aic7xxx.c revision 44589
1/*
2 * Generic driver for the aic7xxx based adaptec SCSI controllers
3 * Product specific probe and attach routines can be found in:
4 * i386/eisa/ahc_eisa.c	27/284X and aic7770 motherboard controllers
5 * pci/ahc_pci.c	3985, 3980, 3940, 2940, aic7895, aic7890,
6 *			aic7880, aic7870, aic7860, and aic7850 controllers
7 *
8 * Copyright (c) 1994, 1995, 1996, 1997, 1998, 1999 Justin T. Gibbs.
9 * All rights reserved.
10 *
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted provided that the following conditions
13 * are met:
14 * 1. Redistributions of source code must retain the above copyright
15 *    notice, this list of conditions, and the following disclaimer,
16 *    without modification, immediately at the beginning of the file.
17 * 2. The name of the author may not be used to endorse or promote products
18 *    derived from this software without specific prior written permission.
19 *
20 * Where this Software is combined with software released under the terms of
21 * the GNU Public License ("GPL") and the terms of the GPL would require the
22 * combined work to also be released under the terms of the GPL, the terms
23 * and conditions of this License will apply in addition to those of the
24 * GPL with the exception of any terms or conditions of this License that
25 * conflict with, or are expressly prohibited by, the GPL.
26 *
27 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
28 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
29 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
30 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
31 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
32 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
33 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
34 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
35 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
36 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
37 * SUCH DAMAGE.
38 *
39 *      $Id: aic7xxx.c,v 1.18 1999/03/05 23:35:46 gibbs Exp $
40 */
41/*
42 * A few notes on features of the driver.
43 *
44 * SCB paging takes advantage of the fact that devices stay disconnected
45 * from the bus a relatively long time and that while they're disconnected,
46 * having the SCBs for these transactions down on the host adapter is of
47 * little use.  Instead of leaving this idle SCB down on the card we copy
48 * it back up into kernel memory and reuse the SCB slot on the card to
49 * schedule another transaction.  This can be a real payoff when doing random
50 * I/O to tagged queueing devices since there are more transactions active at
51 * once for the device to sort for optimal seek reduction. The algorithm goes
52 * like this...
53 *
54 * The sequencer maintains two lists of its hardware SCBs.  The first is the
55 * singly linked free list which tracks all SCBs that are not currently in
56 * use.  The second is the doubly linked disconnected list which holds the
57 * SCBs of transactions that are in the disconnected state sorted most
58 * recently disconnected first.  When the kernel queues a transaction to
59 * the card, a hardware SCB to "house" this transaction is retrieved from
60 * either of these two lists.  If the SCB came from the disconnected list,
61 * a check is made to see if any data transfer or SCB linking (more on linking
62 * in a bit) information has been changed since it was copied from the host
63 * and if so, DMAs the SCB back up before it can be used.  Once a hardware
64 * SCB has been obtained, the SCB is DMAed from the host.  Before any work
65 * can begin on this SCB, the sequencer must ensure that either the SCB is
66 * for a tagged transaction or the target is not already working on another
67 * non-tagged transaction.  If a conflict arises in the non-tagged case, the
68 * sequencer finds the SCB for the active transactions and sets the SCB_LINKED
69 * field in that SCB to this next SCB to execute.  To facilitate finding
70 * active non-tagged SCBs, the last four bytes of up to the first four hardware
71 * SCBs serve as a storage area for the currently active SCB ID for each
72 * target.
73 *
74 * When a device reconnects, a search is made of the hardware SCBs to find
75 * the SCB for this transaction.  If the search fails, a hardware SCB is
76 * pulled from either the free or disconnected SCB list and the proper
77 * SCB is DMAed from the host.  If the MK_MESSAGE control bit is set
78 * in the control byte of the SCB while it was disconnected, the sequencer
79 * will assert ATN and attempt to issue a message to the host.
80 *
81 * When a command completes, a check for non-zero status and residuals is
82 * made.  If either of these conditions exists, the SCB is DMAed back up to
83 * the host so that it can interpret this information.  Additionally, in the
84 * case of bad status, the sequencer generates a special interrupt and pauses
85 * itself.  This allows the host to setup a request sense command if it
86 * chooses for this target synchronously with the error so that sense
87 * information isn't lost.
88 *
89 */
90
91#include <opt_aic7xxx.h>
92
93#include <pci.h>
94#include <stddef.h>	/* For offsetof */
95
96#include <sys/param.h>
97#include <sys/systm.h>
98#include <sys/malloc.h>
99#include <sys/buf.h>
100#include <sys/proc.h>
101
102#include <cam/cam.h>
103#include <cam/cam_ccb.h>
104#include <cam/cam_sim.h>
105#include <cam/cam_xpt_sim.h>
106#include <cam/cam_debug.h>
107
108#include <cam/scsi/scsi_all.h>
109#include <cam/scsi/scsi_message.h>
110
111#if NPCI > 0
112#include <machine/bus_memio.h>
113#endif
114#include <machine/bus_pio.h>
115#include <machine/bus.h>
116#include <machine/clock.h>
117
118#include <vm/vm.h>
119#include <vm/vm_param.h>
120#include <vm/pmap.h>
121
122#include <dev/aic7xxx/aic7xxx.h>
123#include <dev/aic7xxx/sequencer.h>
124
125#include <aic7xxx_reg.h>
126#include <aic7xxx_seq.h>
127
128#include <sys/kernel.h>
129
130#ifndef AHC_TMODE_ENABLE
131#define AHC_TMODE_ENABLE 0
132#endif
133
134#define MAX(a,b) (((a) > (b)) ? (a) : (b))
135#define MIN(a,b) (((a) < (b)) ? (a) : (b))
136#define ALL_CHANNELS '\0'
137#define ALL_TARGETS_MASK 0xFFFF
138#define INITIATOR_WILDCARD	(~0)
139
140#define	SIM_IS_SCSIBUS_B(ahc, sim)	\
141	((sim) == ahc->sim_b)
142#define	SIM_CHANNEL(ahc, sim)	\
143	(((sim) == ahc->sim_b) ? 'B' : 'A')
144#define	SIM_SCSI_ID(ahc, sim)	\
145	(((sim) == ahc->sim_b) ? ahc->our_id_b : ahc->our_id)
146#define	SIM_PATH(ahc, sim)	\
147	(((sim) == ahc->sim_b) ? ahc->path_b : ahc->path)
148#define	SCB_IS_SCSIBUS_B(scb)	\
149	(((scb)->hscb->tcl & SELBUSB) != 0)
150#define	SCB_TARGET(scb)	\
151	(((scb)->hscb->tcl & TID) >> 4)
152#define	SCB_CHANNEL(scb) \
153	(SCB_IS_SCSIBUS_B(scb) ? 'B' : 'A')
154#define	SCB_LUN(scb)	\
155	((scb)->hscb->tcl & LID)
156#define SCB_TARGET_OFFSET(scb)		\
157	(SCB_TARGET(scb) + (SCB_IS_SCSIBUS_B(scb) ? 8 : 0))
158#define SCB_TARGET_MASK(scb)		\
159	(0x01 << (SCB_TARGET_OFFSET(scb)))
160#define TCL_CHANNEL(ahc, tcl)		\
161	((((ahc)->features & AHC_TWIN) && ((tcl) & SELBUSB)) ? 'B' : 'A')
162#define TCL_TARGET(tcl) (((tcl) & TID) >> TCL_TARGET_SHIFT)
163#define TCL_LUN(tcl) ((tcl) & LID)
164
165#define ccb_scb_ptr spriv_ptr0
166#define ccb_ahc_ptr spriv_ptr1
167
168typedef enum {
169	ROLE_UNKNOWN,
170	ROLE_INITIATOR,
171	ROLE_TARGET,
172} role_t;
173
174struct ahc_devinfo {
175	int	  our_scsiid;
176	int	  target_offset;
177	u_int16_t target_mask;
178	u_int8_t  target;
179	u_int8_t  lun;
180	char	  channel;
181	role_t	  role;		/*
182				 * Only guaranteed to be correct if not
183				 * in the busfree state.
184				 */
185};
186
187typedef enum {
188	SEARCH_COMPLETE,
189	SEARCH_COUNT,
190	SEARCH_REMOVE
191} ahc_search_action;
192
193u_long ahc_unit = 0;
194
195#ifdef AHC_DEBUG
196static int     ahc_debug = AHC_DEBUG;
197#endif
198
199#if NPCI > 0
200void ahc_pci_intr(struct ahc_softc *ahc);
201#endif
202
203#if UNUSED
204static void	ahc_dump_targcmd(struct target_cmd *cmd);
205#endif
206static void	ahc_shutdown(int howto, void *arg);
207static cam_status
208		ahc_find_tmode_devs(struct ahc_softc *ahc,
209				    struct cam_sim *sim, union ccb *ccb,
210				    struct tmode_tstate **tstate,
211				    struct tmode_lstate **lstate,
212				    int notfound_failure);
213static void	ahc_action(struct cam_sim *sim, union ccb *ccb);
214static void	ahc_async(void *callback_arg, u_int32_t code,
215			  struct cam_path *path, void *arg);
216static void	ahc_execute_scb(void *arg, bus_dma_segment_t *dm_segs,
217				int nsegments, int error);
218static void	ahc_poll(struct cam_sim *sim);
219static void	ahc_setup_data(struct ahc_softc *ahc,
220			       struct ccb_scsiio *csio, struct scb *scb);
221static void	ahc_freeze_devq(struct ahc_softc *ahc, struct cam_path *path);
222static struct scb *
223                ahc_get_scb(struct ahc_softc *ahc);
224static void     ahc_free_scb(struct ahc_softc *ahc, struct scb *scb);
225static struct scb *
226		ahc_alloc_scb(struct ahc_softc *ahc);
227static void	ahc_scb_devinfo(struct ahc_softc *ahc,
228				struct ahc_devinfo *devinfo,
229				struct scb *scb);
230static void	ahc_fetch_devinfo(struct ahc_softc *ahc,
231				  struct ahc_devinfo *devinfo);
232static void	ahc_compile_devinfo(struct ahc_devinfo *devinfo, u_int our_id,
233				    u_int target, u_int lun, char channel,
234				    role_t role);
235static u_int	ahc_abort_wscb(struct ahc_softc *ahc, u_int scbpos, u_int prev);
236static void	ahc_done(struct ahc_softc *ahc, struct scb *scbp);
237static struct tmode_tstate *
238		ahc_alloc_tstate(struct ahc_softc *ahc,
239				 u_int scsi_id, char channel);
240static void	ahc_free_tstate(struct ahc_softc *ahc,
241				u_int scsi_id, char channel, int force);
242static void	ahc_handle_en_lun(struct ahc_softc *ahc, struct cam_sim *sim,
243				  union ccb *ccb);
244static int	ahc_handle_target_cmd(struct ahc_softc *ahc,
245				      struct target_cmd *cmd);
246static void 	ahc_handle_seqint(struct ahc_softc *ahc, u_int intstat);
247static void	ahc_handle_scsiint(struct ahc_softc *ahc, u_int intstat);
248static void	ahc_build_transfer_msg(struct ahc_softc *ahc,
249				       struct ahc_devinfo *devinfo);
250static void	ahc_setup_initiator_msgout(struct ahc_softc *ahc,
251					   struct ahc_devinfo *devinfo,
252					   struct scb *scb);
253static void	ahc_setup_target_msgin(struct ahc_softc *ahc,
254				       struct ahc_devinfo *devinfo);
255static int	ahc_handle_msg_reject(struct ahc_softc *ahc,
256				      struct ahc_devinfo *devinfo);
257static void	ahc_clear_msg_state(struct ahc_softc *ahc);
258static void	ahc_handle_message_phase(struct ahc_softc *ahc,
259					 struct cam_path *path);
260static int	ahc_sent_msg(struct ahc_softc *ahc, u_int msgtype, int full);
261static int	ahc_parse_msg(struct ahc_softc *ahc, struct cam_path *path,
262			      struct ahc_devinfo *devinfo);
263static void	ahc_handle_ign_wide_residue(struct ahc_softc *ahc,
264					    struct ahc_devinfo *devinfo);
265static void	ahc_handle_devreset(struct ahc_softc *ahc,
266				    struct ahc_devinfo *devinfo,
267				    cam_status status, ac_code acode,
268				    char *message,
269				    int verbose_only);
270static void	ahc_loadseq(struct ahc_softc *ahc);
271static int	ahc_check_patch(struct ahc_softc *ahc,
272				struct patch **start_patch,
273				int start_instr, int *skip_addr);
274static void	ahc_download_instr(struct ahc_softc *ahc,
275				   int instrptr, u_int8_t *dconsts);
276static int	ahc_match_scb(struct scb *scb, int target, char channel,
277			      int lun, u_int tag);
278#ifdef AHC_DEBUG
279static void	ahc_print_scb(struct scb *scb);
280#endif
281static int	ahc_search_qinfifo(struct ahc_softc *ahc, int target,
282				   char channel, int lun, u_int tag,
283				   u_int32_t status, ahc_search_action action);
284static void	ahc_abort_ccb(struct ahc_softc *ahc, struct cam_sim *sim,
285			      union ccb *ccb);
286static int	ahc_reset_channel(struct ahc_softc *ahc, char channel,
287				  int initiate_reset);
288static int	ahc_abort_scbs(struct ahc_softc *ahc, int target,
289			       char channel, int lun, u_int tag,
290			       u_int32_t status);
291static int	ahc_search_disc_list(struct ahc_softc *ahc, int target,
292				     char channel, int lun, u_int tag);
293static u_int	ahc_rem_scb_from_disc_list(struct ahc_softc *ahc,
294					   u_int prev, u_int scbptr);
295static void	ahc_add_curscb_to_free_list(struct ahc_softc *ahc);
296static void	ahc_clear_intstat(struct ahc_softc *ahc);
297static void	ahc_reset_current_bus(struct ahc_softc *ahc);
298static struct ahc_syncrate *
299		ahc_devlimited_syncrate(struct ahc_softc *ahc, u_int *period);
300static struct ahc_syncrate *
301		ahc_find_syncrate(struct ahc_softc *ahc, u_int *period,
302				  u_int maxsync);
303static u_int	ahc_find_period(struct ahc_softc *ahc, u_int scsirate,
304				u_int maxsync);
305static void	ahc_validate_offset(struct ahc_softc *ahc,
306				    struct ahc_syncrate *syncrate,
307				    u_int *offset, int wide);
308static void	ahc_update_target_msg_request(struct ahc_softc *ahc,
309					      struct ahc_devinfo *devinfo,
310					      struct ahc_initiator_tinfo *tinfo,
311					      int force);
312static int	ahc_create_path(struct ahc_softc *ahc,
313				struct ahc_devinfo *devinfo,
314				struct cam_path **path);
315static void	ahc_set_syncrate(struct ahc_softc *ahc,
316				 struct ahc_devinfo *devinfo,
317				 struct cam_path *path,
318				 struct ahc_syncrate *syncrate,
319				 u_int period, u_int offset, u_int type);
320static void	ahc_set_width(struct ahc_softc *ahc,
321			      struct ahc_devinfo *devinfo,
322			      struct cam_path *path, u_int width, u_int type);
323static void	ahc_set_tags(struct ahc_softc *ahc,
324			     struct ahc_devinfo *devinfo,
325			     int enable);
326static void	ahc_construct_sdtr(struct ahc_softc *ahc,
327				   u_int period, u_int offset);
328
329static void	ahc_construct_wdtr(struct ahc_softc *ahc, u_int bus_width);
330
331static void	ahc_calc_residual(struct scb *scb);
332
333static void	ahc_update_pending_syncrates(struct ahc_softc *ahc);
334
335static void	ahc_set_recoveryscb(struct ahc_softc *ahc, struct scb *scb);
336
337static timeout_t
338		ahc_timeout;
339static __inline int  sequencer_paused(struct ahc_softc *ahc);
340static __inline void pause_sequencer(struct ahc_softc *ahc);
341static __inline void unpause_sequencer(struct ahc_softc *ahc,
342				       int unpause_always);
343static __inline void restart_sequencer(struct ahc_softc *ahc);
344static __inline u_int ahc_index_busy_tcl(struct ahc_softc *ahc,
345					 u_int tcl, int unbusy);
346
347static __inline void	 ahc_busy_tcl(struct ahc_softc *ahc, struct scb *scb);
348
349static __inline void	   ahc_freeze_ccb(union ccb* ccb);
350static __inline cam_status ahc_ccb_status(union ccb* ccb);
351static __inline void	   ahc_set_ccb_status(union ccb* ccb,
352					      cam_status status);
353static __inline void	   ahc_run_tqinfifo(struct ahc_softc *ahc);
354
355static __inline struct ahc_initiator_tinfo *
356			   ahc_fetch_transinfo(struct ahc_softc *ahc,
357					       char channel,
358					       u_int our_id, u_int target,
359					       struct tmode_tstate **tstate);
360
361static __inline u_int32_t
362ahc_hscb_busaddr(struct ahc_softc *ahc, u_int index)
363{
364	return (ahc->hscb_busaddr + (sizeof(struct hardware_scb) * index));
365}
366
367#define AHC_BUSRESET_DELAY	25	/* Reset delay in us */
368
369static __inline int
370sequencer_paused(struct ahc_softc *ahc)
371{
372	return ((ahc_inb(ahc, HCNTRL) & PAUSE) != 0);
373}
374
375static __inline void
376pause_sequencer(struct ahc_softc *ahc)
377{
378	ahc_outb(ahc, HCNTRL, ahc->pause);
379
380	/*
381	 * Since the sequencer can disable pausing in a critical section, we
382	 * must loop until it actually stops.
383	 */
384	while (sequencer_paused(ahc) == 0)
385		;
386}
387
388static __inline void
389unpause_sequencer(struct ahc_softc *ahc, int unpause_always)
390{
391	if (unpause_always
392	 || (ahc_inb(ahc, INTSTAT) & (SCSIINT | SEQINT | BRKADRINT)) == 0)
393		ahc_outb(ahc, HCNTRL, ahc->unpause);
394}
395
396/*
397 * Restart the sequencer program from address zero
398 */
399static __inline void
400restart_sequencer(struct ahc_softc *ahc)
401{
402	pause_sequencer(ahc);
403	ahc_outb(ahc, SEQCTL, FASTMODE|SEQRESET);
404	unpause_sequencer(ahc, /*unpause_always*/TRUE);
405}
406
407static __inline u_int
408ahc_index_busy_tcl(struct ahc_softc *ahc, u_int tcl, int unbusy)
409{
410	u_int scbid;
411
412	scbid = ahc->untagged_scbs[tcl];
413	if (unbusy)
414		ahc->untagged_scbs[tcl] = SCB_LIST_NULL;
415
416	return (scbid);
417}
418
419static __inline void
420ahc_busy_tcl(struct ahc_softc *ahc, struct scb *scb)
421{
422	ahc->untagged_scbs[scb->hscb->tcl] = scb->hscb->tag;
423}
424
425static __inline void
426ahc_freeze_ccb(union ccb* ccb)
427{
428	if ((ccb->ccb_h.status & CAM_DEV_QFRZN) == 0) {
429		ccb->ccb_h.status |= CAM_DEV_QFRZN;
430		xpt_freeze_devq(ccb->ccb_h.path, /*count*/1);
431	}
432}
433
434static __inline cam_status
435ahc_ccb_status(union ccb* ccb)
436{
437	return (ccb->ccb_h.status & CAM_STATUS_MASK);
438}
439
440static __inline void
441ahc_set_ccb_status(union ccb* ccb, cam_status status)
442{
443	ccb->ccb_h.status &= ~CAM_STATUS_MASK;
444	ccb->ccb_h.status |= status;
445}
446
447static __inline struct ahc_initiator_tinfo *
448ahc_fetch_transinfo(struct ahc_softc *ahc, char channel, u_int our_id,
449		    u_int remote_id, struct tmode_tstate **tstate)
450{
451	/*
452	 * Transfer data structures are stored from the perspective
453	 * of the target role.  Since the parameters for a connection
454	 * in the initiator role to a given target are the same as
455	 * when the roles are reversed, we pretend we are the target.
456	 */
457	if (channel == 'B')
458		our_id += 8;
459	*tstate = ahc->enabled_targets[our_id];
460	return (&(*tstate)->transinfo[remote_id]);
461}
462
463static __inline void
464ahc_run_tqinfifo(struct ahc_softc *ahc)
465{
466	struct target_cmd *cmd;
467
468	while ((cmd = &ahc->targetcmds[ahc->tqinfifonext])->cmd_valid != 0) {
469
470		/*
471		 * Only advance through the queue if we
472		 * had the resources to process the command.
473		 */
474		if (ahc_handle_target_cmd(ahc, cmd) != 0)
475			break;
476
477		ahc->tqinfifonext++;
478		cmd->cmd_valid = 0;
479
480		/*
481		 * Lazily update our position in the target mode incomming
482		 * command queue as seen by the sequencer.
483		 */
484		if ((ahc->tqinfifonext & (TQINFIFO_UPDATE_CNT-1)) == 0) {
485			pause_sequencer(ahc);
486			ahc_outb(ahc, KERNEL_TQINPOS, ahc->tqinfifonext - 1);
487			unpause_sequencer(ahc, /*unpause_always*/FALSE);
488		}
489	}
490}
491
492char *
493ahc_name(struct ahc_softc *ahc)
494{
495	static char name[10];
496
497	snprintf(name, sizeof(name), "ahc%d", ahc->unit);
498	return (name);
499}
500
501#ifdef  AHC_DEBUG
502static void
503ahc_print_scb(struct scb *scb)
504{
505	struct hardware_scb *hscb = scb->hscb;
506
507	printf("scb:%p control:0x%x tcl:0x%x cmdlen:%d cmdpointer:0x%lx\n",
508		scb,
509		hscb->control,
510		hscb->tcl,
511		hscb->cmdlen,
512		hscb->cmdpointer );
513	printf("        datlen:%d data:0x%lx segs:0x%x segp:0x%lx\n",
514		hscb->datalen,
515		hscb->data,
516		hscb->SG_count,
517		hscb->SG_pointer);
518	printf("	sg_addr:%lx sg_len:%ld\n",
519		scb->ahc_dma[0].addr,
520		scb->ahc_dma[0].len);
521	printf("	cdb:%x %x %x %x %x %x %x %x %x %x %x %x\n",
522		hscb->cmdstore[0], hscb->cmdstore[1], hscb->cmdstore[2],
523		hscb->cmdstore[3], hscb->cmdstore[4], hscb->cmdstore[5],
524		hscb->cmdstore[6], hscb->cmdstore[7], hscb->cmdstore[8],
525		hscb->cmdstore[9], hscb->cmdstore[10], hscb->cmdstore[11]);
526}
527#endif
528
529static struct {
530        u_int8_t errno;
531	char *errmesg;
532} hard_error[] = {
533	{ ILLHADDR,	"Illegal Host Access" },
534	{ ILLSADDR,	"Illegal Sequencer Address referrenced" },
535	{ ILLOPCODE,	"Illegal Opcode in sequencer program" },
536	{ SQPARERR,	"Sequencer Parity Error" },
537	{ DPARERR,	"Data-path Parity Error" },
538	{ MPARERR,	"Scratch or SCB Memory Parity Error" },
539	{ PCIERRSTAT,	"PCI Error detected" },
540	{ CIOPARERR,	"CIOBUS Parity Error" },
541};
542
543
544/*
545 * Valid SCSIRATE values.  (p. 3-17)
546 * Provides a mapping of tranfer periods in ns to the proper value to
547 * stick in the scsiscfr reg to use that transfer rate.
548 */
549#define AHC_SYNCRATE_ULTRA2	0
550#define AHC_SYNCRATE_ULTRA	2
551#define AHC_SYNCRATE_FAST	5
552static struct ahc_syncrate ahc_syncrates[] = {
553	/* ultra2  fast/ultra  period	rate */
554	{ 0x13,   0x000,	10,	"40.0"	},
555	{ 0x14,   0x000,	11,	"33.0"	},
556	{ 0x15,   0x100,	12,	"20.0"	},
557	{ 0x16,   0x110,	15,	"16.0"	},
558	{ 0x17,   0x120,	18,	"13.4"	},
559	{ 0x18,   0x000,	25,	"10.0"	},
560	{ 0x19,   0x010,	31,	"8.0"	},
561	{ 0x1a,   0x020,	37,	"6.67"	},
562	{ 0x1b,   0x030,	43,	"5.7"	},
563	{ 0x10,   0x040,	50,	"5.0"	},
564	{ 0x00,   0x050,	56,	"4.4"	},
565	{ 0x00,   0x060,	62,	"4.0"	},
566	{ 0x00,   0x070,	68,	"3.6"	},
567	{ 0x00,   0x000,	0,	NULL	}
568};
569
570/*
571 * Allocate a controller structure for a new device and initialize it.
572 */
573struct ahc_softc *
574ahc_alloc(int unit, u_int32_t iobase, vm_offset_t maddr, ahc_chip chip,
575	  ahc_feature features, ahc_flag flags, struct scb_data *scb_data)
576{
577	/*
578	 * find unit and check we have that many defined
579	 */
580	struct  ahc_softc *ahc;
581	size_t	alloc_size;
582
583	/*
584	 * Allocate a storage area for us
585	 */
586	if (scb_data == NULL)
587		/*
588		 * We are not sharing SCB space with another controller
589		 * so allocate our own SCB data space.
590		 */
591		alloc_size = sizeof(struct full_ahc_softc);
592	else
593		alloc_size = sizeof(struct ahc_softc);
594	ahc = malloc(alloc_size, M_DEVBUF, M_NOWAIT);
595	if (!ahc) {
596		printf("ahc%d: cannot malloc!\n", unit);
597		return NULL;
598	}
599	bzero(ahc, alloc_size);
600	if (scb_data == NULL) {
601		struct full_ahc_softc* full_softc = (struct full_ahc_softc*)ahc;
602		ahc->scb_data = &full_softc->scb_data_storage;
603		STAILQ_INIT(&ahc->scb_data->free_scbs);
604	} else
605		ahc->scb_data = scb_data;
606	LIST_INIT(&ahc->pending_ccbs);
607	ahc->unit = unit;
608
609	/*
610	 * XXX This should be done by the bus specific probe stubs with
611	 *     the bus layer providing the bsh and tag.  Unfortunately,
612	 *     we need to clean up how we configure things before this
613	 *     can happen.
614	 */
615	if (maddr != NULL) {
616		ahc->tag = I386_BUS_SPACE_MEM;
617		ahc->bsh = (bus_space_handle_t)maddr;
618	} else {
619		ahc->tag = I386_BUS_SPACE_IO;
620		ahc->bsh = (bus_space_handle_t)iobase;
621	}
622	ahc->chip = chip;
623	ahc->features = features;
624	ahc->flags = flags;
625	ahc->unpause = (ahc_inb(ahc, HCNTRL) & IRQMS) | INTEN;
626	ahc->pause = ahc->unpause | PAUSE;
627
628	return (ahc);
629}
630
631void
632ahc_free(ahc)
633	struct ahc_softc *ahc;
634{
635	free(ahc, M_DEVBUF);
636	return;
637}
638
639int
640ahc_reset(struct ahc_softc *ahc)
641{
642	u_int	sblkctl;
643	int	wait;
644
645	ahc_outb(ahc, HCNTRL, CHIPRST | ahc->pause);
646	/*
647	 * Ensure that the reset has finished
648	 */
649	wait = 1000;
650	while (--wait && !(ahc_inb(ahc, HCNTRL) & CHIPRSTACK))
651		DELAY(1000);
652	if (wait == 0) {
653		printf("%s: WARNING - Failed chip reset!  "
654		       "Trying to initialize anyway.\n", ahc_name(ahc));
655	}
656	ahc_outb(ahc, HCNTRL, ahc->pause);
657
658	/* Determine channel configuration */
659	sblkctl = ahc_inb(ahc, SBLKCTL) & (SELBUSB|SELWIDE);
660	/* No Twin Channel PCI cards */
661	if ((ahc->chip & AHC_PCI) != 0)
662		sblkctl &= ~SELBUSB;
663	switch (sblkctl) {
664	case 0:
665		/* Single Narrow Channel */
666		break;
667	case 2:
668		/* Wide Channel */
669		ahc->features |= AHC_WIDE;
670		break;
671	case 8:
672		/* Twin Channel */
673		ahc->features |= AHC_TWIN;
674		break;
675	default:
676		printf(" Unsupported adapter type.  Ignoring\n");
677		return(-1);
678	}
679	return (0);
680}
681
682/*
683 * Called when we have an active connection to a target on the bus,
684 * this function finds the nearest syncrate to the input period limited
685 * by the capabilities of the bus connectivity of the target.
686 */
687static struct ahc_syncrate *
688ahc_devlimited_syncrate(struct ahc_softc *ahc, u_int *period) {
689	u_int	maxsync;
690
691	if ((ahc->features & AHC_ULTRA2) != 0) {
692		if ((ahc_inb(ahc, SBLKCTL) & ENAB40) != 0
693		 && (ahc_inb(ahc, SSTAT2) & EXP_ACTIVE) == 0) {
694			maxsync = AHC_SYNCRATE_ULTRA2;
695		} else {
696			maxsync = AHC_SYNCRATE_ULTRA;
697		}
698	} else if ((ahc->features & AHC_ULTRA) != 0) {
699		maxsync = AHC_SYNCRATE_ULTRA;
700	} else {
701		maxsync = AHC_SYNCRATE_FAST;
702	}
703	return (ahc_find_syncrate(ahc, period, maxsync));
704}
705
706/*
707 * Look up the valid period to SCSIRATE conversion in our table.
708 * Return the period and offset that should be sent to the target
709 * if this was the beginning of an SDTR.
710 */
711static struct ahc_syncrate *
712ahc_find_syncrate(struct ahc_softc *ahc, u_int *period, u_int maxsync)
713{
714	struct ahc_syncrate *syncrate;
715
716	syncrate = &ahc_syncrates[maxsync];
717	while ((syncrate->rate != NULL)
718	    && ((ahc->features & AHC_ULTRA2) == 0
719	     || (syncrate->sxfr_ultra2 != 0))) {
720
721		if (*period <= syncrate->period) {
722			/*
723			 * When responding to a target that requests
724			 * sync, the requested rate may fall between
725			 * two rates that we can output, but still be
726			 * a rate that we can receive.  Because of this,
727			 * we want to respond to the target with
728			 * the same rate that it sent to us even
729			 * if the period we use to send data to it
730			 * is lower.  Only lower the response period
731			 * if we must.
732			 */
733			if (syncrate == &ahc_syncrates[maxsync]) {
734				*period = syncrate->period;
735			}
736			break;
737		}
738		syncrate++;
739	}
740
741	if ((*period == 0)
742	 || (syncrate->rate == NULL)
743	 || ((ahc->features & AHC_ULTRA2) != 0
744	  && (syncrate->sxfr_ultra2 == 0))) {
745		/* Use asynchronous transfers. */
746		*period = 0;
747		syncrate = NULL;
748	}
749	return (syncrate);
750}
751
752static u_int
753ahc_find_period(struct ahc_softc *ahc, u_int scsirate, u_int maxsync)
754{
755	struct ahc_syncrate *syncrate;
756
757	if ((ahc->features & AHC_ULTRA2) != 0) {
758		scsirate &= SXFR_ULTRA2;
759	} else  {
760		scsirate &= SXFR;
761	}
762
763	syncrate = &ahc_syncrates[maxsync];
764	while (syncrate->rate != NULL) {
765
766		if ((ahc->features & AHC_ULTRA2) != 0) {
767			if (syncrate->sxfr_ultra2 == 0)
768				break;
769			else if (scsirate == syncrate->sxfr_ultra2)
770				return (syncrate->period);
771		} else if (scsirate == (syncrate->sxfr & ~ULTRA_SXFR)) {
772				return (syncrate->period);
773		}
774		syncrate++;
775	}
776	return (0); /* async */
777}
778
779static void
780ahc_validate_offset(struct ahc_softc *ahc, struct ahc_syncrate *syncrate,
781		    u_int *offset, int wide)
782{
783	u_int maxoffset;
784
785	/* Limit offset to what we can do */
786	if (syncrate == NULL) {
787		maxoffset = 0;
788	} else if ((ahc->features & AHC_ULTRA2) != 0) {
789		maxoffset = MAX_OFFSET_ULTRA2;
790	} else {
791		if (wide)
792			maxoffset = MAX_OFFSET_16BIT;
793		else
794			maxoffset = MAX_OFFSET_8BIT;
795	}
796	*offset = MIN(*offset, maxoffset);
797}
798
799static void
800ahc_update_target_msg_request(struct ahc_softc *ahc,
801			      struct ahc_devinfo *devinfo,
802			      struct ahc_initiator_tinfo *tinfo,
803			      int force)
804{
805	int paused;
806	u_int targ_msg_req_orig;
807
808	targ_msg_req_orig = ahc->targ_msg_req;
809	if (tinfo->current.period != tinfo->goal.period
810	 || tinfo->current.width != tinfo->goal.width
811	 || (force
812	  && (tinfo->goal.period != 0
813	   || tinfo->goal.width != MSG_EXT_WDTR_BUS_8_BIT)))
814		ahc->targ_msg_req |= devinfo->target_mask;
815	else
816		ahc->targ_msg_req &= ~devinfo->target_mask;
817
818	if (ahc->targ_msg_req != targ_msg_req_orig) {
819		/* Update the message request bit for this target */
820		paused = sequencer_paused(ahc);
821
822		if (!paused)
823			pause_sequencer(ahc);
824
825		ahc_outb(ahc, TARGET_MSG_REQUEST, ahc->targ_msg_req & 0xFF);
826		ahc_outb(ahc, TARGET_MSG_REQUEST + 1,
827			 (ahc->targ_msg_req >> 8) & 0xFF);
828
829		if (!paused)
830			unpause_sequencer(ahc, /*unpause always*/FALSE);
831	}
832}
833
834static int
835ahc_create_path(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
836		     struct cam_path **path)
837{
838	path_id_t path_id;
839
840	if (devinfo->channel == 'B')
841		path_id = cam_sim_path(ahc->sim_b);
842	else
843		path_id = cam_sim_path(ahc->sim);
844
845	return (xpt_create_path(path, /*periph*/NULL,
846				path_id, devinfo->target,
847				devinfo->lun));
848}
849
850static void
851ahc_set_syncrate(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
852		 struct cam_path *path, struct ahc_syncrate *syncrate,
853		 u_int period, u_int offset, u_int type)
854{
855	struct ahc_initiator_tinfo *tinfo;
856	struct tmode_tstate *tstate;
857	u_int old_period;
858	u_int old_offset;
859
860	if (syncrate == NULL) {
861		period = 0;
862		offset = 0;
863	}
864
865	tinfo = ahc_fetch_transinfo(ahc, devinfo->channel, devinfo->our_scsiid,
866				    devinfo->target, &tstate);
867	old_period = tinfo->current.period;
868	old_offset = tinfo->current.offset;
869
870	if ((type & AHC_TRANS_CUR) != 0
871	 && (old_period != period || old_offset != offset)) {
872		struct	cam_path *path2;
873		u_int	scsirate;
874
875		scsirate = tinfo->scsirate;
876		if ((ahc->features & AHC_ULTRA2) != 0) {
877
878			scsirate &= ~SXFR_ULTRA2;
879
880			if (syncrate != NULL) {
881				scsirate |= syncrate->sxfr_ultra2;
882			}
883
884			if ((type & AHC_TRANS_ACTIVE) == AHC_TRANS_ACTIVE)
885				ahc_outb(ahc, SCSIOFFSET, offset);
886		} else {
887
888			scsirate &= ~(SXFR|SOFS);
889			/*
890			 * Ensure Ultra mode is set properly for
891			 * this target.
892			 */
893			tstate->ultraenb &= ~devinfo->target_mask;
894			if (syncrate != NULL) {
895				if (syncrate->sxfr & ULTRA_SXFR) {
896					tstate->ultraenb |=
897						devinfo->target_mask;
898				}
899				scsirate |= syncrate->sxfr & SXFR;
900				scsirate |= offset & SOFS;
901			}
902			if ((type & AHC_TRANS_ACTIVE) == AHC_TRANS_ACTIVE) {
903				u_int sxfrctl0;
904
905				sxfrctl0 = ahc_inb(ahc, SXFRCTL0);
906				sxfrctl0 &= ~FAST20;
907				if (tstate->ultraenb & devinfo->target_mask)
908					sxfrctl0 |= FAST20;
909				ahc_outb(ahc, SXFRCTL0, sxfrctl0);
910			}
911		}
912		if ((type & AHC_TRANS_ACTIVE) == AHC_TRANS_ACTIVE)
913			ahc_outb(ahc, SCSIRATE, scsirate);
914
915		tinfo->scsirate = scsirate;
916		tinfo->current.period = period;
917		tinfo->current.offset = offset;
918
919		/* Update the syncrates in any pending scbs */
920		ahc_update_pending_syncrates(ahc);
921
922		/*
923		 * If possible, tell the SCSI layer about the
924		 * new transfer parameters.
925		 */
926		/* If possible, update the XPT's notion of our transfer rate */
927		path2 = NULL;
928		if (path == NULL) {
929			int error;
930
931			error = ahc_create_path(ahc, devinfo, &path2);
932			if (error == CAM_REQ_CMP)
933				path = path2;
934			else
935				path2 = NULL;
936		}
937
938		if (path != NULL) {
939			struct	ccb_trans_settings neg;
940
941			neg.sync_period = period;
942			neg.sync_offset = offset;
943			neg.valid = CCB_TRANS_SYNC_RATE_VALID
944				  | CCB_TRANS_SYNC_OFFSET_VALID;
945			xpt_setup_ccb(&neg.ccb_h, path, /*priority*/1);
946			xpt_async(AC_TRANSFER_NEG, path, &neg);
947		}
948
949		if (path2 != NULL)
950			xpt_free_path(path2);
951
952		if (bootverbose) {
953			if (offset != 0) {
954				printf("%s: target %d synchronous at %sMHz, "
955				       "offset = 0x%x\n", ahc_name(ahc),
956				       devinfo->target, syncrate->rate, offset);
957			} else {
958				printf("%s: target %d using "
959				       "asynchronous transfers\n",
960				       ahc_name(ahc), devinfo->target);
961			}
962		}
963	}
964
965	if ((type & AHC_TRANS_GOAL) != 0) {
966		tinfo->goal.period = period;
967		tinfo->goal.offset = offset;
968	}
969
970	if ((type & AHC_TRANS_USER) != 0) {
971		tinfo->user.period = period;
972		tinfo->user.offset = offset;
973	}
974
975	ahc_update_target_msg_request(ahc, devinfo, tinfo, /*force*/FALSE);
976}
977
978static void
979ahc_set_width(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
980	      struct cam_path *path, u_int width, u_int type)
981{
982	struct ahc_initiator_tinfo *tinfo;
983	struct tmode_tstate *tstate;
984	u_int  oldwidth;
985
986	tinfo = ahc_fetch_transinfo(ahc, devinfo->channel, devinfo->our_scsiid,
987				    devinfo->target, &tstate);
988	oldwidth = tinfo->current.width;
989
990	if ((type & AHC_TRANS_CUR) != 0 && oldwidth != width) {
991		struct  cam_path *path2;
992		u_int	scsirate;
993
994		scsirate =  tinfo->scsirate;
995		scsirate &= ~WIDEXFER;
996		if (width == MSG_EXT_WDTR_BUS_16_BIT)
997			scsirate |= WIDEXFER;
998
999		tinfo->scsirate = scsirate;
1000
1001		if ((type & AHC_TRANS_ACTIVE) == AHC_TRANS_ACTIVE)
1002			ahc_outb(ahc, SCSIRATE, scsirate);
1003
1004		tinfo->current.width = width;
1005
1006		/* If possible, update the XPT's notion of our transfer rate */
1007		path2 = NULL;
1008		if (path == NULL) {
1009			int error;
1010
1011			error = ahc_create_path(ahc, devinfo, &path2);
1012			if (error == CAM_REQ_CMP)
1013				path = path2;
1014			else
1015				path2 = NULL;
1016		}
1017
1018		if (path != NULL) {
1019			struct	ccb_trans_settings neg;
1020
1021			neg.bus_width = width;
1022			neg.valid = CCB_TRANS_BUS_WIDTH_VALID;
1023			xpt_setup_ccb(&neg.ccb_h, path, /*priority*/1);
1024			xpt_async(AC_TRANSFER_NEG, path, &neg);
1025		}
1026
1027		if (path2 != NULL)
1028			xpt_free_path(path2);
1029
1030		if (bootverbose) {
1031			printf("%s: target %d using %dbit transfers\n",
1032			       ahc_name(ahc), devinfo->target,
1033			       8 * (0x01 << width));
1034		}
1035	}
1036	if ((type & AHC_TRANS_GOAL) != 0)
1037		tinfo->goal.width = width;
1038	if ((type & AHC_TRANS_USER) != 0)
1039		tinfo->user.width = width;
1040
1041	ahc_update_target_msg_request(ahc, devinfo, tinfo, /*force*/FALSE);
1042}
1043
1044static void
1045ahc_set_tags(struct ahc_softc *ahc, struct ahc_devinfo *devinfo, int enable)
1046{
1047	struct ahc_initiator_tinfo *tinfo;
1048	struct tmode_tstate *tstate;
1049
1050	tinfo = ahc_fetch_transinfo(ahc, devinfo->channel, devinfo->our_scsiid,
1051				    devinfo->target, &tstate);
1052
1053	if (enable)
1054		tstate->tagenable |= devinfo->target_mask;
1055	else
1056		tstate->tagenable &= ~devinfo->target_mask;
1057}
1058
1059/*
1060 * Attach all the sub-devices we can find
1061 */
1062int
1063ahc_attach(struct ahc_softc *ahc)
1064{
1065	struct ccb_setasync csa;
1066	struct cam_devq *devq;
1067	int bus_id;
1068	int bus_id2;
1069	struct cam_sim *sim;
1070	struct cam_sim *sim2;
1071	struct cam_path *path;
1072	struct cam_path *path2;
1073	int count;
1074
1075	count = 0;
1076	sim = NULL;
1077	sim2 = NULL;
1078
1079	/*
1080	 * Attach secondary channel first if the user has
1081	 * declared it the primary channel.
1082	 */
1083	if ((ahc->flags & AHC_CHANNEL_B_PRIMARY) != 0) {
1084		bus_id = 1;
1085		bus_id2 = 0;
1086	} else {
1087		bus_id = 0;
1088		bus_id2 = 1;
1089	}
1090
1091	/*
1092	 * Create the device queue for our SIM(s).
1093	 */
1094	devq = cam_simq_alloc(ahc->scb_data->maxscbs);
1095	if (devq == NULL)
1096		goto fail;
1097
1098	/*
1099	 * Construct our first channel SIM entry
1100	 */
1101	sim = cam_sim_alloc(ahc_action, ahc_poll, "ahc", ahc, ahc->unit,
1102			    1, ahc->scb_data->maxscbs, devq);
1103	if (sim == NULL) {
1104		cam_simq_free(devq);
1105		goto fail;
1106	}
1107
1108	if (xpt_bus_register(sim, bus_id) != CAM_SUCCESS) {
1109		cam_sim_free(sim, /*free_devq*/TRUE);
1110		sim = NULL;
1111		goto fail;
1112	}
1113
1114	if (xpt_create_path(&path, /*periph*/NULL,
1115			    cam_sim_path(sim), CAM_TARGET_WILDCARD,
1116			    CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
1117		xpt_bus_deregister(cam_sim_path(sim));
1118		cam_sim_free(sim, /*free_devq*/TRUE);
1119		sim = NULL;
1120		goto fail;
1121	}
1122
1123	xpt_setup_ccb(&csa.ccb_h, path, /*priority*/5);
1124	csa.ccb_h.func_code = XPT_SASYNC_CB;
1125	csa.event_enable = AC_LOST_DEVICE;
1126	csa.callback = ahc_async;
1127	csa.callback_arg = sim;
1128	xpt_action((union ccb *)&csa);
1129	count++;
1130
1131	if (ahc->features & AHC_TWIN) {
1132		sim2 = cam_sim_alloc(ahc_action, ahc_poll, "ahc",
1133				    ahc, ahc->unit, 1,
1134				    ahc->scb_data->maxscbs, devq);
1135
1136		if (sim2 == NULL) {
1137			printf("ahc_attach: Unable to attach second "
1138			       "bus due to resource shortage");
1139			goto fail;
1140		}
1141
1142		if (xpt_bus_register(sim2, bus_id2) != CAM_SUCCESS) {
1143			printf("ahc_attach: Unable to attach second "
1144			       "bus due to resource shortage");
1145			/*
1146			 * We do not want to destroy the device queue
1147			 * because the first bus is using it.
1148			 */
1149			cam_sim_free(sim2, /*free_devq*/FALSE);
1150			goto fail;
1151		}
1152
1153		if (xpt_create_path(&path2, /*periph*/NULL,
1154				    cam_sim_path(sim2),
1155				    CAM_TARGET_WILDCARD,
1156				    CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
1157			xpt_bus_deregister(cam_sim_path(sim2));
1158			cam_sim_free(sim2, /*free_devq*/FALSE);
1159			sim2 = NULL;
1160			goto fail;
1161		}
1162		xpt_setup_ccb(&csa.ccb_h, path2, /*priority*/5);
1163		csa.ccb_h.func_code = XPT_SASYNC_CB;
1164		csa.event_enable = AC_LOST_DEVICE;
1165		csa.callback = ahc_async;
1166		csa.callback_arg = sim2;
1167		xpt_action((union ccb *)&csa);
1168		count++;
1169	}
1170fail:
1171	if ((ahc->flags & AHC_CHANNEL_B_PRIMARY) != 0) {
1172		ahc->sim_b = sim;
1173		ahc->path_b = path;
1174		ahc->sim = sim2;
1175		ahc->path = path2;
1176	} else {
1177		ahc->sim = sim;
1178		ahc->path = path;
1179		ahc->sim_b = sim2;
1180		ahc->path_b = path2;
1181	}
1182	return (count);
1183}
1184
1185static void
1186ahc_scb_devinfo(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
1187		struct scb *scb)
1188{
1189	role_t	role;
1190	int	our_id;
1191
1192	if (scb->ccb->ccb_h.func_code == XPT_CONT_TARGET_IO) {
1193		our_id = scb->ccb->ccb_h.target_id;
1194		role = ROLE_TARGET;
1195	} else {
1196		our_id = SCB_CHANNEL(scb) == 'B' ? ahc->our_id_b : ahc->our_id;
1197		role = ROLE_INITIATOR;
1198	}
1199	ahc_compile_devinfo(devinfo, our_id, SCB_TARGET(scb),
1200			    SCB_LUN(scb), SCB_CHANNEL(scb), role);
1201}
1202
1203static void
1204ahc_fetch_devinfo(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
1205{
1206	u_int	saved_tcl;
1207	role_t	role;
1208	int	our_id;
1209
1210	if (ahc_inb(ahc, SSTAT0) & TARGET)
1211		role = ROLE_TARGET;
1212	else
1213		role = ROLE_INITIATOR;
1214
1215	if (role == ROLE_TARGET
1216	 && (ahc->features & AHC_MULTI_TID) != 0
1217	 && (ahc_inb(ahc, SEQ_FLAGS) & CMDPHASE_PENDING) != 0) {
1218		/* We were selected, so pull our id from TARGIDIN */
1219		our_id = ahc_inb(ahc, TARGIDIN) & OID;
1220	} else if ((ahc->features & AHC_ULTRA2) != 0)
1221		our_id = ahc_inb(ahc, SCSIID_ULTRA2) & OID;
1222	else
1223		our_id = ahc_inb(ahc, SCSIID) & OID;
1224
1225	saved_tcl = ahc_inb(ahc, SAVED_TCL);
1226	ahc_compile_devinfo(devinfo, our_id, TCL_TARGET(saved_tcl),
1227			    TCL_LUN(saved_tcl), TCL_CHANNEL(ahc, saved_tcl),
1228			    role);
1229}
1230
1231static void
1232ahc_compile_devinfo(struct ahc_devinfo *devinfo, u_int our_id, u_int target,
1233		    u_int lun, char channel, role_t role)
1234{
1235	devinfo->our_scsiid = our_id;
1236	devinfo->target = target;
1237	devinfo->lun = lun;
1238	devinfo->target_offset = target;
1239	devinfo->channel = channel;
1240	devinfo->role = role;
1241	if (channel == 'B')
1242		devinfo->target_offset += 8;
1243	devinfo->target_mask = (0x01 << devinfo->target_offset);
1244}
1245
1246/*
1247 * Catch an interrupt from the adapter
1248 */
1249void
1250ahc_intr(void *arg)
1251{
1252	struct	ahc_softc *ahc;
1253	u_int	intstat;
1254
1255	ahc = (struct ahc_softc *)arg;
1256
1257	intstat = ahc_inb(ahc, INTSTAT);
1258
1259	/*
1260	 * Any interrupts to process?
1261	 */
1262#if NPCI > 0
1263	if ((intstat & INT_PEND) == 0) {
1264		if ((ahc->chip & AHC_PCI) != 0
1265		 && (ahc->unsolicited_ints > 500)) {
1266			if ((ahc_inb(ahc, ERROR) & PCIERRSTAT) != 0)
1267				ahc_pci_intr(ahc);
1268			ahc->unsolicited_ints = 0;
1269		} else {
1270			ahc->unsolicited_ints++;
1271		}
1272		return;
1273	} else {
1274		ahc->unsolicited_ints = 0;
1275	}
1276#else
1277	if ((intstat & INT_PEND) == 0)
1278		return;
1279#endif
1280
1281	if (intstat & CMDCMPLT) {
1282		struct scb *scb;
1283		u_int  scb_index;
1284
1285		ahc_outb(ahc, CLRINT, CLRCMDINT);
1286		while (ahc->qoutfifo[ahc->qoutfifonext] != SCB_LIST_NULL) {
1287			scb_index = ahc->qoutfifo[ahc->qoutfifonext];
1288			ahc->qoutfifo[ahc->qoutfifonext++] = SCB_LIST_NULL;
1289
1290			scb = ahc->scb_data->scbarray[scb_index];
1291			if (!scb || !(scb->flags & SCB_ACTIVE)) {
1292				printf("%s: WARNING no command for scb %d "
1293				       "(cmdcmplt)\nQOUTPOS = %d\n",
1294				       ahc_name(ahc), scb_index,
1295				       ahc->qoutfifonext - 1);
1296				continue;
1297			}
1298
1299			/*
1300			 * Save off the residual
1301			 * if there is one.
1302			 */
1303			if (scb->hscb->residual_SG_count != 0)
1304				ahc_calc_residual(scb);
1305			ahc_done(ahc, scb);
1306		}
1307
1308		if ((ahc->flags & AHC_TARGETMODE) != 0) {
1309			ahc_run_tqinfifo(ahc);
1310		}
1311	}
1312	if (intstat & BRKADRINT) {
1313		/*
1314		 * We upset the sequencer :-(
1315		 * Lookup the error message
1316		 */
1317		int i, error, num_errors;
1318
1319		error = ahc_inb(ahc, ERROR);
1320		num_errors =  sizeof(hard_error)/sizeof(hard_error[0]);
1321		for (i = 0; error != 1 && i < num_errors; i++)
1322			error >>= 1;
1323		panic("%s: brkadrint, %s at seqaddr = 0x%x\n",
1324		      ahc_name(ahc), hard_error[i].errmesg,
1325		      ahc_inb(ahc, SEQADDR0) |
1326		      (ahc_inb(ahc, SEQADDR1) << 8));
1327
1328		/* Tell everyone that this HBA is no longer availible */
1329		ahc_abort_scbs(ahc, CAM_TARGET_WILDCARD, ALL_CHANNELS,
1330			       CAM_LUN_WILDCARD, SCB_LIST_NULL, CAM_NO_HBA);
1331	}
1332	if (intstat & SEQINT)
1333		ahc_handle_seqint(ahc, intstat);
1334
1335	if (intstat & SCSIINT)
1336		ahc_handle_scsiint(ahc, intstat);
1337}
1338
1339static struct tmode_tstate *
1340ahc_alloc_tstate(struct ahc_softc *ahc, u_int scsi_id, char channel)
1341{
1342	struct tmode_tstate *master_tstate;
1343	struct tmode_tstate *tstate;
1344	int i, s;
1345
1346	master_tstate = ahc->enabled_targets[ahc->our_id];
1347	if (channel == 'B') {
1348		scsi_id += 8;
1349		master_tstate = ahc->enabled_targets[ahc->our_id_b + 8];
1350	}
1351	if (ahc->enabled_targets[scsi_id] != NULL
1352	 && ahc->enabled_targets[scsi_id] != master_tstate)
1353		panic("%s: ahc_alloc_tstate - Target already allocated",
1354		      ahc_name(ahc));
1355	tstate = malloc(sizeof(*tstate), M_DEVBUF, M_NOWAIT);
1356	if (tstate == NULL)
1357		return (NULL);
1358
1359	/*
1360	 * If we have allocated a master tstate, copy user settings from
1361	 * the master tstate (taken from SRAM or the EEPROM) for this
1362	 * channel, but reset our current and goal settings to async/narrow
1363	 * until an initiator talks to us.
1364	 */
1365	if (master_tstate != NULL) {
1366		bcopy(master_tstate, tstate, sizeof(*tstate));
1367		bzero(tstate->enabled_luns, sizeof(tstate->enabled_luns));
1368		tstate->ultraenb = 0;
1369		for (i = 0; i < 16; i++) {
1370			bzero(&tstate->transinfo[i].current,
1371			      sizeof(tstate->transinfo[i].current));
1372			bzero(&tstate->transinfo[i].goal,
1373			      sizeof(tstate->transinfo[i].goal));
1374		}
1375	} else
1376		bzero(tstate, sizeof(*tstate));
1377	s = splcam();
1378	ahc->enabled_targets[scsi_id] = tstate;
1379	splx(s);
1380	return (tstate);
1381}
1382
1383static void
1384ahc_free_tstate(struct ahc_softc *ahc, u_int scsi_id, char channel, int force)
1385{
1386	struct tmode_tstate *tstate;
1387
1388	/* Don't clean up the entry for our initiator role */
1389	if ((ahc->flags & AHC_INITIATORMODE) != 0
1390	 && ((channel == 'B' && scsi_id == ahc->our_id_b)
1391	  || (channel == 'A' && scsi_id == ahc->our_id))
1392	 && force == FALSE)
1393		return;
1394
1395	if (channel == 'B')
1396		scsi_id += 8;
1397	tstate = ahc->enabled_targets[scsi_id];
1398	if (tstate != NULL)
1399		free(tstate, M_DEVBUF);
1400	ahc->enabled_targets[scsi_id] = NULL;
1401}
1402
1403static void
1404ahc_handle_en_lun(struct ahc_softc *ahc, struct cam_sim *sim, union ccb *ccb)
1405{
1406	struct	   tmode_tstate *tstate;
1407	struct	   tmode_lstate *lstate;
1408	struct	   ccb_en_lun *cel;
1409	cam_status status;
1410	int	   target;
1411	int	   lun;
1412	u_int	   target_mask;
1413	char	   channel;
1414	int	   s;
1415
1416	status = ahc_find_tmode_devs(ahc, sim, ccb, &tstate, &lstate,
1417				     /* notfound_failure*/FALSE);
1418
1419	if (status != CAM_REQ_CMP) {
1420		ccb->ccb_h.status = status;
1421		return;
1422	}
1423
1424	cel = &ccb->cel;
1425	target = ccb->ccb_h.target_id;
1426	lun = ccb->ccb_h.target_lun;
1427	channel = SIM_CHANNEL(ahc, sim);
1428	target_mask = 0x01 << target;
1429	if (channel == 'B')
1430		target_mask <<= 8;
1431
1432	if (cel->enable != 0) {
1433		u_int scsiseq;
1434
1435		/* Are we already enabled?? */
1436		if (lstate != NULL) {
1437			printf("Lun already enabled\n");
1438			ccb->ccb_h.status = CAM_LUN_ALRDY_ENA;
1439			return;
1440		}
1441
1442		if (cel->grp6_len != 0
1443		 || cel->grp7_len != 0) {
1444			/*
1445			 * Don't (yet?) support vendor
1446			 * specific commands.
1447			 */
1448			ccb->ccb_h.status = CAM_REQ_INVALID;
1449			printf("Non-zero Group Codes\n");
1450			return;
1451		}
1452
1453		/*
1454		 * Seems to be okay.
1455		 * Setup our data structures.
1456		 */
1457		if (target != CAM_TARGET_WILDCARD && tstate == NULL) {
1458			tstate = ahc_alloc_tstate(ahc, target, channel);
1459			if (tstate == NULL) {
1460				printf("Couldn't allocate tstate\n");
1461				ccb->ccb_h.status = CAM_RESRC_UNAVAIL;
1462				return;
1463			}
1464		}
1465		lstate = malloc(sizeof(*lstate), M_DEVBUF, M_NOWAIT);
1466		if (lstate == NULL) {
1467			printf("Couldn't allocate lstate\n");
1468			ccb->ccb_h.status = CAM_RESRC_UNAVAIL;
1469			return;
1470		}
1471		bzero(lstate, sizeof(*lstate));
1472		SLIST_INIT(&lstate->accept_tios);
1473		SLIST_INIT(&lstate->immed_notifies);
1474		s = splcam();
1475		pause_sequencer(ahc);
1476		if (target != CAM_TARGET_WILDCARD) {
1477			tstate->enabled_luns[lun] = lstate;
1478			ahc->enabled_luns++;
1479
1480			if ((ahc->features & AHC_MULTI_TID) != 0) {
1481				u_int16_t targid_mask;
1482
1483				targid_mask = ahc_inb(ahc, TARGID)
1484					    | (ahc_inb(ahc, TARGID + 1) << 8);
1485
1486				targid_mask |= target_mask;
1487				ahc_outb(ahc, TARGID, targid_mask);
1488				ahc_outb(ahc, TARGID+1, (targid_mask >> 8));
1489			} else {
1490				int our_id;
1491				char  channel;
1492
1493				channel = SIM_CHANNEL(ahc, sim);
1494				our_id = SIM_SCSI_ID(ahc, sim);
1495
1496				/*
1497				 * This can only happen if selections
1498				 * are not enabled
1499				 */
1500				if (target != our_id) {
1501					u_int sblkctl;
1502					char  cur_channel;
1503					int   swap;
1504
1505					sblkctl = ahc_inb(ahc, SBLKCTL);
1506					cur_channel = (sblkctl & SELBUSB)
1507						    ? 'B' : 'A';
1508					if ((ahc->features & AHC_TWIN) == 0)
1509						cur_channel = 'A';
1510					swap = cur_channel != channel;
1511					if (channel == 'A')
1512						ahc->our_id = target;
1513					else
1514						ahc->our_id_b = target;
1515
1516					if (swap)
1517						ahc_outb(ahc, SBLKCTL,
1518							 sblkctl ^ SELBUSB);
1519
1520					ahc_outb(ahc, SCSIID, target);
1521
1522					if (swap)
1523						ahc_outb(ahc, SBLKCTL, sblkctl);
1524				}
1525			}
1526		} else
1527			ahc->black_hole = lstate;
1528		/* Allow select-in operations */
1529		if (ahc->black_hole != NULL && ahc->enabled_luns > 0) {
1530			scsiseq = ahc_inb(ahc, SCSISEQ_TEMPLATE);
1531			scsiseq |= ENSELI;
1532			ahc_outb(ahc, SCSISEQ_TEMPLATE, scsiseq);
1533			scsiseq = ahc_inb(ahc, SCSISEQ);
1534			scsiseq |= ENSELI;
1535			ahc_outb(ahc, SCSISEQ, scsiseq);
1536		}
1537		unpause_sequencer(ahc, /*always?*/FALSE);
1538		splx(s);
1539		ccb->ccb_h.status = CAM_REQ_CMP;
1540		xpt_print_path(ccb->ccb_h.path);
1541		printf("Lun now enabled for target mode\n");
1542	} else {
1543		struct ccb_hdr *elm;
1544
1545		if (lstate == NULL) {
1546			ccb->ccb_h.status = CAM_LUN_INVALID;
1547			return;
1548		}
1549
1550		s = splcam();
1551		ccb->ccb_h.status = CAM_REQ_CMP;
1552		LIST_FOREACH(elm, &ahc->pending_ccbs, sim_links.le) {
1553			if (elm->func_code == XPT_CONT_TARGET_IO
1554			 && !xpt_path_comp(elm->path, ccb->ccb_h.path)){
1555				printf("CTIO pending\n");
1556				ccb->ccb_h.status = CAM_REQ_INVALID;
1557				splx(s);
1558				return;
1559			}
1560		}
1561
1562		if (SLIST_FIRST(&lstate->accept_tios) != NULL) {
1563			printf("ATIOs pending\n");
1564			ccb->ccb_h.status = CAM_REQ_INVALID;
1565		}
1566
1567		if (SLIST_FIRST(&lstate->immed_notifies) != NULL) {
1568			printf("INOTs pending\n");
1569			ccb->ccb_h.status = CAM_REQ_INVALID;
1570		}
1571
1572		if (ccb->ccb_h.status == CAM_REQ_CMP) {
1573			int i, empty;
1574
1575			xpt_print_path(ccb->ccb_h.path);
1576			printf("Target mode disabled\n");
1577			free(lstate, M_DEVBUF);
1578
1579			pause_sequencer(ahc);
1580			/* Can we clean up the target too? */
1581			if (target != CAM_TARGET_WILDCARD) {
1582				tstate->enabled_luns[lun] = NULL;
1583				ahc->enabled_luns--;
1584				for (empty = 1, i = 0; i < 8; i++)
1585					if (tstate->enabled_luns[i] != NULL) {
1586						empty = 0;
1587						break;
1588					}
1589
1590				if (empty) {
1591					ahc_free_tstate(ahc, target, channel,
1592							/*force*/FALSE);
1593					if (ahc->features & AHC_MULTI_TID) {
1594						u_int16_t targid_mask;
1595
1596						targid_mask =
1597						    ahc_inb(ahc, TARGID)
1598						    | (ahc_inb(ahc, TARGID + 1)
1599						       << 8);
1600
1601						targid_mask &= ~target_mask;
1602						ahc_outb(ahc, TARGID,
1603							 targid_mask);
1604						ahc_outb(ahc, TARGID+1,
1605						 	 (targid_mask >> 8));
1606					}
1607				}
1608			} else {
1609
1610				ahc->black_hole = NULL;
1611
1612				/*
1613				 * We can't allow selections without
1614				 * our black hole device.
1615				 */
1616				empty = TRUE;
1617			}
1618			if (ahc->enabled_luns == 0) {
1619				/* Disallow select-in */
1620				u_int scsiseq;
1621
1622				scsiseq = ahc_inb(ahc, SCSISEQ_TEMPLATE);
1623				scsiseq &= ~ENSELI;
1624				ahc_outb(ahc, SCSISEQ_TEMPLATE, scsiseq);
1625				scsiseq = ahc_inb(ahc, SCSISEQ);
1626				scsiseq &= ~ENSELI;
1627				ahc_outb(ahc, SCSISEQ, scsiseq);
1628			}
1629			unpause_sequencer(ahc, /*always?*/FALSE);
1630		}
1631		splx(s);
1632	}
1633}
1634
1635static int
1636ahc_handle_target_cmd(struct ahc_softc *ahc, struct target_cmd *cmd)
1637{
1638	struct	  tmode_tstate *tstate;
1639	struct	  tmode_lstate *lstate;
1640	struct	  ccb_accept_tio *atio;
1641	u_int8_t *byte;
1642	int	  initiator;
1643	int	  target;
1644	int	  lun;
1645
1646	initiator = cmd->initiator_channel >> 4;
1647	target = cmd->targ_id;
1648	lun    = (cmd->identify & MSG_IDENTIFY_LUNMASK);
1649
1650	byte = cmd->bytes;
1651	tstate = ahc->enabled_targets[target];
1652	lstate = NULL;
1653	if (tstate != NULL && lun < 8)
1654		lstate = tstate->enabled_luns[lun];
1655
1656	/*
1657	 * Commands for disabled luns go to the black hole driver.
1658	 */
1659	if (lstate == NULL) {
1660		lstate = ahc->black_hole;
1661		atio =
1662		    (struct ccb_accept_tio*)SLIST_FIRST(&lstate->accept_tios);
1663	} else {
1664		atio =
1665		    (struct ccb_accept_tio*)SLIST_FIRST(&lstate->accept_tios);
1666	}
1667	if (atio == NULL) {
1668		ahc->flags |= AHC_TQINFIFO_BLOCKED;
1669		printf("No ATIOs for incoming command\n");
1670		/*
1671		 * Wait for more ATIOs from the peripheral driver for this lun.
1672		 */
1673		return (1);
1674	} else
1675		ahc->flags &= ~AHC_TQINFIFO_BLOCKED;
1676	SLIST_REMOVE_HEAD(&lstate->accept_tios, sim_links.sle);
1677
1678	if (lstate == ahc->black_hole) {
1679		/* Fill in the wildcards */
1680		atio->ccb_h.target_id = target;
1681		atio->ccb_h.target_lun = lun;
1682	}
1683
1684	/*
1685	 * Package it up and send it off to
1686	 * whomever has this lun enabled.
1687	 */
1688	atio->init_id = initiator;
1689	if (byte[0] != 0xFF) {
1690		/* Tag was included */
1691		atio->tag_action = *byte++;
1692		atio->tag_id = *byte++;
1693		atio->ccb_h.flags = CAM_TAG_ACTION_VALID;
1694	} else {
1695		byte++;
1696		atio->ccb_h.flags = 0;
1697	}
1698
1699	/* Okay.  Now determine the cdb size based on the command code */
1700	switch (*byte >> CMD_GROUP_CODE_SHIFT) {
1701	case 0:
1702		atio->cdb_len = 6;
1703		break;
1704	case 1:
1705	case 2:
1706		atio->cdb_len = 10;
1707		break;
1708	case 4:
1709		atio->cdb_len = 16;
1710		break;
1711	case 5:
1712		atio->cdb_len = 12;
1713		break;
1714	case 3:
1715	default:
1716		/* Only copy the opcode. */
1717		atio->cdb_len = 1;
1718		printf("Reserved or VU command code type encountered\n");
1719		break;
1720	}
1721	bcopy(byte, atio->cdb_io.cdb_bytes, atio->cdb_len);
1722
1723	atio->ccb_h.status |= CAM_CDB_RECVD;
1724
1725	if ((cmd->identify & MSG_IDENTIFY_DISCFLAG) == 0) {
1726		/*
1727		 * We weren't allowed to disconnect.
1728		 * We're hanging on the bus until a
1729		 * continue target I/O comes in response
1730		 * to this accept tio.
1731		 */
1732#if 0
1733		printf("Received Immediate Command %d:%d:%d - %p\n",
1734		       initiator, target, lun, ahc->pending_device);
1735#endif
1736		ahc->pending_device = lstate;
1737	}
1738	xpt_done((union ccb*)atio);
1739	return (0);
1740}
1741
1742static void
1743ahc_handle_seqint(struct ahc_softc *ahc, u_int intstat)
1744{
1745	struct scb *scb;
1746	struct ahc_devinfo devinfo;
1747
1748	ahc_fetch_devinfo(ahc, &devinfo);
1749
1750	/*
1751	 * Clear the upper byte that holds SEQINT status
1752	 * codes and clear the SEQINT bit. We will unpause
1753	 * the sequencer, if appropriate, after servicing
1754	 * the request.
1755	 */
1756	ahc_outb(ahc, CLRINT, CLRSEQINT);
1757	switch (intstat & SEQINT_MASK) {
1758	case NO_MATCH:
1759	{
1760		/* Ensure we don't leave the selection hardware on */
1761		ahc_outb(ahc, SCSISEQ,
1762			 ahc_inb(ahc, SCSISEQ) & (ENSELI|ENRSELI|ENAUTOATNP));
1763
1764		printf("%s:%c:%d: no active SCB for reconnecting "
1765		       "target - issuing BUS DEVICE RESET\n",
1766		       ahc_name(ahc), devinfo.channel, devinfo.target);
1767		printf("SAVED_TCL == 0x%x, ARG_1 == 0x%x, SEQ_FLAGS == 0x%x\n",
1768		       ahc_inb(ahc, SAVED_TCL), ahc_inb(ahc, ARG_1),
1769		       ahc_inb(ahc, SEQ_FLAGS));
1770		break;
1771	}
1772	case SEND_REJECT:
1773	{
1774		u_int rejbyte = ahc_inb(ahc, ACCUM);
1775		printf("%s:%c:%d: Warning - unknown message received from "
1776		       "target (0x%x).  Rejecting\n",
1777		       ahc_name(ahc), devinfo.channel, devinfo.target, rejbyte);
1778		break;
1779	}
1780	case NO_IDENT:
1781	{
1782		/*
1783		 * The reconnecting target either did not send an identify
1784		 * message, or did, but we didn't find and SCB to match and
1785		 * before it could respond to our ATN/abort, it hit a dataphase.
1786		 * The only safe thing to do is to blow it away with a bus
1787		 * reset.
1788		 */
1789		int found;
1790
1791		printf("%s:%c:%d: Target did not send an IDENTIFY message. "
1792		       "LASTPHASE = 0x%x, SAVED_TCL == 0x%x\n",
1793		       ahc_name(ahc), devinfo.channel, devinfo.target,
1794		       ahc_inb(ahc, LASTPHASE), ahc_inb(ahc, SAVED_TCL));
1795		found = ahc_reset_channel(ahc, devinfo.channel,
1796					  /*initiate reset*/TRUE);
1797		printf("%s: Issued Channel %c Bus Reset. "
1798		       "%d SCBs aborted\n", ahc_name(ahc), devinfo.channel,
1799		       found);
1800		break;
1801	}
1802	case BAD_PHASE:
1803		if (ahc_inb(ahc, LASTPHASE) == P_BUSFREE) {
1804			printf("%s:%c:%d: Missed busfree.\n", ahc_name(ahc),
1805			       devinfo.channel, devinfo.target);
1806			restart_sequencer(ahc);
1807			return;
1808		} else {
1809			printf("%s:%c:%d: unknown scsi bus phase.  Attempting "
1810			       "to continue\n", ahc_name(ahc), devinfo.channel,
1811			       devinfo.target);
1812		}
1813		break;
1814	case BAD_STATUS:
1815	{
1816		u_int  scb_index;
1817		struct hardware_scb *hscb;
1818		struct ccb_scsiio *csio;
1819		/*
1820		 * The sequencer will notify us when a command
1821		 * has an error that would be of interest to
1822		 * the kernel.  This allows us to leave the sequencer
1823		 * running in the common case of command completes
1824		 * without error.  The sequencer will already have
1825		 * dma'd the SCB back up to us, so we can reference
1826		 * the in kernel copy directly.
1827		 */
1828		scb_index = ahc_inb(ahc, SCB_TAG);
1829		scb = ahc->scb_data->scbarray[scb_index];
1830		hscb = scb->hscb;
1831
1832		/*
1833		 * Set the default return value to 0 (don't
1834		 * send sense).  The sense code will change
1835		 * this if needed.
1836		 */
1837		ahc_outb(ahc, RETURN_1, 0);
1838		if (!(scb && (scb->flags & SCB_ACTIVE))) {
1839			printf("%s:%c:%d: ahc_intr - referenced scb "
1840			       "not valid during seqint 0x%x scb(%d)\n",
1841			       ahc_name(ahc), devinfo.channel,
1842			       devinfo.target, intstat, scb_index);
1843			goto unpause;
1844		}
1845
1846		/* Don't want to clobber the original sense code */
1847		if ((scb->flags & SCB_SENSE) != 0) {
1848			/*
1849			 * Clear the SCB_SENSE Flag and have
1850			 * the sequencer do a normal command
1851			 * complete.
1852			 */
1853			scb->flags &= ~SCB_SENSE;
1854			ahc_set_ccb_status(scb->ccb, CAM_AUTOSENSE_FAIL);
1855			break;
1856		}
1857		ahc_set_ccb_status(scb->ccb, CAM_SCSI_STATUS_ERROR);
1858		csio = &scb->ccb->csio;
1859		csio->scsi_status = hscb->status;
1860		switch (hscb->status) {
1861		case SCSI_STATUS_OK:
1862			printf("%s: Interrupted for staus of 0???\n",
1863			       ahc_name(ahc));
1864			break;
1865		case SCSI_STATUS_CMD_TERMINATED:
1866		case SCSI_STATUS_CHECK_COND:
1867#ifdef AHC_DEBUG
1868			if (ahc_debug & AHC_SHOWSENSE) {
1869				xpt_print_path(csio->ccb_h.path);
1870				printf("SCB %d: requests Check Status\n",
1871				       scb->hscb->tag);
1872			}
1873#endif
1874
1875			if ((csio->ccb_h.flags & CAM_DIS_AUTOSENSE) == 0) {
1876				struct ahc_dma_seg *sg = scb->ahc_dma;
1877				struct scsi_sense *sc =
1878					(struct scsi_sense *)(&hscb->cmdstore);
1879				struct ahc_initiator_tinfo *tinfo;
1880				struct tmode_tstate *tstate;
1881
1882				/*
1883				 * Save off the residual if there is one.
1884				 */
1885				if (hscb->residual_SG_count != 0)
1886					ahc_calc_residual(scb);
1887
1888#ifdef AHC_DEBUG
1889				if (ahc_debug & AHC_SHOWSENSE) {
1890					xpt_print_path(csio->ccb_h.path);
1891					printf("Sending Sense\n");
1892				}
1893#endif
1894				/*
1895				 * bzero from the sense data before having
1896				 * the drive fill it.  The SCSI spec mandates
1897				 * that any untransfered data should be
1898				 * assumed to be zero.
1899				 */
1900				bzero(&csio->sense_data,
1901				      sizeof(csio->sense_data));
1902				sc->opcode = REQUEST_SENSE;
1903				sc->byte2 =  SCB_LUN(scb) << 5;
1904				sc->unused[0] = 0;
1905				sc->unused[1] = 0;
1906				sc->length = csio->sense_len;
1907				sc->control = 0;
1908
1909				sg->addr = vtophys(&csio->sense_data);
1910				sg->len = csio->sense_len;
1911
1912				/*
1913				 * Would be nice to preserve DISCENB here,
1914				 * but due to the way we page SCBs, we can't.
1915				 */
1916				hscb->control = 0;
1917
1918				/*
1919				 * This request sense could be because the
1920				 * the device lost power or in some other
1921				 * way has lost our transfer negotiations.
1922				 * Renegotiate if appropriate.
1923				 */
1924				tinfo = ahc_fetch_transinfo(ahc,
1925							    devinfo.channel,
1926							    devinfo.our_scsiid,
1927							    devinfo.target,
1928							    &tstate);
1929				ahc_update_target_msg_request(ahc, &devinfo,
1930							      tinfo,
1931							      /*force*/TRUE);
1932				hscb->status = 0;
1933				hscb->SG_count = 1;
1934				hscb->SG_pointer = scb->ahc_dmaphys;
1935				hscb->data = sg->addr;
1936				hscb->datalen = sg->len;
1937				hscb->cmdpointer = hscb->cmdstore_busaddr;
1938				hscb->cmdlen = sizeof(*sc);
1939				scb->sg_count = hscb->SG_count;
1940				scb->flags |= SCB_SENSE;
1941				/*
1942				 * Ensure the target is busy since this
1943				 * will be an untagged request.
1944				 */
1945				ahc_busy_tcl(ahc, scb);
1946				ahc_outb(ahc, RETURN_1, SEND_SENSE);
1947
1948				/*
1949				 * Ensure we have enough time to actually
1950				 * retrieve the sense.
1951				 */
1952				untimeout(ahc_timeout, (caddr_t)scb,
1953					  scb->ccb->ccb_h.timeout_ch);
1954				scb->ccb->ccb_h.timeout_ch =
1955				    timeout(ahc_timeout, (caddr_t)scb, 5 * hz);
1956				/* Freeze the queue while the sense occurs. */
1957				ahc_freeze_devq(ahc, scb->ccb->ccb_h.path);
1958				ahc_freeze_ccb(scb->ccb);
1959				break;
1960			}
1961			break;
1962		case SCSI_STATUS_BUSY:
1963		case SCSI_STATUS_QUEUE_FULL:
1964			/*
1965			 * Requeue any transactions that haven't been
1966			 * sent yet.
1967			 */
1968			ahc_freeze_devq(ahc, scb->ccb->ccb_h.path);
1969			ahc_freeze_ccb(scb->ccb);
1970			break;
1971		}
1972		break;
1973	}
1974	case TRACE_POINT:
1975	{
1976		printf("SSTAT2 = 0x%x DFCNTRL = 0x%x\n", ahc_inb(ahc, SSTAT2),
1977		       ahc_inb(ahc, DFCNTRL));
1978		printf("SSTAT3 = 0x%x DSTATUS = 0x%x\n", ahc_inb(ahc, SSTAT3),
1979		       ahc_inb(ahc, DFSTATUS));
1980		printf("SSTAT0 = 0x%x, SCB_DATACNT = 0x%x\n",
1981		       ahc_inb(ahc, SSTAT0),
1982		       ahc_inb(ahc, SCB_DATACNT));
1983		break;
1984	}
1985	case TARGET_MSG_HELP:
1986	{
1987		/*
1988		 * XXX Handle BDR, Abort, Abort Tag, and transfer negotiations.
1989		 */
1990		restart_sequencer(ahc);
1991		return;
1992	}
1993	case HOST_MSG_LOOP:
1994	{
1995		/*
1996		 * The sequencer has encountered a message phase
1997		 * that requires host assistance for completion.
1998		 * While handling the message phase(s), we will be
1999		 * notified by the sequencer after each byte is
2000		 * transfered so we can track bus phases.
2001		 *
2002		 * If this is the first time we've seen a HOST_MSG_LOOP,
2003		 * initialize the state of the host message loop.
2004		 */
2005		if (ahc->msg_type == MSG_TYPE_NONE) {
2006			u_int bus_phase;
2007
2008			bus_phase = ahc_inb(ahc, SCSISIGI) & PHASE_MASK;
2009			if (bus_phase != P_MESGIN && bus_phase != P_MESGOUT)
2010				panic("ahc_intr: HOST_MSG_LOOP bad phase 0x%x",
2011				      bus_phase);
2012
2013			if (devinfo.role == ROLE_INITIATOR) {
2014				struct scb *scb;
2015				u_int scb_index;
2016
2017				scb_index = ahc_inb(ahc, SCB_TAG);
2018				scb = ahc->scb_data->scbarray[scb_index];
2019
2020				if (bus_phase == P_MESGOUT)
2021					ahc_setup_initiator_msgout(ahc,
2022								   &devinfo,
2023								   scb);
2024				else {
2025					ahc->msg_type =
2026					    MSG_TYPE_INITIATOR_MSGIN;
2027					ahc->msgin_index = 0;
2028				}
2029			} else {
2030				if (bus_phase == P_MESGOUT) {
2031					ahc->msg_type =
2032					    MSG_TYPE_TARGET_MSGOUT;
2033					ahc->msgin_index = 0;
2034				} else
2035					/* XXX Ever executed??? */
2036					ahc_setup_target_msgin(ahc, &devinfo);
2037			}
2038		}
2039
2040		/* Pass a NULL path so that handlers generate their own */
2041		ahc_handle_message_phase(ahc, /*path*/NULL);
2042		break;
2043	}
2044	case DATA_OVERRUN:
2045	{
2046		/*
2047		 * When the sequencer detects an overrun, it
2048		 * places the controller in "BITBUCKET" mode
2049		 * and allows the target to complete its transfer.
2050		 * Unfortunately, none of the counters get updated
2051		 * when the controller is in this mode, so we have
2052		 * no way of knowing how large the overrun was.
2053		 */
2054		u_int scbindex = ahc_inb(ahc, SCB_TAG);
2055		u_int lastphase = ahc_inb(ahc, LASTPHASE);
2056		int i;
2057
2058		scb = ahc->scb_data->scbarray[scbindex];
2059		xpt_print_path(scb->ccb->ccb_h.path);
2060		printf("data overrun detected in %s phase."
2061		       "  Tag == 0x%x.\n",
2062		       lastphase == P_DATAIN ? "Data-In" : "Data-Out",
2063		       scb->hscb->tag);
2064		xpt_print_path(scb->ccb->ccb_h.path);
2065		printf("%s seen Data Phase.  Length = %d.  NumSGs = %d.\n",
2066		       ahc_inb(ahc, SEQ_FLAGS) & DPHASE ? "Have" : "Haven't",
2067		       scb->ccb->csio.dxfer_len, scb->sg_count);
2068		if (scb->sg_count > 0) {
2069			for (i = 0; i < scb->sg_count - 1; i++) {
2070				printf("sg[%d] - Addr 0x%x : Length %d\n",
2071				       i,
2072				       scb->ahc_dma[i].addr,
2073				       scb->ahc_dma[i].len);
2074			}
2075		}
2076		/*
2077		 * Set this and it will take affect when the
2078		 * target does a command complete.
2079		 */
2080		ahc_freeze_devq(ahc, scb->ccb->ccb_h.path);
2081		ahc_set_ccb_status(scb->ccb, CAM_DATA_RUN_ERR);
2082		ahc_freeze_ccb(scb->ccb);
2083		break;
2084	}
2085	case TRACEPOINT:
2086	{
2087		printf("TRACEPOINT: RETURN_2 = %d\n", ahc_inb(ahc, RETURN_2));
2088#if 0
2089		printf("SSTAT1 == 0x%x\n", ahc_inb(ahc, SSTAT1));
2090		printf("SSTAT0 == 0x%x\n", ahc_inb(ahc, SSTAT0));
2091		printf(", SCSISIGI == 0x%x\n", ahc_inb(ahc, SCSISIGI));
2092		printf("TRACEPOINT: CCHCNT = %d, SG_COUNT = %d\n",
2093		       ahc_inb(ahc, CCHCNT), ahc_inb(ahc, SG_COUNT));
2094		printf("TRACEPOINT: SCB_TAG = %d\n", ahc_inb(ahc, SCB_TAG));
2095		printf("TRACEPOINT1: CCHADDR = %d, CCHCNT = %d, SCBPTR = %d\n",
2096		       ahc_inb(ahc, CCHADDR)
2097		    | (ahc_inb(ahc, CCHADDR+1) << 8)
2098		    | (ahc_inb(ahc, CCHADDR+2) << 16)
2099		    | (ahc_inb(ahc, CCHADDR+3) << 24),
2100		       ahc_inb(ahc, CCHCNT)
2101		    | (ahc_inb(ahc, CCHCNT+1) << 8)
2102		    | (ahc_inb(ahc, CCHCNT+2) << 16),
2103		       ahc_inb(ahc, SCBPTR));
2104		printf("TRACEPOINT: WAITING_SCBH = %d\n", ahc_inb(ahc, WAITING_SCBH));
2105		printf("TRACEPOINT: SCB_TAG = %d\n", ahc_inb(ahc, SCB_TAG));
2106#endif
2107		break;
2108	}
2109#if NOT_YET
2110	/* XXX Fill these in later */
2111	case MESG_BUFFER_BUSY:
2112		break;
2113	case MSGIN_PHASEMIS:
2114		break;
2115#endif
2116	default:
2117		printf("ahc_intr: seqint, "
2118		       "intstat == 0x%x, scsisigi = 0x%x\n",
2119		       intstat, ahc_inb(ahc, SCSISIGI));
2120		break;
2121	}
2122
2123unpause:
2124	/*
2125	 *  The sequencer is paused immediately on
2126	 *  a SEQINT, so we should restart it when
2127	 *  we're done.
2128	 */
2129	unpause_sequencer(ahc, /*unpause_always*/TRUE);
2130}
2131
2132static void
2133ahc_handle_scsiint(struct ahc_softc *ahc, u_int intstat)
2134{
2135	u_int	scb_index;
2136	u_int	status;
2137	struct	scb *scb;
2138	char	cur_channel;
2139	char	intr_channel;
2140
2141	if ((ahc->features & AHC_TWIN) != 0
2142	 && ((ahc_inb(ahc, SBLKCTL) & SELBUSB) != 0))
2143		cur_channel = 'B';
2144	else
2145		cur_channel = 'A';
2146	intr_channel = cur_channel;
2147
2148	status = ahc_inb(ahc, SSTAT1);
2149	if (status == 0) {
2150		if ((ahc->features & AHC_TWIN) != 0) {
2151			/* Try the other channel */
2152		 	ahc_outb(ahc, SBLKCTL, ahc_inb(ahc, SBLKCTL) ^ SELBUSB);
2153			status = ahc_inb(ahc, SSTAT1);
2154		 	ahc_outb(ahc, SBLKCTL, ahc_inb(ahc, SBLKCTL) ^ SELBUSB);
2155			intr_channel = (cur_channel == 'A') ? 'B' : 'A';
2156		}
2157		if (status == 0) {
2158			printf("%s: Spurious SCSI interrupt\n", ahc_name(ahc));
2159			return;
2160		}
2161	}
2162
2163	scb_index = ahc_inb(ahc, SCB_TAG);
2164	if (scb_index < ahc->scb_data->numscbs) {
2165		scb = ahc->scb_data->scbarray[scb_index];
2166		if ((scb->flags & SCB_ACTIVE) == 0)
2167			scb = NULL;
2168	} else
2169		scb = NULL;
2170
2171	if ((status & SCSIRSTI) != 0) {
2172		printf("%s: Someone reset channel %c\n",
2173			ahc_name(ahc), intr_channel);
2174		ahc_reset_channel(ahc, intr_channel, /* Initiate Reset */FALSE);
2175	} else if ((status & BUSFREE) != 0 && (status & SELTO) == 0) {
2176		/*
2177		 * First look at what phase we were last in.
2178		 * If its message out, chances are pretty good
2179		 * that the busfree was in response to one of
2180		 * our abort requests.
2181		 */
2182		u_int lastphase = ahc_inb(ahc, LASTPHASE);
2183		u_int saved_tcl = ahc_inb(ahc, SAVED_TCL);
2184		u_int target = (saved_tcl >> 4) & 0x0f;
2185		char channel = saved_tcl & SELBUSB ? 'B': 'A';
2186		int printerror = 1;
2187
2188		ahc_outb(ahc, SCSISEQ,
2189			 ahc_inb(ahc, SCSISEQ) & (ENSELI|ENRSELI|ENAUTOATNP));
2190		if (lastphase == P_MESGOUT) {
2191			u_int message;
2192			u_int tag;
2193
2194			message = ahc_inb(ahc, SINDEX);
2195
2196			tag = SCB_LIST_NULL;
2197			switch (message) {
2198			case MSG_ABORT_TAG:
2199				tag = scb->hscb->tag;
2200				/* FALLTRHOUGH */
2201			case MSG_ABORT:
2202				xpt_print_path(scb->ccb->ccb_h.path);
2203				printf("SCB %d - Abort %s Completed.\n",
2204				       scb->hscb->tag, tag == SCB_LIST_NULL ?
2205				       "" : "Tag");
2206				if ((scb->flags & SCB_RECOVERY_SCB) != 0) {
2207					ahc_set_ccb_status(scb->ccb,
2208							   CAM_REQ_ABORTED);
2209					ahc_done(ahc, scb);
2210				}
2211				printerror = 0;
2212				break;
2213			case MSG_BUS_DEV_RESET:
2214			{
2215				struct ahc_devinfo devinfo;
2216
2217				ahc_scb_devinfo(ahc, &devinfo, scb);
2218				ahc_handle_devreset(ahc, &devinfo,
2219						    CAM_BDR_SENT, AC_SENT_BDR,
2220						    "Bus Device Reset",
2221						    /*verbose_only*/FALSE);
2222				printerror = 0;
2223				break;
2224			}
2225			default:
2226				break;
2227			}
2228		}
2229		if (printerror != 0) {
2230			if (scb != NULL) {
2231				u_int tag;
2232
2233				if ((scb->hscb->control & TAG_ENB) != 0)
2234					tag = scb->hscb->tag;
2235				else
2236					tag = SCB_LIST_NULL;
2237				ahc_abort_scbs(ahc, target, channel,
2238					       SCB_LUN(scb), tag,
2239					       CAM_UNEXP_BUSFREE);
2240			} else {
2241				ahc_abort_scbs(ahc, target, channel,
2242					       CAM_LUN_WILDCARD, SCB_LIST_NULL,
2243					       CAM_UNEXP_BUSFREE);
2244				printf("%s: ", ahc_name(ahc));
2245			}
2246			printf("Unexpected busfree.  LASTPHASE == 0x%x\n"
2247			       "SEQADDR == 0x%x\n",
2248			       lastphase, ahc_inb(ahc, SEQADDR0)
2249				| (ahc_inb(ahc, SEQADDR1) << 8));
2250		}
2251		ahc_clear_msg_state(ahc);
2252		ahc_outb(ahc, SIMODE1, ahc_inb(ahc, SIMODE1) & ~ENBUSFREE);
2253		ahc_outb(ahc, CLRSINT1, CLRBUSFREE);
2254		ahc_outb(ahc, CLRINT, CLRSCSIINT);
2255		restart_sequencer(ahc);
2256	} else if ((status & SELTO) != 0) {
2257		u_int scbptr;
2258
2259		scbptr = ahc_inb(ahc, WAITING_SCBH);
2260		ahc_outb(ahc, SCBPTR, scbptr);
2261		scb_index = ahc_inb(ahc, SCB_TAG);
2262
2263		if (scb_index < ahc->scb_data->numscbs) {
2264			scb = ahc->scb_data->scbarray[scb_index];
2265			if ((scb->flags & SCB_ACTIVE) == 0)
2266				scb = NULL;
2267		} else
2268			scb = NULL;
2269
2270		if (scb == NULL) {
2271			printf("%s: ahc_intr - referenced scb not "
2272			       "valid during SELTO scb(%d, %d)\n",
2273			       ahc_name(ahc), scbptr, scb_index);
2274		} else {
2275			struct ahc_devinfo devinfo;
2276
2277			ahc_scb_devinfo(ahc, &devinfo, scb);
2278			ahc_handle_devreset(ahc, &devinfo, CAM_SEL_TIMEOUT,
2279					    /*ac_code*/0, "Selection Timeout",
2280					    /*verbose_only*/TRUE);
2281		}
2282		/* Stop the selection */
2283		ahc_outb(ahc, SCSISEQ, 0);
2284
2285		ahc_clear_msg_state(ahc);
2286
2287		ahc_outb(ahc, CLRSINT1, CLRSELTIMEO|CLRBUSFREE);
2288
2289		ahc_outb(ahc, CLRINT, CLRSCSIINT);
2290
2291		restart_sequencer(ahc);
2292	} else if (scb == NULL) {
2293		printf("%s: ahc_intr - referenced scb not "
2294		       "valid during scsiint 0x%x scb(%d)\n"
2295		       "SIMODE0 = 0x%x, SIMODE1 = 0x%x, SSTAT0 = 0x%x\n"
2296		       "SEQADDR = 0x%x\n", ahc_name(ahc),
2297			status, scb_index, ahc_inb(ahc, SIMODE0),
2298			ahc_inb(ahc, SIMODE1), ahc_inb(ahc, SSTAT0),
2299			ahc_inb(ahc, SEQADDR0) | (ahc_inb(ahc, SEQADDR1) << 8));
2300		ahc_outb(ahc, CLRSINT1, status);
2301		ahc_outb(ahc, CLRINT, CLRSCSIINT);
2302		unpause_sequencer(ahc, /*unpause_always*/TRUE);
2303		scb = NULL;
2304	} else if ((status & SCSIPERR) != 0) {
2305		/*
2306		 * Determine the bus phase and
2307		 * queue an appropriate message
2308		 */
2309		char *phase;
2310		u_int mesg_out = MSG_NOOP;
2311		u_int lastphase = ahc_inb(ahc, LASTPHASE);
2312
2313		xpt_print_path(scb->ccb->ccb_h.path);
2314
2315		switch (lastphase) {
2316		case P_DATAOUT:
2317			phase = "Data-Out";
2318			break;
2319		case P_DATAIN:
2320			phase = "Data-In";
2321			mesg_out = MSG_INITIATOR_DET_ERR;
2322			break;
2323		case P_COMMAND:
2324			phase = "Command";
2325			break;
2326		case P_MESGOUT:
2327			phase = "Message-Out";
2328			break;
2329		case P_STATUS:
2330			phase = "Status";
2331			mesg_out = MSG_INITIATOR_DET_ERR;
2332			break;
2333		case P_MESGIN:
2334			phase = "Message-In";
2335			mesg_out = MSG_PARITY_ERROR;
2336			break;
2337		default:
2338			phase = "unknown";
2339			break;
2340		}
2341		printf("parity error during %s phase.\n", phase);
2342
2343		printf("SEQADDR == 0x%x\n", ahc_inb(ahc, SEQADDR0)
2344				 | (ahc_inb(ahc, SEQADDR1) << 8));
2345
2346		printf("SCSIRATE == 0x%x\n", ahc_inb(ahc, SCSIRATE));
2347
2348		/*
2349		 * We've set the hardware to assert ATN if we
2350		 * get a parity error on "in" phases, so all we
2351		 * need to do is stuff the message buffer with
2352		 * the appropriate message.  "In" phases have set
2353		 * mesg_out to something other than MSG_NOP.
2354		 */
2355		if (mesg_out != MSG_NOOP) {
2356			if (ahc->msg_type != MSG_TYPE_NONE)
2357				ahc->send_msg_perror = TRUE;
2358			else
2359				ahc_outb(ahc, MSG_OUT, mesg_out);
2360		}
2361		ahc_outb(ahc, CLRSINT1, CLRSCSIPERR);
2362		ahc_outb(ahc, CLRINT, CLRSCSIINT);
2363		unpause_sequencer(ahc, /*unpause_always*/TRUE);
2364	} else {
2365		xpt_print_path(scb->ccb->ccb_h.path);
2366		printf("Unknown SCSIINT. Status = 0x%x\n", status);
2367		ahc_outb(ahc, CLRSINT1, status);
2368		ahc_outb(ahc, CLRINT, CLRSCSIINT);
2369		unpause_sequencer(ahc, /*unpause_always*/TRUE);
2370	}
2371}
2372
2373static void
2374ahc_build_transfer_msg(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
2375{
2376	/*
2377	 * We need to initiate transfer negotiations.
2378	 * If our current and goal settings are identical,
2379	 * we want to renegotiate due to a check condition.
2380	 */
2381	struct	ahc_initiator_tinfo *tinfo;
2382	struct	tmode_tstate *tstate;
2383	int	dowide;
2384	int	dosync;
2385
2386	tinfo = ahc_fetch_transinfo(ahc, devinfo->channel, devinfo->our_scsiid,
2387				    devinfo->target, &tstate);
2388	dowide = tinfo->current.width != tinfo->goal.width;
2389	dosync = tinfo->current.period != tinfo->goal.period;
2390
2391	if (!dowide && !dosync) {
2392		dowide = tinfo->goal.width != MSG_EXT_WDTR_BUS_8_BIT;
2393		dosync = tinfo->goal.period != 0;
2394	}
2395
2396	if (dowide)
2397		ahc_construct_wdtr(ahc, tinfo->goal.width);
2398	else if (dosync) {
2399		struct	ahc_syncrate *rate;
2400		u_int	period;
2401		u_int	offset;
2402
2403		period = tinfo->goal.period;
2404		rate = ahc_devlimited_syncrate(ahc, &period);
2405		offset = tinfo->goal.offset;
2406		ahc_validate_offset(ahc, rate, &offset,
2407				    tinfo->current.width);
2408		ahc_construct_sdtr(ahc, period, offset);
2409	} else {
2410		panic("ahc_intr: AWAITING_MSG for negotiation, "
2411		      "but no negotiation needed\n");
2412	}
2413}
2414
2415static void
2416ahc_setup_initiator_msgout(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
2417			   struct scb *scb)
2418{
2419	/*
2420	 * To facilitate adding multiple messages together,
2421	 * each routine should increment the index and len
2422	 * variables instead of setting them explicitly.
2423	 */
2424	ahc->msgout_index = 0;
2425	ahc->msgout_len = 0;
2426
2427	if ((scb->flags & SCB_DEVICE_RESET) == 0
2428	 && ahc_inb(ahc, MSG_OUT) == MSG_IDENTIFYFLAG) {
2429		u_int identify_msg;
2430
2431		identify_msg = MSG_IDENTIFYFLAG | SCB_LUN(scb);
2432		if ((scb->hscb->control & DISCENB) != 0)
2433			identify_msg |= MSG_IDENTIFY_DISCFLAG;
2434		ahc->msgout_buf[ahc->msgout_index++] = identify_msg;
2435		ahc->msgout_len++;
2436
2437		if ((scb->hscb->control & TAG_ENB) != 0) {
2438			ahc->msgout_buf[ahc->msgout_index++] =
2439			    scb->ccb->csio.tag_action;
2440			ahc->msgout_buf[ahc->msgout_index++] = scb->hscb->tag;
2441			ahc->msgout_len += 2;
2442		}
2443	}
2444
2445	if (scb->flags & SCB_DEVICE_RESET) {
2446		ahc->msgout_buf[ahc->msgout_index++] = MSG_BUS_DEV_RESET;
2447		ahc->msgout_len++;
2448		xpt_print_path(scb->ccb->ccb_h.path);
2449		printf("Bus Device Reset Message Sent\n");
2450	} else if (scb->flags & SCB_ABORT) {
2451		if ((scb->hscb->control & TAG_ENB) != 0)
2452			ahc->msgout_buf[ahc->msgout_index++] = MSG_ABORT_TAG;
2453		else
2454			ahc->msgout_buf[ahc->msgout_index++] = MSG_ABORT;
2455		ahc->msgout_len++;
2456		xpt_print_path(scb->ccb->ccb_h.path);
2457		printf("Abort Message Sent\n");
2458	} else if ((ahc->targ_msg_req & devinfo->target_mask) != 0) {
2459		ahc_build_transfer_msg(ahc, devinfo);
2460	} else {
2461		printf("ahc_intr: AWAITING_MSG for an SCB that "
2462		       "does not have a waiting message");
2463		panic("SCB = %d, SCB Control = %x, MSG_OUT = %x "
2464		      "SCB flags = %x", scb->hscb->tag, scb->hscb->control,
2465		      ahc_inb(ahc, MSG_OUT), scb->flags);
2466	}
2467
2468	/*
2469	 * Clear the MK_MESSAGE flag from the SCB so we aren't
2470	 * asked to send this message again.
2471	 */
2472	ahc_outb(ahc, SCB_CONTROL, ahc_inb(ahc, SCB_CONTROL) & ~MK_MESSAGE);
2473	ahc->msgout_index = 0;
2474	ahc->msg_type = MSG_TYPE_INITIATOR_MSGOUT;
2475}
2476
2477static void
2478ahc_setup_target_msgin(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
2479{
2480	/*
2481	 * To facilitate adding multiple messages together,
2482	 * each routine should increment the index and len
2483	 * variables instead of setting them explicitly.
2484	 */
2485	ahc->msgout_index = 0;
2486	ahc->msgout_len = 0;
2487
2488	if ((ahc->targ_msg_req & devinfo->target_mask) != 0)
2489		ahc_build_transfer_msg(ahc, devinfo);
2490	else
2491		panic("ahc_intr: AWAITING target message with no message");
2492
2493	ahc->msgout_index = 0;
2494	ahc->msg_type = MSG_TYPE_TARGET_MSGIN;
2495}
2496
2497static int
2498ahc_handle_msg_reject(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
2499{
2500	/*
2501	 * What we care about here is if we had an
2502	 * outstanding SDTR or WDTR message for this
2503	 * target.  If we did, this is a signal that
2504	 * the target is refusing negotiation.
2505	 */
2506	struct scb *scb;
2507	u_int scb_index;
2508	u_int last_msg;
2509	int   response = 0;
2510
2511	scb_index = ahc_inb(ahc, SCB_TAG);
2512	scb = ahc->scb_data->scbarray[scb_index];
2513
2514	/* Might be necessary */
2515	last_msg = ahc_inb(ahc, LAST_MSG);
2516
2517	if (ahc_sent_msg(ahc, MSG_EXT_WDTR, /*full*/FALSE)) {
2518		struct ahc_initiator_tinfo *tinfo;
2519		struct tmode_tstate *tstate;
2520
2521		/* note 8bit xfers and clear flag */
2522		printf("%s:%c:%d: refuses WIDE negotiation.  Using "
2523		       "8bit transfers\n", ahc_name(ahc),
2524		       devinfo->channel, devinfo->target);
2525		ahc_set_width(ahc, devinfo, scb->ccb->ccb_h.path,
2526			      MSG_EXT_WDTR_BUS_8_BIT,
2527			      AHC_TRANS_ACTIVE|AHC_TRANS_GOAL);
2528		ahc_set_syncrate(ahc, devinfo, scb->ccb->ccb_h.path,
2529				 /*syncrate*/NULL, /*period*/0,
2530				 /*offset*/0, AHC_TRANS_ACTIVE);
2531		tinfo = ahc_fetch_transinfo(ahc, devinfo->channel,
2532					    devinfo->our_scsiid,
2533					    devinfo->target, &tstate);
2534		if (tinfo->goal.period) {
2535			u_int period;
2536
2537			/* Start the sync negotiation */
2538			period = tinfo->goal.period;
2539			ahc_devlimited_syncrate(ahc, &period);
2540			ahc->msgout_index = 0;
2541			ahc->msgout_len = 0;
2542			ahc_construct_sdtr(ahc, period, tinfo->goal.offset);
2543			ahc->msgout_index = 0;
2544			response = 1;
2545		}
2546	} else if (ahc_sent_msg(ahc, MSG_EXT_SDTR, /*full*/FALSE)) {
2547		/* note asynch xfers and clear flag */
2548		ahc_set_syncrate(ahc, devinfo, scb->ccb->ccb_h.path,
2549				 /*syncrate*/NULL, /*period*/0,
2550				 /*offset*/0,
2551				 AHC_TRANS_ACTIVE|AHC_TRANS_GOAL);
2552		printf("%s:%c:%d: refuses synchronous negotiation. "
2553		       "Using asynchronous transfers\n",
2554		       ahc_name(ahc),
2555		       devinfo->channel, devinfo->target);
2556	} else if ((scb->hscb->control & MSG_SIMPLE_Q_TAG) != 0) {
2557		struct	ccb_trans_settings neg;
2558
2559		printf("%s:%c:%d: refuses tagged commands.  Performing "
2560		       "non-tagged I/O\n", ahc_name(ahc),
2561		       devinfo->channel, devinfo->target);
2562
2563		ahc_set_tags(ahc, devinfo, FALSE);
2564		neg.flags = 0;
2565		neg.valid = CCB_TRANS_TQ_VALID;
2566		xpt_setup_ccb(&neg.ccb_h, scb->ccb->ccb_h.path, /*priority*/1);
2567		xpt_async(AC_TRANSFER_NEG, scb->ccb->ccb_h.path, &neg);
2568
2569		/*
2570		 * Resend the identify for this CCB as the target
2571		 * may believe that the selection is invalid otherwise.
2572		 */
2573		ahc_outb(ahc, SCB_CONTROL, ahc_inb(ahc, SCB_CONTROL)
2574					  & ~MSG_SIMPLE_Q_TAG);
2575	 	scb->hscb->control &= ~MSG_SIMPLE_Q_TAG;
2576		scb->ccb->ccb_h.flags &= ~CAM_TAG_ACTION_VALID;
2577		ahc_outb(ahc, MSG_OUT, MSG_IDENTIFYFLAG);
2578		ahc_outb(ahc, SCSISIGO, ahc_inb(ahc, SCSISIGO) | ATNO);
2579
2580		/*
2581		 * Requeue all tagged commands for this target
2582		 * currently in our posession so they can be
2583		 * converted to untagged commands.
2584		 */
2585		ahc_search_qinfifo(ahc, SCB_TARGET(scb), SCB_CHANNEL(scb),
2586				   SCB_LUN(scb), /*tag*/SCB_LIST_NULL,
2587				   CAM_REQUEUE_REQ, SEARCH_COMPLETE);
2588	} else {
2589		/*
2590		 * Otherwise, we ignore it.
2591		 */
2592		printf("%s:%c:%d: Message reject for %x -- ignored\n",
2593		       ahc_name(ahc), devinfo->channel, devinfo->target,
2594		       last_msg);
2595	}
2596	return (response);
2597}
2598
2599static void
2600ahc_clear_msg_state(struct ahc_softc *ahc)
2601{
2602	ahc->msgout_len = 0;
2603	ahc->msgin_index = 0;
2604	ahc->msg_type = MSG_TYPE_NONE;
2605	ahc_outb(ahc, MSG_OUT, MSG_NOOP);
2606}
2607
2608static void
2609ahc_handle_message_phase(struct ahc_softc *ahc, struct cam_path *path)
2610{
2611	struct	ahc_devinfo devinfo;
2612	u_int	bus_phase;
2613	int	end_session;
2614
2615	ahc_fetch_devinfo(ahc, &devinfo);
2616
2617
2618	end_session = FALSE;
2619	bus_phase = ahc_inb(ahc, SCSISIGI) & PHASE_MASK;
2620
2621reswitch:
2622	switch (ahc->msg_type) {
2623	case MSG_TYPE_INITIATOR_MSGOUT:
2624	{
2625		int lastbyte;
2626		int phasemis;
2627		int msgdone;
2628
2629		if (ahc->msgout_len == 0)
2630			panic("REQINIT interrupt with no active message");
2631
2632		phasemis = bus_phase != P_MESGOUT;
2633		if (phasemis) {
2634			if (bus_phase == P_MESGIN) {
2635				/*
2636				 * Change gears and see if
2637				 * this messages is of interest to
2638				 * us or should be passed back to
2639				 * the sequencer.
2640				 */
2641				ahc_outb(ahc, CLRSINT1, CLRATNO);
2642				ahc->send_msg_perror = FALSE;
2643				ahc->msg_type = MSG_TYPE_INITIATOR_MSGIN;
2644				ahc->msgin_index = 0;
2645				goto reswitch;
2646			}
2647			end_session = TRUE;
2648			break;
2649		}
2650
2651		if (ahc->send_msg_perror) {
2652			ahc_outb(ahc, CLRSINT1, CLRATNO);
2653			ahc_outb(ahc, CLRSINT1, CLRREQINIT);
2654			ahc_outb(ahc, SCSIDATL, MSG_PARITY_ERROR);
2655			break;
2656		}
2657
2658		msgdone	= ahc->msgout_index == ahc->msgout_len;
2659		if (msgdone) {
2660			/*
2661			 * The target has requested a retry.
2662			 * Re-assert ATN, reset our message index to
2663			 * 0, and try again.
2664			 */
2665			ahc->msgout_index = 0;
2666			ahc_outb(ahc, SCSISIGO, ahc_inb(ahc, SCSISIGO) | ATNO);
2667		}
2668
2669		lastbyte = ahc->msgout_index == (ahc->msgout_len - 1);
2670		if (lastbyte) {
2671			/* Last byte is signified by dropping ATN */
2672			ahc_outb(ahc, CLRSINT1, CLRATNO);
2673		}
2674
2675		/*
2676		 * Clear our interrupt status and present
2677		 * the next byte on the bus.
2678		 */
2679		ahc_outb(ahc, CLRSINT1, CLRREQINIT);
2680		ahc_outb(ahc, SCSIDATL, ahc->msgout_buf[ahc->msgout_index++]);
2681		break;
2682	}
2683	case MSG_TYPE_INITIATOR_MSGIN:
2684	{
2685		int phasemis;
2686		int message_done;
2687
2688		phasemis = bus_phase != P_MESGIN;
2689
2690		if (phasemis) {
2691			ahc->msgin_index = 0;
2692			if (bus_phase == P_MESGOUT
2693			 && (ahc->send_msg_perror == TRUE
2694			  || (ahc->msgout_len != 0
2695			   && ahc->msgout_index == 0))) {
2696				ahc->msg_type = MSG_TYPE_INITIATOR_MSGOUT;
2697				goto reswitch;
2698			}
2699			end_session = TRUE;
2700			break;
2701		}
2702
2703		/* Pull the byte in without acking it */
2704		ahc->msgin_buf[ahc->msgin_index] = ahc_inb(ahc, SCSIBUSL);
2705
2706		message_done = ahc_parse_msg(ahc, path, &devinfo);
2707
2708		if (message_done) {
2709			/*
2710			 * Clear our incoming message buffer in case there
2711			 * is another message following this one.
2712			 */
2713			ahc->msgin_index = 0;
2714
2715			/*
2716			 * If this message illicited a response,
2717			 * assert ATN so the target takes us to the
2718			 * message out phase.
2719			 */
2720			if (ahc->msgout_len != 0)
2721				ahc_outb(ahc, SCSISIGO,
2722					 ahc_inb(ahc, SCSISIGO) | ATNO);
2723		}
2724
2725		/* Ack the byte */
2726		ahc_outb(ahc, CLRSINT1, CLRREQINIT);
2727		ahc_inb(ahc, SCSIDATL);
2728		ahc->msgin_index++;
2729		break;
2730	}
2731	case MSG_TYPE_TARGET_MSGIN:
2732	{
2733		int msgdone;
2734		int msgout_request;
2735
2736		if (ahc->msgout_len == 0)
2737			panic("Target MSGIN with no active message");
2738
2739		/*
2740		 * If we interrupted a mesgout session, the initiator
2741		 * will not know this until our first REQ.  So, we
2742		 * only honor mesgout requests after we've sent our
2743		 * first byte.
2744		 */
2745		if ((ahc_inb(ahc, SCSISIGI) & ATNI) != 0
2746		 && ahc->msgout_index > 0)
2747			msgout_request = TRUE;
2748		else
2749			msgout_request = FALSE;
2750
2751		if (msgout_request) {
2752
2753			/*
2754			 * Change gears and see if
2755			 * this messages is of interest to
2756			 * us or should be passed back to
2757			 * the sequencer.
2758			 */
2759			ahc->msg_type = MSG_TYPE_TARGET_MSGOUT;
2760			ahc_outb(ahc, SCSISIGO, P_MESGOUT | BSYO);
2761			ahc->msgin_index = 0;
2762			/* Dummy read to REQ for first byte */
2763			ahc_inb(ahc, SCSIDATL);
2764			ahc_outb(ahc, SXFRCTL0,
2765				 ahc_inb(ahc, SXFRCTL0) | SPIOEN);
2766			break;
2767		}
2768
2769		msgdone = ahc->msgout_index == ahc->msgout_len;
2770		if (msgdone) {
2771			ahc_outb(ahc, SXFRCTL0,
2772				 ahc_inb(ahc, SXFRCTL0) & ~SPIOEN);
2773			end_session = TRUE;
2774			break;
2775		}
2776
2777		/*
2778		 * Present the next byte on the bus.
2779		 */
2780		ahc_outb(ahc, SXFRCTL0, ahc_inb(ahc, SXFRCTL0) | SPIOEN);
2781		ahc_outb(ahc, SCSIDATL, ahc->msgout_buf[ahc->msgout_index++]);
2782		break;
2783	}
2784	case MSG_TYPE_TARGET_MSGOUT:
2785	{
2786		int lastbyte;
2787		int msgdone;
2788
2789		/*
2790		 * The initiator signals that this is
2791		 * the last byte by dropping ATN.
2792		 */
2793		lastbyte = (ahc_inb(ahc, SCSISIGI) & ATNI) == 0;
2794
2795		/*
2796		 * Read the latched byte, but turn off SPIOEN first
2797		 * so that we don't inadvertantly cause a REQ for the
2798		 * next byte.
2799		 */
2800		ahc_outb(ahc, SXFRCTL0, ahc_inb(ahc, SXFRCTL0) & ~SPIOEN);
2801		ahc->msgin_buf[ahc->msgin_index] = ahc_inb(ahc, SCSIDATL);
2802		msgdone = ahc_parse_msg(ahc, path, &devinfo);
2803		ahc->msgin_index++;
2804
2805		/*
2806		 * XXX Read spec about initiator dropping ATN too soon
2807		 *     and use msgdone to detect it.
2808		 */
2809		if (msgdone) {
2810			ahc->msgin_index = 0;
2811
2812			/*
2813			 * If this message illicited a response, transition
2814			 * to the Message in phase and send it.
2815			 */
2816			if (ahc->msgout_len != 0) {
2817				ahc_outb(ahc, SCSISIGO, P_MESGIN | BSYO);
2818				ahc_outb(ahc, SXFRCTL0,
2819					 ahc_inb(ahc, SXFRCTL0) | SPIOEN);
2820				ahc->msg_type = MSG_TYPE_TARGET_MSGIN;
2821				ahc->msgin_index = 0;
2822				break;
2823			}
2824		}
2825
2826		if (lastbyte)
2827			end_session = TRUE;
2828		else {
2829			/* Ask for the next byte. */
2830			ahc_outb(ahc, SXFRCTL0,
2831				 ahc_inb(ahc, SXFRCTL0) | SPIOEN);
2832		}
2833
2834		break;
2835	}
2836	default:
2837		panic("Unknown REQINIT message type");
2838	}
2839
2840	if (end_session) {
2841		ahc_clear_msg_state(ahc);
2842		ahc_outb(ahc, RETURN_1, EXIT_MSG_LOOP);
2843	} else
2844		ahc_outb(ahc, RETURN_1, CONT_MSG_LOOP);
2845}
2846
2847/*
2848 * See if we sent a particular extended message to the target.
2849 * If "full" is true, the target saw the full message.
2850 * If "full" is false, the target saw at least the first
2851 * byte of the message.
2852 */
2853static int
2854ahc_sent_msg(struct ahc_softc *ahc, u_int msgtype, int full)
2855{
2856	int found;
2857	int index;
2858
2859	found = FALSE;
2860	index = 0;
2861
2862	while (index < ahc->msgout_len) {
2863		if ((ahc->msgout_buf[index] & MSG_IDENTIFYFLAG) != 0
2864		 || ahc->msgout_buf[index] == MSG_MESSAGE_REJECT)
2865			index++;
2866		else if (ahc->msgout_buf[index] >= MSG_SIMPLE_Q_TAG
2867		      && ahc->msgout_buf[index] < MSG_IGN_WIDE_RESIDUE) {
2868			/* Skip tag type and tag id */
2869			index += 2;
2870		} else if (ahc->msgout_buf[index] == MSG_EXTENDED) {
2871			/* Found a candidate */
2872			if (ahc->msgout_buf[index+2] == msgtype) {
2873				u_int end_index;
2874
2875				end_index = index + 1
2876					  + ahc->msgout_buf[index + 1];
2877				if (full) {
2878					if (ahc->msgout_index > end_index)
2879						found = TRUE;
2880				} else if (ahc->msgout_index > index)
2881					found = TRUE;
2882			}
2883			break;
2884		} else {
2885			panic("ahc_sent_msg: Inconsistent msg buffer");
2886		}
2887	}
2888	return (found);
2889}
2890
2891static int
2892ahc_parse_msg(struct ahc_softc *ahc, struct cam_path *path,
2893	      struct ahc_devinfo *devinfo)
2894{
2895	struct	ahc_initiator_tinfo *tinfo;
2896	struct	tmode_tstate *tstate;
2897	int	reject;
2898	int	done;
2899	int	response;
2900	u_int	targ_scsirate;
2901
2902	done = FALSE;
2903	response = FALSE;
2904	reject = FALSE;
2905	tinfo = ahc_fetch_transinfo(ahc, devinfo->channel, devinfo->our_scsiid,
2906				    devinfo->target, &tstate);
2907	targ_scsirate = tinfo->scsirate;
2908
2909	/*
2910	 * Parse as much of the message as is availible,
2911	 * rejecting it if we don't support it.  When
2912	 * the entire message is availible and has been
2913	 * handled, return TRUE indicating that we have
2914	 * parsed an entire message.
2915	 *
2916	 * In the case of extended messages, we accept the length
2917	 * byte outright and perform more checking once we know the
2918	 * extended message type.
2919	 */
2920	switch (ahc->msgin_buf[0]) {
2921	case MSG_MESSAGE_REJECT:
2922		response = ahc_handle_msg_reject(ahc, devinfo);
2923		/* FALLTHROUGH */
2924	case MSG_NOOP:
2925		done = TRUE;
2926		break;
2927	case MSG_IGN_WIDE_RESIDUE:
2928	{
2929		/* Wait for the whole message */
2930		if (ahc->msgin_index >= 1) {
2931			if (ahc->msgin_buf[1] != 1
2932			 || tinfo->current.width == MSG_EXT_WDTR_BUS_8_BIT) {
2933				reject = TRUE;
2934				done = TRUE;
2935			} else
2936				ahc_handle_ign_wide_residue(ahc, devinfo);
2937		}
2938		break;
2939	}
2940	case MSG_EXTENDED:
2941	{
2942		/* Wait for enough of the message to begin validation */
2943		if (ahc->msgin_index < 2)
2944			break;
2945		switch (ahc->msgin_buf[2]) {
2946		case MSG_EXT_SDTR:
2947		{
2948			struct	 ahc_syncrate *syncrate;
2949			u_int	 period;
2950			u_int	 offset;
2951			u_int	 saved_offset;
2952
2953			if (ahc->msgin_buf[1] != MSG_EXT_SDTR_LEN) {
2954				reject = TRUE;
2955				break;
2956			}
2957
2958			/*
2959			 * Wait until we have both args before validating
2960			 * and acting on this message.
2961			 *
2962			 * Add one to MSG_EXT_SDTR_LEN to account for
2963			 * the extended message preamble.
2964			 */
2965			if (ahc->msgin_index < (MSG_EXT_SDTR_LEN + 1))
2966				break;
2967
2968			period = ahc->msgin_buf[3];
2969			saved_offset = offset = ahc->msgin_buf[4];
2970			syncrate = ahc_devlimited_syncrate(ahc, &period);
2971			ahc_validate_offset(ahc, syncrate, &offset,
2972					    targ_scsirate & WIDEXFER);
2973			ahc_set_syncrate(ahc, devinfo, path,
2974					 syncrate, period, offset,
2975					 AHC_TRANS_ACTIVE|AHC_TRANS_GOAL);
2976
2977			/*
2978			 * See if we initiated Sync Negotiation
2979			 * and didn't have to fall down to async
2980			 * transfers.
2981			 */
2982			if (ahc_sent_msg(ahc, MSG_EXT_SDTR, /*full*/TRUE)) {
2983				/* We started it */
2984				if (saved_offset != offset) {
2985					/* Went too low - force async */
2986					reject = TRUE;
2987				}
2988			} else {
2989				/*
2990				 * Send our own SDTR in reply
2991				 */
2992				if (bootverbose)
2993					printf("Sending SDTR!\n");
2994				ahc->msgout_index = 0;
2995				ahc->msgout_len = 0;
2996				ahc_construct_sdtr(ahc, period, offset);
2997				ahc->msgout_index = 0;
2998				response = TRUE;
2999			}
3000			done = TRUE;
3001			break;
3002		}
3003		case MSG_EXT_WDTR:
3004		{
3005			u_int	bus_width;
3006			u_int	sending_reply;
3007
3008			sending_reply = FALSE;
3009			if (ahc->msgin_buf[1] != MSG_EXT_WDTR_LEN) {
3010				reject = TRUE;
3011				break;
3012			}
3013
3014			/*
3015			 * Wait until we have our arg before validating
3016			 * and acting on this message.
3017			 *
3018			 * Add one to MSG_EXT_WDTR_LEN to account for
3019			 * the extended message preamble.
3020			 */
3021			if (ahc->msgin_index < (MSG_EXT_WDTR_LEN + 1))
3022				break;
3023
3024			/*
3025			 * Due to a problem with sync/wide transfers
3026			 * on the aic7880 only allow this on Ultra2
3027			 * controllers for the moment.
3028			 */
3029			if (devinfo->role == ROLE_TARGET
3030			 && (ahc->features & AHC_ULTRA2) == 0) {
3031				reject = TRUE;
3032				break;
3033			}
3034
3035			bus_width = ahc->msgin_buf[3];
3036			if (ahc_sent_msg(ahc, MSG_EXT_WDTR, /*full*/TRUE)) {
3037				/*
3038				 * Don't send a WDTR back to the
3039				 * target, since we asked first.
3040				 */
3041				switch (bus_width){
3042				default:
3043					/*
3044					 * How can we do anything greater
3045					 * than 16bit transfers on a 16bit
3046					 * bus?
3047					 */
3048					reject = TRUE;
3049					printf("%s: target %d requested %dBit "
3050					       "transfers.  Rejecting...\n",
3051					       ahc_name(ahc), devinfo->target,
3052					       8 * (0x01 << bus_width));
3053					/* FALLTHROUGH */
3054				case MSG_EXT_WDTR_BUS_8_BIT:
3055					bus_width = MSG_EXT_WDTR_BUS_8_BIT;
3056					break;
3057				case MSG_EXT_WDTR_BUS_16_BIT:
3058					break;
3059				}
3060			} else {
3061				/*
3062				 * Send our own WDTR in reply
3063				 */
3064				if (bootverbose)
3065					printf("Sending WDTR!\n");
3066				switch (bus_width) {
3067				default:
3068					if (ahc->features & AHC_WIDE) {
3069						/* Respond Wide */
3070						bus_width =
3071						    MSG_EXT_WDTR_BUS_16_BIT;
3072						break;
3073					}
3074					/* FALLTHROUGH */
3075				case MSG_EXT_WDTR_BUS_8_BIT:
3076					bus_width = MSG_EXT_WDTR_BUS_8_BIT;
3077					break;
3078				}
3079				ahc->msgout_index = 0;
3080				ahc->msgout_len = 0;
3081				ahc_construct_wdtr(ahc, bus_width);
3082				ahc->msgout_index = 0;
3083				response = TRUE;
3084				sending_reply = TRUE;
3085			}
3086			ahc_set_width(ahc, devinfo, path, bus_width,
3087				      AHC_TRANS_ACTIVE|AHC_TRANS_GOAL);
3088
3089			/* After a wide message, we are async */
3090			ahc_set_syncrate(ahc, devinfo, path,
3091					 /*syncrate*/NULL, /*period*/0,
3092					 /*offset*/0, AHC_TRANS_ACTIVE);
3093			if (sending_reply == FALSE && reject == FALSE) {
3094
3095				if (tinfo->goal.period) {
3096					struct	ahc_syncrate *rate;
3097					u_int	period;
3098					u_int	offset;
3099
3100					/* Start the sync negotiation */
3101					period = tinfo->goal.period;
3102					rate = ahc_devlimited_syncrate(ahc,
3103								       &period);
3104					offset = tinfo->goal.offset;
3105					ahc_validate_offset(ahc, rate, &offset,
3106							  tinfo->current.width);
3107					ahc->msgout_index = 0;
3108					ahc->msgout_len = 0;
3109					ahc_construct_sdtr(ahc, period, offset);
3110					ahc->msgout_index = 0;
3111					response = TRUE;
3112				}
3113			}
3114			done = TRUE;
3115			break;
3116		}
3117		default:
3118			/* Unknown extended message.  Reject it. */
3119			reject = TRUE;
3120			break;
3121		}
3122		break;
3123	}
3124	case MSG_ABORT:
3125	case MSG_ABORT_TAG:
3126	case MSG_BUS_DEV_RESET:
3127	case MSG_CLEAR_QUEUE:
3128	case MSG_TERM_IO_PROC:
3129		/* Target mode messages */
3130		if (devinfo->role != ROLE_TARGET)
3131			reject = TRUE;
3132		break;
3133	default:
3134		reject = TRUE;
3135		break;
3136	}
3137
3138	if (reject) {
3139		/*
3140		 * Assert attention and setup to
3141		 * reject the message.
3142		 */
3143		ahc->msgout_index = 0;
3144		ahc->msgout_len = 1;
3145		ahc->msgout_buf[0] = MSG_MESSAGE_REJECT;
3146		done = TRUE;
3147		response = TRUE;
3148	}
3149
3150	if (done && !response)
3151		/* Clear the outgoing message buffer */
3152		ahc->msgout_len = 0;
3153
3154	return (done);
3155}
3156
3157static void
3158ahc_handle_ign_wide_residue(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
3159{
3160	u_int scb_index;
3161	struct scb *scb;
3162
3163	scb_index = ahc_inb(ahc, SCB_TAG);
3164	scb = ahc->scb_data->scbarray[scb_index];
3165	if ((ahc_inb(ahc, SEQ_FLAGS) & DPHASE) == 0
3166	 || (scb->ccb->ccb_h.flags & CAM_DIR_MASK) != CAM_DIR_IN) {
3167		/*
3168		 * Ignore the message if we haven't
3169		 * seen an appropriate data phase yet.
3170		 */
3171	} else {
3172		/*
3173		 * If the residual occurred on the last
3174		 * transfer and the transfer request was
3175		 * expected to end on an odd count, do
3176		 * nothing.  Otherwise, subtract a byte
3177		 * and update the residual count accordingly.
3178		 */
3179		u_int resid_sgcnt;
3180
3181		resid_sgcnt = ahc_inb(ahc, SCB_RESID_SGCNT);
3182		if (resid_sgcnt == 0
3183		 && ahc_inb(ahc, DATA_COUNT_ODD) == 1) {
3184			/*
3185			 * If the residual occurred on the last
3186			 * transfer and the transfer request was
3187			 * expected to end on an odd count, do
3188			 * nothing.
3189			 */
3190		} else {
3191			u_int data_cnt;
3192			u_int data_addr;
3193			u_int sg_index;
3194
3195			data_cnt = (ahc_inb(ahc, SCB_RESID_DCNT + 2) << 16)
3196				 | (ahc_inb(ahc, SCB_RESID_DCNT + 1) << 8)
3197				 | (ahc_inb(ahc, SCB_RESID_DCNT));
3198
3199			data_addr = (ahc_inb(ahc, SHADDR + 3) << 24)
3200				  | (ahc_inb(ahc, SHADDR + 2) << 16)
3201				  | (ahc_inb(ahc, SHADDR + 1) << 8)
3202				  | (ahc_inb(ahc, SHADDR));
3203
3204			data_cnt += 1;
3205			data_addr -= 1;
3206
3207			sg_index = scb->sg_count - resid_sgcnt;
3208
3209			/*
3210			 * scb->ahc_dma starts with the second S/G entry.
3211			 */
3212			if (sg_index-- != 0
3213			 && (scb->ahc_dma[sg_index].len < data_cnt)) {
3214				u_int sg_addr;
3215
3216				data_cnt = 1;
3217				data_addr = scb->ahc_dma[sg_index - 1].addr
3218					  + scb->ahc_dma[sg_index - 1].len - 1;
3219
3220				sg_addr = scb->ahc_dmaphys
3221					+ (sg_index * sizeof(*scb->ahc_dma));
3222				ahc_outb(ahc, SG_NEXT + 3, sg_addr >> 24);
3223				ahc_outb(ahc, SG_NEXT + 2, sg_addr >> 16);
3224				ahc_outb(ahc, SG_NEXT + 1, sg_addr >> 8);
3225				ahc_outb(ahc, SG_NEXT, sg_addr);
3226			}
3227
3228			ahc_outb(ahc, SCB_RESID_DCNT + 2, data_cnt >> 16);
3229			ahc_outb(ahc, SCB_RESID_DCNT + 1, data_cnt >> 8);
3230			ahc_outb(ahc, SCB_RESID_DCNT, data_cnt);
3231
3232			ahc_outb(ahc, SHADDR + 3, data_addr >> 24);
3233			ahc_outb(ahc, SHADDR + 2, data_addr >> 16);
3234			ahc_outb(ahc, SHADDR + 1, data_addr >> 8);
3235			ahc_outb(ahc, SHADDR, data_addr);
3236		}
3237	}
3238}
3239
3240static void
3241ahc_handle_devreset(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
3242		    cam_status status, ac_code acode, char *message,
3243		    int verbose_only)
3244{
3245	struct cam_path *path;
3246	int found;
3247	int error;
3248
3249	error = ahc_create_path(ahc, devinfo, &path);
3250
3251	/*
3252	 * Go back to async/narrow transfers and renegotiate.
3253	 * ahc_set_width and ahc_set_syncrate can cope with NULL
3254	 * paths.
3255	 */
3256	ahc_set_width(ahc, devinfo, path, MSG_EXT_WDTR_BUS_8_BIT,
3257		      AHC_TRANS_CUR);
3258	ahc_set_syncrate(ahc, devinfo, path, /*syncrate*/NULL,
3259			 /*period*/0, /*offset*/0, AHC_TRANS_CUR);
3260	found = ahc_abort_scbs(ahc, devinfo->target, devinfo->channel,
3261			       CAM_LUN_WILDCARD, SCB_LIST_NULL, status);
3262
3263	if (error == CAM_REQ_CMP && acode != 0)
3264		xpt_async(AC_SENT_BDR, path, NULL);
3265
3266	if (error == CAM_REQ_CMP)
3267		xpt_free_path(path);
3268
3269	if (message != NULL
3270	 && (verbose_only == 0 || bootverbose != 0))
3271		printf("%s: %s on %c:%d. %d SCBs aborted\n", ahc_name(ahc),
3272		       message, devinfo->channel, devinfo->target, found);
3273}
3274
3275/*
3276 * We have an scb which has been processed by the
3277 * adaptor, now we look to see how the operation
3278 * went.
3279 */
3280static void
3281ahc_done(struct ahc_softc *ahc, struct scb *scb)
3282{
3283	union ccb *ccb;
3284
3285	CAM_DEBUG(scb->ccb->ccb_h.path, CAM_DEBUG_TRACE,
3286		  ("ahc_done - scb %d\n", scb->hscb->tag));
3287
3288	ccb = scb->ccb;
3289	LIST_REMOVE(&ccb->ccb_h, sim_links.le);
3290
3291	untimeout(ahc_timeout, (caddr_t)scb, ccb->ccb_h.timeout_ch);
3292
3293	if ((ccb->ccb_h.flags & CAM_DIR_MASK) != CAM_DIR_NONE) {
3294		bus_dmasync_op_t op;
3295
3296		if ((ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN)
3297			op = BUS_DMASYNC_POSTREAD;
3298		else
3299			op = BUS_DMASYNC_POSTWRITE;
3300		bus_dmamap_sync(ahc->dmat, scb->dmamap, op);
3301		bus_dmamap_unload(ahc->dmat, scb->dmamap);
3302	}
3303
3304	/*
3305	 * Unbusy this target/channel/lun.
3306	 * XXX if we are holding two commands per lun,
3307	 *     send the next command.
3308	 */
3309	ahc_index_busy_tcl(ahc, scb->hscb->tcl, /*unbusy*/TRUE);
3310
3311	if (ccb->ccb_h.func_code == XPT_CONT_TARGET_IO) {
3312		ccb->ccb_h.status = CAM_REQ_CMP;
3313		ahc_free_scb(ahc, scb);
3314		xpt_done(ccb);
3315		return;
3316	}
3317
3318	/*
3319	 * If the recovery SCB completes, we have to be
3320	 * out of our timeout.
3321	 */
3322	if ((scb->flags & SCB_RECOVERY_SCB) != 0) {
3323
3324		struct	ccb_hdr *ccbh;
3325
3326		/*
3327		 * We were able to complete the command successfully,
3328		 * so reinstate the timeouts for all other pending
3329		 * commands.
3330		 */
3331		ccbh = ahc->pending_ccbs.lh_first;
3332		while (ccbh != NULL) {
3333			struct scb *pending_scb;
3334
3335			pending_scb = (struct scb *)ccbh->ccb_scb_ptr;
3336			ccbh->timeout_ch =
3337			    timeout(ahc_timeout, pending_scb,
3338				    (ccbh->timeout * hz)/1000);
3339			ccbh = LIST_NEXT(ccbh, sim_links.le);
3340		}
3341
3342		/*
3343		 * Ensure that we didn't put a second instance of this
3344		 * SCB into the QINFIFO.
3345		 */
3346		ahc_search_qinfifo(ahc, SCB_TARGET(scb), SCB_CHANNEL(scb),
3347				   SCB_LUN(scb), scb->hscb->tag, /*status*/0,
3348				   SEARCH_REMOVE);
3349		if (ahc_ccb_status(ccb) == CAM_BDR_SENT)
3350			ahc_set_ccb_status(ccb, CAM_CMD_TIMEOUT);
3351		xpt_print_path(ccb->ccb_h.path);
3352		printf("no longer in timeout, status = %x\n",
3353		       ccb->ccb_h.status);
3354	}
3355
3356	/* Don't clobber any existing error state */
3357	if (ahc_ccb_status(ccb) == CAM_REQ_INPROG) {
3358		ccb->ccb_h.status |= CAM_REQ_CMP;
3359	} else if ((scb->flags & SCB_SENSE) != 0) {
3360		/* We performed autosense retrieval */
3361		scb->ccb->ccb_h.status |= CAM_AUTOSNS_VALID;
3362	}
3363	ccb->ccb_h.status &= ~CAM_SIM_QUEUED;
3364	ahc_free_scb(ahc, scb);
3365	xpt_done(ccb);
3366}
3367
3368/*
3369 * Determine the number of SCBs available on the controller
3370 */
3371int
3372ahc_probe_scbs(struct ahc_softc *ahc) {
3373	int i;
3374
3375	for (i = 0; i < AHC_SCB_MAX; i++) {
3376		ahc_outb(ahc, SCBPTR, i);
3377		ahc_outb(ahc, SCB_CONTROL, i);
3378		if (ahc_inb(ahc, SCB_CONTROL) != i)
3379			break;
3380		ahc_outb(ahc, SCBPTR, 0);
3381		if (ahc_inb(ahc, SCB_CONTROL) != 0)
3382			break;
3383	}
3384
3385	return (i);
3386}
3387
3388/*
3389 * Start the board, ready for normal operation
3390 */
3391int
3392ahc_init(struct ahc_softc *ahc)
3393{
3394	int	max_targ = 15;
3395	int	i;
3396	int	term;
3397	u_int	scsi_conf;
3398	u_int	scsiseq_template;
3399	u_int	ultraenb;
3400	u_int	discenable;
3401	u_int	tagenable;
3402
3403#ifdef AHC_PRINT_SRAM
3404	printf("Scratch Ram:");
3405	for (i = 0x20; i < 0x5f; i++) {
3406		if (((i % 8) == 0) && (i != 0)) {
3407			printf ("\n              ");
3408		}
3409		printf (" 0x%x", ahc_inb(ahc, i));
3410	}
3411	if ((ahc->features & AHC_MORE_SRAM) != 0) {
3412		for (i = 0x70; i < 0x7f; i++) {
3413			if (((i % 8) == 0) && (i != 0)) {
3414				printf ("\n              ");
3415			}
3416			printf (" 0x%x", ahc_inb(ahc, i));
3417		}
3418	}
3419	printf ("\n");
3420#endif
3421
3422	/*
3423	 * Assume we have a board at this stage and it has been reset.
3424	 */
3425	if ((ahc->flags & AHC_USEDEFAULTS) != 0) {
3426		ahc->our_id = ahc->our_id_b = 7;
3427	}
3428
3429	/*
3430	 * Default to allowing initiator operations.
3431	 */
3432	ahc->flags |= AHC_INITIATORMODE;
3433
3434	/*
3435	 * XXX Would be better to use a per device flag, but PCI and EISA
3436	 *     devices don't have them yet.
3437	 */
3438	if ((AHC_TMODE_ENABLE & (0x01 << ahc->unit)) != 0) {
3439		ahc->flags |= AHC_TARGETMODE;
3440		/*
3441		 * Although we have space for both the initiator and
3442		 * target roles on ULTRA2 chips, we currently disable
3443		 * the initiator role to allow multi-scsi-id target mode
3444		 * configurations.  We can only respond on the same SCSI
3445		 * ID as our initiator role if we allow initiator operation.
3446		 * At some point, we should add a configuration knob to
3447		 * allow both roles to be loaded.
3448		 */
3449		ahc->flags &= ~AHC_INITIATORMODE;
3450	}
3451
3452	/*
3453	 * Allocate a tstate to house information for our
3454	 * initiator presence on the bus as well as the user
3455	 * data for any target mode initiator.
3456	 */
3457	if (ahc_alloc_tstate(ahc, ahc->our_id, 'A') == NULL) {
3458		printf("%s: unable to allocate tmode_tstate.  "
3459		       "Failing attach\n", ahc_name(ahc));
3460		return (-1);
3461	}
3462
3463	if ((ahc->features & AHC_TWIN) != 0) {
3464		if (ahc_alloc_tstate(ahc, ahc->our_id_b, 'B') == NULL) {
3465			printf("%s: unable to allocate tmode_tstate.  "
3466			       "Failing attach\n", ahc_name(ahc));
3467			return (-1);
3468		}
3469 		printf("Twin Channel, A SCSI Id=%d, B SCSI Id=%d, primary %c, ",
3470		       ahc->our_id, ahc->our_id_b,
3471		       ahc->flags & AHC_CHANNEL_B_PRIMARY? 'B': 'A');
3472	} else {
3473		if ((ahc->features & AHC_WIDE) != 0) {
3474			printf("Wide ");
3475		} else {
3476			printf("Single ");
3477		}
3478		printf("Channel %c, SCSI Id=%d, ", ahc->channel, ahc->our_id);
3479	}
3480
3481	ahc_outb(ahc, SEQ_FLAGS, 0);
3482
3483	/* Determine the number of SCBs and initialize them */
3484
3485	if (ahc->scb_data->maxhscbs == 0) {
3486		ahc->scb_data->maxhscbs = ahc_probe_scbs(ahc);
3487		/* SCB 0 heads the free list */
3488		ahc_outb(ahc, FREE_SCBH, 0);
3489		for (i = 0; i < ahc->scb_data->maxhscbs; i++) {
3490			ahc_outb(ahc, SCBPTR, i);
3491
3492			/* Clear the control byte. */
3493			ahc_outb(ahc, SCB_CONTROL, 0);
3494
3495			/* Set the next pointer */
3496			ahc_outb(ahc, SCB_NEXT, i+1);
3497
3498			/* Make the tag number invalid */
3499			ahc_outb(ahc, SCB_TAG, SCB_LIST_NULL);
3500		}
3501
3502		/* Make that the last SCB terminates the free list */
3503		ahc_outb(ahc, SCBPTR, i-1);
3504		ahc_outb(ahc, SCB_NEXT, SCB_LIST_NULL);
3505
3506		/* Ensure we clear the 0 SCB's control byte. */
3507		ahc_outb(ahc, SCBPTR, 0);
3508		ahc_outb(ahc, SCB_CONTROL, 0);
3509
3510		ahc->scb_data->maxhscbs = i;
3511	}
3512
3513	if (ahc->scb_data->maxhscbs == 0)
3514		panic("%s: No SCB space found", ahc_name(ahc));
3515
3516	if (ahc->scb_data->maxhscbs < AHC_SCB_MAX) {
3517		ahc->flags |= AHC_PAGESCBS;
3518		ahc->scb_data->maxscbs = AHC_SCB_MAX;
3519		printf("%d/%d SCBs\n", ahc->scb_data->maxhscbs,
3520		       ahc->scb_data->maxscbs);
3521	} else {
3522		ahc->scb_data->maxscbs = ahc->scb_data->maxhscbs;
3523		ahc->flags &= ~AHC_PAGESCBS;
3524		printf("%d SCBs\n", ahc->scb_data->maxhscbs);
3525	}
3526
3527#ifdef AHC_DEBUG
3528	if (ahc_debug & AHC_SHOWMISC) {
3529		printf("%s: hardware scb %d bytes; kernel scb %d bytes; "
3530		       "ahc_dma %d bytes\n",
3531			ahc_name(ahc),
3532		        sizeof(struct hardware_scb),
3533			sizeof(struct scb),
3534			sizeof(struct ahc_dma_seg));
3535	}
3536#endif /* AHC_DEBUG */
3537
3538	/* Set the SCSI Id, SXFRCTL0, SXFRCTL1, and SIMODE1, for both channels*/
3539	if (ahc->features & AHC_TWIN) {
3540
3541		/*
3542		 * The device is gated to channel B after a chip reset,
3543		 * so set those values first
3544		 */
3545		term = (ahc->flags & AHC_TERM_ENB_B) != 0 ? STPWEN : 0;
3546		if ((ahc->features & AHC_ULTRA2) != 0)
3547			ahc_outb(ahc, SCSIID_ULTRA2, ahc->our_id_b);
3548		else
3549			ahc_outb(ahc, SCSIID, ahc->our_id_b);
3550		scsi_conf = ahc_inb(ahc, SCSICONF + 1);
3551		ahc_outb(ahc, SXFRCTL1, (scsi_conf & (ENSPCHK|STIMESEL))
3552					|term|ENSTIMER|ACTNEGEN);
3553		ahc_outb(ahc, SIMODE1, ENSELTIMO|ENSCSIRST|ENSCSIPERR);
3554		ahc_outb(ahc, SXFRCTL0, DFON|SPIOEN);
3555
3556#if 0
3557		if ((scsi_conf & RESET_SCSI) != 0
3558		 && (ahc->flags & AHC_INITIATORMODE) != 0)
3559			ahc->flags |= AHC_RESET_BUS_B;
3560#else
3561		if ((ahc->flags & AHC_INITIATORMODE) != 0)
3562			ahc->flags |= AHC_RESET_BUS_B;
3563#endif
3564
3565		/* Select Channel A */
3566		ahc_outb(ahc, SBLKCTL, ahc_inb(ahc, SBLKCTL) & ~SELBUSB);
3567	}
3568	term = (ahc->flags & AHC_TERM_ENB_A) != 0 ? STPWEN : 0;
3569	if ((ahc->features & AHC_ULTRA2) != 0)
3570		ahc_outb(ahc, SCSIID_ULTRA2, ahc->our_id);
3571	else
3572		ahc_outb(ahc, SCSIID, ahc->our_id);
3573	scsi_conf = ahc_inb(ahc, SCSICONF);
3574	ahc_outb(ahc, SXFRCTL1, (scsi_conf & (ENSPCHK|STIMESEL))
3575				|term
3576				|ENSTIMER|ACTNEGEN);
3577	ahc_outb(ahc, SIMODE1, ENSELTIMO|ENSCSIRST|ENSCSIPERR);
3578	ahc_outb(ahc, SXFRCTL0, DFON|SPIOEN);
3579
3580	if ((ahc->features & AHC_ULTRA2) != 0) {
3581		/* Wait for our transceiver status to settle */
3582		i = 1000000;
3583		while (--i && ((ahc_inb(ahc, SBLKCTL) & (ENAB40|ENAB20)) == 0))
3584			DELAY(100);
3585
3586		if (i == 0)
3587			panic("%s: Transceiver state never settled\n",
3588			      ahc_name(ahc));
3589	}
3590
3591#if 0
3592	if ((scsi_conf & RESET_SCSI) != 0
3593	 && (ahc->flags & AHC_INITIATORMODE) != 0)
3594		ahc->flags |= AHC_RESET_BUS_A;
3595#else
3596	if ((ahc->flags & AHC_INITIATORMODE) != 0)
3597		ahc->flags |= AHC_RESET_BUS_A;
3598#endif
3599
3600	/*
3601	 * Look at the information that board initialization or
3602	 * the board bios has left us.  In the lower four bits of each
3603	 * target's scratch space any value other than 0 indicates
3604	 * that we should initiate synchronous transfers.  If it's zero,
3605	 * the user or the BIOS has decided to disable synchronous
3606	 * negotiation to that target so we don't activate the needsdtr
3607	 * flag.
3608	 */
3609	ultraenb = 0;
3610	tagenable = ALL_TARGETS_MASK;
3611
3612	/* Grab the disconnection disable table and invert it for our needs */
3613	if (ahc->flags & AHC_USEDEFAULTS) {
3614		printf("%s: Host Adapter Bios disabled.  Using default SCSI "
3615			"device parameters\n", ahc_name(ahc));
3616		ahc->flags |= AHC_EXTENDED_TRANS_A|AHC_EXTENDED_TRANS_B|
3617			      AHC_TERM_ENB_A|AHC_TERM_ENB_B;
3618		discenable = ALL_TARGETS_MASK;
3619		if ((ahc->features & AHC_ULTRA) != 0)
3620			ultraenb = ALL_TARGETS_MASK;
3621	} else {
3622		discenable = ~((ahc_inb(ahc, DISC_DSB + 1) << 8)
3623			   | ahc_inb(ahc, DISC_DSB));
3624		if ((ahc->features & (AHC_ULTRA|AHC_ULTRA2)) != 0)
3625			ultraenb = (ahc_inb(ahc, ULTRA_ENB + 1) << 8)
3626				      | ahc_inb(ahc, ULTRA_ENB);
3627	}
3628
3629	if ((ahc->features & (AHC_WIDE|AHC_TWIN)) == 0)
3630		max_targ = 7;
3631
3632	for (i = 0; i <= max_targ; i++) {
3633		struct ahc_initiator_tinfo *tinfo;
3634		struct tmode_tstate *tstate;
3635		u_int our_id;
3636		u_int target_id;
3637		char channel;
3638
3639		channel = 'A';
3640		our_id = ahc->our_id;
3641		target_id = i;
3642		if (i > 7 && (ahc->features & AHC_TWIN) != 0) {
3643			channel = 'B';
3644			our_id = ahc->our_id_b;
3645			target_id = i % 8;
3646		}
3647		tinfo = ahc_fetch_transinfo(ahc, channel, our_id,
3648					    target_id, &tstate);
3649		/* Default to async narrow across the board */
3650		bzero(tinfo, sizeof(*tinfo));
3651		if (ahc->flags & AHC_USEDEFAULTS) {
3652			if ((ahc->features & AHC_WIDE) != 0)
3653				tinfo->user.width = MSG_EXT_WDTR_BUS_16_BIT;
3654
3655			/*
3656			 * These will be truncated when we determine the
3657			 * connection type we have with the target.
3658			 */
3659			tinfo->user.period = ahc_syncrates->period;
3660			tinfo->user.offset = ~0;
3661		} else {
3662			u_int scsirate;
3663			u_int16_t mask;
3664
3665			/* Take the settings leftover in scratch RAM. */
3666			scsirate = ahc_inb(ahc, TARG_SCSIRATE + i);
3667			mask = (0x01 << i);
3668			if ((ahc->features & AHC_ULTRA2) != 0) {
3669				u_int offset;
3670
3671				if ((scsirate & SOFS) == 0x0F) {
3672					/*
3673					 * Haven't negotiated yet,
3674					 * so the format is different.
3675					 */
3676					scsirate = (scsirate & SXFR) >> 4
3677						 | (ultraenb & mask)
3678						  ? 0x18 : 0x10
3679						 | (scsirate & WIDEXFER);
3680					offset = MAX_OFFSET_ULTRA2;
3681				} else
3682					offset = ahc_inb(ahc, TARG_OFFSET + i);
3683				ahc_find_period(ahc, scsirate,
3684						AHC_SYNCRATE_ULTRA2);
3685				if (offset == 0)
3686					tinfo->user.period = 0;
3687				else
3688					tinfo->user.offset = ~0;
3689			} else if ((scsirate & SOFS) != 0) {
3690				tinfo->user.period =
3691				    ahc_find_period(ahc, scsirate,
3692						    (ultraenb & mask)
3693						   ? AHC_SYNCRATE_ULTRA
3694						   : AHC_SYNCRATE_FAST);
3695				if ((scsirate & SOFS) != 0
3696				 && tinfo->user.period != 0) {
3697					tinfo->user.offset = ~0;
3698				}
3699			}
3700			if ((scsirate & WIDEXFER) != 0
3701			 && (ahc->features & AHC_WIDE) != 0)
3702				tinfo->user.width = MSG_EXT_WDTR_BUS_16_BIT;
3703		}
3704		tstate->ultraenb = ultraenb;
3705		tstate->discenable = discenable;
3706		tstate->tagenable = tagenable;
3707	}
3708
3709#ifdef AHC_DEBUG
3710	if (ahc_debug & AHC_SHOWMISC)
3711		printf("NEEDSDTR == 0x%x\nNEEDWDTR == 0x%x\n"
3712		       "DISCENABLE == 0x%x\nULTRAENB == 0x%x\n",
3713		       ahc->needsdtr_orig, ahc->needwdtr_orig,
3714		       discenable, ultraenb);
3715#endif
3716	/*
3717	 * Allocate enough "hardware scbs" to handle
3718	 * the maximum number of concurrent transactions
3719	 * we can have active.  We have to use contigmalloc
3720	 * if this array crosses a page boundary since the
3721	 * sequencer depends on this array being physically
3722	 * contiguous.
3723	 */
3724	if (ahc->scb_data->hscbs == NULL) {
3725		size_t array_size;
3726
3727		array_size = ahc->scb_data->maxscbs*sizeof(struct hardware_scb);
3728		if (array_size > PAGE_SIZE) {
3729			ahc->scb_data->hscbs = (struct hardware_scb *)
3730					contigmalloc(array_size, M_DEVBUF,
3731						     M_NOWAIT, 0ul, 0xffffffff,
3732						     PAGE_SIZE, 0x10000);
3733		} else {
3734			ahc->scb_data->hscbs = (struct hardware_scb *)
3735				     malloc(array_size, M_DEVBUF, M_NOWAIT);
3736		}
3737
3738		if (ahc->scb_data->hscbs == NULL) {
3739			printf("%s: unable to allocate hardware SCB array.  "
3740			       "Failing attach\n", ahc_name(ahc));
3741			return (-1);
3742		}
3743		/* At least the control byte of each hscb needs to be zeroed */
3744		bzero(ahc->scb_data->hscbs, array_size);
3745	}
3746
3747	if ((ahc->flags & AHC_TARGETMODE) != 0) {
3748		size_t array_size;
3749
3750		array_size = AHC_TMODE_CMDS * sizeof(struct target_cmd);
3751		ahc->targetcmds = contigmalloc(array_size, M_DEVBUF,
3752					       M_NOWAIT, 0ul, 0xffffffff,
3753					       PAGE_SIZE, 0x10000);
3754
3755		if (ahc->targetcmds == NULL) {
3756			printf("%s: unable to allocate targetcmd array.  "
3757			       "Failing attach\n", ahc_name(ahc));
3758			return (-1);
3759		}
3760
3761		/* All target command blocks start out invalid. */
3762		for (i = 0; i < AHC_TMODE_CMDS; i++)
3763			ahc->targetcmds[i].cmd_valid = 0;
3764		ahc_outb(ahc, KERNEL_TQINPOS, ahc->tqinfifonext - 1);
3765		ahc_outb(ahc, TQINPOS, 0);
3766	}
3767
3768	/*
3769	 * Tell the sequencer where it can find the our arrays in memory.
3770	 */
3771	{
3772		u_int32_t physaddr;
3773
3774		/* Tell the sequencer where it can find the hscb array. */
3775		physaddr = vtophys(ahc->scb_data->hscbs);
3776		ahc_outb(ahc, HSCB_ADDR, physaddr & 0xFF);
3777		ahc_outb(ahc, HSCB_ADDR + 1, (physaddr >> 8) & 0xFF);
3778		ahc_outb(ahc, HSCB_ADDR + 2, (physaddr >> 16) & 0xFF);
3779		ahc_outb(ahc, HSCB_ADDR + 3, (physaddr >> 24) & 0xFF);
3780		ahc->hscb_busaddr = physaddr;
3781
3782		physaddr = vtophys(ahc->qoutfifo);
3783		ahc_outb(ahc, SCBID_ADDR, physaddr & 0xFF);
3784		ahc_outb(ahc, SCBID_ADDR + 1, (physaddr >> 8) & 0xFF);
3785		ahc_outb(ahc, SCBID_ADDR + 2, (physaddr >> 16) & 0xFF);
3786		ahc_outb(ahc, SCBID_ADDR + 3, (physaddr >> 24) & 0xFF);
3787
3788		if ((ahc->flags & AHC_TARGETMODE) != 0) {
3789			physaddr = vtophys(ahc->targetcmds);
3790			ahc_outb(ahc, TMODE_CMDADDR, physaddr & 0xFF);
3791			ahc_outb(ahc, TMODE_CMDADDR + 1,
3792				 (physaddr >> 8) & 0xFF);
3793			ahc_outb(ahc, TMODE_CMDADDR + 2,
3794				 (physaddr >> 16) & 0xFF);
3795			ahc_outb(ahc, TMODE_CMDADDR + 3,
3796				 (physaddr >> 24) & 0xFF);
3797
3798			ahc_outb(ahc, CMDSIZE_TABLE, 5);
3799			ahc_outb(ahc, CMDSIZE_TABLE + 1, 9);
3800			ahc_outb(ahc, CMDSIZE_TABLE + 2, 9);
3801			ahc_outb(ahc, CMDSIZE_TABLE + 3, 0);
3802			ahc_outb(ahc, CMDSIZE_TABLE + 4, 15);
3803			ahc_outb(ahc, CMDSIZE_TABLE + 5, 11);
3804			ahc_outb(ahc, CMDSIZE_TABLE + 6, 0);
3805			ahc_outb(ahc, CMDSIZE_TABLE + 7, 0);
3806		}
3807
3808		/* There are no untagged SCBs active yet. */
3809		for (i = 0; i < sizeof(ahc->untagged_scbs); i++) {
3810			ahc->untagged_scbs[i] = SCB_LIST_NULL;
3811		}
3812		for (i = 0; i < sizeof(ahc->qoutfifo); i++) {
3813			ahc->qoutfifo[i] = SCB_LIST_NULL;
3814		}
3815	}
3816
3817	/* Our Q FIFOs are empty. */
3818	ahc_outb(ahc, KERNEL_QINPOS, 0);
3819	ahc_outb(ahc, QINPOS, 0);
3820	ahc_outb(ahc, QOUTPOS, 0);
3821
3822	/* Don't have any special messages to send to targets */
3823	ahc_outb(ahc, TARGET_MSG_REQUEST, 0);
3824	ahc_outb(ahc, TARGET_MSG_REQUEST + 1, 0);
3825
3826	/*
3827	 * Use the built in queue management registers
3828	 * if they are available.
3829	 */
3830	if ((ahc->features & AHC_QUEUE_REGS) != 0) {
3831		ahc_outb(ahc, QOFF_CTLSTA, SCB_QSIZE_256);
3832		ahc_outb(ahc, SDSCB_QOFF, 0);
3833		ahc_outb(ahc, SNSCB_QOFF, 0);
3834		ahc_outb(ahc, HNSCB_QOFF, 0);
3835	}
3836
3837
3838	/* We don't have any waiting selections */
3839	ahc_outb(ahc, WAITING_SCBH, SCB_LIST_NULL);
3840
3841	/* Our disconnection list is empty too */
3842	ahc_outb(ahc, DISCONNECTED_SCBH, SCB_LIST_NULL);
3843
3844	/* Message out buffer starts empty */
3845	ahc_outb(ahc, MSG_OUT, MSG_NOOP);
3846
3847	/*
3848	 * Setup the allowed SCSI Sequences based on operational mode.
3849	 * If we are a target, we'll enalbe select in operations once
3850	 * we've had a lun enabled.
3851	 */
3852	scsiseq_template = ENSELO|ENAUTOATNO|ENAUTOATNP;
3853	if ((ahc->flags & AHC_INITIATORMODE) != 0)
3854		scsiseq_template |= ENRSELI;
3855	ahc_outb(ahc, SCSISEQ_TEMPLATE, scsiseq_template);
3856
3857	/*
3858	 * Load the Sequencer program and Enable the adapter
3859	 * in "fast" mode.
3860         */
3861	if (bootverbose)
3862		printf("%s: Downloading Sequencer Program...",
3863		       ahc_name(ahc));
3864
3865	ahc_loadseq(ahc);
3866
3867	/* We have to wait until after any system dumps... */
3868	at_shutdown(ahc_shutdown, ahc, SHUTDOWN_FINAL);
3869
3870	return (0);
3871}
3872
3873static cam_status
3874ahc_find_tmode_devs(struct ahc_softc *ahc, struct cam_sim *sim, union ccb *ccb,
3875		    struct tmode_tstate **tstate, struct tmode_lstate **lstate,
3876		    int notfound_failure)
3877{
3878	int our_id;
3879
3880	/*
3881	 * If we are not configured for target mode, someone
3882	 * is really confused to be sending this to us.
3883	 */
3884	if ((ahc->flags & AHC_TARGETMODE) == 0)
3885		return (CAM_REQ_INVALID);
3886
3887	/* Range check target and lun */
3888
3889	/*
3890	 * Handle the 'black hole' device that sucks up
3891	 * requests to unattached luns on enabled targets.
3892	 */
3893	if (ccb->ccb_h.target_id == CAM_TARGET_WILDCARD
3894	 && ccb->ccb_h.target_lun == CAM_LUN_WILDCARD) {
3895		*tstate = NULL;
3896		*lstate = ahc->black_hole;
3897	} else {
3898		u_int max_id;
3899
3900		if (cam_sim_bus(sim) == 0)
3901			our_id = ahc->our_id;
3902		else
3903			our_id = ahc->our_id_b;
3904
3905		max_id = (ahc->features & AHC_WIDE) ? 15 : 7;
3906		if (ccb->ccb_h.target_id > max_id)
3907			return (CAM_TID_INVALID);
3908
3909		if (ccb->ccb_h.target_lun > 7)
3910			return (CAM_LUN_INVALID);
3911
3912		if (ccb->ccb_h.target_id != our_id) {
3913			if ((ahc->features & AHC_MULTI_TID) != 0) {
3914				/*
3915				 * Only allow additional targets if
3916				 * the initiator role is disabled.
3917				 * The hardware cannot handle a re-select-in
3918				 * on the initiator id during a re-select-out
3919				 * on a different target id.
3920				 */
3921			   	if ((ahc->flags & AHC_INITIATORMODE) != 0)
3922					return (CAM_TID_INVALID);
3923			} else {
3924				/*
3925				 * Only allow our target id to change
3926				 * if the initiator role is not configured
3927				 * and there are no enabled luns which
3928				 * are attached to the currently registered
3929				 * scsi id.
3930				 */
3931			   	if ((ahc->flags & AHC_INITIATORMODE) != 0
3932				 || ahc->enabled_luns > 0)
3933					return (CAM_TID_INVALID);
3934			}
3935		}
3936
3937		*tstate = ahc->enabled_targets[ccb->ccb_h.target_id];
3938		*lstate = NULL;
3939		if (*tstate != NULL)
3940			*lstate =
3941			    (*tstate)->enabled_luns[ccb->ccb_h.target_lun];
3942	}
3943
3944	if (notfound_failure != 0 && *lstate == NULL)
3945		return (CAM_PATH_INVALID);
3946
3947	return (CAM_REQ_CMP);
3948}
3949
3950static void
3951ahc_action(struct cam_sim *sim, union ccb *ccb)
3952{
3953	struct	ahc_softc *ahc;
3954	struct	tmode_lstate *lstate;
3955	u_int	target_id;
3956	u_int	our_id;
3957	int	s;
3958
3959	CAM_DEBUG(ccb->ccb_h.path, CAM_DEBUG_TRACE, ("ahc_action\n"));
3960
3961	ahc = (struct ahc_softc *)cam_sim_softc(sim);
3962
3963	target_id = ccb->ccb_h.target_id;
3964	our_id = SIM_SCSI_ID(ahc, sim);
3965
3966	switch (ccb->ccb_h.func_code) {
3967	/* Common cases first */
3968	case XPT_ACCEPT_TARGET_IO:	/* Accept Host Target Mode CDB */
3969	case XPT_CONT_TARGET_IO:/* Continue Host Target I/O Connection*/
3970	{
3971		struct	   tmode_tstate *tstate;
3972		cam_status status;
3973
3974		status = ahc_find_tmode_devs(ahc, sim, ccb, &tstate,
3975					     &lstate, TRUE);
3976
3977		if (status != CAM_REQ_CMP) {
3978			if (ccb->ccb_h.func_code == XPT_CONT_TARGET_IO) {
3979				/* Response from the black hole device */
3980				tstate = NULL;
3981				lstate = ahc->black_hole;
3982			} else {
3983				ccb->ccb_h.status = status;
3984				xpt_done(ccb);
3985				break;
3986			}
3987		}
3988		if (ccb->ccb_h.func_code == XPT_ACCEPT_TARGET_IO) {
3989			int s;
3990
3991			s = splcam();
3992			SLIST_INSERT_HEAD(&lstate->accept_tios, &ccb->ccb_h,
3993					  sim_links.sle);
3994			ccb->ccb_h.status = CAM_REQ_INPROG;
3995			if ((ahc->flags & AHC_TQINFIFO_BLOCKED) != 0)
3996				ahc_run_tqinfifo(ahc);
3997			splx(s);
3998			break;
3999		}
4000
4001		/*
4002		 * The target_id represents the target we attempt to
4003		 * select.  In target mode, this is the initiator of
4004		 * the original command.
4005		 */
4006		our_id = target_id;
4007		target_id = ccb->csio.init_id;
4008		/* FALLTHROUGH */
4009	}
4010	case XPT_SCSI_IO:	/* Execute the requested I/O operation */
4011	case XPT_RESET_DEV:	/* Bus Device Reset the specified SCSI device */
4012	{
4013		struct	   scb *scb;
4014		struct	   hardware_scb *hscb;
4015		struct	   ahc_initiator_tinfo *tinfo;
4016		struct	   tmode_tstate *tstate;
4017		u_int16_t  mask;
4018
4019		/*
4020		 * get an scb to use.
4021		 */
4022		if ((scb = ahc_get_scb(ahc)) == NULL) {
4023			int s;
4024
4025			s = splcam();
4026			ahc->flags |= AHC_RESOURCE_SHORTAGE;
4027			splx(s);
4028			xpt_freeze_simq(ahc->sim, /*count*/1);
4029			ahc_set_ccb_status(ccb, CAM_REQUEUE_REQ);
4030			xpt_done(ccb);
4031			return;
4032		}
4033
4034		hscb = scb->hscb;
4035
4036		CAM_DEBUG(ccb->ccb_h.path, CAM_DEBUG_SUBTRACE,
4037			  ("start scb(%p)\n", scb));
4038		scb->ccb = ccb;
4039		/*
4040		 * So we can find the SCB when an abort is requested
4041		 */
4042		ccb->ccb_h.ccb_scb_ptr = scb;
4043		ccb->ccb_h.ccb_ahc_ptr = ahc;
4044
4045		/*
4046		 * Put all the arguments for the xfer in the scb
4047		 */
4048		hscb->tcl = ((target_id << 4) & 0xF0)
4049			| (SIM_IS_SCSIBUS_B(ahc, sim) ? SELBUSB : 0)
4050			| (ccb->ccb_h.target_lun & 0x07);
4051
4052		mask = SCB_TARGET_MASK(scb);
4053		tinfo = ahc_fetch_transinfo(ahc, SIM_CHANNEL(ahc, sim), our_id,
4054					    target_id, &tstate);
4055
4056		hscb->scsirate = tinfo->scsirate;
4057		hscb->scsioffset = tinfo->current.offset;
4058		if ((tstate->ultraenb & mask) != 0)
4059			hscb->control |= ULTRAENB;
4060
4061		if ((tstate->discenable & mask) != 0
4062		 && (ccb->ccb_h.flags & CAM_DIS_DISCONNECT) == 0)
4063			hscb->control |= DISCENB;
4064
4065		if (ccb->ccb_h.func_code == XPT_RESET_DEV) {
4066			hscb->cmdpointer = NULL;
4067			scb->flags |= SCB_DEVICE_RESET;
4068			hscb->control |= MK_MESSAGE;
4069			ahc_execute_scb(scb, NULL, 0, 0);
4070		} else {
4071			if (ccb->ccb_h.func_code == XPT_CONT_TARGET_IO) {
4072				if (ahc->pending_device == lstate) {
4073					scb->flags |= SCB_TARGET_IMMEDIATE;
4074					ahc->pending_device = NULL;
4075				}
4076				hscb->control |= TARGET_SCB;
4077				hscb->cmdpointer = IDENTIFY_SEEN;
4078				if ((ccb->ccb_h.flags & CAM_SEND_STATUS) != 0) {
4079					hscb->cmdpointer |= SPHASE_PENDING;
4080					hscb->status = ccb->csio.scsi_status;
4081				}
4082
4083				/* Overloaded with tag ID */
4084				hscb->cmdlen = ccb->csio.tag_id;
4085				/*
4086				 * Overloaded with the value to place
4087				 * in SCSIID for reselection.
4088				 */
4089				hscb->cmdpointer |=
4090					(our_id|(hscb->tcl & 0xF0)) << 16;
4091			}
4092			if (ccb->ccb_h.flags & CAM_TAG_ACTION_VALID)
4093				hscb->control |= ccb->csio.tag_action;
4094
4095			ahc_setup_data(ahc, &ccb->csio, scb);
4096		}
4097		break;
4098	}
4099	case XPT_NOTIFY_ACK:
4100	case XPT_IMMED_NOTIFY:
4101	{
4102		struct	   tmode_tstate *tstate;
4103		struct	   tmode_lstate *lstate;
4104		cam_status status;
4105
4106		status = ahc_find_tmode_devs(ahc, sim, ccb, &tstate,
4107					     &lstate, TRUE);
4108
4109		if (status != CAM_REQ_CMP) {
4110			ccb->ccb_h.status = status;
4111			xpt_done(ccb);
4112			break;
4113		}
4114		if (ccb->ccb_h.func_code == XPT_NOTIFY_ACK) {
4115			/* Clear notification state */
4116		}
4117		SLIST_INSERT_HEAD(&lstate->immed_notifies, &ccb->ccb_h,
4118				  sim_links.sle);
4119		ccb->ccb_h.status = CAM_REQ_INPROG;
4120		break;
4121	}
4122	case XPT_EN_LUN:		/* Enable LUN as a target */
4123		ahc_handle_en_lun(ahc, sim, ccb);
4124		xpt_done(ccb);
4125		break;
4126	case XPT_ABORT:			/* Abort the specified CCB */
4127	{
4128		ahc_abort_ccb(ahc, sim, ccb);
4129		break;
4130	}
4131	case XPT_SET_TRAN_SETTINGS:
4132	{
4133		struct	ahc_devinfo devinfo;
4134		struct	ccb_trans_settings *cts;
4135		struct	ahc_initiator_tinfo *tinfo;
4136		struct	tmode_tstate *tstate;
4137		u_int	update_type;
4138		int	s;
4139
4140		cts = &ccb->cts;
4141		ahc_compile_devinfo(&devinfo, SIM_SCSI_ID(ahc, sim),
4142				    cts->ccb_h.target_id,
4143				    cts->ccb_h.target_lun,
4144				    SIM_CHANNEL(ahc, sim),
4145				    ROLE_UNKNOWN);
4146		tinfo = ahc_fetch_transinfo(ahc, devinfo.channel,
4147					    devinfo.our_scsiid,
4148					    devinfo.target, &tstate);
4149		update_type = 0;
4150		if ((cts->flags & CCB_TRANS_CURRENT_SETTINGS) != 0)
4151			update_type |= AHC_TRANS_GOAL;
4152		if ((cts->flags & CCB_TRANS_USER_SETTINGS) != 0)
4153			update_type |= AHC_TRANS_USER;
4154
4155		s = splcam();
4156
4157		if ((cts->valid & CCB_TRANS_DISC_VALID) != 0) {
4158			if ((cts->flags & CCB_TRANS_DISC_ENB) != 0)
4159				tstate->discenable |= devinfo.target_mask;
4160			else
4161				tstate->discenable &= ~devinfo.target_mask;
4162		}
4163
4164		if ((cts->valid & CCB_TRANS_TQ_VALID) != 0) {
4165			if ((cts->flags & CCB_TRANS_TAG_ENB) != 0)
4166				tstate->tagenable |= devinfo.target_mask;
4167			else
4168				tstate->tagenable &= ~devinfo.target_mask;
4169		}
4170
4171		if ((cts->valid & CCB_TRANS_BUS_WIDTH_VALID) != 0) {
4172			switch (cts->bus_width) {
4173			case MSG_EXT_WDTR_BUS_16_BIT:
4174				if ((ahc->features & AHC_WIDE) != 0)
4175					break;
4176				/* FALLTHROUGH to 8bit */
4177			case MSG_EXT_WDTR_BUS_32_BIT:
4178			case MSG_EXT_WDTR_BUS_8_BIT:
4179			default:
4180				cts->bus_width = MSG_EXT_WDTR_BUS_8_BIT;
4181				break;
4182			}
4183			ahc_set_width(ahc, &devinfo, cts->ccb_h.path,
4184				      cts->bus_width, update_type);
4185		}
4186
4187		if ((cts->valid &  CCB_TRANS_SYNC_RATE_VALID) != 0) {
4188			struct ahc_syncrate *syncrate;
4189			u_int maxsync;
4190
4191			if ((ahc->features & AHC_ULTRA2) != 0)
4192				maxsync = AHC_SYNCRATE_ULTRA2;
4193			else if ((ahc->features & AHC_ULTRA) != 0)
4194				maxsync = AHC_SYNCRATE_ULTRA;
4195			else
4196				maxsync = AHC_SYNCRATE_FAST;
4197
4198			if ((cts->valid & CCB_TRANS_SYNC_OFFSET_VALID) == 0)
4199				if (update_type & AHC_TRANS_USER)
4200					cts->sync_offset = tinfo->user.offset;
4201				else
4202					cts->sync_offset = tinfo->goal.offset;
4203
4204			syncrate = ahc_find_syncrate(ahc, &cts->sync_period,
4205						     maxsync);
4206			ahc_validate_offset(ahc, syncrate, &cts->sync_offset,
4207					    MSG_EXT_WDTR_BUS_8_BIT);
4208
4209			/* We use a period of 0 to represent async */
4210			if (cts->sync_offset == 0)
4211				cts->sync_period = 0;
4212
4213			ahc_set_syncrate(ahc, &devinfo, cts->ccb_h.path,
4214					 syncrate, cts->sync_period,
4215					 cts->sync_offset, update_type);
4216		}
4217		splx(s);
4218		ccb->ccb_h.status = CAM_REQ_CMP;
4219		xpt_done(ccb);
4220		break;
4221	}
4222	case XPT_GET_TRAN_SETTINGS:
4223	/* Get default/user set transfer settings for the target */
4224	{
4225		struct	ahc_devinfo devinfo;
4226		struct	ccb_trans_settings *cts;
4227		struct	ahc_initiator_tinfo *targ_info;
4228		struct	tmode_tstate *tstate;
4229		struct	ahc_transinfo *tinfo;
4230		int	s;
4231
4232		cts = &ccb->cts;
4233		ahc_compile_devinfo(&devinfo, SIM_SCSI_ID(ahc, sim),
4234				    cts->ccb_h.target_id,
4235				    cts->ccb_h.target_lun,
4236				    SIM_CHANNEL(ahc, sim),
4237				    ROLE_UNKNOWN);
4238		targ_info = ahc_fetch_transinfo(ahc, devinfo.channel,
4239						devinfo.our_scsiid,
4240						devinfo.target, &tstate);
4241
4242		if ((cts->flags & CCB_TRANS_CURRENT_SETTINGS) != 0)
4243			tinfo = &targ_info->current;
4244		else
4245			tinfo = &targ_info->user;
4246
4247		s = splcam();
4248
4249		cts->flags &= ~(CCB_TRANS_DISC_ENB|CCB_TRANS_TAG_ENB);
4250		if ((tstate->discenable & devinfo.target_mask) != 0)
4251			cts->flags |= CCB_TRANS_DISC_ENB;
4252
4253		if ((tstate->tagenable & devinfo.target_mask) != 0)
4254			cts->flags |= CCB_TRANS_TAG_ENB;
4255
4256		cts->sync_period = tinfo->period;
4257		cts->sync_offset = tinfo->offset;
4258		cts->bus_width = tinfo->width;
4259
4260		splx(s);
4261
4262		cts->valid = CCB_TRANS_SYNC_RATE_VALID
4263			   | CCB_TRANS_SYNC_OFFSET_VALID
4264			   | CCB_TRANS_BUS_WIDTH_VALID
4265			   | CCB_TRANS_DISC_VALID
4266			   | CCB_TRANS_TQ_VALID;
4267
4268		ccb->ccb_h.status = CAM_REQ_CMP;
4269		xpt_done(ccb);
4270		break;
4271	}
4272	case XPT_CALC_GEOMETRY:
4273	{
4274		struct	  ccb_calc_geometry *ccg;
4275		u_int32_t size_mb;
4276		u_int32_t secs_per_cylinder;
4277		int	  extended;
4278
4279		ccg = &ccb->ccg;
4280		size_mb = ccg->volume_size
4281			/ ((1024L * 1024L) / ccg->block_size);
4282		extended = SIM_IS_SCSIBUS_B(ahc, sim)
4283			? ahc->flags & AHC_EXTENDED_TRANS_B
4284			: ahc->flags & AHC_EXTENDED_TRANS_A;
4285
4286		if (size_mb > 1024 && extended) {
4287			ccg->heads = 255;
4288			ccg->secs_per_track = 63;
4289		} else {
4290			ccg->heads = 64;
4291			ccg->secs_per_track = 32;
4292		}
4293		secs_per_cylinder = ccg->heads * ccg->secs_per_track;
4294		ccg->cylinders = ccg->volume_size / secs_per_cylinder;
4295		ccb->ccb_h.status = CAM_REQ_CMP;
4296		xpt_done(ccb);
4297		break;
4298	}
4299	case XPT_RESET_BUS:		/* Reset the specified SCSI bus */
4300	{
4301		int  found;
4302
4303		s = splcam();
4304		found = ahc_reset_channel(ahc, SIM_CHANNEL(ahc, sim),
4305					  /*initiate reset*/TRUE);
4306		splx(s);
4307		if (bootverbose) {
4308			xpt_print_path(SIM_PATH(ahc, sim));
4309			printf("SCSI bus reset delivered. "
4310			       "%d SCBs aborted.\n", found);
4311		}
4312		ccb->ccb_h.status = CAM_REQ_CMP;
4313		xpt_done(ccb);
4314		break;
4315	}
4316	case XPT_TERM_IO:		/* Terminate the I/O process */
4317		/* XXX Implement */
4318		ccb->ccb_h.status = CAM_REQ_INVALID;
4319		xpt_done(ccb);
4320		break;
4321	case XPT_PATH_INQ:		/* Path routing inquiry */
4322	{
4323		struct ccb_pathinq *cpi = &ccb->cpi;
4324
4325		cpi->version_num = 1; /* XXX??? */
4326		cpi->hba_inquiry = PI_SDTR_ABLE|PI_TAG_ABLE;
4327		if ((ahc->features & AHC_WIDE) != 0)
4328			cpi->hba_inquiry |= PI_WIDE_16;
4329		if ((ahc->flags & AHC_TARGETMODE) != 0) {
4330			cpi->target_sprt = PIT_PROCESSOR
4331					 | PIT_DISCONNECT
4332					 | PIT_TERM_IO;
4333		} else {
4334			cpi->target_sprt = 0;
4335		}
4336		cpi->hba_misc = (ahc->flags & AHC_INITIATORMODE)
4337			      ? 0 : PIM_NOINITIATOR;
4338		cpi->hba_eng_cnt = 0;
4339		cpi->max_target = (ahc->features & AHC_WIDE) ? 15 : 7;
4340		cpi->max_lun = 7;
4341		if (SIM_IS_SCSIBUS_B(ahc, sim)) {
4342			cpi->initiator_id = ahc->our_id_b;
4343			if ((ahc->flags & AHC_RESET_BUS_B) == 0)
4344				cpi->hba_misc |= PIM_NOBUSRESET;
4345		} else {
4346			cpi->initiator_id = ahc->our_id;
4347			if ((ahc->flags & AHC_RESET_BUS_A) == 0)
4348				cpi->hba_misc |= PIM_NOBUSRESET;
4349		}
4350		cpi->bus_id = cam_sim_bus(sim);
4351		strncpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
4352		strncpy(cpi->hba_vid, "Adaptec", HBA_IDLEN);
4353		strncpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
4354		cpi->unit_number = cam_sim_unit(sim);
4355		cpi->ccb_h.status = CAM_REQ_CMP;
4356		xpt_done(ccb);
4357		break;
4358	}
4359	default:
4360		ccb->ccb_h.status = CAM_REQ_INVALID;
4361		xpt_done(ccb);
4362		break;
4363	}
4364}
4365
4366static void
4367ahc_async(void *callback_arg, u_int32_t code, struct cam_path *path, void *arg)
4368{
4369	struct ahc_softc *ahc;
4370	struct cam_sim *sim;
4371
4372	sim = (struct cam_sim *)callback_arg;
4373	ahc = (struct ahc_softc *)cam_sim_softc(sim);
4374	switch (code) {
4375	case AC_LOST_DEVICE:
4376	{
4377		struct	ahc_devinfo devinfo;
4378		int	s;
4379
4380		ahc_compile_devinfo(&devinfo, SIM_SCSI_ID(ahc, sim),
4381				    xpt_path_target_id(path),
4382				    xpt_path_lun_id(path),
4383				    SIM_CHANNEL(ahc, sim),
4384				    ROLE_UNKNOWN);
4385
4386		/*
4387		 * Revert to async/narrow transfers
4388		 * for the next device.
4389		 */
4390		s = splcam();
4391		pause_sequencer(ahc);
4392		ahc_set_width(ahc, &devinfo, path, MSG_EXT_WDTR_BUS_8_BIT,
4393			      AHC_TRANS_GOAL|AHC_TRANS_CUR);
4394		ahc_set_syncrate(ahc, &devinfo, path, /*syncrate*/NULL,
4395				 /*period*/0, /*offset*/0,
4396				 AHC_TRANS_GOAL|AHC_TRANS_CUR);
4397		unpause_sequencer(ahc, /*unpause always*/FALSE);
4398		splx(s);
4399		break;
4400	}
4401	default:
4402		break;
4403	}
4404}
4405
4406static void
4407ahc_execute_scb(void *arg, bus_dma_segment_t *dm_segs, int nsegments,
4408		int error)
4409{
4410	struct	 scb *scb;
4411	union	 ccb *ccb;
4412	struct	 ahc_softc *ahc;
4413	int	 s;
4414
4415	scb = (struct scb *)arg;
4416	ccb = scb->ccb;
4417	ahc = (struct ahc_softc *)ccb->ccb_h.ccb_ahc_ptr;
4418
4419	if (nsegments != 0) {
4420		struct	  ahc_dma_seg *sg;
4421		bus_dma_segment_t *end_seg;
4422		bus_dmasync_op_t op;
4423
4424		end_seg = dm_segs + nsegments;
4425
4426		/* Copy the first SG into the data pointer area */
4427		scb->hscb->SG_pointer = scb->ahc_dmaphys;
4428		scb->hscb->data = dm_segs->ds_addr;
4429		scb->hscb->datalen = dm_segs->ds_len;
4430		dm_segs++;
4431
4432		/* Copy the remaining segments into our SG list */
4433		sg = scb->ahc_dma;
4434		while (dm_segs < end_seg) {
4435			sg->addr = dm_segs->ds_addr;
4436			sg->len = dm_segs->ds_len;
4437			sg++;
4438			dm_segs++;
4439		}
4440
4441		if ((ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN)
4442			op = BUS_DMASYNC_PREREAD;
4443		else
4444			op = BUS_DMASYNC_PREWRITE;
4445
4446		bus_dmamap_sync(ahc->dmat, scb->dmamap, op);
4447
4448		if (ccb->ccb_h.func_code == XPT_CONT_TARGET_IO) {
4449			scb->hscb->cmdpointer |= DPHASE_PENDING;
4450			if ((ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN)
4451				scb->hscb->cmdpointer |= (TARGET_DATA_IN << 8);
4452		}
4453	} else {
4454		scb->hscb->SG_pointer = 0;
4455		scb->hscb->data = 0;
4456		scb->hscb->datalen = 0;
4457	}
4458
4459	scb->sg_count = scb->hscb->SG_count = nsegments;
4460
4461	s = splcam();
4462
4463	/*
4464	 * Last time we need to check if this SCB needs to
4465	 * be aborted.
4466	 */
4467	if (ahc_ccb_status(ccb) != CAM_REQ_INPROG) {
4468		if (nsegments != 0)
4469			bus_dmamap_unload(ahc->dmat, scb->dmamap);
4470		ahc_free_scb(ahc, scb);
4471		xpt_done(ccb);
4472		splx(s);
4473		return;
4474	}
4475
4476	/* Busy this tcl if we are untagged */
4477	if ((scb->hscb->control & TAG_ENB) == 0)
4478		ahc_busy_tcl(ahc, scb);
4479
4480	LIST_INSERT_HEAD(&ahc->pending_ccbs, &ccb->ccb_h,
4481			 sim_links.le);
4482
4483	scb->flags |= SCB_ACTIVE;
4484	ccb->ccb_h.status |= CAM_SIM_QUEUED;
4485
4486	ccb->ccb_h.timeout_ch =
4487	    timeout(ahc_timeout, (caddr_t)scb,
4488		    (ccb->ccb_h.timeout * hz) / 1000);
4489
4490	if ((scb->flags & SCB_TARGET_IMMEDIATE) != 0) {
4491#if 0
4492		printf("Continueing Immediate Command %d:%d\n",
4493		       ccb->ccb_h.target_id, ccb->ccb_h.target_lun);
4494#endif
4495		pause_sequencer(ahc);
4496		if ((ahc->flags & AHC_PAGESCBS) == 0)
4497			ahc_outb(ahc, SCBPTR, scb->hscb->tag);
4498		ahc_outb(ahc, SCB_TAG, scb->hscb->tag);
4499		ahc_outb(ahc, RETURN_1, CONT_MSG_LOOP);
4500		unpause_sequencer(ahc, /*unpause_always*/FALSE);
4501	} else {
4502
4503		ahc->qinfifo[ahc->qinfifonext++] = scb->hscb->tag;
4504
4505		if ((ahc->features & AHC_QUEUE_REGS) != 0) {
4506			ahc_outb(ahc, HNSCB_QOFF, ahc->qinfifonext);
4507		} else {
4508			pause_sequencer(ahc);
4509			ahc_outb(ahc, KERNEL_QINPOS, ahc->qinfifonext);
4510			unpause_sequencer(ahc, /*unpause_always*/FALSE);
4511		}
4512	}
4513
4514	splx(s);
4515}
4516
4517static void
4518ahc_poll(struct cam_sim *sim)
4519{
4520	ahc_intr(cam_sim_softc(sim));
4521}
4522
4523static void
4524ahc_setup_data(struct ahc_softc *ahc, struct ccb_scsiio *csio,
4525	       struct scb *scb)
4526{
4527	struct hardware_scb *hscb;
4528	struct ccb_hdr *ccb_h;
4529
4530	hscb = scb->hscb;
4531	ccb_h = &csio->ccb_h;
4532
4533	if (ccb_h->func_code == XPT_SCSI_IO) {
4534		hscb->cmdlen = csio->cdb_len;
4535		if ((ccb_h->flags & CAM_CDB_POINTER) != 0) {
4536			if ((ccb_h->flags & CAM_CDB_PHYS) == 0)
4537				if (hscb->cmdlen <= 16) {
4538					memcpy(hscb->cmdstore,
4539					       csio->cdb_io.cdb_ptr,
4540					       hscb->cmdlen);
4541					hscb->cmdpointer =
4542					    hscb->cmdstore_busaddr;
4543				} else
4544					hscb->cmdpointer =
4545					    vtophys(csio->cdb_io.cdb_ptr);
4546			else
4547				hscb->cmdpointer =
4548					(u_int32_t)csio->cdb_io.cdb_ptr;
4549		} else {
4550			/*
4551			 * CCB CDB Data Storage area is only 16 bytes
4552			 * so no additional testing is required
4553			 */
4554			memcpy(hscb->cmdstore, csio->cdb_io.cdb_bytes,
4555			       hscb->cmdlen);
4556			hscb->cmdpointer = hscb->cmdstore_busaddr;
4557		}
4558	}
4559
4560	/* Only use S/G if there is a transfer */
4561	if ((ccb_h->flags & CAM_DIR_MASK) != CAM_DIR_NONE) {
4562		if ((ccb_h->flags & CAM_SCATTER_VALID) == 0) {
4563			/* We've been given a pointer to a single buffer */
4564			if ((ccb_h->flags & CAM_DATA_PHYS) == 0) {
4565				int s;
4566				int error;
4567
4568				s = splsoftvm();
4569				error = bus_dmamap_load(ahc->dmat,
4570							scb->dmamap,
4571							csio->data_ptr,
4572							csio->dxfer_len,
4573							ahc_execute_scb,
4574							scb, /*flags*/0);
4575				if (error == EINPROGRESS) {
4576					/*
4577					 * So as to maintain ordering,
4578					 * freeze the controller queue
4579					 * until our mapping is
4580					 * returned.
4581					 */
4582					xpt_freeze_simq(ahc->sim,
4583							/*count*/1);
4584					scb->ccb->ccb_h.status |=
4585					    CAM_RELEASE_SIMQ;
4586				}
4587				splx(s);
4588			} else {
4589				struct bus_dma_segment seg;
4590
4591				/* Pointer to physical buffer */
4592				if (csio->dxfer_len > AHC_MAXTRANSFER_SIZE)
4593					panic("ahc_setup_data - Transfer size "
4594					      "larger than can device max");
4595
4596				seg.ds_addr = (bus_addr_t)csio->data_ptr;
4597				seg.ds_len = csio->dxfer_len;
4598				ahc_execute_scb(scb, &seg, 1, 0);
4599			}
4600		} else {
4601			struct bus_dma_segment *segs;
4602
4603			if ((ccb_h->flags & CAM_DATA_PHYS) != 0)
4604				panic("ahc_setup_data - Physical segment "
4605				      "pointers unsupported");
4606
4607			if ((ccb_h->flags & CAM_SG_LIST_PHYS) == 0)
4608				panic("ahc_setup_data - Virtual segment "
4609				      "addresses unsupported");
4610
4611			/* Just use the segments provided */
4612			segs = (struct bus_dma_segment *)csio->data_ptr;
4613			ahc_execute_scb(scb, segs, csio->sglist_cnt, 0);
4614		}
4615	} else {
4616		ahc_execute_scb(scb, NULL, 0, 0);
4617	}
4618}
4619
4620static void
4621ahc_freeze_devq(struct ahc_softc *ahc, struct cam_path *path)
4622{
4623	int	target;
4624	char	channel;
4625	int	lun;
4626
4627	target = xpt_path_target_id(path);
4628	lun = xpt_path_lun_id(path);
4629	channel = xpt_path_sim(path)->bus_id == 0 ? 'A' : 'B';
4630
4631	ahc_search_qinfifo(ahc, target, channel, lun,
4632			   /*tag*/SCB_LIST_NULL, CAM_REQUEUE_REQ,
4633			   SEARCH_COMPLETE);
4634}
4635
4636/*
4637 * An scb (and hence an scb entry on the board) is put onto the
4638 * free list.
4639 */
4640static void
4641ahc_free_scb(struct ahc_softc *ahc, struct scb *scb)
4642{
4643	struct hardware_scb *hscb;
4644	int opri;
4645
4646	hscb = scb->hscb;
4647
4648	opri = splcam();
4649
4650	if ((ahc->flags & AHC_RESOURCE_SHORTAGE) != 0
4651	 && (scb->ccb->ccb_h.status & CAM_RELEASE_SIMQ) == 0) {
4652		scb->ccb->ccb_h.status |= CAM_RELEASE_SIMQ;
4653		ahc->flags &= ~AHC_RESOURCE_SHORTAGE;
4654	}
4655
4656	/* Clean up for the next user */
4657	scb->flags = SCB_FREE;
4658	hscb->control = 0;
4659	hscb->status = 0;
4660
4661	STAILQ_INSERT_HEAD(&ahc->scb_data->free_scbs, scb, links);
4662	splx(opri);
4663}
4664
4665/*
4666 * Get a free scb, either one already assigned to a hardware slot
4667 * on the adapter or one that will require an SCB to be paged out before
4668 * use. If there are none, see if we can allocate a new SCB.  Otherwise
4669 * either return an error or sleep.
4670 */
4671static struct scb *
4672ahc_get_scb(struct ahc_softc *ahc)
4673{
4674	struct scb *scbp;
4675	int opri;
4676
4677	opri = splcam();
4678	if ((scbp = STAILQ_FIRST(&ahc->scb_data->free_scbs))) {
4679		STAILQ_REMOVE_HEAD(&ahc->scb_data->free_scbs, links);
4680	} else if (ahc->scb_data->numscbs < ahc->scb_data->maxscbs) {
4681		scbp = ahc_alloc_scb(ahc);
4682		if (scbp == NULL)
4683			printf("%s: Can't malloc SCB\n", ahc_name(ahc));
4684	}
4685
4686	splx(opri);
4687
4688	return (scbp);
4689}
4690
4691
4692static struct scb *
4693ahc_alloc_scb(struct ahc_softc *ahc)
4694{
4695	static	struct ahc_dma_seg *next_sg_array = NULL;
4696	static	int sg_arrays_free = 0;
4697	struct	scb *newscb;
4698	int	error;
4699
4700	newscb = (struct scb *) malloc(sizeof(struct scb), M_DEVBUF, M_NOWAIT);
4701	if (newscb != NULL) {
4702		bzero(newscb, sizeof(struct scb));
4703		error = bus_dmamap_create(ahc->dmat, /*flags*/0,
4704					  &newscb->dmamap);
4705		if (error != 0)
4706			printf("%s: Unable to allocate SCB dmamap - error %d\n",
4707			       ahc_name(ahc), error);
4708
4709		if (error == 0 && next_sg_array == NULL) {
4710			size_t	alloc_size = sizeof(struct ahc_dma_seg)
4711					     * AHC_NSEG;
4712			sg_arrays_free = PAGE_SIZE / alloc_size;
4713			alloc_size *= sg_arrays_free;
4714			if (alloc_size == 0)
4715				panic("%s: SG list doesn't fit in a page",
4716				      ahc_name(ahc));
4717			next_sg_array = (struct ahc_dma_seg *)
4718					malloc(alloc_size, M_DEVBUF, M_NOWAIT);
4719		}
4720		if (error == 0 && next_sg_array != NULL) {
4721			struct hardware_scb *hscb;
4722
4723			newscb->ahc_dma = next_sg_array;
4724			newscb->ahc_dmaphys = vtophys(next_sg_array);
4725			sg_arrays_free--;
4726			if (sg_arrays_free == 0)
4727				next_sg_array = NULL;
4728			else
4729				next_sg_array = &next_sg_array[AHC_NSEG];
4730			hscb = &ahc->scb_data->hscbs[ahc->scb_data->numscbs];
4731			newscb->hscb = hscb;
4732			hscb->control = 0;
4733			hscb->status = 0;
4734			hscb->tag = ahc->scb_data->numscbs;
4735			hscb->residual_data_count[2] = 0;
4736			hscb->residual_data_count[1] = 0;
4737			hscb->residual_data_count[0] = 0;
4738			hscb->residual_SG_count = 0;
4739			hscb->cmdstore_busaddr =
4740				ahc_hscb_busaddr(ahc, hscb->tag)
4741			      + offsetof(struct hardware_scb, cmdstore);
4742			/*
4743			 * Place in the scbarray
4744			 * Never is removed.
4745			 */
4746			ahc->scb_data->scbarray[hscb->tag] = newscb;
4747			ahc->scb_data->numscbs++;
4748		} else {
4749			free(newscb, M_DEVBUF);
4750			newscb = NULL;
4751		}
4752	}
4753	return newscb;
4754}
4755
4756static void
4757ahc_loadseq(struct ahc_softc *ahc)
4758{
4759	struct patch *cur_patch;
4760	int i;
4761	int downloaded;
4762	int skip_addr;
4763	u_int8_t download_consts[4];
4764
4765	/* Setup downloadable constant table */
4766#if 0
4767	/* No downloaded constants are currently defined. */
4768	download_consts[TMODE_NUMCMDS] = ahc->num_targetcmds;
4769#endif
4770
4771	cur_patch = patches;
4772	downloaded = 0;
4773	skip_addr = 0;
4774	ahc_outb(ahc, SEQCTL, PERRORDIS|FAILDIS|FASTMODE|LOADRAM);
4775	ahc_outb(ahc, SEQADDR0, 0);
4776	ahc_outb(ahc, SEQADDR1, 0);
4777
4778	for (i = 0; i < sizeof(seqprog)/4; i++) {
4779		if (ahc_check_patch(ahc, &cur_patch, i, &skip_addr) == 0) {
4780			/*
4781			 * Don't download this instruction as it
4782			 * is in a patch that was removed.
4783			 */
4784                        continue;
4785		}
4786		ahc_download_instr(ahc, i, download_consts);
4787		downloaded++;
4788	}
4789	ahc_outb(ahc, SEQCTL, PERRORDIS|FAILDIS|FASTMODE);
4790	restart_sequencer(ahc);
4791
4792	if (bootverbose)
4793		printf(" %d instructions downloaded\n", downloaded);
4794}
4795
4796static int
4797ahc_check_patch(struct ahc_softc *ahc, struct patch **start_patch,
4798		int start_instr, int *skip_addr)
4799{
4800	struct	patch *cur_patch;
4801	struct	patch *last_patch;
4802	int	num_patches;
4803
4804	num_patches = sizeof(patches)/sizeof(struct patch);
4805	last_patch = &patches[num_patches];
4806	cur_patch = *start_patch;
4807
4808	while (cur_patch < last_patch && start_instr == cur_patch->begin) {
4809
4810		if (cur_patch->patch_func(ahc) == 0) {
4811
4812			/* Start rejecting code */
4813			*skip_addr = start_instr + cur_patch->skip_instr;
4814			cur_patch += cur_patch->skip_patch;
4815		} else {
4816			/* Accepted this patch.  Advance to the next
4817			 * one and wait for our intruction pointer to
4818			 * hit this point.
4819			 */
4820			cur_patch++;
4821		}
4822	}
4823
4824	*start_patch = cur_patch;
4825	if (start_instr < *skip_addr)
4826		/* Still skipping */
4827		return (0);
4828
4829	return (1);
4830}
4831
4832static void
4833ahc_download_instr(struct ahc_softc *ahc, int instrptr, u_int8_t *dconsts)
4834{
4835	union	ins_formats instr;
4836	struct	ins_format1 *fmt1_ins;
4837	struct	ins_format3 *fmt3_ins;
4838	u_int	opcode;
4839
4840	/* Structure copy */
4841	instr = *(union ins_formats*)&seqprog[instrptr * 4];
4842
4843	fmt1_ins = &instr.format1;
4844	fmt3_ins = NULL;
4845
4846	/* Pull the opcode */
4847	opcode = instr.format1.opcode;
4848	switch (opcode) {
4849	case AIC_OP_JMP:
4850	case AIC_OP_JC:
4851	case AIC_OP_JNC:
4852	case AIC_OP_CALL:
4853	case AIC_OP_JNE:
4854	case AIC_OP_JNZ:
4855	case AIC_OP_JE:
4856	case AIC_OP_JZ:
4857	{
4858		struct patch *cur_patch;
4859		int address_offset;
4860		u_int address;
4861		int skip_addr;
4862		int i;
4863
4864		fmt3_ins = &instr.format3;
4865		address_offset = 0;
4866		address = fmt3_ins->address;
4867		cur_patch = patches;
4868		skip_addr = 0;
4869
4870		for (i = 0; i < address;) {
4871
4872			ahc_check_patch(ahc, &cur_patch, i, &skip_addr);
4873
4874			if (skip_addr > i) {
4875				int end_addr;
4876
4877				end_addr = MIN(address, skip_addr);
4878				address_offset += end_addr - i;
4879				i = skip_addr;
4880			} else {
4881				i++;
4882			}
4883		}
4884		address -= address_offset;
4885		fmt3_ins->address = address;
4886		/* FALLTHROUGH */
4887	}
4888	case AIC_OP_OR:
4889	case AIC_OP_AND:
4890	case AIC_OP_XOR:
4891	case AIC_OP_ADD:
4892	case AIC_OP_ADC:
4893	case AIC_OP_BMOV:
4894		if (fmt1_ins->parity != 0) {
4895			fmt1_ins->immediate = dconsts[fmt1_ins->immediate];
4896		}
4897		fmt1_ins->parity = 0;
4898		/* FALLTHROUGH */
4899	case AIC_OP_ROL:
4900		if ((ahc->features & AHC_ULTRA2) != 0) {
4901			int i, count;
4902
4903			/* Calculate odd parity for the instruction */
4904			for (i = 0, count = 0; i < 31; i++) {
4905				u_int32_t mask;
4906
4907				mask = 0x01 << i;
4908				if ((instr.integer & mask) != 0)
4909					count++;
4910			}
4911			if ((count & 0x01) == 0)
4912				instr.format1.parity = 1;
4913		} else {
4914			/* Compress the instruction for older sequencers */
4915			if (fmt3_ins != NULL) {
4916				instr.integer =
4917					fmt3_ins->immediate
4918				      | (fmt3_ins->source << 8)
4919				      | (fmt3_ins->address << 16)
4920				      |	(fmt3_ins->opcode << 25);
4921			} else {
4922				instr.integer =
4923					fmt1_ins->immediate
4924				      | (fmt1_ins->source << 8)
4925				      | (fmt1_ins->destination << 16)
4926				      |	(fmt1_ins->ret << 24)
4927				      |	(fmt1_ins->opcode << 25);
4928			}
4929		}
4930		ahc_outsb(ahc, SEQRAM, instr.bytes, 4);
4931		break;
4932	default:
4933		panic("Unknown opcode encountered in seq program");
4934		break;
4935	}
4936}
4937
4938static void
4939ahc_set_recoveryscb(struct ahc_softc *ahc, struct scb *scb) {
4940
4941	if ((scb->flags & SCB_RECOVERY_SCB) == 0) {
4942		struct ccb_hdr *ccbh;
4943
4944		scb->flags |= SCB_RECOVERY_SCB;
4945
4946		/*
4947		 * Take all queued, but not sent SCBs out of the equation.
4948		 * Also ensure that no new CCBs are queued to us while we
4949		 * try to fix this problem.
4950		 */
4951		if ((scb->ccb->ccb_h.status & CAM_RELEASE_SIMQ) == 0) {
4952			xpt_freeze_simq(ahc->sim, /*count*/1);
4953			scb->ccb->ccb_h.status |= CAM_RELEASE_SIMQ;
4954		}
4955
4956		/*
4957		 * Go through all of our pending SCBs and remove
4958		 * any scheduled timeouts for them.  We will reschedule
4959		 * them after we've successfully fixed this problem.
4960		 */
4961		ccbh = ahc->pending_ccbs.lh_first;
4962		while (ccbh != NULL) {
4963			struct scb *pending_scb;
4964
4965			pending_scb = (struct scb *)ccbh->ccb_scb_ptr;
4966			untimeout(ahc_timeout, pending_scb, ccbh->timeout_ch);
4967			ccbh = ccbh->sim_links.le.le_next;
4968		}
4969	}
4970}
4971
4972static void
4973ahc_timeout(void *arg)
4974{
4975	struct	scb *scb;
4976	struct	ahc_softc *ahc;
4977	int	s, found;
4978	u_int	bus_state;
4979	int	target;
4980	int	lun;
4981	char	channel;
4982
4983	scb = (struct scb *)arg;
4984	ahc = (struct ahc_softc *)scb->ccb->ccb_h.ccb_ahc_ptr;
4985
4986	s = splcam();
4987
4988	/*
4989	 * Ensure that the card doesn't do anything
4990	 * behind our back.  Also make sure that we
4991	 * didn't "just" miss an interrupt that would
4992	 * affect this timeout.
4993	 */
4994	do {
4995		ahc_intr(ahc);
4996		pause_sequencer(ahc);
4997	} while (ahc_inb(ahc, INTSTAT) & INT_PEND);
4998
4999	if ((scb->flags & SCB_ACTIVE) == 0) {
5000		/* Previous timeout took care of me already */
5001		printf("Timedout SCB handled by another timeout\n");
5002		unpause_sequencer(ahc, /*unpause_always*/TRUE);
5003		splx(s);
5004		return;
5005	}
5006
5007	target = SCB_TARGET(scb);
5008	channel = SCB_CHANNEL(scb);
5009	lun = SCB_LUN(scb);
5010
5011	xpt_print_path(scb->ccb->ccb_h.path);
5012	printf("SCB 0x%x - timed out ", scb->hscb->tag);
5013	/*
5014	 * Take a snapshot of the bus state and print out
5015	 * some information so we can track down driver bugs.
5016	 */
5017	bus_state = ahc_inb(ahc, LASTPHASE);
5018
5019	switch(bus_state)
5020	{
5021	case P_DATAOUT:
5022		printf("in dataout phase");
5023		break;
5024	case P_DATAIN:
5025		printf("in datain phase");
5026		break;
5027	case P_COMMAND:
5028		printf("in command phase");
5029		break;
5030	case P_MESGOUT:
5031		printf("in message out phase");
5032		break;
5033	case P_STATUS:
5034		printf("in status phase");
5035		break;
5036	case P_MESGIN:
5037		printf("in message in phase");
5038		break;
5039	case P_BUSFREE:
5040		printf("while idle, LASTPHASE == 0x%x",
5041			bus_state);
5042		break;
5043	default:
5044		/*
5045		 * We aren't in a valid phase, so assume we're
5046		 * idle.
5047		 */
5048		printf("invalid phase, LASTPHASE == 0x%x",
5049			bus_state);
5050		bus_state = P_BUSFREE;
5051		break;
5052	}
5053
5054	printf(", SEQADDR == 0x%x\n",
5055	       ahc_inb(ahc, SEQADDR0) | (ahc_inb(ahc, SEQADDR1) << 8));
5056
5057#if 0
5058	printf(", SCSISIGI == 0x%x\n", ahc_inb(ahc, SCSISIGI));
5059	printf("SIMODE1 = 0x%x\n", ahc_inb(ahc, SIMODE1));
5060	printf("INTSTAT = 0x%x\n", ahc_inb(ahc, INTSTAT));
5061	printf("SSTAT1 == 0x%x\n", ahc_inb(ahc, SSTAT1));
5062	printf("SCSIRATE == 0x%x\n", ahc_inb(ahc, SCSIRATE));
5063	printf("CCSCBCTL == 0x%x\n", ahc_inb(ahc, CCSCBCTL));
5064	printf("CCSCBCNT == 0x%x\n", ahc_inb(ahc, CCSCBCNT));
5065	printf("DFCNTRL == 0x%x\n", ahc_inb(ahc, DFCNTRL));
5066	printf("DFSTATUS == 0x%x\n", ahc_inb(ahc, DFSTATUS));
5067	printf("CCHCNT == 0x%x\n", ahc_inb(ahc, CCHCNT));
5068#endif
5069	if (scb->flags & SCB_DEVICE_RESET) {
5070		/*
5071		 * Been down this road before.
5072		 * Do a full bus reset.
5073		 */
5074bus_reset:
5075		ahc_set_ccb_status(scb->ccb, CAM_CMD_TIMEOUT);
5076		found = ahc_reset_channel(ahc, channel, /*Initiate Reset*/TRUE);
5077		printf("%s: Issued Channel %c Bus Reset. "
5078		       "%d SCBs aborted\n", ahc_name(ahc), channel, found);
5079	} else {
5080		/*
5081		 * If we are a target, transition to bus free and report
5082		 * the timeout.
5083		 *
5084		 * The target/initiator that is holding up the bus may not
5085		 * be the same as the one that triggered this timeout
5086		 * (different commands have different timeout lengths).
5087		 * If the bus is idle and we are actiing as the initiator
5088		 * for this request, queue a BDR message to the timed out
5089		 * target.  Otherwise, if the timed out transaction is
5090		 * active:
5091		 *   Initiator transaction:
5092		 *	Stuff the message buffer with a BDR message and assert
5093		 *	ATN in the hopes that the target will let go of the bus
5094		 *	and go to the mesgout phase.  If this fails, we'll
5095		 *	get another timeout 2 seconds later which will attempt
5096		 *	a bus reset.
5097		 *
5098		 *   Target transaction:
5099		 *	Transition to BUS FREE and report the error.
5100		 *	It's good to be the target!
5101		 */
5102		u_int active_scb_index;
5103
5104		active_scb_index = ahc_inb(ahc, SCB_TAG);
5105
5106		if (bus_state != P_BUSFREE
5107		  && (active_scb_index < ahc->scb_data->numscbs)) {
5108			struct scb *active_scb;
5109
5110			/*
5111			 * If the active SCB is not from our device,
5112			 * assume that another device is hogging the bus
5113			 * and wait for it's timeout to expire before
5114			 * taking additional action.
5115			 */
5116			active_scb = ahc->scb_data->scbarray[active_scb_index];
5117			if (active_scb->hscb->tcl != scb->hscb->tcl
5118			 && (scb->flags & SCB_OTHERTCL_TIMEOUT) == 0) {
5119				struct	ccb_hdr *ccbh;
5120				u_int	newtimeout;
5121
5122				xpt_print_path(scb->ccb->ccb_h.path);
5123				printf("Other SCB Timeout\n");
5124				scb->flags |= SCB_OTHERTCL_TIMEOUT;
5125				newtimeout = MAX(active_scb->ccb->ccb_h.timeout,
5126						 scb->ccb->ccb_h.timeout);
5127				ccbh = &scb->ccb->ccb_h;
5128				scb->ccb->ccb_h.timeout_ch =
5129				    timeout(ahc_timeout, scb,
5130					    (newtimeout * hz) / 1000);
5131				splx(s);
5132				return;
5133			}
5134
5135			/* It's us */
5136			if ((scb->hscb->control & TARGET_SCB) != 0) {
5137
5138				/*
5139				 * Send back any queued up transactions
5140				 * and properly record the error condition.
5141				 */
5142				ahc_freeze_devq(ahc, scb->ccb->ccb_h.path);
5143				ahc_set_ccb_status(scb->ccb, CAM_CMD_TIMEOUT);
5144				ahc_freeze_ccb(scb->ccb);
5145				ahc_done(ahc, scb);
5146
5147				/* Will clear us from the bus */
5148				restart_sequencer(ahc);
5149				return;
5150			}
5151
5152			ahc_set_recoveryscb(ahc, active_scb);
5153			ahc_outb(ahc, MSG_OUT, MSG_BUS_DEV_RESET);
5154			ahc_outb(ahc, SCSISIGO, bus_state|ATNO);
5155			xpt_print_path(active_scb->ccb->ccb_h.path);
5156			printf("BDR message in message buffer\n");
5157			active_scb->flags |=  SCB_DEVICE_RESET;
5158			active_scb->ccb->ccb_h.timeout_ch =
5159			    timeout(ahc_timeout, (caddr_t)active_scb, 2 * hz);
5160			unpause_sequencer(ahc, /*unpause_always*/FALSE);
5161		} else {
5162			int	 disconnected;
5163
5164			if ((scb->hscb->control & TARGET_SCB) != 0)
5165				panic("Timed-out target SCB but bus idle");
5166
5167			if (bus_state != P_BUSFREE
5168			 && (ahc_inb(ahc, SSTAT0) & TARGET) != 0) {
5169				/* Hung target selection.  Goto busfree */
5170				printf("%s: Hung target selection\n",
5171				       ahc_name(ahc));
5172				restart_sequencer(ahc);
5173				return;
5174			}
5175
5176			if (ahc_search_qinfifo(ahc, target, channel, lun,
5177					       scb->hscb->tag, /*status*/0,
5178					       SEARCH_COUNT) > 0) {
5179				disconnected = FALSE;
5180			} else {
5181				disconnected = TRUE;
5182			}
5183
5184			if (disconnected) {
5185
5186				ahc_set_recoveryscb(ahc, scb);
5187				/*
5188				 * Simply set the MK_MESSAGE control bit.
5189				 */
5190				scb->hscb->control |= MK_MESSAGE;
5191				scb->flags |= SCB_QUEUED_MSG
5192					   |  SCB_DEVICE_RESET;
5193
5194				/*
5195				 * Remove this SCB from the disconnected
5196				 * list so that a reconnect at this point
5197				 * causes a BDR.
5198				 */
5199				ahc_search_disc_list(ahc, target, channel, lun,
5200						     scb->hscb->tag);
5201				ahc_index_busy_tcl(ahc, scb->hscb->tcl,
5202						   /*unbusy*/TRUE);
5203
5204				/*
5205				 * Actually re-queue this SCB in case we can
5206				 * select the device before it reconnects.
5207				 * Clear out any entries in the QINFIFO first
5208				 * so we are the next SCB for this target
5209				 * to run.
5210				 */
5211				ahc_search_qinfifo(ahc, SCB_TARGET(scb),
5212						   channel, SCB_LUN(scb),
5213						   SCB_LIST_NULL,
5214						   CAM_REQUEUE_REQ,
5215						   SEARCH_COMPLETE);
5216				xpt_print_path(scb->ccb->ccb_h.path);
5217				printf("Queuing a BDR SCB\n");
5218				ahc->qinfifo[ahc->qinfifonext++] =
5219				    scb->hscb->tag;
5220				if ((ahc->features & AHC_QUEUE_REGS) != 0) {
5221					ahc_outb(ahc, HNSCB_QOFF,
5222						 ahc->qinfifonext);
5223				} else {
5224					ahc_outb(ahc, KERNEL_QINPOS,
5225						 ahc->qinfifonext);
5226				}
5227				scb->ccb->ccb_h.timeout_ch =
5228				    timeout(ahc_timeout, (caddr_t)scb, 2 * hz);
5229				unpause_sequencer(ahc, /*unpause_always*/FALSE);
5230			} else {
5231				/* Go "immediatly" to the bus reset */
5232				/* This shouldn't happen */
5233				ahc_set_recoveryscb(ahc, scb);
5234				xpt_print_path(scb->ccb->ccb_h.path);
5235				printf("SCB %d: Immediate reset.  "
5236					"Flags = 0x%x\n", scb->hscb->tag,
5237					scb->flags);
5238				goto bus_reset;
5239			}
5240		}
5241	}
5242	splx(s);
5243}
5244
5245static int
5246ahc_search_qinfifo(struct ahc_softc *ahc, int target, char channel,
5247		   int lun, u_int tag, u_int32_t status,
5248		   ahc_search_action action)
5249{
5250	struct	 scb *scbp;
5251	u_int8_t qinpos;
5252	u_int8_t qintail;
5253	int	 found;
5254
5255	qinpos = ahc_inb(ahc, QINPOS);
5256	qintail = ahc->qinfifonext;
5257	found = 0;
5258
5259	/*
5260	 * Start with an empty queue.  Entries that are not chosen
5261	 * for removal will be re-added to the queue as we go.
5262	 */
5263	ahc->qinfifonext = qinpos;
5264
5265	while (qinpos != qintail) {
5266		scbp = ahc->scb_data->scbarray[ahc->qinfifo[qinpos]];
5267		if (ahc_match_scb(scbp, target, channel, lun, tag)) {
5268			/*
5269			 * We found an scb that needs to be removed.
5270			 */
5271			switch (action) {
5272			case SEARCH_COMPLETE:
5273				if (ahc_ccb_status(scbp->ccb) == CAM_REQ_INPROG)
5274					ahc_set_ccb_status(scbp->ccb, status);
5275				ahc_freeze_ccb(scbp->ccb);
5276				ahc_done(ahc, scbp);
5277				break;
5278			case SEARCH_COUNT:
5279				ahc->qinfifo[ahc->qinfifonext++] =
5280				    scbp->hscb->tag;
5281				break;
5282			case SEARCH_REMOVE:
5283				break;
5284			}
5285			found++;
5286		} else {
5287			ahc->qinfifo[ahc->qinfifonext++] = scbp->hscb->tag;
5288		}
5289		qinpos++;
5290	}
5291
5292	if ((ahc->features & AHC_QUEUE_REGS) != 0) {
5293		ahc_outb(ahc, HNSCB_QOFF, ahc->qinfifonext);
5294	} else {
5295		ahc_outb(ahc, KERNEL_QINPOS, ahc->qinfifonext);
5296	}
5297
5298	return (found);
5299}
5300
5301
5302static void
5303ahc_abort_ccb(struct ahc_softc *ahc, struct cam_sim *sim, union ccb *ccb)
5304{
5305	union ccb *abort_ccb;
5306
5307	abort_ccb = ccb->cab.abort_ccb;
5308	switch (abort_ccb->ccb_h.func_code) {
5309	case XPT_ACCEPT_TARGET_IO:
5310	case XPT_IMMED_NOTIFY:
5311	case XPT_CONT_TARGET_IO:
5312	{
5313		struct tmode_tstate *tstate;
5314		struct tmode_lstate *lstate;
5315		struct ccb_hdr_slist *list;
5316		cam_status status;
5317
5318		status = ahc_find_tmode_devs(ahc, sim, abort_ccb, &tstate,
5319					     &lstate, TRUE);
5320
5321		if (status != CAM_REQ_CMP) {
5322			ccb->ccb_h.status = status;
5323			break;
5324		}
5325
5326		if (abort_ccb->ccb_h.func_code == XPT_ACCEPT_TARGET_IO)
5327			list = &lstate->accept_tios;
5328		else if (abort_ccb->ccb_h.func_code == XPT_IMMED_NOTIFY)
5329			list = &lstate->immed_notifies;
5330		else
5331			list = NULL;
5332
5333		if (list != NULL) {
5334			struct ccb_hdr *curelm;
5335			int found;
5336
5337			curelm = SLIST_FIRST(list);
5338			found = 0;
5339			if (curelm == &abort_ccb->ccb_h) {
5340				found = 1;
5341				SLIST_REMOVE_HEAD(list, sim_links.sle);
5342			} else {
5343				while(curelm != NULL) {
5344					struct ccb_hdr *nextelm;
5345
5346					nextelm =
5347					    SLIST_NEXT(curelm, sim_links.sle);
5348
5349					if (nextelm == &abort_ccb->ccb_h) {
5350						found = 1;
5351						SLIST_NEXT(curelm,
5352							   sim_links.sle) =
5353						    SLIST_NEXT(nextelm,
5354							       sim_links.sle);
5355						break;
5356					}
5357					curelm = nextelm;
5358				}
5359			}
5360
5361			if (found) {
5362				abort_ccb->ccb_h.status = CAM_REQ_ABORTED;
5363				xpt_done(abort_ccb);
5364				ccb->ccb_h.status = CAM_REQ_CMP;
5365			} else {
5366				printf("Not found\n");
5367				ccb->ccb_h.status = CAM_PATH_INVALID;
5368			}
5369			break;
5370		}
5371		/* FALLTHROUGH */
5372	}
5373	case XPT_SCSI_IO:
5374		/* XXX Fully implement the hard ones */
5375		ccb->ccb_h.status = CAM_UA_ABORT;
5376		break;
5377	default:
5378		ccb->ccb_h.status = CAM_REQ_INVALID;
5379		break;
5380	}
5381	xpt_done(ccb);
5382}
5383
5384/*
5385 * Abort all SCBs that match the given description (target/channel/lun/tag),
5386 * setting their status to the passed in status if the status has not already
5387 * been modified from CAM_REQ_INPROG.  This routine assumes that the sequencer
5388 * is paused before it is called.
5389 */
5390static int
5391ahc_abort_scbs(struct ahc_softc *ahc, int target, char channel,
5392	       int lun, u_int tag, u_int32_t status)
5393{
5394	struct	scb *scbp;
5395	u_int	active_scb;
5396	int	i;
5397	int	found;
5398
5399	/* restore this when we're done */
5400	active_scb = ahc_inb(ahc, SCBPTR);
5401
5402	found = ahc_search_qinfifo(ahc, target, channel, lun, tag,
5403				   CAM_REQUEUE_REQ, SEARCH_COMPLETE);
5404
5405	/*
5406	 * Search waiting for selection list.
5407	 */
5408	{
5409		u_int8_t next, prev;
5410
5411		next = ahc_inb(ahc, WAITING_SCBH);  /* Start at head of list. */
5412		prev = SCB_LIST_NULL;
5413
5414		while (next != SCB_LIST_NULL) {
5415			u_int8_t scb_index;
5416
5417			ahc_outb(ahc, SCBPTR, next);
5418			scb_index = ahc_inb(ahc, SCB_TAG);
5419			if (scb_index >= ahc->scb_data->numscbs) {
5420				panic("Waiting List inconsistency. "
5421				      "SCB index == %d, yet numscbs == %d.",
5422				      scb_index, ahc->scb_data->numscbs);
5423			}
5424			scbp = ahc->scb_data->scbarray[scb_index];
5425			if (ahc_match_scb(scbp, target, channel, lun, tag)) {
5426
5427				next = ahc_abort_wscb(ahc, next, prev);
5428			} else {
5429
5430				prev = next;
5431				next = ahc_inb(ahc, SCB_NEXT);
5432			}
5433		}
5434	}
5435	/*
5436	 * Go through the disconnected list and remove any entries we
5437	 * have queued for completion, 0'ing their control byte too.
5438	 */
5439	ahc_search_disc_list(ahc, target, channel, lun, tag);
5440
5441	/*
5442	 * Go through the hardware SCB array looking for commands that
5443	 * were active but not on any list.
5444	 */
5445	for(i = 0; i < ahc->scb_data->maxhscbs; i++) {
5446		u_int scbid;
5447
5448		ahc_outb(ahc, SCBPTR, i);
5449		scbid = ahc_inb(ahc, SCB_TAG);
5450		if (scbid < ahc->scb_data->numscbs) {
5451			scbp = ahc->scb_data->scbarray[scbid];
5452			if (ahc_match_scb(scbp, target, channel, lun, tag)) {
5453				ahc_add_curscb_to_free_list(ahc);
5454                        }
5455		}
5456	}
5457	/*
5458	 * Go through the pending CCB list and look for
5459	 * commands for this target that are still active.
5460	 * These are other tagged commands that were
5461	 * disconnected when the reset occured.
5462	 */
5463	{
5464		struct ccb_hdr *ccb_h;
5465
5466
5467		ccb_h = ahc->pending_ccbs.lh_first;
5468
5469		while (ccb_h != NULL) {
5470			scbp = (struct scb *)ccb_h->ccb_scb_ptr;
5471			ccb_h = ccb_h->sim_links.le.le_next;
5472			if (ahc_match_scb(scbp, target, channel, lun, tag)) {
5473				if (ahc_ccb_status(scbp->ccb) == CAM_REQ_INPROG)
5474					ahc_set_ccb_status(scbp->ccb, status);
5475				ahc_freeze_ccb(scbp->ccb);
5476				ahc_done(ahc, scbp);
5477				found++;
5478			}
5479		}
5480	}
5481	ahc_outb(ahc, SCBPTR, active_scb);
5482	return found;
5483}
5484
5485static int
5486ahc_search_disc_list(struct ahc_softc *ahc, int target, char channel,
5487		     int lun, u_int tag)
5488{
5489	struct	scb *scbp;
5490	u_int	next;
5491	u_int	prev;
5492	u_int	count;
5493	u_int	active_scb;
5494
5495	count = 0;
5496	next = ahc_inb(ahc, DISCONNECTED_SCBH);
5497	prev = SCB_LIST_NULL;
5498
5499	/* restore this when we're done */
5500	active_scb = ahc_inb(ahc, SCBPTR);
5501
5502	while (next != SCB_LIST_NULL) {
5503		u_int scb_index;
5504
5505		ahc_outb(ahc, SCBPTR, next);
5506		scb_index = ahc_inb(ahc, SCB_TAG);
5507		if (scb_index >= ahc->scb_data->numscbs) {
5508			panic("Disconnected List inconsistency. "
5509			      "SCB index == %d, yet numscbs == %d.",
5510			      scb_index, ahc->scb_data->numscbs);
5511		}
5512		scbp = ahc->scb_data->scbarray[scb_index];
5513		if (ahc_match_scb(scbp, target, channel, lun, tag)) {
5514			next = ahc_rem_scb_from_disc_list(ahc, prev,
5515							  next);
5516			count++;
5517		} else {
5518			prev = next;
5519			next = ahc_inb(ahc, SCB_NEXT);
5520		}
5521	}
5522	ahc_outb(ahc, SCBPTR, active_scb);
5523	return (count);
5524}
5525
5526static u_int
5527ahc_rem_scb_from_disc_list(struct ahc_softc *ahc, u_int prev, u_int scbptr)
5528{
5529	u_int next;
5530
5531	ahc_outb(ahc, SCBPTR, scbptr);
5532	next = ahc_inb(ahc, SCB_NEXT);
5533
5534	ahc_outb(ahc, SCB_CONTROL, 0);
5535
5536	ahc_add_curscb_to_free_list(ahc);
5537
5538	if (prev != SCB_LIST_NULL) {
5539		ahc_outb(ahc, SCBPTR, prev);
5540		ahc_outb(ahc, SCB_NEXT, next);
5541	} else
5542		ahc_outb(ahc, DISCONNECTED_SCBH, next);
5543
5544	return next;
5545}
5546
5547static void
5548ahc_add_curscb_to_free_list(struct ahc_softc *ahc)
5549{
5550	/* Invalidate the tag so that ahc_find_scb doesn't think it's active */
5551	ahc_outb(ahc, SCB_TAG, SCB_LIST_NULL);
5552
5553	ahc_outb(ahc, SCB_NEXT, ahc_inb(ahc, FREE_SCBH));
5554	ahc_outb(ahc, FREE_SCBH, ahc_inb(ahc, SCBPTR));
5555}
5556
5557/*
5558 * Manipulate the waiting for selection list and return the
5559 * scb that follows the one that we remove.
5560 */
5561static u_int
5562ahc_abort_wscb(struct ahc_softc *ahc, u_int scbpos, u_int prev)
5563{
5564	u_int curscb, next;
5565
5566	/*
5567	 * Select the SCB we want to abort and
5568	 * pull the next pointer out of it.
5569	 */
5570	curscb = ahc_inb(ahc, SCBPTR);
5571	ahc_outb(ahc, SCBPTR, scbpos);
5572	next = ahc_inb(ahc, SCB_NEXT);
5573
5574	/* Clear the necessary fields */
5575	ahc_outb(ahc, SCB_CONTROL, 0);
5576
5577	ahc_add_curscb_to_free_list(ahc);
5578
5579	/* update the waiting list */
5580	if (prev == SCB_LIST_NULL) {
5581		/* First in the list */
5582		ahc_outb(ahc, WAITING_SCBH, next);
5583
5584		/*
5585		 * Ensure we aren't attempting to perform
5586		 * selection for this entry.
5587		 */
5588		ahc_outb(ahc, SCSISEQ, (ahc_inb(ahc, SCSISEQ) & ~ENSELO));
5589	} else {
5590		/*
5591		 * Select the scb that pointed to us
5592		 * and update its next pointer.
5593		 */
5594		ahc_outb(ahc, SCBPTR, prev);
5595		ahc_outb(ahc, SCB_NEXT, next);
5596	}
5597
5598	/*
5599	 * Point us back at the original scb position.
5600	 */
5601	ahc_outb(ahc, SCBPTR, curscb);
5602	return next;
5603}
5604
5605static void
5606ahc_clear_intstat(struct ahc_softc *ahc)
5607{
5608	/* Clear any interrupt conditions this may have caused */
5609	ahc_outb(ahc, CLRSINT0, CLRSELDO|CLRSELDI|CLRSELINGO);
5610	ahc_outb(ahc, CLRSINT1, CLRSELTIMEO|CLRATNO|CLRSCSIRSTI
5611				|CLRBUSFREE|CLRSCSIPERR|CLRPHASECHG|
5612				CLRREQINIT);
5613	ahc_outb(ahc, CLRINT, CLRSCSIINT);
5614}
5615
5616static void
5617ahc_reset_current_bus(struct ahc_softc *ahc)
5618{
5619	u_int8_t scsiseq;
5620
5621	ahc_outb(ahc, SIMODE1, ahc_inb(ahc, SIMODE1) & ~ENSCSIRST);
5622	scsiseq = ahc_inb(ahc, SCSISEQ);
5623	ahc_outb(ahc, SCSISEQ, scsiseq | SCSIRSTO);
5624	DELAY(AHC_BUSRESET_DELAY);
5625	/* Turn off the bus reset */
5626	ahc_outb(ahc, SCSISEQ, scsiseq & ~SCSIRSTO);
5627
5628	ahc_clear_intstat(ahc);
5629
5630	/* Re-enable reset interrupts */
5631	ahc_outb(ahc, SIMODE1, ahc_inb(ahc, SIMODE1) | ENSCSIRST);
5632}
5633
5634static int
5635ahc_reset_channel(struct ahc_softc *ahc, char channel, int initiate_reset)
5636{
5637	struct	cam_path *path;
5638	u_int	initiator, target, max_scsiid;
5639	u_int	sblkctl;
5640	u_int	our_id;
5641	int	found;
5642	char	cur_channel;
5643
5644	ahc->pending_device = NULL;
5645
5646	pause_sequencer(ahc);
5647	/*
5648	 * Clean up all the state information for the
5649	 * pending transactions on this bus.
5650	 */
5651	found = ahc_abort_scbs(ahc, CAM_TARGET_WILDCARD, channel,
5652			       CAM_LUN_WILDCARD, SCB_LIST_NULL,
5653			       CAM_SCSI_BUS_RESET);
5654	if (channel == 'B') {
5655		path = ahc->path_b;
5656		our_id = ahc->our_id_b;
5657	} else {
5658		path = ahc->path;
5659		our_id = ahc->our_id;
5660	}
5661
5662	/* Notify the XPT that a bus reset occurred */
5663	xpt_async(AC_BUS_RESET, path, NULL);
5664
5665	/*
5666	 * Revert to async/narrow transfers until we renegotiate.
5667	 */
5668	max_scsiid = (ahc->features & AHC_WIDE) ? 15 : 7;
5669	for (target = 0; target <= max_scsiid; target++) {
5670
5671		if (ahc->enabled_targets[target] == NULL)
5672			continue;
5673		for (initiator = 0; initiator <= max_scsiid; initiator++) {
5674			struct ahc_devinfo devinfo;
5675
5676			ahc_compile_devinfo(&devinfo, target, initiator,
5677					    CAM_LUN_WILDCARD,
5678					    channel, ROLE_UNKNOWN);
5679			ahc_set_width(ahc, &devinfo, path,
5680				      MSG_EXT_WDTR_BUS_8_BIT,
5681				      AHC_TRANS_CUR);
5682			ahc_set_syncrate(ahc, &devinfo, path,
5683					 /*syncrate*/NULL, /*period*/0,
5684					 /*offset*/0, AHC_TRANS_CUR);
5685		}
5686	}
5687
5688	/*
5689	 * Reset the bus if we are initiating this reset and
5690	 * restart/unpause the sequencer
5691	 */
5692	sblkctl = ahc_inb(ahc, SBLKCTL);
5693	cur_channel = 'A';
5694	if ((ahc->features & AHC_TWIN) != 0
5695	 && ((sblkctl & SELBUSB) != 0))
5696	    cur_channel = 'B';
5697	if (cur_channel != channel) {
5698		/* Case 1: Command for another bus is active
5699		 * Stealthily reset the other bus without
5700		 * upsetting the current bus.
5701		 */
5702		ahc_outb(ahc, SBLKCTL, sblkctl ^ SELBUSB);
5703		ahc_outb(ahc, SIMODE1, ahc_inb(ahc, SIMODE1) & ~ENBUSFREE);
5704		ahc_outb(ahc, SCSISEQ,
5705			 ahc_inb(ahc, SCSISEQ) & (ENSELI|ENRSELI|ENAUTOATNP));
5706		if (initiate_reset)
5707			ahc_reset_current_bus(ahc);
5708		ahc_clear_intstat(ahc);
5709		ahc_outb(ahc, SBLKCTL, sblkctl);
5710		unpause_sequencer(ahc, /*unpause_always*/FALSE);
5711	} else {
5712		/* Case 2: A command from this bus is active or we're idle */
5713		ahc_clear_msg_state(ahc);
5714		ahc_outb(ahc, SIMODE1, ahc_inb(ahc, SIMODE1) & ~ENBUSFREE);
5715		ahc_outb(ahc, SCSISEQ,
5716			 ahc_inb(ahc, SCSISEQ) & (ENSELI|ENRSELI|ENAUTOATNP));
5717		if (initiate_reset)
5718			ahc_reset_current_bus(ahc);
5719		ahc_clear_intstat(ahc);
5720		restart_sequencer(ahc);
5721	}
5722	return found;
5723}
5724
5725static int
5726ahc_match_scb (struct scb *scb, int target, char channel, int lun, u_int tag)
5727{
5728	int targ = SCB_TARGET(scb);
5729	char chan = SCB_CHANNEL(scb);
5730	int slun = SCB_LUN(scb);
5731	int match;
5732
5733	match = ((chan == channel) || (channel == ALL_CHANNELS));
5734	if (match != 0)
5735		match = ((targ == target) || (target == CAM_TARGET_WILDCARD));
5736	if (match != 0)
5737		match = ((lun == slun) || (lun == CAM_LUN_WILDCARD));
5738	if (match != 0)
5739		match = ((tag == scb->hscb->tag) || (tag == SCB_LIST_NULL));
5740
5741	return match;
5742}
5743
5744static void
5745ahc_construct_sdtr(struct ahc_softc *ahc, u_int period, u_int offset)
5746{
5747	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXTENDED;
5748	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXT_SDTR_LEN;
5749	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXT_SDTR;
5750	ahc->msgout_buf[ahc->msgout_index++] = period;
5751	ahc->msgout_buf[ahc->msgout_index++] = offset;
5752	ahc->msgout_len += 5;
5753}
5754
5755static void
5756ahc_construct_wdtr(struct ahc_softc *ahc, u_int bus_width)
5757{
5758	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXTENDED;
5759	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXT_WDTR_LEN;
5760	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXT_WDTR;
5761	ahc->msgout_buf[ahc->msgout_index++] = bus_width;
5762	ahc->msgout_len += 4;
5763}
5764
5765static void
5766ahc_calc_residual(struct scb *scb)
5767{
5768	struct	hardware_scb *hscb;
5769
5770	hscb = scb->hscb;
5771
5772	/*
5773	 * If the disconnected flag is still set, this is bogus
5774	 * residual information left over from a sequencer
5775	 * pagin/pageout, so ignore this case.
5776	 */
5777	if ((scb->hscb->control & DISCONNECTED) == 0) {
5778		u_int32_t resid;
5779		int	  resid_sgs;
5780		int	  sg;
5781
5782		/*
5783		 * Remainder of the SG where the transfer
5784		 * stopped.
5785		 */
5786		resid = (hscb->residual_data_count[2] << 16)
5787		      |	(hscb->residual_data_count[1] <<8)
5788		      |	(hscb->residual_data_count[0]);
5789
5790		/*
5791		 * Add up the contents of all residual
5792		 * SG segments that are after the SG where
5793		 * the transfer stopped.
5794		 */
5795		resid_sgs = scb->hscb->residual_SG_count - 1/*current*/;
5796		sg = scb->sg_count - resid_sgs - 1/*first SG*/;
5797		while (resid_sgs > 0) {
5798
5799			resid += scb->ahc_dma[sg].len;
5800			sg++;
5801			resid_sgs--;
5802		}
5803		if ((scb->flags & SCB_SENSE) == 0) {
5804
5805			scb->ccb->csio.resid = resid;
5806		} else {
5807
5808			scb->ccb->csio.sense_resid = resid;
5809		}
5810	}
5811
5812	/*
5813	 * Clean out the residual information in this SCB for its
5814	 * next consumer.
5815	 */
5816	hscb->residual_data_count[0] = 0;
5817	hscb->residual_data_count[1] = 0;
5818	hscb->residual_data_count[2] = 0;
5819	hscb->residual_SG_count = 0;
5820
5821#ifdef AHC_DEBUG
5822	if (ahc_debug & AHC_SHOWMISC) {
5823		sc_print_addr(xs->sc_link);
5824		printf("Handled Residual of %ld bytes\n" ,xs->resid);
5825	}
5826#endif
5827}
5828
5829static void
5830ahc_update_pending_syncrates(struct ahc_softc *ahc)
5831{
5832	struct	ccb_hdr *ccbh;
5833	int	pending_ccb_count;
5834	int	i;
5835	u_int	saved_scbptr;
5836
5837	/*
5838	 * Traverse the pending SCB list and ensure that all of the
5839	 * SCBs there have the proper settings.
5840	 */
5841	ccbh = LIST_FIRST(&ahc->pending_ccbs);
5842	pending_ccb_count = 0;
5843	while (ccbh != NULL) {
5844		struct ahc_devinfo devinfo;
5845		union  ccb *ccb;
5846		struct scb *pending_scb;
5847		struct hardware_scb *pending_hscb;
5848		struct ahc_initiator_tinfo *tinfo;
5849		struct tmode_tstate *tstate;
5850		u_int  our_id, remote_id;
5851
5852		ccb = (union ccb*)ccbh;
5853		pending_scb = (struct scb *)ccbh->ccb_scb_ptr;
5854		pending_hscb = pending_scb->hscb;
5855		if (ccbh->func_code == XPT_CONT_TARGET_IO) {
5856			our_id = ccb->ccb_h.target_id;
5857			remote_id = ccb->ctio.init_id;
5858		} else {
5859			our_id = SCB_IS_SCSIBUS_B(pending_scb)
5860			       ? ahc->our_id_b : ahc->our_id;
5861			remote_id = ccb->ccb_h.target_id;
5862		}
5863		ahc_compile_devinfo(&devinfo, our_id, remote_id,
5864				    SCB_LUN(pending_scb),
5865				    SCB_CHANNEL(pending_scb),
5866				    ROLE_UNKNOWN);
5867		tinfo = ahc_fetch_transinfo(ahc, devinfo.channel,
5868					    our_id, remote_id, &tstate);
5869		pending_hscb->control &= ~ULTRAENB;
5870		if ((tstate->ultraenb & devinfo.target_mask) != 0)
5871			pending_hscb->control |= ULTRAENB;
5872		pending_hscb->scsirate = tinfo->scsirate;
5873		pending_hscb->scsioffset = tinfo->current.offset;
5874		pending_ccb_count++;
5875		ccbh = LIST_NEXT(ccbh, sim_links.le);
5876	}
5877
5878	if (pending_ccb_count == 0)
5879		return;
5880
5881	saved_scbptr = ahc_inb(ahc, SCBPTR);
5882	/* Ensure that the hscbs down on the card match the new information */
5883	for (i = 0; i < ahc->scb_data->maxhscbs; i++) {
5884		u_int scb_tag;
5885
5886		ahc_outb(ahc, SCBPTR, i);
5887		scb_tag = ahc_inb(ahc, SCB_TAG);
5888		if (scb_tag != SCB_LIST_NULL) {
5889			struct	ahc_devinfo devinfo;
5890			union  ccb *ccb;
5891			struct	scb *pending_scb;
5892			struct	hardware_scb *pending_hscb;
5893			struct	ahc_initiator_tinfo *tinfo;
5894			struct	tmode_tstate *tstate;
5895			u_int	our_id, remote_id;
5896			u_int	control;
5897
5898			pending_scb = ahc->scb_data->scbarray[scb_tag];
5899			if (pending_scb->flags == SCB_FREE)
5900				continue;
5901			pending_hscb = pending_scb->hscb;
5902			ccb = pending_scb->ccb;
5903			if (ccb->ccb_h.func_code == XPT_CONT_TARGET_IO) {
5904				our_id = ccb->ccb_h.target_id;
5905				remote_id = ccb->ctio.init_id;
5906			} else {
5907				our_id = SCB_IS_SCSIBUS_B(pending_scb)
5908				       ? ahc->our_id_b : ahc->our_id;
5909				remote_id = ccb->ccb_h.target_id;
5910			}
5911			ahc_compile_devinfo(&devinfo, our_id, remote_id,
5912					    SCB_LUN(pending_scb),
5913					    SCB_CHANNEL(pending_scb),
5914					    ROLE_UNKNOWN);
5915			tinfo = ahc_fetch_transinfo(ahc, devinfo.channel,
5916						    our_id, remote_id, &tstate);
5917			control = ahc_inb(ahc, SCB_CONTROL);
5918			control &= ~ULTRAENB;
5919			if ((tstate->ultraenb & devinfo.target_mask) != 0)
5920				control |= ULTRAENB;
5921			ahc_outb(ahc, SCB_CONTROL, control);
5922			ahc_outb(ahc, SCB_SCSIRATE, tinfo->scsirate);
5923			ahc_outb(ahc, SCB_SCSIOFFSET, tinfo->current.offset);
5924		}
5925	}
5926	ahc_outb(ahc, SCBPTR, saved_scbptr);
5927}
5928
5929#if UNUSED
5930static void
5931ahc_dump_targcmd(struct target_cmd *cmd)
5932{
5933	u_int8_t *byte;
5934	u_int8_t *last_byte;
5935	int i;
5936
5937	byte = &cmd->initiator_channel;
5938	/* Debugging info for received commands */
5939	last_byte = &cmd[1].initiator_channel;
5940
5941	i = 0;
5942	while (byte < last_byte) {
5943		if (i == 0)
5944			printf("\t");
5945		printf("%#x", *byte++);
5946		i++;
5947		if (i == 8) {
5948			printf("\n");
5949			i = 0;
5950		} else {
5951			printf(", ");
5952		}
5953	}
5954}
5955#endif
5956
5957static void
5958ahc_shutdown(int howto, void *arg)
5959{
5960	struct	ahc_softc *ahc;
5961	int	i;
5962
5963	ahc = (struct ahc_softc *)arg;
5964
5965	ahc_reset(ahc);
5966	ahc_outb(ahc, SCSISEQ, 0);
5967	ahc_outb(ahc, SXFRCTL0, 0);
5968	ahc_outb(ahc, DSPCISTATUS, 0);
5969
5970	for (i = TARG_SCSIRATE; i < HA_274_BIOSCTRL; i++)
5971		ahc_outb(ahc, i, 0);
5972}
5973