MFC r281828, r289083, r289084, r289091, r289093, r289095, r289097, r289098,

    r289104, r289105, r289118:  various i2c fixes...

  Fix numerous issues in iic(4) and iicbus(4):
  --Allow multiple open iic fds by storing addressing state in cdevpriv
  --Fix, as much as possible, the baked-in race conditions in the iic
  ioctl interface by requesting bus ownership on I2CSTART, releasing it on
  I2CSTOP/I2CRSTCARD, and requiring bus ownership by the current cdevpriv
  to use the I/O ioctls
  --Reduce internal iic buffer size and remove 1K read/write limit by
  iteratively calling iicbus_read/iicbus_write
  --Eliminate dynamic allocation in I2CWRITE/I2CREAD
  --Move handling of I2CRDWR to separate function and improve error handling
  --Add new I2CSADDR ioctl to store address in current cdevpriv so that
  I2CSTART is not needed for read(2)/write(2) to work
  --Redesign iicbus_request_bus() and iicbus_release_bus():
      --iicbus_request_bus() no longer falls through if the bus is already
  owned by the requesting device.  Multiple threads on the same device may
  want exclusive access.  Also, iicbus_release_bus() was never
  device-recursive anyway.
      --Previously, if IICBUS_CALLBACK failed in iicbus_release_bus(), but
  the following iicbus_poll() call succeeded, IICBUS_CALLBACK would not be
  issued again
      --Do not hold iicbus mtx during IICBUS_CALLBACK call.  There are
  several drivers that may sleep in IICBUS_CALLBACK, if IIC_WAIT is passed.
      --Do not loop in iicbus_request_bus if IICBUS_CALLBACK returns
  EWOULDBLOCK; instead pass that to the caller so that it can retry if so
  desired.

  Bugfix: Exit the transfer loop if any read or write operation fails.  Also,
  perform a stop operation on the bus if there was an error, otherwise the
  bus will remain hung forever.  Consistantly use 'if (error != 0)' style in
  the function.

  Mostly rewrite the imx i2c driver.  This started out as an attempt to fix
  one specific problem: the driver didn't check for ACK/NAK after writing a
  slave address byte to the bus, and some slaves signal that they are busy
  (such as when completing an internal write to flash memory) by sending a
  NAK in response to being addressed.

  Use IIC_EBUSBSY and IIC_BUSERR status values consistantly across all drivers.
  Make it clearer what each one means in the comments that define them.

  Add iic2errno(), a helper function to translate IIC_Exxxxx status values to
  errno values that are at least vaguely equivelent.  Also add a new status
  value, IIC_ERESOURCE, to indicate a failure to acquire memory or other
  required resources to complete a transaction.

  Return only IIC_Exxxx status values from iicbus-layer functions.  Most of
  these functions are thin wrappers around calling the hardware-layer driver,
  but some of them do sanity checks and return an error.

  Add a short name, IIC_INTRWAIT, for the common case (IIC_INTR | IIC_WAIT).

  Replace a local sx lock that allowed only one client at a time to access
  an eeprom device with iicbus_request/release_bus(), which achieves the
  same effect and also keeps other i2c slave drivers from clashing on the bus.

12 files changed, 518 insertions, 418 deletions

diff --git a/sys/arm/freescale/imx/imx_i2c.c b/sys/arm/freescale/imx/imx_i2c.c
index abcb014..0249275 100644
--- a/sys/arm/freescale/imx/imx_i2c.c
+++ b/sys/arm/freescale/imx/imx_i2c.c
@@ -1,6 +1,7 @@
 /*-
  * Copyright (C) 2008-2009 Semihalf, Michal Hajduk
  * Copyright (c) 2012, 2013 The FreeBSD Foundation
+ * Copyright (c) 2015 Ian Lepore <ian@FreeBSD.org>
  * All rights reserved.
  *
  * Portions of this software were developed by Oleksandr Rybalko
@@ -28,6 +29,19 @@
  * SUCH DAMAGE.
  */
 
+/*
+ * I2C driver for Freescale i.MX hardware.
+ *
+ * Note that the hardware is capable of running as both a master and a slave.
+ * This driver currently implements only master-mode operations.
+ *
+ * This driver supports multi-master i2c busses, by detecting bus arbitration
+ * loss and returning IIC_EBUSBSY status.  Notably, it does not do any kind of
+ * retries if some other master jumps onto the bus and interrupts one of our
+ * transfer cycles resulting in arbitration loss in mid-transfer.  The caller
+ * must handle retries in a way that makes sense for the slave being addressed.
+ */
+
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
@@ -43,9 +57,6 @@ __FBSDID("$FreeBSD$");
 #include <machine/resource.h>
 #include <sys/rman.h>
 
-#include <sys/lock.h>
-#include <sys/mutex.h>
-
 #include <arm/freescale/imx/imx_ccmvar.h>
 
 #include <dev/iicbus/iiconf.h>
@@ -108,13 +119,6 @@ static struct clkdiv clkdiv_table[] = {
         { 2560, 0x1d }, { 3072, 0x1e }, { 3840, 0x1f }, {UINT_MAX, 0x1f} 
 };
 
-#ifdef  DEBUG
-#define debugf(fmt, args...) do { printf("%s(): ", __func__);		\
-		printf(fmt,##args); } while (0)
-#else
-#define debugf(fmt, args...)
-#endif
-
 static struct ofw_compat_data compat_data[] = {
 	{"fsl,imx6q-i2c",  1},
 	{"fsl,imx-i2c",	   1},
@@ -125,10 +129,8 @@ struct i2c_softc {
 	device_t		dev;
 	device_t		iicbus;
 	struct resource		*res;
-	struct mtx		mutex;
 	int			rid;
-	bus_space_handle_t	bsh;
-	bus_space_tag_t		bst;
+	sbintime_t		byte_time_sbt;
 };
 
 static phandle_t i2c_get_node(device_t, device_t);
@@ -158,7 +160,7 @@ static device_method_t i2c_methods[] = {
 	DEVMETHOD(iicbus_write,			i2c_write),
 	DEVMETHOD(iicbus_transfer,		iicbus_transfer_gen),
 
-	{ 0, 0 }
+	DEVMETHOD_END
 };
 
 static driver_t i2c_driver = {
@@ -184,14 +186,14 @@ static __inline void
 i2c_write_reg(struct i2c_softc *sc, bus_size_t off, uint8_t val)
 {
 
-	bus_space_write_1(sc->bst, sc->bsh, off, val);
+	bus_write_1(sc->res, off, val);
 }
 
 static __inline uint8_t
 i2c_read_reg(struct i2c_softc *sc, bus_size_t off)
 {
 
-	return (bus_space_read_1(sc->bst, sc->bsh, off));
+	return (bus_read_1(sc->res, off));
 }
 
 static __inline void
@@ -204,60 +206,77 @@ i2c_flag_set(struct i2c_softc *sc, bus_size_t off, uint8_t mask)
 	i2c_write_reg(sc, off, status);
 }
 
-/* Wait for transfer interrupt flag */
+/* Wait for bus to become busy or not-busy. */
 static int
-wait_for_iif(struct i2c_softc *sc)
+wait_for_busbusy(struct i2c_softc *sc, int wantbusy)
 {
-	int retry;
+	int retry, srb;
 
 	retry = 1000;
 	while (retry --) {
-		if (i2c_read_reg(sc, I2C_STATUS_REG) & I2CSR_MIF)
+		srb = i2c_read_reg(sc, I2C_STATUS_REG) & I2CSR_MBB;
+		if ((srb && wantbusy) || (!srb && !wantbusy))
 			return (IIC_NOERR);
-		DELAY(10);
+		DELAY(1);
 	}
-
 	return (IIC_ETIMEOUT);
 }
 
-/* Wait for free bus */
+/* Wait for transfer to complete, optionally check RXAK. */
 static int
-wait_for_nibb(struct i2c_softc *sc)
+wait_for_xfer(struct i2c_softc *sc, int checkack)
 {
-	int retry;
+	int retry, sr;
 
-	retry = 1000;
+	/*
+	 * Sleep for about the time it takes to transfer a byte (with precision
+	 * set to tolerate 5% oversleep).  We calculate the approximate byte
+	 * transfer time when we set the bus speed divisor.  Slaves are allowed
+	 * to do clock-stretching so the actual transfer time can be larger, but
+	 * this gets the bulk of the waiting out of the way without tying up the
+	 * processor the whole time.
+	 */
+	pause_sbt("imxi2c", sc->byte_time_sbt, sc->byte_time_sbt / 20, 0);
+
+	retry = 10000;
 	while (retry --) {
-		if ((i2c_read_reg(sc, I2C_STATUS_REG) & I2CSR_MBB) == 0)
-			return (IIC_NOERR);
-		DELAY(10);
+		sr = i2c_read_reg(sc, I2C_STATUS_REG);
+		if (sr & I2CSR_MIF) {
+                        if (sr & I2CSR_MAL) 
+				return (IIC_EBUSERR);
+			else if (checkack && (sr & I2CSR_RXAK))
+				return (IIC_ENOACK);
+			else
+				return (IIC_NOERR);
+		}
+		DELAY(1);
 	}
-
 	return (IIC_ETIMEOUT);
 }
 
-/* Wait for transfer complete+interrupt flag */
+/*
+ * Implement the error handling shown in the state diagram of the imx6 reference
+ * manual.  If there was an error, then:
+ *  - Clear master mode (MSTA and MTX).
+ *  - Wait for the bus to become free or for a timeout to happen.
+ *  - Disable the controller.
+ */
 static int
-wait_for_icf(struct i2c_softc *sc)
+i2c_error_handler(struct i2c_softc *sc, int error)
 {
-	int retry;
 
-	retry = 1000;
-	while (retry --) {
-
-		if ((i2c_read_reg(sc, I2C_STATUS_REG) &
-		    (I2CSR_MCF|I2CSR_MIF)) == (I2CSR_MCF|I2CSR_MIF))
-			return (IIC_NOERR);
-		DELAY(10);
+	if (error != 0) {
+		i2c_write_reg(sc, I2C_STATUS_REG, 0);
+		i2c_write_reg(sc, I2C_CONTROL_REG, I2CCR_MEN);
+		wait_for_busbusy(sc, false);
+		i2c_write_reg(sc, I2C_CONTROL_REG, 0);
 	}
-
-	return (IIC_ETIMEOUT);
+	return (error);
 }
 
 static int
 i2c_probe(device_t dev)
 {
-	struct i2c_softc *sc;
 
 	if (!ofw_bus_status_okay(dev))
 		return (ENXIO);
@@ -265,23 +284,7 @@ i2c_probe(device_t dev)
 	if (ofw_bus_search_compatible(dev, compat_data)->ocd_data == 0)
 		return (ENXIO);
 
-	sc = device_get_softc(dev);
-	sc->rid = 0;
-
-	sc->res = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &sc->rid,
-	    RF_ACTIVE);
-	if (sc->res == NULL) {
-		device_printf(dev, "could not allocate resources\n");
-		return (ENXIO);
-	}
-
-	sc->bst = rman_get_bustag(sc->res);
-	sc->bsh = rman_get_bushandle(sc->res);
-
-	/* Enable I2C */
-	i2c_write_reg(sc, I2C_CONTROL_REG, I2CCR_MEN);
-	bus_release_resource(dev, SYS_RES_MEMORY, sc->rid, sc->res);
-	device_set_desc(dev, "Freescale i.MX I2C bus controller");
+	device_set_desc(dev, "Freescale i.MX I2C");
 
 	return (BUS_PROBE_DEFAULT);
 }
@@ -295,28 +298,21 @@ i2c_attach(device_t dev)
 	sc->dev = dev;
 	sc->rid = 0;
 
-	mtx_init(&sc->mutex, device_get_nameunit(dev), "I2C", MTX_DEF);
-
 	sc->res = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &sc->rid,
 	    RF_ACTIVE);
 	if (sc->res == NULL) {
 		device_printf(dev, "could not allocate resources");
-		mtx_destroy(&sc->mutex);
 		return (ENXIO);
 	}
 
-	sc->bst = rman_get_bustag(sc->res);
-	sc->bsh = rman_get_bushandle(sc->res);
-
 	sc->iicbus = device_add_child(dev, "iicbus", -1);
 	if (sc->iicbus == NULL) {
 		device_printf(dev, "could not add iicbus child");
-		mtx_destroy(&sc->mutex);
 		return (ENXIO);
 	}
 
 	bus_generic_attach(dev);
-	return (IIC_NOERR);
+	return (0);
 }
 
 static int
@@ -327,34 +323,20 @@ i2c_repeated_start(device_t dev, u_char slave, int timeout)
 
 	sc = device_get_softc(dev);
 
-	mtx_lock(&sc->mutex);
-
-	i2c_write_reg(sc, I2C_ADDR_REG, slave);
 	if ((i2c_read_reg(sc, I2C_STATUS_REG) & I2CSR_MBB) == 0) {
-		mtx_unlock(&sc->mutex);
-		return (IIC_EBUSBSY);
+		return (IIC_EBUSERR);
 	}
 
-	/* Set repeated start condition */
-	DELAY(10);
+	/*
+	 * Set repeated start condition, delay (per reference manual, min 156nS)
+	 * before writing slave address, wait for ack after write.
+	 */
 	i2c_flag_set(sc, I2C_CONTROL_REG, I2CCR_RSTA);
-	DELAY(10);
-	/* Clear status */
+	DELAY(1);
 	i2c_write_reg(sc, I2C_STATUS_REG, 0x0);
-	/* Write target address - LSB is R/W bit */
 	i2c_write_reg(sc, I2C_DATA_REG, slave);
-
-	error = wait_for_iif(sc);
-
-	/* Clear status */
-	i2c_write_reg(sc, I2C_STATUS_REG, 0x0);
-
-	mtx_unlock(&sc->mutex);
-
-	if (error)
-		return (error);
-
-	return (IIC_NOERR);
+	error = wait_for_xfer(sc, true);
+	return (i2c_error_handler(sc, error));
 }
 
 static int
@@ -365,53 +347,30 @@ i2c_start(device_t dev, u_char slave, int timeout)
 
 	sc = device_get_softc(dev);
 
-	mtx_lock(&sc->mutex);
-	i2c_write_reg(sc, I2C_ADDR_REG, slave);
+	i2c_write_reg(sc, I2C_CONTROL_REG, I2CCR_MEN);
+	DELAY(10); /* Delay for controller to sample bus state. */
 	if (i2c_read_reg(sc, I2C_STATUS_REG) & I2CSR_MBB) {
-		mtx_unlock(&sc->mutex);
-		return (IIC_EBUSBSY);
+		return (i2c_error_handler(sc, IIC_EBUSERR));
 	}
-
-	/* Set start condition */
-	i2c_write_reg(sc, I2C_CONTROL_REG,
-	    I2CCR_MEN | I2CCR_MSTA | I2CCR_TXAK);
-	DELAY(100);
-	i2c_write_reg(sc, I2C_CONTROL_REG,
-	    I2CCR_MEN | I2CCR_MSTA | I2CCR_MTX | I2CCR_TXAK);
-	/* Clear status */
-	i2c_write_reg(sc, I2C_STATUS_REG, 0x0);
-	/* Write target address - LSB is R/W bit */
+	i2c_write_reg(sc, I2C_CONTROL_REG, I2CCR_MEN | I2CCR_MSTA | I2CCR_MTX);
+	if ((error = wait_for_busbusy(sc, true)) != IIC_NOERR)
+		return (i2c_error_handler(sc, error));
+	i2c_write_reg(sc, I2C_STATUS_REG, 0);
 	i2c_write_reg(sc, I2C_DATA_REG, slave);
-
-	error = wait_for_iif(sc);
-
-	mtx_unlock(&sc->mutex);
-	if (error)
-		return (error);
-
-	return (IIC_NOERR);
+	error = wait_for_xfer(sc, true);
+	return (i2c_error_handler(sc, error));
 }
 
-
 static int
 i2c_stop(device_t dev)
 {
 	struct i2c_softc *sc;
 
 	sc = device_get_softc(dev);
-	mtx_lock(&sc->mutex);
-	i2c_write_reg(sc, I2C_CONTROL_REG, I2CCR_MEN | I2CCR_TXAK);
-	DELAY(100);
-	/* Reset controller if bus still busy after STOP */
-	if (wait_for_nibb(sc) == IIC_ETIMEOUT) {
-		i2c_write_reg(sc, I2C_CONTROL_REG, 0);
-		DELAY(1000);
-		i2c_write_reg(sc, I2C_CONTROL_REG, I2CCR_MEN | I2CCR_TXAK);
-
-		i2c_write_reg(sc, I2C_STATUS_REG, 0x0);
-	}
-	mtx_unlock(&sc->mutex);
 
+	i2c_write_reg(sc, I2C_CONTROL_REG, I2CCR_MEN);
+	wait_for_busbusy(sc, false);
+	i2c_write_reg(sc, I2C_CONTROL_REG, 0);
 	return (IIC_NOERR);
 }
 
@@ -434,19 +393,23 @@ i2c_reset(device_t dev, u_char speed, u_char addr, u_char *oldadr)
 		if (clkdiv_table[i].divisor >= div)
 			break;
 	}
-	div = clkdiv_table[i].regcode;
 
-	mtx_lock(&sc->mutex);
-	i2c_write_reg(sc, I2C_CONTROL_REG, 0x0);
-	i2c_write_reg(sc, I2C_STATUS_REG, 0x0);
-	DELAY(1000);
+	/*
+	 * Calculate roughly how long it will take to transfer a byte (which
+	 * requires 9 clock cycles) at the new bus speed.  This value is used to
+	 * pause() while waiting for transfer-complete.  With a 66MHz IPG clock
+	 * and the actual i2c bus speeds that leads to, for nominal 100KHz and
+	 * 400KHz bus speeds the transfer times are roughly 104uS and 22uS.
+	 */
+	busfreq = ipgfreq / clkdiv_table[i].divisor;
+	sc->byte_time_sbt = SBT_1US * (9000000 / busfreq);
 
-	i2c_write_reg(sc, I2C_FDR_REG, (uint8_t)div);
-	i2c_write_reg(sc, I2C_CONTROL_REG, I2CCR_MEN);
-	DELAY(1000);
+	/*
+	 * Disable the controller (do the reset), and set the new clock divisor.
+	 */
 	i2c_write_reg(sc, I2C_STATUS_REG, 0x0);
-	mtx_unlock(&sc->mutex);
-
+	i2c_write_reg(sc, I2C_CONTROL_REG, 0x0);
+	i2c_write_reg(sc, I2C_FDR_REG, (uint8_t)clkdiv_table[i].regcode);
 	return (IIC_NOERR);
 }
 
@@ -459,48 +422,42 @@ i2c_read(device_t dev, char *buf, int len, int *read, int last, int delay)
 	sc = device_get_softc(dev);
 	*read = 0;
 
-	mtx_lock(&sc->mutex);
-
 	if (len) {
 		if (len == 1)
 			i2c_write_reg(sc, I2C_CONTROL_REG, I2CCR_MEN |
 			    I2CCR_MSTA | I2CCR_TXAK);
-
 		else
 			i2c_write_reg(sc, I2C_CONTROL_REG, I2CCR_MEN |
 			    I2CCR_MSTA);
-
-		/* dummy read */
+                /* Dummy read to prime the receiver. */
+		i2c_write_reg(sc, I2C_STATUS_REG, 0x0);
 		i2c_read_reg(sc, I2C_DATA_REG);
-		DELAY(1000);
 	}
 
+	error = 0;
+	*read = 0;
 	while (*read < len) {
-		error = wait_for_icf(sc);
-		if (error) {
-			mtx_unlock(&sc->mutex);
-			return (error);
-		}
+		if ((error = wait_for_xfer(sc, false)) != IIC_NOERR)
+			break;
 		i2c_write_reg(sc, I2C_STATUS_REG, 0x0);
-		if ((*read == len - 2) && last) {
-			/* NO ACK on last byte */
-			i2c_write_reg(sc, I2C_CONTROL_REG, I2CCR_MEN |
-			    I2CCR_MSTA | I2CCR_TXAK);
+		if (last) {
+			if (*read == len - 2) {
+				/* NO ACK on last byte */
+				i2c_write_reg(sc, I2C_CONTROL_REG, I2CCR_MEN |
+				    I2CCR_MSTA | I2CCR_TXAK);
+			} else if (*read == len - 1) {
+				/* Transfer done, signal stop. */
+				i2c_write_reg(sc, I2C_CONTROL_REG, I2CCR_MEN |
+				    I2CCR_TXAK);
+				wait_for_busbusy(sc, false);
+			}
 		}
-
-		if ((*read == len - 1) && last) {
-			/* Transfer done, remove master bit */
-			i2c_write_reg(sc, I2C_CONTROL_REG, I2CCR_MEN |
-			    I2CCR_TXAK);
-		}
-
 		reg = i2c_read_reg(sc, I2C_DATA_REG);
 		*buf++ = reg;
 		(*read)++;
 	}
-	mtx_unlock(&sc->mutex);
 
-	return (IIC_NOERR);
+	return (i2c_error_handler(sc, error));
 }
 
 static int
@@ -510,22 +467,16 @@ i2c_write(device_t dev, const char *buf, int len, int *sent, int timeout)
 	int error;
 
 	sc = device_get_softc(dev);
-	*sent = 0;
 
-	mtx_lock(&sc->mutex);
+	error = 0;
+	*sent = 0;
 	while (*sent < len) {
 		i2c_write_reg(sc, I2C_STATUS_REG, 0x0);
 		i2c_write_reg(sc, I2C_DATA_REG, *buf++);
-
-		error = wait_for_iif(sc);
-		if (error) {
-			mtx_unlock(&sc->mutex);
-			return (error);
-		}
-
+		if ((error = wait_for_xfer(sc, true)) != IIC_NOERR)
+			break;
 		(*sent)++;
 	}
-	mtx_unlock(&sc->mutex);
 
-	return (IIC_NOERR);
+	return (i2c_error_handler(sc, error));
 }
diff --git a/sys/arm/freescale/vybrid/vf_i2c.c b/sys/arm/freescale/vybrid/vf_i2c.c
index 2eb6726..92a48d7 100644
--- a/sys/arm/freescale/vybrid/vf_i2c.c
+++ b/sys/arm/freescale/vybrid/vf_i2c.c
@@ -233,7 +233,7 @@ i2c_repeated_start(device_t dev, u_char slave, int timeout)
 
 	if ((READ1(sc, I2C_IBSR) & IBSR_IBB) == 0) {
 		mtx_unlock(&sc->mutex);
-		return (IIC_EBUSBSY);
+		return (IIC_EBUSERR);
 	}
 
 	/* Set repeated start condition */
@@ -276,7 +276,7 @@ i2c_start(device_t dev, u_char slave, int timeout)
 	if (READ1(sc, I2C_IBSR) & IBSR_IBB) {
 		mtx_unlock(&sc->mutex);
 		vf_i2c_dbg(sc, "cant i2c start: IIC_EBUSBSY\n");
-		return (IIC_EBUSBSY);
+		return (IIC_EBUSERR);
 	}
 
 	/* Set start condition */
diff --git a/sys/arm/samsung/exynos/exynos5_i2c.c b/sys/arm/samsung/exynos/exynos5_i2c.c
index bf7548f..a73beed 100644
--- a/sys/arm/samsung/exynos/exynos5_i2c.c
+++ b/sys/arm/samsung/exynos/exynos5_i2c.c
@@ -265,8 +265,8 @@ i2c_start(device_t dev, u_char slave, int timeout)
 	error = wait_for_nibb(sc);
 	if (error) {
 		mtx_unlock(&sc->mutex);
-		DPRINTF("cant i2c start: IIC_EBUSBSY\n");
-		return (IIC_EBUSBSY);
+		DPRINTF("cant i2c start: IIC_EBUSERR\n");
+		return (IIC_EBUSERR);
 	}
 
 	reg = READ1(sc, I2CCON);
diff --git a/sys/dev/iicbus/icee.c b/sys/dev/iicbus/icee.c
index 2e26d0e..800ec4c 100644
--- a/sys/dev/iicbus/icee.c
+++ b/sys/dev/iicbus/icee.c
@@ -48,7 +48,7 @@ __FBSDID("$FreeBSD$");
 
 struct icee_softc {
 	device_t	sc_dev;		/* Myself */
-	struct sx	sc_lock;	/* basically a perimeter lock */
+	device_t	sc_busdev;	/* Parent bus */
 	struct cdev	*cdev;		/* user interface */
 	int		addr;
 	int		size;		/* How big am I? */
@@ -57,12 +57,6 @@ struct icee_softc {
 	int		wr_sz;		/* What's the write page size */
 };
 
-#define ICEE_LOCK(_sc)		sx_xlock(&(_sc)->sc_lock)
-#define	ICEE_UNLOCK(_sc)	sx_xunlock(&(_sc)->sc_lock)
-#define ICEE_LOCK_INIT(_sc)	sx_init(&_sc->sc_lock, "icee")
-#define ICEE_LOCK_DESTROY(_sc)	sx_destroy(&_sc->sc_lock);
-#define ICEE_ASSERT_LOCKED(_sc)	sx_assert(&_sc->sc_lock, SA_XLOCKED);
-#define ICEE_ASSERT_UNLOCKED(_sc) sx_assert(&_sc->sc_lock, SA_UNLOCKED);
 #define CDEV2SOFTC(dev)		((dev)->si_drv1)
 
 /* cdev routines */
@@ -84,7 +78,7 @@ static struct cdevsw icee_cdevsw =
 static int
 icee_probe(device_t dev)
 {
-	/* XXX really probe? -- not until we know the size... */
+
 	device_set_desc(dev, "I2C EEPROM");
 	return (BUS_PROBE_NOWILDCARD);
 }
@@ -97,6 +91,7 @@ icee_attach(device_t dev)
 	int dunit, err;
 
 	sc->sc_dev = dev;
+	sc->sc_busdev = device_get_parent(sc->sc_dev);
 	sc->addr = iicbus_get_addr(dev);
 	err = 0;
 	dname = device_get_name(dev);
@@ -117,8 +112,7 @@ icee_attach(device_t dev)
 		goto out;
 	}
 	sc->cdev->si_drv1 = sc;
-	ICEE_LOCK_INIT(sc);
-out:;
+out:
 	return (err);
 }
 
@@ -126,7 +120,7 @@ static int
 icee_open(struct cdev *dev, int oflags, int devtype, struct thread *td)
 {
 
-    	return (0);
+	return (0);
 }
 
 static int
@@ -155,7 +149,9 @@ icee_read(struct cdev *dev, struct uio *uio, int ioflag)
 		return (EIO);
 	if (sc->type != 8 && sc->type != 16)
 		return (EINVAL);
-	ICEE_LOCK(sc);
+	error = iicbus_request_bus(sc->sc_busdev, sc->sc_dev, IIC_INTRWAIT);
+	if (error!= 0)
+		return (iic2errno(error));
 	slave = error = 0;
 	while (uio->uio_resid > 0) {
 		if (uio->uio_offset >= sc->size)
@@ -180,13 +176,15 @@ icee_read(struct cdev *dev, struct uio *uio, int ioflag)
 		for (i = 0; i < 2; i++)
 			msgs[i].slave = slave;
 		error = iicbus_transfer(sc->sc_dev, msgs, 2);
-		if (error)
+		if (error) {
+			error = iic2errno(error);
 			break;
+		}
 		error = uiomove(data, len, uio);
 		if (error)
 			break;
 	}
-	ICEE_UNLOCK(sc);
+	iicbus_release_bus(sc->sc_busdev, sc->sc_dev);
 	return (error);
 }
 
@@ -214,7 +212,10 @@ icee_write(struct cdev *dev, struct uio *uio, int ioflag)
 		return (EIO);
 	if (sc->type != 8 && sc->type != 16)
 		return (EINVAL);
-	ICEE_LOCK(sc);
+
+	error = iicbus_request_bus(sc->sc_busdev, sc->sc_dev, IIC_INTRWAIT);
+	if (error!= 0)
+		return (iic2errno(error));
 	slave = error = 0;
 	while (uio->uio_resid > 0) {
 		if (uio->uio_offset >= sc->size)
@@ -239,22 +240,22 @@ icee_write(struct cdev *dev, struct uio *uio, int ioflag)
 		if (error)
 			break;
 		error = iicbus_transfer(sc->sc_dev, wr, 1);
-		if (error)
+		if (error) {
+			error = iic2errno(error);
 			break;
-		// Now wait for the write to be done by trying to read
-		// the part.
+		}
+		/* Read after write to wait for write-done. */
 		waitlimit = 10000;
 		rd[0].slave = slave;
-		do 
-		{
-		    error = iicbus_transfer(sc->sc_dev, rd, 1);
+		do {
+			error = iicbus_transfer(sc->sc_dev, rd, 1);
 		} while (waitlimit-- > 0 && error != 0);
 		if (error) {
-		    printf("waiting for write failed %d\n", error);
-		    break;
+			error = iic2errno(error);
+			break;
 		}
 	}
-	ICEE_UNLOCK(sc);
+	iicbus_release_bus(sc->sc_busdev, sc->sc_dev);
 	return error;
 }
 
diff --git a/sys/dev/iicbus/iic.c b/sys/dev/iicbus/iic.c
index 16d113ee..84e1314 100644
--- a/sys/dev/iicbus/iic.c
+++ b/sys/dev/iicbus/iic.c
@@ -37,6 +37,7 @@
 #include <sys/sx.h>
 #include <sys/systm.h>
 #include <sys/uio.h>
+#include <sys/errno.h>
 
 #include <dev/iicbus/iiconf.h>
 #include <dev/iicbus/iicbus.h>
@@ -44,28 +45,32 @@
 
 #include "iicbus_if.h"
 
-#define BUFSIZE 1024
-
 struct iic_softc {
-
 	device_t sc_dev;
-	u_char sc_addr;			/* 7 bit address on iicbus */
-	int sc_count;			/* >0 if device opened */
-
-	char sc_buffer[BUFSIZE];	/* output buffer */
-	char sc_inbuf[BUFSIZE];		/* input buffer */
-
 	struct cdev *sc_devnode;
-	struct sx sc_lock;
 };
 
-#define	IIC_LOCK(sc)			sx_xlock(&(sc)->sc_lock)
-#define	IIC_UNLOCK(sc)			sx_xunlock(&(sc)->sc_lock)
+struct iic_cdevpriv {
+	struct sx lock;
+	struct iic_softc *sc;
+	bool started;
+	uint8_t addr;
+};
+
+
+#define	IIC_LOCK(cdp)			sx_xlock(&(cdp)->lock)
+#define	IIC_UNLOCK(cdp)			sx_xunlock(&(cdp)->lock)
+
+static MALLOC_DEFINE(M_IIC, "iic", "I2C device data");
 
 static int iic_probe(device_t);
 static int iic_attach(device_t);
 static int iic_detach(device_t);
 static void iic_identify(driver_t *driver, device_t parent);
+static void iicdtor(void *data);
+static int iicuio_move(struct iic_cdevpriv *priv, struct uio *uio, int last);
+static int iicuio(struct cdev *dev, struct uio *uio, int ioflag);
+static int iicrdwr(struct iic_cdevpriv *priv, struct iic_rdwr_data *d, int flags);
 
 static devclass_t iic_devclass;
 
@@ -89,18 +94,13 @@ static driver_t iic_driver = {
 };
 
 static	d_open_t	iicopen;
-static	d_close_t	iicclose;
-static	d_write_t	iicwrite;
-static	d_read_t	iicread;
 static	d_ioctl_t	iicioctl;
 
 static struct cdevsw iic_cdevsw = {
 	.d_version =	D_VERSION,
-	.d_flags =	D_TRACKCLOSE,
 	.d_open =	iicopen,
-	.d_close =	iicclose,
-	.d_read =	iicread,
-	.d_write =	iicwrite,
+	.d_read =	iicuio,
+	.d_write =	iicuio,
 	.d_ioctl =	iicioctl,
 	.d_name =	"iic",
 };
@@ -127,16 +127,15 @@ iic_probe(device_t dev)
 static int
 iic_attach(device_t dev)
 {
-	struct iic_softc *sc = (struct iic_softc *)device_get_softc(dev);
+	struct iic_softc *sc;
 
+	sc = device_get_softc(dev);
 	sc->sc_dev = dev;
-	sx_init(&sc->sc_lock, "iic");
 	sc->sc_devnode = make_dev(&iic_cdevsw, device_get_unit(dev),
 			UID_ROOT, GID_WHEEL,
 			0600, "iic%d", device_get_unit(dev));
 	if (sc->sc_devnode == NULL) {
 		device_printf(dev, "failed to create character device\n");
-		sx_destroy(&sc->sc_lock);
 		return (ENXIO);
 	}
 	sc->sc_devnode->si_drv1 = sc;
@@ -147,11 +146,12 @@ iic_attach(device_t dev)
 static int
 iic_detach(device_t dev)
 {
-	struct iic_softc *sc = (struct iic_softc *)device_get_softc(dev);
+	struct iic_softc *sc;
+
+	sc = device_get_softc(dev);
 
 	if (sc->sc_devnode)
 		destroy_dev(sc->sc_devnode);
-	sx_destroy(&sc->sc_lock);
 
 	return (0);
 }
@@ -159,238 +159,331 @@ iic_detach(device_t dev)
 static int
 iicopen(struct cdev *dev, int flags, int fmt, struct thread *td)
 {
-	struct iic_softc *sc = dev->si_drv1;
+	struct iic_cdevpriv *priv;
+	int error;
 
-	IIC_LOCK(sc);
-	if (sc->sc_count > 0) {
-		IIC_UNLOCK(sc);
-		return (EBUSY);
-	}
+	priv = malloc(sizeof(*priv), M_IIC, M_WAITOK | M_ZERO);
 
-	sc->sc_count++;
-	IIC_UNLOCK(sc);
+	sx_init(&priv->lock, "iic");
+	priv->sc = dev->si_drv1;
 
-	return (0);
+	error = devfs_set_cdevpriv(priv, iicdtor); 
+	if (error != 0)
+		free(priv, M_IIC);
+
+	return (error);
 }
 
-static int
-iicclose(struct cdev *dev, int flags, int fmt, struct thread *td)
+static void
+iicdtor(void *data)
 {
-	struct iic_softc *sc = dev->si_drv1;
+	device_t iicdev, parent;
+	struct iic_cdevpriv *priv;
 
-	IIC_LOCK(sc);
-	if (!sc->sc_count) {
-		/* XXX: I don't think this can happen. */
-		IIC_UNLOCK(sc);
-		return (EINVAL);
-	}
+	priv = data;
+	KASSERT(priv != NULL, ("iic cdevpriv should not be NULL!"));
 
-	sc->sc_count--;
+	iicdev = priv->sc->sc_dev;
+	parent = device_get_parent(iicdev);
 
-	if (sc->sc_count < 0)
-		panic("%s: iic_count < 0!", __func__);
-	IIC_UNLOCK(sc);
+	if (priv->started) {
+		iicbus_stop(parent);
+		iicbus_reset(parent, IIC_UNKNOWN, 0, NULL);
+		iicbus_release_bus(parent, iicdev);
+	}
 
-	return (0);
+	sx_destroy(&priv->lock);
+	free(priv, M_IIC);
 }
 
 static int
-iicwrite(struct cdev *dev, struct uio * uio, int ioflag)
+iicuio_move(struct iic_cdevpriv *priv, struct uio *uio, int last)
 {
-	struct iic_softc *sc = dev->si_drv1;
-	device_t iicdev = sc->sc_dev;
-	int sent, error, count;
-
-	IIC_LOCK(sc);
-	if (!sc->sc_addr) {
-		IIC_UNLOCK(sc);
-		return (EINVAL);
+	device_t parent;
+	int error, num_bytes, transferred_bytes, written_bytes;
+	char buffer[128];
+
+	parent = device_get_parent(priv->sc->sc_dev);
+	error = 0;
+
+	/*
+	 * We can only transfer up to sizeof(buffer) bytes in 1 shot, so loop until
+	 * everything has been transferred.
+	*/
+	while ((error == 0) && (uio->uio_resid > 0)) {
+
+		num_bytes = MIN(uio->uio_resid, sizeof(buffer));
+		transferred_bytes = 0;
+
+		if (uio->uio_rw == UIO_WRITE) {
+			error = uiomove(buffer, num_bytes, uio);
+
+			while ((error == 0) && (transferred_bytes < num_bytes)) {
+				written_bytes = 0;
+				error = iicbus_write(parent, &buffer[transferred_bytes],
+				    num_bytes - transferred_bytes, &written_bytes, 0);
+				transferred_bytes += written_bytes;
+			}
+				
+		} else if (uio->uio_rw == UIO_READ) {
+			error = iicbus_read(parent, buffer,
+			    num_bytes, &transferred_bytes,
+			    ((uio->uio_resid <= sizeof(buffer)) ? last : 0), 0);
+			if (error == 0)
+				error = uiomove(buffer, transferred_bytes, uio);
+		}
 	}
 
-	if (sc->sc_count == 0) {
-		/* XXX: I don't think this can happen. */
-		IIC_UNLOCK(sc);
-		return (EINVAL);
-	}
+	return (error);
+}
 
-	error = iicbus_request_bus(device_get_parent(iicdev), iicdev,
-	    IIC_DONTWAIT);
-	if (error) {
-		IIC_UNLOCK(sc);
+static int
+iicuio(struct cdev *dev, struct uio *uio, int ioflag)
+{
+	device_t parent;
+	struct iic_cdevpriv *priv;
+	int error;
+	uint8_t addr;
+
+	priv = NULL;
+	error = devfs_get_cdevpriv((void**)&priv);
+
+	if (error != 0)
 		return (error);
+	KASSERT(priv != NULL, ("iic cdevpriv should not be NULL!"));
+
+	IIC_LOCK(priv);
+	if (priv->started || (priv->addr == 0)) {
+		IIC_UNLOCK(priv);
+		return (ENXIO);
 	}
+	parent = device_get_parent(priv->sc->sc_dev);
 
-	count = min(uio->uio_resid, BUFSIZE);
-	error = uiomove(sc->sc_buffer, count, uio);
-	if (error) {
-		IIC_UNLOCK(sc);
+	error = iicbus_request_bus(parent, priv->sc->sc_dev,
+	    (ioflag & O_NONBLOCK) ? IIC_DONTWAIT : (IIC_WAIT | IIC_INTR));
+	if (error != 0) {
+		IIC_UNLOCK(priv);
 		return (error);
 	}
 
-	error = iicbus_block_write(device_get_parent(iicdev), sc->sc_addr,
-					sc->sc_buffer, count, &sent);
+	if (uio->uio_rw == UIO_READ)
+		addr = priv->addr | LSB;
+	else
+		addr = priv->addr & ~LSB;
+
+	error = iicbus_start(parent, addr, 0);
+	if (error != 0)
+	{
+		iicbus_release_bus(parent, priv->sc->sc_dev);
+		IIC_UNLOCK(priv);
+		return (error);
+	}
 
-	iicbus_release_bus(device_get_parent(iicdev), iicdev);
-	IIC_UNLOCK(sc);
+	error = iicuio_move(priv, uio, IIC_LAST_READ);
 
+	iicbus_stop(parent);
+	iicbus_release_bus(parent, priv->sc->sc_dev);
+	IIC_UNLOCK(priv);
 	return (error);
 }
 
 static int
-iicread(struct cdev *dev, struct uio * uio, int ioflag)
+iicrdwr(struct iic_cdevpriv *priv, struct iic_rdwr_data *d, int flags)
 {
-	struct iic_softc *sc = dev->si_drv1;
-	device_t iicdev = sc->sc_dev;
-	int len, error = 0;
-	int bufsize;
-
-	IIC_LOCK(sc);
-	if (!sc->sc_addr) {
-		IIC_UNLOCK(sc);
-		return (EINVAL);
-	}
+	struct iic_msg *buf, *m;
+	void **usrbufs;
+	device_t iicdev, parent;
+	int error, i;
 
-	if (sc->sc_count == 0) {
-		/* XXX: I don't think this can happen. */
-		IIC_UNLOCK(sc);
-		return (EINVAL);
-	}
+	iicdev = priv->sc->sc_dev;
+	parent = device_get_parent(iicdev);
+	error = 0;
 
-	error = iicbus_request_bus(device_get_parent(iicdev), iicdev,
-	    IIC_DONTWAIT);
-	if (error) {
-		IIC_UNLOCK(sc);
-		return (error);
-	}
+	buf = malloc(sizeof(*d->msgs) * d->nmsgs, M_IIC, M_WAITOK);
 
-	/* max amount of data to read */
-	len = min(uio->uio_resid, BUFSIZE);
+	error = copyin(d->msgs, buf, sizeof(*d->msgs) * d->nmsgs);
 
-	error = iicbus_block_read(device_get_parent(iicdev), sc->sc_addr,
-	    sc->sc_inbuf, len, &bufsize);
-	if (error) {
-		IIC_UNLOCK(sc);
-		return (error);
+	/* Alloc kernel buffers for userland data, copyin write data */
+	usrbufs = malloc(sizeof(void *) * d->nmsgs, M_IIC, M_WAITOK | M_ZERO);
+
+	for (i = 0; i < d->nmsgs; i++) {
+		m = &(buf[i]);
+		usrbufs[i] = m->buf;
+
+		/*
+		 * At least init the buffer to NULL so we can safely free() it later.
+		 * If the copyin() to buf failed, don't try to malloc bogus m->len.
+		 */
+		m->buf = NULL;
+		if (error != 0)
+			continue;
+		m->buf = malloc(m->len, M_IIC, M_WAITOK);
+		if (!(m->flags & IIC_M_RD))
+			error = copyin(usrbufs[i], m->buf, m->len);
 	}
 
-	if (bufsize > uio->uio_resid)
-		panic("%s: too much data read!", __func__);
+	if (error == 0)
+		error = iicbus_request_bus(parent, iicdev,
+		    (flags & O_NONBLOCK) ? IIC_DONTWAIT : (IIC_WAIT | IIC_INTR));
 
-	iicbus_release_bus(device_get_parent(iicdev), iicdev);
+	if (error == 0) {
+		error = iicbus_transfer(iicdev, buf, d->nmsgs);
+		iicbus_release_bus(parent, iicdev);
+	}
+
+	/* Copyout all read segments, free up kernel buffers */
+	for (i = 0; i < d->nmsgs; i++) {
+		m = &(buf[i]);
+		if ((error == 0) && (m->flags & IIC_M_RD))
+			error = copyout(m->buf, usrbufs[i], m->len);
+		free(m->buf, M_IIC);
+	}
 
-	error = uiomove(sc->sc_inbuf, bufsize, uio);
-	IIC_UNLOCK(sc);
+	free(usrbufs, M_IIC);
+	free(buf, M_IIC);
 	return (error);
 }
 
 static int
 iicioctl(struct cdev *dev, u_long cmd, caddr_t data, int flags, struct thread *td)
 {
-	struct iic_softc *sc = dev->si_drv1;
-	device_t iicdev = sc->sc_dev;
-	device_t parent = device_get_parent(iicdev);
-	struct iiccmd *s = (struct iiccmd *)data;
-	struct iic_rdwr_data *d = (struct iic_rdwr_data *)data;
-	struct iic_msg *m;
-	int error, count, i;
-	char *buf = NULL;
-	void **usrbufs = NULL;
-
-	if ((error = iicbus_request_bus(parent, iicdev,
-	    (flags & O_NONBLOCK) ? IIC_DONTWAIT : (IIC_WAIT | IIC_INTR))))
+	device_t parent, iicdev;
+	struct iiccmd *s;
+	struct uio ubuf;
+	struct iovec uvec;
+	struct iic_cdevpriv *priv;
+	int error;
+
+	s = (struct iiccmd *)data;
+	error = devfs_get_cdevpriv((void**)&priv);
+	if (error != 0)
 		return (error);
 
+	KASSERT(priv != NULL, ("iic cdevpriv should not be NULL!"));
+
+	iicdev = priv->sc->sc_dev;
+	parent = device_get_parent(iicdev);
+	IIC_LOCK(priv);
+
+
 	switch (cmd) {
 	case I2CSTART:
-		IIC_LOCK(sc);
-		error = iicbus_start(parent, s->slave, 0);
+		if (priv->started) {
+			error = EINVAL;
+			break;
+		}
+		error = iicbus_request_bus(parent, iicdev,
+		    (flags & O_NONBLOCK) ? IIC_DONTWAIT : (IIC_WAIT | IIC_INTR));
 
-		/*
-		 * Implicitly set the chip addr to the slave addr passed as
-		 * parameter. Consequently, start/stop shall be called before
-		 * the read or the write of a block.
-		 */
-		if (!error)
-			sc->sc_addr = s->slave;
-		IIC_UNLOCK(sc);
+		if (error == 0)
+			error = iicbus_start(parent, s->slave, 0);
+
+		if (error == 0) {
+			priv->addr = s->slave;
+			priv->started = true;
+		} else
+			iicbus_release_bus(parent, iicdev);
 
 		break;
 
 	case I2CSTOP:
-		error = iicbus_stop(parent);
+		if (priv->started) {
+			error = iicbus_stop(parent);
+			iicbus_release_bus(parent, iicdev);
+			priv->started = false;
+		}
+
 		break;
 
 	case I2CRSTCARD:
-		error = iicbus_reset(parent, IIC_UNKNOWN, 0, NULL);
 		/*
-		 * Ignore IIC_ENOADDR as it only means we have a master-only
-		 * controller.
-		 */
-		if (error == IIC_ENOADDR)
-			error = 0;
+		 * Bus should be owned before we reset it.
+		 * We allow the bus to be already owned as the result of an in-progress
+		 * sequence; however, bus reset will always be followed by release
+		 * (a new start is presumably needed for I/O anyway). */ 
+		if (!priv->started)	
+			error = iicbus_request_bus(parent, iicdev,
+			    (flags & O_NONBLOCK) ? IIC_DONTWAIT : (IIC_WAIT | IIC_INTR));
+
+		if (error == 0) {
+			error = iicbus_reset(parent, IIC_UNKNOWN, 0, NULL);
+			/*
+			 * Ignore IIC_ENOADDR as it only means we have a master-only
+			 * controller.
+			 */
+			if (error == IIC_ENOADDR)
+				error = 0;
+
+			iicbus_release_bus(parent, iicdev);
+			priv->started = false;
+		}
 		break;
 
 	case I2CWRITE:
-		if (s->count <= 0) {
+		if (!priv->started) {
 			error = EINVAL;
 			break;
 		}
-		buf = malloc((unsigned long)s->count, M_TEMP, M_WAITOK);
-		error = copyin(s->buf, buf, s->count);
-		if (error)
-			break;
-		error = iicbus_write(parent, buf, s->count, &count, 10);
+		uvec.iov_base = s->buf;
+		uvec.iov_len = s->count;
+		ubuf.uio_iov = &uvec;
+		ubuf.uio_iovcnt = 1;
+		ubuf.uio_segflg = UIO_USERSPACE;
+		ubuf.uio_td = td;
+		ubuf.uio_resid = s->count;
+		ubuf.uio_offset = 0;
+		ubuf.uio_rw = UIO_WRITE;
+		error = iicuio_move(priv, &ubuf, 0);
 		break;
 
 	case I2CREAD:
-		if (s->count <= 0) {
+		if (!priv->started) {
 			error = EINVAL;
 			break;
 		}
-		buf = malloc((unsigned long)s->count, M_TEMP, M_WAITOK);
-		error = iicbus_read(parent, buf, s->count, &count, s->last, 10);
-		if (error)
-			break;
-		error = copyout(buf, s->buf, s->count);
+		uvec.iov_base = s->buf;
+		uvec.iov_len = s->count;
+		ubuf.uio_iov = &uvec;
+		ubuf.uio_iovcnt = 1;
+		ubuf.uio_segflg = UIO_USERSPACE;
+		ubuf.uio_td = td;
+		ubuf.uio_resid = s->count;
+		ubuf.uio_offset = 0;
+		ubuf.uio_rw = UIO_READ;
+		error = iicuio_move(priv, &ubuf, s->last);
 		break;
 
 	case I2CRDWR:
-		buf = malloc(sizeof(*d->msgs) * d->nmsgs, M_TEMP, M_WAITOK);
-		error = copyin(d->msgs, buf, sizeof(*d->msgs) * d->nmsgs);
-		if (error)
+		/*
+		 * The rdwr list should be a self-contained set of
+		 * transactions.  Fail if another transaction is in progress.
+                 */
+		if (priv->started) {
+			error = EINVAL;
 			break;
-		/* Alloc kernel buffers for userland data, copyin write data */
-		usrbufs = malloc(sizeof(void *) * d->nmsgs, M_TEMP, M_ZERO | M_WAITOK);
-		for (i = 0; i < d->nmsgs; i++) {
-			m = &((struct iic_msg *)buf)[i];
-			usrbufs[i] = m->buf;
-			m->buf = malloc(m->len, M_TEMP, M_WAITOK);
-			if (!(m->flags & IIC_M_RD))
-				copyin(usrbufs[i], m->buf, m->len);
-		}
-		error = iicbus_transfer(iicdev, (struct iic_msg *)buf, d->nmsgs);
-		/* Copyout all read segments, free up kernel buffers */
-		for (i = 0; i < d->nmsgs; i++) {
-			m = &((struct iic_msg *)buf)[i];
-			if (m->flags & IIC_M_RD)
-				copyout(m->buf, usrbufs[i], m->len);
-			free(m->buf, M_TEMP);
 		}
-		free(usrbufs, M_TEMP);
+
+		error = iicrdwr(priv, (struct iic_rdwr_data *)data, flags);
+
 		break;
 
 	case I2CRPTSTART:
+		if (!priv->started) {
+			error = EINVAL;
+			break;
+		}
 		error = iicbus_repeated_start(parent, s->slave, 0);
 		break;
 
+	case I2CSADDR:
+		priv->addr = *((uint8_t*)data);
+		break;
+
 	default:
 		error = ENOTTY;
 	}
 
-	iicbus_release_bus(parent, iicdev);
-
-	if (buf != NULL)
-		free(buf, M_TEMP);
+	IIC_UNLOCK(priv);
 	return (error);
 }
 
diff --git a/sys/dev/iicbus/iic.h b/sys/dev/iicbus/iic.h
index ab58abf..ba98d28 100644
--- a/sys/dev/iicbus/iic.h
+++ b/sys/dev/iicbus/iic.h
@@ -63,5 +63,6 @@ struct iic_rdwr_data {
 #define I2CREAD		_IOW('i', 5, struct iiccmd)	/* receive data */
 #define I2CRDWR		_IOW('i', 6, struct iic_rdwr_data)	/* General read/write interface */
 #define I2CRPTSTART	_IOW('i', 7, struct iiccmd)	/* repeated start */
+#define I2CSADDR	_IOW('i', 8, uint8_t)		/* set slave address for future I/O */
 
 #endif
diff --git a/sys/dev/iicbus/iicbus_if.m b/sys/dev/iicbus/iicbus_if.m
index 120b5e7..3f58168 100644
--- a/sys/dev/iicbus/iicbus_if.m
+++ b/sys/dev/iicbus/iicbus_if.m
@@ -51,6 +51,10 @@ METHOD int intr {
 
 #
 # iicbus callback
+# Request ownership of bus
+# index: IIC_REQUEST_BUS or IIC_RELEASE_BUS
+# data: pointer to int containing IIC_WAIT or IIC_DONTWAIT and either IIC_INTR or IIC_NOINTR
+# This function is allowed to sleep if *data contains IIC_WAIT.
 #
 METHOD int callback {
 	device_t dev;
diff --git a/sys/dev/iicbus/iicoc.c b/sys/dev/iicbus/iicoc.c
index de17e74..45f1692 100644
--- a/sys/dev/iicbus/iicoc.c
+++ b/sys/dev/iicbus/iicoc.c
@@ -236,7 +236,7 @@ iicoc_detach(device_t dev)
 static int 
 iicoc_start(device_t dev, u_char slave, int timeout)
 {
-	int error = IIC_EBUSBSY;
+	int error = IIC_EBUSERR;
 	struct iicoc_softc *sc;
 
 	sc = device_get_softc(dev);
diff --git a/sys/dev/iicbus/iiconf.c b/sys/dev/iicbus/iiconf.c
index 940760b..e28d341 100644
--- a/sys/dev/iicbus/iiconf.c
+++ b/sys/dev/iicbus/iiconf.c
@@ -40,6 +40,28 @@ __FBSDID("$FreeBSD$");
 #include "iicbus_if.h"
 
 /*
+ * Translate IIC_Exxxxx status values to vaguely-equivelent errno values.
+ */
+int
+iic2errno(int iic_status)
+{
+	switch (iic_status) {
+	case IIC_NOERR:         return (0);
+	case IIC_EBUSERR:       return (EALREADY);
+	case IIC_ENOACK:        return (EIO);
+	case IIC_ETIMEOUT:      return (ETIMEDOUT);
+	case IIC_EBUSBSY:       return (EWOULDBLOCK);
+	case IIC_ESTATUS:       return (EPROTO);
+	case IIC_EUNDERFLOW:    return (EIO);
+	case IIC_EOVERFLOW:     return (EOVERFLOW);
+	case IIC_ENOTSUPP:      return (EOPNOTSUPP);
+	case IIC_ENOADDR:       return (EADDRNOTAVAIL);
+	case IIC_ERESOURCE:     return (ENOMEM);
+	default:                return (EIO);
+	}
+}
+
+/*
  * iicbus_intr()
  */
 void
@@ -70,8 +92,7 @@ iicbus_poll(struct iicbus_softc *sc, int how)
 		break;
 
 	default:
-		return (EWOULDBLOCK);
-		break;
+		return (IIC_EBUSBSY);
 	}
 
 	return (error);
@@ -90,31 +111,32 @@ iicbus_request_bus(device_t bus, device_t dev, int how)
 	struct iicbus_softc *sc = (struct iicbus_softc *)device_get_softc(bus);
 	int error = 0;
 
-	/* first, ask the underlying layers if the request is ok */
 	IICBUS_LOCK(sc);
-	do {
-		error = IICBUS_CALLBACK(device_get_parent(bus),
-						IIC_REQUEST_BUS, (caddr_t)&how);
-		if (error)
-			error = iicbus_poll(sc, how);
-	} while (error == EWOULDBLOCK);
-
-	while (!error) {
-		if (sc->owner && sc->owner != dev) {
 
-			error = iicbus_poll(sc, how);
-		} else {
-			sc->owner = dev;
+	while ((error == 0) && (sc->owner != NULL))
+		error = iicbus_poll(sc, how);
+
+	if (error == 0) {
+		sc->owner = dev;
+		/* 
+		 * Drop the lock around the call to the bus driver. 
+		 * This call should be allowed to sleep in the IIC_WAIT case.
+		 * Drivers might also need to grab locks that would cause LOR
+		 * if our lock is held.
+		 */
+		IICBUS_UNLOCK(sc);
+		/* Ask the underlying layers if the request is ok */
+		error = IICBUS_CALLBACK(device_get_parent(bus),
+		    IIC_REQUEST_BUS, (caddr_t)&how);
+		IICBUS_LOCK(sc);
 
-			IICBUS_UNLOCK(sc);
-			return (0);
+		if (error != 0) {
+			sc->owner = NULL;
+			wakeup_one(sc);
 		}
-
-		/* free any allocated resource */
-		if (error)
-			IICBUS_CALLBACK(device_get_parent(bus), IIC_RELEASE_BUS,
-					(caddr_t)&how);
 	}
+
+
 	IICBUS_UNLOCK(sc);
 
 	return (error);
@@ -131,26 +153,33 @@ iicbus_release_bus(device_t bus, device_t dev)
 	struct iicbus_softc *sc = (struct iicbus_softc *)device_get_softc(bus);
 	int error;
 
-	/* first, ask the underlying layers if the release is ok */
-	error = IICBUS_CALLBACK(device_get_parent(bus), IIC_RELEASE_BUS, NULL);
-
-	if (error)
-		return (error);
-
 	IICBUS_LOCK(sc);
 
 	if (sc->owner != dev) {
 		IICBUS_UNLOCK(sc);
-		return (EACCES);
+		return (IIC_EBUSBSY);
 	}
 
-	sc->owner = NULL;
-
-	/* wakeup waiting processes */
-	wakeup(sc);
+	/* 
+	 * Drop the lock around the call to the bus driver. 
+	 * This call should be allowed to sleep in the IIC_WAIT case.
+	 * Drivers might also need to grab locks that would cause LOR
+	 * if our lock is held.
+	 */
 	IICBUS_UNLOCK(sc);
+	/* Ask the underlying layers if the release is ok */
+	error = IICBUS_CALLBACK(device_get_parent(bus), IIC_RELEASE_BUS, NULL);
 
-	return (0);
+	if (error == 0) {
+		IICBUS_LOCK(sc);
+		sc->owner = NULL;
+
+		/* wakeup a waiting thread */
+		wakeup_one(sc);
+		IICBUS_UNLOCK(sc);
+	}
+
+	return (error);
 }
 
 /*
@@ -178,7 +207,7 @@ iicbus_start(device_t bus, u_char slave, int timeout)
 	int error = 0;
 
 	if (sc->started)
-		return (EINVAL);		/* bus already started */
+		return (IIC_ESTATUS); /* protocol error, bus already started */
 
 	if (!(error = IICBUS_START(device_get_parent(bus), slave, timeout)))
 		sc->started = slave;
@@ -200,7 +229,7 @@ iicbus_repeated_start(device_t bus, u_char slave, int timeout)
 	int error = 0;
 
 	if (!sc->started)
-		return (EINVAL);     /* bus should have been already started */
+		return (IIC_ESTATUS); /* protocol error, bus not started */
 
 	if (!(error = IICBUS_REPEATED_START(device_get_parent(bus), slave, timeout)))
 		sc->started = slave;
@@ -222,7 +251,7 @@ iicbus_stop(device_t bus)
 	int error = 0;
 
 	if (!sc->started)
-		return (EINVAL);		/* bus not started */
+		return (IIC_ESTATUS); /* protocol error, bus not started */
 
 	error = IICBUS_STOP(device_get_parent(bus));
 
@@ -245,7 +274,7 @@ iicbus_write(device_t bus, const char *buf, int len, int *sent, int timeout)
 	
 	/* a slave must have been started for writing */
 	if (sc->started == 0 || (sc->strict != 0 && (sc->started & LSB) != 0))
-		return (EINVAL);
+		return (IIC_ESTATUS);
 
 	return (IICBUS_WRITE(device_get_parent(bus), buf, len, sent, timeout));
 }
@@ -263,7 +292,7 @@ iicbus_read(device_t bus, char *buf, int len, int *read, int last, int delay)
 	
 	/* a slave must have been started for reading */
 	if (sc->started == 0 || (sc->strict != 0 && (sc->started & LSB) == 0))
-		return (EINVAL);
+		return (IIC_ESTATUS);
 
 	return (IICBUS_READ(device_get_parent(bus), buf, len, read, last, delay));
 }
@@ -276,9 +305,14 @@ iicbus_read(device_t bus, char *buf, int len, int *read, int last, int delay)
 int
 iicbus_write_byte(device_t bus, char byte, int timeout)
 {
+	struct iicbus_softc *sc = device_get_softc(bus);
 	char data = byte;
 	int sent;
 
+	/* a slave must have been started for writing */
+	if (sc->started == 0 || (sc->strict != 0 && (sc->started & LSB) != 0))
+		return (IIC_ESTATUS);
+
 	return (iicbus_write(bus, &data, 1, &sent, timeout));
 }
 
@@ -290,8 +324,13 @@ iicbus_write_byte(device_t bus, char byte, int timeout)
 int
 iicbus_read_byte(device_t bus, char *byte, int timeout)
 {
+	struct iicbus_softc *sc = device_get_softc(bus);
 	int read;
 
+	/* a slave must have been started for reading */
+	if (sc->started == 0 || (sc->strict != 0 && (sc->started & LSB) == 0))
+		return (IIC_ESTATUS);
+
 	return (iicbus_read(bus, byte, 1, &read, IIC_LAST_READ, timeout));
 }
 
@@ -352,6 +391,7 @@ iicbus_block_read(device_t bus, u_char slave, char *buf, int len, int *read)
 int
 iicbus_transfer(device_t bus, struct iic_msg *msgs, uint32_t nmsgs)
 {
+
 	return (IICBUS_TRANSFER(device_get_parent(bus), msgs, nmsgs));
 }
 
@@ -368,10 +408,10 @@ iicbus_transfer_gen(device_t dev, struct iic_msg *msgs, uint32_t nmsgs)
 	bool nostop;
 
 	if ((error = device_get_children(dev, &children, &nkid)) != 0)
-		return (error);
+		return (IIC_ERESOURCE);
 	if (nkid != 1) {
 		free(children, M_TEMP);
-		return (EIO);
+		return (IIC_ENOTSUPP);
 	}
 	bus = children[0];
 	rpstart = 0;
@@ -390,8 +430,7 @@ iicbus_transfer_gen(device_t dev, struct iic_msg *msgs, uint32_t nmsgs)
 			else
 				error = iicbus_start(bus, addr, 0);
 		}
-
-		if (error)
+		if (error != 0)
 			break;
 
 		if (msgs[i].flags & IIC_M_RD)
@@ -400,6 +439,8 @@ iicbus_transfer_gen(device_t dev, struct iic_msg *msgs, uint32_t nmsgs)
 		else
 			error = iicbus_write(bus, msgs[i].buf, msgs[i].len,
 			    &lenwrote, 0);
+		if (error != 0)
+			break;
 
 		if ((msgs[i].flags & IIC_M_NOSTOP) != 0 ||
 		    (nostop && i + 1 < nmsgs)) {
@@ -409,5 +450,7 @@ iicbus_transfer_gen(device_t dev, struct iic_msg *msgs, uint32_t nmsgs)
 			iicbus_stop(bus);
 		}
 	}
+	if (error != 0 && !nostop)
+		iicbus_stop(bus);
 	return (error);
 }
diff --git a/sys/dev/iicbus/iiconf.h b/sys/dev/iicbus/iiconf.h
index 092ba8d..aca0137 100644
--- a/sys/dev/iicbus/iiconf.h
+++ b/sys/dev/iicbus/iiconf.h
@@ -43,6 +43,7 @@
 #define IIC_NOINTR	0
 #define IIC_WAIT	0x1
 #define IIC_INTR	0x2
+#define IIC_INTRWAIT	(IIC_INTR | IIC_WAIT)
 
 /*
  * i2c modes
@@ -82,16 +83,22 @@
  * adapter layer errors
  */
 #define IIC_NOERR	0x0	/* no error occured */
-#define IIC_EBUSERR	0x1	/* bus error */
+#define IIC_EBUSERR	0x1	/* bus error (hardware not in expected state) */
 #define IIC_ENOACK	0x2	/* ack not received until timeout */
 #define IIC_ETIMEOUT	0x3	/* timeout */
-#define IIC_EBUSBSY	0x4	/* bus busy */
+#define IIC_EBUSBSY	0x4	/* bus busy (reserved by another client) */
 #define IIC_ESTATUS	0x5	/* status error */
 #define IIC_EUNDERFLOW	0x6	/* slave ready for more data */
 #define IIC_EOVERFLOW	0x7	/* too much data */
 #define IIC_ENOTSUPP	0x8	/* request not supported */
 #define IIC_ENOADDR	0x9	/* no address assigned to the interface */
+#define IIC_ERESOURCE	0xa	/* resources (memory, whatever) unavailable */
 
+/*
+ * Note that all iicbus functions return IIC_Exxxxx status values,
+ * except iic2errno() (obviously) and iicbus_started() (returns bool).
+ */
+extern int iic2errno(int);
 extern int iicbus_request_bus(device_t, device_t, int);
 extern int iicbus_release_bus(device_t, device_t);
 extern device_t iicbus_alloc_bus(device_t);
diff --git a/sys/dev/pcf/pcf.c b/sys/dev/pcf/pcf.c
index 55e0346..f9252b5 100644
--- a/sys/dev/pcf/pcf.c
+++ b/sys/dev/pcf/pcf.c
@@ -170,7 +170,7 @@ pcf_start(device_t dev, u_char slave, int timeout)
 		printf("pcf: busy!\n");
 #endif
 		PCF_UNLOCK(sc);
-		return (IIC_EBUSBSY);
+		return (IIC_EBUSERR);
 	}
 
 	/* set slave address to PCF. Last bit (LSB) must be set correctly
diff --git a/sys/powerpc/mpc85xx/i2c.c b/sys/powerpc/mpc85xx/i2c.c
index f21c845..e02a08b 100644
--- a/sys/powerpc/mpc85xx/i2c.c
+++ b/sys/powerpc/mpc85xx/i2c.c
@@ -284,7 +284,7 @@ i2c_start(device_t dev, u_char slave, int timeout)
 		debugf("bus busy");
 		mtx_unlock(&sc->mutex);
 		i2c_stop(dev);
-		return (IIC_EBUSBSY);
+		return (IIC_EBUSERR);
 	}
 
 	/* Set start condition */