xref: /freebsd/sys/dev/aic7xxx/aic7xxx.c (revision 2ad872c5794e4c26fdf6ed219ad3f09ca0d5304a)
1 /*
2  * Generic driver for the aic7xxx based adaptec SCSI controllers
3  * Product specific probe and attach routines can be found in:
4  * i386/eisa/ahc_eisa.c	27/284X and aic7770 motherboard controllers
5  * pci/ahc_pci.c	3985, 3980, 3940, 2940, aic7895, aic7890,
6  *			aic7880, aic7870, aic7860, and aic7850 controllers
7  *
8  * Copyright (c) 1994, 1995, 1996, 1997, 1998 Justin T. Gibbs.
9  * All rights reserved.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions, and the following disclaimer,
16  *    without modification, immediately at the beginning of the file.
17  * 2. The name of the author may not be used to endorse or promote products
18  *    derived from this software without specific prior written permission.
19  *
20  * Where this Software is combined with software released under the terms of
21  * the GNU Public License ("GPL") and the terms of the GPL would require the
22  * combined work to also be released under the terms of the GPL, the terms
23  * and conditions of this License will apply in addition to those of the
24  * GPL with the exception of any terms or conditions of this License that
25  * conflict with, or are expressly prohibited by, the GPL.
26  *
27  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
28  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
29  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
30  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
31  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
32  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
33  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
34  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
35  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
36  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
37  * SUCH DAMAGE.
38  *
39  *      $Id: aic7xxx.c,v 1.13 1998/12/15 08:22:40 gibbs Exp $
40  */
41 /*
42  * A few notes on features of the driver.
43  *
44  * SCB paging takes advantage of the fact that devices stay disconnected
45  * from the bus a relatively long time and that while they're disconnected,
46  * having the SCBs for these transactions down on the host adapter is of
47  * little use.  Instead of leaving this idle SCB down on the card we copy
48  * it back up into kernel memory and reuse the SCB slot on the card to
49  * schedule another transaction.  This can be a real payoff when doing random
50  * I/O to tagged queueing devices since there are more transactions active at
51  * once for the device to sort for optimal seek reduction. The algorithm goes
52  * like this...
53  *
54  * The sequencer maintains two lists of its hardware SCBs.  The first is the
55  * singly linked free list which tracks all SCBs that are not currently in
56  * use.  The second is the doubly linked disconnected list which holds the
57  * SCBs of transactions that are in the disconnected state sorted most
58  * recently disconnected first.  When the kernel queues a transaction to
59  * the card, a hardware SCB to "house" this transaction is retrieved from
60  * either of these two lists.  If the SCB came from the disconnected list,
61  * a check is made to see if any data transfer or SCB linking (more on linking
62  * in a bit) information has been changed since it was copied from the host
63  * and if so, DMAs the SCB back up before it can be used.  Once a hardware
64  * SCB has been obtained, the SCB is DMAed from the host.  Before any work
65  * can begin on this SCB, the sequencer must ensure that either the SCB is
66  * for a tagged transaction or the target is not already working on another
67  * non-tagged transaction.  If a conflict arises in the non-tagged case, the
68  * sequencer finds the SCB for the active transactions and sets the SCB_LINKED
69  * field in that SCB to this next SCB to execute.  To facilitate finding
70  * active non-tagged SCBs, the last four bytes of up to the first four hardware
71  * SCBs serve as a storage area for the currently active SCB ID for each
72  * target.
73  *
74  * When a device reconnects, a search is made of the hardware SCBs to find
75  * the SCB for this transaction.  If the search fails, a hardware SCB is
76  * pulled from either the free or disconnected SCB list and the proper
77  * SCB is DMAed from the host.  If the MK_MESSAGE control bit is set
78  * in the control byte of the SCB while it was disconnected, the sequencer
79  * will assert ATN and attempt to issue a message to the host.
80  *
81  * When a command completes, a check for non-zero status and residuals is
82  * made.  If either of these conditions exists, the SCB is DMAed back up to
83  * the host so that it can interpret this information.  Additionally, in the
84  * case of bad status, the sequencer generates a special interrupt and pauses
85  * itself.  This allows the host to setup a request sense command if it
86  * chooses for this target synchronously with the error so that sense
87  * information isn't lost.
88  *
89  */
90 
91 #include <opt_aic7xxx.h>
92 
93 #include <pci.h>
94 #include <stddef.h>	/* For offsetof */
95 
96 #include <sys/param.h>
97 #include <sys/systm.h>
98 #include <sys/malloc.h>
99 #include <sys/buf.h>
100 #include <sys/proc.h>
101 
102 #include <cam/cam.h>
103 #include <cam/cam_ccb.h>
104 #include <cam/cam_sim.h>
105 #include <cam/cam_xpt_sim.h>
106 #include <cam/cam_debug.h>
107 
108 #include <cam/scsi/scsi_all.h>
109 #include <cam/scsi/scsi_message.h>
110 
111 #if NPCI > 0
112 #include <machine/bus_memio.h>
113 #endif
114 #include <machine/bus_pio.h>
115 #include <machine/bus.h>
116 #include <machine/clock.h>
117 
118 #include <vm/vm.h>
119 #include <vm/vm_param.h>
120 #include <vm/pmap.h>
121 
122 #include <dev/aic7xxx/aic7xxx.h>
123 #include <dev/aic7xxx/sequencer.h>
124 
125 #include <aic7xxx_reg.h>
126 #include <aic7xxx_seq.h>
127 
128 #include <sys/kernel.h>
129 
130 #ifndef AHC_TMODE_ENABLE
131 #define AHC_TMODE_ENABLE 0
132 #endif
133 
134 #define MAX(a,b) (((a) > (b)) ? (a) : (b))
135 #define MIN(a,b) (((a) < (b)) ? (a) : (b))
136 #define ALL_CHANNELS '\0'
137 #define ALL_TARGETS_MASK 0xFFFF
138 
139 #define	SIM_IS_SCSIBUS_B(ahc, sim)	\
140 	(sim == ahc->sim_b)
141 #define	SCB_IS_SCSIBUS_B(scb)	\
142 	(((scb)->hscb->tcl & SELBUSB) != 0)
143 #define	SCB_TARGET(scb)	\
144 	(((scb)->hscb->tcl & TID) >> 4)
145 #define	SCB_CHANNEL(scb) \
146 	(SCB_IS_SCSIBUS_B(scb) ? 'B' : 'A')
147 #define	SCB_LUN(scb)	\
148 	((scb)->hscb->tcl & LID)
149 #define SCB_TARGET_OFFSET(scb)		\
150 	(SCB_TARGET(scb) + (SCB_IS_SCSIBUS_B(scb) ? 8 : 0))
151 #define SCB_TARGET_MASK(scb)		\
152 	(0x01 << (SCB_TARGET_OFFSET(scb)))
153 
154 #define ccb_scb_ptr spriv_ptr0
155 #define ccb_ahc_ptr spriv_ptr1
156 
157 typedef enum {
158 	ROLE_UNKNOWN,
159 	ROLE_INITIATOR,
160 	ROLE_TARGET,
161 } role_t;
162 
163 struct ahc_devinfo {
164 	int	  target_offset;
165 	u_int16_t target_mask;
166 	u_int8_t  target;
167 	u_int8_t  lun;
168 	char	  channel;
169 	role_t	  role;		/*
170 				 * Only guaranteed to be correct if not
171 				 * in the busfree state.
172 				 */
173 };
174 
175 typedef enum {
176 	SEARCH_COMPLETE,
177 	SEARCH_COUNT,
178 	SEARCH_REMOVE
179 } ahc_search_action;
180 
181 u_long ahc_unit = 0;
182 
183 #ifdef AHC_DEBUG
184 static int     ahc_debug = AHC_DEBUG;
185 #endif
186 
187 #if NPCI > 0
188 void ahc_pci_intr(struct ahc_softc *ahc);
189 #endif
190 
191 #if UNUSED
192 static void	ahc_dump_targcmd(struct target_cmd *cmd);
193 #endif
194 static void	ahc_shutdown(int howto, void *arg);
195 static cam_status
196 		ahc_find_tmode_devs(struct ahc_softc *ahc,
197 				    struct cam_sim *sim, union ccb *ccb,
198 				    struct tmode_tstate **tstate,
199 				    struct tmode_lstate **lstate,
200 				    int notfound_failure);
201 static void	ahc_action(struct cam_sim *sim, union ccb *ccb);
202 static void	ahc_async(void *callback_arg, u_int32_t code,
203 			  struct cam_path *path, void *arg);
204 static void	ahc_execute_scb(void *arg, bus_dma_segment_t *dm_segs,
205 				int nsegments, int error);
206 static void	ahc_poll(struct cam_sim *sim);
207 static void	ahc_setup_data(struct ahc_softc *ahc,
208 			       struct ccb_scsiio *csio, struct scb *scb);
209 static void	ahc_freeze_devq(struct ahc_softc *ahc, struct cam_path *path);
210 static struct scb *
211                 ahc_get_scb(struct ahc_softc *ahc);
212 static void     ahc_free_scb(struct ahc_softc *ahc, struct scb *scb);
213 static struct scb *
214 		ahc_alloc_scb(struct ahc_softc *ahc);
215 static void	ahc_fetch_devinfo(struct ahc_softc *ahc,
216 				  struct ahc_devinfo *devinfo);
217 static void	ahc_compile_devinfo(struct ahc_devinfo *devinfo,
218 				    u_int target, u_int lun, char channel,
219 				    role_t role);
220 static u_int	ahc_abort_wscb(struct ahc_softc *ahc, u_int scbpos, u_int prev);
221 static void	ahc_done(struct ahc_softc *ahc, struct scb *scbp);
222 static void	ahc_handle_target_cmd(struct ahc_softc *ahc,
223 				      struct target_cmd *cmd);
224 static void 	ahc_handle_seqint(struct ahc_softc *ahc, u_int intstat);
225 static void	ahc_handle_scsiint(struct ahc_softc *ahc, u_int intstat);
226 static void	ahc_build_transfer_msg(struct ahc_softc *ahc,
227 				       struct ahc_devinfo *devinfo);
228 static void	ahc_setup_initiator_msgout(struct ahc_softc *ahc,
229 					   struct ahc_devinfo *devinfo,
230 					   struct scb *scb);
231 static void	ahc_setup_target_msgin(struct ahc_softc *ahc,
232 				       struct ahc_devinfo *devinfo);
233 static int	ahc_handle_msg_reject(struct ahc_softc *ahc,
234 				      struct ahc_devinfo *devinfo);
235 static void	ahc_clear_msg_state(struct ahc_softc *ahc);
236 static void	ahc_handle_message_phase(struct ahc_softc *ahc,
237 					 struct cam_path *path);
238 static int	ahc_sent_msg(struct ahc_softc *ahc, u_int msgtype, int full);
239 static int	ahc_parse_msg(struct ahc_softc *ahc, struct cam_path *path,
240 			      struct ahc_devinfo *devinfo);
241 static void	ahc_handle_devreset(struct ahc_softc *ahc, int target,
242 				    char channel, cam_status status,
243 				    ac_code acode, char *message,
244 				    int verbose_only);
245 static void	ahc_loadseq(struct ahc_softc *ahc);
246 static int	ahc_check_patch(struct ahc_softc *ahc,
247 				struct patch **start_patch,
248 				int start_instr, int *skip_addr);
249 static void	ahc_download_instr(struct ahc_softc *ahc,
250 				   int instrptr, u_int8_t *dconsts);
251 static int	ahc_match_scb(struct scb *scb, int target, char channel,
252 			      int lun, u_int tag);
253 #ifdef AHC_DEBUG
254 static void	ahc_print_scb(struct scb *scb);
255 #endif
256 static int	ahc_search_qinfifo(struct ahc_softc *ahc, int target,
257 				   char channel, int lun, u_int tag,
258 				   u_int32_t status, ahc_search_action action);
259 static void	ahc_abort_ccb(struct ahc_softc *ahc, struct cam_sim *sim,
260 			      union ccb *ccb);
261 static int	ahc_reset_channel(struct ahc_softc *ahc, char channel,
262 				  int initiate_reset);
263 static int	ahc_abort_scbs(struct ahc_softc *ahc, int target,
264 			       char channel, int lun, u_int tag,
265 			       u_int32_t status);
266 static int	ahc_search_disc_list(struct ahc_softc *ahc, int target,
267 				     char channel, int lun, u_int tag);
268 static u_int	ahc_rem_scb_from_disc_list(struct ahc_softc *ahc,
269 					   u_int prev, u_int scbptr);
270 static void	ahc_add_curscb_to_free_list(struct ahc_softc *ahc);
271 static void	ahc_clear_intstat(struct ahc_softc *ahc);
272 static void	ahc_reset_current_bus(struct ahc_softc *ahc);
273 static struct ahc_syncrate *
274 		ahc_devlimited_syncrate(struct ahc_softc *ahc, u_int *period);
275 static struct ahc_syncrate *
276 		ahc_find_syncrate(struct ahc_softc *ahc, u_int *period,
277 				  u_int maxsync);
278 static u_int	ahc_find_period(struct ahc_softc *ahc, u_int scsirate,
279 				u_int maxsync);
280 static void	ahc_validate_offset(struct ahc_softc *ahc,
281 				    struct ahc_syncrate *syncrate,
282 				    u_int *offset, int wide);
283 static void	ahc_update_target_msg_request(struct ahc_softc *ahc,
284 					      struct ahc_devinfo *devinfo,
285 					      struct ahc_target_tinfo *tinfo,
286 					      int force);
287 static int	ahc_create_path(struct ahc_softc *ahc,
288 				struct ahc_devinfo *devinfo,
289 				struct cam_path **path);
290 static void	ahc_set_syncrate(struct ahc_softc *ahc,
291 				 struct ahc_devinfo *devinfo,
292 				 struct cam_path *path,
293 				 struct ahc_syncrate *syncrate,
294 				 u_int period, u_int offset, u_int type);
295 static void	ahc_set_width(struct ahc_softc *ahc,
296 			      struct ahc_devinfo *devinfo,
297 			      struct cam_path *path, u_int width, u_int type);
298 static void	ahc_construct_sdtr(struct ahc_softc *ahc,
299 				   u_int period, u_int offset);
300 
301 static void	ahc_construct_wdtr(struct ahc_softc *ahc, u_int bus_width);
302 
303 static void	ahc_calc_residual(struct scb *scb);
304 
305 static void	ahc_update_pending_syncrates(struct ahc_softc *ahc);
306 
307 static void	ahc_set_recoveryscb(struct ahc_softc *ahc, struct scb *scb);
308 
309 static timeout_t
310 		ahc_timeout;
311 static __inline int  sequencer_paused(struct ahc_softc *ahc);
312 static __inline void pause_sequencer(struct ahc_softc *ahc);
313 static __inline void unpause_sequencer(struct ahc_softc *ahc,
314 				       int unpause_always);
315 static __inline void restart_sequencer(struct ahc_softc *ahc);
316 static __inline u_int ahc_index_busy_tcl(struct ahc_softc *ahc,
317 					 u_int tcl, int unbusy);
318 
319 static __inline void	 ahc_busy_tcl(struct ahc_softc *ahc, struct scb *scb);
320 
321 static __inline void	   ahc_freeze_ccb(union ccb* ccb);
322 static __inline cam_status ahc_ccb_status(union ccb* ccb);
323 static __inline void	   ahc_set_ccb_status(union ccb* ccb,
324 					      cam_status status);
325 
326 static __inline u_int32_t
327 ahc_hscb_busaddr(struct ahc_softc *ahc, u_int index)
328 {
329 	return (ahc->hscb_busaddr + (sizeof(struct hardware_scb) * index));
330 }
331 
332 #define AHC_BUSRESET_DELAY	25	/* Reset delay in us */
333 
334 static __inline int
335 sequencer_paused(struct ahc_softc *ahc)
336 {
337 	return ((ahc_inb(ahc, HCNTRL) & PAUSE) != 0);
338 }
339 
340 static __inline void
341 pause_sequencer(struct ahc_softc *ahc)
342 {
343 	ahc_outb(ahc, HCNTRL, ahc->pause);
344 
345 	/*
346 	 * Since the sequencer can disable pausing in a critical section, we
347 	 * must loop until it actually stops.
348 	 */
349 	while (sequencer_paused(ahc) == 0)
350 		;
351 }
352 
353 static __inline void
354 unpause_sequencer(struct ahc_softc *ahc, int unpause_always)
355 {
356 	if (unpause_always
357 	 || (ahc_inb(ahc, INTSTAT) & (SCSIINT | SEQINT | BRKADRINT)) == 0)
358 		ahc_outb(ahc, HCNTRL, ahc->unpause);
359 }
360 
361 /*
362  * Restart the sequencer program from address zero
363  */
364 static __inline void
365 restart_sequencer(struct ahc_softc *ahc)
366 {
367 	pause_sequencer(ahc);
368 	ahc_outb(ahc, SEQCTL, FASTMODE|SEQRESET);
369 	unpause_sequencer(ahc, /*unpause_always*/TRUE);
370 }
371 
372 static __inline u_int
373 ahc_index_busy_tcl(struct ahc_softc *ahc, u_int tcl, int unbusy)
374 {
375 	u_int scbid;
376 
377 	scbid = ahc->untagged_scbs[tcl];
378 	if (unbusy)
379 		ahc->untagged_scbs[tcl] = SCB_LIST_NULL;
380 
381 	return (scbid);
382 }
383 
384 static __inline void
385 ahc_busy_tcl(struct ahc_softc *ahc, struct scb *scb)
386 {
387 	ahc->untagged_scbs[scb->hscb->tcl] = scb->hscb->tag;
388 }
389 
390 static __inline void
391 ahc_freeze_ccb(union ccb* ccb)
392 {
393 	if ((ccb->ccb_h.status & CAM_DEV_QFRZN) == 0) {
394 		ccb->ccb_h.status |= CAM_DEV_QFRZN;
395 		xpt_freeze_devq(ccb->ccb_h.path, /*count*/1);
396 	}
397 }
398 
399 static __inline cam_status
400 ahc_ccb_status(union ccb* ccb)
401 {
402 	return (ccb->ccb_h.status & CAM_STATUS_MASK);
403 }
404 
405 static __inline void
406 ahc_set_ccb_status(union ccb* ccb, cam_status status)
407 {
408 	ccb->ccb_h.status &= ~CAM_STATUS_MASK;
409 	ccb->ccb_h.status |= status;
410 }
411 
412 char *
413 ahc_name(struct ahc_softc *ahc)
414 {
415 	static char name[10];
416 
417 	snprintf(name, sizeof(name), "ahc%d", ahc->unit);
418 	return (name);
419 }
420 
421 #ifdef  AHC_DEBUG
422 static void
423 ahc_print_scb(struct scb *scb)
424 {
425 	struct hardware_scb *hscb = scb->hscb;
426 
427 	printf("scb:%p control:0x%x tcl:0x%x cmdlen:%d cmdpointer:0x%lx\n",
428 		scb,
429 		hscb->control,
430 		hscb->tcl,
431 		hscb->cmdlen,
432 		hscb->cmdpointer );
433 	printf("        datlen:%d data:0x%lx segs:0x%x segp:0x%lx\n",
434 		hscb->datalen,
435 		hscb->data,
436 		hscb->SG_count,
437 		hscb->SG_pointer);
438 	printf("	sg_addr:%lx sg_len:%ld\n",
439 		scb->ahc_dma[0].addr,
440 		scb->ahc_dma[0].len);
441 	printf("	cdb:%x %x %x %x %x %x %x %x %x %x %x %x\n",
442 		hscb->cmdstore[0], hscb->cmdstore[1], hscb->cmdstore[2],
443 		hscb->cmdstore[3], hscb->cmdstore[4], hscb->cmdstore[5],
444 		hscb->cmdstore[6], hscb->cmdstore[7], hscb->cmdstore[8],
445 		hscb->cmdstore[9], hscb->cmdstore[10], hscb->cmdstore[11]);
446 }
447 #endif
448 
449 static struct {
450         u_int8_t errno;
451 	char *errmesg;
452 } hard_error[] = {
453 	{ ILLHADDR,	"Illegal Host Access" },
454 	{ ILLSADDR,	"Illegal Sequencer Address referrenced" },
455 	{ ILLOPCODE,	"Illegal Opcode in sequencer program" },
456 	{ SQPARERR,	"Sequencer Parity Error" },
457 	{ DPARERR,	"Data-path Parity Error" },
458 	{ MPARERR,	"Scratch or SCB Memory Parity Error" },
459 	{ PCIERRSTAT,	"PCI Error detected" },
460 	{ CIOPARERR,	"CIOBUS Parity Error" },
461 };
462 
463 
464 /*
465  * Valid SCSIRATE values.  (p. 3-17)
466  * Provides a mapping of tranfer periods in ns to the proper value to
467  * stick in the scsiscfr reg to use that transfer rate.
468  */
469 #define AHC_SYNCRATE_ULTRA2	0
470 #define AHC_SYNCRATE_ULTRA	2
471 #define AHC_SYNCRATE_FAST	5
472 static struct ahc_syncrate ahc_syncrates[] = {
473 	/* ultra2  fast/ultra  period	rate */
474 	{ 0x13,   0x000,	10,	"40.0"	},
475 	{ 0x14,   0x000,	11,	"33.0"	},
476 	{ 0x15,   0x100,	12,	"20.0"	},
477 	{ 0x16,   0x110,	15,	"16.0"	},
478 	{ 0x17,   0x120,	18,	"13.4"	},
479 	{ 0x18,   0x000,	25,	"10.0"	},
480 	{ 0x19,   0x010,	31,	"8.0"	},
481 	{ 0x1a,   0x020,	37,	"6.67"	},
482 	{ 0x1b,   0x030,	43,	"5.7"	},
483 	{ 0x10,   0x040,	50,	"5.0"	},
484 	{ 0x00,   0x050,	56,	"4.4"	},
485 	{ 0x00,   0x060,	62,	"4.0"	},
486 	{ 0x00,   0x070,	68,	"3.6"	},
487 	{ 0x00,   0x000,	0,	NULL	}
488 };
489 
490 /*
491  * Allocate a controller structure for a new device and initialize it.
492  */
493 struct ahc_softc *
494 ahc_alloc(int unit, u_int32_t iobase, vm_offset_t maddr, ahc_chip chip,
495 	  ahc_feature features, ahc_flag flags, struct scb_data *scb_data)
496 {
497 	/*
498 	 * find unit and check we have that many defined
499 	 */
500 	struct  ahc_softc *ahc;
501 	size_t	alloc_size;
502 
503 	/*
504 	 * Allocate a storage area for us
505 	 */
506 	if (scb_data == NULL)
507 		/*
508 		 * We are not sharing SCB space with another controller
509 		 * so allocate our own SCB data space.
510 		 */
511 		alloc_size = sizeof(struct full_ahc_softc);
512 	else
513 		alloc_size = sizeof(struct ahc_softc);
514 	ahc = malloc(alloc_size, M_DEVBUF, M_NOWAIT);
515 	if (!ahc) {
516 		printf("ahc%d: cannot malloc!\n", unit);
517 		return NULL;
518 	}
519 	bzero(ahc, alloc_size);
520 	if (scb_data == NULL) {
521 		struct full_ahc_softc* full_softc = (struct full_ahc_softc*)ahc;
522 		ahc->scb_data = &full_softc->scb_data_storage;
523 		STAILQ_INIT(&ahc->scb_data->free_scbs);
524 	} else
525 		ahc->scb_data = scb_data;
526 	LIST_INIT(&ahc->pending_ccbs);
527 	ahc->unit = unit;
528 
529 	/*
530 	 * XXX This should be done by the bus specific probe stubs with
531 	 *     the bus layer providing the bsh and tag.  Unfortunately,
532 	 *     we need to clean up how we configure things before this
533 	 *     can happen.
534 	 */
535 	if (maddr != NULL) {
536 		ahc->tag = I386_BUS_SPACE_MEM;
537 		ahc->bsh = (bus_space_handle_t)maddr;
538 	} else {
539 		ahc->tag = I386_BUS_SPACE_IO;
540 		ahc->bsh = (bus_space_handle_t)iobase;
541 	}
542 	ahc->chip = chip;
543 	ahc->features = features;
544 	ahc->flags = flags;
545 	ahc->unpause = (ahc_inb(ahc, HCNTRL) & IRQMS) | INTEN;
546 	ahc->pause = ahc->unpause | PAUSE;
547 
548 	return (ahc);
549 }
550 
551 void
552 ahc_free(ahc)
553 	struct ahc_softc *ahc;
554 {
555 	free(ahc, M_DEVBUF);
556 	return;
557 }
558 
559 int
560 ahc_reset(struct ahc_softc *ahc)
561 {
562 	u_int	sblkctl;
563 	int	wait;
564 
565 	ahc_outb(ahc, HCNTRL, CHIPRST | ahc->pause);
566 	/*
567 	 * Ensure that the reset has finished
568 	 */
569 	wait = 1000;
570 	while (--wait && !(ahc_inb(ahc, HCNTRL) & CHIPRSTACK))
571 		DELAY(1000);
572 	if (wait == 0) {
573 		printf("%s: WARNING - Failed chip reset!  "
574 		       "Trying to initialize anyway.\n", ahc_name(ahc));
575 	}
576 	ahc_outb(ahc, HCNTRL, ahc->pause);
577 
578 	/* Determine channel configuration */
579 	sblkctl = ahc_inb(ahc, SBLKCTL) & (SELBUSB|SELWIDE);
580 	/* No Twin Channel PCI cards */
581 	if ((ahc->chip & AHC_PCI) != 0)
582 		sblkctl &= ~SELBUSB;
583 	switch (sblkctl) {
584 	case 0:
585 		/* Single Narrow Channel */
586 		break;
587 	case 2:
588 		/* Wide Channel */
589 		ahc->features |= AHC_WIDE;
590 		break;
591 	case 8:
592 		/* Twin Channel */
593 		ahc->features |= AHC_TWIN;
594 		break;
595 	default:
596 		printf(" Unsupported adapter type.  Ignoring\n");
597 		return(-1);
598 	}
599 	return (0);
600 }
601 
602 /*
603  * Called when we have an active connection to a target on the bus,
604  * this function finds the nearest syncrate to the input period limited
605  * by the capabilities of the bus connectivity of the target.
606  */
607 static struct ahc_syncrate *
608 ahc_devlimited_syncrate(struct ahc_softc *ahc, u_int *period) {
609 	u_int	maxsync;
610 
611 	if ((ahc->features & AHC_ULTRA2) != 0) {
612 		if ((ahc_inb(ahc, SBLKCTL) & ENAB40) != 0
613 		 && (ahc_inb(ahc, SSTAT2) & EXP_ACTIVE) == 0) {
614 			maxsync = AHC_SYNCRATE_ULTRA2;
615 		} else {
616 			maxsync = AHC_SYNCRATE_ULTRA;
617 		}
618 	} else if ((ahc->features & AHC_ULTRA) != 0) {
619 		maxsync = AHC_SYNCRATE_ULTRA;
620 	} else {
621 		maxsync = AHC_SYNCRATE_FAST;
622 	}
623 	return (ahc_find_syncrate(ahc, period, maxsync));
624 }
625 
626 /*
627  * Look up the valid period to SCSIRATE conversion in our table.
628  * Return the period and offset that should be sent to the target
629  * if this was the beginning of an SDTR.
630  */
631 static struct ahc_syncrate *
632 ahc_find_syncrate(struct ahc_softc *ahc, u_int *period, u_int maxsync)
633 {
634 	struct ahc_syncrate *syncrate;
635 
636 	syncrate = &ahc_syncrates[maxsync];
637 	while ((syncrate->rate != NULL)
638 	    && ((ahc->features & AHC_ULTRA2) == 0
639 	     || (syncrate->sxfr_ultra2 != 0))) {
640 
641 		if (*period <= syncrate->period) {
642 			/*
643 			 * When responding to a target that requests
644 			 * sync, the requested rate may fall between
645 			 * two rates that we can output, but still be
646 			 * a rate that we can receive.  Because of this,
647 			 * we want to respond to the target with
648 			 * the same rate that it sent to us even
649 			 * if the period we use to send data to it
650 			 * is lower.  Only lower the response period
651 			 * if we must.
652 			 */
653 			if (syncrate == &ahc_syncrates[maxsync]) {
654 				*period = syncrate->period;
655 			}
656 			break;
657 		}
658 		syncrate++;
659 	}
660 
661 	if ((*period == 0)
662 	 || (syncrate->rate == NULL)
663 	 || ((ahc->features & AHC_ULTRA2) != 0
664 	  && (syncrate->sxfr_ultra2 == 0))) {
665 		/* Use asynchronous transfers. */
666 		*period = 0;
667 		syncrate = NULL;
668 	}
669 	return (syncrate);
670 }
671 
672 static u_int
673 ahc_find_period(struct ahc_softc *ahc, u_int scsirate, u_int maxsync)
674 {
675 	struct ahc_syncrate *syncrate;
676 
677 	if ((ahc->features & AHC_ULTRA2) != 0) {
678 		scsirate &= SXFR_ULTRA2;
679 	} else  {
680 		scsirate &= SXFR;
681 	}
682 
683 	syncrate = &ahc_syncrates[maxsync];
684 	while (syncrate->rate != NULL) {
685 
686 		if ((ahc->features & AHC_ULTRA2) != 0) {
687 			if (syncrate->sxfr_ultra2 == 0)
688 				break;
689 			else if (scsirate == syncrate->sxfr_ultra2)
690 				return (syncrate->period);
691 		} else if (scsirate == (syncrate->sxfr & ~ULTRA_SXFR)) {
692 				return (syncrate->period);
693 		}
694 		syncrate++;
695 	}
696 	return (0); /* async */
697 }
698 
699 static void
700 ahc_validate_offset(struct ahc_softc *ahc, struct ahc_syncrate *syncrate,
701 		    u_int *offset, int wide)
702 {
703 	u_int maxoffset;
704 
705 	/* Limit offset to what we can do */
706 	if (syncrate == NULL) {
707 		maxoffset = 0;
708 	} else if ((ahc->features & AHC_ULTRA2) != 0) {
709 		maxoffset = MAX_OFFSET_ULTRA2;
710 	} else {
711 		if (wide)
712 			maxoffset = MAX_OFFSET_16BIT;
713 		else
714 			maxoffset = MAX_OFFSET_8BIT;
715 	}
716 	*offset = MIN(*offset, maxoffset);
717 }
718 
719 static void
720 ahc_update_target_msg_request(struct ahc_softc *ahc,
721 			      struct ahc_devinfo *devinfo,
722 			      struct ahc_target_tinfo *tinfo,
723 			      int force)
724 {
725 	int paused;
726 	u_int targ_msg_req_orig;
727 
728 	targ_msg_req_orig = ahc->targ_msg_req;
729 	if (tinfo->current.period != tinfo->goal.period
730 	 || tinfo->current.width != tinfo->goal.width
731 	 || (force
732 	  && (tinfo->goal.period != 0
733 	   || tinfo->goal.width != MSG_EXT_WDTR_BUS_8_BIT)))
734 		ahc->targ_msg_req |= devinfo->target_mask;
735 	else
736 		ahc->targ_msg_req &= ~devinfo->target_mask;
737 
738 	if (ahc->targ_msg_req != targ_msg_req_orig) {
739 		/* Update the message request bit for this target */
740 		paused = sequencer_paused(ahc);
741 
742 		if (!paused)
743 			pause_sequencer(ahc);
744 
745 		ahc_outb(ahc, TARGET_MSG_REQUEST, ahc->targ_msg_req & 0xFF);
746 		ahc_outb(ahc, TARGET_MSG_REQUEST + 1,
747 			 (ahc->targ_msg_req >> 8) & 0xFF);
748 
749 		if (!paused)
750 			unpause_sequencer(ahc, /*unpause always*/FALSE);
751 	}
752 }
753 
754 static int
755 ahc_create_path(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
756 		     struct cam_path **path)
757 {
758 	path_id_t path_id;
759 
760 	if (devinfo->channel == 'B')
761 		path_id = cam_sim_path(ahc->sim_b);
762 	else
763 		path_id = cam_sim_path(ahc->sim);
764 
765 	return (xpt_create_path(path, /*periph*/NULL,
766 				path_id, devinfo->target,
767 				devinfo->lun));
768 }
769 
770 static void
771 ahc_set_syncrate(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
772 		 struct cam_path *path, struct ahc_syncrate *syncrate,
773 		 u_int period, u_int offset, u_int type)
774 {
775 	struct ahc_target_tinfo *tinfo;
776 	u_int old_period;
777 	u_int old_offset;
778 
779 	if (syncrate == NULL) {
780 		period = 0;
781 		offset = 0;
782 	}
783 
784 	tinfo = &ahc->transinfo[devinfo->target_offset];
785 	old_period = tinfo->current.period;
786 	old_offset = tinfo->current.offset;
787 
788 	if ((type & AHC_TRANS_CUR) != 0
789 	 && (old_period != period || old_offset != offset)) {
790 		struct	cam_path *path2;
791 		u_int	scsirate;
792 
793 		scsirate = tinfo->scsirate;
794 		if ((ahc->features & AHC_ULTRA2) != 0) {
795 
796 			scsirate &= ~SXFR_ULTRA2;
797 
798 			if (syncrate != NULL) {
799 				scsirate |= syncrate->sxfr_ultra2;
800 			}
801 
802 			if ((type & AHC_TRANS_ACTIVE) == AHC_TRANS_ACTIVE)
803 				ahc_outb(ahc, SCSIOFFSET, offset);
804 		} else {
805 
806 			scsirate &= ~(SXFR|SOFS);
807 			/*
808 			 * Ensure Ultra mode is set properly for
809 			 * this target.
810 			 */
811 			ahc->ultraenb &= ~devinfo->target_mask;
812 			if (syncrate != NULL) {
813 				if (syncrate->sxfr & ULTRA_SXFR) {
814 					ahc->ultraenb |= devinfo->target_mask;
815 				}
816 				scsirate |= syncrate->sxfr & SXFR;
817 				scsirate |= offset & SOFS;
818 			}
819 			if ((type & AHC_TRANS_ACTIVE) == AHC_TRANS_ACTIVE) {
820 				u_int sxfrctl0;
821 
822 				sxfrctl0 = ahc_inb(ahc, SXFRCTL0);
823 				sxfrctl0 &= ~FAST20;
824 				if (ahc->ultraenb & devinfo->target_mask)
825 					sxfrctl0 |= FAST20;
826 				ahc_outb(ahc, SXFRCTL0, sxfrctl0);
827 			}
828 		}
829 		if ((type & AHC_TRANS_ACTIVE) == AHC_TRANS_ACTIVE)
830 			ahc_outb(ahc, SCSIRATE, scsirate);
831 
832 		tinfo->scsirate = scsirate;
833 		tinfo->current.period = period;
834 		tinfo->current.offset = offset;
835 
836 		/* Update the syncrates in any pending scbs */
837 		ahc_update_pending_syncrates(ahc);
838 
839 		/*
840 		 * If possible, tell the SCSI layer about the
841 		 * new transfer parameters.
842 		 */
843 		/* If possible, update the XPT's notion of our transfer rate */
844 		path2 = NULL;
845 		if (path == NULL) {
846 			int error;
847 
848 			error = ahc_create_path(ahc, devinfo, &path2);
849 			if (error == CAM_REQ_CMP)
850 				path = path2;
851 			else
852 				path2 = NULL;
853 		}
854 
855 		if (path != NULL) {
856 			struct	ccb_trans_settings neg;
857 
858 			neg.sync_period = period;
859 			neg.sync_offset = offset;
860 			neg.valid = CCB_TRANS_SYNC_RATE_VALID
861 				  | CCB_TRANS_SYNC_OFFSET_VALID;
862 			xpt_setup_ccb(&neg.ccb_h, path, /*priority*/1);
863 			xpt_async(AC_TRANSFER_NEG, path, &neg);
864 		}
865 
866 		if (path2 != NULL)
867 			xpt_free_path(path2);
868 
869 		if (bootverbose) {
870 			if (offset != 0) {
871 				printf("%s: target %d synchronous at %sMHz, "
872 				       "offset = 0x%x\n", ahc_name(ahc),
873 				       devinfo->target, syncrate->rate, offset);
874 			} else {
875 				printf("%s: target %d using "
876 				       "asynchronous transfers\n",
877 				       ahc_name(ahc), devinfo->target);
878 			}
879 		}
880 	}
881 
882 	if ((type & AHC_TRANS_GOAL) != 0) {
883 		tinfo->goal.period = period;
884 		tinfo->goal.offset = offset;
885 	}
886 
887 	if ((type & AHC_TRANS_USER) != 0) {
888 		tinfo->user.period = period;
889 		tinfo->user.offset = offset;
890 	}
891 
892 	ahc_update_target_msg_request(ahc, devinfo, tinfo, /*force*/FALSE);
893 }
894 
895 static void
896 ahc_set_width(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
897 	      struct cam_path *path, u_int width, u_int type)
898 {
899 	struct ahc_target_tinfo *tinfo;
900 	u_int  oldwidth;
901 
902 	tinfo = &ahc->transinfo[devinfo->target_offset];
903 	oldwidth = tinfo->current.width;
904 
905 	if ((type & AHC_TRANS_CUR) != 0 && oldwidth != width) {
906 		struct  cam_path *path2;
907 		u_int	scsirate;
908 
909 		scsirate =  tinfo->scsirate;
910 		scsirate &= ~WIDEXFER;
911 		if (width == MSG_EXT_WDTR_BUS_16_BIT)
912 			scsirate |= WIDEXFER;
913 
914 		tinfo->scsirate = scsirate;
915 
916 		if ((type & AHC_TRANS_ACTIVE) == AHC_TRANS_ACTIVE)
917 			ahc_outb(ahc, SCSIRATE, scsirate);
918 
919 		tinfo->current.width = width;
920 
921 		/* If possible, update the XPT's notion of our transfer rate */
922 		path2 = NULL;
923 		if (path == NULL) {
924 			int error;
925 
926 			error = ahc_create_path(ahc, devinfo, &path2);
927 			if (error == CAM_REQ_CMP)
928 				path = path2;
929 			else
930 				path2 = NULL;
931 		}
932 
933 		if (path != NULL) {
934 			struct	ccb_trans_settings neg;
935 
936 			neg.bus_width = width;
937 			neg.valid = CCB_TRANS_BUS_WIDTH_VALID;
938 			xpt_setup_ccb(&neg.ccb_h, path, /*priority*/1);
939 			xpt_async(AC_TRANSFER_NEG, path, &neg);
940 		}
941 
942 		if (path2 != NULL)
943 			xpt_free_path(path2);
944 
945 		if (bootverbose) {
946 			printf("%s: target %d using %dbit transfers\n",
947 			       ahc_name(ahc), devinfo->target,
948 			       8 * (0x01 << width));
949 		}
950 	}
951 	if ((type & AHC_TRANS_GOAL) != 0)
952 		tinfo->goal.width = width;
953 	if ((type & AHC_TRANS_USER) != 0)
954 		tinfo->user.width = width;
955 
956 	ahc_update_target_msg_request(ahc, devinfo, tinfo, /*force*/FALSE);
957 }
958 
959 /*
960  * Attach all the sub-devices we can find
961  */
962 int
963 ahc_attach(struct ahc_softc *ahc)
964 {
965 	struct ccb_setasync csa;
966 	struct cam_devq *devq;
967 	int bus_id;
968 	int bus_id2;
969 	struct cam_sim *sim;
970 	struct cam_sim *sim2;
971 	struct cam_path *path;
972 	struct cam_path *path2;
973 	int count;
974 
975 	count = 0;
976 	sim = NULL;
977 	sim2 = NULL;
978 
979 	/*
980 	 * Attach secondary channel first if the user has
981 	 * declared it the primary channel.
982 	 */
983 	if ((ahc->flags & AHC_CHANNEL_B_PRIMARY) != 0) {
984 		bus_id = 1;
985 		bus_id2 = 0;
986 	} else {
987 		bus_id = 0;
988 		bus_id2 = 1;
989 	}
990 
991 	/*
992 	 * Create the device queue for our SIM(s).
993 	 */
994 	devq = cam_simq_alloc(ahc->scb_data->maxscbs);
995 	if (devq == NULL)
996 		goto fail;
997 
998 	/*
999 	 * Construct our first channel SIM entry
1000 	 */
1001 	sim = cam_sim_alloc(ahc_action, ahc_poll, "ahc", ahc, ahc->unit,
1002 			    1, ahc->scb_data->maxscbs, devq);
1003 	if (sim == NULL) {
1004 		cam_simq_free(devq);
1005 		goto fail;
1006 	}
1007 
1008 	if (xpt_bus_register(sim, bus_id) != CAM_SUCCESS) {
1009 		cam_sim_free(sim, /*free_devq*/TRUE);
1010 		sim = NULL;
1011 		goto fail;
1012 	}
1013 
1014 	if (xpt_create_path(&path, /*periph*/NULL,
1015 			    cam_sim_path(sim), CAM_TARGET_WILDCARD,
1016 			    CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
1017 		xpt_bus_deregister(cam_sim_path(sim));
1018 		cam_sim_free(sim, /*free_devq*/TRUE);
1019 		sim = NULL;
1020 		goto fail;
1021 	}
1022 
1023 	xpt_setup_ccb(&csa.ccb_h, path, /*priority*/5);
1024 	csa.ccb_h.func_code = XPT_SASYNC_CB;
1025 	csa.event_enable = AC_LOST_DEVICE;
1026 	csa.callback = ahc_async;
1027 	csa.callback_arg = sim;
1028 	xpt_action((union ccb *)&csa);
1029 	count++;
1030 
1031 	if (ahc->features & AHC_TWIN) {
1032 		sim2 = cam_sim_alloc(ahc_action, ahc_poll, "ahc",
1033 				    ahc, ahc->unit, 1,
1034 				    ahc->scb_data->maxscbs, devq);
1035 
1036 		if (sim2 == NULL) {
1037 			printf("ahc_attach: Unable to attach second "
1038 			       "bus due to resource shortage");
1039 			goto fail;
1040 		}
1041 
1042 		if (xpt_bus_register(sim2, bus_id2) != CAM_SUCCESS) {
1043 			printf("ahc_attach: Unable to attach second "
1044 			       "bus due to resource shortage");
1045 			/*
1046 			 * We do not want to destroy the device queue
1047 			 * because the first bus is using it.
1048 			 */
1049 			cam_sim_free(sim2, /*free_devq*/FALSE);
1050 			goto fail;
1051 		}
1052 
1053 		if (xpt_create_path(&path2, /*periph*/NULL,
1054 				    cam_sim_path(sim2),
1055 				    CAM_TARGET_WILDCARD,
1056 				    CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
1057 			xpt_bus_deregister(cam_sim_path(sim2));
1058 			cam_sim_free(sim2, /*free_devq*/FALSE);
1059 			sim2 = NULL;
1060 			goto fail;
1061 		}
1062 		xpt_setup_ccb(&csa.ccb_h, path2, /*priority*/5);
1063 		csa.ccb_h.func_code = XPT_SASYNC_CB;
1064 		csa.event_enable = AC_LOST_DEVICE;
1065 		csa.callback = ahc_async;
1066 		csa.callback_arg = sim2;
1067 		xpt_action((union ccb *)&csa);
1068 		count++;
1069 	}
1070 fail:
1071 	if ((ahc->flags & AHC_CHANNEL_B_PRIMARY) != 0) {
1072 		ahc->sim_b = sim;
1073 		ahc->path_b = path;
1074 		ahc->sim = sim2;
1075 		ahc->path = path2;
1076 	} else {
1077 		ahc->sim = sim;
1078 		ahc->path = path;
1079 		ahc->sim_b = sim2;
1080 		ahc->path_b = path2;
1081 	}
1082 	return (count);
1083 }
1084 
1085 static void
1086 ahc_fetch_devinfo(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
1087 {
1088 	u_int  saved_tcl;
1089 	role_t role;
1090 
1091 	if (ahc_inb(ahc, SSTAT0) & TARGET)
1092 		role = ROLE_TARGET;
1093 	else
1094 		role = ROLE_INITIATOR;
1095 
1096 	saved_tcl = ahc_inb(ahc, SAVED_TCL);
1097 	ahc_compile_devinfo(devinfo, (saved_tcl >> 4) & 0x0f,
1098 			    saved_tcl & 0x3, (saved_tcl & SELBUSB) ? 'B': 'A',
1099 			    role);
1100 }
1101 
1102 static void
1103 ahc_compile_devinfo(struct ahc_devinfo *devinfo, u_int target, u_int lun,
1104 		    char channel, role_t role)
1105 {
1106 	devinfo->target = target;
1107 	devinfo->lun = lun;
1108 	devinfo->target_offset = target;
1109 	devinfo->channel = channel;
1110 	devinfo->role = role;
1111 	if (channel == 'B')
1112 		devinfo->target_offset += 8;
1113 	devinfo->target_mask = (0x01 << devinfo->target_offset);
1114 }
1115 
1116 /*
1117  * Catch an interrupt from the adapter
1118  */
1119 void
1120 ahc_intr(void *arg)
1121 {
1122 	struct	ahc_softc *ahc;
1123 	u_int	intstat;
1124 
1125 	ahc = (struct ahc_softc *)arg;
1126 
1127 	intstat = ahc_inb(ahc, INTSTAT);
1128 
1129 	/*
1130 	 * Any interrupts to process?
1131 	 */
1132 #if NPCI > 0
1133 	if ((intstat & INT_PEND) == 0) {
1134 		if ((ahc->chip & AHC_PCI) != 0
1135 		 && (ahc->unsolicited_ints > 500)) {
1136 			if ((ahc_inb(ahc, ERROR) & PCIERRSTAT) != 0)
1137 				ahc_pci_intr(ahc);
1138 			ahc->unsolicited_ints = 0;
1139 		} else {
1140 			ahc->unsolicited_ints++;
1141 		}
1142 		return;
1143 	} else {
1144 		ahc->unsolicited_ints = 0;
1145 	}
1146 #else
1147 	if ((intstat & INT_PEND) == 0)
1148 		return;
1149 #endif
1150 
1151 	if (intstat & CMDCMPLT) {
1152 		struct scb *scb;
1153 		u_int  scb_index;
1154 
1155 		ahc_outb(ahc, CLRINT, CLRCMDINT);
1156 		while (ahc->qoutfifo[ahc->qoutfifonext] != SCB_LIST_NULL) {
1157 			scb_index = ahc->qoutfifo[ahc->qoutfifonext];
1158 			ahc->qoutfifo[ahc->qoutfifonext++] = SCB_LIST_NULL;
1159 
1160 			scb = ahc->scb_data->scbarray[scb_index];
1161 			if (!scb || !(scb->flags & SCB_ACTIVE)) {
1162 				printf("%s: WARNING no command for scb %d "
1163 				       "(cmdcmplt)\nQOUTPOS = %d\n",
1164 				       ahc_name(ahc), scb_index,
1165 				       ahc->qoutfifonext - 1);
1166 				continue;
1167 			}
1168 
1169 			/*
1170 			 * Save off the residual
1171 			 * if there is one.
1172 			 */
1173 			if (scb->hscb->residual_SG_count != 0)
1174 				ahc_calc_residual(scb);
1175 			ahc_done(ahc, scb);
1176 		}
1177 
1178 		if ((ahc->flags & AHC_TARGETMODE) != 0) {
1179 			while (ahc->targetcmds[ahc->tqinfifonext].cmd_valid) {
1180 				struct target_cmd *cmd;
1181 
1182 				cmd = &ahc->targetcmds[ahc->tqinfifonext++];
1183 				ahc_handle_target_cmd(ahc, cmd);
1184 				cmd->cmd_valid = 0;
1185 			}
1186 		}
1187 	}
1188 	if (intstat & BRKADRINT) {
1189 		/*
1190 		 * We upset the sequencer :-(
1191 		 * Lookup the error message
1192 		 */
1193 		int i, error, num_errors;
1194 
1195 		error = ahc_inb(ahc, ERROR);
1196 		num_errors =  sizeof(hard_error)/sizeof(hard_error[0]);
1197 		for (i = 0; error != 1 && i < num_errors; i++)
1198 			error >>= 1;
1199 		panic("%s: brkadrint, %s at seqaddr = 0x%x\n",
1200 		      ahc_name(ahc), hard_error[i].errmesg,
1201 		      ahc_inb(ahc, SEQADDR0) |
1202 		      (ahc_inb(ahc, SEQADDR1) << 8));
1203 
1204 		/* Tell everyone that this HBA is no longer availible */
1205 		ahc_abort_scbs(ahc, CAM_TARGET_WILDCARD, ALL_CHANNELS,
1206 			       CAM_LUN_WILDCARD, SCB_LIST_NULL, CAM_NO_HBA);
1207 	}
1208 	if (intstat & SEQINT)
1209 		ahc_handle_seqint(ahc, intstat);
1210 
1211 	if (intstat & SCSIINT)
1212 		ahc_handle_scsiint(ahc, intstat);
1213 }
1214 
1215 static void
1216 ahc_handle_target_cmd(struct ahc_softc *ahc, struct target_cmd *cmd)
1217 {
1218 	struct	  tmode_tstate *tstate;
1219 	struct	  tmode_lstate *lstate;
1220 	struct	  ccb_accept_tio *atio;
1221 	u_int8_t *byte;
1222 	int	  initiator;
1223 	int	  target;
1224 	int	  lun;
1225 
1226 	initiator = cmd->initiator_channel >> 4;
1227 	target = cmd->targ_id;
1228 	lun    = (cmd->identify & MSG_IDENTIFY_LUNMASK);
1229 
1230 	byte = cmd->bytes;
1231 	tstate = ahc->enabled_targets[target];
1232 	lstate = NULL;
1233 	if (tstate != NULL && lun < 8)
1234 		lstate = tstate->enabled_luns[lun];
1235 
1236 	/*
1237 	 * XXX Need to have a default TMODE devce that attaches to luns
1238 	 *     that wouldn't otherwise be enabled and returns the proper
1239 	 *     inquiry information.  After all, we don't want to duplicate
1240 	 *     this code in each driver.  For now, simply drop it on the
1241 	 *     floor.
1242 	 */
1243 	if (lstate == NULL) {
1244 		printf("Incoming Command on disabled lun\n");
1245 		return;
1246 	}
1247 
1248 	atio = (struct ccb_accept_tio*)SLIST_FIRST(&lstate->accept_tios);
1249 	/* XXX Should reconnect and return BUSY status */
1250 	if (atio == NULL) {
1251 		printf("No ATIOs for incoming command\n");
1252 		return;
1253 	}
1254 	SLIST_REMOVE_HEAD(&lstate->accept_tios, sim_links.sle);
1255 
1256 	/*
1257 	 * Package it up and send it off to
1258 	 * whomever has this lun enabled.
1259 	 */
1260 	atio->init_id = initiator;
1261 	if (byte[0] != 0xFF) {
1262 		/* Tag was included */
1263 		atio->tag_action = *byte++;
1264 		atio->tag_id = *byte++;
1265 		atio->ccb_h.flags = CAM_TAG_ACTION_VALID;
1266 	} else {
1267 		byte++;
1268 		atio->ccb_h.flags = 0;
1269 	}
1270 
1271 	/* Okay.  Now determine the cdb size based on the command code */
1272 	switch (*byte >> CMD_GROUP_CODE_SHIFT) {
1273 	case 0:
1274 		atio->cdb_len = 6;
1275 		break;
1276 	case 1:
1277 	case 2:
1278 		atio->cdb_len = 10;
1279 		break;
1280 	case 4:
1281 		atio->cdb_len = 16;
1282 		break;
1283 	case 5:
1284 		atio->cdb_len = 12;
1285 		break;
1286 	case 3:
1287 	default:
1288 		/* Only copy the opcode. */
1289 		atio->cdb_len = 1;
1290 		printf("Reserved or VU command code type encountered\n");
1291 		break;
1292 	}
1293 	bcopy(byte, atio->cdb_io.cdb_bytes, atio->cdb_len);
1294 
1295 	atio->ccb_h.status |= CAM_CDB_RECVD;
1296 
1297 	if ((cmd->identify & MSG_IDENTIFY_DISCFLAG) == 0) {
1298 		/*
1299 		 * We weren't allowed to disconnect.
1300 		 * We're hanging on the bus until a
1301 		 * continue target I/O comes in response
1302 		 * to this accept tio.
1303 		 */
1304 		ahc->pending_device = lstate;
1305 	}
1306 	xpt_done((union ccb*)atio);
1307 }
1308 
1309 static void
1310 ahc_handle_seqint(struct ahc_softc *ahc, u_int intstat)
1311 {
1312 	struct scb *scb;
1313 	struct ahc_devinfo devinfo;
1314 
1315 	ahc_fetch_devinfo(ahc, &devinfo);
1316 
1317 	/*
1318 	 * Clear the upper byte that holds SEQINT status
1319 	 * codes and clear the SEQINT bit. We will unpause
1320 	 * the sequencer, if appropriate, after servicing
1321 	 * the request.
1322 	 */
1323 	ahc_outb(ahc, CLRINT, CLRSEQINT);
1324 	switch (intstat & SEQINT_MASK) {
1325 	case NO_MATCH:
1326 	{
1327 		/* Ensure we don't leave the selection hardware on */
1328 		ahc_outb(ahc, SCSISEQ,
1329 			 ahc_inb(ahc, SCSISEQ) & (ENSELI|ENRSELI|ENAUTOATNP));
1330 
1331 		printf("%s:%c:%d: no active SCB for reconnecting "
1332 		       "target - issuing BUS DEVICE RESET\n",
1333 		       ahc_name(ahc), devinfo.channel, devinfo.target);
1334 		printf("SAVED_TCL == 0x%x, ARG_1 == 0x%x, SEQ_FLAGS == 0x%x\n",
1335 		       ahc_inb(ahc, SAVED_TCL), ahc_inb(ahc, ARG_1),
1336 		       ahc_inb(ahc, SEQ_FLAGS));
1337 		break;
1338 	}
1339 	case SEND_REJECT:
1340 	{
1341 		u_int rejbyte = ahc_inb(ahc, ACCUM);
1342 		printf("%s:%c:%d: Warning - unknown message received from "
1343 		       "target (0x%x).  Rejecting\n",
1344 		       ahc_name(ahc), devinfo.channel, devinfo.target, rejbyte);
1345 		break;
1346 	}
1347 	case NO_IDENT:
1348 	{
1349 		/*
1350 		 * The reconnecting target either did not send an identify
1351 		 * message, or did, but we didn't find and SCB to match and
1352 		 * before it could respond to our ATN/abort, it hit a dataphase.
1353 		 * The only safe thing to do is to blow it away with a bus
1354 		 * reset.
1355 		 */
1356 		int found;
1357 
1358 		printf("%s:%c:%d: Target did not send an IDENTIFY message. "
1359 		       "LASTPHASE = 0x%x, SAVED_TCL == 0x%x\n",
1360 		       ahc_name(ahc), devinfo.channel, devinfo.target,
1361 		       ahc_inb(ahc, LASTPHASE), ahc_inb(ahc, SAVED_TCL));
1362 		found = ahc_reset_channel(ahc, devinfo.channel,
1363 					  /*initiate reset*/TRUE);
1364 		printf("%s: Issued Channel %c Bus Reset. "
1365 		       "%d SCBs aborted\n", ahc_name(ahc), devinfo.channel,
1366 		       found);
1367 		break;
1368 	}
1369 	case BAD_PHASE:
1370 		if (ahc_inb(ahc, LASTPHASE) == P_BUSFREE) {
1371 			printf("%s:%c:%d: Missed busfree.\n", ahc_name(ahc),
1372 			       devinfo.channel, devinfo.target);
1373 			restart_sequencer(ahc);
1374 			return;
1375 		} else {
1376 			printf("%s:%c:%d: unknown scsi bus phase.  Attempting "
1377 			       "to continue\n", ahc_name(ahc), devinfo.channel,
1378 			       devinfo.target);
1379 		}
1380 		break;
1381 	case BAD_STATUS:
1382 	{
1383 		u_int  scb_index;
1384 		struct hardware_scb *hscb;
1385 		struct ccb_scsiio *csio;
1386 		/*
1387 		 * The sequencer will notify us when a command
1388 		 * has an error that would be of interest to
1389 		 * the kernel.  This allows us to leave the sequencer
1390 		 * running in the common case of command completes
1391 		 * without error.  The sequencer will already have
1392 		 * dma'd the SCB back up to us, so we can reference
1393 		 * the in kernel copy directly.
1394 		 */
1395 		scb_index = ahc_inb(ahc, SCB_TAG);
1396 		scb = ahc->scb_data->scbarray[scb_index];
1397 		hscb = scb->hscb;
1398 
1399 		/*
1400 		 * Set the default return value to 0 (don't
1401 		 * send sense).  The sense code will change
1402 		 * this if needed.
1403 		 */
1404 		ahc_outb(ahc, RETURN_1, 0);
1405 		if (!(scb && (scb->flags & SCB_ACTIVE))) {
1406 			printf("%s:%c:%d: ahc_intr - referenced scb "
1407 			       "not valid during seqint 0x%x scb(%d)\n",
1408 			       ahc_name(ahc), devinfo.channel,
1409 			       devinfo.target, intstat, scb_index);
1410 			goto unpause;
1411 		}
1412 
1413 		/* Don't want to clobber the original sense code */
1414 		if ((scb->flags & SCB_SENSE) != 0) {
1415 			/*
1416 			 * Clear the SCB_SENSE Flag and have
1417 			 * the sequencer do a normal command
1418 			 * complete.
1419 			 */
1420 			scb->flags &= ~SCB_SENSE;
1421 			ahc_set_ccb_status(scb->ccb, CAM_AUTOSENSE_FAIL);
1422 			break;
1423 		}
1424 		ahc_set_ccb_status(scb->ccb, CAM_SCSI_STATUS_ERROR);
1425 		csio = &scb->ccb->csio;
1426 		csio->scsi_status = hscb->status;
1427 		switch (hscb->status) {
1428 		case SCSI_STATUS_OK:
1429 			printf("%s: Interrupted for staus of 0???\n",
1430 			       ahc_name(ahc));
1431 			break;
1432 		case SCSI_STATUS_CMD_TERMINATED:
1433 		case SCSI_STATUS_CHECK_COND:
1434 #ifdef AHC_DEBUG
1435 			if (ahc_debug & AHC_SHOWSENSE) {
1436 				xpt_print_path(csio->ccb_h.path);
1437 				printf("SCB %d: requests Check Status\n",
1438 				       scb->hscb->tag);
1439 			}
1440 #endif
1441 
1442 			if ((csio->ccb_h.flags & CAM_DIS_AUTOSENSE) == 0) {
1443 				struct ahc_dma_seg *sg = scb->ahc_dma;
1444 				struct scsi_sense *sc =
1445 					(struct scsi_sense *)(&hscb->cmdstore);
1446 				struct ahc_target_tinfo *tinfo;
1447 
1448 				/*
1449 				 * Save off the residual if there is one.
1450 				 */
1451 				if (hscb->residual_SG_count != 0)
1452 					ahc_calc_residual(scb);
1453 
1454 #ifdef AHC_DEBUG
1455 				if (ahc_debug & AHC_SHOWSENSE) {
1456 					xpt_print_path(csio->ccb_h.path);
1457 					printf("Sending Sense\n");
1458 				}
1459 #endif
1460 				/*
1461 				 * bzero from the sense data before having
1462 				 * the drive fill it.  The SCSI spec mandates
1463 				 * that any untransfered data should be
1464 				 * assumed to be zero.
1465 				 */
1466 				bzero(&csio->sense_data,
1467 				      sizeof(csio->sense_data));
1468 				sc->opcode = REQUEST_SENSE;
1469 				sc->byte2 =  SCB_LUN(scb) << 5;
1470 				sc->unused[0] = 0;
1471 				sc->unused[1] = 0;
1472 				sc->length = csio->sense_len;
1473 				sc->control = 0;
1474 
1475 				sg->addr = vtophys(&csio->sense_data);
1476 				sg->len = csio->sense_len;
1477 
1478 				/*
1479 				 * Would be nice to preserve DISCENB here,
1480 				 * but due to the way we page SCBs, we can't.
1481 				 */
1482 				hscb->control = 0;
1483 
1484 				/*
1485 				 * This request sense could be because the
1486 				 * the device lost power or in some other
1487 				 * way has lost our transfer negotiations.
1488 				 * Renegotiate if appropriate.
1489 				 */
1490 				tinfo = &ahc->transinfo[devinfo.target_offset];
1491 				ahc_update_target_msg_request(ahc, &devinfo,
1492 							      tinfo,
1493 							      /*force*/TRUE);
1494 				hscb->status = 0;
1495 				hscb->SG_count = 1;
1496 				hscb->SG_pointer = scb->ahc_dmaphys;
1497 				hscb->data = sg->addr;
1498 				hscb->datalen = sg->len;
1499 				hscb->cmdpointer = hscb->cmdstore_busaddr;
1500 				hscb->cmdlen = sizeof(*sc);
1501 				scb->sg_count = hscb->SG_count;
1502 				scb->flags |= SCB_SENSE;
1503 				/*
1504 				 * Ensure the target is busy since this
1505 				 * will be an untagged request.
1506 				 */
1507 				ahc_busy_tcl(ahc, scb);
1508 				ahc_outb(ahc, RETURN_1, SEND_SENSE);
1509 
1510 				/*
1511 				 * Ensure we have enough time to actually
1512 				 * retrieve the sense.
1513 				 */
1514 				untimeout(ahc_timeout, (caddr_t)scb,
1515 					  scb->ccb->ccb_h.timeout_ch);
1516 				scb->ccb->ccb_h.timeout_ch =
1517 				    timeout(ahc_timeout, (caddr_t)scb, 5 * hz);
1518 				/* Freeze the queue while the sense occurs. */
1519 				ahc_freeze_devq(ahc, scb->ccb->ccb_h.path);
1520 				ahc_freeze_ccb(scb->ccb);
1521 				break;
1522 			}
1523 			break;
1524 		case SCSI_STATUS_BUSY:
1525 		case SCSI_STATUS_QUEUE_FULL:
1526 			/*
1527 			 * Requeue any transactions that haven't been
1528 			 * sent yet.
1529 			 */
1530 			ahc_freeze_devq(ahc, scb->ccb->ccb_h.path);
1531 			ahc_freeze_ccb(scb->ccb);
1532 			break;
1533 		}
1534 		break;
1535 	}
1536 	case TARGET_MSG_HELP:
1537 	{
1538 		/*
1539 		 * XXX Handle BDR, Abort, Abort Tag, and transfer negotiations.
1540 		 */
1541 		restart_sequencer(ahc);
1542 		return;
1543 	}
1544 	case HOST_MSG_LOOP:
1545 	{
1546 		/*
1547 		 * The sequencer has encountered a message phase
1548 		 * that requires host assistance for completion.
1549 		 * While handling the message phase(s), we will be
1550 		 * notified by the sequencer after each byte is
1551 		 * transfered so we can track bus phases.
1552 		 *
1553 		 * If this is the first time we've seen a HOST_MSG_LOOP,
1554 		 * initialize the state of the host message loop.
1555 		 */
1556 		if (ahc->msg_type == MSG_TYPE_NONE) {
1557 			u_int bus_phase;
1558 
1559 			bus_phase = ahc_inb(ahc, SCSISIGI) & PHASE_MASK;
1560 			if (bus_phase != P_MESGIN && bus_phase != P_MESGOUT)
1561 				panic("ahc_intr: HOST_MSG_LOOP bad phase 0x%x",
1562 				      bus_phase);
1563 
1564 			if (devinfo.role == ROLE_INITIATOR) {
1565 				struct scb *scb;
1566 				u_int scb_index;
1567 
1568 				scb_index = ahc_inb(ahc, SCB_TAG);
1569 				scb = ahc->scb_data->scbarray[scb_index];
1570 
1571 				if (bus_phase == P_MESGOUT)
1572 					ahc_setup_initiator_msgout(ahc,
1573 								   &devinfo,
1574 								   scb);
1575 				else {
1576 					ahc->msg_type =
1577 					    MSG_TYPE_INITIATOR_MSGIN;
1578 					ahc->msgin_index = 0;
1579 				}
1580 			} else {
1581 				if (bus_phase == P_MESGOUT) {
1582 					ahc->msg_type =
1583 					    MSG_TYPE_TARGET_MSGOUT;
1584 					ahc->msgin_index = 0;
1585 				} else
1586 					/* XXX Ever executed??? */
1587 					ahc_setup_target_msgin(ahc, &devinfo);
1588 			}
1589 		}
1590 
1591 		/* Pass a NULL path so that handlers generate their own */
1592 		ahc_handle_message_phase(ahc, /*path*/NULL);
1593 		break;
1594 	}
1595 	case DATA_OVERRUN:
1596 	{
1597 		/*
1598 		 * When the sequencer detects an overrun, it
1599 		 * places the controller in "BITBUCKET" mode
1600 		 * and allows the target to complete its transfer.
1601 		 * Unfortunately, none of the counters get updated
1602 		 * when the controller is in this mode, so we have
1603 		 * no way of knowing how large the overrun was.
1604 		 */
1605 		u_int scbindex = ahc_inb(ahc, SCB_TAG);
1606 		u_int lastphase = ahc_inb(ahc, LASTPHASE);
1607 		int i;
1608 
1609 		scb = ahc->scb_data->scbarray[scbindex];
1610 		xpt_print_path(scb->ccb->ccb_h.path);
1611 		printf("data overrun detected in %s phase."
1612 		       "  Tag == 0x%x.\n",
1613 		       lastphase == P_DATAIN ? "Data-In" : "Data-Out",
1614 		       scb->hscb->tag);
1615 		xpt_print_path(scb->ccb->ccb_h.path);
1616 		printf("%s seen Data Phase.  Length = %d.  NumSGs = %d.\n",
1617 		       ahc_inb(ahc, SEQ_FLAGS) & DPHASE ? "Have" : "Haven't",
1618 		       scb->ccb->csio.dxfer_len, scb->sg_count);
1619 		for (i = 0; i < scb->sg_count - 1; i++) {
1620 			printf("sg[%d] - Addr 0x%x : Length %d\n",
1621 			       i,
1622 			       scb->ahc_dma[i].addr,
1623 			       scb->ahc_dma[i].len);
1624 		}
1625 		/*
1626 		 * Set this and it will take affect when the
1627 		 * target does a command complete.
1628 		 */
1629 		ahc_freeze_devq(ahc, scb->ccb->ccb_h.path);
1630 		ahc_set_ccb_status(scb->ccb, CAM_DATA_RUN_ERR);
1631 		ahc_freeze_ccb(scb->ccb);
1632 		break;
1633 	}
1634 	case TRACEPOINT:
1635 	{
1636 		printf("TRACEPOINT: RETURN_2 = %d\n", ahc_inb(ahc, RETURN_2));
1637 #if 0
1638 		printf("SSTAT1 == 0x%x\n", ahc_inb(ahc, SSTAT1));
1639 		printf("SSTAT0 == 0x%x\n", ahc_inb(ahc, SSTAT0));
1640 		printf(", SCSISIGI == 0x%x\n", ahc_inb(ahc, SCSISIGI));
1641 		printf("TRACEPOINT: CCHCNT = %d, SG_COUNT = %d\n",
1642 		       ahc_inb(ahc, CCHCNT), ahc_inb(ahc, SG_COUNT));
1643 		printf("TRACEPOINT: SCB_TAG = %d\n", ahc_inb(ahc, SCB_TAG));
1644 		printf("TRACEPOINT1: CCHADDR = %d, CCHCNT = %d, SCBPTR = %d\n",
1645 		       ahc_inb(ahc, CCHADDR)
1646 		    | (ahc_inb(ahc, CCHADDR+1) << 8)
1647 		    | (ahc_inb(ahc, CCHADDR+2) << 16)
1648 		    | (ahc_inb(ahc, CCHADDR+3) << 24),
1649 		       ahc_inb(ahc, CCHCNT)
1650 		    | (ahc_inb(ahc, CCHCNT+1) << 8)
1651 		    | (ahc_inb(ahc, CCHCNT+2) << 16),
1652 		       ahc_inb(ahc, SCBPTR));
1653 		printf("TRACEPOINT: WAITING_SCBH = %d\n", ahc_inb(ahc, WAITING_SCBH));
1654 		printf("TRACEPOINT: SCB_TAG = %d\n", ahc_inb(ahc, SCB_TAG));
1655 #endif
1656 		break;
1657 	}
1658 #if NOT_YET
1659 	/* XXX Fill these in later */
1660 	case MESG_BUFFER_BUSY:
1661 		break;
1662 	case MSGIN_PHASEMIS:
1663 		break;
1664 #endif
1665 	default:
1666 		printf("ahc_intr: seqint, "
1667 		       "intstat == 0x%x, scsisigi = 0x%x\n",
1668 		       intstat, ahc_inb(ahc, SCSISIGI));
1669 		break;
1670 	}
1671 
1672 unpause:
1673 	/*
1674 	 *  The sequencer is paused immediately on
1675 	 *  a SEQINT, so we should restart it when
1676 	 *  we're done.
1677 	 */
1678 	unpause_sequencer(ahc, /*unpause_always*/TRUE);
1679 }
1680 
1681 static void
1682 ahc_handle_scsiint(struct ahc_softc *ahc, u_int intstat)
1683 {
1684 	u_int	scb_index;
1685 	u_int	status;
1686 	struct	scb *scb;
1687 	char	cur_channel;
1688 	char	intr_channel;
1689 
1690 	if ((ahc->features & AHC_TWIN) != 0
1691 	 && ((ahc_inb(ahc, SBLKCTL) & SELBUSB) != 0))
1692 		cur_channel = 'B';
1693 	else
1694 		cur_channel = 'A';
1695 	intr_channel = cur_channel;
1696 
1697 	status = ahc_inb(ahc, SSTAT1);
1698 	if (status == 0) {
1699 		if ((ahc->features & AHC_TWIN) != 0) {
1700 			/* Try the other channel */
1701 		 	ahc_outb(ahc, SBLKCTL, ahc_inb(ahc, SBLKCTL) ^ SELBUSB);
1702 			status = ahc_inb(ahc, SSTAT1);
1703 		 	ahc_outb(ahc, SBLKCTL, ahc_inb(ahc, SBLKCTL) ^ SELBUSB);
1704 			intr_channel = (cur_channel == 'A') ? 'B' : 'A';
1705 		}
1706 		if (status == 0) {
1707 			printf("%s: Spurious SCSI interrupt\n", ahc_name(ahc));
1708 			return;
1709 		}
1710 	}
1711 
1712 	scb_index = ahc_inb(ahc, SCB_TAG);
1713 	if (scb_index < ahc->scb_data->numscbs) {
1714 		scb = ahc->scb_data->scbarray[scb_index];
1715 		if ((scb->flags & SCB_ACTIVE) == 0)
1716 			scb = NULL;
1717 	} else
1718 		scb = NULL;
1719 
1720 	if ((status & SCSIRSTI) != 0) {
1721 		printf("%s: Someone reset channel %c\n",
1722 			ahc_name(ahc), intr_channel);
1723 		ahc_reset_channel(ahc, intr_channel, /* Initiate Reset */FALSE);
1724 	} else if ((status & BUSFREE) != 0 && (status & SELTO) == 0) {
1725 		/*
1726 		 * First look at what phase we were last in.
1727 		 * If its message out, chances are pretty good
1728 		 * that the busfree was in response to one of
1729 		 * our abort requests.
1730 		 */
1731 		u_int lastphase = ahc_inb(ahc, LASTPHASE);
1732 		u_int saved_tcl = ahc_inb(ahc, SAVED_TCL);
1733 		u_int target = (saved_tcl >> 4) & 0x0f;
1734 		char channel = saved_tcl & SELBUSB ? 'B': 'A';
1735 		int printerror = 1;
1736 
1737 		ahc_outb(ahc, SCSISEQ,
1738 			 ahc_inb(ahc, SCSISEQ) & (ENSELI|ENRSELI|ENAUTOATNP));
1739 		if (lastphase == P_MESGOUT) {
1740 			u_int message;
1741 			u_int tag;
1742 
1743 			message = ahc_inb(ahc, SINDEX);
1744 
1745 			tag = SCB_LIST_NULL;
1746 			switch (message) {
1747 			case MSG_ABORT_TAG:
1748 				tag = scb->hscb->tag;
1749 				/* FALLTRHOUGH */
1750 			case MSG_ABORT:
1751 				xpt_print_path(scb->ccb->ccb_h.path);
1752 				printf("SCB %d - Abort %s Completed.\n",
1753 				       scb->hscb->tag, tag == SCB_LIST_NULL ?
1754 				       "" : "Tag");
1755 				if ((scb->flags & SCB_RECOVERY_SCB) != 0) {
1756 					ahc_set_ccb_status(scb->ccb,
1757 							   CAM_REQ_ABORTED);
1758 					ahc_done(ahc, scb);
1759 				}
1760 				printerror = 0;
1761 				break;
1762 			case MSG_BUS_DEV_RESET:
1763 				ahc_handle_devreset(ahc, target, channel,
1764 						    CAM_BDR_SENT, AC_SENT_BDR,
1765 						    "Bus Device Reset",
1766 						    /*verbose_only*/FALSE);
1767 				printerror = 0;
1768 				break;
1769 			default:
1770 				break;
1771 			}
1772 		}
1773 		if (printerror != 0) {
1774 			if (scb != NULL) {
1775 				u_int tag;
1776 
1777 				if ((scb->hscb->control & TAG_ENB) != 0)
1778 					tag = scb->hscb->tag;
1779 				else
1780 					tag = SCB_LIST_NULL;
1781 				ahc_abort_scbs(ahc, target, channel,
1782 					       SCB_LUN(scb), tag,
1783 					       CAM_UNEXP_BUSFREE);
1784 			} else {
1785 				ahc_abort_scbs(ahc, target, channel,
1786 					       CAM_LUN_WILDCARD, SCB_LIST_NULL,
1787 					       CAM_UNEXP_BUSFREE);
1788 				printf("%s: ", ahc_name(ahc));
1789 			}
1790 			printf("Unexpected busfree.  LASTPHASE == 0x%x\n"
1791 			       "SEQADDR == 0x%x\n",
1792 			       lastphase, ahc_inb(ahc, SEQADDR0)
1793 				| (ahc_inb(ahc, SEQADDR1) << 8));
1794 		}
1795 		ahc_clear_msg_state(ahc);
1796 		ahc_outb(ahc, SIMODE1, ahc_inb(ahc, SIMODE1) & ~ENBUSFREE);
1797 		ahc_outb(ahc, CLRSINT1, CLRBUSFREE);
1798 		ahc_outb(ahc, CLRINT, CLRSCSIINT);
1799 		restart_sequencer(ahc);
1800 	} else if ((status & SELTO) != 0) {
1801 		u_int scbptr;
1802 
1803 		scbptr = ahc_inb(ahc, WAITING_SCBH);
1804 		ahc_outb(ahc, SCBPTR, scbptr);
1805 		scb_index = ahc_inb(ahc, SCB_TAG);
1806 
1807 		if (scb_index < ahc->scb_data->numscbs) {
1808 			scb = ahc->scb_data->scbarray[scb_index];
1809 			if ((scb->flags & SCB_ACTIVE) == 0)
1810 				scb = NULL;
1811 		} else
1812 			scb = NULL;
1813 
1814 		if (scb == NULL) {
1815 			printf("%s: ahc_intr - referenced scb not "
1816 			       "valid during SELTO scb(%d, %d)\n",
1817 			       ahc_name(ahc), scbptr, scb_index);
1818 		} else {
1819 			ahc_handle_devreset(ahc, SCB_TARGET(scb),
1820 					    SCB_CHANNEL(scb), CAM_SEL_TIMEOUT,
1821 					    /*ac_code*/0, "Selection Timeout",
1822 					    /*verbose_only*/TRUE);
1823 		}
1824 		/* Stop the selection */
1825 		ahc_outb(ahc, SCSISEQ, 0);
1826 
1827 		ahc_clear_msg_state(ahc);
1828 
1829 		ahc_outb(ahc, CLRSINT1, CLRSELTIMEO|CLRBUSFREE);
1830 
1831 		ahc_outb(ahc, CLRINT, CLRSCSIINT);
1832 
1833 		restart_sequencer(ahc);
1834 	} else if (scb == NULL) {
1835 		printf("%s: ahc_intr - referenced scb not "
1836 		       "valid during scsiint 0x%x scb(%d)\n"
1837 		       "SIMODE0 = 0x%x, SIMODE1 = 0x%x, SSTAT0 = 0x%x\n"
1838 		       "SEQADDR = 0x%x\n", ahc_name(ahc),
1839 			status, scb_index, ahc_inb(ahc, SIMODE0),
1840 			ahc_inb(ahc, SIMODE1), ahc_inb(ahc, SSTAT0),
1841 			ahc_inb(ahc, SEQADDR0) | (ahc_inb(ahc, SEQADDR1) << 8));
1842 		ahc_outb(ahc, CLRSINT1, status);
1843 		ahc_outb(ahc, CLRINT, CLRSCSIINT);
1844 		unpause_sequencer(ahc, /*unpause_always*/TRUE);
1845 		scb = NULL;
1846 	} else if ((status & SCSIPERR) != 0) {
1847 		/*
1848 		 * Determine the bus phase and
1849 		 * queue an appropriate message
1850 		 */
1851 		char *phase;
1852 		u_int mesg_out = MSG_NOOP;
1853 		u_int lastphase = ahc_inb(ahc, LASTPHASE);
1854 
1855 		xpt_print_path(scb->ccb->ccb_h.path);
1856 
1857 		switch (lastphase) {
1858 		case P_DATAOUT:
1859 			phase = "Data-Out";
1860 			break;
1861 		case P_DATAIN:
1862 			phase = "Data-In";
1863 			mesg_out = MSG_INITIATOR_DET_ERR;
1864 			break;
1865 		case P_COMMAND:
1866 			phase = "Command";
1867 			break;
1868 		case P_MESGOUT:
1869 			phase = "Message-Out";
1870 			break;
1871 		case P_STATUS:
1872 			phase = "Status";
1873 			mesg_out = MSG_INITIATOR_DET_ERR;
1874 			break;
1875 		case P_MESGIN:
1876 			phase = "Message-In";
1877 			mesg_out = MSG_PARITY_ERROR;
1878 			break;
1879 		default:
1880 			phase = "unknown";
1881 			break;
1882 		}
1883 		printf("parity error during %s phase.\n", phase);
1884 
1885 		printf("SEQADDR == 0x%x\n", ahc_inb(ahc, SEQADDR0)
1886 				 | (ahc_inb(ahc, SEQADDR1) << 8));
1887 
1888 		printf("SCSIRATE == 0x%x\n", ahc_inb(ahc, SCSIRATE));
1889 
1890 		/*
1891 		 * We've set the hardware to assert ATN if we
1892 		 * get a parity error on "in" phases, so all we
1893 		 * need to do is stuff the message buffer with
1894 		 * the appropriate message.  "In" phases have set
1895 		 * mesg_out to something other than MSG_NOP.
1896 		 */
1897 		if (mesg_out != MSG_NOOP) {
1898 			if (ahc->msg_type != MSG_TYPE_NONE)
1899 				ahc->send_msg_perror = TRUE;
1900 			else
1901 				ahc_outb(ahc, MSG_OUT, mesg_out);
1902 		}
1903 		ahc_outb(ahc, CLRSINT1, CLRSCSIPERR);
1904 		ahc_outb(ahc, CLRINT, CLRSCSIINT);
1905 		unpause_sequencer(ahc, /*unpause_always*/TRUE);
1906 	} else {
1907 		xpt_print_path(scb->ccb->ccb_h.path);
1908 		printf("Unknown SCSIINT. Status = 0x%x\n", status);
1909 		ahc_outb(ahc, CLRSINT1, status);
1910 		ahc_outb(ahc, CLRINT, CLRSCSIINT);
1911 		unpause_sequencer(ahc, /*unpause_always*/TRUE);
1912 	}
1913 }
1914 
1915 static void
1916 ahc_build_transfer_msg(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
1917 {
1918 	/*
1919 	 * We need to initiate transfer negotiations.
1920 	 * If our current and goal settings are identical,
1921 	 * we want to renegotiate due to a check condition.
1922 	 */
1923 	struct	ahc_target_tinfo *tinfo;
1924 	int	dowide;
1925 	int	dosync;
1926 
1927 	tinfo = &ahc->transinfo[devinfo->target_offset];
1928 	dowide = tinfo->current.width != tinfo->goal.width;
1929 	dosync = tinfo->current.period != tinfo->goal.period;
1930 
1931 	if (!dowide && !dosync) {
1932 		dowide = tinfo->goal.width != MSG_EXT_WDTR_BUS_8_BIT;
1933 		dosync = tinfo->goal.period != 0;
1934 	}
1935 
1936 	if (dowide)
1937 		ahc_construct_wdtr(ahc, tinfo->goal.width);
1938 	else if (dosync) {
1939 		struct	ahc_syncrate *rate;
1940 		u_int	period;
1941 		u_int	offset;
1942 
1943 		period = tinfo->goal.period;
1944 		rate = ahc_devlimited_syncrate(ahc, &period);
1945 		offset = tinfo->goal.offset;
1946 		ahc_validate_offset(ahc, rate, &offset,
1947 				    tinfo->current.width);
1948 		ahc_construct_sdtr(ahc, period, offset);
1949 	} else {
1950 		panic("ahc_intr: AWAITING_MSG for negotiation, "
1951 		      "but no negotiation needed\n");
1952 	}
1953 }
1954 
1955 static void
1956 ahc_setup_initiator_msgout(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
1957 			   struct scb *scb)
1958 {
1959 	/*
1960 	 * To facilitate adding multiple messages together,
1961 	 * each routine should increment the index and len
1962 	 * variables instead of setting them explicitly.
1963 	 */
1964 	ahc->msgout_index = 0;
1965 	ahc->msgout_len = 0;
1966 
1967 	if ((scb->flags & SCB_DEVICE_RESET) == 0
1968 	 && ahc_inb(ahc, MSG_OUT) == MSG_IDENTIFYFLAG) {
1969 		u_int identify_msg;
1970 
1971 		identify_msg = MSG_IDENTIFYFLAG | SCB_LUN(scb);
1972 		if ((scb->hscb->control & DISCENB) != 0)
1973 			identify_msg |= MSG_IDENTIFY_DISCFLAG;
1974 		ahc->msgout_buf[ahc->msgout_index++] = identify_msg;
1975 		ahc->msgout_len++;
1976 
1977 		if ((scb->hscb->control & TAG_ENB) != 0) {
1978 			ahc->msgout_buf[ahc->msgout_index++] =
1979 			    scb->ccb->csio.tag_action;
1980 			ahc->msgout_buf[ahc->msgout_index++] = scb->hscb->tag;
1981 			ahc->msgout_len += 2;
1982 		}
1983 	}
1984 
1985 	if (scb->flags & SCB_DEVICE_RESET) {
1986 		ahc->msgout_buf[ahc->msgout_index++] = MSG_BUS_DEV_RESET;
1987 		ahc->msgout_len++;
1988 		xpt_print_path(scb->ccb->ccb_h.path);
1989 		printf("Bus Device Reset Message Sent\n");
1990 	} else if (scb->flags & SCB_ABORT) {
1991 		if ((scb->hscb->control & TAG_ENB) != 0)
1992 			ahc->msgout_buf[ahc->msgout_index++] = MSG_ABORT_TAG;
1993 		else
1994 			ahc->msgout_buf[ahc->msgout_index++] = MSG_ABORT;
1995 		ahc->msgout_len++;
1996 		xpt_print_path(scb->ccb->ccb_h.path);
1997 		printf("Abort Message Sent\n");
1998 	} else if ((ahc->targ_msg_req & devinfo->target_mask) != 0) {
1999 		ahc_build_transfer_msg(ahc, devinfo);
2000 	} else {
2001 		printf("ahc_intr: AWAITING_MSG for an SCB that "
2002 		       "does not have a waiting message");
2003 		panic("SCB = %d, SCB Control = %x, MSG_OUT = %x "
2004 		      "SCB flags = %x", scb->hscb->tag, scb->hscb->control,
2005 		      ahc_inb(ahc, MSG_OUT), scb->flags);
2006 	}
2007 
2008 	/*
2009 	 * Clear the MK_MESSAGE flag from the SCB so we aren't
2010 	 * asked to send this message again.
2011 	 */
2012 	ahc_outb(ahc, SCB_CONTROL, ahc_inb(ahc, SCB_CONTROL) & ~MK_MESSAGE);
2013 	ahc->msgout_index = 0;
2014 	ahc->msg_type = MSG_TYPE_INITIATOR_MSGOUT;
2015 }
2016 
2017 static void
2018 ahc_setup_target_msgin(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
2019 {
2020 	/*
2021 	 * To facilitate adding multiple messages together,
2022 	 * each routine should increment the index and len
2023 	 * variables instead of setting them explicitly.
2024 	 */
2025 	ahc->msgout_index = 0;
2026 	ahc->msgout_len = 0;
2027 
2028 	if ((ahc->targ_msg_req & devinfo->target_mask) != 0)
2029 		ahc_build_transfer_msg(ahc, devinfo);
2030 	else
2031 		panic("ahc_intr: AWAITING target message with no message");
2032 
2033 	ahc->msgout_index = 0;
2034 	ahc->msg_type = MSG_TYPE_TARGET_MSGIN;
2035 }
2036 
2037 static int
2038 ahc_handle_msg_reject(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
2039 {
2040 	/*
2041 	 * What we care about here is if we had an
2042 	 * outstanding SDTR or WDTR message for this
2043 	 * target.  If we did, this is a signal that
2044 	 * the target is refusing negotiation.
2045 	 */
2046 	struct scb *scb;
2047 	u_int scb_index;
2048 	u_int last_msg;
2049 	int   response = 0;
2050 
2051 	scb_index = ahc_inb(ahc, SCB_TAG);
2052 	scb = ahc->scb_data->scbarray[scb_index];
2053 
2054 	/* Might be necessary */
2055 	last_msg = ahc_inb(ahc, LAST_MSG);
2056 
2057 	if (ahc_sent_msg(ahc, MSG_EXT_WDTR, /*full*/FALSE)) {
2058 		struct ahc_target_tinfo *tinfo;
2059 
2060 		/* note 8bit xfers and clear flag */
2061 		printf("%s:%c:%d: refuses WIDE negotiation.  Using "
2062 		       "8bit transfers\n", ahc_name(ahc),
2063 		       devinfo->channel, devinfo->target);
2064 		ahc_set_width(ahc, devinfo, scb->ccb->ccb_h.path,
2065 			      MSG_EXT_WDTR_BUS_8_BIT,
2066 			      AHC_TRANS_ACTIVE|AHC_TRANS_GOAL);
2067 		ahc_set_syncrate(ahc, devinfo, scb->ccb->ccb_h.path,
2068 				 /*syncrate*/NULL, /*period*/0,
2069 				 /*offset*/0, AHC_TRANS_ACTIVE);
2070 		tinfo = &ahc->transinfo[devinfo->target_offset];
2071 		if (tinfo->goal.period) {
2072 			u_int period;
2073 
2074 			/* Start the sync negotiation */
2075 			period = tinfo->goal.period;
2076 			ahc_devlimited_syncrate(ahc, &period);
2077 			ahc->msgout_index = 0;
2078 			ahc->msgout_len = 0;
2079 			ahc_construct_sdtr(ahc, period, tinfo->goal.offset);
2080 			ahc->msgout_index = 0;
2081 			response = 1;
2082 		}
2083 	} else if (ahc_sent_msg(ahc, MSG_EXT_SDTR, /*full*/FALSE)) {
2084 		/* note asynch xfers and clear flag */
2085 		ahc_set_syncrate(ahc, devinfo, scb->ccb->ccb_h.path,
2086 				 /*syncrate*/NULL, /*period*/0,
2087 				 /*offset*/0,
2088 				 AHC_TRANS_ACTIVE|AHC_TRANS_GOAL);
2089 		printf("%s:%c:%d: refuses synchronous negotiation. "
2090 		       "Using asynchronous transfers\n",
2091 		       ahc_name(ahc),
2092 		       devinfo->channel, devinfo->target);
2093 	} else if ((scb->hscb->control & MSG_SIMPLE_Q_TAG) != 0) {
2094 		struct	ccb_trans_settings neg;
2095 
2096 		printf("%s:%c:%d: refuses tagged commands.  Performing "
2097 		       "non-tagged I/O\n", ahc_name(ahc),
2098 		       devinfo->channel, devinfo->target);
2099 
2100 		ahc->tagenable &= ~devinfo->target_mask;
2101 		neg.flags = 0;
2102 		neg.valid = CCB_TRANS_TQ_VALID;
2103 		xpt_setup_ccb(&neg.ccb_h, scb->ccb->ccb_h.path, /*priority*/1);
2104 		xpt_async(AC_TRANSFER_NEG, scb->ccb->ccb_h.path, &neg);
2105 
2106 		/*
2107 		 * Resend the identify for this CCB as the target
2108 		 * may believe that the selection is invalid otherwise.
2109 		 */
2110 		ahc_outb(ahc, SCB_CONTROL, ahc_inb(ahc, SCB_CONTROL)
2111 					  & ~MSG_SIMPLE_Q_TAG);
2112 	 	scb->hscb->control &= ~MSG_SIMPLE_Q_TAG;
2113 		scb->ccb->ccb_h.flags &= ~CAM_TAG_ACTION_VALID;
2114 		ahc_outb(ahc, MSG_OUT, MSG_IDENTIFYFLAG);
2115 		ahc_outb(ahc, SCSISIGO, ahc_inb(ahc, SCSISIGO) | ATNO);
2116 
2117 		/*
2118 		 * Requeue all tagged commands for this target
2119 		 * currently in our posession so they can be
2120 		 * converted to untagged commands.
2121 		 */
2122 		ahc_search_qinfifo(ahc, SCB_TARGET(scb), SCB_CHANNEL(scb),
2123 				   SCB_LUN(scb), /*tag*/SCB_LIST_NULL,
2124 				   CAM_REQUEUE_REQ, SEARCH_COMPLETE);
2125 	} else {
2126 		/*
2127 		 * Otherwise, we ignore it.
2128 		 */
2129 		printf("%s:%c:%d: Message reject for %x -- ignored\n",
2130 		       ahc_name(ahc), devinfo->channel, devinfo->target,
2131 		       last_msg);
2132 	}
2133 	return (response);
2134 }
2135 
2136 static void
2137 ahc_clear_msg_state(struct ahc_softc *ahc)
2138 {
2139 	ahc->msgout_len = 0;
2140 	ahc->msgin_index = 0;
2141 	ahc->msg_type = MSG_TYPE_NONE;
2142 	ahc_outb(ahc, MSG_OUT, MSG_NOOP);
2143 }
2144 
2145 static void
2146 ahc_handle_message_phase(struct ahc_softc *ahc, struct cam_path *path)
2147 {
2148 	struct	ahc_devinfo devinfo;
2149 	u_int	bus_phase;
2150 	int	end_session;
2151 
2152 	ahc_fetch_devinfo(ahc, &devinfo);
2153 
2154 
2155 	end_session = FALSE;
2156 	bus_phase = ahc_inb(ahc, SCSISIGI) & PHASE_MASK;
2157 
2158 reswitch:
2159 	switch (ahc->msg_type) {
2160 	case MSG_TYPE_INITIATOR_MSGOUT:
2161 	{
2162 		int lastbyte;
2163 		int phasemis;
2164 		int msgdone;
2165 
2166 		if (ahc->msgout_len == 0)
2167 			panic("REQINIT interrupt with no active message");
2168 
2169 		phasemis = bus_phase != P_MESGOUT;
2170 		if (phasemis) {
2171 			if (bus_phase == P_MESGIN) {
2172 				/*
2173 				 * Change gears and see if
2174 				 * this messages is of interest to
2175 				 * us or should be passed back to
2176 				 * the sequencer.
2177 				 */
2178 				ahc_outb(ahc, CLRSINT1, CLRATNO);
2179 				ahc->send_msg_perror = FALSE;
2180 				ahc->msg_type = MSG_TYPE_INITIATOR_MSGIN;
2181 				ahc->msgin_index = 0;
2182 				goto reswitch;
2183 			}
2184 			end_session = TRUE;
2185 			break;
2186 		}
2187 
2188 		if (ahc->send_msg_perror) {
2189 			ahc_outb(ahc, CLRSINT1, CLRATNO);
2190 			ahc_outb(ahc, CLRSINT1, CLRREQINIT);
2191 			ahc_outb(ahc, SCSIDATL, MSG_PARITY_ERROR);
2192 			break;
2193 		}
2194 
2195 		msgdone	= ahc->msgout_index == ahc->msgout_len;
2196 		if (msgdone) {
2197 			/*
2198 			 * The target has requested a retry.
2199 			 * Re-assert ATN, reset our message index to
2200 			 * 0, and try again.
2201 			 */
2202 			ahc->msgout_index = 0;
2203 			ahc_outb(ahc, SCSISIGO, ahc_inb(ahc, SCSISIGO) | ATNO);
2204 		}
2205 
2206 		lastbyte = ahc->msgout_index == (ahc->msgout_len - 1);
2207 		if (lastbyte) {
2208 			/* Last byte is signified by dropping ATN */
2209 			ahc_outb(ahc, CLRSINT1, CLRATNO);
2210 		}
2211 
2212 		/*
2213 		 * Clear our interrupt status and present
2214 		 * the next byte on the bus.
2215 		 */
2216 		ahc_outb(ahc, CLRSINT1, CLRREQINIT);
2217 		ahc_outb(ahc, SCSIDATL, ahc->msgout_buf[ahc->msgout_index++]);
2218 		break;
2219 	}
2220 	case MSG_TYPE_INITIATOR_MSGIN:
2221 	{
2222 		int phasemis;
2223 		int message_done;
2224 
2225 		phasemis = bus_phase != P_MESGIN;
2226 
2227 		if (phasemis) {
2228 			ahc->msgin_index = 0;
2229 			if (bus_phase == P_MESGOUT
2230 			 && (ahc->send_msg_perror == TRUE
2231 			  || (ahc->msgout_len != 0
2232 			   && ahc->msgout_index == 0))) {
2233 				ahc->msg_type = MSG_TYPE_INITIATOR_MSGOUT;
2234 				goto reswitch;
2235 			}
2236 			end_session = TRUE;
2237 			break;
2238 		}
2239 
2240 		/* Pull the byte in without acking it */
2241 		ahc->msgin_buf[ahc->msgin_index] = ahc_inb(ahc, SCSIBUSL);
2242 
2243 		message_done = ahc_parse_msg(ahc, path, &devinfo);
2244 
2245 		if (message_done) {
2246 			/*
2247 			 * Clear our incoming message buffer in case there
2248 			 * is another message following this one.
2249 			 */
2250 			ahc->msgin_index = 0;
2251 
2252 			/*
2253 			 * If this message illicited a response,
2254 			 * assert ATN so the target takes us to the
2255 			 * message out phase.
2256 			 */
2257 			if (ahc->msgout_len != 0)
2258 				ahc_outb(ahc, SCSISIGO,
2259 					 ahc_inb(ahc, SCSISIGO) | ATNO);
2260 		}
2261 
2262 		/* Ack the byte */
2263 		ahc_outb(ahc, CLRSINT1, CLRREQINIT);
2264 		ahc_inb(ahc, SCSIDATL);
2265 		ahc->msgin_index++;
2266 		break;
2267 	}
2268 	case MSG_TYPE_TARGET_MSGIN:
2269 	{
2270 		int msgdone;
2271 		int msgout_request;
2272 
2273 		if (ahc->msgout_len == 0)
2274 			panic("Target REQINIT with no active message");
2275 
2276 		/*
2277 		 * If we interrupted a mesgout session, the initiator
2278 		 * will not know this until our first REQ.  So, we
2279 		 * only honor mesgout requests after we've sent our
2280 		 * first byte.
2281 		 */
2282 		if ((ahc_inb(ahc, SCSISIGI) & ATNI) != 0
2283 		 && ahc->msgout_index > 0)
2284 			msgout_request = TRUE;
2285 		else
2286 			msgout_request = FALSE;
2287 
2288 		if (msgout_request) {
2289 
2290 			/*
2291 			 * Change gears and see if
2292 			 * this messages is of interest to
2293 			 * us or should be passed back to
2294 			 * the sequencer.
2295 			 */
2296 			ahc->msg_type = MSG_TYPE_TARGET_MSGOUT;
2297 			ahc_outb(ahc, SCSISIGO, P_MESGOUT | BSYO);
2298 			ahc->msgin_index = 0;
2299 			/* Dummy read to REQ for first byte */
2300 			ahc_inb(ahc, SCSIDATL);
2301 			ahc_outb(ahc, SXFRCTL0,
2302 				 ahc_inb(ahc, SXFRCTL0) | SPIOEN);
2303 			break;
2304 		}
2305 
2306 		msgdone = ahc->msgout_index == ahc->msgout_len;
2307 		if (msgdone) {
2308 			ahc_outb(ahc, SXFRCTL0,
2309 				 ahc_inb(ahc, SXFRCTL0) & ~SPIOEN);
2310 			end_session = TRUE;
2311 			break;
2312 		}
2313 
2314 		/*
2315 		 * Present the next byte on the bus.
2316 		 */
2317 		ahc_outb(ahc, SXFRCTL0, ahc_inb(ahc, SXFRCTL0) | SPIOEN);
2318 		ahc_outb(ahc, SCSIDATL, ahc->msgout_buf[ahc->msgout_index++]);
2319 		break;
2320 	}
2321 	case MSG_TYPE_TARGET_MSGOUT:
2322 	{
2323 		int lastbyte;
2324 		int msgdone;
2325 
2326 		/*
2327 		 * The initiator signals that this is
2328 		 * the last byte by dropping ATN.
2329 		 */
2330 		lastbyte = (ahc_inb(ahc, SCSISIGI) & ATNI) == 0;
2331 
2332 		/*
2333 		 * Read the latched byte, but turn off SPIOEN first
2334 		 * so that we don't inadvertantly cause a REQ for the
2335 		 * next byte.
2336 		 */
2337 		ahc_outb(ahc, SXFRCTL0, ahc_inb(ahc, SXFRCTL0) & ~SPIOEN);
2338 		ahc->msgin_buf[ahc->msgin_index] = ahc_inb(ahc, SCSIDATL);
2339 		msgdone = ahc_parse_msg(ahc, path, &devinfo);
2340 		ahc->msgin_index++;
2341 
2342 		/*
2343 		 * XXX Read spec about initiator dropping ATN too soon
2344 		 *     and use msgdone to detect it.
2345 		 */
2346 		if (msgdone) {
2347 			ahc->msgin_index = 0;
2348 
2349 			/*
2350 			 * If this message illicited a response, transition
2351 			 * to the Message in phase and send it.
2352 			 */
2353 			if (ahc->msgout_len != 0) {
2354 				ahc_outb(ahc, SCSISIGO, P_MESGIN | BSYO);
2355 				ahc_outb(ahc, SXFRCTL0,
2356 					 ahc_inb(ahc, SXFRCTL0) | SPIOEN);
2357 				ahc->msg_type = MSG_TYPE_TARGET_MSGIN;
2358 				ahc->msgin_index = 0;
2359 				break;
2360 			}
2361 		}
2362 
2363 		if (lastbyte)
2364 			end_session = TRUE;
2365 		else {
2366 			/* Ask for the next byte. */
2367 			ahc_outb(ahc, SXFRCTL0,
2368 				 ahc_inb(ahc, SXFRCTL0) | SPIOEN);
2369 		}
2370 
2371 		break;
2372 	}
2373 	default:
2374 		panic("Unknown REQINIT message type");
2375 	}
2376 
2377 	if (end_session) {
2378 		ahc_clear_msg_state(ahc);
2379 		ahc_outb(ahc, RETURN_1, EXIT_MSG_LOOP);
2380 	} else
2381 		ahc_outb(ahc, RETURN_1, CONT_MSG_LOOP);
2382 }
2383 
2384 /*
2385  * See if we sent a particular extended message to the target.
2386  * If "full" is true, the target saw the full message.
2387  * If "full" is false, the target saw at least the first
2388  * byte of the message.
2389  */
2390 static int
2391 ahc_sent_msg(struct ahc_softc *ahc, u_int msgtype, int full)
2392 {
2393 	int found;
2394 	int index;
2395 
2396 	found = FALSE;
2397 	index = 0;
2398 
2399 	while (index < ahc->msgout_len) {
2400 		if ((ahc->msgout_buf[index] & MSG_IDENTIFYFLAG) != 0
2401 		 || ahc->msgout_buf[index] == MSG_MESSAGE_REJECT)
2402 			index++;
2403 		else if (ahc->msgout_buf[index] >= MSG_SIMPLE_Q_TAG
2404 		      && ahc->msgout_buf[index] < MSG_IGN_WIDE_RESIDUE) {
2405 			/* Skip tag type and tag id */
2406 			index += 2;
2407 		} else if (ahc->msgout_buf[index] == MSG_EXTENDED) {
2408 			/* Found a candidate */
2409 			if (ahc->msgout_buf[index+2] == msgtype) {
2410 				u_int end_index;
2411 
2412 				end_index = index + 1
2413 					  + ahc->msgout_buf[index + 1];
2414 				if (full) {
2415 					if (ahc->msgout_index > end_index)
2416 						found = TRUE;
2417 				} else if (ahc->msgout_index > index)
2418 					found = TRUE;
2419 			}
2420 			break;
2421 		} else {
2422 			panic("ahc_sent_msg: Inconsistent msg buffer");
2423 		}
2424 	}
2425 	return (found);
2426 }
2427 
2428 static int
2429 ahc_parse_msg(struct ahc_softc *ahc, struct cam_path *path,
2430 	      struct ahc_devinfo *devinfo)
2431 {
2432 	int	 reject;
2433 	int	 done;
2434 	int	 response;
2435 	u_int	 targ_scsirate;
2436 
2437 	done = FALSE;
2438 	response = FALSE;
2439 	reject = FALSE;
2440 	targ_scsirate = ahc->transinfo[devinfo->target_offset].scsirate;
2441 	/*
2442 	 * Parse as much of the message as is availible,
2443 	 * rejecting it if we don't support it.  When
2444 	 * the entire message is availible and has been
2445 	 * handled, return TRUE indicating that we have
2446 	 * parsed an entire message.
2447 	 *
2448 	 * In the case of extended messages, we accept the length
2449 	 * byte outright and perform more checking once we know the
2450 	 * extended message type.
2451 	 */
2452 	if (ahc->msgin_buf[0] == MSG_MESSAGE_REJECT) {
2453 		response = ahc_handle_msg_reject(ahc, devinfo);
2454 		done = TRUE;
2455 	} else if (ahc->msgin_buf[0] == MSG_NOOP) {
2456 		done = TRUE;
2457 	} else if (ahc->msgin_buf[0] != MSG_EXTENDED) {
2458 		reject = TRUE;
2459 	} else if (ahc->msgin_index >= 2) {
2460 		switch (ahc->msgin_buf[2]) {
2461 		case MSG_EXT_SDTR:
2462 		{
2463 			struct	 ahc_syncrate *syncrate;
2464 			u_int	 period;
2465 			u_int	 offset;
2466 			u_int	 saved_offset;
2467 
2468 			if (ahc->msgin_buf[1] != MSG_EXT_SDTR_LEN) {
2469 				reject = TRUE;
2470 				break;
2471 			}
2472 
2473 			/*
2474 			 * Wait until we have both args before validating
2475 			 * and acting on this message.
2476 			 *
2477 			 * Add one to MSG_EXT_SDTR_LEN to account for
2478 			 * the extended message preamble.
2479 			 */
2480 			if (ahc->msgin_index < (MSG_EXT_SDTR_LEN + 1))
2481 				break;
2482 
2483 			period = ahc->msgin_buf[3];
2484 			saved_offset = offset = ahc->msgin_buf[4];
2485 			syncrate = ahc_devlimited_syncrate(ahc, &period);
2486 			ahc_validate_offset(ahc, syncrate, &offset,
2487 					    targ_scsirate & WIDEXFER);
2488 			ahc_set_syncrate(ahc, devinfo, path,
2489 					 syncrate, period, offset,
2490 					 AHC_TRANS_ACTIVE|AHC_TRANS_GOAL);
2491 
2492 			/*
2493 			 * See if we initiated Sync Negotiation
2494 			 * and didn't have to fall down to async
2495 			 * transfers.
2496 			 */
2497 			if (ahc_sent_msg(ahc, MSG_EXT_SDTR, /*full*/TRUE)) {
2498 				/* We started it */
2499 				if (saved_offset != offset) {
2500 					/* Went too low - force async */
2501 					reject = TRUE;
2502 				}
2503 			} else {
2504 				/*
2505 				 * Send our own SDTR in reply
2506 				 */
2507 				if (bootverbose)
2508 					printf("Sending SDTR!\n");
2509 				ahc->msgout_index = 0;
2510 				ahc->msgout_len = 0;
2511 				ahc_construct_sdtr(ahc, period, offset);
2512 				ahc->msgout_index = 0;
2513 				response = TRUE;
2514 			}
2515 			done = TRUE;
2516 			break;
2517 		}
2518 		case MSG_EXT_WDTR:
2519 		{
2520 			u_int	bus_width;
2521 			u_int	sending_reply;
2522 
2523 			sending_reply = FALSE;
2524 			if (ahc->msgin_buf[1] != MSG_EXT_WDTR_LEN) {
2525 				reject = TRUE;
2526 				break;
2527 			}
2528 
2529 			/*
2530 			 * Wait until we have our arg before validating
2531 			 * and acting on this message.
2532 			 *
2533 			 * Add one to MSG_EXT_WDTR_LEN to account for
2534 			 * the extended message preamble.
2535 			 */
2536 			if (ahc->msgin_index < (MSG_EXT_WDTR_LEN + 1))
2537 				break;
2538 
2539 			if (devinfo->role == ROLE_TARGET) {
2540 				reject = TRUE;
2541 				break;
2542 			}
2543 
2544 			bus_width = ahc->msgin_buf[3];
2545 			if (ahc_sent_msg(ahc, MSG_EXT_WDTR, /*full*/TRUE)) {
2546 				/*
2547 				 * Don't send a WDTR back to the
2548 				 * target, since we asked first.
2549 				 */
2550 				switch (bus_width){
2551 				default:
2552 					/*
2553 					 * How can we do anything greater
2554 					 * than 16bit transfers on a 16bit
2555 					 * bus?
2556 					 */
2557 					reject = TRUE;
2558 					printf("%s: target %d requested %dBit "
2559 					       "transfers.  Rejecting...\n",
2560 					       ahc_name(ahc), devinfo->target,
2561 					       8 * (0x01 << bus_width));
2562 					/* FALLTHROUGH */
2563 				case MSG_EXT_WDTR_BUS_8_BIT:
2564 					bus_width = MSG_EXT_WDTR_BUS_8_BIT;
2565 					break;
2566 				case MSG_EXT_WDTR_BUS_16_BIT:
2567 					break;
2568 				}
2569 			} else {
2570 				/*
2571 				 * Send our own WDTR in reply
2572 				 */
2573 				if (bootverbose)
2574 					printf("Sending WDTR!\n");
2575 				switch (bus_width) {
2576 				default:
2577 					if (ahc->features & AHC_WIDE) {
2578 						/* Respond Wide */
2579 						bus_width =
2580 						    MSG_EXT_WDTR_BUS_16_BIT;
2581 						break;
2582 					}
2583 					/* FALLTHROUGH */
2584 				case MSG_EXT_WDTR_BUS_8_BIT:
2585 					bus_width = MSG_EXT_WDTR_BUS_8_BIT;
2586 					break;
2587 				}
2588 				ahc->msgout_index = 0;
2589 				ahc->msgout_len = 0;
2590 				ahc_construct_wdtr(ahc, bus_width);
2591 				ahc->msgout_index = 0;
2592 				response = TRUE;
2593 				sending_reply = TRUE;
2594 			}
2595 			ahc_set_width(ahc, devinfo, path, bus_width,
2596 				      AHC_TRANS_ACTIVE|AHC_TRANS_GOAL);
2597 
2598 			/* After a wide message, we are async */
2599 			ahc_set_syncrate(ahc, devinfo, path,
2600 					 /*syncrate*/NULL, /*period*/0,
2601 					 /*offset*/0, AHC_TRANS_ACTIVE);
2602 			if (sending_reply == FALSE && reject == FALSE) {
2603 				struct ahc_target_tinfo *tinfo;
2604 
2605 				tinfo = &ahc->transinfo[devinfo->target_offset];
2606 				if (tinfo->goal.period) {
2607 					struct	ahc_syncrate *rate;
2608 					u_int	period;
2609 					u_int	offset;
2610 
2611 					/* Start the sync negotiation */
2612 					period = tinfo->goal.period;
2613 					rate = ahc_devlimited_syncrate(ahc,
2614 								       &period);
2615 					offset = tinfo->goal.offset;
2616 					ahc_validate_offset(ahc, rate, &offset,
2617 							  tinfo->current.width);
2618 					ahc->msgout_index = 0;
2619 					ahc->msgout_len = 0;
2620 					ahc_construct_sdtr(ahc, period, offset);
2621 					ahc->msgout_index = 0;
2622 					response = TRUE;
2623 				}
2624 			}
2625 			done = TRUE;
2626 			break;
2627 		}
2628 		default:
2629 			/* Unknown extended message.  Reject it. */
2630 			reject = TRUE;
2631 			break;
2632 		}
2633 	}
2634 
2635 	if (reject) {
2636 		/*
2637 		 * Assert attention and setup to
2638 		 * reject the message.
2639 		 */
2640 		ahc->msgout_index = 0;
2641 		ahc->msgout_len = 1;
2642 		ahc->msgout_buf[0] = MSG_MESSAGE_REJECT;
2643 		done = TRUE;
2644 		response = TRUE;
2645 	}
2646 
2647 	if (done && !response)
2648 		/* Clear the outgoing message buffer */
2649 		ahc->msgout_len = 0;
2650 
2651 	return (done);
2652 }
2653 
2654 static void
2655 ahc_handle_devreset(struct ahc_softc *ahc, int target, char channel,
2656 		    cam_status status, ac_code acode, char *message,
2657 		    int verbose_only)
2658 {
2659 	struct ahc_devinfo devinfo;
2660 	struct cam_path *path;
2661 	int found;
2662 	int error;
2663 
2664 	ahc_compile_devinfo(&devinfo, target, CAM_LUN_WILDCARD, channel,
2665 			    ROLE_UNKNOWN);
2666 
2667 	error = ahc_create_path(ahc, &devinfo, &path);
2668 
2669 	/*
2670 	 * Go back to async/narrow transfers and renegotiate.
2671 	 * ahc_set_width and ahc_set_syncrate can cope with NULL
2672 	 * paths.
2673 	 */
2674 	ahc_set_width(ahc, &devinfo, path, MSG_EXT_WDTR_BUS_8_BIT,
2675 		      AHC_TRANS_CUR);
2676 	ahc_set_syncrate(ahc, &devinfo, path, /*syncrate*/NULL,
2677 			 /*period*/0, /*offset*/0, AHC_TRANS_CUR);
2678 	found = ahc_abort_scbs(ahc, target, channel, CAM_LUN_WILDCARD,
2679 			       SCB_LIST_NULL, status);
2680 
2681 	if (error == CAM_REQ_CMP && acode != 0)
2682 		xpt_async(AC_SENT_BDR, path, NULL);
2683 
2684 	if (error == CAM_REQ_CMP)
2685 		xpt_free_path(path);
2686 
2687 	if (message != NULL
2688 	 && (verbose_only == 0 || bootverbose != 0))
2689 		printf("%s: %s on %c:%d. %d SCBs aborted\n", ahc_name(ahc),
2690 		       message, channel, target, found);
2691 }
2692 
2693 /*
2694  * We have an scb which has been processed by the
2695  * adaptor, now we look to see how the operation
2696  * went.
2697  */
2698 static void
2699 ahc_done(struct ahc_softc *ahc, struct scb *scb)
2700 {
2701 	union ccb *ccb;
2702 
2703 	CAM_DEBUG(scb->ccb->ccb_h.path, CAM_DEBUG_TRACE,
2704 		  ("ahc_done - scb %d\n", scb->hscb->tag));
2705 
2706 	ccb = scb->ccb;
2707 	LIST_REMOVE(&ccb->ccb_h, sim_links.le);
2708 
2709 	untimeout(ahc_timeout, (caddr_t)scb, ccb->ccb_h.timeout_ch);
2710 
2711 	if ((ccb->ccb_h.flags & CAM_DIR_MASK) != CAM_DIR_NONE) {
2712 		bus_dmasync_op_t op;
2713 
2714 		if ((ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN)
2715 			op = BUS_DMASYNC_POSTREAD;
2716 		else
2717 			op = BUS_DMASYNC_POSTWRITE;
2718 		bus_dmamap_sync(ahc->dmat, scb->dmamap, op);
2719 		bus_dmamap_unload(ahc->dmat, scb->dmamap);
2720 	}
2721 
2722 	/*
2723 	 * Unbusy this target/channel/lun.
2724 	 * XXX if we are holding two commands per lun,
2725 	 *     send the next command.
2726 	 */
2727 	ahc_index_busy_tcl(ahc, scb->hscb->tcl, /*unbusy*/TRUE);
2728 
2729 	if (ccb->ccb_h.func_code == XPT_CONT_TARGET_IO) {
2730 		ccb->ccb_h.status = CAM_REQ_CMP;
2731 		ahc_free_scb(ahc, scb);
2732 		xpt_done(ccb);
2733 		return;
2734 	}
2735 
2736 	/*
2737 	 * If the recovery SCB completes, we have to be
2738 	 * out of our timeout.
2739 	 */
2740 	if ((scb->flags & SCB_RECOVERY_SCB) != 0) {
2741 
2742 		struct	ccb_hdr *ccbh;
2743 
2744 		/*
2745 		 * We were able to complete the command successfully,
2746 		 * so reinstate the timeouts for all other pending
2747 		 * commands.
2748 		 */
2749 		ccbh = ahc->pending_ccbs.lh_first;
2750 		while (ccbh != NULL) {
2751 			struct scb *pending_scb;
2752 
2753 			pending_scb = (struct scb *)ccbh->ccb_scb_ptr;
2754 			ccbh->timeout_ch =
2755 			    timeout(ahc_timeout, pending_scb,
2756 				    (ccbh->timeout * hz)/1000);
2757 			ccbh = LIST_NEXT(ccbh, sim_links.le);
2758 		}
2759 
2760 		/*
2761 		 * Ensure that we didn't put a second instance of this
2762 		 * SCB into the QINFIFO.
2763 		 */
2764 		ahc_search_qinfifo(ahc, SCB_TARGET(scb), SCB_CHANNEL(scb),
2765 				   SCB_LUN(scb), scb->hscb->tag, /*status*/0,
2766 				   SEARCH_REMOVE);
2767 		if (ahc_ccb_status(ccb) == CAM_BDR_SENT)
2768 			ahc_set_ccb_status(ccb, CAM_CMD_TIMEOUT);
2769 		xpt_print_path(ccb->ccb_h.path);
2770 		printf("no longer in timeout, status = %x\n",
2771 		       ccb->ccb_h.status);
2772 	}
2773 
2774 	/* Don't clobber any existing error state */
2775 	if (ahc_ccb_status(ccb) == CAM_REQ_INPROG) {
2776 		ccb->ccb_h.status |= CAM_REQ_CMP;
2777 	} else if ((scb->flags & SCB_SENSE) != 0) {
2778 		/* We performed autosense retrieval */
2779 		scb->ccb->ccb_h.status |= CAM_AUTOSNS_VALID;
2780 	}
2781 	ccb->ccb_h.status &= ~CAM_SIM_QUEUED;
2782 	ahc_free_scb(ahc, scb);
2783 	xpt_done(ccb);
2784 }
2785 
2786 /*
2787  * Determine the number of SCBs available on the controller
2788  */
2789 int
2790 ahc_probe_scbs(struct ahc_softc *ahc) {
2791 	int i;
2792 
2793 	for (i = 0; i < AHC_SCB_MAX; i++) {
2794 		ahc_outb(ahc, SCBPTR, i);
2795 		ahc_outb(ahc, SCB_CONTROL, i);
2796 		if (ahc_inb(ahc, SCB_CONTROL) != i)
2797 			break;
2798 		ahc_outb(ahc, SCBPTR, 0);
2799 		if (ahc_inb(ahc, SCB_CONTROL) != 0)
2800 			break;
2801 	}
2802 
2803 	return (i);
2804 }
2805 
2806 /*
2807  * Start the board, ready for normal operation
2808  */
2809 int
2810 ahc_init(struct ahc_softc *ahc)
2811 {
2812 	int	max_targ = 15;
2813 	int	i;
2814 	int	term;
2815 	u_int	scsi_conf;
2816 	u_int	scsiseq_template;
2817 
2818 #ifdef AHC_PRINT_SRAM
2819 	printf("Scratch Ram:");
2820 	for (i = 0x20; i < 0x5f; i++) {
2821 		if (((i % 8) == 0) && (i != 0)) {
2822 			printf ("\n              ");
2823 		}
2824 		printf (" 0x%x", ahc_inb(ahc, i));
2825 	}
2826 	if ((ahc->features & AHC_MORE_SRAM) != 0) {
2827 		for (i = 0x70; i < 0x7f; i++) {
2828 			if (((i % 8) == 0) && (i != 0)) {
2829 				printf ("\n              ");
2830 			}
2831 			printf (" 0x%x", ahc_inb(ahc, i));
2832 		}
2833 	}
2834 	printf ("\n");
2835 #endif
2836 
2837 	/*
2838 	 * Assume we have a board at this stage and it has been reset.
2839 	 */
2840 	if ((ahc->flags & AHC_USEDEFAULTS) != 0) {
2841 		ahc->our_id = ahc->our_id_b = 7;
2842 	}
2843 
2844 	/*
2845 	 * Default to allowing initiator operations.
2846 	 */
2847 	ahc->flags |= AHC_INITIATORMODE;
2848 
2849 	/*
2850 	 * XXX Would be better to use a per device flag, but PCI and EISA
2851 	 *     devices don't have them yet.
2852 	 */
2853 	if ((AHC_TMODE_ENABLE & (0x01 << ahc->unit)) != 0) {
2854 		ahc->flags |= AHC_TARGETMODE;
2855 		if ((ahc->features & AHC_ULTRA2) == 0)
2856 			/* Only have space for both on the Ultra2 chips */
2857 			ahc->flags &= ~AHC_INITIATORMODE;
2858 	}
2859 
2860 
2861 	if ((ahc->features & AHC_TWIN) != 0) {
2862  		printf("Twin Channel, A SCSI Id=%d, B SCSI Id=%d, primary %c, ",
2863 		       ahc->our_id, ahc->our_id_b,
2864 		       ahc->flags & AHC_CHANNEL_B_PRIMARY? 'B': 'A');
2865 	} else {
2866 		if ((ahc->features & AHC_WIDE) != 0) {
2867 			printf("Wide ");
2868 		} else {
2869 			printf("Single ");
2870 		}
2871 		printf("Channel %c, SCSI Id=%d, ", ahc->channel, ahc->our_id);
2872 	}
2873 
2874 	ahc_outb(ahc, SEQ_FLAGS, 0);
2875 
2876 	/* Determine the number of SCBs and initialize them */
2877 
2878 	if (ahc->scb_data->maxhscbs == 0) {
2879 		ahc->scb_data->maxhscbs = ahc_probe_scbs(ahc);
2880 		/* SCB 0 heads the free list */
2881 		ahc_outb(ahc, FREE_SCBH, 0);
2882 		for (i = 0; i < ahc->scb_data->maxhscbs; i++) {
2883 			ahc_outb(ahc, SCBPTR, i);
2884 
2885 			/* Clear the control byte. */
2886 			ahc_outb(ahc, SCB_CONTROL, 0);
2887 
2888 			/* Set the next pointer */
2889 			ahc_outb(ahc, SCB_NEXT, i+1);
2890 
2891 			/* Make the tag number invalid */
2892 			ahc_outb(ahc, SCB_TAG, SCB_LIST_NULL);
2893 		}
2894 
2895 		/* Make that the last SCB terminates the free list */
2896 		ahc_outb(ahc, SCBPTR, i-1);
2897 		ahc_outb(ahc, SCB_NEXT, SCB_LIST_NULL);
2898 
2899 		/* Ensure we clear the 0 SCB's control byte. */
2900 		ahc_outb(ahc, SCBPTR, 0);
2901 		ahc_outb(ahc, SCB_CONTROL, 0);
2902 
2903 		ahc->scb_data->maxhscbs = i;
2904 	}
2905 
2906 	if (ahc->scb_data->maxhscbs == 0)
2907 		panic("%s: No SCB space found", ahc_name(ahc));
2908 
2909 	if (ahc->scb_data->maxhscbs < AHC_SCB_MAX) {
2910 		ahc->flags |= AHC_PAGESCBS;
2911 		ahc->scb_data->maxscbs = AHC_SCB_MAX;
2912 		printf("%d/%d SCBs\n", ahc->scb_data->maxhscbs,
2913 		       ahc->scb_data->maxscbs);
2914 	} else {
2915 		ahc->scb_data->maxscbs = ahc->scb_data->maxhscbs;
2916 		ahc->flags &= ~AHC_PAGESCBS;
2917 		printf("%d SCBs\n", ahc->scb_data->maxhscbs);
2918 	}
2919 
2920 #ifdef AHC_DEBUG
2921 	if (ahc_debug & AHC_SHOWMISC) {
2922 		printf("%s: hardware scb %d bytes; kernel scb %d bytes; "
2923 		       "ahc_dma %d bytes\n",
2924 			ahc_name(ahc),
2925 		        sizeof(struct hardware_scb),
2926 			sizeof(struct scb),
2927 			sizeof(struct ahc_dma_seg));
2928 	}
2929 #endif /* AHC_DEBUG */
2930 
2931 	/* Set the SCSI Id, SXFRCTL0, SXFRCTL1, and SIMODE1, for both channels*/
2932 	if (ahc->features & AHC_TWIN) {
2933 
2934 		/*
2935 		 * The device is gated to channel B after a chip reset,
2936 		 * so set those values first
2937 		 */
2938 		term = (ahc->flags & AHC_TERM_ENB_B) != 0 ? STPWEN : 0;
2939 		if ((ahc->features & AHC_ULTRA2) != 0)
2940 			ahc_outb(ahc, SCSIID_ULTRA2, ahc->our_id_b);
2941 		else
2942 			ahc_outb(ahc, SCSIID, ahc->our_id_b);
2943 		scsi_conf = ahc_inb(ahc, SCSICONF + 1);
2944 		ahc_outb(ahc, SXFRCTL1, (scsi_conf & (ENSPCHK|STIMESEL))
2945 					|term|ENSTIMER|ACTNEGEN);
2946 		ahc_outb(ahc, SIMODE1, ENSELTIMO|ENSCSIRST|ENSCSIPERR);
2947 		ahc_outb(ahc, SXFRCTL0, DFON|SPIOEN);
2948 
2949 #if 0
2950 		if ((scsi_conf & RESET_SCSI) != 0
2951 		 && (ahc->flags & AHC_INITIATORMODE) != 0)
2952 			ahc->flags |= AHC_RESET_BUS_B;
2953 #else
2954 		if ((ahc->flags & AHC_INITIATORMODE) != 0)
2955 			ahc->flags |= AHC_RESET_BUS_B;
2956 #endif
2957 
2958 		/* Select Channel A */
2959 		ahc_outb(ahc, SBLKCTL, ahc_inb(ahc, SBLKCTL) & ~SELBUSB);
2960 	}
2961 	term = (ahc->flags & AHC_TERM_ENB_A) != 0 ? STPWEN : 0;
2962 	if ((ahc->features & AHC_ULTRA2) != 0)
2963 		ahc_outb(ahc, SCSIID_ULTRA2, ahc->our_id);
2964 	else
2965 		ahc_outb(ahc, SCSIID, ahc->our_id);
2966 	scsi_conf = ahc_inb(ahc, SCSICONF);
2967 	ahc_outb(ahc, SXFRCTL1, (scsi_conf & (ENSPCHK|STIMESEL))
2968 				|term
2969 				|ENSTIMER|ACTNEGEN);
2970 	ahc_outb(ahc, SIMODE1, ENSELTIMO|ENSCSIRST|ENSCSIPERR);
2971 	ahc_outb(ahc, SXFRCTL0, DFON|SPIOEN);
2972 
2973 	if ((ahc->features & AHC_ULTRA2) != 0) {
2974 		/* Wait for our transceiver status to settle */
2975 		i = 1000000;
2976 		while (--i && ((ahc_inb(ahc, SBLKCTL) & (ENAB40|ENAB20)) == 0))
2977 			DELAY(100);
2978 
2979 		if (i == 0)
2980 			panic("%s: Transceiver state never settled\n",
2981 			      ahc_name(ahc));
2982 	}
2983 
2984 #if 0
2985 	if ((scsi_conf & RESET_SCSI) != 0
2986 	 && (ahc->flags & AHC_INITIATORMODE) != 0)
2987 		ahc->flags |= AHC_RESET_BUS_A;
2988 #else
2989 	if ((ahc->flags & AHC_INITIATORMODE) != 0)
2990 		ahc->flags |= AHC_RESET_BUS_A;
2991 #endif
2992 
2993 	/*
2994 	 * Look at the information that board initialization or
2995 	 * the board bios has left us.  In the lower four bits of each
2996 	 * target's scratch space any value other than 0 indicates
2997 	 * that we should initiate synchronous transfers.  If it's zero,
2998 	 * the user or the BIOS has decided to disable synchronous
2999 	 * negotiation to that target so we don't activate the needsdtr
3000 	 * flag.
3001 	 */
3002 	ahc->ultraenb = 0;
3003 	ahc->tagenable = ALL_TARGETS_MASK;
3004 
3005 	/* Grab the disconnection disable table and invert it for our needs */
3006 	if (ahc->flags & AHC_USEDEFAULTS) {
3007 		printf("%s: Host Adapter Bios disabled.  Using default SCSI "
3008 			"device parameters\n", ahc_name(ahc));
3009 		ahc->flags |= AHC_EXTENDED_TRANS_A|AHC_EXTENDED_TRANS_B|
3010 			      AHC_TERM_ENB_A|AHC_TERM_ENB_B;
3011 		ahc->discenable = ALL_TARGETS_MASK;
3012 		if ((ahc->features & AHC_ULTRA) != 0)
3013 			ahc->ultraenb = 0xffff;
3014 	} else {
3015 		ahc->discenable = ~((ahc_inb(ahc, DISC_DSB + 1) << 8)
3016 				   | ahc_inb(ahc, DISC_DSB));
3017 		if ((ahc->features & (AHC_ULTRA|AHC_ULTRA2)) != 0)
3018 			ahc->ultraenb = (ahc_inb(ahc, ULTRA_ENB + 1) << 8)
3019 				      | ahc_inb(ahc, ULTRA_ENB);
3020 	}
3021 
3022 	if ((ahc->features & (AHC_WIDE|AHC_TWIN)) == 0)
3023 		max_targ = 7;
3024 
3025 	for (i = 0; i <= max_targ; i++) {
3026 		struct ahc_target_tinfo *transinfo;
3027 
3028 		transinfo = &ahc->transinfo[i];
3029 		/* Default to async narrow across the board */
3030 		bzero(transinfo, sizeof(*transinfo));
3031 		if (ahc->flags & AHC_USEDEFAULTS) {
3032 			if ((ahc->features & AHC_WIDE) != 0)
3033 				transinfo->user.width = MSG_EXT_WDTR_BUS_16_BIT;
3034 
3035 			/*
3036 			 * These will be truncated when we determine the
3037 			 * connection type we have with the target.
3038 			 */
3039 			transinfo->user.period = ahc_syncrates->period;
3040 			transinfo->user.offset = ~0;
3041 		} else {
3042 			u_int scsirate;
3043 			u_int16_t mask;
3044 
3045 			/* Take the settings leftover in scratch RAM. */
3046 			scsirate = ahc_inb(ahc, TARG_SCSIRATE + i);
3047 			mask = (0x01 << i);
3048 			if ((ahc->features & AHC_ULTRA2) != 0) {
3049 				u_int offset;
3050 
3051 				if ((scsirate & SOFS) == 0x0F) {
3052 					/*
3053 					 * Haven't negotiated yet,
3054 					 * so the format is different.
3055 					 */
3056 					scsirate = (scsirate & SXFR) >> 4
3057 						 | (ahc->ultraenb & mask)
3058 						  ? 0x18 : 0x10
3059 						 | (scsirate & WIDEXFER);
3060 					offset = MAX_OFFSET_ULTRA2;
3061 				} else
3062 					offset = ahc_inb(ahc, TARG_OFFSET + i);
3063 				ahc_find_period(ahc, scsirate,
3064 						AHC_SYNCRATE_ULTRA2);
3065 				if (offset == 0)
3066 					transinfo->user.period = 0;
3067 				else
3068 					transinfo->user.offset = ~0;
3069 			} else if ((scsirate & SOFS) != 0) {
3070 				transinfo->user.period =
3071 				    ahc_find_period(ahc, scsirate,
3072 						    (ahc->ultraenb & mask)
3073 						   ? AHC_SYNCRATE_ULTRA
3074 						   : AHC_SYNCRATE_FAST);
3075 				if ((scsirate & SOFS) != 0
3076 				 && transinfo->user.period != 0) {
3077 					transinfo->user.offset = ~0;
3078 				}
3079 			}
3080 			if ((scsirate & WIDEXFER) != 0
3081 			 && (ahc->features & AHC_WIDE) != 0) {
3082 				transinfo->user.width = MSG_EXT_WDTR_BUS_16_BIT;
3083 			}
3084 
3085 		}
3086 	}
3087 
3088 #ifdef AHC_DEBUG
3089 	if (ahc_debug & AHC_SHOWMISC)
3090 		printf("NEEDSDTR == 0x%x\nNEEDWDTR == 0x%x\n"
3091 		       "DISCENABLE == 0x%x\nULTRAENB == 0x%x\n",
3092 		       ahc->needsdtr_orig, ahc->needwdtr_orig,
3093 		       ahc->discenable, ahc->ultraenb);
3094 #endif
3095 	/*
3096 	 * Allocate enough "hardware scbs" to handle
3097 	 * the maximum number of concurrent transactions
3098 	 * we can have active.  We have to use contigmalloc
3099 	 * if this array crosses a page boundary since the
3100 	 * sequencer depends on this array being physically
3101 	 * contiguous.
3102 	 */
3103 	if (ahc->scb_data->hscbs == NULL) {
3104 		size_t array_size;
3105 
3106 		array_size = ahc->scb_data->maxscbs*sizeof(struct hardware_scb);
3107 		if (array_size > PAGE_SIZE) {
3108 			ahc->scb_data->hscbs = (struct hardware_scb *)
3109 					contigmalloc(array_size, M_DEVBUF,
3110 						     M_NOWAIT, 0ul, 0xffffffff,
3111 						     PAGE_SIZE, 0x10000);
3112 		} else {
3113 			ahc->scb_data->hscbs = (struct hardware_scb *)
3114 				     malloc(array_size, M_DEVBUF, M_NOWAIT);
3115 		}
3116 
3117 		if (ahc->scb_data->hscbs == NULL) {
3118 			printf("%s: unable to allocate hardware SCB array.  "
3119 			       "Failing attach\n", ahc_name(ahc));
3120 			return (-1);
3121 		}
3122 		/* At least the control byte of each hscb needs to be zeroed */
3123 		bzero(ahc->scb_data->hscbs, array_size);
3124 	}
3125 
3126 	if ((ahc->flags & AHC_TARGETMODE) != 0) {
3127 		size_t array_size;
3128 
3129 		array_size = AHC_TMODE_CMDS * sizeof(struct target_cmd);
3130 		ahc->targetcmds = contigmalloc(array_size, M_DEVBUF,
3131 					       M_NOWAIT, 0ul, 0xffffffff,
3132 					       PAGE_SIZE, 0x10000);
3133 
3134 		if (ahc->targetcmds == NULL) {
3135 			printf("%s: unable to allocate targetcmd array.  "
3136 			       "Failing attach\n", ahc_name(ahc));
3137 			return (-1);
3138 		}
3139 
3140 		/* All target command blocks start out invalid. */
3141 		for (i = 0; i < AHC_TMODE_CMDS; i++)
3142 			ahc->targetcmds[i].cmd_valid = 0;
3143 		ahc_outb(ahc, KERNEL_TQINPOS, 0);
3144 		ahc_outb(ahc, TQINPOS, 0);
3145 	}
3146 
3147 	/*
3148 	 * Tell the sequencer where it can find the our arrays in memory.
3149 	 */
3150 	{
3151 		u_int32_t physaddr;
3152 
3153 		/* Tell the sequencer where it can find the hscb array. */
3154 		physaddr = vtophys(ahc->scb_data->hscbs);
3155 		ahc_outb(ahc, HSCB_ADDR, physaddr & 0xFF);
3156 		ahc_outb(ahc, HSCB_ADDR + 1, (physaddr >> 8) & 0xFF);
3157 		ahc_outb(ahc, HSCB_ADDR + 2, (physaddr >> 16) & 0xFF);
3158 		ahc_outb(ahc, HSCB_ADDR + 3, (physaddr >> 24) & 0xFF);
3159 		ahc->hscb_busaddr = physaddr;
3160 
3161 		physaddr = vtophys(ahc->qoutfifo);
3162 		ahc_outb(ahc, SCBID_ADDR, physaddr & 0xFF);
3163 		ahc_outb(ahc, SCBID_ADDR + 1, (physaddr >> 8) & 0xFF);
3164 		ahc_outb(ahc, SCBID_ADDR + 2, (physaddr >> 16) & 0xFF);
3165 		ahc_outb(ahc, SCBID_ADDR + 3, (physaddr >> 24) & 0xFF);
3166 
3167 		if ((ahc->flags & AHC_TARGETMODE) != 0) {
3168 			physaddr = vtophys(ahc->targetcmds);
3169 			ahc_outb(ahc, TMODE_CMDADDR, physaddr & 0xFF);
3170 			ahc_outb(ahc, TMODE_CMDADDR + 1,
3171 				 (physaddr >> 8) & 0xFF);
3172 			ahc_outb(ahc, TMODE_CMDADDR + 2,
3173 				 (physaddr >> 16) & 0xFF);
3174 			ahc_outb(ahc, TMODE_CMDADDR + 3,
3175 				 (physaddr >> 24) & 0xFF);
3176 
3177 			ahc_outb(ahc, CMDSIZE_TABLE, 5);
3178 			ahc_outb(ahc, CMDSIZE_TABLE + 1, 9);
3179 			ahc_outb(ahc, CMDSIZE_TABLE + 2, 9);
3180 			ahc_outb(ahc, CMDSIZE_TABLE + 3, 0);
3181 			ahc_outb(ahc, CMDSIZE_TABLE + 4, 15);
3182 			ahc_outb(ahc, CMDSIZE_TABLE + 5, 11);
3183 			ahc_outb(ahc, CMDSIZE_TABLE + 6, 0);
3184 			ahc_outb(ahc, CMDSIZE_TABLE + 7, 0);
3185 		}
3186 
3187 		/* There are no untagged SCBs active yet. */
3188 		for (i = 0; i < sizeof(ahc->untagged_scbs); i++) {
3189 			ahc->untagged_scbs[i] = SCB_LIST_NULL;
3190 		}
3191 		for (i = 0; i < sizeof(ahc->qoutfifo); i++) {
3192 			ahc->qoutfifo[i] = SCB_LIST_NULL;
3193 		}
3194 	}
3195 
3196 	/* Our Q FIFOs are empty. */
3197 	ahc_outb(ahc, KERNEL_QINPOS, 0);
3198 	ahc_outb(ahc, QINPOS, 0);
3199 	ahc_outb(ahc, QOUTPOS, 0);
3200 
3201 	/* Don't have any special messages to send to targets */
3202 	ahc_outb(ahc, TARGET_MSG_REQUEST, 0);
3203 	ahc_outb(ahc, TARGET_MSG_REQUEST + 1, 0);
3204 
3205 	/*
3206 	 * Use the built in queue management registers
3207 	 * if they are available.
3208 	 */
3209 	if ((ahc->features & AHC_QUEUE_REGS) != 0) {
3210 		ahc_outb(ahc, QOFF_CTLSTA, SCB_QSIZE_256);
3211 		ahc_outb(ahc, SDSCB_QOFF, 0);
3212 		ahc_outb(ahc, SNSCB_QOFF, 0);
3213 		ahc_outb(ahc, HNSCB_QOFF, 0);
3214 	}
3215 
3216 
3217 	/* We don't have any waiting selections */
3218 	ahc_outb(ahc, WAITING_SCBH, SCB_LIST_NULL);
3219 
3220 	/* Our disconnection list is empty too */
3221 	ahc_outb(ahc, DISCONNECTED_SCBH, SCB_LIST_NULL);
3222 
3223 	/* Message out buffer starts empty */
3224 	ahc_outb(ahc, MSG_OUT, MSG_NOOP);
3225 
3226 	/*
3227 	 * Setup the allowed SCSI Sequences based on operational mode.
3228 	 * If we are a target, we'll enalbe select in operations once
3229 	 * we've had a lun enabled.
3230 	 */
3231 	scsiseq_template = ENSELO|ENAUTOATNO|ENAUTOATNP;
3232 	if ((ahc->flags & AHC_INITIATORMODE) != 0)
3233 		scsiseq_template |= ENRSELI;
3234 	ahc_outb(ahc, SCSISEQ_TEMPLATE, scsiseq_template);
3235 
3236 	/*
3237 	 * Load the Sequencer program and Enable the adapter
3238 	 * in "fast" mode.
3239          */
3240 	if (bootverbose)
3241 		printf("%s: Downloading Sequencer Program...",
3242 		       ahc_name(ahc));
3243 
3244 	ahc_loadseq(ahc);
3245 
3246 	/* We have to wait until after any system dumps... */
3247 	at_shutdown(ahc_shutdown, ahc, SHUTDOWN_FINAL);
3248 
3249 	return (0);
3250 }
3251 
3252 static cam_status
3253 ahc_find_tmode_devs(struct ahc_softc *ahc, struct cam_sim *sim, union ccb *ccb,
3254 		    struct tmode_tstate **tstate, struct tmode_lstate **lstate,
3255 		    int notfound_failure)
3256 {
3257 	int our_id;
3258 
3259 	/*
3260 	 * If we are not configured for target mode, someone
3261 	 * is really confused to be sending this to us.
3262 	 */
3263 	if ((ahc->flags & AHC_TARGETMODE) == 0)
3264 		return (CAM_REQ_INVALID);
3265 
3266 	/* Range check target and lun */
3267 	if (cam_sim_bus(sim) == 0)
3268 		our_id = ahc->our_id;
3269 	else
3270 		our_id = ahc->our_id_b;
3271 	if (ccb->ccb_h.target_id > ((ahc->features & AHC_WIDE) ? 15 : 7)
3272 	 || ((ahc->features & AHC_MULTI_TID) == 0
3273 	  && (ccb->ccb_h.target_id != our_id)))
3274 		return (CAM_TID_INVALID);
3275 
3276 	if (ccb->ccb_h.target_lun > 8)
3277 		return (CAM_LUN_INVALID);
3278 
3279 	*tstate = ahc->enabled_targets[ccb->ccb_h.target_id];
3280 	*lstate = NULL;
3281 	if (*tstate != NULL)
3282 		*lstate = (*tstate)->enabled_luns[ccb->ccb_h.target_lun];
3283 
3284 	if (notfound_failure != 0 && *lstate == NULL)
3285 		return (CAM_PATH_INVALID);
3286 
3287 	return (CAM_REQ_CMP);
3288 }
3289 
3290 static void
3291 ahc_action(struct cam_sim *sim, union ccb *ccb)
3292 {
3293 	struct	  ahc_softc *ahc;
3294 	struct	  tmode_lstate *lstate;
3295 	int	  target_id;
3296 	int	  s;
3297 
3298 	CAM_DEBUG(ccb->ccb_h.path, CAM_DEBUG_TRACE, ("ahc_action\n"));
3299 
3300 	ahc = (struct ahc_softc *)cam_sim_softc(sim);
3301 
3302 	target_id = ccb->ccb_h.target_id;
3303 
3304 	switch (ccb->ccb_h.func_code) {
3305 	/* Common cases first */
3306 	case XPT_ACCEPT_TARGET_IO:	/* Accept Host Target Mode CDB */
3307 	case XPT_CONT_TARGET_IO:/* Continue Host Target I/O Connection*/
3308 	{
3309 		struct	   tmode_tstate *tstate;
3310 		cam_status status;
3311 
3312 		status = ahc_find_tmode_devs(ahc, sim, ccb, &tstate,
3313 					     &lstate, TRUE);
3314 
3315 		if (status != CAM_REQ_CMP) {
3316 			ccb->ccb_h.status = status;
3317 			xpt_done(ccb);
3318 			break;
3319 		}
3320 		if (ccb->ccb_h.func_code == XPT_ACCEPT_TARGET_IO) {
3321 			SLIST_INSERT_HEAD(&lstate->accept_tios, &ccb->ccb_h,
3322 					  sim_links.sle);
3323 			ccb->ccb_h.status = CAM_REQ_INPROG;
3324 			break;
3325 		}
3326 
3327 		/*
3328 		 * The target_id represents the target we attempt to
3329 		 * select.  In target mode, this is the initiator of
3330 		 * the original command.
3331 		 */
3332 		target_id = ccb->csio.init_id;
3333 		/* FALLTHROUGH */
3334 	}
3335 	case XPT_SCSI_IO:	/* Execute the requested I/O operation */
3336 	case XPT_RESET_DEV:	/* Bus Device Reset the specified SCSI device */
3337 	{
3338 		struct	   scb *scb;
3339 		struct	   hardware_scb *hscb;
3340 		struct	   ahc_target_tinfo *tinfo;
3341 		u_int16_t  mask;
3342 
3343 		/*
3344 		 * get an scb to use.
3345 		 */
3346 		if ((scb = ahc_get_scb(ahc)) == NULL) {
3347 			int s;
3348 
3349 			s = splcam();
3350 			ahc->flags |= AHC_RESOURCE_SHORTAGE;
3351 			splx(s);
3352 			xpt_freeze_simq(ahc->sim, /*count*/1);
3353 			ahc_set_ccb_status(ccb, CAM_REQUEUE_REQ);
3354 			xpt_done(ccb);
3355 			return;
3356 		}
3357 
3358 		hscb = scb->hscb;
3359 
3360 		CAM_DEBUG(ccb->ccb_h.path, CAM_DEBUG_SUBTRACE,
3361 			  ("start scb(%p)\n", scb));
3362 		scb->ccb = ccb;
3363 		/*
3364 		 * So we can find the SCB when an abort is requested
3365 		 */
3366 		ccb->ccb_h.ccb_scb_ptr = scb;
3367 		ccb->ccb_h.ccb_ahc_ptr = ahc;
3368 
3369 		/*
3370 		 * Put all the arguments for the xfer in the scb
3371 		 */
3372 		hscb->tcl = ((target_id << 4) & 0xF0)
3373 			| (SIM_IS_SCSIBUS_B(ahc, sim) ? SELBUSB : 0)
3374 			| (ccb->ccb_h.target_lun & 0x07);
3375 
3376 		mask = SCB_TARGET_MASK(scb);
3377 		tinfo = &ahc->transinfo[SCB_TARGET_OFFSET(scb)];
3378 
3379 		hscb->scsirate = tinfo->scsirate;
3380 		hscb->scsioffset = tinfo->current.offset;
3381 		if ((ahc->ultraenb & mask) != 0)
3382 			hscb->control |= ULTRAENB;
3383 
3384 		if ((ahc->discenable & mask) != 0
3385 		 && (ccb->ccb_h.flags & CAM_DIS_DISCONNECT) == 0)
3386 			hscb->control |= DISCENB;
3387 
3388 		if (ccb->ccb_h.func_code == XPT_RESET_DEV) {
3389 			hscb->cmdpointer = NULL;
3390 			scb->flags |= SCB_DEVICE_RESET;
3391 			hscb->control |= MK_MESSAGE;
3392 			ahc_execute_scb(scb, NULL, 0, 0);
3393 		} else {
3394 			if (ccb->ccb_h.func_code == XPT_CONT_TARGET_IO) {
3395 				if (ahc->pending_device == lstate) {
3396 					scb->flags |= SCB_TARGET_IMMEDIATE;
3397 					ahc->pending_device = NULL;
3398 				}
3399 				hscb->control |= TARGET_SCB;
3400 				hscb->cmdpointer = IDENTIFY_SEEN;
3401 				if ((ccb->ccb_h.flags & CAM_SEND_STATUS) != 0) {
3402 					hscb->cmdpointer |= SPHASE_PENDING;
3403 					hscb->status = ccb->csio.scsi_status;
3404 				}
3405 
3406 				/* Overloaded with tag ID */
3407 				hscb->cmdlen = ccb->csio.tag_id;
3408 				/*
3409 				 * Overloaded with our target ID to
3410 				 * use for reselection.
3411 				 */
3412 				hscb->next = ccb->ccb_h.target_id;
3413 			}
3414 			if (ccb->ccb_h.flags & CAM_TAG_ACTION_VALID)
3415 				hscb->control |= ccb->csio.tag_action;
3416 
3417 			ahc_setup_data(ahc, &ccb->csio, scb);
3418 		}
3419 		break;
3420 	}
3421 	case XPT_NOTIFY_ACK:
3422 	case XPT_IMMED_NOTIFY:
3423 	{
3424 		struct	   tmode_tstate *tstate;
3425 		struct	   tmode_lstate *lstate;
3426 		cam_status status;
3427 
3428 		status = ahc_find_tmode_devs(ahc, sim, ccb, &tstate,
3429 					     &lstate, TRUE);
3430 
3431 		if (status != CAM_REQ_CMP) {
3432 			ccb->ccb_h.status = status;
3433 			xpt_done(ccb);
3434 			break;
3435 		}
3436 		if (ccb->ccb_h.func_code == XPT_NOTIFY_ACK) {
3437 			/* Clear notification state */
3438 		}
3439 		SLIST_INSERT_HEAD(&lstate->immed_notifies, &ccb->ccb_h,
3440 				  sim_links.sle);
3441 		ccb->ccb_h.status = CAM_REQ_INPROG;
3442 		break;
3443 	}
3444 	case XPT_EN_LUN:		/* Enable LUN as a target */
3445 	{
3446 		struct	   tmode_tstate *tstate;
3447 		struct	   tmode_lstate *lstate;
3448 		struct	   ccb_en_lun *cel;
3449 		cam_status status;
3450 		int	   target;
3451 		int	   lun;
3452 
3453 		status = ahc_find_tmode_devs(ahc, sim, ccb, &tstate, &lstate,
3454 					     /* notfound_failure*/FALSE);
3455 
3456 		if (status != CAM_REQ_CMP) {
3457 			ccb->ccb_h.status = status;
3458 			xpt_done(ccb);
3459 			break;
3460 		}
3461 
3462 		cel = &ccb->cel;
3463 		target = ccb->ccb_h.target_id;
3464 		lun = ccb->ccb_h.target_lun;
3465 		if (cel->enable != 0) {
3466 			u_int scsiseq;
3467 
3468 			/* Are we already enabled?? */
3469 			if (lstate != NULL) {
3470 				ccb->ccb_h.status = CAM_LUN_ALRDY_ENA;
3471 				xpt_done(ccb);
3472 				break;
3473 			}
3474 
3475 			if (cel->grp6_len != 0
3476 			 || cel->grp7_len != 0) {
3477 				/*
3478 				 * Don't (yet?) support vendor
3479 				 * specific commands.
3480 				 */
3481 				ccb->ccb_h.status = CAM_REQ_INVALID;
3482 				xpt_done(ccb);
3483 				break;
3484 			}
3485 
3486 			/*
3487 			 * Seems to be okay.
3488 			 * Setup our data structures.
3489 			 */
3490 			if (tstate == NULL) {
3491 				tstate = malloc(sizeof(*tstate),
3492 						M_DEVBUF, M_NOWAIT);
3493 				if (tstate == NULL) {
3494 					ccb->ccb_h.status = CAM_RESRC_UNAVAIL;
3495 					xpt_done(ccb);
3496 					break;
3497 				}
3498 				bzero(tstate, sizeof(*tstate));
3499 				ahc->enabled_targets[target] = tstate;
3500 			}
3501 			lstate = malloc(sizeof(*lstate), M_DEVBUF, M_NOWAIT);
3502 			if (lstate == NULL) {
3503 				ccb->ccb_h.status = CAM_RESRC_UNAVAIL;
3504 				xpt_done(ccb);
3505 				break;
3506 			}
3507 			bzero(lstate, sizeof(*lstate));
3508 			SLIST_INIT(&lstate->accept_tios);
3509 			SLIST_INIT(&lstate->immed_notifies);
3510 			tstate->enabled_luns[lun] = lstate;
3511 			pause_sequencer(ahc);
3512 			if ((ahc->features & AHC_MULTI_TID) != 0) {
3513 				u_int16_t targid_mask;
3514 
3515 				targid_mask = ahc_inb(ahc, TARGID)
3516 					    | (ahc_inb(ahc, TARGID + 1) << 8);
3517 
3518 				targid_mask |= (0x01 << target);
3519 				ahc_outb(ahc, TARGID, targid_mask);
3520 				ahc_outb(ahc, TARGID+1, (targid_mask >> 8));
3521 			}
3522 			/* Allow select-in operations */
3523 			scsiseq = ahc_inb(ahc, SCSISEQ_TEMPLATE);
3524 			scsiseq |= ENSELI;
3525 			ahc_outb(ahc, SCSISEQ_TEMPLATE, scsiseq);
3526 			scsiseq = ahc_inb(ahc, SCSISEQ);
3527 			scsiseq |= ENSELI;
3528 			ahc_outb(ahc, SCSISEQ, scsiseq);
3529 			unpause_sequencer(ahc, /*always?*/FALSE);
3530 			ccb->ccb_h.status = CAM_REQ_CMP;
3531 			xpt_print_path(ccb->ccb_h.path);
3532 			printf("Lun now enabled for target mode\n");
3533 			xpt_done(ccb);
3534 			break;
3535 		} else {
3536 			struct ccb_hdr *elm;
3537 
3538 			/* XXX Fully Implement Disable */
3539 			if (lstate == NULL) {
3540 				ccb->ccb_h.status = CAM_LUN_INVALID;
3541 				xpt_done(ccb);
3542 				break;
3543 			}
3544 
3545 			ccb->ccb_h.status = CAM_REQ_CMP;
3546 			LIST_FOREACH(elm, &ahc->pending_ccbs, sim_links.le) {
3547 				if (elm->func_code == XPT_CONT_TARGET_IO
3548 				 && !xpt_path_comp(elm->path, ccb->ccb_h.path)){
3549 					printf("CTIO pending\n");
3550 					ccb->ccb_h.status = CAM_REQ_INVALID;
3551 					break;
3552 				}
3553 			}
3554 
3555 			if (SLIST_FIRST(&lstate->accept_tios) != NULL) {
3556 				printf("ATIOs pending\n");
3557 				ccb->ccb_h.status = CAM_REQ_INVALID;
3558 			}
3559 
3560 			if (SLIST_FIRST(&lstate->immed_notifies) != NULL) {
3561 				printf("INOTs pending\n");
3562 				ccb->ccb_h.status = CAM_REQ_INVALID;
3563 			}
3564 
3565 			if (ccb->ccb_h.status == CAM_REQ_CMP) {
3566 				int i, empty;
3567 
3568 				free(lstate, M_DEVBUF);
3569 				tstate->enabled_luns[lun] = NULL;
3570 
3571 				/* Can we clean up the target too? */
3572 				for (empty = 1, i = 0; i < 8; i++)
3573 					if (tstate->enabled_luns[i] != NULL) {
3574 						empty = 0;
3575 						break;
3576 					}
3577 				if (empty) {
3578 					printf("Target Empty\n");
3579 					free(tstate, M_DEVBUF);
3580 					ahc->enabled_targets[target] = NULL;
3581 					pause_sequencer(ahc);
3582 					if (ahc->features & AHC_MULTI_TID) {
3583 						u_int16_t targid_mask;
3584 
3585 						targid_mask =
3586 						    ahc_inb(ahc, TARGID)
3587 						  | (ahc_inb(ahc, TARGID + 1)
3588 						     << 8);
3589 
3590 						targid_mask &= (0x01 << target);
3591 						ahc_outb(ahc, TARGID,
3592 							 targid_mask);
3593 						ahc_outb(ahc, TARGID+1,
3594 							 (targid_mask >> 8));
3595 					}
3596 
3597 					for (empty = 1, i = 0; i < 16; i++)
3598 						if (ahc->enabled_targets[i]
3599 						    != NULL) {
3600 							empty = 0;
3601 							break;
3602 						}
3603 					if (empty) {
3604 						/* Disallow select-in */
3605 						u_int scsiseq;
3606 
3607 						printf("No targets\n");
3608 						scsiseq =
3609 						    ahc_inb(ahc,
3610 							    SCSISEQ_TEMPLATE);
3611 						scsiseq &= ~ENSELI;
3612 						ahc_outb(ahc, SCSISEQ_TEMPLATE,
3613 							 scsiseq);
3614 						scsiseq = ahc_inb(ahc, SCSISEQ);
3615 						scsiseq &= ~ENSELI;
3616 						ahc_outb(ahc, SCSISEQ, scsiseq);
3617 					}
3618 					unpause_sequencer(ahc,
3619 							  /*always?*/FALSE);
3620 				}
3621 			}
3622 			xpt_done(ccb);
3623 			break;
3624 		}
3625 		break;
3626 	}
3627 	case XPT_ABORT:			/* Abort the specified CCB */
3628 	{
3629 		ahc_abort_ccb(ahc, sim, ccb);
3630 		break;
3631 	}
3632 	case XPT_SET_TRAN_SETTINGS:
3633 	{
3634 		struct	  ahc_devinfo devinfo;
3635 		struct	  ccb_trans_settings *cts;
3636 		struct	  ahc_target_tinfo *tinfo;
3637 		u_int	  update_type;
3638 		int	  s;
3639 
3640 		cts = &ccb->cts;
3641 		ahc_compile_devinfo(&devinfo, cts->ccb_h.target_id,
3642 				    cts->ccb_h.target_lun,
3643 				    SIM_IS_SCSIBUS_B(ahc, sim) ? 'B' : 'A',
3644 				    ROLE_UNKNOWN);
3645 		tinfo = &ahc->transinfo[devinfo.target_offset];
3646 		update_type = 0;
3647 		if ((cts->flags & CCB_TRANS_CURRENT_SETTINGS) != 0)
3648 			update_type |= AHC_TRANS_GOAL;
3649 		if ((cts->flags & CCB_TRANS_USER_SETTINGS) != 0)
3650 			update_type |= AHC_TRANS_USER;
3651 
3652 		s = splcam();
3653 
3654 		if ((cts->valid & CCB_TRANS_DISC_VALID) != 0) {
3655 			if ((cts->flags & CCB_TRANS_DISC_ENB) != 0)
3656 				ahc->discenable |= devinfo.target_mask;
3657 			else
3658 				ahc->discenable &= ~devinfo.target_mask;
3659 		}
3660 
3661 		if ((cts->valid & CCB_TRANS_TQ_VALID) != 0) {
3662 			if ((cts->flags & CCB_TRANS_TAG_ENB) != 0)
3663 				ahc->tagenable |= devinfo.target_mask;
3664 			else
3665 				ahc->tagenable &= ~devinfo.target_mask;
3666 		}
3667 
3668 		if ((cts->valid & CCB_TRANS_BUS_WIDTH_VALID) != 0) {
3669 			switch (cts->bus_width) {
3670 			case MSG_EXT_WDTR_BUS_16_BIT:
3671 				if ((ahc->features & AHC_WIDE) != 0)
3672 					break;
3673 				/* FALLTHROUGH to 8bit */
3674 			case MSG_EXT_WDTR_BUS_32_BIT:
3675 			case MSG_EXT_WDTR_BUS_8_BIT:
3676 			default:
3677 				cts->bus_width = MSG_EXT_WDTR_BUS_8_BIT;
3678 				break;
3679 			}
3680 			ahc_set_width(ahc, &devinfo, cts->ccb_h.path,
3681 				      cts->bus_width, update_type);
3682 		}
3683 
3684 		if ((cts->valid &  CCB_TRANS_SYNC_RATE_VALID) != 0) {
3685 			struct ahc_syncrate *syncrate;
3686 			u_int maxsync;
3687 
3688 			if ((ahc->features & AHC_ULTRA2) != 0)
3689 				maxsync = AHC_SYNCRATE_ULTRA2;
3690 			else if ((ahc->features & AHC_ULTRA) != 0)
3691 				maxsync = AHC_SYNCRATE_ULTRA;
3692 			else
3693 				maxsync = AHC_SYNCRATE_FAST;
3694 
3695 			if ((cts->valid & CCB_TRANS_SYNC_OFFSET_VALID) == 0)
3696 				cts->sync_offset = 0;
3697 
3698 			syncrate = ahc_find_syncrate(ahc, &cts->sync_period,
3699 						     maxsync);
3700 			ahc_validate_offset(ahc, syncrate, &cts->sync_offset,
3701 					    MSG_EXT_WDTR_BUS_8_BIT);
3702 
3703 			/* We use a period of 0 to represent async */
3704 			if (cts->sync_offset == 0)
3705 				cts->sync_period = 0;
3706 
3707 			ahc_set_syncrate(ahc, &devinfo, cts->ccb_h.path,
3708 					 syncrate, cts->sync_period,
3709 					 cts->sync_offset, update_type);
3710 		}
3711 		splx(s);
3712 		ccb->ccb_h.status = CAM_REQ_CMP;
3713 		xpt_done(ccb);
3714 		break;
3715 	}
3716 	case XPT_GET_TRAN_SETTINGS:
3717 	/* Get default/user set transfer settings for the target */
3718 	{
3719 		struct	  ahc_devinfo devinfo;
3720 		struct	  ccb_trans_settings *cts;
3721 		struct	  ahc_target_tinfo *targ_info;
3722 		struct	  ahc_transinfo *tinfo;
3723 		int	  s;
3724 
3725 		cts = &ccb->cts;
3726 		ahc_compile_devinfo(&devinfo, cts->ccb_h.target_id,
3727 				    cts->ccb_h.target_lun,
3728 				    SIM_IS_SCSIBUS_B(ahc, sim) ? 'B' : 'A',
3729 				    ROLE_UNKNOWN);
3730 		targ_info = &ahc->transinfo[devinfo.target_offset];
3731 
3732 		if ((cts->flags & CCB_TRANS_CURRENT_SETTINGS) != 0)
3733 			tinfo = &targ_info->current;
3734 		else
3735 			tinfo = &targ_info->user;
3736 
3737 		s = splcam();
3738 
3739 		cts->flags &= ~(CCB_TRANS_DISC_ENB|CCB_TRANS_TAG_ENB);
3740 		if ((ahc->discenable & devinfo.target_mask) != 0)
3741 			cts->flags |= CCB_TRANS_DISC_ENB;
3742 
3743 		if ((ahc->tagenable & devinfo.target_mask) != 0)
3744 			cts->flags |= CCB_TRANS_TAG_ENB;
3745 
3746 		cts->sync_period = tinfo->period;
3747 		cts->sync_offset = tinfo->offset;
3748 		cts->bus_width = tinfo->width;
3749 
3750 		splx(s);
3751 
3752 		cts->valid = CCB_TRANS_SYNC_RATE_VALID
3753 			   | CCB_TRANS_SYNC_OFFSET_VALID
3754 			   | CCB_TRANS_BUS_WIDTH_VALID
3755 			   | CCB_TRANS_DISC_VALID
3756 			   | CCB_TRANS_TQ_VALID;
3757 
3758 		ccb->ccb_h.status = CAM_REQ_CMP;
3759 		xpt_done(ccb);
3760 		break;
3761 	}
3762 	case XPT_CALC_GEOMETRY:
3763 	{
3764 		struct	  ccb_calc_geometry *ccg;
3765 		u_int32_t size_mb;
3766 		u_int32_t secs_per_cylinder;
3767 		int	  extended;
3768 
3769 		ccg = &ccb->ccg;
3770 		size_mb = ccg->volume_size
3771 			/ ((1024L * 1024L) / ccg->block_size);
3772 		extended = SIM_IS_SCSIBUS_B(ahc, sim)
3773 			? ahc->flags & AHC_EXTENDED_TRANS_B
3774 			: ahc->flags & AHC_EXTENDED_TRANS_A;
3775 
3776 		if (size_mb > 1024 && extended) {
3777 			ccg->heads = 255;
3778 			ccg->secs_per_track = 63;
3779 		} else {
3780 			ccg->heads = 64;
3781 			ccg->secs_per_track = 32;
3782 		}
3783 		secs_per_cylinder = ccg->heads * ccg->secs_per_track;
3784 		ccg->cylinders = ccg->volume_size / secs_per_cylinder;
3785 		ccb->ccb_h.status = CAM_REQ_CMP;
3786 		xpt_done(ccb);
3787 		break;
3788 	}
3789 	case XPT_RESET_BUS:		/* Reset the specified SCSI bus */
3790 	{
3791 		struct cam_path *path;
3792 		char channel;
3793 		int  found;
3794 
3795 		s = splcam();
3796 		if (SIM_IS_SCSIBUS_B(ahc, sim)) {
3797 			channel = 'B';
3798 			path = ahc->path_b;
3799 		} else {
3800 			channel = 'A';
3801 			path = ahc->path;
3802 		}
3803 		found = ahc_reset_channel(ahc, channel, /*initiate reset*/TRUE);
3804 		splx(s);
3805 		if (bootverbose) {
3806 			xpt_print_path(path);
3807 			printf("SCSI bus reset delivered. "
3808 			       "%d SCBs aborted.\n", found);
3809 		}
3810 		ccb->ccb_h.status = CAM_REQ_CMP;
3811 		xpt_done(ccb);
3812 		break;
3813 	}
3814 	case XPT_TERM_IO:		/* Terminate the I/O process */
3815 		/* XXX Implement */
3816 		ccb->ccb_h.status = CAM_REQ_INVALID;
3817 		xpt_done(ccb);
3818 		break;
3819 	case XPT_PATH_INQ:		/* Path routing inquiry */
3820 	{
3821 		struct ccb_pathinq *cpi = &ccb->cpi;
3822 
3823 		cpi->version_num = 1; /* XXX??? */
3824 		cpi->hba_inquiry = PI_SDTR_ABLE|PI_TAG_ABLE;
3825 		if ((ahc->features & AHC_WIDE) != 0)
3826 			cpi->hba_inquiry |= PI_WIDE_16;
3827 		if ((ahc->flags & AHC_TARGETMODE) != 0) {
3828 			cpi->target_sprt = PIT_PROCESSOR
3829 					 | PIT_DISCONNECT
3830 					 | PIT_TERM_IO;
3831 		} else {
3832 			cpi->target_sprt = 0;
3833 		}
3834 		cpi->hba_misc = (ahc->flags & AHC_INITIATORMODE)
3835 			      ? 0 : PIM_NOINITIATOR;
3836 		cpi->hba_eng_cnt = 0;
3837 		cpi->max_target = (ahc->features & AHC_WIDE) ? 15 : 7;
3838 		cpi->max_lun = 7;
3839 		if (SIM_IS_SCSIBUS_B(ahc, sim)) {
3840 			cpi->initiator_id = ahc->our_id_b;
3841 			if ((ahc->flags & AHC_RESET_BUS_B) == 0)
3842 				cpi->hba_misc |= PIM_NOBUSRESET;
3843 		} else {
3844 			cpi->initiator_id = ahc->our_id;
3845 			if ((ahc->flags & AHC_RESET_BUS_A) == 0)
3846 				cpi->hba_misc |= PIM_NOBUSRESET;
3847 		}
3848 		cpi->bus_id = cam_sim_bus(sim);
3849 		strncpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
3850 		strncpy(cpi->hba_vid, "Adaptec", HBA_IDLEN);
3851 		strncpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
3852 		cpi->unit_number = cam_sim_unit(sim);
3853 		cpi->ccb_h.status = CAM_REQ_CMP;
3854 		xpt_done(ccb);
3855 		break;
3856 	}
3857 	default:
3858 		ccb->ccb_h.status = CAM_REQ_INVALID;
3859 		xpt_done(ccb);
3860 		break;
3861 	}
3862 }
3863 
3864 static void
3865 ahc_async(void *callback_arg, u_int32_t code, struct cam_path *path, void *arg)
3866 {
3867 	struct ahc_softc *ahc;
3868 	struct cam_sim *sim;
3869 
3870 	sim = (struct cam_sim *)callback_arg;
3871 	ahc = (struct ahc_softc *)cam_sim_softc(sim);
3872 	switch (code) {
3873 	case AC_LOST_DEVICE:
3874 	{
3875 		struct	ahc_devinfo devinfo;
3876 
3877 		ahc_compile_devinfo(&devinfo, xpt_path_target_id(path),
3878 				    xpt_path_lun_id(path),
3879 				    SIM_IS_SCSIBUS_B(ahc, sim) ? 'B' : 'A',
3880 				    ROLE_UNKNOWN);
3881 
3882 		/*
3883 		 * Revert to async/narrow transfers
3884 		 * for the next device.
3885 		 */
3886 		pause_sequencer(ahc);
3887 		ahc_set_width(ahc, &devinfo, path, MSG_EXT_WDTR_BUS_8_BIT,
3888 			      AHC_TRANS_GOAL|AHC_TRANS_CUR);
3889 		ahc_set_syncrate(ahc, &devinfo, path, /*syncrate*/NULL,
3890 				 /*period*/0, /*offset*/0,
3891 				 AHC_TRANS_GOAL|AHC_TRANS_CUR);
3892 		unpause_sequencer(ahc, /*unpause always*/FALSE);
3893 		break;
3894 	}
3895 	default:
3896 		break;
3897 	}
3898 }
3899 
3900 static void
3901 ahc_execute_scb(void *arg, bus_dma_segment_t *dm_segs, int nsegments,
3902 		int error)
3903 {
3904 	struct	 scb *scb;
3905 	union	 ccb *ccb;
3906 	struct	 ahc_softc *ahc;
3907 	int	 s;
3908 
3909 	scb = (struct scb *)arg;
3910 	ccb = scb->ccb;
3911 	ahc = (struct ahc_softc *)ccb->ccb_h.ccb_ahc_ptr;
3912 
3913 	if (nsegments != 0) {
3914 		struct	  ahc_dma_seg *sg;
3915 		bus_dma_segment_t *end_seg;
3916 		bus_dmasync_op_t op;
3917 
3918 		end_seg = dm_segs + nsegments;
3919 
3920 		/* Copy the first SG into the data pointer area */
3921 		scb->hscb->SG_pointer = scb->ahc_dmaphys;
3922 		scb->hscb->data = dm_segs->ds_addr;
3923 		scb->hscb->datalen = dm_segs->ds_len;
3924 		dm_segs++;
3925 
3926 		/* Copy the remaining segments into our SG list */
3927 		sg = scb->ahc_dma;
3928 		while (dm_segs < end_seg) {
3929 			sg->addr = dm_segs->ds_addr;
3930 			sg->len = dm_segs->ds_len;
3931 			sg++;
3932 			dm_segs++;
3933 		}
3934 
3935 		if ((ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN)
3936 			op = BUS_DMASYNC_PREREAD;
3937 		else
3938 			op = BUS_DMASYNC_PREWRITE;
3939 
3940 		bus_dmamap_sync(ahc->dmat, scb->dmamap, op);
3941 	} else {
3942 		scb->hscb->SG_pointer = 0;
3943 		scb->hscb->data = 0;
3944 		scb->hscb->datalen = 0;
3945 	}
3946 
3947 	scb->sg_count = scb->hscb->SG_count = nsegments;
3948 
3949 	s = splcam();
3950 
3951 	/*
3952 	 * Last time we need to check if this SCB needs to
3953 	 * be aborted.
3954 	 */
3955 	if (ahc_ccb_status(ccb) != CAM_REQ_INPROG) {
3956 		if (nsegments != 0)
3957 			bus_dmamap_unload(ahc->dmat, scb->dmamap);
3958 		ahc_free_scb(ahc, scb);
3959 		xpt_done(ccb);
3960 		splx(s);
3961 		return;
3962 	}
3963 
3964 	/* Busy this tcl if we are untagged */
3965 	if ((scb->hscb->control & TAG_ENB) == 0)
3966 		ahc_busy_tcl(ahc, scb);
3967 
3968 	LIST_INSERT_HEAD(&ahc->pending_ccbs, &ccb->ccb_h,
3969 			 sim_links.le);
3970 
3971 	scb->flags |= SCB_ACTIVE;
3972 	ccb->ccb_h.status |= CAM_SIM_QUEUED;
3973 
3974 	ccb->ccb_h.timeout_ch =
3975 	    timeout(ahc_timeout, (caddr_t)scb,
3976 		    (ccb->ccb_h.timeout * hz) / 1000);
3977 
3978 	if ((scb->flags & SCB_TARGET_IMMEDIATE) != 0) {
3979 		if ((ahc->flags & AHC_PAGESCBS) == 0)
3980 			ahc_outb(ahc, SCBPTR, scb->hscb->tag);
3981 		pause_sequencer(ahc);
3982 		ahc_outb(ahc, SCB_TAG, scb->hscb->tag);
3983 		ahc_outb(ahc, RETURN_1, CONT_MSG_LOOP);
3984 		unpause_sequencer(ahc, /*unpause_always*/FALSE);
3985 	} else {
3986 
3987 		ahc->qinfifo[ahc->qinfifonext++] = scb->hscb->tag;
3988 
3989 		if ((ahc->features & AHC_QUEUE_REGS) != 0) {
3990 			ahc_outb(ahc, HNSCB_QOFF, ahc->qinfifonext);
3991 		} else {
3992 			pause_sequencer(ahc);
3993 			ahc_outb(ahc, KERNEL_QINPOS, ahc->qinfifonext);
3994 			unpause_sequencer(ahc, /*unpause_always*/FALSE);
3995 		}
3996 	}
3997 
3998 	splx(s);
3999 }
4000 
4001 static void
4002 ahc_poll(struct cam_sim *sim)
4003 {
4004 	ahc_intr(cam_sim_softc(sim));
4005 }
4006 
4007 static void
4008 ahc_setup_data(struct ahc_softc *ahc, struct ccb_scsiio *csio,
4009 	       struct scb *scb)
4010 {
4011 	struct hardware_scb *hscb;
4012 	struct ccb_hdr *ccb_h;
4013 
4014 	hscb = scb->hscb;
4015 	ccb_h = &csio->ccb_h;
4016 
4017 	if (ccb_h->func_code == XPT_SCSI_IO) {
4018 		hscb->cmdlen = csio->cdb_len;
4019 		if ((ccb_h->flags & CAM_CDB_POINTER) != 0) {
4020 			if ((ccb_h->flags & CAM_CDB_PHYS) == 0)
4021 				if (hscb->cmdlen <= 16) {
4022 					memcpy(hscb->cmdstore,
4023 					       csio->cdb_io.cdb_ptr,
4024 					       hscb->cmdlen);
4025 					hscb->cmdpointer =
4026 					    hscb->cmdstore_busaddr;
4027 				} else
4028 					hscb->cmdpointer =
4029 					    vtophys(csio->cdb_io.cdb_ptr);
4030 			else
4031 				hscb->cmdpointer =
4032 					(u_int32_t)csio->cdb_io.cdb_ptr;
4033 		} else {
4034 			/*
4035 			 * CCB CDB Data Storage area is only 16 bytes
4036 			 * so no additional testing is required
4037 			 */
4038 			memcpy(hscb->cmdstore, csio->cdb_io.cdb_bytes,
4039 			       hscb->cmdlen);
4040 			hscb->cmdpointer = hscb->cmdstore_busaddr;
4041 		}
4042 	}
4043 
4044 	/* Only use S/G if there is a transfer */
4045 	if ((ccb_h->flags & CAM_DIR_MASK) != CAM_DIR_NONE) {
4046 		if ((ccb_h->flags & CAM_SCATTER_VALID) == 0) {
4047 			/* We've been given a pointer to a single buffer */
4048 			if ((ccb_h->flags & CAM_DATA_PHYS) == 0) {
4049 				int s;
4050 				int error;
4051 
4052 				s = splsoftvm();
4053 				error = bus_dmamap_load(ahc->dmat,
4054 							scb->dmamap,
4055 							csio->data_ptr,
4056 							csio->dxfer_len,
4057 							ahc_execute_scb,
4058 							scb, /*flags*/0);
4059 				if (error == EINPROGRESS) {
4060 					/*
4061 					 * So as to maintain ordering,
4062 					 * freeze the controller queue
4063 					 * until our mapping is
4064 					 * returned.
4065 					 */
4066 					xpt_freeze_simq(ahc->sim,
4067 							/*count*/1);
4068 					scb->ccb->ccb_h.status |=
4069 					    CAM_RELEASE_SIMQ;
4070 				}
4071 				splx(s);
4072 			} else {
4073 				struct bus_dma_segment seg;
4074 
4075 				/* Pointer to physical buffer */
4076 				if (csio->dxfer_len > AHC_MAXTRANSFER_SIZE)
4077 					panic("ahc_setup_data - Transfer size "
4078 					      "larger than can device max");
4079 
4080 				seg.ds_addr = (bus_addr_t)csio->data_ptr;
4081 				seg.ds_len = csio->dxfer_len;
4082 				ahc_execute_scb(scb, &seg, 1, 0);
4083 			}
4084 		} else {
4085 			struct bus_dma_segment *segs;
4086 
4087 			if ((ccb_h->flags & CAM_DATA_PHYS) != 0)
4088 				panic("ahc_setup_data - Physical segment "
4089 				      "pointers unsupported");
4090 
4091 			if ((ccb_h->flags & CAM_SG_LIST_PHYS) == 0)
4092 				panic("ahc_setup_data - Virtual segment "
4093 				      "addresses unsupported");
4094 
4095 			/* Just use the segments provided */
4096 			segs = (struct bus_dma_segment *)csio->data_ptr;
4097 			ahc_execute_scb(scb, segs, csio->sglist_cnt, 0);
4098 		}
4099 		if (ccb_h->func_code == XPT_CONT_TARGET_IO) {
4100 			hscb->cmdpointer |= DPHASE_PENDING;
4101 			if ((ccb_h->flags & CAM_DIR_MASK) == CAM_DIR_IN)
4102 				hscb->cmdpointer |= (TARGET_DATA_IN << 8);
4103 		}
4104 	} else {
4105 		ahc_execute_scb(scb, NULL, 0, 0);
4106 	}
4107 }
4108 
4109 static void
4110 ahc_freeze_devq(struct ahc_softc *ahc, struct cam_path *path)
4111 {
4112 	int	target;
4113 	char	channel;
4114 	int	lun;
4115 
4116 	target = xpt_path_target_id(path);
4117 	lun = xpt_path_lun_id(path);
4118 	channel = xpt_path_sim(path)->bus_id == 0 ? 'A' : 'B';
4119 
4120 	ahc_search_qinfifo(ahc, target, channel, lun,
4121 			   /*tag*/SCB_LIST_NULL, CAM_REQUEUE_REQ,
4122 			   SEARCH_COMPLETE);
4123 }
4124 
4125 /*
4126  * An scb (and hence an scb entry on the board) is put onto the
4127  * free list.
4128  */
4129 static void
4130 ahc_free_scb(struct ahc_softc *ahc, struct scb *scb)
4131 {
4132 	struct hardware_scb *hscb;
4133 	int opri;
4134 
4135 	hscb = scb->hscb;
4136 
4137 	opri = splcam();
4138 
4139 	if ((ahc->flags & AHC_RESOURCE_SHORTAGE) != 0
4140 	 && (scb->ccb->ccb_h.status & CAM_RELEASE_SIMQ) == 0) {
4141 		scb->ccb->ccb_h.status |= CAM_RELEASE_SIMQ;
4142 		ahc->flags &= ~AHC_RESOURCE_SHORTAGE;
4143 	}
4144 
4145 	/* Clean up for the next user */
4146 	scb->flags = SCB_FREE;
4147 	hscb->control = 0;
4148 	hscb->status = 0;
4149 
4150 	STAILQ_INSERT_HEAD(&ahc->scb_data->free_scbs, scb, links);
4151 	splx(opri);
4152 }
4153 
4154 /*
4155  * Get a free scb, either one already assigned to a hardware slot
4156  * on the adapter or one that will require an SCB to be paged out before
4157  * use. If there are none, see if we can allocate a new SCB.  Otherwise
4158  * either return an error or sleep.
4159  */
4160 static struct scb *
4161 ahc_get_scb(struct ahc_softc *ahc)
4162 {
4163 	struct scb *scbp;
4164 	int opri;
4165 
4166 	opri = splcam();
4167 	if ((scbp = STAILQ_FIRST(&ahc->scb_data->free_scbs))) {
4168 		STAILQ_REMOVE_HEAD(&ahc->scb_data->free_scbs, links);
4169 	} else if (ahc->scb_data->numscbs < ahc->scb_data->maxscbs) {
4170 		scbp = ahc_alloc_scb(ahc);
4171 		if (scbp == NULL)
4172 			printf("%s: Can't malloc SCB\n", ahc_name(ahc));
4173 	}
4174 
4175 	splx(opri);
4176 
4177 	return (scbp);
4178 }
4179 
4180 
4181 static struct scb *
4182 ahc_alloc_scb(struct ahc_softc *ahc)
4183 {
4184 	static	struct ahc_dma_seg *next_sg_array = NULL;
4185 	static	int sg_arrays_free = 0;
4186 	struct	scb *newscb;
4187 	int	error;
4188 
4189 	newscb = (struct scb *) malloc(sizeof(struct scb), M_DEVBUF, M_NOWAIT);
4190 	if (newscb != NULL) {
4191 		bzero(newscb, sizeof(struct scb));
4192 		error = bus_dmamap_create(ahc->dmat, /*flags*/0,
4193 					  &newscb->dmamap);
4194 		if (error != 0)
4195 			printf("%s: Unable to allocate SCB dmamap - error %d\n",
4196 			       ahc_name(ahc), error);
4197 
4198 		if (error == 0 && next_sg_array == NULL) {
4199 			size_t	alloc_size = sizeof(struct ahc_dma_seg)
4200 					     * AHC_NSEG;
4201 			sg_arrays_free = PAGE_SIZE / alloc_size;
4202 			alloc_size *= sg_arrays_free;
4203 			if (alloc_size == 0)
4204 				panic("%s: SG list doesn't fit in a page",
4205 				      ahc_name(ahc));
4206 			next_sg_array = (struct ahc_dma_seg *)
4207 					malloc(alloc_size, M_DEVBUF, M_NOWAIT);
4208 		}
4209 		if (error == 0 && next_sg_array != NULL) {
4210 			struct hardware_scb *hscb;
4211 
4212 			newscb->ahc_dma = next_sg_array;
4213 			newscb->ahc_dmaphys = vtophys(next_sg_array);
4214 			sg_arrays_free--;
4215 			if (sg_arrays_free == 0)
4216 				next_sg_array = NULL;
4217 			else
4218 				next_sg_array = &next_sg_array[AHC_NSEG];
4219 			hscb = &ahc->scb_data->hscbs[ahc->scb_data->numscbs];
4220 			newscb->hscb = hscb;
4221 			hscb->control = 0;
4222 			hscb->status = 0;
4223 			hscb->tag = ahc->scb_data->numscbs;
4224 			hscb->residual_data_count[2] = 0;
4225 			hscb->residual_data_count[1] = 0;
4226 			hscb->residual_data_count[0] = 0;
4227 			hscb->residual_SG_count = 0;
4228 			hscb->cmdstore_busaddr =
4229 				ahc_hscb_busaddr(ahc, hscb->tag)
4230 			      + offsetof(struct hardware_scb, cmdstore);
4231 			/*
4232 			 * Place in the scbarray
4233 			 * Never is removed.
4234 			 */
4235 			ahc->scb_data->scbarray[hscb->tag] = newscb;
4236 			ahc->scb_data->numscbs++;
4237 		} else {
4238 			free(newscb, M_DEVBUF);
4239 			newscb = NULL;
4240 		}
4241 	}
4242 	return newscb;
4243 }
4244 
4245 static void
4246 ahc_loadseq(struct ahc_softc *ahc)
4247 {
4248 	struct patch *cur_patch;
4249 	int i;
4250 	int downloaded;
4251 	int skip_addr;
4252 	u_int8_t download_consts[4];
4253 
4254 	/* Setup downloadable constant table */
4255 #if 0
4256 	/* No downloaded constants are currently defined. */
4257 	download_consts[TMODE_NUMCMDS] = ahc->num_targetcmds;
4258 #endif
4259 
4260 	cur_patch = patches;
4261 	downloaded = 0;
4262 	skip_addr = 0;
4263 	ahc_outb(ahc, SEQCTL, PERRORDIS|FAILDIS|FASTMODE|LOADRAM);
4264 	ahc_outb(ahc, SEQADDR0, 0);
4265 	ahc_outb(ahc, SEQADDR1, 0);
4266 
4267 	for (i = 0; i < sizeof(seqprog)/4; i++) {
4268 		if (ahc_check_patch(ahc, &cur_patch, i, &skip_addr) == 0) {
4269 			/*
4270 			 * Don't download this instruction as it
4271 			 * is in a patch that was removed.
4272 			 */
4273                         continue;
4274 		}
4275 		ahc_download_instr(ahc, i, download_consts);
4276 		downloaded++;
4277 	}
4278 	ahc_outb(ahc, SEQCTL, PERRORDIS|FAILDIS|FASTMODE);
4279 	restart_sequencer(ahc);
4280 
4281 	if (bootverbose)
4282 		printf(" %d instructions downloaded\n", downloaded);
4283 }
4284 
4285 static int
4286 ahc_check_patch(struct ahc_softc *ahc, struct patch **start_patch,
4287 		int start_instr, int *skip_addr)
4288 {
4289 	struct	patch *cur_patch;
4290 	struct	patch *last_patch;
4291 	int	num_patches;
4292 
4293 	num_patches = sizeof(patches)/sizeof(struct patch);
4294 	last_patch = &patches[num_patches];
4295 	cur_patch = *start_patch;
4296 
4297 	while (cur_patch < last_patch && start_instr == cur_patch->begin) {
4298 
4299 		if (cur_patch->patch_func(ahc) == 0) {
4300 
4301 			/* Start rejecting code */
4302 			*skip_addr = start_instr + cur_patch->skip_instr;
4303 			cur_patch += cur_patch->skip_patch;
4304 		} else {
4305 			/* Accepted this patch.  Advance to the next
4306 			 * one and wait for our intruction pointer to
4307 			 * hit this point.
4308 			 */
4309 			cur_patch++;
4310 		}
4311 	}
4312 
4313 	*start_patch = cur_patch;
4314 	if (start_instr < *skip_addr)
4315 		/* Still skipping */
4316 		return (0);
4317 
4318 	return (1);
4319 }
4320 
4321 static void
4322 ahc_download_instr(struct ahc_softc *ahc, int instrptr, u_int8_t *dconsts)
4323 {
4324 	union	ins_formats instr;
4325 	struct	ins_format1 *fmt1_ins;
4326 	struct	ins_format3 *fmt3_ins;
4327 	u_int	opcode;
4328 
4329 	/* Structure copy */
4330 	instr = *(union ins_formats*)&seqprog[instrptr * 4];
4331 
4332 	fmt1_ins = &instr.format1;
4333 	fmt3_ins = NULL;
4334 
4335 	/* Pull the opcode */
4336 	opcode = instr.format1.opcode;
4337 	switch (opcode) {
4338 	case AIC_OP_JMP:
4339 	case AIC_OP_JC:
4340 	case AIC_OP_JNC:
4341 	case AIC_OP_CALL:
4342 	case AIC_OP_JNE:
4343 	case AIC_OP_JNZ:
4344 	case AIC_OP_JE:
4345 	case AIC_OP_JZ:
4346 	{
4347 		struct patch *cur_patch;
4348 		int address_offset;
4349 		u_int address;
4350 		int skip_addr;
4351 		int i;
4352 
4353 		fmt3_ins = &instr.format3;
4354 		address_offset = 0;
4355 		address = fmt3_ins->address;
4356 		cur_patch = patches;
4357 		skip_addr = 0;
4358 
4359 		for (i = 0; i < address;) {
4360 
4361 			ahc_check_patch(ahc, &cur_patch, i, &skip_addr);
4362 
4363 			if (skip_addr > i) {
4364 				int end_addr;
4365 
4366 				end_addr = MIN(address, skip_addr);
4367 				address_offset += end_addr - i;
4368 				i = skip_addr;
4369 			} else {
4370 				i++;
4371 			}
4372 		}
4373 		address -= address_offset;
4374 		fmt3_ins->address = address;
4375 		/* FALLTHROUGH */
4376 	}
4377 	case AIC_OP_OR:
4378 	case AIC_OP_AND:
4379 	case AIC_OP_XOR:
4380 	case AIC_OP_ADD:
4381 	case AIC_OP_ADC:
4382 	case AIC_OP_BMOV:
4383 		if (fmt1_ins->parity != 0) {
4384 			fmt1_ins->immediate = dconsts[fmt1_ins->immediate];
4385 		}
4386 		fmt1_ins->parity = 0;
4387 		/* FALLTHROUGH */
4388 	case AIC_OP_ROL:
4389 		if ((ahc->features & AHC_ULTRA2) != 0) {
4390 			int i, count;
4391 
4392 			/* Calculate odd parity for the instruction */
4393 			for (i = 0, count = 0; i < 31; i++) {
4394 				u_int32_t mask;
4395 
4396 				mask = 0x01 << i;
4397 				if ((instr.integer & mask) != 0)
4398 					count++;
4399 			}
4400 			if ((count & 0x01) == 0)
4401 				instr.format1.parity = 1;
4402 		} else {
4403 			/* Compress the instruction for older sequencers */
4404 			if (fmt3_ins != NULL) {
4405 				instr.integer =
4406 					fmt3_ins->immediate
4407 				      | (fmt3_ins->source << 8)
4408 				      | (fmt3_ins->address << 16)
4409 				      |	(fmt3_ins->opcode << 25);
4410 			} else {
4411 				instr.integer =
4412 					fmt1_ins->immediate
4413 				      | (fmt1_ins->source << 8)
4414 				      | (fmt1_ins->destination << 16)
4415 				      |	(fmt1_ins->ret << 24)
4416 				      |	(fmt1_ins->opcode << 25);
4417 			}
4418 		}
4419 		ahc_outsb(ahc, SEQRAM, instr.bytes, 4);
4420 		break;
4421 	default:
4422 		panic("Unknown opcode encountered in seq program");
4423 		break;
4424 	}
4425 }
4426 
4427 static void
4428 ahc_set_recoveryscb(struct ahc_softc *ahc, struct scb *scb) {
4429 
4430 	if ((scb->flags & SCB_RECOVERY_SCB) == 0) {
4431 		struct ccb_hdr *ccbh;
4432 
4433 		scb->flags |= SCB_RECOVERY_SCB;
4434 
4435 		/*
4436 		 * Take all queued, but not sent SCBs out of the equation.
4437 		 * Also ensure that no new CCBs are queued to us while we
4438 		 * try to fix this problem.
4439 		 */
4440 		if ((scb->ccb->ccb_h.status & CAM_RELEASE_SIMQ) == 0) {
4441 			xpt_freeze_simq(ahc->sim, /*count*/1);
4442 			scb->ccb->ccb_h.status |= CAM_RELEASE_SIMQ;
4443 		}
4444 
4445 		/*
4446 		 * Go through all of our pending SCBs and remove
4447 		 * any scheduled timeouts for them.  We will reschedule
4448 		 * them after we've successfully fixed this problem.
4449 		 */
4450 		ccbh = ahc->pending_ccbs.lh_first;
4451 		while (ccbh != NULL) {
4452 			struct scb *pending_scb;
4453 
4454 			pending_scb = (struct scb *)ccbh->ccb_scb_ptr;
4455 			untimeout(ahc_timeout, pending_scb, ccbh->timeout_ch);
4456 			ccbh = ccbh->sim_links.le.le_next;
4457 		}
4458 	}
4459 }
4460 
4461 static void
4462 ahc_timeout(void *arg)
4463 {
4464 	struct	scb *scb;
4465 	struct	ahc_softc *ahc;
4466 	int	s, found;
4467 	u_int	bus_state;
4468 	int	target;
4469 	int	lun;
4470 	char	channel;
4471 
4472 	scb = (struct scb *)arg;
4473 	ahc = (struct ahc_softc *)scb->ccb->ccb_h.ccb_ahc_ptr;
4474 
4475 	s = splcam();
4476 
4477 	/*
4478 	 * Ensure that the card doesn't do anything
4479 	 * behind our back.  Also make sure that we
4480 	 * didn't "just" miss an interrupt that would
4481 	 * affect this timeout.
4482 	 */
4483 	do {
4484 		ahc_intr(ahc);
4485 		pause_sequencer(ahc);
4486 	} while (ahc_inb(ahc, INTSTAT) & INT_PEND);
4487 
4488 	if ((scb->flags & SCB_ACTIVE) == 0) {
4489 		/* Previous timeout took care of me already */
4490 		printf("Timedout SCB handled by another timeout\n");
4491 		unpause_sequencer(ahc, /*unpause_always*/TRUE);
4492 		splx(s);
4493 		return;
4494 	}
4495 
4496 	target = SCB_TARGET(scb);
4497 	channel = SCB_CHANNEL(scb);
4498 	lun = SCB_LUN(scb);
4499 
4500 	xpt_print_path(scb->ccb->ccb_h.path);
4501 	printf("SCB 0x%x - timed out ", scb->hscb->tag);
4502 	/*
4503 	 * Take a snapshot of the bus state and print out
4504 	 * some information so we can track down driver bugs.
4505 	 */
4506 	bus_state = ahc_inb(ahc, LASTPHASE);
4507 
4508 	switch(bus_state)
4509 	{
4510 	case P_DATAOUT:
4511 		printf("in dataout phase");
4512 		break;
4513 	case P_DATAIN:
4514 		printf("in datain phase");
4515 		break;
4516 	case P_COMMAND:
4517 		printf("in command phase");
4518 		break;
4519 	case P_MESGOUT:
4520 		printf("in message out phase");
4521 		break;
4522 	case P_STATUS:
4523 		printf("in status phase");
4524 		break;
4525 	case P_MESGIN:
4526 		printf("in message in phase");
4527 		break;
4528 	case P_BUSFREE:
4529 		printf("while idle, LASTPHASE == 0x%x",
4530 			bus_state);
4531 		break;
4532 	default:
4533 		/*
4534 		 * We aren't in a valid phase, so assume we're
4535 		 * idle.
4536 		 */
4537 		printf("invalid phase, LASTPHASE == 0x%x",
4538 			bus_state);
4539 		bus_state = P_BUSFREE;
4540 		break;
4541 	}
4542 
4543 	printf(", SEQADDR == 0x%x\n",
4544 	       ahc_inb(ahc, SEQADDR0) | (ahc_inb(ahc, SEQADDR1) << 8));
4545 
4546 #if 0
4547 	printf(", SCSISIGI == 0x%x\n", ahc_inb(ahc, SCSISIGI));
4548 	printf("SIMODE1 = 0x%x\n", ahc_inb(ahc, SIMODE1));
4549 	printf("INTSTAT = 0x%x\n", ahc_inb(ahc, INTSTAT));
4550 	printf("SSTAT1 == 0x%x\n", ahc_inb(ahc, SSTAT1));
4551 	printf("SCSIRATE == 0x%x\n", ahc_inb(ahc, SCSIRATE));
4552 	printf("CCSCBCTL == 0x%x\n", ahc_inb(ahc, CCSCBCTL));
4553 	printf("CCSCBCNT == 0x%x\n", ahc_inb(ahc, CCSCBCNT));
4554 	printf("DFCNTRL == 0x%x\n", ahc_inb(ahc, DFCNTRL));
4555 	printf("DFSTATUS == 0x%x\n", ahc_inb(ahc, DFSTATUS));
4556 	printf("CCHCNT == 0x%x\n", ahc_inb(ahc, CCHCNT));
4557 #endif
4558 	if (scb->flags & SCB_DEVICE_RESET) {
4559 		/*
4560 		 * Been down this road before.
4561 		 * Do a full bus reset.
4562 		 */
4563 bus_reset:
4564 		ahc_set_ccb_status(scb->ccb, CAM_CMD_TIMEOUT);
4565 		found = ahc_reset_channel(ahc, channel, /*Initiate Reset*/TRUE);
4566 		printf("%s: Issued Channel %c Bus Reset. "
4567 		       "%d SCBs aborted\n", ahc_name(ahc), channel, found);
4568 	} else {
4569 		/*
4570 		 * If we are a target, transition to bus free and report
4571 		 * the timeout.
4572 		 *
4573 		 * The target/initiator that is holding up the bus may not
4574 		 * be the same as the one that triggered this timeout
4575 		 * (different commands have different timeout lengths).
4576 		 * If the bus is idle and we are actiing as the initiator
4577 		 * for this request, queue a BDR message to the timed out
4578 		 * target.  Otherwise, if the timed out transaction is
4579 		 * active:
4580 		 *   Initiator transaction:
4581 		 *	Stuff the message buffer with a BDR message and assert
4582 		 *	ATN in the hopes that the target will let go of the bus
4583 		 *	and go to the mesgout phase.  If this fails, we'll
4584 		 *	get another timeout 2 seconds later which will attempt
4585 		 *	a bus reset.
4586 		 *
4587 		 *   Target transaction:
4588 		 *	Transition to BUS FREE and report the error.
4589 		 *	It's good to be the target!
4590 		 */
4591 		u_int active_scb_index;
4592 
4593 		active_scb_index = ahc_inb(ahc, SCB_TAG);
4594 
4595 		if (bus_state != P_BUSFREE
4596 		  && (active_scb_index < ahc->scb_data->numscbs)) {
4597 			struct scb *active_scb;
4598 
4599 			/*
4600 			 * If the active SCB is not from our device,
4601 			 * assume that another device is hogging the bus
4602 			 * and wait for it's timeout to expire before
4603 			 * taking additional action.
4604 			 */
4605 			active_scb = ahc->scb_data->scbarray[active_scb_index];
4606 			if (active_scb->hscb->tcl != scb->hscb->tcl
4607 			 && (scb->flags & SCB_OTHERTCL_TIMEOUT) == 0) {
4608 				struct	ccb_hdr *ccbh;
4609 				u_int	newtimeout;
4610 
4611 				scb->flags |= SCB_OTHERTCL_TIMEOUT;
4612 				newtimeout = MAX(active_scb->ccb->ccb_h.timeout,
4613 						 scb->ccb->ccb_h.timeout);
4614 				ccbh = &scb->ccb->ccb_h;
4615 				scb->ccb->ccb_h.timeout_ch =
4616 				    timeout(ahc_timeout, scb,
4617 					    (newtimeout * hz) / 1000);
4618 				splx(s);
4619 				return;
4620 			}
4621 
4622 			/* It's us */
4623 			if ((scb->hscb->control & TARGET_SCB) != 0) {
4624 
4625 				/*
4626 				 * Send back any queued up transactions
4627 				 * and properly record the error condition.
4628 				 */
4629 				ahc_freeze_devq(ahc, scb->ccb->ccb_h.path);
4630 				ahc_set_ccb_status(scb->ccb, CAM_CMD_TIMEOUT);
4631 				ahc_freeze_ccb(scb->ccb);
4632 				ahc_done(ahc, scb);
4633 
4634 				/* Will clear us from the bus */
4635 				restart_sequencer(ahc);
4636 				return;
4637 			}
4638 
4639 			ahc_set_recoveryscb(ahc, active_scb);
4640 			ahc_outb(ahc, MSG_OUT, MSG_BUS_DEV_RESET);
4641 			ahc_outb(ahc, SCSISIGO, bus_state|ATNO);
4642 			xpt_print_path(active_scb->ccb->ccb_h.path);
4643 			printf("BDR message in message buffer\n");
4644 			active_scb->flags |=  SCB_DEVICE_RESET;
4645 			active_scb->ccb->ccb_h.timeout_ch =
4646 			    timeout(ahc_timeout, (caddr_t)active_scb, 2 * hz);
4647 			unpause_sequencer(ahc, /*unpause_always*/TRUE);
4648 		} else {
4649 			int	 disconnected;
4650 
4651 			if (bus_state != P_BUSFREE
4652 			 && (ahc_inb(ahc, SSTAT0) & TARGET) != 0) {
4653 				/* Hung target selection.  Goto busfree */
4654 				printf("%s: Hung target selection\n",
4655 				       ahc_name(ahc));
4656 				restart_sequencer(ahc);
4657 				return;
4658 			}
4659 
4660 			if (ahc_search_qinfifo(ahc, target, channel, lun,
4661 					       scb->hscb->tag, /*status*/0,
4662 					       SEARCH_COUNT) > 0) {
4663 				disconnected = FALSE;
4664 			} else {
4665 				disconnected = TRUE;
4666 			}
4667 
4668 			if (disconnected) {
4669 
4670 				ahc_set_recoveryscb(ahc, scb);
4671 				/*
4672 				 * Simply set the MK_MESSAGE control bit.
4673 				 */
4674 				scb->hscb->control |= MK_MESSAGE;
4675 				scb->flags |= SCB_QUEUED_MSG
4676 					   |  SCB_DEVICE_RESET;
4677 
4678 				/*
4679 				 * Remove this SCB from the disconnected
4680 				 * list so that a reconnect at this point
4681 				 * causes a BDR.
4682 				 */
4683 				ahc_search_disc_list(ahc, target, channel, lun,
4684 						     scb->hscb->tag);
4685 				ahc_index_busy_tcl(ahc, scb->hscb->tcl,
4686 						   /*unbusy*/TRUE);
4687 
4688 				/*
4689 				 * Actually re-queue this SCB in case we can
4690 				 * select the device before it reconnects.
4691 				 * Clear out any entries in the QINFIFO first
4692 				 * so we are the next SCB for this target
4693 				 * to run.
4694 				 */
4695 				ahc_search_qinfifo(ahc, SCB_TARGET(scb),
4696 						   channel, SCB_LUN(scb),
4697 						   SCB_LIST_NULL,
4698 						   CAM_REQUEUE_REQ,
4699 						   SEARCH_COMPLETE);
4700 				xpt_print_path(scb->ccb->ccb_h.path);
4701 				printf("Queuing a BDR SCB\n");
4702 				ahc->qinfifo[ahc->qinfifonext++] =
4703 				    scb->hscb->tag;
4704 				if ((ahc->features & AHC_QUEUE_REGS) != 0) {
4705 					ahc_outb(ahc, HNSCB_QOFF,
4706 						 ahc->qinfifonext);
4707 				} else {
4708 					ahc_outb(ahc, KERNEL_QINPOS,
4709 						 ahc->qinfifonext);
4710 				}
4711 				scb->ccb->ccb_h.timeout_ch =
4712 				    timeout(ahc_timeout, (caddr_t)scb, 2 * hz);
4713 				unpause_sequencer(ahc, /*unpause_always*/FALSE);
4714 			} else {
4715 				/* Go "immediatly" to the bus reset */
4716 				/* This shouldn't happen */
4717 				ahc_set_recoveryscb(ahc, scb);
4718 				xpt_print_path(scb->ccb->ccb_h.path);
4719 				printf("SCB %d: Immediate reset.  "
4720 					"Flags = 0x%x\n", scb->hscb->tag,
4721 					scb->flags);
4722 				goto bus_reset;
4723 			}
4724 		}
4725 	}
4726 	splx(s);
4727 }
4728 
4729 static int
4730 ahc_search_qinfifo(struct ahc_softc *ahc, int target, char channel,
4731 		   int lun, u_int tag, u_int32_t status,
4732 		   ahc_search_action action)
4733 {
4734 	struct	 scb *scbp;
4735 	u_int8_t qinpos;
4736 	u_int8_t qintail;
4737 	int	 found;
4738 
4739 	qinpos = ahc_inb(ahc, QINPOS);
4740 	qintail = ahc->qinfifonext;
4741 	found = 0;
4742 
4743 	/*
4744 	 * Start with an empty queue.  Entries that are not chosen
4745 	 * for removal will be re-added to the queue as we go.
4746 	 */
4747 	ahc->qinfifonext = qinpos;
4748 
4749 	while (qinpos != qintail) {
4750 		scbp = ahc->scb_data->scbarray[ahc->qinfifo[qinpos]];
4751 		if (ahc_match_scb(scbp, target, channel, lun, tag)) {
4752 			/*
4753 			 * We found an scb that needs to be removed.
4754 			 */
4755 			switch (action) {
4756 			case SEARCH_COMPLETE:
4757 				if (ahc_ccb_status(scbp->ccb) == CAM_REQ_INPROG)
4758 					ahc_set_ccb_status(scbp->ccb, status);
4759 				ahc_freeze_ccb(scbp->ccb);
4760 				ahc_done(ahc, scbp);
4761 				break;
4762 			case SEARCH_COUNT:
4763 				ahc->qinfifo[ahc->qinfifonext++] =
4764 				    scbp->hscb->tag;
4765 				break;
4766 			case SEARCH_REMOVE:
4767 				break;
4768 			}
4769 			found++;
4770 		} else {
4771 			ahc->qinfifo[ahc->qinfifonext++] = scbp->hscb->tag;
4772 		}
4773 		qinpos++;
4774 	}
4775 
4776 	if ((ahc->features & AHC_QUEUE_REGS) != 0) {
4777 		ahc_outb(ahc, HNSCB_QOFF, ahc->qinfifonext);
4778 	} else {
4779 		ahc_outb(ahc, KERNEL_QINPOS, ahc->qinfifonext);
4780 	}
4781 
4782 	return (found);
4783 }
4784 
4785 
4786 static void
4787 ahc_abort_ccb(struct ahc_softc *ahc, struct cam_sim *sim, union ccb *ccb)
4788 {
4789 	union ccb *abort_ccb;
4790 
4791 	abort_ccb = ccb->cab.abort_ccb;
4792 	switch (abort_ccb->ccb_h.func_code) {
4793 	case XPT_ACCEPT_TARGET_IO:
4794 	case XPT_IMMED_NOTIFY:
4795 	case XPT_CONT_TARGET_IO:
4796 	{
4797 		struct tmode_tstate *tstate;
4798 		struct tmode_lstate *lstate;
4799 		struct ccb_hdr_slist *list;
4800 		cam_status status;
4801 
4802 		status = ahc_find_tmode_devs(ahc, sim, abort_ccb, &tstate,
4803 					     &lstate, TRUE);
4804 
4805 		if (status != CAM_REQ_CMP) {
4806 			ccb->ccb_h.status = status;
4807 			break;
4808 		}
4809 
4810 		if (abort_ccb->ccb_h.func_code == XPT_ACCEPT_TARGET_IO)
4811 			list = &lstate->accept_tios;
4812 		else if (abort_ccb->ccb_h.func_code == XPT_IMMED_NOTIFY)
4813 			list = &lstate->immed_notifies;
4814 		else
4815 			list = NULL;
4816 
4817 		if (list != NULL) {
4818 			struct ccb_hdr *curelm;
4819 			int found;
4820 
4821 			curelm = SLIST_FIRST(list);
4822 			found = 0;
4823 			if (curelm == &abort_ccb->ccb_h) {
4824 				found = 1;
4825 				SLIST_REMOVE_HEAD(list, sim_links.sle);
4826 			} else {
4827 				while(curelm != NULL) {
4828 					struct ccb_hdr *nextelm;
4829 
4830 					nextelm =
4831 					    SLIST_NEXT(curelm, sim_links.sle);
4832 
4833 					if (nextelm == &abort_ccb->ccb_h) {
4834 						found = 1;
4835 						SLIST_NEXT(curelm,
4836 							   sim_links.sle) =
4837 						    SLIST_NEXT(nextelm,
4838 							       sim_links.sle);
4839 						break;
4840 					}
4841 					curelm = nextelm;
4842 				}
4843 			}
4844 
4845 			if (found)
4846 				abort_ccb->ccb_h.status = CAM_REQ_ABORTED;
4847 			else {
4848 				printf("Not found\n");
4849 				ccb->ccb_h.status = CAM_PATH_INVALID;
4850 			}
4851 			break;
4852 		}
4853 		/* FALLTHROUGH */
4854 	}
4855 	case XPT_SCSI_IO:
4856 		/* XXX Fully implement the hard ones */
4857 		ccb->ccb_h.status = CAM_UA_ABORT;
4858 		break;
4859 	default:
4860 		ccb->ccb_h.status = CAM_REQ_INVALID;
4861 		break;
4862 	}
4863 	xpt_done(ccb);
4864 }
4865 
4866 /*
4867  * Abort all SCBs that match the given description (target/channel/lun/tag),
4868  * setting their status to the passed in status if the status has not already
4869  * been modified from CAM_REQ_INPROG.  This routine assumes that the sequencer
4870  * is paused before it is called.
4871  */
4872 static int
4873 ahc_abort_scbs(struct ahc_softc *ahc, int target, char channel,
4874 	       int lun, u_int tag, u_int32_t status)
4875 {
4876 	struct	scb *scbp;
4877 	u_int	active_scb;
4878 	int	i;
4879 	int	found;
4880 
4881 	/* restore this when we're done */
4882 	active_scb = ahc_inb(ahc, SCBPTR);
4883 
4884 	found = ahc_search_qinfifo(ahc, target, channel, lun, tag,
4885 				   CAM_REQUEUE_REQ, SEARCH_COMPLETE);
4886 
4887 	/*
4888 	 * Search waiting for selection list.
4889 	 */
4890 	{
4891 		u_int8_t next, prev;
4892 
4893 		next = ahc_inb(ahc, WAITING_SCBH);  /* Start at head of list. */
4894 		prev = SCB_LIST_NULL;
4895 
4896 		while (next != SCB_LIST_NULL) {
4897 			u_int8_t scb_index;
4898 
4899 			ahc_outb(ahc, SCBPTR, next);
4900 			scb_index = ahc_inb(ahc, SCB_TAG);
4901 			if (scb_index >= ahc->scb_data->numscbs) {
4902 				panic("Waiting List inconsistency. "
4903 				      "SCB index == %d, yet numscbs == %d.",
4904 				      scb_index, ahc->scb_data->numscbs);
4905 			}
4906 			scbp = ahc->scb_data->scbarray[scb_index];
4907 			if (ahc_match_scb(scbp, target, channel, lun, tag)) {
4908 
4909 				next = ahc_abort_wscb(ahc, next, prev);
4910 			} else {
4911 
4912 				prev = next;
4913 				next = ahc_inb(ahc, SCB_NEXT);
4914 			}
4915 		}
4916 	}
4917 	/*
4918 	 * Go through the disconnected list and remove any entries we
4919 	 * have queued for completion, 0'ing their control byte too.
4920 	 */
4921 	ahc_search_disc_list(ahc, target, channel, lun, tag);
4922 
4923 	/*
4924 	 * Go through the hardware SCB array looking for commands that
4925 	 * were active but not on any list.
4926 	 */
4927 	for(i = 0; i < ahc->scb_data->maxhscbs; i++) {
4928 		u_int scbid;
4929 
4930 		ahc_outb(ahc, SCBPTR, i);
4931 		scbid = ahc_inb(ahc, SCB_TAG);
4932 		if (scbid < ahc->scb_data->numscbs) {
4933 			scbp = ahc->scb_data->scbarray[scbid];
4934 			if (ahc_match_scb(scbp, target, channel, lun, tag)) {
4935 				ahc_add_curscb_to_free_list(ahc);
4936                         }
4937 		}
4938 	}
4939 	/*
4940 	 * Go through the pending CCB list and look for
4941 	 * commands for this target that are still active.
4942 	 * These are other tagged commands that were
4943 	 * disconnected when the reset occured.
4944 	 */
4945 	{
4946 		struct ccb_hdr *ccb_h;
4947 
4948 
4949 		ccb_h = ahc->pending_ccbs.lh_first;
4950 
4951 		while (ccb_h != NULL) {
4952 			scbp = (struct scb *)ccb_h->ccb_scb_ptr;
4953 			ccb_h = ccb_h->sim_links.le.le_next;
4954 			if (ahc_match_scb(scbp, target, channel, lun, tag)) {
4955 				if (ahc_ccb_status(scbp->ccb) == CAM_REQ_INPROG)
4956 					ahc_set_ccb_status(scbp->ccb, status);
4957 				ahc_freeze_ccb(scbp->ccb);
4958 				ahc_done(ahc, scbp);
4959 				found++;
4960 			}
4961 		}
4962 	}
4963 	ahc_outb(ahc, SCBPTR, active_scb);
4964 	return found;
4965 }
4966 
4967 static int
4968 ahc_search_disc_list(struct ahc_softc *ahc, int target, char channel,
4969 		     int lun, u_int tag)
4970 {
4971 	struct	scb *scbp;
4972 	u_int	next;
4973 	u_int	prev;
4974 	u_int	count;
4975 	u_int	active_scb;
4976 
4977 	count = 0;
4978 	next = ahc_inb(ahc, DISCONNECTED_SCBH);
4979 	prev = SCB_LIST_NULL;
4980 
4981 	/* restore this when we're done */
4982 	active_scb = ahc_inb(ahc, SCBPTR);
4983 
4984 	while (next != SCB_LIST_NULL) {
4985 		u_int scb_index;
4986 
4987 		ahc_outb(ahc, SCBPTR, next);
4988 		scb_index = ahc_inb(ahc, SCB_TAG);
4989 		if (scb_index >= ahc->scb_data->numscbs) {
4990 			panic("Disconnected List inconsistency. "
4991 			      "SCB index == %d, yet numscbs == %d.",
4992 			      scb_index, ahc->scb_data->numscbs);
4993 		}
4994 		scbp = ahc->scb_data->scbarray[scb_index];
4995 		if (ahc_match_scb(scbp, target, channel, lun, tag)) {
4996 			next = ahc_rem_scb_from_disc_list(ahc, prev,
4997 							  next);
4998 			count++;
4999 		} else {
5000 			prev = next;
5001 			next = ahc_inb(ahc, SCB_NEXT);
5002 		}
5003 	}
5004 	ahc_outb(ahc, SCBPTR, active_scb);
5005 	return (count);
5006 }
5007 
5008 static u_int
5009 ahc_rem_scb_from_disc_list(struct ahc_softc *ahc, u_int prev, u_int scbptr)
5010 {
5011 	u_int next;
5012 
5013 	ahc_outb(ahc, SCBPTR, scbptr);
5014 	next = ahc_inb(ahc, SCB_NEXT);
5015 
5016 	ahc_outb(ahc, SCB_CONTROL, 0);
5017 
5018 	ahc_add_curscb_to_free_list(ahc);
5019 
5020 	if (prev != SCB_LIST_NULL) {
5021 		ahc_outb(ahc, SCBPTR, prev);
5022 		ahc_outb(ahc, SCB_NEXT, next);
5023 	} else
5024 		ahc_outb(ahc, DISCONNECTED_SCBH, next);
5025 
5026 	return next;
5027 }
5028 
5029 static void
5030 ahc_add_curscb_to_free_list(struct ahc_softc *ahc)
5031 {
5032 	/* Invalidate the tag so that ahc_find_scb doesn't think it's active */
5033 	ahc_outb(ahc, SCB_TAG, SCB_LIST_NULL);
5034 
5035 	ahc_outb(ahc, SCB_NEXT, ahc_inb(ahc, FREE_SCBH));
5036 	ahc_outb(ahc, FREE_SCBH, ahc_inb(ahc, SCBPTR));
5037 }
5038 
5039 /*
5040  * Manipulate the waiting for selection list and return the
5041  * scb that follows the one that we remove.
5042  */
5043 static u_int
5044 ahc_abort_wscb(struct ahc_softc *ahc, u_int scbpos, u_int prev)
5045 {
5046 	u_int curscb, next;
5047 
5048 	/*
5049 	 * Select the SCB we want to abort and
5050 	 * pull the next pointer out of it.
5051 	 */
5052 	curscb = ahc_inb(ahc, SCBPTR);
5053 	ahc_outb(ahc, SCBPTR, scbpos);
5054 	next = ahc_inb(ahc, SCB_NEXT);
5055 
5056 	/* Clear the necessary fields */
5057 	ahc_outb(ahc, SCB_CONTROL, 0);
5058 
5059 	ahc_add_curscb_to_free_list(ahc);
5060 
5061 	/* update the waiting list */
5062 	if (prev == SCB_LIST_NULL) {
5063 		/* First in the list */
5064 		ahc_outb(ahc, WAITING_SCBH, next);
5065 
5066 		/*
5067 		 * Ensure we aren't attempting to perform
5068 		 * selection for this entry.
5069 		 */
5070 		ahc_outb(ahc, SCSISEQ, (ahc_inb(ahc, SCSISEQ) & ~ENSELO));
5071 	} else {
5072 		/*
5073 		 * Select the scb that pointed to us
5074 		 * and update its next pointer.
5075 		 */
5076 		ahc_outb(ahc, SCBPTR, prev);
5077 		ahc_outb(ahc, SCB_NEXT, next);
5078 	}
5079 
5080 	/*
5081 	 * Point us back at the original scb position.
5082 	 */
5083 	ahc_outb(ahc, SCBPTR, curscb);
5084 	return next;
5085 }
5086 
5087 static void
5088 ahc_clear_intstat(struct ahc_softc *ahc)
5089 {
5090 	/* Clear any interrupt conditions this may have caused */
5091 	ahc_outb(ahc, CLRSINT0, CLRSELDO|CLRSELDI|CLRSELINGO);
5092 	ahc_outb(ahc, CLRSINT1, CLRSELTIMEO|CLRATNO|CLRSCSIRSTI
5093 				|CLRBUSFREE|CLRSCSIPERR|CLRPHASECHG|
5094 				CLRREQINIT);
5095 	ahc_outb(ahc, CLRINT, CLRSCSIINT);
5096 }
5097 
5098 static void
5099 ahc_reset_current_bus(struct ahc_softc *ahc)
5100 {
5101 	u_int8_t scsiseq;
5102 
5103 	ahc_outb(ahc, SIMODE1, ahc_inb(ahc, SIMODE1) & ~ENSCSIRST);
5104 	scsiseq = ahc_inb(ahc, SCSISEQ);
5105 	ahc_outb(ahc, SCSISEQ, scsiseq | SCSIRSTO);
5106 	DELAY(AHC_BUSRESET_DELAY);
5107 	/* Turn off the bus reset */
5108 	ahc_outb(ahc, SCSISEQ, scsiseq & ~SCSIRSTO);
5109 
5110 	ahc_clear_intstat(ahc);
5111 
5112 	/* Re-enable reset interrupts */
5113 	ahc_outb(ahc, SIMODE1, ahc_inb(ahc, SIMODE1) | ENSCSIRST);
5114 }
5115 
5116 static int
5117 ahc_reset_channel(struct ahc_softc *ahc, char channel, int initiate_reset)
5118 {
5119 	u_int	  target, max_target;
5120 	int	  found;
5121 	u_int8_t  sblkctl;
5122 	char	  cur_channel;
5123 	struct	  cam_path *path;
5124 
5125 	pause_sequencer(ahc);
5126 	/*
5127 	 * Clean up all the state information for the
5128 	 * pending transactions on this bus.
5129 	 */
5130 	found = ahc_abort_scbs(ahc, CAM_TARGET_WILDCARD, channel,
5131 			       CAM_LUN_WILDCARD, SCB_LIST_NULL,
5132 			       CAM_SCSI_BUS_RESET);
5133 	path = channel == 'B' ? ahc->path_b : ahc->path;
5134 
5135 	/* Notify the XPT that a bus reset occurred */
5136 	xpt_async(AC_BUS_RESET, path, NULL);
5137 
5138 	/*
5139 	 * Revert to async/narrow transfers until we renegotiate.
5140 	 */
5141 	max_target = (ahc->features & AHC_WIDE) ? 15 : 7;
5142 	for (target = 0; target <= max_target; target++) {
5143 		struct ahc_devinfo devinfo;
5144 
5145 		ahc_compile_devinfo(&devinfo, target, CAM_LUN_WILDCARD,
5146 				    channel, ROLE_UNKNOWN);
5147 		ahc_set_width(ahc, &devinfo, path, MSG_EXT_WDTR_BUS_8_BIT,
5148 			      AHC_TRANS_CUR);
5149 		ahc_set_syncrate(ahc, &devinfo, path, /*syncrate*/NULL,
5150 				 /*period*/0, /*offset*/0, AHC_TRANS_CUR);
5151 	}
5152 
5153 	/*
5154 	 * Reset the bus if we are initiating this reset and
5155 	 * restart/unpause the sequencer
5156 	 */
5157 	sblkctl = ahc_inb(ahc, SBLKCTL);
5158 	cur_channel = 'A';
5159 	if ((ahc->features & AHC_TWIN) != 0
5160 	 && ((sblkctl & SELBUSB) != 0))
5161 	    cur_channel = 'B';
5162 	if (cur_channel != channel) {
5163 		/* Case 1: Command for another bus is active
5164 		 * Stealthily reset the other bus without
5165 		 * upsetting the current bus.
5166 		 */
5167 		ahc_outb(ahc, SBLKCTL, sblkctl ^ SELBUSB);
5168 		ahc_outb(ahc, SIMODE1, ahc_inb(ahc, SIMODE1) & ~ENBUSFREE);
5169 		ahc_outb(ahc, SCSISEQ,
5170 			 ahc_inb(ahc, SCSISEQ) & (ENSELI|ENRSELI|ENAUTOATNP));
5171 		if (initiate_reset)
5172 			ahc_reset_current_bus(ahc);
5173 		ahc_clear_intstat(ahc);
5174 		ahc_outb(ahc, SBLKCTL, sblkctl);
5175 		unpause_sequencer(ahc, /*unpause_always*/FALSE);
5176 	} else {
5177 		/* Case 2: A command from this bus is active or we're idle */
5178 		ahc_clear_msg_state(ahc);
5179 		ahc_outb(ahc, SIMODE1, ahc_inb(ahc, SIMODE1) & ~ENBUSFREE);
5180 		ahc_outb(ahc, SCSISEQ,
5181 			 ahc_inb(ahc, SCSISEQ) & (ENSELI|ENRSELI|ENAUTOATNP));
5182 		if (initiate_reset)
5183 			ahc_reset_current_bus(ahc);
5184 		ahc_clear_intstat(ahc);
5185 		restart_sequencer(ahc);
5186 	}
5187 	return found;
5188 }
5189 
5190 static int
5191 ahc_match_scb (struct scb *scb, int target, char channel, int lun, u_int tag)
5192 {
5193 	int targ = SCB_TARGET(scb);
5194 	char chan = SCB_CHANNEL(scb);
5195 	int slun = SCB_LUN(scb);
5196 	int match;
5197 
5198 	match = ((chan == channel) || (channel == ALL_CHANNELS));
5199 	if (match != 0)
5200 		match = ((targ == target) || (target == CAM_TARGET_WILDCARD));
5201 	if (match != 0)
5202 		match = ((lun == slun) || (lun == CAM_LUN_WILDCARD));
5203 	if (match != 0)
5204 		match = ((tag == scb->hscb->tag) || (tag == SCB_LIST_NULL));
5205 
5206 	return match;
5207 }
5208 
5209 static void
5210 ahc_construct_sdtr(struct ahc_softc *ahc, u_int period, u_int offset)
5211 {
5212 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXTENDED;
5213 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXT_SDTR_LEN;
5214 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXT_SDTR;
5215 	ahc->msgout_buf[ahc->msgout_index++] = period;
5216 	ahc->msgout_buf[ahc->msgout_index++] = offset;
5217 	ahc->msgout_len += 5;
5218 }
5219 
5220 static void
5221 ahc_construct_wdtr(struct ahc_softc *ahc, u_int bus_width)
5222 {
5223 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXTENDED;
5224 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXT_WDTR_LEN;
5225 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXT_WDTR;
5226 	ahc->msgout_buf[ahc->msgout_index++] = bus_width;
5227 	ahc->msgout_len += 4;
5228 }
5229 
5230 static void
5231 ahc_calc_residual(struct scb *scb)
5232 {
5233 	struct	hardware_scb *hscb;
5234 
5235 	hscb = scb->hscb;
5236 
5237 	/*
5238 	 * If the disconnected flag is still set, this is bogus
5239 	 * residual information left over from a sequencer
5240 	 * pagin/pageout, so ignore this case.
5241 	 */
5242 	if ((scb->hscb->control & DISCONNECTED) == 0) {
5243 		u_int32_t resid;
5244 		int	  resid_sgs;
5245 		int	  sg;
5246 
5247 		/*
5248 		 * Remainder of the SG where the transfer
5249 		 * stopped.
5250 		 */
5251 		resid = (hscb->residual_data_count[2] << 16)
5252 		      |	(hscb->residual_data_count[1] <<8)
5253 		      |	(hscb->residual_data_count[0]);
5254 
5255 		/*
5256 		 * Add up the contents of all residual
5257 		 * SG segments that are after the SG where
5258 		 * the transfer stopped.
5259 		 */
5260 		resid_sgs = scb->hscb->residual_SG_count - 1/*current*/;
5261 		sg = scb->sg_count - resid_sgs - 1/*first SG*/;
5262 		while (resid_sgs > 0) {
5263 
5264 			resid += scb->ahc_dma[sg].len;
5265 			sg++;
5266 			resid_sgs--;
5267 		}
5268 		if ((scb->flags & SCB_SENSE) == 0) {
5269 
5270 			scb->ccb->csio.resid = resid;
5271 		} else {
5272 
5273 			scb->ccb->csio.sense_resid = resid;
5274 		}
5275 	}
5276 
5277 	/*
5278 	 * Clean out the residual information in this SCB for its
5279 	 * next consumer.
5280 	 */
5281 	hscb->residual_data_count[0] = 0;
5282 	hscb->residual_data_count[1] = 0;
5283 	hscb->residual_data_count[2] = 0;
5284 	hscb->residual_SG_count = 0;
5285 
5286 #ifdef AHC_DEBUG
5287 	if (ahc_debug & AHC_SHOWMISC) {
5288 		sc_print_addr(xs->sc_link);
5289 		printf("Handled Residual of %ld bytes\n" ,xs->resid);
5290 	}
5291 #endif
5292 }
5293 
5294 static void
5295 ahc_update_pending_syncrates(struct ahc_softc *ahc)
5296 {
5297 	/*
5298 	 * Traverse the pending SCB list and ensure that all of the
5299 	 * SCBs there have the proper settings.
5300 	 */
5301 	struct	ccb_hdr *ccbh;
5302 	int	pending_ccb_count;
5303 	int	i;
5304 	u_int	saved_scbptr;
5305 
5306 	/*
5307 	 * We were able to complete the command successfully,
5308 	 * so reinstate the timeouts for all other pending
5309 	 * commands.
5310 	 */
5311 	ccbh = LIST_FIRST(&ahc->pending_ccbs);
5312 	pending_ccb_count = 0;
5313 	while (ccbh != NULL) {
5314 		struct scb *pending_scb;
5315 		struct hardware_scb *pending_hscb;
5316 		struct ahc_target_tinfo *tinfo;
5317 		struct ahc_devinfo devinfo;
5318 
5319 		pending_scb = (struct scb *)ccbh->ccb_scb_ptr;
5320 		pending_hscb = pending_scb->hscb;
5321 		ahc_compile_devinfo(&devinfo, SCB_TARGET(pending_scb),
5322 				    SCB_LUN(pending_scb),
5323 				    SCB_CHANNEL(pending_scb),
5324 				    ROLE_UNKNOWN);
5325 		tinfo = &ahc->transinfo[devinfo.target_offset];
5326 		pending_hscb->control &= ~ULTRAENB;
5327 		if ((ahc->ultraenb & devinfo.target_mask) != 0)
5328 			pending_hscb->control |= ULTRAENB;
5329 		pending_hscb->scsirate = tinfo->scsirate;
5330 		pending_hscb->scsioffset = tinfo->current.offset;
5331 		pending_ccb_count++;
5332 		ccbh = LIST_NEXT(ccbh, sim_links.le);
5333 	}
5334 
5335 	if (pending_ccb_count == 0)
5336 		return;
5337 
5338 	saved_scbptr = ahc_inb(ahc, SCBPTR);
5339 	/* Ensure that the hscbs down on the card match the new information */
5340 	for (i = 0; i < ahc->scb_data->maxhscbs; i++) {
5341 		u_int scb_tag;
5342 
5343 		ahc_outb(ahc, SCBPTR, i);
5344 		scb_tag = ahc_inb(ahc, SCB_TAG);
5345 		if (scb_tag != SCB_LIST_NULL) {
5346 			struct	scb *pending_scb;
5347 			struct	hardware_scb *pending_hscb;
5348 			struct	ahc_target_tinfo *tinfo;
5349 			struct	ahc_devinfo devinfo;
5350 			u_int	control;
5351 
5352 			pending_scb = ahc->scb_data->scbarray[scb_tag];
5353 			pending_hscb = pending_scb->hscb;
5354 			ahc_compile_devinfo(&devinfo, SCB_TARGET(pending_scb),
5355 					    SCB_LUN(pending_scb),
5356 					    SCB_CHANNEL(pending_scb),
5357 					    ROLE_UNKNOWN);
5358 			tinfo = &ahc->transinfo[devinfo.target_offset];
5359 			control = ahc_inb(ahc, SCB_CONTROL);
5360 			control &= ~ULTRAENB;
5361 			if ((ahc->ultraenb & devinfo.target_mask) != 0)
5362 				control |= ULTRAENB;
5363 			ahc_outb(ahc, SCB_CONTROL, control);
5364 			ahc_outb(ahc, SCB_SCSIRATE, tinfo->scsirate);
5365 			ahc_outb(ahc, SCB_SCSIOFFSET, tinfo->current.offset);
5366 		}
5367 	}
5368 	ahc_outb(ahc, SCBPTR, saved_scbptr);
5369 }
5370 
5371 #if UNUSED
5372 static void
5373 ahc_dump_targcmd(struct target_cmd *cmd)
5374 {
5375 	u_int8_t *byte;
5376 	u_int8_t *last_byte;
5377 	int i;
5378 
5379 	byte = &cmd->initiator_channel;
5380 	/* Debugging info for received commands */
5381 	last_byte = &cmd[1].initiator_channel;
5382 
5383 	i = 0;
5384 	while (byte < last_byte) {
5385 		if (i == 0)
5386 			printf("\t");
5387 		printf("%#x", *byte++);
5388 		i++;
5389 		if (i == 8) {
5390 			printf("\n");
5391 			i = 0;
5392 		} else {
5393 			printf(", ");
5394 		}
5395 	}
5396 }
5397 #endif
5398 
5399 static void
5400 ahc_shutdown(int howto, void *arg)
5401 {
5402 	struct	ahc_softc *ahc;
5403 	int	i;
5404 
5405 	ahc = (struct ahc_softc *)arg;
5406 
5407 	ahc_reset(ahc);
5408 	ahc_outb(ahc, SCSISEQ, 0);
5409 	ahc_outb(ahc, SXFRCTL0, 0);
5410 	ahc_outb(ahc, DSPCISTATUS, 0);
5411 
5412 	for (i = TARG_SCSIRATE; i < HA_274_BIOSCTRL; i++)
5413 		ahc_outb(ahc, i, 0);
5414 }
5415