xref: /freebsd/sys/dev/aic7xxx/aic7xxx.c (revision 4cf49a43559ed9fdad601bdcccd2c55963008675)
1 /*
2  * Generic driver for the aic7xxx based adaptec SCSI controllers
3  * Product specific probe and attach routines can be found in:
4  * i386/eisa/ahc_eisa.c	27/284X and aic7770 motherboard controllers
5  * pci/ahc_pci.c	3985, 3980, 3940, 2940, aic7895, aic7890,
6  *			aic7880, aic7870, aic7860, and aic7850 controllers
7  *
8  * Copyright (c) 1994, 1995, 1996, 1997, 1998, 1999 Justin T. Gibbs.
9  * All rights reserved.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions, and the following disclaimer,
16  *    without modification, immediately at the beginning of the file.
17  * 2. The name of the author may not be used to endorse or promote products
18  *    derived from this software without specific prior written permission.
19  *
20  * Where this Software is combined with software released under the terms of
21  * the GNU Public License ("GPL") and the terms of the GPL would require the
22  * combined work to also be released under the terms of the GPL, the terms
23  * and conditions of this License will apply in addition to those of the
24  * GPL with the exception of any terms or conditions of this License that
25  * conflict with, or are expressly prohibited by, the GPL.
26  *
27  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
28  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
29  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
30  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
31  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
32  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
33  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
34  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
35  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
36  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
37  * SUCH DAMAGE.
38  *
39  * $FreeBSD$
40  */
41 /*
42  * A few notes on features of the driver.
43  *
44  * SCB paging takes advantage of the fact that devices stay disconnected
45  * from the bus a relatively long time and that while they're disconnected,
46  * having the SCBs for these transactions down on the host adapter is of
47  * little use.  Instead of leaving this idle SCB down on the card we copy
48  * it back up into kernel memory and reuse the SCB slot on the card to
49  * schedule another transaction.  This can be a real payoff when doing random
50  * I/O to tagged queueing devices since there are more transactions active at
51  * once for the device to sort for optimal seek reduction. The algorithm goes
52  * like this...
53  *
54  * The sequencer maintains two lists of its hardware SCBs.  The first is the
55  * singly linked free list which tracks all SCBs that are not currently in
56  * use.  The second is the doubly linked disconnected list which holds the
57  * SCBs of transactions that are in the disconnected state sorted most
58  * recently disconnected first.  When the kernel queues a transaction to
59  * the card, a hardware SCB to "house" this transaction is retrieved from
60  * either of these two lists.  If the SCB came from the disconnected list,
61  * a check is made to see if any data transfer or SCB linking (more on linking
62  * in a bit) information has been changed since it was copied from the host
63  * and if so, DMAs the SCB back up before it can be used.  Once a hardware
64  * SCB has been obtained, the SCB is DMAed from the host.  Before any work
65  * can begin on this SCB, the sequencer must ensure that either the SCB is
66  * for a tagged transaction or the target is not already working on another
67  * non-tagged transaction.  If a conflict arises in the non-tagged case, the
68  * sequencer finds the SCB for the active transactions and sets the SCB_LINKED
69  * field in that SCB to this next SCB to execute.  To facilitate finding
70  * active non-tagged SCBs, the last four bytes of up to the first four hardware
71  * SCBs serve as a storage area for the currently active SCB ID for each
72  * target.
73  *
74  * When a device reconnects, a search is made of the hardware SCBs to find
75  * the SCB for this transaction.  If the search fails, a hardware SCB is
76  * pulled from either the free or disconnected SCB list and the proper
77  * SCB is DMAed from the host.  If the MK_MESSAGE control bit is set
78  * in the control byte of the SCB while it was disconnected, the sequencer
79  * will assert ATN and attempt to issue a message to the host.
80  *
81  * When a command completes, a check for non-zero status and residuals is
82  * made.  If either of these conditions exists, the SCB is DMAed back up to
83  * the host so that it can interpret this information.  Additionally, in the
84  * case of bad status, the sequencer generates a special interrupt and pauses
85  * itself.  This allows the host to setup a request sense command if it
86  * chooses for this target synchronously with the error so that sense
87  * information isn't lost.
88  *
89  */
90 
91 #include <opt_aic7xxx.h>
92 
93 #include <pci.h>
94 #include <stddef.h>	/* For offsetof */
95 
96 #include <sys/param.h>
97 #include <sys/systm.h>
98 #include <sys/malloc.h>
99 #include <sys/eventhandler.h>
100 #include <sys/buf.h>
101 #include <sys/proc.h>
102 
103 #include <cam/cam.h>
104 #include <cam/cam_ccb.h>
105 #include <cam/cam_sim.h>
106 #include <cam/cam_xpt_sim.h>
107 #include <cam/cam_debug.h>
108 
109 #include <cam/scsi/scsi_all.h>
110 #include <cam/scsi/scsi_message.h>
111 
112 #if NPCI > 0
113 #include <machine/bus_memio.h>
114 #endif
115 #include <machine/bus_pio.h>
116 #include <machine/bus.h>
117 #include <machine/clock.h>
118 #include <sys/rman.h>
119 
120 #include <vm/vm.h>
121 #include <vm/vm_param.h>
122 #include <vm/pmap.h>
123 
124 #include <dev/aic7xxx/aic7xxx.h>
125 #include <dev/aic7xxx/sequencer.h>
126 
127 #include <aic7xxx_reg.h>
128 #include <aic7xxx_seq.h>
129 
130 #include <sys/kernel.h>
131 
132 #ifndef AHC_TMODE_ENABLE
133 #define AHC_TMODE_ENABLE 0
134 #endif
135 
136 #define MAX(a,b) (((a) > (b)) ? (a) : (b))
137 #define MIN(a,b) (((a) < (b)) ? (a) : (b))
138 #define ALL_CHANNELS '\0'
139 #define ALL_TARGETS_MASK 0xFFFF
140 #define INITIATOR_WILDCARD	(~0)
141 
142 #define	SIM_IS_SCSIBUS_B(ahc, sim)	\
143 	((sim) == ahc->sim_b)
144 #define	SIM_CHANNEL(ahc, sim)	\
145 	(((sim) == ahc->sim_b) ? 'B' : 'A')
146 #define	SIM_SCSI_ID(ahc, sim)	\
147 	(((sim) == ahc->sim_b) ? ahc->our_id_b : ahc->our_id)
148 #define	SIM_PATH(ahc, sim)	\
149 	(((sim) == ahc->sim_b) ? ahc->path_b : ahc->path)
150 #define	SCB_IS_SCSIBUS_B(scb)	\
151 	(((scb)->hscb->tcl & SELBUSB) != 0)
152 #define	SCB_TARGET(scb)	\
153 	(((scb)->hscb->tcl & TID) >> 4)
154 #define	SCB_CHANNEL(scb) \
155 	(SCB_IS_SCSIBUS_B(scb) ? 'B' : 'A')
156 #define	SCB_LUN(scb)	\
157 	((scb)->hscb->tcl & LID)
158 #define SCB_TARGET_OFFSET(scb)		\
159 	(SCB_TARGET(scb) + (SCB_IS_SCSIBUS_B(scb) ? 8 : 0))
160 #define SCB_TARGET_MASK(scb)		\
161 	(0x01 << (SCB_TARGET_OFFSET(scb)))
162 #define TCL_CHANNEL(ahc, tcl)		\
163 	((((ahc)->features & AHC_TWIN) && ((tcl) & SELBUSB)) ? 'B' : 'A')
164 #define TCL_SCSI_ID(ahc, tcl)		\
165 	(TCL_CHANNEL((ahc), (tcl)) == 'B' ? (ahc)->our_id_b : (ahc)->our_id)
166 #define TCL_TARGET(tcl) (((tcl) & TID) >> TCL_TARGET_SHIFT)
167 #define TCL_LUN(tcl) ((tcl) & LID)
168 
169 #define ccb_scb_ptr spriv_ptr0
170 #define ccb_ahc_ptr spriv_ptr1
171 
172 typedef enum {
173 	ROLE_UNKNOWN,
174 	ROLE_INITIATOR,
175 	ROLE_TARGET
176 } role_t;
177 
178 struct ahc_devinfo {
179 	int	  our_scsiid;
180 	int	  target_offset;
181 	u_int16_t target_mask;
182 	u_int8_t  target;
183 	u_int8_t  lun;
184 	char	  channel;
185 	role_t	  role;		/*
186 				 * Only guaranteed to be correct if not
187 				 * in the busfree state.
188 				 */
189 };
190 
191 typedef enum {
192 	SEARCH_COMPLETE,
193 	SEARCH_COUNT,
194 	SEARCH_REMOVE
195 } ahc_search_action;
196 
197 #ifdef AHC_DEBUG
198 static int     ahc_debug = AHC_DEBUG;
199 #endif
200 
201 #if NPCI > 0
202 void ahc_pci_intr(struct ahc_softc *ahc);
203 #endif
204 
205 static int	ahcinitscbdata(struct ahc_softc *ahc);
206 static void	ahcfiniscbdata(struct ahc_softc *ahc);
207 
208 static bus_dmamap_callback_t	ahcdmamapcb;
209 
210 #if UNUSED
211 static void	ahc_dump_targcmd(struct target_cmd *cmd);
212 #endif
213 static void	ahc_shutdown(void *arg, int howto);
214 static cam_status
215 		ahc_find_tmode_devs(struct ahc_softc *ahc,
216 				    struct cam_sim *sim, union ccb *ccb,
217 				    struct tmode_tstate **tstate,
218 				    struct tmode_lstate **lstate,
219 				    int notfound_failure);
220 static void	ahc_action(struct cam_sim *sim, union ccb *ccb);
221 static void	ahc_async(void *callback_arg, u_int32_t code,
222 			  struct cam_path *path, void *arg);
223 static void	ahc_execute_scb(void *arg, bus_dma_segment_t *dm_segs,
224 				int nsegments, int error);
225 static void	ahc_poll(struct cam_sim *sim);
226 static void	ahc_setup_data(struct ahc_softc *ahc,
227 			       struct ccb_scsiio *csio, struct scb *scb);
228 static void	ahc_freeze_devq(struct ahc_softc *ahc, struct cam_path *path);
229 static void	ahcallocscbs(struct ahc_softc *ahc);
230 static void	ahc_scb_devinfo(struct ahc_softc *ahc,
231 				struct ahc_devinfo *devinfo,
232 				struct scb *scb);
233 static void	ahc_fetch_devinfo(struct ahc_softc *ahc,
234 				  struct ahc_devinfo *devinfo);
235 static void	ahc_compile_devinfo(struct ahc_devinfo *devinfo, u_int our_id,
236 				    u_int target, u_int lun, char channel,
237 				    role_t role);
238 static u_int	ahc_abort_wscb(struct ahc_softc *ahc, u_int scbpos, u_int prev);
239 static void	ahc_done(struct ahc_softc *ahc, struct scb *scbp);
240 static struct tmode_tstate *
241 		ahc_alloc_tstate(struct ahc_softc *ahc,
242 				 u_int scsi_id, char channel);
243 static void	ahc_free_tstate(struct ahc_softc *ahc,
244 				u_int scsi_id, char channel, int force);
245 static void	ahc_handle_en_lun(struct ahc_softc *ahc, struct cam_sim *sim,
246 				  union ccb *ccb);
247 static int	ahc_handle_target_cmd(struct ahc_softc *ahc,
248 				      struct target_cmd *cmd);
249 static void 	ahc_handle_seqint(struct ahc_softc *ahc, u_int intstat);
250 static void	ahc_handle_scsiint(struct ahc_softc *ahc, u_int intstat);
251 static void	ahc_build_transfer_msg(struct ahc_softc *ahc,
252 				       struct ahc_devinfo *devinfo);
253 static void	ahc_setup_initiator_msgout(struct ahc_softc *ahc,
254 					   struct ahc_devinfo *devinfo,
255 					   struct scb *scb);
256 static void	ahc_setup_target_msgin(struct ahc_softc *ahc,
257 				       struct ahc_devinfo *devinfo);
258 static int	ahc_handle_msg_reject(struct ahc_softc *ahc,
259 				      struct ahc_devinfo *devinfo);
260 static void	ahc_clear_msg_state(struct ahc_softc *ahc);
261 static void	ahc_handle_message_phase(struct ahc_softc *ahc,
262 					 struct cam_path *path);
263 static int	ahc_sent_msg(struct ahc_softc *ahc, u_int msgtype, int full);
264 typedef enum {
265 	MSGLOOP_IN_PROG,
266 	MSGLOOP_MSGCOMPLETE,
267 	MSGLOOP_TERMINATED
268 } msg_loop_stat;
269 static int ahc_parse_msg(struct ahc_softc *ahc, struct cam_path *path,
270 				   struct ahc_devinfo *devinfo);
271 static void	ahc_handle_ign_wide_residue(struct ahc_softc *ahc,
272 					    struct ahc_devinfo *devinfo);
273 static void	ahc_handle_devreset(struct ahc_softc *ahc,
274 				    struct ahc_devinfo *devinfo,
275 				    cam_status status, ac_code acode,
276 				    char *message,
277 				    int verbose_only);
278 static void	ahc_loadseq(struct ahc_softc *ahc);
279 static int	ahc_check_patch(struct ahc_softc *ahc,
280 				struct patch **start_patch,
281 				int start_instr, int *skip_addr);
282 static void	ahc_download_instr(struct ahc_softc *ahc,
283 				   int instrptr, u_int8_t *dconsts);
284 static int	ahc_match_scb(struct scb *scb, int target, char channel,
285 			      int lun, u_int tag, role_t role);
286 #ifdef AHC_DEBUG
287 static void	ahc_print_scb(struct scb *scb);
288 #endif
289 static int	ahc_search_qinfifo(struct ahc_softc *ahc, int target,
290 				   char channel, int lun, u_int tag,
291 				   role_t role, u_int32_t status,
292 				   ahc_search_action action);
293 static void	ahc_abort_ccb(struct ahc_softc *ahc, struct cam_sim *sim,
294 			      union ccb *ccb);
295 static int	ahc_reset_channel(struct ahc_softc *ahc, char channel,
296 				  int initiate_reset);
297 static int	ahc_abort_scbs(struct ahc_softc *ahc, int target,
298 			       char channel, int lun, u_int tag, role_t role,
299 			       u_int32_t status);
300 static int	ahc_search_disc_list(struct ahc_softc *ahc, int target,
301 				     char channel, int lun, u_int tag);
302 static u_int	ahc_rem_scb_from_disc_list(struct ahc_softc *ahc,
303 					   u_int prev, u_int scbptr);
304 static void	ahc_add_curscb_to_free_list(struct ahc_softc *ahc);
305 static void	ahc_clear_intstat(struct ahc_softc *ahc);
306 static void	ahc_reset_current_bus(struct ahc_softc *ahc);
307 static struct ahc_syncrate *
308 		ahc_devlimited_syncrate(struct ahc_softc *ahc, u_int *period);
309 static struct ahc_syncrate *
310 		ahc_find_syncrate(struct ahc_softc *ahc, u_int *period,
311 				  u_int maxsync);
312 static u_int	ahc_find_period(struct ahc_softc *ahc, u_int scsirate,
313 				u_int maxsync);
314 static void	ahc_validate_offset(struct ahc_softc *ahc,
315 				    struct ahc_syncrate *syncrate,
316 				    u_int *offset, int wide);
317 static void	ahc_update_target_msg_request(struct ahc_softc *ahc,
318 					      struct ahc_devinfo *devinfo,
319 					      struct ahc_initiator_tinfo *tinfo,
320 					      int force, int paused);
321 static int	ahc_create_path(struct ahc_softc *ahc,
322 				struct ahc_devinfo *devinfo,
323 				struct cam_path **path);
324 static void	ahc_set_syncrate(struct ahc_softc *ahc,
325 				 struct ahc_devinfo *devinfo,
326 				 struct cam_path *path,
327 				 struct ahc_syncrate *syncrate,
328 				 u_int period, u_int offset, u_int type,
329 				 int paused);
330 static void	ahc_set_width(struct ahc_softc *ahc,
331 			      struct ahc_devinfo *devinfo,
332 			      struct cam_path *path, u_int width, u_int type,
333 			      int paused);
334 static void	ahc_set_tags(struct ahc_softc *ahc,
335 			     struct ahc_devinfo *devinfo,
336 			     int enable);
337 static void	ahc_construct_sdtr(struct ahc_softc *ahc,
338 				   u_int period, u_int offset);
339 
340 static void	ahc_construct_wdtr(struct ahc_softc *ahc, u_int bus_width);
341 
342 static void	ahc_calc_residual(struct scb *scb);
343 
344 static void	ahc_update_pending_syncrates(struct ahc_softc *ahc);
345 
346 static void	ahc_set_recoveryscb(struct ahc_softc *ahc, struct scb *scb);
347 
348 static timeout_t
349 		ahc_timeout;
350 static void	ahc_queue_lstate_event(struct ahc_softc *ahc,
351 				       struct tmode_lstate *lstate,
352 				       u_int initiator_id, u_int event_type,
353 				       u_int event_arg);
354 static void	ahc_send_lstate_events(struct ahc_softc *ahc,
355 				       struct tmode_lstate *lstate);
356 static __inline int  sequencer_paused(struct ahc_softc *ahc);
357 static __inline void pause_sequencer(struct ahc_softc *ahc);
358 static __inline void unpause_sequencer(struct ahc_softc *ahc,
359 				       int unpause_always);
360 static __inline void restart_sequencer(struct ahc_softc *ahc);
361 static __inline u_int ahc_index_busy_tcl(struct ahc_softc *ahc,
362 					 u_int tcl, int unbusy);
363 
364 static __inline void	 ahc_busy_tcl(struct ahc_softc *ahc, struct scb *scb);
365 
366 static __inline void	   ahc_freeze_ccb(union ccb* ccb);
367 static __inline cam_status ahc_ccb_status(union ccb* ccb);
368 static __inline void	   ahcsetccbstatus(union ccb* ccb,
369 					   cam_status status);
370 static __inline void	   ahc_run_tqinfifo(struct ahc_softc *ahc);
371 static __inline void	   ahc_run_qoutfifo(struct ahc_softc *ahc);
372 
373 static __inline struct ahc_initiator_tinfo *
374 			   ahc_fetch_transinfo(struct ahc_softc *ahc,
375 					       char channel,
376 					       u_int our_id, u_int target,
377 					       struct tmode_tstate **tstate);
378 static __inline void
379 		ahcfreescb(struct ahc_softc *ahc, struct scb *scb);
380 static __inline struct scb *
381 		ahcgetscb(struct ahc_softc *ahc);
382 
383 static __inline u_int32_t
384 ahc_hscb_busaddr(struct ahc_softc *ahc, u_int index)
385 {
386 	return (ahc->scb_data->hscb_busaddr
387 		+ (sizeof(struct hardware_scb) * index));
388 }
389 
390 #define AHC_BUSRESET_DELAY	25	/* Reset delay in us */
391 
392 static __inline int
393 sequencer_paused(struct ahc_softc *ahc)
394 {
395 	return ((ahc_inb(ahc, HCNTRL) & PAUSE) != 0);
396 }
397 
398 static __inline void
399 pause_sequencer(struct ahc_softc *ahc)
400 {
401 	ahc_outb(ahc, HCNTRL, ahc->pause);
402 
403 	/*
404 	 * Since the sequencer can disable pausing in a critical section, we
405 	 * must loop until it actually stops.
406 	 */
407 	while (sequencer_paused(ahc) == 0)
408 		;
409 }
410 
411 static __inline void
412 unpause_sequencer(struct ahc_softc *ahc, int unpause_always)
413 {
414 	if (unpause_always
415 	 || (ahc_inb(ahc, INTSTAT) & (SCSIINT | SEQINT | BRKADRINT)) == 0)
416 		ahc_outb(ahc, HCNTRL, ahc->unpause);
417 }
418 
419 /*
420  * Restart the sequencer program from address zero
421  */
422 static __inline void
423 restart_sequencer(struct ahc_softc *ahc)
424 {
425 	pause_sequencer(ahc);
426 	ahc_outb(ahc, SEQCTL, FASTMODE|SEQRESET);
427 	unpause_sequencer(ahc, /*unpause_always*/TRUE);
428 }
429 
430 static __inline u_int
431 ahc_index_busy_tcl(struct ahc_softc *ahc, u_int tcl, int unbusy)
432 {
433 	u_int scbid;
434 
435 	scbid = ahc->untagged_scbs[tcl];
436 	if (unbusy)
437 		ahc->untagged_scbs[tcl] = SCB_LIST_NULL;
438 
439 	return (scbid);
440 }
441 
442 static __inline void
443 ahc_busy_tcl(struct ahc_softc *ahc, struct scb *scb)
444 {
445 	ahc->untagged_scbs[scb->hscb->tcl] = scb->hscb->tag;
446 }
447 
448 static __inline void
449 ahc_freeze_ccb(union ccb* ccb)
450 {
451 	if ((ccb->ccb_h.status & CAM_DEV_QFRZN) == 0) {
452 		ccb->ccb_h.status |= CAM_DEV_QFRZN;
453 		xpt_freeze_devq(ccb->ccb_h.path, /*count*/1);
454 	}
455 }
456 
457 static __inline cam_status
458 ahc_ccb_status(union ccb* ccb)
459 {
460 	return (ccb->ccb_h.status & CAM_STATUS_MASK);
461 }
462 
463 static __inline void
464 ahcsetccbstatus(union ccb* ccb, cam_status status)
465 {
466 	ccb->ccb_h.status &= ~CAM_STATUS_MASK;
467 	ccb->ccb_h.status |= status;
468 }
469 
470 static __inline struct ahc_initiator_tinfo *
471 ahc_fetch_transinfo(struct ahc_softc *ahc, char channel, u_int our_id,
472 		    u_int remote_id, struct tmode_tstate **tstate)
473 {
474 	/*
475 	 * Transfer data structures are stored from the perspective
476 	 * of the target role.  Since the parameters for a connection
477 	 * in the initiator role to a given target are the same as
478 	 * when the roles are reversed, we pretend we are the target.
479 	 */
480 	if (channel == 'B')
481 		our_id += 8;
482 	*tstate = ahc->enabled_targets[our_id];
483 	return (&(*tstate)->transinfo[remote_id]);
484 }
485 
486 static __inline void
487 ahc_run_tqinfifo(struct ahc_softc *ahc)
488 {
489 	struct target_cmd *cmd;
490 
491 	while ((cmd = &ahc->targetcmds[ahc->tqinfifonext])->cmd_valid != 0) {
492 
493 		/*
494 		 * Only advance through the queue if we
495 		 * had the resources to process the command.
496 		 */
497 		if (ahc_handle_target_cmd(ahc, cmd) != 0)
498 			break;
499 
500 		ahc->tqinfifonext++;
501 		cmd->cmd_valid = 0;
502 
503 		/*
504 		 * Lazily update our position in the target mode incomming
505 		 * command queue as seen by the sequencer.
506 		 */
507 		if ((ahc->tqinfifonext & (TQINFIFO_UPDATE_CNT-1)) == 0) {
508 			pause_sequencer(ahc);
509 			ahc_outb(ahc, KERNEL_TQINPOS, ahc->tqinfifonext - 1);
510 			unpause_sequencer(ahc, /*unpause_always*/FALSE);
511 		}
512 	}
513 }
514 
515 static __inline void
516 ahc_run_qoutfifo(struct ahc_softc *ahc)
517 {
518 	struct scb *scb;
519 	u_int  scb_index;
520 
521 	while (ahc->qoutfifo[ahc->qoutfifonext] != SCB_LIST_NULL) {
522 		scb_index = ahc->qoutfifo[ahc->qoutfifonext];
523 		ahc->qoutfifo[ahc->qoutfifonext++] = SCB_LIST_NULL;
524 
525 		scb = &ahc->scb_data->scbarray[scb_index];
526 		if (scb_index >= ahc->scb_data->numscbs
527 		  || (scb->flags & SCB_ACTIVE) == 0) {
528 			printf("%s: WARNING no command for scb %d "
529 			       "(cmdcmplt)\nQOUTPOS = %d\n",
530 			       ahc_name(ahc), scb_index,
531 			       ahc->qoutfifonext - 1);
532 			continue;
533 		}
534 
535 		/*
536 		 * Save off the residual
537 		 * if there is one.
538 		 */
539 		if (scb->hscb->residual_SG_count != 0)
540 			ahc_calc_residual(scb);
541 		else
542 			scb->ccb->csio.resid = 0;
543 		ahc_done(ahc, scb);
544 	}
545 }
546 
547 
548 /*
549  * An scb (and hence an scb entry on the board) is put onto the
550  * free list.
551  */
552 static __inline void
553 ahcfreescb(struct ahc_softc *ahc, struct scb *scb)
554 {
555 	struct hardware_scb *hscb;
556 	int opri;
557 
558 	hscb = scb->hscb;
559 
560 	opri = splcam();
561 
562 	if ((ahc->flags & AHC_RESOURCE_SHORTAGE) != 0
563 	 && (scb->ccb->ccb_h.status & CAM_RELEASE_SIMQ) == 0) {
564 		scb->ccb->ccb_h.status |= CAM_RELEASE_SIMQ;
565 		ahc->flags &= ~AHC_RESOURCE_SHORTAGE;
566 	}
567 
568 	/* Clean up for the next user */
569 	scb->flags = SCB_FREE;
570 	hscb->control = 0;
571 	hscb->status = 0;
572 
573 	SLIST_INSERT_HEAD(&ahc->scb_data->free_scbs, scb, links);
574 	splx(opri);
575 }
576 
577 /*
578  * Get a free scb, either one already assigned to a hardware slot
579  * on the adapter or one that will require an SCB to be paged out before
580  * use. If there are none, see if we can allocate a new SCB.  Otherwise
581  * either return an error or sleep.
582  */
583 static __inline struct scb *
584 ahcgetscb(struct ahc_softc *ahc)
585 {
586 	struct scb *scbp;
587 	int opri;
588 
589 	opri = splcam();
590 	if ((scbp = SLIST_FIRST(&ahc->scb_data->free_scbs))) {
591 		SLIST_REMOVE_HEAD(&ahc->scb_data->free_scbs, links);
592 	} else {
593 		ahcallocscbs(ahc);
594 		scbp = SLIST_FIRST(&ahc->scb_data->free_scbs);
595 		if (scbp != NULL)
596 			SLIST_REMOVE_HEAD(&ahc->scb_data->free_scbs, links);
597 	}
598 
599 	splx(opri);
600 
601 	return (scbp);
602 }
603 
604 char *
605 ahc_name(struct ahc_softc *ahc)
606 {
607 	static char name[10];
608 
609 	snprintf(name, sizeof(name), "ahc%d", ahc->unit);
610 	return (name);
611 }
612 
613 #ifdef  AHC_DEBUG
614 static void
615 ahc_print_scb(struct scb *scb)
616 {
617 	struct hardware_scb *hscb = scb->hscb;
618 
619 	printf("scb:%p control:0x%x tcl:0x%x cmdlen:%d cmdpointer:0x%lx\n",
620 		scb,
621 		hscb->control,
622 		hscb->tcl,
623 		hscb->cmdlen,
624 		hscb->cmdpointer );
625 	printf("        datlen:%d data:0x%lx segs:0x%x segp:0x%lx\n",
626 		hscb->datalen,
627 		hscb->data,
628 		hscb->SG_count,
629 		hscb->SG_pointer);
630 	printf("	sg_addr:%lx sg_len:%ld\n",
631 		scb->sg_list[0].addr,
632 		scb->sg_list[0].len);
633 	printf("	cdb:%x %x %x %x %x %x %x %x %x %x %x %x\n",
634 		hscb->cmdstore[0], hscb->cmdstore[1], hscb->cmdstore[2],
635 		hscb->cmdstore[3], hscb->cmdstore[4], hscb->cmdstore[5],
636 		hscb->cmdstore[6], hscb->cmdstore[7], hscb->cmdstore[8],
637 		hscb->cmdstore[9], hscb->cmdstore[10], hscb->cmdstore[11]);
638 }
639 #endif
640 
641 static struct {
642         u_int8_t errno;
643 	char *errmesg;
644 } hard_error[] = {
645 	{ ILLHADDR,	"Illegal Host Access" },
646 	{ ILLSADDR,	"Illegal Sequencer Address referrenced" },
647 	{ ILLOPCODE,	"Illegal Opcode in sequencer program" },
648 	{ SQPARERR,	"Sequencer Parity Error" },
649 	{ DPARERR,	"Data-path Parity Error" },
650 	{ MPARERR,	"Scratch or SCB Memory Parity Error" },
651 	{ PCIERRSTAT,	"PCI Error detected" },
652 	{ CIOPARERR,	"CIOBUS Parity Error" },
653 };
654 
655 
656 /*
657  * Valid SCSIRATE values.  (p. 3-17)
658  * Provides a mapping of tranfer periods in ns to the proper value to
659  * stick in the scsiscfr reg to use that transfer rate.
660  */
661 #define AHC_SYNCRATE_ULTRA2	0
662 #define AHC_SYNCRATE_ULTRA	2
663 #define AHC_SYNCRATE_FAST	5
664 static struct ahc_syncrate ahc_syncrates[] = {
665 	/* ultra2  fast/ultra  period	rate */
666 	{ 0x13,   0x000,	10,	"40.0"	},
667 	{ 0x14,   0x000,	11,	"33.0"	},
668 	{ 0x15,   0x100,	12,	"20.0"	},
669 	{ 0x16,   0x110,	15,	"16.0"	},
670 	{ 0x17,   0x120,	18,	"13.4"	},
671 	{ 0x18,   0x000,	25,	"10.0"	},
672 	{ 0x19,   0x010,	31,	"8.0"	},
673 	{ 0x1a,   0x020,	37,	"6.67"	},
674 	{ 0x1b,   0x030,	43,	"5.7"	},
675 	{ 0x10,   0x040,	50,	"5.0"	},
676 	{ 0x00,   0x050,	56,	"4.4"	},
677 	{ 0x00,   0x060,	62,	"4.0"	},
678 	{ 0x00,   0x070,	68,	"3.6"	},
679 	{ 0x00,   0x000,	0,	NULL	}
680 };
681 
682 /*
683  * Allocate a controller structure for a new device and initialize it.
684  */
685 struct ahc_softc *
686 ahc_alloc(device_t dev, struct resource *regs, int regs_type, int regs_id,
687 	  bus_dma_tag_t parent_dmat, ahc_chip chip, ahc_feature features,
688 	  ahc_flag flags, struct scb_data *scb_data)
689 {
690 	/*
691 	 * find unit and check we have that many defined
692 	 */
693 	struct  ahc_softc *ahc;
694 	size_t	alloc_size;
695 
696 	/*
697 	 * Allocate a storage area for us
698 	 */
699 	if (scb_data == NULL)
700 		/*
701 		 * We are not sharing SCB space with another controller
702 		 * so allocate our own SCB data space.
703 		 */
704 		alloc_size = sizeof(struct full_ahc_softc);
705 	else
706 		alloc_size = sizeof(struct ahc_softc);
707 	ahc = malloc(alloc_size, M_DEVBUF, M_NOWAIT);
708 	if (!ahc) {
709 		device_printf(dev, "cannot malloc softc!\n");
710 		return NULL;
711 	}
712 	bzero(ahc, alloc_size);
713 	LIST_INIT(&ahc->pending_ccbs);
714 	ahc->device = dev;
715 	ahc->unit = device_get_unit(dev);
716 	ahc->regs_res_type = regs_type;
717 	ahc->regs_res_id = regs_id;
718 	ahc->regs = regs;
719 	ahc->tag = rman_get_bustag(regs);
720 	ahc->bsh = rman_get_bushandle(regs);
721 	ahc->parent_dmat = parent_dmat;
722 	ahc->chip = chip;
723 	ahc->features = features;
724 	ahc->flags = flags;
725 	if (scb_data == NULL) {
726 		struct full_ahc_softc* full_softc = (struct full_ahc_softc*)ahc;
727 		ahc->scb_data = &full_softc->scb_data_storage;
728 	} else
729 		ahc->scb_data = scb_data;
730 
731 	ahc->unpause = (ahc_inb(ahc, HCNTRL) & IRQMS) | INTEN;
732 	/* The IRQMS bit is only valid on VL and EISA chips */
733 	if ((ahc->chip & AHC_PCI) != 0)
734 		ahc->unpause &= ~IRQMS;
735 	ahc->pause = ahc->unpause | PAUSE;
736 	return (ahc);
737 }
738 
739 void
740 ahc_free(ahc)
741 	struct ahc_softc *ahc;
742 {
743 	ahcfiniscbdata(ahc);
744 	switch (ahc->init_level) {
745 	case 3:
746 		bus_dmamap_unload(ahc->shared_data_dmat,
747 				  ahc->shared_data_dmamap);
748 	case 2:
749 		bus_dmamem_free(ahc->shared_data_dmat, ahc->qoutfifo,
750 				ahc->shared_data_dmamap);
751 		bus_dmamap_destroy(ahc->shared_data_dmat,
752 				   ahc->shared_data_dmamap);
753 	case 1:
754 		bus_dma_tag_destroy(ahc->buffer_dmat);
755 		break;
756 	}
757 
758 	if (ahc->regs != NULL)
759 		bus_release_resource(ahc->device, ahc->regs_res_type,
760 				     ahc->regs_res_id, ahc->regs);
761 	if (ahc->irq != NULL)
762 		bus_release_resource(ahc->device, ahc->irq_res_type,
763 				     0, ahc->irq);
764 
765 	free(ahc, M_DEVBUF);
766 	return;
767 }
768 
769 static int
770 ahcinitscbdata(struct ahc_softc *ahc)
771 {
772 	struct scb_data *scb_data;
773 	int i;
774 
775 	scb_data = ahc->scb_data;
776 	SLIST_INIT(&scb_data->free_scbs);
777 	SLIST_INIT(&scb_data->sg_maps);
778 
779 	/* Allocate SCB resources */
780 	scb_data->scbarray =
781 	    (struct scb *)malloc(sizeof(struct scb) * AHC_SCB_MAX,
782 				 M_DEVBUF, M_NOWAIT);
783 	if (scb_data->scbarray == NULL)
784 		return (ENOMEM);
785 	bzero(scb_data->scbarray, sizeof(struct scb) * AHC_SCB_MAX);
786 
787 	/* Determine the number of hardware SCBs and initialize them */
788 
789 	scb_data->maxhscbs = ahc_probe_scbs(ahc);
790 	/* SCB 0 heads the free list */
791 	ahc_outb(ahc, FREE_SCBH, 0);
792 	for (i = 0; i < ahc->scb_data->maxhscbs; i++) {
793 		ahc_outb(ahc, SCBPTR, i);
794 
795 		/* Clear the control byte. */
796 		ahc_outb(ahc, SCB_CONTROL, 0);
797 
798 		/* Set the next pointer */
799 		ahc_outb(ahc, SCB_NEXT, i+1);
800 
801 		/* Make the tag number invalid */
802 		ahc_outb(ahc, SCB_TAG, SCB_LIST_NULL);
803 	}
804 
805 	/* Make sure that the last SCB terminates the free list */
806 	ahc_outb(ahc, SCBPTR, i-1);
807 	ahc_outb(ahc, SCB_NEXT, SCB_LIST_NULL);
808 
809 	/* Ensure we clear the 0 SCB's control byte. */
810 	ahc_outb(ahc, SCBPTR, 0);
811 	ahc_outb(ahc, SCB_CONTROL, 0);
812 
813 	scb_data->maxhscbs = i;
814 
815 	if (ahc->scb_data->maxhscbs == 0)
816 		panic("%s: No SCB space found", ahc_name(ahc));
817 
818 	/*
819 	 * Create our DMA tags.  These tags define the kinds of device
820 	 * accessable memory allocations and memory mappings we will
821 	 * need to perform during normal operation.
822 	 *
823 	 * Unless we need to further restrict the allocation, we rely
824 	 * on the restrictions of the parent dmat, hence the common
825 	 * use of MAXADDR and MAXSIZE.
826 	 */
827 
828 	/* DMA tag for our hardware scb structures */
829 	if (bus_dma_tag_create(ahc->parent_dmat, /*alignment*/1, /*boundary*/0,
830 			       /*lowaddr*/BUS_SPACE_MAXADDR,
831 			       /*highaddr*/BUS_SPACE_MAXADDR,
832 			       /*filter*/NULL, /*filterarg*/NULL,
833 			       AHC_SCB_MAX * sizeof(struct hardware_scb),
834 			       /*nsegments*/1,
835 			       /*maxsegsz*/BUS_SPACE_MAXSIZE_32BIT,
836 			       /*flags*/0, &scb_data->hscb_dmat) != 0) {
837 		goto error_exit;
838 	}
839 
840 	scb_data->init_level++;
841 
842 	/* Allocation for our ccbs */
843 	if (bus_dmamem_alloc(scb_data->hscb_dmat, (void **)&scb_data->hscbs,
844 			     BUS_DMA_NOWAIT, &scb_data->hscb_dmamap) != 0) {
845 		goto error_exit;
846 	}
847 
848 	scb_data->init_level++;
849 
850 	/* And permanently map them */
851 	bus_dmamap_load(scb_data->hscb_dmat, scb_data->hscb_dmamap,
852 			scb_data->hscbs,
853 			AHC_SCB_MAX * sizeof(struct hardware_scb),
854 			ahcdmamapcb, &scb_data->hscb_busaddr, /*flags*/0);
855 
856 	scb_data->init_level++;
857 
858 	/* DMA tag for our sense buffers */
859 	if (bus_dma_tag_create(ahc->parent_dmat, /*alignment*/1, /*boundary*/0,
860 			       /*lowaddr*/BUS_SPACE_MAXADDR,
861 			       /*highaddr*/BUS_SPACE_MAXADDR,
862 			       /*filter*/NULL, /*filterarg*/NULL,
863 			       AHC_SCB_MAX * sizeof(struct scsi_sense_data),
864 			       /*nsegments*/1,
865 			       /*maxsegsz*/BUS_SPACE_MAXSIZE_32BIT,
866 			       /*flags*/0, &scb_data->sense_dmat) != 0) {
867 		goto error_exit;
868 	}
869 
870 	scb_data->init_level++;
871 
872 	/* Allocate them */
873 	if (bus_dmamem_alloc(scb_data->sense_dmat, (void **)&scb_data->sense,
874 			     BUS_DMA_NOWAIT, &scb_data->sense_dmamap) != 0) {
875 		goto error_exit;
876 	}
877 
878 	scb_data->init_level++;
879 
880 	/* And permanently map them */
881 	bus_dmamap_load(scb_data->sense_dmat, scb_data->sense_dmamap,
882 			scb_data->sense,
883 			AHC_SCB_MAX * sizeof(struct scsi_sense_data),
884 			ahcdmamapcb, &scb_data->sense_busaddr, /*flags*/0);
885 
886 	scb_data->init_level++;
887 
888 	/* DMA tag for our S/G structures.  We allocate in page sized chunks */
889 	if (bus_dma_tag_create(ahc->parent_dmat, /*alignment*/1, /*boundary*/0,
890 			       /*lowaddr*/BUS_SPACE_MAXADDR,
891 			       /*highaddr*/BUS_SPACE_MAXADDR,
892 			       /*filter*/NULL, /*filterarg*/NULL,
893 			       PAGE_SIZE, /*nsegments*/1,
894 			       /*maxsegsz*/BUS_SPACE_MAXSIZE_32BIT,
895 			       /*flags*/0, &scb_data->sg_dmat) != 0) {
896 		goto error_exit;
897 	}
898 
899         scb_data->init_level++;
900 
901 	/* Perform initial CCB allocation */
902 	bzero(scb_data->hscbs, AHC_SCB_MAX * sizeof(struct hardware_scb));
903 	ahcallocscbs(ahc);
904 
905 	if (scb_data->numscbs == 0) {
906 		printf("%s: ahc_init_scb_data - "
907 		       "Unable to allocate initial scbs\n",
908 		       ahc_name(ahc));
909 		goto error_exit;
910 	}
911 
912 	/*
913          * Note that we were successfull
914          */
915         return 0;
916 
917 error_exit:
918 
919 	return ENOMEM;
920 }
921 
922 static void
923 ahcfiniscbdata(struct ahc_softc *ahc)
924 {
925 	struct scb_data *scb_data;
926 
927 	scb_data = ahc->scb_data;
928 
929 	switch (scb_data->init_level) {
930 	default:
931 	case 7:
932 	{
933 		struct sg_map_node *sg_map;
934 
935 		while ((sg_map = SLIST_FIRST(&scb_data->sg_maps))!= NULL) {
936 			SLIST_REMOVE_HEAD(&scb_data->sg_maps, links);
937 			bus_dmamap_unload(scb_data->sg_dmat,
938 					  sg_map->sg_dmamap);
939 			bus_dmamem_free(scb_data->sg_dmat, sg_map->sg_vaddr,
940 					sg_map->sg_dmamap);
941 			free(sg_map, M_DEVBUF);
942 		}
943 		bus_dma_tag_destroy(scb_data->sg_dmat);
944 	}
945 	case 6:
946 		bus_dmamap_unload(scb_data->sense_dmat,
947 				  scb_data->sense_dmamap);
948 	case 5:
949 		bus_dmamem_free(scb_data->sense_dmat, scb_data->sense,
950 				scb_data->sense_dmamap);
951 		bus_dmamap_destroy(scb_data->sense_dmat,
952 				   scb_data->sense_dmamap);
953 	case 4:
954 		bus_dma_tag_destroy(scb_data->sense_dmat);
955 	case 3:
956 		bus_dmamap_unload(scb_data->hscb_dmat, scb_data->hscb_dmamap);
957 	case 2:
958 		bus_dmamem_free(scb_data->hscb_dmat, scb_data->hscbs,
959 				scb_data->hscb_dmamap);
960 		bus_dmamap_destroy(scb_data->hscb_dmat, scb_data->hscb_dmamap);
961 	case 1:
962 		bus_dma_tag_destroy(scb_data->hscb_dmat);
963 		break;
964 	}
965 	if (scb_data->scbarray != NULL)
966 		free(scb_data->scbarray, M_DEVBUF);
967 }
968 
969 static void
970 ahcdmamapcb(void *arg, bus_dma_segment_t *segs, int nseg, int error)
971 {
972 	bus_addr_t *baddr;
973 
974 	baddr = (bus_addr_t *)arg;
975 	*baddr = segs->ds_addr;
976 }
977 
978 int
979 ahc_reset(struct ahc_softc *ahc)
980 {
981 	u_int	sblkctl;
982 	int	wait;
983 
984 	ahc_outb(ahc, HCNTRL, CHIPRST | ahc->pause);
985 	/*
986 	 * Ensure that the reset has finished
987 	 */
988 	wait = 1000;
989 	while (--wait && !(ahc_inb(ahc, HCNTRL) & CHIPRSTACK))
990 		DELAY(1000);
991 	if (wait == 0) {
992 		printf("%s: WARNING - Failed chip reset!  "
993 		       "Trying to initialize anyway.\n", ahc_name(ahc));
994 	}
995 	ahc_outb(ahc, HCNTRL, ahc->pause);
996 
997 	/* Determine channel configuration */
998 	sblkctl = ahc_inb(ahc, SBLKCTL) & (SELBUSB|SELWIDE);
999 	/* No Twin Channel PCI cards */
1000 	if ((ahc->chip & AHC_PCI) != 0)
1001 		sblkctl &= ~SELBUSB;
1002 	switch (sblkctl) {
1003 	case 0:
1004 		/* Single Narrow Channel */
1005 		break;
1006 	case 2:
1007 		/* Wide Channel */
1008 		ahc->features |= AHC_WIDE;
1009 		break;
1010 	case 8:
1011 		/* Twin Channel */
1012 		ahc->features |= AHC_TWIN;
1013 		break;
1014 	default:
1015 		printf(" Unsupported adapter type.  Ignoring\n");
1016 		return(-1);
1017 	}
1018 	return (0);
1019 }
1020 
1021 /*
1022  * Called when we have an active connection to a target on the bus,
1023  * this function finds the nearest syncrate to the input period limited
1024  * by the capabilities of the bus connectivity of the target.
1025  */
1026 static struct ahc_syncrate *
1027 ahc_devlimited_syncrate(struct ahc_softc *ahc, u_int *period) {
1028 	u_int	maxsync;
1029 
1030 	if ((ahc->features & AHC_ULTRA2) != 0) {
1031 		if ((ahc_inb(ahc, SBLKCTL) & ENAB40) != 0
1032 		 && (ahc_inb(ahc, SSTAT2) & EXP_ACTIVE) == 0) {
1033 			maxsync = AHC_SYNCRATE_ULTRA2;
1034 		} else {
1035 			maxsync = AHC_SYNCRATE_ULTRA;
1036 		}
1037 	} else if ((ahc->features & AHC_ULTRA) != 0) {
1038 		maxsync = AHC_SYNCRATE_ULTRA;
1039 	} else {
1040 		maxsync = AHC_SYNCRATE_FAST;
1041 	}
1042 	return (ahc_find_syncrate(ahc, period, maxsync));
1043 }
1044 
1045 /*
1046  * Look up the valid period to SCSIRATE conversion in our table.
1047  * Return the period and offset that should be sent to the target
1048  * if this was the beginning of an SDTR.
1049  */
1050 static struct ahc_syncrate *
1051 ahc_find_syncrate(struct ahc_softc *ahc, u_int *period, u_int maxsync)
1052 {
1053 	struct ahc_syncrate *syncrate;
1054 
1055 	syncrate = &ahc_syncrates[maxsync];
1056 	while ((syncrate->rate != NULL)
1057 	    && ((ahc->features & AHC_ULTRA2) == 0
1058 	     || (syncrate->sxfr_ultra2 != 0))) {
1059 
1060 		if (*period <= syncrate->period) {
1061 			/*
1062 			 * When responding to a target that requests
1063 			 * sync, the requested rate may fall between
1064 			 * two rates that we can output, but still be
1065 			 * a rate that we can receive.  Because of this,
1066 			 * we want to respond to the target with
1067 			 * the same rate that it sent to us even
1068 			 * if the period we use to send data to it
1069 			 * is lower.  Only lower the response period
1070 			 * if we must.
1071 			 */
1072 			if (syncrate == &ahc_syncrates[maxsync]) {
1073 				*period = syncrate->period;
1074 			}
1075 			break;
1076 		}
1077 		syncrate++;
1078 	}
1079 
1080 	if ((*period == 0)
1081 	 || (syncrate->rate == NULL)
1082 	 || ((ahc->features & AHC_ULTRA2) != 0
1083 	  && (syncrate->sxfr_ultra2 == 0))) {
1084 		/* Use asynchronous transfers. */
1085 		*period = 0;
1086 		syncrate = NULL;
1087 	}
1088 	return (syncrate);
1089 }
1090 
1091 static u_int
1092 ahc_find_period(struct ahc_softc *ahc, u_int scsirate, u_int maxsync)
1093 {
1094 	struct ahc_syncrate *syncrate;
1095 
1096 	if ((ahc->features & AHC_ULTRA2) != 0) {
1097 		scsirate &= SXFR_ULTRA2;
1098 	} else  {
1099 		scsirate &= SXFR;
1100 	}
1101 
1102 	syncrate = &ahc_syncrates[maxsync];
1103 	while (syncrate->rate != NULL) {
1104 
1105 		if ((ahc->features & AHC_ULTRA2) != 0) {
1106 			if (syncrate->sxfr_ultra2 == 0)
1107 				break;
1108 			else if (scsirate == syncrate->sxfr_ultra2)
1109 				return (syncrate->period);
1110 		} else if (scsirate == (syncrate->sxfr & ~ULTRA_SXFR)) {
1111 				return (syncrate->period);
1112 		}
1113 		syncrate++;
1114 	}
1115 	return (0); /* async */
1116 }
1117 
1118 static void
1119 ahc_validate_offset(struct ahc_softc *ahc, struct ahc_syncrate *syncrate,
1120 		    u_int *offset, int wide)
1121 {
1122 	u_int maxoffset;
1123 
1124 	/* Limit offset to what we can do */
1125 	if (syncrate == NULL) {
1126 		maxoffset = 0;
1127 	} else if ((ahc->features & AHC_ULTRA2) != 0) {
1128 		maxoffset = MAX_OFFSET_ULTRA2;
1129 	} else {
1130 		if (wide)
1131 			maxoffset = MAX_OFFSET_16BIT;
1132 		else
1133 			maxoffset = MAX_OFFSET_8BIT;
1134 	}
1135 	*offset = MIN(*offset, maxoffset);
1136 }
1137 
1138 static void
1139 ahc_update_target_msg_request(struct ahc_softc *ahc,
1140 			      struct ahc_devinfo *devinfo,
1141 			      struct ahc_initiator_tinfo *tinfo,
1142 			      int force, int paused)
1143 {
1144 	u_int targ_msg_req_orig;
1145 
1146 	targ_msg_req_orig = ahc->targ_msg_req;
1147 	if (tinfo->current.period != tinfo->goal.period
1148 	 || tinfo->current.width != tinfo->goal.width
1149 	 || tinfo->current.offset != tinfo->goal.offset
1150 	 || (force
1151 	  && (tinfo->goal.period != 0
1152 	   || tinfo->goal.width != MSG_EXT_WDTR_BUS_8_BIT)))
1153 		ahc->targ_msg_req |= devinfo->target_mask;
1154 	else
1155 		ahc->targ_msg_req &= ~devinfo->target_mask;
1156 
1157 	if (ahc->targ_msg_req != targ_msg_req_orig) {
1158 		/* Update the message request bit for this target */
1159 		if ((ahc->features & AHC_HS_MAILBOX) != 0) {
1160 			if (paused) {
1161 				ahc_outb(ahc, TARGET_MSG_REQUEST,
1162 					 ahc->targ_msg_req & 0xFF);
1163 				ahc_outb(ahc, TARGET_MSG_REQUEST + 1,
1164 					 (ahc->targ_msg_req >> 8) & 0xFF);
1165 			} else {
1166 				ahc_outb(ahc, HS_MAILBOX,
1167 					 0x01 << HOST_MAILBOX_SHIFT);
1168 			}
1169 		} else {
1170 			if (!paused)
1171 				pause_sequencer(ahc);
1172 
1173 			ahc_outb(ahc, TARGET_MSG_REQUEST,
1174 				 ahc->targ_msg_req & 0xFF);
1175 			ahc_outb(ahc, TARGET_MSG_REQUEST + 1,
1176 				 (ahc->targ_msg_req >> 8) & 0xFF);
1177 
1178 			if (!paused)
1179 				unpause_sequencer(ahc, /*unpause always*/FALSE);
1180 		}
1181 	}
1182 }
1183 
1184 static int
1185 ahc_create_path(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
1186 		     struct cam_path **path)
1187 {
1188 	path_id_t path_id;
1189 
1190 	if (devinfo->channel == 'B')
1191 		path_id = cam_sim_path(ahc->sim_b);
1192 	else
1193 		path_id = cam_sim_path(ahc->sim);
1194 
1195 	return (xpt_create_path(path, /*periph*/NULL,
1196 				path_id, devinfo->target,
1197 				devinfo->lun));
1198 }
1199 
1200 static void
1201 ahc_set_syncrate(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
1202 		 struct cam_path *path, struct ahc_syncrate *syncrate,
1203 		 u_int period, u_int offset, u_int type, int paused)
1204 {
1205 	struct	ahc_initiator_tinfo *tinfo;
1206 	struct	tmode_tstate *tstate;
1207 	u_int	old_period;
1208 	u_int	old_offset;
1209 	int	active = (type & AHC_TRANS_ACTIVE) == AHC_TRANS_ACTIVE;
1210 
1211 	if (syncrate == NULL) {
1212 		period = 0;
1213 		offset = 0;
1214 	}
1215 
1216 	tinfo = ahc_fetch_transinfo(ahc, devinfo->channel, devinfo->our_scsiid,
1217 				    devinfo->target, &tstate);
1218 	old_period = tinfo->current.period;
1219 	old_offset = tinfo->current.offset;
1220 
1221 	if ((type & AHC_TRANS_CUR) != 0
1222 	 && (old_period != period || old_offset != offset)) {
1223 		struct	cam_path *path2;
1224 		u_int	scsirate;
1225 
1226 		scsirate = tinfo->scsirate;
1227 		if ((ahc->features & AHC_ULTRA2) != 0) {
1228 
1229 			scsirate &= ~SXFR_ULTRA2;
1230 
1231 			if (syncrate != NULL) {
1232 				scsirate |= syncrate->sxfr_ultra2;
1233 			}
1234 
1235 			if (active)
1236 				ahc_outb(ahc, SCSIOFFSET, offset);
1237 		} else {
1238 
1239 			scsirate &= ~(SXFR|SOFS);
1240 			/*
1241 			 * Ensure Ultra mode is set properly for
1242 			 * this target.
1243 			 */
1244 			tstate->ultraenb &= ~devinfo->target_mask;
1245 			if (syncrate != NULL) {
1246 				if (syncrate->sxfr & ULTRA_SXFR) {
1247 					tstate->ultraenb |=
1248 						devinfo->target_mask;
1249 				}
1250 				scsirate |= syncrate->sxfr & SXFR;
1251 				scsirate |= offset & SOFS;
1252 			}
1253 			if (active) {
1254 				u_int sxfrctl0;
1255 
1256 				sxfrctl0 = ahc_inb(ahc, SXFRCTL0);
1257 				sxfrctl0 &= ~FAST20;
1258 				if (tstate->ultraenb & devinfo->target_mask)
1259 					sxfrctl0 |= FAST20;
1260 				ahc_outb(ahc, SXFRCTL0, sxfrctl0);
1261 			}
1262 		}
1263 		if (active)
1264 			ahc_outb(ahc, SCSIRATE, scsirate);
1265 
1266 		tinfo->scsirate = scsirate;
1267 		tinfo->current.period = period;
1268 		tinfo->current.offset = offset;
1269 
1270 		/* Update the syncrates in any pending scbs */
1271 		ahc_update_pending_syncrates(ahc);
1272 
1273 		/*
1274 		 * If possible, tell the SCSI layer about the
1275 		 * new transfer parameters.
1276 		 */
1277 		/* If possible, update the XPT's notion of our transfer rate */
1278 		path2 = NULL;
1279 		if (path == NULL) {
1280 			int error;
1281 
1282 			error = ahc_create_path(ahc, devinfo, &path2);
1283 			if (error == CAM_REQ_CMP)
1284 				path = path2;
1285 			else
1286 				path2 = NULL;
1287 		}
1288 
1289 		if (path != NULL) {
1290 			struct	ccb_trans_settings neg;
1291 
1292 			neg.sync_period = period;
1293 			neg.sync_offset = offset;
1294 			neg.valid = CCB_TRANS_SYNC_RATE_VALID
1295 				  | CCB_TRANS_SYNC_OFFSET_VALID;
1296 			xpt_setup_ccb(&neg.ccb_h, path, /*priority*/1);
1297 			xpt_async(AC_TRANSFER_NEG, path, &neg);
1298 		}
1299 
1300 		if (path2 != NULL)
1301 			xpt_free_path(path2);
1302 
1303 		if (bootverbose) {
1304 			if (offset != 0) {
1305 				printf("%s: target %d synchronous at %sMHz, "
1306 				       "offset = 0x%x\n", ahc_name(ahc),
1307 				       devinfo->target, syncrate->rate, offset);
1308 			} else {
1309 				printf("%s: target %d using "
1310 				       "asynchronous transfers\n",
1311 				       ahc_name(ahc), devinfo->target);
1312 			}
1313 		}
1314 	}
1315 
1316 	if ((type & AHC_TRANS_GOAL) != 0) {
1317 		tinfo->goal.period = period;
1318 		tinfo->goal.offset = offset;
1319 	}
1320 
1321 	if ((type & AHC_TRANS_USER) != 0) {
1322 		tinfo->user.period = period;
1323 		tinfo->user.offset = offset;
1324 	}
1325 
1326 	ahc_update_target_msg_request(ahc, devinfo, tinfo,
1327 				      /*force*/FALSE,
1328 				      paused);
1329 }
1330 
1331 static void
1332 ahc_set_width(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
1333 	      struct cam_path *path, u_int width, u_int type, int paused)
1334 {
1335 	struct ahc_initiator_tinfo *tinfo;
1336 	struct tmode_tstate *tstate;
1337 	u_int  oldwidth;
1338 	int    active = (type & AHC_TRANS_ACTIVE) == AHC_TRANS_ACTIVE;
1339 
1340 	tinfo = ahc_fetch_transinfo(ahc, devinfo->channel, devinfo->our_scsiid,
1341 				    devinfo->target, &tstate);
1342 	oldwidth = tinfo->current.width;
1343 
1344 	if ((type & AHC_TRANS_CUR) != 0 && oldwidth != width) {
1345 		struct  cam_path *path2;
1346 		u_int	scsirate;
1347 
1348 		scsirate =  tinfo->scsirate;
1349 		scsirate &= ~WIDEXFER;
1350 		if (width == MSG_EXT_WDTR_BUS_16_BIT)
1351 			scsirate |= WIDEXFER;
1352 
1353 		tinfo->scsirate = scsirate;
1354 
1355 		if (active)
1356 			ahc_outb(ahc, SCSIRATE, scsirate);
1357 
1358 		tinfo->current.width = width;
1359 
1360 		/* If possible, update the XPT's notion of our transfer rate */
1361 		path2 = NULL;
1362 		if (path == NULL) {
1363 			int error;
1364 
1365 			error = ahc_create_path(ahc, devinfo, &path2);
1366 			if (error == CAM_REQ_CMP)
1367 				path = path2;
1368 			else
1369 				path2 = NULL;
1370 		}
1371 
1372 		if (path != NULL) {
1373 			struct	ccb_trans_settings neg;
1374 
1375 			neg.bus_width = width;
1376 			neg.valid = CCB_TRANS_BUS_WIDTH_VALID;
1377 			xpt_setup_ccb(&neg.ccb_h, path, /*priority*/1);
1378 			xpt_async(AC_TRANSFER_NEG, path, &neg);
1379 		}
1380 
1381 		if (path2 != NULL)
1382 			xpt_free_path(path2);
1383 
1384 		if (bootverbose) {
1385 			printf("%s: target %d using %dbit transfers\n",
1386 			       ahc_name(ahc), devinfo->target,
1387 			       8 * (0x01 << width));
1388 		}
1389 	}
1390 	if ((type & AHC_TRANS_GOAL) != 0)
1391 		tinfo->goal.width = width;
1392 	if ((type & AHC_TRANS_USER) != 0)
1393 		tinfo->user.width = width;
1394 
1395 	ahc_update_target_msg_request(ahc, devinfo, tinfo,
1396 				      /*force*/FALSE, paused);
1397 }
1398 
1399 static void
1400 ahc_set_tags(struct ahc_softc *ahc, struct ahc_devinfo *devinfo, int enable)
1401 {
1402 	struct ahc_initiator_tinfo *tinfo;
1403 	struct tmode_tstate *tstate;
1404 
1405 	tinfo = ahc_fetch_transinfo(ahc, devinfo->channel, devinfo->our_scsiid,
1406 				    devinfo->target, &tstate);
1407 
1408 	if (enable)
1409 		tstate->tagenable |= devinfo->target_mask;
1410 	else
1411 		tstate->tagenable &= ~devinfo->target_mask;
1412 }
1413 
1414 /*
1415  * Attach all the sub-devices we can find
1416  */
1417 int
1418 ahc_attach(struct ahc_softc *ahc)
1419 {
1420 	struct ccb_setasync csa;
1421 	struct cam_devq *devq;
1422 	int bus_id;
1423 	int bus_id2;
1424 	struct cam_sim *sim;
1425 	struct cam_sim *sim2;
1426 	struct cam_path *path;
1427 	struct cam_path *path2;
1428 	int count;
1429 	int s;
1430 	int error;
1431 
1432 	count = 0;
1433 	sim = NULL;
1434 	sim2 = NULL;
1435 
1436 	s = splcam();
1437 	/* Hook up our interrupt handler */
1438 	if ((error = bus_setup_intr(ahc->device, ahc->irq, INTR_TYPE_CAM,
1439 				    ahc_intr, ahc, &ahc->ih)) != 0) {
1440 		device_printf(ahc->device, "bus_setup_intr() failed: %d\n",
1441 			      error);
1442 		goto fail;
1443 	}
1444 
1445 	/*
1446 	 * Attach secondary channel first if the user has
1447 	 * declared it the primary channel.
1448 	 */
1449 	if ((ahc->flags & AHC_CHANNEL_B_PRIMARY) != 0) {
1450 		bus_id = 1;
1451 		bus_id2 = 0;
1452 	} else {
1453 		bus_id = 0;
1454 		bus_id2 = 1;
1455 	}
1456 
1457 	/*
1458 	 * Create the device queue for our SIM(s).
1459 	 */
1460 	devq = cam_simq_alloc(AHC_SCB_MAX);
1461 	if (devq == NULL)
1462 		goto fail;
1463 
1464 	/*
1465 	 * Construct our first channel SIM entry
1466 	 */
1467 	sim = cam_sim_alloc(ahc_action, ahc_poll, "ahc", ahc, ahc->unit,
1468 			    1, AHC_SCB_MAX, devq);
1469 	if (sim == NULL) {
1470 		cam_simq_free(devq);
1471 		goto fail;
1472 	}
1473 
1474 	if (xpt_bus_register(sim, bus_id) != CAM_SUCCESS) {
1475 		cam_sim_free(sim, /*free_devq*/TRUE);
1476 		sim = NULL;
1477 		goto fail;
1478 	}
1479 
1480 	if (xpt_create_path(&path, /*periph*/NULL,
1481 			    cam_sim_path(sim), CAM_TARGET_WILDCARD,
1482 			    CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
1483 		xpt_bus_deregister(cam_sim_path(sim));
1484 		cam_sim_free(sim, /*free_devq*/TRUE);
1485 		sim = NULL;
1486 		goto fail;
1487 	}
1488 
1489 	xpt_setup_ccb(&csa.ccb_h, path, /*priority*/5);
1490 	csa.ccb_h.func_code = XPT_SASYNC_CB;
1491 	csa.event_enable = AC_LOST_DEVICE;
1492 	csa.callback = ahc_async;
1493 	csa.callback_arg = sim;
1494 	xpt_action((union ccb *)&csa);
1495 	count++;
1496 
1497 	if (ahc->features & AHC_TWIN) {
1498 		sim2 = cam_sim_alloc(ahc_action, ahc_poll, "ahc",
1499 				    ahc, ahc->unit, 1,
1500 				    AHC_SCB_MAX, devq);
1501 
1502 		if (sim2 == NULL) {
1503 			printf("ahc_attach: Unable to attach second "
1504 			       "bus due to resource shortage");
1505 			goto fail;
1506 		}
1507 
1508 		if (xpt_bus_register(sim2, bus_id2) != CAM_SUCCESS) {
1509 			printf("ahc_attach: Unable to attach second "
1510 			       "bus due to resource shortage");
1511 			/*
1512 			 * We do not want to destroy the device queue
1513 			 * because the first bus is using it.
1514 			 */
1515 			cam_sim_free(sim2, /*free_devq*/FALSE);
1516 			goto fail;
1517 		}
1518 
1519 		if (xpt_create_path(&path2, /*periph*/NULL,
1520 				    cam_sim_path(sim2),
1521 				    CAM_TARGET_WILDCARD,
1522 				    CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
1523 			xpt_bus_deregister(cam_sim_path(sim2));
1524 			cam_sim_free(sim2, /*free_devq*/FALSE);
1525 			sim2 = NULL;
1526 			goto fail;
1527 		}
1528 		xpt_setup_ccb(&csa.ccb_h, path2, /*priority*/5);
1529 		csa.ccb_h.func_code = XPT_SASYNC_CB;
1530 		csa.event_enable = AC_LOST_DEVICE;
1531 		csa.callback = ahc_async;
1532 		csa.callback_arg = sim2;
1533 		xpt_action((union ccb *)&csa);
1534 		count++;
1535 	}
1536 
1537 fail:
1538 	if ((ahc->flags & AHC_CHANNEL_B_PRIMARY) != 0) {
1539 		ahc->sim_b = sim;
1540 		ahc->path_b = path;
1541 		ahc->sim = sim2;
1542 		ahc->path = path2;
1543 	} else {
1544 		ahc->sim = sim;
1545 		ahc->path = path;
1546 		ahc->sim_b = sim2;
1547 		ahc->path_b = path2;
1548 	}
1549 	splx(s);
1550 	return (count);
1551 }
1552 
1553 static void
1554 ahc_scb_devinfo(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
1555 		struct scb *scb)
1556 {
1557 	role_t	role;
1558 	int	our_id;
1559 
1560 	if (scb->ccb->ccb_h.func_code == XPT_CONT_TARGET_IO) {
1561 		our_id = scb->ccb->ccb_h.target_id;
1562 		role = ROLE_TARGET;
1563 	} else {
1564 		our_id = SCB_CHANNEL(scb) == 'B' ? ahc->our_id_b : ahc->our_id;
1565 		role = ROLE_INITIATOR;
1566 	}
1567 	ahc_compile_devinfo(devinfo, our_id, SCB_TARGET(scb),
1568 			    SCB_LUN(scb), SCB_CHANNEL(scb), role);
1569 }
1570 
1571 static void
1572 ahc_fetch_devinfo(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
1573 {
1574 	u_int	saved_tcl;
1575 	role_t	role;
1576 	int	our_id;
1577 
1578 	if (ahc_inb(ahc, SSTAT0) & TARGET)
1579 		role = ROLE_TARGET;
1580 	else
1581 		role = ROLE_INITIATOR;
1582 
1583 	if (role == ROLE_TARGET
1584 	 && (ahc->features & AHC_MULTI_TID) != 0
1585 	 && (ahc_inb(ahc, SEQ_FLAGS) & CMDPHASE_PENDING) != 0) {
1586 		/* We were selected, so pull our id from TARGIDIN */
1587 		our_id = ahc_inb(ahc, TARGIDIN) & OID;
1588 	} else if ((ahc->features & AHC_ULTRA2) != 0)
1589 		our_id = ahc_inb(ahc, SCSIID_ULTRA2) & OID;
1590 	else
1591 		our_id = ahc_inb(ahc, SCSIID) & OID;
1592 
1593 	saved_tcl = ahc_inb(ahc, SAVED_TCL);
1594 	ahc_compile_devinfo(devinfo, our_id, TCL_TARGET(saved_tcl),
1595 			    TCL_LUN(saved_tcl), TCL_CHANNEL(ahc, saved_tcl),
1596 			    role);
1597 }
1598 
1599 static void
1600 ahc_compile_devinfo(struct ahc_devinfo *devinfo, u_int our_id, u_int target,
1601 		    u_int lun, char channel, role_t role)
1602 {
1603 	devinfo->our_scsiid = our_id;
1604 	devinfo->target = target;
1605 	devinfo->lun = lun;
1606 	devinfo->target_offset = target;
1607 	devinfo->channel = channel;
1608 	devinfo->role = role;
1609 	if (channel == 'B')
1610 		devinfo->target_offset += 8;
1611 	devinfo->target_mask = (0x01 << devinfo->target_offset);
1612 }
1613 
1614 /*
1615  * Catch an interrupt from the adapter
1616  */
1617 void
1618 ahc_intr(void *arg)
1619 {
1620 	struct	ahc_softc *ahc;
1621 	u_int	intstat;
1622 
1623 	ahc = (struct ahc_softc *)arg;
1624 
1625 	intstat = ahc_inb(ahc, INTSTAT);
1626 
1627 	/*
1628 	 * Any interrupts to process?
1629 	 */
1630 #if NPCI > 0
1631 	if ((intstat & INT_PEND) == 0) {
1632 		if ((ahc->chip & AHC_PCI) != 0
1633 		 && (ahc->unsolicited_ints > 500)) {
1634 			if ((ahc_inb(ahc, ERROR) & PCIERRSTAT) != 0)
1635 				ahc_pci_intr(ahc);
1636 			ahc->unsolicited_ints = 0;
1637 		} else {
1638 			ahc->unsolicited_ints++;
1639 		}
1640 		return;
1641 	} else {
1642 		ahc->unsolicited_ints = 0;
1643 	}
1644 #else
1645 	if ((intstat & INT_PEND) == 0)
1646 		return;
1647 #endif
1648 
1649 	if (intstat & CMDCMPLT) {
1650 		ahc_outb(ahc, CLRINT, CLRCMDINT);
1651 		ahc_run_qoutfifo(ahc);
1652 		if ((ahc->flags & AHC_TARGETMODE) != 0) {
1653 			ahc_run_tqinfifo(ahc);
1654 		}
1655 	}
1656 	if (intstat & BRKADRINT) {
1657 		/*
1658 		 * We upset the sequencer :-(
1659 		 * Lookup the error message
1660 		 */
1661 		int i, error, num_errors;
1662 
1663 		error = ahc_inb(ahc, ERROR);
1664 		num_errors =  sizeof(hard_error)/sizeof(hard_error[0]);
1665 		for (i = 0; error != 1 && i < num_errors; i++)
1666 			error >>= 1;
1667 		panic("%s: brkadrint, %s at seqaddr = 0x%x\n",
1668 		      ahc_name(ahc), hard_error[i].errmesg,
1669 		      ahc_inb(ahc, SEQADDR0) |
1670 		      (ahc_inb(ahc, SEQADDR1) << 8));
1671 
1672 		/* Tell everyone that this HBA is no longer availible */
1673 		ahc_abort_scbs(ahc, CAM_TARGET_WILDCARD, ALL_CHANNELS,
1674 			       CAM_LUN_WILDCARD, SCB_LIST_NULL, ROLE_UNKNOWN,
1675 			       CAM_NO_HBA);
1676 	}
1677 	if (intstat & SEQINT)
1678 		ahc_handle_seqint(ahc, intstat);
1679 
1680 	if (intstat & SCSIINT)
1681 		ahc_handle_scsiint(ahc, intstat);
1682 }
1683 
1684 static struct tmode_tstate *
1685 ahc_alloc_tstate(struct ahc_softc *ahc, u_int scsi_id, char channel)
1686 {
1687 	struct tmode_tstate *master_tstate;
1688 	struct tmode_tstate *tstate;
1689 	int i, s;
1690 
1691 	master_tstate = ahc->enabled_targets[ahc->our_id];
1692 	if (channel == 'B') {
1693 		scsi_id += 8;
1694 		master_tstate = ahc->enabled_targets[ahc->our_id_b + 8];
1695 	}
1696 	if (ahc->enabled_targets[scsi_id] != NULL
1697 	 && ahc->enabled_targets[scsi_id] != master_tstate)
1698 		panic("%s: ahc_alloc_tstate - Target already allocated",
1699 		      ahc_name(ahc));
1700 	tstate = malloc(sizeof(*tstate), M_DEVBUF, M_NOWAIT);
1701 	if (tstate == NULL)
1702 		return (NULL);
1703 
1704 	/*
1705 	 * If we have allocated a master tstate, copy user settings from
1706 	 * the master tstate (taken from SRAM or the EEPROM) for this
1707 	 * channel, but reset our current and goal settings to async/narrow
1708 	 * until an initiator talks to us.
1709 	 */
1710 	if (master_tstate != NULL) {
1711 		bcopy(master_tstate, tstate, sizeof(*tstate));
1712 		bzero(tstate->enabled_luns, sizeof(tstate->enabled_luns));
1713 		tstate->ultraenb = 0;
1714 		for (i = 0; i < 16; i++) {
1715 			bzero(&tstate->transinfo[i].current,
1716 			      sizeof(tstate->transinfo[i].current));
1717 			bzero(&tstate->transinfo[i].goal,
1718 			      sizeof(tstate->transinfo[i].goal));
1719 		}
1720 	} else
1721 		bzero(tstate, sizeof(*tstate));
1722 	s = splcam();
1723 	ahc->enabled_targets[scsi_id] = tstate;
1724 	splx(s);
1725 	return (tstate);
1726 }
1727 
1728 static void
1729 ahc_free_tstate(struct ahc_softc *ahc, u_int scsi_id, char channel, int force)
1730 {
1731 	struct tmode_tstate *tstate;
1732 
1733 	/* Don't clean up the entry for our initiator role */
1734 	if ((ahc->flags & AHC_INITIATORMODE) != 0
1735 	 && ((channel == 'B' && scsi_id == ahc->our_id_b)
1736 	  || (channel == 'A' && scsi_id == ahc->our_id))
1737 	 && force == FALSE)
1738 		return;
1739 
1740 	if (channel == 'B')
1741 		scsi_id += 8;
1742 	tstate = ahc->enabled_targets[scsi_id];
1743 	if (tstate != NULL)
1744 		free(tstate, M_DEVBUF);
1745 	ahc->enabled_targets[scsi_id] = NULL;
1746 }
1747 
1748 static void
1749 ahc_handle_en_lun(struct ahc_softc *ahc, struct cam_sim *sim, union ccb *ccb)
1750 {
1751 	struct	   tmode_tstate *tstate;
1752 	struct	   tmode_lstate *lstate;
1753 	struct	   ccb_en_lun *cel;
1754 	cam_status status;
1755 	int	   target;
1756 	int	   lun;
1757 	u_int	   target_mask;
1758 	char	   channel;
1759 	int	   s;
1760 
1761 	status = ahc_find_tmode_devs(ahc, sim, ccb, &tstate, &lstate,
1762 				     /* notfound_failure*/FALSE);
1763 
1764 	if (status != CAM_REQ_CMP) {
1765 		ccb->ccb_h.status = status;
1766 		return;
1767 	}
1768 
1769 	cel = &ccb->cel;
1770 	target = ccb->ccb_h.target_id;
1771 	lun = ccb->ccb_h.target_lun;
1772 	channel = SIM_CHANNEL(ahc, sim);
1773 	target_mask = 0x01 << target;
1774 	if (channel == 'B')
1775 		target_mask <<= 8;
1776 
1777 	if (cel->enable != 0) {
1778 		u_int scsiseq;
1779 
1780 		/* Are we already enabled?? */
1781 		if (lstate != NULL) {
1782 			xpt_print_path(ccb->ccb_h.path);
1783 			printf("Lun already enabled\n");
1784 			ccb->ccb_h.status = CAM_LUN_ALRDY_ENA;
1785 			return;
1786 		}
1787 
1788 		if (cel->grp6_len != 0
1789 		 || cel->grp7_len != 0) {
1790 			/*
1791 			 * Don't (yet?) support vendor
1792 			 * specific commands.
1793 			 */
1794 			ccb->ccb_h.status = CAM_REQ_INVALID;
1795 			printf("Non-zero Group Codes\n");
1796 			return;
1797 		}
1798 
1799 		/*
1800 		 * Seems to be okay.
1801 		 * Setup our data structures.
1802 		 */
1803 		if (target != CAM_TARGET_WILDCARD && tstate == NULL) {
1804 			tstate = ahc_alloc_tstate(ahc, target, channel);
1805 			if (tstate == NULL) {
1806 				xpt_print_path(ccb->ccb_h.path);
1807 				printf("Couldn't allocate tstate\n");
1808 				ccb->ccb_h.status = CAM_RESRC_UNAVAIL;
1809 				return;
1810 			}
1811 		}
1812 		lstate = malloc(sizeof(*lstate), M_DEVBUF, M_NOWAIT);
1813 		if (lstate == NULL) {
1814 			xpt_print_path(ccb->ccb_h.path);
1815 			printf("Couldn't allocate lstate\n");
1816 			ccb->ccb_h.status = CAM_RESRC_UNAVAIL;
1817 			return;
1818 		}
1819 		bzero(lstate, sizeof(*lstate));
1820 		status = xpt_create_path(&lstate->path, /*periph*/NULL,
1821 					 xpt_path_path_id(ccb->ccb_h.path),
1822 					 xpt_path_target_id(ccb->ccb_h.path),
1823 					 xpt_path_lun_id(ccb->ccb_h.path));
1824 		if (status != CAM_REQ_CMP) {
1825 			free(lstate, M_DEVBUF);
1826 			xpt_print_path(ccb->ccb_h.path);
1827 			printf("Couldn't allocate path\n");
1828 			ccb->ccb_h.status = CAM_RESRC_UNAVAIL;
1829 			return;
1830 		}
1831 		SLIST_INIT(&lstate->accept_tios);
1832 		SLIST_INIT(&lstate->immed_notifies);
1833 		s = splcam();
1834 		pause_sequencer(ahc);
1835 		if (target != CAM_TARGET_WILDCARD) {
1836 			tstate->enabled_luns[lun] = lstate;
1837 			ahc->enabled_luns++;
1838 
1839 			if ((ahc->features & AHC_MULTI_TID) != 0) {
1840 				u_int16_t targid_mask;
1841 
1842 				targid_mask = ahc_inb(ahc, TARGID)
1843 					    | (ahc_inb(ahc, TARGID + 1) << 8);
1844 
1845 				targid_mask |= target_mask;
1846 				ahc_outb(ahc, TARGID, targid_mask);
1847 				ahc_outb(ahc, TARGID+1, (targid_mask >> 8));
1848 			} else {
1849 				int our_id;
1850 				char  channel;
1851 
1852 				channel = SIM_CHANNEL(ahc, sim);
1853 				our_id = SIM_SCSI_ID(ahc, sim);
1854 
1855 				/*
1856 				 * This can only happen if selections
1857 				 * are not enabled
1858 				 */
1859 				if (target != our_id) {
1860 					u_int sblkctl;
1861 					char  cur_channel;
1862 					int   swap;
1863 
1864 					sblkctl = ahc_inb(ahc, SBLKCTL);
1865 					cur_channel = (sblkctl & SELBUSB)
1866 						    ? 'B' : 'A';
1867 					if ((ahc->features & AHC_TWIN) == 0)
1868 						cur_channel = 'A';
1869 					swap = cur_channel != channel;
1870 					if (channel == 'A')
1871 						ahc->our_id = target;
1872 					else
1873 						ahc->our_id_b = target;
1874 
1875 					if (swap)
1876 						ahc_outb(ahc, SBLKCTL,
1877 							 sblkctl ^ SELBUSB);
1878 
1879 					ahc_outb(ahc, SCSIID, target);
1880 
1881 					if (swap)
1882 						ahc_outb(ahc, SBLKCTL, sblkctl);
1883 				}
1884 			}
1885 		} else
1886 			ahc->black_hole = lstate;
1887 		/* Allow select-in operations */
1888 		if (ahc->black_hole != NULL && ahc->enabled_luns > 0) {
1889 			scsiseq = ahc_inb(ahc, SCSISEQ_TEMPLATE);
1890 			scsiseq |= ENSELI;
1891 			ahc_outb(ahc, SCSISEQ_TEMPLATE, scsiseq);
1892 			scsiseq = ahc_inb(ahc, SCSISEQ);
1893 			scsiseq |= ENSELI;
1894 			ahc_outb(ahc, SCSISEQ, scsiseq);
1895 		}
1896 		unpause_sequencer(ahc, /*always?*/FALSE);
1897 		splx(s);
1898 		ccb->ccb_h.status = CAM_REQ_CMP;
1899 		xpt_print_path(ccb->ccb_h.path);
1900 		printf("Lun now enabled for target mode\n");
1901 	} else {
1902 		struct ccb_hdr *elm;
1903 
1904 		if (lstate == NULL) {
1905 			ccb->ccb_h.status = CAM_LUN_INVALID;
1906 			return;
1907 		}
1908 
1909 		s = splcam();
1910 		ccb->ccb_h.status = CAM_REQ_CMP;
1911 		LIST_FOREACH(elm, &ahc->pending_ccbs, sim_links.le) {
1912 			if (elm->func_code == XPT_CONT_TARGET_IO
1913 			 && !xpt_path_comp(elm->path, ccb->ccb_h.path)){
1914 				printf("CTIO pending\n");
1915 				ccb->ccb_h.status = CAM_REQ_INVALID;
1916 				splx(s);
1917 				return;
1918 			}
1919 		}
1920 
1921 		if (SLIST_FIRST(&lstate->accept_tios) != NULL) {
1922 			printf("ATIOs pending\n");
1923 			ccb->ccb_h.status = CAM_REQ_INVALID;
1924 		}
1925 
1926 		if (SLIST_FIRST(&lstate->immed_notifies) != NULL) {
1927 			printf("INOTs pending\n");
1928 			ccb->ccb_h.status = CAM_REQ_INVALID;
1929 		}
1930 
1931 		if (ccb->ccb_h.status == CAM_REQ_CMP) {
1932 			int i, empty;
1933 
1934 			xpt_print_path(ccb->ccb_h.path);
1935 			printf("Target mode disabled\n");
1936 			xpt_free_path(lstate->path);
1937 			free(lstate, M_DEVBUF);
1938 
1939 			pause_sequencer(ahc);
1940 			/* Can we clean up the target too? */
1941 			if (target != CAM_TARGET_WILDCARD) {
1942 				tstate->enabled_luns[lun] = NULL;
1943 				ahc->enabled_luns--;
1944 				for (empty = 1, i = 0; i < 8; i++)
1945 					if (tstate->enabled_luns[i] != NULL) {
1946 						empty = 0;
1947 						break;
1948 					}
1949 
1950 				if (empty) {
1951 					ahc_free_tstate(ahc, target, channel,
1952 							/*force*/FALSE);
1953 					if (ahc->features & AHC_MULTI_TID) {
1954 						u_int16_t targid_mask;
1955 
1956 						targid_mask =
1957 						    ahc_inb(ahc, TARGID)
1958 						    | (ahc_inb(ahc, TARGID + 1)
1959 						       << 8);
1960 
1961 						targid_mask &= ~target_mask;
1962 						ahc_outb(ahc, TARGID,
1963 							 targid_mask);
1964 						ahc_outb(ahc, TARGID+1,
1965 						 	 (targid_mask >> 8));
1966 					}
1967 				}
1968 			} else {
1969 
1970 				ahc->black_hole = NULL;
1971 
1972 				/*
1973 				 * We can't allow selections without
1974 				 * our black hole device.
1975 				 */
1976 				empty = TRUE;
1977 			}
1978 			if (ahc->enabled_luns == 0) {
1979 				/* Disallow select-in */
1980 				u_int scsiseq;
1981 
1982 				scsiseq = ahc_inb(ahc, SCSISEQ_TEMPLATE);
1983 				scsiseq &= ~ENSELI;
1984 				ahc_outb(ahc, SCSISEQ_TEMPLATE, scsiseq);
1985 				scsiseq = ahc_inb(ahc, SCSISEQ);
1986 				scsiseq &= ~ENSELI;
1987 				ahc_outb(ahc, SCSISEQ, scsiseq);
1988 			}
1989 			unpause_sequencer(ahc, /*always?*/FALSE);
1990 		}
1991 		splx(s);
1992 	}
1993 }
1994 
1995 static int
1996 ahc_handle_target_cmd(struct ahc_softc *ahc, struct target_cmd *cmd)
1997 {
1998 	struct	  tmode_tstate *tstate;
1999 	struct	  tmode_lstate *lstate;
2000 	struct	  ccb_accept_tio *atio;
2001 	u_int8_t *byte;
2002 	int	  initiator;
2003 	int	  target;
2004 	int	  lun;
2005 
2006 	initiator = cmd->initiator_channel >> 4;
2007 	target = cmd->targ_id;
2008 	lun    = (cmd->identify & MSG_IDENTIFY_LUNMASK);
2009 
2010 	byte = cmd->bytes;
2011 	tstate = ahc->enabled_targets[target];
2012 	lstate = NULL;
2013 	if (tstate != NULL && lun < 8)
2014 		lstate = tstate->enabled_luns[lun];
2015 
2016 	/*
2017 	 * Commands for disabled luns go to the black hole driver.
2018 	 */
2019 	if (lstate == NULL) {
2020 		lstate = ahc->black_hole;
2021 		atio =
2022 		    (struct ccb_accept_tio*)SLIST_FIRST(&lstate->accept_tios);
2023 	} else {
2024 		atio =
2025 		    (struct ccb_accept_tio*)SLIST_FIRST(&lstate->accept_tios);
2026 	}
2027 	if (atio == NULL) {
2028 		ahc->flags |= AHC_TQINFIFO_BLOCKED;
2029 		printf("No ATIOs for incoming command\n");
2030 		/*
2031 		 * Wait for more ATIOs from the peripheral driver for this lun.
2032 		 */
2033 		return (1);
2034 	} else
2035 		ahc->flags &= ~AHC_TQINFIFO_BLOCKED;
2036 	SLIST_REMOVE_HEAD(&lstate->accept_tios, sim_links.sle);
2037 
2038 	if (lstate == ahc->black_hole) {
2039 		/* Fill in the wildcards */
2040 		atio->ccb_h.target_id = target;
2041 		atio->ccb_h.target_lun = lun;
2042 	}
2043 
2044 	/*
2045 	 * Package it up and send it off to
2046 	 * whomever has this lun enabled.
2047 	 */
2048 	atio->init_id = initiator;
2049 	if (byte[0] != 0xFF) {
2050 		/* Tag was included */
2051 		atio->tag_action = *byte++;
2052 		atio->tag_id = *byte++;
2053 		atio->ccb_h.flags = CAM_TAG_ACTION_VALID;
2054 	} else {
2055 		byte++;
2056 		atio->ccb_h.flags = 0;
2057 	}
2058 
2059 	/* Okay.  Now determine the cdb size based on the command code */
2060 	switch (*byte >> CMD_GROUP_CODE_SHIFT) {
2061 	case 0:
2062 		atio->cdb_len = 6;
2063 		break;
2064 	case 1:
2065 	case 2:
2066 		atio->cdb_len = 10;
2067 		break;
2068 	case 4:
2069 		atio->cdb_len = 16;
2070 		break;
2071 	case 5:
2072 		atio->cdb_len = 12;
2073 		break;
2074 	case 3:
2075 	default:
2076 		/* Only copy the opcode. */
2077 		atio->cdb_len = 1;
2078 		printf("Reserved or VU command code type encountered\n");
2079 		break;
2080 	}
2081 	bcopy(byte, atio->cdb_io.cdb_bytes, atio->cdb_len);
2082 
2083 	atio->ccb_h.status |= CAM_CDB_RECVD;
2084 
2085 	if ((cmd->identify & MSG_IDENTIFY_DISCFLAG) == 0) {
2086 		/*
2087 		 * We weren't allowed to disconnect.
2088 		 * We're hanging on the bus until a
2089 		 * continue target I/O comes in response
2090 		 * to this accept tio.
2091 		 */
2092 #if 0
2093 		printf("Received Immediate Command %d:%d:%d - %p\n",
2094 		       initiator, target, lun, ahc->pending_device);
2095 #endif
2096 		ahc->pending_device = lstate;
2097 	}
2098 	xpt_done((union ccb*)atio);
2099 	return (0);
2100 }
2101 
2102 static void
2103 ahc_handle_seqint(struct ahc_softc *ahc, u_int intstat)
2104 {
2105 	struct scb *scb;
2106 	struct ahc_devinfo devinfo;
2107 
2108 	ahc_fetch_devinfo(ahc, &devinfo);
2109 
2110 	/*
2111 	 * Clear the upper byte that holds SEQINT status
2112 	 * codes and clear the SEQINT bit. We will unpause
2113 	 * the sequencer, if appropriate, after servicing
2114 	 * the request.
2115 	 */
2116 	ahc_outb(ahc, CLRINT, CLRSEQINT);
2117 	switch (intstat & SEQINT_MASK) {
2118 	case NO_MATCH:
2119 	{
2120 		/* Ensure we don't leave the selection hardware on */
2121 		ahc_outb(ahc, SCSISEQ,
2122 			 ahc_inb(ahc, SCSISEQ) & (ENSELI|ENRSELI|ENAUTOATNP));
2123 
2124 		printf("%s:%c:%d: no active SCB for reconnecting "
2125 		       "target - issuing BUS DEVICE RESET\n",
2126 		       ahc_name(ahc), devinfo.channel, devinfo.target);
2127 		printf("SAVED_TCL == 0x%x, ARG_1 == 0x%x, SEQ_FLAGS == 0x%x\n",
2128 		       ahc_inb(ahc, SAVED_TCL), ahc_inb(ahc, ARG_1),
2129 		       ahc_inb(ahc, SEQ_FLAGS));
2130 		ahc->msgout_buf[0] = MSG_BUS_DEV_RESET;
2131 		ahc->msgout_len = 1;
2132 		ahc->msgout_index = 0;
2133 		ahc->msg_type = MSG_TYPE_INITIATOR_MSGOUT;
2134 		ahc_outb(ahc, MSG_OUT, HOST_MSG);
2135 		ahc_outb(ahc, SCSISIGO, ahc_inb(ahc, LASTPHASE) | ATNO);
2136 		break;
2137 	}
2138 	case UPDATE_TMSG_REQ:
2139 		ahc_outb(ahc, TARGET_MSG_REQUEST, ahc->targ_msg_req & 0xFF);
2140 		ahc_outb(ahc, TARGET_MSG_REQUEST + 1,
2141 			 (ahc->targ_msg_req >> 8) & 0xFF);
2142 		ahc_outb(ahc, HS_MAILBOX, 0);
2143 		break;
2144 	case SEND_REJECT:
2145 	{
2146 		u_int rejbyte = ahc_inb(ahc, ACCUM);
2147 		printf("%s:%c:%d: Warning - unknown message received from "
2148 		       "target (0x%x).  Rejecting\n",
2149 		       ahc_name(ahc), devinfo.channel, devinfo.target, rejbyte);
2150 		break;
2151 	}
2152 	case NO_IDENT:
2153 	{
2154 		/*
2155 		 * The reconnecting target either did not send an identify
2156 		 * message, or did, but we didn't find and SCB to match and
2157 		 * before it could respond to our ATN/abort, it hit a dataphase.
2158 		 * The only safe thing to do is to blow it away with a bus
2159 		 * reset.
2160 		 */
2161 		int found;
2162 
2163 		printf("%s:%c:%d: Target did not send an IDENTIFY message. "
2164 		       "LASTPHASE = 0x%x, SAVED_TCL == 0x%x\n",
2165 		       ahc_name(ahc), devinfo.channel, devinfo.target,
2166 		       ahc_inb(ahc, LASTPHASE), ahc_inb(ahc, SAVED_TCL));
2167 		found = ahc_reset_channel(ahc, devinfo.channel,
2168 					  /*initiate reset*/TRUE);
2169 		printf("%s: Issued Channel %c Bus Reset. "
2170 		       "%d SCBs aborted\n", ahc_name(ahc), devinfo.channel,
2171 		       found);
2172 		return;
2173 	}
2174 	case BAD_PHASE:
2175 		if (ahc_inb(ahc, LASTPHASE) == P_BUSFREE) {
2176 			printf("%s:%c:%d: Missed busfree.\n", ahc_name(ahc),
2177 			       devinfo.channel, devinfo.target);
2178 			restart_sequencer(ahc);
2179 			return;
2180 		} else {
2181 			printf("%s:%c:%d: unknown scsi bus phase.  Attempting "
2182 			       "to continue\n", ahc_name(ahc), devinfo.channel,
2183 			       devinfo.target);
2184 		}
2185 		break;
2186 	case BAD_STATUS:
2187 	{
2188 		u_int  scb_index;
2189 		struct hardware_scb *hscb;
2190 		struct ccb_scsiio *csio;
2191 		/*
2192 		 * The sequencer will notify us when a command
2193 		 * has an error that would be of interest to
2194 		 * the kernel.  This allows us to leave the sequencer
2195 		 * running in the common case of command completes
2196 		 * without error.  The sequencer will already have
2197 		 * dma'd the SCB back up to us, so we can reference
2198 		 * the in kernel copy directly.
2199 		 */
2200 		scb_index = ahc_inb(ahc, SCB_TAG);
2201 		scb = &ahc->scb_data->scbarray[scb_index];
2202 
2203 		/*
2204 		 * Set the default return value to 0 (don't
2205 		 * send sense).  The sense code will change
2206 		 * this if needed.
2207 		 */
2208 		ahc_outb(ahc, RETURN_1, 0);
2209 		if (!(scb_index < ahc->scb_data->numscbs
2210 		   && (scb->flags & SCB_ACTIVE) != 0)) {
2211 			printf("%s:%c:%d: ahc_intr - referenced scb "
2212 			       "not valid during seqint 0x%x scb(%d)\n",
2213 			       ahc_name(ahc), devinfo.channel,
2214 			       devinfo.target, intstat, scb_index);
2215 			goto unpause;
2216 		}
2217 
2218 		hscb = scb->hscb;
2219 
2220 		/* Don't want to clobber the original sense code */
2221 		if ((scb->flags & SCB_SENSE) != 0) {
2222 			/*
2223 			 * Clear the SCB_SENSE Flag and have
2224 			 * the sequencer do a normal command
2225 			 * complete.
2226 			 */
2227 			scb->flags &= ~SCB_SENSE;
2228 			ahcsetccbstatus(scb->ccb, CAM_AUTOSENSE_FAIL);
2229 			break;
2230 		}
2231 		ahcsetccbstatus(scb->ccb, CAM_SCSI_STATUS_ERROR);
2232 		/* Freeze the queue unit the client sees the error. */
2233 		ahc_freeze_devq(ahc, scb->ccb->ccb_h.path);
2234 		ahc_freeze_ccb(scb->ccb);
2235 		csio = &scb->ccb->csio;
2236 		csio->scsi_status = hscb->status;
2237 		switch (hscb->status) {
2238 		case SCSI_STATUS_OK:
2239 			printf("%s: Interrupted for staus of 0???\n",
2240 			       ahc_name(ahc));
2241 			break;
2242 		case SCSI_STATUS_CMD_TERMINATED:
2243 		case SCSI_STATUS_CHECK_COND:
2244 #ifdef AHC_DEBUG
2245 			if (ahc_debug & AHC_SHOWSENSE) {
2246 				xpt_print_path(csio->ccb_h.path);
2247 				printf("SCB %d: requests Check Status\n",
2248 				       scb->hscb->tag);
2249 			}
2250 #endif
2251 
2252 			if ((csio->ccb_h.flags & CAM_DIS_AUTOSENSE) == 0) {
2253 				struct ahc_dma_seg *sg;
2254 				struct scsi_sense *sc;
2255 				struct ahc_initiator_tinfo *tinfo;
2256 				struct tmode_tstate *tstate;
2257 
2258 				sg = scb->sg_list;
2259 				sc = (struct scsi_sense *)(&hscb->cmdstore);
2260 				/*
2261 				 * Save off the residual if there is one.
2262 				 */
2263 				if (hscb->residual_SG_count != 0)
2264 					ahc_calc_residual(scb);
2265 				else
2266 					scb->ccb->csio.resid = 0;
2267 
2268 #ifdef AHC_DEBUG
2269 				if (ahc_debug & AHC_SHOWSENSE) {
2270 					xpt_print_path(csio->ccb_h.path);
2271 					printf("Sending Sense\n");
2272 				}
2273 #endif
2274 				sg->addr = ahc->scb_data->sense_busaddr
2275 				   + (hscb->tag*sizeof(struct scsi_sense_data));
2276 				sg->len = MIN(sizeof(struct scsi_sense_data),
2277 					      csio->sense_len);
2278 
2279 				sc->opcode = REQUEST_SENSE;
2280 				sc->byte2 =  SCB_LUN(scb) << 5;
2281 				sc->unused[0] = 0;
2282 				sc->unused[1] = 0;
2283 				sc->length = sg->len;
2284 				sc->control = 0;
2285 
2286 				/*
2287 				 * Would be nice to preserve DISCENB here,
2288 				 * but due to the way we page SCBs, we can't.
2289 				 */
2290 				hscb->control = 0;
2291 
2292 				/*
2293 				 * This request sense could be because the
2294 				 * the device lost power or in some other
2295 				 * way has lost our transfer negotiations.
2296 				 * Renegotiate if appropriate.
2297 				 */
2298 				tinfo = ahc_fetch_transinfo(ahc,
2299 							    devinfo.channel,
2300 							    devinfo.our_scsiid,
2301 							    devinfo.target,
2302 							    &tstate);
2303 				ahc_update_target_msg_request(ahc, &devinfo,
2304 							      tinfo,
2305 							      /*force*/TRUE,
2306 							      /*paused*/TRUE);
2307 				hscb->status = 0;
2308 				hscb->SG_count = 1;
2309 				hscb->SG_pointer = scb->sg_list_phys;
2310 				hscb->data = sg->addr;
2311 				hscb->datalen = sg->len;
2312 				hscb->cmdpointer = hscb->cmdstore_busaddr;
2313 				hscb->cmdlen = sizeof(*sc);
2314 				scb->sg_count = hscb->SG_count;
2315 				scb->flags |= SCB_SENSE;
2316 				/*
2317 				 * Ensure the target is busy since this
2318 				 * will be an untagged request.
2319 				 */
2320 				ahc_busy_tcl(ahc, scb);
2321 				ahc_outb(ahc, RETURN_1, SEND_SENSE);
2322 
2323 				/*
2324 				 * Ensure we have enough time to actually
2325 				 * retrieve the sense.
2326 				 */
2327 				untimeout(ahc_timeout, (caddr_t)scb,
2328 					  scb->ccb->ccb_h.timeout_ch);
2329 				scb->ccb->ccb_h.timeout_ch =
2330 				    timeout(ahc_timeout, (caddr_t)scb, 5 * hz);
2331 			}
2332 			break;
2333 		case SCSI_STATUS_BUSY:
2334 		case SCSI_STATUS_QUEUE_FULL:
2335 			/*
2336 			 * Requeue any transactions that haven't been
2337 			 * sent yet.
2338 			 */
2339 			ahc_freeze_devq(ahc, scb->ccb->ccb_h.path);
2340 			ahc_freeze_ccb(scb->ccb);
2341 			break;
2342 		}
2343 		break;
2344 	}
2345 	case TRACE_POINT:
2346 	{
2347 		printf("SSTAT2 = 0x%x DFCNTRL = 0x%x\n", ahc_inb(ahc, SSTAT2),
2348 		       ahc_inb(ahc, DFCNTRL));
2349 		printf("SSTAT3 = 0x%x DSTATUS = 0x%x\n", ahc_inb(ahc, SSTAT3),
2350 		       ahc_inb(ahc, DFSTATUS));
2351 		printf("SSTAT0 = 0x%x, SCB_DATACNT = 0x%x\n",
2352 		       ahc_inb(ahc, SSTAT0),
2353 		       ahc_inb(ahc, SCB_DATACNT));
2354 		break;
2355 	}
2356 	case HOST_MSG_LOOP:
2357 	{
2358 		/*
2359 		 * The sequencer has encountered a message phase
2360 		 * that requires host assistance for completion.
2361 		 * While handling the message phase(s), we will be
2362 		 * notified by the sequencer after each byte is
2363 		 * transfered so we can track bus phases.
2364 		 *
2365 		 * If this is the first time we've seen a HOST_MSG_LOOP,
2366 		 * initialize the state of the host message loop.
2367 		 */
2368 		if (ahc->msg_type == MSG_TYPE_NONE) {
2369 			u_int bus_phase;
2370 
2371 			bus_phase = ahc_inb(ahc, SCSISIGI) & PHASE_MASK;
2372 			if (bus_phase != P_MESGIN
2373 			 && bus_phase != P_MESGOUT) {
2374 				printf("ahc_intr: HOST_MSG_LOOP bad "
2375 				       "phase 0x%x\n",
2376 				      bus_phase);
2377 				/*
2378 				 * Probably transitioned to bus free before
2379 				 * we got here.  Just punt the message.
2380 				 */
2381 				ahc_clear_intstat(ahc);
2382 				restart_sequencer(ahc);
2383 			}
2384 
2385 			if (devinfo.role == ROLE_INITIATOR) {
2386 				struct scb *scb;
2387 				u_int scb_index;
2388 
2389 				scb_index = ahc_inb(ahc, SCB_TAG);
2390 				scb = &ahc->scb_data->scbarray[scb_index];
2391 
2392 				if (bus_phase == P_MESGOUT)
2393 					ahc_setup_initiator_msgout(ahc,
2394 								   &devinfo,
2395 								   scb);
2396 				else {
2397 					ahc->msg_type =
2398 					    MSG_TYPE_INITIATOR_MSGIN;
2399 					ahc->msgin_index = 0;
2400 				}
2401 			} else {
2402 				if (bus_phase == P_MESGOUT) {
2403 					ahc->msg_type =
2404 					    MSG_TYPE_TARGET_MSGOUT;
2405 					ahc->msgin_index = 0;
2406 				} else
2407 					/* XXX Ever executed??? */
2408 					ahc_setup_target_msgin(ahc, &devinfo);
2409 			}
2410 		}
2411 
2412 		/* Pass a NULL path so that handlers generate their own */
2413 		ahc_handle_message_phase(ahc, /*path*/NULL);
2414 		break;
2415 	}
2416 	case DATA_OVERRUN:
2417 	{
2418 		/*
2419 		 * When the sequencer detects an overrun, it
2420 		 * places the controller in "BITBUCKET" mode
2421 		 * and allows the target to complete its transfer.
2422 		 * Unfortunately, none of the counters get updated
2423 		 * when the controller is in this mode, so we have
2424 		 * no way of knowing how large the overrun was.
2425 		 */
2426 		u_int scbindex = ahc_inb(ahc, SCB_TAG);
2427 		u_int lastphase = ahc_inb(ahc, LASTPHASE);
2428 		int i;
2429 
2430 		scb = &ahc->scb_data->scbarray[scbindex];
2431 		xpt_print_path(scb->ccb->ccb_h.path);
2432 		printf("data overrun detected in %s phase."
2433 		       "  Tag == 0x%x.\n",
2434 		       lastphase == P_DATAIN ? "Data-In" : "Data-Out",
2435 		       scb->hscb->tag);
2436 		xpt_print_path(scb->ccb->ccb_h.path);
2437 		printf("%s seen Data Phase.  Length = %d.  NumSGs = %d.\n",
2438 		       ahc_inb(ahc, SEQ_FLAGS) & DPHASE ? "Have" : "Haven't",
2439 		       scb->ccb->csio.dxfer_len, scb->sg_count);
2440 		if (scb->sg_count > 0) {
2441 			for (i = 0; i < scb->sg_count - 1; i++) {
2442 				printf("sg[%d] - Addr 0x%x : Length %d\n",
2443 				       i,
2444 				       scb->sg_list[i].addr,
2445 				       scb->sg_list[i].len);
2446 			}
2447 		}
2448 		/*
2449 		 * Set this and it will take affect when the
2450 		 * target does a command complete.
2451 		 */
2452 		ahc_freeze_devq(ahc, scb->ccb->ccb_h.path);
2453 		ahcsetccbstatus(scb->ccb, CAM_DATA_RUN_ERR);
2454 		ahc_freeze_ccb(scb->ccb);
2455 		break;
2456 	}
2457 	case TRACEPOINT:
2458 	{
2459 		printf("TRACEPOINT: RETURN_2 = %d\n", ahc_inb(ahc, RETURN_2));
2460 #if 0
2461 		printf("SSTAT1 == 0x%x\n", ahc_inb(ahc, SSTAT1));
2462 		printf("SSTAT0 == 0x%x\n", ahc_inb(ahc, SSTAT0));
2463 		printf(", SCSISIGI == 0x%x\n", ahc_inb(ahc, SCSISIGI));
2464 		printf("TRACEPOINT: CCHCNT = %d, SG_COUNT = %d\n",
2465 		       ahc_inb(ahc, CCHCNT), ahc_inb(ahc, SG_COUNT));
2466 		printf("TRACEPOINT: SCB_TAG = %d\n", ahc_inb(ahc, SCB_TAG));
2467 		printf("TRACEPOINT1: CCHADDR = %d, CCHCNT = %d, SCBPTR = %d\n",
2468 		       ahc_inb(ahc, CCHADDR)
2469 		    | (ahc_inb(ahc, CCHADDR+1) << 8)
2470 		    | (ahc_inb(ahc, CCHADDR+2) << 16)
2471 		    | (ahc_inb(ahc, CCHADDR+3) << 24),
2472 		       ahc_inb(ahc, CCHCNT)
2473 		    | (ahc_inb(ahc, CCHCNT+1) << 8)
2474 		    | (ahc_inb(ahc, CCHCNT+2) << 16),
2475 		       ahc_inb(ahc, SCBPTR));
2476 		printf("TRACEPOINT: WAITING_SCBH = %d\n", ahc_inb(ahc, WAITING_SCBH));
2477 		printf("TRACEPOINT: SCB_TAG = %d\n", ahc_inb(ahc, SCB_TAG));
2478 #endif
2479 		break;
2480 	}
2481 #if NOT_YET
2482 	/* XXX Fill these in later */
2483 	case MESG_BUFFER_BUSY:
2484 		break;
2485 	case MSGIN_PHASEMIS:
2486 		break;
2487 #endif
2488 	default:
2489 		printf("ahc_intr: seqint, "
2490 		       "intstat == 0x%x, scsisigi = 0x%x\n",
2491 		       intstat, ahc_inb(ahc, SCSISIGI));
2492 		break;
2493 	}
2494 
2495 unpause:
2496 	/*
2497 	 *  The sequencer is paused immediately on
2498 	 *  a SEQINT, so we should restart it when
2499 	 *  we're done.
2500 	 */
2501 	unpause_sequencer(ahc, /*unpause_always*/TRUE);
2502 }
2503 
2504 static void
2505 ahc_handle_scsiint(struct ahc_softc *ahc, u_int intstat)
2506 {
2507 	u_int	scb_index;
2508 	u_int	status;
2509 	struct	scb *scb;
2510 	char	cur_channel;
2511 	char	intr_channel;
2512 
2513 	if ((ahc->features & AHC_TWIN) != 0
2514 	 && ((ahc_inb(ahc, SBLKCTL) & SELBUSB) != 0))
2515 		cur_channel = 'B';
2516 	else
2517 		cur_channel = 'A';
2518 	intr_channel = cur_channel;
2519 
2520 	status = ahc_inb(ahc, SSTAT1);
2521 	if (status == 0) {
2522 		if ((ahc->features & AHC_TWIN) != 0) {
2523 			/* Try the other channel */
2524 		 	ahc_outb(ahc, SBLKCTL, ahc_inb(ahc, SBLKCTL) ^ SELBUSB);
2525 			status = ahc_inb(ahc, SSTAT1);
2526 		 	ahc_outb(ahc, SBLKCTL, ahc_inb(ahc, SBLKCTL) ^ SELBUSB);
2527 			intr_channel = (cur_channel == 'A') ? 'B' : 'A';
2528 		}
2529 		if (status == 0) {
2530 			printf("%s: Spurious SCSI interrupt\n", ahc_name(ahc));
2531 			return;
2532 		}
2533 	}
2534 
2535 	scb_index = ahc_inb(ahc, SCB_TAG);
2536 	if (scb_index < ahc->scb_data->numscbs) {
2537 		scb = &ahc->scb_data->scbarray[scb_index];
2538 		if ((scb->flags & SCB_ACTIVE) == 0)
2539 			scb = NULL;
2540 	} else
2541 		scb = NULL;
2542 
2543 	if ((status & SCSIRSTI) != 0) {
2544 		printf("%s: Someone reset channel %c\n",
2545 			ahc_name(ahc), intr_channel);
2546 		ahc_reset_channel(ahc, intr_channel, /* Initiate Reset */FALSE);
2547 	} else if ((status & BUSFREE) != 0 && (status & SELTO) == 0) {
2548 		/*
2549 		 * First look at what phase we were last in.
2550 		 * If its message out, chances are pretty good
2551 		 * that the busfree was in response to one of
2552 		 * our abort requests.
2553 		 */
2554 		u_int lastphase = ahc_inb(ahc, LASTPHASE);
2555 		u_int saved_tcl = ahc_inb(ahc, SAVED_TCL);
2556 		u_int target = TCL_TARGET(saved_tcl);
2557 		u_int initiator_role_id = TCL_SCSI_ID(ahc, saved_tcl);
2558 		char channel = TCL_CHANNEL(ahc, saved_tcl);
2559 		int printerror = 1;
2560 
2561 		ahc_outb(ahc, SCSISEQ,
2562 			 ahc_inb(ahc, SCSISEQ) & (ENSELI|ENRSELI|ENAUTOATNP));
2563 		if (lastphase == P_MESGOUT) {
2564 			u_int message;
2565 			u_int tag;
2566 
2567 			message = ahc->msgout_buf[ahc->msgout_index - 1];
2568 			tag = SCB_LIST_NULL;
2569 			switch (message) {
2570 			case MSG_ABORT_TAG:
2571 				tag = scb->hscb->tag;
2572 				/* FALLTRHOUGH */
2573 			case MSG_ABORT:
2574 				xpt_print_path(scb->ccb->ccb_h.path);
2575 				printf("SCB %d - Abort %s Completed.\n",
2576 				       scb->hscb->tag, tag == SCB_LIST_NULL ?
2577 				       "" : "Tag");
2578 				if ((scb->flags & SCB_RECOVERY_SCB) != 0) {
2579 					ahcsetccbstatus(scb->ccb,
2580 							CAM_REQ_ABORTED);
2581 					ahc_done(ahc, scb);
2582 				}
2583 				printerror = 0;
2584 				break;
2585 			case MSG_BUS_DEV_RESET:
2586 			{
2587 				struct ahc_devinfo devinfo;
2588 
2589 				ahc_compile_devinfo(&devinfo,
2590 						    initiator_role_id,
2591 						    target,
2592 						    TCL_LUN(saved_tcl),
2593 						    channel,
2594 						    ROLE_INITIATOR);
2595 				ahc_handle_devreset(ahc, &devinfo,
2596 						    CAM_BDR_SENT, AC_SENT_BDR,
2597 						    "Bus Device Reset",
2598 						    /*verbose_only*/FALSE);
2599 				printerror = 0;
2600 				break;
2601 			}
2602 			default:
2603 				break;
2604 			}
2605 		}
2606 		if (printerror != 0) {
2607 			if (scb != NULL) {
2608 				u_int tag;
2609 
2610 				if ((scb->hscb->control & TAG_ENB) != 0)
2611 					tag = scb->hscb->tag;
2612 				else
2613 					tag = SCB_LIST_NULL;
2614 				ahc_abort_scbs(ahc, target, channel,
2615 					       SCB_LUN(scb), tag,
2616 					       ROLE_INITIATOR,
2617 					       CAM_UNEXP_BUSFREE);
2618 			} else {
2619 				ahc_abort_scbs(ahc, target, channel,
2620 					       CAM_LUN_WILDCARD, SCB_LIST_NULL,
2621 					       ROLE_INITIATOR,
2622 					       CAM_UNEXP_BUSFREE);
2623 				printf("%s: ", ahc_name(ahc));
2624 			}
2625 			printf("Unexpected busfree.  LASTPHASE == 0x%x\n"
2626 			       "SEQADDR == 0x%x\n",
2627 			       lastphase, ahc_inb(ahc, SEQADDR0)
2628 				| (ahc_inb(ahc, SEQADDR1) << 8));
2629 		}
2630 		ahc_clear_msg_state(ahc);
2631 		ahc_outb(ahc, SIMODE1, ahc_inb(ahc, SIMODE1) & ~ENBUSFREE);
2632 		ahc_outb(ahc, CLRSINT1, CLRBUSFREE);
2633 		ahc_outb(ahc, CLRINT, CLRSCSIINT);
2634 		restart_sequencer(ahc);
2635 	} else if ((status & SELTO) != 0) {
2636 		u_int scbptr;
2637 
2638 		scbptr = ahc_inb(ahc, WAITING_SCBH);
2639 		ahc_outb(ahc, SCBPTR, scbptr);
2640 		scb_index = ahc_inb(ahc, SCB_TAG);
2641 
2642 		if (scb_index < ahc->scb_data->numscbs) {
2643 			scb = &ahc->scb_data->scbarray[scb_index];
2644 			if ((scb->flags & SCB_ACTIVE) == 0)
2645 				scb = NULL;
2646 		} else
2647 			scb = NULL;
2648 
2649 		if (scb == NULL) {
2650 			printf("%s: ahc_intr - referenced scb not "
2651 			       "valid during SELTO scb(%d, %d)\n",
2652 			       ahc_name(ahc), scbptr, scb_index);
2653 		} else {
2654 			struct ahc_devinfo devinfo;
2655 
2656 			ahc_scb_devinfo(ahc, &devinfo, scb);
2657 			ahc_handle_devreset(ahc, &devinfo, CAM_SEL_TIMEOUT,
2658 					    /*ac_code*/0, "Selection Timeout",
2659 					    /*verbose_only*/TRUE);
2660 		}
2661 		/* Stop the selection */
2662 		ahc_outb(ahc, SCSISEQ, 0);
2663 
2664 		/* No more pending messages */
2665 		ahc_clear_msg_state(ahc);
2666 
2667 		/*
2668 		 * Although the driver does not care about the
2669 		 * 'Selection in Progress' status bit, the busy
2670 		 * LED does.  SELINGO is only cleared by a sucessful
2671 		 * selection, so we must manually clear it to ensure
2672 		 * the LED turns off just incase no future successful
2673 		 * selections occur (e.g. no devices on the bus).
2674 		 */
2675 		ahc_outb(ahc, CLRSINT0, CLRSELINGO);
2676 
2677 		/* Clear interrupt state */
2678 		ahc_outb(ahc, CLRSINT1, CLRSELTIMEO|CLRBUSFREE);
2679 		ahc_outb(ahc, CLRINT, CLRSCSIINT);
2680 		restart_sequencer(ahc);
2681 	} else if (scb == NULL) {
2682 		printf("%s: ahc_intr - referenced scb not "
2683 		       "valid during scsiint 0x%x scb(%d)\n"
2684 		       "SIMODE0 = 0x%x, SIMODE1 = 0x%x, SSTAT0 = 0x%x\n"
2685 		       "SEQADDR = 0x%x\n", ahc_name(ahc),
2686 			status, scb_index, ahc_inb(ahc, SIMODE0),
2687 			ahc_inb(ahc, SIMODE1), ahc_inb(ahc, SSTAT0),
2688 			ahc_inb(ahc, SEQADDR0) | (ahc_inb(ahc, SEQADDR1) << 8));
2689 		ahc_outb(ahc, CLRSINT1, status);
2690 		ahc_outb(ahc, CLRINT, CLRSCSIINT);
2691 		unpause_sequencer(ahc, /*unpause_always*/TRUE);
2692 		scb = NULL;
2693 	} else if ((status & SCSIPERR) != 0) {
2694 		/*
2695 		 * Determine the bus phase and
2696 		 * queue an appropriate message
2697 		 */
2698 		char *phase;
2699 		u_int mesg_out = MSG_NOOP;
2700 		u_int lastphase = ahc_inb(ahc, LASTPHASE);
2701 
2702 		xpt_print_path(scb->ccb->ccb_h.path);
2703 
2704 		switch (lastphase) {
2705 		case P_DATAOUT:
2706 			phase = "Data-Out";
2707 			break;
2708 		case P_DATAIN:
2709 			phase = "Data-In";
2710 			mesg_out = MSG_INITIATOR_DET_ERR;
2711 			break;
2712 		case P_COMMAND:
2713 			phase = "Command";
2714 			break;
2715 		case P_MESGOUT:
2716 			phase = "Message-Out";
2717 			break;
2718 		case P_STATUS:
2719 			phase = "Status";
2720 			mesg_out = MSG_INITIATOR_DET_ERR;
2721 			break;
2722 		case P_MESGIN:
2723 			phase = "Message-In";
2724 			mesg_out = MSG_PARITY_ERROR;
2725 			break;
2726 		default:
2727 			phase = "unknown";
2728 			break;
2729 		}
2730 		printf("parity error during %s phase.\n", phase);
2731 
2732 		printf("SEQADDR == 0x%x\n", ahc_inb(ahc, SEQADDR0)
2733 				 | (ahc_inb(ahc, SEQADDR1) << 8));
2734 
2735 		printf("SCSIRATE == 0x%x\n", ahc_inb(ahc, SCSIRATE));
2736 
2737 		/*
2738 		 * We've set the hardware to assert ATN if we
2739 		 * get a parity error on "in" phases, so all we
2740 		 * need to do is stuff the message buffer with
2741 		 * the appropriate message.  "In" phases have set
2742 		 * mesg_out to something other than MSG_NOP.
2743 		 */
2744 		if (mesg_out != MSG_NOOP) {
2745 			if (ahc->msg_type != MSG_TYPE_NONE)
2746 				ahc->send_msg_perror = TRUE;
2747 			else
2748 				ahc_outb(ahc, MSG_OUT, mesg_out);
2749 		}
2750 		ahc_outb(ahc, CLRSINT1, CLRSCSIPERR);
2751 		ahc_outb(ahc, CLRINT, CLRSCSIINT);
2752 		unpause_sequencer(ahc, /*unpause_always*/TRUE);
2753 	} else {
2754 		xpt_print_path(scb->ccb->ccb_h.path);
2755 		printf("Unknown SCSIINT. Status = 0x%x\n", status);
2756 		ahc_outb(ahc, CLRSINT1, status);
2757 		ahc_outb(ahc, CLRINT, CLRSCSIINT);
2758 		unpause_sequencer(ahc, /*unpause_always*/TRUE);
2759 	}
2760 }
2761 
2762 static void
2763 ahc_build_transfer_msg(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
2764 {
2765 	/*
2766 	 * We need to initiate transfer negotiations.
2767 	 * If our current and goal settings are identical,
2768 	 * we want to renegotiate due to a check condition.
2769 	 */
2770 	struct	ahc_initiator_tinfo *tinfo;
2771 	struct	tmode_tstate *tstate;
2772 	int	dowide;
2773 	int	dosync;
2774 
2775 	tinfo = ahc_fetch_transinfo(ahc, devinfo->channel, devinfo->our_scsiid,
2776 				    devinfo->target, &tstate);
2777 	dowide = tinfo->current.width != tinfo->goal.width;
2778 	dosync = tinfo->current.period != tinfo->goal.period;
2779 
2780 	if (!dowide && !dosync) {
2781 		dowide = tinfo->goal.width != MSG_EXT_WDTR_BUS_8_BIT;
2782 		dosync = tinfo->goal.period != 0;
2783 	}
2784 
2785 	if (dowide)
2786 		ahc_construct_wdtr(ahc, tinfo->goal.width);
2787 	else if (dosync) {
2788 		struct	ahc_syncrate *rate;
2789 		u_int	period;
2790 		u_int	offset;
2791 
2792 		period = tinfo->goal.period;
2793 		rate = ahc_devlimited_syncrate(ahc, &period);
2794 		offset = tinfo->goal.offset;
2795 		ahc_validate_offset(ahc, rate, &offset,
2796 				    tinfo->current.width);
2797 		ahc_construct_sdtr(ahc, period, offset);
2798 	} else {
2799 		panic("ahc_intr: AWAITING_MSG for negotiation, "
2800 		      "but no negotiation needed\n");
2801 	}
2802 }
2803 
2804 static void
2805 ahc_setup_initiator_msgout(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
2806 			   struct scb *scb)
2807 {
2808 	/*
2809 	 * To facilitate adding multiple messages together,
2810 	 * each routine should increment the index and len
2811 	 * variables instead of setting them explicitly.
2812 	 */
2813 	ahc->msgout_index = 0;
2814 	ahc->msgout_len = 0;
2815 
2816 	if ((scb->flags & SCB_DEVICE_RESET) == 0
2817 	 && ahc_inb(ahc, MSG_OUT) == MSG_IDENTIFYFLAG) {
2818 		u_int identify_msg;
2819 
2820 		identify_msg = MSG_IDENTIFYFLAG | SCB_LUN(scb);
2821 		if ((scb->hscb->control & DISCENB) != 0)
2822 			identify_msg |= MSG_IDENTIFY_DISCFLAG;
2823 		ahc->msgout_buf[ahc->msgout_index++] = identify_msg;
2824 		ahc->msgout_len++;
2825 
2826 		if ((scb->hscb->control & TAG_ENB) != 0) {
2827 			ahc->msgout_buf[ahc->msgout_index++] =
2828 			    scb->ccb->csio.tag_action;
2829 			ahc->msgout_buf[ahc->msgout_index++] = scb->hscb->tag;
2830 			ahc->msgout_len += 2;
2831 		}
2832 	}
2833 
2834 	if (scb->flags & SCB_DEVICE_RESET) {
2835 		ahc->msgout_buf[ahc->msgout_index++] = MSG_BUS_DEV_RESET;
2836 		ahc->msgout_len++;
2837 		xpt_print_path(scb->ccb->ccb_h.path);
2838 		printf("Bus Device Reset Message Sent\n");
2839 	} else if (scb->flags & SCB_ABORT) {
2840 		if ((scb->hscb->control & TAG_ENB) != 0)
2841 			ahc->msgout_buf[ahc->msgout_index++] = MSG_ABORT_TAG;
2842 		else
2843 			ahc->msgout_buf[ahc->msgout_index++] = MSG_ABORT;
2844 		ahc->msgout_len++;
2845 		xpt_print_path(scb->ccb->ccb_h.path);
2846 		printf("Abort Message Sent\n");
2847 	} else if ((ahc->targ_msg_req & devinfo->target_mask) != 0) {
2848 		ahc_build_transfer_msg(ahc, devinfo);
2849 	} else {
2850 		printf("ahc_intr: AWAITING_MSG for an SCB that "
2851 		       "does not have a waiting message");
2852 		panic("SCB = %d, SCB Control = %x, MSG_OUT = %x "
2853 		      "SCB flags = %x", scb->hscb->tag, scb->hscb->control,
2854 		      ahc_inb(ahc, MSG_OUT), scb->flags);
2855 	}
2856 
2857 	/*
2858 	 * Clear the MK_MESSAGE flag from the SCB so we aren't
2859 	 * asked to send this message again.
2860 	 */
2861 	ahc_outb(ahc, SCB_CONTROL, ahc_inb(ahc, SCB_CONTROL) & ~MK_MESSAGE);
2862 	ahc->msgout_index = 0;
2863 	ahc->msg_type = MSG_TYPE_INITIATOR_MSGOUT;
2864 }
2865 
2866 static void
2867 ahc_setup_target_msgin(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
2868 {
2869 	/*
2870 	 * To facilitate adding multiple messages together,
2871 	 * each routine should increment the index and len
2872 	 * variables instead of setting them explicitly.
2873 	 */
2874 	ahc->msgout_index = 0;
2875 	ahc->msgout_len = 0;
2876 
2877 	if ((ahc->targ_msg_req & devinfo->target_mask) != 0)
2878 		ahc_build_transfer_msg(ahc, devinfo);
2879 	else
2880 		panic("ahc_intr: AWAITING target message with no message");
2881 
2882 	ahc->msgout_index = 0;
2883 	ahc->msg_type = MSG_TYPE_TARGET_MSGIN;
2884 }
2885 
2886 static int
2887 ahc_handle_msg_reject(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
2888 {
2889 	/*
2890 	 * What we care about here is if we had an
2891 	 * outstanding SDTR or WDTR message for this
2892 	 * target.  If we did, this is a signal that
2893 	 * the target is refusing negotiation.
2894 	 */
2895 	struct scb *scb;
2896 	u_int scb_index;
2897 	u_int last_msg;
2898 	int   response = 0;
2899 
2900 	scb_index = ahc_inb(ahc, SCB_TAG);
2901 	scb = &ahc->scb_data->scbarray[scb_index];
2902 
2903 	/* Might be necessary */
2904 	last_msg = ahc_inb(ahc, LAST_MSG);
2905 
2906 	if (ahc_sent_msg(ahc, MSG_EXT_WDTR, /*full*/FALSE)) {
2907 		struct ahc_initiator_tinfo *tinfo;
2908 		struct tmode_tstate *tstate;
2909 
2910 		/* note 8bit xfers and clear flag */
2911 		printf("%s:%c:%d: refuses WIDE negotiation.  Using "
2912 		       "8bit transfers\n", ahc_name(ahc),
2913 		       devinfo->channel, devinfo->target);
2914 		ahc_set_width(ahc, devinfo, scb->ccb->ccb_h.path,
2915 			      MSG_EXT_WDTR_BUS_8_BIT,
2916 			      AHC_TRANS_ACTIVE|AHC_TRANS_GOAL,
2917 			      /*paused*/TRUE);
2918 		ahc_set_syncrate(ahc, devinfo, scb->ccb->ccb_h.path,
2919 				 /*syncrate*/NULL, /*period*/0,
2920 				 /*offset*/0, AHC_TRANS_ACTIVE,
2921 				 /*paused*/TRUE);
2922 		tinfo = ahc_fetch_transinfo(ahc, devinfo->channel,
2923 					    devinfo->our_scsiid,
2924 					    devinfo->target, &tstate);
2925 		if (tinfo->goal.period) {
2926 			u_int period;
2927 
2928 			/* Start the sync negotiation */
2929 			period = tinfo->goal.period;
2930 			ahc_devlimited_syncrate(ahc, &period);
2931 			ahc->msgout_index = 0;
2932 			ahc->msgout_len = 0;
2933 			ahc_construct_sdtr(ahc, period, tinfo->goal.offset);
2934 			ahc->msgout_index = 0;
2935 			response = 1;
2936 		}
2937 	} else if (ahc_sent_msg(ahc, MSG_EXT_SDTR, /*full*/FALSE)) {
2938 		/* note asynch xfers and clear flag */
2939 		ahc_set_syncrate(ahc, devinfo, scb->ccb->ccb_h.path,
2940 				 /*syncrate*/NULL, /*period*/0,
2941 				 /*offset*/0,
2942 				 AHC_TRANS_ACTIVE|AHC_TRANS_GOAL,
2943 				 /*paused*/TRUE);
2944 		printf("%s:%c:%d: refuses synchronous negotiation. "
2945 		       "Using asynchronous transfers\n",
2946 		       ahc_name(ahc),
2947 		       devinfo->channel, devinfo->target);
2948 	} else if ((scb->hscb->control & MSG_SIMPLE_Q_TAG) != 0) {
2949 		struct	ccb_trans_settings neg;
2950 
2951 		printf("%s:%c:%d: refuses tagged commands.  Performing "
2952 		       "non-tagged I/O\n", ahc_name(ahc),
2953 		       devinfo->channel, devinfo->target);
2954 
2955 		ahc_set_tags(ahc, devinfo, FALSE);
2956 		neg.flags = 0;
2957 		neg.valid = CCB_TRANS_TQ_VALID;
2958 		xpt_setup_ccb(&neg.ccb_h, scb->ccb->ccb_h.path, /*priority*/1);
2959 		xpt_async(AC_TRANSFER_NEG, scb->ccb->ccb_h.path, &neg);
2960 
2961 		/*
2962 		 * Resend the identify for this CCB as the target
2963 		 * may believe that the selection is invalid otherwise.
2964 		 */
2965 		ahc_outb(ahc, SCB_CONTROL, ahc_inb(ahc, SCB_CONTROL)
2966 					  & ~MSG_SIMPLE_Q_TAG);
2967 	 	scb->hscb->control &= ~MSG_SIMPLE_Q_TAG;
2968 		scb->ccb->ccb_h.flags &= ~CAM_TAG_ACTION_VALID;
2969 		ahc_outb(ahc, MSG_OUT, MSG_IDENTIFYFLAG);
2970 		ahc_outb(ahc, SCSISIGO, ahc_inb(ahc, SCSISIGO) | ATNO);
2971 
2972 		/*
2973 		 * Requeue all tagged commands for this target
2974 		 * currently in our posession so they can be
2975 		 * converted to untagged commands.
2976 		 */
2977 		ahc_search_qinfifo(ahc, SCB_TARGET(scb), SCB_CHANNEL(scb),
2978 				   SCB_LUN(scb), /*tag*/SCB_LIST_NULL,
2979 				   ROLE_INITIATOR, CAM_REQUEUE_REQ,
2980 				   SEARCH_COMPLETE);
2981 	} else {
2982 		/*
2983 		 * Otherwise, we ignore it.
2984 		 */
2985 		printf("%s:%c:%d: Message reject for %x -- ignored\n",
2986 		       ahc_name(ahc), devinfo->channel, devinfo->target,
2987 		       last_msg);
2988 	}
2989 	return (response);
2990 }
2991 
2992 static void
2993 ahc_clear_msg_state(struct ahc_softc *ahc)
2994 {
2995 	ahc->msgout_len = 0;
2996 	ahc->msgin_index = 0;
2997 	ahc->msg_type = MSG_TYPE_NONE;
2998 	ahc_outb(ahc, MSG_OUT, MSG_NOOP);
2999 }
3000 
3001 static void
3002 ahc_handle_message_phase(struct ahc_softc *ahc, struct cam_path *path)
3003 {
3004 	struct	ahc_devinfo devinfo;
3005 	u_int	bus_phase;
3006 	int	end_session;
3007 
3008 	ahc_fetch_devinfo(ahc, &devinfo);
3009 	end_session = FALSE;
3010 	bus_phase = ahc_inb(ahc, SCSISIGI) & PHASE_MASK;
3011 
3012 reswitch:
3013 	switch (ahc->msg_type) {
3014 	case MSG_TYPE_INITIATOR_MSGOUT:
3015 	{
3016 		int lastbyte;
3017 		int phasemis;
3018 		int msgdone;
3019 
3020 		if (ahc->msgout_len == 0)
3021 			panic("REQINIT interrupt with no active message");
3022 
3023 		phasemis = bus_phase != P_MESGOUT;
3024 		if (phasemis) {
3025 			if (bus_phase == P_MESGIN) {
3026 				/*
3027 				 * Change gears and see if
3028 				 * this messages is of interest to
3029 				 * us or should be passed back to
3030 				 * the sequencer.
3031 				 */
3032 				ahc_outb(ahc, CLRSINT1, CLRATNO);
3033 				ahc->send_msg_perror = FALSE;
3034 				ahc->msg_type = MSG_TYPE_INITIATOR_MSGIN;
3035 				ahc->msgin_index = 0;
3036 				goto reswitch;
3037 			}
3038 			end_session = TRUE;
3039 			break;
3040 		}
3041 
3042 		if (ahc->send_msg_perror) {
3043 			ahc_outb(ahc, CLRSINT1, CLRATNO);
3044 			ahc_outb(ahc, CLRSINT1, CLRREQINIT);
3045 			ahc_outb(ahc, SCSIDATL, MSG_PARITY_ERROR);
3046 			break;
3047 		}
3048 
3049 		msgdone	= ahc->msgout_index == ahc->msgout_len;
3050 		if (msgdone) {
3051 			/*
3052 			 * The target has requested a retry.
3053 			 * Re-assert ATN, reset our message index to
3054 			 * 0, and try again.
3055 			 */
3056 			ahc->msgout_index = 0;
3057 			ahc_outb(ahc, SCSISIGO, ahc_inb(ahc, SCSISIGO) | ATNO);
3058 		}
3059 
3060 		lastbyte = ahc->msgout_index == (ahc->msgout_len - 1);
3061 		if (lastbyte) {
3062 			/* Last byte is signified by dropping ATN */
3063 			ahc_outb(ahc, CLRSINT1, CLRATNO);
3064 		}
3065 
3066 		/*
3067 		 * Clear our interrupt status and present
3068 		 * the next byte on the bus.
3069 		 */
3070 		ahc_outb(ahc, CLRSINT1, CLRREQINIT);
3071 		ahc_outb(ahc, SCSIDATL, ahc->msgout_buf[ahc->msgout_index++]);
3072 		break;
3073 	}
3074 	case MSG_TYPE_INITIATOR_MSGIN:
3075 	{
3076 		int phasemis;
3077 		int message_done;
3078 
3079 		phasemis = bus_phase != P_MESGIN;
3080 
3081 		if (phasemis) {
3082 			ahc->msgin_index = 0;
3083 			if (bus_phase == P_MESGOUT
3084 			 && (ahc->send_msg_perror == TRUE
3085 			  || (ahc->msgout_len != 0
3086 			   && ahc->msgout_index == 0))) {
3087 				ahc->msg_type = MSG_TYPE_INITIATOR_MSGOUT;
3088 				goto reswitch;
3089 			}
3090 			end_session = TRUE;
3091 			break;
3092 		}
3093 
3094 		/* Pull the byte in without acking it */
3095 		ahc->msgin_buf[ahc->msgin_index] = ahc_inb(ahc, SCSIBUSL);
3096 
3097 		message_done = ahc_parse_msg(ahc, path, &devinfo);
3098 
3099 		if (message_done) {
3100 			/*
3101 			 * Clear our incoming message buffer in case there
3102 			 * is another message following this one.
3103 			 */
3104 			ahc->msgin_index = 0;
3105 
3106 			/*
3107 			 * If this message illicited a response,
3108 			 * assert ATN so the target takes us to the
3109 			 * message out phase.
3110 			 */
3111 			if (ahc->msgout_len != 0)
3112 				ahc_outb(ahc, SCSISIGO,
3113 					 ahc_inb(ahc, SCSISIGO) | ATNO);
3114 		}
3115 
3116 		/* Ack the byte */
3117 		ahc_outb(ahc, CLRSINT1, CLRREQINIT);
3118 		ahc_inb(ahc, SCSIDATL);
3119 		ahc->msgin_index++;
3120 		break;
3121 	}
3122 	case MSG_TYPE_TARGET_MSGIN:
3123 	{
3124 		int msgdone;
3125 		int msgout_request;
3126 
3127 		if (ahc->msgout_len == 0)
3128 			panic("Target MSGIN with no active message");
3129 
3130 		/*
3131 		 * If we interrupted a mesgout session, the initiator
3132 		 * will not know this until our first REQ.  So, we
3133 		 * only honor mesgout requests after we've sent our
3134 		 * first byte.
3135 		 */
3136 		if ((ahc_inb(ahc, SCSISIGI) & ATNI) != 0
3137 		 && ahc->msgout_index > 0)
3138 			msgout_request = TRUE;
3139 		else
3140 			msgout_request = FALSE;
3141 
3142 		if (msgout_request) {
3143 
3144 			/*
3145 			 * Change gears and see if
3146 			 * this messages is of interest to
3147 			 * us or should be passed back to
3148 			 * the sequencer.
3149 			 */
3150 			ahc->msg_type = MSG_TYPE_TARGET_MSGOUT;
3151 			ahc_outb(ahc, SCSISIGO, P_MESGOUT | BSYO);
3152 			ahc->msgin_index = 0;
3153 			/* Dummy read to REQ for first byte */
3154 			ahc_inb(ahc, SCSIDATL);
3155 			ahc_outb(ahc, SXFRCTL0,
3156 				 ahc_inb(ahc, SXFRCTL0) | SPIOEN);
3157 			break;
3158 		}
3159 
3160 		msgdone = ahc->msgout_index == ahc->msgout_len;
3161 		if (msgdone) {
3162 			ahc_outb(ahc, SXFRCTL0,
3163 				 ahc_inb(ahc, SXFRCTL0) & ~SPIOEN);
3164 			end_session = TRUE;
3165 			break;
3166 		}
3167 
3168 		/*
3169 		 * Present the next byte on the bus.
3170 		 */
3171 		ahc_outb(ahc, SXFRCTL0, ahc_inb(ahc, SXFRCTL0) | SPIOEN);
3172 		ahc_outb(ahc, SCSIDATL, ahc->msgout_buf[ahc->msgout_index++]);
3173 		break;
3174 	}
3175 	case MSG_TYPE_TARGET_MSGOUT:
3176 	{
3177 		int lastbyte;
3178 		int msgdone;
3179 
3180 		/*
3181 		 * The initiator signals that this is
3182 		 * the last byte by dropping ATN.
3183 		 */
3184 		lastbyte = (ahc_inb(ahc, SCSISIGI) & ATNI) == 0;
3185 
3186 		/*
3187 		 * Read the latched byte, but turn off SPIOEN first
3188 		 * so that we don't inadvertantly cause a REQ for the
3189 		 * next byte.
3190 		 */
3191 		ahc_outb(ahc, SXFRCTL0, ahc_inb(ahc, SXFRCTL0) & ~SPIOEN);
3192 		ahc->msgin_buf[ahc->msgin_index] = ahc_inb(ahc, SCSIDATL);
3193 		msgdone = ahc_parse_msg(ahc, path, &devinfo);
3194 		if (msgdone == MSGLOOP_TERMINATED) {
3195 			/*
3196 			 * The message is *really* done in that it caused
3197 			 * us to go to bus free.  The sequencer has already
3198 			 * been reset at this point, so pull the ejection
3199 			 * handle.
3200 			 */
3201 			return;
3202 		}
3203 
3204 		ahc->msgin_index++;
3205 
3206 		/*
3207 		 * XXX Read spec about initiator dropping ATN too soon
3208 		 *     and use msgdone to detect it.
3209 		 */
3210 		if (msgdone == MSGLOOP_MSGCOMPLETE) {
3211 			ahc->msgin_index = 0;
3212 
3213 			/*
3214 			 * If this message illicited a response, transition
3215 			 * to the Message in phase and send it.
3216 			 */
3217 			if (ahc->msgout_len != 0) {
3218 				ahc_outb(ahc, SCSISIGO, P_MESGIN | BSYO);
3219 				ahc_outb(ahc, SXFRCTL0,
3220 					 ahc_inb(ahc, SXFRCTL0) | SPIOEN);
3221 				ahc->msg_type = MSG_TYPE_TARGET_MSGIN;
3222 				ahc->msgin_index = 0;
3223 				break;
3224 			}
3225 		}
3226 
3227 		if (lastbyte)
3228 			end_session = TRUE;
3229 		else {
3230 			/* Ask for the next byte. */
3231 			ahc_outb(ahc, SXFRCTL0,
3232 				 ahc_inb(ahc, SXFRCTL0) | SPIOEN);
3233 		}
3234 
3235 		break;
3236 	}
3237 	default:
3238 		panic("Unknown REQINIT message type");
3239 	}
3240 
3241 	if (end_session) {
3242 		ahc_clear_msg_state(ahc);
3243 		ahc_outb(ahc, RETURN_1, EXIT_MSG_LOOP);
3244 	} else
3245 		ahc_outb(ahc, RETURN_1, CONT_MSG_LOOP);
3246 }
3247 
3248 /*
3249  * See if we sent a particular extended message to the target.
3250  * If "full" is true, the target saw the full message.
3251  * If "full" is false, the target saw at least the first
3252  * byte of the message.
3253  */
3254 static int
3255 ahc_sent_msg(struct ahc_softc *ahc, u_int msgtype, int full)
3256 {
3257 	int found;
3258 	int index;
3259 
3260 	found = FALSE;
3261 	index = 0;
3262 
3263 	while (index < ahc->msgout_len) {
3264 		if ((ahc->msgout_buf[index] & MSG_IDENTIFYFLAG) != 0
3265 		 || ahc->msgout_buf[index] == MSG_MESSAGE_REJECT)
3266 			index++;
3267 		else if (ahc->msgout_buf[index] >= MSG_SIMPLE_Q_TAG
3268 		      && ahc->msgout_buf[index] < MSG_IGN_WIDE_RESIDUE) {
3269 			/* Skip tag type and tag id */
3270 			index += 2;
3271 		} else if (ahc->msgout_buf[index] == MSG_EXTENDED) {
3272 			/* Found a candidate */
3273 			if (ahc->msgout_buf[index+2] == msgtype) {
3274 				u_int end_index;
3275 
3276 				end_index = index + 1
3277 					  + ahc->msgout_buf[index + 1];
3278 				if (full) {
3279 					if (ahc->msgout_index > end_index)
3280 						found = TRUE;
3281 				} else if (ahc->msgout_index > index)
3282 					found = TRUE;
3283 			}
3284 			break;
3285 		} else {
3286 			panic("ahc_sent_msg: Inconsistent msg buffer");
3287 		}
3288 	}
3289 	return (found);
3290 }
3291 
3292 static int
3293 ahc_parse_msg(struct ahc_softc *ahc, struct cam_path *path,
3294 	      struct ahc_devinfo *devinfo)
3295 {
3296 	struct	ahc_initiator_tinfo *tinfo;
3297 	struct	tmode_tstate *tstate;
3298 	int	reject;
3299 	int	done;
3300 	int	response;
3301 	u_int	targ_scsirate;
3302 
3303 	done = MSGLOOP_IN_PROG;
3304 	response = FALSE;
3305 	reject = FALSE;
3306 	tinfo = ahc_fetch_transinfo(ahc, devinfo->channel, devinfo->our_scsiid,
3307 				    devinfo->target, &tstate);
3308 	targ_scsirate = tinfo->scsirate;
3309 
3310 	/*
3311 	 * Parse as much of the message as is availible,
3312 	 * rejecting it if we don't support it.  When
3313 	 * the entire message is availible and has been
3314 	 * handled, return TRUE indicating that we have
3315 	 * parsed an entire message.
3316 	 *
3317 	 * In the case of extended messages, we accept the length
3318 	 * byte outright and perform more checking once we know the
3319 	 * extended message type.
3320 	 */
3321 	switch (ahc->msgin_buf[0]) {
3322 	case MSG_MESSAGE_REJECT:
3323 		response = ahc_handle_msg_reject(ahc, devinfo);
3324 		/* FALLTHROUGH */
3325 	case MSG_NOOP:
3326 		done = MSGLOOP_MSGCOMPLETE;
3327 		break;
3328 	case MSG_IGN_WIDE_RESIDUE:
3329 	{
3330 		/* Wait for the whole message */
3331 		if (ahc->msgin_index >= 1) {
3332 			if (ahc->msgin_buf[1] != 1
3333 			 || tinfo->current.width == MSG_EXT_WDTR_BUS_8_BIT) {
3334 				reject = TRUE;
3335 				done = MSGLOOP_MSGCOMPLETE;
3336 			} else
3337 				ahc_handle_ign_wide_residue(ahc, devinfo);
3338 		}
3339 		break;
3340 	}
3341 	case MSG_EXTENDED:
3342 	{
3343 		/* Wait for enough of the message to begin validation */
3344 		if (ahc->msgin_index < 2)
3345 			break;
3346 		switch (ahc->msgin_buf[2]) {
3347 		case MSG_EXT_SDTR:
3348 		{
3349 			struct	 ahc_syncrate *syncrate;
3350 			u_int	 period;
3351 			u_int	 offset;
3352 			u_int	 saved_offset;
3353 
3354 			if (ahc->msgin_buf[1] != MSG_EXT_SDTR_LEN) {
3355 				reject = TRUE;
3356 				break;
3357 			}
3358 
3359 			/*
3360 			 * Wait until we have both args before validating
3361 			 * and acting on this message.
3362 			 *
3363 			 * Add one to MSG_EXT_SDTR_LEN to account for
3364 			 * the extended message preamble.
3365 			 */
3366 			if (ahc->msgin_index < (MSG_EXT_SDTR_LEN + 1))
3367 				break;
3368 
3369 			period = ahc->msgin_buf[3];
3370 			saved_offset = offset = ahc->msgin_buf[4];
3371 			syncrate = ahc_devlimited_syncrate(ahc, &period);
3372 			ahc_validate_offset(ahc, syncrate, &offset,
3373 					    targ_scsirate & WIDEXFER);
3374 			ahc_set_syncrate(ahc, devinfo, path,
3375 					 syncrate, period, offset,
3376 					 AHC_TRANS_ACTIVE|AHC_TRANS_GOAL,
3377 					 /*paused*/TRUE);
3378 
3379 			/*
3380 			 * See if we initiated Sync Negotiation
3381 			 * and didn't have to fall down to async
3382 			 * transfers.
3383 			 */
3384 			if (ahc_sent_msg(ahc, MSG_EXT_SDTR, /*full*/TRUE)) {
3385 				/* We started it */
3386 				if (saved_offset != offset) {
3387 					/* Went too low - force async */
3388 					reject = TRUE;
3389 				}
3390 			} else {
3391 				/*
3392 				 * Send our own SDTR in reply
3393 				 */
3394 				if (bootverbose)
3395 					printf("Sending SDTR!\n");
3396 				ahc->msgout_index = 0;
3397 				ahc->msgout_len = 0;
3398 				ahc_construct_sdtr(ahc, period, offset);
3399 				ahc->msgout_index = 0;
3400 				response = TRUE;
3401 			}
3402 			done = MSGLOOP_MSGCOMPLETE;
3403 			break;
3404 		}
3405 		case MSG_EXT_WDTR:
3406 		{
3407 			u_int	bus_width;
3408 			u_int	sending_reply;
3409 
3410 			sending_reply = FALSE;
3411 			if (ahc->msgin_buf[1] != MSG_EXT_WDTR_LEN) {
3412 				reject = TRUE;
3413 				break;
3414 			}
3415 
3416 			/*
3417 			 * Wait until we have our arg before validating
3418 			 * and acting on this message.
3419 			 *
3420 			 * Add one to MSG_EXT_WDTR_LEN to account for
3421 			 * the extended message preamble.
3422 			 */
3423 			if (ahc->msgin_index < (MSG_EXT_WDTR_LEN + 1))
3424 				break;
3425 
3426 			/*
3427 			 * Due to a problem with sync/wide transfers
3428 			 * on the aic7880 only allow this on Ultra2
3429 			 * controllers for the moment.
3430 			 */
3431 			if (devinfo->role == ROLE_TARGET
3432 			 && (ahc->features & AHC_ULTRA2) == 0) {
3433 				reject = TRUE;
3434 				break;
3435 			}
3436 
3437 			bus_width = ahc->msgin_buf[3];
3438 			if (ahc_sent_msg(ahc, MSG_EXT_WDTR, /*full*/TRUE)) {
3439 				/*
3440 				 * Don't send a WDTR back to the
3441 				 * target, since we asked first.
3442 				 */
3443 				switch (bus_width){
3444 				default:
3445 					/*
3446 					 * How can we do anything greater
3447 					 * than 16bit transfers on a 16bit
3448 					 * bus?
3449 					 */
3450 					reject = TRUE;
3451 					printf("%s: target %d requested %dBit "
3452 					       "transfers.  Rejecting...\n",
3453 					       ahc_name(ahc), devinfo->target,
3454 					       8 * (0x01 << bus_width));
3455 					/* FALLTHROUGH */
3456 				case MSG_EXT_WDTR_BUS_8_BIT:
3457 					bus_width = MSG_EXT_WDTR_BUS_8_BIT;
3458 					break;
3459 				case MSG_EXT_WDTR_BUS_16_BIT:
3460 					break;
3461 				}
3462 			} else {
3463 				/*
3464 				 * Send our own WDTR in reply
3465 				 */
3466 				if (bootverbose)
3467 					printf("Sending WDTR!\n");
3468 				switch (bus_width) {
3469 				default:
3470 					if (ahc->features & AHC_WIDE) {
3471 						/* Respond Wide */
3472 						bus_width =
3473 						    MSG_EXT_WDTR_BUS_16_BIT;
3474 						break;
3475 					}
3476 					/* FALLTHROUGH */
3477 				case MSG_EXT_WDTR_BUS_8_BIT:
3478 					bus_width = MSG_EXT_WDTR_BUS_8_BIT;
3479 					break;
3480 				}
3481 				ahc->msgout_index = 0;
3482 				ahc->msgout_len = 0;
3483 				ahc_construct_wdtr(ahc, bus_width);
3484 				ahc->msgout_index = 0;
3485 				response = TRUE;
3486 				sending_reply = TRUE;
3487 			}
3488 			ahc_set_width(ahc, devinfo, path, bus_width,
3489 				      AHC_TRANS_ACTIVE|AHC_TRANS_GOAL,
3490 				      /*paused*/TRUE);
3491 
3492 			/* After a wide message, we are async */
3493 			ahc_set_syncrate(ahc, devinfo, path,
3494 					 /*syncrate*/NULL, /*period*/0,
3495 					 /*offset*/0, AHC_TRANS_ACTIVE,
3496 					 /*paused*/TRUE);
3497 			if (sending_reply == FALSE && reject == FALSE) {
3498 
3499 				if (tinfo->goal.period) {
3500 					struct	ahc_syncrate *rate;
3501 					u_int	period;
3502 					u_int	offset;
3503 
3504 					/* Start the sync negotiation */
3505 					period = tinfo->goal.period;
3506 					rate = ahc_devlimited_syncrate(ahc,
3507 								       &period);
3508 					offset = tinfo->goal.offset;
3509 					ahc_validate_offset(ahc, rate, &offset,
3510 							  tinfo->current.width);
3511 					ahc->msgout_index = 0;
3512 					ahc->msgout_len = 0;
3513 					ahc_construct_sdtr(ahc, period, offset);
3514 					ahc->msgout_index = 0;
3515 					response = TRUE;
3516 				}
3517 			}
3518 			done = MSGLOOP_MSGCOMPLETE;
3519 			break;
3520 		}
3521 		default:
3522 			/* Unknown extended message.  Reject it. */
3523 			reject = TRUE;
3524 			break;
3525 		}
3526 		break;
3527 	}
3528 	case MSG_BUS_DEV_RESET:
3529 		ahc_handle_devreset(ahc, devinfo,
3530 				    CAM_BDR_SENT, AC_SENT_BDR,
3531 				    "Bus Device Reset Received",
3532 				    /*verbose_only*/FALSE);
3533 		restart_sequencer(ahc);
3534 		done = MSGLOOP_TERMINATED;
3535 		break;
3536 	case MSG_ABORT_TAG:
3537 	case MSG_ABORT:
3538 	case MSG_CLEAR_QUEUE:
3539 		/* Target mode messages */
3540 		if (devinfo->role != ROLE_TARGET) {
3541 			reject = TRUE;
3542 			break;
3543 		}
3544 		ahc_abort_scbs(ahc, devinfo->target, devinfo->channel,
3545 			       devinfo->lun,
3546 			       ahc->msgin_buf[0] == MSG_ABORT_TAG
3547 						  ? SCB_LIST_NULL
3548 						  : ahc_inb(ahc, INITIATOR_TAG),
3549 			       ROLE_TARGET, CAM_REQ_ABORTED);
3550 
3551 		tstate = ahc->enabled_targets[devinfo->our_scsiid];
3552 		if (tstate != NULL) {
3553 			struct tmode_lstate* lstate;
3554 
3555 			lstate = tstate->enabled_luns[devinfo->lun];
3556 			if (lstate != NULL) {
3557 				ahc_queue_lstate_event(ahc, lstate,
3558 						       devinfo->our_scsiid,
3559 						       ahc->msgin_buf[0],
3560 						       /*arg*/0);
3561 				ahc_send_lstate_events(ahc, lstate);
3562 			}
3563 		}
3564 		done = MSGLOOP_MSGCOMPLETE;
3565 		break;
3566 	case MSG_TERM_IO_PROC:
3567 	default:
3568 		reject = TRUE;
3569 		break;
3570 	}
3571 
3572 	if (reject) {
3573 		/*
3574 		 * Setup to reject the message.
3575 		 */
3576 		ahc->msgout_index = 0;
3577 		ahc->msgout_len = 1;
3578 		ahc->msgout_buf[0] = MSG_MESSAGE_REJECT;
3579 		done = MSGLOOP_MSGCOMPLETE;
3580 		response = TRUE;
3581 	}
3582 
3583 	if (done != MSGLOOP_IN_PROG && !response)
3584 		/* Clear the outgoing message buffer */
3585 		ahc->msgout_len = 0;
3586 
3587 	return (done);
3588 }
3589 
3590 static void
3591 ahc_handle_ign_wide_residue(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
3592 {
3593 	u_int scb_index;
3594 	struct scb *scb;
3595 
3596 	scb_index = ahc_inb(ahc, SCB_TAG);
3597 	scb = &ahc->scb_data->scbarray[scb_index];
3598 	if ((ahc_inb(ahc, SEQ_FLAGS) & DPHASE) == 0
3599 	 || (scb->ccb->ccb_h.flags & CAM_DIR_MASK) != CAM_DIR_IN) {
3600 		/*
3601 		 * Ignore the message if we haven't
3602 		 * seen an appropriate data phase yet.
3603 		 */
3604 	} else {
3605 		/*
3606 		 * If the residual occurred on the last
3607 		 * transfer and the transfer request was
3608 		 * expected to end on an odd count, do
3609 		 * nothing.  Otherwise, subtract a byte
3610 		 * and update the residual count accordingly.
3611 		 */
3612 		u_int resid_sgcnt;
3613 
3614 		resid_sgcnt = ahc_inb(ahc, SCB_RESID_SGCNT);
3615 		if (resid_sgcnt == 0
3616 		 && ahc_inb(ahc, DATA_COUNT_ODD) == 1) {
3617 			/*
3618 			 * If the residual occurred on the last
3619 			 * transfer and the transfer request was
3620 			 * expected to end on an odd count, do
3621 			 * nothing.
3622 			 */
3623 		} else {
3624 			u_int data_cnt;
3625 			u_int data_addr;
3626 			u_int sg_index;
3627 
3628 			data_cnt = (ahc_inb(ahc, SCB_RESID_DCNT + 2) << 16)
3629 				 | (ahc_inb(ahc, SCB_RESID_DCNT + 1) << 8)
3630 				 | (ahc_inb(ahc, SCB_RESID_DCNT));
3631 
3632 			data_addr = (ahc_inb(ahc, SHADDR + 3) << 24)
3633 				  | (ahc_inb(ahc, SHADDR + 2) << 16)
3634 				  | (ahc_inb(ahc, SHADDR + 1) << 8)
3635 				  | (ahc_inb(ahc, SHADDR));
3636 
3637 			data_cnt += 1;
3638 			data_addr -= 1;
3639 
3640 			sg_index = scb->sg_count - resid_sgcnt;
3641 
3642 			/*
3643 			 * scb->sg_list starts with the second S/G entry.
3644 			 */
3645 			if (sg_index-- != 0
3646 			 && (scb->sg_list[sg_index].len < data_cnt)) {
3647 				u_int sg_addr;
3648 
3649 				data_cnt = 1;
3650 				data_addr = scb->sg_list[sg_index - 1].addr
3651 					  + scb->sg_list[sg_index - 1].len - 1;
3652 
3653 				sg_addr = scb->sg_list_phys
3654 					+ (sg_index * sizeof(*scb->sg_list));
3655 				ahc_outb(ahc, SG_NEXT + 3, sg_addr >> 24);
3656 				ahc_outb(ahc, SG_NEXT + 2, sg_addr >> 16);
3657 				ahc_outb(ahc, SG_NEXT + 1, sg_addr >> 8);
3658 				ahc_outb(ahc, SG_NEXT, sg_addr);
3659 			}
3660 
3661 			ahc_outb(ahc, SCB_RESID_DCNT + 2, data_cnt >> 16);
3662 			ahc_outb(ahc, SCB_RESID_DCNT + 1, data_cnt >> 8);
3663 			ahc_outb(ahc, SCB_RESID_DCNT, data_cnt);
3664 
3665 			ahc_outb(ahc, SHADDR + 3, data_addr >> 24);
3666 			ahc_outb(ahc, SHADDR + 2, data_addr >> 16);
3667 			ahc_outb(ahc, SHADDR + 1, data_addr >> 8);
3668 			ahc_outb(ahc, SHADDR, data_addr);
3669 		}
3670 	}
3671 }
3672 
3673 static void
3674 ahc_handle_devreset(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
3675 		    cam_status status, ac_code acode, char *message,
3676 		    int verbose_only)
3677 {
3678 	struct cam_path *path;
3679 	int found;
3680 	int error;
3681 	struct tmode_tstate* tstate;
3682 	u_int lun;
3683 
3684 
3685 	error = ahc_create_path(ahc, devinfo, &path);
3686 
3687 	found = ahc_abort_scbs(ahc, devinfo->target, devinfo->channel,
3688 			       CAM_LUN_WILDCARD, SCB_LIST_NULL, devinfo->role,
3689 			       status);
3690 
3691 	/*
3692 	 * Send an immediate notify ccb to all target more peripheral
3693 	 * drivers affected by this action.
3694 	 */
3695 	tstate = ahc->enabled_targets[devinfo->our_scsiid];
3696 	if (tstate != NULL) {
3697 		for (lun = 0; lun <= 7; lun++) {
3698 			struct tmode_lstate* lstate;
3699 
3700 			lstate = tstate->enabled_luns[lun];
3701 			if (lstate == NULL)
3702 				continue;
3703 
3704 			ahc_queue_lstate_event(ahc, lstate, devinfo->our_scsiid,
3705 					       MSG_BUS_DEV_RESET, /*arg*/0);
3706 			ahc_send_lstate_events(ahc, lstate);
3707 		}
3708 	}
3709 
3710 	/*
3711 	 * Go back to async/narrow transfers and renegotiate.
3712 	 * ahc_set_width and ahc_set_syncrate can cope with NULL
3713 	 * paths.
3714 	 */
3715 	ahc_set_width(ahc, devinfo, path, MSG_EXT_WDTR_BUS_8_BIT,
3716 		      AHC_TRANS_CUR, /*paused*/TRUE);
3717 	ahc_set_syncrate(ahc, devinfo, path, /*syncrate*/NULL,
3718 			 /*period*/0, /*offset*/0, AHC_TRANS_CUR,
3719 			 /*paused*/TRUE);
3720 
3721 	if (error == CAM_REQ_CMP && acode != 0)
3722 		xpt_async(AC_SENT_BDR, path, NULL);
3723 
3724 	if (error == CAM_REQ_CMP)
3725 		xpt_free_path(path);
3726 
3727 	if (message != NULL
3728 	 && (verbose_only == 0 || bootverbose != 0))
3729 		printf("%s: %s on %c:%d. %d SCBs aborted\n", ahc_name(ahc),
3730 		       message, devinfo->channel, devinfo->target, found);
3731 }
3732 
3733 /*
3734  * We have an scb which has been processed by the
3735  * adaptor, now we look to see how the operation
3736  * went.
3737  */
3738 static void
3739 ahc_done(struct ahc_softc *ahc, struct scb *scb)
3740 {
3741 	union ccb *ccb;
3742 
3743 	CAM_DEBUG(scb->ccb->ccb_h.path, CAM_DEBUG_TRACE,
3744 		  ("ahc_done - scb %d\n", scb->hscb->tag));
3745 
3746 	ccb = scb->ccb;
3747 	LIST_REMOVE(&ccb->ccb_h, sim_links.le);
3748 
3749 	untimeout(ahc_timeout, (caddr_t)scb, ccb->ccb_h.timeout_ch);
3750 
3751 	if ((ccb->ccb_h.flags & CAM_DIR_MASK) != CAM_DIR_NONE) {
3752 		bus_dmasync_op_t op;
3753 
3754 		if ((ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN)
3755 			op = BUS_DMASYNC_POSTREAD;
3756 		else
3757 			op = BUS_DMASYNC_POSTWRITE;
3758 		bus_dmamap_sync(ahc->buffer_dmat, scb->dmamap, op);
3759 		bus_dmamap_unload(ahc->buffer_dmat, scb->dmamap);
3760 	}
3761 
3762 	/*
3763 	 * Unbusy this target/channel/lun.
3764 	 * XXX if we are holding two commands per lun,
3765 	 *     send the next command.
3766 	 */
3767 	ahc_index_busy_tcl(ahc, scb->hscb->tcl, /*unbusy*/TRUE);
3768 
3769 	if (ccb->ccb_h.func_code == XPT_CONT_TARGET_IO) {
3770 		if (ahc_ccb_status(ccb) == CAM_REQ_INPROG)
3771 			ccb->ccb_h.status |= CAM_REQ_CMP;
3772 		ccb->ccb_h.status &= ~CAM_SIM_QUEUED;
3773 		ahcfreescb(ahc, scb);
3774 		xpt_done(ccb);
3775 		return;
3776 	}
3777 
3778 	/*
3779 	 * If the recovery SCB completes, we have to be
3780 	 * out of our timeout.
3781 	 */
3782 	if ((scb->flags & SCB_RECOVERY_SCB) != 0) {
3783 
3784 		struct	ccb_hdr *ccbh;
3785 
3786 		/*
3787 		 * We were able to complete the command successfully,
3788 		 * so reinstate the timeouts for all other pending
3789 		 * commands.
3790 		 */
3791 		ccbh = ahc->pending_ccbs.lh_first;
3792 		while (ccbh != NULL) {
3793 			struct scb *pending_scb;
3794 
3795 			pending_scb = (struct scb *)ccbh->ccb_scb_ptr;
3796 			ccbh->timeout_ch =
3797 			    timeout(ahc_timeout, pending_scb,
3798 				    (ccbh->timeout * hz)/1000);
3799 			ccbh = LIST_NEXT(ccbh, sim_links.le);
3800 		}
3801 
3802 		/*
3803 		 * Ensure that we didn't put a second instance of this
3804 		 * SCB into the QINFIFO.
3805 		 */
3806 		ahc_search_qinfifo(ahc, SCB_TARGET(scb), SCB_CHANNEL(scb),
3807 				   SCB_LUN(scb), scb->hscb->tag,
3808 				   ROLE_INITIATOR, /*status*/0,
3809 				   SEARCH_REMOVE);
3810 		if (ahc_ccb_status(ccb) == CAM_BDR_SENT)
3811 			ahcsetccbstatus(ccb, CAM_CMD_TIMEOUT);
3812 		xpt_print_path(ccb->ccb_h.path);
3813 		printf("no longer in timeout, status = %x\n",
3814 		       ccb->ccb_h.status);
3815 	}
3816 
3817 	/* Don't clobber any existing error state */
3818 	if (ahc_ccb_status(ccb) == CAM_REQ_INPROG) {
3819 		ccb->ccb_h.status |= CAM_REQ_CMP;
3820 	} else if ((scb->flags & SCB_SENSE) != 0) {
3821 		/*
3822 		 * We performed autosense retrieval.
3823 		 *
3824 		 * bzero the sense data before having
3825 		 * the drive fill it.  The SCSI spec mandates
3826 		 * that any untransfered data should be
3827 		 * assumed to be zero.  Complete the 'bounce'
3828 		 * of sense information through buffers accessible
3829 		 * via bus-space by copying it into the clients
3830 		 * csio.
3831 		 */
3832 		bzero(&ccb->csio.sense_data, sizeof(ccb->csio.sense_data));
3833 		bcopy(&ahc->scb_data->sense[scb->hscb->tag],
3834 		      &ccb->csio.sense_data, scb->sg_list->len);
3835 		scb->ccb->ccb_h.status |= CAM_AUTOSNS_VALID;
3836 	}
3837 	ccb->ccb_h.status &= ~CAM_SIM_QUEUED;
3838 	ahcfreescb(ahc, scb);
3839 	xpt_done(ccb);
3840 }
3841 
3842 /*
3843  * Determine the number of SCBs available on the controller
3844  */
3845 int
3846 ahc_probe_scbs(struct ahc_softc *ahc) {
3847 	int i;
3848 
3849 	for (i = 0; i < AHC_SCB_MAX; i++) {
3850 		ahc_outb(ahc, SCBPTR, i);
3851 		ahc_outb(ahc, SCB_CONTROL, i);
3852 		if (ahc_inb(ahc, SCB_CONTROL) != i)
3853 			break;
3854 		ahc_outb(ahc, SCBPTR, 0);
3855 		if (ahc_inb(ahc, SCB_CONTROL) != 0)
3856 			break;
3857 	}
3858 
3859 	return (i);
3860 }
3861 
3862 /*
3863  * Start the board, ready for normal operation
3864  */
3865 int
3866 ahc_init(struct ahc_softc *ahc)
3867 {
3868 	int	  max_targ = 15;
3869 	int	  i;
3870 	int	  term;
3871 	u_int	  scsi_conf;
3872 	u_int	  scsiseq_template;
3873 	u_int	  ultraenb;
3874 	u_int	  discenable;
3875 	u_int	  tagenable;
3876 	size_t	  driver_data_size;
3877 	u_int32_t physaddr;
3878 
3879 #ifdef AHC_PRINT_SRAM
3880 	printf("Scratch Ram:");
3881 	for (i = 0x20; i < 0x5f; i++) {
3882 		if (((i % 8) == 0) && (i != 0)) {
3883 			printf ("\n              ");
3884 		}
3885 		printf (" 0x%x", ahc_inb(ahc, i));
3886 	}
3887 	if ((ahc->features & AHC_MORE_SRAM) != 0) {
3888 		for (i = 0x70; i < 0x7f; i++) {
3889 			if (((i % 8) == 0) && (i != 0)) {
3890 				printf ("\n              ");
3891 			}
3892 			printf (" 0x%x", ahc_inb(ahc, i));
3893 		}
3894 	}
3895 	printf ("\n");
3896 #endif
3897 
3898 	/*
3899 	 * Assume we have a board at this stage and it has been reset.
3900 	 */
3901 	if ((ahc->flags & AHC_USEDEFAULTS) != 0) {
3902 		ahc->our_id = ahc->our_id_b = 7;
3903 	}
3904 
3905 	/*
3906 	 * Default to allowing initiator operations.
3907 	 */
3908 	ahc->flags |= AHC_INITIATORMODE;
3909 
3910 	/*
3911 	 * XXX Would be better to use a per device flag, but PCI and EISA
3912 	 *     devices don't have them yet.
3913 	 */
3914 	if ((AHC_TMODE_ENABLE & (0x01 << ahc->unit)) != 0) {
3915 		ahc->flags |= AHC_TARGETMODE;
3916 		/*
3917 		 * Although we have space for both the initiator and
3918 		 * target roles on ULTRA2 chips, we currently disable
3919 		 * the initiator role to allow multi-scsi-id target mode
3920 		 * configurations.  We can only respond on the same SCSI
3921 		 * ID as our initiator role if we allow initiator operation.
3922 		 * At some point, we should add a configuration knob to
3923 		 * allow both roles to be loaded.
3924 		 */
3925 		ahc->flags &= ~AHC_INITIATORMODE;
3926 	}
3927 
3928 	/* DMA tag for mapping buffers into device visible space. */
3929 	if (bus_dma_tag_create(ahc->parent_dmat, /*alignment*/1, /*boundary*/0,
3930 			       /*lowaddr*/BUS_SPACE_MAXADDR,
3931 			       /*highaddr*/BUS_SPACE_MAXADDR,
3932 			       /*filter*/NULL, /*filterarg*/NULL,
3933 			       /*maxsize*/MAXBSIZE, /*nsegments*/AHC_NSEG,
3934 			       /*maxsegsz*/AHC_MAXTRANSFER_SIZE,
3935 			       /*flags*/BUS_DMA_ALLOCNOW,
3936 			       &ahc->buffer_dmat) != 0) {
3937 		return (ENOMEM);
3938 	}
3939 
3940 	ahc->init_level++;
3941 
3942 	/*
3943 	 * DMA tag for our command fifos and other data in system memory
3944 	 * the card's sequencer must be able to access.  For initiator
3945 	 * roles, we need to allocate space for the qinfifo, qoutfifo,
3946 	 * and untagged_scb arrays each of which are composed of 256
3947 	 * 1 byte elements.  When providing for the target mode role,
3948 	 * we additionally must provide space for the incoming target
3949 	 * command fifo.
3950 	 */
3951 	driver_data_size = 3 * 256 * sizeof(u_int8_t);
3952 	if ((ahc->flags & AHC_TARGETMODE) != 0)
3953 		driver_data_size += AHC_TMODE_CMDS * sizeof(struct target_cmd);
3954 	if (bus_dma_tag_create(ahc->parent_dmat, /*alignment*/1, /*boundary*/0,
3955 			       /*lowaddr*/BUS_SPACE_MAXADDR,
3956 			       /*highaddr*/BUS_SPACE_MAXADDR,
3957 			       /*filter*/NULL, /*filterarg*/NULL,
3958 			       driver_data_size,
3959 			       /*nsegments*/1,
3960 			       /*maxsegsz*/BUS_SPACE_MAXSIZE_32BIT,
3961 			       /*flags*/0, &ahc->shared_data_dmat) != 0) {
3962 		return (ENOMEM);
3963 	}
3964 
3965 	ahc->init_level++;
3966 
3967 	/* Allocation of driver data */
3968 	if (bus_dmamem_alloc(ahc->shared_data_dmat, (void **)&ahc->qoutfifo,
3969 			     BUS_DMA_NOWAIT, &ahc->shared_data_dmamap) != 0) {
3970 		return (ENOMEM);
3971 	}
3972 
3973 	ahc->init_level++;
3974 
3975         /* And permanently map it in */
3976 	bus_dmamap_load(ahc->shared_data_dmat, ahc->shared_data_dmamap,
3977 			ahc->qoutfifo, driver_data_size,
3978 			ahcdmamapcb, &ahc->shared_data_busaddr, /*flags*/0);
3979 
3980 	ahc->init_level++;
3981 
3982 	/* Allocate SCB data now that buffer_dmat is initialized) */
3983 	if (ahc->scb_data->maxhscbs == 0)
3984 		if (ahcinitscbdata(ahc) != 0)
3985 			return (ENOMEM);
3986 
3987 	ahc->qinfifo = &ahc->qoutfifo[256];
3988 	ahc->untagged_scbs = &ahc->qinfifo[256];
3989 	/* There are no untagged SCBs active yet. */
3990 	for (i = 0; i < 256; i++)
3991 		ahc->untagged_scbs[i] = SCB_LIST_NULL;
3992 
3993 	/* All of our queues are empty */
3994 	for (i = 0; i < 256; i++)
3995 		ahc->qoutfifo[i] = SCB_LIST_NULL;
3996 
3997 	if ((ahc->flags & AHC_TARGETMODE) != 0) {
3998 		ahc->targetcmds = (struct target_cmd *)&ahc->untagged_scbs[256];
3999 
4000 		/* All target command blocks start out invalid. */
4001 		for (i = 0; i < AHC_TMODE_CMDS; i++)
4002 			ahc->targetcmds[i].cmd_valid = 0;
4003 		ahc_outb(ahc, KERNEL_TQINPOS, ahc->tqinfifonext - 1);
4004 		ahc_outb(ahc, TQINPOS, 0);
4005 	}
4006 
4007 	/*
4008 	 * Allocate a tstate to house information for our
4009 	 * initiator presence on the bus as well as the user
4010 	 * data for any target mode initiator.
4011 	 */
4012 	if (ahc_alloc_tstate(ahc, ahc->our_id, 'A') == NULL) {
4013 		printf("%s: unable to allocate tmode_tstate.  "
4014 		       "Failing attach\n", ahc_name(ahc));
4015 		return (-1);
4016 	}
4017 
4018 	if ((ahc->features & AHC_TWIN) != 0) {
4019 		if (ahc_alloc_tstate(ahc, ahc->our_id_b, 'B') == NULL) {
4020 			printf("%s: unable to allocate tmode_tstate.  "
4021 			       "Failing attach\n", ahc_name(ahc));
4022 			return (-1);
4023 		}
4024  		printf("Twin Channel, A SCSI Id=%d, B SCSI Id=%d, primary %c, ",
4025 		       ahc->our_id, ahc->our_id_b,
4026 		       ahc->flags & AHC_CHANNEL_B_PRIMARY? 'B': 'A');
4027 	} else {
4028 		if ((ahc->features & AHC_WIDE) != 0) {
4029 			printf("Wide ");
4030 		} else {
4031 			printf("Single ");
4032 		}
4033 		printf("Channel %c, SCSI Id=%d, ", ahc->channel, ahc->our_id);
4034 	}
4035 
4036 	ahc_outb(ahc, SEQ_FLAGS, 0);
4037 
4038 	if (ahc->scb_data->maxhscbs < AHC_SCB_MAX) {
4039 		ahc->flags |= AHC_PAGESCBS;
4040 		printf("%d/%d SCBs\n", ahc->scb_data->maxhscbs, AHC_SCB_MAX);
4041 	} else {
4042 		ahc->flags &= ~AHC_PAGESCBS;
4043 		printf("%d SCBs\n", ahc->scb_data->maxhscbs);
4044 	}
4045 
4046 #ifdef AHC_DEBUG
4047 	if (ahc_debug & AHC_SHOWMISC) {
4048 		printf("%s: hardware scb %d bytes; kernel scb %d bytes; "
4049 		       "ahc_dma %d bytes\n",
4050 			ahc_name(ahc),
4051 		        sizeof(struct hardware_scb),
4052 			sizeof(struct scb),
4053 			sizeof(struct ahc_dma_seg));
4054 	}
4055 #endif /* AHC_DEBUG */
4056 
4057 	/* Set the SCSI Id, SXFRCTL0, SXFRCTL1, and SIMODE1, for both channels*/
4058 	if (ahc->features & AHC_TWIN) {
4059 
4060 		/*
4061 		 * The device is gated to channel B after a chip reset,
4062 		 * so set those values first
4063 		 */
4064 		term = (ahc->flags & AHC_TERM_ENB_B) != 0 ? STPWEN : 0;
4065 		if ((ahc->features & AHC_ULTRA2) != 0)
4066 			ahc_outb(ahc, SCSIID_ULTRA2, ahc->our_id_b);
4067 		else
4068 			ahc_outb(ahc, SCSIID, ahc->our_id_b);
4069 		scsi_conf = ahc_inb(ahc, SCSICONF + 1);
4070 		ahc_outb(ahc, SXFRCTL1, (scsi_conf & (ENSPCHK|STIMESEL))
4071 					|term|ENSTIMER|ACTNEGEN);
4072 		ahc_outb(ahc, SIMODE1, ENSELTIMO|ENSCSIRST|ENSCSIPERR);
4073 		ahc_outb(ahc, SXFRCTL0, DFON|SPIOEN);
4074 
4075 		if ((scsi_conf & RESET_SCSI) != 0
4076 		 && (ahc->flags & AHC_INITIATORMODE) != 0)
4077 			ahc->flags |= AHC_RESET_BUS_B;
4078 
4079 		/* Select Channel A */
4080 		ahc_outb(ahc, SBLKCTL, ahc_inb(ahc, SBLKCTL) & ~SELBUSB);
4081 	}
4082 	term = (ahc->flags & AHC_TERM_ENB_A) != 0 ? STPWEN : 0;
4083 	if ((ahc->features & AHC_ULTRA2) != 0)
4084 		ahc_outb(ahc, SCSIID_ULTRA2, ahc->our_id);
4085 	else
4086 		ahc_outb(ahc, SCSIID, ahc->our_id);
4087 	scsi_conf = ahc_inb(ahc, SCSICONF);
4088 	ahc_outb(ahc, SXFRCTL1, (scsi_conf & (ENSPCHK|STIMESEL))
4089 				|term
4090 				|ENSTIMER|ACTNEGEN);
4091 	ahc_outb(ahc, SIMODE1, ENSELTIMO|ENSCSIRST|ENSCSIPERR);
4092 	ahc_outb(ahc, SXFRCTL0, DFON|SPIOEN);
4093 
4094 	if ((scsi_conf & RESET_SCSI) != 0
4095 	 && (ahc->flags & AHC_INITIATORMODE) != 0)
4096 		ahc->flags |= AHC_RESET_BUS_A;
4097 
4098 	/*
4099 	 * Look at the information that board initialization or
4100 	 * the board bios has left us.  In the lower four bits of each
4101 	 * target's scratch space any value other than 0 indicates
4102 	 * that we should initiate synchronous transfers.  If it's zero,
4103 	 * the user or the BIOS has decided to disable synchronous
4104 	 * negotiation to that target so we don't activate the needsdtr
4105 	 * flag.
4106 	 */
4107 	ultraenb = 0;
4108 	tagenable = ALL_TARGETS_MASK;
4109 
4110 	/* Grab the disconnection disable table and invert it for our needs */
4111 	if (ahc->flags & AHC_USEDEFAULTS) {
4112 		printf("%s: Host Adapter Bios disabled.  Using default SCSI "
4113 			"device parameters\n", ahc_name(ahc));
4114 		ahc->flags |= AHC_EXTENDED_TRANS_A|AHC_EXTENDED_TRANS_B|
4115 			      AHC_TERM_ENB_A|AHC_TERM_ENB_B;
4116 		discenable = ALL_TARGETS_MASK;
4117 		if ((ahc->features & AHC_ULTRA) != 0)
4118 			ultraenb = ALL_TARGETS_MASK;
4119 	} else {
4120 		discenable = ~((ahc_inb(ahc, DISC_DSB + 1) << 8)
4121 			   | ahc_inb(ahc, DISC_DSB));
4122 		if ((ahc->features & (AHC_ULTRA|AHC_ULTRA2)) != 0)
4123 			ultraenb = (ahc_inb(ahc, ULTRA_ENB + 1) << 8)
4124 				      | ahc_inb(ahc, ULTRA_ENB);
4125 	}
4126 
4127 	if ((ahc->features & (AHC_WIDE|AHC_TWIN)) == 0)
4128 		max_targ = 7;
4129 
4130 	for (i = 0; i <= max_targ; i++) {
4131 		struct ahc_initiator_tinfo *tinfo;
4132 		struct tmode_tstate *tstate;
4133 		u_int our_id;
4134 		u_int target_id;
4135 		char channel;
4136 
4137 		channel = 'A';
4138 		our_id = ahc->our_id;
4139 		target_id = i;
4140 		if (i > 7 && (ahc->features & AHC_TWIN) != 0) {
4141 			channel = 'B';
4142 			our_id = ahc->our_id_b;
4143 			target_id = i % 8;
4144 		}
4145 		tinfo = ahc_fetch_transinfo(ahc, channel, our_id,
4146 					    target_id, &tstate);
4147 		/* Default to async narrow across the board */
4148 		bzero(tinfo, sizeof(*tinfo));
4149 		if (ahc->flags & AHC_USEDEFAULTS) {
4150 			if ((ahc->features & AHC_WIDE) != 0)
4151 				tinfo->user.width = MSG_EXT_WDTR_BUS_16_BIT;
4152 
4153 			/*
4154 			 * These will be truncated when we determine the
4155 			 * connection type we have with the target.
4156 			 */
4157 			tinfo->user.period = ahc_syncrates->period;
4158 			tinfo->user.offset = ~0;
4159 		} else {
4160 			u_int scsirate;
4161 			u_int16_t mask;
4162 
4163 			/* Take the settings leftover in scratch RAM. */
4164 			scsirate = ahc_inb(ahc, TARG_SCSIRATE + i);
4165 			mask = (0x01 << i);
4166 			if ((ahc->features & AHC_ULTRA2) != 0) {
4167 				u_int offset;
4168 
4169 				if ((scsirate & SOFS) == 0x0F) {
4170 					/*
4171 					 * Haven't negotiated yet,
4172 					 * so the format is different.
4173 					 */
4174 					scsirate = (scsirate & SXFR) >> 4
4175 						 | (ultraenb & mask)
4176 						  ? 0x18 : 0x10
4177 						 | (scsirate & WIDEXFER);
4178 					offset = MAX_OFFSET_ULTRA2;
4179 				} else
4180 					offset = ahc_inb(ahc, TARG_OFFSET + i);
4181 				tinfo->user.period =
4182 				    ahc_find_period(ahc, scsirate,
4183 						    AHC_SYNCRATE_ULTRA2);
4184 				if (offset == 0)
4185 					tinfo->user.period = 0;
4186 				else
4187 					tinfo->user.offset = ~0;
4188 			} else if ((scsirate & SOFS) != 0) {
4189 				tinfo->user.period =
4190 				    ahc_find_period(ahc, scsirate,
4191 						    (ultraenb & mask)
4192 						   ? AHC_SYNCRATE_ULTRA
4193 						   : AHC_SYNCRATE_FAST);
4194 				if (tinfo->user.period != 0)
4195 					tinfo->user.offset = ~0;
4196 			}
4197 			if ((scsirate & WIDEXFER) != 0
4198 			 && (ahc->features & AHC_WIDE) != 0)
4199 				tinfo->user.width = MSG_EXT_WDTR_BUS_16_BIT;
4200 		}
4201 		tstate->ultraenb = ultraenb;
4202 		tstate->discenable = discenable;
4203 		tstate->tagenable = 0; /* Wait until the XPT says its okay */
4204 	}
4205 	ahc->user_discenable = discenable;
4206 	ahc->user_tagenable = tagenable;
4207 
4208 	/*
4209 	 * Tell the sequencer where it can find the our arrays in memory.
4210 	 */
4211 	physaddr = ahc->scb_data->hscb_busaddr;
4212 	ahc_outb(ahc, HSCB_ADDR, physaddr & 0xFF);
4213 	ahc_outb(ahc, HSCB_ADDR + 1, (physaddr >> 8) & 0xFF);
4214 	ahc_outb(ahc, HSCB_ADDR + 2, (physaddr >> 16) & 0xFF);
4215 	ahc_outb(ahc, HSCB_ADDR + 3, (physaddr >> 24) & 0xFF);
4216 
4217 	physaddr = ahc->shared_data_busaddr;
4218 	ahc_outb(ahc, SCBID_ADDR, physaddr & 0xFF);
4219 	ahc_outb(ahc, SCBID_ADDR + 1, (physaddr >> 8) & 0xFF);
4220 	ahc_outb(ahc, SCBID_ADDR + 2, (physaddr >> 16) & 0xFF);
4221 	ahc_outb(ahc, SCBID_ADDR + 3, (physaddr >> 24) & 0xFF);
4222 
4223 	/* Target mode incomding command fifo */
4224 	physaddr += 3 * 256 * sizeof(u_int8_t);
4225 	ahc_outb(ahc, TMODE_CMDADDR, physaddr & 0xFF);
4226 	ahc_outb(ahc, TMODE_CMDADDR + 1, (physaddr >> 8) & 0xFF);
4227 	ahc_outb(ahc, TMODE_CMDADDR + 2, (physaddr >> 16) & 0xFF);
4228 	ahc_outb(ahc, TMODE_CMDADDR + 3, (physaddr >> 24) & 0xFF);
4229 
4230 	/*
4231 	 * Initialize the group code to command length table.
4232 	 * This overrides the values in TARG_SCSIRATE, so only
4233 	 * setup the table after we have processed that information.
4234 	 */
4235 	ahc_outb(ahc, CMDSIZE_TABLE, 5);
4236 	ahc_outb(ahc, CMDSIZE_TABLE + 1, 9);
4237 	ahc_outb(ahc, CMDSIZE_TABLE + 2, 9);
4238 	ahc_outb(ahc, CMDSIZE_TABLE + 3, 0);
4239 	ahc_outb(ahc, CMDSIZE_TABLE + 4, 15);
4240 	ahc_outb(ahc, CMDSIZE_TABLE + 5, 11);
4241 	ahc_outb(ahc, CMDSIZE_TABLE + 6, 0);
4242 	ahc_outb(ahc, CMDSIZE_TABLE + 7, 0);
4243 
4244 	/* Tell the sequencer of our initial queue positions */
4245 	ahc_outb(ahc, KERNEL_QINPOS, 0);
4246 	ahc_outb(ahc, QINPOS, 0);
4247 	ahc_outb(ahc, QOUTPOS, 0);
4248 
4249 #ifdef AHC_DEBUG
4250 	if (ahc_debug & AHC_SHOWMISC)
4251 		printf("NEEDSDTR == 0x%x\nNEEDWDTR == 0x%x\n"
4252 		       "DISCENABLE == 0x%x\nULTRAENB == 0x%x\n",
4253 		       ahc->needsdtr_orig, ahc->needwdtr_orig,
4254 		       discenable, ultraenb);
4255 #endif
4256 
4257 	/* Don't have any special messages to send to targets */
4258 	ahc_outb(ahc, TARGET_MSG_REQUEST, 0);
4259 	ahc_outb(ahc, TARGET_MSG_REQUEST + 1, 0);
4260 
4261 	/*
4262 	 * Use the built in queue management registers
4263 	 * if they are available.
4264 	 */
4265 	if ((ahc->features & AHC_QUEUE_REGS) != 0) {
4266 		ahc_outb(ahc, QOFF_CTLSTA, SCB_QSIZE_256);
4267 		ahc_outb(ahc, SDSCB_QOFF, 0);
4268 		ahc_outb(ahc, SNSCB_QOFF, 0);
4269 		ahc_outb(ahc, HNSCB_QOFF, 0);
4270 	}
4271 
4272 
4273 	/* We don't have any waiting selections */
4274 	ahc_outb(ahc, WAITING_SCBH, SCB_LIST_NULL);
4275 
4276 	/* Our disconnection list is empty too */
4277 	ahc_outb(ahc, DISCONNECTED_SCBH, SCB_LIST_NULL);
4278 
4279 	/* Message out buffer starts empty */
4280 	ahc_outb(ahc, MSG_OUT, MSG_NOOP);
4281 
4282 	/*
4283 	 * Setup the allowed SCSI Sequences based on operational mode.
4284 	 * If we are a target, we'll enalbe select in operations once
4285 	 * we've had a lun enabled.
4286 	 */
4287 	scsiseq_template = ENSELO|ENAUTOATNO|ENAUTOATNP;
4288 	if ((ahc->flags & AHC_INITIATORMODE) != 0)
4289 		scsiseq_template |= ENRSELI;
4290 	ahc_outb(ahc, SCSISEQ_TEMPLATE, scsiseq_template);
4291 
4292 	/*
4293 	 * Load the Sequencer program and Enable the adapter
4294 	 * in "fast" mode.
4295          */
4296 	if (bootverbose)
4297 		printf("%s: Downloading Sequencer Program...",
4298 		       ahc_name(ahc));
4299 
4300 	ahc_loadseq(ahc);
4301 
4302 	/* We have to wait until after any system dumps... */
4303 	EVENTHANDLER_REGISTER(shutdown_final, ahc_shutdown, ahc, SHUTDOWN_PRI_DEFAULT);
4304 
4305 	return (0);
4306 }
4307 
4308 static cam_status
4309 ahc_find_tmode_devs(struct ahc_softc *ahc, struct cam_sim *sim, union ccb *ccb,
4310 		    struct tmode_tstate **tstate, struct tmode_lstate **lstate,
4311 		    int notfound_failure)
4312 {
4313 	int our_id;
4314 
4315 	/*
4316 	 * If we are not configured for target mode, someone
4317 	 * is really confused to be sending this to us.
4318 	 */
4319 	if ((ahc->flags & AHC_TARGETMODE) == 0)
4320 		return (CAM_REQ_INVALID);
4321 
4322 	/* Range check target and lun */
4323 
4324 	/*
4325 	 * Handle the 'black hole' device that sucks up
4326 	 * requests to unattached luns on enabled targets.
4327 	 */
4328 	if (ccb->ccb_h.target_id == CAM_TARGET_WILDCARD
4329 	 && ccb->ccb_h.target_lun == CAM_LUN_WILDCARD) {
4330 		*tstate = NULL;
4331 		*lstate = ahc->black_hole;
4332 	} else {
4333 		u_int max_id;
4334 
4335 		if (cam_sim_bus(sim) == 0)
4336 			our_id = ahc->our_id;
4337 		else
4338 			our_id = ahc->our_id_b;
4339 
4340 		max_id = (ahc->features & AHC_WIDE) ? 15 : 7;
4341 		if (ccb->ccb_h.target_id > max_id)
4342 			return (CAM_TID_INVALID);
4343 
4344 		if (ccb->ccb_h.target_lun > 7)
4345 			return (CAM_LUN_INVALID);
4346 
4347 		if (ccb->ccb_h.target_id != our_id) {
4348 			if ((ahc->features & AHC_MULTI_TID) != 0) {
4349 				/*
4350 				 * Only allow additional targets if
4351 				 * the initiator role is disabled.
4352 				 * The hardware cannot handle a re-select-in
4353 				 * on the initiator id during a re-select-out
4354 				 * on a different target id.
4355 				 */
4356 			   	if ((ahc->flags & AHC_INITIATORMODE) != 0)
4357 					return (CAM_TID_INVALID);
4358 			} else {
4359 				/*
4360 				 * Only allow our target id to change
4361 				 * if the initiator role is not configured
4362 				 * and there are no enabled luns which
4363 				 * are attached to the currently registered
4364 				 * scsi id.
4365 				 */
4366 			   	if ((ahc->flags & AHC_INITIATORMODE) != 0
4367 				 || ahc->enabled_luns > 0)
4368 					return (CAM_TID_INVALID);
4369 			}
4370 		}
4371 
4372 		*tstate = ahc->enabled_targets[ccb->ccb_h.target_id];
4373 		*lstate = NULL;
4374 		if (*tstate != NULL)
4375 			*lstate =
4376 			    (*tstate)->enabled_luns[ccb->ccb_h.target_lun];
4377 	}
4378 
4379 	if (notfound_failure != 0 && *lstate == NULL)
4380 		return (CAM_PATH_INVALID);
4381 
4382 	return (CAM_REQ_CMP);
4383 }
4384 
4385 static void
4386 ahc_action(struct cam_sim *sim, union ccb *ccb)
4387 {
4388 	struct	ahc_softc *ahc;
4389 	struct	tmode_lstate *lstate;
4390 	u_int	target_id;
4391 	u_int	our_id;
4392 	int	s;
4393 
4394 	CAM_DEBUG(ccb->ccb_h.path, CAM_DEBUG_TRACE, ("ahc_action\n"));
4395 
4396 	ahc = (struct ahc_softc *)cam_sim_softc(sim);
4397 
4398 	target_id = ccb->ccb_h.target_id;
4399 	our_id = SIM_SCSI_ID(ahc, sim);
4400 
4401 	switch (ccb->ccb_h.func_code) {
4402 	/* Common cases first */
4403 	case XPT_ACCEPT_TARGET_IO:	/* Accept Host Target Mode CDB */
4404 	case XPT_CONT_TARGET_IO:/* Continue Host Target I/O Connection*/
4405 	{
4406 		struct	   tmode_tstate *tstate;
4407 		cam_status status;
4408 
4409 		status = ahc_find_tmode_devs(ahc, sim, ccb, &tstate,
4410 					     &lstate, TRUE);
4411 
4412 		if (status != CAM_REQ_CMP) {
4413 			if (ccb->ccb_h.func_code == XPT_CONT_TARGET_IO) {
4414 				/* Response from the black hole device */
4415 				tstate = NULL;
4416 				lstate = ahc->black_hole;
4417 			} else {
4418 				ccb->ccb_h.status = status;
4419 				xpt_done(ccb);
4420 				break;
4421 			}
4422 		}
4423 		if (ccb->ccb_h.func_code == XPT_ACCEPT_TARGET_IO) {
4424 			int s;
4425 
4426 			s = splcam();
4427 			SLIST_INSERT_HEAD(&lstate->accept_tios, &ccb->ccb_h,
4428 					  sim_links.sle);
4429 			ccb->ccb_h.status = CAM_REQ_INPROG;
4430 			if ((ahc->flags & AHC_TQINFIFO_BLOCKED) != 0)
4431 				ahc_run_tqinfifo(ahc);
4432 			splx(s);
4433 			break;
4434 		}
4435 
4436 		/*
4437 		 * The target_id represents the target we attempt to
4438 		 * select.  In target mode, this is the initiator of
4439 		 * the original command.
4440 		 */
4441 		our_id = target_id;
4442 		target_id = ccb->csio.init_id;
4443 		/* FALLTHROUGH */
4444 	}
4445 	case XPT_SCSI_IO:	/* Execute the requested I/O operation */
4446 	case XPT_RESET_DEV:	/* Bus Device Reset the specified SCSI device */
4447 	{
4448 		struct	   scb *scb;
4449 		struct	   hardware_scb *hscb;
4450 		struct	   ahc_initiator_tinfo *tinfo;
4451 		struct	   tmode_tstate *tstate;
4452 		u_int16_t  mask;
4453 
4454 		/*
4455 		 * get an scb to use.
4456 		 */
4457 		if ((scb = ahcgetscb(ahc)) == NULL) {
4458 			int s;
4459 
4460 			s = splcam();
4461 			ahc->flags |= AHC_RESOURCE_SHORTAGE;
4462 			splx(s);
4463 			xpt_freeze_simq(ahc->sim, /*count*/1);
4464 			ahcsetccbstatus(ccb, CAM_REQUEUE_REQ);
4465 			xpt_done(ccb);
4466 			return;
4467 		}
4468 
4469 		hscb = scb->hscb;
4470 
4471 		CAM_DEBUG(ccb->ccb_h.path, CAM_DEBUG_SUBTRACE,
4472 			  ("start scb(%p)\n", scb));
4473 		scb->ccb = ccb;
4474 		/*
4475 		 * So we can find the SCB when an abort is requested
4476 		 */
4477 		ccb->ccb_h.ccb_scb_ptr = scb;
4478 		ccb->ccb_h.ccb_ahc_ptr = ahc;
4479 
4480 		/*
4481 		 * Put all the arguments for the xfer in the scb
4482 		 */
4483 		hscb->tcl = ((target_id << 4) & 0xF0)
4484 			| (SIM_IS_SCSIBUS_B(ahc, sim) ? SELBUSB : 0)
4485 			| (ccb->ccb_h.target_lun & 0x07);
4486 
4487 		mask = SCB_TARGET_MASK(scb);
4488 		tinfo = ahc_fetch_transinfo(ahc, SIM_CHANNEL(ahc, sim), our_id,
4489 					    target_id, &tstate);
4490 
4491 		hscb->scsirate = tinfo->scsirate;
4492 		hscb->scsioffset = tinfo->current.offset;
4493 		if ((tstate->ultraenb & mask) != 0)
4494 			hscb->control |= ULTRAENB;
4495 
4496 		if ((tstate->discenable & mask) != 0
4497 		 && (ccb->ccb_h.flags & CAM_DIS_DISCONNECT) == 0)
4498 			hscb->control |= DISCENB;
4499 
4500 		if (ccb->ccb_h.func_code == XPT_RESET_DEV) {
4501 			hscb->cmdpointer = NULL;
4502 			scb->flags |= SCB_DEVICE_RESET;
4503 			hscb->control |= MK_MESSAGE;
4504 			ahc_execute_scb(scb, NULL, 0, 0);
4505 		} else {
4506 			if (ccb->ccb_h.func_code == XPT_CONT_TARGET_IO) {
4507 				if (ahc->pending_device == lstate) {
4508 					scb->flags |= SCB_TARGET_IMMEDIATE;
4509 					ahc->pending_device = NULL;
4510 				}
4511 				hscb->control |= TARGET_SCB;
4512 				hscb->cmdpointer = IDENTIFY_SEEN;
4513 				if ((ccb->ccb_h.flags & CAM_SEND_STATUS) != 0) {
4514 					hscb->cmdpointer |= SPHASE_PENDING;
4515 					hscb->status = ccb->csio.scsi_status;
4516 				}
4517 
4518 				/* Overloaded with tag ID */
4519 				hscb->cmdlen = ccb->csio.tag_id;
4520 				/*
4521 				 * Overloaded with the value to place
4522 				 * in SCSIID for reselection.
4523 				 */
4524 				hscb->cmdpointer |=
4525 					(our_id|(hscb->tcl & 0xF0)) << 16;
4526 			}
4527 			if (ccb->ccb_h.flags & CAM_TAG_ACTION_VALID)
4528 				hscb->control |= ccb->csio.tag_action;
4529 
4530 			ahc_setup_data(ahc, &ccb->csio, scb);
4531 		}
4532 		break;
4533 	}
4534 	case XPT_NOTIFY_ACK:
4535 	case XPT_IMMED_NOTIFY:
4536 	{
4537 		struct	   tmode_tstate *tstate;
4538 		struct	   tmode_lstate *lstate;
4539 		cam_status status;
4540 
4541 		status = ahc_find_tmode_devs(ahc, sim, ccb, &tstate,
4542 					     &lstate, TRUE);
4543 
4544 		if (status != CAM_REQ_CMP) {
4545 			ccb->ccb_h.status = status;
4546 			xpt_done(ccb);
4547 			break;
4548 		}
4549 		SLIST_INSERT_HEAD(&lstate->immed_notifies, &ccb->ccb_h,
4550 				  sim_links.sle);
4551 		ccb->ccb_h.status = CAM_REQ_INPROG;
4552 		ahc_send_lstate_events(ahc, lstate);
4553 		break;
4554 	}
4555 	case XPT_EN_LUN:		/* Enable LUN as a target */
4556 		ahc_handle_en_lun(ahc, sim, ccb);
4557 		xpt_done(ccb);
4558 		break;
4559 	case XPT_ABORT:			/* Abort the specified CCB */
4560 	{
4561 		ahc_abort_ccb(ahc, sim, ccb);
4562 		break;
4563 	}
4564 	case XPT_SET_TRAN_SETTINGS:
4565 	{
4566 		struct	ahc_devinfo devinfo;
4567 		struct	ccb_trans_settings *cts;
4568 		struct	ahc_initiator_tinfo *tinfo;
4569 		struct	tmode_tstate *tstate;
4570 		u_int16_t *discenable;
4571 		u_int16_t *tagenable;
4572 		u_int	update_type;
4573 		int	s;
4574 
4575 		cts = &ccb->cts;
4576 		ahc_compile_devinfo(&devinfo, SIM_SCSI_ID(ahc, sim),
4577 				    cts->ccb_h.target_id,
4578 				    cts->ccb_h.target_lun,
4579 				    SIM_CHANNEL(ahc, sim),
4580 				    ROLE_UNKNOWN);
4581 		tinfo = ahc_fetch_transinfo(ahc, devinfo.channel,
4582 					    devinfo.our_scsiid,
4583 					    devinfo.target, &tstate);
4584 		update_type = 0;
4585 		if ((cts->flags & CCB_TRANS_CURRENT_SETTINGS) != 0) {
4586 			update_type |= AHC_TRANS_GOAL;
4587 			discenable = &tstate->discenable;
4588 			tagenable = &tstate->tagenable;
4589 		} else if ((cts->flags & CCB_TRANS_USER_SETTINGS) != 0) {
4590 			update_type |= AHC_TRANS_USER;
4591 			discenable = &ahc->user_discenable;
4592 			tagenable = &ahc->user_tagenable;
4593 		} else {
4594 			ccb->ccb_h.status = CAM_REQ_INVALID;
4595 			xpt_done(ccb);
4596 			break;
4597 		}
4598 
4599 		s = splcam();
4600 
4601 		if ((cts->valid & CCB_TRANS_DISC_VALID) != 0) {
4602 			if ((cts->flags & CCB_TRANS_DISC_ENB) != 0)
4603 				*discenable |= devinfo.target_mask;
4604 			else
4605 				*discenable &= ~devinfo.target_mask;
4606 		}
4607 
4608 		if ((cts->valid & CCB_TRANS_TQ_VALID) != 0) {
4609 			if ((cts->flags & CCB_TRANS_TAG_ENB) != 0)
4610 				*tagenable |= devinfo.target_mask;
4611 			else
4612 				*tagenable &= ~devinfo.target_mask;
4613 		}
4614 
4615 		if ((cts->valid & CCB_TRANS_BUS_WIDTH_VALID) != 0) {
4616 			switch (cts->bus_width) {
4617 			case MSG_EXT_WDTR_BUS_16_BIT:
4618 				if ((ahc->features & AHC_WIDE) != 0)
4619 					break;
4620 				/* FALLTHROUGH to 8bit */
4621 			case MSG_EXT_WDTR_BUS_32_BIT:
4622 			case MSG_EXT_WDTR_BUS_8_BIT:
4623 			default:
4624 				cts->bus_width = MSG_EXT_WDTR_BUS_8_BIT;
4625 				break;
4626 			}
4627 			ahc_set_width(ahc, &devinfo, cts->ccb_h.path,
4628 				      cts->bus_width, update_type,
4629 				      /*paused*/FALSE);
4630 		}
4631 
4632 		if (((cts->valid & CCB_TRANS_SYNC_RATE_VALID) != 0)
4633 		 || ((cts->valid & CCB_TRANS_SYNC_OFFSET_VALID) != 0)) {
4634 			struct ahc_syncrate *syncrate;
4635 			u_int maxsync;
4636 
4637 			if ((ahc->features & AHC_ULTRA2) != 0)
4638 				maxsync = AHC_SYNCRATE_ULTRA2;
4639 			else if ((ahc->features & AHC_ULTRA) != 0)
4640 				maxsync = AHC_SYNCRATE_ULTRA;
4641 			else
4642 				maxsync = AHC_SYNCRATE_FAST;
4643 
4644 			if ((cts->valid & CCB_TRANS_SYNC_OFFSET_VALID) == 0) {
4645 				if (update_type & AHC_TRANS_USER)
4646 					cts->sync_offset = tinfo->user.offset;
4647 				else
4648 					cts->sync_offset = tinfo->goal.offset;
4649 			}
4650 
4651 			if ((cts->valid & CCB_TRANS_SYNC_RATE_VALID) == 0) {
4652 				if (update_type & AHC_TRANS_USER)
4653 					cts->sync_period = tinfo->user.period;
4654 				else
4655 					cts->sync_period = tinfo->goal.period;
4656 			}
4657 
4658 			syncrate = ahc_find_syncrate(ahc, &cts->sync_period,
4659 						     maxsync);
4660 			ahc_validate_offset(ahc, syncrate, &cts->sync_offset,
4661 					    MSG_EXT_WDTR_BUS_8_BIT);
4662 
4663 			/* We use a period of 0 to represent async */
4664 			if (cts->sync_offset == 0)
4665 				cts->sync_period = 0;
4666 
4667 			ahc_set_syncrate(ahc, &devinfo, cts->ccb_h.path,
4668 					 syncrate, cts->sync_period,
4669 					 cts->sync_offset, update_type,
4670 					 /*paused*/FALSE);
4671 		}
4672 		splx(s);
4673 		ccb->ccb_h.status = CAM_REQ_CMP;
4674 		xpt_done(ccb);
4675 		break;
4676 	}
4677 	case XPT_GET_TRAN_SETTINGS:
4678 	/* Get default/user set transfer settings for the target */
4679 	{
4680 		struct	ahc_devinfo devinfo;
4681 		struct	ccb_trans_settings *cts;
4682 		struct	ahc_initiator_tinfo *targ_info;
4683 		struct	tmode_tstate *tstate;
4684 		struct	ahc_transinfo *tinfo;
4685 		int	s;
4686 
4687 		cts = &ccb->cts;
4688 		ahc_compile_devinfo(&devinfo, SIM_SCSI_ID(ahc, sim),
4689 				    cts->ccb_h.target_id,
4690 				    cts->ccb_h.target_lun,
4691 				    SIM_CHANNEL(ahc, sim),
4692 				    ROLE_UNKNOWN);
4693 		targ_info = ahc_fetch_transinfo(ahc, devinfo.channel,
4694 						devinfo.our_scsiid,
4695 						devinfo.target, &tstate);
4696 
4697 		if ((cts->flags & CCB_TRANS_CURRENT_SETTINGS) != 0)
4698 			tinfo = &targ_info->current;
4699 		else
4700 			tinfo = &targ_info->user;
4701 
4702 		s = splcam();
4703 
4704 		cts->flags &= ~(CCB_TRANS_DISC_ENB|CCB_TRANS_TAG_ENB);
4705 		if ((cts->flags & CCB_TRANS_USER_SETTINGS) != 0) {
4706 			if ((ahc->user_discenable & devinfo.target_mask) != 0)
4707 				cts->flags |= CCB_TRANS_DISC_ENB;
4708 
4709 			if ((ahc->user_tagenable & devinfo.target_mask) != 0)
4710 				cts->flags |= CCB_TRANS_TAG_ENB;
4711 		} else {
4712 			if ((tstate->discenable & devinfo.target_mask) != 0)
4713 				cts->flags |= CCB_TRANS_DISC_ENB;
4714 
4715 			if ((tstate->tagenable & devinfo.target_mask) != 0)
4716 				cts->flags |= CCB_TRANS_TAG_ENB;
4717 		}
4718 
4719 		cts->sync_period = tinfo->period;
4720 		cts->sync_offset = tinfo->offset;
4721 		cts->bus_width = tinfo->width;
4722 
4723 		splx(s);
4724 
4725 		cts->valid = CCB_TRANS_SYNC_RATE_VALID
4726 			   | CCB_TRANS_SYNC_OFFSET_VALID
4727 			   | CCB_TRANS_BUS_WIDTH_VALID
4728 			   | CCB_TRANS_DISC_VALID
4729 			   | CCB_TRANS_TQ_VALID;
4730 
4731 		ccb->ccb_h.status = CAM_REQ_CMP;
4732 		xpt_done(ccb);
4733 		break;
4734 	}
4735 	case XPT_CALC_GEOMETRY:
4736 	{
4737 		struct	  ccb_calc_geometry *ccg;
4738 		u_int32_t size_mb;
4739 		u_int32_t secs_per_cylinder;
4740 		int	  extended;
4741 
4742 		ccg = &ccb->ccg;
4743 		size_mb = ccg->volume_size
4744 			/ ((1024L * 1024L) / ccg->block_size);
4745 		extended = SIM_IS_SCSIBUS_B(ahc, sim)
4746 			? ahc->flags & AHC_EXTENDED_TRANS_B
4747 			: ahc->flags & AHC_EXTENDED_TRANS_A;
4748 
4749 		if (size_mb > 1024 && extended) {
4750 			ccg->heads = 255;
4751 			ccg->secs_per_track = 63;
4752 		} else {
4753 			ccg->heads = 64;
4754 			ccg->secs_per_track = 32;
4755 		}
4756 		secs_per_cylinder = ccg->heads * ccg->secs_per_track;
4757 		ccg->cylinders = ccg->volume_size / secs_per_cylinder;
4758 		ccb->ccb_h.status = CAM_REQ_CMP;
4759 		xpt_done(ccb);
4760 		break;
4761 	}
4762 	case XPT_RESET_BUS:		/* Reset the specified SCSI bus */
4763 	{
4764 		int  found;
4765 
4766 		s = splcam();
4767 		found = ahc_reset_channel(ahc, SIM_CHANNEL(ahc, sim),
4768 					  /*initiate reset*/TRUE);
4769 		splx(s);
4770 		if (bootverbose) {
4771 			xpt_print_path(SIM_PATH(ahc, sim));
4772 			printf("SCSI bus reset delivered. "
4773 			       "%d SCBs aborted.\n", found);
4774 		}
4775 		ccb->ccb_h.status = CAM_REQ_CMP;
4776 		xpt_done(ccb);
4777 		break;
4778 	}
4779 	case XPT_TERM_IO:		/* Terminate the I/O process */
4780 		/* XXX Implement */
4781 		ccb->ccb_h.status = CAM_REQ_INVALID;
4782 		xpt_done(ccb);
4783 		break;
4784 	case XPT_PATH_INQ:		/* Path routing inquiry */
4785 	{
4786 		struct ccb_pathinq *cpi = &ccb->cpi;
4787 
4788 		cpi->version_num = 1; /* XXX??? */
4789 		cpi->hba_inquiry = PI_SDTR_ABLE|PI_TAG_ABLE;
4790 		if ((ahc->features & AHC_WIDE) != 0)
4791 			cpi->hba_inquiry |= PI_WIDE_16;
4792 		if ((ahc->flags & AHC_TARGETMODE) != 0) {
4793 			cpi->target_sprt = PIT_PROCESSOR
4794 					 | PIT_DISCONNECT
4795 					 | PIT_TERM_IO;
4796 		} else {
4797 			cpi->target_sprt = 0;
4798 		}
4799 		cpi->hba_misc = (ahc->flags & AHC_INITIATORMODE)
4800 			      ? 0 : PIM_NOINITIATOR;
4801 		cpi->hba_eng_cnt = 0;
4802 		cpi->max_target = (ahc->features & AHC_WIDE) ? 15 : 7;
4803 		cpi->max_lun = 7;
4804 		if (SIM_IS_SCSIBUS_B(ahc, sim)) {
4805 			cpi->initiator_id = ahc->our_id_b;
4806 			if ((ahc->flags & AHC_RESET_BUS_B) == 0)
4807 				cpi->hba_misc |= PIM_NOBUSRESET;
4808 		} else {
4809 			cpi->initiator_id = ahc->our_id;
4810 			if ((ahc->flags & AHC_RESET_BUS_A) == 0)
4811 				cpi->hba_misc |= PIM_NOBUSRESET;
4812 		}
4813 		cpi->bus_id = cam_sim_bus(sim);
4814 		cpi->base_transfer_speed = 3300;
4815 		strncpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
4816 		strncpy(cpi->hba_vid, "Adaptec", HBA_IDLEN);
4817 		strncpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
4818 		cpi->unit_number = cam_sim_unit(sim);
4819 		cpi->ccb_h.status = CAM_REQ_CMP;
4820 		xpt_done(ccb);
4821 		break;
4822 	}
4823 	default:
4824 		ccb->ccb_h.status = CAM_REQ_INVALID;
4825 		xpt_done(ccb);
4826 		break;
4827 	}
4828 }
4829 
4830 static void
4831 ahc_async(void *callback_arg, u_int32_t code, struct cam_path *path, void *arg)
4832 {
4833 	struct ahc_softc *ahc;
4834 	struct cam_sim *sim;
4835 
4836 	sim = (struct cam_sim *)callback_arg;
4837 	ahc = (struct ahc_softc *)cam_sim_softc(sim);
4838 	switch (code) {
4839 	case AC_LOST_DEVICE:
4840 	{
4841 		struct	ahc_devinfo devinfo;
4842 		int	s;
4843 
4844 		ahc_compile_devinfo(&devinfo, SIM_SCSI_ID(ahc, sim),
4845 				    xpt_path_target_id(path),
4846 				    xpt_path_lun_id(path),
4847 				    SIM_CHANNEL(ahc, sim),
4848 				    ROLE_UNKNOWN);
4849 
4850 		/*
4851 		 * Revert to async/narrow transfers
4852 		 * for the next device.
4853 		 */
4854 		s = splcam();
4855 		ahc_set_width(ahc, &devinfo, path, MSG_EXT_WDTR_BUS_8_BIT,
4856 			      AHC_TRANS_GOAL|AHC_TRANS_CUR,
4857 			      /*paused*/FALSE);
4858 		ahc_set_syncrate(ahc, &devinfo, path, /*syncrate*/NULL,
4859 				 /*period*/0, /*offset*/0,
4860 				 AHC_TRANS_GOAL|AHC_TRANS_CUR,
4861 				 /*paused*/FALSE);
4862 		splx(s);
4863 		break;
4864 	}
4865 	default:
4866 		break;
4867 	}
4868 }
4869 
4870 static void
4871 ahc_execute_scb(void *arg, bus_dma_segment_t *dm_segs, int nsegments,
4872 		int error)
4873 {
4874 	struct	 scb *scb;
4875 	union	 ccb *ccb;
4876 	struct	 ahc_softc *ahc;
4877 	int	 s;
4878 
4879 	scb = (struct scb *)arg;
4880 	ccb = scb->ccb;
4881 	ahc = (struct ahc_softc *)ccb->ccb_h.ccb_ahc_ptr;
4882 
4883 	if (nsegments != 0) {
4884 		struct	  ahc_dma_seg *sg;
4885 		bus_dma_segment_t *end_seg;
4886 		bus_dmasync_op_t op;
4887 
4888 		end_seg = dm_segs + nsegments;
4889 
4890 		/* Copy the first SG into the data pointer area */
4891 		scb->hscb->SG_pointer = scb->sg_list_phys;
4892 		scb->hscb->data = dm_segs->ds_addr;
4893 		scb->hscb->datalen = dm_segs->ds_len;
4894 		dm_segs++;
4895 
4896 		/* Copy the remaining segments into our SG list */
4897 		sg = scb->sg_list;
4898 		while (dm_segs < end_seg) {
4899 			sg->addr = dm_segs->ds_addr;
4900 			sg->len = dm_segs->ds_len;
4901 			sg++;
4902 			dm_segs++;
4903 		}
4904 
4905 		if ((ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN)
4906 			op = BUS_DMASYNC_PREREAD;
4907 		else
4908 			op = BUS_DMASYNC_PREWRITE;
4909 
4910 		bus_dmamap_sync(ahc->buffer_dmat, scb->dmamap, op);
4911 
4912 		if (ccb->ccb_h.func_code == XPT_CONT_TARGET_IO) {
4913 			scb->hscb->cmdpointer |= DPHASE_PENDING;
4914 			if ((ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN)
4915 				scb->hscb->cmdpointer |= (TARGET_DATA_IN << 8);
4916 		}
4917 	} else {
4918 		scb->hscb->SG_pointer = 0;
4919 		scb->hscb->data = 0;
4920 		scb->hscb->datalen = 0;
4921 	}
4922 
4923 	scb->sg_count = scb->hscb->SG_count = nsegments;
4924 
4925 	s = splcam();
4926 
4927 	/*
4928 	 * Last time we need to check if this SCB needs to
4929 	 * be aborted.
4930 	 */
4931 	if (ahc_ccb_status(ccb) != CAM_REQ_INPROG) {
4932 		if (nsegments != 0)
4933 			bus_dmamap_unload(ahc->buffer_dmat, scb->dmamap);
4934 		ahcfreescb(ahc, scb);
4935 		xpt_done(ccb);
4936 		splx(s);
4937 		return;
4938 	}
4939 
4940 	/* Busy this tcl if we are untagged */
4941 	if ((scb->hscb->control & TAG_ENB) == 0)
4942 		ahc_busy_tcl(ahc, scb);
4943 
4944 	LIST_INSERT_HEAD(&ahc->pending_ccbs, &ccb->ccb_h,
4945 			 sim_links.le);
4946 
4947 	scb->flags |= SCB_ACTIVE;
4948 	ccb->ccb_h.status |= CAM_SIM_QUEUED;
4949 
4950 	ccb->ccb_h.timeout_ch =
4951 	    timeout(ahc_timeout, (caddr_t)scb,
4952 		    (ccb->ccb_h.timeout * hz) / 1000);
4953 
4954 	if ((scb->flags & SCB_TARGET_IMMEDIATE) != 0) {
4955 #if 0
4956 		printf("Continueing Immediate Command %d:%d\n",
4957 		       ccb->ccb_h.target_id, ccb->ccb_h.target_lun);
4958 #endif
4959 		pause_sequencer(ahc);
4960 		if ((ahc->flags & AHC_PAGESCBS) == 0)
4961 			ahc_outb(ahc, SCBPTR, scb->hscb->tag);
4962 		ahc_outb(ahc, SCB_TAG, scb->hscb->tag);
4963 		ahc_outb(ahc, RETURN_1, CONT_MSG_LOOP);
4964 		unpause_sequencer(ahc, /*unpause_always*/FALSE);
4965 	} else {
4966 
4967 		ahc->qinfifo[ahc->qinfifonext++] = scb->hscb->tag;
4968 
4969 		if ((ahc->features & AHC_QUEUE_REGS) != 0) {
4970 			ahc_outb(ahc, HNSCB_QOFF, ahc->qinfifonext);
4971 		} else {
4972 			pause_sequencer(ahc);
4973 			ahc_outb(ahc, KERNEL_QINPOS, ahc->qinfifonext);
4974 			unpause_sequencer(ahc, /*unpause_always*/FALSE);
4975 		}
4976 	}
4977 
4978 	splx(s);
4979 }
4980 
4981 static void
4982 ahc_poll(struct cam_sim *sim)
4983 {
4984 	ahc_intr(cam_sim_softc(sim));
4985 }
4986 
4987 static void
4988 ahc_setup_data(struct ahc_softc *ahc, struct ccb_scsiio *csio,
4989 	       struct scb *scb)
4990 {
4991 	struct hardware_scb *hscb;
4992 	struct ccb_hdr *ccb_h;
4993 
4994 	hscb = scb->hscb;
4995 	ccb_h = &csio->ccb_h;
4996 
4997 	if (ccb_h->func_code == XPT_SCSI_IO) {
4998 		hscb->cmdlen = csio->cdb_len;
4999 		if ((ccb_h->flags & CAM_CDB_POINTER) != 0) {
5000 			if ((ccb_h->flags & CAM_CDB_PHYS) == 0)
5001 				if (hscb->cmdlen <= 16) {
5002 					memcpy(hscb->cmdstore,
5003 					       csio->cdb_io.cdb_ptr,
5004 					       hscb->cmdlen);
5005 					hscb->cmdpointer =
5006 					    hscb->cmdstore_busaddr;
5007 				} else  {
5008 					ahcsetccbstatus(scb->ccb,
5009 							CAM_REQ_INVALID);
5010 					xpt_done(scb->ccb);
5011 					ahcfreescb(ahc, scb);
5012 					return;
5013 				}
5014 			else
5015 				hscb->cmdpointer =
5016 				  ((intptr_t)csio->cdb_io.cdb_ptr) & 0xffffffff;
5017 		} else {
5018 			/*
5019 			 * CCB CDB Data Storage area is only 16 bytes
5020 			 * so no additional testing is required
5021 			 */
5022 			memcpy(hscb->cmdstore, csio->cdb_io.cdb_bytes,
5023 			       hscb->cmdlen);
5024 			hscb->cmdpointer = hscb->cmdstore_busaddr;
5025 		}
5026 	}
5027 
5028 	/* Only use S/G if there is a transfer */
5029 	if ((ccb_h->flags & CAM_DIR_MASK) != CAM_DIR_NONE) {
5030 		if ((ccb_h->flags & CAM_SCATTER_VALID) == 0) {
5031 			/* We've been given a pointer to a single buffer */
5032 			if ((ccb_h->flags & CAM_DATA_PHYS) == 0) {
5033 				int s;
5034 				int error;
5035 
5036 				s = splsoftvm();
5037 				error = bus_dmamap_load(ahc->buffer_dmat,
5038 							scb->dmamap,
5039 							csio->data_ptr,
5040 							csio->dxfer_len,
5041 							ahc_execute_scb,
5042 							scb, /*flags*/0);
5043 				if (error == EINPROGRESS) {
5044 					/*
5045 					 * So as to maintain ordering,
5046 					 * freeze the controller queue
5047 					 * until our mapping is
5048 					 * returned.
5049 					 */
5050 					xpt_freeze_simq(ahc->sim,
5051 							/*count*/1);
5052 					scb->ccb->ccb_h.status |=
5053 					    CAM_RELEASE_SIMQ;
5054 				}
5055 				splx(s);
5056 			} else {
5057 				struct bus_dma_segment seg;
5058 
5059 				/* Pointer to physical buffer */
5060 				if (csio->dxfer_len > AHC_MAXTRANSFER_SIZE)
5061 					panic("ahc_setup_data - Transfer size "
5062 					      "larger than can device max");
5063 
5064 				seg.ds_addr = (bus_addr_t)csio->data_ptr;
5065 				seg.ds_len = csio->dxfer_len;
5066 				ahc_execute_scb(scb, &seg, 1, 0);
5067 			}
5068 		} else {
5069 			struct bus_dma_segment *segs;
5070 
5071 			if ((ccb_h->flags & CAM_DATA_PHYS) != 0)
5072 				panic("ahc_setup_data - Physical segment "
5073 				      "pointers unsupported");
5074 
5075 			if ((ccb_h->flags & CAM_SG_LIST_PHYS) == 0)
5076 				panic("ahc_setup_data - Virtual segment "
5077 				      "addresses unsupported");
5078 
5079 			/* Just use the segments provided */
5080 			segs = (struct bus_dma_segment *)csio->data_ptr;
5081 			ahc_execute_scb(scb, segs, csio->sglist_cnt, 0);
5082 		}
5083 	} else {
5084 		ahc_execute_scb(scb, NULL, 0, 0);
5085 	}
5086 }
5087 
5088 static void
5089 ahc_freeze_devq(struct ahc_softc *ahc, struct cam_path *path)
5090 {
5091 	int	target;
5092 	char	channel;
5093 	int	lun;
5094 
5095 	target = xpt_path_target_id(path);
5096 	lun = xpt_path_lun_id(path);
5097 	channel = xpt_path_sim(path)->bus_id == 0 ? 'A' : 'B';
5098 
5099 	ahc_search_qinfifo(ahc, target, channel, lun,
5100 			   /*tag*/SCB_LIST_NULL, ROLE_UNKNOWN,
5101 			   CAM_REQUEUE_REQ, SEARCH_COMPLETE);
5102 }
5103 
5104 static void
5105 ahcallocscbs(struct ahc_softc *ahc)
5106 {
5107 	struct scb_data *scb_data;
5108 	struct scb *next_scb;
5109 	struct sg_map_node *sg_map;
5110 	bus_addr_t physaddr;
5111 	struct ahc_dma_seg *segs;
5112 	int newcount;
5113 	int i;
5114 
5115 	scb_data = ahc->scb_data;
5116 	if (scb_data->numscbs >= AHC_SCB_MAX)
5117 		/* Can't allocate any more */
5118 		return;
5119 
5120 	next_scb = &scb_data->scbarray[scb_data->numscbs];
5121 
5122 	sg_map = malloc(sizeof(*sg_map), M_DEVBUF, M_NOWAIT);
5123 
5124 	if (sg_map == NULL)
5125 		return;
5126 
5127 	/* Allocate S/G space for the next batch of SCBS */
5128 	if (bus_dmamem_alloc(scb_data->sg_dmat, (void **)&sg_map->sg_vaddr,
5129 			     BUS_DMA_NOWAIT, &sg_map->sg_dmamap) != 0) {
5130 		free(sg_map, M_DEVBUF);
5131 		return;
5132 	}
5133 
5134 	SLIST_INSERT_HEAD(&scb_data->sg_maps, sg_map, links);
5135 
5136 	bus_dmamap_load(scb_data->sg_dmat, sg_map->sg_dmamap, sg_map->sg_vaddr,
5137 			PAGE_SIZE, ahcdmamapcb, &sg_map->sg_physaddr,
5138 			/*flags*/0);
5139 
5140 	segs = sg_map->sg_vaddr;
5141 	physaddr = sg_map->sg_physaddr;
5142 
5143 	newcount = (PAGE_SIZE / (AHC_NSEG * sizeof(struct ahc_dma_seg)));
5144 	for (i = 0; scb_data->numscbs < AHC_SCB_MAX && i < newcount; i++) {
5145 		int error;
5146 
5147 		next_scb->sg_list = segs;
5148 		next_scb->sg_list_phys = physaddr;
5149 		next_scb->flags = SCB_FREE;
5150 		error = bus_dmamap_create(ahc->buffer_dmat, /*flags*/0,
5151 					  &next_scb->dmamap);
5152 		if (error != 0)
5153 			break;
5154 		next_scb->hscb = &scb_data->hscbs[scb_data->numscbs];
5155 		next_scb->hscb->tag = ahc->scb_data->numscbs;
5156 		next_scb->hscb->cmdstore_busaddr =
5157 		    ahc_hscb_busaddr(ahc, next_scb->hscb->tag)
5158 		  + offsetof(struct hardware_scb, cmdstore);
5159 		SLIST_INSERT_HEAD(&ahc->scb_data->free_scbs, next_scb, links);
5160 		segs += AHC_NSEG;
5161 		physaddr += (AHC_NSEG * sizeof(struct ahc_dma_seg));
5162 		next_scb++;
5163 		ahc->scb_data->numscbs++;
5164 	}
5165 }
5166 
5167 static void
5168 ahc_loadseq(struct ahc_softc *ahc)
5169 {
5170 	struct patch *cur_patch;
5171 	int i;
5172 	int downloaded;
5173 	int skip_addr;
5174 	u_int8_t download_consts[4];
5175 
5176 	/* Setup downloadable constant table */
5177 #if 0
5178 	/* No downloaded constants are currently defined. */
5179 	download_consts[TMODE_NUMCMDS] = ahc->num_targetcmds;
5180 #endif
5181 
5182 	cur_patch = patches;
5183 	downloaded = 0;
5184 	skip_addr = 0;
5185 	ahc_outb(ahc, SEQCTL, PERRORDIS|FAILDIS|FASTMODE|LOADRAM);
5186 	ahc_outb(ahc, SEQADDR0, 0);
5187 	ahc_outb(ahc, SEQADDR1, 0);
5188 
5189 	for (i = 0; i < sizeof(seqprog)/4; i++) {
5190 		if (ahc_check_patch(ahc, &cur_patch, i, &skip_addr) == 0) {
5191 			/*
5192 			 * Don't download this instruction as it
5193 			 * is in a patch that was removed.
5194 			 */
5195                         continue;
5196 		}
5197 		ahc_download_instr(ahc, i, download_consts);
5198 		downloaded++;
5199 	}
5200 	ahc_outb(ahc, SEQCTL, PERRORDIS|FAILDIS|FASTMODE);
5201 	restart_sequencer(ahc);
5202 
5203 	if (bootverbose)
5204 		printf(" %d instructions downloaded\n", downloaded);
5205 }
5206 
5207 static int
5208 ahc_check_patch(struct ahc_softc *ahc, struct patch **start_patch,
5209 		int start_instr, int *skip_addr)
5210 {
5211 	struct	patch *cur_patch;
5212 	struct	patch *last_patch;
5213 	int	num_patches;
5214 
5215 	num_patches = sizeof(patches)/sizeof(struct patch);
5216 	last_patch = &patches[num_patches];
5217 	cur_patch = *start_patch;
5218 
5219 	while (cur_patch < last_patch && start_instr == cur_patch->begin) {
5220 
5221 		if (cur_patch->patch_func(ahc) == 0) {
5222 
5223 			/* Start rejecting code */
5224 			*skip_addr = start_instr + cur_patch->skip_instr;
5225 			cur_patch += cur_patch->skip_patch;
5226 		} else {
5227 			/* Accepted this patch.  Advance to the next
5228 			 * one and wait for our intruction pointer to
5229 			 * hit this point.
5230 			 */
5231 			cur_patch++;
5232 		}
5233 	}
5234 
5235 	*start_patch = cur_patch;
5236 	if (start_instr < *skip_addr)
5237 		/* Still skipping */
5238 		return (0);
5239 
5240 	return (1);
5241 }
5242 
5243 static void
5244 ahc_download_instr(struct ahc_softc *ahc, int instrptr, u_int8_t *dconsts)
5245 {
5246 	union	ins_formats instr;
5247 	struct	ins_format1 *fmt1_ins;
5248 	struct	ins_format3 *fmt3_ins;
5249 	u_int	opcode;
5250 
5251 	/* Structure copy */
5252 	instr = *(union ins_formats*)&seqprog[instrptr * 4];
5253 
5254 	fmt1_ins = &instr.format1;
5255 	fmt3_ins = NULL;
5256 
5257 	/* Pull the opcode */
5258 	opcode = instr.format1.opcode;
5259 	switch (opcode) {
5260 	case AIC_OP_JMP:
5261 	case AIC_OP_JC:
5262 	case AIC_OP_JNC:
5263 	case AIC_OP_CALL:
5264 	case AIC_OP_JNE:
5265 	case AIC_OP_JNZ:
5266 	case AIC_OP_JE:
5267 	case AIC_OP_JZ:
5268 	{
5269 		struct patch *cur_patch;
5270 		int address_offset;
5271 		u_int address;
5272 		int skip_addr;
5273 		int i;
5274 
5275 		fmt3_ins = &instr.format3;
5276 		address_offset = 0;
5277 		address = fmt3_ins->address;
5278 		cur_patch = patches;
5279 		skip_addr = 0;
5280 
5281 		for (i = 0; i < address;) {
5282 
5283 			ahc_check_patch(ahc, &cur_patch, i, &skip_addr);
5284 
5285 			if (skip_addr > i) {
5286 				int end_addr;
5287 
5288 				end_addr = MIN(address, skip_addr);
5289 				address_offset += end_addr - i;
5290 				i = skip_addr;
5291 			} else {
5292 				i++;
5293 			}
5294 		}
5295 		address -= address_offset;
5296 		fmt3_ins->address = address;
5297 		/* FALLTHROUGH */
5298 	}
5299 	case AIC_OP_OR:
5300 	case AIC_OP_AND:
5301 	case AIC_OP_XOR:
5302 	case AIC_OP_ADD:
5303 	case AIC_OP_ADC:
5304 	case AIC_OP_BMOV:
5305 		if (fmt1_ins->parity != 0) {
5306 			fmt1_ins->immediate = dconsts[fmt1_ins->immediate];
5307 		}
5308 		fmt1_ins->parity = 0;
5309 		/* FALLTHROUGH */
5310 	case AIC_OP_ROL:
5311 		if ((ahc->features & AHC_ULTRA2) != 0) {
5312 			int i, count;
5313 
5314 			/* Calculate odd parity for the instruction */
5315 			for (i = 0, count = 0; i < 31; i++) {
5316 				u_int32_t mask;
5317 
5318 				mask = 0x01 << i;
5319 				if ((instr.integer & mask) != 0)
5320 					count++;
5321 			}
5322 			if ((count & 0x01) == 0)
5323 				instr.format1.parity = 1;
5324 		} else {
5325 			/* Compress the instruction for older sequencers */
5326 			if (fmt3_ins != NULL) {
5327 				instr.integer =
5328 					fmt3_ins->immediate
5329 				      | (fmt3_ins->source << 8)
5330 				      | (fmt3_ins->address << 16)
5331 				      |	(fmt3_ins->opcode << 25);
5332 			} else {
5333 				instr.integer =
5334 					fmt1_ins->immediate
5335 				      | (fmt1_ins->source << 8)
5336 				      | (fmt1_ins->destination << 16)
5337 				      |	(fmt1_ins->ret << 24)
5338 				      |	(fmt1_ins->opcode << 25);
5339 			}
5340 		}
5341 		ahc_outsb(ahc, SEQRAM, instr.bytes, 4);
5342 		break;
5343 	default:
5344 		panic("Unknown opcode encountered in seq program");
5345 		break;
5346 	}
5347 }
5348 
5349 static void
5350 ahc_set_recoveryscb(struct ahc_softc *ahc, struct scb *scb) {
5351 
5352 	if ((scb->flags & SCB_RECOVERY_SCB) == 0) {
5353 		struct ccb_hdr *ccbh;
5354 
5355 		scb->flags |= SCB_RECOVERY_SCB;
5356 
5357 		/*
5358 		 * Take all queued, but not sent SCBs out of the equation.
5359 		 * Also ensure that no new CCBs are queued to us while we
5360 		 * try to fix this problem.
5361 		 */
5362 		if ((scb->ccb->ccb_h.status & CAM_RELEASE_SIMQ) == 0) {
5363 			xpt_freeze_simq(ahc->sim, /*count*/1);
5364 			scb->ccb->ccb_h.status |= CAM_RELEASE_SIMQ;
5365 		}
5366 
5367 		/*
5368 		 * Go through all of our pending SCBs and remove
5369 		 * any scheduled timeouts for them.  We will reschedule
5370 		 * them after we've successfully fixed this problem.
5371 		 */
5372 		ccbh = ahc->pending_ccbs.lh_first;
5373 		while (ccbh != NULL) {
5374 			struct scb *pending_scb;
5375 
5376 			pending_scb = (struct scb *)ccbh->ccb_scb_ptr;
5377 			untimeout(ahc_timeout, pending_scb, ccbh->timeout_ch);
5378 			ccbh = ccbh->sim_links.le.le_next;
5379 		}
5380 	}
5381 }
5382 
5383 static void
5384 ahc_timeout(void *arg)
5385 {
5386 	struct	scb *scb;
5387 	struct	ahc_softc *ahc;
5388 	int	s, found;
5389 	u_int	bus_state;
5390 	int	target;
5391 	int	lun;
5392 	char	channel;
5393 
5394 	scb = (struct scb *)arg;
5395 	ahc = (struct ahc_softc *)scb->ccb->ccb_h.ccb_ahc_ptr;
5396 
5397 	s = splcam();
5398 
5399 	/*
5400 	 * Ensure that the card doesn't do anything
5401 	 * behind our back.  Also make sure that we
5402 	 * didn't "just" miss an interrupt that would
5403 	 * affect this timeout.
5404 	 */
5405 	do {
5406 		ahc_intr(ahc);
5407 		pause_sequencer(ahc);
5408 	} while (ahc_inb(ahc, INTSTAT) & INT_PEND);
5409 
5410 	if ((scb->flags & SCB_ACTIVE) == 0) {
5411 		/* Previous timeout took care of me already */
5412 		printf("Timedout SCB handled by another timeout\n");
5413 		unpause_sequencer(ahc, /*unpause_always*/TRUE);
5414 		splx(s);
5415 		return;
5416 	}
5417 
5418 	target = SCB_TARGET(scb);
5419 	channel = SCB_CHANNEL(scb);
5420 	lun = SCB_LUN(scb);
5421 
5422 	xpt_print_path(scb->ccb->ccb_h.path);
5423 	printf("SCB 0x%x - timed out ", scb->hscb->tag);
5424 	/*
5425 	 * Take a snapshot of the bus state and print out
5426 	 * some information so we can track down driver bugs.
5427 	 */
5428 	bus_state = ahc_inb(ahc, LASTPHASE);
5429 
5430 	switch(bus_state)
5431 	{
5432 	case P_DATAOUT:
5433 		printf("in dataout phase");
5434 		break;
5435 	case P_DATAIN:
5436 		printf("in datain phase");
5437 		break;
5438 	case P_COMMAND:
5439 		printf("in command phase");
5440 		break;
5441 	case P_MESGOUT:
5442 		printf("in message out phase");
5443 		break;
5444 	case P_STATUS:
5445 		printf("in status phase");
5446 		break;
5447 	case P_MESGIN:
5448 		printf("in message in phase");
5449 		break;
5450 	case P_BUSFREE:
5451 		printf("while idle, LASTPHASE == 0x%x",
5452 			bus_state);
5453 		break;
5454 	default:
5455 		/*
5456 		 * We aren't in a valid phase, so assume we're
5457 		 * idle.
5458 		 */
5459 		printf("invalid phase, LASTPHASE == 0x%x",
5460 			bus_state);
5461 		bus_state = P_BUSFREE;
5462 		break;
5463 	}
5464 
5465 	printf(", SEQADDR == 0x%x\n",
5466 	       ahc_inb(ahc, SEQADDR0) | (ahc_inb(ahc, SEQADDR1) << 8));
5467 
5468 #if 0
5469 	printf(", SCSISIGI == 0x%x\n", ahc_inb(ahc, SCSISIGI));
5470 	printf("SIMODE1 = 0x%x\n", ahc_inb(ahc, SIMODE1));
5471 	printf("INTSTAT = 0x%x\n", ahc_inb(ahc, INTSTAT));
5472 	printf("SSTAT1 == 0x%x\n", ahc_inb(ahc, SSTAT1));
5473 	printf("SCSIRATE == 0x%x\n", ahc_inb(ahc, SCSIRATE));
5474 	printf("CCSCBCTL == 0x%x\n", ahc_inb(ahc, CCSCBCTL));
5475 	printf("CCSCBCNT == 0x%x\n", ahc_inb(ahc, CCSCBCNT));
5476 	printf("DFCNTRL == 0x%x\n", ahc_inb(ahc, DFCNTRL));
5477 	printf("DFSTATUS == 0x%x\n", ahc_inb(ahc, DFSTATUS));
5478 	printf("CCHCNT == 0x%x\n", ahc_inb(ahc, CCHCNT));
5479 #endif
5480 	if (scb->flags & SCB_DEVICE_RESET) {
5481 		/*
5482 		 * Been down this road before.
5483 		 * Do a full bus reset.
5484 		 */
5485 bus_reset:
5486 		ahcsetccbstatus(scb->ccb, CAM_CMD_TIMEOUT);
5487 		found = ahc_reset_channel(ahc, channel, /*Initiate Reset*/TRUE);
5488 		printf("%s: Issued Channel %c Bus Reset. "
5489 		       "%d SCBs aborted\n", ahc_name(ahc), channel, found);
5490 	} else {
5491 		/*
5492 		 * If we are a target, transition to bus free and report
5493 		 * the timeout.
5494 		 *
5495 		 * The target/initiator that is holding up the bus may not
5496 		 * be the same as the one that triggered this timeout
5497 		 * (different commands have different timeout lengths).
5498 		 * If the bus is idle and we are actiing as the initiator
5499 		 * for this request, queue a BDR message to the timed out
5500 		 * target.  Otherwise, if the timed out transaction is
5501 		 * active:
5502 		 *   Initiator transaction:
5503 		 *	Stuff the message buffer with a BDR message and assert
5504 		 *	ATN in the hopes that the target will let go of the bus
5505 		 *	and go to the mesgout phase.  If this fails, we'll
5506 		 *	get another timeout 2 seconds later which will attempt
5507 		 *	a bus reset.
5508 		 *
5509 		 *   Target transaction:
5510 		 *	Transition to BUS FREE and report the error.
5511 		 *	It's good to be the target!
5512 		 */
5513 		u_int active_scb_index;
5514 
5515 		active_scb_index = ahc_inb(ahc, SCB_TAG);
5516 
5517 		if (bus_state != P_BUSFREE
5518 		  && (active_scb_index < ahc->scb_data->numscbs)) {
5519 			struct scb *active_scb;
5520 
5521 			/*
5522 			 * If the active SCB is not from our device,
5523 			 * assume that another device is hogging the bus
5524 			 * and wait for it's timeout to expire before
5525 			 * taking additional action.
5526 			 */
5527 			active_scb = &ahc->scb_data->scbarray[active_scb_index];
5528 			if (active_scb->hscb->tcl != scb->hscb->tcl
5529 			 && (scb->flags & SCB_OTHERTCL_TIMEOUT) == 0) {
5530 				struct	ccb_hdr *ccbh;
5531 				u_int	newtimeout;
5532 
5533 				xpt_print_path(scb->ccb->ccb_h.path);
5534 				printf("Other SCB Timeout\n");
5535 				scb->flags |= SCB_OTHERTCL_TIMEOUT;
5536 				newtimeout = MAX(active_scb->ccb->ccb_h.timeout,
5537 						 scb->ccb->ccb_h.timeout);
5538 				ccbh = &scb->ccb->ccb_h;
5539 				scb->ccb->ccb_h.timeout_ch =
5540 				    timeout(ahc_timeout, scb,
5541 					    (newtimeout * hz) / 1000);
5542 				splx(s);
5543 				return;
5544 			}
5545 
5546 			/* It's us */
5547 			if ((scb->hscb->control & TARGET_SCB) != 0) {
5548 
5549 				/*
5550 				 * Send back any queued up transactions
5551 				 * and properly record the error condition.
5552 				 */
5553 				ahc_freeze_devq(ahc, scb->ccb->ccb_h.path);
5554 				ahcsetccbstatus(scb->ccb, CAM_CMD_TIMEOUT);
5555 				ahc_freeze_ccb(scb->ccb);
5556 				ahc_done(ahc, scb);
5557 
5558 				/* Will clear us from the bus */
5559 				restart_sequencer(ahc);
5560 				return;
5561 			}
5562 
5563 			ahc_set_recoveryscb(ahc, active_scb);
5564 			ahc_outb(ahc, MSG_OUT, MSG_BUS_DEV_RESET);
5565 			ahc_outb(ahc, SCSISIGO, bus_state|ATNO);
5566 			xpt_print_path(active_scb->ccb->ccb_h.path);
5567 			printf("BDR message in message buffer\n");
5568 			active_scb->flags |=  SCB_DEVICE_RESET;
5569 			active_scb->ccb->ccb_h.timeout_ch =
5570 			    timeout(ahc_timeout, (caddr_t)active_scb, 2 * hz);
5571 			unpause_sequencer(ahc, /*unpause_always*/FALSE);
5572 		} else {
5573 			int	 disconnected;
5574 
5575 			/* XXX Shouldn't panic.  Just punt instead */
5576 			if ((scb->hscb->control & TARGET_SCB) != 0)
5577 				panic("Timed-out target SCB but bus idle");
5578 
5579 			if (bus_state != P_BUSFREE
5580 			 && (ahc_inb(ahc, SSTAT0) & TARGET) != 0) {
5581 				/* XXX What happened to the SCB? */
5582 				/* Hung target selection.  Goto busfree */
5583 				printf("%s: Hung target selection\n",
5584 				       ahc_name(ahc));
5585 				restart_sequencer(ahc);
5586 				return;
5587 			}
5588 
5589 			if (ahc_search_qinfifo(ahc, target, channel, lun,
5590 					       scb->hscb->tag, ROLE_INITIATOR,
5591 					       /*status*/0, SEARCH_COUNT) > 0) {
5592 				disconnected = FALSE;
5593 			} else {
5594 				disconnected = TRUE;
5595 			}
5596 
5597 			if (disconnected) {
5598 
5599 				ahc_set_recoveryscb(ahc, scb);
5600 				/*
5601 				 * Simply set the MK_MESSAGE control bit.
5602 				 */
5603 				scb->hscb->control |= MK_MESSAGE;
5604 				scb->flags |= SCB_QUEUED_MSG
5605 					   |  SCB_DEVICE_RESET;
5606 
5607 				/*
5608 				 * Remove this SCB from the disconnected
5609 				 * list so that a reconnect at this point
5610 				 * causes a BDR.
5611 				 */
5612 				ahc_search_disc_list(ahc, target, channel, lun,
5613 						     scb->hscb->tag);
5614 				ahc_index_busy_tcl(ahc, scb->hscb->tcl,
5615 						   /*unbusy*/TRUE);
5616 
5617 				/*
5618 				 * Actually re-queue this SCB in case we can
5619 				 * select the device before it reconnects.
5620 				 * Clear out any entries in the QINFIFO first
5621 				 * so we are the next SCB for this target
5622 				 * to run.
5623 				 */
5624 				ahc_search_qinfifo(ahc, SCB_TARGET(scb),
5625 						   channel, SCB_LUN(scb),
5626 						   SCB_LIST_NULL,
5627 						   CAM_REQUEUE_REQ,
5628 						   ROLE_INITIATOR,
5629 						   SEARCH_COMPLETE);
5630 				xpt_print_path(scb->ccb->ccb_h.path);
5631 				printf("Queuing a BDR SCB\n");
5632 				ahc->qinfifo[ahc->qinfifonext++] =
5633 				    scb->hscb->tag;
5634 				if ((ahc->features & AHC_QUEUE_REGS) != 0) {
5635 					ahc_outb(ahc, HNSCB_QOFF,
5636 						 ahc->qinfifonext);
5637 				} else {
5638 					ahc_outb(ahc, KERNEL_QINPOS,
5639 						 ahc->qinfifonext);
5640 				}
5641 				scb->ccb->ccb_h.timeout_ch =
5642 				    timeout(ahc_timeout, (caddr_t)scb, 2 * hz);
5643 				unpause_sequencer(ahc, /*unpause_always*/FALSE);
5644 			} else {
5645 				/* Go "immediatly" to the bus reset */
5646 				/* This shouldn't happen */
5647 				ahc_set_recoveryscb(ahc, scb);
5648 				xpt_print_path(scb->ccb->ccb_h.path);
5649 				printf("SCB %d: Immediate reset.  "
5650 					"Flags = 0x%x\n", scb->hscb->tag,
5651 					scb->flags);
5652 				goto bus_reset;
5653 			}
5654 		}
5655 	}
5656 	splx(s);
5657 }
5658 
5659 static int
5660 ahc_search_qinfifo(struct ahc_softc *ahc, int target, char channel,
5661 		   int lun, u_int tag, role_t role, u_int32_t status,
5662 		   ahc_search_action action)
5663 {
5664 	struct	 scb *scbp;
5665 	u_int8_t qinpos;
5666 	u_int8_t qintail;
5667 	int	 found;
5668 
5669 	qinpos = ahc_inb(ahc, QINPOS);
5670 	qintail = ahc->qinfifonext;
5671 	found = 0;
5672 
5673 	/*
5674 	 * Start with an empty queue.  Entries that are not chosen
5675 	 * for removal will be re-added to the queue as we go.
5676 	 */
5677 	ahc->qinfifonext = qinpos;
5678 
5679 	while (qinpos != qintail) {
5680 		scbp = &ahc->scb_data->scbarray[ahc->qinfifo[qinpos]];
5681 		if (ahc_match_scb(scbp, target, channel, lun, tag, role)) {
5682 			/*
5683 			 * We found an scb that needs to be removed.
5684 			 */
5685 			switch (action) {
5686 			case SEARCH_COMPLETE:
5687 				if (ahc_ccb_status(scbp->ccb) == CAM_REQ_INPROG)
5688 					ahcsetccbstatus(scbp->ccb, status);
5689 				ahc_freeze_ccb(scbp->ccb);
5690 				ahc_done(ahc, scbp);
5691 				break;
5692 			case SEARCH_COUNT:
5693 				ahc->qinfifo[ahc->qinfifonext++] =
5694 				    scbp->hscb->tag;
5695 				break;
5696 			case SEARCH_REMOVE:
5697 				break;
5698 			}
5699 			found++;
5700 		} else {
5701 			ahc->qinfifo[ahc->qinfifonext++] = scbp->hscb->tag;
5702 		}
5703 		qinpos++;
5704 	}
5705 
5706 	if ((ahc->features & AHC_QUEUE_REGS) != 0) {
5707 		ahc_outb(ahc, HNSCB_QOFF, ahc->qinfifonext);
5708 	} else {
5709 		ahc_outb(ahc, KERNEL_QINPOS, ahc->qinfifonext);
5710 	}
5711 
5712 	return (found);
5713 }
5714 
5715 
5716 static void
5717 ahc_abort_ccb(struct ahc_softc *ahc, struct cam_sim *sim, union ccb *ccb)
5718 {
5719 	union ccb *abort_ccb;
5720 
5721 	abort_ccb = ccb->cab.abort_ccb;
5722 	switch (abort_ccb->ccb_h.func_code) {
5723 	case XPT_ACCEPT_TARGET_IO:
5724 	case XPT_IMMED_NOTIFY:
5725 	case XPT_CONT_TARGET_IO:
5726 	{
5727 		struct tmode_tstate *tstate;
5728 		struct tmode_lstate *lstate;
5729 		struct ccb_hdr_slist *list;
5730 		cam_status status;
5731 
5732 		status = ahc_find_tmode_devs(ahc, sim, abort_ccb, &tstate,
5733 					     &lstate, TRUE);
5734 
5735 		if (status != CAM_REQ_CMP) {
5736 			ccb->ccb_h.status = status;
5737 			break;
5738 		}
5739 
5740 		if (abort_ccb->ccb_h.func_code == XPT_ACCEPT_TARGET_IO)
5741 			list = &lstate->accept_tios;
5742 		else if (abort_ccb->ccb_h.func_code == XPT_IMMED_NOTIFY)
5743 			list = &lstate->immed_notifies;
5744 		else
5745 			list = NULL;
5746 
5747 		if (list != NULL) {
5748 			struct ccb_hdr *curelm;
5749 			int found;
5750 
5751 			curelm = SLIST_FIRST(list);
5752 			found = 0;
5753 			if (curelm == &abort_ccb->ccb_h) {
5754 				found = 1;
5755 				SLIST_REMOVE_HEAD(list, sim_links.sle);
5756 			} else {
5757 				while(curelm != NULL) {
5758 					struct ccb_hdr *nextelm;
5759 
5760 					nextelm =
5761 					    SLIST_NEXT(curelm, sim_links.sle);
5762 
5763 					if (nextelm == &abort_ccb->ccb_h) {
5764 						found = 1;
5765 						SLIST_NEXT(curelm,
5766 							   sim_links.sle) =
5767 						    SLIST_NEXT(nextelm,
5768 							       sim_links.sle);
5769 						break;
5770 					}
5771 					curelm = nextelm;
5772 				}
5773 			}
5774 
5775 			if (found) {
5776 				abort_ccb->ccb_h.status = CAM_REQ_ABORTED;
5777 				xpt_done(abort_ccb);
5778 				ccb->ccb_h.status = CAM_REQ_CMP;
5779 			} else {
5780 				printf("Not found\n");
5781 				ccb->ccb_h.status = CAM_PATH_INVALID;
5782 			}
5783 			break;
5784 		}
5785 		/* FALLTHROUGH */
5786 	}
5787 	case XPT_SCSI_IO:
5788 		/* XXX Fully implement the hard ones */
5789 		ccb->ccb_h.status = CAM_UA_ABORT;
5790 		break;
5791 	default:
5792 		ccb->ccb_h.status = CAM_REQ_INVALID;
5793 		break;
5794 	}
5795 	xpt_done(ccb);
5796 }
5797 
5798 /*
5799  * Abort all SCBs that match the given description (target/channel/lun/tag),
5800  * setting their status to the passed in status if the status has not already
5801  * been modified from CAM_REQ_INPROG.  This routine assumes that the sequencer
5802  * is paused before it is called.
5803  */
5804 static int
5805 ahc_abort_scbs(struct ahc_softc *ahc, int target, char channel,
5806 	       int lun, u_int tag, role_t role, u_int32_t status)
5807 {
5808 	struct	scb *scbp;
5809 	u_int	active_scb;
5810 	int	i;
5811 	int	found;
5812 
5813 	/* restore this when we're done */
5814 	active_scb = ahc_inb(ahc, SCBPTR);
5815 
5816 	found = ahc_search_qinfifo(ahc, target, channel, lun, tag,
5817 				   CAM_REQUEUE_REQ, role, SEARCH_COMPLETE);
5818 
5819 	/*
5820 	 * Search waiting for selection list.
5821 	 */
5822 	{
5823 		u_int8_t next, prev;
5824 
5825 		next = ahc_inb(ahc, WAITING_SCBH);  /* Start at head of list. */
5826 		prev = SCB_LIST_NULL;
5827 
5828 		while (next != SCB_LIST_NULL) {
5829 			u_int8_t scb_index;
5830 
5831 			ahc_outb(ahc, SCBPTR, next);
5832 			scb_index = ahc_inb(ahc, SCB_TAG);
5833 			if (scb_index >= ahc->scb_data->numscbs) {
5834 				panic("Waiting List inconsistency. "
5835 				      "SCB index == %d, yet numscbs == %d.",
5836 				      scb_index, ahc->scb_data->numscbs);
5837 			}
5838 			scbp = &ahc->scb_data->scbarray[scb_index];
5839 			if (ahc_match_scb(scbp, target, channel,
5840 					  lun, tag, role)) {
5841 
5842 				next = ahc_abort_wscb(ahc, next, prev);
5843 			} else {
5844 
5845 				prev = next;
5846 				next = ahc_inb(ahc, SCB_NEXT);
5847 			}
5848 		}
5849 	}
5850 	/*
5851 	 * Go through the disconnected list and remove any entries we
5852 	 * have queued for completion, 0'ing their control byte too.
5853 	 */
5854 	ahc_search_disc_list(ahc, target, channel, lun, tag);
5855 
5856 	/*
5857 	 * Go through the hardware SCB array looking for commands that
5858 	 * were active but not on any list.
5859 	 */
5860 	for(i = 0; i < ahc->scb_data->maxhscbs; i++) {
5861 		u_int scbid;
5862 
5863 		ahc_outb(ahc, SCBPTR, i);
5864 		scbid = ahc_inb(ahc, SCB_TAG);
5865 		if (scbid < ahc->scb_data->numscbs) {
5866 			scbp = &ahc->scb_data->scbarray[scbid];
5867 			if (ahc_match_scb(scbp, target, channel,
5868 					  lun, tag, role)) {
5869 				ahc_add_curscb_to_free_list(ahc);
5870                         }
5871 		}
5872 	}
5873 	/*
5874 	 * Go through the pending CCB list and look for
5875 	 * commands for this target that are still active.
5876 	 * These are other tagged commands that were
5877 	 * disconnected when the reset occured.
5878 	 */
5879 	{
5880 		struct ccb_hdr *ccb_h;
5881 
5882 		ccb_h = ahc->pending_ccbs.lh_first;
5883 		while (ccb_h != NULL) {
5884 			scbp = (struct scb *)ccb_h->ccb_scb_ptr;
5885 			ccb_h = ccb_h->sim_links.le.le_next;
5886 			if (ahc_match_scb(scbp, target, channel,
5887 					  lun, tag, role)) {
5888 				if (ahc_ccb_status(scbp->ccb) == CAM_REQ_INPROG)
5889 					ahcsetccbstatus(scbp->ccb, status);
5890 				ahc_freeze_ccb(scbp->ccb);
5891 				ahc_done(ahc, scbp);
5892 				found++;
5893 			}
5894 		}
5895 	}
5896 	ahc_outb(ahc, SCBPTR, active_scb);
5897 	return found;
5898 }
5899 
5900 static int
5901 ahc_search_disc_list(struct ahc_softc *ahc, int target, char channel,
5902 		     int lun, u_int tag)
5903 {
5904 	struct	scb *scbp;
5905 	u_int	next;
5906 	u_int	prev;
5907 	u_int	count;
5908 	u_int	active_scb;
5909 
5910 	count = 0;
5911 	next = ahc_inb(ahc, DISCONNECTED_SCBH);
5912 	prev = SCB_LIST_NULL;
5913 
5914 	/* restore this when we're done */
5915 	active_scb = ahc_inb(ahc, SCBPTR);
5916 
5917 	while (next != SCB_LIST_NULL) {
5918 		u_int scb_index;
5919 
5920 		ahc_outb(ahc, SCBPTR, next);
5921 		scb_index = ahc_inb(ahc, SCB_TAG);
5922 		if (scb_index >= ahc->scb_data->numscbs) {
5923 			panic("Disconnected List inconsistency. "
5924 			      "SCB index == %d, yet numscbs == %d.",
5925 			      scb_index, ahc->scb_data->numscbs);
5926 		}
5927 		scbp = &ahc->scb_data->scbarray[scb_index];
5928 		if (ahc_match_scb(scbp, target, channel, lun,
5929 				  tag, ROLE_INITIATOR)) {
5930 			next = ahc_rem_scb_from_disc_list(ahc, prev, next);
5931 			count++;
5932 		} else {
5933 			prev = next;
5934 			next = ahc_inb(ahc, SCB_NEXT);
5935 		}
5936 	}
5937 	ahc_outb(ahc, SCBPTR, active_scb);
5938 	return (count);
5939 }
5940 
5941 static u_int
5942 ahc_rem_scb_from_disc_list(struct ahc_softc *ahc, u_int prev, u_int scbptr)
5943 {
5944 	u_int next;
5945 
5946 	ahc_outb(ahc, SCBPTR, scbptr);
5947 	next = ahc_inb(ahc, SCB_NEXT);
5948 
5949 	ahc_outb(ahc, SCB_CONTROL, 0);
5950 
5951 	ahc_add_curscb_to_free_list(ahc);
5952 
5953 	if (prev != SCB_LIST_NULL) {
5954 		ahc_outb(ahc, SCBPTR, prev);
5955 		ahc_outb(ahc, SCB_NEXT, next);
5956 	} else
5957 		ahc_outb(ahc, DISCONNECTED_SCBH, next);
5958 
5959 	return (next);
5960 }
5961 
5962 static void
5963 ahc_add_curscb_to_free_list(struct ahc_softc *ahc)
5964 {
5965 	/* Invalidate the tag so that ahc_find_scb doesn't think it's active */
5966 	ahc_outb(ahc, SCB_TAG, SCB_LIST_NULL);
5967 
5968 	ahc_outb(ahc, SCB_NEXT, ahc_inb(ahc, FREE_SCBH));
5969 	ahc_outb(ahc, FREE_SCBH, ahc_inb(ahc, SCBPTR));
5970 }
5971 
5972 /*
5973  * Manipulate the waiting for selection list and return the
5974  * scb that follows the one that we remove.
5975  */
5976 static u_int
5977 ahc_abort_wscb(struct ahc_softc *ahc, u_int scbpos, u_int prev)
5978 {
5979 	u_int curscb, next;
5980 
5981 	/*
5982 	 * Select the SCB we want to abort and
5983 	 * pull the next pointer out of it.
5984 	 */
5985 	curscb = ahc_inb(ahc, SCBPTR);
5986 	ahc_outb(ahc, SCBPTR, scbpos);
5987 	next = ahc_inb(ahc, SCB_NEXT);
5988 
5989 	/* Clear the necessary fields */
5990 	ahc_outb(ahc, SCB_CONTROL, 0);
5991 
5992 	ahc_add_curscb_to_free_list(ahc);
5993 
5994 	/* update the waiting list */
5995 	if (prev == SCB_LIST_NULL) {
5996 		/* First in the list */
5997 		ahc_outb(ahc, WAITING_SCBH, next);
5998 
5999 		/*
6000 		 * Ensure we aren't attempting to perform
6001 		 * selection for this entry.
6002 		 */
6003 		ahc_outb(ahc, SCSISEQ, (ahc_inb(ahc, SCSISEQ) & ~ENSELO));
6004 	} else {
6005 		/*
6006 		 * Select the scb that pointed to us
6007 		 * and update its next pointer.
6008 		 */
6009 		ahc_outb(ahc, SCBPTR, prev);
6010 		ahc_outb(ahc, SCB_NEXT, next);
6011 	}
6012 
6013 	/*
6014 	 * Point us back at the original scb position.
6015 	 */
6016 	ahc_outb(ahc, SCBPTR, curscb);
6017 	return next;
6018 }
6019 
6020 static void
6021 ahc_clear_intstat(struct ahc_softc *ahc)
6022 {
6023 	/* Clear any interrupt conditions this may have caused */
6024 	ahc_outb(ahc, CLRSINT0, CLRSELDO|CLRSELDI|CLRSELINGO);
6025 	ahc_outb(ahc, CLRSINT1, CLRSELTIMEO|CLRATNO|CLRSCSIRSTI
6026 				|CLRBUSFREE|CLRSCSIPERR|CLRPHASECHG|
6027 				CLRREQINIT);
6028 	ahc_outb(ahc, CLRINT, CLRSCSIINT);
6029 }
6030 
6031 static void
6032 ahc_reset_current_bus(struct ahc_softc *ahc)
6033 {
6034 	u_int8_t scsiseq;
6035 
6036 	ahc_outb(ahc, SIMODE1, ahc_inb(ahc, SIMODE1) & ~ENSCSIRST);
6037 	scsiseq = ahc_inb(ahc, SCSISEQ);
6038 	ahc_outb(ahc, SCSISEQ, scsiseq | SCSIRSTO);
6039 	DELAY(AHC_BUSRESET_DELAY);
6040 	/* Turn off the bus reset */
6041 	ahc_outb(ahc, SCSISEQ, scsiseq & ~SCSIRSTO);
6042 
6043 	ahc_clear_intstat(ahc);
6044 
6045 	/* Re-enable reset interrupts */
6046 	ahc_outb(ahc, SIMODE1, ahc_inb(ahc, SIMODE1) | ENSCSIRST);
6047 }
6048 
6049 static int
6050 ahc_reset_channel(struct ahc_softc *ahc, char channel, int initiate_reset)
6051 {
6052 	struct	cam_path *path;
6053 	u_int	initiator, target, max_scsiid;
6054 	u_int	sblkctl;
6055 	u_int	our_id;
6056 	int	found;
6057 	int	restart_needed;
6058 	char	cur_channel;
6059 
6060 	ahc->pending_device = NULL;
6061 
6062 	pause_sequencer(ahc);
6063 
6064 	/*
6065 	 * Run our command complete fifos to ensure that we perform
6066 	 * completion processing on any commands that 'completed'
6067 	 * before the reset occurred.
6068 	 */
6069 	ahc_run_qoutfifo(ahc);
6070 	if ((ahc->flags & AHC_TARGETMODE) != 0) {
6071 		ahc_run_tqinfifo(ahc);
6072 	}
6073 
6074 	/*
6075 	 * Reset the bus if we are initiating this reset
6076 	 */
6077 	sblkctl = ahc_inb(ahc, SBLKCTL);
6078 	cur_channel = 'A';
6079 	if ((ahc->features & AHC_TWIN) != 0
6080 	 && ((sblkctl & SELBUSB) != 0))
6081 	    cur_channel = 'B';
6082 	if (cur_channel != channel) {
6083 		/* Case 1: Command for another bus is active
6084 		 * Stealthily reset the other bus without
6085 		 * upsetting the current bus.
6086 		 */
6087 		ahc_outb(ahc, SBLKCTL, sblkctl ^ SELBUSB);
6088 		ahc_outb(ahc, SIMODE1, ahc_inb(ahc, SIMODE1) & ~ENBUSFREE);
6089 		ahc_outb(ahc, SCSISEQ,
6090 			 ahc_inb(ahc, SCSISEQ) & (ENSELI|ENRSELI|ENAUTOATNP));
6091 		if (initiate_reset)
6092 			ahc_reset_current_bus(ahc);
6093 		ahc_clear_intstat(ahc);
6094 		ahc_outb(ahc, SBLKCTL, sblkctl);
6095 		restart_needed = FALSE;
6096 	} else {
6097 		/* Case 2: A command from this bus is active or we're idle */
6098 		ahc_clear_msg_state(ahc);
6099 		ahc_outb(ahc, SIMODE1, ahc_inb(ahc, SIMODE1) & ~ENBUSFREE);
6100 		ahc_outb(ahc, SCSISEQ,
6101 			 ahc_inb(ahc, SCSISEQ) & (ENSELI|ENRSELI|ENAUTOATNP));
6102 		if (initiate_reset)
6103 			ahc_reset_current_bus(ahc);
6104 		ahc_clear_intstat(ahc);
6105 
6106 		/*
6107 		 * Since we are going to restart the sequencer, avoid
6108 		 * a race in the sequencer that could cause corruption
6109 		 * of our Q pointers by starting over from index 0.
6110 		 */
6111 		ahc->qoutfifonext = 0;
6112 		if ((ahc->features & AHC_QUEUE_REGS) != 0)
6113 			ahc_outb(ahc, SDSCB_QOFF, 0);
6114 		else
6115 			ahc_outb(ahc, QOUTPOS, 0);
6116 		if ((ahc->flags & AHC_TARGETMODE) != 0) {
6117 			ahc->tqinfifonext = 0;
6118 			ahc_outb(ahc, KERNEL_TQINPOS, ahc->tqinfifonext - 1);
6119 			ahc_outb(ahc, TQINPOS, 0);
6120 		}
6121 		restart_needed = TRUE;
6122 	}
6123 
6124 	/*
6125 	 * Clean up all the state information for the
6126 	 * pending transactions on this bus.
6127 	 */
6128 	found = ahc_abort_scbs(ahc, CAM_TARGET_WILDCARD, channel,
6129 			       CAM_LUN_WILDCARD, SCB_LIST_NULL,
6130 			       ROLE_UNKNOWN, CAM_SCSI_BUS_RESET);
6131 	if (channel == 'B') {
6132 		path = ahc->path_b;
6133 		our_id = ahc->our_id_b;
6134 	} else {
6135 		path = ahc->path;
6136 		our_id = ahc->our_id;
6137 	}
6138 
6139 	max_scsiid = (ahc->features & AHC_WIDE) ? 15 : 7;
6140 
6141 	/*
6142 	 * Send an immediate notify ccb to all target more peripheral
6143 	 * drivers affected by this action.
6144 	 */
6145 	for (target = 0; target <= max_scsiid; target++) {
6146 		struct tmode_tstate* tstate;
6147 		u_int lun;
6148 
6149 		tstate = ahc->enabled_targets[target];
6150 		if (tstate == NULL)
6151 			continue;
6152 		for (lun = 0; lun <= 7; lun++) {
6153 			struct tmode_lstate* lstate;
6154 
6155 			lstate = tstate->enabled_luns[lun];
6156 			if (lstate == NULL)
6157 				continue;
6158 
6159 			ahc_queue_lstate_event(ahc, lstate, CAM_TARGET_WILDCARD,
6160 					       EVENT_TYPE_BUS_RESET, /*arg*/0);
6161 			ahc_send_lstate_events(ahc, lstate);
6162 		}
6163 	}
6164 
6165 	/* Notify the XPT that a bus reset occurred */
6166 	xpt_async(AC_BUS_RESET, path, NULL);
6167 
6168 	/*
6169 	 * Revert to async/narrow transfers until we renegotiate.
6170 	 */
6171 	for (target = 0; target <= max_scsiid; target++) {
6172 
6173 		if (ahc->enabled_targets[target] == NULL)
6174 			continue;
6175 		for (initiator = 0; initiator <= max_scsiid; initiator++) {
6176 			struct ahc_devinfo devinfo;
6177 
6178 			ahc_compile_devinfo(&devinfo, target, initiator,
6179 					    CAM_LUN_WILDCARD,
6180 					    channel, ROLE_UNKNOWN);
6181 			ahc_set_width(ahc, &devinfo, path,
6182 				      MSG_EXT_WDTR_BUS_8_BIT,
6183 				      AHC_TRANS_CUR, /*paused*/TRUE);
6184 			ahc_set_syncrate(ahc, &devinfo, path,
6185 					 /*syncrate*/NULL, /*period*/0,
6186 					 /*offset*/0, AHC_TRANS_CUR,
6187 					 /*paused*/TRUE);
6188 		}
6189 	}
6190 
6191 	if (restart_needed)
6192 		restart_sequencer(ahc);
6193 	else
6194 		unpause_sequencer(ahc, /*unpause_always*/FALSE);
6195 	return found;
6196 }
6197 
6198 static int
6199 ahc_match_scb(struct scb *scb, int target, char channel,
6200 	      int lun, role_t role, u_int tag)
6201 {
6202 	int targ = SCB_TARGET(scb);
6203 	char chan = SCB_CHANNEL(scb);
6204 	int slun = SCB_LUN(scb);
6205 	int match;
6206 
6207 	match = ((chan == channel) || (channel == ALL_CHANNELS));
6208 	if (match != 0)
6209 		match = ((targ == target) || (target == CAM_TARGET_WILDCARD));
6210 	if (match != 0)
6211 		match = ((lun == slun) || (lun == CAM_LUN_WILDCARD));
6212 	if (match != 0) {
6213 		int group;
6214 
6215 		group = XPT_FC_GROUP(scb->ccb->ccb_h.func_code);
6216 		if (role == ROLE_INITIATOR) {
6217 			match = (group == XPT_FC_GROUP_COMMON)
6218 			      && ((tag == scb->ccb->csio.tag_id)
6219 			       || (tag == SCB_LIST_NULL));
6220 		} else if (role == ROLE_TARGET) {
6221 			match = (group == XPT_FC_GROUP_TMODE)
6222 			      && ((tag == scb->ccb->csio.tag_id)
6223 			       || (tag == SCB_LIST_NULL));
6224 		}
6225 	}
6226 	return match;
6227 }
6228 
6229 static void
6230 ahc_construct_sdtr(struct ahc_softc *ahc, u_int period, u_int offset)
6231 {
6232 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXTENDED;
6233 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXT_SDTR_LEN;
6234 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXT_SDTR;
6235 	ahc->msgout_buf[ahc->msgout_index++] = period;
6236 	ahc->msgout_buf[ahc->msgout_index++] = offset;
6237 	ahc->msgout_len += 5;
6238 }
6239 
6240 static void
6241 ahc_construct_wdtr(struct ahc_softc *ahc, u_int bus_width)
6242 {
6243 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXTENDED;
6244 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXT_WDTR_LEN;
6245 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXT_WDTR;
6246 	ahc->msgout_buf[ahc->msgout_index++] = bus_width;
6247 	ahc->msgout_len += 4;
6248 }
6249 
6250 static void
6251 ahc_calc_residual(struct scb *scb)
6252 {
6253 	struct	hardware_scb *hscb;
6254 
6255 	hscb = scb->hscb;
6256 
6257 	/*
6258 	 * If the disconnected flag is still set, this is bogus
6259 	 * residual information left over from a sequencer
6260 	 * pagin/pageout, so ignore this case.
6261 	 */
6262 	if ((scb->hscb->control & DISCONNECTED) == 0) {
6263 		u_int32_t resid;
6264 		int	  resid_sgs;
6265 		int	  sg;
6266 
6267 		/*
6268 		 * Remainder of the SG where the transfer
6269 		 * stopped.
6270 		 */
6271 		resid = (hscb->residual_data_count[2] << 16)
6272 		      |	(hscb->residual_data_count[1] <<8)
6273 		      |	(hscb->residual_data_count[0]);
6274 
6275 		/*
6276 		 * Add up the contents of all residual
6277 		 * SG segments that are after the SG where
6278 		 * the transfer stopped.
6279 		 */
6280 		resid_sgs = scb->hscb->residual_SG_count - 1/*current*/;
6281 		sg = scb->sg_count - resid_sgs - 1/*first SG*/;
6282 		while (resid_sgs > 0) {
6283 
6284 			resid += scb->sg_list[sg].len;
6285 			sg++;
6286 			resid_sgs--;
6287 		}
6288 		if ((scb->flags & SCB_SENSE) == 0) {
6289 
6290 			scb->ccb->csio.resid = resid;
6291 		} else {
6292 
6293 			scb->ccb->csio.sense_resid = resid;
6294 		}
6295 	}
6296 
6297 	/*
6298 	 * Clean out the residual information in this SCB for its
6299 	 * next consumer.
6300 	 */
6301 	hscb->residual_data_count[0] = 0;
6302 	hscb->residual_data_count[1] = 0;
6303 	hscb->residual_data_count[2] = 0;
6304 	hscb->residual_SG_count = 0;
6305 
6306 #ifdef AHC_DEBUG
6307 	if (ahc_debug & AHC_SHOWMISC) {
6308 		sc_print_addr(xs->sc_link);
6309 		printf("Handled Residual of %ld bytes\n" ,xs->resid);
6310 	}
6311 #endif
6312 }
6313 
6314 static void
6315 ahc_update_pending_syncrates(struct ahc_softc *ahc)
6316 {
6317 	struct	ccb_hdr *ccbh;
6318 	int	pending_ccb_count;
6319 	int	i;
6320 	u_int	saved_scbptr;
6321 
6322 	/*
6323 	 * Traverse the pending SCB list and ensure that all of the
6324 	 * SCBs there have the proper settings.
6325 	 */
6326 	ccbh = LIST_FIRST(&ahc->pending_ccbs);
6327 	pending_ccb_count = 0;
6328 	while (ccbh != NULL) {
6329 		struct ahc_devinfo devinfo;
6330 		union  ccb *ccb;
6331 		struct scb *pending_scb;
6332 		struct hardware_scb *pending_hscb;
6333 		struct ahc_initiator_tinfo *tinfo;
6334 		struct tmode_tstate *tstate;
6335 		u_int  our_id, remote_id;
6336 
6337 		ccb = (union ccb*)ccbh;
6338 		pending_scb = (struct scb *)ccbh->ccb_scb_ptr;
6339 		pending_hscb = pending_scb->hscb;
6340 		if (ccbh->func_code == XPT_CONT_TARGET_IO) {
6341 			our_id = ccb->ccb_h.target_id;
6342 			remote_id = ccb->ctio.init_id;
6343 		} else {
6344 			our_id = SCB_IS_SCSIBUS_B(pending_scb)
6345 			       ? ahc->our_id_b : ahc->our_id;
6346 			remote_id = ccb->ccb_h.target_id;
6347 		}
6348 		ahc_compile_devinfo(&devinfo, our_id, remote_id,
6349 				    SCB_LUN(pending_scb),
6350 				    SCB_CHANNEL(pending_scb),
6351 				    ROLE_UNKNOWN);
6352 		tinfo = ahc_fetch_transinfo(ahc, devinfo.channel,
6353 					    our_id, remote_id, &tstate);
6354 		pending_hscb->control &= ~ULTRAENB;
6355 		if ((tstate->ultraenb & devinfo.target_mask) != 0)
6356 			pending_hscb->control |= ULTRAENB;
6357 		pending_hscb->scsirate = tinfo->scsirate;
6358 		pending_hscb->scsioffset = tinfo->current.offset;
6359 		pending_ccb_count++;
6360 		ccbh = LIST_NEXT(ccbh, sim_links.le);
6361 	}
6362 
6363 	if (pending_ccb_count == 0)
6364 		return;
6365 
6366 	saved_scbptr = ahc_inb(ahc, SCBPTR);
6367 	/* Ensure that the hscbs down on the card match the new information */
6368 	for (i = 0; i < ahc->scb_data->maxhscbs; i++) {
6369 		u_int scb_tag;
6370 
6371 		ahc_outb(ahc, SCBPTR, i);
6372 		scb_tag = ahc_inb(ahc, SCB_TAG);
6373 		if (scb_tag != SCB_LIST_NULL) {
6374 			struct	ahc_devinfo devinfo;
6375 			union  ccb *ccb;
6376 			struct	scb *pending_scb;
6377 			struct	hardware_scb *pending_hscb;
6378 			struct	ahc_initiator_tinfo *tinfo;
6379 			struct	tmode_tstate *tstate;
6380 			u_int	our_id, remote_id;
6381 			u_int	control;
6382 
6383 			pending_scb = &ahc->scb_data->scbarray[scb_tag];
6384 			if (pending_scb->flags == SCB_FREE)
6385 				continue;
6386 			pending_hscb = pending_scb->hscb;
6387 			ccb = pending_scb->ccb;
6388 			if (ccb->ccb_h.func_code == XPT_CONT_TARGET_IO) {
6389 				our_id = ccb->ccb_h.target_id;
6390 				remote_id = ccb->ctio.init_id;
6391 			} else {
6392 				our_id = SCB_IS_SCSIBUS_B(pending_scb)
6393 				       ? ahc->our_id_b : ahc->our_id;
6394 				remote_id = ccb->ccb_h.target_id;
6395 			}
6396 			ahc_compile_devinfo(&devinfo, our_id, remote_id,
6397 					    SCB_LUN(pending_scb),
6398 					    SCB_CHANNEL(pending_scb),
6399 					    ROLE_UNKNOWN);
6400 			tinfo = ahc_fetch_transinfo(ahc, devinfo.channel,
6401 						    our_id, remote_id, &tstate);
6402 			control = ahc_inb(ahc, SCB_CONTROL);
6403 			control &= ~ULTRAENB;
6404 			if ((tstate->ultraenb & devinfo.target_mask) != 0)
6405 				control |= ULTRAENB;
6406 			ahc_outb(ahc, SCB_CONTROL, control);
6407 			ahc_outb(ahc, SCB_SCSIRATE, tinfo->scsirate);
6408 			ahc_outb(ahc, SCB_SCSIOFFSET, tinfo->current.offset);
6409 		}
6410 	}
6411 	ahc_outb(ahc, SCBPTR, saved_scbptr);
6412 }
6413 
6414 #if UNUSED
6415 static void
6416 ahc_dump_targcmd(struct target_cmd *cmd)
6417 {
6418 	u_int8_t *byte;
6419 	u_int8_t *last_byte;
6420 	int i;
6421 
6422 	byte = &cmd->initiator_channel;
6423 	/* Debugging info for received commands */
6424 	last_byte = &cmd[1].initiator_channel;
6425 
6426 	i = 0;
6427 	while (byte < last_byte) {
6428 		if (i == 0)
6429 			printf("\t");
6430 		printf("%#x", *byte++);
6431 		i++;
6432 		if (i == 8) {
6433 			printf("\n");
6434 			i = 0;
6435 		} else {
6436 			printf(", ");
6437 		}
6438 	}
6439 }
6440 #endif
6441 
6442 static void
6443 ahc_shutdown(void *arg, int howto)
6444 {
6445 	struct	ahc_softc *ahc;
6446 	int	i;
6447 	u_int	sxfrctl1_a, sxfrctl1_b;
6448 
6449 	ahc = (struct ahc_softc *)arg;
6450 
6451 	pause_sequencer(ahc);
6452 
6453 	/*
6454 	 * Preserve the value of the SXFRCTL1 register for all channels.
6455 	 * It contains settings that affect termination and we don't want
6456 	 * to disturb the integrity of the bus during shutdown in case
6457 	 * we are in a multi-initiator setup.
6458 	 */
6459 	sxfrctl1_b = 0;
6460 	if ((ahc->features & AHC_TWIN) != 0) {
6461 		u_int sblkctl;
6462 
6463 		sblkctl = ahc_inb(ahc, SBLKCTL);
6464 		ahc_outb(ahc, SBLKCTL, sblkctl | SELBUSB);
6465 		sxfrctl1_b = ahc_inb(ahc, SXFRCTL1);
6466 		ahc_outb(ahc, SBLKCTL, sblkctl & ~SELBUSB);
6467 	}
6468 
6469 	sxfrctl1_a = ahc_inb(ahc, SXFRCTL1);
6470 
6471 	/* This will reset most registers to 0, but not all */
6472 	ahc_reset(ahc);
6473 
6474 	if ((ahc->features & AHC_TWIN) != 0) {
6475 		u_int sblkctl;
6476 
6477 		sblkctl = ahc_inb(ahc, SBLKCTL);
6478 		ahc_outb(ahc, SBLKCTL, sblkctl | SELBUSB);
6479 		ahc_outb(ahc, SXFRCTL1, sxfrctl1_b);
6480 		ahc_outb(ahc, SBLKCTL, sblkctl & ~SELBUSB);
6481 	}
6482 	ahc_outb(ahc, SXFRCTL1, sxfrctl1_a);
6483 
6484 	ahc_outb(ahc, SCSISEQ, 0);
6485 	ahc_outb(ahc, SXFRCTL0, 0);
6486 	ahc_outb(ahc, DSPCISTATUS, 0);
6487 
6488 	for (i = TARG_SCSIRATE; i < HA_274_BIOSCTRL; i++)
6489 		ahc_outb(ahc, i, 0);
6490 }
6491 
6492 /*
6493  * Add a target mode event to this lun's queue
6494  */
6495 static void
6496 ahc_queue_lstate_event(struct ahc_softc *ahc, struct tmode_lstate *lstate,
6497 		       u_int initiator_id, u_int event_type, u_int event_arg)
6498 {
6499 	struct ahc_tmode_event *event;
6500 	int pending;
6501 
6502 	xpt_freeze_devq(lstate->path, /*count*/1);
6503 	if (lstate->event_w_idx >= lstate->event_r_idx)
6504 		pending = lstate->event_w_idx - lstate->event_r_idx;
6505 	else
6506 		pending = AHC_TMODE_EVENT_BUFFER_SIZE + 1
6507 			- (lstate->event_r_idx - lstate->event_w_idx);
6508 
6509 	if (event_type == EVENT_TYPE_BUS_RESET
6510 	 || event_type == MSG_BUS_DEV_RESET) {
6511 		/*
6512 		 * Any earlier events are irrelevant, so reset our buffer.
6513 		 * This has the effect of allowing us to deal with reset
6514 		 * floods (an external device holding down the reset line)
6515 		 * without losing the event that is really interesting.
6516 		 */
6517 		lstate->event_r_idx = 0;
6518 		lstate->event_w_idx = 0;
6519 		xpt_release_devq(lstate->path, pending, /*runqueue*/FALSE);
6520 	}
6521 
6522 	if (pending == AHC_TMODE_EVENT_BUFFER_SIZE) {
6523 		xpt_print_path(lstate->path);
6524 		printf("immediate event %x:%x lost\n",
6525 		       lstate->event_buffer[lstate->event_r_idx].event_type,
6526 		       lstate->event_buffer[lstate->event_r_idx].event_arg);
6527 		lstate->event_r_idx++;
6528 		if (lstate->event_r_idx == AHC_TMODE_EVENT_BUFFER_SIZE)
6529 			lstate->event_r_idx = 0;
6530 		xpt_release_devq(lstate->path, /*count*/1, /*runqueue*/FALSE);
6531 	}
6532 
6533 	event = &lstate->event_buffer[lstate->event_w_idx];
6534 	event->initiator_id = initiator_id;
6535 	event->event_type = event_type;
6536 	event->event_arg = event_arg;
6537 	lstate->event_w_idx++;
6538 	if (lstate->event_w_idx == AHC_TMODE_EVENT_BUFFER_SIZE)
6539 		lstate->event_w_idx = 0;
6540 }
6541 
6542 /*
6543  * Send any target mode events queued up waiting
6544  * for immediate notify resources.
6545  */
6546 static void
6547 ahc_send_lstate_events(struct ahc_softc *ahc, struct tmode_lstate *lstate)
6548 {
6549 	struct ccb_hdr *ccbh;
6550 	struct ccb_immed_notify *inot;
6551 
6552 	while (lstate->event_r_idx != lstate->event_w_idx
6553 	    && (ccbh = SLIST_FIRST(&lstate->immed_notifies)) != NULL) {
6554 		struct ahc_tmode_event *event;
6555 
6556 		event = &lstate->event_buffer[lstate->event_r_idx];
6557 		SLIST_REMOVE_HEAD(&lstate->immed_notifies, sim_links.sle);
6558 		inot = (struct ccb_immed_notify *)ccbh;
6559 		switch (event->event_type) {
6560 		case EVENT_TYPE_BUS_RESET:
6561 			ccbh->status = CAM_SCSI_BUS_RESET|CAM_DEV_QFRZN;
6562 			break;
6563 		default:
6564 			ccbh->status = CAM_MESSAGE_RECV|CAM_DEV_QFRZN;
6565 			inot->message_args[0] = event->event_type;
6566 			inot->message_args[1] = event->event_arg;
6567 			break;
6568 		}
6569 		inot->initiator_id = event->initiator_id;
6570 		inot->sense_len = 0;
6571 		xpt_done((union ccb *)inot);
6572 		lstate->event_r_idx++;
6573 		if (lstate->event_r_idx == AHC_TMODE_EVENT_BUFFER_SIZE)
6574 			lstate->event_r_idx = 0;
6575 	}
6576 }
6577