Index our "DMA safe" sense buffers by SCB rather than hscb.

hscbs may be traded during error recovery due to the way
we manage the qinfifo.  This has the effect of changing the
index to the sense buffer even though the request sense command
references the original buffer.  SCBs don't play this swapping
game and so serve as a more consistent reference.

4 files changed, 28 insertions, 4 deletions

diff --git a/sys/dev/aic7xxx/aic7xxx.c b/sys/dev/aic7xxx/aic7xxx.c
index 5f8540a..70f22c7 100644
--- a/sys/dev/aic7xxx/aic7xxx.c
+++ b/sys/dev/aic7xxx/aic7xxx.c
@@ -487,8 +487,7 @@ ahc_handle_seqint(struct ahc_softc *ahc, u_int intstat)
 					printf("Sending Sense\n");
 				}
 #endif
-				sg->addr = ahc->scb_data->sense_busaddr
-				   + (hscb->tag*sizeof(struct scsi_sense_data));
+				sg->addr = ahc_get_sense_bufaddr(ahc, scb);
 				sg->len = ahc_get_sense_bufsize(ahc, scb);
 				sg->len |= AHC_DMA_LAST_SEG;
 
diff --git a/sys/dev/aic7xxx/aic7xxx_freebsd.c b/sys/dev/aic7xxx/aic7xxx_freebsd.c
index 24debda..6fe99ab 100644
--- a/sys/dev/aic7xxx/aic7xxx_freebsd.c
+++ b/sys/dev/aic7xxx/aic7xxx_freebsd.c
@@ -337,7 +337,7 @@ ahc_done(struct ahc_softc *ahc, struct scb *scb)
 		 */
 		memset(&ccb->csio.sense_data, 0, sizeof(ccb->csio.sense_data));
 		memcpy(&ccb->csio.sense_data,
-		       &ahc->scb_data->sense[scb->hscb->tag],
+		       ahc_get_sense_buf(ahc, scb),
 		       (scb->sg_list->len & AHC_SG_LEN_MASK)
 		       - ccb->csio.sense_resid);
 		scb->io_ctx->ccb_h.status |= CAM_AUTOSNS_VALID;
diff --git a/sys/dev/aic7xxx/aic7xxx_inline.h b/sys/dev/aic7xxx/aic7xxx_inline.h
index 875d7fe..b95fd3f 100644
--- a/sys/dev/aic7xxx/aic7xxx_inline.h
+++ b/sys/dev/aic7xxx/aic7xxx_inline.h
@@ -200,6 +200,12 @@ static __inline void	ahc_free_scb(struct ahc_softc *ahc, struct scb *scb);
 static __inline void	ahc_swap_with_next_hscb(struct ahc_softc *ahc,
 						struct scb *scb);
 static __inline void	ahc_queue_scb(struct ahc_softc *ahc, struct scb *scb);
+static __inline struct scsi_sense_data *
+			ahc_get_sense_buf(struct ahc_softc *ahc,
+					  struct scb *scb);
+static __inline uint32_t
+			ahc_get_sense_bufaddr(struct ahc_softc *ahc,
+					      struct scb *scb);
 
 /*
  * Determine whether the sequencer reported a residual
@@ -346,6 +352,25 @@ ahc_queue_scb(struct ahc_softc *ahc, struct scb *scb)
 	}
 }
 
+static __inline struct scsi_sense_data *
+ahc_get_sense_buf(struct ahc_softc *ahc, struct scb *scb)
+{
+	int offset;
+
+	offset = scb - ahc->scb_data->scbarray;
+	return (&ahc->scb_data->sense[offset]);
+}
+
+static __inline uint32_t
+ahc_get_sense_bufaddr(struct ahc_softc *ahc, struct scb *scb)
+{
+	int offset;
+
+	offset = scb - ahc->scb_data->scbarray;
+	return (ahc->scb_data->sense_busaddr
+	      + (offset * sizeof(struct scsi_sense_data)));
+}
+
 /************************** Interrupt Processing ******************************/
 static __inline u_int ahc_check_cmdcmpltqueues(struct ahc_softc *ahc);
 static __inline void ahc_intr(struct ahc_softc *ahc);
diff --git a/sys/dev/aic7xxx/aic7xxx_osm.c b/sys/dev/aic7xxx/aic7xxx_osm.c
index 24debda..6fe99ab 100644
--- a/sys/dev/aic7xxx/aic7xxx_osm.c
+++ b/sys/dev/aic7xxx/aic7xxx_osm.c
@@ -337,7 +337,7 @@ ahc_done(struct ahc_softc *ahc, struct scb *scb)
 		 */
 		memset(&ccb->csio.sense_data, 0, sizeof(ccb->csio.sense_data));
 		memcpy(&ccb->csio.sense_data,
-		       &ahc->scb_data->sense[scb->hscb->tag],
+		       ahc_get_sense_buf(ahc, scb),
 		       (scb->sg_list->len & AHC_SG_LEN_MASK)
 		       - ccb->csio.sense_resid);
 		scb->io_ctx->ccb_h.status |= CAM_AUTOSNS_VALID;