xref: /netbsd/sys/dev/ic/aic7xxx.c (revision bf9ec67e)
1 /*	$NetBSD: aic7xxx.c,v 1.88 2002/04/05 18:27:50 bouyer Exp $	*/
2 
3 /*
4  * Generic driver for the aic7xxx based adaptec SCSI controllers
5  * Product specific probe and attach routines can be found in:
6  * i386/eisa/ahc_eisa.c	27/284X and aic7770 motherboard controllers
7  * pci/ahc_pci.c	3985, 3980, 3940, 2940, aic7895, aic7890,
8  *			aic7880, aic7870, aic7860, and aic7850 controllers
9  * cardbus/ahc_cardbus.c aic7860 cardbus controllers
10  *
11  * Copyright (c) 1994, 1995, 1996, 1997, 1998, 1999, 2000 Justin T. Gibbs.
12  * All rights reserved.
13  *
14  * Redistribution and use in source and binary forms, with or without
15  * modification, are permitted provided that the following conditions
16  * are met:
17  * 1. Redistributions of source code must retain the above copyright
18  *    notice, this list of conditions, and the following disclaimer,
19  *    without modification.
20  * 2. The name of the author may not be used to endorse or promote products
21  *    derived from this software without specific prior written permission.
22  *
23  * Alternatively, this software may be distributed under the terms of the
24  * the GNU Public License ("GPL").
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
30  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  *
38  * $FreeBSD: src/sys/dev/aic7xxx/aic7xxx.c,v 1.42 2000/03/18 22:28:18 gibbs Exp $
39  */
40 /*
41  * A few notes on features of the driver.
42  *
43  * SCB paging takes advantage of the fact that devices stay disconnected
44  * from the bus a relatively long time and that while they're disconnected,
45  * having the SCBs for these transactions down on the host adapter is of
46  * little use.  Instead of leaving this idle SCB down on the card we copy
47  * it back up into kernel memory and reuse the SCB slot on the card to
48  * schedule another transaction.  This can be a real payoff when doing random
49  * I/O to tagged queueing devices since there are more transactions active at
50  * once for the device to sort for optimal seek reduction. The algorithm goes
51  * like this...
52  *
53  * The sequencer maintains two lists of its hardware SCBs.  The first is the
54  * singly linked free list which tracks all SCBs that are not currently in
55  * use.  The second is the doubly linked disconnected list which holds the
56  * SCBs of transactions that are in the disconnected state sorted most
57  * recently disconnected first.  When the kernel queues a transaction to
58  * the card, a hardware SCB to "house" this transaction is retrieved from
59  * either of these two lists.  If the SCB came from the disconnected list,
60  * a check is made to see if any data transfer or SCB linking (more on linking
61  * in a bit) information has been changed since it was copied from the host
62  * and if so, DMAs the SCB back up before it can be used.  Once a hardware
63  * SCB has been obtained, the SCB is DMAed from the host.  Before any work
64  * can begin on this SCB, the sequencer must ensure that either the SCB is
65  * for a tagged transaction or the target is not already working on another
66  * non-tagged transaction.  If a conflict arises in the non-tagged case, the
67  * sequencer finds the SCB for the active transactions and sets the SCB_LINKED
68  * field in that SCB to this next SCB to execute.  To facilitate finding
69  * active non-tagged SCBs, the last four bytes of up to the first four hardware
70  * SCBs serve as a storage area for the currently active SCB ID for each
71  * target.
72  *
73  * When a device reconnects, a search is made of the hardware SCBs to find
74  * the SCB for this transaction.  If the search fails, a hardware SCB is
75  * pulled from either the free or disconnected SCB list and the proper
76  * SCB is DMAed from the host.  If the MK_MESSAGE control bit is set
77  * in the control byte of the SCB while it was disconnected, the sequencer
78  * will assert ATN and attempt to issue a message to the host.
79  *
80  * When a command completes, a check for non-zero status and residuals is
81  * made.  If either of these conditions exists, the SCB is DMAed back up to
82  * the host so that it can interpret this information.  Additionally, in the
83  * case of bad status, the sequencer generates a special interrupt and pauses
84  * itself.  This allows the host to setup a request sense command if it
85  * chooses for this target synchronously with the error so that sense
86  * information isn't lost.
87  *
88  */
89 
90 #include <sys/cdefs.h>
91 __KERNEL_RCSID(0, "$NetBSD: aic7xxx.c,v 1.88 2002/04/05 18:27:50 bouyer Exp $");
92 
93 #include "opt_ddb.h"
94 #include "opt_ahc.h"
95 
96 #include <sys/param.h>
97 #include <sys/kernel.h>
98 #include <sys/systm.h>
99 #include <sys/device.h>
100 #include <sys/malloc.h>
101 #include <sys/buf.h>
102 #include <sys/proc.h>
103 #include <sys/scsiio.h>
104 
105 #include <machine/bus.h>
106 #include <machine/intr.h>
107 
108 #include <dev/scsipi/scsi_all.h>
109 #include <dev/scsipi/scsipi_all.h>
110 #include <dev/scsipi/scsi_message.h>
111 #include <dev/scsipi/scsipi_debug.h>
112 #include <dev/scsipi/scsiconf.h>
113 
114 #include <uvm/uvm_extern.h>
115 
116 #include <dev/ic/aic7xxxvar.h>
117 #include <dev/microcode/aic7xxx/sequencer.h>
118 #include <dev/microcode/aic7xxx/aic7xxx_reg.h>
119 #include <dev/microcode/aic7xxx/aic7xxx_seq.h>
120 
121 #define ALL_CHANNELS '\0'
122 #define ALL_TARGETS_MASK 0xFFFF
123 #define INITIATOR_WILDCARD	(~0)
124 
125 #define	SIM_IS_SCSIBUS_B(ahc, periph)	\
126 	((periph)->periph_channel->chan_channel == 1)
127 #define	SIM_CHANNEL(ahc, periph)	\
128 	(SIM_IS_SCSIBUS_B(ahc, periph) ? 'B' : 'A')
129 #define	SIM_SCSI_ID(ahc, periph)	\
130 	(SIM_IS_SCSIBUS_B(ahc, periph) ? ahc->our_id_b : ahc->our_id)
131 #define	SCB_IS_SCSIBUS_B(scb)	\
132 	(((scb)->hscb->tcl & SELBUSB) != 0)
133 #define	SCB_TARGET(scb)	\
134 	(((scb)->hscb->tcl & TID) >> 4)
135 #define	SCB_CHANNEL(scb) \
136 	(SCB_IS_SCSIBUS_B(scb) ? 'B' : 'A')
137 #define	SCB_LUN(scb)	\
138 	((scb)->hscb->tcl & LID)
139 #define SCB_TARGET_OFFSET(scb)		\
140 	(SCB_TARGET(scb) + (SCB_IS_SCSIBUS_B(scb) ? 8 : 0))
141 #define SCB_TARGET_MASK(scb)		\
142 	(0x01 << (SCB_TARGET_OFFSET(scb)))
143 #define TCL_CHANNEL(ahc, tcl)		\
144 	((((ahc)->features & AHC_TWIN) && ((tcl) & SELBUSB)) ? 'B' : 'A')
145 #define TCL_SCSI_ID(ahc, tcl)		\
146 	(TCL_CHANNEL((ahc), (tcl)) == 'B' ? (ahc)->our_id_b : (ahc)->our_id)
147 #define TCL_TARGET(tcl) (((tcl) & TID) >> TCL_TARGET_SHIFT)
148 #define TCL_LUN(tcl) ((tcl) & LID)
149 
150 #define XS_TCL(ahc, xs) \
151 	((((xs)->xs_periph->periph_target << 4) & 0xF0) \
152 	    | (SIM_IS_SCSIBUS_B((ahc), (xs)->xs_periph) ? SELBUSB : 0) \
153 	    | ((xs)->xs_periph->periph_lun & 0x07))
154 
155 const char * const ahc_chip_names[] =
156 {
157 	"NONE",
158 	"aic7770",
159 	"aic7850",
160 	"aic7855",
161 	"aic7859",
162 	"aic7860",
163 	"aic7870",
164 	"aic7880",
165 	"aic7890/91",
166 	"aic7892",
167 	"aic7895",
168 	"aic7896/97",
169 	"aic7899"
170 };
171 
172 typedef enum {
173 	ROLE_UNKNOWN,
174 	ROLE_INITIATOR,
175 	ROLE_TARGET
176 } role_t;
177 
178 struct ahc_devinfo {
179 	int	  our_scsiid;
180 	int	  target_offset;
181 	u_int16_t target_mask;
182 	u_int8_t  target;
183 	u_int8_t  lun;
184 	char	  channel;
185 	role_t	  role;		/*
186 				 * Only guaranteed to be correct if not
187 				 * in the busfree state.
188 				 */
189 };
190 
191 typedef enum {
192 	SEARCH_COMPLETE,
193 	SEARCH_COUNT,
194 	SEARCH_REMOVE
195 } ahc_search_action;
196 
197 #ifdef AHC_DEBUG
198 static int     ahc_debug = AHC_DEBUG;
199 #endif
200 
201 static int	ahcinitscbdata(struct ahc_softc *);
202 static void	ahcfiniscbdata(struct ahc_softc *);
203 
204 #if UNUSED
205 static void	ahc_dump_targcmd(struct target_cmd *);
206 #endif
207 static void	ahc_shutdown(void *arg);
208 static void	ahc_action(struct scsipi_channel *,
209 				scsipi_adapter_req_t, void *);
210 static int	ahc_ioctl(struct scsipi_channel *, u_long, caddr_t, int,
211 			  struct proc *);
212 static void	ahc_execute_scb(void *, bus_dma_segment_t *, int);
213 static int	ahc_poll(struct ahc_softc *, int);
214 static void	ahc_setup_data(struct ahc_softc *, struct scsipi_xfer *,
215 			       struct scb *);
216 static void	ahc_freeze_devq(struct ahc_softc *, struct scsipi_periph *);
217 static void	ahcallocscbs(struct ahc_softc *);
218 #if UNUSED
219 static void	ahc_scb_devinfo(struct ahc_softc *, struct ahc_devinfo *,
220 				struct scb *);
221 #endif
222 static void	ahc_fetch_devinfo(struct ahc_softc *, struct ahc_devinfo *);
223 static void	ahc_compile_devinfo(struct ahc_devinfo *, u_int, u_int, u_int,
224 				    char, role_t);
225 static u_int	ahc_abort_wscb(struct ahc_softc *, u_int, u_int);
226 static void	ahc_done(struct ahc_softc *, struct scb *);
227 static struct tmode_tstate *
228 		ahc_alloc_tstate(struct ahc_softc *, u_int, char);
229 #if UNUSED
230 static void	ahc_free_tstate(struct ahc_softc *, u_int, char, int);
231 #endif
232 static void 	ahc_handle_seqint(struct ahc_softc *, u_int);
233 static void	ahc_handle_scsiint(struct ahc_softc *, u_int);
234 static void	ahc_build_transfer_msg(struct ahc_softc *,
235 				       struct ahc_devinfo *);
236 static void	ahc_setup_initiator_msgout(struct ahc_softc *,
237 					   struct ahc_devinfo *,
238 					   struct scb *);
239 static void	ahc_setup_target_msgin(struct ahc_softc *,
240 				       struct ahc_devinfo *);
241 static void	ahc_clear_msg_state(struct ahc_softc *);
242 static void	ahc_handle_message_phase(struct ahc_softc *,
243 					 struct scsipi_periph *);
244 static int	ahc_sent_msg(struct ahc_softc *, u_int, int);
245 
246 static int	ahc_parse_msg(struct ahc_softc *, struct scsipi_periph *,
247 			      struct ahc_devinfo *);
248 static void	ahc_handle_ign_wide_residue(struct ahc_softc *,
249 					    struct ahc_devinfo *);
250 static void	ahc_handle_devreset(struct ahc_softc *, struct ahc_devinfo *,
251 				    int, char *, int);
252 #ifdef AHC_DUMP_SEQ
253 static void	ahc_dumpseq(struct ahc_softc *);
254 #endif
255 static void	ahc_loadseq(struct ahc_softc *);
256 static int	ahc_check_patch(struct ahc_softc *, const struct patch **,
257 				int, int *);
258 static void	ahc_download_instr(struct ahc_softc *, int, u_int8_t *);
259 static int	ahc_match_scb(struct scb *, int, char, int, u_int, role_t);
260 #if defined(AHC_DEBUG)
261 static void	ahc_print_scb(struct scb *);
262 #endif
263 static int	ahc_search_qinfifo(struct ahc_softc *, int, char, int, u_int,
264 				   role_t, scb_flag, ahc_search_action);
265 static int	ahc_reset_channel(struct ahc_softc *, char, int);
266 static int	ahc_abort_scbs(struct ahc_softc *, int, char, int, u_int,
267 			       role_t, int);
268 static int	ahc_search_disc_list(struct ahc_softc *, int,
269 				     char, int, u_int, int, int, int);
270 static u_int	ahc_rem_scb_from_disc_list(struct ahc_softc *, u_int, u_int);
271 static void	ahc_add_curscb_to_free_list(struct ahc_softc *);
272 static void	ahc_clear_intstat(struct ahc_softc *);
273 static void	ahc_reset_current_bus(struct ahc_softc *);
274 static const struct ahc_syncrate *
275 		ahc_devlimited_syncrate(struct ahc_softc *, u_int *);
276 static const struct ahc_syncrate *
277 		ahc_find_syncrate(struct ahc_softc *, u_int *, u_int);
278 static u_int	ahc_find_period(struct ahc_softc *, u_int, u_int);
279 static void	ahc_validate_offset(struct ahc_softc *,
280 				const struct ahc_syncrate *, u_int *, int);
281 static void	ahc_update_target_msg_request(struct ahc_softc *,
282 					      struct ahc_devinfo *,
283 					      struct ahc_initiator_tinfo *,
284 					      int, int);
285 static void	ahc_set_syncrate(struct ahc_softc *, struct ahc_devinfo *,
286 				 const struct ahc_syncrate *, u_int, u_int,
287 				 u_int, int, int);
288 static void	ahc_set_width(struct ahc_softc *, struct ahc_devinfo *,
289 			      u_int, u_int, int, int);
290 static void	ahc_set_tags(struct ahc_softc *, struct ahc_devinfo *, int);
291 static void	ahc_update_xfer_mode(struct ahc_softc *, struct ahc_devinfo *);
292 static void	ahc_construct_sdtr(struct ahc_softc *, u_int, u_int);
293 
294 static void	ahc_construct_wdtr(struct ahc_softc *, u_int);
295 
296 static void	ahc_calc_residual(struct scb *);
297 
298 static void	ahc_update_pending_syncrates(struct ahc_softc *);
299 
300 static void	ahc_set_recoveryscb(struct ahc_softc *, struct scb *);
301 
302 static void     ahc_timeout (void *);
303 static __inline int  sequencer_paused(struct ahc_softc *);
304 static __inline void pause_sequencer(struct ahc_softc *);
305 static __inline void unpause_sequencer(struct ahc_softc *);
306 static 		void restart_sequencer(struct ahc_softc *);
307 static __inline u_int ahc_index_busy_tcl(struct ahc_softc *, u_int, int);
308 
309 static __inline void	 ahc_busy_tcl(struct ahc_softc *, struct scb *);
310 static __inline int	ahc_isbusy_tcl(struct ahc_softc *, struct scb *);
311 
312 static __inline void	   ahc_freeze_ccb(struct scb *);
313 static __inline void	   ahcsetccbstatus(struct scsipi_xfer *, int);
314 static void		   ahc_run_qoutfifo(struct ahc_softc *);
315 
316 static __inline struct ahc_initiator_tinfo *
317 			   ahc_fetch_transinfo(struct ahc_softc *,
318 					       char, u_int, u_int,
319 					       struct tmode_tstate **);
320 static void	   ahcfreescb(struct ahc_softc *, struct scb *);
321 static __inline	struct scb *ahcgetscb(struct ahc_softc *);
322 
323 static int ahc_createdmamem(bus_dma_tag_t, int, int, bus_dmamap_t *,
324 			    caddr_t *, bus_addr_t *, bus_dma_segment_t *,
325 			    int *, const char *, const char *);
326 static void ahc_freedmamem(bus_dma_tag_t, int, bus_dmamap_t,
327 			   caddr_t, bus_dma_segment_t *, int);
328 static void ahcminphys(struct buf *);
329 
330 static __inline void ahc_swap_hscb(struct hardware_scb *);
331 static __inline void ahc_swap_sg(struct ahc_dma_seg *);
332 static int ahc_istagged_device(struct ahc_softc *, struct scsipi_xfer *, int);
333 
334 #if defined(AHC_DEBUG) && 0
335 static void ahc_dumptinfo(struct ahc_softc *, struct ahc_initiator_tinfo *);
336 #endif
337 
338 static __inline void
339 ahc_swap_hscb(struct hardware_scb *hscb)
340 {
341 	hscb->SG_pointer = htole32(hscb->SG_pointer);
342 	hscb->data = htole32(hscb->data);
343 	hscb->datalen = htole32(hscb->datalen);
344 	/*
345 	 * No need to swap cmdpointer; it's either 0 or set to
346 	 * cmdstore_busaddr, which is already swapped.
347 	 */
348 }
349 
350 static __inline void
351 ahc_swap_sg(struct ahc_dma_seg *sg)
352 {
353 	sg->addr = htole32(sg->addr);
354 	sg->len = htole32(sg->len);
355 }
356 
357 static void
358 ahcminphys(bp)
359 	struct buf *bp;
360 {
361 /*
362  * Even though the card can transfer up to 16megs per command
363  * we are limited by the number of segments in the dma segment
364  * list that we can hold.  The worst case is that all pages are
365  * discontinuous physically, hense the "page per segment" limit
366  * enforced here.
367  */
368 	if (bp->b_bcount > AHC_MAXTRANSFER_SIZE) {
369 		bp->b_bcount = AHC_MAXTRANSFER_SIZE;
370 	}
371 	minphys(bp);
372 }
373 
374 
375 static __inline u_int32_t
376 ahc_hscb_busaddr(struct ahc_softc *ahc, u_int index)
377 {
378 	return (ahc->scb_data->hscb_busaddr
379 		+ (sizeof(struct hardware_scb) * index));
380 }
381 
382 #define AHC_BUSRESET_DELAY	25	/* Reset delay in us */
383 
384 static __inline int
385 sequencer_paused(struct ahc_softc *ahc)
386 {
387 	return ((ahc_inb(ahc, HCNTRL) & PAUSE) != 0);
388 }
389 
390 static __inline void
391 pause_sequencer(struct ahc_softc *ahc)
392 {
393 	ahc_outb(ahc, HCNTRL, ahc->pause);
394 
395 	/*
396 	 * Since the sequencer can disable pausing in a critical section, we
397 	 * must loop until it actually stops.
398 	 */
399 	while (sequencer_paused(ahc) == 0)
400 		;
401 }
402 
403 static __inline void
404 unpause_sequencer(struct ahc_softc *ahc)
405 {
406 	if ((ahc_inb(ahc, INTSTAT) & (SCSIINT | SEQINT | BRKADRINT)) == 0)
407 		ahc_outb(ahc, HCNTRL, ahc->unpause);
408 }
409 
410 /*
411  * Restart the sequencer program from address zero
412  */
413 static void
414 restart_sequencer(struct ahc_softc *ahc)
415 {
416 	u_int i;
417 
418 	pause_sequencer(ahc);
419 
420 	/*
421 	 * Everytime we restart the sequencer, there
422 	 * is the possiblitity that we have restarted
423 	 * within a three instruction window where an
424 	 * SCB has been marked free but has not made it
425 	 * onto the free list.  Since SCSI events(bus reset,
426 	 * unexpected bus free) will always freeze the
427 	 * sequencer, we cannot close this window.  To
428 	 * avoid losing an SCB, we reconsitute the free
429 	 * list every time we restart the sequencer.
430 	 */
431 	ahc_outb(ahc, FREE_SCBH, SCB_LIST_NULL);
432 	for (i = 0; i < ahc->scb_data->maxhscbs; i++) {
433 
434 		ahc_outb(ahc, SCBPTR, i);
435 		if (ahc_inb(ahc, SCB_TAG) == SCB_LIST_NULL)
436 			ahc_add_curscb_to_free_list(ahc);
437 	}
438 	ahc_outb(ahc, SEQCTL, FASTMODE|SEQRESET);
439 	unpause_sequencer(ahc);
440 }
441 
442 static __inline u_int
443 ahc_index_busy_tcl(struct ahc_softc *ahc, u_int tcl, int unbusy)
444 {
445 	u_int scbid;
446 
447 	scbid = ahc->untagged_scbs[tcl];
448 	if (unbusy) {
449 		ahc->untagged_scbs[tcl] = SCB_LIST_NULL;
450 		bus_dmamap_sync(ahc->parent_dmat, ahc->shared_data_dmamap,
451 		    UNTAGGEDSCB_OFFSET * 256, 256, BUS_DMASYNC_PREWRITE);
452 	}
453 
454 	return (scbid);
455 }
456 
457 static __inline void
458 ahc_busy_tcl(struct ahc_softc *ahc, struct scb *scb)
459 {
460 	ahc->untagged_scbs[scb->hscb->tcl] = scb->hscb->tag;
461 	bus_dmamap_sync(ahc->parent_dmat, ahc->shared_data_dmamap,
462 	    UNTAGGEDSCB_OFFSET * 256, 256, BUS_DMASYNC_PREWRITE);
463 }
464 
465 static __inline int
466 ahc_isbusy_tcl(struct ahc_softc *ahc, struct scb *scb)
467 {
468 	return ahc->untagged_scbs[scb->hscb->tcl] != SCB_LIST_NULL;
469 }
470 
471 static __inline void
472 ahc_freeze_ccb(struct scb *scb)
473 {
474 	struct scsipi_xfer *xs = scb->xs;
475 
476 	if (!(scb->flags & SCB_FREEZE_QUEUE)) {
477 		scsipi_periph_freeze(xs->xs_periph, 1);
478 		scb->flags |= SCB_FREEZE_QUEUE;
479 	}
480 }
481 
482 static __inline void
483 ahcsetccbstatus(struct scsipi_xfer *xs, int status)
484 {
485 	xs->error = status;
486 }
487 
488 static __inline struct ahc_initiator_tinfo *
489 ahc_fetch_transinfo(struct ahc_softc *ahc, char channel, u_int our_id,
490 		    u_int remote_id, struct tmode_tstate **tstate)
491 {
492 	/*
493 	 * Transfer data structures are stored from the perspective
494 	 * of the target role.  Since the parameters for a connection
495 	 * in the initiator role to a given target are the same as
496 	 * when the roles are reversed, we pretend we are the target.
497 	 */
498 	if (channel == 'B')
499 		our_id += 8;
500 	*tstate = ahc->enabled_targets[our_id];
501 	return (&(*tstate)->transinfo[remote_id]);
502 }
503 
504 static void
505 ahc_run_qoutfifo(struct ahc_softc *ahc)
506 {
507 	struct scb *scb;
508 	u_int  scb_index;
509 
510 	bus_dmamap_sync(ahc->parent_dmat, ahc->shared_data_dmamap, 0,
511 	     256, BUS_DMASYNC_POSTREAD);
512 
513 	while (ahc->qoutfifo[ahc->qoutfifonext] != SCB_LIST_NULL) {
514 		scb_index = ahc->qoutfifo[ahc->qoutfifonext];
515 		ahc->qoutfifo[ahc->qoutfifonext++] = SCB_LIST_NULL;
516 
517 		scb = &ahc->scb_data->scbarray[scb_index];
518 		if (scb_index >= ahc->scb_data->numscbs
519 		  || (scb->flags & SCB_ACTIVE) == 0) {
520 			printf("%s: WARNING no command for scb %d "
521 			       "(cmdcmplt)\nQOUTPOS = %d\n",
522 			       ahc_name(ahc), scb_index,
523 			       ahc->qoutfifonext - 1);
524 			continue;
525 		}
526 
527 		/*
528 		 * Save off the residual
529 		 * if there is one.
530 		 */
531 		if (scb->hscb->residual_SG_count != 0)
532 			ahc_calc_residual(scb);
533 		else
534 			scb->xs->resid = 0;
535 #ifdef AHC_DEBUG
536 		if (ahc_debug & AHC_SHOWSCBS) {
537 			scsipi_printaddr(scb->xs->xs_periph);
538 			printf("run_qoutfifo: SCB %x complete\n",
539 			    scb->hscb->tag);
540 		}
541 #endif
542 		ahc_done(ahc, scb);
543 	}
544 }
545 
546 
547 /*
548  * An scb (and hence an scb entry on the board) is put onto the
549  * free list.
550  */
551 static void
552 ahcfreescb(struct ahc_softc *ahc, struct scb *scb)
553 {
554 	struct hardware_scb *hscb;
555 	int opri;
556 
557 	hscb = scb->hscb;
558 
559 #ifdef AHC_DEBUG
560 	if (ahc_debug & AHC_SHOWSCBALLOC)
561 		printf("%s: free SCB tag %x\n", ahc_name(ahc), hscb->tag);
562 #endif
563 
564 	opri = splbio();
565 
566 	if ((ahc->flags & AHC_RESOURCE_SHORTAGE) != 0 ||
567 	    (scb->flags & SCB_RECOVERY_SCB) != 0) {
568 		ahc->flags &= ~AHC_RESOURCE_SHORTAGE;
569 		scsipi_channel_thaw(&ahc->sc_channel, 1);
570 		if (ahc->features & AHC_TWIN)
571 			scsipi_channel_thaw(&ahc->sc_channel_b, 1);
572 	}
573 
574 	/* Clean up for the next user */
575 	scb->flags = SCB_FREE;
576 	hscb->control = 0;
577 	hscb->status = 0;
578 
579 	SLIST_INSERT_HEAD(&ahc->scb_data->free_scbs, scb, links);
580 
581 	splx(opri);
582 }
583 
584 /*
585  * Get a free scb, either one already assigned to a hardware slot
586  * on the adapter or one that will require an SCB to be paged out before
587  * use. If there are none, see if we can allocate a new SCB.  Otherwise
588  * either return an error or sleep.
589  */
590 static __inline struct scb *
591 ahcgetscb(struct ahc_softc *ahc)
592 {
593 	struct scb *scbp;
594 	int opri;;
595 
596 	opri = splbio();
597 	if ((scbp = SLIST_FIRST(&ahc->scb_data->free_scbs))) {
598 		SLIST_REMOVE_HEAD(&ahc->scb_data->free_scbs, links);
599 	} else {
600 		ahcallocscbs(ahc);
601 		scbp = SLIST_FIRST(&ahc->scb_data->free_scbs);
602 		if (scbp != NULL)
603 			SLIST_REMOVE_HEAD(&ahc->scb_data->free_scbs, links);
604 	}
605 
606 	splx(opri);
607 
608 #ifdef AHC_DEBUG
609 	if (ahc_debug & AHC_SHOWSCBALLOC) {
610 		if (scbp != NULL)
611 			printf("%s: new SCB, tag %x\n", ahc_name(ahc),
612 			    scbp->hscb->tag);
613 		else
614 			printf("%s: failed to allocate new SCB\n",
615 			    ahc_name(ahc));
616 	}
617 #endif
618 
619 	return (scbp);
620 }
621 
622 static int
623 ahc_createdmamem(tag, size, flags, mapp, vaddr, baddr, seg, nseg, myname, what)
624 	bus_dma_tag_t tag;
625 	int size;
626 	int flags;
627 	bus_dmamap_t *mapp;
628 	caddr_t *vaddr;
629 	bus_addr_t *baddr;
630 	bus_dma_segment_t *seg;
631 	int *nseg;
632 	const char *myname, *what;
633 {
634 	int error, level = 0;
635 
636 	if ((error = bus_dmamem_alloc(tag, size, PAGE_SIZE, 0,
637 			seg, 1, nseg, BUS_DMA_NOWAIT)) != 0) {
638 		printf("%s: failed to allocate DMA mem for %s, error = %d\n",
639 			myname, what, error);
640 		goto out;
641 	}
642 	level++;
643 
644 	if ((error = bus_dmamem_map(tag, seg, *nseg, size, vaddr,
645 			BUS_DMA_NOWAIT|BUS_DMA_COHERENT)) != 0) {
646 		printf("%s: failed to map DMA mem for %s, error = %d\n",
647 			myname, what, error);
648 		goto out;
649 	}
650 	level++;
651 
652 	if ((error = bus_dmamap_create(tag, size, 1, size, 0,
653 			BUS_DMA_NOWAIT | flags, mapp)) != 0) {
654                 printf("%s: failed to create DMA map for %s, error = %d\n",
655 			myname, what, error);
656 		goto out;
657         }
658 	level++;
659 
660 	if ((error = bus_dmamap_load(tag, *mapp, *vaddr, size, NULL,
661 			BUS_DMA_NOWAIT)) != 0) {
662                 printf("%s: failed to load DMA map for %s, error = %d\n",
663 			myname, what, error);
664 		goto out;
665         }
666 
667 	*baddr = (*mapp)->dm_segs[0].ds_addr;
668 
669 #ifdef AHC_DEBUG
670 	printf("%s: dmamem for %s at busaddr %lx virt %lx nseg %d size %d\n",
671 	    myname, what, (unsigned long)*baddr, (unsigned long)*vaddr,
672 	    *nseg, size);
673 #endif
674 
675 	return 0;
676 out:
677 	switch (level) {
678 	case 3:
679 		bus_dmamap_destroy(tag, *mapp);
680 		/* FALLTHROUGH */
681 	case 2:
682 		bus_dmamem_unmap(tag, *vaddr, size);
683 		/* FALLTHROUGH */
684 	case 1:
685 		bus_dmamem_free(tag, seg, *nseg);
686 		break;
687 	default:
688 		break;
689 	}
690 
691 	return error;
692 }
693 
694 static void
695 ahc_freedmamem(tag, size, map, vaddr, seg, nseg)
696 	bus_dma_tag_t tag;
697 	int size;
698 	bus_dmamap_t map;
699 	caddr_t vaddr;
700 	bus_dma_segment_t *seg;
701 	int nseg;
702 {
703 
704 	bus_dmamap_unload(tag, map);
705 	bus_dmamap_destroy(tag, map);
706 	bus_dmamem_unmap(tag, vaddr, size);
707 	bus_dmamem_free(tag, seg, nseg);
708 }
709 
710 char *
711 ahc_name(struct ahc_softc *ahc)
712 {
713 	return (ahc->sc_dev.dv_xname);
714 }
715 
716 #ifdef AHC_DEBUG
717 static void
718 ahc_print_scb(struct scb *scb)
719 {
720 	struct hardware_scb *hscb = scb->hscb;
721 
722 	printf("scb:%p tag %x control:0x%x tcl:0x%x cmdlen:%d cmdpointer:0x%lx\n",
723 		scb,
724 		hscb->tag,
725 		hscb->control,
726 		hscb->tcl,
727 		hscb->cmdlen,
728 		(unsigned long)le32toh(hscb->cmdpointer));
729 	printf("        datlen:%u data:0x%lx segs:0x%x segp:0x%lx\n",
730 		le32toh(hscb->datalen),
731 		(unsigned long)(le32toh(hscb->data)),
732 		hscb->SG_count,
733 		(unsigned long)(le32toh(hscb->SG_pointer)));
734 	printf("	sg_addr:%lx sg_len:%lu\n",
735 		(unsigned long)(le32toh(scb->sg_list[0].addr)),
736 		(unsigned long)(le32toh(scb->sg_list[0].len)));
737 	printf("	cdb:%x %x %x %x %x %x %x %x %x %x %x %x\n",
738 		hscb->cmdstore[0], hscb->cmdstore[1], hscb->cmdstore[2],
739 		hscb->cmdstore[3], hscb->cmdstore[4], hscb->cmdstore[5],
740 		hscb->cmdstore[6], hscb->cmdstore[7], hscb->cmdstore[8],
741 		hscb->cmdstore[9], hscb->cmdstore[10], hscb->cmdstore[11]);
742 }
743 #endif
744 
745 static const struct {
746         u_int8_t errno;
747 	const char *errmesg;
748 } hard_error[] = {
749 	{ ILLHADDR,	"Illegal Host Access" },
750 	{ ILLSADDR,	"Illegal Sequencer Address referrenced" },
751 	{ ILLOPCODE,	"Illegal Opcode in sequencer program" },
752 	{ SQPARERR,	"Sequencer Parity Error" },
753 	{ DPARERR,	"Data-path Parity Error" },
754 	{ MPARERR,	"Scratch or SCB Memory Parity Error" },
755 	{ PCIERRSTAT,	"PCI Error detected" },
756 	{ CIOPARERR,	"CIOBUS Parity Error" },
757 };
758 static const int num_errors = sizeof(hard_error)/sizeof(hard_error[0]);
759 
760 static const struct {
761         u_int8_t phase;
762         u_int8_t mesg_out; /* Message response to parity errors */
763 	const char *phasemsg;
764 } phase_table[] = {
765 	{ P_DATAOUT,	MSG_NOOP,		"in Data-out phase"	},
766 	{ P_DATAIN,	MSG_INITIATOR_DET_ERR,	"in Data-in phase"	},
767 	{ P_COMMAND,	MSG_NOOP,		"in Command phase"	},
768 	{ P_MESGOUT,	MSG_NOOP,		"in Message-out phase"	},
769 	{ P_STATUS,	MSG_INITIATOR_DET_ERR,	"in Status phase"	},
770 	{ P_MESGIN,	MSG_PARITY_ERROR,	"in Message-in phase"	},
771 	{ P_BUSFREE,	MSG_NOOP,		"while idle"		},
772 	{ 0,		MSG_NOOP,		"in unknown phase"	}
773 };
774 static const int num_phases = (sizeof(phase_table)/sizeof(phase_table[0])) - 1;
775 
776 /*
777  * Valid SCSIRATE values.  (p. 3-17)
778  * Provides a mapping of transfer periods in ns to the proper value to
779  * stick in the scsiscfr reg to use that transfer rate.
780  */
781 #define AHC_SYNCRATE_DT		0
782 #define AHC_SYNCRATE_ULTRA2	1
783 #define AHC_SYNCRATE_ULTRA	3
784 #define AHC_SYNCRATE_FAST	6
785 static const struct ahc_syncrate ahc_syncrates[] = {
786       /* ultra2    fast/ultra  period     rate */
787 	{ 0x42,      0x000,      9,      "80.0" },
788 	{ 0x03,      0x000,     10,      "40.0" },
789 	{ 0x04,      0x000,     11,      "33.0" },
790 	{ 0x05,      0x100,     12,      "20.0" },
791 	{ 0x06,      0x110,     15,      "16.0" },
792 	{ 0x07,      0x120,     18,      "13.4" },
793 	{ 0x08,      0x000,     25,      "10.0" },
794 	{ 0x19,      0x010,     31,      "8.0"  },
795 	{ 0x1a,      0x020,     37,      "6.67" },
796 	{ 0x1b,      0x030,     43,      "5.7"  },
797 	{ 0x1c,      0x040,     50,      "5.0"  },
798 	{ 0x00,      0x050,     56,      "4.4"  },
799 	{ 0x00,      0x060,     62,      "4.0"  },
800 	{ 0x00,      0x070,     68,      "3.6"  },
801 	{ 0x00,      0x000,      0,      NULL   }
802 };
803 
804 /*
805  * Allocate a controller structure for a new device and initialize it.
806  */
807 int
808 ahc_alloc(struct ahc_softc *ahc, bus_space_handle_t sh, bus_space_tag_t st,
809 	  bus_dma_tag_t parent_dmat, ahc_chip chip, ahc_feature features,
810 	  ahc_flag flags)
811 {
812 	struct scb_data *scb_data;
813 
814 	scb_data = malloc(sizeof (struct scb_data), M_DEVBUF, M_NOWAIT|M_ZERO);
815 	if (scb_data == NULL) {
816 		printf("%s: cannot malloc softc!\n", ahc_name(ahc));
817 		return -1;
818 	}
819 	LIST_INIT(&ahc->pending_ccbs);
820 	ahc->tag = st;
821 	ahc->bsh = sh;
822 	ahc->parent_dmat = parent_dmat;
823 	ahc->chip = chip;
824 	ahc->features = features;
825 	ahc->flags = flags;
826 	ahc->scb_data = scb_data;
827 
828 	ahc->unpause = (ahc_inb(ahc, HCNTRL) & IRQMS) | INTEN;
829 	/* The IRQMS bit is only valid on VL and EISA chips */
830 	if ((ahc->chip & AHC_PCI) != 0)
831 		ahc->unpause &= ~IRQMS;
832 	ahc->pause = ahc->unpause | PAUSE;
833 	return (0);
834 }
835 
836 void
837 ahc_free(ahc)
838 	struct ahc_softc *ahc;
839 {
840 	ahcfiniscbdata(ahc);
841 	if (ahc->init_level != 0)
842 		ahc_freedmamem(ahc->parent_dmat, ahc->shared_data_size,
843 		    ahc->shared_data_dmamap, ahc->qoutfifo,
844 		    &ahc->shared_data_seg, ahc->shared_data_nseg);
845 
846 	if (ahc->scb_data != NULL)
847 		free(ahc->scb_data, M_DEVBUF);
848 	if (ahc->bus_data != NULL)
849 		free(ahc->bus_data, M_DEVBUF);
850 	return;
851 }
852 
853 static int
854 ahcinitscbdata(struct ahc_softc *ahc)
855 {
856 	struct scb_data *scb_data;
857 	int i;
858 
859 	scb_data = ahc->scb_data;
860 	SLIST_INIT(&scb_data->free_scbs);
861 	SLIST_INIT(&scb_data->sg_maps);
862 
863 	/* Allocate SCB resources */
864 	scb_data->scbarray =
865 	    (struct scb *)malloc(sizeof(struct scb) * AHC_SCB_MAX,
866 				 M_DEVBUF, M_NOWAIT|M_ZERO);
867 	if (scb_data->scbarray == NULL)
868 		return (ENOMEM);
869 
870 	/* Determine the number of hardware SCBs and initialize them */
871 
872 	scb_data->maxhscbs = ahc_probe_scbs(ahc);
873 	/* SCB 0 heads the free list */
874 	ahc_outb(ahc, FREE_SCBH, 0);
875 	for (i = 0; i < ahc->scb_data->maxhscbs; i++) {
876 		ahc_outb(ahc, SCBPTR, i);
877 
878 		/* Clear the control byte. */
879 		ahc_outb(ahc, SCB_CONTROL, 0);
880 
881 		/* Set the next pointer */
882 		ahc_outb(ahc, SCB_NEXT, i+1);
883 
884 		/* Make the tag number invalid */
885 		ahc_outb(ahc, SCB_TAG, SCB_LIST_NULL);
886 	}
887 
888 	/* Make sure that the last SCB terminates the free list */
889 	ahc_outb(ahc, SCBPTR, i-1);
890 	ahc_outb(ahc, SCB_NEXT, SCB_LIST_NULL);
891 
892 	/* Ensure we clear the 0 SCB's control byte. */
893 	ahc_outb(ahc, SCBPTR, 0);
894 	ahc_outb(ahc, SCB_CONTROL, 0);
895 
896 	scb_data->maxhscbs = i;
897 
898 	if (ahc->scb_data->maxhscbs == 0)
899 		panic("%s: No SCB space found", ahc_name(ahc));
900 
901 	/*
902 	 * Create our DMA tags.  These tags define the kinds of device
903 	 * accessible memory allocations and memory mappings we will
904 	 * need to perform during normal operation.
905 	 *
906 	 * Unless we need to further restrict the allocation, we rely
907 	 * on the restrictions of the parent dmat, hence the common
908 	 * use of MAXADDR and MAXSIZE.
909 	 */
910 
911 	if (ahc_createdmamem(ahc->parent_dmat,
912 	    AHC_SCB_MAX * sizeof(struct hardware_scb), ahc->sc_dmaflags,
913 	    &scb_data->hscb_dmamap,
914 	    (caddr_t *)&scb_data->hscbs, &scb_data->hscb_busaddr,
915 	    &scb_data->hscb_seg, &scb_data->hscb_nseg, ahc_name(ahc),
916 	    "hardware SCB structures") < 0)
917 		goto error_exit;
918 
919 	scb_data->init_level++;
920 
921 	if (ahc_createdmamem(ahc->parent_dmat,
922 	    AHC_SCB_MAX * sizeof(struct scsipi_sense_data), ahc->sc_dmaflags,
923 	    &scb_data->sense_dmamap, (caddr_t *)&scb_data->sense,
924 	    &scb_data->sense_busaddr, &scb_data->sense_seg,
925 	    &scb_data->sense_nseg, ahc_name(ahc), "sense buffers") < 0)
926 		goto error_exit;
927 
928 	scb_data->init_level++;
929 
930 	/* Perform initial CCB allocation */
931 	memset(scb_data->hscbs, 0, AHC_SCB_MAX * sizeof(struct hardware_scb));
932 	ahcallocscbs(ahc);
933 
934 	if (scb_data->numscbs == 0) {
935 		printf("%s: ahc_init_scb_data - "
936 		       "Unable to allocate initial scbs\n",
937 		       ahc_name(ahc));
938 		goto error_exit;
939 	}
940 
941 	scb_data->init_level++;
942 
943 	/*
944          * Note that we were successfull
945          */
946         return 0;
947 
948 error_exit:
949 
950 	return ENOMEM;
951 }
952 
953 static void
954 ahcfiniscbdata(struct ahc_softc *ahc)
955 {
956 	struct scb_data *scb_data;
957 
958 	scb_data = ahc->scb_data;
959 
960 	switch (scb_data->init_level) {
961 	default:
962 	case 3:
963 	{
964 		struct sg_map_node *sg_map;
965 
966 		while ((sg_map = SLIST_FIRST(&scb_data->sg_maps))!= NULL) {
967 			SLIST_REMOVE_HEAD(&scb_data->sg_maps, links);
968 			ahc_freedmamem(ahc->parent_dmat, PAGE_SIZE,
969 			    sg_map->sg_dmamap, (caddr_t)sg_map->sg_vaddr,
970 			    &sg_map->sg_dmasegs, sg_map->sg_nseg);
971 			free(sg_map, M_DEVBUF);
972 		}
973 	}
974 	/*FALLTHROUGH*/
975 	case 2:
976 		ahc_freedmamem(ahc->parent_dmat,
977 		    AHC_SCB_MAX * sizeof(struct scsipi_sense_data),
978 		    scb_data->sense_dmamap, (caddr_t)scb_data->sense,
979 		    &scb_data->sense_seg, scb_data->sense_nseg);
980 	/*FALLTHROUGH*/
981 	case 1:
982 		ahc_freedmamem(ahc->parent_dmat,
983 		    AHC_SCB_MAX * sizeof(struct hardware_scb),
984 		    scb_data->hscb_dmamap, (caddr_t)scb_data->hscbs,
985 		    &scb_data->hscb_seg, scb_data->hscb_nseg);
986 	/*FALLTHROUGH*/
987 	}
988 	if (scb_data->scbarray != NULL)
989 		free(scb_data->scbarray, M_DEVBUF);
990 }
991 
992 int
993 ahc_reset(struct ahc_softc *ahc)
994 {
995 	u_int	sblkctl;
996 	int	wait;
997 
998 #ifdef AHC_DUMP_SEQ
999 	if (ahc->init_level == 0)
1000 		ahc_dumpseq(ahc);
1001 #endif
1002 	ahc_outb(ahc, HCNTRL, CHIPRST | ahc->pause);
1003 	/*
1004 	 * Ensure that the reset has finished
1005 	 */
1006 	wait = 1000;
1007 	do {
1008 		DELAY(1000);
1009 	} while (--wait && !(ahc_inb(ahc, HCNTRL) & CHIPRSTACK));
1010 
1011 	if (wait == 0) {
1012 		printf("%s: WARNING - Failed chip reset!  "
1013 		       "Trying to initialize anyway.\n", ahc_name(ahc));
1014 	}
1015 	ahc_outb(ahc, HCNTRL, ahc->pause);
1016 
1017 	/* Determine channel configuration */
1018 	sblkctl = ahc_inb(ahc, SBLKCTL) & (SELBUSB|SELWIDE);
1019 	/* No Twin Channel PCI cards */
1020 	if ((ahc->chip & AHC_PCI) != 0)
1021 		sblkctl &= ~SELBUSB;
1022 	switch (sblkctl) {
1023 	case 0:
1024 		/* Single Narrow Channel */
1025 		break;
1026 	case 2:
1027 		/* Wide Channel */
1028 		ahc->features |= AHC_WIDE;
1029 		break;
1030 	case 8:
1031 		/* Twin Channel */
1032 		ahc->features |= AHC_TWIN;
1033 		break;
1034 	default:
1035 		printf(" Unsupported adapter type.  Ignoring\n");
1036 		return(-1);
1037 	}
1038 
1039 	return (0);
1040 }
1041 
1042 /*
1043  * Called when we have an active connection to a target on the bus,
1044  * this function finds the nearest syncrate to the input period limited
1045  * by the capabilities of the bus connectivity of the target.
1046  */
1047 static const struct ahc_syncrate *
1048 ahc_devlimited_syncrate(struct ahc_softc *ahc, u_int *period) {
1049 	u_int	maxsync;
1050 
1051 	if ((ahc->features & AHC_ULTRA2) != 0) {
1052 		if ((ahc_inb(ahc, SBLKCTL) & ENAB40) != 0
1053 		 && (ahc_inb(ahc, SSTAT2) & EXP_ACTIVE) == 0) {
1054 			maxsync = AHC_SYNCRATE_ULTRA2;
1055 		} else {
1056 			maxsync = AHC_SYNCRATE_ULTRA;
1057 		}
1058 	} else if ((ahc->features & AHC_ULTRA) != 0) {
1059 		maxsync = AHC_SYNCRATE_ULTRA;
1060 	} else {
1061 		maxsync = AHC_SYNCRATE_FAST;
1062 	}
1063 	return (ahc_find_syncrate(ahc, period, maxsync));
1064 }
1065 
1066 /*
1067  * Look up the valid period to SCSIRATE conversion in our table.
1068  * Return the period and offset that should be sent to the target
1069  * if this was the beginning of an SDTR.
1070  */
1071 static const struct ahc_syncrate *
1072 ahc_find_syncrate(struct ahc_softc *ahc, u_int *period, u_int maxsync)
1073 {
1074 	const struct ahc_syncrate *syncrate;
1075 
1076 	syncrate = &ahc_syncrates[maxsync];
1077 	while ((syncrate->rate != NULL)
1078 	    && ((ahc->features & AHC_ULTRA2) == 0
1079 	     || (syncrate->sxfr_u2 != 0))) {
1080 
1081 		if (*period <= syncrate->period) {
1082 			/*
1083 			 * When responding to a target that requests
1084 			 * sync, the requested rate may fall between
1085 			 * two rates that we can output, but still be
1086 			 * a rate that we can receive.  Because of this,
1087 			 * we want to respond to the target with
1088 			 * the same rate that it sent to us even
1089 			 * if the period we use to send data to it
1090 			 * is lower.  Only lower the response period
1091 			 * if we must.
1092 			 */
1093 			if (syncrate == &ahc_syncrates[maxsync])
1094 				*period = syncrate->period;
1095 			break;
1096 		}
1097 		syncrate++;
1098 	}
1099 
1100 	if ((*period == 0)
1101 	 || (syncrate->rate == NULL)
1102 	 || ((ahc->features & AHC_ULTRA2) != 0
1103 	  && (syncrate->sxfr_u2 == 0))) {
1104 		/* Use asynchronous transfers. */
1105 		*period = 0;
1106 		syncrate = NULL;
1107 	}
1108 	return (syncrate);
1109 }
1110 
1111 static u_int
1112 ahc_find_period(struct ahc_softc *ahc, u_int scsirate, u_int maxsync)
1113 {
1114 	const struct ahc_syncrate *syncrate;
1115 
1116 	if ((ahc->features & AHC_ULTRA2) != 0)
1117 		scsirate &= SXFR_ULTRA2;
1118 	else
1119 		scsirate &= SXFR;
1120 
1121 	syncrate = &ahc_syncrates[maxsync];
1122 	while (syncrate->rate != NULL) {
1123 
1124 		if ((ahc->features & AHC_ULTRA2) != 0) {
1125 			if (syncrate->sxfr_u2 == 0)
1126 				break;
1127 			else if (scsirate == (syncrate->sxfr_u2 & SXFR_ULTRA2))
1128 				return (syncrate->period);
1129 		} else if (scsirate == (syncrate->sxfr & SXFR)) {
1130 				return (syncrate->period);
1131 		}
1132 		syncrate++;
1133 	}
1134 	return (0); /* async */
1135 }
1136 
1137 static void
1138 ahc_validate_offset(struct ahc_softc *ahc, const struct ahc_syncrate *syncrate,
1139 		    u_int *offset, int wide)
1140 {
1141 	u_int maxoffset;
1142 
1143 	/* Limit offset to what we can do */
1144 	if (syncrate == NULL) {
1145 		maxoffset = 0;
1146 	} else if ((ahc->features & AHC_ULTRA2) != 0) {
1147 		maxoffset = MAX_OFFSET_ULTRA2;
1148 	} else {
1149 		if (wide)
1150 			maxoffset = MAX_OFFSET_16BIT;
1151 		else
1152 			maxoffset = MAX_OFFSET_8BIT;
1153 	}
1154 	*offset = MIN(*offset, maxoffset);
1155 }
1156 
1157 static void
1158 ahc_update_target_msg_request(struct ahc_softc *ahc,
1159 			      struct ahc_devinfo *devinfo,
1160 			      struct ahc_initiator_tinfo *tinfo,
1161 			      int force, int paused)
1162 {
1163 	u_int targ_msg_req_orig;
1164 
1165 	targ_msg_req_orig = ahc->targ_msg_req;
1166 	if (tinfo->current.period != tinfo->goal.period
1167 	 || tinfo->current.width != tinfo->goal.width
1168 	 || tinfo->current.offset != tinfo->goal.offset
1169 	 || (force
1170 	  && (tinfo->goal.period != 0
1171 	   || tinfo->goal.width != MSG_EXT_WDTR_BUS_8_BIT))) {
1172 		ahc->targ_msg_req |= devinfo->target_mask;
1173 	} else {
1174 		ahc->targ_msg_req &= ~devinfo->target_mask;
1175 	}
1176 
1177 	if (ahc->targ_msg_req != targ_msg_req_orig) {
1178 		/* Update the message request bit for this target */
1179 		if ((ahc->features & AHC_HS_MAILBOX) != 0) {
1180 			if (paused) {
1181 				ahc_outb(ahc, TARGET_MSG_REQUEST,
1182 					 ahc->targ_msg_req & 0xFF);
1183 				ahc_outb(ahc, TARGET_MSG_REQUEST + 1,
1184 					 (ahc->targ_msg_req >> 8) & 0xFF);
1185 			} else {
1186 				ahc_outb(ahc, HS_MAILBOX,
1187 					 0x01 << HOST_MAILBOX_SHIFT);
1188 			}
1189 		} else {
1190 			if (!paused)
1191 				pause_sequencer(ahc);
1192 
1193 			ahc_outb(ahc, TARGET_MSG_REQUEST,
1194 				 ahc->targ_msg_req & 0xFF);
1195 			ahc_outb(ahc, TARGET_MSG_REQUEST + 1,
1196 				 (ahc->targ_msg_req >> 8) & 0xFF);
1197 
1198 			if (!paused)
1199 				unpause_sequencer(ahc);
1200 		}
1201 	}
1202 }
1203 
1204 static void
1205 ahc_set_syncrate(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
1206 		 const struct ahc_syncrate *syncrate,
1207 		 u_int period, u_int offset, u_int type, int paused, int done)
1208 {
1209 	struct	ahc_initiator_tinfo *tinfo;
1210 	struct	tmode_tstate *tstate;
1211 	u_int	old_period;
1212 	u_int	old_offset;
1213 	int	active = (type & AHC_TRANS_ACTIVE) == AHC_TRANS_ACTIVE;
1214 
1215 	if (syncrate == NULL) {
1216 		period = 0;
1217 		offset = 0;
1218 	}
1219 
1220 	tinfo = ahc_fetch_transinfo(ahc, devinfo->channel, devinfo->our_scsiid,
1221 				    devinfo->target, &tstate);
1222 	old_period = tinfo->current.period;
1223 	old_offset = tinfo->current.offset;
1224 
1225 	if ((type & AHC_TRANS_CUR) != 0
1226 	 && (old_period != period || old_offset != offset)) {
1227 		u_int	scsirate;
1228 
1229 		scsirate = tinfo->scsirate;
1230 		if ((ahc->features & AHC_ULTRA2) != 0) {
1231 
1232 			/* XXX */
1233 			/* Force single edge until DT is fully implemented */
1234 			scsirate &= ~(SXFR_ULTRA2|SINGLE_EDGE|ENABLE_CRC);
1235 			if (syncrate != NULL)
1236 				scsirate |= syncrate->sxfr_u2|SINGLE_EDGE;
1237 
1238 			if (active)
1239 				ahc_outb(ahc, SCSIOFFSET, offset);
1240 		} else {
1241 
1242 			scsirate &= ~(SXFR|SOFS);
1243 			/*
1244 			 * Ensure Ultra mode is set properly for
1245 			 * this target.
1246 			 */
1247 			tstate->ultraenb &= ~devinfo->target_mask;
1248 			if (syncrate != NULL) {
1249 				if (syncrate->sxfr & ULTRA_SXFR) {
1250 					tstate->ultraenb |=
1251 						devinfo->target_mask;
1252 				}
1253 				scsirate |= syncrate->sxfr & SXFR;
1254 				scsirate |= offset & SOFS;
1255 			}
1256 			if (active) {
1257 				u_int sxfrctl0;
1258 
1259 				sxfrctl0 = ahc_inb(ahc, SXFRCTL0);
1260 				sxfrctl0 &= ~FAST20;
1261 				if (tstate->ultraenb & devinfo->target_mask)
1262 					sxfrctl0 |= FAST20;
1263 				ahc_outb(ahc, SXFRCTL0, sxfrctl0);
1264 			}
1265 		}
1266 		if (active)
1267 			ahc_outb(ahc, SCSIRATE, scsirate);
1268 
1269 		tinfo->scsirate = scsirate;
1270 		tinfo->current.period = period;
1271 		tinfo->current.offset = offset;
1272 
1273 		/* Update the syncrates in any pending scbs */
1274 		ahc_update_pending_syncrates(ahc);
1275 	}
1276 
1277 	if ((type & AHC_TRANS_GOAL) != 0) {
1278 		tinfo->goal.period = period;
1279 		tinfo->goal.offset = offset;
1280 	}
1281 
1282 	if ((type & AHC_TRANS_USER) != 0) {
1283 		tinfo->user.period = period;
1284 		tinfo->user.offset = offset;
1285 	}
1286 
1287 	ahc_update_target_msg_request(ahc, devinfo, tinfo,
1288 				      /*force*/FALSE,
1289 				      paused);
1290 }
1291 
1292 static void
1293 ahc_set_width(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
1294 	      u_int width, u_int type, int paused, int done)
1295 {
1296 	struct ahc_initiator_tinfo *tinfo;
1297 	struct tmode_tstate *tstate;
1298 	u_int  oldwidth;
1299 	int    active = (type & AHC_TRANS_ACTIVE) == AHC_TRANS_ACTIVE;
1300 
1301 	tinfo = ahc_fetch_transinfo(ahc, devinfo->channel, devinfo->our_scsiid,
1302 				    devinfo->target, &tstate);
1303 	oldwidth = tinfo->current.width;
1304 
1305 	if ((type & AHC_TRANS_CUR) != 0 && oldwidth != width) {
1306 		u_int	scsirate;
1307 
1308 		scsirate =  tinfo->scsirate;
1309 		scsirate &= ~WIDEXFER;
1310 		if (width == MSG_EXT_WDTR_BUS_16_BIT)
1311 			scsirate |= WIDEXFER;
1312 
1313 		tinfo->scsirate = scsirate;
1314 
1315 		if (active)
1316 			ahc_outb(ahc, SCSIRATE, scsirate);
1317 
1318 		tinfo->current.width = width;
1319 	}
1320 
1321 	if ((type & AHC_TRANS_GOAL) != 0)
1322 		tinfo->goal.width = width;
1323 	if ((type & AHC_TRANS_USER) != 0)
1324 		tinfo->user.width = width;
1325 
1326 	ahc_update_target_msg_request(ahc, devinfo, tinfo,
1327 				      /*force*/FALSE, paused);
1328 }
1329 
1330 static void
1331 ahc_set_tags(struct ahc_softc *ahc, struct ahc_devinfo *devinfo, int enable)
1332 {
1333 	struct ahc_initiator_tinfo *tinfo;
1334 	struct tmode_tstate *tstate;
1335 
1336 	tinfo = ahc_fetch_transinfo(ahc, devinfo->channel, devinfo->our_scsiid,
1337 				    devinfo->target, &tstate);
1338 
1339 	if (enable) {
1340 		tstate->tagenable |= devinfo->target_mask;
1341 	} else {
1342 		tstate->tagenable &= ~devinfo->target_mask;
1343 		tstate->tagdisable |= devinfo->target_mask;
1344 	}
1345 }
1346 
1347 static void
1348 ahc_update_xfer_mode(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
1349 {
1350 	struct scsipi_xfer_mode xm;
1351 	struct ahc_initiator_tinfo *tinfo;
1352 	struct tmode_tstate *tstate;
1353 
1354 	if (ahc->inited_targets[devinfo->target] != 2)
1355 		return;
1356 
1357 	tinfo = ahc_fetch_transinfo(ahc, devinfo->channel, devinfo->our_scsiid,
1358 				    devinfo->target, &tstate);
1359 
1360 	xm.xm_target = devinfo->target;
1361 	xm.xm_mode = 0;
1362 	xm.xm_period = tinfo->current.period;
1363 	xm.xm_offset = tinfo->current.offset;
1364 	if (tinfo->current.width == 1)
1365 		xm.xm_mode |= PERIPH_CAP_WIDE16;
1366 	if (tinfo->current.period)
1367 		xm.xm_mode |= PERIPH_CAP_SYNC;
1368 	if (tstate->tagenable & devinfo->target_mask)
1369 		xm.xm_mode |= PERIPH_CAP_TQING;
1370 	scsipi_async_event(
1371 	    devinfo->channel == 'B' ? &ahc->sc_channel_b : &ahc->sc_channel,
1372 	    ASYNC_EVENT_XFER_MODE, &xm);
1373 }
1374 
1375 /*
1376  * Attach all the sub-devices we can find
1377  */
1378 int
1379 ahc_attach(struct ahc_softc *ahc)
1380 {
1381 	ahc->sc_adapter.adapt_dev = &ahc->sc_dev;
1382 	ahc->sc_adapter.adapt_nchannels = (ahc->features & AHC_TWIN) ? 2 : 1;
1383 	if (ahc->flags & AHC_PAGESCBS) {
1384 		ahc->sc_adapter.adapt_openings = AHC_SCB_MAX;
1385 		ahc->sc_adapter.adapt_max_periph = 16;
1386 	} else {
1387 		ahc->sc_adapter.adapt_openings =  ahc->scb_data->maxhscbs;
1388 		if (ahc->scb_data->maxhscbs >= 16)
1389 			ahc->sc_adapter.adapt_max_periph = 16;
1390 		else
1391 			ahc->sc_adapter.adapt_max_periph = 4;
1392 	}
1393 	ahc->sc_adapter.adapt_ioctl = ahc_ioctl;
1394 	ahc->sc_adapter.adapt_minphys = ahcminphys;
1395 	ahc->sc_adapter.adapt_request = ahc_action;
1396 
1397 	ahc->sc_channel.chan_adapter = &ahc->sc_adapter;
1398 	ahc->sc_channel.chan_bustype = &scsi_bustype;
1399 	ahc->sc_channel.chan_channel = 0;
1400 	ahc->sc_channel.chan_ntargets = (ahc->features & AHC_WIDE) ? 16 : 8;
1401 	ahc->sc_channel.chan_nluns = 8;
1402 	ahc->sc_channel.chan_id = ahc->our_id;
1403 
1404 	if (ahc->features & AHC_TWIN) {
1405 		ahc->sc_channel_b = ahc->sc_channel;
1406 		ahc->sc_channel_b.chan_id = ahc->our_id_b;
1407 		ahc->sc_channel_b.chan_channel = 1;
1408 	}
1409 
1410 	if ((ahc->flags & AHC_CHANNEL_B_PRIMARY) == 0) {
1411 		ahc->child = config_found((void *)ahc, &ahc->sc_channel, scsiprint);
1412 		if (ahc->features & AHC_TWIN)
1413 			ahc->child = config_found((void *)ahc, &ahc->sc_channel_b,
1414 			    scsiprint);
1415 	} else {
1416 		ahc->child = config_found((void *)ahc, &ahc->sc_channel_b, scsiprint);
1417 		ahc->child = config_found((void *)ahc, &ahc->sc_channel, scsiprint);
1418 	}
1419 	return 1;
1420 }
1421 
1422 int
1423 ahc_detach(struct ahc_softc *ahc, int flags)
1424 {
1425 	int rv = 0;
1426 
1427 	if (ahc->child != NULL)
1428 		rv = config_detach(ahc->child, flags);
1429 
1430 	ahc_free(ahc);
1431 
1432         return (rv);
1433 }
1434 
1435 int
1436 ahc_activate(struct device *self, enum devact act)
1437 {
1438 	struct ahc_softc *ahc = (void *) self;
1439 	int s, rv = 0;
1440 
1441 	s = splhigh();
1442 	switch (act) {
1443 	case DVACT_ACTIVATE:
1444 		rv = EOPNOTSUPP;
1445 		break;
1446 
1447 	case DVACT_DEACTIVATE:
1448 		if (ahc->child != NULL)
1449 			rv = config_deactivate(ahc->child);
1450 		break;
1451 	}
1452 	splx(s);
1453 
1454 	return (rv);
1455 }
1456 
1457 static void
1458 ahc_fetch_devinfo(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
1459 {
1460 	u_int	saved_tcl;
1461 	role_t	role;
1462 	int	our_id;
1463 
1464 	if (ahc_inb(ahc, SSTAT0) & TARGET)
1465 		role = ROLE_TARGET;
1466 	else
1467 		role = ROLE_INITIATOR;
1468 
1469 	if (role == ROLE_TARGET
1470 	 && (ahc->features & AHC_MULTI_TID) != 0
1471 	 && (ahc_inb(ahc, SEQ_FLAGS) & CMDPHASE_PENDING) != 0) {
1472 		/* We were selected, so pull our id from TARGIDIN */
1473 		our_id = ahc_inb(ahc, TARGIDIN) & OID;
1474 	} else if ((ahc->features & AHC_ULTRA2) != 0)
1475 		our_id = ahc_inb(ahc, SCSIID_ULTRA2) & OID;
1476 	else
1477 		our_id = ahc_inb(ahc, SCSIID) & OID;
1478 
1479 	saved_tcl = ahc_inb(ahc, SAVED_TCL);
1480 	ahc_compile_devinfo(devinfo, our_id, TCL_TARGET(saved_tcl),
1481 			    TCL_LUN(saved_tcl), TCL_CHANNEL(ahc, saved_tcl),
1482 			    role);
1483 }
1484 
1485 static void
1486 ahc_compile_devinfo(struct ahc_devinfo *devinfo, u_int our_id, u_int target,
1487 		    u_int lun, char channel, role_t role)
1488 {
1489 	devinfo->our_scsiid = our_id;
1490 	devinfo->target = target;
1491 	devinfo->lun = lun;
1492 	devinfo->target_offset = target;
1493 	devinfo->channel = channel;
1494 	devinfo->role = role;
1495 	if (channel == 'B')
1496 		devinfo->target_offset += 8;
1497 	devinfo->target_mask = (0x01 << devinfo->target_offset);
1498 }
1499 
1500 /*
1501  * Catch an interrupt from the adapter
1502  */
1503 int
1504 ahc_intr(void *arg)
1505 {
1506 	struct	ahc_softc *ahc;
1507 	u_int	intstat;
1508 
1509 	ahc = (struct ahc_softc *)arg;
1510 
1511 	intstat = ahc_inb(ahc, INTSTAT);
1512 
1513 	/*
1514 	 * Any interrupts to process?
1515 	 */
1516 	if ((intstat & INT_PEND) == 0) {
1517 		if (ahc->bus_intr && ahc->bus_intr(ahc)) {
1518 #ifdef AHC_DEBUG
1519 			printf("%s: bus intr: CCHADDR %x HADDR %x SEQADDR %x\n",
1520 			    ahc_name(ahc),
1521 			    ahc_inb(ahc, CCHADDR) |
1522 			    (ahc_inb(ahc, CCHADDR+1) << 8)
1523 			    | (ahc_inb(ahc, CCHADDR+2) << 16)
1524 			    | (ahc_inb(ahc, CCHADDR+3) << 24),
1525 			    ahc_inb(ahc, HADDR) | (ahc_inb(ahc, HADDR+1) << 8)
1526 			    | (ahc_inb(ahc, HADDR+2) << 16)
1527 			    | (ahc_inb(ahc, HADDR+3) << 24),
1528 			    ahc_inb(ahc, SEQADDR0) |
1529 			    (ahc_inb(ahc, SEQADDR1) << 8));
1530 #endif
1531 			return 1;
1532 		}
1533 		return 0;
1534 	}
1535 
1536 #ifdef AHC_DEBUG
1537 	if (ahc_debug & AHC_SHOWINTR) {
1538 		printf("%s: intstat %x\n", ahc_name(ahc), intstat);
1539 	}
1540 #endif
1541 
1542 	if (intstat & CMDCMPLT) {
1543 		ahc_outb(ahc, CLRINT, CLRCMDINT);
1544 		ahc_run_qoutfifo(ahc);
1545 	}
1546 	if (intstat & BRKADRINT) {
1547 		/*
1548 		 * We upset the sequencer :-(
1549 		 * Lookup the error message
1550 		 */
1551 		int i, error, num_errors;
1552 
1553 		error = ahc_inb(ahc, ERROR);
1554 		num_errors =  sizeof(hard_error)/sizeof(hard_error[0]);
1555 		for (i = 0; error != 1 && i < num_errors; i++)
1556 			error >>= 1;
1557 		panic("%s: brkadrint, %s at seqaddr = 0x%x\n",
1558 		      ahc_name(ahc), hard_error[i].errmesg,
1559 		      ahc_inb(ahc, SEQADDR0) |
1560 		      (ahc_inb(ahc, SEQADDR1) << 8));
1561 
1562 		/* Tell everyone that this HBA is no longer available */
1563 		ahc_abort_scbs(ahc, AHC_TARGET_WILDCARD, ALL_CHANNELS,
1564 			       AHC_LUN_WILDCARD, SCB_LIST_NULL, ROLE_UNKNOWN,
1565 			       XS_DRIVER_STUFFUP);
1566 	}
1567 	if (intstat & SEQINT)
1568 		ahc_handle_seqint(ahc, intstat);
1569 
1570 	if (intstat & SCSIINT)
1571 		ahc_handle_scsiint(ahc, intstat);
1572 
1573 	return 1;
1574 }
1575 
1576 static struct tmode_tstate *
1577 ahc_alloc_tstate(struct ahc_softc *ahc, u_int scsi_id, char channel)
1578 {
1579 	struct tmode_tstate *master_tstate;
1580 	struct tmode_tstate *tstate;
1581 	int i, s;
1582 
1583 	master_tstate = ahc->enabled_targets[ahc->our_id];
1584 	if (channel == 'B') {
1585 		scsi_id += 8;
1586 		master_tstate = ahc->enabled_targets[ahc->our_id_b + 8];
1587 	}
1588 	if (ahc->enabled_targets[scsi_id] != NULL
1589 	 && ahc->enabled_targets[scsi_id] != master_tstate)
1590 		panic("%s: ahc_alloc_tstate - Target already allocated",
1591 		      ahc_name(ahc));
1592 	tstate = malloc(sizeof(*tstate), M_DEVBUF, M_NOWAIT);
1593 	if (tstate == NULL)
1594 		return (NULL);
1595 
1596 	/*
1597 	 * If we have allocated a master tstate, copy user settings from
1598 	 * the master tstate (taken from SRAM or the EEPROM) for this
1599 	 * channel, but reset our current and goal settings to async/narrow
1600 	 * until an initiator talks to us.
1601 	 */
1602 	if (master_tstate != NULL) {
1603 		memcpy(tstate, master_tstate, sizeof(*tstate));
1604 		tstate->ultraenb = 0;
1605 		for (i = 0; i < 16; i++) {
1606 			memset(&tstate->transinfo[i].current, 0,
1607 			      sizeof(tstate->transinfo[i].current));
1608 			memset(&tstate->transinfo[i].goal, 0,
1609 			      sizeof(tstate->transinfo[i].goal));
1610 		}
1611 	} else
1612 		memset(tstate, 0, sizeof(*tstate));
1613 	s = splbio();
1614 	ahc->enabled_targets[scsi_id] = tstate;
1615 	splx(s);
1616 	return (tstate);
1617 }
1618 
1619 #if UNUSED
1620 static void
1621 ahc_free_tstate(struct ahc_softc *ahc, u_int scsi_id, char channel, int force)
1622 {
1623 	struct tmode_tstate *tstate;
1624 
1625 	/* Don't clean up the entry for our initiator role */
1626 	if ((ahc->flags & AHC_INITIATORMODE) != 0
1627 	 && ((channel == 'B' && scsi_id == ahc->our_id_b)
1628 	  || (channel == 'A' && scsi_id == ahc->our_id))
1629 	 && force == FALSE)
1630 		return;
1631 
1632 	if (channel == 'B')
1633 		scsi_id += 8;
1634 	tstate = ahc->enabled_targets[scsi_id];
1635 	if (tstate != NULL)
1636 		free(tstate, M_DEVBUF);
1637 	ahc->enabled_targets[scsi_id] = NULL;
1638 }
1639 #endif
1640 
1641 static void
1642 ahc_handle_seqint(struct ahc_softc *ahc, u_int intstat)
1643 {
1644 	struct scb *scb;
1645 	struct ahc_devinfo devinfo;
1646 
1647 	ahc_fetch_devinfo(ahc, &devinfo);
1648 
1649 	/*
1650 	 * Clear the upper byte that holds SEQINT status
1651 	 * codes and clear the SEQINT bit. We will unpause
1652 	 * the sequencer, if appropriate, after servicing
1653 	 * the request.
1654 	 */
1655 	ahc_outb(ahc, CLRINT, CLRSEQINT);
1656 	switch (intstat & SEQINT_MASK) {
1657 	case NO_MATCH:
1658 	{
1659 		/* Ensure we don't leave the selection hardware on */
1660 		ahc_outb(ahc, SCSISEQ,
1661 			 ahc_inb(ahc, SCSISEQ) & (ENSELI|ENRSELI|ENAUTOATNP));
1662 
1663 		printf("%s:%c:%d: no active SCB for reconnecting "
1664 		       "target - issuing BUS DEVICE RESET\n",
1665 		       ahc_name(ahc), devinfo.channel, devinfo.target);
1666 		printf("SAVED_TCL == 0x%x, ARG_1 == 0x%x, SEQ_FLAGS == 0x%x\n",
1667 		       ahc_inb(ahc, SAVED_TCL), ahc_inb(ahc, ARG_1),
1668 		       ahc_inb(ahc, SEQ_FLAGS));
1669 		ahc->msgout_buf[0] = MSG_BUS_DEV_RESET;
1670 		ahc->msgout_len = 1;
1671 		ahc->msgout_index = 0;
1672 		ahc->msg_type = MSG_TYPE_INITIATOR_MSGOUT;
1673 		ahc_outb(ahc, MSG_OUT, HOST_MSG);
1674 		ahc_outb(ahc, SCSISIGO, ahc_inb(ahc, LASTPHASE) | ATNO);
1675 		break;
1676 	}
1677 	case UPDATE_TMSG_REQ:
1678 		ahc_outb(ahc, TARGET_MSG_REQUEST, ahc->targ_msg_req & 0xFF);
1679 		ahc_outb(ahc, TARGET_MSG_REQUEST + 1,
1680 			 (ahc->targ_msg_req >> 8) & 0xFF);
1681 		ahc_outb(ahc, HS_MAILBOX, 0);
1682 		break;
1683 	case SEND_REJECT:
1684 	{
1685 		u_int rejbyte = ahc_inb(ahc, ACCUM);
1686 		printf("%s:%c:%d: Warning - unknown message received from "
1687 		       "target (0x%x).  Rejecting\n",
1688 		       ahc_name(ahc), devinfo.channel, devinfo.target, rejbyte);
1689 		break;
1690 	}
1691 	case NO_IDENT:
1692 	{
1693 		/*
1694 		 * The reconnecting target either did not send an identify
1695 		 * message, or did, but we didn't find and SCB to match and
1696 		 * before it could respond to our ATN/abort, it hit a dataphase.
1697 		 * The only safe thing to do is to blow it away with a bus
1698 		 * reset.
1699 		 */
1700 		int found;
1701 
1702 		printf("%s:%c:%d: Target did not send an IDENTIFY message. "
1703 		       "LASTPHASE = 0x%x, SAVED_TCL == 0x%x\n",
1704 		       ahc_name(ahc), devinfo.channel, devinfo.target,
1705 		       ahc_inb(ahc, LASTPHASE), ahc_inb(ahc, SAVED_TCL));
1706 		found = ahc_reset_channel(ahc, devinfo.channel,
1707 					  /*initiate reset*/TRUE);
1708 		printf("%s: Issued Channel %c Bus Reset. "
1709 		       "%d SCBs aborted\n", ahc_name(ahc), devinfo.channel,
1710 		       found);
1711 		return;
1712 	}
1713 	case BAD_PHASE:
1714 	{
1715 		u_int lastphase;
1716 
1717 		lastphase = ahc_inb(ahc, LASTPHASE);
1718 		if (lastphase == P_BUSFREE) {
1719 			printf("%s:%c:%d: Missed busfree.  Curphase = 0x%x\n",
1720 			       ahc_name(ahc), devinfo.channel, devinfo.target,
1721 			       ahc_inb(ahc, SCSISIGI));
1722 			restart_sequencer(ahc);
1723 			return;
1724 		} else {
1725 			printf("%s:%c:%d: unknown scsi bus phase %x.  "
1726 			       "Attempting to continue\n",
1727 			       ahc_name(ahc), devinfo.channel, devinfo.target,
1728 			       ahc_inb(ahc, SCSISIGI));
1729 		}
1730 		break;
1731 	}
1732 	case BAD_STATUS:
1733 	{
1734 		u_int  scb_index;
1735 		struct hardware_scb *hscb;
1736 		struct scsipi_xfer *xs;
1737 		/*
1738 		 * The sequencer will notify us when a command
1739 		 * has an error that would be of interest to
1740 		 * the kernel.  This allows us to leave the sequencer
1741 		 * running in the common case of command completes
1742 		 * without error.  The sequencer will already have
1743 		 * dma'd the SCB back up to us, so we can reference
1744 		 * the in kernel copy directly.
1745 		 */
1746 		scb_index = ahc_inb(ahc, SCB_TAG);
1747 		scb = &ahc->scb_data->scbarray[scb_index];
1748 
1749 		/* ahc_print_scb(scb); */
1750 
1751 		/*
1752 		 * Set the default return value to 0 (don't
1753 		 * send sense).  The sense code will change
1754 		 * this if needed.
1755 		 */
1756 		ahc_outb(ahc, RETURN_1, 0);
1757 		if (!(scb_index < ahc->scb_data->numscbs
1758 		   && (scb->flags & SCB_ACTIVE) != 0)) {
1759 			printf("%s:%c:%d: ahc_intr - referenced scb "
1760 			       "not valid during seqint 0x%x scb(%d)\n",
1761 			       ahc_name(ahc), devinfo.channel,
1762 			       devinfo.target, intstat, scb_index);
1763 			goto unpause;
1764 		}
1765 
1766 		hscb = scb->hscb;
1767 		xs = scb->xs;
1768 
1769 		/* Don't want to clobber the original sense code */
1770 		if ((scb->flags & SCB_SENSE) != 0) {
1771 			/*
1772 			 * Clear the SCB_SENSE Flag and have
1773 			 * the sequencer do a normal command
1774 			 * complete.
1775 			 */
1776 			scb->flags &= ~SCB_SENSE;
1777 			ahcsetccbstatus(xs, XS_DRIVER_STUFFUP);
1778 			break;
1779 		}
1780 		/* Freeze the queue unit the client sees the error. */
1781 		ahc_freeze_devq(ahc, xs->xs_periph);
1782 		ahc_freeze_ccb(scb);
1783 		xs->status = hscb->status;
1784 		switch (hscb->status) {
1785 		case SCSI_STATUS_OK:
1786 			printf("%s: Interrupted for status of 0???\n",
1787 			       ahc_name(ahc));
1788 			break;
1789 		case SCSI_STATUS_CMD_TERMINATED:
1790 		case SCSI_STATUS_CHECK_COND:
1791 #if defined(AHC_DEBUG)
1792 			if (ahc_debug & AHC_SHOWSENSE) {
1793 				scsipi_printaddr(xs->xs_periph);
1794 				printf("Check Status, resid %d datalen %d\n",
1795 				    xs->resid, xs->datalen);
1796 			}
1797 #endif
1798 
1799 			if (xs->error == XS_NOERROR &&
1800 			    !(scb->flags & SCB_SENSE)) {
1801 				struct ahc_dma_seg *sg;
1802 				struct scsipi_sense *sc;
1803 				struct ahc_initiator_tinfo *tinfo;
1804 				struct tmode_tstate *tstate;
1805 
1806 				sg = scb->sg_list;
1807 				sc = (struct scsipi_sense *)(&hscb->cmdstore);
1808 				/*
1809 				 * Save off the residual if there is one.
1810 				 */
1811 				if (hscb->residual_SG_count != 0)
1812 					ahc_calc_residual(scb);
1813 				else
1814 					xs->resid = 0;
1815 
1816 #ifdef AHC_DEBUG
1817 				if (ahc_debug & AHC_SHOWSENSE) {
1818 					scsipi_printaddr(xs->xs_periph);
1819 					printf("Sending Sense\n");
1820 				}
1821 #endif
1822 				sg->addr = ahc->scb_data->sense_busaddr +
1823 				   (hscb->tag*sizeof(struct scsipi_sense_data));
1824 				sg->len = sizeof (struct scsipi_sense_data);
1825 
1826 				sc->opcode = REQUEST_SENSE;
1827 				sc->byte2 =  SCB_LUN(scb) << 5;
1828 				sc->unused[0] = 0;
1829 				sc->unused[1] = 0;
1830 				sc->length = sg->len;
1831 				sc->control = 0;
1832 
1833 				/*
1834 				 * Would be nice to preserve DISCENB here,
1835 				 * but due to the way we page SCBs, we can't.
1836 				 */
1837 				hscb->control = 0;
1838 
1839 				/*
1840 				 * This request sense could be because the
1841 				 * the device lost power or in some other
1842 				 * way has lost our transfer negotiations.
1843 				 * Renegotiate if appropriate.  Unit attention
1844 				 * errors will be reported before any data
1845 				 * phases occur.
1846 				 */
1847 				ahc_calc_residual(scb);
1848 #if defined(AHC_DEBUG)
1849 				if (ahc_debug & AHC_SHOWSENSE) {
1850 					scsipi_printaddr(xs->xs_periph);
1851 					printf("Sense: datalen %d resid %d"
1852 					       "chan %d id %d targ %d\n",
1853 					    xs->datalen, xs->resid,
1854 					    devinfo.channel, devinfo.our_scsiid,
1855 					    devinfo.target);
1856 				}
1857 #endif
1858 				if (xs->datalen > 0 &&
1859 				    xs->resid == xs->datalen) {
1860 					tinfo = ahc_fetch_transinfo(ahc,
1861 							    devinfo.channel,
1862 							    devinfo.our_scsiid,
1863 							    devinfo.target,
1864 							    &tstate);
1865 					ahc_update_target_msg_request(ahc,
1866 							      &devinfo,
1867 							      tinfo,
1868 							      /*force*/TRUE,
1869 							      /*paused*/TRUE);
1870 				}
1871 				hscb->status = 0;
1872 				hscb->SG_count = 1;
1873 				hscb->SG_pointer = scb->sg_list_phys;
1874 				hscb->data = sg->addr;
1875 				hscb->datalen = sg->len;
1876 				hscb->cmdpointer = hscb->cmdstore_busaddr;
1877 				hscb->cmdlen = sizeof(*sc);
1878 				scb->sg_count = hscb->SG_count;
1879 				ahc_swap_hscb(hscb);
1880 				ahc_swap_sg(scb->sg_list);
1881 				scb->flags |= SCB_SENSE;
1882 				/*
1883 				 * Ensure the target is busy since this
1884 				 * will be an untagged request.
1885 				 */
1886 				ahc_busy_tcl(ahc, scb);
1887 				ahc_outb(ahc, RETURN_1, SEND_SENSE);
1888 
1889 				/*
1890 				 * Ensure we have enough time to actually
1891 				 * retrieve the sense.
1892 				 */
1893 				if (!(scb->xs->xs_control & XS_CTL_POLL)) {
1894 					callout_reset(&scb->xs->xs_callout,
1895 					    5 * hz, ahc_timeout, scb);
1896 				}
1897 			}
1898 			break;
1899 		case SCSI_STATUS_QUEUE_FULL:
1900 		case SCSI_STATUS_BUSY:
1901 			xs->error = XS_BUSY;
1902 			break;
1903 		}
1904 		break;
1905 	}
1906 	case TRACE_POINT:
1907 	{
1908 		printf("SSTAT2 = 0x%x DFCNTRL = 0x%x\n", ahc_inb(ahc, SSTAT2),
1909 		       ahc_inb(ahc, DFCNTRL));
1910 		printf("SSTAT3 = 0x%x DSTATUS = 0x%x\n", ahc_inb(ahc, SSTAT3),
1911 		       ahc_inb(ahc, DFSTATUS));
1912 		printf("SSTAT0 = 0x%x, SCB_DATACNT = 0x%x\n",
1913 		       ahc_inb(ahc, SSTAT0),
1914 		       ahc_inb(ahc, SCB_DATACNT));
1915 		break;
1916 	}
1917 	case HOST_MSG_LOOP:
1918 	{
1919 		/*
1920 		 * The sequencer has encountered a message phase
1921 		 * that requires host assistance for completion.
1922 		 * While handling the message phase(s), we will be
1923 		 * notified by the sequencer after each byte is
1924 		 * transferred so we can track bus phases.
1925 		 *
1926 		 * If this is the first time we've seen a HOST_MSG_LOOP,
1927 		 * initialize the state of the host message loop.
1928 		 */
1929 		if (ahc->msg_type == MSG_TYPE_NONE) {
1930 			u_int bus_phase;
1931 
1932 			bus_phase = ahc_inb(ahc, SCSISIGI) & PHASE_MASK;
1933 			if (bus_phase != P_MESGIN
1934 			 && bus_phase != P_MESGOUT) {
1935 				printf("ahc_intr: HOST_MSG_LOOP bad "
1936 				       "phase 0x%x\n",
1937 				      bus_phase);
1938 				/*
1939 				 * Probably transitioned to bus free before
1940 				 * we got here.  Just punt the message.
1941 				 */
1942 				ahc_clear_intstat(ahc);
1943 				restart_sequencer(ahc);
1944 			}
1945 
1946 			if (devinfo.role == ROLE_INITIATOR) {
1947 				struct scb *scb;
1948 				u_int scb_index;
1949 
1950 				scb_index = ahc_inb(ahc, SCB_TAG);
1951 				scb = &ahc->scb_data->scbarray[scb_index];
1952 
1953 				if (bus_phase == P_MESGOUT)
1954 					ahc_setup_initiator_msgout(ahc,
1955 								   &devinfo,
1956 								   scb);
1957 				else {
1958 					ahc->msg_type =
1959 					    MSG_TYPE_INITIATOR_MSGIN;
1960 					ahc->msgin_index = 0;
1961 				}
1962 			} else {
1963 				if (bus_phase == P_MESGOUT) {
1964 					ahc->msg_type =
1965 					    MSG_TYPE_TARGET_MSGOUT;
1966 					ahc->msgin_index = 0;
1967 				} else
1968 					/* XXX Ever executed??? */
1969 					ahc_setup_target_msgin(ahc, &devinfo);
1970 			}
1971 		}
1972 
1973 		/* Pass a NULL path so that handlers generate their own */
1974 		ahc_handle_message_phase(ahc, /*path*/NULL);
1975 		break;
1976 	}
1977 	case PERR_DETECTED:
1978 	{
1979 		/*
1980 		 * If we've cleared the parity error interrupt
1981 		 * but the sequencer still believes that SCSIPERR
1982 		 * is true, it must be that the parity error is
1983 		 * for the currently presented byte on the bus,
1984 		 * and we are not in a phase (data-in) where we will
1985 		 * eventually ack this byte.  Ack the byte and
1986 		 * throw it away in the hope that the target will
1987 		 * take us to message out to deliver the appropriate
1988 		 * error message.
1989 		 */
1990 		if ((intstat & SCSIINT) == 0
1991 		 && (ahc_inb(ahc, SSTAT1) & SCSIPERR) != 0) {
1992 			u_int curphase;
1993 
1994 			/*
1995 			 * The hardware will only let you ack bytes
1996 			 * if the expected phase in SCSISIGO matches
1997 			 * the current phase.  Make sure this is
1998 			 * currently the case.
1999 			 */
2000 			curphase = ahc_inb(ahc, SCSISIGI) & PHASE_MASK;
2001 			ahc_outb(ahc, LASTPHASE, curphase);
2002 			ahc_outb(ahc, SCSISIGO, curphase);
2003 			ahc_inb(ahc, SCSIDATL);
2004 		}
2005 		break;
2006 	}
2007 	case DATA_OVERRUN:
2008 	{
2009 		/*
2010 		 * When the sequencer detects an overrun, it
2011 		 * places the controller in "BITBUCKET" mode
2012 		 * and allows the target to complete its transfer.
2013 		 * Unfortunately, none of the counters get updated
2014 		 * when the controller is in this mode, so we have
2015 		 * no way of knowing how large the overrun was.
2016 		 */
2017 		u_int scbindex = ahc_inb(ahc, SCB_TAG);
2018 		u_int lastphase = ahc_inb(ahc, LASTPHASE);
2019 		int i;
2020 
2021 		scb = &ahc->scb_data->scbarray[scbindex];
2022 		for (i = 0; i < num_phases; i++) {
2023 			if (lastphase == phase_table[i].phase)
2024 				break;
2025 		}
2026 		scsipi_printaddr(scb->xs->xs_periph);
2027 		printf("data overrun detected %s."
2028 		       "  Tag == 0x%x.\n",
2029 		       phase_table[i].phasemsg,
2030   		       scb->hscb->tag);
2031 		scsipi_printaddr(scb->xs->xs_periph);
2032 		printf("%s seen Data Phase.  Length = %d.  NumSGs = %d.\n",
2033 		       ahc_inb(ahc, SEQ_FLAGS) & DPHASE ? "Have" : "Haven't",
2034 		       scb->xs->datalen, scb->sg_count);
2035 		if (scb->sg_count > 0) {
2036 			for (i = 0; i < scb->sg_count; i++) {
2037 				printf("sg[%d] - Addr 0x%x : Length %d\n",
2038 				       i,
2039 				       le32toh(scb->sg_list[i].addr),
2040 				       le32toh(scb->sg_list[i].len));
2041 			}
2042 		}
2043 		/*
2044 		 * Set this and it will take affect when the
2045 		 * target does a command complete.
2046 		 */
2047 		ahc_freeze_devq(ahc, scb->xs->xs_periph);
2048 		ahcsetccbstatus(scb->xs, XS_DRIVER_STUFFUP);
2049 		ahc_freeze_ccb(scb);
2050 		break;
2051 	}
2052 	case TRACEPOINT:
2053 	{
2054 		printf("TRACEPOINT: RETURN_1 = %d\n", ahc_inb(ahc, RETURN_1));
2055 		printf("TRACEPOINT: RETURN_2 = %d\n", ahc_inb(ahc, RETURN_2));
2056 		printf("TRACEPOINT: ARG_1    = %d\n", ahc_inb(ahc, ARG_1));
2057 		printf("TRACEPOINT: ARG_2    = %d\n", ahc_inb(ahc, ARG_2));
2058 		printf("TRACEPOINT: CCHADDR =  %x\n",
2059 		    ahc_inb(ahc, CCHADDR) | (ahc_inb(ahc, CCHADDR+1) << 8)
2060 		    | (ahc_inb(ahc, CCHADDR+2) << 16)
2061 		    | (ahc_inb(ahc, CCHADDR+3) << 24));
2062 #if 0
2063 		printf("SSTAT1 == 0x%x\n", ahc_inb(ahc, SSTAT1));
2064 		printf("SSTAT0 == 0x%x\n", ahc_inb(ahc, SSTAT0));
2065 		printf(", SCSISIGI == 0x%x\n", ahc_inb(ahc, SCSISIGI));
2066 		printf("TRACEPOINT: CCHCNT = %d, SG_COUNT = %d\n",
2067 		       ahc_inb(ahc, CCHCNT), ahc_inb(ahc, SG_COUNT));
2068 		printf("TRACEPOINT: SCB_TAG = %d\n", ahc_inb(ahc, SCB_TAG));
2069 		printf("TRACEPOINT1: CCHADDR = %d, CCHCNT = %d, SCBPTR = %d\n",
2070 		       ahc_inb(ahc, CCHADDR)
2071 		    | (ahc_inb(ahc, CCHADDR+1) << 8)
2072 		    | (ahc_inb(ahc, CCHADDR+2) << 16)
2073 		    | (ahc_inb(ahc, CCHADDR+3) << 24),
2074 		       ahc_inb(ahc, CCHCNT)
2075 		    | (ahc_inb(ahc, CCHCNT+1) << 8)
2076 		    | (ahc_inb(ahc, CCHCNT+2) << 16),
2077 		       ahc_inb(ahc, SCBPTR));
2078 		printf("TRACEPOINT: WAITING_SCBH = %d\n", ahc_inb(ahc, WAITING_SCBH));
2079 		printf("TRACEPOINT: SCB_TAG = %d\n", ahc_inb(ahc, SCB_TAG));
2080 #ifdef DDB
2081 		cpu_Debugger();
2082 #endif
2083 #endif
2084 		break;
2085 	}
2086 #if NOT_YET
2087 	/* XXX Fill these in later */
2088 	case MESG_BUFFER_BUSY:
2089 		break;
2090 	case MSGIN_PHASEMIS:
2091 		break;
2092 #endif
2093 	default:
2094 		printf("ahc_intr: seqint, "
2095 		       "intstat == 0x%x, scsisigi = 0x%x\n",
2096 		       intstat, ahc_inb(ahc, SCSISIGI));
2097 		break;
2098 	}
2099 
2100 unpause:
2101 	/*
2102 	 *  The sequencer is paused immediately on
2103 	 *  a SEQINT, so we should restart it when
2104 	 *  we're done.
2105 	 */
2106 	unpause_sequencer(ahc);
2107 }
2108 
2109 static void
2110 ahc_handle_scsiint(struct ahc_softc *ahc, u_int intstat)
2111 {
2112 	u_int	scb_index;
2113 	u_int	status;
2114 	struct	scb *scb;
2115 	char	cur_channel;
2116 	char	intr_channel;
2117 
2118 	if ((ahc->features & AHC_TWIN) != 0
2119 	 && ((ahc_inb(ahc, SBLKCTL) & SELBUSB) != 0))
2120 		cur_channel = 'B';
2121 	else
2122 		cur_channel = 'A';
2123 	intr_channel = cur_channel;
2124 
2125 	status = ahc_inb(ahc, SSTAT1);
2126 	if (status == 0) {
2127 		if ((ahc->features & AHC_TWIN) != 0) {
2128 			/* Try the other channel */
2129 		 	ahc_outb(ahc, SBLKCTL, ahc_inb(ahc, SBLKCTL) ^ SELBUSB);
2130 			status = ahc_inb(ahc, SSTAT1);
2131 		 	ahc_outb(ahc, SBLKCTL, ahc_inb(ahc, SBLKCTL) ^ SELBUSB);
2132 			intr_channel = (cur_channel == 'A') ? 'B' : 'A';
2133 		}
2134 		if (status == 0) {
2135 			printf("%s: Spurious SCSI interrupt\n", ahc_name(ahc));
2136 			return;
2137 		}
2138 	}
2139 
2140 	scb_index = ahc_inb(ahc, SCB_TAG);
2141 	if (scb_index < ahc->scb_data->numscbs) {
2142 		scb = &ahc->scb_data->scbarray[scb_index];
2143 		if ((scb->flags & SCB_ACTIVE) == 0
2144 		 || (ahc_inb(ahc, SEQ_FLAGS) & IDENTIFY_SEEN) == 0)
2145 			scb = NULL;
2146 	} else
2147 		scb = NULL;
2148 
2149 	if ((status & SCSIRSTI) != 0) {
2150 		printf("%s: Someone reset channel %c\n",
2151 			ahc_name(ahc), intr_channel);
2152 		ahc_reset_channel(ahc, intr_channel, /* Initiate Reset */FALSE);
2153 	} else if ((status & SCSIPERR) != 0) {
2154 		/*
2155 		 * Determine the bus phase and queue an appropriate message.
2156 		 * SCSIPERR is latched true as soon as a parity error
2157 		 * occurs.  If the sequencer acked the transfer that
2158 		 * caused the parity error and the currently presented
2159 		 * transfer on the bus has correct parity, SCSIPERR will
2160 		 * be cleared by CLRSCSIPERR.  Use this to determine if
2161 		 * we should look at the last phase the sequencer recorded,
2162 		 * or the current phase presented on the bus.
2163 		 */
2164 		u_int mesg_out;
2165 		u_int curphase;
2166 		u_int errorphase;
2167 		u_int lastphase;
2168 		int   i;
2169 
2170 		lastphase = ahc_inb(ahc, LASTPHASE);
2171 		curphase = ahc_inb(ahc, SCSISIGI) & PHASE_MASK;
2172 		ahc_outb(ahc, CLRSINT1, CLRSCSIPERR);
2173 		/*
2174 		 * For all phases save DATA, the sequencer won't
2175 		 * automatically ack a byte that has a parity error
2176 		 * in it.  So the only way that the current phase
2177 		 * could be 'data-in' is if the parity error is for
2178 		 * an already acked byte in the data phase.  During
2179 		 * synchronous data-in transfers, we may actually
2180 		 * ack bytes before latching the current phase in
2181 		 * LASTPHASE, leading to the discrepancy between
2182 		 * curphase and lastphase.
2183 		 */
2184 		if ((ahc_inb(ahc, SSTAT1) & SCSIPERR) != 0
2185 		 || curphase == P_DATAIN)
2186 			errorphase = curphase;
2187 		else
2188 			errorphase = lastphase;
2189 
2190 		for (i = 0; i < num_phases; i++) {
2191 			if (errorphase == phase_table[i].phase)
2192 				break;
2193 		}
2194 		mesg_out = phase_table[i].mesg_out;
2195 		if (scb != NULL)
2196 			scsipi_printaddr(scb->xs->xs_periph);
2197 		else
2198 			printf("%s:%c:%d: ", ahc_name(ahc),
2199 			       intr_channel,
2200 			       TCL_TARGET(ahc_inb(ahc, SAVED_TCL)));
2201 
2202 		printf("parity error detected %s. "
2203 		       "SEQADDR(0x%x) SCSIRATE(0x%x)\n",
2204 		       phase_table[i].phasemsg,
2205 		       ahc_inb(ahc, SEQADDR0) | (ahc_inb(ahc, SEQADDR1) << 8),
2206 		       ahc_inb(ahc, SCSIRATE));
2207 
2208 		/*
2209 		 * We've set the hardware to assert ATN if we
2210 		 * get a parity error on "in" phases, so all we
2211 		 * need to do is stuff the message buffer with
2212 		 * the appropriate message.  "In" phases have set
2213 		 * mesg_out to something other than MSG_NOP.
2214 		 */
2215 		if (mesg_out != MSG_NOOP) {
2216 			if (ahc->msg_type != MSG_TYPE_NONE)
2217 				ahc->send_msg_perror = TRUE;
2218 			else
2219 				ahc_outb(ahc, MSG_OUT, mesg_out);
2220 		}
2221 		ahc_outb(ahc, CLRINT, CLRSCSIINT);
2222 		unpause_sequencer(ahc);
2223 	} else if ((status & BUSFREE) != 0
2224 		&& (ahc_inb(ahc, SIMODE1) & ENBUSFREE) != 0) {
2225 		/*
2226 		 * First look at what phase we were last in.
2227 		 * If its message out, chances are pretty good
2228 		 * that the busfree was in response to one of
2229 		 * our abort requests.
2230 		 */
2231 		u_int lastphase = ahc_inb(ahc, LASTPHASE);
2232 		u_int saved_tcl = ahc_inb(ahc, SAVED_TCL);
2233 		u_int target = TCL_TARGET(saved_tcl);
2234 		u_int initiator_role_id = TCL_SCSI_ID(ahc, saved_tcl);
2235 		char channel = TCL_CHANNEL(ahc, saved_tcl);
2236 		int printerror = 1;
2237 
2238 		ahc_outb(ahc, SCSISEQ,
2239 			 ahc_inb(ahc, SCSISEQ) & (ENSELI|ENRSELI|ENAUTOATNP));
2240 		if (lastphase == P_MESGOUT) {
2241 			u_int message;
2242 			u_int tag;
2243 
2244 			message = ahc->msgout_buf[ahc->msgout_index - 1];
2245 			tag = SCB_LIST_NULL;
2246 			switch (message) {
2247 			case MSG_ABORT_TAG:
2248 				tag = scb->hscb->tag;
2249 				/* FALLTRHOUGH */
2250 			case MSG_ABORT:
2251 				scsipi_printaddr(scb->xs->xs_periph);
2252 				printf("SCB %x - Abort %s Completed.\n",
2253 				       scb->hscb->tag, tag == SCB_LIST_NULL ?
2254 				       "" : "Tag");
2255 				ahc_abort_scbs(ahc, target, channel,
2256 					       TCL_LUN(saved_tcl), tag,
2257 					       ROLE_INITIATOR,
2258 					       XS_DRIVER_STUFFUP);
2259 				printerror = 0;
2260 				break;
2261 			case MSG_BUS_DEV_RESET:
2262 			{
2263 				struct ahc_devinfo devinfo;
2264 
2265 				if (scb != NULL &&
2266 				    (scb->xs->xs_control & XS_CTL_RESET)
2267 				 && ahc_match_scb(scb, target, channel,
2268 						  TCL_LUN(saved_tcl),
2269 						  SCB_LIST_NULL,
2270 						  ROLE_INITIATOR)) {
2271 					ahcsetccbstatus(scb->xs, XS_NOERROR);
2272 				}
2273 				ahc_compile_devinfo(&devinfo,
2274 						    initiator_role_id,
2275 						    target,
2276 						    TCL_LUN(saved_tcl),
2277 						    channel,
2278 						    ROLE_INITIATOR);
2279 				ahc_handle_devreset(ahc, &devinfo,
2280 						    XS_RESET,
2281 						    "Bus Device Reset",
2282 						    /*verbose_level*/0);
2283 				printerror = 0;
2284 				break;
2285 			}
2286 			default:
2287 				break;
2288 			}
2289 		}
2290 		if (printerror != 0) {
2291 			int i;
2292 
2293 			if (scb != NULL) {
2294 				u_int tag;
2295 
2296 				if ((scb->hscb->control & TAG_ENB) != 0)
2297 					tag = scb->hscb->tag;
2298 				else
2299 					tag = SCB_LIST_NULL;
2300 				ahc_abort_scbs(ahc, target, channel,
2301 					       SCB_LUN(scb), tag,
2302 					       ROLE_INITIATOR,
2303 					       XS_DRIVER_STUFFUP);
2304 				scsipi_printaddr(scb->xs->xs_periph);
2305 			} else {
2306 				/*
2307 				 * We had not fully identified this connection,
2308 				 * so we cannot abort anything.
2309 				 */
2310 				printf("%s: ", ahc_name(ahc));
2311 			}
2312 			for (i = 0; i < num_phases; i++) {
2313 				if (lastphase == phase_table[i].phase)
2314 					break;
2315 			}
2316 			printf("Unexpected busfree %s\n"
2317 			       "SEQADDR == 0x%x\n",
2318 			       phase_table[i].phasemsg, ahc_inb(ahc, SEQADDR0)
2319 				| (ahc_inb(ahc, SEQADDR1) << 8));
2320 		}
2321 		ahc_clear_msg_state(ahc);
2322 		ahc_outb(ahc, SIMODE1, ahc_inb(ahc, SIMODE1) & ~ENBUSFREE);
2323 		ahc_outb(ahc, CLRSINT1, CLRBUSFREE|CLRSCSIPERR);
2324 		ahc_outb(ahc, CLRINT, CLRSCSIINT);
2325 		restart_sequencer(ahc);
2326 	} else if ((status & SELTO) != 0) {
2327 		u_int scbptr;
2328 
2329 		scbptr = ahc_inb(ahc, WAITING_SCBH);
2330 		ahc_outb(ahc, SCBPTR, scbptr);
2331 		scb_index = ahc_inb(ahc, SCB_TAG);
2332 
2333 		if (scb_index < ahc->scb_data->numscbs) {
2334 			scb = &ahc->scb_data->scbarray[scb_index];
2335 			if ((scb->flags & SCB_ACTIVE) == 0)
2336 				scb = NULL;
2337 		} else
2338 			scb = NULL;
2339 
2340 		if (scb == NULL) {
2341 			printf("%s: ahc_intr - referenced scb not "
2342 			       "valid during SELTO scb(%d, %d)\n",
2343 			       ahc_name(ahc), scbptr, scb_index);
2344 		} else {
2345 			u_int tag;
2346 
2347 			tag = SCB_LIST_NULL;
2348 			if ((scb->hscb->control & TAG_ENB) != 0)
2349 				tag = scb->hscb->tag;
2350 
2351 			ahc_abort_scbs(ahc, SCB_TARGET(scb), SCB_CHANNEL(scb),
2352 				       SCB_LUN(scb), tag,
2353 				       ROLE_INITIATOR, XS_SELTIMEOUT);
2354 		}
2355 		/* Stop the selection */
2356 		ahc_outb(ahc, SCSISEQ, 0);
2357 
2358 		/* No more pending messages */
2359 		ahc_clear_msg_state(ahc);
2360 
2361 		/*
2362 		 * Although the driver does not care about the
2363 		 * 'Selection in Progress' status bit, the busy
2364 		 * LED does.  SELINGO is only cleared by a sucessful
2365 		 * selection, so we must manually clear it to ensure
2366 		 * the LED turns off just incase no future successful
2367 		 * selections occur (e.g. no devices on the bus).
2368 		 */
2369 		ahc_outb(ahc, CLRSINT0, CLRSELINGO);
2370 
2371 		/* Clear interrupt state */
2372 		ahc_outb(ahc, CLRSINT1, CLRSELTIMEO|CLRBUSFREE|CLRSCSIPERR);
2373 		ahc_outb(ahc, CLRINT, CLRSCSIINT);
2374 		restart_sequencer(ahc);
2375 	} else {
2376 		scsipi_printaddr(scb->xs->xs_periph);
2377 		printf("Unknown SCSIINT. Status = 0x%x\n", status);
2378 		ahc_outb(ahc, CLRSINT1, status);
2379 		ahc_outb(ahc, CLRINT, CLRSCSIINT);
2380 		unpause_sequencer(ahc);
2381 	}
2382 }
2383 
2384 static void
2385 ahc_build_transfer_msg(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
2386 {
2387 	/*
2388 	 * We need to initiate transfer negotiations.
2389 	 * If our current and goal settings are identical,
2390 	 * we want to renegotiate due to a check condition.
2391 	 */
2392 	struct	ahc_initiator_tinfo *tinfo;
2393 	struct	tmode_tstate *tstate;
2394 	int	dowide;
2395 	int	dosync;
2396 
2397 	tinfo = ahc_fetch_transinfo(ahc, devinfo->channel, devinfo->our_scsiid,
2398 				    devinfo->target, &tstate);
2399 	dowide = tinfo->current.width != tinfo->goal.width;
2400 	dosync = tinfo->current.period != tinfo->goal.period;
2401 
2402 	if (!dowide && !dosync) {
2403 		dowide = tinfo->goal.width != MSG_EXT_WDTR_BUS_8_BIT;
2404 		dosync = tinfo->goal.period != 0;
2405 	}
2406 
2407 	if (dowide) {
2408 		ahc_construct_wdtr(ahc, tinfo->goal.width);
2409 	} else if (dosync) {
2410 		const struct	ahc_syncrate *rate;
2411 		u_int	period;
2412 		u_int	offset;
2413 
2414 		period = tinfo->goal.period;
2415 		rate = ahc_devlimited_syncrate(ahc, &period);
2416 		offset = tinfo->goal.offset;
2417 		ahc_validate_offset(ahc, rate, &offset,
2418 				    tinfo->current.width);
2419 		ahc_construct_sdtr(ahc, period, offset);
2420 	} else {
2421 		panic("ahc_intr: AWAITING_MSG for negotiation, "
2422 		      "but no negotiation needed\n");
2423 	}
2424 }
2425 
2426 static void
2427 ahc_setup_initiator_msgout(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
2428 			   struct scb *scb)
2429 {
2430 	/*
2431 	 * To facilitate adding multiple messages together,
2432 	 * each routine should increment the index and len
2433 	 * variables instead of setting them explicitly.
2434 	 */
2435 	ahc->msgout_index = 0;
2436 	ahc->msgout_len = 0;
2437 
2438 	if ((scb->flags & SCB_DEVICE_RESET) == 0
2439 	 && ahc_inb(ahc, MSG_OUT) == MSG_IDENTIFYFLAG) {
2440 		u_int identify_msg;
2441 
2442 		identify_msg = MSG_IDENTIFYFLAG | SCB_LUN(scb);
2443 		if ((scb->hscb->control & DISCENB) != 0)
2444 			identify_msg |= MSG_IDENTIFY_DISCFLAG;
2445 		ahc->msgout_buf[ahc->msgout_index++] = identify_msg;
2446 		ahc->msgout_len++;
2447 
2448 		if ((scb->hscb->control & TAG_ENB) != 0) {
2449 			ahc->msgout_buf[ahc->msgout_index++] =
2450 						scb->xs->xs_tag_type;
2451 			ahc->msgout_buf[ahc->msgout_index++] = scb->hscb->tag;
2452 			ahc->msgout_len += 2;
2453 		}
2454 	}
2455 
2456 	if (scb->flags & SCB_DEVICE_RESET) {
2457 		ahc->msgout_buf[ahc->msgout_index++] = MSG_BUS_DEV_RESET;
2458 		ahc->msgout_len++;
2459 		scsipi_printaddr(scb->xs->xs_periph);
2460 		printf("Bus Device Reset Message Sent\n");
2461 	} else if (scb->flags & SCB_ABORT) {
2462 		if ((scb->hscb->control & TAG_ENB) != 0)
2463 			ahc->msgout_buf[ahc->msgout_index++] = MSG_ABORT_TAG;
2464 		else
2465 			ahc->msgout_buf[ahc->msgout_index++] = MSG_ABORT;
2466 		ahc->msgout_len++;
2467 		scsipi_printaddr(scb->xs->xs_periph);
2468 		printf("Abort Message Sent\n");
2469 	} else if ((ahc->targ_msg_req & devinfo->target_mask) != 0) {
2470 		ahc_build_transfer_msg(ahc, devinfo);
2471 	} else {
2472 		printf("ahc_intr: AWAITING_MSG for an SCB that "
2473 		       "does not have a waiting message");
2474 		panic("SCB = %d, SCB Control = %x, MSG_OUT = %x "
2475 		      "SCB flags = %x", scb->hscb->tag, scb->hscb->control,
2476 		      ahc_inb(ahc, MSG_OUT), scb->flags);
2477 	}
2478 
2479 	/*
2480 	 * Clear the MK_MESSAGE flag from the SCB so we aren't
2481 	 * asked to send this message again.
2482 	 */
2483 	ahc_outb(ahc, SCB_CONTROL, ahc_inb(ahc, SCB_CONTROL) & ~MK_MESSAGE);
2484 	ahc->msgout_index = 0;
2485 	ahc->msg_type = MSG_TYPE_INITIATOR_MSGOUT;
2486 }
2487 
2488 static void
2489 ahc_setup_target_msgin(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
2490 {
2491 	/*
2492 	 * To facilitate adding multiple messages together,
2493 	 * each routine should increment the index and len
2494 	 * variables instead of setting them explicitly.
2495 	 */
2496 	ahc->msgout_index = 0;
2497 	ahc->msgout_len = 0;
2498 
2499 	if ((ahc->targ_msg_req & devinfo->target_mask) != 0)
2500 		ahc_build_transfer_msg(ahc, devinfo);
2501 	else
2502 		panic("ahc_intr: AWAITING target message with no message");
2503 
2504 	ahc->msgout_index = 0;
2505 	ahc->msg_type = MSG_TYPE_TARGET_MSGIN;
2506 }
2507 
2508 static int
2509 ahc_handle_msg_reject(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
2510 {
2511 	/*
2512 	 * What we care about here is if we had an
2513 	 * outstanding SDTR or WDTR message for this
2514 	 * target.  If we did, this is a signal that
2515 	 * the target is refusing negotiation.
2516 	 */
2517 	struct scb *scb;
2518 	u_int scb_index;
2519 	u_int last_msg;
2520 	int   response = 0;
2521 
2522 	scb_index = ahc_inb(ahc, SCB_TAG);
2523 	scb = &ahc->scb_data->scbarray[scb_index];
2524 
2525 	/* Might be necessary */
2526 	last_msg = ahc_inb(ahc, LAST_MSG);
2527 
2528 	if (ahc_sent_msg(ahc, MSG_EXT_WDTR, /*full*/FALSE)) {
2529 		struct ahc_initiator_tinfo *tinfo;
2530 		struct tmode_tstate *tstate;
2531 
2532 #ifdef AHC_DEBUG_NEG
2533 		/* note 8bit xfers */
2534 		printf("%s:%c:%d: refuses WIDE negotiation.  Using "
2535 		       "8bit transfers\n", ahc_name(ahc),
2536 		       devinfo->channel, devinfo->target);
2537 #endif
2538 		ahc_set_width(ahc, devinfo,
2539 			      MSG_EXT_WDTR_BUS_8_BIT,
2540 			      AHC_TRANS_ACTIVE|AHC_TRANS_GOAL,
2541 			      /*paused*/TRUE, /*done*/TRUE);
2542 		/*
2543 		 * No need to clear the sync rate.  If the target
2544 		 * did not accept the command, our syncrate is
2545 		 * unaffected.  If the target started the negotiation,
2546 		 * but rejected our response, we already cleared the
2547 		 * sync rate before sending our WDTR.
2548 		 */
2549 		tinfo = ahc_fetch_transinfo(ahc, devinfo->channel,
2550 					    devinfo->our_scsiid,
2551 					    devinfo->target, &tstate);
2552 		if (tinfo->goal.period) {
2553 			u_int period;
2554 
2555 			/* Start the sync negotiation */
2556 			period = tinfo->goal.period;
2557 			ahc_devlimited_syncrate(ahc, &period);
2558 			ahc->msgout_index = 0;
2559 			ahc->msgout_len = 0;
2560 			ahc_construct_sdtr(ahc, period, tinfo->goal.offset);
2561 			ahc->msgout_index = 0;
2562 			response = 1;
2563 		} else
2564 			ahc_update_xfer_mode(ahc, devinfo);
2565 	} else if (ahc_sent_msg(ahc, MSG_EXT_SDTR, /*full*/FALSE)) {
2566 		/* note asynch xfers and clear flag */
2567 		ahc_set_syncrate(ahc, devinfo, /*syncrate*/NULL, /*period*/0,
2568 				 /*offset*/0, AHC_TRANS_ACTIVE|AHC_TRANS_GOAL,
2569 				 /*paused*/TRUE, /*done*/TRUE);
2570 #ifdef AHC_DEBUG_NEG
2571 		printf("%s:%c:%d: refuses synchronous negotiation. "
2572 		       "Using asynchronous transfers\n",
2573 		       ahc_name(ahc),
2574 		       devinfo->channel, devinfo->target);
2575 #endif
2576 		ahc_update_xfer_mode(ahc, devinfo);
2577 	} else if ((scb->hscb->control & TAG_ENB) != 0) {
2578 		printf("%s:%c:%d: refuses tagged commands.  Performing "
2579 		       "non-tagged I/O\n", ahc_name(ahc),
2580 		       devinfo->channel, devinfo->target);
2581 
2582 		ahc_set_tags(ahc, devinfo, FALSE);
2583 		ahc_update_xfer_mode(ahc, devinfo);
2584 
2585 		/*
2586 		 * Resend the identify for this CCB as the target
2587 		 * may believe that the selection is invalid otherwise.
2588 		 */
2589 		ahc_outb(ahc, SCB_CONTROL, ahc_inb(ahc, SCB_CONTROL)
2590 					  & ~MSG_SIMPLE_Q_TAG);
2591 	 	scb->hscb->control &= ~MSG_SIMPLE_Q_TAG;
2592 		ahc_outb(ahc, MSG_OUT, MSG_IDENTIFYFLAG);
2593 		ahc_outb(ahc, SCSISIGO, ahc_inb(ahc, SCSISIGO) | ATNO);
2594 
2595 		/*
2596 		 * Requeue all tagged commands for this target
2597 		 * currently in our posession so they can be
2598 		 * converted to untagged commands.
2599 		 */
2600 		ahc_search_qinfifo(ahc, SCB_TARGET(scb), SCB_CHANNEL(scb),
2601 				   SCB_LUN(scb), /*tag*/SCB_LIST_NULL,
2602 				   ROLE_INITIATOR, SCB_REQUEUE,
2603 				   SEARCH_COMPLETE);
2604 	} else {
2605 		/*
2606 		 * Otherwise, we ignore it.
2607 		 */
2608 		printf("%s:%c:%d: Message reject for %x -- ignored\n",
2609 		       ahc_name(ahc), devinfo->channel, devinfo->target,
2610 		       last_msg);
2611 	}
2612 	return (response);
2613 }
2614 
2615 static void
2616 ahc_clear_msg_state(struct ahc_softc *ahc)
2617 {
2618 	ahc->msgout_len = 0;
2619 	ahc->msgin_index = 0;
2620 	ahc->msg_type = MSG_TYPE_NONE;
2621 	ahc_outb(ahc, MSG_OUT, MSG_NOOP);
2622 }
2623 
2624 static void
2625 ahc_handle_message_phase(struct ahc_softc *ahc, struct scsipi_periph *periph)
2626 {
2627 	struct	ahc_devinfo devinfo;
2628 	u_int	bus_phase;
2629 	int	end_session;
2630 
2631 	ahc_fetch_devinfo(ahc, &devinfo);
2632 	end_session = FALSE;
2633 	bus_phase = ahc_inb(ahc, SCSISIGI) & PHASE_MASK;
2634 
2635 reswitch:
2636 	switch (ahc->msg_type) {
2637 	case MSG_TYPE_INITIATOR_MSGOUT:
2638 	{
2639 		int lastbyte;
2640 		int phasemis;
2641 		int msgdone;
2642 
2643 		if (ahc->msgout_len == 0)
2644 			panic("REQINIT interrupt with no active message");
2645 
2646 		phasemis = bus_phase != P_MESGOUT;
2647 		if (phasemis) {
2648 			if (bus_phase == P_MESGIN) {
2649 				/*
2650 				 * Change gears and see if
2651 				 * this messages is of interest to
2652 				 * us or should be passed back to
2653 				 * the sequencer.
2654 				 */
2655 				ahc_outb(ahc, CLRSINT1, CLRATNO);
2656 				ahc->send_msg_perror = FALSE;
2657 				ahc->msg_type = MSG_TYPE_INITIATOR_MSGIN;
2658 				ahc->msgin_index = 0;
2659 				goto reswitch;
2660 			}
2661 			end_session = TRUE;
2662 			break;
2663 		}
2664 
2665 		if (ahc->send_msg_perror) {
2666 			ahc_outb(ahc, CLRSINT1, CLRATNO);
2667 			ahc_outb(ahc, CLRSINT1, CLRREQINIT);
2668 			ahc_outb(ahc, SCSIDATL, MSG_PARITY_ERROR);
2669 			break;
2670 		}
2671 
2672 		msgdone	= ahc->msgout_index == ahc->msgout_len;
2673 		if (msgdone) {
2674 			/*
2675 			 * The target has requested a retry.
2676 			 * Re-assert ATN, reset our message index to
2677 			 * 0, and try again.
2678 			 */
2679 			ahc->msgout_index = 0;
2680 			ahc_outb(ahc, SCSISIGO, ahc_inb(ahc, SCSISIGO) | ATNO);
2681 		}
2682 
2683 		lastbyte = ahc->msgout_index == (ahc->msgout_len - 1);
2684 		if (lastbyte) {
2685 			/* Last byte is signified by dropping ATN */
2686 			ahc_outb(ahc, CLRSINT1, CLRATNO);
2687 		}
2688 
2689 		/*
2690 		 * Clear our interrupt status and present
2691 		 * the next byte on the bus.
2692 		 */
2693 		ahc_outb(ahc, CLRSINT1, CLRREQINIT);
2694 		ahc_outb(ahc, SCSIDATL, ahc->msgout_buf[ahc->msgout_index++]);
2695 		break;
2696 	}
2697 	case MSG_TYPE_INITIATOR_MSGIN:
2698 	{
2699 		int phasemis;
2700 		int message_done;
2701 
2702 		phasemis = bus_phase != P_MESGIN;
2703 
2704 		if (phasemis) {
2705 			ahc->msgin_index = 0;
2706 			if (bus_phase == P_MESGOUT
2707 			 && (ahc->send_msg_perror == TRUE
2708 			  || (ahc->msgout_len != 0
2709 			   && ahc->msgout_index == 0))) {
2710 				ahc->msg_type = MSG_TYPE_INITIATOR_MSGOUT;
2711 				goto reswitch;
2712 			}
2713 			end_session = TRUE;
2714 			break;
2715 		}
2716 
2717 		/* Pull the byte in without acking it */
2718 		ahc->msgin_buf[ahc->msgin_index] = ahc_inb(ahc, SCSIBUSL);
2719 
2720 		message_done = ahc_parse_msg(ahc, periph, &devinfo);
2721 
2722 		if (message_done) {
2723 			/*
2724 			 * Clear our incoming message buffer in case there
2725 			 * is another message following this one.
2726 			 */
2727 			ahc->msgin_index = 0;
2728 
2729 			/*
2730 			 * If this message illicited a response,
2731 			 * assert ATN so the target takes us to the
2732 			 * message out phase.
2733 			 */
2734 			if (ahc->msgout_len != 0)
2735 				ahc_outb(ahc, SCSISIGO,
2736 					 ahc_inb(ahc, SCSISIGO) | ATNO);
2737 		} else
2738 			ahc->msgin_index++;
2739 
2740 		/* Ack the byte */
2741 		ahc_outb(ahc, CLRSINT1, CLRREQINIT);
2742 		ahc_inb(ahc, SCSIDATL);
2743 		break;
2744 	}
2745 	case MSG_TYPE_TARGET_MSGIN:
2746 	{
2747 		int msgdone;
2748 		int msgout_request;
2749 
2750 		if (ahc->msgout_len == 0)
2751 			panic("Target MSGIN with no active message");
2752 
2753 		/*
2754 		 * If we interrupted a mesgout session, the initiator
2755 		 * will not know this until our first REQ.  So, we
2756 		 * only honor mesgout requests after we've sent our
2757 		 * first byte.
2758 		 */
2759 		if ((ahc_inb(ahc, SCSISIGI) & ATNI) != 0
2760 		 && ahc->msgout_index > 0)
2761 			msgout_request = TRUE;
2762 		else
2763 			msgout_request = FALSE;
2764 
2765 		if (msgout_request) {
2766 
2767 			/*
2768 			 * Change gears and see if
2769 			 * this messages is of interest to
2770 			 * us or should be passed back to
2771 			 * the sequencer.
2772 			 */
2773 			ahc->msg_type = MSG_TYPE_TARGET_MSGOUT;
2774 			ahc_outb(ahc, SCSISIGO, P_MESGOUT | BSYO);
2775 			ahc->msgin_index = 0;
2776 			/* Dummy read to REQ for first byte */
2777 			ahc_inb(ahc, SCSIDATL);
2778 			ahc_outb(ahc, SXFRCTL0,
2779 				 ahc_inb(ahc, SXFRCTL0) | SPIOEN);
2780 			break;
2781 		}
2782 
2783 		msgdone = ahc->msgout_index == ahc->msgout_len;
2784 		if (msgdone) {
2785 			ahc_outb(ahc, SXFRCTL0,
2786 				 ahc_inb(ahc, SXFRCTL0) & ~SPIOEN);
2787 			end_session = TRUE;
2788 			break;
2789 		}
2790 
2791 		/*
2792 		 * Present the next byte on the bus.
2793 		 */
2794 		ahc_outb(ahc, SXFRCTL0, ahc_inb(ahc, SXFRCTL0) | SPIOEN);
2795 		ahc_outb(ahc, SCSIDATL, ahc->msgout_buf[ahc->msgout_index++]);
2796 		break;
2797 	}
2798 	case MSG_TYPE_TARGET_MSGOUT:
2799 	{
2800 		int lastbyte;
2801 		int msgdone;
2802 
2803 		/*
2804 		 * The initiator signals that this is
2805 		 * the last byte by dropping ATN.
2806 		 */
2807 		lastbyte = (ahc_inb(ahc, SCSISIGI) & ATNI) == 0;
2808 
2809 		/*
2810 		 * Read the latched byte, but turn off SPIOEN first
2811 		 * so that we don't inadvertantly cause a REQ for the
2812 		 * next byte.
2813 		 */
2814 		ahc_outb(ahc, SXFRCTL0, ahc_inb(ahc, SXFRCTL0) & ~SPIOEN);
2815 		ahc->msgin_buf[ahc->msgin_index] = ahc_inb(ahc, SCSIDATL);
2816 		msgdone = ahc_parse_msg(ahc, periph, &devinfo);
2817 		if (msgdone == MSGLOOP_TERMINATED) {
2818 			/*
2819 			 * The message is *really* done in that it caused
2820 			 * us to go to bus free.  The sequencer has already
2821 			 * been reset at this point, so pull the ejection
2822 			 * handle.
2823 			 */
2824 			return;
2825 		}
2826 
2827 		ahc->msgin_index++;
2828 
2829 		/*
2830 		 * XXX Read spec about initiator dropping ATN too soon
2831 		 *     and use msgdone to detect it.
2832 		 */
2833 		if (msgdone == MSGLOOP_MSGCOMPLETE) {
2834 			ahc->msgin_index = 0;
2835 
2836 			/*
2837 			 * If this message illicited a response, transition
2838 			 * to the Message in phase and send it.
2839 			 */
2840 			if (ahc->msgout_len != 0) {
2841 				ahc_outb(ahc, SCSISIGO, P_MESGIN | BSYO);
2842 				ahc_outb(ahc, SXFRCTL0,
2843 					 ahc_inb(ahc, SXFRCTL0) | SPIOEN);
2844 				ahc->msg_type = MSG_TYPE_TARGET_MSGIN;
2845 				ahc->msgin_index = 0;
2846 				break;
2847 			}
2848 		}
2849 
2850 		if (lastbyte)
2851 			end_session = TRUE;
2852 		else {
2853 			/* Ask for the next byte. */
2854 			ahc_outb(ahc, SXFRCTL0,
2855 				 ahc_inb(ahc, SXFRCTL0) | SPIOEN);
2856 		}
2857 
2858 		break;
2859 	}
2860 	default:
2861 		panic("Unknown REQINIT message type");
2862 	}
2863 
2864 	if (end_session) {
2865 		ahc_clear_msg_state(ahc);
2866 		ahc_outb(ahc, RETURN_1, EXIT_MSG_LOOP);
2867 	} else
2868 		ahc_outb(ahc, RETURN_1, CONT_MSG_LOOP);
2869 }
2870 
2871 /*
2872  * See if we sent a particular extended message to the target.
2873  * If "full" is true, the target saw the full message.
2874  * If "full" is false, the target saw at least the first
2875  * byte of the message.
2876  */
2877 static int
2878 ahc_sent_msg(struct ahc_softc *ahc, u_int msgtype, int full)
2879 {
2880 	int found;
2881 	int index;
2882 
2883 	found = FALSE;
2884 	index = 0;
2885 
2886 	while (index < ahc->msgout_len) {
2887 		if (ahc->msgout_buf[index] == MSG_EXTENDED) {
2888 
2889 			/* Found a candidate */
2890 			if (ahc->msgout_buf[index+2] == msgtype) {
2891 				u_int end_index;
2892 
2893 				end_index = index + 1
2894 					  + ahc->msgout_buf[index + 1];
2895 				if (full) {
2896 					if (ahc->msgout_index > end_index)
2897 						found = TRUE;
2898 				} else if (ahc->msgout_index > index)
2899 					found = TRUE;
2900 			}
2901 			break;
2902 		} else if (ahc->msgout_buf[index] >= MSG_SIMPLE_Q_TAG
2903 			&& ahc->msgout_buf[index] <= MSG_IGN_WIDE_RESIDUE) {
2904 
2905 			/* Skip tag type and tag id or residue param*/
2906 			index += 2;
2907 		} else {
2908 			/* Single byte message */
2909 			index++;
2910 		}
2911 	}
2912 	return (found);
2913 }
2914 
2915 static int
2916 ahc_parse_msg(struct ahc_softc *ahc, struct scsipi_periph *periph,
2917 	      struct ahc_devinfo *devinfo)
2918 {
2919 	struct	ahc_initiator_tinfo *tinfo;
2920 	struct	tmode_tstate *tstate;
2921 	int	reject;
2922 	int	done;
2923 	int	response;
2924 	u_int	targ_scsirate;
2925 
2926 	done = MSGLOOP_IN_PROG;
2927 	response = FALSE;
2928 	reject = FALSE;
2929 	tinfo = ahc_fetch_transinfo(ahc, devinfo->channel, devinfo->our_scsiid,
2930 				    devinfo->target, &tstate);
2931 	targ_scsirate = tinfo->scsirate;
2932 
2933 	/*
2934 	 * Parse as much of the message as is available,
2935 	 * rejecting it if we don't support it.  When
2936 	 * the entire message is available and has been
2937 	 * handled, return MSGLOOP_MSGCOMPLETE, indicating
2938 	 * that we have parsed an entire message.
2939 	 *
2940 	 * In the case of extended messages, we accept the length
2941 	 * byte outright and perform more checking once we know the
2942 	 * extended message type.
2943 	 */
2944 	switch (ahc->msgin_buf[0]) {
2945 	case MSG_MESSAGE_REJECT:
2946 		response = ahc_handle_msg_reject(ahc, devinfo);
2947 		/* FALLTHROUGH */
2948 	case MSG_NOOP:
2949 		done = MSGLOOP_MSGCOMPLETE;
2950 		break;
2951 	case MSG_IGN_WIDE_RESIDUE:
2952 	{
2953 		/* Wait for the whole message */
2954 		if (ahc->msgin_index >= 1) {
2955 			if (ahc->msgin_buf[1] != 1
2956 			 || tinfo->current.width == MSG_EXT_WDTR_BUS_8_BIT) {
2957 				reject = TRUE;
2958 				done = MSGLOOP_MSGCOMPLETE;
2959 			} else
2960 				ahc_handle_ign_wide_residue(ahc, devinfo);
2961 		}
2962 		break;
2963 	}
2964 	case MSG_EXTENDED:
2965 	{
2966 		/* Wait for enough of the message to begin validation */
2967 		if (ahc->msgin_index < 2)
2968 			break;
2969 		switch (ahc->msgin_buf[2]) {
2970 		case MSG_EXT_SDTR:
2971 		{
2972 			const struct	 ahc_syncrate *syncrate;
2973 			u_int	 period;
2974 			u_int	 offset;
2975 			u_int	 saved_offset;
2976 
2977 			if (ahc->msgin_buf[1] != MSG_EXT_SDTR_LEN) {
2978 				reject = TRUE;
2979 				break;
2980 			}
2981 
2982 			/*
2983 			 * Wait until we have both args before validating
2984 			 * and acting on this message.
2985 			 *
2986 			 * Add one to MSG_EXT_SDTR_LEN to account for
2987 			 * the extended message preamble.
2988 			 */
2989 			if (ahc->msgin_index < (MSG_EXT_SDTR_LEN + 1))
2990 				break;
2991 
2992 			period = ahc->msgin_buf[3];
2993 			saved_offset = offset = ahc->msgin_buf[4];
2994 			syncrate = ahc_devlimited_syncrate(ahc, &period);
2995 			ahc_validate_offset(ahc, syncrate, &offset,
2996 					    targ_scsirate & WIDEXFER);
2997 			ahc_set_syncrate(ahc, devinfo,
2998 					 syncrate, period, offset,
2999 					 AHC_TRANS_ACTIVE|AHC_TRANS_GOAL,
3000 					 /*paused*/TRUE, /*done*/TRUE);
3001 			ahc_update_xfer_mode(ahc, devinfo);
3002 
3003 			/*
3004 			 * See if we initiated Sync Negotiation
3005 			 * and didn't have to fall down to async
3006 			 * transfers.
3007 			 */
3008 			if (ahc_sent_msg(ahc, MSG_EXT_SDTR, /*full*/TRUE)) {
3009 				/* We started it */
3010 				if (saved_offset != offset) {
3011 					/* Went too low - force async */
3012 					reject = TRUE;
3013 				}
3014 			} else {
3015 				/*
3016 				 * Send our own SDTR in reply
3017 				 */
3018 				ahc->msgout_index = 0;
3019 				ahc->msgout_len = 0;
3020 				ahc_construct_sdtr(ahc, period, offset);
3021 				ahc->msgout_index = 0;
3022 				response = TRUE;
3023 			}
3024 			done = MSGLOOP_MSGCOMPLETE;
3025 			break;
3026 		}
3027 		case MSG_EXT_WDTR:
3028 		{
3029 			u_int	bus_width;
3030 			u_int	sending_reply;
3031 
3032 			sending_reply = FALSE;
3033 			if (ahc->msgin_buf[1] != MSG_EXT_WDTR_LEN) {
3034 				reject = TRUE;
3035 				break;
3036 			}
3037 
3038 			/*
3039 			 * Wait until we have our arg before validating
3040 			 * and acting on this message.
3041 			 *
3042 			 * Add one to MSG_EXT_WDTR_LEN to account for
3043 			 * the extended message preamble.
3044 			 */
3045 			if (ahc->msgin_index < (MSG_EXT_WDTR_LEN + 1))
3046 				break;
3047 
3048 			bus_width = ahc->msgin_buf[3];
3049 			if (ahc_sent_msg(ahc, MSG_EXT_WDTR, /*full*/TRUE)) {
3050 				/*
3051 				 * Don't send a WDTR back to the
3052 				 * target, since we asked first.
3053 				 */
3054 				switch (bus_width){
3055 				default:
3056 					/*
3057 					 * How can we do anything greater
3058 					 * than 16bit transfers on a 16bit
3059 					 * bus?
3060 					 */
3061 					reject = TRUE;
3062 					printf("%s: target %d requested %dBit "
3063 					       "transfers.  Rejecting...\n",
3064 					       ahc_name(ahc), devinfo->target,
3065 					       8 * (0x01 << bus_width));
3066 					/* FALLTHROUGH */
3067 				case MSG_EXT_WDTR_BUS_8_BIT:
3068 					bus_width = MSG_EXT_WDTR_BUS_8_BIT;
3069 					break;
3070 				case MSG_EXT_WDTR_BUS_16_BIT:
3071 					break;
3072 				}
3073 			} else {
3074 				/*
3075 				 * Send our own WDTR in reply
3076 				 */
3077 				switch (bus_width) {
3078 				default:
3079 					if (ahc->features & AHC_WIDE) {
3080 						/* Respond Wide */
3081 						bus_width =
3082 						    MSG_EXT_WDTR_BUS_16_BIT;
3083 						break;
3084 					}
3085 					/* FALLTHROUGH */
3086 				case MSG_EXT_WDTR_BUS_8_BIT:
3087 					bus_width = MSG_EXT_WDTR_BUS_8_BIT;
3088 					break;
3089 				}
3090 				ahc->msgout_index = 0;
3091 				ahc->msgout_len = 0;
3092 				ahc_construct_wdtr(ahc, bus_width);
3093 				ahc->msgout_index = 0;
3094 				response = TRUE;
3095 				sending_reply = TRUE;
3096 			}
3097 			ahc_set_width(ahc, devinfo, bus_width,
3098 				      AHC_TRANS_ACTIVE|AHC_TRANS_GOAL,
3099 				      /*paused*/TRUE, /*done*/TRUE);
3100 
3101 			/* After a wide message, we are async */
3102 			ahc_set_syncrate(ahc, devinfo,
3103 					 /*syncrate*/NULL, /*period*/0,
3104 					 /*offset*/0, AHC_TRANS_ACTIVE,
3105 					 /*paused*/TRUE, /*done*/FALSE);
3106 			if (sending_reply == FALSE && reject == FALSE) {
3107 
3108 				if (tinfo->goal.period) {
3109 					const struct	ahc_syncrate *rate;
3110 					u_int	period;
3111 					u_int	offset;
3112 
3113 					/* Start the sync negotiation */
3114 					period = tinfo->goal.period;
3115 					rate = ahc_devlimited_syncrate(ahc,
3116 								       &period);
3117 					offset = tinfo->goal.offset;
3118 					ahc_validate_offset(ahc, rate, &offset,
3119 							  tinfo->current.width);
3120 					ahc->msgout_index = 0;
3121 					ahc->msgout_len = 0;
3122 					ahc_construct_sdtr(ahc, period, offset);
3123 					ahc->msgout_index = 0;
3124 					response = TRUE;
3125 				} else
3126 					ahc_update_xfer_mode(ahc, devinfo);
3127 			}
3128 			done = MSGLOOP_MSGCOMPLETE;
3129 			break;
3130 		}
3131 		default:
3132 			/* Unknown extended message.  Reject it. */
3133 			reject = TRUE;
3134 			break;
3135 		}
3136 		break;
3137 	}
3138 	case MSG_BUS_DEV_RESET:
3139 		ahc_handle_devreset(ahc, devinfo,
3140 				    XS_RESET, "Bus Device Reset Received",
3141 				    /*verbose_level*/0);
3142 		restart_sequencer(ahc);
3143 		done = MSGLOOP_TERMINATED;
3144 		break;
3145 	case MSG_ABORT_TAG:
3146 	case MSG_ABORT:
3147 	case MSG_CLEAR_QUEUE:
3148 		/* Target mode messages */
3149 		if (devinfo->role != ROLE_TARGET) {
3150 			reject = TRUE;
3151 			break;
3152 		}
3153 #if AHC_TARGET_MODE
3154 		ahc_abort_scbs(ahc, devinfo->target, devinfo->channel,
3155 			       devinfo->lun,
3156 			       ahc->msgin_buf[0] == MSG_ABORT_TAG
3157 						  ? SCB_LIST_NULL
3158 						  : ahc_inb(ahc, INITIATOR_TAG),
3159 			       ROLE_TARGET, XS_DRIVER_STUFFUP);
3160 
3161 		tstate = ahc->enabled_targets[devinfo->our_scsiid];
3162 		if (tstate != NULL) {
3163 			struct tmode_lstate* lstate;
3164 
3165 			lstate = tstate->enabled_luns[devinfo->lun];
3166 			if (lstate != NULL) {
3167 				ahc_queue_lstate_event(ahc, lstate,
3168 						       devinfo->our_scsiid,
3169 						       ahc->msgin_buf[0],
3170 						       /*arg*/0);
3171 				ahc_send_lstate_events(ahc, lstate);
3172 			}
3173 		}
3174 		done = MSGLOOP_MSGCOMPLETE;
3175 #else
3176 		panic("ahc: got target mode message");
3177 #endif
3178 		break;
3179 	case MSG_TERM_IO_PROC:
3180 	default:
3181 		reject = TRUE;
3182 		break;
3183 	}
3184 
3185 	if (reject) {
3186 		/*
3187 		 * Setup to reject the message.
3188 		 */
3189 		ahc->msgout_index = 0;
3190 		ahc->msgout_len = 1;
3191 		ahc->msgout_buf[0] = MSG_MESSAGE_REJECT;
3192 		done = MSGLOOP_MSGCOMPLETE;
3193 		response = TRUE;
3194 	}
3195 
3196 	if (done != MSGLOOP_IN_PROG && !response)
3197 		/* Clear the outgoing message buffer */
3198 		ahc->msgout_len = 0;
3199 
3200 	return (done);
3201 }
3202 
3203 static void
3204 ahc_handle_ign_wide_residue(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
3205 {
3206 	u_int scb_index;
3207 	struct scb *scb;
3208 
3209 	scb_index = ahc_inb(ahc, SCB_TAG);
3210 	scb = &ahc->scb_data->scbarray[scb_index];
3211 	if ((ahc_inb(ahc, SEQ_FLAGS) & DPHASE) == 0
3212 	 || !(scb->xs->xs_control & XS_CTL_DATA_IN)) {
3213 		/*
3214 		 * Ignore the message if we haven't
3215 		 * seen an appropriate data phase yet.
3216 		 */
3217 	} else {
3218 		/*
3219 		 * If the residual occurred on the last
3220 		 * transfer and the transfer request was
3221 		 * expected to end on an odd count, do
3222 		 * nothing.  Otherwise, subtract a byte
3223 		 * and update the residual count accordingly.
3224 		 */
3225 		u_int resid_sgcnt;
3226 
3227 		resid_sgcnt = ahc_inb(ahc, SCB_RESID_SGCNT);
3228 		if (resid_sgcnt == 0
3229 		 && ahc_inb(ahc, DATA_COUNT_ODD) == 1) {
3230 			/*
3231 			 * If the residual occurred on the last
3232 			 * transfer and the transfer request was
3233 			 * expected to end on an odd count, do
3234 			 * nothing.
3235 			 */
3236 		} else {
3237 			u_int data_cnt;
3238 			u_int32_t data_addr;
3239 			u_int sg_index;
3240 
3241 			data_cnt = (ahc_inb(ahc, SCB_RESID_DCNT + 2) << 16)
3242 				 | (ahc_inb(ahc, SCB_RESID_DCNT + 1) << 8)
3243 				 | (ahc_inb(ahc, SCB_RESID_DCNT));
3244 
3245 			data_addr = (ahc_inb(ahc, SHADDR + 3) << 24)
3246 				  | (ahc_inb(ahc, SHADDR + 2) << 16)
3247 				  | (ahc_inb(ahc, SHADDR + 1) << 8)
3248 				  | (ahc_inb(ahc, SHADDR));
3249 
3250 			data_cnt += 1;
3251 			data_addr -= 1;
3252 
3253 			sg_index = scb->sg_count - resid_sgcnt;
3254 
3255 			if (sg_index != 0
3256 			 && (le32toh(scb->sg_list[sg_index].len) < data_cnt)) {
3257 				u_int32_t sg_addr;
3258 
3259 				sg_index--;
3260 				data_cnt = 1;
3261 				data_addr = le32toh(scb->sg_list[sg_index].addr)
3262 					  + le32toh(scb->sg_list[sg_index].len)
3263 					  - 1;
3264 
3265 				/*
3266 				 * The physical address base points to the
3267 				 * second entry as it is always used for
3268 				 * calculating the "next S/G pointer".
3269 				 */
3270 				sg_addr = scb->sg_list_phys
3271 					+ (sg_index* sizeof(*scb->sg_list));
3272 				ahc_outb(ahc, SG_NEXT + 3, sg_addr >> 24);
3273 				ahc_outb(ahc, SG_NEXT + 2, sg_addr >> 16);
3274 				ahc_outb(ahc, SG_NEXT + 1, sg_addr >> 8);
3275 				ahc_outb(ahc, SG_NEXT, sg_addr);
3276 			}
3277 
3278 			ahc_outb(ahc, SCB_RESID_DCNT + 2, data_cnt >> 16);
3279 			ahc_outb(ahc, SCB_RESID_DCNT + 1, data_cnt >> 8);
3280 			ahc_outb(ahc, SCB_RESID_DCNT, data_cnt);
3281 
3282 			ahc_outb(ahc, SHADDR + 3, data_addr >> 24);
3283 			ahc_outb(ahc, SHADDR + 2, data_addr >> 16);
3284 			ahc_outb(ahc, SHADDR + 1, data_addr >> 8);
3285 			ahc_outb(ahc, SHADDR, data_addr);
3286 		}
3287 	}
3288 }
3289 
3290 static void
3291 ahc_handle_devreset(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
3292 		    int status, char *message,
3293 		    int verbose_level)
3294 {
3295 	int found;
3296 
3297 	found = ahc_abort_scbs(ahc, devinfo->target, devinfo->channel,
3298 			       AHC_LUN_WILDCARD, SCB_LIST_NULL, devinfo->role,
3299 			       status);
3300 
3301 	/*
3302 	 * Go back to async/narrow transfers and renegotiate.
3303 	 * ahc_set_width and ahc_set_syncrate can cope with NULL
3304 	 * paths.
3305 	 */
3306 	ahc_set_width(ahc, devinfo, MSG_EXT_WDTR_BUS_8_BIT,
3307 		      AHC_TRANS_CUR, /*paused*/TRUE, /*done*/FALSE);
3308 	ahc_set_syncrate(ahc, devinfo, /*syncrate*/NULL,
3309 			 /*period*/0, /*offset*/0, AHC_TRANS_CUR,
3310 			 /*paused*/TRUE, /*done*/FALSE);
3311 	ahc_update_xfer_mode(ahc, devinfo);
3312 
3313 	if (message != NULL && (verbose_level <= 0))
3314 		printf("%s: %s on %c:%d. %d SCBs aborted\n", ahc_name(ahc),
3315 		       message, devinfo->channel, devinfo->target, found);
3316 }
3317 
3318 /*
3319  * We have an scb which has been processed by the
3320  * adaptor, now we look to see how the operation
3321  * went.
3322  */
3323 static void
3324 ahc_done(struct ahc_softc *ahc, struct scb *scb)
3325 {
3326 	struct scsipi_xfer *xs;
3327 	struct scsipi_periph *periph;
3328 	int requeue = 0;
3329 	int target;
3330 
3331 
3332 	xs = scb->xs;
3333 	periph = xs->xs_periph;
3334 	LIST_REMOVE(scb, plinks);
3335 
3336 	callout_stop(&scb->xs->xs_callout);
3337 
3338 #ifdef AHC_DEBUG
3339 	if (ahc_debug & AHC_SHOWCMDS) {
3340 		scsipi_printaddr(periph);
3341 		printf("ahc_done opcode %d tag %x\n", xs->cmdstore.opcode,
3342 		    scb->hscb->tag);
3343 	}
3344 #endif
3345 
3346 	target = periph->periph_target;
3347 
3348 	if (xs->datalen) {
3349 		int op;
3350 
3351 		if (xs->xs_control & XS_CTL_DATA_IN)
3352 			op = BUS_DMASYNC_POSTREAD;
3353 		else
3354 			op = BUS_DMASYNC_POSTWRITE;
3355 		bus_dmamap_sync(ahc->parent_dmat, scb->dmamap, 0,
3356 		    scb->dmamap->dm_mapsize, op);
3357 		bus_dmamap_unload(ahc->parent_dmat, scb->dmamap);
3358 	}
3359 
3360 	/*
3361 	 * Unbusy this target/channel/lun.
3362 	 * XXX if we are holding two commands per lun,
3363 	 *     send the next command.
3364 	 */
3365 	if (!(scb->hscb->control & TAG_ENB))
3366 		ahc_index_busy_tcl(ahc, scb->hscb->tcl, /*unbusy*/TRUE);
3367 
3368 	/*
3369 	 * If the recovery SCB completes, we have to be
3370 	 * out of our timeout.
3371 	 */
3372 	if ((scb->flags & SCB_RECOVERY_SCB) != 0) {
3373 
3374 		struct	scb *scbp;
3375 
3376 		/*
3377 		 * We were able to complete the command successfully,
3378 		 * so reinstate the timeouts for all other pending
3379 		 * commands.
3380 		 */
3381 		scbp = ahc->pending_ccbs.lh_first;
3382 		while (scbp != NULL) {
3383 			struct scsipi_xfer *txs = scbp->xs;
3384 
3385 			if (!(txs->xs_control & XS_CTL_POLL)) {
3386 				callout_reset(&scbp->xs->xs_callout,
3387 				    mstohz(scbp->xs->timeout),
3388 				    ahc_timeout, scbp);
3389 			}
3390 			scbp = LIST_NEXT(scbp, plinks);
3391 		}
3392 
3393 		/*
3394 		 * Ensure that we didn't put a second instance of this
3395 		 * SCB into the QINFIFO.
3396 		 */
3397 		ahc_search_qinfifo(ahc, SCB_TARGET(scb), SCB_CHANNEL(scb),
3398 				   SCB_LUN(scb), scb->hscb->tag,
3399 				   ROLE_INITIATOR, /*status*/0,
3400 				   SEARCH_REMOVE);
3401 		if (xs->error != XS_NOERROR)
3402 			ahcsetccbstatus(xs, XS_TIMEOUT);
3403 		scsipi_printaddr(xs->xs_periph);
3404 		printf("no longer in timeout, status = %x\n", xs->status);
3405 	}
3406 
3407 	if (xs->error != XS_NOERROR) {
3408 		/* Don't clobber any existing error state */
3409 	} else if ((scb->flags & SCB_SENSE) != 0) {
3410 		/*
3411 		 * We performed autosense retrieval.
3412 		 *
3413 		 * zero the sense data before having
3414 		 * the drive fill it.  The SCSI spec mandates
3415 		 * that any untransferred data should be
3416 		 * assumed to be zero.  Complete the 'bounce'
3417 		 * of sense information through buffers accessible
3418 		 * via bus-space by copying it into the clients
3419 		 * csio.
3420 		 */
3421 		memset(&xs->sense.scsi_sense, 0, sizeof(xs->sense.scsi_sense));
3422 		memcpy(&xs->sense.scsi_sense,
3423 		    &ahc->scb_data->sense[scb->hscb->tag],
3424 		    le32toh(scb->sg_list->len));
3425 		xs->error = XS_SENSE;
3426 	}
3427 	if (scb->flags & SCB_FREEZE_QUEUE) {
3428 		scsipi_periph_thaw(periph, 1);
3429 		scb->flags &= ~SCB_FREEZE_QUEUE;
3430 	}
3431 
3432 	requeue = scb->flags & SCB_REQUEUE;
3433 	ahcfreescb(ahc, scb);
3434 
3435 	if (requeue) {
3436 		xs->error = XS_REQUEUE;
3437 	}
3438 	scsipi_done(xs);
3439 }
3440 
3441 /*
3442  * Determine the number of SCBs available on the controller
3443  */
3444 int
3445 ahc_probe_scbs(struct ahc_softc *ahc) {
3446 	int i;
3447 
3448 	for (i = 0; i < AHC_SCB_MAX; i++) {
3449 		ahc_outb(ahc, SCBPTR, i);
3450 		ahc_outb(ahc, SCB_CONTROL, i);
3451 		if (ahc_inb(ahc, SCB_CONTROL) != i)
3452 			break;
3453 		ahc_outb(ahc, SCBPTR, 0);
3454 		if (ahc_inb(ahc, SCB_CONTROL) != 0)
3455 			break;
3456 	}
3457 	return (i);
3458 }
3459 
3460 /*
3461  * Start the board, ready for normal operation
3462  */
3463 int
3464 ahc_init(struct ahc_softc *ahc)
3465 {
3466 	int	  max_targ = 15;
3467 	int	  i;
3468 	int	  term;
3469 	u_int	  scsi_conf;
3470 	u_int	  scsiseq_template;
3471 	u_int	  ultraenb;
3472 	u_int	  discenable;
3473 	u_int	  tagenable;
3474 	size_t	  driver_data_size;
3475 	u_int32_t physaddr;
3476 
3477 #ifdef AHC_PRINT_SRAM
3478 	printf("Scratch Ram:");
3479 	for (i = 0x20; i < 0x5f; i++) {
3480 		if (((i % 8) == 0) && (i != 0)) {
3481 			printf ("\n              ");
3482 		}
3483 		printf (" 0x%x", ahc_inb(ahc, i));
3484 	}
3485 	if ((ahc->features & AHC_MORE_SRAM) != 0) {
3486 		for (i = 0x70; i < 0x7f; i++) {
3487 			if (((i % 8) == 0) && (i != 0)) {
3488 				printf ("\n              ");
3489 			}
3490 			printf (" 0x%x", ahc_inb(ahc, i));
3491 		}
3492 	}
3493 	printf ("\n");
3494 #endif
3495 
3496 	/*
3497 	 * Assume we have a board at this stage and it has been reset.
3498 	 */
3499 	if ((ahc->flags & AHC_USEDEFAULTS) != 0)
3500 		ahc->our_id = ahc->our_id_b = 7;
3501 
3502 	/*
3503 	 * Default to allowing initiator operations.
3504 	 */
3505 	ahc->flags |= AHC_INITIATORMODE;
3506 
3507 	/*
3508 	 * DMA tag for our command fifos and other data in system memory
3509 	 * the card's sequencer must be able to access.  For initiator
3510 	 * roles, we need to allocate space for the qinfifo, qoutfifo,
3511 	 * and untagged_scb arrays each of which are composed of 256
3512 	 * 1 byte elements.  When providing for the target mode role,
3513 	 * we additionally must provide space for the incoming target
3514 	 * command fifo.
3515 	 */
3516 	driver_data_size = 3 * 256 * sizeof(u_int8_t);
3517 
3518 	if (ahc_createdmamem(ahc->parent_dmat, driver_data_size,
3519 	    ahc->sc_dmaflags,
3520 	    &ahc->shared_data_dmamap, (caddr_t *)&ahc->qoutfifo,
3521 	    &ahc->shared_data_busaddr, &ahc->shared_data_seg,
3522 	    &ahc->shared_data_nseg, ahc_name(ahc), "shared data") < 0)
3523 		return (ENOMEM);
3524 
3525 	ahc->init_level++;
3526 
3527 	/* Allocate SCB data now that parent_dmat is initialized */
3528 	if (ahc->scb_data->maxhscbs == 0)
3529 		if (ahcinitscbdata(ahc) != 0)
3530 			return (ENOMEM);
3531 
3532 	ahc->qinfifo = &ahc->qoutfifo[256];
3533 	ahc->untagged_scbs = &ahc->qinfifo[256];
3534 	/* There are no untagged SCBs active yet. */
3535 	for (i = 0; i < 256; i++)
3536 		ahc->untagged_scbs[i] = SCB_LIST_NULL;
3537 
3538 	/* All of our queues are empty */
3539 	for (i = 0; i < 256; i++)
3540 		ahc->qoutfifo[i] = SCB_LIST_NULL;
3541 
3542 	bus_dmamap_sync(ahc->parent_dmat, ahc->shared_data_dmamap, 0,
3543 	    driver_data_size, BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
3544 
3545 	/*
3546 	 * Allocate a tstate to house information for our
3547 	 * initiator presence on the bus as well as the user
3548 	 * data for any target mode initiator.
3549 	 */
3550 	if (ahc_alloc_tstate(ahc, ahc->our_id, 'A') == NULL) {
3551 		printf("%s: unable to allocate tmode_tstate.  "
3552 		       "Failing attach\n", ahc_name(ahc));
3553 		return (-1);
3554 	}
3555 
3556 	if ((ahc->features & AHC_TWIN) != 0) {
3557 		if (ahc_alloc_tstate(ahc, ahc->our_id_b, 'B') == NULL) {
3558 			printf("%s: unable to allocate tmode_tstate.  "
3559 			       "Failing attach\n", ahc_name(ahc));
3560 			return (-1);
3561 		}
3562  		printf("Twin Channel, A SCSI Id=%d, B SCSI Id=%d, primary %c, ",
3563 		       ahc->our_id, ahc->our_id_b,
3564 		       ahc->flags & AHC_CHANNEL_B_PRIMARY? 'B': 'A');
3565 	} else {
3566 		if ((ahc->features & AHC_WIDE) != 0) {
3567 			printf("Wide ");
3568 		} else {
3569 			printf("Single ");
3570 		}
3571 		printf("Channel %c, SCSI Id=%d, ", ahc->channel, ahc->our_id);
3572 	}
3573 
3574 	ahc_outb(ahc, SEQ_FLAGS, 0);
3575 
3576 	if (ahc->scb_data->maxhscbs < AHC_SCB_MAX) {
3577 		ahc->flags |= AHC_PAGESCBS;
3578 		printf("%d/%d SCBs\n", ahc->scb_data->maxhscbs, AHC_SCB_MAX);
3579 	} else {
3580 		ahc->flags &= ~AHC_PAGESCBS;
3581 		printf("%d SCBs\n", ahc->scb_data->maxhscbs);
3582 	}
3583 
3584 #ifdef AHC_DEBUG
3585 	if (ahc_debug & AHC_SHOWMISC) {
3586 		printf("%s: hardware scb %lu bytes; kernel scb %lu bytes; "
3587 		       "ahc_dma %lu bytes\n",
3588 			ahc_name(ahc),
3589 		        (unsigned long) sizeof(struct hardware_scb),
3590 			(unsigned long) sizeof(struct scb),
3591 			(unsigned long) sizeof(struct ahc_dma_seg));
3592 	}
3593 #endif /* AHC_DEBUG */
3594 
3595 	/* Set the SCSI Id, SXFRCTL0, SXFRCTL1, and SIMODE1, for both channels*/
3596 	if (ahc->features & AHC_TWIN) {
3597 
3598 		/*
3599 		 * The device is gated to channel B after a chip reset,
3600 		 * so set those values first
3601 		 */
3602 		term = (ahc->flags & AHC_TERM_ENB_B) != 0 ? STPWEN : 0;
3603 		if ((ahc->features & AHC_ULTRA2) != 0)
3604 			ahc_outb(ahc, SCSIID_ULTRA2, ahc->our_id_b);
3605 		else
3606 			ahc_outb(ahc, SCSIID, ahc->our_id_b);
3607 		scsi_conf = ahc_inb(ahc, SCSICONF + 1);
3608 		ahc_outb(ahc, SXFRCTL1, (scsi_conf & (ENSPCHK|STIMESEL))
3609 					|term|ENSTIMER|ACTNEGEN);
3610 		ahc_outb(ahc, SIMODE1, ENSELTIMO|ENSCSIRST|ENSCSIPERR);
3611 		ahc_outb(ahc, SXFRCTL0, DFON|SPIOEN);
3612 
3613 		if ((scsi_conf & RESET_SCSI) != 0
3614 		 && (ahc->flags & AHC_INITIATORMODE) != 0)
3615 			ahc->flags |= AHC_RESET_BUS_B;
3616 
3617 		/* Select Channel A */
3618 		ahc_outb(ahc, SBLKCTL, ahc_inb(ahc, SBLKCTL) & ~SELBUSB);
3619 	}
3620 	term = (ahc->flags & AHC_TERM_ENB_A) != 0 ? STPWEN : 0;
3621 	if ((ahc->features & AHC_ULTRA2) != 0)
3622 		ahc_outb(ahc, SCSIID_ULTRA2, ahc->our_id);
3623 	else
3624 		ahc_outb(ahc, SCSIID, ahc->our_id);
3625 	scsi_conf = ahc_inb(ahc, SCSICONF);
3626 	ahc_outb(ahc, SXFRCTL1, (scsi_conf & (ENSPCHK|STIMESEL))
3627 				|term
3628 				|ENSTIMER|ACTNEGEN);
3629 	ahc_outb(ahc, SIMODE1, ENSELTIMO|ENSCSIRST|ENSCSIPERR);
3630 	ahc_outb(ahc, SXFRCTL0, DFON|SPIOEN);
3631 
3632 	if ((scsi_conf & RESET_SCSI) != 0
3633 	 && (ahc->flags & AHC_INITIATORMODE) != 0)
3634 		ahc->flags |= AHC_RESET_BUS_A;
3635 
3636 	/*
3637 	 * Look at the information that board initialization or
3638 	 * the board bios has left us.
3639 	 */
3640 	ultraenb = 0;
3641 	tagenable = ALL_TARGETS_MASK;
3642 
3643 	/* Grab the disconnection disable table and invert it for our needs */
3644 	if (ahc->flags & AHC_USEDEFAULTS) {
3645 		printf("%s: Host Adapter Bios disabled.  Using default SCSI "
3646 			"device parameters\n", ahc_name(ahc));
3647 		ahc->flags |= AHC_EXTENDED_TRANS_A|AHC_EXTENDED_TRANS_B|
3648 			      AHC_TERM_ENB_A|AHC_TERM_ENB_B;
3649 		discenable = ALL_TARGETS_MASK;
3650 		if ((ahc->features & AHC_ULTRA) != 0)
3651 			ultraenb = ALL_TARGETS_MASK;
3652 	} else {
3653 		discenable = ~((ahc_inb(ahc, DISC_DSB + 1) << 8)
3654 			   | ahc_inb(ahc, DISC_DSB));
3655 		if ((ahc->features & (AHC_ULTRA|AHC_ULTRA2)) != 0)
3656 			ultraenb = (ahc_inb(ahc, ULTRA_ENB + 1) << 8)
3657 				      | ahc_inb(ahc, ULTRA_ENB);
3658 	}
3659 
3660 	if ((ahc->features & (AHC_WIDE|AHC_TWIN)) == 0)
3661 		max_targ = 7;
3662 
3663 	for (i = 0; i <= max_targ; i++) {
3664 		struct ahc_initiator_tinfo *tinfo;
3665 		struct tmode_tstate *tstate;
3666 		u_int our_id;
3667 		u_int target_id;
3668 		char channel;
3669 
3670 		channel = 'A';
3671 		our_id = ahc->our_id;
3672 		target_id = i;
3673 		if (i > 7 && (ahc->features & AHC_TWIN) != 0) {
3674 			channel = 'B';
3675 			our_id = ahc->our_id_b;
3676 			target_id = i % 8;
3677 		}
3678 		tinfo = ahc_fetch_transinfo(ahc, channel, our_id,
3679 					    target_id, &tstate);
3680 		/* Default to async narrow across the board */
3681 		memset(tinfo, 0, sizeof(*tinfo));
3682 		if (ahc->flags & AHC_USEDEFAULTS) {
3683 			if ((ahc->features & AHC_WIDE) != 0)
3684 				tinfo->user.width = MSG_EXT_WDTR_BUS_16_BIT;
3685 
3686 			/*
3687 			 * These will be truncated when we determine the
3688 			 * connection type we have with the target.
3689 			 */
3690 			tinfo->user.period = ahc_syncrates->period;
3691 			tinfo->user.offset = ~0;
3692 		} else {
3693 			u_int scsirate;
3694 			u_int16_t mask;
3695 
3696 			/* Take the settings leftover in scratch RAM. */
3697 			scsirate = ahc_inb(ahc, TARG_SCSIRATE + i);
3698 			mask = (0x01 << i);
3699 			if ((ahc->features & AHC_ULTRA2) != 0) {
3700 				u_int offset;
3701 				u_int maxsync;
3702 
3703 				if ((scsirate & SOFS) == 0x0F) {
3704 					/*
3705 					 * Haven't negotiated yet,
3706 					 * so the format is different.
3707 					 */
3708 					scsirate = (scsirate & SXFR) >> 4
3709 						 | (ultraenb & mask)
3710 						  ? 0x08 : 0x0
3711 						 | (scsirate & WIDEXFER);
3712 					offset = MAX_OFFSET_ULTRA2;
3713 				} else
3714 					offset = ahc_inb(ahc, TARG_OFFSET + i);
3715 				maxsync = AHC_SYNCRATE_ULTRA2;
3716 				if ((ahc->features & AHC_DT) != 0)
3717 					maxsync = AHC_SYNCRATE_DT;
3718 				tinfo->user.period =
3719 				    ahc_find_period(ahc, scsirate, maxsync);
3720 				if (offset == 0)
3721 					tinfo->user.period = 0;
3722 				else
3723 					tinfo->user.offset = ~0;
3724 			} else if ((scsirate & SOFS) != 0) {
3725 				tinfo->user.period =
3726 				    ahc_find_period(ahc, scsirate,
3727 						    (ultraenb & mask)
3728 						   ? AHC_SYNCRATE_ULTRA
3729 						   : AHC_SYNCRATE_FAST);
3730 				if (tinfo->user.period != 0)
3731 					tinfo->user.offset = ~0;
3732 			}
3733 			if ((scsirate & WIDEXFER) != 0
3734 			 && (ahc->features & AHC_WIDE) != 0)
3735 				tinfo->user.width = MSG_EXT_WDTR_BUS_16_BIT;
3736 		}
3737 		tinfo->goal = tinfo->user; /* force negotiation */
3738 		tstate->ultraenb = ultraenb;
3739 		tstate->discenable = discenable;
3740 		tstate->tagenable = 0; /* Wait until the XPT says its okay */
3741 		tstate->tagdisable = 0;
3742 	}
3743 	ahc->user_discenable = discenable;
3744 	ahc->user_tagenable = tagenable;
3745 
3746 	/*
3747 	 * Tell the sequencer where it can find our arrays in memory.
3748 	 */
3749 	physaddr = ahc->scb_data->hscb_busaddr;
3750 	ahc_outb(ahc, HSCB_ADDR, physaddr & 0xFF);
3751 	ahc_outb(ahc, HSCB_ADDR + 1, (physaddr >> 8) & 0xFF);
3752 	ahc_outb(ahc, HSCB_ADDR + 2, (physaddr >> 16) & 0xFF);
3753 	ahc_outb(ahc, HSCB_ADDR + 3, (physaddr >> 24) & 0xFF);
3754 
3755 	physaddr = ahc->shared_data_busaddr;
3756 	ahc_outb(ahc, SCBID_ADDR, physaddr & 0xFF);
3757 	ahc_outb(ahc, SCBID_ADDR + 1, (physaddr >> 8) & 0xFF);
3758 	ahc_outb(ahc, SCBID_ADDR + 2, (physaddr >> 16) & 0xFF);
3759 	ahc_outb(ahc, SCBID_ADDR + 3, (physaddr >> 24) & 0xFF);
3760 
3761 	/* Target mode incomding command fifo */
3762 	physaddr += 3 * 256 * sizeof(u_int8_t);
3763 	ahc_outb(ahc, TMODE_CMDADDR, physaddr & 0xFF);
3764 	ahc_outb(ahc, TMODE_CMDADDR + 1, (physaddr >> 8) & 0xFF);
3765 	ahc_outb(ahc, TMODE_CMDADDR + 2, (physaddr >> 16) & 0xFF);
3766 	ahc_outb(ahc, TMODE_CMDADDR + 3, (physaddr >> 24) & 0xFF);
3767 
3768 	/*
3769 	 * Initialize the group code to command length table.
3770 	 * This overrides the values in TARG_SCSIRATE, so only
3771 	 * setup the table after we have processed that information.
3772 	 */
3773 	ahc_outb(ahc, CMDSIZE_TABLE, 5);
3774 	ahc_outb(ahc, CMDSIZE_TABLE + 1, 9);
3775 	ahc_outb(ahc, CMDSIZE_TABLE + 2, 9);
3776 	ahc_outb(ahc, CMDSIZE_TABLE + 3, 0);
3777 	ahc_outb(ahc, CMDSIZE_TABLE + 4, 15);
3778 	ahc_outb(ahc, CMDSIZE_TABLE + 5, 11);
3779 	ahc_outb(ahc, CMDSIZE_TABLE + 6, 0);
3780 	ahc_outb(ahc, CMDSIZE_TABLE + 7, 0);
3781 
3782 	/* Tell the sequencer of our initial queue positions */
3783 	ahc_outb(ahc, KERNEL_QINPOS, 0);
3784 	ahc_outb(ahc, QINPOS, 0);
3785 	ahc_outb(ahc, QOUTPOS, 0);
3786 
3787 #ifdef AHC_DEBUG
3788 	if (ahc_debug & AHC_SHOWMISC)
3789 		printf("DISCENABLE == 0x%x\nULTRAENB == 0x%x\n",
3790 		       discenable, ultraenb);
3791 #endif
3792 
3793 	/* Don't have any special messages to send to targets */
3794 	ahc_outb(ahc, TARGET_MSG_REQUEST, 0);
3795 	ahc_outb(ahc, TARGET_MSG_REQUEST + 1, 0);
3796 
3797 	/*
3798 	 * Use the built in queue management registers
3799 	 * if they are available.
3800 	 */
3801 	if ((ahc->features & AHC_QUEUE_REGS) != 0) {
3802 		ahc_outb(ahc, QOFF_CTLSTA, SCB_QSIZE_256);
3803 		ahc_outb(ahc, SDSCB_QOFF, 0);
3804 		ahc_outb(ahc, SNSCB_QOFF, 0);
3805 		ahc_outb(ahc, HNSCB_QOFF, 0);
3806 	}
3807 
3808 
3809 	/* We don't have any waiting selections */
3810 	ahc_outb(ahc, WAITING_SCBH, SCB_LIST_NULL);
3811 
3812 	/* Our disconnection list is empty too */
3813 	ahc_outb(ahc, DISCONNECTED_SCBH, SCB_LIST_NULL);
3814 
3815 	/* Message out buffer starts empty */
3816 	ahc_outb(ahc, MSG_OUT, MSG_NOOP);
3817 
3818 	/*
3819 	 * Setup the allowed SCSI Sequences based on operational mode.
3820 	 * If we are a target, we'll enable select in operations once
3821 	 * we've had a lun enabled.
3822 	 */
3823 	scsiseq_template = ENSELO|ENAUTOATNO|ENAUTOATNP;
3824 	if ((ahc->flags & AHC_INITIATORMODE) != 0)
3825 		scsiseq_template |= ENRSELI;
3826 	ahc_outb(ahc, SCSISEQ_TEMPLATE, scsiseq_template);
3827 
3828 	/*
3829 	 * Load the Sequencer program and Enable the adapter
3830 	 * in "fast" mode.
3831          */
3832 #ifdef AHC_DEBUG
3833 	printf("%s: Downloading Sequencer Program...",
3834 	       ahc_name(ahc));
3835 #endif
3836 
3837 	ahc_loadseq(ahc);
3838 
3839 	/* We have to wait until after any system dumps... */
3840 	shutdownhook_establish(ahc_shutdown, ahc);
3841 
3842 	return (0);
3843 }
3844 
3845 static int
3846 ahc_ioctl(struct scsipi_channel *channel, u_long cmd, caddr_t addr, int flag,
3847 	  struct proc *p)
3848 {
3849 	struct ahc_softc *ahc = (void *)channel->chan_adapter->adapt_dev;
3850 	int s, ret = ENOTTY;
3851 
3852 	switch (cmd) {
3853 	case SCBUSIORESET:
3854 		s = splbio();
3855 		ahc_reset_channel(ahc, channel->chan_channel == 1 ? 'B' : 'A',
3856 		    TRUE);
3857 		splx(s);
3858 		ret = 0;
3859 		break;
3860 	default:
3861 		break;
3862 	}
3863 
3864 	return ret;
3865 }
3866 
3867 
3868 /*
3869  * XXX fvdl the busy_tcl checks and settings should only be done
3870  * for the non-tagged queueing case, but we don't do tagged queueing
3871  * yet, so..
3872  */
3873 static void
3874 ahc_action(struct scsipi_channel *chan, scsipi_adapter_req_t req, void *arg)
3875 {
3876 	struct scsipi_xfer *xs;
3877 	struct scsipi_periph *periph;
3878 	struct ahc_softc *ahc = (void *)chan->chan_adapter->adapt_dev;
3879 	struct scb *scb;
3880 	struct hardware_scb *hscb;
3881 	struct ahc_initiator_tinfo *tinfo;
3882 	struct tmode_tstate *tstate;
3883 	u_int target_id;
3884 	u_int our_id;
3885 	int s, tcl;
3886 	u_int16_t mask;
3887 	char channel;
3888 
3889 	switch (req) {
3890 	case ADAPTER_REQ_RUN_XFER:
3891 		xs = arg;
3892 		periph = xs->xs_periph;
3893 
3894 		SC_DEBUG(xs->xs_periph, SCSIPI_DB3, ("ahc_action\n"));
3895 
3896 		/* must protect the queue */
3897 		s = splbio();
3898 
3899 		tcl = XS_TCL(ahc, xs);
3900 
3901 		if (!ahc_istagged_device(ahc, xs, 0) &&
3902 		     ahc_index_busy_tcl(ahc, tcl, FALSE) != SCB_LIST_NULL) {
3903 			panic("ahc_action: not tagged and device busy");
3904 		}
3905 
3906 
3907 		target_id = periph->periph_target;
3908 		our_id = SIM_SCSI_ID(ahc, periph);
3909 
3910 		/*
3911 		 * get an scb to use.
3912 		 */
3913 		if ((scb = ahcgetscb(ahc)) == NULL) {
3914 			xs->error = XS_RESOURCE_SHORTAGE;
3915 			scsipi_done(xs);
3916 			splx(s);
3917 			return;
3918 		}
3919 
3920 		tcl = XS_TCL(ahc, xs);
3921 
3922 #ifdef DIAGNOSTIC
3923 		if (!ahc_istagged_device(ahc, xs, 0) &&
3924 		    ahc_index_busy_tcl(ahc, tcl, FALSE) != SCB_LIST_NULL)
3925 			panic("ahc: queuing for busy target");
3926 #endif
3927 
3928 		scb->xs = xs;
3929 		hscb = scb->hscb;
3930 		hscb->tcl = tcl;
3931 
3932 		if (xs->xs_tag_type) {
3933 #ifdef DIAGNOSTIC
3934 		if (ahc_istagged_device(ahc, xs, 0) == 0)
3935 			panic("ahc_action: taggged command for untagged device");
3936 #endif
3937 			scb->hscb->control |= TAG_ENB;
3938 		} else
3939 			ahc_busy_tcl(ahc, scb);
3940 
3941 		splx(s);
3942 
3943 		channel = SIM_CHANNEL(ahc, periph);
3944 		if (ahc->inited_channels[channel - 'A'] == 0) {
3945 			if ((channel == 'A' &&
3946 			     (ahc->flags & AHC_RESET_BUS_A)) ||
3947 			    (channel == 'B' &&
3948 			     (ahc->flags & AHC_RESET_BUS_B))) {
3949 				s = splbio();
3950 				ahc_reset_channel(ahc, channel, TRUE);
3951 				splx(s);
3952 			}
3953 			ahc->inited_channels[channel - 'A'] = 1;
3954 		}
3955 
3956 		/*
3957 		 * Put all the arguments for the xfer in the scb
3958 		 */
3959 
3960 		mask = SCB_TARGET_MASK(scb);
3961 		tinfo = ahc_fetch_transinfo(ahc,
3962 			    SIM_CHANNEL(ahc, periph),
3963 			    our_id, target_id, &tstate);
3964 		if (ahc->inited_targets[target_id] == 0) {
3965 			struct ahc_devinfo devinfo;
3966 			s = splbio();
3967 			ahc_compile_devinfo(&devinfo, our_id, target_id,
3968 			    periph->periph_lun,
3969 			    SIM_CHANNEL(ahc, periph),
3970 			    ROLE_INITIATOR);
3971 			ahc_update_target_msg_request(ahc, &devinfo, tinfo,
3972 			    TRUE, FALSE);
3973 			ahc->inited_targets[target_id] = 1;
3974 			splx(s);
3975 		}
3976 		hscb->scsirate = tinfo->scsirate;
3977 		hscb->scsioffset = tinfo->current.offset;
3978 		if ((tstate->ultraenb & mask) != 0)
3979 			hscb->control |= ULTRAENB;
3980 
3981 		if ((tstate->discenable & mask) != 0)
3982 			hscb->control |= DISCENB;
3983 
3984 		if (xs->xs_control & XS_CTL_RESET) {
3985 			hscb->cmdpointer = 0;
3986 			scb->flags |= SCB_DEVICE_RESET;
3987 			hscb->control |= MK_MESSAGE;
3988 			ahc_execute_scb(scb, NULL, 0);
3989 		}
3990 
3991 		ahc_setup_data(ahc, xs, scb);
3992 		return;
3993 	case ADAPTER_REQ_GROW_RESOURCES:
3994 		/* XXX not supported */
3995 		return;
3996 	case ADAPTER_REQ_SET_XFER_MODE:
3997 	{
3998 		struct scsipi_xfer_mode *xm = arg;
3999 		struct ahc_devinfo devinfo;
4000 		int target_id, our_id;
4001 		char channel;
4002 
4003 		target_id = xm->xm_target;
4004 		our_id = chan->chan_id;
4005 		channel = (chan->chan_channel == 1) ? 'B' : 'A';
4006 		s = splbio();
4007 		tinfo = ahc_fetch_transinfo(ahc, channel, our_id, target_id,
4008 		    &tstate);
4009 		ahc_compile_devinfo(&devinfo, our_id, target_id,
4010 		    0, channel, ROLE_INITIATOR);
4011 		ahc->inited_targets[target_id] = 2;
4012 		if (xm->xm_mode & PERIPH_CAP_TQING &&
4013 		    (tstate->tagdisable & devinfo.target_mask) == 0) {
4014 			ahc_set_tags(ahc, &devinfo, TRUE);
4015 		}
4016 		splx(s);
4017 		ahc_update_xfer_mode(ahc, &devinfo);
4018 	}
4019 	}
4020 }
4021 
4022 static void
4023 ahc_execute_scb(void *arg, bus_dma_segment_t *dm_segs, int nsegments)
4024 {
4025 	struct	 scb *scb;
4026 	struct scsipi_xfer *xs;
4027 	struct	 ahc_softc *ahc;
4028 	int	 s;
4029 
4030 	scb = (struct scb *)arg;
4031 	xs = scb->xs;
4032 	ahc = (void *)xs->xs_periph->periph_channel->chan_adapter->adapt_dev;
4033 
4034 
4035 	if (nsegments != 0) {
4036 		struct	  ahc_dma_seg *sg;
4037 		bus_dma_segment_t *end_seg;
4038 		int op;
4039 
4040 		end_seg = dm_segs + nsegments;
4041 
4042 		/* Copy the first SG into the data pointer area */
4043 		scb->hscb->data = dm_segs->ds_addr;
4044 		scb->hscb->datalen = dm_segs->ds_len;
4045 
4046 		/* Copy the segments into our SG list */
4047 		sg = scb->sg_list;
4048 		while (dm_segs < end_seg) {
4049 			sg->addr = dm_segs->ds_addr;
4050 			sg->len = dm_segs->ds_len;
4051 			ahc_swap_sg(sg);
4052 			sg++;
4053 			dm_segs++;
4054 		}
4055 
4056 		/* Note where to find the SG entries in bus space */
4057 		scb->hscb->SG_pointer = scb->sg_list_phys;
4058 
4059 		if (xs->xs_control & XS_CTL_DATA_IN)
4060 			op = BUS_DMASYNC_PREREAD;
4061 		else
4062 			op = BUS_DMASYNC_PREWRITE;
4063 
4064 		bus_dmamap_sync(ahc->parent_dmat, scb->dmamap, 0,
4065 		    scb->dmamap->dm_mapsize, op);
4066 
4067 	} else {
4068 		scb->hscb->SG_pointer = 0;
4069 		scb->hscb->data = 0;
4070 		scb->hscb->datalen = 0;
4071 	}
4072 
4073 	scb->sg_count = scb->hscb->SG_count = nsegments;
4074 
4075 	s = splbio();
4076 
4077 	/*
4078 	 * Last time we need to check if this SCB needs to
4079 	 * be aborted.
4080 	 */
4081 	if (xs->xs_status & XS_STS_DONE) {
4082 		if (!ahc_istagged_device(ahc, xs, 0))
4083 			ahc_index_busy_tcl(ahc, scb->hscb->tcl, TRUE);
4084 		if (nsegments != 0)
4085 			bus_dmamap_unload(ahc->parent_dmat, scb->dmamap);
4086 		ahcfreescb(ahc, scb);
4087 		splx(s);
4088 		return;
4089 	}
4090 
4091 #ifdef DIAGNOSTIC
4092 	if (scb->sg_count > 255)
4093 		panic("ahc bad sg_count");
4094 #endif
4095 
4096 	ahc_swap_hscb(scb->hscb);
4097 
4098 	LIST_INSERT_HEAD(&ahc->pending_ccbs, scb, plinks);
4099 
4100 	scb->flags |= SCB_ACTIVE;
4101 
4102 	if (!(xs->xs_control & XS_CTL_POLL))
4103 		callout_reset(&scb->xs->xs_callout, mstohz(xs->timeout),
4104 		    ahc_timeout, scb);
4105 
4106 	if ((scb->flags & SCB_TARGET_IMMEDIATE) != 0) {
4107 #if 0
4108 		printf("Continueing Immediate Command %d:%d\n",
4109 		       xs->xs_periph->periph_target,
4110 		       xs->xs_periph->periph_lun);
4111 #endif
4112 		pause_sequencer(ahc);
4113 		if ((ahc->flags & AHC_PAGESCBS) == 0)
4114 			ahc_outb(ahc, SCBPTR, scb->hscb->tag);
4115 		ahc_outb(ahc, SCB_TAG, scb->hscb->tag);
4116 		ahc_outb(ahc, RETURN_1, CONT_MSG_LOOP);
4117 		unpause_sequencer(ahc);
4118 	} else {
4119 
4120 #if 0
4121 		printf("tag %x at qpos %u vaddr %p paddr 0x%lx\n",
4122 		    scb->hscb->tag, ahc->qinfifonext,
4123 		    &ahc->qinfifo[ahc->qinfifonext],
4124 		    ahc->shared_data_busaddr + 1024 + ahc->qinfifonext);
4125 #endif
4126 
4127 		ahc->qinfifo[ahc->qinfifonext++] = scb->hscb->tag;
4128 
4129 		bus_dmamap_sync(ahc->parent_dmat, ahc->shared_data_dmamap,
4130 		    QINFIFO_OFFSET * 256, 256, BUS_DMASYNC_PREWRITE);
4131 
4132 		if ((ahc->features & AHC_QUEUE_REGS) != 0) {
4133 			ahc_outb(ahc, HNSCB_QOFF, ahc->qinfifonext);
4134 		} else {
4135 			pause_sequencer(ahc);
4136 			ahc_outb(ahc, KERNEL_QINPOS, ahc->qinfifonext);
4137 			unpause_sequencer(ahc);
4138 		}
4139 	}
4140 
4141 #ifdef AHC_DEBUG
4142 	if (ahc_debug & AHC_SHOWCMDS) {
4143 		scsi_print_addr(xs->xs_periph);
4144 		printf("opcode %d tag %x len %d flags %x control %x fpos %u"
4145 		    " rate %x\n",
4146 		    xs->cmdstore.opcode, scb->hscb->tag, scb->hscb->datalen,
4147 		    scb->flags, scb->hscb->control, ahc->qinfifonext,
4148 		    scb->hscb->scsirate);
4149 	}
4150 #endif
4151 
4152 	if (!(xs->xs_control & XS_CTL_POLL)) {
4153 		splx(s);
4154 		return;
4155 	}
4156 	/*
4157 	 * If we can't use interrupts, poll for completion
4158 	 */
4159 	SC_DEBUG(xs->xs_periph, SCSIPI_DB3, ("cmd_poll\n"));
4160 	do {
4161 		if (ahc_poll(ahc, xs->timeout)) {
4162 			if (!(xs->xs_control & XS_CTL_SILENT))
4163 				printf("cmd fail\n");
4164 			ahc_timeout(scb);
4165 			break;
4166 		}
4167 	} while (!(xs->xs_status & XS_STS_DONE));
4168 	splx(s);
4169 	return;
4170 }
4171 
4172 static int
4173 ahc_poll(struct ahc_softc *ahc, int wait)
4174 {
4175 	while (--wait) {
4176 		DELAY(1000);
4177 		if (ahc_inb(ahc, INTSTAT) & INT_PEND)
4178 			break;
4179 	}
4180 
4181 	if (wait == 0) {
4182 		printf("%s: board is not responding\n", ahc_name(ahc));
4183 		return (EIO);
4184 	}
4185 
4186 	ahc_intr((void *)ahc);
4187 	return (0);
4188 }
4189 
4190 static void
4191 ahc_setup_data(struct ahc_softc *ahc, struct scsipi_xfer *xs,
4192 	       struct scb *scb)
4193 {
4194 	struct hardware_scb *hscb;
4195 
4196 	hscb = scb->hscb;
4197 	xs->resid = xs->status = 0;
4198 
4199 	hscb->cmdlen = xs->cmdlen;
4200 	memcpy(hscb->cmdstore, xs->cmd, xs->cmdlen);
4201 	hscb->cmdpointer = hscb->cmdstore_busaddr;
4202 
4203 	/* Only use S/G if there is a transfer */
4204 	if (xs->datalen) {
4205 		int error;
4206 
4207 		error = bus_dmamap_load(ahc->parent_dmat,
4208 			    scb->dmamap, xs->data,
4209 			    xs->datalen, NULL,
4210 			    ((xs->xs_control & XS_CTL_NOSLEEP) ?
4211 			     BUS_DMA_NOWAIT : BUS_DMA_WAITOK) |
4212 			    BUS_DMA_STREAMING |
4213 			    ((xs->xs_control & XS_CTL_DATA_IN) ?
4214 			     BUS_DMA_READ : BUS_DMA_WRITE));
4215 		if (error) {
4216 #ifdef AHC_DEBUG
4217 			printf("%s: in ahc_setup_data(): bus_dmamap_load() "
4218 			    "= %d\n",
4219 			    ahc_name(ahc),
4220 			    error);
4221 #endif
4222 			if (!ahc_istagged_device(ahc, xs, 0))
4223 				ahc_index_busy_tcl(ahc, hscb->tcl, TRUE);
4224 			xs->error = XS_RESOURCE_SHORTAGE;	/* XXX fvdl */
4225 			scsipi_done(xs);
4226 			return;
4227 		}
4228 		ahc_execute_scb(scb,
4229 		    scb->dmamap->dm_segs,
4230 		    scb->dmamap->dm_nsegs);
4231 	} else {
4232 		ahc_execute_scb(scb, NULL, 0);
4233 	}
4234 }
4235 
4236 static void
4237 ahc_freeze_devq(struct ahc_softc *ahc, struct scsipi_periph *periph)
4238 {
4239 	int	target;
4240 	char	channel;
4241 	int	lun;
4242 
4243 	target = periph->periph_target;
4244 	lun = periph->periph_lun;
4245 	channel = periph->periph_channel->chan_channel;
4246 
4247 	ahc_search_qinfifo(ahc, target, channel, lun,
4248 			   /*tag*/SCB_LIST_NULL, ROLE_UNKNOWN,
4249 			   SCB_REQUEUE, SEARCH_COMPLETE);
4250 }
4251 
4252 static void
4253 ahcallocscbs(struct ahc_softc *ahc)
4254 {
4255 	struct scb_data *scb_data;
4256 	struct scb *next_scb;
4257 	struct sg_map_node *sg_map;
4258 	bus_addr_t physaddr;
4259 	struct ahc_dma_seg *segs;
4260 	int newcount;
4261 	int i;
4262 
4263 	scb_data = ahc->scb_data;
4264 	if (scb_data->numscbs >= AHC_SCB_MAX)
4265 		/* Can't allocate any more */
4266 		return;
4267 
4268 	next_scb = &scb_data->scbarray[scb_data->numscbs];
4269 
4270 	sg_map = malloc(sizeof(*sg_map), M_DEVBUF, M_NOWAIT);
4271 
4272 	if (sg_map == NULL)
4273 		return;
4274 
4275 	if (ahc_createdmamem(ahc->parent_dmat, PAGE_SIZE, ahc->sc_dmaflags,
4276 	    &sg_map->sg_dmamap,
4277 	    (caddr_t *)&sg_map->sg_vaddr, &sg_map->sg_physaddr,
4278 	    &sg_map->sg_dmasegs, &sg_map->sg_nseg, ahc_name(ahc),
4279 	    "SG space") < 0) {
4280 		free(sg_map, M_DEVBUF);
4281 		return;
4282 	}
4283 
4284 	SLIST_INSERT_HEAD(&scb_data->sg_maps, sg_map, links);
4285 
4286 	segs = sg_map->sg_vaddr;
4287 	physaddr = sg_map->sg_physaddr;
4288 
4289 	newcount = (PAGE_SIZE / (AHC_NSEG * sizeof(struct ahc_dma_seg)));
4290 	for (i = 0; scb_data->numscbs < AHC_SCB_MAX && i < newcount; i++) {
4291 		int error;
4292 
4293 		next_scb->sg_list = segs;
4294 		/*
4295 		 * The sequencer always starts with the second entry.
4296 		 * The first entry is embedded in the scb.
4297 		 */
4298 		next_scb->sg_list_phys = physaddr + sizeof(struct ahc_dma_seg);
4299 		next_scb->flags = SCB_FREE;
4300 		error = bus_dmamap_create(ahc->parent_dmat,
4301 			    AHC_MAXTRANSFER_SIZE, AHC_NSEG, MAXBSIZE, 0,
4302 			    BUS_DMA_NOWAIT|BUS_DMA_ALLOCNOW|ahc->sc_dmaflags,
4303 			    &next_scb->dmamap);
4304 		if (error != 0)
4305 			break;
4306 		next_scb->hscb = &scb_data->hscbs[scb_data->numscbs];
4307 		next_scb->hscb->tag = ahc->scb_data->numscbs;
4308 		next_scb->hscb->cmdstore_busaddr =
4309 		    ahc_hscb_busaddr(ahc, next_scb->hscb->tag)
4310 		  + offsetof(struct hardware_scb, cmdstore);
4311 		next_scb->hscb->cmdstore_busaddr =
4312 		    htole32(next_scb->hscb->cmdstore_busaddr);
4313 		SLIST_INSERT_HEAD(&ahc->scb_data->free_scbs, next_scb, links);
4314 		segs += AHC_NSEG;
4315 		physaddr += (AHC_NSEG * sizeof(struct ahc_dma_seg));
4316 		next_scb++;
4317 		ahc->scb_data->numscbs++;
4318 	}
4319 #ifdef AHC_DEBUG
4320 	if (ahc_debug & AHC_SHOWSCBALLOC)
4321 		printf("%s: allocated %d new SCBs count now %d\n",
4322 		    ahc_name(ahc), i - 1, ahc->scb_data->numscbs);
4323 #endif
4324 }
4325 
4326 #ifdef AHC_DUMP_SEQ
4327 static void
4328 ahc_dumpseq(struct ahc_softc* ahc)
4329 {
4330 	int i;
4331 	int max_prog;
4332 
4333 	if ((ahc->chip & AHC_BUS_MASK) < AHC_PCI)
4334 		max_prog = 448;
4335 	else if ((ahc->features & AHC_ULTRA2) != 0)
4336 		max_prog = 768;
4337 	else
4338 		max_prog = 512;
4339 
4340 	ahc_outb(ahc, SEQCTL, PERRORDIS|FAILDIS|FASTMODE|LOADRAM);
4341 	ahc_outb(ahc, SEQADDR0, 0);
4342 	ahc_outb(ahc, SEQADDR1, 0);
4343 	for (i = 0; i < max_prog; i++) {
4344 		u_int8_t ins_bytes[4];
4345 
4346 		ahc_insb(ahc, SEQRAM, ins_bytes, 4);
4347 		printf("0x%08x\n", ins_bytes[0] << 24
4348 				 | ins_bytes[1] << 16
4349 				 | ins_bytes[2] << 8
4350 				 | ins_bytes[3]);
4351 	}
4352 }
4353 #endif
4354 
4355 static void
4356 ahc_loadseq(struct ahc_softc *ahc)
4357 {
4358 	const struct patch *cur_patch;
4359 	int i;
4360 	int downloaded;
4361 	int skip_addr;
4362 	u_int8_t download_consts[4];
4363 
4364 	/* Setup downloadable constant table */
4365 #if 0
4366 	/* No downloaded constants are currently defined. */
4367 	download_consts[TMODE_NUMCMDS] = ahc->num_targetcmds;
4368 #endif
4369 
4370 	cur_patch = patches;
4371 	downloaded = 0;
4372 	skip_addr = 0;
4373 	ahc_outb(ahc, SEQCTL, PERRORDIS|FAILDIS|FASTMODE|LOADRAM);
4374 	ahc_outb(ahc, SEQADDR0, 0);
4375 	ahc_outb(ahc, SEQADDR1, 0);
4376 
4377 	for (i = 0; i < sizeof(seqprog)/4; i++) {
4378 		if (ahc_check_patch(ahc, &cur_patch, i, &skip_addr) == 0) {
4379 			/*
4380 			 * Don't download this instruction as it
4381 			 * is in a patch that was removed.
4382 			 */
4383                         continue;
4384 		}
4385 		ahc_download_instr(ahc, i, download_consts);
4386 		downloaded++;
4387 	}
4388 	ahc_outb(ahc, SEQCTL, PERRORDIS|FAILDIS|FASTMODE);
4389 	restart_sequencer(ahc);
4390 
4391 #ifdef AHC_DEBUG
4392 	printf(" %d instructions downloaded\n", downloaded);
4393 #endif
4394 }
4395 
4396 static int
4397 ahc_check_patch(struct ahc_softc *ahc, const struct patch **start_patch,
4398 		int start_instr, int *skip_addr)
4399 {
4400 	const struct	patch *cur_patch;
4401 	const struct	patch *last_patch;
4402 	int	num_patches;
4403 
4404 	num_patches = sizeof(patches)/sizeof(struct patch);
4405 	last_patch = &patches[num_patches];
4406 	cur_patch = *start_patch;
4407 
4408 	while (cur_patch < last_patch && start_instr == cur_patch->begin) {
4409 
4410 		if (cur_patch->patch_func(ahc) == 0) {
4411 
4412 			/* Start rejecting code */
4413 			*skip_addr = start_instr + cur_patch->skip_instr;
4414 			cur_patch += cur_patch->skip_patch;
4415 		} else {
4416 			/* Accepted this patch.  Advance to the next
4417 			 * one and wait for our intruction pointer to
4418 			 * hit this point.
4419 			 */
4420 			cur_patch++;
4421 		}
4422 	}
4423 
4424 	*start_patch = cur_patch;
4425 	if (start_instr < *skip_addr)
4426 		/* Still skipping */
4427 		return (0);
4428 
4429 	return (1);
4430 }
4431 
4432 static void
4433 ahc_download_instr(struct ahc_softc *ahc, int instrptr, u_int8_t *dconsts)
4434 {
4435 	union	ins_formats instr;
4436 	struct	ins_format1 *fmt1_ins;
4437 	struct	ins_format3 *fmt3_ins;
4438 	u_int	opcode;
4439 
4440 	/* Structure copy */
4441 	memcpy(&instr, &seqprog[instrptr * 4], sizeof instr);
4442 
4443 	instr.integer = le32toh(instr.integer);
4444 
4445 	fmt1_ins = &instr.format1;
4446 	fmt3_ins = NULL;
4447 
4448 	/* Pull the opcode */
4449 	opcode = instr.format1.opcode;
4450 	switch (opcode) {
4451 	case AIC_OP_JMP:
4452 	case AIC_OP_JC:
4453 	case AIC_OP_JNC:
4454 	case AIC_OP_CALL:
4455 	case AIC_OP_JNE:
4456 	case AIC_OP_JNZ:
4457 	case AIC_OP_JE:
4458 	case AIC_OP_JZ:
4459 	{
4460 		const struct patch *cur_patch;
4461 		int address_offset;
4462 		u_int address;
4463 		int skip_addr;
4464 		int i;
4465 
4466 		fmt3_ins = &instr.format3;
4467 		address_offset = 0;
4468 		address = fmt3_ins->address;
4469 		cur_patch = patches;
4470 		skip_addr = 0;
4471 
4472 		for (i = 0; i < address;) {
4473 
4474 			ahc_check_patch(ahc, &cur_patch, i, &skip_addr);
4475 
4476 			if (skip_addr > i) {
4477 				int end_addr;
4478 
4479 				end_addr = MIN(address, skip_addr);
4480 				address_offset += end_addr - i;
4481 				i = skip_addr;
4482 			} else {
4483 				i++;
4484 			}
4485 		}
4486 		address -= address_offset;
4487 		fmt3_ins->address = address;
4488 		/* FALLTHROUGH */
4489 	}
4490 	case AIC_OP_OR:
4491 	case AIC_OP_AND:
4492 	case AIC_OP_XOR:
4493 	case AIC_OP_ADD:
4494 	case AIC_OP_ADC:
4495 	case AIC_OP_BMOV:
4496 		if (fmt1_ins->parity != 0) {
4497 			fmt1_ins->immediate = dconsts[fmt1_ins->immediate];
4498 		}
4499 		fmt1_ins->parity = 0;
4500 		/* FALLTHROUGH */
4501 	case AIC_OP_ROL:
4502 		if ((ahc->features & AHC_ULTRA2) != 0) {
4503 			int i, count;
4504 
4505 			/* Calculate odd parity for the instruction */
4506 			for (i = 0, count = 0; i < 31; i++) {
4507 				u_int32_t mask;
4508 
4509 				mask = 0x01 << i;
4510 				if ((instr.integer & mask) != 0)
4511 					count++;
4512 			}
4513 			if ((count & 0x01) == 0)
4514 				instr.format1.parity = 1;
4515 		} else {
4516 			/* Compress the instruction for older sequencers */
4517 			if (fmt3_ins != NULL) {
4518 				instr.integer =
4519 					fmt3_ins->immediate
4520 				      | (fmt3_ins->source << 8)
4521 				      | (fmt3_ins->address << 16)
4522 				      |	(fmt3_ins->opcode << 25);
4523 			} else {
4524 				instr.integer =
4525 					fmt1_ins->immediate
4526 				      | (fmt1_ins->source << 8)
4527 				      | (fmt1_ins->destination << 16)
4528 				      |	(fmt1_ins->ret << 24)
4529 				      |	(fmt1_ins->opcode << 25);
4530 			}
4531 		}
4532 		instr.integer = htole32(instr.integer);
4533 		ahc_outsb(ahc, SEQRAM, instr.bytes, 4);
4534 		break;
4535 	default:
4536 		panic("Unknown opcode encountered in seq program");
4537 		break;
4538 	}
4539 }
4540 
4541 static void
4542 ahc_set_recoveryscb(struct ahc_softc *ahc, struct scb *scb)
4543 {
4544 
4545 	if ((scb->flags & SCB_RECOVERY_SCB) == 0) {
4546 		struct scb *scbp;
4547 
4548 		scb->flags |= SCB_RECOVERY_SCB;
4549 
4550 		/*
4551 		 * Take all queued, but not sent SCBs out of the equation.
4552 		 * Also ensure that no new CCBs are queued to us while we
4553 		 * try to fix this problem.
4554 		 */
4555 		scsipi_channel_freeze(&ahc->sc_channel, 1);
4556 		if (ahc->features & AHC_TWIN)
4557 			scsipi_channel_freeze(&ahc->sc_channel_b, 1);
4558 
4559 		/*
4560 		 * Go through all of our pending SCBs and remove
4561 		 * any scheduled timeouts for them.  We will reschedule
4562 		 * them after we've successfully fixed this problem.
4563 		 */
4564 		scbp = ahc->pending_ccbs.lh_first;
4565 		while (scbp != NULL) {
4566 			callout_stop(&scbp->xs->xs_callout);
4567 			scbp = scbp->plinks.le_next;
4568 		}
4569 	}
4570 }
4571 
4572 static void
4573 ahc_timeout(void *arg)
4574 {
4575 	struct	scb *scb;
4576 	struct	ahc_softc *ahc;
4577 	int	s, found;
4578 	u_int	last_phase;
4579 	int	target;
4580 	int	lun;
4581 	int	i;
4582 	char	channel;
4583 
4584 	scb = (struct scb *)arg;
4585 	ahc =
4586 	    (void *)scb->xs->xs_periph->periph_channel->chan_adapter->adapt_dev;
4587 
4588 	s = splbio();
4589 
4590 	/*
4591 	 * Ensure that the card doesn't do anything
4592 	 * behind our back.  Also make sure that we
4593 	 * didn't "just" miss an interrupt that would
4594 	 * affect this timeout.
4595 	 */
4596 	do {
4597 		ahc_intr(ahc);
4598 		pause_sequencer(ahc);
4599 	} while (ahc_inb(ahc, INTSTAT) & INT_PEND);
4600 
4601 	if ((scb->flags & SCB_ACTIVE) == 0) {
4602 		/* Previous timeout took care of me already */
4603 		printf("Timedout SCB handled by another timeout\n");
4604 		unpause_sequencer(ahc);
4605 		splx(s);
4606 		return;
4607 	}
4608 
4609 	target = SCB_TARGET(scb);
4610 	channel = SCB_CHANNEL(scb);
4611 	lun = SCB_LUN(scb);
4612 
4613 	scsipi_printaddr(scb->xs->xs_periph);
4614 	printf("SCB %x - timed out ", scb->hscb->tag);
4615 	/*
4616 	 * Take a snapshot of the bus state and print out
4617 	 * some information so we can track down driver bugs.
4618 	 */
4619 	last_phase = ahc_inb(ahc, LASTPHASE);
4620 
4621 	for (i = 0; i < num_phases; i++) {
4622 		if (last_phase == phase_table[i].phase)
4623 			break;
4624 	}
4625 	printf("%s", phase_table[i].phasemsg);
4626 
4627 	printf(", SEQADDR == 0x%x\n",
4628 	       ahc_inb(ahc, SEQADDR0) | (ahc_inb(ahc, SEQADDR1) << 8));
4629 	printf("SCSIRATE == 0x%x\n", ahc_inb(ahc, SCSIRATE));
4630 
4631 #ifdef AHC_DEBUG
4632 	ahc_print_scb(scb);
4633 #endif
4634 
4635 #if 0
4636 	printf("SSTAT1 == 0x%x\n", ahc_inb(ahc, SSTAT1));
4637 	printf("SSTAT3 == 0x%x\n", ahc_inb(ahc, SSTAT3));
4638 	printf("SCSIPHASE == 0x%x\n", ahc_inb(ahc, SCSIPHASE));
4639 	printf("SCSIOFFSET == 0x%x\n", ahc_inb(ahc, SCSIOFFSET));
4640 	printf("SEQ_FLAGS == 0x%x\n", ahc_inb(ahc, SEQ_FLAGS));
4641 	printf("SCB_DATAPTR == 0x%x\n", ahc_inb(ahc, SCB_DATAPTR)
4642 				      | ahc_inb(ahc, SCB_DATAPTR + 1) << 8
4643 				      | ahc_inb(ahc, SCB_DATAPTR + 2) << 16
4644 				      | ahc_inb(ahc, SCB_DATAPTR + 3) << 24);
4645 	printf("SCB_DATACNT == 0x%x\n", ahc_inb(ahc, SCB_DATACNT)
4646 				      | ahc_inb(ahc, SCB_DATACNT + 1) << 8
4647 				      | ahc_inb(ahc, SCB_DATACNT + 2) << 16);
4648 	printf("SCB_SGCOUNT == 0x%x\n", ahc_inb(ahc, SCB_SGCOUNT));
4649 	printf("CCSCBCTL == 0x%x\n", ahc_inb(ahc, CCSCBCTL));
4650 	printf("CCSCBCNT == 0x%x\n", ahc_inb(ahc, CCSCBCNT));
4651 	printf("DFCNTRL == 0x%x\n", ahc_inb(ahc, DFCNTRL));
4652 	printf("DFSTATUS == 0x%x\n", ahc_inb(ahc, DFSTATUS));
4653 	printf("CCHCNT == 0x%x\n", ahc_inb(ahc, CCHCNT));
4654 	if (scb->sg_count > 0) {
4655 		for (i = 0; i < scb->sg_count; i++) {
4656 			printf("sg[%d] - Addr 0x%x : Length %d\n",
4657 			       i,
4658 			       le32toh(scb->sg_list[i].addr),
4659 			       le32toh(scb->sg_list[i].len));
4660 		}
4661 	}
4662 #endif
4663 	if (scb->flags & (SCB_DEVICE_RESET|SCB_ABORT)) {
4664 		/*
4665 		 * Been down this road before.
4666 		 * Do a full bus reset.
4667 		 */
4668 bus_reset:
4669 		ahcsetccbstatus(scb->xs, XS_TIMEOUT);
4670 		found = ahc_reset_channel(ahc, channel, /*Initiate Reset*/TRUE);
4671 		printf("%s: Issued Channel %c Bus Reset. "
4672 		       "%d SCBs aborted\n", ahc_name(ahc), channel, found);
4673 	} else {
4674 		/*
4675 		 * If we are a target, transition to bus free and report
4676 		 * the timeout.
4677 		 *
4678 		 * The target/initiator that is holding up the bus may not
4679 		 * be the same as the one that triggered this timeout
4680 		 * (different commands have different timeout lengths).
4681 		 * If the bus is idle and we are actiing as the initiator
4682 		 * for this request, queue a BDR message to the timed out
4683 		 * target.  Otherwise, if the timed out transaction is
4684 		 * active:
4685 		 *   Initiator transaction:
4686 		 *	Stuff the message buffer with a BDR message and assert
4687 		 *	ATN in the hopes that the target will let go of the bus
4688 		 *	and go to the mesgout phase.  If this fails, we'll
4689 		 *	get another timeout 2 seconds later which will attempt
4690 		 *	a bus reset.
4691 		 *
4692 		 *   Target transaction:
4693 		 *	Transition to BUS FREE and report the error.
4694 		 *	It's good to be the target!
4695 		 */
4696 		u_int active_scb_index;
4697 
4698 		active_scb_index = ahc_inb(ahc, SCB_TAG);
4699 
4700 		if (last_phase != P_BUSFREE
4701 		  && (active_scb_index < ahc->scb_data->numscbs)) {
4702 			struct scb *active_scb;
4703 
4704 			/*
4705 			 * If the active SCB is not from our device,
4706 			 * assume that another device is hogging the bus
4707 			 * and wait for it's timeout to expire before
4708 			 * taking additional action.
4709 			 */
4710 			active_scb = &ahc->scb_data->scbarray[active_scb_index];
4711 			if (active_scb->hscb->tcl != scb->hscb->tcl) {
4712 				u_int	newtimeout;
4713 
4714 				scsipi_printaddr(scb->xs->xs_periph);
4715 				printf("Other SCB Timeout%s",
4716 			 	       (scb->flags & SCB_OTHERTCL_TIMEOUT) != 0
4717 				       ? " again\n" : "\n");
4718 				scb->flags |= SCB_OTHERTCL_TIMEOUT;
4719 				newtimeout = MAX(active_scb->xs->timeout,
4720 						 scb->xs->timeout);
4721 				callout_reset(&scb->xs->xs_callout,
4722 				    mstohz(newtimeout), ahc_timeout, scb);
4723 				splx(s);
4724 				return;
4725 			}
4726 
4727 			/* It's us */
4728 			if ((scb->hscb->control & TARGET_SCB) != 0) {
4729 
4730 				/*
4731 				 * Send back any queued up transactions
4732 				 * and properly record the error condition.
4733 				 */
4734 				ahc_freeze_devq(ahc, scb->xs->xs_periph);
4735 				ahcsetccbstatus(scb->xs, XS_TIMEOUT);
4736 				ahc_freeze_ccb(scb);
4737 				ahc_done(ahc, scb);
4738 
4739 				/* Will clear us from the bus */
4740 				restart_sequencer(ahc);
4741 				splx(s);
4742 				return;
4743 			}
4744 
4745 			ahc_set_recoveryscb(ahc, active_scb);
4746 			ahc_outb(ahc, MSG_OUT, MSG_BUS_DEV_RESET);
4747 			ahc_outb(ahc, SCSISIGO, last_phase|ATNO);
4748 			scsipi_printaddr(active_scb->xs->xs_periph);
4749 			printf("BDR message in message buffer\n");
4750 			active_scb->flags |=  SCB_DEVICE_RESET;
4751 			callout_reset(&active_scb->xs->xs_callout,
4752 			    2 * hz, ahc_timeout, active_scb);
4753 			unpause_sequencer(ahc);
4754 		} else {
4755 			int	 disconnected;
4756 
4757 			/* XXX Shouldn't panic.  Just punt instead */
4758 			if ((scb->hscb->control & TARGET_SCB) != 0)
4759 				panic("Timed-out target SCB but bus idle");
4760 
4761 			if (last_phase != P_BUSFREE
4762 			 && (ahc_inb(ahc, SSTAT0) & TARGET) != 0) {
4763 				/* XXX What happened to the SCB? */
4764 				/* Hung target selection.  Goto busfree */
4765 				printf("%s: Hung target selection\n",
4766 				       ahc_name(ahc));
4767 				restart_sequencer(ahc);
4768 				splx(s);
4769 				return;
4770 			}
4771 
4772 			if (ahc_search_qinfifo(ahc, target, channel, lun,
4773 					       scb->hscb->tag, ROLE_INITIATOR,
4774 					       /*status*/0, SEARCH_COUNT) > 0) {
4775 				disconnected = FALSE;
4776 			} else {
4777 				disconnected = TRUE;
4778 			}
4779 
4780 			if (disconnected) {
4781 				u_int active_scb;
4782 
4783 				ahc_set_recoveryscb(ahc, scb);
4784 				/*
4785 				 * Simply set the MK_MESSAGE control bit.
4786 				 */
4787 				scb->hscb->control |= MK_MESSAGE;
4788 				scb->flags |= SCB_QUEUED_MSG
4789 					   |  SCB_DEVICE_RESET;
4790 
4791 				/*
4792 				 * Mark the cached copy of this SCB in the
4793 				 * disconnected list too, so that a reconnect
4794 				 * at this point causes a BDR or abort.
4795 				 */
4796 				active_scb = ahc_inb(ahc, SCBPTR);
4797 				if (ahc_search_disc_list(ahc, target,
4798 							 channel, lun,
4799 							 scb->hscb->tag,
4800 							 /*stop_on_first*/TRUE,
4801 							 /*remove*/FALSE,
4802 							 /*save_state*/FALSE)) {
4803 					u_int scb_control;
4804 
4805 					scb_control = ahc_inb(ahc, SCB_CONTROL);
4806 					scb_control |= MK_MESSAGE;
4807 					ahc_outb(ahc, SCB_CONTROL, scb_control);
4808 				}
4809 				ahc_outb(ahc, SCBPTR, active_scb);
4810 				ahc_index_busy_tcl(ahc, scb->hscb->tcl,
4811 						   /*unbusy*/TRUE);
4812 
4813 				/*
4814 				 * Actually re-queue this SCB in case we can
4815 				 * select the device before it reconnects.
4816 				 * Clear out any entries in the QINFIFO first
4817 				 * so we are the next SCB for this target
4818 				 * to run.
4819 				 */
4820 				ahc_search_qinfifo(ahc, SCB_TARGET(scb),
4821 						   channel, SCB_LUN(scb),
4822 						   SCB_LIST_NULL,
4823 						   ROLE_INITIATOR,
4824 						   SCB_REQUEUE,
4825 						   SEARCH_COMPLETE);
4826 				scsipi_printaddr(scb->xs->xs_periph);
4827 				printf("Queuing a BDR SCB\n");
4828 				ahc->qinfifo[ahc->qinfifonext++] =
4829 				    scb->hscb->tag;
4830 
4831 				bus_dmamap_sync(ahc->parent_dmat,
4832 				    ahc->shared_data_dmamap,
4833 				    QINFIFO_OFFSET * 256, 256,
4834 				    BUS_DMASYNC_PREWRITE);
4835 
4836 				if ((ahc->features & AHC_QUEUE_REGS) != 0) {
4837 					ahc_outb(ahc, HNSCB_QOFF,
4838 						 ahc->qinfifonext);
4839 				} else {
4840 					ahc_outb(ahc, KERNEL_QINPOS,
4841 						 ahc->qinfifonext);
4842 				}
4843 				callout_reset(&scb->xs->xs_callout, 2 * hz,
4844 				    ahc_timeout, scb);
4845 				unpause_sequencer(ahc);
4846 			} else {
4847 				/* Go "immediatly" to the bus reset */
4848 				/* This shouldn't happen */
4849 				ahc_set_recoveryscb(ahc, scb);
4850 				scsipi_printaddr(scb->xs->xs_periph);
4851 				printf("SCB %x: Immediate reset.  "
4852 					"Flags = 0x%x\n", scb->hscb->tag,
4853 					scb->flags);
4854 				goto bus_reset;
4855 			}
4856 		}
4857 	}
4858 	splx(s);
4859 }
4860 
4861 static int
4862 ahc_search_qinfifo(struct ahc_softc *ahc, int target, char channel,
4863 		   int lun, u_int tag, role_t role, scb_flag status,
4864 		   ahc_search_action action)
4865 {
4866 	struct	 scb *scbp;
4867 	u_int8_t qinpos;
4868 	u_int8_t qintail;
4869 	int	 found;
4870 
4871 	qinpos = ahc_inb(ahc, QINPOS);
4872 	qintail = ahc->qinfifonext;
4873 	found = 0;
4874 
4875 	/*
4876 	 * Start with an empty queue.  Entries that are not chosen
4877 	 * for removal will be re-added to the queue as we go.
4878 	 */
4879 	ahc->qinfifonext = qinpos;
4880 
4881 	bus_dmamap_sync(ahc->parent_dmat, ahc->shared_data_dmamap,
4882 	    QINFIFO_OFFSET * 256, 256, BUS_DMASYNC_POSTREAD);
4883 
4884 	while (qinpos != qintail) {
4885 		scbp = &ahc->scb_data->scbarray[ahc->qinfifo[qinpos]];
4886 		if (ahc_match_scb(scbp, target, channel, lun, tag, role)) {
4887 			/*
4888 			 * We found an scb that needs to be removed.
4889 			 */
4890 			switch (action) {
4891 			case SEARCH_COMPLETE:
4892 				if (!(scbp->xs->xs_status & XS_STS_DONE)) {
4893 					scbp->flags |= status;
4894 					scbp->xs->error = XS_NOERROR;
4895 				}
4896 				ahc_freeze_ccb(scbp);
4897 				ahc_done(ahc, scbp);
4898 				break;
4899 			case SEARCH_COUNT:
4900 				ahc->qinfifo[ahc->qinfifonext++] =
4901 				    scbp->hscb->tag;
4902 				break;
4903 			case SEARCH_REMOVE:
4904 				break;
4905 			}
4906 			found++;
4907 		} else {
4908 			ahc->qinfifo[ahc->qinfifonext++] = scbp->hscb->tag;
4909 		}
4910 		qinpos++;
4911 	}
4912 
4913 	bus_dmamap_sync(ahc->parent_dmat, ahc->shared_data_dmamap,
4914 	    QINFIFO_OFFSET * 256, 256, BUS_DMASYNC_PREWRITE);
4915 
4916 	if ((ahc->features & AHC_QUEUE_REGS) != 0) {
4917 		ahc_outb(ahc, HNSCB_QOFF, ahc->qinfifonext);
4918 	} else {
4919 		ahc_outb(ahc, KERNEL_QINPOS, ahc->qinfifonext);
4920 	}
4921 
4922 	return (found);
4923 }
4924 
4925 /*
4926  * Abort all SCBs that match the given description (target/channel/lun/tag),
4927  * setting their status to the passed in status if the status has not already
4928  * been modified from CAM_REQ_INPROG.  This routine assumes that the sequencer
4929  * is paused before it is called.
4930  */
4931 static int
4932 ahc_abort_scbs(struct ahc_softc *ahc, int target, char channel,
4933 	       int lun, u_int tag, role_t role, int status)
4934 {
4935 	struct	scb *scbp;
4936 	u_int	active_scb;
4937 	int	i;
4938 	int	found;
4939 
4940 	/* restore this when we're done */
4941 	active_scb = ahc_inb(ahc, SCBPTR);
4942 
4943 	found = ahc_search_qinfifo(ahc, target, channel, lun, SCB_LIST_NULL,
4944 				   role, SCB_REQUEUE, SEARCH_COMPLETE);
4945 
4946 	/*
4947 	 * Search waiting for selection list.
4948 	 */
4949 	{
4950 		u_int8_t next, prev;
4951 
4952 		next = ahc_inb(ahc, WAITING_SCBH);  /* Start at head of list. */
4953 		prev = SCB_LIST_NULL;
4954 
4955 		while (next != SCB_LIST_NULL) {
4956 			u_int8_t scb_index;
4957 
4958 			ahc_outb(ahc, SCBPTR, next);
4959 			scb_index = ahc_inb(ahc, SCB_TAG);
4960 			if (scb_index >= ahc->scb_data->numscbs) {
4961 				panic("Waiting List inconsistency. "
4962 				      "SCB index == %d, yet numscbs == %d.",
4963 				      scb_index, ahc->scb_data->numscbs);
4964 			}
4965 			scbp = &ahc->scb_data->scbarray[scb_index];
4966 			if (ahc_match_scb(scbp, target, channel,
4967 					  lun, SCB_LIST_NULL, role)) {
4968 
4969 				next = ahc_abort_wscb(ahc, next, prev);
4970 			} else {
4971 
4972 				prev = next;
4973 				next = ahc_inb(ahc, SCB_NEXT);
4974 			}
4975 		}
4976 	}
4977 	/*
4978 	 * Go through the disconnected list and remove any entries we
4979 	 * have queued for completion, 0'ing their control byte too.
4980 	 * We save the active SCB and restore it ourselves, so there
4981 	 * is no reason for this search to restore it too.
4982 	 */
4983 	ahc_search_disc_list(ahc, target, channel, lun, tag,
4984 			     /*stop_on_first*/FALSE, /*remove*/TRUE,
4985 			     /*save_state*/FALSE);
4986 
4987 	/*
4988 	 * Go through the hardware SCB array looking for commands that
4989 	 * were active but not on any list.
4990 	 */
4991 	for(i = 0; i < ahc->scb_data->maxhscbs; i++) {
4992 		u_int scbid;
4993 
4994 		ahc_outb(ahc, SCBPTR, i);
4995 		scbid = ahc_inb(ahc, SCB_TAG);
4996 		scbp = &ahc->scb_data->scbarray[scbid];
4997 		if (scbid < ahc->scb_data->numscbs
4998 		 && ahc_match_scb(scbp, target, channel, lun, tag, role))
4999 			ahc_add_curscb_to_free_list(ahc);
5000 	}
5001 
5002 	/*
5003 	 * Go through the pending CCB list and look for
5004 	 * commands for this target that are still active.
5005 	 * These are other tagged commands that were
5006 	 * disconnected when the reset occurred.
5007 	 */
5008 	{
5009 		struct scb *scb;
5010 
5011 		scb = ahc->pending_ccbs.lh_first;
5012 		while (scb != NULL) {
5013 			scbp = scb;
5014 			scb = scb->plinks.le_next;
5015 			if (ahc_match_scb(scbp, target, channel,
5016 					  lun, tag, role)) {
5017 				if (!(scbp->xs->xs_status & XS_STS_DONE))
5018 					ahcsetccbstatus(scbp->xs, status);
5019 				ahc_freeze_ccb(scbp);
5020 				ahc_done(ahc, scbp);
5021 				found++;
5022 			}
5023 		}
5024 	}
5025 	ahc_outb(ahc, SCBPTR, active_scb);
5026 	return found;
5027 }
5028 
5029 static int
5030 ahc_search_disc_list(struct ahc_softc *ahc, int target, char channel,
5031 		     int lun, u_int tag, int stop_on_first, int remove,
5032 		     int save_state)
5033 {
5034 	struct	scb *scbp;
5035 	u_int	next;
5036 	u_int	prev;
5037 	u_int	count;
5038 	u_int	active_scb;
5039 
5040 	count = 0;
5041 	next = ahc_inb(ahc, DISCONNECTED_SCBH);
5042 	prev = SCB_LIST_NULL;
5043 
5044 	if (save_state) {
5045 		/* restore this when we're done */
5046 		active_scb = ahc_inb(ahc, SCBPTR);
5047 	} else
5048 		/* Silence compiler */
5049 		active_scb = SCB_LIST_NULL;
5050 
5051 	while (next != SCB_LIST_NULL) {
5052 		u_int scb_index;
5053 
5054 		ahc_outb(ahc, SCBPTR, next);
5055 		scb_index = ahc_inb(ahc, SCB_TAG);
5056 		if (scb_index >= ahc->scb_data->numscbs) {
5057 			panic("Disconnected List inconsistency. "
5058 			      "SCB index == %d, yet numscbs == %d.",
5059 			      scb_index, ahc->scb_data->numscbs);
5060 		}
5061 		scbp = &ahc->scb_data->scbarray[scb_index];
5062 		if (ahc_match_scb(scbp, target, channel, lun,
5063 				  tag, ROLE_INITIATOR)) {
5064 			count++;
5065 			if (remove) {
5066 				next =
5067 				    ahc_rem_scb_from_disc_list(ahc, prev, next);
5068 			} else {
5069 				prev = next;
5070 				next = ahc_inb(ahc, SCB_NEXT);
5071 			}
5072 			if (stop_on_first)
5073 				break;
5074 		} else {
5075 			prev = next;
5076 			next = ahc_inb(ahc, SCB_NEXT);
5077 		}
5078 	}
5079 	if (save_state)
5080 		ahc_outb(ahc, SCBPTR, active_scb);
5081 	return (count);
5082 }
5083 
5084 static u_int
5085 ahc_rem_scb_from_disc_list(struct ahc_softc *ahc, u_int prev, u_int scbptr)
5086 {
5087 	u_int next;
5088 
5089 	ahc_outb(ahc, SCBPTR, scbptr);
5090 	next = ahc_inb(ahc, SCB_NEXT);
5091 
5092 	ahc_outb(ahc, SCB_CONTROL, 0);
5093 
5094 	ahc_add_curscb_to_free_list(ahc);
5095 
5096 	if (prev != SCB_LIST_NULL) {
5097 		ahc_outb(ahc, SCBPTR, prev);
5098 		ahc_outb(ahc, SCB_NEXT, next);
5099 	} else
5100 		ahc_outb(ahc, DISCONNECTED_SCBH, next);
5101 
5102 	return (next);
5103 }
5104 
5105 static void
5106 ahc_add_curscb_to_free_list(struct ahc_softc *ahc)
5107 {
5108 	/* Invalidate the tag so that ahc_find_scb doesn't think it's active */
5109 	ahc_outb(ahc, SCB_TAG, SCB_LIST_NULL);
5110 
5111 	ahc_outb(ahc, SCB_NEXT, ahc_inb(ahc, FREE_SCBH));
5112 	ahc_outb(ahc, FREE_SCBH, ahc_inb(ahc, SCBPTR));
5113 }
5114 
5115 /*
5116  * Manipulate the waiting for selection list and return the
5117  * scb that follows the one that we remove.
5118  */
5119 static u_int
5120 ahc_abort_wscb(struct ahc_softc *ahc, u_int scbpos, u_int prev)
5121 {
5122 	u_int curscb, next;
5123 
5124 	/*
5125 	 * Select the SCB we want to abort and
5126 	 * pull the next pointer out of it.
5127 	 */
5128 	curscb = ahc_inb(ahc, SCBPTR);
5129 	ahc_outb(ahc, SCBPTR, scbpos);
5130 	next = ahc_inb(ahc, SCB_NEXT);
5131 
5132 	/* Clear the necessary fields */
5133 	ahc_outb(ahc, SCB_CONTROL, 0);
5134 
5135 	ahc_add_curscb_to_free_list(ahc);
5136 
5137 	/* update the waiting list */
5138 	if (prev == SCB_LIST_NULL) {
5139 		/* First in the list */
5140 		ahc_outb(ahc, WAITING_SCBH, next);
5141 
5142 		/*
5143 		 * Ensure we aren't attempting to perform
5144 		 * selection for this entry.
5145 		 */
5146 		ahc_outb(ahc, SCSISEQ, (ahc_inb(ahc, SCSISEQ) & ~ENSELO));
5147 	} else {
5148 		/*
5149 		 * Select the scb that pointed to us
5150 		 * and update its next pointer.
5151 		 */
5152 		ahc_outb(ahc, SCBPTR, prev);
5153 		ahc_outb(ahc, SCB_NEXT, next);
5154 	}
5155 
5156 	/*
5157 	 * Point us back at the original scb position.
5158 	 */
5159 	ahc_outb(ahc, SCBPTR, curscb);
5160 	return next;
5161 }
5162 
5163 static void
5164 ahc_clear_intstat(struct ahc_softc *ahc)
5165 {
5166 	/* Clear any interrupt conditions this may have caused */
5167 	ahc_outb(ahc, CLRSINT0, CLRSELDO|CLRSELDI|CLRSELINGO);
5168 	ahc_outb(ahc, CLRSINT1, CLRSELTIMEO|CLRATNO|CLRSCSIRSTI
5169 				|CLRBUSFREE|CLRSCSIPERR|CLRPHASECHG|
5170 				CLRREQINIT);
5171 	ahc_outb(ahc, CLRINT, CLRSCSIINT);
5172 }
5173 
5174 static void
5175 ahc_reset_current_bus(struct ahc_softc *ahc)
5176 {
5177 	u_int8_t scsiseq;
5178 
5179 	ahc_outb(ahc, SIMODE1, ahc_inb(ahc, SIMODE1) & ~ENSCSIRST);
5180 	scsiseq = ahc_inb(ahc, SCSISEQ);
5181 	ahc_outb(ahc, SCSISEQ, scsiseq | SCSIRSTO);
5182 	DELAY(AHC_BUSRESET_DELAY);
5183 	/* Turn off the bus reset */
5184 	ahc_outb(ahc, SCSISEQ, scsiseq & ~SCSIRSTO);
5185 
5186 	ahc_clear_intstat(ahc);
5187 
5188 	/* Re-enable reset interrupts */
5189 	ahc_outb(ahc, SIMODE1, ahc_inb(ahc, SIMODE1) | ENSCSIRST);
5190 }
5191 
5192 static int
5193 ahc_reset_channel(struct ahc_softc *ahc, char channel, int initiate_reset)
5194 {
5195 	u_int	initiator, target, max_scsiid;
5196 	u_int	sblkctl;
5197 	u_int	our_id;
5198 	int	found;
5199 	int	restart_needed;
5200 	char	cur_channel;
5201 
5202 	ahc->pending_device = NULL;
5203 
5204 	pause_sequencer(ahc);
5205 
5206 	/*
5207 	 * Run our command complete fifos to ensure that we perform
5208 	 * completion processing on any commands that 'completed'
5209 	 * before the reset occurred.
5210 	 */
5211 	ahc_run_qoutfifo(ahc);
5212 
5213 	/*
5214 	 * Reset the bus if we are initiating this reset
5215 	 */
5216 	sblkctl = ahc_inb(ahc, SBLKCTL);
5217 	cur_channel = 'A';
5218 	if ((ahc->features & AHC_TWIN) != 0
5219 	 && ((sblkctl & SELBUSB) != 0))
5220 	    cur_channel = 'B';
5221 	if (cur_channel != channel) {
5222 		/* Case 1: Command for another bus is active
5223 		 * Stealthily reset the other bus without
5224 		 * upsetting the current bus.
5225 		 */
5226 		ahc_outb(ahc, SBLKCTL, sblkctl ^ SELBUSB);
5227 		ahc_outb(ahc, SIMODE1, ahc_inb(ahc, SIMODE1) & ~ENBUSFREE);
5228 		ahc_outb(ahc, SCSISEQ,
5229 			 ahc_inb(ahc, SCSISEQ) & (ENSELI|ENRSELI|ENAUTOATNP));
5230 		if (initiate_reset)
5231 			ahc_reset_current_bus(ahc);
5232 		ahc_clear_intstat(ahc);
5233 		ahc_outb(ahc, SBLKCTL, sblkctl);
5234 		restart_needed = FALSE;
5235 	} else {
5236 		/* Case 2: A command from this bus is active or we're idle */
5237 		ahc_clear_msg_state(ahc);
5238 		ahc_outb(ahc, SIMODE1, ahc_inb(ahc, SIMODE1) & ~ENBUSFREE);
5239 		ahc_outb(ahc, SCSISEQ,
5240 			 ahc_inb(ahc, SCSISEQ) & (ENSELI|ENRSELI|ENAUTOATNP));
5241 		if (initiate_reset)
5242 			ahc_reset_current_bus(ahc);
5243 		ahc_clear_intstat(ahc);
5244 
5245 		/*
5246 		 * Since we are going to restart the sequencer, avoid
5247 		 * a race in the sequencer that could cause corruption
5248 		 * of our Q pointers by starting over from index 0.
5249 		 */
5250 		ahc->qoutfifonext = 0;
5251 		if ((ahc->features & AHC_QUEUE_REGS) != 0)
5252 			ahc_outb(ahc, SDSCB_QOFF, 0);
5253 		else
5254 			ahc_outb(ahc, QOUTPOS, 0);
5255 		restart_needed = TRUE;
5256 	}
5257 
5258 	/*
5259 	 * Clean up all the state information for the
5260 	 * pending transactions on this bus.
5261 	 */
5262 	found = ahc_abort_scbs(ahc, AHC_TARGET_WILDCARD, channel,
5263 			       AHC_LUN_WILDCARD, SCB_LIST_NULL,
5264 			       ROLE_UNKNOWN, XS_RESET);
5265 	if (channel == 'B') {
5266 		our_id = ahc->our_id_b;
5267 	} else {
5268 		our_id = ahc->our_id;
5269 	}
5270 
5271 	max_scsiid = (ahc->features & AHC_WIDE) ? 15 : 7;
5272 
5273 	/*
5274 	 * Revert to async/narrow transfers until we renegotiate.
5275 	 */
5276 	for (target = 0; target <= max_scsiid; target++) {
5277 
5278 		if (ahc->enabled_targets[target] == NULL)
5279 			continue;
5280 		for (initiator = 0; initiator <= max_scsiid; initiator++) {
5281 			struct ahc_devinfo devinfo;
5282 
5283 			ahc_compile_devinfo(&devinfo, target, initiator,
5284 					    AHC_LUN_WILDCARD,
5285 					    channel, ROLE_UNKNOWN);
5286 			ahc_set_width(ahc, &devinfo,
5287 				      MSG_EXT_WDTR_BUS_8_BIT,
5288 				      AHC_TRANS_CUR, /*paused*/TRUE, FALSE);
5289 			ahc_set_syncrate(ahc, &devinfo,
5290 					 /*syncrate*/NULL, /*period*/0,
5291 					 /*offset*/0, AHC_TRANS_CUR,
5292 					 /*paused*/TRUE, FALSE);
5293 			ahc_update_xfer_mode(ahc, &devinfo);
5294 		}
5295 	}
5296 
5297 	if (restart_needed)
5298 		restart_sequencer(ahc);
5299 	else
5300 		unpause_sequencer(ahc);
5301 	return found;
5302 }
5303 
5304 static int
5305 ahc_match_scb(struct scb *scb, int target, char channel,
5306 	      int lun, u_int tag, role_t role)
5307 {
5308 	int targ = SCB_TARGET(scb);
5309 	char chan = SCB_CHANNEL(scb);
5310 	int slun = SCB_LUN(scb);
5311 	int match;
5312 
5313 	match = ((chan == channel) || (channel == ALL_CHANNELS));
5314 	if (match != 0)
5315 		match = ((targ == target) || (target == AHC_TARGET_WILDCARD));
5316 	if (match != 0)
5317 		match = ((lun == slun) || (lun == AHC_LUN_WILDCARD));
5318 
5319 	return match;
5320 }
5321 
5322 static void
5323 ahc_construct_sdtr(struct ahc_softc *ahc, u_int period, u_int offset)
5324 {
5325 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXTENDED;
5326 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXT_SDTR_LEN;
5327 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXT_SDTR;
5328 	ahc->msgout_buf[ahc->msgout_index++] = period;
5329 	ahc->msgout_buf[ahc->msgout_index++] = offset;
5330 	ahc->msgout_len += 5;
5331 }
5332 
5333 static void
5334 ahc_construct_wdtr(struct ahc_softc *ahc, u_int bus_width)
5335 {
5336 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXTENDED;
5337 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXT_WDTR_LEN;
5338 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXT_WDTR;
5339 	ahc->msgout_buf[ahc->msgout_index++] = bus_width;
5340 	ahc->msgout_len += 4;
5341 }
5342 
5343 static void
5344 ahc_calc_residual(struct scb *scb)
5345 {
5346 	struct	hardware_scb *hscb;
5347 
5348 	hscb = scb->hscb;
5349 
5350 	/*
5351 	 * If the disconnected flag is still set, this is bogus
5352 	 * residual information left over from a sequencer
5353 	 * pagin/pageout, so ignore this case.
5354 	 */
5355 	if ((scb->hscb->control & DISCONNECTED) == 0) {
5356 		u_int32_t resid;
5357 		int	  resid_sgs;
5358 		int	  sg;
5359 
5360 		/*
5361 		 * Remainder of the SG where the transfer
5362 		 * stopped.
5363 		 */
5364 		resid = (hscb->residual_data_count[2] << 16)
5365 		      |	(hscb->residual_data_count[1] <<8)
5366 		      |	(hscb->residual_data_count[0]);
5367 
5368 		/*
5369 		 * Add up the contents of all residual
5370 		 * SG segments that are after the SG where
5371 		 * the transfer stopped.
5372 		 */
5373 		resid_sgs = scb->hscb->residual_SG_count - 1/*current*/;
5374 		sg = scb->sg_count - resid_sgs;
5375 		while (resid_sgs > 0) {
5376 
5377 			resid += le32toh(scb->sg_list[sg].len);
5378 			sg++;
5379 			resid_sgs--;
5380 		}
5381 		scb->xs->resid = resid;
5382 	}
5383 
5384 	/*
5385 	 * Clean out the residual information in this SCB for its
5386 	 * next consumer.
5387 	 */
5388 	hscb->residual_SG_count = 0;
5389 
5390 #ifdef AHC_DEBUG
5391 	if (ahc_debug & AHC_SHOWMISC) {
5392 		scsipi_printaddr(scb->xs->xs_periph);
5393 		printf("Handled Residual of %ld bytes\n" ,(long)scb->xs->resid);
5394 	}
5395 #endif
5396 }
5397 
5398 static void
5399 ahc_update_pending_syncrates(struct ahc_softc *ahc)
5400 {
5401 	struct	scb *scb;
5402 	int	pending_ccb_count;
5403 	int	i;
5404 	u_int	saved_scbptr;
5405 
5406 	/*
5407 	 * Traverse the pending SCB list and ensure that all of the
5408 	 * SCBs there have the proper settings.
5409 	 */
5410 	scb = LIST_FIRST(&ahc->pending_ccbs);
5411 	pending_ccb_count = 0;
5412 	while (scb != NULL) {
5413 		struct ahc_devinfo devinfo;
5414 		struct scsipi_xfer *xs;
5415 		struct scb *pending_scb;
5416 		struct hardware_scb *pending_hscb;
5417 		struct ahc_initiator_tinfo *tinfo;
5418 		struct tmode_tstate *tstate;
5419 		u_int  our_id, remote_id;
5420 
5421 		xs = scb->xs;
5422 		pending_scb = scb;
5423 		pending_hscb = pending_scb->hscb;
5424 		our_id = SCB_IS_SCSIBUS_B(pending_scb)
5425 		       ? ahc->our_id_b : ahc->our_id;
5426 		remote_id = xs->xs_periph->periph_target;
5427 		ahc_compile_devinfo(&devinfo, our_id, remote_id,
5428 				    SCB_LUN(pending_scb),
5429 				    SCB_CHANNEL(pending_scb),
5430 				    ROLE_UNKNOWN);
5431 		tinfo = ahc_fetch_transinfo(ahc, devinfo.channel,
5432 					    our_id, remote_id, &tstate);
5433 		pending_hscb->control &= ~ULTRAENB;
5434 		if ((tstate->ultraenb & devinfo.target_mask) != 0)
5435 			pending_hscb->control |= ULTRAENB;
5436 		pending_hscb->scsirate = tinfo->scsirate;
5437 		pending_hscb->scsioffset = tinfo->current.offset;
5438 		pending_ccb_count++;
5439 		scb = LIST_NEXT(scb, plinks);
5440 	}
5441 
5442 	if (pending_ccb_count == 0)
5443 		return;
5444 
5445 	saved_scbptr = ahc_inb(ahc, SCBPTR);
5446 	/* Ensure that the hscbs down on the card match the new information */
5447 	for (i = 0; i < ahc->scb_data->maxhscbs; i++) {
5448 		u_int scb_tag;
5449 
5450 		ahc_outb(ahc, SCBPTR, i);
5451 		scb_tag = ahc_inb(ahc, SCB_TAG);
5452 		if (scb_tag != SCB_LIST_NULL) {
5453 			struct	ahc_devinfo devinfo;
5454 			struct	scb *pending_scb;
5455 			struct scsipi_xfer *xs;
5456 			struct	hardware_scb *pending_hscb;
5457 			struct	ahc_initiator_tinfo *tinfo;
5458 			struct	tmode_tstate *tstate;
5459 			u_int	our_id, remote_id;
5460 			u_int	control;
5461 
5462 			pending_scb = &ahc->scb_data->scbarray[scb_tag];
5463 			if (pending_scb->flags == SCB_FREE)
5464 				continue;
5465 			pending_hscb = pending_scb->hscb;
5466 			xs = pending_scb->xs;
5467 			our_id = SCB_IS_SCSIBUS_B(pending_scb)
5468 			       ? ahc->our_id_b : ahc->our_id;
5469 			remote_id = xs->xs_periph->periph_target;
5470 			ahc_compile_devinfo(&devinfo, our_id, remote_id,
5471 					    SCB_LUN(pending_scb),
5472 					    SCB_CHANNEL(pending_scb),
5473 					    ROLE_UNKNOWN);
5474 			tinfo = ahc_fetch_transinfo(ahc, devinfo.channel,
5475 						    our_id, remote_id, &tstate);
5476 			control = ahc_inb(ahc, SCB_CONTROL);
5477 			control &= ~ULTRAENB;
5478 			if ((tstate->ultraenb & devinfo.target_mask) != 0)
5479 				control |= ULTRAENB;
5480 			ahc_outb(ahc, SCB_CONTROL, control);
5481 			ahc_outb(ahc, SCB_SCSIRATE, tinfo->scsirate);
5482 			ahc_outb(ahc, SCB_SCSIOFFSET, tinfo->current.offset);
5483 		}
5484 	}
5485 	ahc_outb(ahc, SCBPTR, saved_scbptr);
5486 }
5487 
5488 #if UNUSED
5489 static void
5490 ahc_dump_targcmd(struct target_cmd *cmd)
5491 {
5492 	u_int8_t *byte;
5493 	u_int8_t *last_byte;
5494 	int i;
5495 
5496 	byte = &cmd->initiator_channel;
5497 	/* Debugging info for received commands */
5498 	last_byte = &cmd[1].initiator_channel;
5499 
5500 	i = 0;
5501 	while (byte < last_byte) {
5502 		if (i == 0)
5503 			printf("\t");
5504 		printf("%#x", *byte++);
5505 		i++;
5506 		if (i == 8) {
5507 			printf("\n");
5508 			i = 0;
5509 		} else {
5510 			printf(", ");
5511 		}
5512 	}
5513 }
5514 #endif
5515 
5516 static void
5517 ahc_shutdown(void *arg)
5518 {
5519 	struct	ahc_softc *ahc;
5520 	int	i;
5521 	u_int	sxfrctl1_a, sxfrctl1_b;
5522 
5523 	ahc = (struct ahc_softc *)arg;
5524 
5525 	pause_sequencer(ahc);
5526 
5527 	/*
5528 	 * Preserve the value of the SXFRCTL1 register for all channels.
5529 	 * It contains settings that affect termination and we don't want
5530 	 * to disturb the integrity of the bus during shutdown in case
5531 	 * we are in a multi-initiator setup.
5532 	 */
5533 	sxfrctl1_b = 0;
5534 	if ((ahc->features & AHC_TWIN) != 0) {
5535 		u_int sblkctl;
5536 
5537 		sblkctl = ahc_inb(ahc, SBLKCTL);
5538 		ahc_outb(ahc, SBLKCTL, sblkctl | SELBUSB);
5539 		sxfrctl1_b = ahc_inb(ahc, SXFRCTL1);
5540 		ahc_outb(ahc, SBLKCTL, sblkctl & ~SELBUSB);
5541 	}
5542 
5543 	sxfrctl1_a = ahc_inb(ahc, SXFRCTL1);
5544 
5545 	/* This will reset most registers to 0, but not all */
5546 	ahc_reset(ahc);
5547 
5548 	if ((ahc->features & AHC_TWIN) != 0) {
5549 		u_int sblkctl;
5550 
5551 		sblkctl = ahc_inb(ahc, SBLKCTL);
5552 		ahc_outb(ahc, SBLKCTL, sblkctl | SELBUSB);
5553 		ahc_outb(ahc, SXFRCTL1, sxfrctl1_b);
5554 		ahc_outb(ahc, SBLKCTL, sblkctl & ~SELBUSB);
5555 	}
5556 	ahc_outb(ahc, SXFRCTL1, sxfrctl1_a);
5557 
5558 	ahc_outb(ahc, SCSISEQ, 0);
5559 	ahc_outb(ahc, SXFRCTL0, 0);
5560 	ahc_outb(ahc, DSPCISTATUS, 0);
5561 
5562 	for (i = TARG_SCSIRATE; i < HA_274_BIOSCTRL; i++)
5563 		ahc_outb(ahc, i, 0);
5564 }
5565 
5566 #if defined(AHC_DEBUG) && 0
5567 static void
5568 ahc_dumptinfo(struct ahc_softc *ahc, struct ahc_initiator_tinfo *tinfo)
5569 {
5570 	printf("%s: tinfo: rate %u\n", ahc_name(ahc), tinfo->scsirate);
5571 
5572 	printf("\tcurrent:\n");
5573 	printf("\t\twidth %u period %u offset %u flags %x\n",
5574 	    tinfo->current.width, tinfo->current.period,
5575 	    tinfo->current.offset, tinfo->current.ppr_flags);
5576 
5577 	printf("\tgoal:\n");
5578 	printf("\t\twidth %u period %u offset %u flags %x\n",
5579 	    tinfo->goal.width, tinfo->goal.period,
5580 	    tinfo->goal.offset, tinfo->goal.ppr_flags);
5581 
5582 	printf("\tuser:\n");
5583 	printf("\t\twidth %u period %u offset %u flags %x\n",
5584 	    tinfo->user.width, tinfo->user.period,
5585 	    tinfo->user.offset, tinfo->user.ppr_flags);
5586 }
5587 #endif
5588 
5589 static int
5590 ahc_istagged_device(struct ahc_softc *ahc, struct scsipi_xfer *xs,
5591 		    int nocmdcheck)
5592 {
5593 #ifdef AHC_NO_TAGS
5594 	return 0;
5595 #else
5596 	char channel;
5597 	u_int our_id, target;
5598 	struct tmode_tstate *tstate;
5599 	struct ahc_devinfo devinfo;
5600 
5601 	channel = SIM_CHANNEL(ahc, xs->xs_periph);
5602 	our_id = SIM_SCSI_ID(ahc, xs->xs_periph);
5603 	target = xs->xs_periph->periph_target;
5604 	(void)ahc_fetch_transinfo(ahc, channel, our_id, target, &tstate);
5605 
5606 	ahc_compile_devinfo(&devinfo, our_id, target,
5607 	    xs->xs_periph->periph_lun, channel, ROLE_INITIATOR);
5608 
5609 	return (tstate->tagenable & devinfo.target_mask);
5610 #endif
5611 }
5612