dpt_scsi.c revision 331722
1/*-
2 *       Copyright (c) 1997 by Simon Shapiro
3 *       All Rights Reserved
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions, and the following disclaimer,
10 *    without modification, immediately at the beginning of the file.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 *    notice, this list of conditions and the following disclaimer in the
13 *    documentation and/or other materials provided with the distribution.
14 * 3. The name of the author may not be used to endorse or promote products
15 *    derived from this software without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
21 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 */
29
30#include <sys/cdefs.h>
31__FBSDID("$FreeBSD: stable/11/sys/dev/dpt/dpt_scsi.c 331722 2018-03-29 02:50:57Z eadler $");
32
33/*
34 * dpt_scsi.c: SCSI dependent code for the DPT driver
35 *
36 * credits:	Assisted by Mike Neuffer in the early low level DPT code
37 *		Thanx to Mark Salyzyn of DPT for his assistance.
38 *		Special thanx to Justin Gibbs for invaluable help in
39 *		making this driver look and work like a FreeBSD component.
40 *		Last but not least, many thanx to UCB and the FreeBSD
41 *		team for creating and maintaining such a wonderful O/S.
42 *
43 * TODO:     * Add ISA probe code.
44 *	     * Add driver-level RAID-0. This will allow interoperability with
45 *	       NiceTry, M$-Doze, Win-Dog, Slowlaris, etc., in recognizing RAID
46 *	       arrays that span controllers (Wow!).
47 */
48
49#define _DPT_C_
50
51#include "opt_dpt.h"
52#include "opt_eisa.h"
53
54#include <sys/param.h>
55#include <sys/systm.h>
56#include <sys/conf.h>
57#include <sys/eventhandler.h>
58#include <sys/malloc.h>
59#include <sys/kernel.h>
60
61#include <sys/bus.h>
62
63#include <machine/bus.h>
64
65#include <machine/resource.h>
66#include <sys/rman.h>
67
68
69#include <cam/cam.h>
70#include <cam/cam_ccb.h>
71#include <cam/cam_sim.h>
72#include <cam/cam_xpt_sim.h>
73#include <cam/cam_debug.h>
74#include <cam/scsi/scsi_all.h>
75#include <cam/scsi/scsi_message.h>
76
77#include <vm/vm.h>
78#include <vm/pmap.h>
79
80#include <dev/dpt/dpt.h>
81
82/* dpt_isa.c, dpt_eisa.c, and dpt_pci.c need this in a central place */
83devclass_t	dpt_devclass;
84
85#define microtime_now dpt_time_now()
86
87#define dpt_inl(dpt, port)				\
88	bus_read_4((dpt)->io_res, (dpt)->io_offset + port)
89#define dpt_inb(dpt, port)				\
90	bus_read_1((dpt)->io_res, (dpt)->io_offset + port)
91#define dpt_outl(dpt, port, value)			\
92	bus_write_4((dpt)->io_res, (dpt)->io_offset + port, value)
93#define dpt_outb(dpt, port, value)			\
94	bus_write_1((dpt)->io_res, (dpt)->io_offset + port, value)
95
96/*
97 * These will have to be setup by parameters passed at boot/load time. For
98 * performance reasons, we make them constants for the time being.
99 */
100#define	dpt_min_segs	DPT_MAX_SEGS
101#define	dpt_max_segs	DPT_MAX_SEGS
102
103/* Definitions for our use of the SIM private CCB area */
104#define ccb_dccb_ptr spriv_ptr0
105#define ccb_dpt_ptr spriv_ptr1
106
107/* ================= Private Inline Function declarations ===================*/
108static __inline int		dpt_just_reset(dpt_softc_t * dpt);
109static __inline int		dpt_raid_busy(dpt_softc_t * dpt);
110#ifdef DEV_EISA
111static __inline int		dpt_pio_wait (u_int32_t, u_int, u_int, u_int);
112#endif
113static __inline int		dpt_wait(dpt_softc_t *dpt, u_int bits,
114					 u_int state);
115static __inline struct dpt_ccb* dptgetccb(struct dpt_softc *dpt);
116static __inline void		dptfreeccb(struct dpt_softc *dpt,
117					   struct dpt_ccb *dccb);
118static __inline bus_addr_t	dptccbvtop(struct dpt_softc *dpt,
119					   struct dpt_ccb *dccb);
120
121static __inline int		dpt_send_immediate(dpt_softc_t *dpt,
122						   eata_ccb_t *cmd_block,
123						   u_int32_t cmd_busaddr,
124						   u_int retries,
125						   u_int ifc, u_int code,
126						   u_int code2);
127
128/* ==================== Private Function declarations =======================*/
129static void		dptmapmem(void *arg, bus_dma_segment_t *segs,
130				  int nseg, int error);
131
132static struct sg_map_node*
133			dptallocsgmap(struct dpt_softc *dpt);
134
135static int		dptallocccbs(dpt_softc_t *dpt);
136
137static int		dpt_get_conf(dpt_softc_t *dpt, dpt_ccb_t *dccb,
138				     u_int32_t dccb_busaddr, u_int size,
139				     u_int page, u_int target, int extent);
140static void		dpt_detect_cache(dpt_softc_t *dpt, dpt_ccb_t *dccb,
141					 u_int32_t dccb_busaddr,
142					 u_int8_t *buff);
143
144static void		dpt_poll(struct cam_sim *sim);
145static void		dpt_intr_locked(dpt_softc_t *dpt);
146
147static void		dptexecuteccb(void *arg, bus_dma_segment_t *dm_segs,
148				      int nseg, int error);
149
150static void		dpt_action(struct cam_sim *sim, union ccb *ccb);
151
152static int		dpt_send_eata_command(dpt_softc_t *dpt, eata_ccb_t *cmd,
153					      u_int32_t cmd_busaddr,
154					      u_int command, u_int retries,
155					      u_int ifc, u_int code,
156					      u_int code2);
157static void		dptprocesserror(dpt_softc_t *dpt, dpt_ccb_t *dccb,
158					union ccb *ccb, u_int hba_stat,
159					u_int scsi_stat, u_int32_t resid);
160
161static void		dpttimeout(void *arg);
162static void		dptshutdown(void *arg, int howto);
163
164/* ================= Private Inline Function definitions ====================*/
165static __inline int
166dpt_just_reset(dpt_softc_t * dpt)
167{
168	if ((dpt_inb(dpt, 2) == 'D')
169	 && (dpt_inb(dpt, 3) == 'P')
170	 && (dpt_inb(dpt, 4) == 'T')
171	 && (dpt_inb(dpt, 5) == 'H'))
172		return (1);
173	else
174		return (0);
175}
176
177static __inline int
178dpt_raid_busy(dpt_softc_t * dpt)
179{
180	if ((dpt_inb(dpt, 0) == 'D')
181	 && (dpt_inb(dpt, 1) == 'P')
182	 && (dpt_inb(dpt, 2) == 'T'))
183		return (1);
184	else
185		return (0);
186}
187
188#ifdef DEV_EISA
189static __inline int
190dpt_pio_wait (u_int32_t base, u_int reg, u_int bits, u_int state)
191{
192	int   i;
193	u_int c;
194
195	for (i = 0; i < 20000; i++) {	/* wait 20ms for not busy */
196		c = inb(base + reg) & bits;
197		if (!(c == state))
198			return (0);
199		else
200			DELAY(50);
201	}
202	return (-1);
203}
204#endif
205
206static __inline int
207dpt_wait(dpt_softc_t *dpt, u_int bits, u_int state)
208{
209	int   i;
210	u_int c;
211
212	for (i = 0; i < 20000; i++) {	/* wait 20ms for not busy */
213		c = dpt_inb(dpt, HA_RSTATUS) & bits;
214		if (c == state)
215			return (0);
216		else
217			DELAY(50);
218	}
219	return (-1);
220}
221
222static __inline struct dpt_ccb*
223dptgetccb(struct dpt_softc *dpt)
224{
225	struct	dpt_ccb* dccb;
226
227	if (!dumping)
228		mtx_assert(&dpt->lock, MA_OWNED);
229	if ((dccb = SLIST_FIRST(&dpt->free_dccb_list)) != NULL) {
230		SLIST_REMOVE_HEAD(&dpt->free_dccb_list, links);
231		dpt->free_dccbs--;
232	} else if (dpt->total_dccbs < dpt->max_dccbs) {
233		dptallocccbs(dpt);
234		dccb = SLIST_FIRST(&dpt->free_dccb_list);
235		if (dccb == NULL)
236			device_printf(dpt->dev, "Can't malloc DCCB\n");
237		else {
238			SLIST_REMOVE_HEAD(&dpt->free_dccb_list, links);
239			dpt->free_dccbs--;
240		}
241	}
242
243	return (dccb);
244}
245
246static __inline void
247dptfreeccb(struct dpt_softc *dpt, struct dpt_ccb *dccb)
248{
249
250	if (!dumping)
251		mtx_assert(&dpt->lock, MA_OWNED);
252	if ((dccb->state & DCCB_ACTIVE) != 0)
253		LIST_REMOVE(&dccb->ccb->ccb_h, sim_links.le);
254	if ((dccb->state & DCCB_RELEASE_SIMQ) != 0)
255		dccb->ccb->ccb_h.status |= CAM_RELEASE_SIMQ;
256	else if (dpt->resource_shortage != 0
257	 && (dccb->ccb->ccb_h.status & CAM_RELEASE_SIMQ) == 0) {
258		dccb->ccb->ccb_h.status |= CAM_RELEASE_SIMQ;
259		dpt->resource_shortage = FALSE;
260	}
261	dccb->state = DCCB_FREE;
262	SLIST_INSERT_HEAD(&dpt->free_dccb_list, dccb, links);
263	++dpt->free_dccbs;
264}
265
266static __inline bus_addr_t
267dptccbvtop(struct dpt_softc *dpt, struct dpt_ccb *dccb)
268{
269	return (dpt->dpt_ccb_busbase
270	      + (u_int32_t)((caddr_t)dccb - (caddr_t)dpt->dpt_dccbs));
271}
272
273static __inline struct dpt_ccb *
274dptccbptov(struct dpt_softc *dpt, bus_addr_t busaddr)
275{
276	return (dpt->dpt_dccbs
277	     +  ((struct dpt_ccb *)busaddr
278	       - (struct dpt_ccb *)dpt->dpt_ccb_busbase));
279}
280
281/*
282 * Send a command for immediate execution by the DPT
283 * See above function for IMPORTANT notes.
284 */
285static __inline int
286dpt_send_immediate(dpt_softc_t *dpt, eata_ccb_t *cmd_block,
287		   u_int32_t cmd_busaddr, u_int retries,
288		   u_int ifc, u_int code, u_int code2)
289{
290	return (dpt_send_eata_command(dpt, cmd_block, cmd_busaddr,
291				      EATA_CMD_IMMEDIATE, retries, ifc,
292				      code, code2));
293}
294
295
296/* ===================== Private Function definitions =======================*/
297static void
298dptmapmem(void *arg, bus_dma_segment_t *segs, int nseg, int error)
299{
300	bus_addr_t *busaddrp;
301
302	busaddrp = (bus_addr_t *)arg;
303	*busaddrp = segs->ds_addr;
304}
305
306static struct sg_map_node *
307dptallocsgmap(struct dpt_softc *dpt)
308{
309	struct sg_map_node *sg_map;
310
311	sg_map = malloc(sizeof(*sg_map), M_DEVBUF, M_NOWAIT);
312
313	if (sg_map == NULL)
314		return (NULL);
315
316	/* Allocate S/G space for the next batch of CCBS */
317	if (bus_dmamem_alloc(dpt->sg_dmat, (void **)&sg_map->sg_vaddr,
318			     BUS_DMA_NOWAIT, &sg_map->sg_dmamap) != 0) {
319		free(sg_map, M_DEVBUF);
320		return (NULL);
321	}
322
323	(void)bus_dmamap_load(dpt->sg_dmat, sg_map->sg_dmamap, sg_map->sg_vaddr,
324			      PAGE_SIZE, dptmapmem, &sg_map->sg_physaddr,
325			      /*flags*/0);
326
327	SLIST_INSERT_HEAD(&dpt->sg_maps, sg_map, links);
328
329	return (sg_map);
330}
331
332/*
333 * Allocate another chunk of CCB's. Return count of entries added.
334 */
335static int
336dptallocccbs(dpt_softc_t *dpt)
337{
338	struct dpt_ccb *next_ccb;
339	struct sg_map_node *sg_map;
340	bus_addr_t physaddr;
341	dpt_sg_t *segs;
342	int newcount;
343	int i;
344
345	if (!dumping)
346		mtx_assert(&dpt->lock, MA_OWNED);
347	next_ccb = &dpt->dpt_dccbs[dpt->total_dccbs];
348
349	if (next_ccb == dpt->dpt_dccbs) {
350		/*
351		 * First time through.  Re-use the S/G
352		 * space we allocated for initialization
353		 * CCBS.
354		 */
355		sg_map = SLIST_FIRST(&dpt->sg_maps);
356	} else {
357		sg_map = dptallocsgmap(dpt);
358	}
359
360	if (sg_map == NULL)
361		return (0);
362
363	segs = sg_map->sg_vaddr;
364	physaddr = sg_map->sg_physaddr;
365
366	newcount = (PAGE_SIZE / (dpt->sgsize * sizeof(dpt_sg_t)));
367	for (i = 0; dpt->total_dccbs < dpt->max_dccbs && i < newcount; i++) {
368		int error;
369
370		error = bus_dmamap_create(dpt->buffer_dmat, /*flags*/0,
371					  &next_ccb->dmamap);
372		if (error != 0)
373			break;
374		callout_init_mtx(&next_ccb->timer, &dpt->lock, 0);
375		next_ccb->sg_list = segs;
376		next_ccb->sg_busaddr = htonl(physaddr);
377		next_ccb->eata_ccb.cp_dataDMA = htonl(physaddr);
378		next_ccb->eata_ccb.cp_statDMA = htonl(dpt->sp_physaddr);
379		next_ccb->eata_ccb.cp_reqDMA =
380		    htonl(dptccbvtop(dpt, next_ccb)
381			+ offsetof(struct dpt_ccb, sense_data));
382		next_ccb->eata_ccb.cp_busaddr = dpt->dpt_ccb_busend;
383		next_ccb->state = DCCB_FREE;
384		next_ccb->tag = dpt->total_dccbs;
385		SLIST_INSERT_HEAD(&dpt->free_dccb_list, next_ccb, links);
386		segs += dpt->sgsize;
387		physaddr += (dpt->sgsize * sizeof(dpt_sg_t));
388		dpt->dpt_ccb_busend += sizeof(*next_ccb);
389		next_ccb++;
390		dpt->total_dccbs++;
391	}
392	return (i);
393}
394
395#ifdef DEV_EISA
396dpt_conf_t *
397dpt_pio_get_conf (u_int32_t base)
398{
399	static dpt_conf_t *	conf;
400	u_int16_t *		p;
401	int			i;
402
403	/*
404	 * Allocate a dpt_conf_t
405	 */
406	if (!conf) {
407		conf = (dpt_conf_t *)malloc(sizeof(dpt_conf_t),
408						 M_DEVBUF, M_NOWAIT | M_ZERO);
409	}
410
411	/*
412	 * If we didn't get one then we probably won't ever get one.
413	 */
414	if (!conf) {
415		printf("dpt: unable to allocate dpt_conf_t\n");
416		return (NULL);
417	}
418
419	/*
420	 * Reset the controller.
421	 */
422	outb((base + HA_WCOMMAND), EATA_CMD_RESET);
423
424	/*
425	 * Wait for the controller to become ready.
426	 * For some reason there can be -no- delays after calling reset
427	 * before we wait on ready status.
428	 */
429	if (dpt_pio_wait(base, HA_RSTATUS, HA_SBUSY, 0)) {
430		printf("dpt: timeout waiting for controller to become ready\n");
431		return (NULL);
432	}
433
434	if (dpt_pio_wait(base, HA_RAUXSTAT, HA_ABUSY, 0)) {
435		printf("dpt: timetout waiting for adapter ready.\n");
436		return (NULL);
437	}
438
439	/*
440	 * Send the PIO_READ_CONFIG command.
441	 */
442	outb((base + HA_WCOMMAND), EATA_CMD_PIO_READ_CONFIG);
443
444	/*
445	 * Read the data into the struct.
446	 */
447	p = (u_int16_t *)conf;
448	for (i = 0; i < (sizeof(dpt_conf_t) / 2); i++) {
449
450		if (dpt_pio_wait(base, HA_RSTATUS, HA_SDRQ, 0)) {
451			if (bootverbose)
452				printf("dpt: timeout in data read.\n");
453			return (NULL);
454		}
455
456		(*p) = inw(base + HA_RDATA);
457		p++;
458	}
459
460	if (inb(base + HA_RSTATUS) & HA_SERROR) {
461		if (bootverbose)
462			printf("dpt: error reading configuration data.\n");
463		return (NULL);
464	}
465
466#define BE_EATA_SIGNATURE	0x45415441
467#define LE_EATA_SIGNATURE	0x41544145
468
469	/*
470	 * Test to see if we have a valid card.
471	 */
472	if ((conf->signature == BE_EATA_SIGNATURE) ||
473	    (conf->signature == LE_EATA_SIGNATURE)) {
474
475		while (inb(base + HA_RSTATUS) & HA_SDRQ) {
476 			inw(base + HA_RDATA);
477		}
478
479		return (conf);
480	}
481	return (NULL);
482}
483#endif
484
485/*
486 * Read a configuration page into the supplied dpt_cont_t buffer.
487 */
488static int
489dpt_get_conf(dpt_softc_t *dpt, dpt_ccb_t *dccb, u_int32_t dccb_busaddr,
490	     u_int size, u_int page, u_int target, int extent)
491{
492	eata_ccb_t *cp;
493
494	u_int8_t   status;
495
496	int	   ndx;
497	int	   result;
498
499	mtx_assert(&dpt->lock, MA_OWNED);
500	cp = &dccb->eata_ccb;
501	bzero((void *)(uintptr_t)(volatile void *)dpt->sp, sizeof(*dpt->sp));
502
503	cp->Interpret = 1;
504	cp->DataIn = 1;
505	cp->Auto_Req_Sen = 1;
506	cp->reqlen = sizeof(struct scsi_sense_data);
507
508	cp->cp_id = target;
509	cp->cp_LUN = 0;		/* In the EATA packet */
510	cp->cp_lun = 0;		/* In the SCSI command */
511
512	cp->cp_scsi_cmd = INQUIRY;
513	cp->cp_len = size;
514
515	cp->cp_extent = extent;
516
517	cp->cp_page = page;
518	cp->cp_channel = 0;	/* DNC, Interpret mode is set */
519	cp->cp_identify = 1;
520	cp->cp_datalen = htonl(size);
521
522	/*
523	 * This could be a simple for loop, but we suspected the compiler To
524	 * have optimized it a bit too much. Wait for the controller to
525	 * become ready
526	 */
527	while (((status = dpt_inb(dpt, HA_RSTATUS)) != (HA_SREADY | HA_SSC)
528	     && (status != (HA_SREADY | HA_SSC | HA_SERROR))
529	     && (status != (HA_SDRDY | HA_SERROR | HA_SDRQ)))
530	    || (dpt_wait(dpt, HA_SBUSY, 0))) {
531
532		/*
533		 * RAID Drives still Spinning up? (This should only occur if
534		 * the DPT controller is in a NON PC (PCI?) platform).
535		 */
536		if (dpt_raid_busy(dpt)) {
537			device_printf(dpt->dev,
538			    "WARNING: Get_conf() RSUS failed.\n");
539			return (0);
540		}
541	}
542
543	DptStat_Reset_BUSY(dpt->sp);
544
545	/*
546	 * XXXX We might want to do something more clever than aborting at
547	 * this point, like resetting (rebooting) the controller and trying
548	 * again.
549	 */
550	if ((result = dpt_send_eata_command(dpt, cp, dccb_busaddr,
551					    EATA_CMD_DMA_SEND_CP,
552					    10000, 0, 0, 0)) != 0) {
553		device_printf(dpt->dev,
554		       "WARNING: Get_conf() failed (%d) to send "
555		       "EATA_CMD_DMA_READ_CONFIG\n",
556		       result);
557		return (0);
558	}
559	/* Wait for two seconds for a response.  This can be slow  */
560	for (ndx = 0;
561	     (ndx < 20000)
562	     && !((status = dpt_inb(dpt, HA_RAUXSTAT)) & HA_AIRQ);
563	     ndx++) {
564		DELAY(50);
565	}
566
567	/* Grab the status and clear interrupts */
568	status = dpt_inb(dpt, HA_RSTATUS);
569
570	/*
571	 * Check the status carefully.  Return only if the
572	 * command was successful.
573	 */
574	if (((status & HA_SERROR) == 0)
575	 && (dpt->sp->hba_stat == 0)
576	 && (dpt->sp->scsi_stat == 0)
577	 && (dpt->sp->residue_len == 0))
578		return (0);
579
580	if (dpt->sp->scsi_stat == SCSI_STATUS_CHECK_COND)
581		return (0);
582
583	return (1);
584}
585
586/* Detect Cache parameters and size */
587static void
588dpt_detect_cache(dpt_softc_t *dpt, dpt_ccb_t *dccb, u_int32_t dccb_busaddr,
589		 u_int8_t *buff)
590{
591	eata_ccb_t *cp;
592	u_int8_t   *param;
593	int	    bytes;
594	int	    result;
595	int	    ndx;
596	u_int8_t    status;
597
598	mtx_assert(&dpt->lock, MA_OWNED);
599
600	/*
601	 * Default setting, for best performance..
602	 * This is what virtually all cards default to..
603	 */
604	dpt->cache_type = DPT_CACHE_WRITEBACK;
605	dpt->cache_size = 0;
606
607	cp = &dccb->eata_ccb;
608	bzero((void *)(uintptr_t)(volatile void *)dpt->sp, sizeof(dpt->sp));
609	bzero(buff, 512);
610
611	/* Setup the command structure */
612	cp->Interpret = 1;
613	cp->DataIn = 1;
614	cp->Auto_Req_Sen = 1;
615	cp->reqlen = sizeof(struct scsi_sense_data);
616
617	cp->cp_id = 0;		/* who cares?  The HBA will interpret.. */
618	cp->cp_LUN = 0;		/* In the EATA packet */
619	cp->cp_lun = 0;		/* In the SCSI command */
620	cp->cp_channel = 0;
621
622	cp->cp_scsi_cmd = EATA_CMD_DMA_SEND_CP;
623	cp->cp_len = 56;
624
625	cp->cp_extent = 0;
626	cp->cp_page = 0;
627	cp->cp_identify = 1;
628	cp->cp_dispri = 1;
629
630	/*
631	 * Build the EATA Command Packet structure
632	 * for a Log Sense Command.
633	 */
634	cp->cp_cdb[0] = 0x4d;
635	cp->cp_cdb[1] = 0x0;
636	cp->cp_cdb[2] = 0x40 | 0x33;
637	cp->cp_cdb[7] = 1;
638
639	cp->cp_datalen = htonl(512);
640
641	result = dpt_send_eata_command(dpt, cp, dccb_busaddr,
642				       EATA_CMD_DMA_SEND_CP,
643				       10000, 0, 0, 0);
644	if (result != 0) {
645		device_printf(dpt->dev,
646		       "WARNING: detect_cache() failed (%d) to send "
647		       "EATA_CMD_DMA_SEND_CP\n", result);
648		return;
649	}
650	/* Wait for two seconds for a response.  This can be slow... */
651	for (ndx = 0;
652	     (ndx < 20000) &&
653	     !((status = dpt_inb(dpt, HA_RAUXSTAT)) & HA_AIRQ);
654	     ndx++) {
655		DELAY(50);
656	}
657
658	/* Grab the status and clear interrupts */
659	status = dpt_inb(dpt, HA_RSTATUS);
660
661	/*
662	 * Sanity check
663	 */
664	if (buff[0] != 0x33) {
665		return;
666	}
667	bytes = DPT_HCP_LENGTH(buff);
668	param = DPT_HCP_FIRST(buff);
669
670	if (DPT_HCP_CODE(param) != 1) {
671		/*
672		 * DPT Log Page layout error
673		 */
674		device_printf(dpt->dev, "NOTICE: Log Page (1) layout error\n");
675		return;
676	}
677	if (!(param[4] & 0x4)) {
678		dpt->cache_type = DPT_NO_CACHE;
679		return;
680	}
681	while (DPT_HCP_CODE(param) != 6) {
682		param = DPT_HCP_NEXT(param);
683		if ((param < buff)
684		 || (param >= &buff[bytes])) {
685			return;
686		}
687	}
688
689	if (param[4] & 0x2) {
690		/*
691		 * Cache disabled
692		 */
693		dpt->cache_type = DPT_NO_CACHE;
694		return;
695	}
696
697	if (param[4] & 0x4) {
698		dpt->cache_type = DPT_CACHE_WRITETHROUGH;
699	}
700
701	/* XXX This isn't correct.  This log parameter only has two bytes.... */
702#if 0
703	dpt->cache_size = param[5]
704			| (param[6] << 8)
705			| (param[7] << 16)
706			| (param[8] << 24);
707#endif
708}
709
710static void
711dpt_poll(struct cam_sim *sim)
712{
713	dpt_intr_locked(cam_sim_softc(sim));
714}
715
716static void
717dptexecuteccb(void *arg, bus_dma_segment_t *dm_segs, int nseg, int error)
718{
719	struct	 dpt_ccb *dccb;
720	union	 ccb *ccb;
721	struct	 dpt_softc *dpt;
722
723	dccb = (struct dpt_ccb *)arg;
724	ccb = dccb->ccb;
725	dpt = (struct dpt_softc *)ccb->ccb_h.ccb_dpt_ptr;
726	if (!dumping)
727		mtx_assert(&dpt->lock, MA_OWNED);
728
729	if (error != 0) {
730		if (error != EFBIG)
731			device_printf(dpt->dev,
732			       "Unexepected error 0x%x returned from "
733			       "bus_dmamap_load\n", error);
734		if (ccb->ccb_h.status == CAM_REQ_INPROG) {
735			xpt_freeze_devq(ccb->ccb_h.path, /*count*/1);
736			ccb->ccb_h.status = CAM_REQ_TOO_BIG|CAM_DEV_QFRZN;
737		}
738		dptfreeccb(dpt, dccb);
739		xpt_done(ccb);
740		return;
741	}
742
743	if (nseg != 0) {
744		dpt_sg_t *sg;
745		bus_dma_segment_t *end_seg;
746		bus_dmasync_op_t op;
747
748		end_seg = dm_segs + nseg;
749
750		/* Copy the segments into our SG list */
751		sg = dccb->sg_list;
752		while (dm_segs < end_seg) {
753			sg->seg_len = htonl(dm_segs->ds_len);
754			sg->seg_addr = htonl(dm_segs->ds_addr);
755			sg++;
756			dm_segs++;
757		}
758
759		if (nseg > 1) {
760			dccb->eata_ccb.scatter = 1;
761			dccb->eata_ccb.cp_dataDMA = dccb->sg_busaddr;
762			dccb->eata_ccb.cp_datalen =
763			    htonl(nseg * sizeof(dpt_sg_t));
764		} else {
765			dccb->eata_ccb.cp_dataDMA = dccb->sg_list[0].seg_addr;
766			dccb->eata_ccb.cp_datalen = dccb->sg_list[0].seg_len;
767		}
768
769		if ((ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN)
770			op = BUS_DMASYNC_PREREAD;
771		else
772			op = BUS_DMASYNC_PREWRITE;
773
774		bus_dmamap_sync(dpt->buffer_dmat, dccb->dmamap, op);
775
776	} else {
777		dccb->eata_ccb.cp_dataDMA = 0;
778		dccb->eata_ccb.cp_datalen = 0;
779	}
780
781	/*
782	 * Last time we need to check if this CCB needs to
783	 * be aborted.
784	 */
785	if (ccb->ccb_h.status != CAM_REQ_INPROG) {
786		if (nseg != 0)
787			bus_dmamap_unload(dpt->buffer_dmat, dccb->dmamap);
788		dptfreeccb(dpt, dccb);
789		xpt_done(ccb);
790		return;
791	}
792
793	dccb->state |= DCCB_ACTIVE;
794	ccb->ccb_h.status |= CAM_SIM_QUEUED;
795	LIST_INSERT_HEAD(&dpt->pending_ccb_list, &ccb->ccb_h, sim_links.le);
796	callout_reset_sbt(&dccb->timer, SBT_1MS * ccb->ccb_h.timeout, 0,
797	    dpttimeout, dccb, 0);
798	if (dpt_send_eata_command(dpt, &dccb->eata_ccb,
799				  dccb->eata_ccb.cp_busaddr,
800				  EATA_CMD_DMA_SEND_CP, 0, 0, 0, 0) != 0) {
801		ccb->ccb_h.status = CAM_NO_HBA; /* HBA dead or just busy?? */
802		if (nseg != 0)
803			bus_dmamap_unload(dpt->buffer_dmat, dccb->dmamap);
804		dptfreeccb(dpt, dccb);
805		xpt_done(ccb);
806	}
807}
808
809static void
810dpt_action(struct cam_sim *sim, union ccb *ccb)
811{
812	struct	  dpt_softc *dpt;
813
814	CAM_DEBUG(ccb->ccb_h.path, CAM_DEBUG_TRACE, ("dpt_action\n"));
815
816	dpt = (struct dpt_softc *)cam_sim_softc(sim);
817	mtx_assert(&dpt->lock, MA_OWNED);
818
819	if ((dpt->state & DPT_HA_SHUTDOWN_ACTIVE) != 0) {
820		xpt_print_path(ccb->ccb_h.path);
821		printf("controller is shutdown. Aborting CCB.\n");
822		ccb->ccb_h.status = CAM_NO_HBA;
823		xpt_done(ccb);
824		return;
825	}
826
827	switch (ccb->ccb_h.func_code) {
828	/* Common cases first */
829	case XPT_SCSI_IO:	/* Execute the requested I/O operation */
830	{
831		struct	ccb_scsiio *csio;
832		struct	ccb_hdr *ccbh;
833		struct	dpt_ccb *dccb;
834		struct	eata_ccb *eccb;
835
836		csio = &ccb->csio;
837		ccbh = &ccb->ccb_h;
838		/* Max CDB length is 12 bytes */
839		if (csio->cdb_len > 12) {
840			ccb->ccb_h.status = CAM_REQ_INVALID;
841			xpt_done(ccb);
842			return;
843		}
844		if ((dccb = dptgetccb(dpt)) == NULL) {
845			dpt->resource_shortage = 1;
846			xpt_freeze_simq(sim, /*count*/1);
847			ccb->ccb_h.status = CAM_REQUEUE_REQ;
848			xpt_done(ccb);
849			return;
850		}
851		eccb = &dccb->eata_ccb;
852
853		/* Link dccb and ccb so we can find one from the other */
854		dccb->ccb = ccb;
855		ccb->ccb_h.ccb_dccb_ptr = dccb;
856		ccb->ccb_h.ccb_dpt_ptr = dpt;
857
858		/*
859		 * Explicitly set all flags so that the compiler can
860		 * be smart about setting them.
861		 */
862		eccb->SCSI_Reset = 0;
863		eccb->HBA_Init = 0;
864		eccb->Auto_Req_Sen = (ccb->ccb_h.flags & CAM_DIS_AUTOSENSE)
865				   ? 0 : 1;
866		eccb->scatter = 0;
867		eccb->Quick = 0;
868		eccb->Interpret =
869		    ccb->ccb_h.target_id == dpt->hostid[cam_sim_bus(sim)]
870		    ? 1 : 0;
871		eccb->DataOut = (ccb->ccb_h.flags & CAM_DIR_OUT) ? 1 : 0;
872		eccb->DataIn = (ccb->ccb_h.flags & CAM_DIR_IN) ? 1 : 0;
873		eccb->reqlen = csio->sense_len;
874		eccb->cp_id = ccb->ccb_h.target_id;
875		eccb->cp_channel = cam_sim_bus(sim);
876		eccb->cp_LUN = ccb->ccb_h.target_lun;
877		eccb->cp_luntar = 0;
878		eccb->cp_dispri = (ccb->ccb_h.flags & CAM_DIS_DISCONNECT)
879				? 0 : 1;
880		eccb->cp_identify = 1;
881
882		if ((ccb->ccb_h.flags & CAM_TAG_ACTION_VALID) != 0
883		 && csio->tag_action != CAM_TAG_ACTION_NONE) {
884			eccb->cp_msg[0] = csio->tag_action;
885			eccb->cp_msg[1] = dccb->tag;
886		} else {
887			eccb->cp_msg[0] = 0;
888			eccb->cp_msg[1] = 0;
889		}
890		eccb->cp_msg[2] = 0;
891
892		if ((ccb->ccb_h.flags & CAM_CDB_POINTER) != 0) {
893			if ((ccb->ccb_h.flags & CAM_CDB_PHYS) == 0) {
894				bcopy(csio->cdb_io.cdb_ptr,
895				      eccb->cp_cdb, csio->cdb_len);
896			} else {
897				/* I guess I could map it in... */
898				ccb->ccb_h.status = CAM_REQ_INVALID;
899				dptfreeccb(dpt, dccb);
900				xpt_done(ccb);
901				return;
902			}
903		} else {
904			bcopy(csio->cdb_io.cdb_bytes,
905			      eccb->cp_cdb, csio->cdb_len);
906		}
907		/*
908		 * If we have any data to send with this command,
909		 * map it into bus space.
910		 */
911	        /* Only use S/G if there is a transfer */
912		if ((ccbh->flags & CAM_DIR_MASK) != CAM_DIR_NONE) {
913			int error;
914
915			error = bus_dmamap_load_ccb(dpt->buffer_dmat,
916						    dccb->dmamap,
917						    ccb,
918						    dptexecuteccb,
919						    dccb, /*flags*/0);
920			if (error == EINPROGRESS) {
921				/*
922				 * So as to maintain ordering,
923				 * freeze the controller queue
924				 * until our mapping is
925				 * returned.
926				 */
927				xpt_freeze_simq(sim, 1);
928				dccb->state |= CAM_RELEASE_SIMQ;
929			}
930		} else {
931			/*
932			 * XXX JGibbs.
933			 * Does it want them both on or both off?
934			 * CAM_DIR_NONE is both on, so this code can
935			 * be removed if this is also what the DPT
936			 * exptects.
937			 */
938			eccb->DataOut = 0;
939			eccb->DataIn = 0;
940			dptexecuteccb(dccb, NULL, 0, 0);
941		}
942		break;
943	}
944	case XPT_RESET_DEV:	/* Bus Device Reset the specified SCSI device */
945	case XPT_ABORT:			/* Abort the specified CCB */
946		/* XXX Implement */
947		ccb->ccb_h.status = CAM_REQ_INVALID;
948		xpt_done(ccb);
949		break;
950	case XPT_SET_TRAN_SETTINGS:
951	{
952		ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
953		xpt_done(ccb);
954		break;
955	}
956	case XPT_GET_TRAN_SETTINGS:
957	/* Get default/user set transfer settings for the target */
958	{
959		struct	ccb_trans_settings *cts = &ccb->cts;
960		struct ccb_trans_settings_scsi *scsi =
961		    &cts->proto_specific.scsi;
962		struct ccb_trans_settings_spi *spi =
963		    &cts->xport_specific.spi;
964
965		cts->protocol = PROTO_SCSI;
966		cts->protocol_version = SCSI_REV_2;
967		cts->transport = XPORT_SPI;
968		cts->transport_version = 2;
969
970		if (cts->type == CTS_TYPE_USER_SETTINGS) {
971			spi->flags = CTS_SPI_FLAGS_DISC_ENB;
972			spi->bus_width = (dpt->max_id > 7)
973				       ? MSG_EXT_WDTR_BUS_8_BIT
974				       : MSG_EXT_WDTR_BUS_16_BIT;
975			spi->sync_period = 25; /* 10MHz */
976			if (spi->sync_period != 0)
977				spi->sync_offset = 15;
978			scsi->flags = CTS_SCSI_FLAGS_TAG_ENB;
979
980			spi->valid = CTS_SPI_VALID_SYNC_RATE
981				| CTS_SPI_VALID_SYNC_OFFSET
982				| CTS_SPI_VALID_BUS_WIDTH
983				| CTS_SPI_VALID_DISC;
984			scsi->valid = CTS_SCSI_VALID_TQ;
985			ccb->ccb_h.status = CAM_REQ_CMP;
986		} else {
987			ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
988		}
989		xpt_done(ccb);
990		break;
991	}
992	case XPT_CALC_GEOMETRY:
993	{
994		/*
995		 * XXX Use Adaptec translation until I find out how to
996		 *     get this information from the card.
997		 */
998		cam_calc_geometry(&ccb->ccg, /*extended*/1);
999		xpt_done(ccb);
1000		break;
1001	}
1002	case XPT_RESET_BUS:		/* Reset the specified SCSI bus */
1003	{
1004		/* XXX Implement */
1005		ccb->ccb_h.status = CAM_REQ_CMP;
1006		xpt_done(ccb);
1007		break;
1008	}
1009	case XPT_TERM_IO:		/* Terminate the I/O process */
1010		/* XXX Implement */
1011		ccb->ccb_h.status = CAM_REQ_INVALID;
1012		xpt_done(ccb);
1013		break;
1014	case XPT_PATH_INQ:		/* Path routing inquiry */
1015	{
1016		struct ccb_pathinq *cpi = &ccb->cpi;
1017
1018		cpi->version_num = 1;
1019		cpi->hba_inquiry = PI_SDTR_ABLE|PI_TAG_ABLE;
1020		if (dpt->max_id > 7)
1021			cpi->hba_inquiry |= PI_WIDE_16;
1022		cpi->target_sprt = 0;
1023		cpi->hba_misc = 0;
1024		cpi->hba_eng_cnt = 0;
1025		cpi->max_target = dpt->max_id;
1026		cpi->max_lun = dpt->max_lun;
1027		cpi->initiator_id = dpt->hostid[cam_sim_bus(sim)];
1028		cpi->bus_id = cam_sim_bus(sim);
1029		cpi->base_transfer_speed = 3300;
1030		strlcpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
1031		strlcpy(cpi->hba_vid, "DPT", HBA_IDLEN);
1032		strlcpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
1033		cpi->unit_number = cam_sim_unit(sim);
1034                cpi->transport = XPORT_SPI;
1035                cpi->transport_version = 2;
1036                cpi->protocol = PROTO_SCSI;
1037                cpi->protocol_version = SCSI_REV_2;
1038		cpi->ccb_h.status = CAM_REQ_CMP;
1039		xpt_done(ccb);
1040		break;
1041	}
1042	default:
1043		ccb->ccb_h.status = CAM_REQ_INVALID;
1044		xpt_done(ccb);
1045		break;
1046	}
1047}
1048
1049/*
1050 * This routine will try to send an EATA command to the DPT HBA.
1051 * It will, by default, try 20,000 times, waiting 50us between tries.
1052 * It returns 0 on success and 1 on failure.
1053 */
1054static int
1055dpt_send_eata_command(dpt_softc_t *dpt, eata_ccb_t *cmd_block,
1056		      u_int32_t cmd_busaddr, u_int command, u_int retries,
1057		      u_int ifc, u_int code, u_int code2)
1058{
1059	u_int	loop;
1060
1061	if (!retries)
1062		retries = 20000;
1063
1064	/*
1065	 * I hate this polling nonsense. Wish there was a way to tell the DPT
1066	 * to go get commands at its own pace,  or to interrupt when ready.
1067	 * In the mean time we will measure how many itterations it really
1068	 * takes.
1069	 */
1070	for (loop = 0; loop < retries; loop++) {
1071		if ((dpt_inb(dpt, HA_RAUXSTAT) & HA_ABUSY) == 0)
1072			break;
1073		else
1074			DELAY(50);
1075	}
1076
1077	if (loop < retries) {
1078#ifdef DPT_MEASURE_PERFORMANCE
1079		if (loop > dpt->performance.max_eata_tries)
1080			dpt->performance.max_eata_tries = loop;
1081
1082		if (loop < dpt->performance.min_eata_tries)
1083			dpt->performance.min_eata_tries = loop;
1084#endif
1085	} else {
1086#ifdef DPT_MEASURE_PERFORMANCE
1087		++dpt->performance.command_too_busy;
1088#endif
1089		return (1);
1090	}
1091
1092	/* The controller is alive, advance the wedge timer */
1093#ifdef DPT_RESET_HBA
1094	dpt->last_contact = microtime_now;
1095#endif
1096
1097	if (cmd_block == NULL)
1098		cmd_busaddr = 0;
1099#if (BYTE_ORDER == BIG_ENDIAN)
1100	else {
1101		cmd_busaddr = ((cmd_busaddr >> 24) & 0xFF)
1102			    | ((cmd_busaddr >> 16) & 0xFF)
1103			    | ((cmd_busaddr >> 8) & 0xFF)
1104			    | (cmd_busaddr & 0xFF);
1105	}
1106#endif
1107	/* And now the address */
1108	dpt_outl(dpt, HA_WDMAADDR, cmd_busaddr);
1109
1110	if (command == EATA_CMD_IMMEDIATE) {
1111		if (cmd_block == NULL) {
1112			dpt_outb(dpt, HA_WCODE2, code2);
1113			dpt_outb(dpt, HA_WCODE, code);
1114		}
1115		dpt_outb(dpt, HA_WIFC, ifc);
1116	}
1117	dpt_outb(dpt, HA_WCOMMAND, command);
1118
1119	return (0);
1120}
1121
1122
1123/* ==================== Exported Function definitions =======================*/
1124void
1125dpt_alloc(device_t dev)
1126{
1127	dpt_softc_t	*dpt = device_get_softc(dev);
1128	int    i;
1129
1130	mtx_init(&dpt->lock, "dpt", NULL, MTX_DEF);
1131	SLIST_INIT(&dpt->free_dccb_list);
1132	LIST_INIT(&dpt->pending_ccb_list);
1133	for (i = 0; i < MAX_CHANNELS; i++)
1134		dpt->resetlevel[i] = DPT_HA_OK;
1135
1136#ifdef DPT_MEASURE_PERFORMANCE
1137	dpt_reset_performance(dpt);
1138#endif /* DPT_MEASURE_PERFORMANCE */
1139	return;
1140}
1141
1142void
1143dpt_free(struct dpt_softc *dpt)
1144{
1145	switch (dpt->init_level) {
1146	default:
1147	case 5:
1148		bus_dmamap_unload(dpt->dccb_dmat, dpt->dccb_dmamap);
1149	case 4:
1150		bus_dmamem_free(dpt->dccb_dmat, dpt->dpt_dccbs,
1151				dpt->dccb_dmamap);
1152	case 3:
1153		bus_dma_tag_destroy(dpt->dccb_dmat);
1154	case 2:
1155		bus_dma_tag_destroy(dpt->buffer_dmat);
1156	case 1:
1157	{
1158		struct sg_map_node *sg_map;
1159
1160		while ((sg_map = SLIST_FIRST(&dpt->sg_maps)) != NULL) {
1161			SLIST_REMOVE_HEAD(&dpt->sg_maps, links);
1162			bus_dmamap_unload(dpt->sg_dmat,
1163					  sg_map->sg_dmamap);
1164			bus_dmamem_free(dpt->sg_dmat, sg_map->sg_vaddr,
1165					sg_map->sg_dmamap);
1166			free(sg_map, M_DEVBUF);
1167		}
1168		bus_dma_tag_destroy(dpt->sg_dmat);
1169	}
1170	case 0:
1171		break;
1172	}
1173	mtx_destroy(&dpt->lock);
1174}
1175
1176int
1177dpt_alloc_resources (device_t dev)
1178{
1179	dpt_softc_t *	dpt;
1180	int		error;
1181
1182	dpt = device_get_softc(dev);
1183
1184	dpt->io_res = bus_alloc_resource_any(dev, dpt->io_type, &dpt->io_rid,
1185					     RF_ACTIVE);
1186	if (dpt->io_res == NULL) {
1187		device_printf(dev, "No I/O space?!\n");
1188		error = ENOMEM;
1189		goto bad;
1190	}
1191
1192	dpt->irq_res = bus_alloc_resource_any(dev, SYS_RES_IRQ, &dpt->irq_rid,
1193					      RF_ACTIVE);
1194	if (dpt->irq_res == NULL) {
1195		device_printf(dev, "No IRQ!\n");
1196		error = ENOMEM;
1197		goto bad;
1198	}
1199
1200	return (0);
1201bad:
1202	return(error);
1203}
1204
1205
1206void
1207dpt_release_resources (device_t dev)
1208{
1209	struct dpt_softc *	dpt;
1210
1211	dpt = device_get_softc(dev);
1212
1213	if (dpt->ih)
1214		bus_teardown_intr(dev, dpt->irq_res, dpt->ih);
1215        if (dpt->io_res)
1216                bus_release_resource(dev, dpt->io_type, dpt->io_rid, dpt->io_res);
1217        if (dpt->irq_res)
1218                bus_release_resource(dev, SYS_RES_IRQ, dpt->irq_rid, dpt->irq_res);
1219        if (dpt->drq_res)
1220                bus_release_resource(dev, SYS_RES_DRQ, dpt->drq_rid, dpt->drq_res);
1221
1222	return;
1223}
1224
1225static u_int8_t string_sizes[] =
1226{
1227	sizeof(((dpt_inq_t*)NULL)->vendor),
1228	sizeof(((dpt_inq_t*)NULL)->modelNum),
1229	sizeof(((dpt_inq_t*)NULL)->firmware),
1230	sizeof(((dpt_inq_t*)NULL)->protocol),
1231};
1232
1233int
1234dpt_init(struct dpt_softc *dpt)
1235{
1236	dpt_conf_t  conf;
1237	struct	    sg_map_node *sg_map;
1238	dpt_ccb_t  *dccb;
1239	u_int8_t   *strp;
1240	int	    index;
1241	int	    i;
1242	int	    retval;
1243
1244	dpt->init_level = 0;
1245	SLIST_INIT(&dpt->sg_maps);
1246	mtx_lock(&dpt->lock);
1247
1248#ifdef DPT_RESET_BOARD
1249	device_printf(dpt->dev, "resetting HBA\n");
1250	dpt_outb(dpt, HA_WCOMMAND, EATA_CMD_RESET);
1251	DELAY(750000);
1252	/* XXX Shouldn't we poll a status register or something??? */
1253#endif
1254	/* DMA tag for our S/G structures.  We allocate in page sized chunks */
1255	if (bus_dma_tag_create(	/* parent	*/ dpt->parent_dmat,
1256				/* alignment	*/ 1,
1257				/* boundary	*/ 0,
1258				/* lowaddr	*/ BUS_SPACE_MAXADDR,
1259				/* highaddr	*/ BUS_SPACE_MAXADDR,
1260				/* filter	*/ NULL,
1261				/* filterarg	*/ NULL,
1262				/* maxsize	*/ PAGE_SIZE,
1263				/* nsegments	*/ 1,
1264				/* maxsegsz	*/ BUS_SPACE_MAXSIZE_32BIT,
1265				/* flags	*/ 0,
1266				/* lockfunc	*/ NULL,
1267				/* lockarg	*/ NULL,
1268				&dpt->sg_dmat) != 0) {
1269		goto error_exit;
1270        }
1271
1272	dpt->init_level++;
1273
1274	/*
1275	 * We allocate our DPT ccbs as a contiguous array of bus dma'able
1276	 * memory.  To get the allocation size, we need to know how many
1277	 * ccbs the card supports.  This requires a ccb.  We solve this
1278	 * chicken and egg problem by allocating some re-usable S/G space
1279	 * up front, and treating it as our status packet, CCB, and target
1280	 * memory space for these commands.
1281	 */
1282	sg_map = dptallocsgmap(dpt);
1283	if (sg_map == NULL)
1284		goto error_exit;
1285
1286	dpt->sp = (volatile dpt_sp_t *)sg_map->sg_vaddr;
1287	dccb = (struct dpt_ccb *)(uintptr_t)(volatile void *)&dpt->sp[1];
1288	bzero(dccb, sizeof(*dccb));
1289	dpt->sp_physaddr = sg_map->sg_physaddr;
1290	dccb->eata_ccb.cp_dataDMA =
1291	    htonl(sg_map->sg_physaddr + sizeof(dpt_sp_t) + sizeof(*dccb));
1292	dccb->eata_ccb.cp_busaddr = ~0;
1293	dccb->eata_ccb.cp_statDMA = htonl(dpt->sp_physaddr);
1294	dccb->eata_ccb.cp_reqDMA = htonl(dpt->sp_physaddr + sizeof(*dccb)
1295				       + offsetof(struct dpt_ccb, sense_data));
1296
1297	/* Okay.  Fetch our config */
1298	bzero(&dccb[1], sizeof(conf)); /* data area */
1299	retval = dpt_get_conf(dpt, dccb, sg_map->sg_physaddr + sizeof(dpt_sp_t),
1300			      sizeof(conf), 0xc1, 7, 1);
1301
1302	if (retval != 0) {
1303		device_printf(dpt->dev, "Failed to get board configuration\n");
1304		goto error_exit;
1305	}
1306	bcopy(&dccb[1], &conf, sizeof(conf));
1307
1308	bzero(&dccb[1], sizeof(dpt->board_data));
1309	retval = dpt_get_conf(dpt, dccb, sg_map->sg_physaddr + sizeof(dpt_sp_t),
1310			      sizeof(dpt->board_data), 0, conf.scsi_id0, 0);
1311	if (retval != 0) {
1312		device_printf(dpt->dev, "Failed to get inquiry information\n");
1313		goto error_exit;
1314	}
1315	bcopy(&dccb[1], &dpt->board_data, sizeof(dpt->board_data));
1316
1317	dpt_detect_cache(dpt, dccb, sg_map->sg_physaddr + sizeof(dpt_sp_t),
1318			 (u_int8_t *)&dccb[1]);
1319
1320	switch (ntohl(conf.splen)) {
1321	case DPT_EATA_REVA:
1322		dpt->EATA_revision = 'a';
1323		break;
1324	case DPT_EATA_REVB:
1325		dpt->EATA_revision = 'b';
1326		break;
1327	case DPT_EATA_REVC:
1328		dpt->EATA_revision = 'c';
1329		break;
1330	case DPT_EATA_REVZ:
1331		dpt->EATA_revision = 'z';
1332		break;
1333	default:
1334		dpt->EATA_revision = '?';
1335	}
1336
1337	dpt->max_id	 = conf.MAX_ID;
1338	dpt->max_lun	 = conf.MAX_LUN;
1339	dpt->irq	 = conf.IRQ;
1340	dpt->dma_channel = (8 - conf.DMA_channel) & 7;
1341	dpt->channels	 = conf.MAX_CHAN + 1;
1342	dpt->state	|= DPT_HA_OK;
1343	if (conf.SECOND)
1344		dpt->primary = FALSE;
1345	else
1346		dpt->primary = TRUE;
1347
1348	dpt->more_support = conf.MORE_support;
1349
1350	if (strncmp(dpt->board_data.firmware, "07G0", 4) >= 0)
1351		dpt->immediate_support = 1;
1352	else
1353		dpt->immediate_support = 0;
1354
1355	dpt->broken_INQUIRY = FALSE;
1356
1357	dpt->cplen = ntohl(conf.cplen);
1358	dpt->cppadlen = ntohs(conf.cppadlen);
1359	dpt->max_dccbs = ntohs(conf.queuesiz);
1360
1361	if (dpt->max_dccbs > 256) {
1362		device_printf(dpt->dev, "Max CCBs reduced from %d to "
1363		       "256 due to tag algorithm\n", dpt->max_dccbs);
1364		dpt->max_dccbs = 256;
1365	}
1366
1367	dpt->hostid[0] = conf.scsi_id0;
1368	dpt->hostid[1] = conf.scsi_id1;
1369	dpt->hostid[2] = conf.scsi_id2;
1370
1371	if (conf.SG_64K)
1372		dpt->sgsize = 8192;
1373	else
1374		dpt->sgsize = ntohs(conf.SGsiz);
1375
1376	/* We can only get 64k buffers, so don't bother to waste space. */
1377	if (dpt->sgsize < 17 || dpt->sgsize > 32)
1378		dpt->sgsize = 32;
1379
1380	if (dpt->sgsize > dpt_max_segs)
1381		dpt->sgsize = dpt_max_segs;
1382
1383	/* DMA tag for mapping buffers into device visible space. */
1384	if (bus_dma_tag_create(	/* parent	*/ dpt->parent_dmat,
1385				/* alignment	*/ 1,
1386				/* boundary	*/ 0,
1387				/* lowaddr	*/ BUS_SPACE_MAXADDR,
1388				/* highaddr	*/ BUS_SPACE_MAXADDR,
1389				/* filter	*/ NULL,
1390				/* filterarg	*/ NULL,
1391				/* maxsize	*/ DFLTPHYS,
1392				/* nsegments	*/ dpt->sgsize,
1393				/* maxsegsz	*/ BUS_SPACE_MAXSIZE_32BIT,
1394				/* flags	*/ BUS_DMA_ALLOCNOW,
1395				/* lockfunc	*/ busdma_lock_mutex,
1396				/* lockarg	*/ &dpt->lock,
1397				&dpt->buffer_dmat) != 0) {
1398		device_printf(dpt->dev,
1399		    "bus_dma_tag_create(...,dpt->buffer_dmat) failed\n");
1400		goto error_exit;
1401	}
1402
1403	dpt->init_level++;
1404
1405	/* DMA tag for our ccb structures and interrupt status packet */
1406	if (bus_dma_tag_create(	/* parent	*/ dpt->parent_dmat,
1407				/* alignment	*/ 1,
1408				/* boundary	*/ 0,
1409				/* lowaddr	*/ BUS_SPACE_MAXADDR,
1410				/* highaddr	*/ BUS_SPACE_MAXADDR,
1411				/* filter	*/ NULL,
1412				/* filterarg	*/ NULL,
1413				/* maxsize	*/ (dpt->max_dccbs *
1414						    sizeof(struct dpt_ccb)) +
1415						    sizeof(dpt_sp_t),
1416				/* nsegments	*/ 1,
1417				/* maxsegsz	*/ BUS_SPACE_MAXSIZE_32BIT,
1418				/* flags	*/ 0,
1419				/* lockfunc	*/ NULL,
1420				/* lockarg	*/ NULL,
1421				&dpt->dccb_dmat) != 0) {
1422		device_printf(dpt->dev,
1423		    "bus_dma_tag_create(...,dpt->dccb_dmat) failed\n");
1424		goto error_exit;
1425        }
1426
1427	dpt->init_level++;
1428
1429	/* Allocation for our ccbs and interrupt status packet */
1430	if (bus_dmamem_alloc(dpt->dccb_dmat, (void **)&dpt->dpt_dccbs,
1431			     BUS_DMA_NOWAIT, &dpt->dccb_dmamap) != 0) {
1432		device_printf(dpt->dev,
1433		    "bus_dmamem_alloc(dpt->dccb_dmat,...) failed\n");
1434		goto error_exit;
1435	}
1436
1437	dpt->init_level++;
1438
1439	/* And permanently map them */
1440	bus_dmamap_load(dpt->dccb_dmat, dpt->dccb_dmamap,
1441       			dpt->dpt_dccbs,
1442			(dpt->max_dccbs * sizeof(struct dpt_ccb))
1443			+ sizeof(dpt_sp_t),
1444			dptmapmem, &dpt->dpt_ccb_busbase, /*flags*/0);
1445
1446	/* Clear them out. */
1447	bzero(dpt->dpt_dccbs,
1448	      (dpt->max_dccbs * sizeof(struct dpt_ccb)) + sizeof(dpt_sp_t));
1449
1450	dpt->dpt_ccb_busend = dpt->dpt_ccb_busbase;
1451
1452	dpt->sp = (dpt_sp_t*)&dpt->dpt_dccbs[dpt->max_dccbs];
1453	dpt->sp_physaddr = dpt->dpt_ccb_busbase
1454			 + (dpt->max_dccbs * sizeof(dpt_ccb_t));
1455	dpt->init_level++;
1456
1457	/* Allocate our first batch of ccbs */
1458	if (dptallocccbs(dpt) == 0) {
1459		device_printf(dpt->dev, "dptallocccbs(dpt) == 0\n");
1460		mtx_unlock(&dpt->lock);
1461		return (2);
1462	}
1463
1464	/* Prepare for Target Mode */
1465	dpt->target_mode_enabled = 1;
1466
1467	/* Nuke excess spaces from inquiry information */
1468	strp = dpt->board_data.vendor;
1469	for (i = 0; i < sizeof(string_sizes); i++) {
1470		index = string_sizes[i] - 1;
1471		while (index && (strp[index] == ' '))
1472			strp[index--] = '\0';
1473		strp += string_sizes[i];
1474	}
1475
1476	device_printf(dpt->dev, "%.8s %.16s FW Rev. %.4s, ",
1477	       dpt->board_data.vendor,
1478	       dpt->board_data.modelNum, dpt->board_data.firmware);
1479
1480	printf("%d channel%s, ", dpt->channels, dpt->channels > 1 ? "s" : "");
1481
1482	if (dpt->cache_type != DPT_NO_CACHE
1483	 && dpt->cache_size != 0) {
1484		printf("%s Cache, ",
1485		       dpt->cache_type == DPT_CACHE_WRITETHROUGH
1486		     ? "Write-Through" : "Write-Back");
1487	}
1488
1489	printf("%d CCBs\n", dpt->max_dccbs);
1490	mtx_unlock(&dpt->lock);
1491	return (0);
1492
1493error_exit:
1494	mtx_unlock(&dpt->lock);
1495	return (1);
1496}
1497
1498int
1499dpt_attach(dpt_softc_t *dpt)
1500{
1501	struct cam_devq *devq;
1502	int i;
1503
1504	/*
1505	 * Create the device queue for our SIM.
1506	 */
1507	devq = cam_simq_alloc(dpt->max_dccbs);
1508	if (devq == NULL)
1509		return (0);
1510
1511	mtx_lock(&dpt->lock);
1512	for (i = 0; i < dpt->channels; i++) {
1513		/*
1514		 * Construct our SIM entry
1515		 */
1516		dpt->sims[i] = cam_sim_alloc(dpt_action, dpt_poll, "dpt",
1517		    dpt, device_get_unit(dpt->dev), &dpt->lock,
1518					     /*untagged*/2,
1519					     /*tagged*/dpt->max_dccbs, devq);
1520		if (dpt->sims[i] == NULL) {
1521			if (i == 0)
1522				cam_simq_free(devq);
1523			else
1524				printf(	"%s(): Unable to attach bus %d "
1525					"due to resource shortage\n",
1526					__func__, i);
1527			break;
1528		}
1529
1530		if (xpt_bus_register(dpt->sims[i], dpt->dev, i) != CAM_SUCCESS){
1531			cam_sim_free(dpt->sims[i], /*free_devq*/i == 0);
1532			dpt->sims[i] = NULL;
1533			break;
1534		}
1535
1536		if (xpt_create_path(&dpt->paths[i], /*periph*/NULL,
1537				    cam_sim_path(dpt->sims[i]),
1538				    CAM_TARGET_WILDCARD,
1539				    CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
1540			xpt_bus_deregister(cam_sim_path(dpt->sims[i]));
1541			cam_sim_free(dpt->sims[i], /*free_devq*/i == 0);
1542			dpt->sims[i] = NULL;
1543			break;
1544		}
1545
1546	}
1547	mtx_unlock(&dpt->lock);
1548	if (i > 0)
1549		EVENTHANDLER_REGISTER(shutdown_final, dptshutdown,
1550				      dpt, SHUTDOWN_PRI_DEFAULT);
1551	return (i);
1552}
1553
1554int
1555dpt_detach (device_t dev)
1556{
1557	struct dpt_softc *	dpt;
1558	int			i;
1559
1560	dpt = device_get_softc(dev);
1561
1562	mtx_lock(&dpt->lock);
1563	for (i = 0; i < dpt->channels; i++) {
1564#if 0
1565	        xpt_async(AC_LOST_DEVICE, dpt->paths[i], NULL);
1566#endif
1567        	xpt_free_path(dpt->paths[i]);
1568        	xpt_bus_deregister(cam_sim_path(dpt->sims[i]));
1569        	cam_sim_free(dpt->sims[i], /*free_devq*/TRUE);
1570	}
1571	mtx_unlock(&dpt->lock);
1572
1573	dptshutdown((void *)dpt, SHUTDOWN_PRI_DEFAULT);
1574
1575	dpt_release_resources(dev);
1576
1577	dpt_free(dpt);
1578
1579	return (0);
1580}
1581
1582/*
1583 * This is the interrupt handler for the DPT driver.
1584 */
1585void
1586dpt_intr(void *arg)
1587{
1588	dpt_softc_t    *dpt;
1589
1590	dpt = arg;
1591	mtx_lock(&dpt->lock);
1592	dpt_intr_locked(dpt);
1593	mtx_unlock(&dpt->lock);
1594}
1595
1596void
1597dpt_intr_locked(dpt_softc_t *dpt)
1598{
1599	dpt_ccb_t      *dccb;
1600	union ccb      *ccb;
1601	u_int		status;
1602	u_int		aux_status;
1603	u_int		hba_stat;
1604	u_int		scsi_stat;
1605	u_int32_t	residue_len;	/* Number of bytes not transferred */
1606
1607	/* First order of business is to check if this interrupt is for us */
1608	while (((aux_status = dpt_inb(dpt, HA_RAUXSTAT)) & HA_AIRQ) != 0) {
1609
1610		/*
1611		 * What we want to do now, is to capture the status, all of it,
1612		 * move it where it belongs, wake up whoever sleeps waiting to
1613		 * process this result, and get out of here.
1614		 */
1615		if (dpt->sp->ccb_busaddr < dpt->dpt_ccb_busbase
1616		 || dpt->sp->ccb_busaddr >= dpt->dpt_ccb_busend) {
1617			device_printf(dpt->dev,
1618			    "Encountered bogus status packet\n");
1619			status = dpt_inb(dpt, HA_RSTATUS);
1620			return;
1621		}
1622
1623		dccb = dptccbptov(dpt, dpt->sp->ccb_busaddr);
1624
1625		dpt->sp->ccb_busaddr = ~0;
1626
1627		/* Ignore status packets with EOC not set */
1628		if (dpt->sp->EOC == 0) {
1629			device_printf(dpt->dev,
1630			       "ERROR: Request %d received with "
1631			       "clear EOC.\n     Marking as LOST.\n",
1632			       dccb->transaction_id);
1633
1634			/* This CLEARS the interrupt! */
1635			status = dpt_inb(dpt, HA_RSTATUS);
1636			continue;
1637		}
1638		dpt->sp->EOC = 0;
1639
1640		/*
1641		 * Double buffer the status information so the hardware can
1642		 * work on updating the status packet while we decifer the
1643		 * one we were just interrupted for.
1644		 * According to Mark Salyzyn, we only need few pieces of it.
1645		 */
1646		hba_stat = dpt->sp->hba_stat;
1647		scsi_stat = dpt->sp->scsi_stat;
1648		residue_len = dpt->sp->residue_len;
1649
1650		/* Clear interrupts, check for error */
1651		if ((status = dpt_inb(dpt, HA_RSTATUS)) & HA_SERROR) {
1652			/*
1653			 * Error Condition. Check for magic cookie. Exit
1654			 * this test on earliest sign of non-reset condition
1655			 */
1656
1657			/* Check that this is not a board reset interrupt */
1658			if (dpt_just_reset(dpt)) {
1659				device_printf(dpt->dev, "HBA rebooted.\n"
1660				       "      All transactions should be "
1661				       "resubmitted\n");
1662
1663				device_printf(dpt->dev,
1664				       ">>---->>  This is incomplete, "
1665				       "fix me....  <<----<<");
1666				panic("DPT Rebooted");
1667
1668			}
1669		}
1670		/* Process CCB */
1671		ccb = dccb->ccb;
1672		callout_stop(&dccb->timer);
1673		if ((ccb->ccb_h.flags & CAM_DIR_MASK) != CAM_DIR_NONE) {
1674			bus_dmasync_op_t op;
1675
1676			if ((ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN)
1677				op = BUS_DMASYNC_POSTREAD;
1678			else
1679				op = BUS_DMASYNC_POSTWRITE;
1680			bus_dmamap_sync(dpt->buffer_dmat, dccb->dmamap, op);
1681			bus_dmamap_unload(dpt->buffer_dmat, dccb->dmamap);
1682		}
1683
1684		/* Common Case inline... */
1685		if (hba_stat == HA_NO_ERROR) {
1686			ccb->csio.scsi_status = scsi_stat;
1687			ccb->ccb_h.status = 0;
1688			switch (scsi_stat) {
1689			case SCSI_STATUS_OK:
1690				ccb->ccb_h.status |= CAM_REQ_CMP;
1691				break;
1692			case SCSI_STATUS_CHECK_COND:
1693			case SCSI_STATUS_CMD_TERMINATED:
1694				bcopy(&dccb->sense_data, &ccb->csio.sense_data,
1695				      ccb->csio.sense_len);
1696				ccb->ccb_h.status |= CAM_AUTOSNS_VALID;
1697				/* FALLTHROUGH */
1698			default:
1699				ccb->ccb_h.status |= CAM_SCSI_STATUS_ERROR;
1700				/* XXX Freeze DevQ */
1701				break;
1702			}
1703			ccb->csio.resid = residue_len;
1704			dptfreeccb(dpt, dccb);
1705			xpt_done(ccb);
1706		} else {
1707			dptprocesserror(dpt, dccb, ccb, hba_stat, scsi_stat,
1708					residue_len);
1709		}
1710	}
1711}
1712
1713static void
1714dptprocesserror(dpt_softc_t *dpt, dpt_ccb_t *dccb, union ccb *ccb,
1715		u_int hba_stat, u_int scsi_stat, u_int32_t resid)
1716{
1717	ccb->csio.resid = resid;
1718	switch (hba_stat) {
1719	case HA_ERR_SEL_TO:
1720		ccb->ccb_h.status = CAM_SEL_TIMEOUT;
1721		break;
1722	case HA_ERR_CMD_TO:
1723		ccb->ccb_h.status = CAM_CMD_TIMEOUT;
1724		break;
1725	case HA_SCSIBUS_RESET:
1726	case HA_HBA_POWER_UP:	/* Similar effect to a bus reset??? */
1727		ccb->ccb_h.status = CAM_SCSI_BUS_RESET;
1728		break;
1729	case HA_CP_ABORTED:
1730	case HA_CP_RESET:	/* XXX ??? */
1731	case HA_CP_ABORT_NA:	/* XXX ??? */
1732	case HA_CP_RESET_NA:	/* XXX ??? */
1733		if ((ccb->ccb_h.status & CAM_STATUS_MASK) == CAM_REQ_INPROG)
1734			ccb->ccb_h.status = CAM_REQ_ABORTED;
1735		break;
1736	case HA_PCI_PARITY:
1737	case HA_PCI_MABORT:
1738	case HA_PCI_TABORT:
1739	case HA_PCI_STABORT:
1740	case HA_BUS_PARITY:
1741	case HA_PARITY_ERR:
1742	case HA_ECC_ERR:
1743		ccb->ccb_h.status = CAM_UNCOR_PARITY;
1744		break;
1745	case HA_UNX_MSGRJCT:
1746		ccb->ccb_h.status = CAM_MSG_REJECT_REC;
1747		break;
1748	case HA_UNX_BUSPHASE:
1749		ccb->ccb_h.status = CAM_SEQUENCE_FAIL;
1750		break;
1751	case HA_UNX_BUS_FREE:
1752		ccb->ccb_h.status = CAM_UNEXP_BUSFREE;
1753		break;
1754	case HA_SCSI_HUNG:
1755	case HA_RESET_STUCK:
1756		/*
1757		 * Dead???  Can the controller get unstuck
1758		 * from these conditions
1759		 */
1760		ccb->ccb_h.status = CAM_NO_HBA;
1761		break;
1762	case HA_RSENSE_FAIL:
1763		ccb->ccb_h.status = CAM_AUTOSENSE_FAIL;
1764		break;
1765	default:
1766		device_printf(dpt->dev, "Undocumented Error %x\n", hba_stat);
1767		printf("Please mail this message to shimon@simon-shapiro.org\n");
1768		ccb->ccb_h.status = CAM_REQ_CMP_ERR;
1769		break;
1770	}
1771	dptfreeccb(dpt, dccb);
1772	xpt_done(ccb);
1773}
1774
1775static void
1776dpttimeout(void *arg)
1777{
1778	struct dpt_ccb	 *dccb;
1779	union  ccb	 *ccb;
1780	struct dpt_softc *dpt;
1781
1782	dccb = (struct dpt_ccb *)arg;
1783	ccb = dccb->ccb;
1784	dpt = (struct dpt_softc *)ccb->ccb_h.ccb_dpt_ptr;
1785	mtx_assert(&dpt->lock, MA_OWNED);
1786	xpt_print_path(ccb->ccb_h.path);
1787	printf("CCB %p - timed out\n", (void *)dccb);
1788
1789	/*
1790	 * Try to clear any pending jobs.  FreeBSD will lose interrupts,
1791	 * leaving the controller suspended, and commands timed-out.
1792	 * By calling the interrupt handler, any command thus stuck will be
1793	 * completed.
1794	 */
1795	dpt_intr_locked(dpt);
1796
1797	if ((dccb->state & DCCB_ACTIVE) == 0) {
1798		xpt_print_path(ccb->ccb_h.path);
1799		printf("CCB %p - timed out CCB already completed\n",
1800		       (void *)dccb);
1801		return;
1802	}
1803
1804	/* Abort this particular command.  Leave all others running */
1805	dpt_send_immediate(dpt, &dccb->eata_ccb, dccb->eata_ccb.cp_busaddr,
1806			   /*retries*/20000, EATA_SPECIFIC_ABORT, 0, 0);
1807	ccb->ccb_h.status = CAM_CMD_TIMEOUT;
1808}
1809
1810/*
1811 * Shutdown the controller and ensure that the cache is completely flushed.
1812 * Called from the shutdown_final event after all disk access has completed.
1813 */
1814static void
1815dptshutdown(void *arg, int howto)
1816{
1817	dpt_softc_t *dpt;
1818
1819	dpt = (dpt_softc_t *)arg;
1820
1821	device_printf(dpt->dev,
1822	    "Shutting down (mode %x) HBA.	Please wait...\n", howto);
1823
1824	/*
1825	 * What we do for a shutdown, is give the DPT early power loss warning
1826	 */
1827	mtx_lock(&dpt->lock);
1828	dpt_send_immediate(dpt, NULL, 0, EATA_POWER_OFF_WARN, 0, 0, 0);
1829	mtx_unlock(&dpt->lock);
1830	DELAY(1000 * 1000 * 5);
1831	device_printf(dpt->dev, "Controller was warned of shutdown and is now "
1832	       "disabled\n");
1833}
1834
1835/*============================================================================*/
1836
1837#if 0
1838#ifdef DPT_RESET_HBA
1839
1840/*
1841**	Function name : dpt_reset_hba
1842**
1843**	Description : Reset the HBA and properly discard all pending work
1844**	Input :       Softc
1845**	Output :      Nothing
1846*/
1847static void
1848dpt_reset_hba(dpt_softc_t *dpt)
1849{
1850	eata_ccb_t       *ccb;
1851	dpt_ccb_t         dccb, *dccbp;
1852	int               result;
1853	struct scsi_xfer *xs;
1854
1855	mtx_assert(&dpt->lock, MA_OWNED);
1856
1857	/* Prepare a control block.  The SCSI command part is immaterial */
1858	dccb.xs = NULL;
1859	dccb.flags = 0;
1860	dccb.state = DPT_CCB_STATE_NEW;
1861	dccb.std_callback = NULL;
1862	dccb.wrbuff_callback = NULL;
1863
1864	ccb = &dccb.eata_ccb;
1865	ccb->CP_OpCode = EATA_CMD_RESET;
1866	ccb->SCSI_Reset = 0;
1867	ccb->HBA_Init = 1;
1868	ccb->Auto_Req_Sen = 1;
1869	ccb->cp_id = 0; /* Should be ignored */
1870	ccb->DataIn = 1;
1871	ccb->DataOut = 0;
1872	ccb->Interpret = 1;
1873	ccb->reqlen = htonl(sizeof(struct scsi_sense_data));
1874	ccb->cp_statDMA = htonl(vtophys(&ccb->cp_statDMA));
1875	ccb->cp_reqDMA = htonl(vtophys(&ccb->cp_reqDMA));
1876	ccb->cp_viraddr = (u_int32_t) & ccb;
1877
1878	ccb->cp_msg[0] = HA_IDENTIFY_MSG | HA_DISCO_RECO;
1879	ccb->cp_scsi_cmd = 0;  /* Should be ignored */
1880
1881	/* Lock up the submitted queue.  We are very persistent here */
1882	while (dpt->queue_status & DPT_SUBMITTED_QUEUE_ACTIVE) {
1883		DELAY(100);
1884	}
1885
1886	dpt->queue_status |= DPT_SUBMITTED_QUEUE_ACTIVE;
1887
1888	/* Send the RESET message */
1889	if ((result = dpt_send_eata_command(dpt, &dccb.eata_ccb,
1890					    EATA_CMD_RESET, 0, 0, 0, 0)) != 0) {
1891		device_printf(dpt->dev, "Failed to send the RESET message.\n"
1892		       "     Trying cold boot (ouch!)\n");
1893
1894
1895		if ((result = dpt_send_eata_command(dpt, &dccb.eata_ccb,
1896						    EATA_COLD_BOOT, 0, 0,
1897						    0, 0)) != 0) {
1898			panic("%s:  Faild to cold boot the HBA\n",
1899			    device_get_nameunit(dpt->dev));
1900		}
1901#ifdef DPT_MEASURE_PERFORMANCE
1902		dpt->performance.cold_boots++;
1903#endif /* DPT_MEASURE_PERFORMANCE */
1904	}
1905
1906#ifdef DPT_MEASURE_PERFORMANCE
1907	dpt->performance.warm_starts++;
1908#endif /* DPT_MEASURE_PERFORMANCE */
1909
1910	device_printf(dpt->dev,
1911	    "Aborting pending requests.  O/S should re-submit\n");
1912
1913	while ((dccbp = TAILQ_FIRST(&dpt->completed_ccbs)) != NULL) {
1914		struct scsi_xfer *xs = dccbp->xs;
1915
1916		/* Not all transactions have xs structs */
1917		if (xs != NULL) {
1918			/* Tell the kernel proper this did not complete well */
1919			xs->error |= XS_SELTIMEOUT;
1920			xs->flags |= SCSI_ITSDONE;
1921			scsi_done(xs);
1922		}
1923
1924		dpt_Qremove_submitted(dpt, dccbp);
1925
1926		/* Remember, Callbacks are NOT in the standard queue */
1927		if (dccbp->std_callback != NULL) {
1928			(dccbp->std_callback)(dpt, dccbp->eata_ccb.cp_channel,
1929					       dccbp);
1930		} else {
1931			dpt_Qpush_free(dpt, dccbp);
1932		}
1933	}
1934
1935	device_printf(dpt->dev, "reset done aborting all pending commands\n");
1936	dpt->queue_status &= ~DPT_SUBMITTED_QUEUE_ACTIVE;
1937}
1938
1939#endif /* DPT_RESET_HBA */
1940
1941/*
1942 * Build a Command Block for target mode READ/WRITE BUFFER,
1943 * with the ``sync'' bit ON.
1944 *
1945 * Although the length and offset are 24 bit fields in the command, they cannot
1946 * exceed 8192 bytes, so we take them as short integers andcheck their range.
1947 * If they are sensless, we round them to zero offset, maximum length and
1948 * complain.
1949 */
1950
1951static void
1952dpt_target_ccb(dpt_softc_t * dpt, int bus, u_int8_t target, u_int8_t lun,
1953	       dpt_ccb_t * ccb, int mode, u_int8_t command,
1954	       u_int16_t length, u_int16_t offset)
1955{
1956	eata_ccb_t     *cp;
1957
1958	mtx_assert(&dpt->lock, MA_OWNED);
1959	if ((length + offset) > DPT_MAX_TARGET_MODE_BUFFER_SIZE) {
1960		device_printf(dpt->dev,
1961		    "Length of %d, and offset of %d are wrong\n",
1962		    length, offset);
1963		length = DPT_MAX_TARGET_MODE_BUFFER_SIZE;
1964		offset = 0;
1965	}
1966	ccb->xs = NULL;
1967	ccb->flags = 0;
1968	ccb->state = DPT_CCB_STATE_NEW;
1969	ccb->std_callback = (ccb_callback) dpt_target_done;
1970	ccb->wrbuff_callback = NULL;
1971
1972	cp = &ccb->eata_ccb;
1973	cp->CP_OpCode = EATA_CMD_DMA_SEND_CP;
1974	cp->SCSI_Reset = 0;
1975	cp->HBA_Init = 0;
1976	cp->Auto_Req_Sen = 1;
1977	cp->cp_id = target;
1978	cp->DataIn = 1;
1979	cp->DataOut = 0;
1980	cp->Interpret = 0;
1981	cp->reqlen = htonl(sizeof(struct scsi_sense_data));
1982	cp->cp_statDMA = htonl(vtophys(&cp->cp_statDMA));
1983	cp->cp_reqDMA = htonl(vtophys(&cp->cp_reqDMA));
1984	cp->cp_viraddr = (u_int32_t) & ccb;
1985
1986	cp->cp_msg[0] = HA_IDENTIFY_MSG | HA_DISCO_RECO;
1987
1988	cp->cp_scsi_cmd = command;
1989	cp->cp_cdb[1] = (u_int8_t) (mode & SCSI_TM_MODE_MASK);
1990	cp->cp_lun = lun;	/* Order is important here! */
1991	cp->cp_cdb[2] = 0x00;	/* Buffer Id, only 1 :-( */
1992	cp->cp_cdb[3] = (length >> 16) & 0xFF;	/* Buffer offset MSB */
1993	cp->cp_cdb[4] = (length >> 8) & 0xFF;
1994	cp->cp_cdb[5] = length & 0xFF;
1995	cp->cp_cdb[6] = (length >> 16) & 0xFF;	/* Length MSB */
1996	cp->cp_cdb[7] = (length >> 8) & 0xFF;
1997	cp->cp_cdb[8] = length & 0xFF;	/* Length LSB */
1998	cp->cp_cdb[9] = 0;	/* No sync, no match bits */
1999
2000	/*
2001	 * This could be optimized to live in dpt_register_buffer.
2002	 * We keep it here, just in case the kernel decides to reallocate pages
2003	 */
2004	if (dpt_scatter_gather(dpt, ccb, DPT_RW_BUFFER_SIZE,
2005			       dpt->rw_buffer[bus][target][lun])) {
2006		device_printf(dpt->dev, "Failed to setup Scatter/Gather for "
2007		       "Target-Mode buffer\n");
2008	}
2009}
2010
2011/* Setup a target mode READ command */
2012
2013static void
2014dpt_set_target(int redo, dpt_softc_t * dpt,
2015	       u_int8_t bus, u_int8_t target, u_int8_t lun, int mode,
2016	       u_int16_t length, u_int16_t offset, dpt_ccb_t * ccb)
2017{
2018
2019	mtx_assert(&dpt->lock, MA_OWNED);
2020	if (dpt->target_mode_enabled) {
2021		if (!redo)
2022			dpt_target_ccb(dpt, bus, target, lun, ccb, mode,
2023				       SCSI_TM_READ_BUFFER, length, offset);
2024
2025		ccb->transaction_id = ++dpt->commands_processed;
2026
2027#ifdef DPT_MEASURE_PERFORMANCE
2028		dpt->performance.command_count[ccb->eata_ccb.cp_scsi_cmd]++;
2029		ccb->command_started = microtime_now;
2030#endif
2031		dpt_Qadd_waiting(dpt, ccb);
2032		dpt_sched_queue(dpt);
2033	} else {
2034		device_printf(dpt->dev,
2035		    "Target Mode Request, but Target Mode is OFF\n");
2036	}
2037}
2038
2039/*
2040 * Schedule a buffer to be sent to another target.
2041 * The work will be scheduled and the callback provided will be called when
2042 * the work is actually done.
2043 *
2044 * Please NOTE:  ``Anyone'' can send a buffer, but only registered clients
2045 * get notified of receipt of buffers.
2046 */
2047
2048int
2049dpt_send_buffer(int unit, u_int8_t channel, u_int8_t target, u_int8_t lun,
2050		u_int8_t mode, u_int16_t length, u_int16_t offset, void *data,
2051		buff_wr_done callback)
2052{
2053	dpt_softc_t    *dpt;
2054	dpt_ccb_t      *ccb = NULL;
2055
2056	/* This is an external call.  Be a bit paranoid */
2057	dpt = devclass_get_device(dpt_devclass, unit);
2058	if (dpt == NULL)
2059		return (INVALID_UNIT);
2060
2061	mtx_lock(&dpt->lock);
2062	if (dpt->target_mode_enabled) {
2063		if ((channel >= dpt->channels) || (target > dpt->max_id) ||
2064		    (lun > dpt->max_lun)) {
2065			mtx_unlock(&dpt->lock);
2066			return (INVALID_SENDER);
2067		}
2068		if ((dpt->rw_buffer[channel][target][lun] == NULL) ||
2069		    (dpt->buffer_receiver[channel][target][lun] == NULL)) {
2070			mtx_unlock(&dpt->lock);
2071			return (NOT_REGISTERED);
2072		}
2073
2074		/* Process the free list */
2075		if ((TAILQ_EMPTY(&dpt->free_ccbs)) && dpt_alloc_freelist(dpt)) {
2076			device_printf(dpt->dev,
2077			    "ERROR: Cannot allocate any more free CCB's.\n"
2078			    "             Please try later\n");
2079			mtx_unlock(&dpt->lock);
2080			return (NO_RESOURCES);
2081		}
2082		/* Now grab the newest CCB */
2083		if ((ccb = dpt_Qpop_free(dpt)) == NULL) {
2084			mtx_unlock(&dpt->lock);
2085			panic("%s: Got a NULL CCB from pop_free()\n",
2086			    device_get_nameunit(dpt->dev));
2087		}
2088
2089		bcopy(dpt->rw_buffer[channel][target][lun] + offset, data, length);
2090		dpt_target_ccb(dpt, channel, target, lun, ccb, mode,
2091					   SCSI_TM_WRITE_BUFFER,
2092					   length, offset);
2093		ccb->std_callback = (ccb_callback) callback; /* Potential trouble */
2094
2095		ccb->transaction_id = ++dpt->commands_processed;
2096
2097#ifdef DPT_MEASURE_PERFORMANCE
2098		dpt->performance.command_count[ccb->eata_ccb.cp_scsi_cmd]++;
2099		ccb->command_started = microtime_now;
2100#endif
2101		dpt_Qadd_waiting(dpt, ccb);
2102		dpt_sched_queue(dpt);
2103
2104		mtx_unlock(&dpt->lock);
2105		return (0);
2106	}
2107	mtx_unlock(&dpt->lock);
2108	return (DRIVER_DOWN);
2109}
2110
2111static void
2112dpt_target_done(dpt_softc_t * dpt, int bus, dpt_ccb_t * ccb)
2113{
2114	eata_ccb_t     *cp;
2115
2116	cp = &ccb->eata_ccb;
2117
2118	/*
2119	 * Remove the CCB from the waiting queue.
2120	 *  We do NOT put it back on the free, etc., queues as it is a special
2121	 * ccb, owned by the dpt_softc of this unit.
2122	 */
2123	dpt_Qremove_completed(dpt, ccb);
2124
2125#define br_channel           (ccb->eata_ccb.cp_channel)
2126#define br_target            (ccb->eata_ccb.cp_id)
2127#define br_lun               (ccb->eata_ccb.cp_LUN)
2128#define br_index	     [br_channel][br_target][br_lun]
2129#define read_buffer_callback (dpt->buffer_receiver br_index )
2130#define	read_buffer	     (dpt->rw_buffer[br_channel][br_target][br_lun])
2131#define cb(offset)           (ccb->eata_ccb.cp_cdb[offset])
2132#define br_offset            ((cb(3) << 16) | (cb(4) << 8) | cb(5))
2133#define br_length            ((cb(6) << 16) | (cb(7) << 8) | cb(8))
2134
2135	/* Different reasons for being here, you know... */
2136	switch (ccb->eata_ccb.cp_scsi_cmd) {
2137	case SCSI_TM_READ_BUFFER:
2138		if (read_buffer_callback != NULL) {
2139			/* This is a buffer generated by a kernel process */
2140			read_buffer_callback(device_get_unit(dpt->dev),
2141					     br_channel, br_target, br_lun,
2142					     read_buffer,
2143					     br_offset, br_length);
2144		} else {
2145			/*
2146			 * This is a buffer waited for by a user (sleeping)
2147			 * command
2148			 */
2149			wakeup(ccb);
2150		}
2151
2152		/* We ALWAYS re-issue the same command; args are don't-care  */
2153		dpt_set_target(1, 0, 0, 0, 0, 0, 0, 0, 0);
2154		break;
2155
2156	case SCSI_TM_WRITE_BUFFER:
2157		(ccb->wrbuff_callback) (device_get_unit(dpt->dev), br_channel,
2158					br_target, br_offset, br_length,
2159					br_lun, ccb->status_packet.hba_stat);
2160		break;
2161	default:
2162		device_printf(dpt->dev,
2163		    "%s is an unsupported command for target mode\n",
2164		    scsi_cmd_name(ccb->eata_ccb.cp_scsi_cmd));
2165	}
2166	dpt->target_ccb[br_channel][br_target][br_lun] = NULL;
2167	dpt_Qpush_free(dpt, ccb);
2168}
2169
2170
2171/*
2172 * Use this function to register a client for a buffer read target operation.
2173 * The function you register will be called every time a buffer is received
2174 * by the target mode code.
2175 */
2176dpt_rb_t
2177dpt_register_buffer(int unit, u_int8_t channel, u_int8_t target, u_int8_t lun,
2178		    u_int8_t mode, u_int16_t length, u_int16_t offset,
2179		    dpt_rec_buff callback, dpt_rb_op_t op)
2180{
2181	dpt_softc_t    *dpt;
2182	dpt_ccb_t      *ccb = NULL;
2183	int             ospl;
2184
2185	dpt = devclass_get_device(dpt_devclass, unit);
2186	if (dpt == NULL)
2187		return (INVALID_UNIT);
2188	mtx_lock(&dpt->lock);
2189
2190	if (dpt->state & DPT_HA_SHUTDOWN_ACTIVE) {
2191		mtx_unlock(&dpt->lock);
2192		return (DRIVER_DOWN);
2193	}
2194
2195	if ((channel > (dpt->channels - 1)) || (target > (dpt->max_id - 1)) ||
2196	    (lun > (dpt->max_lun - 1))) {
2197		mtx_unlock(&dpt->lock);
2198		return (INVALID_SENDER);
2199	}
2200
2201	if (dpt->buffer_receiver[channel][target][lun] == NULL) {
2202		if (op == REGISTER_BUFFER) {
2203			/* Assign the requested callback */
2204			dpt->buffer_receiver[channel][target][lun] = callback;
2205			/* Get a CCB */
2206
2207			/* Process the free list */
2208			if ((TAILQ_EMPTY(&dpt->free_ccbs)) && dpt_alloc_freelist(dpt)) {
2209				device_printf(dpt->dev,
2210				    "ERROR: Cannot allocate any more free CCB's.\n"
2211				    "             Please try later\n");
2212				mtx_unlock(&dpt->lock);
2213				return (NO_RESOURCES);
2214			}
2215			/* Now grab the newest CCB */
2216			if ((ccb = dpt_Qpop_free(dpt)) == NULL) {
2217				mtx_unlock(&dpt->lock);
2218				panic("%s: Got a NULL CCB from pop_free()\n",
2219				    device_get_nameunit(dpt->dev));
2220			}
2221
2222			/* Clean up the leftover of the previous tenant */
2223			ccb->status = DPT_CCB_STATE_NEW;
2224			dpt->target_ccb[channel][target][lun] = ccb;
2225
2226			dpt->rw_buffer[channel][target][lun] =
2227				malloc(DPT_RW_BUFFER_SIZE, M_DEVBUF, M_NOWAIT);
2228			if (dpt->rw_buffer[channel][target][lun] == NULL) {
2229				device_printf(dpt->dev, "Failed to allocate "
2230				       "Target-Mode buffer\n");
2231				dpt_Qpush_free(dpt, ccb);
2232				mtx_unlock(&dpt->lock);
2233				return (NO_RESOURCES);
2234			}
2235			dpt_set_target(0, dpt, channel, target, lun, mode,
2236				       length, offset, ccb);
2237			mtx_unlock(&dpt->lock);
2238			return (SUCCESSFULLY_REGISTERED);
2239		} else {
2240			mtx_unlock(&dpt->lock);
2241			return (NOT_REGISTERED);
2242		}
2243	} else {
2244		if (op == REGISTER_BUFFER) {
2245			if (dpt->buffer_receiver[channel][target][lun] == callback) {
2246				mtx_unlock(&dpt->lock);
2247				return (ALREADY_REGISTERED);
2248			} else {
2249				mtx_unlock(&dpt->lock);
2250				return (REGISTERED_TO_ANOTHER);
2251			}
2252		} else {
2253			if (dpt->buffer_receiver[channel][target][lun] == callback) {
2254				dpt->buffer_receiver[channel][target][lun] = NULL;
2255				dpt_Qpush_free(dpt, ccb);
2256				free(dpt->rw_buffer[channel][target][lun], M_DEVBUF);
2257				mtx_unlock(&dpt->lock);
2258				return (SUCCESSFULLY_REGISTERED);
2259			} else {
2260				mtx_unlock(&dpt->lock);
2261				return (INVALID_CALLBACK);
2262			}
2263		}
2264
2265	}
2266	mtx_unlock(&dpt->lock);
2267}
2268
2269/* Return the state of the blinking DPT LED's */
2270u_int8_t
2271dpt_blinking_led(dpt_softc_t * dpt)
2272{
2273	int             ndx;
2274	u_int32_t       state;
2275	u_int32_t       previous;
2276	u_int8_t        result;
2277
2278	mtx_assert(&dpt->lock, MA_OWNED);
2279	result = 0;
2280
2281	for (ndx = 0, state = 0, previous = 0;
2282	     (ndx < 10) && (state != previous);
2283	     ndx++) {
2284		previous = state;
2285		state = dpt_inl(dpt, 1);
2286	}
2287
2288	if ((state == previous) && (state == DPT_BLINK_INDICATOR))
2289		result = dpt_inb(dpt, 5);
2290
2291	return (result);
2292}
2293
2294/*
2295 * Execute a command which did not come from the kernel's SCSI layer.
2296 * The only way to map user commands to bus and target is to comply with the
2297 * standard DPT wire-down scheme:
2298 */
2299int
2300dpt_user_cmd(dpt_softc_t * dpt, eata_pt_t * user_cmd,
2301	     caddr_t cmdarg, int minor_no)
2302{
2303	dpt_ccb_t *ccb;
2304	void	  *data;
2305	int	   channel, target, lun;
2306	int	   huh;
2307	int	   result;
2308	int	   submitted;
2309
2310	mtx_assert(&dpt->lock, MA_OWNED);
2311	data = NULL;
2312	channel = minor2hba(minor_no);
2313	target = minor2target(minor_no);
2314	lun = minor2lun(minor_no);
2315
2316	if ((channel > (dpt->channels - 1))
2317	 || (target > dpt->max_id)
2318	 || (lun > dpt->max_lun))
2319		return (ENXIO);
2320
2321	if (target == dpt->sc_scsi_link[channel].adapter_targ) {
2322		/* This one is for the controller itself */
2323		if ((user_cmd->eataID[0] != 'E')
2324		 || (user_cmd->eataID[1] != 'A')
2325		 || (user_cmd->eataID[2] != 'T')
2326		 || (user_cmd->eataID[3] != 'A')) {
2327			return (ENXIO);
2328		}
2329	}
2330	/* Get a DPT CCB, so we can prepare a command */
2331
2332	/* Process the free list */
2333	if ((TAILQ_EMPTY(&dpt->free_ccbs)) && dpt_alloc_freelist(dpt)) {
2334		device_printf(dpt->dev,
2335		    "ERROR: Cannot allocate any more free CCB's.\n"
2336		    "             Please try later\n");
2337		return (EFAULT);
2338	}
2339	/* Now grab the newest CCB */
2340	if ((ccb = dpt_Qpop_free(dpt)) == NULL) {
2341		panic("%s: Got a NULL CCB from pop_free()\n",
2342		    device_get_nameunit(dpt->dev));
2343	} else {
2344		/* Clean up the leftover of the previous tenant */
2345		ccb->status = DPT_CCB_STATE_NEW;
2346	}
2347
2348	bcopy((caddr_t) & user_cmd->command_packet, (caddr_t) & ccb->eata_ccb,
2349	      sizeof(eata_ccb_t));
2350
2351	/* We do not want to do user specified scatter/gather.  Why?? */
2352	if (ccb->eata_ccb.scatter == 1)
2353		return (EINVAL);
2354
2355	ccb->eata_ccb.Auto_Req_Sen = 1;
2356	ccb->eata_ccb.reqlen = htonl(sizeof(struct scsi_sense_data));
2357	ccb->eata_ccb.cp_datalen = htonl(sizeof(ccb->eata_ccb.cp_datalen));
2358	ccb->eata_ccb.cp_dataDMA = htonl(vtophys(ccb->eata_ccb.cp_dataDMA));
2359	ccb->eata_ccb.cp_statDMA = htonl(vtophys(&ccb->eata_ccb.cp_statDMA));
2360	ccb->eata_ccb.cp_reqDMA = htonl(vtophys(&ccb->eata_ccb.cp_reqDMA));
2361	ccb->eata_ccb.cp_viraddr = (u_int32_t) & ccb;
2362
2363	if (ccb->eata_ccb.DataIn || ccb->eata_ccb.DataOut) {
2364		/* Data I/O is involved in this command.  Alocate buffer */
2365		if (ccb->eata_ccb.cp_datalen > PAGE_SIZE) {
2366			data = contigmalloc(ccb->eata_ccb.cp_datalen,
2367					    M_TEMP, M_WAITOK, 0, ~0,
2368					    ccb->eata_ccb.cp_datalen,
2369					    0x10000);
2370		} else {
2371			data = malloc(ccb->eata_ccb.cp_datalen, M_TEMP,
2372				      M_WAITOK);
2373		}
2374
2375		if (data == NULL) {
2376			device_printf(dpt->dev, "Cannot allocate %d bytes "
2377			       "for EATA command\n",
2378			       ccb->eata_ccb.cp_datalen);
2379			return (EFAULT);
2380		}
2381#define usr_cmd_DMA (caddr_t)user_cmd->command_packet.cp_dataDMA
2382		if (ccb->eata_ccb.DataIn == 1) {
2383			if (copyin(usr_cmd_DMA,
2384				   data, ccb->eata_ccb.cp_datalen) == -1)
2385				return (EFAULT);
2386		}
2387	} else {
2388		/* No data I/O involved here.  Make sure the DPT knows that */
2389		ccb->eata_ccb.cp_datalen = 0;
2390		data = NULL;
2391	}
2392
2393	if (ccb->eata_ccb.FWNEST == 1)
2394		ccb->eata_ccb.FWNEST = 0;
2395
2396	if (ccb->eata_ccb.cp_datalen != 0) {
2397		if (dpt_scatter_gather(dpt, ccb, ccb->eata_ccb.cp_datalen,
2398				       data) != 0) {
2399			if (data != NULL)
2400				free(data, M_TEMP);
2401			return (EFAULT);
2402		}
2403	}
2404	/**
2405	 * We are required to quiet a SCSI bus.
2406	 * since we do not queue comands on a bus basis,
2407	 * we wait for ALL commands on a controller to complete.
2408	 * In the mean time, sched_queue() will not schedule new commands.
2409	 */
2410	if ((ccb->eata_ccb.cp_cdb[0] == MULTIFUNCTION_CMD)
2411	    && (ccb->eata_ccb.cp_cdb[2] == BUS_QUIET)) {
2412		/* We wait for ALL traffic for this HBa to subside */
2413		dpt->state |= DPT_HA_QUIET;
2414
2415		while ((submitted = dpt->submitted_ccbs_count) != 0) {
2416			huh = mtx_sleep((void *) dpt, &dpt->lock,
2417			    PCATCH | PRIBIO, "dptqt", 100 * hz);
2418			switch (huh) {
2419			case 0:
2420				/* Wakeup call received */
2421				break;
2422			case EWOULDBLOCK:
2423				/* Timer Expired */
2424				break;
2425			default:
2426				/* anything else */
2427				break;
2428			}
2429		}
2430	}
2431	/* Resume normal operation */
2432	if ((ccb->eata_ccb.cp_cdb[0] == MULTIFUNCTION_CMD)
2433	    && (ccb->eata_ccb.cp_cdb[2] == BUS_UNQUIET)) {
2434		dpt->state &= ~DPT_HA_QUIET;
2435	}
2436	/**
2437	 * Schedule the command and submit it.
2438	 * We bypass dpt_sched_queue, as it will block on DPT_HA_QUIET
2439	 */
2440	ccb->xs = NULL;
2441	ccb->flags = 0;
2442	ccb->eata_ccb.Auto_Req_Sen = 1;	/* We always want this feature */
2443
2444	ccb->transaction_id = ++dpt->commands_processed;
2445	ccb->std_callback = (ccb_callback) dpt_user_cmd_done;
2446	ccb->result = (u_int32_t) & cmdarg;
2447	ccb->data = data;
2448
2449#ifdef DPT_MEASURE_PERFORMANCE
2450	++dpt->performance.command_count[ccb->eata_ccb.cp_scsi_cmd];
2451	ccb->command_started = microtime_now;
2452#endif
2453	dpt_Qadd_waiting(dpt, ccb);
2454
2455	dpt_sched_queue(dpt);
2456
2457	/* Wait for the command to complete */
2458	(void) mtx_sleep((void *) ccb, &dpt->lock, PCATCH | PRIBIO, "dptucw",
2459	    100 * hz);
2460
2461	/* Free allocated memory */
2462	if (data != NULL)
2463		free(data, M_TEMP);
2464
2465	return (0);
2466}
2467
2468static void
2469dpt_user_cmd_done(dpt_softc_t * dpt, int bus, dpt_ccb_t * ccb)
2470{
2471	u_int32_t       result;
2472	caddr_t         cmd_arg;
2473
2474	mtx_unlock(&dpt->lock);
2475
2476	/**
2477	 * If Auto Request Sense is on, copyout the sense struct
2478	 */
2479#define usr_pckt_DMA 	(caddr_t)(intptr_t)ntohl(ccb->eata_ccb.cp_reqDMA)
2480#define usr_pckt_len	ntohl(ccb->eata_ccb.cp_datalen)
2481	if (ccb->eata_ccb.Auto_Req_Sen == 1) {
2482		if (copyout((caddr_t) & ccb->sense_data, usr_pckt_DMA,
2483			    sizeof(struct scsi_sense_data))) {
2484			mtx_lock(&dpt->lock);
2485			ccb->result = EFAULT;
2486			dpt_Qpush_free(dpt, ccb);
2487			wakeup(ccb);
2488			return;
2489		}
2490	}
2491	/* If DataIn is on, copyout the data */
2492	if ((ccb->eata_ccb.DataIn == 1)
2493	    && (ccb->status_packet.hba_stat == HA_NO_ERROR)) {
2494		if (copyout(ccb->data, usr_pckt_DMA, usr_pckt_len)) {
2495			mtx_lock(&dpt->lock);
2496			dpt_Qpush_free(dpt, ccb);
2497			ccb->result = EFAULT;
2498
2499			wakeup(ccb);
2500			return;
2501		}
2502	}
2503	/* Copyout the status */
2504	result = ccb->status_packet.hba_stat;
2505	cmd_arg = (caddr_t) ccb->result;
2506
2507	if (copyout((caddr_t) & result, cmd_arg, sizeof(result))) {
2508		mtx_lock(&dpt->lock);
2509		dpt_Qpush_free(dpt, ccb);
2510		ccb->result = EFAULT;
2511		wakeup(ccb);
2512		return;
2513	}
2514	mtx_lock(&dpt->lock);
2515	/* Put the CCB back in the freelist */
2516	ccb->state |= DPT_CCB_STATE_COMPLETED;
2517	dpt_Qpush_free(dpt, ccb);
2518
2519	/* Free allocated memory */
2520	return;
2521}
2522
2523#endif
2524