sys/dev/disk/buslogic/bt.c

   1 /*-
   2  * Generic driver for the BusLogic MultiMaster SCSI host adapters
   3  * Product specific probe and attach routines can be found in:
   4  * sys/dev/buslogic/bt_pci.c    BT-946, BT-948, BT-956, BT-958 cards
   5  *
   6  * Copyright (c) 1998, 1999 Justin T. Gibbs.
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions, and the following disclaimer,
  14  *    without modification, immediately at the beginning of the file.
  15  * 2. The name of the author may not be used to endorse or promote products
  16  *    derived from this software without specific prior written permission.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  21  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
  22  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  28  * SUCH DAMAGE.
  29  *
  30  * $FreeBSD: src/sys/dev/buslogic/bt.c,v 1.54 2012/11/17 01:51:40 svnexp Exp $
  31  */
  32
  33  /*
  34   * Special thanks to Leonard N. Zubkoff for writing such a complete and
  35   * well documented Mylex/BusLogic MultiMaster driver for Linux.  Support
  36   * in this driver for the wide range of MultiMaster controllers and
  37   * firmware revisions, with their otherwise undocumented quirks, would not
  38   * have been possible without his efforts.
  39   */
  40
  41 #include <sys/param.h>
  42 #include <sys/systm.h>
  43 #include <sys/malloc.h>
  44 #include <sys/buf.h>
  45 #include <sys/kernel.h>
  46 #include <sys/lock.h>
  47 #include <sys/sysctl.h>
  48 #include <sys/bus.h>
  49 #include <sys/rman.h>
  50
  51 #include <bus/cam/cam.h>
  52 #include <bus/cam/cam_ccb.h>
  53 #include <bus/cam/cam_sim.h>
  54 #include <bus/cam/cam_xpt_sim.h>
  55 #include <bus/cam/cam_debug.h>
  56 #include <bus/cam/scsi/scsi_message.h>
  57
  58 #include <vm/vm.h>
  59 #include <vm/pmap.h>
  60
  61 #include <dev/disk/buslogic/btreg.h>
  62
  63 /* MailBox Management functions */
  64 static __inline void    btnextinbox(struct bt_softc *bt);
  65 static __inline void    btnextoutbox(struct bt_softc *bt);
  66
  67 static __inline void
  68 btnextinbox(struct bt_softc *bt)
  69 {
  70         if (bt->cur_inbox == bt->last_inbox)
  71                 bt->cur_inbox = bt->in_boxes;
  72         else
  73                 bt->cur_inbox++;
  74 }
  75
  76 static __inline void
  77 btnextoutbox(struct bt_softc *bt)
  78 {
  79         if (bt->cur_outbox == bt->last_outbox)
  80                 bt->cur_outbox = bt->out_boxes;
  81         else
  82                 bt->cur_outbox++;
  83 }
  84
  85 /* CCB Mangement functions */
  86 static __inline u_int32_t               btccbvtop(struct bt_softc *bt,
  87                                                   struct bt_ccb *bccb);
  88 static __inline struct bt_ccb*          btccbptov(struct bt_softc *bt,
  89                                                   u_int32_t ccb_addr);
  90 static __inline u_int32_t               btsensepaddr(struct bt_softc *bt,
  91                                                      struct bt_ccb *bccb);
  92 static __inline struct scsi_sense_data* btsensevaddr(struct bt_softc *bt,
  93                                                      struct bt_ccb *bccb);
  94
  95 static __inline u_int32_t
  96 btccbvtop(struct bt_softc *bt, struct bt_ccb *bccb)
  97 {
  98         return (bt->bt_ccb_physbase
  99               + (u_int32_t)((caddr_t)bccb - (caddr_t)bt->bt_ccb_array));
 100 }
 101
 102 static __inline struct bt_ccb *
 103 btccbptov(struct bt_softc *bt, u_int32_t ccb_addr)
 104 {
 105         return (bt->bt_ccb_array +
 106                 ((struct bt_ccb*)(uintptr_t)ccb_addr - (struct bt_ccb*)(uintptr_t)bt->bt_ccb_physbase));
 107 }
 108
 109 static __inline u_int32_t
 110 btsensepaddr(struct bt_softc *bt, struct bt_ccb *bccb)
 111 {
 112         u_int index;
 113
 114         index = (u_int)(bccb - bt->bt_ccb_array);
 115         return (bt->sense_buffers_physbase
 116                 + (index * sizeof(struct scsi_sense_data)));
 117 }
 118
 119 static __inline struct scsi_sense_data *
 120 btsensevaddr(struct bt_softc *bt, struct bt_ccb *bccb)
 121 {
 122         u_int index;
 123
 124         index = (u_int)(bccb - bt->bt_ccb_array);
 125         return (bt->sense_buffers + index);
 126 }
 127
 128 static __inline struct bt_ccb*  btgetccb(struct bt_softc *bt);
 129 static __inline void            btfreeccb(struct bt_softc *bt,
 130                                           struct bt_ccb *bccb);
 131 static void             btallocccbs(struct bt_softc *bt);
 132 static bus_dmamap_callback_t btexecuteccb;
 133 static void             btdone(struct bt_softc *bt, struct bt_ccb *bccb,
 134                                bt_mbi_comp_code_t comp_code);
 135 static void             bt_intr_locked(struct bt_softc *bt);
 136
 137 /* Host adapter command functions */
 138 static int      btreset(struct bt_softc* bt, int hard_reset);
 139
 140 /* Initialization functions */
 141 static int                      btinitmboxes(struct bt_softc *bt);
 142 static bus_dmamap_callback_t    btmapmboxes;
 143 static bus_dmamap_callback_t    btmapccbs;
 144 static bus_dmamap_callback_t    btmapsgs;
 145
 146 /* Transfer Negotiation Functions */
 147 static void btfetchtransinfo(struct bt_softc *bt,
 148                              struct ccb_trans_settings *cts);
 149
 150 /* CAM SIM entry points */
 151 #define ccb_bccb_ptr spriv_ptr0
 152 #define ccb_bt_ptr spriv_ptr1
 153 static void     btaction(struct cam_sim *sim, union ccb *ccb);
 154 static void     btpoll(struct cam_sim *sim);
 155
 156 /* Our timeout handler */
 157 static void     bttimeout(void *arg);
 158
 159
 160 /* Exported functions */
 161 void
 162 bt_init_softc(device_t dev, struct resource *port,
 163               struct resource *irq, struct resource *drq)
 164 {
 165         struct bt_softc *bt = device_get_softc(dev);
 166
 167         SLIST_INIT(&bt->free_bt_ccbs);
 168         LIST_INIT(&bt->pending_ccbs);
 169         SLIST_INIT(&bt->sg_maps);
 170         bt->dev = dev;
 171         bt->port = port;
 172         bt->irq = irq;
 173         bt->drq = drq;
 174         lockinit(&bt->lock, "bt", 0, LK_CANRECURSE);
 175 }
 176
 177 void
 178 bt_free_softc(device_t dev)
 179 {
 180         struct bt_softc *bt = device_get_softc(dev);
 181
 182         switch (bt->init_level) {
 183         default:
 184         case 11:
 185                 bus_dmamap_unload(bt->sense_dmat, bt->sense_dmamap);
 186         case 10:
 187                 bus_dmamem_free(bt->sense_dmat, bt->sense_buffers,
 188                                 bt->sense_dmamap);
 189         case 9:
 190                 bus_dma_tag_destroy(bt->sense_dmat);
 191         case 8:
 192         {
 193                 struct sg_map_node *sg_map;
 194
 195                 while ((sg_map = SLIST_FIRST(&bt->sg_maps))!= NULL) {
 196                         SLIST_REMOVE_HEAD(&bt->sg_maps, links);
 197                         bus_dmamap_unload(bt->sg_dmat,
 198                                           sg_map->sg_dmamap);
 199                         bus_dmamem_free(bt->sg_dmat, sg_map->sg_vaddr,
 200                                         sg_map->sg_dmamap);
 201                         kfree(sg_map, M_DEVBUF);
 202                 }
 203                 bus_dma_tag_destroy(bt->sg_dmat);
 204         }
 205         case 7:
 206                 bus_dmamap_unload(bt->ccb_dmat, bt->ccb_dmamap);
 207                 /* FALLTHROUGH */
 208         case 6:
 209                 bus_dmamem_free(bt->ccb_dmat, bt->bt_ccb_array,
 210                                 bt->ccb_dmamap);
 211                 bus_dmamap_destroy(bt->ccb_dmat, bt->ccb_dmamap);
 212                 /* FALLTHROUGH */
 213         case 5:
 214                 bus_dma_tag_destroy(bt->ccb_dmat);
 215                 /* FALLTHROUGH */
 216         case 4:
 217                 bus_dmamap_unload(bt->mailbox_dmat, bt->mailbox_dmamap);
 218                 /* FALLTHROUGH */
 219         case 3:
 220                 bus_dmamem_free(bt->mailbox_dmat, bt->in_boxes,
 221                                 bt->mailbox_dmamap);
 222                 bus_dmamap_destroy(bt->mailbox_dmat, bt->mailbox_dmamap);
 223                 /* FALLTHROUGH */
 224         case 2:
 225                 bus_dma_tag_destroy(bt->buffer_dmat);
 226                 /* FALLTHROUGH */
 227         case 1:
 228                 bus_dma_tag_destroy(bt->mailbox_dmat);
 229                 /* FALLTHROUGH */
 230         case 0:
 231                 break;
 232         }
 233         lockuninit(&bt->lock);
 234 }
 235
 236 /*
 237  * Probe the adapter and verify that the card is a BusLogic.
 238  */
 239 int
 240 bt_probe(device_t dev)
 241 {
 242         struct bt_softc *bt = device_get_softc(dev);
 243         esetup_info_data_t esetup_info;
 244         u_int    status;
 245         u_int    intstat;
 246         u_int    geometry;
 247         int      error;
 248         u_int8_t param;
 249
 250         /*
 251          * See if the three I/O ports look reasonable.
 252          * Touch the minimal number of registers in the
 253          * failure case.
 254          */
 255         status = bt_inb(bt, STATUS_REG);
 256         if ((status == 0)
 257          || (status & (DIAG_ACTIVE|CMD_REG_BUSY|
 258                        STATUS_REG_RSVD|CMD_INVALID)) != 0) {
 259                 if (bootverbose)
 260                         device_printf(dev, "Failed Status Reg Test - %x\n",
 261                                status);
 262                 return (ENXIO);
 263         }
 264
 265         intstat = bt_inb(bt, INTSTAT_REG);
 266         if ((intstat & INTSTAT_REG_RSVD) != 0) {
 267                 device_printf(dev, "Failed Intstat Reg Test\n");
 268                 return (ENXIO);
 269         }
 270
 271         geometry = bt_inb(bt, GEOMETRY_REG);
 272         if (geometry == 0xFF) {
 273                 if (bootverbose)
 274                         device_printf(dev, "Failed Geometry Reg Test\n");
 275                 return (ENXIO);
 276         }
 277
 278         /*
 279          * Looking good so far.  Final test is to reset the
 280          * adapter and attempt to fetch the extended setup
 281          * information.  This should filter out all 1542 cards.
 282          */
 283         lockmgr(&bt->lock, LK_EXCLUSIVE);
 284         if ((error = btreset(bt, /*hard_reset*/TRUE)) != 0) {
 285                 lockmgr(&bt->lock, LK_RELEASE);
 286                 if (bootverbose)
 287                         device_printf(dev, "Failed Reset\n");
 288                 return (ENXIO);
 289         }
 290
 291         param = sizeof(esetup_info);
 292         error = bt_cmd(bt, BOP_INQUIRE_ESETUP_INFO, &param, /*parmlen*/1,
 293                        (u_int8_t*)&esetup_info, sizeof(esetup_info),
 294                        DEFAULT_CMD_TIMEOUT);
 295         lockmgr(&bt->lock, LK_RELEASE);
 296         if (error != 0) {
 297                 return (ENXIO);
 298         }
 299
 300         return (0);
 301 }
 302
 303 /*
 304  * Pull the boards setup information and record it in our softc.
 305  */
 306 int
 307 bt_fetch_adapter_info(device_t dev)
 308 {
 309         struct bt_softc *bt = device_get_softc(dev);
 310         board_id_data_t board_id;
 311         esetup_info_data_t esetup_info;
 312         config_data_t config_data;
 313         int      error;
 314         u_int8_t length_param;
 315
 316         /* First record the firmware version */
 317         lockmgr(&bt->lock, LK_EXCLUSIVE);
 318         error = bt_cmd(bt, BOP_INQUIRE_BOARD_ID, NULL, /*parmlen*/0,
 319                        (u_int8_t*)&board_id, sizeof(board_id),
 320                        DEFAULT_CMD_TIMEOUT);
 321         if (error != 0) {
 322                 lockmgr(&bt->lock, LK_RELEASE);
 323                 device_printf(dev, "bt_fetch_adapter_info - Failed Get Board Info\n");
 324                 return (error);
 325         }
 326         bt->firmware_ver[0] = board_id.firmware_rev_major;
 327         bt->firmware_ver[1] = '.';
 328         bt->firmware_ver[2] = board_id.firmware_rev_minor;
 329         bt->firmware_ver[3] = '\0';
 330
 331         /*
 332          * Depending on the firmware major and minor version,
 333          * we may be able to fetch additional minor version info.
 334          */
 335         if (bt->firmware_ver[0] > '0') {
 336
 337                 error = bt_cmd(bt, BOP_INQUIRE_FW_VER_3DIG, NULL, /*parmlen*/0,
 338                                (u_int8_t*)&bt->firmware_ver[3], 1,
 339                                DEFAULT_CMD_TIMEOUT);
 340                 if (error != 0) {
 341                         lockmgr(&bt->lock, LK_RELEASE);
 342                         device_printf(dev,
 343                                       "bt_fetch_adapter_info - Failed Get "
 344                                       "Firmware 3rd Digit\n");
 345                         return (error);
 346                 }
 347                 if (bt->firmware_ver[3] == ' ')
 348                         bt->firmware_ver[3] = '\0';
 349                 bt->firmware_ver[4] = '\0';
 350         }
 351
 352         if (strcmp(bt->firmware_ver, "3.3") >= 0) {
 353
 354                 error = bt_cmd(bt, BOP_INQUIRE_FW_VER_4DIG, NULL, /*parmlen*/0,
 355                                (u_int8_t*)&bt->firmware_ver[4], 1,
 356                                DEFAULT_CMD_TIMEOUT);
 357                 if (error != 0) {
 358                         lockmgr(&bt->lock, LK_RELEASE);
 359                         device_printf(dev,
 360                                       "bt_fetch_adapter_info - Failed Get "
 361                                       "Firmware 4th Digit\n");
 362                         return (error);
 363                 }
 364                 if (bt->firmware_ver[4] == ' ')
 365                         bt->firmware_ver[4] = '\0';
 366                 bt->firmware_ver[5] = '\0';
 367         }
 368
 369         /*
 370          * Some boards do not handle the "recently documented"
 371          * Inquire Board Model Number command correctly or do not give
 372          * exact information.  Use the Firmware and Extended Setup
 373          * information in these cases to come up with the right answer.
 374          * The major firmware revision number indicates:
 375          *
 376          *      5.xx    BusLogic "W" Series Host Adapters:
 377          *              BT-948/958/958D
 378          *      4.xx    BusLogic "C" Series Host Adapters:
 379          *              BT-946C/956C/956CD/747C/757C/757CD/445C/545C/540CF
 380          *      3.xx    BusLogic "S" Series Host Adapters:
 381          *              BT-747S/747D/757S/757D/445S/545S/542D
 382          *              BT-542B/742A (revision H)
 383          *      2.xx    BusLogic "A" Series Host Adapters:
 384          *              BT-542B/742A (revision G and below)
 385          */
 386         length_param = sizeof(esetup_info);
 387         error = bt_cmd(bt, BOP_INQUIRE_ESETUP_INFO, &length_param, /*parmlen*/1,
 388                        (u_int8_t*)&esetup_info, sizeof(esetup_info),
 389                        DEFAULT_CMD_TIMEOUT);
 390         if (error != 0) {
 391                 lockmgr(&bt->lock, LK_RELEASE);
 392                 return (error);
 393         }
 394
 395         bt->bios_addr = esetup_info.bios_addr << 12;
 396
 397         if (esetup_info.bus_type == 'A'
 398          && bt->firmware_ver[0] == '2') {
 399                 ksnprintf(bt->model, sizeof(bt->model), "542B");
 400         } else if (esetup_info.bus_type == 'E'
 401                 && (strncmp(bt->firmware_ver, "2.1", 3) == 0
 402                  || strncmp(bt->firmware_ver, "2.20", 4) == 0)) {
 403                 ksnprintf(bt->model, sizeof(bt->model), "742A");
 404         } else {
 405                 ha_model_data_t model_data;
 406                 int i;
 407
 408                 length_param = sizeof(model_data);
 409                 error = bt_cmd(bt, BOP_INQUIRE_MODEL, &length_param, 1,
 410                                (u_int8_t*)&model_data, sizeof(model_data),
 411                                DEFAULT_CMD_TIMEOUT);
 412                 if (error != 0) {
 413                         lockmgr(&bt->lock, LK_RELEASE);
 414                         device_printf(dev,
 415                                       "bt_fetch_adapter_info - Failed Inquire "
 416                                       "Model Number\n");
 417                         return (error);
 418                 }
 419                 for (i = 0; i < sizeof(model_data.ascii_model); i++) {
 420                         bt->model[i] = model_data.ascii_model[i];
 421                         if (bt->model[i] == ' ')
 422                                 break;
 423                 }
 424                 bt->model[i] = '\0';
 425         }
 426
 427         bt->level_trigger_ints = esetup_info.level_trigger_ints ? 1 : 0;
 428
 429         /* SG element limits */
 430         bt->max_sg = esetup_info.max_sg;
 431
 432         /* Set feature flags */
 433         bt->wide_bus = esetup_info.wide_bus;
 434         bt->diff_bus = esetup_info.diff_bus;
 435         bt->ultra_scsi = esetup_info.ultra_scsi;
 436
 437         if ((bt->firmware_ver[0] == '5')
 438          || (bt->firmware_ver[0] == '4' && bt->wide_bus))
 439                 bt->extended_lun = TRUE;
 440
 441         bt->strict_rr = (strcmp(bt->firmware_ver, "3.31") >= 0);
 442
 443         bt->extended_trans =
 444             ((bt_inb(bt, GEOMETRY_REG) & EXTENDED_TRANSLATION) != 0);
 445
 446         /*
 447          * Determine max CCB count and whether tagged queuing is
 448          * available based on controller type. Tagged queuing
 449          * only works on 'W' series adapters, 'C' series adapters
 450          * with firmware of rev 4.42 and higher, and 'S' series
 451          * adapters with firmware of rev 3.35 and higher.  The
 452          * maximum CCB counts are as follows:
 453          *
 454          *      192     BT-948/958/958D
 455          *      100     BT-946C/956C/956CD/747C/757C/757CD/445C
 456          *      50      BT-545C/540CF
 457          *      30      BT-747S/747D/757S/757D/445S/545S/542D/542B/742A
 458          */
 459         if (bt->firmware_ver[0] == '5') {
 460                 bt->max_ccbs = 192;
 461                 bt->tag_capable = TRUE;
 462         } else if (bt->firmware_ver[0] == '4') {
 463                 if (bt->model[0] == '5')
 464                         bt->max_ccbs = 50;
 465                 else
 466                         bt->max_ccbs = 100;
 467                 bt->tag_capable = (strcmp(bt->firmware_ver, "4.22") >= 0);
 468         } else {
 469                 bt->max_ccbs = 30;
 470                 if (bt->firmware_ver[0] == '3'
 471                  && (strcmp(bt->firmware_ver, "3.35") >= 0))
 472                         bt->tag_capable = TRUE;
 473                 else
 474                         bt->tag_capable = FALSE;
 475         }
 476
 477         if (bt->tag_capable != FALSE)
 478                 bt->tags_permitted = ALL_TARGETS;
 479
 480         /* Determine Sync/Wide/Disc settings */
 481         if (bt->firmware_ver[0] >= '4') {
 482                 auto_scsi_data_t auto_scsi_data;
 483                 fetch_lram_params_t fetch_lram_params;
 484                 int error;
 485
 486                 /*
 487                  * These settings are stored in the
 488                  * AutoSCSI data in LRAM of 'W' and 'C'
 489                  * adapters.
 490                  */
 491                 fetch_lram_params.offset = AUTO_SCSI_BYTE_OFFSET;
 492                 fetch_lram_params.response_len = sizeof(auto_scsi_data);
 493                 error = bt_cmd(bt, BOP_FETCH_LRAM,
 494                                (u_int8_t*)&fetch_lram_params,
 495                                sizeof(fetch_lram_params),
 496                                (u_int8_t*)&auto_scsi_data,
 497                                sizeof(auto_scsi_data), DEFAULT_CMD_TIMEOUT);
 498
 499                 if (error != 0) {
 500                         lockmgr(&bt->lock, LK_RELEASE);
 501                         device_printf(dev,
 502                                       "bt_fetch_adapter_info - Failed "
 503                                       "Get Auto SCSI Info\n");
 504                         return (error);
 505                 }
 506
 507                 bt->disc_permitted = auto_scsi_data.low_disc_permitted
 508                                    | (auto_scsi_data.high_disc_permitted << 8);
 509                 bt->sync_permitted = auto_scsi_data.low_sync_permitted
 510                                    | (auto_scsi_data.high_sync_permitted << 8);
 511                 bt->fast_permitted = auto_scsi_data.low_fast_permitted
 512                                    | (auto_scsi_data.high_fast_permitted << 8);
 513                 bt->ultra_permitted = auto_scsi_data.low_ultra_permitted
 514                                    | (auto_scsi_data.high_ultra_permitted << 8);
 515                 bt->wide_permitted = auto_scsi_data.low_wide_permitted
 516                                    | (auto_scsi_data.high_wide_permitted << 8);
 517
 518                 if (bt->ultra_scsi == FALSE)
 519                         bt->ultra_permitted = 0;
 520
 521                 if (bt->wide_bus == FALSE)
 522                         bt->wide_permitted = 0;
 523         } else {
 524                 /*
 525                  * 'S' and 'A' series have this information in the setup
 526                  * information structure.
 527                  */
 528                 setup_data_t    setup_info;
 529
 530                 length_param = sizeof(setup_info);
 531                 error = bt_cmd(bt, BOP_INQUIRE_SETUP_INFO, &length_param,
 532                                /*paramlen*/1, (u_int8_t*)&setup_info,
 533                                sizeof(setup_info), DEFAULT_CMD_TIMEOUT);
 534
 535                 if (error != 0) {
 536                         lockmgr(&bt->lock, LK_RELEASE);
 537                         device_printf(dev,
 538                                       "bt_fetch_adapter_info - Failed "
 539                                       "Get Setup Info\n");
 540                         return (error);
 541                 }
 542
 543                 if (setup_info.initiate_sync != 0) {
 544                         bt->sync_permitted = ALL_TARGETS;
 545
 546                         if (bt->model[0] == '7') {
 547                                 if (esetup_info.sync_neg10MB != 0)
 548                                         bt->fast_permitted = ALL_TARGETS;
 549                                 if (strcmp(bt->model, "757") == 0)
 550                                         bt->wide_permitted = ALL_TARGETS;
 551                         }
 552                 }
 553                 bt->disc_permitted = ALL_TARGETS;
 554         }
 555
 556         /* We need as many mailboxes as we can have ccbs */
 557         bt->num_boxes = bt->max_ccbs;
 558
 559         /* Determine our SCSI ID */
 560
 561         error = bt_cmd(bt, BOP_INQUIRE_CONFIG, NULL, /*parmlen*/0,
 562                        (u_int8_t*)&config_data, sizeof(config_data),
 563                        DEFAULT_CMD_TIMEOUT);
 564         lockmgr(&bt->lock, LK_RELEASE);
 565         if (error != 0) {
 566                 device_printf(dev,
 567                               "bt_fetch_adapter_info - Failed Get Config\n");
 568                 return (error);
 569         }
 570         bt->scsi_id = config_data.scsi_id;
 571
 572         return (0);
 573 }
 574
 575 /*
 576  * Start the board, ready for normal operation
 577  */
 578 int
 579 bt_init(device_t dev)
 580 {
 581         struct bt_softc *bt = device_get_softc(dev);
 582
 583         /* Announce the Adapter */
 584         device_printf(dev, "BT-%s FW Rev. %s ", bt->model, bt->firmware_ver);
 585
 586         if (bt->ultra_scsi != 0)
 587                 kprintf("Ultra ");
 588
 589         if (bt->wide_bus != 0)
 590                 kprintf("Wide ");
 591         else
 592                 kprintf("Narrow ");
 593
 594         if (bt->diff_bus != 0)
 595                 kprintf("Diff ");
 596
 597         kprintf("SCSI Host Adapter, SCSI ID %d, %d CCBs\n", bt->scsi_id,
 598                bt->max_ccbs);
 599
 600         /*
 601          * Create our DMA tags.  These tags define the kinds of device
 602          * accessible memory allocations and memory mappings we will
 603          * need to perform during normal operation.
 604          *
 605          * Unless we need to further restrict the allocation, we rely
 606          * on the restrictions of the parent dmat, hence the common
 607          * use of MAXADDR and MAXSIZE.
 608          */
 609
 610         /* DMA tag for mapping buffers into device visible space. */
 611         if (bus_dma_tag_create( /* parent       */ bt->parent_dmat,
 612                                 /* alignment    */ 1,
 613                                 /* boundary     */ 0,
 614                                 /* lowaddr      */ BUS_SPACE_MAXADDR,
 615                                 /* highaddr     */ BUS_SPACE_MAXADDR,
 616                                 /* filter       */ NULL,
 617                                 /* filterarg    */ NULL,
 618                                 /* maxsize      */ MAXBSIZE,
 619                                 /* nsegments    */ BT_NSEG,
 620                                 /* maxsegsz     */ BUS_SPACE_MAXSIZE_32BIT,
 621                                 /* flags        */ BUS_DMA_ALLOCNOW,
 622                                 &bt->buffer_dmat) != 0) {
 623                 goto error_exit;
 624         }
 625
 626         bt->init_level++;
 627         /* DMA tag for our mailboxes */
 628         if (bus_dma_tag_create( /* parent       */ bt->parent_dmat,
 629                                 /* alignment    */ 1,
 630                                 /* boundary     */ 0,
 631                                 /* lowaddr      */ BUS_SPACE_MAXADDR,
 632                                 /* highaddr     */ BUS_SPACE_MAXADDR,
 633                                 /* filter       */ NULL,
 634                                 /* filterarg    */ NULL,
 635                                 /* maxsize      */ bt->num_boxes *
 636                                                    (sizeof(bt_mbox_in_t) +
 637                                                     sizeof(bt_mbox_out_t)),
 638                                 /* nsegments    */ 1,
 639                                 /* maxsegsz     */ BUS_SPACE_MAXSIZE_32BIT,
 640                                 /* flags        */ 0,
 641                                 &bt->mailbox_dmat) != 0) {
 642                 goto error_exit;
 643         }
 644
 645         bt->init_level++;
 646
 647         /* Allocation for our mailboxes */
 648         if (bus_dmamem_alloc(bt->mailbox_dmat, (void **)&bt->out_boxes,
 649                              BUS_DMA_NOWAIT, &bt->mailbox_dmamap) != 0) {
 650                 goto error_exit;
 651         }
 652
 653         bt->init_level++;
 654
 655         /* And permanently map them */
 656         bus_dmamap_load(bt->mailbox_dmat, bt->mailbox_dmamap,
 657                         bt->out_boxes,
 658                         bt->num_boxes * (sizeof(bt_mbox_in_t)
 659                                        + sizeof(bt_mbox_out_t)),
 660                         btmapmboxes, bt, /*flags*/0);
 661
 662         bt->init_level++;
 663
 664         bt->in_boxes = (bt_mbox_in_t *)&bt->out_boxes[bt->num_boxes];
 665
 666         lockmgr(&bt->lock, LK_EXCLUSIVE);
 667         btinitmboxes(bt);
 668         lockmgr(&bt->lock, LK_RELEASE);
 669
 670         /* DMA tag for our ccb structures */
 671         if (bus_dma_tag_create( /* parent       */ bt->parent_dmat,
 672                                 /* alignment    */ 1,
 673                                 /* boundary     */ 0,
 674                                 /* lowaddr      */ BUS_SPACE_MAXADDR,
 675                                 /* highaddr     */ BUS_SPACE_MAXADDR,
 676                                 /* filter       */ NULL,
 677                                 /* filterarg    */ NULL,
 678                                 /* maxsize      */ bt->max_ccbs *
 679                                                    sizeof(struct bt_ccb),
 680                                 /* nsegments    */ 1,
 681                                 /* maxsegsz     */ BUS_SPACE_MAXSIZE_32BIT,
 682                                 /* flags        */ 0,
 683                                 &bt->ccb_dmat) != 0) {
 684                 goto error_exit;
 685         }
 686
 687         bt->init_level++;
 688
 689         /* Allocation for our ccbs */
 690         if (bus_dmamem_alloc(bt->ccb_dmat, (void **)&bt->bt_ccb_array,
 691                              BUS_DMA_NOWAIT, &bt->ccb_dmamap) != 0) {
 692                 goto error_exit;
 693         }
 694
 695         bt->init_level++;
 696
 697         /* And permanently map them */
 698         bus_dmamap_load(bt->ccb_dmat, bt->ccb_dmamap,
 699                         bt->bt_ccb_array,
 700                         bt->max_ccbs * sizeof(struct bt_ccb),
 701                         btmapccbs, bt, /*flags*/0);
 702
 703         bt->init_level++;
 704
 705         /* DMA tag for our S/G structures.  We allocate in page sized chunks */
 706         if (bus_dma_tag_create( /* parent       */ bt->parent_dmat,
 707                                 /* alignment    */ 1,
 708                                 /* boundary     */ 0,
 709                                 /* lowaddr      */ BUS_SPACE_MAXADDR,
 710                                 /* highaddr     */ BUS_SPACE_MAXADDR,
 711                                 /* filter       */ NULL,
 712                                 /* filterarg    */ NULL,
 713                                 /* maxsize      */ PAGE_SIZE,
 714                                 /* nsegments    */ 1,
 715                                 /* maxsegsz     */ BUS_SPACE_MAXSIZE_32BIT,
 716                                 /* flags        */ 0,
 717                                 &bt->sg_dmat) != 0) {
 718                 goto error_exit;
 719         }
 720
 721         bt->init_level++;
 722
 723         /* Perform initial CCB allocation */
 724         bzero(bt->bt_ccb_array, bt->max_ccbs * sizeof(struct bt_ccb));
 725         btallocccbs(bt);
 726
 727         if (bt->num_ccbs == 0) {
 728                 device_printf(dev,
 729                               "bt_init - Unable to allocate initial ccbs\n");
 730                 goto error_exit;
 731         }
 732
 733         /*
 734          * Note that we are going and return (to attach)
 735          */
 736         return 0;
 737
 738 error_exit:
 739
 740         return (ENXIO);
 741 }
 742
 743 int
 744 bt_attach(device_t dev)
 745 {
 746         struct bt_softc *bt = device_get_softc(dev);
 747         int tagged_dev_openings;
 748         struct cam_devq *devq;
 749         int error;
 750
 751         /*
 752          * We reserve 1 ccb for error recovery, so don't
 753          * tell the XPT about it.
 754          */
 755         if (bt->tag_capable != 0)
 756                 tagged_dev_openings = bt->max_ccbs - 1;
 757         else
 758                 tagged_dev_openings = 0;
 759
 760         /*
 761          * Create the device queue for our SIM.
 762          */
 763         devq = cam_simq_alloc(bt->max_ccbs - 1);
 764         if (devq == NULL)
 765                 return (ENOMEM);
 766
 767         /*
 768          * Construct our SIM entry
 769          */
 770         bt->sim = cam_sim_alloc(btaction, btpoll, "bt", bt,
 771             device_get_unit(bt->dev), &bt->lock, 2, tagged_dev_openings, devq);
 772         cam_simq_release(devq);
 773         if (bt->sim == NULL)
 774                 return (ENOMEM);
 775
 776         lockmgr(&bt->lock, LK_EXCLUSIVE);
 777         if (xpt_bus_register(bt->sim, 0) != CAM_SUCCESS) {
 778                 cam_sim_free(bt->sim);
 779                 lockmgr(&bt->lock, LK_RELEASE);
 780                 return (ENXIO);
 781         }
 782
 783         if (xpt_create_path(&bt->path, /*periph*/NULL,
 784                             cam_sim_path(bt->sim), CAM_TARGET_WILDCARD,
 785                             CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
 786                 xpt_bus_deregister(cam_sim_path(bt->sim));
 787                 cam_sim_free(bt->sim);
 788                 lockmgr(&bt->lock, LK_RELEASE);
 789                 return (ENXIO);
 790         }
 791         lockmgr(&bt->lock, LK_RELEASE);
 792
 793         /*
 794          * Setup interrupt.
 795          */
 796         error = bus_setup_intr(dev, bt->irq,
 797             INTR_MPSAFE, bt_intr, bt, &bt->ih, NULL);
 798         if (error) {
 799                 device_printf(dev, "bus_setup_intr() failed: %d\n", error);
 800                 return (error);
 801         }
 802
 803         return (0);
 804 }
 805
 806 static void
 807 btallocccbs(struct bt_softc *bt)
 808 {
 809         struct bt_ccb *next_ccb;
 810         struct sg_map_node *sg_map;
 811         bus_addr_t physaddr;
 812         bt_sg_t *segs;
 813         int newcount;
 814         int i;
 815
 816         if (bt->num_ccbs >= bt->max_ccbs)
 817                 /* Can't allocate any more */
 818                 return;
 819
 820         next_ccb = &bt->bt_ccb_array[bt->num_ccbs];
 821
 822         sg_map = kmalloc(sizeof(*sg_map), M_DEVBUF, M_WAITOK);
 823
 824         /* Allocate S/G space for the next batch of CCBS */
 825         if (bus_dmamem_alloc(bt->sg_dmat, (void **)&sg_map->sg_vaddr,
 826                              BUS_DMA_NOWAIT, &sg_map->sg_dmamap) != 0) {
 827                 kfree(sg_map, M_DEVBUF);
 828                 goto error_exit;
 829         }
 830
 831         SLIST_INSERT_HEAD(&bt->sg_maps, sg_map, links);
 832
 833         bus_dmamap_load(bt->sg_dmat, sg_map->sg_dmamap, sg_map->sg_vaddr,
 834                         PAGE_SIZE, btmapsgs, bt, /*flags*/0);
 835
 836         segs = sg_map->sg_vaddr;
 837         physaddr = sg_map->sg_physaddr;
 838
 839         newcount = (PAGE_SIZE / (BT_NSEG * sizeof(bt_sg_t)));
 840         for (i = 0; bt->num_ccbs < bt->max_ccbs && i < newcount; i++) {
 841                 int error;
 842
 843                 next_ccb->sg_list = segs;
 844                 next_ccb->sg_list_phys = physaddr;
 845                 next_ccb->flags = BCCB_FREE;
 846                 callout_init_mp(&next_ccb->timer);
 847                 error = bus_dmamap_create(bt->buffer_dmat, /*flags*/0,
 848                                           &next_ccb->dmamap);
 849                 if (error != 0)
 850                         break;
 851                 SLIST_INSERT_HEAD(&bt->free_bt_ccbs, next_ccb, links);
 852                 segs += BT_NSEG;
 853                 physaddr += (BT_NSEG * sizeof(bt_sg_t));
 854                 next_ccb++;
 855                 bt->num_ccbs++;
 856         }
 857
 858         /* Reserve a CCB for error recovery */
 859         if (bt->recovery_bccb == NULL) {
 860                 bt->recovery_bccb = SLIST_FIRST(&bt->free_bt_ccbs);
 861                 SLIST_REMOVE_HEAD(&bt->free_bt_ccbs, links);
 862         }
 863
 864         if (SLIST_FIRST(&bt->free_bt_ccbs) != NULL)
 865                 return;
 866
 867 error_exit:
 868         device_printf(bt->dev, "Can't malloc BCCBs\n");
 869 }
 870
 871 static __inline void
 872 btfreeccb(struct bt_softc *bt, struct bt_ccb *bccb)
 873 {
 874         if (!dumping)
 875                 KKASSERT(lockowned(&bt->lock));
 876         if ((bccb->flags & BCCB_ACTIVE) != 0)
 877                 LIST_REMOVE(&bccb->ccb->ccb_h, sim_links.le);
 878         if (bt->resource_shortage != 0
 879          && (bccb->ccb->ccb_h.status & CAM_RELEASE_SIMQ) == 0) {
 880                 bccb->ccb->ccb_h.status |= CAM_RELEASE_SIMQ;
 881                 bt->resource_shortage = FALSE;
 882         }
 883         bccb->flags = BCCB_FREE;
 884         SLIST_INSERT_HEAD(&bt->free_bt_ccbs, bccb, links);
 885         bt->active_ccbs--;
 886 }
 887
 888 static __inline struct bt_ccb*
 889 btgetccb(struct bt_softc *bt)
 890 {
 891         struct  bt_ccb* bccb;
 892
 893         if (!dumping)
 894                 KKASSERT(lockowned(&bt->lock));
 895         if ((bccb = SLIST_FIRST(&bt->free_bt_ccbs)) != NULL) {
 896                 SLIST_REMOVE_HEAD(&bt->free_bt_ccbs, links);
 897                 bt->active_ccbs++;
 898         } else {
 899                 btallocccbs(bt);
 900                 bccb = SLIST_FIRST(&bt->free_bt_ccbs);
 901                 if (bccb != NULL) {
 902                         SLIST_REMOVE_HEAD(&bt->free_bt_ccbs, links);
 903                         bt->active_ccbs++;
 904                 }
 905         }
 906
 907         return (bccb);
 908 }
 909
 910 static void
 911 btaction(struct cam_sim *sim, union ccb *ccb)
 912 {
 913         struct  bt_softc *bt;
 914
 915         CAM_DEBUG(ccb->ccb_h.path, CAM_DEBUG_TRACE, ("btaction\n"));
 916
 917         bt = (struct bt_softc *)cam_sim_softc(sim);
 918         KKASSERT(lockowned(&bt->lock));
 919
 920         switch (ccb->ccb_h.func_code) {
 921         /* Common cases first */
 922         case XPT_SCSI_IO:       /* Execute the requested I/O operation */
 923         case XPT_RESET_DEV:     /* Bus Device Reset the specified SCSI device */
 924         {
 925                 struct  bt_ccb  *bccb;
 926                 struct  bt_hccb *hccb;
 927
 928                 /*
 929                  * get a bccb to use.
 930                  */
 931                 if ((bccb = btgetccb(bt)) == NULL) {
 932                         bt->resource_shortage = TRUE;
 933                         xpt_freeze_simq(bt->sim, /*count*/1);
 934                         ccb->ccb_h.status = CAM_REQUEUE_REQ;
 935                         xpt_done(ccb);
 936                         return;
 937                 }
 938
 939                 hccb = &bccb->hccb;
 940
 941                 /*
 942                  * So we can find the BCCB when an abort is requested
 943                  */
 944                 bccb->ccb = ccb;
 945                 ccb->ccb_h.ccb_bccb_ptr = bccb;
 946                 ccb->ccb_h.ccb_bt_ptr = bt;
 947
 948                 /*
 949                  * Put all the arguments for the xfer in the bccb
 950                  */
 951                 hccb->target_id = ccb->ccb_h.target_id;
 952                 hccb->target_lun = ccb->ccb_h.target_lun;
 953                 hccb->btstat = 0;
 954                 hccb->sdstat = 0;
 955
 956                 if (ccb->ccb_h.func_code == XPT_SCSI_IO) {
 957                         struct ccb_scsiio *csio;
 958                         struct ccb_hdr *ccbh;
 959
 960                         csio = &ccb->csio;
 961                         ccbh = &csio->ccb_h;
 962                         hccb->opcode = INITIATOR_CCB_WRESID;
 963                         hccb->datain = (ccb->ccb_h.flags & CAM_DIR_IN) ? 1 : 0;
 964                         hccb->dataout =(ccb->ccb_h.flags & CAM_DIR_OUT) ? 1 : 0;
 965                         hccb->cmd_len = csio->cdb_len;
 966                         if (hccb->cmd_len > sizeof(hccb->scsi_cdb)) {
 967                                 ccb->ccb_h.status = CAM_REQ_INVALID;
 968                                 btfreeccb(bt, bccb);
 969                                 xpt_done(ccb);
 970                                 return;
 971                         }
 972                         hccb->sense_len = csio->sense_len;
 973                         if ((ccbh->flags & CAM_TAG_ACTION_VALID) != 0
 974                          && ccb->csio.tag_action != CAM_TAG_ACTION_NONE) {
 975                                 hccb->tag_enable = TRUE;
 976                                 hccb->tag_type = (ccb->csio.tag_action & 0x3);
 977                         } else {
 978                                 hccb->tag_enable = FALSE;
 979                                 hccb->tag_type = 0;
 980                         }
 981                         if ((ccbh->flags & CAM_CDB_POINTER) != 0) {
 982                                 if ((ccbh->flags & CAM_CDB_PHYS) == 0) {
 983                                         bcopy(csio->cdb_io.cdb_ptr,
 984                                               hccb->scsi_cdb, hccb->cmd_len);
 985                                 } else {
 986                                         /* I guess I could map it in... */
 987                                         ccbh->status = CAM_REQ_INVALID;
 988                                         btfreeccb(bt, bccb);
 989                                         xpt_done(ccb);
 990                                         return;
 991                                 }
 992                         } else {
 993                                 bcopy(csio->cdb_io.cdb_bytes,
 994                                       hccb->scsi_cdb, hccb->cmd_len);
 995                         }
 996                         /* If need be, bounce our sense buffer */
 997                         if (bt->sense_buffers != NULL) {
 998                                 hccb->sense_addr = btsensepaddr(bt, bccb);
 999                         } else {
1000                                 hccb->sense_addr = vtophys(&csio->sense_data);
1001                         }
1002                         /*
1003                          * If we have any data to send with this command,
1004                          * map it into bus space.
1005                          */
1006                         /* Only use S/G if there is a transfer */
1007                         if ((ccbh->flags & CAM_DIR_MASK) != CAM_DIR_NONE) {
1008                                 if ((ccbh->flags & CAM_SCATTER_VALID) == 0) {
1009                                         /*
1010                                          * We've been given a pointer
1011                                          * to a single buffer.
1012                                          */
1013                                         if ((ccbh->flags & CAM_DATA_PHYS)==0) {
1014                                                 int error;
1015
1016                                                 error = bus_dmamap_load(
1017                                                     bt->buffer_dmat,
1018                                                     bccb->dmamap,
1019                                                     csio->data_ptr,
1020                                                     csio->dxfer_len,
1021                                                     btexecuteccb,
1022                                                     bccb,
1023                                                     /*flags*/0);
1024                                                 if (error == EINPROGRESS) {
1025                                                         /*
1026                                                          * So as to maintain
1027                                                          * ordering, freeze the
1028                                                          * controller queue
1029                                                          * until our mapping is
1030                                                          * returned.
1031                                                          */
1032                                                         xpt_freeze_simq(bt->sim,
1033                                                                         1);
1034                                                         csio->ccb_h.status |=
1035                                                             CAM_RELEASE_SIMQ;
1036                                                 }
1037                                         } else {
1038                                                 struct bus_dma_segment seg;
1039
1040                                                 /* Pointer to physical buffer */
1041                                                 seg.ds_addr =
1042                                                     (bus_addr_t)csio->data_ptr;
1043                                                 seg.ds_len = csio->dxfer_len;
1044                                                 btexecuteccb(bccb, &seg, 1, 0);
1045                                         }
1046                                 } else {
1047                                         struct bus_dma_segment *segs;
1048
1049                                         if ((ccbh->flags & CAM_DATA_PHYS) != 0)
1050                                                 panic("btaction - Physical "
1051                                                       "segment pointers "
1052                                                       "unsupported");
1053
1054                                         if ((ccbh->flags&CAM_SG_LIST_PHYS)==0)
1055                                                 panic("btaction - Virtual "
1056                                                       "segment addresses "
1057                                                       "unsupported");
1058
1059                                         /* Just use the segments provided */
1060                                         segs = (struct bus_dma_segment *)
1061                                             csio->data_ptr;
1062                                         btexecuteccb(bccb, segs,
1063                                                      csio->sglist_cnt, 0);
1064                                 }
1065                         } else {
1066                                 btexecuteccb(bccb, NULL, 0, 0);
1067                         }
1068                 } else {
1069                         hccb->opcode = INITIATOR_BUS_DEV_RESET;
1070                         /* No data transfer */
1071                         hccb->datain = TRUE;
1072                         hccb->dataout = TRUE;
1073                         hccb->cmd_len = 0;
1074                         hccb->sense_len = 0;
1075                         hccb->tag_enable = FALSE;
1076                         hccb->tag_type = 0;
1077                         btexecuteccb(bccb, NULL, 0, 0);
1078                 }
1079                 break;
1080         }
1081         case XPT_EN_LUN:                /* Enable LUN as a target */
1082         case XPT_TARGET_IO:             /* Execute target I/O request */
1083         case XPT_ACCEPT_TARGET_IO:      /* Accept Host Target Mode CDB */
1084         case XPT_CONT_TARGET_IO:        /* Continue Host Target I/O Connection*/
1085         case XPT_ABORT:                 /* Abort the specified CCB */
1086                 /* XXX Implement */
1087                 ccb->ccb_h.status = CAM_REQ_INVALID;
1088                 xpt_done(ccb);
1089                 break;
1090         case XPT_SET_TRAN_SETTINGS:
1091         {
1092                 /* XXX Implement */
1093                 ccb->ccb_h.status = CAM_PROVIDE_FAIL;
1094                 xpt_done(ccb);
1095                 break;
1096         }
1097         case XPT_GET_TRAN_SETTINGS:
1098         /* Get default/user set transfer settings for the target */
1099         {
1100                 struct  ccb_trans_settings *cts;
1101                 u_int   target_mask;
1102
1103                 cts = &ccb->cts;
1104                 target_mask = 0x01 << ccb->ccb_h.target_id;
1105                 if (cts->type == CTS_TYPE_CURRENT_SETTINGS) {
1106                         struct ccb_trans_settings_scsi *scsi =
1107                             &cts->proto_specific.scsi;
1108                         struct ccb_trans_settings_spi *spi =
1109                             &cts->xport_specific.spi;
1110                         cts->protocol = PROTO_SCSI;
1111                         cts->protocol_version = SCSI_REV_2;
1112                         cts->transport = XPORT_SPI;
1113                         cts->transport_version = 2;
1114
1115                         scsi->flags &= ~CTS_SCSI_FLAGS_TAG_ENB;
1116                         spi->flags &= ~CTS_SPI_FLAGS_DISC_ENB;
1117
1118                         if ((bt->disc_permitted & target_mask) != 0)
1119                                 spi->flags |= CTS_SPI_FLAGS_DISC_ENB;
1120                         if ((bt->tags_permitted & target_mask) != 0)
1121                                 scsi->flags |= CTS_SCSI_FLAGS_TAG_ENB;
1122
1123                         if ((bt->ultra_permitted & target_mask) != 0)
1124                                 spi->sync_period = 12;
1125                         else if ((bt->fast_permitted & target_mask) != 0)
1126                                 spi->sync_period = 25;
1127                         else if ((bt->sync_permitted & target_mask) != 0)
1128                                 spi->sync_period = 50;
1129                         else
1130                                 spi->sync_period = 0;
1131
1132                         if (spi->sync_period != 0)
1133                                 spi->sync_offset = 15;
1134
1135                         spi->valid |= CTS_SPI_VALID_SYNC_RATE;
1136                         spi->valid |= CTS_SPI_VALID_SYNC_OFFSET;
1137
1138                         spi->valid |= CTS_SPI_VALID_BUS_WIDTH;
1139                         if ((bt->wide_permitted & target_mask) != 0)
1140                                 spi->bus_width = MSG_EXT_WDTR_BUS_16_BIT;
1141                         else
1142                                 spi->bus_width = MSG_EXT_WDTR_BUS_8_BIT;
1143
1144                         if (cts->ccb_h.target_lun != CAM_LUN_WILDCARD) {
1145                                 scsi->valid = CTS_SCSI_VALID_TQ;
1146                                 spi->valid |= CTS_SPI_VALID_DISC;
1147                         } else
1148                                 scsi->valid = 0;
1149                 } else {
1150                         btfetchtransinfo(bt, cts);
1151                 }
1152
1153                 ccb->ccb_h.status = CAM_REQ_CMP;
1154                 xpt_done(ccb);
1155                 break;
1156         }
1157         case XPT_CALC_GEOMETRY:
1158         {
1159                 struct    ccb_calc_geometry *ccg;
1160                 u_int32_t size_mb;
1161                 u_int32_t secs_per_cylinder;
1162
1163                 ccg = &ccb->ccg;
1164                 size_mb = ccg->volume_size
1165                         / ((1024L * 1024L) / ccg->block_size);
1166
1167                 if (size_mb >= 1024 && (bt->extended_trans != 0)) {
1168                         if (size_mb >= 2048) {
1169                                 ccg->heads = 255;
1170                                 ccg->secs_per_track = 63;
1171                         } else {
1172                                 ccg->heads = 128;
1173                                 ccg->secs_per_track = 32;
1174                         }
1175                 } else {
1176                         ccg->heads = 64;
1177                         ccg->secs_per_track = 32;
1178                 }
1179                 secs_per_cylinder = ccg->heads * ccg->secs_per_track;
1180                 ccg->cylinders = ccg->volume_size / secs_per_cylinder;
1181                 ccb->ccb_h.status = CAM_REQ_CMP;
1182                 xpt_done(ccb);
1183                 break;
1184         }
1185         case XPT_RESET_BUS:             /* Reset the specified SCSI bus */
1186         {
1187                 btreset(bt, /*hardreset*/TRUE);
1188                 ccb->ccb_h.status = CAM_REQ_CMP;
1189                 xpt_done(ccb);
1190                 break;
1191         }
1192         case XPT_TERM_IO:               /* Terminate the I/O process */
1193                 /* XXX Implement */
1194                 ccb->ccb_h.status = CAM_REQ_INVALID;
1195                 xpt_done(ccb);
1196                 break;
1197         case XPT_PATH_INQ:              /* Path routing inquiry */
1198         {
1199                 struct ccb_pathinq *cpi = &ccb->cpi;
1200
1201                 cpi->version_num = 1; /* XXX??? */
1202                 cpi->hba_inquiry = PI_SDTR_ABLE;
1203                 if (bt->tag_capable != 0)
1204                         cpi->hba_inquiry |= PI_TAG_ABLE;
1205                 if (bt->wide_bus != 0)
1206                         cpi->hba_inquiry |= PI_WIDE_16;
1207                 cpi->target_sprt = 0;
1208                 cpi->hba_misc = 0;
1209                 cpi->hba_eng_cnt = 0;
1210                 cpi->max_target = bt->wide_bus ? 15 : 7;
1211                 cpi->max_lun = 7;
1212                 cpi->initiator_id = bt->scsi_id;
1213                 cpi->bus_id = cam_sim_bus(sim);
1214                 cpi->base_transfer_speed = 3300;
1215                 strncpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
1216                 strncpy(cpi->hba_vid, "BusLogic", HBA_IDLEN);
1217                 strncpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
1218                 cpi->unit_number = cam_sim_unit(sim);
1219                 cpi->ccb_h.status = CAM_REQ_CMP;
1220                 cpi->transport = XPORT_SPI;
1221                 cpi->transport_version = 2;
1222                 cpi->protocol = PROTO_SCSI;
1223                 cpi->protocol_version = SCSI_REV_2;
1224                 xpt_done(ccb);
1225                 break;
1226         }
1227         default:
1228                 ccb->ccb_h.status = CAM_REQ_INVALID;
1229                 xpt_done(ccb);
1230                 break;
1231         }
1232 }
1233
1234 static void
1235 btexecuteccb(void *arg, bus_dma_segment_t *dm_segs, int nseg, int error)
1236 {
1237         struct   bt_ccb *bccb;
1238         union    ccb *ccb;
1239         struct   bt_softc *bt;
1240
1241         bccb = (struct bt_ccb *)arg;
1242         ccb = bccb->ccb;
1243         bt = (struct bt_softc *)ccb->ccb_h.ccb_bt_ptr;
1244
1245         if (error != 0) {
1246                 if (error != EFBIG)
1247                         device_printf(bt->dev,
1248                                       "Unexpected error 0x%x returned from "
1249                                       "bus_dmamap_load\n", error);
1250                 if (ccb->ccb_h.status == CAM_REQ_INPROG) {
1251                         xpt_freeze_devq(ccb->ccb_h.path, /*count*/1);
1252                         ccb->ccb_h.status = CAM_REQ_TOO_BIG|CAM_DEV_QFRZN;
1253                 }
1254                 btfreeccb(bt, bccb);
1255                 xpt_done(ccb);
1256                 return;
1257         }
1258
1259         if (nseg != 0) {
1260                 bt_sg_t *sg;
1261                 bus_dma_segment_t *end_seg;
1262                 bus_dmasync_op_t op;
1263
1264                 end_seg = dm_segs + nseg;
1265
1266                 /* Copy the segments into our SG list */
1267                 sg = bccb->sg_list;
1268                 while (dm_segs < end_seg) {
1269                         sg->len = dm_segs->ds_len;
1270                         sg->addr = dm_segs->ds_addr;
1271                         sg++;
1272                         dm_segs++;
1273                 }
1274
1275                 if (nseg > 1) {
1276                         bccb->hccb.opcode = INITIATOR_SG_CCB_WRESID;
1277                         bccb->hccb.data_len = sizeof(bt_sg_t) * nseg;
1278                         bccb->hccb.data_addr = bccb->sg_list_phys;
1279                 } else {
1280                         bccb->hccb.data_len = bccb->sg_list->len;
1281                         bccb->hccb.data_addr = bccb->sg_list->addr;
1282                 }
1283
1284                 if ((ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN)
1285                         op = BUS_DMASYNC_PREREAD;
1286                 else
1287                         op = BUS_DMASYNC_PREWRITE;
1288
1289                 bus_dmamap_sync(bt->buffer_dmat, bccb->dmamap, op);
1290
1291         } else {
1292                 bccb->hccb.opcode = INITIATOR_CCB;
1293                 bccb->hccb.data_len = 0;
1294                 bccb->hccb.data_addr = 0;
1295         }
1296
1297         /*
1298          * Last time we need to check if this CCB needs to
1299          * be aborted.
1300          */
1301         if (ccb->ccb_h.status != CAM_REQ_INPROG) {
1302                 if (nseg != 0)
1303                         bus_dmamap_unload(bt->buffer_dmat, bccb->dmamap);
1304                 btfreeccb(bt, bccb);
1305                 xpt_done(ccb);
1306                 return;
1307         }
1308
1309         bccb->flags = BCCB_ACTIVE;
1310         ccb->ccb_h.status |= CAM_SIM_QUEUED;
1311         LIST_INSERT_HEAD(&bt->pending_ccbs, &ccb->ccb_h, sim_links.le);
1312
1313         callout_reset(&bccb->timer, (ccb->ccb_h.timeout * hz) / 1000,
1314             bttimeout, bccb);
1315
1316         /* Tell the adapter about this command */
1317         bt->cur_outbox->ccb_addr = btccbvtop(bt, bccb);
1318         if (bt->cur_outbox->action_code != BMBO_FREE) {
1319                 /*
1320                  * We should never encounter a busy mailbox.
1321                  * If we do, warn the user, and treat it as
1322                  * a resource shortage.  If the controller is
1323                  * hung, one of the pending transactions will
1324                  * timeout causing us to start recovery operations.
1325                  */
1326                 device_printf(bt->dev,
1327                               "Encountered busy mailbox with %d out of %d "
1328                               "commands active!!!\n", bt->active_ccbs,
1329                               bt->max_ccbs);
1330                 callout_stop(&bccb->timer);
1331                 if (nseg != 0)
1332                         bus_dmamap_unload(bt->buffer_dmat, bccb->dmamap);
1333                 btfreeccb(bt, bccb);
1334                 bt->resource_shortage = TRUE;
1335                 xpt_freeze_simq(bt->sim, /*count*/1);
1336                 ccb->ccb_h.status = CAM_REQUEUE_REQ;
1337                 xpt_done(ccb);
1338                 return;
1339         }
1340         bt->cur_outbox->action_code = BMBO_START;
1341         bt_outb(bt, COMMAND_REG, BOP_START_MBOX);
1342         btnextoutbox(bt);
1343 }
1344
1345 void
1346 bt_intr(void *arg)
1347 {
1348         struct  bt_softc *bt;
1349
1350         bt = arg;
1351         lockmgr(&bt->lock, LK_EXCLUSIVE);
1352         bt_intr_locked(bt);
1353         lockmgr(&bt->lock, LK_RELEASE);
1354 }
1355
1356 void
1357 bt_intr_locked(struct bt_softc *bt)
1358 {
1359         u_int   intstat;
1360
1361         while (((intstat = bt_inb(bt, INTSTAT_REG)) & INTR_PENDING) != 0) {
1362
1363                 if ((intstat & CMD_COMPLETE) != 0) {
1364                         bt->latched_status = bt_inb(bt, STATUS_REG);
1365                         bt->command_cmp = TRUE;
1366                 }
1367
1368                 bt_outb(bt, CONTROL_REG, RESET_INTR);
1369
1370                 if ((intstat & IMB_LOADED) != 0) {
1371                         while (bt->cur_inbox->comp_code != BMBI_FREE) {
1372                                 btdone(bt,
1373                                        btccbptov(bt, bt->cur_inbox->ccb_addr),
1374                                        bt->cur_inbox->comp_code);
1375                                 bt->cur_inbox->comp_code = BMBI_FREE;
1376                                 btnextinbox(bt);
1377                         }
1378                 }
1379
1380                 if ((intstat & SCSI_BUS_RESET) != 0) {
1381                         btreset(bt, /*hardreset*/FALSE);
1382                 }
1383         }
1384 }
1385
1386 static void
1387 btdone(struct bt_softc *bt, struct bt_ccb *bccb, bt_mbi_comp_code_t comp_code)
1388 {
1389         union  ccb        *ccb;
1390         struct ccb_scsiio *csio;
1391
1392         ccb = bccb->ccb;
1393         csio = &bccb->ccb->csio;
1394
1395         if ((bccb->flags & BCCB_ACTIVE) == 0) {
1396                 device_printf(bt->dev,
1397                               "btdone - Attempt to free non-active BCCB %p\n",
1398                               (void *)bccb);
1399                 return;
1400         }
1401
1402         if ((ccb->ccb_h.flags & CAM_DIR_MASK) != CAM_DIR_NONE) {
1403                 bus_dmasync_op_t op;
1404
1405                 if ((ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN)
1406                         op = BUS_DMASYNC_POSTREAD;
1407                 else
1408                         op = BUS_DMASYNC_POSTWRITE;
1409                 bus_dmamap_sync(bt->buffer_dmat, bccb->dmamap, op);
1410                 bus_dmamap_unload(bt->buffer_dmat, bccb->dmamap);
1411         }
1412
1413         if (bccb == bt->recovery_bccb) {
1414                 /*
1415                  * The recovery BCCB does not have a CCB associated
1416                  * with it, so short circuit the normal error handling.
1417                  * We now traverse our list of pending CCBs and process
1418                  * any that were terminated by the recovery CCBs action.
1419                  * We also reinstate timeouts for all remaining, pending,
1420                  * CCBs.
1421                  */
1422                 struct cam_path *path;
1423                 struct ccb_hdr *ccb_h;
1424                 cam_status error;
1425
1426                 /* Notify all clients that a BDR occured */
1427                 error = xpt_create_path(&path, /*periph*/NULL,
1428                                         cam_sim_path(bt->sim),
1429                                         bccb->hccb.target_id,
1430                                         CAM_LUN_WILDCARD);
1431
1432                 if (error == CAM_REQ_CMP)
1433                         xpt_async(AC_SENT_BDR, path, NULL);
1434
1435                 ccb_h = LIST_FIRST(&bt->pending_ccbs);
1436                 while (ccb_h != NULL) {
1437                         struct bt_ccb *pending_bccb;
1438
1439                         pending_bccb = (struct bt_ccb *)ccb_h->ccb_bccb_ptr;
1440                         if (pending_bccb->hccb.target_id
1441                          == bccb->hccb.target_id) {
1442                                 pending_bccb->hccb.btstat = BTSTAT_HA_BDR;
1443                                 ccb_h = LIST_NEXT(ccb_h, sim_links.le);
1444                                 btdone(bt, pending_bccb, BMBI_ERROR);
1445                         } else {
1446                                 callout_reset(&pending_bccb->timer,
1447                                     (ccb_h->timeout * hz) / 1000,
1448                                     bttimeout, pending_bccb);
1449                                 ccb_h = LIST_NEXT(ccb_h, sim_links.le);
1450                         }
1451                 }
1452                 device_printf(bt->dev, "No longer in timeout\n");
1453                 return;
1454         }
1455
1456         callout_stop(&bccb->timer);
1457
1458         switch (comp_code) {
1459         case BMBI_FREE:
1460                 device_printf(bt->dev,
1461                               "btdone - CCB completed with free status!\n");
1462                 break;
1463         case BMBI_NOT_FOUND:
1464                 device_printf(bt->dev,
1465                               "btdone - CCB Abort failed to find CCB\n");
1466                 break;
1467         case BMBI_ABORT:
1468         case BMBI_ERROR:
1469                 if (bootverbose) {
1470                         kprintf("bt: ccb %p - error %x occurred.  "
1471                                "btstat = %x, sdstat = %x\n",
1472                                (void *)bccb, comp_code, bccb->hccb.btstat,
1473                                bccb->hccb.sdstat);
1474                 }
1475                 /* An error occured */
1476                 switch(bccb->hccb.btstat) {
1477                 case BTSTAT_DATARUN_ERROR:
1478                         if (bccb->hccb.data_len == 0) {
1479                                 /*
1480                                  * At least firmware 4.22, does this
1481                                  * for a QUEUE FULL condition.
1482                                  */
1483                                 bccb->hccb.sdstat = SCSI_STATUS_QUEUE_FULL;
1484                         } else if (bccb->hccb.data_len < 0) {
1485                                 csio->ccb_h.status = CAM_DATA_RUN_ERR;
1486                                 break;
1487                         }
1488                         /* FALLTHROUGH */
1489                 case BTSTAT_NOERROR:
1490                 case BTSTAT_LINKED_CMD_COMPLETE:
1491                 case BTSTAT_LINKED_CMD_FLAG_COMPLETE:
1492                 case BTSTAT_DATAUNDERUN_ERROR:
1493
1494                         csio->scsi_status = bccb->hccb.sdstat;
1495                         csio->ccb_h.status |= CAM_SCSI_STATUS_ERROR;
1496                         switch(csio->scsi_status) {
1497                         case SCSI_STATUS_CHECK_COND:
1498                         case SCSI_STATUS_CMD_TERMINATED:
1499                                 csio->ccb_h.status |= CAM_AUTOSNS_VALID;
1500                                 /* Bounce sense back if necessary */
1501                                 if (bt->sense_buffers != NULL) {
1502                                         csio->sense_data =
1503                                             *btsensevaddr(bt, bccb);
1504                                 }
1505                                 break;
1506                         default:
1507                                 break;
1508                         case SCSI_STATUS_OK:
1509                                 csio->ccb_h.status = CAM_REQ_CMP;
1510                                 break;
1511                         }
1512                         csio->resid = bccb->hccb.data_len;
1513                         break;
1514                 case BTSTAT_SELTIMEOUT:
1515                         csio->ccb_h.status = CAM_SEL_TIMEOUT;
1516                         break;
1517                 case BTSTAT_UNEXPECTED_BUSFREE:
1518                         csio->ccb_h.status = CAM_UNEXP_BUSFREE;
1519                         break;
1520                 case BTSTAT_INVALID_PHASE:
1521                         csio->ccb_h.status = CAM_SEQUENCE_FAIL;
1522                         break;
1523                 case BTSTAT_INVALID_ACTION_CODE:
1524                         panic("%s: Inavlid Action code", bt_name(bt));
1525                         break;
1526                 case BTSTAT_INVALID_OPCODE:
1527                         panic("%s: Inavlid CCB Opcode code", bt_name(bt));
1528                         break;
1529                 case BTSTAT_LINKED_CCB_LUN_MISMATCH:
1530                         /* We don't even support linked commands... */
1531                         panic("%s: Linked CCB Lun Mismatch", bt_name(bt));
1532                         break;
1533                 case BTSTAT_INVALID_CCB_OR_SG_PARAM:
1534                         panic("%s: Invalid CCB or SG list", bt_name(bt));
1535                         break;
1536                 case BTSTAT_AUTOSENSE_FAILED:
1537                         csio->ccb_h.status = CAM_AUTOSENSE_FAIL;
1538                         break;
1539                 case BTSTAT_TAGGED_MSG_REJECTED:
1540                 {
1541                         struct ccb_trans_settings neg;
1542                         struct ccb_trans_settings_scsi *scsi =
1543                             &neg.proto_specific.scsi;
1544
1545                         neg.protocol = PROTO_SCSI;
1546                         neg.protocol_version = SCSI_REV_2;
1547                         neg.transport = XPORT_SPI;
1548                         neg.transport_version = 2;
1549                         scsi->valid = CTS_SCSI_VALID_TQ;
1550                         scsi->flags = 0;
1551                         xpt_print_path(csio->ccb_h.path);
1552                         kprintf("refuses tagged commands.  Performing "
1553                                "non-tagged I/O\n");
1554                         xpt_setup_ccb(&neg.ccb_h, csio->ccb_h.path,
1555                                       /*priority*/1);
1556                         xpt_async(AC_TRANSFER_NEG, csio->ccb_h.path, &neg);
1557                         bt->tags_permitted &= ~(0x01 << csio->ccb_h.target_id);
1558                         csio->ccb_h.status = CAM_MSG_REJECT_REC;
1559                         break;
1560                 }
1561                 case BTSTAT_UNSUPPORTED_MSG_RECEIVED:
1562                         /*
1563                          * XXX You would think that this is
1564                          *     a recoverable error... Hmmm.
1565                          */
1566                         csio->ccb_h.status = CAM_REQ_CMP_ERR;
1567                         break;
1568                 case BTSTAT_HA_SOFTWARE_ERROR:
1569                 case BTSTAT_HA_WATCHDOG_ERROR:
1570                 case BTSTAT_HARDWARE_FAILURE:
1571                         /* Hardware reset ??? Can we recover ??? */
1572                         csio->ccb_h.status = CAM_NO_HBA;
1573                         break;
1574                 case BTSTAT_TARGET_IGNORED_ATN:
1575                 case BTSTAT_OTHER_SCSI_BUS_RESET:
1576                 case BTSTAT_HA_SCSI_BUS_RESET:
1577                         if ((csio->ccb_h.status & CAM_STATUS_MASK)
1578                          != CAM_CMD_TIMEOUT)
1579                                 csio->ccb_h.status = CAM_SCSI_BUS_RESET;
1580                         break;
1581                 case BTSTAT_HA_BDR:
1582                         if ((bccb->flags & BCCB_DEVICE_RESET) == 0)
1583                                 csio->ccb_h.status = CAM_BDR_SENT;
1584                         else
1585                                 csio->ccb_h.status = CAM_CMD_TIMEOUT;
1586                         break;
1587                 case BTSTAT_INVALID_RECONNECT:
1588                 case BTSTAT_ABORT_QUEUE_GENERATED:
1589                         csio->ccb_h.status = CAM_REQ_TERMIO;
1590                         break;
1591                 case BTSTAT_SCSI_PERROR_DETECTED:
1592                         csio->ccb_h.status = CAM_UNCOR_PARITY;
1593                         break;
1594                 }
1595                 if (csio->ccb_h.status != CAM_REQ_CMP) {
1596                         xpt_freeze_devq(csio->ccb_h.path, /*count*/1);
1597                         csio->ccb_h.status |= CAM_DEV_QFRZN;
1598                 }
1599                 if ((bccb->flags & BCCB_RELEASE_SIMQ) != 0)
1600                         ccb->ccb_h.status |= CAM_RELEASE_SIMQ;
1601                 btfreeccb(bt, bccb);
1602                 xpt_done(ccb);
1603                 break;
1604         case BMBI_OK:
1605                 /* All completed without incident */
1606                 ccb->ccb_h.status |= CAM_REQ_CMP;
1607                 if ((bccb->flags & BCCB_RELEASE_SIMQ) != 0)
1608                         ccb->ccb_h.status |= CAM_RELEASE_SIMQ;
1609                 btfreeccb(bt, bccb);
1610                 xpt_done(ccb);
1611                 break;
1612         }
1613 }
1614
1615 static int
1616 btreset(struct bt_softc* bt, int hard_reset)
1617 {
1618         struct   ccb_hdr *ccb_h;
1619         u_int    status;
1620         u_int    timeout;
1621         u_int8_t reset_type;
1622
1623         if (hard_reset != 0)
1624                 reset_type = HARD_RESET;
1625         else
1626                 reset_type = SOFT_RESET;
1627         bt_outb(bt, CONTROL_REG, reset_type);
1628
1629         /* Wait 5sec. for Diagnostic start */
1630         timeout = 5 * 10000;
1631         while (--timeout) {
1632                 status = bt_inb(bt, STATUS_REG);
1633                 if ((status & DIAG_ACTIVE) != 0)
1634                         break;
1635                 DELAY(100);
1636         }
1637         if (timeout == 0) {
1638                 if (bootverbose)
1639                         device_printf(bt->dev,
1640                             "btreset - Diagnostic Active failed to "
1641                             "assert. status = 0x%x\n", status);
1642                 return (ETIMEDOUT);
1643         }
1644
1645         /* Wait 10sec. for Diagnostic end */
1646         timeout = 10 * 10000;
1647         while (--timeout) {
1648                 status = bt_inb(bt, STATUS_REG);
1649                 if ((status & DIAG_ACTIVE) == 0)
1650                         break;
1651                 DELAY(100);
1652         }
1653         if (timeout == 0) {
1654                 panic("%s: btreset - Diagnostic Active failed to drop. "
1655                        "status = 0x%x\n", bt_name(bt), status);
1656                 return (ETIMEDOUT);
1657         }
1658
1659         /* Wait for the host adapter to become ready or report a failure */
1660         timeout = 10000;
1661         while (--timeout) {
1662                 status = bt_inb(bt, STATUS_REG);
1663                 if ((status & (DIAG_FAIL|HA_READY|DATAIN_REG_READY)) != 0)
1664                         break;
1665                 DELAY(100);
1666         }
1667         if (timeout == 0) {
1668                 device_printf(bt->dev,
1669                     "btreset - Host adapter failed to come ready. "
1670                     "status = 0x%x\n", status);
1671                 return (ETIMEDOUT);
1672         }
1673
1674         /* If the diagnostics failed, tell the user */
1675         if ((status & DIAG_FAIL) != 0
1676          || (status & HA_READY) == 0) {
1677                 device_printf(bt->dev,
1678                     "btreset - Adapter failed diagnostics\n");
1679
1680                 if ((status & DATAIN_REG_READY) != 0)
1681                         device_printf(bt->dev,
1682                             "btreset - Host Adapter Error code = 0x%x\n",
1683                             bt_inb(bt, DATAIN_REG));
1684                 return (ENXIO);
1685         }
1686
1687         /* If we've allocated mailboxes, initialize them */
1688         if (bt->init_level > 4)
1689                 btinitmboxes(bt);
1690
1691         /* If we've attached to the XPT, tell it about the event */
1692         if (bt->path != NULL)
1693                 xpt_async(AC_BUS_RESET, bt->path, NULL);
1694
1695         /*
1696          * Perform completion processing for all outstanding CCBs.
1697          */
1698         while ((ccb_h = LIST_FIRST(&bt->pending_ccbs)) != NULL) {
1699                 struct bt_ccb *pending_bccb;
1700
1701                 pending_bccb = (struct bt_ccb *)ccb_h->ccb_bccb_ptr;
1702                 pending_bccb->hccb.btstat = BTSTAT_HA_SCSI_BUS_RESET;
1703                 btdone(bt, pending_bccb, BMBI_ERROR);
1704         }
1705
1706         return (0);
1707 }
1708
1709 /*
1710  * Send a command to the adapter.
1711  */
1712 int
1713 bt_cmd(struct bt_softc *bt, bt_op_t opcode, u_int8_t *params, u_int param_len,
1714       u_int8_t *reply_data, u_int reply_len, u_int cmd_timeout)
1715 {
1716         u_int   timeout;
1717         u_int   status;
1718         u_int   saved_status;
1719         u_int   intstat;
1720         u_int   reply_buf_size;
1721         int     cmd_complete;
1722         int     error;
1723
1724         /* No data returned to start */
1725         reply_buf_size = reply_len;
1726         reply_len = 0;
1727         intstat = 0;
1728         cmd_complete = 0;
1729         saved_status = 0;
1730         error = 0;
1731
1732         bt->command_cmp = 0;
1733         /*
1734          * Wait up to 10 sec. for the adapter to become
1735          * ready to accept commands.
1736          */
1737         timeout = 100000;
1738         while (--timeout) {
1739                 status = bt_inb(bt, STATUS_REG);
1740                 if ((status & HA_READY) != 0
1741                  && (status & CMD_REG_BUSY) == 0)
1742                         break;
1743                 /*
1744                  * Throw away any pending data which may be
1745                  * left over from earlier commands that we
1746                  * timedout on.
1747                  */
1748                 if ((status & DATAIN_REG_READY) != 0)
1749                         (void)bt_inb(bt, DATAIN_REG);
1750                 DELAY(100);
1751         }
1752         if (timeout == 0) {
1753                 device_printf(bt->dev,
1754                     "bt_cmd: Timeout waiting for adapter ready, "
1755                     "status = 0x%x\n", status);
1756                 return (ETIMEDOUT);
1757         }
1758
1759         /*
1760          * Send the opcode followed by any necessary parameter bytes.
1761          */
1762         bt_outb(bt, COMMAND_REG, opcode);
1763
1764         /*
1765          * Wait for up to 1sec for each byte of the
1766          * parameter list sent to be sent.
1767          */
1768         timeout = 10000;
1769         while (param_len && --timeout) {
1770                 DELAY(100);
1771                 status = bt_inb(bt, STATUS_REG);
1772                 intstat = bt_inb(bt, INTSTAT_REG);
1773
1774                 if ((intstat & (INTR_PENDING|CMD_COMPLETE))
1775                  == (INTR_PENDING|CMD_COMPLETE)) {
1776                         saved_status = status;
1777                         cmd_complete = 1;
1778                         break;
1779                 }
1780                 if (bt->command_cmp != 0) {
1781                         saved_status = bt->latched_status;
1782                         cmd_complete = 1;
1783                         break;
1784                 }
1785                 if ((status & DATAIN_REG_READY) != 0)
1786                         break;
1787                 if ((status & CMD_REG_BUSY) == 0) {
1788                         bt_outb(bt, COMMAND_REG, *params++);
1789                         param_len--;
1790                         timeout = 10000;
1791                 }
1792         }
1793         if (timeout == 0) {
1794                 device_printf(bt->dev, "bt_cmd: Timeout sending parameters, "
1795                     "status = 0x%x\n", status);
1796                 cmd_complete = 1;
1797                 saved_status = status;
1798                 error = ETIMEDOUT;
1799         }
1800
1801         /*
1802          * Wait for the command to complete.
1803          */
1804         while (cmd_complete == 0 && --cmd_timeout) {
1805                 status = bt_inb(bt, STATUS_REG);
1806                 intstat = bt_inb(bt, INTSTAT_REG);
1807                 /*
1808                  * It may be that this command was issued with
1809                  * controller interrupts disabled.  We'll never
1810                  * get to our command if an incoming mailbox
1811                  * interrupt is pending, so take care of completed
1812                  * mailbox commands by calling our interrupt handler.
1813                  */
1814                 if ((intstat & (INTR_PENDING|IMB_LOADED))
1815                  == (INTR_PENDING|IMB_LOADED))
1816                         bt_intr_locked(bt);
1817
1818                 if (bt->command_cmp != 0) {
1819                         /*
1820                          * Our interrupt handler saw CMD_COMPLETE
1821                          * status before we did.
1822                          */
1823                         cmd_complete = 1;
1824                         saved_status = bt->latched_status;
1825                 } else if ((intstat & (INTR_PENDING|CMD_COMPLETE))
1826                         == (INTR_PENDING|CMD_COMPLETE)) {
1827                         /*
1828                          * Our poll (in case interrupts are blocked)
1829                          * saw the CMD_COMPLETE interrupt.
1830                          */
1831                         cmd_complete = 1;
1832                         saved_status = status;
1833                 } else if (opcode == BOP_MODIFY_IO_ADDR
1834                         && (status & CMD_REG_BUSY) == 0) {
1835                         /*
1836                          * The BOP_MODIFY_IO_ADDR does not issue a CMD_COMPLETE,
1837                          * but it should update the status register.  So, we
1838                          * consider this command complete when the CMD_REG_BUSY
1839                          * status clears.
1840                          */
1841                         saved_status = status;
1842                         cmd_complete = 1;
1843                 } else if ((status & DATAIN_REG_READY) != 0) {
1844                         u_int8_t data;
1845
1846                         data = bt_inb(bt, DATAIN_REG);
1847                         if (reply_len < reply_buf_size) {
1848                                 *reply_data++ = data;
1849                         } else {
1850                                 device_printf(bt->dev,
1851                                     "bt_cmd - Discarded reply data byte "
1852                                     "for opcode 0x%x\n", opcode);
1853                         }
1854                         /*
1855                          * Reset timeout to ensure at least a second
1856                          * between response bytes.
1857                          */
1858                         cmd_timeout = MAX(cmd_timeout, 10000);
1859                         reply_len++;
1860
1861                 } else if ((opcode == BOP_FETCH_LRAM)
1862                         && (status & HA_READY) != 0) {
1863                                 saved_status = status;
1864                                 cmd_complete = 1;
1865                 }
1866                 DELAY(100);
1867         }
1868         if (cmd_timeout == 0) {
1869                 device_printf(bt->dev,
1870                     "bt_cmd: Timeout waiting for command (%x) "
1871                     "to complete.\n", opcode);
1872                 device_printf(bt->dev, "status = 0x%x, intstat = 0x%x, "
1873                     "rlen %d\n", status, intstat, reply_len);
1874                 error = (ETIMEDOUT);
1875         }
1876
1877         /*
1878          * Clear any pending interrupts.
1879          */
1880         bt_intr_locked(bt);
1881
1882         if (error != 0)
1883                 return (error);
1884
1885         /*
1886          * If the command was rejected by the controller, tell the caller.
1887          */
1888         if ((saved_status & CMD_INVALID) != 0) {
1889                 /*
1890                  * Some early adapters may not recover properly from
1891                  * an invalid command.  If it appears that the controller
1892                  * has wedged (i.e. status was not cleared by our interrupt
1893                  * reset above), perform a soft reset.
1894                  */
1895                 if (bootverbose)
1896                         device_printf(bt->dev, "Invalid Command 0x%x\n",
1897                                 opcode);
1898                 DELAY(1000);
1899                 status = bt_inb(bt, STATUS_REG);
1900                 if ((status & (CMD_INVALID|STATUS_REG_RSVD|DATAIN_REG_READY|
1901                               CMD_REG_BUSY|DIAG_FAIL|DIAG_ACTIVE)) != 0
1902                  || (status & (HA_READY|INIT_REQUIRED))
1903                   != (HA_READY|INIT_REQUIRED)) {
1904                         btreset(bt, /*hard_reset*/FALSE);
1905                 }
1906                 return (EINVAL);
1907         }
1908
1909         if (param_len > 0) {
1910                 /* The controller did not accept the full argument list */
1911                 return (E2BIG);
1912         }
1913
1914         if (reply_len != reply_buf_size) {
1915                 /* Too much or too little data received */
1916                 return (EMSGSIZE);
1917         }
1918
1919         /* We were successful */
1920         return (0);
1921 }
1922
1923 static int
1924 btinitmboxes(struct bt_softc *bt) {
1925         init_32b_mbox_params_t init_mbox;
1926         int error;
1927
1928         bzero(bt->in_boxes, sizeof(bt_mbox_in_t) * bt->num_boxes);
1929         bzero(bt->out_boxes, sizeof(bt_mbox_out_t) * bt->num_boxes);
1930         bt->cur_inbox = bt->in_boxes;
1931         bt->last_inbox = bt->in_boxes + bt->num_boxes - 1;
1932         bt->cur_outbox = bt->out_boxes;
1933         bt->last_outbox = bt->out_boxes + bt->num_boxes - 1;
1934
1935         /* Tell the adapter about them */
1936         init_mbox.num_boxes = bt->num_boxes;
1937         init_mbox.base_addr[0] = bt->mailbox_physbase & 0xFF;
1938         init_mbox.base_addr[1] = (bt->mailbox_physbase >> 8) & 0xFF;
1939         init_mbox.base_addr[2] = (bt->mailbox_physbase >> 16) & 0xFF;
1940         init_mbox.base_addr[3] = (bt->mailbox_physbase >> 24) & 0xFF;
1941         error = bt_cmd(bt, BOP_INITIALIZE_32BMBOX, (u_int8_t *)&init_mbox,
1942                        /*parmlen*/sizeof(init_mbox), /*reply_buf*/NULL,
1943                        /*reply_len*/0, DEFAULT_CMD_TIMEOUT);
1944
1945         if (error != 0)
1946                 kprintf("btinitmboxes: Initialization command failed\n");
1947         else if (bt->strict_rr != 0) {
1948                 /*
1949                  * If the controller supports
1950                  * strict round robin mode,
1951                  * enable it
1952                  */
1953                 u_int8_t param;
1954
1955                 param = 0;
1956                 error = bt_cmd(bt, BOP_ENABLE_STRICT_RR, &param, 1,
1957                                /*reply_buf*/NULL, /*reply_len*/0,
1958                                DEFAULT_CMD_TIMEOUT);
1959
1960                 if (error != 0) {
1961                         kprintf("btinitmboxes: Unable to enable strict RR\n");
1962                         error = 0;
1963                 } else if (bootverbose) {
1964                         device_printf(bt->dev,
1965                             "Using Strict Round Robin Mailbox Mode\n");
1966                 }
1967         }
1968
1969         return (error);
1970 }
1971
1972 /*
1973  * Update the XPT's idea of the negotiated transfer
1974  * parameters for a particular target.
1975  */
1976 static void
1977 btfetchtransinfo(struct bt_softc *bt, struct ccb_trans_settings *cts)
1978 {
1979         setup_data_t    setup_info;
1980         u_int           target;
1981         u_int           targ_offset;
1982         u_int           targ_mask;
1983         u_int           sync_period;
1984         u_int           sync_offset;
1985         u_int           bus_width;
1986         int             error;
1987         u_int8_t        param;
1988         targ_syncinfo_t sync_info;
1989         struct ccb_trans_settings_scsi *scsi =
1990             &cts->proto_specific.scsi;
1991         struct ccb_trans_settings_spi *spi =
1992             &cts->xport_specific.spi;
1993
1994         spi->valid = 0;
1995         scsi->valid = 0;
1996
1997         target = cts->ccb_h.target_id;
1998         targ_offset = (target & 0x7);
1999         targ_mask = (0x01 << targ_offset);
2000
2001         /*
2002          * Inquire Setup Information.  This command retreives the
2003          * Wide negotiation status for recent adapters as well as
2004          * the sync info for older models.
2005          */
2006         param = sizeof(setup_info);
2007         error = bt_cmd(bt, BOP_INQUIRE_SETUP_INFO, &param, /*paramlen*/1,
2008                        (u_int8_t*)&setup_info, sizeof(setup_info),
2009                        DEFAULT_CMD_TIMEOUT);
2010
2011         if (error != 0) {
2012                 device_printf(bt->dev,
2013                     "btfetchtransinfo - Inquire Setup Info Failed %x\n",
2014                     error);
2015                 return;
2016         }
2017
2018         sync_info = (target < 8) ? setup_info.low_syncinfo[targ_offset]
2019                                  : setup_info.high_syncinfo[targ_offset];
2020
2021         if (sync_info.sync == 0)
2022                 sync_offset = 0;
2023         else
2024                 sync_offset = sync_info.offset;
2025
2026
2027         bus_width = MSG_EXT_WDTR_BUS_8_BIT;
2028         if (strcmp(bt->firmware_ver, "5.06L") >= 0) {
2029                 u_int wide_active;
2030
2031                 wide_active =
2032                     (target < 8) ? (setup_info.low_wide_active & targ_mask)
2033                                  : (setup_info.high_wide_active & targ_mask);
2034
2035                 if (wide_active)
2036                         bus_width = MSG_EXT_WDTR_BUS_16_BIT;
2037         } else if ((bt->wide_permitted & targ_mask) != 0) {
2038                 struct ccb_getdev cgd;
2039
2040                 /*
2041                  * Prior to rev 5.06L, wide status isn't provided,
2042                  * so we "guess" that wide transfers are in effect
2043                  * if the user settings allow for wide and the inquiry
2044                  * data for the device indicates that it can handle
2045                  * wide transfers.
2046                  */
2047                 xpt_setup_ccb(&cgd.ccb_h, cts->ccb_h.path, /*priority*/1);
2048                 cgd.ccb_h.func_code = XPT_GDEV_TYPE;
2049                 xpt_action((union ccb *)&cgd);
2050                 if ((cgd.ccb_h.status & CAM_STATUS_MASK) == CAM_REQ_CMP
2051                  && (cgd.inq_data.flags & SID_WBus16) != 0)
2052                         bus_width = MSG_EXT_WDTR_BUS_16_BIT;
2053         }
2054
2055         if (bt->firmware_ver[0] >= '3') {
2056                 /*
2057                  * For adapters that can do fast or ultra speeds,
2058                  * use the more exact Target Sync Information command.
2059                  */
2060                 target_sync_info_data_t sync_info;
2061
2062                 param = sizeof(sync_info);
2063                 error = bt_cmd(bt, BOP_TARG_SYNC_INFO, &param, /*paramlen*/1,
2064                                (u_int8_t*)&sync_info, sizeof(sync_info),
2065                                DEFAULT_CMD_TIMEOUT);
2066
2067                 if (error != 0) {
2068                         device_printf(bt->dev,
2069                             "btfetchtransinfo - Inquire Sync "
2070                             "Info Failed 0x%x\n", error);
2071                         return;
2072                 }
2073                 sync_period = sync_info.sync_rate[target] * 100;
2074         } else {
2075                 sync_period = 2000 + (500 * sync_info.period);
2076         }
2077
2078         cts->protocol = PROTO_SCSI;
2079         cts->protocol_version = SCSI_REV_2;
2080         cts->transport = XPORT_SPI;
2081         cts->transport_version = 2;
2082
2083         spi->sync_period = sync_period;
2084         spi->valid |= CTS_SPI_VALID_SYNC_RATE;
2085         spi->sync_offset = sync_offset;
2086         spi->valid |= CTS_SPI_VALID_SYNC_OFFSET;
2087
2088         spi->valid |= CTS_SPI_VALID_BUS_WIDTH;
2089         spi->bus_width = bus_width;
2090
2091         if (cts->ccb_h.target_lun != CAM_LUN_WILDCARD) {
2092                 scsi->valid = CTS_SCSI_VALID_TQ;
2093                 spi->valid |= CTS_SPI_VALID_DISC;
2094         } else
2095                 scsi->valid = 0;
2096
2097         xpt_async(AC_TRANSFER_NEG, cts->ccb_h.path, cts);
2098 }
2099
2100 static void
2101 btmapmboxes(void *arg, bus_dma_segment_t *segs, int nseg, int error)
2102 {
2103         struct bt_softc* bt;
2104
2105         bt = (struct bt_softc*)arg;
2106         bt->mailbox_physbase = segs->ds_addr;
2107 }
2108
2109 static void
2110 btmapccbs(void *arg, bus_dma_segment_t *segs, int nseg, int error)
2111 {
2112         struct bt_softc* bt;
2113
2114         bt = (struct bt_softc*)arg;
2115         bt->bt_ccb_physbase = segs->ds_addr;
2116 }
2117
2118 static void
2119 btmapsgs(void *arg, bus_dma_segment_t *segs, int nseg, int error)
2120 {
2121
2122         struct bt_softc* bt;
2123
2124         bt = (struct bt_softc*)arg;
2125         SLIST_FIRST(&bt->sg_maps)->sg_physaddr = segs->ds_addr;
2126 }
2127
2128 static void
2129 btpoll(struct cam_sim *sim)
2130 {
2131         bt_intr_locked(cam_sim_softc(sim));
2132 }
2133
2134 void
2135 bttimeout(void *arg)
2136 {
2137         struct bt_ccb   *bccb;
2138         union  ccb      *ccb;
2139         struct bt_softc *bt;
2140
2141         bccb = (struct bt_ccb *)arg;
2142         ccb = bccb->ccb;
2143         bt = (struct bt_softc *)ccb->ccb_h.ccb_bt_ptr;
2144         lockmgr(&bt->lock, LK_EXCLUSIVE);
2145         xpt_print_path(ccb->ccb_h.path);
2146         kprintf("CCB %p - timed out\n", (void *)bccb);
2147
2148         if ((bccb->flags & BCCB_ACTIVE) == 0) {
2149                 xpt_print_path(ccb->ccb_h.path);
2150                 kprintf("CCB %p - timed out CCB already completed\n",
2151                        (void *)bccb);
2152                 lockmgr(&bt->lock, LK_RELEASE);
2153                 return;
2154         }
2155
2156         /*
2157          * In order to simplify the recovery process, we ask the XPT
2158          * layer to halt the queue of new transactions and we traverse
2159          * the list of pending CCBs and remove their timeouts. This
2160          * means that the driver attempts to clear only one error
2161          * condition at a time.  In general, timeouts that occur
2162          * close together are related anyway, so there is no benefit
2163          * in attempting to handle errors in parrallel.  Timeouts will
2164          * be reinstated when the recovery process ends.
2165          */
2166         if ((bccb->flags & BCCB_DEVICE_RESET) == 0) {
2167                 struct ccb_hdr *ccb_h;
2168
2169                 if ((bccb->flags & BCCB_RELEASE_SIMQ) == 0) {
2170                         xpt_freeze_simq(bt->sim, /*count*/1);
2171                         bccb->flags |= BCCB_RELEASE_SIMQ;
2172                 }
2173
2174                 ccb_h = LIST_FIRST(&bt->pending_ccbs);
2175                 while (ccb_h != NULL) {
2176                         struct bt_ccb *pending_bccb;
2177
2178                         pending_bccb = (struct bt_ccb *)ccb_h->ccb_bccb_ptr;
2179                         callout_stop(&pending_bccb->timer);
2180                         ccb_h = LIST_NEXT(ccb_h, sim_links.le);
2181                 }
2182         }
2183
2184         if ((bccb->flags & BCCB_DEVICE_RESET) != 0
2185          || bt->cur_outbox->action_code != BMBO_FREE
2186          || ((bccb->hccb.tag_enable == TRUE)
2187           && (bt->firmware_ver[0] < '5'))) {
2188                 /*
2189                  * Try a full host adapter/SCSI bus reset.
2190                  * We do this only if we have already attempted
2191                  * to clear the condition with a BDR, or we cannot
2192                  * attempt a BDR for lack of mailbox resources
2193                  * or because of faulty firmware.  It turns out
2194                  * that firmware versions prior to 5.xx treat BDRs
2195                  * as untagged commands that cannot be sent until
2196                  * all outstanding tagged commands have been processed.
2197                  * This makes it somewhat difficult to use a BDR to
2198                  * clear up a problem with an uncompleted tagged command.
2199                  */
2200                 ccb->ccb_h.status = CAM_CMD_TIMEOUT;
2201                 btreset(bt, /*hardreset*/TRUE);
2202                 device_printf(bt->dev, "No longer in timeout\n");
2203         } else {
2204                 /*
2205                  * Send a Bus Device Reset message:
2206                  * The target that is holding up the bus may not
2207                  * be the same as the one that triggered this timeout
2208                  * (different commands have different timeout lengths),
2209                  * but we have no way of determining this from our
2210                  * timeout handler.  Our strategy here is to queue a
2211                  * BDR message to the target of the timed out command.
2212                  * If this fails, we'll get another timeout 2 seconds
2213                  * later which will attempt a bus reset.
2214                  */
2215                 bccb->flags |= BCCB_DEVICE_RESET;
2216                 callout_reset(&bccb->timer, 2 * hz, bttimeout, bccb);
2217
2218                 bt->recovery_bccb->hccb.opcode = INITIATOR_BUS_DEV_RESET;
2219
2220                 /* No Data Transfer */
2221                 bt->recovery_bccb->hccb.datain = TRUE;
2222                 bt->recovery_bccb->hccb.dataout = TRUE;
2223                 bt->recovery_bccb->hccb.btstat = 0;
2224                 bt->recovery_bccb->hccb.sdstat = 0;
2225                 bt->recovery_bccb->hccb.target_id = ccb->ccb_h.target_id;
2226
2227                 /* Tell the adapter about this command */
2228                 bt->cur_outbox->ccb_addr = btccbvtop(bt, bt->recovery_bccb);
2229                 bt->cur_outbox->action_code = BMBO_START;
2230                 bt_outb(bt, COMMAND_REG, BOP_START_MBOX);
2231                 btnextoutbox(bt);
2232         }
2233         lockmgr(&bt->lock, LK_RELEASE);
2234 }
2235
2236 MODULE_VERSION(bt, 1);
2237 MODULE_DEPEND(bt, cam, 1, 1, 1);