sys/dev/esp/ncr53c9x.c

   1 /*-
   2  * Copyright (c) 2004 Scott Long
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  *
  14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  24  * SUCH DAMAGE.
  25  *
  26  */
  27
  28 /*      $NetBSD: ncr53c9x.c,v 1.114 2005/02/27 00:27:02 perry Exp $     */
  29
  30 /*-
  31  * Copyright (c) 1998, 2002 The NetBSD Foundation, Inc.
  32  * All rights reserved.
  33  *
  34  * This code is derived from software contributed to The NetBSD Foundation
  35  * by Charles M. Hannum.
  36  *
  37  * Redistribution and use in source and binary forms, with or without
  38  * modification, are permitted provided that the following conditions
  39  * are met:
  40  * 1. Redistributions of source code must retain the above copyright
  41  *    notice, this list of conditions and the following disclaimer.
  42  * 2. Redistributions in binary form must reproduce the above copyright
  43  *    notice, this list of conditions and the following disclaimer in the
  44  *    documentation and/or other materials provided with the distribution.
  45  * 3. All advertising materials mentioning features or use of this software
  46  *    must display the following acknowledgement:
  47  *        This product includes software developed by the NetBSD
  48  *        Foundation, Inc. and its contributors.
  49  * 4. Neither the name of The NetBSD Foundation nor the names of its
  50  *    contributors may be used to endorse or promote products derived
  51  *    from this software without specific prior written permission.
  52  *
  53  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
  54  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  55  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  56  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
  57  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  58  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  59  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  60  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  61  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  62  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  63  * POSSIBILITY OF SUCH DAMAGE.
  64  */
  65
  66 /*-
  67  * Copyright (c) 1994 Peter Galbavy
  68  * Copyright (c) 1995 Paul Kranenburg
  69  * All rights reserved.
  70  *
  71  * Redistribution and use in source and binary forms, with or without
  72  * modification, are permitted provided that the following conditions
  73  * are met:
  74  * 1. Redistributions of source code must retain the above copyright
  75  *    notice, this list of conditions and the following disclaimer.
  76  * 2. Redistributions in binary form must reproduce the above copyright
  77  *    notice, this list of conditions and the following disclaimer in the
  78  *    documentation and/or other materials provided with the distribution.
  79  * 3. All advertising materials mentioning features or use of this software
  80  *    must display the following acknowledgement:
  81  *      This product includes software developed by Peter Galbavy
  82  * 4. The name of the author may not be used to endorse or promote products
  83  *    derived from this software without specific prior written permission.
  84  *
  85  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  86  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  87  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  88  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
  89  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  90  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  91  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  92  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  93  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  94  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  95  * POSSIBILITY OF SUCH DAMAGE.
  96  */
  97
  98 /*
  99  * Based on aic6360 by Jarle Greipsland
 100  *
 101  * Acknowledgements: Many of the algorithms used in this driver are
 102  * inspired by the work of Julian Elischer (julian@FreeBSD.org) and
 103  * Charles Hannum (mycroft@duality.gnu.ai.mit.edu).  Thanks a million!
 104  */
 105
 106 #include <sys/cdefs.h>
 107 __FBSDID("$FreeBSD$");
 108
 109 #include <sys/param.h>
 110 #include <sys/systm.h>
 111 #include <sys/bus.h>
 112 #include <sys/kernel.h>
 113 #include <sys/malloc.h>
 114 #include <sys/resource.h>
 115 #include <sys/lock.h>
 116 #include <sys/mutex.h>
 117 #include <sys/queue.h>
 118 #include <sys/time.h>
 119 #include <sys/callout.h>
 120
 121 #include <cam/cam.h>
 122 #include <cam/cam_ccb.h>
 123 #include <cam/cam_debug.h>
 124 #include <cam/cam_sim.h>
 125 #include <cam/cam_xpt_sim.h>
 126 #include <cam/scsi/scsi_all.h>
 127 #include <cam/scsi/scsi_message.h>
 128
 129 #include <dev/esp/ncr53c9xreg.h>
 130 #include <dev/esp/ncr53c9xvar.h>
 131
 132 int ncr53c9x_debug = NCR_SHOWMISC /*|NCR_SHOWPHASE|NCR_SHOWTRAC|NCR_SHOWCMDS*/;
 133 #ifdef DEBUG
 134 int ncr53c9x_notag = 0;
 135 #endif
 136
 137 static void     ncr53c9x_select(struct ncr53c9x_softc *, struct ncr53c9x_ecb *);
 138 static int      ncr53c9x_reselect(struct ncr53c9x_softc *, int, int, int);
 139 static void     ncr53c9x_scsi_reset(struct ncr53c9x_softc *);
 140 static void     ncr53c9x_poll(struct cam_sim *);
 141 static void     ncr53c9x_sched(struct ncr53c9x_softc *);
 142 static void     ncr53c9x_done(struct ncr53c9x_softc *, struct ncr53c9x_ecb *);
 143 static void     ncr53c9x_msgin(struct ncr53c9x_softc *);
 144 static void     ncr53c9x_msgout(struct ncr53c9x_softc *);
 145 static void     ncr53c9x_timeout(void *arg);
 146 static void     ncr53c9x_watch(void *arg);
 147 static void     ncr53c9x_abort(struct ncr53c9x_softc *, struct ncr53c9x_ecb *);
 148 static void     ncr53c9x_dequeue(struct ncr53c9x_softc *,
 149                                 struct ncr53c9x_ecb *);
 150 static void     ncr53c9x_sense(struct ncr53c9x_softc *, struct ncr53c9x_ecb *);
 151 static void     ncr53c9x_free_ecb(struct ncr53c9x_softc *,
 152                                   struct ncr53c9x_ecb *);
 153 static void     ncr53c9x_wrfifo(struct ncr53c9x_softc *, u_char *, int);
 154 static int      ncr53c9x_rdfifo(struct ncr53c9x_softc *, int);
 155
 156 static struct ncr53c9x_ecb *ncr53c9x_get_ecb(struct ncr53c9x_softc *);
 157 static struct ncr53c9x_linfo *ncr53c9x_lunsearch(struct ncr53c9x_tinfo *,
 158                                                  int64_t lun);
 159
 160 static __inline void ncr53c9x_readregs(struct ncr53c9x_softc *);
 161 static __inline int ncr53c9x_stp2cpb(struct ncr53c9x_softc *, int);
 162 static __inline void ncr53c9x_setsync(struct ncr53c9x_softc *,
 163                                       struct ncr53c9x_tinfo *);
 164
 165 #define NCR_RDFIFO_START   0
 166 #define NCR_RDFIFO_CONTINUE 1
 167
 168 #define NCR_SET_COUNT(sc, size) do { \
 169                 NCR_WRITE_REG((sc), NCR_TCL, (size));                   \
 170                 NCR_WRITE_REG((sc), NCR_TCM, (size) >> 8);              \
 171                 if ((sc->sc_cfg2 & NCRCFG2_FE) ||                       \
 172                     (sc->sc_rev == NCR_VARIANT_FAS366)) {               \
 173                         NCR_WRITE_REG((sc), NCR_TCH, (size) >> 16);     \
 174                 }                                                       \
 175                 if (sc->sc_rev == NCR_VARIANT_FAS366) {                 \
 176                         NCR_WRITE_REG(sc, NCR_RCH, 0);                  \
 177                 }                                                       \
 178 } while (0)
 179
 180 #ifndef mstohz
 181 #define mstohz(ms) \
 182         (((ms) < 0x20000)  ? \
 183             ((ms +0u) / 1000u) * hz : \
 184             ((ms +0u) * hz) /1000u)
 185 #endif
 186
 187 /*
 188  * Names for the NCR53c9x variants, corresponding to the variant tags
 189  * in ncr53c9xvar.h.
 190  */
 191 static const char *ncr53c9x_variant_names[] = {
 192         "ESP100",
 193         "ESP100A",
 194         "ESP200",
 195         "NCR53C94",
 196         "NCR53C96",
 197         "ESP406",
 198         "FAS408",
 199         "FAS216",
 200         "AM53C974",
 201         "FAS366/HME",
 202         "NCR53C90 (86C01)",
 203         "FAS100A",
 204         "FAS236",
 205 };
 206
 207 /*
 208  * Search linked list for LUN info by LUN id.
 209  */
 210 static struct ncr53c9x_linfo *
 211 ncr53c9x_lunsearch(struct ncr53c9x_tinfo *ti, int64_t lun)
 212 {
 213         struct ncr53c9x_linfo *li;
 214         LIST_FOREACH(li, &ti->luns, link)
 215                 if (li->lun == lun)
 216                         return (li);
 217         return (NULL);
 218 }
 219
 220 /*
 221  * Attach this instance, and then all the sub-devices.
 222  */
 223 int
 224 ncr53c9x_attach(struct ncr53c9x_softc *sc)
 225 {
 226         struct cam_devq *devq;
 227         struct cam_sim *sim;
 228         struct cam_path *path;
 229         struct ncr53c9x_ecb *ecb;
 230         int error, i;
 231
 232         mtx_init(&sc->sc_lock, "ncr", "ncr53c9x lock", MTX_DEF);
 233
 234         /*
 235          * Note, the front-end has set us up to print the chip variation.
 236          */
 237         if (sc->sc_rev >= NCR_VARIANT_MAX) {
 238                 device_printf(sc->sc_dev, "unknown variant %d, devices not "
 239                     "attached\n", sc->sc_rev);
 240                 return (EINVAL);
 241         }
 242
 243         device_printf(sc->sc_dev, "%s, %dMHz, SCSI ID %d\n",
 244             ncr53c9x_variant_names[sc->sc_rev], sc->sc_freq, sc->sc_id);
 245
 246         sc->sc_ntarg = (sc->sc_rev == NCR_VARIANT_FAS366) ? 16 : 8;
 247
 248         /*
 249          * Allocate SCSI message buffers.
 250          * Front-ends can override allocation to avoid alignment
 251          * handling in the DMA engines. Note that that ncr53c9x_msgout()
 252          * can request a 1 byte DMA transfer.
 253          */
 254         if (sc->sc_omess == NULL) {
 255                 sc->sc_omess_self = 1;
 256                 sc->sc_omess = malloc(NCR_MAX_MSG_LEN, M_DEVBUF, M_NOWAIT);
 257                 if (sc->sc_omess == NULL) {
 258                         device_printf(sc->sc_dev,
 259                             "cannot allocate MSGOUT buffer\n");
 260                         return (ENOMEM);
 261                 }
 262         } else
 263                 sc->sc_omess_self = 0;
 264
 265         if (sc->sc_imess == NULL) {
 266                 sc->sc_imess_self = 1;
 267                 sc->sc_imess = malloc(NCR_MAX_MSG_LEN + 1, M_DEVBUF, M_NOWAIT);
 268                 if (sc->sc_imess == NULL) {
 269                         device_printf(sc->sc_dev,
 270                             "cannot allocate MSGIN buffer\n");
 271                         error = ENOMEM;
 272                         goto fail_omess;
 273                 }
 274         } else
 275                 sc->sc_imess_self = 0;
 276
 277         sc->sc_tinfo = malloc(sc->sc_ntarg * sizeof(sc->sc_tinfo[0]),
 278             M_DEVBUF, M_NOWAIT | M_ZERO);
 279         if (sc->sc_tinfo == NULL) {
 280                 device_printf(sc->sc_dev,
 281                     "cannot allocate target info buffer\n");
 282                 error = ENOMEM;
 283                 goto fail_imess;
 284         }
 285
 286         callout_init(&sc->sc_watchdog, 0);
 287
 288         /*
 289          * Treat NCR53C90 with the 86C01 DMA chip exactly as ESP100
 290          * from now on.
 291          */
 292         if (sc->sc_rev == NCR_VARIANT_NCR53C90_86C01)
 293                 sc->sc_rev = NCR_VARIANT_ESP100;
 294
 295         sc->sc_ccf = FREQTOCCF(sc->sc_freq);
 296
 297         /* The value *must not* be == 1. Make it 2 */
 298         if (sc->sc_ccf == 1)
 299                 sc->sc_ccf = 2;
 300
 301         /*
 302          * The recommended timeout is 250ms. This register is loaded
 303          * with a value calculated as follows, from the docs:
 304          *
 305          *              (timout period) x (CLK frequency)
 306          *      reg = -------------------------------------
 307          *               8192 x (Clock Conversion Factor)
 308          *
 309          * Since CCF has a linear relation to CLK, this generally computes
 310          * to the constant of 153.
 311          */
 312         sc->sc_timeout = ((250 * 1000) * sc->sc_freq) / (8192 * sc->sc_ccf);
 313
 314         /* CCF register only has 3 bits; 0 is actually 8 */
 315         sc->sc_ccf &= 7;
 316
 317         /*
 318          * Register with CAM
 319          */
 320         devq = cam_simq_alloc(sc->sc_ntarg);
 321         if (devq == NULL) {
 322                 device_printf(sc->sc_dev, "cannot allocate device queue\n");
 323                 error = ENOMEM;
 324                 goto fail_tinfo;
 325         }
 326
 327         sim = cam_sim_alloc(ncr53c9x_action, ncr53c9x_poll, "esp", sc,
 328                             device_get_unit(sc->sc_dev), &Giant, 1,
 329                             NCR_TAG_DEPTH, devq);
 330         if (sim == NULL) {
 331                 device_printf(sc->sc_dev, "cannot allocate SIM entry\n");
 332                 error = ENOMEM;
 333                 goto fail_devq;
 334         }
 335         if (xpt_bus_register(sim, sc->sc_dev, 0) != CAM_SUCCESS) {
 336                 device_printf(sc->sc_dev, "cannot register bus\n");
 337                 error = EIO;
 338                 goto fail_sim;
 339         }
 340
 341         if (xpt_create_path(&path, NULL, cam_sim_path(sim),
 342                             CAM_TARGET_WILDCARD, CAM_LUN_WILDCARD)
 343                             != CAM_REQ_CMP) {
 344                 device_printf(sc->sc_dev, "cannot create path\n");
 345                 error = EIO;
 346                 goto fail_bus;
 347         }
 348
 349         sc->sc_sim = sim;
 350         sc->sc_path = path;
 351
 352         /* Reset state & bus */
 353 #if 0
 354         sc->sc_cfflags = sc->sc_dev.dv_cfdata->cf_flags;
 355 #endif
 356         sc->sc_state = 0;
 357         ncr53c9x_init(sc, 1);
 358
 359         TAILQ_INIT(&sc->free_list);
 360         if ((sc->ecb_array = malloc(sizeof(struct ncr53c9x_ecb) * NCR_TAG_DEPTH,
 361                                     M_DEVBUF, M_NOWAIT|M_ZERO)) == NULL) {
 362                 device_printf(sc->sc_dev, "cannot allocate ECB array\n");
 363                 error = ENOMEM;
 364                 goto fail_path;
 365         }
 366         for (i = 0; i < NCR_TAG_DEPTH; i++) {
 367                 ecb = &sc->ecb_array[i];
 368                 ecb->sc = sc;
 369                 ecb->tag_id = i;
 370                 TAILQ_INSERT_HEAD(&sc->free_list, ecb, free_links);
 371         }
 372
 373         callout_reset(&sc->sc_watchdog, 60*hz, ncr53c9x_watch, sc);
 374
 375         return (0);
 376
 377 fail_path:
 378         xpt_free_path(path);
 379 fail_bus:
 380         xpt_bus_deregister(cam_sim_path(sim));
 381 fail_sim:
 382         cam_sim_free(sim, TRUE);
 383 fail_devq:
 384         cam_simq_free(devq);
 385 fail_tinfo:
 386         free(sc->sc_tinfo, M_DEVBUF);
 387 fail_imess:
 388         if (sc->sc_imess_self)
 389                 free(sc->sc_imess, M_DEVBUF);
 390 fail_omess:
 391         if (sc->sc_omess_self)
 392                 free(sc->sc_omess, M_DEVBUF);
 393         return (error);
 394 }
 395
 396 int
 397 ncr53c9x_detach(struct ncr53c9x_softc *sc)
 398 {
 399
 400         callout_drain(&sc->sc_watchdog);
 401         mtx_lock(&sc->sc_lock);
 402         ncr53c9x_init(sc, 1);
 403         mtx_unlock(&sc->sc_lock);
 404         xpt_free_path(sc->sc_path);
 405         xpt_bus_deregister(cam_sim_path(sc->sc_sim));
 406         cam_sim_free(sc->sc_sim, TRUE);
 407         free(sc->ecb_array, M_DEVBUF);
 408         free(sc->sc_tinfo, M_DEVBUF);
 409         if (sc->sc_imess_self)
 410                 free(sc->sc_imess, M_DEVBUF);
 411         if (sc->sc_omess_self)
 412                 free(sc->sc_omess, M_DEVBUF);
 413         mtx_destroy(&sc->sc_lock);
 414
 415         return (0);
 416 }
 417
 418 /*
 419  * This is the generic ncr53c9x reset function. It does not reset the SCSI bus,
 420  * only this controller, but kills any on-going commands, and also stops
 421  * and resets the DMA.
 422  *
 423  * After reset, registers are loaded with the defaults from the attach
 424  * routine above.
 425  */
 426 void
 427 ncr53c9x_reset(struct ncr53c9x_softc *sc)
 428 {
 429
 430         /* reset DMA first */
 431         NCRDMA_RESET(sc);
 432
 433         /* reset SCSI chip */
 434         NCRCMD(sc, NCRCMD_RSTCHIP);
 435         NCRCMD(sc, NCRCMD_NOP);
 436         DELAY(500);
 437
 438         /* do these backwards, and fall through */
 439         switch (sc->sc_rev) {
 440         case NCR_VARIANT_ESP406:
 441         case NCR_VARIANT_FAS408:
 442                 NCR_WRITE_REG(sc, NCR_CFG5, sc->sc_cfg5 | NCRCFG5_SINT);
 443                 NCR_WRITE_REG(sc, NCR_CFG4, sc->sc_cfg4);
 444         case NCR_VARIANT_AM53C974:
 445         case NCR_VARIANT_FAS100A:
 446         case NCR_VARIANT_FAS216:
 447         case NCR_VARIANT_FAS236:
 448         case NCR_VARIANT_NCR53C94:
 449         case NCR_VARIANT_NCR53C96:
 450         case NCR_VARIANT_ESP200:
 451                 sc->sc_features |= NCR_F_HASCFG3;
 452                 NCR_WRITE_REG(sc, NCR_CFG3, sc->sc_cfg3);
 453         case NCR_VARIANT_ESP100A:
 454                 sc->sc_features |= NCR_F_SELATN3;
 455                 NCR_WRITE_REG(sc, NCR_CFG2, sc->sc_cfg2);
 456         case NCR_VARIANT_ESP100:
 457                 NCR_WRITE_REG(sc, NCR_CFG1, sc->sc_cfg1);
 458                 NCR_WRITE_REG(sc, NCR_CCF, sc->sc_ccf);
 459                 NCR_WRITE_REG(sc, NCR_SYNCOFF, 0);
 460                 NCR_WRITE_REG(sc, NCR_TIMEOUT, sc->sc_timeout);
 461                 break;
 462
 463         case NCR_VARIANT_FAS366:
 464                 sc->sc_features |=
 465                     NCR_F_HASCFG3 | NCR_F_FASTSCSI | NCR_F_SELATN3;
 466                 sc->sc_cfg3 = NCRFASCFG3_FASTCLK | NCRFASCFG3_OBAUTO;
 467                 sc->sc_cfg3_fscsi = NCRFASCFG3_FASTSCSI;
 468                 NCR_WRITE_REG(sc, NCR_CFG3, sc->sc_cfg3);
 469                 sc->sc_cfg2 = 0; /* NCRCFG2_HMEFE| NCRCFG2_HME32 */
 470                 NCR_WRITE_REG(sc, NCR_CFG2, sc->sc_cfg2);
 471                 NCR_WRITE_REG(sc, NCR_CFG1, sc->sc_cfg1);
 472                 NCR_WRITE_REG(sc, NCR_CCF, sc->sc_ccf);
 473                 NCR_WRITE_REG(sc, NCR_SYNCOFF, 0);
 474                 NCR_WRITE_REG(sc, NCR_TIMEOUT, sc->sc_timeout);
 475                 break;
 476
 477         default:
 478                 device_printf(sc->sc_dev, "unknown revision code, "
 479                               "assuming ESP100\n");
 480                 NCR_WRITE_REG(sc, NCR_CFG1, sc->sc_cfg1);
 481                 NCR_WRITE_REG(sc, NCR_CCF, sc->sc_ccf);
 482                 NCR_WRITE_REG(sc, NCR_SYNCOFF, 0);
 483                 NCR_WRITE_REG(sc, NCR_TIMEOUT, sc->sc_timeout);
 484         }
 485
 486         if (sc->sc_rev == NCR_VARIANT_AM53C974)
 487                 NCR_WRITE_REG(sc, NCR_AMDCFG4, sc->sc_cfg4);
 488
 489 #if 0
 490         device_printf(sc->sc_dev, "ncr53c9x_reset: revision %d\n",
 491                sc->sc_rev);
 492         device_printf(sc->sc_dev, "ncr53c9x_reset: cfg1 0x%x, cfg2 0x%x, "
 493             "cfg3 0x%x, ccf 0x%x, timeout 0x%x\n",
 494             sc->sc_cfg1, sc->sc_cfg2, sc->sc_cfg3, sc->sc_ccf, sc->sc_timeout);
 495 #endif
 496 }
 497
 498 /*
 499  * Reset the SCSI bus, but not the chip
 500  */
 501 static void
 502 ncr53c9x_scsi_reset(struct ncr53c9x_softc *sc)
 503 {
 504
 505         (*sc->sc_glue->gl_dma_stop)(sc);
 506
 507         NCR_MISC(("%s: resetting SCSI bus\n", device_get_nameunit(sc->sc_dev)));
 508         NCRCMD(sc, NCRCMD_RSTSCSI);
 509         DELAY(250000);          /* Give the bus a fighting chance to settle */
 510 }
 511
 512 /*
 513  * Initialize ncr53c9x state machine
 514  */
 515 void
 516 ncr53c9x_init(struct ncr53c9x_softc *sc, int doreset)
 517 {
 518         struct ncr53c9x_ecb *ecb;
 519         struct ncr53c9x_linfo *li;
 520         int i, r;
 521
 522         NCR_MISC(("[NCR_INIT(%d) %d] ", doreset, sc->sc_state));
 523
 524         if (sc->sc_state == 0) {
 525                 /* First time through; initialize. */
 526
 527                 TAILQ_INIT(&sc->ready_list);
 528                 sc->sc_nexus = NULL;
 529                 memset(sc->sc_tinfo, 0, sizeof(sc->sc_tinfo));
 530                 for (r = 0; r < sc->sc_ntarg; r++) {
 531                         LIST_INIT(&sc->sc_tinfo[r].luns);
 532                 }
 533         } else {
 534                 /* Cancel any active commands. */
 535                 sc->sc_state = NCR_CLEANING;
 536                 sc->sc_msgify = 0;
 537                 if ((ecb = sc->sc_nexus) != NULL) {
 538                         ecb->ccb->ccb_h.status = CAM_CMD_TIMEOUT;
 539                         ncr53c9x_done(sc, ecb);
 540                 }
 541                 /* Cancel outstanding disconnected commands on each LUN */
 542                 for (r = 0; r < sc->sc_ntarg; r++) {
 543                         LIST_FOREACH(li, &sc->sc_tinfo[r].luns, link) {
 544                                 if ((ecb = li->untagged) != NULL) {
 545                                         li->untagged = NULL;
 546                                         /*
 547                                          * XXXXXXX
 548                                          *
 549                                          * Should we terminate a command
 550                                          * that never reached the disk?
 551                                          */
 552                                         li->busy = 0;
 553                                         ecb->ccb->ccb_h.status =
 554                                             CAM_CMD_TIMEOUT;
 555                                         ncr53c9x_done(sc, ecb);
 556                                 }
 557                                 for (i = 0; i < 256; i++)
 558                                         if ((ecb = li->queued[i])) {
 559                                                 li->queued[i] = NULL;
 560                                                 ecb->ccb->ccb_h.status =
 561                                                     CAM_CMD_TIMEOUT;
 562                                                 ncr53c9x_done(sc, ecb);
 563                                         }
 564                                 li->used = 0;
 565                         }
 566                 }
 567         }
 568
 569         /*
 570          * reset the chip to a known state
 571          */
 572         ncr53c9x_reset(sc);
 573
 574         sc->sc_flags = 0;
 575         sc->sc_msgpriq = sc->sc_msgout = sc->sc_msgoutq = 0;
 576         sc->sc_phase = sc->sc_prevphase = INVALID_PHASE;
 577
 578         for (r = 0; r < sc->sc_ntarg; r++) {
 579                 struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[r];
 580 /* XXX - config flags per target: low bits: no reselect; high bits: no synch */
 581
 582                 ti->flags = ((sc->sc_minsync && !(sc->sc_cfflags & (1<<((r&7)+8))))
 583                     ? 0 : T_SYNCHOFF) |
 584                     ((sc->sc_cfflags & (1<<(r&7))) ? T_RSELECTOFF : 0);
 585 #ifdef DEBUG
 586                 if (ncr53c9x_notag)
 587                         ti->flags &= ~T_TAG;
 588 #endif
 589                 ti->period = sc->sc_minsync;
 590                 ti->offset = 0;
 591                 ti->cfg3   = 0;
 592         }
 593
 594         if (doreset) {
 595                 sc->sc_state = NCR_SBR;
 596                 NCRCMD(sc, NCRCMD_RSTSCSI);
 597         } else {
 598                 sc->sc_state = NCR_IDLE;
 599                 ncr53c9x_sched(sc);
 600         }
 601 }
 602
 603 /*
 604  * Read the NCR registers, and save their contents for later use.
 605  * NCR_STAT, NCR_STEP & NCR_INTR are mostly zeroed out when reading
 606  * NCR_INTR - so make sure it is the last read.
 607  *
 608  * I think that (from reading the docs) most bits in these registers
 609  * only make sense when he DMA CSR has an interrupt showing. Call only
 610  * if an interrupt is pending.
 611  */
 612 static __inline void
 613 ncr53c9x_readregs(struct ncr53c9x_softc *sc)
 614 {
 615
 616         sc->sc_espstat = NCR_READ_REG(sc, NCR_STAT);
 617         /* Only the stepo bits are of interest */
 618         sc->sc_espstep = NCR_READ_REG(sc, NCR_STEP) & NCRSTEP_MASK;
 619
 620         if (sc->sc_rev == NCR_VARIANT_FAS366)
 621                 sc->sc_espstat2 = NCR_READ_REG(sc, NCR_STAT2);
 622
 623         sc->sc_espintr = NCR_READ_REG(sc, NCR_INTR);
 624
 625         if (sc->sc_glue->gl_clear_latched_intr != NULL)
 626                 (*sc->sc_glue->gl_clear_latched_intr)(sc);
 627
 628         /*
 629          * Determine the SCSI bus phase, return either a real SCSI bus phase
 630          * or some pseudo phase we use to detect certain exceptions.
 631          */
 632
 633         sc->sc_phase = (sc->sc_espintr & NCRINTR_DIS) ?
 634             /* Disconnected */ BUSFREE_PHASE : sc->sc_espstat & NCRSTAT_PHASE;
 635
 636         NCR_INTS(("regs[intr=%02x,stat=%02x,step=%02x,stat2=%02x] ",
 637             sc->sc_espintr, sc->sc_espstat, sc->sc_espstep, sc->sc_espstat2));
 638 }
 639
 640 /*
 641  * Convert Synchronous Transfer Period to chip register Clock Per Byte value.
 642  */
 643 static __inline int
 644 ncr53c9x_stp2cpb(struct ncr53c9x_softc *sc, int period)
 645 {
 646         int v;
 647         v = (sc->sc_freq * period) / 250;
 648         if (ncr53c9x_cpb2stp(sc, v) < period)
 649                 /* Correct round-down error */
 650                 v++;
 651         return (v);
 652 }
 653
 654 static __inline void
 655 ncr53c9x_setsync(struct ncr53c9x_softc *sc, struct ncr53c9x_tinfo *ti)
 656 {
 657         u_char syncoff, synctp;
 658         u_char cfg3 = sc->sc_cfg3 | ti->cfg3;
 659
 660         if (ti->flags & T_SYNCMODE) {
 661                 syncoff = ti->offset;
 662                 synctp = ncr53c9x_stp2cpb(sc, ti->period);
 663                 if (sc->sc_features & NCR_F_FASTSCSI) {
 664                         /*
 665                          * If the period is 200ns or less (ti->period <= 50),
 666                          * put the chip in Fast SCSI mode.
 667                          */
 668                         if (ti->period <= 50)
 669                                 /*
 670                                  * There are (at least) 4 variations of the
 671                                  * configuration 3 register.  The drive attach
 672                                  * routine sets the appropriate bit to put the
 673                                  * chip into Fast SCSI mode so that it doesn't
 674                                  * have to be figured out here each time.
 675                                  */
 676                                 cfg3 |= sc->sc_cfg3_fscsi;
 677                 }
 678
 679                 /*
 680                  * Am53c974 requires different SYNCTP values when the
 681                  * FSCSI bit is off.
 682                  */
 683                 if (sc->sc_rev == NCR_VARIANT_AM53C974 &&
 684                     (cfg3 & NCRAMDCFG3_FSCSI) == 0)
 685                         synctp--;
 686         } else {
 687                 syncoff = 0;
 688                 synctp = 0;
 689         }
 690
 691         if (sc->sc_features & NCR_F_HASCFG3)
 692                 NCR_WRITE_REG(sc, NCR_CFG3, cfg3);
 693
 694         NCR_WRITE_REG(sc, NCR_SYNCOFF, syncoff);
 695         NCR_WRITE_REG(sc, NCR_SYNCTP, synctp);
 696 }
 697
 698 /*
 699  * Send a command to a target, set the driver state to NCR_SELECTING
 700  * and let the caller take care of the rest.
 701  *
 702  * Keeping this as a function allows me to say that this may be done
 703  * by DMA instead of programmed I/O soon.
 704  */
 705 static void
 706 ncr53c9x_select(struct ncr53c9x_softc *sc, struct ncr53c9x_ecb *ecb)
 707 {
 708         int target = ecb->ccb->ccb_h.target_id;
 709         int lun = ecb->ccb->ccb_h.target_lun;
 710         struct ncr53c9x_tinfo *ti;
 711         int tiflags;
 712         u_char *cmd;
 713         int clen;
 714         int selatn3, selatns;
 715         size_t dmasize;
 716
 717         NCR_TRACE(("[ncr53c9x_select(t%d,l%d,cmd:%x,tag:%x,%x)] ",
 718             target, lun, ecb->cmd.cmd.opcode, ecb->tag[0], ecb->tag[1]));
 719
 720         ti = &sc->sc_tinfo[target];
 721         tiflags = ti->flags;
 722         sc->sc_state = NCR_SELECTING;
 723         /*
 724          * Schedule the timeout now, the first time we will go away
 725          * expecting to come back due to an interrupt, because it is
 726          * always possible that the interrupt may never happen.
 727          */
 728         ecb->ccb->ccb_h.timeout_ch =
 729             timeout(ncr53c9x_timeout, ecb, mstohz(ecb->timeout));
 730
 731         /*
 732          * The docs say the target register is never reset, and I
 733          * can't think of a better place to set it
 734          */
 735         if (sc->sc_rev == NCR_VARIANT_FAS366) {
 736                 NCRCMD(sc, NCRCMD_FLUSH);
 737                 NCR_WRITE_REG(sc, NCR_SELID, target | NCR_BUSID_HME);
 738         } else {
 739                 NCR_WRITE_REG(sc, NCR_SELID, target);
 740         }
 741         ncr53c9x_setsync(sc, ti);
 742
 743         if ((ecb->flags & ECB_SENSE) != 0) {
 744                 /*
 745                  * For REQUEST SENSE, we should not send an IDENTIFY or
 746                  * otherwise mangle the target.  There should be no MESSAGE IN
 747                  * phase.
 748                  */
 749                 if (sc->sc_features & NCR_F_DMASELECT) {
 750                         /* setup DMA transfer for command */
 751                         dmasize = clen = ecb->clen;
 752                         sc->sc_cmdlen = clen;
 753                         sc->sc_cmdp = (caddr_t)&ecb->cmd.cmd;
 754
 755                         /* Program the SCSI counter */
 756                         NCR_SET_COUNT(sc, dmasize);
 757
 758                         if (sc->sc_rev != NCR_VARIANT_FAS366)
 759                                 NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA);
 760
 761                         /* And get the targets attention */
 762                         NCRCMD(sc, NCRCMD_SELNATN | NCRCMD_DMA);
 763                         NCRDMA_SETUP(sc, &sc->sc_cmdp, &sc->sc_cmdlen, 0,
 764                             &dmasize);
 765                         NCRDMA_GO(sc);
 766                 } else {
 767                         ncr53c9x_wrfifo(sc, (u_char *)&ecb->cmd.cmd, ecb->clen);
 768                         NCRCMD(sc, NCRCMD_SELNATN);
 769                 }
 770                 return;
 771         }
 772
 773         selatn3 = selatns = 0;
 774         if (ecb->tag[0] != 0) {
 775                 if (sc->sc_features & NCR_F_SELATN3)
 776                         /* use SELATN3 to send tag messages */
 777                         selatn3 = 1;
 778                 else
 779                         /* We don't have SELATN3; use SELATNS to send tags */
 780                         selatns = 1;
 781         }
 782
 783         if (ti->flags & T_NEGOTIATE) {
 784                 /* We have to use SELATNS to send sync/wide messages */
 785                 selatn3 = 0;
 786                 selatns = 1;
 787         }
 788
 789         cmd = (u_char *)&ecb->cmd.cmd;
 790
 791         if (selatn3) {
 792                 /* We'll use tags with SELATN3 */
 793                 clen = ecb->clen + 3;
 794                 cmd -= 3;
 795                 cmd[0] = MSG_IDENTIFY(lun, 1);  /* msg[0] */
 796                 cmd[1] = ecb->tag[0];           /* msg[1] */
 797                 cmd[2] = ecb->tag[1];           /* msg[2] */
 798         } else {
 799                 /* We don't have tags, or will send messages with SELATNS */
 800                 clen = ecb->clen + 1;
 801                 cmd -= 1;
 802                 cmd[0] = MSG_IDENTIFY(lun, (tiflags & T_RSELECTOFF) == 0);
 803         }
 804
 805         if ((sc->sc_features & NCR_F_DMASELECT) && !selatns) {
 806
 807                 /* setup DMA transfer for command */
 808                 dmasize = clen;
 809                 sc->sc_cmdlen = clen;
 810                 sc->sc_cmdp = cmd;
 811
 812                 /* Program the SCSI counter */
 813                 NCR_SET_COUNT(sc, dmasize);
 814
 815                 /* load the count in */
 816                 /* if (sc->sc_rev != NCR_VARIANT_FAS366) */
 817                         NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA);
 818
 819                 /* And get the targets attention */
 820                 if (selatn3) {
 821                         sc->sc_msgout = SEND_TAG;
 822                         sc->sc_flags |= NCR_ATN;
 823                         NCRCMD(sc, NCRCMD_SELATN3 | NCRCMD_DMA);
 824                 } else
 825                         NCRCMD(sc, NCRCMD_SELATN | NCRCMD_DMA);
 826                 NCRDMA_SETUP(sc, &sc->sc_cmdp, &sc->sc_cmdlen, 0, &dmasize);
 827                 NCRDMA_GO(sc);
 828                 return;
 829         }
 830
 831         /*
 832          * Who am I?  This is where we tell the target that we are
 833          * happy for it to disconnect etc.
 834          */
 835
 836         /* Now get the command into the FIFO */
 837         ncr53c9x_wrfifo(sc, cmd, clen);
 838
 839         /* And get the targets attention */
 840         if (selatns) {
 841                 NCR_MSGS(("SELATNS \n"));
 842                 /* Arbitrate, select and stop after IDENTIFY message */
 843                 NCRCMD(sc, NCRCMD_SELATNS);
 844         } else if (selatn3) {
 845                 sc->sc_msgout = SEND_TAG;
 846                 sc->sc_flags |= NCR_ATN;
 847                 NCRCMD(sc, NCRCMD_SELATN3);
 848         } else
 849                 NCRCMD(sc, NCRCMD_SELATN);
 850 }
 851
 852 static void
 853 ncr53c9x_free_ecb(struct ncr53c9x_softc *sc, struct ncr53c9x_ecb *ecb)
 854 {
 855
 856         ecb->flags = 0;
 857         TAILQ_INSERT_TAIL(&sc->free_list, ecb, free_links);
 858         return;
 859 }
 860
 861 static struct ncr53c9x_ecb *
 862 ncr53c9x_get_ecb(struct ncr53c9x_softc *sc)
 863 {
 864         struct ncr53c9x_ecb *ecb;
 865
 866         ecb = TAILQ_FIRST(&sc->free_list);
 867         if (ecb) {
 868                 if (ecb->flags != 0)
 869                         panic("ecb flags not cleared\n");
 870                 TAILQ_REMOVE(&sc->free_list, ecb, free_links);
 871                 ecb->flags = ECB_ALLOC;
 872                 bzero(&ecb->ccb, sizeof(struct ncr53c9x_ecb) -
 873                       offsetof(struct ncr53c9x_ecb, ccb));
 874         }
 875         return (ecb);
 876 }
 877
 878 /*
 879  * DRIVER FUNCTIONS CALLABLE FROM HIGHER LEVEL DRIVERS:
 880  */
 881
 882 /*
 883  * Start a SCSI-command
 884  * This function is called by the higher level SCSI-driver to queue/run
 885  * SCSI-commands.
 886  */
 887
 888 void
 889 ncr53c9x_action(struct cam_sim *sim, union ccb *ccb)
 890 {
 891         struct ncr53c9x_softc *sc;
 892         struct ncr53c9x_ecb *ecb;
 893
 894         NCR_TRACE(("[ncr53c9x_action %d]", ccb->ccb_h.func_code));
 895
 896         sc = cam_sim_softc(sim);
 897         mtx_lock(&sc->sc_lock);
 898
 899         switch (ccb->ccb_h.func_code) {
 900         case XPT_RESET_BUS:
 901                 ncr53c9x_scsi_reset(sc);
 902                 ccb->ccb_h.status = CAM_REQ_CMP;
 903                 mtx_unlock(&sc->sc_lock);
 904                 xpt_done(ccb);
 905                 return;
 906         case XPT_CALC_GEOMETRY:
 907                 mtx_unlock(&sc->sc_lock);
 908                 cam_calc_geometry(&ccb->ccg, sc->sc_extended_geom);
 909                 xpt_done(ccb);
 910                 return;
 911         case XPT_PATH_INQ:
 912         {
 913                 struct ccb_pathinq *cpi = &ccb->cpi;
 914
 915                 cpi->version_num = 1;
 916                 cpi->hba_inquiry = PI_SDTR_ABLE|PI_TAG_ABLE;
 917                 cpi->hba_inquiry |=
 918                     (sc->sc_rev == NCR_VARIANT_FAS366) ? PI_WIDE_16 : 0;
 919                 cpi->target_sprt = 0;
 920                 cpi->hba_misc = 0;
 921                 cpi->hba_eng_cnt = 0;
 922                 cpi->max_target = sc->sc_ntarg - 1;
 923                 cpi->max_lun = 8;
 924                 cpi->initiator_id = sc->sc_id;
 925                 cpi->bus_id = 0;
 926                 cpi->base_transfer_speed = 3300;
 927                 strncpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
 928                 strncpy(cpi->hba_vid, "Sun", HBA_IDLEN);
 929                 strncpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
 930                 cpi->unit_number = cam_sim_unit(sim);
 931                 cpi->transport = XPORT_SPI;
 932                 cpi->transport_version = 2;
 933                 cpi->protocol = PROTO_SCSI;
 934                 cpi->protocol_version = SCSI_REV_2;
 935                 ccb->ccb_h.status = CAM_REQ_CMP;
 936                 mtx_unlock(&sc->sc_lock);
 937                 xpt_done(ccb);
 938                 return;
 939         }
 940         case XPT_GET_TRAN_SETTINGS:
 941         {
 942                 struct ccb_trans_settings *cts = &ccb->cts;
 943                 struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[ccb->ccb_h.target_id];
 944                 struct ccb_trans_settings_scsi *scsi =
 945                     &cts->proto_specific.scsi;
 946                 struct ccb_trans_settings_spi *spi =
 947                     &cts->xport_specific.spi;
 948
 949                 cts->protocol = PROTO_SCSI;
 950                 cts->protocol_version = SCSI_REV_2;
 951                 cts->transport = XPORT_SPI;
 952                 cts->transport_version = 2;
 953
 954                 if (cts->type == CTS_TYPE_CURRENT_SETTINGS) {
 955                         spi->sync_period = ti->period;
 956                         spi->sync_offset = ti->offset;
 957                         spi->bus_width = ti->width;
 958                         if ((ti->flags & T_TAG) != 0) {
 959                                 spi->flags |= CTS_SPI_FLAGS_DISC_ENB;
 960                                 scsi->flags |= CTS_SCSI_FLAGS_TAG_ENB;
 961                         } else {
 962                                 spi->flags &= ~CTS_SPI_FLAGS_DISC_ENB;
 963                                 scsi->flags &= ~CTS_SCSI_FLAGS_TAG_ENB;
 964                         }
 965                 } else {
 966                         spi->sync_period = sc->sc_maxsync;
 967                         spi->sync_offset = sc->sc_maxoffset;
 968                         spi->bus_width = sc->sc_maxwidth;
 969                         spi->flags |= CTS_SPI_FLAGS_DISC_ENB;
 970                         scsi->flags |= CTS_SCSI_FLAGS_TAG_ENB;
 971                 }
 972                 spi->valid =
 973                     CTS_SPI_VALID_BUS_WIDTH |
 974                     CTS_SPI_VALID_SYNC_RATE |
 975                     CTS_SPI_VALID_SYNC_OFFSET |
 976                     CTS_SPI_VALID_DISC;
 977                 scsi->valid = CTS_SCSI_VALID_TQ;
 978                 ccb->ccb_h.status = CAM_REQ_CMP;
 979                 mtx_unlock(&sc->sc_lock);
 980                 xpt_done(ccb);
 981                 return;
 982         }
 983         case XPT_ABORT:
 984                 printf("XPT_ABORT called\n");
 985                 ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
 986                 mtx_unlock(&sc->sc_lock);
 987                 xpt_done(ccb);
 988                 return;
 989         case XPT_TERM_IO:
 990                 printf("XPT_TERM_IO called\n");
 991                 ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
 992                 mtx_unlock(&sc->sc_lock);
 993                 xpt_done(ccb);
 994                 return;
 995         case XPT_RESET_DEV:
 996                 printf("XPT_RESET_DEV called\n");
 997         case XPT_SCSI_IO:
 998         {
 999                 struct ccb_scsiio *csio;
1000
1001                 if (ccb->ccb_h.target_id < 0 ||
1002                     ccb->ccb_h.target_id >= sc->sc_ntarg) {
1003                         ccb->ccb_h.status = CAM_PATH_INVALID;
1004                         mtx_unlock(&sc->sc_lock);
1005                         xpt_done(ccb);
1006                         return;
1007                 }
1008                 /* Get an ECB to use. */
1009                 ecb = ncr53c9x_get_ecb(sc);
1010                 /*
1011                  * This should never happen as we track resources
1012                  * in the mid-layer.
1013                  */
1014                 if (ecb == NULL) {
1015                         xpt_freeze_simq(sim, 1);
1016                         ccb->ccb_h.status = CAM_REQUEUE_REQ;
1017                         printf("unable to allocate ecb\n");
1018                         mtx_unlock(&sc->sc_lock);
1019                         xpt_done(ccb);
1020                         return;
1021                 }
1022
1023                 /* Initialize ecb */
1024                 ecb->ccb = ccb;
1025                 ecb->timeout = ccb->ccb_h.timeout;
1026
1027                 if (ccb->ccb_h.func_code == XPT_RESET_DEV) {
1028                         ecb->flags |= ECB_RESET;
1029                         ecb->clen = 0;
1030                         ecb->dleft = 0;
1031                 } else {
1032                         csio = &ccb->csio;
1033                         if ((ccb->ccb_h.flags & CAM_CDB_POINTER) != 0)
1034                                 bcopy(csio->cdb_io.cdb_ptr, &ecb->cmd.cmd,
1035                                       csio->cdb_len);
1036                         else
1037                                 bcopy(csio->cdb_io.cdb_bytes, &ecb->cmd.cmd,
1038                                       csio->cdb_len);
1039                         ecb->clen = csio->cdb_len;
1040                         ecb->daddr = csio->data_ptr;
1041                         ecb->dleft = csio->dxfer_len;
1042                 }
1043                 ecb->stat = 0;
1044
1045                 TAILQ_INSERT_TAIL(&sc->ready_list, ecb, chain);
1046                 ecb->flags |= ECB_READY;
1047                 if (sc->sc_state == NCR_IDLE)
1048                         ncr53c9x_sched(sc);
1049
1050                 break;
1051         }
1052
1053         case XPT_SET_TRAN_SETTINGS:
1054         {
1055                 struct ccb_trans_settings *cts = &ccb->cts;
1056                 int target = ccb->ccb_h.target_id;
1057                 struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[target];
1058                 struct ccb_trans_settings_scsi *scsi =
1059                     &cts->proto_specific.scsi;
1060                 struct ccb_trans_settings_spi *spi =
1061                     &cts->xport_specific.spi;
1062
1063                 if ((scsi->valid & CTS_SCSI_VALID_TQ) != 0) {
1064                         if ((sc->sc_cfflags & (1<<((target & 7) + 16))) == 0 &&
1065                             (scsi->flags & CTS_SCSI_FLAGS_TAG_ENB)) {
1066                                 NCR_MISC(("%s: target %d: tagged queuing\n",
1067                                     device_get_nameunit(sc->sc_dev), target));
1068                                 ti->flags |= T_TAG;
1069                         } else
1070                                 ti->flags &= ~T_TAG;
1071                 }
1072
1073                 if ((spi->valid & CTS_SPI_VALID_BUS_WIDTH) != 0) {
1074                         if (spi->bus_width != 0) {
1075                                 NCR_MISC(("%s: target %d: wide negotiation\n",
1076                                     device_get_nameunit(sc->sc_dev), target));
1077                                 if (sc->sc_rev == NCR_VARIANT_FAS366) {
1078                                         ti->flags |= T_WIDE;
1079                                         ti->width = 1;
1080                                 }
1081                         } else {
1082                                 ti->flags &= ~T_WIDE;
1083                                 ti->width = 0;
1084                         }
1085                         ti->flags |= T_NEGOTIATE;
1086                 }
1087
1088                 if ((spi->valid & CTS_SPI_VALID_SYNC_RATE) != 0) {
1089                         NCR_MISC(("%s: target %d: sync period negotiation\n",
1090                             device_get_nameunit(sc->sc_dev), target));
1091                         ti->flags |= T_NEGOTIATE;
1092                         ti->period = spi->sync_period;
1093                 }
1094
1095                 if ((spi->valid & CTS_SPI_VALID_SYNC_OFFSET) != 0) {
1096                         NCR_MISC(("%s: target %d: sync offset negotiation\n",
1097                             device_get_nameunit(sc->sc_dev), target));
1098                         ti->flags |= T_NEGOTIATE;
1099                         ti->offset = spi->sync_offset;
1100                 }
1101
1102                 mtx_unlock(&sc->sc_lock);
1103                 ccb->ccb_h.status = CAM_REQ_CMP;
1104                 xpt_done(ccb);
1105                 return;
1106         }
1107
1108         default:
1109                 device_printf(sc->sc_dev, "Unhandled function code %d\n",
1110                        ccb->ccb_h.func_code);
1111                 ccb->ccb_h.status = CAM_PROVIDE_FAIL;
1112                 mtx_unlock(&sc->sc_lock);
1113                 xpt_done(ccb);
1114                 return;
1115         }
1116
1117         mtx_unlock(&sc->sc_lock);
1118 }
1119
1120 /*
1121  * Used when interrupt driven I/O is not allowed, e.g. during boot.
1122  */
1123 static void
1124 ncr53c9x_poll(struct cam_sim *sim)
1125 {
1126         struct ncr53c9x_softc *sc;
1127
1128         NCR_TRACE(("[ncr53c9x_poll] "));
1129         sc = cam_sim_softc(sim);
1130         if (NCRDMA_ISINTR(sc)) {
1131                 ncr53c9x_intr(sc);
1132         }
1133 }
1134
1135 /*
1136  * LOW LEVEL SCSI UTILITIES
1137  */
1138
1139 /*
1140  * Schedule a scsi operation.  This has now been pulled out of the interrupt
1141  * handler so that we may call it from ncr53c9x_scsipi_request and
1142  * ncr53c9x_done.  This may save us an unnecessary interrupt just to get
1143  * things going.  Should only be called when state == NCR_IDLE and at bio pl.
1144  */
1145 static void
1146 ncr53c9x_sched(struct ncr53c9x_softc *sc)
1147 {
1148         struct ncr53c9x_ecb *ecb;
1149         struct ncr53c9x_tinfo *ti;
1150         struct ncr53c9x_linfo *li;
1151         int lun;
1152         int tag;
1153
1154         NCR_TRACE(("[ncr53c9x_sched] "));
1155         if (sc->sc_state != NCR_IDLE)
1156                 panic("ncr53c9x_sched: not IDLE (state=%d)", sc->sc_state);
1157
1158         /*
1159          * Find first ecb in ready queue that is for a target/lunit
1160          * combinations that is not busy.
1161          */
1162         for (ecb = TAILQ_FIRST(&sc->ready_list); ecb != NULL;
1163             ecb = TAILQ_NEXT(ecb, chain)) {
1164                 ti = &sc->sc_tinfo[ecb->ccb->ccb_h.target_id];
1165                 lun = ecb->ccb->ccb_h.target_lun;
1166
1167                 /* Select type of tag for this command */
1168                 if ((ti->flags & (T_RSELECTOFF)) != 0)
1169                         tag = 0;
1170                 else if ((ti->flags & (T_TAG)) == 0)
1171                         tag = 0;
1172                 else if ((ecb->flags & ECB_SENSE) != 0)
1173                         tag = 0;
1174                 else if ((ecb->ccb->ccb_h.flags & CAM_TAG_ACTION_VALID) == 0)
1175                         tag = 0;
1176                 else if (ecb->ccb->csio.tag_action == CAM_TAG_ACTION_NONE)
1177                         tag = 0;
1178                 else
1179                         tag = ecb->ccb->csio.tag_action;
1180
1181                 li = TINFO_LUN(ti, lun);
1182                 if (li == NULL) {
1183                         /* Initialize LUN info and add to list. */
1184                         if ((li = malloc(sizeof(*li),
1185                             M_DEVBUF, M_NOWAIT|M_ZERO)) == NULL) {
1186                                 continue;
1187                         }
1188                         li->lun = lun;
1189
1190                         LIST_INSERT_HEAD(&ti->luns, li, link);
1191                         if (lun < NCR_NLUN)
1192                                 ti->lun[lun] = li;
1193                 }
1194                 li->last_used = time_second;
1195                 if (tag == 0) {
1196                         /* Try to issue this as an un-tagged command */
1197                         if (li->untagged == NULL)
1198                                 li->untagged = ecb;
1199                 }
1200                 if (li->untagged != NULL) {
1201                         tag = 0;
1202                         if ((li->busy != 1) && li->used == 0) {
1203                                 /* We need to issue this untagged command now */
1204                                 ecb = li->untagged;
1205                         } else {
1206                                 /* Not ready yet */
1207                                 continue;
1208                         }
1209                 }
1210                 ecb->tag[0] = tag;
1211                 if (tag != 0) {
1212                         li->queued[ecb->tag_id] = ecb;
1213                         ecb->tag[1] = ecb->tag_id;
1214                         li->used++;
1215                 }
1216                 if (li->untagged != NULL && (li->busy != 1)) {
1217                         li->busy = 1;
1218                         TAILQ_REMOVE(&sc->ready_list, ecb, chain);
1219                         ecb->flags &= ~ECB_READY;
1220                         sc->sc_nexus = ecb;
1221                         ncr53c9x_select(sc, ecb);
1222                         break;
1223                 }
1224                 if (li->untagged == NULL && tag != 0) {
1225                         TAILQ_REMOVE(&sc->ready_list, ecb, chain);
1226                         ecb->flags &= ~ECB_READY;
1227                         sc->sc_nexus = ecb;
1228                         ncr53c9x_select(sc, ecb);
1229                         break;
1230                 } else
1231                         NCR_TRACE(("%d:%d busy\n",
1232                             ecb->ccb->ccb_h.target_id,
1233                             ecb->ccb->ccb_h.target_lun));
1234         }
1235 }
1236
1237 static void
1238 ncr53c9x_sense(struct ncr53c9x_softc *sc, struct ncr53c9x_ecb *ecb)
1239 {
1240         union ccb *ccb = ecb->ccb;
1241         struct ncr53c9x_tinfo *ti;
1242         struct scsi_request_sense *ss = (void *)&ecb->cmd.cmd;
1243         struct ncr53c9x_linfo *li;
1244         int lun;
1245
1246         NCR_TRACE(("requesting sense "));
1247
1248         lun = ccb->ccb_h.target_lun;
1249         ti = &sc->sc_tinfo[ccb->ccb_h.target_id];
1250
1251         /* Next, setup a request sense command block */
1252         memset(ss, 0, sizeof(*ss));
1253         ss->opcode = REQUEST_SENSE;
1254         ss->byte2 = ccb->ccb_h.target_lun << SCSI_CMD_LUN_SHIFT;
1255         ss->length = sizeof(struct scsi_sense_data);
1256         ecb->clen = sizeof(*ss);
1257         ecb->daddr = (char *)&ecb->ccb->csio.sense_data;
1258         ecb->dleft = sizeof(struct scsi_sense_data);
1259         ecb->flags |= ECB_SENSE;
1260         ecb->timeout = NCR_SENSE_TIMEOUT;
1261         ti->senses++;
1262         li = TINFO_LUN(ti, lun);
1263         if (li->busy)
1264                 li->busy = 0;
1265         ncr53c9x_dequeue(sc, ecb);
1266         li->untagged = ecb; /* must be executed first to fix C/A */
1267         li->busy = 2;
1268         if (ecb == sc->sc_nexus) {
1269                 ncr53c9x_select(sc, ecb);
1270         } else {
1271                 TAILQ_INSERT_HEAD(&sc->ready_list, ecb, chain);
1272                 ecb->flags |= ECB_READY;
1273                 if (sc->sc_state == NCR_IDLE)
1274                         ncr53c9x_sched(sc);
1275         }
1276 }
1277
1278 /*
1279  * POST PROCESSING OF SCSI_CMD (usually current)
1280  */
1281 static void
1282 ncr53c9x_done(struct ncr53c9x_softc *sc, struct ncr53c9x_ecb *ecb)
1283 {
1284         union ccb *ccb = ecb->ccb;
1285         struct ncr53c9x_tinfo *ti;
1286         struct ncr53c9x_linfo *li;
1287         int lun;
1288
1289         NCR_TRACE(("[ncr53c9x_done(status:%x)] ", ccb->ccb_h.status));
1290
1291         ti = &sc->sc_tinfo[ccb->ccb_h.target_id];
1292         lun = ccb->ccb_h.target_lun;
1293         li  = TINFO_LUN(ti, lun);
1294
1295         untimeout(ncr53c9x_timeout, ecb, ccb->ccb_h.timeout_ch);
1296
1297         /*
1298          * Now, if we've come here with no error code, i.e. we've kept the
1299          * initial XS_NOERROR, and the status code signals that we should
1300          * check sense, we'll need to set up a request sense cmd block and
1301          * push the command back into the ready queue *before* any other
1302          * commands for this target/lunit, else we lose the sense info.
1303          * We don't support chk sense conditions for the request sense cmd.
1304          */
1305         if (ccb->ccb_h.status == CAM_REQ_CMP) {
1306                 if ((ecb->flags & ECB_ABORT) != 0) {
1307                         ccb->ccb_h.status = CAM_CMD_TIMEOUT;
1308                 } else if ((ecb->flags & ECB_SENSE) != 0 &&
1309                            (ecb->stat != SCSI_STATUS_CHECK_COND)) {
1310                         ccb->ccb_h.status = CAM_AUTOSNS_VALID;
1311                 } else if (ecb->stat == SCSI_STATUS_CHECK_COND) {
1312                         if ((ecb->flags & ECB_SENSE) != 0)
1313                                 ccb->ccb_h.status = CAM_AUTOSENSE_FAIL;
1314                         else {
1315                                 /* First, save the return values */
1316                                 ccb->csio.resid = ecb->dleft;
1317                                 ncr53c9x_sense(sc, ecb);
1318                                 return;
1319                         }
1320                 } else {
1321                         ccb->csio.resid = ecb->dleft;
1322                 }
1323 #if 0
1324                 if (xs->status == SCSI_QUEUE_FULL || xs->status == XS_BUSY)
1325                         xs->error = XS_BUSY;
1326 #endif
1327         }
1328
1329 #ifdef NCR53C9X_DEBUG
1330         if (ncr53c9x_debug & NCR_SHOWTRAC) {
1331                 if (ccb->csio.resid != 0)
1332                         printf("resid=%d ", ccb->csio.resid);
1333 #if 0
1334                 if (xs->error == XS_SENSE)
1335                         printf("sense=0x%02x\n",
1336                             xs->sense.scsi_sense.error_code);
1337                 else
1338                         printf("error=%d\n", xs->error);
1339 #endif
1340         }
1341 #endif
1342
1343         /*
1344          * Remove the ECB from whatever queue it's on.
1345          */
1346         ncr53c9x_dequeue(sc, ecb);
1347         if (ecb == sc->sc_nexus) {
1348                 sc->sc_nexus = NULL;
1349                 if (sc->sc_state != NCR_CLEANING) {
1350                         sc->sc_state = NCR_IDLE;
1351                         ncr53c9x_sched(sc);
1352                 }
1353         }
1354
1355         if (ccb->ccb_h.status == CAM_SEL_TIMEOUT) {
1356                 /* Selection timeout -- discard this LUN if empty */
1357                 if (li->untagged == NULL && li->used == 0) {
1358                         if (lun < NCR_NLUN)
1359                                 ti->lun[lun] = NULL;
1360                         LIST_REMOVE(li, link);
1361                         free(li, M_DEVBUF);
1362                 }
1363         }
1364
1365         ncr53c9x_free_ecb(sc, ecb);
1366         ti->cmds++;
1367         xpt_done(ccb);
1368 }
1369
1370 static void
1371 ncr53c9x_dequeue(struct ncr53c9x_softc *sc, struct ncr53c9x_ecb *ecb)
1372 {
1373         struct ncr53c9x_tinfo *ti;
1374         struct ncr53c9x_linfo *li;
1375         int64_t lun;
1376
1377         ti = &sc->sc_tinfo[ecb->ccb->ccb_h.target_id];
1378         lun = ecb->ccb->ccb_h.target_lun;
1379         li = TINFO_LUN(ti, lun);
1380 #ifdef DIAGNOSTIC
1381         if (li == NULL || li->lun != lun)
1382                 panic("ncr53c9x_dequeue: lun %qx for ecb %p does not exist",
1383                       (long long) lun, ecb);
1384 #endif
1385         if (li->untagged == ecb) {
1386                 li->busy = 0;
1387                 li->untagged = NULL;
1388         }
1389         if (ecb->tag[0] && li->queued[ecb->tag[1]] != NULL) {
1390 #ifdef DIAGNOSTIC
1391                 if (li->queued[ecb->tag[1]] != NULL &&
1392                     (li->queued[ecb->tag[1]] != ecb))
1393                         panic("ncr53c9x_dequeue: slot %d for lun %qx has %p "
1394                             "instead of ecb %p\n", ecb->tag[1],
1395                             (long long) lun,
1396                             li->queued[ecb->tag[1]], ecb);
1397 #endif
1398                 li->queued[ecb->tag[1]] = NULL;
1399                 li->used--;
1400         }
1401
1402         if ((ecb->flags & ECB_READY) != 0) {
1403                 ecb->flags &= ~ECB_READY;
1404                 TAILQ_REMOVE(&sc->ready_list, ecb, chain);
1405         }
1406 }
1407
1408 /*
1409  * INTERRUPT/PROTOCOL ENGINE
1410  */
1411
1412 /*
1413  * Schedule an outgoing message by prioritizing it, and asserting
1414  * attention on the bus. We can only do this when we are the initiator
1415  * else there will be an illegal command interrupt.
1416  */
1417 #define ncr53c9x_sched_msgout(m) \
1418         do {                                                    \
1419                 NCR_MSGS(("ncr53c9x_sched_msgout %x %d", m, __LINE__)); \
1420                 NCRCMD(sc, NCRCMD_SETATN);                      \
1421                 sc->sc_flags |= NCR_ATN;                        \
1422                 sc->sc_msgpriq |= (m);                          \
1423         } while (0)
1424
1425 static void
1426 ncr53c9x_flushfifo(struct ncr53c9x_softc *sc)
1427 {
1428         NCR_TRACE(("[flushfifo] "));
1429
1430         NCRCMD(sc, NCRCMD_FLUSH);
1431
1432         if (sc->sc_phase == COMMAND_PHASE ||
1433             sc->sc_phase == MESSAGE_OUT_PHASE)
1434                 DELAY(2);
1435 }
1436
1437 static int
1438 ncr53c9x_rdfifo(struct ncr53c9x_softc *sc, int how)
1439 {
1440         int i, n;
1441         u_char *buf;
1442
1443         switch(how) {
1444         case NCR_RDFIFO_START:
1445                 buf = sc->sc_imess;
1446                 sc->sc_imlen = 0;
1447                 break;
1448         case NCR_RDFIFO_CONTINUE:
1449                 buf = sc->sc_imess + sc->sc_imlen;
1450                 break;
1451         default:
1452                 panic("ncr53c9x_rdfifo: bad flag");
1453                 break;
1454         }
1455
1456         /*
1457          * XXX buffer (sc_imess) size for message
1458          */
1459
1460         n = NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF;
1461
1462         if (sc->sc_rev == NCR_VARIANT_FAS366) {
1463                 n *= 2;
1464
1465                 for (i = 0; i < n; i++)
1466                         buf[i] = NCR_READ_REG(sc, NCR_FIFO);
1467
1468                 if (sc->sc_espstat2 & NCRFAS_STAT2_ISHUTTLE) {
1469
1470                         NCR_WRITE_REG(sc, NCR_FIFO, 0);
1471                         buf[i++] = NCR_READ_REG(sc, NCR_FIFO);
1472
1473                         NCR_READ_REG(sc, NCR_FIFO);
1474
1475                         ncr53c9x_flushfifo(sc);
1476                 }
1477         } else {
1478                 for (i = 0; i < n; i++)
1479                         buf[i] = NCR_READ_REG(sc, NCR_FIFO);
1480         }
1481
1482         sc->sc_imlen += i;
1483
1484 #if 0
1485 #ifdef NCR53C9X_DEBUG
1486         {
1487                 int j;
1488
1489                 NCR_TRACE(("\n[rdfifo %s (%d):",
1490                     (how == NCR_RDFIFO_START) ? "start" : "cont",
1491                     (int)sc->sc_imlen));
1492                 if (ncr53c9x_debug & NCR_SHOWTRAC) {
1493                         for (j = 0; j < sc->sc_imlen; j++)
1494                                 printf(" %02x", sc->sc_imess[j]);
1495                         printf("]\n");
1496                 }
1497         }
1498 #endif
1499 #endif
1500         return sc->sc_imlen;
1501 }
1502
1503 static void
1504 ncr53c9x_wrfifo(struct ncr53c9x_softc *sc, u_char *p, int len)
1505 {
1506         int i;
1507
1508 #ifdef NCR53C9X_DEBUG
1509         NCR_MSGS(("[wrfifo(%d):", len));
1510         if (ncr53c9x_debug & NCR_SHOWMSGS) {
1511                 for (i = 0; i < len; i++)
1512                         printf(" %02x", p[i]);
1513                 printf("]\n");
1514         }
1515 #endif
1516
1517         for (i = 0; i < len; i++) {
1518                 NCR_WRITE_REG(sc, NCR_FIFO, p[i]);
1519
1520                 if (sc->sc_rev == NCR_VARIANT_FAS366)
1521                         NCR_WRITE_REG(sc, NCR_FIFO, 0);
1522         }
1523 }
1524
1525 static int
1526 ncr53c9x_reselect(struct ncr53c9x_softc *sc, int message, int tagtype,
1527                   int tagid)
1528 {
1529         u_char selid, target, lun;
1530         struct ncr53c9x_ecb *ecb = NULL;
1531         struct ncr53c9x_tinfo *ti;
1532         struct ncr53c9x_linfo *li;
1533
1534
1535         if (sc->sc_rev == NCR_VARIANT_FAS366) {
1536                 target = sc->sc_selid;
1537         } else {
1538                 /*
1539                  * The SCSI chip made a snapshot of the data bus
1540                  * while the reselection was being negotiated.
1541                  * This enables us to determine which target did
1542                  * the reselect.
1543                  */
1544                 selid = sc->sc_selid & ~(1 << sc->sc_id);
1545                 if (selid & (selid - 1)) {
1546                         device_printf(sc->sc_dev, "reselect with invalid "
1547                             "selid %02x; sending DEVICE RESET\n", selid);
1548                         goto reset;
1549                 }
1550
1551                 target = ffs(selid) - 1;
1552         }
1553         lun = message & 0x07;
1554
1555         /*
1556          * Search wait queue for disconnected cmd
1557          * The list should be short, so I haven't bothered with
1558          * any more sophisticated structures than a simple
1559          * singly linked list.
1560          */
1561         ti = &sc->sc_tinfo[target];
1562         li = TINFO_LUN(ti, lun);
1563
1564         /*
1565          * We can get as far as the LUN with the IDENTIFY
1566          * message.  Check to see if we're running an
1567          * un-tagged command.  Otherwise ack the IDENTIFY
1568          * and wait for a tag message.
1569          */
1570         if (li != NULL) {
1571                 if (li->untagged != NULL && li->busy)
1572                         ecb = li->untagged;
1573                 else if (tagtype != MSG_SIMPLE_Q_TAG) {
1574                         /* Wait for tag to come by */
1575                         sc->sc_state = NCR_IDENTIFIED;
1576                         return (0);
1577                 } else if (tagtype)
1578                         ecb = li->queued[tagid];
1579         }
1580         if (ecb == NULL) {
1581                 device_printf(sc->sc_dev, "reselect from target %d lun %d "
1582                     "tag %x:%x with no nexus; sending ABORT\n",
1583                     target, lun, tagtype, tagid);
1584                 goto abort;
1585         }
1586
1587         /* Make this nexus active again. */
1588         sc->sc_state = NCR_CONNECTED;
1589         sc->sc_nexus = ecb;
1590         ncr53c9x_setsync(sc, ti);
1591
1592         if (ecb->flags & ECB_RESET)
1593                 ncr53c9x_sched_msgout(SEND_DEV_RESET);
1594         else if (ecb->flags & ECB_ABORT)
1595                 ncr53c9x_sched_msgout(SEND_ABORT);
1596
1597         /* Do an implicit RESTORE POINTERS. */
1598         sc->sc_dp = ecb->daddr;
1599         sc->sc_dleft = ecb->dleft;
1600
1601         return (0);
1602
1603 reset:
1604         ncr53c9x_sched_msgout(SEND_DEV_RESET);
1605         return (1);
1606
1607 abort:
1608         ncr53c9x_sched_msgout(SEND_ABORT);
1609         return (1);
1610 }
1611
1612 /* From NetBSD.  These should go into CAM at some point */
1613 #define MSG_ISEXTENDED(m)       ((m) == MSG_EXTENDED)
1614 #define MSG_IS1BYTE(m) \
1615         ((!MSG_ISEXTENDED(m) && (m) < 0x20) || MSG_ISIDENTIFY(m))
1616 #define MSG_IS2BYTE(m)          (((m) & 0xf0) == 0x20)
1617
1618 static inline int
1619 __verify_msg_format(u_char *p, int len)
1620 {
1621
1622         if (len == 1 && MSG_IS1BYTE(p[0]))
1623                 return 1;
1624         if (len == 2 && MSG_IS2BYTE(p[0]))
1625                 return 1;
1626         if (len >= 3 && MSG_ISEXTENDED(p[0]) &&
1627             len == p[1] + 2)
1628                 return 1;
1629
1630         return 0;
1631 }
1632
1633 /*
1634  * Get an incoming message as initiator.
1635  *
1636  * The SCSI bus must already be in MESSAGE_IN_PHASE and there is a
1637  * byte in the FIFO
1638  */
1639 static void
1640 ncr53c9x_msgin(struct ncr53c9x_softc *sc)
1641 {
1642
1643         NCR_TRACE(("[ncr53c9x_msgin(curmsglen:%ld)] ", (long)sc->sc_imlen));
1644
1645         if (sc->sc_imlen == 0) {
1646                 device_printf(sc->sc_dev, "msgin: no msg byte available\n");
1647                 return;
1648         }
1649
1650         /*
1651          * Prepare for a new message.  A message should (according
1652          * to the SCSI standard) be transmitted in one single
1653          * MESSAGE_IN_PHASE. If we have been in some other phase,
1654          * then this is a new message.
1655          */
1656         if (sc->sc_prevphase != MESSAGE_IN_PHASE &&
1657             sc->sc_state != NCR_RESELECTED) {
1658                 device_printf(sc->sc_dev, "phase change, dropping message, "
1659                     "prev %d, state %d\n", sc->sc_prevphase, sc->sc_state);
1660                 sc->sc_flags &= ~NCR_DROP_MSGI;
1661                 sc->sc_imlen = 0;
1662         }
1663
1664         /*
1665          * If we're going to reject the message, don't bother storing
1666          * the incoming bytes.  But still, we need to ACK them.
1667          */
1668         if ((sc->sc_flags & NCR_DROP_MSGI) != 0) {
1669                 NCRCMD(sc, NCRCMD_MSGOK);
1670                 printf("<dropping msg byte %x>", sc->sc_imess[sc->sc_imlen]);
1671                 return;
1672         }
1673
1674         if (sc->sc_imlen >= NCR_MAX_MSG_LEN) {
1675                 ncr53c9x_sched_msgout(SEND_REJECT);
1676                 sc->sc_flags |= NCR_DROP_MSGI;
1677         } else {
1678                 u_char *pb;
1679                 int plen;
1680
1681                 switch (sc->sc_state) {
1682                 /*
1683                  * if received message is the first of reselection
1684                  * then first byte is selid, and then message
1685                  */
1686                 case NCR_RESELECTED:
1687                         pb = sc->sc_imess + 1;
1688                         plen = sc->sc_imlen - 1;
1689                         break;
1690                 default:
1691                         pb = sc->sc_imess;
1692                         plen = sc->sc_imlen;
1693                         break;
1694                 }
1695
1696                 if (__verify_msg_format(pb, plen))
1697                         goto gotit;
1698         }
1699
1700         /* Ack what we have so far */
1701         NCRCMD(sc, NCRCMD_MSGOK);
1702         return;
1703
1704 gotit:
1705         NCR_MSGS(("gotmsg(%x) state %d", sc->sc_imess[0], sc->sc_state));
1706         /* We got a complete message, flush the imess, */
1707         /* XXX nobody uses imlen below */
1708         sc->sc_imlen = 0;
1709         /*
1710          * Now we should have a complete message (1 byte, 2 byte
1711          * and moderately long extended messages).  We only handle
1712          * extended messages which total length is shorter than
1713          * NCR_MAX_MSG_LEN.  Longer messages will be amputated.
1714          */
1715         switch (sc->sc_state) {
1716                 struct ncr53c9x_ecb *ecb;
1717                 struct ncr53c9x_tinfo *ti;
1718                 struct ncr53c9x_linfo *li;
1719                 int lun;
1720
1721         case NCR_CONNECTED:
1722                 ecb = sc->sc_nexus;
1723                 ti = &sc->sc_tinfo[ecb->ccb->ccb_h.target_id];
1724
1725                 switch (sc->sc_imess[0]) {
1726                 case MSG_CMDCOMPLETE:
1727                         NCR_MSGS(("cmdcomplete "));
1728                         if (sc->sc_dleft < 0) {
1729                                 xpt_print_path(ecb->ccb->ccb_h.path);
1730                                 printf("got %ld extra bytes\n",
1731                                     -(long)sc->sc_dleft);
1732                                 sc->sc_dleft = 0;
1733                         }
1734                         ecb->dleft = (ecb->flags & ECB_TENTATIVE_DONE) ?
1735                             0 : sc->sc_dleft;
1736                         if ((ecb->flags & ECB_SENSE) == 0)
1737                                 ecb->ccb->csio.resid = ecb->dleft;
1738                         sc->sc_state = NCR_CMDCOMPLETE;
1739                         break;
1740
1741                 case MSG_MESSAGE_REJECT:
1742                         NCR_MSGS(("msg reject (msgout=%x) ", sc->sc_msgout));
1743                         switch (sc->sc_msgout) {
1744                         case SEND_TAG:
1745                                 /*
1746                                  * Target does not like tagged queuing.
1747                                  *  - Flush the command queue
1748                                  *  - Disable tagged queuing for the target
1749                                  *  - Dequeue ecb from the queued array.
1750                                  */
1751                                 device_printf(sc->sc_dev, "tagged queuing "
1752                                     "rejected: target %d\n",
1753                                     ecb->ccb->ccb_h.target_id);
1754
1755                                 NCR_MSGS(("(rejected sent tag)"));
1756                                 NCRCMD(sc, NCRCMD_FLUSH);
1757                                 DELAY(1);
1758                                 ti->flags &= ~T_TAG;
1759                                 lun = ecb->ccb->ccb_h.target_lun;
1760                                 li = TINFO_LUN(ti, lun);
1761                                 if (ecb->tag[0] &&
1762                                     li->queued[ecb->tag[1]] != NULL) {
1763                                         li->queued[ecb->tag[1]] = NULL;
1764                                         li->used--;
1765                                 }
1766                                 ecb->tag[0] = ecb->tag[1] = 0;
1767                                 li->untagged = ecb;
1768                                 li->busy = 1;
1769                                 break;
1770
1771                         case SEND_SDTR:
1772                                 device_printf(sc->sc_dev, "sync transfer "
1773                                     "rejected: target %d\n",
1774                                     ecb->ccb->ccb_h.target_id);
1775
1776                                 sc->sc_flags &= ~NCR_SYNCHNEGO;
1777                                 ti->flags &= ~(T_NEGOTIATE | T_SYNCMODE);
1778                                 ncr53c9x_setsync(sc, ti);
1779                                 break;
1780
1781                         case SEND_WDTR:
1782                                 device_printf(sc->sc_dev, "wide transfer "
1783                                     "rejected: target %d\n",
1784                                     ecb->ccb->ccb_h.target_id);
1785                                 ti->flags &= ~(T_WIDE | T_WDTRSENT);
1786                                 ti->width = 0;
1787                                 break;
1788
1789                         case SEND_INIT_DET_ERR:
1790                                 goto abort;
1791                         }
1792                         break;
1793
1794                 case MSG_NOOP:
1795                         NCR_MSGS(("noop "));
1796                         break;
1797
1798                 case MSG_HEAD_OF_Q_TAG:
1799                 case MSG_SIMPLE_Q_TAG:
1800                 case MSG_ORDERED_Q_TAG:
1801                         NCR_MSGS(("TAG %x:%x",
1802                             sc->sc_imess[0], sc->sc_imess[1]));
1803                         break;
1804
1805                 case MSG_DISCONNECT:
1806                         NCR_MSGS(("disconnect "));
1807                         ti->dconns++;
1808                         sc->sc_state = NCR_DISCONNECT;
1809
1810                         /*
1811                          * Mark the fact that all bytes have moved. The
1812                          * target may not bother to do a SAVE POINTERS
1813                          * at this stage. This flag will set the residual
1814                          * count to zero on MSG COMPLETE.
1815                          */
1816                         if (sc->sc_dleft == 0)
1817                                 ecb->flags |= ECB_TENTATIVE_DONE;
1818
1819                         break;
1820
1821                 case MSG_SAVEDATAPOINTER:
1822                         NCR_MSGS(("save datapointer "));
1823                         ecb->daddr = sc->sc_dp;
1824                         ecb->dleft = sc->sc_dleft;
1825                         break;
1826
1827                 case MSG_RESTOREPOINTERS:
1828                         NCR_MSGS(("restore datapointer "));
1829                         sc->sc_dp = ecb->daddr;
1830                         sc->sc_dleft = ecb->dleft;
1831                         break;
1832
1833                 case MSG_EXTENDED:
1834                         NCR_MSGS(("extended(%x) ", sc->sc_imess[2]));
1835                         switch (sc->sc_imess[2]) {
1836                         case MSG_EXT_SDTR:
1837                                 NCR_MSGS(("SDTR period %d, offset %d ",
1838                                     sc->sc_imess[3], sc->sc_imess[4]));
1839                                 if (sc->sc_imess[1] != 3)
1840                                         goto reject;
1841                                 ti->period = sc->sc_imess[3];
1842                                 ti->offset = sc->sc_imess[4];
1843                                 ti->flags &= ~T_NEGOTIATE;
1844                                 if (sc->sc_minsync == 0 ||
1845                                     ti->offset == 0 ||
1846                                     ti->period > 124) {
1847 #if 0
1848 #ifdef NCR53C9X_DEBUG
1849                                         xpt_print_path(ecb->ccb->ccb_h.path);
1850                                         printf("async mode\n");
1851 #endif
1852 #endif
1853                                         ti->flags &= ~T_SYNCMODE;
1854                                         if ((sc->sc_flags&NCR_SYNCHNEGO) == 0) {
1855                                                 /*
1856                                                  * target initiated negotiation
1857                                                  */
1858                                                 ti->offset = 0;
1859                                                 ncr53c9x_sched_msgout(
1860                                                     SEND_SDTR);
1861                                         }
1862                                 } else {
1863                                         int p;
1864
1865                                         p = ncr53c9x_stp2cpb(sc, ti->period);
1866                                         ti->period = ncr53c9x_cpb2stp(sc, p);
1867                                         if ((sc->sc_flags&NCR_SYNCHNEGO) == 0) {
1868                                                 /*
1869                                                  * target initiated negotiation
1870                                                  */
1871                                                 if (ti->period < sc->sc_minsync)
1872                                                         ti->period =
1873                                                             sc->sc_minsync;
1874                                                 if (ti->offset > 15)
1875                                                         ti->offset = 15;
1876                                                 ti->flags &= ~T_SYNCMODE;
1877                                                 ncr53c9x_sched_msgout(
1878                                                     SEND_SDTR);
1879                                         } else {
1880                                                 /* we are sync */
1881                                                 ti->flags |= T_SYNCMODE;
1882                                         }
1883                                 }
1884                                 sc->sc_flags &= ~NCR_SYNCHNEGO;
1885                                 ncr53c9x_setsync(sc, ti);
1886                                 break;
1887
1888                         case MSG_EXT_WDTR:
1889 #ifdef NCR53C9X_DEBUG
1890                                 device_printf(sc->sc_dev, "wide mode %d\n",
1891                                     sc->sc_imess[3]);
1892 #endif
1893                                 if (sc->sc_imess[3] == 1) {
1894                                         ti->cfg3 |= NCRFASCFG3_EWIDE;
1895                                         ncr53c9x_setsync(sc, ti);
1896                                 } else
1897                                         ti->width = 0;
1898                                 /*
1899                                  * Device started width negotiation.
1900                                  */
1901                                 if (!(ti->flags & T_WDTRSENT))
1902                                         ncr53c9x_sched_msgout(SEND_WDTR);
1903                                 ti->flags &= ~(T_WIDE | T_WDTRSENT);
1904                                 break;
1905                         default:
1906                                 xpt_print_path(ecb->ccb->ccb_h.path);
1907                                 printf("unrecognized MESSAGE EXTENDED;"
1908                                     " sending REJECT\n");
1909                                 goto reject;
1910                         }
1911                         break;
1912
1913                 default:
1914                         NCR_MSGS(("ident "));
1915                         xpt_print_path(ecb->ccb->ccb_h.path);
1916                         printf("unrecognized MESSAGE; sending REJECT\n");
1917                 reject:
1918                         ncr53c9x_sched_msgout(SEND_REJECT);
1919                         break;
1920                 }
1921                 break;
1922
1923         case NCR_IDENTIFIED:
1924                 /*
1925                  * IDENTIFY message was received and queue tag is expected now
1926                  */
1927                 if ((sc->sc_imess[0] != MSG_SIMPLE_Q_TAG) ||
1928                     (sc->sc_msgify == 0)) {
1929                         device_printf(sc->sc_dev, "TAG reselect without "
1930                             "IDENTIFY; MSG %x; sending DEVICE RESET\n",
1931                              sc->sc_imess[0]);
1932                         goto reset;
1933                 }
1934                 (void) ncr53c9x_reselect(sc, sc->sc_msgify,
1935                     sc->sc_imess[0], sc->sc_imess[1]);
1936                 break;
1937
1938         case NCR_RESELECTED:
1939                 if (MSG_ISIDENTIFY(sc->sc_imess[1])) {
1940                         sc->sc_msgify = sc->sc_imess[1];
1941                 } else {
1942                         device_printf(sc->sc_dev, "reselect without IDENTIFY;"
1943                             " MSG %x; sending DEVICE RESET\n", sc->sc_imess[1]);
1944                         goto reset;
1945                 }
1946                 (void) ncr53c9x_reselect(sc, sc->sc_msgify, 0, 0);
1947                 break;
1948
1949         default:
1950                 device_printf(sc->sc_dev, "unexpected MESSAGE IN; "
1951                     "sending DEVICE RESET\n");
1952         reset:
1953                 ncr53c9x_sched_msgout(SEND_DEV_RESET);
1954                 break;
1955
1956         abort:
1957                 ncr53c9x_sched_msgout(SEND_ABORT);
1958                 break;
1959         }
1960
1961         /* if we have more messages to send set ATN */
1962         if (sc->sc_msgpriq)
1963                 NCRCMD(sc, NCRCMD_SETATN);
1964
1965         /* Ack last message byte */
1966         NCRCMD(sc, NCRCMD_MSGOK);
1967
1968         /* Done, reset message pointer. */
1969         sc->sc_flags &= ~NCR_DROP_MSGI;
1970         sc->sc_imlen = 0;
1971 }
1972
1973
1974 /*
1975  * Send the highest priority, scheduled message
1976  */
1977 static void
1978 ncr53c9x_msgout(struct ncr53c9x_softc *sc)
1979 {
1980         struct ncr53c9x_tinfo *ti;
1981         struct ncr53c9x_ecb *ecb;
1982         size_t size;
1983
1984         NCR_TRACE(("[ncr53c9x_msgout(priq:%x, prevphase:%x)]",
1985             sc->sc_msgpriq, sc->sc_prevphase));
1986
1987         /*
1988          * XXX - the NCR_ATN flag is not in sync with the actual ATN
1989          *       condition on the SCSI bus. The 53c9x chip
1990          *       automatically turns off ATN before sending the
1991          *       message byte.  (See also the comment below in the
1992          *       default case when picking out a message to send.)
1993          */
1994         if (sc->sc_flags & NCR_ATN) {
1995                 if (sc->sc_prevphase != MESSAGE_OUT_PHASE) {
1996                 new:
1997                         NCRCMD(sc, NCRCMD_FLUSH);
1998 /*                      DELAY(1); */
1999                         sc->sc_msgoutq = 0;
2000                         sc->sc_omlen = 0;
2001                 }
2002         } else {
2003                 if (sc->sc_prevphase == MESSAGE_OUT_PHASE) {
2004                         ncr53c9x_sched_msgout(sc->sc_msgoutq);
2005                         goto new;
2006                 } else {
2007                         device_printf(sc->sc_dev, "at line %d: unexpected "
2008                             "MESSAGE OUT phase\n", __LINE__);
2009                 }
2010         }
2011
2012         if (sc->sc_omlen == 0) {
2013                 /* Pick up highest priority message */
2014                 sc->sc_msgout = sc->sc_msgpriq & -sc->sc_msgpriq;
2015                 sc->sc_msgoutq |= sc->sc_msgout;
2016                 sc->sc_msgpriq &= ~sc->sc_msgout;
2017                 sc->sc_omlen = 1;               /* "Default" message len */
2018                 switch (sc->sc_msgout) {
2019                 case SEND_SDTR:
2020                         ecb = sc->sc_nexus;
2021                         ti = &sc->sc_tinfo[ecb->ccb->ccb_h.target_id];
2022                         sc->sc_omess[0] = MSG_EXTENDED;
2023                         sc->sc_omess[1] = MSG_EXT_SDTR_LEN;
2024                         sc->sc_omess[2] = MSG_EXT_SDTR;
2025                         sc->sc_omess[3] = ti->period;
2026                         sc->sc_omess[4] = ti->offset;
2027                         sc->sc_omlen = 5;
2028                         if ((sc->sc_flags & NCR_SYNCHNEGO) == 0) {
2029                                 ti->flags |= T_SYNCMODE;
2030                                 ncr53c9x_setsync(sc, ti);
2031                         }
2032                         break;
2033                 case SEND_WDTR:
2034                         ecb = sc->sc_nexus;
2035                         ti = &sc->sc_tinfo[ecb->ccb->ccb_h.target_id];
2036                         sc->sc_omess[0] = MSG_EXTENDED;
2037                         sc->sc_omess[1] = MSG_EXT_WDTR_LEN;
2038                         sc->sc_omess[2] = MSG_EXT_WDTR;
2039                         sc->sc_omess[3] = ti->width;
2040                         sc->sc_omlen = 4;
2041                         break;
2042                 case SEND_IDENTIFY:
2043                         if (sc->sc_state != NCR_CONNECTED) {
2044                                 device_printf(sc->sc_dev, "at line %d: no "
2045                                     "nexus\n", __LINE__);
2046                         }
2047                         ecb = sc->sc_nexus;
2048                         sc->sc_omess[0] =
2049                             MSG_IDENTIFY(ecb->ccb->ccb_h.target_lun, 0);
2050                         break;
2051                 case SEND_TAG:
2052                         if (sc->sc_state != NCR_CONNECTED) {
2053                                 device_printf(sc->sc_dev, "at line %d: no "
2054                                     "nexus\n", __LINE__);
2055                         }
2056                         ecb = sc->sc_nexus;
2057                         sc->sc_omess[0] = ecb->tag[0];
2058                         sc->sc_omess[1] = ecb->tag[1];
2059                         sc->sc_omlen = 2;
2060                         break;
2061                 case SEND_DEV_RESET:
2062                         sc->sc_flags |= NCR_ABORTING;
2063                         sc->sc_omess[0] = MSG_BUS_DEV_RESET;
2064                         ecb = sc->sc_nexus;
2065                         ti = &sc->sc_tinfo[ecb->ccb->ccb_h.target_id];
2066                         ti->flags &= ~T_SYNCMODE;
2067                         if ((ti->flags & T_SYNCHOFF) == 0)
2068                                 /* We can re-start sync negotiation */
2069                                 ti->flags |= T_NEGOTIATE;
2070                         break;
2071                 case SEND_PARITY_ERROR:
2072                         sc->sc_omess[0] = MSG_PARITY_ERROR;
2073                         break;
2074                 case SEND_ABORT:
2075                         sc->sc_flags |= NCR_ABORTING;
2076                         sc->sc_omess[0] = MSG_ABORT;
2077                         break;
2078                 case SEND_INIT_DET_ERR:
2079                         sc->sc_omess[0] = MSG_INITIATOR_DET_ERR;
2080                         break;
2081                 case SEND_REJECT:
2082                         sc->sc_omess[0] = MSG_MESSAGE_REJECT;
2083                         break;
2084                 default:
2085                         /*
2086                          * We normally do not get here, since the chip
2087                          * automatically turns off ATN before the last
2088                          * byte of a message is sent to the target.
2089                          * However, if the target rejects our (multi-byte)
2090                          * message early by switching to MSG IN phase
2091                          * ATN remains on, so the target may return to
2092                          * MSG OUT phase. If there are no scheduled messages
2093                          * left we send a NO-OP.
2094                          *
2095                          * XXX - Note that this leaves no useful purpose for
2096                          * the NCR_ATN flag.
2097                          */
2098                         sc->sc_flags &= ~NCR_ATN;
2099                         sc->sc_omess[0] = MSG_NOOP;
2100                         break;
2101                 }
2102                 sc->sc_omp = sc->sc_omess;
2103         }
2104
2105 #ifdef DEBUG
2106         if (ncr53c9x_debug & NCR_SHOWMSGS) {
2107                 int i;
2108
2109                 NCR_MSGS(("<msgout:"));
2110                 for (i = 0; i < sc->sc_omlen; i++)
2111                         NCR_MSGS((" %02x", sc->sc_omess[i]));
2112                 NCR_MSGS(("> "));
2113         }
2114 #endif
2115         if (sc->sc_rev == NCR_VARIANT_FAS366) {
2116                 /*
2117                  * XXX fifo size
2118                  */
2119                 ncr53c9x_flushfifo(sc);
2120                 ncr53c9x_wrfifo(sc, sc->sc_omp, sc->sc_omlen);
2121                 NCRCMD(sc, NCRCMD_TRANS);
2122         } else {
2123                 /* (re)send the message */
2124                 size = min(sc->sc_omlen, sc->sc_maxxfer);
2125                 NCRDMA_SETUP(sc, &sc->sc_omp, &sc->sc_omlen, 0, &size);
2126                 /* Program the SCSI counter */
2127                 NCR_SET_COUNT(sc, size);
2128
2129                 /* Load the count in and start the message-out transfer */
2130                 NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA);
2131                 NCRCMD(sc, NCRCMD_TRANS|NCRCMD_DMA);
2132                 NCRDMA_GO(sc);
2133         }
2134 }
2135
2136 /*
2137  * This is the most critical part of the driver, and has to know
2138  * how to deal with *all* error conditions and phases from the SCSI
2139  * bus. If there are no errors and the DMA was active, then call the
2140  * DMA pseudo-interrupt handler. If this returns 1, then that was it
2141  * and we can return from here without further processing.
2142  *
2143  * Most of this needs verifying.
2144  */
2145 void
2146 ncr53c9x_intr(void *arg)
2147 {
2148         struct ncr53c9x_softc *sc = arg;
2149         struct ncr53c9x_ecb *ecb;
2150         struct ncr53c9x_tinfo *ti;
2151         size_t size;
2152         int nfifo;
2153
2154         NCR_INTS(("[ncr53c9x_intr: state %d]", sc->sc_state));
2155
2156         if (!NCRDMA_ISINTR(sc))
2157                 return;
2158
2159         mtx_lock(&sc->sc_lock);
2160 again:
2161         /* and what do the registers say... */
2162         ncr53c9x_readregs(sc);
2163
2164         /*
2165          * At the moment, only a SCSI Bus Reset or Illegal
2166          * Command are classed as errors. A disconnect is a
2167          * valid condition, and we let the code check is the
2168          * "NCR_BUSFREE_OK" flag was set before declaring it
2169          * and error.
2170          *
2171          * Also, the status register tells us about "Gross
2172          * Errors" and "Parity errors". Only the Gross Error
2173          * is really bad, and the parity errors are dealt
2174          * with later
2175          *
2176          * TODO
2177          *      If there are too many parity error, go to slow
2178          *      cable mode ?
2179          */
2180
2181         /* SCSI Reset */
2182         if ((sc->sc_espintr & NCRINTR_SBR) != 0) {
2183                 if ((NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) != 0) {
2184                         NCRCMD(sc, NCRCMD_FLUSH);
2185                         DELAY(1);
2186                 }
2187                 if (sc->sc_state != NCR_SBR) {
2188                         device_printf(sc->sc_dev, "SCSI bus reset\n");
2189                         ncr53c9x_init(sc, 0); /* Restart everything */
2190                         goto out;
2191                 }
2192 #if 0
2193 /*XXX*/         printf("<expected bus reset: "
2194                     "[intr %x, stat %x, step %d]>\n",
2195                     sc->sc_espintr, sc->sc_espstat, sc->sc_espstep);
2196 #endif
2197                 if (sc->sc_nexus != NULL)
2198                         panic("%s: nexus in reset state",
2199                             device_get_nameunit(sc->sc_dev));
2200                 goto sched;
2201         }
2202
2203         ecb = sc->sc_nexus;
2204
2205 #define NCRINTR_ERR (NCRINTR_SBR|NCRINTR_ILL)
2206         if (sc->sc_espintr & NCRINTR_ERR ||
2207             sc->sc_espstat & NCRSTAT_GE) {
2208
2209                 if ((sc->sc_espstat & NCRSTAT_GE) != 0) {
2210                         /* Gross Error; no target ? */
2211                         if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
2212                                 NCRCMD(sc, NCRCMD_FLUSH);
2213                                 DELAY(1);
2214                         }
2215                         if (sc->sc_state == NCR_CONNECTED ||
2216                             sc->sc_state == NCR_SELECTING) {
2217                                 ecb->ccb->ccb_h.status = CAM_SEL_TIMEOUT;
2218                                 ncr53c9x_done(sc, ecb);
2219                         }
2220                         goto out;
2221                 }
2222
2223                 if ((sc->sc_espintr & NCRINTR_ILL) != 0) {
2224                         if ((sc->sc_flags & NCR_EXPECT_ILLCMD) != 0) {
2225                                 /*
2226                                  * Eat away "Illegal command" interrupt
2227                                  * on a ESP100 caused by a re-selection
2228                                  * while we were trying to select
2229                                  * another target.
2230                                  */
2231 #ifdef DEBUG
2232                                 device_printf(sc->sc_dev, "ESP100 work-around "
2233                                     "activated\n");
2234 #endif
2235                                 sc->sc_flags &= ~NCR_EXPECT_ILLCMD;
2236                                 goto out;
2237                         }
2238                         /* illegal command, out of sync ? */
2239                         device_printf(sc->sc_dev, "illegal command: 0x%x "
2240                             "(state %d, phase %x, prevphase %x)\n",
2241                             sc->sc_lastcmd,
2242                             sc->sc_state, sc->sc_phase, sc->sc_prevphase);
2243                         if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
2244                                 NCRCMD(sc, NCRCMD_FLUSH);
2245                                 DELAY(1);
2246                         }
2247                         ncr53c9x_init(sc, 1); /* Restart everything */
2248                         goto out;
2249                 }
2250         }
2251         sc->sc_flags &= ~NCR_EXPECT_ILLCMD;
2252
2253         /*
2254          * Call if DMA is active.
2255          *
2256          * If DMA_INTR returns true, then maybe go 'round the loop
2257          * again in case there is no more DMA queued, but a phase
2258          * change is expected.
2259          */
2260         if (NCRDMA_ISACTIVE(sc)) {
2261                 int r = NCRDMA_INTR(sc);
2262                 if (r == -1) {
2263                         device_printf(sc->sc_dev, "DMA error; resetting\n");
2264                         ncr53c9x_init(sc, 1);
2265                         goto out;
2266                 }
2267                 /* If DMA active here, then go back to work... */
2268                 if (NCRDMA_ISACTIVE(sc))
2269                         goto out;
2270
2271                 if ((sc->sc_espstat & NCRSTAT_TC) == 0) {
2272                         /*
2273                          * DMA not completed.  If we can not find a
2274                          * acceptable explanation, print a diagnostic.
2275                          */
2276                         if (sc->sc_state == NCR_SELECTING)
2277                                 /*
2278                                  * This can happen if we are reselected
2279                                  * while using DMA to select a target.
2280                                  */
2281                                 /*void*/;
2282                         else if (sc->sc_prevphase == MESSAGE_OUT_PHASE) {
2283                                 /*
2284                                  * Our (multi-byte) message (eg SDTR) was
2285                                  * interrupted by the target to send
2286                                  * a MSG REJECT.
2287                                  * Print diagnostic if current phase
2288                                  * is not MESSAGE IN.
2289                                  */
2290                                 if (sc->sc_phase != MESSAGE_IN_PHASE)
2291                                         device_printf(sc->sc_dev,"!TC on MSGOUT"
2292                                             " [intr %x, stat %x, step %d]"
2293                                             " prevphase %x, resid %lx\n",
2294                                             sc->sc_espintr,
2295                                             sc->sc_espstat,
2296                                             sc->sc_espstep,
2297                                             sc->sc_prevphase,
2298                                             (u_long)sc->sc_omlen);
2299                         } else if (sc->sc_dleft == 0) {
2300                                 /*
2301                                  * The DMA operation was started for
2302                                  * a DATA transfer. Print a diagnostic
2303                                  * if the DMA counter and TC bit
2304                                  * appear to be out of sync.
2305                                  *
2306                                  * XXX This is fatal and usually means that
2307                                  *     the DMA engine is hopelessly out of
2308                                  *     sync with reality.  A disk is likely
2309                                  *     getting spammed at this point.
2310                                  */
2311                                 device_printf(sc->sc_dev, "!TC on DATA XFER"
2312                                     " [intr %x, stat %x, step %d]"
2313                                     " prevphase %x, resid %x\n",
2314                                     sc->sc_espintr,
2315                                     sc->sc_espstat,
2316                                     sc->sc_espstep,
2317                                     sc->sc_prevphase,
2318                                     ecb ? ecb->dleft : -1);
2319                                 panic("esp: unrecoverable DMA error");
2320                         }
2321                 }
2322         }
2323
2324         /*
2325          * Check for less serious errors.
2326          */
2327         if ((sc->sc_espstat & NCRSTAT_PE) != 0) {
2328                 device_printf(sc->sc_dev, "SCSI bus parity error\n");
2329                 if (sc->sc_prevphase == MESSAGE_IN_PHASE)
2330                         ncr53c9x_sched_msgout(SEND_PARITY_ERROR);
2331                 else
2332                         ncr53c9x_sched_msgout(SEND_INIT_DET_ERR);
2333         }
2334
2335         if ((sc->sc_espintr & NCRINTR_DIS) != 0) {
2336                 sc->sc_msgify = 0;
2337                 NCR_INTS(("<DISC [intr %x, stat %x, step %d]>",
2338                     sc->sc_espintr,sc->sc_espstat,sc->sc_espstep));
2339                 if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
2340                         NCRCMD(sc, NCRCMD_FLUSH);
2341 /*                      DELAY(1); */
2342                 }
2343                 /*
2344                  * This command must (apparently) be issued within
2345                  * 250mS of a disconnect. So here you are...
2346                  */
2347                 NCRCMD(sc, NCRCMD_ENSEL);
2348
2349                 switch (sc->sc_state) {
2350                 case NCR_RESELECTED:
2351                         goto sched;
2352
2353                 case NCR_SELECTING:
2354                 {
2355                         struct ncr53c9x_linfo *li;
2356
2357                         ecb->ccb->ccb_h.status = CAM_SEL_TIMEOUT;
2358
2359                         /* Selection timeout -- discard all LUNs if empty */
2360                         ti = &sc->sc_tinfo[ecb->ccb->ccb_h.target_id];
2361                         li = LIST_FIRST(&ti->luns);
2362                         while (li != NULL) {
2363                                 if (li->untagged == NULL && li->used == 0) {
2364                                         if (li->lun < NCR_NLUN)
2365                                                 ti->lun[li->lun] = NULL;
2366                                         LIST_REMOVE(li, link);
2367                                         free(li, M_DEVBUF);
2368                                         /*
2369                                          * Restart the search at the beginning
2370                                          */
2371                                         li = LIST_FIRST(&ti->luns);
2372                                         continue;
2373                                 }
2374                                 li = LIST_NEXT(li, link);
2375                         }
2376                         goto finish;
2377                 }
2378                 case NCR_CONNECTED:
2379                         if ((sc->sc_flags & NCR_SYNCHNEGO) != 0) {
2380 #ifdef NCR53C9X_DEBUG
2381                                 if (ecb != NULL)
2382                                         xpt_print_path(ecb->ccb->ccb_h.path);
2383                                 printf("sync nego not completed!\n");
2384 #endif
2385                                 ti = &sc->sc_tinfo[ecb->ccb->ccb_h.target_id];
2386                                 sc->sc_flags &= ~NCR_SYNCHNEGO;
2387                                 ti->flags &= ~(T_NEGOTIATE | T_SYNCMODE);
2388                         }
2389
2390                         /* it may be OK to disconnect */
2391                         if ((sc->sc_flags & NCR_ABORTING) == 0) {
2392                                 /*
2393                                  * Section 5.1.1 of the SCSI 2 spec
2394                                  * suggests issuing a REQUEST SENSE
2395                                  * following an unexpected disconnect.
2396                                  * Some devices go into a contingent
2397                                  * allegiance condition when
2398                                  * disconnecting, and this is necessary
2399                                  * to clean up their state.
2400                                  */
2401                                 device_printf(sc->sc_dev, "unexpected "
2402                                     "disconnect [state %d, intr %x, stat %x, "
2403                                     "phase(c %x, p %x)]; ", sc->sc_state,
2404                                     sc->sc_espintr, sc->sc_espstat,
2405                                     sc->sc_phase, sc->sc_prevphase);
2406
2407                                 /*
2408                                  * XXX This will cause a chip reset and will
2409                                  *     prevent us from finding out the real
2410                                  *     problem with the device.  However, it's
2411                                  *     neccessary until a way can be found to
2412                                  *     safely cancel the DMA that is in
2413                                  *     progress.
2414                                  */
2415                                 if (1 || (ecb->flags & ECB_SENSE) != 0) {
2416                                         printf("resetting\n");
2417                                         goto reset;
2418                                 }
2419                                 printf("sending REQUEST SENSE\n");
2420                                 untimeout(ncr53c9x_timeout, ecb,
2421                                           ecb->ccb->ccb_h.timeout_ch);
2422                                 ncr53c9x_sense(sc, ecb);
2423                                 goto out;
2424                         }
2425
2426                         ecb->ccb->ccb_h.status = CAM_CMD_TIMEOUT;
2427                         goto finish;
2428
2429                 case NCR_DISCONNECT:
2430                         sc->sc_nexus = NULL;
2431                         goto sched;
2432
2433                 case NCR_CMDCOMPLETE:
2434                         ecb->ccb->ccb_h.status = CAM_REQ_CMP;
2435                         goto finish;
2436                 }
2437         }
2438
2439         switch (sc->sc_state) {
2440
2441         case NCR_SBR:
2442                 device_printf(sc->sc_dev, "waiting for Bus Reset to happen\n");
2443                 goto out;
2444
2445         case NCR_RESELECTED:
2446                 /*
2447                  * we must be continuing a message ?
2448                  */
2449                 device_printf(sc->sc_dev, "unhandled reselect continuation, "
2450                         "state %d, intr %02x\n", sc->sc_state, sc->sc_espintr);
2451                 ncr53c9x_init(sc, 1);
2452                 goto out;
2453                 break;
2454
2455         case NCR_IDENTIFIED:
2456                 ecb = sc->sc_nexus;
2457                 if (sc->sc_phase != MESSAGE_IN_PHASE) {
2458                         int i = (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF);
2459                         /*
2460                          * Things are seriously screwed up.
2461                          * Pull the brakes, i.e. reset
2462                          */
2463                         device_printf(sc->sc_dev, "target didn't send tag: %d "
2464                             "bytes in fifo\n", i);
2465                         /* Drain and display fifo */
2466                         while (i-- > 0)
2467                                 printf("[%d] ", NCR_READ_REG(sc, NCR_FIFO));
2468
2469                         ncr53c9x_init(sc, 1);
2470                         goto out;
2471                 } else
2472                         goto msgin;
2473
2474         case NCR_IDLE:
2475         case NCR_SELECTING:
2476                 ecb = sc->sc_nexus;
2477                 if (sc->sc_espintr & NCRINTR_RESEL) {
2478                         sc->sc_msgpriq = sc->sc_msgout = sc->sc_msgoutq = 0;
2479                         sc->sc_flags = 0;
2480                         /*
2481                          * If we're trying to select a
2482                          * target ourselves, push our command
2483                          * back into the ready list.
2484                          */
2485                         if (sc->sc_state == NCR_SELECTING) {
2486                                 NCR_INTS(("backoff selector "));
2487                                 untimeout(ncr53c9x_timeout, ecb,
2488                                           ecb->ccb->ccb_h.timeout_ch);
2489                                 ncr53c9x_dequeue(sc, ecb);
2490                                 TAILQ_INSERT_HEAD(&sc->ready_list, ecb, chain);
2491                                 ecb->flags |= ECB_READY;
2492                                 ecb = sc->sc_nexus = NULL;
2493                         }
2494                         sc->sc_state = NCR_RESELECTED;
2495                         if (sc->sc_phase != MESSAGE_IN_PHASE) {
2496                                 /*
2497                                  * Things are seriously screwed up.
2498                                  * Pull the brakes, i.e. reset
2499                                  */
2500                                 device_printf(sc->sc_dev, "target didn't "
2501                                     "identify\n");
2502                                 ncr53c9x_init(sc, 1);
2503                                 goto out;
2504                         }
2505                         /*
2506                          * The C90 only inhibits FIFO writes until reselection
2507                          * is complete instead of waiting until the interrupt
2508                          * status register has been read.  So, if the reselect
2509                          * happens while we were entering command bytes (for
2510                          * another target) some of those bytes can appear in
2511                          * the FIFO here, after the interrupt is taken.
2512                          *
2513                          * To remedy this situation, pull the Selection ID
2514                          * and Identify message from the FIFO directly, and
2515                          * ignore any extraneous fifo contents. Also, set
2516                          * a flag that allows one Illegal Command Interrupt
2517                          * to occur which the chip also generates as a result
2518                          * of writing to the FIFO during a reselect.
2519                          */
2520                         if (sc->sc_rev == NCR_VARIANT_ESP100) {
2521                                 nfifo = NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF;
2522                                 sc->sc_imess[0] = NCR_READ_REG(sc, NCR_FIFO);
2523                                 sc->sc_imess[1] = NCR_READ_REG(sc, NCR_FIFO);
2524                                 sc->sc_imlen = 2;
2525                                 if (nfifo != 2) {
2526                                         /* Flush the rest */
2527                                         NCRCMD(sc, NCRCMD_FLUSH);
2528                                 }
2529                                 sc->sc_flags |= NCR_EXPECT_ILLCMD;
2530                                 if (nfifo > 2)
2531                                         nfifo = 2; /* We fixed it.. */
2532                         } else
2533                                 nfifo = ncr53c9x_rdfifo(sc, NCR_RDFIFO_START);
2534
2535                         if (nfifo != 2) {
2536                                 device_printf(sc->sc_dev, "RESELECT: %d bytes "
2537                                     "in FIFO! [intr %x, stat %x, step %d, "
2538                                     "prevphase %x]\n",
2539                                     nfifo,
2540                                     sc->sc_espintr,
2541                                     sc->sc_espstat,
2542                                     sc->sc_espstep,
2543                                     sc->sc_prevphase);
2544                                 ncr53c9x_init(sc, 1);
2545                                 goto out;
2546                         }
2547                         sc->sc_selid = sc->sc_imess[0];
2548                         NCR_INTS(("selid=%02x ", sc->sc_selid));
2549
2550                         /* Handle identify message */
2551                         ncr53c9x_msgin(sc);
2552
2553                         if (sc->sc_state != NCR_CONNECTED &&
2554                             sc->sc_state != NCR_IDENTIFIED) {
2555                                 /* IDENTIFY fail?! */
2556                                 device_printf(sc->sc_dev, "identify failed, "
2557                                     "state %d, intr %02x\n", sc->sc_state,
2558                                     sc->sc_espintr);
2559                                 ncr53c9x_init(sc, 1);
2560                                 goto out;
2561                         }
2562                         goto shortcut; /* ie. next phase expected soon */
2563                 }
2564
2565 #define NCRINTR_DONE    (NCRINTR_FC|NCRINTR_BS)
2566                 if ((sc->sc_espintr & NCRINTR_DONE) == NCRINTR_DONE) {
2567                         /*
2568                          * Arbitration won; examine the `step' register
2569                          * to determine how far the selection could progress.
2570                          */
2571                         if (ecb == NULL) {
2572                                 /*
2573                                  * When doing path inquiry during boot
2574                                  * FAS100A trigger a stray interrupt which
2575                                  * we just ignore instead of panicing.
2576                                  */
2577                                 if (sc->sc_state == NCR_IDLE &&
2578                                     sc->sc_espstep == 0)
2579                                         goto out;
2580                                 panic("ncr53c9x: no nexus");
2581                         }
2582
2583                         ti = &sc->sc_tinfo[ecb->ccb->ccb_h.target_id];
2584
2585                         switch (sc->sc_espstep) {
2586                         case 0:
2587                                 /*
2588                                  * The target did not respond with a
2589                                  * message out phase - probably an old
2590                                  * device that doesn't recognize ATN.
2591                                  * Clear ATN and just continue, the
2592                                  * target should be in the command
2593                                  * phase.
2594                                  * XXXX check for command phase?
2595                                  */
2596                                 NCRCMD(sc, NCRCMD_RSTATN);
2597                                 break;
2598                         case 1:
2599                                 if ((ti->flags & T_NEGOTIATE) == 0 &&
2600                                     ecb->tag[0] == 0) {
2601                                         device_printf(sc->sc_dev, "step 1 & "
2602                                             "!NEG\n");
2603                                         goto reset;
2604                                 }
2605                                 if (sc->sc_phase != MESSAGE_OUT_PHASE) {
2606                                         device_printf(sc->sc_dev, "!MSGOUT\n");
2607                                         goto reset;
2608                                 }
2609                                 if (ti->flags & T_WIDE) {
2610                                         ti->flags |= T_WDTRSENT;
2611                                         ncr53c9x_sched_msgout(SEND_WDTR);
2612                                 }
2613                                 if (ti->flags & T_NEGOTIATE) {
2614                                         /* Start negotiating */
2615                                         sc->sc_flags |= NCR_SYNCHNEGO;
2616                                         if (ecb->tag[0])
2617                                                 ncr53c9x_sched_msgout(
2618                                                     SEND_TAG|SEND_SDTR);
2619                                         else
2620                                                 ncr53c9x_sched_msgout(
2621                                                     SEND_SDTR);
2622                                 } else {
2623                                         /* Could not do ATN3 so send TAG */
2624                                         ncr53c9x_sched_msgout(SEND_TAG);
2625                                 }
2626                                 sc->sc_prevphase = MESSAGE_OUT_PHASE; /* XXXX */
2627                                 break;
2628                         case 3:
2629                                 /*
2630                                  * Grr, this is supposed to mean
2631                                  * "target left command phase  prematurely".
2632                                  * It seems to happen regularly when
2633                                  * sync mode is on.
2634                                  * Look at FIFO to see if command went out.
2635                                  * (Timing problems?)
2636                                  */
2637                                 if (sc->sc_features & NCR_F_DMASELECT) {
2638                                         if (sc->sc_cmdlen == 0)
2639                                                 /* Hope for the best.. */
2640                                                 break;
2641                                 } else if ((NCR_READ_REG(sc, NCR_FFLAG)
2642                                     & NCRFIFO_FF) == 0) {
2643                                         /* Hope for the best.. */
2644                                         break;
2645                                 }
2646                                 printf("(%s:%d:%d): selection failed;"
2647                                     " %d left in FIFO "
2648                                     "[intr %x, stat %x, step %d]\n",
2649                                     device_get_nameunit(sc->sc_dev),
2650                                     ecb->ccb->ccb_h.target_id,
2651                                     ecb->ccb->ccb_h.target_lun,
2652                                     NCR_READ_REG(sc, NCR_FFLAG)
2653                                      & NCRFIFO_FF,
2654                                     sc->sc_espintr, sc->sc_espstat,
2655                                     sc->sc_espstep);
2656                                 NCRCMD(sc, NCRCMD_FLUSH);
2657                                 ncr53c9x_sched_msgout(SEND_ABORT);
2658                                 goto out;
2659                         case 2:
2660                                 /* Select stuck at Command Phase */
2661                                 NCRCMD(sc, NCRCMD_FLUSH);
2662                                 break;
2663                         case 4:
2664                                 if (sc->sc_features & NCR_F_DMASELECT &&
2665                                     sc->sc_cmdlen != 0)
2666                                         printf("(%s:%d:%d): select; "
2667                                             "%lu left in DMA buffer "
2668                                             "[intr %x, stat %x, step %d]\n",
2669                                             device_get_nameunit(sc->sc_dev),
2670                                             ecb->ccb->ccb_h.target_id,
2671                                             ecb->ccb->ccb_h.target_lun,
2672                                             (u_long)sc->sc_cmdlen,
2673                                             sc->sc_espintr,
2674                                             sc->sc_espstat,
2675                                             sc->sc_espstep);
2676                                 /* So far, everything went fine */
2677                                 break;
2678                         }
2679
2680                         sc->sc_prevphase = INVALID_PHASE; /* ?? */
2681                         /* Do an implicit RESTORE POINTERS. */
2682                         sc->sc_dp = ecb->daddr;
2683                         sc->sc_dleft = ecb->dleft;
2684                         sc->sc_state = NCR_CONNECTED;
2685                         break;
2686
2687                 } else {
2688
2689                         device_printf(sc->sc_dev, "unexpected status after "
2690                             "select: [intr %x, stat %x, step %x]\n",
2691                             sc->sc_espintr, sc->sc_espstat, sc->sc_espstep);
2692                         NCRCMD(sc, NCRCMD_FLUSH);
2693                         DELAY(1);
2694                         goto reset;
2695                 }
2696                 if (sc->sc_state == NCR_IDLE) {
2697                         device_printf(sc->sc_dev, "stray interrupt\n");
2698                         goto out;
2699                 }
2700                 break;
2701
2702         case NCR_CONNECTED:
2703                 if ((sc->sc_flags & NCR_ICCS) != 0) {
2704                         /* "Initiate Command Complete Steps" in progress */
2705                         u_char msg;
2706
2707                         sc->sc_flags &= ~NCR_ICCS;
2708
2709                         if (!(sc->sc_espintr & NCRINTR_DONE)) {
2710                                 device_printf(sc->sc_dev, "ICCS: "
2711                                     ": [intr %x, stat %x, step %x]\n",
2712                                     sc->sc_espintr, sc->sc_espstat,
2713                                     sc->sc_espstep);
2714                         }
2715                         ncr53c9x_rdfifo(sc, NCR_RDFIFO_START);
2716                         if (sc->sc_imlen < 2)
2717                                 device_printf(sc->sc_dev, "can't get status, "
2718                                     "only %d bytes\n", (int)sc->sc_imlen);
2719                         ecb->stat = sc->sc_imess[sc->sc_imlen - 2];
2720                         msg = sc->sc_imess[sc->sc_imlen - 1];
2721                         NCR_PHASE(("<stat:(%x,%x)>", ecb->stat, msg));
2722                         if (msg == MSG_CMDCOMPLETE) {
2723                                 ecb->dleft = (ecb->flags & ECB_TENTATIVE_DONE)
2724                                         ? 0 : sc->sc_dleft;
2725                                 if ((ecb->flags & ECB_SENSE) == 0)
2726                                         ecb->ccb->csio.resid = ecb->dleft;
2727                                 sc->sc_state = NCR_CMDCOMPLETE;
2728                         } else
2729                                 device_printf(sc->sc_dev, "STATUS_PHASE: "
2730                                     "msg %d\n", msg);
2731                         sc->sc_imlen = 0;
2732                         NCRCMD(sc, NCRCMD_MSGOK);
2733                         goto shortcut; /* ie. wait for disconnect */
2734                 }
2735                 break;
2736
2737         default:
2738                 device_printf(sc->sc_dev, "invalid state: %d [intr %x, "
2739                     "phase(c %x, p %x)]\n", sc->sc_state,
2740                     sc->sc_espintr, sc->sc_phase, sc->sc_prevphase);
2741                 goto reset;
2742         }
2743
2744         /*
2745          * Driver is now in state NCR_CONNECTED, i.e. we
2746          * have a current command working the SCSI bus.
2747          */
2748         if (sc->sc_state != NCR_CONNECTED || ecb == NULL) {
2749                 panic("ncr53c9x: no nexus");
2750         }
2751
2752         switch (sc->sc_phase) {
2753         case MESSAGE_OUT_PHASE:
2754                 NCR_PHASE(("MESSAGE_OUT_PHASE "));
2755                 ncr53c9x_msgout(sc);
2756                 sc->sc_prevphase = MESSAGE_OUT_PHASE;
2757                 break;
2758
2759         case MESSAGE_IN_PHASE:
2760 msgin:
2761                 NCR_PHASE(("MESSAGE_IN_PHASE "));
2762                 if ((sc->sc_espintr & NCRINTR_BS) != 0) {
2763                         if ((sc->sc_rev != NCR_VARIANT_FAS366) ||
2764                             !(sc->sc_espstat2 & NCRFAS_STAT2_EMPTY)) {
2765                                 NCRCMD(sc, NCRCMD_FLUSH);
2766                         }
2767                         sc->sc_flags |= NCR_WAITI;
2768                         NCRCMD(sc, NCRCMD_TRANS);
2769                 } else if ((sc->sc_espintr & NCRINTR_FC) != 0) {
2770                         if ((sc->sc_flags & NCR_WAITI) == 0) {
2771                                 device_printf(sc->sc_dev, "MSGIN: unexpected "
2772                                     "FC bit: [intr %x, stat %x, step %x]\n",
2773                                     sc->sc_espintr, sc->sc_espstat,
2774                                     sc->sc_espstep);
2775                         }
2776                         sc->sc_flags &= ~NCR_WAITI;
2777                         ncr53c9x_rdfifo(sc,
2778                             (sc->sc_prevphase == sc->sc_phase) ?
2779                             NCR_RDFIFO_CONTINUE : NCR_RDFIFO_START);
2780                         ncr53c9x_msgin(sc);
2781                 } else {
2782                         device_printf(sc->sc_dev, "MSGIN: weird bits: "
2783                             "[intr %x, stat %x, step %x]\n",
2784                             sc->sc_espintr, sc->sc_espstat, sc->sc_espstep);
2785                 }
2786                 sc->sc_prevphase = MESSAGE_IN_PHASE;
2787                 goto shortcut;  /* i.e. expect data to be ready */
2788
2789         case COMMAND_PHASE:
2790                 /*
2791                  * Send the command block. Normally we don't see this
2792                  * phase because the SEL_ATN command takes care of
2793                  * all this. However, we end up here if either the
2794                  * target or we wanted to exchange some more messages
2795                  * first (e.g. to start negotiations).
2796                  */
2797
2798                 NCR_PHASE(("COMMAND_PHASE 0x%02x (%d) ",
2799                     ecb->cmd.cmd.opcode, ecb->clen));
2800                 if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
2801                         NCRCMD(sc, NCRCMD_FLUSH);
2802 /*                      DELAY(1);*/
2803                 }
2804                 if (sc->sc_features & NCR_F_DMASELECT) {
2805                         /* setup DMA transfer for command */
2806                         size = ecb->clen;
2807                         sc->sc_cmdlen = size;
2808                         sc->sc_cmdp = (caddr_t)&ecb->cmd.cmd;
2809                         NCRDMA_SETUP(sc, &sc->sc_cmdp, &sc->sc_cmdlen,
2810                             0, &size);
2811                         /* Program the SCSI counter */
2812                         NCR_SET_COUNT(sc, size);
2813
2814                         /* load the count in */
2815                         NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA);
2816
2817                         /* start the command transfer */
2818                         NCRCMD(sc, NCRCMD_TRANS | NCRCMD_DMA);
2819                         NCRDMA_GO(sc);
2820                 } else {
2821                         ncr53c9x_wrfifo(sc, (u_char *)&ecb->cmd.cmd, ecb->clen);
2822                         NCRCMD(sc, NCRCMD_TRANS);
2823                 }
2824                 sc->sc_prevphase = COMMAND_PHASE;
2825                 break;
2826
2827         case DATA_OUT_PHASE:
2828                 NCR_PHASE(("DATA_OUT_PHASE [%ld] ",(long)sc->sc_dleft));
2829                 NCRCMD(sc, NCRCMD_FLUSH);
2830                 size = min(sc->sc_dleft, sc->sc_maxxfer);
2831                 NCRDMA_SETUP(sc, &sc->sc_dp, &sc->sc_dleft, 0, &size);
2832                 sc->sc_prevphase = DATA_OUT_PHASE;
2833                 goto setup_xfer;
2834
2835         case DATA_IN_PHASE:
2836                 NCR_PHASE(("DATA_IN_PHASE "));
2837                 if (sc->sc_rev == NCR_VARIANT_ESP100)
2838                         NCRCMD(sc, NCRCMD_FLUSH);
2839                 size = min(sc->sc_dleft, sc->sc_maxxfer);
2840                 NCRDMA_SETUP(sc, &sc->sc_dp, &sc->sc_dleft, 1, &size);
2841                 sc->sc_prevphase = DATA_IN_PHASE;
2842         setup_xfer:
2843                 /* Target returned to data phase: wipe "done" memory */
2844                 ecb->flags &= ~ECB_TENTATIVE_DONE;
2845
2846                 /* Program the SCSI counter */
2847                 NCR_SET_COUNT(sc, size);
2848
2849                 /* load the count in */
2850                 NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA);
2851
2852                 /*
2853                  * Note that if `size' is 0, we've already transceived
2854                  * all the bytes we want but we're still in DATA PHASE.
2855                  * Apparently, the device needs padding. Also, a
2856                  * transfer size of 0 means "maximum" to the chip
2857                  * DMA logic.
2858                  */
2859                 NCRCMD(sc,
2860                     (size == 0 ? NCRCMD_TRPAD : NCRCMD_TRANS) | NCRCMD_DMA);
2861                 NCRDMA_GO(sc);
2862                 goto out;
2863
2864         case STATUS_PHASE:
2865                 NCR_PHASE(("STATUS_PHASE "));
2866                 sc->sc_flags |= NCR_ICCS;
2867                 NCRCMD(sc, NCRCMD_ICCS);
2868                 sc->sc_prevphase = STATUS_PHASE;
2869                 goto shortcut;  /* i.e. expect status results soon */
2870
2871         case INVALID_PHASE:
2872                 break;
2873
2874         default:
2875                 device_printf(sc->sc_dev, "unexpected bus phase; resetting\n");
2876                 goto reset;
2877         }
2878
2879 out:
2880         mtx_unlock(&sc->sc_lock);
2881         return;
2882
2883 reset:
2884         ncr53c9x_init(sc, 1);
2885         goto out;
2886
2887 finish:
2888         ncr53c9x_done(sc, ecb);
2889         goto out;
2890
2891 sched:
2892         sc->sc_state = NCR_IDLE;
2893         ncr53c9x_sched(sc);
2894         goto out;
2895
2896 shortcut:
2897         /*
2898          * The idea is that many of the SCSI operations take very little
2899          * time, and going away and getting interrupted is too high an
2900          * overhead to pay. For example, selecting, sending a message
2901          * and command and then doing some work can be done in one "pass".
2902          *
2903          * The delay is a heuristic. It is 2 when at 20MHz, 2 at 25MHz and 1
2904          * at 40MHz. This needs testing.
2905          */
2906         {
2907                 struct timeval wait, cur;
2908
2909                 microtime(&wait);
2910                 wait.tv_usec += 50 / sc->sc_freq;
2911                 if (wait.tv_usec > 1000000) {
2912                         wait.tv_sec++;
2913                         wait.tv_usec -= 1000000;
2914                 }
2915                 do {
2916                         if (NCRDMA_ISINTR(sc))
2917                                 goto again;
2918                         microtime(&cur);
2919                 } while (cur.tv_sec <= wait.tv_sec &&
2920                          cur.tv_usec <= wait.tv_usec);
2921         }
2922         goto out;
2923 }
2924
2925 static void
2926 ncr53c9x_abort(sc, ecb)
2927         struct ncr53c9x_softc *sc;
2928         struct ncr53c9x_ecb *ecb;
2929 {
2930
2931         /* 2 secs for the abort */
2932         ecb->timeout = NCR_ABORT_TIMEOUT;
2933         ecb->flags |= ECB_ABORT;
2934
2935         if (ecb == sc->sc_nexus) {
2936                 /*
2937                  * If we're still selecting, the message will be scheduled
2938                  * after selection is complete.
2939                  */
2940                 if (sc->sc_state == NCR_CONNECTED)
2941                         ncr53c9x_sched_msgout(SEND_ABORT);
2942
2943                 /*
2944                  * Reschedule timeout.
2945                  */
2946                 ecb->ccb->ccb_h.timeout_ch =
2947                     timeout(ncr53c9x_timeout, ecb, mstohz(ecb->timeout));
2948         } else {
2949                 /*
2950                  * Just leave the command where it is.
2951                  * XXX - what choice do we have but to reset the SCSI
2952                  *       eventually?
2953                  */
2954                 if (sc->sc_state == NCR_IDLE)
2955                         ncr53c9x_sched(sc);
2956         }
2957 }
2958
2959 static void
2960 ncr53c9x_timeout(void *arg)
2961 {
2962         struct ncr53c9x_ecb *ecb = arg;
2963         union ccb *ccb = ecb->ccb;
2964         struct ncr53c9x_softc *sc = ecb->sc;
2965         struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[ccb->ccb_h.target_id];
2966
2967         xpt_print_path(ccb->ccb_h.path);
2968         device_printf(sc->sc_dev, "timed out [ecb %p (flags 0x%x, dleft %x, "
2969             "stat %x)], <state %d, nexus %p, phase(l %x, c %x, p %x), "
2970             "resid %lx, msg(q %x,o %x) %s>",
2971             ecb, ecb->flags, ecb->dleft, ecb->stat,
2972             sc->sc_state, sc->sc_nexus,
2973             NCR_READ_REG(sc, NCR_STAT),
2974             sc->sc_phase, sc->sc_prevphase,
2975             (long)sc->sc_dleft, sc->sc_msgpriq, sc->sc_msgout,
2976             NCRDMA_ISACTIVE(sc) ? "DMA active" : "");
2977 #if defined(NCR53C9X_DEBUG) && NCR53C9X_DEBUG > 1
2978         printf("TRACE: %s.", ecb->trace);
2979 #endif
2980
2981         mtx_lock(&sc->sc_lock);
2982
2983         if (ecb->flags & ECB_ABORT) {
2984                 /* abort timed out */
2985                 printf(" AGAIN\n");
2986
2987                 ncr53c9x_init(sc, 1);
2988         } else {
2989                 /* abort the operation that has timed out */
2990                 printf("\n");
2991                 ccb->ccb_h.status = CAM_CMD_TIMEOUT;
2992                 ncr53c9x_abort(sc, ecb);
2993
2994                 /* Disable sync mode if stuck in a data phase */
2995                 if (ecb == sc->sc_nexus &&
2996                     (ti->flags & T_SYNCMODE) != 0 &&
2997                     (sc->sc_phase & (MSGI|CDI)) == 0) {
2998                         /* XXX ASYNC CALLBACK! */
2999                         xpt_print_path(ccb->ccb_h.path);
3000                         printf("sync negotiation disabled\n");
3001                         sc->sc_cfflags |=
3002                             (1 << ((ccb->ccb_h.target_id & 7) + 8));
3003                 }
3004         }
3005
3006         mtx_unlock(&sc->sc_lock);
3007 }
3008
3009 static void
3010 ncr53c9x_watch(void *arg)
3011 {
3012         struct ncr53c9x_softc *sc = (struct ncr53c9x_softc *)arg;
3013         struct ncr53c9x_tinfo *ti;
3014         struct ncr53c9x_linfo *li;
3015         int t;
3016         /* Delete any structures that have not been used in 10min. */
3017         time_t old = time_second - (10 * 60);
3018
3019         mtx_lock(&sc->sc_lock);
3020         for (t = 0; t < sc->sc_ntarg; t++) {
3021                 ti = &sc->sc_tinfo[t];
3022                 li = LIST_FIRST(&ti->luns);
3023                 while (li) {
3024                         if (li->last_used < old &&
3025                             li->untagged == NULL &&
3026                             li->used == 0) {
3027                                 if (li->lun < NCR_NLUN)
3028                                         ti->lun[li->lun] = NULL;
3029                                 LIST_REMOVE(li, link);
3030                                 free(li, M_DEVBUF);
3031                                 /* Restart the search at the beginning */
3032                                 li = LIST_FIRST(&ti->luns);
3033                                 continue;
3034                         }
3035                         li = LIST_NEXT(li, link);
3036                 }
3037         }
3038         mtx_unlock(&sc->sc_lock);
3039         callout_reset(&sc->sc_watchdog, 60 * hz, ncr53c9x_watch, sc);
3040 }