Home | History | Annotate | Line # | Download | only in pci
amr.c revision 1.54.8.1
      1 /*	$NetBSD: amr.c,v 1.54.8.1 2012/10/30 17:21:22 yamt Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 2002, 2003 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This code is derived from software contributed to The NetBSD Foundation
      8  * by Andrew Doran.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  *
     19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     29  * POSSIBILITY OF SUCH DAMAGE.
     30  */
     31 
     32 /*-
     33  * Copyright (c) 1999,2000 Michael Smith
     34  * Copyright (c) 2000 BSDi
     35  * All rights reserved.
     36  *
     37  * Redistribution and use in source and binary forms, with or without
     38  * modification, are permitted provided that the following conditions
     39  * are met:
     40  * 1. Redistributions of source code must retain the above copyright
     41  *    notice, this list of conditions and the following disclaimer.
     42  * 2. Redistributions in binary form must reproduce the above copyright
     43  *    notice, this list of conditions and the following disclaimer in the
     44  *    documentation and/or other materials provided with the distribution.
     45  *
     46  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
     47  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     48  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     49  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
     50  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     51  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     52  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     53  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     54  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     55  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     56  * SUCH DAMAGE.
     57  *
     58  * from FreeBSD: amr_pci.c,v 1.5 2000/08/30 07:52:40 msmith Exp
     59  * from FreeBSD: amr.c,v 1.16 2000/08/30 07:52:40 msmith Exp
     60  */
     61 
     62 /*
     63  * Driver for AMI RAID controllers.
     64  */
     65 
     66 #include <sys/cdefs.h>
     67 __KERNEL_RCSID(0, "$NetBSD: amr.c,v 1.54.8.1 2012/10/30 17:21:22 yamt Exp $");
     68 
     69 #include <sys/param.h>
     70 #include <sys/systm.h>
     71 #include <sys/kernel.h>
     72 #include <sys/device.h>
     73 #include <sys/queue.h>
     74 #include <sys/proc.h>
     75 #include <sys/buf.h>
     76 #include <sys/malloc.h>
     77 #include <sys/conf.h>
     78 #include <sys/kthread.h>
     79 #include <sys/kauth.h>
     80 
     81 #include <machine/endian.h>
     82 #include <sys/bus.h>
     83 
     84 #include <dev/pci/pcidevs.h>
     85 #include <dev/pci/pcivar.h>
     86 #include <dev/pci/amrreg.h>
     87 #include <dev/pci/amrvar.h>
     88 #include <dev/pci/amrio.h>
     89 
     90 #include "locators.h"
     91 
     92 static void	amr_attach(device_t, device_t, void *);
     93 static void	amr_ccb_dump(struct amr_softc *, struct amr_ccb *);
     94 static void	*amr_enquire(struct amr_softc *, u_int8_t, u_int8_t, u_int8_t,
     95 			     void *);
     96 static int	amr_init(struct amr_softc *, const char *,
     97 			 struct pci_attach_args *pa);
     98 static int	amr_intr(void *);
     99 static int	amr_match(device_t, cfdata_t, void *);
    100 static int	amr_print(void *, const char *);
    101 static void	amr_shutdown(void *);
    102 static void	amr_teardown(struct amr_softc *);
    103 static void	amr_thread(void *);
    104 
    105 static int	amr_quartz_get_work(struct amr_softc *,
    106 				    struct amr_mailbox_resp *);
    107 static int	amr_quartz_submit(struct amr_softc *, struct amr_ccb *);
    108 static int	amr_std_get_work(struct amr_softc *, struct amr_mailbox_resp *);
    109 static int	amr_std_submit(struct amr_softc *, struct amr_ccb *);
    110 
    111 static dev_type_open(amropen);
    112 static dev_type_close(amrclose);
    113 static dev_type_ioctl(amrioctl);
    114 
    115 CFATTACH_DECL_NEW(amr, sizeof(struct amr_softc),
    116     amr_match, amr_attach, NULL, NULL);
    117 
    118 const struct cdevsw amr_cdevsw = {
    119 	amropen, amrclose, noread, nowrite, amrioctl,
    120 	nostop, notty, nopoll, nommap, nokqfilter, D_OTHER
    121 };
    122 
    123 extern struct   cfdriver amr_cd;
    124 
    125 #define AT_QUARTZ	0x01	/* `Quartz' chipset */
    126 #define	AT_SIG		0x02	/* Check for signature */
    127 
    128 static struct amr_pci_type {
    129 	u_short	apt_vendor;
    130 	u_short	apt_product;
    131 	u_short	apt_flags;
    132 } const amr_pci_type[] = {
    133 	{ PCI_VENDOR_AMI,   PCI_PRODUCT_AMI_MEGARAID,  0 },
    134 	{ PCI_VENDOR_AMI,   PCI_PRODUCT_AMI_MEGARAID2, 0 },
    135 	{ PCI_VENDOR_AMI,   PCI_PRODUCT_AMI_MEGARAID3, AT_QUARTZ },
    136 	{ PCI_VENDOR_SYMBIOS, PCI_PRODUCT_AMI_MEGARAID3, AT_QUARTZ },
    137 	{ PCI_VENDOR_INTEL, PCI_PRODUCT_AMI_MEGARAID3, AT_QUARTZ | AT_SIG },
    138 	{ PCI_VENDOR_INTEL,  PCI_PRODUCT_SYMBIOS_MEGARAID_320X, AT_QUARTZ },
    139 	{ PCI_VENDOR_INTEL,  PCI_PRODUCT_SYMBIOS_MEGARAID_320E, AT_QUARTZ },
    140 	{ PCI_VENDOR_SYMBIOS,  PCI_PRODUCT_SYMBIOS_MEGARAID_300X, AT_QUARTZ },
    141 	{ PCI_VENDOR_DELL,  PCI_PRODUCT_DELL_PERC_4DI, AT_QUARTZ },
    142 	{ PCI_VENDOR_DELL,  PCI_PRODUCT_DELL_PERC_4DI_2, AT_QUARTZ },
    143 	{ PCI_VENDOR_DELL,  PCI_PRODUCT_DELL_PERC_4ESI, AT_QUARTZ },
    144 	{ PCI_VENDOR_SYMBIOS,  PCI_PRODUCT_SYMBIOS_PERC_4SC, AT_QUARTZ },
    145 	{ PCI_VENDOR_SYMBIOS,  PCI_PRODUCT_SYMBIOS_MEGARAID_320X, AT_QUARTZ },
    146 	{ PCI_VENDOR_SYMBIOS,  PCI_PRODUCT_SYMBIOS_MEGARAID_320E, AT_QUARTZ },
    147 	{ PCI_VENDOR_SYMBIOS,  PCI_PRODUCT_SYMBIOS_MEGARAID_300X, AT_QUARTZ },
    148 };
    149 
    150 static struct amr_typestr {
    151 	const char	*at_str;
    152 	int		at_sig;
    153 } const amr_typestr[] = {
    154 	{ "Series 431",			AMR_SIG_431 },
    155 	{ "Series 438",			AMR_SIG_438 },
    156 	{ "Series 466",			AMR_SIG_466 },
    157 	{ "Series 467",			AMR_SIG_467 },
    158 	{ "Series 490",			AMR_SIG_490 },
    159 	{ "Series 762",			AMR_SIG_762 },
    160 	{ "HP NetRAID (T5)",		AMR_SIG_T5 },
    161 	{ "HP NetRAID (T7)",		AMR_SIG_T7 },
    162 };
    163 
    164 static struct {
    165 	const char	*ds_descr;
    166 	int	ds_happy;
    167 } const amr_dstate[] = {
    168 	{ "offline",	0 },
    169 	{ "degraded",	1 },
    170 	{ "optimal",	1 },
    171 	{ "online",	1 },
    172 	{ "failed",	0 },
    173 	{ "rebuilding",	1 },
    174 	{ "hotspare",	0 },
    175 };
    176 
    177 static void	*amr_sdh;
    178 
    179 static int	amr_max_segs;
    180 int		amr_max_xfer;
    181 
    182 static inline u_int8_t
    183 amr_inb(struct amr_softc *amr, int off)
    184 {
    185 
    186 	bus_space_barrier(amr->amr_iot, amr->amr_ioh, off, 1,
    187 	    BUS_SPACE_BARRIER_WRITE | BUS_SPACE_BARRIER_READ);
    188 	return (bus_space_read_1(amr->amr_iot, amr->amr_ioh, off));
    189 }
    190 
    191 static inline u_int32_t
    192 amr_inl(struct amr_softc *amr, int off)
    193 {
    194 
    195 	bus_space_barrier(amr->amr_iot, amr->amr_ioh, off, 4,
    196 	    BUS_SPACE_BARRIER_WRITE | BUS_SPACE_BARRIER_READ);
    197 	return (bus_space_read_4(amr->amr_iot, amr->amr_ioh, off));
    198 }
    199 
    200 static inline void
    201 amr_outb(struct amr_softc *amr, int off, u_int8_t val)
    202 {
    203 
    204 	bus_space_write_1(amr->amr_iot, amr->amr_ioh, off, val);
    205 	bus_space_barrier(amr->amr_iot, amr->amr_ioh, off, 1,
    206 	    BUS_SPACE_BARRIER_WRITE);
    207 }
    208 
    209 static inline void
    210 amr_outl(struct amr_softc *amr, int off, u_int32_t val)
    211 {
    212 
    213 	bus_space_write_4(amr->amr_iot, amr->amr_ioh, off, val);
    214 	bus_space_barrier(amr->amr_iot, amr->amr_ioh, off, 4,
    215 	    BUS_SPACE_BARRIER_WRITE);
    216 }
    217 
    218 /*
    219  * Match a supported device.
    220  */
    221 static int
    222 amr_match(device_t parent, cfdata_t match, void *aux)
    223 {
    224 	struct pci_attach_args *pa;
    225 	pcireg_t s;
    226 	int i;
    227 
    228 	pa = (struct pci_attach_args *)aux;
    229 
    230 	/*
    231 	 * Don't match the device if it's operating in I2O mode.  In this
    232 	 * case it should be handled by the `iop' driver.
    233 	 */
    234 	if (PCI_CLASS(pa->pa_class) == PCI_CLASS_I2O)
    235 		return (0);
    236 
    237 	for (i = 0; i < sizeof(amr_pci_type) / sizeof(amr_pci_type[0]); i++)
    238 		if (PCI_VENDOR(pa->pa_id) == amr_pci_type[i].apt_vendor &&
    239 		    PCI_PRODUCT(pa->pa_id) == amr_pci_type[i].apt_product)
    240 		    	break;
    241 
    242 	if (i == sizeof(amr_pci_type) / sizeof(amr_pci_type[0]))
    243 		return (0);
    244 
    245 	if ((amr_pci_type[i].apt_flags & AT_SIG) == 0)
    246 		return (1);
    247 
    248 	s = pci_conf_read(pa->pa_pc, pa->pa_tag, AMR_QUARTZ_SIG_REG) & 0xffff;
    249 	return (s == AMR_QUARTZ_SIG0 || s == AMR_QUARTZ_SIG1);
    250 }
    251 
    252 /*
    253  * Attach a supported device.
    254  */
    255 static void
    256 amr_attach(device_t parent, device_t self, void *aux)
    257 {
    258 	struct pci_attach_args *pa;
    259 	struct amr_attach_args amra;
    260 	const struct amr_pci_type *apt;
    261 	struct amr_softc *amr;
    262 	pci_chipset_tag_t pc;
    263 	pci_intr_handle_t ih;
    264 	const char *intrstr;
    265 	pcireg_t reg;
    266 	int rseg, i, j, size, rv, memreg, ioreg;
    267 	struct amr_ccb *ac;
    268 	int locs[AMRCF_NLOCS];
    269 
    270 	aprint_naive(": RAID controller\n");
    271 
    272 	amr = device_private(self);
    273 	amr->amr_dv = self;
    274 	pa = (struct pci_attach_args *)aux;
    275 	pc = pa->pa_pc;
    276 
    277 	for (i = 0; i < sizeof(amr_pci_type) / sizeof(amr_pci_type[0]); i++)
    278 		if (PCI_VENDOR(pa->pa_id) == amr_pci_type[i].apt_vendor &&
    279 		    PCI_PRODUCT(pa->pa_id) == amr_pci_type[i].apt_product)
    280 			break;
    281 	apt = amr_pci_type + i;
    282 
    283 	memreg = ioreg = 0;
    284 	for (i = 0x10; i <= 0x14; i += 4) {
    285 		reg = pci_conf_read(pc, pa->pa_tag, i);
    286 		switch (PCI_MAPREG_TYPE(reg)) {
    287 		case PCI_MAPREG_TYPE_MEM:
    288 			if (PCI_MAPREG_MEM_SIZE(reg) != 0)
    289 				memreg = i;
    290 			break;
    291 		case PCI_MAPREG_TYPE_IO:
    292 			if (PCI_MAPREG_IO_SIZE(reg) != 0)
    293 				ioreg = i;
    294 			break;
    295 
    296 		}
    297 	}
    298 
    299 	if (memreg && pci_mapreg_map(pa, memreg, PCI_MAPREG_TYPE_MEM, 0,
    300 	    &amr->amr_iot, &amr->amr_ioh, NULL, &amr->amr_ios) == 0)
    301 		;
    302 	else if (ioreg && pci_mapreg_map(pa, ioreg, PCI_MAPREG_TYPE_IO, 0,
    303 	    &amr->amr_iot, &amr->amr_ioh, NULL, &amr->amr_ios) == 0)
    304 		;
    305 	else {
    306 		aprint_error("can't map control registers\n");
    307 		amr_teardown(amr);
    308 		return;
    309 	}
    310 
    311 	amr->amr_flags |= AMRF_PCI_REGS;
    312 	amr->amr_dmat = pa->pa_dmat;
    313 	amr->amr_pc = pa->pa_pc;
    314 
    315 	/* Enable the device. */
    316 	reg = pci_conf_read(pa->pa_pc, pa->pa_tag, PCI_COMMAND_STATUS_REG);
    317 	pci_conf_write(pa->pa_pc, pa->pa_tag, PCI_COMMAND_STATUS_REG,
    318 	    reg | PCI_COMMAND_MASTER_ENABLE);
    319 
    320 	/* Map and establish the interrupt. */
    321 	if (pci_intr_map(pa, &ih)) {
    322 		aprint_error("can't map interrupt\n");
    323 		amr_teardown(amr);
    324 		return;
    325 	}
    326 	intrstr = pci_intr_string(pc, ih);
    327 	amr->amr_ih = pci_intr_establish(pc, ih, IPL_BIO, amr_intr, amr);
    328 	if (amr->amr_ih == NULL) {
    329 		aprint_error("can't establish interrupt");
    330 		if (intrstr != NULL)
    331 			aprint_error(" at %s", intrstr);
    332 		aprint_error("\n");
    333 		amr_teardown(amr);
    334 		return;
    335 	}
    336 	amr->amr_flags |= AMRF_PCI_INTR;
    337 
    338 	/*
    339 	 * Allocate space for the mailbox and S/G lists.  Some controllers
    340 	 * don't like S/G lists to be located below 0x2000, so we allocate
    341 	 * enough slop to enable us to compensate.
    342 	 *
    343 	 * The standard mailbox structure needs to be aligned on a 16-byte
    344 	 * boundary.  The 64-bit mailbox has one extra field, 4 bytes in
    345 	 * size, which precedes the standard mailbox.
    346 	 */
    347 	size = AMR_SGL_SIZE * AMR_MAX_CMDS + 0x2000;
    348 	amr->amr_dmasize = size;
    349 
    350 	if ((rv = bus_dmamem_alloc(amr->amr_dmat, size, PAGE_SIZE, 0,
    351 	    &amr->amr_dmaseg, 1, &rseg, BUS_DMA_NOWAIT)) != 0) {
    352 		aprint_error_dev(amr->amr_dv, "unable to allocate buffer, rv = %d\n",
    353 		    rv);
    354 		amr_teardown(amr);
    355 		return;
    356 	}
    357 	amr->amr_flags |= AMRF_DMA_ALLOC;
    358 
    359 	if ((rv = bus_dmamem_map(amr->amr_dmat, &amr->amr_dmaseg, rseg, size,
    360 	    (void **)&amr->amr_mbox,
    361 	    BUS_DMA_NOWAIT | BUS_DMA_COHERENT)) != 0) {
    362 		aprint_error_dev(amr->amr_dv, "unable to map buffer, rv = %d\n",
    363 		    rv);
    364 		amr_teardown(amr);
    365 		return;
    366 	}
    367 	amr->amr_flags |= AMRF_DMA_MAP;
    368 
    369 	if ((rv = bus_dmamap_create(amr->amr_dmat, size, 1, size, 0,
    370 	    BUS_DMA_NOWAIT, &amr->amr_dmamap)) != 0) {
    371 		aprint_error_dev(amr->amr_dv, "unable to create buffer DMA map, rv = %d\n",
    372 		    rv);
    373 		amr_teardown(amr);
    374 		return;
    375 	}
    376 	amr->amr_flags |= AMRF_DMA_CREATE;
    377 
    378 	if ((rv = bus_dmamap_load(amr->amr_dmat, amr->amr_dmamap,
    379 	    amr->amr_mbox, size, NULL, BUS_DMA_NOWAIT)) != 0) {
    380 		aprint_error_dev(amr->amr_dv, "unable to load buffer DMA map, rv = %d\n",
    381 		    rv);
    382 		amr_teardown(amr);
    383 		return;
    384 	}
    385 	amr->amr_flags |= AMRF_DMA_LOAD;
    386 
    387 	memset(amr->amr_mbox, 0, size);
    388 
    389 	amr->amr_mbox_paddr = amr->amr_dmamap->dm_segs[0].ds_addr;
    390 	amr->amr_sgls_paddr = (amr->amr_mbox_paddr + 0x1fff) & ~0x1fff;
    391 	amr->amr_sgls = (struct amr_sgentry *)((char *)amr->amr_mbox +
    392 	    amr->amr_sgls_paddr - amr->amr_dmamap->dm_segs[0].ds_addr);
    393 
    394 	/*
    395 	 * Allocate and initalise the command control blocks.
    396 	 */
    397 	ac = malloc(sizeof(*ac) * AMR_MAX_CMDS, M_DEVBUF, M_NOWAIT | M_ZERO);
    398 	amr->amr_ccbs = ac;
    399 	SLIST_INIT(&amr->amr_ccb_freelist);
    400 	TAILQ_INIT(&amr->amr_ccb_active);
    401 	amr->amr_flags |= AMRF_CCBS;
    402 
    403 	if (amr_max_xfer == 0) {
    404 		amr_max_xfer = min(((AMR_MAX_SEGS - 1) * PAGE_SIZE), MAXPHYS);
    405 		amr_max_segs = (amr_max_xfer + (PAGE_SIZE * 2) - 1) / PAGE_SIZE;
    406 	}
    407 
    408 	for (i = 0; i < AMR_MAX_CMDS; i++, ac++) {
    409 		rv = bus_dmamap_create(amr->amr_dmat, amr_max_xfer,
    410 		    amr_max_segs, amr_max_xfer, 0,
    411 		    BUS_DMA_NOWAIT | BUS_DMA_ALLOCNOW, &ac->ac_xfer_map);
    412 		if (rv != 0)
    413 			break;
    414 
    415 		ac->ac_ident = i;
    416 		amr_ccb_free(amr, ac);
    417 	}
    418 	if (i != AMR_MAX_CMDS) {
    419 		aprint_error_dev(amr->amr_dv, "memory exhausted\n");
    420 		amr_teardown(amr);
    421 		return;
    422 	}
    423 
    424 	/*
    425 	 * Take care of model-specific tasks.
    426 	 */
    427 	if ((apt->apt_flags & AT_QUARTZ) != 0) {
    428 		amr->amr_submit = amr_quartz_submit;
    429 		amr->amr_get_work = amr_quartz_get_work;
    430 	} else {
    431 		amr->amr_submit = amr_std_submit;
    432 		amr->amr_get_work = amr_std_get_work;
    433 
    434 		/* Notify the controller of the mailbox location. */
    435 		amr_outl(amr, AMR_SREG_MBOX, (u_int32_t)amr->amr_mbox_paddr + 16);
    436 		amr_outb(amr, AMR_SREG_MBOX_ENABLE, AMR_SMBOX_ENABLE_ADDR);
    437 
    438 		/* Clear outstanding interrupts and enable interrupts. */
    439 		amr_outb(amr, AMR_SREG_CMD, AMR_SCMD_ACKINTR);
    440 		amr_outb(amr, AMR_SREG_TOGL,
    441 		    amr_inb(amr, AMR_SREG_TOGL) | AMR_STOGL_ENABLE);
    442 	}
    443 
    444 	/*
    445 	 * Retrieve parameters, and tell the world about us.
    446 	 */
    447 	amr->amr_enqbuf = malloc(AMR_ENQUIRY_BUFSIZE, M_DEVBUF, M_NOWAIT);
    448 	amr->amr_flags |= AMRF_ENQBUF;
    449 	amr->amr_maxqueuecnt = i;
    450 	aprint_normal(": AMI RAID ");
    451 	if (amr_init(amr, intrstr, pa) != 0) {
    452 		amr_teardown(amr);
    453 		return;
    454 	}
    455 
    456 	/*
    457 	 * Cap the maximum number of outstanding commands.  AMI's Linux
    458 	 * driver doesn't trust the controller's reported value, and lockups
    459 	 * have been seen when we do.
    460 	 */
    461 	amr->amr_maxqueuecnt = min(amr->amr_maxqueuecnt, AMR_MAX_CMDS);
    462 	if (amr->amr_maxqueuecnt > i)
    463 		amr->amr_maxqueuecnt = i;
    464 
    465 	/* Set our `shutdownhook' before we start any device activity. */
    466 	if (amr_sdh == NULL)
    467 		amr_sdh = shutdownhook_establish(amr_shutdown, NULL);
    468 
    469 	/* Attach sub-devices. */
    470 	for (j = 0; j < amr->amr_numdrives; j++) {
    471 		if (amr->amr_drive[j].al_size == 0)
    472 			continue;
    473 		amra.amra_unit = j;
    474 
    475 		locs[AMRCF_UNIT] = j;
    476 
    477 		amr->amr_drive[j].al_dv = config_found_sm_loc(amr->amr_dv,
    478 			"amr", locs, &amra, amr_print, config_stdsubmatch);
    479 	}
    480 
    481 	SIMPLEQ_INIT(&amr->amr_ccb_queue);
    482 
    483 	/* XXX This doesn't work for newer boards yet. */
    484 	if ((apt->apt_flags & AT_QUARTZ) == 0) {
    485 		rv = kthread_create(PRI_NONE, 0, NULL, amr_thread, amr,
    486 		    &amr->amr_thread, "%s", device_xname(amr->amr_dv));
    487  		if (rv != 0)
    488 			aprint_error_dev(amr->amr_dv, "unable to create thread (%d)",
    489  			    rv);
    490  		else
    491  			amr->amr_flags |= AMRF_THREAD;
    492 	}
    493 }
    494 
    495 /*
    496  * Free up resources.
    497  */
    498 static void
    499 amr_teardown(struct amr_softc *amr)
    500 {
    501 	struct amr_ccb *ac;
    502 	int fl;
    503 
    504 	fl = amr->amr_flags;
    505 
    506 	if ((fl & AMRF_THREAD) != 0) {
    507 		amr->amr_flags |= AMRF_THREAD_EXIT;
    508 		wakeup(amr_thread);
    509 		while ((amr->amr_flags & AMRF_THREAD_EXIT) != 0)
    510 			tsleep(&amr->amr_flags, PWAIT, "amrexit", 0);
    511 	}
    512 	if ((fl & AMRF_CCBS) != 0) {
    513 		SLIST_FOREACH(ac, &amr->amr_ccb_freelist, ac_chain.slist) {
    514 			bus_dmamap_destroy(amr->amr_dmat, ac->ac_xfer_map);
    515 		}
    516 		free(amr->amr_ccbs, M_DEVBUF);
    517 	}
    518 	if ((fl & AMRF_ENQBUF) != 0)
    519 		free(amr->amr_enqbuf, M_DEVBUF);
    520 	if ((fl & AMRF_DMA_LOAD) != 0)
    521 		bus_dmamap_unload(amr->amr_dmat, amr->amr_dmamap);
    522 	if ((fl & AMRF_DMA_MAP) != 0)
    523 		bus_dmamem_unmap(amr->amr_dmat, (void *)amr->amr_mbox,
    524 		    amr->amr_dmasize);
    525 	if ((fl & AMRF_DMA_ALLOC) != 0)
    526 		bus_dmamem_free(amr->amr_dmat, &amr->amr_dmaseg, 1);
    527 	if ((fl & AMRF_DMA_CREATE) != 0)
    528 		bus_dmamap_destroy(amr->amr_dmat, amr->amr_dmamap);
    529 	if ((fl & AMRF_PCI_INTR) != 0)
    530 		pci_intr_disestablish(amr->amr_pc, amr->amr_ih);
    531 	if ((fl & AMRF_PCI_REGS) != 0)
    532 		bus_space_unmap(amr->amr_iot, amr->amr_ioh, amr->amr_ios);
    533 }
    534 
    535 /*
    536  * Print autoconfiguration message for a sub-device.
    537  */
    538 static int
    539 amr_print(void *aux, const char *pnp)
    540 {
    541 	struct amr_attach_args *amra;
    542 
    543 	amra = (struct amr_attach_args *)aux;
    544 
    545 	if (pnp != NULL)
    546 		aprint_normal("block device at %s", pnp);
    547 	aprint_normal(" unit %d", amra->amra_unit);
    548 	return (UNCONF);
    549 }
    550 
    551 /*
    552  * Retrieve operational parameters and describe the controller.
    553  */
    554 static int
    555 amr_init(struct amr_softc *amr, const char *intrstr,
    556 	 struct pci_attach_args *pa)
    557 {
    558 	struct amr_adapter_info *aa;
    559 	struct amr_prodinfo *ap;
    560 	struct amr_enquiry *ae;
    561 	struct amr_enquiry3 *aex;
    562 	const char *prodstr;
    563 	u_int i, sig, ishp;
    564 	char sbuf[64];
    565 
    566 	/*
    567 	 * Try to get 40LD product info, which tells us what the card is
    568 	 * labelled as.
    569 	 */
    570 	ap = amr_enquire(amr, AMR_CMD_CONFIG, AMR_CONFIG_PRODUCT_INFO, 0,
    571 	    amr->amr_enqbuf);
    572 	if (ap != NULL) {
    573 		aprint_normal("<%.80s>\n", ap->ap_product);
    574 		if (intrstr != NULL)
    575 			aprint_normal_dev(amr->amr_dv, "interrupting at %s\n",
    576 			    intrstr);
    577 		aprint_normal_dev(amr->amr_dv, "firmware %.16s, BIOS %.16s, %dMB RAM\n",
    578 		    ap->ap_firmware, ap->ap_bios,
    579 		    le16toh(ap->ap_memsize));
    580 
    581 		amr->amr_maxqueuecnt = ap->ap_maxio;
    582 
    583 		/*
    584 		 * Fetch and record state of logical drives.
    585 		 */
    586 		aex = amr_enquire(amr, AMR_CMD_CONFIG, AMR_CONFIG_ENQ3,
    587 		    AMR_CONFIG_ENQ3_SOLICITED_FULL, amr->amr_enqbuf);
    588 		if (aex == NULL) {
    589 			aprint_error_dev(amr->amr_dv, "ENQUIRY3 failed\n");
    590 			return (-1);
    591 		}
    592 
    593 		if (aex->ae_numldrives > __arraycount(aex->ae_drivestate)) {
    594 			aprint_error_dev(amr->amr_dv, "Inquiry returned more drives (%d)"
    595 			   " than the array can handle (%zu)\n",
    596 			   aex->ae_numldrives,
    597 			   __arraycount(aex->ae_drivestate));
    598 			aex->ae_numldrives = __arraycount(aex->ae_drivestate);
    599 		}
    600 		if (aex->ae_numldrives > AMR_MAX_UNITS) {
    601 			aprint_error_dev(amr->amr_dv,
    602 			    "adjust AMR_MAX_UNITS to %d (currently %d)"
    603 			    "\n", AMR_MAX_UNITS,
    604 			    amr->amr_numdrives);
    605 			amr->amr_numdrives = AMR_MAX_UNITS;
    606 		} else
    607 			amr->amr_numdrives = aex->ae_numldrives;
    608 
    609 		for (i = 0; i < amr->amr_numdrives; i++) {
    610 			amr->amr_drive[i].al_size =
    611 			    le32toh(aex->ae_drivesize[i]);
    612 			amr->amr_drive[i].al_state = aex->ae_drivestate[i];
    613 			amr->amr_drive[i].al_properties = aex->ae_driveprop[i];
    614 		}
    615 
    616 		return (0);
    617 	}
    618 
    619 	/*
    620 	 * Try 8LD extended ENQUIRY to get the controller signature.  Once
    621 	 * found, search for a product description.
    622 	 */
    623 	ae = amr_enquire(amr, AMR_CMD_EXT_ENQUIRY2, 0, 0, amr->amr_enqbuf);
    624 	if (ae != NULL) {
    625 		i = 0;
    626 		sig = le32toh(ae->ae_signature);
    627 
    628 		while (i < sizeof(amr_typestr) / sizeof(amr_typestr[0])) {
    629 			if (amr_typestr[i].at_sig == sig)
    630 				break;
    631 			i++;
    632 		}
    633 		if (i == sizeof(amr_typestr) / sizeof(amr_typestr[0])) {
    634 			snprintf(sbuf, sizeof(sbuf),
    635 			    "unknown ENQUIRY2 sig (0x%08x)", sig);
    636 			prodstr = sbuf;
    637 		} else
    638 			prodstr = amr_typestr[i].at_str;
    639 	} else {
    640 		ae = amr_enquire(amr, AMR_CMD_ENQUIRY, 0, 0, amr->amr_enqbuf);
    641 		if (ae == NULL) {
    642 			aprint_error_dev(amr->amr_dv, "unsupported controller\n");
    643 			return (-1);
    644 		}
    645 
    646 		switch (PCI_PRODUCT(pa->pa_id)) {
    647 		case PCI_PRODUCT_AMI_MEGARAID:
    648 			prodstr = "Series 428";
    649 			break;
    650 		case PCI_PRODUCT_AMI_MEGARAID2:
    651 			prodstr = "Series 434";
    652 			break;
    653 		default:
    654 			snprintf(sbuf, sizeof(sbuf), "unknown PCI dev (0x%04x)",
    655 			    PCI_PRODUCT(pa->pa_id));
    656 			prodstr = sbuf;
    657 			break;
    658 		}
    659 	}
    660 
    661 	/*
    662 	 * HP NetRaid controllers have a special encoding of the firmware
    663 	 * and BIOS versions.  The AMI version seems to have it as strings
    664 	 * whereas the HP version does it with a leading uppercase character
    665 	 * and two binary numbers.
    666 	*/
    667 	aa = &ae->ae_adapter;
    668 
    669 	if (aa->aa_firmware[2] >= 'A' && aa->aa_firmware[2] <= 'Z' &&
    670 	    aa->aa_firmware[1] <  ' ' && aa->aa_firmware[0] <  ' ' &&
    671 	    aa->aa_bios[2] >= 'A' && aa->aa_bios[2] <= 'Z' &&
    672 	    aa->aa_bios[1] <  ' ' && aa->aa_bios[0] <  ' ') {
    673 		if (le32toh(ae->ae_signature) == AMR_SIG_438) {
    674 			/* The AMI 438 is a NetRaid 3si in HP-land. */
    675 			prodstr = "HP NetRaid 3si";
    676 		}
    677 		ishp = 1;
    678 	} else
    679 		ishp = 0;
    680 
    681 	aprint_normal("<%s>\n", prodstr);
    682 	if (intrstr != NULL)
    683 		aprint_normal_dev(amr->amr_dv, "interrupting at %s\n",
    684 		    intrstr);
    685 
    686 	if (ishp)
    687 		aprint_normal_dev(amr->amr_dv, "firmware <%c.%02d.%02d>, BIOS <%c.%02d.%02d>"
    688 		    ", %dMB RAM\n", aa->aa_firmware[2],
    689 		     aa->aa_firmware[1], aa->aa_firmware[0], aa->aa_bios[2],
    690 		     aa->aa_bios[1], aa->aa_bios[0], aa->aa_memorysize);
    691 	else
    692 		aprint_normal_dev(amr->amr_dv, "firmware <%.4s>, BIOS <%.4s>, %dMB RAM\n",
    693 		    aa->aa_firmware, aa->aa_bios,
    694 		    aa->aa_memorysize);
    695 
    696 	amr->amr_maxqueuecnt = aa->aa_maxio;
    697 
    698 	/*
    699 	 * Record state of logical drives.
    700 	 */
    701 	if (ae->ae_ldrv.al_numdrives > __arraycount(ae->ae_ldrv.al_size)) {
    702 		aprint_error_dev(amr->amr_dv, "Inquiry returned more drives (%d)"
    703 		   " than the array can handle (%zu)\n",
    704 		   ae->ae_ldrv.al_numdrives,
    705 		   __arraycount(ae->ae_ldrv.al_size));
    706 		ae->ae_ldrv.al_numdrives = __arraycount(ae->ae_ldrv.al_size);
    707 	}
    708 	if (ae->ae_ldrv.al_numdrives > AMR_MAX_UNITS) {
    709 		aprint_error_dev(amr->amr_dv, "adjust AMR_MAX_UNITS to %d (currently %d)\n",
    710 		    ae->ae_ldrv.al_numdrives,
    711 		    AMR_MAX_UNITS);
    712 		amr->amr_numdrives = AMR_MAX_UNITS;
    713 	} else
    714 		amr->amr_numdrives = ae->ae_ldrv.al_numdrives;
    715 
    716 	for (i = 0; i < amr->amr_numdrives; i++) {
    717 		amr->amr_drive[i].al_size = le32toh(ae->ae_ldrv.al_size[i]);
    718 		amr->amr_drive[i].al_state = ae->ae_ldrv.al_state[i];
    719 		amr->amr_drive[i].al_properties = ae->ae_ldrv.al_properties[i];
    720 	}
    721 
    722 	return (0);
    723 }
    724 
    725 /*
    726  * Flush the internal cache on each configured controller.  Called at
    727  * shutdown time.
    728  */
    729 static void
    730 amr_shutdown(void *cookie)
    731 {
    732 	extern struct cfdriver amr_cd;
    733 	struct amr_softc *amr;
    734 	struct amr_ccb *ac;
    735 	int i, rv, s;
    736 
    737 	for (i = 0; i < amr_cd.cd_ndevs; i++) {
    738 		if ((amr = device_lookup_private(&amr_cd, i)) == NULL)
    739 			continue;
    740 
    741 		if ((rv = amr_ccb_alloc(amr, &ac)) == 0) {
    742 			ac->ac_cmd.mb_command = AMR_CMD_FLUSH;
    743 			s = splbio();
    744 			rv = amr_ccb_poll(amr, ac, 30000);
    745 			splx(s);
    746 			amr_ccb_free(amr, ac);
    747 		}
    748 		if (rv != 0)
    749 			aprint_error_dev(amr->amr_dv, "unable to flush cache (%d)\n", rv);
    750 	}
    751 }
    752 
    753 /*
    754  * Interrupt service routine.
    755  */
    756 static int
    757 amr_intr(void *cookie)
    758 {
    759 	struct amr_softc *amr;
    760 	struct amr_ccb *ac;
    761 	struct amr_mailbox_resp mbox;
    762 	u_int i, forus, idx;
    763 
    764 	amr = cookie;
    765 	forus = 0;
    766 
    767 	while ((*amr->amr_get_work)(amr, &mbox) == 0) {
    768 		/* Iterate over completed commands in this result. */
    769 		for (i = 0; i < mbox.mb_nstatus; i++) {
    770 			idx = mbox.mb_completed[i] - 1;
    771 			ac = amr->amr_ccbs + idx;
    772 
    773 			if (idx >= amr->amr_maxqueuecnt) {
    774 				printf("%s: bad status (bogus ID: %u=%u)\n",
    775 				    device_xname(amr->amr_dv), i, idx);
    776 				continue;
    777 			}
    778 
    779 			if ((ac->ac_flags & AC_ACTIVE) == 0) {
    780 				printf("%s: bad status (not active; 0x04%x)\n",
    781 				    device_xname(amr->amr_dv), ac->ac_flags);
    782 				continue;
    783 			}
    784 
    785 			ac->ac_status = mbox.mb_status;
    786 			ac->ac_flags = (ac->ac_flags & ~AC_ACTIVE) |
    787 			    AC_COMPLETE;
    788 			TAILQ_REMOVE(&amr->amr_ccb_active, ac, ac_chain.tailq);
    789 
    790 			if ((ac->ac_flags & AC_MOAN) != 0)
    791 				printf("%s: ccb %d completed\n",
    792 				    device_xname(amr->amr_dv), ac->ac_ident);
    793 
    794 			/* Pass notification to upper layers. */
    795 			if (ac->ac_handler != NULL)
    796 				(*ac->ac_handler)(ac);
    797 			else
    798 				wakeup(ac);
    799 		}
    800 		forus = 1;
    801 	}
    802 
    803 	if (forus)
    804 		amr_ccb_enqueue(amr, NULL);
    805 
    806 	return (forus);
    807 }
    808 
    809 /*
    810  * Watchdog thread.
    811  */
    812 static void
    813 amr_thread(void *cookie)
    814 {
    815 	struct amr_softc *amr;
    816 	struct amr_ccb *ac;
    817 	struct amr_logdrive *al;
    818 	struct amr_enquiry *ae;
    819 	int rv, i, s;
    820 
    821 	amr = cookie;
    822 	ae = amr->amr_enqbuf;
    823 
    824 	for (;;) {
    825 		tsleep(amr_thread, PWAIT, "amrwdog", AMR_WDOG_TICKS);
    826 
    827 		if ((amr->amr_flags & AMRF_THREAD_EXIT) != 0) {
    828 			amr->amr_flags ^= AMRF_THREAD_EXIT;
    829 			wakeup(&amr->amr_flags);
    830 			kthread_exit(0);
    831 		}
    832 
    833 		s = splbio();
    834 		amr_intr(cookie);
    835 		ac = TAILQ_FIRST(&amr->amr_ccb_active);
    836 		while (ac != NULL) {
    837 			if (ac->ac_start_time + AMR_TIMEOUT > time_uptime)
    838 				break;
    839 			if ((ac->ac_flags & AC_MOAN) == 0) {
    840 				printf("%s: ccb %d timed out; mailbox:\n",
    841 				    device_xname(amr->amr_dv), ac->ac_ident);
    842 				amr_ccb_dump(amr, ac);
    843 				ac->ac_flags |= AC_MOAN;
    844 			}
    845 			ac = TAILQ_NEXT(ac, ac_chain.tailq);
    846 		}
    847 		splx(s);
    848 
    849 		if ((rv = amr_ccb_alloc(amr, &ac)) != 0) {
    850 			printf("%s: ccb_alloc failed (%d)\n",
    851  			    device_xname(amr->amr_dv), rv);
    852 			continue;
    853 		}
    854 
    855 		ac->ac_cmd.mb_command = AMR_CMD_ENQUIRY;
    856 
    857 		rv = amr_ccb_map(amr, ac, amr->amr_enqbuf,
    858 		    AMR_ENQUIRY_BUFSIZE, AC_XFER_IN);
    859 		if (rv != 0) {
    860 			aprint_error_dev(amr->amr_dv, "ccb_map failed (%d)\n",
    861  			    rv);
    862 			amr_ccb_free(amr, ac);
    863 			continue;
    864 		}
    865 
    866 		rv = amr_ccb_wait(amr, ac);
    867 		amr_ccb_unmap(amr, ac);
    868 		if (rv != 0) {
    869 			aprint_error_dev(amr->amr_dv, "enquiry failed (st=%d)\n",
    870  			    ac->ac_status);
    871 			continue;
    872 		}
    873 		amr_ccb_free(amr, ac);
    874 
    875 		al = amr->amr_drive;
    876 		for (i = 0; i < __arraycount(ae->ae_ldrv.al_state); i++, al++) {
    877 			if (al->al_dv == NULL)
    878 				continue;
    879 			if (al->al_state == ae->ae_ldrv.al_state[i])
    880 				continue;
    881 
    882 			printf("%s: state changed: %s -> %s\n",
    883 			    device_xname(al->al_dv),
    884 			    amr_drive_state(al->al_state, NULL),
    885 			    amr_drive_state(ae->ae_ldrv.al_state[i], NULL));
    886 
    887 			al->al_state = ae->ae_ldrv.al_state[i];
    888 		}
    889 	}
    890 }
    891 
    892 /*
    893  * Return a text description of a logical drive's current state.
    894  */
    895 const char *
    896 amr_drive_state(int state, int *happy)
    897 {
    898 	const char *str;
    899 
    900 	state = AMR_DRV_CURSTATE(state);
    901 	if (state >= sizeof(amr_dstate) / sizeof(amr_dstate[0])) {
    902 		if (happy)
    903 			*happy = 1;
    904 		str = "status unknown";
    905 	} else {
    906 		if (happy)
    907 			*happy = amr_dstate[state].ds_happy;
    908 		str = amr_dstate[state].ds_descr;
    909 	}
    910 
    911 	return (str);
    912 }
    913 
    914 /*
    915  * Run a generic enquiry-style command.
    916  */
    917 static void *
    918 amr_enquire(struct amr_softc *amr, u_int8_t cmd, u_int8_t cmdsub,
    919 	    u_int8_t cmdqual, void *sbuf)
    920 {
    921 	struct amr_ccb *ac;
    922 	u_int8_t *mb;
    923 	int rv;
    924 
    925 	if (amr_ccb_alloc(amr, &ac) != 0)
    926 		return (NULL);
    927 
    928 	/* Build the command proper. */
    929 	mb = (u_int8_t *)&ac->ac_cmd;
    930 	mb[0] = cmd;
    931 	mb[2] = cmdsub;
    932 	mb[3] = cmdqual;
    933 
    934 	rv = amr_ccb_map(amr, ac, sbuf, AMR_ENQUIRY_BUFSIZE, AC_XFER_IN);
    935 	if (rv == 0) {
    936 		rv = amr_ccb_poll(amr, ac, 2000);
    937 		amr_ccb_unmap(amr, ac);
    938 	}
    939 	amr_ccb_free(amr, ac);
    940 
    941 	return (rv ? NULL : sbuf);
    942 }
    943 
    944 /*
    945  * Allocate and initialise a CCB.
    946  */
    947 int
    948 amr_ccb_alloc(struct amr_softc *amr, struct amr_ccb **acp)
    949 {
    950 	int s;
    951 
    952 	s = splbio();
    953 	if ((*acp = SLIST_FIRST(&amr->amr_ccb_freelist)) == NULL) {
    954 		splx(s);
    955 		return (EAGAIN);
    956 	}
    957 	SLIST_REMOVE_HEAD(&amr->amr_ccb_freelist, ac_chain.slist);
    958 	splx(s);
    959 
    960 	return (0);
    961 }
    962 
    963 /*
    964  * Free a CCB.
    965  */
    966 void
    967 amr_ccb_free(struct amr_softc *amr, struct amr_ccb *ac)
    968 {
    969 	int s;
    970 
    971 	memset(&ac->ac_cmd, 0, sizeof(ac->ac_cmd));
    972 	ac->ac_cmd.mb_ident = ac->ac_ident + 1;
    973 	ac->ac_cmd.mb_busy = 1;
    974 	ac->ac_handler = NULL;
    975 	ac->ac_flags = 0;
    976 
    977 	s = splbio();
    978 	SLIST_INSERT_HEAD(&amr->amr_ccb_freelist, ac, ac_chain.slist);
    979 	splx(s);
    980 }
    981 
    982 /*
    983  * If a CCB is specified, enqueue it.  Pull CCBs off the software queue in
    984  * the order that they were enqueued and try to submit their command blocks
    985  * to the controller for execution.
    986  */
    987 void
    988 amr_ccb_enqueue(struct amr_softc *amr, struct amr_ccb *ac)
    989 {
    990 	int s;
    991 
    992 	s = splbio();
    993 
    994 	if (ac != NULL)
    995 		SIMPLEQ_INSERT_TAIL(&amr->amr_ccb_queue, ac, ac_chain.simpleq);
    996 
    997 	while ((ac = SIMPLEQ_FIRST(&amr->amr_ccb_queue)) != NULL) {
    998 		if ((*amr->amr_submit)(amr, ac) != 0)
    999 			break;
   1000 		SIMPLEQ_REMOVE_HEAD(&amr->amr_ccb_queue, ac_chain.simpleq);
   1001 		TAILQ_INSERT_TAIL(&amr->amr_ccb_active, ac, ac_chain.tailq);
   1002 	}
   1003 
   1004 	splx(s);
   1005 }
   1006 
   1007 /*
   1008  * Map the specified CCB's data buffer onto the bus, and fill the
   1009  * scatter-gather list.
   1010  */
   1011 int
   1012 amr_ccb_map(struct amr_softc *amr, struct amr_ccb *ac, void *data, int size,
   1013 	    int tflag)
   1014 {
   1015 	struct amr_sgentry *sge;
   1016 	struct amr_mailbox_cmd *mb;
   1017 	int nsegs, i, rv, sgloff;
   1018 	bus_dmamap_t xfer;
   1019 	int dmaflag = 0;
   1020 
   1021 	xfer = ac->ac_xfer_map;
   1022 
   1023 	rv = bus_dmamap_load(amr->amr_dmat, xfer, data, size, NULL,
   1024 	    BUS_DMA_NOWAIT);
   1025 	if (rv != 0)
   1026 		return (rv);
   1027 
   1028 	mb = &ac->ac_cmd;
   1029 	ac->ac_xfer_size = size;
   1030 	ac->ac_flags |= (tflag & (AC_XFER_OUT | AC_XFER_IN));
   1031 	sgloff = AMR_SGL_SIZE * ac->ac_ident;
   1032 
   1033 	if (tflag & AC_XFER_OUT)
   1034 		dmaflag |= BUS_DMASYNC_PREWRITE;
   1035 	if (tflag & AC_XFER_IN)
   1036 		dmaflag |= BUS_DMASYNC_PREREAD;
   1037 
   1038 	/* We don't need to use a scatter/gather list for just 1 segment. */
   1039 	nsegs = xfer->dm_nsegs;
   1040 	if (nsegs == 1) {
   1041 		mb->mb_nsgelem = 0;
   1042 		mb->mb_physaddr = htole32(xfer->dm_segs[0].ds_addr);
   1043 		ac->ac_flags |= AC_NOSGL;
   1044 	} else {
   1045 		mb->mb_nsgelem = nsegs;
   1046 		mb->mb_physaddr = htole32(amr->amr_sgls_paddr + sgloff);
   1047 
   1048 		sge = (struct amr_sgentry *)((char *)amr->amr_sgls + sgloff);
   1049 		for (i = 0; i < nsegs; i++, sge++) {
   1050 			sge->sge_addr = htole32(xfer->dm_segs[i].ds_addr);
   1051 			sge->sge_count = htole32(xfer->dm_segs[i].ds_len);
   1052 		}
   1053 	}
   1054 
   1055 	bus_dmamap_sync(amr->amr_dmat, xfer, 0, ac->ac_xfer_size, dmaflag);
   1056 
   1057 	if ((ac->ac_flags & AC_NOSGL) == 0)
   1058 		bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, sgloff,
   1059 		    AMR_SGL_SIZE, BUS_DMASYNC_PREWRITE);
   1060 
   1061 	return (0);
   1062 }
   1063 
   1064 /*
   1065  * Unmap the specified CCB's data buffer.
   1066  */
   1067 void
   1068 amr_ccb_unmap(struct amr_softc *amr, struct amr_ccb *ac)
   1069 {
   1070 	int dmaflag = 0;
   1071 
   1072 	if (ac->ac_flags & AC_XFER_IN)
   1073 		dmaflag |= BUS_DMASYNC_POSTREAD;
   1074 	if (ac->ac_flags & AC_XFER_OUT)
   1075 		dmaflag |= BUS_DMASYNC_POSTWRITE;
   1076 
   1077 	if ((ac->ac_flags & AC_NOSGL) == 0)
   1078 		bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap,
   1079 		    AMR_SGL_SIZE * ac->ac_ident, AMR_SGL_SIZE,
   1080 		    BUS_DMASYNC_POSTWRITE);
   1081 	bus_dmamap_sync(amr->amr_dmat, ac->ac_xfer_map, 0, ac->ac_xfer_size,
   1082 	    dmaflag);
   1083 	bus_dmamap_unload(amr->amr_dmat, ac->ac_xfer_map);
   1084 }
   1085 
   1086 /*
   1087  * Submit a command to the controller and poll on completion.  Return
   1088  * non-zero on timeout or error.  Must be called with interrupts blocked.
   1089  */
   1090 int
   1091 amr_ccb_poll(struct amr_softc *amr, struct amr_ccb *ac, int timo)
   1092 {
   1093 	int rv;
   1094 
   1095 	if ((rv = (*amr->amr_submit)(amr, ac)) != 0)
   1096 		return (rv);
   1097 	TAILQ_INSERT_TAIL(&amr->amr_ccb_active, ac, ac_chain.tailq);
   1098 
   1099 	for (timo *= 10; timo != 0; timo--) {
   1100 		amr_intr(amr);
   1101 		if ((ac->ac_flags & AC_COMPLETE) != 0)
   1102 			break;
   1103 		DELAY(100);
   1104 	}
   1105 
   1106 	return (timo == 0 || ac->ac_status != 0 ? EIO : 0);
   1107 }
   1108 
   1109 /*
   1110  * Submit a command to the controller and sleep on completion.  Return
   1111  * non-zero on error.
   1112  */
   1113 int
   1114 amr_ccb_wait(struct amr_softc *amr, struct amr_ccb *ac)
   1115 {
   1116 	int s;
   1117 
   1118 	s = splbio();
   1119 	amr_ccb_enqueue(amr, ac);
   1120 	tsleep(ac, PRIBIO, "amrcmd", 0);
   1121 	splx(s);
   1122 
   1123 	return (ac->ac_status != 0 ? EIO : 0);
   1124 }
   1125 
   1126 #if 0
   1127 /*
   1128  * Wait for the mailbox to become available.
   1129  */
   1130 static int
   1131 amr_mbox_wait(struct amr_softc *amr)
   1132 {
   1133 	int timo;
   1134 
   1135 	for (timo = 10000; timo != 0; timo--) {
   1136 		bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
   1137 		    sizeof(struct amr_mailbox), BUS_DMASYNC_POSTREAD);
   1138 		if (amr->amr_mbox->mb_cmd.mb_busy == 0)
   1139 			break;
   1140 		DELAY(100);
   1141 	}
   1142 
   1143 	if (timo == 0)
   1144 		printf("%s: controller wedged\n", device_xname(amr->amr_dv));
   1145 
   1146 	return (timo != 0 ? 0 : EAGAIN);
   1147 }
   1148 #endif
   1149 
   1150 /*
   1151  * Tell the controller that the mailbox contains a valid command.  Must be
   1152  * called with interrupts blocked.
   1153  */
   1154 static int
   1155 amr_quartz_submit(struct amr_softc *amr, struct amr_ccb *ac)
   1156 {
   1157 	u_int32_t v;
   1158 
   1159 	amr->amr_mbox->mb_poll = 0;
   1160 	amr->amr_mbox->mb_ack = 0;
   1161 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
   1162 	    sizeof(struct amr_mailbox), BUS_DMASYNC_PREWRITE);
   1163 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
   1164 	    sizeof(struct amr_mailbox), BUS_DMASYNC_POSTREAD);
   1165 	if (amr->amr_mbox->mb_cmd.mb_busy != 0)
   1166 		return (EAGAIN);
   1167 
   1168 	v = amr_inl(amr, AMR_QREG_IDB);
   1169 	if ((v & AMR_QIDB_SUBMIT) != 0) {
   1170 		amr->amr_mbox->mb_cmd.mb_busy = 0;
   1171 		bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
   1172 		    sizeof(struct amr_mailbox), BUS_DMASYNC_PREWRITE);
   1173 		bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
   1174 		    sizeof(struct amr_mailbox), BUS_DMASYNC_PREREAD);
   1175 		return (EAGAIN);
   1176 	}
   1177 
   1178 	amr->amr_mbox->mb_segment = 0;
   1179 	memcpy(&amr->amr_mbox->mb_cmd, &ac->ac_cmd, sizeof(ac->ac_cmd));
   1180 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
   1181 	    sizeof(struct amr_mailbox), BUS_DMASYNC_PREWRITE);
   1182 
   1183 	ac->ac_start_time = time_uptime;
   1184 	ac->ac_flags |= AC_ACTIVE;
   1185 	amr_outl(amr, AMR_QREG_IDB,
   1186 	    (amr->amr_mbox_paddr + 16) | AMR_QIDB_SUBMIT);
   1187 	return (0);
   1188 }
   1189 
   1190 static int
   1191 amr_std_submit(struct amr_softc *amr, struct amr_ccb *ac)
   1192 {
   1193 
   1194 	amr->amr_mbox->mb_poll = 0;
   1195 	amr->amr_mbox->mb_ack = 0;
   1196 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
   1197 	    sizeof(struct amr_mailbox), BUS_DMASYNC_PREWRITE);
   1198 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
   1199 	    sizeof(struct amr_mailbox), BUS_DMASYNC_POSTREAD);
   1200 	if (amr->amr_mbox->mb_cmd.mb_busy != 0)
   1201 		return (EAGAIN);
   1202 
   1203 	if ((amr_inb(amr, AMR_SREG_MBOX_BUSY) & AMR_SMBOX_BUSY_FLAG) != 0) {
   1204 		amr->amr_mbox->mb_cmd.mb_busy = 0;
   1205 		bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
   1206 		    sizeof(struct amr_mailbox), BUS_DMASYNC_PREWRITE);
   1207 		bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
   1208 		    sizeof(struct amr_mailbox), BUS_DMASYNC_PREREAD);
   1209 		return (EAGAIN);
   1210 	}
   1211 
   1212 	amr->amr_mbox->mb_segment = 0;
   1213 	memcpy(&amr->amr_mbox->mb_cmd, &ac->ac_cmd, sizeof(ac->ac_cmd));
   1214 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
   1215 	    sizeof(struct amr_mailbox), BUS_DMASYNC_PREWRITE);
   1216 
   1217 	ac->ac_start_time = time_uptime;
   1218 	ac->ac_flags |= AC_ACTIVE;
   1219 	amr_outb(amr, AMR_SREG_CMD, AMR_SCMD_POST);
   1220 	return (0);
   1221 }
   1222 
   1223 /*
   1224  * Claim any work that the controller has completed; acknowledge completion,
   1225  * save details of the completion in (mbsave).  Must be called with
   1226  * interrupts blocked.
   1227  */
   1228 static int
   1229 amr_quartz_get_work(struct amr_softc *amr, struct amr_mailbox_resp *mbsave)
   1230 {
   1231 
   1232 	/* Work waiting for us? */
   1233 	if (amr_inl(amr, AMR_QREG_ODB) != AMR_QODB_READY)
   1234 		return (-1);
   1235 
   1236 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
   1237 	    sizeof(struct amr_mailbox), BUS_DMASYNC_POSTREAD);
   1238 
   1239 	/* Save the mailbox, which contains a list of completed commands. */
   1240 	memcpy(mbsave, &amr->amr_mbox->mb_resp, sizeof(*mbsave));
   1241 
   1242 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
   1243 	    sizeof(struct amr_mailbox), BUS_DMASYNC_PREREAD);
   1244 
   1245 	/* Ack the interrupt and mailbox transfer. */
   1246 	amr_outl(amr, AMR_QREG_ODB, AMR_QODB_READY);
   1247 	amr_outl(amr, AMR_QREG_IDB, (amr->amr_mbox_paddr+16) | AMR_QIDB_ACK);
   1248 
   1249 	/*
   1250 	 * This waits for the controller to notice that we've taken the
   1251 	 * command from it.  It's very inefficient, and we shouldn't do it,
   1252 	 * but if we remove this code, we stop completing commands under
   1253 	 * load.
   1254 	 *
   1255 	 * Peter J says we shouldn't do this.  The documentation says we
   1256 	 * should.  Who is right?
   1257 	 */
   1258 	while ((amr_inl(amr, AMR_QREG_IDB) & AMR_QIDB_ACK) != 0)
   1259 		DELAY(10);
   1260 
   1261 	return (0);
   1262 }
   1263 
   1264 static int
   1265 amr_std_get_work(struct amr_softc *amr, struct amr_mailbox_resp *mbsave)
   1266 {
   1267 	u_int8_t istat;
   1268 
   1269 	/* Check for valid interrupt status. */
   1270 	if (((istat = amr_inb(amr, AMR_SREG_INTR)) & AMR_SINTR_VALID) == 0)
   1271 		return (-1);
   1272 
   1273 	/* Ack the interrupt. */
   1274 	amr_outb(amr, AMR_SREG_INTR, istat);
   1275 
   1276 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
   1277 	    sizeof(struct amr_mailbox), BUS_DMASYNC_POSTREAD);
   1278 
   1279 	/* Save mailbox, which contains a list of completed commands. */
   1280 	memcpy(mbsave, &amr->amr_mbox->mb_resp, sizeof(*mbsave));
   1281 
   1282 	bus_dmamap_sync(amr->amr_dmat, amr->amr_dmamap, 0,
   1283 	    sizeof(struct amr_mailbox), BUS_DMASYNC_PREREAD);
   1284 
   1285 	/* Ack mailbox transfer. */
   1286 	amr_outb(amr, AMR_SREG_CMD, AMR_SCMD_ACKINTR);
   1287 
   1288 	return (0);
   1289 }
   1290 
   1291 static void
   1292 amr_ccb_dump(struct amr_softc *amr, struct amr_ccb *ac)
   1293 {
   1294 	int i;
   1295 
   1296 	printf("%s: ", device_xname(amr->amr_dv));
   1297 	for (i = 0; i < 4; i++)
   1298 		printf("%08x ", ((u_int32_t *)&ac->ac_cmd)[i]);
   1299 	printf("\n");
   1300 }
   1301 
   1302 static int
   1303 amropen(dev_t dev, int flag, int mode, struct lwp *l)
   1304 {
   1305 	struct amr_softc *amr;
   1306 
   1307 	if ((amr = device_lookup_private(&amr_cd, minor(dev))) == NULL)
   1308 		return (ENXIO);
   1309 	if ((amr->amr_flags & AMRF_OPEN) != 0)
   1310 		return (EBUSY);
   1311 
   1312 	amr->amr_flags |= AMRF_OPEN;
   1313 	return (0);
   1314 }
   1315 
   1316 static int
   1317 amrclose(dev_t dev, int flag, int mode, struct lwp *l)
   1318 {
   1319 	struct amr_softc *amr;
   1320 
   1321 	amr = device_lookup_private(&amr_cd, minor(dev));
   1322 	amr->amr_flags &= ~AMRF_OPEN;
   1323 	return (0);
   1324 }
   1325 
   1326 static int
   1327 amrioctl(dev_t dev, u_long cmd, void *data, int flag,
   1328     struct lwp *l)
   1329 {
   1330 	struct amr_softc *amr;
   1331 	struct amr_user_ioctl *au;
   1332 	struct amr_ccb *ac;
   1333 	struct amr_mailbox_ioctl *mbi;
   1334 	unsigned long au_length;
   1335 	uint8_t *au_cmd;
   1336 	int error;
   1337 	void *dp = NULL, *au_buffer;
   1338 
   1339 	amr = device_lookup_private(&amr_cd, minor(dev));
   1340 
   1341 	/* This should be compatible with the FreeBSD interface */
   1342 
   1343 	switch (cmd) {
   1344 	case AMR_IO_VERSION:
   1345 		*(int *)data = AMR_IO_VERSION_NUMBER;
   1346 		return 0;
   1347 	case AMR_IO_COMMAND:
   1348 		error = kauth_authorize_device_passthru(l->l_cred, dev,
   1349 		    KAUTH_REQ_DEVICE_RAWIO_PASSTHRU_ALL, data);
   1350 		if (error)
   1351 			return (error);
   1352 
   1353 		au = (struct amr_user_ioctl *)data;
   1354 		au_cmd = au->au_cmd;
   1355 		au_buffer = au->au_buffer;
   1356 		au_length = au->au_length;
   1357 		break;
   1358 	default:
   1359 		return ENOTTY;
   1360 	}
   1361 
   1362 	if (au_cmd[0] == AMR_CMD_PASS) {
   1363 		/* not yet */
   1364 		return EOPNOTSUPP;
   1365 	}
   1366 
   1367 	if (au_length <= 0 || au_length > MAXPHYS || au_cmd[0] == 0x06)
   1368 		return (EINVAL);
   1369 
   1370 	/*
   1371 	 * allocate kernel memory for data, doing I/O directly to user
   1372 	 * buffer isn't that easy.
   1373 	 */
   1374 	dp = malloc(au_length, M_DEVBUF, M_WAITOK|M_ZERO);
   1375 	if (dp == NULL)
   1376 		return ENOMEM;
   1377 	if ((error = copyin(au_buffer, dp, au_length)) != 0)
   1378 		goto out;
   1379 
   1380 	/* direct command to controller */
   1381 	while (amr_ccb_alloc(amr, &ac) != 0) {
   1382 		error = tsleep(NULL, PRIBIO | PCATCH, "armmbx", hz);
   1383 		if (error == EINTR)
   1384 			goto out;
   1385 	}
   1386 
   1387 	mbi = (struct amr_mailbox_ioctl *)&ac->ac_cmd;
   1388 	mbi->mb_command = au_cmd[0];
   1389 	mbi->mb_channel = au_cmd[1];
   1390 	mbi->mb_param = au_cmd[2];
   1391 	mbi->mb_pad[0] = au_cmd[3];
   1392 	mbi->mb_drive = au_cmd[4];
   1393 	error = amr_ccb_map(amr, ac, dp, (int)au_length,
   1394 	    AC_XFER_IN | AC_XFER_OUT);
   1395 	if (error == 0) {
   1396 		error = amr_ccb_wait(amr, ac);
   1397 		amr_ccb_unmap(amr, ac);
   1398 		if (error == 0)
   1399 			error = copyout(dp, au_buffer, au_length);
   1400 
   1401 	}
   1402 	amr_ccb_free(amr, ac);
   1403 out:
   1404 	free(dp, M_DEVBUF);
   1405 	return (error);
   1406 }
   1407