xref: /freebsd/sys/dev/aac/aac.c (revision 262e143bd46171a6415a5b28af260a5efa2a3db8)
1 /*-
2  * Copyright (c) 2000 Michael Smith
3  * Copyright (c) 2001 Scott Long
4  * Copyright (c) 2000 BSDi
5  * Copyright (c) 2001 Adaptec, Inc.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 
30 #include <sys/cdefs.h>
31 __FBSDID("$FreeBSD$");
32 
33 /*
34  * Driver for the Adaptec 'FSA' family of PCI/SCSI RAID adapters.
35  */
36 #define AAC_DRIVER_VERSION		0x02000000
37 #define AAC_DRIVERNAME			"aac"
38 
39 #include "opt_aac.h"
40 
41 /* #include <stddef.h> */
42 #include <sys/param.h>
43 #include <sys/systm.h>
44 #include <sys/malloc.h>
45 #include <sys/kernel.h>
46 #include <sys/kthread.h>
47 #include <sys/sysctl.h>
48 #include <sys/poll.h>
49 #include <sys/ioccom.h>
50 
51 #include <sys/bus.h>
52 #include <sys/conf.h>
53 #include <sys/signalvar.h>
54 #include <sys/time.h>
55 #include <sys/eventhandler.h>
56 #include <sys/rman.h>
57 
58 #include <machine/bus.h>
59 #include <sys/bus_dma.h>
60 #include <machine/resource.h>
61 
62 #include <dev/pci/pcireg.h>
63 #include <dev/pci/pcivar.h>
64 
65 #include <dev/aac/aacreg.h>
66 #include <sys/aac_ioctl.h>
67 #include <dev/aac/aacvar.h>
68 #include <dev/aac/aac_tables.h>
69 
70 static void	aac_startup(void *arg);
71 static void	aac_add_container(struct aac_softc *sc,
72 				  struct aac_mntinforesp *mir, int f);
73 static void	aac_get_bus_info(struct aac_softc *sc);
74 
75 /* Command Processing */
76 static void	aac_timeout(struct aac_softc *sc);
77 static void	aac_complete(void *context, int pending);
78 static int	aac_bio_command(struct aac_softc *sc, struct aac_command **cmp);
79 static void	aac_bio_complete(struct aac_command *cm);
80 static int	aac_wait_command(struct aac_command *cm);
81 static void	aac_command_thread(struct aac_softc *sc);
82 
83 /* Command Buffer Management */
84 static void	aac_map_command_sg(void *arg, bus_dma_segment_t *segs,
85 				   int nseg, int error);
86 static void	aac_map_command_helper(void *arg, bus_dma_segment_t *segs,
87 				       int nseg, int error);
88 static int	aac_alloc_commands(struct aac_softc *sc);
89 static void	aac_free_commands(struct aac_softc *sc);
90 static void	aac_unmap_command(struct aac_command *cm);
91 
92 /* Hardware Interface */
93 static void	aac_common_map(void *arg, bus_dma_segment_t *segs, int nseg,
94 			       int error);
95 static int	aac_check_firmware(struct aac_softc *sc);
96 static int	aac_init(struct aac_softc *sc);
97 static int	aac_sync_command(struct aac_softc *sc, u_int32_t command,
98 				 u_int32_t arg0, u_int32_t arg1, u_int32_t arg2,
99 				 u_int32_t arg3, u_int32_t *sp);
100 static int	aac_enqueue_fib(struct aac_softc *sc, int queue,
101 				struct aac_command *cm);
102 static int	aac_dequeue_fib(struct aac_softc *sc, int queue,
103 				u_int32_t *fib_size, struct aac_fib **fib_addr);
104 static int	aac_enqueue_response(struct aac_softc *sc, int queue,
105 				     struct aac_fib *fib);
106 
107 /* Falcon/PPC interface */
108 static int	aac_fa_get_fwstatus(struct aac_softc *sc);
109 static void	aac_fa_qnotify(struct aac_softc *sc, int qbit);
110 static int	aac_fa_get_istatus(struct aac_softc *sc);
111 static void	aac_fa_clear_istatus(struct aac_softc *sc, int mask);
112 static void	aac_fa_set_mailbox(struct aac_softc *sc, u_int32_t command,
113 				   u_int32_t arg0, u_int32_t arg1,
114 				   u_int32_t arg2, u_int32_t arg3);
115 static int	aac_fa_get_mailbox(struct aac_softc *sc, int mb);
116 static void	aac_fa_set_interrupts(struct aac_softc *sc, int enable);
117 
118 struct aac_interface aac_fa_interface = {
119 	aac_fa_get_fwstatus,
120 	aac_fa_qnotify,
121 	aac_fa_get_istatus,
122 	aac_fa_clear_istatus,
123 	aac_fa_set_mailbox,
124 	aac_fa_get_mailbox,
125 	aac_fa_set_interrupts,
126 	NULL, NULL, NULL
127 };
128 
129 /* StrongARM interface */
130 static int	aac_sa_get_fwstatus(struct aac_softc *sc);
131 static void	aac_sa_qnotify(struct aac_softc *sc, int qbit);
132 static int	aac_sa_get_istatus(struct aac_softc *sc);
133 static void	aac_sa_clear_istatus(struct aac_softc *sc, int mask);
134 static void	aac_sa_set_mailbox(struct aac_softc *sc, u_int32_t command,
135 				   u_int32_t arg0, u_int32_t arg1,
136 				   u_int32_t arg2, u_int32_t arg3);
137 static int	aac_sa_get_mailbox(struct aac_softc *sc, int mb);
138 static void	aac_sa_set_interrupts(struct aac_softc *sc, int enable);
139 
140 struct aac_interface aac_sa_interface = {
141 	aac_sa_get_fwstatus,
142 	aac_sa_qnotify,
143 	aac_sa_get_istatus,
144 	aac_sa_clear_istatus,
145 	aac_sa_set_mailbox,
146 	aac_sa_get_mailbox,
147 	aac_sa_set_interrupts,
148 	NULL, NULL, NULL
149 };
150 
151 /* i960Rx interface */
152 static int	aac_rx_get_fwstatus(struct aac_softc *sc);
153 static void	aac_rx_qnotify(struct aac_softc *sc, int qbit);
154 static int	aac_rx_get_istatus(struct aac_softc *sc);
155 static void	aac_rx_clear_istatus(struct aac_softc *sc, int mask);
156 static void	aac_rx_set_mailbox(struct aac_softc *sc, u_int32_t command,
157 				   u_int32_t arg0, u_int32_t arg1,
158 				   u_int32_t arg2, u_int32_t arg3);
159 static int	aac_rx_get_mailbox(struct aac_softc *sc, int mb);
160 static void	aac_rx_set_interrupts(struct aac_softc *sc, int enable);
161 static int aac_rx_send_command(struct aac_softc *sc, struct aac_command *cm);
162 static int aac_rx_get_outb_queue(struct aac_softc *sc);
163 static void aac_rx_set_outb_queue(struct aac_softc *sc, int index);
164 
165 struct aac_interface aac_rx_interface = {
166 	aac_rx_get_fwstatus,
167 	aac_rx_qnotify,
168 	aac_rx_get_istatus,
169 	aac_rx_clear_istatus,
170 	aac_rx_set_mailbox,
171 	aac_rx_get_mailbox,
172 	aac_rx_set_interrupts,
173 	aac_rx_send_command,
174 	aac_rx_get_outb_queue,
175 	aac_rx_set_outb_queue
176 };
177 
178 /* Rocket/MIPS interface */
179 static int	aac_rkt_get_fwstatus(struct aac_softc *sc);
180 static void	aac_rkt_qnotify(struct aac_softc *sc, int qbit);
181 static int	aac_rkt_get_istatus(struct aac_softc *sc);
182 static void	aac_rkt_clear_istatus(struct aac_softc *sc, int mask);
183 static void	aac_rkt_set_mailbox(struct aac_softc *sc, u_int32_t command,
184 				    u_int32_t arg0, u_int32_t arg1,
185 				    u_int32_t arg2, u_int32_t arg3);
186 static int	aac_rkt_get_mailbox(struct aac_softc *sc, int mb);
187 static void	aac_rkt_set_interrupts(struct aac_softc *sc, int enable);
188 static int aac_rkt_send_command(struct aac_softc *sc, struct aac_command *cm);
189 static int aac_rkt_get_outb_queue(struct aac_softc *sc);
190 static void aac_rkt_set_outb_queue(struct aac_softc *sc, int index);
191 
192 struct aac_interface aac_rkt_interface = {
193 	aac_rkt_get_fwstatus,
194 	aac_rkt_qnotify,
195 	aac_rkt_get_istatus,
196 	aac_rkt_clear_istatus,
197 	aac_rkt_set_mailbox,
198 	aac_rkt_get_mailbox,
199 	aac_rkt_set_interrupts,
200 	aac_rkt_send_command,
201 	aac_rkt_get_outb_queue,
202 	aac_rkt_set_outb_queue
203 };
204 
205 /* Debugging and Diagnostics */
206 static void	aac_describe_controller(struct aac_softc *sc);
207 static char	*aac_describe_code(struct aac_code_lookup *table,
208 				   u_int32_t code);
209 
210 /* Management Interface */
211 static d_open_t		aac_open;
212 static d_close_t	aac_close;
213 static d_ioctl_t	aac_ioctl;
214 static d_poll_t		aac_poll;
215 static int		aac_ioctl_sendfib(struct aac_softc *sc, caddr_t ufib);
216 static void		aac_handle_aif(struct aac_softc *sc,
217 					   struct aac_fib *fib);
218 static int		aac_rev_check(struct aac_softc *sc, caddr_t udata);
219 static int		aac_getnext_aif(struct aac_softc *sc, caddr_t arg);
220 static int		aac_return_aif(struct aac_softc *sc, caddr_t uptr);
221 static int		aac_query_disk(struct aac_softc *sc, caddr_t uptr);
222 static int		aac_get_pci_info(struct aac_softc *sc, caddr_t uptr);
223 static void		aac_ioctl_event(struct aac_softc *sc,
224 				        struct aac_event *event, void *arg);
225 
226 static struct cdevsw aac_cdevsw = {
227 	.d_version =	D_VERSION,
228 	.d_flags =	D_NEEDGIANT,
229 	.d_open =	aac_open,
230 	.d_close =	aac_close,
231 	.d_ioctl =	aac_ioctl,
232 	.d_poll =	aac_poll,
233 	.d_name =	"aac",
234 };
235 
236 MALLOC_DEFINE(M_AACBUF, "aacbuf", "Buffers for the AAC driver");
237 
238 /* sysctl node */
239 SYSCTL_NODE(_hw, OID_AUTO, aac, CTLFLAG_RD, 0, "AAC driver parameters");
240 
241 /*
242  * Device Interface
243  */
244 
245 /*
246  * Initialise the controller and softc
247  */
248 int
249 aac_attach(struct aac_softc *sc)
250 {
251 	int error, unit;
252 
253 	debug_called(1);
254 
255 	/*
256 	 * Initialise per-controller queues.
257 	 */
258 	aac_initq_free(sc);
259 	aac_initq_ready(sc);
260 	aac_initq_busy(sc);
261 	aac_initq_bio(sc);
262 
263 	/*
264 	 * Initialise command-completion task.
265 	 */
266 	TASK_INIT(&sc->aac_task_complete, 0, aac_complete, sc);
267 
268 	/* mark controller as suspended until we get ourselves organised */
269 	sc->aac_state |= AAC_STATE_SUSPEND;
270 
271 	/*
272 	 * Check that the firmware on the card is supported.
273 	 */
274 	if ((error = aac_check_firmware(sc)) != 0)
275 		return(error);
276 
277 	/*
278 	 * Initialize locks
279 	 */
280 	mtx_init(&sc->aac_aifq_lock, "AAC AIF lock", NULL, MTX_DEF);
281 	mtx_init(&sc->aac_io_lock, "AAC I/O lock", NULL, MTX_DEF);
282 	mtx_init(&sc->aac_container_lock, "AAC container lock", NULL, MTX_DEF);
283 	TAILQ_INIT(&sc->aac_container_tqh);
284 
285 	/* Initialize the local AIF queue pointers */
286 	sc->aac_aifq_head = sc->aac_aifq_tail = AAC_AIFQ_LENGTH;
287 
288 	/*
289 	 * Initialise the adapter.
290 	 */
291 	if ((error = aac_init(sc)) != 0)
292 		return(error);
293 
294 	/*
295 	 * Allocate and connect our interrupt.
296 	 */
297 	sc->aac_irq_rid = 0;
298 	if ((sc->aac_irq = bus_alloc_resource_any(sc->aac_dev, SYS_RES_IRQ,
299 			   			  &sc->aac_irq_rid,
300 			   			  RF_SHAREABLE |
301 						  RF_ACTIVE)) == NULL) {
302 		device_printf(sc->aac_dev, "can't allocate interrupt\n");
303 		return (EINVAL);
304 	}
305 	if (sc->flags & AAC_FLAGS_NEW_COMM) {
306 		if (bus_setup_intr(sc->aac_dev, sc->aac_irq,
307 				   INTR_MPSAFE|INTR_TYPE_BIO, aac_new_intr,
308 				   sc, &sc->aac_intr)) {
309 			device_printf(sc->aac_dev, "can't set up interrupt\n");
310 			return (EINVAL);
311 		}
312 	} else {
313 		if (bus_setup_intr(sc->aac_dev, sc->aac_irq,
314 				   INTR_FAST|INTR_TYPE_BIO, aac_fast_intr,
315 				   sc, &sc->aac_intr)) {
316 			device_printf(sc->aac_dev,
317 				      "can't set up FAST interrupt\n");
318 			if (bus_setup_intr(sc->aac_dev, sc->aac_irq,
319 					   INTR_MPSAFE|INTR_TYPE_BIO,
320 					   aac_fast_intr, sc, &sc->aac_intr)) {
321 				device_printf(sc->aac_dev,
322 					     "can't set up MPSAFE interrupt\n");
323 				return (EINVAL);
324 			}
325 		}
326 	}
327 
328 	/*
329 	 * Print a little information about the controller.
330 	 */
331 	aac_describe_controller(sc);
332 
333 	/*
334 	 * Register to probe our containers later.
335 	 */
336 	sc->aac_ich.ich_func = aac_startup;
337 	sc->aac_ich.ich_arg = sc;
338 	if (config_intrhook_establish(&sc->aac_ich) != 0) {
339 		device_printf(sc->aac_dev,
340 			      "can't establish configuration hook\n");
341 		return(ENXIO);
342 	}
343 
344 	/*
345 	 * Make the control device.
346 	 */
347 	unit = device_get_unit(sc->aac_dev);
348 	sc->aac_dev_t = make_dev(&aac_cdevsw, unit, UID_ROOT, GID_OPERATOR,
349 				 0640, "aac%d", unit);
350 	(void)make_dev_alias(sc->aac_dev_t, "afa%d", unit);
351 	(void)make_dev_alias(sc->aac_dev_t, "hpn%d", unit);
352 	sc->aac_dev_t->si_drv1 = sc;
353 
354 	/* Create the AIF thread */
355 	if (kthread_create((void(*)(void *))aac_command_thread, sc,
356 		   &sc->aifthread, 0, 0, "aac%daif", unit))
357 		panic("Could not create AIF thread\n");
358 
359 	/* Register the shutdown method to only be called post-dump */
360 	if ((sc->eh = EVENTHANDLER_REGISTER(shutdown_final, aac_shutdown,
361 	    sc->aac_dev, SHUTDOWN_PRI_DEFAULT)) == NULL)
362 		device_printf(sc->aac_dev,
363 			      "shutdown event registration failed\n");
364 
365 	/* Register with CAM for the non-DASD devices */
366 	if ((sc->flags & AAC_FLAGS_ENABLE_CAM) != 0) {
367 		TAILQ_INIT(&sc->aac_sim_tqh);
368 		aac_get_bus_info(sc);
369 	}
370 
371 	return(0);
372 }
373 
374 void
375 aac_add_event(struct aac_softc *sc, struct aac_event *event)
376 {
377 
378 	switch (event->ev_type & AAC_EVENT_MASK) {
379 	case AAC_EVENT_CMFREE:
380 		TAILQ_INSERT_TAIL(&sc->aac_ev_cmfree, event, ev_links);
381 		break;
382 	default:
383 		device_printf(sc->aac_dev, "aac_add event: unknown event %d\n",
384 		    event->ev_type);
385 		break;
386 	}
387 
388 	return;
389 }
390 
391 /*
392  * Probe for containers, create disks.
393  */
394 static void
395 aac_startup(void *arg)
396 {
397 	struct aac_softc *sc;
398 	struct aac_fib *fib;
399 	struct aac_mntinfo *mi;
400 	struct aac_mntinforesp *mir = NULL;
401 	int count = 0, i = 0;
402 
403 	debug_called(1);
404 
405 	sc = (struct aac_softc *)arg;
406 
407 	/* disconnect ourselves from the intrhook chain */
408 	config_intrhook_disestablish(&sc->aac_ich);
409 
410 	mtx_lock(&sc->aac_io_lock);
411 	aac_alloc_sync_fib(sc, &fib);
412 	mi = (struct aac_mntinfo *)&fib->data[0];
413 
414 	/* loop over possible containers */
415 	do {
416 		/* request information on this container */
417 		bzero(mi, sizeof(struct aac_mntinfo));
418 		mi->Command = VM_NameServe;
419 		mi->MntType = FT_FILESYS;
420 		mi->MntCount = i;
421 		if (aac_sync_fib(sc, ContainerCommand, 0, fib,
422 				 sizeof(struct aac_mntinfo))) {
423 			printf("error probing container %d", i);
424 			continue;
425 		}
426 
427 		mir = (struct aac_mntinforesp *)&fib->data[0];
428 		/* XXX Need to check if count changed */
429 		count = mir->MntRespCount;
430 		aac_add_container(sc, mir, 0);
431 		i++;
432 	} while ((i < count) && (i < AAC_MAX_CONTAINERS));
433 
434 	aac_release_sync_fib(sc);
435 	mtx_unlock(&sc->aac_io_lock);
436 
437 	/* poke the bus to actually attach the child devices */
438 	if (bus_generic_attach(sc->aac_dev))
439 		device_printf(sc->aac_dev, "bus_generic_attach failed\n");
440 
441 	/* mark the controller up */
442 	sc->aac_state &= ~AAC_STATE_SUSPEND;
443 
444 	/* enable interrupts now */
445 	AAC_UNMASK_INTERRUPTS(sc);
446 }
447 
448 /*
449  * Create a device to respresent a new container
450  */
451 static void
452 aac_add_container(struct aac_softc *sc, struct aac_mntinforesp *mir, int f)
453 {
454 	struct aac_container *co;
455 	device_t child;
456 
457 	/*
458 	 * Check container volume type for validity.  Note that many of
459 	 * the possible types may never show up.
460 	 */
461 	if ((mir->Status == ST_OK) && (mir->MntTable[0].VolType != CT_NONE)) {
462 		co = (struct aac_container *)malloc(sizeof *co, M_AACBUF,
463 		       M_NOWAIT | M_ZERO);
464 		if (co == NULL)
465 			panic("Out of memory?!\n");
466 		debug(1, "id %x  name '%.16s'  size %u  type %d",
467 		      mir->MntTable[0].ObjectId,
468 		      mir->MntTable[0].FileSystemName,
469 		      mir->MntTable[0].Capacity, mir->MntTable[0].VolType);
470 
471 		if ((child = device_add_child(sc->aac_dev, "aacd", -1)) == NULL)
472 			device_printf(sc->aac_dev, "device_add_child failed\n");
473 		else
474 			device_set_ivars(child, co);
475 		device_set_desc(child, aac_describe_code(aac_container_types,
476 				mir->MntTable[0].VolType));
477 		co->co_disk = child;
478 		co->co_found = f;
479 		bcopy(&mir->MntTable[0], &co->co_mntobj,
480 		      sizeof(struct aac_mntobj));
481 		mtx_lock(&sc->aac_container_lock);
482 		TAILQ_INSERT_TAIL(&sc->aac_container_tqh, co, co_link);
483 		mtx_unlock(&sc->aac_container_lock);
484 	}
485 }
486 
487 /*
488  * Free all of the resources associated with (sc)
489  *
490  * Should not be called if the controller is active.
491  */
492 void
493 aac_free(struct aac_softc *sc)
494 {
495 
496 	debug_called(1);
497 
498 	/* remove the control device */
499 	if (sc->aac_dev_t != NULL)
500 		destroy_dev(sc->aac_dev_t);
501 
502 	/* throw away any FIB buffers, discard the FIB DMA tag */
503 	aac_free_commands(sc);
504 	if (sc->aac_fib_dmat)
505 		bus_dma_tag_destroy(sc->aac_fib_dmat);
506 
507 	free(sc->aac_commands, M_AACBUF);
508 
509 	/* destroy the common area */
510 	if (sc->aac_common) {
511 		bus_dmamap_unload(sc->aac_common_dmat, sc->aac_common_dmamap);
512 		bus_dmamem_free(sc->aac_common_dmat, sc->aac_common,
513 				sc->aac_common_dmamap);
514 	}
515 	if (sc->aac_common_dmat)
516 		bus_dma_tag_destroy(sc->aac_common_dmat);
517 
518 	/* disconnect the interrupt handler */
519 	if (sc->aac_intr)
520 		bus_teardown_intr(sc->aac_dev, sc->aac_irq, sc->aac_intr);
521 	if (sc->aac_irq != NULL)
522 		bus_release_resource(sc->aac_dev, SYS_RES_IRQ, sc->aac_irq_rid,
523 				     sc->aac_irq);
524 
525 	/* destroy data-transfer DMA tag */
526 	if (sc->aac_buffer_dmat)
527 		bus_dma_tag_destroy(sc->aac_buffer_dmat);
528 
529 	/* destroy the parent DMA tag */
530 	if (sc->aac_parent_dmat)
531 		bus_dma_tag_destroy(sc->aac_parent_dmat);
532 
533 	/* release the register window mapping */
534 	if (sc->aac_regs_resource != NULL)
535 		bus_release_resource(sc->aac_dev, SYS_RES_MEMORY,
536 				     sc->aac_regs_rid, sc->aac_regs_resource);
537 }
538 
539 /*
540  * Disconnect from the controller completely, in preparation for unload.
541  */
542 int
543 aac_detach(device_t dev)
544 {
545 	struct aac_softc *sc;
546 	struct aac_container *co;
547 	struct aac_sim	*sim;
548 	int error;
549 
550 	debug_called(1);
551 
552 	sc = device_get_softc(dev);
553 
554 	if (sc->aac_state & AAC_STATE_OPEN)
555 		return(EBUSY);
556 
557 	/* Remove the child containers */
558 	while ((co = TAILQ_FIRST(&sc->aac_container_tqh)) != NULL) {
559 		error = device_delete_child(dev, co->co_disk);
560 		if (error)
561 			return (error);
562 		TAILQ_REMOVE(&sc->aac_container_tqh, co, co_link);
563 		free(co, M_AACBUF);
564 	}
565 
566 	/* Remove the CAM SIMs */
567 	while ((sim = TAILQ_FIRST(&sc->aac_sim_tqh)) != NULL) {
568 		TAILQ_REMOVE(&sc->aac_sim_tqh, sim, sim_link);
569 		error = device_delete_child(dev, sim->sim_dev);
570 		if (error)
571 			return (error);
572 		free(sim, M_AACBUF);
573 	}
574 
575 	if (sc->aifflags & AAC_AIFFLAGS_RUNNING) {
576 		sc->aifflags |= AAC_AIFFLAGS_EXIT;
577 		wakeup(sc->aifthread);
578 		tsleep(sc->aac_dev, PUSER | PCATCH, "aacdch", 30 * hz);
579 	}
580 
581 	if (sc->aifflags & AAC_AIFFLAGS_RUNNING)
582 		panic("Cannot shutdown AIF thread\n");
583 
584 	if ((error = aac_shutdown(dev)))
585 		return(error);
586 
587 	EVENTHANDLER_DEREGISTER(shutdown_final, sc->eh);
588 
589 	aac_free(sc);
590 
591 	mtx_destroy(&sc->aac_aifq_lock);
592 	mtx_destroy(&sc->aac_io_lock);
593 	mtx_destroy(&sc->aac_container_lock);
594 
595 	return(0);
596 }
597 
598 /*
599  * Bring the controller down to a dormant state and detach all child devices.
600  *
601  * This function is called before detach or system shutdown.
602  *
603  * Note that we can assume that the bioq on the controller is empty, as we won't
604  * allow shutdown if any device is open.
605  */
606 int
607 aac_shutdown(device_t dev)
608 {
609 	struct aac_softc *sc;
610 	struct aac_fib *fib;
611 	struct aac_close_command *cc;
612 
613 	debug_called(1);
614 
615 	sc = device_get_softc(dev);
616 
617 	sc->aac_state |= AAC_STATE_SUSPEND;
618 
619 	/*
620 	 * Send a Container shutdown followed by a HostShutdown FIB to the
621 	 * controller to convince it that we don't want to talk to it anymore.
622 	 * We've been closed and all I/O completed already
623 	 */
624 	device_printf(sc->aac_dev, "shutting down controller...");
625 
626 	mtx_lock(&sc->aac_io_lock);
627 	aac_alloc_sync_fib(sc, &fib);
628 	cc = (struct aac_close_command *)&fib->data[0];
629 
630 	bzero(cc, sizeof(struct aac_close_command));
631 	cc->Command = VM_CloseAll;
632 	cc->ContainerId = 0xffffffff;
633 	if (aac_sync_fib(sc, ContainerCommand, 0, fib,
634 	    sizeof(struct aac_close_command)))
635 		printf("FAILED.\n");
636 	else
637 		printf("done\n");
638 #if 0
639 	else {
640 		fib->data[0] = 0;
641 		/*
642 		 * XXX Issuing this command to the controller makes it shut down
643 		 * but also keeps it from coming back up without a reset of the
644 		 * PCI bus.  This is not desirable if you are just unloading the
645 		 * driver module with the intent to reload it later.
646 		 */
647 		if (aac_sync_fib(sc, FsaHostShutdown, AAC_FIBSTATE_SHUTDOWN,
648 		    fib, 1)) {
649 			printf("FAILED.\n");
650 		} else {
651 			printf("done.\n");
652 		}
653 	}
654 #endif
655 
656 	AAC_MASK_INTERRUPTS(sc);
657 	aac_release_sync_fib(sc);
658 	mtx_unlock(&sc->aac_io_lock);
659 
660 	return(0);
661 }
662 
663 /*
664  * Bring the controller to a quiescent state, ready for system suspend.
665  */
666 int
667 aac_suspend(device_t dev)
668 {
669 	struct aac_softc *sc;
670 
671 	debug_called(1);
672 
673 	sc = device_get_softc(dev);
674 
675 	sc->aac_state |= AAC_STATE_SUSPEND;
676 
677 	AAC_MASK_INTERRUPTS(sc);
678 	return(0);
679 }
680 
681 /*
682  * Bring the controller back to a state ready for operation.
683  */
684 int
685 aac_resume(device_t dev)
686 {
687 	struct aac_softc *sc;
688 
689 	debug_called(1);
690 
691 	sc = device_get_softc(dev);
692 
693 	sc->aac_state &= ~AAC_STATE_SUSPEND;
694 	AAC_UNMASK_INTERRUPTS(sc);
695 	return(0);
696 }
697 
698 /*
699  * Interrupt handler for NEW_COMM interface.
700  */
701 void
702 aac_new_intr(void *arg)
703 {
704 	struct aac_softc *sc;
705 	u_int32_t index, fast;
706 	struct aac_command *cm;
707 	struct aac_fib *fib;
708 	int i;
709 
710 	debug_called(2);
711 
712 	sc = (struct aac_softc *)arg;
713 
714 	mtx_lock(&sc->aac_io_lock);
715 	while (1) {
716 		index = AAC_GET_OUTB_QUEUE(sc);
717 		if (index == 0xffffffff)
718 			index = AAC_GET_OUTB_QUEUE(sc);
719 		if (index == 0xffffffff)
720 			break;
721 		if (index & 2) {
722 			if (index == 0xfffffffe) {
723 				/* XXX This means that the controller wants
724 				 * more work.  Ignore it for now.
725 				 */
726 				continue;
727 			}
728 			/* AIF */
729 			fib = (struct aac_fib *)malloc(sizeof *fib, M_AACBUF,
730 				   M_NOWAIT | M_ZERO);
731 			if (fib == NULL) {
732 				/* If we're really this short on memory,
733 				 * hopefully breaking out of the handler will
734 				 * allow something to get freed.  This
735 				 * actually sucks a whole lot.
736 				 */
737 				break;
738 			}
739 			index &= ~2;
740 			for (i = 0; i < sizeof(struct aac_fib)/4; ++i)
741 				((u_int32_t *)fib)[i] = AAC_GETREG4(sc, index + i*4);
742 			aac_handle_aif(sc, fib);
743 			free(fib, M_AACBUF);
744 
745 			/*
746 			 * AIF memory is owned by the adapter, so let it
747 			 * know that we are done with it.
748 			 */
749 			AAC_SET_OUTB_QUEUE(sc, index);
750 			AAC_CLEAR_ISTATUS(sc, AAC_DB_RESPONSE_READY);
751 		} else {
752 			fast = index & 1;
753 			cm = sc->aac_commands + (index >> 2);
754 			fib = cm->cm_fib;
755 			if (fast) {
756 				fib->Header.XferState |= AAC_FIBSTATE_DONEADAP;
757 				*((u_int32_t *)(fib->data)) = AAC_ERROR_NORMAL;
758 			}
759 			aac_remove_busy(cm);
760  			aac_unmap_command(cm);
761 			cm->cm_flags |= AAC_CMD_COMPLETED;
762 
763 			/* is there a completion handler? */
764 			if (cm->cm_complete != NULL) {
765 				cm->cm_complete(cm);
766 			} else {
767 				/* assume that someone is sleeping on this
768 				 * command
769 				 */
770 				wakeup(cm);
771 			}
772 			sc->flags &= ~AAC_QUEUE_FRZN;
773 		}
774 	}
775 	/* see if we can start some more I/O */
776 	if ((sc->flags & AAC_QUEUE_FRZN) == 0)
777 		aac_startio(sc);
778 
779 	mtx_unlock(&sc->aac_io_lock);
780 }
781 
782 void
783 aac_fast_intr(void *arg)
784 {
785 	struct aac_softc *sc;
786 	u_int16_t reason;
787 
788 	debug_called(2);
789 
790 	sc = (struct aac_softc *)arg;
791 
792 	/*
793 	 * Read the status register directly.  This is faster than taking the
794 	 * driver lock and reading the queues directly.  It also saves having
795 	 * to turn parts of the driver lock into a spin mutex, which would be
796 	 * ugly.
797 	 */
798 	reason = AAC_GET_ISTATUS(sc);
799 	AAC_CLEAR_ISTATUS(sc, reason);
800 
801 	/* handle completion processing */
802 	if (reason & AAC_DB_RESPONSE_READY)
803 		taskqueue_enqueue_fast(taskqueue_fast, &sc->aac_task_complete);
804 
805 	/* controller wants to talk to us */
806 	if (reason & (AAC_DB_PRINTF | AAC_DB_COMMAND_READY)) {
807 		/*
808 		 * XXX Make sure that we don't get fooled by strange messages
809 		 * that start with a NULL.
810 		 */
811 		if ((reason & AAC_DB_PRINTF) &&
812 			(sc->aac_common->ac_printf[0] == 0))
813 			sc->aac_common->ac_printf[0] = 32;
814 
815 		/*
816 		 * This might miss doing the actual wakeup.  However, the
817 		 * msleep that this is waking up has a timeout, so it will
818 		 * wake up eventually.  AIFs and printfs are low enough
819 		 * priority that they can handle hanging out for a few seconds
820 		 * if needed.
821 		 */
822 		wakeup(sc->aifthread);
823 	}
824 }
825 
826 /*
827  * Command Processing
828  */
829 
830 /*
831  * Start as much queued I/O as possible on the controller
832  */
833 void
834 aac_startio(struct aac_softc *sc)
835 {
836 	struct aac_command *cm;
837 	int error;
838 
839 	debug_called(2);
840 
841 	for (;;) {
842 		/*
843 		 * This flag might be set if the card is out of resources.
844 		 * Checking it here prevents an infinite loop of deferrals.
845 		 */
846 		if (sc->flags & AAC_QUEUE_FRZN)
847 			break;
848 
849 		/*
850 		 * Try to get a command that's been put off for lack of
851 		 * resources
852 		 */
853 		cm = aac_dequeue_ready(sc);
854 
855 		/*
856 		 * Try to build a command off the bio queue (ignore error
857 		 * return)
858 		 */
859 		if (cm == NULL)
860 			aac_bio_command(sc, &cm);
861 
862 		/* nothing to do? */
863 		if (cm == NULL)
864 			break;
865 
866 		/* don't map more than once */
867 		if (cm->cm_flags & AAC_CMD_MAPPED)
868 			panic("aac: command %p already mapped", cm);
869 
870 		/*
871 		 * Set up the command to go to the controller.  If there are no
872 		 * data buffers associated with the command then it can bypass
873 		 * busdma.
874 		 */
875 		if (cm->cm_datalen != 0) {
876 			error = bus_dmamap_load(sc->aac_buffer_dmat,
877 						cm->cm_datamap, cm->cm_data,
878 						cm->cm_datalen,
879 						aac_map_command_sg, cm, 0);
880 			if (error == EINPROGRESS) {
881 				debug(1, "freezing queue\n");
882 				sc->flags |= AAC_QUEUE_FRZN;
883 				error = 0;
884 			} else if (error != 0)
885 				panic("aac_startio: unexpected error %d from "
886 				      "busdma\n", error);
887 		} else
888 			aac_map_command_sg(cm, NULL, 0, 0);
889 	}
890 }
891 
892 /*
893  * Handle notification of one or more FIBs coming from the controller.
894  */
895 static void
896 aac_command_thread(struct aac_softc *sc)
897 {
898 	struct aac_fib *fib;
899 	u_int32_t fib_size;
900 	int size, retval;
901 
902 	debug_called(2);
903 
904 	mtx_lock(&sc->aac_io_lock);
905 	sc->aifflags = AAC_AIFFLAGS_RUNNING;
906 
907 	while ((sc->aifflags & AAC_AIFFLAGS_EXIT) == 0) {
908 
909 		retval = 0;
910 		if ((sc->aifflags & AAC_AIFFLAGS_PENDING) == 0)
911 			retval = msleep(sc->aifthread, &sc->aac_io_lock, PRIBIO,
912 					"aifthd", AAC_PERIODIC_INTERVAL * hz);
913 
914 		/*
915 		 * First see if any FIBs need to be allocated.  This needs
916 		 * to be called without the driver lock because contigmalloc
917 		 * will grab Giant, and would result in an LOR.
918 		 */
919 		if ((sc->aifflags & AAC_AIFFLAGS_ALLOCFIBS) != 0) {
920 			mtx_unlock(&sc->aac_io_lock);
921 			aac_alloc_commands(sc);
922 			mtx_lock(&sc->aac_io_lock);
923 			sc->aifflags &= ~AAC_AIFFLAGS_ALLOCFIBS;
924 			aac_startio(sc);
925 		}
926 
927 		/*
928 		 * While we're here, check to see if any commands are stuck.
929 		 * This is pretty low-priority, so it's ok if it doesn't
930 		 * always fire.
931 		 */
932 		if (retval == EWOULDBLOCK)
933 			aac_timeout(sc);
934 
935 		/* Check the hardware printf message buffer */
936 		if (sc->aac_common->ac_printf[0] != 0)
937 			aac_print_printf(sc);
938 
939 		/* Also check to see if the adapter has a command for us. */
940 		if (sc->flags & AAC_FLAGS_NEW_COMM)
941 			continue;
942 		for (;;) {
943 			if (aac_dequeue_fib(sc, AAC_HOST_NORM_CMD_QUEUE,
944 					   &fib_size, &fib))
945 				break;
946 
947 			AAC_PRINT_FIB(sc, fib);
948 
949 			switch (fib->Header.Command) {
950 			case AifRequest:
951 				aac_handle_aif(sc, fib);
952 				break;
953 			default:
954 				device_printf(sc->aac_dev, "unknown command "
955 					      "from controller\n");
956 				break;
957 			}
958 
959 			if ((fib->Header.XferState == 0) ||
960 			    (fib->Header.StructType != AAC_FIBTYPE_TFIB)) {
961 				break;
962 			}
963 
964 			/* Return the AIF to the controller. */
965 			if (fib->Header.XferState & AAC_FIBSTATE_FROMADAP) {
966 				fib->Header.XferState |= AAC_FIBSTATE_DONEHOST;
967 				*(AAC_FSAStatus*)fib->data = ST_OK;
968 
969 				/* XXX Compute the Size field? */
970 				size = fib->Header.Size;
971 				if (size > sizeof(struct aac_fib)) {
972 					size = sizeof(struct aac_fib);
973 					fib->Header.Size = size;
974 				}
975 				/*
976 				 * Since we did not generate this command, it
977 				 * cannot go through the normal
978 				 * enqueue->startio chain.
979 				 */
980 				aac_enqueue_response(sc,
981 						 AAC_ADAP_NORM_RESP_QUEUE,
982 						 fib);
983 			}
984 		}
985 	}
986 	sc->aifflags &= ~AAC_AIFFLAGS_RUNNING;
987 	mtx_unlock(&sc->aac_io_lock);
988 	wakeup(sc->aac_dev);
989 
990 	kthread_exit(0);
991 }
992 
993 /*
994  * Process completed commands.
995  */
996 static void
997 aac_complete(void *context, int pending)
998 {
999 	struct aac_softc *sc;
1000 	struct aac_command *cm;
1001 	struct aac_fib *fib;
1002 	u_int32_t fib_size;
1003 
1004 	debug_called(2);
1005 
1006 	sc = (struct aac_softc *)context;
1007 
1008 	mtx_lock(&sc->aac_io_lock);
1009 
1010 	/* pull completed commands off the queue */
1011 	for (;;) {
1012 		/* look for completed FIBs on our queue */
1013 		if (aac_dequeue_fib(sc, AAC_HOST_NORM_RESP_QUEUE, &fib_size,
1014 							&fib))
1015 			break;	/* nothing to do */
1016 
1017 		/* get the command, unmap and hand off for processing */
1018 		cm = sc->aac_commands + fib->Header.SenderData;
1019 		if (cm == NULL) {
1020 			AAC_PRINT_FIB(sc, fib);
1021 			break;
1022 		}
1023 		aac_remove_busy(cm);
1024 
1025  		aac_unmap_command(cm);
1026 		cm->cm_flags |= AAC_CMD_COMPLETED;
1027 
1028 		/* is there a completion handler? */
1029 		if (cm->cm_complete != NULL) {
1030 			cm->cm_complete(cm);
1031 		} else {
1032 			/* assume that someone is sleeping on this command */
1033 			wakeup(cm);
1034 		}
1035 	}
1036 
1037 	/* see if we can start some more I/O */
1038 	sc->flags &= ~AAC_QUEUE_FRZN;
1039 	aac_startio(sc);
1040 
1041 	mtx_unlock(&sc->aac_io_lock);
1042 }
1043 
1044 /*
1045  * Handle a bio submitted from a disk device.
1046  */
1047 void
1048 aac_submit_bio(struct bio *bp)
1049 {
1050 	struct aac_disk *ad;
1051 	struct aac_softc *sc;
1052 
1053 	debug_called(2);
1054 
1055 	ad = (struct aac_disk *)bp->bio_disk->d_drv1;
1056 	sc = ad->ad_controller;
1057 
1058 	/* queue the BIO and try to get some work done */
1059 	aac_enqueue_bio(sc, bp);
1060 	aac_startio(sc);
1061 }
1062 
1063 /*
1064  * Get a bio and build a command to go with it.
1065  */
1066 static int
1067 aac_bio_command(struct aac_softc *sc, struct aac_command **cmp)
1068 {
1069 	struct aac_command *cm;
1070 	struct aac_fib *fib;
1071 	struct aac_disk *ad;
1072 	struct bio *bp;
1073 
1074 	debug_called(2);
1075 
1076 	/* get the resources we will need */
1077 	cm = NULL;
1078 	bp = NULL;
1079 	if (aac_alloc_command(sc, &cm))	/* get a command */
1080 		goto fail;
1081 	if ((bp = aac_dequeue_bio(sc)) == NULL)
1082 		goto fail;
1083 
1084 	/* fill out the command */
1085 	cm->cm_data = (void *)bp->bio_data;
1086 	cm->cm_datalen = bp->bio_bcount;
1087 	cm->cm_complete = aac_bio_complete;
1088 	cm->cm_private = bp;
1089 	cm->cm_timestamp = time_uptime;
1090 	cm->cm_queue = AAC_ADAP_NORM_CMD_QUEUE;
1091 
1092 	/* build the FIB */
1093 	fib = cm->cm_fib;
1094 	fib->Header.Size = sizeof(struct aac_fib_header);
1095 	fib->Header.XferState =
1096 		AAC_FIBSTATE_HOSTOWNED   |
1097 		AAC_FIBSTATE_INITIALISED |
1098 		AAC_FIBSTATE_EMPTY	 |
1099 		AAC_FIBSTATE_FROMHOST	 |
1100 		AAC_FIBSTATE_REXPECTED   |
1101 		AAC_FIBSTATE_NORM	 |
1102 		AAC_FIBSTATE_ASYNC	 |
1103 		AAC_FIBSTATE_FAST_RESPONSE;
1104 
1105 	/* build the read/write request */
1106 	ad = (struct aac_disk *)bp->bio_disk->d_drv1;
1107 
1108 	if (sc->flags & AAC_FLAGS_RAW_IO) {
1109 		struct aac_raw_io *raw;
1110 		raw = (struct aac_raw_io *)&fib->data[0];
1111 		fib->Header.Command = RawIo;
1112 		raw->BlockNumber = (u_int64_t)bp->bio_pblkno;
1113 		raw->ByteCount = bp->bio_bcount;
1114 		raw->ContainerId = ad->ad_container->co_mntobj.ObjectId;
1115 		raw->BpTotal = 0;
1116 		raw->BpComplete = 0;
1117 		fib->Header.Size += sizeof(struct aac_raw_io);
1118 		cm->cm_sgtable = (struct aac_sg_table *)&raw->SgMapRaw;
1119 		if (bp->bio_cmd == BIO_READ) {
1120 			raw->Flags = 1;
1121 			cm->cm_flags |= AAC_CMD_DATAIN;
1122 		} else {
1123 			raw->Flags = 0;
1124 			cm->cm_flags |= AAC_CMD_DATAOUT;
1125 		}
1126 	} else if ((sc->flags & AAC_FLAGS_SG_64BIT) == 0) {
1127 		fib->Header.Command = ContainerCommand;
1128 		if (bp->bio_cmd == BIO_READ) {
1129 			struct aac_blockread *br;
1130 			br = (struct aac_blockread *)&fib->data[0];
1131 			br->Command = VM_CtBlockRead;
1132 			br->ContainerId = ad->ad_container->co_mntobj.ObjectId;
1133 			br->BlockNumber = bp->bio_pblkno;
1134 			br->ByteCount = bp->bio_bcount;
1135 			fib->Header.Size += sizeof(struct aac_blockread);
1136 			cm->cm_sgtable = &br->SgMap;
1137 			cm->cm_flags |= AAC_CMD_DATAIN;
1138 		} else {
1139 			struct aac_blockwrite *bw;
1140 			bw = (struct aac_blockwrite *)&fib->data[0];
1141 			bw->Command = VM_CtBlockWrite;
1142 			bw->ContainerId = ad->ad_container->co_mntobj.ObjectId;
1143 			bw->BlockNumber = bp->bio_pblkno;
1144 			bw->ByteCount = bp->bio_bcount;
1145 			bw->Stable = CUNSTABLE;
1146 			fib->Header.Size += sizeof(struct aac_blockwrite);
1147 			cm->cm_flags |= AAC_CMD_DATAOUT;
1148 			cm->cm_sgtable = &bw->SgMap;
1149 		}
1150 	} else {
1151 		fib->Header.Command = ContainerCommand64;
1152 		if (bp->bio_cmd == BIO_READ) {
1153 			struct aac_blockread64 *br;
1154 			br = (struct aac_blockread64 *)&fib->data[0];
1155 			br->Command = VM_CtHostRead64;
1156 			br->ContainerId = ad->ad_container->co_mntobj.ObjectId;
1157 			br->SectorCount = bp->bio_bcount / AAC_BLOCK_SIZE;
1158 			br->BlockNumber = bp->bio_pblkno;
1159 			br->Pad = 0;
1160 			br->Flags = 0;
1161 			fib->Header.Size += sizeof(struct aac_blockread64);
1162 			cm->cm_flags |= AAC_CMD_DATAOUT;
1163 			cm->cm_sgtable = (struct aac_sg_table *)&br->SgMap64;
1164 		} else {
1165 			struct aac_blockwrite64 *bw;
1166 			bw = (struct aac_blockwrite64 *)&fib->data[0];
1167 			bw->Command = VM_CtHostWrite64;
1168 			bw->ContainerId = ad->ad_container->co_mntobj.ObjectId;
1169 			bw->SectorCount = bp->bio_bcount / AAC_BLOCK_SIZE;
1170 			bw->BlockNumber = bp->bio_pblkno;
1171 			bw->Pad = 0;
1172 			bw->Flags = 0;
1173 			fib->Header.Size += sizeof(struct aac_blockwrite64);
1174 			cm->cm_flags |= AAC_CMD_DATAIN;
1175 			cm->cm_sgtable = (struct aac_sg_table *)&bw->SgMap64;
1176 		}
1177 	}
1178 
1179 	*cmp = cm;
1180 	return(0);
1181 
1182 fail:
1183 	if (bp != NULL)
1184 		aac_enqueue_bio(sc, bp);
1185 	if (cm != NULL)
1186 		aac_release_command(cm);
1187 	return(ENOMEM);
1188 }
1189 
1190 /*
1191  * Handle a bio-instigated command that has been completed.
1192  */
1193 static void
1194 aac_bio_complete(struct aac_command *cm)
1195 {
1196 	struct aac_blockread_response *brr;
1197 	struct aac_blockwrite_response *bwr;
1198 	struct bio *bp;
1199 	AAC_FSAStatus status;
1200 
1201 	/* fetch relevant status and then release the command */
1202 	bp = (struct bio *)cm->cm_private;
1203 	if (bp->bio_cmd == BIO_READ) {
1204 		brr = (struct aac_blockread_response *)&cm->cm_fib->data[0];
1205 		status = brr->Status;
1206 	} else {
1207 		bwr = (struct aac_blockwrite_response *)&cm->cm_fib->data[0];
1208 		status = bwr->Status;
1209 	}
1210 	aac_release_command(cm);
1211 
1212 	/* fix up the bio based on status */
1213 	if (status == ST_OK) {
1214 		bp->bio_resid = 0;
1215 	} else {
1216 		bp->bio_error = EIO;
1217 		bp->bio_flags |= BIO_ERROR;
1218 		/* pass an error string out to the disk layer */
1219 		bp->bio_driver1 = aac_describe_code(aac_command_status_table,
1220 						    status);
1221 	}
1222 	aac_biodone(bp);
1223 }
1224 
1225 /*
1226  * Submit a command to the controller, return when it completes.
1227  * XXX This is very dangerous!  If the card has gone out to lunch, we could
1228  *     be stuck here forever.  At the same time, signals are not caught
1229  *     because there is a risk that a signal could wakeup the sleep before
1230  *     the card has a chance to complete the command.  Since there is no way
1231  *     to cancel a command that is in progress, we can't protect against the
1232  *     card completing a command late and spamming the command and data
1233  *     memory.  So, we are held hostage until the command completes.
1234  */
1235 static int
1236 aac_wait_command(struct aac_command *cm)
1237 {
1238 	struct aac_softc *sc;
1239 	int error;
1240 
1241 	debug_called(2);
1242 
1243 	sc = cm->cm_sc;
1244 
1245 	/* Put the command on the ready queue and get things going */
1246 	cm->cm_queue = AAC_ADAP_NORM_CMD_QUEUE;
1247 	aac_enqueue_ready(cm);
1248 	aac_startio(sc);
1249 	error = msleep(cm, &sc->aac_io_lock, PRIBIO, "aacwait", 0);
1250 	return(error);
1251 }
1252 
1253 /*
1254  *Command Buffer Management
1255  */
1256 
1257 /*
1258  * Allocate a command.
1259  */
1260 int
1261 aac_alloc_command(struct aac_softc *sc, struct aac_command **cmp)
1262 {
1263 	struct aac_command *cm;
1264 
1265 	debug_called(3);
1266 
1267 	if ((cm = aac_dequeue_free(sc)) == NULL) {
1268 		if (sc->total_fibs < sc->aac_max_fibs) {
1269 			sc->aifflags |= AAC_AIFFLAGS_ALLOCFIBS;
1270 			wakeup(sc->aifthread);
1271 		}
1272 		return (EBUSY);
1273 	}
1274 
1275 	*cmp = cm;
1276 	return(0);
1277 }
1278 
1279 /*
1280  * Release a command back to the freelist.
1281  */
1282 void
1283 aac_release_command(struct aac_command *cm)
1284 {
1285 	struct aac_event *event;
1286 	struct aac_softc *sc;
1287 
1288 	debug_called(3);
1289 
1290 	/* (re)initialise the command/FIB */
1291 	cm->cm_sgtable = NULL;
1292 	cm->cm_flags = 0;
1293 	cm->cm_complete = NULL;
1294 	cm->cm_private = NULL;
1295 	cm->cm_fib->Header.XferState = AAC_FIBSTATE_EMPTY;
1296 	cm->cm_fib->Header.StructType = AAC_FIBTYPE_TFIB;
1297 	cm->cm_fib->Header.Flags = 0;
1298 	cm->cm_fib->Header.SenderSize = cm->cm_sc->aac_max_fib_size;
1299 
1300 	/*
1301 	 * These are duplicated in aac_start to cover the case where an
1302 	 * intermediate stage may have destroyed them.  They're left
1303 	 * initialised here for debugging purposes only.
1304 	 */
1305 	cm->cm_fib->Header.ReceiverFibAddress = (u_int32_t)cm->cm_fibphys;
1306 	cm->cm_fib->Header.SenderData = 0;
1307 
1308 	aac_enqueue_free(cm);
1309 
1310 	sc = cm->cm_sc;
1311 	event = TAILQ_FIRST(&sc->aac_ev_cmfree);
1312 	if (event != NULL) {
1313 		TAILQ_REMOVE(&sc->aac_ev_cmfree, event, ev_links);
1314 		event->ev_callback(sc, event, event->ev_arg);
1315 	}
1316 }
1317 
1318 /*
1319  * Map helper for command/FIB allocation.
1320  */
1321 static void
1322 aac_map_command_helper(void *arg, bus_dma_segment_t *segs, int nseg, int error)
1323 {
1324 	uint64_t	*fibphys;
1325 
1326 	fibphys = (uint64_t *)arg;
1327 
1328 	debug_called(3);
1329 
1330 	*fibphys = segs[0].ds_addr;
1331 }
1332 
1333 /*
1334  * Allocate and initialise commands/FIBs for this adapter.
1335  */
1336 static int
1337 aac_alloc_commands(struct aac_softc *sc)
1338 {
1339 	struct aac_command *cm;
1340 	struct aac_fibmap *fm;
1341 	uint64_t fibphys;
1342 	int i, error;
1343 
1344 	debug_called(2);
1345 
1346 	if (sc->total_fibs + sc->aac_max_fibs_alloc > sc->aac_max_fibs)
1347 		return (ENOMEM);
1348 
1349 	fm = malloc(sizeof(struct aac_fibmap), M_AACBUF, M_NOWAIT|M_ZERO);
1350 	if (fm == NULL)
1351 		return (ENOMEM);
1352 
1353 	/* allocate the FIBs in DMAable memory and load them */
1354 	if (bus_dmamem_alloc(sc->aac_fib_dmat, (void **)&fm->aac_fibs,
1355 			     BUS_DMA_NOWAIT, &fm->aac_fibmap)) {
1356 		device_printf(sc->aac_dev,
1357 			      "Not enough contiguous memory available.\n");
1358 		free(fm, M_AACBUF);
1359 		return (ENOMEM);
1360 	}
1361 
1362 	/* Ignore errors since this doesn't bounce */
1363 	(void)bus_dmamap_load(sc->aac_fib_dmat, fm->aac_fibmap, fm->aac_fibs,
1364 			      sc->aac_max_fibs_alloc * sc->aac_max_fib_size,
1365 			      aac_map_command_helper, &fibphys, 0);
1366 
1367 	/* initialise constant fields in the command structure */
1368 	mtx_lock(&sc->aac_io_lock);
1369 	bzero(fm->aac_fibs, sc->aac_max_fibs_alloc * sc->aac_max_fib_size);
1370 	for (i = 0; i < sc->aac_max_fibs_alloc; i++) {
1371 		cm = sc->aac_commands + sc->total_fibs;
1372 		fm->aac_commands = cm;
1373 		cm->cm_sc = sc;
1374 		cm->cm_fib = (struct aac_fib *)
1375 			((u_int8_t *)fm->aac_fibs + i*sc->aac_max_fib_size);
1376 		cm->cm_fibphys = fibphys + i*sc->aac_max_fib_size;
1377 		cm->cm_index = sc->total_fibs;
1378 
1379 		if ((error = bus_dmamap_create(sc->aac_buffer_dmat, 0,
1380 					       &cm->cm_datamap)) == 0)
1381 			aac_release_command(cm);
1382 		else
1383 			break;
1384 		sc->total_fibs++;
1385 	}
1386 
1387 	if (i > 0) {
1388 		TAILQ_INSERT_TAIL(&sc->aac_fibmap_tqh, fm, fm_link);
1389 		debug(1, "total_fibs= %d\n", sc->total_fibs);
1390 		mtx_unlock(&sc->aac_io_lock);
1391 		return (0);
1392 	}
1393 
1394 	mtx_unlock(&sc->aac_io_lock);
1395 	bus_dmamap_unload(sc->aac_fib_dmat, fm->aac_fibmap);
1396 	bus_dmamem_free(sc->aac_fib_dmat, fm->aac_fibs, fm->aac_fibmap);
1397 	free(fm, M_AACBUF);
1398 	return (ENOMEM);
1399 }
1400 
1401 /*
1402  * Free FIBs owned by this adapter.
1403  */
1404 static void
1405 aac_free_commands(struct aac_softc *sc)
1406 {
1407 	struct aac_fibmap *fm;
1408 	struct aac_command *cm;
1409 	int i;
1410 
1411 	debug_called(1);
1412 
1413 	while ((fm = TAILQ_FIRST(&sc->aac_fibmap_tqh)) != NULL) {
1414 
1415 		TAILQ_REMOVE(&sc->aac_fibmap_tqh, fm, fm_link);
1416 		/*
1417 		 * We check against total_fibs to handle partially
1418 		 * allocated blocks.
1419 		 */
1420 		for (i = 0; i < sc->aac_max_fibs_alloc && sc->total_fibs--; i++) {
1421 			cm = fm->aac_commands + i;
1422 			bus_dmamap_destroy(sc->aac_buffer_dmat, cm->cm_datamap);
1423 		}
1424 		bus_dmamap_unload(sc->aac_fib_dmat, fm->aac_fibmap);
1425 		bus_dmamem_free(sc->aac_fib_dmat, fm->aac_fibs, fm->aac_fibmap);
1426 		free(fm, M_AACBUF);
1427 	}
1428 }
1429 
1430 /*
1431  * Command-mapping helper function - populate this command's s/g table.
1432  */
1433 static void
1434 aac_map_command_sg(void *arg, bus_dma_segment_t *segs, int nseg, int error)
1435 {
1436 	struct aac_softc *sc;
1437 	struct aac_command *cm;
1438 	struct aac_fib *fib;
1439 	int i;
1440 
1441 	debug_called(3);
1442 
1443 	cm = (struct aac_command *)arg;
1444 	sc = cm->cm_sc;
1445 	fib = cm->cm_fib;
1446 
1447 	/* copy into the FIB */
1448 	if (cm->cm_sgtable != NULL) {
1449 		if (fib->Header.Command == RawIo) {
1450 			struct aac_sg_tableraw *sg;
1451 			sg = (struct aac_sg_tableraw *)cm->cm_sgtable;
1452 			sg->SgCount = nseg;
1453 			for (i = 0; i < nseg; i++) {
1454 				sg->SgEntryRaw[i].SgAddress = segs[i].ds_addr;
1455 				sg->SgEntryRaw[i].SgByteCount = segs[i].ds_len;
1456 				sg->SgEntryRaw[i].Next = 0;
1457 				sg->SgEntryRaw[i].Prev = 0;
1458 				sg->SgEntryRaw[i].Flags = 0;
1459 			}
1460 			/* update the FIB size for the s/g count */
1461 			fib->Header.Size += nseg*sizeof(struct aac_sg_entryraw);
1462 		} else if ((cm->cm_sc->flags & AAC_FLAGS_SG_64BIT) == 0) {
1463 			struct aac_sg_table *sg;
1464 			sg = cm->cm_sgtable;
1465 			sg->SgCount = nseg;
1466 			for (i = 0; i < nseg; i++) {
1467 				sg->SgEntry[i].SgAddress = segs[i].ds_addr;
1468 				sg->SgEntry[i].SgByteCount = segs[i].ds_len;
1469 			}
1470 			/* update the FIB size for the s/g count */
1471 			fib->Header.Size += nseg*sizeof(struct aac_sg_entry);
1472 		} else {
1473 			struct aac_sg_table64 *sg;
1474 			sg = (struct aac_sg_table64 *)cm->cm_sgtable;
1475 			sg->SgCount = nseg;
1476 			for (i = 0; i < nseg; i++) {
1477 				sg->SgEntry64[i].SgAddress = segs[i].ds_addr;
1478 				sg->SgEntry64[i].SgByteCount = segs[i].ds_len;
1479 			}
1480 			/* update the FIB size for the s/g count */
1481 			fib->Header.Size += nseg*sizeof(struct aac_sg_entry64);
1482 		}
1483 	}
1484 
1485 	/* Fix up the address values in the FIB.  Use the command array index
1486 	 * instead of a pointer since these fields are only 32 bits.  Shift
1487 	 * the SenderFibAddress over to make room for the fast response bit
1488 	 * and for the AIF bit
1489 	 */
1490 	cm->cm_fib->Header.SenderFibAddress = (cm->cm_index << 2);
1491 	cm->cm_fib->Header.ReceiverFibAddress = (u_int32_t)cm->cm_fibphys;
1492 
1493 	/* save a pointer to the command for speedy reverse-lookup */
1494 	cm->cm_fib->Header.SenderData = cm->cm_index;
1495 
1496 	if (cm->cm_flags & AAC_CMD_DATAIN)
1497 		bus_dmamap_sync(sc->aac_buffer_dmat, cm->cm_datamap,
1498 				BUS_DMASYNC_PREREAD);
1499 	if (cm->cm_flags & AAC_CMD_DATAOUT)
1500 		bus_dmamap_sync(sc->aac_buffer_dmat, cm->cm_datamap,
1501 				BUS_DMASYNC_PREWRITE);
1502 	cm->cm_flags |= AAC_CMD_MAPPED;
1503 
1504 	if (sc->flags & AAC_FLAGS_NEW_COMM) {
1505 		int count = 10000000L;
1506 		while (AAC_SEND_COMMAND(sc, cm) != 0) {
1507 			if (--count == 0) {
1508 				aac_unmap_command(cm);
1509 				sc->flags |= AAC_QUEUE_FRZN;
1510 				aac_requeue_ready(cm);
1511 			}
1512 			DELAY(5);			/* wait 5 usec. */
1513 		}
1514 	} else {
1515 		/* Put the FIB on the outbound queue */
1516 		if (aac_enqueue_fib(sc, cm->cm_queue, cm) == EBUSY) {
1517 			aac_unmap_command(cm);
1518 			sc->flags |= AAC_QUEUE_FRZN;
1519 			aac_requeue_ready(cm);
1520 		}
1521 	}
1522 
1523 	return;
1524 }
1525 
1526 /*
1527  * Unmap a command from controller-visible space.
1528  */
1529 static void
1530 aac_unmap_command(struct aac_command *cm)
1531 {
1532 	struct aac_softc *sc;
1533 
1534 	debug_called(2);
1535 
1536 	sc = cm->cm_sc;
1537 
1538 	if (!(cm->cm_flags & AAC_CMD_MAPPED))
1539 		return;
1540 
1541 	if (cm->cm_datalen != 0) {
1542 		if (cm->cm_flags & AAC_CMD_DATAIN)
1543 			bus_dmamap_sync(sc->aac_buffer_dmat, cm->cm_datamap,
1544 					BUS_DMASYNC_POSTREAD);
1545 		if (cm->cm_flags & AAC_CMD_DATAOUT)
1546 			bus_dmamap_sync(sc->aac_buffer_dmat, cm->cm_datamap,
1547 					BUS_DMASYNC_POSTWRITE);
1548 
1549 		bus_dmamap_unload(sc->aac_buffer_dmat, cm->cm_datamap);
1550 	}
1551 	cm->cm_flags &= ~AAC_CMD_MAPPED;
1552 }
1553 
1554 /*
1555  * Hardware Interface
1556  */
1557 
1558 /*
1559  * Initialise the adapter.
1560  */
1561 static void
1562 aac_common_map(void *arg, bus_dma_segment_t *segs, int nseg, int error)
1563 {
1564 	struct aac_softc *sc;
1565 
1566 	debug_called(1);
1567 
1568 	sc = (struct aac_softc *)arg;
1569 
1570 	sc->aac_common_busaddr = segs[0].ds_addr;
1571 }
1572 
1573 static int
1574 aac_check_firmware(struct aac_softc *sc)
1575 {
1576 	u_int32_t major, minor, options = 0, atu_size = 0;
1577 	int status;
1578 
1579 	debug_called(1);
1580 
1581 	/*
1582 	 * Retrieve the firmware version numbers.  Dell PERC2/QC cards with
1583 	 * firmware version 1.x are not compatible with this driver.
1584 	 */
1585 	if (sc->flags & AAC_FLAGS_PERC2QC) {
1586 		if (aac_sync_command(sc, AAC_MONKER_GETKERNVER, 0, 0, 0, 0,
1587 				     NULL)) {
1588 			device_printf(sc->aac_dev,
1589 				      "Error reading firmware version\n");
1590 			return (EIO);
1591 		}
1592 
1593 		/* These numbers are stored as ASCII! */
1594 		major = (AAC_GET_MAILBOX(sc, 1) & 0xff) - 0x30;
1595 		minor = (AAC_GET_MAILBOX(sc, 2) & 0xff) - 0x30;
1596 		if (major == 1) {
1597 			device_printf(sc->aac_dev,
1598 			    "Firmware version %d.%d is not supported.\n",
1599 			    major, minor);
1600 			return (EINVAL);
1601 		}
1602 	}
1603 
1604 	/*
1605 	 * Retrieve the capabilities/supported options word so we know what
1606 	 * work-arounds to enable.  Some firmware revs don't support this
1607 	 * command.
1608 	 */
1609 	if (aac_sync_command(sc, AAC_MONKER_GETINFO, 0, 0, 0, 0, &status)) {
1610 		if (status != AAC_SRB_STS_INVALID_REQUEST) {
1611 			device_printf(sc->aac_dev,
1612 			     "RequestAdapterInfo failed\n");
1613 			return (EIO);
1614 		}
1615 	} else {
1616 		options = AAC_GET_MAILBOX(sc, 1);
1617 		atu_size = AAC_GET_MAILBOX(sc, 2);
1618 		sc->supported_options = options;
1619 
1620 		if ((options & AAC_SUPPORTED_4GB_WINDOW) != 0 &&
1621 		    (sc->flags & AAC_FLAGS_NO4GB) == 0)
1622 			sc->flags |= AAC_FLAGS_4GB_WINDOW;
1623 		if (options & AAC_SUPPORTED_NONDASD)
1624 			sc->flags |= AAC_FLAGS_ENABLE_CAM;
1625 		if ((options & AAC_SUPPORTED_SGMAP_HOST64) != 0
1626 		     && (sizeof(bus_addr_t) > 4)) {
1627 			device_printf(sc->aac_dev,
1628 			    "Enabling 64-bit address support\n");
1629 			sc->flags |= AAC_FLAGS_SG_64BIT;
1630 		}
1631 		if ((options & AAC_SUPPORTED_NEW_COMM)
1632 		 && sc->aac_if.aif_send_command)
1633 			sc->flags |= AAC_FLAGS_NEW_COMM;
1634 		if (options & AAC_SUPPORTED_64BIT_ARRAYSIZE)
1635 			sc->flags |= AAC_FLAGS_ARRAY_64BIT;
1636 	}
1637 
1638 	/* Check for broken hardware that does a lower number of commands */
1639 	sc->aac_max_fibs = (sc->flags & AAC_FLAGS_256FIBS ? 256:512);
1640 
1641 	/* Remap mem. resource, if required */
1642 	if ((sc->flags & AAC_FLAGS_NEW_COMM) &&
1643 		atu_size > rman_get_size(sc->aac_regs_resource)) {
1644 		bus_release_resource(
1645 			sc->aac_dev, SYS_RES_MEMORY,
1646 			sc->aac_regs_rid, sc->aac_regs_resource);
1647 		sc->aac_regs_resource = bus_alloc_resource(
1648 			sc->aac_dev, SYS_RES_MEMORY, &sc->aac_regs_rid,
1649 			0ul, ~0ul, atu_size, RF_ACTIVE);
1650 		if (sc->aac_regs_resource == NULL) {
1651 			sc->aac_regs_resource = bus_alloc_resource_any(
1652 				sc->aac_dev, SYS_RES_MEMORY,
1653 				&sc->aac_regs_rid, RF_ACTIVE);
1654 			if (sc->aac_regs_resource == NULL) {
1655 				device_printf(sc->aac_dev,
1656 				    "couldn't allocate register window\n");
1657 				return (ENXIO);
1658 			}
1659 			sc->flags &= ~AAC_FLAGS_NEW_COMM;
1660 		}
1661 		sc->aac_btag = rman_get_bustag(sc->aac_regs_resource);
1662 		sc->aac_bhandle = rman_get_bushandle(sc->aac_regs_resource);
1663 	}
1664 
1665 	/* Read preferred settings */
1666 	sc->aac_max_fib_size = sizeof(struct aac_fib);
1667 	sc->aac_max_sectors = 128;				/* 64KB */
1668 	if (sc->flags & AAC_FLAGS_SG_64BIT)
1669 		sc->aac_sg_tablesize = (AAC_FIB_DATASIZE
1670 		 - sizeof(struct aac_blockwrite64)
1671 		 + sizeof(struct aac_sg_table64))
1672 		 / sizeof(struct aac_sg_table64);
1673 	else
1674 		sc->aac_sg_tablesize = (AAC_FIB_DATASIZE
1675 		 - sizeof(struct aac_blockwrite)
1676 		 + sizeof(struct aac_sg_table))
1677 		 / sizeof(struct aac_sg_table);
1678 
1679 	if (!aac_sync_command(sc, AAC_MONKER_GETCOMMPREF, 0, 0, 0, 0, NULL)) {
1680 		options = AAC_GET_MAILBOX(sc, 1);
1681 		sc->aac_max_fib_size = (options & 0xFFFF);
1682 		sc->aac_max_sectors = (options >> 16) << 1;
1683 		options = AAC_GET_MAILBOX(sc, 2);
1684 		sc->aac_sg_tablesize = (options >> 16);
1685 		options = AAC_GET_MAILBOX(sc, 3);
1686 		sc->aac_max_fibs = (options & 0xFFFF);
1687 	}
1688 	if (sc->aac_max_fib_size > PAGE_SIZE)
1689 		sc->aac_max_fib_size = PAGE_SIZE;
1690 	sc->aac_max_fibs_alloc = PAGE_SIZE / sc->aac_max_fib_size;
1691 
1692 	return (0);
1693 }
1694 
1695 static int
1696 aac_init(struct aac_softc *sc)
1697 {
1698 	struct aac_adapter_init	*ip;
1699 	time_t then;
1700 	u_int32_t code, qoffset;
1701 	int error;
1702 
1703 	debug_called(1);
1704 
1705 	/*
1706 	 * First wait for the adapter to come ready.
1707 	 */
1708 	then = time_uptime;
1709 	do {
1710 		code = AAC_GET_FWSTATUS(sc);
1711 		if (code & AAC_SELF_TEST_FAILED) {
1712 			device_printf(sc->aac_dev, "FATAL: selftest failed\n");
1713 			return(ENXIO);
1714 		}
1715 		if (code & AAC_KERNEL_PANIC) {
1716 			device_printf(sc->aac_dev,
1717 				      "FATAL: controller kernel panic\n");
1718 			return(ENXIO);
1719 		}
1720 		if (time_uptime > (then + AAC_BOOT_TIMEOUT)) {
1721 			device_printf(sc->aac_dev,
1722 				      "FATAL: controller not coming ready, "
1723 					   "status %x\n", code);
1724 			return(ENXIO);
1725 		}
1726 	} while (!(code & AAC_UP_AND_RUNNING));
1727 
1728 	error = ENOMEM;
1729 	/*
1730 	 * Create DMA tag for mapping buffers into controller-addressable space.
1731 	 */
1732 	if (bus_dma_tag_create(sc->aac_parent_dmat, 	/* parent */
1733 			       1, 0, 			/* algnmnt, boundary */
1734 			       (sc->flags & AAC_FLAGS_SG_64BIT) ?
1735 			       BUS_SPACE_MAXADDR :
1736 			       BUS_SPACE_MAXADDR_32BIT,	/* lowaddr */
1737 			       BUS_SPACE_MAXADDR, 	/* highaddr */
1738 			       NULL, NULL, 		/* filter, filterarg */
1739 			       MAXBSIZE,		/* maxsize */
1740 			       sc->aac_sg_tablesize,	/* nsegments */
1741 			       MAXBSIZE,		/* maxsegsize */
1742 			       BUS_DMA_ALLOCNOW,	/* flags */
1743 			       busdma_lock_mutex,	/* lockfunc */
1744 			       &sc->aac_io_lock,	/* lockfuncarg */
1745 			       &sc->aac_buffer_dmat)) {
1746 		device_printf(sc->aac_dev, "can't allocate buffer DMA tag\n");
1747 		goto out;
1748 	}
1749 
1750 	/*
1751 	 * Create DMA tag for mapping FIBs into controller-addressable space..
1752 	 */
1753 	if (bus_dma_tag_create(sc->aac_parent_dmat,	/* parent */
1754 			       1, 0, 			/* algnmnt, boundary */
1755 			       (sc->flags & AAC_FLAGS_4GB_WINDOW) ?
1756 			       BUS_SPACE_MAXADDR_32BIT :
1757 			       0x7fffffff,		/* lowaddr */
1758 			       BUS_SPACE_MAXADDR, 	/* highaddr */
1759 			       NULL, NULL, 		/* filter, filterarg */
1760 			       sc->aac_max_fibs_alloc *
1761 			       sc->aac_max_fib_size,  /* maxsize */
1762 			       1,			/* nsegments */
1763 			       sc->aac_max_fibs_alloc *
1764 			       sc->aac_max_fib_size,	/* maxsegsize */
1765 			       0,			/* flags */
1766 			       NULL, NULL,		/* No locking needed */
1767 			       &sc->aac_fib_dmat)) {
1768 		device_printf(sc->aac_dev, "can't allocate FIB DMA tag\n");;
1769 		goto out;
1770 	}
1771 
1772 	/*
1773 	 * Create DMA tag for the common structure and allocate it.
1774 	 */
1775 	if (bus_dma_tag_create(sc->aac_parent_dmat, 	/* parent */
1776 			       1, 0,			/* algnmnt, boundary */
1777 			       (sc->flags & AAC_FLAGS_4GB_WINDOW) ?
1778 			       BUS_SPACE_MAXADDR_32BIT :
1779 			       0x7fffffff,		/* lowaddr */
1780 			       BUS_SPACE_MAXADDR, 	/* highaddr */
1781 			       NULL, NULL, 		/* filter, filterarg */
1782 			       8192 + sizeof(struct aac_common), /* maxsize */
1783 			       1,			/* nsegments */
1784 			       BUS_SPACE_MAXSIZE_32BIT,	/* maxsegsize */
1785 			       0,			/* flags */
1786 			       NULL, NULL,		/* No locking needed */
1787 			       &sc->aac_common_dmat)) {
1788 		device_printf(sc->aac_dev,
1789 			      "can't allocate common structure DMA tag\n");
1790 		goto out;
1791 	}
1792 	if (bus_dmamem_alloc(sc->aac_common_dmat, (void **)&sc->aac_common,
1793 			     BUS_DMA_NOWAIT, &sc->aac_common_dmamap)) {
1794 		device_printf(sc->aac_dev, "can't allocate common structure\n");
1795 		goto out;
1796 	}
1797 
1798 	/*
1799 	 * Work around a bug in the 2120 and 2200 that cannot DMA commands
1800 	 * below address 8192 in physical memory.
1801 	 * XXX If the padding is not needed, can it be put to use instead
1802 	 * of ignored?
1803 	 */
1804 	(void)bus_dmamap_load(sc->aac_common_dmat, sc->aac_common_dmamap,
1805 			sc->aac_common, 8192 + sizeof(*sc->aac_common),
1806 			aac_common_map, sc, 0);
1807 
1808 	if (sc->aac_common_busaddr < 8192) {
1809 		sc->aac_common = (struct aac_common *)
1810 		    ((uint8_t *)sc->aac_common + 8192);
1811 		sc->aac_common_busaddr += 8192;
1812 	}
1813 	bzero(sc->aac_common, sizeof(*sc->aac_common));
1814 
1815 	/* Allocate some FIBs and associated command structs */
1816 	TAILQ_INIT(&sc->aac_fibmap_tqh);
1817 	sc->aac_commands = malloc(sc->aac_max_fibs * sizeof(struct aac_command),
1818 				  M_AACBUF, M_WAITOK|M_ZERO);
1819 	while (sc->total_fibs < AAC_PREALLOCATE_FIBS) {
1820 		if (aac_alloc_commands(sc) != 0)
1821 			break;
1822 	}
1823 	if (sc->total_fibs == 0)
1824 		goto out;
1825 
1826 	/*
1827 	 * Fill in the init structure.  This tells the adapter about the
1828 	 * physical location of various important shared data structures.
1829 	 */
1830 	ip = &sc->aac_common->ac_init;
1831 	ip->InitStructRevision = AAC_INIT_STRUCT_REVISION;
1832 	if (sc->aac_max_fib_size > sizeof(struct aac_fib)) {
1833 		ip->InitStructRevision = AAC_INIT_STRUCT_REVISION_4;
1834 		sc->flags |= AAC_FLAGS_RAW_IO;
1835 	}
1836 	ip->MiniPortRevision = AAC_INIT_STRUCT_MINIPORT_REVISION;
1837 
1838 	ip->AdapterFibsPhysicalAddress = sc->aac_common_busaddr +
1839 					 offsetof(struct aac_common, ac_fibs);
1840 	ip->AdapterFibsVirtualAddress = 0;
1841 	ip->AdapterFibsSize = AAC_ADAPTER_FIBS * sizeof(struct aac_fib);
1842 	ip->AdapterFibAlign = sizeof(struct aac_fib);
1843 
1844 	ip->PrintfBufferAddress = sc->aac_common_busaddr +
1845 				  offsetof(struct aac_common, ac_printf);
1846 	ip->PrintfBufferSize = AAC_PRINTF_BUFSIZE;
1847 
1848 	/*
1849 	 * The adapter assumes that pages are 4K in size, except on some
1850  	 * broken firmware versions that do the page->byte conversion twice,
1851 	 * therefore 'assuming' that this value is in 16MB units (2^24).
1852 	 * Round up since the granularity is so high.
1853 	 */
1854 	ip->HostPhysMemPages = ctob(physmem) / AAC_PAGE_SIZE;
1855 	if (sc->flags & AAC_FLAGS_BROKEN_MEMMAP) {
1856 		ip->HostPhysMemPages =
1857 		    (ip->HostPhysMemPages + AAC_PAGE_SIZE) / AAC_PAGE_SIZE;
1858 	}
1859 	ip->HostElapsedSeconds = time_uptime;	/* reset later if invalid */
1860 
1861 	ip->InitFlags = 0;
1862 	if (sc->flags & AAC_FLAGS_NEW_COMM) {
1863 		ip->InitFlags = INITFLAGS_NEW_COMM_SUPPORTED;
1864 		device_printf(sc->aac_dev, "New comm. interface enabled\n");
1865 	}
1866 
1867 	ip->MaxIoCommands = sc->aac_max_fibs;
1868 	ip->MaxIoSize = sc->aac_max_sectors << 9;
1869 	ip->MaxFibSize = sc->aac_max_fib_size;
1870 
1871 	/*
1872 	 * Initialise FIB queues.  Note that it appears that the layout of the
1873 	 * indexes and the segmentation of the entries may be mandated by the
1874 	 * adapter, which is only told about the base of the queue index fields.
1875 	 *
1876 	 * The initial values of the indices are assumed to inform the adapter
1877 	 * of the sizes of the respective queues, and theoretically it could
1878 	 * work out the entire layout of the queue structures from this.  We
1879 	 * take the easy route and just lay this area out like everyone else
1880 	 * does.
1881 	 *
1882 	 * The Linux driver uses a much more complex scheme whereby several
1883 	 * header records are kept for each queue.  We use a couple of generic
1884 	 * list manipulation functions which 'know' the size of each list by
1885 	 * virtue of a table.
1886 	 */
1887 	qoffset = offsetof(struct aac_common, ac_qbuf) + AAC_QUEUE_ALIGN;
1888 	qoffset &= ~(AAC_QUEUE_ALIGN - 1);
1889 	sc->aac_queues =
1890 	    (struct aac_queue_table *)((uintptr_t)sc->aac_common + qoffset);
1891 	ip->CommHeaderAddress = sc->aac_common_busaddr + qoffset;
1892 
1893 	sc->aac_queues->qt_qindex[AAC_HOST_NORM_CMD_QUEUE][AAC_PRODUCER_INDEX] =
1894 		AAC_HOST_NORM_CMD_ENTRIES;
1895 	sc->aac_queues->qt_qindex[AAC_HOST_NORM_CMD_QUEUE][AAC_CONSUMER_INDEX] =
1896 		AAC_HOST_NORM_CMD_ENTRIES;
1897 	sc->aac_queues->qt_qindex[AAC_HOST_HIGH_CMD_QUEUE][AAC_PRODUCER_INDEX] =
1898 		AAC_HOST_HIGH_CMD_ENTRIES;
1899 	sc->aac_queues->qt_qindex[AAC_HOST_HIGH_CMD_QUEUE][AAC_CONSUMER_INDEX] =
1900 		AAC_HOST_HIGH_CMD_ENTRIES;
1901 	sc->aac_queues->qt_qindex[AAC_ADAP_NORM_CMD_QUEUE][AAC_PRODUCER_INDEX] =
1902 		AAC_ADAP_NORM_CMD_ENTRIES;
1903 	sc->aac_queues->qt_qindex[AAC_ADAP_NORM_CMD_QUEUE][AAC_CONSUMER_INDEX] =
1904 		AAC_ADAP_NORM_CMD_ENTRIES;
1905 	sc->aac_queues->qt_qindex[AAC_ADAP_HIGH_CMD_QUEUE][AAC_PRODUCER_INDEX] =
1906 		AAC_ADAP_HIGH_CMD_ENTRIES;
1907 	sc->aac_queues->qt_qindex[AAC_ADAP_HIGH_CMD_QUEUE][AAC_CONSUMER_INDEX] =
1908 		AAC_ADAP_HIGH_CMD_ENTRIES;
1909 	sc->aac_queues->qt_qindex[AAC_HOST_NORM_RESP_QUEUE][AAC_PRODUCER_INDEX]=
1910 		AAC_HOST_NORM_RESP_ENTRIES;
1911 	sc->aac_queues->qt_qindex[AAC_HOST_NORM_RESP_QUEUE][AAC_CONSUMER_INDEX]=
1912 		AAC_HOST_NORM_RESP_ENTRIES;
1913 	sc->aac_queues->qt_qindex[AAC_HOST_HIGH_RESP_QUEUE][AAC_PRODUCER_INDEX]=
1914 		AAC_HOST_HIGH_RESP_ENTRIES;
1915 	sc->aac_queues->qt_qindex[AAC_HOST_HIGH_RESP_QUEUE][AAC_CONSUMER_INDEX]=
1916 		AAC_HOST_HIGH_RESP_ENTRIES;
1917 	sc->aac_queues->qt_qindex[AAC_ADAP_NORM_RESP_QUEUE][AAC_PRODUCER_INDEX]=
1918 		AAC_ADAP_NORM_RESP_ENTRIES;
1919 	sc->aac_queues->qt_qindex[AAC_ADAP_NORM_RESP_QUEUE][AAC_CONSUMER_INDEX]=
1920 		AAC_ADAP_NORM_RESP_ENTRIES;
1921 	sc->aac_queues->qt_qindex[AAC_ADAP_HIGH_RESP_QUEUE][AAC_PRODUCER_INDEX]=
1922 		AAC_ADAP_HIGH_RESP_ENTRIES;
1923 	sc->aac_queues->qt_qindex[AAC_ADAP_HIGH_RESP_QUEUE][AAC_CONSUMER_INDEX]=
1924 		AAC_ADAP_HIGH_RESP_ENTRIES;
1925 	sc->aac_qentries[AAC_HOST_NORM_CMD_QUEUE] =
1926 		&sc->aac_queues->qt_HostNormCmdQueue[0];
1927 	sc->aac_qentries[AAC_HOST_HIGH_CMD_QUEUE] =
1928 		&sc->aac_queues->qt_HostHighCmdQueue[0];
1929 	sc->aac_qentries[AAC_ADAP_NORM_CMD_QUEUE] =
1930 		&sc->aac_queues->qt_AdapNormCmdQueue[0];
1931 	sc->aac_qentries[AAC_ADAP_HIGH_CMD_QUEUE] =
1932 		&sc->aac_queues->qt_AdapHighCmdQueue[0];
1933 	sc->aac_qentries[AAC_HOST_NORM_RESP_QUEUE] =
1934 		&sc->aac_queues->qt_HostNormRespQueue[0];
1935 	sc->aac_qentries[AAC_HOST_HIGH_RESP_QUEUE] =
1936 		&sc->aac_queues->qt_HostHighRespQueue[0];
1937 	sc->aac_qentries[AAC_ADAP_NORM_RESP_QUEUE] =
1938 		&sc->aac_queues->qt_AdapNormRespQueue[0];
1939 	sc->aac_qentries[AAC_ADAP_HIGH_RESP_QUEUE] =
1940 		&sc->aac_queues->qt_AdapHighRespQueue[0];
1941 
1942 	/*
1943 	 * Do controller-type-specific initialisation
1944 	 */
1945 	switch (sc->aac_hwif) {
1946 	case AAC_HWIF_I960RX:
1947 		AAC_SETREG4(sc, AAC_RX_ODBR, ~0);
1948 		break;
1949 	case AAC_HWIF_RKT:
1950 		AAC_SETREG4(sc, AAC_RKT_ODBR, ~0);
1951 		break;
1952 	default:
1953 		break;
1954 	}
1955 
1956 	/*
1957 	 * Give the init structure to the controller.
1958 	 */
1959 	if (aac_sync_command(sc, AAC_MONKER_INITSTRUCT,
1960 			     sc->aac_common_busaddr +
1961 			     offsetof(struct aac_common, ac_init), 0, 0, 0,
1962 			     NULL)) {
1963 		device_printf(sc->aac_dev,
1964 			      "error establishing init structure\n");
1965 		error = EIO;
1966 		goto out;
1967 	}
1968 
1969 	error = 0;
1970 out:
1971 	return(error);
1972 }
1973 
1974 /*
1975  * Send a synchronous command to the controller and wait for a result.
1976  * Indicate if the controller completed the command with an error status.
1977  */
1978 static int
1979 aac_sync_command(struct aac_softc *sc, u_int32_t command,
1980 		 u_int32_t arg0, u_int32_t arg1, u_int32_t arg2, u_int32_t arg3,
1981 		 u_int32_t *sp)
1982 {
1983 	time_t then;
1984 	u_int32_t status;
1985 
1986 	debug_called(3);
1987 
1988 	/* populate the mailbox */
1989 	AAC_SET_MAILBOX(sc, command, arg0, arg1, arg2, arg3);
1990 
1991 	/* ensure the sync command doorbell flag is cleared */
1992 	AAC_CLEAR_ISTATUS(sc, AAC_DB_SYNC_COMMAND);
1993 
1994 	/* then set it to signal the adapter */
1995 	AAC_QNOTIFY(sc, AAC_DB_SYNC_COMMAND);
1996 
1997 	/* spin waiting for the command to complete */
1998 	then = time_uptime;
1999 	do {
2000 		if (time_uptime > (then + AAC_IMMEDIATE_TIMEOUT)) {
2001 			debug(1, "timed out");
2002 			return(EIO);
2003 		}
2004 	} while (!(AAC_GET_ISTATUS(sc) & AAC_DB_SYNC_COMMAND));
2005 
2006 	/* clear the completion flag */
2007 	AAC_CLEAR_ISTATUS(sc, AAC_DB_SYNC_COMMAND);
2008 
2009 	/* get the command status */
2010 	status = AAC_GET_MAILBOX(sc, 0);
2011 	if (sp != NULL)
2012 		*sp = status;
2013 
2014 	if (status != AAC_SRB_STS_SUCCESS)
2015 		return (-1);
2016 	return(0);
2017 }
2018 
2019 int
2020 aac_sync_fib(struct aac_softc *sc, u_int32_t command, u_int32_t xferstate,
2021 		 struct aac_fib *fib, u_int16_t datasize)
2022 {
2023 	debug_called(3);
2024 	mtx_assert(&sc->aac_io_lock, MA_OWNED);
2025 
2026 	if (datasize > AAC_FIB_DATASIZE)
2027 		return(EINVAL);
2028 
2029 	/*
2030 	 * Set up the sync FIB
2031 	 */
2032 	fib->Header.XferState = AAC_FIBSTATE_HOSTOWNED |
2033 				AAC_FIBSTATE_INITIALISED |
2034 				AAC_FIBSTATE_EMPTY;
2035 	fib->Header.XferState |= xferstate;
2036 	fib->Header.Command = command;
2037 	fib->Header.StructType = AAC_FIBTYPE_TFIB;
2038 	fib->Header.Size = sizeof(struct aac_fib) + datasize;
2039 	fib->Header.SenderSize = sizeof(struct aac_fib);
2040 	fib->Header.SenderFibAddress = 0;	/* Not needed */
2041 	fib->Header.ReceiverFibAddress = sc->aac_common_busaddr +
2042 					 offsetof(struct aac_common,
2043 						  ac_sync_fib);
2044 
2045 	/*
2046 	 * Give the FIB to the controller, wait for a response.
2047 	 */
2048 	if (aac_sync_command(sc, AAC_MONKER_SYNCFIB,
2049 			     fib->Header.ReceiverFibAddress, 0, 0, 0, NULL)) {
2050 		debug(2, "IO error");
2051 		return(EIO);
2052 	}
2053 
2054 	return (0);
2055 }
2056 
2057 /*
2058  * Adapter-space FIB queue manipulation
2059  *
2060  * Note that the queue implementation here is a little funky; neither the PI or
2061  * CI will ever be zero.  This behaviour is a controller feature.
2062  */
2063 static struct {
2064 	int		size;
2065 	int		notify;
2066 } aac_qinfo[] = {
2067 	{AAC_HOST_NORM_CMD_ENTRIES, AAC_DB_COMMAND_NOT_FULL},
2068 	{AAC_HOST_HIGH_CMD_ENTRIES, 0},
2069 	{AAC_ADAP_NORM_CMD_ENTRIES, AAC_DB_COMMAND_READY},
2070 	{AAC_ADAP_HIGH_CMD_ENTRIES, 0},
2071 	{AAC_HOST_NORM_RESP_ENTRIES, AAC_DB_RESPONSE_NOT_FULL},
2072 	{AAC_HOST_HIGH_RESP_ENTRIES, 0},
2073 	{AAC_ADAP_NORM_RESP_ENTRIES, AAC_DB_RESPONSE_READY},
2074 	{AAC_ADAP_HIGH_RESP_ENTRIES, 0}
2075 };
2076 
2077 /*
2078  * Atomically insert an entry into the nominated queue, returns 0 on success or
2079  * EBUSY if the queue is full.
2080  *
2081  * Note: it would be more efficient to defer notifying the controller in
2082  *	 the case where we may be inserting several entries in rapid succession,
2083  *	 but implementing this usefully may be difficult (it would involve a
2084  *	 separate queue/notify interface).
2085  */
2086 static int
2087 aac_enqueue_fib(struct aac_softc *sc, int queue, struct aac_command *cm)
2088 {
2089 	u_int32_t pi, ci;
2090 	int error;
2091 	u_int32_t fib_size;
2092 	u_int32_t fib_addr;
2093 
2094 	debug_called(3);
2095 
2096 	fib_size = cm->cm_fib->Header.Size;
2097 	fib_addr = cm->cm_fib->Header.ReceiverFibAddress;
2098 
2099 	/* get the producer/consumer indices */
2100 	pi = sc->aac_queues->qt_qindex[queue][AAC_PRODUCER_INDEX];
2101 	ci = sc->aac_queues->qt_qindex[queue][AAC_CONSUMER_INDEX];
2102 
2103 	/* wrap the queue? */
2104 	if (pi >= aac_qinfo[queue].size)
2105 		pi = 0;
2106 
2107 	/* check for queue full */
2108 	if ((pi + 1) == ci) {
2109 		error = EBUSY;
2110 		goto out;
2111 	}
2112 
2113 	/*
2114 	 * To avoid a race with its completion interrupt, place this command on
2115 	 * the busy queue prior to advertising it to the controller.
2116 	 */
2117 	aac_enqueue_busy(cm);
2118 
2119 	/* populate queue entry */
2120 	(sc->aac_qentries[queue] + pi)->aq_fib_size = fib_size;
2121 	(sc->aac_qentries[queue] + pi)->aq_fib_addr = fib_addr;
2122 
2123 	/* update producer index */
2124 	sc->aac_queues->qt_qindex[queue][AAC_PRODUCER_INDEX] = pi + 1;
2125 
2126 	/* notify the adapter if we know how */
2127 	if (aac_qinfo[queue].notify != 0)
2128 		AAC_QNOTIFY(sc, aac_qinfo[queue].notify);
2129 
2130 	error = 0;
2131 
2132 out:
2133 	return(error);
2134 }
2135 
2136 /*
2137  * Atomically remove one entry from the nominated queue, returns 0 on
2138  * success or ENOENT if the queue is empty.
2139  */
2140 static int
2141 aac_dequeue_fib(struct aac_softc *sc, int queue, u_int32_t *fib_size,
2142 		struct aac_fib **fib_addr)
2143 {
2144 	u_int32_t pi, ci;
2145 	u_int32_t fib_index;
2146 	int error;
2147 	int notify;
2148 
2149 	debug_called(3);
2150 
2151 	/* get the producer/consumer indices */
2152 	pi = sc->aac_queues->qt_qindex[queue][AAC_PRODUCER_INDEX];
2153 	ci = sc->aac_queues->qt_qindex[queue][AAC_CONSUMER_INDEX];
2154 
2155 	/* check for queue empty */
2156 	if (ci == pi) {
2157 		error = ENOENT;
2158 		goto out;
2159 	}
2160 
2161 	/* wrap the pi so the following test works */
2162 	if (pi >= aac_qinfo[queue].size)
2163 		pi = 0;
2164 
2165 	notify = 0;
2166 	if (ci == pi + 1)
2167 		notify++;
2168 
2169 	/* wrap the queue? */
2170 	if (ci >= aac_qinfo[queue].size)
2171 		ci = 0;
2172 
2173 	/* fetch the entry */
2174 	*fib_size = (sc->aac_qentries[queue] + ci)->aq_fib_size;
2175 
2176 	switch (queue) {
2177 	case AAC_HOST_NORM_CMD_QUEUE:
2178 	case AAC_HOST_HIGH_CMD_QUEUE:
2179 		/*
2180 		 * The aq_fib_addr is only 32 bits wide so it can't be counted
2181 		 * on to hold an address.  For AIF's, the adapter assumes
2182 		 * that it's giving us an address into the array of AIF fibs.
2183 		 * Therefore, we have to convert it to an index.
2184 		 */
2185 		fib_index = (sc->aac_qentries[queue] + ci)->aq_fib_addr /
2186 			sizeof(struct aac_fib);
2187 		*fib_addr = &sc->aac_common->ac_fibs[fib_index];
2188 		break;
2189 
2190 	case AAC_HOST_NORM_RESP_QUEUE:
2191 	case AAC_HOST_HIGH_RESP_QUEUE:
2192 	{
2193 		struct aac_command *cm;
2194 
2195 		/*
2196 		 * As above, an index is used instead of an actual address.
2197 		 * Gotta shift the index to account for the fast response
2198 		 * bit.  No other correction is needed since this value was
2199 		 * originally provided by the driver via the SenderFibAddress
2200 		 * field.
2201 		 */
2202 		fib_index = (sc->aac_qentries[queue] + ci)->aq_fib_addr;
2203 		cm = sc->aac_commands + (fib_index >> 2);
2204 		*fib_addr = cm->cm_fib;
2205 
2206 		/*
2207 		 * Is this a fast response? If it is, update the fib fields in
2208 		 * local memory since the whole fib isn't DMA'd back up.
2209 		 */
2210 		if (fib_index & 0x01) {
2211 			(*fib_addr)->Header.XferState |= AAC_FIBSTATE_DONEADAP;
2212 			*((u_int32_t*)((*fib_addr)->data)) = AAC_ERROR_NORMAL;
2213 		}
2214 		break;
2215 	}
2216 	default:
2217 		panic("Invalid queue in aac_dequeue_fib()");
2218 		break;
2219 	}
2220 
2221 	/* update consumer index */
2222 	sc->aac_queues->qt_qindex[queue][AAC_CONSUMER_INDEX] = ci + 1;
2223 
2224 	/* if we have made the queue un-full, notify the adapter */
2225 	if (notify && (aac_qinfo[queue].notify != 0))
2226 		AAC_QNOTIFY(sc, aac_qinfo[queue].notify);
2227 	error = 0;
2228 
2229 out:
2230 	return(error);
2231 }
2232 
2233 /*
2234  * Put our response to an Adapter Initialed Fib on the response queue
2235  */
2236 static int
2237 aac_enqueue_response(struct aac_softc *sc, int queue, struct aac_fib *fib)
2238 {
2239 	u_int32_t pi, ci;
2240 	int error;
2241 	u_int32_t fib_size;
2242 	u_int32_t fib_addr;
2243 
2244 	debug_called(1);
2245 
2246 	/* Tell the adapter where the FIB is */
2247 	fib_size = fib->Header.Size;
2248 	fib_addr = fib->Header.SenderFibAddress;
2249 	fib->Header.ReceiverFibAddress = fib_addr;
2250 
2251 	/* get the producer/consumer indices */
2252 	pi = sc->aac_queues->qt_qindex[queue][AAC_PRODUCER_INDEX];
2253 	ci = sc->aac_queues->qt_qindex[queue][AAC_CONSUMER_INDEX];
2254 
2255 	/* wrap the queue? */
2256 	if (pi >= aac_qinfo[queue].size)
2257 		pi = 0;
2258 
2259 	/* check for queue full */
2260 	if ((pi + 1) == ci) {
2261 		error = EBUSY;
2262 		goto out;
2263 	}
2264 
2265 	/* populate queue entry */
2266 	(sc->aac_qentries[queue] + pi)->aq_fib_size = fib_size;
2267 	(sc->aac_qentries[queue] + pi)->aq_fib_addr = fib_addr;
2268 
2269 	/* update producer index */
2270 	sc->aac_queues->qt_qindex[queue][AAC_PRODUCER_INDEX] = pi + 1;
2271 
2272 	/* notify the adapter if we know how */
2273 	if (aac_qinfo[queue].notify != 0)
2274 		AAC_QNOTIFY(sc, aac_qinfo[queue].notify);
2275 
2276 	error = 0;
2277 
2278 out:
2279 	return(error);
2280 }
2281 
2282 /*
2283  * Check for commands that have been outstanding for a suspiciously long time,
2284  * and complain about them.
2285  */
2286 static void
2287 aac_timeout(struct aac_softc *sc)
2288 {
2289 	struct aac_command *cm;
2290 	time_t deadline;
2291 	int timedout, code;
2292 
2293 	/*
2294 	 * Traverse the busy command list, bitch about late commands once
2295 	 * only.
2296 	 */
2297 	timedout = 0;
2298 	deadline = time_uptime - AAC_CMD_TIMEOUT;
2299 	TAILQ_FOREACH(cm, &sc->aac_busy, cm_link) {
2300 		if ((cm->cm_timestamp  < deadline)
2301 			/* && !(cm->cm_flags & AAC_CMD_TIMEDOUT) */) {
2302 			cm->cm_flags |= AAC_CMD_TIMEDOUT;
2303 			device_printf(sc->aac_dev,
2304 				      "COMMAND %p TIMEOUT AFTER %d SECONDS\n",
2305 				      cm, (int)(time_uptime-cm->cm_timestamp));
2306 			AAC_PRINT_FIB(sc, cm->cm_fib);
2307 			timedout++;
2308 		}
2309 	}
2310 
2311 	if (timedout) {
2312 		code = AAC_GET_FWSTATUS(sc);
2313 		if (code != AAC_UP_AND_RUNNING) {
2314 			device_printf(sc->aac_dev, "WARNING! Controller is no "
2315 				      "longer running! code= 0x%x\n", code);
2316 		}
2317 	}
2318 	return;
2319 }
2320 
2321 /*
2322  * Interface Function Vectors
2323  */
2324 
2325 /*
2326  * Read the current firmware status word.
2327  */
2328 static int
2329 aac_sa_get_fwstatus(struct aac_softc *sc)
2330 {
2331 	debug_called(3);
2332 
2333 	return(AAC_GETREG4(sc, AAC_SA_FWSTATUS));
2334 }
2335 
2336 static int
2337 aac_rx_get_fwstatus(struct aac_softc *sc)
2338 {
2339 	debug_called(3);
2340 
2341 	return(AAC_GETREG4(sc, AAC_RX_FWSTATUS));
2342 }
2343 
2344 static int
2345 aac_fa_get_fwstatus(struct aac_softc *sc)
2346 {
2347 	int val;
2348 
2349 	debug_called(3);
2350 
2351 	val = AAC_GETREG4(sc, AAC_FA_FWSTATUS);
2352 	return (val);
2353 }
2354 
2355 static int
2356 aac_rkt_get_fwstatus(struct aac_softc *sc)
2357 {
2358 	debug_called(3);
2359 
2360 	return(AAC_GETREG4(sc, AAC_RKT_FWSTATUS));
2361 }
2362 
2363 /*
2364  * Notify the controller of a change in a given queue
2365  */
2366 
2367 static void
2368 aac_sa_qnotify(struct aac_softc *sc, int qbit)
2369 {
2370 	debug_called(3);
2371 
2372 	AAC_SETREG2(sc, AAC_SA_DOORBELL1_SET, qbit);
2373 }
2374 
2375 static void
2376 aac_rx_qnotify(struct aac_softc *sc, int qbit)
2377 {
2378 	debug_called(3);
2379 
2380 	AAC_SETREG4(sc, AAC_RX_IDBR, qbit);
2381 }
2382 
2383 static void
2384 aac_fa_qnotify(struct aac_softc *sc, int qbit)
2385 {
2386 	debug_called(3);
2387 
2388 	AAC_SETREG2(sc, AAC_FA_DOORBELL1, qbit);
2389 	AAC_FA_HACK(sc);
2390 }
2391 
2392 static void
2393 aac_rkt_qnotify(struct aac_softc *sc, int qbit)
2394 {
2395 	debug_called(3);
2396 
2397 	AAC_SETREG4(sc, AAC_RKT_IDBR, qbit);
2398 }
2399 
2400 /*
2401  * Get the interrupt reason bits
2402  */
2403 static int
2404 aac_sa_get_istatus(struct aac_softc *sc)
2405 {
2406 	debug_called(3);
2407 
2408 	return(AAC_GETREG2(sc, AAC_SA_DOORBELL0));
2409 }
2410 
2411 static int
2412 aac_rx_get_istatus(struct aac_softc *sc)
2413 {
2414 	debug_called(3);
2415 
2416 	return(AAC_GETREG4(sc, AAC_RX_ODBR));
2417 }
2418 
2419 static int
2420 aac_fa_get_istatus(struct aac_softc *sc)
2421 {
2422 	int val;
2423 
2424 	debug_called(3);
2425 
2426 	val = AAC_GETREG2(sc, AAC_FA_DOORBELL0);
2427 	return (val);
2428 }
2429 
2430 static int
2431 aac_rkt_get_istatus(struct aac_softc *sc)
2432 {
2433 	debug_called(3);
2434 
2435 	return(AAC_GETREG4(sc, AAC_RKT_ODBR));
2436 }
2437 
2438 /*
2439  * Clear some interrupt reason bits
2440  */
2441 static void
2442 aac_sa_clear_istatus(struct aac_softc *sc, int mask)
2443 {
2444 	debug_called(3);
2445 
2446 	AAC_SETREG2(sc, AAC_SA_DOORBELL0_CLEAR, mask);
2447 }
2448 
2449 static void
2450 aac_rx_clear_istatus(struct aac_softc *sc, int mask)
2451 {
2452 	debug_called(3);
2453 
2454 	AAC_SETREG4(sc, AAC_RX_ODBR, mask);
2455 }
2456 
2457 static void
2458 aac_fa_clear_istatus(struct aac_softc *sc, int mask)
2459 {
2460 	debug_called(3);
2461 
2462 	AAC_SETREG2(sc, AAC_FA_DOORBELL0_CLEAR, mask);
2463 	AAC_FA_HACK(sc);
2464 }
2465 
2466 static void
2467 aac_rkt_clear_istatus(struct aac_softc *sc, int mask)
2468 {
2469 	debug_called(3);
2470 
2471 	AAC_SETREG4(sc, AAC_RKT_ODBR, mask);
2472 }
2473 
2474 /*
2475  * Populate the mailbox and set the command word
2476  */
2477 static void
2478 aac_sa_set_mailbox(struct aac_softc *sc, u_int32_t command,
2479 		u_int32_t arg0, u_int32_t arg1, u_int32_t arg2, u_int32_t arg3)
2480 {
2481 	debug_called(4);
2482 
2483 	AAC_SETREG4(sc, AAC_SA_MAILBOX, command);
2484 	AAC_SETREG4(sc, AAC_SA_MAILBOX + 4, arg0);
2485 	AAC_SETREG4(sc, AAC_SA_MAILBOX + 8, arg1);
2486 	AAC_SETREG4(sc, AAC_SA_MAILBOX + 12, arg2);
2487 	AAC_SETREG4(sc, AAC_SA_MAILBOX + 16, arg3);
2488 }
2489 
2490 static void
2491 aac_rx_set_mailbox(struct aac_softc *sc, u_int32_t command,
2492 		u_int32_t arg0, u_int32_t arg1, u_int32_t arg2, u_int32_t arg3)
2493 {
2494 	debug_called(4);
2495 
2496 	AAC_SETREG4(sc, AAC_RX_MAILBOX, command);
2497 	AAC_SETREG4(sc, AAC_RX_MAILBOX + 4, arg0);
2498 	AAC_SETREG4(sc, AAC_RX_MAILBOX + 8, arg1);
2499 	AAC_SETREG4(sc, AAC_RX_MAILBOX + 12, arg2);
2500 	AAC_SETREG4(sc, AAC_RX_MAILBOX + 16, arg3);
2501 }
2502 
2503 static void
2504 aac_fa_set_mailbox(struct aac_softc *sc, u_int32_t command,
2505 		u_int32_t arg0, u_int32_t arg1, u_int32_t arg2, u_int32_t arg3)
2506 {
2507 	debug_called(4);
2508 
2509 	AAC_SETREG4(sc, AAC_FA_MAILBOX, command);
2510 	AAC_FA_HACK(sc);
2511 	AAC_SETREG4(sc, AAC_FA_MAILBOX + 4, arg0);
2512 	AAC_FA_HACK(sc);
2513 	AAC_SETREG4(sc, AAC_FA_MAILBOX + 8, arg1);
2514 	AAC_FA_HACK(sc);
2515 	AAC_SETREG4(sc, AAC_FA_MAILBOX + 12, arg2);
2516 	AAC_FA_HACK(sc);
2517 	AAC_SETREG4(sc, AAC_FA_MAILBOX + 16, arg3);
2518 	AAC_FA_HACK(sc);
2519 }
2520 
2521 static void
2522 aac_rkt_set_mailbox(struct aac_softc *sc, u_int32_t command, u_int32_t arg0,
2523 		    u_int32_t arg1, u_int32_t arg2, u_int32_t arg3)
2524 {
2525 	debug_called(4);
2526 
2527 	AAC_SETREG4(sc, AAC_RKT_MAILBOX, command);
2528 	AAC_SETREG4(sc, AAC_RKT_MAILBOX + 4, arg0);
2529 	AAC_SETREG4(sc, AAC_RKT_MAILBOX + 8, arg1);
2530 	AAC_SETREG4(sc, AAC_RKT_MAILBOX + 12, arg2);
2531 	AAC_SETREG4(sc, AAC_RKT_MAILBOX + 16, arg3);
2532 }
2533 
2534 /*
2535  * Fetch the immediate command status word
2536  */
2537 static int
2538 aac_sa_get_mailbox(struct aac_softc *sc, int mb)
2539 {
2540 	debug_called(4);
2541 
2542 	return(AAC_GETREG4(sc, AAC_SA_MAILBOX + (mb * 4)));
2543 }
2544 
2545 static int
2546 aac_rx_get_mailbox(struct aac_softc *sc, int mb)
2547 {
2548 	debug_called(4);
2549 
2550 	return(AAC_GETREG4(sc, AAC_RX_MAILBOX + (mb * 4)));
2551 }
2552 
2553 static int
2554 aac_fa_get_mailbox(struct aac_softc *sc, int mb)
2555 {
2556 	int val;
2557 
2558 	debug_called(4);
2559 
2560 	val = AAC_GETREG4(sc, AAC_FA_MAILBOX + (mb * 4));
2561 	return (val);
2562 }
2563 
2564 static int
2565 aac_rkt_get_mailbox(struct aac_softc *sc, int mb)
2566 {
2567 	debug_called(4);
2568 
2569 	return(AAC_GETREG4(sc, AAC_RKT_MAILBOX + (mb * 4)));
2570 }
2571 
2572 /*
2573  * Set/clear interrupt masks
2574  */
2575 static void
2576 aac_sa_set_interrupts(struct aac_softc *sc, int enable)
2577 {
2578 	debug(2, "%sable interrupts", enable ? "en" : "dis");
2579 
2580 	if (enable) {
2581 		AAC_SETREG2((sc), AAC_SA_MASK0_CLEAR, AAC_DB_INTERRUPTS);
2582 	} else {
2583 		AAC_SETREG2((sc), AAC_SA_MASK0_SET, ~0);
2584 	}
2585 }
2586 
2587 static void
2588 aac_rx_set_interrupts(struct aac_softc *sc, int enable)
2589 {
2590 	debug(2, "%sable interrupts", enable ? "en" : "dis");
2591 
2592 	if (enable) {
2593 		if (sc->flags & AAC_FLAGS_NEW_COMM)
2594 			AAC_SETREG4(sc, AAC_RX_OIMR, ~AAC_DB_INT_NEW_COMM);
2595 		else
2596 			AAC_SETREG4(sc, AAC_RX_OIMR, ~AAC_DB_INTERRUPTS);
2597 	} else {
2598 		AAC_SETREG4(sc, AAC_RX_OIMR, ~0);
2599 	}
2600 }
2601 
2602 static void
2603 aac_fa_set_interrupts(struct aac_softc *sc, int enable)
2604 {
2605 	debug(2, "%sable interrupts", enable ? "en" : "dis");
2606 
2607 	if (enable) {
2608 		AAC_SETREG2((sc), AAC_FA_MASK0_CLEAR, AAC_DB_INTERRUPTS);
2609 		AAC_FA_HACK(sc);
2610 	} else {
2611 		AAC_SETREG2((sc), AAC_FA_MASK0, ~0);
2612 		AAC_FA_HACK(sc);
2613 	}
2614 }
2615 
2616 static void
2617 aac_rkt_set_interrupts(struct aac_softc *sc, int enable)
2618 {
2619 	debug(2, "%sable interrupts", enable ? "en" : "dis");
2620 
2621 	if (enable) {
2622 		if (sc->flags & AAC_FLAGS_NEW_COMM)
2623 			AAC_SETREG4(sc, AAC_RKT_OIMR, ~AAC_DB_INT_NEW_COMM);
2624 		else
2625 			AAC_SETREG4(sc, AAC_RKT_OIMR, ~AAC_DB_INTERRUPTS);
2626 	} else {
2627 		AAC_SETREG4(sc, AAC_RKT_OIMR, ~0);
2628 	}
2629 }
2630 
2631 /*
2632  * New comm. interface: Send command functions
2633  */
2634 static int
2635 aac_rx_send_command(struct aac_softc *sc, struct aac_command *cm)
2636 {
2637 	u_int32_t index, device;
2638 
2639 	debug(2, "send command (new comm.)");
2640 
2641 	index = AAC_GETREG4(sc, AAC_RX_IQUE);
2642 	if (index == 0xffffffffL)
2643 		index = AAC_GETREG4(sc, AAC_RX_IQUE);
2644 	if (index == 0xffffffffL)
2645 		return index;
2646 	aac_enqueue_busy(cm);
2647 	device = index;
2648 	AAC_SETREG4(sc, device, (u_int32_t)(cm->cm_fibphys & 0xffffffffUL));
2649 	device += 4;
2650 	AAC_SETREG4(sc, device, (u_int32_t)(cm->cm_fibphys >> 32));
2651 	device += 4;
2652 	AAC_SETREG4(sc, device, cm->cm_fib->Header.Size);
2653 	AAC_SETREG4(sc, AAC_RX_IQUE, index);
2654 	return 0;
2655 }
2656 
2657 static int
2658 aac_rkt_send_command(struct aac_softc *sc, struct aac_command *cm)
2659 {
2660 	u_int32_t index, device;
2661 
2662 	debug(2, "send command (new comm.)");
2663 
2664 	index = AAC_GETREG4(sc, AAC_RKT_IQUE);
2665 	if (index == 0xffffffffL)
2666 		index = AAC_GETREG4(sc, AAC_RKT_IQUE);
2667 	if (index == 0xffffffffL)
2668 		return index;
2669 	aac_enqueue_busy(cm);
2670 	device = index;
2671 	AAC_SETREG4(sc, device, (u_int32_t)(cm->cm_fibphys & 0xffffffffUL));
2672 	device += 4;
2673 	AAC_SETREG4(sc, device, (u_int32_t)(cm->cm_fibphys >> 32));
2674 	device += 4;
2675 	AAC_SETREG4(sc, device, cm->cm_fib->Header.Size);
2676 	AAC_SETREG4(sc, AAC_RKT_IQUE, index);
2677 	return 0;
2678 }
2679 
2680 /*
2681  * New comm. interface: get, set outbound queue index
2682  */
2683 static int
2684 aac_rx_get_outb_queue(struct aac_softc *sc)
2685 {
2686 	debug_called(3);
2687 
2688 	return(AAC_GETREG4(sc, AAC_RX_OQUE));
2689 }
2690 
2691 static int
2692 aac_rkt_get_outb_queue(struct aac_softc *sc)
2693 {
2694 	debug_called(3);
2695 
2696 	return(AAC_GETREG4(sc, AAC_RKT_OQUE));
2697 }
2698 
2699 static void
2700 aac_rx_set_outb_queue(struct aac_softc *sc, int index)
2701 {
2702 	debug_called(3);
2703 
2704 	AAC_SETREG4(sc, AAC_RX_OQUE, index);
2705 }
2706 
2707 static void
2708 aac_rkt_set_outb_queue(struct aac_softc *sc, int index)
2709 {
2710 	debug_called(3);
2711 
2712 	AAC_SETREG4(sc, AAC_RKT_OQUE, index);
2713 }
2714 
2715 /*
2716  * Debugging and Diagnostics
2717  */
2718 
2719 /*
2720  * Print some information about the controller.
2721  */
2722 static void
2723 aac_describe_controller(struct aac_softc *sc)
2724 {
2725 	struct aac_fib *fib;
2726 	struct aac_adapter_info	*info;
2727 
2728 	debug_called(2);
2729 
2730 	mtx_lock(&sc->aac_io_lock);
2731 	aac_alloc_sync_fib(sc, &fib);
2732 
2733 	fib->data[0] = 0;
2734 	if (aac_sync_fib(sc, RequestAdapterInfo, 0, fib, 1)) {
2735 		device_printf(sc->aac_dev, "RequestAdapterInfo failed\n");
2736 		aac_release_sync_fib(sc);
2737 		mtx_unlock(&sc->aac_io_lock);
2738 		return;
2739 	}
2740 
2741 	/* save the kernel revision structure for later use */
2742 	info = (struct aac_adapter_info *)&fib->data[0];
2743 	sc->aac_revision = info->KernelRevision;
2744 
2745 	device_printf(sc->aac_dev, "Adaptec Raid Controller %d.%d.%d-%d\n",
2746 		AAC_DRIVER_VERSION >> 24,
2747 		(AAC_DRIVER_VERSION >> 16) & 0xFF,
2748 		AAC_DRIVER_VERSION & 0xFF,
2749 		AAC_DRIVER_BUILD);
2750 
2751 	if (bootverbose) {
2752 		device_printf(sc->aac_dev, "%s %dMHz, %dMB memory "
2753 		    "(%dMB cache, %dMB execution), %s\n",
2754 		    aac_describe_code(aac_cpu_variant, info->CpuVariant),
2755 		    info->ClockSpeed, info->TotalMem / (1024 * 1024),
2756 		    info->BufferMem / (1024 * 1024),
2757 		    info->ExecutionMem / (1024 * 1024),
2758 		    aac_describe_code(aac_battery_platform,
2759 		    info->batteryPlatform));
2760 
2761 		device_printf(sc->aac_dev,
2762 		    "Kernel %d.%d-%d, Build %d, S/N %6X\n",
2763 		    info->KernelRevision.external.comp.major,
2764 		    info->KernelRevision.external.comp.minor,
2765 		    info->KernelRevision.external.comp.dash,
2766 		    info->KernelRevision.buildNumber,
2767 		    (u_int32_t)(info->SerialNumber & 0xffffff));
2768 
2769 		device_printf(sc->aac_dev, "Supported Options=%b\n",
2770 			      sc->supported_options,
2771 			      "\20"
2772 			      "\1SNAPSHOT"
2773 			      "\2CLUSTERS"
2774 			      "\3WCACHE"
2775 			      "\4DATA64"
2776 			      "\5HOSTTIME"
2777 			      "\6RAID50"
2778 			      "\7WINDOW4GB"
2779 			      "\10SCSIUPGD"
2780 			      "\11SOFTERR"
2781 			      "\12NORECOND"
2782 			      "\13SGMAP64"
2783 			      "\14ALARM"
2784 			      "\15NONDASD"
2785 			      "\16SCSIMGT"
2786 			      "\17RAIDSCSI"
2787 			      "\21ADPTINFO"
2788 			      "\22NEWCOMM"
2789 			      "\23ARRAY64BIT"
2790 			      "\24HEATSENSOR");
2791 	}
2792 	aac_release_sync_fib(sc);
2793 	mtx_unlock(&sc->aac_io_lock);
2794 }
2795 
2796 /*
2797  * Look up a text description of a numeric error code and return a pointer to
2798  * same.
2799  */
2800 static char *
2801 aac_describe_code(struct aac_code_lookup *table, u_int32_t code)
2802 {
2803 	int i;
2804 
2805 	for (i = 0; table[i].string != NULL; i++)
2806 		if (table[i].code == code)
2807 			return(table[i].string);
2808 	return(table[i + 1].string);
2809 }
2810 
2811 /*
2812  * Management Interface
2813  */
2814 
2815 static int
2816 aac_open(struct cdev *dev, int flags, int fmt, d_thread_t *td)
2817 {
2818 	struct aac_softc *sc;
2819 
2820 	debug_called(2);
2821 
2822 	sc = dev->si_drv1;
2823 
2824 	/* Check to make sure the device isn't already open */
2825 	if (sc->aac_state & AAC_STATE_OPEN) {
2826 		return EBUSY;
2827 	}
2828 	sc->aac_state |= AAC_STATE_OPEN;
2829 
2830 	return 0;
2831 }
2832 
2833 static int
2834 aac_close(struct cdev *dev, int flags, int fmt, d_thread_t *td)
2835 {
2836 	struct aac_softc *sc;
2837 
2838 	debug_called(2);
2839 
2840 	sc = dev->si_drv1;
2841 
2842 	/* Mark this unit as no longer open  */
2843 	sc->aac_state &= ~AAC_STATE_OPEN;
2844 
2845 	return 0;
2846 }
2847 
2848 static int
2849 aac_ioctl(struct cdev *dev, u_long cmd, caddr_t arg, int flag, d_thread_t *td)
2850 {
2851 	union aac_statrequest *as;
2852 	struct aac_softc *sc;
2853 	int error = 0;
2854 	uint32_t cookie;
2855 
2856 	debug_called(2);
2857 
2858 	as = (union aac_statrequest *)arg;
2859 	sc = dev->si_drv1;
2860 
2861 	switch (cmd) {
2862 	case AACIO_STATS:
2863 		switch (as->as_item) {
2864 		case AACQ_FREE:
2865 		case AACQ_BIO:
2866 		case AACQ_READY:
2867 		case AACQ_BUSY:
2868 			bcopy(&sc->aac_qstat[as->as_item], &as->as_qstat,
2869 			      sizeof(struct aac_qstat));
2870 			break;
2871 		default:
2872 			error = ENOENT;
2873 			break;
2874 		}
2875 	break;
2876 
2877 	case FSACTL_SENDFIB:
2878 		arg = *(caddr_t*)arg;
2879 	case FSACTL_LNX_SENDFIB:
2880 		debug(1, "FSACTL_SENDFIB");
2881 		error = aac_ioctl_sendfib(sc, arg);
2882 		break;
2883 	case FSACTL_AIF_THREAD:
2884 	case FSACTL_LNX_AIF_THREAD:
2885 		debug(1, "FSACTL_AIF_THREAD");
2886 		error = EINVAL;
2887 		break;
2888 	case FSACTL_OPEN_GET_ADAPTER_FIB:
2889 		arg = *(caddr_t*)arg;
2890 	case FSACTL_LNX_OPEN_GET_ADAPTER_FIB:
2891 		debug(1, "FSACTL_OPEN_GET_ADAPTER_FIB");
2892 		/*
2893 		 * Pass the caller out an AdapterFibContext.
2894 		 *
2895 		 * Note that because we only support one opener, we
2896 		 * basically ignore this.  Set the caller's context to a magic
2897 		 * number just in case.
2898 		 *
2899 		 * The Linux code hands the driver a pointer into kernel space,
2900 		 * and then trusts it when the caller hands it back.  Aiee!
2901 		 * Here, we give it the proc pointer of the per-adapter aif
2902 		 * thread. It's only used as a sanity check in other calls.
2903 		 */
2904 		cookie = (uint32_t)(uintptr_t)sc->aifthread;
2905 		error = copyout(&cookie, arg, sizeof(cookie));
2906 		break;
2907 	case FSACTL_GET_NEXT_ADAPTER_FIB:
2908 		arg = *(caddr_t*)arg;
2909 	case FSACTL_LNX_GET_NEXT_ADAPTER_FIB:
2910 		debug(1, "FSACTL_GET_NEXT_ADAPTER_FIB");
2911 		error = aac_getnext_aif(sc, arg);
2912 		break;
2913 	case FSACTL_CLOSE_GET_ADAPTER_FIB:
2914 	case FSACTL_LNX_CLOSE_GET_ADAPTER_FIB:
2915 		debug(1, "FSACTL_CLOSE_GET_ADAPTER_FIB");
2916 		/* don't do anything here */
2917 		break;
2918 	case FSACTL_MINIPORT_REV_CHECK:
2919 		arg = *(caddr_t*)arg;
2920 	case FSACTL_LNX_MINIPORT_REV_CHECK:
2921 		debug(1, "FSACTL_MINIPORT_REV_CHECK");
2922 		error = aac_rev_check(sc, arg);
2923 		break;
2924 	case FSACTL_QUERY_DISK:
2925 		arg = *(caddr_t*)arg;
2926 	case FSACTL_LNX_QUERY_DISK:
2927 		debug(1, "FSACTL_QUERY_DISK");
2928 		error = aac_query_disk(sc, arg);
2929 		break;
2930 	case FSACTL_DELETE_DISK:
2931 	case FSACTL_LNX_DELETE_DISK:
2932 		/*
2933 		 * We don't trust the underland to tell us when to delete a
2934 		 * container, rather we rely on an AIF coming from the
2935 		 * controller
2936 		 */
2937 		error = 0;
2938 		break;
2939 	case FSACTL_GET_PCI_INFO:
2940 		arg = *(caddr_t*)arg;
2941 	case FSACTL_LNX_GET_PCI_INFO:
2942 		debug(1, "FSACTL_GET_PCI_INFO");
2943 		error = aac_get_pci_info(sc, arg);
2944 		break;
2945 	default:
2946 		debug(1, "unsupported cmd 0x%lx\n", cmd);
2947 		error = EINVAL;
2948 		break;
2949 	}
2950 	return(error);
2951 }
2952 
2953 static int
2954 aac_poll(struct cdev *dev, int poll_events, d_thread_t *td)
2955 {
2956 	struct aac_softc *sc;
2957 	int revents;
2958 
2959 	sc = dev->si_drv1;
2960 	revents = 0;
2961 
2962 	mtx_lock(&sc->aac_aifq_lock);
2963 	if ((poll_events & (POLLRDNORM | POLLIN)) != 0) {
2964 		if (sc->aac_aifq_tail != sc->aac_aifq_head)
2965 			revents |= poll_events & (POLLIN | POLLRDNORM);
2966 	}
2967 	mtx_unlock(&sc->aac_aifq_lock);
2968 
2969 	if (revents == 0) {
2970 		if (poll_events & (POLLIN | POLLRDNORM))
2971 			selrecord(td, &sc->rcv_select);
2972 	}
2973 
2974 	return (revents);
2975 }
2976 
2977 static void
2978 aac_ioctl_event(struct aac_softc *sc, struct aac_event *event, void *arg)
2979 {
2980 
2981 	switch (event->ev_type) {
2982 	case AAC_EVENT_CMFREE:
2983 		mtx_lock(&sc->aac_io_lock);
2984 		if (aac_alloc_command(sc, (struct aac_command **)arg) == 0) {
2985 			aac_add_event(sc, event);
2986 			mtx_unlock(&sc->aac_io_lock);
2987 			return;
2988 		}
2989 		free(event, M_AACBUF);
2990 		wakeup(arg);
2991 		mtx_unlock(&sc->aac_io_lock);
2992 		break;
2993 	default:
2994 		break;
2995 	}
2996 }
2997 
2998 /*
2999  * Send a FIB supplied from userspace
3000  */
3001 static int
3002 aac_ioctl_sendfib(struct aac_softc *sc, caddr_t ufib)
3003 {
3004 	struct aac_command *cm;
3005 	int size, error;
3006 
3007 	debug_called(2);
3008 
3009 	cm = NULL;
3010 
3011 	/*
3012 	 * Get a command
3013 	 */
3014 	mtx_lock(&sc->aac_io_lock);
3015 	if (aac_alloc_command(sc, &cm)) {
3016 		struct aac_event *event;
3017 
3018 		event = malloc(sizeof(struct aac_event), M_AACBUF,
3019 		    M_NOWAIT | M_ZERO);
3020 		if (event == NULL) {
3021 			error = EBUSY;
3022 			goto out;
3023 		}
3024 		event->ev_type = AAC_EVENT_CMFREE;
3025 		event->ev_callback = aac_ioctl_event;
3026 		event->ev_arg = &cm;
3027 		aac_add_event(sc, event);
3028 		msleep(&cm, &sc->aac_io_lock, 0, "sendfib", 0);
3029 	}
3030 
3031 	/*
3032 	 * Fetch the FIB header, then re-copy to get data as well.
3033 	 */
3034 	if ((error = copyin(ufib, cm->cm_fib,
3035 			    sizeof(struct aac_fib_header))) != 0)
3036 		goto out;
3037 	size = cm->cm_fib->Header.Size + sizeof(struct aac_fib_header);
3038 	if (size > sizeof(struct aac_fib)) {
3039 		device_printf(sc->aac_dev, "incoming FIB oversized (%d > %zd)\n",
3040 			      size, sizeof(struct aac_fib));
3041 		size = sizeof(struct aac_fib);
3042 	}
3043 	if ((error = copyin(ufib, cm->cm_fib, size)) != 0)
3044 		goto out;
3045 	cm->cm_fib->Header.Size = size;
3046 	cm->cm_timestamp = time_uptime;
3047 
3048 	/*
3049 	 * Pass the FIB to the controller, wait for it to complete.
3050 	 */
3051 	if ((error = aac_wait_command(cm)) != 0) {
3052 		device_printf(sc->aac_dev,
3053 			      "aac_wait_command return %d\n", error);
3054 		goto out;
3055 	}
3056 
3057 	/*
3058 	 * Copy the FIB and data back out to the caller.
3059 	 */
3060 	size = cm->cm_fib->Header.Size;
3061 	if (size > sizeof(struct aac_fib)) {
3062 		device_printf(sc->aac_dev, "outbound FIB oversized (%d > %zd)\n",
3063 			      size, sizeof(struct aac_fib));
3064 		size = sizeof(struct aac_fib);
3065 	}
3066 	error = copyout(cm->cm_fib, ufib, size);
3067 
3068 out:
3069 	if (cm != NULL) {
3070 		aac_release_command(cm);
3071 	}
3072 
3073 	mtx_unlock(&sc->aac_io_lock);
3074 	return(error);
3075 }
3076 
3077 /*
3078  * Handle an AIF sent to us by the controller; queue it for later reference.
3079  * If the queue fills up, then drop the older entries.
3080  */
3081 static void
3082 aac_handle_aif(struct aac_softc *sc, struct aac_fib *fib)
3083 {
3084 	struct aac_aif_command *aif;
3085 	struct aac_container *co, *co_next;
3086 	struct aac_mntinfo *mi;
3087 	struct aac_mntinforesp *mir = NULL;
3088 	u_int16_t rsize;
3089 	int next, found;
3090 	int count = 0, added = 0, i = 0;
3091 
3092 	debug_called(2);
3093 
3094 	aif = (struct aac_aif_command*)&fib->data[0];
3095 	aac_print_aif(sc, aif);
3096 
3097 	/* Is it an event that we should care about? */
3098 	switch (aif->command) {
3099 	case AifCmdEventNotify:
3100 		switch (aif->data.EN.type) {
3101 		case AifEnAddContainer:
3102 		case AifEnDeleteContainer:
3103 			/*
3104 			 * A container was added or deleted, but the message
3105 			 * doesn't tell us anything else!  Re-enumerate the
3106 			 * containers and sort things out.
3107 			 */
3108 			aac_alloc_sync_fib(sc, &fib);
3109 			mi = (struct aac_mntinfo *)&fib->data[0];
3110 			do {
3111 				/*
3112 				 * Ask the controller for its containers one at
3113 				 * a time.
3114 				 * XXX What if the controller's list changes
3115 				 * midway through this enumaration?
3116 				 * XXX This should be done async.
3117 				 */
3118 				bzero(mi, sizeof(struct aac_mntinfo));
3119 				mi->Command = VM_NameServe;
3120 				mi->MntType = FT_FILESYS;
3121 				mi->MntCount = i;
3122 				rsize = sizeof(mir);
3123 				if (aac_sync_fib(sc, ContainerCommand, 0, fib,
3124 						 sizeof(struct aac_mntinfo))) {
3125 					printf("Error probing container %d\n",
3126 					      i);
3127 					continue;
3128 				}
3129 				mir = (struct aac_mntinforesp *)&fib->data[0];
3130 				/* XXX Need to check if count changed */
3131 				count = mir->MntRespCount;
3132 				/*
3133 				 * Check the container against our list.
3134 				 * co->co_found was already set to 0 in a
3135 				 * previous run.
3136 				 */
3137 				if ((mir->Status == ST_OK) &&
3138 				    (mir->MntTable[0].VolType != CT_NONE)) {
3139 					found = 0;
3140 					TAILQ_FOREACH(co,
3141 						      &sc->aac_container_tqh,
3142 						      co_link) {
3143 						if (co->co_mntobj.ObjectId ==
3144 						    mir->MntTable[0].ObjectId) {
3145 							co->co_found = 1;
3146 							found = 1;
3147 							break;
3148 						}
3149 					}
3150 					/*
3151 					 * If the container matched, continue
3152 					 * in the list.
3153 					 */
3154 					if (found) {
3155 						i++;
3156 						continue;
3157 					}
3158 
3159 					/*
3160 					 * This is a new container.  Do all the
3161 					 * appropriate things to set it up.
3162 					 */
3163 					aac_add_container(sc, mir, 1);
3164 					added = 1;
3165 				}
3166 				i++;
3167 			} while ((i < count) && (i < AAC_MAX_CONTAINERS));
3168 			aac_release_sync_fib(sc);
3169 
3170 			/*
3171 			 * Go through our list of containers and see which ones
3172 			 * were not marked 'found'.  Since the controller didn't
3173 			 * list them they must have been deleted.  Do the
3174 			 * appropriate steps to destroy the device.  Also reset
3175 			 * the co->co_found field.
3176 			 */
3177 			co = TAILQ_FIRST(&sc->aac_container_tqh);
3178 			while (co != NULL) {
3179 				if (co->co_found == 0) {
3180 					mtx_unlock(&sc->aac_io_lock);
3181 					mtx_lock(&Giant);
3182 					device_delete_child(sc->aac_dev,
3183 							    co->co_disk);
3184 					mtx_unlock(&Giant);
3185 					mtx_lock(&sc->aac_io_lock);
3186 					co_next = TAILQ_NEXT(co, co_link);
3187 					mtx_lock(&sc->aac_container_lock);
3188 					TAILQ_REMOVE(&sc->aac_container_tqh, co,
3189 						     co_link);
3190 					mtx_unlock(&sc->aac_container_lock);
3191 					free(co, M_AACBUF);
3192 					co = co_next;
3193 				} else {
3194 					co->co_found = 0;
3195 					co = TAILQ_NEXT(co, co_link);
3196 				}
3197 			}
3198 
3199 			/* Attach the newly created containers */
3200 			if (added) {
3201 				mtx_unlock(&sc->aac_io_lock);
3202 				mtx_lock(&Giant);
3203 				bus_generic_attach(sc->aac_dev);
3204 				mtx_unlock(&Giant);
3205 				mtx_lock(&sc->aac_io_lock);
3206 			}
3207 
3208 			break;
3209 
3210 		default:
3211 			break;
3212 		}
3213 
3214 	default:
3215 		break;
3216 	}
3217 
3218 	/* Copy the AIF data to the AIF queue for ioctl retrieval */
3219 	mtx_lock(&sc->aac_aifq_lock);
3220 	next = (sc->aac_aifq_head + 1) % AAC_AIFQ_LENGTH;
3221 	if (next != sc->aac_aifq_tail) {
3222 		bcopy(aif, &sc->aac_aifq[next], sizeof(struct aac_aif_command));
3223 		sc->aac_aifq_head = next;
3224 
3225 		/* On the off chance that someone is sleeping for an aif... */
3226 		if (sc->aac_state & AAC_STATE_AIF_SLEEPER)
3227 			wakeup(sc->aac_aifq);
3228 		/* Wakeup any poll()ers */
3229 		selwakeuppri(&sc->rcv_select, PRIBIO);
3230 	}
3231 	mtx_unlock(&sc->aac_aifq_lock);
3232 
3233 	return;
3234 }
3235 
3236 /*
3237  * Return the Revision of the driver to userspace and check to see if the
3238  * userspace app is possibly compatible.  This is extremely bogus since
3239  * our driver doesn't follow Adaptec's versioning system.  Cheat by just
3240  * returning what the card reported.
3241  */
3242 static int
3243 aac_rev_check(struct aac_softc *sc, caddr_t udata)
3244 {
3245 	struct aac_rev_check rev_check;
3246 	struct aac_rev_check_resp rev_check_resp;
3247 	int error = 0;
3248 
3249 	debug_called(2);
3250 
3251 	/*
3252 	 * Copyin the revision struct from userspace
3253 	 */
3254 	if ((error = copyin(udata, (caddr_t)&rev_check,
3255 			sizeof(struct aac_rev_check))) != 0) {
3256 		return error;
3257 	}
3258 
3259 	debug(2, "Userland revision= %d\n",
3260 	      rev_check.callingRevision.buildNumber);
3261 
3262 	/*
3263 	 * Doctor up the response struct.
3264 	 */
3265 	rev_check_resp.possiblyCompatible = 1;
3266 	rev_check_resp.adapterSWRevision.external.ul =
3267 	    sc->aac_revision.external.ul;
3268 	rev_check_resp.adapterSWRevision.buildNumber =
3269 	    sc->aac_revision.buildNumber;
3270 
3271 	return(copyout((caddr_t)&rev_check_resp, udata,
3272 			sizeof(struct aac_rev_check_resp)));
3273 }
3274 
3275 /*
3276  * Pass the caller the next AIF in their queue
3277  */
3278 static int
3279 aac_getnext_aif(struct aac_softc *sc, caddr_t arg)
3280 {
3281 	struct get_adapter_fib_ioctl agf;
3282 	int error;
3283 
3284 	debug_called(2);
3285 
3286 	if ((error = copyin(arg, &agf, sizeof(agf))) == 0) {
3287 
3288 		/*
3289 		 * Check the magic number that we gave the caller.
3290 		 */
3291 		if (agf.AdapterFibContext != (int)(uintptr_t)sc->aifthread) {
3292 			error = EFAULT;
3293 		} else {
3294 			error = aac_return_aif(sc, agf.AifFib);
3295 			if ((error == EAGAIN) && (agf.Wait)) {
3296 				sc->aac_state |= AAC_STATE_AIF_SLEEPER;
3297 				while (error == EAGAIN) {
3298 					error = tsleep(sc->aac_aifq, PRIBIO |
3299 						       PCATCH, "aacaif", 0);
3300 					if (error == 0)
3301 						error = aac_return_aif(sc,
3302 						    agf.AifFib);
3303 				}
3304 				sc->aac_state &= ~AAC_STATE_AIF_SLEEPER;
3305 			}
3306 		}
3307 	}
3308 	return(error);
3309 }
3310 
3311 /*
3312  * Hand the next AIF off the top of the queue out to userspace.
3313  */
3314 static int
3315 aac_return_aif(struct aac_softc *sc, caddr_t uptr)
3316 {
3317 	int next, error;
3318 
3319 	debug_called(2);
3320 
3321 	mtx_lock(&sc->aac_aifq_lock);
3322 	if (sc->aac_aifq_tail == sc->aac_aifq_head) {
3323 		mtx_unlock(&sc->aac_aifq_lock);
3324 		return (EAGAIN);
3325 	}
3326 
3327 	next = (sc->aac_aifq_tail + 1) % AAC_AIFQ_LENGTH;
3328 	error = copyout(&sc->aac_aifq[next], uptr,
3329 			sizeof(struct aac_aif_command));
3330 	if (error)
3331 		device_printf(sc->aac_dev,
3332 		    "aac_return_aif: copyout returned %d\n", error);
3333 	else
3334 		sc->aac_aifq_tail = next;
3335 
3336 	mtx_unlock(&sc->aac_aifq_lock);
3337 	return(error);
3338 }
3339 
3340 static int
3341 aac_get_pci_info(struct aac_softc *sc, caddr_t uptr)
3342 {
3343 	struct aac_pci_info {
3344 		u_int32_t bus;
3345 		u_int32_t slot;
3346 	} pciinf;
3347 	int error;
3348 
3349 	debug_called(2);
3350 
3351 	pciinf.bus = pci_get_bus(sc->aac_dev);
3352 	pciinf.slot = pci_get_slot(sc->aac_dev);
3353 
3354 	error = copyout((caddr_t)&pciinf, uptr,
3355 			sizeof(struct aac_pci_info));
3356 
3357 	return (error);
3358 }
3359 
3360 /*
3361  * Give the userland some information about the container.  The AAC arch
3362  * expects the driver to be a SCSI passthrough type driver, so it expects
3363  * the containers to have b:t:l numbers.  Fake it.
3364  */
3365 static int
3366 aac_query_disk(struct aac_softc *sc, caddr_t uptr)
3367 {
3368 	struct aac_query_disk query_disk;
3369 	struct aac_container *co;
3370 	struct aac_disk	*disk;
3371 	int error, id;
3372 
3373 	debug_called(2);
3374 
3375 	disk = NULL;
3376 
3377 	error = copyin(uptr, (caddr_t)&query_disk,
3378 		       sizeof(struct aac_query_disk));
3379 	if (error)
3380 		return (error);
3381 
3382 	id = query_disk.ContainerNumber;
3383 	if (id == -1)
3384 		return (EINVAL);
3385 
3386 	mtx_lock(&sc->aac_container_lock);
3387 	TAILQ_FOREACH(co, &sc->aac_container_tqh, co_link) {
3388 		if (co->co_mntobj.ObjectId == id)
3389 			break;
3390 		}
3391 
3392 	if (co == NULL) {
3393 			query_disk.Valid = 0;
3394 			query_disk.Locked = 0;
3395 			query_disk.Deleted = 1;		/* XXX is this right? */
3396 	} else {
3397 		disk = device_get_softc(co->co_disk);
3398 		query_disk.Valid = 1;
3399 		query_disk.Locked =
3400 		    (disk->ad_flags & AAC_DISK_OPEN) ? 1 : 0;
3401 		query_disk.Deleted = 0;
3402 		query_disk.Bus = device_get_unit(sc->aac_dev);
3403 		query_disk.Target = disk->unit;
3404 		query_disk.Lun = 0;
3405 		query_disk.UnMapped = 0;
3406 		sprintf(&query_disk.diskDeviceName[0], "%s%d",
3407 		        disk->ad_disk->d_name, disk->ad_disk->d_unit);
3408 	}
3409 	mtx_unlock(&sc->aac_container_lock);
3410 
3411 	error = copyout((caddr_t)&query_disk, uptr,
3412 			sizeof(struct aac_query_disk));
3413 
3414 	return (error);
3415 }
3416 
3417 static void
3418 aac_get_bus_info(struct aac_softc *sc)
3419 {
3420 	struct aac_fib *fib;
3421 	struct aac_ctcfg *c_cmd;
3422 	struct aac_ctcfg_resp *c_resp;
3423 	struct aac_vmioctl *vmi;
3424 	struct aac_vmi_businf_resp *vmi_resp;
3425 	struct aac_getbusinf businfo;
3426 	struct aac_sim *caminf;
3427 	device_t child;
3428 	int i, found, error;
3429 
3430 	mtx_lock(&sc->aac_io_lock);
3431 	aac_alloc_sync_fib(sc, &fib);
3432 	c_cmd = (struct aac_ctcfg *)&fib->data[0];
3433 	bzero(c_cmd, sizeof(struct aac_ctcfg));
3434 
3435 	c_cmd->Command = VM_ContainerConfig;
3436 	c_cmd->cmd = CT_GET_SCSI_METHOD;
3437 	c_cmd->param = 0;
3438 
3439 	error = aac_sync_fib(sc, ContainerCommand, 0, fib,
3440 	    sizeof(struct aac_ctcfg));
3441 	if (error) {
3442 		device_printf(sc->aac_dev, "Error %d sending "
3443 		    "VM_ContainerConfig command\n", error);
3444 		aac_release_sync_fib(sc);
3445 		mtx_unlock(&sc->aac_io_lock);
3446 		return;
3447 	}
3448 
3449 	c_resp = (struct aac_ctcfg_resp *)&fib->data[0];
3450 	if (c_resp->Status != ST_OK) {
3451 		device_printf(sc->aac_dev, "VM_ContainerConfig returned 0x%x\n",
3452 		    c_resp->Status);
3453 		aac_release_sync_fib(sc);
3454 		mtx_unlock(&sc->aac_io_lock);
3455 		return;
3456 	}
3457 
3458 	sc->scsi_method_id = c_resp->param;
3459 
3460 	vmi = (struct aac_vmioctl *)&fib->data[0];
3461 	bzero(vmi, sizeof(struct aac_vmioctl));
3462 
3463 	vmi->Command = VM_Ioctl;
3464 	vmi->ObjType = FT_DRIVE;
3465 	vmi->MethId = sc->scsi_method_id;
3466 	vmi->ObjId = 0;
3467 	vmi->IoctlCmd = GetBusInfo;
3468 
3469 	error = aac_sync_fib(sc, ContainerCommand, 0, fib,
3470 	    sizeof(struct aac_vmioctl));
3471 	if (error) {
3472 		device_printf(sc->aac_dev, "Error %d sending VMIoctl command\n",
3473 		    error);
3474 		aac_release_sync_fib(sc);
3475 		mtx_unlock(&sc->aac_io_lock);
3476 		return;
3477 	}
3478 
3479 	vmi_resp = (struct aac_vmi_businf_resp *)&fib->data[0];
3480 	if (vmi_resp->Status != ST_OK) {
3481 		device_printf(sc->aac_dev, "VM_Ioctl returned %d\n",
3482 		    vmi_resp->Status);
3483 		aac_release_sync_fib(sc);
3484 		mtx_unlock(&sc->aac_io_lock);
3485 		return;
3486 	}
3487 
3488 	bcopy(&vmi_resp->BusInf, &businfo, sizeof(struct aac_getbusinf));
3489 	aac_release_sync_fib(sc);
3490 	mtx_unlock(&sc->aac_io_lock);
3491 
3492 	found = 0;
3493 	for (i = 0; i < businfo.BusCount; i++) {
3494 		if (businfo.BusValid[i] != AAC_BUS_VALID)
3495 			continue;
3496 
3497 		caminf = (struct aac_sim *)malloc( sizeof(struct aac_sim),
3498 		    M_AACBUF, M_NOWAIT | M_ZERO);
3499 		if (caminf == NULL) {
3500 			device_printf(sc->aac_dev,
3501 			    "No memory to add passthrough bus %d\n", i);
3502 			break;
3503 		};
3504 
3505 		child = device_add_child(sc->aac_dev, "aacp", -1);
3506 		if (child == NULL) {
3507 			device_printf(sc->aac_dev,
3508 			    "device_add_child failed for passthrough bus %d\n",
3509 			    i);
3510 			free(caminf, M_AACBUF);
3511 			break;
3512 		}
3513 
3514 		caminf->TargetsPerBus = businfo.TargetsPerBus;
3515 		caminf->BusNumber = i;
3516 		caminf->InitiatorBusId = businfo.InitiatorBusId[i];
3517 		caminf->aac_sc = sc;
3518 		caminf->sim_dev = child;
3519 
3520 		device_set_ivars(child, caminf);
3521 		device_set_desc(child, "SCSI Passthrough Bus");
3522 		TAILQ_INSERT_TAIL(&sc->aac_sim_tqh, caminf, sim_link);
3523 
3524 		found = 1;
3525 	}
3526 
3527 	if (found)
3528 		bus_generic_attach(sc->aac_dev);
3529 
3530 	return;
3531 }
3532