xref: /netbsd/sys/arch/arc/dti/btl.c (revision c4a72b64)
1 /*	$NetBSD: btl.c,v 1.10 2002/10/02 04:59:47 thorpej Exp $	*/
2 /*	NetBSD: bt.c,v 1.10 1996/05/12 23:51:54 mycroft Exp 	*/
3 
4 #undef BTDIAG
5 #define integrate
6 
7 #define notyet /* XXX - #undef this, if this driver does actually work */
8 
9 /*
10  * Copyright (c) 1994, 1996 Charles M. Hannum.  All rights reserved.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. All advertising materials mentioning features or use of this software
21  *    must display the following acknowledgement:
22  *	This product includes software developed by Charles M. Hannum.
23  * 4. The name of the author may not be used to endorse or promote products
24  *    derived from this software without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
27  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
28  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
29  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
30  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
31  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
32  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
33  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
34  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36  */
37 
38 /*
39  * Originally written by Julian Elischer (julian@tfs.com)
40  * for TRW Financial Systems for use under the MACH(2.5) operating system.
41  *
42  * TRW Financial Systems, in accordance with their agreement with Carnegie
43  * Mellon University, makes this software available to CMU to distribute
44  * or use in any manner that they see fit as long as this message is kept with
45  * the software. For this reason TFS also grants any other persons or
46  * organisations permission to use or modify this software.
47  *
48  * TFS supplies this software to be publicly redistributed
49  * on the understanding that TFS is not responsible for the correct
50  * functioning of this software in any circumstances.
51  */
52 
53 #include <sys/types.h>
54 #include <sys/param.h>
55 #include <sys/systm.h>
56 #include <sys/kernel.h>
57 #include <sys/errno.h>
58 #include <sys/malloc.h>
59 #include <sys/ioctl.h>
60 #include <sys/device.h>
61 #include <sys/buf.h>
62 #include <sys/proc.h>
63 #include <sys/user.h>
64 
65 #include <machine/intr.h>
66 #include <machine/pio.h>
67 
68 #include <arc/dti/desktech.h>
69 
70 #include <dev/scsipi/scsi_all.h>
71 #include <dev/scsipi/scsipi_all.h>
72 #include <dev/scsipi/scsiconf.h>
73 
74 #include <dev/isa/isavar.h>
75 #include <arc/dti/btlreg.h>
76 #include <arc/dti/btlvar.h>
77 
78 #ifndef DDB
79 #define Debugger() panic("should call debugger here (bt742a.c)")
80 #endif /* ! DDB */
81 
82 /*
83  * Mail box defs  etc.
84  * these could be bigger but we need the bt_softc to fit on a single page..
85  */
86 #define BT_MBX_SIZE	32	/* mail box size  (MAX 255 MBxs) */
87 				/* don't need that many really */
88 #define BT_CCB_MAX	32	/* store up to 32 CCBs at one time */
89 #define	CCB_HASH_SIZE	32	/* hash table size for phystokv */
90 #define	CCB_HASH_SHIFT	9
91 #define CCB_HASH(x)	((((long)(x))>>CCB_HASH_SHIFT) & (CCB_HASH_SIZE - 1))
92 
93 #define bt_nextmbx(wmb, mbx, mbio) \
94 	if ((wmb) == &(mbx)->mbio[BT_MBX_SIZE - 1])	\
95 		(wmb) = &(mbx)->mbio[0];		\
96 	else						\
97 		(wmb)++;
98 
99 struct bt_mbx {
100 	struct bt_mbx_out mbo[BT_MBX_SIZE];
101 	struct bt_mbx_in mbi[BT_MBX_SIZE];
102 	struct bt_mbx_out *cmbo;	/* Collection Mail Box out */
103 	struct bt_mbx_out *tmbo;	/* Target Mail Box out */
104 	struct bt_mbx_in *tmbi;		/* Target Mail Box in */
105 };
106 
107 #define KVTOPHYS(x)	(*btl_conf->bc_kvtophys)((int)(x))
108 #define PHYSTOKV(x)	(*btl_conf->bc_phystokv)((int)(x))
109 
110 struct bt_softc {
111 	struct device sc_dev;
112 	void *sc_ih;
113 
114 	int sc_iobase;
115 	int sc_irq, sc_drq;
116 
117 	char sc_model[7],
118 	     sc_firmware[6];
119 
120 	struct bt_mbx *sc_mbx;		/* all our mailboxes */
121 #define	wmbx	(sc->sc_mbx)
122 	struct bt_ccb *sc_ccbhash[CCB_HASH_SIZE];
123 	TAILQ_HEAD(, bt_ccb) sc_free_ccb, sc_waiting_ccb;
124 	TAILQ_HEAD(, bt_buf) sc_free_buf;
125 	int sc_numccbs, sc_mbofull;
126 	int sc_numbufs;
127 	int sc_scsi_dev;		/* adapters scsi id */
128 	struct scsipi_link sc_link;	/* prototype for devs */
129 	struct scsipi_adapter sc_adapter;
130 };
131 
132 #ifdef BTDEBUG
133 int     bt_debug = 0;
134 #endif /* BTDEBUG */
135 
136 int bt_cmd __P((int, struct bt_softc *, int, u_char *, int, u_char *));
137 integrate void bt_finish_ccbs __P((struct bt_softc *));
138 int btintr __P((void *));
139 integrate void bt_reset_ccb __P((struct bt_softc *, struct bt_ccb *));
140 void bt_free_ccb __P((struct bt_softc *, struct bt_ccb *));
141 integrate void bt_init_ccb __P((struct bt_softc *, struct bt_ccb *));
142 struct bt_ccb *bt_get_ccb __P((struct bt_softc *, int));
143 struct bt_ccb *bt_ccb_phys_kv __P((struct bt_softc *, u_long));
144 void bt_queue_ccb __P((struct bt_softc *, struct bt_ccb *));
145 void bt_collect_mbo __P((struct bt_softc *));
146 void bt_start_ccbs __P((struct bt_softc *));
147 void bt_done __P((struct bt_softc *, struct bt_ccb *));
148 int bt_find __P((struct isa_attach_args *, struct bt_softc *));
149 void bt_init __P((struct bt_softc *));
150 void bt_inquire_setup_information __P((struct bt_softc *));
151 void btminphys __P((struct buf *));
152 int bt_scsi_cmd __P((struct scsipi_xfer *));
153 int bt_poll __P((struct bt_softc *, struct scsipi_xfer *, int));
154 void bt_timeout __P((void *arg));
155 void bt_free_buf __P((struct bt_softc *, struct bt_buf *));
156 struct bt_buf * bt_get_buf __P((struct bt_softc *, int));
157 
158 /* the below structure is so we have a default dev struct for out link struct */
159 struct scsipi_device bt_dev = {
160 	NULL,			/* Use default error handler */
161 	NULL,			/* have a queue, served by this */
162 	NULL,			/* have no async handler */
163 	NULL,			/* Use default 'done' routine */
164 };
165 
166 int	btprobe __P((struct device *, struct cfdata *, void *));
167 void	btattach __P((struct device *, struct device *, void *));
168 int	btprint __P((void *, const char *));
169 
170 CFATTACH_DECL(btl, sizeof(struct bt_softc),
171     btprobe, btattach, NULL, NULL);
172 
173 #define BT_RESET_TIMEOUT	2000	/* time to wait for reset (mSec) */
174 #define	BT_ABORT_TIMEOUT	2000	/* time to wait for abort (mSec) */
175 
176 struct btl_config *btl_conf = NULL;
177 
178 /*
179  * bt_cmd(iobase, sc, icnt, ibuf, ocnt, obuf)
180  *
181  * Activate Adapter command
182  *    icnt:   number of args (outbound bytes including opcode)
183  *    ibuf:   argument buffer
184  *    ocnt:   number of expected returned bytes
185  *    obuf:   result buffer
186  *    wait:   number of seconds to wait for response
187  *
188  * Performs an adapter command through the ports.  Not to be confused with a
189  * scsi command, which is read in via the dma; one of the adapter commands
190  * tells it to read in a scsi command.
191  */
192 int
193 bt_cmd(iobase, sc, icnt, ibuf, ocnt, obuf)
194 	int iobase;
195 	struct bt_softc *sc;
196 	int icnt, ocnt;
197 	u_char *ibuf, *obuf;
198 {
199 	const char *name;
200 	register int i;
201 	int wait;
202 	u_char sts;
203 	u_char opcode = ibuf[0];
204 
205 	if (sc != NULL)
206 		name = sc->sc_dev.dv_xname;
207 	else
208 		name = "(bt probe)";
209 
210 	/*
211 	 * Calculate a reasonable timeout for the command.
212 	 */
213 	switch (opcode) {
214 	case BT_INQUIRE_DEVICES:
215 		wait = 15 * 20000;
216 		break;
217 	default:
218 		wait = 1 * 20000;
219 		break;
220 	}
221 
222 	/*
223 	 * Wait for the adapter to go idle, unless it's one of
224 	 * the commands which don't need this
225 	 */
226 	if (opcode != BT_MBO_INTR_EN) {
227 		for (i = 20000; i; i--) {	/* 1 sec? */
228 			sts = isa_inb(iobase + BT_STAT_PORT);
229 			if (sts & BT_STAT_IDLE)
230 				break;
231 			delay(50);
232 		}
233 		if (!i) {
234 			printf("%s: bt_cmd, host not idle(0x%x)\n",
235 			    name, sts);
236 			return ENXIO;
237 		}
238 	}
239 	/*
240 	 * Now that it is idle, if we expect output, preflush the
241 	 * queue feeding to us.
242 	 */
243 	if (ocnt) {
244 		while ((isa_inb(iobase + BT_STAT_PORT)) & BT_STAT_DF)
245 			isa_inb(iobase + BT_DATA_PORT);
246 	}
247 	/*
248 	 * Output the command and the number of arguments given
249 	 * for each byte, first check the port is empty.
250 	 */
251 	while (icnt--) {
252 		for (i = wait; i; i--) {
253 			sts = isa_inb(iobase + BT_STAT_PORT);
254 			if (!(sts & BT_STAT_CDF))
255 				break;
256 			delay(50);
257 		}
258 		if (!i) {
259 			if (opcode != BT_INQUIRE_REVISION &&
260 			    opcode != BT_INQUIRE_REVISION_3)
261 				printf("%s: bt_cmd, cmd/data port full\n", name);
262 			isa_outb(iobase + BT_CTRL_PORT, BT_CTRL_SRST);
263 			return ENXIO;
264 		}
265 		isa_outb(iobase + BT_CMD_PORT, *ibuf++);
266 	}
267 	/*
268 	 * If we expect input, loop that many times, each time,
269 	 * looking for the data register to have valid data
270 	 */
271 	while (ocnt--) {
272 		for (i = wait; i; i--) {
273 			sts = isa_inb(iobase + BT_STAT_PORT);
274 			if (sts & BT_STAT_DF)
275 				break;
276 			delay(50);
277 		}
278 		if (!i) {
279 			if (opcode != BT_INQUIRE_REVISION &&
280 			    opcode != BT_INQUIRE_REVISION_3)
281 				printf("%s: bt_cmd, cmd/data port empty %d\n",
282 				    name, ocnt);
283 			isa_outb(iobase + BT_CTRL_PORT, BT_CTRL_SRST);
284 			return ENXIO;
285 		}
286 		*obuf++ = isa_inb(iobase + BT_DATA_PORT);
287 	}
288 	/*
289 	 * Wait for the board to report a finished instruction.
290 	 * We may get an extra interrupt for the HACC signal, but this is
291 	 * unimportant.
292 	 */
293 	if (opcode != BT_MBO_INTR_EN) {
294 		for (i = 20000; i; i--) {	/* 1 sec? */
295 			sts = isa_inb(iobase + BT_INTR_PORT);
296 			/* XXX Need to save this in the interrupt handler? */
297 			if (sts & BT_INTR_HACC)
298 				break;
299 			delay(50);
300 		}
301 		if (!i) {
302 			printf("%s: bt_cmd, host not finished(0x%x)\n",
303 			    name, sts);
304 			return ENXIO;
305 		}
306 	}
307 	isa_outb(iobase + BT_CTRL_PORT, BT_CTRL_IRST);
308 	return 0;
309 }
310 
311 /*
312  * Check if the device can be found at the port given
313  * and if so, set it up ready for further work
314  * as an argument, takes the isa_device structure from
315  * autoconf.c
316  */
317 int
318 btprobe(parent, match, aux)
319 	struct device *parent;
320 	struct cfdata *match;
321 	void *aux;
322 {
323 	register struct isa_attach_args *ia = aux;
324 
325 #ifdef NEWCONFIG
326 	if (ia->ia_iobase == IOBASEUNK)
327 		return 0;
328 #endif
329 
330 	if (btl_conf == NULL)
331 		return (0);
332 
333 	/* See if there is a unit at this location. */
334 	if (bt_find(ia, NULL) != 0)
335 		return 0;
336 
337 	ia->ia_msize = 0;
338 	ia->ia_iosize = 4;
339 	/* IRQ and DRQ set by bt_find(). */
340 	return 1;
341 }
342 
343 /*
344  * Attach all the sub-devices we can find
345  */
346 void
347 btattach(parent, self, aux)
348 	struct device *parent, *self;
349 	void *aux;
350 {
351 	struct isa_attach_args *ia = aux;
352 	struct bt_softc *sc = (void *)self;
353 	struct bt_ccb *ccb;
354 	struct bt_buf *buf;
355 	u_int bouncearea;
356 	u_int bouncebase;
357 	u_int bouncesize;
358 
359 	if (bt_find(ia, sc) != 0)
360 		panic("btattach: bt_find of %s failed", self->dv_xname);
361 	sc->sc_iobase = ia->ia_iobase;
362 
363 	/*
364 	 * create mbox area
365 	 */
366 	(*btl_conf->bc_bouncemem)(&bouncebase, &bouncesize);
367 	bouncearea = bouncebase + sizeof(struct bt_mbx);
368 	sc->sc_mbx = (struct bt_mbx *)bouncebase;
369 
370 	bt_inquire_setup_information(sc);
371 	bt_init(sc);
372 	TAILQ_INIT(&sc->sc_free_ccb);
373 	TAILQ_INIT(&sc->sc_free_buf);
374 	TAILQ_INIT(&sc->sc_waiting_ccb);
375 
376 	/*
377 	 * fill up with ccb's
378 	 */
379 	while (sc->sc_numccbs < BT_CCB_MAX) {
380 		ccb = (struct bt_ccb *)bouncearea;
381 		bouncearea +=  sizeof(struct bt_ccb);
382 		bt_init_ccb(sc, ccb);
383 		TAILQ_INSERT_HEAD(&sc->sc_free_ccb, ccb, chain);
384 		sc->sc_numccbs++;
385 	}
386 	/*
387 	 * fill up with bufs's
388 	 */
389 	while ((bouncearea + sizeof(struct bt_buf)) < bouncebase + bouncesize) {
390 		buf = (struct bt_buf *)bouncearea;
391 		bouncearea +=  sizeof(struct bt_buf);
392 		TAILQ_INSERT_HEAD(&sc->sc_free_buf, buf, chain);
393 		sc->sc_numbufs++;
394 	}
395 	/*
396 	 * Fill in the adapter.
397 	 */
398 	sc->sc_adapter.scsipi_cmd = bt_scsi_cmd;
399 	sc->sc_adapter.scsipi_minphys = btminphys;
400 	/*
401 	 * fill in the prototype scsipi_link.
402 	 */
403 	sc->sc_link.scsipi_scsi.channel = SCSI_CHANNEL_ONLY_ONE;
404 	sc->sc_link.adapter_softc = sc;
405 	sc->sc_link.scsipi_scsi.adapter_target = sc->sc_scsi_dev;
406 	sc->sc_link.adapter = &sc->sc_adapter;
407 	sc->sc_link.device = &bt_dev;
408 	sc->sc_link.openings = 1;
409 	sc->sc_link.scsipi_scsi.max_target = 7;
410 	sc->sc_link.scsipi_scsi.max_lun = 7;
411 	sc->sc_link.type = BUS_SCSI;
412 
413 	sc->sc_ih = isa_intr_establish(ia->ia_ic, sc->sc_irq, IST_EDGE,
414 	    IPL_BIO, btintr, sc);
415 
416 	/*
417 	 * ask the adapter what subunits are present
418 	 */
419 	config_found(self, &sc->sc_link, scsiprint);
420 }
421 
422 integrate void
423 bt_finish_ccbs(sc)
424 	struct bt_softc *sc;
425 {
426 	struct bt_mbx_in *wmbi;
427 	struct bt_ccb *ccb;
428 	int i;
429 
430 	wmbi = wmbx->tmbi;
431 
432 	if (wmbi->stat == BT_MBI_FREE) {
433 		for (i = 0; i < BT_MBX_SIZE; i++) {
434 			if (wmbi->stat != BT_MBI_FREE) {
435 				printf("%s: mbi not in round-robin order\n",
436 				    sc->sc_dev.dv_xname);
437 				goto AGAIN;
438 			}
439 			bt_nextmbx(wmbi, wmbx, mbi);
440 		}
441 #ifdef BTDIAGnot
442 		printf("%s: mbi interrupt with no full mailboxes\n",
443 		    sc->sc_dev.dv_xname);
444 #endif
445 		return;
446 	}
447 
448 AGAIN:
449 	do {
450 		ccb = bt_ccb_phys_kv(sc, phystol(wmbi->ccb_addr));
451 		if (!ccb) {
452 			printf("%s: bad mbi ccb pointer; skipping\n",
453 			    sc->sc_dev.dv_xname);
454 			goto next;
455 		}
456 
457 #ifdef BTDEBUG
458 		if (bt_debug) {
459 			u_char *cp = (u_char *) &ccb->scsi_cmd;
460 			printf("op=%x %x %x %x %x %x\n",
461 			    cp[0], cp[1], cp[2], cp[3], cp[4], cp[5]);
462 			printf("stat %x for mbi addr = 0x%08x, ",
463 			    wmbi->stat, wmbi);
464 			printf("ccb addr = 0x%x\n", ccb);
465 		}
466 #endif /* BTDEBUG */
467 
468 		switch (wmbi->stat) {
469 		case BT_MBI_OK:
470 		case BT_MBI_ERROR:
471 			if ((ccb->flags & CCB_ABORT) != 0) {
472 				/*
473 				 * If we already started an abort, wait for it
474 				 * to complete before clearing the CCB.  We
475 				 * could instead just clear CCB_SENDING, but
476 				 * what if the mailbox was already received?
477 				 * The worst that happens here is that we clear
478 				 * the CCB a bit later than we need to.  BFD.
479 				 */
480 				goto next;
481 			}
482 			break;
483 
484 		case BT_MBI_ABORT:
485 		case BT_MBI_UNKNOWN:
486 			/*
487 			 * Even if the CCB wasn't found, we clear it anyway.
488 			 * See preceding comment.
489 			 */
490 			break;
491 
492 		default:
493 			printf("%s: bad mbi status %02x; skipping\n",
494 			    sc->sc_dev.dv_xname, wmbi->stat);
495 			goto next;
496 		}
497 
498 		callout_stop(&ccb->xs->xs_callout);
499 		bt_done(sc, ccb);
500 
501 	next:
502 		wmbi->stat = BT_MBI_FREE;
503 		bt_nextmbx(wmbi, wmbx, mbi);
504 	} while (wmbi->stat != BT_MBI_FREE);
505 
506 	wmbx->tmbi = wmbi;
507 }
508 
509 /*
510  * Catch an interrupt from the adaptor
511  */
512 int
513 btintr(arg)
514 	void *arg;
515 {
516 	struct bt_softc *sc = arg;
517 	int iobase = sc->sc_iobase;
518 	u_char sts;
519 
520 #ifdef BTDEBUG
521 	printf("%s: btintr ", sc->sc_dev.dv_xname);
522 #endif /* BTDEBUG */
523 
524 	/*
525 	 * First acknowlege the interrupt, Then if it's not telling about
526 	 * a completed operation just return.
527 	 */
528 	sts = isa_inb(iobase + BT_INTR_PORT);
529 	if ((sts & BT_INTR_ANYINTR) == 0)
530 		return 0;
531 	isa_outb(iobase + BT_CTRL_PORT, BT_CTRL_IRST);
532 
533 #ifdef BTDIAG
534 	/* Make sure we clear CCB_SENDING before finishing a CCB. */
535 	bt_collect_mbo(sc);
536 #endif
537 
538 	/* Mail box out empty? */
539 	if (sts & BT_INTR_MBOA) {
540 		struct bt_toggle toggle;
541 
542 		toggle.cmd.opcode = BT_MBO_INTR_EN;
543 		toggle.cmd.enable = 0;
544 		bt_cmd(iobase, sc, sizeof(toggle.cmd), (u_char *)&toggle.cmd, 0,
545 		    (u_char *)0);
546 		bt_start_ccbs(sc);
547 	}
548 
549 	/* Mail box in full? */
550 	if (sts & BT_INTR_MBIF)
551 		bt_finish_ccbs(sc);
552 
553 	return 1;
554 }
555 
556 integrate void
557 bt_reset_ccb(sc, ccb)
558 	struct bt_softc *sc;
559 	struct bt_ccb *ccb;
560 {
561 
562 	ccb->flags = 0;
563 }
564 
565 /*
566  * A ccb is put onto the free list.
567  */
568 void
569 bt_free_ccb(sc, ccb)
570 	struct bt_softc *sc;
571 	struct bt_ccb *ccb;
572 {
573 	int s;
574 
575 	s = splbio();
576 
577 	bt_reset_ccb(sc, ccb);
578 	TAILQ_INSERT_HEAD(&sc->sc_free_ccb, ccb, chain);
579 
580 	/*
581 	 * If there were none, wake anybody waiting for one to come free,
582 	 * starting with queued entries.
583 	 */
584 	if (ccb->chain.tqe_next == 0)
585 		wakeup(&sc->sc_free_ccb);
586 
587 	splx(s);
588 }
589 
590 /*
591  * A buf is put onto the free list.
592  */
593 void
594 bt_free_buf(sc, buf)
595 	struct bt_softc *sc;
596 	struct bt_buf *buf;
597 {
598 	int s;
599 
600 	s = splbio();
601 
602 	TAILQ_INSERT_HEAD(&sc->sc_free_buf, buf, chain);
603 	sc->sc_numbufs++;
604 
605 	/*
606 	 * If there were none, wake anybody waiting for one to come free,
607 	 * starting with queued entries.
608 	 */
609 	if (buf->chain.tqe_next == 0)
610 		wakeup(&sc->sc_free_buf);
611 
612 	splx(s);
613 }
614 
615 integrate void
616 bt_init_ccb(sc, ccb)
617 	struct bt_softc *sc;
618 	struct bt_ccb *ccb;
619 {
620 	int hashnum;
621 
622 	bzero(ccb, sizeof(struct bt_ccb));
623 	/*
624 	 * put in the phystokv hash table
625 	 * Never gets taken out.
626 	 */
627 	ccb->hashkey = KVTOPHYS(ccb);
628 	hashnum = CCB_HASH(ccb->hashkey);
629 	ccb->nexthash = sc->sc_ccbhash[hashnum];
630 	sc->sc_ccbhash[hashnum] = ccb;
631 	bt_reset_ccb(sc, ccb);
632 }
633 
634 /*
635  * Get a free ccb
636  *
637  * If there are none, either return an error or sleep.
638  */
639 struct bt_ccb *
640 bt_get_ccb(sc, nosleep)
641 	struct bt_softc *sc;
642 	int nosleep;
643 {
644 	struct bt_ccb *ccb;
645 	int s;
646 
647 	s = splbio();
648 
649 	/*
650 	 * If we can and have to, sleep waiting for one to come free.
651 	 */
652 	for (;;) {
653 		ccb = sc->sc_free_ccb.tqh_first;
654 		if (ccb) {
655 			TAILQ_REMOVE(&sc->sc_free_ccb, ccb, chain);
656 			break;
657 		}
658 		if (nosleep)
659 			goto out;
660 		tsleep(&sc->sc_free_ccb, PRIBIO, "btccb", 0);
661 	}
662 
663 	ccb->flags |= CCB_ALLOC;
664 
665 out:
666 	splx(s);
667 	return ccb;
668 }
669 
670 /*
671  * Get a free buf
672  *
673  * If there are none, either return an error or sleep.
674  */
675 struct bt_buf *
676 bt_get_buf(sc, nosleep)
677 	struct bt_softc *sc;
678 	int nosleep;
679 {
680 	struct bt_buf *buf;
681 	int s;
682 
683 	s = splbio();
684 
685 	/*
686 	 * If we can and have to, sleep waiting for one to come free.
687 	 */
688 	for (;;) {
689 		buf = sc->sc_free_buf.tqh_first;
690 		if (buf) {
691 			TAILQ_REMOVE(&sc->sc_free_buf, buf, chain);
692 			sc->sc_numbufs--;
693 			break;
694 		}
695 		if (nosleep)
696 			goto out;
697 		tsleep(&sc->sc_free_buf, PRIBIO, "btbuf", 0);
698 	}
699 
700 out:
701 	splx(s);
702 	return buf;
703 }
704 
705 /*
706  * Given a physical address, find the ccb that it corresponds to.
707  */
708 struct bt_ccb *
709 bt_ccb_phys_kv(sc, ccb_phys)
710 	struct bt_softc *sc;
711 	u_long ccb_phys;
712 {
713 	int hashnum = CCB_HASH(ccb_phys);
714 	struct bt_ccb *ccb = sc->sc_ccbhash[hashnum];
715 
716 	while (ccb) {
717 		if (ccb->hashkey == ccb_phys)
718 			break;
719 		ccb = ccb->nexthash;
720 	}
721 	return ccb;
722 }
723 
724 /*
725  * Queue a CCB to be sent to the controller, and send it if possible.
726  */
727 void
728 bt_queue_ccb(sc, ccb)
729 	struct bt_softc *sc;
730 	struct bt_ccb *ccb;
731 {
732 
733 	TAILQ_INSERT_TAIL(&sc->sc_waiting_ccb, ccb, chain);
734 	bt_start_ccbs(sc);
735 }
736 
737 /*
738  * Garbage collect mailboxes that are no longer in use.
739  */
740 void
741 bt_collect_mbo(sc)
742 	struct bt_softc *sc;
743 {
744 	struct bt_mbx_out *wmbo;	/* Mail Box Out pointer */
745 
746 	wmbo = wmbx->cmbo;
747 
748 	while (sc->sc_mbofull > 0) {
749 		if (wmbo->cmd != BT_MBO_FREE)
750 			break;
751 
752 #ifdef BTDIAG
753 		ccb = bt_ccb_phys_kv(sc, phystol(wmbo->ccb_addr));
754 		ccb->flags &= ~CCB_SENDING;
755 #endif
756 
757 		--sc->sc_mbofull;
758 		bt_nextmbx(wmbo, wmbx, mbo);
759 	}
760 
761 	wmbx->cmbo = wmbo;
762 }
763 
764 /*
765  * Send as many CCBs as we have empty mailboxes for.
766  */
767 void
768 bt_start_ccbs(sc)
769 	struct bt_softc *sc;
770 {
771 	int iobase = sc->sc_iobase;
772 	struct bt_mbx_out *wmbo;	/* Mail Box Out pointer */
773 	struct bt_ccb *ccb;
774 
775 	wmbo = wmbx->tmbo;
776 
777 	while ((ccb = sc->sc_waiting_ccb.tqh_first) != NULL) {
778 		if (sc->sc_mbofull >= BT_MBX_SIZE) {
779 			bt_collect_mbo(sc);
780 			if (sc->sc_mbofull >= BT_MBX_SIZE) {
781 				struct bt_toggle toggle;
782 
783 				toggle.cmd.opcode = BT_MBO_INTR_EN;
784 				toggle.cmd.enable = 1;
785 				bt_cmd(iobase, sc, sizeof(toggle.cmd),
786 				    (u_char *)&toggle.cmd, 0, (u_char *)0);
787 				break;
788 			}
789 		}
790 
791 		TAILQ_REMOVE(&sc->sc_waiting_ccb, ccb, chain);
792 #ifdef BTDIAG
793 		ccb->flags |= CCB_SENDING;
794 #endif
795 
796 		/* Link ccb to mbo. */
797 		ltophys(KVTOPHYS(ccb), wmbo->ccb_addr);
798 		if (ccb->flags & CCB_ABORT)
799 			wmbo->cmd = BT_MBO_ABORT;
800 		else
801 			wmbo->cmd = BT_MBO_START;
802 
803 		/* Tell the card to poll immediately. */
804 		isa_outb(iobase + BT_CMD_PORT, BT_START_SCSI);
805 
806 		if ((ccb->xs->xs_control & XS_CTL_POLL) == 0)
807 			callout_reset(&ccb->xs->xs_callout,
808 			    mstohz(ccb->timeout), bt_timeout, ccb);
809 
810 		++sc->sc_mbofull;
811 		bt_nextmbx(wmbo, wmbx, mbo);
812 	}
813 
814 	wmbx->tmbo = wmbo;
815 }
816 
817 /*
818  * We have a ccb which has been processed by the
819  * adaptor, now we look to see how the operation
820  * went. Wake up the owner if waiting
821  */
822 void
823 bt_done(sc, ccb)
824 	struct bt_softc *sc;
825 	struct bt_ccb *ccb;
826 {
827 	struct scsipi_sense_data *s1, *s2;
828 	struct scsipi_xfer *xs = ccb->xs;
829 
830 	u_long thiskv, thisbounce;
831 	int bytes_this_page, datalen;
832 	struct bt_scat_gath *sg;
833 	int seg;
834 
835 	SC_DEBUG(xs->sc_link, SDEV_DB2, ("bt_done\n"));
836 	/*
837 	 * Otherwise, put the results of the operation
838 	 * into the xfer and call whoever started it
839 	 */
840 #ifdef BTDIAG
841 	if (ccb->flags & CCB_SENDING) {
842 		printf("%s: exiting ccb still in transit!\n", sc->sc_dev.dv_xname);
843 		Debugger();
844 		return;
845 	}
846 #endif
847 	if ((ccb->flags & CCB_ALLOC) == 0) {
848 		printf("%s: exiting ccb not allocated!\n", sc->sc_dev.dv_xname);
849 		Debugger();
850 		return;
851 	}
852 	if (xs->error == XS_NOERROR) {
853 		if (ccb->host_stat != BT_OK) {
854 			switch (ccb->host_stat) {
855 			case BT_SEL_TIMEOUT:	/* No response */
856 				xs->error = XS_SELTIMEOUT;
857 				break;
858 			default:	/* Other scsi protocol messes */
859 				printf("%s: host_stat %x\n",
860 				    sc->sc_dev.dv_xname, ccb->host_stat);
861 				xs->error = XS_DRIVER_STUFFUP;
862 				break;
863 			}
864 		} else if (ccb->target_stat != SCSI_OK) {
865 			switch (ccb->target_stat) {
866 			case SCSI_CHECK:
867 				s1 = &ccb->scsi_sense;
868 				s2 = &xs->sense.scsi_sense;
869 				*s2 = *s1;
870 				xs->error = XS_SENSE;
871 				break;
872 			case SCSI_BUSY:
873 				xs->error = XS_BUSY;
874 				break;
875 			default:
876 				printf("%s: target_stat %x\n",
877 				    sc->sc_dev.dv_xname, ccb->target_stat);
878 				xs->error = XS_DRIVER_STUFFUP;
879 				break;
880 			}
881 		} else
882 			xs->resid = 0;
883 	}
884 
885 	if((datalen = xs->datalen) != 0) {
886 		thiskv = (int)xs->data;
887 		sg = ccb->scat_gath;
888 		seg = phystol(ccb->data_length) / sizeof(struct bt_scat_gath);
889 
890 		while (seg) {
891 			thisbounce = PHYSTOKV(phystol(sg->seg_addr));
892 			bytes_this_page = phystol(sg->seg_len);
893 			if(xs->xs_control & XS_CTL_DATA_IN) {
894 				bcopy((void *)thisbounce, (void *)thiskv, bytes_this_page);
895 			}
896 			bt_free_buf(sc, (struct bt_buf *)thisbounce);
897 			thiskv += bytes_this_page;
898 			datalen -= bytes_this_page;
899 
900 			sg++;
901 			seg--;
902 		}
903 	}
904 
905 	bt_free_ccb(sc, ccb);
906 	xs->xs_status |= XS_STS_DONE;
907 	scsipi_done(xs);
908 }
909 
910 /*
911  * Find the board and find it's irq/drq
912  */
913 int
914 bt_find(ia, sc)
915 	struct isa_attach_args *ia;
916 	struct bt_softc *sc;
917 {
918 	int iobase = ia->ia_iobase;
919 	int i;
920 	u_char sts;
921 	struct bt_extended_inquire inquire;
922 	struct bt_config config;
923 	int irq, drq;
924 
925 #ifndef notyet
926 	/* Check something is at the ports we need to access */
927 	sts = isa_inb(iobase + BHA_STAT_PORT);
928 	if (sts == 0xFF)
929 		return (0);
930 #endif
931 
932 	/*
933 	 * reset board, If it doesn't respond, assume
934 	 * that it's not there.. good for the probe
935 	 */
936 
937 	isa_outb(iobase + BT_CTRL_PORT, BT_CTRL_HRST | BT_CTRL_SRST);
938 
939 	delay(100);
940 	for (i = BT_RESET_TIMEOUT; i; i--) {
941 		sts = isa_inb(iobase + BT_STAT_PORT);
942 		if (sts == (BT_STAT_IDLE | BT_STAT_INIT))
943 			break;
944 		delay(1000);
945 	}
946 	if (!i) {
947 #ifdef BTDEBUG
948 		if (bt_debug)
949 			printf("bt_find: No answer from buslogic board\n");
950 #endif /* BTDEBUG */
951 		return 1;
952 	}
953 
954 #ifndef notyet
955 	/*
956 	 * The BusLogic cards implement an Adaptec 1542 (aha)-compatible
957 	 * interface. The native bha interface is not compatible with
958 	 * an aha. 1542. We need to ensure that we never match an
959 	 * Adaptec 1542. We must also avoid sending Adaptec-compatible
960 	 * commands to a real bha, lest it go into 1542 emulation mode.
961 	 * (On an indirect bus like ISA, we should always probe for BusLogic
962 	 * interfaces before Adaptec interfaces).
963 	 */
964 
965 	/*
966 	 * Make sure we don't match an AHA-1542A or AHA-1542B, by checking
967 	 * for an extended-geometry register.  The 1542[AB] don't have one.
968 	 */
969 	sts = isa_inb(iobase +  BT_EXTGEOM_PORT);
970 	if (sts == 0xFF)
971 		return (0);
972 #endif /* notyet */
973 
974 	/*
975 	 * Check that we actually know how to use this board.
976 	 */
977 	delay(1000);
978 	bzero(&inquire, sizeof inquire);
979 	inquire.cmd.opcode = BT_INQUIRE_EXTENDED;
980 	inquire.cmd.len = sizeof(inquire.reply);
981 	i = bt_cmd(iobase, sc, sizeof(inquire.cmd), (u_char *)&inquire.cmd,
982 	    sizeof(inquire.reply), (u_char *)&inquire.reply);
983 
984 #ifndef notyet
985 	/*
986 	 * Some 1542Cs (CP, perhaps not CF, may depend on firmware rev)
987 	 * have the extended-geometry register and also respond to
988 	 * BHA_INQUIRE_EXTENDED.  Make sure we never match such cards,
989 	 * by checking the size of the reply is what a BusLogic card returns.
990 	 */
991 	if (i) { /* XXX - this doesn't really check the size. ??? see bha.c */
992 #ifdef BTDEBUG
993 		printf("bt_find: board returned %d instead of %d to %s\n",
994 		       i, sizeof(inquire.reply), "INQUIRE_EXTENDED");
995 #endif
996 		return (0);
997 	}
998 
999 	/* OK, we know we've found a buslogic adaptor. */
1000 #endif /* notyet */
1001 
1002 	switch (inquire.reply.bus_type) {
1003 	case BT_BUS_TYPE_24BIT:
1004 	case BT_BUS_TYPE_32BIT:
1005 		break;
1006 	case BT_BUS_TYPE_MCA:
1007 		/* We don't grok MicroChannel (yet). */
1008 		return 1;
1009 	default:
1010 		printf("bt_find: illegal bus type %c\n", inquire.reply.bus_type);
1011 		return 1;
1012 	}
1013 
1014 	/*
1015 	 * Assume we have a board at this stage setup dma channel from
1016 	 * jumpers and save int level
1017 	 */
1018 	delay(1000);
1019 	config.cmd.opcode = BT_INQUIRE_CONFIG;
1020 	bt_cmd(iobase, sc, sizeof(config.cmd), (u_char *)&config.cmd,
1021 	    sizeof(config.reply), (u_char *)&config.reply);
1022 	switch (config.reply.chan) {
1023 	case EISADMA:
1024 		drq = DRQUNK;
1025 		break;
1026 	case CHAN0:
1027 		drq = 0;
1028 		break;
1029 	case CHAN5:
1030 		drq = 5;
1031 		break;
1032 	case CHAN6:
1033 		drq = 6;
1034 		break;
1035 	case CHAN7:
1036 		drq = 7;
1037 		break;
1038 	default:
1039 		printf("bt_find: illegal drq setting %x\n", config.reply.chan);
1040 		return 1;
1041 	}
1042 
1043 	switch (config.reply.intr) {
1044 	case INT9:
1045 		irq = 9;
1046 		break;
1047 	case INT10:
1048 		irq = 10;
1049 		break;
1050 	case INT11:
1051 		irq = 11;
1052 		break;
1053 	case INT12:
1054 		irq = 12;
1055 		break;
1056 	case INT14:
1057 		irq = 14;
1058 		break;
1059 	case INT15:
1060 		irq = 15;
1061 		break;
1062 	default:
1063 		printf("bt_find: illegal irq setting %x\n", config.reply.intr);
1064 		return 1;
1065 	}
1066 
1067 	if (sc != NULL) {
1068 		/* who are we on the scsi bus? */
1069 		sc->sc_scsi_dev = config.reply.scsi_dev;
1070 
1071 		sc->sc_iobase = iobase;
1072 		sc->sc_irq = irq;
1073 		sc->sc_drq = drq;
1074 	} else {
1075 		if (ia->ia_irq == IRQUNK)
1076 			ia->ia_irq = irq;
1077 		else if (ia->ia_irq != irq)
1078 			return 1;
1079 		if (ia->ia_drq == DRQUNK)
1080 			ia->ia_drq = drq;
1081 		else if (ia->ia_drq != drq)
1082 			return 1;
1083 	}
1084 
1085 	return 0;
1086 }
1087 
1088 /*
1089  * Start the board, ready for normal operation
1090  */
1091 void
1092 bt_init(sc)
1093 	struct bt_softc *sc;
1094 {
1095 	int iobase = sc->sc_iobase;
1096 	struct bt_devices devices;
1097 	struct bt_setup setup;
1098 	struct bt_mailbox mailbox;
1099 	struct bt_period period;
1100 	int i;
1101 
1102 	/* Enable round-robin scheme - appeared at firmware rev. 3.31. */
1103 	if (strcmp(sc->sc_firmware, "3.31") >= 0) {
1104 		struct bt_toggle toggle;
1105 
1106 		toggle.cmd.opcode = BT_ROUND_ROBIN;
1107 		toggle.cmd.enable = 1;
1108 		bt_cmd(iobase, sc, sizeof(toggle.cmd), (u_char *)&toggle.cmd,
1109 		    0, (u_char *)0);
1110 	}
1111 
1112 	/* Inquire Installed Devices (to force synchronous negotiation). */
1113 	devices.cmd.opcode = BT_INQUIRE_DEVICES;
1114 	bt_cmd(iobase, sc, sizeof(devices.cmd), (u_char *)&devices.cmd,
1115 	    sizeof(devices.reply), (u_char *)&devices.reply);
1116 
1117 	/* Obtain setup information from. */
1118 	setup.cmd.opcode = BT_INQUIRE_SETUP;
1119 	setup.cmd.len = sizeof(setup.reply);
1120 	bt_cmd(iobase, sc, sizeof(setup.cmd), (u_char *)&setup.cmd,
1121 	    sizeof(setup.reply), (u_char *)&setup.reply);
1122 
1123 	printf("%s: %s, %s\n",
1124 	    sc->sc_dev.dv_xname,
1125 	    setup.reply.sync_neg ? "sync" : "async",
1126 	    setup.reply.parity ? "parity" : "no parity");
1127 
1128 	for (i = 0; i < 8; i++)
1129 		period.reply.period[i] = setup.reply.sync[i].period * 5 + 20;
1130 
1131 	if (sc->sc_firmware[0] >= '3') {
1132 		period.cmd.opcode = BT_INQUIRE_PERIOD;
1133 		period.cmd.len = sizeof(period.reply);
1134 		bt_cmd(iobase, sc, sizeof(period.cmd), (u_char *)&period.cmd,
1135 		    sizeof(period.reply), (u_char *)&period.reply);
1136 	}
1137 
1138 	for (i = 0; i < 8; i++) {
1139 		if (!setup.reply.sync[i].valid ||
1140 		    (!setup.reply.sync[i].offset && !setup.reply.sync[i].period))
1141 			continue;
1142 		printf("%s targ %d: sync, offset %d, period %dnsec\n",
1143 		    sc->sc_dev.dv_xname, i,
1144 		    setup.reply.sync[i].offset, period.reply.period[i] * 10);
1145 	}
1146 
1147 	/*
1148 	 * Set up initial mail box for round-robin operation.
1149 	 */
1150 	for (i = 0; i < BT_MBX_SIZE; i++) {
1151 		wmbx->mbo[i].cmd = BT_MBO_FREE;
1152 		wmbx->mbi[i].stat = BT_MBI_FREE;
1153 	}
1154 	wmbx->cmbo = wmbx->tmbo = &wmbx->mbo[0];
1155 	wmbx->tmbi = &wmbx->mbi[0];
1156 	sc->sc_mbofull = 0;
1157 
1158 	/* Initialize mail box. */
1159 	mailbox.cmd.opcode = BT_MBX_INIT_EXTENDED;
1160 	mailbox.cmd.nmbx = BT_MBX_SIZE;
1161 	ltophys(KVTOPHYS(wmbx), mailbox.cmd.addr);
1162 	bt_cmd(iobase, sc, sizeof(mailbox.cmd), (u_char *)&mailbox.cmd,
1163 	    0, (u_char *)0);
1164 }
1165 
1166 void
1167 bt_inquire_setup_information(sc)
1168 	struct bt_softc *sc;
1169 {
1170 	int iobase = sc->sc_iobase;
1171 	struct bt_model model;
1172 	struct bt_revision revision;
1173 	struct bt_digit digit;
1174 	char *p;
1175 
1176 	/*
1177 	 * Get the firmware revision.
1178 	 */
1179 	p = sc->sc_firmware;
1180 	revision.cmd.opcode = BT_INQUIRE_REVISION;
1181 	bt_cmd(iobase, sc, sizeof(revision.cmd), (u_char *)&revision.cmd,
1182 	    sizeof(revision.reply), (u_char *)&revision.reply);
1183 	*p++ = revision.reply.firm_revision;
1184 	*p++ = '.';
1185 	*p++ = revision.reply.firm_version;
1186 	digit.cmd.opcode = BT_INQUIRE_REVISION_3;
1187 	bt_cmd(iobase, sc, sizeof(digit.cmd), (u_char *)&digit.cmd,
1188 	    sizeof(digit.reply), (u_char *)&digit.reply);
1189 	*p++ = digit.reply.digit;
1190 	if (revision.reply.firm_revision >= '3' ||
1191 	    (revision.reply.firm_revision == '3' && revision.reply.firm_version >= '3')) {
1192 		digit.cmd.opcode = BT_INQUIRE_REVISION_4;
1193 		bt_cmd(iobase, sc, sizeof(digit.cmd), (u_char *)&digit.cmd,
1194 		    sizeof(digit.reply), (u_char *)&digit.reply);
1195 		*p++ = digit.reply.digit;
1196 	}
1197 	while (p > sc->sc_firmware && (p[-1] == ' ' || p[-1] == '\0'))
1198 		p--;
1199 	*p = '\0';
1200 
1201 	/*
1202 	 * Get the model number.
1203 	 */
1204 	if (revision.reply.firm_revision >= '3') {
1205 		p = sc->sc_model;
1206 		model.cmd.opcode = BT_INQUIRE_MODEL;
1207 		model.cmd.len = sizeof(model.reply);
1208 		bt_cmd(iobase, sc, sizeof(model.cmd), (u_char *)&model.cmd,
1209 		    sizeof(model.reply), (u_char *)&model.reply);
1210 		*p++ = model.reply.id[0];
1211 		*p++ = model.reply.id[1];
1212 		*p++ = model.reply.id[2];
1213 		*p++ = model.reply.id[3];
1214 		while (p > sc->sc_model && (p[-1] == ' ' || p[-1] == '\0'))
1215 			p--;
1216 		*p++ = model.reply.version[0];
1217 		*p++ = model.reply.version[1];
1218 		while (p > sc->sc_model && (p[-1] == ' ' || p[-1] == '\0'))
1219 			p--;
1220 		*p = '\0';
1221 	} else
1222 		strcpy(sc->sc_model, "542B");
1223 
1224 	printf(": model BT-%s, firmware %s\n", sc->sc_model, sc->sc_firmware);
1225 }
1226 
1227 void
1228 btminphys(bp)
1229 	struct buf *bp;
1230 {
1231 
1232 	if (bp->b_bcount > ((BT_NSEG - 1) << PGSHIFT))
1233 		bp->b_bcount = ((BT_NSEG - 1) << PGSHIFT);
1234 	minphys(bp);
1235 }
1236 
1237 /*
1238  * start a scsi operation given the command and the data address.  Also needs
1239  * the unit, target and lu.
1240  */
1241 int
1242 bt_scsi_cmd(xs)
1243 	struct scsipi_xfer *xs;
1244 {
1245 	struct scsipi_link *sc_link = xs->sc_link;
1246 	struct bt_softc *sc = sc_link->adapter_softc;
1247 	struct bt_ccb *ccb;
1248 	struct bt_scat_gath *sg;
1249 	int seg;		/* scatter gather seg being worked on */
1250 	u_long thiskv, thisbounce;
1251 	int bytes_this_page, datalen, control;
1252 	int s;
1253 
1254 	SC_DEBUG(sc_link, SDEV_DB2, ("bt_scsi_cmd\n"));
1255 	/*
1256 	 * get a ccb to use. If the transfer
1257 	 * is from a buf (possibly from interrupt time)
1258 	 * then we can't allow it to sleep
1259 	 */
1260 	control = xs->xs_control;
1261 	if ((ccb = bt_get_ccb(sc, control & XS_CTL_NOSLEEP)) == NULL) {
1262 		xs->error = XS_DRIVER_STUFFUP;
1263 		return TRY_AGAIN_LATER;
1264 	}
1265 	ccb->xs = xs;
1266 	ccb->timeout = xs->timeout;
1267 
1268 	/*
1269 	 * Put all the arguments for the xfer in the ccb
1270 	 */
1271 	if (control & XS_CTL_RESET) {
1272 		ccb->opcode = BT_RESET_CCB;
1273 		ccb->scsi_cmd_length = 0;
1274 	} else {
1275 		/* can't use S/G if zero length */
1276 		ccb->opcode = (xs->datalen ? BT_INIT_SCAT_GATH_CCB
1277 					   : BT_INITIATOR_CCB);
1278 		bcopy(xs->cmd, &ccb->scsi_cmd,
1279 		    ccb->scsi_cmd_length = xs->cmdlen);
1280 	}
1281 
1282 	if (xs->datalen) {
1283 		sg = ccb->scat_gath;
1284 		seg = 0;
1285 		/*
1286 		 * Set up the scatter-gather block.
1287 		 */
1288 		SC_DEBUG(sc_link, SDEV_DB4,
1289 		    ("%d @0x%x:- ", xs->datalen, xs->data));
1290 
1291 		datalen = xs->datalen;
1292 		thiskv = (int)xs->data;
1293 
1294 		while (datalen && seg < BT_NSEG) {
1295 
1296 			/* put in the base address of a buf */
1297 			thisbounce = (u_long)
1298 				bt_get_buf(sc, control & XS_CTL_NOSLEEP);
1299 			if(thisbounce == 0)
1300 				break;
1301 			ltophys(KVTOPHYS(thisbounce), sg->seg_addr);
1302 			bytes_this_page = min(sizeof(struct bt_buf), datalen);
1303 			if (control & XS_CTL_DATA_OUT) {
1304 				bcopy((void *)thiskv, (void *)thisbounce, bytes_this_page);
1305 			}
1306 			thiskv += bytes_this_page;
1307 			datalen -= bytes_this_page;
1308 
1309 			ltophys(bytes_this_page, sg->seg_len);
1310 			sg++;
1311 			seg++;
1312 		}
1313 		SC_DEBUGN(sc_link, SDEV_DB4, ("\n"));
1314 		if (datalen) {
1315 			printf("%s: bt_scsi_cmd, out of bufs %d of %d left.\n",
1316 					sc->sc_dev.dv_xname, datalen, xs->datalen);
1317 			goto badbuf;
1318 		}
1319 		ltophys(KVTOPHYS(ccb->scat_gath), ccb->data_addr);
1320 		ltophys(seg * sizeof(struct bt_scat_gath), ccb->data_length);
1321 	} else {		/* No data xfer, use non S/G values */
1322 		ltophys(0, ccb->data_addr);
1323 		ltophys(0, ccb->data_length);
1324 	}
1325 
1326 	ccb->data_out = 0;
1327 	ccb->data_in = 0;
1328 	ccb->target = sc_link->scsipi_scsi.target;
1329 	ccb->lun = sc_link->scsipi_scsi.lun;
1330 	ltophys(KVTOPHYS(&ccb->scsi_sense), ccb->sense_ptr);
1331 	ccb->req_sense_length = sizeof(ccb->scsi_sense);
1332 	ccb->host_stat = 0x00;
1333 	ccb->target_stat = 0x00;
1334 	ccb->link_id = 0;
1335 	ltophys(0, ccb->link_addr);
1336 
1337 	s = splbio();
1338 	bt_queue_ccb(sc, ccb);
1339 	splx(s);
1340 
1341 	/*
1342 	 * Usually return SUCCESSFULLY QUEUED
1343 	 */
1344 	SC_DEBUG(sc_link, SDEV_DB3, ("cmd_sent\n"));
1345 	if ((control & XS_CTL_POLL) == 0)
1346 		return SUCCESSFULLY_QUEUED;
1347 
1348 	/*
1349 	 * If we can't use interrupts, poll on completion
1350 	 */
1351 	if (bt_poll(sc, xs, ccb->timeout)) {
1352 		bt_timeout(ccb);
1353 		if (bt_poll(sc, xs, ccb->timeout))
1354 			bt_timeout(ccb);
1355 	}
1356 	return COMPLETE;
1357 
1358 badbuf:
1359 	sg = ccb->scat_gath;
1360 	while (seg) {
1361 		thisbounce = PHYSTOKV(phystol(sg->seg_addr));
1362 		bt_free_buf(sc, (struct bt_buf *)thisbounce);
1363 		sg++;
1364 		seg--;
1365 	}
1366 	xs->error = XS_DRIVER_STUFFUP;
1367 	bt_free_ccb(sc, ccb);
1368 	return TRY_AGAIN_LATER;
1369 }
1370 
1371 /*
1372  * Poll a particular unit, looking for a particular xs
1373  */
1374 int
1375 bt_poll(sc, xs, count)
1376 	struct bt_softc *sc;
1377 	struct scsipi_xfer *xs;
1378 	int count;
1379 {
1380 	int iobase = sc->sc_iobase;
1381 
1382 	/* timeouts are in msec, so we loop in 1000 usec cycles */
1383 	while (count) {
1384 		/*
1385 		 * If we had interrupts enabled, would we
1386 		 * have got an interrupt?
1387 		 */
1388 		if (isa_inb(iobase + BT_INTR_PORT) & BT_INTR_ANYINTR)
1389 			btintr(sc);
1390 		if (xs->xs_status & XS_STS_DONE)
1391 			return 0;
1392 		delay(1000);	/* only happens in boot so ok */
1393 		count--;
1394 	}
1395 	return 1;
1396 }
1397 
1398 void
1399 bt_timeout(arg)
1400 	void *arg;
1401 {
1402 	struct bt_ccb *ccb = arg;
1403 	struct scsipi_xfer *xs = ccb->xs;
1404 	struct scsipi_link *sc_link = xs->sc_link;
1405 	struct bt_softc *sc = sc_link->adapter_softc;
1406 	int s;
1407 
1408 	scsi_print_addr(sc_link);
1409 	printf("timed out");
1410 
1411 	s = splbio();
1412 
1413 #ifdef BTDIAG
1414 	/*
1415 	 * If the ccb's mbx is not free, then the board has gone Far East?
1416 	 */
1417 	bt_collect_mbo(sc);
1418 	if (ccb->flags & CCB_SENDING) {
1419 		printf("%s: not taking commands!\n", sc->sc_dev.dv_xname);
1420 		Debugger();
1421 	}
1422 #endif
1423 
1424 	/*
1425 	 * If it has been through before, then
1426 	 * a previous abort has failed, don't
1427 	 * try abort again
1428 	 */
1429 	if (ccb->flags & CCB_ABORT) {
1430 		/* abort timed out */
1431 		printf(" AGAIN\n");
1432 		/* XXX Must reset! */
1433 	} else {
1434 		/* abort the operation that has timed out */
1435 		printf("\n");
1436 		ccb->xs->error = XS_TIMEOUT;
1437 		ccb->timeout = BT_ABORT_TIMEOUT;
1438 		ccb->flags |= CCB_ABORT;
1439 		bt_queue_ccb(sc, ccb);
1440 	}
1441 
1442 	splx(s);
1443 }
1444