xref: /netbsd-src/sys/dev/pci/amr.c (revision c0179c282a5968435315a82f4128c61372c68fc3)
1 /*	$NetBSD: amr.c,v 1.42 2006/11/25 16:48:32 christos Exp $	*/
2 
3 /*-
4  * Copyright (c) 2002, 2003 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Andrew Doran.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. All advertising materials mentioning features or use of this software
19  *    must display the following acknowledgement:
20  *        This product includes software developed by the NetBSD
21  *        Foundation, Inc. and its contributors.
22  * 4. Neither the name of The NetBSD Foundation nor the names of its
23  *    contributors may be used to endorse or promote products derived
24  *    from this software without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
27  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
28  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
29  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
30  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
31  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
32  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
33  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
34  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
35  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
36  * POSSIBILITY OF SUCH DAMAGE.
37  */
38 
39 /*-
40  * Copyright (c) 1999,2000 Michael Smith
41  * Copyright (c) 2000 BSDi
42  * All rights reserved.
43  *
44  * Redistribution and use in source and binary forms, with or without
45  * modification, are permitted provided that the following conditions
46  * are met:
47  * 1. Redistributions of source code must retain the above copyright
48  *    notice, this list of conditions and the following disclaimer.
49  * 2. Redistributions in binary form must reproduce the above copyright
50  *    notice, this list of conditions and the following disclaimer in the
51  *    documentation and/or other materials provided with the distribution.
52  *
53  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
54  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
55  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
56  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
57  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
58  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
59  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
60  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
61  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
62  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
63  * SUCH DAMAGE.
64  *
65  * from FreeBSD: amr_pci.c,v 1.5 2000/08/30 07:52:40 msmith Exp
66  * from FreeBSD: amr.c,v 1.16 2000/08/30 07:52:40 msmith Exp
67  */
68 
69 /*
70  * Driver for AMI RAID controllers.
71  */
72 
73 #include <sys/cdefs.h>
74 __KERNEL_RCSID(0, "$NetBSD: amr.c,v 1.42 2006/11/25 16:48:32 christos Exp $");
75 
76 #include <sys/param.h>
77 #include <sys/systm.h>
78 #include <sys/kernel.h>
79 #include <sys/device.h>
80 #include <sys/queue.h>
81 #include <sys/proc.h>
82 #include <sys/buf.h>
83 #include <sys/malloc.h>
84 #include <sys/conf.h>
85 #include <sys/kthread.h>
86 #include <sys/kauth.h>
87 
88 #include <uvm/uvm_extern.h>
89 
90 #include <machine/endian.h>
91 #include <machine/bus.h>
92 
93 #include <dev/pci/pcidevs.h>
94 #include <dev/pci/pcivar.h>
95 #include <dev/pci/amrreg.h>
96 #include <dev/pci/amrvar.h>
97 #include <dev/pci/amrio.h>
98 
99 #include "locators.h"
100 
101 static void	amr_attach(struct device *, struct device *, void *);
102 static void	amr_ccb_dump(struct amr_softc *, struct amr_ccb *);
103 static void	*amr_enquire(struct amr_softc *, u_int8_t, u_int8_t, u_int8_t,
104 			     void *);
105 static int	amr_init(struct amr_softc *, const char *,
106 			 struct pci_attach_args *pa);
107 static int	amr_intr(void *);
108 static int	amr_match(struct device *, struct cfdata *, void *);
109 static int	amr_print(void *, const char *);
110 static void	amr_shutdown(void *);
111 static void	amr_teardown(struct amr_softc *);
112 static void	amr_thread(void *);
113 static void	amr_thread_create(void *);
114 
115 static int	amr_quartz_get_work(struct amr_softc *,
116 				    struct amr_mailbox_resp *);
117 static int	amr_quartz_submit(struct amr_softc *, struct amr_ccb *);
118 static int	amr_std_get_work(struct amr_softc *, struct amr_mailbox_resp *);
119 static int	amr_std_submit(struct amr_softc *, struct amr_ccb *);
120 
121 static dev_type_open(amropen);
122 static dev_type_close(amrclose);
123 static dev_type_ioctl(amrioctl);
124 
125 CFATTACH_DECL(amr, sizeof(struct amr_softc),
126     amr_match, amr_attach, NULL, NULL);
127 
128 const struct cdevsw amr_cdevsw = {
129 	amropen, amrclose, noread, nowrite, amrioctl,
130 	nostop, notty, nopoll, nommap, nokqfilter, D_OTHER
131 };
132 
133 extern struct   cfdriver amr_cd;
134 
135 #define AT_QUARTZ	0x01	/* `Quartz' chipset */
136 #define	AT_SIG		0x02	/* Check for signature */
137 
138 static struct amr_pci_type {
139 	u_short	apt_vendor;
140 	u_short	apt_product;
141 	u_short	apt_flags;
142 } const amr_pci_type[] = {
143 	{ PCI_VENDOR_AMI,   PCI_PRODUCT_AMI_MEGARAID,  0 },
144 	{ PCI_VENDOR_AMI,   PCI_PRODUCT_AMI_MEGARAID2, 0 },
145 	{ PCI_VENDOR_AMI,   PCI_PRODUCT_AMI_MEGARAID3, AT_QUARTZ },
146 	{ PCI_VENDOR_SYMBIOS, PCI_PRODUCT_AMI_MEGARAID3, AT_QUARTZ },
147 	{ PCI_VENDOR_INTEL, PCI_PRODUCT_AMI_MEGARAID3, AT_QUARTZ | AT_SIG },
148 	{ PCI_VENDOR_INTEL,  PCI_PRODUCT_SYMBIOS_MEGARAID_320X, AT_QUARTZ },
149 	{ PCI_VENDOR_INTEL,  PCI_PRODUCT_SYMBIOS_MEGARAID_320E, AT_QUARTZ },
150 	{ PCI_VENDOR_SYMBIOS,  PCI_PRODUCT_SYMBIOS_MEGARAID_300X, AT_QUARTZ },
151 	{ PCI_VENDOR_DELL,  PCI_PRODUCT_DELL_PERC_4DI, AT_QUARTZ },
152 	{ PCI_VENDOR_DELL,  PCI_PRODUCT_DELL_PERC_4DI_2, AT_QUARTZ },
153 	{ PCI_VENDOR_DELL,  PCI_PRODUCT_DELL_PERC_4ESI, AT_QUARTZ },
154 	{ PCI_VENDOR_SYMBIOS,  PCI_PRODUCT_SYMBIOS_PERC_4SC, AT_QUARTZ },
155 	{ PCI_VENDOR_SYMBIOS,  PCI_PRODUCT_SYMBIOS_MEGARAID_320X, AT_QUARTZ },
156 	{ PCI_VENDOR_SYMBIOS,  PCI_PRODUCT_SYMBIOS_MEGARAID_320E, AT_QUARTZ },
157 	{ PCI_VENDOR_SYMBIOS,  PCI_PRODUCT_SYMBIOS_MEGARAID_300X, AT_QUARTZ },
158 };
159 
160 static struct amr_typestr {
161 	const char	*at_str;
162 	int		at_sig;
163 } const amr_typestr[] = {
164 	{ "Series 431",			AMR_SIG_431 },
165 	{ "Series 438",			AMR_SIG_438 },
166 	{ "Series 466",			AMR_SIG_466 },
167 	{ "Series 467",			AMR_SIG_467 },
168 	{ "Series 490",			AMR_SIG_490 },
169 	{ "Series 762",			AMR_SIG_762 },
170 	{ "HP NetRAID (T5)",		AMR_SIG_T5 },
171 	{ "HP NetRAID (T7)",		AMR_SIG_T7 },
172 };
173 
174 static struct {
175 	const char	*ds_descr;
176 	int	ds_happy;
177 } const amr_dstate[] = {
178 	{ "offline",	0 },
179 	{ "degraded",	1 },
180 	{ "optimal",	1 },
181 	{ "online",	1 },
182 	{ "failed",	0 },
183 	{ "rebuilding",	1 },
184 	{ "hotspare",	0 },
185 };
186 
187 static void	*amr_sdh;
188 
189 static int	amr_max_segs;
190 int		amr_max_xfer;
191 
192 static inline u_int8_t
193 amr_inb(struct amr_softc *amr, int off)
194 {
195 
196 	bus_space_barrier(amr->amr_iot, amr->amr_ioh, off, 1,
197 	    BUS_SPACE_BARRIER_WRITE | BUS_SPACE_BARRIER_READ);
198 	return (bus_space_read_1(amr->amr_iot, amr->amr_ioh, off));
199 }
200 
201 static inline u_int32_t
202 amr_inl(struct amr_softc *amr, int off)
203 {
204 
205 	bus_space_barrier(amr->amr_iot, amr->amr_ioh, off, 4,
206 	    BUS_SPACE_BARRIER_WRITE | BUS_SPACE_BARRIER_READ);
207 	return (bus_space_read_4(amr->amr_iot, amr->amr_ioh, off));
208 }
209 
210 static inline void
211 amr_outb(struct amr_softc *amr, int off, u_int8_t val)
212 {
213 
214 	bus_space_write_1(amr->amr_iot, amr->amr_ioh, off, val);
215 	bus_space_barrier(amr->amr_iot, amr->amr_ioh, off, 1,
216 	    BUS_SPACE_BARRIER_WRITE);
217 }
218 
219 static inline void
220 amr_outl(struct amr_softc *amr, int off, u_int32_t val)
221 {
222 
223 	bus_space_write_4(amr->amr_iot, amr->amr_ioh, off, val);
224 	bus_space_barrier(amr->amr_iot, amr->amr_ioh, off, 4,
225 	    BUS_SPACE_BARRIER_WRITE);
226 }
227 
228 /*
229  * Match a supported device.
230  */
231 static int
232 amr_match(struct device *parent, struct cfdata *match,
233     void *aux)
234 {
235 	struct pci_attach_args *pa;
236 	pcireg_t s;
237 	int i;
238 
239 	pa = (struct pci_attach_args *)aux;
240 
241 	/*
242 	 * Don't match the device if it's operating in I2O mode.  In this
243 	 * case it should be handled by the `iop' driver.
244 	 */
245 	if (PCI_CLASS(pa->pa_class) == PCI_CLASS_I2O)
246 		return (0);
247 
248 	for (i = 0; i < sizeof(amr_pci_type) / sizeof(amr_pci_type[0]); i++)
249 		if (PCI_VENDOR(pa->pa_id) == amr_pci_type[i].apt_vendor &&
250 		    PCI_PRODUCT(pa->pa_id) == amr_pci_type[i].apt_product)
251 		    	break;
252 
253 	if (i == sizeof(amr_pci_type) / sizeof(amr_pci_type[0]))
254 		return (0);
255 
256 	if ((amr_pci_type[i].apt_flags & AT_SIG) == 0)
257 		return (1);
258 
259 	s = pci_conf_read(pa->pa_pc, pa->pa_tag, AMR_QUARTZ_SIG_REG) & 0xffff;
260 	return (s == AMR_QUARTZ_SIG0 || s == AMR_QUARTZ_SIG1);
261 }
262 
263 /*
264  * Attach a supported device.
265  */
266 static void
267 amr_attach(struct device *parent, struct device *self, void *aux)
268 {
269 	struct pci_attach_args *pa;
270 	struct amr_attach_args amra;
271 	const struct amr_pci_type *apt;
272 	struct amr_softc *amr;
273 	pci_chipset_tag_t pc;
274 	pci_intr_handle_t ih;
275 	const char *intrstr;
276 	pcireg_t reg;
277 	int rseg, i, j, size, rv, memreg, ioreg;
278 	struct amr_ccb *ac;
279 	int locs[AMRCF_NLOCS];
280 
281 	aprint_naive(": RAID controller\n");
282 
283 	amr = (struct amr_softc *)self;
284 	pa = (struct pci_attach_args *)aux;
285 	pc = pa->pa_pc;
286 
287 	for (i = 0; i < sizeof(amr_pci_type) / sizeof(amr_pci_type[0]); i++)
288 		if (PCI_VENDOR(pa->pa_id) == amr_pci_type[i].apt_vendor &&
289 		    PCI_PRODUCT(pa->pa_id) == amr_pci_type[i].apt_product)
290 			break;
291 	apt = amr_pci_type + i;
292 
293 	memreg = ioreg = 0;
294 	for (i = 0x10; i <= 0x14; i += 4) {
295 		reg = pci_conf_read(pc, pa->pa_tag, i);
296 		switch (PCI_MAPREG_TYPE(reg)) {
297 		case PCI_MAPREG_TYPE_MEM:
298 			if (PCI_MAPREG_MEM_SIZE(reg) != 0)
299 				memreg = i;
300 			break;
301 		case PCI_MAPREG_TYPE_IO:
302 			if (PCI_MAPREG_IO_SIZE(reg) != 0)
303 				ioreg = i;
304 			break;
305 
306 		}
307 	}
308 
309 	if (memreg && pci_mapreg_map(pa, memreg, PCI_MAPREG_TYPE_MEM, 0,
310 	    &amr->amr_iot, &amr->amr_ioh, NULL, &amr->amr_ios) == 0)
311 		;
312 	else if (ioreg && pci_mapreg_map(pa, ioreg, PCI_MAPREG_TYPE_IO, 0,
313 	    &amr->amr_iot, &amr->amr_ioh, NULL, &amr->amr_ios) == 0)
314 		;
315 	else {
316 		aprint_error("can't map control registers\n");
317 		amr_teardown(amr);
318 		return;
319 	}
320 
321 	amr->amr_flags |= AMRF_PCI_REGS;
322 	amr->amr_dmat = pa->pa_dmat;
323 	amr->amr_pc = pa->pa_pc;
324 
325 	/* Enable the device. */
326 	reg = pci_conf_read(pa->pa_pc, pa->pa_tag, PCI_COMMAND_STATUS_REG);
327 	pci_conf_write(pa->pa_pc, pa->pa_tag, PCI_COMMAND_STATUS_REG,
328 	    reg | PCI_COMMAND_MASTER_ENABLE);
329 
330 	/* Map and establish the interrupt. */
331 	if (pci_intr_map(pa, &ih)) {
332 		aprint_error("can't map interrupt\n");
333 		amr_teardown(amr);
334 		return;
335 	}
336 	intrstr = pci_intr_string(pc, ih);
337 	amr->amr_ih = pci_intr_establish(pc, ih, IPL_BIO, amr_intr, amr);
338 	if (amr->amr_ih == NULL) {
339 		aprint_error("can't establish interrupt");
340 		if (intrstr != NULL)
341 			aprint_normal(" at %s", intrstr);
342 		aprint_normal("\n");
343 		amr_teardown(amr);
344 		return;
345 	}
346 	amr->amr_flags |= AMRF_PCI_INTR;
347 
348 	/*
349 	 * Allocate space for the mailbox and S/G lists.  Some controllers
350 	 * don't like S/G lists to be located below 0x2000, so we allocate
351 	 * enough slop to enable us to compensate.
352 	 *
353 	 * The standard mailbox structure needs to be aligned on a 16-byte
354 	 * boundary.  The 64-bit mailbox has one extra field, 4 bytes in
355 	 * size, which precedes the standard mailbox.
356 	 */
357 	size = AMR_SGL_SIZE * AMR_MAX_CMDS + 0x2000;
358 	amr->amr_dmasize = size;
359 
360 	if ((rv = bus_dmamem_alloc(amr->amr_dmat, size, PAGE_SIZE, 0,
361 	    &amr->amr_dmaseg, 1, &rseg, BUS_DMA_NOWAIT)) != 0) {
362 		aprint_error("%s: unable to allocate buffer, rv = %d\n",
363 		    amr->amr_dv.dv_xname, rv);
364 		amr_teardown(amr);
365 		return;
366 	}
367 	amr->amr_flags |= AMRF_DMA_ALLOC;
368 
369 	if ((rv = bus_dmamem_map(amr->amr_dmat, &amr->amr_dmaseg, rseg, size,
370 	    (caddr_t *)&amr->amr_mbox,
371 	    BUS_DMA_NOWAIT | BUS_DMA_COHERENT)) != 0) {
372 		aprint_error("%s: unable to map buffer, rv = %d\n",
373 		    amr->amr_dv.dv_xname, rv);
374 		amr_teardown(amr);
375 		return;
376 	}
377 	amr->amr_flags |= AMRF_DMA_MAP;
378 
379 	if ((rv = bus_dmamap_create(amr->amr_dmat, size, 1, size, 0,
380 	    BUS_DMA_NOWAIT, &amr->amr_dmamap)) != 0) {
381 		aprint_error("%s: unable to create buffer DMA map, rv = %d\n",
382 		    amr->amr_dv.dv_xname, rv);
383 		amr_teardown(amr);
384 		return;
385 	}
386 	amr->amr_flags |= AMRF_DMA_CREATE;
387 
388 	if ((rv = bus_dmamap_load(amr->amr_dmat, amr->amr_dmamap,
389 	    amr->amr_mbox, size, NULL, BUS_DMA_NOWAIT)) != 0) {
390 		aprint_error("%s: unable to load buffer DMA map, rv = %d\n",
391 		    amr->amr_dv.dv_xname, rv);
392 		amr_teardown(amr);
393 		return;
394 	}
395 	amr->amr_flags |= AMRF_DMA_LOAD;
396 
397 	memset(amr->amr_mbox, 0, size);
398 
399 	amr->amr_mbox_paddr = amr->amr_dmamap->dm_segs[0].ds_addr;
400 	amr->amr_sgls_paddr = (amr->amr_mbox_paddr + 0x1fff) & ~0x1fff;
401 	amr->amr_sgls = (struct amr_sgentry *)((caddr_t)amr->amr_mbox +
402 	    amr->amr_sgls_paddr - amr->amr_dmamap->dm_segs[0].ds_addr);
403 
404 	/*
405 	 * Allocate and initalise the command control blocks.
406 	 */
407 	ac = malloc(sizeof(*ac) * AMR_MAX_CMDS, M_DEVBUF, M_NOWAIT | M_ZERO);
408 	amr->amr_ccbs = ac;
409 	SLIST_INIT(&amr->amr_ccb_freelist);
410 	TAILQ_INIT(&amr->amr_ccb_active);
411 	amr->amr_flags |= AMRF_CCBS;
412 
413 	if (amr_max_xfer == 0) {
414 		amr_max_xfer = min(((AMR_MAX_SEGS - 1) * PAGE_SIZE), MAXPHYS);
415 		amr_max_segs = (amr_max_xfer + (PAGE_SIZE * 2) - 1) / PAGE_SIZE;
416 	}
417 
418 	for (i = 0; i < AMR_MAX_CMDS; i++, ac++) {
419 		rv = bus_dmamap_create(amr->amr_dmat, amr_max_xfer,
420 		    amr_max_segs, amr_max_xfer, 0,
421 		    BUS_DMA_NOWAIT | BUS_DMA_ALLOCNOW, &ac->ac_xfer_map);
422 		if (rv != 0)
423 			break;
424 
425 		ac->ac_ident = i;
426 		amr_ccb_free(amr, ac);
427 	}
428 	if (i != AMR_MAX_CMDS) {
429 		aprint_error("%s: memory exhausted\n", amr->amr_dv.dv_xname);
430 		amr_teardown(amr);
431 		return;
432 	}
433 
434 	/*
435 	 * Take care of model-specific tasks.
436 	 */
437 	if ((apt->apt_flags & AT_QUARTZ) != 0) {
438 		amr->amr_submit = amr_quartz_submit;
439 		amr->amr_get_work = amr_quartz_get_work;
440 	} else {
441 		amr->amr_submit = amr_std_submit;
442 		amr->amr_get_work = amr_std_get_work;
443 
444 		/* Notify the controller of the mailbox location. */
445 		amr_outl(amr, AMR_SREG_MBOX, (u_int32_t)amr->amr_mbox_paddr + 16);
446 		amr_outb(amr, AMR_SREG_MBOX_ENABLE, AMR_SMBOX_ENABLE_ADDR);
447 
448 		/* Clear outstanding interrupts and enable interrupts. */
449 		amr_outb(amr, AMR_SREG_CMD, AMR_SCMD_ACKINTR);
450 		amr_outb(amr, AMR_SREG_TOGL,
451 		    amr_inb(amr, AMR_SREG_TOGL) | AMR_STOGL_ENABLE);
452 	}
453 
454 	/*
455 	 * Retrieve parameters, and tell the world about us.
456 	 */
457 	amr->amr_enqbuf = malloc(AMR_ENQUIRY_BUFSIZE, M_DEVBUF, M_NOWAIT);
458 	amr->amr_flags |= AMRF_ENQBUF;
459 	amr->amr_maxqueuecnt = i;
460 	aprint_normal(": AMI RAID ");
461 	if (amr_init(amr, intrstr, pa) != 0) {
462 		amr_teardown(amr);
463 		return;
464 	}
465 
466 	/*
467 	 * Cap the maximum number of outstanding commands.  AMI's Linux
468 	 * driver doesn't trust the controller's reported value, and lockups
469 	 * have been seen when we do.
470 	 */
471 	amr->amr_maxqueuecnt = min(amr->amr_maxqueuecnt, AMR_MAX_CMDS);
472 	if (amr->amr_maxqueuecnt > i)
473 		amr->amr_maxqueuecnt = i;
474 
475 	/* Set our `shutdownhook' before we start any device activity. */
476 	if (amr_sdh == NULL)
477 		amr_sdh = shutdownhook_establish(amr_shutdown, NULL);
478 
479 	/* Attach sub-devices. */
480 	for (j = 0; j < amr->amr_numdrives; j++) {
481 		if (amr->amr_drive[j].al_size == 0)
482 			continue;
483 		amra.amra_unit = j;
484 
485 		locs[AMRCF_UNIT] = j;
486 
487 		amr->amr_drive[j].al_dv = config_found_sm_loc(&amr->amr_dv,
488 			"amr", locs, &amra, amr_print, config_stdsubmatch);
489 	}
490 
491 	SIMPLEQ_INIT(&amr->amr_ccb_queue);
492 
493 	/* XXX This doesn't work for newer boards yet. */
494 	if ((apt->apt_flags & AT_QUARTZ) == 0)
495 		kthread_create(amr_thread_create, amr);
496 }
497 
498 /*
499  * Free up resources.
500  */
501 static void
502 amr_teardown(struct amr_softc *amr)
503 {
504 	struct amr_ccb *ac;
505 	int fl;
506 
507 	fl = amr->amr_flags;
508 
509 	if ((fl & AMRF_THREAD) != 0) {
510 		amr->amr_flags |= AMRF_THREAD_EXIT;
511 		wakeup(amr_thread);
512 		while ((amr->amr_flags & AMRF_THREAD_EXIT) != 0)
513 			tsleep(&amr->amr_flags, PWAIT, "amrexit", 0);
514 	}
515 	if ((fl & AMRF_CCBS) != 0) {
516 		SLIST_FOREACH(ac, &amr->amr_ccb_freelist, ac_chain.slist) {
517 			bus_dmamap_destroy(amr->amr_dmat, ac->ac_xfer_map);
518 		}
519 		free(amr->amr_ccbs, M_DEVBUF);
520 	}
521 	if ((fl & AMRF_ENQBUF) != 0)
522 		free(amr->amr_enqbuf, M_DEVBUF);
523 	if ((fl & AMRF_DMA_LOAD) != 0)
524 		bus_dmamap_unload(amr->amr_dmat, amr->amr_dmamap);
525 	if ((fl & AMRF_DMA_MAP) != 0)
526 		bus_dmamem_unmap(amr->amr_dmat, (caddr_t)amr->amr_mbox,
527 		    amr->amr_dmasize);
528 	if ((fl & AMRF_DMA_ALLOC) != 0)
529 		bus_dmamem_free(amr->amr_dmat, &amr->amr_dmaseg, 1);
530 	if ((fl & AMRF_DMA_CREATE) != 0)
531 		bus_dmamap_destroy(amr->amr_dmat, amr->amr_dmamap);
532 	if ((fl & AMRF_PCI_INTR) != 0)
533 		pci_intr_disestablish(amr->amr_pc, amr->amr_ih);
534 	if ((fl & AMRF_PCI_REGS) != 0)
535 		bus_space_unmap(amr->amr_iot, amr->amr_ioh, amr->amr_ios);
536 }
537 
538 /*
539  * Print autoconfiguration message for a sub-device.
540  */
541 static int
542 amr_print(void *aux, const char *pnp)
543 {
544 	struct amr_attach_args *amra;
545 
546 	amra = (struct amr_attach_args *)aux;
547 
548 	if (pnp != NULL)
549 		aprint_normal("block device at %s", pnp);
550 	aprint_normal(" unit %d", amra->amra_unit);
551 	return (UNCONF);
552 }
553 
554 /*
555  * Retrieve operational parameters and describe the controller.
556  */
557 static int
558 amr_init(struct amr_softc *amr, const char *intrstr,
559 	 struct pci_attach_args *pa)
560 {
561 	struct amr_adapter_info *aa;
562 	struct amr_prodinfo *ap;
563 	struct amr_enquiry *ae;
564 	struct amr_enquiry3 *aex;
565 	const char *prodstr;
566 	u_int i, sig, ishp;
567 	char sbuf[64];
568 
569 	/*
570 	 * Try to get 40LD product info, which tells us what the card is
571 	 * labelled as.
572 	 */
573 	ap = amr_enquire(amr, AMR_CMD_CONFIG, AMR_CONFIG_PRODUCT_INFO, 0,
574 	    amr->amr_enqbuf);
575 	if (ap != NULL) {
576 		aprint_normal("<%.80s>\n", ap->ap_product);
577 		if (intrstr != NULL)
578 			aprint_normal("%s: interrupting at %s\n",
579 			    amr->amr_dv.dv_xname, intrstr);
580 		aprint_normal("%s: firmware %.16s, BIOS %.16s, %dMB RAM\n",
581 		    amr->amr_dv.dv_xname, ap->ap_firmware, ap->ap_bios,
582 		    le16toh(ap->ap_memsize));
583 
584 		amr->amr_maxqueuecnt = ap->ap_maxio;
585 
586 		/*
587 		 * Fetch and record state of logical drives.
588 		 */
589 		aex = amr_enquire(amr, AMR_CMD_CONFIG, AMR_CONFIG_ENQ3,
590 		    AMR_CONFIG_ENQ3_SOLICITED_FULL, amr->amr_enqbuf);
591 		if (aex == NULL) {
592 			aprint_error("%s ENQUIRY3 failed\n",
593 			    amr->amr_dv.dv_xname);
594 			return (-1);
595 		}
596 
597 		if (aex->ae_numldrives > __arraycount(aex->ae_drivestate)) {
598 			aprint_error("%s: Inquiry returned more drives (%d)"
599 			   " than the array can handle (%zu)\n",
600 			   amr->amr_dv.dv_xname, aex->ae_numldrives,
601 			   __arraycount(aex->ae_drivestate));
602 			aex->ae_numldrives = __arraycount(aex->ae_drivestate);
603 		}
604 		if (aex->ae_numldrives > AMR_MAX_UNITS) {
605 			aprint_error(
606 			    "%s: adjust AMR_MAX_UNITS to %d (currently %d)"
607 			    "\n", amr->amr_dv.dv_xname, AMR_MAX_UNITS,
608 			    amr->amr_numdrives);
609 			amr->amr_numdrives = AMR_MAX_UNITS;
610 		} else
611 			amr->amr_numdrives = aex->ae_numldrives;
612 
613 		for (i = 0; i < amr->amr_numdrives; i++) {
614 			amr->amr_drive[i].al_size =
615 			    le32toh(aex->ae_drivesize[i]);
616 			amr->amr_drive[i].al_state = aex->ae_drivestate[i];
617 			amr->amr_drive[i].al_properties = aex->ae_driveprop[i];
618 		}
619 
620 		return (0);
621 	}
622 
623 	/*
624 	 * Try 8LD extended ENQUIRY to get the controller signature.  Once
625 	 * found, search for a product description.
626 	 */
627 	ae = amr_enquire(amr, AMR_CMD_EXT_ENQUIRY2, 0, 0, amr->amr_enqbuf);
628 	if (ae != NULL) {
629 		i = 0;
630 		sig = le32toh(ae->ae_signature);
631 
632 		while (i < sizeof(amr_typestr) / sizeof(amr_typestr[0])) {
633 			if (amr_typestr[i].at_sig == sig)
634 				break;
635 			i++;
636 		}
637 		if (i == sizeof(amr_typestr) / sizeof(amr_typestr[0])) {
638 			snprintf(sbuf, sizeof(sbuf),
639 			    "unknown ENQUIRY2 sig (0x%08x)", sig);
640 			prodstr = sbuf;
641 		} else
642 			prodstr = amr_typestr[i].at_str;
643 	} else {
644 		ae = amr_enquire(amr, AMR_CMD_ENQUIRY, 0, 0, amr->amr_enqbuf);
645 		if (ae == NULL) {
646 			aprint_error("%s: unsupported controller\n",
647 			    amr->amr_dv.dv_xname);
648 			return (-1);
649 		}
650 
651 		switch (PCI_PRODUCT(pa->pa_id)) {
652 		case PCI_PRODUCT_AMI_MEGARAID:
653 			prodstr = "Series 428";
654 			break;
655 		case PCI_PRODUCT_AMI_MEGARAID2:
656 			prodstr = "Series 434";
657 			break;
658 		default:
659 			snprintf(sbuf, sizeof(sbuf), "unknown PCI dev (0x%04x)",
660 			    PCI_PRODUCT(pa->pa_id));
661 			prodstr = sbuf;
662 			break;
663 		}
664 	}
665 
666 	/*
667 	 * HP NetRaid controllers have a special encoding of the firmware
668 	 * and BIOS versions.  The AMI version seems to have it as strings
669 	 * whereas the HP version does it with a leading uppercase character
670 	 * and two binary numbers.
671 	*/
672 	aa = &ae->ae_adapter;
673 
674 	if (aa->aa_firmware[2] >= 'A' && aa->aa_firmware[2] <= 'Z' &&
675 	    aa->aa_firmware[1] <  ' ' && aa->aa_firmware[0] <  ' ' &&
676 	    aa->aa_bios[2] >= 'A' && aa->aa_bios[2] <= 'Z' &&
677 	    aa->aa_bios[1] <  ' ' && aa->aa_bios[0] <  ' ') {
678 		if (le32toh(ae->ae_signature) == AMR_SIG_438) {
679 			/* The AMI 438 is a NetRaid 3si in HP-land. */
680 			prodstr = "HP NetRaid 3si";
681 		}
682 		ishp = 1;
683 	} else
684 		ishp = 0;
685 
686 	aprint_normal("<%s>\n", prodstr);
687 	if (intrstr != NULL)
688 		aprint_normal("%s: interrupting at %s\n", amr->amr_dv.dv_xname,
689 		    intrstr);
690 
691 	if (ishp)
692 		aprint_normal("%s: firmware <%c.%02d.%02d>, BIOS <%c.%02d.%02d>"
693 		    ", %dMB RAM\n", amr->amr_dv.dv_xname, aa->aa_firmware[2],
694 		     aa->aa_firmware[1], aa->aa_firmware[0], aa->aa_bios[2],
695 		     aa->aa_bios[1], aa->aa_bios[0], aa->aa_memorysize);
696 	else
697 		aprint_normal("%s: firmware <%.4s>, BIOS <%.4s>, %dMB RAM\n",
698 		    amr->amr_dv.dv_xname, aa->aa_firmware, aa->aa_bios,
699 		    aa->aa_memorysize);
700 
701 	amr->amr_maxqueuecnt = aa->aa_maxio;
702 
703 	/*
704 	 * Record state of logical drives.
705 	 */
706 	if (ae->ae_ldrv.al_numdrives > __arraycount(ae->ae_ldrv.al_size)) {
707 		aprint_error("%s: Inquiry returned more drives (%d)"
708 		   " than the array can handle (%zu)\n",
709 		   amr->amr_dv.dv_xname, ae->ae_ldrv.al_numdrives,
710 		   __arraycount(ae->ae_ldrv.al_size));
711 		ae->ae_ldrv.al_numdrives = __arraycount(ae->ae_ldrv.al_size);
712 	}
713 	if (ae->ae_ldrv.al_numdrives > AMR_MAX_UNITS) {
714 		aprint_error("%s: adjust AMR_MAX_UNITS to %d (currently %d)\n",
715 		    amr->amr_dv.dv_xname, ae->ae_ldrv.al_numdrives,
716 		    AMR_MAX_UNITS);
717 		amr->amr_numdrives = AMR_MAX_UNITS;
718 	} else
719 		amr->amr_numdrives = ae->ae_ldrv.al_numdrives;
720 
721 	for (i = 0; i < amr->amr_numdrives; i++) {
722 		amr->amr_drive[i].al_size = le32toh(ae->ae_ldrv.al_size[i]);
723 		amr->amr_drive[i].al_state = ae->ae_ldrv.al_state[i];
724 		amr->amr_drive[i].al_properties = ae->ae_ldrv.al_properties[i];
725 	}
726 
727 	return (0);
728 }
729 
730 /*
731  * Flush the internal cache on each configured controller.  Called at
732  * shutdown time.
733  */
734 static void
735 amr_shutdown(void *cookie)
736 {
737 	extern struct cfdriver amr_cd;
738 	struct amr_softc *amr;
739 	struct amr_ccb *ac;
740 	int i, rv, s;
741 
742 	for (i = 0; i < amr_cd.cd_ndevs; i++) {
743 		if ((amr = device_lookup(&amr_cd, i)) == NULL)
744 			continue;
745 
746 		if ((rv = amr_ccb_alloc(amr, &ac)) == 0) {
747 			ac->ac_cmd.mb_command = AMR_CMD_FLUSH;
748 			s = splbio();
749 			rv = amr_ccb_poll(amr, ac, 30000);
750 			splx(s);
751 			amr_ccb_free(amr, ac);
752 		}
753 		if (rv != 0)
754 			printf("%s: unable to flush cache (%d)\n",
755 			    amr->amr_dv.dv_xname, rv);
756 	}
757 }
758 
759 /*
760  * Interrupt service routine.
761  */
762 static int
763 amr_intr(void *cookie)
764 {
765 	struct amr_softc *amr;
766 	struct amr_ccb *ac;
767 	struct amr_mailbox_resp mbox;
768 	u_int i, forus, idx;
769 
770 	amr = cookie;
771 	forus = 0;
772 
773 	while ((*amr->amr_get_work)(amr, &mbox) == 0) {
774 		/* Iterate over completed commands in this result. */
775 		for (i = 0; i < mbox.mb_nstatus; i++) {
776 			idx = mbox.mb_completed[i] - 1;
777 			ac = amr->amr_ccbs + idx;
778 
779 			if (idx >= amr->amr_maxqueuecnt) {
780 				printf("%s: bad status (bogus ID: %u=%u)\n",
781 				    amr->amr_dv.dv_xname, i, idx);
782 				continue;
783 			}
784 
785 			if ((ac->ac_flags & AC_ACTIVE) == 0) {
786 				printf("%s: bad status (not active; 0x04%x)\n",
787 				    amr->amr_dv.dv_xname, ac->ac_flags);
788 				continue;
789 			}
790 
791 			ac->ac_status = mbox.mb_status;
792 			ac->ac_flags = (ac->ac_flags & ~AC_ACTIVE) |
793 			    AC_COMPLETE;
794 			TAILQ_REMOVE(&amr->amr_ccb_active, ac, ac_chain.tailq);
795 
796 			if ((ac->ac_flags & AC_MOAN) != 0)
797 				printf("%s: ccb %d completed\n",
798 				    amr->amr_dv.dv_xname, ac->ac_ident);
799 
800 			/* Pass notification to upper layers. */
801 			if (ac->ac_handler != NULL)
802 				(*ac->ac_handler)(ac);
803 			else
804 				wakeup(ac);
805 		}
806 		forus = 1;
807 	}
808 
809 	if (forus)
810 		amr_ccb_enqueue(amr, NULL);
811 
812 	return (forus);
813 }
814 
815 /*
816  * Create the watchdog thread.
817  */
818 static void
819 amr_thread_create(void *cookie)
820 {
821 	struct amr_softc *amr;
822 	int rv;
823 
824 	amr = cookie;
825 
826 	if ((amr->amr_flags & AMRF_THREAD_EXIT) != 0) {
827 		amr->amr_flags ^= AMRF_THREAD_EXIT;
828 		wakeup(&amr->amr_flags);
829 		return;
830 	}
831 
832 	rv = kthread_create1(amr_thread, amr, &amr->amr_thread, "%s",
833 	    amr->amr_dv.dv_xname);
834  	if (rv != 0)
835 		aprint_error("%s: unable to create thread (%d)",
836  		    amr->amr_dv.dv_xname, rv);
837  	else
838  		amr->amr_flags |= AMRF_THREAD;
839 }
840 
841 /*
842  * Watchdog thread.
843  */
844 static void
845 amr_thread(void *cookie)
846 {
847 	struct amr_softc *amr;
848 	struct amr_ccb *ac;
849 	struct amr_logdrive *al;
850 	struct amr_enquiry *ae;
851 	int rv, i, s;
852 
853 	amr = cookie;
854 	ae = amr->amr_enqbuf;
855 
856 	for (;;) {
857 		tsleep(amr_thread, PWAIT, "amrwdog", AMR_WDOG_TICKS);
858 
859 		if ((amr->amr_flags & AMRF_THREAD_EXIT) != 0) {
860 			amr->amr_flags ^= AMRF_THREAD_EXIT;
861 			wakeup(&amr->amr_flags);
862 			kthread_exit(0);
863 		}
864 
865 		s = splbio();
866 		amr_intr(cookie);
867 		ac = TAILQ_FIRST(&amr->amr_ccb_active);
868 		while (ac != NULL) {
869 			if (ac->ac_start_time + AMR_TIMEOUT > time_uptime)
870 				break;
871 			if ((ac->ac_flags & AC_MOAN) == 0) {
872 				printf("%s: ccb %d timed out; mailbox:\n",
873 				    amr->amr_dv.dv_xname, ac->ac_ident);
874 				amr_ccb_dump(amr, ac);
875 				ac->ac_flags |= AC_MOAN;
876 			}
877 			ac = TAILQ_NEXT(ac, ac_chain.tailq);
878 		}
879 		splx(s);
880 
881 		if ((rv = amr_ccb_alloc(amr, &ac)) != 0) {
882 			printf("%s: ccb_alloc failed (%d)\n",
883  			    amr->amr_dv.dv_xname, rv);
884 			continue;
885 		}
886 
887 		ac->ac_cmd.mb_command = AMR_CMD_ENQUIRY;
888 
889 		rv = amr_ccb_map(amr, ac, amr->amr_enqbuf,
890 		    AMR_ENQUIRY_BUFSIZE, AC_XFER_IN);
891 		if (rv != 0) {
892 			printf("%s: ccb_map failed (%d)\n",
893  			    amr->amr_dv.dv_xname, rv);
894 			amr_ccb_free(amr, ac);
895 			continue;
896 		}
897 
898 		rv = amr_ccb_wait(amr, ac);
899 		amr_ccb_unmap(amr, ac);
900 		if (rv != 0) {
901 			printf("%s: enquiry failed (st=%d)\n",
902  			    amr->amr_dv.dv_xname, ac->ac_status);
903 			continue;
904 		}
905 		amr_ccb_free(amr, ac);
906 
907 		al = amr->amr_drive;
908 		for (i = 0; i < __arraycount(ae->ae_ldrv.al_state); i++, al++) {
909 			if (al->al_dv == NULL)
910 				continue;
911 			if (al->al_state == ae->ae_ldrv.al_state[i])
912 				continue;
913 
914 			printf("%s: state changed: %s -> %s\n",
915 			    al->al_dv->dv_xname,
916 			    amr_drive_state(al->al_state, NULL),
917 			    amr_drive_state(ae->ae_ldrv.al_state[i], NULL));
918 
919 			al->al_state = ae->ae_ldrv.al_state[i];
920 		}
921 	}
922 }
923 
924 /*
925  * Return a text description of a logical drive's current state.
926  */
927 const char *
928 amr_drive_state(int state, int *happy)
929 {
930 	const char *str;
931 
932 	state = AMR_DRV_CURSTATE(state);
933 	if (state >= sizeof(amr_dstate) / sizeof(amr_dstate[0])) {
934 		if (happy)
935 			*happy = 1;
936 		str = "status unknown";
937 	} else {
938 		if (happy)
939 			*happy = amr_dstate[state].ds_happy;
940 		str = amr_dstate[state].ds_descr;
941 	}
942 
943 	return (str);
944 }
945 
946 /*
947  * Run a generic enquiry-style command.
948  */
949 static void *
950 amr_enquire(struct amr_softc *amr, u_int8_t cmd, u_int8_t cmdsub,
951 	    u_int8_t cmdqual, void *sbuf)
952 {
953 	struct amr_ccb *ac;
954 	u_int8_t *mb;
955 	int rv;
956 
957 	if (amr_ccb_alloc(amr, &ac) != 0)
958 		return (NULL);
959 
960 	/* Build the command proper. */
961 	mb = (u_int8_t *)&ac->ac_cmd;
962 	mb[0] = cmd;
963 	mb[2] = cmdsub;
964 	mb[3] = cmdqual;
965 
966 	rv = amr_ccb_map(amr, ac, sbuf, AMR_ENQUIRY_BUFSIZE, AC_XFER_IN);
967 	if (rv == 0) {
968 		rv = amr_ccb_poll(amr, ac, 2000);
969 		amr_ccb_unmap(amr, ac);
970 	}
971 	amr_ccb_free(amr, ac);
972 
973 	return (rv ? NULL : sbuf);
974 }
975 
976 /*
977  * Allocate and initialise a CCB.
978  */
979 int
980 amr_ccb_alloc(struct amr_softc *amr, struct amr_ccb **acp)
981 {
982 	int s;
983 
984 	s = splbio();
985 	if ((*acp = SLIST_FIRST(&amr->amr_ccb_freelist)) == NULL) {
986 		splx(s);
987 		return (EAGAIN);
988 	}
989 	SLIST_REMOVE_HEAD(&amr->amr_ccb_freelist, ac_chain.slist);
990 	splx(s);
991 
992 	return (0);
993 }
994 
995 /*
996  * Free a CCB.
997  */
998 void
999 amr_ccb_free(struct amr_softc *amr, struct amr_ccb *ac)
1000 {
1001 	int s;
1002 
1003 	memset(&ac->ac_cmd, 0, sizeof(ac->ac_cmd));
1004 	ac->ac_cmd.mb_ident = ac->ac_ident + 1;
1005 	ac->ac_cmd.mb_busy = 1;
1006 	ac->ac_handler = NULL;
1007 	ac->ac_flags = 0;
1008 
1009 	s = splbio();
1010 	SLIST_INSERT_HEAD(&amr->amr_ccb_freelist, ac, ac_chain.slist);
1011 	splx(s);
1012 }
1013 
1014 /*
1015  * If a CCB is specified, enqueue it.  Pull CCBs off the software queue in
1016  * the order that they were enqueued and try to submit their command blocks
1017  * to the controller for execution.
1018  */
1019 void
1020 amr_ccb_enqueue(struct amr_softc *amr, struct amr_ccb *ac)
1021 {
1022 	int s;
1023 
1024 	s = splbio();
1025 
1026 	if (ac != NULL)
1027 		SIMPLEQ_INSERT_TAIL(&amr->amr_ccb_queue, ac, ac_chain.simpleq);
1028 
1029 	while ((ac = SIMPLEQ_FIRST(&amr->amr_ccb_queue)) != NULL) {
1030 		if ((*amr->amr_submit)(amr, ac) != 0)
1031 			break;
1032 		SIMPLEQ_REMOVE_HEAD(&amr->amr_ccb_queue, ac_chain.simpleq);
1033 		TAILQ_INSERT_TAIL(&amr->amr_ccb_active, ac, ac_chain.tailq);
1034 	}
1035 
1036 	splx(s);
1037 }
1038 
1039 /*
1040  * Map the specified CCB's data buffer onto the bus, and fill the
1041  * scatter-gather list.
1042  */
1043 int
1044 amr_ccb_map(struct amr_softc *amr, struct amr_ccb *ac, void *data, int size,
1045 	    int tflag)
1046 {
1047 	struct amr_sgentry *sge;
1048 	struct amr_mailbox_cmd *mb;
1049 	int nsegs, i, rv, sgloff;
1050 	bus_dmamap_t xfer;
1051 	int dmaflag = 0;
1052 
1053 	xfer = ac->ac_xfer_map;
1054 
1055 	rv = bus_dmamap_load(amr->amr_dmat, xfer, data, size, NULL,
1056 	    BUS_DMA_NOWAIT);
1057 	if (rv != 0)
1058 		return (rv);
1059 
1060 	mb = &ac->ac_cmd;
1061 	ac->ac_xfer_size = size;
1062 	ac->ac_flags |= (tflag & (AC_XFER_OUT | AC_XFER_IN));
1063 	sgloff = AMR_SGL_SIZE * ac->ac_ident;
1064 
1065 	if (tflag & AC_XFER_OUT)
1066 		dmaflag |= BUS_DMASYNC_PREWRITE;
1067 	if (tflag & AC_XFER_IN)
1068 		dmaflag |= BUS_DMASYNC_PREREAD;
1069 
1070 	/* We don't need to use a scatter/gather list for just 1 segment. */
1071 	nsegs = xfer->dm_nsegs;
1072 	if (nsegs == 1) {
1073 		mb->mb_nsgelem = 0;
1074 		mb->mb_physaddr = htole32(xfer->dm_segs[0].ds_addr);
1075 		ac->ac_flags |= AC_NOSGL;
1076 	} else {
1077 		mb->mb_nsgelem = nsegs;
1078 		mb->mb_physaddr = htole32(amr->amr_sgls_paddr + sgloff);
1079 
1080 		sge = (struct amr_sgentry *)((caddr_t)amr->amr_sgls + sgloff);
1081 		for (i = 0; i < nsegs; i++, sge++) {
1082 			sge->sge_addr = htole32(xfer->dm_segs[i].ds_addr);
1083 			sge->sge_count = htole32(xfer->dm_segs[i].ds_len);
1084 		}
1085 	}
1086 
1087 	bus_dmamap_sync(amr->amr_dmat, xfer, 0, ac->ac_xfer_size, dmaflag);
1088 
1089 	if ((ac->ac_flags & AC_NOSGL) == 0)
1090 		bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, sgloff,
1091 		    AMR_SGL_SIZE, BUS_DMASYNC_PREWRITE);
1092 
1093 	return (0);
1094 }
1095 
1096 /*
1097  * Unmap the specified CCB's data buffer.
1098  */
1099 void
1100 amr_ccb_unmap(struct amr_softc *amr, struct amr_ccb *ac)
1101 {
1102 	int dmaflag = 0;
1103 
1104 	if (ac->ac_flags & AC_XFER_IN)
1105 		dmaflag |= BUS_DMASYNC_POSTREAD;
1106 	if (ac->ac_flags & AC_XFER_OUT)
1107 		dmaflag |= BUS_DMASYNC_POSTWRITE;
1108 
1109 	if ((ac->ac_flags & AC_NOSGL) == 0)
1110 		bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap,
1111 		    AMR_SGL_SIZE * ac->ac_ident, AMR_SGL_SIZE,
1112 		    BUS_DMASYNC_POSTWRITE);
1113 	bus_dmamap_sync(amr->amr_dmat, ac->ac_xfer_map, 0, ac->ac_xfer_size,
1114 	    dmaflag);
1115 	bus_dmamap_unload(amr->amr_dmat, ac->ac_xfer_map);
1116 }
1117 
1118 /*
1119  * Submit a command to the controller and poll on completion.  Return
1120  * non-zero on timeout or error.  Must be called with interrupts blocked.
1121  */
1122 int
1123 amr_ccb_poll(struct amr_softc *amr, struct amr_ccb *ac, int timo)
1124 {
1125 	int rv;
1126 
1127 	if ((rv = (*amr->amr_submit)(amr, ac)) != 0)
1128 		return (rv);
1129 	TAILQ_INSERT_TAIL(&amr->amr_ccb_active, ac, ac_chain.tailq);
1130 
1131 	for (timo *= 10; timo != 0; timo--) {
1132 		amr_intr(amr);
1133 		if ((ac->ac_flags & AC_COMPLETE) != 0)
1134 			break;
1135 		DELAY(100);
1136 	}
1137 
1138 	return (timo == 0 || ac->ac_status != 0 ? EIO : 0);
1139 }
1140 
1141 /*
1142  * Submit a command to the controller and sleep on completion.  Return
1143  * non-zero on error.
1144  */
1145 int
1146 amr_ccb_wait(struct amr_softc *amr, struct amr_ccb *ac)
1147 {
1148 	int s;
1149 
1150 	s = splbio();
1151 	amr_ccb_enqueue(amr, ac);
1152 	tsleep(ac, PRIBIO, "amrcmd", 0);
1153 	splx(s);
1154 
1155 	return (ac->ac_status != 0 ? EIO : 0);
1156 }
1157 
1158 #if 0
1159 /*
1160  * Wait for the mailbox to become available.
1161  */
1162 static int
1163 amr_mbox_wait(struct amr_softc *amr)
1164 {
1165 	int timo;
1166 
1167 	for (timo = 10000; timo != 0; timo--) {
1168 		bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1169 		    sizeof(struct amr_mailbox), BUS_DMASYNC_POSTREAD);
1170 		if (amr->amr_mbox->mb_cmd.mb_busy == 0)
1171 			break;
1172 		DELAY(100);
1173 	}
1174 
1175 	if (timo == 0)
1176 		printf("%s: controller wedged\n", amr->amr_dv.dv_xname);
1177 
1178 	return (timo != 0 ? 0 : EAGAIN);
1179 }
1180 #endif
1181 
1182 /*
1183  * Tell the controller that the mailbox contains a valid command.  Must be
1184  * called with interrupts blocked.
1185  */
1186 static int
1187 amr_quartz_submit(struct amr_softc *amr, struct amr_ccb *ac)
1188 {
1189 	u_int32_t v;
1190 
1191 	amr->amr_mbox->mb_poll = 0;
1192 	amr->amr_mbox->mb_ack = 0;
1193 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1194 	    sizeof(struct amr_mailbox), BUS_DMASYNC_PREWRITE);
1195 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1196 	    sizeof(struct amr_mailbox), BUS_DMASYNC_POSTREAD);
1197 	if (amr->amr_mbox->mb_cmd.mb_busy != 0)
1198 		return (EAGAIN);
1199 
1200 	v = amr_inl(amr, AMR_QREG_IDB);
1201 	if ((v & AMR_QIDB_SUBMIT) != 0) {
1202 		amr->amr_mbox->mb_cmd.mb_busy = 0;
1203 		bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1204 		    sizeof(struct amr_mailbox), BUS_DMASYNC_PREWRITE);
1205 		bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1206 		    sizeof(struct amr_mailbox), BUS_DMASYNC_PREREAD);
1207 		return (EAGAIN);
1208 	}
1209 
1210 	amr->amr_mbox->mb_segment = 0;
1211 	memcpy(&amr->amr_mbox->mb_cmd, &ac->ac_cmd, sizeof(ac->ac_cmd));
1212 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1213 	    sizeof(struct amr_mailbox), BUS_DMASYNC_PREWRITE);
1214 
1215 	ac->ac_start_time = time_uptime;
1216 	ac->ac_flags |= AC_ACTIVE;
1217 	amr_outl(amr, AMR_QREG_IDB,
1218 	    (amr->amr_mbox_paddr + 16) | AMR_QIDB_SUBMIT);
1219 	return (0);
1220 }
1221 
1222 static int
1223 amr_std_submit(struct amr_softc *amr, struct amr_ccb *ac)
1224 {
1225 
1226 	amr->amr_mbox->mb_poll = 0;
1227 	amr->amr_mbox->mb_ack = 0;
1228 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1229 	    sizeof(struct amr_mailbox), BUS_DMASYNC_PREWRITE);
1230 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1231 	    sizeof(struct amr_mailbox), BUS_DMASYNC_POSTREAD);
1232 	if (amr->amr_mbox->mb_cmd.mb_busy != 0)
1233 		return (EAGAIN);
1234 
1235 	if ((amr_inb(amr, AMR_SREG_MBOX_BUSY) & AMR_SMBOX_BUSY_FLAG) != 0) {
1236 		amr->amr_mbox->mb_cmd.mb_busy = 0;
1237 		bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1238 		    sizeof(struct amr_mailbox), BUS_DMASYNC_PREWRITE);
1239 		bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1240 		    sizeof(struct amr_mailbox), BUS_DMASYNC_PREREAD);
1241 		return (EAGAIN);
1242 	}
1243 
1244 	amr->amr_mbox->mb_segment = 0;
1245 	memcpy(&amr->amr_mbox->mb_cmd, &ac->ac_cmd, sizeof(ac->ac_cmd));
1246 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1247 	    sizeof(struct amr_mailbox), BUS_DMASYNC_PREWRITE);
1248 
1249 	ac->ac_start_time = time_uptime;
1250 	ac->ac_flags |= AC_ACTIVE;
1251 	amr_outb(amr, AMR_SREG_CMD, AMR_SCMD_POST);
1252 	return (0);
1253 }
1254 
1255 /*
1256  * Claim any work that the controller has completed; acknowledge completion,
1257  * save details of the completion in (mbsave).  Must be called with
1258  * interrupts blocked.
1259  */
1260 static int
1261 amr_quartz_get_work(struct amr_softc *amr, struct amr_mailbox_resp *mbsave)
1262 {
1263 
1264 	/* Work waiting for us? */
1265 	if (amr_inl(amr, AMR_QREG_ODB) != AMR_QODB_READY)
1266 		return (-1);
1267 
1268 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1269 	    sizeof(struct amr_mailbox), BUS_DMASYNC_POSTREAD);
1270 
1271 	/* Save the mailbox, which contains a list of completed commands. */
1272 	memcpy(mbsave, &amr->amr_mbox->mb_resp, sizeof(*mbsave));
1273 
1274 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1275 	    sizeof(struct amr_mailbox), BUS_DMASYNC_PREREAD);
1276 
1277 	/* Ack the interrupt and mailbox transfer. */
1278 	amr_outl(amr, AMR_QREG_ODB, AMR_QODB_READY);
1279 	amr_outl(amr, AMR_QREG_IDB, (amr->amr_mbox_paddr+16) | AMR_QIDB_ACK);
1280 
1281 	/*
1282 	 * This waits for the controller to notice that we've taken the
1283 	 * command from it.  It's very inefficient, and we shouldn't do it,
1284 	 * but if we remove this code, we stop completing commands under
1285 	 * load.
1286 	 *
1287 	 * Peter J says we shouldn't do this.  The documentation says we
1288 	 * should.  Who is right?
1289 	 */
1290 	while ((amr_inl(amr, AMR_QREG_IDB) & AMR_QIDB_ACK) != 0)
1291 		DELAY(10);
1292 
1293 	return (0);
1294 }
1295 
1296 static int
1297 amr_std_get_work(struct amr_softc *amr, struct amr_mailbox_resp *mbsave)
1298 {
1299 	u_int8_t istat;
1300 
1301 	/* Check for valid interrupt status. */
1302 	if (((istat = amr_inb(amr, AMR_SREG_INTR)) & AMR_SINTR_VALID) == 0)
1303 		return (-1);
1304 
1305 	/* Ack the interrupt. */
1306 	amr_outb(amr, AMR_SREG_INTR, istat);
1307 
1308 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1309 	    sizeof(struct amr_mailbox), BUS_DMASYNC_POSTREAD);
1310 
1311 	/* Save mailbox, which contains a list of completed commands. */
1312 	memcpy(mbsave, &amr->amr_mbox->mb_resp, sizeof(*mbsave));
1313 
1314 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
1315 	    sizeof(struct amr_mailbox), BUS_DMASYNC_PREREAD);
1316 
1317 	/* Ack mailbox transfer. */
1318 	amr_outb(amr, AMR_SREG_CMD, AMR_SCMD_ACKINTR);
1319 
1320 	return (0);
1321 }
1322 
1323 static void
1324 amr_ccb_dump(struct amr_softc *amr, struct amr_ccb *ac)
1325 {
1326 	int i;
1327 
1328 	printf("%s: ", amr->amr_dv.dv_xname);
1329 	for (i = 0; i < 4; i++)
1330 		printf("%08x ", ((u_int32_t *)&ac->ac_cmd)[i]);
1331 	printf("\n");
1332 }
1333 
1334 static int
1335 amropen(dev_t dev, int flag, int mode, struct lwp *l)
1336 {
1337 	struct amr_softc *amr;
1338 
1339 	if ((amr = device_lookup(&amr_cd, minor(dev))) == NULL)
1340 		return (ENXIO);
1341 	if ((amr->amr_flags & AMRF_OPEN) != 0)
1342 		return (EBUSY);
1343 
1344 	amr->amr_flags |= AMRF_OPEN;
1345 	return (0);
1346 }
1347 
1348 static int
1349 amrclose(dev_t dev, int flag, int mode, struct lwp *l)
1350 {
1351 	struct amr_softc *amr;
1352 
1353 	amr = device_lookup(&amr_cd, minor(dev));
1354 	amr->amr_flags &= ~AMRF_OPEN;
1355 	return (0);
1356 }
1357 
1358 static int
1359 amrioctl(dev_t dev, u_long cmd, caddr_t data, int flag,
1360     struct lwp *l)
1361 {
1362 	struct amr_softc *amr;
1363 	struct amr_user_ioctl *au;
1364 	struct amr_ccb *ac;
1365 	struct amr_mailbox_ioctl *mbi;
1366 	unsigned long au_length;
1367 	uint8_t *au_cmd;
1368 	int error;
1369 	void *dp = NULL, *au_buffer;
1370 
1371 	amr = device_lookup(&amr_cd, minor(dev));
1372 
1373 	/* This should be compatible with the FreeBSD interface */
1374 
1375 	switch (cmd) {
1376 	case AMR_IO_VERSION:
1377 		*(int *)data = AMR_IO_VERSION_NUMBER;
1378 		return 0;
1379 	case AMR_IO_COMMAND:
1380 		error = kauth_authorize_device_passthru(l->l_cred, dev, data);
1381 		if (error)
1382 			return (error);
1383 
1384 		au = (struct amr_user_ioctl *)data;
1385 		au_cmd = au->au_cmd;
1386 		au_buffer = au->au_buffer;
1387 		au_length = au->au_length;
1388 		break;
1389 	default:
1390 		return ENOTTY;
1391 	}
1392 
1393 	if (au_cmd[0] == AMR_CMD_PASS) {
1394 		/* not yet */
1395 		return EOPNOTSUPP;
1396 	}
1397 
1398 	if (au_length <= 0 || au_length > MAXPHYS || au_cmd[0] == 0x06)
1399 		return (EINVAL);
1400 
1401 	/*
1402 	 * allocate kernel memory for data, doing I/O directly to user
1403 	 * buffer isn't that easy.
1404 	 */
1405 	dp = malloc(au_length, M_DEVBUF, M_WAITOK|M_ZERO);
1406 	if (dp == NULL)
1407 		return ENOMEM;
1408 	if ((error = copyin(au_buffer, dp, au_length)) != 0)
1409 		goto out;
1410 
1411 	/* direct command to controller */
1412 	while (amr_ccb_alloc(amr, &ac) != 0) {
1413 		error = tsleep(NULL, PRIBIO | PCATCH, "armmbx", hz);
1414 		if (error == EINTR)
1415 			goto out;
1416 	}
1417 
1418 	mbi = (struct amr_mailbox_ioctl *)&ac->ac_cmd;
1419 	mbi->mb_command = au_cmd[0];
1420 	mbi->mb_channel = au_cmd[1];
1421 	mbi->mb_param = au_cmd[2];
1422 	mbi->mb_pad[0] = au_cmd[3];
1423 	mbi->mb_drive = au_cmd[4];
1424 	error = amr_ccb_map(amr, ac, dp, (int)au_length,
1425 	    AC_XFER_IN | AC_XFER_OUT);
1426 	if (error == 0) {
1427 		error = amr_ccb_wait(amr, ac);
1428 		amr_ccb_unmap(amr, ac);
1429 		if (error == 0)
1430 			error = copyout(dp, au_buffer, au_length);
1431 
1432 	}
1433 	amr_ccb_free(amr, ac);
1434 out:
1435 	free(dp, M_DEVBUF);
1436 	return (error);
1437 }
1438