xref: /openbsd/sys/dev/ic/ncr53c9x.c (revision e5dd7070)
1 /*	$OpenBSD: ncr53c9x.c,v 1.76 2020/07/20 14:41:13 krw Exp $	*/
2 /*     $NetBSD: ncr53c9x.c,v 1.56 2000/11/30 14:41:46 thorpej Exp $    */
3 
4 /*
5  * Copyright (c) 1996 Charles M. Hannum.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. All advertising materials mentioning features or use of this software
16  *    must display the following acknowledgement:
17  *	This product includes software developed by Charles M. Hannum.
18  * 4. The name of the author may not be used to endorse or promote products
19  *    derived from this software without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1994 Peter Galbavy
35  * Copyright (c) 1995 Paul Kranenburg
36  * All rights reserved.
37  *
38  * Redistribution and use in source and binary forms, with or without
39  * modification, are permitted provided that the following conditions
40  * are met:
41  * 1. Redistributions of source code must retain the above copyright
42  *    notice, this list of conditions and the following disclaimer.
43  * 2. Redistributions in binary form must reproduce the above copyright
44  *    notice, this list of conditions and the following disclaimer in the
45  *    documentation and/or other materials provided with the distribution.
46  *
47  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
48  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
49  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
50  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
51  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
52  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
53  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
54  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
55  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
56  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
57  * POSSIBILITY OF SUCH DAMAGE.
58  */
59 
60 /*
61  * Based on aic6360 by Jarle Greipsland
62  *
63  * Acknowledgements: Many of the algorithms used in this driver are
64  * inspired by the work of Julian Elischer (julian@tfs.com) and
65  * Charles Hannum (mycroft@duality.gnu.ai.mit.edu).  Thanks a million!
66  */
67 
68 #include <sys/param.h>
69 #include <sys/systm.h>
70 #include <sys/kernel.h>
71 #include <sys/errno.h>
72 #include <sys/ioctl.h>
73 #include <sys/device.h>
74 #include <sys/malloc.h>
75 #include <sys/queue.h>
76 #include <sys/pool.h>
77 
78 #include <scsi/scsi_all.h>
79 #include <scsi/scsiconf.h>
80 #include <scsi/scsi_message.h>
81 
82 #include <machine/cpu.h>
83 
84 #include <dev/ic/ncr53c9xreg.h>
85 #include <dev/ic/ncr53c9xvar.h>
86 
87 #ifdef NCR53C9X_DEBUG
88 int ncr53c9x_debug = 0; /*NCR_SHOWPHASE|NCR_SHOWMISC|NCR_SHOWTRAC|NCR_SHOWCMDS;*/
89 #endif
90 #ifdef DEBUG
91 int ncr53c9x_notag = 0;
92 #endif
93 
94 /*static*/ void	ncr53c9x_readregs(struct ncr53c9x_softc *);
95 /*static*/ void	ncr53c9x_select(struct ncr53c9x_softc *,
96 					    struct ncr53c9x_ecb *);
97 /*static*/ int ncr53c9x_reselect(struct ncr53c9x_softc *, int, int, int);
98 /*static*/ void	ncr53c9x_scsi_reset(struct ncr53c9x_softc *);
99 /*static*/ int	ncr53c9x_poll(struct ncr53c9x_softc *,
100 					    struct scsi_xfer *, int);
101 /*static*/ void	ncr53c9x_sched(struct ncr53c9x_softc *);
102 /*static*/ void	ncr53c9x_done(struct ncr53c9x_softc *,
103 					    struct ncr53c9x_ecb *);
104 /*static*/ void	ncr53c9x_msgin(struct ncr53c9x_softc *);
105 /*static*/ void	ncr53c9x_msgout(struct ncr53c9x_softc *);
106 /*static*/ void	ncr53c9x_timeout(void *arg);
107 /*static*/ void	ncr53c9x_abort(struct ncr53c9x_softc *,
108 					    struct ncr53c9x_ecb *);
109 /*static*/ void ncr53c9x_dequeue(struct ncr53c9x_softc *,
110 					    struct ncr53c9x_ecb *);
111 
112 void ncr53c9x_sense(struct ncr53c9x_softc *,
113 					    struct ncr53c9x_ecb *);
114 void ncr53c9x_free_ecb(void *, void *);
115 void *ncr53c9x_get_ecb(void *);
116 
117 static inline int ncr53c9x_stp2cpb(struct ncr53c9x_softc *, int);
118 static inline void ncr53c9x_setsync(struct ncr53c9x_softc *,
119 					    struct ncr53c9x_tinfo *);
120 static struct ncr53c9x_linfo *ncr53c9x_lunsearch(struct ncr53c9x_tinfo *,
121     int64_t lun);
122 
123 static void ncr53c9x_wrfifo(struct ncr53c9x_softc *, u_char *, int);
124 static int ncr53c9x_rdfifo(struct ncr53c9x_softc *, int);
125 #define NCR_RDFIFO_START	0
126 #define NCR_RDFIFO_CONTINUE	1
127 
128 #define NCR_SET_COUNT(sc, size) do {						\
129 			NCR_WRITE_REG((sc), NCR_TCL, (size));			\
130 			NCR_WRITE_REG((sc), NCR_TCM, (size) >> 8);		\
131 			if ((sc->sc_cfg2 & NCRCFG2_FE) ||			\
132 			    (sc->sc_rev == NCR_VARIANT_FAS366)) {		\
133 				NCR_WRITE_REG((sc), NCR_TCH, (size) >> 16);	\
134 			}							\
135 			if (sc->sc_rev == NCR_VARIANT_FAS366) {			\
136 				NCR_WRITE_REG(sc, NCR_RCH, 0);			\
137 			}							\
138 } while (0)
139 
140 static int ecb_pool_initialized = 0;
141 static struct scsi_iopool ecb_iopool;
142 static struct pool ecb_pool;
143 
144 struct cfdriver esp_cd = {
145 	NULL, "esp", DV_DULL
146 };
147 
148 void	ncr53c9x_scsi_cmd(struct scsi_xfer *);
149 int	ncr53c9x_scsi_probe(struct scsi_link *);
150 void	ncr53c9x_scsi_free(struct scsi_link *);
151 
152 struct scsi_adapter ncr53c9x_switch = {
153 	ncr53c9x_scsi_cmd, NULL, ncr53c9x_scsi_probe,
154 	ncr53c9x_scsi_free, NULL
155 };
156 
157 /*
158  * Names for the NCR53c9x variants, corresponding to the variant tags
159  * in ncr53c9xvar.h.
160  */
161 const char *ncr53c9x_variant_names[] = {
162 	"ESP100",
163 	"ESP100A",
164 	"ESP200",
165 	"NCR53C94",
166 	"NCR53C96",
167 	"ESP406",
168 	"FAS408",
169 	"FAS216",
170 	"AM53C974",
171 	"FAS366/HME",
172 };
173 
174 /*
175  * Search linked list for LUN info by LUN id.
176  */
177 static struct ncr53c9x_linfo *
178 ncr53c9x_lunsearch(ti, lun)
179 	struct ncr53c9x_tinfo *ti;
180 	int64_t lun;
181 {
182 	struct ncr53c9x_linfo *li;
183 	LIST_FOREACH(li, &ti->luns, link)
184 	    if (li->lun == lun)
185 		    return (li);
186 	return (NULL);
187 }
188 
189 /*
190  * Attach this instance, and then all the sub-devices
191  */
192 void
193 ncr53c9x_attach(sc)
194 	struct ncr53c9x_softc *sc;
195 {
196 	struct scsibus_attach_args saa;
197 
198 	/*
199 	 * Allocate SCSI message buffers.
200 	 * Front-ends can override allocation to avoid alignment
201 	 * handling in the DMA engines. Note that ncr53c9x_msgout()
202 	 * can request a 1 byte DMA transfer.
203 	 */
204 	if (sc->sc_omess == NULL)
205 		sc->sc_omess = malloc(NCR_MAX_MSG_LEN, M_DEVBUF, M_NOWAIT);
206 
207 	if (sc->sc_imess == NULL)
208 		sc->sc_imess = malloc(NCR_MAX_MSG_LEN+1, M_DEVBUF, M_NOWAIT);
209 
210 	if (sc->sc_omess == NULL || sc->sc_imess == NULL) {
211 		printf("out of memory\n");
212 		return;
213 	}
214 
215 	/*
216 	 * Note, the front-end has set us up to print the chip variation.
217 	 */
218 	if (sc->sc_rev >= NCR_VARIANT_MAX) {
219 		printf("\n%s: unknown variant %d, devices not attached\n",
220 		    sc->sc_dev.dv_xname, sc->sc_rev);
221 		return;
222 	}
223 
224 	printf(": %s, %dMHz\n", ncr53c9x_variant_names[sc->sc_rev],
225 	    sc->sc_freq);
226 
227 	sc->sc_ccf = FREQTOCCF(sc->sc_freq);
228 
229 	/* The value *must not* be == 1. Make it 2 */
230 	if (sc->sc_ccf == 1)
231 		sc->sc_ccf = 2;
232 
233 	/*
234 	 * The recommended timeout is 250ms. This register is loaded
235 	 * with a value calculated as follows, from the docs:
236 	 *
237 	 *		(timout period) x (CLK frequency)
238 	 *	reg = -------------------------------------
239 	 *		 8192 x (Clock Conversion Factor)
240 	 *
241 	 * Since CCF has a linear relation to CLK, this generally computes
242 	 * to the constant of 153.
243 	 */
244 	sc->sc_timeout = ((250 * 1000) * sc->sc_freq) / (8192 * sc->sc_ccf);
245 
246 	/* CCF register only has 3 bits; 0 is actually 8 */
247 	sc->sc_ccf &= 7;
248 
249 	/* Find how many targets we need to support */
250 	switch (sc->sc_rev) {
251 	case NCR_VARIANT_FAS366:
252 		sc->sc_ntarg = 16;
253 		break;
254 	default:
255 		sc->sc_ntarg = 8;
256 		break;
257 	}
258 
259 	/* Reset state & bus */
260 	sc->sc_cfflags = sc->sc_dev.dv_cfdata->cf_flags;
261 	sc->sc_state = 0;
262 	ncr53c9x_init(sc, 1);
263 
264 	saa.saa_adapter_softc = sc;
265 	saa.saa_adapter_target = sc->sc_id;
266 	saa.saa_adapter = &ncr53c9x_switch;
267 	saa.saa_adapter_buswidth = sc->sc_ntarg;
268 	saa.saa_luns = 8;
269 	saa.saa_openings = 2;
270 	saa.saa_pool = &ecb_iopool;
271 	saa.saa_quirks = saa.saa_flags = 0;
272 	saa.saa_wwpn = saa.saa_wwnn = 0;
273 
274 	config_found(&sc->sc_dev, &saa, scsiprint);
275 }
276 
277 /*
278  * This is the generic ncr53c9x reset function. It does not reset the SCSI bus,
279  * only this controller, but kills any on-going commands, and also stops
280  * and resets the DMA.
281  *
282  * After reset, registers are loaded with the defaults from the attach
283  * routine above.
284  */
285 void
286 ncr53c9x_reset(sc)
287 	struct ncr53c9x_softc *sc;
288 {
289 
290 	/* reset DMA first */
291 	NCRDMA_RESET(sc);
292 
293 	/* reset SCSI chip */
294 	NCRCMD(sc, NCRCMD_RSTCHIP);
295 	NCRCMD(sc, NCRCMD_NOP);
296 	DELAY(500);
297 
298 	/* do these backwards, and fall through */
299 	switch (sc->sc_rev) {
300 	case NCR_VARIANT_ESP406:
301 	case NCR_VARIANT_FAS408:
302 		NCR_WRITE_REG(sc, NCR_CFG5, sc->sc_cfg5 | NCRCFG5_SINT);
303 		NCR_WRITE_REG(sc, NCR_CFG4, sc->sc_cfg4);
304 	case NCR_VARIANT_AM53C974:
305 	case NCR_VARIANT_FAS216:
306 	case NCR_VARIANT_NCR53C94:
307 	case NCR_VARIANT_NCR53C96:
308 	case NCR_VARIANT_ESP200:
309 		sc->sc_features |= NCR_F_HASCFG3;
310 		NCR_WRITE_REG(sc, NCR_CFG3, sc->sc_cfg3);
311 	case NCR_VARIANT_ESP100A:
312 		sc->sc_features |= NCR_F_SELATN3;
313 		NCR_WRITE_REG(sc, NCR_CFG2, sc->sc_cfg2);
314 	case NCR_VARIANT_ESP100:
315 		NCR_WRITE_REG(sc, NCR_CFG1, sc->sc_cfg1);
316 		NCR_WRITE_REG(sc, NCR_CCF, sc->sc_ccf);
317 		NCR_WRITE_REG(sc, NCR_SYNCOFF, 0);
318 		NCR_WRITE_REG(sc, NCR_TIMEOUT, sc->sc_timeout);
319 		break;
320 	case NCR_VARIANT_FAS366:
321 		sc->sc_features |=
322 		    NCR_F_SELATN3 | NCR_F_HASCFG3 | NCR_F_FASTSCSI;
323 		sc->sc_cfg3 = NCRFASCFG3_FASTCLK | NCRFASCFG3_OBAUTO;
324 		sc->sc_cfg3_fscsi = NCRFASCFG3_FASTSCSI;
325 		NCR_WRITE_REG(sc, NCR_CFG3, sc->sc_cfg3);
326 		sc->sc_cfg2 = 0; /* NCRCFG2_HMEFE | NCRCFG2_HME32 */
327 		NCR_WRITE_REG(sc, NCR_CFG2, sc->sc_cfg2);
328 		NCR_WRITE_REG(sc, NCR_CFG1, sc->sc_cfg1);
329 		NCR_WRITE_REG(sc, NCR_CCF, sc->sc_ccf);
330 		NCR_WRITE_REG(sc, NCR_SYNCOFF, 0);
331 		NCR_WRITE_REG(sc, NCR_TIMEOUT, sc->sc_timeout);
332 		break;
333 	default:
334 		printf("%s: unknown revision code, assuming ESP100\n",
335 		    sc->sc_dev.dv_xname);
336 		NCR_WRITE_REG(sc, NCR_CFG1, sc->sc_cfg1);
337 		NCR_WRITE_REG(sc, NCR_CCF, sc->sc_ccf);
338 		NCR_WRITE_REG(sc, NCR_SYNCOFF, 0);
339 		NCR_WRITE_REG(sc, NCR_TIMEOUT, sc->sc_timeout);
340 	}
341 
342 	if (sc->sc_rev == NCR_VARIANT_AM53C974)
343 		NCR_WRITE_REG(sc, NCR_AMDCFG4, sc->sc_cfg4);
344 
345 #if 0
346 	printf("%s: ncr53c9x_reset: revision %d\n",
347 	    sc->sc_dev.dv_xname, sc->sc_rev);
348 	printf("%s: ncr53c9x_reset: cfg1 0x%x, cfg2 0x%x, cfg3 0x%x, ccf 0x%x, timeout 0x%x\n",
349 	    sc->sc_dev.dv_xname,
350 	    sc->sc_cfg1, sc->sc_cfg2, sc->sc_cfg3,
351 	    sc->sc_ccf, sc->sc_timeout);
352 #endif
353 }
354 
355 /*
356  * Reset the SCSI bus, but not the chip
357  */
358 void
359 ncr53c9x_scsi_reset(sc)
360 	struct ncr53c9x_softc *sc;
361 {
362 
363 	(*sc->sc_glue->gl_dma_stop)(sc);
364 
365 	printf("%s: resetting SCSI bus\n", sc->sc_dev.dv_xname);
366 	NCRCMD(sc, NCRCMD_RSTSCSI);
367 }
368 
369 /*
370  * Initialize ncr53c9x state machine
371  */
372 void
373 ncr53c9x_init(sc, doreset)
374 	struct ncr53c9x_softc *sc;
375 	int doreset;
376 {
377 	struct ncr53c9x_ecb *ecb;
378 	struct ncr53c9x_linfo *li;
379 	int r, i;
380 
381 	NCR_TRACE(("[NCR_INIT(%d) %d] ", doreset, sc->sc_state));
382 
383 	if (!ecb_pool_initialized) {
384 		/* All instances share this pool */
385 		pool_init(&ecb_pool, sizeof(struct ncr53c9x_ecb), 0, IPL_BIO,
386 		    0, "ncr53c9x_ecb", NULL);
387 		scsi_iopool_init(&ecb_iopool, NULL,
388 		    ncr53c9x_get_ecb, ncr53c9x_free_ecb);
389 		ecb_pool_initialized = 1;
390 	}
391 
392 	if (sc->sc_state == 0) {
393 		/* First time through; initialize. */
394 
395 		TAILQ_INIT(&sc->ready_list);
396 		sc->sc_nexus = NULL;
397 		bzero(sc->sc_tinfo, sizeof(sc->sc_tinfo));
398 		for (r = 0; r < sc->sc_ntarg; r++) {
399 			LIST_INIT(&sc->sc_tinfo[r].luns);
400 		}
401 	} else {
402 		/* Cancel any active commands. */
403 		sc->sc_state = NCR_CLEANING;
404 		sc->sc_msgify = 0;
405 		if ((ecb = sc->sc_nexus) != NULL) {
406 			ecb->xs->error = XS_TIMEOUT;
407 			ncr53c9x_done(sc, ecb);
408 		}
409 		for (r = 0; r < sc->sc_ntarg; r++) {
410 			LIST_FOREACH(li, &sc->sc_tinfo[r].luns, link) {
411 				if ((ecb = li->untagged)) {
412 					li->untagged = NULL;
413 					/*
414 					 * XXXXXXX
415 					 * Should we terminate a command
416 					 * that never reached the disk?
417 					 */
418 					li->busy = 0;
419 					ecb->xs->error = XS_TIMEOUT;
420 					ncr53c9x_done(sc, ecb);
421 				}
422 				for (i = 0; i < 256; i++)
423 					if ((ecb = li->queued[i])) {
424 						li->queued[i] = NULL;
425 						ecb->xs->error = XS_TIMEOUT;
426 						ncr53c9x_done(sc, ecb);
427 					}
428 				li->used = 0;
429 			}
430 		}
431 	}
432 
433 	/*
434 	 * reset the chip to a known state
435 	 */
436 	ncr53c9x_reset(sc);
437 
438 	sc->sc_phase = sc->sc_prevphase = INVALID_PHASE;
439 	for (r = 0; r < sc->sc_ntarg; r++) {
440 		struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[r];
441 /* XXX - config flags per target: low bits: no reselect; high bits: no synch */
442 
443                 ti->flags = ((!(sc->sc_cfflags & (1 << (r + 16))) &&
444 		    sc->sc_minsync) ? 0 : T_SYNCHOFF) |
445 		    ((sc->sc_cfflags & (1 << r)) ?  T_RSELECTOFF : 0) |
446 		    T_NEED_TO_RESET;
447 #ifdef DEBUG
448 		 if (ncr53c9x_notag)
449 			 ti->flags &= ~T_TAG;
450 #endif
451 		ti->period = sc->sc_minsync;
452 		ti->offset = 0;
453 		ti->cfg3 = 0;
454 	}
455 
456 	if (doreset) {
457 		sc->sc_state = NCR_SBR;
458 		NCRCMD(sc, NCRCMD_RSTSCSI);
459 		/*
460 		 * XXX gross...
461 		 * On some systems, commands issued too close to a reset
462 		 * do not work correctly. We'll force a short delay on
463 		 * known-to-be-sensitive chips.
464 		 */
465 		switch (sc->sc_rev) {
466 		case NCR_VARIANT_NCR53C94:
467 			DELAY(600000);	/* 600ms */
468 			break;
469 		case NCR_VARIANT_NCR53C96:
470 			DELAY(100000);	/* 100ms */
471 			break;
472 		}
473 	} else {
474 		sc->sc_state = NCR_IDLE;
475 		ncr53c9x_sched(sc);
476 	}
477 }
478 
479 /*
480  * Read the NCR registers, and save their contents for later use.
481  * NCR_STAT, NCR_STEP & NCR_INTR are mostly zeroed out when reading
482  * NCR_INTR - so make sure it is the last read.
483  *
484  * I think that (from reading the docs) most bits in these registers
485  * only make sense when he DMA CSR has an interrupt showing. Call only
486  * if an interrupt is pending.
487  */
488 __inline__ void
489 ncr53c9x_readregs(sc)
490 	struct ncr53c9x_softc *sc;
491 {
492 
493 	sc->sc_espstat = NCR_READ_REG(sc, NCR_STAT);
494 	/* Only the stepo bits are of interest */
495 	sc->sc_espstep = NCR_READ_REG(sc, NCR_STEP) & NCRSTEP_MASK;
496 
497 	if (sc->sc_rev == NCR_VARIANT_FAS366)
498 		sc->sc_espstat2 = NCR_READ_REG(sc, NCR_STAT2);
499 
500 	sc->sc_espintr = NCR_READ_REG(sc, NCR_INTR);
501 
502 	if (sc->sc_glue->gl_clear_latched_intr != NULL)
503 		(*sc->sc_glue->gl_clear_latched_intr)(sc);
504 
505 	/*
506 	 * Determine the SCSI bus phase, return either a real SCSI bus phase
507 	 * or some pseudo phase we use to detect certain exceptions.
508 	 */
509 
510 	sc->sc_phase = (sc->sc_espintr & NCRINTR_DIS)
511 			? /* Disconnected */ BUSFREE_PHASE
512 			: sc->sc_espstat & NCRSTAT_PHASE;
513 
514 	NCR_MISC(("regs[intr=%02x,stat=%02x,step=%02x,stat2=%02x] ",
515 		sc->sc_espintr, sc->sc_espstat, sc->sc_espstep, sc->sc_espstat2));
516 }
517 
518 /*
519  * Convert Synchronous Transfer Period to chip register Clock Per Byte value.
520  */
521 static inline int
522 ncr53c9x_stp2cpb(sc, period)
523 	struct ncr53c9x_softc *sc;
524 	int period;
525 {
526 	int v;
527 	v = (sc->sc_freq * period) / 250;
528 	if (ncr53c9x_cpb2stp(sc, v) < period)
529 		/* Correct round-down error */
530 		v++;
531 	return (v);
532 }
533 
534 static inline void
535 ncr53c9x_setsync(sc, ti)
536 	struct ncr53c9x_softc *sc;
537 	struct ncr53c9x_tinfo *ti;
538 {
539 	u_char syncoff, synctp;
540 	u_char cfg3 = sc->sc_cfg3 | ti->cfg3;
541 
542 	if (ti->flags & T_SYNCMODE) {
543 		syncoff = ti->offset;
544 		synctp = ncr53c9x_stp2cpb(sc, ti->period);
545 		if (sc->sc_features & NCR_F_FASTSCSI) {
546 			/*
547 			 * If the period is 200ns or less (ti->period <= 50),
548 			 * put the chip in Fast SCSI mode.
549 			 */
550 			if (ti->period <= 50)
551 				/*
552 				 * There are (at least) 4 variations of the
553 				 * configuration 3 register.  The drive attach
554 				 * routine sets the appropriate bit to put the
555 				 * chip into Fast SCSI mode so that it doesn't
556 				 * have to be figured out here each time.
557 				 */
558 				cfg3 |= (sc->sc_rev == NCR_VARIANT_AM53C974) ?
559 				    NCRAMDCFG3_FSCSI : NCRCFG3_FSCSI;
560 		}
561 
562 		/*
563 		 * Am53c974 requires different SYNCTP values when the
564 		 * FSCSI bit is off.
565 		 */
566 		if (sc->sc_rev == NCR_VARIANT_AM53C974 &&
567 		    (cfg3 & NCRAMDCFG3_FSCSI) == 0)
568 			synctp--;
569 	} else {
570 		syncoff = 0;
571 		synctp = 0;
572 	}
573 
574 	if (sc->sc_features & NCR_F_HASCFG3)
575 		NCR_WRITE_REG(sc, NCR_CFG3, cfg3);
576 
577 	NCR_WRITE_REG(sc, NCR_SYNCOFF, syncoff);
578 	NCR_WRITE_REG(sc, NCR_SYNCTP, synctp);
579 }
580 
581 /*
582  * Send a command to a target, set the driver state to NCR_SELECTING
583  * and let the caller take care of the rest.
584  *
585  * Keeping this as a function allows me to say that this may be done
586  * by DMA instead of programmed I/O soon.
587  */
588 void
589 ncr53c9x_select(sc, ecb)
590 	struct ncr53c9x_softc *sc;
591 	struct ncr53c9x_ecb *ecb;
592 {
593 	struct scsi_link *sc_link = ecb->xs->sc_link;
594 	int target = sc_link->target;
595 	int lun = sc_link->lun;
596 	struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[target];
597 	int tiflags = ti->flags;
598 	u_char *cmd;
599 	int clen;
600 	int selatn3, selatns;
601 	size_t dmasize;
602 
603 	NCR_TRACE(("[ncr53c9x_select(t%d,l%d,cmd:%x,tag%x,%x)] ",
604 		   target, lun, ecb->cmd.cmd.opcode, ecb->tag[0], ecb->tag[1]));
605 
606 	sc->sc_state = NCR_SELECTING;
607 	/*
608 	 * Schedule the timeout now, the first time we will go away
609 	 * expecting to come back due to an interrupt, because it is
610 	 * always possible that the interrupt may never happen.
611 	 */
612 	if ((ecb->xs->flags & SCSI_POLL) == 0) {
613 		int timeout = ecb->timeout;
614 
615 		if (timeout > 1000000)
616 			timeout = (timeout / 1000) * hz;
617 		else
618 			timeout = (timeout * hz) / 1000;
619 		timeout_add(&ecb->to, timeout);
620 	}
621 
622 	/*
623 	 * The docs say the target register is never reset, and I
624 	 * can't think of a better place to set it
625 	 */
626 	if (sc->sc_rev == NCR_VARIANT_FAS366) {
627 		NCRCMD(sc, NCRCMD_FLUSH);
628 		NCR_WRITE_REG(sc, NCR_SELID, target | NCR_BUSID_HME);
629 	} else {
630 		NCR_WRITE_REG(sc, NCR_SELID, target);
631 	}
632 	ncr53c9x_setsync(sc, ti);
633 
634 	if ((ecb->flags & ECB_SENSE) != 0) {
635 		/*
636 		 * For REQUEST SENSE, we should not send an IDENTIFY or
637 		 * otherwise mangle the target.  There should be no MESSAGE IN
638 		 * phase.
639 		 */
640 		if (sc->sc_features & NCR_F_DMASELECT) {
641 			/* setup DMA transfer for command */
642 			dmasize = clen = ecb->clen;
643 			sc->sc_cmdlen = clen;
644 			sc->sc_cmdp = (caddr_t)&ecb->cmd.cmd;
645 
646 			NCRDMA_SETUP(sc, &sc->sc_cmdp, &sc->sc_cmdlen, 0,
647 			    &dmasize);
648 			/* Program the SCSI counter */
649 			NCR_SET_COUNT(sc, dmasize);
650 
651 			if (sc->sc_rev != NCR_VARIANT_FAS366)
652 				NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA);
653 
654 			/* And get the targets attention */
655 			NCRCMD(sc, NCRCMD_SELNATN | NCRCMD_DMA);
656 			NCRDMA_GO(sc);
657 		} else {
658 			ncr53c9x_wrfifo(sc, (u_char *)&ecb->cmd.cmd, ecb->clen);
659 			sc->sc_cmdlen = 0;
660 			NCRCMD(sc, NCRCMD_SELNATN);
661 		}
662 		return;
663 	}
664 
665 	selatn3 = selatns = 0;
666 	if (ecb->tag[0] != 0) {
667 		if (sc->sc_features & NCR_F_SELATN3)
668 			/* use SELATN3 to send tag messages */
669 			selatn3 = 1;
670 		else
671 			/* We don't have SELATN3; use SELATNS to send tags */
672 			selatns = 1;
673 	}
674 
675 	if (ti->flags & T_NEGOTIATE) {
676 		/* We have to use SELATNS to send sync/wide messages */
677 		selatn3 = 0;
678 		selatns = 1;
679 	}
680 
681 	cmd = (u_char *)&ecb->cmd.cmd;
682 
683 	if (selatn3) {
684 		/* We'll use tags with SELATN3 */
685 		clen = ecb->clen + 3;
686 		cmd -= 3;
687 		cmd[0] = MSG_IDENTIFY(lun, 1);	/* msg[0] */
688 		cmd[1] = ecb->tag[0];		/* msg[1] */
689 		cmd[2] = ecb->tag[1];		/* msg[2] */
690 	} else {
691 		/* We don't have tags, or will send messages with SELATNS */
692 		clen = ecb->clen + 1;
693 		cmd -= 1;
694 		cmd[0] = MSG_IDENTIFY(lun, (tiflags & T_RSELECTOFF) == 0);
695 	}
696 
697 	if ((sc->sc_features & NCR_F_DMASELECT) && !selatns) {
698 
699 		/* setup DMA transfer for command */
700 		dmasize = clen;
701 		sc->sc_cmdlen = clen;
702 		sc->sc_cmdp = cmd;
703 
704 		NCRDMA_SETUP(sc, &sc->sc_cmdp, &sc->sc_cmdlen, 0, &dmasize);
705 		/* Program the SCSI counter */
706 		NCR_SET_COUNT(sc, dmasize);
707 
708 		/* load the count in */
709 		/* if (sc->sc_rev != NCR_VARIANT_FAS366) */
710 			NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA);
711 
712 		/* And get the targets attention */
713 		if (selatn3) {
714 			sc->sc_msgout = SEND_TAG;
715 			sc->sc_flags |= NCR_ATN;
716 			NCRCMD(sc, NCRCMD_SELATN3 | NCRCMD_DMA);
717 		} else
718 			NCRCMD(sc, NCRCMD_SELATN | NCRCMD_DMA);
719 		NCRDMA_GO(sc);
720 		return;
721 	}
722 
723 	/*
724 	 * Who am I. This is where we tell the target that we are
725 	 * happy for it to disconnect etc.
726 	 */
727 
728 	/* Now get the command into the FIFO */
729 	sc->sc_cmdlen = 0;
730 	ncr53c9x_wrfifo(sc, cmd, clen);
731 
732 	/* And get the targets attention */
733 	if (selatns) {
734 		NCR_MISC(("SELATNS \n"));
735 		/* Arbitrate, select and stop after IDENTIFY message */
736 		NCRCMD(sc, NCRCMD_SELATNS);
737 	} else if (selatn3) {
738 		sc->sc_msgout = SEND_TAG;
739 		sc->sc_flags |= NCR_ATN;
740 		NCRCMD(sc, NCRCMD_SELATN3);
741 	} else
742 		NCRCMD(sc, NCRCMD_SELATN);
743 }
744 
745 /*
746  * DRIVER FUNCTIONS CALLABLE FROM HIGHER LEVEL DRIVERS
747  */
748 
749 void *
750 ncr53c9x_get_ecb(void *null)
751 {
752 	struct ncr53c9x_ecb *ecb;
753 
754 	ecb = pool_get(&ecb_pool, M_NOWAIT|M_ZERO);
755 	if (ecb == NULL)
756 		return (NULL);
757 
758 	timeout_set(&ecb->to, ncr53c9x_timeout, ecb);
759 	ecb->flags |= ECB_ALLOC;
760 
761 	return (ecb);
762 }
763 
764 void
765 ncr53c9x_free_ecb(void *null, void *ecb)
766 {
767 	pool_put(&ecb_pool, ecb);
768 }
769 
770 int
771 ncr53c9x_scsi_probe(struct scsi_link *sc_link)
772 {
773 	struct ncr53c9x_softc *sc = sc_link->bus->sb_adapter_softc;
774 	struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[sc_link->target];
775 	struct ncr53c9x_linfo *li;
776 	int64_t lun = sc_link->lun;
777 	int s;
778 
779 	/* Initialize LUN info and add to list. */
780 	li = malloc(sizeof(*li), M_DEVBUF, M_WAITOK | M_ZERO);
781 	if (li == NULL)
782 		return (ENOMEM);
783 
784 	li->last_used = getuptime();
785 	li->lun = lun;
786 
787 	s = splbio();
788 	LIST_INSERT_HEAD(&ti->luns, li, link);
789 	if (lun < NCR_NLUN)
790 		ti->lun[lun] = li;
791 	splx(s);
792 
793 	return (0);
794 
795 }
796 
797 void
798 ncr53c9x_scsi_free(struct scsi_link *sc_link)
799 {
800 	struct ncr53c9x_softc *sc = sc_link->bus->sb_adapter_softc;
801 	struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[sc_link->target];
802 	struct ncr53c9x_linfo *li;
803 	int64_t lun = sc_link->lun;
804 	int s;
805 
806 	s = splbio();
807 	li = TINFO_LUN(ti, lun);
808 
809 	LIST_REMOVE(li, link);
810 	if (lun < NCR_NLUN)
811 		ti->lun[lun] = NULL;
812 	splx(s);
813 
814 	free(li, M_DEVBUF, 0);
815 }
816 
817 /*
818  * Start a SCSI-command
819  * This function is called by the higher level SCSI-driver to queue/run
820  * SCSI-commands.
821  */
822 void
823 ncr53c9x_scsi_cmd(xs)
824 	struct scsi_xfer *xs;
825 {
826 	struct scsi_link *sc_link = xs->sc_link;
827 	struct ncr53c9x_softc *sc = sc_link->bus->sb_adapter_softc;
828 	struct ncr53c9x_ecb *ecb;
829 	struct ncr53c9x_tinfo *ti;
830 	struct ncr53c9x_linfo *li;
831 	int64_t lun = sc_link->lun;
832 	int s, flags;
833 
834 	NCR_TRACE(("[ncr53c9x_scsi_cmd] "));
835 	NCR_CMDS(("[0x%x, %d]->%d ", (int)xs->cmd->opcode, xs->cmdlen,
836 	    sc_link->target));
837 
838 	/*
839 	 * Commands larger than 12 bytes seem to confuse the chip
840 	 * (at least on FAS366 flavours).
841 	 */
842 	if (xs->cmdlen > 12) {
843 		memset(&xs->sense, 0, sizeof(xs->sense));
844 		/* sense data borrowed from gdt(4) */
845 		xs->sense.error_code = SSD_ERRCODE_VALID | SSD_ERRCODE_CURRENT;
846 		xs->sense.flags = SKEY_ILLEGAL_REQUEST;
847 		xs->sense.add_sense_code = 0x20; /* illcmd */
848 		xs->error = XS_SENSE;
849 		scsi_done(xs);
850 		return;
851 	}
852 
853 	flags = xs->flags;
854 	ti = &sc->sc_tinfo[sc_link->target];
855 	li = TINFO_LUN(ti, lun);
856 
857 	/* Initialize ecb */
858 	ecb = xs->io;
859 	ecb->xs = xs;
860 	ecb->timeout = xs->timeout;
861 
862 	if (flags & SCSI_RESET) {
863 		ecb->flags |= ECB_RESET;
864 		ecb->clen = 0;
865 		ecb->dleft = 0;
866 	} else {
867 		bcopy(xs->cmd, &ecb->cmd.cmd, xs->cmdlen);
868 		ecb->clen = xs->cmdlen;
869 		ecb->daddr = xs->data;
870 		ecb->dleft = xs->datalen;
871 	}
872 	ecb->stat = 0;
873 
874 	s = splbio();
875 
876 	TAILQ_INSERT_TAIL(&sc->ready_list, ecb, chain);
877 	ecb->flags |= ECB_READY;
878 	if (sc->sc_state == NCR_IDLE)
879 		ncr53c9x_sched(sc);
880 
881 	splx(s);
882 
883 	if ((flags & SCSI_POLL) == 0)
884 		return;
885 
886 	/* Not allowed to use interrupts, use polling instead */
887 	if (ncr53c9x_poll(sc, xs, ecb->timeout)) {
888 		ncr53c9x_timeout(ecb);
889 		if (ncr53c9x_poll(sc, xs, ecb->timeout))
890 			ncr53c9x_timeout(ecb);
891 	}
892 }
893 
894 /*
895  * Used when interrupt driven I/O isn't allowed, e.g. during boot.
896  */
897 int
898 ncr53c9x_poll(sc, xs, count)
899 	struct ncr53c9x_softc *sc;
900 	struct scsi_xfer *xs;
901 	int count;
902 {
903 	int s;
904 
905 	NCR_TRACE(("[ncr53c9x_poll] "));
906 	while (count) {
907 		if (NCRDMA_ISINTR(sc)) {
908 			s = splbio();
909 			ncr53c9x_intr(sc);
910 			splx(s);
911 		}
912 #if alternatively
913 		if (NCR_READ_REG(sc, NCR_STAT) & NCRSTAT_INT) {
914 			s = splbio();
915 			ncr53c9x_intr(sc);
916 			splx(s);
917 		}
918 #endif
919 		if ((xs->flags & ITSDONE) != 0)
920 			return (0);
921 		s = splbio();
922 		if (sc->sc_state == NCR_IDLE) {
923 			NCR_TRACE(("[ncr53c9x_poll: rescheduling] "));
924 			ncr53c9x_sched(sc);
925 		}
926 		splx(s);
927 		DELAY(1000);
928 		count--;
929 	}
930 	return (1);
931 }
932 
933 
934 /*
935  * LOW LEVEL SCSI UTILITIES
936  */
937 
938 /*
939  * Schedule a scsi operation.  This has now been pulled out of the interrupt
940  * handler so that we may call it from ncr53c9x_scsi_cmd and ncr53c9x_done.
941  * This may save us an unnecessary interrupt just to get things going.
942  * Should only be called when state == NCR_IDLE and at bio pl.
943  */
944 void
945 ncr53c9x_sched(sc)
946 	struct ncr53c9x_softc *sc;
947 {
948 	struct ncr53c9x_ecb *ecb;
949 	struct scsi_link *sc_link;
950 	struct ncr53c9x_tinfo *ti;
951 	int lun;
952 	struct ncr53c9x_linfo *li;
953 	int s, tag;
954 
955 	NCR_TRACE(("[ncr53c9x_sched] "));
956 	if (sc->sc_state != NCR_IDLE)
957 		panic("ncr53c9x_sched: not IDLE (state=%d)", sc->sc_state);
958 
959 	/*
960 	 * Find first ecb in ready queue that is for a target/lunit
961 	 * combinations that is not busy.
962 	 */
963 	TAILQ_FOREACH(ecb, &sc->ready_list, chain) {
964 		sc_link = ecb->xs->sc_link;
965 		ti = &sc->sc_tinfo[sc_link->target];
966 		lun = sc_link->lun;
967 
968 		/* Select type of tag for this command */
969 		if ((ti->flags & (T_RSELECTOFF)) != 0)
970 			tag = 0;
971 		else if ((ti->flags & T_TAG) == 0)
972 			tag = 0;
973 		else if ((ecb->flags & ECB_SENSE) != 0)
974 			tag = 0;
975 		else
976 			tag = MSG_SIMPLE_Q_TAG;
977 #if 0
978 		/* XXXX Use tags for polled commands? */
979 		if (ecb->xs->flags & SCSI_POLL)
980 			tag = 0;
981 #endif
982 		s = splbio();
983 		li = TINFO_LUN(ti, lun);
984 		if (!li) {
985 			/* Initialize LUN info and add to list. */
986 			if ((li = malloc(sizeof(*li), M_DEVBUF,
987 			    M_NOWAIT | M_ZERO)) == NULL) {
988 				splx(s);
989 				continue;
990 			}
991 			li->lun = lun;
992 
993 			LIST_INSERT_HEAD(&ti->luns, li, link);
994 			if (lun < NCR_NLUN)
995 				ti->lun[lun] = li;
996 		}
997 		li->last_used = getuptime();
998 		if (!tag) {
999 			/* Try to issue this as an un-tagged command */
1000 			if (!li->untagged)
1001 				li->untagged = ecb;
1002 		}
1003 		if (li->untagged) {
1004 			tag = 0;
1005 			if ((li->busy != 1) && !li->used) {
1006 				/* We need to issue this untagged command now */
1007 				ecb = li->untagged;
1008 				sc_link = ecb->xs->sc_link;
1009 			}
1010 			else {
1011 				/* Not ready yet */
1012 				splx(s);
1013 				continue;
1014 			}
1015 		}
1016 		ecb->tag[0] = tag;
1017 		if (tag) {
1018 			int i;
1019 
1020 			/* Allocate a tag */
1021 			if (li->used == 255) {
1022 				/* no free tags */
1023 				splx(s);
1024 				continue;
1025 			}
1026 			/* Start from the last used location */
1027 			for (i=li->avail; i<256; i++) {
1028 				if (li->queued[i] == NULL)
1029 					break;
1030 			}
1031 			/* Couldn't find one, start again from the beginning */
1032 			if (i == 256) {
1033 				for (i = 0; i<256; i++) {
1034 					if (li->queued[i] == NULL)
1035 						break;
1036 				}
1037 			}
1038 #ifdef DIAGNOSTIC
1039 			if (i == 256)
1040 				panic("ncr53c9x_sched: tag alloc failure");
1041 #endif
1042 
1043 			/* Save where to start next time. */
1044 			li->avail = i+1;
1045 			li->used++;
1046 
1047 			li->queued[i] = ecb;
1048 			ecb->tag[1] = i;
1049 		}
1050 		splx(s);
1051 		if (li->untagged && (li->busy != 1)) {
1052 			li->busy = 1;
1053 			TAILQ_REMOVE(&sc->ready_list, ecb, chain);
1054 			ecb->flags &= ~ECB_READY;
1055 			sc->sc_nexus = ecb;
1056 			ncr53c9x_select(sc, ecb);
1057 			break;
1058 		}
1059 		if (!li->untagged && tag) {
1060 			TAILQ_REMOVE(&sc->ready_list, ecb, chain);
1061 			ecb->flags &= ~ECB_READY;
1062 			sc->sc_nexus = ecb;
1063 			ncr53c9x_select(sc, ecb);
1064 			break;
1065 		} else
1066 			NCR_MISC(("%d:%d busy\n",
1067 				  sc_link->target,
1068 				  sc_link->lun));
1069 	}
1070 }
1071 
1072 void
1073 ncr53c9x_sense(sc, ecb)
1074 	struct ncr53c9x_softc *sc;
1075 	struct ncr53c9x_ecb *ecb;
1076 {
1077 	struct scsi_xfer *xs = ecb->xs;
1078 	struct scsi_link *sc_link = xs->sc_link;
1079 	struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[sc_link->target];
1080 	struct scsi_sense *ss = (void *)&ecb->cmd.cmd;
1081 	struct ncr53c9x_linfo *li;
1082 	int lun = sc_link->lun;
1083 
1084 	NCR_MISC(("requesting sense "));
1085 	/* Next, setup a request sense command block */
1086 	bzero(ss, sizeof(*ss));
1087 	ss->opcode = REQUEST_SENSE;
1088 	ss->byte2 = sc_link->lun << 5;
1089 	ss->length = sizeof(struct scsi_sense_data);
1090 	ecb->clen = sizeof(*ss);
1091 	ecb->daddr = (char *)&xs->sense;
1092 	ecb->dleft = sizeof(struct scsi_sense_data);
1093 	ecb->flags |= ECB_SENSE;
1094 	ecb->timeout = NCR_SENSE_TIMEOUT;
1095 	ti->senses++;
1096 	li = TINFO_LUN(ti, lun);
1097 	if (li->busy) li->busy = 0;
1098 	ncr53c9x_dequeue(sc, ecb);
1099 	li->untagged = ecb;
1100 	li->busy = 2;
1101 	if (ecb == sc->sc_nexus) {
1102 		ncr53c9x_select(sc, ecb);
1103 	} else {
1104 		TAILQ_INSERT_HEAD(&sc->ready_list, ecb, chain);
1105 		ecb->flags |= ECB_READY;
1106 		if (sc->sc_state == NCR_IDLE)
1107 			ncr53c9x_sched(sc);
1108 	}
1109 }
1110 
1111 /*
1112  * POST PROCESSING OF SCSI_CMD (usually current)
1113  */
1114 void
1115 ncr53c9x_done(sc, ecb)
1116 	struct ncr53c9x_softc *sc;
1117 	struct ncr53c9x_ecb *ecb;
1118 {
1119 	struct scsi_xfer *xs = ecb->xs;
1120 	struct scsi_link *sc_link = xs->sc_link;
1121 	struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[sc_link->target];
1122 	int lun = sc_link->lun;
1123 	struct ncr53c9x_linfo *li = TINFO_LUN(ti, lun);
1124 
1125 	NCR_TRACE(("[ncr53c9x_done(error:%x)] ", xs->error));
1126 
1127 	timeout_del(&ecb->to);
1128 
1129 	if (ecb->stat == SCSI_QUEUE_FULL) {
1130 		/*
1131 		 * Set current throttle -- we should reset
1132 		 * this periodically
1133 		 */
1134 		sc_link->openings = li->used - 1;
1135 		printf("\n%s: QFULL -- throttling to %d commands\n",
1136 		    sc->sc_dev.dv_xname, sc_link->openings);
1137 	}
1138 
1139 	/*
1140 	 * Now, if we've come here with no error code, i.e. we've kept the
1141 	 * initial XS_NOERROR, and the status code signals that we should
1142 	 * check sense, we'll need to set up a request sense cmd block and
1143 	 * push the command back into the ready queue *before* any other
1144 	 * commands for this target/lunit, else we lose the sense info.
1145 	 * We don't support chk sense conditions for the request sense cmd.
1146 	 */
1147 	if (xs->error == XS_NOERROR) {
1148 		xs->status = ecb->stat;
1149 		if ((ecb->flags & ECB_ABORT) != 0) {
1150 			xs->error = XS_TIMEOUT;
1151 		} else if ((ecb->flags & ECB_SENSE) != 0) {
1152 			xs->error = XS_SENSE;
1153 		} else if ((ecb->stat & ST_MASK) == SCSI_CHECK) {
1154 			/* First, save the return values */
1155 			xs->resid = ecb->dleft;
1156 			ncr53c9x_sense(sc, ecb);
1157 			return;
1158 		} else {
1159 			xs->resid = ecb->dleft;
1160 		}
1161 	}
1162 
1163 #ifdef NCR53C9X_DEBUG
1164 	if (ncr53c9x_debug & NCR_SHOWMISC) {
1165 		if (xs->resid != 0)
1166 			printf("resid=%lu ", (unsigned long)xs->resid);
1167 		if (xs->error == XS_SENSE)
1168 			printf("sense=0x%02x\n", xs->sense.error_code);
1169 		else
1170 			printf("error=%d\n", xs->error);
1171 	}
1172 #endif
1173 
1174 	/*
1175 	 * Remove the ECB from whatever queue it's on.
1176 	 */
1177 	ncr53c9x_dequeue(sc, ecb);
1178 	if (ecb == sc->sc_nexus) {
1179 		sc->sc_nexus = NULL;
1180 		if (sc->sc_state != NCR_CLEANING) {
1181 			sc->sc_state = NCR_IDLE;
1182 			ncr53c9x_sched(sc);
1183 		}
1184 	}
1185 
1186 	ti->cmds++;
1187 	scsi_done(xs);
1188 }
1189 
1190 void
1191 ncr53c9x_dequeue(sc, ecb)
1192 	struct ncr53c9x_softc *sc;
1193 	struct ncr53c9x_ecb *ecb;
1194 {
1195 	struct ncr53c9x_tinfo *ti =
1196 	    &sc->sc_tinfo[ecb->xs->sc_link->target];
1197 	struct ncr53c9x_linfo *li;
1198 	int64_t lun = ecb->xs->sc_link->lun;
1199 
1200 	li = TINFO_LUN(ti, lun);
1201 #ifdef DIAGNOSTIC
1202 	if ((!li) || (li->lun != lun))
1203 		panic("ncr53c9x_dequeue: lun %llx for ecb %p does not exist",
1204 		    (long long)lun, ecb);
1205 #endif
1206 	if (li->untagged == ecb) {
1207 		li->busy = 0;
1208 		li->untagged = NULL;
1209 	}
1210 	if (ecb->tag[0] && li->queued[ecb->tag[1]]) {
1211 #ifdef DIAGNOSTIC
1212 		if (li->queued[ecb->tag[1]] && (li->queued[ecb->tag[1]] != ecb))
1213 			panic("ncr53c9x_dequeue: slot %d for lun %llx has %p "
1214 			    "instead of ecb %p", ecb->tag[1],
1215 			    (long long)lun,
1216 			    li->queued[ecb->tag[1]], ecb);
1217 #endif
1218 		li->queued[ecb->tag[1]] = NULL;
1219 		li->used --;
1220 
1221 	}
1222 	if (ecb->flags & ECB_READY) {
1223 		ecb->flags &= ~ECB_READY;
1224 		TAILQ_REMOVE(&sc->ready_list, ecb, chain);
1225 	}
1226  }
1227 
1228 /*
1229  * INTERRUPT/PROTOCOL ENGINE
1230  */
1231 
1232 /*
1233  * Schedule an outgoing message by prioritizing it, and asserting
1234  * attention on the bus. We can only do this when we are the initiator
1235  * else there will be an illegal command interrupt.
1236  */
1237 #define ncr53c9x_sched_msgout(m) \
1238 	do {							\
1239 		NCR_MISC(("ncr53c9x_sched_msgout %x %d ", m, __LINE__));	\
1240 		NCRCMD(sc, NCRCMD_SETATN);			\
1241 		sc->sc_flags |= NCR_ATN;			\
1242 		sc->sc_msgpriq |= (m);				\
1243 	} while (0)
1244 
1245 static void
1246 ncr53c9x_flushfifo(struct ncr53c9x_softc *sc)
1247 {
1248 	NCR_MISC(("[flushfifo] "));
1249 
1250 	NCRCMD(sc, NCRCMD_FLUSH);
1251 
1252 	if (sc->sc_phase == COMMAND_PHASE ||
1253 	    sc->sc_phase == MESSAGE_OUT_PHASE)
1254 		DELAY(2);
1255 }
1256 
1257 static int
1258 ncr53c9x_rdfifo(struct ncr53c9x_softc *sc, int how)
1259 {
1260 	int i, n;
1261 	u_char *buf;
1262 
1263 	switch(how) {
1264 	case NCR_RDFIFO_START:
1265 		buf = sc->sc_imess;
1266 		sc->sc_imlen = 0;
1267 		break;
1268 	case NCR_RDFIFO_CONTINUE:
1269 		buf = sc->sc_imess + sc->sc_imlen;
1270 		break;
1271 	default:
1272 		panic("ncr53c9x_rdfifo: bad flag");
1273 		break;
1274 	}
1275 
1276 	/*
1277 	 * XXX buffer (sc_imess) size for message
1278 	 */
1279 
1280 	n = NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF;
1281 
1282 	if (sc->sc_rev == NCR_VARIANT_FAS366) {
1283 		n *= 2;
1284 
1285 		for (i = 0; i < n; i++)
1286 			buf[i] = NCR_READ_REG(sc, NCR_FIFO);
1287 
1288 		if (sc->sc_espstat2 & FAS_STAT2_ISHUTTLE) {
1289 
1290 			NCR_WRITE_REG(sc, NCR_FIFO, 0);
1291 			buf[i++] = NCR_READ_REG(sc, NCR_FIFO);
1292 
1293 			NCR_READ_REG(sc, NCR_FIFO);
1294 
1295 			ncr53c9x_flushfifo(sc);
1296 		}
1297 	} else {
1298 		for (i = 0; i < n; i++)
1299 			buf[i] = NCR_READ_REG(sc, NCR_FIFO);
1300 	}
1301 
1302 	sc->sc_imlen += i;
1303 
1304 #ifdef NCR53C9X_DEBUG
1305 	{
1306 		int j;
1307 
1308 		NCR_TRACE(("\n[rdfifo %s (%d):",
1309 		    (how == NCR_RDFIFO_START) ? "start" : "cont",
1310 		    (int)sc->sc_imlen));
1311 		if (ncr53c9x_debug & NCR_SHOWTRAC) {
1312 			for (j = 0; j < sc->sc_imlen; j++)
1313 				printf(" %02x", sc->sc_imess[j]);
1314 			printf("]\n");
1315 		}
1316 	}
1317 #endif
1318 	return sc->sc_imlen;
1319 }
1320 
1321 static void
1322 ncr53c9x_wrfifo(struct ncr53c9x_softc *sc, u_char *p, int len)
1323 {
1324 	int i;
1325 
1326 #ifdef NCR53C9X_DEBUG
1327 	NCR_MISC(("[wrfifo(%d):", len));
1328 	if (ncr53c9x_debug & NCR_SHOWTRAC) {
1329 		for (i = 0; i < len; i++)
1330 			printf(" %02x", p[i]);
1331 		printf("]\n");
1332 	}
1333 #endif
1334 
1335 	for (i = 0; i < len; i++) {
1336 		NCR_WRITE_REG(sc, NCR_FIFO, p[i]);
1337 
1338 		if (sc->sc_rev == NCR_VARIANT_FAS366)
1339 			NCR_WRITE_REG(sc, NCR_FIFO, 0);
1340 	}
1341 }
1342 
1343 int
1344 ncr53c9x_reselect(sc, message, tagtype, tagid)
1345 	struct ncr53c9x_softc *sc;
1346 	int message;
1347 	int tagtype;
1348 	int tagid;
1349 {
1350 	u_char selid, target, lun;
1351 	struct ncr53c9x_ecb *ecb = NULL;
1352 	struct ncr53c9x_tinfo *ti;
1353 	struct ncr53c9x_linfo *li;
1354 
1355 	if (sc->sc_rev == NCR_VARIANT_FAS366) {
1356 		target = sc->sc_selid;
1357 	} else {
1358 		/*
1359 		 * The SCSI chip made a snapshot of the data bus while the reselection
1360 		 * was being negotiated.  This enables us to determine which target did
1361 		 * the reselect.
1362 		 */
1363 		selid = sc->sc_selid & ~(1 << sc->sc_id);
1364 		if (selid & (selid - 1)) {
1365 			printf("%s: reselect with invalid selid %02x;"
1366 			    " sending DEVICE RESET\n", sc->sc_dev.dv_xname, selid);
1367 			goto reset;
1368 
1369 		}
1370 		target = ffs(selid) - 1;
1371 	}
1372 	lun = message & 0x07;
1373 
1374 	/*
1375 	 * Search wait queue for disconnected cmd
1376 	 * The list should be short, so I haven't bothered with
1377 	 * any more sophisticated structures than a simple
1378 	 * singly linked list.
1379 	 */
1380 	ti = &sc->sc_tinfo[target];
1381 	li = TINFO_LUN(ti, lun);
1382 
1383 	/*
1384 	 * We can get as far as the LUN with the IDENTIFY
1385 	 * message.  Check to see if we're running an
1386 	 * un-tagged command.  Otherwise ack the IDENTIFY
1387 	 * and wait for a tag message.
1388 	 */
1389 	if (li != NULL) {
1390 		if (li->untagged != NULL && li->busy)
1391 			ecb = li->untagged;
1392 		else if (tagtype != MSG_SIMPLE_Q_TAG) {
1393 			/* Wait for tag to come by */
1394 			sc->sc_state = NCR_IDENTIFIED;
1395 			return (0);
1396 		} else if (tagtype) ecb = li->queued[tagid];
1397 	}
1398 	if (ecb == NULL) {
1399 		printf("%s: reselect from target %d lun %d tag %x:%x with no nexus;"
1400 		    " sending ABORT\n", sc->sc_dev.dv_xname, target, lun, tagtype, tagid);
1401 		goto abort;
1402 	}
1403 
1404 	/* Make this nexus active again. */
1405 	sc->sc_state = NCR_CONNECTED;
1406 	sc->sc_nexus = ecb;
1407 	ncr53c9x_setsync(sc, ti);
1408 
1409 	if (ecb->flags & ECB_RESET)
1410 		ncr53c9x_sched_msgout(SEND_DEV_RESET);
1411 	else if (ecb->flags & ECB_ABORT)
1412 		ncr53c9x_sched_msgout(SEND_ABORT);
1413 
1414 	/* Do an implicit RESTORE POINTERS. */
1415 	sc->sc_dp = ecb->daddr;
1416 	sc->sc_dleft = ecb->dleft;
1417 
1418 	return (0);
1419 
1420 reset:
1421 	ncr53c9x_sched_msgout(SEND_DEV_RESET);
1422 	return (1);
1423 
1424 abort:
1425 	ncr53c9x_sched_msgout(SEND_ABORT);
1426 	return (1);
1427 }
1428 
1429 static inline int
1430 __verify_msg_format(u_char *p, int len)
1431 {
1432 
1433 	if (len == 1 && IS1BYTEMSG(p[0]))
1434 		return 1;
1435 	if (len == 2 && IS2BYTEMSG(p[0]))
1436 		return 1;
1437 	if (len >= 3 && ISEXTMSG(p[0]) &&
1438 	    len == p[1] + 2)
1439 		return 1;
1440 
1441 	return 0;
1442 }
1443 
1444 /*
1445  * Get an incoming message as initiator.
1446  *
1447  * The SCSI bus must already be in MESSAGE_IN_PHASE and there is a
1448  * byte in the FIFO
1449  */
1450 void
1451 ncr53c9x_msgin(sc)
1452 	struct ncr53c9x_softc *sc;
1453 {
1454 
1455 	NCR_TRACE(("[ncr53c9x_msgin(curmsglen:%ld)] ", (long)sc->sc_imlen));
1456 
1457 	if (sc->sc_imlen == 0) {
1458 		printf("%s: msgin: no msg byte available\n", sc->sc_dev.dv_xname);
1459 		return;
1460 	}
1461 
1462 	/*
1463 	 * Prepare for a new message.  A message should (according
1464 	 * to the SCSI standard) be transmitted in one single
1465 	 * MESSAGE_IN_PHASE. If we have been in some other phase,
1466 	 * then this is a new message.
1467 	 */
1468 	if (sc->sc_prevphase != MESSAGE_IN_PHASE && sc->sc_state != NCR_RESELECTED) {
1469 		printf("%s: phase change, dropping message, prev %d, state %d\n",
1470 		    sc->sc_dev.dv_xname, sc->sc_prevphase, sc->sc_state);
1471 		sc->sc_flags &= ~NCR_DROP_MSGI;
1472 		sc->sc_imlen = 0;
1473 	}
1474 
1475 	NCR_TRACE(("<msgbyte:0x%02x>", sc->sc_imess[0]));
1476 
1477 	/*
1478 	 * If we're going to reject the message, don't bother storing
1479 	 * the incoming bytes.  But still, we need to ACK them.
1480 	 */
1481 	if ((sc->sc_flags & NCR_DROP_MSGI)) {
1482 		NCRCMD(sc, NCRCMD_MSGOK);
1483 		printf("<dropping msg byte %x>",
1484 			sc->sc_imess[sc->sc_imlen]);
1485 		return;
1486 	}
1487 
1488 	if (sc->sc_imlen >= NCR_MAX_MSG_LEN) {
1489 		ncr53c9x_sched_msgout(SEND_REJECT);
1490 		sc->sc_flags |= NCR_DROP_MSGI;
1491 	} else {
1492 		u_char *pb;
1493 		int plen;
1494 
1495 		switch (sc->sc_state) {
1496 			/*
1497 			 * if received message is the first of reselection
1498 			 * then first byte is selid, and then message
1499 			 */
1500 		case NCR_RESELECTED:
1501 			pb = sc->sc_imess + 1;
1502 			plen = sc->sc_imlen - 1;
1503 			break;
1504 		default:
1505 			pb = sc->sc_imess;
1506 			plen = sc->sc_imlen;
1507 			break;
1508 		}
1509 
1510 		if (__verify_msg_format(pb, plen))
1511 			goto gotit;
1512 	}
1513 
1514 	/* Ack what we have so far */
1515 	NCRCMD(sc, NCRCMD_MSGOK);
1516 	return;
1517 
1518 gotit:
1519 	NCR_MSGS(("gotmsg(%x) state %d", sc->sc_imess[0], sc->sc_state));
1520 	/* we got complete message, flush the imess, XXX nobody uses imlen below */
1521 	sc->sc_imlen = 0;
1522 
1523 	/*
1524 	 * Now we should have a complete message (1 byte, 2 byte
1525 	 * and moderately long extended messages).  We only handle
1526 	 * extended messages which total length is shorter than
1527 	 * NCR_MAX_MSG_LEN.  Longer messages will be amputated.
1528 	 */
1529 	switch (sc->sc_state) {
1530 		struct ncr53c9x_ecb *ecb;
1531 		struct ncr53c9x_tinfo *ti;
1532 		struct ncr53c9x_linfo *li;
1533 		int lun;
1534 
1535 	case NCR_CONNECTED:
1536 		ecb = sc->sc_nexus;
1537 		ti = &sc->sc_tinfo[ecb->xs->sc_link->target];
1538 
1539 		switch (sc->sc_imess[0]) {
1540 		case MSG_CMDCOMPLETE:
1541 			NCR_MSGS(("cmdcomplete "));
1542 			if (sc->sc_dleft < 0) {
1543 				sc_print_addr(ecb->xs->sc_link);
1544 				printf("got %ld extra bytes\n",
1545 				    -(long)sc->sc_dleft);
1546 				sc->sc_dleft = 0;
1547 			}
1548 			ecb->dleft = (ecb->flags & ECB_TENTATIVE_DONE)
1549 				? 0
1550 				: sc->sc_dleft;
1551 			if ((ecb->flags & ECB_SENSE) == 0)
1552 				ecb->xs->resid = ecb->dleft;
1553 			sc->sc_state = NCR_CMDCOMPLETE;
1554 			break;
1555 
1556 		case MSG_MESSAGE_REJECT:
1557 			NCR_MSGS(("msg reject (msgout=%x) ", sc->sc_msgout));
1558 			switch (sc->sc_msgout) {
1559 			case SEND_TAG:
1560 				/* Target does not like tagged queuing.
1561 				 *  - Flush the command queue
1562 				 *  - Disable tagged queuing for the target
1563 				 *  - Dequeue ecb from the queued array.
1564 				 */
1565 				printf("%s: tagged queuing rejected: target %d\n",
1566 				    sc->sc_dev.dv_xname, ecb->xs->sc_link->target);
1567 
1568 				NCR_MSGS(("(rejected sent tag)"));
1569 				NCRCMD(sc, NCRCMD_FLUSH);
1570 				DELAY(1);
1571 				ti->flags &= ~T_TAG;
1572 				lun = ecb->xs->sc_link->lun;
1573 				li = TINFO_LUN(ti, lun);
1574 				if (ecb->tag[0] &&
1575 				    li->queued[ecb->tag[1]] != NULL) {
1576 					li->queued[ecb->tag[1]] = NULL;
1577 					li->used--;
1578 				}
1579 				ecb->tag[0] = ecb->tag[1] = 0;
1580 				li->untagged = ecb;
1581 				li->busy = 1;
1582 				break;
1583 
1584 			case SEND_SDTR:
1585 				printf("%s: sync transfer rejected: target %d\n",
1586 				    sc->sc_dev.dv_xname, ecb->xs->sc_link->target);
1587 				sc->sc_flags &= ~NCR_SYNCHNEGO;
1588 				ti->flags &= ~(T_NEGOTIATE | T_SYNCMODE);
1589 				ncr53c9x_setsync(sc, ti);
1590 				break;
1591 
1592 			case SEND_WDTR:
1593 				printf("%s: wide transfer rejected: target %d\n",
1594 				    sc->sc_dev.dv_xname, ecb->xs->sc_link->target);
1595 				ti->flags &= ~T_WIDE;
1596 				ti->width = 0;
1597 				break;
1598 
1599 			case SEND_INIT_DET_ERR:
1600 				goto abort;
1601 			}
1602 			break;
1603 
1604 		case MSG_NOOP:
1605 			NCR_MSGS(("noop "));
1606 			break;
1607 
1608 		case MSG_HEAD_OF_Q_TAG:
1609 		case MSG_SIMPLE_Q_TAG:
1610 		case MSG_ORDERED_Q_TAG:
1611 			NCR_MSGS(("TAG %x:%x", sc->sc_imess[0], sc->sc_imess[1]));
1612 			break;
1613 
1614 		case MSG_DISCONNECT:
1615 			NCR_MSGS(("disconnect "));
1616 			ti->dconns++;
1617 			sc->sc_state = NCR_DISCONNECT;
1618 
1619 			/*
1620 			 * Mark the fact that all bytes have moved. The
1621 			 * target may not bother to do a SAVE POINTERS
1622 			 * at this stage. This flag will set the residual
1623 			 * count to zero on MSG COMPLETE.
1624 			 */
1625 			if (sc->sc_dleft == 0)
1626 				ecb->flags |= ECB_TENTATIVE_DONE;
1627 
1628 			break;
1629 
1630 		case MSG_SAVEDATAPOINTER:
1631 			NCR_MSGS(("save datapointer "));
1632 			ecb->daddr = sc->sc_dp;
1633 			ecb->dleft = sc->sc_dleft;
1634 			break;
1635 
1636 		case MSG_RESTOREPOINTERS:
1637 			NCR_MSGS(("restore datapointer "));
1638 			sc->sc_dp = ecb->daddr;
1639 			sc->sc_dleft = ecb->dleft;
1640 			break;
1641 
1642 		case MSG_EXTENDED:
1643 			NCR_MSGS(("extended(%x) ", sc->sc_imess[2]));
1644 			switch (sc->sc_imess[2]) {
1645 			case MSG_EXT_SDTR:
1646 				NCR_MSGS(("SDTR period %d, offset %d ",
1647 					sc->sc_imess[3], sc->sc_imess[4]));
1648 				if (sc->sc_imess[1] != 3)
1649 					goto reject;
1650 				ti->period = sc->sc_imess[3];
1651 				ti->offset = sc->sc_imess[4];
1652 				ti->flags &= ~T_NEGOTIATE;
1653 				if (sc->sc_minsync == 0 ||
1654 				    ti->offset == 0 ||
1655 				    ti->period > 124) {
1656 #ifdef NCR53C9X_DEBUG
1657 					sc_print_addr(ecb->xs->sc_link);
1658 					printf("async mode\n");
1659 #endif
1660 					if ((sc->sc_flags&NCR_SYNCHNEGO)
1661 					    == 0) {
1662 						/*
1663 						 * target initiated negotiation
1664 						 */
1665 						ti->offset = 0;
1666 						ti->flags &= ~T_SYNCMODE;
1667 						ncr53c9x_sched_msgout(
1668 						    SEND_SDTR);
1669 					} else {
1670 						/* we are async */
1671 						ti->flags &= ~T_SYNCMODE;
1672 					}
1673 				} else {
1674 #ifdef NCR53C9X_DEBUG
1675 					int r, s;
1676 #endif
1677 					int p;
1678 
1679 					p = ncr53c9x_stp2cpb(sc, ti->period);
1680 					ti->period = ncr53c9x_cpb2stp(sc, p);
1681 #ifdef NCR53C9X_DEBUG
1682 					sc_print_addr(ecb->xs->sc_link);
1683 					r = 250/ti->period;
1684 					s = (100*250)/ti->period - 100*r;
1685 					printf("max sync rate %d.%02dMB/s\n",
1686 						r, s);
1687 #endif
1688 					if ((sc->sc_flags&NCR_SYNCHNEGO) == 0) {
1689 						/*
1690 						 * target initiated negotiation
1691 						 */
1692 						if (ti->period <
1693 						    sc->sc_minsync)
1694 							ti->period =
1695 							    sc->sc_minsync;
1696 						if (ti->offset > 15)
1697 							ti->offset = 15;
1698 						ti->flags &= ~T_SYNCMODE;
1699 						ncr53c9x_sched_msgout(
1700 						    SEND_SDTR);
1701 					} else {
1702 						/* we are sync */
1703 						ti->flags |= T_SYNCMODE;
1704 					}
1705 				}
1706 				sc->sc_flags &= ~NCR_SYNCHNEGO;
1707 				ncr53c9x_setsync(sc, ti);
1708 				break;
1709 
1710 			case MSG_EXT_WDTR:
1711 				printf("%s: wide mode %d\n",
1712 				    sc->sc_dev.dv_xname, sc->sc_imess[3]);
1713 				if (sc->sc_imess[3] == 1) {
1714 					ti->cfg3 |= NCRFASCFG3_EWIDE;
1715 					ncr53c9x_setsync(sc, ti);
1716 				} else
1717 					ti->width = 0;
1718 				ti->flags &= ~T_WIDE;
1719 				break;
1720 			default:
1721 				sc_print_addr(ecb->xs->sc_link);
1722 				printf("unrecognized MESSAGE EXTENDED;"
1723 				    " sending REJECT\n");
1724 				goto reject;
1725 			}
1726 			break;
1727 
1728 		default:
1729 			NCR_MSGS(("ident "));
1730 			sc_print_addr(ecb->xs->sc_link);
1731 			printf("unrecognized MESSAGE; sending REJECT\n");
1732 		reject:
1733 			ncr53c9x_sched_msgout(SEND_REJECT);
1734 			break;
1735 		}
1736 		break;
1737 
1738 	case NCR_IDENTIFIED:
1739 		/*
1740 		 * IDENTIFY message was received and queue tag is expected now
1741 		 */
1742 		if ((sc->sc_imess[0] != MSG_SIMPLE_Q_TAG) ||
1743 		    (sc->sc_msgify == 0)) {
1744 			printf("%s: TAG reselect without IDENTIFY;"
1745 			    " MSG %x;"
1746 			    " sending DEVICE RESET\n",
1747 			    sc->sc_dev.dv_xname,
1748 			    sc->sc_imess[0]);
1749 			goto reset;
1750 		}
1751 		(void) ncr53c9x_reselect(sc, sc->sc_msgify,
1752 		    sc->sc_imess[0], sc->sc_imess[1]);
1753 		break;
1754 
1755 	case NCR_RESELECTED:
1756 		if (MSG_ISIDENTIFY(sc->sc_imess[1])) {
1757 			sc->sc_msgify = sc->sc_imess[1];
1758 		} else {
1759 			printf("%s: reselect without IDENTIFY;"
1760 			    " MSG %x;"
1761 			    " sending DEVICE RESET\n",
1762 			    sc->sc_dev.dv_xname,
1763 			    sc->sc_imess[1]);
1764 			goto reset;
1765 		}
1766 		(void) ncr53c9x_reselect(sc, sc->sc_msgify, 0, 0);
1767 		break;
1768 
1769 	default:
1770 		printf("%s: unexpected MESSAGE IN; sending DEVICE RESET\n",
1771 		    sc->sc_dev.dv_xname);
1772 	reset:
1773 		ncr53c9x_sched_msgout(SEND_DEV_RESET);
1774 		break;
1775 
1776 	abort:
1777 		ncr53c9x_sched_msgout(SEND_ABORT);
1778 		break;
1779 	}
1780 
1781 	/* if we have more messages to send set ATN */
1782 	if (sc->sc_msgpriq)
1783 		NCRCMD(sc, NCRCMD_SETATN);
1784 
1785 	/* Ack last message byte */
1786 	NCRCMD(sc, NCRCMD_MSGOK);
1787 
1788 	/* Done, reset message pointer. */
1789 	sc->sc_flags &= ~NCR_DROP_MSGI;
1790 	sc->sc_imlen = 0;
1791 }
1792 
1793 
1794 /*
1795  * Send the highest priority, scheduled message
1796  */
1797 void
1798 ncr53c9x_msgout(sc)
1799 	struct ncr53c9x_softc *sc;
1800 {
1801 	struct ncr53c9x_tinfo *ti;
1802 	struct ncr53c9x_ecb *ecb;
1803 	size_t size;
1804 
1805 	NCR_TRACE(("[ncr53c9x_msgout(priq:%x, prevphase:%x)]",
1806 	    sc->sc_msgpriq, sc->sc_prevphase));
1807 
1808 	/*
1809 	 * XXX - the NCR_ATN flag is not in sync with the actual ATN
1810 	 *	 condition on the SCSI bus. The 53c9x chip
1811 	 *	 automatically turns off ATN before sending the
1812 	 *	 message byte.  (see also the comment below in the
1813 	 *	 default case when picking out a message to send)
1814 	 */
1815 	if (sc->sc_flags & NCR_ATN) {
1816 		if (sc->sc_prevphase != MESSAGE_OUT_PHASE) {
1817 		new:
1818 			NCRCMD(sc, NCRCMD_FLUSH);
1819 /*			DELAY(1); */
1820 			sc->sc_msgoutq = 0;
1821 			sc->sc_omlen = 0;
1822 		}
1823 	} else {
1824 		if (sc->sc_prevphase == MESSAGE_OUT_PHASE) {
1825 			ncr53c9x_sched_msgout(sc->sc_msgoutq);
1826 			goto new;
1827 		} else {
1828 			printf("%s at line %d: unexpected MESSAGE OUT phase\n",
1829 			    sc->sc_dev.dv_xname, __LINE__);
1830 		}
1831 	}
1832 
1833 	if (sc->sc_omlen == 0) {
1834 		/* Pick up highest priority message */
1835 		sc->sc_msgout = sc->sc_msgpriq & -sc->sc_msgpriq;
1836 		sc->sc_msgoutq |= sc->sc_msgout;
1837 		sc->sc_msgpriq &= ~sc->sc_msgout;
1838 		sc->sc_omlen = 1;		/* "Default" message len */
1839 		switch (sc->sc_msgout) {
1840 		case SEND_SDTR:
1841 			ecb = sc->sc_nexus;
1842 			ti = &sc->sc_tinfo[ecb->xs->sc_link->target];
1843 			sc->sc_omess[0] = MSG_EXTENDED;
1844 			sc->sc_omess[1] = 3;
1845 			sc->sc_omess[2] = MSG_EXT_SDTR;
1846 			sc->sc_omess[3] = ti->period;
1847 			sc->sc_omess[4] = ti->offset;
1848 			sc->sc_omlen = 5;
1849 			if ((sc->sc_flags & NCR_SYNCHNEGO) == 0) {
1850 				ti->flags |= T_SYNCMODE;
1851 				ncr53c9x_setsync(sc, ti);
1852 			}
1853 			break;
1854 		case SEND_WDTR:
1855 			ecb = sc->sc_nexus;
1856 			ti = &sc->sc_tinfo[ecb->xs->sc_link->target];
1857 			sc->sc_omess[0] = MSG_EXTENDED;
1858 			sc->sc_omess[1] = 2;
1859 			sc->sc_omess[2] = MSG_EXT_WDTR;
1860 			sc->sc_omess[3] = ti->width;
1861 			sc->sc_omlen = 4;
1862 			break;
1863 		case SEND_IDENTIFY:
1864 			if (sc->sc_state != NCR_CONNECTED) {
1865 				printf("%s at line %d: no nexus\n",
1866 				    sc->sc_dev.dv_xname, __LINE__);
1867 			}
1868 			ecb = sc->sc_nexus;
1869 			sc->sc_omess[0] =
1870 			    MSG_IDENTIFY(ecb->xs->sc_link->lun, 0);
1871 			break;
1872 		case SEND_TAG:
1873 			if (sc->sc_state != NCR_CONNECTED) {
1874 				printf("%s at line %d: no nexus\n",
1875 				    sc->sc_dev.dv_xname, __LINE__);
1876 			}
1877 			ecb = sc->sc_nexus;
1878 			sc->sc_omess[0] = ecb->tag[0];
1879 			sc->sc_omess[1] = ecb->tag[1];
1880 			sc->sc_omlen = 2;
1881 			break;
1882 		case SEND_DEV_RESET:
1883 			sc->sc_flags |= NCR_ABORTING;
1884 			sc->sc_omess[0] = MSG_BUS_DEV_RESET;
1885 			ecb = sc->sc_nexus;
1886 			ti = &sc->sc_tinfo[ecb->xs->sc_link->target];
1887 			ti->flags &= ~T_SYNCMODE;
1888 			if ((ti->flags & T_SYNCHOFF) == 0)
1889 				/* We can re-start sync negotiation */
1890 				ti->flags |= T_NEGOTIATE;
1891 			break;
1892 		case SEND_PARITY_ERROR:
1893 			sc->sc_omess[0] = MSG_PARITY_ERROR;
1894 			break;
1895 		case SEND_ABORT:
1896 			sc->sc_flags |= NCR_ABORTING;
1897 			sc->sc_omess[0] = MSG_ABORT;
1898 			break;
1899 		case SEND_INIT_DET_ERR:
1900 			sc->sc_omess[0] = MSG_INITIATOR_DET_ERR;
1901 			break;
1902 		case SEND_REJECT:
1903 			sc->sc_omess[0] = MSG_MESSAGE_REJECT;
1904 			break;
1905 		default:
1906 			/*
1907 			 * We normally do not get here, since the chip
1908 			 * automatically turns off ATN before the last
1909 			 * byte of a message is sent to the target.
1910 			 * However, if the target rejects our (multi-byte)
1911 			 * message early by switching to MSG IN phase
1912 			 * ATN remains on, so the target may return to
1913 			 * MSG OUT phase. If there are no scheduled messages
1914 			 * left we send a NO-OP.
1915 			 *
1916 			 * XXX - Note that this leaves no useful purpose for
1917 			 * the NCR_ATN flag.
1918 			 */
1919 			sc->sc_flags &= ~NCR_ATN;
1920 			sc->sc_omess[0] = MSG_NOOP;
1921 			break;
1922 		}
1923 		sc->sc_omp = sc->sc_omess;
1924 	}
1925 
1926 #ifdef DEBUG
1927 	{
1928 		int i;
1929 
1930 		for (i = 0; i<sc->sc_omlen; i++)
1931 			NCR_MISC(("<msgbyte:0x%02x>", sc->sc_omess[i]));
1932 	}
1933 #endif
1934 	if (sc->sc_rev == NCR_VARIANT_FAS366) {
1935 		/*
1936 		 * XXX fifo size
1937 		 */
1938 		ncr53c9x_flushfifo(sc);
1939 		ncr53c9x_wrfifo(sc, sc->sc_omp, sc->sc_omlen);
1940 		sc->sc_cmdlen = 0;
1941 		NCRCMD(sc, NCRCMD_TRANS);
1942 	} else {
1943 		/* (re)send the message */
1944 		size = min(sc->sc_omlen, sc->sc_maxxfer);
1945 		NCRDMA_SETUP(sc, &sc->sc_omp, &sc->sc_omlen, 0, &size);
1946 		/* Program the SCSI counter */
1947 		NCR_SET_COUNT(sc, size);
1948 
1949                /* Load the count in and start the message-out transfer */
1950 		NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA);
1951 		NCRCMD(sc, NCRCMD_TRANS|NCRCMD_DMA);
1952 		NCRDMA_GO(sc);
1953 	}
1954 }
1955 
1956 /*
1957  * This is the most critical part of the driver, and has to know
1958  * how to deal with *all* error conditions and phases from the SCSI
1959  * bus. If there are no errors and the DMA was active, then call the
1960  * DMA pseudo-interrupt handler. If this returns 1, then that was it
1961  * and we can return from here without further processing.
1962  *
1963  * Most of this needs verifying.
1964  */
1965 int sdebug = 0;
1966 int
1967 ncr53c9x_intr(arg)
1968 	void *arg;
1969 {
1970 	struct ncr53c9x_softc *sc = arg;
1971 	struct ncr53c9x_ecb *ecb;
1972 	struct scsi_link *sc_link;
1973 	struct ncr53c9x_tinfo *ti;
1974 	size_t size;
1975 	int nfifo;
1976 
1977 	NCR_TRACE(("[ncr53c9x_intr: state %d] ", sc->sc_state));
1978 
1979 	if (!NCRDMA_ISINTR(sc))
1980 		return (0);
1981 
1982 again:
1983 	/* and what do the registers say... */
1984 	ncr53c9x_readregs(sc);
1985 
1986 	/*
1987 	 * At the moment, only a SCSI Bus Reset or Illegal
1988 	 * Command are classed as errors. A disconnect is a
1989 	 * valid condition, and we let the code check is the
1990 	 * "NCR_BUSFREE_OK" flag was set before declaring it
1991 	 * and error.
1992 	 *
1993 	 * Also, the status register tells us about "Gross
1994 	 * Errors" and "Parity errors". Only the Gross Error
1995 	 * is really bad, and the parity errors are dealt
1996 	 * with later
1997 	 *
1998 	 * TODO
1999 	 *      If there are too many parity error, go to slow
2000 	 *      cable mode ?
2001 	 */
2002 
2003 	/* SCSI Reset */
2004 	if (sc->sc_espintr & NCRINTR_SBR) {
2005 		if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
2006 			NCRCMD(sc, NCRCMD_FLUSH);
2007 			DELAY(1);
2008 		}
2009 		if (sc->sc_state != NCR_SBR) {
2010 			printf("%s: SCSI bus reset\n",
2011 				sc->sc_dev.dv_xname);
2012 			ncr53c9x_init(sc, 0); /* Restart everything */
2013 			return (1);
2014 		}
2015 #if 0
2016 /*XXX*/		printf("<expected bus reset: "
2017 			"[intr %x, stat %x, step %d]>\n",
2018 			sc->sc_espintr, sc->sc_espstat,
2019 			sc->sc_espstep);
2020 #endif
2021 		if (sc->sc_nexus)
2022 			panic("%s: nexus in reset state",
2023 		      sc->sc_dev.dv_xname);
2024 		goto sched;
2025 	}
2026 
2027 	ecb = sc->sc_nexus;
2028 
2029 #define NCRINTR_ERR (NCRINTR_SBR|NCRINTR_ILL)
2030 	if (sc->sc_espintr & NCRINTR_ERR ||
2031 	    sc->sc_espstat & NCRSTAT_GE) {
2032 
2033 		if (sc->sc_espstat & NCRSTAT_GE) {
2034 			/* Gross Error; no target ? */
2035 			if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
2036 				NCRCMD(sc, NCRCMD_FLUSH);
2037 				DELAY(1);
2038 			}
2039 			if (sc->sc_state == NCR_CONNECTED ||
2040 			    sc->sc_state == NCR_SELECTING) {
2041 				ecb->xs->error = XS_TIMEOUT;
2042 				ncr53c9x_done(sc, ecb);
2043 			}
2044 			return (1);
2045 		}
2046 
2047 		if (sc->sc_espintr & NCRINTR_ILL) {
2048 			if (sc->sc_flags & NCR_EXPECT_ILLCMD) {
2049 				/*
2050 				 * Eat away "Illegal command" interrupt
2051 				 * on a ESP100 caused by a re-selection
2052 				 * while we were trying to select
2053 				 * another target.
2054 				 */
2055 #ifdef DEBUG
2056 				printf("%s: ESP100 work-around activated\n",
2057 					sc->sc_dev.dv_xname);
2058 #endif
2059 				sc->sc_flags &= ~NCR_EXPECT_ILLCMD;
2060 				return (1);
2061 			}
2062 			/* illegal command, out of sync ? */
2063 			printf("%s: illegal command: 0x%x "
2064 			    "(state %d, phase %x, prevphase %x)\n",
2065 				sc->sc_dev.dv_xname, sc->sc_lastcmd,
2066 				sc->sc_state, sc->sc_phase,
2067 				sc->sc_prevphase);
2068 			if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
2069 				NCRCMD(sc, NCRCMD_FLUSH);
2070 				DELAY(1);
2071 			}
2072 			ncr53c9x_init(sc, 1); /* Restart everything */
2073 			return (1);
2074 		}
2075 	}
2076 	sc->sc_flags &= ~NCR_EXPECT_ILLCMD;
2077 
2078 	/*
2079 	 * Call if DMA is active.
2080 	 *
2081 	 * If DMA_INTR returns true, then maybe go 'round the loop
2082 	 * again in case there is no more DMA queued, but a phase
2083 	 * change is expected.
2084 	 */
2085 	if (NCRDMA_ISACTIVE(sc)) {
2086 		int r = NCRDMA_INTR(sc);
2087 		if (r == -1) {
2088 			printf("%s: DMA error; resetting\n",
2089 				sc->sc_dev.dv_xname);
2090 			ncr53c9x_init(sc, 1);
2091 			return (1);
2092 		}
2093 		/* If DMA active here, then go back to work... */
2094 		if (NCRDMA_ISACTIVE(sc))
2095 			return (1);
2096 
2097 		if ((sc->sc_espstat & NCRSTAT_TC) == 0) {
2098 			/*
2099 			 * DMA not completed.  If we can not find a
2100 			 * acceptable explanation, print a diagnostic.
2101 			 */
2102 			if (sc->sc_state == NCR_SELECTING)
2103 				/*
2104 				 * This can happen if we are reselected
2105 				 * while using DMA to select a target.
2106 				 */
2107 				/*void*/;
2108 			else if (sc->sc_prevphase == MESSAGE_OUT_PHASE){
2109 				/*
2110 				 * Our (multi-byte) message (eg SDTR)
2111 				 * was interrupted by the target to
2112 				 * send a MSG REJECT.
2113 				 * Print diagnostic if current phase
2114 				 * is not MESSAGE IN.
2115 				 */
2116 				if (sc->sc_phase != MESSAGE_IN_PHASE)
2117 				    printf("%s: !TC on MSG OUT"
2118 				       " [intr %x, stat %x, step %d]"
2119 				       " prevphase %x, resid %lx\n",
2120 					sc->sc_dev.dv_xname,
2121 					sc->sc_espintr,
2122 					sc->sc_espstat,
2123 					sc->sc_espstep,
2124 					sc->sc_prevphase,
2125 					(u_long)sc->sc_omlen);
2126 			} else if (sc->sc_dleft == 0) {
2127 				/*
2128 				 * The DMA operation was started for
2129 				 * a DATA transfer. Print a diagnostic
2130 				 * if the DMA counter and TC bit
2131 				 * appear to be out of sync.
2132 				 */
2133 				printf("%s: !TC on DATA XFER"
2134 				       " [intr %x, stat %x, step %d]"
2135 				       " prevphase %x, resid %x\n",
2136 					sc->sc_dev.dv_xname,
2137 					sc->sc_espintr,
2138 					sc->sc_espstat,
2139 					sc->sc_espstep,
2140 					sc->sc_prevphase,
2141 					ecb?ecb->dleft:-1);
2142 			}
2143 		}
2144 	}
2145 
2146 	/*
2147 	 * check for less serious errors
2148 	 */
2149 	if (sc->sc_espstat & NCRSTAT_PE) {
2150 		printf("%s: SCSI bus parity error\n", sc->sc_dev.dv_xname);
2151 		if (sc->sc_prevphase == MESSAGE_IN_PHASE)
2152 			ncr53c9x_sched_msgout(SEND_PARITY_ERROR);
2153 		else
2154 			ncr53c9x_sched_msgout(SEND_INIT_DET_ERR);
2155 	}
2156 
2157 	if (sc->sc_espintr & NCRINTR_DIS) {
2158 		sc->sc_msgify = 0;
2159 		NCR_MISC(("<DISC [intr %x, stat %x, step %d]>",
2160 			sc->sc_espintr,sc->sc_espstat,sc->sc_espstep));
2161 		if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
2162 			NCRCMD(sc, NCRCMD_FLUSH);
2163 /*			DELAY(1); */
2164 		}
2165 		/*
2166 		 * This command must (apparently) be issued within
2167 		 * 250mS of a disconnect. So here you are...
2168 		 */
2169 		NCRCMD(sc, NCRCMD_ENSEL);
2170 
2171 		switch (sc->sc_state) {
2172 		case NCR_RESELECTED:
2173 			goto sched;
2174 
2175 		case NCR_SELECTING:
2176 			ecb->xs->error = XS_SELTIMEOUT;
2177 			goto finish;
2178 
2179 		case NCR_CONNECTED:
2180 			if ((sc->sc_flags & NCR_SYNCHNEGO)) {
2181 #ifdef NCR53C9X_DEBUG
2182 				if (ecb)
2183 					sc_print_addr(ecb->xs->sc_link);
2184 				printf("sync nego not completed!\n");
2185 #endif
2186 				ti = &sc->sc_tinfo[ecb->xs->sc_link->target];
2187 				sc->sc_flags &= ~NCR_SYNCHNEGO;
2188 				ti->flags &= ~(T_NEGOTIATE | T_SYNCMODE);
2189 			}
2190 
2191 			/* it may be OK to disconnect */
2192 			if ((sc->sc_flags & NCR_ABORTING) == 0) {
2193 				/*
2194 				 * Section 5.1.1 of the SCSI 2 spec
2195 				 * suggests issuing a REQUEST SENSE
2196 				 * following an unexpected disconnect.
2197 				 * Some devices go into a contingent
2198 				 * allegiance condition when
2199 				 * disconnecting, and this is necessary
2200 				 * to clean up their state.
2201 				 */
2202 				printf("%s: unexpected disconnect; ",
2203 				    sc->sc_dev.dv_xname);
2204 				if (ecb->flags & ECB_SENSE) {
2205 					printf("resetting\n");
2206 					goto reset;
2207 				}
2208 				printf("sending REQUEST SENSE\n");
2209 				timeout_del(&ecb->to);
2210 				ncr53c9x_sense(sc, ecb);
2211 				goto out;
2212 			}
2213 
2214 			ecb->xs->error = XS_TIMEOUT;
2215 			goto finish;
2216 
2217 		case NCR_DISCONNECT:
2218 			sc->sc_nexus = NULL;
2219 			goto sched;
2220 
2221 		case NCR_CMDCOMPLETE:
2222 			goto finish;
2223 		}
2224 	}
2225 
2226 	switch (sc->sc_state) {
2227 
2228 	case NCR_SBR:
2229 		printf("%s: waiting for SCSI Bus Reset to happen\n",
2230 			sc->sc_dev.dv_xname);
2231 		return (1);
2232 
2233 	case NCR_RESELECTED:
2234 		/*
2235 		 * we must be continuing a message ?
2236 		 */
2237 		if (sc->sc_phase != MESSAGE_IN_PHASE) {
2238 			printf("%s: target didn't identify\n",
2239 				sc->sc_dev.dv_xname);
2240 			ncr53c9x_init(sc, 1);
2241 			return (1);
2242 		}
2243 printf("<<RESELECT CONT'd>>");
2244 #if XXXX
2245 		ncr53c9x_msgin(sc);
2246 		if (sc->sc_state != NCR_CONNECTED) {
2247 			/* IDENTIFY fail?! */
2248 			printf("%s: identify failed\n",
2249 				sc->sc_dev.dv_xname);
2250 			ncr53c9x_init(sc, 1);
2251 			return (1);
2252 		}
2253 #endif
2254 		break;
2255 
2256 	case NCR_IDENTIFIED:
2257 		ecb = sc->sc_nexus;
2258 		if (sc->sc_phase != MESSAGE_IN_PHASE) {
2259 			int i = (NCR_READ_REG(sc, NCR_FFLAG)
2260 			    & NCRFIFO_FF);
2261 			/*
2262 			 * Things are seriously fucked up.
2263 			 * Pull the brakes, i.e. reset
2264 			 */
2265 			printf("%s: target didn't send tag: %d bytes in fifo\n",
2266 			    sc->sc_dev.dv_xname, i);
2267 			/* Drain and display fifo */
2268 			while (i-- > 0)
2269 				printf("[%d] ", NCR_READ_REG(sc, NCR_FIFO));
2270 			ncr53c9x_init(sc, 1);
2271 			return (1);
2272 		} else
2273 			goto msgin;
2274 
2275 		break;
2276 	case NCR_IDLE:
2277 	case NCR_SELECTING:
2278 		ecb = sc->sc_nexus;
2279 		if (sc->sc_espintr & NCRINTR_RESEL) {
2280 			sc->sc_msgpriq = sc->sc_msgout = sc->sc_msgoutq = 0;
2281 			sc->sc_flags = 0;
2282 			/*
2283 			 * If we're trying to select a
2284 			 * target ourselves, push our command
2285 			 * back into the ready list.
2286 			 */
2287 			if (sc->sc_state == NCR_SELECTING) {
2288 				NCR_MISC(("backoff selector "));
2289 				timeout_del(&ecb->to);
2290 				ncr53c9x_dequeue(sc, ecb);
2291 				TAILQ_INSERT_HEAD(&sc->ready_list, ecb, chain);
2292 				ecb->flags |= ECB_READY;
2293 				ecb = sc->sc_nexus = NULL;
2294 			}
2295 			sc->sc_state = NCR_RESELECTED;
2296 			if (sc->sc_phase != MESSAGE_IN_PHASE) {
2297 				/*
2298 				 * Things are seriously fucked up.
2299 				 * Pull the brakes, i.e. reset
2300 				 */
2301 				printf("%s: target didn't identify\n",
2302 					sc->sc_dev.dv_xname);
2303 				ncr53c9x_init(sc, 1);
2304 				return (1);
2305 			}
2306 			/*
2307 			 * The C90 only inhibits FIFO writes until
2308 			 * reselection is complete, instead of
2309 			 * waiting until the interrupt status register
2310 			 * has been read. So, if the reselect happens
2311 			 * while we were entering a command bytes (for
2312 			 * another target) some of those bytes can
2313 			 * appear in the FIFO here, after the
2314 			 * interrupt is taken.
2315 			 */
2316 			nfifo = ncr53c9x_rdfifo(sc, NCR_RDFIFO_START);
2317 
2318 			if (nfifo < 2 ||
2319 			    (nfifo > 2 &&
2320 			     sc->sc_rev != NCR_VARIANT_ESP100)) {
2321 				printf("%s: RESELECT: "
2322 				    "%d bytes in FIFO! "
2323 				    "[intr %x, stat %x, step %d, prevphase %x]\n",
2324 					sc->sc_dev.dv_xname,
2325 					nfifo,
2326 					sc->sc_espintr,
2327 					sc->sc_espstat,
2328 					sc->sc_espstep,
2329 					sc->sc_prevphase);
2330 				ncr53c9x_init(sc, 1);
2331 				return (1);
2332 			}
2333 			sc->sc_selid = sc->sc_imess[0];
2334 			NCR_MISC(("selid=%2x ", sc->sc_selid));
2335 
2336 			/* Handle identify message */
2337 			ncr53c9x_msgin(sc);
2338 			if (nfifo != 2) {
2339 				/*
2340 				 * Note: this should not happen
2341 				 * with `dmaselect' on.
2342 				 */
2343 				sc->sc_flags |= NCR_EXPECT_ILLCMD;
2344 				NCRCMD(sc, NCRCMD_FLUSH);
2345 			} else if (sc->sc_features & NCR_F_DMASELECT &&
2346 				   sc->sc_rev == NCR_VARIANT_ESP100) {
2347 				sc->sc_flags |= NCR_EXPECT_ILLCMD;
2348 			}
2349 
2350 			if (sc->sc_state != NCR_CONNECTED &&
2351 			    sc->sc_state != NCR_IDENTIFIED) {
2352 				/* IDENTIFY fail?! */
2353 				printf("%s: identify failed, state %d, intr %02x\n",
2354 					sc->sc_dev.dv_xname, sc->sc_state,
2355 				    sc->sc_espintr);
2356 				ncr53c9x_init(sc, 1);
2357 				return (1);
2358 			}
2359 			goto shortcut; /* ie. next phase expected soon */
2360 		}
2361 
2362 #define	NCRINTR_DONE	(NCRINTR_FC|NCRINTR_BS)
2363 		if ((sc->sc_espintr & NCRINTR_DONE) == NCRINTR_DONE) {
2364 			/*
2365 			 * Arbitration won; examine the `step' register
2366 			 * to determine how far the selection could progress.
2367 			 */
2368 			ecb = sc->sc_nexus;
2369 			if (!ecb)
2370 				panic("ncr53c9x: no nexus");
2371 
2372 			sc_link = ecb->xs->sc_link;
2373 			ti = &sc->sc_tinfo[sc_link->target];
2374 
2375 			switch (sc->sc_espstep) {
2376 			case 0:
2377 				/*
2378 				 * The target did not respond with a
2379 				 * message out phase - probably an old
2380 				 * device that doesn't recognize ATN.
2381 				 * Clear ATN and just continue, the
2382 				 * target should be in the command
2383 				 * phase.
2384 				 * XXXX check for command phase?
2385 				 */
2386 				NCRCMD(sc, NCRCMD_RSTATN);
2387 				break;
2388 			case 1:
2389 				if ((ti->flags & T_NEGOTIATE) == 0 &&
2390 				    ecb->tag[0] == 0) {
2391 					printf("%s: step 1 & !NEG\n",
2392 						sc->sc_dev.dv_xname);
2393 					goto reset;
2394 				}
2395 				if (sc->sc_phase != MESSAGE_OUT_PHASE) {
2396 					printf("%s: !MSGOUT\n",
2397 						sc->sc_dev.dv_xname);
2398 					goto reset;
2399 				}
2400 				if (ti->flags & T_WIDE) {
2401 					ncr53c9x_sched_msgout(SEND_WDTR);
2402 				}
2403 				if (ti->flags & T_NEGOTIATE) {
2404 					/* Start negotiating */
2405 					ti->period = sc->sc_minsync;
2406 					ti->offset = 15;
2407 					sc->sc_flags |= NCR_SYNCHNEGO;
2408 					if (ecb->tag[0])
2409 						ncr53c9x_sched_msgout(SEND_TAG|SEND_SDTR);
2410 					else
2411 						ncr53c9x_sched_msgout(SEND_SDTR);
2412 				} else {
2413 					/* Could not do ATN3 so send TAG */
2414 					ncr53c9x_sched_msgout(SEND_TAG);
2415 				}
2416 				sc->sc_prevphase = MESSAGE_OUT_PHASE; /* XXXX */
2417 				break;
2418 			case 3:
2419 				/*
2420 				 * Grr, this is supposed to mean
2421 				 * "target left command phase  prematurely".
2422 				 * It seems to happen regularly when
2423 				 * sync mode is on.
2424 				 * Look at FIFO to see if command went out.
2425 				 * (Timing problems?)
2426 				 */
2427 				if (sc->sc_features & NCR_F_DMASELECT) {
2428 					if (sc->sc_cmdlen == 0)
2429 						/* Hope for the best.. */
2430 						break;
2431 				} else if ((NCR_READ_REG(sc, NCR_FFLAG)
2432 					    & NCRFIFO_FF) == 0) {
2433 					/* Hope for the best.. */
2434 					break;
2435 				}
2436 				printf("(%s:%d:%d): selection failed;"
2437 					" %d left in FIFO "
2438 					"[intr %x, stat %x, step %d]\n",
2439 					sc->sc_dev.dv_xname,
2440 					sc_link->target,
2441 					sc_link->lun,
2442 					NCR_READ_REG(sc, NCR_FFLAG)
2443 					 & NCRFIFO_FF,
2444 					sc->sc_espintr, sc->sc_espstat,
2445 					sc->sc_espstep);
2446 				NCRCMD(sc, NCRCMD_FLUSH);
2447 				ncr53c9x_sched_msgout(SEND_ABORT);
2448 				return (1);
2449 			case 2:
2450 				/* Select stuck at Command Phase */
2451 				NCRCMD(sc, NCRCMD_FLUSH);
2452 				break;
2453 			case 4:
2454 				if (sc->sc_features & NCR_F_DMASELECT &&
2455 				    sc->sc_cmdlen != 0)
2456 					printf("(%s:%d:%d): select; "
2457 					       "%lu left in DMA buffer "
2458 					"[intr %x, stat %x, step %d]\n",
2459 						sc->sc_dev.dv_xname,
2460 						sc_link->target,
2461 						sc_link->lun,
2462 						(u_long)sc->sc_cmdlen,
2463 						sc->sc_espintr,
2464 						sc->sc_espstat,
2465 						sc->sc_espstep);
2466 				/* So far, everything went fine */
2467 				break;
2468 			}
2469 
2470 			sc->sc_prevphase = INVALID_PHASE; /* ?? */
2471 			/* Do an implicit RESTORE POINTERS. */
2472 			sc->sc_dp = ecb->daddr;
2473 			sc->sc_dleft = ecb->dleft;
2474 			sc->sc_state = NCR_CONNECTED;
2475 			break;
2476 
2477 		} else {
2478 
2479 			printf("%s: unexpected status after select"
2480 				": [intr %x, stat %x, step %x]\n",
2481 				sc->sc_dev.dv_xname,
2482 				sc->sc_espintr, sc->sc_espstat,
2483 				sc->sc_espstep);
2484 			NCRCMD(sc, NCRCMD_FLUSH);
2485 			DELAY(1);
2486 			goto reset;
2487 		}
2488 		if (sc->sc_state == NCR_IDLE) {
2489 			printf("%s: stray interrupt\n",
2490 			    sc->sc_dev.dv_xname);
2491 				return (0);
2492 		}
2493 		break;
2494 
2495 	case NCR_CONNECTED:
2496 		if (sc->sc_flags & NCR_ICCS) {
2497 			/* "Initiate Command Complete Steps" in progress */
2498 			u_char msg;
2499 
2500 			sc->sc_flags &= ~NCR_ICCS;
2501 
2502 			if (!(sc->sc_espintr & NCRINTR_DONE)) {
2503 				printf("%s: ICCS: "
2504 				      ": [intr %x, stat %x, step %x]\n",
2505 					sc->sc_dev.dv_xname,
2506 					sc->sc_espintr, sc->sc_espstat,
2507 					sc->sc_espstep);
2508 			}
2509 			ncr53c9x_rdfifo(sc, NCR_RDFIFO_START);
2510 			if (sc->sc_imlen < 2)
2511 				printf("%s: can't get status, only %d bytes\n",
2512 				    sc->sc_dev.dv_xname, (int)sc->sc_imlen);
2513 			ecb->stat = sc->sc_imess[sc->sc_imlen - 2];
2514 			msg = sc->sc_imess[sc->sc_imlen - 1];
2515 			NCR_PHASE(("<stat:(%x,%x)>", ecb->stat, msg));
2516 			if (msg == MSG_CMDCOMPLETE) {
2517 				ecb->dleft = (ecb->flags & ECB_TENTATIVE_DONE)
2518 					? 0
2519 					: sc->sc_dleft;
2520 				if ((ecb->flags & ECB_SENSE) == 0)
2521 					ecb->xs->resid = ecb->dleft;
2522 				sc->sc_state = NCR_CMDCOMPLETE;
2523 			} else
2524 				printf("%s: STATUS_PHASE: msg %d\n",
2525 					sc->sc_dev.dv_xname, msg);
2526 			sc->sc_imlen = 0;
2527 			NCRCMD(sc, NCRCMD_MSGOK);
2528 			goto shortcut; /* ie. wait for disconnect */
2529 		}
2530 		break;
2531 	default:
2532 		/* Don't panic: reset. */
2533 		printf("%s: invalid state: %d\n",
2534 		      sc->sc_dev.dv_xname,
2535 		      sc->sc_state);
2536 		ncr53c9x_scsi_reset(sc);
2537 		goto out;
2538 		break;
2539 	}
2540 
2541 	/*
2542 	 * Driver is now in state NCR_CONNECTED, i.e. we
2543 	 * have a current command working the SCSI bus.
2544 	 */
2545 	if (sc->sc_state != NCR_CONNECTED || ecb == NULL) {
2546 		panic("ncr53c9x no nexus");
2547 	}
2548 
2549 	switch (sc->sc_phase) {
2550 	case MESSAGE_OUT_PHASE:
2551 		NCR_PHASE(("MESSAGE_OUT_PHASE "));
2552 		ncr53c9x_msgout(sc);
2553 		sc->sc_prevphase = MESSAGE_OUT_PHASE;
2554 		break;
2555 	case MESSAGE_IN_PHASE:
2556 msgin:
2557 		NCR_PHASE(("MESSAGE_IN_PHASE "));
2558 		if (sc->sc_espintr & NCRINTR_BS) {
2559 			if ((sc->sc_rev != NCR_VARIANT_FAS366) ||
2560 			    !(sc->sc_espstat2 & FAS_STAT2_EMPTY)) {
2561 				NCRCMD(sc, NCRCMD_FLUSH);
2562 			}
2563 			sc->sc_flags |= NCR_WAITI;
2564 			NCRCMD(sc, NCRCMD_TRANS);
2565 		} else if (sc->sc_espintr & NCRINTR_FC) {
2566 			if ((sc->sc_flags & NCR_WAITI) == 0) {
2567 				printf("%s: MSGIN: unexpected FC bit: "
2568 					"[intr %x, stat %x, step %x]\n",
2569 				sc->sc_dev.dv_xname,
2570 				sc->sc_espintr, sc->sc_espstat,
2571 				sc->sc_espstep);
2572 			}
2573 			sc->sc_flags &= ~NCR_WAITI;
2574 			ncr53c9x_rdfifo(sc,
2575 			    (sc->sc_prevphase == sc->sc_phase) ?
2576 			    NCR_RDFIFO_CONTINUE : NCR_RDFIFO_START);
2577 			ncr53c9x_msgin(sc);
2578 		} else {
2579 			printf("%s: MSGIN: weird bits: "
2580 				"[intr %x, stat %x, step %x]\n",
2581 				sc->sc_dev.dv_xname,
2582 				sc->sc_espintr, sc->sc_espstat,
2583 				sc->sc_espstep);
2584 		}
2585 		sc->sc_prevphase = MESSAGE_IN_PHASE;
2586 		goto shortcut;	/* i.e. expect data to be ready */
2587 		break;
2588 	case COMMAND_PHASE:
2589 		/*
2590 		 * Send the command block. Normally we don't see this
2591 		 * phase because the SEL_ATN command takes care of
2592 		 * all this. However, we end up here if either the
2593 		 * target or we wanted to exchange some more messages
2594 		 * first (e.g. to start negotiations).
2595 		 */
2596 
2597 		NCR_PHASE(("COMMAND_PHASE 0x%02x (%d) ",
2598 			ecb->cmd.cmd.opcode, ecb->clen));
2599 		if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
2600 			NCRCMD(sc, NCRCMD_FLUSH);
2601 /*			DELAY(1); */
2602 		}
2603 		if (sc->sc_features & NCR_F_DMASELECT) {
2604 			/* setup DMA transfer for command */
2605 			size = ecb->clen;
2606 			sc->sc_cmdlen = size;
2607 			sc->sc_cmdp = (caddr_t)&ecb->cmd.cmd;
2608 			NCRDMA_SETUP(sc, &sc->sc_cmdp, &sc->sc_cmdlen,
2609 				     0, &size);
2610 			/* Program the SCSI counter */
2611 			NCR_SET_COUNT(sc, size);
2612 
2613 			/* load the count in */
2614 			NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA);
2615 
2616 			/* start the command transfer */
2617 			NCRCMD(sc, NCRCMD_TRANS | NCRCMD_DMA);
2618 			NCRDMA_GO(sc);
2619 		} else {
2620 			ncr53c9x_wrfifo(sc, (u_char *)&ecb->cmd.cmd, ecb->clen);
2621 			sc->sc_cmdlen = 0;
2622 			NCRCMD(sc, NCRCMD_TRANS);
2623 		}
2624 		sc->sc_prevphase = COMMAND_PHASE;
2625 		break;
2626 	case DATA_OUT_PHASE:
2627 		NCR_PHASE(("DATA_OUT_PHASE [%ld] ",(long)sc->sc_dleft));
2628 		NCRCMD(sc, NCRCMD_FLUSH);
2629 		size = min(sc->sc_dleft, sc->sc_maxxfer);
2630 		NCRDMA_SETUP(sc, &sc->sc_dp, &sc->sc_dleft,
2631 			  0, &size);
2632 		sc->sc_prevphase = DATA_OUT_PHASE;
2633 		goto setup_xfer;
2634 	case DATA_IN_PHASE:
2635 		NCR_PHASE(("DATA_IN_PHASE "));
2636 		if (sc->sc_rev == NCR_VARIANT_ESP100)
2637 			NCRCMD(sc, NCRCMD_FLUSH);
2638 		size = min(sc->sc_dleft, sc->sc_maxxfer);
2639 		NCRDMA_SETUP(sc, &sc->sc_dp, &sc->sc_dleft,
2640 			  1, &size);
2641 		sc->sc_prevphase = DATA_IN_PHASE;
2642 	setup_xfer:
2643 		/* Target returned to data phase: wipe "done" memory */
2644 		ecb->flags &= ~ECB_TENTATIVE_DONE;
2645 
2646 		/* Program the SCSI counter */
2647 		NCR_SET_COUNT(sc, size);
2648 
2649 		/* load the count in */
2650 		NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA);
2651 
2652 		/*
2653 		 * Note that if `size' is 0, we've already transceived
2654 		 * all the bytes we want but we're still in DATA PHASE.
2655 		 * Apparently, the device needs padding. Also, a
2656 		 * transfer size of 0 means "maximum" to the chip
2657 		 * DMA logic.
2658 		 */
2659 		NCRCMD(sc,
2660 		       (size==0?NCRCMD_TRPAD:NCRCMD_TRANS)|NCRCMD_DMA);
2661 		NCRDMA_GO(sc);
2662 		return (1);
2663 	case STATUS_PHASE:
2664 		NCR_PHASE(("STATUS_PHASE "));
2665 		sc->sc_flags |= NCR_ICCS;
2666 		NCRCMD(sc, NCRCMD_ICCS);
2667 		sc->sc_prevphase = STATUS_PHASE;
2668 		goto shortcut;	/* i.e. expect status results soon */
2669 		break;
2670 	case INVALID_PHASE:
2671 		break;
2672 	default:
2673 		printf("%s: unexpected bus phase; resetting\n",
2674 		    sc->sc_dev.dv_xname);
2675 		goto reset;
2676 	}
2677 
2678 out:
2679 	return (1);
2680 
2681 reset:
2682 	ncr53c9x_init(sc, 1);
2683 	goto out;
2684 
2685 finish:
2686 	ncr53c9x_done(sc, ecb);
2687 	goto out;
2688 
2689 sched:
2690 	sc->sc_state = NCR_IDLE;
2691 	ncr53c9x_sched(sc);
2692 	goto out;
2693 
2694 shortcut:
2695 	/*
2696 	 * The idea is that many of the SCSI operations take very little
2697 	 * time, and going away and getting interrupted is too high an
2698 	 * overhead to pay. For example, selecting, sending a message
2699 	 * and command and then doing some work can be done in one "pass".
2700 	 *
2701 	 * The delay is a heuristic. It is 2 when at 20MHz, 2 at 25MHz and 1
2702 	 * at 40MHz. This needs testing.
2703 	 */
2704 	{
2705 		struct timeval wait, cur;
2706 
2707 		microuptime(&wait);
2708 		wait.tv_usec += 50/sc->sc_freq;
2709 		if (wait.tv_usec >= 1000000) {
2710 			wait.tv_sec++;
2711 			wait.tv_usec -= 1000000;
2712 		}
2713 		do {
2714 			if (NCRDMA_ISINTR(sc))
2715 				goto again;
2716 			microuptime(&cur);
2717 		} while (timercmp(&cur, &wait, <=));
2718 	}
2719 	goto out;
2720 }
2721 
2722 void
2723 ncr53c9x_abort(sc, ecb)
2724 	struct ncr53c9x_softc *sc;
2725 	struct ncr53c9x_ecb *ecb;
2726 {
2727 
2728 	/* 2 secs for the abort */
2729 	ecb->timeout = NCR_ABORT_TIMEOUT;
2730 	ecb->flags |= ECB_ABORT;
2731 
2732 	if (ecb == sc->sc_nexus) {
2733 		int timeout = ecb->timeout;
2734 
2735 		/*
2736 		 * If we're still selecting, the message will be scheduled
2737 		 * after selection is complete.
2738 		 */
2739 		if (sc->sc_state == NCR_CONNECTED)
2740 			ncr53c9x_sched_msgout(SEND_ABORT);
2741 
2742 		/*
2743 		 * Reschedule timeout.
2744 		 */
2745 		if (timeout > 1000000)
2746 			timeout = (timeout / 1000) * hz;
2747 		else
2748 			timeout = (timeout * hz) / 1000;
2749 		timeout_add(&ecb->to, timeout);
2750 	} else {
2751 		/*
2752 		 * Just leave the command where it is.
2753 		 * XXX - what choice do we have but to reset the SCSI
2754 		 *	 eventually?
2755 		 */
2756 		if (sc->sc_state == NCR_IDLE)
2757 			ncr53c9x_sched(sc);
2758 	}
2759 }
2760 
2761 void
2762 ncr53c9x_timeout(arg)
2763 	void *arg;
2764 {
2765 	struct ncr53c9x_ecb *ecb = arg;
2766 	struct scsi_xfer *xs = ecb->xs;
2767 	struct scsi_link *sc_link = xs->sc_link;
2768 	struct ncr53c9x_softc *sc = sc_link->bus->sb_adapter_softc;
2769 	struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[sc_link->target];
2770 	int s;
2771 
2772 	sc_print_addr(sc_link);
2773 	printf("timed out [ecb %p (flags 0x%x, dleft %x, stat %x)], "
2774 	       "<state %d, nexus %p, phase(l %x, c %x, p %x), resid %lx, "
2775 	       "msg(q %x,o %x) %s>",
2776 		ecb, ecb->flags, ecb->dleft, ecb->stat,
2777 		sc->sc_state, sc->sc_nexus,
2778 		NCR_READ_REG(sc, NCR_STAT),
2779 		sc->sc_phase, sc->sc_prevphase,
2780 		(long)sc->sc_dleft, sc->sc_msgpriq, sc->sc_msgout,
2781 		NCRDMA_ISACTIVE(sc) ? "DMA active" : "");
2782 #if NCR53C9X_DEBUG > 1
2783 	printf("TRACE: %s.", ecb->trace);
2784 #endif
2785 
2786 	s = splbio();
2787 
2788 	if (ecb->flags & ECB_ABORT) {
2789 		/* abort timed out */
2790 		printf(" AGAIN\n");
2791 
2792 		ncr53c9x_init(sc, 1);
2793 	} else {
2794 		/* abort the operation that has timed out */
2795 		printf("\n");
2796 		xs->error = XS_TIMEOUT;
2797 		ncr53c9x_abort(sc, ecb);
2798 
2799 		/* Disable sync mode if stuck in a data phase */
2800 		if (ecb == sc->sc_nexus &&
2801 		    (ti->flags & T_SYNCMODE) != 0 &&
2802 		    (sc->sc_phase & (MSGI|CDI)) == 0) {
2803 			sc_print_addr(sc_link);
2804 			printf("sync negotiation disabled\n");
2805 			sc->sc_cfflags |= (1 << (sc_link->target + 16));
2806 		}
2807 	}
2808 
2809 	splx(s);
2810 }
2811