xref: /openbsd/sys/dev/ic/ncr53c9x.c (revision 3d8817e4)
1 /*	$OpenBSD: ncr53c9x.c,v 1.50 2010/11/11 17:47:00 miod Exp $	*/
2 /*     $NetBSD: ncr53c9x.c,v 1.56 2000/11/30 14:41:46 thorpej Exp $    */
3 
4 /*
5  * Copyright (c) 1996 Charles M. Hannum.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. All advertising materials mentioning features or use of this software
16  *    must display the following acknowledgement:
17  *	This product includes software developed by Charles M. Hannum.
18  * 4. The name of the author may not be used to endorse or promote products
19  *    derived from this software without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1994 Peter Galbavy
35  * Copyright (c) 1995 Paul Kranenburg
36  * All rights reserved.
37  *
38  * Redistribution and use in source and binary forms, with or without
39  * modification, are permitted provided that the following conditions
40  * are met:
41  * 1. Redistributions of source code must retain the above copyright
42  *    notice, this list of conditions and the following disclaimer.
43  * 2. Redistributions in binary form must reproduce the above copyright
44  *    notice, this list of conditions and the following disclaimer in the
45  *    documentation and/or other materials provided with the distribution.
46  *
47  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
48  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
49  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
50  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
51  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
52  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
53  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
54  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
55  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
56  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
57  * POSSIBILITY OF SUCH DAMAGE.
58  */
59 
60 /*
61  * Based on aic6360 by Jarle Greipsland
62  *
63  * Acknowledgements: Many of the algorithms used in this driver are
64  * inspired by the work of Julian Elischer (julian@tfs.com) and
65  * Charles Hannum (mycroft@duality.gnu.ai.mit.edu).  Thanks a million!
66  */
67 
68 #include <sys/types.h>
69 #include <sys/param.h>
70 #include <sys/systm.h>
71 #include <sys/kernel.h>
72 #include <sys/errno.h>
73 #include <sys/ioctl.h>
74 #include <sys/device.h>
75 #include <sys/buf.h>
76 #include <sys/malloc.h>
77 #include <sys/proc.h>
78 #include <sys/queue.h>
79 #include <sys/pool.h>
80 
81 #include <scsi/scsi_all.h>
82 #include <scsi/scsiconf.h>
83 #include <scsi/scsi_message.h>
84 
85 #include <machine/cpu.h>
86 
87 #include <dev/ic/ncr53c9xreg.h>
88 #include <dev/ic/ncr53c9xvar.h>
89 
90 #ifdef NCR53C9X_DEBUG
91 int ncr53c9x_debug = 0; /*NCR_SHOWPHASE|NCR_SHOWMISC|NCR_SHOWTRAC|NCR_SHOWCMDS;*/
92 #endif
93 #ifdef DEBUG
94 int ncr53c9x_notag = 0;
95 #endif
96 
97 /*static*/ void	ncr53c9x_readregs(struct ncr53c9x_softc *);
98 /*static*/ void	ncr53c9x_select(struct ncr53c9x_softc *,
99 					    struct ncr53c9x_ecb *);
100 /*static*/ int ncr53c9x_reselect(struct ncr53c9x_softc *, int, int, int);
101 /*static*/ void	ncr53c9x_scsi_reset(struct ncr53c9x_softc *);
102 /*static*/ int	ncr53c9x_poll(struct ncr53c9x_softc *,
103 					    struct scsi_xfer *, int);
104 /*static*/ void	ncr53c9x_sched(struct ncr53c9x_softc *);
105 /*static*/ void	ncr53c9x_done(struct ncr53c9x_softc *,
106 					    struct ncr53c9x_ecb *);
107 /*static*/ void	ncr53c9x_msgin(struct ncr53c9x_softc *);
108 /*static*/ void	ncr53c9x_msgout(struct ncr53c9x_softc *);
109 /*static*/ void	ncr53c9x_timeout(void *arg);
110 /*static*/ void ncr53c9x_watch(void *arg);
111 /*static*/ void	ncr53c9x_abort(struct ncr53c9x_softc *,
112 					    struct ncr53c9x_ecb *);
113 /*static*/ void ncr53c9x_dequeue(struct ncr53c9x_softc *,
114 					    struct ncr53c9x_ecb *);
115 
116 void ncr53c9x_sense(struct ncr53c9x_softc *,
117 					    struct ncr53c9x_ecb *);
118 void ncr53c9x_free_ecb(struct ncr53c9x_softc *,
119 					    struct ncr53c9x_ecb *, int);
120 struct ncr53c9x_ecb *ncr53c9x_get_ecb(struct ncr53c9x_softc *, int);
121 
122 static inline int ncr53c9x_stp2cpb(struct ncr53c9x_softc *, int);
123 static inline void ncr53c9x_setsync(struct ncr53c9x_softc *,
124 					    struct ncr53c9x_tinfo *);
125 static struct ncr53c9x_linfo *ncr53c9x_lunsearch(struct ncr53c9x_tinfo *,
126     int64_t lun);
127 
128 static void ncr53c9x_wrfifo(struct ncr53c9x_softc *, u_char *, int);
129 static int ncr53c9x_rdfifo(struct ncr53c9x_softc *, int);
130 #define NCR_RDFIFO_START	0
131 #define NCR_RDFIFO_CONTINUE	1
132 
133 #define NCR_SET_COUNT(sc, size) do {						\
134 			NCR_WRITE_REG((sc), NCR_TCL, (size));			\
135 			NCR_WRITE_REG((sc), NCR_TCM, (size) >> 8);		\
136 			if ((sc->sc_cfg2 & NCRCFG2_FE) ||			\
137 			    (sc->sc_rev == NCR_VARIANT_FAS366)) {		\
138 				NCR_WRITE_REG((sc), NCR_TCH, (size) >> 16);	\
139 			}							\
140 			if (sc->sc_rev == NCR_VARIANT_FAS366) {			\
141 				NCR_WRITE_REG(sc, NCR_RCH, 0);			\
142 			}							\
143 } while (0)
144 
145 static int ecb_pool_initialized = 0;
146 static struct pool ecb_pool;
147 
148 struct cfdriver esp_cd = {
149 	NULL, "esp", DV_DULL
150 };
151 
152 /*
153  * Names for the NCR53c9x variants, corresponding to the variant tags
154  * in ncr53c9xvar.h.
155  */
156 const char *ncr53c9x_variant_names[] = {
157 	"ESP100",
158 	"ESP100A",
159 	"ESP200",
160 	"NCR53C94",
161 	"NCR53C96",
162 	"ESP406",
163 	"FAS408",
164 	"FAS216",
165 	"AM53C974",
166 	"FAS366/HME",
167 };
168 
169 /*
170  * Search linked list for LUN info by LUN id.
171  */
172 static struct ncr53c9x_linfo *
173 ncr53c9x_lunsearch(ti, lun)
174 	struct ncr53c9x_tinfo *ti;
175 	int64_t lun;
176 {
177 	struct ncr53c9x_linfo *li;
178 	LIST_FOREACH(li, &ti->luns, link)
179 	    if (li->lun == lun)
180 		    return (li);
181 	return (NULL);
182 }
183 
184 /*
185  * Attach this instance, and then all the sub-devices
186  */
187 void
188 ncr53c9x_attach(sc, adapter)
189 	struct ncr53c9x_softc *sc;
190 	struct scsi_adapter *adapter;
191 {
192 	struct scsibus_attach_args saa;
193 
194 	timeout_set(&sc->sc_watchdog, ncr53c9x_watch, sc);
195 	/*
196 	 * Allocate SCSI message buffers.
197 	 * Front-ends can override allocation to avoid alignment
198 	 * handling in the DMA engines. Note that ncr53c9x_msgout()
199 	 * can request a 1 byte DMA transfer.
200 	 */
201 	if (sc->sc_omess == NULL)
202 		sc->sc_omess = malloc(NCR_MAX_MSG_LEN, M_DEVBUF, M_NOWAIT);
203 
204 	if (sc->sc_imess == NULL)
205 		sc->sc_imess = malloc(NCR_MAX_MSG_LEN+1, M_DEVBUF, M_NOWAIT);
206 
207 	if (sc->sc_omess == NULL || sc->sc_imess == NULL) {
208 		printf("out of memory\n");
209 		return;
210 	}
211 
212 	/*
213 	 * Note, the front-end has set us up to print the chip variation.
214 	 */
215 	if (sc->sc_rev >= NCR_VARIANT_MAX) {
216 		printf("\n%s: unknown variant %d, devices not attached\n",
217 		    sc->sc_dev.dv_xname, sc->sc_rev);
218 		return;
219 	}
220 
221 	printf(": %s, %dMHz\n", ncr53c9x_variant_names[sc->sc_rev],
222 	    sc->sc_freq);
223 
224 	sc->sc_ccf = FREQTOCCF(sc->sc_freq);
225 
226 	/* The value *must not* be == 1. Make it 2 */
227 	if (sc->sc_ccf == 1)
228 		sc->sc_ccf = 2;
229 
230 	/*
231 	 * The recommended timeout is 250ms. This register is loaded
232 	 * with a value calculated as follows, from the docs:
233 	 *
234 	 *		(timout period) x (CLK frequency)
235 	 *	reg = -------------------------------------
236 	 *		 8192 x (Clock Conversion Factor)
237 	 *
238 	 * Since CCF has a linear relation to CLK, this generally computes
239 	 * to the constant of 153.
240 	 */
241 	sc->sc_timeout = ((250 * 1000) * sc->sc_freq) / (8192 * sc->sc_ccf);
242 
243 	/* CCF register only has 3 bits; 0 is actually 8 */
244 	sc->sc_ccf &= 7;
245 
246 	/* Find how many targets we need to support */
247 	switch (sc->sc_rev) {
248 	case NCR_VARIANT_FAS366:
249 		sc->sc_ntarg = 16;
250 		break;
251 	default:
252 		sc->sc_ntarg = 8;
253 		break;
254 	}
255 
256 	/* Reset state & bus */
257 	sc->sc_cfflags = sc->sc_dev.dv_cfdata->cf_flags;
258 	sc->sc_state = 0;
259 	ncr53c9x_init(sc, 1);
260 
261 	/*
262 	 * fill in the prototype scsi_link.
263 	 */
264 	sc->sc_link.adapter_softc = sc;
265 	sc->sc_link.adapter_target = sc->sc_id;
266 	sc->sc_link.adapter = adapter;
267 	sc->sc_link.openings = 2;
268 	sc->sc_link.adapter_buswidth = sc->sc_ntarg;
269 
270 	bzero(&saa, sizeof(saa));
271 	saa.saa_sc_link = &sc->sc_link;
272 
273 	/*
274 	 * Now try to attach all the sub-devices
275 	 */
276 	config_found(&sc->sc_dev, &saa, scsiprint);
277 	timeout_add(&sc->sc_watchdog, 60*hz);
278 }
279 
280 /*
281  * This is the generic ncr53c9x reset function. It does not reset the SCSI bus,
282  * only this controller, but kills any on-going commands, and also stops
283  * and resets the DMA.
284  *
285  * After reset, registers are loaded with the defaults from the attach
286  * routine above.
287  */
288 void
289 ncr53c9x_reset(sc)
290 	struct ncr53c9x_softc *sc;
291 {
292 
293 	/* reset DMA first */
294 	NCRDMA_RESET(sc);
295 
296 	/* reset SCSI chip */
297 	NCRCMD(sc, NCRCMD_RSTCHIP);
298 	NCRCMD(sc, NCRCMD_NOP);
299 	DELAY(500);
300 
301 	/* do these backwards, and fall through */
302 	switch (sc->sc_rev) {
303 	case NCR_VARIANT_ESP406:
304 	case NCR_VARIANT_FAS408:
305 		NCR_WRITE_REG(sc, NCR_CFG5, sc->sc_cfg5 | NCRCFG5_SINT);
306 		NCR_WRITE_REG(sc, NCR_CFG4, sc->sc_cfg4);
307 	case NCR_VARIANT_AM53C974:
308 	case NCR_VARIANT_FAS216:
309 	case NCR_VARIANT_NCR53C94:
310 	case NCR_VARIANT_NCR53C96:
311 	case NCR_VARIANT_ESP200:
312 		sc->sc_features |= NCR_F_HASCFG3;
313 		NCR_WRITE_REG(sc, NCR_CFG3, sc->sc_cfg3);
314 	case NCR_VARIANT_ESP100A:
315 		sc->sc_features |= NCR_F_SELATN3;
316 		NCR_WRITE_REG(sc, NCR_CFG2, sc->sc_cfg2);
317 	case NCR_VARIANT_ESP100:
318 		NCR_WRITE_REG(sc, NCR_CFG1, sc->sc_cfg1);
319 		NCR_WRITE_REG(sc, NCR_CCF, sc->sc_ccf);
320 		NCR_WRITE_REG(sc, NCR_SYNCOFF, 0);
321 		NCR_WRITE_REG(sc, NCR_TIMEOUT, sc->sc_timeout);
322 		break;
323 	case NCR_VARIANT_FAS366:
324 		sc->sc_features |=
325 		    NCR_F_SELATN3 | NCR_F_HASCFG3 | NCR_F_FASTSCSI;
326 		sc->sc_cfg3 = NCRFASCFG3_FASTCLK | NCRFASCFG3_OBAUTO;
327 		sc->sc_cfg3_fscsi = NCRFASCFG3_FASTSCSI;
328 		NCR_WRITE_REG(sc, NCR_CFG3, sc->sc_cfg3);
329 		sc->sc_cfg2 = 0; /* NCRCFG2_HMEFE | NCRCFG2_HME32 */
330 		NCR_WRITE_REG(sc, NCR_CFG2, sc->sc_cfg2);
331 		NCR_WRITE_REG(sc, NCR_CFG1, sc->sc_cfg1);
332 		NCR_WRITE_REG(sc, NCR_CCF, sc->sc_ccf);
333 		NCR_WRITE_REG(sc, NCR_SYNCOFF, 0);
334 		NCR_WRITE_REG(sc, NCR_TIMEOUT, sc->sc_timeout);
335 		break;
336 	default:
337 		printf("%s: unknown revision code, assuming ESP100\n",
338 		    sc->sc_dev.dv_xname);
339 		NCR_WRITE_REG(sc, NCR_CFG1, sc->sc_cfg1);
340 		NCR_WRITE_REG(sc, NCR_CCF, sc->sc_ccf);
341 		NCR_WRITE_REG(sc, NCR_SYNCOFF, 0);
342 		NCR_WRITE_REG(sc, NCR_TIMEOUT, sc->sc_timeout);
343 	}
344 
345 	if (sc->sc_rev == NCR_VARIANT_AM53C974)
346 		NCR_WRITE_REG(sc, NCR_AMDCFG4, sc->sc_cfg4);
347 
348 #if 0
349 	printf("%s: ncr53c9x_reset: revision %d\n",
350 	    sc->sc_dev.dv_xname, sc->sc_rev);
351 	printf("%s: ncr53c9x_reset: cfg1 0x%x, cfg2 0x%x, cfg3 0x%x, ccf 0x%x, timeout 0x%x\n",
352 	    sc->sc_dev.dv_xname,
353 	    sc->sc_cfg1, sc->sc_cfg2, sc->sc_cfg3,
354 	    sc->sc_ccf, sc->sc_timeout);
355 #endif
356 }
357 
358 /*
359  * Reset the SCSI bus, but not the chip
360  */
361 void
362 ncr53c9x_scsi_reset(sc)
363 	struct ncr53c9x_softc *sc;
364 {
365 
366 	(*sc->sc_glue->gl_dma_stop)(sc);
367 
368 	printf("%s: resetting SCSI bus\n", sc->sc_dev.dv_xname);
369 	NCRCMD(sc, NCRCMD_RSTSCSI);
370 }
371 
372 /*
373  * Initialize ncr53c9x state machine
374  */
375 void
376 ncr53c9x_init(sc, doreset)
377 	struct ncr53c9x_softc *sc;
378 	int doreset;
379 {
380 	struct ncr53c9x_ecb *ecb;
381 	struct ncr53c9x_linfo *li;
382 	int r, i;
383 
384 	NCR_TRACE(("[NCR_INIT(%d) %d] ", doreset, sc->sc_state));
385 
386 	if (!ecb_pool_initialized) {
387 		/* All instances share this pool */
388 		pool_init(&ecb_pool, sizeof(struct ncr53c9x_ecb), 0, 0, 0,
389 		    "ncr53c9x_ecb", NULL);
390 		ecb_pool_initialized = 1;
391 	}
392 
393 	if (sc->sc_state == 0) {
394 		/* First time through; initialize. */
395 
396 		TAILQ_INIT(&sc->ready_list);
397 		sc->sc_nexus = NULL;
398 		bzero(sc->sc_tinfo, sizeof(sc->sc_tinfo));
399 		for (r = 0; r < sc->sc_ntarg; r++) {
400 			LIST_INIT(&sc->sc_tinfo[r].luns);
401 		}
402 	} else {
403 		/* Cancel any active commands. */
404 		sc->sc_state = NCR_CLEANING;
405 		sc->sc_msgify = 0;
406 		if ((ecb = sc->sc_nexus) != NULL) {
407 			ecb->xs->error = XS_TIMEOUT;
408 			ncr53c9x_done(sc, ecb);
409 		}
410 		for (r = 0; r < sc->sc_ntarg; r++) {
411 			LIST_FOREACH(li, &sc->sc_tinfo[r].luns, link) {
412 				if ((ecb = li->untagged)) {
413 					li->untagged = NULL;
414 					/*
415 					 * XXXXXXX
416 					 * Should we terminate a command
417 					 * that never reached the disk?
418 					 */
419 					li->busy = 0;
420 					ecb->xs->error = XS_TIMEOUT;
421 					ncr53c9x_done(sc, ecb);
422 				}
423 				for (i = 0; i < 256; i++)
424 					if ((ecb = li->queued[i])) {
425 						li->queued[i] = NULL;
426 						ecb->xs->error = XS_TIMEOUT;
427 						ncr53c9x_done(sc, ecb);
428 					}
429 				li->used = 0;
430 			}
431 		}
432 	}
433 
434 	/*
435 	 * reset the chip to a known state
436 	 */
437 	ncr53c9x_reset(sc);
438 
439 	sc->sc_phase = sc->sc_prevphase = INVALID_PHASE;
440 	for (r = 0; r < sc->sc_ntarg; r++) {
441 		struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[r];
442 /* XXX - config flags per target: low bits: no reselect; high bits: no synch */
443 
444                 ti->flags = ((!(sc->sc_cfflags & (1 << (r + 16))) &&
445 		    sc->sc_minsync) ? 0 : T_SYNCHOFF) |
446 		    ((sc->sc_cfflags & (1 << r)) ?  T_RSELECTOFF : 0) |
447 		    T_NEED_TO_RESET;
448 #ifdef DEBUG
449 		 if (ncr53c9x_notag)
450 			 ti->flags &= ~T_TAG;
451 #endif
452 		ti->period = sc->sc_minsync;
453 		ti->offset = 0;
454 		ti->cfg3 = 0;
455 	}
456 
457 	if (doreset) {
458 		sc->sc_state = NCR_SBR;
459 		NCRCMD(sc, NCRCMD_RSTSCSI);
460 		/*
461 		 * XXX gross...
462 		 * On some systems, commands issued too close to a reset
463 		 * do not work correctly. We'll force a short delay on
464 		 * known-to-be-sensitive chips.
465 		 */
466 		switch (sc->sc_rev) {
467 		case NCR_VARIANT_NCR53C94:
468 			DELAY(600000);	/* 600ms */
469 			break;
470 		case NCR_VARIANT_NCR53C96:
471 			DELAY(100000);	/* 100ms */
472 			break;
473 		}
474 	} else {
475 		sc->sc_state = NCR_IDLE;
476 		ncr53c9x_sched(sc);
477 	}
478 }
479 
480 /*
481  * Read the NCR registers, and save their contents for later use.
482  * NCR_STAT, NCR_STEP & NCR_INTR are mostly zeroed out when reading
483  * NCR_INTR - so make sure it is the last read.
484  *
485  * I think that (from reading the docs) most bits in these registers
486  * only make sense when he DMA CSR has an interrupt showing. Call only
487  * if an interrupt is pending.
488  */
489 __inline__ void
490 ncr53c9x_readregs(sc)
491 	struct ncr53c9x_softc *sc;
492 {
493 
494 	sc->sc_espstat = NCR_READ_REG(sc, NCR_STAT);
495 	/* Only the stepo bits are of interest */
496 	sc->sc_espstep = NCR_READ_REG(sc, NCR_STEP) & NCRSTEP_MASK;
497 
498 	if (sc->sc_rev == NCR_VARIANT_FAS366)
499 		sc->sc_espstat2 = NCR_READ_REG(sc, NCR_STAT2);
500 
501 	sc->sc_espintr = NCR_READ_REG(sc, NCR_INTR);
502 
503 	if (sc->sc_glue->gl_clear_latched_intr != NULL)
504 		(*sc->sc_glue->gl_clear_latched_intr)(sc);
505 
506 	/*
507 	 * Determine the SCSI bus phase, return either a real SCSI bus phase
508 	 * or some pseudo phase we use to detect certain exceptions.
509 	 */
510 
511 	sc->sc_phase = (sc->sc_espintr & NCRINTR_DIS)
512 			? /* Disconnected */ BUSFREE_PHASE
513 			: sc->sc_espstat & NCRSTAT_PHASE;
514 
515 	NCR_MISC(("regs[intr=%02x,stat=%02x,step=%02x,stat2=%02x] ",
516 		sc->sc_espintr, sc->sc_espstat, sc->sc_espstep, sc->sc_espstat2));
517 }
518 
519 /*
520  * Convert Synchronous Transfer Period to chip register Clock Per Byte value.
521  */
522 static inline int
523 ncr53c9x_stp2cpb(sc, period)
524 	struct ncr53c9x_softc *sc;
525 	int period;
526 {
527 	int v;
528 	v = (sc->sc_freq * period) / 250;
529 	if (ncr53c9x_cpb2stp(sc, v) < period)
530 		/* Correct round-down error */
531 		v++;
532 	return (v);
533 }
534 
535 static inline void
536 ncr53c9x_setsync(sc, ti)
537 	struct ncr53c9x_softc *sc;
538 	struct ncr53c9x_tinfo *ti;
539 {
540 	u_char syncoff, synctp;
541 	u_char cfg3 = sc->sc_cfg3 | ti->cfg3;
542 
543 	if (ti->flags & T_SYNCMODE) {
544 		syncoff = ti->offset;
545 		synctp = ncr53c9x_stp2cpb(sc, ti->period);
546 		if (sc->sc_features & NCR_F_FASTSCSI) {
547 			/*
548 			 * If the period is 200ns or less (ti->period <= 50),
549 			 * put the chip in Fast SCSI mode.
550 			 */
551 			if (ti->period <= 50)
552 				/*
553 				 * There are (at least) 4 variations of the
554 				 * configuration 3 register.  The drive attach
555 				 * routine sets the appropriate bit to put the
556 				 * chip into Fast SCSI mode so that it doesn't
557 				 * have to be figured out here each time.
558 				 */
559 				cfg3 |= (sc->sc_rev == NCR_VARIANT_AM53C974) ?
560 				    NCRAMDCFG3_FSCSI : NCRCFG3_FSCSI;
561 		}
562 
563 		/*
564 		 * Am53c974 requires different SYNCTP values when the
565 		 * FSCSI bit is off.
566 		 */
567 		if (sc->sc_rev == NCR_VARIANT_AM53C974 &&
568 		    (cfg3 & NCRAMDCFG3_FSCSI) == 0)
569 			synctp--;
570 	} else {
571 		syncoff = 0;
572 		synctp = 0;
573 	}
574 
575 	if (sc->sc_features & NCR_F_HASCFG3)
576 		NCR_WRITE_REG(sc, NCR_CFG3, cfg3);
577 
578 	NCR_WRITE_REG(sc, NCR_SYNCOFF, syncoff);
579 	NCR_WRITE_REG(sc, NCR_SYNCTP, synctp);
580 }
581 
582 /*
583  * Send a command to a target, set the driver state to NCR_SELECTING
584  * and let the caller take care of the rest.
585  *
586  * Keeping this as a function allows me to say that this may be done
587  * by DMA instead of programmed I/O soon.
588  */
589 void
590 ncr53c9x_select(sc, ecb)
591 	struct ncr53c9x_softc *sc;
592 	struct ncr53c9x_ecb *ecb;
593 {
594 	struct scsi_link *sc_link = ecb->xs->sc_link;
595 	int target = sc_link->target;
596 	int lun = sc_link->lun;
597 	struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[target];
598 	int tiflags = ti->flags;
599 	u_char *cmd;
600 	int clen;
601 	int selatn3, selatns;
602 	size_t dmasize;
603 
604 	NCR_TRACE(("[ncr53c9x_select(t%d,l%d,cmd:%x,tag%x,%x)] ",
605 		   target, lun, ecb->cmd.cmd.opcode, ecb->tag[0], ecb->tag[1]));
606 
607 	sc->sc_state = NCR_SELECTING;
608 	/*
609 	 * Schedule the timeout now, the first time we will go away
610 	 * expecting to come back due to an interrupt, because it is
611 	 * always possible that the interrupt may never happen.
612 	 */
613 	if ((ecb->xs->flags & SCSI_POLL) == 0) {
614 		int timeout = ecb->timeout;
615 
616 		if (timeout > 1000000)
617 			timeout = (timeout / 1000) * hz;
618 		else
619 			timeout = (timeout * hz) / 1000;
620 		timeout_add(&ecb->to, timeout);
621 	}
622 
623 	/*
624 	 * The docs say the target register is never reset, and I
625 	 * can't think of a better place to set it
626 	 */
627 	if (sc->sc_rev == NCR_VARIANT_FAS366) {
628 		NCRCMD(sc, NCRCMD_FLUSH);
629 		NCR_WRITE_REG(sc, NCR_SELID, target | NCR_BUSID_HME);
630 	} else {
631 		NCR_WRITE_REG(sc, NCR_SELID, target);
632 	}
633 	ncr53c9x_setsync(sc, ti);
634 
635 	if ((ecb->flags & ECB_SENSE) != 0) {
636 		/*
637 		 * For REQUEST SENSE, we should not send an IDENTIFY or
638 		 * otherwise mangle the target.  There should be no MESSAGE IN
639 		 * phase.
640 		 */
641 		if (sc->sc_features & NCR_F_DMASELECT) {
642 			/* setup DMA transfer for command */
643 			dmasize = clen = ecb->clen;
644 			sc->sc_cmdlen = clen;
645 			sc->sc_cmdp = (caddr_t)&ecb->cmd.cmd;
646 
647 			NCRDMA_SETUP(sc, &sc->sc_cmdp, &sc->sc_cmdlen, 0,
648 			    &dmasize);
649 			/* Program the SCSI counter */
650 			NCR_SET_COUNT(sc, dmasize);
651 
652 			if (sc->sc_rev != NCR_VARIANT_FAS366)
653 				NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA);
654 
655 			/* And get the targets attention */
656 			NCRCMD(sc, NCRCMD_SELNATN | NCRCMD_DMA);
657 			NCRDMA_GO(sc);
658 		} else {
659 			ncr53c9x_wrfifo(sc, (u_char *)&ecb->cmd.cmd, ecb->clen);
660 			NCRCMD(sc, NCRCMD_SELNATN);
661 		}
662 		return;
663 	}
664 
665 	selatn3 = selatns = 0;
666 	if (ecb->tag[0] != 0) {
667 		if (sc->sc_features & NCR_F_SELATN3)
668 			/* use SELATN3 to send tag messages */
669 			selatn3 = 1;
670 		else
671 			/* We don't have SELATN3; use SELATNS to send tags */
672 			selatns = 1;
673 	}
674 
675 	if (ti->flags & T_NEGOTIATE) {
676 		/* We have to use SELATNS to send sync/wide messages */
677 		selatn3 = 0;
678 		selatns = 1;
679 	}
680 
681 	cmd = (u_char *)&ecb->cmd.cmd;
682 
683 	if (selatn3) {
684 		/* We'll use tags with SELATN3 */
685 		clen = ecb->clen + 3;
686 		cmd -= 3;
687 		cmd[0] = MSG_IDENTIFY(lun, 1);	/* msg[0] */
688 		cmd[1] = ecb->tag[0];		/* msg[1] */
689 		cmd[2] = ecb->tag[1];		/* msg[2] */
690 	} else {
691 		/* We don't have tags, or will send messages with SELATNS */
692 		clen = ecb->clen + 1;
693 		cmd -= 1;
694 		cmd[0] = MSG_IDENTIFY(lun, (tiflags & T_RSELECTOFF) == 0);
695 	}
696 
697 	if ((sc->sc_features & NCR_F_DMASELECT) && !selatns) {
698 
699 		/* setup DMA transfer for command */
700 		dmasize = clen;
701 		sc->sc_cmdlen = clen;
702 		sc->sc_cmdp = cmd;
703 
704 		NCRDMA_SETUP(sc, &sc->sc_cmdp, &sc->sc_cmdlen, 0, &dmasize);
705 		/* Program the SCSI counter */
706 		NCR_SET_COUNT(sc, dmasize);
707 
708 		/* load the count in */
709 		/* if (sc->sc_rev != NCR_VARIANT_FAS366) */
710 			NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA);
711 
712 		/* And get the targets attention */
713 		if (selatn3) {
714 			sc->sc_msgout = SEND_TAG;
715 			sc->sc_flags |= NCR_ATN;
716 			NCRCMD(sc, NCRCMD_SELATN3 | NCRCMD_DMA);
717 		} else
718 			NCRCMD(sc, NCRCMD_SELATN | NCRCMD_DMA);
719 		NCRDMA_GO(sc);
720 		return;
721 	}
722 
723 	/*
724 	 * Who am I. This is where we tell the target that we are
725 	 * happy for it to disconnect etc.
726 	 */
727 
728 	/* Now get the command into the FIFO */
729 	ncr53c9x_wrfifo(sc, cmd, clen);
730 
731 	/* And get the targets attention */
732 	if (selatns) {
733 		NCR_MISC(("SELATNS \n"));
734 		/* Arbitrate, select and stop after IDENTIFY message */
735 		NCRCMD(sc, NCRCMD_SELATNS);
736 	} else if (selatn3) {
737 		sc->sc_msgout = SEND_TAG;
738 		sc->sc_flags |= NCR_ATN;
739 		NCRCMD(sc, NCRCMD_SELATN3);
740 	} else
741 		NCRCMD(sc, NCRCMD_SELATN);
742 }
743 
744 void
745 ncr53c9x_free_ecb(sc, ecb, flags)
746 	struct ncr53c9x_softc *sc;
747 	struct ncr53c9x_ecb *ecb;
748 	int flags;
749 {
750 	int s;
751 
752 	s = splbio();
753 	ecb->flags = 0;
754 	pool_put(&ecb_pool, (void *)ecb);
755 	splx(s);
756 }
757 
758 struct ncr53c9x_ecb *
759 ncr53c9x_get_ecb(sc, flags)
760 	struct ncr53c9x_softc *sc;
761 	int flags;
762 {
763 	struct ncr53c9x_ecb *ecb;
764 	int s, wait = PR_NOWAIT;
765 
766 	if ((curproc != NULL) && ((flags & SCSI_NOSLEEP) == 0))
767 		wait = PR_WAITOK;
768 
769 	s = splbio();
770 	ecb = (struct ncr53c9x_ecb *)pool_get(&ecb_pool, wait);
771 	splx(s);
772 	if (ecb == NULL)
773 		return (NULL);
774 	bzero(ecb, sizeof(*ecb));
775 	timeout_set(&ecb->to, ncr53c9x_timeout, ecb);
776 	ecb->flags |= ECB_ALLOC;
777 	return (ecb);
778 }
779 
780 /*
781  * DRIVER FUNCTIONS CALLABLE FROM HIGHER LEVEL DRIVERS
782  */
783 
784 /*
785  * Start a SCSI-command
786  * This function is called by the higher level SCSI-driver to queue/run
787  * SCSI-commands.
788  */
789 void
790 ncr53c9x_scsi_cmd(xs)
791 	struct scsi_xfer *xs;
792 {
793 	struct scsi_link *sc_link = xs->sc_link;
794 	struct ncr53c9x_softc *sc = sc_link->adapter_softc;
795 	struct ncr53c9x_ecb *ecb;
796 	struct ncr53c9x_tinfo *ti;
797 	struct ncr53c9x_linfo *li;
798 	int64_t lun = sc_link->lun;
799 	int s, flags;
800 
801 	NCR_TRACE(("[ncr53c9x_scsi_cmd] "));
802 	NCR_CMDS(("[0x%x, %d]->%d ", (int)xs->cmd->opcode, xs->cmdlen,
803 	    sc_link->target));
804 
805 	flags = xs->flags;
806 	ti = &sc->sc_tinfo[sc_link->target];
807 	li = TINFO_LUN(ti, lun);
808 	if (li == NULL) {
809 		/* Initialize LUN info and add to list. */
810 		if ((li = malloc(sizeof(*li), M_DEVBUF,
811 		    M_NOWAIT | M_ZERO)) == NULL) {
812 			xs->error = XS_NO_CCB;
813 			scsi_done(xs);
814 			return;
815 		}
816 		li->last_used = time_second;
817 		li->lun = lun;
818 		s = splbio();
819 		LIST_INSERT_HEAD(&ti->luns, li, link);
820 		if (lun < NCR_NLUN)
821 			ti->lun[lun] = li;
822 		splx(s);
823 	}
824 
825 	if ((ecb = ncr53c9x_get_ecb(sc, flags)) == NULL) {
826 		xs->error = XS_NO_CCB;
827 		scsi_done(xs);
828 		return;
829 	}
830 
831 	/* Initialize ecb */
832 	ecb->xs = xs;
833 	ecb->timeout = xs->timeout;
834 
835 	if (flags & SCSI_RESET) {
836 		ecb->flags |= ECB_RESET;
837 		ecb->clen = 0;
838 		ecb->dleft = 0;
839 	} else {
840 		bcopy(xs->cmd, &ecb->cmd.cmd, xs->cmdlen);
841 		ecb->clen = xs->cmdlen;
842 		ecb->daddr = xs->data;
843 		ecb->dleft = xs->datalen;
844 	}
845 	ecb->stat = 0;
846 
847 	s = splbio();
848 
849 	TAILQ_INSERT_TAIL(&sc->ready_list, ecb, chain);
850 	ecb->flags |= ECB_READY;
851 	if (sc->sc_state == NCR_IDLE)
852 		ncr53c9x_sched(sc);
853 
854 	splx(s);
855 
856 	if ((flags & SCSI_POLL) == 0)
857 		return;
858 
859 	/* Not allowed to use interrupts, use polling instead */
860 	if (ncr53c9x_poll(sc, xs, ecb->timeout)) {
861 		ncr53c9x_timeout(ecb);
862 		if (ncr53c9x_poll(sc, xs, ecb->timeout))
863 			ncr53c9x_timeout(ecb);
864 	}
865 }
866 
867 /*
868  * Used when interrupt driven I/O isn't allowed, e.g. during boot.
869  */
870 int
871 ncr53c9x_poll(sc, xs, count)
872 	struct ncr53c9x_softc *sc;
873 	struct scsi_xfer *xs;
874 	int count;
875 {
876 	int s;
877 
878 	NCR_TRACE(("[ncr53c9x_poll] "));
879 	while (count) {
880 		if (NCRDMA_ISINTR(sc)) {
881 			s = splbio();
882 			ncr53c9x_intr(sc);
883 			splx(s);
884 		}
885 #if alternatively
886 		if (NCR_READ_REG(sc, NCR_STAT) & NCRSTAT_INT) {
887 			s = splbio();
888 			ncr53c9x_intr(sc);
889 			splx(s);
890 		}
891 #endif
892 		if ((xs->flags & ITSDONE) != 0)
893 			return (0);
894 		if (sc->sc_state == NCR_IDLE) {
895 			NCR_TRACE(("[ncr53c9x_poll: rescheduling] "));
896 			ncr53c9x_sched(sc);
897 		}
898 		DELAY(1000);
899 		count--;
900 	}
901 	return (1);
902 }
903 
904 
905 /*
906  * LOW LEVEL SCSI UTILITIES
907  */
908 
909 /*
910  * Schedule a scsi operation.  This has now been pulled out of the interrupt
911  * handler so that we may call it from ncr53c9x_scsi_cmd and ncr53c9x_done.
912  * This may save us an unnecessary interrupt just to get things going.
913  * Should only be called when state == NCR_IDLE and at bio pl.
914  */
915 void
916 ncr53c9x_sched(sc)
917 	struct ncr53c9x_softc *sc;
918 {
919 	struct ncr53c9x_ecb *ecb;
920 	struct scsi_link *sc_link;
921 	struct ncr53c9x_tinfo *ti;
922 	int lun;
923 	struct ncr53c9x_linfo *li;
924 	int s, tag;
925 
926 	NCR_TRACE(("[ncr53c9x_sched] "));
927 	if (sc->sc_state != NCR_IDLE)
928 		panic("ncr53c9x_sched: not IDLE (state=%d)", sc->sc_state);
929 
930 	/*
931 	 * Find first ecb in ready queue that is for a target/lunit
932 	 * combinations that is not busy.
933 	 */
934 	TAILQ_FOREACH(ecb, &sc->ready_list, chain) {
935 		sc_link = ecb->xs->sc_link;
936 		ti = &sc->sc_tinfo[sc_link->target];
937 		lun = sc_link->lun;
938 
939 		/* Select type of tag for this command */
940 		if ((ti->flags & (T_RSELECTOFF)) != 0)
941 			tag = 0;
942 		else if ((ti->flags & T_TAG) == 0)
943 			tag = 0;
944 		else if ((ecb->flags & ECB_SENSE) != 0)
945 			tag = 0;
946 		else
947 			tag = MSG_SIMPLE_Q_TAG;
948 #if 0
949 		/* XXXX Use tags for polled commands? */
950 		if (ecb->xs->flags & SCSI_POLL)
951 			tag = 0;
952 #endif
953 		s = splbio();
954 		li = TINFO_LUN(ti, lun);
955 		if (!li) {
956 			/* Initialize LUN info and add to list. */
957 			if ((li = malloc(sizeof(*li), M_DEVBUF,
958 			    M_NOWAIT | M_ZERO)) == NULL) {
959 				splx(s);
960 				continue;
961 			}
962 			li->lun = lun;
963 
964 			LIST_INSERT_HEAD(&ti->luns, li, link);
965 			if (lun < NCR_NLUN)
966 				ti->lun[lun] = li;
967 		}
968 		li->last_used = time_second;
969 		if (!tag) {
970 			/* Try to issue this as an un-tagged command */
971 			if (!li->untagged)
972 				li->untagged = ecb;
973 		}
974 		if (li->untagged) {
975 			tag = 0;
976 			if ((li->busy != 1) && !li->used) {
977 				/* We need to issue this untagged command now */
978 				ecb = li->untagged;
979 				sc_link = ecb->xs->sc_link;
980 			}
981 			else {
982 				/* Not ready yet */
983 				splx(s);
984 				continue;
985 			}
986 		}
987 		ecb->tag[0] = tag;
988 		if (tag) {
989 			int i;
990 
991 			/* Allocate a tag */
992 			if (li->used == 255) {
993 				/* no free tags */
994 				splx(s);
995 				continue;
996 			}
997 			/* Start from the last used location */
998 			for (i=li->avail; i<256; i++) {
999 				if (li->queued[i] == NULL)
1000 					break;
1001 			}
1002 			/* Couldn't find one, start again from the beginning */
1003 			if (i == 256) {
1004 				for (i = 0; i<256; i++) {
1005 					if (li->queued[i] == NULL)
1006 						break;
1007 				}
1008 			}
1009 #ifdef DIAGNOSTIC
1010 			if (i == 256)
1011 				panic("ncr53c9x_sched: tag alloc failure");
1012 #endif
1013 
1014 			/* Save where to start next time. */
1015 			li->avail = i+1;
1016 			li->used++;
1017 
1018 			li->queued[i] = ecb;
1019 			ecb->tag[1] = i;
1020 		}
1021 		splx(s);
1022 		if (li->untagged && (li->busy != 1)) {
1023 			li->busy = 1;
1024 			TAILQ_REMOVE(&sc->ready_list, ecb, chain);
1025 			ecb->flags &= ~ECB_READY;
1026 			sc->sc_nexus = ecb;
1027 			ncr53c9x_select(sc, ecb);
1028 			break;
1029 		}
1030 		if (!li->untagged && tag) {
1031 			TAILQ_REMOVE(&sc->ready_list, ecb, chain);
1032 			ecb->flags &= ~ECB_READY;
1033 			sc->sc_nexus = ecb;
1034 			ncr53c9x_select(sc, ecb);
1035 			break;
1036 		} else
1037 			NCR_MISC(("%d:%d busy\n",
1038 				  sc_link->target,
1039 				  sc_link->lun));
1040 	}
1041 }
1042 
1043 void
1044 ncr53c9x_sense(sc, ecb)
1045 	struct ncr53c9x_softc *sc;
1046 	struct ncr53c9x_ecb *ecb;
1047 {
1048 	struct scsi_xfer *xs = ecb->xs;
1049 	struct scsi_link *sc_link = xs->sc_link;
1050 	struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[sc_link->target];
1051 	struct scsi_sense *ss = (void *)&ecb->cmd.cmd;
1052 	struct ncr53c9x_linfo *li;
1053 	int lun = sc_link->lun;
1054 
1055 	NCR_MISC(("requesting sense "));
1056 	/* Next, setup a request sense command block */
1057 	bzero(ss, sizeof(*ss));
1058 	ss->opcode = REQUEST_SENSE;
1059 	ss->byte2 = sc_link->lun << 5;
1060 	ss->length = sizeof(struct scsi_sense_data);
1061 	ecb->clen = sizeof(*ss);
1062 	ecb->daddr = (char *)&xs->sense;
1063 	ecb->dleft = sizeof(struct scsi_sense_data);
1064 	ecb->flags |= ECB_SENSE;
1065 	ecb->timeout = NCR_SENSE_TIMEOUT;
1066 	ti->senses++;
1067 	li = TINFO_LUN(ti, lun);
1068 	if (li->busy) li->busy = 0;
1069 	ncr53c9x_dequeue(sc, ecb);
1070 	li->untagged = ecb;
1071 	li->busy = 2;
1072 	if (ecb == sc->sc_nexus) {
1073 		ncr53c9x_select(sc, ecb);
1074 	} else {
1075 		TAILQ_INSERT_HEAD(&sc->ready_list, ecb, chain);
1076 		ecb->flags |= ECB_READY;
1077 		if (sc->sc_state == NCR_IDLE)
1078 			ncr53c9x_sched(sc);
1079 	}
1080 }
1081 
1082 /*
1083  * POST PROCESSING OF SCSI_CMD (usually current)
1084  */
1085 void
1086 ncr53c9x_done(sc, ecb)
1087 	struct ncr53c9x_softc *sc;
1088 	struct ncr53c9x_ecb *ecb;
1089 {
1090 	struct scsi_xfer *xs = ecb->xs;
1091 	struct scsi_link *sc_link = xs->sc_link;
1092 	struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[sc_link->target];
1093 	int lun = sc_link->lun;
1094 	struct ncr53c9x_linfo *li = TINFO_LUN(ti, lun);
1095 
1096 	NCR_TRACE(("[ncr53c9x_done(error:%x)] ", xs->error));
1097 
1098 	timeout_del(&ecb->to);
1099 
1100 	if (ecb->stat == SCSI_QUEUE_FULL) {
1101 		/*
1102 		 * Set current throttle -- we should reset
1103 		 * this periodically
1104 		 */
1105 		sc_link->openings = li->used - 1;
1106 		printf("\n%s: QFULL -- throttling to %d commands\n",
1107 		    sc->sc_dev.dv_xname, sc_link->openings);
1108 	}
1109 
1110 	/*
1111 	 * Now, if we've come here with no error code, i.e. we've kept the
1112 	 * initial XS_NOERROR, and the status code signals that we should
1113 	 * check sense, we'll need to set up a request sense cmd block and
1114 	 * push the command back into the ready queue *before* any other
1115 	 * commands for this target/lunit, else we lose the sense info.
1116 	 * We don't support chk sense conditions for the request sense cmd.
1117 	 */
1118 	if (xs->error == XS_NOERROR) {
1119 		xs->status = ecb->stat;
1120 		if ((ecb->flags & ECB_ABORT) != 0) {
1121 			xs->error = XS_TIMEOUT;
1122 		} else if ((ecb->flags & ECB_SENSE) != 0) {
1123 			xs->error = XS_SENSE;
1124 		} else if ((ecb->stat & ST_MASK) == SCSI_CHECK) {
1125 			/* First, save the return values */
1126 			xs->resid = ecb->dleft;
1127 			ncr53c9x_sense(sc, ecb);
1128 			return;
1129 		} else {
1130 			xs->resid = ecb->dleft;
1131 		}
1132 	}
1133 
1134 #ifdef NCR53C9X_DEBUG
1135 	if (ncr53c9x_debug & NCR_SHOWMISC) {
1136 		if (xs->resid != 0)
1137 			printf("resid=%lu ", (unsigned long)xs->resid);
1138 		if (xs->error == XS_SENSE)
1139 			printf("sense=0x%02x\n", xs->sense.error_code);
1140 		else
1141 			printf("error=%d\n", xs->error);
1142 	}
1143 #endif
1144 
1145 	/*
1146 	 * Remove the ECB from whatever queue it's on.
1147 	 */
1148 	ncr53c9x_dequeue(sc, ecb);
1149 	if (ecb == sc->sc_nexus) {
1150 		sc->sc_nexus = NULL;
1151 		if (sc->sc_state != NCR_CLEANING) {
1152 			sc->sc_state = NCR_IDLE;
1153 			ncr53c9x_sched(sc);
1154 		}
1155 	}
1156 
1157 	if (xs->error == XS_SELTIMEOUT) {
1158 		/* Selection timeout -- discard this LUN if empty */
1159 		if (!li->untagged && !li->used) {
1160 			if (lun < NCR_NLUN)
1161 				ti->lun[lun] = NULL;
1162 			LIST_REMOVE(li, link);
1163 			free(li, M_DEVBUF);
1164 		}
1165 	}
1166 
1167 	ncr53c9x_free_ecb(sc, ecb, xs->flags);
1168 	ti->cmds++;
1169 	scsi_done(xs);
1170 }
1171 
1172 void
1173 ncr53c9x_dequeue(sc, ecb)
1174 	struct ncr53c9x_softc *sc;
1175 	struct ncr53c9x_ecb *ecb;
1176 {
1177 	struct ncr53c9x_tinfo *ti =
1178 	    &sc->sc_tinfo[ecb->xs->sc_link->target];
1179 	struct ncr53c9x_linfo *li;
1180 	int64_t lun = ecb->xs->sc_link->lun;
1181 
1182 	li = TINFO_LUN(ti, lun);
1183 #ifdef DIAGNOSTIC
1184 	if ((!li) || (li->lun != lun))
1185 		panic("ncr53c9x_dequeue: lun %qx for ecb %p does not exist",
1186 		    (long long)lun, ecb);
1187 #endif
1188 	if (li->untagged == ecb) {
1189 		li->busy = 0;
1190 		li->untagged = NULL;
1191 	}
1192 	if (ecb->tag[0] && li->queued[ecb->tag[1]]) {
1193 #ifdef DIAGNOSTIC
1194 		if (li->queued[ecb->tag[1]] && (li->queued[ecb->tag[1]] != ecb))
1195 			panic("ncr53c9x_dequeue: slot %d for lun %qx has %p "
1196 			    "instead of ecb %p", ecb->tag[1],
1197 			    (long long)lun,
1198 			    li->queued[ecb->tag[1]], ecb);
1199 #endif
1200 		li->queued[ecb->tag[1]] = NULL;
1201 		li->used --;
1202 
1203 	}
1204 	if (ecb->flags & ECB_READY) {
1205 		ecb->flags &= ~ECB_READY;
1206 		TAILQ_REMOVE(&sc->ready_list, ecb, chain);
1207 	}
1208  }
1209 
1210 /*
1211  * INTERRUPT/PROTOCOL ENGINE
1212  */
1213 
1214 /*
1215  * Schedule an outgoing message by prioritizing it, and asserting
1216  * attention on the bus. We can only do this when we are the initiator
1217  * else there will be an illegal command interrupt.
1218  */
1219 #define ncr53c9x_sched_msgout(m) \
1220 	do {							\
1221 		NCR_MISC(("ncr53c9x_sched_msgout %x %d ", m, __LINE__));	\
1222 		NCRCMD(sc, NCRCMD_SETATN);			\
1223 		sc->sc_flags |= NCR_ATN;			\
1224 		sc->sc_msgpriq |= (m);				\
1225 	} while (0)
1226 
1227 static void
1228 ncr53c9x_flushfifo(struct ncr53c9x_softc *sc)
1229 {
1230 	NCR_MISC(("[flushfifo] "));
1231 
1232 	NCRCMD(sc, NCRCMD_FLUSH);
1233 
1234 	if (sc->sc_phase == COMMAND_PHASE ||
1235 	    sc->sc_phase == MESSAGE_OUT_PHASE)
1236 		DELAY(2);
1237 }
1238 
1239 static int
1240 ncr53c9x_rdfifo(struct ncr53c9x_softc *sc, int how)
1241 {
1242 	int i, n;
1243 	u_char *buf;
1244 
1245 	switch(how) {
1246 	case NCR_RDFIFO_START:
1247 		buf = sc->sc_imess;
1248 		sc->sc_imlen = 0;
1249 		break;
1250 	case NCR_RDFIFO_CONTINUE:
1251 		buf = sc->sc_imess + sc->sc_imlen;
1252 		break;
1253 	default:
1254 		panic("ncr53c9x_rdfifo: bad flag");
1255 		break;
1256 	}
1257 
1258 	/*
1259 	 * XXX buffer (sc_imess) size for message
1260 	 */
1261 
1262 	n = NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF;
1263 
1264 	if (sc->sc_rev == NCR_VARIANT_FAS366) {
1265 		n *= 2;
1266 
1267 		for (i = 0; i < n; i++)
1268 			buf[i] = NCR_READ_REG(sc, NCR_FIFO);
1269 
1270 		if (sc->sc_espstat2 & FAS_STAT2_ISHUTTLE) {
1271 
1272 			NCR_WRITE_REG(sc, NCR_FIFO, 0);
1273 			buf[i++] = NCR_READ_REG(sc, NCR_FIFO);
1274 
1275 			NCR_READ_REG(sc, NCR_FIFO);
1276 
1277 			ncr53c9x_flushfifo(sc);
1278 		}
1279 	} else {
1280 		for (i = 0; i < n; i++)
1281 			buf[i] = NCR_READ_REG(sc, NCR_FIFO);
1282 	}
1283 
1284 	sc->sc_imlen += i;
1285 
1286 #ifdef NCR53C9X_DEBUG
1287 	{
1288 		int j;
1289 
1290 		NCR_TRACE(("\n[rdfifo %s (%d):",
1291 		    (how == NCR_RDFIFO_START) ? "start" : "cont",
1292 		    (int)sc->sc_imlen));
1293 		if (ncr53c9x_debug & NCR_SHOWTRAC) {
1294 			for (j = 0; j < sc->sc_imlen; j++)
1295 				printf(" %02x", sc->sc_imess[j]);
1296 			printf("]\n");
1297 		}
1298 	}
1299 #endif
1300 	return sc->sc_imlen;
1301 }
1302 
1303 static void
1304 ncr53c9x_wrfifo(struct ncr53c9x_softc *sc, u_char *p, int len)
1305 {
1306 	int i;
1307 
1308 #ifdef NCR53C9X_DEBUG
1309 	NCR_MISC(("[wrfifo(%d):", len));
1310 	if (ncr53c9x_debug & NCR_SHOWTRAC) {
1311 		for (i = 0; i < len; i++)
1312 			printf(" %02x", p[i]);
1313 		printf("]\n");
1314 	}
1315 #endif
1316 
1317 	for (i = 0; i < len; i++) {
1318 		NCR_WRITE_REG(sc, NCR_FIFO, p[i]);
1319 
1320 		if (sc->sc_rev == NCR_VARIANT_FAS366)
1321 			NCR_WRITE_REG(sc, NCR_FIFO, 0);
1322 	}
1323 }
1324 
1325 int
1326 ncr53c9x_reselect(sc, message, tagtype, tagid)
1327 	struct ncr53c9x_softc *sc;
1328 	int message;
1329 	int tagtype;
1330 	int tagid;
1331 {
1332 	u_char selid, target, lun;
1333 	struct ncr53c9x_ecb *ecb = NULL;
1334 	struct ncr53c9x_tinfo *ti;
1335 	struct ncr53c9x_linfo *li;
1336 
1337 	if (sc->sc_rev == NCR_VARIANT_FAS366) {
1338 		target = sc->sc_selid;
1339 	} else {
1340 		/*
1341 		 * The SCSI chip made a snapshot of the data bus while the reselection
1342 		 * was being negotiated.  This enables us to determine which target did
1343 		 * the reselect.
1344 		 */
1345 		selid = sc->sc_selid & ~(1 << sc->sc_id);
1346 		if (selid & (selid - 1)) {
1347 			printf("%s: reselect with invalid selid %02x;"
1348 			    " sending DEVICE RESET\n", sc->sc_dev.dv_xname, selid);
1349 			goto reset;
1350 
1351 		}
1352 		target = ffs(selid) - 1;
1353 	}
1354 	lun = message & 0x07;
1355 
1356 	/*
1357 	 * Search wait queue for disconnected cmd
1358 	 * The list should be short, so I haven't bothered with
1359 	 * any more sophisticated structures than a simple
1360 	 * singly linked list.
1361 	 */
1362 	ti = &sc->sc_tinfo[target];
1363 	li = TINFO_LUN(ti, lun);
1364 
1365 	/*
1366 	 * We can get as far as the LUN with the IDENTIFY
1367 	 * message.  Check to see if we're running an
1368 	 * un-tagged command.  Otherwise ack the IDENTIFY
1369 	 * and wait for a tag message.
1370 	 */
1371 	if (li != NULL) {
1372 		if (li->untagged != NULL && li->busy)
1373 			ecb = li->untagged;
1374 		else if (tagtype != MSG_SIMPLE_Q_TAG) {
1375 			/* Wait for tag to come by */
1376 			sc->sc_state = NCR_IDENTIFIED;
1377 			return (0);
1378 		} else if (tagtype) ecb = li->queued[tagid];
1379 	}
1380 	if (ecb == NULL) {
1381 		printf("%s: reselect from target %d lun %d tag %x:%x with no nexus;"
1382 		    " sending ABORT\n", sc->sc_dev.dv_xname, target, lun, tagtype, tagid);
1383 		goto abort;
1384 	}
1385 
1386 	/* Make this nexus active again. */
1387 	sc->sc_state = NCR_CONNECTED;
1388 	sc->sc_nexus = ecb;
1389 	ncr53c9x_setsync(sc, ti);
1390 
1391 	if (ecb->flags & ECB_RESET)
1392 		ncr53c9x_sched_msgout(SEND_DEV_RESET);
1393 	else if (ecb->flags & ECB_ABORT)
1394 		ncr53c9x_sched_msgout(SEND_ABORT);
1395 
1396 	/* Do an implicit RESTORE POINTERS. */
1397 	sc->sc_dp = ecb->daddr;
1398 	sc->sc_dleft = ecb->dleft;
1399 
1400 	return (0);
1401 
1402 reset:
1403 	ncr53c9x_sched_msgout(SEND_DEV_RESET);
1404 	return (1);
1405 
1406 abort:
1407 	ncr53c9x_sched_msgout(SEND_ABORT);
1408 	return (1);
1409 }
1410 
1411 static inline int
1412 __verify_msg_format(u_char *p, int len)
1413 {
1414 
1415 	if (len == 1 && IS1BYTEMSG(p[0]))
1416 		return 1;
1417 	if (len == 2 && IS2BYTEMSG(p[0]))
1418 		return 1;
1419 	if (len >= 3 && ISEXTMSG(p[0]) &&
1420 	    len == p[1] + 2)
1421 		return 1;
1422 
1423 	return 0;
1424 }
1425 
1426 /*
1427  * Get an incoming message as initiator.
1428  *
1429  * The SCSI bus must already be in MESSAGE_IN_PHASE and there is a
1430  * byte in the FIFO
1431  */
1432 void
1433 ncr53c9x_msgin(sc)
1434 	struct ncr53c9x_softc *sc;
1435 {
1436 
1437 	NCR_TRACE(("[ncr53c9x_msgin(curmsglen:%ld)] ", (long)sc->sc_imlen));
1438 
1439 	if (sc->sc_imlen == 0) {
1440 		printf("%s: msgin: no msg byte available\n", sc->sc_dev.dv_xname);
1441 		return;
1442 	}
1443 
1444 	/*
1445 	 * Prepare for a new message.  A message should (according
1446 	 * to the SCSI standard) be transmitted in one single
1447 	 * MESSAGE_IN_PHASE. If we have been in some other phase,
1448 	 * then this is a new message.
1449 	 */
1450 	if (sc->sc_prevphase != MESSAGE_IN_PHASE && sc->sc_state != NCR_RESELECTED) {
1451 		printf("%s: phase change, dropping message, prev %d, state %d\n",
1452 		    sc->sc_dev.dv_xname, sc->sc_prevphase, sc->sc_state);
1453 		sc->sc_flags &= ~NCR_DROP_MSGI;
1454 		sc->sc_imlen = 0;
1455 	}
1456 
1457 	NCR_TRACE(("<msgbyte:0x%02x>", sc->sc_imess[0]));
1458 
1459 	/*
1460 	 * If we're going to reject the message, don't bother storing
1461 	 * the incoming bytes.  But still, we need to ACK them.
1462 	 */
1463 	if ((sc->sc_flags & NCR_DROP_MSGI)) {
1464 		NCRCMD(sc, NCRCMD_MSGOK);
1465 		printf("<dropping msg byte %x>",
1466 			sc->sc_imess[sc->sc_imlen]);
1467 		return;
1468 	}
1469 
1470 	if (sc->sc_imlen >= NCR_MAX_MSG_LEN) {
1471 		ncr53c9x_sched_msgout(SEND_REJECT);
1472 		sc->sc_flags |= NCR_DROP_MSGI;
1473 	} else {
1474 		u_char *pb;
1475 		int plen;
1476 
1477 		switch (sc->sc_state) {
1478 			/*
1479 			 * if received message is the first of reselection
1480 			 * then first byte is selid, and then message
1481 			 */
1482 		case NCR_RESELECTED:
1483 			pb = sc->sc_imess + 1;
1484 			plen = sc->sc_imlen - 1;
1485 			break;
1486 		default:
1487 			pb = sc->sc_imess;
1488 			plen = sc->sc_imlen;
1489 			break;
1490 		}
1491 
1492 		if (__verify_msg_format(pb, plen))
1493 			goto gotit;
1494 	}
1495 
1496 	/* Ack what we have so far */
1497 	NCRCMD(sc, NCRCMD_MSGOK);
1498 	return;
1499 
1500 gotit:
1501 	NCR_MSGS(("gotmsg(%x) state %d", sc->sc_imess[0], sc->sc_state));
1502 	/* we got complete message, flush the imess, XXX nobody uses imlen below */
1503 	sc->sc_imlen = 0;
1504 
1505 	/*
1506 	 * Now we should have a complete message (1 byte, 2 byte
1507 	 * and moderately long extended messages).  We only handle
1508 	 * extended messages which total length is shorter than
1509 	 * NCR_MAX_MSG_LEN.  Longer messages will be amputated.
1510 	 */
1511 	switch (sc->sc_state) {
1512 		struct ncr53c9x_ecb *ecb;
1513 		struct ncr53c9x_tinfo *ti;
1514 		struct ncr53c9x_linfo *li;
1515 		int lun;
1516 
1517 	case NCR_CONNECTED:
1518 		ecb = sc->sc_nexus;
1519 		ti = &sc->sc_tinfo[ecb->xs->sc_link->target];
1520 
1521 		switch (sc->sc_imess[0]) {
1522 		case MSG_CMDCOMPLETE:
1523 			NCR_MSGS(("cmdcomplete "));
1524 			if (sc->sc_dleft < 0) {
1525 				sc_print_addr(ecb->xs->sc_link);
1526 				printf("got %ld extra bytes\n",
1527 				    -(long)sc->sc_dleft);
1528 				sc->sc_dleft = 0;
1529 			}
1530 			ecb->dleft = (ecb->flags & ECB_TENTATIVE_DONE)
1531 				? 0
1532 				: sc->sc_dleft;
1533 			if ((ecb->flags & ECB_SENSE) == 0)
1534 				ecb->xs->resid = ecb->dleft;
1535 			sc->sc_state = NCR_CMDCOMPLETE;
1536 			break;
1537 
1538 		case MSG_MESSAGE_REJECT:
1539 			NCR_MSGS(("msg reject (msgout=%x) ", sc->sc_msgout));
1540 			switch (sc->sc_msgout) {
1541 			case SEND_TAG:
1542 				/* Target does not like tagged queuing.
1543 				 *  - Flush the command queue
1544 				 *  - Disable tagged queuing for the target
1545 				 *  - Dequeue ecb from the queued array.
1546 				 */
1547 				printf("%s: tagged queuing rejected: target %d\n",
1548 				    sc->sc_dev.dv_xname, ecb->xs->sc_link->target);
1549 
1550 				NCR_MSGS(("(rejected sent tag)"));
1551 				NCRCMD(sc, NCRCMD_FLUSH);
1552 				DELAY(1);
1553 				ti->flags &= ~T_TAG;
1554 				lun = ecb->xs->sc_link->lun;
1555 				li = TINFO_LUN(ti, lun);
1556 				if (ecb->tag[0] &&
1557 				    li->queued[ecb->tag[1]] != NULL) {
1558 					li->queued[ecb->tag[1]] = NULL;
1559 					li->used--;
1560 				}
1561 				ecb->tag[0] = ecb->tag[1] = 0;
1562 				li->untagged = ecb;
1563 				li->busy = 1;
1564 				break;
1565 
1566 			case SEND_SDTR:
1567 				printf("%s: sync transfer rejected: target %d\n",
1568 				    sc->sc_dev.dv_xname, ecb->xs->sc_link->target);
1569 				sc->sc_flags &= ~NCR_SYNCHNEGO;
1570 				ti->flags &= ~(T_NEGOTIATE | T_SYNCMODE);
1571 				ncr53c9x_setsync(sc, ti);
1572 				break;
1573 
1574 			case SEND_WDTR:
1575 				printf("%s: wide transfer rejected: target %d\n",
1576 				    sc->sc_dev.dv_xname, ecb->xs->sc_link->target);
1577 				ti->flags &= ~T_WIDE;
1578 				ti->width = 0;
1579 				break;
1580 
1581 			case SEND_INIT_DET_ERR:
1582 				goto abort;
1583 			}
1584 			break;
1585 
1586 		case MSG_NOOP:
1587 			NCR_MSGS(("noop "));
1588 			break;
1589 
1590 		case MSG_HEAD_OF_Q_TAG:
1591 		case MSG_SIMPLE_Q_TAG:
1592 		case MSG_ORDERED_Q_TAG:
1593 			NCR_MSGS(("TAG %x:%x", sc->sc_imess[0], sc->sc_imess[1]));
1594 			break;
1595 
1596 		case MSG_DISCONNECT:
1597 			NCR_MSGS(("disconnect "));
1598 			ti->dconns++;
1599 			sc->sc_state = NCR_DISCONNECT;
1600 
1601 			/*
1602 			 * Mark the fact that all bytes have moved. The
1603 			 * target may not bother to do a SAVE POINTERS
1604 			 * at this stage. This flag will set the residual
1605 			 * count to zero on MSG COMPLETE.
1606 			 */
1607 			if (sc->sc_dleft == 0)
1608 				ecb->flags |= ECB_TENTATIVE_DONE;
1609 
1610 			break;
1611 
1612 		case MSG_SAVEDATAPOINTER:
1613 			NCR_MSGS(("save datapointer "));
1614 			ecb->daddr = sc->sc_dp;
1615 			ecb->dleft = sc->sc_dleft;
1616 			break;
1617 
1618 		case MSG_RESTOREPOINTERS:
1619 			NCR_MSGS(("restore datapointer "));
1620 			sc->sc_dp = ecb->daddr;
1621 			sc->sc_dleft = ecb->dleft;
1622 			break;
1623 
1624 		case MSG_EXTENDED:
1625 			NCR_MSGS(("extended(%x) ", sc->sc_imess[2]));
1626 			switch (sc->sc_imess[2]) {
1627 			case MSG_EXT_SDTR:
1628 				NCR_MSGS(("SDTR period %d, offset %d ",
1629 					sc->sc_imess[3], sc->sc_imess[4]));
1630 				if (sc->sc_imess[1] != 3)
1631 					goto reject;
1632 				ti->period = sc->sc_imess[3];
1633 				ti->offset = sc->sc_imess[4];
1634 				ti->flags &= ~T_NEGOTIATE;
1635 				if (sc->sc_minsync == 0 ||
1636 				    ti->offset == 0 ||
1637 				    ti->period > 124) {
1638 #ifdef NCR53C9X_DEBUG
1639 					sc_print_addr(ecb->xs->sc_link);
1640 					printf("async mode\n");
1641 #endif
1642 					if ((sc->sc_flags&NCR_SYNCHNEGO)
1643 					    == 0) {
1644 						/*
1645 						 * target initiated negotiation
1646 						 */
1647 						ti->offset = 0;
1648 						ti->flags &= ~T_SYNCMODE;
1649 						ncr53c9x_sched_msgout(
1650 						    SEND_SDTR);
1651 					} else {
1652 						/* we are async */
1653 						ti->flags &= ~T_SYNCMODE;
1654 					}
1655 				} else {
1656 #ifdef NCR53C9X_DEBUG
1657 					int r, s;
1658 #endif
1659 					int p;
1660 
1661 					p = ncr53c9x_stp2cpb(sc, ti->period);
1662 					ti->period = ncr53c9x_cpb2stp(sc, p);
1663 #ifdef NCR53C9X_DEBUG
1664 					sc_print_addr(ecb->xs->sc_link);
1665 					r = 250/ti->period;
1666 					s = (100*250)/ti->period - 100*r;
1667 					printf("max sync rate %d.%02dMB/s\n",
1668 						r, s);
1669 #endif
1670 					if ((sc->sc_flags&NCR_SYNCHNEGO) == 0) {
1671 						/*
1672 						 * target initiated negotiation
1673 						 */
1674 						if (ti->period <
1675 						    sc->sc_minsync)
1676 							ti->period =
1677 							    sc->sc_minsync;
1678 						if (ti->offset > 15)
1679 							ti->offset = 15;
1680 						ti->flags &= ~T_SYNCMODE;
1681 						ncr53c9x_sched_msgout(
1682 						    SEND_SDTR);
1683 					} else {
1684 						/* we are sync */
1685 						ti->flags |= T_SYNCMODE;
1686 					}
1687 				}
1688 				sc->sc_flags &= ~NCR_SYNCHNEGO;
1689 				ncr53c9x_setsync(sc, ti);
1690 				break;
1691 
1692 			case MSG_EXT_WDTR:
1693 				printf("%s: wide mode %d\n",
1694 				    sc->sc_dev.dv_xname, sc->sc_imess[3]);
1695 				if (sc->sc_imess[3] == 1) {
1696 					ti->cfg3 |= NCRFASCFG3_EWIDE;
1697 					ncr53c9x_setsync(sc, ti);
1698 				} else
1699 					ti->width = 0;
1700 				ti->flags &= ~T_WIDE;
1701 				break;
1702 			default:
1703 				sc_print_addr(ecb->xs->sc_link);
1704 				printf("unrecognized MESSAGE EXTENDED;"
1705 				    " sending REJECT\n");
1706 				goto reject;
1707 			}
1708 			break;
1709 
1710 		default:
1711 			NCR_MSGS(("ident "));
1712 			sc_print_addr(ecb->xs->sc_link);
1713 			printf("unrecognized MESSAGE; sending REJECT\n");
1714 		reject:
1715 			ncr53c9x_sched_msgout(SEND_REJECT);
1716 			break;
1717 		}
1718 		break;
1719 
1720 	case NCR_IDENTIFIED:
1721 		/*
1722 		 * IDENTIFY message was received and queue tag is expected now
1723 		 */
1724 		if ((sc->sc_imess[0] != MSG_SIMPLE_Q_TAG) ||
1725 		    (sc->sc_msgify == 0)) {
1726 			printf("%s: TAG reselect without IDENTIFY;"
1727 			    " MSG %x;"
1728 			    " sending DEVICE RESET\n",
1729 			    sc->sc_dev.dv_xname,
1730 			    sc->sc_imess[0]);
1731 			goto reset;
1732 		}
1733 		(void) ncr53c9x_reselect(sc, sc->sc_msgify,
1734 		    sc->sc_imess[0], sc->sc_imess[1]);
1735 		break;
1736 
1737 	case NCR_RESELECTED:
1738 		if (MSG_ISIDENTIFY(sc->sc_imess[1])) {
1739 			sc->sc_msgify = sc->sc_imess[1];
1740 		} else {
1741 			printf("%s: reselect without IDENTIFY;"
1742 			    " MSG %x;"
1743 			    " sending DEVICE RESET\n",
1744 			    sc->sc_dev.dv_xname,
1745 			    sc->sc_imess[1]);
1746 			goto reset;
1747 		}
1748 		(void) ncr53c9x_reselect(sc, sc->sc_msgify, 0, 0);
1749 		break;
1750 
1751 	default:
1752 		printf("%s: unexpected MESSAGE IN; sending DEVICE RESET\n",
1753 		    sc->sc_dev.dv_xname);
1754 	reset:
1755 		ncr53c9x_sched_msgout(SEND_DEV_RESET);
1756 		break;
1757 
1758 	abort:
1759 		ncr53c9x_sched_msgout(SEND_ABORT);
1760 		break;
1761 	}
1762 
1763 	/* if we have more messages to send set ATN */
1764 	if (sc->sc_msgpriq)
1765 		NCRCMD(sc, NCRCMD_SETATN);
1766 
1767 	/* Ack last message byte */
1768 	NCRCMD(sc, NCRCMD_MSGOK);
1769 
1770 	/* Done, reset message pointer. */
1771 	sc->sc_flags &= ~NCR_DROP_MSGI;
1772 	sc->sc_imlen = 0;
1773 }
1774 
1775 
1776 /*
1777  * Send the highest priority, scheduled message
1778  */
1779 void
1780 ncr53c9x_msgout(sc)
1781 	struct ncr53c9x_softc *sc;
1782 {
1783 	struct ncr53c9x_tinfo *ti;
1784 	struct ncr53c9x_ecb *ecb;
1785 	size_t size;
1786 
1787 	NCR_TRACE(("[ncr53c9x_msgout(priq:%x, prevphase:%x)]",
1788 	    sc->sc_msgpriq, sc->sc_prevphase));
1789 
1790 	/*
1791 	 * XXX - the NCR_ATN flag is not in sync with the actual ATN
1792 	 *	 condition on the SCSI bus. The 53c9x chip
1793 	 *	 automatically turns off ATN before sending the
1794 	 *	 message byte.  (see also the comment below in the
1795 	 *	 default case when picking out a message to send)
1796 	 */
1797 	if (sc->sc_flags & NCR_ATN) {
1798 		if (sc->sc_prevphase != MESSAGE_OUT_PHASE) {
1799 		new:
1800 			NCRCMD(sc, NCRCMD_FLUSH);
1801 /*			DELAY(1); */
1802 			sc->sc_msgoutq = 0;
1803 			sc->sc_omlen = 0;
1804 		}
1805 	} else {
1806 		if (sc->sc_prevphase == MESSAGE_OUT_PHASE) {
1807 			ncr53c9x_sched_msgout(sc->sc_msgoutq);
1808 			goto new;
1809 		} else {
1810 			printf("%s at line %d: unexpected MESSAGE OUT phase\n",
1811 			    sc->sc_dev.dv_xname, __LINE__);
1812 		}
1813 	}
1814 
1815 	if (sc->sc_omlen == 0) {
1816 		/* Pick up highest priority message */
1817 		sc->sc_msgout = sc->sc_msgpriq & -sc->sc_msgpriq;
1818 		sc->sc_msgoutq |= sc->sc_msgout;
1819 		sc->sc_msgpriq &= ~sc->sc_msgout;
1820 		sc->sc_omlen = 1;		/* "Default" message len */
1821 		switch (sc->sc_msgout) {
1822 		case SEND_SDTR:
1823 			ecb = sc->sc_nexus;
1824 			ti = &sc->sc_tinfo[ecb->xs->sc_link->target];
1825 			sc->sc_omess[0] = MSG_EXTENDED;
1826 			sc->sc_omess[1] = 3;
1827 			sc->sc_omess[2] = MSG_EXT_SDTR;
1828 			sc->sc_omess[3] = ti->period;
1829 			sc->sc_omess[4] = ti->offset;
1830 			sc->sc_omlen = 5;
1831 			if ((sc->sc_flags & NCR_SYNCHNEGO) == 0) {
1832 				ti->flags |= T_SYNCMODE;
1833 				ncr53c9x_setsync(sc, ti);
1834 			}
1835 			break;
1836 		case SEND_WDTR:
1837 			ecb = sc->sc_nexus;
1838 			ti = &sc->sc_tinfo[ecb->xs->sc_link->target];
1839 			sc->sc_omess[0] = MSG_EXTENDED;
1840 			sc->sc_omess[1] = 2;
1841 			sc->sc_omess[2] = MSG_EXT_WDTR;
1842 			sc->sc_omess[3] = ti->width;
1843 			sc->sc_omlen = 4;
1844 			break;
1845 		case SEND_IDENTIFY:
1846 			if (sc->sc_state != NCR_CONNECTED) {
1847 				printf("%s at line %d: no nexus\n",
1848 				    sc->sc_dev.dv_xname, __LINE__);
1849 			}
1850 			ecb = sc->sc_nexus;
1851 			sc->sc_omess[0] =
1852 			    MSG_IDENTIFY(ecb->xs->sc_link->lun, 0);
1853 			break;
1854 		case SEND_TAG:
1855 			if (sc->sc_state != NCR_CONNECTED) {
1856 				printf("%s at line %d: no nexus\n",
1857 				    sc->sc_dev.dv_xname, __LINE__);
1858 			}
1859 			ecb = sc->sc_nexus;
1860 			sc->sc_omess[0] = ecb->tag[0];
1861 			sc->sc_omess[1] = ecb->tag[1];
1862 			sc->sc_omlen = 2;
1863 			break;
1864 		case SEND_DEV_RESET:
1865 			sc->sc_flags |= NCR_ABORTING;
1866 			sc->sc_omess[0] = MSG_BUS_DEV_RESET;
1867 			ecb = sc->sc_nexus;
1868 			ti = &sc->sc_tinfo[ecb->xs->sc_link->target];
1869 			ti->flags &= ~T_SYNCMODE;
1870 			if ((ti->flags & T_SYNCHOFF) == 0)
1871 				/* We can re-start sync negotiation */
1872 				ti->flags |= T_NEGOTIATE;
1873 			break;
1874 		case SEND_PARITY_ERROR:
1875 			sc->sc_omess[0] = MSG_PARITY_ERROR;
1876 			break;
1877 		case SEND_ABORT:
1878 			sc->sc_flags |= NCR_ABORTING;
1879 			sc->sc_omess[0] = MSG_ABORT;
1880 			break;
1881 		case SEND_INIT_DET_ERR:
1882 			sc->sc_omess[0] = MSG_INITIATOR_DET_ERR;
1883 			break;
1884 		case SEND_REJECT:
1885 			sc->sc_omess[0] = MSG_MESSAGE_REJECT;
1886 			break;
1887 		default:
1888 			/*
1889 			 * We normally do not get here, since the chip
1890 			 * automatically turns off ATN before the last
1891 			 * byte of a message is sent to the target.
1892 			 * However, if the target rejects our (multi-byte)
1893 			 * message early by switching to MSG IN phase
1894 			 * ATN remains on, so the target may return to
1895 			 * MSG OUT phase. If there are no scheduled messages
1896 			 * left we send a NO-OP.
1897 			 *
1898 			 * XXX - Note that this leaves no useful purpose for
1899 			 * the NCR_ATN flag.
1900 			 */
1901 			sc->sc_flags &= ~NCR_ATN;
1902 			sc->sc_omess[0] = MSG_NOOP;
1903 			break;
1904 		}
1905 		sc->sc_omp = sc->sc_omess;
1906 	}
1907 
1908 #ifdef DEBUG
1909 	{
1910 		int i;
1911 
1912 		for (i = 0; i<sc->sc_omlen; i++)
1913 			NCR_MISC(("<msgbyte:0x%02x>", sc->sc_omess[i]));
1914 	}
1915 #endif
1916 	if (sc->sc_rev == NCR_VARIANT_FAS366) {
1917 		/*
1918 		 * XXX fifo size
1919 		 */
1920 		ncr53c9x_flushfifo(sc);
1921 		ncr53c9x_wrfifo(sc, sc->sc_omp, sc->sc_omlen);
1922 		NCRCMD(sc, NCRCMD_TRANS);
1923 	} else {
1924 		/* (re)send the message */
1925 		size = min(sc->sc_omlen, sc->sc_maxxfer);
1926 		NCRDMA_SETUP(sc, &sc->sc_omp, &sc->sc_omlen, 0, &size);
1927 		/* Program the SCSI counter */
1928 		NCR_SET_COUNT(sc, size);
1929 
1930                /* Load the count in and start the message-out transfer */
1931 		NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA);
1932 		NCRCMD(sc, NCRCMD_TRANS|NCRCMD_DMA);
1933 		NCRDMA_GO(sc);
1934 	}
1935 }
1936 
1937 /*
1938  * This is the most critical part of the driver, and has to know
1939  * how to deal with *all* error conditions and phases from the SCSI
1940  * bus. If there are no errors and the DMA was active, then call the
1941  * DMA pseudo-interrupt handler. If this returns 1, then that was it
1942  * and we can return from here without further processing.
1943  *
1944  * Most of this needs verifying.
1945  */
1946 int sdebug = 0;
1947 int
1948 ncr53c9x_intr(arg)
1949 	void *arg;
1950 {
1951 	struct ncr53c9x_softc *sc = arg;
1952 	struct ncr53c9x_ecb *ecb;
1953 	struct scsi_link *sc_link;
1954 	struct ncr53c9x_tinfo *ti;
1955 	size_t size;
1956 	int nfifo;
1957 
1958 	NCR_TRACE(("[ncr53c9x_intr: state %d] ", sc->sc_state));
1959 
1960 	if (!NCRDMA_ISINTR(sc))
1961 		return (0);
1962 
1963 again:
1964 	/* and what do the registers say... */
1965 	ncr53c9x_readregs(sc);
1966 
1967 	/*
1968 	 * At the moment, only a SCSI Bus Reset or Illegal
1969 	 * Command are classed as errors. A disconnect is a
1970 	 * valid condition, and we let the code check is the
1971 	 * "NCR_BUSFREE_OK" flag was set before declaring it
1972 	 * and error.
1973 	 *
1974 	 * Also, the status register tells us about "Gross
1975 	 * Errors" and "Parity errors". Only the Gross Error
1976 	 * is really bad, and the parity errors are dealt
1977 	 * with later
1978 	 *
1979 	 * TODO
1980 	 *      If there are too many parity error, go to slow
1981 	 *      cable mode ?
1982 	 */
1983 
1984 	/* SCSI Reset */
1985 	if (sc->sc_espintr & NCRINTR_SBR) {
1986 		if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
1987 			NCRCMD(sc, NCRCMD_FLUSH);
1988 			DELAY(1);
1989 		}
1990 		if (sc->sc_state != NCR_SBR) {
1991 			printf("%s: SCSI bus reset\n",
1992 				sc->sc_dev.dv_xname);
1993 			ncr53c9x_init(sc, 0); /* Restart everything */
1994 			return (1);
1995 		}
1996 #if 0
1997 /*XXX*/		printf("<expected bus reset: "
1998 			"[intr %x, stat %x, step %d]>\n",
1999 			sc->sc_espintr, sc->sc_espstat,
2000 			sc->sc_espstep);
2001 #endif
2002 		if (sc->sc_nexus)
2003 			panic("%s: nexus in reset state",
2004 		      sc->sc_dev.dv_xname);
2005 		goto sched;
2006 	}
2007 
2008 	ecb = sc->sc_nexus;
2009 
2010 #define NCRINTR_ERR (NCRINTR_SBR|NCRINTR_ILL)
2011 	if (sc->sc_espintr & NCRINTR_ERR ||
2012 	    sc->sc_espstat & NCRSTAT_GE) {
2013 
2014 		if (sc->sc_espstat & NCRSTAT_GE) {
2015 			/* Gross Error; no target ? */
2016 			if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
2017 				NCRCMD(sc, NCRCMD_FLUSH);
2018 				DELAY(1);
2019 			}
2020 			if (sc->sc_state == NCR_CONNECTED ||
2021 			    sc->sc_state == NCR_SELECTING) {
2022 				ecb->xs->error = XS_TIMEOUT;
2023 				ncr53c9x_done(sc, ecb);
2024 			}
2025 			return (1);
2026 		}
2027 
2028 		if (sc->sc_espintr & NCRINTR_ILL) {
2029 			if (sc->sc_flags & NCR_EXPECT_ILLCMD) {
2030 				/*
2031 				 * Eat away "Illegal command" interrupt
2032 				 * on a ESP100 caused by a re-selection
2033 				 * while we were trying to select
2034 				 * another target.
2035 				 */
2036 #ifdef DEBUG
2037 				printf("%s: ESP100 work-around activated\n",
2038 					sc->sc_dev.dv_xname);
2039 #endif
2040 				sc->sc_flags &= ~NCR_EXPECT_ILLCMD;
2041 				return (1);
2042 			}
2043 			/* illegal command, out of sync ? */
2044 			printf("%s: illegal command: 0x%x "
2045 			    "(state %d, phase %x, prevphase %x)\n",
2046 				sc->sc_dev.dv_xname, sc->sc_lastcmd,
2047 				sc->sc_state, sc->sc_phase,
2048 				sc->sc_prevphase);
2049 			if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
2050 				NCRCMD(sc, NCRCMD_FLUSH);
2051 				DELAY(1);
2052 			}
2053 			ncr53c9x_init(sc, 1); /* Restart everything */
2054 			return (1);
2055 		}
2056 	}
2057 	sc->sc_flags &= ~NCR_EXPECT_ILLCMD;
2058 
2059 	/*
2060 	 * Call if DMA is active.
2061 	 *
2062 	 * If DMA_INTR returns true, then maybe go 'round the loop
2063 	 * again in case there is no more DMA queued, but a phase
2064 	 * change is expected.
2065 	 */
2066 	if (NCRDMA_ISACTIVE(sc)) {
2067 		int r = NCRDMA_INTR(sc);
2068 		if (r == -1) {
2069 			printf("%s: DMA error; resetting\n",
2070 				sc->sc_dev.dv_xname);
2071 			ncr53c9x_init(sc, 1);
2072 			return (1);
2073 		}
2074 		/* If DMA active here, then go back to work... */
2075 		if (NCRDMA_ISACTIVE(sc))
2076 			return (1);
2077 
2078 		if ((sc->sc_espstat & NCRSTAT_TC) == 0) {
2079 			/*
2080 			 * DMA not completed.  If we can not find a
2081 			 * acceptable explanation, print a diagnostic.
2082 			 */
2083 			if (sc->sc_state == NCR_SELECTING)
2084 				/*
2085 				 * This can happen if we are reselected
2086 				 * while using DMA to select a target.
2087 				 */
2088 				/*void*/;
2089 			else if (sc->sc_prevphase == MESSAGE_OUT_PHASE){
2090 				/*
2091 				 * Our (multi-byte) message (eg SDTR)
2092 				 * was interrupted by the target to
2093 				 * send a MSG REJECT.
2094 				 * Print diagnostic if current phase
2095 				 * is not MESSAGE IN.
2096 				 */
2097 				if (sc->sc_phase != MESSAGE_IN_PHASE)
2098 				    printf("%s: !TC on MSG OUT"
2099 				       " [intr %x, stat %x, step %d]"
2100 				       " prevphase %x, resid %lx\n",
2101 					sc->sc_dev.dv_xname,
2102 					sc->sc_espintr,
2103 					sc->sc_espstat,
2104 					sc->sc_espstep,
2105 					sc->sc_prevphase,
2106 					(u_long)sc->sc_omlen);
2107 			} else if (sc->sc_dleft == 0) {
2108 				/*
2109 				 * The DMA operation was started for
2110 				 * a DATA transfer. Print a diagnostic
2111 				 * if the DMA counter and TC bit
2112 				 * appear to be out of sync.
2113 				 */
2114 				printf("%s: !TC on DATA XFER"
2115 				       " [intr %x, stat %x, step %d]"
2116 				       " prevphase %x, resid %x\n",
2117 					sc->sc_dev.dv_xname,
2118 					sc->sc_espintr,
2119 					sc->sc_espstat,
2120 					sc->sc_espstep,
2121 					sc->sc_prevphase,
2122 					ecb?ecb->dleft:-1);
2123 			}
2124 		}
2125 	}
2126 
2127 	/*
2128 	 * check for less serious errors
2129 	 */
2130 	if (sc->sc_espstat & NCRSTAT_PE) {
2131 		printf("%s: SCSI bus parity error\n", sc->sc_dev.dv_xname);
2132 		if (sc->sc_prevphase == MESSAGE_IN_PHASE)
2133 			ncr53c9x_sched_msgout(SEND_PARITY_ERROR);
2134 		else
2135 			ncr53c9x_sched_msgout(SEND_INIT_DET_ERR);
2136 	}
2137 
2138 	if (sc->sc_espintr & NCRINTR_DIS) {
2139 		sc->sc_msgify = 0;
2140 		NCR_MISC(("<DISC [intr %x, stat %x, step %d]>",
2141 			sc->sc_espintr,sc->sc_espstat,sc->sc_espstep));
2142 		if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
2143 			NCRCMD(sc, NCRCMD_FLUSH);
2144 /*			DELAY(1); */
2145 		}
2146 		/*
2147 		 * This command must (apparently) be issued within
2148 		 * 250mS of a disconnect. So here you are...
2149 		 */
2150 		NCRCMD(sc, NCRCMD_ENSEL);
2151 
2152 		switch (sc->sc_state) {
2153 		case NCR_RESELECTED:
2154 			goto sched;
2155 
2156 		case NCR_SELECTING:
2157 		{
2158 			struct ncr53c9x_linfo *li;
2159 
2160 			ecb->xs->error = XS_SELTIMEOUT;
2161 
2162 			/* Selection timeout -- discard all LUNs if empty */
2163 			sc_link = ecb->xs->sc_link;
2164 			ti = &sc->sc_tinfo[sc_link->target];
2165 			for (li = LIST_FIRST(&ti->luns);
2166 			    li != LIST_END(&ti->luns); ) {
2167 				if (!li->untagged && !li->used) {
2168 					if (li->lun < NCR_NLUN)
2169 						ti->lun[li->lun] = NULL;
2170 					LIST_REMOVE(li, link);
2171 					free(li, M_DEVBUF);
2172 					/* Restart the search at the beginning */
2173 					li = LIST_FIRST(&ti->luns);
2174 					continue;
2175 				}
2176 				li = LIST_NEXT(li, link);
2177 			}
2178 			goto finish;
2179 		}
2180 		case NCR_CONNECTED:
2181 			if ((sc->sc_flags & NCR_SYNCHNEGO)) {
2182 #ifdef NCR53C9X_DEBUG
2183 				if (ecb)
2184 					sc_print_addr(ecb->xs->sc_link);
2185 				printf("sync nego not completed!\n");
2186 #endif
2187 				ti = &sc->sc_tinfo[ecb->xs->sc_link->target];
2188 				sc->sc_flags &= ~NCR_SYNCHNEGO;
2189 				ti->flags &= ~(T_NEGOTIATE | T_SYNCMODE);
2190 			}
2191 
2192 			/* it may be OK to disconnect */
2193 			if ((sc->sc_flags & NCR_ABORTING) == 0) {
2194 				/*
2195 				 * Section 5.1.1 of the SCSI 2 spec
2196 				 * suggests issuing a REQUEST SENSE
2197 				 * following an unexpected disconnect.
2198 				 * Some devices go into a contingent
2199 				 * allegiance condition when
2200 				 * disconnecting, and this is necessary
2201 				 * to clean up their state.
2202 				 */
2203 				printf("%s: unexpected disconnect; ",
2204 				    sc->sc_dev.dv_xname);
2205 				if (ecb->flags & ECB_SENSE) {
2206 					printf("resetting\n");
2207 					goto reset;
2208 				}
2209 				printf("sending REQUEST SENSE\n");
2210 				timeout_del(&ecb->to);
2211 				ncr53c9x_sense(sc, ecb);
2212 				goto out;
2213 			}
2214 
2215 			ecb->xs->error = XS_TIMEOUT;
2216 			goto finish;
2217 
2218 		case NCR_DISCONNECT:
2219 			sc->sc_nexus = NULL;
2220 			goto sched;
2221 
2222 		case NCR_CMDCOMPLETE:
2223 			goto finish;
2224 		}
2225 	}
2226 
2227 	switch (sc->sc_state) {
2228 
2229 	case NCR_SBR:
2230 		printf("%s: waiting for SCSI Bus Reset to happen\n",
2231 			sc->sc_dev.dv_xname);
2232 		return (1);
2233 
2234 	case NCR_RESELECTED:
2235 		/*
2236 		 * we must be continuing a message ?
2237 		 */
2238 		if (sc->sc_phase != MESSAGE_IN_PHASE) {
2239 			printf("%s: target didn't identify\n",
2240 				sc->sc_dev.dv_xname);
2241 			ncr53c9x_init(sc, 1);
2242 			return (1);
2243 		}
2244 printf("<<RESELECT CONT'd>>");
2245 #if XXXX
2246 		ncr53c9x_msgin(sc);
2247 		if (sc->sc_state != NCR_CONNECTED) {
2248 			/* IDENTIFY fail?! */
2249 			printf("%s: identify failed\n",
2250 				sc->sc_dev.dv_xname);
2251 			ncr53c9x_init(sc, 1);
2252 			return (1);
2253 		}
2254 #endif
2255 		break;
2256 
2257 	case NCR_IDENTIFIED:
2258 		ecb = sc->sc_nexus;
2259 		if (sc->sc_phase != MESSAGE_IN_PHASE) {
2260 			int i = (NCR_READ_REG(sc, NCR_FFLAG)
2261 			    & NCRFIFO_FF);
2262 			/*
2263 			 * Things are seriously fucked up.
2264 			 * Pull the brakes, i.e. reset
2265 			 */
2266 			printf("%s: target didn't send tag: %d bytes in fifo\n",
2267 			    sc->sc_dev.dv_xname, i);
2268 			/* Drain and display fifo */
2269 			while (i-- > 0)
2270 				printf("[%d] ", NCR_READ_REG(sc, NCR_FIFO));
2271 			ncr53c9x_init(sc, 1);
2272 			return (1);
2273 		} else
2274 			goto msgin;
2275 
2276 		break;
2277 	case NCR_IDLE:
2278 	case NCR_SELECTING:
2279 		ecb = sc->sc_nexus;
2280 		if (sc->sc_espintr & NCRINTR_RESEL) {
2281 			sc->sc_msgpriq = sc->sc_msgout = sc->sc_msgoutq = 0;
2282 			sc->sc_flags = 0;
2283 			/*
2284 			 * If we're trying to select a
2285 			 * target ourselves, push our command
2286 			 * back into the ready list.
2287 			 */
2288 			if (sc->sc_state == NCR_SELECTING) {
2289 				NCR_MISC(("backoff selector "));
2290 				timeout_del(&ecb->to);
2291 				ncr53c9x_dequeue(sc, ecb);
2292 				TAILQ_INSERT_HEAD(&sc->ready_list, ecb, chain);
2293 				ecb->flags |= ECB_READY;
2294 				ecb = sc->sc_nexus = NULL;
2295 			}
2296 			sc->sc_state = NCR_RESELECTED;
2297 			if (sc->sc_phase != MESSAGE_IN_PHASE) {
2298 				/*
2299 				 * Things are seriously fucked up.
2300 				 * Pull the brakes, i.e. reset
2301 				 */
2302 				printf("%s: target didn't identify\n",
2303 					sc->sc_dev.dv_xname);
2304 				ncr53c9x_init(sc, 1);
2305 				return (1);
2306 			}
2307 			/*
2308 			 * The C90 only inhibits FIFO writes until
2309 			 * reselection is complete, instead of
2310 			 * waiting until the interrupt status register
2311 			 * has been read. So, if the reselect happens
2312 			 * while we were entering a command bytes (for
2313 			 * another target) some of those bytes can
2314 			 * appear in the FIFO here, after the
2315 			 * interrupt is taken.
2316 			 */
2317 			nfifo = ncr53c9x_rdfifo(sc, NCR_RDFIFO_START);
2318 
2319 			if (nfifo < 2 ||
2320 			    (nfifo > 2 &&
2321 			     sc->sc_rev != NCR_VARIANT_ESP100)) {
2322 				printf("%s: RESELECT: "
2323 				    "%d bytes in FIFO! "
2324 				    "[intr %x, stat %x, step %d, prevphase %x]\n",
2325 					sc->sc_dev.dv_xname,
2326 					nfifo,
2327 					sc->sc_espintr,
2328 					sc->sc_espstat,
2329 					sc->sc_espstep,
2330 					sc->sc_prevphase);
2331 				ncr53c9x_init(sc, 1);
2332 				return (1);
2333 			}
2334 			sc->sc_selid = sc->sc_imess[0];
2335 			NCR_MISC(("selid=%2x ", sc->sc_selid));
2336 
2337 			/* Handle identify message */
2338 			ncr53c9x_msgin(sc);
2339 			if (nfifo != 2) {
2340 				/*
2341 				 * Note: this should not happen
2342 				 * with `dmaselect' on.
2343 				 */
2344 				sc->sc_flags |= NCR_EXPECT_ILLCMD;
2345 				NCRCMD(sc, NCRCMD_FLUSH);
2346 			} else if (sc->sc_features & NCR_F_DMASELECT &&
2347 				   sc->sc_rev == NCR_VARIANT_ESP100) {
2348 				sc->sc_flags |= NCR_EXPECT_ILLCMD;
2349 			}
2350 
2351 			if (sc->sc_state != NCR_CONNECTED &&
2352 			    sc->sc_state != NCR_IDENTIFIED) {
2353 				/* IDENTIFY fail?! */
2354 				printf("%s: identify failed, state %d, intr %02x\n",
2355 					sc->sc_dev.dv_xname, sc->sc_state,
2356 				    sc->sc_espintr);
2357 				ncr53c9x_init(sc, 1);
2358 				return (1);
2359 			}
2360 			goto shortcut; /* ie. next phase expected soon */
2361 		}
2362 
2363 #define	NCRINTR_DONE	(NCRINTR_FC|NCRINTR_BS)
2364 		if ((sc->sc_espintr & NCRINTR_DONE) == NCRINTR_DONE) {
2365 			/*
2366 			 * Arbitration won; examine the `step' register
2367 			 * to determine how far the selection could progress.
2368 			 */
2369 			ecb = sc->sc_nexus;
2370 			if (!ecb)
2371 				panic("ncr53c9x: no nexus");
2372 
2373 			sc_link = ecb->xs->sc_link;
2374 			ti = &sc->sc_tinfo[sc_link->target];
2375 
2376 			switch (sc->sc_espstep) {
2377 			case 0:
2378 				/*
2379 				 * The target did not respond with a
2380 				 * message out phase - probably an old
2381 				 * device that doesn't recognize ATN.
2382 				 * Clear ATN and just continue, the
2383 				 * target should be in the command
2384 				 * phase.
2385 				 * XXXX check for command phase?
2386 				 */
2387 				NCRCMD(sc, NCRCMD_RSTATN);
2388 				break;
2389 			case 1:
2390 				if ((ti->flags & T_NEGOTIATE) == 0 &&
2391 				    ecb->tag[0] == 0) {
2392 					printf("%s: step 1 & !NEG\n",
2393 						sc->sc_dev.dv_xname);
2394 					goto reset;
2395 				}
2396 				if (sc->sc_phase != MESSAGE_OUT_PHASE) {
2397 					printf("%s: !MSGOUT\n",
2398 						sc->sc_dev.dv_xname);
2399 					goto reset;
2400 				}
2401 				if (ti->flags & T_WIDE) {
2402 					ncr53c9x_sched_msgout(SEND_WDTR);
2403 				}
2404 				if (ti->flags & T_NEGOTIATE) {
2405 					/* Start negotiating */
2406 					ti->period = sc->sc_minsync;
2407 					ti->offset = 15;
2408 					sc->sc_flags |= NCR_SYNCHNEGO;
2409 					if (ecb->tag[0])
2410 						ncr53c9x_sched_msgout(SEND_TAG|SEND_SDTR);
2411 					else
2412 						ncr53c9x_sched_msgout(SEND_SDTR);
2413 				} else {
2414 					/* Could not do ATN3 so send TAG */
2415 					ncr53c9x_sched_msgout(SEND_TAG);
2416 				}
2417 				sc->sc_prevphase = MESSAGE_OUT_PHASE; /* XXXX */
2418 				break;
2419 			case 3:
2420 				/*
2421 				 * Grr, this is supposed to mean
2422 				 * "target left command phase  prematurely".
2423 				 * It seems to happen regularly when
2424 				 * sync mode is on.
2425 				 * Look at FIFO to see if command went out.
2426 				 * (Timing problems?)
2427 				 */
2428 				if (sc->sc_features & NCR_F_DMASELECT) {
2429 					if (sc->sc_cmdlen == 0)
2430 						/* Hope for the best.. */
2431 						break;
2432 				} else if ((NCR_READ_REG(sc, NCR_FFLAG)
2433 					    & NCRFIFO_FF) == 0) {
2434 					/* Hope for the best.. */
2435 					break;
2436 				}
2437 				printf("(%s:%d:%d): selection failed;"
2438 					" %d left in FIFO "
2439 					"[intr %x, stat %x, step %d]\n",
2440 					sc->sc_dev.dv_xname,
2441 					sc_link->target,
2442 					sc_link->lun,
2443 					NCR_READ_REG(sc, NCR_FFLAG)
2444 					 & NCRFIFO_FF,
2445 					sc->sc_espintr, sc->sc_espstat,
2446 					sc->sc_espstep);
2447 				NCRCMD(sc, NCRCMD_FLUSH);
2448 				ncr53c9x_sched_msgout(SEND_ABORT);
2449 				return (1);
2450 			case 2:
2451 				/* Select stuck at Command Phase */
2452 				NCRCMD(sc, NCRCMD_FLUSH);
2453 				break;
2454 			case 4:
2455 				if (sc->sc_features & NCR_F_DMASELECT &&
2456 				    sc->sc_cmdlen != 0)
2457 					printf("(%s:%d:%d): select; "
2458 					       "%lu left in DMA buffer "
2459 					"[intr %x, stat %x, step %d]\n",
2460 						sc->sc_dev.dv_xname,
2461 						sc_link->target,
2462 						sc_link->lun,
2463 						(u_long)sc->sc_cmdlen,
2464 						sc->sc_espintr,
2465 						sc->sc_espstat,
2466 						sc->sc_espstep);
2467 				/* So far, everything went fine */
2468 				break;
2469 			}
2470 
2471 			sc->sc_prevphase = INVALID_PHASE; /* ?? */
2472 			/* Do an implicit RESTORE POINTERS. */
2473 			sc->sc_dp = ecb->daddr;
2474 			sc->sc_dleft = ecb->dleft;
2475 			sc->sc_state = NCR_CONNECTED;
2476 			break;
2477 
2478 		} else {
2479 
2480 			printf("%s: unexpected status after select"
2481 				": [intr %x, stat %x, step %x]\n",
2482 				sc->sc_dev.dv_xname,
2483 				sc->sc_espintr, sc->sc_espstat,
2484 				sc->sc_espstep);
2485 			NCRCMD(sc, NCRCMD_FLUSH);
2486 			DELAY(1);
2487 			goto reset;
2488 		}
2489 		if (sc->sc_state == NCR_IDLE) {
2490 			printf("%s: stray interrupt\n",
2491 			    sc->sc_dev.dv_xname);
2492 				return (0);
2493 		}
2494 		break;
2495 
2496 	case NCR_CONNECTED:
2497 		if (sc->sc_flags & NCR_ICCS) {
2498 			/* "Initiate Command Complete Steps" in progress */
2499 			u_char msg;
2500 
2501 			sc->sc_flags &= ~NCR_ICCS;
2502 
2503 			if (!(sc->sc_espintr & NCRINTR_DONE)) {
2504 				printf("%s: ICCS: "
2505 				      ": [intr %x, stat %x, step %x]\n",
2506 					sc->sc_dev.dv_xname,
2507 					sc->sc_espintr, sc->sc_espstat,
2508 					sc->sc_espstep);
2509 			}
2510 			ncr53c9x_rdfifo(sc, NCR_RDFIFO_START);
2511 			if (sc->sc_imlen < 2)
2512 				printf("%s: can't get status, only %d bytes\n",
2513 				    sc->sc_dev.dv_xname, (int)sc->sc_imlen);
2514 			ecb->stat = sc->sc_imess[sc->sc_imlen - 2];
2515 			msg = sc->sc_imess[sc->sc_imlen - 1];
2516 			NCR_PHASE(("<stat:(%x,%x)>", ecb->stat, msg));
2517 			if (msg == MSG_CMDCOMPLETE) {
2518 				ecb->dleft = (ecb->flags & ECB_TENTATIVE_DONE)
2519 					? 0
2520 					: sc->sc_dleft;
2521 				if ((ecb->flags & ECB_SENSE) == 0)
2522 					ecb->xs->resid = ecb->dleft;
2523 				sc->sc_state = NCR_CMDCOMPLETE;
2524 			} else
2525 				printf("%s: STATUS_PHASE: msg %d\n",
2526 					sc->sc_dev.dv_xname, msg);
2527 			sc->sc_imlen = 0;
2528 			NCRCMD(sc, NCRCMD_MSGOK);
2529 			goto shortcut; /* ie. wait for disconnect */
2530 		}
2531 		break;
2532 	default:
2533 		/* Don't panic: reset. */
2534 		printf("%s: invalid state: %d\n",
2535 		      sc->sc_dev.dv_xname,
2536 		      sc->sc_state);
2537 		ncr53c9x_scsi_reset(sc);
2538 		goto out;
2539 		break;
2540 	}
2541 
2542 	/*
2543 	 * Driver is now in state NCR_CONNECTED, i.e. we
2544 	 * have a current command working the SCSI bus.
2545 	 */
2546 	if (sc->sc_state != NCR_CONNECTED || ecb == NULL) {
2547 		panic("ncr53c9x no nexus");
2548 	}
2549 
2550 	switch (sc->sc_phase) {
2551 	case MESSAGE_OUT_PHASE:
2552 		NCR_PHASE(("MESSAGE_OUT_PHASE "));
2553 		ncr53c9x_msgout(sc);
2554 		sc->sc_prevphase = MESSAGE_OUT_PHASE;
2555 		break;
2556 	case MESSAGE_IN_PHASE:
2557 msgin:
2558 		NCR_PHASE(("MESSAGE_IN_PHASE "));
2559 		if (sc->sc_espintr & NCRINTR_BS) {
2560 			if ((sc->sc_rev != NCR_VARIANT_FAS366) ||
2561 			    !(sc->sc_espstat2 & FAS_STAT2_EMPTY)) {
2562 				NCRCMD(sc, NCRCMD_FLUSH);
2563 			}
2564 			sc->sc_flags |= NCR_WAITI;
2565 			NCRCMD(sc, NCRCMD_TRANS);
2566 		} else if (sc->sc_espintr & NCRINTR_FC) {
2567 			if ((sc->sc_flags & NCR_WAITI) == 0) {
2568 				printf("%s: MSGIN: unexpected FC bit: "
2569 					"[intr %x, stat %x, step %x]\n",
2570 				sc->sc_dev.dv_xname,
2571 				sc->sc_espintr, sc->sc_espstat,
2572 				sc->sc_espstep);
2573 			}
2574 			sc->sc_flags &= ~NCR_WAITI;
2575 			ncr53c9x_rdfifo(sc,
2576 			    (sc->sc_prevphase == sc->sc_phase) ?
2577 			    NCR_RDFIFO_CONTINUE : NCR_RDFIFO_START);
2578 			ncr53c9x_msgin(sc);
2579 		} else {
2580 			printf("%s: MSGIN: weird bits: "
2581 				"[intr %x, stat %x, step %x]\n",
2582 				sc->sc_dev.dv_xname,
2583 				sc->sc_espintr, sc->sc_espstat,
2584 				sc->sc_espstep);
2585 		}
2586 		sc->sc_prevphase = MESSAGE_IN_PHASE;
2587 		goto shortcut;	/* i.e. expect data to be ready */
2588 		break;
2589 	case COMMAND_PHASE:
2590 		/*
2591 		 * Send the command block. Normally we don't see this
2592 		 * phase because the SEL_ATN command takes care of
2593 		 * all this. However, we end up here if either the
2594 		 * target or we wanted to exchange some more messages
2595 		 * first (e.g. to start negotiations).
2596 		 */
2597 
2598 		NCR_PHASE(("COMMAND_PHASE 0x%02x (%d) ",
2599 			ecb->cmd.cmd.opcode, ecb->clen));
2600 		if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
2601 			NCRCMD(sc, NCRCMD_FLUSH);
2602 /*			DELAY(1); */
2603 		}
2604 		if (sc->sc_features & NCR_F_DMASELECT) {
2605 			/* setup DMA transfer for command */
2606 			size = ecb->clen;
2607 			sc->sc_cmdlen = size;
2608 			sc->sc_cmdp = (caddr_t)&ecb->cmd.cmd;
2609 			NCRDMA_SETUP(sc, &sc->sc_cmdp, &sc->sc_cmdlen,
2610 				     0, &size);
2611 			/* Program the SCSI counter */
2612 			NCR_SET_COUNT(sc, size);
2613 
2614 			/* load the count in */
2615 			NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA);
2616 
2617 			/* start the command transfer */
2618 			NCRCMD(sc, NCRCMD_TRANS | NCRCMD_DMA);
2619 			NCRDMA_GO(sc);
2620 		} else {
2621 			ncr53c9x_wrfifo(sc, (u_char *)&ecb->cmd.cmd, ecb->clen);
2622 			NCRCMD(sc, NCRCMD_TRANS);
2623 		}
2624 		sc->sc_prevphase = COMMAND_PHASE;
2625 		break;
2626 	case DATA_OUT_PHASE:
2627 		NCR_PHASE(("DATA_OUT_PHASE [%ld] ",(long)sc->sc_dleft));
2628 		NCRCMD(sc, NCRCMD_FLUSH);
2629 		size = min(sc->sc_dleft, sc->sc_maxxfer);
2630 		NCRDMA_SETUP(sc, &sc->sc_dp, &sc->sc_dleft,
2631 			  0, &size);
2632 		sc->sc_prevphase = DATA_OUT_PHASE;
2633 		goto setup_xfer;
2634 	case DATA_IN_PHASE:
2635 		NCR_PHASE(("DATA_IN_PHASE "));
2636 		if (sc->sc_rev == NCR_VARIANT_ESP100)
2637 			NCRCMD(sc, NCRCMD_FLUSH);
2638 		size = min(sc->sc_dleft, sc->sc_maxxfer);
2639 		NCRDMA_SETUP(sc, &sc->sc_dp, &sc->sc_dleft,
2640 			  1, &size);
2641 		sc->sc_prevphase = DATA_IN_PHASE;
2642 	setup_xfer:
2643 		/* Target returned to data phase: wipe "done" memory */
2644 		ecb->flags &= ~ECB_TENTATIVE_DONE;
2645 
2646 		/* Program the SCSI counter */
2647 		NCR_SET_COUNT(sc, size);
2648 
2649 		/* load the count in */
2650 		NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA);
2651 
2652 		/*
2653 		 * Note that if `size' is 0, we've already transceived
2654 		 * all the bytes we want but we're still in DATA PHASE.
2655 		 * Apparently, the device needs padding. Also, a
2656 		 * transfer size of 0 means "maximum" to the chip
2657 		 * DMA logic.
2658 		 */
2659 		NCRCMD(sc,
2660 		       (size==0?NCRCMD_TRPAD:NCRCMD_TRANS)|NCRCMD_DMA);
2661 		NCRDMA_GO(sc);
2662 		return (1);
2663 	case STATUS_PHASE:
2664 		NCR_PHASE(("STATUS_PHASE "));
2665 		sc->sc_flags |= NCR_ICCS;
2666 		NCRCMD(sc, NCRCMD_ICCS);
2667 		sc->sc_prevphase = STATUS_PHASE;
2668 		goto shortcut;	/* i.e. expect status results soon */
2669 		break;
2670 	case INVALID_PHASE:
2671 		break;
2672 	default:
2673 		printf("%s: unexpected bus phase; resetting\n",
2674 		    sc->sc_dev.dv_xname);
2675 		goto reset;
2676 	}
2677 
2678 out:
2679 	return (1);
2680 
2681 reset:
2682 	ncr53c9x_init(sc, 1);
2683 	goto out;
2684 
2685 finish:
2686 	ncr53c9x_done(sc, ecb);
2687 	goto out;
2688 
2689 sched:
2690 	sc->sc_state = NCR_IDLE;
2691 	ncr53c9x_sched(sc);
2692 	goto out;
2693 
2694 shortcut:
2695 	/*
2696 	 * The idea is that many of the SCSI operations take very little
2697 	 * time, and going away and getting interrupted is too high an
2698 	 * overhead to pay. For example, selecting, sending a message
2699 	 * and command and then doing some work can be done in one "pass".
2700 	 *
2701 	 * The delay is a heuristic. It is 2 when at 20MHz, 2 at 25MHz and 1
2702 	 * at 40MHz. This needs testing.
2703 	 */
2704 	{
2705 		struct timeval wait, cur;
2706 
2707 		microtime(&wait);
2708 		wait.tv_usec += 50/sc->sc_freq;
2709 		if (wait.tv_usec > 1000000) {
2710 			wait.tv_sec++;
2711 			wait.tv_usec -= 1000000;
2712 		}
2713 		do {
2714 			if (NCRDMA_ISINTR(sc))
2715 				goto again;
2716 			microtime(&cur);
2717 		} while (timercmp(&cur, &wait, <=));
2718 	}
2719 	goto out;
2720 }
2721 
2722 void
2723 ncr53c9x_abort(sc, ecb)
2724 	struct ncr53c9x_softc *sc;
2725 	struct ncr53c9x_ecb *ecb;
2726 {
2727 
2728 	/* 2 secs for the abort */
2729 	ecb->timeout = NCR_ABORT_TIMEOUT;
2730 	ecb->flags |= ECB_ABORT;
2731 
2732 	if (ecb == sc->sc_nexus) {
2733 		int timeout = ecb->timeout;
2734 
2735 		/*
2736 		 * If we're still selecting, the message will be scheduled
2737 		 * after selection is complete.
2738 		 */
2739 		if (sc->sc_state == NCR_CONNECTED)
2740 			ncr53c9x_sched_msgout(SEND_ABORT);
2741 
2742 		/*
2743 		 * Reschedule timeout.
2744 		 */
2745 		if (timeout > 1000000)
2746 			timeout = (timeout / 1000) * hz;
2747 		else
2748 			timeout = (timeout * hz) / 1000;
2749 		timeout_add(&ecb->to, timeout);
2750 	} else {
2751 		/*
2752 		 * Just leave the command where it is.
2753 		 * XXX - what choice do we have but to reset the SCSI
2754 		 *	 eventually?
2755 		 */
2756 		if (sc->sc_state == NCR_IDLE)
2757 			ncr53c9x_sched(sc);
2758 	}
2759 }
2760 
2761 void
2762 ncr53c9x_timeout(arg)
2763 	void *arg;
2764 {
2765 	struct ncr53c9x_ecb *ecb = arg;
2766 	struct scsi_xfer *xs = ecb->xs;
2767 	struct scsi_link *sc_link = xs->sc_link;
2768 	struct ncr53c9x_softc *sc = sc_link->adapter_softc;
2769 	struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[sc_link->target];
2770 	int s;
2771 
2772 	sc_print_addr(sc_link);
2773 	printf("timed out [ecb %p (flags 0x%x, dleft %x, stat %x)], "
2774 	       "<state %d, nexus %p, phase(l %x, c %x, p %x), resid %lx, "
2775 	       "msg(q %x,o %x) %s>",
2776 		ecb, ecb->flags, ecb->dleft, ecb->stat,
2777 		sc->sc_state, sc->sc_nexus,
2778 		NCR_READ_REG(sc, NCR_STAT),
2779 		sc->sc_phase, sc->sc_prevphase,
2780 		(long)sc->sc_dleft, sc->sc_msgpriq, sc->sc_msgout,
2781 		NCRDMA_ISACTIVE(sc) ? "DMA active" : "");
2782 #if NCR53C9X_DEBUG > 1
2783 	printf("TRACE: %s.", ecb->trace);
2784 #endif
2785 
2786 	s = splbio();
2787 
2788 	if (ecb->flags & ECB_ABORT) {
2789 		/* abort timed out */
2790 		printf(" AGAIN\n");
2791 
2792 		ncr53c9x_init(sc, 1);
2793 	} else {
2794 		/* abort the operation that has timed out */
2795 		printf("\n");
2796 		xs->error = XS_TIMEOUT;
2797 		ncr53c9x_abort(sc, ecb);
2798 
2799 		/* Disable sync mode if stuck in a data phase */
2800 		if (ecb == sc->sc_nexus &&
2801 		    (ti->flags & T_SYNCMODE) != 0 &&
2802 		    (sc->sc_phase & (MSGI|CDI)) == 0) {
2803 			sc_print_addr(sc_link);
2804 			printf("sync negotiation disabled\n");
2805 			sc->sc_cfflags |= (1 << (sc_link->target + 16));
2806 		}
2807 	}
2808 
2809 	splx(s);
2810 }
2811 
2812 void
2813 ncr53c9x_watch(arg)
2814 	void *arg;
2815 {
2816 	struct ncr53c9x_softc *sc = (struct ncr53c9x_softc *)arg;
2817 	struct ncr53c9x_tinfo *ti;
2818 	struct ncr53c9x_linfo *li;
2819 	int t, s;
2820 	/* Delete any structures that have not been used in 10min. */
2821 	time_t old = time_second - (10*60);
2822 
2823 	s = splbio();
2824 	for (t = 0; t < sc->sc_ntarg; t++) {
2825 		ti = &sc->sc_tinfo[t];
2826 		for (li = LIST_FIRST(&ti->luns); li != LIST_END(&ti->luns); ) {
2827 			if (li->last_used < old && !li->untagged && !li->used) {
2828 				if (li->lun < NCR_NLUN)
2829 					ti->lun[li->lun] = NULL;
2830 				LIST_REMOVE(li, link);
2831 				free(li, M_DEVBUF);
2832 				/* Restart the search at the beginning */
2833 				li = LIST_FIRST(&ti->luns);
2834 				continue;
2835 			}
2836 			li = LIST_NEXT(li, link);
2837 		}
2838 	}
2839 	splx(s);
2840 	timeout_add_sec(&sc->sc_watchdog, 60);
2841 }
2842