xref: /openbsd-src/sys/dev/ic/ncr53c9x.c (revision 99fd087599a8791921855f21bd7e36130f39aadc)
1 /*	$OpenBSD: ncr53c9x.c,v 1.68 2020/02/14 18:37:03 krw Exp $	*/
2 /*     $NetBSD: ncr53c9x.c,v 1.56 2000/11/30 14:41:46 thorpej Exp $    */
3 
4 /*
5  * Copyright (c) 1996 Charles M. Hannum.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. All advertising materials mentioning features or use of this software
16  *    must display the following acknowledgement:
17  *	This product includes software developed by Charles M. Hannum.
18  * 4. The name of the author may not be used to endorse or promote products
19  *    derived from this software without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1994 Peter Galbavy
35  * Copyright (c) 1995 Paul Kranenburg
36  * All rights reserved.
37  *
38  * Redistribution and use in source and binary forms, with or without
39  * modification, are permitted provided that the following conditions
40  * are met:
41  * 1. Redistributions of source code must retain the above copyright
42  *    notice, this list of conditions and the following disclaimer.
43  * 2. Redistributions in binary form must reproduce the above copyright
44  *    notice, this list of conditions and the following disclaimer in the
45  *    documentation and/or other materials provided with the distribution.
46  *
47  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
48  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
49  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
50  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
51  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
52  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
53  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
54  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
55  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
56  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
57  * POSSIBILITY OF SUCH DAMAGE.
58  */
59 
60 /*
61  * Based on aic6360 by Jarle Greipsland
62  *
63  * Acknowledgements: Many of the algorithms used in this driver are
64  * inspired by the work of Julian Elischer (julian@tfs.com) and
65  * Charles Hannum (mycroft@duality.gnu.ai.mit.edu).  Thanks a million!
66  */
67 
68 #include <sys/param.h>
69 #include <sys/systm.h>
70 #include <sys/kernel.h>
71 #include <sys/errno.h>
72 #include <sys/ioctl.h>
73 #include <sys/device.h>
74 #include <sys/malloc.h>
75 #include <sys/queue.h>
76 #include <sys/pool.h>
77 
78 #include <scsi/scsi_all.h>
79 #include <scsi/scsiconf.h>
80 #include <scsi/scsi_message.h>
81 
82 #include <machine/cpu.h>
83 
84 #include <dev/ic/ncr53c9xreg.h>
85 #include <dev/ic/ncr53c9xvar.h>
86 
87 #ifdef NCR53C9X_DEBUG
88 int ncr53c9x_debug = 0; /*NCR_SHOWPHASE|NCR_SHOWMISC|NCR_SHOWTRAC|NCR_SHOWCMDS;*/
89 #endif
90 #ifdef DEBUG
91 int ncr53c9x_notag = 0;
92 #endif
93 
94 /*static*/ void	ncr53c9x_readregs(struct ncr53c9x_softc *);
95 /*static*/ void	ncr53c9x_select(struct ncr53c9x_softc *,
96 					    struct ncr53c9x_ecb *);
97 /*static*/ int ncr53c9x_reselect(struct ncr53c9x_softc *, int, int, int);
98 /*static*/ void	ncr53c9x_scsi_reset(struct ncr53c9x_softc *);
99 /*static*/ int	ncr53c9x_poll(struct ncr53c9x_softc *,
100 					    struct scsi_xfer *, int);
101 /*static*/ void	ncr53c9x_sched(struct ncr53c9x_softc *);
102 /*static*/ void	ncr53c9x_done(struct ncr53c9x_softc *,
103 					    struct ncr53c9x_ecb *);
104 /*static*/ void	ncr53c9x_msgin(struct ncr53c9x_softc *);
105 /*static*/ void	ncr53c9x_msgout(struct ncr53c9x_softc *);
106 /*static*/ void	ncr53c9x_timeout(void *arg);
107 /*static*/ void	ncr53c9x_abort(struct ncr53c9x_softc *,
108 					    struct ncr53c9x_ecb *);
109 /*static*/ void ncr53c9x_dequeue(struct ncr53c9x_softc *,
110 					    struct ncr53c9x_ecb *);
111 
112 void ncr53c9x_sense(struct ncr53c9x_softc *,
113 					    struct ncr53c9x_ecb *);
114 void ncr53c9x_free_ecb(void *, void *);
115 void *ncr53c9x_get_ecb(void *);
116 
117 static inline int ncr53c9x_stp2cpb(struct ncr53c9x_softc *, int);
118 static inline void ncr53c9x_setsync(struct ncr53c9x_softc *,
119 					    struct ncr53c9x_tinfo *);
120 static struct ncr53c9x_linfo *ncr53c9x_lunsearch(struct ncr53c9x_tinfo *,
121     int64_t lun);
122 
123 static void ncr53c9x_wrfifo(struct ncr53c9x_softc *, u_char *, int);
124 static int ncr53c9x_rdfifo(struct ncr53c9x_softc *, int);
125 #define NCR_RDFIFO_START	0
126 #define NCR_RDFIFO_CONTINUE	1
127 
128 #define NCR_SET_COUNT(sc, size) do {						\
129 			NCR_WRITE_REG((sc), NCR_TCL, (size));			\
130 			NCR_WRITE_REG((sc), NCR_TCM, (size) >> 8);		\
131 			if ((sc->sc_cfg2 & NCRCFG2_FE) ||			\
132 			    (sc->sc_rev == NCR_VARIANT_FAS366)) {		\
133 				NCR_WRITE_REG((sc), NCR_TCH, (size) >> 16);	\
134 			}							\
135 			if (sc->sc_rev == NCR_VARIANT_FAS366) {			\
136 				NCR_WRITE_REG(sc, NCR_RCH, 0);			\
137 			}							\
138 } while (0)
139 
140 static int ecb_pool_initialized = 0;
141 static struct scsi_iopool ecb_iopool;
142 static struct pool ecb_pool;
143 
144 struct cfdriver esp_cd = {
145 	NULL, "esp", DV_DULL
146 };
147 
148 void	ncr53c9x_scsi_cmd(struct scsi_xfer *);
149 int	ncr53c9x_scsi_probe(struct scsi_link *);
150 void	ncr53c9x_scsi_free(struct scsi_link *);
151 
152 struct scsi_adapter ncr53c9x_switch = {
153 	ncr53c9x_scsi_cmd, NULL, ncr53c9x_scsi_probe,
154 	ncr53c9x_scsi_free, NULL
155 };
156 
157 /*
158  * Names for the NCR53c9x variants, corresponding to the variant tags
159  * in ncr53c9xvar.h.
160  */
161 const char *ncr53c9x_variant_names[] = {
162 	"ESP100",
163 	"ESP100A",
164 	"ESP200",
165 	"NCR53C94",
166 	"NCR53C96",
167 	"ESP406",
168 	"FAS408",
169 	"FAS216",
170 	"AM53C974",
171 	"FAS366/HME",
172 };
173 
174 /*
175  * Search linked list for LUN info by LUN id.
176  */
177 static struct ncr53c9x_linfo *
178 ncr53c9x_lunsearch(ti, lun)
179 	struct ncr53c9x_tinfo *ti;
180 	int64_t lun;
181 {
182 	struct ncr53c9x_linfo *li;
183 	LIST_FOREACH(li, &ti->luns, link)
184 	    if (li->lun == lun)
185 		    return (li);
186 	return (NULL);
187 }
188 
189 /*
190  * Attach this instance, and then all the sub-devices
191  */
192 void
193 ncr53c9x_attach(sc)
194 	struct ncr53c9x_softc *sc;
195 {
196 	struct scsibus_attach_args saa;
197 
198 	/*
199 	 * Allocate SCSI message buffers.
200 	 * Front-ends can override allocation to avoid alignment
201 	 * handling in the DMA engines. Note that ncr53c9x_msgout()
202 	 * can request a 1 byte DMA transfer.
203 	 */
204 	if (sc->sc_omess == NULL)
205 		sc->sc_omess = malloc(NCR_MAX_MSG_LEN, M_DEVBUF, M_NOWAIT);
206 
207 	if (sc->sc_imess == NULL)
208 		sc->sc_imess = malloc(NCR_MAX_MSG_LEN+1, M_DEVBUF, M_NOWAIT);
209 
210 	if (sc->sc_omess == NULL || sc->sc_imess == NULL) {
211 		printf("out of memory\n");
212 		return;
213 	}
214 
215 	/*
216 	 * Note, the front-end has set us up to print the chip variation.
217 	 */
218 	if (sc->sc_rev >= NCR_VARIANT_MAX) {
219 		printf("\n%s: unknown variant %d, devices not attached\n",
220 		    sc->sc_dev.dv_xname, sc->sc_rev);
221 		return;
222 	}
223 
224 	printf(": %s, %dMHz\n", ncr53c9x_variant_names[sc->sc_rev],
225 	    sc->sc_freq);
226 
227 	sc->sc_ccf = FREQTOCCF(sc->sc_freq);
228 
229 	/* The value *must not* be == 1. Make it 2 */
230 	if (sc->sc_ccf == 1)
231 		sc->sc_ccf = 2;
232 
233 	/*
234 	 * The recommended timeout is 250ms. This register is loaded
235 	 * with a value calculated as follows, from the docs:
236 	 *
237 	 *		(timout period) x (CLK frequency)
238 	 *	reg = -------------------------------------
239 	 *		 8192 x (Clock Conversion Factor)
240 	 *
241 	 * Since CCF has a linear relation to CLK, this generally computes
242 	 * to the constant of 153.
243 	 */
244 	sc->sc_timeout = ((250 * 1000) * sc->sc_freq) / (8192 * sc->sc_ccf);
245 
246 	/* CCF register only has 3 bits; 0 is actually 8 */
247 	sc->sc_ccf &= 7;
248 
249 	/* Find how many targets we need to support */
250 	switch (sc->sc_rev) {
251 	case NCR_VARIANT_FAS366:
252 		sc->sc_ntarg = 16;
253 		break;
254 	default:
255 		sc->sc_ntarg = 8;
256 		break;
257 	}
258 
259 	/* Reset state & bus */
260 	sc->sc_cfflags = sc->sc_dev.dv_cfdata->cf_flags;
261 	sc->sc_state = 0;
262 	ncr53c9x_init(sc, 1);
263 
264 	/*
265 	 * fill in the prototype scsi_link.
266 	 */
267 	sc->sc_link.adapter_softc = sc;
268 	sc->sc_link.adapter_target = sc->sc_id;
269 	sc->sc_link.adapter = &ncr53c9x_switch;
270 	sc->sc_link.openings = 2;
271 	sc->sc_link.adapter_buswidth = sc->sc_ntarg;
272 	sc->sc_link.pool = &ecb_iopool;
273 
274 	bzero(&saa, sizeof(saa));
275 	saa.saa_sc_link = &sc->sc_link;
276 
277 	/*
278 	 * Now try to attach all the sub-devices
279 	 */
280 	config_found(&sc->sc_dev, &saa, scsiprint);
281 }
282 
283 /*
284  * This is the generic ncr53c9x reset function. It does not reset the SCSI bus,
285  * only this controller, but kills any on-going commands, and also stops
286  * and resets the DMA.
287  *
288  * After reset, registers are loaded with the defaults from the attach
289  * routine above.
290  */
291 void
292 ncr53c9x_reset(sc)
293 	struct ncr53c9x_softc *sc;
294 {
295 
296 	/* reset DMA first */
297 	NCRDMA_RESET(sc);
298 
299 	/* reset SCSI chip */
300 	NCRCMD(sc, NCRCMD_RSTCHIP);
301 	NCRCMD(sc, NCRCMD_NOP);
302 	DELAY(500);
303 
304 	/* do these backwards, and fall through */
305 	switch (sc->sc_rev) {
306 	case NCR_VARIANT_ESP406:
307 	case NCR_VARIANT_FAS408:
308 		NCR_WRITE_REG(sc, NCR_CFG5, sc->sc_cfg5 | NCRCFG5_SINT);
309 		NCR_WRITE_REG(sc, NCR_CFG4, sc->sc_cfg4);
310 	case NCR_VARIANT_AM53C974:
311 	case NCR_VARIANT_FAS216:
312 	case NCR_VARIANT_NCR53C94:
313 	case NCR_VARIANT_NCR53C96:
314 	case NCR_VARIANT_ESP200:
315 		sc->sc_features |= NCR_F_HASCFG3;
316 		NCR_WRITE_REG(sc, NCR_CFG3, sc->sc_cfg3);
317 	case NCR_VARIANT_ESP100A:
318 		sc->sc_features |= NCR_F_SELATN3;
319 		NCR_WRITE_REG(sc, NCR_CFG2, sc->sc_cfg2);
320 	case NCR_VARIANT_ESP100:
321 		NCR_WRITE_REG(sc, NCR_CFG1, sc->sc_cfg1);
322 		NCR_WRITE_REG(sc, NCR_CCF, sc->sc_ccf);
323 		NCR_WRITE_REG(sc, NCR_SYNCOFF, 0);
324 		NCR_WRITE_REG(sc, NCR_TIMEOUT, sc->sc_timeout);
325 		break;
326 	case NCR_VARIANT_FAS366:
327 		sc->sc_features |=
328 		    NCR_F_SELATN3 | NCR_F_HASCFG3 | NCR_F_FASTSCSI;
329 		sc->sc_cfg3 = NCRFASCFG3_FASTCLK | NCRFASCFG3_OBAUTO;
330 		sc->sc_cfg3_fscsi = NCRFASCFG3_FASTSCSI;
331 		NCR_WRITE_REG(sc, NCR_CFG3, sc->sc_cfg3);
332 		sc->sc_cfg2 = 0; /* NCRCFG2_HMEFE | NCRCFG2_HME32 */
333 		NCR_WRITE_REG(sc, NCR_CFG2, sc->sc_cfg2);
334 		NCR_WRITE_REG(sc, NCR_CFG1, sc->sc_cfg1);
335 		NCR_WRITE_REG(sc, NCR_CCF, sc->sc_ccf);
336 		NCR_WRITE_REG(sc, NCR_SYNCOFF, 0);
337 		NCR_WRITE_REG(sc, NCR_TIMEOUT, sc->sc_timeout);
338 		break;
339 	default:
340 		printf("%s: unknown revision code, assuming ESP100\n",
341 		    sc->sc_dev.dv_xname);
342 		NCR_WRITE_REG(sc, NCR_CFG1, sc->sc_cfg1);
343 		NCR_WRITE_REG(sc, NCR_CCF, sc->sc_ccf);
344 		NCR_WRITE_REG(sc, NCR_SYNCOFF, 0);
345 		NCR_WRITE_REG(sc, NCR_TIMEOUT, sc->sc_timeout);
346 	}
347 
348 	if (sc->sc_rev == NCR_VARIANT_AM53C974)
349 		NCR_WRITE_REG(sc, NCR_AMDCFG4, sc->sc_cfg4);
350 
351 #if 0
352 	printf("%s: ncr53c9x_reset: revision %d\n",
353 	    sc->sc_dev.dv_xname, sc->sc_rev);
354 	printf("%s: ncr53c9x_reset: cfg1 0x%x, cfg2 0x%x, cfg3 0x%x, ccf 0x%x, timeout 0x%x\n",
355 	    sc->sc_dev.dv_xname,
356 	    sc->sc_cfg1, sc->sc_cfg2, sc->sc_cfg3,
357 	    sc->sc_ccf, sc->sc_timeout);
358 #endif
359 }
360 
361 /*
362  * Reset the SCSI bus, but not the chip
363  */
364 void
365 ncr53c9x_scsi_reset(sc)
366 	struct ncr53c9x_softc *sc;
367 {
368 
369 	(*sc->sc_glue->gl_dma_stop)(sc);
370 
371 	printf("%s: resetting SCSI bus\n", sc->sc_dev.dv_xname);
372 	NCRCMD(sc, NCRCMD_RSTSCSI);
373 }
374 
375 /*
376  * Initialize ncr53c9x state machine
377  */
378 void
379 ncr53c9x_init(sc, doreset)
380 	struct ncr53c9x_softc *sc;
381 	int doreset;
382 {
383 	struct ncr53c9x_ecb *ecb;
384 	struct ncr53c9x_linfo *li;
385 	int r, i;
386 
387 	NCR_TRACE(("[NCR_INIT(%d) %d] ", doreset, sc->sc_state));
388 
389 	if (!ecb_pool_initialized) {
390 		/* All instances share this pool */
391 		pool_init(&ecb_pool, sizeof(struct ncr53c9x_ecb), 0, IPL_BIO,
392 		    0, "ncr53c9x_ecb", NULL);
393 		scsi_iopool_init(&ecb_iopool, NULL,
394 		    ncr53c9x_get_ecb, ncr53c9x_free_ecb);
395 		ecb_pool_initialized = 1;
396 	}
397 
398 	if (sc->sc_state == 0) {
399 		/* First time through; initialize. */
400 
401 		TAILQ_INIT(&sc->ready_list);
402 		sc->sc_nexus = NULL;
403 		bzero(sc->sc_tinfo, sizeof(sc->sc_tinfo));
404 		for (r = 0; r < sc->sc_ntarg; r++) {
405 			LIST_INIT(&sc->sc_tinfo[r].luns);
406 		}
407 	} else {
408 		/* Cancel any active commands. */
409 		sc->sc_state = NCR_CLEANING;
410 		sc->sc_msgify = 0;
411 		if ((ecb = sc->sc_nexus) != NULL) {
412 			ecb->xs->error = XS_TIMEOUT;
413 			ncr53c9x_done(sc, ecb);
414 		}
415 		for (r = 0; r < sc->sc_ntarg; r++) {
416 			LIST_FOREACH(li, &sc->sc_tinfo[r].luns, link) {
417 				if ((ecb = li->untagged)) {
418 					li->untagged = NULL;
419 					/*
420 					 * XXXXXXX
421 					 * Should we terminate a command
422 					 * that never reached the disk?
423 					 */
424 					li->busy = 0;
425 					ecb->xs->error = XS_TIMEOUT;
426 					ncr53c9x_done(sc, ecb);
427 				}
428 				for (i = 0; i < 256; i++)
429 					if ((ecb = li->queued[i])) {
430 						li->queued[i] = NULL;
431 						ecb->xs->error = XS_TIMEOUT;
432 						ncr53c9x_done(sc, ecb);
433 					}
434 				li->used = 0;
435 			}
436 		}
437 	}
438 
439 	/*
440 	 * reset the chip to a known state
441 	 */
442 	ncr53c9x_reset(sc);
443 
444 	sc->sc_phase = sc->sc_prevphase = INVALID_PHASE;
445 	for (r = 0; r < sc->sc_ntarg; r++) {
446 		struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[r];
447 /* XXX - config flags per target: low bits: no reselect; high bits: no synch */
448 
449                 ti->flags = ((!(sc->sc_cfflags & (1 << (r + 16))) &&
450 		    sc->sc_minsync) ? 0 : T_SYNCHOFF) |
451 		    ((sc->sc_cfflags & (1 << r)) ?  T_RSELECTOFF : 0) |
452 		    T_NEED_TO_RESET;
453 #ifdef DEBUG
454 		 if (ncr53c9x_notag)
455 			 ti->flags &= ~T_TAG;
456 #endif
457 		ti->period = sc->sc_minsync;
458 		ti->offset = 0;
459 		ti->cfg3 = 0;
460 	}
461 
462 	if (doreset) {
463 		sc->sc_state = NCR_SBR;
464 		NCRCMD(sc, NCRCMD_RSTSCSI);
465 		/*
466 		 * XXX gross...
467 		 * On some systems, commands issued too close to a reset
468 		 * do not work correctly. We'll force a short delay on
469 		 * known-to-be-sensitive chips.
470 		 */
471 		switch (sc->sc_rev) {
472 		case NCR_VARIANT_NCR53C94:
473 			DELAY(600000);	/* 600ms */
474 			break;
475 		case NCR_VARIANT_NCR53C96:
476 			DELAY(100000);	/* 100ms */
477 			break;
478 		}
479 	} else {
480 		sc->sc_state = NCR_IDLE;
481 		ncr53c9x_sched(sc);
482 	}
483 }
484 
485 /*
486  * Read the NCR registers, and save their contents for later use.
487  * NCR_STAT, NCR_STEP & NCR_INTR are mostly zeroed out when reading
488  * NCR_INTR - so make sure it is the last read.
489  *
490  * I think that (from reading the docs) most bits in these registers
491  * only make sense when he DMA CSR has an interrupt showing. Call only
492  * if an interrupt is pending.
493  */
494 __inline__ void
495 ncr53c9x_readregs(sc)
496 	struct ncr53c9x_softc *sc;
497 {
498 
499 	sc->sc_espstat = NCR_READ_REG(sc, NCR_STAT);
500 	/* Only the stepo bits are of interest */
501 	sc->sc_espstep = NCR_READ_REG(sc, NCR_STEP) & NCRSTEP_MASK;
502 
503 	if (sc->sc_rev == NCR_VARIANT_FAS366)
504 		sc->sc_espstat2 = NCR_READ_REG(sc, NCR_STAT2);
505 
506 	sc->sc_espintr = NCR_READ_REG(sc, NCR_INTR);
507 
508 	if (sc->sc_glue->gl_clear_latched_intr != NULL)
509 		(*sc->sc_glue->gl_clear_latched_intr)(sc);
510 
511 	/*
512 	 * Determine the SCSI bus phase, return either a real SCSI bus phase
513 	 * or some pseudo phase we use to detect certain exceptions.
514 	 */
515 
516 	sc->sc_phase = (sc->sc_espintr & NCRINTR_DIS)
517 			? /* Disconnected */ BUSFREE_PHASE
518 			: sc->sc_espstat & NCRSTAT_PHASE;
519 
520 	NCR_MISC(("regs[intr=%02x,stat=%02x,step=%02x,stat2=%02x] ",
521 		sc->sc_espintr, sc->sc_espstat, sc->sc_espstep, sc->sc_espstat2));
522 }
523 
524 /*
525  * Convert Synchronous Transfer Period to chip register Clock Per Byte value.
526  */
527 static inline int
528 ncr53c9x_stp2cpb(sc, period)
529 	struct ncr53c9x_softc *sc;
530 	int period;
531 {
532 	int v;
533 	v = (sc->sc_freq * period) / 250;
534 	if (ncr53c9x_cpb2stp(sc, v) < period)
535 		/* Correct round-down error */
536 		v++;
537 	return (v);
538 }
539 
540 static inline void
541 ncr53c9x_setsync(sc, ti)
542 	struct ncr53c9x_softc *sc;
543 	struct ncr53c9x_tinfo *ti;
544 {
545 	u_char syncoff, synctp;
546 	u_char cfg3 = sc->sc_cfg3 | ti->cfg3;
547 
548 	if (ti->flags & T_SYNCMODE) {
549 		syncoff = ti->offset;
550 		synctp = ncr53c9x_stp2cpb(sc, ti->period);
551 		if (sc->sc_features & NCR_F_FASTSCSI) {
552 			/*
553 			 * If the period is 200ns or less (ti->period <= 50),
554 			 * put the chip in Fast SCSI mode.
555 			 */
556 			if (ti->period <= 50)
557 				/*
558 				 * There are (at least) 4 variations of the
559 				 * configuration 3 register.  The drive attach
560 				 * routine sets the appropriate bit to put the
561 				 * chip into Fast SCSI mode so that it doesn't
562 				 * have to be figured out here each time.
563 				 */
564 				cfg3 |= (sc->sc_rev == NCR_VARIANT_AM53C974) ?
565 				    NCRAMDCFG3_FSCSI : NCRCFG3_FSCSI;
566 		}
567 
568 		/*
569 		 * Am53c974 requires different SYNCTP values when the
570 		 * FSCSI bit is off.
571 		 */
572 		if (sc->sc_rev == NCR_VARIANT_AM53C974 &&
573 		    (cfg3 & NCRAMDCFG3_FSCSI) == 0)
574 			synctp--;
575 	} else {
576 		syncoff = 0;
577 		synctp = 0;
578 	}
579 
580 	if (sc->sc_features & NCR_F_HASCFG3)
581 		NCR_WRITE_REG(sc, NCR_CFG3, cfg3);
582 
583 	NCR_WRITE_REG(sc, NCR_SYNCOFF, syncoff);
584 	NCR_WRITE_REG(sc, NCR_SYNCTP, synctp);
585 }
586 
587 /*
588  * Send a command to a target, set the driver state to NCR_SELECTING
589  * and let the caller take care of the rest.
590  *
591  * Keeping this as a function allows me to say that this may be done
592  * by DMA instead of programmed I/O soon.
593  */
594 void
595 ncr53c9x_select(sc, ecb)
596 	struct ncr53c9x_softc *sc;
597 	struct ncr53c9x_ecb *ecb;
598 {
599 	struct scsi_link *sc_link = ecb->xs->sc_link;
600 	int target = sc_link->target;
601 	int lun = sc_link->lun;
602 	struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[target];
603 	int tiflags = ti->flags;
604 	u_char *cmd;
605 	int clen;
606 	int selatn3, selatns;
607 	size_t dmasize;
608 
609 	NCR_TRACE(("[ncr53c9x_select(t%d,l%d,cmd:%x,tag%x,%x)] ",
610 		   target, lun, ecb->cmd.cmd.opcode, ecb->tag[0], ecb->tag[1]));
611 
612 	sc->sc_state = NCR_SELECTING;
613 	/*
614 	 * Schedule the timeout now, the first time we will go away
615 	 * expecting to come back due to an interrupt, because it is
616 	 * always possible that the interrupt may never happen.
617 	 */
618 	if ((ecb->xs->flags & SCSI_POLL) == 0) {
619 		int timeout = ecb->timeout;
620 
621 		if (timeout > 1000000)
622 			timeout = (timeout / 1000) * hz;
623 		else
624 			timeout = (timeout * hz) / 1000;
625 		timeout_add(&ecb->to, timeout);
626 	}
627 
628 	/*
629 	 * The docs say the target register is never reset, and I
630 	 * can't think of a better place to set it
631 	 */
632 	if (sc->sc_rev == NCR_VARIANT_FAS366) {
633 		NCRCMD(sc, NCRCMD_FLUSH);
634 		NCR_WRITE_REG(sc, NCR_SELID, target | NCR_BUSID_HME);
635 	} else {
636 		NCR_WRITE_REG(sc, NCR_SELID, target);
637 	}
638 	ncr53c9x_setsync(sc, ti);
639 
640 	if ((ecb->flags & ECB_SENSE) != 0) {
641 		/*
642 		 * For REQUEST SENSE, we should not send an IDENTIFY or
643 		 * otherwise mangle the target.  There should be no MESSAGE IN
644 		 * phase.
645 		 */
646 		if (sc->sc_features & NCR_F_DMASELECT) {
647 			/* setup DMA transfer for command */
648 			dmasize = clen = ecb->clen;
649 			sc->sc_cmdlen = clen;
650 			sc->sc_cmdp = (caddr_t)&ecb->cmd.cmd;
651 
652 			NCRDMA_SETUP(sc, &sc->sc_cmdp, &sc->sc_cmdlen, 0,
653 			    &dmasize);
654 			/* Program the SCSI counter */
655 			NCR_SET_COUNT(sc, dmasize);
656 
657 			if (sc->sc_rev != NCR_VARIANT_FAS366)
658 				NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA);
659 
660 			/* And get the targets attention */
661 			NCRCMD(sc, NCRCMD_SELNATN | NCRCMD_DMA);
662 			NCRDMA_GO(sc);
663 		} else {
664 			ncr53c9x_wrfifo(sc, (u_char *)&ecb->cmd.cmd, ecb->clen);
665 			sc->sc_cmdlen = 0;
666 			NCRCMD(sc, NCRCMD_SELNATN);
667 		}
668 		return;
669 	}
670 
671 	selatn3 = selatns = 0;
672 	if (ecb->tag[0] != 0) {
673 		if (sc->sc_features & NCR_F_SELATN3)
674 			/* use SELATN3 to send tag messages */
675 			selatn3 = 1;
676 		else
677 			/* We don't have SELATN3; use SELATNS to send tags */
678 			selatns = 1;
679 	}
680 
681 	if (ti->flags & T_NEGOTIATE) {
682 		/* We have to use SELATNS to send sync/wide messages */
683 		selatn3 = 0;
684 		selatns = 1;
685 	}
686 
687 	cmd = (u_char *)&ecb->cmd.cmd;
688 
689 	if (selatn3) {
690 		/* We'll use tags with SELATN3 */
691 		clen = ecb->clen + 3;
692 		cmd -= 3;
693 		cmd[0] = MSG_IDENTIFY(lun, 1);	/* msg[0] */
694 		cmd[1] = ecb->tag[0];		/* msg[1] */
695 		cmd[2] = ecb->tag[1];		/* msg[2] */
696 	} else {
697 		/* We don't have tags, or will send messages with SELATNS */
698 		clen = ecb->clen + 1;
699 		cmd -= 1;
700 		cmd[0] = MSG_IDENTIFY(lun, (tiflags & T_RSELECTOFF) == 0);
701 	}
702 
703 	if ((sc->sc_features & NCR_F_DMASELECT) && !selatns) {
704 
705 		/* setup DMA transfer for command */
706 		dmasize = clen;
707 		sc->sc_cmdlen = clen;
708 		sc->sc_cmdp = cmd;
709 
710 		NCRDMA_SETUP(sc, &sc->sc_cmdp, &sc->sc_cmdlen, 0, &dmasize);
711 		/* Program the SCSI counter */
712 		NCR_SET_COUNT(sc, dmasize);
713 
714 		/* load the count in */
715 		/* if (sc->sc_rev != NCR_VARIANT_FAS366) */
716 			NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA);
717 
718 		/* And get the targets attention */
719 		if (selatn3) {
720 			sc->sc_msgout = SEND_TAG;
721 			sc->sc_flags |= NCR_ATN;
722 			NCRCMD(sc, NCRCMD_SELATN3 | NCRCMD_DMA);
723 		} else
724 			NCRCMD(sc, NCRCMD_SELATN | NCRCMD_DMA);
725 		NCRDMA_GO(sc);
726 		return;
727 	}
728 
729 	/*
730 	 * Who am I. This is where we tell the target that we are
731 	 * happy for it to disconnect etc.
732 	 */
733 
734 	/* Now get the command into the FIFO */
735 	sc->sc_cmdlen = 0;
736 	ncr53c9x_wrfifo(sc, cmd, clen);
737 
738 	/* And get the targets attention */
739 	if (selatns) {
740 		NCR_MISC(("SELATNS \n"));
741 		/* Arbitrate, select and stop after IDENTIFY message */
742 		NCRCMD(sc, NCRCMD_SELATNS);
743 	} else if (selatn3) {
744 		sc->sc_msgout = SEND_TAG;
745 		sc->sc_flags |= NCR_ATN;
746 		NCRCMD(sc, NCRCMD_SELATN3);
747 	} else
748 		NCRCMD(sc, NCRCMD_SELATN);
749 }
750 
751 /*
752  * DRIVER FUNCTIONS CALLABLE FROM HIGHER LEVEL DRIVERS
753  */
754 
755 void *
756 ncr53c9x_get_ecb(void *null)
757 {
758 	struct ncr53c9x_ecb *ecb;
759 
760 	ecb = pool_get(&ecb_pool, M_NOWAIT|M_ZERO);
761 	if (ecb == NULL)
762 		return (NULL);
763 
764 	timeout_set(&ecb->to, ncr53c9x_timeout, ecb);
765 	ecb->flags |= ECB_ALLOC;
766 
767 	return (ecb);
768 }
769 
770 void
771 ncr53c9x_free_ecb(void *null, void *ecb)
772 {
773 	pool_put(&ecb_pool, ecb);
774 }
775 
776 int
777 ncr53c9x_scsi_probe(struct scsi_link *sc_link)
778 {
779 	struct ncr53c9x_softc *sc = sc_link->adapter_softc;
780 	struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[sc_link->target];
781 	struct ncr53c9x_linfo *li;
782 	int64_t lun = sc_link->lun;
783 	int s;
784 
785 	/* Initialize LUN info and add to list. */
786 	li = malloc(sizeof(*li), M_DEVBUF, M_WAITOK | M_ZERO);
787 	if (li == NULL)
788 		return (ENOMEM);
789 
790 	li->last_used = time_second;
791 	li->lun = lun;
792 
793 	s = splbio();
794 	LIST_INSERT_HEAD(&ti->luns, li, link);
795 	if (lun < NCR_NLUN)
796 		ti->lun[lun] = li;
797 	splx(s);
798 
799 	return (0);
800 
801 }
802 
803 void
804 ncr53c9x_scsi_free(struct scsi_link *sc_link)
805 {
806 	struct ncr53c9x_softc *sc = sc_link->adapter_softc;
807 	struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[sc_link->target];
808 	struct ncr53c9x_linfo *li;
809 	int64_t lun = sc_link->lun;
810 	int s;
811 
812 	s = splbio();
813 	li = TINFO_LUN(ti, lun);
814 
815 	LIST_REMOVE(li, link);
816 	if (lun < NCR_NLUN)
817 		ti->lun[lun] = NULL;
818 	splx(s);
819 
820 	free(li, M_DEVBUF, 0);
821 }
822 
823 /*
824  * Start a SCSI-command
825  * This function is called by the higher level SCSI-driver to queue/run
826  * SCSI-commands.
827  */
828 void
829 ncr53c9x_scsi_cmd(xs)
830 	struct scsi_xfer *xs;
831 {
832 	struct scsi_link *sc_link = xs->sc_link;
833 	struct ncr53c9x_softc *sc = sc_link->adapter_softc;
834 	struct ncr53c9x_ecb *ecb;
835 	struct ncr53c9x_tinfo *ti;
836 	struct ncr53c9x_linfo *li;
837 	int64_t lun = sc_link->lun;
838 	int s, flags;
839 
840 	NCR_TRACE(("[ncr53c9x_scsi_cmd] "));
841 	NCR_CMDS(("[0x%x, %d]->%d ", (int)xs->cmd->opcode, xs->cmdlen,
842 	    sc_link->target));
843 
844 	/*
845 	 * Commands larger than 12 bytes seem to confuse the chip
846 	 * (at least on FAS366 flavours).
847 	 */
848 	if (xs->cmdlen > 12) {
849 		memset(&xs->sense, 0, sizeof(xs->sense));
850 		/* sense data borrowed from gdt(4) */
851 		xs->sense.error_code = SSD_ERRCODE_VALID | SSD_ERRCODE_CURRENT;
852 		xs->sense.flags = SKEY_ILLEGAL_REQUEST;
853 		xs->sense.add_sense_code = 0x20; /* illcmd */
854 		xs->error = XS_SENSE;
855 		scsi_done(xs);
856 		return;
857 	}
858 
859 	flags = xs->flags;
860 	ti = &sc->sc_tinfo[sc_link->target];
861 	li = TINFO_LUN(ti, lun);
862 
863 	/* Initialize ecb */
864 	ecb = xs->io;
865 	ecb->xs = xs;
866 	ecb->timeout = xs->timeout;
867 
868 	if (flags & SCSI_RESET) {
869 		ecb->flags |= ECB_RESET;
870 		ecb->clen = 0;
871 		ecb->dleft = 0;
872 	} else {
873 		bcopy(xs->cmd, &ecb->cmd.cmd, xs->cmdlen);
874 		ecb->clen = xs->cmdlen;
875 		ecb->daddr = xs->data;
876 		ecb->dleft = xs->datalen;
877 	}
878 	ecb->stat = 0;
879 
880 	s = splbio();
881 
882 	TAILQ_INSERT_TAIL(&sc->ready_list, ecb, chain);
883 	ecb->flags |= ECB_READY;
884 	if (sc->sc_state == NCR_IDLE)
885 		ncr53c9x_sched(sc);
886 
887 	splx(s);
888 
889 	if ((flags & SCSI_POLL) == 0)
890 		return;
891 
892 	/* Not allowed to use interrupts, use polling instead */
893 	if (ncr53c9x_poll(sc, xs, ecb->timeout)) {
894 		ncr53c9x_timeout(ecb);
895 		if (ncr53c9x_poll(sc, xs, ecb->timeout))
896 			ncr53c9x_timeout(ecb);
897 	}
898 }
899 
900 /*
901  * Used when interrupt driven I/O isn't allowed, e.g. during boot.
902  */
903 int
904 ncr53c9x_poll(sc, xs, count)
905 	struct ncr53c9x_softc *sc;
906 	struct scsi_xfer *xs;
907 	int count;
908 {
909 	int s;
910 
911 	NCR_TRACE(("[ncr53c9x_poll] "));
912 	while (count) {
913 		if (NCRDMA_ISINTR(sc)) {
914 			s = splbio();
915 			ncr53c9x_intr(sc);
916 			splx(s);
917 		}
918 #if alternatively
919 		if (NCR_READ_REG(sc, NCR_STAT) & NCRSTAT_INT) {
920 			s = splbio();
921 			ncr53c9x_intr(sc);
922 			splx(s);
923 		}
924 #endif
925 		if ((xs->flags & ITSDONE) != 0)
926 			return (0);
927 		s = splbio();
928 		if (sc->sc_state == NCR_IDLE) {
929 			NCR_TRACE(("[ncr53c9x_poll: rescheduling] "));
930 			ncr53c9x_sched(sc);
931 		}
932 		splx(s);
933 		DELAY(1000);
934 		count--;
935 	}
936 	return (1);
937 }
938 
939 
940 /*
941  * LOW LEVEL SCSI UTILITIES
942  */
943 
944 /*
945  * Schedule a scsi operation.  This has now been pulled out of the interrupt
946  * handler so that we may call it from ncr53c9x_scsi_cmd and ncr53c9x_done.
947  * This may save us an unnecessary interrupt just to get things going.
948  * Should only be called when state == NCR_IDLE and at bio pl.
949  */
950 void
951 ncr53c9x_sched(sc)
952 	struct ncr53c9x_softc *sc;
953 {
954 	struct ncr53c9x_ecb *ecb;
955 	struct scsi_link *sc_link;
956 	struct ncr53c9x_tinfo *ti;
957 	int lun;
958 	struct ncr53c9x_linfo *li;
959 	int s, tag;
960 
961 	NCR_TRACE(("[ncr53c9x_sched] "));
962 	if (sc->sc_state != NCR_IDLE)
963 		panic("ncr53c9x_sched: not IDLE (state=%d)", sc->sc_state);
964 
965 	/*
966 	 * Find first ecb in ready queue that is for a target/lunit
967 	 * combinations that is not busy.
968 	 */
969 	TAILQ_FOREACH(ecb, &sc->ready_list, chain) {
970 		sc_link = ecb->xs->sc_link;
971 		ti = &sc->sc_tinfo[sc_link->target];
972 		lun = sc_link->lun;
973 
974 		/* Select type of tag for this command */
975 		if ((ti->flags & (T_RSELECTOFF)) != 0)
976 			tag = 0;
977 		else if ((ti->flags & T_TAG) == 0)
978 			tag = 0;
979 		else if ((ecb->flags & ECB_SENSE) != 0)
980 			tag = 0;
981 		else
982 			tag = MSG_SIMPLE_Q_TAG;
983 #if 0
984 		/* XXXX Use tags for polled commands? */
985 		if (ecb->xs->flags & SCSI_POLL)
986 			tag = 0;
987 #endif
988 		s = splbio();
989 		li = TINFO_LUN(ti, lun);
990 		if (!li) {
991 			/* Initialize LUN info and add to list. */
992 			if ((li = malloc(sizeof(*li), M_DEVBUF,
993 			    M_NOWAIT | M_ZERO)) == NULL) {
994 				splx(s);
995 				continue;
996 			}
997 			li->lun = lun;
998 
999 			LIST_INSERT_HEAD(&ti->luns, li, link);
1000 			if (lun < NCR_NLUN)
1001 				ti->lun[lun] = li;
1002 		}
1003 		li->last_used = time_second;
1004 		if (!tag) {
1005 			/* Try to issue this as an un-tagged command */
1006 			if (!li->untagged)
1007 				li->untagged = ecb;
1008 		}
1009 		if (li->untagged) {
1010 			tag = 0;
1011 			if ((li->busy != 1) && !li->used) {
1012 				/* We need to issue this untagged command now */
1013 				ecb = li->untagged;
1014 				sc_link = ecb->xs->sc_link;
1015 			}
1016 			else {
1017 				/* Not ready yet */
1018 				splx(s);
1019 				continue;
1020 			}
1021 		}
1022 		ecb->tag[0] = tag;
1023 		if (tag) {
1024 			int i;
1025 
1026 			/* Allocate a tag */
1027 			if (li->used == 255) {
1028 				/* no free tags */
1029 				splx(s);
1030 				continue;
1031 			}
1032 			/* Start from the last used location */
1033 			for (i=li->avail; i<256; i++) {
1034 				if (li->queued[i] == NULL)
1035 					break;
1036 			}
1037 			/* Couldn't find one, start again from the beginning */
1038 			if (i == 256) {
1039 				for (i = 0; i<256; i++) {
1040 					if (li->queued[i] == NULL)
1041 						break;
1042 				}
1043 			}
1044 #ifdef DIAGNOSTIC
1045 			if (i == 256)
1046 				panic("ncr53c9x_sched: tag alloc failure");
1047 #endif
1048 
1049 			/* Save where to start next time. */
1050 			li->avail = i+1;
1051 			li->used++;
1052 
1053 			li->queued[i] = ecb;
1054 			ecb->tag[1] = i;
1055 		}
1056 		splx(s);
1057 		if (li->untagged && (li->busy != 1)) {
1058 			li->busy = 1;
1059 			TAILQ_REMOVE(&sc->ready_list, ecb, chain);
1060 			ecb->flags &= ~ECB_READY;
1061 			sc->sc_nexus = ecb;
1062 			ncr53c9x_select(sc, ecb);
1063 			break;
1064 		}
1065 		if (!li->untagged && tag) {
1066 			TAILQ_REMOVE(&sc->ready_list, ecb, chain);
1067 			ecb->flags &= ~ECB_READY;
1068 			sc->sc_nexus = ecb;
1069 			ncr53c9x_select(sc, ecb);
1070 			break;
1071 		} else
1072 			NCR_MISC(("%d:%d busy\n",
1073 				  sc_link->target,
1074 				  sc_link->lun));
1075 	}
1076 }
1077 
1078 void
1079 ncr53c9x_sense(sc, ecb)
1080 	struct ncr53c9x_softc *sc;
1081 	struct ncr53c9x_ecb *ecb;
1082 {
1083 	struct scsi_xfer *xs = ecb->xs;
1084 	struct scsi_link *sc_link = xs->sc_link;
1085 	struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[sc_link->target];
1086 	struct scsi_sense *ss = (void *)&ecb->cmd.cmd;
1087 	struct ncr53c9x_linfo *li;
1088 	int lun = sc_link->lun;
1089 
1090 	NCR_MISC(("requesting sense "));
1091 	/* Next, setup a request sense command block */
1092 	bzero(ss, sizeof(*ss));
1093 	ss->opcode = REQUEST_SENSE;
1094 	ss->byte2 = sc_link->lun << 5;
1095 	ss->length = sizeof(struct scsi_sense_data);
1096 	ecb->clen = sizeof(*ss);
1097 	ecb->daddr = (char *)&xs->sense;
1098 	ecb->dleft = sizeof(struct scsi_sense_data);
1099 	ecb->flags |= ECB_SENSE;
1100 	ecb->timeout = NCR_SENSE_TIMEOUT;
1101 	ti->senses++;
1102 	li = TINFO_LUN(ti, lun);
1103 	if (li->busy) li->busy = 0;
1104 	ncr53c9x_dequeue(sc, ecb);
1105 	li->untagged = ecb;
1106 	li->busy = 2;
1107 	if (ecb == sc->sc_nexus) {
1108 		ncr53c9x_select(sc, ecb);
1109 	} else {
1110 		TAILQ_INSERT_HEAD(&sc->ready_list, ecb, chain);
1111 		ecb->flags |= ECB_READY;
1112 		if (sc->sc_state == NCR_IDLE)
1113 			ncr53c9x_sched(sc);
1114 	}
1115 }
1116 
1117 /*
1118  * POST PROCESSING OF SCSI_CMD (usually current)
1119  */
1120 void
1121 ncr53c9x_done(sc, ecb)
1122 	struct ncr53c9x_softc *sc;
1123 	struct ncr53c9x_ecb *ecb;
1124 {
1125 	struct scsi_xfer *xs = ecb->xs;
1126 	struct scsi_link *sc_link = xs->sc_link;
1127 	struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[sc_link->target];
1128 	int lun = sc_link->lun;
1129 	struct ncr53c9x_linfo *li = TINFO_LUN(ti, lun);
1130 
1131 	NCR_TRACE(("[ncr53c9x_done(error:%x)] ", xs->error));
1132 
1133 	timeout_del(&ecb->to);
1134 
1135 	if (ecb->stat == SCSI_QUEUE_FULL) {
1136 		/*
1137 		 * Set current throttle -- we should reset
1138 		 * this periodically
1139 		 */
1140 		sc_link->openings = li->used - 1;
1141 		printf("\n%s: QFULL -- throttling to %d commands\n",
1142 		    sc->sc_dev.dv_xname, sc_link->openings);
1143 	}
1144 
1145 	/*
1146 	 * Now, if we've come here with no error code, i.e. we've kept the
1147 	 * initial XS_NOERROR, and the status code signals that we should
1148 	 * check sense, we'll need to set up a request sense cmd block and
1149 	 * push the command back into the ready queue *before* any other
1150 	 * commands for this target/lunit, else we lose the sense info.
1151 	 * We don't support chk sense conditions for the request sense cmd.
1152 	 */
1153 	if (xs->error == XS_NOERROR) {
1154 		xs->status = ecb->stat;
1155 		if ((ecb->flags & ECB_ABORT) != 0) {
1156 			xs->error = XS_TIMEOUT;
1157 		} else if ((ecb->flags & ECB_SENSE) != 0) {
1158 			xs->error = XS_SENSE;
1159 		} else if ((ecb->stat & ST_MASK) == SCSI_CHECK) {
1160 			/* First, save the return values */
1161 			xs->resid = ecb->dleft;
1162 			ncr53c9x_sense(sc, ecb);
1163 			return;
1164 		} else {
1165 			xs->resid = ecb->dleft;
1166 		}
1167 	}
1168 
1169 #ifdef NCR53C9X_DEBUG
1170 	if (ncr53c9x_debug & NCR_SHOWMISC) {
1171 		if (xs->resid != 0)
1172 			printf("resid=%lu ", (unsigned long)xs->resid);
1173 		if (xs->error == XS_SENSE)
1174 			printf("sense=0x%02x\n", xs->sense.error_code);
1175 		else
1176 			printf("error=%d\n", xs->error);
1177 	}
1178 #endif
1179 
1180 	/*
1181 	 * Remove the ECB from whatever queue it's on.
1182 	 */
1183 	ncr53c9x_dequeue(sc, ecb);
1184 	if (ecb == sc->sc_nexus) {
1185 		sc->sc_nexus = NULL;
1186 		if (sc->sc_state != NCR_CLEANING) {
1187 			sc->sc_state = NCR_IDLE;
1188 			ncr53c9x_sched(sc);
1189 		}
1190 	}
1191 
1192 	ti->cmds++;
1193 	scsi_done(xs);
1194 }
1195 
1196 void
1197 ncr53c9x_dequeue(sc, ecb)
1198 	struct ncr53c9x_softc *sc;
1199 	struct ncr53c9x_ecb *ecb;
1200 {
1201 	struct ncr53c9x_tinfo *ti =
1202 	    &sc->sc_tinfo[ecb->xs->sc_link->target];
1203 	struct ncr53c9x_linfo *li;
1204 	int64_t lun = ecb->xs->sc_link->lun;
1205 
1206 	li = TINFO_LUN(ti, lun);
1207 #ifdef DIAGNOSTIC
1208 	if ((!li) || (li->lun != lun))
1209 		panic("ncr53c9x_dequeue: lun %llx for ecb %p does not exist",
1210 		    (long long)lun, ecb);
1211 #endif
1212 	if (li->untagged == ecb) {
1213 		li->busy = 0;
1214 		li->untagged = NULL;
1215 	}
1216 	if (ecb->tag[0] && li->queued[ecb->tag[1]]) {
1217 #ifdef DIAGNOSTIC
1218 		if (li->queued[ecb->tag[1]] && (li->queued[ecb->tag[1]] != ecb))
1219 			panic("ncr53c9x_dequeue: slot %d for lun %llx has %p "
1220 			    "instead of ecb %p", ecb->tag[1],
1221 			    (long long)lun,
1222 			    li->queued[ecb->tag[1]], ecb);
1223 #endif
1224 		li->queued[ecb->tag[1]] = NULL;
1225 		li->used --;
1226 
1227 	}
1228 	if (ecb->flags & ECB_READY) {
1229 		ecb->flags &= ~ECB_READY;
1230 		TAILQ_REMOVE(&sc->ready_list, ecb, chain);
1231 	}
1232  }
1233 
1234 /*
1235  * INTERRUPT/PROTOCOL ENGINE
1236  */
1237 
1238 /*
1239  * Schedule an outgoing message by prioritizing it, and asserting
1240  * attention on the bus. We can only do this when we are the initiator
1241  * else there will be an illegal command interrupt.
1242  */
1243 #define ncr53c9x_sched_msgout(m) \
1244 	do {							\
1245 		NCR_MISC(("ncr53c9x_sched_msgout %x %d ", m, __LINE__));	\
1246 		NCRCMD(sc, NCRCMD_SETATN);			\
1247 		sc->sc_flags |= NCR_ATN;			\
1248 		sc->sc_msgpriq |= (m);				\
1249 	} while (0)
1250 
1251 static void
1252 ncr53c9x_flushfifo(struct ncr53c9x_softc *sc)
1253 {
1254 	NCR_MISC(("[flushfifo] "));
1255 
1256 	NCRCMD(sc, NCRCMD_FLUSH);
1257 
1258 	if (sc->sc_phase == COMMAND_PHASE ||
1259 	    sc->sc_phase == MESSAGE_OUT_PHASE)
1260 		DELAY(2);
1261 }
1262 
1263 static int
1264 ncr53c9x_rdfifo(struct ncr53c9x_softc *sc, int how)
1265 {
1266 	int i, n;
1267 	u_char *buf;
1268 
1269 	switch(how) {
1270 	case NCR_RDFIFO_START:
1271 		buf = sc->sc_imess;
1272 		sc->sc_imlen = 0;
1273 		break;
1274 	case NCR_RDFIFO_CONTINUE:
1275 		buf = sc->sc_imess + sc->sc_imlen;
1276 		break;
1277 	default:
1278 		panic("ncr53c9x_rdfifo: bad flag");
1279 		break;
1280 	}
1281 
1282 	/*
1283 	 * XXX buffer (sc_imess) size for message
1284 	 */
1285 
1286 	n = NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF;
1287 
1288 	if (sc->sc_rev == NCR_VARIANT_FAS366) {
1289 		n *= 2;
1290 
1291 		for (i = 0; i < n; i++)
1292 			buf[i] = NCR_READ_REG(sc, NCR_FIFO);
1293 
1294 		if (sc->sc_espstat2 & FAS_STAT2_ISHUTTLE) {
1295 
1296 			NCR_WRITE_REG(sc, NCR_FIFO, 0);
1297 			buf[i++] = NCR_READ_REG(sc, NCR_FIFO);
1298 
1299 			NCR_READ_REG(sc, NCR_FIFO);
1300 
1301 			ncr53c9x_flushfifo(sc);
1302 		}
1303 	} else {
1304 		for (i = 0; i < n; i++)
1305 			buf[i] = NCR_READ_REG(sc, NCR_FIFO);
1306 	}
1307 
1308 	sc->sc_imlen += i;
1309 
1310 #ifdef NCR53C9X_DEBUG
1311 	{
1312 		int j;
1313 
1314 		NCR_TRACE(("\n[rdfifo %s (%d):",
1315 		    (how == NCR_RDFIFO_START) ? "start" : "cont",
1316 		    (int)sc->sc_imlen));
1317 		if (ncr53c9x_debug & NCR_SHOWTRAC) {
1318 			for (j = 0; j < sc->sc_imlen; j++)
1319 				printf(" %02x", sc->sc_imess[j]);
1320 			printf("]\n");
1321 		}
1322 	}
1323 #endif
1324 	return sc->sc_imlen;
1325 }
1326 
1327 static void
1328 ncr53c9x_wrfifo(struct ncr53c9x_softc *sc, u_char *p, int len)
1329 {
1330 	int i;
1331 
1332 #ifdef NCR53C9X_DEBUG
1333 	NCR_MISC(("[wrfifo(%d):", len));
1334 	if (ncr53c9x_debug & NCR_SHOWTRAC) {
1335 		for (i = 0; i < len; i++)
1336 			printf(" %02x", p[i]);
1337 		printf("]\n");
1338 	}
1339 #endif
1340 
1341 	for (i = 0; i < len; i++) {
1342 		NCR_WRITE_REG(sc, NCR_FIFO, p[i]);
1343 
1344 		if (sc->sc_rev == NCR_VARIANT_FAS366)
1345 			NCR_WRITE_REG(sc, NCR_FIFO, 0);
1346 	}
1347 }
1348 
1349 int
1350 ncr53c9x_reselect(sc, message, tagtype, tagid)
1351 	struct ncr53c9x_softc *sc;
1352 	int message;
1353 	int tagtype;
1354 	int tagid;
1355 {
1356 	u_char selid, target, lun;
1357 	struct ncr53c9x_ecb *ecb = NULL;
1358 	struct ncr53c9x_tinfo *ti;
1359 	struct ncr53c9x_linfo *li;
1360 
1361 	if (sc->sc_rev == NCR_VARIANT_FAS366) {
1362 		target = sc->sc_selid;
1363 	} else {
1364 		/*
1365 		 * The SCSI chip made a snapshot of the data bus while the reselection
1366 		 * was being negotiated.  This enables us to determine which target did
1367 		 * the reselect.
1368 		 */
1369 		selid = sc->sc_selid & ~(1 << sc->sc_id);
1370 		if (selid & (selid - 1)) {
1371 			printf("%s: reselect with invalid selid %02x;"
1372 			    " sending DEVICE RESET\n", sc->sc_dev.dv_xname, selid);
1373 			goto reset;
1374 
1375 		}
1376 		target = ffs(selid) - 1;
1377 	}
1378 	lun = message & 0x07;
1379 
1380 	/*
1381 	 * Search wait queue for disconnected cmd
1382 	 * The list should be short, so I haven't bothered with
1383 	 * any more sophisticated structures than a simple
1384 	 * singly linked list.
1385 	 */
1386 	ti = &sc->sc_tinfo[target];
1387 	li = TINFO_LUN(ti, lun);
1388 
1389 	/*
1390 	 * We can get as far as the LUN with the IDENTIFY
1391 	 * message.  Check to see if we're running an
1392 	 * un-tagged command.  Otherwise ack the IDENTIFY
1393 	 * and wait for a tag message.
1394 	 */
1395 	if (li != NULL) {
1396 		if (li->untagged != NULL && li->busy)
1397 			ecb = li->untagged;
1398 		else if (tagtype != MSG_SIMPLE_Q_TAG) {
1399 			/* Wait for tag to come by */
1400 			sc->sc_state = NCR_IDENTIFIED;
1401 			return (0);
1402 		} else if (tagtype) ecb = li->queued[tagid];
1403 	}
1404 	if (ecb == NULL) {
1405 		printf("%s: reselect from target %d lun %d tag %x:%x with no nexus;"
1406 		    " sending ABORT\n", sc->sc_dev.dv_xname, target, lun, tagtype, tagid);
1407 		goto abort;
1408 	}
1409 
1410 	/* Make this nexus active again. */
1411 	sc->sc_state = NCR_CONNECTED;
1412 	sc->sc_nexus = ecb;
1413 	ncr53c9x_setsync(sc, ti);
1414 
1415 	if (ecb->flags & ECB_RESET)
1416 		ncr53c9x_sched_msgout(SEND_DEV_RESET);
1417 	else if (ecb->flags & ECB_ABORT)
1418 		ncr53c9x_sched_msgout(SEND_ABORT);
1419 
1420 	/* Do an implicit RESTORE POINTERS. */
1421 	sc->sc_dp = ecb->daddr;
1422 	sc->sc_dleft = ecb->dleft;
1423 
1424 	return (0);
1425 
1426 reset:
1427 	ncr53c9x_sched_msgout(SEND_DEV_RESET);
1428 	return (1);
1429 
1430 abort:
1431 	ncr53c9x_sched_msgout(SEND_ABORT);
1432 	return (1);
1433 }
1434 
1435 static inline int
1436 __verify_msg_format(u_char *p, int len)
1437 {
1438 
1439 	if (len == 1 && IS1BYTEMSG(p[0]))
1440 		return 1;
1441 	if (len == 2 && IS2BYTEMSG(p[0]))
1442 		return 1;
1443 	if (len >= 3 && ISEXTMSG(p[0]) &&
1444 	    len == p[1] + 2)
1445 		return 1;
1446 
1447 	return 0;
1448 }
1449 
1450 /*
1451  * Get an incoming message as initiator.
1452  *
1453  * The SCSI bus must already be in MESSAGE_IN_PHASE and there is a
1454  * byte in the FIFO
1455  */
1456 void
1457 ncr53c9x_msgin(sc)
1458 	struct ncr53c9x_softc *sc;
1459 {
1460 
1461 	NCR_TRACE(("[ncr53c9x_msgin(curmsglen:%ld)] ", (long)sc->sc_imlen));
1462 
1463 	if (sc->sc_imlen == 0) {
1464 		printf("%s: msgin: no msg byte available\n", sc->sc_dev.dv_xname);
1465 		return;
1466 	}
1467 
1468 	/*
1469 	 * Prepare for a new message.  A message should (according
1470 	 * to the SCSI standard) be transmitted in one single
1471 	 * MESSAGE_IN_PHASE. If we have been in some other phase,
1472 	 * then this is a new message.
1473 	 */
1474 	if (sc->sc_prevphase != MESSAGE_IN_PHASE && sc->sc_state != NCR_RESELECTED) {
1475 		printf("%s: phase change, dropping message, prev %d, state %d\n",
1476 		    sc->sc_dev.dv_xname, sc->sc_prevphase, sc->sc_state);
1477 		sc->sc_flags &= ~NCR_DROP_MSGI;
1478 		sc->sc_imlen = 0;
1479 	}
1480 
1481 	NCR_TRACE(("<msgbyte:0x%02x>", sc->sc_imess[0]));
1482 
1483 	/*
1484 	 * If we're going to reject the message, don't bother storing
1485 	 * the incoming bytes.  But still, we need to ACK them.
1486 	 */
1487 	if ((sc->sc_flags & NCR_DROP_MSGI)) {
1488 		NCRCMD(sc, NCRCMD_MSGOK);
1489 		printf("<dropping msg byte %x>",
1490 			sc->sc_imess[sc->sc_imlen]);
1491 		return;
1492 	}
1493 
1494 	if (sc->sc_imlen >= NCR_MAX_MSG_LEN) {
1495 		ncr53c9x_sched_msgout(SEND_REJECT);
1496 		sc->sc_flags |= NCR_DROP_MSGI;
1497 	} else {
1498 		u_char *pb;
1499 		int plen;
1500 
1501 		switch (sc->sc_state) {
1502 			/*
1503 			 * if received message is the first of reselection
1504 			 * then first byte is selid, and then message
1505 			 */
1506 		case NCR_RESELECTED:
1507 			pb = sc->sc_imess + 1;
1508 			plen = sc->sc_imlen - 1;
1509 			break;
1510 		default:
1511 			pb = sc->sc_imess;
1512 			plen = sc->sc_imlen;
1513 			break;
1514 		}
1515 
1516 		if (__verify_msg_format(pb, plen))
1517 			goto gotit;
1518 	}
1519 
1520 	/* Ack what we have so far */
1521 	NCRCMD(sc, NCRCMD_MSGOK);
1522 	return;
1523 
1524 gotit:
1525 	NCR_MSGS(("gotmsg(%x) state %d", sc->sc_imess[0], sc->sc_state));
1526 	/* we got complete message, flush the imess, XXX nobody uses imlen below */
1527 	sc->sc_imlen = 0;
1528 
1529 	/*
1530 	 * Now we should have a complete message (1 byte, 2 byte
1531 	 * and moderately long extended messages).  We only handle
1532 	 * extended messages which total length is shorter than
1533 	 * NCR_MAX_MSG_LEN.  Longer messages will be amputated.
1534 	 */
1535 	switch (sc->sc_state) {
1536 		struct ncr53c9x_ecb *ecb;
1537 		struct ncr53c9x_tinfo *ti;
1538 		struct ncr53c9x_linfo *li;
1539 		int lun;
1540 
1541 	case NCR_CONNECTED:
1542 		ecb = sc->sc_nexus;
1543 		ti = &sc->sc_tinfo[ecb->xs->sc_link->target];
1544 
1545 		switch (sc->sc_imess[0]) {
1546 		case MSG_CMDCOMPLETE:
1547 			NCR_MSGS(("cmdcomplete "));
1548 			if (sc->sc_dleft < 0) {
1549 				sc_print_addr(ecb->xs->sc_link);
1550 				printf("got %ld extra bytes\n",
1551 				    -(long)sc->sc_dleft);
1552 				sc->sc_dleft = 0;
1553 			}
1554 			ecb->dleft = (ecb->flags & ECB_TENTATIVE_DONE)
1555 				? 0
1556 				: sc->sc_dleft;
1557 			if ((ecb->flags & ECB_SENSE) == 0)
1558 				ecb->xs->resid = ecb->dleft;
1559 			sc->sc_state = NCR_CMDCOMPLETE;
1560 			break;
1561 
1562 		case MSG_MESSAGE_REJECT:
1563 			NCR_MSGS(("msg reject (msgout=%x) ", sc->sc_msgout));
1564 			switch (sc->sc_msgout) {
1565 			case SEND_TAG:
1566 				/* Target does not like tagged queuing.
1567 				 *  - Flush the command queue
1568 				 *  - Disable tagged queuing for the target
1569 				 *  - Dequeue ecb from the queued array.
1570 				 */
1571 				printf("%s: tagged queuing rejected: target %d\n",
1572 				    sc->sc_dev.dv_xname, ecb->xs->sc_link->target);
1573 
1574 				NCR_MSGS(("(rejected sent tag)"));
1575 				NCRCMD(sc, NCRCMD_FLUSH);
1576 				DELAY(1);
1577 				ti->flags &= ~T_TAG;
1578 				lun = ecb->xs->sc_link->lun;
1579 				li = TINFO_LUN(ti, lun);
1580 				if (ecb->tag[0] &&
1581 				    li->queued[ecb->tag[1]] != NULL) {
1582 					li->queued[ecb->tag[1]] = NULL;
1583 					li->used--;
1584 				}
1585 				ecb->tag[0] = ecb->tag[1] = 0;
1586 				li->untagged = ecb;
1587 				li->busy = 1;
1588 				break;
1589 
1590 			case SEND_SDTR:
1591 				printf("%s: sync transfer rejected: target %d\n",
1592 				    sc->sc_dev.dv_xname, ecb->xs->sc_link->target);
1593 				sc->sc_flags &= ~NCR_SYNCHNEGO;
1594 				ti->flags &= ~(T_NEGOTIATE | T_SYNCMODE);
1595 				ncr53c9x_setsync(sc, ti);
1596 				break;
1597 
1598 			case SEND_WDTR:
1599 				printf("%s: wide transfer rejected: target %d\n",
1600 				    sc->sc_dev.dv_xname, ecb->xs->sc_link->target);
1601 				ti->flags &= ~T_WIDE;
1602 				ti->width = 0;
1603 				break;
1604 
1605 			case SEND_INIT_DET_ERR:
1606 				goto abort;
1607 			}
1608 			break;
1609 
1610 		case MSG_NOOP:
1611 			NCR_MSGS(("noop "));
1612 			break;
1613 
1614 		case MSG_HEAD_OF_Q_TAG:
1615 		case MSG_SIMPLE_Q_TAG:
1616 		case MSG_ORDERED_Q_TAG:
1617 			NCR_MSGS(("TAG %x:%x", sc->sc_imess[0], sc->sc_imess[1]));
1618 			break;
1619 
1620 		case MSG_DISCONNECT:
1621 			NCR_MSGS(("disconnect "));
1622 			ti->dconns++;
1623 			sc->sc_state = NCR_DISCONNECT;
1624 
1625 			/*
1626 			 * Mark the fact that all bytes have moved. The
1627 			 * target may not bother to do a SAVE POINTERS
1628 			 * at this stage. This flag will set the residual
1629 			 * count to zero on MSG COMPLETE.
1630 			 */
1631 			if (sc->sc_dleft == 0)
1632 				ecb->flags |= ECB_TENTATIVE_DONE;
1633 
1634 			break;
1635 
1636 		case MSG_SAVEDATAPOINTER:
1637 			NCR_MSGS(("save datapointer "));
1638 			ecb->daddr = sc->sc_dp;
1639 			ecb->dleft = sc->sc_dleft;
1640 			break;
1641 
1642 		case MSG_RESTOREPOINTERS:
1643 			NCR_MSGS(("restore datapointer "));
1644 			sc->sc_dp = ecb->daddr;
1645 			sc->sc_dleft = ecb->dleft;
1646 			break;
1647 
1648 		case MSG_EXTENDED:
1649 			NCR_MSGS(("extended(%x) ", sc->sc_imess[2]));
1650 			switch (sc->sc_imess[2]) {
1651 			case MSG_EXT_SDTR:
1652 				NCR_MSGS(("SDTR period %d, offset %d ",
1653 					sc->sc_imess[3], sc->sc_imess[4]));
1654 				if (sc->sc_imess[1] != 3)
1655 					goto reject;
1656 				ti->period = sc->sc_imess[3];
1657 				ti->offset = sc->sc_imess[4];
1658 				ti->flags &= ~T_NEGOTIATE;
1659 				if (sc->sc_minsync == 0 ||
1660 				    ti->offset == 0 ||
1661 				    ti->period > 124) {
1662 #ifdef NCR53C9X_DEBUG
1663 					sc_print_addr(ecb->xs->sc_link);
1664 					printf("async mode\n");
1665 #endif
1666 					if ((sc->sc_flags&NCR_SYNCHNEGO)
1667 					    == 0) {
1668 						/*
1669 						 * target initiated negotiation
1670 						 */
1671 						ti->offset = 0;
1672 						ti->flags &= ~T_SYNCMODE;
1673 						ncr53c9x_sched_msgout(
1674 						    SEND_SDTR);
1675 					} else {
1676 						/* we are async */
1677 						ti->flags &= ~T_SYNCMODE;
1678 					}
1679 				} else {
1680 #ifdef NCR53C9X_DEBUG
1681 					int r, s;
1682 #endif
1683 					int p;
1684 
1685 					p = ncr53c9x_stp2cpb(sc, ti->period);
1686 					ti->period = ncr53c9x_cpb2stp(sc, p);
1687 #ifdef NCR53C9X_DEBUG
1688 					sc_print_addr(ecb->xs->sc_link);
1689 					r = 250/ti->period;
1690 					s = (100*250)/ti->period - 100*r;
1691 					printf("max sync rate %d.%02dMB/s\n",
1692 						r, s);
1693 #endif
1694 					if ((sc->sc_flags&NCR_SYNCHNEGO) == 0) {
1695 						/*
1696 						 * target initiated negotiation
1697 						 */
1698 						if (ti->period <
1699 						    sc->sc_minsync)
1700 							ti->period =
1701 							    sc->sc_minsync;
1702 						if (ti->offset > 15)
1703 							ti->offset = 15;
1704 						ti->flags &= ~T_SYNCMODE;
1705 						ncr53c9x_sched_msgout(
1706 						    SEND_SDTR);
1707 					} else {
1708 						/* we are sync */
1709 						ti->flags |= T_SYNCMODE;
1710 					}
1711 				}
1712 				sc->sc_flags &= ~NCR_SYNCHNEGO;
1713 				ncr53c9x_setsync(sc, ti);
1714 				break;
1715 
1716 			case MSG_EXT_WDTR:
1717 				printf("%s: wide mode %d\n",
1718 				    sc->sc_dev.dv_xname, sc->sc_imess[3]);
1719 				if (sc->sc_imess[3] == 1) {
1720 					ti->cfg3 |= NCRFASCFG3_EWIDE;
1721 					ncr53c9x_setsync(sc, ti);
1722 				} else
1723 					ti->width = 0;
1724 				ti->flags &= ~T_WIDE;
1725 				break;
1726 			default:
1727 				sc_print_addr(ecb->xs->sc_link);
1728 				printf("unrecognized MESSAGE EXTENDED;"
1729 				    " sending REJECT\n");
1730 				goto reject;
1731 			}
1732 			break;
1733 
1734 		default:
1735 			NCR_MSGS(("ident "));
1736 			sc_print_addr(ecb->xs->sc_link);
1737 			printf("unrecognized MESSAGE; sending REJECT\n");
1738 		reject:
1739 			ncr53c9x_sched_msgout(SEND_REJECT);
1740 			break;
1741 		}
1742 		break;
1743 
1744 	case NCR_IDENTIFIED:
1745 		/*
1746 		 * IDENTIFY message was received and queue tag is expected now
1747 		 */
1748 		if ((sc->sc_imess[0] != MSG_SIMPLE_Q_TAG) ||
1749 		    (sc->sc_msgify == 0)) {
1750 			printf("%s: TAG reselect without IDENTIFY;"
1751 			    " MSG %x;"
1752 			    " sending DEVICE RESET\n",
1753 			    sc->sc_dev.dv_xname,
1754 			    sc->sc_imess[0]);
1755 			goto reset;
1756 		}
1757 		(void) ncr53c9x_reselect(sc, sc->sc_msgify,
1758 		    sc->sc_imess[0], sc->sc_imess[1]);
1759 		break;
1760 
1761 	case NCR_RESELECTED:
1762 		if (MSG_ISIDENTIFY(sc->sc_imess[1])) {
1763 			sc->sc_msgify = sc->sc_imess[1];
1764 		} else {
1765 			printf("%s: reselect without IDENTIFY;"
1766 			    " MSG %x;"
1767 			    " sending DEVICE RESET\n",
1768 			    sc->sc_dev.dv_xname,
1769 			    sc->sc_imess[1]);
1770 			goto reset;
1771 		}
1772 		(void) ncr53c9x_reselect(sc, sc->sc_msgify, 0, 0);
1773 		break;
1774 
1775 	default:
1776 		printf("%s: unexpected MESSAGE IN; sending DEVICE RESET\n",
1777 		    sc->sc_dev.dv_xname);
1778 	reset:
1779 		ncr53c9x_sched_msgout(SEND_DEV_RESET);
1780 		break;
1781 
1782 	abort:
1783 		ncr53c9x_sched_msgout(SEND_ABORT);
1784 		break;
1785 	}
1786 
1787 	/* if we have more messages to send set ATN */
1788 	if (sc->sc_msgpriq)
1789 		NCRCMD(sc, NCRCMD_SETATN);
1790 
1791 	/* Ack last message byte */
1792 	NCRCMD(sc, NCRCMD_MSGOK);
1793 
1794 	/* Done, reset message pointer. */
1795 	sc->sc_flags &= ~NCR_DROP_MSGI;
1796 	sc->sc_imlen = 0;
1797 }
1798 
1799 
1800 /*
1801  * Send the highest priority, scheduled message
1802  */
1803 void
1804 ncr53c9x_msgout(sc)
1805 	struct ncr53c9x_softc *sc;
1806 {
1807 	struct ncr53c9x_tinfo *ti;
1808 	struct ncr53c9x_ecb *ecb;
1809 	size_t size;
1810 
1811 	NCR_TRACE(("[ncr53c9x_msgout(priq:%x, prevphase:%x)]",
1812 	    sc->sc_msgpriq, sc->sc_prevphase));
1813 
1814 	/*
1815 	 * XXX - the NCR_ATN flag is not in sync with the actual ATN
1816 	 *	 condition on the SCSI bus. The 53c9x chip
1817 	 *	 automatically turns off ATN before sending the
1818 	 *	 message byte.  (see also the comment below in the
1819 	 *	 default case when picking out a message to send)
1820 	 */
1821 	if (sc->sc_flags & NCR_ATN) {
1822 		if (sc->sc_prevphase != MESSAGE_OUT_PHASE) {
1823 		new:
1824 			NCRCMD(sc, NCRCMD_FLUSH);
1825 /*			DELAY(1); */
1826 			sc->sc_msgoutq = 0;
1827 			sc->sc_omlen = 0;
1828 		}
1829 	} else {
1830 		if (sc->sc_prevphase == MESSAGE_OUT_PHASE) {
1831 			ncr53c9x_sched_msgout(sc->sc_msgoutq);
1832 			goto new;
1833 		} else {
1834 			printf("%s at line %d: unexpected MESSAGE OUT phase\n",
1835 			    sc->sc_dev.dv_xname, __LINE__);
1836 		}
1837 	}
1838 
1839 	if (sc->sc_omlen == 0) {
1840 		/* Pick up highest priority message */
1841 		sc->sc_msgout = sc->sc_msgpriq & -sc->sc_msgpriq;
1842 		sc->sc_msgoutq |= sc->sc_msgout;
1843 		sc->sc_msgpriq &= ~sc->sc_msgout;
1844 		sc->sc_omlen = 1;		/* "Default" message len */
1845 		switch (sc->sc_msgout) {
1846 		case SEND_SDTR:
1847 			ecb = sc->sc_nexus;
1848 			ti = &sc->sc_tinfo[ecb->xs->sc_link->target];
1849 			sc->sc_omess[0] = MSG_EXTENDED;
1850 			sc->sc_omess[1] = 3;
1851 			sc->sc_omess[2] = MSG_EXT_SDTR;
1852 			sc->sc_omess[3] = ti->period;
1853 			sc->sc_omess[4] = ti->offset;
1854 			sc->sc_omlen = 5;
1855 			if ((sc->sc_flags & NCR_SYNCHNEGO) == 0) {
1856 				ti->flags |= T_SYNCMODE;
1857 				ncr53c9x_setsync(sc, ti);
1858 			}
1859 			break;
1860 		case SEND_WDTR:
1861 			ecb = sc->sc_nexus;
1862 			ti = &sc->sc_tinfo[ecb->xs->sc_link->target];
1863 			sc->sc_omess[0] = MSG_EXTENDED;
1864 			sc->sc_omess[1] = 2;
1865 			sc->sc_omess[2] = MSG_EXT_WDTR;
1866 			sc->sc_omess[3] = ti->width;
1867 			sc->sc_omlen = 4;
1868 			break;
1869 		case SEND_IDENTIFY:
1870 			if (sc->sc_state != NCR_CONNECTED) {
1871 				printf("%s at line %d: no nexus\n",
1872 				    sc->sc_dev.dv_xname, __LINE__);
1873 			}
1874 			ecb = sc->sc_nexus;
1875 			sc->sc_omess[0] =
1876 			    MSG_IDENTIFY(ecb->xs->sc_link->lun, 0);
1877 			break;
1878 		case SEND_TAG:
1879 			if (sc->sc_state != NCR_CONNECTED) {
1880 				printf("%s at line %d: no nexus\n",
1881 				    sc->sc_dev.dv_xname, __LINE__);
1882 			}
1883 			ecb = sc->sc_nexus;
1884 			sc->sc_omess[0] = ecb->tag[0];
1885 			sc->sc_omess[1] = ecb->tag[1];
1886 			sc->sc_omlen = 2;
1887 			break;
1888 		case SEND_DEV_RESET:
1889 			sc->sc_flags |= NCR_ABORTING;
1890 			sc->sc_omess[0] = MSG_BUS_DEV_RESET;
1891 			ecb = sc->sc_nexus;
1892 			ti = &sc->sc_tinfo[ecb->xs->sc_link->target];
1893 			ti->flags &= ~T_SYNCMODE;
1894 			if ((ti->flags & T_SYNCHOFF) == 0)
1895 				/* We can re-start sync negotiation */
1896 				ti->flags |= T_NEGOTIATE;
1897 			break;
1898 		case SEND_PARITY_ERROR:
1899 			sc->sc_omess[0] = MSG_PARITY_ERROR;
1900 			break;
1901 		case SEND_ABORT:
1902 			sc->sc_flags |= NCR_ABORTING;
1903 			sc->sc_omess[0] = MSG_ABORT;
1904 			break;
1905 		case SEND_INIT_DET_ERR:
1906 			sc->sc_omess[0] = MSG_INITIATOR_DET_ERR;
1907 			break;
1908 		case SEND_REJECT:
1909 			sc->sc_omess[0] = MSG_MESSAGE_REJECT;
1910 			break;
1911 		default:
1912 			/*
1913 			 * We normally do not get here, since the chip
1914 			 * automatically turns off ATN before the last
1915 			 * byte of a message is sent to the target.
1916 			 * However, if the target rejects our (multi-byte)
1917 			 * message early by switching to MSG IN phase
1918 			 * ATN remains on, so the target may return to
1919 			 * MSG OUT phase. If there are no scheduled messages
1920 			 * left we send a NO-OP.
1921 			 *
1922 			 * XXX - Note that this leaves no useful purpose for
1923 			 * the NCR_ATN flag.
1924 			 */
1925 			sc->sc_flags &= ~NCR_ATN;
1926 			sc->sc_omess[0] = MSG_NOOP;
1927 			break;
1928 		}
1929 		sc->sc_omp = sc->sc_omess;
1930 	}
1931 
1932 #ifdef DEBUG
1933 	{
1934 		int i;
1935 
1936 		for (i = 0; i<sc->sc_omlen; i++)
1937 			NCR_MISC(("<msgbyte:0x%02x>", sc->sc_omess[i]));
1938 	}
1939 #endif
1940 	if (sc->sc_rev == NCR_VARIANT_FAS366) {
1941 		/*
1942 		 * XXX fifo size
1943 		 */
1944 		ncr53c9x_flushfifo(sc);
1945 		ncr53c9x_wrfifo(sc, sc->sc_omp, sc->sc_omlen);
1946 		sc->sc_cmdlen = 0;
1947 		NCRCMD(sc, NCRCMD_TRANS);
1948 	} else {
1949 		/* (re)send the message */
1950 		size = min(sc->sc_omlen, sc->sc_maxxfer);
1951 		NCRDMA_SETUP(sc, &sc->sc_omp, &sc->sc_omlen, 0, &size);
1952 		/* Program the SCSI counter */
1953 		NCR_SET_COUNT(sc, size);
1954 
1955                /* Load the count in and start the message-out transfer */
1956 		NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA);
1957 		NCRCMD(sc, NCRCMD_TRANS|NCRCMD_DMA);
1958 		NCRDMA_GO(sc);
1959 	}
1960 }
1961 
1962 /*
1963  * This is the most critical part of the driver, and has to know
1964  * how to deal with *all* error conditions and phases from the SCSI
1965  * bus. If there are no errors and the DMA was active, then call the
1966  * DMA pseudo-interrupt handler. If this returns 1, then that was it
1967  * and we can return from here without further processing.
1968  *
1969  * Most of this needs verifying.
1970  */
1971 int sdebug = 0;
1972 int
1973 ncr53c9x_intr(arg)
1974 	void *arg;
1975 {
1976 	struct ncr53c9x_softc *sc = arg;
1977 	struct ncr53c9x_ecb *ecb;
1978 	struct scsi_link *sc_link;
1979 	struct ncr53c9x_tinfo *ti;
1980 	size_t size;
1981 	int nfifo;
1982 
1983 	NCR_TRACE(("[ncr53c9x_intr: state %d] ", sc->sc_state));
1984 
1985 	if (!NCRDMA_ISINTR(sc))
1986 		return (0);
1987 
1988 again:
1989 	/* and what do the registers say... */
1990 	ncr53c9x_readregs(sc);
1991 
1992 	/*
1993 	 * At the moment, only a SCSI Bus Reset or Illegal
1994 	 * Command are classed as errors. A disconnect is a
1995 	 * valid condition, and we let the code check is the
1996 	 * "NCR_BUSFREE_OK" flag was set before declaring it
1997 	 * and error.
1998 	 *
1999 	 * Also, the status register tells us about "Gross
2000 	 * Errors" and "Parity errors". Only the Gross Error
2001 	 * is really bad, and the parity errors are dealt
2002 	 * with later
2003 	 *
2004 	 * TODO
2005 	 *      If there are too many parity error, go to slow
2006 	 *      cable mode ?
2007 	 */
2008 
2009 	/* SCSI Reset */
2010 	if (sc->sc_espintr & NCRINTR_SBR) {
2011 		if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
2012 			NCRCMD(sc, NCRCMD_FLUSH);
2013 			DELAY(1);
2014 		}
2015 		if (sc->sc_state != NCR_SBR) {
2016 			printf("%s: SCSI bus reset\n",
2017 				sc->sc_dev.dv_xname);
2018 			ncr53c9x_init(sc, 0); /* Restart everything */
2019 			return (1);
2020 		}
2021 #if 0
2022 /*XXX*/		printf("<expected bus reset: "
2023 			"[intr %x, stat %x, step %d]>\n",
2024 			sc->sc_espintr, sc->sc_espstat,
2025 			sc->sc_espstep);
2026 #endif
2027 		if (sc->sc_nexus)
2028 			panic("%s: nexus in reset state",
2029 		      sc->sc_dev.dv_xname);
2030 		goto sched;
2031 	}
2032 
2033 	ecb = sc->sc_nexus;
2034 
2035 #define NCRINTR_ERR (NCRINTR_SBR|NCRINTR_ILL)
2036 	if (sc->sc_espintr & NCRINTR_ERR ||
2037 	    sc->sc_espstat & NCRSTAT_GE) {
2038 
2039 		if (sc->sc_espstat & NCRSTAT_GE) {
2040 			/* Gross Error; no target ? */
2041 			if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
2042 				NCRCMD(sc, NCRCMD_FLUSH);
2043 				DELAY(1);
2044 			}
2045 			if (sc->sc_state == NCR_CONNECTED ||
2046 			    sc->sc_state == NCR_SELECTING) {
2047 				ecb->xs->error = XS_TIMEOUT;
2048 				ncr53c9x_done(sc, ecb);
2049 			}
2050 			return (1);
2051 		}
2052 
2053 		if (sc->sc_espintr & NCRINTR_ILL) {
2054 			if (sc->sc_flags & NCR_EXPECT_ILLCMD) {
2055 				/*
2056 				 * Eat away "Illegal command" interrupt
2057 				 * on a ESP100 caused by a re-selection
2058 				 * while we were trying to select
2059 				 * another target.
2060 				 */
2061 #ifdef DEBUG
2062 				printf("%s: ESP100 work-around activated\n",
2063 					sc->sc_dev.dv_xname);
2064 #endif
2065 				sc->sc_flags &= ~NCR_EXPECT_ILLCMD;
2066 				return (1);
2067 			}
2068 			/* illegal command, out of sync ? */
2069 			printf("%s: illegal command: 0x%x "
2070 			    "(state %d, phase %x, prevphase %x)\n",
2071 				sc->sc_dev.dv_xname, sc->sc_lastcmd,
2072 				sc->sc_state, sc->sc_phase,
2073 				sc->sc_prevphase);
2074 			if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
2075 				NCRCMD(sc, NCRCMD_FLUSH);
2076 				DELAY(1);
2077 			}
2078 			ncr53c9x_init(sc, 1); /* Restart everything */
2079 			return (1);
2080 		}
2081 	}
2082 	sc->sc_flags &= ~NCR_EXPECT_ILLCMD;
2083 
2084 	/*
2085 	 * Call if DMA is active.
2086 	 *
2087 	 * If DMA_INTR returns true, then maybe go 'round the loop
2088 	 * again in case there is no more DMA queued, but a phase
2089 	 * change is expected.
2090 	 */
2091 	if (NCRDMA_ISACTIVE(sc)) {
2092 		int r = NCRDMA_INTR(sc);
2093 		if (r == -1) {
2094 			printf("%s: DMA error; resetting\n",
2095 				sc->sc_dev.dv_xname);
2096 			ncr53c9x_init(sc, 1);
2097 			return (1);
2098 		}
2099 		/* If DMA active here, then go back to work... */
2100 		if (NCRDMA_ISACTIVE(sc))
2101 			return (1);
2102 
2103 		if ((sc->sc_espstat & NCRSTAT_TC) == 0) {
2104 			/*
2105 			 * DMA not completed.  If we can not find a
2106 			 * acceptable explanation, print a diagnostic.
2107 			 */
2108 			if (sc->sc_state == NCR_SELECTING)
2109 				/*
2110 				 * This can happen if we are reselected
2111 				 * while using DMA to select a target.
2112 				 */
2113 				/*void*/;
2114 			else if (sc->sc_prevphase == MESSAGE_OUT_PHASE){
2115 				/*
2116 				 * Our (multi-byte) message (eg SDTR)
2117 				 * was interrupted by the target to
2118 				 * send a MSG REJECT.
2119 				 * Print diagnostic if current phase
2120 				 * is not MESSAGE IN.
2121 				 */
2122 				if (sc->sc_phase != MESSAGE_IN_PHASE)
2123 				    printf("%s: !TC on MSG OUT"
2124 				       " [intr %x, stat %x, step %d]"
2125 				       " prevphase %x, resid %lx\n",
2126 					sc->sc_dev.dv_xname,
2127 					sc->sc_espintr,
2128 					sc->sc_espstat,
2129 					sc->sc_espstep,
2130 					sc->sc_prevphase,
2131 					(u_long)sc->sc_omlen);
2132 			} else if (sc->sc_dleft == 0) {
2133 				/*
2134 				 * The DMA operation was started for
2135 				 * a DATA transfer. Print a diagnostic
2136 				 * if the DMA counter and TC bit
2137 				 * appear to be out of sync.
2138 				 */
2139 				printf("%s: !TC on DATA XFER"
2140 				       " [intr %x, stat %x, step %d]"
2141 				       " prevphase %x, resid %x\n",
2142 					sc->sc_dev.dv_xname,
2143 					sc->sc_espintr,
2144 					sc->sc_espstat,
2145 					sc->sc_espstep,
2146 					sc->sc_prevphase,
2147 					ecb?ecb->dleft:-1);
2148 			}
2149 		}
2150 	}
2151 
2152 	/*
2153 	 * check for less serious errors
2154 	 */
2155 	if (sc->sc_espstat & NCRSTAT_PE) {
2156 		printf("%s: SCSI bus parity error\n", sc->sc_dev.dv_xname);
2157 		if (sc->sc_prevphase == MESSAGE_IN_PHASE)
2158 			ncr53c9x_sched_msgout(SEND_PARITY_ERROR);
2159 		else
2160 			ncr53c9x_sched_msgout(SEND_INIT_DET_ERR);
2161 	}
2162 
2163 	if (sc->sc_espintr & NCRINTR_DIS) {
2164 		sc->sc_msgify = 0;
2165 		NCR_MISC(("<DISC [intr %x, stat %x, step %d]>",
2166 			sc->sc_espintr,sc->sc_espstat,sc->sc_espstep));
2167 		if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
2168 			NCRCMD(sc, NCRCMD_FLUSH);
2169 /*			DELAY(1); */
2170 		}
2171 		/*
2172 		 * This command must (apparently) be issued within
2173 		 * 250mS of a disconnect. So here you are...
2174 		 */
2175 		NCRCMD(sc, NCRCMD_ENSEL);
2176 
2177 		switch (sc->sc_state) {
2178 		case NCR_RESELECTED:
2179 			goto sched;
2180 
2181 		case NCR_SELECTING:
2182 			ecb->xs->error = XS_SELTIMEOUT;
2183 			goto finish;
2184 
2185 		case NCR_CONNECTED:
2186 			if ((sc->sc_flags & NCR_SYNCHNEGO)) {
2187 #ifdef NCR53C9X_DEBUG
2188 				if (ecb)
2189 					sc_print_addr(ecb->xs->sc_link);
2190 				printf("sync nego not completed!\n");
2191 #endif
2192 				ti = &sc->sc_tinfo[ecb->xs->sc_link->target];
2193 				sc->sc_flags &= ~NCR_SYNCHNEGO;
2194 				ti->flags &= ~(T_NEGOTIATE | T_SYNCMODE);
2195 			}
2196 
2197 			/* it may be OK to disconnect */
2198 			if ((sc->sc_flags & NCR_ABORTING) == 0) {
2199 				/*
2200 				 * Section 5.1.1 of the SCSI 2 spec
2201 				 * suggests issuing a REQUEST SENSE
2202 				 * following an unexpected disconnect.
2203 				 * Some devices go into a contingent
2204 				 * allegiance condition when
2205 				 * disconnecting, and this is necessary
2206 				 * to clean up their state.
2207 				 */
2208 				printf("%s: unexpected disconnect; ",
2209 				    sc->sc_dev.dv_xname);
2210 				if (ecb->flags & ECB_SENSE) {
2211 					printf("resetting\n");
2212 					goto reset;
2213 				}
2214 				printf("sending REQUEST SENSE\n");
2215 				timeout_del(&ecb->to);
2216 				ncr53c9x_sense(sc, ecb);
2217 				goto out;
2218 			}
2219 
2220 			ecb->xs->error = XS_TIMEOUT;
2221 			goto finish;
2222 
2223 		case NCR_DISCONNECT:
2224 			sc->sc_nexus = NULL;
2225 			goto sched;
2226 
2227 		case NCR_CMDCOMPLETE:
2228 			goto finish;
2229 		}
2230 	}
2231 
2232 	switch (sc->sc_state) {
2233 
2234 	case NCR_SBR:
2235 		printf("%s: waiting for SCSI Bus Reset to happen\n",
2236 			sc->sc_dev.dv_xname);
2237 		return (1);
2238 
2239 	case NCR_RESELECTED:
2240 		/*
2241 		 * we must be continuing a message ?
2242 		 */
2243 		if (sc->sc_phase != MESSAGE_IN_PHASE) {
2244 			printf("%s: target didn't identify\n",
2245 				sc->sc_dev.dv_xname);
2246 			ncr53c9x_init(sc, 1);
2247 			return (1);
2248 		}
2249 printf("<<RESELECT CONT'd>>");
2250 #if XXXX
2251 		ncr53c9x_msgin(sc);
2252 		if (sc->sc_state != NCR_CONNECTED) {
2253 			/* IDENTIFY fail?! */
2254 			printf("%s: identify failed\n",
2255 				sc->sc_dev.dv_xname);
2256 			ncr53c9x_init(sc, 1);
2257 			return (1);
2258 		}
2259 #endif
2260 		break;
2261 
2262 	case NCR_IDENTIFIED:
2263 		ecb = sc->sc_nexus;
2264 		if (sc->sc_phase != MESSAGE_IN_PHASE) {
2265 			int i = (NCR_READ_REG(sc, NCR_FFLAG)
2266 			    & NCRFIFO_FF);
2267 			/*
2268 			 * Things are seriously fucked up.
2269 			 * Pull the brakes, i.e. reset
2270 			 */
2271 			printf("%s: target didn't send tag: %d bytes in fifo\n",
2272 			    sc->sc_dev.dv_xname, i);
2273 			/* Drain and display fifo */
2274 			while (i-- > 0)
2275 				printf("[%d] ", NCR_READ_REG(sc, NCR_FIFO));
2276 			ncr53c9x_init(sc, 1);
2277 			return (1);
2278 		} else
2279 			goto msgin;
2280 
2281 		break;
2282 	case NCR_IDLE:
2283 	case NCR_SELECTING:
2284 		ecb = sc->sc_nexus;
2285 		if (sc->sc_espintr & NCRINTR_RESEL) {
2286 			sc->sc_msgpriq = sc->sc_msgout = sc->sc_msgoutq = 0;
2287 			sc->sc_flags = 0;
2288 			/*
2289 			 * If we're trying to select a
2290 			 * target ourselves, push our command
2291 			 * back into the ready list.
2292 			 */
2293 			if (sc->sc_state == NCR_SELECTING) {
2294 				NCR_MISC(("backoff selector "));
2295 				timeout_del(&ecb->to);
2296 				ncr53c9x_dequeue(sc, ecb);
2297 				TAILQ_INSERT_HEAD(&sc->ready_list, ecb, chain);
2298 				ecb->flags |= ECB_READY;
2299 				ecb = sc->sc_nexus = NULL;
2300 			}
2301 			sc->sc_state = NCR_RESELECTED;
2302 			if (sc->sc_phase != MESSAGE_IN_PHASE) {
2303 				/*
2304 				 * Things are seriously fucked up.
2305 				 * Pull the brakes, i.e. reset
2306 				 */
2307 				printf("%s: target didn't identify\n",
2308 					sc->sc_dev.dv_xname);
2309 				ncr53c9x_init(sc, 1);
2310 				return (1);
2311 			}
2312 			/*
2313 			 * The C90 only inhibits FIFO writes until
2314 			 * reselection is complete, instead of
2315 			 * waiting until the interrupt status register
2316 			 * has been read. So, if the reselect happens
2317 			 * while we were entering a command bytes (for
2318 			 * another target) some of those bytes can
2319 			 * appear in the FIFO here, after the
2320 			 * interrupt is taken.
2321 			 */
2322 			nfifo = ncr53c9x_rdfifo(sc, NCR_RDFIFO_START);
2323 
2324 			if (nfifo < 2 ||
2325 			    (nfifo > 2 &&
2326 			     sc->sc_rev != NCR_VARIANT_ESP100)) {
2327 				printf("%s: RESELECT: "
2328 				    "%d bytes in FIFO! "
2329 				    "[intr %x, stat %x, step %d, prevphase %x]\n",
2330 					sc->sc_dev.dv_xname,
2331 					nfifo,
2332 					sc->sc_espintr,
2333 					sc->sc_espstat,
2334 					sc->sc_espstep,
2335 					sc->sc_prevphase);
2336 				ncr53c9x_init(sc, 1);
2337 				return (1);
2338 			}
2339 			sc->sc_selid = sc->sc_imess[0];
2340 			NCR_MISC(("selid=%2x ", sc->sc_selid));
2341 
2342 			/* Handle identify message */
2343 			ncr53c9x_msgin(sc);
2344 			if (nfifo != 2) {
2345 				/*
2346 				 * Note: this should not happen
2347 				 * with `dmaselect' on.
2348 				 */
2349 				sc->sc_flags |= NCR_EXPECT_ILLCMD;
2350 				NCRCMD(sc, NCRCMD_FLUSH);
2351 			} else if (sc->sc_features & NCR_F_DMASELECT &&
2352 				   sc->sc_rev == NCR_VARIANT_ESP100) {
2353 				sc->sc_flags |= NCR_EXPECT_ILLCMD;
2354 			}
2355 
2356 			if (sc->sc_state != NCR_CONNECTED &&
2357 			    sc->sc_state != NCR_IDENTIFIED) {
2358 				/* IDENTIFY fail?! */
2359 				printf("%s: identify failed, state %d, intr %02x\n",
2360 					sc->sc_dev.dv_xname, sc->sc_state,
2361 				    sc->sc_espintr);
2362 				ncr53c9x_init(sc, 1);
2363 				return (1);
2364 			}
2365 			goto shortcut; /* ie. next phase expected soon */
2366 		}
2367 
2368 #define	NCRINTR_DONE	(NCRINTR_FC|NCRINTR_BS)
2369 		if ((sc->sc_espintr & NCRINTR_DONE) == NCRINTR_DONE) {
2370 			/*
2371 			 * Arbitration won; examine the `step' register
2372 			 * to determine how far the selection could progress.
2373 			 */
2374 			ecb = sc->sc_nexus;
2375 			if (!ecb)
2376 				panic("ncr53c9x: no nexus");
2377 
2378 			sc_link = ecb->xs->sc_link;
2379 			ti = &sc->sc_tinfo[sc_link->target];
2380 
2381 			switch (sc->sc_espstep) {
2382 			case 0:
2383 				/*
2384 				 * The target did not respond with a
2385 				 * message out phase - probably an old
2386 				 * device that doesn't recognize ATN.
2387 				 * Clear ATN and just continue, the
2388 				 * target should be in the command
2389 				 * phase.
2390 				 * XXXX check for command phase?
2391 				 */
2392 				NCRCMD(sc, NCRCMD_RSTATN);
2393 				break;
2394 			case 1:
2395 				if ((ti->flags & T_NEGOTIATE) == 0 &&
2396 				    ecb->tag[0] == 0) {
2397 					printf("%s: step 1 & !NEG\n",
2398 						sc->sc_dev.dv_xname);
2399 					goto reset;
2400 				}
2401 				if (sc->sc_phase != MESSAGE_OUT_PHASE) {
2402 					printf("%s: !MSGOUT\n",
2403 						sc->sc_dev.dv_xname);
2404 					goto reset;
2405 				}
2406 				if (ti->flags & T_WIDE) {
2407 					ncr53c9x_sched_msgout(SEND_WDTR);
2408 				}
2409 				if (ti->flags & T_NEGOTIATE) {
2410 					/* Start negotiating */
2411 					ti->period = sc->sc_minsync;
2412 					ti->offset = 15;
2413 					sc->sc_flags |= NCR_SYNCHNEGO;
2414 					if (ecb->tag[0])
2415 						ncr53c9x_sched_msgout(SEND_TAG|SEND_SDTR);
2416 					else
2417 						ncr53c9x_sched_msgout(SEND_SDTR);
2418 				} else {
2419 					/* Could not do ATN3 so send TAG */
2420 					ncr53c9x_sched_msgout(SEND_TAG);
2421 				}
2422 				sc->sc_prevphase = MESSAGE_OUT_PHASE; /* XXXX */
2423 				break;
2424 			case 3:
2425 				/*
2426 				 * Grr, this is supposed to mean
2427 				 * "target left command phase  prematurely".
2428 				 * It seems to happen regularly when
2429 				 * sync mode is on.
2430 				 * Look at FIFO to see if command went out.
2431 				 * (Timing problems?)
2432 				 */
2433 				if (sc->sc_features & NCR_F_DMASELECT) {
2434 					if (sc->sc_cmdlen == 0)
2435 						/* Hope for the best.. */
2436 						break;
2437 				} else if ((NCR_READ_REG(sc, NCR_FFLAG)
2438 					    & NCRFIFO_FF) == 0) {
2439 					/* Hope for the best.. */
2440 					break;
2441 				}
2442 				printf("(%s:%d:%d): selection failed;"
2443 					" %d left in FIFO "
2444 					"[intr %x, stat %x, step %d]\n",
2445 					sc->sc_dev.dv_xname,
2446 					sc_link->target,
2447 					sc_link->lun,
2448 					NCR_READ_REG(sc, NCR_FFLAG)
2449 					 & NCRFIFO_FF,
2450 					sc->sc_espintr, sc->sc_espstat,
2451 					sc->sc_espstep);
2452 				NCRCMD(sc, NCRCMD_FLUSH);
2453 				ncr53c9x_sched_msgout(SEND_ABORT);
2454 				return (1);
2455 			case 2:
2456 				/* Select stuck at Command Phase */
2457 				NCRCMD(sc, NCRCMD_FLUSH);
2458 				break;
2459 			case 4:
2460 				if (sc->sc_features & NCR_F_DMASELECT &&
2461 				    sc->sc_cmdlen != 0)
2462 					printf("(%s:%d:%d): select; "
2463 					       "%lu left in DMA buffer "
2464 					"[intr %x, stat %x, step %d]\n",
2465 						sc->sc_dev.dv_xname,
2466 						sc_link->target,
2467 						sc_link->lun,
2468 						(u_long)sc->sc_cmdlen,
2469 						sc->sc_espintr,
2470 						sc->sc_espstat,
2471 						sc->sc_espstep);
2472 				/* So far, everything went fine */
2473 				break;
2474 			}
2475 
2476 			sc->sc_prevphase = INVALID_PHASE; /* ?? */
2477 			/* Do an implicit RESTORE POINTERS. */
2478 			sc->sc_dp = ecb->daddr;
2479 			sc->sc_dleft = ecb->dleft;
2480 			sc->sc_state = NCR_CONNECTED;
2481 			break;
2482 
2483 		} else {
2484 
2485 			printf("%s: unexpected status after select"
2486 				": [intr %x, stat %x, step %x]\n",
2487 				sc->sc_dev.dv_xname,
2488 				sc->sc_espintr, sc->sc_espstat,
2489 				sc->sc_espstep);
2490 			NCRCMD(sc, NCRCMD_FLUSH);
2491 			DELAY(1);
2492 			goto reset;
2493 		}
2494 		if (sc->sc_state == NCR_IDLE) {
2495 			printf("%s: stray interrupt\n",
2496 			    sc->sc_dev.dv_xname);
2497 				return (0);
2498 		}
2499 		break;
2500 
2501 	case NCR_CONNECTED:
2502 		if (sc->sc_flags & NCR_ICCS) {
2503 			/* "Initiate Command Complete Steps" in progress */
2504 			u_char msg;
2505 
2506 			sc->sc_flags &= ~NCR_ICCS;
2507 
2508 			if (!(sc->sc_espintr & NCRINTR_DONE)) {
2509 				printf("%s: ICCS: "
2510 				      ": [intr %x, stat %x, step %x]\n",
2511 					sc->sc_dev.dv_xname,
2512 					sc->sc_espintr, sc->sc_espstat,
2513 					sc->sc_espstep);
2514 			}
2515 			ncr53c9x_rdfifo(sc, NCR_RDFIFO_START);
2516 			if (sc->sc_imlen < 2)
2517 				printf("%s: can't get status, only %d bytes\n",
2518 				    sc->sc_dev.dv_xname, (int)sc->sc_imlen);
2519 			ecb->stat = sc->sc_imess[sc->sc_imlen - 2];
2520 			msg = sc->sc_imess[sc->sc_imlen - 1];
2521 			NCR_PHASE(("<stat:(%x,%x)>", ecb->stat, msg));
2522 			if (msg == MSG_CMDCOMPLETE) {
2523 				ecb->dleft = (ecb->flags & ECB_TENTATIVE_DONE)
2524 					? 0
2525 					: sc->sc_dleft;
2526 				if ((ecb->flags & ECB_SENSE) == 0)
2527 					ecb->xs->resid = ecb->dleft;
2528 				sc->sc_state = NCR_CMDCOMPLETE;
2529 			} else
2530 				printf("%s: STATUS_PHASE: msg %d\n",
2531 					sc->sc_dev.dv_xname, msg);
2532 			sc->sc_imlen = 0;
2533 			NCRCMD(sc, NCRCMD_MSGOK);
2534 			goto shortcut; /* ie. wait for disconnect */
2535 		}
2536 		break;
2537 	default:
2538 		/* Don't panic: reset. */
2539 		printf("%s: invalid state: %d\n",
2540 		      sc->sc_dev.dv_xname,
2541 		      sc->sc_state);
2542 		ncr53c9x_scsi_reset(sc);
2543 		goto out;
2544 		break;
2545 	}
2546 
2547 	/*
2548 	 * Driver is now in state NCR_CONNECTED, i.e. we
2549 	 * have a current command working the SCSI bus.
2550 	 */
2551 	if (sc->sc_state != NCR_CONNECTED || ecb == NULL) {
2552 		panic("ncr53c9x no nexus");
2553 	}
2554 
2555 	switch (sc->sc_phase) {
2556 	case MESSAGE_OUT_PHASE:
2557 		NCR_PHASE(("MESSAGE_OUT_PHASE "));
2558 		ncr53c9x_msgout(sc);
2559 		sc->sc_prevphase = MESSAGE_OUT_PHASE;
2560 		break;
2561 	case MESSAGE_IN_PHASE:
2562 msgin:
2563 		NCR_PHASE(("MESSAGE_IN_PHASE "));
2564 		if (sc->sc_espintr & NCRINTR_BS) {
2565 			if ((sc->sc_rev != NCR_VARIANT_FAS366) ||
2566 			    !(sc->sc_espstat2 & FAS_STAT2_EMPTY)) {
2567 				NCRCMD(sc, NCRCMD_FLUSH);
2568 			}
2569 			sc->sc_flags |= NCR_WAITI;
2570 			NCRCMD(sc, NCRCMD_TRANS);
2571 		} else if (sc->sc_espintr & NCRINTR_FC) {
2572 			if ((sc->sc_flags & NCR_WAITI) == 0) {
2573 				printf("%s: MSGIN: unexpected FC bit: "
2574 					"[intr %x, stat %x, step %x]\n",
2575 				sc->sc_dev.dv_xname,
2576 				sc->sc_espintr, sc->sc_espstat,
2577 				sc->sc_espstep);
2578 			}
2579 			sc->sc_flags &= ~NCR_WAITI;
2580 			ncr53c9x_rdfifo(sc,
2581 			    (sc->sc_prevphase == sc->sc_phase) ?
2582 			    NCR_RDFIFO_CONTINUE : NCR_RDFIFO_START);
2583 			ncr53c9x_msgin(sc);
2584 		} else {
2585 			printf("%s: MSGIN: weird bits: "
2586 				"[intr %x, stat %x, step %x]\n",
2587 				sc->sc_dev.dv_xname,
2588 				sc->sc_espintr, sc->sc_espstat,
2589 				sc->sc_espstep);
2590 		}
2591 		sc->sc_prevphase = MESSAGE_IN_PHASE;
2592 		goto shortcut;	/* i.e. expect data to be ready */
2593 		break;
2594 	case COMMAND_PHASE:
2595 		/*
2596 		 * Send the command block. Normally we don't see this
2597 		 * phase because the SEL_ATN command takes care of
2598 		 * all this. However, we end up here if either the
2599 		 * target or we wanted to exchange some more messages
2600 		 * first (e.g. to start negotiations).
2601 		 */
2602 
2603 		NCR_PHASE(("COMMAND_PHASE 0x%02x (%d) ",
2604 			ecb->cmd.cmd.opcode, ecb->clen));
2605 		if (NCR_READ_REG(sc, NCR_FFLAG) & NCRFIFO_FF) {
2606 			NCRCMD(sc, NCRCMD_FLUSH);
2607 /*			DELAY(1); */
2608 		}
2609 		if (sc->sc_features & NCR_F_DMASELECT) {
2610 			/* setup DMA transfer for command */
2611 			size = ecb->clen;
2612 			sc->sc_cmdlen = size;
2613 			sc->sc_cmdp = (caddr_t)&ecb->cmd.cmd;
2614 			NCRDMA_SETUP(sc, &sc->sc_cmdp, &sc->sc_cmdlen,
2615 				     0, &size);
2616 			/* Program the SCSI counter */
2617 			NCR_SET_COUNT(sc, size);
2618 
2619 			/* load the count in */
2620 			NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA);
2621 
2622 			/* start the command transfer */
2623 			NCRCMD(sc, NCRCMD_TRANS | NCRCMD_DMA);
2624 			NCRDMA_GO(sc);
2625 		} else {
2626 			ncr53c9x_wrfifo(sc, (u_char *)&ecb->cmd.cmd, ecb->clen);
2627 			sc->sc_cmdlen = 0;
2628 			NCRCMD(sc, NCRCMD_TRANS);
2629 		}
2630 		sc->sc_prevphase = COMMAND_PHASE;
2631 		break;
2632 	case DATA_OUT_PHASE:
2633 		NCR_PHASE(("DATA_OUT_PHASE [%ld] ",(long)sc->sc_dleft));
2634 		NCRCMD(sc, NCRCMD_FLUSH);
2635 		size = min(sc->sc_dleft, sc->sc_maxxfer);
2636 		NCRDMA_SETUP(sc, &sc->sc_dp, &sc->sc_dleft,
2637 			  0, &size);
2638 		sc->sc_prevphase = DATA_OUT_PHASE;
2639 		goto setup_xfer;
2640 	case DATA_IN_PHASE:
2641 		NCR_PHASE(("DATA_IN_PHASE "));
2642 		if (sc->sc_rev == NCR_VARIANT_ESP100)
2643 			NCRCMD(sc, NCRCMD_FLUSH);
2644 		size = min(sc->sc_dleft, sc->sc_maxxfer);
2645 		NCRDMA_SETUP(sc, &sc->sc_dp, &sc->sc_dleft,
2646 			  1, &size);
2647 		sc->sc_prevphase = DATA_IN_PHASE;
2648 	setup_xfer:
2649 		/* Target returned to data phase: wipe "done" memory */
2650 		ecb->flags &= ~ECB_TENTATIVE_DONE;
2651 
2652 		/* Program the SCSI counter */
2653 		NCR_SET_COUNT(sc, size);
2654 
2655 		/* load the count in */
2656 		NCRCMD(sc, NCRCMD_NOP|NCRCMD_DMA);
2657 
2658 		/*
2659 		 * Note that if `size' is 0, we've already transceived
2660 		 * all the bytes we want but we're still in DATA PHASE.
2661 		 * Apparently, the device needs padding. Also, a
2662 		 * transfer size of 0 means "maximum" to the chip
2663 		 * DMA logic.
2664 		 */
2665 		NCRCMD(sc,
2666 		       (size==0?NCRCMD_TRPAD:NCRCMD_TRANS)|NCRCMD_DMA);
2667 		NCRDMA_GO(sc);
2668 		return (1);
2669 	case STATUS_PHASE:
2670 		NCR_PHASE(("STATUS_PHASE "));
2671 		sc->sc_flags |= NCR_ICCS;
2672 		NCRCMD(sc, NCRCMD_ICCS);
2673 		sc->sc_prevphase = STATUS_PHASE;
2674 		goto shortcut;	/* i.e. expect status results soon */
2675 		break;
2676 	case INVALID_PHASE:
2677 		break;
2678 	default:
2679 		printf("%s: unexpected bus phase; resetting\n",
2680 		    sc->sc_dev.dv_xname);
2681 		goto reset;
2682 	}
2683 
2684 out:
2685 	return (1);
2686 
2687 reset:
2688 	ncr53c9x_init(sc, 1);
2689 	goto out;
2690 
2691 finish:
2692 	ncr53c9x_done(sc, ecb);
2693 	goto out;
2694 
2695 sched:
2696 	sc->sc_state = NCR_IDLE;
2697 	ncr53c9x_sched(sc);
2698 	goto out;
2699 
2700 shortcut:
2701 	/*
2702 	 * The idea is that many of the SCSI operations take very little
2703 	 * time, and going away and getting interrupted is too high an
2704 	 * overhead to pay. For example, selecting, sending a message
2705 	 * and command and then doing some work can be done in one "pass".
2706 	 *
2707 	 * The delay is a heuristic. It is 2 when at 20MHz, 2 at 25MHz and 1
2708 	 * at 40MHz. This needs testing.
2709 	 */
2710 	{
2711 		struct timeval wait, cur;
2712 
2713 		microuptime(&wait);
2714 		wait.tv_usec += 50/sc->sc_freq;
2715 		if (wait.tv_usec >= 1000000) {
2716 			wait.tv_sec++;
2717 			wait.tv_usec -= 1000000;
2718 		}
2719 		do {
2720 			if (NCRDMA_ISINTR(sc))
2721 				goto again;
2722 			microuptime(&cur);
2723 		} while (timercmp(&cur, &wait, <=));
2724 	}
2725 	goto out;
2726 }
2727 
2728 void
2729 ncr53c9x_abort(sc, ecb)
2730 	struct ncr53c9x_softc *sc;
2731 	struct ncr53c9x_ecb *ecb;
2732 {
2733 
2734 	/* 2 secs for the abort */
2735 	ecb->timeout = NCR_ABORT_TIMEOUT;
2736 	ecb->flags |= ECB_ABORT;
2737 
2738 	if (ecb == sc->sc_nexus) {
2739 		int timeout = ecb->timeout;
2740 
2741 		/*
2742 		 * If we're still selecting, the message will be scheduled
2743 		 * after selection is complete.
2744 		 */
2745 		if (sc->sc_state == NCR_CONNECTED)
2746 			ncr53c9x_sched_msgout(SEND_ABORT);
2747 
2748 		/*
2749 		 * Reschedule timeout.
2750 		 */
2751 		if (timeout > 1000000)
2752 			timeout = (timeout / 1000) * hz;
2753 		else
2754 			timeout = (timeout * hz) / 1000;
2755 		timeout_add(&ecb->to, timeout);
2756 	} else {
2757 		/*
2758 		 * Just leave the command where it is.
2759 		 * XXX - what choice do we have but to reset the SCSI
2760 		 *	 eventually?
2761 		 */
2762 		if (sc->sc_state == NCR_IDLE)
2763 			ncr53c9x_sched(sc);
2764 	}
2765 }
2766 
2767 void
2768 ncr53c9x_timeout(arg)
2769 	void *arg;
2770 {
2771 	struct ncr53c9x_ecb *ecb = arg;
2772 	struct scsi_xfer *xs = ecb->xs;
2773 	struct scsi_link *sc_link = xs->sc_link;
2774 	struct ncr53c9x_softc *sc = sc_link->adapter_softc;
2775 	struct ncr53c9x_tinfo *ti = &sc->sc_tinfo[sc_link->target];
2776 	int s;
2777 
2778 	sc_print_addr(sc_link);
2779 	printf("timed out [ecb %p (flags 0x%x, dleft %x, stat %x)], "
2780 	       "<state %d, nexus %p, phase(l %x, c %x, p %x), resid %lx, "
2781 	       "msg(q %x,o %x) %s>",
2782 		ecb, ecb->flags, ecb->dleft, ecb->stat,
2783 		sc->sc_state, sc->sc_nexus,
2784 		NCR_READ_REG(sc, NCR_STAT),
2785 		sc->sc_phase, sc->sc_prevphase,
2786 		(long)sc->sc_dleft, sc->sc_msgpriq, sc->sc_msgout,
2787 		NCRDMA_ISACTIVE(sc) ? "DMA active" : "");
2788 #if NCR53C9X_DEBUG > 1
2789 	printf("TRACE: %s.", ecb->trace);
2790 #endif
2791 
2792 	s = splbio();
2793 
2794 	if (ecb->flags & ECB_ABORT) {
2795 		/* abort timed out */
2796 		printf(" AGAIN\n");
2797 
2798 		ncr53c9x_init(sc, 1);
2799 	} else {
2800 		/* abort the operation that has timed out */
2801 		printf("\n");
2802 		xs->error = XS_TIMEOUT;
2803 		ncr53c9x_abort(sc, ecb);
2804 
2805 		/* Disable sync mode if stuck in a data phase */
2806 		if (ecb == sc->sc_nexus &&
2807 		    (ti->flags & T_SYNCMODE) != 0 &&
2808 		    (sc->sc_phase & (MSGI|CDI)) == 0) {
2809 			sc_print_addr(sc_link);
2810 			printf("sync negotiation disabled\n");
2811 			sc->sc_cfflags |= (1 << (sc_link->target + 16));
2812 		}
2813 	}
2814 
2815 	splx(s);
2816 }
2817