xref: /netbsd-src/sys/dev/ic/iha.c (revision de1dfb1250df962f1ff3a011772cf58e605aed11)
1 /*	$NetBSD: iha.c,v 1.24 2003/11/02 11:07:45 wiz Exp $ */
2 
3 /*-
4  * Device driver for the INI-9XXXU/UW or INIC-940/950 PCI SCSI Controller.
5  *
6  *  Written for 386bsd and FreeBSD by
7  *	Winston Hung		<winstonh@initio.com>
8  *
9  * Copyright (c) 1997-1999 Initio Corp.
10  * Copyright (c) 2000, 2001 Ken Westerback
11  * Copyright (c) 2001, 2002 Izumi Tsutsui
12  * All rights reserved.
13  *
14  * Redistribution and use in source and binary forms, with or without
15  * modification, are permitted provided that the following conditions
16  * are met:
17  * 1. Redistributions of source code must retain the above copyright
18  *    notice, this list of conditions and the following disclaimer,
19  *    without modification, immediately at the beginning of the file.
20  * 2. The name of the author may not be used to endorse or promote products
21  *    derived from this software without specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
24  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
25  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
26  * IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT,
27  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
28  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
29  * SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
31  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
32  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
33  * THE POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 /*
37  * Ported to NetBSD by Izumi Tsutsui <tsutsui@ceres.dti.ne.jp> from OpenBSD:
38  * $OpenBSD: iha.c,v 1.3 2001/02/20 00:47:33 krw Exp $
39  */
40 
41 #include <sys/cdefs.h>
42 __KERNEL_RCSID(0, "$NetBSD: iha.c,v 1.24 2003/11/02 11:07:45 wiz Exp $");
43 
44 #include <sys/param.h>
45 #include <sys/systm.h>
46 #include <sys/kernel.h>
47 #include <sys/buf.h>
48 #include <sys/device.h>
49 #include <sys/malloc.h>
50 
51 #include <uvm/uvm_extern.h>
52 
53 #include <machine/bus.h>
54 #include <machine/intr.h>
55 
56 #include <dev/scsipi/scsi_all.h>
57 #include <dev/scsipi/scsipi_all.h>
58 #include <dev/scsipi/scsiconf.h>
59 #include <dev/scsipi/scsi_message.h>
60 
61 #include <dev/ic/ihareg.h>
62 #include <dev/ic/ihavar.h>
63 
64 /*
65  * SCSI Rate Table, indexed by FLAG_SCSI_RATE field of
66  * tcs flags.
67  */
68 static const u_int8_t iha_rate_tbl[] = {
69 	/* fast 20		  */
70 	/* nanosecond divide by 4 */
71 	12,	/* 50ns,  20M	  */
72 	18,	/* 75ns,  13.3M	  */
73 	25,	/* 100ns, 10M	  */
74 	31,	/* 125ns, 8M	  */
75 	37,	/* 150ns, 6.6M	  */
76 	43,	/* 175ns, 5.7M	  */
77 	50,	/* 200ns, 5M	  */
78 	62	/* 250ns, 4M	  */
79 };
80 #define IHA_MAX_PERIOD	62
81 
82 #ifdef notused
83 static u_int16_t eeprom_default[EEPROM_SIZE] = {
84 	/* -- Header ------------------------------------ */
85 	/* signature */
86 	EEP_SIGNATURE,
87 	/* size, revision */
88 	EEP_WORD(EEPROM_SIZE * 2, 0x01),
89 	/* -- Host Adapter Structure -------------------- */
90 	/* model */
91 	0x0095,
92 	/* model info, number of channel */
93 	EEP_WORD(0x00, 1),
94 	/* BIOS config */
95 	EEP_BIOSCFG_DEFAULT,
96 	/* host adapter config */
97 	0,
98 
99 	/* -- eeprom_adapter[0] ------------------------------- */
100 	/* ID, adapter config 1 */
101 	EEP_WORD(7, CFG_DEFAULT),
102 	/* adapter config 2, number of targets */
103 	EEP_WORD(0x00, 8),
104 	/* target flags */
105 	EEP_WORD(FLAG_DEFAULT, FLAG_DEFAULT),
106 	EEP_WORD(FLAG_DEFAULT, FLAG_DEFAULT),
107 	EEP_WORD(FLAG_DEFAULT, FLAG_DEFAULT),
108 	EEP_WORD(FLAG_DEFAULT, FLAG_DEFAULT),
109 	EEP_WORD(FLAG_DEFAULT, FLAG_DEFAULT),
110 	EEP_WORD(FLAG_DEFAULT, FLAG_DEFAULT),
111 	EEP_WORD(FLAG_DEFAULT, FLAG_DEFAULT),
112 	EEP_WORD(FLAG_DEFAULT, FLAG_DEFAULT),
113 
114 	/* -- eeprom_adapter[1] ------------------------------- */
115 	/* ID, adapter config 1 */
116 	EEP_WORD(7, CFG_DEFAULT),
117 	/* adapter config 2, number of targets */
118 	EEP_WORD(0x00, 8),
119 	/* target flags */
120 	EEP_WORD(FLAG_DEFAULT, FLAG_DEFAULT),
121 	EEP_WORD(FLAG_DEFAULT, FLAG_DEFAULT),
122 	EEP_WORD(FLAG_DEFAULT, FLAG_DEFAULT),
123 	EEP_WORD(FLAG_DEFAULT, FLAG_DEFAULT),
124 	EEP_WORD(FLAG_DEFAULT, FLAG_DEFAULT),
125 	EEP_WORD(FLAG_DEFAULT, FLAG_DEFAULT),
126 	EEP_WORD(FLAG_DEFAULT, FLAG_DEFAULT),
127 	EEP_WORD(FLAG_DEFAULT, FLAG_DEFAULT),
128 	/* reserved[5] */
129 	0, 0, 0, 0, 0,
130 	/* checksum */
131 	0
132 };
133 #endif
134 
135 static void iha_append_free_scb(struct iha_softc *, struct iha_scb *);
136 static void iha_append_done_scb(struct iha_softc *, struct iha_scb *, u_int8_t);
137 static __inline struct iha_scb *iha_pop_done_scb(struct iha_softc *);
138 
139 static struct iha_scb *iha_find_pend_scb(struct iha_softc *);
140 static __inline void iha_append_pend_scb(struct iha_softc *, struct iha_scb *);
141 static __inline void iha_push_pend_scb(struct iha_softc *, struct iha_scb *);
142 static __inline void iha_del_pend_scb(struct iha_softc *, struct iha_scb *);
143 static __inline void iha_mark_busy_scb(struct iha_scb *);
144 
145 static __inline void iha_set_ssig(struct iha_softc *, u_int8_t, u_int8_t);
146 
147 static int iha_alloc_sglist(struct iha_softc *);
148 
149 static void iha_scsipi_request(struct scsipi_channel *, scsipi_adapter_req_t,
150     void *);
151 static void iha_update_xfer_mode(struct iha_softc *, int);
152 
153 static void iha_reset_scsi_bus(struct iha_softc *);
154 static void iha_reset_chip(struct iha_softc *);
155 static void iha_reset_dma(struct iha_softc *);
156 static void iha_reset_tcs(struct tcs *, u_int8_t);
157 
158 static void iha_main(struct iha_softc *);
159 static void iha_scsi(struct iha_softc *);
160 static void iha_select(struct iha_softc *, struct iha_scb *, u_int8_t);
161 static int iha_wait(struct iha_softc *, u_int8_t);
162 
163 static void iha_exec_scb(struct iha_softc *, struct iha_scb *);
164 static void iha_done_scb(struct iha_softc *, struct iha_scb *);
165 static int iha_push_sense_request(struct iha_softc *, struct iha_scb *);
166 
167 static void iha_timeout(void *);
168 static void iha_abort_xs(struct iha_softc *, struct scsipi_xfer *, u_int8_t);
169 static u_int8_t iha_data_over_run(struct iha_scb *);
170 
171 static int iha_next_state(struct iha_softc *);
172 static int iha_state_1(struct iha_softc *);
173 static int iha_state_2(struct iha_softc *);
174 static int iha_state_3(struct iha_softc *);
175 static int iha_state_4(struct iha_softc *);
176 static int iha_state_5(struct iha_softc *);
177 static int iha_state_6(struct iha_softc *);
178 static int iha_state_8(struct iha_softc *);
179 
180 static int iha_xfer_data(struct iha_softc *, struct iha_scb *, int);
181 static int iha_xpad_in(struct iha_softc *);
182 static int iha_xpad_out(struct iha_softc *);
183 
184 static int iha_status_msg(struct iha_softc *);
185 static void iha_busfree(struct iha_softc *);
186 static int iha_resel(struct iha_softc *);
187 
188 static int iha_msgin(struct iha_softc *);
189 static int iha_msgin_extended(struct iha_softc *);
190 static int iha_msgin_sdtr(struct iha_softc *);
191 static int iha_msgin_ignore_wid_resid(struct iha_softc *);
192 
193 static int  iha_msgout(struct iha_softc *, u_int8_t);
194 static void iha_msgout_abort(struct iha_softc *, u_int8_t);
195 static int  iha_msgout_reject(struct iha_softc *);
196 static int  iha_msgout_extended(struct iha_softc *);
197 static int  iha_msgout_wdtr(struct iha_softc *);
198 static int  iha_msgout_sdtr(struct iha_softc *);
199 
200 static void iha_wide_done(struct iha_softc *);
201 static void iha_sync_done(struct iha_softc *);
202 
203 static void iha_bad_seq(struct iha_softc *);
204 
205 static void iha_read_eeprom(struct iha_softc *, struct iha_eeprom *);
206 static int iha_se2_rd_all(struct iha_softc *, u_int16_t *);
207 static void iha_se2_instr(struct iha_softc *, int);
208 static u_int16_t iha_se2_rd(struct iha_softc *, int);
209 #ifdef notused
210 static void iha_se2_update_all(struct iha_softc *);
211 static void iha_se2_wr(struct iha_softc *, int, u_int16_t);
212 #endif
213 
214 /*
215  * iha_append_free_scb - append the supplied SCB to the tail of the
216  *			 sc_freescb queue after clearing and resetting
217  *			 everything possible.
218  */
219 static void
220 iha_append_free_scb(sc, scb)
221 	struct iha_softc *sc;
222 	struct iha_scb *scb;
223 {
224 	int s;
225 
226 	s = splbio();
227 
228 	if (scb == sc->sc_actscb)
229 		sc->sc_actscb = NULL;
230 
231 	scb->status = STATUS_QUEUED;
232 	scb->ha_stat = HOST_OK;
233 	scb->ta_stat = SCSI_OK;
234 
235 	scb->nextstat = 0;
236 	scb->scb_tagmsg = 0;
237 
238 	scb->xs = NULL;
239 	scb->tcs = NULL;
240 
241 	/*
242 	 * scb_tagid, sg_addr, sglist
243 	 * SCB_SensePtr are set at initialization
244 	 * and never change
245 	 */
246 
247 	TAILQ_INSERT_TAIL(&sc->sc_freescb, scb, chain);
248 
249 	splx(s);
250 }
251 
252 static void
253 iha_append_done_scb(sc, scb, hastat)
254 	struct iha_softc *sc;
255 	struct iha_scb *scb;
256 	u_int8_t hastat;
257 {
258 	struct tcs *tcs;
259 	int s;
260 
261 	s = splbio();
262 
263 	if (scb->xs != NULL)
264 		callout_stop(&scb->xs->xs_callout);
265 
266 	if (scb == sc->sc_actscb)
267 		sc->sc_actscb = NULL;
268 
269 	tcs = scb->tcs;
270 
271 	if (scb->scb_tagmsg != 0) {
272 		if (tcs->tagcnt)
273 			tcs->tagcnt--;
274 	} else if (tcs->ntagscb == scb)
275 		tcs->ntagscb = NULL;
276 
277 	scb->status = STATUS_QUEUED;
278 	scb->ha_stat = hastat;
279 
280 	TAILQ_INSERT_TAIL(&sc->sc_donescb, scb, chain);
281 
282 	splx(s);
283 }
284 
285 static __inline struct iha_scb *
286 iha_pop_done_scb(sc)
287 	struct iha_softc *sc;
288 {
289 	struct iha_scb *scb;
290 	int s;
291 
292 	s = splbio();
293 
294 	scb = TAILQ_FIRST(&sc->sc_donescb);
295 
296 	if (scb != NULL) {
297 		scb->status = STATUS_RENT;
298 		TAILQ_REMOVE(&sc->sc_donescb, scb, chain);
299 	}
300 
301 	splx(s);
302 
303 	return (scb);
304 }
305 
306 /*
307  * iha_find_pend_scb - scan the pending queue for a SCB that can be
308  *		       processed immediately. Return NULL if none found
309  *		       and a pointer to the SCB if one is found. If there
310  *		       is an active SCB, return NULL!
311  */
312 static struct iha_scb *
313 iha_find_pend_scb(sc)
314 	struct iha_softc *sc;
315 {
316 	struct iha_scb *scb;
317 	struct tcs *tcs;
318 	int s;
319 
320 	s = splbio();
321 
322 	if (sc->sc_actscb != NULL)
323 		scb = NULL;
324 
325 	else
326 		TAILQ_FOREACH(scb, &sc->sc_pendscb, chain) {
327 			if ((scb->xs->xs_control & XS_CTL_RESET) != 0)
328 				/* ALWAYS willing to reset a device */
329 				break;
330 
331 			tcs = scb->tcs;
332 
333 			if ((scb->scb_tagmsg) != 0) {
334 				/*
335 				 * A Tagged I/O. OK to start If no
336 				 * non-tagged I/O is active on the same
337 				 * target
338 				 */
339 				if (tcs->ntagscb == NULL)
340 					break;
341 
342 			} else	if (scb->cmd[0] == REQUEST_SENSE) {
343 				/*
344 				 * OK to do a non-tagged request sense
345 				 * even if a non-tagged I/O has been
346 				 * started, 'cuz we don't allow any
347 				 * disconnect during a request sense op
348 				 */
349 				break;
350 
351 			} else	if (tcs->tagcnt == 0) {
352 				/*
353 				 * No tagged I/O active on this target,
354 				 * ok to start a non-tagged one if one
355 				 * is not already active
356 				 */
357 				if (tcs->ntagscb == NULL)
358 					break;
359 			}
360 		}
361 
362 	splx(s);
363 
364 	return (scb);
365 }
366 
367 static __inline void
368 iha_append_pend_scb(sc, scb)
369 	struct iha_softc *sc;
370 	struct iha_scb *scb;
371 {
372 	/* ASSUMPTION: only called within a splbio()/splx() pair */
373 
374 	if (scb == sc->sc_actscb)
375 		sc->sc_actscb = NULL;
376 
377 	scb->status = STATUS_QUEUED;
378 
379 	TAILQ_INSERT_TAIL(&sc->sc_pendscb, scb, chain);
380 }
381 
382 static __inline void
383 iha_push_pend_scb(sc, scb)
384 	struct iha_softc *sc;
385 	struct iha_scb *scb;
386 {
387 	int s;
388 
389 	s = splbio();
390 
391 	if (scb == sc->sc_actscb)
392 		sc->sc_actscb = NULL;
393 
394 	scb->status = STATUS_QUEUED;
395 
396 	TAILQ_INSERT_HEAD(&sc->sc_pendscb, scb, chain);
397 
398 	splx(s);
399 }
400 
401 /*
402  * iha_del_pend_scb - remove scb from sc_pendscb
403  */
404 static __inline void
405 iha_del_pend_scb(sc, scb)
406 	struct iha_softc *sc;
407 	struct iha_scb *scb;
408 {
409 	int s;
410 
411 	s = splbio();
412 
413 	TAILQ_REMOVE(&sc->sc_pendscb, scb, chain);
414 
415 	splx(s);
416 }
417 
418 static __inline void
419 iha_mark_busy_scb(scb)
420 	struct iha_scb *scb;
421 {
422 	int  s;
423 
424 	s = splbio();
425 
426 	scb->status = STATUS_BUSY;
427 
428 	if (scb->scb_tagmsg == 0)
429 		scb->tcs->ntagscb = scb;
430 	else
431 		scb->tcs->tagcnt++;
432 
433 	splx(s);
434 }
435 
436 /*
437  * iha_set_ssig - read the current scsi signal mask, then write a new
438  *		  one which turns off/on the specified signals.
439  */
440 static __inline void
441 iha_set_ssig(sc, offsigs, onsigs)
442 	struct iha_softc *sc;
443 	u_int8_t offsigs, onsigs;
444 {
445 	bus_space_tag_t iot = sc->sc_iot;
446 	bus_space_handle_t ioh = sc->sc_ioh;
447 	u_int8_t currsigs;
448 
449 	currsigs = bus_space_read_1(iot, ioh, TUL_SSIGI);
450 	bus_space_write_1(iot, ioh, TUL_SSIGO, (currsigs & ~offsigs) | onsigs);
451 }
452 
453 /*
454  * iha_intr - the interrupt service routine for the iha driver
455  */
456 int
457 iha_intr(arg)
458 	void *arg;
459 {
460 	bus_space_tag_t iot;
461 	bus_space_handle_t ioh;
462 	struct iha_softc *sc;
463 	int s;
464 
465 	sc  = (struct iha_softc *)arg;
466 	iot = sc->sc_iot;
467 	ioh = sc->sc_ioh;
468 
469 	if ((bus_space_read_1(iot, ioh, TUL_STAT0) & INTPD) == 0)
470 		return (0);
471 
472 	s = splbio(); /* XXX - Or are interrupts off when ISR's are called? */
473 
474 	if (sc->sc_semaph != SEMAPH_IN_MAIN) {
475 		/* XXX - need these inside a splbio()/splx()? */
476 		bus_space_write_1(iot, ioh, TUL_IMSK, MASK_ALL);
477 		sc->sc_semaph = SEMAPH_IN_MAIN;
478 
479 		iha_main(sc);
480 
481 		sc->sc_semaph = ~SEMAPH_IN_MAIN;
482 		bus_space_write_1(iot, ioh, TUL_IMSK, (MASK_ALL & ~MSCMP));
483 	}
484 
485 	splx(s);
486 
487 	return (1);
488 }
489 
490 void
491 iha_attach(sc)
492 	struct iha_softc *sc;
493 {
494 	bus_space_tag_t iot = sc->sc_iot;
495 	bus_space_handle_t ioh = sc->sc_ioh;
496 	struct iha_scb *scb;
497 	struct iha_eeprom eeprom;
498 	struct eeprom_adapter *conf;
499 	int i, error, reg;
500 
501 	iha_read_eeprom(sc, &eeprom);
502 
503 	conf = &eeprom.adapter[0];
504 
505 	/*
506 	 * fill in the rest of the iha_softc fields
507 	 */
508 	sc->sc_id = CFG_ID(conf->config1);
509 	sc->sc_semaph = ~SEMAPH_IN_MAIN;
510 	sc->sc_status0 = 0;
511 	sc->sc_actscb = NULL;
512 
513 	TAILQ_INIT(&sc->sc_freescb);
514 	TAILQ_INIT(&sc->sc_pendscb);
515 	TAILQ_INIT(&sc->sc_donescb);
516 	error = iha_alloc_sglist(sc);
517 	if (error != 0) {
518 		printf(": cannot allocate sglist\n");
519 		return;
520 	}
521 
522 	sc->sc_scb = malloc(sizeof(struct iha_scb) * IHA_MAX_SCB,
523 	    M_DEVBUF, M_NOWAIT|M_ZERO);
524 	if (sc->sc_scb == NULL) {
525 		printf(": cannot allocate SCB\n");
526 		return;
527 	}
528 
529 	for (i = 0, scb = sc->sc_scb; i < IHA_MAX_SCB; i++, scb++) {
530 		scb->scb_tagid = i;
531 		scb->sgoffset = IHA_SG_SIZE * i;
532 		scb->sglist = sc->sc_sglist + IHA_MAX_SG_ENTRIES * i;
533 		scb->sg_addr =
534 		    sc->sc_dmamap->dm_segs[0].ds_addr + scb->sgoffset;
535 
536 		error = bus_dmamap_create(sc->sc_dmat,
537 		    MAXPHYS, IHA_MAX_SG_ENTRIES, MAXPHYS, 0,
538 		    BUS_DMA_NOWAIT, &scb->dmap);
539 
540 		if (error != 0) {
541 			printf(": couldn't create SCB DMA map, error = %d\n",
542 			    error);
543 			return;
544 		}
545 		TAILQ_INSERT_TAIL(&sc->sc_freescb, scb, chain);
546 	}
547 
548 	/* Mask all the interrupts */
549 	bus_space_write_1(iot, ioh, TUL_IMSK, MASK_ALL);
550 
551 	/* Stop any I/O and reset the scsi module */
552 	iha_reset_dma(sc);
553 	bus_space_write_1(iot, ioh, TUL_SCTRL0, RSMOD);
554 
555 	/* Program HBA's SCSI ID */
556 	bus_space_write_1(iot, ioh, TUL_SID, sc->sc_id << 4);
557 
558 	/*
559 	 * Configure the channel as requested by the NVRAM settings read
560 	 * by iha_read_eeprom() above.
561 	 */
562 
563 	sc->sc_sconf1 = SCONFIG0DEFAULT;
564 	if ((conf->config1 & CFG_EN_PAR) != 0)
565 		sc->sc_sconf1 |= SPCHK;
566 	bus_space_write_1(iot, ioh, TUL_SCONFIG0, sc->sc_sconf1);
567 
568 	/* set selection time out 250 ms */
569 	bus_space_write_1(iot, ioh, TUL_STIMO, STIMO_250MS);
570 
571 	/* Enable desired SCSI termination configuration read from eeprom */
572 	reg = 0;
573 	if (conf->config1 & CFG_ACT_TERM1)
574 		reg |= ENTMW;
575 	if (conf->config1 & CFG_ACT_TERM2)
576 		reg |= ENTM;
577 	bus_space_write_1(iot, ioh, TUL_DCTRL0, reg);
578 
579 	reg = bus_space_read_1(iot, ioh, TUL_GCTRL1) & ~ATDEN;
580 	if (conf->config1 & CFG_AUTO_TERM)
581 		reg |= ATDEN;
582 	bus_space_write_1(iot, ioh, TUL_GCTRL1, reg);
583 
584 	for (i = 0; i < IHA_MAX_TARGETS / 2; i++) {
585 		sc->sc_tcs[i * 2    ].flags = EEP_LBYTE(conf->tflags[i]);
586 		sc->sc_tcs[i * 2 + 1].flags = EEP_HBYTE(conf->tflags[i]);
587 		iha_reset_tcs(&sc->sc_tcs[i * 2    ], sc->sc_sconf1);
588 		iha_reset_tcs(&sc->sc_tcs[i * 2 + 1], sc->sc_sconf1);
589 	}
590 
591 	iha_reset_chip(sc);
592 	bus_space_write_1(iot, ioh, TUL_SIEN, ALL_INTERRUPTS);
593 
594 	/*
595 	 * fill in the adapter.
596 	 */
597 	sc->sc_adapter.adapt_dev = &sc->sc_dev;
598 	sc->sc_adapter.adapt_nchannels = 1;
599 	sc->sc_adapter.adapt_openings = IHA_MAX_SCB;
600 	sc->sc_adapter.adapt_max_periph = IHA_MAX_SCB;
601 	sc->sc_adapter.adapt_ioctl = NULL;
602 	sc->sc_adapter.adapt_minphys = minphys;
603 	sc->sc_adapter.adapt_request = iha_scsipi_request;
604 
605 	/*
606 	 * fill in the channel.
607 	 */
608 	sc->sc_channel.chan_adapter = &sc->sc_adapter;
609 	sc->sc_channel.chan_bustype = &scsi_bustype;
610 	sc->sc_channel.chan_channel = 0;
611 	sc->sc_channel.chan_ntargets = CFG_TARGET(conf->config2);
612 	sc->sc_channel.chan_nluns = 8;
613 	sc->sc_channel.chan_id = sc->sc_id;
614 
615 	/*
616 	 * Now try to attach all the sub devices.
617 	 */
618 	config_found(&sc->sc_dev, &sc->sc_channel, scsiprint);
619 }
620 
621 /*
622  * iha_alloc_sglist - allocate and map sglist for SCB's
623  */
624 static int
625 iha_alloc_sglist(sc)
626 	struct iha_softc *sc;
627 {
628 	bus_dma_segment_t seg;
629 	int error, rseg;
630 
631 	/*
632 	 * Allocate DMA-safe memory for the SCB's sglist
633 	 */
634 	if ((error = bus_dmamem_alloc(sc->sc_dmat,
635 	    IHA_SG_SIZE * IHA_MAX_SCB,
636 	    PAGE_SIZE, 0, &seg, 1, &rseg, BUS_DMA_NOWAIT)) != 0) {
637 		printf(": unable to allocate sglist, error = %d\n", error);
638 		return (error);
639 	}
640 	if ((error = bus_dmamem_map(sc->sc_dmat, &seg, rseg,
641 	    IHA_SG_SIZE * IHA_MAX_SCB, (caddr_t *)&sc->sc_sglist,
642 	    BUS_DMA_NOWAIT | BUS_DMA_COHERENT)) != 0) {
643 		printf(": unable to map sglist, error = %d\n", error);
644 		return (error);
645 	}
646 
647 	/*
648 	 * Create and load the DMA map used for the SCBs
649 	 */
650 	if ((error = bus_dmamap_create(sc->sc_dmat,
651 	    IHA_SG_SIZE * IHA_MAX_SCB, 1, IHA_SG_SIZE * IHA_MAX_SCB,
652 	    0, BUS_DMA_NOWAIT, &sc->sc_dmamap)) != 0) {
653 		printf(": unable to create control DMA map, error = %d\n",
654 		    error);
655 		return (error);
656 	}
657 	if ((error = bus_dmamap_load(sc->sc_dmat, sc->sc_dmamap,
658 	    sc->sc_sglist, IHA_SG_SIZE * IHA_MAX_SCB,
659 	    NULL, BUS_DMA_NOWAIT)) != 0) {
660 		printf(": unable to load control DMA map, error = %d\n", error);
661 		return (error);
662 	}
663 
664 	memset(sc->sc_sglist, 0, IHA_SG_SIZE * IHA_MAX_SCB);
665 
666 	return (0);
667 }
668 
669 void
670 iha_scsipi_request(chan, req, arg)
671 	struct scsipi_channel *chan;
672 	scsipi_adapter_req_t req;
673 	void *arg;
674 {
675 	struct scsipi_xfer *xs;
676 	struct scsipi_periph *periph;
677 	struct iha_scb *scb;
678 	struct iha_softc *sc;
679 	int error, s;
680 
681 	sc = (struct iha_softc *)chan->chan_adapter->adapt_dev;
682 
683 	switch (req) {
684 	case ADAPTER_REQ_RUN_XFER:
685 		xs = arg;
686 		periph = xs->xs_periph;
687 
688 		if (xs->cmdlen > sizeof(struct scsi_generic) ||
689 		    periph->periph_target >= IHA_MAX_TARGETS) {
690 			xs->error = XS_DRIVER_STUFFUP;
691 			return;
692 		}
693 
694 		s = splbio();
695 		scb = TAILQ_FIRST(&sc->sc_freescb);
696 		if (scb != NULL) {
697 			scb->status = STATUS_RENT;
698 			TAILQ_REMOVE(&sc->sc_freescb, scb, chain);
699 		}
700 #ifdef DIAGNOSTIC
701 		else {
702 			scsipi_printaddr(periph);
703 			printf("unable to allocate scb\n");
704 			panic("iha_scsipi_request");
705 		}
706 #endif
707 		splx(s);
708 
709 		scb->target = periph->periph_target;
710 		scb->lun = periph->periph_lun;
711 		scb->tcs = &sc->sc_tcs[scb->target];
712 		scb->scb_id = MSG_IDENTIFY(periph->periph_lun,
713 		    (xs->xs_control & XS_CTL_REQSENSE) == 0);
714 
715 		scb->xs = xs;
716 		scb->cmdlen = xs->cmdlen;
717 		memcpy(&scb->cmd, xs->cmd, xs->cmdlen);
718 		scb->buflen = xs->datalen;
719 		scb->flags = 0;
720 		if (xs->xs_control & XS_CTL_DATA_OUT)
721 			scb->flags |= FLAG_DATAOUT;
722 		if (xs->xs_control & XS_CTL_DATA_IN)
723 			scb->flags |= FLAG_DATAIN;
724 
725 		if (scb->flags & (FLAG_DATAIN | FLAG_DATAOUT)) {
726 			error = bus_dmamap_load(sc->sc_dmat, scb->dmap,
727 			    xs->data, scb->buflen, NULL,
728 			    ((xs->xs_control & XS_CTL_NOSLEEP) ?
729 			     BUS_DMA_NOWAIT : BUS_DMA_WAITOK) |
730 			    BUS_DMA_STREAMING |
731 			    ((scb->flags & FLAG_DATAIN) ?
732 			     BUS_DMA_READ : BUS_DMA_WRITE));
733 
734 			if (error) {
735 				printf("%s: error %d loading DMA map\n",
736 				    sc->sc_dev.dv_xname, error);
737 				iha_append_free_scb(sc, scb);
738 				xs->error = XS_DRIVER_STUFFUP;
739 				scsipi_done(xs);
740 				return;
741 			}
742 			bus_dmamap_sync(sc->sc_dmat, scb->dmap,
743 			    0, scb->dmap->dm_mapsize,
744 			    (scb->flags & FLAG_DATAIN) ?
745 			    BUS_DMASYNC_PREREAD : BUS_DMASYNC_PREWRITE);
746 		}
747 
748 		iha_exec_scb(sc, scb);
749 		return;
750 
751 	case ADAPTER_REQ_GROW_RESOURCES:
752 		return; /* XXX */
753 
754 	case ADAPTER_REQ_SET_XFER_MODE:
755 		{
756 			struct tcs *tcs;
757 			struct scsipi_xfer_mode *xm = arg;
758 
759 			tcs = &sc->sc_tcs[xm->xm_target];
760 
761 			if ((xm->xm_mode & PERIPH_CAP_WIDE16) != 0 &&
762 			    (tcs->flags & FLAG_NO_WIDE) == 0)
763 				tcs->flags &= ~(FLAG_WIDE_DONE|FLAG_SYNC_DONE);
764 
765 			if ((xm->xm_mode & PERIPH_CAP_SYNC) != 0 &&
766 			    (tcs->flags & FLAG_NO_SYNC) == 0)
767 				tcs->flags &= ~FLAG_SYNC_DONE;
768 
769 			/*
770 			 * If we're not going to negotiate, send the
771 			 * notification now, since it won't happen later.
772 			 */
773 			if ((tcs->flags & (FLAG_WIDE_DONE|FLAG_SYNC_DONE)) ==
774 			    (FLAG_WIDE_DONE|FLAG_SYNC_DONE))
775 				iha_update_xfer_mode(sc, xm->xm_target);
776 
777 			return;
778 		}
779 	}
780 }
781 
782 void
783 iha_update_xfer_mode(sc, target)
784 	struct iha_softc *sc;
785 	int target;
786 {
787 	struct tcs *tcs = &sc->sc_tcs[target];
788 	struct scsipi_xfer_mode xm;
789 
790 	xm.xm_target = target;
791 	xm.xm_mode = 0;
792 	xm.xm_period = 0;
793 	xm.xm_offset = 0;
794 
795 	if (tcs->syncm & PERIOD_WIDE_SCSI)
796 		xm.xm_mode |= PERIPH_CAP_WIDE16;
797 
798 	if (tcs->period) {
799 		xm.xm_mode |= PERIPH_CAP_SYNC;
800 		xm.xm_period = tcs->period;
801 		xm.xm_offset = tcs->offset;
802 	}
803 
804 	scsipi_async_event(&sc->sc_channel, ASYNC_EVENT_XFER_MODE, &xm);
805 }
806 
807 static void
808 iha_reset_scsi_bus(sc)
809 	struct iha_softc *sc;
810 {
811 	struct iha_scb *scb;
812 	struct tcs *tcs;
813 	int i, s;
814 
815 	s = splbio();
816 
817 	iha_reset_dma(sc);
818 
819 	for (i = 0, scb = sc->sc_scb; i < IHA_MAX_SCB; i++, scb++)
820 		switch (scb->status) {
821 		case STATUS_BUSY:
822 			iha_append_done_scb(sc, scb, HOST_SCSI_RST);
823 			break;
824 
825 		case STATUS_SELECT:
826 			iha_push_pend_scb(sc, scb);
827 			break;
828 
829 		default:
830 			break;
831 		}
832 
833 	for (i = 0, tcs = sc->sc_tcs; i < IHA_MAX_TARGETS; i++, tcs++)
834 		iha_reset_tcs(tcs, sc->sc_sconf1);
835 
836 	splx(s);
837 }
838 
839 void
840 iha_reset_chip(sc)
841 	struct iha_softc *sc;
842 {
843 	bus_space_tag_t iot = sc->sc_iot;
844 	bus_space_handle_t ioh = sc->sc_ioh;
845 
846 	/* reset tulip chip */
847 
848 	bus_space_write_1(iot, ioh, TUL_SCTRL0, RSCSI);
849 
850 	do {
851 		sc->sc_sistat = bus_space_read_1(iot, ioh, TUL_SISTAT);
852 	} while ((sc->sc_sistat & SRSTD) == 0);
853 
854 	iha_set_ssig(sc, 0, 0);
855 
856 	bus_space_read_1(iot, ioh, TUL_SISTAT); /* Clear any active interrupt*/
857 }
858 
859 /*
860  * iha_reset_dma - abort any active DMA xfer, reset tulip FIFO.
861  */
862 static void
863 iha_reset_dma(sc)
864 	struct iha_softc *sc;
865 {
866 	bus_space_tag_t iot = sc->sc_iot;
867 	bus_space_handle_t ioh = sc->sc_ioh;
868 
869 	if ((bus_space_read_1(iot, ioh, TUL_ISTUS1) & XPEND) != 0) {
870 		/* if DMA xfer is pending, abort DMA xfer */
871 		bus_space_write_1(iot, ioh, TUL_DCMD, ABTXFR);
872 		/* wait Abort DMA xfer done */
873 		while ((bus_space_read_1(iot, ioh, TUL_ISTUS0) & DABT) == 0)
874 			;
875 	}
876 
877 	bus_space_write_1(iot, ioh, TUL_SCTRL0, RSFIFO);
878 }
879 
880 /*
881  * iha_reset_tcs - reset the target control structure pointed
882  *		   to by tcs to default values. tcs flags
883  *		   only has the negotiation done bits reset as
884  *		   the other bits are fixed at initialization.
885  */
886 static void
887 iha_reset_tcs(tcs, config0)
888 	struct tcs *tcs;
889 	u_int8_t config0;
890 {
891 
892 	tcs->flags &= ~(FLAG_SYNC_DONE | FLAG_WIDE_DONE);
893 	tcs->period = 0;
894 	tcs->offset = 0;
895 	tcs->tagcnt = 0;
896 	tcs->ntagscb  = NULL;
897 	tcs->syncm = 0;
898 	tcs->sconfig0 = config0;
899 }
900 
901 /*
902  * iha_main - process the active SCB, taking one off pending and making it
903  *	      active if necessary, and any done SCB's created as
904  *	      a result until there are no interrupts pending and no pending
905  *	      SCB's that can be started.
906  */
907 static void
908 iha_main(sc)
909 	struct iha_softc *sc;
910 {
911 	bus_space_tag_t iot = sc->sc_iot;
912 	bus_space_handle_t ioh =sc->sc_ioh;
913 	struct iha_scb *scb;
914 
915 	for (;;) {
916 		iha_scsi(sc);
917 
918 		while ((scb = iha_pop_done_scb(sc)) != NULL)
919 			iha_done_scb(sc, scb);
920 
921 		/*
922 		 * If there are no interrupts pending, or we can't start
923 		 * a pending sc, break out of the for(;;). Otherwise
924 		 * continue the good work with another call to
925 		 * iha_scsi().
926 		 */
927 		if (((bus_space_read_1(iot, ioh, TUL_STAT0) & INTPD) == 0)
928 		    && (iha_find_pend_scb(sc) == NULL))
929 			break;
930 	}
931 }
932 
933 /*
934  * iha_scsi - service any outstanding interrupts. If there are none, try to
935  *            start another SCB currently in the pending queue.
936  */
937 static void
938 iha_scsi(sc)
939 	struct iha_softc *sc;
940 {
941 	bus_space_tag_t iot = sc->sc_iot;
942 	bus_space_handle_t ioh = sc->sc_ioh;
943 	struct iha_scb *scb;
944 	struct tcs *tcs;
945 	u_int8_t stat;
946 
947 	/* service pending interrupts asap */
948 
949 	stat = bus_space_read_1(iot, ioh, TUL_STAT0);
950 	if ((stat & INTPD) != 0) {
951 		sc->sc_status0 = stat;
952 		sc->sc_status1 = bus_space_read_1(iot, ioh, TUL_STAT1);
953 		sc->sc_sistat = bus_space_read_1(iot, ioh, TUL_SISTAT);
954 
955 		sc->sc_phase = sc->sc_status0 & PH_MASK;
956 
957 		if ((sc->sc_sistat & SRSTD) != 0) {
958 			iha_reset_scsi_bus(sc);
959 			return;
960 		}
961 
962 		if ((sc->sc_sistat & RSELED) != 0) {
963 			iha_resel(sc);
964 			return;
965 		}
966 
967 		if ((sc->sc_sistat & (STIMEO | DISCD)) != 0) {
968 			iha_busfree(sc);
969 			return;
970 		}
971 
972 		if ((sc->sc_sistat & (SCMDN | SBSRV)) != 0) {
973 			iha_next_state(sc);
974 			return;
975 		}
976 
977 		if ((sc->sc_sistat & SELED) != 0)
978 			iha_set_ssig(sc, 0, 0);
979 	}
980 
981 	/*
982 	 * There were no interrupts pending which required action elsewhere, so
983 	 * see if it is possible to start the selection phase on a pending SCB
984 	 */
985 	if ((scb = iha_find_pend_scb(sc)) == NULL)
986 		return;
987 
988 	tcs = scb->tcs;
989 
990 	/* program HBA's SCSI ID & target SCSI ID */
991 	bus_space_write_1(iot, ioh, TUL_SID, (sc->sc_id << 4) | scb->target);
992 
993 	if ((scb->xs->xs_control & XS_CTL_RESET) == 0) {
994 		bus_space_write_1(iot, ioh, TUL_SYNCM, tcs->syncm);
995 
996 		if ((tcs->flags & FLAG_NO_NEG_SYNC) == 0 ||
997 		    (tcs->flags & FLAG_NO_NEG_WIDE) == 0)
998 			iha_select(sc, scb, SELATNSTOP);
999 
1000 		else if (scb->scb_tagmsg != 0)
1001 			iha_select(sc, scb, SEL_ATN3);
1002 
1003 		else
1004 			iha_select(sc, scb, SEL_ATN);
1005 
1006 	} else {
1007 		iha_select(sc, scb, SELATNSTOP);
1008 		scb->nextstat = 8;
1009 	}
1010 
1011 	if ((scb->xs->xs_control & XS_CTL_POLL) != 0) {
1012 		int timeout;
1013 		for (timeout = scb->xs->timeout; timeout > 0; timeout--) {
1014 			if (iha_wait(sc, NO_OP) == -1)
1015 				break;
1016 			if (iha_next_state(sc) == -1)
1017 				break;
1018 			delay(1000); /* Only happens in boot, so it's ok */
1019 		}
1020 
1021 		/*
1022 		 * Since done queue processing not done until AFTER this
1023 		 * function returns, scb is on the done queue, not
1024 		 * the free queue at this point and still has valid data
1025 		 *
1026 		 * Conversely, xs->error has not been set yet
1027 		 */
1028 		if (timeout == 0)
1029 			iha_timeout(scb);
1030 	}
1031 }
1032 
1033 static void
1034 iha_select(sc, scb, select_type)
1035 	struct iha_softc *sc;
1036 	struct iha_scb *scb;
1037 	u_int8_t select_type;
1038 {
1039 	bus_space_tag_t iot = sc->sc_iot;
1040 	bus_space_handle_t ioh = sc->sc_ioh;
1041 
1042 	switch (select_type) {
1043 	case SEL_ATN:
1044 		bus_space_write_1(iot, ioh, TUL_SFIFO, scb->scb_id);
1045 		bus_space_write_multi_1(iot, ioh, TUL_SFIFO,
1046 		    scb->cmd, scb->cmdlen);
1047 
1048 		scb->nextstat = 2;
1049 		break;
1050 
1051 	case SELATNSTOP:
1052 		scb->nextstat = 1;
1053 		break;
1054 
1055 	case SEL_ATN3:
1056 		bus_space_write_1(iot, ioh, TUL_SFIFO, scb->scb_id);
1057 		bus_space_write_1(iot, ioh, TUL_SFIFO, scb->scb_tagmsg);
1058 		bus_space_write_1(iot, ioh, TUL_SFIFO, scb->scb_tagid);
1059 
1060 		bus_space_write_multi_1(iot, ioh, TUL_SFIFO, scb->cmd,
1061 		    scb->cmdlen);
1062 
1063 		scb->nextstat = 2;
1064 		break;
1065 
1066 	default:
1067 		printf("[debug] iha_select() - unknown select type = 0x%02x\n",
1068 		    select_type);
1069 		return;
1070 	}
1071 
1072 	iha_del_pend_scb(sc, scb);
1073 	scb->status = STATUS_SELECT;
1074 
1075 	sc->sc_actscb = scb;
1076 
1077 	bus_space_write_1(iot, ioh, TUL_SCMD, select_type);
1078 }
1079 
1080 /*
1081  * iha_wait - wait for an interrupt to service or a SCSI bus phase change
1082  *            after writing the supplied command to the tulip chip. If
1083  *            the command is NO_OP, skip the command writing.
1084  */
1085 static int
1086 iha_wait(sc, cmd)
1087 	struct iha_softc *sc;
1088 	u_int8_t cmd;
1089 {
1090 	bus_space_tag_t iot = sc->sc_iot;
1091 	bus_space_handle_t ioh = sc->sc_ioh;
1092 
1093 	if (cmd != NO_OP)
1094 		bus_space_write_1(iot, ioh, TUL_SCMD, cmd);
1095 
1096 	/*
1097 	 * Have to do this here, in addition to in iha_isr, because
1098 	 * interrupts might be turned off when we get here.
1099 	 */
1100 	do {
1101 		sc->sc_status0 = bus_space_read_1(iot, ioh, TUL_STAT0);
1102 	} while ((sc->sc_status0 & INTPD) == 0);
1103 
1104 	sc->sc_status1 = bus_space_read_1(iot, ioh, TUL_STAT1);
1105 	sc->sc_sistat = bus_space_read_1(iot, ioh, TUL_SISTAT);
1106 
1107 	sc->sc_phase = sc->sc_status0 & PH_MASK;
1108 
1109 	if ((sc->sc_sistat & SRSTD) != 0) {
1110 		/* SCSI bus reset interrupt */
1111 		iha_reset_scsi_bus(sc);
1112 		return (-1);
1113 	}
1114 
1115 	if ((sc->sc_sistat & RSELED) != 0)
1116 		/* Reselection interrupt */
1117 		return (iha_resel(sc));
1118 
1119 	if ((sc->sc_sistat & STIMEO) != 0) {
1120 		/* selected/reselected timeout interrupt */
1121 		iha_busfree(sc);
1122 		return (-1);
1123 	}
1124 
1125 	if ((sc->sc_sistat & DISCD) != 0) {
1126 		/* BUS disconnection interrupt */
1127 		if ((sc->sc_flags & FLAG_EXPECT_DONE_DISC) != 0) {
1128 			bus_space_write_1(iot, ioh, TUL_SCTRL0, RSFIFO);
1129 			bus_space_write_1(iot, ioh, TUL_SCONFIG0,
1130 			    SCONFIG0DEFAULT);
1131 			bus_space_write_1(iot, ioh, TUL_SCTRL1, EHRSL);
1132 			iha_append_done_scb(sc, sc->sc_actscb, HOST_OK);
1133 			sc->sc_flags &= ~FLAG_EXPECT_DONE_DISC;
1134 
1135 		} else if ((sc->sc_flags & FLAG_EXPECT_DISC) != 0) {
1136 			bus_space_write_1(iot, ioh, TUL_SCTRL0, RSFIFO);
1137 			bus_space_write_1(iot, ioh, TUL_SCONFIG0,
1138 			    SCONFIG0DEFAULT);
1139 			bus_space_write_1(iot, ioh, TUL_SCTRL1, EHRSL);
1140 			sc->sc_actscb = NULL;
1141 			sc->sc_flags &= ~FLAG_EXPECT_DISC;
1142 
1143 		} else
1144 			iha_busfree(sc);
1145 
1146 		return (-1);
1147 	}
1148 
1149 	return (sc->sc_phase);
1150 }
1151 
1152 static void
1153 iha_exec_scb(sc, scb)
1154 	struct iha_softc *sc;
1155 	struct iha_scb *scb;
1156 {
1157 	bus_space_tag_t iot;
1158 	bus_space_handle_t ioh;
1159 	bus_dmamap_t dm;
1160 	struct scsipi_xfer *xs = scb->xs;
1161 	int nseg, s;
1162 
1163 	dm = scb->dmap;
1164 	nseg = dm->dm_nsegs;
1165 
1166 	if (nseg > 1) {
1167 		struct iha_sg_element *sg = scb->sglist;
1168 		int i;
1169 
1170 		for (i = 0; i < nseg; i++) {
1171 			sg[i].sg_len = htole32(dm->dm_segs[i].ds_len);
1172 			sg[i].sg_addr = htole32(dm->dm_segs[i].ds_addr);
1173 		}
1174 		bus_dmamap_sync(sc->sc_dmat, sc->sc_dmamap,
1175 		    scb->sgoffset, IHA_SG_SIZE,
1176 		    BUS_DMASYNC_PREWRITE);
1177 
1178 		scb->flags |= FLAG_SG;
1179 		scb->sg_size = scb->sg_max = nseg;
1180 		scb->sg_index = 0;
1181 
1182 		scb->bufaddr = scb->sg_addr;
1183 	} else
1184 		scb->bufaddr = dm->dm_segs[0].ds_addr;
1185 
1186 	if ((xs->xs_control & XS_CTL_POLL) == 0) {
1187 		int timeout = mstohz(xs->timeout);
1188 		if (timeout == 0)
1189 			timeout = 1;
1190 		callout_reset(&xs->xs_callout, timeout, iha_timeout, scb);
1191 	}
1192 
1193 	s = splbio();
1194 
1195 	if (((scb->xs->xs_control & XS_RESET) != 0) ||
1196 	    (scb->cmd[0] == REQUEST_SENSE))
1197 		iha_push_pend_scb(sc, scb);   /* Insert SCB at head of Pend */
1198 	else
1199 		iha_append_pend_scb(sc, scb); /* Append SCB to tail of Pend */
1200 
1201 	/*
1202 	 * Run through iha_main() to ensure something is active, if
1203 	 * only this new SCB.
1204 	 */
1205 	if (sc->sc_semaph != SEMAPH_IN_MAIN) {
1206 		iot = sc->sc_iot;
1207 		ioh = sc->sc_ioh;
1208 
1209 		bus_space_write_1(iot, ioh, TUL_IMSK, MASK_ALL);
1210 		sc->sc_semaph = SEMAPH_IN_MAIN;
1211 
1212 		splx(s);
1213 		iha_main(sc);
1214 		s = splbio();
1215 
1216 		sc->sc_semaph = ~SEMAPH_IN_MAIN;
1217 		bus_space_write_1(iot, ioh, TUL_IMSK, (MASK_ALL & ~MSCMP));
1218 	}
1219 
1220 	splx(s);
1221 }
1222 
1223 /*
1224  * iha_done_scb - We have a scb which has been processed by the
1225  *                adaptor, now we look to see how the operation went.
1226  */
1227 static void
1228 iha_done_scb(sc, scb)
1229 	struct iha_softc *sc;
1230 	struct iha_scb *scb;
1231 {
1232 	struct scsipi_xfer *xs = scb->xs;
1233 
1234 	if (xs != NULL) {
1235 		/* Cancel the timeout. */
1236 		callout_stop(&xs->xs_callout);
1237 
1238 		if (scb->flags & (FLAG_DATAIN | FLAG_DATAOUT)) {
1239 			bus_dmamap_sync(sc->sc_dmat, scb->dmap,
1240 			    0, scb->dmap->dm_mapsize,
1241 			    (scb->flags & FLAG_DATAIN) ?
1242 			    BUS_DMASYNC_POSTREAD : BUS_DMASYNC_POSTWRITE);
1243 			bus_dmamap_unload(sc->sc_dmat, scb->dmap);
1244 		}
1245 
1246 		xs->status = scb->ta_stat;
1247 
1248 		switch (scb->ha_stat) {
1249 		case HOST_OK:
1250 			switch (scb->ta_stat) {
1251 			case SCSI_OK:
1252 			case SCSI_CONDITION_MET:
1253 			case SCSI_INTERM:
1254 			case SCSI_INTERM_COND_MET:
1255 				xs->resid = scb->buflen;
1256 				xs->error = XS_NOERROR;
1257 				if ((scb->flags & FLAG_RSENS) != 0)
1258 					xs->error = XS_SENSE;
1259 				break;
1260 
1261 			case SCSI_RESV_CONFLICT:
1262 			case SCSI_BUSY:
1263 			case SCSI_QUEUE_FULL:
1264 				xs->error = XS_BUSY;
1265 				break;
1266 
1267 			case SCSI_TERMINATED:
1268 			case SCSI_ACA_ACTIVE:
1269 			case SCSI_CHECK:
1270 				scb->tcs->flags &=
1271 				    ~(FLAG_SYNC_DONE | FLAG_WIDE_DONE);
1272 
1273 				if ((scb->flags & FLAG_RSENS) != 0 ||
1274 				    iha_push_sense_request(sc, scb) != 0) {
1275 					scb->flags &= ~FLAG_RSENS;
1276 					printf("%s: request sense failed\n",
1277 					    sc->sc_dev.dv_xname);
1278 					xs->error = XS_DRIVER_STUFFUP;
1279 					break;
1280 				}
1281 
1282 				xs->error = XS_SENSE;
1283 				return;
1284 
1285 			default:
1286 				xs->error = XS_DRIVER_STUFFUP;
1287 				break;
1288 			}
1289 			break;
1290 
1291 		case HOST_SEL_TOUT:
1292 			xs->error = XS_SELTIMEOUT;
1293 			break;
1294 
1295 		case HOST_SCSI_RST:
1296 		case HOST_DEV_RST:
1297 			xs->error = XS_RESET;
1298 			break;
1299 
1300 		case HOST_SPERR:
1301 			printf("%s: SCSI Parity error detected\n",
1302 			    sc->sc_dev.dv_xname);
1303 			xs->error = XS_DRIVER_STUFFUP;
1304 			break;
1305 
1306 		case HOST_TIMED_OUT:
1307 			xs->error = XS_TIMEOUT;
1308 			break;
1309 
1310 		case HOST_DO_DU:
1311 		case HOST_BAD_PHAS:
1312 		default:
1313 			xs->error = XS_DRIVER_STUFFUP;
1314 			break;
1315 		}
1316 
1317 		scsipi_done(xs);
1318 	}
1319 
1320 	iha_append_free_scb(sc, scb);
1321 }
1322 
1323 /*
1324  * iha_push_sense_request - obtain auto sense data by pushing the
1325  *			    SCB needing it back onto the pending
1326  *			    queue with a REQUEST_SENSE CDB.
1327  */
1328 static int
1329 iha_push_sense_request(sc, scb)
1330 	struct iha_softc *sc;
1331 	struct iha_scb *scb;
1332 {
1333 	struct scsipi_xfer *xs = scb->xs;
1334 	struct scsipi_periph *periph = xs->xs_periph;
1335 	struct scsipi_sense *ss = (struct scsipi_sense *)scb->cmd;
1336 	int lun = periph->periph_lun;
1337 	int err;
1338 
1339 	ss->opcode = REQUEST_SENSE;
1340 	ss->byte2 = lun << SCSI_CMD_LUN_SHIFT;
1341 	ss->unused[0] = ss->unused[1] = 0;
1342 	ss->length = sizeof(struct scsipi_sense_data);
1343 	ss->control = 0;
1344 
1345 	scb->flags = FLAG_RSENS | FLAG_DATAIN;
1346 
1347 	scb->scb_id &= ~MSG_IDENTIFY_DISCFLAG;
1348 
1349 	scb->scb_tagmsg = 0;
1350 	scb->ta_stat = SCSI_OK;
1351 
1352 	scb->cmdlen = sizeof(struct scsipi_sense);
1353 	scb->buflen = ss->length;
1354 
1355 	err = bus_dmamap_load(sc->sc_dmat, scb->dmap,
1356 	    &xs->sense.scsi_sense, scb->buflen, NULL,
1357 	    BUS_DMA_READ|BUS_DMA_NOWAIT);
1358 	if (err != 0) {
1359 		printf("iha_push_sense_request: cannot bus_dmamap_load()\n");
1360 		xs->error = XS_DRIVER_STUFFUP;
1361 		return 1;
1362 	}
1363 	bus_dmamap_sync(sc->sc_dmat, scb->dmap,
1364 	    0, scb->buflen, BUS_DMASYNC_PREREAD);
1365 
1366 	/* XXX What about queued command? */
1367 	iha_exec_scb(sc, scb);
1368 
1369 	return 0;
1370 }
1371 
1372 static void
1373 iha_timeout(arg)
1374 	void *arg;
1375 {
1376 	struct iha_scb *scb = (struct iha_scb *)arg;
1377 	struct scsipi_xfer *xs = scb->xs;
1378 	struct scsipi_periph *periph = xs->xs_periph;
1379 	struct iha_softc *sc;
1380 
1381 	sc = (void *)periph->periph_channel->chan_adapter->adapt_dev;
1382 
1383 	if (xs == NULL)
1384 		printf("[debug] iha_timeout called with xs == NULL\n");
1385 
1386 	else {
1387 		scsipi_printaddr(periph);
1388 		printf("SCSI OpCode 0x%02x timed out\n", xs->cmd->opcode);
1389 
1390 		iha_abort_xs(sc, xs, HOST_TIMED_OUT);
1391 	}
1392 }
1393 
1394 /*
1395  * iha_abort_xs - find the SCB associated with the supplied xs and
1396  *                stop all processing on it, moving it to the done
1397  *                queue with the supplied host status value.
1398  */
1399 static void
1400 iha_abort_xs(sc, xs, hastat)
1401 	struct iha_softc *sc;
1402 	struct scsipi_xfer *xs;
1403 	u_int8_t hastat;
1404 {
1405 	struct iha_scb *scb;
1406 	int i, s;
1407 
1408 	s = splbio();
1409 
1410 	/* Check the pending queue for the SCB pointing to xs */
1411 
1412 	TAILQ_FOREACH(scb, &sc->sc_pendscb, chain)
1413 		if (scb->xs == xs) {
1414 			iha_del_pend_scb(sc, scb);
1415 			iha_append_done_scb(sc, scb, hastat);
1416 			splx(s);
1417 			return;
1418 		}
1419 
1420 	/*
1421 	 * If that didn't work, check all BUSY/SELECTING SCB's for one
1422 	 * pointing to xs
1423 	 */
1424 
1425 	for (i = 0, scb = sc->sc_scb; i < IHA_MAX_SCB; i++, scb++)
1426 		switch (scb->status) {
1427 		case STATUS_BUSY:
1428 		case STATUS_SELECT:
1429 			if (scb->xs == xs) {
1430 				iha_append_done_scb(sc, scb, hastat);
1431 				splx(s);
1432 				return;
1433 			}
1434 			break;
1435 		default:
1436 			break;
1437 		}
1438 
1439 	splx(s);
1440 }
1441 
1442 /*
1443  * iha_data_over_run - return HOST_OK for all SCSI opcodes where BufLen
1444  *		       is an 'Allocation Length'. All other SCSI opcodes
1445  *		       get HOST_DO_DU as they SHOULD have xferred all the
1446  *		       data requested.
1447  *
1448  *		       The list of opcodes using 'Allocation Length' was
1449  *		       found by scanning all the SCSI-3 T10 drafts. See
1450  *		       www.t10.org for the curious with a .pdf reader.
1451  */
1452 static u_int8_t
1453 iha_data_over_run(scb)
1454 	struct iha_scb *scb;
1455 {
1456 	switch (scb->cmd[0]) {
1457 	case 0x03: /* Request Sense                   SPC-2 */
1458 	case 0x12: /* Inquiry                         SPC-2 */
1459 	case 0x1a: /* Mode Sense (6 byte version)     SPC-2 */
1460 	case 0x1c: /* Receive Diagnostic Results      SPC-2 */
1461 	case 0x23: /* Read Format Capacities          MMC-2 */
1462 	case 0x29: /* Read Generation                 SBC   */
1463 	case 0x34: /* Read Position                   SSC-2 */
1464 	case 0x37: /* Read Defect Data                SBC   */
1465 	case 0x3c: /* Read Buffer                     SPC-2 */
1466 	case 0x42: /* Read Sub Channel                MMC-2 */
1467 	case 0x43: /* Read TOC/PMA/ATIP               MMC   */
1468 
1469 	/* XXX - 2 with same opcode of 0x44? */
1470 	case 0x44: /* Read Header/Read Density Suprt  MMC/SSC*/
1471 
1472 	case 0x46: /* Get Configuration               MMC-2 */
1473 	case 0x4a: /* Get Event/Status Notification   MMC-2 */
1474 	case 0x4d: /* Log Sense                       SPC-2 */
1475 	case 0x51: /* Read Disc Information           MMC   */
1476 	case 0x52: /* Read Track Information          MMC   */
1477 	case 0x59: /* Read Master CUE                 MMC   */
1478 	case 0x5a: /* Mode Sense (10 byte version)    SPC-2 */
1479 	case 0x5c: /* Read Buffer Capacity            MMC   */
1480 	case 0x5e: /* Persistent Reserve In           SPC-2 */
1481 	case 0x84: /* Receive Copy Results            SPC-2 */
1482 	case 0xa0: /* Report LUNs                     SPC-2 */
1483 	case 0xa3: /* Various Report requests         SBC-2/SCC-2*/
1484 	case 0xa4: /* Report Key                      MMC-2 */
1485 	case 0xad: /* Read DVD Structure              MMC-2 */
1486 	case 0xb4: /* Read Element Status (Attached)  SMC   */
1487 	case 0xb5: /* Request Volume Element Address  SMC   */
1488 	case 0xb7: /* Read Defect Data (12 byte ver.) SBC   */
1489 	case 0xb8: /* Read Element Status (Independ.) SMC   */
1490 	case 0xba: /* Report Redundancy               SCC-2 */
1491 	case 0xbd: /* Mechanism Status                MMC   */
1492 	case 0xbe: /* Report Basic Redundancy         SCC-2 */
1493 
1494 		return (HOST_OK);
1495 
1496 	default:
1497 		return (HOST_DO_DU);
1498 	}
1499 }
1500 
1501 /*
1502  * iha_next_state - process the current SCB as requested in its
1503  *                  nextstat member.
1504  */
1505 static int
1506 iha_next_state(sc)
1507 	struct iha_softc *sc;
1508 {
1509 
1510 	if (sc->sc_actscb == NULL)
1511 		return (-1);
1512 
1513 	switch (sc->sc_actscb->nextstat) {
1514 	case 1:
1515 		if (iha_state_1(sc) == 3)
1516 			goto state_3;
1517 		break;
1518 
1519 	case 2:
1520 		switch (iha_state_2(sc)) {
1521 		case 3:
1522 			goto state_3;
1523 		case 4:
1524 			goto state_4;
1525 		default:
1526 			break;
1527 		}
1528 		break;
1529 
1530 	case 3:
1531 	state_3:
1532 		if (iha_state_3(sc) == 4)
1533 			goto state_4;
1534 		break;
1535 
1536 	case 4:
1537 	state_4:
1538 		switch (iha_state_4(sc)) {
1539 		case 0:
1540 			return (0);
1541 		case 6:
1542 			goto state_6;
1543 		default:
1544 			break;
1545 		}
1546 		break;
1547 
1548 	case 5:
1549 		switch (iha_state_5(sc)) {
1550 		case 4:
1551 			goto state_4;
1552 		case 6:
1553 			goto state_6;
1554 		default:
1555 			break;
1556 		}
1557 		break;
1558 
1559 	case 6:
1560 	state_6:
1561 		iha_state_6(sc);
1562 		break;
1563 
1564 	case 8:
1565 		iha_state_8(sc);
1566 		break;
1567 
1568 	default:
1569 #ifdef IHA_DEBUG_STATE
1570 		printf("[debug] -unknown state: %i-\n",
1571 		    sc->sc_actscb->nextstat);
1572 #endif
1573 		iha_bad_seq(sc);
1574 		break;
1575 	}
1576 
1577 	return (-1);
1578 }
1579 
1580 /*
1581  * iha_state_1 - selection is complete after a SELATNSTOP. If the target
1582  *               has put the bus into MSG_OUT phase start wide/sync
1583  *               negotiation. Otherwise clear the FIFO and go to state 3,
1584  *	    	 which will send the SCSI CDB to the target.
1585  */
1586 static int
1587 iha_state_1(sc)
1588 	struct iha_softc *sc;
1589 {
1590 	bus_space_tag_t iot = sc->sc_iot;
1591 	bus_space_handle_t ioh = sc->sc_ioh;
1592 	struct iha_scb *scb = sc->sc_actscb;
1593 	struct tcs *tcs;
1594 	int flags;
1595 
1596 	iha_mark_busy_scb(scb);
1597 
1598 	tcs = scb->tcs;
1599 
1600 	bus_space_write_1(iot, ioh, TUL_SCONFIG0, tcs->sconfig0);
1601 
1602 	/*
1603 	 * If we are in PHASE_MSG_OUT, send
1604 	 *     a) IDENT message (with tags if appropriate)
1605 	 *     b) WDTR if the target is configured to negotiate wide xfers
1606 	 *     ** OR **
1607 	 *     c) SDTR if the target is configured to negotiate sync xfers
1608 	 *	  but not wide ones
1609 	 *
1610 	 * If we are NOT, then the target is not asking for anything but
1611 	 * the data/command, so go straight to state 3.
1612 	 */
1613 	if (sc->sc_phase == PHASE_MSG_OUT) {
1614 		bus_space_write_1(iot, ioh, TUL_SCTRL1, (ESBUSIN | EHRSL));
1615 		bus_space_write_1(iot, ioh, TUL_SFIFO, scb->scb_id);
1616 
1617 		if (scb->scb_tagmsg != 0) {
1618 			bus_space_write_1(iot, ioh, TUL_SFIFO,
1619 			    scb->scb_tagmsg);
1620 			bus_space_write_1(iot, ioh, TUL_SFIFO,
1621 			    scb->scb_tagid);
1622 		}
1623 
1624 		flags = tcs->flags;
1625 		if ((flags & FLAG_NO_NEG_WIDE) == 0) {
1626 			if (iha_msgout_wdtr(sc) == -1)
1627 				return (-1);
1628 		} else if ((flags & FLAG_NO_NEG_SYNC) == 0) {
1629 			if (iha_msgout_sdtr(sc) == -1)
1630 				return (-1);
1631 		}
1632 
1633 	} else {
1634 		bus_space_write_1(iot, ioh, TUL_SCTRL0, RSFIFO);
1635 		iha_set_ssig(sc, REQ | BSY | SEL | ATN, 0);
1636 	}
1637 
1638 	return (3);
1639 }
1640 
1641 /*
1642  * iha_state_2 - selection is complete after a SEL_ATN or SEL_ATN3. If the SCSI
1643  *		 CDB has already been send, go to state 4 to start the data
1644  *		 xfer. Otherwise reset the FIFO and go to state 3, sending
1645  *		 the SCSI CDB.
1646  */
1647 static int
1648 iha_state_2(sc)
1649 	struct iha_softc *sc;
1650 {
1651 	bus_space_tag_t iot = sc->sc_iot;
1652 	bus_space_handle_t ioh = sc->sc_ioh;
1653 	struct iha_scb *scb = sc->sc_actscb;
1654 
1655 	iha_mark_busy_scb(scb);
1656 
1657 	bus_space_write_1(iot, ioh, TUL_SCONFIG0, scb->tcs->sconfig0);
1658 
1659 	if ((sc->sc_status1 & CPDNE) != 0)
1660 		return (4);
1661 
1662 	bus_space_write_1(iot, ioh, TUL_SCTRL0, RSFIFO);
1663 
1664 	iha_set_ssig(sc, REQ | BSY | SEL | ATN, 0);
1665 
1666 	return (3);
1667 }
1668 
1669 /*
1670  * iha_state_3 - send the SCSI CDB to the target, processing any status
1671  *		 or other messages received until that is done or
1672  *		 abandoned.
1673  */
1674 static int
1675 iha_state_3(sc)
1676 	struct iha_softc *sc;
1677 {
1678 	bus_space_tag_t iot = sc->sc_iot;
1679 	bus_space_handle_t ioh = sc->sc_ioh;
1680 	struct iha_scb *scb = sc->sc_actscb;
1681 	int flags;
1682 
1683 	for (;;) {
1684 		switch (sc->sc_phase) {
1685 		case PHASE_CMD_OUT:
1686 			bus_space_write_multi_1(iot, ioh, TUL_SFIFO,
1687 			    scb->cmd, scb->cmdlen);
1688 			if (iha_wait(sc, XF_FIFO_OUT) == -1)
1689 				return (-1);
1690 			else if (sc->sc_phase == PHASE_CMD_OUT) {
1691 				iha_bad_seq(sc);
1692 				return (-1);
1693 			} else
1694 				return (4);
1695 
1696 		case PHASE_MSG_IN:
1697 			scb->nextstat = 3;
1698 			if (iha_msgin(sc) == -1)
1699 				return (-1);
1700 			break;
1701 
1702 		case PHASE_STATUS_IN:
1703 			if (iha_status_msg(sc) == -1)
1704 				return (-1);
1705 			break;
1706 
1707 		case PHASE_MSG_OUT:
1708 			flags = scb->tcs->flags;
1709 			if ((flags & FLAG_NO_NEG_SYNC) != 0) {
1710 				if (iha_msgout(sc, MSG_NOOP) == -1)
1711 					return (-1);
1712 			} else if (iha_msgout_sdtr(sc) == -1)
1713 				return (-1);
1714 			break;
1715 
1716 		default:
1717 			printf("[debug] -s3- bad phase = %d\n", sc->sc_phase);
1718 			iha_bad_seq(sc);
1719 			return (-1);
1720 		}
1721 	}
1722 }
1723 
1724 /*
1725  * iha_state_4 - start a data xfer. Handle any bus state
1726  *               transitions until PHASE_DATA_IN/_OUT
1727  *               or the attempt is abandoned. If there is
1728  *               no data to xfer, go to state 6 and finish
1729  *               processing the current SCB.
1730  */
1731 static int
1732 iha_state_4(sc)
1733 	struct iha_softc *sc;
1734 {
1735 	struct iha_scb *scb = sc->sc_actscb;
1736 
1737 	if ((scb->flags & (FLAG_DATAIN | FLAG_DATAOUT)) ==
1738 	    (FLAG_DATAIN | FLAG_DATAOUT))
1739 		return (6); /* Both dir flags set => NO xfer was requested */
1740 
1741 	for (;;) {
1742 		if (scb->buflen == 0)
1743 			return (6);
1744 
1745 		switch (sc->sc_phase) {
1746 		case PHASE_STATUS_IN:
1747 			if ((scb->flags & (FLAG_DATAIN | FLAG_DATAOUT)) != 0)
1748 				scb->ha_stat = iha_data_over_run(scb);
1749 			if ((iha_status_msg(sc)) == -1)
1750 				return (-1);
1751 			break;
1752 
1753 		case PHASE_MSG_IN:
1754 			scb->nextstat = 4;
1755 			if (iha_msgin(sc) == -1)
1756 				return (-1);
1757 			break;
1758 
1759 		case PHASE_MSG_OUT:
1760 			if ((sc->sc_status0 & SPERR) != 0) {
1761 				scb->buflen = 0;
1762 				scb->ha_stat = HOST_SPERR;
1763 				if (iha_msgout(sc, MSG_INITIATOR_DET_ERR) == -1)
1764 					return (-1);
1765 				else
1766 					return (6);
1767 			} else {
1768 				if (iha_msgout(sc, MSG_NOOP) == -1)
1769 					return (-1);
1770 			}
1771 			break;
1772 
1773 		case PHASE_DATA_IN:
1774 			return (iha_xfer_data(sc, scb, FLAG_DATAIN));
1775 
1776 		case PHASE_DATA_OUT:
1777 			return (iha_xfer_data(sc, scb, FLAG_DATAOUT));
1778 
1779 		default:
1780 			iha_bad_seq(sc);
1781 			return (-1);
1782 		}
1783 	}
1784 }
1785 
1786 /*
1787  * iha_state_5 - handle the partial or final completion of the current
1788  *		 data xfer. If DMA is still active stop it. If there is
1789  *		 more data to xfer, go to state 4 and start the xfer.
1790  *		 If not go to state 6 and finish the SCB.
1791  */
1792 static int
1793 iha_state_5(sc)
1794 	struct iha_softc *sc;
1795 {
1796 	bus_space_tag_t iot = sc->sc_iot;
1797 	bus_space_handle_t ioh = sc->sc_ioh;
1798 	struct iha_scb *scb = sc->sc_actscb;
1799 	struct iha_sg_element *sg;
1800 	u_int32_t cnt;
1801 	u_int8_t period, stat;
1802 	long xcnt;  /* cannot use unsigned!! see code: if (xcnt < 0) */
1803 	int i;
1804 
1805 	cnt = bus_space_read_4(iot, ioh, TUL_STCNT0) & TCNT;
1806 
1807 	/*
1808 	 * Stop any pending DMA activity and check for parity error.
1809 	 */
1810 
1811 	if ((bus_space_read_1(iot, ioh, TUL_DCMD) & XDIR) != 0) {
1812 		/* Input Operation */
1813 		if ((sc->sc_status0 & SPERR) != 0)
1814 			scb->ha_stat = HOST_SPERR;
1815 
1816 		if ((bus_space_read_1(iot, ioh, TUL_ISTUS1) & XPEND) != 0) {
1817 			bus_space_write_1(iot, ioh, TUL_DCTRL0,
1818 			    bus_space_read_1(iot, ioh, TUL_DCTRL0) | SXSTP);
1819 			while (bus_space_read_1(iot, ioh, TUL_ISTUS1) & XPEND)
1820 				;
1821 		}
1822 
1823 	} else {
1824 		/* Output Operation */
1825 		if ((sc->sc_status1 & SXCMP) == 0) {
1826 			period = scb->tcs->syncm;
1827 			if ((period & PERIOD_WIDE_SCSI) != 0)
1828 				cnt += (bus_space_read_1(iot, ioh,
1829 				    TUL_SFIFOCNT) & FIFOC) * 2;
1830 			else
1831 				cnt += bus_space_read_1(iot, ioh,
1832 				    TUL_SFIFOCNT) & FIFOC;
1833 		}
1834 
1835 		if ((bus_space_read_1(iot, ioh, TUL_ISTUS1) & XPEND) != 0) {
1836 			bus_space_write_1(iot, ioh, TUL_DCMD, ABTXFR);
1837 			do
1838 				stat = bus_space_read_1(iot, ioh, TUL_ISTUS0);
1839 			while ((stat & DABT) == 0);
1840 		}
1841 
1842 		if ((cnt == 1) && (sc->sc_phase == PHASE_DATA_OUT)) {
1843 			if (iha_wait(sc, XF_FIFO_OUT) == -1)
1844 				return (-1);
1845 			cnt = 0;
1846 
1847 		} else if ((sc->sc_status1 & SXCMP) == 0)
1848 			bus_space_write_1(iot, ioh, TUL_SCTRL0, RSFIFO);
1849 	}
1850 
1851 	if (cnt == 0) {
1852 		scb->buflen = 0;
1853 		return (6);
1854 	}
1855 
1856 	/* Update active data pointer and restart the I/O at the new point */
1857 
1858 	xcnt = scb->buflen - cnt;	/* xcnt == bytes xferred */
1859 	scb->buflen = cnt;	  	/* cnt  == bytes left    */
1860 
1861 	if ((scb->flags & FLAG_SG) != 0) {
1862 		sg = &scb->sglist[scb->sg_index];
1863 		for (i = scb->sg_index; i < scb->sg_max; sg++, i++) {
1864 			xcnt -= le32toh(sg->sg_len);
1865 			if (xcnt < 0) {
1866 				xcnt += le32toh(sg->sg_len);
1867 
1868 				sg->sg_addr =
1869 				    htole32(le32toh(sg->sg_addr) + xcnt);
1870 				sg->sg_len =
1871 				    htole32(le32toh(sg->sg_len) - xcnt);
1872 				bus_dmamap_sync(sc->sc_dmat, sc->sc_dmamap,
1873 				    scb->sgoffset, IHA_SG_SIZE,
1874 				    BUS_DMASYNC_PREWRITE);
1875 
1876 				scb->bufaddr += (i - scb->sg_index) *
1877 				    sizeof(struct iha_sg_element);
1878 				scb->sg_size = scb->sg_max - i;
1879 				scb->sg_index = i;
1880 
1881 				return (4);
1882 			}
1883 		}
1884 		return (6);
1885 
1886 	} else
1887 		scb->bufaddr += xcnt;
1888 
1889 	return (4);
1890 }
1891 
1892 /*
1893  * iha_state_6 - finish off the active scb (may require several
1894  *		 iterations if PHASE_MSG_IN) and return -1 to indicate
1895  *		 the bus is free.
1896  */
1897 static int
1898 iha_state_6(sc)
1899 	struct iha_softc *sc;
1900 {
1901 
1902 	for (;;) {
1903 		switch (sc->sc_phase) {
1904 		case PHASE_STATUS_IN:
1905 			if (iha_status_msg(sc) == -1)
1906 				return (-1);
1907 			break;
1908 
1909 		case PHASE_MSG_IN:
1910 			sc->sc_actscb->nextstat = 6;
1911 			if ((iha_msgin(sc)) == -1)
1912 				return (-1);
1913 			break;
1914 
1915 		case PHASE_MSG_OUT:
1916 			if ((iha_msgout(sc, MSG_NOOP)) == -1)
1917 				return (-1);
1918 			break;
1919 
1920 		case PHASE_DATA_IN:
1921 			if (iha_xpad_in(sc) == -1)
1922 				return (-1);
1923 			break;
1924 
1925 		case PHASE_DATA_OUT:
1926 			if (iha_xpad_out(sc) == -1)
1927 				return (-1);
1928 			break;
1929 
1930 		default:
1931 			iha_bad_seq(sc);
1932 			return (-1);
1933 		}
1934 	}
1935 }
1936 
1937 /*
1938  * iha_state_8 - reset the active device and all busy SCBs using it
1939  */
1940 static int
1941 iha_state_8(sc)
1942 	struct iha_softc *sc;
1943 {
1944 	bus_space_tag_t iot = sc->sc_iot;
1945 	bus_space_handle_t ioh = sc->sc_ioh;
1946 	struct iha_scb *scb;
1947 	int i;
1948 	u_int8_t tar;
1949 
1950 	if (sc->sc_phase == PHASE_MSG_OUT) {
1951 		bus_space_write_1(iot, ioh, TUL_SFIFO, MSG_BUS_DEV_RESET);
1952 
1953 		scb = sc->sc_actscb;
1954 
1955 		/* This SCB finished correctly -- resetting the device */
1956 		iha_append_done_scb(sc, scb, HOST_OK);
1957 
1958 		iha_reset_tcs(scb->tcs, sc->sc_sconf1);
1959 
1960 		tar = scb->target;
1961 		for (i = 0, scb = sc->sc_scb; i < IHA_MAX_SCB; i++, scb++)
1962 			if (scb->target == tar)
1963 				switch (scb->status) {
1964 				case STATUS_BUSY:
1965 					iha_append_done_scb(sc,
1966 					    scb, HOST_DEV_RST);
1967 					break;
1968 
1969 				case STATUS_SELECT:
1970 					iha_push_pend_scb(sc, scb);
1971 					break;
1972 
1973 				default:
1974 					break;
1975 				}
1976 
1977 		sc->sc_flags |= FLAG_EXPECT_DISC;
1978 
1979 		if (iha_wait(sc, XF_FIFO_OUT) == -1)
1980 			return (-1);
1981 	}
1982 
1983 	iha_bad_seq(sc);
1984 	return (-1);
1985 }
1986 
1987 /*
1988  * iha_xfer_data - initiate the DMA xfer of the data
1989  */
1990 static int
1991 iha_xfer_data(sc, scb, direction)
1992 	struct iha_softc *sc;
1993 	struct iha_scb *scb;
1994 	int direction;
1995 {
1996 	bus_space_tag_t iot = sc->sc_iot;
1997 	bus_space_handle_t ioh = sc->sc_ioh;
1998 	u_int32_t xferlen;
1999 	u_int8_t xfercmd;
2000 
2001 	if ((scb->flags & (FLAG_DATAIN | FLAG_DATAOUT)) != direction)
2002 		return (6); /* wrong direction, abandon I/O */
2003 
2004 	bus_space_write_4(iot, ioh, TUL_STCNT0, scb->buflen);
2005 
2006 	xfercmd = STRXFR;
2007 	if (direction == FLAG_DATAIN)
2008 		xfercmd |= XDIR;
2009 
2010 	if (scb->flags & FLAG_SG) {
2011 		xferlen = scb->sg_size * sizeof(struct iha_sg_element);
2012 		xfercmd |= SGXFR;
2013 	} else
2014 		xferlen = scb->buflen;
2015 
2016 	bus_space_write_4(iot, ioh, TUL_DXC,  xferlen);
2017 	bus_space_write_4(iot, ioh, TUL_DXPA, scb->bufaddr);
2018 	bus_space_write_1(iot, ioh, TUL_DCMD, xfercmd);
2019 
2020 	bus_space_write_1(iot, ioh, TUL_SCMD,
2021 	    (direction == FLAG_DATAIN) ? XF_DMA_IN : XF_DMA_OUT);
2022 
2023 	scb->nextstat = 5;
2024 
2025 	return (0);
2026 }
2027 
2028 static int
2029 iha_xpad_in(sc)
2030 	struct iha_softc *sc;
2031 {
2032 	bus_space_tag_t iot = sc->sc_iot;
2033 	bus_space_handle_t ioh = sc->sc_ioh;
2034 	struct iha_scb *scb = sc->sc_actscb;
2035 
2036 	if ((scb->flags & (FLAG_DATAIN | FLAG_DATAOUT)) != 0)
2037 		scb->ha_stat = HOST_DO_DU;
2038 
2039 	for (;;) {
2040 		if ((scb->tcs->syncm & PERIOD_WIDE_SCSI) != 0)
2041 			bus_space_write_4(iot, ioh, TUL_STCNT0, 2);
2042 		else
2043 			bus_space_write_4(iot, ioh, TUL_STCNT0, 1);
2044 
2045 		switch (iha_wait(sc, XF_FIFO_IN)) {
2046 		case -1:
2047 			return (-1);
2048 
2049 		case PHASE_DATA_IN:
2050 			bus_space_read_1(iot, ioh, TUL_SFIFO);
2051 			break;
2052 
2053 		default:
2054 			bus_space_write_1(iot, ioh, TUL_SCTRL0, RSFIFO);
2055 			return (6);
2056 		}
2057 	}
2058 }
2059 
2060 static int
2061 iha_xpad_out(sc)
2062 	struct iha_softc *sc;
2063 {
2064 	bus_space_tag_t iot = sc->sc_iot;
2065 	bus_space_handle_t ioh = sc->sc_ioh;
2066 	struct iha_scb *scb = sc->sc_actscb;
2067 
2068 	if ((scb->flags & (FLAG_DATAIN | FLAG_DATAOUT)) != 0)
2069 		scb->ha_stat = HOST_DO_DU;
2070 
2071 	for (;;) {
2072 		if ((scb->tcs->syncm & PERIOD_WIDE_SCSI) != 0)
2073 			bus_space_write_4(iot, ioh, TUL_STCNT0, 2);
2074 		else
2075 			bus_space_write_4(iot, ioh, TUL_STCNT0, 1);
2076 
2077 		bus_space_write_1(iot, ioh, TUL_SFIFO, 0);
2078 
2079 		switch (iha_wait(sc, XF_FIFO_OUT)) {
2080 		case -1:
2081 			return (-1);
2082 
2083 		case PHASE_DATA_OUT:
2084 			break;
2085 
2086 		default:
2087 			/* Disable wide CPU to allow read 16 bits */
2088 			bus_space_write_1(iot, ioh, TUL_SCTRL1, EHRSL);
2089 			bus_space_write_1(iot, ioh, TUL_SCTRL0, RSFIFO);
2090 			return (6);
2091 		}
2092 	}
2093 }
2094 
2095 static int
2096 iha_status_msg(sc)
2097 	struct iha_softc *sc;
2098 {
2099 	bus_space_tag_t iot = sc->sc_iot;
2100 	bus_space_handle_t ioh = sc->sc_ioh;
2101 	struct iha_scb *scb;
2102 	u_int8_t msg;
2103 	int phase;
2104 
2105 	if ((phase = iha_wait(sc, CMD_COMP)) == -1)
2106 		return (-1);
2107 
2108 	scb = sc->sc_actscb;
2109 
2110 	scb->ta_stat = bus_space_read_1(iot, ioh, TUL_SFIFO);
2111 
2112 	if (phase == PHASE_MSG_OUT) {
2113 		if ((sc->sc_status0 & SPERR) == 0)
2114 			bus_space_write_1(iot, ioh, TUL_SFIFO, MSG_NOOP);
2115 		else
2116 			bus_space_write_1(iot, ioh, TUL_SFIFO,
2117 			    MSG_PARITY_ERROR);
2118 
2119 		return (iha_wait(sc, XF_FIFO_OUT));
2120 
2121 	} else if (phase == PHASE_MSG_IN) {
2122 		msg = bus_space_read_1(iot, ioh, TUL_SFIFO);
2123 
2124 		if ((sc->sc_status0 & SPERR) != 0)
2125 			switch (iha_wait(sc, MSG_ACCEPT)) {
2126 			case -1:
2127 				return (-1);
2128 			case PHASE_MSG_OUT:
2129 				bus_space_write_1(iot, ioh, TUL_SFIFO,
2130 				    MSG_PARITY_ERROR);
2131 				return (iha_wait(sc, XF_FIFO_OUT));
2132 			default:
2133 				iha_bad_seq(sc);
2134 				return (-1);
2135 			}
2136 
2137 		if (msg == MSG_CMDCOMPLETE) {
2138 			if ((scb->ta_stat &
2139 			    (SCSI_INTERM | SCSI_BUSY)) == SCSI_INTERM) {
2140 				iha_bad_seq(sc);
2141 				return (-1);
2142 			}
2143 			sc->sc_flags |= FLAG_EXPECT_DONE_DISC;
2144 			bus_space_write_1(iot, ioh, TUL_SCTRL0, RSFIFO);
2145 			return (iha_wait(sc, MSG_ACCEPT));
2146 		}
2147 
2148 		if ((msg == MSG_LINK_CMD_COMPLETE)
2149 		    || (msg == MSG_LINK_CMD_COMPLETEF)) {
2150 			if ((scb->ta_stat &
2151 			    (SCSI_INTERM | SCSI_BUSY)) == SCSI_INTERM)
2152 				return (iha_wait(sc, MSG_ACCEPT));
2153 		}
2154 	}
2155 
2156 	iha_bad_seq(sc);
2157 	return (-1);
2158 }
2159 
2160 /*
2161  * iha_busfree - SCSI bus free detected as a result of a TIMEOUT or
2162  *		 DISCONNECT interrupt. Reset the tulip FIFO and
2163  *		 SCONFIG0 and enable hardware reselect. Move any active
2164  *		 SCB to sc_donescb list. Return an appropriate host status
2165  *		 if an I/O was active.
2166  */
2167 static void
2168 iha_busfree(sc)
2169 	struct iha_softc *sc;
2170 {
2171 	bus_space_tag_t iot = sc->sc_iot;
2172 	bus_space_handle_t ioh = sc->sc_ioh;
2173 	struct iha_scb *scb;
2174 
2175 	bus_space_write_1(iot, ioh, TUL_SCTRL0, RSFIFO);
2176 	bus_space_write_1(iot, ioh, TUL_SCONFIG0, SCONFIG0DEFAULT);
2177 	bus_space_write_1(iot, ioh, TUL_SCTRL1, EHRSL);
2178 
2179 	scb = sc->sc_actscb;
2180 
2181 	if (scb != NULL) {
2182 		if (scb->status == STATUS_SELECT)
2183 			/* selection timeout   */
2184 			iha_append_done_scb(sc, scb, HOST_SEL_TOUT);
2185 		else
2186 			/* Unexpected bus free */
2187 			iha_append_done_scb(sc, scb, HOST_BAD_PHAS);
2188 	}
2189 }
2190 
2191 /*
2192  * iha_resel - handle a detected SCSI bus reselection request.
2193  */
2194 static int
2195 iha_resel(sc)
2196 	struct iha_softc *sc;
2197 {
2198 	bus_space_tag_t iot = sc->sc_iot;
2199 	bus_space_handle_t ioh = sc->sc_ioh;
2200 	struct iha_scb *scb;
2201 	struct tcs *tcs;
2202 	u_int8_t tag, target, lun, msg, abortmsg;
2203 
2204 	if (sc->sc_actscb != NULL) {
2205 		if ((sc->sc_actscb->status == STATUS_SELECT))
2206 			iha_push_pend_scb(sc, sc->sc_actscb);
2207 		sc->sc_actscb = NULL;
2208 	}
2209 
2210 	target = bus_space_read_1(iot, ioh, TUL_SBID);
2211 	lun = bus_space_read_1(iot, ioh, TUL_SALVC) & IHA_MSG_IDENTIFY_LUNMASK;
2212 
2213 	tcs = &sc->sc_tcs[target];
2214 
2215 	bus_space_write_1(iot, ioh, TUL_SCONFIG0, tcs->sconfig0);
2216 	bus_space_write_1(iot, ioh, TUL_SYNCM, tcs->syncm);
2217 
2218 	abortmsg = MSG_ABORT; /* until a valid tag has been obtained */
2219 
2220 	if (tcs->ntagscb != NULL)
2221 		/* There is a non-tagged I/O active on the target */
2222 		scb = tcs->ntagscb;
2223 
2224 	else {
2225 		/*
2226 		 * Since there is no active non-tagged operation
2227 		 * read the tag type, the tag itself, and find
2228 		 * the appropriate scb by indexing sc_scb with
2229 		 * the tag.
2230 		 */
2231 
2232 		switch (iha_wait(sc, MSG_ACCEPT)) {
2233 		case -1:
2234 			return (-1);
2235 		case PHASE_MSG_IN:
2236 			bus_space_write_4(iot, ioh, TUL_STCNT0, 1);
2237 			if ((iha_wait(sc, XF_FIFO_IN)) == -1)
2238 				return (-1);
2239 			break;
2240 		default:
2241 			goto abort;
2242 		}
2243 
2244 		msg = bus_space_read_1(iot, ioh, TUL_SFIFO); /* Read Tag Msg */
2245 
2246 		if ((msg < MSG_SIMPLE_Q_TAG) || (msg > MSG_ORDERED_Q_TAG))
2247 			goto abort;
2248 
2249 		switch (iha_wait(sc, MSG_ACCEPT)) {
2250 		case -1:
2251 			return (-1);
2252 		case PHASE_MSG_IN:
2253 			bus_space_write_4(iot, ioh, TUL_STCNT0, 1);
2254 			if ((iha_wait(sc, XF_FIFO_IN)) == -1)
2255 				return (-1);
2256 			break;
2257 		default:
2258 			goto abort;
2259 		}
2260 
2261 		tag  = bus_space_read_1(iot, ioh, TUL_SFIFO); /* Read Tag ID */
2262 		scb = &sc->sc_scb[tag];
2263 
2264 		abortmsg = MSG_ABORT_TAG; /* Now that we have valdid tag! */
2265 	}
2266 
2267 	if ((scb->target != target)
2268 	    || (scb->lun != lun)
2269 	    || (scb->status != STATUS_BUSY)) {
2270  abort:
2271 		iha_msgout_abort(sc, abortmsg);
2272 		return (-1);
2273 	}
2274 
2275 	sc->sc_actscb = scb;
2276 
2277 	if (iha_wait(sc, MSG_ACCEPT) == -1)
2278 		return (-1);
2279 
2280 	return (iha_next_state(sc));
2281 }
2282 
2283 static int
2284 iha_msgin(sc)
2285 	struct iha_softc *sc;
2286 {
2287 	bus_space_tag_t iot = sc->sc_iot;
2288 	bus_space_handle_t ioh = sc->sc_ioh;
2289 	int flags;
2290 	int phase;
2291 	u_int8_t msg;
2292 
2293 	for (;;) {
2294 		if ((bus_space_read_1(iot, ioh, TUL_SFIFOCNT) & FIFOC) > 0)
2295 			bus_space_write_1(iot, ioh, TUL_SCTRL0, RSFIFO);
2296 
2297 		bus_space_write_4(iot, ioh, TUL_STCNT0, 1);
2298 
2299 		phase = iha_wait(sc, XF_FIFO_IN);
2300 		msg = bus_space_read_1(iot, ioh, TUL_SFIFO);
2301 
2302 		switch (msg) {
2303 		case MSG_DISCONNECT:
2304 			sc->sc_flags |= FLAG_EXPECT_DISC;
2305 			if (iha_wait(sc, MSG_ACCEPT) != -1)
2306 				iha_bad_seq(sc);
2307 			phase = -1;
2308 			break;
2309 		case MSG_SAVEDATAPOINTER:
2310 		case MSG_RESTOREPOINTERS:
2311 		case MSG_NOOP:
2312 			phase = iha_wait(sc, MSG_ACCEPT);
2313 			break;
2314 		case MSG_MESSAGE_REJECT:
2315 			/* XXX - need to clear FIFO like other 'Clear ATN'?*/
2316 			iha_set_ssig(sc, REQ | BSY | SEL | ATN, 0);
2317 			flags = sc->sc_actscb->tcs->flags;
2318 			if ((flags & FLAG_NO_NEG_SYNC) == 0)
2319 				iha_set_ssig(sc, REQ | BSY | SEL, ATN);
2320 			phase = iha_wait(sc, MSG_ACCEPT);
2321 			break;
2322 		case MSG_EXTENDED:
2323 			phase = iha_msgin_extended(sc);
2324 			break;
2325 		case MSG_IGN_WIDE_RESIDUE:
2326 			phase = iha_msgin_ignore_wid_resid(sc);
2327 			break;
2328 		case MSG_CMDCOMPLETE:
2329 			sc->sc_flags |= FLAG_EXPECT_DONE_DISC;
2330 			bus_space_write_1(iot, ioh, TUL_SCTRL0, RSFIFO);
2331 			phase = iha_wait(sc, MSG_ACCEPT);
2332 			if (phase != -1) {
2333 				iha_bad_seq(sc);
2334 				return (-1);
2335 			}
2336 			break;
2337 		default:
2338 			printf("[debug] iha_msgin: bad msg type: %d\n", msg);
2339 			phase = iha_msgout_reject(sc);
2340 			break;
2341 		}
2342 
2343 		if (phase != PHASE_MSG_IN)
2344 			return (phase);
2345 	}
2346 	/* NOTREACHED */
2347 }
2348 
2349 static int
2350 iha_msgin_extended(sc)
2351 	struct iha_softc *sc;
2352 {
2353 	bus_space_tag_t iot = sc->sc_iot;
2354 	bus_space_handle_t ioh = sc->sc_ioh;
2355 	int flags, i, phase, msglen, msgcode;
2356 
2357 	/*
2358 	 * XXX - can we just stop reading and reject, or do we have to
2359 	 *	 read all input, discarding the excess, and then reject
2360 	 */
2361 	for (i = 0; i < IHA_MAX_EXTENDED_MSG; i++) {
2362 		phase = iha_wait(sc, MSG_ACCEPT);
2363 
2364 		if (phase != PHASE_MSG_IN)
2365 			return (phase);
2366 
2367 		bus_space_write_4(iot, ioh, TUL_STCNT0, 1);
2368 
2369 		if (iha_wait(sc, XF_FIFO_IN) == -1)
2370 			return (-1);
2371 
2372 		sc->sc_msg[i] = bus_space_read_1(iot, ioh, TUL_SFIFO);
2373 
2374 		if (sc->sc_msg[0] == i)
2375 			break;
2376 	}
2377 
2378 	msglen	= sc->sc_msg[0];
2379 	msgcode = sc->sc_msg[1];
2380 
2381 	if ((msglen == MSG_EXT_SDTR_LEN) && (msgcode == MSG_EXT_SDTR)) {
2382 		if (iha_msgin_sdtr(sc) == 0) {
2383 			iha_sync_done(sc);
2384 			return (iha_wait(sc, MSG_ACCEPT));
2385 		}
2386 
2387 		iha_set_ssig(sc, REQ | BSY | SEL, ATN);
2388 
2389 		phase = iha_wait(sc, MSG_ACCEPT);
2390 		if (phase != PHASE_MSG_OUT)
2391 			return (phase);
2392 
2393 		/* Clear FIFO for important message - final SYNC offer */
2394 		bus_space_write_1(iot, ioh, TUL_SCTRL0, RSFIFO);
2395 
2396 		iha_sync_done(sc); /* This is our final offer */
2397 
2398 	} else if ((msglen == MSG_EXT_WDTR_LEN) && (msgcode == MSG_EXT_WDTR)) {
2399 
2400 		flags = sc->sc_actscb->tcs->flags;
2401 
2402 		if ((flags & FLAG_NO_WIDE) != 0)
2403 			/* Offer 8bit xfers only */
2404 			sc->sc_msg[2] = MSG_EXT_WDTR_BUS_8_BIT;
2405 
2406 		else if (sc->sc_msg[2] > MSG_EXT_WDTR_BUS_32_BIT)
2407 			/* BAD MSG */
2408 			return (iha_msgout_reject(sc));
2409 
2410 		else if (sc->sc_msg[2] == MSG_EXT_WDTR_BUS_32_BIT)
2411 			/* Offer 16bit instead */
2412 			sc->sc_msg[2] = MSG_EXT_WDTR_BUS_16_BIT;
2413 
2414 		else {
2415 			iha_wide_done(sc);
2416 			if ((flags & FLAG_NO_NEG_SYNC) == 0)
2417 				iha_set_ssig(sc, REQ | BSY | SEL, ATN);
2418 			return (iha_wait(sc, MSG_ACCEPT));
2419 		}
2420 
2421 		iha_set_ssig(sc, REQ | BSY | SEL, ATN);
2422 
2423 		phase = iha_wait(sc, MSG_ACCEPT);
2424 		if (phase != PHASE_MSG_OUT)
2425 			return (phase);
2426 	} else
2427 		return (iha_msgout_reject(sc));
2428 
2429 	return (iha_msgout_extended(sc));
2430 }
2431 
2432 /*
2433  * iha_msgin_sdtr - check SDTR msg in sc_msg. If the offer is
2434  *		    acceptable leave sc_msg as is and return 0.
2435  *		    If the negotiation must continue, modify sc_msg
2436  *		    as needed and return 1. Else return 0.
2437  */
2438 static int
2439 iha_msgin_sdtr(sc)
2440 	struct iha_softc *sc;
2441 {
2442 	int flags;
2443 	int newoffer;
2444 	u_int8_t default_period;
2445 
2446 	flags = sc->sc_actscb->tcs->flags;
2447 
2448 	default_period = iha_rate_tbl[flags & FLAG_SCSI_RATE];
2449 
2450 	if (sc->sc_msg[3] == 0)
2451 		/* target offered async only. Accept it. */
2452 		return (0);
2453 
2454 	newoffer = 0;
2455 
2456 	if ((flags & FLAG_NO_SYNC) != 0) {
2457 		sc->sc_msg[3] = 0;
2458 		newoffer = 1;
2459 	}
2460 
2461 	if (sc->sc_msg[3] > IHA_MAX_OFFSET) {
2462 		sc->sc_msg[3] = IHA_MAX_OFFSET;
2463 		newoffer = 1;
2464 	}
2465 
2466 	if (sc->sc_msg[2] < default_period) {
2467 		sc->sc_msg[2] = default_period;
2468 		newoffer = 1;
2469 	}
2470 
2471 	if (sc->sc_msg[2] > IHA_MAX_PERIOD) {
2472 		/* Use async */
2473 		sc->sc_msg[3] = 0;
2474 		newoffer = 1;
2475 	}
2476 
2477 	return (newoffer);
2478 }
2479 
2480 static int
2481 iha_msgin_ignore_wid_resid(sc)
2482 	struct iha_softc *sc;
2483 {
2484 	bus_space_tag_t iot = sc->sc_iot;
2485 	bus_space_handle_t ioh = sc->sc_ioh;
2486 	int phase;
2487 
2488 	phase = iha_wait(sc, MSG_ACCEPT);
2489 
2490 	if (phase == PHASE_MSG_IN) {
2491 		phase = iha_wait(sc, XF_FIFO_IN);
2492 
2493 		if (phase != -1) {
2494 			bus_space_write_1(iot, ioh, TUL_SFIFO, 0);
2495 			bus_space_read_1(iot, ioh, TUL_SFIFO);
2496 			bus_space_read_1(iot, ioh, TUL_SFIFO);
2497 
2498 			phase = iha_wait(sc, MSG_ACCEPT);
2499 		}
2500 	}
2501 
2502 	return (phase);
2503 }
2504 
2505 static int
2506 iha_msgout(sc, msg)
2507 	struct iha_softc *sc;
2508 	u_int8_t msg;
2509 {
2510 
2511 	bus_space_write_1(sc->sc_iot, sc->sc_ioh, TUL_SFIFO, msg);
2512 
2513 	return (iha_wait(sc, XF_FIFO_OUT));
2514 }
2515 
2516 static void
2517 iha_msgout_abort(sc, aborttype)
2518 	struct iha_softc *sc;
2519 	u_int8_t aborttype;
2520 {
2521 
2522 	iha_set_ssig(sc, REQ | BSY | SEL, ATN);
2523 
2524 	switch (iha_wait(sc, MSG_ACCEPT)) {
2525 	case -1:
2526 		break;
2527 
2528 	case PHASE_MSG_OUT:
2529 		sc->sc_flags |= FLAG_EXPECT_DISC;
2530 		if (iha_msgout(sc, aborttype) != -1)
2531 			iha_bad_seq(sc);
2532 		break;
2533 
2534 	default:
2535 		iha_bad_seq(sc);
2536 		break;
2537 	}
2538 }
2539 
2540 static int
2541 iha_msgout_reject(sc)
2542 	struct iha_softc *sc;
2543 {
2544 
2545 	iha_set_ssig(sc, REQ | BSY | SEL, ATN);
2546 
2547 	if (iha_wait(sc, MSG_ACCEPT) == PHASE_MSG_OUT)
2548 		return (iha_msgout(sc, MSG_MESSAGE_REJECT));
2549 
2550 	return (-1);
2551 }
2552 
2553 static int
2554 iha_msgout_extended(sc)
2555 	struct iha_softc *sc;
2556 {
2557 	bus_space_tag_t iot = sc->sc_iot;
2558 	bus_space_handle_t ioh = sc->sc_ioh;
2559 	int phase;
2560 
2561 	bus_space_write_1(iot, ioh, TUL_SFIFO, MSG_EXTENDED);
2562 
2563 	bus_space_write_multi_1(iot, ioh, TUL_SFIFO,
2564 	    sc->sc_msg, sc->sc_msg[0] + 1);
2565 
2566 	phase = iha_wait(sc, XF_FIFO_OUT);
2567 
2568 	bus_space_write_1(iot, ioh, TUL_SCTRL0, RSFIFO);
2569 	iha_set_ssig(sc, REQ | BSY | SEL | ATN, 0);
2570 
2571 	return (phase);
2572 }
2573 
2574 static int
2575 iha_msgout_wdtr(sc)
2576 	struct iha_softc *sc;
2577 {
2578 
2579 	sc->sc_actscb->tcs->flags |= FLAG_WIDE_DONE;
2580 
2581 	sc->sc_msg[0] = MSG_EXT_WDTR_LEN;
2582 	sc->sc_msg[1] = MSG_EXT_WDTR;
2583 	sc->sc_msg[2] = MSG_EXT_WDTR_BUS_16_BIT;
2584 
2585 	return (iha_msgout_extended(sc));
2586 }
2587 
2588 static int
2589 iha_msgout_sdtr(sc)
2590 	struct iha_softc *sc;
2591 {
2592 	struct tcs *tcs = sc->sc_actscb->tcs;
2593 
2594 	tcs->flags |= FLAG_SYNC_DONE;
2595 
2596 	sc->sc_msg[0] = MSG_EXT_SDTR_LEN;
2597 	sc->sc_msg[1] = MSG_EXT_SDTR;
2598 	sc->sc_msg[2] = iha_rate_tbl[tcs->flags & FLAG_SCSI_RATE];
2599 	sc->sc_msg[3] = IHA_MAX_OFFSET; /* REQ/ACK */
2600 
2601 	return (iha_msgout_extended(sc));
2602 }
2603 
2604 static void
2605 iha_wide_done(sc)
2606 	struct iha_softc *sc;
2607 {
2608 	bus_space_tag_t iot = sc->sc_iot;
2609 	bus_space_handle_t ioh = sc->sc_ioh;
2610 	struct tcs *tcs = sc->sc_actscb->tcs;
2611 
2612 	tcs->syncm = 0;
2613 	tcs->period = 0;
2614 	tcs->offset = 0;
2615 
2616 	if (sc->sc_msg[2] != 0)
2617 		tcs->syncm |= PERIOD_WIDE_SCSI;
2618 
2619 	tcs->sconfig0 &= ~ALTPD;
2620 	tcs->flags &= ~FLAG_SYNC_DONE;
2621 	tcs->flags |=  FLAG_WIDE_DONE;
2622 
2623 	iha_update_xfer_mode(sc, sc->sc_actscb->target);
2624 
2625 	bus_space_write_1(iot, ioh, TUL_SCONFIG0, tcs->sconfig0);
2626 	bus_space_write_1(iot, ioh, TUL_SYNCM, tcs->syncm);
2627 }
2628 
2629 static void
2630 iha_sync_done(sc)
2631 	struct iha_softc *sc;
2632 {
2633 	bus_space_tag_t iot = sc->sc_iot;
2634 	bus_space_handle_t ioh = sc->sc_ioh;
2635 	struct tcs *tcs = sc->sc_actscb->tcs;
2636 	int i;
2637 
2638 	tcs->period = sc->sc_msg[2];
2639 	tcs->offset = sc->sc_msg[3];
2640 	if (tcs->offset != 0) {
2641 		tcs->syncm |= tcs->offset;
2642 
2643 		/* pick the highest possible rate */
2644 		for (i = 0; i < sizeof(iha_rate_tbl); i++)
2645 			if (iha_rate_tbl[i] >= tcs->period)
2646 				break;
2647 
2648 		tcs->syncm |= (i << 4);
2649 		tcs->sconfig0 |= ALTPD;
2650 	}
2651 
2652 	tcs->flags |= FLAG_SYNC_DONE;
2653 
2654 	iha_update_xfer_mode(sc, sc->sc_actscb->target);
2655 
2656 	bus_space_write_1(iot, ioh, TUL_SCONFIG0, tcs->sconfig0);
2657 	bus_space_write_1(iot, ioh, TUL_SYNCM, tcs->syncm);
2658 }
2659 
2660 /*
2661  * iha_bad_seq - a SCSI bus phase was encountered out of the
2662  *               correct/expected sequence. Reset the SCSI bus.
2663  */
2664 static void
2665 iha_bad_seq(sc)
2666 	struct iha_softc *sc;
2667 {
2668 	struct iha_scb *scb = sc->sc_actscb;
2669 
2670 	if (scb != NULL)
2671 		iha_append_done_scb(sc, scb, HOST_BAD_PHAS);
2672 
2673 	iha_reset_scsi_bus(sc);
2674 	iha_reset_chip(sc);
2675 }
2676 
2677 /*
2678  * iha_read_eeprom - read Serial EEPROM value & set to defaults
2679  *		     if required. XXX - Writing does NOT work!
2680  */
2681 static void
2682 iha_read_eeprom(sc, eeprom)
2683 	struct iha_softc *sc;
2684 	struct iha_eeprom *eeprom;
2685 {
2686 	bus_space_tag_t iot = sc->sc_iot;
2687 	bus_space_handle_t ioh = sc->sc_ioh;
2688 	u_int16_t *buf = (u_int16_t *)eeprom;
2689 	u_int8_t gctrl;
2690 
2691 	/* Enable EEProm programming */
2692 	gctrl = bus_space_read_1(iot, ioh, TUL_GCTRL0) | EEPRG;
2693 	bus_space_write_1(iot, ioh, TUL_GCTRL0, gctrl);
2694 
2695 	/* Read EEProm */
2696 	if (iha_se2_rd_all(sc, buf) == 0)
2697 		panic("%s: cannot read EEPROM", sc->sc_dev.dv_xname);
2698 
2699 	/* Disable EEProm programming */
2700 	gctrl = bus_space_read_1(iot, ioh, TUL_GCTRL0) & ~EEPRG;
2701 	bus_space_write_1(iot, ioh, TUL_GCTRL0, gctrl);
2702 }
2703 
2704 #ifdef notused
2705 /*
2706  * iha_se2_update_all - Update SCSI H/A configuration parameters from
2707  *			serial EEPROM Setup default pattern. Only
2708  *			change those values different from the values
2709  *			in iha_eeprom.
2710  */
2711 static void
2712 iha_se2_update_all(sc)
2713 	struct iha_softc *sc;
2714 {
2715 	bus_space_tag_t iot = sc->sc_iot;
2716 	bus_space_handle_t ioh = sc->sc_ioh;
2717 	u_int16_t *np;
2718 	u_int32_t chksum;
2719 	int i;
2720 
2721 	/* Enable erase/write state of EEPROM */
2722 	iha_se2_instr(sc, ENABLE_ERASE);
2723 	bus_space_write_1(iot, ioh, TUL_NVRAM, 0);
2724 	EEP_WAIT();
2725 
2726 	np = (u_int16_t *)&eeprom_default;
2727 
2728 	for (i = 0, chksum = 0; i < EEPROM_SIZE - 1; i++) {
2729 		iha_se2_wr(sc, i, *np);
2730 		chksum += *np++;
2731 	}
2732 
2733 	chksum &= 0x0000ffff;
2734 	iha_se2_wr(sc, 31, chksum);
2735 
2736 	/* Disable erase/write state of EEPROM */
2737 	iha_se2_instr(sc, 0);
2738 	bus_space_write_1(iot, ioh, TUL_NVRAM, 0);
2739 	EEP_WAIT();
2740 }
2741 
2742 /*
2743  * iha_se2_wr - write the given 16 bit value into the Serial EEPROM
2744  *		at the specified offset
2745  */
2746 static void
2747 iha_se2_wr(sc, addr, writeword)
2748 	struct iha_softc *sc;
2749 	int addr;
2750 	u_int16_t writeword;
2751 {
2752 	bus_space_tag_t iot = sc->sc_iot;
2753 	bus_space_handle_t ioh = sc->sc_ioh;
2754 	int i, bit;
2755 
2756 	/* send 'WRITE' Instruction == address | WRITE bit */
2757 	iha_se2_instr(sc, addr | WRITE);
2758 
2759 	for (i = 16; i > 0; i--) {
2760 		if (writeword & (1 << (i - 1)))
2761 			bus_space_write_1(iot, ioh, TUL_NVRAM, NVRCS | NVRDO);
2762 		else
2763 			bus_space_write_1(iot, ioh, TUL_NVRAM, NVRCS);
2764 		EEP_WAIT();
2765 		bus_space_write_1(iot, ioh, TUL_NVRAM, NVRCS | NVRCK);
2766 		EEP_WAIT();
2767 	}
2768 
2769 	bus_space_write_1(iot, ioh, TUL_NVRAM, NVRCS);
2770 	EEP_WAIT();
2771 	bus_space_write_1(iot, ioh, TUL_NVRAM, 0);
2772 	EEP_WAIT();
2773 	bus_space_write_1(iot, ioh, TUL_NVRAM, NVRCS);
2774 	EEP_WAIT();
2775 
2776 	for (;;) {
2777 		bus_space_write_1(iot, ioh, TUL_NVRAM, NVRCS | NVRCK);
2778 		EEP_WAIT();
2779 		bus_space_write_1(iot, ioh, TUL_NVRAM, NVRCS);
2780 		EEP_WAIT();
2781 		bit = bus_space_read_1(iot, ioh, TUL_NVRAM) & NVRDI;
2782 		EEP_WAIT();
2783 		if (bit != 0)
2784 			break; /* write complete */
2785 	}
2786 
2787 	bus_space_write_1(iot, ioh, TUL_NVRAM, 0);
2788 }
2789 #endif
2790 
2791 /*
2792  * iha_se2_rd - read & return the 16 bit value at the specified
2793  *		offset in the Serial E2PROM
2794  *
2795  */
2796 static u_int16_t
2797 iha_se2_rd(sc, addr)
2798 	struct iha_softc *sc;
2799 	int addr;
2800 {
2801 	bus_space_tag_t iot = sc->sc_iot;
2802 	bus_space_handle_t ioh = sc->sc_ioh;
2803 	int i, bit;
2804 	u_int16_t readword;
2805 
2806 	/* Send 'READ' instruction == address | READ bit */
2807 	iha_se2_instr(sc, addr | READ);
2808 
2809 	readword = 0;
2810 	for (i = 16; i > 0; i--) {
2811 		bus_space_write_1(iot, ioh, TUL_NVRAM, NVRCS | NVRCK);
2812 		EEP_WAIT();
2813 		bus_space_write_1(iot, ioh, TUL_NVRAM, NVRCS);
2814 		EEP_WAIT();
2815 		/* sample data after the following edge of clock     */
2816 		bit = bus_space_read_1(iot, ioh, TUL_NVRAM) & NVRDI ? 1 : 0;
2817 		EEP_WAIT();
2818 
2819 		readword |= bit << (i - 1);
2820 	}
2821 
2822 	bus_space_write_1(iot, ioh, TUL_NVRAM, 0);
2823 
2824 	return (readword);
2825 }
2826 
2827 /*
2828  * iha_se2_rd_all - Read SCSI H/A config parameters from serial EEPROM
2829  */
2830 static int
2831 iha_se2_rd_all(sc, buf)
2832 	struct iha_softc *sc;
2833 	u_int16_t *buf;
2834 {
2835 	struct iha_eeprom *eeprom = (struct iha_eeprom *)buf;
2836 	u_int32_t chksum;
2837 	int i;
2838 
2839 	for (i = 0, chksum = 0; i < EEPROM_SIZE - 1; i++) {
2840 		*buf = iha_se2_rd(sc, i);
2841 		chksum += *buf++;
2842 	}
2843 	*buf = iha_se2_rd(sc, 31); /* read checksum from EEPROM */
2844 
2845 	chksum &= 0x0000ffff; /* lower 16 bits */
2846 
2847 	return (eeprom->signature == EEP_SIGNATURE) &&
2848 	    (eeprom->checksum == chksum);
2849 }
2850 
2851 /*
2852  * iha_se2_instr - write an octet to serial E2PROM one bit at a time
2853  */
2854 static void
2855 iha_se2_instr(sc, instr)
2856 	struct iha_softc *sc;
2857 	int instr;
2858 {
2859 	bus_space_tag_t iot = sc->sc_iot;
2860 	bus_space_handle_t ioh = sc->sc_ioh;
2861 	int b, i;
2862 
2863 	b = NVRCS | NVRDO; /* Write the start bit (== 1) */
2864 
2865 	bus_space_write_1(iot, ioh, TUL_NVRAM, b);
2866 	EEP_WAIT();
2867 	bus_space_write_1(iot, ioh, TUL_NVRAM, b | NVRCK);
2868 	EEP_WAIT();
2869 
2870 	for (i = 8; i > 0; i--) {
2871 		if (instr & (1 << (i - 1)))
2872 			b = NVRCS | NVRDO; /* Write a 1 bit */
2873 		else
2874 			b = NVRCS;	   /* Write a 0 bit */
2875 
2876 		bus_space_write_1(iot, ioh, TUL_NVRAM, b);
2877 		EEP_WAIT();
2878 		bus_space_write_1(iot, ioh, TUL_NVRAM, b | NVRCK);
2879 		EEP_WAIT();
2880 	}
2881 
2882 	bus_space_write_1(iot, ioh, TUL_NVRAM, NVRCS);
2883 }
2884