amr_ccb_freelist, ac_chain.slist) {
525 			bus_dmamap_destroy(amr->amr_dmat, ac->ac_xfer_map);
526 		}
527 		free(amr->amr_ccbs, M_DEVBUF);
528 	}
529 	if ((fl & AMRF_ENQBUF) != 0)
530 		free(amr->amr_enqbuf, M_DEVBUF);
531 	if ((fl & AMRF_DMA_LOAD) != 0)
532 		bus_dmamap_unload(amr->amr_dmat, amr->amr_dmamap);
533 	if ((fl & AMRF_DMA_MAP) != 0)
534 		bus_dmamem_unmap(amr->amr_dmat, (void *)amr->amr_mbox,
535 		    amr->amr_dmasize);
536 	if ((fl & AMRF_DMA_ALLOC) != 0)
537 		bus_dmamem_free(amr->amr_dmat, &amr->amr_dmaseg, 1);
538 	if ((fl & AMRF_DMA_CREATE) != 0)
539 		bus_dmamap_destroy(amr->amr_dmat, amr->amr_dmamap);
540 	if ((fl & AMRF_PCI_INTR) != 0)
541 		pci_intr_disestablish(amr->amr_pc, amr->amr_ih);
542 	if ((fl & AMRF_PCI_REGS) != 0)
543 		bus_space_unmap(amr->amr_iot, amr->amr_ioh, amr->amr_ios);
544 }
545 
546 /*
547  * Print autoconfiguration message for a sub-device.
548  */
549 static int
550 amr_print(void *aux, const char *pnp)
551 {
552 	struct amr_attach_args *amra;
553 
554 	amra = (struct amr_attach_args *)aux;
555 
556 	if (pnp != NULL)
557 		aprint_normal("block device at %s", pnp);
558 	aprint_normal(" unit %d", amra->amra_unit);
559 	return (UNCONF);
560 }
561 
562 /*
563  * Retrieve operational parameters and describe the controller.
564  */
565 static int
566 amr_init(struct amr_softc *amr, const char *intrstr,
567 	 struct pci_attach_args *pa)
568 {
569 	struct amr_adapter_info *aa;
570 	struct amr_prodinfo *ap;
571 	struct amr_enquiry *ae;
572 	struct amr_enquiry3 *aex;
573 	const char *prodstr;
574 	u_int i, sig, ishp;
575 	char sbuf[64];
576 
577 	/*
578 	 * Try to get 40LD product info, which tells us what the card is
579 	 * labelled as.
580 	 */
581 	ap = amr_enquire(amr, AMR_CMD_CONFIG, AMR_CONFIG_PRODUCT_INFO, 0,
582 	    amr->amr_enqbuf);
583 	if (ap != NULL) {
584 		aprint_normal("<%.80s>\n", ap->ap_product);
585 		if (intrstr != NULL)
586 			aprint_normal_dev(amr->amr_dv, "interrupting at %s\n",
587 			    intrstr);
588 		aprint_normal_dev(amr->amr_dv, "firmware %.16s, BIOS %.16s, %dMB RAM\n",
589 		    ap->ap_firmware, ap->ap_bios,
590 		    le16toh(ap->ap_memsize));
591 
592 		amr->amr_maxqueuecnt = ap->ap_maxio;
593 
594 		/*
595 		 * Fetch and record state of logical drives.
596 		 */
597 		aex = amr_enquire(amr, AMR_CMD_CONFIG, AMR_CONFIG_ENQ3,
598 		    AMR_CONFIG_ENQ3_SOLICITED_FULL, amr->amr_enqbuf);
599 		if (aex == NULL) {
600 			aprint_error_dev(amr->amr_dv, "ENQUIRY3 failed\n");
601 			return (-1);
602 		}
603 
604 		if (aex->ae_numldrives > __arraycount(aex->ae_drivestate)) {
605 			aprint_error_dev(amr->amr_dv, "Inquiry returned more drives (%d)"
606 			   " than the array can handle (%zu)\n",
607 			   aex->ae_numldrives,
608 			   __arraycount(aex->ae_drivestate));
609 			aex->ae_numldrives = __arraycount(aex->ae_drivestate);
610 		}
611 		if (aex->ae_numldrives > AMR_MAX_UNITS) {
612 			aprint_error_dev(amr->amr_dv,
613 			    "adjust AMR_MAX_UNITS to %d (currently %d)"
614 			    "\n", AMR_MAX_UNITS,
615 			    amr->amr_numdrives);
616 			amr->amr_numdrives = AMR_MAX_UNITS;
617 		} else
618 			amr->amr_numdrives = aex->ae_numldrives;
619 
620 		for (i = 0; i < amr->amr_numdrives; i++) {
621 			amr->amr_drive[i].al_size =
622 			    le32toh(aex->ae_drivesize[i]);
623 			amr->amr_drive[i].al_state = aex->ae_drivestate[i];
624 			amr->amr_drive[i].al_properties = aex->ae_driveprop[i];
625 		}
626 
627 		return (0);
628 	}
629 
630 	/*
631 	 * Try 8LD extended ENQUIRY to get the controller signature.  Once
632 	 * found, search for a product description.
633 	 */
634 	ae = amr_enquire(amr, AMR_CMD_EXT_ENQUIRY2, 0, 0, amr->amr_enqbuf);
635 	if (ae != NULL) {
636 		i = 0;
637 		sig = le32toh(ae->ae_signature);
638 
639 		while (i < sizeof(amr_typestr) / sizeof(amr_typestr[0])) {
640 			if (amr_typestr[i].at_sig == sig)
641 				break;
642 			i++;
643 		}
644 		if (i == sizeof(amr_typestr) / sizeof(amr_typestr[0])) {
645 			snprintf(sbuf, sizeof(sbuf),
646 			    "unknown ENQUIRY2 sig (0x%08x)", sig);
647 			prodstr = sbuf;
648 		} else
649 			prodstr = amr_typestr[i].at_str;
650 	} else {
651 		ae = amr_enquire(amr, AMR_CMD_ENQUIRY, 0, 0, amr->amr_enqbuf);
652 		if (ae == NULL) {
653 			aprint_error_dev(amr->amr_dv, "unsupported controller\n");
654 			return (-1);
655 		}
656 
657 		switch (PCI_PRODUCT(pa->pa_id)) {
658 		case PCI_PRODUCT_AMI_MEGARAID:
659 			prodstr = "Series 428";
660 			break;
661 		case PCI_PRODUCT_AMI_MEGARAID2:
662 			prodstr = "Series 434";
663 			break;
664 		default:
665 			snprintf(sbuf, sizeof(sbuf), "unknown PCI dev (0x%04x)",
666 			    PCI_PRODUCT(pa->pa_id));
667 			prodstr = sbuf;
668 			break;
669 		}
670 	}
671 
672 	/*
673 	 * HP NetRaid controllers have a special encoding of the firmware
674 	 * and BIOS versions.  The AMI version seems to have it as strings
675 	 * whereas the HP version does it with a leading uppercase character
676 	 * and two binary numbers.
677 	*/
678 	aa = &ae->ae_adapter;
679 
680 	if (aa->aa_firmware[2] >= 'A' && aa->aa_firmware[2] <= 'Z' &&
681 	    aa->aa_firmware[1] <  ' ' && aa->aa_firmware[0] <  ' ' &&
682 	    aa->aa_bios[2] >= 'A' && aa->aa_bios[2] <= 'Z' &&
683 	    aa->aa_bios[1] <  ' ' && aa->aa_bios[0] <  ' ') {
684 		if (le32toh(ae->ae_signature) == AMR_SIG_438) {
685 			/* The AMI 438 is a NetRaid 3si in HP-land. */
686 			prodstr = "HP NetRaid 3si";
687 		}
688 		ishp = 1;
689 	} else
690 		ishp = 0;
691 
692 	aprint_normal("<%s>\n", prodstr);
693 	if (intrstr != NULL)
694 		aprint_normal_dev(amr->amr_dv, "interrupting at %s\n",
695 		    intrstr);
696 
697 	if (ishp)
698 		aprint_normal_dev(amr->amr_dv, "firmware <%c.%02d.%02d>, BIOS <%c.%02d.%02d>"
699 		    ", %dMB RAM\n", aa->aa_firmware[2],
700 		     aa->aa_firmware[1], aa->aa_firmware[0], aa->aa_bios[2],
701 		     aa->aa_bios[1], aa->aa_bios[0], aa->aa_memorysize);
702 	else
703 		aprint_normal_dev(amr->amr_dv, "firmware <%.4s>, BIOS <%.4s>, %dMB RAM\n",
704 		    aa->aa_firmware, aa->aa_bios,
705 		    aa->aa_memorysize);
706 
707 	amr->amr_maxqueuecnt = aa->aa_maxio;
708 
709 	/*
710 	 * Record state of logical drives.
711 	 */
712 	if (ae->ae_ldrv.al_numdrives > __arraycount(ae->ae_ldrv.al_size)) {
713 		aprint_error_dev(amr->amr_dv, "Inquiry returned more drives (%d)"
714 		   " than the array can handle (%zu)\n",
715 		   ae->ae_ldrv.al_numdrives,
716 		   __arraycount(ae->ae_ldrv.al_size));
717 		ae->ae_ldrv.al_numdrives = __arraycount(ae->ae_ldrv.al_size);
718 	}
719 	if (ae->ae_ldrv.al_numdrives > AMR_MAX_UNITS) {
720 		aprint_error_dev(amr->amr_dv, "adjust AMR_MAX_UNITS to %d (currently %d)\n",
721 		    ae->ae_ldrv.al_numdrives,
722 		    AMR_MAX_UNITS);
723 		amr->amr_numdrives = AMR_MAX_UNITS;
724 	} else
725 		amr->amr_numdrives = ae->ae_ldrv.al_numdrives;
726 
727 	for (i = 0; i < amr->amr_numdrives; i++) {
728 		amr->amr_drive[i].al_size = le32toh(ae->ae_ldrv.al_size[i]);
729 		amr->amr_drive[i].al_state = ae->ae_ldrv.al_state[i];
730 		amr->amr_drive[i].al_properties = ae->ae_ldrv.al_properties[i];
731 	}
732 
733 	return (0);
734 }
735 
736 /*
737  * Flush the internal cache on each configured controller.  Called at
738  * shutdown time.
739  */
740 static void
741 amr_shutdown(void *cookie)
742 {
743 	extern struct cfdriver amr_cd;
744 	struct amr_softc *amr;
745 	struct amr_ccb *ac;
746 	int i, rv, s;
747 
748 	for (i = 0; i < amr_cd.cd_ndevs; i++) {
749 		if ((amr = device_lookup_private(&amr_cd, i)) == NULL)
750 			continue;
751 
752 		if ((rv = amr_ccb_alloc(amr, &ac)) == 0) {
753 			ac->ac_cmd.mb_command = AMR_CMD_FLUSH;
754 			s = splbio();
755 			rv = amr_ccb_poll(amr, ac, 30000);
756 			splx(s);
757 			amr_ccb_free(amr, ac);
758 		}
759 		if (rv != 0)
760 			aprint_error_dev(amr->amr_dv, "unable to flush cache (%d)\n", rv);
761 	}
762 }
763 
764 /*
765  * Interrupt service routine.
766  */
767 static int
768 amr_intr(void *cookie)
769 {
770 	struct amr_softc *amr;
771 	struct amr_ccb *ac;
772 	struct amr_mailbox_resp mbox;
773 	u_int i, forus, idx;
774 
775 	amr = cookie;
776 	forus = 0;
777 
778 	while ((*amr->amr_get_work)(amr, &mbox) == 0) {
779 		/* Iterate over completed commands in this result. */
780 		for (i = 0; i < mbox.mb_nstatus; i++) {
781 			idx = mbox.mb_completed[i] - 1;
782 			ac = amr->amr_ccbs + idx;
783 
784 			if (idx >= amr->amr_maxqueuecnt) {
785 				printf("%s: bad status (bogus ID: %u=%u)\n",
786 				    device_xname(amr->amr_dv), i, idx);
787 				continue;
788 			}
789 
790 			if ((ac->ac_flags & AC_ACTIVE) == 0) {
791 				printf("%s: bad status (not active; 0x04%x)\n",
792 				    device_xname(amr->amr_dv), ac->ac_flags);
793 				continue;
794 			}
795 
796 			ac->ac_status = mbox.mb_status;
797 			ac->ac_flags = (ac->ac_flags & ~AC_ACTIVE) |
798 			    AC_COMPLETE;
799 			TAILQ_REMOVE(&amr->amr_ccb_active, ac, ac_chain.tailq);
800 
801 			if ((ac->ac_flags & AC_MOAN) != 0)
802 				printf("%s: ccb %d completed\n",
803 				    device_xname(amr->amr_dv), ac->ac_ident);
804 
805 			/* Pass notification to upper layers. */
806 			if (ac->ac_handler != NULL)
807 				(*ac->ac_handler)(ac);
808 			else
809 				wakeup(ac);
810 		}
811 		forus = 1;
812 	}
813 
814 	if (forus)
815 		amr_ccb_enqueue(amr, NULL);
816 
817 	return (forus);
818 }
819 
820 /*
821  * Watchdog thread.
822  */
823 static void
824 amr_thread(void *cookie)
825 {
826 	struct amr_softc *amr;
827 	struct amr_ccb *ac;
828 	struct amr_logdrive *al;
829 	struct amr_enquiry *ae;
830 	int rv, i, s;
831 
832 	amr = cookie;
833 	ae = amr->amr_enqbuf;
834 
835 	for (;;) {
836 		tsleep(amr_thread, PWAIT, "amrwdog", AMR_WDOG_TICKS);
837 
838 		if ((amr->amr_flags & AMRF_THREAD_EXIT) != 0) {
839 			amr->amr_flags ^= AMRF_THREAD_EXIT;
840 			wakeup(&amr->amr_flags);
841 			kthread_exit(0);
842 		}
843 
844 		s = splbio();
845 		amr_intr(cookie);
846 		ac = TAILQ_FIRST(&amr->amr_ccb_active);
847 		while (ac != NULL) {
848 			if (ac->ac_start_time + AMR_TIMEOUT > time_uptime)
849 				break;
850 			if ((ac->ac_flags & AC_MOAN) == 0) {
851 				printf("%s: ccb %d timed out; mailbox:\n",
852 				    device_xname(amr->amr_dv), ac->ac_ident);
853 				amr_ccb_dump(amr, ac);
854 				ac->ac_flags |= AC_MOAN;
855 			}
856 			ac = TAILQ_NEXT(ac, ac_chain.tailq);
857 		}
858 		splx(s);
859 
860 		if ((rv = amr_ccb_alloc(amr, &ac)) != 0) {
861 			printf("%s: ccb_alloc failed (%d)\n",
862  			    device_xname(amr->amr_dv), rv);
863 			continue;
864 		}
865 
866 		ac->ac_cmd.mb_command = AMR_CMD_ENQUIRY;
867 
868 		rv = amr_ccb_map(amr, ac, amr->amr_enqbuf,
869 		    AMR_ENQUIRY_BUFSIZE, AC_XFER_IN);
870 		if (rv != 0) {
871 			aprint_error_dev(amr->amr_dv, "ccb_map failed (%d)\n",
872  			    rv);
873 			amr_ccb_free(amr, ac);
874 			continue;
875 		}
876 
877 		rv = amr_ccb_wait(amr, ac);
878 		amr_ccb_unmap(amr, ac);
879 		if (rv != 0) {
880 			aprint_error_dev(amr->amr_dv, "enquiry failed (st=%d)\n",
881  			    ac->ac_status);
882 			continue;
883 		}
884 		amr_ccb_free(amr, ac);
885 
886 		al = amr->amr_drive;
887 		for (i = 0; i < __arraycount(ae->ae_ldrv.al_state); i++, al++) {
888 			if (al->al_dv == NULL)
889 				continue;
890 			if (al->al_state == ae->ae_ldrv.al_state[i])
891 				continue;
892 
893 			printf("%s: state changed: %s -> %s\n",
894 			    device_xname(al->al_dv),
895 			    amr_drive_state(al->al_state, NULL),
896 			    amr_drive_state(ae->ae_ldrv.al_state[i], NULL));
897 
898 			al->al_state = ae->ae_ldrv.al_state[i];
899 		}
900 	}
901 }
902 
903 /*
904  * Return a text description of a logical drive's current state.
905  */
906 const char *
907 amr_drive_state(int state, int *happy)
908 {
909 	const char *str;
910 
911 	state = AMR_DRV_CURSTATE(state);
912 	if (state >= sizeof(amr_dstate) / sizeof(amr_dstate[0])) {
913 		if (happy)
914 			*happy = 1;
915 		str = "status unknown";
916 	} else {
917 		if (happy)
918 			*happy = amr_dstate[state].ds_happy;
919 		str = amr_dstate[state].ds_descr;
920 	}
921 
922 	return (str);
923 }
924 
925 /*
926  * Run a generic enquiry-style command.
927  */
928 static void *
929 amr_enquire(struct amr_softc *amr, u_int8_t cmd, u_int8_t cmdsub,
930 	    u_int8_t cmdqual, void *sbuf)
931 {
932 	struct amr_ccb *ac;
933 	u_int8_t *mb;
934 	int rv;
935 
936 	if (amr_ccb_alloc(amr, &ac) != 0)
937 		return (NULL);
938 
939 	/* Build the command proper. */
940 	mb = (u_int8_t *)&ac->ac_cmd;
941 	mb[0] = cmd;
942 	mb[2] = cmdsub;
943 	mb[3] = cmdqual;
944 
945 	rv = amr_ccb_map(amr, ac, sbuf, AMR_ENQUIRY_BUFSIZE, AC_XFER_IN);
946 	if (rv == 0) {
947 		rv = amr_ccb_poll(amr, ac, 2000);
948 		amr_ccb_unmap(amr, ac);
949 	}
950 	amr_ccb_free(amr, ac);
951 
952 	return (rv ? NULL : sbuf);
953 }
954 
955 /*
956  * Allocate and initialise a CCB.
957  */
958 int
959 amr_ccb_alloc(struct amr_softc *amr, struct amr_ccb **acp)
960 {
961 	int s;
962 
963 	s = splbio();
964 	if ((*acp = SLIST_FIRST(&amr->amr_ccb_freelist)) == NULL) {
965 		splx(s);
966 		return (EAGAIN);
967 	}
968 	SLIST_REMOVE_HEAD(&amr->amr_ccb_freelist, ac_chain.slist);
969 	splx(s);
970 
971 	return (0);
972 }
973 
974 /*
975  * Free a CCB.
976  */
977 void
978 amr_ccb_free(struct amr_softc *amr, struct amr_ccb *ac)
979 {
980 	int s;
981 
982 	memset(&ac->ac_cmd, 0, sizeof(ac->ac_cmd));
983 	ac->ac_cmd.mb_ident = ac->ac_ident + 1;
984 	ac->ac_cmd.mb_busy = 1;
985 	ac->ac_handler = NULL;
986 	ac->ac_flags = 0;
987 
988 	s = splbio();
989 	SLIST_INSERT_HEAD(&amr->amr_ccb_freelist, ac, ac_chain.slist);
990 	splx(s);
991 }
992 
993 /*
994  * If a CCB is specified, enqueue it.  Pull CCBs off the software queue in
995  * the order that they were enqueued and try to submit their command blocks
996  * to the controller for execution.
997  */
998 void
999 amr_ccb_enqueue(struct amr_softc *amr, struct amr_ccb *ac)
1000 {
1001 	int s;
1002 
1003 	s = splbio();
1004 
1005 	if (ac != NULL)
1006 		SIMPLEQ_INSERT_TAIL(&amr->amr_ccb_queue, ac, ac_chain.simpleq);
1007 
1008 	while ((ac = SIMPLEQ_FIRST(&amr->amr_ccb_queue)) != NULL) {
1009 		if ((*amr->amr_submit)(amr, ac) != 0)
1010 			break;
1011 		SIMPLEQ_REMOVE_HEAD(&amr->amr_ccb_queue, ac_chain.simpleq);
1012 		TAILQ_INSERT_TAIL(&amr->amr_ccb_active, ac, ac_chain.tailq);
1013 	}
1014 
1015 	splx(s);
1016 }
1017 
1018 /*
1019  * Map the specified CCB's data buffer onto the bus, and fill the
1020  * scatter-gather list.
1021  */
1022 int
1023 amr_ccb_map(struct amr_softc *amr, struct amr_ccb *ac, void *data, int size,
1024 	    int tflag)
1025 {
1026 	struct amr_sgentry *sge;
1027 	struct amr_mailbox_cmd *mb;
1028 	int nsegs, i, rv, sgloff;
1029 	bus_dmamap_t xfer;
1030 	int dmaflag = 0;
1031 
1032 	xfer = ac->ac_xfer_map;
1033 
1034 	rv = bus_dmamap_load(amr->amr_dmat, xfer, data, size, NULL,
1035 	    BUS_DMA_NOWAIT);
1036 	if (rv != 0)
1037 		return (rv);
1038 
1039 	mb = &ac->ac_cmd;
1040 	ac->ac_xfer_size = size;
1041 	ac->ac_flags |= (tflag & (AC_XFER_OUT | AC_XFER_IN));
1042 	sgloff = AMR_SGL_SIZE * ac->ac_ident;
1043 
1044 	if (tflag & AC_XFER_OUT)
1045 		dmaflag |= BUS_DMASYNC_PREWRITE;
1046 	if (tflag & AC_XFER_IN)
1047 		dmaflag |= BUS_DMASYNC_PREREAD;
1048 
1049 	/* We don't need to use a scatter/gather list for just 1 segment. */
1050 	nsegs = xfer->dm_nsegs;
1051 	if (nsegs == 1) {
1052 		mb->mb_nsgelem = 0;
1053 		mb->mb_physaddr = htole32(xfer->dm_segs[0].ds_addr);
1054 		ac->ac_flags |= AC_NOSGL;
1055 	} else {
1056 		mb->mb_nsgelem = nsegs;
1057 		mb->mb_physaddr = htole32(amr->amr_sgls_paddr + sgloff);
1058 
1059 		sge = (struct amr_sgentry *)((char *)amr->amr_sgls + sgloff);
1060 		for (i = 0; i < nsegs; i++, sge++) {
1061 			sge->sge_addr = htole32(xfer->dm_segs[i].ds_addr);
1062 			sge->sge_count = htole32(xfer->dm_segs[i].ds_len);
1063 		}
1064 	}
1065 
1066 	bus_dmamap_sync(amr->amr_dmat, xfer, 0, ac->ac_xfer_size, dmaflag);
1067 
1068 	if ((ac->ac_flags & AC_NOSGL) == 0)
1069 		bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, sgloff,
1070 		    AMR_SGL_SIZE, BUS_DMASYNC_PREWRITE);
1071 
1072 	return (0);
1073 }
1074 
1075 /*
1076  * Unmap the specified CCB's data buffer.
1077  */
1078 void
1079 amr_ccb_unmap(struct amr_softc *amr, struct amr_ccb *ac)
1080 {
1081 	int dmaflag = 0;
1082 
1083 	if (ac->ac_flags & AC_XFER_IN)
1084 		dmaflag |= BUS_DMASYNC_POSTREAD;
1085 	if (ac->ac_flags & AC_XFER_OUT)
1086 		dmaflag |= BUS_DMASYNC_POSTWRITE;
1087 
1088 	if ((ac->ac_flags & AC_NOSGL) == 0)
1089 		bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap,
1090 		    AMR_SGL_SIZE * ac->ac_ident, AMR_SGL_SIZE,
1091 		    BUS_DMASYNC_POSTWRITE);
1092 	bus_dmamap_sync(amr->amr_dmat, ac->ac_xfer_map, 0, ac->ac_xfer_size,
1093 	    dmaflag);
1094 	bus_dmamap_unload(amr->amr_dmat, ac->ac_xfer_map);
1095 }
1096 
1097 /*
1098  * Submit a command to the controller and poll on completion.  Return
1099  * non-zero on timeout or error.  Must be called with interrupts blocked.
1100  */
1101 int
1102 amr_ccb_poll(struct amr_softc *amr, struct amr_ccb *ac, int timo)
1103 {
1104 	int rv;
1105 
1106 	if ((rv = (*amr->amr_submit)(amr, ac)) != 0)
1107 		return (rv);
1108 	TAILQ_INSERT_TAIL(&amr->amr_ccb_active, ac, ac_chain.tailq);
1109 
1110 	for (timo *= 10; timo != 0; timo--) {
1111 		amr_intr(amr);
1112 		if ((ac->ac_flags & AC_COMPLETE) != 0)
1113 			break;
1114 		DELAY(100);
1115 	}
1116 
1117 	return (timo == 0 || ac->ac_status != 0 ? EIO : 0);
1118 }
1119 
1120 /*
1121  * Submit a command to the controller and sleep on completion.  Return
1122  * non-zero on error.
1123  */
1124 int
1125 amr_ccb_wait(struct amr_softc *amr, struct amr_ccb *ac)
1126 {
1127 	int s;
1128 
1129 	s = splbio();
1130 	amr_ccb_enqueue(amr, ac);
1131 	tsleep(ac, PRIBIO, "amrcmd", 0);
1132 	splx(s);
1133 
1134 	return (ac->ac_status != 0 ? EIO : 0);
1135 }
1136 
1137 #if 0
1138 /*
1139  * Wait for the mailbox to become available.
1140  */
1141 static int
1142 amr_mbox_wait(struct amr_softc *amr)
1143 {
1144 	int timo;
1145 
1146 	for (timo = 10000; timo != 0; timo--) {
1147 		bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1148 		    sizeof(struct amr_mailbox), BUS_DMASYNC_POSTREAD);
1149 		if (amr->amr_mbox->mb_cmd.mb_busy == 0)
1150 			break;
1151 		DELAY(100);
1152 	}
1153 
1154 	if (timo == 0)
1155 		printf("%s: controller wedged\n", device_xname(amr->amr_dv));
1156 
1157 	return (timo != 0 ? 0 : EAGAIN);
1158 }
1159 #endif
1160 
1161 /*
1162  * Tell the controller that the mailbox contains a valid command.  Must be
1163  * called with interrupts blocked.
1164  */
1165 static int
1166 amr_quartz_submit(struct amr_softc *amr, struct amr_ccb *ac)
1167 {
1168 	u_int32_t v;
1169 
1170 	amr->amr_mbox->mb_poll = 0;
1171 	amr->amr_mbox->mb_ack = 0;
1172 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1173 	    sizeof(struct amr_mailbox), BUS_DMASYNC_PREWRITE);
1174 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1175 	    sizeof(struct amr_mailbox), BUS_DMASYNC_POSTREAD);
1176 	if (amr->amr_mbox->mb_cmd.mb_busy != 0)
1177 		return (EAGAIN);
1178 
1179 	v = amr_inl(amr, AMR_QREG_IDB);
1180 	if ((v & AMR_QIDB_SUBMIT) != 0) {
1181 		amr->amr_mbox->mb_cmd.mb_busy = 0;
1182 		bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1183 		    sizeof(struct amr_mailbox), BUS_DMASYNC_PREWRITE);
1184 		bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1185 		    sizeof(struct amr_mailbox), BUS_DMASYNC_PREREAD);
1186 		return (EAGAIN);
1187 	}
1188 
1189 	amr->amr_mbox->mb_segment = 0;
1190 	memcpy(&amr->amr_mbox->mb_cmd, &ac->ac_cmd, sizeof(ac->ac_cmd));
1191 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1192 	    sizeof(struct amr_mailbox), BUS_DMASYNC_PREWRITE);
1193 
1194 	ac->ac_start_time = time_uptime;
1195 	ac->ac_flags |= AC_ACTIVE;
1196 	amr_outl(amr, AMR_QREG_IDB,
1197 	    (amr->amr_mbox_paddr + 16) | AMR_QIDB_SUBMIT);
1198 	return (0);
1199 }
1200 
1201 static int
1202 amr_std_submit(struct amr_softc *amr, struct amr_ccb *ac)
1203 {
1204 
1205 	amr->amr_mbox->mb_poll = 0;
1206 	amr->amr_mbox->mb_ack = 0;
1207 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1208 	    sizeof(struct amr_mailbox), BUS_DMASYNC_PREWRITE);
1209 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1210 	    sizeof(struct amr_mailbox), BUS_DMASYNC_POSTREAD);
1211 	if (amr->amr_mbox->mb_cmd.mb_busy != 0)
1212 		return (EAGAIN);
1213 
1214 	if ((amr_inb(amr, AMR_SREG_MBOX_BUSY) & AMR_SMBOX_BUSY_FLAG) != 0) {
1215 		amr->amr_mbox->mb_cmd.mb_busy = 0;
1216 		bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1217 		    sizeof(struct amr_mailbox), BUS_DMASYNC_PREWRITE);
1218 		bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1219 		    sizeof(struct amr_mailbox), BUS_DMASYNC_PREREAD);
1220 		return (EAGAIN);
1221 	}
1222 
1223 	amr->amr_mbox->mb_segment = 0;
1224 	memcpy(&amr->amr_mbox->mb_cmd, &ac->ac_cmd, sizeof(ac->ac_cmd));
1225 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1226 	    sizeof(struct amr_mailbox), BUS_DMASYNC_PREWRITE);
1227 
1228 	ac->ac_start_time = time_uptime;
1229 	ac->ac_flags |= AC_ACTIVE;
1230 	amr_outb(amr, AMR_SREG_CMD, AMR_SCMD_POST);
1231 	return (0);
1232 }
1233 
1234 /*
1235  * Claim any work that the controller has completed; acknowledge completion,
1236  * save details of the completion in (mbsave).  Must be called with
1237  * interrupts blocked.
1238  */
1239 static int
1240 amr_quartz_get_work(struct amr_softc *amr, struct amr_mailbox_resp *mbsave)
1241 {
1242 
1243 	/* Work waiting for us? */
1244 	if (amr_inl(amr, AMR_QREG_ODB) != AMR_QODB_READY)
1245 		return (-1);
1246 
1247 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1248 	    sizeof(struct amr_mailbox), BUS_DMASYNC_POSTREAD);
1249 
1250 	/* Save the mailbox, which contains a list of completed commands. */
1251 	memcpy(mbsave, &amr->amr_mbox->mb_resp, sizeof(*mbsave));
1252 
1253 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1254 	    sizeof(struct amr_mailbox), BUS_DMASYNC_PREREAD);
1255 
1256 	/* Ack the interrupt and mailbox transfer. */
1257 	amr_outl(amr, AMR_QREG_ODB, AMR_QODB_READY);
1258 	amr_outl(amr, AMR_QREG_IDB, (amr->amr_mbox_paddr+16) | AMR_QIDB_ACK);
1259 
1260 	/*
1261 	 * This waits for the controller to notice that we've taken the
1262 	 * command from it.  It's very inefficient, and we shouldn't do it,
1263 	 * but if we remove this code, we stop completing commands under
1264 	 * load.
1265 	 *
1266 	 * Peter J says we shouldn't do this.  The documentation says we
1267 	 * should.  Who is right?
1268 	 */
1269 	while ((amr_inl(amr, AMR_QREG_IDB) & AMR_QIDB_ACK) != 0)
1270 		DELAY(10);
1271 
1272 	return (0);
1273 }
1274 
1275 static int
1276 amr_std_get_work(struct amr_softc *amr, struct amr_mailbox_resp *mbsave)
1277 {
1278 	u_int8_t istat;
1279 
1280 	/* Check for valid interrupt status. */
1281 	if (((istat = amr_inb(amr, AMR_SREG_INTR)) & AMR_SINTR_VALID) == 0)
1282 		return (-1);
1283 
1284 	/* Ack the interrupt. */
1285 	amr_outb(amr, AMR_SREG_INTR, istat);
1286 
1287 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1288 	    sizeof(struct amr_mailbox), BUS_DMASYNC_POSTREAD);
1289 
1290 	/* Save mailbox, which contains a list of completed commands. */
1291 	memcpy(mbsave, &amr->amr_mbox->mb_resp, sizeof(*mbsave));
1292 
1293 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1294 	    sizeof(struct amr_mailbox), BUS_DMASYNC_PREREAD);
1295 
1296 	/* Ack mailbox transfer. */
1297 	amr_outb(amr, AMR_SREG_CMD, AMR_SCMD_ACKINTR);
1298 
1299 	return (0);
1300 }
1301 
1302 static void
1303 amr_ccb_dump(struct amr_softc *amr, struct amr_ccb *ac)
1304 {
1305 	int i;
1306 
1307 	printf("%s: ", device_xname(amr->amr_dv));
1308 	for (i = 0; i < 4; i++)
1309 		printf("%08x ", ((u_int32_t *)&ac->ac_cmd)[i]);
1310 	printf("\n");
1311 }
1312 
1313 static int
1314 amropen(dev_t dev, int flag, int mode, struct lwp *l)
1315 {
1316 	struct amr_softc *amr;
1317 
1318 	if ((amr = device_lookup_private(&amr_cd, minor(dev))) == NULL)
1319 		return (ENXIO);
1320 	if ((amr->amr_flags & AMRF_OPEN) != 0)
1321 		return (EBUSY);
1322 
1323 	amr->amr_flags |= AMRF_OPEN;
1324 	return (0);
1325 }
1326 
1327 static int
1328 amrclose(dev_t dev, int flag, int mode, struct lwp *l)
1329 {
1330 	struct amr_softc *amr;
1331 
1332 	amr = device_lookup_private(&amr_cd, minor(dev));
1333 	amr->amr_flags &= ~AMRF_OPEN;
1334 	return (0);
1335 }
1336 
1337 static int
1338 amrioctl(dev_t dev, u_long cmd, void *data, int flag,
1339     struct lwp *l)
1340 {
1341 	struct amr_softc *amr;
1342 	struct amr_user_ioctl *au;
1343 	struct amr_ccb *ac;
1344 	struct amr_mailbox_ioctl *mbi;
1345 	unsigned long au_length;
1346 	uint8_t *au_cmd;
1347 	int error;
1348 	void *dp = NULL, *au_buffer;
1349 
1350 	amr = device_lookup_private(&amr_cd, minor(dev));
1351 
1352 	/* This should be compatible with the FreeBSD interface */
1353 
1354 	switch (cmd) {
1355 	case AMR_IO_VERSION:
1356 		*(int *)data = AMR_IO_VERSION_NUMBER;
1357 		return 0;
1358 	case AMR_IO_COMMAND:
1359 		error = kauth_authorize_device_passthru(l->l_cred, dev,
1360 		    KAUTH_REQ_DEVICE_RAWIO_PASSTHRU_ALL, data);
1361 		if (error)
1362 			return (error);
1363 
1364 		au = (struct amr_user_ioctl *)data;
1365 		au_cmd = au->au_cmd;
1366 		au_buffer = au->au_buffer;
1367 		au_length = au->au_length;
1368 		break;
1369 	default:
1370 		return ENOTTY;
1371 	}
1372 
1373 	if (au_cmd[0] == AMR_CMD_PASS) {
1374 		/* not yet */
1375 		return EOPNOTSUPP;
1376 	}
1377 
1378 	if (au_length <= 0 || au_length > MAXPHYS || au_cmd[0] == 0x06)
1379 		return (EINVAL);
1380 
1381 	/*
1382 	 * allocate kernel memory for data, doing I/O directly to user
1383 	 * buffer isn't that easy.
1384 	 */
1385 	dp = malloc(au_length, M_DEVBUF, M_WAITOK|M_ZERO);
1386 	if (dp == NULL)
1387 		return ENOMEM;
1388 	if ((error = copyin(au_buffer, dp, au_length)) != 0)
1389 		goto out;
1390 
1391 	/* direct command to controller */
1392 	while (amr_ccb_alloc(amr, &ac) != 0) {
1393 		error = tsleep(NULL, PRIBIO | PCATCH, "armmbx", hz);
1394 		if (error == EINTR)
1395 			goto out;
1396 	}
1397 
1398 	mbi = (struct amr_mailbox_ioctl *)&ac->ac_cmd;
1399 	mbi->mb_command = au_cmd[0];
1400 	mbi->mb_channel = au_cmd[1];
1401 	mbi->mb_param = au_cmd[2];
1402 	mbi->mb_pad[0] = au_cmd[3];
1403 	mbi->mb_drive = au_cmd[4];
1404 	error = amr_ccb_map(amr, ac, dp, (int)au_length,
1405 	    AC_XFER_IN | AC_XFER_OUT);
1406 	if (error == 0) {
1407 		error = amr_ccb_wait(amr, ac);
1408 		amr_ccb_unmap(amr, ac);
1409 		if (error == 0)
1410 			error = copyout(dp, au_buffer, au_length);
1411 
1412 	}
1413 	amr_ccb_free(amr, ac);
1414 out:
1415 	free(dp, M_DEVBUF);
1416 	return (error);
1417 }
1418