xref: /netbsd-src/sys/dev/ic/ncr53c9x.c (revision fdecd6a253f999ae92b139670d9e15cc9df4497c)
1 /*	$NetBSD: ncr53c9x.c,v 1.11 1997/06/26 00:27:25 thorpej Exp $	*/
2 
3 /*
4  * Copyright (c) 1996 Charles M. Hannum.  All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  * 3. All advertising materials mentioning features or use of this software
15  *    must display the following acknowledgement:
16  *	This product includes software developed by Charles M. Hannum.
17  * 4. The name of the author may not be used to endorse or promote products
18  *    derived from this software without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
21  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
22  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
23  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
24  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
25  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
26  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
27  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
29  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30  */
31 
32 /*
33  * Copyright (c) 1994 Peter Galbavy
34  * Copyright (c) 1995 Paul Kranenburg
35  * All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 3. All advertising materials mentioning features or use of this software
46  *    must display the following acknowledgement:
47  *	This product includes software developed by Peter Galbavy
48  * 4. The name of the author may not be used to endorse or promote products
49  *    derived from this software without specific prior written permission.
50  *
51  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
52  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
53  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
54  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
55  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
56  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
57  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
58  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
59  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
60  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
61  * POSSIBILITY OF SUCH DAMAGE.
62  */
63 
64 /*
65  * Based on aic6360 by Jarle Greipsland
66  *
67  * Acknowledgements: Many of the algorithms used in this driver are
68  * inspired by the work of Julian Elischer (julian@tfs.com) and
69  * Charles Hannum (mycroft@duality.gnu.ai.mit.edu).  Thanks a million!
70  */
71 
72 #include <sys/types.h>
73 #include <sys/param.h>
74 #include <sys/systm.h>
75 #include <sys/kernel.h>
76 #include <sys/errno.h>
77 #include <sys/ioctl.h>
78 #include <sys/device.h>
79 #include <sys/buf.h>
80 #include <sys/proc.h>
81 #include <sys/user.h>
82 #include <sys/queue.h>
83 
84 #include <scsi/scsi_all.h>
85 #include <scsi/scsiconf.h>
86 #include <scsi/scsi_message.h>
87 
88 #include <machine/cpu.h>
89 
90 #include <dev/ic/ncr53c9xreg.h>
91 #include <dev/ic/ncr53c9xvar.h>
92 
93 int ncr53c9x_debug = 0; /*NCR_SHOWPHASE|NCR_SHOWMISC|NCR_SHOWTRAC|NCR_SHOWCMDS;*/
94 
95 /*static*/ void	ncr53c9x_readregs	__P((struct ncr53c9x_softc *));
96 /*static*/ void	ncr53c9x_select		__P((struct ncr53c9x_softc *,
97 					    struct ncr53c9x_ecb *));
98 /*static*/ int ncr53c9x_reselect	__P((struct ncr53c9x_softc *, int));
99 /*static*/ void	ncr53c9x_scsi_reset	__P((struct ncr53c9x_softc *));
100 /*static*/ void	ncr53c9x_init		__P((struct ncr53c9x_softc *, int));
101 /*static*/ int	ncr53c9x_poll		__P((struct ncr53c9x_softc *,
102 					    struct scsi_xfer *, int));
103 /*static*/ void	ncr53c9x_sched		__P((struct ncr53c9x_softc *));
104 /*static*/ void	ncr53c9x_done		__P((struct ncr53c9x_softc *,
105 					    struct ncr53c9x_ecb *));
106 /*static*/ void	ncr53c9x_msgin		__P((struct ncr53c9x_softc *));
107 /*static*/ void	ncr53c9x_msgout		__P((struct ncr53c9x_softc *));
108 /*static*/ void	ncr53c9x_timeout	__P((void *arg));
109 /*static*/ void	ncr53c9x_abort		__P((struct ncr53c9x_softc *,
110 					    struct ncr53c9x_ecb *));
111 /*static*/ void ncr53c9x_dequeue	__P((struct ncr53c9x_softc *,
112 					    struct ncr53c9x_ecb *));
113 
114 void ncr53c9x_sense			__P((struct ncr53c9x_softc *,
115 					    struct ncr53c9x_ecb *));
116 void ncr53c9x_free_ecb			__P((struct ncr53c9x_softc *,
117 					    struct ncr53c9x_ecb *, int));
118 struct ncr53c9x_ecb *ncr53c9x_get_ecb	__P((struct ncr53c9x_softc *, int));
119 
120 static inline int ncr53c9x_stp2cpb	__P((struct ncr53c9x_softc *, int));
121 static inline void ncr53c9x_setsync	__P((struct ncr53c9x_softc *,
122 					    struct ncr53c9x_tinfo *));
123 
124 /*
125  * Names for the NCR53c9x variants, correspnding to the variant tags
126  * in ncr53c9xvar.h.
127  */
128 const char *ncr53c9x_variant_names[] = {
129 	"ESP100",
130 	"ESP100A",
131 	"ESP200",
132 	"NCR53C94",
133 	"NCR53C96",
134 	"ESP406",
135 	"FAS408",
136 };
137 
138 /*
139  * Attach this instance, and then all the sub-devices
140  */
141 void
142 ncr53c9x_attach(sc, adapter, dev)
143 	struct ncr53c9x_softc *sc;
144 	struct scsi_adapter *adapter;
145 	struct scsi_device *dev;
146 {
147 
148 	/*
149 	 * Note, the front-end has set us up to print the chip variation.
150 	 */
151 
152 	if (sc->sc_rev >= NCR_VARIANT_MAX) {
153 		printf("\n%s: unknown variant %d, devices not attached\n",
154 		    sc->sc_dev.dv_xname, sc->sc_rev);
155 		return;
156 	}
157 
158 	printf(": %s, %dMHz, SCSI ID %d\n",
159 	    ncr53c9x_variant_names[sc->sc_rev], sc->sc_freq, sc->sc_id);
160 
161 	sc->sc_ccf = FREQTOCCF(sc->sc_freq);
162 
163 	/* The value *must not* be == 1. Make it 2 */
164 	if (sc->sc_ccf == 1)
165 		sc->sc_ccf = 2;
166 
167 	/*
168 	 * The recommended timeout is 250ms. This register is loaded
169 	 * with a value calculated as follows, from the docs:
170 	 *
171 	 *		(timout period) x (CLK frequency)
172 	 *	reg = -------------------------------------
173 	 *		 8192 x (Clock Conversion Factor)
174 	 *
175 	 * Since CCF has a linear relation to CLK, this generally computes
176 	 * to the constant of 153.
177 	 */
178 	sc->sc_timeout = ((250 * 1000) * sc->sc_freq) / (8192 * sc->sc_ccf);
179 
180 	/* CCF register only has 3 bits; 0 is actually 8 */
181 	sc->sc_ccf &= 7;
182 
183 	/* Reset state & bus */
184 	sc->sc_state = 0;
185 	ncr53c9x_init(sc, 1);
186 
187 	/*
188 	 * fill in the prototype scsi_link.
189 	 */
190 	sc->sc_link.channel = SCSI_CHANNEL_ONLY_ONE;
191 	sc->sc_link.adapter_softc = sc;
192 	sc->sc_link.adapter_target = sc->sc_id;
193 	sc->sc_link.adapter = adapter;
194 	sc->sc_link.device = dev;
195 	sc->sc_link.openings = 2;
196 	sc->sc_link.max_target = 7;
197 
198 	/*
199 	 * Now try to attach all the sub-devices
200 	 */
201 	config_found(&sc->sc_dev, &sc->sc_link, scsiprint);
202 
203 	/*
204 	 * Enable interupts from the SCSI core
205 	 */
206 	if ((sc->sc_rev == NCR_VARIANT_ESP406) ||
207 	    (sc->sc_rev == NCR_VARIANT_FAS408)) {
208 		NCR_PIOREGS(sc);
209 		NCR_WRITE_REG(sc, NCR_CFG5, NCRCFG5_SINT |
210 		    NCR_READ_REG(sc, NCR_CFG5));
211 		NCR_SCSIREGS(sc);
212 	}
213 }
214 
215 /*
216  * This is the generic esp reset function. It does not reset the SCSI bus,
217  * only this controllers, but kills any on-going commands, and also stops
218  * and resets the DMA.
219  *
220  * After reset, registers are loaded with the defaults from the attach
221  * routine above.
222  */
223 void
224 ncr53c9x_reset(sc)
225 	struct ncr53c9x_softc *sc;
226 {
227 
228 	/* reset DMA first */
229 	NCRDMA_RESET(sc);
230 
231 	/* reset SCSI chip */
232 	NCRCMD(sc, NCRCMD_RSTCHIP);
233 	NCRCMD(sc, NCRCMD_NOP);
234 	DELAY(500);
235 
236 	/* do these backwards, and fall through */
237 	switch (sc->sc_rev) {
238 	case NCR_VARIANT_ESP406:
239 	case NCR_VARIANT_FAS408:
240 		NCR_SCSIREGS(sc);
241 	case NCR_VARIANT_NCR53C94:
242 	case NCR_VARIANT_NCR53C96:
243 	case NCR_VARIANT_ESP200:
244 		NCR_WRITE_REG(sc, NCR_CFG3, sc->sc_cfg3);
245 	case NCR_VARIANT_ESP100A:
246 		NCR_WRITE_REG(sc, NCR_CFG2, sc->sc_cfg2);
247 	case NCR_VARIANT_ESP100:
248 		NCR_WRITE_REG(sc, NCR_CFG1, sc->sc_cfg1);
249 		NCR_WRITE_REG(sc, NCR_CCF, sc->sc_ccf);
250 		NCR_WRITE_REG(sc, NCR_SYNCOFF, 0);
251 		NCR_WRITE_REG(sc, NCR_TIMEOUT, sc->sc_timeout);
252 		break;
253 	default:
254 		printf("%s: unknown revision code, assuming ESP100\n",
255 		    sc->sc_dev.dv_xname);
256 		NCR_WRITE_REG(sc, NCR_CFG1, sc->sc_cfg1);
257 		NCR_WRITE_REG(sc, NCR_CCF, sc->sc_ccf);
258 		NCR_WRITE_REG(sc, NCR_SYNCOFF, 0);
259 		NCR_WRITE_REG(sc, NCR_TIMEOUT, sc->sc_timeout);
260 	}
261 }
262 
263 /*
264  * Reset the SCSI bus, but not the chip
265  */
266 void
267 ncr53c9x_scsi_reset(sc)
268 	struct ncr53c9x_softc *sc;
269 {
270 
271 	(*sc->sc_glue->gl_dma_stop)(sc);
272 
273 	printf("%s: resetting SCSI bus\n", sc->sc_dev.dv_xname);
274 	NCRCMD(sc, NCRCMD_RSTSCSI);
275 }
276 
277 /*
278  * Initialize esp state machine
279  */
280 void
281 ncr53c9x_init(sc, doreset)
282 	struct ncr53c9x_softc *sc;
283 	int doreset;
284 {
285 	struct ncr53c9x_ecb *ecb;
286 	int r;
287 
288 	NCR_TRACE(("[NCR_INIT(%d)] ", doreset));
289 
290 	if (sc->sc_state == 0) {
291 		/* First time through; initialize. */
292 		TAILQ_INIT(&sc->ready_list);
293 		TAILQ_INIT(&sc->nexus_list);
294 		TAILQ_INIT(&sc->free_list);
295 		sc->sc_nexus = NULL;
296 		ecb = sc->sc_ecb;
297 		bzero(ecb, sizeof(sc->sc_ecb));
298 		for (r = 0; r < sizeof(sc->sc_ecb) / sizeof(*ecb); r++) {
299 			TAILQ_INSERT_TAIL(&sc->free_list, ecb, chain);
300 			ecb++;
301 		}
302 		bzero(sc->sc_tinfo, sizeof(sc->sc_tinfo));
303 	} else {
304 		/* Cancel any active commands. */
305 		sc->sc_state = NCR_CLEANING;
306 		if ((ecb = sc->sc_nexus) != NULL) {
307 			ecb->xs->error = XS_DRIVER_STUFFUP;
308 			ncr53c9x_done(sc, ecb);
309 		}
310 		while ((ecb = sc->nexus_list.tqh_first) != NULL) {
311 			ecb->xs->error = XS_DRIVER_STUFFUP;
312 			ncr53c9x_done(sc, ecb);
313 		}
314 	}
315 
316 	/*
317 	 * reset the chip to a known state
318 	 */
319 	ncr53c9x_reset(sc);
320 
321 	sc->sc_phase = sc->sc_prevphase = INVALID_PHASE;
322 	for (r = 0; r < 8; r++) {
323 		struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[r];
324 /* XXX - config flags per target: low bits: no reselect; high bits: no synch */
325 		int fl = sc->sc_dev.dv_cfdata->cf_flags;
326 
327 		ti->flags = ((sc->sc_minsync && !(fl & (1<<(r+8))))
328 				? T_NEGOTIATE : 0) |
329 				((fl & (1<<r)) ? T_RSELECTOFF : 0) |
330 				T_NEED_TO_RESET;
331 		ti->period = sc->sc_minsync;
332 		ti->offset = 0;
333 	}
334 
335 	if (doreset) {
336 		sc->sc_state = NCR_SBR;
337 		NCRCMD(sc, NCRCMD_RSTSCSI);
338 	} else {
339 		sc->sc_state = NCR_IDLE;
340 	}
341 }
342 
343 /*
344  * Read the NCR registers, and save their contents for later use.
345  * NCR_STAT, NCR_STEP & NCR_INTR are mostly zeroed out when reading
346  * NCR_INTR - so make sure it is the last read.
347  *
348  * I think that (from reading the docs) most bits in these registers
349  * only make sense when he DMA CSR has an interrupt showing. Call only
350  * if an interrupt is pending.
351  */
352 void
353 ncr53c9x_readregs(sc)
354 	struct ncr53c9x_softc *sc;
355 {
356 
357 	sc->sc_espstat = NCR_READ_REG(sc, NCR_STAT);
358 	/* Only the stepo bits are of interest */
359 	sc->sc_espstep = NCR_READ_REG(sc, NCR_STEP) & NCRSTEP_MASK;
360 	sc->sc_espintr = NCR_READ_REG(sc, NCR_INTR);
361 
362 	if (sc->sc_glue->gl_clear_latched_intr != NULL)
363 		(*sc->sc_glue->gl_clear_latched_intr)(sc);
364 
365 	/*
366 	 * Determine the SCSI bus phase, return either a real SCSI bus phase
367 	 * or some pseudo phase we use to detect certain exceptions.
368 	 */
369 
370 	sc->sc_phase = (sc->sc_espintr & NCRINTR_DIS)
371 			? /* Disconnected */ BUSFREE_PHASE
372 			: sc->sc_espstat & NCRSTAT_PHASE;
373 
374 	NCR_MISC(("regs[intr=%02x,stat=%02x,step=%02x] ",
375 		sc->sc_espintr, sc->sc_espstat, sc->sc_espstep));
376 }
377 
378 /*
379  * Convert Synchronous Transfer Period to chip register Clock Per Byte value.
380  */
381 static inline int
382 ncr53c9x_stp2cpb(sc, period)
383 	struct ncr53c9x_softc *sc;
384 	int period;
385 {
386 	int v;
387 	v = (sc->sc_freq * period) / 250;
388 	if (ncr53c9x_cpb2stp(sc, v) < period)
389 		/* Correct round-down error */
390 		v++;
391 	return v;
392 }
393 
394 static inline void
395 ncr53c9x_setsync(sc, ti)
396 	struct ncr53c9x_softc *sc;
397 	struct ncr53c9x_tinfo *ti;
398 {
399 
400 	if (ti->flags & T_SYNCMODE) {
401 		NCR_WRITE_REG(sc, NCR_SYNCOFF, ti->offset);
402 		NCR_WRITE_REG(sc, NCR_SYNCTP,
403 		    ncr53c9x_stp2cpb(sc, ti->period));
404 	} else {
405 		NCR_WRITE_REG(sc, NCR_SYNCOFF, 0);
406 		NCR_WRITE_REG(sc, NCR_SYNCTP, 0);
407 	}
408 }
409 
410 int ncr53c9x_dmaselect = 0;
411 /*
412  * Send a command to a target, set the driver state to NCR_SELECTING
413  * and let the caller take care of the rest.
414  *
415  * Keeping this as a function allows me to say that this may be done
416  * by DMA instead of programmed I/O soon.
417  */
418 void
419 ncr53c9x_select(sc, ecb)
420 	struct ncr53c9x_softc *sc;
421 	struct ncr53c9x_ecb *ecb;
422 {
423 	struct scsi_link *sc_link = ecb->xs->sc_link;
424 	int target = sc_link->target;
425 	struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[target];
426 	u_char *cmd;
427 	int clen;
428 
429 	NCR_TRACE(("[ncr53c9x_select(t%d,l%d,cmd:%x)] ",
430 	    sc_link->target, sc_link->lun, ecb->cmd.cmd.opcode));
431 
432 	/* new state NCR_SELECTING */
433 	sc->sc_state = NCR_SELECTING;
434 
435 	/*
436 	 * Schedule the timeout now, the first time we will go away
437 	 * expecting to come back due to an interrupt, because it is
438 	 * always possible that the interrupt may never happen.
439 	 */
440 	if ((ecb->xs->flags & SCSI_POLL) == 0)
441 		timeout(ncr53c9x_timeout, ecb,
442 		    (ecb->timeout * hz) / 1000);
443 
444 	NCRCMD(sc, NCRCMD_FLUSH);
445 
446 	/*
447 	 * The docs say the target register is never reset, and I
448 	 * can't think of a better place to set it
449 	 */
450 	NCR_WRITE_REG(sc, NCR_SELID, target);
451 	ncr53c9x_setsync(sc, ti);
452 
453 	if (ncr53c9x_dmaselect && (ti->flags & T_NEGOTIATE) == 0) {
454 		size_t dmacl;
455 		ecb->cmd.id =
456 		    MSG_IDENTIFY(sc_link->lun, (ti->flags & T_RSELECTOFF)?0:1);
457 
458 		/* setup DMA transfer for command */
459 		clen = ecb->clen + 1;
460 		sc->sc_cmdlen = clen;
461 		sc->sc_cmdp = (caddr_t)&ecb->cmd;
462 		dmacl = clen;
463 		NCRDMA_SETUP(sc, &sc->sc_cmdp, &sc->sc_cmdlen, 0, &dmacl);
464 		/* Program the SCSI counter */
465 		NCR_WRITE_REG(sc, NCR_TCL, clen);
466 		NCR_WRITE_REG(sc, NCR_TCM, clen >> 8);
467 		if (sc->sc_cfg2 & NCRCFG2_FE) {
468 			NCR_WRITE_REG(sc, NCR_TCH, clen >> 16);
469 		}
470 
471 		/* And get the targets attention */
472 		NCRCMD(sc, NCRCMD_SELATN | NCRCMD_DMA);
473 		NCRDMA_GO(sc);
474 		return;
475 	}
476 	/*
477 	 * Who am I. This is where we tell the target that we are
478 	 * happy for it to disconnect etc.
479 	 */
480 	NCR_WRITE_REG(sc, NCR_FIFO,
481 		MSG_IDENTIFY(sc_link->lun, (ti->flags & T_RSELECTOFF)?0:1));
482 
483 	if (ti->flags & T_NEGOTIATE) {
484 		/* Arbitrate, select and stop after IDENTIFY message */
485 		NCRCMD(sc, NCRCMD_SELATNS);
486 		return;
487 	}
488 
489 	/* Now the command into the FIFO */
490 	cmd = (u_char *)&ecb->cmd.cmd;
491 	clen = ecb->clen;
492 	while (clen--)
493 		NCR_WRITE_REG(sc, NCR_FIFO, *cmd++);
494 
495 	/* And get the targets attention */
496 	NCRCMD(sc, NCRCMD_SELATN);
497 }
498 
499 void
500 ncr53c9x_free_ecb(sc, ecb, flags)
501 	struct ncr53c9x_softc *sc;
502 	struct ncr53c9x_ecb *ecb;
503 	int flags;
504 {
505 	int s;
506 
507 	s = splbio();
508 
509 	ecb->flags = 0;
510 	TAILQ_INSERT_HEAD(&sc->free_list, ecb, chain);
511 
512 	/*
513 	 * If there were none, wake anybody waiting for one to come free,
514 	 * starting with queued entries.
515 	 */
516 	if (ecb->chain.tqe_next == 0)
517 		wakeup(&sc->free_list);
518 
519 	splx(s);
520 }
521 
522 struct ncr53c9x_ecb *
523 ncr53c9x_get_ecb(sc, flags)
524 	struct ncr53c9x_softc *sc;
525 	int flags;
526 {
527 	struct ncr53c9x_ecb *ecb;
528 	int s;
529 
530 	s = splbio();
531 
532 	while ((ecb = sc->free_list.tqh_first) == NULL &&
533 	       (flags & SCSI_NOSLEEP) == 0)
534 		tsleep(&sc->free_list, PRIBIO, "especb", 0);
535 	if (ecb) {
536 		TAILQ_REMOVE(&sc->free_list, ecb, chain);
537 		ecb->flags |= ECB_ALLOC;
538 	}
539 
540 	splx(s);
541 	return ecb;
542 }
543 
544 /*
545  * DRIVER FUNCTIONS CALLABLE FROM HIGHER LEVEL DRIVERS
546  */
547 
548 /*
549  * Start a SCSI-command
550  * This function is called by the higher level SCSI-driver to queue/run
551  * SCSI-commands.
552  */
553 int
554 ncr53c9x_scsi_cmd(xs)
555 	struct scsi_xfer *xs;
556 {
557 	struct scsi_link *sc_link = xs->sc_link;
558 	struct ncr53c9x_softc *sc = sc_link->adapter_softc;
559 	struct ncr53c9x_ecb *ecb;
560 	int s, flags;
561 
562 	NCR_TRACE(("[ncr53c9x_scsi_cmd] "));
563 	NCR_CMDS(("[0x%x, %d]->%d ", (int)xs->cmd->opcode, xs->cmdlen,
564 	    sc_link->target));
565 
566 	flags = xs->flags;
567 	if ((ecb = ncr53c9x_get_ecb(sc, flags)) == NULL) {
568 		xs->error = XS_DRIVER_STUFFUP;
569 		return TRY_AGAIN_LATER;
570 	}
571 
572 	/* Initialize ecb */
573 	ecb->xs = xs;
574 	ecb->timeout = xs->timeout;
575 
576 	if (flags & SCSI_RESET) {
577 		ecb->flags |= ECB_RESET;
578 		ecb->clen = 0;
579 		ecb->dleft = 0;
580 	} else {
581 		bcopy(xs->cmd, &ecb->cmd.cmd, xs->cmdlen);
582 		ecb->clen = xs->cmdlen;
583 		ecb->daddr = xs->data;
584 		ecb->dleft = xs->datalen;
585 	}
586 	ecb->stat = 0;
587 
588 	s = splbio();
589 
590 	TAILQ_INSERT_TAIL(&sc->ready_list, ecb, chain);
591 	if (sc->sc_state == NCR_IDLE)
592 		ncr53c9x_sched(sc);
593 
594 	splx(s);
595 
596 	if ((flags & SCSI_POLL) == 0)
597 		return SUCCESSFULLY_QUEUED;
598 
599 	/* Not allowed to use interrupts, use polling instead */
600 	if (ncr53c9x_poll(sc, xs, ecb->timeout)) {
601 		ncr53c9x_timeout(ecb);
602 		if (ncr53c9x_poll(sc, xs, ecb->timeout))
603 			ncr53c9x_timeout(ecb);
604 	}
605 	return COMPLETE;
606 }
607 
608 /*
609  * Used when interrupt driven I/O isn't allowed, e.g. during boot.
610  */
611 int
612 ncr53c9x_poll(sc, xs, count)
613 	struct ncr53c9x_softc *sc;
614 	struct scsi_xfer *xs;
615 	int count;
616 {
617 
618 	NCR_TRACE(("[ncr53c9x_poll] "));
619 	while (count) {
620 		if (NCRDMA_ISINTR(sc)) {
621 			ncr53c9x_intr(sc);
622 		}
623 #if alternatively
624 		if (NCR_READ_REG(sc, NCR_STAT) & NCRSTAT_INT)
625 			ncr53c9x_intr(sc);
626 #endif
627 		if ((xs->flags & ITSDONE) != 0)
628 			return 0;
629 		if (sc->sc_state == NCR_IDLE) {
630 			NCR_TRACE(("[ncr53c9x_poll: rescheduling] "));
631 			ncr53c9x_sched(sc);
632 		}
633 		DELAY(1000);
634 		count--;
635 	}
636 	return 1;
637 }
638 
639 
640 /*
641  * LOW LEVEL SCSI UTILITIES
642  */
643 
644 /*
645  * Schedule a scsi operation.  This has now been pulled out of the interrupt
646  * handler so that we may call it from ncr53c9x_scsi_cmd and ncr53c9x_done.
647  * This may save us an unecessary interrupt just to get things going.
648  * Should only be called when state == NCR_IDLE and at bio pl.
649  */
650 void
651 ncr53c9x_sched(sc)
652 	struct ncr53c9x_softc *sc;
653 {
654 	struct ncr53c9x_ecb *ecb;
655 	struct scsi_link *sc_link;
656 	struct ncr53c9x_tinfo *ti;
657 
658 	NCR_TRACE(("[ncr53c9x_sched] "));
659 	if (sc->sc_state != NCR_IDLE)
660 		panic("ncr53c9x_sched: not IDLE (state=%d)", sc->sc_state);
661 
662 	/*
663 	 * Find first ecb in ready queue that is for a target/lunit
664 	 * combinations that is not busy.
665 	 */
666 	for (ecb = sc->ready_list.tqh_first; ecb; ecb = ecb->chain.tqe_next) {
667 		sc_link = ecb->xs->sc_link;
668 		ti = &sc->sc_tinfo[sc_link->target];
669 		if ((ti->lubusy & (1 << sc_link->lun)) == 0) {
670 			TAILQ_REMOVE(&sc->ready_list, ecb, chain);
671 			sc->sc_nexus = ecb;
672 			ncr53c9x_select(sc, ecb);
673 			break;
674 		} else
675 			NCR_MISC(("%d:%d busy\n",
676 			    sc_link->target, sc_link->lun));
677 	}
678 }
679 
680 void
681 ncr53c9x_sense(sc, ecb)
682 	struct ncr53c9x_softc *sc;
683 	struct ncr53c9x_ecb *ecb;
684 {
685 	struct scsi_xfer *xs = ecb->xs;
686 	struct scsi_link *sc_link = xs->sc_link;
687 	struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[sc_link->target];
688 	struct scsi_sense *ss = (void *)&ecb->cmd.cmd;
689 
690 	NCR_MISC(("requesting sense "));
691 	/* Next, setup a request sense command block */
692 	bzero(ss, sizeof(*ss));
693 	ss->opcode = REQUEST_SENSE;
694 	ss->byte2 = sc_link->lun << 5;
695 	ss->length = sizeof(struct scsi_sense_data);
696 	ecb->clen = sizeof(*ss);
697 	ecb->daddr = (char *)&xs->sense;
698 	ecb->dleft = sizeof(struct scsi_sense_data);
699 	ecb->flags |= ECB_SENSE;
700 	ecb->timeout = NCR_SENSE_TIMEOUT;
701 	ti->senses++;
702 	if (ecb->flags & ECB_NEXUS)
703 		ti->lubusy &= ~(1 << sc_link->lun);
704 	if (ecb == sc->sc_nexus) {
705 		ncr53c9x_select(sc, ecb);
706 	} else {
707 		ncr53c9x_dequeue(sc, ecb);
708 		TAILQ_INSERT_HEAD(&sc->ready_list, ecb, chain);
709 		if (sc->sc_state == NCR_IDLE)
710 			ncr53c9x_sched(sc);
711 	}
712 }
713 
714 /*
715  * POST PROCESSING OF SCSI_CMD (usually current)
716  */
717 void
718 ncr53c9x_done(sc, ecb)
719 	struct ncr53c9x_softc *sc;
720 	struct ncr53c9x_ecb *ecb;
721 {
722 	struct scsi_xfer *xs = ecb->xs;
723 	struct scsi_link *sc_link = xs->sc_link;
724 	struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[sc_link->target];
725 
726 	NCR_TRACE(("[ncr53c9x_done(error:%x)] ", xs->error));
727 
728 	untimeout(ncr53c9x_timeout, ecb);
729 
730 	/*
731 	 * Now, if we've come here with no error code, i.e. we've kept the
732 	 * initial XS_NOERROR, and the status code signals that we should
733 	 * check sense, we'll need to set up a request sense cmd block and
734 	 * push the command back into the ready queue *before* any other
735 	 * commands for this target/lunit, else we lose the sense info.
736 	 * We don't support chk sense conditions for the request sense cmd.
737 	 */
738 	if (xs->error == XS_NOERROR) {
739 		if ((ecb->flags & ECB_ABORT) != 0) {
740 			xs->error = XS_DRIVER_STUFFUP;
741 		} else if ((ecb->flags & ECB_SENSE) != 0) {
742 			xs->error = XS_SENSE;
743 		} else if ((ecb->stat & ST_MASK) == SCSI_CHECK) {
744 			/* First, save the return values */
745 			xs->resid = ecb->dleft;
746 			xs->status = ecb->stat;
747 			ncr53c9x_sense(sc, ecb);
748 			return;
749 		} else {
750 			xs->resid = ecb->dleft;
751 		}
752 	}
753 
754 	xs->flags |= ITSDONE;
755 
756 #ifdef NCR53C9X_DEBUG
757 	if (ncr53c9x_debug & NCR_SHOWMISC) {
758 		if (xs->resid != 0)
759 			printf("resid=%d ", xs->resid);
760 		if (xs->error == XS_SENSE)
761 			printf("sense=0x%02x\n", xs->sense.error_code);
762 		else
763 			printf("error=%d\n", xs->error);
764 	}
765 #endif
766 
767 	/*
768 	 * Remove the ECB from whatever queue it's on.
769 	 */
770 	if (ecb->flags & ECB_NEXUS)
771 		ti->lubusy &= ~(1 << sc_link->lun);
772 	if (ecb == sc->sc_nexus) {
773 		sc->sc_nexus = NULL;
774 		sc->sc_state = NCR_IDLE;
775 		ncr53c9x_sched(sc);
776 	} else
777 		ncr53c9x_dequeue(sc, ecb);
778 
779 	ncr53c9x_free_ecb(sc, ecb, xs->flags);
780 	ti->cmds++;
781 	scsi_done(xs);
782 }
783 
784 void
785 ncr53c9x_dequeue(sc, ecb)
786 	struct ncr53c9x_softc *sc;
787 	struct ncr53c9x_ecb *ecb;
788 {
789 
790 	if (ecb->flags & ECB_NEXUS) {
791 		TAILQ_REMOVE(&sc->nexus_list, ecb, chain);
792 	} else {
793 		TAILQ_REMOVE(&sc->ready_list, ecb, chain);
794 	}
795 }
796 
797 /*
798  * INTERRUPT/PROTOCOL ENGINE
799  */
800 
801 /*
802  * Schedule an outgoing message by prioritizing it, and asserting
803  * attention on the bus. We can only do this when we are the initiator
804  * else there will be an illegal command interrupt.
805  */
806 #define ncr53c9x_sched_msgout(m) \
807 	do {							\
808 		NCR_MISC(("ncr53c9x_sched_msgout %d ", m));	\
809 		NCRCMD(sc, NCRCMD_SETATN);			\
810 		sc->sc_flags |= NCR_ATN;			\
811 		sc->sc_msgpriq |= (m);				\
812 	} while (0)
813 
814 int
815 ncr53c9x_reselect(sc, message)
816 	struct ncr53c9x_softc *sc;
817 	int message;
818 {
819 	u_char selid, target, lun;
820 	struct ncr53c9x_ecb *ecb;
821 	struct scsi_link *sc_link;
822 	struct ncr53c9x_tinfo *ti;
823 
824 	/*
825 	 * The SCSI chip made a snapshot of the data bus while the reselection
826 	 * was being negotiated.  This enables us to determine which target did
827 	 * the reselect.
828 	 */
829 	selid = sc->sc_selid & ~(1 << sc->sc_id);
830 	if (selid & (selid - 1)) {
831 		printf("%s: reselect with invalid selid %02x;"
832 		    " sending DEVICE RESET\n", sc->sc_dev.dv_xname, selid);
833 		goto reset;
834 	}
835 
836 	/*
837 	 * Search wait queue for disconnected cmd
838 	 * The list should be short, so I haven't bothered with
839 	 * any more sophisticated structures than a simple
840 	 * singly linked list.
841 	 */
842 	target = ffs(selid) - 1;
843 	lun = message & 0x07;
844 	for (ecb = sc->nexus_list.tqh_first; ecb != NULL;
845 	     ecb = ecb->chain.tqe_next) {
846 		sc_link = ecb->xs->sc_link;
847 		if (sc_link->target == target && sc_link->lun == lun)
848 			break;
849 	}
850 	if (ecb == NULL) {
851 		printf("%s: reselect from target %d lun %d with no nexus;"
852 		    " sending ABORT\n", sc->sc_dev.dv_xname, target, lun);
853 		goto abort;
854 	}
855 
856 	/* Make this nexus active again. */
857 	TAILQ_REMOVE(&sc->nexus_list, ecb, chain);
858 	sc->sc_state = NCR_CONNECTED;
859 	sc->sc_nexus = ecb;
860 	ti = &sc->sc_tinfo[target];
861 	ti->lubusy |= (1 << lun);
862 	ncr53c9x_setsync(sc, ti);
863 
864 	if (ecb->flags & ECB_RESET)
865 		ncr53c9x_sched_msgout(SEND_DEV_RESET);
866 	else if (ecb->flags & ECB_ABORT)
867 		ncr53c9x_sched_msgout(SEND_ABORT);
868 
869 	/* Do an implicit RESTORE POINTERS. */
870 	sc->sc_dp = ecb->daddr;
871 	sc->sc_dleft = ecb->dleft;
872 
873 	return (0);
874 
875 reset:
876 	ncr53c9x_sched_msgout(SEND_DEV_RESET);
877 	return (1);
878 
879 abort:
880 	ncr53c9x_sched_msgout(SEND_ABORT);
881 	return (1);
882 }
883 
884 #define IS1BYTEMSG(m) (((m) != 1 && (m) < 0x20) || (m) & 0x80)
885 #define IS2BYTEMSG(m) (((m) & 0xf0) == 0x20)
886 #define ISEXTMSG(m) ((m) == 1)
887 
888 /*
889  * Get an incoming message as initiator.
890  *
891  * The SCSI bus must already be in MESSAGE_IN_PHASE and there is a
892  * byte in the FIFO
893  */
894 void
895 ncr53c9x_msgin(sc)
896 	register struct ncr53c9x_softc *sc;
897 {
898 	register int v;
899 
900 	NCR_TRACE(("[ncr53c9x_msgin(curmsglen:%ld)] ", (long)sc->sc_imlen));
901 
902 	if ((NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) == 0) {
903 		printf("%s: msgin: no msg byte available\n",
904 			sc->sc_dev.dv_xname);
905 		return;
906 	}
907 
908 	/*
909 	 * Prepare for a new message.  A message should (according
910 	 * to the SCSI standard) be transmitted in one single
911 	 * MESSAGE_IN_PHASE. If we have been in some other phase,
912 	 * then this is a new message.
913 	 */
914 	if (sc->sc_prevphase != MESSAGE_IN_PHASE) {
915 		sc->sc_flags &= ~NCR_DROP_MSGI;
916 		sc->sc_imlen = 0;
917 	}
918 
919 	v = NCR_READ_REG(sc, NCR_FIFO);
920 	NCR_MISC(("<msgbyte:0x%02x>", v));
921 
922 #if 0
923 	if (sc->sc_state == NCR_RESELECTED && sc->sc_imlen == 0) {
924 		/*
925 		 * Which target is reselecting us? (The ID bit really)
926 		 */
927 		sc->sc_selid = v;
928 		NCR_MISC(("selid=0x%2x ", sc->sc_selid));
929 		return;
930 	}
931 #endif
932 
933 	sc->sc_imess[sc->sc_imlen] = v;
934 
935 	/*
936 	 * If we're going to reject the message, don't bother storing
937 	 * the incoming bytes.  But still, we need to ACK them.
938 	 */
939 
940 	if ((sc->sc_flags & NCR_DROP_MSGI)) {
941 		NCRCMD(sc, NCRCMD_MSGOK);
942 		printf("<dropping msg byte %x>",
943 			sc->sc_imess[sc->sc_imlen]);
944 		return;
945 	}
946 
947 	if (sc->sc_imlen >= NCR_MAX_MSG_LEN) {
948 		ncr53c9x_sched_msgout(SEND_REJECT);
949 		sc->sc_flags |= NCR_DROP_MSGI;
950 	} else {
951 		sc->sc_imlen++;
952 		/*
953 		 * This testing is suboptimal, but most
954 		 * messages will be of the one byte variety, so
955 		 * it should not effect performance
956 		 * significantly.
957 		 */
958 		if (sc->sc_imlen == 1 && IS1BYTEMSG(sc->sc_imess[0]))
959 			goto gotit;
960 		if (sc->sc_imlen == 2 && IS2BYTEMSG(sc->sc_imess[0]))
961 			goto gotit;
962 		if (sc->sc_imlen >= 3 && ISEXTMSG(sc->sc_imess[0]) &&
963 		    sc->sc_imlen == sc->sc_imess[1] + 2)
964 			goto gotit;
965 	}
966 	/* Ack what we have so far */
967 	NCRCMD(sc, NCRCMD_MSGOK);
968 	return;
969 
970 gotit:
971 	NCR_MSGS(("gotmsg(%x)", sc->sc_imess[0]));
972 	/*
973 	 * Now we should have a complete message (1 byte, 2 byte
974 	 * and moderately long extended messages).  We only handle
975 	 * extended messages which total length is shorter than
976 	 * NCR_MAX_MSG_LEN.  Longer messages will be amputated.
977 	 */
978 	switch (sc->sc_state) {
979 		struct ncr53c9x_ecb *ecb;
980 		struct ncr53c9x_tinfo *ti;
981 
982 	case NCR_CONNECTED:
983 		ecb = sc->sc_nexus;
984 		ti = &sc->sc_tinfo[ecb->xs->sc_link->target];
985 
986 		switch (sc->sc_imess[0]) {
987 		case MSG_CMDCOMPLETE:
988 			NCR_MSGS(("cmdcomplete "));
989 			if (sc->sc_dleft < 0) {
990 				struct scsi_link *sc_link = ecb->xs->sc_link;
991 				printf("%s: %ld extra bytes from %d:%d\n",
992 				    sc->sc_dev.dv_xname, -(long)sc->sc_dleft,
993 				    sc_link->target, sc_link->lun);
994 				sc->sc_dleft = 0;
995 			}
996 			ecb->xs->resid = ecb->dleft = sc->sc_dleft;
997 			sc->sc_state = NCR_CMDCOMPLETE;
998 			break;
999 
1000 		case MSG_MESSAGE_REJECT:
1001 			if (ncr53c9x_debug & NCR_SHOWMSGS)
1002 				printf("%s: our msg rejected by target\n",
1003 				    sc->sc_dev.dv_xname);
1004 			switch (sc->sc_msgout) {
1005 			case SEND_SDTR:
1006 				sc->sc_flags &= ~NCR_SYNCHNEGO;
1007 				ti->flags &= ~(T_NEGOTIATE | T_SYNCMODE);
1008 				ncr53c9x_setsync(sc, ti);
1009 				break;
1010 			case SEND_INIT_DET_ERR:
1011 				goto abort;
1012 			}
1013 			break;
1014 
1015 		case MSG_NOOP:
1016 			NCR_MSGS(("noop "));
1017 			break;
1018 
1019 		case MSG_DISCONNECT:
1020 			NCR_MSGS(("disconnect "));
1021 			ti->dconns++;
1022 			sc->sc_state = NCR_DISCONNECT;
1023 
1024 			if ((ecb->xs->sc_link->quirks & SDEV_AUTOSAVE) == 0)
1025 				break;
1026 			/*FALLTHROUGH*/
1027 
1028 		case MSG_SAVEDATAPOINTER:
1029 			NCR_MSGS(("save datapointer "));
1030 			ecb->daddr = sc->sc_dp;
1031 			ecb->dleft = sc->sc_dleft;
1032 			break;
1033 
1034 		case MSG_RESTOREPOINTERS:
1035 			NCR_MSGS(("restore datapointer "));
1036 			sc->sc_dp = ecb->daddr;
1037 			sc->sc_dleft = ecb->dleft;
1038 			break;
1039 
1040 		case MSG_EXTENDED:
1041 			NCR_MSGS(("extended(%x) ", sc->sc_imess[2]));
1042 			switch (sc->sc_imess[2]) {
1043 			case MSG_EXT_SDTR:
1044 				NCR_MSGS(("SDTR period %d, offset %d ",
1045 					sc->sc_imess[3], sc->sc_imess[4]));
1046 				if (sc->sc_imess[1] != 3)
1047 					goto reject;
1048 				ti->period = sc->sc_imess[3];
1049 				ti->offset = sc->sc_imess[4];
1050 				ti->flags &= ~T_NEGOTIATE;
1051 				if (sc->sc_minsync == 0 ||
1052 				    ti->offset == 0 ||
1053 				    ti->period > 124) {
1054 					printf("%s:%d: async\n", "esp",
1055 						ecb->xs->sc_link->target);
1056 					if ((sc->sc_flags&NCR_SYNCHNEGO)
1057 					    == 0) {
1058 						/*
1059 						 * target initiated negotiation
1060 						 */
1061 						ti->offset = 0;
1062 						ti->flags &= ~T_SYNCMODE;
1063 						ncr53c9x_sched_msgout(
1064 						    SEND_SDTR);
1065 					} else {
1066 						/* we are async */
1067 						ti->flags &= ~T_SYNCMODE;
1068 					}
1069 				} else {
1070 					int r = 250/ti->period;
1071 					int s = (100*250)/ti->period - 100*r;
1072 					int p;
1073 
1074 					p = ncr53c9x_stp2cpb(sc, ti->period);
1075 					ti->period = ncr53c9x_cpb2stp(sc, p);
1076 #ifdef NCR53C9X_DEBUG
1077 					sc_print_addr(ecb->xs->sc_link);
1078 					printf("max sync rate %d.%02dMb/s\n",
1079 						r, s);
1080 #endif
1081 					if ((sc->sc_flags&NCR_SYNCHNEGO)
1082 					    == 0) {
1083 						/*
1084 						 * target initiated negotiation
1085 						 */
1086 						if (ti->period <
1087 						    sc->sc_minsync)
1088 							ti->period =
1089 							    sc->sc_minsync;
1090 						if (ti->offset > 15)
1091 							ti->offset = 15;
1092 						ti->flags &= ~T_SYNCMODE;
1093 						ncr53c9x_sched_msgout(
1094 						    SEND_SDTR);
1095 					} else {
1096 						/* we are sync */
1097 						ti->flags |= T_SYNCMODE;
1098 					}
1099 				}
1100 				sc->sc_flags &= ~NCR_SYNCHNEGO;
1101 				ncr53c9x_setsync(sc, ti);
1102 				break;
1103 
1104 			default:
1105 				printf("%s: unrecognized MESSAGE EXTENDED;"
1106 				    " sending REJECT\n", sc->sc_dev.dv_xname);
1107 				goto reject;
1108 			}
1109 			break;
1110 
1111 		default:
1112 			NCR_MSGS(("ident "));
1113 			printf("%s: unrecognized MESSAGE; sending REJECT\n",
1114 			    sc->sc_dev.dv_xname);
1115 		reject:
1116 			ncr53c9x_sched_msgout(SEND_REJECT);
1117 			break;
1118 		}
1119 		break;
1120 
1121 	case NCR_RESELECTED:
1122 		if (!MSG_ISIDENTIFY(sc->sc_imess[0])) {
1123 			printf("%s: reselect without IDENTIFY;"
1124 			    " sending DEVICE RESET\n", sc->sc_dev.dv_xname);
1125 			goto reset;
1126 		}
1127 
1128 		(void) ncr53c9x_reselect(sc, sc->sc_imess[0]);
1129 		break;
1130 
1131 	default:
1132 		printf("%s: unexpected MESSAGE IN; sending DEVICE RESET\n",
1133 		    sc->sc_dev.dv_xname);
1134 	reset:
1135 		ncr53c9x_sched_msgout(SEND_DEV_RESET);
1136 		break;
1137 
1138 	abort:
1139 		ncr53c9x_sched_msgout(SEND_ABORT);
1140 		break;
1141 	}
1142 
1143 	/* Ack last message byte */
1144 	NCRCMD(sc, NCRCMD_MSGOK);
1145 
1146 	/* Done, reset message pointer. */
1147 	sc->sc_flags &= ~NCR_DROP_MSGI;
1148 	sc->sc_imlen = 0;
1149 }
1150 
1151 
1152 /*
1153  * Send the highest priority, scheduled message
1154  */
1155 void
1156 ncr53c9x_msgout(sc)
1157 	register struct ncr53c9x_softc *sc;
1158 {
1159 	struct ncr53c9x_tinfo *ti;
1160 	struct ncr53c9x_ecb *ecb;
1161 	size_t size;
1162 
1163 	NCR_TRACE(("[ncr53c9x_msgout(priq:%x, prevphase:%x)]",
1164 	    sc->sc_msgpriq, sc->sc_prevphase));
1165 
1166 	if (sc->sc_flags & NCR_ATN) {
1167 		if (sc->sc_prevphase != MESSAGE_OUT_PHASE) {
1168 		new:
1169 			NCRCMD(sc, NCRCMD_FLUSH);
1170 			DELAY(1);
1171 			sc->sc_msgoutq = 0;
1172 			sc->sc_omlen = 0;
1173 		}
1174 	} else {
1175 		if (sc->sc_prevphase == MESSAGE_OUT_PHASE) {
1176 			ncr53c9x_sched_msgout(sc->sc_msgoutq);
1177 			goto new;
1178 		} else {
1179 			printf("%s at line %d: unexpected MESSAGE OUT phase\n",
1180 			    sc->sc_dev.dv_xname, __LINE__);
1181 		}
1182 	}
1183 
1184 	if (sc->sc_omlen == 0) {
1185 		/* Pick up highest priority message */
1186 		sc->sc_msgout = sc->sc_msgpriq & -sc->sc_msgpriq;
1187 		sc->sc_msgoutq |= sc->sc_msgout;
1188 		sc->sc_msgpriq &= ~sc->sc_msgout;
1189 		sc->sc_omlen = 1;		/* "Default" message len */
1190 		switch (sc->sc_msgout) {
1191 		case SEND_SDTR:
1192 			ecb = sc->sc_nexus;
1193 			ti = &sc->sc_tinfo[ecb->xs->sc_link->target];
1194 			sc->sc_omess[0] = MSG_EXTENDED;
1195 			sc->sc_omess[1] = 3;
1196 			sc->sc_omess[2] = MSG_EXT_SDTR;
1197 			sc->sc_omess[3] = ti->period;
1198 			sc->sc_omess[4] = ti->offset;
1199 			sc->sc_omlen = 5;
1200 			if ((sc->sc_flags & NCR_SYNCHNEGO) == 0) {
1201 				ti->flags |= T_SYNCMODE;
1202 				ncr53c9x_setsync(sc, ti);
1203 			}
1204 			break;
1205 		case SEND_IDENTIFY:
1206 			if (sc->sc_state != NCR_CONNECTED) {
1207 				printf("%s at line %d: no nexus\n",
1208 				    sc->sc_dev.dv_xname, __LINE__);
1209 			}
1210 			ecb = sc->sc_nexus;
1211 			sc->sc_omess[0] =
1212 			    MSG_IDENTIFY(ecb->xs->sc_link->lun, 0);
1213 			break;
1214 		case SEND_DEV_RESET:
1215 			sc->sc_flags |= NCR_ABORTING;
1216 			sc->sc_omess[0] = MSG_BUS_DEV_RESET;
1217 			ecb = sc->sc_nexus;
1218 			ti = &sc->sc_tinfo[ecb->xs->sc_link->target];
1219 			ti->flags &= ~T_SYNCMODE;
1220 			ti->flags |= T_NEGOTIATE;
1221 			break;
1222 		case SEND_PARITY_ERROR:
1223 			sc->sc_omess[0] = MSG_PARITY_ERROR;
1224 			break;
1225 		case SEND_ABORT:
1226 			sc->sc_flags |= NCR_ABORTING;
1227 			sc->sc_omess[0] = MSG_ABORT;
1228 			break;
1229 		case SEND_INIT_DET_ERR:
1230 			sc->sc_omess[0] = MSG_INITIATOR_DET_ERR;
1231 			break;
1232 		case SEND_REJECT:
1233 			sc->sc_omess[0] = MSG_MESSAGE_REJECT;
1234 			break;
1235 		default:
1236 			NCRCMD(sc, NCRCMD_RSTATN);
1237 			sc->sc_flags &= ~NCR_ATN;
1238 			sc->sc_omess[0] = MSG_NOOP;
1239 			break;
1240 		}
1241 		sc->sc_omp = sc->sc_omess;
1242 	}
1243 
1244 #if 1
1245 	/* (re)send the message */
1246 	size = min(sc->sc_omlen, sc->sc_maxxfer);
1247 	NCRDMA_SETUP(sc, &sc->sc_omp, &sc->sc_omlen, 0, &size);
1248 	/* Program the SCSI counter */
1249 	NCR_WRITE_REG(sc, NCR_TCL, size);
1250 	NCR_WRITE_REG(sc, NCR_TCM, size >> 8);
1251 	if (sc->sc_cfg2 & NCRCFG2_FE) {
1252 		NCR_WRITE_REG(sc, NCR_TCH, size >> 16);
1253 	}
1254 	/* load the count in */
1255 	NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA);
1256 	NCRCMD(sc, NCRCMD_TRANS|NCRCMD_DMA);
1257 	NCRDMA_GO(sc);
1258 #else
1259 	{	int i;
1260 		for (i = 0; i < sc->sc_omlen; i++)
1261 			NCR_WRITE_REG(sc, FIFO, sc->sc_omess[i]);
1262 		NCRCMD(sc, NCRCMD_TRANS);
1263 		sc->sc_omlen = 0;
1264 	}
1265 #endif
1266 }
1267 
1268 /*
1269  * This is the most critical part of the driver, and has to know
1270  * how to deal with *all* error conditions and phases from the SCSI
1271  * bus. If there are no errors and the DMA was active, then call the
1272  * DMA pseudo-interrupt handler. If this returns 1, then that was it
1273  * and we can return from here without further processing.
1274  *
1275  * Most of this needs verifying.
1276  */
1277 int
1278 ncr53c9x_intr(sc)
1279 	register struct ncr53c9x_softc *sc;
1280 {
1281 	register struct ncr53c9x_ecb *ecb;
1282 	register struct scsi_link *sc_link;
1283 	struct ncr53c9x_tinfo *ti;
1284 	int loop;
1285 	size_t size;
1286 	int nfifo;
1287 
1288 	NCR_TRACE(("[ncr53c9x_intr] "));
1289 
1290 	/*
1291 	 * I have made some (maybe seriously flawed) assumptions here,
1292 	 * but basic testing (uncomment the printf() below), show that
1293 	 * certainly something happens when this loop is here.
1294 	 *
1295 	 * The idea is that many of the SCSI operations take very little
1296 	 * time, and going away and getting interrupted is too high an
1297 	 * overhead to pay. For example, selecting, sending a message
1298 	 * and command and then doing some work can be done in one "pass".
1299 	 *
1300 	 * The DELAY is not variable because I do not understand that the
1301 	 * DELAY loop should be fixed-time regardless of CPU speed, but
1302 	 * I am *assuming* that the faster SCSI processors get things done
1303 	 * quicker (sending a command byte etc), and so there is no
1304 	 * need to be too slow.
1305 	 *
1306 	 * This is a heuristic. It is 2 when at 20Mhz, 2 at 25Mhz and 1
1307 	 * at 40Mhz. This needs testing.
1308 	 */
1309 	for (loop = 0; 1;loop++, DELAY(50/sc->sc_freq)) {
1310 		/* a feeling of deja-vu */
1311 		if (!NCRDMA_ISINTR(sc))
1312 			return (loop != 0);
1313 #if 0
1314 		if (loop)
1315 			printf("*");
1316 #endif
1317 
1318 		/* and what do the registers say... */
1319 		ncr53c9x_readregs(sc);
1320 
1321 		sc->sc_intrcnt.ev_count++;
1322 
1323 		/*
1324 		 * At the moment, only a SCSI Bus Reset or Illegal
1325 		 * Command are classed as errors. A disconnect is a
1326 		 * valid condition, and we let the code check is the
1327 		 * "NCR_BUSFREE_OK" flag was set before declaring it
1328 		 * and error.
1329 		 *
1330 		 * Also, the status register tells us about "Gross
1331 		 * Errors" and "Parity errors". Only the Gross Error
1332 		 * is really bad, and the parity errors are dealt
1333 		 * with later
1334 		 *
1335 		 * TODO
1336 		 *	If there are too many parity error, go to slow
1337 		 *	cable mode ?
1338 		 */
1339 
1340 		/* SCSI Reset */
1341 		if (sc->sc_espintr & NCRINTR_SBR) {
1342 			if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
1343 				NCRCMD(sc, NCRCMD_FLUSH);
1344 				DELAY(1);
1345 			}
1346 			if (sc->sc_state != NCR_SBR) {
1347 				printf("%s: SCSI bus reset\n",
1348 					sc->sc_dev.dv_xname);
1349 				ncr53c9x_init(sc, 0); /* Restart everything */
1350 				return 1;
1351 			}
1352 #if 0
1353 	/*XXX*/		printf("<expected bus reset: "
1354 				"[intr %x, stat %x, step %d]>\n",
1355 				sc->sc_espintr, sc->sc_espstat,
1356 				sc->sc_espstep);
1357 #endif
1358 			if (sc->sc_nexus)
1359 				panic("%s: nexus in reset state",
1360 				      sc->sc_dev.dv_xname);
1361 			goto sched;
1362 		}
1363 
1364 		ecb = sc->sc_nexus;
1365 
1366 #define NCRINTR_ERR (NCRINTR_SBR|NCRINTR_ILL)
1367 		if (sc->sc_espintr & NCRINTR_ERR ||
1368 		    sc->sc_espstat & NCRSTAT_GE) {
1369 
1370 			if (sc->sc_espstat & NCRSTAT_GE) {
1371 				/* no target ? */
1372 				if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
1373 					NCRCMD(sc, NCRCMD_FLUSH);
1374 					DELAY(1);
1375 				}
1376 				if (sc->sc_state == NCR_CONNECTED ||
1377 				    sc->sc_state == NCR_SELECTING) {
1378 					ecb->xs->error = XS_DRIVER_STUFFUP;
1379 					ncr53c9x_done(sc, ecb);
1380 				}
1381 				return 1;
1382 			}
1383 
1384 			if (sc->sc_espintr & NCRINTR_ILL) {
1385 				if (sc->sc_flags & NCR_EXPECT_ILLCMD) {
1386 printf("%s: ILL: ESP100 work-around activated\n", sc->sc_dev.dv_xname);
1387 					sc->sc_flags &= ~NCR_EXPECT_ILLCMD;
1388 					continue;
1389 				}
1390 				/* illegal command, out of sync ? */
1391 				printf("%s: illegal command: 0x%x "
1392 				    "(state %d, phase %x, prevphase %x)\n",
1393 					sc->sc_dev.dv_xname, sc->sc_lastcmd,
1394 					sc->sc_state, sc->sc_phase,
1395 					sc->sc_prevphase);
1396 				if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
1397 					NCRCMD(sc, NCRCMD_FLUSH);
1398 					DELAY(1);
1399 				}
1400 				ncr53c9x_init(sc, 1); /* Restart everything */
1401 				return 1;
1402 			}
1403 		}
1404 		sc->sc_flags &= ~NCR_EXPECT_ILLCMD;
1405 
1406 		/*
1407 		 * Call if DMA is active.
1408 		 *
1409 		 * If DMA_INTR returns true, then maybe go 'round the loop
1410 		 * again in case there is no more DMA queued, but a phase
1411 		 * change is expected.
1412 		 */
1413 		if (NCRDMA_ISACTIVE(sc)) {
1414 			int r = NCRDMA_INTR(sc);
1415 			if (r == -1) {
1416 				printf("%s: DMA error; resetting\n",
1417 					sc->sc_dev.dv_xname);
1418 				ncr53c9x_init(sc, 1);
1419 			}
1420 			/* If DMA active here, then go back to work... */
1421 			if (NCRDMA_ISACTIVE(sc))
1422 				return 1;
1423 
1424 			/*
1425 			 * Note that this can happen during normal operation
1426 			 * if we are reselected while using DMA to select
1427 			 * a target.  If this is the case, don't issue the
1428 			 * warning.
1429 			 */
1430 			if (sc->sc_dleft == 0 &&
1431 			    (sc->sc_espstat & NCRSTAT_TC) == 0 &&
1432 			    !((sc->sc_espintr & NCRINTR_RESEL) &&
1433 			      sc->sc_state == NCR_SELECTING))
1434 				printf("%s: !TC [intr %x, stat %x, step %d]"
1435 				       " prevphase %x, resid %x\n",
1436 					sc->sc_dev.dv_xname,
1437 					sc->sc_espintr,
1438 					sc->sc_espstat,
1439 					sc->sc_espstep,
1440 					sc->sc_prevphase,
1441 					ecb?ecb->dleft:-1);
1442 		}
1443 
1444 #if 0	/* Unreliable on some NCR revisions? */
1445 		if ((sc->sc_espstat & NCRSTAT_INT) == 0) {
1446 			printf("%s: spurious interrupt\n",
1447 			    sc->sc_dev.dv_xname);
1448 			return 1;
1449 		}
1450 #endif
1451 
1452 		/*
1453 		 * check for less serious errors
1454 		 */
1455 		if (sc->sc_espstat & NCRSTAT_PE) {
1456 			printf("%s: SCSI bus parity error\n",
1457 				sc->sc_dev.dv_xname);
1458 			if (sc->sc_prevphase == MESSAGE_IN_PHASE)
1459 				ncr53c9x_sched_msgout(SEND_PARITY_ERROR);
1460 			else
1461 				ncr53c9x_sched_msgout(SEND_INIT_DET_ERR);
1462 		}
1463 
1464 		if (sc->sc_espintr & NCRINTR_DIS) {
1465 			NCR_MISC(("<DISC [intr %x, stat %x, step %d]>",
1466 				sc->sc_espintr,sc->sc_espstat,sc->sc_espstep));
1467 			if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
1468 				NCRCMD(sc, NCRCMD_FLUSH);
1469 				DELAY(1);
1470 			}
1471 			/*
1472 			 * This command must (apparently) be issued within
1473 			 * 250mS of a disconnect. So here you are...
1474 			 */
1475 			NCRCMD(sc, NCRCMD_ENSEL);
1476 			switch (sc->sc_state) {
1477 			case NCR_RESELECTED:
1478 				goto sched;
1479 
1480 			case NCR_SELECTING:
1481 				ecb->xs->error = XS_SELTIMEOUT;
1482 				goto finish;
1483 
1484 			case NCR_CONNECTED:
1485 				if ((sc->sc_flags & NCR_SYNCHNEGO)) {
1486 #ifdef NCR53C9X_DEBUG
1487 					if (ecb)
1488 						sc_print_addr(ecb->xs->sc_link);
1489 					printf("sync nego not completed!\n");
1490 #endif
1491 					ti = &sc->sc_tinfo[ecb->xs->sc_link->target];
1492 					sc->sc_flags &= ~NCR_SYNCHNEGO;
1493 					ti->flags &=
1494 					    ~(T_NEGOTIATE | T_SYNCMODE);
1495 				}
1496 
1497 				/* it may be OK to disconnect */
1498 				if ((sc->sc_flags & NCR_ABORTING) == 0) {
1499 					/*
1500 					 * Section 5.1.1 of the SCSI 2 spec
1501 					 * suggests issuing a REQUEST SENSE
1502 					 * following an unexpected disconnect.
1503 					 * Some devices go into a contingent
1504 					 * allegiance condition when
1505 					 * disconnecting, and this is necessary
1506 					 * to clean up their state.
1507 					 */
1508 					printf("%s: unexpected disconnect; ",
1509 					    sc->sc_dev.dv_xname);
1510 					if (ecb->flags & ECB_SENSE) {
1511 						printf("resetting\n");
1512 						goto reset;
1513 					}
1514 					printf("sending REQUEST SENSE\n");
1515 					untimeout(ncr53c9x_timeout, ecb);
1516 					ncr53c9x_sense(sc, ecb);
1517 					goto out;
1518 				}
1519 
1520 				ecb->xs->error = XS_DRIVER_STUFFUP;
1521 				goto finish;
1522 
1523 			case NCR_DISCONNECT:
1524 				TAILQ_INSERT_HEAD(&sc->nexus_list, ecb, chain);
1525 				sc->sc_nexus = NULL;
1526 				goto sched;
1527 
1528 			case NCR_CMDCOMPLETE:
1529 				goto finish;
1530 			}
1531 		}
1532 
1533 		switch (sc->sc_state) {
1534 
1535 		case NCR_SBR:
1536 			printf("%s: waiting for SCSI Bus Reset to happen\n",
1537 				sc->sc_dev.dv_xname);
1538 			return 1;
1539 
1540 		case NCR_RESELECTED:
1541 			/*
1542 			 * we must be continuing a message ?
1543 			 */
1544 			if (sc->sc_phase != MESSAGE_IN_PHASE) {
1545 				printf("%s: target didn't identify\n",
1546 					sc->sc_dev.dv_xname);
1547 				ncr53c9x_init(sc, 1);
1548 				return 1;
1549 			}
1550 printf("<<RESELECT CONT'd>>");
1551 #if XXXX
1552 			ncr53c9x_msgin(sc);
1553 			if (sc->sc_state != NCR_CONNECTED) {
1554 				/* IDENTIFY fail?! */
1555 				printf("%s: identify failed\n",
1556 					sc->sc_dev.dv_xname);
1557 				ncr53c9x_init(sc, 1);
1558 				return 1;
1559 			}
1560 #endif
1561 			break;
1562 
1563 		case NCR_IDLE:
1564 if (sc->sc_flags & NCR_ICCS) printf("[[esp: BUMMER]]");
1565 		case NCR_SELECTING:
1566 			sc->sc_msgpriq = sc->sc_msgout = sc->sc_msgoutq = 0;
1567 			sc->sc_flags = 0;
1568 			ecb = sc->sc_nexus;
1569 
1570 			if (sc->sc_espintr & NCRINTR_RESEL) {
1571 				/*
1572 				 * If we're trying to select a
1573 				 * target ourselves, push our command
1574 				 * back into the ready list.
1575 				 */
1576 				if (sc->sc_state == NCR_SELECTING) {
1577 					NCR_MISC(("backoff selector "));
1578 					untimeout(ncr53c9x_timeout, ecb);
1579 					sc_link = ecb->xs->sc_link;
1580 					ti = &sc->sc_tinfo[sc_link->target];
1581 					TAILQ_INSERT_HEAD(&sc->ready_list,
1582 					    ecb, chain);
1583 					ecb = sc->sc_nexus = NULL;
1584 				}
1585 				sc->sc_state = NCR_RESELECTED;
1586 				if (sc->sc_phase != MESSAGE_IN_PHASE) {
1587 					/*
1588 					 * Things are seriously fucked up.
1589 					 * Pull the brakes, i.e. reset
1590 					 */
1591 					printf("%s: target didn't identify\n",
1592 						sc->sc_dev.dv_xname);
1593 					ncr53c9x_init(sc, 1);
1594 					return 1;
1595 				}
1596 				/*
1597 				 * The C90 only inhibits FIFO writes until
1598 				 * reselection is complete, instead of
1599 				 * waiting until the interrupt status register
1600 				 * has been read. So, if the reselect happens
1601 				 * while we were entering a command bytes (for
1602 				 * another target) some of those bytes can
1603 				 * appear in the FIFO here, after the
1604 				 * interrupt is taken.
1605 				 */
1606 				nfifo = NCR_READ_REG(sc,NCR_FFLAG) & NCRFIFO_FF;
1607 				if (nfifo < 2 ||
1608 				    (nfifo > 2 &&
1609 				     sc->sc_rev != NCR_VARIANT_ESP100)) {
1610 					printf("%s: RESELECT: "
1611 					    "%d bytes in FIFO! "
1612 					    "[intr %x, stat %x, step %d, prevphase %x]\n",
1613 						sc->sc_dev.dv_xname,
1614 						nfifo,
1615 						sc->sc_espintr,
1616 						sc->sc_espstat,
1617 						sc->sc_espstep,
1618 						sc->sc_prevphase);
1619 					ncr53c9x_init(sc, 1);
1620 					return 1;
1621 				}
1622 				sc->sc_selid = NCR_READ_REG(sc, NCR_FIFO);
1623 				NCR_MISC(("selid=0x%2x ", sc->sc_selid));
1624 
1625 				/* Handle identify message */
1626 				ncr53c9x_msgin(sc);
1627 				if (nfifo != 2) {
1628 					sc->sc_flags |= NCR_EXPECT_ILLCMD;
1629 					NCRCMD(sc, NCRCMD_FLUSH);
1630 				}
1631 
1632 				if (sc->sc_state != NCR_CONNECTED) {
1633 					/* IDENTIFY fail?! */
1634 					printf("%s: identify failed\n",
1635 						sc->sc_dev.dv_xname);
1636 					ncr53c9x_init(sc, 1);
1637 					return 1;
1638 				}
1639 				continue; /* ie. next phase expected soon */
1640 			}
1641 
1642 #define	NCRINTR_DONE	(NCRINTR_FC|NCRINTR_BS)
1643 			if ((sc->sc_espintr & NCRINTR_DONE) == NCRINTR_DONE) {
1644 				ecb = sc->sc_nexus;
1645 				if (!ecb)
1646 					panic("esp: not nexus at sc->sc_nexus");
1647 
1648 				sc_link = ecb->xs->sc_link;
1649 				ti = &sc->sc_tinfo[sc_link->target];
1650 
1651 				switch (sc->sc_espstep) {
1652 				case 0:
1653 					printf("%s: select timeout/no "
1654 					    "disconnect\n",
1655 					    sc->sc_dev.dv_xname);
1656 					ecb->xs->error = XS_SELTIMEOUT;
1657 					goto finish;
1658 				case 1:
1659 					if ((ti->flags & T_NEGOTIATE) == 0) {
1660 						printf("%s: step 1 & !NEG\n",
1661 							sc->sc_dev.dv_xname);
1662 						goto reset;
1663 					}
1664 					if (sc->sc_phase != MESSAGE_OUT_PHASE) {
1665 						printf("%s: !MSGOUT\n",
1666 							sc->sc_dev.dv_xname);
1667 						goto reset;
1668 					}
1669 					/* Start negotiating */
1670 					ti->period = sc->sc_minsync;
1671 					ti->offset = 15;
1672 					sc->sc_flags |= NCR_SYNCHNEGO;
1673 					ncr53c9x_sched_msgout(SEND_SDTR);
1674 					break;
1675 				case 3:
1676 					/*
1677 					 * Grr, this is supposed to mean
1678 					 * "target left command phase
1679 					 *  prematurely". It seems to happen
1680 					 * regularly when sync mode is on.
1681 					 * Look at FIFO to see if command
1682 					 * went out.
1683 					 * (Timing problems?)
1684 					 */
1685 					if (ncr53c9x_dmaselect) {
1686 					    if (sc->sc_cmdlen == 0)
1687 						/* Hope for the best.. */
1688 						break;
1689 					} else if ((NCR_READ_REG(sc, NCR_FFLAG)
1690 					    & NCRFIFO_FF) == 0) {
1691 						/* Hope for the best.. */
1692 						break;
1693 					}
1694 					printf("(%s:%d:%d): selection failed;"
1695 						" %d left in FIFO "
1696 						"[intr %x, stat %x, step %d]\n",
1697 						sc->sc_dev.dv_xname,
1698 						sc_link->target,
1699 						sc_link->lun,
1700 						NCR_READ_REG(sc, NCR_FFLAG)
1701 						 & NCRFIFO_FF,
1702 						sc->sc_espintr, sc->sc_espstat,
1703 						sc->sc_espstep);
1704 					NCRCMD(sc, NCRCMD_FLUSH);
1705 					ncr53c9x_sched_msgout(SEND_ABORT);
1706 					return 1;
1707 				case 2:
1708 					/* Select stuck at Command Phase */
1709 					NCRCMD(sc, NCRCMD_FLUSH);
1710 				case 4:
1711 					if (ncr53c9x_dmaselect &&
1712 					    sc->sc_cmdlen != 0)
1713 						printf("(%s:%d:%d): select; "
1714 						      "%d left in DMA buffer\n",
1715 							sc->sc_dev.dv_xname,
1716 							sc_link->target,
1717 							sc_link->lun,
1718 							sc->sc_cmdlen);
1719 					/* So far, everything went fine */
1720 					break;
1721 				}
1722 #if 0
1723 				if (ecb->xs->flags & SCSI_RESET)
1724 					ncr53c9x_sched_msgout(SEND_DEV_RESET);
1725 				else if (ti->flags & T_NEGOTIATE)
1726 					ncr53c9x_sched_msgout(
1727 					    SEND_IDENTIFY | SEND_SDTR);
1728 				else
1729 					ncr53c9x_sched_msgout(SEND_IDENTIFY);
1730 #endif
1731 
1732 				ecb->flags |= ECB_NEXUS;
1733 				ti->lubusy |= (1 << sc_link->lun);
1734 
1735 				sc->sc_prevphase = INVALID_PHASE; /* ?? */
1736 				/* Do an implicit RESTORE POINTERS. */
1737 				sc->sc_dp = ecb->daddr;
1738 				sc->sc_dleft = ecb->dleft;
1739 				sc->sc_state = NCR_CONNECTED;
1740 				break;
1741 			} else {
1742 				printf("%s: unexpected status after select"
1743 					": [intr %x, stat %x, step %x]\n",
1744 					sc->sc_dev.dv_xname,
1745 					sc->sc_espintr, sc->sc_espstat,
1746 					sc->sc_espstep);
1747 				NCRCMD(sc, NCRCMD_FLUSH);
1748 				DELAY(1);
1749 				goto reset;
1750 			}
1751 			if (sc->sc_state == NCR_IDLE) {
1752 				printf("%s: stray interrupt\n",
1753 				    sc->sc_dev.dv_xname);
1754 					return 0;
1755 			}
1756 			break;
1757 
1758 		case NCR_CONNECTED:
1759 			if (sc->sc_flags & NCR_ICCS) {
1760 				u_char msg;
1761 
1762 				sc->sc_flags &= ~NCR_ICCS;
1763 
1764 				if (!(sc->sc_espintr & NCRINTR_DONE)) {
1765 					printf("%s: ICCS: "
1766 					      ": [intr %x, stat %x, step %x]\n",
1767 						sc->sc_dev.dv_xname,
1768 						sc->sc_espintr, sc->sc_espstat,
1769 						sc->sc_espstep);
1770 				}
1771 				if ((NCR_READ_REG(sc, NCR_FFLAG)
1772 				    & NCRFIFO_FF) != 2) {
1773 					int i = (NCR_READ_REG(sc, NCR_FFLAG)
1774 					    & NCRFIFO_FF) - 2;
1775 					while (i--)
1776 						(void) NCR_READ_REG(sc,
1777 						    NCR_FIFO);
1778 				}
1779 				ecb->stat = NCR_READ_REG(sc, NCR_FIFO);
1780 				msg = NCR_READ_REG(sc, NCR_FIFO);
1781 				NCR_PHASE(("<stat:(%x,%x)>", ecb->stat, msg));
1782 				if (msg == MSG_CMDCOMPLETE) {
1783 					ecb->xs->resid = ecb->dleft =
1784 					    sc->sc_dleft;
1785 					sc->sc_state = NCR_CMDCOMPLETE;
1786 				} else
1787 					printf("%s: STATUS_PHASE: msg %d\n",
1788 						sc->sc_dev.dv_xname, msg);
1789 				NCRCMD(sc, NCRCMD_MSGOK);
1790 				continue; /* ie. wait for disconnect */
1791 			}
1792 			break;
1793 		default:
1794 			panic("%s: invalid state: %d",
1795 			      sc->sc_dev.dv_xname,
1796 			      sc->sc_state);
1797 		}
1798 
1799 		/*
1800 		 * Driver is now in state NCR_CONNECTED, i.e. we
1801 		 * have a current command working the SCSI bus.
1802 		 */
1803 		if (sc->sc_state != NCR_CONNECTED || ecb == NULL) {
1804 			panic("esp no nexus");
1805 		}
1806 
1807 		switch (sc->sc_phase) {
1808 		case MESSAGE_OUT_PHASE:
1809 			NCR_PHASE(("MESSAGE_OUT_PHASE "));
1810 			ncr53c9x_msgout(sc);
1811 			sc->sc_prevphase = MESSAGE_OUT_PHASE;
1812 			break;
1813 		case MESSAGE_IN_PHASE:
1814 			NCR_PHASE(("MESSAGE_IN_PHASE "));
1815 			if (sc->sc_espintr & NCRINTR_BS) {
1816 				NCRCMD(sc, NCRCMD_FLUSH);
1817 				sc->sc_flags |= NCR_WAITI;
1818 				NCRCMD(sc, NCRCMD_TRANS);
1819 			} else if (sc->sc_espintr & NCRINTR_FC) {
1820 				if ((sc->sc_flags & NCR_WAITI) == 0) {
1821 					printf("%s: MSGIN: unexpected FC bit: "
1822 						"[intr %x, stat %x, step %x]\n",
1823 					sc->sc_dev.dv_xname,
1824 					sc->sc_espintr, sc->sc_espstat,
1825 					sc->sc_espstep);
1826 				}
1827 				sc->sc_flags &= ~NCR_WAITI;
1828 				ncr53c9x_msgin(sc);
1829 			} else {
1830 				printf("%s: MSGIN: weird bits: "
1831 					"[intr %x, stat %x, step %x]\n",
1832 					sc->sc_dev.dv_xname,
1833 					sc->sc_espintr, sc->sc_espstat,
1834 					sc->sc_espstep);
1835 			}
1836 			sc->sc_prevphase = MESSAGE_IN_PHASE;
1837 			break;
1838 		case COMMAND_PHASE:
1839 			/*
1840 			 * Send the command block. Normally we don't see this
1841 			 * phase because the SEL_ATN command takes care of
1842 			 * all this. However, we end up here if either the
1843 			 * target or we wanted exchange some more messages
1844 			 * first (e.g. to start negotiations).
1845 			 */
1846 
1847 			NCR_PHASE(("COMMAND_PHASE 0x%02x (%d) ",
1848 				ecb->cmd.cmd.opcode, ecb->clen));
1849 			if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
1850 				NCRCMD(sc, NCRCMD_FLUSH);
1851 				DELAY(1);
1852 			}
1853 			if (ncr53c9x_dmaselect) {
1854 				size_t size;
1855 				/* setup DMA transfer for command */
1856 				size = ecb->clen;
1857 				sc->sc_cmdlen = size;
1858 				sc->sc_cmdp = (caddr_t)&ecb->cmd.cmd;
1859 				NCRDMA_SETUP(sc, &sc->sc_cmdp, &sc->sc_cmdlen,
1860 					     0, &size);
1861 				/* Program the SCSI counter */
1862 				NCR_WRITE_REG(sc, NCR_TCL, size);
1863 				NCR_WRITE_REG(sc, NCR_TCM, size >> 8);
1864 				if (sc->sc_cfg2 & NCRCFG2_FE) {
1865 					NCR_WRITE_REG(sc, NCR_TCH, size >> 16);
1866 				}
1867 
1868 				NCRCMD(sc, NCRCMD_TRANS | NCRCMD_DMA);
1869 				NCRDMA_GO(sc);
1870 			} else {
1871 				u_char *cmd = (u_char *)&ecb->cmd.cmd;
1872 				int i;
1873 				/* Now the command into the FIFO */
1874 				for (i = 0; i < ecb->clen; i++)
1875 					NCR_WRITE_REG(sc, NCR_FIFO, *cmd++);
1876 				NCRCMD(sc, NCRCMD_TRANS);
1877 			}
1878 			sc->sc_prevphase = COMMAND_PHASE;
1879 			break;
1880 		case DATA_OUT_PHASE:
1881 			NCR_PHASE(("DATA_OUT_PHASE [%ld] ",(long)sc->sc_dleft));
1882 			NCRCMD(sc, NCRCMD_FLUSH);
1883 			size = min(sc->sc_dleft, sc->sc_maxxfer);
1884 			NCRDMA_SETUP(sc, &sc->sc_dp, &sc->sc_dleft,
1885 				  0, &size);
1886 			sc->sc_prevphase = DATA_OUT_PHASE;
1887 			goto setup_xfer;
1888 		case DATA_IN_PHASE:
1889 			NCR_PHASE(("DATA_IN_PHASE "));
1890 			if (sc->sc_rev == NCR_VARIANT_ESP100)
1891 				NCRCMD(sc, NCRCMD_FLUSH);
1892 			size = min(sc->sc_dleft, sc->sc_maxxfer);
1893 			NCRDMA_SETUP(sc, &sc->sc_dp, &sc->sc_dleft,
1894 				  1, &size);
1895 			sc->sc_prevphase = DATA_IN_PHASE;
1896 		setup_xfer:
1897 			/* Program the SCSI counter */
1898 			NCR_WRITE_REG(sc, NCR_TCL, size);
1899 			NCR_WRITE_REG(sc, NCR_TCM, size >> 8);
1900 			if (sc->sc_cfg2 & NCRCFG2_FE) {
1901 				NCR_WRITE_REG(sc, NCR_TCH, size >> 16);
1902 			}
1903 			/* load the count in */
1904 			NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA);
1905 
1906 			/*
1907 			 * Note that if `size' is 0, we've already transceived
1908 			 * all the bytes we want but we're still in DATA PHASE.
1909 			 * Apparently, the device needs padding. Also, a
1910 			 * transfer size of 0 means "maximum" to the chip
1911 			 * DMA logic.
1912 			 */
1913 			NCRCMD(sc,
1914 			       (size==0?NCRCMD_TRPAD:NCRCMD_TRANS)|NCRCMD_DMA);
1915 			NCRDMA_GO(sc);
1916 			return 1;
1917 		case STATUS_PHASE:
1918 			NCR_PHASE(("STATUS_PHASE "));
1919 			sc->sc_flags |= NCR_ICCS;
1920 			NCRCMD(sc, NCRCMD_ICCS);
1921 			sc->sc_prevphase = STATUS_PHASE;
1922 			break;
1923 		case INVALID_PHASE:
1924 			break;
1925 		default:
1926 			printf("%s: unexpected bus phase; resetting\n",
1927 			    sc->sc_dev.dv_xname);
1928 			goto reset;
1929 		}
1930 	}
1931 	panic("esp: should not get here..");
1932 
1933 reset:
1934 	ncr53c9x_init(sc, 1);
1935 	return 1;
1936 
1937 finish:
1938 	ncr53c9x_done(sc, ecb);
1939 	goto out;
1940 
1941 sched:
1942 	sc->sc_state = NCR_IDLE;
1943 	ncr53c9x_sched(sc);
1944 	goto out;
1945 
1946 out:
1947 	return 1;
1948 }
1949 
1950 void
1951 ncr53c9x_abort(sc, ecb)
1952 	struct ncr53c9x_softc *sc;
1953 	struct ncr53c9x_ecb *ecb;
1954 {
1955 
1956 	/* 2 secs for the abort */
1957 	ecb->timeout = NCR_ABORT_TIMEOUT;
1958 	ecb->flags |= ECB_ABORT;
1959 
1960 	if (ecb == sc->sc_nexus) {
1961 		/*
1962 		 * If we're still selecting, the message will be scheduled
1963 		 * after selection is complete.
1964 		 */
1965 		if (sc->sc_state == NCR_CONNECTED)
1966 			ncr53c9x_sched_msgout(SEND_ABORT);
1967 
1968 		/*
1969 		 * Reschedule timeout. First, cancel a queued timeout (if any)
1970 		 * in case someone decides to call ncr53c9x_abort() from
1971 		 * elsewhere.
1972 		 */
1973 		untimeout(ncr53c9x_timeout, ecb);
1974 		timeout(ncr53c9x_timeout, ecb, (ecb->timeout * hz) / 1000);
1975 	} else {
1976 		ncr53c9x_dequeue(sc, ecb);
1977 		TAILQ_INSERT_HEAD(&sc->ready_list, ecb, chain);
1978 		if (sc->sc_state == NCR_IDLE)
1979 			ncr53c9x_sched(sc);
1980 	}
1981 }
1982 
1983 void
1984 ncr53c9x_timeout(arg)
1985 	void *arg;
1986 {
1987 	struct ncr53c9x_ecb *ecb = arg;
1988 	struct scsi_xfer *xs = ecb->xs;
1989 	struct scsi_link *sc_link = xs->sc_link;
1990 	struct ncr53c9x_softc *sc = sc_link->adapter_softc;
1991 	int s;
1992 
1993 	sc_print_addr(sc_link);
1994 	printf("%s: timed out [ecb %p (flags 0x%x, dleft %x, stat %x)], "
1995 	       "<state %d, nexus %p, phase(c %x, p %x), resid %lx, "
1996 	       "msg(q %x,o %x) %s>",
1997 		sc->sc_dev.dv_xname,
1998 		ecb, ecb->flags, ecb->dleft, ecb->stat,
1999 		sc->sc_state, sc->sc_nexus, sc->sc_phase, sc->sc_prevphase,
2000 		(long)sc->sc_dleft, sc->sc_msgpriq, sc->sc_msgout,
2001 		NCRDMA_ISACTIVE(sc) ? "DMA active" : "");
2002 #if NCR53C9X_DEBUG > 1
2003 	printf("TRACE: %s.", ecb->trace);
2004 #endif
2005 
2006 	s = splbio();
2007 
2008 	if (ecb->flags & ECB_ABORT) {
2009 		/* abort timed out */
2010 		printf(" AGAIN\n");
2011 		ncr53c9x_init(sc, 1);
2012 	} else {
2013 		/* abort the operation that has timed out */
2014 		printf("\n");
2015 		xs->error = XS_TIMEOUT;
2016 		ncr53c9x_abort(sc, ecb);
2017 	}
2018 
2019 	splx(s);
2020 }
2021