sys/dev/esp/ncr53c9x.c

   1 /*-
   2  * Copyright (c) 2004 Scott Long
   3  * Copyright (c) 2005, 2008 Marius Strobl <marius@FreeBSD.org>
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  * 2. Redistributions in binary form must reproduce the above copyright
  12  *    notice, this list of conditions and the following disclaimer in the
  13  *    documentation and/or other materials provided with the distribution.
  14  *
  15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  18  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  25  * SUCH DAMAGE.
  26  *
  27  */
  28
  29 /*      $NetBSD: ncr53c9x.c,v 1.145 2012/06/18 21:23:56 martin Exp $    */
  30
  31 /*-
  32  * Copyright (c) 1998, 2002 The NetBSD Foundation, Inc.
  33  * All rights reserved.
  34  *
  35  * This code is derived from software contributed to The NetBSD Foundation
  36  * by Charles M. Hannum.
  37  *
  38  * Redistribution and use in source and binary forms, with or without
  39  * modification, are permitted provided that the following conditions
  40  * are met:
  41  * 1. Redistributions of source code must retain the above copyright
  42  *    notice, this list of conditions and the following disclaimer.
  43  * 2. Redistributions in binary form must reproduce the above copyright
  44  *    notice, this list of conditions and the following disclaimer in the
  45  *    documentation and/or other materials provided with the distribution.
  46  *
  47  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
  48  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  49  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  50  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
  51  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  52  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  53  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  54  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  55  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  56  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  57  * POSSIBILITY OF SUCH DAMAGE.
  58  */
  59
  60 /*-
  61  * Copyright (c) 1994 Peter Galbavy
  62  * Copyright (c) 1995 Paul Kranenburg
  63  * All rights reserved.
  64  *
  65  * Redistribution and use in source and binary forms, with or without
  66  * modification, are permitted provided that the following conditions
  67  * are met:
  68  * 1. Redistributions of source code must retain the above copyright
  69  *    notice, this list of conditions and the following disclaimer.
  70  * 2. Redistributions in binary form must reproduce the above copyright
  71  *    notice, this list of conditions and the following disclaimer in the
  72  *    documentation and/or other materials provided with the distribution.
  73  * 3. All advertising materials mentioning features or use of this software
  74  *    must display the following acknowledgement:
  75  *      This product includes software developed by Peter Galbavy
  76  * 4. The name of the author may not be used to endorse or promote products
  77  *    derived from this software without specific prior written permission.
  78  *
  79  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  80  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  81  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  82  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
  83  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  84  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  85  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  86  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  87  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  88  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  89  * POSSIBILITY OF SUCH DAMAGE.
  90  */
  91
  92 /*
  93  * Based on aic6360 by Jarle Greipsland
  94  *
  95  * Acknowledgements: Many of the algorithms used in this driver are
  96  * inspired by the work of Julian Elischer (julian@FreeBSD.org) and
  97  * Charles Hannum (mycroft@duality.gnu.ai.mit.edu).  Thanks a million!
  98  */
  99
 100 #include <sys/cdefs.h>
 101 __FBSDID("$FreeBSD$");
 102
 103 #include <sys/param.h>
 104 #include <sys/systm.h>
 105 #include <sys/bus.h>
 106 #include <sys/kernel.h>
 107 #include <sys/malloc.h>
 108 #include <sys/lock.h>
 109 #include <sys/module.h>
 110 #include <sys/mutex.h>
 111 #include <sys/queue.h>
 112 #include <sys/time.h>
 113 #include <sys/callout.h>
 114
 115 #include <cam/cam.h>
 116 #include <cam/cam_ccb.h>
 117 #include <cam/cam_debug.h>
 118 #include <cam/cam_sim.h>
 119 #include <cam/cam_xpt_sim.h>
 120 #include <cam/scsi/scsi_all.h>
 121 #include <cam/scsi/scsi_message.h>
 122
 123 #include <dev/esp/ncr53c9xreg.h>
 124 #include <dev/esp/ncr53c9xvar.h>
 125
 126 devclass_t esp_devclass;
 127
 128 MODULE_DEPEND(esp, cam, 1, 1, 1);
 129
 130 #ifdef NCR53C9X_DEBUG
 131 int ncr53c9x_debug =
 132     NCR_SHOWMISC /* | NCR_SHOWPHASE | NCR_SHOWTRAC | NCR_SHOWCMDS */;
 133 #endif
 134
 135 static void     ncr53c9x_abort(struct ncr53c9x_softc *sc,
 136                     struct ncr53c9x_ecb *ecb);
 137 static void     ncr53c9x_action(struct cam_sim *sim, union ccb *ccb);
 138 static void     ncr53c9x_async(void *cbarg, uint32_t code,
 139                     struct cam_path *path, void *arg);
 140 static void     ncr53c9x_callout(void *arg);
 141 static void     ncr53c9x_clear(struct ncr53c9x_softc *sc, cam_status result);
 142 static void     ncr53c9x_clear_target(struct ncr53c9x_softc *sc, int target,
 143                     cam_status result);
 144 static void     ncr53c9x_dequeue(struct ncr53c9x_softc *sc,
 145                     struct ncr53c9x_ecb *ecb);
 146 static void     ncr53c9x_done(struct ncr53c9x_softc *sc,
 147                     struct ncr53c9x_ecb *ecb);
 148 static void     ncr53c9x_free_ecb(struct ncr53c9x_softc *sc,
 149                     struct ncr53c9x_ecb *ecb);
 150 static void     ncr53c9x_msgin(struct ncr53c9x_softc *sc);
 151 static void     ncr53c9x_msgout(struct ncr53c9x_softc *sc);
 152 static void     ncr53c9x_init(struct ncr53c9x_softc *sc, int doreset);
 153 static void     ncr53c9x_intr1(struct ncr53c9x_softc *sc);
 154 static void     ncr53c9x_poll(struct cam_sim *sim);
 155 static int      ncr53c9x_rdfifo(struct ncr53c9x_softc *sc, int how);
 156 static int      ncr53c9x_reselect(struct ncr53c9x_softc *sc, int message,
 157                     int tagtype, int tagid);
 158 static void     ncr53c9x_reset(struct ncr53c9x_softc *sc);
 159 static void     ncr53c9x_sense(struct ncr53c9x_softc *sc,
 160                     struct ncr53c9x_ecb *ecb);
 161 static void     ncr53c9x_sched(struct ncr53c9x_softc *sc);
 162 static void     ncr53c9x_select(struct ncr53c9x_softc *sc,
 163                     struct ncr53c9x_ecb *ecb);
 164 static void     ncr53c9x_watch(void *arg);
 165 static void     ncr53c9x_wrfifo(struct ncr53c9x_softc *sc, uint8_t *p,
 166                     int len);
 167
 168 static struct ncr53c9x_ecb      *ncr53c9x_get_ecb(struct ncr53c9x_softc *sc);
 169 static struct ncr53c9x_linfo    *ncr53c9x_lunsearch(struct ncr53c9x_tinfo *sc,
 170                                     int64_t lun);
 171
 172 static inline void      ncr53c9x_readregs(struct ncr53c9x_softc *sc);
 173 static inline void      ncr53c9x_setsync(struct ncr53c9x_softc *sc,
 174                             struct ncr53c9x_tinfo *ti);
 175 static inline int       ncr53c9x_stp2cpb(struct ncr53c9x_softc *sc,
 176                             int period);
 177
 178 #define NCR_RDFIFO_START   0
 179 #define NCR_RDFIFO_CONTINUE 1
 180
 181 #define NCR_SET_COUNT(sc, size) do {                                    \
 182                 NCR_WRITE_REG((sc), NCR_TCL, (size));                   \
 183                 NCR_WRITE_REG((sc), NCR_TCM, (size) >> 8);              \
 184                 if ((sc->sc_features & NCR_F_LARGEXFER) != 0)           \
 185                         NCR_WRITE_REG((sc), NCR_TCH, (size) >> 16);     \
 186                 if (sc->sc_rev == NCR_VARIANT_FAS366)                   \
 187                         NCR_WRITE_REG(sc, NCR_RCH, 0);                  \
 188 } while (/* CONSTCOND */0)
 189
 190 #ifndef mstohz
 191 #define mstohz(ms) \
 192         (((ms) < 0x20000) ? \
 193             ((ms +0u) / 1000u) * hz : \
 194             ((ms +0u) * hz) /1000u)
 195 #endif
 196
 197 /*
 198  * Names for the NCR53c9x variants, corresponding to the variant tags
 199  * in ncr53c9xvar.h.
 200  */
 201 static const char *ncr53c9x_variant_names[] = {
 202         "ESP100",
 203         "ESP100A",
 204         "ESP200",
 205         "NCR53C94",
 206         "NCR53C96",
 207         "ESP406",
 208         "FAS408",
 209         "FAS216",
 210         "AM53C974",
 211         "FAS366/HME",
 212         "NCR53C90 (86C01)",
 213         "FAS100A",
 214         "FAS236",
 215 };
 216
 217 /*
 218  * Search linked list for LUN info by LUN id.
 219  */
 220 static struct ncr53c9x_linfo *
 221 ncr53c9x_lunsearch(struct ncr53c9x_tinfo *ti, int64_t lun)
 222 {
 223         struct ncr53c9x_linfo *li;
 224
 225         LIST_FOREACH(li, &ti->luns, link)
 226                 if (li->lun == lun)
 227                         return (li);
 228         return (NULL);
 229 }
 230
 231 /*
 232  * Attach this instance, and then all the sub-devices.
 233  */
 234 int
 235 ncr53c9x_attach(struct ncr53c9x_softc *sc)
 236 {
 237         struct cam_devq *devq;
 238         struct cam_sim *sim;
 239         struct cam_path *path;
 240         struct ncr53c9x_ecb *ecb;
 241         int error, i;
 242
 243         if (NCR_LOCK_INITIALIZED(sc) == 0) {
 244                 device_printf(sc->sc_dev, "mutex not initialized\n");
 245                 return (ENXIO);
 246         }
 247
 248         callout_init_mtx(&sc->sc_watchdog, &sc->sc_lock, 0);
 249
 250         /*
 251          * Note, the front-end has set us up to print the chip variation.
 252          */
 253         if (sc->sc_rev >= NCR_VARIANT_MAX) {
 254                 device_printf(sc->sc_dev, "unknown variant %d, devices not "
 255                     "attached\n", sc->sc_rev);
 256                 return (EINVAL);
 257         }
 258
 259         device_printf(sc->sc_dev, "%s, %d MHz, SCSI ID %d\n",
 260             ncr53c9x_variant_names[sc->sc_rev], sc->sc_freq, sc->sc_id);
 261
 262         sc->sc_ntarg = (sc->sc_rev == NCR_VARIANT_FAS366) ? 16 : 8;
 263
 264         /*
 265          * Allocate SCSI message buffers.
 266          * Front-ends can override allocation to avoid alignment
 267          * handling in the DMA engines.  Note that ncr53c9x_msgout()
 268          * can request a 1 byte DMA transfer.
 269          */
 270         if (sc->sc_omess == NULL) {
 271                 sc->sc_omess_self = 1;
 272                 sc->sc_omess = malloc(NCR_MAX_MSG_LEN, M_DEVBUF, M_NOWAIT);
 273                 if (sc->sc_omess == NULL) {
 274                         device_printf(sc->sc_dev,
 275                             "cannot allocate MSGOUT buffer\n");
 276                         return (ENOMEM);
 277                 }
 278         } else
 279                 sc->sc_omess_self = 0;
 280
 281         if (sc->sc_imess == NULL) {
 282                 sc->sc_imess_self = 1;
 283                 sc->sc_imess = malloc(NCR_MAX_MSG_LEN + 1, M_DEVBUF, M_NOWAIT);
 284                 if (sc->sc_imess == NULL) {
 285                         device_printf(sc->sc_dev,
 286                             "cannot allocate MSGIN buffer\n");
 287                         error = ENOMEM;
 288                         goto fail_omess;
 289                 }
 290         } else
 291                 sc->sc_imess_self = 0;
 292
 293         sc->sc_tinfo = malloc(sc->sc_ntarg * sizeof(sc->sc_tinfo[0]),
 294             M_DEVBUF, M_NOWAIT | M_ZERO);
 295         if (sc->sc_tinfo == NULL) {
 296                 device_printf(sc->sc_dev,
 297                     "cannot allocate target info buffer\n");
 298                 error = ENOMEM;
 299                 goto fail_imess;
 300         }
 301
 302         /*
 303          * Treat NCR53C90 with the 86C01 DMA chip exactly as ESP100
 304          * from now on.
 305          */
 306         if (sc->sc_rev == NCR_VARIANT_NCR53C90_86C01)
 307                 sc->sc_rev = NCR_VARIANT_ESP100;
 308
 309         sc->sc_ccf = FREQTOCCF(sc->sc_freq);
 310
 311         /* The value *must not* be == 1.  Make it 2. */
 312         if (sc->sc_ccf == 1)
 313                 sc->sc_ccf = 2;
 314
 315         /*
 316          * The recommended timeout is 250ms.  This register is loaded
 317          * with a value calculated as follows, from the docs:
 318          *
 319          *              (timeout period) x (CLK frequency)
 320          *      reg = -------------------------------------
 321          *               8192 x (Clock Conversion Factor)
 322          *
 323          * Since CCF has a linear relation to CLK, this generally computes
 324          * to the constant of 153.
 325          */
 326         sc->sc_timeout = ((250 * 1000) * sc->sc_freq) / (8192 * sc->sc_ccf);
 327
 328         /* The CCF register only has 3 bits; 0 is actually 8. */
 329         sc->sc_ccf &= 7;
 330
 331         /*
 332          * Register with CAM.
 333          */
 334         devq = cam_simq_alloc(sc->sc_ntarg);
 335         if (devq == NULL) {
 336                 device_printf(sc->sc_dev, "cannot allocate device queue\n");
 337                 error = ENOMEM;
 338                 goto fail_tinfo;
 339         }
 340
 341         sim = cam_sim_alloc(ncr53c9x_action, ncr53c9x_poll, "esp", sc,
 342             device_get_unit(sc->sc_dev), &sc->sc_lock, 1, NCR_TAG_DEPTH, devq);
 343         if (sim == NULL) {
 344                 device_printf(sc->sc_dev, "cannot allocate SIM entry\n");
 345                 error = ENOMEM;
 346                 goto fail_devq;
 347         }
 348
 349         NCR_LOCK(sc);
 350
 351         if (xpt_bus_register(sim, sc->sc_dev, 0) != CAM_SUCCESS) {
 352                 device_printf(sc->sc_dev, "cannot register bus\n");
 353                 error = EIO;
 354                 goto fail_lock;
 355         }
 356
 357         if (xpt_create_path(&path, NULL, cam_sim_path(sim),
 358             CAM_TARGET_WILDCARD, CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
 359                 device_printf(sc->sc_dev, "cannot create path\n");
 360                 error = EIO;
 361                 goto fail_bus;
 362         }
 363
 364         if (xpt_register_async(AC_LOST_DEVICE, ncr53c9x_async, sim, path) !=
 365             CAM_REQ_CMP) {
 366                 device_printf(sc->sc_dev, "cannot register async handler\n");
 367                 error = EIO;
 368                 goto fail_path;
 369         }
 370
 371         sc->sc_sim = sim;
 372         sc->sc_path = path;
 373
 374         /* Reset state and bus. */
 375 #if 0
 376         sc->sc_cfflags = sc->sc_dev.dv_cfdata->cf_flags;
 377 #else
 378         sc->sc_cfflags = 0;
 379 #endif
 380         sc->sc_state = 0;
 381         ncr53c9x_init(sc, 1);
 382
 383         TAILQ_INIT(&sc->free_list);
 384         if ((sc->ecb_array =
 385             malloc(sizeof(struct ncr53c9x_ecb) * NCR_TAG_DEPTH, M_DEVBUF,
 386             M_NOWAIT | M_ZERO)) == NULL) {
 387                 device_printf(sc->sc_dev, "cannot allocate ECB array\n");
 388                 error = ENOMEM;
 389                 goto fail_async;
 390         }
 391         for (i = 0; i < NCR_TAG_DEPTH; i++) {
 392                 ecb = &sc->ecb_array[i];
 393                 ecb->sc = sc;
 394                 ecb->tag_id = i;
 395                 callout_init_mtx(&ecb->ch, &sc->sc_lock, 0);
 396                 TAILQ_INSERT_HEAD(&sc->free_list, ecb, free_links);
 397         }
 398
 399         callout_reset(&sc->sc_watchdog, 60 * hz, ncr53c9x_watch, sc);
 400
 401         NCR_UNLOCK(sc);
 402
 403         return (0);
 404
 405 fail_async:
 406         xpt_register_async(0, ncr53c9x_async, sim, path);
 407 fail_path:
 408         xpt_free_path(path);
 409 fail_bus:
 410         xpt_bus_deregister(cam_sim_path(sim));
 411 fail_lock:
 412         NCR_UNLOCK(sc);
 413         cam_sim_free(sim, TRUE);
 414 fail_devq:
 415         cam_simq_free(devq);
 416 fail_tinfo:
 417         free(sc->sc_tinfo, M_DEVBUF);
 418 fail_imess:
 419         if (sc->sc_imess_self)
 420                 free(sc->sc_imess, M_DEVBUF);
 421 fail_omess:
 422         if (sc->sc_omess_self)
 423                 free(sc->sc_omess, M_DEVBUF);
 424         return (error);
 425 }
 426
 427 int
 428 ncr53c9x_detach(struct ncr53c9x_softc *sc)
 429 {
 430         struct ncr53c9x_linfo *li, *nextli;
 431         int t;
 432
 433         callout_drain(&sc->sc_watchdog);
 434
 435         NCR_LOCK(sc);
 436
 437         if (sc->sc_tinfo) {
 438                 /* Cancel all commands. */
 439                 ncr53c9x_clear(sc, CAM_REQ_ABORTED);
 440
 441                 /* Free logical units. */
 442                 for (t = 0; t < sc->sc_ntarg; t++) {
 443                         for (li = LIST_FIRST(&sc->sc_tinfo[t].luns); li;
 444                             li = nextli) {
 445                                 nextli = LIST_NEXT(li, link);
 446                                 free(li, M_DEVBUF);
 447                         }
 448                 }
 449         }
 450
 451         xpt_register_async(0, ncr53c9x_async, sc->sc_sim, sc->sc_path);
 452         xpt_free_path(sc->sc_path);
 453         xpt_bus_deregister(cam_sim_path(sc->sc_sim));
 454         cam_sim_free(sc->sc_sim, TRUE);
 455
 456         NCR_UNLOCK(sc);
 457
 458         free(sc->ecb_array, M_DEVBUF);
 459         free(sc->sc_tinfo, M_DEVBUF);
 460         if (sc->sc_imess_self)
 461                 free(sc->sc_imess, M_DEVBUF);
 462         if (sc->sc_omess_self)
 463                 free(sc->sc_omess, M_DEVBUF);
 464
 465         return (0);
 466 }
 467
 468 /*
 469  * This is the generic ncr53c9x reset function.  It does not reset the SCSI
 470  * bus, only this controller, but kills any on-going commands, and also stops
 471  * and resets the DMA.
 472  *
 473  * After reset, registers are loaded with the defaults from the attach
 474  * routine above.
 475  */
 476 static void
 477 ncr53c9x_reset(struct ncr53c9x_softc *sc)
 478 {
 479
 480         NCR_LOCK_ASSERT(sc, MA_OWNED);
 481
 482         /* Reset DMA first. */
 483         NCRDMA_RESET(sc);
 484
 485         /* Reset SCSI chip. */
 486         NCRCMD(sc, NCRCMD_RSTCHIP);
 487         NCRCMD(sc, NCRCMD_NOP);
 488         DELAY(500);
 489
 490         /* Do these backwards, and fall through. */
 491         switch (sc->sc_rev) {
 492         case NCR_VARIANT_ESP406:
 493         case NCR_VARIANT_FAS408:
 494                 NCR_WRITE_REG(sc, NCR_CFG5, sc->sc_cfg5 | NCRCFG5_SINT);
 495                 NCR_WRITE_REG(sc, NCR_CFG4, sc->sc_cfg4);
 496                 /* FALLTHROUGH */
 497         case NCR_VARIANT_AM53C974:
 498         case NCR_VARIANT_FAS100A:
 499         case NCR_VARIANT_FAS216:
 500         case NCR_VARIANT_FAS236:
 501         case NCR_VARIANT_NCR53C94:
 502         case NCR_VARIANT_NCR53C96:
 503         case NCR_VARIANT_ESP200:
 504                 sc->sc_features |= NCR_F_HASCFG3;
 505                 NCR_WRITE_REG(sc, NCR_CFG3, sc->sc_cfg3);
 506                 /* FALLTHROUGH */
 507         case NCR_VARIANT_ESP100A:
 508                 sc->sc_features |= NCR_F_SELATN3;
 509                 if ((sc->sc_cfg2 & NCRCFG2_FE) != 0)
 510                         sc->sc_features |= NCR_F_LARGEXFER;
 511                 NCR_WRITE_REG(sc, NCR_CFG2, sc->sc_cfg2);
 512                 /* FALLTHROUGH */
 513         case NCR_VARIANT_ESP100:
 514                 NCR_WRITE_REG(sc, NCR_CFG1, sc->sc_cfg1);
 515                 NCR_WRITE_REG(sc, NCR_CCF, sc->sc_ccf);
 516                 NCR_WRITE_REG(sc, NCR_SYNCOFF, 0);
 517                 NCR_WRITE_REG(sc, NCR_TIMEOUT, sc->sc_timeout);
 518                 break;
 519
 520         case NCR_VARIANT_FAS366:
 521                 sc->sc_features |= NCR_F_HASCFG3 | NCR_F_FASTSCSI |
 522                     NCR_F_SELATN3 | NCR_F_LARGEXFER;
 523                 sc->sc_cfg3 = NCRFASCFG3_FASTCLK | NCRFASCFG3_OBAUTO;
 524                 if (sc->sc_id > 7)
 525                         sc->sc_cfg3 |= NCRFASCFG3_IDBIT3;
 526                 sc->sc_cfg3_fscsi = NCRFASCFG3_FASTSCSI;
 527                 NCR_WRITE_REG(sc, NCR_CFG3, sc->sc_cfg3);
 528                 sc->sc_cfg2 = NCRCFG2_HMEFE | NCRCFG2_HME32;
 529                 NCR_WRITE_REG(sc, NCR_CFG2, sc->sc_cfg2);
 530                 NCR_WRITE_REG(sc, NCR_CFG1, sc->sc_cfg1);
 531                 NCR_WRITE_REG(sc, NCR_CCF, sc->sc_ccf);
 532                 NCR_WRITE_REG(sc, NCR_SYNCOFF, 0);
 533                 NCR_WRITE_REG(sc, NCR_TIMEOUT, sc->sc_timeout);
 534                 break;
 535
 536         default:
 537                 device_printf(sc->sc_dev,
 538                     "unknown revision code, assuming ESP100\n");
 539                 NCR_WRITE_REG(sc, NCR_CFG1, sc->sc_cfg1);
 540                 NCR_WRITE_REG(sc, NCR_CCF, sc->sc_ccf);
 541                 NCR_WRITE_REG(sc, NCR_SYNCOFF, 0);
 542                 NCR_WRITE_REG(sc, NCR_TIMEOUT, sc->sc_timeout);
 543         }
 544
 545         if (sc->sc_rev == NCR_VARIANT_AM53C974)
 546                 NCR_WRITE_REG(sc, NCR_AMDCFG4, sc->sc_cfg4);
 547
 548 #if 0
 549         device_printf(sc->sc_dev, "%s: revision %d\n", __func__, sc->sc_rev);
 550         device_printf(sc->sc_dev, "%s: cfg1 0x%x, cfg2 0x%x, cfg3 0x%x, ccf "
 551             "0x%x, timeout 0x%x\n", __func__, sc->sc_cfg1, sc->sc_cfg2,
 552             sc->sc_cfg3, sc->sc_ccf, sc->sc_timeout);
 553 #endif
 554 }
 555
 556 /*
 557  * Clear all commands.
 558  */
 559 static void
 560 ncr53c9x_clear(struct ncr53c9x_softc *sc, cam_status result)
 561 {
 562         struct ncr53c9x_ecb *ecb;
 563         int r;
 564
 565         NCR_LOCK_ASSERT(sc, MA_OWNED);
 566
 567         /* Cancel any active commands. */
 568         sc->sc_state = NCR_CLEANING;
 569         sc->sc_msgify = 0;
 570         ecb = sc->sc_nexus;
 571         if (ecb != NULL) {
 572                 ecb->ccb->ccb_h.status = result;
 573                 ncr53c9x_done(sc, ecb);
 574         }
 575         /* Cancel outstanding disconnected commands. */
 576         for (r = 0; r < sc->sc_ntarg; r++)
 577                 ncr53c9x_clear_target(sc, r, result);
 578 }
 579
 580 /*
 581  * Clear all commands for a specific target.
 582  */
 583 static void
 584 ncr53c9x_clear_target(struct ncr53c9x_softc *sc, int target,
 585     cam_status result)
 586 {
 587         struct ncr53c9x_ecb *ecb;
 588         struct ncr53c9x_linfo *li;
 589         int i;
 590
 591         NCR_LOCK_ASSERT(sc, MA_OWNED);
 592
 593         /* Cancel outstanding disconnected commands on each LUN. */
 594         LIST_FOREACH(li, &sc->sc_tinfo[target].luns, link) {
 595                 ecb = li->untagged;
 596                 if (ecb != NULL) {
 597                         li->untagged = NULL;
 598                         /*
 599                          * XXX should we terminate a command
 600                          * that never reached the disk?
 601                          */
 602                         li->busy = 0;
 603                         ecb->ccb->ccb_h.status = result;
 604                         ncr53c9x_done(sc, ecb);
 605                 }
 606                 for (i = 0; i < NCR_TAG_DEPTH; i++) {
 607                         ecb = li->queued[i];
 608                         if (ecb != NULL) {
 609                                 li->queued[i] = NULL;
 610                                 ecb->ccb->ccb_h.status = result;
 611                                 ncr53c9x_done(sc, ecb);
 612                         }
 613                 }
 614                 li->used = 0;
 615         }
 616 }
 617
 618 /*
 619  * Initialize ncr53c9x state machine.
 620  */
 621 static void
 622 ncr53c9x_init(struct ncr53c9x_softc *sc, int doreset)
 623 {
 624         struct ncr53c9x_tinfo *ti;
 625         int r;
 626
 627         NCR_LOCK_ASSERT(sc, MA_OWNED);
 628
 629         NCR_MISC(("[NCR_INIT(%d) %d] ", doreset, sc->sc_state));
 630
 631         if (sc->sc_state == 0) {
 632                 /* First time through; initialize. */
 633
 634                 TAILQ_INIT(&sc->ready_list);
 635                 sc->sc_nexus = NULL;
 636                 memset(sc->sc_tinfo, 0, sizeof(*sc->sc_tinfo));
 637                 for (r = 0; r < sc->sc_ntarg; r++) {
 638                         LIST_INIT(&sc->sc_tinfo[r].luns);
 639                 }
 640         } else
 641                 ncr53c9x_clear(sc, CAM_CMD_TIMEOUT);
 642
 643         /*
 644          * Reset the chip to a known state.
 645          */
 646         ncr53c9x_reset(sc);
 647
 648         sc->sc_flags = 0;
 649         sc->sc_msgpriq = sc->sc_msgout = sc->sc_msgoutq = 0;
 650         sc->sc_phase = sc->sc_prevphase = INVALID_PHASE;
 651
 652         /*
 653          * If we're the first time through, set the default parameters
 654          * for all targets.  Otherwise we only clear their current transfer
 655          * settings so we'll renegotiate their goal settings with the next
 656          * command.
 657          */
 658         if (sc->sc_state == 0) {
 659                 for (r = 0; r < sc->sc_ntarg; r++) {
 660                         ti = &sc->sc_tinfo[r];
 661 /* XXX - config flags per target: low bits: no reselect; high bits: no synch */
 662
 663                         ti->flags = ((sc->sc_minsync != 0 &&
 664                             (sc->sc_cfflags & (1 << ((r & 7) + 8))) == 0) ?
 665                             0 : T_SYNCHOFF) |
 666                             ((sc->sc_cfflags & (1 << (r & 7))) == 0 ?
 667                             0 : T_RSELECTOFF);
 668                         ti->curr.period = ti->goal.period = 0;
 669                         ti->curr.offset = ti->goal.offset = 0;
 670                         ti->curr.width = ti->goal.width =
 671                             MSG_EXT_WDTR_BUS_8_BIT;
 672                 }
 673         } else {
 674                 for (r = 0; r < sc->sc_ntarg; r++) {
 675                         ti = &sc->sc_tinfo[r];
 676                         ti->flags &= ~(T_SDTRSENT | T_WDTRSENT);
 677                         ti->curr.period = 0;
 678                         ti->curr.offset = 0;
 679                         ti->curr.width = MSG_EXT_WDTR_BUS_8_BIT;
 680                 }
 681         }
 682
 683         if (doreset) {
 684                 sc->sc_state = NCR_SBR;
 685                 NCRCMD(sc, NCRCMD_RSTSCSI);
 686                 /* Give the bus a fighting chance to settle. */
 687                 DELAY(250000);
 688         } else {
 689                 sc->sc_state = NCR_IDLE;
 690                 ncr53c9x_sched(sc);
 691         }
 692 }
 693
 694 /*
 695  * Read the NCR registers, and save their contents for later use.
 696  * NCR_STAT, NCR_STEP & NCR_INTR are mostly zeroed out when reading
 697  * NCR_INTR - so make sure it is the last read.
 698  *
 699  * I think that (from reading the docs) most bits in these registers
 700  * only make sense when the DMA CSR has an interrupt showing.  Call only
 701  * if an interrupt is pending.
 702  */
 703 static inline void
 704 ncr53c9x_readregs(struct ncr53c9x_softc *sc)
 705 {
 706
 707         NCR_LOCK_ASSERT(sc, MA_OWNED);
 708
 709         sc->sc_espstat = NCR_READ_REG(sc, NCR_STAT);
 710         /* Only the step bits are of interest. */
 711         sc->sc_espstep = NCR_READ_REG(sc, NCR_STEP) & NCRSTEP_MASK;
 712
 713         if (sc->sc_rev == NCR_VARIANT_FAS366)
 714                 sc->sc_espstat2 = NCR_READ_REG(sc, NCR_STAT2);
 715
 716         sc->sc_espintr = NCR_READ_REG(sc, NCR_INTR);
 717
 718         /*
 719          * Determine the SCSI bus phase, return either a real SCSI bus phase
 720          * or some pseudo phase we use to detect certain exceptions.
 721          */
 722         sc->sc_phase = (sc->sc_espintr & NCRINTR_DIS) ?
 723             BUSFREE_PHASE : sc->sc_espstat & NCRSTAT_PHASE;
 724
 725         NCR_INTS(("regs[intr=%02x,stat=%02x,step=%02x,stat2=%02x] ",
 726             sc->sc_espintr, sc->sc_espstat, sc->sc_espstep, sc->sc_espstat2));
 727 }
 728
 729 /*
 730  * Convert Synchronous Transfer Period to chip register Clock Per Byte value.
 731  */
 732 static inline int
 733 ncr53c9x_stp2cpb(struct ncr53c9x_softc *sc, int period)
 734 {
 735         int v;
 736
 737         NCR_LOCK_ASSERT(sc, MA_OWNED);
 738
 739         v = (sc->sc_freq * period) / 250;
 740         if (ncr53c9x_cpb2stp(sc, v) < period)
 741                 /* Correct round-down error. */
 742                 v++;
 743         return (v);
 744 }
 745
 746 static inline void
 747 ncr53c9x_setsync(struct ncr53c9x_softc *sc, struct ncr53c9x_tinfo *ti)
 748 {
 749         uint8_t cfg3, syncoff, synctp;
 750
 751         NCR_LOCK_ASSERT(sc, MA_OWNED);
 752
 753         cfg3 = sc->sc_cfg3;
 754         if (ti->curr.offset != 0) {
 755                 syncoff = ti->curr.offset;
 756                 synctp = ncr53c9x_stp2cpb(sc, ti->curr.period);
 757                 if (sc->sc_features & NCR_F_FASTSCSI) {
 758                         /*
 759                          * If the period is 200ns or less (ti->period <= 50),
 760                          * put the chip in Fast SCSI mode.
 761                          */
 762                         if (ti->curr.period <= 50)
 763                                 /*
 764                                  * There are (at least) 4 variations of the
 765                                  * configuration 3 register.  The drive attach
 766                                  * routine sets the appropriate bit to put the
 767                                  * chip into Fast SCSI mode so that it doesn't
 768                                  * have to be figured out here each time.
 769                                  */
 770                                 cfg3 |= sc->sc_cfg3_fscsi;
 771                 }
 772
 773                 /*
 774                  * Am53c974 requires different SYNCTP values when the
 775                  * FSCSI bit is off.
 776                  */
 777                 if (sc->sc_rev == NCR_VARIANT_AM53C974 &&
 778                     (cfg3 & NCRAMDCFG3_FSCSI) == 0)
 779                         synctp--;
 780         } else {
 781                 syncoff = 0;
 782                 synctp = 0;
 783         }
 784
 785         if (ti->curr.width != MSG_EXT_WDTR_BUS_8_BIT) {
 786                 if (sc->sc_rev == NCR_VARIANT_FAS366)
 787                         cfg3 |= NCRFASCFG3_EWIDE;
 788         }
 789
 790         if (sc->sc_features & NCR_F_HASCFG3)
 791                 NCR_WRITE_REG(sc, NCR_CFG3, cfg3);
 792
 793         NCR_WRITE_REG(sc, NCR_SYNCOFF, syncoff);
 794         NCR_WRITE_REG(sc, NCR_SYNCTP, synctp);
 795 }
 796
 797 /*
 798  * Send a command to a target, set the driver state to NCR_SELECTING
 799  * and let the caller take care of the rest.
 800  *
 801  * Keeping this as a function allows me to say that this may be done
 802  * by DMA instead of programmed I/O soon.
 803  */
 804 static void
 805 ncr53c9x_select(struct ncr53c9x_softc *sc, struct ncr53c9x_ecb *ecb)
 806 {
 807         struct ncr53c9x_tinfo *ti;
 808         uint8_t *cmd;
 809         size_t dmasize;
 810         int clen, error, selatn3, selatns;
 811         int lun = ecb->ccb->ccb_h.target_lun;
 812         int target = ecb->ccb->ccb_h.target_id;
 813
 814         NCR_LOCK_ASSERT(sc, MA_OWNED);
 815
 816         NCR_TRACE(("[%s(t%d,l%d,cmd:%x,tag:%x,%x)] ", __func__, target, lun,
 817             ecb->cmd.cmd.opcode, ecb->tag[0], ecb->tag[1]));
 818
 819         ti = &sc->sc_tinfo[target];
 820         sc->sc_state = NCR_SELECTING;
 821         /*
 822          * Schedule the callout now, the first time we will go away
 823          * expecting to come back due to an interrupt, because it is
 824          * always possible that the interrupt may never happen.
 825          */
 826         callout_reset(&ecb->ch, mstohz(ecb->timeout), ncr53c9x_callout, ecb);
 827
 828         /*
 829          * The docs say the target register is never reset, and I
 830          * can't think of a better place to set it.
 831          */
 832         if (sc->sc_rev == NCR_VARIANT_FAS366) {
 833                 NCRCMD(sc, NCRCMD_FLUSH);
 834                 NCR_WRITE_REG(sc, NCR_SELID, target | NCR_BUSID_HMEXC32 |
 835                     NCR_BUSID_HMEENCID);
 836         } else
 837                 NCR_WRITE_REG(sc, NCR_SELID, target);
 838
 839         /*
 840          * If we are requesting sense, force a renegotiation if we are
 841          * currently using anything different from asynchronous at 8 bit
 842          * as the target might have lost our transfer negotiations.
 843          */
 844         if ((ecb->flags & ECB_SENSE) != 0 && (ti->curr.offset != 0 ||
 845             ti->curr.width != MSG_EXT_WDTR_BUS_8_BIT)) {
 846                 ti->curr.period = 0;
 847                 ti->curr.offset = 0;
 848                 ti->curr.width = MSG_EXT_WDTR_BUS_8_BIT;
 849         }
 850         ncr53c9x_setsync(sc, ti);
 851
 852         selatn3 = selatns = 0;
 853         if (ecb->tag[0] != 0) {
 854                 if (sc->sc_features & NCR_F_SELATN3)
 855                         /* Use SELATN3 to send tag messages. */
 856                         selatn3 = 1;
 857                 else
 858                         /* We don't have SELATN3; use SELATNS to send tags. */
 859                         selatns = 1;
 860         }
 861
 862         if (ti->curr.period != ti->goal.period ||
 863             ti->curr.offset != ti->goal.offset ||
 864             ti->curr.width != ti->goal.width) {
 865                 /* We have to use SELATNS to send sync/wide messages. */
 866                 selatn3 = 0;
 867                 selatns = 1;
 868         }
 869
 870         cmd = (uint8_t *)&ecb->cmd.cmd;
 871
 872         if (selatn3) {
 873                 /* We'll use tags with SELATN3. */
 874                 clen = ecb->clen + 3;
 875                 cmd -= 3;
 876                 cmd[0] = MSG_IDENTIFY(lun, 1);  /* msg[0] */
 877                 cmd[1] = ecb->tag[0];           /* msg[1] */
 878                 cmd[2] = ecb->tag[1];           /* msg[2] */
 879         } else {
 880                 /* We don't have tags, or will send messages with SELATNS. */
 881                 clen = ecb->clen + 1;
 882                 cmd -= 1;
 883                 cmd[0] = MSG_IDENTIFY(lun, (ti->flags & T_RSELECTOFF) == 0);
 884         }
 885
 886         if ((sc->sc_features & NCR_F_DMASELECT) && !selatns) {
 887                 /* Setup DMA transfer for command. */
 888                 dmasize = clen;
 889                 sc->sc_cmdlen = clen;
 890                 sc->sc_cmdp = cmd;
 891                 error = NCRDMA_SETUP(sc, &sc->sc_cmdp, &sc->sc_cmdlen, 0,
 892                     &dmasize);
 893                 if (error != 0)
 894                         goto cmd;
 895
 896                 /* Program the SCSI counter. */
 897                 NCR_SET_COUNT(sc, dmasize);
 898
 899                 /* Load the count in. */
 900                 NCRCMD(sc, NCRCMD_NOP | NCRCMD_DMA);
 901
 902                 /* And get the target's attention. */
 903                 if (selatn3) {
 904                         sc->sc_msgout = SEND_TAG;
 905                         sc->sc_flags |= NCR_ATN;
 906                         NCRCMD(sc, NCRCMD_SELATN3 | NCRCMD_DMA);
 907                 } else
 908                         NCRCMD(sc, NCRCMD_SELATN | NCRCMD_DMA);
 909                 NCRDMA_GO(sc);
 910                 return;
 911         }
 912
 913 cmd:
 914         /*
 915          * Who am I?  This is where we tell the target that we are
 916          * happy for it to disconnect etc.
 917          */
 918
 919         /* Now get the command into the FIFO. */
 920         sc->sc_cmdlen = 0;
 921         ncr53c9x_wrfifo(sc, cmd, clen);
 922
 923         /* And get the target's attention. */
 924         if (selatns) {
 925                 NCR_MSGS(("SELATNS \n"));
 926                 /* Arbitrate, select and stop after IDENTIFY message. */
 927                 NCRCMD(sc, NCRCMD_SELATNS);
 928         } else if (selatn3) {
 929                 sc->sc_msgout = SEND_TAG;
 930                 sc->sc_flags |= NCR_ATN;
 931                 NCRCMD(sc, NCRCMD_SELATN3);
 932         } else
 933                 NCRCMD(sc, NCRCMD_SELATN);
 934 }
 935
 936 static void
 937 ncr53c9x_free_ecb(struct ncr53c9x_softc *sc, struct ncr53c9x_ecb *ecb)
 938 {
 939
 940         NCR_LOCK_ASSERT(sc, MA_OWNED);
 941
 942         ecb->flags = 0;
 943         TAILQ_INSERT_TAIL(&sc->free_list, ecb, free_links);
 944 }
 945
 946 static struct ncr53c9x_ecb *
 947 ncr53c9x_get_ecb(struct ncr53c9x_softc *sc)
 948 {
 949         struct ncr53c9x_ecb *ecb;
 950
 951         NCR_LOCK_ASSERT(sc, MA_OWNED);
 952
 953         ecb = TAILQ_FIRST(&sc->free_list);
 954         if (ecb) {
 955                 if (ecb->flags != 0)
 956                         panic("%s: ecb flags not cleared", __func__);
 957                 TAILQ_REMOVE(&sc->free_list, ecb, free_links);
 958                 ecb->flags = ECB_ALLOC;
 959                 bzero(&ecb->ccb, sizeof(struct ncr53c9x_ecb) -
 960                     offsetof(struct ncr53c9x_ecb, ccb));
 961         }
 962         return (ecb);
 963 }
 964
 965 /*
 966  * DRIVER FUNCTIONS CALLABLE FROM HIGHER LEVEL DRIVERS:
 967  */
 968
 969 /*
 970  * Start a SCSI-command.
 971  * This function is called by the higher level SCSI-driver to queue/run
 972  * SCSI-commands.
 973  */
 974
 975 static void
 976 ncr53c9x_action(struct cam_sim *sim, union ccb *ccb)
 977 {
 978         struct ccb_pathinq *cpi;
 979         struct ccb_scsiio *csio;
 980         struct ccb_trans_settings *cts;
 981         struct ccb_trans_settings_scsi *scsi;
 982         struct ccb_trans_settings_spi *spi;
 983         struct ncr53c9x_ecb *ecb;
 984         struct ncr53c9x_softc *sc;
 985         struct ncr53c9x_tinfo *ti;
 986         int target;
 987
 988         sc = cam_sim_softc(sim);
 989
 990         NCR_LOCK_ASSERT(sc, MA_OWNED);
 991
 992         NCR_TRACE(("[%s %d]", __func__, ccb->ccb_h.func_code));
 993
 994         switch (ccb->ccb_h.func_code) {
 995         case XPT_RESET_BUS:
 996                 ncr53c9x_init(sc, 1);
 997                 ccb->ccb_h.status = CAM_REQ_CMP;
 998                 break;
 999
1000         case XPT_CALC_GEOMETRY:
1001                 cam_calc_geometry(&ccb->ccg, sc->sc_extended_geom);
1002                 break;
1003
1004         case XPT_PATH_INQ:
1005                 cpi = &ccb->cpi;
1006                 cpi->version_num = 1;
1007                 cpi->hba_inquiry = PI_SDTR_ABLE | PI_TAG_ABLE;
1008                 cpi->hba_inquiry |=
1009                     (sc->sc_rev == NCR_VARIANT_FAS366) ? PI_WIDE_16 : 0;
1010                 cpi->target_sprt = 0;
1011                 cpi->hba_misc = 0;
1012                 cpi->hba_eng_cnt = 0;
1013                 cpi->max_target = sc->sc_ntarg - 1;
1014                 cpi->max_lun = 7;
1015                 cpi->initiator_id = sc->sc_id;
1016                 strncpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
1017                 strncpy(cpi->hba_vid, "NCR", HBA_IDLEN);
1018                 strncpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
1019                 cpi->unit_number = cam_sim_unit(sim);
1020                 cpi->bus_id = 0;
1021                 cpi->base_transfer_speed = 3300;
1022                 cpi->protocol = PROTO_SCSI;
1023                 cpi->protocol_version = SCSI_REV_2;
1024                 cpi->transport = XPORT_SPI;
1025                 cpi->transport_version = 2;
1026                 cpi->maxio = sc->sc_maxxfer;
1027                 ccb->ccb_h.status = CAM_REQ_CMP;
1028                 break;
1029
1030         case XPT_GET_TRAN_SETTINGS:
1031                 cts = &ccb->cts;
1032                 ti = &sc->sc_tinfo[ccb->ccb_h.target_id];
1033                 scsi = &cts->proto_specific.scsi;
1034                 spi = &cts->xport_specific.spi;
1035
1036                 cts->protocol = PROTO_SCSI;
1037                 cts->protocol_version = SCSI_REV_2;
1038                 cts->transport = XPORT_SPI;
1039                 cts->transport_version = 2;
1040
1041                 if (cts->type == CTS_TYPE_CURRENT_SETTINGS) {
1042                         spi->sync_period = ti->curr.period;
1043                         spi->sync_offset = ti->curr.offset;
1044                         spi->bus_width = ti->curr.width;
1045                         if ((ti->flags & T_TAG) != 0) {
1046                                 spi->flags |= CTS_SPI_FLAGS_DISC_ENB;
1047                                 scsi->flags |= CTS_SCSI_FLAGS_TAG_ENB;
1048                         } else {
1049                                 spi->flags &= ~CTS_SPI_FLAGS_DISC_ENB;
1050                                 scsi->flags &= ~CTS_SCSI_FLAGS_TAG_ENB;
1051                         }
1052                 } else {
1053                         if ((ti->flags & T_SYNCHOFF) != 0) {
1054                                 spi->sync_period = 0;
1055                                 spi->sync_offset = 0;
1056                         } else {
1057                                 spi->sync_period = sc->sc_minsync;
1058                                 spi->sync_offset = sc->sc_maxoffset;
1059                         }
1060                         spi->bus_width = sc->sc_maxwidth;
1061                         spi->flags |= CTS_SPI_FLAGS_DISC_ENB;
1062                         scsi->flags |= CTS_SCSI_FLAGS_TAG_ENB;
1063                 }
1064                 spi->valid =
1065                     CTS_SPI_VALID_BUS_WIDTH |
1066                     CTS_SPI_VALID_SYNC_RATE |
1067                     CTS_SPI_VALID_SYNC_OFFSET |
1068                     CTS_SPI_VALID_DISC;
1069                 scsi->valid = CTS_SCSI_VALID_TQ;
1070                 ccb->ccb_h.status = CAM_REQ_CMP;
1071                 break;
1072
1073         case XPT_ABORT:
1074                 device_printf(sc->sc_dev, "XPT_ABORT called\n");
1075                 ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
1076                 break;
1077
1078         case XPT_TERM_IO:
1079                 device_printf(sc->sc_dev, "XPT_TERM_IO called\n");
1080                 ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
1081                 break;
1082
1083         case XPT_RESET_DEV:
1084         case XPT_SCSI_IO:
1085                 if (ccb->ccb_h.target_id >= sc->sc_ntarg) {
1086                         ccb->ccb_h.status = CAM_PATH_INVALID;
1087                         goto done;
1088                 }
1089                 /* Get an ECB to use. */
1090                 ecb = ncr53c9x_get_ecb(sc);
1091                 /*
1092                  * This should never happen as we track resources
1093                  * in the mid-layer.
1094                  */
1095                 if (ecb == NULL) {
1096                         xpt_freeze_simq(sim, 1);
1097                         ccb->ccb_h.status = CAM_REQUEUE_REQ;
1098                         device_printf(sc->sc_dev, "unable to allocate ecb\n");
1099                         goto done;
1100                 }
1101
1102                 /* Initialize ecb. */
1103                 ecb->ccb = ccb;
1104                 ecb->timeout = ccb->ccb_h.timeout;
1105
1106                 if (ccb->ccb_h.func_code == XPT_RESET_DEV) {
1107                         ecb->flags |= ECB_RESET;
1108                         ecb->clen = 0;
1109                         ecb->dleft = 0;
1110                 } else {
1111                         csio = &ccb->csio;
1112                         if ((ccb->ccb_h.flags & CAM_CDB_POINTER) != 0)
1113                                 bcopy(csio->cdb_io.cdb_ptr, &ecb->cmd.cmd,
1114                                     csio->cdb_len);
1115                         else
1116                                 bcopy(csio->cdb_io.cdb_bytes, &ecb->cmd.cmd,
1117                                     csio->cdb_len);
1118                         ecb->clen = csio->cdb_len;
1119                         ecb->daddr = csio->data_ptr;
1120                         ecb->dleft = csio->dxfer_len;
1121                 }
1122                 ecb->stat = 0;
1123
1124                 TAILQ_INSERT_TAIL(&sc->ready_list, ecb, chain);
1125                 ecb->flags |= ECB_READY;
1126                 if (sc->sc_state == NCR_IDLE)
1127                         ncr53c9x_sched(sc);
1128                 return;
1129
1130         case XPT_SET_TRAN_SETTINGS:
1131                 cts = &ccb->cts;
1132                 target = ccb->ccb_h.target_id;
1133                 ti = &sc->sc_tinfo[target];
1134                 scsi = &cts->proto_specific.scsi;
1135                 spi = &cts->xport_specific.spi;
1136
1137                 if ((scsi->valid & CTS_SCSI_VALID_TQ) != 0) {
1138                         if ((sc->sc_cfflags & (1<<((target & 7) + 16))) == 0 &&
1139                             (scsi->flags & CTS_SCSI_FLAGS_TAG_ENB)) {
1140                                 NCR_MISC(("%s: target %d: tagged queuing\n",
1141                                     device_get_nameunit(sc->sc_dev), target));
1142                                 ti->flags |= T_TAG;
1143                         } else
1144                                 ti->flags &= ~T_TAG;
1145                 }
1146
1147                 if ((spi->valid & CTS_SPI_VALID_BUS_WIDTH) != 0) {
1148                         NCR_MISC(("%s: target %d: wide negotiation\n",
1149                             device_get_nameunit(sc->sc_dev), target));
1150                         ti->goal.width = spi->bus_width;
1151                 }
1152
1153                 if ((spi->valid & CTS_SPI_VALID_SYNC_RATE) != 0) {
1154                         NCR_MISC(("%s: target %d: sync period negotiation\n",
1155                             device_get_nameunit(sc->sc_dev), target));
1156                         ti->goal.period = spi->sync_period;
1157                 }
1158
1159                 if ((spi->valid & CTS_SPI_VALID_SYNC_OFFSET) != 0) {
1160                         NCR_MISC(("%s: target %d: sync offset negotiation\n",
1161                             device_get_nameunit(sc->sc_dev), target));
1162                         ti->goal.offset = spi->sync_offset;
1163                 }
1164
1165                 ccb->ccb_h.status = CAM_REQ_CMP;
1166                 break;
1167
1168         default:
1169                 device_printf(sc->sc_dev, "Unhandled function code %d\n",
1170                     ccb->ccb_h.func_code);
1171                 ccb->ccb_h.status = CAM_PROVIDE_FAIL;
1172         }
1173
1174 done:
1175         xpt_done(ccb);
1176 }
1177
1178 /*
1179  * Used when interrupt driven I/O is not allowed, e.g. during boot.
1180  */
1181 static void
1182 ncr53c9x_poll(struct cam_sim *sim)
1183 {
1184         struct ncr53c9x_softc *sc;
1185
1186         sc = cam_sim_softc(sim);
1187
1188         NCR_LOCK_ASSERT(sc, MA_OWNED);
1189
1190         NCR_TRACE(("[%s] ", __func__));
1191
1192         if (NCRDMA_ISINTR(sc))
1193                 ncr53c9x_intr1(sc);
1194 }
1195
1196 /*
1197  *  Asynchronous notification handler
1198  */
1199 static void
1200 ncr53c9x_async(void *cbarg, uint32_t code, struct cam_path *path, void *arg)
1201 {
1202         struct ncr53c9x_softc *sc;
1203         struct ncr53c9x_tinfo *ti;
1204         int target;
1205
1206         sc = cam_sim_softc(cbarg);
1207
1208         NCR_LOCK_ASSERT(sc, MA_OWNED);
1209
1210         switch (code) {
1211         case AC_LOST_DEVICE:
1212                 target = xpt_path_target_id(path);
1213                 if (target < 0 || target >= sc->sc_ntarg)
1214                         break;
1215
1216                 /* Cancel outstanding disconnected commands. */
1217                 ncr53c9x_clear_target(sc, target, CAM_REQ_ABORTED);
1218
1219                 /* Set the default parameters for the target. */
1220                 ti = &sc->sc_tinfo[target];
1221 /* XXX - config flags per target: low bits: no reselect; high bits: no synch */
1222                 ti->flags = ((sc->sc_minsync != 0 &&
1223                     (sc->sc_cfflags & (1 << ((target & 7) + 8))) == 0) ?
1224                     0 : T_SYNCHOFF) |
1225                     ((sc->sc_cfflags & (1 << (target & 7))) == 0 ?
1226                     0 : T_RSELECTOFF);
1227                 ti->curr.period = ti->goal.period = 0;
1228                 ti->curr.offset = ti->goal.offset = 0;
1229                 ti->curr.width = ti->goal.width = MSG_EXT_WDTR_BUS_8_BIT;
1230                 break;
1231         }
1232 }
1233
1234 /*
1235  * LOW LEVEL SCSI UTILITIES
1236  */
1237
1238 /*
1239  * Schedule a SCSI operation.  This has now been pulled out of the interrupt
1240  * handler so that we may call it from ncr53c9x_action and ncr53c9x_done.
1241  * This may save us an unnecessary interrupt just to get things going.
1242  * Should only be called when state == NCR_IDLE and with sc_lock held.
1243  */
1244 static void
1245 ncr53c9x_sched(struct ncr53c9x_softc *sc)
1246 {
1247         struct ncr53c9x_ecb *ecb;
1248         struct ncr53c9x_linfo *li;
1249         struct ncr53c9x_tinfo *ti;
1250         int lun, tag;
1251
1252         NCR_LOCK_ASSERT(sc, MA_OWNED);
1253
1254         NCR_TRACE(("[%s] ", __func__));
1255
1256         if (sc->sc_state != NCR_IDLE)
1257                 panic("%s: not IDLE (state=%d)", __func__, sc->sc_state);
1258
1259         /*
1260          * Find first ecb in ready queue that is for a target/lunit
1261          * combinations that is not busy.
1262          */
1263         TAILQ_FOREACH(ecb, &sc->ready_list, chain) {
1264                 ti = &sc->sc_tinfo[ecb->ccb->ccb_h.target_id];
1265                 lun = ecb->ccb->ccb_h.target_lun;
1266
1267                 /* Select type of tag for this command */
1268                 if ((ti->flags & (T_RSELECTOFF | T_TAG)) != T_TAG)
1269                         tag = 0;
1270                 else if ((ecb->flags & ECB_SENSE) != 0)
1271                         tag = 0;
1272                 else if ((ecb->ccb->ccb_h.flags & CAM_TAG_ACTION_VALID) == 0)
1273                         tag = 0;
1274                 else if (ecb->ccb->csio.tag_action == CAM_TAG_ACTION_NONE)
1275                         tag = 0;
1276                 else
1277                         tag = ecb->ccb->csio.tag_action;
1278
1279                 li = TINFO_LUN(ti, lun);
1280                 if (li == NULL) {
1281                         /* Initialize LUN info and add to list. */
1282                         li = malloc(sizeof(*li), M_DEVBUF, M_NOWAIT | M_ZERO);
1283                         if (li == NULL)
1284                                 continue;
1285                         li->lun = lun;
1286
1287                         LIST_INSERT_HEAD(&ti->luns, li, link);
1288                         if (lun < NCR_NLUN)
1289                                 ti->lun[lun] = li;
1290                 }
1291                 li->last_used = time_second;
1292                 if (tag == 0) {
1293                         /* Try to issue this as an untagged command. */
1294                         if (li->untagged == NULL)
1295                                 li->untagged = ecb;
1296                 }
1297                 if (li->untagged != NULL) {
1298                         tag = 0;
1299                         if ((li->busy != 1) && li->used == 0) {
1300                                 /*
1301                                  * We need to issue this untagged command
1302                                  * now.
1303                                  */
1304                                 ecb = li->untagged;
1305                         } else {
1306                                 /* not ready, yet */
1307                                 continue;
1308                         }
1309                 }
1310                 ecb->tag[0] = tag;
1311                 if (tag != 0) {
1312                         li->queued[ecb->tag_id] = ecb;
1313                         ecb->tag[1] = ecb->tag_id;
1314                         li->used++;
1315                 }
1316                 if (li->untagged != NULL && (li->busy != 1)) {
1317                         li->busy = 1;
1318                         TAILQ_REMOVE(&sc->ready_list, ecb, chain);
1319                         ecb->flags &= ~ECB_READY;
1320                         sc->sc_nexus = ecb;
1321                         ncr53c9x_select(sc, ecb);
1322                         break;
1323                 }
1324                 if (li->untagged == NULL && tag != 0) {
1325                         TAILQ_REMOVE(&sc->ready_list, ecb, chain);
1326                         ecb->flags &= ~ECB_READY;
1327                         sc->sc_nexus = ecb;
1328                         ncr53c9x_select(sc, ecb);
1329                         break;
1330                 } else
1331                         NCR_TRACE(("[%s %d:%d busy] \n", __func__,
1332                             ecb->ccb->ccb_h.target_id,
1333                             ecb->ccb->ccb_h.target_lun));
1334         }
1335 }
1336
1337 static void
1338 ncr53c9x_sense(struct ncr53c9x_softc *sc, struct ncr53c9x_ecb *ecb)
1339 {
1340         union ccb *ccb = ecb->ccb;
1341         struct ncr53c9x_linfo *li;
1342         struct ncr53c9x_tinfo *ti;
1343         struct scsi_request_sense *ss = (void *)&ecb->cmd.cmd;
1344         int lun;
1345
1346         NCR_LOCK_ASSERT(sc, MA_OWNED);
1347
1348         NCR_TRACE(("[%s] ", __func__));
1349
1350         lun = ccb->ccb_h.target_lun;
1351         ti = &sc->sc_tinfo[ccb->ccb_h.target_id];
1352
1353         /* Next, setup a REQUEST SENSE command block. */
1354         memset(ss, 0, sizeof(*ss));
1355         ss->opcode = REQUEST_SENSE;
1356         ss->byte2 = ccb->ccb_h.target_lun << SCSI_CMD_LUN_SHIFT;
1357         ss->length = sizeof(struct scsi_sense_data);
1358         ecb->clen = sizeof(*ss);
1359         memset(&ccb->csio.sense_data, 0, sizeof(ccb->csio.sense_data));
1360         ecb->daddr = (uint8_t *)&ccb->csio.sense_data;
1361         ecb->dleft = sizeof(struct scsi_sense_data);
1362         ecb->flags |= ECB_SENSE;
1363         ecb->timeout = NCR_SENSE_TIMEOUT;
1364         ti->senses++;
1365         li = TINFO_LUN(ti, lun);
1366         if (li->busy)
1367                 li->busy = 0;
1368         ncr53c9x_dequeue(sc, ecb);
1369         li->untagged = ecb;     /* Must be executed first to fix C/A. */
1370         li->busy = 2;
1371         if (ecb == sc->sc_nexus)
1372                 ncr53c9x_select(sc, ecb);
1373         else {
1374                 TAILQ_INSERT_HEAD(&sc->ready_list, ecb, chain);
1375                 ecb->flags |= ECB_READY;
1376                 if (sc->sc_state == NCR_IDLE)
1377                         ncr53c9x_sched(sc);
1378         }
1379 }
1380
1381 /*
1382  * POST PROCESSING OF SCSI_CMD (usually current)
1383  */
1384 static void
1385 ncr53c9x_done(struct ncr53c9x_softc *sc, struct ncr53c9x_ecb *ecb)
1386 {
1387         union ccb *ccb = ecb->ccb;
1388         struct ncr53c9x_linfo *li;
1389         struct ncr53c9x_tinfo *ti;
1390         int lun, sense_returned;
1391
1392         NCR_LOCK_ASSERT(sc, MA_OWNED);
1393
1394         NCR_TRACE(("[%s(status:%x)] ", __func__, ccb->ccb_h.status));
1395
1396         ti = &sc->sc_tinfo[ccb->ccb_h.target_id];
1397         lun = ccb->ccb_h.target_lun;
1398         li = TINFO_LUN(ti, lun);
1399
1400         callout_stop(&ecb->ch);
1401
1402         /*
1403          * Now, if we've come here with no error code, i.e. we've kept the
1404          * initial CAM_REQ_CMP, and the status code signals that we should
1405          * check sense, we'll need to set up a request sense cmd block and
1406          * push the command back into the ready queue *before* any other
1407          * commands for this target/lunit, else we lose the sense info.
1408          * We don't support chk sense conditions for the request sense cmd.
1409          */
1410         if (ccb->ccb_h.status == CAM_REQ_CMP) {
1411                 ccb->csio.scsi_status = ecb->stat;
1412                 if ((ecb->flags & ECB_ABORT) != 0)
1413                         ccb->ccb_h.status = CAM_CMD_TIMEOUT;
1414                 else if ((ecb->flags & ECB_SENSE) != 0 &&
1415                    (ecb->stat != SCSI_STATUS_CHECK_COND)) {
1416                         ccb->csio.scsi_status = SCSI_STATUS_CHECK_COND;
1417                         ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR |
1418                             CAM_AUTOSNS_VALID;
1419                         sense_returned = sizeof(ccb->csio.sense_data) -
1420                             ecb->dleft;
1421                         if (sense_returned < ccb->csio.sense_len)
1422                                 ccb->csio.sense_resid = ccb->csio.sense_len -
1423                                     sense_returned;
1424                         else
1425                                 ccb->csio.sense_resid = 0;
1426                 } else if (ecb->stat == SCSI_STATUS_CHECK_COND) {
1427                         if ((ecb->flags & ECB_SENSE) != 0)
1428                                 ccb->ccb_h.status = CAM_AUTOSENSE_FAIL;
1429                         else {
1430                                 /* First, save the return values. */
1431                                 ccb->csio.resid = ecb->dleft;
1432                                 if ((ccb->ccb_h.flags & CAM_DIS_AUTOSENSE) ==
1433                                     0) {
1434                                         ncr53c9x_sense(sc, ecb);
1435                                         return;
1436                                 }
1437                                 ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR;
1438                         }
1439                 } else
1440                         ccb->csio.resid = ecb->dleft;
1441                 if (ecb->stat == SCSI_STATUS_QUEUE_FULL)
1442                         ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR;
1443                 else if (ecb->stat == SCSI_STATUS_BUSY)
1444                         ccb->ccb_h.status = CAM_SCSI_BUSY;
1445         } else if ((ccb->ccb_h.status & CAM_DEV_QFRZN) == 0) {
1446                 ccb->ccb_h.status |= CAM_DEV_QFRZN;
1447                 xpt_freeze_devq(ccb->ccb_h.path, 1);
1448         }
1449
1450 #ifdef NCR53C9X_DEBUG
1451         if ((ncr53c9x_debug & NCR_SHOWTRAC) != 0) {
1452                 if (ccb->csio.resid != 0)
1453                         printf("resid=%d ", ccb->csio.resid);
1454                 if ((ccb->ccb_h.status & CAM_AUTOSNS_VALID) != 0)
1455                         printf("sense=0x%02x\n",
1456                             ccb->csio.sense_data.error_code);
1457                 else
1458                         printf("status SCSI=0x%x CAM=0x%x\n",
1459                             ccb->csio.scsi_status, ccb->ccb_h.status);
1460         }
1461 #endif
1462
1463         /*
1464          * Remove the ECB from whatever queue it's on.
1465          */
1466         ncr53c9x_dequeue(sc, ecb);
1467         if (ecb == sc->sc_nexus) {
1468                 sc->sc_nexus = NULL;
1469                 if (sc->sc_state != NCR_CLEANING) {
1470                         sc->sc_state = NCR_IDLE;
1471                         ncr53c9x_sched(sc);
1472                 }
1473         }
1474
1475         if ((ccb->ccb_h.status & CAM_SEL_TIMEOUT) != 0) {
1476                 /* Selection timeout -- discard this LUN if empty. */
1477                 if (li->untagged == NULL && li->used == 0) {
1478                         if (lun < NCR_NLUN)
1479                                 ti->lun[lun] = NULL;
1480                         LIST_REMOVE(li, link);
1481                         free(li, M_DEVBUF);
1482                 }
1483         }
1484
1485         ncr53c9x_free_ecb(sc, ecb);
1486         ti->cmds++;
1487         xpt_done(ccb);
1488 }
1489
1490 static void
1491 ncr53c9x_dequeue(struct ncr53c9x_softc *sc, struct ncr53c9x_ecb *ecb)
1492 {
1493         struct ncr53c9x_linfo *li;
1494         struct ncr53c9x_tinfo *ti;
1495         int64_t lun;
1496
1497         NCR_LOCK_ASSERT(sc, MA_OWNED);
1498
1499         ti = &sc->sc_tinfo[ecb->ccb->ccb_h.target_id];
1500         lun = ecb->ccb->ccb_h.target_lun;
1501         li = TINFO_LUN(ti, lun);
1502 #ifdef DIAGNOSTIC
1503         if (li == NULL || li->lun != lun)
1504                 panic("%s: lun %llx for ecb %p does not exist", __func__,
1505                     (long long)lun, ecb);
1506 #endif
1507         if (li->untagged == ecb) {
1508                 li->busy = 0;
1509                 li->untagged = NULL;
1510         }
1511         if (ecb->tag[0] && li->queued[ecb->tag[1]] != NULL) {
1512 #ifdef DIAGNOSTIC
1513                 if (li->queued[ecb->tag[1]] != NULL &&
1514                     (li->queued[ecb->tag[1]] != ecb))
1515                         panic("%s: slot %d for lun %llx has %p instead of ecb "
1516                             "%p", __func__, ecb->tag[1], (long long)lun,
1517                             li->queued[ecb->tag[1]], ecb);
1518 #endif
1519                 li->queued[ecb->tag[1]] = NULL;
1520                 li->used--;
1521         }
1522         ecb->tag[0] = ecb->tag[1] = 0;
1523
1524         if ((ecb->flags & ECB_READY) != 0) {
1525                 ecb->flags &= ~ECB_READY;
1526                 TAILQ_REMOVE(&sc->ready_list, ecb, chain);
1527         }
1528 }
1529
1530 /*
1531  * INTERRUPT/PROTOCOL ENGINE
1532  */
1533
1534 /*
1535  * Schedule an outgoing message by prioritizing it, and asserting
1536  * attention on the bus.  We can only do this when we are the initiator
1537  * else there will be an illegal command interrupt.
1538  */
1539 #define ncr53c9x_sched_msgout(m) do {                                   \
1540         NCR_MSGS(("ncr53c9x_sched_msgout %x %d", m, __LINE__));         \
1541         NCRCMD(sc, NCRCMD_SETATN);                                      \
1542         sc->sc_flags |= NCR_ATN;                                        \
1543         sc->sc_msgpriq |= (m);                                          \
1544 } while (/* CONSTCOND */0)
1545
1546 static void
1547 ncr53c9x_flushfifo(struct ncr53c9x_softc *sc)
1548 {
1549
1550         NCR_LOCK_ASSERT(sc, MA_OWNED);
1551
1552         NCR_TRACE(("[%s] ", __func__));
1553
1554         NCRCMD(sc, NCRCMD_FLUSH);
1555
1556         if (sc->sc_phase == COMMAND_PHASE ||
1557             sc->sc_phase == MESSAGE_OUT_PHASE)
1558                 DELAY(2);
1559 }
1560
1561 static int
1562 ncr53c9x_rdfifo(struct ncr53c9x_softc *sc, int how)
1563 {
1564         int i, n;
1565         uint8_t *ibuf;
1566
1567         NCR_LOCK_ASSERT(sc, MA_OWNED);
1568
1569         switch (how) {
1570         case NCR_RDFIFO_START:
1571                 ibuf = sc->sc_imess;
1572                 sc->sc_imlen = 0;
1573                 break;
1574
1575         case NCR_RDFIFO_CONTINUE:
1576                 ibuf = sc->sc_imess + sc->sc_imlen;
1577                 break;
1578
1579         default:
1580                 panic("%s: bad flag", __func__);
1581                 /* NOTREACHED */
1582         }
1583
1584         /*
1585          * XXX buffer (sc_imess) size for message
1586          */
1587
1588         n = NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF;
1589
1590         if (sc->sc_rev == NCR_VARIANT_FAS366) {
1591                 n *= 2;
1592
1593                 for (i = 0; i < n; i++)
1594                         ibuf[i] = NCR_READ_REG(sc, NCR_FIFO);
1595
1596                 if (sc->sc_espstat2 & NCRFAS_STAT2_ISHUTTLE) {
1597
1598                         NCR_WRITE_REG(sc, NCR_FIFO, 0);
1599                         ibuf[i++] = NCR_READ_REG(sc, NCR_FIFO);
1600
1601                         NCR_READ_REG(sc, NCR_FIFO);
1602
1603                         ncr53c9x_flushfifo(sc);
1604                 }
1605         } else
1606                 for (i = 0; i < n; i++)
1607                         ibuf[i] = NCR_READ_REG(sc, NCR_FIFO);
1608
1609         sc->sc_imlen += i;
1610
1611 #if 0
1612 #ifdef NCR53C9X_DEBUG
1613         NCR_TRACE(("\n[rdfifo %s (%d):",
1614             (how == NCR_RDFIFO_START) ? "start" : "cont", (int)sc->sc_imlen));
1615         if ((ncr53c9x_debug & NCR_SHOWTRAC) != 0) {
1616                 for (i = 0; i < sc->sc_imlen; i++)
1617                         printf(" %02x", sc->sc_imess[i]);
1618                 printf("]\n");
1619         }
1620 #endif
1621 #endif
1622         return (sc->sc_imlen);
1623 }
1624
1625 static void
1626 ncr53c9x_wrfifo(struct ncr53c9x_softc *sc, uint8_t *p, int len)
1627 {
1628         int i;
1629
1630         NCR_LOCK_ASSERT(sc, MA_OWNED);
1631
1632 #ifdef NCR53C9X_DEBUG
1633         NCR_MSGS(("[wrfifo(%d):", len));
1634         if ((ncr53c9x_debug & NCR_SHOWMSGS) != 0) {
1635                 for (i = 0; i < len; i++)
1636                         printf(" %02x", p[i]);
1637                 printf("]\n");
1638         }
1639 #endif
1640
1641         for (i = 0; i < len; i++) {
1642                 NCR_WRITE_REG(sc, NCR_FIFO, p[i]);
1643
1644                 if (sc->sc_rev == NCR_VARIANT_FAS366)
1645                         NCR_WRITE_REG(sc, NCR_FIFO, 0);
1646         }
1647 }
1648
1649 static int
1650 ncr53c9x_reselect(struct ncr53c9x_softc *sc, int message, int tagtype,
1651     int tagid)
1652 {
1653         struct ncr53c9x_ecb *ecb = NULL;
1654         struct ncr53c9x_linfo *li;
1655         struct ncr53c9x_tinfo *ti;
1656         uint8_t lun, selid, target;
1657
1658         NCR_LOCK_ASSERT(sc, MA_OWNED);
1659
1660         if (sc->sc_rev == NCR_VARIANT_FAS366)
1661                 target = sc->sc_selid;
1662         else {
1663                 /*
1664                  * The SCSI chip made a snapshot of the data bus
1665                  * while the reselection was being negotiated.
1666                  * This enables us to determine which target did
1667                  * the reselect.
1668                  */
1669                 selid = sc->sc_selid & ~(1 << sc->sc_id);
1670                 if (selid & (selid - 1)) {
1671                         device_printf(sc->sc_dev, "reselect with invalid "
1672                             "selid %02x; sending DEVICE RESET\n", selid);
1673                         goto reset;
1674                 }
1675
1676                 target = ffs(selid) - 1;
1677         }
1678         lun = message & 0x07;
1679
1680         /*
1681          * Search wait queue for disconnected command.
1682          * The list should be short, so I haven't bothered with
1683          * any more sophisticated structures than a simple
1684          * singly linked list.
1685          */
1686         ti = &sc->sc_tinfo[target];
1687         li = TINFO_LUN(ti, lun);
1688
1689         /*
1690          * We can get as far as the LUN with the IDENTIFY
1691          * message.  Check to see if we're running an
1692          * untagged command.  Otherwise ack the IDENTIFY
1693          * and wait for a tag message.
1694          */
1695         if (li != NULL) {
1696                 if (li->untagged != NULL && li->busy)
1697                         ecb = li->untagged;
1698                 else if (tagtype != MSG_SIMPLE_Q_TAG) {
1699                         /* Wait for tag to come by. */
1700                         sc->sc_state = NCR_IDENTIFIED;
1701                         return (0);
1702                 } else if (tagtype)
1703                         ecb = li->queued[tagid];
1704         }
1705         if (ecb == NULL) {
1706                 device_printf(sc->sc_dev, "reselect from target %d lun %d "
1707                     "tag %x:%x with no nexus; sending ABORT\n",
1708                     target, lun, tagtype, tagid);
1709                 goto abort;
1710         }
1711
1712         /* Make this nexus active again. */
1713         sc->sc_state = NCR_CONNECTED;
1714         sc->sc_nexus = ecb;
1715         ncr53c9x_setsync(sc, ti);
1716
1717         if (ecb->flags & ECB_RESET)
1718                 ncr53c9x_sched_msgout(SEND_DEV_RESET);
1719         else if (ecb->flags & ECB_ABORT)
1720                 ncr53c9x_sched_msgout(SEND_ABORT);
1721
1722         /* Do an implicit RESTORE POINTERS. */
1723         sc->sc_dp = ecb->daddr;
1724         sc->sc_dleft = ecb->dleft;
1725
1726         return (0);
1727
1728 reset:
1729         ncr53c9x_sched_msgout(SEND_DEV_RESET);
1730         return (1);
1731
1732 abort:
1733         ncr53c9x_sched_msgout(SEND_ABORT);
1734         return (1);
1735 }
1736
1737 /* From NetBSD; these should go into CAM at some point. */
1738 #define MSG_ISEXTENDED(m)       ((m) == MSG_EXTENDED)
1739 #define MSG_IS1BYTE(m) \
1740         ((!MSG_ISEXTENDED(m) && (m) < 0x20) || MSG_ISIDENTIFY(m))
1741 #define MSG_IS2BYTE(m)          (((m) & 0xf0) == 0x20)
1742
1743 static inline int
1744 __verify_msg_format(uint8_t *p, int len)
1745 {
1746
1747         if (len == 1 && MSG_IS1BYTE(p[0]))
1748                 return (1);
1749         if (len == 2 && MSG_IS2BYTE(p[0]))
1750                 return (1);
1751         if (len >= 3 && MSG_ISEXTENDED(p[0]) &&
1752             len == p[1] + 2)
1753                 return (1);
1754
1755         return (0);
1756 }
1757
1758 /*
1759  * Get an incoming message as initiator.
1760  *
1761  * The SCSI bus must already be in MESSAGE_IN_PHASE and there is a
1762  * byte in the FIFO.
1763  */
1764 static void
1765 ncr53c9x_msgin(struct ncr53c9x_softc *sc)
1766 {
1767         struct ncr53c9x_ecb *ecb;
1768         struct ncr53c9x_linfo *li;
1769         struct ncr53c9x_tinfo *ti;
1770         uint8_t *pb;
1771         int len, lun;
1772
1773         NCR_LOCK_ASSERT(sc, MA_OWNED);
1774
1775         NCR_TRACE(("[%s(curmsglen:%ld)] ", __func__, (long)sc->sc_imlen));
1776
1777         if (sc->sc_imlen == 0) {
1778                 device_printf(sc->sc_dev, "msgin: no msg byte available\n");
1779                 return;
1780         }
1781
1782         /*
1783          * Prepare for a new message.  A message should (according
1784          * to the SCSI standard) be transmitted in one single
1785          * MESSAGE_IN_PHASE.  If we have been in some other phase,
1786          * then this is a new message.
1787          */
1788         if (sc->sc_prevphase != MESSAGE_IN_PHASE &&
1789             sc->sc_state != NCR_RESELECTED) {
1790                 device_printf(sc->sc_dev, "phase change, dropping message, "
1791                     "prev %d, state %d\n", sc->sc_prevphase, sc->sc_state);
1792                 sc->sc_flags &= ~NCR_DROP_MSGI;
1793                 sc->sc_imlen = 0;
1794         }
1795
1796         /*
1797          * If we're going to reject the message, don't bother storing
1798          * the incoming bytes.  But still, we need to ACK them.
1799          */
1800         if ((sc->sc_flags & NCR_DROP_MSGI) != 0) {
1801                 NCRCMD(sc, NCRCMD_MSGOK);
1802                 device_printf(sc->sc_dev, "<dropping msg byte %x>",
1803                     sc->sc_imess[sc->sc_imlen]);
1804                 return;
1805         }
1806
1807         if (sc->sc_imlen >= NCR_MAX_MSG_LEN) {
1808                 ncr53c9x_sched_msgout(SEND_REJECT);
1809                 sc->sc_flags |= NCR_DROP_MSGI;
1810         } else {
1811                 switch (sc->sc_state) {
1812                 /*
1813                  * if received message is the first of reselection
1814                  * then first byte is selid, and then message
1815                  */
1816                 case NCR_RESELECTED:
1817                         pb = sc->sc_imess + 1;
1818                         len = sc->sc_imlen - 1;
1819                         break;
1820
1821                 default:
1822                         pb = sc->sc_imess;
1823                         len = sc->sc_imlen;
1824                 }
1825
1826                 if (__verify_msg_format(pb, len))
1827                         goto gotit;
1828         }
1829
1830         /* Acknowledge what we have so far. */
1831         NCRCMD(sc, NCRCMD_MSGOK);
1832         return;
1833
1834 gotit:
1835         NCR_MSGS(("gotmsg(%x) state %d", sc->sc_imess[0], sc->sc_state));
1836         /*
1837          * We got a complete message, flush the imess.
1838          * XXX nobody uses imlen below.
1839          */
1840         sc->sc_imlen = 0;
1841         /*
1842          * Now we should have a complete message (1 byte, 2 byte
1843          * and moderately long extended messages).  We only handle
1844          * extended messages which total length is shorter than
1845          * NCR_MAX_MSG_LEN.  Longer messages will be amputated.
1846          */
1847         switch (sc->sc_state) {
1848         case NCR_CONNECTED:
1849                 ecb = sc->sc_nexus;
1850                 ti = &sc->sc_tinfo[ecb->ccb->ccb_h.target_id];
1851
1852                 switch (sc->sc_imess[0]) {
1853                 case MSG_CMDCOMPLETE:
1854                         NCR_MSGS(("cmdcomplete "));
1855                         if (sc->sc_dleft < 0) {
1856                                 xpt_print_path(ecb->ccb->ccb_h.path);
1857                                 printf("got %ld extra bytes\n",
1858                                     -(long)sc->sc_dleft);
1859                                 sc->sc_dleft = 0;
1860                         }
1861                         ecb->dleft = (ecb->flags & ECB_TENTATIVE_DONE) ?
1862                             0 : sc->sc_dleft;
1863                         if ((ecb->flags & ECB_SENSE) == 0)
1864                                 ecb->ccb->csio.resid = ecb->dleft;
1865                         sc->sc_state = NCR_CMDCOMPLETE;
1866                         break;
1867
1868                 case MSG_MESSAGE_REJECT:
1869                         NCR_MSGS(("msg reject (msgout=%x) ", sc->sc_msgout));
1870                         switch (sc->sc_msgout) {
1871                         case SEND_TAG:
1872                                 /*
1873                                  * Target does not like tagged queuing.
1874                                  *  - Flush the command queue
1875                                  *  - Disable tagged queuing for the target
1876                                  *  - Dequeue ecb from the queued array.
1877                                  */
1878                                 device_printf(sc->sc_dev, "tagged queuing "
1879                                     "rejected: target %d\n",
1880                                     ecb->ccb->ccb_h.target_id);
1881
1882                                 NCR_MSGS(("(rejected sent tag)"));
1883                                 NCRCMD(sc, NCRCMD_FLUSH);
1884                                 DELAY(1);
1885                                 ti->flags &= ~T_TAG;
1886                                 lun = ecb->ccb->ccb_h.target_lun;
1887                                 li = TINFO_LUN(ti, lun);
1888                                 if (ecb->tag[0] &&
1889                                     li->queued[ecb->tag[1]] != NULL) {
1890                                         li->queued[ecb->tag[1]] = NULL;
1891                                         li->used--;
1892                                 }
1893                                 ecb->tag[0] = ecb->tag[1] = 0;
1894                                 li->untagged = ecb;
1895                                 li->busy = 1;
1896                                 break;
1897
1898                         case SEND_SDTR:
1899                                 device_printf(sc->sc_dev, "sync transfer "
1900                                     "rejected: target %d\n",
1901                                     ecb->ccb->ccb_h.target_id);
1902
1903                                 ti->flags &= ~T_SDTRSENT;
1904                                 ti->curr.period = ti->goal.period = 0;
1905                                 ti->curr.offset = ti->goal.offset = 0;
1906                                 ncr53c9x_setsync(sc, ti);
1907                                 break;
1908
1909                         case SEND_WDTR:
1910                                 device_printf(sc->sc_dev, "wide transfer "
1911                                     "rejected: target %d\n",
1912                                     ecb->ccb->ccb_h.target_id);
1913
1914                                 ti->flags &= ~T_WDTRSENT;
1915                                 ti->curr.width = ti->goal.width =
1916                                     MSG_EXT_WDTR_BUS_8_BIT;
1917                                 ncr53c9x_setsync(sc, ti);
1918                                 break;
1919
1920                         case SEND_INIT_DET_ERR:
1921                                 goto abort;
1922                         }
1923                         break;
1924
1925                 case MSG_NOOP:
1926                         NCR_MSGS(("noop "));
1927                         break;
1928
1929                 case MSG_HEAD_OF_Q_TAG:
1930                 case MSG_SIMPLE_Q_TAG:
1931                 case MSG_ORDERED_Q_TAG:
1932                         NCR_MSGS(("TAG %x:%x",
1933                             sc->sc_imess[0], sc->sc_imess[1]));
1934                         break;
1935
1936                 case MSG_DISCONNECT:
1937                         NCR_MSGS(("disconnect "));
1938                         ti->dconns++;
1939                         sc->sc_state = NCR_DISCONNECT;
1940
1941                         /*
1942                          * Mark the fact that all bytes have moved.  The
1943                          * target may not bother to do a SAVE POINTERS
1944                          * at this stage.  This flag will set the residual
1945                          * count to zero on MSG COMPLETE.
1946                          */
1947                         if (sc->sc_dleft == 0)
1948                                 ecb->flags |= ECB_TENTATIVE_DONE;
1949                         break;
1950
1951                 case MSG_SAVEDATAPOINTER:
1952                         NCR_MSGS(("save datapointer "));
1953                         ecb->daddr = sc->sc_dp;
1954                         ecb->dleft = sc->sc_dleft;
1955                         break;
1956
1957                 case MSG_RESTOREPOINTERS:
1958                         NCR_MSGS(("restore datapointer "));
1959                         sc->sc_dp = ecb->daddr;
1960                         sc->sc_dleft = ecb->dleft;
1961                         break;
1962
1963                 case MSG_IGN_WIDE_RESIDUE:
1964                         NCR_MSGS(("ignore wide residue (%d bytes)",
1965                             sc->sc_imess[1]));
1966                         if (sc->sc_imess[1] != 1) {
1967                                 xpt_print_path(ecb->ccb->ccb_h.path);
1968                                 printf("unexpected MESSAGE IGNORE WIDE "
1969                                     "RESIDUE (%d bytes); sending REJECT\n",
1970                                     sc->sc_imess[1]);
1971                                 goto reject;
1972                         }
1973                         /*
1974                          * If there was a last transfer of an even number of
1975                          * bytes, wipe the "done" memory and adjust by one
1976                          * byte (sc->sc_imess[1]).
1977                          */
1978                         len = sc->sc_dleft - ecb->dleft;
1979                         if (len != 0 && (len & 1) == 0) {
1980                                 ecb->flags &= ~ECB_TENTATIVE_DONE;
1981                                 sc->sc_dp = (char *)sc->sc_dp - 1;
1982                                 sc->sc_dleft--;
1983                         }
1984                         break;
1985
1986                 case MSG_EXTENDED:
1987                         NCR_MSGS(("extended(%x) ", sc->sc_imess[2]));
1988                         switch (sc->sc_imess[2]) {
1989                         case MSG_EXT_SDTR:
1990                                 NCR_MSGS(("SDTR period %d, offset %d ",
1991                                     sc->sc_imess[3], sc->sc_imess[4]));
1992                                 if (sc->sc_imess[1] != 3)
1993                                         goto reject;
1994                                 ti->curr.period = sc->sc_imess[3];
1995                                 ti->curr.offset = sc->sc_imess[4];
1996                                 if (sc->sc_minsync == 0 ||
1997                                     ti->curr.offset == 0 ||
1998                                     ti->curr.period > 124) {
1999 #if 0
2000 #ifdef NCR53C9X_DEBUG
2001                                         xpt_print_path(ecb->ccb->ccb_h.path);
2002                                         printf("async mode\n");
2003 #endif
2004 #endif
2005                                         if ((ti->flags & T_SDTRSENT) == 0) {
2006                                                 /*
2007                                                  * target initiated negotiation
2008                                                  */
2009                                                 ti->curr.offset = 0;
2010                                                 ncr53c9x_sched_msgout(
2011                                                     SEND_SDTR);
2012                                         }
2013                                 } else {
2014                                         ti->curr.period =
2015                                             ncr53c9x_cpb2stp(sc,
2016                                             ncr53c9x_stp2cpb(sc,
2017                                             ti->curr.period));
2018                                         if ((ti->flags & T_SDTRSENT) == 0) {
2019                                                 /*
2020                                                  * target initiated negotiation
2021                                                  */
2022                                                 if (ti->curr.period <
2023                                                     sc->sc_minsync)
2024                                                         ti->curr.period =
2025                                                             sc->sc_minsync;
2026                                                 if (ti->curr.offset >
2027                                                     sc->sc_maxoffset)
2028                                                         ti->curr.offset =
2029                                                             sc->sc_maxoffset;
2030                                                 ncr53c9x_sched_msgout(
2031                                                     SEND_SDTR);
2032                                         }
2033                                 }
2034                                 ti->flags &= ~T_SDTRSENT;
2035                                 ti->goal.period = ti->curr.period;
2036                                 ti->goal.offset = ti->curr.offset;
2037                                 ncr53c9x_setsync(sc, ti);
2038                                 break;
2039
2040                         case MSG_EXT_WDTR:
2041                                 NCR_MSGS(("wide mode %d ", sc->sc_imess[3]));
2042                                 ti->curr.width = sc->sc_imess[3];
2043                                 if (!(ti->flags & T_WDTRSENT))
2044                                         /*
2045                                          * target initiated negotiation
2046                                          */
2047                                         ncr53c9x_sched_msgout(SEND_WDTR);
2048                                 ti->flags &= ~T_WDTRSENT;
2049                                 ti->goal.width = ti->curr.width;
2050                                 ncr53c9x_setsync(sc, ti);
2051                                 break;
2052
2053                         default:
2054                                 xpt_print_path(ecb->ccb->ccb_h.path);
2055                                 printf("unrecognized MESSAGE EXTENDED 0x%x;"
2056                                     " sending REJECT\n", sc->sc_imess[2]);
2057                                 goto reject;
2058                         }
2059                         break;
2060
2061                 default:
2062                         NCR_MSGS(("ident "));
2063                         xpt_print_path(ecb->ccb->ccb_h.path);
2064                         printf("unrecognized MESSAGE 0x%x; sending REJECT\n",
2065                             sc->sc_imess[0]);
2066                         /* FALLTHROUGH */
2067                 reject:
2068                         ncr53c9x_sched_msgout(SEND_REJECT);
2069                         break;
2070                 }
2071                 break;
2072
2073         case NCR_IDENTIFIED:
2074                 /*
2075                  * IDENTIFY message was received and queue tag is expected
2076                  * now.
2077                  */
2078                 if ((sc->sc_imess[0] != MSG_SIMPLE_Q_TAG) ||
2079                     (sc->sc_msgify == 0)) {
2080                         device_printf(sc->sc_dev, "TAG reselect without "
2081                             "IDENTIFY; MSG %x; sending DEVICE RESET\n",
2082                             sc->sc_imess[0]);
2083                         goto reset;
2084                 }
2085                 (void)ncr53c9x_reselect(sc, sc->sc_msgify,
2086                     sc->sc_imess[0], sc->sc_imess[1]);
2087                 break;
2088
2089         case NCR_RESELECTED:
2090                 if (MSG_ISIDENTIFY(sc->sc_imess[1]))
2091                         sc->sc_msgify = sc->sc_imess[1];
2092                 else {
2093                         device_printf(sc->sc_dev, "reselect without IDENTIFY;"
2094                             " MSG %x; sending DEVICE RESET\n", sc->sc_imess[1]);
2095                         goto reset;
2096                 }
2097                 (void)ncr53c9x_reselect(sc, sc->sc_msgify, 0, 0);
2098                 break;
2099
2100         default:
2101                 device_printf(sc->sc_dev, "unexpected MESSAGE IN; "
2102                     "sending DEVICE RESET\n");
2103                 /* FALLTHROUGH */
2104         reset:
2105                 ncr53c9x_sched_msgout(SEND_DEV_RESET);
2106                 break;
2107
2108         abort:
2109                 ncr53c9x_sched_msgout(SEND_ABORT);
2110         }
2111
2112         /* If we have more messages to send set ATN. */
2113         if (sc->sc_msgpriq) {
2114                 NCRCMD(sc, NCRCMD_SETATN);
2115                 sc->sc_flags |= NCR_ATN;
2116         }
2117
2118         /* Acknowledge last message byte. */
2119         NCRCMD(sc, NCRCMD_MSGOK);
2120
2121         /* Done, reset message pointer. */
2122         sc->sc_flags &= ~NCR_DROP_MSGI;
2123         sc->sc_imlen = 0;
2124 }
2125
2126 /*
2127  * Send the highest priority, scheduled message.
2128  */
2129 static void
2130 ncr53c9x_msgout(struct ncr53c9x_softc *sc)
2131 {
2132         struct ncr53c9x_tinfo *ti;
2133         struct ncr53c9x_ecb *ecb;
2134         size_t size;
2135         int error;
2136 #ifdef NCR53C9X_DEBUG
2137         int i;
2138 #endif
2139
2140         NCR_LOCK_ASSERT(sc, MA_OWNED);
2141
2142         NCR_TRACE(("[%s(priq:%x, prevphase:%x)]", __func__, sc->sc_msgpriq,
2143             sc->sc_prevphase));
2144
2145         /*
2146          * XXX - the NCR_ATN flag is not in sync with the actual ATN
2147          *       condition on the SCSI bus.  The 53c9x chip
2148          *       automatically turns off ATN before sending the
2149          *       message byte.  (See also the comment below in the
2150          *       default case when picking out a message to send.)
2151          */
2152         if (sc->sc_flags & NCR_ATN) {
2153                 if (sc->sc_prevphase != MESSAGE_OUT_PHASE) {
2154                 new:
2155                         NCRCMD(sc, NCRCMD_FLUSH);
2156 #if 0
2157                         DELAY(1);
2158 #endif
2159                         sc->sc_msgoutq = 0;
2160                         sc->sc_omlen = 0;
2161                 }
2162         } else {
2163                 if (sc->sc_prevphase == MESSAGE_OUT_PHASE) {
2164                         ncr53c9x_sched_msgout(sc->sc_msgoutq);
2165                         goto new;
2166                 } else
2167                         device_printf(sc->sc_dev, "at line %d: unexpected "
2168                             "MESSAGE OUT phase\n", __LINE__);
2169         }
2170
2171         if (sc->sc_omlen == 0) {
2172                 /* Pick up highest priority message. */
2173                 sc->sc_msgout = sc->sc_msgpriq & -sc->sc_msgpriq;
2174                 sc->sc_msgoutq |= sc->sc_msgout;
2175                 sc->sc_msgpriq &= ~sc->sc_msgout;
2176                 sc->sc_omlen = 1;               /* "Default" message len */
2177                 switch (sc->sc_msgout) {
2178                 case SEND_SDTR:
2179                         ecb = sc->sc_nexus;
2180                         ti = &sc->sc_tinfo[ecb->ccb->ccb_h.target_id];
2181                         sc->sc_omess[0] = MSG_EXTENDED;
2182                         sc->sc_omess[1] = MSG_EXT_SDTR_LEN;
2183                         sc->sc_omess[2] = MSG_EXT_SDTR;
2184                         sc->sc_omess[3] = ti->goal.period;
2185                         sc->sc_omess[4] = ti->goal.offset;
2186                         sc->sc_omlen = 5;
2187                         break;
2188
2189                 case SEND_WDTR:
2190                         ecb = sc->sc_nexus;
2191                         ti = &sc->sc_tinfo[ecb->ccb->ccb_h.target_id];
2192                         sc->sc_omess[0] = MSG_EXTENDED;
2193                         sc->sc_omess[1] = MSG_EXT_WDTR_LEN;
2194                         sc->sc_omess[2] = MSG_EXT_WDTR;
2195                         sc->sc_omess[3] = ti->goal.width;
2196                         sc->sc_omlen = 4;
2197                         break;
2198
2199                 case SEND_IDENTIFY:
2200                         if (sc->sc_state != NCR_CONNECTED)
2201                                 device_printf(sc->sc_dev, "at line %d: no "
2202                                     "nexus\n", __LINE__);
2203                         ecb = sc->sc_nexus;
2204                         sc->sc_omess[0] =
2205                             MSG_IDENTIFY(ecb->ccb->ccb_h.target_lun, 0);
2206                         break;
2207
2208                 case SEND_TAG:
2209                         if (sc->sc_state != NCR_CONNECTED)
2210                                 device_printf(sc->sc_dev, "at line %d: no "
2211                                     "nexus\n", __LINE__);
2212                         ecb = sc->sc_nexus;
2213                         sc->sc_omess[0] = ecb->tag[0];
2214                         sc->sc_omess[1] = ecb->tag[1];
2215                         sc->sc_omlen = 2;
2216                         break;
2217
2218                 case SEND_DEV_RESET:
2219                         sc->sc_flags |= NCR_ABORTING;
2220                         sc->sc_omess[0] = MSG_BUS_DEV_RESET;
2221                         ecb = sc->sc_nexus;
2222                         ti = &sc->sc_tinfo[ecb->ccb->ccb_h.target_id];
2223                         ti->curr.period = 0;
2224                         ti->curr.offset = 0;
2225                         ti->curr.width = MSG_EXT_WDTR_BUS_8_BIT;
2226                         break;
2227
2228                 case SEND_PARITY_ERROR:
2229                         sc->sc_omess[0] = MSG_PARITY_ERROR;
2230                         break;
2231
2232                 case SEND_ABORT:
2233                         sc->sc_flags |= NCR_ABORTING;
2234                         sc->sc_omess[0] = MSG_ABORT;
2235                         break;
2236
2237                 case SEND_INIT_DET_ERR:
2238                         sc->sc_omess[0] = MSG_INITIATOR_DET_ERR;
2239                         break;
2240
2241                 case SEND_REJECT:
2242                         sc->sc_omess[0] = MSG_MESSAGE_REJECT;
2243                         break;
2244
2245                 default:
2246                         /*
2247                          * We normally do not get here, since the chip
2248                          * automatically turns off ATN before the last
2249                          * byte of a message is sent to the target.
2250                          * However, if the target rejects our (multi-byte)
2251                          * message early by switching to MSG IN phase
2252                          * ATN remains on, so the target may return to
2253                          * MSG OUT phase.  If there are no scheduled messages
2254                          * left we send a NO-OP.
2255                          *
2256                          * XXX - Note that this leaves no useful purpose for
2257                          * the NCR_ATN flag.
2258                          */
2259                         sc->sc_flags &= ~NCR_ATN;
2260                         sc->sc_omess[0] = MSG_NOOP;
2261                 }
2262                 sc->sc_omp = sc->sc_omess;
2263         }
2264
2265 #ifdef NCR53C9X_DEBUG
2266         if ((ncr53c9x_debug & NCR_SHOWMSGS) != 0) {
2267                 NCR_MSGS(("<msgout:"));
2268                 for (i = 0; i < sc->sc_omlen; i++)
2269                         NCR_MSGS((" %02x", sc->sc_omess[i]));
2270                 NCR_MSGS(("> "));
2271         }
2272 #endif
2273
2274         if (sc->sc_rev != NCR_VARIANT_FAS366) {
2275                 /* (Re)send the message. */
2276                 size = ulmin(sc->sc_omlen, sc->sc_maxxfer);
2277                 error = NCRDMA_SETUP(sc, &sc->sc_omp, &sc->sc_omlen, 0, &size);
2278                 if (error != 0)
2279                         goto cmd;
2280
2281                 /* Program the SCSI counter. */
2282                 NCR_SET_COUNT(sc, size);
2283
2284                 /* Load the count in and start the message-out transfer. */
2285                 NCRCMD(sc, NCRCMD_NOP | NCRCMD_DMA);
2286                 NCRCMD(sc, NCRCMD_TRANS | NCRCMD_DMA);
2287                 NCRDMA_GO(sc);
2288                 return;
2289         }
2290
2291 cmd:
2292         /*
2293          * XXX FIFO size
2294          */
2295         sc->sc_cmdlen = 0;
2296         ncr53c9x_flushfifo(sc);
2297         ncr53c9x_wrfifo(sc, sc->sc_omp, sc->sc_omlen);
2298         NCRCMD(sc, NCRCMD_TRANS);
2299 }
2300
2301 void
2302 ncr53c9x_intr(void *arg)
2303 {
2304         struct ncr53c9x_softc *sc = arg;
2305
2306         if (!NCRDMA_ISINTR(sc))
2307                 return;
2308
2309         NCR_LOCK(sc);
2310
2311         ncr53c9x_intr1(sc);
2312
2313         NCR_UNLOCK(sc);
2314 }
2315
2316 /*
2317  * This is the most critical part of the driver, and has to know
2318  * how to deal with *all* error conditions and phases from the SCSI
2319  * bus.  If there are no errors and the DMA was active, then call the
2320  * DMA pseudo-interrupt handler.  If this returns 1, then that was it
2321  * and we can return from here without further processing.
2322  *
2323  * Most of this needs verifying.
2324  */
2325 static void
2326 ncr53c9x_intr1(struct ncr53c9x_softc *sc)
2327 {
2328         struct ncr53c9x_ecb *ecb;
2329         struct ncr53c9x_linfo *li;
2330         struct ncr53c9x_tinfo *ti;
2331         struct timeval cur, wait;
2332         size_t size;
2333         int error, i, nfifo;
2334         uint8_t msg;
2335
2336         NCR_LOCK_ASSERT(sc, MA_OWNED);
2337
2338         NCR_INTS(("[ncr53c9x_intr: state %d]", sc->sc_state));
2339
2340 again:
2341         /* and what do the registers say... */
2342         ncr53c9x_readregs(sc);
2343
2344         /*
2345          * At the moment, only a SCSI Bus Reset or Illegal
2346          * Command are classed as errors.  A disconnect is a
2347          * valid condition, and we let the code check is the
2348          * "NCR_BUSFREE_OK" flag was set before declaring it
2349          * and error.
2350          *
2351          * Also, the status register tells us about "Gross
2352          * Errors" and "Parity errors".  Only the Gross Error
2353          * is really bad, and the parity errors are dealt
2354          * with later.
2355          *
2356          * TODO
2357          *      If there are too many parity error, go to slow
2358          *      cable mode?
2359          */
2360
2361         if ((sc->sc_espintr & NCRINTR_SBR) != 0) {
2362                 if ((NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) != 0) {
2363                         NCRCMD(sc, NCRCMD_FLUSH);
2364                         DELAY(1);
2365                 }
2366                 if (sc->sc_state != NCR_SBR) {
2367                         device_printf(sc->sc_dev, "SCSI bus reset\n");
2368                         ncr53c9x_init(sc, 0);   /* Restart everything. */
2369                         return;
2370                 }
2371 #if 0
2372 /*XXX*/         device_printf(sc->sc_dev, "<expected bus reset: "
2373                     "[intr %x, stat %x, step %d]>\n",
2374                     sc->sc_espintr, sc->sc_espstat, sc->sc_espstep);
2375 #endif
2376                 if (sc->sc_nexus != NULL)
2377                         panic("%s: nexus in reset state",
2378                             device_get_nameunit(sc->sc_dev));
2379                 goto sched;
2380         }
2381
2382         ecb = sc->sc_nexus;
2383
2384 #define NCRINTR_ERR (NCRINTR_SBR | NCRINTR_ILL)
2385         if (sc->sc_espintr & NCRINTR_ERR ||
2386             sc->sc_espstat & NCRSTAT_GE) {
2387                 if ((sc->sc_espstat & NCRSTAT_GE) != 0) {
2388                         /* Gross Error; no target? */
2389                         if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
2390                                 NCRCMD(sc, NCRCMD_FLUSH);
2391                                 DELAY(1);
2392                         }
2393                         if (sc->sc_state == NCR_CONNECTED ||
2394                             sc->sc_state == NCR_SELECTING) {
2395                                 ecb->ccb->ccb_h.status = CAM_SEL_TIMEOUT;
2396                                 ncr53c9x_done(sc, ecb);
2397                         }
2398                         return;
2399                 }
2400
2401                 if ((sc->sc_espintr & NCRINTR_ILL) != 0) {
2402                         if ((sc->sc_flags & NCR_EXPECT_ILLCMD) != 0) {
2403                                 /*
2404                                  * Eat away "Illegal command" interrupt
2405                                  * on a ESP100 caused by a re-selection
2406                                  * while we were trying to select
2407                                  * another target.
2408                                  */
2409 #ifdef NCR53C9X_DEBUG
2410                                 device_printf(sc->sc_dev, "ESP100 work-around "
2411                                     "activated\n");
2412 #endif
2413                                 sc->sc_flags &= ~NCR_EXPECT_ILLCMD;
2414                                 return;
2415                         }
2416                         /* Illegal command, out of sync? */
2417                         device_printf(sc->sc_dev, "illegal command: 0x%x "
2418                             "(state %d, phase %x, prevphase %x)\n",
2419                             sc->sc_lastcmd,
2420                             sc->sc_state, sc->sc_phase, sc->sc_prevphase);
2421                         if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
2422                                 NCRCMD(sc, NCRCMD_FLUSH);
2423                                 DELAY(1);
2424                         }
2425                         goto reset;
2426                 }
2427         }
2428         sc->sc_flags &= ~NCR_EXPECT_ILLCMD;
2429
2430         /*
2431          * Call if DMA is active.
2432          *
2433          * If DMA_INTR returns true, then maybe go 'round the loop
2434          * again in case there is no more DMA queued, but a phase
2435          * change is expected.
2436          */
2437         if (NCRDMA_ISACTIVE(sc)) {
2438                 if (NCRDMA_INTR(sc) == -1) {
2439                         device_printf(sc->sc_dev, "DMA error; resetting\n");
2440                         goto reset;
2441                 }
2442                 /* If DMA active here, then go back to work... */
2443                 if (NCRDMA_ISACTIVE(sc))
2444                         return;
2445
2446                 if ((sc->sc_espstat & NCRSTAT_TC) == 0) {
2447                         /*
2448                          * DMA not completed.  If we can not find a
2449                          * acceptable explanation, print a diagnostic.
2450                          */
2451                         if (sc->sc_state == NCR_SELECTING)
2452                                 /*
2453                                  * This can happen if we are reselected
2454                                  * while using DMA to select a target.
2455                                  */
2456                                 /*void*/;
2457                         else if (sc->sc_prevphase == MESSAGE_OUT_PHASE) {
2458                                 /*
2459                                  * Our (multi-byte) message (eg SDTR) was
2460                                  * interrupted by the target to send
2461                                  * a MSG REJECT.
2462                                  * Print diagnostic if current phase
2463                                  * is not MESSAGE IN.
2464                                  */
2465                                 if (sc->sc_phase != MESSAGE_IN_PHASE)
2466                                         device_printf(sc->sc_dev,"!TC on MSGOUT"
2467                                             " [intr %x, stat %x, step %d]"
2468                                             " prevphase %x, resid %lx\n",
2469                                             sc->sc_espintr,
2470                                             sc->sc_espstat,
2471                                             sc->sc_espstep,
2472                                             sc->sc_prevphase,
2473                                             (u_long)sc->sc_omlen);
2474                         } else if (sc->sc_dleft == 0) {
2475                                 /*
2476                                  * The DMA operation was started for
2477                                  * a DATA transfer.  Print a diagnostic
2478                                  * if the DMA counter and TC bit
2479                                  * appear to be out of sync.
2480                                  *
2481                                  * XXX This is fatal and usually means that
2482                                  *     the DMA engine is hopelessly out of
2483                                  *     sync with reality.  A disk is likely
2484                                  *     getting spammed at this point.
2485                                  */
2486                                 device_printf(sc->sc_dev, "!TC on DATA XFER"
2487                                     " [intr %x, stat %x, step %d]"
2488                                     " prevphase %x, resid %x\n",
2489                                     sc->sc_espintr,
2490                                     sc->sc_espstat,
2491                                     sc->sc_espstep,
2492                                     sc->sc_prevphase,
2493                                     ecb ? ecb->dleft : -1);
2494                                 goto reset;
2495                         }
2496                 }
2497         }
2498
2499         /*
2500          * Check for less serious errors.
2501          */
2502         if ((sc->sc_espstat & NCRSTAT_PE) != 0) {
2503                 device_printf(sc->sc_dev, "SCSI bus parity error\n");
2504                 if (sc->sc_prevphase == MESSAGE_IN_PHASE)
2505                         ncr53c9x_sched_msgout(SEND_PARITY_ERROR);
2506                 else
2507                         ncr53c9x_sched_msgout(SEND_INIT_DET_ERR);
2508         }
2509
2510         if ((sc->sc_espintr & NCRINTR_DIS) != 0) {
2511                 sc->sc_msgify = 0;
2512                 NCR_INTS(("<DISC [intr %x, stat %x, step %d]>",
2513                     sc->sc_espintr,sc->sc_espstat,sc->sc_espstep));
2514                 if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
2515                         NCRCMD(sc, NCRCMD_FLUSH);
2516 #if 0
2517                         DELAY(1);
2518 #endif
2519                 }
2520                 /*
2521                  * This command must (apparently) be issued within
2522                  * 250mS of a disconnect.  So here you are...
2523                  */
2524                 NCRCMD(sc, NCRCMD_ENSEL);
2525
2526                 switch (sc->sc_state) {
2527                 case NCR_RESELECTED:
2528                         goto sched;
2529
2530                 case NCR_SELECTING:
2531                         ecb->ccb->ccb_h.status = CAM_SEL_TIMEOUT;
2532
2533                         /* Selection timeout -- discard all LUNs if empty. */
2534                         ti = &sc->sc_tinfo[ecb->ccb->ccb_h.target_id];
2535                         li = LIST_FIRST(&ti->luns);
2536                         while (li != NULL) {
2537                                 if (li->untagged == NULL && li->used == 0) {
2538                                         if (li->lun < NCR_NLUN)
2539                                                 ti->lun[li->lun] = NULL;
2540                                         LIST_REMOVE(li, link);
2541                                         free(li, M_DEVBUF);
2542                                         /*
2543                                          * Restart the search at the beginning.
2544                                          */
2545                                         li = LIST_FIRST(&ti->luns);
2546                                         continue;
2547                                 }
2548                                 li = LIST_NEXT(li, link);
2549                         }
2550                         goto finish;
2551
2552                 case NCR_CONNECTED:
2553                         if (ecb != NULL) {
2554                                 ti = &sc->sc_tinfo[ecb->ccb->ccb_h.target_id];
2555                                 if ((ti->flags & T_SDTRSENT) != 0) {
2556                                         xpt_print_path(ecb->ccb->ccb_h.path);
2557                                         printf("sync nego not completed!\n");
2558                                         ti->flags &= ~T_SDTRSENT;
2559                                         ti->curr.period = ti->goal.period = 0;
2560                                         ti->curr.offset = ti->goal.offset = 0;
2561                                         ncr53c9x_setsync(sc, ti);
2562                                 }
2563                                 if ((ti->flags & T_WDTRSENT) != 0) {
2564                                         xpt_print_path(ecb->ccb->ccb_h.path);
2565                                         printf("wide nego not completed!\n");
2566                                         ti->flags &= ~T_WDTRSENT;
2567                                         ti->curr.width = ti->goal.width =
2568                                             MSG_EXT_WDTR_BUS_8_BIT;
2569                                         ncr53c9x_setsync(sc, ti);
2570                                 }
2571                         }
2572
2573                         /* It may be OK to disconnect. */
2574                         if ((sc->sc_flags & NCR_ABORTING) == 0) {
2575                                 /*
2576                                  * Section 5.1.1 of the SCSI 2 spec
2577                                  * suggests issuing a REQUEST SENSE
2578                                  * following an unexpected disconnect.
2579                                  * Some devices go into a contingent
2580                                  * allegiance condition when
2581                                  * disconnecting, and this is necessary
2582                                  * to clean up their state.
2583                                  */
2584                                 device_printf(sc->sc_dev, "unexpected "
2585                                     "disconnect [state %d, intr %x, stat %x, "
2586                                     "phase(c %x, p %x)]; ", sc->sc_state,
2587                                     sc->sc_espintr, sc->sc_espstat,
2588                                     sc->sc_phase, sc->sc_prevphase);
2589
2590                                 /*
2591                                  * XXX This will cause a chip reset and will
2592                                  *     prevent us from finding out the real
2593                                  *     problem with the device.  However, it's
2594                                  *     necessary until a way can be found to
2595                                  *     safely cancel the DMA that is in
2596                                  *     progress.
2597                                  */
2598                                 if (1 || (ecb->flags & ECB_SENSE) != 0) {
2599                                         printf("resetting\n");
2600                                         goto reset;
2601                                 }
2602                                 printf("sending REQUEST SENSE\n");
2603                                 callout_stop(&ecb->ch);
2604                                 ncr53c9x_sense(sc, ecb);
2605                                 return;
2606                         } else if (ecb != NULL &&
2607                             (ecb->flags & ECB_RESET) != 0) {
2608                                 ecb->ccb->ccb_h.status = CAM_REQ_CMP;
2609                                 goto finish;
2610                         }
2611
2612                         ecb->ccb->ccb_h.status = CAM_CMD_TIMEOUT;
2613                         goto finish;
2614
2615                 case NCR_DISCONNECT:
2616                         sc->sc_nexus = NULL;
2617                         goto sched;
2618
2619                 case NCR_CMDCOMPLETE:
2620                         ecb->ccb->ccb_h.status = CAM_REQ_CMP;
2621                         goto finish;
2622                 }
2623         }
2624
2625         switch (sc->sc_state) {
2626         case NCR_SBR:
2627                 device_printf(sc->sc_dev, "waiting for Bus Reset to happen\n");
2628                 return;
2629
2630         case NCR_RESELECTED:
2631                 /*
2632                  * We must be continuing a message?
2633                  */
2634                 device_printf(sc->sc_dev, "unhandled reselect continuation, "
2635                     "state %d, intr %02x\n", sc->sc_state, sc->sc_espintr);
2636                 goto reset;
2637                 break;
2638
2639         case NCR_IDENTIFIED:
2640                 ecb = sc->sc_nexus;
2641                 if (sc->sc_phase != MESSAGE_IN_PHASE) {
2642                         i = NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF;
2643                         /*
2644                          * Things are seriously screwed up.
2645                          * Pull the brakes, i.e. reset.
2646                          */
2647                         device_printf(sc->sc_dev, "target didn't send tag: %d "
2648                             "bytes in FIFO\n", i);
2649                         /* Drain and display FIFO. */
2650                         while (i-- > 0)
2651                                 printf("[%d] ", NCR_READ_REG(sc, NCR_FIFO));
2652
2653                         goto reset;
2654                 } else
2655                         goto msgin;
2656
2657         case NCR_IDLE:
2658         case NCR_SELECTING:
2659                 ecb = sc->sc_nexus;
2660                 if (sc->sc_espintr & NCRINTR_RESEL) {
2661                         sc->sc_msgpriq = sc->sc_msgout = sc->sc_msgoutq = 0;
2662                         sc->sc_flags = 0;
2663                         /*
2664                          * If we're trying to select a
2665                          * target ourselves, push our command
2666                          * back into the ready list.
2667                          */
2668                         if (sc->sc_state == NCR_SELECTING) {
2669                                 NCR_INTS(("backoff selector "));
2670                                 callout_stop(&ecb->ch);
2671                                 ncr53c9x_dequeue(sc, ecb);
2672                                 TAILQ_INSERT_HEAD(&sc->ready_list, ecb, chain);
2673                                 ecb->flags |= ECB_READY;
2674                                 ecb = sc->sc_nexus = NULL;
2675                         }
2676                         sc->sc_state = NCR_RESELECTED;
2677                         if (sc->sc_phase != MESSAGE_IN_PHASE) {
2678                                 /*
2679                                  * Things are seriously screwed up.
2680                                  * Pull the brakes, i.e. reset
2681                                  */
2682                                 device_printf(sc->sc_dev, "target didn't "
2683                                     "identify\n");
2684                                 goto reset;
2685                         }
2686                         /*
2687                          * The C90 only inhibits FIFO writes until reselection
2688                          * is complete instead of waiting until the interrupt
2689                          * status register has been read.  So, if the reselect
2690                          * happens while we were entering command bytes (for
2691                          * another target) some of those bytes can appear in
2692                          * the FIFO here, after the interrupt is taken.
2693                          *
2694                          * To remedy this situation, pull the Selection ID
2695                          * and Identify message from the FIFO directly, and
2696                          * ignore any extraneous FIFO contents.  Also, set
2697                          * a flag that allows one Illegal Command Interrupt
2698                          * to occur which the chip also generates as a result
2699                          * of writing to the FIFO during a reselect.
2700                          */
2701                         if (sc->sc_rev == NCR_VARIANT_ESP100) {
2702                                 nfifo =
2703                                     NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF;
2704                                 sc->sc_imess[0] = NCR_READ_REG(sc, NCR_FIFO);
2705                                 sc->sc_imess[1] = NCR_READ_REG(sc, NCR_FIFO);
2706                                 sc->sc_imlen = 2;
2707                                 if (nfifo != 2) {
2708                                         /* Flush the rest. */
2709                                         NCRCMD(sc, NCRCMD_FLUSH);
2710                                 }
2711                                 sc->sc_flags |= NCR_EXPECT_ILLCMD;
2712                                 if (nfifo > 2)
2713                                         nfifo = 2;      /* We fixed it... */
2714                         } else
2715                                 nfifo = ncr53c9x_rdfifo(sc, NCR_RDFIFO_START);
2716
2717                         if (nfifo != 2) {
2718                                 device_printf(sc->sc_dev, "RESELECT: %d bytes "
2719                                     "in FIFO! [intr %x, stat %x, step %d, "
2720                                     "prevphase %x]\n",
2721                                     nfifo,
2722                                     sc->sc_espintr,
2723                                     sc->sc_espstat,
2724                                     sc->sc_espstep,
2725                                     sc->sc_prevphase);
2726                                 goto reset;
2727                         }
2728                         sc->sc_selid = sc->sc_imess[0];
2729                         NCR_INTS(("selid=%02x ", sc->sc_selid));
2730
2731                         /* Handle IDENTIFY message. */
2732                         ncr53c9x_msgin(sc);
2733
2734                         if (sc->sc_state != NCR_CONNECTED &&
2735                             sc->sc_state != NCR_IDENTIFIED) {
2736                                 /* IDENTIFY fail?! */
2737                                 device_printf(sc->sc_dev, "identify failed, "
2738                                     "state %d, intr %02x\n", sc->sc_state,
2739                                     sc->sc_espintr);
2740                                 goto reset;
2741                         }
2742                         goto shortcut;  /* i.e. next phase expected soon */
2743                 }
2744
2745 #define NCRINTR_DONE    (NCRINTR_FC | NCRINTR_BS)
2746                 if ((sc->sc_espintr & NCRINTR_DONE) == NCRINTR_DONE) {
2747                         /*
2748                          * Arbitration won; examine the `step' register
2749                          * to determine how far the selection could progress.
2750                          */
2751                         if (ecb == NULL) {
2752                                 /*
2753                                  * When doing path inquiry during boot
2754                                  * FAS100A trigger a stray interrupt which
2755                                  * we just ignore instead of panicing.
2756                                  */
2757                                 if (sc->sc_state == NCR_IDLE &&
2758                                     sc->sc_espstep == 0)
2759                                         return;
2760                                 panic("%s: no nexus", __func__);
2761                         }
2762
2763                         ti = &sc->sc_tinfo[ecb->ccb->ccb_h.target_id];
2764
2765                         switch (sc->sc_espstep) {
2766                         case 0:
2767                                 /*
2768                                  * The target did not respond with a
2769                                  * message out phase - probably an old
2770                                  * device that doesn't recognize ATN.
2771                                  * Clear ATN and just continue, the
2772                                  * target should be in the command
2773                                  * phase.
2774                                  * XXX check for command phase?
2775                                  */
2776                                 NCRCMD(sc, NCRCMD_RSTATN);
2777                                 break;
2778
2779                         case 1:
2780                                 if (ti->curr.period == ti->goal.period &&
2781                                     ti->curr.offset == ti->goal.offset &&
2782                                     ti->curr.width == ti->goal.width &&
2783                                     ecb->tag[0] == 0) {
2784                                         device_printf(sc->sc_dev, "step 1 "
2785                                             "and no negotiation to perform "
2786                                             "or tag to send\n");
2787                                         goto reset;
2788                                 }
2789                                 if (sc->sc_phase != MESSAGE_OUT_PHASE) {
2790                                         device_printf(sc->sc_dev, "step 1 "
2791                                             "but not in MESSAGE_OUT_PHASE\n");
2792                                         goto reset;
2793                                 }
2794                                 sc->sc_prevphase = MESSAGE_OUT_PHASE; /* XXX */
2795                                 if (ecb->flags & ECB_RESET) {
2796                                         /*
2797                                          * A DEVICE RESET was scheduled and
2798                                          * ATNS used.  As SEND_DEV_RESET has
2799                                          * the highest priority, the target
2800                                          * will reset and disconnect and we
2801                                          * will end up in ncr53c9x_done w/o
2802                                          * negotiating or sending a TAG.  So
2803                                          * we just break here in order to
2804                                          * avoid warnings about negotiation
2805                                          * not having completed.
2806                                          */
2807                                         ncr53c9x_sched_msgout(SEND_DEV_RESET);
2808                                         break;
2809                                 }
2810                                 if (ti->curr.width != ti->goal.width) {
2811                                         ti->flags |= T_WDTRSENT | T_SDTRSENT;
2812                                         ncr53c9x_sched_msgout(SEND_WDTR |
2813                                             SEND_SDTR);
2814                                 }
2815                                 if (ti->curr.period != ti->goal.period ||
2816                                     ti->curr.offset != ti->goal.offset) {
2817                                         ti->flags |= T_SDTRSENT;
2818                                         ncr53c9x_sched_msgout(SEND_SDTR);
2819                                 }
2820                                 if (ecb->tag[0] != 0)
2821                                         /* Could not do ATN3 so send TAG. */
2822                                         ncr53c9x_sched_msgout(SEND_TAG);
2823                                 break;
2824
2825                         case 3:
2826                                 /*
2827                                  * Grr, this is supposed to mean
2828                                  * "target left command phase prematurely".
2829                                  * It seems to happen regularly when
2830                                  * sync mode is on.
2831                                  * Look at FIFO to see if command went out.
2832                                  * (Timing problems?)
2833                                  */
2834                                 if (sc->sc_features & NCR_F_DMASELECT) {
2835                                         if (sc->sc_cmdlen == 0) {
2836                                                 /* Hope for the best... */
2837                                                 break;
2838                                         }
2839                                 } else if ((NCR_READ_REG(sc, NCR_FFLAG) &
2840                                     NCRFIFO_FF) == 0) {
2841                                         /* Hope for the best... */
2842                                         break;
2843                                 }
2844                                 xpt_print_path(ecb->ccb->ccb_h.path);
2845                                 printf("selection failed; %d left in FIFO "
2846                                     "[intr %x, stat %x, step %d]\n",
2847                                     NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF,
2848                                     sc->sc_espintr, sc->sc_espstat,
2849                                     sc->sc_espstep);
2850                                 NCRCMD(sc, NCRCMD_FLUSH);
2851                                 ncr53c9x_sched_msgout(SEND_ABORT);
2852                                 return;
2853
2854                         case 2:
2855                                 /* Select stuck at Command Phase. */
2856                                 NCRCMD(sc, NCRCMD_FLUSH);
2857                                 break;
2858
2859                         case 4:
2860                                 if (sc->sc_features & NCR_F_DMASELECT &&
2861                                     sc->sc_cmdlen != 0) {
2862                                         xpt_print_path(ecb->ccb->ccb_h.path);
2863                                         printf("select; %lu left in DMA buffer "
2864                                             "[intr %x, stat %x, step %d]\n",
2865                                             (u_long)sc->sc_cmdlen,
2866                                             sc->sc_espintr,
2867                                             sc->sc_espstat,
2868                                             sc->sc_espstep);
2869                                 }
2870                                 /* So far, everything went fine. */
2871                                 break;
2872                         }
2873
2874                         sc->sc_prevphase = INVALID_PHASE;       /* ??? */
2875                         /* Do an implicit RESTORE POINTERS. */
2876                         sc->sc_dp = ecb->daddr;
2877                         sc->sc_dleft = ecb->dleft;
2878                         sc->sc_state = NCR_CONNECTED;
2879                         break;
2880                 } else {
2881                         device_printf(sc->sc_dev, "unexpected status after "
2882                             "select: [intr %x, stat %x, step %x]\n",
2883                             sc->sc_espintr, sc->sc_espstat, sc->sc_espstep);
2884                         NCRCMD(sc, NCRCMD_FLUSH);
2885                         DELAY(1);
2886                         goto reset;
2887                 }
2888                 if (sc->sc_state == NCR_IDLE) {
2889                         device_printf(sc->sc_dev, "stray interrupt\n");
2890                         return;
2891                 }
2892                 break;
2893
2894         case NCR_CONNECTED:
2895                 if ((sc->sc_flags & NCR_ICCS) != 0) {
2896                         /* "Initiate Command Complete Steps" in progress */
2897                         sc->sc_flags &= ~NCR_ICCS;
2898
2899                         if ((sc->sc_espintr & NCRINTR_DONE) == 0) {
2900                                 device_printf(sc->sc_dev, "ICCS: "
2901                                     ": [intr %x, stat %x, step %x]\n",
2902                                     sc->sc_espintr, sc->sc_espstat,
2903                                     sc->sc_espstep);
2904                         }
2905                         ncr53c9x_rdfifo(sc, NCR_RDFIFO_START);
2906                         if (sc->sc_imlen < 2)
2907                                 device_printf(sc->sc_dev, "can't get status, "
2908                                     "only %d bytes\n", (int)sc->sc_imlen);
2909                         ecb->stat = sc->sc_imess[sc->sc_imlen - 2];
2910                         msg = sc->sc_imess[sc->sc_imlen - 1];
2911                         NCR_PHASE(("<stat:(%x,%x)>", ecb->stat, msg));
2912                         if (msg == MSG_CMDCOMPLETE) {
2913                                 ecb->dleft =
2914                                     (ecb->flags & ECB_TENTATIVE_DONE) ?
2915                                     0 : sc->sc_dleft;
2916                                 if ((ecb->flags & ECB_SENSE) == 0)
2917                                         ecb->ccb->csio.resid = ecb->dleft;
2918                                 sc->sc_state = NCR_CMDCOMPLETE;
2919                         } else
2920                                 device_printf(sc->sc_dev, "STATUS_PHASE: "
2921                                     "msg %d\n", msg);
2922                         sc->sc_imlen = 0;
2923                         NCRCMD(sc, NCRCMD_MSGOK);
2924                         goto shortcut;  /* i.e. wait for disconnect */
2925                 }
2926                 break;
2927
2928         default:
2929                 device_printf(sc->sc_dev, "invalid state: %d [intr %x, "
2930                     "phase(c %x, p %x)]\n", sc->sc_state,
2931                     sc->sc_espintr, sc->sc_phase, sc->sc_prevphase);
2932                 goto reset;
2933         }
2934
2935         /*
2936          * Driver is now in state NCR_CONNECTED, i.e. we
2937          * have a current command working the SCSI bus.
2938          */
2939         if (sc->sc_state != NCR_CONNECTED || ecb == NULL)
2940                 panic("%s: no nexus", __func__);
2941
2942         switch (sc->sc_phase) {
2943         case MESSAGE_OUT_PHASE:
2944                 NCR_PHASE(("MESSAGE_OUT_PHASE "));
2945                 ncr53c9x_msgout(sc);
2946                 sc->sc_prevphase = MESSAGE_OUT_PHASE;
2947                 break;
2948
2949         case MESSAGE_IN_PHASE:
2950 msgin:
2951                 NCR_PHASE(("MESSAGE_IN_PHASE "));
2952                 if ((sc->sc_espintr & NCRINTR_BS) != 0) {
2953                         if ((sc->sc_rev != NCR_VARIANT_FAS366) ||
2954                             (sc->sc_espstat2 & NCRFAS_STAT2_EMPTY) == 0) {
2955                                 NCRCMD(sc, NCRCMD_FLUSH);
2956                         }
2957                         sc->sc_flags |= NCR_WAITI;
2958                         NCRCMD(sc, NCRCMD_TRANS);
2959                 } else if ((sc->sc_espintr & NCRINTR_FC) != 0) {
2960                         if ((sc->sc_flags & NCR_WAITI) == 0) {
2961                                 device_printf(sc->sc_dev, "MSGIN: unexpected "
2962                                     "FC bit: [intr %x, stat %x, step %x]\n",
2963                                     sc->sc_espintr, sc->sc_espstat,
2964                                     sc->sc_espstep);
2965                         }
2966                         sc->sc_flags &= ~NCR_WAITI;
2967                         ncr53c9x_rdfifo(sc,
2968                             (sc->sc_prevphase == sc->sc_phase) ?
2969                             NCR_RDFIFO_CONTINUE : NCR_RDFIFO_START);
2970                         ncr53c9x_msgin(sc);
2971                 } else
2972                         device_printf(sc->sc_dev, "MSGIN: weird bits: "
2973                             "[intr %x, stat %x, step %x]\n",
2974                             sc->sc_espintr, sc->sc_espstat, sc->sc_espstep);
2975                 sc->sc_prevphase = MESSAGE_IN_PHASE;
2976                 goto shortcut;  /* i.e. expect data to be ready */
2977
2978         case COMMAND_PHASE:
2979                 /*
2980                  * Send the command block.  Normally we don't see this
2981                  * phase because the SEL_ATN command takes care of
2982                  * all this.  However, we end up here if either the
2983                  * target or we wanted to exchange some more messages
2984                  * first (e.g. to start negotiations).
2985                  */
2986
2987                 NCR_PHASE(("COMMAND_PHASE 0x%02x (%d) ",
2988                     ecb->cmd.cmd.opcode, ecb->clen));
2989                 if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
2990                         NCRCMD(sc, NCRCMD_FLUSH);
2991 #if 0
2992                         DELAY(1);
2993 #endif
2994                 }
2995                 /*
2996                  * If we have more messages to send, e.g. WDTR or SDTR
2997                  * after we've sent a TAG, set ATN so we'll go back to
2998                  * MESSAGE_OUT_PHASE.
2999                  */
3000                 if (sc->sc_msgpriq) {
3001                         NCRCMD(sc, NCRCMD_SETATN);
3002                         sc->sc_flags |= NCR_ATN;
3003                 }
3004                 if (sc->sc_features & NCR_F_DMASELECT) {
3005                         /* Setup DMA transfer for command. */
3006                         size = ecb->clen;
3007                         sc->sc_cmdlen = size;
3008                         sc->sc_cmdp = (void *)&ecb->cmd.cmd;
3009                         error = NCRDMA_SETUP(sc, &sc->sc_cmdp, &sc->sc_cmdlen,
3010                             0, &size);
3011                         if (error != 0)
3012                                 goto cmd;
3013
3014                         /* Program the SCSI counter. */
3015                         NCR_SET_COUNT(sc, size);
3016
3017                         /* Load the count in. */
3018                         NCRCMD(sc, NCRCMD_NOP | NCRCMD_DMA);
3019
3020                         /* Start the command transfer. */
3021                         NCRCMD(sc, NCRCMD_TRANS | NCRCMD_DMA);
3022                         NCRDMA_GO(sc);
3023                         sc->sc_prevphase = COMMAND_PHASE;
3024                         break;
3025                 }
3026 cmd:
3027                 sc->sc_cmdlen = 0;
3028                 ncr53c9x_wrfifo(sc, (uint8_t *)&ecb->cmd.cmd, ecb->clen);
3029                 NCRCMD(sc, NCRCMD_TRANS);
3030                 sc->sc_prevphase = COMMAND_PHASE;
3031                 break;
3032
3033         case DATA_OUT_PHASE:
3034                 NCR_PHASE(("DATA_OUT_PHASE [%ld] ", (long)sc->sc_dleft));
3035                 sc->sc_prevphase = DATA_OUT_PHASE;
3036                 NCRCMD(sc, NCRCMD_FLUSH);
3037                 size = ulmin(sc->sc_dleft, sc->sc_maxxfer);
3038                 error = NCRDMA_SETUP(sc, &sc->sc_dp, &sc->sc_dleft, 0, &size);
3039                 goto setup_xfer;
3040
3041         case DATA_IN_PHASE:
3042                 NCR_PHASE(("DATA_IN_PHASE "));
3043                 sc->sc_prevphase = DATA_IN_PHASE;
3044                 if (sc->sc_rev == NCR_VARIANT_ESP100)
3045                         NCRCMD(sc, NCRCMD_FLUSH);
3046                 size = ulmin(sc->sc_dleft, sc->sc_maxxfer);
3047                 error = NCRDMA_SETUP(sc, &sc->sc_dp, &sc->sc_dleft, 1, &size);
3048 setup_xfer:
3049                 if (error != 0) {
3050                         switch (error) {
3051                         case EFBIG:
3052                                 ecb->ccb->ccb_h.status |= CAM_REQ_TOO_BIG;
3053                                 break;
3054                         case EINPROGRESS:
3055                                 panic("%s: cannot deal with deferred DMA",
3056                                     __func__);
3057                         case EINVAL:
3058                                 ecb->ccb->ccb_h.status |= CAM_REQ_INVALID;
3059                                 break;
3060                         case ENOMEM:
3061                                 ecb->ccb->ccb_h.status |= CAM_REQUEUE_REQ;
3062                                 break;
3063                         default:
3064                                 ecb->ccb->ccb_h.status |= CAM_REQ_CMP_ERR;
3065                         }
3066                         goto finish;
3067                 }
3068
3069                 /* Target returned to data phase: wipe "done" memory. */
3070                 ecb->flags &= ~ECB_TENTATIVE_DONE;
3071
3072                 /* Program the SCSI counter. */
3073                 NCR_SET_COUNT(sc, size);
3074
3075                 /* Load the count in. */
3076                 NCRCMD(sc, NCRCMD_NOP | NCRCMD_DMA);
3077
3078                 /*
3079                  * Note that if `size' is 0, we've already transceived
3080                  * all the bytes we want but we're still in DATA PHASE.
3081                  * Apparently, the device needs padding.  Also, a
3082                  * transfer size of 0 means "maximum" to the chip
3083                  * DMA logic.
3084                  */
3085                 NCRCMD(sc,
3086                     (size == 0 ? NCRCMD_TRPAD : NCRCMD_TRANS) | NCRCMD_DMA);
3087                 NCRDMA_GO(sc);
3088                 return;
3089
3090         case STATUS_PHASE:
3091                 NCR_PHASE(("STATUS_PHASE "));
3092                 sc->sc_flags |= NCR_ICCS;
3093                 NCRCMD(sc, NCRCMD_ICCS);
3094                 sc->sc_prevphase = STATUS_PHASE;
3095                 goto shortcut;  /* i.e. expect status results soon */
3096
3097         case INVALID_PHASE:
3098                 break;
3099
3100         default:
3101                 device_printf(sc->sc_dev,
3102                     "unexpected bus phase; resetting\n");
3103                 goto reset;
3104         }
3105
3106         return;
3107
3108 reset:
3109         ncr53c9x_init(sc, 1);
3110         return;
3111
3112 finish:
3113         ncr53c9x_done(sc, ecb);
3114         return;
3115
3116 sched:
3117         sc->sc_state = NCR_IDLE;
3118         ncr53c9x_sched(sc);
3119         return;
3120
3121 shortcut:
3122         /*
3123          * The idea is that many of the SCSI operations take very little
3124          * time, and going away and getting interrupted is too high an
3125          * overhead to pay.  For example, selecting, sending a message
3126          * and command and then doing some work can be done in one "pass".
3127          *
3128          * The delay is a heuristic.  It is 2 when at 20 MHz, 2 at 25 MHz and
3129          * 1 at 40 MHz.  This needs testing.
3130          */
3131         microtime(&wait);
3132         wait.tv_usec += 50 / sc->sc_freq;
3133         if (wait.tv_usec > 1000000) {
3134                 wait.tv_sec++;
3135                 wait.tv_usec -= 1000000;
3136         }
3137         do {
3138                 if (NCRDMA_ISINTR(sc))
3139                         goto again;
3140                 microtime(&cur);
3141         } while (cur.tv_sec <= wait.tv_sec && cur.tv_usec <= wait.tv_usec);
3142 }
3143
3144 static void
3145 ncr53c9x_abort(struct ncr53c9x_softc *sc, struct ncr53c9x_ecb *ecb)
3146 {
3147
3148         NCR_LOCK_ASSERT(sc, MA_OWNED);
3149
3150         /* 2 secs for the abort */
3151         ecb->timeout = NCR_ABORT_TIMEOUT;
3152         ecb->flags |= ECB_ABORT;
3153
3154         if (ecb == sc->sc_nexus) {
3155                 /*
3156                  * If we're still selecting, the message will be scheduled
3157                  * after selection is complete.
3158                  */
3159                 if (sc->sc_state == NCR_CONNECTED)
3160                         ncr53c9x_sched_msgout(SEND_ABORT);
3161
3162                 /*
3163                  * Reschedule callout.
3164                  */
3165                 callout_reset(&ecb->ch, mstohz(ecb->timeout),
3166                     ncr53c9x_callout, ecb);
3167         } else {
3168                 /*
3169                  * Just leave the command where it is.
3170                  * XXX - what choice do we have but to reset the SCSI
3171                  *       eventually?
3172                  */
3173                 if (sc->sc_state == NCR_IDLE)
3174                         ncr53c9x_sched(sc);
3175         }
3176 }
3177
3178 static void
3179 ncr53c9x_callout(void *arg)
3180 {
3181         struct ncr53c9x_ecb *ecb = arg;
3182         union ccb *ccb = ecb->ccb;
3183         struct ncr53c9x_softc *sc = ecb->sc;
3184         struct ncr53c9x_tinfo *ti;
3185
3186         NCR_LOCK_ASSERT(sc, MA_OWNED);
3187
3188         ti = &sc->sc_tinfo[ccb->ccb_h.target_id];
3189         xpt_print_path(ccb->ccb_h.path);
3190         device_printf(sc->sc_dev, "timed out [ecb %p (flags 0x%x, dleft %x, "
3191             "stat %x)], <state %d, nexus %p, phase(l %x, c %x, p %x), "
3192             "resid %lx, msg(q %x,o %x) %s>",
3193             ecb, ecb->flags, ecb->dleft, ecb->stat,
3194             sc->sc_state, sc->sc_nexus,
3195             NCR_READ_REG(sc, NCR_STAT),
3196             sc->sc_phase, sc->sc_prevphase,
3197             (long)sc->sc_dleft, sc->sc_msgpriq, sc->sc_msgout,
3198             NCRDMA_ISACTIVE(sc) ? "DMA active" : "");
3199 #if defined(NCR53C9X_DEBUG) && NCR53C9X_DEBUG > 1
3200         printf("TRACE: %s.", ecb->trace);
3201 #endif
3202
3203         if (ecb->flags & ECB_ABORT) {
3204                 /* Abort timed out. */
3205                 printf(" AGAIN\n");
3206                 ncr53c9x_init(sc, 1);
3207         } else {
3208                 /* Abort the operation that has timed out. */
3209                 printf("\n");
3210                 ccb->ccb_h.status = CAM_CMD_TIMEOUT;
3211                 ncr53c9x_abort(sc, ecb);
3212
3213                 /* Disable sync mode if stuck in a data phase. */
3214                 if (ecb == sc->sc_nexus && ti->curr.offset != 0 &&
3215                     (sc->sc_phase & (MSGI | CDI)) == 0) {
3216                         /* XXX ASYNC CALLBACK! */
3217                         ti->goal.offset = 0;
3218                         xpt_print_path(ccb->ccb_h.path);
3219                         printf("sync negotiation disabled\n");
3220                 }
3221         }
3222 }
3223
3224 static void
3225 ncr53c9x_watch(void *arg)
3226 {
3227         struct ncr53c9x_softc *sc = arg;
3228         struct ncr53c9x_linfo *li;
3229         struct ncr53c9x_tinfo *ti;
3230         time_t old;
3231         int t;
3232
3233         NCR_LOCK_ASSERT(sc, MA_OWNED);
3234
3235         /* Delete any structures that have not been used in 10min. */
3236         old = time_second - (10 * 60);
3237
3238         for (t = 0; t < sc->sc_ntarg; t++) {
3239                 ti = &sc->sc_tinfo[t];
3240                 li = LIST_FIRST(&ti->luns);
3241                 while (li) {
3242                         if (li->last_used < old &&
3243                             li->untagged == NULL &&
3244                             li->used == 0) {
3245                                 if (li->lun < NCR_NLUN)
3246                                         ti->lun[li->lun] = NULL;
3247                                 LIST_REMOVE(li, link);
3248                                 free(li, M_DEVBUF);
3249                                 /* Restart the search at the beginning. */
3250                                 li = LIST_FIRST(&ti->luns);
3251                                 continue;
3252                         }
3253                         li = LIST_NEXT(li, link);
3254                 }
3255         }
3256         callout_reset(&sc->sc_watchdog, 60 * hz, ncr53c9x_watch, sc);
3257 }