sys/dev/esp/ncr53c9x.c

   1 /*-
   2  * Copyright (c) 2004 Scott Long
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  *
  14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  24  * SUCH DAMAGE.
  25  *
  26  */
  27
  28 /*      $NetBSD: ncr53c9x.c,v 1.114 2005/02/27 00:27:02 perry Exp $     */
  29
  30 /*-
  31  * Copyright (c) 1998, 2002 The NetBSD Foundation, Inc.
  32  * All rights reserved.
  33  *
  34  * This code is derived from software contributed to The NetBSD Foundation
  35  * by Charles M. Hannum.
  36  *
  37  * Redistribution and use in source and binary forms, with or without
  38  * modification, are permitted provided that the following conditions
  39  * are met:
  40  * 1. Redistributions of source code must retain the above copyright
  41  *    notice, this list of conditions and the following disclaimer.
  42  * 2. Redistributions in binary form must reproduce the above copyright
  43  *    notice, this list of conditions and the following disclaimer in the
  44  *    documentation and/or other materials provided with the distribution.
  45  * 3. All advertising materials mentioning features or use of this software
  46  *    must display the following acknowledgement:
  47  *        This product includes software developed by the NetBSD
  48  *        Foundation, Inc. and its contributors.
  49  * 4. Neither the name of The NetBSD Foundation nor the names of its
  50  *    contributors may be used to endorse or promote products derived
  51  *    from this software without specific prior written permission.
  52  *
  53  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
  54  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  55  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  56  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
  57  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  58  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  59  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  60  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  61  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  62  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  63  * POSSIBILITY OF SUCH DAMAGE.
  64  */
  65
  66 /*-
  67  * Copyright (c) 1994 Peter Galbavy
  68  * Copyright (c) 1995 Paul Kranenburg
  69  * All rights reserved.
  70  *
  71  * Redistribution and use in source and binary forms, with or without
  72  * modification, are permitted provided that the following conditions
  73  * are met:
  74  * 1. Redistributions of source code must retain the above copyright
  75  *    notice, this list of conditions and the following disclaimer.
  76  * 2. Redistributions in binary form must reproduce the above copyright
  77  *    notice, this list of conditions and the following disclaimer in the
  78  *    documentation and/or other materials provided with the distribution.
  79  * 3. All advertising materials mentioning features or use of this software
  80  *    must display the following acknowledgement:
  81  *      This product includes software developed by Peter Galbavy
  82  * 4. The name of the author may not be used to endorse or promote products
  83  *    derived from this software without specific prior written permission.
  84  *
  85  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  86  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  87  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  88  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
  89  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  90  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  91  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  92  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  93  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  94  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  95  * POSSIBILITY OF SUCH DAMAGE.
  96  */
  97
  98 /*
  99  * Based on aic6360 by Jarle Greipsland
 100  *
 101  * Acknowledgements: Many of the algorithms used in this driver are
 102  * inspired by the work of Julian Elischer (julian@FreeBSD.org) and
 103  * Charles Hannum (mycroft@duality.gnu.ai.mit.edu).  Thanks a million!
 104  */
 105
 106 #include <sys/cdefs.h>
 107 __FBSDID("$FreeBSD$");
 108
 109 #include <sys/param.h>
 110 #include <sys/systm.h>
 111 #include <sys/bus.h>
 112 #include <sys/kernel.h>
 113 #include <sys/malloc.h>
 114 #include <sys/resource.h>
 115 #include <sys/lock.h>
 116 #include <sys/mutex.h>
 117 #include <sys/queue.h>
 118 #include <sys/time.h>
 119 #include <sys/callout.h>
 120
 121 #include <cam/cam.h>
 122 #include <cam/cam_ccb.h>
 123 #include <cam/cam_debug.h>
 124 #include <cam/cam_sim.h>
 125 #include <cam/cam_xpt_sim.h>
 126 #include <cam/scsi/scsi_all.h>
 127 #include <cam/scsi/scsi_message.h>
 128
 129 #include <dev/esp/ncr53c9xreg.h>
 130 #include <dev/esp/ncr53c9xvar.h>
 131
 132 int ncr53c9x_debug = NCR_SHOWMISC /*|NCR_SHOWPHASE|NCR_SHOWTRAC|NCR_SHOWCMDS*/;
 133 #ifdef DEBUG
 134 int ncr53c9x_notag = 0;
 135 #endif
 136
 137 static void     ncr53c9x_select(struct ncr53c9x_softc *, struct ncr53c9x_ecb *);
 138 static int      ncr53c9x_reselect(struct ncr53c9x_softc *, int, int, int);
 139 static void     ncr53c9x_scsi_reset(struct ncr53c9x_softc *);
 140 static void     ncr53c9x_poll(struct cam_sim *);
 141 static void     ncr53c9x_sched(struct ncr53c9x_softc *);
 142 static void     ncr53c9x_done(struct ncr53c9x_softc *, struct ncr53c9x_ecb *);
 143 static void     ncr53c9x_msgin(struct ncr53c9x_softc *);
 144 static void     ncr53c9x_msgout(struct ncr53c9x_softc *);
 145 static void     ncr53c9x_timeout(void *arg);
 146 static void     ncr53c9x_watch(void *arg);
 147 static void     ncr53c9x_abort(struct ncr53c9x_softc *, struct ncr53c9x_ecb *);
 148 static void     ncr53c9x_dequeue(struct ncr53c9x_softc *,
 149                                 struct ncr53c9x_ecb *);
 150 static void     ncr53c9x_sense(struct ncr53c9x_softc *, struct ncr53c9x_ecb *);
 151 static void     ncr53c9x_free_ecb(struct ncr53c9x_softc *,
 152                                   struct ncr53c9x_ecb *);
 153 static void     ncr53c9x_wrfifo(struct ncr53c9x_softc *, u_char *, int);
 154 static int      ncr53c9x_rdfifo(struct ncr53c9x_softc *, int);
 155
 156 static struct ncr53c9x_ecb *ncr53c9x_get_ecb(struct ncr53c9x_softc *);
 157 static struct ncr53c9x_linfo *ncr53c9x_lunsearch(struct ncr53c9x_tinfo *,
 158                                                  int64_t lun);
 159
 160 static __inline void ncr53c9x_readregs(struct ncr53c9x_softc *);
 161 static __inline int ncr53c9x_stp2cpb(struct ncr53c9x_softc *, int);
 162 static __inline void ncr53c9x_setsync(struct ncr53c9x_softc *,
 163                                       struct ncr53c9x_tinfo *);
 164
 165 #define NCR_RDFIFO_START   0
 166 #define NCR_RDFIFO_CONTINUE 1
 167
 168 #define NCR_SET_COUNT(sc, size) do { \
 169                 NCR_WRITE_REG((sc), NCR_TCL, (size));                   \
 170                 NCR_WRITE_REG((sc), NCR_TCM, (size) >> 8);              \
 171                 if ((sc->sc_cfg2 & NCRCFG2_FE) ||                       \
 172                     (sc->sc_rev == NCR_VARIANT_FAS366)) {               \
 173                         NCR_WRITE_REG((sc), NCR_TCH, (size) >> 16);     \
 174                 }                                                       \
 175                 if (sc->sc_rev == NCR_VARIANT_FAS366) {                 \
 176                         NCR_WRITE_REG(sc, NCR_RCH, 0);                  \
 177                 }                                                       \
 178 } while (0)
 179
 180 #ifndef mstohz
 181 #define mstohz(ms) \
 182         (((ms) < 0x20000)  ? \
 183             ((ms +0u) / 1000u) * hz : \
 184             ((ms +0u) * hz) /1000u)
 185 #endif
 186
 187 /*
 188  * Names for the NCR53c9x variants, corresponding to the variant tags
 189  * in ncr53c9xvar.h.
 190  */
 191 static const char *ncr53c9x_variant_names[] = {
 192         "ESP100",
 193         "ESP100A",
 194         "ESP200",
 195         "NCR53C94",
 196         "NCR53C96",
 197         "ESP406",
 198         "FAS408",
 199         "FAS216",
 200         "AM53C974",
 201         "FAS366/HME",
 202         "NCR53C90 (86C01)",
 203         "FAS100A",
 204         "FAS236",
 205 };
 206
 207 /*
 208  * Search linked list for LUN info by LUN id.
 209  */
 210 static struct ncr53c9x_linfo *
 211 ncr53c9x_lunsearch(struct ncr53c9x_tinfo *ti, int64_t lun)
 212 {
 213         struct ncr53c9x_linfo *li;
 214         LIST_FOREACH(li, &ti->luns, link)
 215                 if (li->lun == lun)
 216                         return (li);
 217         return (NULL);
 218 }
 219
 220 /*
 221  * Attach this instance, and then all the sub-devices.
 222  */
 223 int
 224 ncr53c9x_attach(struct ncr53c9x_softc *sc)
 225 {
 226         struct cam_devq *devq;
 227         struct cam_sim *sim;
 228         struct cam_path *path;
 229         struct ncr53c9x_ecb *ecb;
 230         int error, i;
 231
 232         mtx_init(&sc->sc_lock, "ncr", "ncr53c9x lock", MTX_DEF);
 233
 234         /*
 235          * Note, the front-end has set us up to print the chip variation.
 236          */
 237         if (sc->sc_rev >= NCR_VARIANT_MAX) {
 238                 device_printf(sc->sc_dev, "unknown variant %d, devices not "
 239                     "attached\n", sc->sc_rev);
 240                 return (EINVAL);
 241         }
 242
 243         device_printf(sc->sc_dev, "%s, %dMHz, SCSI ID %d\n",
 244             ncr53c9x_variant_names[sc->sc_rev], sc->sc_freq, sc->sc_id);
 245
 246         sc->sc_ntarg = (sc->sc_rev == NCR_VARIANT_FAS366) ? 16 : 8;
 247
 248         /*
 249          * Allocate SCSI message buffers.
 250          * Front-ends can override allocation to avoid alignment
 251          * handling in the DMA engines. Note that that ncr53c9x_msgout()
 252          * can request a 1 byte DMA transfer.
 253          */
 254         if (sc->sc_omess == NULL) {
 255                 sc->sc_omess_self = 1;
 256                 sc->sc_omess = malloc(NCR_MAX_MSG_LEN, M_DEVBUF, M_NOWAIT);
 257                 if (sc->sc_omess == NULL) {
 258                         device_printf(sc->sc_dev,
 259                             "cannot allocate MSGOUT buffer\n");
 260                         return (ENOMEM);
 261                 }
 262         } else
 263                 sc->sc_omess_self = 0;
 264
 265         if (sc->sc_imess == NULL) {
 266                 sc->sc_imess_self = 1;
 267                 sc->sc_imess = malloc(NCR_MAX_MSG_LEN + 1, M_DEVBUF, M_NOWAIT);
 268                 if (sc->sc_imess == NULL) {
 269                         device_printf(sc->sc_dev,
 270                             "cannot allocate MSGIN buffer\n");
 271                         error = ENOMEM;
 272                         goto fail_omess;
 273                 }
 274         } else
 275                 sc->sc_imess_self = 0;
 276
 277         sc->sc_tinfo = malloc(sc->sc_ntarg * sizeof(sc->sc_tinfo[0]),
 278             M_DEVBUF, M_NOWAIT | M_ZERO);
 279         if (sc->sc_tinfo == NULL) {
 280                 device_printf(sc->sc_dev,
 281                     "cannot allocate target info buffer\n");
 282                 error = ENOMEM;
 283                 goto fail_imess;
 284         }
 285
 286         callout_init(&sc->sc_watchdog, 0);
 287
 288         /*
 289          * Treat NCR53C90 with the 86C01 DMA chip exactly as ESP100
 290          * from now on.
 291          */
 292         if (sc->sc_rev == NCR_VARIANT_NCR53C90_86C01)
 293                 sc->sc_rev = NCR_VARIANT_ESP100;
 294
 295         sc->sc_ccf = FREQTOCCF(sc->sc_freq);
 296
 297         /* The value *must not* be == 1. Make it 2 */
 298         if (sc->sc_ccf == 1)
 299                 sc->sc_ccf = 2;
 300
 301         /*
 302          * The recommended timeout is 250ms. This register is loaded
 303          * with a value calculated as follows, from the docs:
 304          *
 305          *              (timout period) x (CLK frequency)
 306          *      reg = -------------------------------------
 307          *               8192 x (Clock Conversion Factor)
 308          *
 309          * Since CCF has a linear relation to CLK, this generally computes
 310          * to the constant of 153.
 311          */
 312         sc->sc_timeout = ((250 * 1000) * sc->sc_freq) / (8192 * sc->sc_ccf);
 313
 314         /* CCF register only has 3 bits; 0 is actually 8 */
 315         sc->sc_ccf &= 7;
 316
 317         /*
 318          * Register with CAM
 319          */
 320         devq = cam_simq_alloc(sc->sc_ntarg);
 321         if (devq == NULL) {
 322                 device_printf(sc->sc_dev, "cannot allocate device queue\n");
 323                 error = ENOMEM;
 324                 goto fail_tinfo;
 325         }
 326
 327         sim = cam_sim_alloc(ncr53c9x_action, ncr53c9x_poll, "esp", sc,
 328                             device_get_unit(sc->sc_dev), 1,
 329                             NCR_TAG_DEPTH, devq);
 330         if (sim == NULL) {
 331                 device_printf(sc->sc_dev, "cannot allocate SIM entry\n");
 332                 error = ENOMEM;
 333                 goto fail_devq;
 334         }
 335         if (xpt_bus_register(sim, 0) != CAM_SUCCESS) {
 336                 device_printf(sc->sc_dev, "cannot register bus\n");
 337                 error = EIO;
 338                 goto fail_sim;
 339         }
 340
 341         if (xpt_create_path(&path, NULL, cam_sim_path(sim),
 342                             CAM_TARGET_WILDCARD, CAM_LUN_WILDCARD)
 343                             != CAM_REQ_CMP) {
 344                 device_printf(sc->sc_dev, "cannot create path\n");
 345                 error = EIO;
 346                 goto fail_bus;
 347         }
 348
 349         sc->sc_sim = sim;
 350         sc->sc_path = path;
 351
 352         /* Reset state & bus */
 353 #if 0
 354         sc->sc_cfflags = sc->sc_dev.dv_cfdata->cf_flags;
 355 #endif
 356         sc->sc_state = 0;
 357         ncr53c9x_init(sc, 1);
 358
 359         TAILQ_INIT(&sc->free_list);
 360         if ((sc->ecb_array = malloc(sizeof(struct ncr53c9x_ecb) * NCR_TAG_DEPTH,
 361                                     M_DEVBUF, M_NOWAIT|M_ZERO)) == NULL) {
 362                 device_printf(sc->sc_dev, "cannot allocate ECB array\n");
 363                 error = ENOMEM;
 364                 goto fail_path;
 365         }
 366         for (i = 0; i < NCR_TAG_DEPTH; i++) {
 367                 ecb = &sc->ecb_array[i];
 368                 ecb->sc = sc;
 369                 ecb->tag_id = i;
 370                 TAILQ_INSERT_HEAD(&sc->free_list, ecb, free_links);
 371         }
 372
 373         callout_reset(&sc->sc_watchdog, 60*hz, ncr53c9x_watch, sc);
 374
 375         return (0);
 376
 377 fail_path:
 378         xpt_free_path(path);
 379 fail_bus:
 380         xpt_bus_deregister(cam_sim_path(sim));
 381 fail_sim:
 382         cam_sim_free(sim, TRUE);
 383 fail_devq:
 384         cam_simq_free(devq);
 385 fail_tinfo:
 386         free(sc->sc_tinfo, M_DEVBUF);
 387 fail_imess:
 388         if (sc->sc_imess_self)
 389                 free(sc->sc_imess, M_DEVBUF);
 390 fail_omess:
 391         if (sc->sc_omess_self)
 392                 free(sc->sc_omess, M_DEVBUF);
 393         return (error);
 394 }
 395
 396 int
 397 ncr53c9x_detach(struct ncr53c9x_softc *sc)
 398 {
 399
 400         callout_drain(&sc->sc_watchdog);
 401         mtx_lock(&sc->sc_lock);
 402         ncr53c9x_init(sc, 1);
 403         mtx_unlock(&sc->sc_lock);
 404         xpt_free_path(sc->sc_path);
 405         xpt_bus_deregister(cam_sim_path(sc->sc_sim));
 406         cam_sim_free(sc->sc_sim, TRUE);
 407         free(sc->ecb_array, M_DEVBUF);
 408         free(sc->sc_tinfo, M_DEVBUF);
 409         if (sc->sc_imess_self)
 410                 free(sc->sc_imess, M_DEVBUF);
 411         if (sc->sc_omess_self)
 412                 free(sc->sc_omess, M_DEVBUF);
 413         mtx_destroy(&sc->sc_lock);
 414
 415         return (0);
 416 }
 417
 418 /*
 419  * This is the generic ncr53c9x reset function. It does not reset the SCSI bus,
 420  * only this controller, but kills any on-going commands, and also stops
 421  * and resets the DMA.
 422  *
 423  * After reset, registers are loaded with the defaults from the attach
 424  * routine above.
 425  */
 426 void
 427 ncr53c9x_reset(struct ncr53c9x_softc *sc)
 428 {
 429
 430         /* reset DMA first */
 431         NCRDMA_RESET(sc);
 432
 433         /* reset SCSI chip */
 434         NCRCMD(sc, NCRCMD_RSTCHIP);
 435         NCRCMD(sc, NCRCMD_NOP);
 436         DELAY(500);
 437
 438         /* do these backwards, and fall through */
 439         switch (sc->sc_rev) {
 440         case NCR_VARIANT_ESP406:
 441         case NCR_VARIANT_FAS408:
 442                 NCR_WRITE_REG(sc, NCR_CFG5, sc->sc_cfg5 | NCRCFG5_SINT);
 443                 NCR_WRITE_REG(sc, NCR_CFG4, sc->sc_cfg4);
 444         case NCR_VARIANT_AM53C974:
 445         case NCR_VARIANT_FAS100A:
 446         case NCR_VARIANT_FAS216:
 447         case NCR_VARIANT_FAS236:
 448         case NCR_VARIANT_NCR53C94:
 449         case NCR_VARIANT_NCR53C96:
 450         case NCR_VARIANT_ESP200:
 451                 sc->sc_features |= NCR_F_HASCFG3;
 452                 NCR_WRITE_REG(sc, NCR_CFG3, sc->sc_cfg3);
 453         case NCR_VARIANT_ESP100A:
 454                 sc->sc_features |= NCR_F_SELATN3;
 455                 NCR_WRITE_REG(sc, NCR_CFG2, sc->sc_cfg2);
 456         case NCR_VARIANT_ESP100:
 457                 NCR_WRITE_REG(sc, NCR_CFG1, sc->sc_cfg1);
 458                 NCR_WRITE_REG(sc, NCR_CCF, sc->sc_ccf);
 459                 NCR_WRITE_REG(sc, NCR_SYNCOFF, 0);
 460                 NCR_WRITE_REG(sc, NCR_TIMEOUT, sc->sc_timeout);
 461                 break;
 462
 463         case NCR_VARIANT_FAS366:
 464                 sc->sc_features |=
 465                     NCR_F_HASCFG3 | NCR_F_FASTSCSI | NCR_F_SELATN3;
 466                 sc->sc_cfg3 = NCRFASCFG3_FASTCLK | NCRFASCFG3_OBAUTO;
 467                 sc->sc_cfg3_fscsi = NCRFASCFG3_FASTSCSI;
 468                 NCR_WRITE_REG(sc, NCR_CFG3, sc->sc_cfg3);
 469                 sc->sc_cfg2 = 0; /* NCRCFG2_HMEFE| NCRCFG2_HME32 */
 470                 NCR_WRITE_REG(sc, NCR_CFG2, sc->sc_cfg2);
 471                 NCR_WRITE_REG(sc, NCR_CFG1, sc->sc_cfg1);
 472                 NCR_WRITE_REG(sc, NCR_CCF, sc->sc_ccf);
 473                 NCR_WRITE_REG(sc, NCR_SYNCOFF, 0);
 474                 NCR_WRITE_REG(sc, NCR_TIMEOUT, sc->sc_timeout);
 475                 break;
 476
 477         default:
 478                 device_printf(sc->sc_dev, "unknown revision code, "
 479                               "assuming ESP100\n");
 480                 NCR_WRITE_REG(sc, NCR_CFG1, sc->sc_cfg1);
 481                 NCR_WRITE_REG(sc, NCR_CCF, sc->sc_ccf);
 482                 NCR_WRITE_REG(sc, NCR_SYNCOFF, 0);
 483                 NCR_WRITE_REG(sc, NCR_TIMEOUT, sc->sc_timeout);
 484         }
 485
 486         if (sc->sc_rev == NCR_VARIANT_AM53C974)
 487                 NCR_WRITE_REG(sc, NCR_AMDCFG4, sc->sc_cfg4);
 488
 489 #if 0
 490         device_printf(sc->sc_dev, "ncr53c9x_reset: revision %d\n",
 491                sc->sc_rev);
 492         device_printf(sc->sc_dev, "ncr53c9x_reset: cfg1 0x%x, cfg2 0x%x, "
 493             "cfg3 0x%x, ccf 0x%x, timeout 0x%x\n",
 494             sc->sc_cfg1, sc->sc_cfg2, sc->sc_cfg3, sc->sc_ccf, sc->sc_timeout);
 495 #endif
 496 }
 497
 498 /*
 499  * Reset the SCSI bus, but not the chip
 500  */
 501 static void
 502 ncr53c9x_scsi_reset(struct ncr53c9x_softc *sc)
 503 {
 504
 505         (*sc->sc_glue->gl_dma_stop)(sc);
 506
 507         NCR_MISC(("%s: resetting SCSI bus\n", device_get_nameunit(sc->sc_dev)));
 508         NCRCMD(sc, NCRCMD_RSTSCSI);
 509         DELAY(250000);          /* Give the bus a fighting chance to settle */
 510 }
 511
 512 /*
 513  * Initialize ncr53c9x state machine
 514  */
 515 void
 516 ncr53c9x_init(struct ncr53c9x_softc *sc, int doreset)
 517 {
 518         struct ncr53c9x_ecb *ecb;
 519         struct ncr53c9x_linfo *li;
 520         int i, r;
 521
 522         NCR_MISC(("[NCR_INIT(%d) %d] ", doreset, sc->sc_state));
 523
 524         if (sc->sc_state == 0) {
 525                 /* First time through; initialize. */
 526
 527                 TAILQ_INIT(&sc->ready_list);
 528                 sc->sc_nexus = NULL;
 529                 memset(sc->sc_tinfo, 0, sizeof(sc->sc_tinfo));
 530                 for (r = 0; r < sc->sc_ntarg; r++) {
 531                         LIST_INIT(&sc->sc_tinfo[r].luns);
 532                 }
 533         } else {
 534                 /* Cancel any active commands. */
 535                 sc->sc_state = NCR_CLEANING;
 536                 sc->sc_msgify = 0;
 537                 if ((ecb = sc->sc_nexus) != NULL) {
 538                         ecb->ccb->ccb_h.status = CAM_CMD_TIMEOUT;
 539                         ncr53c9x_done(sc, ecb);
 540                 }
 541                 /* Cancel outstanding disconnected commands on each LUN */
 542                 for (r = 0; r < sc->sc_ntarg; r++) {
 543                         LIST_FOREACH(li, &sc->sc_tinfo[r].luns, link) {
 544                                 if ((ecb = li->untagged) != NULL) {
 545                                         li->untagged = NULL;
 546                                         /*
 547                                          * XXXXXXX
 548                                          *
 549                                          * Should we terminate a command
 550                                          * that never reached the disk?
 551                                          */
 552                                         li->busy = 0;
 553                                         ecb->ccb->ccb_h.status =
 554                                             CAM_CMD_TIMEOUT;
 555                                         ncr53c9x_done(sc, ecb);
 556                                 }
 557                                 for (i = 0; i < 256; i++)
 558                                         if ((ecb = li->queued[i])) {
 559                                                 li->queued[i] = NULL;
 560                                                 ecb->ccb->ccb_h.status =
 561                                                     CAM_CMD_TIMEOUT;
 562                                                 ncr53c9x_done(sc, ecb);
 563                                         }
 564                                 li->used = 0;
 565                         }
 566                 }
 567         }
 568
 569         /*
 570          * reset the chip to a known state
 571          */
 572         ncr53c9x_reset(sc);
 573
 574         sc->sc_flags = 0;
 575         sc->sc_msgpriq = sc->sc_msgout = sc->sc_msgoutq = 0;
 576         sc->sc_phase = sc->sc_prevphase = INVALID_PHASE;
 577
 578         for (r = 0; r < sc->sc_ntarg; r++) {
 579                 struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[r];
 580 /* XXX - config flags per target: low bits: no reselect; high bits: no synch */
 581
 582                 ti->flags = ((sc->sc_minsync && !(sc->sc_cfflags & (1<<((r&7)+8))))
 583                     ? 0 : T_SYNCHOFF) |
 584                     ((sc->sc_cfflags & (1<<(r&7))) ? T_RSELECTOFF : 0);
 585 #ifdef DEBUG
 586                 if (ncr53c9x_notag)
 587                         ti->flags &= ~T_TAG;
 588 #endif
 589                 ti->period = sc->sc_minsync;
 590                 ti->offset = 0;
 591                 ti->cfg3   = 0;
 592         }
 593
 594         if (doreset) {
 595                 sc->sc_state = NCR_SBR;
 596                 NCRCMD(sc, NCRCMD_RSTSCSI);
 597         } else {
 598                 sc->sc_state = NCR_IDLE;
 599                 ncr53c9x_sched(sc);
 600         }
 601 }
 602
 603 /*
 604  * Read the NCR registers, and save their contents for later use.
 605  * NCR_STAT, NCR_STEP & NCR_INTR are mostly zeroed out when reading
 606  * NCR_INTR - so make sure it is the last read.
 607  *
 608  * I think that (from reading the docs) most bits in these registers
 609  * only make sense when he DMA CSR has an interrupt showing. Call only
 610  * if an interrupt is pending.
 611  */
 612 static __inline void
 613 ncr53c9x_readregs(struct ncr53c9x_softc *sc)
 614 {
 615
 616         sc->sc_espstat = NCR_READ_REG(sc, NCR_STAT);
 617         /* Only the stepo bits are of interest */
 618         sc->sc_espstep = NCR_READ_REG(sc, NCR_STEP) & NCRSTEP_MASK;
 619
 620         if (sc->sc_rev == NCR_VARIANT_FAS366)
 621                 sc->sc_espstat2 = NCR_READ_REG(sc, NCR_STAT2);
 622
 623         sc->sc_espintr = NCR_READ_REG(sc, NCR_INTR);
 624
 625         if (sc->sc_glue->gl_clear_latched_intr != NULL)
 626                 (*sc->sc_glue->gl_clear_latched_intr)(sc);
 627
 628         /*
 629          * Determine the SCSI bus phase, return either a real SCSI bus phase
 630          * or some pseudo phase we use to detect certain exceptions.
 631          */
 632
 633         sc->sc_phase = (sc->sc_espintr & NCRINTR_DIS) ?
 634             /* Disconnected */ BUSFREE_PHASE : sc->sc_espstat & NCRSTAT_PHASE;
 635
 636         NCR_INTS(("regs[intr=%02x,stat=%02x,step=%02x,stat2=%02x] ",
 637             sc->sc_espintr, sc->sc_espstat, sc->sc_espstep, sc->sc_espstat2));
 638 }
 639
 640 /*
 641  * Convert Synchronous Transfer Period to chip register Clock Per Byte value.
 642  */
 643 static __inline int
 644 ncr53c9x_stp2cpb(struct ncr53c9x_softc *sc, int period)
 645 {
 646         int v;
 647         v = (sc->sc_freq * period) / 250;
 648         if (ncr53c9x_cpb2stp(sc, v) < period)
 649                 /* Correct round-down error */
 650                 v++;
 651         return (v);
 652 }
 653
 654 static __inline void
 655 ncr53c9x_setsync(struct ncr53c9x_softc *sc, struct ncr53c9x_tinfo *ti)
 656 {
 657         u_char syncoff, synctp;
 658         u_char cfg3 = sc->sc_cfg3 | ti->cfg3;
 659
 660         if (ti->flags & T_SYNCMODE) {
 661                 syncoff = ti->offset;
 662                 synctp = ncr53c9x_stp2cpb(sc, ti->period);
 663                 if (sc->sc_features & NCR_F_FASTSCSI) {
 664                         /*
 665                          * If the period is 200ns or less (ti->period <= 50),
 666                          * put the chip in Fast SCSI mode.
 667                          */
 668                         if (ti->period <= 50)
 669                                 /*
 670                                  * There are (at least) 4 variations of the
 671                                  * configuration 3 register.  The drive attach
 672                                  * routine sets the appropriate bit to put the
 673                                  * chip into Fast SCSI mode so that it doesn't
 674                                  * have to be figured out here each time.
 675                                  */
 676                                 cfg3 |= sc->sc_cfg3_fscsi;
 677                 }
 678
 679                 /*
 680                  * Am53c974 requires different SYNCTP values when the
 681                  * FSCSI bit is off.
 682                  */
 683                 if (sc->sc_rev == NCR_VARIANT_AM53C974 &&
 684                     (cfg3 & NCRAMDCFG3_FSCSI) == 0)
 685                         synctp--;
 686         } else {
 687                 syncoff = 0;
 688                 synctp = 0;
 689         }
 690
 691         if (sc->sc_features & NCR_F_HASCFG3)
 692                 NCR_WRITE_REG(sc, NCR_CFG3, cfg3);
 693
 694         NCR_WRITE_REG(sc, NCR_SYNCOFF, syncoff);
 695         NCR_WRITE_REG(sc, NCR_SYNCTP, synctp);
 696 }
 697
 698 /*
 699  * Send a command to a target, set the driver state to NCR_SELECTING
 700  * and let the caller take care of the rest.
 701  *
 702  * Keeping this as a function allows me to say that this may be done
 703  * by DMA instead of programmed I/O soon.
 704  */
 705 static void
 706 ncr53c9x_select(struct ncr53c9x_softc *sc, struct ncr53c9x_ecb *ecb)
 707 {
 708         int target = ecb->ccb->ccb_h.target_id;
 709         int lun = ecb->ccb->ccb_h.target_lun;
 710         struct ncr53c9x_tinfo *ti;
 711         int tiflags;
 712         u_char *cmd;
 713         int clen;
 714         int selatn3, selatns;
 715         size_t dmasize;
 716
 717         NCR_TRACE(("[ncr53c9x_select(t%d,l%d,cmd:%x,tag:%x,%x)] ",
 718             target, lun, ecb->cmd.cmd.opcode, ecb->tag[0], ecb->tag[1]));
 719
 720         ti = &sc->sc_tinfo[target];
 721         tiflags = ti->flags;
 722         sc->sc_state = NCR_SELECTING;
 723         /*
 724          * Schedule the timeout now, the first time we will go away
 725          * expecting to come back due to an interrupt, because it is
 726          * always possible that the interrupt may never happen.
 727          */
 728         ecb->ccb->ccb_h.timeout_ch =
 729             timeout(ncr53c9x_timeout, ecb, mstohz(ecb->timeout));
 730
 731         /*
 732          * The docs say the target register is never reset, and I
 733          * can't think of a better place to set it
 734          */
 735         if (sc->sc_rev == NCR_VARIANT_FAS366) {
 736                 NCRCMD(sc, NCRCMD_FLUSH);
 737                 NCR_WRITE_REG(sc, NCR_SELID, target | NCR_BUSID_HME);
 738         } else {
 739                 NCR_WRITE_REG(sc, NCR_SELID, target);
 740         }
 741         ncr53c9x_setsync(sc, ti);
 742
 743         if ((ecb->flags & ECB_SENSE) != 0) {
 744                 /*
 745                  * For REQUEST SENSE, we should not send an IDENTIFY or
 746                  * otherwise mangle the target.  There should be no MESSAGE IN
 747                  * phase.
 748                  */
 749                 if (sc->sc_features & NCR_F_DMASELECT) {
 750                         /* setup DMA transfer for command */
 751                         dmasize = clen = ecb->clen;
 752                         sc->sc_cmdlen = clen;
 753                         sc->sc_cmdp = (caddr_t)&ecb->cmd.cmd;
 754
 755                         /* Program the SCSI counter */
 756                         NCR_SET_COUNT(sc, dmasize);
 757
 758                         if (sc->sc_rev != NCR_VARIANT_FAS366)
 759                                 NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA);
 760
 761                         /* And get the targets attention */
 762                         NCRCMD(sc, NCRCMD_SELNATN | NCRCMD_DMA);
 763                         NCRDMA_SETUP(sc, &sc->sc_cmdp, &sc->sc_cmdlen, 0,
 764                             &dmasize);
 765                         NCRDMA_GO(sc);
 766                 } else {
 767                         ncr53c9x_wrfifo(sc, (u_char *)&ecb->cmd.cmd, ecb->clen);
 768                         NCRCMD(sc, NCRCMD_SELNATN);
 769                 }
 770                 return;
 771         }
 772
 773         selatn3 = selatns = 0;
 774         if (ecb->tag[0] != 0) {
 775                 if (sc->sc_features & NCR_F_SELATN3)
 776                         /* use SELATN3 to send tag messages */
 777                         selatn3 = 1;
 778                 else
 779                         /* We don't have SELATN3; use SELATNS to send tags */
 780                         selatns = 1;
 781         }
 782
 783         if (ti->flags & T_NEGOTIATE) {
 784                 /* We have to use SELATNS to send sync/wide messages */
 785                 selatn3 = 0;
 786                 selatns = 1;
 787         }
 788
 789         cmd = (u_char *)&ecb->cmd.cmd;
 790
 791         if (selatn3) {
 792                 /* We'll use tags with SELATN3 */
 793                 clen = ecb->clen + 3;
 794                 cmd -= 3;
 795                 cmd[0] = MSG_IDENTIFY(lun, 1);  /* msg[0] */
 796                 cmd[1] = ecb->tag[0];           /* msg[1] */
 797                 cmd[2] = ecb->tag[1];           /* msg[2] */
 798         } else {
 799                 /* We don't have tags, or will send messages with SELATNS */
 800                 clen = ecb->clen + 1;
 801                 cmd -= 1;
 802                 cmd[0] = MSG_IDENTIFY(lun, (tiflags & T_RSELECTOFF) == 0);
 803         }
 804
 805         if ((sc->sc_features & NCR_F_DMASELECT) && !selatns) {
 806
 807                 /* setup DMA transfer for command */
 808                 dmasize = clen;
 809                 sc->sc_cmdlen = clen;
 810                 sc->sc_cmdp = cmd;
 811
 812                 /* Program the SCSI counter */
 813                 NCR_SET_COUNT(sc, dmasize);
 814
 815                 /* load the count in */
 816                 /* if (sc->sc_rev != NCR_VARIANT_FAS366) */
 817                         NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA);
 818
 819                 /* And get the targets attention */
 820                 if (selatn3) {
 821                         sc->sc_msgout = SEND_TAG;
 822                         sc->sc_flags |= NCR_ATN;
 823                         NCRCMD(sc, NCRCMD_SELATN3 | NCRCMD_DMA);
 824                 } else
 825                         NCRCMD(sc, NCRCMD_SELATN | NCRCMD_DMA);
 826                 NCRDMA_SETUP(sc, &sc->sc_cmdp, &sc->sc_cmdlen, 0, &dmasize);
 827                 NCRDMA_GO(sc);
 828                 return;
 829         }
 830
 831         /*
 832          * Who am I?  This is where we tell the target that we are
 833          * happy for it to disconnect etc.
 834          */
 835
 836         /* Now get the command into the FIFO */
 837         ncr53c9x_wrfifo(sc, cmd, clen);
 838
 839         /* And get the targets attention */
 840         if (selatns) {
 841                 NCR_MSGS(("SELATNS \n"));
 842                 /* Arbitrate, select and stop after IDENTIFY message */
 843                 NCRCMD(sc, NCRCMD_SELATNS);
 844         } else if (selatn3) {
 845                 sc->sc_msgout = SEND_TAG;
 846                 sc->sc_flags |= NCR_ATN;
 847                 NCRCMD(sc, NCRCMD_SELATN3);
 848         } else
 849                 NCRCMD(sc, NCRCMD_SELATN);
 850 }
 851
 852 static void
 853 ncr53c9x_free_ecb(struct ncr53c9x_softc *sc, struct ncr53c9x_ecb *ecb)
 854 {
 855
 856         ecb->flags = 0;
 857         TAILQ_INSERT_TAIL(&sc->free_list, ecb, free_links);
 858         return;
 859 }
 860
 861 static struct ncr53c9x_ecb *
 862 ncr53c9x_get_ecb(struct ncr53c9x_softc *sc)
 863 {
 864         struct ncr53c9x_ecb *ecb;
 865
 866         ecb = TAILQ_FIRST(&sc->free_list);
 867         if (ecb) {
 868                 if (ecb->flags != 0)
 869                         panic("ecb flags not cleared\n");
 870                 TAILQ_REMOVE(&sc->free_list, ecb, free_links);
 871                 ecb->flags = ECB_ALLOC;
 872                 bzero(&ecb->ccb, sizeof(struct ncr53c9x_ecb) -
 873                       offsetof(struct ncr53c9x_ecb, ccb));
 874         }
 875         return (ecb);
 876 }
 877
 878 /*
 879  * DRIVER FUNCTIONS CALLABLE FROM HIGHER LEVEL DRIVERS:
 880  */
 881
 882 /*
 883  * Start a SCSI-command
 884  * This function is called by the higher level SCSI-driver to queue/run
 885  * SCSI-commands.
 886  */
 887
 888 void
 889 ncr53c9x_action(struct cam_sim *sim, union ccb *ccb)
 890 {
 891         struct ncr53c9x_softc *sc;
 892         struct ncr53c9x_ecb *ecb;
 893
 894         NCR_TRACE(("[ncr53c9x_action %d]", ccb->ccb_h.func_code));
 895
 896         sc = cam_sim_softc(sim);
 897         mtx_lock(&sc->sc_lock);
 898
 899         switch (ccb->ccb_h.func_code) {
 900         case XPT_RESET_BUS:
 901                 ncr53c9x_scsi_reset(sc);
 902                 ccb->ccb_h.status = CAM_REQ_CMP;
 903                 mtx_unlock(&sc->sc_lock);
 904                 xpt_done(ccb);
 905                 return;
 906         case XPT_CALC_GEOMETRY:
 907                 mtx_unlock(&sc->sc_lock);
 908                 cam_calc_geometry(&ccb->ccg, sc->sc_extended_geom);
 909                 xpt_done(ccb);
 910                 return;
 911         case XPT_PATH_INQ:
 912         {
 913                 struct ccb_pathinq *cpi = &ccb->cpi;
 914
 915                 cpi->version_num = 1;
 916                 cpi->hba_inquiry = PI_SDTR_ABLE|PI_TAG_ABLE;
 917                 cpi->hba_inquiry |=
 918                     (sc->sc_rev == NCR_VARIANT_FAS366) ? PI_WIDE_16 : 0;
 919                 cpi->target_sprt = 0;
 920                 cpi->hba_misc = 0;
 921                 cpi->hba_eng_cnt = 0;
 922                 cpi->max_target = sc->sc_ntarg - 1;
 923                 cpi->max_lun = 8;
 924                 cpi->initiator_id = sc->sc_id;
 925                 cpi->bus_id = 0;
 926                 cpi->base_transfer_speed = 3300;
 927                 strncpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
 928                 strncpy(cpi->hba_vid, "Sun", HBA_IDLEN);
 929                 strncpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
 930                 cpi->unit_number = cam_sim_unit(sim);
 931                 ccb->ccb_h.status = CAM_REQ_CMP;
 932                 mtx_unlock(&sc->sc_lock);
 933                 xpt_done(ccb);
 934                 return;
 935         }
 936         case XPT_GET_TRAN_SETTINGS:
 937         {
 938                 struct ccb_trans_settings *cts = &ccb->cts;
 939                 struct ncr53c9x_tinfo *ti;
 940
 941                 ti = &sc->sc_tinfo[ccb->ccb_h.target_id];
 942
 943                 if ((cts->flags & CCB_TRANS_CURRENT_SETTINGS) != 0) {
 944                         cts->sync_period = ti->period;
 945                         cts->sync_offset = ti->offset;
 946                         cts->bus_width = ti->width;
 947                         if ((ti->flags & T_TAG) != 0)
 948                                 cts->flags |=
 949                                     (CCB_TRANS_DISC_ENB | CCB_TRANS_TAG_ENB);
 950                         else
 951                                 cts->flags &=
 952                                     ~(CCB_TRANS_DISC_ENB | CCB_TRANS_TAG_ENB);
 953                 } else {
 954                         cts->sync_period = sc->sc_maxsync;
 955                         cts->sync_offset = sc->sc_maxoffset;
 956                         cts->bus_width = sc->sc_maxwidth;
 957                         cts->flags |= (CCB_TRANS_DISC_ENB | CCB_TRANS_TAG_ENB);
 958                 }
 959                 cts->valid = CCB_TRANS_BUS_WIDTH_VALID |
 960                              CCB_TRANS_SYNC_RATE_VALID |
 961                              CCB_TRANS_SYNC_OFFSET_VALID |
 962                              CCB_TRANS_DISC_VALID |
 963                              CCB_TRANS_TQ_VALID;
 964                 ccb->ccb_h.status = CAM_REQ_CMP;
 965                 mtx_unlock(&sc->sc_lock);
 966                 xpt_done(ccb);
 967                 return;
 968         }
 969         case XPT_ABORT:
 970                 printf("XPT_ABORT called\n");
 971                 ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
 972                 mtx_unlock(&sc->sc_lock);
 973                 xpt_done(ccb);
 974                 return;
 975         case XPT_TERM_IO:
 976                 printf("XPT_TERM_IO called\n");
 977                 ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
 978                 mtx_unlock(&sc->sc_lock);
 979                 xpt_done(ccb);
 980                 return;
 981         case XPT_RESET_DEV:
 982                 printf("XPT_RESET_DEV called\n");
 983         case XPT_SCSI_IO:
 984         {
 985                 struct ccb_scsiio *csio;
 986
 987                 if (ccb->ccb_h.target_id < 0 ||
 988                     ccb->ccb_h.target_id >= sc->sc_ntarg) {
 989                         ccb->ccb_h.status = CAM_PATH_INVALID;
 990                         mtx_unlock(&sc->sc_lock);
 991                         xpt_done(ccb);
 992                         return;
 993                 }
 994                 /* Get an ECB to use. */
 995                 ecb = ncr53c9x_get_ecb(sc);
 996                 /*
 997                  * This should never happen as we track resources
 998                  * in the mid-layer.
 999                  */
1000                 if (ecb == NULL) {
1001                         xpt_freeze_simq(sim, 1);
1002                         ccb->ccb_h.status = CAM_REQUEUE_REQ;
1003                         printf("unable to allocate ecb\n");
1004                         mtx_unlock(&sc->sc_lock);
1005                         xpt_done(ccb);
1006                         return;
1007                 }
1008
1009                 /* Initialize ecb */
1010                 ecb->ccb = ccb;
1011                 ecb->timeout = ccb->ccb_h.timeout;
1012
1013                 if (ccb->ccb_h.func_code == XPT_RESET_DEV) {
1014                         ecb->flags |= ECB_RESET;
1015                         ecb->clen = 0;
1016                         ecb->dleft = 0;
1017                 } else {
1018                         csio = &ccb->csio;
1019                         if ((ccb->ccb_h.flags & CAM_CDB_POINTER) != 0)
1020                                 bcopy(csio->cdb_io.cdb_ptr, &ecb->cmd.cmd,
1021                                       csio->cdb_len);
1022                         else
1023                                 bcopy(csio->cdb_io.cdb_bytes, &ecb->cmd.cmd,
1024                                       csio->cdb_len);
1025                         ecb->clen = csio->cdb_len;
1026                         ecb->daddr = csio->data_ptr;
1027                         ecb->dleft = csio->dxfer_len;
1028                 }
1029                 ecb->stat = 0;
1030
1031                 TAILQ_INSERT_TAIL(&sc->ready_list, ecb, chain);
1032                 ecb->flags |= ECB_READY;
1033                 if (sc->sc_state == NCR_IDLE)
1034                         ncr53c9x_sched(sc);
1035
1036                 break;
1037         }
1038
1039         case XPT_SET_TRAN_SETTINGS:
1040         {
1041                 struct ncr53c9x_tinfo *ti;
1042                 struct ccb_trans_settings *cts = &ccb->cts;
1043                 int target = ccb->ccb_h.target_id;
1044
1045                 ti = &sc->sc_tinfo[target];
1046
1047                 if ((cts->valid & CCB_TRANS_TQ_VALID) != 0) {
1048                         if ((sc->sc_cfflags & (1<<((target & 7) + 16))) == 0 &&
1049                             (cts->flags & CCB_TRANS_TAG_ENB)) {
1050                                 NCR_MISC(("%s: target %d: tagged queuing\n",
1051                                     device_get_nameunit(sc->sc_dev), target));
1052                                 ti->flags |= T_TAG;
1053                         } else
1054                                 ti->flags &= ~T_TAG;
1055                 }
1056
1057                 if ((cts->valid & CCB_TRANS_BUS_WIDTH_VALID) != 0) {
1058                         if (cts->bus_width != 0) {
1059                                 NCR_MISC(("%s: target %d: wide negotiation\n",
1060                                     device_get_nameunit(sc->sc_dev), target));
1061                                 if (sc->sc_rev == NCR_VARIANT_FAS366) {
1062                                         ti->flags |= T_WIDE;
1063                                         ti->width = 1;
1064                                 }
1065                         } else {
1066                                 ti->flags &= ~T_WIDE;
1067                                 ti->width = 0;
1068                         }
1069                         ti->flags |= T_NEGOTIATE;
1070                 }
1071
1072                 if ((cts->valid & CCB_TRANS_SYNC_RATE_VALID) != 0) {
1073                         NCR_MISC(("%s: target %d: sync period negotiation\n",
1074                             device_get_nameunit(sc->sc_dev), target));
1075                         ti->flags |= T_NEGOTIATE;
1076                         ti->period = cts->sync_period;
1077                 }
1078
1079                 if ((cts->valid & CCB_TRANS_SYNC_OFFSET_VALID) != 0) {
1080                         NCR_MISC(("%s: target %d: sync offset negotiation\n",
1081                             device_get_nameunit(sc->sc_dev), target));
1082                         ti->flags |= T_NEGOTIATE;
1083                         ti->offset = cts->sync_offset;
1084                 }
1085
1086                 mtx_unlock(&sc->sc_lock);
1087                 ccb->ccb_h.status = CAM_REQ_CMP;
1088                 xpt_done(ccb);
1089                 return;
1090         }
1091
1092         default:
1093                 device_printf(sc->sc_dev, "Unhandled function code %d\n",
1094                        ccb->ccb_h.func_code);
1095                 ccb->ccb_h.status = CAM_PROVIDE_FAIL;
1096                 mtx_unlock(&sc->sc_lock);
1097                 xpt_done(ccb);
1098                 return;
1099         }
1100
1101         mtx_unlock(&sc->sc_lock);
1102 }
1103
1104 /*
1105  * Used when interrupt driven I/O is not allowed, e.g. during boot.
1106  */
1107 static void
1108 ncr53c9x_poll(struct cam_sim *sim)
1109 {
1110         struct ncr53c9x_softc *sc;
1111
1112         NCR_TRACE(("[ncr53c9x_poll] "));
1113         sc = cam_sim_softc(sim);
1114         if (NCRDMA_ISINTR(sc)) {
1115                 ncr53c9x_intr(sc);
1116         }
1117 }
1118
1119 /*
1120  * LOW LEVEL SCSI UTILITIES
1121  */
1122
1123 /*
1124  * Schedule a scsi operation.  This has now been pulled out of the interrupt
1125  * handler so that we may call it from ncr53c9x_scsipi_request and
1126  * ncr53c9x_done.  This may save us an unnecessary interrupt just to get
1127  * things going.  Should only be called when state == NCR_IDLE and at bio pl.
1128  */
1129 static void
1130 ncr53c9x_sched(struct ncr53c9x_softc *sc)
1131 {
1132         struct ncr53c9x_ecb *ecb;
1133         struct ncr53c9x_tinfo *ti;
1134         struct ncr53c9x_linfo *li;
1135         int lun;
1136         int tag;
1137
1138         NCR_TRACE(("[ncr53c9x_sched] "));
1139         if (sc->sc_state != NCR_IDLE)
1140                 panic("ncr53c9x_sched: not IDLE (state=%d)", sc->sc_state);
1141
1142         /*
1143          * Find first ecb in ready queue that is for a target/lunit
1144          * combinations that is not busy.
1145          */
1146         for (ecb = TAILQ_FIRST(&sc->ready_list); ecb != NULL;
1147             ecb = TAILQ_NEXT(ecb, chain)) {
1148                 ti = &sc->sc_tinfo[ecb->ccb->ccb_h.target_id];
1149                 lun = ecb->ccb->ccb_h.target_lun;
1150
1151                 /* Select type of tag for this command */
1152                 if ((ti->flags & (T_RSELECTOFF)) != 0)
1153                         tag = 0;
1154                 else if ((ti->flags & (T_TAG)) == 0)
1155                         tag = 0;
1156                 else if ((ecb->flags & ECB_SENSE) != 0)
1157                         tag = 0;
1158                 else if ((ecb->ccb->ccb_h.flags & CAM_TAG_ACTION_VALID) == 0)
1159                         tag = 0;
1160                 else if (ecb->ccb->csio.tag_action == CAM_TAG_ACTION_NONE)
1161                         tag = 0;
1162                 else
1163                         tag = ecb->ccb->csio.tag_action;
1164
1165                 li = TINFO_LUN(ti, lun);
1166                 if (li == NULL) {
1167                         /* Initialize LUN info and add to list. */
1168                         if ((li = malloc(sizeof(*li),
1169                             M_DEVBUF, M_NOWAIT|M_ZERO)) == NULL) {
1170                                 continue;
1171                         }
1172                         li->lun = lun;
1173
1174                         LIST_INSERT_HEAD(&ti->luns, li, link);
1175                         if (lun < NCR_NLUN)
1176                                 ti->lun[lun] = li;
1177                 }
1178                 li->last_used = time_second;
1179                 if (tag == 0) {
1180                         /* Try to issue this as an un-tagged command */
1181                         if (li->untagged == NULL)
1182                                 li->untagged = ecb;
1183                 }
1184                 if (li->untagged != NULL) {
1185                         tag = 0;
1186                         if ((li->busy != 1) && li->used == 0) {
1187                                 /* We need to issue this untagged command now */
1188                                 ecb = li->untagged;
1189                         } else {
1190                                 /* Not ready yet */
1191                                 continue;
1192                         }
1193                 }
1194                 ecb->tag[0] = tag;
1195                 if (tag != 0) {
1196                         li->queued[ecb->tag_id] = ecb;
1197                         ecb->tag[1] = ecb->tag_id;
1198                         li->used++;
1199                 }
1200                 if (li->untagged != NULL && (li->busy != 1)) {
1201                         li->busy = 1;
1202                         TAILQ_REMOVE(&sc->ready_list, ecb, chain);
1203                         ecb->flags &= ~ECB_READY;
1204                         sc->sc_nexus = ecb;
1205                         ncr53c9x_select(sc, ecb);
1206                         break;
1207                 }
1208                 if (li->untagged == NULL && tag != 0) {
1209                         TAILQ_REMOVE(&sc->ready_list, ecb, chain);
1210                         ecb->flags &= ~ECB_READY;
1211                         sc->sc_nexus = ecb;
1212                         ncr53c9x_select(sc, ecb);
1213                         break;
1214                 } else
1215                         NCR_TRACE(("%d:%d busy\n",
1216                             ecb->ccb->ccb_h.target_id,
1217                             ecb->ccb->ccb_h.target_lun));
1218         }
1219 }
1220
1221 static void
1222 ncr53c9x_sense(struct ncr53c9x_softc *sc, struct ncr53c9x_ecb *ecb)
1223 {
1224         union ccb *ccb = ecb->ccb;
1225         struct ncr53c9x_tinfo *ti;
1226         struct scsi_request_sense *ss = (void *)&ecb->cmd.cmd;
1227         struct ncr53c9x_linfo *li;
1228         int lun;
1229
1230         NCR_TRACE(("requesting sense "));
1231
1232         lun = ccb->ccb_h.target_lun;
1233         ti = &sc->sc_tinfo[ccb->ccb_h.target_id];
1234
1235         /* Next, setup a request sense command block */
1236         memset(ss, 0, sizeof(*ss));
1237         ss->opcode = REQUEST_SENSE;
1238         ss->byte2 = ccb->ccb_h.target_lun << SCSI_CMD_LUN_SHIFT;
1239         ss->length = sizeof(struct scsi_sense_data);
1240         ecb->clen = sizeof(*ss);
1241         ecb->daddr = (char *)&ecb->ccb->csio.sense_data;
1242         ecb->dleft = sizeof(struct scsi_sense_data);
1243         ecb->flags |= ECB_SENSE;
1244         ecb->timeout = NCR_SENSE_TIMEOUT;
1245         ti->senses++;
1246         li = TINFO_LUN(ti, lun);
1247         if (li->busy)
1248                 li->busy = 0;
1249         ncr53c9x_dequeue(sc, ecb);
1250         li->untagged = ecb; /* must be executed first to fix C/A */
1251         li->busy = 2;
1252         if (ecb == sc->sc_nexus) {
1253                 ncr53c9x_select(sc, ecb);
1254         } else {
1255                 TAILQ_INSERT_HEAD(&sc->ready_list, ecb, chain);
1256                 ecb->flags |= ECB_READY;
1257                 if (sc->sc_state == NCR_IDLE)
1258                         ncr53c9x_sched(sc);
1259         }
1260 }
1261
1262 /*
1263  * POST PROCESSING OF SCSI_CMD (usually current)
1264  */
1265 static void
1266 ncr53c9x_done(struct ncr53c9x_softc *sc, struct ncr53c9x_ecb *ecb)
1267 {
1268         union ccb *ccb = ecb->ccb;
1269         struct ncr53c9x_tinfo *ti;
1270         struct ncr53c9x_linfo *li;
1271         int lun;
1272
1273         NCR_TRACE(("[ncr53c9x_done(status:%x)] ", ccb->ccb_h.status));
1274
1275         ti = &sc->sc_tinfo[ccb->ccb_h.target_id];
1276         lun = ccb->ccb_h.target_lun;
1277         li  = TINFO_LUN(ti, lun);
1278
1279         untimeout(ncr53c9x_timeout, ecb, ccb->ccb_h.timeout_ch);
1280
1281         /*
1282          * Now, if we've come here with no error code, i.e. we've kept the
1283          * initial XS_NOERROR, and the status code signals that we should
1284          * check sense, we'll need to set up a request sense cmd block and
1285          * push the command back into the ready queue *before* any other
1286          * commands for this target/lunit, else we lose the sense info.
1287          * We don't support chk sense conditions for the request sense cmd.
1288          */
1289         if (ccb->ccb_h.status == CAM_REQ_CMP) {
1290                 if ((ecb->flags & ECB_ABORT) != 0) {
1291                         ccb->ccb_h.status = CAM_CMD_TIMEOUT;
1292                 } else if ((ecb->flags & ECB_SENSE) != 0 &&
1293                            (ecb->stat != SCSI_STATUS_CHECK_COND)) {
1294                         ccb->ccb_h.status = CAM_AUTOSNS_VALID;
1295                 } else if (ecb->stat == SCSI_STATUS_CHECK_COND) {
1296                         if ((ecb->flags & ECB_SENSE) != 0)
1297                                 ccb->ccb_h.status = CAM_AUTOSENSE_FAIL;
1298                         else {
1299                                 /* First, save the return values */
1300                                 ccb->csio.resid = ecb->dleft;
1301                                 ncr53c9x_sense(sc, ecb);
1302                                 return;
1303                         }
1304                 } else {
1305                         ccb->csio.resid = ecb->dleft;
1306                 }
1307 #if 0
1308                 if (xs->status == SCSI_QUEUE_FULL || xs->status == XS_BUSY)
1309                         xs->error = XS_BUSY;
1310 #endif
1311         }
1312
1313 #ifdef NCR53C9X_DEBUG
1314         if (ncr53c9x_debug & NCR_SHOWTRAC) {
1315                 if (ccb->csio.resid != 0)
1316                         printf("resid=%d ", ccb->csio.resid);
1317 #if 0
1318                 if (xs->error == XS_SENSE)
1319                         printf("sense=0x%02x\n",
1320                             xs->sense.scsi_sense.error_code);
1321                 else
1322                         printf("error=%d\n", xs->error);
1323 #endif
1324         }
1325 #endif
1326
1327         /*
1328          * Remove the ECB from whatever queue it's on.
1329          */
1330         ncr53c9x_dequeue(sc, ecb);
1331         if (ecb == sc->sc_nexus) {
1332                 sc->sc_nexus = NULL;
1333                 if (sc->sc_state != NCR_CLEANING) {
1334                         sc->sc_state = NCR_IDLE;
1335                         ncr53c9x_sched(sc);
1336                 }
1337         }
1338
1339         if (ccb->ccb_h.status == CAM_SEL_TIMEOUT) {
1340                 /* Selection timeout -- discard this LUN if empty */
1341                 if (li->untagged == NULL && li->used == 0) {
1342                         if (lun < NCR_NLUN)
1343                                 ti->lun[lun] = NULL;
1344                         LIST_REMOVE(li, link);
1345                         free(li, M_DEVBUF);
1346                 }
1347         }
1348
1349         ncr53c9x_free_ecb(sc, ecb);
1350         ti->cmds++;
1351         xpt_done(ccb);
1352 }
1353
1354 static void
1355 ncr53c9x_dequeue(struct ncr53c9x_softc *sc, struct ncr53c9x_ecb *ecb)
1356 {
1357         struct ncr53c9x_tinfo *ti;
1358         struct ncr53c9x_linfo *li;
1359         int64_t lun;
1360
1361         ti = &sc->sc_tinfo[ecb->ccb->ccb_h.target_id];
1362         lun = ecb->ccb->ccb_h.target_lun;
1363         li = TINFO_LUN(ti, lun);
1364 #ifdef DIAGNOSTIC
1365         if (li == NULL || li->lun != lun)
1366                 panic("ncr53c9x_dequeue: lun %qx for ecb %p does not exist",
1367                       (long long) lun, ecb);
1368 #endif
1369         if (li->untagged == ecb) {
1370                 li->busy = 0;
1371                 li->untagged = NULL;
1372         }
1373         if (ecb->tag[0] && li->queued[ecb->tag[1]] != NULL) {
1374 #ifdef DIAGNOSTIC
1375                 if (li->queued[ecb->tag[1]] != NULL &&
1376                     (li->queued[ecb->tag[1]] != ecb))
1377                         panic("ncr53c9x_dequeue: slot %d for lun %qx has %p "
1378                             "instead of ecb %p\n", ecb->tag[1],
1379                             (long long) lun,
1380                             li->queued[ecb->tag[1]], ecb);
1381 #endif
1382                 li->queued[ecb->tag[1]] = NULL;
1383                 li->used--;
1384         }
1385
1386         if ((ecb->flags & ECB_READY) != 0) {
1387                 ecb->flags &= ~ECB_READY;
1388                 TAILQ_REMOVE(&sc->ready_list, ecb, chain);
1389         }
1390 }
1391
1392 /*
1393  * INTERRUPT/PROTOCOL ENGINE
1394  */
1395
1396 /*
1397  * Schedule an outgoing message by prioritizing it, and asserting
1398  * attention on the bus. We can only do this when we are the initiator
1399  * else there will be an illegal command interrupt.
1400  */
1401 #define ncr53c9x_sched_msgout(m) \
1402         do {                                                    \
1403                 NCR_MSGS(("ncr53c9x_sched_msgout %x %d", m, __LINE__)); \
1404                 NCRCMD(sc, NCRCMD_SETATN);                      \
1405                 sc->sc_flags |= NCR_ATN;                        \
1406                 sc->sc_msgpriq |= (m);                          \
1407         } while (0)
1408
1409 static void
1410 ncr53c9x_flushfifo(struct ncr53c9x_softc *sc)
1411 {
1412         NCR_TRACE(("[flushfifo] "));
1413
1414         NCRCMD(sc, NCRCMD_FLUSH);
1415
1416         if (sc->sc_phase == COMMAND_PHASE ||
1417             sc->sc_phase == MESSAGE_OUT_PHASE)
1418                 DELAY(2);
1419 }
1420
1421 static int
1422 ncr53c9x_rdfifo(struct ncr53c9x_softc *sc, int how)
1423 {
1424         int i, n;
1425         u_char *buf;
1426
1427         switch(how) {
1428         case NCR_RDFIFO_START:
1429                 buf = sc->sc_imess;
1430                 sc->sc_imlen = 0;
1431                 break;
1432         case NCR_RDFIFO_CONTINUE:
1433                 buf = sc->sc_imess + sc->sc_imlen;
1434                 break;
1435         default:
1436                 panic("ncr53c9x_rdfifo: bad flag");
1437                 break;
1438         }
1439
1440         /*
1441          * XXX buffer (sc_imess) size for message
1442          */
1443
1444         n = NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF;
1445
1446         if (sc->sc_rev == NCR_VARIANT_FAS366) {
1447                 n *= 2;
1448
1449                 for (i = 0; i < n; i++)
1450                         buf[i] = NCR_READ_REG(sc, NCR_FIFO);
1451
1452                 if (sc->sc_espstat2 & NCRFAS_STAT2_ISHUTTLE) {
1453
1454                         NCR_WRITE_REG(sc, NCR_FIFO, 0);
1455                         buf[i++] = NCR_READ_REG(sc, NCR_FIFO);
1456
1457                         NCR_READ_REG(sc, NCR_FIFO);
1458
1459                         ncr53c9x_flushfifo(sc);
1460                 }
1461         } else {
1462                 for (i = 0; i < n; i++)
1463                         buf[i] = NCR_READ_REG(sc, NCR_FIFO);
1464         }
1465
1466         sc->sc_imlen += i;
1467
1468 #if 0
1469 #ifdef NCR53C9X_DEBUG
1470         {
1471                 int j;
1472
1473                 NCR_TRACE(("\n[rdfifo %s (%d):",
1474                     (how == NCR_RDFIFO_START) ? "start" : "cont",
1475                     (int)sc->sc_imlen));
1476                 if (ncr53c9x_debug & NCR_SHOWTRAC) {
1477                         for (j = 0; j < sc->sc_imlen; j++)
1478                                 printf(" %02x", sc->sc_imess[j]);
1479                         printf("]\n");
1480                 }
1481         }
1482 #endif
1483 #endif
1484         return sc->sc_imlen;
1485 }
1486
1487 static void
1488 ncr53c9x_wrfifo(struct ncr53c9x_softc *sc, u_char *p, int len)
1489 {
1490         int i;
1491
1492 #ifdef NCR53C9X_DEBUG
1493         NCR_MSGS(("[wrfifo(%d):", len));
1494         if (ncr53c9x_debug & NCR_SHOWMSGS) {
1495                 for (i = 0; i < len; i++)
1496                         printf(" %02x", p[i]);
1497                 printf("]\n");
1498         }
1499 #endif
1500
1501         for (i = 0; i < len; i++) {
1502                 NCR_WRITE_REG(sc, NCR_FIFO, p[i]);
1503
1504                 if (sc->sc_rev == NCR_VARIANT_FAS366)
1505                         NCR_WRITE_REG(sc, NCR_FIFO, 0);
1506         }
1507 }
1508
1509 static int
1510 ncr53c9x_reselect(struct ncr53c9x_softc *sc, int message, int tagtype,
1511                   int tagid)
1512 {
1513         u_char selid, target, lun;
1514         struct ncr53c9x_ecb *ecb = NULL;
1515         struct ncr53c9x_tinfo *ti;
1516         struct ncr53c9x_linfo *li;
1517
1518
1519         if (sc->sc_rev == NCR_VARIANT_FAS366) {
1520                 target = sc->sc_selid;
1521         } else {
1522                 /*
1523                  * The SCSI chip made a snapshot of the data bus
1524                  * while the reselection was being negotiated.
1525                  * This enables us to determine which target did
1526                  * the reselect.
1527                  */
1528                 selid = sc->sc_selid & ~(1 << sc->sc_id);
1529                 if (selid & (selid - 1)) {
1530                         device_printf(sc->sc_dev, "reselect with invalid "
1531                             "selid %02x; sending DEVICE RESET\n", selid);
1532                         goto reset;
1533                 }
1534
1535                 target = ffs(selid) - 1;
1536         }
1537         lun = message & 0x07;
1538
1539         /*
1540          * Search wait queue for disconnected cmd
1541          * The list should be short, so I haven't bothered with
1542          * any more sophisticated structures than a simple
1543          * singly linked list.
1544          */
1545         ti = &sc->sc_tinfo[target];
1546         li = TINFO_LUN(ti, lun);
1547
1548         /*
1549          * We can get as far as the LUN with the IDENTIFY
1550          * message.  Check to see if we're running an
1551          * un-tagged command.  Otherwise ack the IDENTIFY
1552          * and wait for a tag message.
1553          */
1554         if (li != NULL) {
1555                 if (li->untagged != NULL && li->busy)
1556                         ecb = li->untagged;
1557                 else if (tagtype != MSG_SIMPLE_Q_TAG) {
1558                         /* Wait for tag to come by */
1559                         sc->sc_state = NCR_IDENTIFIED;
1560                         return (0);
1561                 } else if (tagtype)
1562                         ecb = li->queued[tagid];
1563         }
1564         if (ecb == NULL) {
1565                 device_printf(sc->sc_dev, "reselect from target %d lun %d "
1566                     "tag %x:%x with no nexus; sending ABORT\n",
1567                     target, lun, tagtype, tagid);
1568                 goto abort;
1569         }
1570
1571         /* Make this nexus active again. */
1572         sc->sc_state = NCR_CONNECTED;
1573         sc->sc_nexus = ecb;
1574         ncr53c9x_setsync(sc, ti);
1575
1576         if (ecb->flags & ECB_RESET)
1577                 ncr53c9x_sched_msgout(SEND_DEV_RESET);
1578         else if (ecb->flags & ECB_ABORT)
1579                 ncr53c9x_sched_msgout(SEND_ABORT);
1580
1581         /* Do an implicit RESTORE POINTERS. */
1582         sc->sc_dp = ecb->daddr;
1583         sc->sc_dleft = ecb->dleft;
1584
1585         return (0);
1586
1587 reset:
1588         ncr53c9x_sched_msgout(SEND_DEV_RESET);
1589         return (1);
1590
1591 abort:
1592         ncr53c9x_sched_msgout(SEND_ABORT);
1593         return (1);
1594 }
1595
1596 /* From NetBSD.  These should go into CAM at some point */
1597 #define MSG_ISEXTENDED(m)       ((m) == MSG_EXTENDED)
1598 #define MSG_IS1BYTE(m) \
1599         ((!MSG_ISEXTENDED(m) && (m) < 0x20) || MSG_ISIDENTIFY(m))
1600 #define MSG_IS2BYTE(m)          (((m) & 0xf0) == 0x20)
1601
1602 static inline int
1603 __verify_msg_format(u_char *p, int len)
1604 {
1605
1606         if (len == 1 && MSG_IS1BYTE(p[0]))
1607                 return 1;
1608         if (len == 2 && MSG_IS2BYTE(p[0]))
1609                 return 1;
1610         if (len >= 3 && MSG_ISEXTENDED(p[0]) &&
1611             len == p[1] + 2)
1612                 return 1;
1613
1614         return 0;
1615 }
1616
1617 /*
1618  * Get an incoming message as initiator.
1619  *
1620  * The SCSI bus must already be in MESSAGE_IN_PHASE and there is a
1621  * byte in the FIFO
1622  */
1623 static void
1624 ncr53c9x_msgin(struct ncr53c9x_softc *sc)
1625 {
1626
1627         NCR_TRACE(("[ncr53c9x_msgin(curmsglen:%ld)] ", (long)sc->sc_imlen));
1628
1629         if (sc->sc_imlen == 0) {
1630                 device_printf(sc->sc_dev, "msgin: no msg byte available\n");
1631                 return;
1632         }
1633
1634         /*
1635          * Prepare for a new message.  A message should (according
1636          * to the SCSI standard) be transmitted in one single
1637          * MESSAGE_IN_PHASE. If we have been in some other phase,
1638          * then this is a new message.
1639          */
1640         if (sc->sc_prevphase != MESSAGE_IN_PHASE &&
1641             sc->sc_state != NCR_RESELECTED) {
1642                 device_printf(sc->sc_dev, "phase change, dropping message, "
1643                     "prev %d, state %d\n", sc->sc_prevphase, sc->sc_state);
1644                 sc->sc_flags &= ~NCR_DROP_MSGI;
1645                 sc->sc_imlen = 0;
1646         }
1647
1648         /*
1649          * If we're going to reject the message, don't bother storing
1650          * the incoming bytes.  But still, we need to ACK them.
1651          */
1652         if ((sc->sc_flags & NCR_DROP_MSGI) != 0) {
1653                 NCRCMD(sc, NCRCMD_MSGOK);
1654                 printf("<dropping msg byte %x>", sc->sc_imess[sc->sc_imlen]);
1655                 return;
1656         }
1657
1658         if (sc->sc_imlen >= NCR_MAX_MSG_LEN) {
1659                 ncr53c9x_sched_msgout(SEND_REJECT);
1660                 sc->sc_flags |= NCR_DROP_MSGI;
1661         } else {
1662                 u_char *pb;
1663                 int plen;
1664
1665                 switch (sc->sc_state) {
1666                 /*
1667                  * if received message is the first of reselection
1668                  * then first byte is selid, and then message
1669                  */
1670                 case NCR_RESELECTED:
1671                         pb = sc->sc_imess + 1;
1672                         plen = sc->sc_imlen - 1;
1673                         break;
1674                 default:
1675                         pb = sc->sc_imess;
1676                         plen = sc->sc_imlen;
1677                         break;
1678                 }
1679
1680                 if (__verify_msg_format(pb, plen))
1681                         goto gotit;
1682         }
1683
1684         /* Ack what we have so far */
1685         NCRCMD(sc, NCRCMD_MSGOK);
1686         return;
1687
1688 gotit:
1689         NCR_MSGS(("gotmsg(%x) state %d", sc->sc_imess[0], sc->sc_state));
1690         /* We got a complete message, flush the imess, */
1691         /* XXX nobody uses imlen below */
1692         sc->sc_imlen = 0;
1693         /*
1694          * Now we should have a complete message (1 byte, 2 byte
1695          * and moderately long extended messages).  We only handle
1696          * extended messages which total length is shorter than
1697          * NCR_MAX_MSG_LEN.  Longer messages will be amputated.
1698          */
1699         switch (sc->sc_state) {
1700                 struct ncr53c9x_ecb *ecb;
1701                 struct ncr53c9x_tinfo *ti;
1702                 struct ncr53c9x_linfo *li;
1703                 int lun;
1704
1705         case NCR_CONNECTED:
1706                 ecb = sc->sc_nexus;
1707                 ti = &sc->sc_tinfo[ecb->ccb->ccb_h.target_id];
1708
1709                 switch (sc->sc_imess[0]) {
1710                 case MSG_CMDCOMPLETE:
1711                         NCR_MSGS(("cmdcomplete "));
1712                         if (sc->sc_dleft < 0) {
1713                                 xpt_print_path(ecb->ccb->ccb_h.path);
1714                                 printf("got %ld extra bytes\n",
1715                                     -(long)sc->sc_dleft);
1716                                 sc->sc_dleft = 0;
1717                         }
1718                         ecb->dleft = (ecb->flags & ECB_TENTATIVE_DONE) ?
1719                             0 : sc->sc_dleft;
1720                         if ((ecb->flags & ECB_SENSE) == 0)
1721                                 ecb->ccb->csio.resid = ecb->dleft;
1722                         sc->sc_state = NCR_CMDCOMPLETE;
1723                         break;
1724
1725                 case MSG_MESSAGE_REJECT:
1726                         NCR_MSGS(("msg reject (msgout=%x) ", sc->sc_msgout));
1727                         switch (sc->sc_msgout) {
1728                         case SEND_TAG:
1729                                 /*
1730                                  * Target does not like tagged queuing.
1731                                  *  - Flush the command queue
1732                                  *  - Disable tagged queuing for the target
1733                                  *  - Dequeue ecb from the queued array.
1734                                  */
1735                                 device_printf(sc->sc_dev, "tagged queuing "
1736                                     "rejected: target %d\n",
1737                                     ecb->ccb->ccb_h.target_id);
1738
1739                                 NCR_MSGS(("(rejected sent tag)"));
1740                                 NCRCMD(sc, NCRCMD_FLUSH);
1741                                 DELAY(1);
1742                                 ti->flags &= ~T_TAG;
1743                                 lun = ecb->ccb->ccb_h.target_lun;
1744                                 li = TINFO_LUN(ti, lun);
1745                                 if (ecb->tag[0] &&
1746                                     li->queued[ecb->tag[1]] != NULL) {
1747                                         li->queued[ecb->tag[1]] = NULL;
1748                                         li->used--;
1749                                 }
1750                                 ecb->tag[0] = ecb->tag[1] = 0;
1751                                 li->untagged = ecb;
1752                                 li->busy = 1;
1753                                 break;
1754
1755                         case SEND_SDTR:
1756                                 device_printf(sc->sc_dev, "sync transfer "
1757                                     "rejected: target %d\n",
1758                                     ecb->ccb->ccb_h.target_id);
1759
1760                                 sc->sc_flags &= ~NCR_SYNCHNEGO;
1761                                 ti->flags &= ~(T_NEGOTIATE | T_SYNCMODE);
1762                                 ncr53c9x_setsync(sc, ti);
1763                                 break;
1764
1765                         case SEND_WDTR:
1766                                 device_printf(sc->sc_dev, "wide transfer "
1767                                     "rejected: target %d\n",
1768                                     ecb->ccb->ccb_h.target_id);
1769                                 ti->flags &= ~(T_WIDE | T_WDTRSENT);
1770                                 ti->width = 0;
1771                                 break;
1772
1773                         case SEND_INIT_DET_ERR:
1774                                 goto abort;
1775                         }
1776                         break;
1777
1778                 case MSG_NOOP:
1779                         NCR_MSGS(("noop "));
1780                         break;
1781
1782                 case MSG_HEAD_OF_Q_TAG:
1783                 case MSG_SIMPLE_Q_TAG:
1784                 case MSG_ORDERED_Q_TAG:
1785                         NCR_MSGS(("TAG %x:%x",
1786                             sc->sc_imess[0], sc->sc_imess[1]));
1787                         break;
1788
1789                 case MSG_DISCONNECT:
1790                         NCR_MSGS(("disconnect "));
1791                         ti->dconns++;
1792                         sc->sc_state = NCR_DISCONNECT;
1793
1794                         /*
1795                          * Mark the fact that all bytes have moved. The
1796                          * target may not bother to do a SAVE POINTERS
1797                          * at this stage. This flag will set the residual
1798                          * count to zero on MSG COMPLETE.
1799                          */
1800                         if (sc->sc_dleft == 0)
1801                                 ecb->flags |= ECB_TENTATIVE_DONE;
1802
1803                         break;
1804
1805                 case MSG_SAVEDATAPOINTER:
1806                         NCR_MSGS(("save datapointer "));
1807                         ecb->daddr = sc->sc_dp;
1808                         ecb->dleft = sc->sc_dleft;
1809                         break;
1810
1811                 case MSG_RESTOREPOINTERS:
1812                         NCR_MSGS(("restore datapointer "));
1813                         sc->sc_dp = ecb->daddr;
1814                         sc->sc_dleft = ecb->dleft;
1815                         break;
1816
1817                 case MSG_EXTENDED:
1818                         NCR_MSGS(("extended(%x) ", sc->sc_imess[2]));
1819                         switch (sc->sc_imess[2]) {
1820                         case MSG_EXT_SDTR:
1821                                 NCR_MSGS(("SDTR period %d, offset %d ",
1822                                     sc->sc_imess[3], sc->sc_imess[4]));
1823                                 if (sc->sc_imess[1] != 3)
1824                                         goto reject;
1825                                 ti->period = sc->sc_imess[3];
1826                                 ti->offset = sc->sc_imess[4];
1827                                 ti->flags &= ~T_NEGOTIATE;
1828                                 if (sc->sc_minsync == 0 ||
1829                                     ti->offset == 0 ||
1830                                     ti->period > 124) {
1831 #if 0
1832 #ifdef NCR53C9X_DEBUG
1833                                         xpt_print_path(ecb->ccb->ccb_h.path);
1834                                         printf("async mode\n");
1835 #endif
1836 #endif
1837                                         ti->flags &= ~T_SYNCMODE;
1838                                         if ((sc->sc_flags&NCR_SYNCHNEGO) == 0) {
1839                                                 /*
1840                                                  * target initiated negotiation
1841                                                  */
1842                                                 ti->offset = 0;
1843                                                 ncr53c9x_sched_msgout(
1844                                                     SEND_SDTR);
1845                                         }
1846                                 } else {
1847                                         int p;
1848
1849                                         p = ncr53c9x_stp2cpb(sc, ti->period);
1850                                         ti->period = ncr53c9x_cpb2stp(sc, p);
1851                                         if ((sc->sc_flags&NCR_SYNCHNEGO) == 0) {
1852                                                 /*
1853                                                  * target initiated negotiation
1854                                                  */
1855                                                 if (ti->period < sc->sc_minsync)
1856                                                         ti->period =
1857                                                             sc->sc_minsync;
1858                                                 if (ti->offset > 15)
1859                                                         ti->offset = 15;
1860                                                 ti->flags &= ~T_SYNCMODE;
1861                                                 ncr53c9x_sched_msgout(
1862                                                     SEND_SDTR);
1863                                         } else {
1864                                                 /* we are sync */
1865                                                 ti->flags |= T_SYNCMODE;
1866                                         }
1867                                 }
1868                                 sc->sc_flags &= ~NCR_SYNCHNEGO;
1869                                 ncr53c9x_setsync(sc, ti);
1870                                 break;
1871
1872                         case MSG_EXT_WDTR:
1873 #ifdef NCR53C9X_DEBUG
1874                                 device_printf(sc->sc_dev, "wide mode %d\n",
1875                                     sc->sc_imess[3]);
1876 #endif
1877                                 if (sc->sc_imess[3] == 1) {
1878                                         ti->cfg3 |= NCRFASCFG3_EWIDE;
1879                                         ncr53c9x_setsync(sc, ti);
1880                                 } else
1881                                         ti->width = 0;
1882                                 /*
1883                                  * Device started width negotiation.
1884                                  */
1885                                 if (!(ti->flags & T_WDTRSENT))
1886                                         ncr53c9x_sched_msgout(SEND_WDTR);
1887                                 ti->flags &= ~(T_WIDE | T_WDTRSENT);
1888                                 break;
1889                         default:
1890                                 xpt_print_path(ecb->ccb->ccb_h.path);
1891                                 printf("unrecognized MESSAGE EXTENDED;"
1892                                     " sending REJECT\n");
1893                                 goto reject;
1894                         }
1895                         break;
1896
1897                 default:
1898                         NCR_MSGS(("ident "));
1899                         xpt_print_path(ecb->ccb->ccb_h.path);
1900                         printf("unrecognized MESSAGE; sending REJECT\n");
1901                 reject:
1902                         ncr53c9x_sched_msgout(SEND_REJECT);
1903                         break;
1904                 }
1905                 break;
1906
1907         case NCR_IDENTIFIED:
1908                 /*
1909                  * IDENTIFY message was received and queue tag is expected now
1910                  */
1911                 if ((sc->sc_imess[0] != MSG_SIMPLE_Q_TAG) ||
1912                     (sc->sc_msgify == 0)) {
1913                         device_printf(sc->sc_dev, "TAG reselect without "
1914                             "IDENTIFY; MSG %x; sending DEVICE RESET\n",
1915                              sc->sc_imess[0]);
1916                         goto reset;
1917                 }
1918                 (void) ncr53c9x_reselect(sc, sc->sc_msgify,
1919                     sc->sc_imess[0], sc->sc_imess[1]);
1920                 break;
1921
1922         case NCR_RESELECTED:
1923                 if (MSG_ISIDENTIFY(sc->sc_imess[1])) {
1924                         sc->sc_msgify = sc->sc_imess[1];
1925                 } else {
1926                         device_printf(sc->sc_dev, "reselect without IDENTIFY;"
1927                             " MSG %x; sending DEVICE RESET\n", sc->sc_imess[1]);
1928                         goto reset;
1929                 }
1930                 (void) ncr53c9x_reselect(sc, sc->sc_msgify, 0, 0);
1931                 break;
1932
1933         default:
1934                 device_printf(sc->sc_dev, "unexpected MESSAGE IN; "
1935                     "sending DEVICE RESET\n");
1936         reset:
1937                 ncr53c9x_sched_msgout(SEND_DEV_RESET);
1938                 break;
1939
1940         abort:
1941                 ncr53c9x_sched_msgout(SEND_ABORT);
1942                 break;
1943         }
1944
1945         /* if we have more messages to send set ATN */
1946         if (sc->sc_msgpriq)
1947                 NCRCMD(sc, NCRCMD_SETATN);
1948
1949         /* Ack last message byte */
1950         NCRCMD(sc, NCRCMD_MSGOK);
1951
1952         /* Done, reset message pointer. */
1953         sc->sc_flags &= ~NCR_DROP_MSGI;
1954         sc->sc_imlen = 0;
1955 }
1956
1957
1958 /*
1959  * Send the highest priority, scheduled message
1960  */
1961 static void
1962 ncr53c9x_msgout(struct ncr53c9x_softc *sc)
1963 {
1964         struct ncr53c9x_tinfo *ti;
1965         struct ncr53c9x_ecb *ecb;
1966         size_t size;
1967
1968         NCR_TRACE(("[ncr53c9x_msgout(priq:%x, prevphase:%x)]",
1969             sc->sc_msgpriq, sc->sc_prevphase));
1970
1971         /*
1972          * XXX - the NCR_ATN flag is not in sync with the actual ATN
1973          *       condition on the SCSI bus. The 53c9x chip
1974          *       automatically turns off ATN before sending the
1975          *       message byte.  (See also the comment below in the
1976          *       default case when picking out a message to send.)
1977          */
1978         if (sc->sc_flags & NCR_ATN) {
1979                 if (sc->sc_prevphase != MESSAGE_OUT_PHASE) {
1980                 new:
1981                         NCRCMD(sc, NCRCMD_FLUSH);
1982 /*                      DELAY(1); */
1983                         sc->sc_msgoutq = 0;
1984                         sc->sc_omlen = 0;
1985                 }
1986         } else {
1987                 if (sc->sc_prevphase == MESSAGE_OUT_PHASE) {
1988                         ncr53c9x_sched_msgout(sc->sc_msgoutq);
1989                         goto new;
1990                 } else {
1991                         device_printf(sc->sc_dev, "at line %d: unexpected "
1992                             "MESSAGE OUT phase\n", __LINE__);
1993                 }
1994         }
1995
1996         if (sc->sc_omlen == 0) {
1997                 /* Pick up highest priority message */
1998                 sc->sc_msgout = sc->sc_msgpriq & -sc->sc_msgpriq;
1999                 sc->sc_msgoutq |= sc->sc_msgout;
2000                 sc->sc_msgpriq &= ~sc->sc_msgout;
2001                 sc->sc_omlen = 1;               /* "Default" message len */
2002                 switch (sc->sc_msgout) {
2003                 case SEND_SDTR:
2004                         ecb = sc->sc_nexus;
2005                         ti = &sc->sc_tinfo[ecb->ccb->ccb_h.target_id];
2006                         sc->sc_omess[0] = MSG_EXTENDED;
2007                         sc->sc_omess[1] = MSG_EXT_SDTR_LEN;
2008                         sc->sc_omess[2] = MSG_EXT_SDTR;
2009                         sc->sc_omess[3] = ti->period;
2010                         sc->sc_omess[4] = ti->offset;
2011                         sc->sc_omlen = 5;
2012                         if ((sc->sc_flags & NCR_SYNCHNEGO) == 0) {
2013                                 ti->flags |= T_SYNCMODE;
2014                                 ncr53c9x_setsync(sc, ti);
2015                         }
2016                         break;
2017                 case SEND_WDTR:
2018                         ecb = sc->sc_nexus;
2019                         ti = &sc->sc_tinfo[ecb->ccb->ccb_h.target_id];
2020                         sc->sc_omess[0] = MSG_EXTENDED;
2021                         sc->sc_omess[1] = MSG_EXT_WDTR_LEN;
2022                         sc->sc_omess[2] = MSG_EXT_WDTR;
2023                         sc->sc_omess[3] = ti->width;
2024                         sc->sc_omlen = 4;
2025                         break;
2026                 case SEND_IDENTIFY:
2027                         if (sc->sc_state != NCR_CONNECTED) {
2028                                 device_printf(sc->sc_dev, "at line %d: no "
2029                                     "nexus\n", __LINE__);
2030                         }
2031                         ecb = sc->sc_nexus;
2032                         sc->sc_omess[0] =
2033                             MSG_IDENTIFY(ecb->ccb->ccb_h.target_lun, 0);
2034                         break;
2035                 case SEND_TAG:
2036                         if (sc->sc_state != NCR_CONNECTED) {
2037                                 device_printf(sc->sc_dev, "at line %d: no "
2038                                     "nexus\n", __LINE__);
2039                         }
2040                         ecb = sc->sc_nexus;
2041                         sc->sc_omess[0] = ecb->tag[0];
2042                         sc->sc_omess[1] = ecb->tag[1];
2043                         sc->sc_omlen = 2;
2044                         break;
2045                 case SEND_DEV_RESET:
2046                         sc->sc_flags |= NCR_ABORTING;
2047                         sc->sc_omess[0] = MSG_BUS_DEV_RESET;
2048                         ecb = sc->sc_nexus;
2049                         ti = &sc->sc_tinfo[ecb->ccb->ccb_h.target_id];
2050                         ti->flags &= ~T_SYNCMODE;
2051                         if ((ti->flags & T_SYNCHOFF) == 0)
2052                                 /* We can re-start sync negotiation */
2053                                 ti->flags |= T_NEGOTIATE;
2054                         break;
2055                 case SEND_PARITY_ERROR:
2056                         sc->sc_omess[0] = MSG_PARITY_ERROR;
2057                         break;
2058                 case SEND_ABORT:
2059                         sc->sc_flags |= NCR_ABORTING;
2060                         sc->sc_omess[0] = MSG_ABORT;
2061                         break;
2062                 case SEND_INIT_DET_ERR:
2063                         sc->sc_omess[0] = MSG_INITIATOR_DET_ERR;
2064                         break;
2065                 case SEND_REJECT:
2066                         sc->sc_omess[0] = MSG_MESSAGE_REJECT;
2067                         break;
2068                 default:
2069                         /*
2070                          * We normally do not get here, since the chip
2071                          * automatically turns off ATN before the last
2072                          * byte of a message is sent to the target.
2073                          * However, if the target rejects our (multi-byte)
2074                          * message early by switching to MSG IN phase
2075                          * ATN remains on, so the target may return to
2076                          * MSG OUT phase. If there are no scheduled messages
2077                          * left we send a NO-OP.
2078                          *
2079                          * XXX - Note that this leaves no useful purpose for
2080                          * the NCR_ATN flag.
2081                          */
2082                         sc->sc_flags &= ~NCR_ATN;
2083                         sc->sc_omess[0] = MSG_NOOP;
2084                         break;
2085                 }
2086                 sc->sc_omp = sc->sc_omess;
2087         }
2088
2089 #ifdef DEBUG
2090         if (ncr53c9x_debug & NCR_SHOWMSGS) {
2091                 int i;
2092
2093                 NCR_MSGS(("<msgout:"));
2094                 for (i = 0; i < sc->sc_omlen; i++)
2095                         NCR_MSGS((" %02x", sc->sc_omess[i]));
2096                 NCR_MSGS(("> "));
2097         }
2098 #endif
2099         if (sc->sc_rev == NCR_VARIANT_FAS366) {
2100                 /*
2101                  * XXX fifo size
2102                  */
2103                 ncr53c9x_flushfifo(sc);
2104                 ncr53c9x_wrfifo(sc, sc->sc_omp, sc->sc_omlen);
2105                 NCRCMD(sc, NCRCMD_TRANS);
2106         } else {
2107                 /* (re)send the message */
2108                 size = min(sc->sc_omlen, sc->sc_maxxfer);
2109                 NCRDMA_SETUP(sc, &sc->sc_omp, &sc->sc_omlen, 0, &size);
2110                 /* Program the SCSI counter */
2111                 NCR_SET_COUNT(sc, size);
2112
2113                 /* Load the count in and start the message-out transfer */
2114                 NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA);
2115                 NCRCMD(sc, NCRCMD_TRANS|NCRCMD_DMA);
2116                 NCRDMA_GO(sc);
2117         }
2118 }
2119
2120 /*
2121  * This is the most critical part of the driver, and has to know
2122  * how to deal with *all* error conditions and phases from the SCSI
2123  * bus. If there are no errors and the DMA was active, then call the
2124  * DMA pseudo-interrupt handler. If this returns 1, then that was it
2125  * and we can return from here without further processing.
2126  *
2127  * Most of this needs verifying.
2128  */
2129 void
2130 ncr53c9x_intr(void *arg)
2131 {
2132         struct ncr53c9x_softc *sc = arg;
2133         struct ncr53c9x_ecb *ecb;
2134         struct ncr53c9x_tinfo *ti;
2135         size_t size;
2136         int nfifo;
2137
2138         NCR_INTS(("[ncr53c9x_intr: state %d]", sc->sc_state));
2139
2140         if (!NCRDMA_ISINTR(sc))
2141                 return;
2142
2143         mtx_lock(&sc->sc_lock);
2144 again:
2145         /* and what do the registers say... */
2146         ncr53c9x_readregs(sc);
2147
2148         /*
2149          * At the moment, only a SCSI Bus Reset or Illegal
2150          * Command are classed as errors. A disconnect is a
2151          * valid condition, and we let the code check is the
2152          * "NCR_BUSFREE_OK" flag was set before declaring it
2153          * and error.
2154          *
2155          * Also, the status register tells us about "Gross
2156          * Errors" and "Parity errors". Only the Gross Error
2157          * is really bad, and the parity errors are dealt
2158          * with later
2159          *
2160          * TODO
2161          *      If there are too many parity error, go to slow
2162          *      cable mode ?
2163          */
2164
2165         /* SCSI Reset */
2166         if ((sc->sc_espintr & NCRINTR_SBR) != 0) {
2167                 if ((NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) != 0) {
2168                         NCRCMD(sc, NCRCMD_FLUSH);
2169                         DELAY(1);
2170                 }
2171                 if (sc->sc_state != NCR_SBR) {
2172                         device_printf(sc->sc_dev, "SCSI bus reset\n");
2173                         ncr53c9x_init(sc, 0); /* Restart everything */
2174                         goto out;
2175                 }
2176 #if 0
2177 /*XXX*/         printf("<expected bus reset: "
2178                     "[intr %x, stat %x, step %d]>\n",
2179                     sc->sc_espintr, sc->sc_espstat, sc->sc_espstep);
2180 #endif
2181                 if (sc->sc_nexus != NULL)
2182                         panic("%s: nexus in reset state",
2183                             device_get_nameunit(sc->sc_dev));
2184                 goto sched;
2185         }
2186
2187         ecb = sc->sc_nexus;
2188
2189 #define NCRINTR_ERR (NCRINTR_SBR|NCRINTR_ILL)
2190         if (sc->sc_espintr & NCRINTR_ERR ||
2191             sc->sc_espstat & NCRSTAT_GE) {
2192
2193                 if ((sc->sc_espstat & NCRSTAT_GE) != 0) {
2194                         /* Gross Error; no target ? */
2195                         if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
2196                                 NCRCMD(sc, NCRCMD_FLUSH);
2197                                 DELAY(1);
2198                         }
2199                         if (sc->sc_state == NCR_CONNECTED ||
2200                             sc->sc_state == NCR_SELECTING) {
2201                                 ecb->ccb->ccb_h.status = CAM_SEL_TIMEOUT;
2202                                 ncr53c9x_done(sc, ecb);
2203                         }
2204                         goto out;
2205                 }
2206
2207                 if ((sc->sc_espintr & NCRINTR_ILL) != 0) {
2208                         if ((sc->sc_flags & NCR_EXPECT_ILLCMD) != 0) {
2209                                 /*
2210                                  * Eat away "Illegal command" interrupt
2211                                  * on a ESP100 caused by a re-selection
2212                                  * while we were trying to select
2213                                  * another target.
2214                                  */
2215 #ifdef DEBUG
2216                                 device_printf(sc->sc_dev, "ESP100 work-around "
2217                                     "activated\n");
2218 #endif
2219                                 sc->sc_flags &= ~NCR_EXPECT_ILLCMD;
2220                                 goto out;
2221                         }
2222                         /* illegal command, out of sync ? */
2223                         device_printf(sc->sc_dev, "illegal command: 0x%x "
2224                             "(state %d, phase %x, prevphase %x)\n",
2225                             sc->sc_lastcmd,
2226                             sc->sc_state, sc->sc_phase, sc->sc_prevphase);
2227                         if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
2228                                 NCRCMD(sc, NCRCMD_FLUSH);
2229                                 DELAY(1);
2230                         }
2231                         ncr53c9x_init(sc, 1); /* Restart everything */
2232                         goto out;
2233                 }
2234         }
2235         sc->sc_flags &= ~NCR_EXPECT_ILLCMD;
2236
2237         /*
2238          * Call if DMA is active.
2239          *
2240          * If DMA_INTR returns true, then maybe go 'round the loop
2241          * again in case there is no more DMA queued, but a phase
2242          * change is expected.
2243          */
2244         if (NCRDMA_ISACTIVE(sc)) {
2245                 int r = NCRDMA_INTR(sc);
2246                 if (r == -1) {
2247                         device_printf(sc->sc_dev, "DMA error; resetting\n");
2248                         ncr53c9x_init(sc, 1);
2249                         goto out;
2250                 }
2251                 /* If DMA active here, then go back to work... */
2252                 if (NCRDMA_ISACTIVE(sc))
2253                         goto out;
2254
2255                 if ((sc->sc_espstat & NCRSTAT_TC) == 0) {
2256                         /*
2257                          * DMA not completed.  If we can not find a
2258                          * acceptable explanation, print a diagnostic.
2259                          */
2260                         if (sc->sc_state == NCR_SELECTING)
2261                                 /*
2262                                  * This can happen if we are reselected
2263                                  * while using DMA to select a target.
2264                                  */
2265                                 /*void*/;
2266                         else if (sc->sc_prevphase == MESSAGE_OUT_PHASE) {
2267                                 /*
2268                                  * Our (multi-byte) message (eg SDTR) was
2269                                  * interrupted by the target to send
2270                                  * a MSG REJECT.
2271                                  * Print diagnostic if current phase
2272                                  * is not MESSAGE IN.
2273                                  */
2274                                 if (sc->sc_phase != MESSAGE_IN_PHASE)
2275                                         device_printf(sc->sc_dev,"!TC on MSGOUT"
2276                                             " [intr %x, stat %x, step %d]"
2277                                             " prevphase %x, resid %lx\n",
2278                                             sc->sc_espintr,
2279                                             sc->sc_espstat,
2280                                             sc->sc_espstep,
2281                                             sc->sc_prevphase,
2282                                             (u_long)sc->sc_omlen);
2283                         } else if (sc->sc_dleft == 0) {
2284                                 /*
2285                                  * The DMA operation was started for
2286                                  * a DATA transfer. Print a diagnostic
2287                                  * if the DMA counter and TC bit
2288                                  * appear to be out of sync.
2289                                  *
2290                                  * XXX This is fatal and usually means that
2291                                  *     the DMA engine is hopelessly out of
2292                                  *     sync with reality.  A disk is likely
2293                                  *     getting spammed at this point.
2294                                  */
2295                                 device_printf(sc->sc_dev, "!TC on DATA XFER"
2296                                     " [intr %x, stat %x, step %d]"
2297                                     " prevphase %x, resid %x\n",
2298                                     sc->sc_espintr,
2299                                     sc->sc_espstat,
2300                                     sc->sc_espstep,
2301                                     sc->sc_prevphase,
2302                                     ecb ? ecb->dleft : -1);
2303                                 panic("esp: unrecoverable DMA error");
2304                         }
2305                 }
2306         }
2307
2308         /*
2309          * Check for less serious errors.
2310          */
2311         if ((sc->sc_espstat & NCRSTAT_PE) != 0) {
2312                 device_printf(sc->sc_dev, "SCSI bus parity error\n");
2313                 if (sc->sc_prevphase == MESSAGE_IN_PHASE)
2314                         ncr53c9x_sched_msgout(SEND_PARITY_ERROR);
2315                 else
2316                         ncr53c9x_sched_msgout(SEND_INIT_DET_ERR);
2317         }
2318
2319         if ((sc->sc_espintr & NCRINTR_DIS) != 0) {
2320                 sc->sc_msgify = 0;
2321                 NCR_INTS(("<DISC [intr %x, stat %x, step %d]>",
2322                     sc->sc_espintr,sc->sc_espstat,sc->sc_espstep));
2323                 if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
2324                         NCRCMD(sc, NCRCMD_FLUSH);
2325 /*                      DELAY(1); */
2326                 }
2327                 /*
2328                  * This command must (apparently) be issued within
2329                  * 250mS of a disconnect. So here you are...
2330                  */
2331                 NCRCMD(sc, NCRCMD_ENSEL);
2332
2333                 switch (sc->sc_state) {
2334                 case NCR_RESELECTED:
2335                         goto sched;
2336
2337                 case NCR_SELECTING:
2338                 {
2339                         struct ncr53c9x_linfo *li;
2340
2341                         ecb->ccb->ccb_h.status = CAM_SEL_TIMEOUT;
2342
2343                         /* Selection timeout -- discard all LUNs if empty */
2344                         ti = &sc->sc_tinfo[ecb->ccb->ccb_h.target_id];
2345                         li = LIST_FIRST(&ti->luns);
2346                         while (li != NULL) {
2347                                 if (li->untagged == NULL && li->used == 0) {
2348                                         if (li->lun < NCR_NLUN)
2349                                                 ti->lun[li->lun] = NULL;
2350                                         LIST_REMOVE(li, link);
2351                                         free(li, M_DEVBUF);
2352                                         /*
2353                                          * Restart the search at the beginning
2354                                          */
2355                                         li = LIST_FIRST(&ti->luns);
2356                                         continue;
2357                                 }
2358                                 li = LIST_NEXT(li, link);
2359                         }
2360                         goto finish;
2361                 }
2362                 case NCR_CONNECTED:
2363                         if ((sc->sc_flags & NCR_SYNCHNEGO) != 0) {
2364 #ifdef NCR53C9X_DEBUG
2365                                 if (ecb != NULL)
2366                                         xpt_print_path(ecb->ccb->ccb_h.path);
2367                                 printf("sync nego not completed!\n");
2368 #endif
2369                                 ti = &sc->sc_tinfo[ecb->ccb->ccb_h.target_id];
2370                                 sc->sc_flags &= ~NCR_SYNCHNEGO;
2371                                 ti->flags &= ~(T_NEGOTIATE | T_SYNCMODE);
2372                         }
2373
2374                         /* it may be OK to disconnect */
2375                         if ((sc->sc_flags & NCR_ABORTING) == 0) {
2376                                 /*
2377                                  * Section 5.1.1 of the SCSI 2 spec
2378                                  * suggests issuing a REQUEST SENSE
2379                                  * following an unexpected disconnect.
2380                                  * Some devices go into a contingent
2381                                  * allegiance condition when
2382                                  * disconnecting, and this is necessary
2383                                  * to clean up their state.
2384                                  */
2385                                 device_printf(sc->sc_dev, "unexpected "
2386                                     "disconnect [state %d, intr %x, stat %x, "
2387                                     "phase(c %x, p %x)]; ", sc->sc_state,
2388                                     sc->sc_espintr, sc->sc_espstat,
2389                                     sc->sc_phase, sc->sc_prevphase);
2390
2391                                 /*
2392                                  * XXX This will cause a chip reset and will
2393                                  *     prevent us from finding out the real
2394                                  *     problem with the device.  However, it's
2395                                  *     neccessary until a way can be found to
2396                                  *     safely cancel the DMA that is in
2397                                  *     progress.
2398                                  */
2399                                 if (1 || (ecb->flags & ECB_SENSE) != 0) {
2400                                         printf("resetting\n");
2401                                         goto reset;
2402                                 }
2403                                 printf("sending REQUEST SENSE\n");
2404                                 untimeout(ncr53c9x_timeout, ecb,
2405                                           ecb->ccb->ccb_h.timeout_ch);
2406                                 ncr53c9x_sense(sc, ecb);
2407                                 goto out;
2408                         }
2409
2410                         ecb->ccb->ccb_h.status = CAM_CMD_TIMEOUT;
2411                         goto finish;
2412
2413                 case NCR_DISCONNECT:
2414                         sc->sc_nexus = NULL;
2415                         goto sched;
2416
2417                 case NCR_CMDCOMPLETE:
2418                         ecb->ccb->ccb_h.status = CAM_REQ_CMP;
2419                         goto finish;
2420                 }
2421         }
2422
2423         switch (sc->sc_state) {
2424
2425         case NCR_SBR:
2426                 device_printf(sc->sc_dev, "waiting for Bus Reset to happen\n");
2427                 goto out;
2428
2429         case NCR_RESELECTED:
2430                 /*
2431                  * we must be continuing a message ?
2432                  */
2433                 device_printf(sc->sc_dev, "unhandled reselect continuation, "
2434                         "state %d, intr %02x\n", sc->sc_state, sc->sc_espintr);
2435                 ncr53c9x_init(sc, 1);
2436                 goto out;
2437                 break;
2438
2439         case NCR_IDENTIFIED:
2440                 ecb = sc->sc_nexus;
2441                 if (sc->sc_phase != MESSAGE_IN_PHASE) {
2442                         int i = (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF);
2443                         /*
2444                          * Things are seriously screwed up.
2445                          * Pull the brakes, i.e. reset
2446                          */
2447                         device_printf(sc->sc_dev, "target didn't send tag: %d "
2448                             "bytes in fifo\n", i);
2449                         /* Drain and display fifo */
2450                         while (i-- > 0)
2451                                 printf("[%d] ", NCR_READ_REG(sc, NCR_FIFO));
2452
2453                         ncr53c9x_init(sc, 1);
2454                         goto out;
2455                 } else
2456                         goto msgin;
2457
2458         case NCR_IDLE:
2459         case NCR_SELECTING:
2460                 ecb = sc->sc_nexus;
2461                 if (sc->sc_espintr & NCRINTR_RESEL) {
2462                         sc->sc_msgpriq = sc->sc_msgout = sc->sc_msgoutq = 0;
2463                         sc->sc_flags = 0;
2464                         /*
2465                          * If we're trying to select a
2466                          * target ourselves, push our command
2467                          * back into the ready list.
2468                          */
2469                         if (sc->sc_state == NCR_SELECTING) {
2470                                 NCR_INTS(("backoff selector "));
2471                                 untimeout(ncr53c9x_timeout, ecb,
2472                                           ecb->ccb->ccb_h.timeout_ch);
2473                                 ncr53c9x_dequeue(sc, ecb);
2474                                 TAILQ_INSERT_HEAD(&sc->ready_list, ecb, chain);
2475                                 ecb->flags |= ECB_READY;
2476                                 ecb = sc->sc_nexus = NULL;
2477                         }
2478                         sc->sc_state = NCR_RESELECTED;
2479                         if (sc->sc_phase != MESSAGE_IN_PHASE) {
2480                                 /*
2481                                  * Things are seriously screwed up.
2482                                  * Pull the brakes, i.e. reset
2483                                  */
2484                                 device_printf(sc->sc_dev, "target didn't "
2485                                     "identify\n");
2486                                 ncr53c9x_init(sc, 1);
2487                                 goto out;
2488                         }
2489                         /*
2490                          * The C90 only inhibits FIFO writes until reselection
2491                          * is complete instead of waiting until the interrupt
2492                          * status register has been read.  So, if the reselect
2493                          * happens while we were entering command bytes (for
2494                          * another target) some of those bytes can appear in
2495                          * the FIFO here, after the interrupt is taken.
2496                          *
2497                          * To remedy this situation, pull the Selection ID
2498                          * and Identify message from the FIFO directly, and
2499                          * ignore any extraneous fifo contents. Also, set
2500                          * a flag that allows one Illegal Command Interrupt
2501                          * to occur which the chip also generates as a result
2502                          * of writing to the FIFO during a reselect.
2503                          */
2504                         if (sc->sc_rev == NCR_VARIANT_ESP100) {
2505                                 nfifo = NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF;
2506                                 sc->sc_imess[0] = NCR_READ_REG(sc, NCR_FIFO);
2507                                 sc->sc_imess[1] = NCR_READ_REG(sc, NCR_FIFO);
2508                                 sc->sc_imlen = 2;
2509                                 if (nfifo != 2) {
2510                                         /* Flush the rest */
2511                                         NCRCMD(sc, NCRCMD_FLUSH);
2512                                 }
2513                                 sc->sc_flags |= NCR_EXPECT_ILLCMD;
2514                                 if (nfifo > 2)
2515                                         nfifo = 2; /* We fixed it.. */
2516                         } else
2517                                 nfifo = ncr53c9x_rdfifo(sc, NCR_RDFIFO_START);
2518
2519                         if (nfifo != 2) {
2520                                 device_printf(sc->sc_dev, "RESELECT: %d bytes "
2521                                     "in FIFO! [intr %x, stat %x, step %d, "
2522                                     "prevphase %x]\n",
2523                                     nfifo,
2524                                     sc->sc_espintr,
2525                                     sc->sc_espstat,
2526                                     sc->sc_espstep,
2527                                     sc->sc_prevphase);
2528                                 ncr53c9x_init(sc, 1);
2529                                 goto out;
2530                         }
2531                         sc->sc_selid = sc->sc_imess[0];
2532                         NCR_INTS(("selid=%02x ", sc->sc_selid));
2533
2534                         /* Handle identify message */
2535                         ncr53c9x_msgin(sc);
2536
2537                         if (sc->sc_state != NCR_CONNECTED &&
2538                             sc->sc_state != NCR_IDENTIFIED) {
2539                                 /* IDENTIFY fail?! */
2540                                 device_printf(sc->sc_dev, "identify failed, "
2541                                     "state %d, intr %02x\n", sc->sc_state,
2542                                     sc->sc_espintr);
2543                                 ncr53c9x_init(sc, 1);
2544                                 goto out;
2545                         }
2546                         goto shortcut; /* ie. next phase expected soon */
2547                 }
2548
2549 #define NCRINTR_DONE    (NCRINTR_FC|NCRINTR_BS)
2550                 if ((sc->sc_espintr & NCRINTR_DONE) == NCRINTR_DONE) {
2551                         /*
2552                          * Arbitration won; examine the `step' register
2553                          * to determine how far the selection could progress.
2554                          */
2555                         if (ecb == NULL) {
2556                                 /*
2557                                  * When doing path inquiry during boot
2558                                  * FAS100A trigger a stray interrupt which
2559                                  * we just ignore instead of panicing.
2560                                  */
2561                                 if (sc->sc_state == NCR_IDLE &&
2562                                     sc->sc_espstep == 0)
2563                                         goto out;
2564                                 panic("ncr53c9x: no nexus");
2565                         }
2566
2567                         ti = &sc->sc_tinfo[ecb->ccb->ccb_h.target_id];
2568
2569                         switch (sc->sc_espstep) {
2570                         case 0:
2571                                 /*
2572                                  * The target did not respond with a
2573                                  * message out phase - probably an old
2574                                  * device that doesn't recognize ATN.
2575                                  * Clear ATN and just continue, the
2576                                  * target should be in the command
2577                                  * phase.
2578                                  * XXXX check for command phase?
2579                                  */
2580                                 NCRCMD(sc, NCRCMD_RSTATN);
2581                                 break;
2582                         case 1:
2583                                 if ((ti->flags & T_NEGOTIATE) == 0 &&
2584                                     ecb->tag[0] == 0) {
2585                                         device_printf(sc->sc_dev, "step 1 & "
2586                                             "!NEG\n");
2587                                         goto reset;
2588                                 }
2589                                 if (sc->sc_phase != MESSAGE_OUT_PHASE) {
2590                                         device_printf(sc->sc_dev, "!MSGOUT\n");
2591                                         goto reset;
2592                                 }
2593                                 if (ti->flags & T_WIDE) {
2594                                         ti->flags |= T_WDTRSENT;
2595                                         ncr53c9x_sched_msgout(SEND_WDTR);
2596                                 }
2597                                 if (ti->flags & T_NEGOTIATE) {
2598                                         /* Start negotiating */
2599                                         sc->sc_flags |= NCR_SYNCHNEGO;
2600                                         if (ecb->tag[0])
2601                                                 ncr53c9x_sched_msgout(
2602                                                     SEND_TAG|SEND_SDTR);
2603                                         else
2604                                                 ncr53c9x_sched_msgout(
2605                                                     SEND_SDTR);
2606                                 } else {
2607                                         /* Could not do ATN3 so send TAG */
2608                                         ncr53c9x_sched_msgout(SEND_TAG);
2609                                 }
2610                                 sc->sc_prevphase = MESSAGE_OUT_PHASE; /* XXXX */
2611                                 break;
2612                         case 3:
2613                                 /*
2614                                  * Grr, this is supposed to mean
2615                                  * "target left command phase  prematurely".
2616                                  * It seems to happen regularly when
2617                                  * sync mode is on.
2618                                  * Look at FIFO to see if command went out.
2619                                  * (Timing problems?)
2620                                  */
2621                                 if (sc->sc_features & NCR_F_DMASELECT) {
2622                                         if (sc->sc_cmdlen == 0)
2623                                                 /* Hope for the best.. */
2624                                                 break;
2625                                 } else if ((NCR_READ_REG(sc, NCR_FFLAG)
2626                                     & NCRFIFO_FF) == 0) {
2627                                         /* Hope for the best.. */
2628                                         break;
2629                                 }
2630                                 printf("(%s:%d:%d): selection failed;"
2631                                     " %d left in FIFO "
2632                                     "[intr %x, stat %x, step %d]\n",
2633                                     device_get_nameunit(sc->sc_dev),
2634                                     ecb->ccb->ccb_h.target_id,
2635                                     ecb->ccb->ccb_h.target_lun,
2636                                     NCR_READ_REG(sc, NCR_FFLAG)
2637                                      & NCRFIFO_FF,
2638                                     sc->sc_espintr, sc->sc_espstat,
2639                                     sc->sc_espstep);
2640                                 NCRCMD(sc, NCRCMD_FLUSH);
2641                                 ncr53c9x_sched_msgout(SEND_ABORT);
2642                                 goto out;
2643                         case 2:
2644                                 /* Select stuck at Command Phase */
2645                                 NCRCMD(sc, NCRCMD_FLUSH);
2646                                 break;
2647                         case 4:
2648                                 if (sc->sc_features & NCR_F_DMASELECT &&
2649                                     sc->sc_cmdlen != 0)
2650                                         printf("(%s:%d:%d): select; "
2651                                             "%lu left in DMA buffer "
2652                                             "[intr %x, stat %x, step %d]\n",
2653                                             device_get_nameunit(sc->sc_dev),
2654                                             ecb->ccb->ccb_h.target_id,
2655                                             ecb->ccb->ccb_h.target_lun,
2656                                             (u_long)sc->sc_cmdlen,
2657                                             sc->sc_espintr,
2658                                             sc->sc_espstat,
2659                                             sc->sc_espstep);
2660                                 /* So far, everything went fine */
2661                                 break;
2662                         }
2663
2664                         sc->sc_prevphase = INVALID_PHASE; /* ?? */
2665                         /* Do an implicit RESTORE POINTERS. */
2666                         sc->sc_dp = ecb->daddr;
2667                         sc->sc_dleft = ecb->dleft;
2668                         sc->sc_state = NCR_CONNECTED;
2669                         break;
2670
2671                 } else {
2672
2673                         device_printf(sc->sc_dev, "unexpected status after "
2674                             "select: [intr %x, stat %x, step %x]\n",
2675                             sc->sc_espintr, sc->sc_espstat, sc->sc_espstep);
2676                         NCRCMD(sc, NCRCMD_FLUSH);
2677                         DELAY(1);
2678                         goto reset;
2679                 }
2680                 if (sc->sc_state == NCR_IDLE) {
2681                         device_printf(sc->sc_dev, "stray interrupt\n");
2682                         goto out;
2683                 }
2684                 break;
2685
2686         case NCR_CONNECTED:
2687                 if ((sc->sc_flags & NCR_ICCS) != 0) {
2688                         /* "Initiate Command Complete Steps" in progress */
2689                         u_char msg;
2690
2691                         sc->sc_flags &= ~NCR_ICCS;
2692
2693                         if (!(sc->sc_espintr & NCRINTR_DONE)) {
2694                                 device_printf(sc->sc_dev, "ICCS: "
2695                                     ": [intr %x, stat %x, step %x]\n",
2696                                     sc->sc_espintr, sc->sc_espstat,
2697                                     sc->sc_espstep);
2698                         }
2699                         ncr53c9x_rdfifo(sc, NCR_RDFIFO_START);
2700                         if (sc->sc_imlen < 2)
2701                                 device_printf(sc->sc_dev, "can't get status, "
2702                                     "only %d bytes\n", (int)sc->sc_imlen);
2703                         ecb->stat = sc->sc_imess[sc->sc_imlen - 2];
2704                         msg = sc->sc_imess[sc->sc_imlen - 1];
2705                         NCR_PHASE(("<stat:(%x,%x)>", ecb->stat, msg));
2706                         if (msg == MSG_CMDCOMPLETE) {
2707                                 ecb->dleft = (ecb->flags & ECB_TENTATIVE_DONE)
2708                                         ? 0 : sc->sc_dleft;
2709                                 if ((ecb->flags & ECB_SENSE) == 0)
2710                                         ecb->ccb->csio.resid = ecb->dleft;
2711                                 sc->sc_state = NCR_CMDCOMPLETE;
2712                         } else
2713                                 device_printf(sc->sc_dev, "STATUS_PHASE: "
2714                                     "msg %d\n", msg);
2715                         sc->sc_imlen = 0;
2716                         NCRCMD(sc, NCRCMD_MSGOK);
2717                         goto shortcut; /* ie. wait for disconnect */
2718                 }
2719                 break;
2720
2721         default:
2722                 device_printf(sc->sc_dev, "invalid state: %d [intr %x, "
2723                     "phase(c %x, p %x)]\n", sc->sc_state,
2724                     sc->sc_espintr, sc->sc_phase, sc->sc_prevphase);
2725                 goto reset;
2726         }
2727
2728         /*
2729          * Driver is now in state NCR_CONNECTED, i.e. we
2730          * have a current command working the SCSI bus.
2731          */
2732         if (sc->sc_state != NCR_CONNECTED || ecb == NULL) {
2733                 panic("ncr53c9x: no nexus");
2734         }
2735
2736         switch (sc->sc_phase) {
2737         case MESSAGE_OUT_PHASE:
2738                 NCR_PHASE(("MESSAGE_OUT_PHASE "));
2739                 ncr53c9x_msgout(sc);
2740                 sc->sc_prevphase = MESSAGE_OUT_PHASE;
2741                 break;
2742
2743         case MESSAGE_IN_PHASE:
2744 msgin:
2745                 NCR_PHASE(("MESSAGE_IN_PHASE "));
2746                 if ((sc->sc_espintr & NCRINTR_BS) != 0) {
2747                         if ((sc->sc_rev != NCR_VARIANT_FAS366) ||
2748                             !(sc->sc_espstat2 & NCRFAS_STAT2_EMPTY)) {
2749                                 NCRCMD(sc, NCRCMD_FLUSH);
2750                         }
2751                         sc->sc_flags |= NCR_WAITI;
2752                         NCRCMD(sc, NCRCMD_TRANS);
2753                 } else if ((sc->sc_espintr & NCRINTR_FC) != 0) {
2754                         if ((sc->sc_flags & NCR_WAITI) == 0) {
2755                                 device_printf(sc->sc_dev, "MSGIN: unexpected "
2756                                     "FC bit: [intr %x, stat %x, step %x]\n",
2757                                     sc->sc_espintr, sc->sc_espstat,
2758                                     sc->sc_espstep);
2759                         }
2760                         sc->sc_flags &= ~NCR_WAITI;
2761                         ncr53c9x_rdfifo(sc,
2762                             (sc->sc_prevphase == sc->sc_phase) ?
2763                             NCR_RDFIFO_CONTINUE : NCR_RDFIFO_START);
2764                         ncr53c9x_msgin(sc);
2765                 } else {
2766                         device_printf(sc->sc_dev, "MSGIN: weird bits: "
2767                             "[intr %x, stat %x, step %x]\n",
2768                             sc->sc_espintr, sc->sc_espstat, sc->sc_espstep);
2769                 }
2770                 sc->sc_prevphase = MESSAGE_IN_PHASE;
2771                 goto shortcut;  /* i.e. expect data to be ready */
2772
2773         case COMMAND_PHASE:
2774                 /*
2775                  * Send the command block. Normally we don't see this
2776                  * phase because the SEL_ATN command takes care of
2777                  * all this. However, we end up here if either the
2778                  * target or we wanted to exchange some more messages
2779                  * first (e.g. to start negotiations).
2780                  */
2781
2782                 NCR_PHASE(("COMMAND_PHASE 0x%02x (%d) ",
2783                     ecb->cmd.cmd.opcode, ecb->clen));
2784                 if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
2785                         NCRCMD(sc, NCRCMD_FLUSH);
2786 /*                      DELAY(1);*/
2787                 }
2788                 if (sc->sc_features & NCR_F_DMASELECT) {
2789                         /* setup DMA transfer for command */
2790                         size = ecb->clen;
2791                         sc->sc_cmdlen = size;
2792                         sc->sc_cmdp = (caddr_t)&ecb->cmd.cmd;
2793                         NCRDMA_SETUP(sc, &sc->sc_cmdp, &sc->sc_cmdlen,
2794                             0, &size);
2795                         /* Program the SCSI counter */
2796                         NCR_SET_COUNT(sc, size);
2797
2798                         /* load the count in */
2799                         NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA);
2800
2801                         /* start the command transfer */
2802                         NCRCMD(sc, NCRCMD_TRANS | NCRCMD_DMA);
2803                         NCRDMA_GO(sc);
2804                 } else {
2805                         ncr53c9x_wrfifo(sc, (u_char *)&ecb->cmd.cmd, ecb->clen);
2806                         NCRCMD(sc, NCRCMD_TRANS);
2807                 }
2808                 sc->sc_prevphase = COMMAND_PHASE;
2809                 break;
2810
2811         case DATA_OUT_PHASE:
2812                 NCR_PHASE(("DATA_OUT_PHASE [%ld] ",(long)sc->sc_dleft));
2813                 NCRCMD(sc, NCRCMD_FLUSH);
2814                 size = min(sc->sc_dleft, sc->sc_maxxfer);
2815                 NCRDMA_SETUP(sc, &sc->sc_dp, &sc->sc_dleft, 0, &size);
2816                 sc->sc_prevphase = DATA_OUT_PHASE;
2817                 goto setup_xfer;
2818
2819         case DATA_IN_PHASE:
2820                 NCR_PHASE(("DATA_IN_PHASE "));
2821                 if (sc->sc_rev == NCR_VARIANT_ESP100)
2822                         NCRCMD(sc, NCRCMD_FLUSH);
2823                 size = min(sc->sc_dleft, sc->sc_maxxfer);
2824                 NCRDMA_SETUP(sc, &sc->sc_dp, &sc->sc_dleft, 1, &size);
2825                 sc->sc_prevphase = DATA_IN_PHASE;
2826         setup_xfer:
2827                 /* Target returned to data phase: wipe "done" memory */
2828                 ecb->flags &= ~ECB_TENTATIVE_DONE;
2829
2830                 /* Program the SCSI counter */
2831                 NCR_SET_COUNT(sc, size);
2832
2833                 /* load the count in */
2834                 NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA);
2835
2836                 /*
2837                  * Note that if `size' is 0, we've already transceived
2838                  * all the bytes we want but we're still in DATA PHASE.
2839                  * Apparently, the device needs padding. Also, a
2840                  * transfer size of 0 means "maximum" to the chip
2841                  * DMA logic.
2842                  */
2843                 NCRCMD(sc,
2844                     (size == 0 ? NCRCMD_TRPAD : NCRCMD_TRANS) | NCRCMD_DMA);
2845                 NCRDMA_GO(sc);
2846                 goto out;
2847
2848         case STATUS_PHASE:
2849                 NCR_PHASE(("STATUS_PHASE "));
2850                 sc->sc_flags |= NCR_ICCS;
2851                 NCRCMD(sc, NCRCMD_ICCS);
2852                 sc->sc_prevphase = STATUS_PHASE;
2853                 goto shortcut;  /* i.e. expect status results soon */
2854
2855         case INVALID_PHASE:
2856                 break;
2857
2858         default:
2859                 device_printf(sc->sc_dev, "unexpected bus phase; resetting\n");
2860                 goto reset;
2861         }
2862
2863 out:
2864         mtx_unlock(&sc->sc_lock);
2865         return;
2866
2867 reset:
2868         ncr53c9x_init(sc, 1);
2869         goto out;
2870
2871 finish:
2872         ncr53c9x_done(sc, ecb);
2873         goto out;
2874
2875 sched:
2876         sc->sc_state = NCR_IDLE;
2877         ncr53c9x_sched(sc);
2878         goto out;
2879
2880 shortcut:
2881         /*
2882          * The idea is that many of the SCSI operations take very little
2883          * time, and going away and getting interrupted is too high an
2884          * overhead to pay. For example, selecting, sending a message
2885          * and command and then doing some work can be done in one "pass".
2886          *
2887          * The delay is a heuristic. It is 2 when at 20MHz, 2 at 25MHz and 1
2888          * at 40MHz. This needs testing.
2889          */
2890         {
2891                 struct timeval wait, cur;
2892
2893                 microtime(&wait);
2894                 wait.tv_usec += 50 / sc->sc_freq;
2895                 if (wait.tv_usec > 1000000) {
2896                         wait.tv_sec++;
2897                         wait.tv_usec -= 1000000;
2898                 }
2899                 do {
2900                         if (NCRDMA_ISINTR(sc))
2901                                 goto again;
2902                         microtime(&cur);
2903                 } while (cur.tv_sec <= wait.tv_sec &&
2904                          cur.tv_usec <= wait.tv_usec);
2905         }
2906         goto out;
2907 }
2908
2909 static void
2910 ncr53c9x_abort(sc, ecb)
2911         struct ncr53c9x_softc *sc;
2912         struct ncr53c9x_ecb *ecb;
2913 {
2914
2915         /* 2 secs for the abort */
2916         ecb->timeout = NCR_ABORT_TIMEOUT;
2917         ecb->flags |= ECB_ABORT;
2918
2919         if (ecb == sc->sc_nexus) {
2920                 /*
2921                  * If we're still selecting, the message will be scheduled
2922                  * after selection is complete.
2923                  */
2924                 if (sc->sc_state == NCR_CONNECTED)
2925                         ncr53c9x_sched_msgout(SEND_ABORT);
2926
2927                 /*
2928                  * Reschedule timeout.
2929                  */
2930                 ecb->ccb->ccb_h.timeout_ch =
2931                     timeout(ncr53c9x_timeout, ecb, mstohz(ecb->timeout));
2932         } else {
2933                 /*
2934                  * Just leave the command where it is.
2935                  * XXX - what choice do we have but to reset the SCSI
2936                  *       eventually?
2937                  */
2938                 if (sc->sc_state == NCR_IDLE)
2939                         ncr53c9x_sched(sc);
2940         }
2941 }
2942
2943 static void
2944 ncr53c9x_timeout(void *arg)
2945 {
2946         struct ncr53c9x_ecb *ecb = arg;
2947         union ccb *ccb = ecb->ccb;
2948         struct ncr53c9x_softc *sc = ecb->sc;
2949         struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[ccb->ccb_h.target_id];
2950
2951         xpt_print_path(ccb->ccb_h.path);
2952         device_printf(sc->sc_dev, "timed out [ecb %p (flags 0x%x, dleft %x, "
2953             "stat %x)], <state %d, nexus %p, phase(l %x, c %x, p %x), "
2954             "resid %lx, msg(q %x,o %x) %s>",
2955             ecb, ecb->flags, ecb->dleft, ecb->stat,
2956             sc->sc_state, sc->sc_nexus,
2957             NCR_READ_REG(sc, NCR_STAT),
2958             sc->sc_phase, sc->sc_prevphase,
2959             (long)sc->sc_dleft, sc->sc_msgpriq, sc->sc_msgout,
2960             NCRDMA_ISACTIVE(sc) ? "DMA active" : "");
2961 #if defined(NCR53C9X_DEBUG) && NCR53C9X_DEBUG > 1
2962         printf("TRACE: %s.", ecb->trace);
2963 #endif
2964
2965         mtx_lock(&sc->sc_lock);
2966
2967         if (ecb->flags & ECB_ABORT) {
2968                 /* abort timed out */
2969                 printf(" AGAIN\n");
2970
2971                 ncr53c9x_init(sc, 1);
2972         } else {
2973                 /* abort the operation that has timed out */
2974                 printf("\n");
2975                 ccb->ccb_h.status = CAM_CMD_TIMEOUT;
2976                 ncr53c9x_abort(sc, ecb);
2977
2978                 /* Disable sync mode if stuck in a data phase */
2979                 if (ecb == sc->sc_nexus &&
2980                     (ti->flags & T_SYNCMODE) != 0 &&
2981                     (sc->sc_phase & (MSGI|CDI)) == 0) {
2982                         /* XXX ASYNC CALLBACK! */
2983                         xpt_print_path(ccb->ccb_h.path);
2984                         printf("sync negotiation disabled\n");
2985                         sc->sc_cfflags |=
2986                             (1 << ((ccb->ccb_h.target_id & 7) + 8));
2987                 }
2988         }
2989
2990         mtx_unlock(&sc->sc_lock);
2991 }
2992
2993 static void
2994 ncr53c9x_watch(void *arg)
2995 {
2996         struct ncr53c9x_softc *sc = (struct ncr53c9x_softc *)arg;
2997         struct ncr53c9x_tinfo *ti;
2998         struct ncr53c9x_linfo *li;
2999         int t;
3000         /* Delete any structures that have not been used in 10min. */
3001         time_t old = time_second - (10 * 60);
3002
3003         mtx_lock(&sc->sc_lock);
3004         for (t = 0; t < sc->sc_ntarg; t++) {
3005                 ti = &sc->sc_tinfo[t];
3006                 li = LIST_FIRST(&ti->luns);
3007                 while (li) {
3008                         if (li->last_used < old &&
3009                             li->untagged == NULL &&
3010                             li->used == 0) {
3011                                 if (li->lun < NCR_NLUN)
3012                                         ti->lun[li->lun] = NULL;
3013                                 LIST_REMOVE(li, link);
3014                                 free(li, M_DEVBUF);
3015                                 /* Restart the search at the beginning */
3016                                 li = LIST_FIRST(&ti->luns);
3017                                 continue;
3018                         }
3019                         li = LIST_NEXT(li, link);
3020                 }
3021         }
3022         mtx_unlock(&sc->sc_lock);
3023         callout_reset(&sc->sc_watchdog, 60 * hz, ncr53c9x_watch, sc);
3024 }