/*
 * u64.c
 *
 * device driver for Ultra64 development system.
 *
 * Copyright 1995, Silicon Graphics, Inc.
 * All Rights Reserved.
 *
 * This is UNPUBLISHED PROPRIETARY SOURCE CODE of Silicon Graphics, Inc.;
 * the contents of this file may not be disclosed to third parties, copied or
 * duplicated in any form, in whole or in part, without the prior written
 * permission of Silicon Graphics, Inc.
 *
 * RESTRICTED RIGHTS LEGEND:
 * Use, duplication or disclosure by the Government is subject to restrictions
 * as set forth in subdivision (c)(1)(ii) of the Rights in Technical Data
 * and Computer Software clause at DFARS 252.227-7013, and/or in similar or
 * successor clauses in the FAR, DOD or NASA FAR Supplement. Unpublished -
 * rights reserved under the Copyright Laws of the United States.
 */


#ident "$Revision: 1.1.1.1 $"

#include "stdio.h"
#include "sys/types.h"
#include "sys/ddi.h"
#include "sys/proc.h"
#include "sys/region.h"
#include "sys/poll.h"
#include "sys/edt.h"
#include "sys/invent.h"
#include "sys/param.h"
#include "sys/cmn_err.h"
#include "sys/immu.h"
#include "sys/kmem.h"
#include "sys/ddi.h"
#include "sys/conf.h"
#include "sys/IP22.h"
#include "sys/termios.h"

#include "sys/errno.h"
#include "sys/major.h"
#include "sys/u64gio.h"
#include "sys/u64driver.h"

#include "PR/ramrom.h"
#include "PR/rdb.h"
#include "PR/ultratypes.h"

#ifndef U64_MAJOR
#define U64_MAJOR 255
#endif


/*
 * Instruct lboot & kernel to use the new style of device driver interface
 * by setting the <prefix>devflag global variable to zero.
 */
int u64_devflag = 0;


/*
 * There will be at most one Ultra64 development board per system, so just
 * declare these as static globals within this driver module.
 */
static struct u64_data          *bdata;

/*
 * Forward declarations  Should these be extern??? They are in this file, and
 * aren't called elsewhere. Shouldn't they be static?
 */
extern int u64_write_ramrom(unsigned int *userbuf, unsigned int *ramrom_offset, 
  int nbytes);

extern int u64_read_ramrom(unsigned int *ramrom_offset, unsigned int *userbuf, 
  int nbytes);


static int u64_internal_write(u64_minor *m, int count, int rdbtype);
static int u64_send_message(unsigned int rdbType, int value);
static void handleMinorData(u64_minor *m, unsigned int inData, int minor);

#define ONE_MEG         0x100000
#define ONE_MEG_SHIFT   20


/*
 * a table indicating how big the minor's buffers are
 */
int minor_recv_buf_sizes[NUMBER_MINORS] = {
    0,                   /* don't use first minor, so don't need a buffer for it */
    U64_MINOR_PRINT_BUF_SIZE,
    U64_MINOR_DEBUG_BUF_SIZE,
    U64_MINOR_LOGGING_BUF_SIZE,
    U64_MINOR_DATA_BUF_SIZE,
    U64_MINOR_FAULT_BUF_SIZE,
    U64_MINOR_KDEBUG_BUF_SIZE,
    U64_MINOR_PROFILE_BUF_SIZE
};
    
int minor_send_buf_sizes[NUMBER_MINORS] = {
    0,                   /* don't use first minor, so don't need a buffer for it */
    0,                   /* printf doesn't send data */
    U64_MINOR_DEBUG_BUF_SIZE,
    0,                   /* logging doesn't send data */
    U64_MINOR_DATA_BUF_SIZE,
    0,                   /* fault doesn't send data */
    U64_MINOR_KDEBUG_BUF_SIZE,
    U64_MINOR_PROFILE_SEND_BUF_SIZE
};
    

/* Handle_RDB_Incoming   Parses out any packets sent by the game to the host.
 * Packets are 32 bit long. The high byte is a composed of six bits type, and 
 * two bits of length. The remaining 3 bytes are available for data.
 *
 * Currently uses a switch statement, might be made faster by using a jump 
 * table. Most packets are either messages or data. Messages are handled 
 * here, but data is sent to handleMinorData() which will copy the data into
 * the appropriate buffer.
 *
 * This routine is only called from within the interrupt handler.
 */
static void Handle_RDB_Incoming(unsigned int inData)
{
    rdbPacket    *rdbData = (rdbPacket*)&inData;

    switch (rdbData->type) 
    {
        case RDB_TYPE_GtoH_PRINT: /* data from an osSyncPrintf */
	    handleMinorData(&bdata->minors[U64_MINOR_PRINT],inData,U64_MINOR_PRINT);
	    break;
        case RDB_TYPE_GtoH_FAULT: /* data from a fault */
	    handleMinorData(&bdata->minors[U64_MINOR_FAULT],inData,U64_MINOR_FAULT);
            break;
	case RDB_TYPE_GtoH_LOG_CT: /* message, saying how much log data is coming */
	    bdata->minors[U64_MINOR_LOGGING].incoming_ct = inData &0xFFFFFF;
	    bdata->minors[U64_MINOR_LOGGING].message = RDB_TYPE_HtoG_LOG_DONE;
	    break;
        case RDB_TYPE_GtoH_LOG: /* logging data */
	    handleMinorData(&bdata->minors[U64_MINOR_LOGGING],inData,U64_MINOR_LOGGING);
            break;
	case RDB_TYPE_GtoH_READY_FOR_DATA:  /* message, letting you know game is ready for data */
            /* only allow data_sema to get to a value of one */
	    if(valusema(&bdata->minors[U64_MINOR_DATA].write_sema) < 1)
		vsema(&bdata->minors[U64_MINOR_DATA].write_sema);
	    break;
	case RDB_TYPE_GtoH_DATA_CT: /* message, letting you know how much data is coming */
	    bdata->minors[U64_MINOR_DATA].incoming_ct = inData &0xFFFFFF;
	    bdata->minors[U64_MINOR_DATA].message = RDB_TYPE_HtoG_DATA_DONE;
	    break;
        case RDB_TYPE_GtoH_DATA: /* hostio data from game */
	    handleMinorData(&bdata->minors[U64_MINOR_DATA],inData,U64_MINOR_DATA);
            break;
        case RDB_TYPE_GtoH_DEBUG:
	    handleMinorData(&bdata->minors[U64_MINOR_DEBUG],inData,U64_MINOR_DEBUG);
            break;
	case RDB_TYPE_GtoH_RAMROM: /* message letting you know, host now has ramrom access */
	    vsema(&bdata->ramrom_sema);
	    break;
	case RDB_TYPE_GtoH_DEBUG_DONE:  /* message, letting you know debug data send is done */
            /* only allow read_sema to get to a value of one */
	    if(valusema(&bdata->minors[U64_MINOR_DEBUG].read_sema) < 1)
		vsema(&bdata->minors[U64_MINOR_DEBUG].read_sema);
	    break;
	case RDB_TYPE_GtoH_DEBUG_READY: /* message indicating rmon has handled message, ready for next */
            /* only allow debug write_sema to get to a value of one */
	    if(valusema(&bdata->minors[U64_MINOR_DEBUG].write_sema) < 1)
		vsema(&bdata->minors[U64_MINOR_DEBUG].write_sema);
	    break;
	case RDB_TYPE_GtoH_KDEBUG:
	    handleMinorData(&bdata->minors[U64_MINOR_KDEBUG],inData,U64_MINOR_KDEBUG);
	    break;
	case RDB_TYPE_GtoH_PROF_DATA:
	    handleMinorData(&bdata->minors[U64_MINOR_PROFILE],inData,U64_MINOR_PROFILE);
	    break;
        default:
            /* unknown type */
            cmn_err(CE_WARN, "u64: RDB_TYPE_UNKNOWN %x", inData);
            break;
    }
}

/* handleMinorData
 * Copy the data from the packet into the kernel buffer and wakeup any sleeping
 * process waiting for data. This routine is only called from within the interrupt handler
 */
static void handleMinorData(u64_minor *m, unsigned int inData, int minor)
{
    rdbPacket    *rdbData = (rdbPacket*)&inData;
    int          length = rdbData->length;
    int          count;

    if (valusema(&m->minor_sema) < 1) /* if there is a client waiting to read */
    {
	if(length + m->read_count <= m->read_buf_size) 
	{
	    /* buffer is not full yet */
	    count = 0;
	    while(length)
	    {
		m->read_buf[m->read_cur_write++] = rdbData->buf[count++];
		m->read_count++;
		if(m->read_cur_write >= m->read_buf_size)
		    m->read_cur_write = 0;
		length--;
	    }
	}
	else
	    cmn_err(CE_WARN,"u64:Overflow of minor %d buffer, data_count %d, length %d",
			    minor, m->read_count,length);
	pollwakeup(m->phead, POLLIN | POLLRDNORM);
	cvsema(&m->read_sema);
    }
}

/* send_write_buffer
 * Send data to the game. This gets called, whenever the game has read a packet.
 * At that time, it is ok to send the next packet, so do so. If there are no more
 * packets waiting, release the bdata->write_buf_sema, so the next block of data
 * can be copied into the write buffer, and the whole thing started again.
 * This routine is only called from within the interrupt handler
 */
static void send_write_buffer(void)
{
    unsigned int *pPkt;

    if (bdata->write_buf_ct == 0) /* no more data to send */
    {
	if(valusema(&bdata->write_buf_sema) < 1)
	    vsema(&bdata->write_buf_sema);
    }
    else  /* send next pkt */
    {
	pPkt = &bdata->write_buf[bdata->write_buf_cur_read];
        *(vu32*)GIO_RDB_BASE_REG = *pPkt;
	bdata->write_buf_cur_read++;
	if(bdata->write_buf_cur_read >= bdata->write_buf_size)
	    bdata->write_buf_cur_read = 0;
	bdata->write_buf_ct--;
    }
}

/*
 * GIO interrupt service routine.  Read the interrupt register to clear the
 * interrupt; Check the GIO_RDB interrupt bits, and if they are set then service
 * the rdb interrupt. If it is not an rdb interrupt, it is an error. We don't 
 * support the old ramrom gio interrupts any more!
 */
void u64_giointr(int unit) 
{
    int intr_val;
    unsigned id_reg; 

    id_reg = bdata->board->product_id_reg;
    
    if (id_reg & GIO_RDB_READ_INTR_BIT) /* Ultra64 has read the RDB port */
    {
        *((vu32 *) GIO_RDB_READ_INTR_REG) = 0;
        send_write_buffer();
        return;
    } 
    if (id_reg & GIO_RDB_WRITE_INTR_BIT) /* Ultra64 has written to the RDB port */
    {
        *((vu32 *) GIO_RDB_WRITE_INTR_REG) = 0;  /* clear the interrupt condition */
        Handle_RDB_Incoming(*((unsigned int *)GIO_RDB_BASE_REG));
        return;
    }

/**** DID NOT USE THE RDB PORT !!! ****/

    intr_val = (bdata->board->gio_interrupt & _U64_REGMASK);
    cmn_err(CE_WARN,"u64_giointr: None RDB interrupt %d\n",intr_val);
}


/*
 * Initialize interrupts and gio configuration
 *
 * possible gio flags:  ('n' in the GIO64 args below is 0 or 1)
 *
 * GIO64_ARB_EXPn_RT      - real-time device (otherwise burst device)
 * GIO64_ARB_EXPn_MST     - device can become bus master
 * GIO64_ARB_EXPn_SIZE_64 - bus transfers are 64 bits (not us!)
 * GIO64_ARB_EXPn_PIPED   - pipelined bus interface registers (again, not us!)
 */
int
u64_init_interrupts(int controller, caddr_t base)
{
    int slot, intr, conf;

    if (base == (caddr_t) 0xbf400000) {
        slot = GIO_SLOT_0;
        intr = GIO_INTERRUPT_0;
    } else {
        cmn_err(CE_WARN, "u64: only slot 0 addressing is supported.\n");
    }

    /* 
     * setgioconfig() always takes params for slot 0 
     */
    conf = GIO64_ARB_EXP0_RT;

#if defined(IP22)
    setgioconfig(slot, conf);
    setgiovector(intr, slot, (void(*)())u64_giointr, controller);
#else
    cmn_err(CE_WARN, "u64: Not supported on non-Indy systems!\n");
#endif
}

void
u64_edtinit(struct edt *e)
{
    int val, i;

    /*
     * On 5.3, the only non-zero field in the edt struct are the e->e_base, 
     * e->e_base2 fields, which points to the base of our GIO address space
     * and to our megabyte of mapped memory.  I don't know why the others are 
     * zeroed out, but none of the sample GIO drivers I've looked at check for 
     * or look at any of these other fields, so go figure.
     */

    /*
     * Check to see if there is a board at our base address with our product ID.
     */
    if ( (badaddr_val(e->e_base, sizeof(int), &val)) || 
	(val & _U64_PRODUCT_ID_MASK) != _U64_PRODUCT_ID_VALUE) {
	printf("u64: not found (addr 0x%x)\n", e->e_base);
	return;
    }

    /*
     * set up the info structure
     */
    bdata = (struct u64_data *)kern_malloc(sizeof(struct u64_data));
    if (bdata == NULL) {
	cmn_err(CE_WARN, "u64: can't alloc board data structure\n");
	return;
    }
    bzero((void *)bdata, sizeof(struct u64_data));

    /*
     * Allocate a megabyte buffer which we can use when reading/writing data
     * to or from the board (we can't copyin/copyout directly from the user's
     * buffer, because those routines use 64 bit transfers).
     */ 
    bdata->oneMeg = (unsigned int *)kern_malloc(ONE_MEG);
    if (bdata->oneMeg == NULL) {
	cmn_err(CE_WARN, 
	  "u64: can't alloc megabyte buffer for copyin/copyout\n");
	if (bdata) {
	    kern_free(bdata);
	}
	return;
    } 

    bdata->board = ((struct u64_board *)e->e_base);
    bdata->memaddr = ((unsigned char *)e->e_base2);

    /*
     * Register our interrupt into the gio interrupt vector table.
     */
    u64_init_interrupts(0, e->e_base);

    /*
     * Initialize semaphores ioctl to available, ramrom to unavailable.
     */
    initnsema(&bdata->ioctl_sema, 1, "ioctl");
    initnsema(&bdata->ramrom_sema, 0, "ramrom");

    /* clear any pending interrupts */
    *((vu32 *) GIO_RDB_READ_INTR_REG) = 0;
    *((vu32 *) GIO_RDB_WRITE_INTR_REG) = 0;


    /*
     * Initialize stuff for rdb write buffer 
     */
    initnsema(&bdata->write_buf_sema, 1, "writebuf");
    bdata->write_buf_cur_write = 0;
    bdata->write_buf_cur_read = 0;
    bdata->write_buf_ct = 0;
    bdata->write_buf = (unsigned int*)kern_malloc(
            U64_INTERNAL_WRITE_BUF_SIZE * sizeof(rdbPacket));
    bdata->write_buf_size = U64_INTERNAL_WRITE_BUF_SIZE;
    if(bdata->write_buf == 0)
    {
	cmn_err(CE_WARN,"Unable to allocate internal write buffer");
	bdata->write_buf_size = 0;
    }

    /* 
     * Initialize minor's stuff
     */
    for(i = 0; i < NUMBER_MINORS; i++)
    {
	initnsema(&bdata->minors[i].minor_sema, 1, "minor");
	initnsema(&bdata->minors[i].read_sema, 0, "read"); /* by default not available */
	initnsema(&bdata->minors[i].write_sema, 0, "write"); /* by default not available */
	bdata->minors[i].read_count = 0;
	bdata->minors[i].write_count = 0;
	bdata->minors[i].read_cur_write = 0;
	bdata->minors[i].read_cur_read = 0;
	bdata->minors[i].write_cur_write = 0;
	bdata->minors[i].write_cur_read = 0;
	bdata->minors[i].incoming_ct = 0;
	bdata->minors[i].message = 0;
	bdata->minors[i].phead = phalloc(KM_NOSLEEP);
	initpollhead(bdata->minors[i].phead);
	bdata->minors[i].read_buf_size = minor_recv_buf_sizes[i];
	if(minor_recv_buf_sizes[i])
	{
	    bdata->minors[i].read_buf = (unsigned char *)kern_malloc(minor_recv_buf_sizes[i]);
	    if(!bdata->minors[i].read_buf)
		cmn_err(CE_WARN, "Unable to allocate %d byte buffer for minor %d",
			minor_recv_buf_sizes[i],i);
	}
	bdata->minors[i].write_buf_size = minor_send_buf_sizes[i];
	if(minor_send_buf_sizes[i])
	{
	    bdata->minors[i].write_buf = (unsigned char *)kern_malloc(minor_send_buf_sizes[i]);
	    if(!bdata->minors[i].write_buf)
		cmn_err(CE_WARN, "Unable to allocate %d byte buffer for minor %d",
			minor_send_buf_sizes[i],i);
	}
    }

    /*
     * Complete success! Put out the standard board-found message
     */
#if (RELEASE_MAJOR==6)
    printf("u64 (IRIX 6.2): board found at address 0x%x\n",  e->e_base);
#else
    printf("u64: board found at address 0x%x\n",  e->e_base);
#endif

    return;	/* successful */
}

/* u64_chpoll is used by select and other calls that block waiting
 * for data. When the data arrives, (in handleMinorData()) it calls
 * pollwakeup, which in turn calls this routine.
 */
u64_chpoll(dev_t dev, short events, int anyyet, short *reventsp, 
			struct pollhead **phpp)
{
    major_t    devmajor;
    minor_t    devminor;
    
    *reventsp = events;

    if ( (devmajor = getemajor(dev)) != U64_MAJOR ) 
    {
	cmn_err(CE_WARN, "u64_chpoll: unexpected major device number %d\n", devmajor);
	return(ENXIO);
    }
    
    devminor = geteminor(dev);
    if(devminor > 0 && devminor < NUMBER_MINORS)
    {
	if ((events & (POLLIN | POLLRDNORM)) && (bdata->minors[devminor].read_count > 0))
	    *reventsp |= POLLIN | POLLRDNORM;
	else 
	{
	    *reventsp = 0;
	    if(!anyyet)
		*phpp = bdata->minors[devminor].phead;
	}
	return(0);
    }


/****  NOT A MINOR WE RECOGNIZE ****/

    cmn_err(CE_WARN,"u64_poll: Did not recognize minor!!");
    return(ENXIO);
}

/* u64_read   read data available on data port. Does not wait for all data
 * to arrive, but returns as soon as it has some of the data. (applications
 * are responsible for checking the number of bytes returned, and repeatedly
 * calling read if they need a specific number of bytes. Several of our apps
 * however handle data on a stream basis, interested in what ever we have, 
 * and don't have knowledge of how many bytes they need.
 */
u64_read(dev_t dev, uio_t *uiop, cred_t *crp)
{
    int         retval;
    int         s;
    major_t     devmajor;
    minor_t     devminor;
    int         count, splitcount = 0;
    u64_minor   *m;

    if ( (devmajor = getemajor(dev)) != U64_MAJOR ) 
    {
        cmn_err(CE_WARN, "u64_read: unexpected major device number %d\n", devmajor);
        return(ENXIO);
    }
    
    devminor = geteminor(dev);
    if(devminor > 0 && devminor < NUMBER_MINORS)
    {
	m = &bdata->minors[devminor];   /* get the minor's data struct */
	if (uiop->uio_iov->iov_len > 0) 
	{
	    if (m->read_count == 0)       /* if there is no data yet */
	    {                             /* block waiting for data */ 
		retval = psema(&m->read_sema, PCATCH | PPIPE);
		if (retval == -1) 
		{
		    cmn_err(CE_WARN,"u64_read: syscall interrupted before read completed");
		    return(EINTR);
		}

	    }
	    s = spl5();  /* turn off interrupts, since we will be mucking with counts */
	    count = MIN(uiop->uio_iov->iov_len, m->read_count);
	    m->incoming_ct -= count; /* may not need, but adjust anyway */
	    m->read_count -= count;  /* adjust read count */
	    /* if the data waiting loops around end of buffer, transfer in two blocks */		   
	    if((count + m->read_cur_read) > m->read_buf_size)
	    {
		splitcount = m->read_buf_size -  m->read_cur_read;
		count -= splitcount; 
		uiomove(&m->read_buf[m->read_cur_read], splitcount, UIO_READ, uiop);
		m->read_cur_read = 0; 
	    }
	    uiomove(&m->read_buf[m->read_cur_read], count, UIO_READ, uiop);
	    m->read_cur_read += count;
	    splx(s);  /* turn interrupts back on */

	    if(m->message && (m->incoming_ct == 0))
	    {
		/* send message to game saying ready for next block of data */
		/* this is used by logging and hostio game to host */
		u64_send_message(m->message, 0);
	    }
	    
	    return (0);
	}
    }

/**** NOT A MINOR WE RECOGNIZE!!! *****/

    cmn_err(CE_WARN, "u64_read: Did not recognize minor %d", devminor);
    return(ENXIO);
}


/* u64_write. Currently supports hostio, debug, kdebug writes and 
 * profile signals.
 *
 * The main difference, between the way these operate, is that 
 * the hostio receives a message from the game, indicating that a
 * buffer big enough for all data is ready. In the case of the debug
 * the assumtion is made that as soon as the game starts it will assign
 * a buffer to receive the data, up to RMON_DBG_BUF_SIZE, and after
 * a block is sent, you wait for a message indicating that the buffer
 * is cleared, before sending again. Also, the debug sends a message
 * with the size of its message before sending the actual message.
 * The kdebug only sends a few bytes, and they are handled during the
 * interrupt, so there is no concern for buffer overflow, just send 'em
 * Likewise, the profile is only sending a single byte of signal, so
 * just send it, and don't worry.
 *
 * In the case of hostio, the sequence of events must start with the
 * host app opening /dev/u64_data_write. This will set the semaphore 
 * m->data_sema, unavailable. Then only after the device is open, the 
 * game can make its first call to osReadGame. This will notify the
 * kernel to make the m->data_sema available. (What this means is that
 * there is now a buffer ready to store the data on the game side.) The
 * host can call uhWriteGame either before or after the game side calls
 * osReadGame. In the case of hostio, although the data is split into 
 * blocks, the buffer on the game side is provided by the application
 * and should be big enough for all the data.
 *
 * In the case of the debug write, the game should already be running,
 * and rmon should already have passed a receive data buffer to the 
 * exception handler. A signal is sent, with a size, and then data is 
 * transfered. When all data is complete, m->data_sema isn't released,
 * meaning that it will block until it gets a message that the data has
 * been removed from the buffer, and that it is ok to send the next block.
 */

u64_write(dev_t dev, uio_t *uiop, cred_t *crp)
{
    major_t           devmajor;
    minor_t           devminor;
    u64_minor         *m;
    int               count;
    int               rdb_type;
    int               splitcount;
    int               retval;

    if ( (devmajor = getemajor(dev)) != U64_MAJOR ) 
    {
	cmn_err(CE_WARN, "u64_write: unexpected major device number %d\n", devmajor);
	return(ENXIO);
    }

    devminor = geteminor(dev);
    switch(devminor) 
    {
	case U64_MINOR_DATA:
	    m = &bdata->minors[devminor];
	    rdb_type = RDB_TYPE_HtoG_DATA;
	    retval = psema(&m->write_sema, PCATCH | PPIPE); /* wait for game to send message  */
	    if(retval == -1)
	    {
		cmn_err(CE_WARN,"u64_write:U64_MINOR_DATA: psema broke by signal");
		return(EINTR);
	    }
	    break;
	case U64_MINOR_DEBUG:
	    m = &bdata->minors[devminor];
	    rdb_type = RDB_TYPE_HtoG_DEBUG;
	    retval = psema(&m->write_sema, PCATCH | PPIPE);
	    if(retval == -1)
	    {
		cmn_err(CE_WARN,"u64_write:U64_MINOR_DEBUG: psema broke by signal");
		return(EINTR);
	    }
	    u64_send_message(RDB_TYPE_HtoG_DEBUG_CT,uiop->uio_iov->iov_len);
	    break;
	case U64_MINOR_KDEBUG:
	    m = &bdata->minors[devminor];
	    rdb_type = RDB_TYPE_HtoG_KDEBUG;
	    retval = psema(&m->write_sema, PCATCH | PPIPE);
	    if(retval == -1)
	    {
		cmn_err(CE_WARN,"u64_write:U64_MINOR_KDEBUG: psema broke by signal");
		return(EINTR);
	    }
	    break;
	case U64_MINOR_PROFILE:
	    m = &bdata->minors[devminor];
	    rdb_type = RDB_TYPE_HtoG_PROF_SIGNAL;
	    retval = psema(&m->write_sema, PCATCH | PPIPE);
	    if(retval == -1)
	    {
		cmn_err(CE_WARN,"u64_write:U64_MINOR_PROFILE: psema broke by signal");
		return(EINTR);
	    }
	    break;
	    
	default:
	    cmn_err(CE_WARN,"u64_write: Did not recognize minor, %d",devminor);
	    return(EROFS);
	    break;
    }

    /*  You must first move data from user buffer to kern buffer with
     *  uiomove. Once you've done that, you call u64_internal_write repeatedly,
     *  until all data is sent. u64_internal_write converts to packets, and
     *  puts the packets in a buffer to go out, sending them when it can.
     *  If the amount of data you wish to send, exceeds your minor's 
     *  write_buf_size you need to break it into blocks.
     */

    while(uiop->uio_iov->iov_len > 0)
    {
	count = MIN(m->write_buf_size,uiop->uio_iov->iov_len);
	if((count + m->write_cur_write) > m->write_buf_size)
	{
	    splitcount = m->write_buf_size - m->write_cur_write;
	    count -= splitcount;
	    uiomove(&m->write_buf[m->write_cur_write], splitcount, UIO_WRITE, uiop);
	    m->write_cur_write = 0;
	}
	else
	    splitcount = 0; /* no wrap */
	/* if wrapped buffer, count will be less than total */
	uiomove(&m->write_buf[m->write_cur_write], count, UIO_WRITE, uiop);
	m->write_cur_write += count;
	count += splitcount;   /* add splitcount back in to get total */
	while(count)  
	{
	    count -= u64_internal_write(m,count,rdb_type);
	}
    }

    if(devminor == U64_MINOR_KDEBUG || devminor == U64_MINOR_PROFILE)
	vsema(&m->write_sema);
    return(0);
}

/* open a device for reading or writing. Only one open for any minor. The 
 * general device, /dev/u64 which responds to ioctl's can be opened multiple times.
 * #### Currently we don't check the  read/write, just assume that it is ok. 
 * When opening a minor we reset it's read and write semaphores, and all counters
 */
u64_open(dev_t *devp, int flag, int otyp, struct cred *crp)
{
    major_t devmajor;
    minor_t devminor;

    if ( (devmajor = getemajor(*devp)) != U64_MAJOR ) 
    {
	cmn_err(CE_WARN, "u64_open: unexpected major device number %d\n", devmajor);
	return(ENXIO);
    }

    /*
     * If u64_edtinit() failed to find the board for whatever reason, bdata
     * will be NULL.
     */
    if (bdata == NULL)
	return(ENXIO);

    devminor = geteminor(*devp);
    if(devminor > 0 && devminor < NUMBER_MINORS)
    {
	u64_minor  *m = &bdata->minors[devminor];

	if (cpsema(&m->minor_sema))   /* you can aquire the semaphore */
	{
	    cpsema(&m->read_sema); /* if data semaphore is available, was 1,
                                      lower it to zero, the default */
	    cpsema(&m->write_sema); /* if data semaphore is available, was 1,
                                      lower it to zero, the default */
	    if(devminor == U64_MINOR_DEBUG || devminor == U64_MINOR_KDEBUG ||
	       devminor == U64_MINOR_PROFILE)
		vsema(&m->write_sema); /* debug & kdebug write are different,
                                        default to available, semaphore value of 1 */
	    m->read_count = 0;  /* set the read_count to zero */
	    m->write_count = 0;
	    m->read_cur_read = 0;
	    m->write_cur_read = 0;
	    m->read_cur_write = 0;
	    m->write_cur_write = 0;
	    m->incoming_ct = 0;
	    m->message = 0;
	    return(0);                    /* opened file successfully */
	} 
	else
	    return(EBUSY);   /* somebody else has already signed into the minor */
    }


/*****  NOT A MINOR THAT WE RECOGNIZE  *******/
/*
 * this is ok if the device is /dev/u64 which has a minor of zero.
 * /dev/u64 has nothing to init. We also allow multiple opens for 
 * /dev/u64. The only drawback is that /dev/u64 isn't pollable, but
 * that's ok, since no data comes over /dev/u64
 */

    if(devminor != 0)  
    {
	cmn_err(CE_WARN,"u64_open: Did not recognize minor %d",devminor);
	return(ENXIO);
    }

    return(0);
}

/*
 * Close the device. Just release the semaphore if it is a minor you recognize.
 */
u64_close(dev_t dev, int flag, int otyp, cred_t *crp)
{
    major_t devmajor;
    minor_t devminor;

    if ( (devmajor = getemajor(dev)) != U64_MAJOR ) 
    {
	cmn_err(CE_WARN, "u64_close: unexpected major device number %d\n", devmajor);
	return(ENXIO);
    }

    devminor = geteminor(dev);
    if(devminor > 0 && devminor < NUMBER_MINORS)
    {
	vsema(&bdata->minors[devminor].minor_sema);
	return(0);
    } 
    else if(devminor == 0)   /* /u64/dev */
	return(0);
    else          /**** NOT A MINOR WE RECOGNIZE  ****/
	return(ENXIO);
}

#define IOCTL_SUCCESS 0
/*
 * ioctl only responds to /dev/u64, and not to the various minors. 
 * We support 
 *    U64_RESET   cause the u64 to reset.
 *    U64_READ    read from the ramrom, without getting access from the game.
 *                (probably no game running) Used by gload.
 *    U64_WRITE   write to the ramrom, without getting access from the game.
 *                (probably no game running) Used by gload.
 *    U64_SAFE_READ   Read from the ramrom, but only after getting access from
 *                    the game. Used by uhReadRamrom().
 *    U64_SAFE_WRITE  Write to the ramrom, bug only after getting access from 
 *                    the game. Used by uhWriteRamrom().
 */

u64_ioctl(dev_t dev, int cmd, void *arg, int mode,
        struct cred *crp, int *rvalp)
{
    major_t    devmajor;
    minor_t    devminor;
    int        retval;
    int        s;
    proc_t     *proc;


    if ( (devmajor = getemajor(dev)) != U64_MAJOR ) 
    {
	cmn_err(CE_WARN,  "u64_ioctl: unexpected major device number %d\n", devmajor);
	return(ENXIO);
    }

    /*
     * Only one client at a time is allowed in for ioctl services.
     */
    retval = psema( &(bdata->ioctl_sema), (PPIPE | PCATCH) );
    if (retval == -1) 
    {
	cmn_err(CE_WARN, "u64_ioctl: syscall interrupted before ioctl was serviced.");
	return(EINTR);
    } 

    devminor = geteminor(dev);

#if 0   /* stuff for Gnu debugger */

    /* debug port */
    else if (devminor == U64_MINOR_DEBUG_READ) {
	switch (cmd) {
          case (TCGETS):
              {                  
                  struct termios *term = (struct termios *)arg;
                  int i;
                  term->c_iflag = 0;                    /* input modes */
                  term->c_oflag = 0;	                /* output modes */
                  term->c_cflag = CLOCAL | CS8;	        /* control modes */
                  term->c_lflag = 0; /* line discipline modes */
                  for (i = 0; i < NCCS; i += 1)
                      term->c_cc[i] = 0;
                  vsema( &(bdata->ioctl_sema) );
                  return(IOCTL_SUCCESS);
              }
              
              break;

          case (TCSETS):
              /* don't care what it is, just keep gdb happy */
              vsema( &(bdata->ioctl_sema) );
              return(IOCTL_SUCCESS);
              break;

          case (TCFLSH):
              /* ### hack. what do we do here??? */
              vsema( &(bdata->ioctl_sema) );
              return(IOCTL_SUCCESS);
              break;
              
          default:
              cmn_err(CE_WARN,"u64_ioctl: bogus ioctl %x, returning %d\n",
                      cmd, EINVAL);
              vsema( &(bdata->ioctl_sema) );
              return(EINVAL);
              break;
	}
    }
#endif    
    
    switch(cmd) 
    {
	case U64_RESET:
	    /*
	     * arg = 0: de-assert reset.
	     * arg = 1: assert reset.
	     */
	    if ( ((int)arg) == 0 )
		bdata->board->reset_control = 0;
	    else if ( ((int)arg) == 1 )
		bdata->board->reset_control = _U64_RESET_CONTROL_RESET;
	    else
	    {
		cmn_err(CE_WARN, 
		  "U64_RESET: illegal reset state %d.\n", ((int)arg));
		vsema( &(bdata->ioctl_sema) );
		return(EINVAL);
	    }
	    s = spl5();
	    bdata->write_buf_cur_write = 0;
	    bdata->write_buf_cur_read = 0;
	    bdata->write_buf_ct = 0;
	    if(valusema(&bdata->write_buf_sema) < 1)
		vsema(&bdata->write_buf_sema);
	    splx(s);
	    vsema( &(bdata->ioctl_sema) );
	    return(IOCTL_SUCCESS);
	    break;


	    /*
	     * U64_WRITE now means, write to the ramrom with no ack, for boot
	     */
	    
	case U64_WRITE:
            if (copyin(arg, &bdata->args.u64_write, sizeof(u64_write_arg_t)) != 0) 
	    {
                cmn_err(CE_WARN, "u64: U64_WRITE ioctl copyin error\n");
		vsema( &(bdata->ioctl_sema) );
                return(EFAULT);
            }

	    /*
	     * copy the user's buffer into ramrom.
	     */
	    retval = u64_write_ramrom( 
	      ( (unsigned int *)bdata->args.u64_write.buffer), 
	      ( (unsigned int *)bdata->args.u64_write.ramrom_addr), 
	      bdata->args.u64_write.nbytes);

	    vsema( &(bdata->ioctl_sema) );
	    return(retval);
	    break;

	    /*
	     * U64_READ now means, read from the ramrom with no ack, for boot
	     */
	case U64_READ:
            if (copyin(arg, &bdata->args.u64_read, sizeof(u64_read_arg_t)) != 0) {
                cmn_err(CE_WARN, "u64: U64_READ ioctl copyin error\n");
		vsema( &(bdata->ioctl_sema) );
                return(EFAULT);
            }

	    /*
	     * copy into user's buffer from ramrom.
	     */
	    retval = u64_read_ramrom( 
	      ( (unsigned int *)bdata->args.u64_read.ramrom_addr), 
	      ( (unsigned int *)bdata->args.u64_read.buffer), 
	      bdata->args.u64_read.nbytes);

	    vsema( &(bdata->ioctl_sema) );
	    return(retval);
	    break;

	    /*
	     * U64_SAFE_WRITE, obtain access to the ramrom from the game, and
	     * then write to ramrom. Release ramrom access after done.
	     */
	case U64_SAFE_WRITE:
            if (copyin(arg, &bdata->args.u64_write, sizeof(u64_write_arg_t)) != 0) {
                cmn_err(CE_WARN, "u64: U64_SAFE_WRITE ioctl copyin error (args)\n");
		vsema( &(bdata->ioctl_sema) );
                return(EFAULT);
            }

	    /*
	     * Arbitrate for control of ramrom by sending a message to
	     * the game, and waiting for an acknowledging response.
	     */
	    u64_send_message(RDB_TYPE_HtoG_REQ_RAMROM, 0);

	    retval = psema( &(bdata->ramrom_sema), (PPIPE | PCATCH) );
	    if (retval == -1) {
		cmn_err(CE_WARN, "u64_ioctl(U64_SAFE_WRITE): syscall interrupted.\n");
		vsema( &(bdata->ioctl_sema) );
		return(EINTR);
	    }
	    
	    /*
	     * Got access to ramrom, copy the user's buffer into ramrom.
	     */
	    retval = u64_write_ramrom( 
		 ( (unsigned int *)bdata->args.u64_write.buffer), 
		 ( (unsigned int *)bdata->args.u64_write.ramrom_addr), 
		 bdata->args.u64_write.nbytes);

	    /* signal game that you're done with ramrom */
	    u64_send_message(RDB_TYPE_HtoG_FREE_RAMROM, 0);

	    vsema( &(bdata->ioctl_sema) );
	    return(retval);
	    break;
	    
	    /*
	     * U64_SAFE_READ: obtain access to the ramrom from the game, and
	     * then read from the ramrom. Release ramrom access after done.
	     */
	case U64_SAFE_READ:
            if (copyin(arg, &bdata->args.u64_read, sizeof(u64_read_arg_t)) != 0) {
                cmn_err(CE_WARN, "u64: U64_WRITE ioctl copyin error\n");
		vsema( &(bdata->ioctl_sema) );
                return(EFAULT);
            }

	    /*
	     * Arbitrate for control of ramrom by sending a message to
	     * the game, and waiting for an acknowledging response.
	     */
	    u64_send_message(RDB_TYPE_HtoG_REQ_RAMROM, 0);

	    retval = psema( &(bdata->ramrom_sema), (PPIPE | PCATCH) );
	    if (retval == -1) {
		cmn_err(CE_WARN, "u64_ioctl(U64_SAFE_READ): syscall interrupted.\n");
		vsema( &(bdata->ioctl_sema) );
		return(EINTR);
	    }

	    /*
	     * got access to ramrom, copy into user's buffer from ramrom.
	     */
	    retval = u64_read_ramrom( 
	      ( (unsigned int *)bdata->args.u64_read.ramrom_addr), 
	      ( (unsigned int *)bdata->args.u64_read.buffer), 
	      bdata->args.u64_read.nbytes);

	    /* signal game that you're done with ramrom */
	    u64_send_message(RDB_TYPE_HtoG_FREE_RAMROM, 0);

	    vsema( &(bdata->ioctl_sema) );
	    return(retval);
	    break;

	default:
	    cmn_err(CE_WARN,
		"u64_ioctl: bogus ioctl %d, returning %d\n", cmd, EINVAL);
	    vsema( &(bdata->ioctl_sema) );
	    return(EINVAL);
	    break;
    }
}


/*
 * For each 1MB bank of memory, set the mapping register, copyin from the 
 * user's buffer into a kern_malloc'd arena, and then from there copy a word
 * at a time into the ramrom.  We have to do the one-hop through memory because
 * copyin uses 64 bit transfers.
 */
int u64_write_ramrom(unsigned int *userbuf, unsigned int *ramrom_offset, 
  int nbytes)
{
    int			page_start;
    int 		bankXferCount;
    unsigned char	*bankAddr;
    int			i;
    unsigned int	*gioAddr;
    unsigned int	*megAddr;
    int                 ret_val;

    /*
     * Make sure we are long word aligned.
     */
    if (nbytes & 0x3) {
	cmn_err(CE_WARN, "u64_write_ramrom: xfer count %d not word aligned.\n",
	  nbytes);
	return(EINVAL);
    }
    if ( ((int)userbuf) & 0x3 ) {
	cmn_err(CE_WARN, 
	  "u64_write_ramrom: user's buffer address 0x%x not word aligned.\n",
	  userbuf);
	return(EINVAL);
    }
    if ( ((int)ramrom_offset) & 0x3 ) {
	cmn_err(CE_WARN, 
	  "u64_write_ramrom: ramrom address 0x%x not word aligned.\n",
	  ramrom_offset);
	return(EINVAL);
    }

    /*
     * Make sure we don't exceed 16 MB rom limit
     */
    if ( ((int)ramrom_offset + nbytes) > RAMROM_SIZE ) {
	cmn_err(CE_WARN, 
	  "u64_write_ramrom: xfer of %d bytes starting at 0x%x exceeds 16MB.\n",
	  nbytes, userbuf);
	return(EINVAL);
    }

    /*
     * Determine initial offset from start of ramrom.
     */
    page_start = ( ((int)ramrom_offset) >> ONE_MEG_SHIFT);

    if (page_start > 15) {
	cmn_err(CE_WARN, 
	  "u64_write_ramrom: ramrom initial offset 0x%x exceeds 16MB.\n",
	  ramrom_offset);
	return(EINVAL);
    }

    bdata->board->dram_page_cntrl = (page_start << 20);
    bankAddr = (unsigned char *)( ((int)ramrom_offset) & 0xfffff);
    bankXferCount = MIN( nbytes, (ONE_MEG - ((int)bankAddr)) );

    while (nbytes) {

	/*
	 * We can't copyin directly from the user buffer to the gio memory,
	 * because the underlying bcopy routine (in the kernel) uses 64 bit
	 * transfers, which the gio board interprets as 16 bit transfers!
	 *
	 * Thus, we have to do a one hop through a kern_malloc'd structure.
	 */
	if ( (ret_val = copyin(userbuf, bdata->oneMeg, bankXferCount)) != 0 ) {

	    cmn_err(CE_WARN, "u64_write_ramrom: user address copyin error\n");
	    printf(
	      "user address 0x%x, kern_malloc buffer address 0x%x, size %d ret_val %d\n", 
	      userbuf, bdata->oneMeg, bankXferCount, ret_val);
	    
	    return(EFAULT);
	}

	/*
	 * Now copy a 32 bit word at a time from the kern_malloc'd and
	 * copyin'd buffer into the gio memory.
	 */
	gioAddr = 
	  (unsigned int *)( ((int)bdata->memaddr) + ((int)bankAddr) );
	megAddr = bdata->oneMeg;

	for (i = 0; i < bankXferCount; i += (sizeof(unsigned int)) ) {
	    *gioAddr++ = *megAddr++;	    
	}

	nbytes -= bankXferCount;
	userbuf = (unsigned int *)( ((int)userbuf) + bankXferCount);

	/*
	 * We should be on a one megabyte boundary now.  Set the bankAddr to 0.
	 */
	bankAddr = 0;
	bankXferCount = MIN( nbytes, ONE_MEG );
	if (nbytes > 0) {
	    ++page_start;
	    bdata->board->dram_page_cntrl = (page_start << 20);
	}
    }
    return(IOCTL_SUCCESS);
}


/*
 * For each 1MB bank of memory, set the mapping register, copy a word at a time
 * from ramrom into a kern_malloc'd arena, and then then copyout() from the 
 * malloc'd buffer into the user's buffer.  We have to do the one-hop through 
 * memory because copyin uses 64 bit transfers.
 */
int u64_read_ramrom(unsigned int *ramrom_offset, unsigned int *userbuf, 
  int nbytes)
{
    int			page_start;
    int 		bankXferCount;
    unsigned char	*bankAddr;
    int			i;
    unsigned int	*gioAddr;
    unsigned int	*megAddr;
    
    /*
     * Make sure we are long word aligned.
     */
    if (nbytes & 0x3) {
	cmn_err(CE_WARN, "u64_read_ramrom: xfer count %d not word aligned.\n",
	  nbytes);
	return(EINVAL);
    }
    if ( ((int)ramrom_offset) & 0x3 ) {
	cmn_err(CE_WARN, 
	  "u64_read_ramrom: ramrom address 0x%x not word aligned.\n",
	  ramrom_offset);
	return(EINVAL);
    }
    if ( ((int)userbuf) & 0x3 ) {
	cmn_err(CE_WARN, 
	  "u64_read_ramrom: user's buffer address 0x%x not word aligned.\n",
	  userbuf);
	return(EINVAL);
    }

    /*
     * Make sure we don't exceed 16 MB rom limit
     */
    if ( ((int)ramrom_offset + nbytes) > RAMROM_SIZE ) {
	cmn_err(CE_WARN, 
	  "u64_read_ramrom: xfer of %d bytes starting at 0x%x exceeds 16MB.\n",
	  nbytes, ramrom_offset);
	return(EINVAL);
    }

    /*
     * Determine initial offset from start of ramrom.
     */
    page_start = ( ((int)ramrom_offset) >> ONE_MEG_SHIFT);

    if (page_start > 15) {
	cmn_err(CE_WARN, 
	  "u64_read_ramrom: ramrom initial offset 0x%x exceeds 16MB.\n",
	  ramrom_offset);
	return(EINVAL);
    }

    bdata->board->dram_page_cntrl = (page_start << 20);
    bankAddr = (unsigned char *)( ((int)ramrom_offset) & 0xfffff);
    bankXferCount = MIN( nbytes, (ONE_MEG - ((int)bankAddr)) );

    while (nbytes) {

	/*
	 * We can't copyout directly from the gio memory to the user buffer,
	 * because the underlying bcopy routine (in the kernel) uses 64 bit
	 * transfers, which the gio board interprets as 16 bit transfers!
	 *
	 * Thus, we have to do a one hop through a kern_malloc'd structure.
	 */


	/*
	 * Copy a 32 bit word at a time from the gio memory into the 
	 * kern_malloc'd buffer.
	 */
	gioAddr = 
	  (unsigned int *)( ((int)bdata->memaddr) + ((int)bankAddr) );
	megAddr = bdata->oneMeg;

	for (i = 0; i < bankXferCount; i += (sizeof(unsigned int)) ) {
	    *megAddr++ = *gioAddr++;
	}

	if (copyout(bdata->oneMeg, userbuf, bankXferCount) != 0) {

	    cmn_err(CE_WARN, "u64_read_ramrom: user address copyout error\n");
	    cmn_err(CE_WARN, 
	      "user address 0x%x, kern_malloc address 0x%x, size %d\n", 
	      userbuf, bdata->oneMeg, bankXferCount);
	    
	    return(EFAULT);
	}

	nbytes -= bankXferCount;
	userbuf = (unsigned int *)( ((int)userbuf) + bankXferCount);

	/*
	 * We should be on a one megabyte boundary now.  Set the bankAddr to 0.
	 */
	bankAddr = 0;
	bankXferCount = MIN( nbytes, ONE_MEG );
	if (nbytes > 0) {
	    ++page_start;
	    bdata->board->dram_page_cntrl = (page_start << 20);
	}
    }
    return(IOCTL_SUCCESS);
}


/*
 * u64_internal_write must block for main write_buf_sema before attempting
 * to write to rdb port. The write semaphore only becomes available after
 * all the data in the write buffer is sent, so this routine assumes that
 * the write buffer is empty. This routine sends the first packet of data,
 * but puts the rest into the bdata->write_buf, to be sent by the interrupt
 * handler. Return the total number of bytes sent in the first packet plus 
 * the number put in the bdata->write_buf. The calling routine is responsible
 * for repeatedly calling u64_internal_write until all data has successfully 
 * been sent.
 */
static int u64_internal_write(u64_minor *m, int count, int rdbtype)
{
    rdbPacket   *pPtr,firstPkt;
    int         s, len, c, inCt = 0;
    int         sent = 0;
    
    s = psema(&bdata->write_buf_sema, PCATCH | PPIPE);
    if(s == -1)
    {
	cmn_err(CE_WARN, "u64_internal_write: psema broke on signal");
	return(EINTR);
    }
    
    s = spl5(); /* disable interrupts since will be altering variables used by interrupts */

    /* fill in the first packet structure, */
    firstPkt.type = (unsigned int)rdbtype;
    len = MIN(count,3);
    firstPkt.length = (unsigned int) len;    
    for(c = 0; c < len; c++ )
    {
	firstPkt.buf[c] = m->write_buf[m->write_cur_read];
	m->write_cur_read++;
	if(m->write_cur_read >= m->write_buf_size)
	    m->write_cur_read = 0;
    }

    /* adjust variables to account for first packet */
    count -= len;
    sent += len;

    /* put remaining data into bdata->write_buf */
    while(count > 0 && (bdata->write_buf_ct < bdata->write_buf_size))
    {
	len = MIN(count,3);
	pPtr = (rdbPacket*)&bdata->write_buf[bdata->write_buf_cur_write];
	pPtr->type = (unsigned int)rdbtype;
	pPtr->length = (unsigned int)len;

	for(c = 0; c < len; c++ )
	{
	    pPtr->buf[c] = m->write_buf[m->write_cur_read];
	    m->write_cur_read++;
	    if(m->write_cur_read >= m->write_buf_size)
		m->write_cur_read = 0;
	}
	
	bdata->write_buf_cur_write++;
	if(bdata->write_buf_cur_write >= bdata->write_buf_size)
	    bdata->write_buf_cur_write = 0;
	bdata->write_buf_ct++;
	count -= len;
	sent += len;
    } 
    
    /* send the first packet */
    *((vu32*) GIO_RDB_BASE_REG) = *((vu32*)&firstPkt);

    splx(s); /* turn interrupts back on */

    return(sent);

}

/*
 * u64_send_message must block for main write_buf_sema before attempting
 * to write to rdb port. The write semaphore only becomes available after
 * all the data in the write buffer is sent, so this routine assumes that
 * the write buffer is empty.
 */
static int u64_send_message(unsigned int rdbType, int value)
{
    rdbPacket    pkt;
    int          s;


    s = psema(&bdata->write_buf_sema, PCATCH | PPIPE);
    if(s == -1)
    {
	cmn_err(CE_WARN, "u64_send_message: psema broke on signal");
	return(EINTR);
    }
    s = spl5();

    pkt.type = rdbType;
    pkt.length = 0;
    pkt.buf[0] = (value >> 16) & 0xFF;
    pkt.buf[1] = (value >> 8) & 0xFF;
    pkt.buf[2] = value & 0xFF;

    *((vu32*) GIO_RDB_BASE_REG) = *((vu32*)&pkt);

    splx(s);

    return(1);
}