xref: /netbsd-src/sys/dev/ic/aha.c (revision 8ac07aec990b9d2e483062509d0a9fa5b4f57cf2)
1 /*	$NetBSD: aha.c,v 1.56 2008/04/08 12:07:25 cegger Exp $	*/
2 
3 /*-
4  * Copyright (c) 1997, 1998 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Charles M. Hannum and by Jason R. Thorpe of the Numerical Aerospace
9  * Simulation Facility, NASA Ames Research Center.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  * 3. All advertising materials mentioning features or use of this software
20  *    must display the following acknowledgement:
21  *	This product includes software developed by the NetBSD
22  *	Foundation, Inc. and its contributors.
23  * 4. Neither the name of The NetBSD Foundation nor the names of its
24  *    contributors may be used to endorse or promote products derived
25  *    from this software without specific prior written permission.
26  *
27  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
28  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
29  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
30  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
31  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
32  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
33  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
34  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
35  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
36  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
37  * POSSIBILITY OF SUCH DAMAGE.
38  */
39 
40 /*
41  * Originally written by Julian Elischer (julian@tfs.com)
42  * for TRW Financial Systems for use under the MACH(2.5) operating system.
43  *
44  * TRW Financial Systems, in accordance with their agreement with Carnegie
45  * Mellon University, makes this software available to CMU to distribute
46  * or use in any manner that they see fit as long as this message is kept with
47  * the software. For this reason TFS also grants any other persons or
48  * organisations permission to use or modify this software.
49  *
50  * TFS supplies this software to be publicly redistributed
51  * on the understanding that TFS is not responsible for the correct
52  * functioning of this software in any circumstances.
53  */
54 
55 #include <sys/cdefs.h>
56 __KERNEL_RCSID(0, "$NetBSD: aha.c,v 1.56 2008/04/08 12:07:25 cegger Exp $");
57 
58 #include "opt_ddb.h"
59 
60 #undef AHADIAG
61 
62 #include <sys/param.h>
63 #include <sys/systm.h>
64 #include <sys/callout.h>
65 #include <sys/kernel.h>
66 #include <sys/errno.h>
67 #include <sys/ioctl.h>
68 #include <sys/device.h>
69 #include <sys/malloc.h>
70 #include <sys/buf.h>
71 #include <sys/proc.h>
72 #include <sys/user.h>
73 
74 #include <uvm/uvm_extern.h>
75 
76 #include <sys/bus.h>
77 #include <sys/intr.h>
78 
79 #include <dev/scsipi/scsi_all.h>
80 #include <dev/scsipi/scsipi_all.h>
81 #include <dev/scsipi/scsiconf.h>
82 
83 #include <dev/ic/ahareg.h>
84 #include <dev/ic/ahavar.h>
85 
86 #ifndef DDB
87 #define Debugger() panic("should call debugger here (aha1542.c)")
88 #endif /* ! DDB */
89 
90 #define	AHA_MAXXFER	((AHA_NSEG - 1) << PGSHIFT)
91 
92 #ifdef AHADEBUG
93 int	aha_debug = 1;
94 #endif /* AHADEBUG */
95 
96 static int	aha_cmd(bus_space_tag_t, bus_space_handle_t,
97 			struct aha_softc *, int, u_char *, int, u_char *);
98 static void	aha_finish_ccbs(struct aha_softc *);
99 static void	aha_free_ccb(struct aha_softc *, struct aha_ccb *);
100 static int	aha_init_ccb(struct aha_softc *, struct aha_ccb *);
101 static struct aha_ccb *aha_get_ccb(struct aha_softc *);
102 static struct aha_ccb *aha_ccb_phys_kv(struct aha_softc *, u_long);
103 static void	aha_queue_ccb(struct aha_softc *, struct aha_ccb *);
104 static void	aha_collect_mbo(struct aha_softc *);
105 static void	aha_start_ccbs(struct aha_softc *);
106 static void	aha_done(struct aha_softc *, struct aha_ccb *);
107 static int	aha_init(struct aha_softc *);
108 static void	aha_inquire_setup_information(struct aha_softc *);
109 static void	ahaminphys(struct buf *);
110 static void	aha_scsipi_request(struct scsipi_channel *,
111 				   scsipi_adapter_req_t, void *);
112 static int	aha_poll(struct aha_softc *, struct scsipi_xfer *, int);
113 static void	aha_timeout(void *arg);
114 static int	aha_create_ccbs(struct aha_softc *, struct aha_ccb *, int);
115 
116 #define AHA_RESET_TIMEOUT	2000	/* time to wait for reset (mSec) */
117 #define	AHA_ABORT_TIMEOUT	2000	/* time to wait for abort (mSec) */
118 
119 /*
120  * aha_cmd(iot, ioh, sc, icnt, ibuf, ocnt, obuf)
121  *
122  * Activate Adapter command
123  *    icnt:   number of args (outbound bytes including opcode)
124  *    ibuf:   argument buffer
125  *    ocnt:   number of expected returned bytes
126  *    obuf:   result buffer
127  *    wait:   number of seconds to wait for response
128  *
129  * Performs an adapter command through the ports.  Not to be confused with a
130  * scsi command, which is read in via the DMA; one of the adapter commands
131  * tells it to read in a scsi command.
132  */
133 static int
134 aha_cmd(bus_space_tag_t iot, bus_space_handle_t ioh, struct aha_softc *sc,
135     int icnt, u_char *ibuf, int ocnt, u_char *obuf)
136 {
137 	const char *name;
138 	int i;
139 	int wait;
140 	u_char sts;
141 	u_char opcode = ibuf[0];
142 
143 	if (sc != NULL)
144 		name = device_xname(&sc->sc_dev);
145 	else
146 		name = "(aha probe)";
147 
148 	/*
149 	 * Calculate a reasonable timeout for the command.
150 	 */
151 	switch (opcode) {
152 	case AHA_INQUIRE_DEVICES:
153 		wait = 90 * 20000;
154 		break;
155 	default:
156 		wait = 1 * 20000;
157 		break;
158 	}
159 
160 	/*
161 	 * Wait for the adapter to go idle, unless it's one of
162 	 * the commands which don't need this
163 	 */
164 	if (opcode != AHA_MBO_INTR_EN) {
165 		for (i = 20000; i; i--) {	/* 1 sec? */
166 			sts = bus_space_read_1(iot, ioh, AHA_STAT_PORT);
167 			if (sts & AHA_STAT_IDLE)
168 				break;
169 			delay(50);
170 		}
171 		if (!i) {
172 			printf("%s: aha_cmd, host not idle(0x%x)\n",
173 			    name, sts);
174 			return (1);
175 		}
176 	}
177 	/*
178 	 * Now that it is idle, if we expect output, preflush the
179 	 * queue feeding to us.
180 	 */
181 	if (ocnt) {
182 		while ((bus_space_read_1(iot, ioh, AHA_STAT_PORT)) & AHA_STAT_DF)
183 			bus_space_read_1(iot, ioh, AHA_DATA_PORT);
184 	}
185 	/*
186 	 * Output the command and the number of arguments given
187 	 * for each byte, first check the port is empty.
188 	 */
189 	while (icnt--) {
190 		for (i = wait; i; i--) {
191 			sts = bus_space_read_1(iot, ioh, AHA_STAT_PORT);
192 			if (!(sts & AHA_STAT_CDF))
193 				break;
194 			delay(50);
195 		}
196 		if (!i) {
197 			if (opcode != AHA_INQUIRE_REVISION)
198 				printf("%s: aha_cmd, cmd/data port full\n", name);
199 			bus_space_write_1(iot, ioh, AHA_CTRL_PORT, AHA_CTRL_SRST);
200 			return (1);
201 		}
202 		bus_space_write_1(iot, ioh, AHA_CMD_PORT, *ibuf++);
203 	}
204 	/*
205 	 * If we expect input, loop that many times, each time,
206 	 * looking for the data register to have valid data
207 	 */
208 	while (ocnt--) {
209 		for (i = wait; i; i--) {
210 			sts = bus_space_read_1(iot, ioh, AHA_STAT_PORT);
211 			if (sts & AHA_STAT_DF)
212 				break;
213 			delay(50);
214 		}
215 		if (!i) {
216 			if (opcode != AHA_INQUIRE_REVISION)
217 				printf("%s: aha_cmd, cmd/data port empty %d\n",
218 				    name, ocnt);
219 			bus_space_write_1(iot, ioh, AHA_CTRL_PORT, AHA_CTRL_SRST);
220 			return (1);
221 		}
222 		*obuf++ = bus_space_read_1(iot, ioh, AHA_DATA_PORT);
223 	}
224 	/*
225 	 * Wait for the board to report a finished instruction.
226 	 * We may get an extra interrupt for the HACC signal, but this is
227 	 * unimportant.
228 	 */
229 	if (opcode != AHA_MBO_INTR_EN) {
230 		for (i = 20000; i; i--) {	/* 1 sec? */
231 			sts = bus_space_read_1(iot, ioh, AHA_INTR_PORT);
232 			/* XXX Need to save this in the interrupt handler? */
233 			if (sts & AHA_INTR_HACC)
234 				break;
235 			delay(50);
236 		}
237 		if (!i) {
238 			printf("%s: aha_cmd, host not finished(0x%x)\n",
239 			    name, sts);
240 			return (1);
241 		}
242 	}
243 	bus_space_write_1(iot, ioh, AHA_CTRL_PORT, AHA_CTRL_IRST);
244 	return (0);
245 }
246 
247 void
248 aha_attach(sc, apd)
249 	struct aha_softc *sc;
250 	struct aha_probe_data *apd;
251 {
252 	struct scsipi_adapter *adapt = &sc->sc_adapter;
253 	struct scsipi_channel *chan = &sc->sc_channel;
254 
255 	TAILQ_INIT(&sc->sc_free_ccb);
256 	TAILQ_INIT(&sc->sc_waiting_ccb);
257 
258 	/*
259 	 * Fill in the scsipi_adapter.
260 	 */
261 	memset(adapt, 0, sizeof(*adapt));
262 	adapt->adapt_dev = &sc->sc_dev;
263 	adapt->adapt_nchannels = 1;
264 	/* adapt_openings initialized below */
265 	/* adapt_max_periph initialized below */
266 	adapt->adapt_request = aha_scsipi_request;
267 	adapt->adapt_minphys = ahaminphys;
268 
269 	/*
270 	 * Fill in the scsipi_channel.
271 	 */
272 	memset(chan, 0, sizeof(*chan));
273 	chan->chan_adapter = adapt;
274 	chan->chan_bustype = &scsi_bustype;
275 	chan->chan_channel = 0;
276 	chan->chan_ntargets = 8;
277 	chan->chan_nluns = 8;
278 	chan->chan_id = apd->sc_scsi_dev;
279 
280 	aha_inquire_setup_information(sc);
281 	if (aha_init(sc) != 0) {
282 		/* Error during initialization! */
283 		return;
284 	}
285 
286 	/*
287 	 * ask the adapter what subunits are present
288 	 */
289 	config_found(&sc->sc_dev, &sc->sc_channel, scsiprint);
290 }
291 
292 static void
293 aha_finish_ccbs(struct aha_softc *sc)
294 {
295 	struct aha_mbx_in *wmbi;
296 	struct aha_ccb *ccb;
297 	int i;
298 
299 	wmbi = wmbx->tmbi;
300 
301 	bus_dmamap_sync(sc->sc_dmat, sc->sc_dmamap_control,
302 	    AHA_MBI_OFF(wmbi), sizeof(struct aha_mbx_in),
303 	    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
304 
305 	if (wmbi->stat == AHA_MBI_FREE) {
306 		for (i = 0; i < AHA_MBX_SIZE; i++) {
307 			if (wmbi->stat != AHA_MBI_FREE) {
308 				printf("%s: mbi not in round-robin order\n",
309 				    device_xname(&sc->sc_dev));
310 				goto AGAIN;
311 			}
312 			aha_nextmbx(wmbi, wmbx, mbi);
313 			bus_dmamap_sync(sc->sc_dmat, sc->sc_dmamap_control,
314 			    AHA_MBI_OFF(wmbi), sizeof(struct aha_mbx_in),
315 			    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
316 		}
317 #ifdef AHADIAGnot
318 		printf("%s: mbi interrupt with no full mailboxes\n",
319 		    device_xname(&sc->sc_dev));
320 #endif
321 		return;
322 	}
323 
324 AGAIN:
325 	do {
326 		ccb = aha_ccb_phys_kv(sc, phystol(wmbi->ccb_addr));
327 		if (!ccb) {
328 			printf("%s: bad mbi ccb pointer; skipping\n",
329 			    device_xname(&sc->sc_dev));
330 			goto next;
331 		}
332 
333 		bus_dmamap_sync(sc->sc_dmat, sc->sc_dmamap_control,
334 		    AHA_CCB_OFF(ccb), sizeof(struct aha_ccb),
335 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
336 
337 #ifdef AHADEBUG
338 		if (aha_debug) {
339 			u_char *cp = ccb->scsi_cmd;
340 			printf("op=%x %x %x %x %x %x\n",
341 			    cp[0], cp[1], cp[2], cp[3], cp[4], cp[5]);
342 			printf("stat %x for mbi addr = %p, ",
343 			    wmbi->stat, wmbi);
344 			printf("ccb addr = %p\n", ccb);
345 		}
346 #endif /* AHADEBUG */
347 
348 		switch (wmbi->stat) {
349 		case AHA_MBI_OK:
350 		case AHA_MBI_ERROR:
351 			if ((ccb->flags & CCB_ABORT) != 0) {
352 				/*
353 				 * If we already started an abort, wait for it
354 				 * to complete before clearing the CCB.  We
355 				 * could instead just clear CCB_SENDING, but
356 				 * what if the mailbox was already received?
357 				 * The worst that happens here is that we clear
358 				 * the CCB a bit later than we need to.  BFD.
359 				 */
360 				goto next;
361 			}
362 			break;
363 
364 		case AHA_MBI_ABORT:
365 		case AHA_MBI_UNKNOWN:
366 			/*
367 			 * Even if the CCB wasn't found, we clear it anyway.
368 			 * See preceding comment.
369 			 */
370 			break;
371 
372 		default:
373 			printf("%s: bad mbi status %02x; skipping\n",
374 			    device_xname(&sc->sc_dev), wmbi->stat);
375 			goto next;
376 		}
377 
378 		callout_stop(&ccb->xs->xs_callout);
379 		aha_done(sc, ccb);
380 
381 	next:
382 		wmbi->stat = AHA_MBI_FREE;
383 		bus_dmamap_sync(sc->sc_dmat, sc->sc_dmamap_control,
384 		    AHA_MBI_OFF(wmbi), sizeof(struct aha_mbx_in),
385 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
386 		aha_nextmbx(wmbi, wmbx, mbi);
387 		bus_dmamap_sync(sc->sc_dmat, sc->sc_dmamap_control,
388 		    AHA_MBI_OFF(wmbi), sizeof(struct aha_mbx_in),
389 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
390 	} while (wmbi->stat != AHA_MBI_FREE);
391 
392 	wmbx->tmbi = wmbi;
393 }
394 
395 /*
396  * Catch an interrupt from the adaptor
397  */
398 int
399 aha_intr(arg)
400 	void *arg;
401 {
402 	struct aha_softc *sc = arg;
403 	bus_space_tag_t iot = sc->sc_iot;
404 	bus_space_handle_t ioh = sc->sc_ioh;
405 	u_char sts;
406 
407 #ifdef AHADEBUG
408 	printf("%s: aha_intr ", device_xname(&sc->sc_dev));
409 #endif /*AHADEBUG */
410 
411 	/*
412 	 * First acknowledge the interrupt, Then if it's not telling about
413 	 * a completed operation just return.
414 	 */
415 	sts = bus_space_read_1(iot, ioh, AHA_INTR_PORT);
416 	if ((sts & AHA_INTR_ANYINTR) == 0)
417 		return (0);
418 	bus_space_write_1(iot, ioh, AHA_CTRL_PORT, AHA_CTRL_IRST);
419 
420 #ifdef AHADIAG
421 	/* Make sure we clear CCB_SENDING before finishing a CCB. */
422 	aha_collect_mbo(sc);
423 #endif
424 
425 	/* Mail box out empty? */
426 	if (sts & AHA_INTR_MBOA) {
427 		struct aha_toggle toggle;
428 
429 		toggle.cmd.opcode = AHA_MBO_INTR_EN;
430 		toggle.cmd.enable = 0;
431 		aha_cmd(iot, ioh, sc,
432 		    sizeof(toggle.cmd), (u_char *)&toggle.cmd,
433 		    0, (u_char *)0);
434 		aha_start_ccbs(sc);
435 	}
436 
437 	/* Mail box in full? */
438 	if (sts & AHA_INTR_MBIF)
439 		aha_finish_ccbs(sc);
440 
441 	return (1);
442 }
443 
444 static inline void
445 aha_reset_ccb(struct aha_softc *sc, struct aha_ccb *ccb)
446 {
447 
448 	ccb->flags = 0;
449 }
450 
451 /*
452  * A ccb is put onto the free list.
453  */
454 static void
455 aha_free_ccb(struct aha_softc *sc, struct aha_ccb *ccb)
456 {
457 	int s;
458 
459 	s = splbio();
460 	aha_reset_ccb(sc, ccb);
461 	TAILQ_INSERT_HEAD(&sc->sc_free_ccb, ccb, chain);
462 	splx(s);
463 }
464 
465 static int
466 aha_init_ccb(struct aha_softc *sc, struct aha_ccb *ccb)
467 {
468 	bus_dma_tag_t dmat = sc->sc_dmat;
469 	int hashnum, error;
470 
471 	/*
472 	 * Create the DMA map for this CCB.
473 	 */
474 	error = bus_dmamap_create(dmat, AHA_MAXXFER, AHA_NSEG, AHA_MAXXFER,
475 	    0, BUS_DMA_NOWAIT|BUS_DMA_ALLOCNOW, &ccb->dmamap_xfer);
476 	if (error) {
477 		aprint_error_dev(&sc->sc_dev, "unable to create ccb DMA map, error = %d\n",
478 		    error);
479 		return (error);
480 	}
481 
482 	/*
483 	 * put in the phystokv hash table
484 	 * Never gets taken out.
485 	 */
486 	ccb->hashkey = sc->sc_dmamap_control->dm_segs[0].ds_addr +
487 	    AHA_CCB_OFF(ccb);
488 	hashnum = CCB_HASH(ccb->hashkey);
489 	ccb->nexthash = sc->sc_ccbhash[hashnum];
490 	sc->sc_ccbhash[hashnum] = ccb;
491 	aha_reset_ccb(sc, ccb);
492 	return (0);
493 }
494 
495 /*
496  * Create a set of ccbs and add them to the free list.  Called once
497  * by aha_init().  We return the number of CCBs successfully created.
498  */
499 static int
500 aha_create_ccbs(struct aha_softc *sc, struct aha_ccb *ccbstore, int count)
501 {
502 	struct aha_ccb *ccb;
503 	int i, error;
504 
505 	memset(ccbstore, 0, sizeof(struct aha_ccb) * count);
506 	for (i = 0; i < count; i++) {
507 		ccb = &ccbstore[i];
508 		if ((error = aha_init_ccb(sc, ccb)) != 0) {
509 			aprint_error_dev(&sc->sc_dev, "unable to initialize ccb, error = %d\n",
510 			    error);
511 			goto out;
512 		}
513 		TAILQ_INSERT_TAIL(&sc->sc_free_ccb, ccb, chain);
514 	}
515  out:
516 	return (i);
517 }
518 
519 /*
520  * Get a free ccb
521  *
522  * If there are none, see if we can allocate a new one.  If so, put it in
523  * the hash table too otherwise either return an error or sleep.
524  */
525 struct aha_ccb *
526 aha_get_ccb(struct aha_softc *sc)
527 {
528 	struct aha_ccb *ccb;
529 	int s;
530 
531 	s = splbio();
532 	ccb = TAILQ_FIRST(&sc->sc_free_ccb);
533 	if (ccb != NULL) {
534 		TAILQ_REMOVE(&sc->sc_free_ccb, ccb, chain);
535 		ccb->flags |= CCB_ALLOC;
536 	}
537 	splx(s);
538 	return (ccb);
539 }
540 
541 /*
542  * Given a physical address, find the ccb that it corresponds to.
543  */
544 static struct aha_ccb *
545 aha_ccb_phys_kv(struct aha_softc *sc, u_long ccb_phys)
546 {
547 	int hashnum = CCB_HASH(ccb_phys);
548 	struct aha_ccb *ccb = sc->sc_ccbhash[hashnum];
549 
550 	while (ccb) {
551 		if (ccb->hashkey == ccb_phys)
552 			break;
553 		ccb = ccb->nexthash;
554 	}
555 	return (ccb);
556 }
557 
558 /*
559  * Queue a CCB to be sent to the controller, and send it if possible.
560  */
561 static void
562 aha_queue_ccb(struct aha_softc *sc, struct aha_ccb *ccb)
563 {
564 
565 	TAILQ_INSERT_TAIL(&sc->sc_waiting_ccb, ccb, chain);
566 	aha_start_ccbs(sc);
567 }
568 
569 /*
570  * Garbage collect mailboxes that are no longer in use.
571  */
572 static void
573 aha_collect_mbo(struct aha_softc *sc)
574 {
575 	struct aha_mbx_out *wmbo;	/* Mail Box Out pointer */
576 #ifdef AHADIAG
577 	struct aha_ccb *ccb;
578 #endif
579 
580 	wmbo = wmbx->cmbo;
581 
582 	while (sc->sc_mbofull > 0) {
583 		bus_dmamap_sync(sc->sc_dmat, sc->sc_dmamap_control,
584 		    AHA_MBO_OFF(wmbo), sizeof(struct aha_mbx_out),
585 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
586 		if (wmbo->cmd != AHA_MBO_FREE)
587 			break;
588 
589 #ifdef AHADIAG
590 		ccb = aha_ccb_phys_kv(sc, phystol(wmbo->ccb_addr));
591 		ccb->flags &= ~CCB_SENDING;
592 #endif
593 
594 		--sc->sc_mbofull;
595 		aha_nextmbx(wmbo, wmbx, mbo);
596 	}
597 
598 	wmbx->cmbo = wmbo;
599 }
600 
601 /*
602  * Send as many CCBs as we have empty mailboxes for.
603  */
604 static void
605 aha_start_ccbs(struct aha_softc *sc)
606 {
607 	bus_space_tag_t iot = sc->sc_iot;
608 	bus_space_handle_t ioh = sc->sc_ioh;
609 	struct aha_mbx_out *wmbo;	/* Mail Box Out pointer */
610 	struct aha_ccb *ccb;
611 
612 	wmbo = wmbx->tmbo;
613 
614 	while ((ccb = sc->sc_waiting_ccb.tqh_first) != NULL) {
615 		if (sc->sc_mbofull >= AHA_MBX_SIZE) {
616 			aha_collect_mbo(sc);
617 			if (sc->sc_mbofull >= AHA_MBX_SIZE) {
618 				struct aha_toggle toggle;
619 
620 				toggle.cmd.opcode = AHA_MBO_INTR_EN;
621 				toggle.cmd.enable = 1;
622 				aha_cmd(iot, ioh, sc,
623 				    sizeof(toggle.cmd), (u_char *)&toggle.cmd,
624 				    0, (u_char *)0);
625 				break;
626 			}
627 		}
628 
629 		TAILQ_REMOVE(&sc->sc_waiting_ccb, ccb, chain);
630 #ifdef AHADIAG
631 		ccb->flags |= CCB_SENDING;
632 #endif
633 
634 		/* Link ccb to mbo. */
635 		ltophys(sc->sc_dmamap_control->dm_segs[0].ds_addr +
636 		    AHA_CCB_OFF(ccb), wmbo->ccb_addr);
637 		if (ccb->flags & CCB_ABORT)
638 			wmbo->cmd = AHA_MBO_ABORT;
639 		else
640 			wmbo->cmd = AHA_MBO_START;
641 
642 		 bus_dmamap_sync(sc->sc_dmat, sc->sc_dmamap_control,
643 		     AHA_MBO_OFF(wmbo), sizeof(struct aha_mbx_out),
644 		     BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
645 
646 		/* Tell the card to poll immediately. */
647 		bus_space_write_1(iot, ioh, AHA_CMD_PORT, AHA_START_SCSI);
648 
649 		if ((ccb->xs->xs_control & XS_CTL_POLL) == 0)
650 			callout_reset(&ccb->xs->xs_callout,
651 			    mstohz(ccb->timeout), aha_timeout, ccb);
652 
653 		++sc->sc_mbofull;
654 		aha_nextmbx(wmbo, wmbx, mbo);
655 	}
656 
657 	wmbx->tmbo = wmbo;
658 }
659 
660 /*
661  * We have a ccb which has been processed by the
662  * adaptor, now we look to see how the operation
663  * went. Wake up the owner if waiting
664  */
665 static void
666 aha_done(struct aha_softc *sc, struct aha_ccb *ccb)
667 {
668 	bus_dma_tag_t dmat = sc->sc_dmat;
669 	struct scsi_sense_data *s1, *s2;
670 	struct scsipi_xfer *xs = ccb->xs;
671 
672 	SC_DEBUG(xs->xs_periph, SCSIPI_DB2, ("aha_done\n"));
673 
674 	/*
675 	 * If we were a data transfer, unload the map that described
676 	 * the data buffer.
677 	 */
678 	if (xs->datalen) {
679 		bus_dmamap_sync(dmat, ccb->dmamap_xfer, 0,
680 		    ccb->dmamap_xfer->dm_mapsize,
681 		    (xs->xs_control & XS_CTL_DATA_IN) ? BUS_DMASYNC_POSTREAD :
682 		    BUS_DMASYNC_POSTWRITE);
683 		bus_dmamap_unload(dmat, ccb->dmamap_xfer);
684 	}
685 
686 	/*
687 	 * Otherwise, put the results of the operation
688 	 * into the xfer and call whoever started it
689 	 */
690 #ifdef AHADIAG
691 	if (ccb->flags & CCB_SENDING) {
692 		printf("%s: exiting ccb still in transit!\n", device_xname(&sc->sc_dev));
693 		Debugger();
694 		return;
695 	}
696 #endif
697 	if ((ccb->flags & CCB_ALLOC) == 0) {
698 		printf("%s: exiting ccb not allocated!\n", device_xname(&sc->sc_dev));
699 		Debugger();
700 		return;
701 	}
702 	if (xs->error == XS_NOERROR) {
703 		if (ccb->host_stat != AHA_OK) {
704 			switch (ccb->host_stat) {
705 			case AHA_SEL_TIMEOUT:	/* No response */
706 				xs->error = XS_SELTIMEOUT;
707 				break;
708 			default:	/* Other scsi protocol messes */
709 				printf("%s: host_stat %x\n",
710 				    device_xname(&sc->sc_dev), ccb->host_stat);
711 				xs->error = XS_DRIVER_STUFFUP;
712 				break;
713 			}
714 		} else if (ccb->target_stat != SCSI_OK) {
715 			switch (ccb->target_stat) {
716 			case SCSI_CHECK:
717 				s1 = (struct scsi_sense_data *) (((char *) (&ccb->scsi_cmd)) +
718 				    ccb->scsi_cmd_length);
719 				s2 = &xs->sense.scsi_sense;
720 				*s2 = *s1;
721 				xs->error = XS_SENSE;
722 				break;
723 			case SCSI_BUSY:
724 				xs->error = XS_BUSY;
725 				break;
726 			default:
727 				printf("%s: target_stat %x\n",
728 				    device_xname(&sc->sc_dev), ccb->target_stat);
729 				xs->error = XS_DRIVER_STUFFUP;
730 				break;
731 			}
732 		} else
733 			xs->resid = 0;
734 	}
735 	aha_free_ccb(sc, ccb);
736 	scsipi_done(xs);
737 }
738 
739 /*
740  * Find the board and find its irq/drq
741  */
742 int
743 aha_find(iot, ioh, sc)
744 	bus_space_tag_t iot;
745 	bus_space_handle_t ioh;
746 	struct aha_probe_data *sc;
747 {
748 	int i;
749 	u_char sts;
750 	struct aha_config config;
751 	int irq, drq;
752 
753 	/*
754 	 * assume invalid status means the board is not present.
755 	 */
756 
757 	sts = bus_space_read_1(iot, ioh, AHA_STAT_PORT);
758 	if (sts == 0)
759 		return (0);
760 	if ((sts & (AHA_STAT_STST|AHA_STAT_RSVD|AHA_STAT_CDF)) != 0)
761 		return (0);
762 	sts = bus_space_read_1(iot, ioh, AHA_INTR_PORT);
763 	if ((sts & AHA_INTR_RSVD) != 0)
764 		return (0);
765 
766 	/*
767 	 * reset board, If it doesn't respond, assume
768 	 * that it's not there.. good for the probe
769 	 */
770 
771 	bus_space_write_1(iot, ioh, AHA_CTRL_PORT, AHA_CTRL_HRST | AHA_CTRL_SRST);
772 
773 	delay(100);
774 	for (i = AHA_RESET_TIMEOUT; i; i--) {
775 		sts = bus_space_read_1(iot, ioh, AHA_STAT_PORT);
776 		if (sts == (AHA_STAT_IDLE | AHA_STAT_INIT))
777 			break;
778 		delay(1000);	/* calibrated in msec */
779 	}
780 	if (!i) {
781 #ifdef AHADEBUG
782 		if (aha_debug)
783 			printf("aha_find: No answer from adaptec board\n");
784 #endif /* AHADEBUG */
785 		return (0);
786 	}
787 
788 	/*
789 	 * setup DMA channel from jumpers and save int
790 	 * level
791 	 */
792 	delay(1000);		/* for Bustek 545 */
793 	config.cmd.opcode = AHA_INQUIRE_CONFIG;
794 	aha_cmd(iot, ioh, (struct aha_softc *)0,
795 	    sizeof(config.cmd), (u_char *)&config.cmd,
796 	    sizeof(config.reply), (u_char *)&config.reply);
797 	switch (config.reply.chan) {
798 	case EISADMA:
799 		drq = -1;
800 		break;
801 	case CHAN0:
802 		drq = 0;
803 		break;
804 	case CHAN5:
805 		drq = 5;
806 		break;
807 	case CHAN6:
808 		drq = 6;
809 		break;
810 	case CHAN7:
811 		drq = 7;
812 		break;
813 	default:
814 		printf("aha_find: illegal drq setting %x\n", config.reply.chan);
815 		return (0);
816 	}
817 
818 	switch (config.reply.intr) {
819 	case INT9:
820 		irq = 9;
821 		break;
822 	case INT10:
823 		irq = 10;
824 		break;
825 	case INT11:
826 		irq = 11;
827 		break;
828 	case INT12:
829 		irq = 12;
830 		break;
831 	case INT14:
832 		irq = 14;
833 		break;
834 	case INT15:
835 		irq = 15;
836 		break;
837 	default:
838 		printf("aha_find: illegal irq setting %x\n", config.reply.intr);
839 		return (0);
840 	}
841 
842 	if (sc) {
843 		sc->sc_irq = irq;
844 		sc->sc_drq = drq;
845 		sc->sc_scsi_dev = config.reply.scsi_dev;
846 	}
847 
848 	return (1);
849 }
850 
851 /*
852  * Start the board, ready for normal operation
853  */
854 static int
855 aha_init(struct aha_softc *sc)
856 {
857 	bus_space_tag_t iot = sc->sc_iot;
858 	bus_space_handle_t ioh = sc->sc_ioh;
859 	bus_dma_segment_t seg;
860 	struct aha_devices devices;
861 	struct aha_setup setup;
862 	struct aha_mailbox mailbox;
863 	int error, i, j, initial_ccbs, rseg;
864 
865 	/*
866 	 * XXX
867 	 * If we are a 1542C or later, disable the extended BIOS so that the
868 	 * mailbox interface is unlocked.
869 	 * No need to check the extended BIOS flags as some of the
870 	 * extensions that cause us problems are not flagged in that byte.
871 	 */
872 	if (!strncmp(sc->sc_model, "1542C", 5)) {
873 		struct aha_extbios extbios;
874 		struct aha_unlock unlock;
875 
876 		printf("%s: unlocking mailbox interface\n", device_xname(&sc->sc_dev));
877 		extbios.cmd.opcode = AHA_EXT_BIOS;
878 		aha_cmd(iot, ioh, sc,
879 		    sizeof(extbios.cmd), (u_char *)&extbios.cmd,
880 		    sizeof(extbios.reply), (u_char *)&extbios.reply);
881 
882 #ifdef AHADEBUG
883 		printf("%s: flags=%02x, mailboxlock=%02x\n",
884 		    device_xname(&sc->sc_dev),
885 		    extbios.reply.flags, extbios.reply.mailboxlock);
886 #endif /* AHADEBUG */
887 
888 		unlock.cmd.opcode = AHA_MBX_ENABLE;
889 		unlock.cmd.junk = 0;
890 		unlock.cmd.magic = extbios.reply.mailboxlock;
891 		aha_cmd(iot, ioh, sc,
892 		    sizeof(unlock.cmd), (u_char *)&unlock.cmd,
893 		    0, (u_char *)0);
894 	}
895 
896 #if 0
897 	/*
898 	 * Change the bus on/off times to not clash with other DMA users.
899 	 */
900 	aha_cmd(iot, ioh, 1, 0, 0, 0, AHA_BUS_ON_TIME_SET, 7);
901 	aha_cmd(iot, ioh, 1, 0, 0, 0, AHA_BUS_OFF_TIME_SET, 4);
902 #endif
903 
904 	/* Inquire Installed Devices (to force synchronous negotiation). */
905 	devices.cmd.opcode = AHA_INQUIRE_DEVICES;
906 	aha_cmd(iot, ioh, sc,
907 	    sizeof(devices.cmd), (u_char *)&devices.cmd,
908 	    sizeof(devices.reply), (u_char *)&devices.reply);
909 
910 	/* Count installed units */
911 	initial_ccbs = 0;
912 	for (i = 0; i < 8; i++) {
913 		for (j = 0; j < 8; j++) {
914 			if (((devices.reply.lun_map[i] >> j) & 1) == 1)
915 				initial_ccbs += 1;
916 		}
917 	}
918 	initial_ccbs *= 2;
919 	if (initial_ccbs > AHA_CCB_MAX)
920 		initial_ccbs = AHA_CCB_MAX;
921 	if (initial_ccbs == 0)	/* yes, this can happen */
922 		initial_ccbs = 2;
923 
924 	/* Obtain setup information from. */
925 	setup.cmd.opcode = AHA_INQUIRE_SETUP;
926 	setup.cmd.len = sizeof(setup.reply);
927 	aha_cmd(iot, ioh, sc,
928 	    sizeof(setup.cmd), (u_char *)&setup.cmd,
929 	    sizeof(setup.reply), (u_char *)&setup.reply);
930 
931 	printf("%s: %s, %s\n",
932 	    device_xname(&sc->sc_dev),
933 	    setup.reply.sync_neg ? "sync" : "async",
934 	    setup.reply.parity ? "parity" : "no parity");
935 
936 	for (i = 0; i < 8; i++) {
937 		if (!setup.reply.sync[i].valid ||
938 		    (!setup.reply.sync[i].offset && !setup.reply.sync[i].period))
939 			continue;
940 		printf("%s targ %d: sync, offset %d, period %dnsec\n",
941 		    device_xname(&sc->sc_dev), i,
942 		    setup.reply.sync[i].offset, setup.reply.sync[i].period * 50 + 200);
943 	}
944 
945 	/*
946 	 * Allocate the mailbox and control blocks.
947 	 */
948 	if ((error = bus_dmamem_alloc(sc->sc_dmat, sizeof(struct aha_control),
949 	    PAGE_SIZE, 0, &seg, 1, &rseg, BUS_DMA_NOWAIT)) != 0) {
950 		aprint_error_dev(&sc->sc_dev, "unable to allocate control structures, "
951 		    "error = %d\n", error);
952 		return (error);
953 	}
954 	if ((error = bus_dmamem_map(sc->sc_dmat, &seg, rseg,
955 	    sizeof(struct aha_control), (void **)&sc->sc_control,
956 	    BUS_DMA_NOWAIT|BUS_DMA_COHERENT)) != 0) {
957 		aprint_error_dev(&sc->sc_dev, "unable to map control structures, error = %d\n", error);
958 		return (error);
959 	}
960 
961 	/*
962 	 * Create and load the DMA map used for the mailbox and
963 	 * control blocks.
964 	 */
965 	if ((error = bus_dmamap_create(sc->sc_dmat, sizeof(struct aha_control),
966 	    1, sizeof(struct aha_control), 0, BUS_DMA_NOWAIT,
967 	    &sc->sc_dmamap_control)) != 0) {
968 		aprint_error_dev(&sc->sc_dev, "unable to create control DMA map, error = %d\n",
969 		    error);
970 		return (error);
971 	}
972 	if ((error = bus_dmamap_load(sc->sc_dmat, sc->sc_dmamap_control,
973 	    sc->sc_control, sizeof(struct aha_control), NULL,
974 	    BUS_DMA_NOWAIT)) != 0) {
975 		aprint_error_dev(&sc->sc_dev, "unable to load control DMA map, error = %d\n",
976 		    error);
977 		return (error);
978 	}
979 
980 	/*
981 	 * Initialize the control blocks.
982 	 */
983 	i = aha_create_ccbs(sc, sc->sc_control->ac_ccbs, initial_ccbs);
984 	if (i == 0) {
985 		aprint_error_dev(&sc->sc_dev, "unable to create control blocks\n");
986 		return (ENOMEM);
987 	} else if (i != initial_ccbs) {
988 		printf("%s: WARNING: only %d of %d control blocks created\n",
989 		    device_xname(&sc->sc_dev), i, initial_ccbs);
990 	}
991 
992 	sc->sc_adapter.adapt_openings = i;
993 	sc->sc_adapter.adapt_max_periph = sc->sc_adapter.adapt_openings;
994 
995 	/*
996 	 * Set up initial mail box for round-robin operation.
997 	 */
998 	for (i = 0; i < AHA_MBX_SIZE; i++) {
999 		wmbx->mbo[i].cmd = AHA_MBO_FREE;
1000 		bus_dmamap_sync(sc->sc_dmat, sc->sc_dmamap_control,
1001 		    AHA_MBO_OFF(&wmbx->mbo[i]), sizeof(struct aha_mbx_out),
1002 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1003 		wmbx->mbi[i].stat = AHA_MBI_FREE;
1004 		bus_dmamap_sync(sc->sc_dmat, sc->sc_dmamap_control,
1005 		    AHA_MBI_OFF(&wmbx->mbi[i]), sizeof(struct aha_mbx_in),
1006 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1007 	}
1008 	wmbx->cmbo = wmbx->tmbo = &wmbx->mbo[0];
1009 	wmbx->tmbi = &wmbx->mbi[0];
1010 	sc->sc_mbofull = 0;
1011 
1012 	/* Initialize mail box. */
1013 	mailbox.cmd.opcode = AHA_MBX_INIT;
1014 	mailbox.cmd.nmbx = AHA_MBX_SIZE;
1015 	ltophys(sc->sc_dmamap_control->dm_segs[0].ds_addr +
1016 	    offsetof(struct aha_control, ac_mbx), mailbox.cmd.addr);
1017 	aha_cmd(iot, ioh, sc,
1018 	    sizeof(mailbox.cmd), (u_char *)&mailbox.cmd,
1019 	    0, (u_char *)0);
1020 	return (0);
1021 }
1022 
1023 static void
1024 aha_inquire_setup_information(struct aha_softc *sc)
1025 {
1026 	bus_space_tag_t iot = sc->sc_iot;
1027 	bus_space_handle_t ioh = sc->sc_ioh;
1028 	struct aha_revision revision;
1029 	u_char sts;
1030 	int i;
1031 	char *p;
1032 
1033 	strcpy(sc->sc_model, "unknown");
1034 
1035 	/*
1036 	 * Assume we have a board at this stage, do an adapter inquire
1037 	 * to find out what type of controller it is.  If the command
1038 	 * fails, we assume it's either a crusty board or an old 1542
1039 	 * clone, and skip the board-specific stuff.
1040 	 */
1041 	revision.cmd.opcode = AHA_INQUIRE_REVISION;
1042 	if (aha_cmd(iot, ioh, sc,
1043 	    sizeof(revision.cmd), (u_char *)&revision.cmd,
1044 	    sizeof(revision.reply), (u_char *)&revision.reply)) {
1045 		/*
1046 		 * aha_cmd() already started the reset.  It's not clear we
1047 		 * even need to bother here.
1048 		 */
1049 		for (i = AHA_RESET_TIMEOUT; i; i--) {
1050 			sts = bus_space_read_1(iot, ioh, AHA_STAT_PORT);
1051 			if (sts == (AHA_STAT_IDLE | AHA_STAT_INIT))
1052 				break;
1053 			delay(1000);
1054 		}
1055 		if (!i) {
1056 #ifdef AHADEBUG
1057 			printf("aha_init: soft reset failed\n");
1058 #endif /* AHADEBUG */
1059 			return;
1060 		}
1061 #ifdef AHADEBUG
1062 		printf("aha_init: inquire command failed\n");
1063 #endif /* AHADEBUG */
1064 		goto noinquire;
1065 	}
1066 
1067 #ifdef AHADEBUG
1068 	printf("%s: inquire %x, %x, %x, %x\n",
1069 	    device_xname(&sc->sc_dev),
1070 	    revision.reply.boardid, revision.reply.spec_opts,
1071 	    revision.reply.revision_1, revision.reply.revision_2);
1072 #endif /* AHADEBUG */
1073 
1074 	switch (revision.reply.boardid) {
1075 	case BOARD_1540_16HEAD_BIOS:
1076 	case BOARD_1540_64HEAD_BIOS:
1077 	case BOARD_1540:
1078 		strcpy(sc->sc_model, "1540");
1079 		break;
1080 	case BOARD_1542:
1081 		strcpy(sc->sc_model, "1540A/1542A/1542B");
1082 		break;
1083 	case BOARD_1640:
1084 		strcpy(sc->sc_model, "1640");
1085 		break;
1086 	case BOARD_1740:
1087 		strcpy(sc->sc_model, "1740");
1088 		break;
1089 	case BOARD_1542C:
1090 		strcpy(sc->sc_model, "1542C");
1091 		break;
1092 	case BOARD_1542CF:
1093 		strcpy(sc->sc_model, "1542CF");
1094 		break;
1095 	case BOARD_1542CP:
1096 		strcpy(sc->sc_model, "1542CP");
1097 		break;
1098 	}
1099 
1100 	p = sc->sc_firmware;
1101 	*p++ = revision.reply.revision_1;
1102 	*p++ = '.';
1103 	*p++ = revision.reply.revision_2;
1104 	*p = '\0';
1105 
1106 noinquire:
1107 	printf("%s: model AHA-%s, firmware %s\n",
1108 	       device_xname(&sc->sc_dev),
1109 	       sc->sc_model, sc->sc_firmware);
1110 }
1111 
1112 static void
1113 ahaminphys(struct buf *bp)
1114 {
1115 
1116 	if (bp->b_bcount > AHA_MAXXFER)
1117 		bp->b_bcount = AHA_MAXXFER;
1118 	minphys(bp);
1119 }
1120 
1121 /*
1122  * start a scsi operation given the command and the data address. Also needs
1123  * the unit, target and lu.
1124  */
1125 
1126 static void
1127 aha_scsipi_request(struct scsipi_channel *chan, scsipi_adapter_req_t req,
1128     void *arg)
1129 {
1130 	struct scsipi_xfer *xs;
1131 	struct scsipi_periph *periph;
1132 	struct aha_softc *sc = (void *)chan->chan_adapter->adapt_dev;
1133 	bus_dma_tag_t dmat = sc->sc_dmat;
1134 	struct aha_ccb *ccb;
1135 	int error, seg, flags, s;
1136 
1137 
1138 	switch (req) {
1139 	case ADAPTER_REQ_RUN_XFER:
1140 		xs = arg;
1141 		periph = xs->xs_periph;
1142 		flags = xs->xs_control;
1143 
1144 		SC_DEBUG(periph, SCSIPI_DB2, ("aha_scsipi_request\n"));
1145 
1146 		/* Get a CCB to use. */
1147 		ccb = aha_get_ccb(sc);
1148 #ifdef DIAGNOSTIC
1149 		/*
1150 		 * This should never happen as we track the resources
1151 		 * in the mid-layer.
1152 		 */
1153 		if (ccb == NULL) {
1154 			scsipi_printaddr(periph);
1155 			printf("unable to allocate ccb\n");
1156 			panic("aha_scsipi_request");
1157 		}
1158 #endif
1159 
1160 		ccb->xs = xs;
1161 		ccb->timeout = xs->timeout;
1162 
1163 		/*
1164 		 * Put all the arguments for the xfer in the ccb
1165 		 */
1166 		if (flags & XS_CTL_RESET) {
1167 			ccb->opcode = AHA_RESET_CCB;
1168 			ccb->scsi_cmd_length = 0;
1169 		} else {
1170 			/* can't use S/G if zero length */
1171 			if (xs->cmdlen > sizeof(ccb->scsi_cmd)) {
1172 				printf("%s: cmdlen %d too large for CCB\n",
1173 				    device_xname(&sc->sc_dev), xs->cmdlen);
1174 				xs->error = XS_DRIVER_STUFFUP;
1175 				goto out_bad;
1176 			}
1177 			ccb->opcode = (xs->datalen ? AHA_INIT_SCAT_GATH_CCB
1178 						   : AHA_INITIATOR_CCB);
1179 			memcpy(&ccb->scsi_cmd, xs->cmd,
1180 			    ccb->scsi_cmd_length = xs->cmdlen);
1181 		}
1182 
1183 		if (xs->datalen) {
1184 			/*
1185 			 * Map the DMA transfer.
1186 			 */
1187 #ifdef TFS
1188 			if (flags & XS_CTL_DATA_UIO) {
1189 				error = bus_dmamap_load_uio(dmat,
1190 				    ccb->dmamap_xfer, (struct uio *)xs->data,
1191 				    ((flags & XS_CTL_NOSLEEP) ? BUS_DMA_NOWAIT :
1192 				     BUS_DMA_WAITOK) | BUS_DMA_STREAMING |
1193 				     ((flags & XS_CTL_DATA_IN) ? BUS_DMA_READ :
1194 				      BUS_DMA_WRITE));
1195 			} else
1196 #endif
1197 			{
1198 				error = bus_dmamap_load(dmat,
1199 				    ccb->dmamap_xfer, xs->data, xs->datalen,
1200 				    NULL,
1201 				    ((flags & XS_CTL_NOSLEEP) ? BUS_DMA_NOWAIT :
1202 				     BUS_DMA_WAITOK) | BUS_DMA_STREAMING |
1203 				     ((flags & XS_CTL_DATA_IN) ? BUS_DMA_READ :
1204 				      BUS_DMA_WRITE));
1205 			}
1206 
1207 			switch (error) {
1208 			case 0:
1209 				break;
1210 
1211 			case ENOMEM:
1212 			case EAGAIN:
1213 				xs->error = XS_RESOURCE_SHORTAGE;
1214 				goto out_bad;
1215 
1216 			default:
1217 				xs->error = XS_DRIVER_STUFFUP;
1218 				if (error == EFBIG) {
1219 					printf("%s: aha_scsi_cmd, more than %d"
1220 					    " DMA segments\n",
1221 					    device_xname(&sc->sc_dev), AHA_NSEG);
1222 				} else {
1223 					aprint_error_dev(&sc->sc_dev, "error %d loading DMA map\n",
1224 					    error);
1225 				}
1226 out_bad:
1227 				aha_free_ccb(sc, ccb);
1228 				scsipi_done(xs);
1229 				return;
1230 			}
1231 
1232 			bus_dmamap_sync(dmat, ccb->dmamap_xfer, 0,
1233 			    ccb->dmamap_xfer->dm_mapsize,
1234 			    (flags & XS_CTL_DATA_IN) ? BUS_DMASYNC_PREREAD :
1235 			    BUS_DMASYNC_PREWRITE);
1236 
1237 			/*
1238 			 * Load the hardware scatter/gather map with the
1239 			 * contents of the DMA map.
1240 			 */
1241 			for (seg = 0; seg < ccb->dmamap_xfer->dm_nsegs; seg++) {
1242 				ltophys(ccb->dmamap_xfer->dm_segs[seg].ds_addr,
1243 				    ccb->scat_gath[seg].seg_addr);
1244 				ltophys(ccb->dmamap_xfer->dm_segs[seg].ds_len,
1245 				    ccb->scat_gath[seg].seg_len);
1246 			}
1247 
1248 			ltophys(sc->sc_dmamap_control->dm_segs[0].ds_addr +
1249 			    AHA_CCB_OFF(ccb) +
1250 			    offsetof(struct aha_ccb, scat_gath),
1251 			    ccb->data_addr);
1252 			ltophys(ccb->dmamap_xfer->dm_nsegs *
1253 			    sizeof(struct aha_scat_gath), ccb->data_length);
1254 		} else {
1255 			/*
1256 			 * No data xfer, use non S/G values.
1257 			 */
1258 			ltophys(0, ccb->data_addr);
1259 			ltophys(0, ccb->data_length);
1260 		}
1261 
1262 		ccb->data_out = 0;
1263 		ccb->data_in = 0;
1264 		ccb->target = periph->periph_target;
1265 		ccb->lun = periph->periph_lun;
1266 		ccb->req_sense_length = sizeof(ccb->scsi_sense);
1267 		ccb->host_stat = 0x00;
1268 		ccb->target_stat = 0x00;
1269 		ccb->link_id = 0;
1270 		ltophys(0, ccb->link_addr);
1271 
1272 		bus_dmamap_sync(sc->sc_dmat, sc->sc_dmamap_control,
1273 		    AHA_CCB_OFF(ccb), sizeof(struct aha_ccb),
1274 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
1275 
1276 		s = splbio();
1277 		aha_queue_ccb(sc, ccb);
1278 		splx(s);
1279 
1280 		SC_DEBUG(periph, SCSIPI_DB3, ("cmd_sent\n"));
1281 		if ((flags & XS_CTL_POLL) == 0)
1282 			return;
1283 
1284 		/* Not allowed to use interrupts, poll for completion. */
1285 		if (aha_poll(sc, xs, ccb->timeout)) {
1286 			aha_timeout(ccb);
1287 			if (aha_poll(sc, xs, ccb->timeout))
1288 				aha_timeout(ccb);
1289 		}
1290 		return;
1291 
1292 	case ADAPTER_REQ_GROW_RESOURCES:
1293 		/* XXX Not supported. */
1294 		return;
1295 
1296 	case ADAPTER_REQ_SET_XFER_MODE:
1297 		/*
1298 		 * Can't really do this on the Adaptec; it has
1299 		 * its own config mechanism, but we do know how
1300 		 * to query what the firmware negotiated.
1301 		 */
1302 		/* XXX XXX XXX */
1303 		return;
1304 	}
1305 }
1306 
1307 /*
1308  * Poll a particular unit, looking for a particular xs
1309  */
1310 static int
1311 aha_poll(struct aha_softc *sc, struct scsipi_xfer *xs, int count)
1312 {
1313 	bus_space_tag_t iot = sc->sc_iot;
1314 	bus_space_handle_t ioh = sc->sc_ioh;
1315 
1316 	/* timeouts are in msec, so we loop in 1000 usec cycles */
1317 	while (count) {
1318 		/*
1319 		 * If we had interrupts enabled, would we
1320 		 * have got an interrupt?
1321 		 */
1322 		if (bus_space_read_1(iot, ioh, AHA_INTR_PORT) & AHA_INTR_ANYINTR)
1323 			aha_intr(sc);
1324 		if (xs->xs_status & XS_STS_DONE)
1325 			return (0);
1326 		delay(1000);	/* only happens in boot so ok */
1327 		count--;
1328 	}
1329 	return (1);
1330 }
1331 
1332 static void
1333 aha_timeout(void *arg)
1334 {
1335 	struct aha_ccb *ccb = arg;
1336 	struct scsipi_xfer *xs = ccb->xs;
1337 	struct scsipi_periph *periph = xs->xs_periph;
1338 	struct aha_softc *sc =
1339 	    (void *)periph->periph_channel->chan_adapter->adapt_dev;
1340 	int s;
1341 
1342 	scsipi_printaddr(periph);
1343 	printf("timed out");
1344 
1345 	s = splbio();
1346 
1347 #ifdef AHADIAG
1348 	/*
1349 	 * If The ccb's mbx is not free, then the board has gone south?
1350 	 */
1351 	aha_collect_mbo(sc);
1352 	if (ccb->flags & CCB_SENDING) {
1353 		aprint_error_dev(&sc->sc_dev, "not taking commands!\n");
1354 		Debugger();
1355 	}
1356 #endif
1357 
1358 	/*
1359 	 * If it has been through before, then
1360 	 * a previous abort has failed, don't
1361 	 * try abort again
1362 	 */
1363 	if (ccb->flags & CCB_ABORT) {
1364 		/* abort timed out */
1365 		printf(" AGAIN\n");
1366 		/* XXX Must reset! */
1367 	} else {
1368 		/* abort the operation that has timed out */
1369 		printf("\n");
1370 		ccb->xs->error = XS_TIMEOUT;
1371 		ccb->timeout = AHA_ABORT_TIMEOUT;
1372 		ccb->flags |= CCB_ABORT;
1373 		aha_queue_ccb(sc, ccb);
1374 	}
1375 
1376 	splx(s);
1377 }
1378