xref: /freebsd/sys/dev/aic7xxx/aic7xxx.c (revision 6e8394b8baa7d5d9153ab90de6824bcd19b3b4e1)
1 /*
2  * Generic driver for the aic7xxx based adaptec SCSI controllers
3  * Product specific probe and attach routines can be found in:
4  * i386/eisa/ahc_eisa.c	27/284X and aic7770 motherboard controllers
5  * pci/ahc_pci.c	3985, 3980, 3940, 2940, aic7895, aic7890,
6  *			aic7880, aic7870, aic7860, and aic7850 controllers
7  *
8  * Copyright (c) 1994, 1995, 1996, 1997, 1998, 1999 Justin T. Gibbs.
9  * All rights reserved.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions, and the following disclaimer,
16  *    without modification, immediately at the beginning of the file.
17  * 2. The name of the author may not be used to endorse or promote products
18  *    derived from this software without specific prior written permission.
19  *
20  * Where this Software is combined with software released under the terms of
21  * the GNU Public License ("GPL") and the terms of the GPL would require the
22  * combined work to also be released under the terms of the GPL, the terms
23  * and conditions of this License will apply in addition to those of the
24  * GPL with the exception of any terms or conditions of this License that
25  * conflict with, or are expressly prohibited by, the GPL.
26  *
27  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
28  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
29  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
30  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
31  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
32  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
33  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
34  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
35  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
36  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
37  * SUCH DAMAGE.
38  *
39  *      $Id: aic7xxx.c,v 1.30 1999/05/22 22:04:07 gibbs Exp $
40  */
41 /*
42  * A few notes on features of the driver.
43  *
44  * SCB paging takes advantage of the fact that devices stay disconnected
45  * from the bus a relatively long time and that while they're disconnected,
46  * having the SCBs for these transactions down on the host adapter is of
47  * little use.  Instead of leaving this idle SCB down on the card we copy
48  * it back up into kernel memory and reuse the SCB slot on the card to
49  * schedule another transaction.  This can be a real payoff when doing random
50  * I/O to tagged queueing devices since there are more transactions active at
51  * once for the device to sort for optimal seek reduction. The algorithm goes
52  * like this...
53  *
54  * The sequencer maintains two lists of its hardware SCBs.  The first is the
55  * singly linked free list which tracks all SCBs that are not currently in
56  * use.  The second is the doubly linked disconnected list which holds the
57  * SCBs of transactions that are in the disconnected state sorted most
58  * recently disconnected first.  When the kernel queues a transaction to
59  * the card, a hardware SCB to "house" this transaction is retrieved from
60  * either of these two lists.  If the SCB came from the disconnected list,
61  * a check is made to see if any data transfer or SCB linking (more on linking
62  * in a bit) information has been changed since it was copied from the host
63  * and if so, DMAs the SCB back up before it can be used.  Once a hardware
64  * SCB has been obtained, the SCB is DMAed from the host.  Before any work
65  * can begin on this SCB, the sequencer must ensure that either the SCB is
66  * for a tagged transaction or the target is not already working on another
67  * non-tagged transaction.  If a conflict arises in the non-tagged case, the
68  * sequencer finds the SCB for the active transactions and sets the SCB_LINKED
69  * field in that SCB to this next SCB to execute.  To facilitate finding
70  * active non-tagged SCBs, the last four bytes of up to the first four hardware
71  * SCBs serve as a storage area for the currently active SCB ID for each
72  * target.
73  *
74  * When a device reconnects, a search is made of the hardware SCBs to find
75  * the SCB for this transaction.  If the search fails, a hardware SCB is
76  * pulled from either the free or disconnected SCB list and the proper
77  * SCB is DMAed from the host.  If the MK_MESSAGE control bit is set
78  * in the control byte of the SCB while it was disconnected, the sequencer
79  * will assert ATN and attempt to issue a message to the host.
80  *
81  * When a command completes, a check for non-zero status and residuals is
82  * made.  If either of these conditions exists, the SCB is DMAed back up to
83  * the host so that it can interpret this information.  Additionally, in the
84  * case of bad status, the sequencer generates a special interrupt and pauses
85  * itself.  This allows the host to setup a request sense command if it
86  * chooses for this target synchronously with the error so that sense
87  * information isn't lost.
88  *
89  */
90 
91 #include <opt_aic7xxx.h>
92 
93 #include <pci.h>
94 #include <stddef.h>	/* For offsetof */
95 
96 #include <sys/param.h>
97 #include <sys/systm.h>
98 #include <sys/malloc.h>
99 #include <sys/buf.h>
100 #include <sys/proc.h>
101 
102 #include <cam/cam.h>
103 #include <cam/cam_ccb.h>
104 #include <cam/cam_sim.h>
105 #include <cam/cam_xpt_sim.h>
106 #include <cam/cam_debug.h>
107 
108 #include <cam/scsi/scsi_all.h>
109 #include <cam/scsi/scsi_message.h>
110 
111 #if NPCI > 0
112 #include <machine/bus_memio.h>
113 #endif
114 #include <machine/bus_pio.h>
115 #include <machine/bus.h>
116 #include <machine/clock.h>
117 #include <sys/rman.h>
118 
119 #include <vm/vm.h>
120 #include <vm/vm_param.h>
121 #include <vm/pmap.h>
122 
123 #include <dev/aic7xxx/aic7xxx.h>
124 #include <dev/aic7xxx/sequencer.h>
125 
126 #include <aic7xxx_reg.h>
127 #include <aic7xxx_seq.h>
128 
129 #include <sys/kernel.h>
130 
131 #ifndef AHC_TMODE_ENABLE
132 #define AHC_TMODE_ENABLE 0
133 #endif
134 
135 #define MAX(a,b) (((a) > (b)) ? (a) : (b))
136 #define MIN(a,b) (((a) < (b)) ? (a) : (b))
137 #define ALL_CHANNELS '\0'
138 #define ALL_TARGETS_MASK 0xFFFF
139 #define INITIATOR_WILDCARD	(~0)
140 
141 #define	SIM_IS_SCSIBUS_B(ahc, sim)	\
142 	((sim) == ahc->sim_b)
143 #define	SIM_CHANNEL(ahc, sim)	\
144 	(((sim) == ahc->sim_b) ? 'B' : 'A')
145 #define	SIM_SCSI_ID(ahc, sim)	\
146 	(((sim) == ahc->sim_b) ? ahc->our_id_b : ahc->our_id)
147 #define	SIM_PATH(ahc, sim)	\
148 	(((sim) == ahc->sim_b) ? ahc->path_b : ahc->path)
149 #define	SCB_IS_SCSIBUS_B(scb)	\
150 	(((scb)->hscb->tcl & SELBUSB) != 0)
151 #define	SCB_TARGET(scb)	\
152 	(((scb)->hscb->tcl & TID) >> 4)
153 #define	SCB_CHANNEL(scb) \
154 	(SCB_IS_SCSIBUS_B(scb) ? 'B' : 'A')
155 #define	SCB_LUN(scb)	\
156 	((scb)->hscb->tcl & LID)
157 #define SCB_TARGET_OFFSET(scb)		\
158 	(SCB_TARGET(scb) + (SCB_IS_SCSIBUS_B(scb) ? 8 : 0))
159 #define SCB_TARGET_MASK(scb)		\
160 	(0x01 << (SCB_TARGET_OFFSET(scb)))
161 #define TCL_CHANNEL(ahc, tcl)		\
162 	((((ahc)->features & AHC_TWIN) && ((tcl) & SELBUSB)) ? 'B' : 'A')
163 #define TCL_SCSI_ID(ahc, tcl)		\
164 	(TCL_CHANNEL((ahc), (tcl)) == 'B' ? (ahc)->our_id_b : (ahc)->our_id)
165 #define TCL_TARGET(tcl) (((tcl) & TID) >> TCL_TARGET_SHIFT)
166 #define TCL_LUN(tcl) ((tcl) & LID)
167 
168 #define ccb_scb_ptr spriv_ptr0
169 #define ccb_ahc_ptr spriv_ptr1
170 
171 typedef enum {
172 	ROLE_UNKNOWN,
173 	ROLE_INITIATOR,
174 	ROLE_TARGET,
175 } role_t;
176 
177 struct ahc_devinfo {
178 	int	  our_scsiid;
179 	int	  target_offset;
180 	u_int16_t target_mask;
181 	u_int8_t  target;
182 	u_int8_t  lun;
183 	char	  channel;
184 	role_t	  role;		/*
185 				 * Only guaranteed to be correct if not
186 				 * in the busfree state.
187 				 */
188 };
189 
190 typedef enum {
191 	SEARCH_COMPLETE,
192 	SEARCH_COUNT,
193 	SEARCH_REMOVE
194 } ahc_search_action;
195 
196 #ifdef AHC_DEBUG
197 static int     ahc_debug = AHC_DEBUG;
198 #endif
199 
200 #if NPCI > 0
201 void ahc_pci_intr(struct ahc_softc *ahc);
202 #endif
203 
204 static int	ahcinitscbdata(struct ahc_softc *ahc);
205 static void	ahcfiniscbdata(struct ahc_softc *ahc);
206 
207 static bus_dmamap_callback_t	ahcdmamapcb;
208 
209 #if UNUSED
210 static void	ahc_dump_targcmd(struct target_cmd *cmd);
211 #endif
212 static void	ahc_shutdown(int howto, void *arg);
213 static cam_status
214 		ahc_find_tmode_devs(struct ahc_softc *ahc,
215 				    struct cam_sim *sim, union ccb *ccb,
216 				    struct tmode_tstate **tstate,
217 				    struct tmode_lstate **lstate,
218 				    int notfound_failure);
219 static void	ahc_action(struct cam_sim *sim, union ccb *ccb);
220 static void	ahc_async(void *callback_arg, u_int32_t code,
221 			  struct cam_path *path, void *arg);
222 static void	ahc_execute_scb(void *arg, bus_dma_segment_t *dm_segs,
223 				int nsegments, int error);
224 static void	ahc_poll(struct cam_sim *sim);
225 static void	ahc_setup_data(struct ahc_softc *ahc,
226 			       struct ccb_scsiio *csio, struct scb *scb);
227 static void	ahc_freeze_devq(struct ahc_softc *ahc, struct cam_path *path);
228 static void	ahcallocscbs(struct ahc_softc *ahc);
229 static void	ahc_scb_devinfo(struct ahc_softc *ahc,
230 				struct ahc_devinfo *devinfo,
231 				struct scb *scb);
232 static void	ahc_fetch_devinfo(struct ahc_softc *ahc,
233 				  struct ahc_devinfo *devinfo);
234 static void	ahc_compile_devinfo(struct ahc_devinfo *devinfo, u_int our_id,
235 				    u_int target, u_int lun, char channel,
236 				    role_t role);
237 static u_int	ahc_abort_wscb(struct ahc_softc *ahc, u_int scbpos, u_int prev);
238 static void	ahc_done(struct ahc_softc *ahc, struct scb *scbp);
239 static struct tmode_tstate *
240 		ahc_alloc_tstate(struct ahc_softc *ahc,
241 				 u_int scsi_id, char channel);
242 static void	ahc_free_tstate(struct ahc_softc *ahc,
243 				u_int scsi_id, char channel, int force);
244 static void	ahc_handle_en_lun(struct ahc_softc *ahc, struct cam_sim *sim,
245 				  union ccb *ccb);
246 static int	ahc_handle_target_cmd(struct ahc_softc *ahc,
247 				      struct target_cmd *cmd);
248 static void 	ahc_handle_seqint(struct ahc_softc *ahc, u_int intstat);
249 static void	ahc_handle_scsiint(struct ahc_softc *ahc, u_int intstat);
250 static void	ahc_build_transfer_msg(struct ahc_softc *ahc,
251 				       struct ahc_devinfo *devinfo);
252 static void	ahc_setup_initiator_msgout(struct ahc_softc *ahc,
253 					   struct ahc_devinfo *devinfo,
254 					   struct scb *scb);
255 static void	ahc_setup_target_msgin(struct ahc_softc *ahc,
256 				       struct ahc_devinfo *devinfo);
257 static int	ahc_handle_msg_reject(struct ahc_softc *ahc,
258 				      struct ahc_devinfo *devinfo);
259 static void	ahc_clear_msg_state(struct ahc_softc *ahc);
260 static void	ahc_handle_message_phase(struct ahc_softc *ahc,
261 					 struct cam_path *path);
262 static int	ahc_sent_msg(struct ahc_softc *ahc, u_int msgtype, int full);
263 static int	ahc_parse_msg(struct ahc_softc *ahc, struct cam_path *path,
264 			      struct ahc_devinfo *devinfo);
265 static void	ahc_handle_ign_wide_residue(struct ahc_softc *ahc,
266 					    struct ahc_devinfo *devinfo);
267 static void	ahc_handle_devreset(struct ahc_softc *ahc,
268 				    struct ahc_devinfo *devinfo,
269 				    cam_status status, ac_code acode,
270 				    char *message,
271 				    int verbose_only);
272 static void	ahc_loadseq(struct ahc_softc *ahc);
273 static int	ahc_check_patch(struct ahc_softc *ahc,
274 				struct patch **start_patch,
275 				int start_instr, int *skip_addr);
276 static void	ahc_download_instr(struct ahc_softc *ahc,
277 				   int instrptr, u_int8_t *dconsts);
278 static int	ahc_match_scb(struct scb *scb, int target, char channel,
279 			      int lun, u_int tag);
280 #ifdef AHC_DEBUG
281 static void	ahc_print_scb(struct scb *scb);
282 #endif
283 static int	ahc_search_qinfifo(struct ahc_softc *ahc, int target,
284 				   char channel, int lun, u_int tag,
285 				   u_int32_t status, ahc_search_action action);
286 static void	ahc_abort_ccb(struct ahc_softc *ahc, struct cam_sim *sim,
287 			      union ccb *ccb);
288 static int	ahc_reset_channel(struct ahc_softc *ahc, char channel,
289 				  int initiate_reset);
290 static int	ahc_abort_scbs(struct ahc_softc *ahc, int target,
291 			       char channel, int lun, u_int tag,
292 			       u_int32_t status);
293 static int	ahc_search_disc_list(struct ahc_softc *ahc, int target,
294 				     char channel, int lun, u_int tag);
295 static u_int	ahc_rem_scb_from_disc_list(struct ahc_softc *ahc,
296 					   u_int prev, u_int scbptr);
297 static void	ahc_add_curscb_to_free_list(struct ahc_softc *ahc);
298 static void	ahc_clear_intstat(struct ahc_softc *ahc);
299 static void	ahc_reset_current_bus(struct ahc_softc *ahc);
300 static struct ahc_syncrate *
301 		ahc_devlimited_syncrate(struct ahc_softc *ahc, u_int *period);
302 static struct ahc_syncrate *
303 		ahc_find_syncrate(struct ahc_softc *ahc, u_int *period,
304 				  u_int maxsync);
305 static u_int	ahc_find_period(struct ahc_softc *ahc, u_int scsirate,
306 				u_int maxsync);
307 static void	ahc_validate_offset(struct ahc_softc *ahc,
308 				    struct ahc_syncrate *syncrate,
309 				    u_int *offset, int wide);
310 static void	ahc_update_target_msg_request(struct ahc_softc *ahc,
311 					      struct ahc_devinfo *devinfo,
312 					      struct ahc_initiator_tinfo *tinfo,
313 					      int force, int paused);
314 static int	ahc_create_path(struct ahc_softc *ahc,
315 				struct ahc_devinfo *devinfo,
316 				struct cam_path **path);
317 static void	ahc_set_syncrate(struct ahc_softc *ahc,
318 				 struct ahc_devinfo *devinfo,
319 				 struct cam_path *path,
320 				 struct ahc_syncrate *syncrate,
321 				 u_int period, u_int offset, u_int type,
322 				 int paused);
323 static void	ahc_set_width(struct ahc_softc *ahc,
324 			      struct ahc_devinfo *devinfo,
325 			      struct cam_path *path, u_int width, u_int type,
326 			      int paused);
327 static void	ahc_set_tags(struct ahc_softc *ahc,
328 			     struct ahc_devinfo *devinfo,
329 			     int enable);
330 static void	ahc_construct_sdtr(struct ahc_softc *ahc,
331 				   u_int period, u_int offset);
332 
333 static void	ahc_construct_wdtr(struct ahc_softc *ahc, u_int bus_width);
334 
335 static void	ahc_calc_residual(struct scb *scb);
336 
337 static void	ahc_update_pending_syncrates(struct ahc_softc *ahc);
338 
339 static void	ahc_set_recoveryscb(struct ahc_softc *ahc, struct scb *scb);
340 
341 static timeout_t
342 		ahc_timeout;
343 static __inline int  sequencer_paused(struct ahc_softc *ahc);
344 static __inline void pause_sequencer(struct ahc_softc *ahc);
345 static __inline void unpause_sequencer(struct ahc_softc *ahc,
346 				       int unpause_always);
347 static __inline void restart_sequencer(struct ahc_softc *ahc);
348 static __inline u_int ahc_index_busy_tcl(struct ahc_softc *ahc,
349 					 u_int tcl, int unbusy);
350 
351 static __inline void	 ahc_busy_tcl(struct ahc_softc *ahc, struct scb *scb);
352 
353 static __inline void	   ahc_freeze_ccb(union ccb* ccb);
354 static __inline cam_status ahc_ccb_status(union ccb* ccb);
355 static __inline void	   ahcsetccbstatus(union ccb* ccb,
356 					   cam_status status);
357 static __inline void	   ahc_run_tqinfifo(struct ahc_softc *ahc);
358 
359 static __inline struct ahc_initiator_tinfo *
360 			   ahc_fetch_transinfo(struct ahc_softc *ahc,
361 					       char channel,
362 					       u_int our_id, u_int target,
363 					       struct tmode_tstate **tstate);
364 static __inline void
365 		ahcfreescb(struct ahc_softc *ahc, struct scb *scb);
366 static __inline struct scb *
367 		ahcgetscb(struct ahc_softc *ahc);
368 
369 static __inline u_int32_t
370 ahc_hscb_busaddr(struct ahc_softc *ahc, u_int index)
371 {
372 	return (ahc->scb_data->hscb_busaddr
373 		+ (sizeof(struct hardware_scb) * index));
374 }
375 
376 #define AHC_BUSRESET_DELAY	25	/* Reset delay in us */
377 
378 static __inline int
379 sequencer_paused(struct ahc_softc *ahc)
380 {
381 	return ((ahc_inb(ahc, HCNTRL) & PAUSE) != 0);
382 }
383 
384 static __inline void
385 pause_sequencer(struct ahc_softc *ahc)
386 {
387 	ahc_outb(ahc, HCNTRL, ahc->pause);
388 
389 	/*
390 	 * Since the sequencer can disable pausing in a critical section, we
391 	 * must loop until it actually stops.
392 	 */
393 	while (sequencer_paused(ahc) == 0)
394 		;
395 }
396 
397 static __inline void
398 unpause_sequencer(struct ahc_softc *ahc, int unpause_always)
399 {
400 	if (unpause_always
401 	 || (ahc_inb(ahc, INTSTAT) & (SCSIINT | SEQINT | BRKADRINT)) == 0)
402 		ahc_outb(ahc, HCNTRL, ahc->unpause);
403 }
404 
405 /*
406  * Restart the sequencer program from address zero
407  */
408 static __inline void
409 restart_sequencer(struct ahc_softc *ahc)
410 {
411 	pause_sequencer(ahc);
412 	ahc_outb(ahc, SEQCTL, FASTMODE|SEQRESET);
413 	unpause_sequencer(ahc, /*unpause_always*/TRUE);
414 }
415 
416 static __inline u_int
417 ahc_index_busy_tcl(struct ahc_softc *ahc, u_int tcl, int unbusy)
418 {
419 	u_int scbid;
420 
421 	scbid = ahc->untagged_scbs[tcl];
422 	if (unbusy)
423 		ahc->untagged_scbs[tcl] = SCB_LIST_NULL;
424 
425 	return (scbid);
426 }
427 
428 static __inline void
429 ahc_busy_tcl(struct ahc_softc *ahc, struct scb *scb)
430 {
431 	ahc->untagged_scbs[scb->hscb->tcl] = scb->hscb->tag;
432 }
433 
434 static __inline void
435 ahc_freeze_ccb(union ccb* ccb)
436 {
437 	if ((ccb->ccb_h.status & CAM_DEV_QFRZN) == 0) {
438 		ccb->ccb_h.status |= CAM_DEV_QFRZN;
439 		xpt_freeze_devq(ccb->ccb_h.path, /*count*/1);
440 	}
441 }
442 
443 static __inline cam_status
444 ahc_ccb_status(union ccb* ccb)
445 {
446 	return (ccb->ccb_h.status & CAM_STATUS_MASK);
447 }
448 
449 static __inline void
450 ahcsetccbstatus(union ccb* ccb, cam_status status)
451 {
452 	ccb->ccb_h.status &= ~CAM_STATUS_MASK;
453 	ccb->ccb_h.status |= status;
454 }
455 
456 static __inline struct ahc_initiator_tinfo *
457 ahc_fetch_transinfo(struct ahc_softc *ahc, char channel, u_int our_id,
458 		    u_int remote_id, struct tmode_tstate **tstate)
459 {
460 	/*
461 	 * Transfer data structures are stored from the perspective
462 	 * of the target role.  Since the parameters for a connection
463 	 * in the initiator role to a given target are the same as
464 	 * when the roles are reversed, we pretend we are the target.
465 	 */
466 	if (channel == 'B')
467 		our_id += 8;
468 	*tstate = ahc->enabled_targets[our_id];
469 	return (&(*tstate)->transinfo[remote_id]);
470 }
471 
472 static __inline void
473 ahc_run_tqinfifo(struct ahc_softc *ahc)
474 {
475 	struct target_cmd *cmd;
476 
477 	while ((cmd = &ahc->targetcmds[ahc->tqinfifonext])->cmd_valid != 0) {
478 
479 		/*
480 		 * Only advance through the queue if we
481 		 * had the resources to process the command.
482 		 */
483 		if (ahc_handle_target_cmd(ahc, cmd) != 0)
484 			break;
485 
486 		ahc->tqinfifonext++;
487 		cmd->cmd_valid = 0;
488 
489 		/*
490 		 * Lazily update our position in the target mode incomming
491 		 * command queue as seen by the sequencer.
492 		 */
493 		if ((ahc->tqinfifonext & (TQINFIFO_UPDATE_CNT-1)) == 0) {
494 			pause_sequencer(ahc);
495 			ahc_outb(ahc, KERNEL_TQINPOS, ahc->tqinfifonext - 1);
496 			unpause_sequencer(ahc, /*unpause_always*/FALSE);
497 		}
498 	}
499 }
500 
501 /*
502  * An scb (and hence an scb entry on the board) is put onto the
503  * free list.
504  */
505 static __inline void
506 ahcfreescb(struct ahc_softc *ahc, struct scb *scb)
507 {
508 	struct hardware_scb *hscb;
509 	int opri;
510 
511 	hscb = scb->hscb;
512 
513 	opri = splcam();
514 
515 	if ((ahc->flags & AHC_RESOURCE_SHORTAGE) != 0
516 	 && (scb->ccb->ccb_h.status & CAM_RELEASE_SIMQ) == 0) {
517 		scb->ccb->ccb_h.status |= CAM_RELEASE_SIMQ;
518 		ahc->flags &= ~AHC_RESOURCE_SHORTAGE;
519 	}
520 
521 	/* Clean up for the next user */
522 	scb->flags = SCB_FREE;
523 	hscb->control = 0;
524 	hscb->status = 0;
525 
526 	SLIST_INSERT_HEAD(&ahc->scb_data->free_scbs, scb, links);
527 	splx(opri);
528 }
529 
530 /*
531  * Get a free scb, either one already assigned to a hardware slot
532  * on the adapter or one that will require an SCB to be paged out before
533  * use. If there are none, see if we can allocate a new SCB.  Otherwise
534  * either return an error or sleep.
535  */
536 static __inline struct scb *
537 ahcgetscb(struct ahc_softc *ahc)
538 {
539 	struct scb *scbp;
540 	int opri;
541 
542 	opri = splcam();
543 	if ((scbp = SLIST_FIRST(&ahc->scb_data->free_scbs))) {
544 		SLIST_REMOVE_HEAD(&ahc->scb_data->free_scbs, links);
545 	} else {
546 		ahcallocscbs(ahc);
547 		scbp = SLIST_FIRST(&ahc->scb_data->free_scbs);
548 		if (scbp != NULL)
549 			SLIST_REMOVE_HEAD(&ahc->scb_data->free_scbs, links);
550 	}
551 
552 	splx(opri);
553 
554 	return (scbp);
555 }
556 
557 char *
558 ahc_name(struct ahc_softc *ahc)
559 {
560 	static char name[10];
561 
562 	snprintf(name, sizeof(name), "ahc%d", ahc->unit);
563 	return (name);
564 }
565 
566 #ifdef  AHC_DEBUG
567 static void
568 ahc_print_scb(struct scb *scb)
569 {
570 	struct hardware_scb *hscb = scb->hscb;
571 
572 	printf("scb:%p control:0x%x tcl:0x%x cmdlen:%d cmdpointer:0x%lx\n",
573 		scb,
574 		hscb->control,
575 		hscb->tcl,
576 		hscb->cmdlen,
577 		hscb->cmdpointer );
578 	printf("        datlen:%d data:0x%lx segs:0x%x segp:0x%lx\n",
579 		hscb->datalen,
580 		hscb->data,
581 		hscb->SG_count,
582 		hscb->SG_pointer);
583 	printf("	sg_addr:%lx sg_len:%ld\n",
584 		scb->sg_list[0].addr,
585 		scb->sg_list[0].len);
586 	printf("	cdb:%x %x %x %x %x %x %x %x %x %x %x %x\n",
587 		hscb->cmdstore[0], hscb->cmdstore[1], hscb->cmdstore[2],
588 		hscb->cmdstore[3], hscb->cmdstore[4], hscb->cmdstore[5],
589 		hscb->cmdstore[6], hscb->cmdstore[7], hscb->cmdstore[8],
590 		hscb->cmdstore[9], hscb->cmdstore[10], hscb->cmdstore[11]);
591 }
592 #endif
593 
594 static struct {
595         u_int8_t errno;
596 	char *errmesg;
597 } hard_error[] = {
598 	{ ILLHADDR,	"Illegal Host Access" },
599 	{ ILLSADDR,	"Illegal Sequencer Address referrenced" },
600 	{ ILLOPCODE,	"Illegal Opcode in sequencer program" },
601 	{ SQPARERR,	"Sequencer Parity Error" },
602 	{ DPARERR,	"Data-path Parity Error" },
603 	{ MPARERR,	"Scratch or SCB Memory Parity Error" },
604 	{ PCIERRSTAT,	"PCI Error detected" },
605 	{ CIOPARERR,	"CIOBUS Parity Error" },
606 };
607 
608 
609 /*
610  * Valid SCSIRATE values.  (p. 3-17)
611  * Provides a mapping of tranfer periods in ns to the proper value to
612  * stick in the scsiscfr reg to use that transfer rate.
613  */
614 #define AHC_SYNCRATE_ULTRA2	0
615 #define AHC_SYNCRATE_ULTRA	2
616 #define AHC_SYNCRATE_FAST	5
617 static struct ahc_syncrate ahc_syncrates[] = {
618 	/* ultra2  fast/ultra  period	rate */
619 	{ 0x13,   0x000,	10,	"40.0"	},
620 	{ 0x14,   0x000,	11,	"33.0"	},
621 	{ 0x15,   0x100,	12,	"20.0"	},
622 	{ 0x16,   0x110,	15,	"16.0"	},
623 	{ 0x17,   0x120,	18,	"13.4"	},
624 	{ 0x18,   0x000,	25,	"10.0"	},
625 	{ 0x19,   0x010,	31,	"8.0"	},
626 	{ 0x1a,   0x020,	37,	"6.67"	},
627 	{ 0x1b,   0x030,	43,	"5.7"	},
628 	{ 0x10,   0x040,	50,	"5.0"	},
629 	{ 0x00,   0x050,	56,	"4.4"	},
630 	{ 0x00,   0x060,	62,	"4.0"	},
631 	{ 0x00,   0x070,	68,	"3.6"	},
632 	{ 0x00,   0x000,	0,	NULL	}
633 };
634 
635 /*
636  * Allocate a controller structure for a new device and initialize it.
637  */
638 struct ahc_softc *
639 ahc_alloc(device_t dev, struct resource *regs, int regs_type, int regs_id,
640 	  bus_dma_tag_t parent_dmat, ahc_chip chip, ahc_feature features,
641 	  ahc_flag flags, struct scb_data *scb_data)
642 {
643 	/*
644 	 * find unit and check we have that many defined
645 	 */
646 	struct  ahc_softc *ahc;
647 	size_t	alloc_size;
648 
649 	/*
650 	 * Allocate a storage area for us
651 	 */
652 	if (scb_data == NULL)
653 		/*
654 		 * We are not sharing SCB space with another controller
655 		 * so allocate our own SCB data space.
656 		 */
657 		alloc_size = sizeof(struct full_ahc_softc);
658 	else
659 		alloc_size = sizeof(struct ahc_softc);
660 	ahc = malloc(alloc_size, M_DEVBUF, M_NOWAIT);
661 	if (!ahc) {
662 		device_printf(dev, "cannot malloc softc!\n");
663 		return NULL;
664 	}
665 	bzero(ahc, alloc_size);
666 	LIST_INIT(&ahc->pending_ccbs);
667 	ahc->device = dev;
668 	ahc->unit = device_get_unit(dev);
669 	ahc->regs_res_type = regs_type;
670 	ahc->regs_res_id = regs_id;
671 	ahc->regs = regs;
672 	ahc->tag = rman_get_bustag(regs);
673 	ahc->bsh = rman_get_bushandle(regs);
674 	ahc->parent_dmat = parent_dmat;
675 	ahc->chip = chip;
676 	ahc->features = features;
677 	ahc->flags = flags;
678 	if (scb_data == NULL) {
679 		struct full_ahc_softc* full_softc = (struct full_ahc_softc*)ahc;
680 		ahc->scb_data = &full_softc->scb_data_storage;
681 	} else
682 		ahc->scb_data = scb_data;
683 
684 	ahc->unpause = (ahc_inb(ahc, HCNTRL) & IRQMS) | INTEN;
685 	/* The IRQMS bit is only valid on VL and EISA chips */
686 	if ((ahc->chip & AHC_PCI) != 0)
687 		ahc->unpause &= ~IRQMS;
688 	ahc->pause = ahc->unpause | PAUSE;
689 	return (ahc);
690 }
691 
692 void
693 ahc_free(ahc)
694 	struct ahc_softc *ahc;
695 {
696 	ahcfiniscbdata(ahc);
697 	switch (ahc->init_level) {
698 	case 3:
699 		bus_dmamap_unload(ahc->shared_data_dmat,
700 				  ahc->shared_data_dmamap);
701 	case 2:
702 		bus_dmamem_free(ahc->shared_data_dmat, ahc->qoutfifo,
703 				ahc->shared_data_dmamap);
704 		bus_dmamap_destroy(ahc->shared_data_dmat,
705 				   ahc->shared_data_dmamap);
706 	case 1:
707 		bus_dma_tag_destroy(ahc->buffer_dmat);
708 		break;
709 	}
710 
711 	if (ahc->regs != NULL)
712 		bus_release_resource(ahc->device, ahc->regs_res_type,
713 				     ahc->regs_res_id, ahc->regs);
714 	if (ahc->irq != NULL)
715 		bus_release_resource(ahc->device, ahc->irq_res_type,
716 				     0, ahc->irq);
717 
718 	free(ahc, M_DEVBUF);
719 	return;
720 }
721 
722 static int
723 ahcinitscbdata(struct ahc_softc *ahc)
724 {
725 	struct scb_data *scb_data;
726 	int i;
727 
728 	scb_data = ahc->scb_data;
729 	SLIST_INIT(&scb_data->free_scbs);
730 	SLIST_INIT(&scb_data->sg_maps);
731 
732 	/* Allocate SCB resources */
733 	scb_data->scbarray =
734 	    (struct scb *)malloc(sizeof(struct scb) * AHC_SCB_MAX,
735 				 M_DEVBUF, M_NOWAIT);
736 	if (scb_data->scbarray == NULL)
737 		return (ENOMEM);
738 	bzero(scb_data->scbarray, sizeof(struct scb) * AHC_SCB_MAX);
739 
740 	/* Determine the number of hardware SCBs and initialize them */
741 
742 	scb_data->maxhscbs = ahc_probe_scbs(ahc);
743 	/* SCB 0 heads the free list */
744 	ahc_outb(ahc, FREE_SCBH, 0);
745 	for (i = 0; i < ahc->scb_data->maxhscbs; i++) {
746 		ahc_outb(ahc, SCBPTR, i);
747 
748 		/* Clear the control byte. */
749 		ahc_outb(ahc, SCB_CONTROL, 0);
750 
751 		/* Set the next pointer */
752 		ahc_outb(ahc, SCB_NEXT, i+1);
753 
754 		/* Make the tag number invalid */
755 		ahc_outb(ahc, SCB_TAG, SCB_LIST_NULL);
756 	}
757 
758 	/* Make sure that the last SCB terminates the free list */
759 	ahc_outb(ahc, SCBPTR, i-1);
760 	ahc_outb(ahc, SCB_NEXT, SCB_LIST_NULL);
761 
762 	/* Ensure we clear the 0 SCB's control byte. */
763 	ahc_outb(ahc, SCBPTR, 0);
764 	ahc_outb(ahc, SCB_CONTROL, 0);
765 
766 	scb_data->maxhscbs = i;
767 
768 	if (ahc->scb_data->maxhscbs == 0)
769 		panic("%s: No SCB space found", ahc_name(ahc));
770 
771 	/*
772 	 * Create our DMA tags.  These tags define the kinds of device
773 	 * accessable memory allocations and memory mappings we will
774 	 * need to perform during normal operation.
775 	 *
776 	 * Unless we need to further restrict the allocation, we rely
777 	 * on the restrictions of the parent dmat, hence the common
778 	 * use of MAXADDR and MAXSIZE.
779 	 */
780 
781 	/* DMA tag for our hardware scb structures */
782 	if (bus_dma_tag_create(ahc->parent_dmat, /*alignment*/0, /*boundary*/0,
783 			       /*lowaddr*/BUS_SPACE_MAXADDR,
784 			       /*highaddr*/BUS_SPACE_MAXADDR,
785 			       /*filter*/NULL, /*filterarg*/NULL,
786 			       AHC_SCB_MAX * sizeof(struct hardware_scb),
787 			       /*nsegments*/1,
788 			       /*maxsegsz*/BUS_SPACE_MAXSIZE_32BIT,
789 			       /*flags*/0, &scb_data->hscb_dmat) != 0) {
790 		goto error_exit;
791 	}
792 
793 	scb_data->init_level++;
794 
795 	/* Allocation for our ccbs */
796 	if (bus_dmamem_alloc(scb_data->hscb_dmat, (void **)&scb_data->hscbs,
797 			     BUS_DMA_NOWAIT, &scb_data->hscb_dmamap) != 0) {
798 		goto error_exit;
799 	}
800 
801 	scb_data->init_level++;
802 
803 	/* And permanently map them */
804 	bus_dmamap_load(scb_data->hscb_dmat, scb_data->hscb_dmamap,
805 			scb_data->hscbs,
806 			AHC_SCB_MAX * sizeof(struct hardware_scb),
807 			ahcdmamapcb, &scb_data->hscb_busaddr, /*flags*/0);
808 
809 	scb_data->init_level++;
810 
811 	/* DMA tag for our sense buffers */
812 	if (bus_dma_tag_create(ahc->parent_dmat, /*alignment*/0, /*boundary*/0,
813 			       /*lowaddr*/BUS_SPACE_MAXADDR,
814 			       /*highaddr*/BUS_SPACE_MAXADDR,
815 			       /*filter*/NULL, /*filterarg*/NULL,
816 			       AHC_SCB_MAX * sizeof(struct scsi_sense_data),
817 			       /*nsegments*/1,
818 			       /*maxsegsz*/BUS_SPACE_MAXSIZE_32BIT,
819 			       /*flags*/0, &scb_data->sense_dmat) != 0) {
820 		goto error_exit;
821 	}
822 
823 	scb_data->init_level++;
824 
825 	/* Allocate them */
826 	if (bus_dmamem_alloc(scb_data->sense_dmat, (void **)&scb_data->sense,
827 			     BUS_DMA_NOWAIT, &scb_data->sense_dmamap) != 0) {
828 		goto error_exit;
829 	}
830 
831 	scb_data->init_level++;
832 
833 	/* And permanently map them */
834 	bus_dmamap_load(scb_data->sense_dmat, scb_data->sense_dmamap,
835 			scb_data->sense,
836 			AHC_SCB_MAX * sizeof(struct scsi_sense_data),
837 			ahcdmamapcb, &scb_data->sense_busaddr, /*flags*/0);
838 
839 	scb_data->init_level++;
840 
841 	/* DMA tag for our S/G structures.  We allocate in page sized chunks */
842 	if (bus_dma_tag_create(ahc->parent_dmat, /*alignment*/0, /*boundary*/0,
843 			       /*lowaddr*/BUS_SPACE_MAXADDR,
844 			       /*highaddr*/BUS_SPACE_MAXADDR,
845 			       /*filter*/NULL, /*filterarg*/NULL,
846 			       PAGE_SIZE, /*nsegments*/1,
847 			       /*maxsegsz*/BUS_SPACE_MAXSIZE_32BIT,
848 			       /*flags*/0, &scb_data->sg_dmat) != 0) {
849 		goto error_exit;
850 	}
851 
852         scb_data->init_level++;
853 
854 	/* Perform initial CCB allocation */
855 	bzero(scb_data->hscbs, AHC_SCB_MAX * sizeof(struct hardware_scb));
856 	ahcallocscbs(ahc);
857 
858 	if (scb_data->numscbs == 0) {
859 		printf("%s: ahc_init_scb_data - "
860 		       "Unable to allocate initial scbs\n",
861 		       ahc_name(ahc));
862 		goto error_exit;
863 	}
864 
865 	/*
866          * Note that we were successfull
867          */
868         return 0;
869 
870 error_exit:
871 
872 	return ENOMEM;
873 }
874 
875 static void
876 ahcfiniscbdata(struct ahc_softc *ahc)
877 {
878 	struct scb_data *scb_data;
879 
880 	scb_data = ahc->scb_data;
881 
882 	switch (scb_data->init_level) {
883 	default:
884 	case 7:
885 	{
886 		struct sg_map_node *sg_map;
887 
888 		while ((sg_map = SLIST_FIRST(&scb_data->sg_maps))!= NULL) {
889 			SLIST_REMOVE_HEAD(&scb_data->sg_maps, links);
890 			bus_dmamap_unload(scb_data->sg_dmat,
891 					  sg_map->sg_dmamap);
892 			bus_dmamem_free(scb_data->sg_dmat, sg_map->sg_vaddr,
893 					sg_map->sg_dmamap);
894 			free(sg_map, M_DEVBUF);
895 		}
896 		bus_dma_tag_destroy(scb_data->sg_dmat);
897 	}
898 	case 6:
899 		bus_dmamap_unload(scb_data->sense_dmat,
900 				  scb_data->sense_dmamap);
901 	case 5:
902 		bus_dmamem_free(scb_data->sense_dmat, scb_data->sense,
903 				scb_data->sense_dmamap);
904 		bus_dmamap_destroy(scb_data->sense_dmat,
905 				   scb_data->sense_dmamap);
906 	case 4:
907 		bus_dma_tag_destroy(scb_data->sense_dmat);
908 	case 3:
909 		bus_dmamap_unload(scb_data->hscb_dmat, scb_data->hscb_dmamap);
910 	case 2:
911 		bus_dmamem_free(scb_data->hscb_dmat, scb_data->hscbs,
912 				scb_data->hscb_dmamap);
913 		bus_dmamap_destroy(scb_data->hscb_dmat, scb_data->hscb_dmamap);
914 	case 1:
915 		bus_dma_tag_destroy(scb_data->hscb_dmat);
916 		break;
917 	}
918 	if (scb_data->scbarray != NULL)
919 		free(scb_data->scbarray, M_DEVBUF);
920 }
921 
922 static void
923 ahcdmamapcb(void *arg, bus_dma_segment_t *segs, int nseg, int error)
924 {
925 	bus_addr_t *baddr;
926 
927 	baddr = (bus_addr_t *)arg;
928 	*baddr = segs->ds_addr;
929 }
930 
931 int
932 ahc_reset(struct ahc_softc *ahc)
933 {
934 	u_int	sblkctl;
935 	int	wait;
936 
937 	ahc_outb(ahc, HCNTRL, CHIPRST | ahc->pause);
938 	/*
939 	 * Ensure that the reset has finished
940 	 */
941 	wait = 1000;
942 	while (--wait && !(ahc_inb(ahc, HCNTRL) & CHIPRSTACK))
943 		DELAY(1000);
944 	if (wait == 0) {
945 		printf("%s: WARNING - Failed chip reset!  "
946 		       "Trying to initialize anyway.\n", ahc_name(ahc));
947 	}
948 	ahc_outb(ahc, HCNTRL, ahc->pause);
949 
950 	/* Determine channel configuration */
951 	sblkctl = ahc_inb(ahc, SBLKCTL) & (SELBUSB|SELWIDE);
952 	/* No Twin Channel PCI cards */
953 	if ((ahc->chip & AHC_PCI) != 0)
954 		sblkctl &= ~SELBUSB;
955 	switch (sblkctl) {
956 	case 0:
957 		/* Single Narrow Channel */
958 		break;
959 	case 2:
960 		/* Wide Channel */
961 		ahc->features |= AHC_WIDE;
962 		break;
963 	case 8:
964 		/* Twin Channel */
965 		ahc->features |= AHC_TWIN;
966 		break;
967 	default:
968 		printf(" Unsupported adapter type.  Ignoring\n");
969 		return(-1);
970 	}
971 	return (0);
972 }
973 
974 /*
975  * Called when we have an active connection to a target on the bus,
976  * this function finds the nearest syncrate to the input period limited
977  * by the capabilities of the bus connectivity of the target.
978  */
979 static struct ahc_syncrate *
980 ahc_devlimited_syncrate(struct ahc_softc *ahc, u_int *period) {
981 	u_int	maxsync;
982 
983 	if ((ahc->features & AHC_ULTRA2) != 0) {
984 		if ((ahc_inb(ahc, SBLKCTL) & ENAB40) != 0
985 		 && (ahc_inb(ahc, SSTAT2) & EXP_ACTIVE) == 0) {
986 			maxsync = AHC_SYNCRATE_ULTRA2;
987 		} else {
988 			maxsync = AHC_SYNCRATE_ULTRA;
989 		}
990 	} else if ((ahc->features & AHC_ULTRA) != 0) {
991 		maxsync = AHC_SYNCRATE_ULTRA;
992 	} else {
993 		maxsync = AHC_SYNCRATE_FAST;
994 	}
995 	return (ahc_find_syncrate(ahc, period, maxsync));
996 }
997 
998 /*
999  * Look up the valid period to SCSIRATE conversion in our table.
1000  * Return the period and offset that should be sent to the target
1001  * if this was the beginning of an SDTR.
1002  */
1003 static struct ahc_syncrate *
1004 ahc_find_syncrate(struct ahc_softc *ahc, u_int *period, u_int maxsync)
1005 {
1006 	struct ahc_syncrate *syncrate;
1007 
1008 	syncrate = &ahc_syncrates[maxsync];
1009 	while ((syncrate->rate != NULL)
1010 	    && ((ahc->features & AHC_ULTRA2) == 0
1011 	     || (syncrate->sxfr_ultra2 != 0))) {
1012 
1013 		if (*period <= syncrate->period) {
1014 			/*
1015 			 * When responding to a target that requests
1016 			 * sync, the requested rate may fall between
1017 			 * two rates that we can output, but still be
1018 			 * a rate that we can receive.  Because of this,
1019 			 * we want to respond to the target with
1020 			 * the same rate that it sent to us even
1021 			 * if the period we use to send data to it
1022 			 * is lower.  Only lower the response period
1023 			 * if we must.
1024 			 */
1025 			if (syncrate == &ahc_syncrates[maxsync]) {
1026 				*period = syncrate->period;
1027 			}
1028 			break;
1029 		}
1030 		syncrate++;
1031 	}
1032 
1033 	if ((*period == 0)
1034 	 || (syncrate->rate == NULL)
1035 	 || ((ahc->features & AHC_ULTRA2) != 0
1036 	  && (syncrate->sxfr_ultra2 == 0))) {
1037 		/* Use asynchronous transfers. */
1038 		*period = 0;
1039 		syncrate = NULL;
1040 	}
1041 	return (syncrate);
1042 }
1043 
1044 static u_int
1045 ahc_find_period(struct ahc_softc *ahc, u_int scsirate, u_int maxsync)
1046 {
1047 	struct ahc_syncrate *syncrate;
1048 
1049 	if ((ahc->features & AHC_ULTRA2) != 0) {
1050 		scsirate &= SXFR_ULTRA2;
1051 	} else  {
1052 		scsirate &= SXFR;
1053 	}
1054 
1055 	syncrate = &ahc_syncrates[maxsync];
1056 	while (syncrate->rate != NULL) {
1057 
1058 		if ((ahc->features & AHC_ULTRA2) != 0) {
1059 			if (syncrate->sxfr_ultra2 == 0)
1060 				break;
1061 			else if (scsirate == syncrate->sxfr_ultra2)
1062 				return (syncrate->period);
1063 		} else if (scsirate == (syncrate->sxfr & ~ULTRA_SXFR)) {
1064 				return (syncrate->period);
1065 		}
1066 		syncrate++;
1067 	}
1068 	return (0); /* async */
1069 }
1070 
1071 static void
1072 ahc_validate_offset(struct ahc_softc *ahc, struct ahc_syncrate *syncrate,
1073 		    u_int *offset, int wide)
1074 {
1075 	u_int maxoffset;
1076 
1077 	/* Limit offset to what we can do */
1078 	if (syncrate == NULL) {
1079 		maxoffset = 0;
1080 	} else if ((ahc->features & AHC_ULTRA2) != 0) {
1081 		maxoffset = MAX_OFFSET_ULTRA2;
1082 	} else {
1083 		if (wide)
1084 			maxoffset = MAX_OFFSET_16BIT;
1085 		else
1086 			maxoffset = MAX_OFFSET_8BIT;
1087 	}
1088 	*offset = MIN(*offset, maxoffset);
1089 }
1090 
1091 static void
1092 ahc_update_target_msg_request(struct ahc_softc *ahc,
1093 			      struct ahc_devinfo *devinfo,
1094 			      struct ahc_initiator_tinfo *tinfo,
1095 			      int force, int paused)
1096 {
1097 	u_int targ_msg_req_orig;
1098 
1099 	targ_msg_req_orig = ahc->targ_msg_req;
1100 	if (tinfo->current.period != tinfo->goal.period
1101 	 || tinfo->current.width != tinfo->goal.width
1102 	 || tinfo->current.offset != tinfo->goal.offset
1103 	 || (force
1104 	  && (tinfo->goal.period != 0
1105 	   || tinfo->goal.width != MSG_EXT_WDTR_BUS_8_BIT)))
1106 		ahc->targ_msg_req |= devinfo->target_mask;
1107 	else
1108 		ahc->targ_msg_req &= ~devinfo->target_mask;
1109 
1110 	if (ahc->targ_msg_req != targ_msg_req_orig) {
1111 		/* Update the message request bit for this target */
1112 		if ((ahc->features & AHC_HS_MAILBOX) != 0) {
1113 			if (paused) {
1114 				ahc_outb(ahc, TARGET_MSG_REQUEST,
1115 					 ahc->targ_msg_req & 0xFF);
1116 				ahc_outb(ahc, TARGET_MSG_REQUEST + 1,
1117 					 (ahc->targ_msg_req >> 8) & 0xFF);
1118 			} else {
1119 				ahc_outb(ahc, HS_MAILBOX,
1120 					 0x01 << HOST_MAILBOX_SHIFT);
1121 			}
1122 		} else {
1123 			if (!paused)
1124 				pause_sequencer(ahc);
1125 
1126 			ahc_outb(ahc, TARGET_MSG_REQUEST,
1127 				 ahc->targ_msg_req & 0xFF);
1128 			ahc_outb(ahc, TARGET_MSG_REQUEST + 1,
1129 				 (ahc->targ_msg_req >> 8) & 0xFF);
1130 
1131 			if (!paused)
1132 				unpause_sequencer(ahc, /*unpause always*/FALSE);
1133 		}
1134 	}
1135 }
1136 
1137 static int
1138 ahc_create_path(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
1139 		     struct cam_path **path)
1140 {
1141 	path_id_t path_id;
1142 
1143 	if (devinfo->channel == 'B')
1144 		path_id = cam_sim_path(ahc->sim_b);
1145 	else
1146 		path_id = cam_sim_path(ahc->sim);
1147 
1148 	return (xpt_create_path(path, /*periph*/NULL,
1149 				path_id, devinfo->target,
1150 				devinfo->lun));
1151 }
1152 
1153 static void
1154 ahc_set_syncrate(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
1155 		 struct cam_path *path, struct ahc_syncrate *syncrate,
1156 		 u_int period, u_int offset, u_int type, int paused)
1157 {
1158 	struct	ahc_initiator_tinfo *tinfo;
1159 	struct	tmode_tstate *tstate;
1160 	u_int	old_period;
1161 	u_int	old_offset;
1162 	int	active = (type & AHC_TRANS_ACTIVE) == AHC_TRANS_ACTIVE;
1163 
1164 	if (syncrate == NULL) {
1165 		period = 0;
1166 		offset = 0;
1167 	}
1168 
1169 	tinfo = ahc_fetch_transinfo(ahc, devinfo->channel, devinfo->our_scsiid,
1170 				    devinfo->target, &tstate);
1171 	old_period = tinfo->current.period;
1172 	old_offset = tinfo->current.offset;
1173 
1174 	if ((type & AHC_TRANS_CUR) != 0
1175 	 && (old_period != period || old_offset != offset)) {
1176 		struct	cam_path *path2;
1177 		u_int	scsirate;
1178 
1179 		scsirate = tinfo->scsirate;
1180 		if ((ahc->features & AHC_ULTRA2) != 0) {
1181 
1182 			scsirate &= ~SXFR_ULTRA2;
1183 
1184 			if (syncrate != NULL) {
1185 				scsirate |= syncrate->sxfr_ultra2;
1186 			}
1187 
1188 			if (active)
1189 				ahc_outb(ahc, SCSIOFFSET, offset);
1190 		} else {
1191 
1192 			scsirate &= ~(SXFR|SOFS);
1193 			/*
1194 			 * Ensure Ultra mode is set properly for
1195 			 * this target.
1196 			 */
1197 			tstate->ultraenb &= ~devinfo->target_mask;
1198 			if (syncrate != NULL) {
1199 				if (syncrate->sxfr & ULTRA_SXFR) {
1200 					tstate->ultraenb |=
1201 						devinfo->target_mask;
1202 				}
1203 				scsirate |= syncrate->sxfr & SXFR;
1204 				scsirate |= offset & SOFS;
1205 			}
1206 			if (active) {
1207 				u_int sxfrctl0;
1208 
1209 				sxfrctl0 = ahc_inb(ahc, SXFRCTL0);
1210 				sxfrctl0 &= ~FAST20;
1211 				if (tstate->ultraenb & devinfo->target_mask)
1212 					sxfrctl0 |= FAST20;
1213 				ahc_outb(ahc, SXFRCTL0, sxfrctl0);
1214 			}
1215 		}
1216 		if (active)
1217 			ahc_outb(ahc, SCSIRATE, scsirate);
1218 
1219 		tinfo->scsirate = scsirate;
1220 		tinfo->current.period = period;
1221 		tinfo->current.offset = offset;
1222 
1223 		/* Update the syncrates in any pending scbs */
1224 		ahc_update_pending_syncrates(ahc);
1225 
1226 		/*
1227 		 * If possible, tell the SCSI layer about the
1228 		 * new transfer parameters.
1229 		 */
1230 		/* If possible, update the XPT's notion of our transfer rate */
1231 		path2 = NULL;
1232 		if (path == NULL) {
1233 			int error;
1234 
1235 			error = ahc_create_path(ahc, devinfo, &path2);
1236 			if (error == CAM_REQ_CMP)
1237 				path = path2;
1238 			else
1239 				path2 = NULL;
1240 		}
1241 
1242 		if (path != NULL) {
1243 			struct	ccb_trans_settings neg;
1244 
1245 			neg.sync_period = period;
1246 			neg.sync_offset = offset;
1247 			neg.valid = CCB_TRANS_SYNC_RATE_VALID
1248 				  | CCB_TRANS_SYNC_OFFSET_VALID;
1249 			xpt_setup_ccb(&neg.ccb_h, path, /*priority*/1);
1250 			xpt_async(AC_TRANSFER_NEG, path, &neg);
1251 		}
1252 
1253 		if (path2 != NULL)
1254 			xpt_free_path(path2);
1255 
1256 		if (bootverbose) {
1257 			if (offset != 0) {
1258 				printf("%s: target %d synchronous at %sMHz, "
1259 				       "offset = 0x%x\n", ahc_name(ahc),
1260 				       devinfo->target, syncrate->rate, offset);
1261 			} else {
1262 				printf("%s: target %d using "
1263 				       "asynchronous transfers\n",
1264 				       ahc_name(ahc), devinfo->target);
1265 			}
1266 		}
1267 	}
1268 
1269 	if ((type & AHC_TRANS_GOAL) != 0) {
1270 		tinfo->goal.period = period;
1271 		tinfo->goal.offset = offset;
1272 	}
1273 
1274 	if ((type & AHC_TRANS_USER) != 0) {
1275 		tinfo->user.period = period;
1276 		tinfo->user.offset = offset;
1277 	}
1278 
1279 	ahc_update_target_msg_request(ahc, devinfo, tinfo,
1280 				      /*force*/FALSE,
1281 				      paused);
1282 }
1283 
1284 static void
1285 ahc_set_width(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
1286 	      struct cam_path *path, u_int width, u_int type, int paused)
1287 {
1288 	struct ahc_initiator_tinfo *tinfo;
1289 	struct tmode_tstate *tstate;
1290 	u_int  oldwidth;
1291 	int    active = (type & AHC_TRANS_ACTIVE) == AHC_TRANS_ACTIVE;
1292 
1293 	tinfo = ahc_fetch_transinfo(ahc, devinfo->channel, devinfo->our_scsiid,
1294 				    devinfo->target, &tstate);
1295 	oldwidth = tinfo->current.width;
1296 
1297 	if ((type & AHC_TRANS_CUR) != 0 && oldwidth != width) {
1298 		struct  cam_path *path2;
1299 		u_int	scsirate;
1300 
1301 		scsirate =  tinfo->scsirate;
1302 		scsirate &= ~WIDEXFER;
1303 		if (width == MSG_EXT_WDTR_BUS_16_BIT)
1304 			scsirate |= WIDEXFER;
1305 
1306 		tinfo->scsirate = scsirate;
1307 
1308 		if (active)
1309 			ahc_outb(ahc, SCSIRATE, scsirate);
1310 
1311 		tinfo->current.width = width;
1312 
1313 		/* If possible, update the XPT's notion of our transfer rate */
1314 		path2 = NULL;
1315 		if (path == NULL) {
1316 			int error;
1317 
1318 			error = ahc_create_path(ahc, devinfo, &path2);
1319 			if (error == CAM_REQ_CMP)
1320 				path = path2;
1321 			else
1322 				path2 = NULL;
1323 		}
1324 
1325 		if (path != NULL) {
1326 			struct	ccb_trans_settings neg;
1327 
1328 			neg.bus_width = width;
1329 			neg.valid = CCB_TRANS_BUS_WIDTH_VALID;
1330 			xpt_setup_ccb(&neg.ccb_h, path, /*priority*/1);
1331 			xpt_async(AC_TRANSFER_NEG, path, &neg);
1332 		}
1333 
1334 		if (path2 != NULL)
1335 			xpt_free_path(path2);
1336 
1337 		if (bootverbose) {
1338 			printf("%s: target %d using %dbit transfers\n",
1339 			       ahc_name(ahc), devinfo->target,
1340 			       8 * (0x01 << width));
1341 		}
1342 	}
1343 	if ((type & AHC_TRANS_GOAL) != 0)
1344 		tinfo->goal.width = width;
1345 	if ((type & AHC_TRANS_USER) != 0)
1346 		tinfo->user.width = width;
1347 
1348 	ahc_update_target_msg_request(ahc, devinfo, tinfo,
1349 				      /*force*/FALSE, paused);
1350 }
1351 
1352 static void
1353 ahc_set_tags(struct ahc_softc *ahc, struct ahc_devinfo *devinfo, int enable)
1354 {
1355 	struct ahc_initiator_tinfo *tinfo;
1356 	struct tmode_tstate *tstate;
1357 
1358 	tinfo = ahc_fetch_transinfo(ahc, devinfo->channel, devinfo->our_scsiid,
1359 				    devinfo->target, &tstate);
1360 
1361 	if (enable)
1362 		tstate->tagenable |= devinfo->target_mask;
1363 	else
1364 		tstate->tagenable &= ~devinfo->target_mask;
1365 }
1366 
1367 /*
1368  * Attach all the sub-devices we can find
1369  */
1370 int
1371 ahc_attach(struct ahc_softc *ahc)
1372 {
1373 	struct ccb_setasync csa;
1374 	struct cam_devq *devq;
1375 	int bus_id;
1376 	int bus_id2;
1377 	struct cam_sim *sim;
1378 	struct cam_sim *sim2;
1379 	struct cam_path *path;
1380 	struct cam_path *path2;
1381 	int count;
1382 	int s;
1383 	int error;
1384 
1385 	count = 0;
1386 	sim = NULL;
1387 	sim2 = NULL;
1388 
1389 	s = splcam();
1390 	/* Hook up our interrupt handler */
1391 	if ((error = bus_setup_intr(ahc->device, ahc->irq, INTR_TYPE_CAM,
1392 				    ahc_intr, ahc, &ahc->ih)) != 0) {
1393 		device_printf(ahc->device, "bus_setup_intr() failed: %d\n",
1394 			      error);
1395 		goto fail;
1396 	}
1397 
1398 	/*
1399 	 * Attach secondary channel first if the user has
1400 	 * declared it the primary channel.
1401 	 */
1402 	if ((ahc->flags & AHC_CHANNEL_B_PRIMARY) != 0) {
1403 		bus_id = 1;
1404 		bus_id2 = 0;
1405 	} else {
1406 		bus_id = 0;
1407 		bus_id2 = 1;
1408 	}
1409 
1410 	/*
1411 	 * Create the device queue for our SIM(s).
1412 	 */
1413 	devq = cam_simq_alloc(AHC_SCB_MAX);
1414 	if (devq == NULL)
1415 		goto fail;
1416 
1417 	/*
1418 	 * Construct our first channel SIM entry
1419 	 */
1420 	sim = cam_sim_alloc(ahc_action, ahc_poll, "ahc", ahc, ahc->unit,
1421 			    1, AHC_SCB_MAX, devq);
1422 	if (sim == NULL) {
1423 		cam_simq_free(devq);
1424 		goto fail;
1425 	}
1426 
1427 	if (xpt_bus_register(sim, bus_id) != CAM_SUCCESS) {
1428 		cam_sim_free(sim, /*free_devq*/TRUE);
1429 		sim = NULL;
1430 		goto fail;
1431 	}
1432 
1433 	if (xpt_create_path(&path, /*periph*/NULL,
1434 			    cam_sim_path(sim), CAM_TARGET_WILDCARD,
1435 			    CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
1436 		xpt_bus_deregister(cam_sim_path(sim));
1437 		cam_sim_free(sim, /*free_devq*/TRUE);
1438 		sim = NULL;
1439 		goto fail;
1440 	}
1441 
1442 	xpt_setup_ccb(&csa.ccb_h, path, /*priority*/5);
1443 	csa.ccb_h.func_code = XPT_SASYNC_CB;
1444 	csa.event_enable = AC_LOST_DEVICE;
1445 	csa.callback = ahc_async;
1446 	csa.callback_arg = sim;
1447 	xpt_action((union ccb *)&csa);
1448 	count++;
1449 
1450 	if (ahc->features & AHC_TWIN) {
1451 		sim2 = cam_sim_alloc(ahc_action, ahc_poll, "ahc",
1452 				    ahc, ahc->unit, 1,
1453 				    AHC_SCB_MAX, devq);
1454 
1455 		if (sim2 == NULL) {
1456 			printf("ahc_attach: Unable to attach second "
1457 			       "bus due to resource shortage");
1458 			goto fail;
1459 		}
1460 
1461 		if (xpt_bus_register(sim2, bus_id2) != CAM_SUCCESS) {
1462 			printf("ahc_attach: Unable to attach second "
1463 			       "bus due to resource shortage");
1464 			/*
1465 			 * We do not want to destroy the device queue
1466 			 * because the first bus is using it.
1467 			 */
1468 			cam_sim_free(sim2, /*free_devq*/FALSE);
1469 			goto fail;
1470 		}
1471 
1472 		if (xpt_create_path(&path2, /*periph*/NULL,
1473 				    cam_sim_path(sim2),
1474 				    CAM_TARGET_WILDCARD,
1475 				    CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
1476 			xpt_bus_deregister(cam_sim_path(sim2));
1477 			cam_sim_free(sim2, /*free_devq*/FALSE);
1478 			sim2 = NULL;
1479 			goto fail;
1480 		}
1481 		xpt_setup_ccb(&csa.ccb_h, path2, /*priority*/5);
1482 		csa.ccb_h.func_code = XPT_SASYNC_CB;
1483 		csa.event_enable = AC_LOST_DEVICE;
1484 		csa.callback = ahc_async;
1485 		csa.callback_arg = sim2;
1486 		xpt_action((union ccb *)&csa);
1487 		count++;
1488 	}
1489 
1490 fail:
1491 	if ((ahc->flags & AHC_CHANNEL_B_PRIMARY) != 0) {
1492 		ahc->sim_b = sim;
1493 		ahc->path_b = path;
1494 		ahc->sim = sim2;
1495 		ahc->path = path2;
1496 	} else {
1497 		ahc->sim = sim;
1498 		ahc->path = path;
1499 		ahc->sim_b = sim2;
1500 		ahc->path_b = path2;
1501 	}
1502 	splx(s);
1503 	return (count);
1504 }
1505 
1506 static void
1507 ahc_scb_devinfo(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
1508 		struct scb *scb)
1509 {
1510 	role_t	role;
1511 	int	our_id;
1512 
1513 	if (scb->ccb->ccb_h.func_code == XPT_CONT_TARGET_IO) {
1514 		our_id = scb->ccb->ccb_h.target_id;
1515 		role = ROLE_TARGET;
1516 	} else {
1517 		our_id = SCB_CHANNEL(scb) == 'B' ? ahc->our_id_b : ahc->our_id;
1518 		role = ROLE_INITIATOR;
1519 	}
1520 	ahc_compile_devinfo(devinfo, our_id, SCB_TARGET(scb),
1521 			    SCB_LUN(scb), SCB_CHANNEL(scb), role);
1522 }
1523 
1524 static void
1525 ahc_fetch_devinfo(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
1526 {
1527 	u_int	saved_tcl;
1528 	role_t	role;
1529 	int	our_id;
1530 
1531 	if (ahc_inb(ahc, SSTAT0) & TARGET)
1532 		role = ROLE_TARGET;
1533 	else
1534 		role = ROLE_INITIATOR;
1535 
1536 	if (role == ROLE_TARGET
1537 	 && (ahc->features & AHC_MULTI_TID) != 0
1538 	 && (ahc_inb(ahc, SEQ_FLAGS) & CMDPHASE_PENDING) != 0) {
1539 		/* We were selected, so pull our id from TARGIDIN */
1540 		our_id = ahc_inb(ahc, TARGIDIN) & OID;
1541 	} else if ((ahc->features & AHC_ULTRA2) != 0)
1542 		our_id = ahc_inb(ahc, SCSIID_ULTRA2) & OID;
1543 	else
1544 		our_id = ahc_inb(ahc, SCSIID) & OID;
1545 
1546 	saved_tcl = ahc_inb(ahc, SAVED_TCL);
1547 	ahc_compile_devinfo(devinfo, our_id, TCL_TARGET(saved_tcl),
1548 			    TCL_LUN(saved_tcl), TCL_CHANNEL(ahc, saved_tcl),
1549 			    role);
1550 }
1551 
1552 static void
1553 ahc_compile_devinfo(struct ahc_devinfo *devinfo, u_int our_id, u_int target,
1554 		    u_int lun, char channel, role_t role)
1555 {
1556 	devinfo->our_scsiid = our_id;
1557 	devinfo->target = target;
1558 	devinfo->lun = lun;
1559 	devinfo->target_offset = target;
1560 	devinfo->channel = channel;
1561 	devinfo->role = role;
1562 	if (channel == 'B')
1563 		devinfo->target_offset += 8;
1564 	devinfo->target_mask = (0x01 << devinfo->target_offset);
1565 }
1566 
1567 /*
1568  * Catch an interrupt from the adapter
1569  */
1570 void
1571 ahc_intr(void *arg)
1572 {
1573 	struct	ahc_softc *ahc;
1574 	u_int	intstat;
1575 
1576 	ahc = (struct ahc_softc *)arg;
1577 
1578 	intstat = ahc_inb(ahc, INTSTAT);
1579 
1580 	/*
1581 	 * Any interrupts to process?
1582 	 */
1583 #if NPCI > 0
1584 	if ((intstat & INT_PEND) == 0) {
1585 		if ((ahc->chip & AHC_PCI) != 0
1586 		 && (ahc->unsolicited_ints > 500)) {
1587 			if ((ahc_inb(ahc, ERROR) & PCIERRSTAT) != 0)
1588 				ahc_pci_intr(ahc);
1589 			ahc->unsolicited_ints = 0;
1590 		} else {
1591 			ahc->unsolicited_ints++;
1592 		}
1593 		return;
1594 	} else {
1595 		ahc->unsolicited_ints = 0;
1596 	}
1597 #else
1598 	if ((intstat & INT_PEND) == 0)
1599 		return;
1600 #endif
1601 
1602 	if (intstat & CMDCMPLT) {
1603 		struct scb *scb;
1604 		u_int  scb_index;
1605 
1606 		ahc_outb(ahc, CLRINT, CLRCMDINT);
1607 		while (ahc->qoutfifo[ahc->qoutfifonext] != SCB_LIST_NULL) {
1608 			scb_index = ahc->qoutfifo[ahc->qoutfifonext];
1609 			ahc->qoutfifo[ahc->qoutfifonext++] = SCB_LIST_NULL;
1610 
1611 			scb = &ahc->scb_data->scbarray[scb_index];
1612 			if (scb_index >= ahc->scb_data->numscbs
1613 			  || (scb->flags & SCB_ACTIVE) == 0) {
1614 				printf("%s: WARNING no command for scb %d "
1615 				       "(cmdcmplt)\nQOUTPOS = %d\n",
1616 				       ahc_name(ahc), scb_index,
1617 				       ahc->qoutfifonext - 1);
1618 				continue;
1619 			}
1620 
1621 			/*
1622 			 * Save off the residual
1623 			 * if there is one.
1624 			 */
1625 			if (scb->hscb->residual_SG_count != 0)
1626 				ahc_calc_residual(scb);
1627 			ahc_done(ahc, scb);
1628 		}
1629 
1630 		if ((ahc->flags & AHC_TARGETMODE) != 0) {
1631 			ahc_run_tqinfifo(ahc);
1632 		}
1633 	}
1634 	if (intstat & BRKADRINT) {
1635 		/*
1636 		 * We upset the sequencer :-(
1637 		 * Lookup the error message
1638 		 */
1639 		int i, error, num_errors;
1640 
1641 		error = ahc_inb(ahc, ERROR);
1642 		num_errors =  sizeof(hard_error)/sizeof(hard_error[0]);
1643 		for (i = 0; error != 1 && i < num_errors; i++)
1644 			error >>= 1;
1645 		panic("%s: brkadrint, %s at seqaddr = 0x%x\n",
1646 		      ahc_name(ahc), hard_error[i].errmesg,
1647 		      ahc_inb(ahc, SEQADDR0) |
1648 		      (ahc_inb(ahc, SEQADDR1) << 8));
1649 
1650 		/* Tell everyone that this HBA is no longer availible */
1651 		ahc_abort_scbs(ahc, CAM_TARGET_WILDCARD, ALL_CHANNELS,
1652 			       CAM_LUN_WILDCARD, SCB_LIST_NULL, CAM_NO_HBA);
1653 	}
1654 	if (intstat & SEQINT)
1655 		ahc_handle_seqint(ahc, intstat);
1656 
1657 	if (intstat & SCSIINT)
1658 		ahc_handle_scsiint(ahc, intstat);
1659 }
1660 
1661 static struct tmode_tstate *
1662 ahc_alloc_tstate(struct ahc_softc *ahc, u_int scsi_id, char channel)
1663 {
1664 	struct tmode_tstate *master_tstate;
1665 	struct tmode_tstate *tstate;
1666 	int i, s;
1667 
1668 	master_tstate = ahc->enabled_targets[ahc->our_id];
1669 	if (channel == 'B') {
1670 		scsi_id += 8;
1671 		master_tstate = ahc->enabled_targets[ahc->our_id_b + 8];
1672 	}
1673 	if (ahc->enabled_targets[scsi_id] != NULL
1674 	 && ahc->enabled_targets[scsi_id] != master_tstate)
1675 		panic("%s: ahc_alloc_tstate - Target already allocated",
1676 		      ahc_name(ahc));
1677 	tstate = malloc(sizeof(*tstate), M_DEVBUF, M_NOWAIT);
1678 	if (tstate == NULL)
1679 		return (NULL);
1680 
1681 	/*
1682 	 * If we have allocated a master tstate, copy user settings from
1683 	 * the master tstate (taken from SRAM or the EEPROM) for this
1684 	 * channel, but reset our current and goal settings to async/narrow
1685 	 * until an initiator talks to us.
1686 	 */
1687 	if (master_tstate != NULL) {
1688 		bcopy(master_tstate, tstate, sizeof(*tstate));
1689 		bzero(tstate->enabled_luns, sizeof(tstate->enabled_luns));
1690 		tstate->ultraenb = 0;
1691 		for (i = 0; i < 16; i++) {
1692 			bzero(&tstate->transinfo[i].current,
1693 			      sizeof(tstate->transinfo[i].current));
1694 			bzero(&tstate->transinfo[i].goal,
1695 			      sizeof(tstate->transinfo[i].goal));
1696 		}
1697 	} else
1698 		bzero(tstate, sizeof(*tstate));
1699 	s = splcam();
1700 	ahc->enabled_targets[scsi_id] = tstate;
1701 	splx(s);
1702 	return (tstate);
1703 }
1704 
1705 static void
1706 ahc_free_tstate(struct ahc_softc *ahc, u_int scsi_id, char channel, int force)
1707 {
1708 	struct tmode_tstate *tstate;
1709 
1710 	/* Don't clean up the entry for our initiator role */
1711 	if ((ahc->flags & AHC_INITIATORMODE) != 0
1712 	 && ((channel == 'B' && scsi_id == ahc->our_id_b)
1713 	  || (channel == 'A' && scsi_id == ahc->our_id))
1714 	 && force == FALSE)
1715 		return;
1716 
1717 	if (channel == 'B')
1718 		scsi_id += 8;
1719 	tstate = ahc->enabled_targets[scsi_id];
1720 	if (tstate != NULL)
1721 		free(tstate, M_DEVBUF);
1722 	ahc->enabled_targets[scsi_id] = NULL;
1723 }
1724 
1725 static void
1726 ahc_handle_en_lun(struct ahc_softc *ahc, struct cam_sim *sim, union ccb *ccb)
1727 {
1728 	struct	   tmode_tstate *tstate;
1729 	struct	   tmode_lstate *lstate;
1730 	struct	   ccb_en_lun *cel;
1731 	cam_status status;
1732 	int	   target;
1733 	int	   lun;
1734 	u_int	   target_mask;
1735 	char	   channel;
1736 	int	   s;
1737 
1738 	status = ahc_find_tmode_devs(ahc, sim, ccb, &tstate, &lstate,
1739 				     /* notfound_failure*/FALSE);
1740 
1741 	if (status != CAM_REQ_CMP) {
1742 		ccb->ccb_h.status = status;
1743 		return;
1744 	}
1745 
1746 	cel = &ccb->cel;
1747 	target = ccb->ccb_h.target_id;
1748 	lun = ccb->ccb_h.target_lun;
1749 	channel = SIM_CHANNEL(ahc, sim);
1750 	target_mask = 0x01 << target;
1751 	if (channel == 'B')
1752 		target_mask <<= 8;
1753 
1754 	if (cel->enable != 0) {
1755 		u_int scsiseq;
1756 
1757 		/* Are we already enabled?? */
1758 		if (lstate != NULL) {
1759 			printf("Lun already enabled\n");
1760 			ccb->ccb_h.status = CAM_LUN_ALRDY_ENA;
1761 			return;
1762 		}
1763 
1764 		if (cel->grp6_len != 0
1765 		 || cel->grp7_len != 0) {
1766 			/*
1767 			 * Don't (yet?) support vendor
1768 			 * specific commands.
1769 			 */
1770 			ccb->ccb_h.status = CAM_REQ_INVALID;
1771 			printf("Non-zero Group Codes\n");
1772 			return;
1773 		}
1774 
1775 		/*
1776 		 * Seems to be okay.
1777 		 * Setup our data structures.
1778 		 */
1779 		if (target != CAM_TARGET_WILDCARD && tstate == NULL) {
1780 			tstate = ahc_alloc_tstate(ahc, target, channel);
1781 			if (tstate == NULL) {
1782 				printf("Couldn't allocate tstate\n");
1783 				ccb->ccb_h.status = CAM_RESRC_UNAVAIL;
1784 				return;
1785 			}
1786 		}
1787 		lstate = malloc(sizeof(*lstate), M_DEVBUF, M_NOWAIT);
1788 		if (lstate == NULL) {
1789 			printf("Couldn't allocate lstate\n");
1790 			ccb->ccb_h.status = CAM_RESRC_UNAVAIL;
1791 			return;
1792 		}
1793 		bzero(lstate, sizeof(*lstate));
1794 		SLIST_INIT(&lstate->accept_tios);
1795 		SLIST_INIT(&lstate->immed_notifies);
1796 		s = splcam();
1797 		pause_sequencer(ahc);
1798 		if (target != CAM_TARGET_WILDCARD) {
1799 			tstate->enabled_luns[lun] = lstate;
1800 			ahc->enabled_luns++;
1801 
1802 			if ((ahc->features & AHC_MULTI_TID) != 0) {
1803 				u_int16_t targid_mask;
1804 
1805 				targid_mask = ahc_inb(ahc, TARGID)
1806 					    | (ahc_inb(ahc, TARGID + 1) << 8);
1807 
1808 				targid_mask |= target_mask;
1809 				ahc_outb(ahc, TARGID, targid_mask);
1810 				ahc_outb(ahc, TARGID+1, (targid_mask >> 8));
1811 			} else {
1812 				int our_id;
1813 				char  channel;
1814 
1815 				channel = SIM_CHANNEL(ahc, sim);
1816 				our_id = SIM_SCSI_ID(ahc, sim);
1817 
1818 				/*
1819 				 * This can only happen if selections
1820 				 * are not enabled
1821 				 */
1822 				if (target != our_id) {
1823 					u_int sblkctl;
1824 					char  cur_channel;
1825 					int   swap;
1826 
1827 					sblkctl = ahc_inb(ahc, SBLKCTL);
1828 					cur_channel = (sblkctl & SELBUSB)
1829 						    ? 'B' : 'A';
1830 					if ((ahc->features & AHC_TWIN) == 0)
1831 						cur_channel = 'A';
1832 					swap = cur_channel != channel;
1833 					if (channel == 'A')
1834 						ahc->our_id = target;
1835 					else
1836 						ahc->our_id_b = target;
1837 
1838 					if (swap)
1839 						ahc_outb(ahc, SBLKCTL,
1840 							 sblkctl ^ SELBUSB);
1841 
1842 					ahc_outb(ahc, SCSIID, target);
1843 
1844 					if (swap)
1845 						ahc_outb(ahc, SBLKCTL, sblkctl);
1846 				}
1847 			}
1848 		} else
1849 			ahc->black_hole = lstate;
1850 		/* Allow select-in operations */
1851 		if (ahc->black_hole != NULL && ahc->enabled_luns > 0) {
1852 			scsiseq = ahc_inb(ahc, SCSISEQ_TEMPLATE);
1853 			scsiseq |= ENSELI;
1854 			ahc_outb(ahc, SCSISEQ_TEMPLATE, scsiseq);
1855 			scsiseq = ahc_inb(ahc, SCSISEQ);
1856 			scsiseq |= ENSELI;
1857 			ahc_outb(ahc, SCSISEQ, scsiseq);
1858 		}
1859 		unpause_sequencer(ahc, /*always?*/FALSE);
1860 		splx(s);
1861 		ccb->ccb_h.status = CAM_REQ_CMP;
1862 		xpt_print_path(ccb->ccb_h.path);
1863 		printf("Lun now enabled for target mode\n");
1864 	} else {
1865 		struct ccb_hdr *elm;
1866 
1867 		if (lstate == NULL) {
1868 			ccb->ccb_h.status = CAM_LUN_INVALID;
1869 			return;
1870 		}
1871 
1872 		s = splcam();
1873 		ccb->ccb_h.status = CAM_REQ_CMP;
1874 		LIST_FOREACH(elm, &ahc->pending_ccbs, sim_links.le) {
1875 			if (elm->func_code == XPT_CONT_TARGET_IO
1876 			 && !xpt_path_comp(elm->path, ccb->ccb_h.path)){
1877 				printf("CTIO pending\n");
1878 				ccb->ccb_h.status = CAM_REQ_INVALID;
1879 				splx(s);
1880 				return;
1881 			}
1882 		}
1883 
1884 		if (SLIST_FIRST(&lstate->accept_tios) != NULL) {
1885 			printf("ATIOs pending\n");
1886 			ccb->ccb_h.status = CAM_REQ_INVALID;
1887 		}
1888 
1889 		if (SLIST_FIRST(&lstate->immed_notifies) != NULL) {
1890 			printf("INOTs pending\n");
1891 			ccb->ccb_h.status = CAM_REQ_INVALID;
1892 		}
1893 
1894 		if (ccb->ccb_h.status == CAM_REQ_CMP) {
1895 			int i, empty;
1896 
1897 			xpt_print_path(ccb->ccb_h.path);
1898 			printf("Target mode disabled\n");
1899 			free(lstate, M_DEVBUF);
1900 
1901 			pause_sequencer(ahc);
1902 			/* Can we clean up the target too? */
1903 			if (target != CAM_TARGET_WILDCARD) {
1904 				tstate->enabled_luns[lun] = NULL;
1905 				ahc->enabled_luns--;
1906 				for (empty = 1, i = 0; i < 8; i++)
1907 					if (tstate->enabled_luns[i] != NULL) {
1908 						empty = 0;
1909 						break;
1910 					}
1911 
1912 				if (empty) {
1913 					ahc_free_tstate(ahc, target, channel,
1914 							/*force*/FALSE);
1915 					if (ahc->features & AHC_MULTI_TID) {
1916 						u_int16_t targid_mask;
1917 
1918 						targid_mask =
1919 						    ahc_inb(ahc, TARGID)
1920 						    | (ahc_inb(ahc, TARGID + 1)
1921 						       << 8);
1922 
1923 						targid_mask &= ~target_mask;
1924 						ahc_outb(ahc, TARGID,
1925 							 targid_mask);
1926 						ahc_outb(ahc, TARGID+1,
1927 						 	 (targid_mask >> 8));
1928 					}
1929 				}
1930 			} else {
1931 
1932 				ahc->black_hole = NULL;
1933 
1934 				/*
1935 				 * We can't allow selections without
1936 				 * our black hole device.
1937 				 */
1938 				empty = TRUE;
1939 			}
1940 			if (ahc->enabled_luns == 0) {
1941 				/* Disallow select-in */
1942 				u_int scsiseq;
1943 
1944 				scsiseq = ahc_inb(ahc, SCSISEQ_TEMPLATE);
1945 				scsiseq &= ~ENSELI;
1946 				ahc_outb(ahc, SCSISEQ_TEMPLATE, scsiseq);
1947 				scsiseq = ahc_inb(ahc, SCSISEQ);
1948 				scsiseq &= ~ENSELI;
1949 				ahc_outb(ahc, SCSISEQ, scsiseq);
1950 			}
1951 			unpause_sequencer(ahc, /*always?*/FALSE);
1952 		}
1953 		splx(s);
1954 	}
1955 }
1956 
1957 static int
1958 ahc_handle_target_cmd(struct ahc_softc *ahc, struct target_cmd *cmd)
1959 {
1960 	struct	  tmode_tstate *tstate;
1961 	struct	  tmode_lstate *lstate;
1962 	struct	  ccb_accept_tio *atio;
1963 	u_int8_t *byte;
1964 	int	  initiator;
1965 	int	  target;
1966 	int	  lun;
1967 
1968 	initiator = cmd->initiator_channel >> 4;
1969 	target = cmd->targ_id;
1970 	lun    = (cmd->identify & MSG_IDENTIFY_LUNMASK);
1971 
1972 	byte = cmd->bytes;
1973 	tstate = ahc->enabled_targets[target];
1974 	lstate = NULL;
1975 	if (tstate != NULL && lun < 8)
1976 		lstate = tstate->enabled_luns[lun];
1977 
1978 	/*
1979 	 * Commands for disabled luns go to the black hole driver.
1980 	 */
1981 	if (lstate == NULL) {
1982 		lstate = ahc->black_hole;
1983 		atio =
1984 		    (struct ccb_accept_tio*)SLIST_FIRST(&lstate->accept_tios);
1985 	} else {
1986 		atio =
1987 		    (struct ccb_accept_tio*)SLIST_FIRST(&lstate->accept_tios);
1988 	}
1989 	if (atio == NULL) {
1990 		ahc->flags |= AHC_TQINFIFO_BLOCKED;
1991 		printf("No ATIOs for incoming command\n");
1992 		/*
1993 		 * Wait for more ATIOs from the peripheral driver for this lun.
1994 		 */
1995 		return (1);
1996 	} else
1997 		ahc->flags &= ~AHC_TQINFIFO_BLOCKED;
1998 	SLIST_REMOVE_HEAD(&lstate->accept_tios, sim_links.sle);
1999 
2000 	if (lstate == ahc->black_hole) {
2001 		/* Fill in the wildcards */
2002 		atio->ccb_h.target_id = target;
2003 		atio->ccb_h.target_lun = lun;
2004 	}
2005 
2006 	/*
2007 	 * Package it up and send it off to
2008 	 * whomever has this lun enabled.
2009 	 */
2010 	atio->init_id = initiator;
2011 	if (byte[0] != 0xFF) {
2012 		/* Tag was included */
2013 		atio->tag_action = *byte++;
2014 		atio->tag_id = *byte++;
2015 		atio->ccb_h.flags = CAM_TAG_ACTION_VALID;
2016 	} else {
2017 		byte++;
2018 		atio->ccb_h.flags = 0;
2019 	}
2020 
2021 	/* Okay.  Now determine the cdb size based on the command code */
2022 	switch (*byte >> CMD_GROUP_CODE_SHIFT) {
2023 	case 0:
2024 		atio->cdb_len = 6;
2025 		break;
2026 	case 1:
2027 	case 2:
2028 		atio->cdb_len = 10;
2029 		break;
2030 	case 4:
2031 		atio->cdb_len = 16;
2032 		break;
2033 	case 5:
2034 		atio->cdb_len = 12;
2035 		break;
2036 	case 3:
2037 	default:
2038 		/* Only copy the opcode. */
2039 		atio->cdb_len = 1;
2040 		printf("Reserved or VU command code type encountered\n");
2041 		break;
2042 	}
2043 	bcopy(byte, atio->cdb_io.cdb_bytes, atio->cdb_len);
2044 
2045 	atio->ccb_h.status |= CAM_CDB_RECVD;
2046 
2047 	if ((cmd->identify & MSG_IDENTIFY_DISCFLAG) == 0) {
2048 		/*
2049 		 * We weren't allowed to disconnect.
2050 		 * We're hanging on the bus until a
2051 		 * continue target I/O comes in response
2052 		 * to this accept tio.
2053 		 */
2054 #if 0
2055 		printf("Received Immediate Command %d:%d:%d - %p\n",
2056 		       initiator, target, lun, ahc->pending_device);
2057 #endif
2058 		ahc->pending_device = lstate;
2059 	}
2060 	xpt_done((union ccb*)atio);
2061 	return (0);
2062 }
2063 
2064 static void
2065 ahc_handle_seqint(struct ahc_softc *ahc, u_int intstat)
2066 {
2067 	struct scb *scb;
2068 	struct ahc_devinfo devinfo;
2069 
2070 	ahc_fetch_devinfo(ahc, &devinfo);
2071 
2072 	/*
2073 	 * Clear the upper byte that holds SEQINT status
2074 	 * codes and clear the SEQINT bit. We will unpause
2075 	 * the sequencer, if appropriate, after servicing
2076 	 * the request.
2077 	 */
2078 	ahc_outb(ahc, CLRINT, CLRSEQINT);
2079 	switch (intstat & SEQINT_MASK) {
2080 	case NO_MATCH:
2081 	{
2082 		/* Ensure we don't leave the selection hardware on */
2083 		ahc_outb(ahc, SCSISEQ,
2084 			 ahc_inb(ahc, SCSISEQ) & (ENSELI|ENRSELI|ENAUTOATNP));
2085 
2086 		printf("%s:%c:%d: no active SCB for reconnecting "
2087 		       "target - issuing BUS DEVICE RESET\n",
2088 		       ahc_name(ahc), devinfo.channel, devinfo.target);
2089 		printf("SAVED_TCL == 0x%x, ARG_1 == 0x%x, SEQ_FLAGS == 0x%x\n",
2090 		       ahc_inb(ahc, SAVED_TCL), ahc_inb(ahc, ARG_1),
2091 		       ahc_inb(ahc, SEQ_FLAGS));
2092 		ahc->msgout_buf[0] = MSG_BUS_DEV_RESET;
2093 		ahc->msgout_len = 1;
2094 		ahc->msgout_index = 0;
2095 		ahc->msg_type = MSG_TYPE_INITIATOR_MSGOUT;
2096 		ahc_outb(ahc, MSG_OUT, HOST_MSG);
2097 		ahc_outb(ahc, SCSISIGO, ahc_inb(ahc, LASTPHASE) | ATNO);
2098 		break;
2099 	}
2100 	case UPDATE_TMSG_REQ:
2101 		ahc_outb(ahc, TARGET_MSG_REQUEST, ahc->targ_msg_req & 0xFF);
2102 		ahc_outb(ahc, TARGET_MSG_REQUEST + 1,
2103 			 (ahc->targ_msg_req >> 8) & 0xFF);
2104 		ahc_outb(ahc, HS_MAILBOX, 0);
2105 		break;
2106 	case SEND_REJECT:
2107 	{
2108 		u_int rejbyte = ahc_inb(ahc, ACCUM);
2109 		printf("%s:%c:%d: Warning - unknown message received from "
2110 		       "target (0x%x).  Rejecting\n",
2111 		       ahc_name(ahc), devinfo.channel, devinfo.target, rejbyte);
2112 		break;
2113 	}
2114 	case NO_IDENT:
2115 	{
2116 		/*
2117 		 * The reconnecting target either did not send an identify
2118 		 * message, or did, but we didn't find and SCB to match and
2119 		 * before it could respond to our ATN/abort, it hit a dataphase.
2120 		 * The only safe thing to do is to blow it away with a bus
2121 		 * reset.
2122 		 */
2123 		int found;
2124 
2125 		printf("%s:%c:%d: Target did not send an IDENTIFY message. "
2126 		       "LASTPHASE = 0x%x, SAVED_TCL == 0x%x\n",
2127 		       ahc_name(ahc), devinfo.channel, devinfo.target,
2128 		       ahc_inb(ahc, LASTPHASE), ahc_inb(ahc, SAVED_TCL));
2129 		found = ahc_reset_channel(ahc, devinfo.channel,
2130 					  /*initiate reset*/TRUE);
2131 		printf("%s: Issued Channel %c Bus Reset. "
2132 		       "%d SCBs aborted\n", ahc_name(ahc), devinfo.channel,
2133 		       found);
2134 		return;
2135 	}
2136 	case BAD_PHASE:
2137 		if (ahc_inb(ahc, LASTPHASE) == P_BUSFREE) {
2138 			printf("%s:%c:%d: Missed busfree.\n", ahc_name(ahc),
2139 			       devinfo.channel, devinfo.target);
2140 			restart_sequencer(ahc);
2141 			return;
2142 		} else {
2143 			printf("%s:%c:%d: unknown scsi bus phase.  Attempting "
2144 			       "to continue\n", ahc_name(ahc), devinfo.channel,
2145 			       devinfo.target);
2146 		}
2147 		break;
2148 	case BAD_STATUS:
2149 	{
2150 		u_int  scb_index;
2151 		struct hardware_scb *hscb;
2152 		struct ccb_scsiio *csio;
2153 		/*
2154 		 * The sequencer will notify us when a command
2155 		 * has an error that would be of interest to
2156 		 * the kernel.  This allows us to leave the sequencer
2157 		 * running in the common case of command completes
2158 		 * without error.  The sequencer will already have
2159 		 * dma'd the SCB back up to us, so we can reference
2160 		 * the in kernel copy directly.
2161 		 */
2162 		scb_index = ahc_inb(ahc, SCB_TAG);
2163 		scb = &ahc->scb_data->scbarray[scb_index];
2164 
2165 		/*
2166 		 * Set the default return value to 0 (don't
2167 		 * send sense).  The sense code will change
2168 		 * this if needed.
2169 		 */
2170 		ahc_outb(ahc, RETURN_1, 0);
2171 		if (!(scb_index < ahc->scb_data->numscbs
2172 		   && (scb->flags & SCB_ACTIVE) != 0)) {
2173 			printf("%s:%c:%d: ahc_intr - referenced scb "
2174 			       "not valid during seqint 0x%x scb(%d)\n",
2175 			       ahc_name(ahc), devinfo.channel,
2176 			       devinfo.target, intstat, scb_index);
2177 			goto unpause;
2178 		}
2179 
2180 		hscb = scb->hscb;
2181 
2182 		/* Don't want to clobber the original sense code */
2183 		if ((scb->flags & SCB_SENSE) != 0) {
2184 			/*
2185 			 * Clear the SCB_SENSE Flag and have
2186 			 * the sequencer do a normal command
2187 			 * complete.
2188 			 */
2189 			scb->flags &= ~SCB_SENSE;
2190 			ahcsetccbstatus(scb->ccb, CAM_AUTOSENSE_FAIL);
2191 			break;
2192 		}
2193 		ahcsetccbstatus(scb->ccb, CAM_SCSI_STATUS_ERROR);
2194 		/* Freeze the queue unit the client sees the error. */
2195 		ahc_freeze_devq(ahc, scb->ccb->ccb_h.path);
2196 		ahc_freeze_ccb(scb->ccb);
2197 		csio = &scb->ccb->csio;
2198 		csio->scsi_status = hscb->status;
2199 		switch (hscb->status) {
2200 		case SCSI_STATUS_OK:
2201 			printf("%s: Interrupted for staus of 0???\n",
2202 			       ahc_name(ahc));
2203 			break;
2204 		case SCSI_STATUS_CMD_TERMINATED:
2205 		case SCSI_STATUS_CHECK_COND:
2206 #ifdef AHC_DEBUG
2207 			if (ahc_debug & AHC_SHOWSENSE) {
2208 				xpt_print_path(csio->ccb_h.path);
2209 				printf("SCB %d: requests Check Status\n",
2210 				       scb->hscb->tag);
2211 			}
2212 #endif
2213 
2214 			if ((csio->ccb_h.flags & CAM_DIS_AUTOSENSE) == 0) {
2215 				struct ahc_dma_seg *sg;
2216 				struct scsi_sense *sc;
2217 				struct ahc_initiator_tinfo *tinfo;
2218 				struct tmode_tstate *tstate;
2219 
2220 				sg = scb->sg_list;
2221 				sc = (struct scsi_sense *)(&hscb->cmdstore);
2222 				/*
2223 				 * Save off the residual if there is one.
2224 				 */
2225 				if (hscb->residual_SG_count != 0)
2226 					ahc_calc_residual(scb);
2227 
2228 #ifdef AHC_DEBUG
2229 				if (ahc_debug & AHC_SHOWSENSE) {
2230 					xpt_print_path(csio->ccb_h.path);
2231 					printf("Sending Sense\n");
2232 				}
2233 #endif
2234 				sg->addr = ahc->scb_data->sense_busaddr
2235 				   + (hscb->tag*sizeof(struct scsi_sense_data));
2236 				sg->len = MIN(sizeof(struct scsi_sense_data),
2237 					      csio->sense_len);
2238 
2239 				sc->opcode = REQUEST_SENSE;
2240 				sc->byte2 =  SCB_LUN(scb) << 5;
2241 				sc->unused[0] = 0;
2242 				sc->unused[1] = 0;
2243 				sc->length = sg->len;
2244 				sc->control = 0;
2245 
2246 				/*
2247 				 * Would be nice to preserve DISCENB here,
2248 				 * but due to the way we page SCBs, we can't.
2249 				 */
2250 				hscb->control = 0;
2251 
2252 				/*
2253 				 * This request sense could be because the
2254 				 * the device lost power or in some other
2255 				 * way has lost our transfer negotiations.
2256 				 * Renegotiate if appropriate.
2257 				 */
2258 				tinfo = ahc_fetch_transinfo(ahc,
2259 							    devinfo.channel,
2260 							    devinfo.our_scsiid,
2261 							    devinfo.target,
2262 							    &tstate);
2263 				ahc_update_target_msg_request(ahc, &devinfo,
2264 							      tinfo,
2265 							      /*force*/TRUE,
2266 							      /*paused*/TRUE);
2267 				hscb->status = 0;
2268 				hscb->SG_count = 1;
2269 				hscb->SG_pointer = scb->sg_list_phys;
2270 				hscb->data = sg->addr;
2271 				hscb->datalen = sg->len;
2272 				hscb->cmdpointer = hscb->cmdstore_busaddr;
2273 				hscb->cmdlen = sizeof(*sc);
2274 				scb->sg_count = hscb->SG_count;
2275 				scb->flags |= SCB_SENSE;
2276 				/*
2277 				 * Ensure the target is busy since this
2278 				 * will be an untagged request.
2279 				 */
2280 				ahc_busy_tcl(ahc, scb);
2281 				ahc_outb(ahc, RETURN_1, SEND_SENSE);
2282 
2283 				/*
2284 				 * Ensure we have enough time to actually
2285 				 * retrieve the sense.
2286 				 */
2287 				untimeout(ahc_timeout, (caddr_t)scb,
2288 					  scb->ccb->ccb_h.timeout_ch);
2289 				scb->ccb->ccb_h.timeout_ch =
2290 				    timeout(ahc_timeout, (caddr_t)scb, 5 * hz);
2291 			}
2292 			break;
2293 		case SCSI_STATUS_BUSY:
2294 		case SCSI_STATUS_QUEUE_FULL:
2295 			/*
2296 			 * Requeue any transactions that haven't been
2297 			 * sent yet.
2298 			 */
2299 			ahc_freeze_devq(ahc, scb->ccb->ccb_h.path);
2300 			ahc_freeze_ccb(scb->ccb);
2301 			break;
2302 		}
2303 		break;
2304 	}
2305 	case TRACE_POINT:
2306 	{
2307 		printf("SSTAT2 = 0x%x DFCNTRL = 0x%x\n", ahc_inb(ahc, SSTAT2),
2308 		       ahc_inb(ahc, DFCNTRL));
2309 		printf("SSTAT3 = 0x%x DSTATUS = 0x%x\n", ahc_inb(ahc, SSTAT3),
2310 		       ahc_inb(ahc, DFSTATUS));
2311 		printf("SSTAT0 = 0x%x, SCB_DATACNT = 0x%x\n",
2312 		       ahc_inb(ahc, SSTAT0),
2313 		       ahc_inb(ahc, SCB_DATACNT));
2314 		break;
2315 	}
2316 	case TARGET_MSG_HELP:
2317 	{
2318 		/*
2319 		 * XXX Handle BDR, Abort, Abort Tag, and transfer negotiations.
2320 		 */
2321 		restart_sequencer(ahc);
2322 		return;
2323 	}
2324 	case HOST_MSG_LOOP:
2325 	{
2326 		/*
2327 		 * The sequencer has encountered a message phase
2328 		 * that requires host assistance for completion.
2329 		 * While handling the message phase(s), we will be
2330 		 * notified by the sequencer after each byte is
2331 		 * transfered so we can track bus phases.
2332 		 *
2333 		 * If this is the first time we've seen a HOST_MSG_LOOP,
2334 		 * initialize the state of the host message loop.
2335 		 */
2336 		if (ahc->msg_type == MSG_TYPE_NONE) {
2337 			u_int bus_phase;
2338 
2339 			bus_phase = ahc_inb(ahc, SCSISIGI) & PHASE_MASK;
2340 			if (bus_phase != P_MESGIN && bus_phase != P_MESGOUT)
2341 				panic("ahc_intr: HOST_MSG_LOOP bad phase 0x%x",
2342 				      bus_phase);
2343 
2344 			if (devinfo.role == ROLE_INITIATOR) {
2345 				struct scb *scb;
2346 				u_int scb_index;
2347 
2348 				scb_index = ahc_inb(ahc, SCB_TAG);
2349 				scb = &ahc->scb_data->scbarray[scb_index];
2350 
2351 				if (bus_phase == P_MESGOUT)
2352 					ahc_setup_initiator_msgout(ahc,
2353 								   &devinfo,
2354 								   scb);
2355 				else {
2356 					ahc->msg_type =
2357 					    MSG_TYPE_INITIATOR_MSGIN;
2358 					ahc->msgin_index = 0;
2359 				}
2360 			} else {
2361 				if (bus_phase == P_MESGOUT) {
2362 					ahc->msg_type =
2363 					    MSG_TYPE_TARGET_MSGOUT;
2364 					ahc->msgin_index = 0;
2365 				} else
2366 					/* XXX Ever executed??? */
2367 					ahc_setup_target_msgin(ahc, &devinfo);
2368 			}
2369 		}
2370 
2371 		/* Pass a NULL path so that handlers generate their own */
2372 		ahc_handle_message_phase(ahc, /*path*/NULL);
2373 		break;
2374 	}
2375 	case DATA_OVERRUN:
2376 	{
2377 		/*
2378 		 * When the sequencer detects an overrun, it
2379 		 * places the controller in "BITBUCKET" mode
2380 		 * and allows the target to complete its transfer.
2381 		 * Unfortunately, none of the counters get updated
2382 		 * when the controller is in this mode, so we have
2383 		 * no way of knowing how large the overrun was.
2384 		 */
2385 		u_int scbindex = ahc_inb(ahc, SCB_TAG);
2386 		u_int lastphase = ahc_inb(ahc, LASTPHASE);
2387 		int i;
2388 
2389 		scb = &ahc->scb_data->scbarray[scbindex];
2390 		xpt_print_path(scb->ccb->ccb_h.path);
2391 		printf("data overrun detected in %s phase."
2392 		       "  Tag == 0x%x.\n",
2393 		       lastphase == P_DATAIN ? "Data-In" : "Data-Out",
2394 		       scb->hscb->tag);
2395 		xpt_print_path(scb->ccb->ccb_h.path);
2396 		printf("%s seen Data Phase.  Length = %d.  NumSGs = %d.\n",
2397 		       ahc_inb(ahc, SEQ_FLAGS) & DPHASE ? "Have" : "Haven't",
2398 		       scb->ccb->csio.dxfer_len, scb->sg_count);
2399 		if (scb->sg_count > 0) {
2400 			for (i = 0; i < scb->sg_count - 1; i++) {
2401 				printf("sg[%d] - Addr 0x%x : Length %d\n",
2402 				       i,
2403 				       scb->sg_list[i].addr,
2404 				       scb->sg_list[i].len);
2405 			}
2406 		}
2407 		/*
2408 		 * Set this and it will take affect when the
2409 		 * target does a command complete.
2410 		 */
2411 		ahc_freeze_devq(ahc, scb->ccb->ccb_h.path);
2412 		ahcsetccbstatus(scb->ccb, CAM_DATA_RUN_ERR);
2413 		ahc_freeze_ccb(scb->ccb);
2414 		break;
2415 	}
2416 	case TRACEPOINT:
2417 	{
2418 		printf("TRACEPOINT: RETURN_2 = %d\n", ahc_inb(ahc, RETURN_2));
2419 #if 0
2420 		printf("SSTAT1 == 0x%x\n", ahc_inb(ahc, SSTAT1));
2421 		printf("SSTAT0 == 0x%x\n", ahc_inb(ahc, SSTAT0));
2422 		printf(", SCSISIGI == 0x%x\n", ahc_inb(ahc, SCSISIGI));
2423 		printf("TRACEPOINT: CCHCNT = %d, SG_COUNT = %d\n",
2424 		       ahc_inb(ahc, CCHCNT), ahc_inb(ahc, SG_COUNT));
2425 		printf("TRACEPOINT: SCB_TAG = %d\n", ahc_inb(ahc, SCB_TAG));
2426 		printf("TRACEPOINT1: CCHADDR = %d, CCHCNT = %d, SCBPTR = %d\n",
2427 		       ahc_inb(ahc, CCHADDR)
2428 		    | (ahc_inb(ahc, CCHADDR+1) << 8)
2429 		    | (ahc_inb(ahc, CCHADDR+2) << 16)
2430 		    | (ahc_inb(ahc, CCHADDR+3) << 24),
2431 		       ahc_inb(ahc, CCHCNT)
2432 		    | (ahc_inb(ahc, CCHCNT+1) << 8)
2433 		    | (ahc_inb(ahc, CCHCNT+2) << 16),
2434 		       ahc_inb(ahc, SCBPTR));
2435 		printf("TRACEPOINT: WAITING_SCBH = %d\n", ahc_inb(ahc, WAITING_SCBH));
2436 		printf("TRACEPOINT: SCB_TAG = %d\n", ahc_inb(ahc, SCB_TAG));
2437 #endif
2438 		break;
2439 	}
2440 #if NOT_YET
2441 	/* XXX Fill these in later */
2442 	case MESG_BUFFER_BUSY:
2443 		break;
2444 	case MSGIN_PHASEMIS:
2445 		break;
2446 #endif
2447 	default:
2448 		printf("ahc_intr: seqint, "
2449 		       "intstat == 0x%x, scsisigi = 0x%x\n",
2450 		       intstat, ahc_inb(ahc, SCSISIGI));
2451 		break;
2452 	}
2453 
2454 unpause:
2455 	/*
2456 	 *  The sequencer is paused immediately on
2457 	 *  a SEQINT, so we should restart it when
2458 	 *  we're done.
2459 	 */
2460 	unpause_sequencer(ahc, /*unpause_always*/TRUE);
2461 }
2462 
2463 static void
2464 ahc_handle_scsiint(struct ahc_softc *ahc, u_int intstat)
2465 {
2466 	u_int	scb_index;
2467 	u_int	status;
2468 	struct	scb *scb;
2469 	char	cur_channel;
2470 	char	intr_channel;
2471 
2472 	if ((ahc->features & AHC_TWIN) != 0
2473 	 && ((ahc_inb(ahc, SBLKCTL) & SELBUSB) != 0))
2474 		cur_channel = 'B';
2475 	else
2476 		cur_channel = 'A';
2477 	intr_channel = cur_channel;
2478 
2479 	status = ahc_inb(ahc, SSTAT1);
2480 	if (status == 0) {
2481 		if ((ahc->features & AHC_TWIN) != 0) {
2482 			/* Try the other channel */
2483 		 	ahc_outb(ahc, SBLKCTL, ahc_inb(ahc, SBLKCTL) ^ SELBUSB);
2484 			status = ahc_inb(ahc, SSTAT1);
2485 		 	ahc_outb(ahc, SBLKCTL, ahc_inb(ahc, SBLKCTL) ^ SELBUSB);
2486 			intr_channel = (cur_channel == 'A') ? 'B' : 'A';
2487 		}
2488 		if (status == 0) {
2489 			printf("%s: Spurious SCSI interrupt\n", ahc_name(ahc));
2490 			return;
2491 		}
2492 	}
2493 
2494 	scb_index = ahc_inb(ahc, SCB_TAG);
2495 	if (scb_index < ahc->scb_data->numscbs) {
2496 		scb = &ahc->scb_data->scbarray[scb_index];
2497 		if ((scb->flags & SCB_ACTIVE) == 0)
2498 			scb = NULL;
2499 	} else
2500 		scb = NULL;
2501 
2502 	if ((status & SCSIRSTI) != 0) {
2503 		printf("%s: Someone reset channel %c\n",
2504 			ahc_name(ahc), intr_channel);
2505 		ahc_reset_channel(ahc, intr_channel, /* Initiate Reset */FALSE);
2506 	} else if ((status & BUSFREE) != 0 && (status & SELTO) == 0) {
2507 		/*
2508 		 * First look at what phase we were last in.
2509 		 * If its message out, chances are pretty good
2510 		 * that the busfree was in response to one of
2511 		 * our abort requests.
2512 		 */
2513 		u_int lastphase = ahc_inb(ahc, LASTPHASE);
2514 		u_int saved_tcl = ahc_inb(ahc, SAVED_TCL);
2515 		u_int target = TCL_TARGET(saved_tcl);
2516 		u_int initiator_role_id = TCL_SCSI_ID(ahc, saved_tcl);
2517 		char channel = TCL_CHANNEL(ahc, saved_tcl);
2518 		int printerror = 1;
2519 
2520 		ahc_outb(ahc, SCSISEQ,
2521 			 ahc_inb(ahc, SCSISEQ) & (ENSELI|ENRSELI|ENAUTOATNP));
2522 		if (lastphase == P_MESGOUT) {
2523 			u_int message;
2524 			u_int tag;
2525 
2526 			message = ahc->msgout_buf[ahc->msgout_index - 1];
2527 			tag = SCB_LIST_NULL;
2528 			switch (message) {
2529 			case MSG_ABORT_TAG:
2530 				tag = scb->hscb->tag;
2531 				/* FALLTRHOUGH */
2532 			case MSG_ABORT:
2533 				xpt_print_path(scb->ccb->ccb_h.path);
2534 				printf("SCB %d - Abort %s Completed.\n",
2535 				       scb->hscb->tag, tag == SCB_LIST_NULL ?
2536 				       "" : "Tag");
2537 				if ((scb->flags & SCB_RECOVERY_SCB) != 0) {
2538 					ahcsetccbstatus(scb->ccb,
2539 							CAM_REQ_ABORTED);
2540 					ahc_done(ahc, scb);
2541 				}
2542 				printerror = 0;
2543 				break;
2544 			case MSG_BUS_DEV_RESET:
2545 			{
2546 				struct ahc_devinfo devinfo;
2547 
2548 				ahc_compile_devinfo(&devinfo,
2549 						    initiator_role_id,
2550 						    target,
2551 						    TCL_LUN(saved_tcl),
2552 						    channel,
2553 						    ROLE_INITIATOR);
2554 				ahc_handle_devreset(ahc, &devinfo,
2555 						    CAM_BDR_SENT, AC_SENT_BDR,
2556 						    "Bus Device Reset",
2557 						    /*verbose_only*/FALSE);
2558 				printerror = 0;
2559 				break;
2560 			}
2561 			default:
2562 				break;
2563 			}
2564 		}
2565 		if (printerror != 0) {
2566 			if (scb != NULL) {
2567 				u_int tag;
2568 
2569 				if ((scb->hscb->control & TAG_ENB) != 0)
2570 					tag = scb->hscb->tag;
2571 				else
2572 					tag = SCB_LIST_NULL;
2573 				ahc_abort_scbs(ahc, target, channel,
2574 					       SCB_LUN(scb), tag,
2575 					       CAM_UNEXP_BUSFREE);
2576 			} else {
2577 				ahc_abort_scbs(ahc, target, channel,
2578 					       CAM_LUN_WILDCARD, SCB_LIST_NULL,
2579 					       CAM_UNEXP_BUSFREE);
2580 				printf("%s: ", ahc_name(ahc));
2581 			}
2582 			printf("Unexpected busfree.  LASTPHASE == 0x%x\n"
2583 			       "SEQADDR == 0x%x\n",
2584 			       lastphase, ahc_inb(ahc, SEQADDR0)
2585 				| (ahc_inb(ahc, SEQADDR1) << 8));
2586 		}
2587 		ahc_clear_msg_state(ahc);
2588 		ahc_outb(ahc, SIMODE1, ahc_inb(ahc, SIMODE1) & ~ENBUSFREE);
2589 		ahc_outb(ahc, CLRSINT1, CLRBUSFREE);
2590 		ahc_outb(ahc, CLRINT, CLRSCSIINT);
2591 		restart_sequencer(ahc);
2592 	} else if ((status & SELTO) != 0) {
2593 		u_int scbptr;
2594 
2595 		scbptr = ahc_inb(ahc, WAITING_SCBH);
2596 		ahc_outb(ahc, SCBPTR, scbptr);
2597 		scb_index = ahc_inb(ahc, SCB_TAG);
2598 
2599 		if (scb_index < ahc->scb_data->numscbs) {
2600 			scb = &ahc->scb_data->scbarray[scb_index];
2601 			if ((scb->flags & SCB_ACTIVE) == 0)
2602 				scb = NULL;
2603 		} else
2604 			scb = NULL;
2605 
2606 		if (scb == NULL) {
2607 			printf("%s: ahc_intr - referenced scb not "
2608 			       "valid during SELTO scb(%d, %d)\n",
2609 			       ahc_name(ahc), scbptr, scb_index);
2610 		} else {
2611 			struct ahc_devinfo devinfo;
2612 
2613 			ahc_scb_devinfo(ahc, &devinfo, scb);
2614 			ahc_handle_devreset(ahc, &devinfo, CAM_SEL_TIMEOUT,
2615 					    /*ac_code*/0, "Selection Timeout",
2616 					    /*verbose_only*/TRUE);
2617 		}
2618 		/* Stop the selection */
2619 		ahc_outb(ahc, SCSISEQ, 0);
2620 
2621 		ahc_clear_msg_state(ahc);
2622 
2623 		ahc_outb(ahc, CLRSINT1, CLRSELTIMEO|CLRBUSFREE);
2624 
2625 		ahc_outb(ahc, CLRINT, CLRSCSIINT);
2626 
2627 		restart_sequencer(ahc);
2628 	} else if (scb == NULL) {
2629 		printf("%s: ahc_intr - referenced scb not "
2630 		       "valid during scsiint 0x%x scb(%d)\n"
2631 		       "SIMODE0 = 0x%x, SIMODE1 = 0x%x, SSTAT0 = 0x%x\n"
2632 		       "SEQADDR = 0x%x\n", ahc_name(ahc),
2633 			status, scb_index, ahc_inb(ahc, SIMODE0),
2634 			ahc_inb(ahc, SIMODE1), ahc_inb(ahc, SSTAT0),
2635 			ahc_inb(ahc, SEQADDR0) | (ahc_inb(ahc, SEQADDR1) << 8));
2636 		ahc_outb(ahc, CLRSINT1, status);
2637 		ahc_outb(ahc, CLRINT, CLRSCSIINT);
2638 		unpause_sequencer(ahc, /*unpause_always*/TRUE);
2639 		scb = NULL;
2640 	} else if ((status & SCSIPERR) != 0) {
2641 		/*
2642 		 * Determine the bus phase and
2643 		 * queue an appropriate message
2644 		 */
2645 		char *phase;
2646 		u_int mesg_out = MSG_NOOP;
2647 		u_int lastphase = ahc_inb(ahc, LASTPHASE);
2648 
2649 		xpt_print_path(scb->ccb->ccb_h.path);
2650 
2651 		switch (lastphase) {
2652 		case P_DATAOUT:
2653 			phase = "Data-Out";
2654 			break;
2655 		case P_DATAIN:
2656 			phase = "Data-In";
2657 			mesg_out = MSG_INITIATOR_DET_ERR;
2658 			break;
2659 		case P_COMMAND:
2660 			phase = "Command";
2661 			break;
2662 		case P_MESGOUT:
2663 			phase = "Message-Out";
2664 			break;
2665 		case P_STATUS:
2666 			phase = "Status";
2667 			mesg_out = MSG_INITIATOR_DET_ERR;
2668 			break;
2669 		case P_MESGIN:
2670 			phase = "Message-In";
2671 			mesg_out = MSG_PARITY_ERROR;
2672 			break;
2673 		default:
2674 			phase = "unknown";
2675 			break;
2676 		}
2677 		printf("parity error during %s phase.\n", phase);
2678 
2679 		printf("SEQADDR == 0x%x\n", ahc_inb(ahc, SEQADDR0)
2680 				 | (ahc_inb(ahc, SEQADDR1) << 8));
2681 
2682 		printf("SCSIRATE == 0x%x\n", ahc_inb(ahc, SCSIRATE));
2683 
2684 		/*
2685 		 * We've set the hardware to assert ATN if we
2686 		 * get a parity error on "in" phases, so all we
2687 		 * need to do is stuff the message buffer with
2688 		 * the appropriate message.  "In" phases have set
2689 		 * mesg_out to something other than MSG_NOP.
2690 		 */
2691 		if (mesg_out != MSG_NOOP) {
2692 			if (ahc->msg_type != MSG_TYPE_NONE)
2693 				ahc->send_msg_perror = TRUE;
2694 			else
2695 				ahc_outb(ahc, MSG_OUT, mesg_out);
2696 		}
2697 		ahc_outb(ahc, CLRSINT1, CLRSCSIPERR);
2698 		ahc_outb(ahc, CLRINT, CLRSCSIINT);
2699 		unpause_sequencer(ahc, /*unpause_always*/TRUE);
2700 	} else {
2701 		xpt_print_path(scb->ccb->ccb_h.path);
2702 		printf("Unknown SCSIINT. Status = 0x%x\n", status);
2703 		ahc_outb(ahc, CLRSINT1, status);
2704 		ahc_outb(ahc, CLRINT, CLRSCSIINT);
2705 		unpause_sequencer(ahc, /*unpause_always*/TRUE);
2706 	}
2707 }
2708 
2709 static void
2710 ahc_build_transfer_msg(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
2711 {
2712 	/*
2713 	 * We need to initiate transfer negotiations.
2714 	 * If our current and goal settings are identical,
2715 	 * we want to renegotiate due to a check condition.
2716 	 */
2717 	struct	ahc_initiator_tinfo *tinfo;
2718 	struct	tmode_tstate *tstate;
2719 	int	dowide;
2720 	int	dosync;
2721 
2722 	tinfo = ahc_fetch_transinfo(ahc, devinfo->channel, devinfo->our_scsiid,
2723 				    devinfo->target, &tstate);
2724 	dowide = tinfo->current.width != tinfo->goal.width;
2725 	dosync = tinfo->current.period != tinfo->goal.period;
2726 
2727 	if (!dowide && !dosync) {
2728 		dowide = tinfo->goal.width != MSG_EXT_WDTR_BUS_8_BIT;
2729 		dosync = tinfo->goal.period != 0;
2730 	}
2731 
2732 	if (dowide)
2733 		ahc_construct_wdtr(ahc, tinfo->goal.width);
2734 	else if (dosync) {
2735 		struct	ahc_syncrate *rate;
2736 		u_int	period;
2737 		u_int	offset;
2738 
2739 		period = tinfo->goal.period;
2740 		rate = ahc_devlimited_syncrate(ahc, &period);
2741 		offset = tinfo->goal.offset;
2742 		ahc_validate_offset(ahc, rate, &offset,
2743 				    tinfo->current.width);
2744 		ahc_construct_sdtr(ahc, period, offset);
2745 	} else {
2746 		panic("ahc_intr: AWAITING_MSG for negotiation, "
2747 		      "but no negotiation needed\n");
2748 	}
2749 }
2750 
2751 static void
2752 ahc_setup_initiator_msgout(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
2753 			   struct scb *scb)
2754 {
2755 	/*
2756 	 * To facilitate adding multiple messages together,
2757 	 * each routine should increment the index and len
2758 	 * variables instead of setting them explicitly.
2759 	 */
2760 	ahc->msgout_index = 0;
2761 	ahc->msgout_len = 0;
2762 
2763 	if ((scb->flags & SCB_DEVICE_RESET) == 0
2764 	 && ahc_inb(ahc, MSG_OUT) == MSG_IDENTIFYFLAG) {
2765 		u_int identify_msg;
2766 
2767 		identify_msg = MSG_IDENTIFYFLAG | SCB_LUN(scb);
2768 		if ((scb->hscb->control & DISCENB) != 0)
2769 			identify_msg |= MSG_IDENTIFY_DISCFLAG;
2770 		ahc->msgout_buf[ahc->msgout_index++] = identify_msg;
2771 		ahc->msgout_len++;
2772 
2773 		if ((scb->hscb->control & TAG_ENB) != 0) {
2774 			ahc->msgout_buf[ahc->msgout_index++] =
2775 			    scb->ccb->csio.tag_action;
2776 			ahc->msgout_buf[ahc->msgout_index++] = scb->hscb->tag;
2777 			ahc->msgout_len += 2;
2778 		}
2779 	}
2780 
2781 	if (scb->flags & SCB_DEVICE_RESET) {
2782 		ahc->msgout_buf[ahc->msgout_index++] = MSG_BUS_DEV_RESET;
2783 		ahc->msgout_len++;
2784 		xpt_print_path(scb->ccb->ccb_h.path);
2785 		printf("Bus Device Reset Message Sent\n");
2786 	} else if (scb->flags & SCB_ABORT) {
2787 		if ((scb->hscb->control & TAG_ENB) != 0)
2788 			ahc->msgout_buf[ahc->msgout_index++] = MSG_ABORT_TAG;
2789 		else
2790 			ahc->msgout_buf[ahc->msgout_index++] = MSG_ABORT;
2791 		ahc->msgout_len++;
2792 		xpt_print_path(scb->ccb->ccb_h.path);
2793 		printf("Abort Message Sent\n");
2794 	} else if ((ahc->targ_msg_req & devinfo->target_mask) != 0) {
2795 		ahc_build_transfer_msg(ahc, devinfo);
2796 	} else {
2797 		printf("ahc_intr: AWAITING_MSG for an SCB that "
2798 		       "does not have a waiting message");
2799 		panic("SCB = %d, SCB Control = %x, MSG_OUT = %x "
2800 		      "SCB flags = %x", scb->hscb->tag, scb->hscb->control,
2801 		      ahc_inb(ahc, MSG_OUT), scb->flags);
2802 	}
2803 
2804 	/*
2805 	 * Clear the MK_MESSAGE flag from the SCB so we aren't
2806 	 * asked to send this message again.
2807 	 */
2808 	ahc_outb(ahc, SCB_CONTROL, ahc_inb(ahc, SCB_CONTROL) & ~MK_MESSAGE);
2809 	ahc->msgout_index = 0;
2810 	ahc->msg_type = MSG_TYPE_INITIATOR_MSGOUT;
2811 }
2812 
2813 static void
2814 ahc_setup_target_msgin(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
2815 {
2816 	/*
2817 	 * To facilitate adding multiple messages together,
2818 	 * each routine should increment the index and len
2819 	 * variables instead of setting them explicitly.
2820 	 */
2821 	ahc->msgout_index = 0;
2822 	ahc->msgout_len = 0;
2823 
2824 	if ((ahc->targ_msg_req & devinfo->target_mask) != 0)
2825 		ahc_build_transfer_msg(ahc, devinfo);
2826 	else
2827 		panic("ahc_intr: AWAITING target message with no message");
2828 
2829 	ahc->msgout_index = 0;
2830 	ahc->msg_type = MSG_TYPE_TARGET_MSGIN;
2831 }
2832 
2833 static int
2834 ahc_handle_msg_reject(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
2835 {
2836 	/*
2837 	 * What we care about here is if we had an
2838 	 * outstanding SDTR or WDTR message for this
2839 	 * target.  If we did, this is a signal that
2840 	 * the target is refusing negotiation.
2841 	 */
2842 	struct scb *scb;
2843 	u_int scb_index;
2844 	u_int last_msg;
2845 	int   response = 0;
2846 
2847 	scb_index = ahc_inb(ahc, SCB_TAG);
2848 	scb = &ahc->scb_data->scbarray[scb_index];
2849 
2850 	/* Might be necessary */
2851 	last_msg = ahc_inb(ahc, LAST_MSG);
2852 
2853 	if (ahc_sent_msg(ahc, MSG_EXT_WDTR, /*full*/FALSE)) {
2854 		struct ahc_initiator_tinfo *tinfo;
2855 		struct tmode_tstate *tstate;
2856 
2857 		/* note 8bit xfers and clear flag */
2858 		printf("%s:%c:%d: refuses WIDE negotiation.  Using "
2859 		       "8bit transfers\n", ahc_name(ahc),
2860 		       devinfo->channel, devinfo->target);
2861 		ahc_set_width(ahc, devinfo, scb->ccb->ccb_h.path,
2862 			      MSG_EXT_WDTR_BUS_8_BIT,
2863 			      AHC_TRANS_ACTIVE|AHC_TRANS_GOAL,
2864 			      /*paused*/TRUE);
2865 		ahc_set_syncrate(ahc, devinfo, scb->ccb->ccb_h.path,
2866 				 /*syncrate*/NULL, /*period*/0,
2867 				 /*offset*/0, AHC_TRANS_ACTIVE,
2868 				 /*paused*/TRUE);
2869 		tinfo = ahc_fetch_transinfo(ahc, devinfo->channel,
2870 					    devinfo->our_scsiid,
2871 					    devinfo->target, &tstate);
2872 		if (tinfo->goal.period) {
2873 			u_int period;
2874 
2875 			/* Start the sync negotiation */
2876 			period = tinfo->goal.period;
2877 			ahc_devlimited_syncrate(ahc, &period);
2878 			ahc->msgout_index = 0;
2879 			ahc->msgout_len = 0;
2880 			ahc_construct_sdtr(ahc, period, tinfo->goal.offset);
2881 			ahc->msgout_index = 0;
2882 			response = 1;
2883 		}
2884 	} else if (ahc_sent_msg(ahc, MSG_EXT_SDTR, /*full*/FALSE)) {
2885 		/* note asynch xfers and clear flag */
2886 		ahc_set_syncrate(ahc, devinfo, scb->ccb->ccb_h.path,
2887 				 /*syncrate*/NULL, /*period*/0,
2888 				 /*offset*/0,
2889 				 AHC_TRANS_ACTIVE|AHC_TRANS_GOAL,
2890 				 /*paused*/TRUE);
2891 		printf("%s:%c:%d: refuses synchronous negotiation. "
2892 		       "Using asynchronous transfers\n",
2893 		       ahc_name(ahc),
2894 		       devinfo->channel, devinfo->target);
2895 	} else if ((scb->hscb->control & MSG_SIMPLE_Q_TAG) != 0) {
2896 		struct	ccb_trans_settings neg;
2897 
2898 		printf("%s:%c:%d: refuses tagged commands.  Performing "
2899 		       "non-tagged I/O\n", ahc_name(ahc),
2900 		       devinfo->channel, devinfo->target);
2901 
2902 		ahc_set_tags(ahc, devinfo, FALSE);
2903 		neg.flags = 0;
2904 		neg.valid = CCB_TRANS_TQ_VALID;
2905 		xpt_setup_ccb(&neg.ccb_h, scb->ccb->ccb_h.path, /*priority*/1);
2906 		xpt_async(AC_TRANSFER_NEG, scb->ccb->ccb_h.path, &neg);
2907 
2908 		/*
2909 		 * Resend the identify for this CCB as the target
2910 		 * may believe that the selection is invalid otherwise.
2911 		 */
2912 		ahc_outb(ahc, SCB_CONTROL, ahc_inb(ahc, SCB_CONTROL)
2913 					  & ~MSG_SIMPLE_Q_TAG);
2914 	 	scb->hscb->control &= ~MSG_SIMPLE_Q_TAG;
2915 		scb->ccb->ccb_h.flags &= ~CAM_TAG_ACTION_VALID;
2916 		ahc_outb(ahc, MSG_OUT, MSG_IDENTIFYFLAG);
2917 		ahc_outb(ahc, SCSISIGO, ahc_inb(ahc, SCSISIGO) | ATNO);
2918 
2919 		/*
2920 		 * Requeue all tagged commands for this target
2921 		 * currently in our posession so they can be
2922 		 * converted to untagged commands.
2923 		 */
2924 		ahc_search_qinfifo(ahc, SCB_TARGET(scb), SCB_CHANNEL(scb),
2925 				   SCB_LUN(scb), /*tag*/SCB_LIST_NULL,
2926 				   CAM_REQUEUE_REQ, SEARCH_COMPLETE);
2927 	} else {
2928 		/*
2929 		 * Otherwise, we ignore it.
2930 		 */
2931 		printf("%s:%c:%d: Message reject for %x -- ignored\n",
2932 		       ahc_name(ahc), devinfo->channel, devinfo->target,
2933 		       last_msg);
2934 	}
2935 	return (response);
2936 }
2937 
2938 static void
2939 ahc_clear_msg_state(struct ahc_softc *ahc)
2940 {
2941 	ahc->msgout_len = 0;
2942 	ahc->msgin_index = 0;
2943 	ahc->msg_type = MSG_TYPE_NONE;
2944 	ahc_outb(ahc, MSG_OUT, MSG_NOOP);
2945 }
2946 
2947 static void
2948 ahc_handle_message_phase(struct ahc_softc *ahc, struct cam_path *path)
2949 {
2950 	struct	ahc_devinfo devinfo;
2951 	u_int	bus_phase;
2952 	int	end_session;
2953 
2954 	ahc_fetch_devinfo(ahc, &devinfo);
2955 	end_session = FALSE;
2956 	bus_phase = ahc_inb(ahc, SCSISIGI) & PHASE_MASK;
2957 
2958 reswitch:
2959 	switch (ahc->msg_type) {
2960 	case MSG_TYPE_INITIATOR_MSGOUT:
2961 	{
2962 		int lastbyte;
2963 		int phasemis;
2964 		int msgdone;
2965 
2966 		if (ahc->msgout_len == 0)
2967 			panic("REQINIT interrupt with no active message");
2968 
2969 		phasemis = bus_phase != P_MESGOUT;
2970 		if (phasemis) {
2971 			if (bus_phase == P_MESGIN) {
2972 				/*
2973 				 * Change gears and see if
2974 				 * this messages is of interest to
2975 				 * us or should be passed back to
2976 				 * the sequencer.
2977 				 */
2978 				ahc_outb(ahc, CLRSINT1, CLRATNO);
2979 				ahc->send_msg_perror = FALSE;
2980 				ahc->msg_type = MSG_TYPE_INITIATOR_MSGIN;
2981 				ahc->msgin_index = 0;
2982 				goto reswitch;
2983 			}
2984 			end_session = TRUE;
2985 			break;
2986 		}
2987 
2988 		if (ahc->send_msg_perror) {
2989 			ahc_outb(ahc, CLRSINT1, CLRATNO);
2990 			ahc_outb(ahc, CLRSINT1, CLRREQINIT);
2991 			ahc_outb(ahc, SCSIDATL, MSG_PARITY_ERROR);
2992 			break;
2993 		}
2994 
2995 		msgdone	= ahc->msgout_index == ahc->msgout_len;
2996 		if (msgdone) {
2997 			/*
2998 			 * The target has requested a retry.
2999 			 * Re-assert ATN, reset our message index to
3000 			 * 0, and try again.
3001 			 */
3002 			ahc->msgout_index = 0;
3003 			ahc_outb(ahc, SCSISIGO, ahc_inb(ahc, SCSISIGO) | ATNO);
3004 		}
3005 
3006 		lastbyte = ahc->msgout_index == (ahc->msgout_len - 1);
3007 		if (lastbyte) {
3008 			/* Last byte is signified by dropping ATN */
3009 			ahc_outb(ahc, CLRSINT1, CLRATNO);
3010 		}
3011 
3012 		/*
3013 		 * Clear our interrupt status and present
3014 		 * the next byte on the bus.
3015 		 */
3016 		ahc_outb(ahc, CLRSINT1, CLRREQINIT);
3017 		ahc_outb(ahc, SCSIDATL, ahc->msgout_buf[ahc->msgout_index++]);
3018 		break;
3019 	}
3020 	case MSG_TYPE_INITIATOR_MSGIN:
3021 	{
3022 		int phasemis;
3023 		int message_done;
3024 
3025 		phasemis = bus_phase != P_MESGIN;
3026 
3027 		if (phasemis) {
3028 			ahc->msgin_index = 0;
3029 			if (bus_phase == P_MESGOUT
3030 			 && (ahc->send_msg_perror == TRUE
3031 			  || (ahc->msgout_len != 0
3032 			   && ahc->msgout_index == 0))) {
3033 				ahc->msg_type = MSG_TYPE_INITIATOR_MSGOUT;
3034 				goto reswitch;
3035 			}
3036 			end_session = TRUE;
3037 			break;
3038 		}
3039 
3040 		/* Pull the byte in without acking it */
3041 		ahc->msgin_buf[ahc->msgin_index] = ahc_inb(ahc, SCSIBUSL);
3042 
3043 		message_done = ahc_parse_msg(ahc, path, &devinfo);
3044 
3045 		if (message_done) {
3046 			/*
3047 			 * Clear our incoming message buffer in case there
3048 			 * is another message following this one.
3049 			 */
3050 			ahc->msgin_index = 0;
3051 
3052 			/*
3053 			 * If this message illicited a response,
3054 			 * assert ATN so the target takes us to the
3055 			 * message out phase.
3056 			 */
3057 			if (ahc->msgout_len != 0)
3058 				ahc_outb(ahc, SCSISIGO,
3059 					 ahc_inb(ahc, SCSISIGO) | ATNO);
3060 		}
3061 
3062 		/* Ack the byte */
3063 		ahc_outb(ahc, CLRSINT1, CLRREQINIT);
3064 		ahc_inb(ahc, SCSIDATL);
3065 		ahc->msgin_index++;
3066 		break;
3067 	}
3068 	case MSG_TYPE_TARGET_MSGIN:
3069 	{
3070 		int msgdone;
3071 		int msgout_request;
3072 
3073 		if (ahc->msgout_len == 0)
3074 			panic("Target MSGIN with no active message");
3075 
3076 		/*
3077 		 * If we interrupted a mesgout session, the initiator
3078 		 * will not know this until our first REQ.  So, we
3079 		 * only honor mesgout requests after we've sent our
3080 		 * first byte.
3081 		 */
3082 		if ((ahc_inb(ahc, SCSISIGI) & ATNI) != 0
3083 		 && ahc->msgout_index > 0)
3084 			msgout_request = TRUE;
3085 		else
3086 			msgout_request = FALSE;
3087 
3088 		if (msgout_request) {
3089 
3090 			/*
3091 			 * Change gears and see if
3092 			 * this messages is of interest to
3093 			 * us or should be passed back to
3094 			 * the sequencer.
3095 			 */
3096 			ahc->msg_type = MSG_TYPE_TARGET_MSGOUT;
3097 			ahc_outb(ahc, SCSISIGO, P_MESGOUT | BSYO);
3098 			ahc->msgin_index = 0;
3099 			/* Dummy read to REQ for first byte */
3100 			ahc_inb(ahc, SCSIDATL);
3101 			ahc_outb(ahc, SXFRCTL0,
3102 				 ahc_inb(ahc, SXFRCTL0) | SPIOEN);
3103 			break;
3104 		}
3105 
3106 		msgdone = ahc->msgout_index == ahc->msgout_len;
3107 		if (msgdone) {
3108 			ahc_outb(ahc, SXFRCTL0,
3109 				 ahc_inb(ahc, SXFRCTL0) & ~SPIOEN);
3110 			end_session = TRUE;
3111 			break;
3112 		}
3113 
3114 		/*
3115 		 * Present the next byte on the bus.
3116 		 */
3117 		ahc_outb(ahc, SXFRCTL0, ahc_inb(ahc, SXFRCTL0) | SPIOEN);
3118 		ahc_outb(ahc, SCSIDATL, ahc->msgout_buf[ahc->msgout_index++]);
3119 		break;
3120 	}
3121 	case MSG_TYPE_TARGET_MSGOUT:
3122 	{
3123 		int lastbyte;
3124 		int msgdone;
3125 
3126 		/*
3127 		 * The initiator signals that this is
3128 		 * the last byte by dropping ATN.
3129 		 */
3130 		lastbyte = (ahc_inb(ahc, SCSISIGI) & ATNI) == 0;
3131 
3132 		/*
3133 		 * Read the latched byte, but turn off SPIOEN first
3134 		 * so that we don't inadvertantly cause a REQ for the
3135 		 * next byte.
3136 		 */
3137 		ahc_outb(ahc, SXFRCTL0, ahc_inb(ahc, SXFRCTL0) & ~SPIOEN);
3138 		ahc->msgin_buf[ahc->msgin_index] = ahc_inb(ahc, SCSIDATL);
3139 		msgdone = ahc_parse_msg(ahc, path, &devinfo);
3140 		ahc->msgin_index++;
3141 
3142 		/*
3143 		 * XXX Read spec about initiator dropping ATN too soon
3144 		 *     and use msgdone to detect it.
3145 		 */
3146 		if (msgdone) {
3147 			ahc->msgin_index = 0;
3148 
3149 			/*
3150 			 * If this message illicited a response, transition
3151 			 * to the Message in phase and send it.
3152 			 */
3153 			if (ahc->msgout_len != 0) {
3154 				ahc_outb(ahc, SCSISIGO, P_MESGIN | BSYO);
3155 				ahc_outb(ahc, SXFRCTL0,
3156 					 ahc_inb(ahc, SXFRCTL0) | SPIOEN);
3157 				ahc->msg_type = MSG_TYPE_TARGET_MSGIN;
3158 				ahc->msgin_index = 0;
3159 				break;
3160 			}
3161 		}
3162 
3163 		if (lastbyte)
3164 			end_session = TRUE;
3165 		else {
3166 			/* Ask for the next byte. */
3167 			ahc_outb(ahc, SXFRCTL0,
3168 				 ahc_inb(ahc, SXFRCTL0) | SPIOEN);
3169 		}
3170 
3171 		break;
3172 	}
3173 	default:
3174 		panic("Unknown REQINIT message type");
3175 	}
3176 
3177 	if (end_session) {
3178 		ahc_clear_msg_state(ahc);
3179 		ahc_outb(ahc, RETURN_1, EXIT_MSG_LOOP);
3180 	} else
3181 		ahc_outb(ahc, RETURN_1, CONT_MSG_LOOP);
3182 }
3183 
3184 /*
3185  * See if we sent a particular extended message to the target.
3186  * If "full" is true, the target saw the full message.
3187  * If "full" is false, the target saw at least the first
3188  * byte of the message.
3189  */
3190 static int
3191 ahc_sent_msg(struct ahc_softc *ahc, u_int msgtype, int full)
3192 {
3193 	int found;
3194 	int index;
3195 
3196 	found = FALSE;
3197 	index = 0;
3198 
3199 	while (index < ahc->msgout_len) {
3200 		if ((ahc->msgout_buf[index] & MSG_IDENTIFYFLAG) != 0
3201 		 || ahc->msgout_buf[index] == MSG_MESSAGE_REJECT)
3202 			index++;
3203 		else if (ahc->msgout_buf[index] >= MSG_SIMPLE_Q_TAG
3204 		      && ahc->msgout_buf[index] < MSG_IGN_WIDE_RESIDUE) {
3205 			/* Skip tag type and tag id */
3206 			index += 2;
3207 		} else if (ahc->msgout_buf[index] == MSG_EXTENDED) {
3208 			/* Found a candidate */
3209 			if (ahc->msgout_buf[index+2] == msgtype) {
3210 				u_int end_index;
3211 
3212 				end_index = index + 1
3213 					  + ahc->msgout_buf[index + 1];
3214 				if (full) {
3215 					if (ahc->msgout_index > end_index)
3216 						found = TRUE;
3217 				} else if (ahc->msgout_index > index)
3218 					found = TRUE;
3219 			}
3220 			break;
3221 		} else {
3222 			panic("ahc_sent_msg: Inconsistent msg buffer");
3223 		}
3224 	}
3225 	return (found);
3226 }
3227 
3228 static int
3229 ahc_parse_msg(struct ahc_softc *ahc, struct cam_path *path,
3230 	      struct ahc_devinfo *devinfo)
3231 {
3232 	struct	ahc_initiator_tinfo *tinfo;
3233 	struct	tmode_tstate *tstate;
3234 	int	reject;
3235 	int	done;
3236 	int	response;
3237 	u_int	targ_scsirate;
3238 
3239 	done = FALSE;
3240 	response = FALSE;
3241 	reject = FALSE;
3242 	tinfo = ahc_fetch_transinfo(ahc, devinfo->channel, devinfo->our_scsiid,
3243 				    devinfo->target, &tstate);
3244 	targ_scsirate = tinfo->scsirate;
3245 
3246 	/*
3247 	 * Parse as much of the message as is availible,
3248 	 * rejecting it if we don't support it.  When
3249 	 * the entire message is availible and has been
3250 	 * handled, return TRUE indicating that we have
3251 	 * parsed an entire message.
3252 	 *
3253 	 * In the case of extended messages, we accept the length
3254 	 * byte outright and perform more checking once we know the
3255 	 * extended message type.
3256 	 */
3257 	switch (ahc->msgin_buf[0]) {
3258 	case MSG_MESSAGE_REJECT:
3259 		response = ahc_handle_msg_reject(ahc, devinfo);
3260 		/* FALLTHROUGH */
3261 	case MSG_NOOP:
3262 		done = TRUE;
3263 		break;
3264 	case MSG_IGN_WIDE_RESIDUE:
3265 	{
3266 		/* Wait for the whole message */
3267 		if (ahc->msgin_index >= 1) {
3268 			if (ahc->msgin_buf[1] != 1
3269 			 || tinfo->current.width == MSG_EXT_WDTR_BUS_8_BIT) {
3270 				reject = TRUE;
3271 				done = TRUE;
3272 			} else
3273 				ahc_handle_ign_wide_residue(ahc, devinfo);
3274 		}
3275 		break;
3276 	}
3277 	case MSG_EXTENDED:
3278 	{
3279 		/* Wait for enough of the message to begin validation */
3280 		if (ahc->msgin_index < 2)
3281 			break;
3282 		switch (ahc->msgin_buf[2]) {
3283 		case MSG_EXT_SDTR:
3284 		{
3285 			struct	 ahc_syncrate *syncrate;
3286 			u_int	 period;
3287 			u_int	 offset;
3288 			u_int	 saved_offset;
3289 
3290 			if (ahc->msgin_buf[1] != MSG_EXT_SDTR_LEN) {
3291 				reject = TRUE;
3292 				break;
3293 			}
3294 
3295 			/*
3296 			 * Wait until we have both args before validating
3297 			 * and acting on this message.
3298 			 *
3299 			 * Add one to MSG_EXT_SDTR_LEN to account for
3300 			 * the extended message preamble.
3301 			 */
3302 			if (ahc->msgin_index < (MSG_EXT_SDTR_LEN + 1))
3303 				break;
3304 
3305 			period = ahc->msgin_buf[3];
3306 			saved_offset = offset = ahc->msgin_buf[4];
3307 			syncrate = ahc_devlimited_syncrate(ahc, &period);
3308 			ahc_validate_offset(ahc, syncrate, &offset,
3309 					    targ_scsirate & WIDEXFER);
3310 			ahc_set_syncrate(ahc, devinfo, path,
3311 					 syncrate, period, offset,
3312 					 AHC_TRANS_ACTIVE|AHC_TRANS_GOAL,
3313 					 /*paused*/TRUE);
3314 
3315 			/*
3316 			 * See if we initiated Sync Negotiation
3317 			 * and didn't have to fall down to async
3318 			 * transfers.
3319 			 */
3320 			if (ahc_sent_msg(ahc, MSG_EXT_SDTR, /*full*/TRUE)) {
3321 				/* We started it */
3322 				if (saved_offset != offset) {
3323 					/* Went too low - force async */
3324 					reject = TRUE;
3325 				}
3326 			} else {
3327 				/*
3328 				 * Send our own SDTR in reply
3329 				 */
3330 				if (bootverbose)
3331 					printf("Sending SDTR!\n");
3332 				ahc->msgout_index = 0;
3333 				ahc->msgout_len = 0;
3334 				ahc_construct_sdtr(ahc, period, offset);
3335 				ahc->msgout_index = 0;
3336 				response = TRUE;
3337 			}
3338 			done = TRUE;
3339 			break;
3340 		}
3341 		case MSG_EXT_WDTR:
3342 		{
3343 			u_int	bus_width;
3344 			u_int	sending_reply;
3345 
3346 			sending_reply = FALSE;
3347 			if (ahc->msgin_buf[1] != MSG_EXT_WDTR_LEN) {
3348 				reject = TRUE;
3349 				break;
3350 			}
3351 
3352 			/*
3353 			 * Wait until we have our arg before validating
3354 			 * and acting on this message.
3355 			 *
3356 			 * Add one to MSG_EXT_WDTR_LEN to account for
3357 			 * the extended message preamble.
3358 			 */
3359 			if (ahc->msgin_index < (MSG_EXT_WDTR_LEN + 1))
3360 				break;
3361 
3362 			/*
3363 			 * Due to a problem with sync/wide transfers
3364 			 * on the aic7880 only allow this on Ultra2
3365 			 * controllers for the moment.
3366 			 */
3367 			if (devinfo->role == ROLE_TARGET
3368 			 && (ahc->features & AHC_ULTRA2) == 0) {
3369 				reject = TRUE;
3370 				break;
3371 			}
3372 
3373 			bus_width = ahc->msgin_buf[3];
3374 			if (ahc_sent_msg(ahc, MSG_EXT_WDTR, /*full*/TRUE)) {
3375 				/*
3376 				 * Don't send a WDTR back to the
3377 				 * target, since we asked first.
3378 				 */
3379 				switch (bus_width){
3380 				default:
3381 					/*
3382 					 * How can we do anything greater
3383 					 * than 16bit transfers on a 16bit
3384 					 * bus?
3385 					 */
3386 					reject = TRUE;
3387 					printf("%s: target %d requested %dBit "
3388 					       "transfers.  Rejecting...\n",
3389 					       ahc_name(ahc), devinfo->target,
3390 					       8 * (0x01 << bus_width));
3391 					/* FALLTHROUGH */
3392 				case MSG_EXT_WDTR_BUS_8_BIT:
3393 					bus_width = MSG_EXT_WDTR_BUS_8_BIT;
3394 					break;
3395 				case MSG_EXT_WDTR_BUS_16_BIT:
3396 					break;
3397 				}
3398 			} else {
3399 				/*
3400 				 * Send our own WDTR in reply
3401 				 */
3402 				if (bootverbose)
3403 					printf("Sending WDTR!\n");
3404 				switch (bus_width) {
3405 				default:
3406 					if (ahc->features & AHC_WIDE) {
3407 						/* Respond Wide */
3408 						bus_width =
3409 						    MSG_EXT_WDTR_BUS_16_BIT;
3410 						break;
3411 					}
3412 					/* FALLTHROUGH */
3413 				case MSG_EXT_WDTR_BUS_8_BIT:
3414 					bus_width = MSG_EXT_WDTR_BUS_8_BIT;
3415 					break;
3416 				}
3417 				ahc->msgout_index = 0;
3418 				ahc->msgout_len = 0;
3419 				ahc_construct_wdtr(ahc, bus_width);
3420 				ahc->msgout_index = 0;
3421 				response = TRUE;
3422 				sending_reply = TRUE;
3423 			}
3424 			ahc_set_width(ahc, devinfo, path, bus_width,
3425 				      AHC_TRANS_ACTIVE|AHC_TRANS_GOAL,
3426 				      /*paused*/TRUE);
3427 
3428 			/* After a wide message, we are async */
3429 			ahc_set_syncrate(ahc, devinfo, path,
3430 					 /*syncrate*/NULL, /*period*/0,
3431 					 /*offset*/0, AHC_TRANS_ACTIVE,
3432 					 /*paused*/TRUE);
3433 			if (sending_reply == FALSE && reject == FALSE) {
3434 
3435 				if (tinfo->goal.period) {
3436 					struct	ahc_syncrate *rate;
3437 					u_int	period;
3438 					u_int	offset;
3439 
3440 					/* Start the sync negotiation */
3441 					period = tinfo->goal.period;
3442 					rate = ahc_devlimited_syncrate(ahc,
3443 								       &period);
3444 					offset = tinfo->goal.offset;
3445 					ahc_validate_offset(ahc, rate, &offset,
3446 							  tinfo->current.width);
3447 					ahc->msgout_index = 0;
3448 					ahc->msgout_len = 0;
3449 					ahc_construct_sdtr(ahc, period, offset);
3450 					ahc->msgout_index = 0;
3451 					response = TRUE;
3452 				}
3453 			}
3454 			done = TRUE;
3455 			break;
3456 		}
3457 		default:
3458 			/* Unknown extended message.  Reject it. */
3459 			reject = TRUE;
3460 			break;
3461 		}
3462 		break;
3463 	}
3464 	case MSG_ABORT:
3465 	case MSG_ABORT_TAG:
3466 	case MSG_BUS_DEV_RESET:
3467 	case MSG_CLEAR_QUEUE:
3468 	case MSG_TERM_IO_PROC:
3469 		/* Target mode messages */
3470 		if (devinfo->role != ROLE_TARGET)
3471 			reject = TRUE;
3472 		break;
3473 	default:
3474 		reject = TRUE;
3475 		break;
3476 	}
3477 
3478 	if (reject) {
3479 		/*
3480 		 * Assert attention and setup to
3481 		 * reject the message.
3482 		 */
3483 		ahc->msgout_index = 0;
3484 		ahc->msgout_len = 1;
3485 		ahc->msgout_buf[0] = MSG_MESSAGE_REJECT;
3486 		done = TRUE;
3487 		response = TRUE;
3488 	}
3489 
3490 	if (done && !response)
3491 		/* Clear the outgoing message buffer */
3492 		ahc->msgout_len = 0;
3493 
3494 	return (done);
3495 }
3496 
3497 static void
3498 ahc_handle_ign_wide_residue(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
3499 {
3500 	u_int scb_index;
3501 	struct scb *scb;
3502 
3503 	scb_index = ahc_inb(ahc, SCB_TAG);
3504 	scb = &ahc->scb_data->scbarray[scb_index];
3505 	if ((ahc_inb(ahc, SEQ_FLAGS) & DPHASE) == 0
3506 	 || (scb->ccb->ccb_h.flags & CAM_DIR_MASK) != CAM_DIR_IN) {
3507 		/*
3508 		 * Ignore the message if we haven't
3509 		 * seen an appropriate data phase yet.
3510 		 */
3511 	} else {
3512 		/*
3513 		 * If the residual occurred on the last
3514 		 * transfer and the transfer request was
3515 		 * expected to end on an odd count, do
3516 		 * nothing.  Otherwise, subtract a byte
3517 		 * and update the residual count accordingly.
3518 		 */
3519 		u_int resid_sgcnt;
3520 
3521 		resid_sgcnt = ahc_inb(ahc, SCB_RESID_SGCNT);
3522 		if (resid_sgcnt == 0
3523 		 && ahc_inb(ahc, DATA_COUNT_ODD) == 1) {
3524 			/*
3525 			 * If the residual occurred on the last
3526 			 * transfer and the transfer request was
3527 			 * expected to end on an odd count, do
3528 			 * nothing.
3529 			 */
3530 		} else {
3531 			u_int data_cnt;
3532 			u_int data_addr;
3533 			u_int sg_index;
3534 
3535 			data_cnt = (ahc_inb(ahc, SCB_RESID_DCNT + 2) << 16)
3536 				 | (ahc_inb(ahc, SCB_RESID_DCNT + 1) << 8)
3537 				 | (ahc_inb(ahc, SCB_RESID_DCNT));
3538 
3539 			data_addr = (ahc_inb(ahc, SHADDR + 3) << 24)
3540 				  | (ahc_inb(ahc, SHADDR + 2) << 16)
3541 				  | (ahc_inb(ahc, SHADDR + 1) << 8)
3542 				  | (ahc_inb(ahc, SHADDR));
3543 
3544 			data_cnt += 1;
3545 			data_addr -= 1;
3546 
3547 			sg_index = scb->sg_count - resid_sgcnt;
3548 
3549 			/*
3550 			 * scb->sg_list starts with the second S/G entry.
3551 			 */
3552 			if (sg_index-- != 0
3553 			 && (scb->sg_list[sg_index].len < data_cnt)) {
3554 				u_int sg_addr;
3555 
3556 				data_cnt = 1;
3557 				data_addr = scb->sg_list[sg_index - 1].addr
3558 					  + scb->sg_list[sg_index - 1].len - 1;
3559 
3560 				sg_addr = scb->sg_list_phys
3561 					+ (sg_index * sizeof(*scb->sg_list));
3562 				ahc_outb(ahc, SG_NEXT + 3, sg_addr >> 24);
3563 				ahc_outb(ahc, SG_NEXT + 2, sg_addr >> 16);
3564 				ahc_outb(ahc, SG_NEXT + 1, sg_addr >> 8);
3565 				ahc_outb(ahc, SG_NEXT, sg_addr);
3566 			}
3567 
3568 			ahc_outb(ahc, SCB_RESID_DCNT + 2, data_cnt >> 16);
3569 			ahc_outb(ahc, SCB_RESID_DCNT + 1, data_cnt >> 8);
3570 			ahc_outb(ahc, SCB_RESID_DCNT, data_cnt);
3571 
3572 			ahc_outb(ahc, SHADDR + 3, data_addr >> 24);
3573 			ahc_outb(ahc, SHADDR + 2, data_addr >> 16);
3574 			ahc_outb(ahc, SHADDR + 1, data_addr >> 8);
3575 			ahc_outb(ahc, SHADDR, data_addr);
3576 		}
3577 	}
3578 }
3579 
3580 static void
3581 ahc_handle_devreset(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
3582 		    cam_status status, ac_code acode, char *message,
3583 		    int verbose_only)
3584 {
3585 	struct cam_path *path;
3586 	int found;
3587 	int error;
3588 
3589 	error = ahc_create_path(ahc, devinfo, &path);
3590 
3591 	/*
3592 	 * Go back to async/narrow transfers and renegotiate.
3593 	 * ahc_set_width and ahc_set_syncrate can cope with NULL
3594 	 * paths.
3595 	 */
3596 	ahc_set_width(ahc, devinfo, path, MSG_EXT_WDTR_BUS_8_BIT,
3597 		      AHC_TRANS_CUR, /*paused*/TRUE);
3598 	ahc_set_syncrate(ahc, devinfo, path, /*syncrate*/NULL,
3599 			 /*period*/0, /*offset*/0, AHC_TRANS_CUR,
3600 			 /*paused*/TRUE);
3601 	found = ahc_abort_scbs(ahc, devinfo->target, devinfo->channel,
3602 			       CAM_LUN_WILDCARD, SCB_LIST_NULL, status);
3603 
3604 	if (error == CAM_REQ_CMP && acode != 0)
3605 		xpt_async(AC_SENT_BDR, path, NULL);
3606 
3607 	if (error == CAM_REQ_CMP)
3608 		xpt_free_path(path);
3609 
3610 	if (message != NULL
3611 	 && (verbose_only == 0 || bootverbose != 0))
3612 		printf("%s: %s on %c:%d. %d SCBs aborted\n", ahc_name(ahc),
3613 		       message, devinfo->channel, devinfo->target, found);
3614 }
3615 
3616 /*
3617  * We have an scb which has been processed by the
3618  * adaptor, now we look to see how the operation
3619  * went.
3620  */
3621 static void
3622 ahc_done(struct ahc_softc *ahc, struct scb *scb)
3623 {
3624 	union ccb *ccb;
3625 
3626 	CAM_DEBUG(scb->ccb->ccb_h.path, CAM_DEBUG_TRACE,
3627 		  ("ahc_done - scb %d\n", scb->hscb->tag));
3628 
3629 	ccb = scb->ccb;
3630 	LIST_REMOVE(&ccb->ccb_h, sim_links.le);
3631 
3632 	untimeout(ahc_timeout, (caddr_t)scb, ccb->ccb_h.timeout_ch);
3633 
3634 	if ((ccb->ccb_h.flags & CAM_DIR_MASK) != CAM_DIR_NONE) {
3635 		bus_dmasync_op_t op;
3636 
3637 		if ((ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN)
3638 			op = BUS_DMASYNC_POSTREAD;
3639 		else
3640 			op = BUS_DMASYNC_POSTWRITE;
3641 		bus_dmamap_sync(ahc->buffer_dmat, scb->dmamap, op);
3642 		bus_dmamap_unload(ahc->buffer_dmat, scb->dmamap);
3643 	}
3644 
3645 	/*
3646 	 * Unbusy this target/channel/lun.
3647 	 * XXX if we are holding two commands per lun,
3648 	 *     send the next command.
3649 	 */
3650 	ahc_index_busy_tcl(ahc, scb->hscb->tcl, /*unbusy*/TRUE);
3651 
3652 	if (ccb->ccb_h.func_code == XPT_CONT_TARGET_IO) {
3653 		ccb->ccb_h.status = CAM_REQ_CMP;
3654 		ahcfreescb(ahc, scb);
3655 		xpt_done(ccb);
3656 		return;
3657 	}
3658 
3659 	/*
3660 	 * If the recovery SCB completes, we have to be
3661 	 * out of our timeout.
3662 	 */
3663 	if ((scb->flags & SCB_RECOVERY_SCB) != 0) {
3664 
3665 		struct	ccb_hdr *ccbh;
3666 
3667 		/*
3668 		 * We were able to complete the command successfully,
3669 		 * so reinstate the timeouts for all other pending
3670 		 * commands.
3671 		 */
3672 		ccbh = ahc->pending_ccbs.lh_first;
3673 		while (ccbh != NULL) {
3674 			struct scb *pending_scb;
3675 
3676 			pending_scb = (struct scb *)ccbh->ccb_scb_ptr;
3677 			ccbh->timeout_ch =
3678 			    timeout(ahc_timeout, pending_scb,
3679 				    (ccbh->timeout * hz)/1000);
3680 			ccbh = LIST_NEXT(ccbh, sim_links.le);
3681 		}
3682 
3683 		/*
3684 		 * Ensure that we didn't put a second instance of this
3685 		 * SCB into the QINFIFO.
3686 		 */
3687 		ahc_search_qinfifo(ahc, SCB_TARGET(scb), SCB_CHANNEL(scb),
3688 				   SCB_LUN(scb), scb->hscb->tag, /*status*/0,
3689 				   SEARCH_REMOVE);
3690 		if (ahc_ccb_status(ccb) == CAM_BDR_SENT)
3691 			ahcsetccbstatus(ccb, CAM_CMD_TIMEOUT);
3692 		xpt_print_path(ccb->ccb_h.path);
3693 		printf("no longer in timeout, status = %x\n",
3694 		       ccb->ccb_h.status);
3695 	}
3696 
3697 	/* Don't clobber any existing error state */
3698 	if (ahc_ccb_status(ccb) == CAM_REQ_INPROG) {
3699 		ccb->ccb_h.status |= CAM_REQ_CMP;
3700 	} else if ((scb->flags & SCB_SENSE) != 0) {
3701 		/*
3702 		 * We performed autosense retrieval.
3703 		 *
3704 		 * bzero the sense data before having
3705 		 * the drive fill it.  The SCSI spec mandates
3706 		 * that any untransfered data should be
3707 		 * assumed to be zero.  Complete the 'bounce'
3708 		 * of sense information through buffers accessible
3709 		 * via bus-space by copying it into the clients
3710 		 * csio.
3711 		 */
3712 		bzero(&ccb->csio.sense_data, sizeof(ccb->csio.sense_data));
3713 		bcopy(&ahc->scb_data->sense[scb->hscb->tag],
3714 		      &ccb->csio.sense_data, scb->sg_list->len);
3715 		scb->ccb->ccb_h.status |= CAM_AUTOSNS_VALID;
3716 	}
3717 	ccb->ccb_h.status &= ~CAM_SIM_QUEUED;
3718 	ahcfreescb(ahc, scb);
3719 	xpt_done(ccb);
3720 }
3721 
3722 /*
3723  * Determine the number of SCBs available on the controller
3724  */
3725 int
3726 ahc_probe_scbs(struct ahc_softc *ahc) {
3727 	int i;
3728 
3729 	for (i = 0; i < AHC_SCB_MAX; i++) {
3730 		ahc_outb(ahc, SCBPTR, i);
3731 		ahc_outb(ahc, SCB_CONTROL, i);
3732 		if (ahc_inb(ahc, SCB_CONTROL) != i)
3733 			break;
3734 		ahc_outb(ahc, SCBPTR, 0);
3735 		if (ahc_inb(ahc, SCB_CONTROL) != 0)
3736 			break;
3737 	}
3738 
3739 	return (i);
3740 }
3741 
3742 /*
3743  * Start the board, ready for normal operation
3744  */
3745 int
3746 ahc_init(struct ahc_softc *ahc)
3747 {
3748 	int	  max_targ = 15;
3749 	int	  i;
3750 	int	  term;
3751 	u_int	  scsi_conf;
3752 	u_int	  scsiseq_template;
3753 	u_int	  ultraenb;
3754 	u_int	  discenable;
3755 	u_int	  tagenable;
3756 	size_t	  driver_data_size;
3757 	u_int32_t physaddr;
3758 
3759 #ifdef AHC_PRINT_SRAM
3760 	printf("Scratch Ram:");
3761 	for (i = 0x20; i < 0x5f; i++) {
3762 		if (((i % 8) == 0) && (i != 0)) {
3763 			printf ("\n              ");
3764 		}
3765 		printf (" 0x%x", ahc_inb(ahc, i));
3766 	}
3767 	if ((ahc->features & AHC_MORE_SRAM) != 0) {
3768 		for (i = 0x70; i < 0x7f; i++) {
3769 			if (((i % 8) == 0) && (i != 0)) {
3770 				printf ("\n              ");
3771 			}
3772 			printf (" 0x%x", ahc_inb(ahc, i));
3773 		}
3774 	}
3775 	printf ("\n");
3776 #endif
3777 
3778 	/*
3779 	 * Assume we have a board at this stage and it has been reset.
3780 	 */
3781 	if ((ahc->flags & AHC_USEDEFAULTS) != 0) {
3782 		ahc->our_id = ahc->our_id_b = 7;
3783 	}
3784 
3785 	/*
3786 	 * Default to allowing initiator operations.
3787 	 */
3788 	ahc->flags |= AHC_INITIATORMODE;
3789 
3790 	/*
3791 	 * XXX Would be better to use a per device flag, but PCI and EISA
3792 	 *     devices don't have them yet.
3793 	 */
3794 	if ((AHC_TMODE_ENABLE & (0x01 << ahc->unit)) != 0) {
3795 		ahc->flags |= AHC_TARGETMODE;
3796 		/*
3797 		 * Although we have space for both the initiator and
3798 		 * target roles on ULTRA2 chips, we currently disable
3799 		 * the initiator role to allow multi-scsi-id target mode
3800 		 * configurations.  We can only respond on the same SCSI
3801 		 * ID as our initiator role if we allow initiator operation.
3802 		 * At some point, we should add a configuration knob to
3803 		 * allow both roles to be loaded.
3804 		 */
3805 		ahc->flags &= ~AHC_INITIATORMODE;
3806 	}
3807 
3808 	/* DMA tag for mapping buffers into device visible space. */
3809 	if (bus_dma_tag_create(ahc->parent_dmat, /*alignment*/0, /*boundary*/0,
3810 			       /*lowaddr*/BUS_SPACE_MAXADDR,
3811 			       /*highaddr*/BUS_SPACE_MAXADDR,
3812 			       /*filter*/NULL, /*filterarg*/NULL,
3813 			       /*maxsize*/MAXBSIZE, /*nsegments*/AHC_NSEG,
3814 			       /*maxsegsz*/AHC_MAXTRANSFER_SIZE,
3815 			       /*flags*/BUS_DMA_ALLOCNOW,
3816 			       &ahc->buffer_dmat) != 0) {
3817 		return (ENOMEM);
3818 	}
3819 
3820 	ahc->init_level++;
3821 
3822 	/*
3823 	 * DMA tag for our command fifos and other data in system memory
3824 	 * the card's sequencer must be able to access.  For initiator
3825 	 * roles, we need to allocate space for the qinfifo, qoutfifo,
3826 	 * and untagged_scb arrays each of which are composed of 256
3827 	 * 1 byte elements.  When providing for the target mode role,
3828 	 * we additionally must provide space for the incoming target
3829 	 * command fifo.
3830 	 */
3831 	driver_data_size = 3 * 256 * sizeof(u_int8_t);
3832 	if ((ahc->flags & AHC_TARGETMODE) != 0)
3833 		driver_data_size += AHC_TMODE_CMDS * sizeof(struct target_cmd);
3834 	if (bus_dma_tag_create(ahc->parent_dmat, /*alignment*/0, /*boundary*/0,
3835 			       /*lowaddr*/BUS_SPACE_MAXADDR,
3836 			       /*highaddr*/BUS_SPACE_MAXADDR,
3837 			       /*filter*/NULL, /*filterarg*/NULL,
3838 			       driver_data_size,
3839 			       /*nsegments*/1,
3840 			       /*maxsegsz*/BUS_SPACE_MAXSIZE_32BIT,
3841 			       /*flags*/0, &ahc->shared_data_dmat) != 0) {
3842 		return (ENOMEM);
3843 	}
3844 
3845 	ahc->init_level++;
3846 
3847 	/* Allocation of driver data */
3848 	if (bus_dmamem_alloc(ahc->shared_data_dmat, (void **)&ahc->qoutfifo,
3849 			     BUS_DMA_NOWAIT, &ahc->shared_data_dmamap) != 0) {
3850 		return (ENOMEM);
3851 	}
3852 
3853 	ahc->init_level++;
3854 
3855         /* And permanently map it in */
3856 	bus_dmamap_load(ahc->shared_data_dmat, ahc->shared_data_dmamap,
3857 			ahc->qoutfifo, driver_data_size,
3858 			ahcdmamapcb, &ahc->shared_data_busaddr, /*flags*/0);
3859 
3860 	ahc->init_level++;
3861 
3862 	/* Allocate SCB data now that buffer_dmat is initialized) */
3863 	if (ahc->scb_data->maxhscbs == 0)
3864 		if (ahcinitscbdata(ahc) != 0)
3865 			return (ENOMEM);
3866 
3867 	ahc->qinfifo = &ahc->qoutfifo[256];
3868 	ahc->untagged_scbs = &ahc->qinfifo[256];
3869 	/* There are no untagged SCBs active yet. */
3870 	for (i = 0; i < 256; i++)
3871 		ahc->untagged_scbs[i] = SCB_LIST_NULL;
3872 
3873 	/* All of our queues are empty */
3874 	for (i = 0; i < 256; i++)
3875 		ahc->qoutfifo[i] = SCB_LIST_NULL;
3876 
3877 	if ((ahc->flags & AHC_TARGETMODE) != 0) {
3878 		ahc->targetcmds = (struct target_cmd *)&ahc->untagged_scbs[256];
3879 
3880 		/* All target command blocks start out invalid. */
3881 		for (i = 0; i < AHC_TMODE_CMDS; i++)
3882 			ahc->targetcmds[i].cmd_valid = 0;
3883 		ahc_outb(ahc, KERNEL_TQINPOS, ahc->tqinfifonext - 1);
3884 		ahc_outb(ahc, TQINPOS, 0);
3885 	}
3886 
3887 	/*
3888 	 * Allocate a tstate to house information for our
3889 	 * initiator presence on the bus as well as the user
3890 	 * data for any target mode initiator.
3891 	 */
3892 	if (ahc_alloc_tstate(ahc, ahc->our_id, 'A') == NULL) {
3893 		printf("%s: unable to allocate tmode_tstate.  "
3894 		       "Failing attach\n", ahc_name(ahc));
3895 		return (-1);
3896 	}
3897 
3898 	if ((ahc->features & AHC_TWIN) != 0) {
3899 		if (ahc_alloc_tstate(ahc, ahc->our_id_b, 'B') == NULL) {
3900 			printf("%s: unable to allocate tmode_tstate.  "
3901 			       "Failing attach\n", ahc_name(ahc));
3902 			return (-1);
3903 		}
3904  		printf("Twin Channel, A SCSI Id=%d, B SCSI Id=%d, primary %c, ",
3905 		       ahc->our_id, ahc->our_id_b,
3906 		       ahc->flags & AHC_CHANNEL_B_PRIMARY? 'B': 'A');
3907 	} else {
3908 		if ((ahc->features & AHC_WIDE) != 0) {
3909 			printf("Wide ");
3910 		} else {
3911 			printf("Single ");
3912 		}
3913 		printf("Channel %c, SCSI Id=%d, ", ahc->channel, ahc->our_id);
3914 	}
3915 
3916 	ahc_outb(ahc, SEQ_FLAGS, 0);
3917 
3918 	if (ahc->scb_data->maxhscbs < AHC_SCB_MAX) {
3919 		ahc->flags |= AHC_PAGESCBS;
3920 		printf("%d/%d SCBs\n", ahc->scb_data->maxhscbs, AHC_SCB_MAX);
3921 	} else {
3922 		ahc->flags &= ~AHC_PAGESCBS;
3923 		printf("%d SCBs\n", ahc->scb_data->maxhscbs);
3924 	}
3925 
3926 #ifdef AHC_DEBUG
3927 	if (ahc_debug & AHC_SHOWMISC) {
3928 		printf("%s: hardware scb %d bytes; kernel scb %d bytes; "
3929 		       "ahc_dma %d bytes\n",
3930 			ahc_name(ahc),
3931 		        sizeof(struct hardware_scb),
3932 			sizeof(struct scb),
3933 			sizeof(struct ahc_dma_seg));
3934 	}
3935 #endif /* AHC_DEBUG */
3936 
3937 	/* Set the SCSI Id, SXFRCTL0, SXFRCTL1, and SIMODE1, for both channels*/
3938 	if (ahc->features & AHC_TWIN) {
3939 
3940 		/*
3941 		 * The device is gated to channel B after a chip reset,
3942 		 * so set those values first
3943 		 */
3944 		term = (ahc->flags & AHC_TERM_ENB_B) != 0 ? STPWEN : 0;
3945 		if ((ahc->features & AHC_ULTRA2) != 0)
3946 			ahc_outb(ahc, SCSIID_ULTRA2, ahc->our_id_b);
3947 		else
3948 			ahc_outb(ahc, SCSIID, ahc->our_id_b);
3949 		scsi_conf = ahc_inb(ahc, SCSICONF + 1);
3950 		ahc_outb(ahc, SXFRCTL1, (scsi_conf & (ENSPCHK|STIMESEL))
3951 					|term|ENSTIMER|ACTNEGEN);
3952 		ahc_outb(ahc, SIMODE1, ENSELTIMO|ENSCSIRST|ENSCSIPERR);
3953 		ahc_outb(ahc, SXFRCTL0, DFON|SPIOEN);
3954 
3955 		if ((scsi_conf & RESET_SCSI) != 0
3956 		 && (ahc->flags & AHC_INITIATORMODE) != 0)
3957 			ahc->flags |= AHC_RESET_BUS_B;
3958 
3959 		/* Select Channel A */
3960 		ahc_outb(ahc, SBLKCTL, ahc_inb(ahc, SBLKCTL) & ~SELBUSB);
3961 	}
3962 	term = (ahc->flags & AHC_TERM_ENB_A) != 0 ? STPWEN : 0;
3963 	if ((ahc->features & AHC_ULTRA2) != 0)
3964 		ahc_outb(ahc, SCSIID_ULTRA2, ahc->our_id);
3965 	else
3966 		ahc_outb(ahc, SCSIID, ahc->our_id);
3967 	scsi_conf = ahc_inb(ahc, SCSICONF);
3968 	ahc_outb(ahc, SXFRCTL1, (scsi_conf & (ENSPCHK|STIMESEL))
3969 				|term
3970 				|ENSTIMER|ACTNEGEN);
3971 	ahc_outb(ahc, SIMODE1, ENSELTIMO|ENSCSIRST|ENSCSIPERR);
3972 	ahc_outb(ahc, SXFRCTL0, DFON|SPIOEN);
3973 
3974 	if ((scsi_conf & RESET_SCSI) != 0
3975 	 && (ahc->flags & AHC_INITIATORMODE) != 0)
3976 		ahc->flags |= AHC_RESET_BUS_A;
3977 
3978 	/*
3979 	 * Look at the information that board initialization or
3980 	 * the board bios has left us.  In the lower four bits of each
3981 	 * target's scratch space any value other than 0 indicates
3982 	 * that we should initiate synchronous transfers.  If it's zero,
3983 	 * the user or the BIOS has decided to disable synchronous
3984 	 * negotiation to that target so we don't activate the needsdtr
3985 	 * flag.
3986 	 */
3987 	ultraenb = 0;
3988 	tagenable = ALL_TARGETS_MASK;
3989 
3990 	/* Grab the disconnection disable table and invert it for our needs */
3991 	if (ahc->flags & AHC_USEDEFAULTS) {
3992 		printf("%s: Host Adapter Bios disabled.  Using default SCSI "
3993 			"device parameters\n", ahc_name(ahc));
3994 		ahc->flags |= AHC_EXTENDED_TRANS_A|AHC_EXTENDED_TRANS_B|
3995 			      AHC_TERM_ENB_A|AHC_TERM_ENB_B;
3996 		discenable = ALL_TARGETS_MASK;
3997 		if ((ahc->features & AHC_ULTRA) != 0)
3998 			ultraenb = ALL_TARGETS_MASK;
3999 	} else {
4000 		discenable = ~((ahc_inb(ahc, DISC_DSB + 1) << 8)
4001 			   | ahc_inb(ahc, DISC_DSB));
4002 		if ((ahc->features & (AHC_ULTRA|AHC_ULTRA2)) != 0)
4003 			ultraenb = (ahc_inb(ahc, ULTRA_ENB + 1) << 8)
4004 				      | ahc_inb(ahc, ULTRA_ENB);
4005 	}
4006 
4007 	if ((ahc->features & (AHC_WIDE|AHC_TWIN)) == 0)
4008 		max_targ = 7;
4009 
4010 	for (i = 0; i <= max_targ; i++) {
4011 		struct ahc_initiator_tinfo *tinfo;
4012 		struct tmode_tstate *tstate;
4013 		u_int our_id;
4014 		u_int target_id;
4015 		char channel;
4016 
4017 		channel = 'A';
4018 		our_id = ahc->our_id;
4019 		target_id = i;
4020 		if (i > 7 && (ahc->features & AHC_TWIN) != 0) {
4021 			channel = 'B';
4022 			our_id = ahc->our_id_b;
4023 			target_id = i % 8;
4024 		}
4025 		tinfo = ahc_fetch_transinfo(ahc, channel, our_id,
4026 					    target_id, &tstate);
4027 		/* Default to async narrow across the board */
4028 		bzero(tinfo, sizeof(*tinfo));
4029 		if (ahc->flags & AHC_USEDEFAULTS) {
4030 			if ((ahc->features & AHC_WIDE) != 0)
4031 				tinfo->user.width = MSG_EXT_WDTR_BUS_16_BIT;
4032 
4033 			/*
4034 			 * These will be truncated when we determine the
4035 			 * connection type we have with the target.
4036 			 */
4037 			tinfo->user.period = ahc_syncrates->period;
4038 			tinfo->user.offset = ~0;
4039 		} else {
4040 			u_int scsirate;
4041 			u_int16_t mask;
4042 
4043 			/* Take the settings leftover in scratch RAM. */
4044 			scsirate = ahc_inb(ahc, TARG_SCSIRATE + i);
4045 			mask = (0x01 << i);
4046 			if ((ahc->features & AHC_ULTRA2) != 0) {
4047 				u_int offset;
4048 
4049 				if ((scsirate & SOFS) == 0x0F) {
4050 					/*
4051 					 * Haven't negotiated yet,
4052 					 * so the format is different.
4053 					 */
4054 					scsirate = (scsirate & SXFR) >> 4
4055 						 | (ultraenb & mask)
4056 						  ? 0x18 : 0x10
4057 						 | (scsirate & WIDEXFER);
4058 					offset = MAX_OFFSET_ULTRA2;
4059 				} else
4060 					offset = ahc_inb(ahc, TARG_OFFSET + i);
4061 				tinfo->user.period =
4062 				    ahc_find_period(ahc, scsirate,
4063 						    AHC_SYNCRATE_ULTRA2);
4064 				if (offset == 0)
4065 					tinfo->user.period = 0;
4066 				else
4067 					tinfo->user.offset = ~0;
4068 			} else if ((scsirate & SOFS) != 0) {
4069 				tinfo->user.period =
4070 				    ahc_find_period(ahc, scsirate,
4071 						    (ultraenb & mask)
4072 						   ? AHC_SYNCRATE_ULTRA
4073 						   : AHC_SYNCRATE_FAST);
4074 				if (tinfo->user.period != 0)
4075 					tinfo->user.offset = ~0;
4076 			}
4077 			if ((scsirate & WIDEXFER) != 0
4078 			 && (ahc->features & AHC_WIDE) != 0)
4079 				tinfo->user.width = MSG_EXT_WDTR_BUS_16_BIT;
4080 		}
4081 		tstate->ultraenb = ultraenb;
4082 		tstate->discenable = discenable;
4083 		tstate->tagenable = tagenable;
4084 	}
4085 
4086 	/*
4087 	 * Tell the sequencer where it can find the our arrays in memory.
4088 	 */
4089 	physaddr = ahc->scb_data->hscb_busaddr;
4090 	ahc_outb(ahc, HSCB_ADDR, physaddr & 0xFF);
4091 	ahc_outb(ahc, HSCB_ADDR + 1, (physaddr >> 8) & 0xFF);
4092 	ahc_outb(ahc, HSCB_ADDR + 2, (physaddr >> 16) & 0xFF);
4093 	ahc_outb(ahc, HSCB_ADDR + 3, (physaddr >> 24) & 0xFF);
4094 
4095 	physaddr = ahc->shared_data_busaddr;
4096 	ahc_outb(ahc, SCBID_ADDR, physaddr & 0xFF);
4097 	ahc_outb(ahc, SCBID_ADDR + 1, (physaddr >> 8) & 0xFF);
4098 	ahc_outb(ahc, SCBID_ADDR + 2, (physaddr >> 16) & 0xFF);
4099 	ahc_outb(ahc, SCBID_ADDR + 3, (physaddr >> 24) & 0xFF);
4100 
4101 	/* Target mode incomding command fifo */
4102 	physaddr += 3 * 256 * sizeof(u_int8_t);
4103 	ahc_outb(ahc, TMODE_CMDADDR, physaddr & 0xFF);
4104 	ahc_outb(ahc, TMODE_CMDADDR + 1, (physaddr >> 8) & 0xFF);
4105 	ahc_outb(ahc, TMODE_CMDADDR + 2, (physaddr >> 16) & 0xFF);
4106 	ahc_outb(ahc, TMODE_CMDADDR + 3, (physaddr >> 24) & 0xFF);
4107 
4108 	/*
4109 	 * Initialize the group code to command length table.
4110 	 * This overrides the values in TARG_SCSIRATE, so only
4111 	 * setup the table after we have processed that information.
4112 	 */
4113 	ahc_outb(ahc, CMDSIZE_TABLE, 5);
4114 	ahc_outb(ahc, CMDSIZE_TABLE + 1, 9);
4115 	ahc_outb(ahc, CMDSIZE_TABLE + 2, 9);
4116 	ahc_outb(ahc, CMDSIZE_TABLE + 3, 0);
4117 	ahc_outb(ahc, CMDSIZE_TABLE + 4, 15);
4118 	ahc_outb(ahc, CMDSIZE_TABLE + 5, 11);
4119 	ahc_outb(ahc, CMDSIZE_TABLE + 6, 0);
4120 	ahc_outb(ahc, CMDSIZE_TABLE + 7, 0);
4121 
4122 	/* Tell the sequencer of our initial queue positions */
4123 	ahc_outb(ahc, KERNEL_QINPOS, 0);
4124 	ahc_outb(ahc, QINPOS, 0);
4125 	ahc_outb(ahc, QOUTPOS, 0);
4126 
4127 #ifdef AHC_DEBUG
4128 	if (ahc_debug & AHC_SHOWMISC)
4129 		printf("NEEDSDTR == 0x%x\nNEEDWDTR == 0x%x\n"
4130 		       "DISCENABLE == 0x%x\nULTRAENB == 0x%x\n",
4131 		       ahc->needsdtr_orig, ahc->needwdtr_orig,
4132 		       discenable, ultraenb);
4133 #endif
4134 
4135 	/* Don't have any special messages to send to targets */
4136 	ahc_outb(ahc, TARGET_MSG_REQUEST, 0);
4137 	ahc_outb(ahc, TARGET_MSG_REQUEST + 1, 0);
4138 
4139 	/*
4140 	 * Use the built in queue management registers
4141 	 * if they are available.
4142 	 */
4143 	if ((ahc->features & AHC_QUEUE_REGS) != 0) {
4144 		ahc_outb(ahc, QOFF_CTLSTA, SCB_QSIZE_256);
4145 		ahc_outb(ahc, SDSCB_QOFF, 0);
4146 		ahc_outb(ahc, SNSCB_QOFF, 0);
4147 		ahc_outb(ahc, HNSCB_QOFF, 0);
4148 	}
4149 
4150 
4151 	/* We don't have any waiting selections */
4152 	ahc_outb(ahc, WAITING_SCBH, SCB_LIST_NULL);
4153 
4154 	/* Our disconnection list is empty too */
4155 	ahc_outb(ahc, DISCONNECTED_SCBH, SCB_LIST_NULL);
4156 
4157 	/* Message out buffer starts empty */
4158 	ahc_outb(ahc, MSG_OUT, MSG_NOOP);
4159 
4160 	/*
4161 	 * Setup the allowed SCSI Sequences based on operational mode.
4162 	 * If we are a target, we'll enalbe select in operations once
4163 	 * we've had a lun enabled.
4164 	 */
4165 	scsiseq_template = ENSELO|ENAUTOATNO|ENAUTOATNP;
4166 	if ((ahc->flags & AHC_INITIATORMODE) != 0)
4167 		scsiseq_template |= ENRSELI;
4168 	ahc_outb(ahc, SCSISEQ_TEMPLATE, scsiseq_template);
4169 
4170 	/*
4171 	 * Load the Sequencer program and Enable the adapter
4172 	 * in "fast" mode.
4173          */
4174 	if (bootverbose)
4175 		printf("%s: Downloading Sequencer Program...",
4176 		       ahc_name(ahc));
4177 
4178 	ahc_loadseq(ahc);
4179 
4180 	/* We have to wait until after any system dumps... */
4181 	at_shutdown(ahc_shutdown, ahc, SHUTDOWN_FINAL);
4182 
4183 	return (0);
4184 }
4185 
4186 static cam_status
4187 ahc_find_tmode_devs(struct ahc_softc *ahc, struct cam_sim *sim, union ccb *ccb,
4188 		    struct tmode_tstate **tstate, struct tmode_lstate **lstate,
4189 		    int notfound_failure)
4190 {
4191 	int our_id;
4192 
4193 	/*
4194 	 * If we are not configured for target mode, someone
4195 	 * is really confused to be sending this to us.
4196 	 */
4197 	if ((ahc->flags & AHC_TARGETMODE) == 0)
4198 		return (CAM_REQ_INVALID);
4199 
4200 	/* Range check target and lun */
4201 
4202 	/*
4203 	 * Handle the 'black hole' device that sucks up
4204 	 * requests to unattached luns on enabled targets.
4205 	 */
4206 	if (ccb->ccb_h.target_id == CAM_TARGET_WILDCARD
4207 	 && ccb->ccb_h.target_lun == CAM_LUN_WILDCARD) {
4208 		*tstate = NULL;
4209 		*lstate = ahc->black_hole;
4210 	} else {
4211 		u_int max_id;
4212 
4213 		if (cam_sim_bus(sim) == 0)
4214 			our_id = ahc->our_id;
4215 		else
4216 			our_id = ahc->our_id_b;
4217 
4218 		max_id = (ahc->features & AHC_WIDE) ? 15 : 7;
4219 		if (ccb->ccb_h.target_id > max_id)
4220 			return (CAM_TID_INVALID);
4221 
4222 		if (ccb->ccb_h.target_lun > 7)
4223 			return (CAM_LUN_INVALID);
4224 
4225 		if (ccb->ccb_h.target_id != our_id) {
4226 			if ((ahc->features & AHC_MULTI_TID) != 0) {
4227 				/*
4228 				 * Only allow additional targets if
4229 				 * the initiator role is disabled.
4230 				 * The hardware cannot handle a re-select-in
4231 				 * on the initiator id during a re-select-out
4232 				 * on a different target id.
4233 				 */
4234 			   	if ((ahc->flags & AHC_INITIATORMODE) != 0)
4235 					return (CAM_TID_INVALID);
4236 			} else {
4237 				/*
4238 				 * Only allow our target id to change
4239 				 * if the initiator role is not configured
4240 				 * and there are no enabled luns which
4241 				 * are attached to the currently registered
4242 				 * scsi id.
4243 				 */
4244 			   	if ((ahc->flags & AHC_INITIATORMODE) != 0
4245 				 || ahc->enabled_luns > 0)
4246 					return (CAM_TID_INVALID);
4247 			}
4248 		}
4249 
4250 		*tstate = ahc->enabled_targets[ccb->ccb_h.target_id];
4251 		*lstate = NULL;
4252 		if (*tstate != NULL)
4253 			*lstate =
4254 			    (*tstate)->enabled_luns[ccb->ccb_h.target_lun];
4255 	}
4256 
4257 	if (notfound_failure != 0 && *lstate == NULL)
4258 		return (CAM_PATH_INVALID);
4259 
4260 	return (CAM_REQ_CMP);
4261 }
4262 
4263 static void
4264 ahc_action(struct cam_sim *sim, union ccb *ccb)
4265 {
4266 	struct	ahc_softc *ahc;
4267 	struct	tmode_lstate *lstate;
4268 	u_int	target_id;
4269 	u_int	our_id;
4270 	int	s;
4271 
4272 	CAM_DEBUG(ccb->ccb_h.path, CAM_DEBUG_TRACE, ("ahc_action\n"));
4273 
4274 	ahc = (struct ahc_softc *)cam_sim_softc(sim);
4275 
4276 	target_id = ccb->ccb_h.target_id;
4277 	our_id = SIM_SCSI_ID(ahc, sim);
4278 
4279 	switch (ccb->ccb_h.func_code) {
4280 	/* Common cases first */
4281 	case XPT_ACCEPT_TARGET_IO:	/* Accept Host Target Mode CDB */
4282 	case XPT_CONT_TARGET_IO:/* Continue Host Target I/O Connection*/
4283 	{
4284 		struct	   tmode_tstate *tstate;
4285 		cam_status status;
4286 
4287 		status = ahc_find_tmode_devs(ahc, sim, ccb, &tstate,
4288 					     &lstate, TRUE);
4289 
4290 		if (status != CAM_REQ_CMP) {
4291 			if (ccb->ccb_h.func_code == XPT_CONT_TARGET_IO) {
4292 				/* Response from the black hole device */
4293 				tstate = NULL;
4294 				lstate = ahc->black_hole;
4295 			} else {
4296 				ccb->ccb_h.status = status;
4297 				xpt_done(ccb);
4298 				break;
4299 			}
4300 		}
4301 		if (ccb->ccb_h.func_code == XPT_ACCEPT_TARGET_IO) {
4302 			int s;
4303 
4304 			s = splcam();
4305 			SLIST_INSERT_HEAD(&lstate->accept_tios, &ccb->ccb_h,
4306 					  sim_links.sle);
4307 			ccb->ccb_h.status = CAM_REQ_INPROG;
4308 			if ((ahc->flags & AHC_TQINFIFO_BLOCKED) != 0)
4309 				ahc_run_tqinfifo(ahc);
4310 			splx(s);
4311 			break;
4312 		}
4313 
4314 		/*
4315 		 * The target_id represents the target we attempt to
4316 		 * select.  In target mode, this is the initiator of
4317 		 * the original command.
4318 		 */
4319 		our_id = target_id;
4320 		target_id = ccb->csio.init_id;
4321 		/* FALLTHROUGH */
4322 	}
4323 	case XPT_SCSI_IO:	/* Execute the requested I/O operation */
4324 	case XPT_RESET_DEV:	/* Bus Device Reset the specified SCSI device */
4325 	{
4326 		struct	   scb *scb;
4327 		struct	   hardware_scb *hscb;
4328 		struct	   ahc_initiator_tinfo *tinfo;
4329 		struct	   tmode_tstate *tstate;
4330 		u_int16_t  mask;
4331 
4332 		/*
4333 		 * get an scb to use.
4334 		 */
4335 		if ((scb = ahcgetscb(ahc)) == NULL) {
4336 			int s;
4337 
4338 			s = splcam();
4339 			ahc->flags |= AHC_RESOURCE_SHORTAGE;
4340 			splx(s);
4341 			xpt_freeze_simq(ahc->sim, /*count*/1);
4342 			ahcsetccbstatus(ccb, CAM_REQUEUE_REQ);
4343 			xpt_done(ccb);
4344 			return;
4345 		}
4346 
4347 		hscb = scb->hscb;
4348 
4349 		CAM_DEBUG(ccb->ccb_h.path, CAM_DEBUG_SUBTRACE,
4350 			  ("start scb(%p)\n", scb));
4351 		scb->ccb = ccb;
4352 		/*
4353 		 * So we can find the SCB when an abort is requested
4354 		 */
4355 		ccb->ccb_h.ccb_scb_ptr = scb;
4356 		ccb->ccb_h.ccb_ahc_ptr = ahc;
4357 
4358 		/*
4359 		 * Put all the arguments for the xfer in the scb
4360 		 */
4361 		hscb->tcl = ((target_id << 4) & 0xF0)
4362 			| (SIM_IS_SCSIBUS_B(ahc, sim) ? SELBUSB : 0)
4363 			| (ccb->ccb_h.target_lun & 0x07);
4364 
4365 		mask = SCB_TARGET_MASK(scb);
4366 		tinfo = ahc_fetch_transinfo(ahc, SIM_CHANNEL(ahc, sim), our_id,
4367 					    target_id, &tstate);
4368 
4369 		hscb->scsirate = tinfo->scsirate;
4370 		hscb->scsioffset = tinfo->current.offset;
4371 		if ((tstate->ultraenb & mask) != 0)
4372 			hscb->control |= ULTRAENB;
4373 
4374 		if ((tstate->discenable & mask) != 0
4375 		 && (ccb->ccb_h.flags & CAM_DIS_DISCONNECT) == 0)
4376 			hscb->control |= DISCENB;
4377 
4378 		if (ccb->ccb_h.func_code == XPT_RESET_DEV) {
4379 			hscb->cmdpointer = NULL;
4380 			scb->flags |= SCB_DEVICE_RESET;
4381 			hscb->control |= MK_MESSAGE;
4382 			ahc_execute_scb(scb, NULL, 0, 0);
4383 		} else {
4384 			if (ccb->ccb_h.func_code == XPT_CONT_TARGET_IO) {
4385 				if (ahc->pending_device == lstate) {
4386 					scb->flags |= SCB_TARGET_IMMEDIATE;
4387 					ahc->pending_device = NULL;
4388 				}
4389 				hscb->control |= TARGET_SCB;
4390 				hscb->cmdpointer = IDENTIFY_SEEN;
4391 				if ((ccb->ccb_h.flags & CAM_SEND_STATUS) != 0) {
4392 					hscb->cmdpointer |= SPHASE_PENDING;
4393 					hscb->status = ccb->csio.scsi_status;
4394 				}
4395 
4396 				/* Overloaded with tag ID */
4397 				hscb->cmdlen = ccb->csio.tag_id;
4398 				/*
4399 				 * Overloaded with the value to place
4400 				 * in SCSIID for reselection.
4401 				 */
4402 				hscb->cmdpointer |=
4403 					(our_id|(hscb->tcl & 0xF0)) << 16;
4404 			}
4405 			if (ccb->ccb_h.flags & CAM_TAG_ACTION_VALID)
4406 				hscb->control |= ccb->csio.tag_action;
4407 
4408 			ahc_setup_data(ahc, &ccb->csio, scb);
4409 		}
4410 		break;
4411 	}
4412 	case XPT_NOTIFY_ACK:
4413 	case XPT_IMMED_NOTIFY:
4414 	{
4415 		struct	   tmode_tstate *tstate;
4416 		struct	   tmode_lstate *lstate;
4417 		cam_status status;
4418 
4419 		status = ahc_find_tmode_devs(ahc, sim, ccb, &tstate,
4420 					     &lstate, TRUE);
4421 
4422 		if (status != CAM_REQ_CMP) {
4423 			ccb->ccb_h.status = status;
4424 			xpt_done(ccb);
4425 			break;
4426 		}
4427 		if (ccb->ccb_h.func_code == XPT_NOTIFY_ACK) {
4428 			/* Clear notification state */
4429 		}
4430 		SLIST_INSERT_HEAD(&lstate->immed_notifies, &ccb->ccb_h,
4431 				  sim_links.sle);
4432 		ccb->ccb_h.status = CAM_REQ_INPROG;
4433 		break;
4434 	}
4435 	case XPT_EN_LUN:		/* Enable LUN as a target */
4436 		ahc_handle_en_lun(ahc, sim, ccb);
4437 		xpt_done(ccb);
4438 		break;
4439 	case XPT_ABORT:			/* Abort the specified CCB */
4440 	{
4441 		ahc_abort_ccb(ahc, sim, ccb);
4442 		break;
4443 	}
4444 	case XPT_SET_TRAN_SETTINGS:
4445 	{
4446 		struct	ahc_devinfo devinfo;
4447 		struct	ccb_trans_settings *cts;
4448 		struct	ahc_initiator_tinfo *tinfo;
4449 		struct	tmode_tstate *tstate;
4450 		u_int	update_type;
4451 		int	s;
4452 
4453 		cts = &ccb->cts;
4454 		ahc_compile_devinfo(&devinfo, SIM_SCSI_ID(ahc, sim),
4455 				    cts->ccb_h.target_id,
4456 				    cts->ccb_h.target_lun,
4457 				    SIM_CHANNEL(ahc, sim),
4458 				    ROLE_UNKNOWN);
4459 		tinfo = ahc_fetch_transinfo(ahc, devinfo.channel,
4460 					    devinfo.our_scsiid,
4461 					    devinfo.target, &tstate);
4462 		update_type = 0;
4463 		if ((cts->flags & CCB_TRANS_CURRENT_SETTINGS) != 0)
4464 			update_type |= AHC_TRANS_GOAL;
4465 		if ((cts->flags & CCB_TRANS_USER_SETTINGS) != 0)
4466 			update_type |= AHC_TRANS_USER;
4467 
4468 		s = splcam();
4469 
4470 		if ((cts->valid & CCB_TRANS_DISC_VALID) != 0) {
4471 			if ((cts->flags & CCB_TRANS_DISC_ENB) != 0)
4472 				tstate->discenable |= devinfo.target_mask;
4473 			else
4474 				tstate->discenable &= ~devinfo.target_mask;
4475 		}
4476 
4477 		if ((cts->valid & CCB_TRANS_TQ_VALID) != 0) {
4478 			if ((cts->flags & CCB_TRANS_TAG_ENB) != 0)
4479 				tstate->tagenable |= devinfo.target_mask;
4480 			else
4481 				tstate->tagenable &= ~devinfo.target_mask;
4482 		}
4483 
4484 		if ((cts->valid & CCB_TRANS_BUS_WIDTH_VALID) != 0) {
4485 			switch (cts->bus_width) {
4486 			case MSG_EXT_WDTR_BUS_16_BIT:
4487 				if ((ahc->features & AHC_WIDE) != 0)
4488 					break;
4489 				/* FALLTHROUGH to 8bit */
4490 			case MSG_EXT_WDTR_BUS_32_BIT:
4491 			case MSG_EXT_WDTR_BUS_8_BIT:
4492 			default:
4493 				cts->bus_width = MSG_EXT_WDTR_BUS_8_BIT;
4494 				break;
4495 			}
4496 			ahc_set_width(ahc, &devinfo, cts->ccb_h.path,
4497 				      cts->bus_width, update_type,
4498 				      /*paused*/FALSE);
4499 		}
4500 
4501 		if (((cts->valid & CCB_TRANS_SYNC_RATE_VALID) != 0)
4502 		 || ((cts->valid & CCB_TRANS_SYNC_OFFSET_VALID) != 0)) {
4503 			struct ahc_syncrate *syncrate;
4504 			u_int maxsync;
4505 
4506 			if ((ahc->features & AHC_ULTRA2) != 0)
4507 				maxsync = AHC_SYNCRATE_ULTRA2;
4508 			else if ((ahc->features & AHC_ULTRA) != 0)
4509 				maxsync = AHC_SYNCRATE_ULTRA;
4510 			else
4511 				maxsync = AHC_SYNCRATE_FAST;
4512 
4513 			if ((cts->valid & CCB_TRANS_SYNC_OFFSET_VALID) == 0) {
4514 				if (update_type & AHC_TRANS_USER)
4515 					cts->sync_offset = tinfo->user.offset;
4516 				else
4517 					cts->sync_offset = tinfo->goal.offset;
4518 			}
4519 
4520 			if ((cts->valid & CCB_TRANS_SYNC_RATE_VALID) == 0) {
4521 				if (update_type & AHC_TRANS_USER)
4522 					cts->sync_period = tinfo->user.period;
4523 				else
4524 					cts->sync_period = tinfo->goal.period;
4525 			}
4526 
4527 			syncrate = ahc_find_syncrate(ahc, &cts->sync_period,
4528 						     maxsync);
4529 			ahc_validate_offset(ahc, syncrate, &cts->sync_offset,
4530 					    MSG_EXT_WDTR_BUS_8_BIT);
4531 
4532 			/* We use a period of 0 to represent async */
4533 			if (cts->sync_offset == 0)
4534 				cts->sync_period = 0;
4535 
4536 			ahc_set_syncrate(ahc, &devinfo, cts->ccb_h.path,
4537 					 syncrate, cts->sync_period,
4538 					 cts->sync_offset, update_type,
4539 					 /*paused*/FALSE);
4540 		}
4541 		splx(s);
4542 		ccb->ccb_h.status = CAM_REQ_CMP;
4543 		xpt_done(ccb);
4544 		break;
4545 	}
4546 	case XPT_GET_TRAN_SETTINGS:
4547 	/* Get default/user set transfer settings for the target */
4548 	{
4549 		struct	ahc_devinfo devinfo;
4550 		struct	ccb_trans_settings *cts;
4551 		struct	ahc_initiator_tinfo *targ_info;
4552 		struct	tmode_tstate *tstate;
4553 		struct	ahc_transinfo *tinfo;
4554 		int	s;
4555 
4556 		cts = &ccb->cts;
4557 		ahc_compile_devinfo(&devinfo, SIM_SCSI_ID(ahc, sim),
4558 				    cts->ccb_h.target_id,
4559 				    cts->ccb_h.target_lun,
4560 				    SIM_CHANNEL(ahc, sim),
4561 				    ROLE_UNKNOWN);
4562 		targ_info = ahc_fetch_transinfo(ahc, devinfo.channel,
4563 						devinfo.our_scsiid,
4564 						devinfo.target, &tstate);
4565 
4566 		if ((cts->flags & CCB_TRANS_CURRENT_SETTINGS) != 0)
4567 			tinfo = &targ_info->current;
4568 		else
4569 			tinfo = &targ_info->user;
4570 
4571 		s = splcam();
4572 
4573 		cts->flags &= ~(CCB_TRANS_DISC_ENB|CCB_TRANS_TAG_ENB);
4574 		if ((tstate->discenable & devinfo.target_mask) != 0)
4575 			cts->flags |= CCB_TRANS_DISC_ENB;
4576 
4577 		if ((tstate->tagenable & devinfo.target_mask) != 0)
4578 			cts->flags |= CCB_TRANS_TAG_ENB;
4579 
4580 		cts->sync_period = tinfo->period;
4581 		cts->sync_offset = tinfo->offset;
4582 		cts->bus_width = tinfo->width;
4583 
4584 		splx(s);
4585 
4586 		cts->valid = CCB_TRANS_SYNC_RATE_VALID
4587 			   | CCB_TRANS_SYNC_OFFSET_VALID
4588 			   | CCB_TRANS_BUS_WIDTH_VALID
4589 			   | CCB_TRANS_DISC_VALID
4590 			   | CCB_TRANS_TQ_VALID;
4591 
4592 		ccb->ccb_h.status = CAM_REQ_CMP;
4593 		xpt_done(ccb);
4594 		break;
4595 	}
4596 	case XPT_CALC_GEOMETRY:
4597 	{
4598 		struct	  ccb_calc_geometry *ccg;
4599 		u_int32_t size_mb;
4600 		u_int32_t secs_per_cylinder;
4601 		int	  extended;
4602 
4603 		ccg = &ccb->ccg;
4604 		size_mb = ccg->volume_size
4605 			/ ((1024L * 1024L) / ccg->block_size);
4606 		extended = SIM_IS_SCSIBUS_B(ahc, sim)
4607 			? ahc->flags & AHC_EXTENDED_TRANS_B
4608 			: ahc->flags & AHC_EXTENDED_TRANS_A;
4609 
4610 		if (size_mb > 1024 && extended) {
4611 			ccg->heads = 255;
4612 			ccg->secs_per_track = 63;
4613 		} else {
4614 			ccg->heads = 64;
4615 			ccg->secs_per_track = 32;
4616 		}
4617 		secs_per_cylinder = ccg->heads * ccg->secs_per_track;
4618 		ccg->cylinders = ccg->volume_size / secs_per_cylinder;
4619 		ccb->ccb_h.status = CAM_REQ_CMP;
4620 		xpt_done(ccb);
4621 		break;
4622 	}
4623 	case XPT_RESET_BUS:		/* Reset the specified SCSI bus */
4624 	{
4625 		int  found;
4626 
4627 		s = splcam();
4628 		found = ahc_reset_channel(ahc, SIM_CHANNEL(ahc, sim),
4629 					  /*initiate reset*/TRUE);
4630 		splx(s);
4631 		if (bootverbose) {
4632 			xpt_print_path(SIM_PATH(ahc, sim));
4633 			printf("SCSI bus reset delivered. "
4634 			       "%d SCBs aborted.\n", found);
4635 		}
4636 		ccb->ccb_h.status = CAM_REQ_CMP;
4637 		xpt_done(ccb);
4638 		break;
4639 	}
4640 	case XPT_TERM_IO:		/* Terminate the I/O process */
4641 		/* XXX Implement */
4642 		ccb->ccb_h.status = CAM_REQ_INVALID;
4643 		xpt_done(ccb);
4644 		break;
4645 	case XPT_PATH_INQ:		/* Path routing inquiry */
4646 	{
4647 		struct ccb_pathinq *cpi = &ccb->cpi;
4648 
4649 		cpi->version_num = 1; /* XXX??? */
4650 		cpi->hba_inquiry = PI_SDTR_ABLE|PI_TAG_ABLE;
4651 		if ((ahc->features & AHC_WIDE) != 0)
4652 			cpi->hba_inquiry |= PI_WIDE_16;
4653 		if ((ahc->flags & AHC_TARGETMODE) != 0) {
4654 			cpi->target_sprt = PIT_PROCESSOR
4655 					 | PIT_DISCONNECT
4656 					 | PIT_TERM_IO;
4657 		} else {
4658 			cpi->target_sprt = 0;
4659 		}
4660 		cpi->hba_misc = (ahc->flags & AHC_INITIATORMODE)
4661 			      ? 0 : PIM_NOINITIATOR;
4662 		cpi->hba_eng_cnt = 0;
4663 		cpi->max_target = (ahc->features & AHC_WIDE) ? 15 : 7;
4664 		cpi->max_lun = 7;
4665 		if (SIM_IS_SCSIBUS_B(ahc, sim)) {
4666 			cpi->initiator_id = ahc->our_id_b;
4667 			if ((ahc->flags & AHC_RESET_BUS_B) == 0)
4668 				cpi->hba_misc |= PIM_NOBUSRESET;
4669 		} else {
4670 			cpi->initiator_id = ahc->our_id;
4671 			if ((ahc->flags & AHC_RESET_BUS_A) == 0)
4672 				cpi->hba_misc |= PIM_NOBUSRESET;
4673 		}
4674 		cpi->bus_id = cam_sim_bus(sim);
4675 		cpi->base_transfer_speed = 3300;
4676 		strncpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
4677 		strncpy(cpi->hba_vid, "Adaptec", HBA_IDLEN);
4678 		strncpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
4679 		cpi->unit_number = cam_sim_unit(sim);
4680 		cpi->ccb_h.status = CAM_REQ_CMP;
4681 		xpt_done(ccb);
4682 		break;
4683 	}
4684 	default:
4685 		ccb->ccb_h.status = CAM_REQ_INVALID;
4686 		xpt_done(ccb);
4687 		break;
4688 	}
4689 }
4690 
4691 static void
4692 ahc_async(void *callback_arg, u_int32_t code, struct cam_path *path, void *arg)
4693 {
4694 	struct ahc_softc *ahc;
4695 	struct cam_sim *sim;
4696 
4697 	sim = (struct cam_sim *)callback_arg;
4698 	ahc = (struct ahc_softc *)cam_sim_softc(sim);
4699 	switch (code) {
4700 	case AC_LOST_DEVICE:
4701 	{
4702 		struct	ahc_devinfo devinfo;
4703 		int	s;
4704 
4705 		ahc_compile_devinfo(&devinfo, SIM_SCSI_ID(ahc, sim),
4706 				    xpt_path_target_id(path),
4707 				    xpt_path_lun_id(path),
4708 				    SIM_CHANNEL(ahc, sim),
4709 				    ROLE_UNKNOWN);
4710 
4711 		/*
4712 		 * Revert to async/narrow transfers
4713 		 * for the next device.
4714 		 */
4715 		s = splcam();
4716 		ahc_set_width(ahc, &devinfo, path, MSG_EXT_WDTR_BUS_8_BIT,
4717 			      AHC_TRANS_GOAL|AHC_TRANS_CUR,
4718 			      /*paused*/FALSE);
4719 		ahc_set_syncrate(ahc, &devinfo, path, /*syncrate*/NULL,
4720 				 /*period*/0, /*offset*/0,
4721 				 AHC_TRANS_GOAL|AHC_TRANS_CUR,
4722 				 /*paused*/FALSE);
4723 		splx(s);
4724 		break;
4725 	}
4726 	default:
4727 		break;
4728 	}
4729 }
4730 
4731 static void
4732 ahc_execute_scb(void *arg, bus_dma_segment_t *dm_segs, int nsegments,
4733 		int error)
4734 {
4735 	struct	 scb *scb;
4736 	union	 ccb *ccb;
4737 	struct	 ahc_softc *ahc;
4738 	int	 s;
4739 
4740 	scb = (struct scb *)arg;
4741 	ccb = scb->ccb;
4742 	ahc = (struct ahc_softc *)ccb->ccb_h.ccb_ahc_ptr;
4743 
4744 	if (nsegments != 0) {
4745 		struct	  ahc_dma_seg *sg;
4746 		bus_dma_segment_t *end_seg;
4747 		bus_dmasync_op_t op;
4748 
4749 		end_seg = dm_segs + nsegments;
4750 
4751 		/* Copy the first SG into the data pointer area */
4752 		scb->hscb->SG_pointer = scb->sg_list_phys;
4753 		scb->hscb->data = dm_segs->ds_addr;
4754 		scb->hscb->datalen = dm_segs->ds_len;
4755 		dm_segs++;
4756 
4757 		/* Copy the remaining segments into our SG list */
4758 		sg = scb->sg_list;
4759 		while (dm_segs < end_seg) {
4760 			sg->addr = dm_segs->ds_addr;
4761 			sg->len = dm_segs->ds_len;
4762 			sg++;
4763 			dm_segs++;
4764 		}
4765 
4766 		if ((ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN)
4767 			op = BUS_DMASYNC_PREREAD;
4768 		else
4769 			op = BUS_DMASYNC_PREWRITE;
4770 
4771 		bus_dmamap_sync(ahc->buffer_dmat, scb->dmamap, op);
4772 
4773 		if (ccb->ccb_h.func_code == XPT_CONT_TARGET_IO) {
4774 			scb->hscb->cmdpointer |= DPHASE_PENDING;
4775 			if ((ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN)
4776 				scb->hscb->cmdpointer |= (TARGET_DATA_IN << 8);
4777 		}
4778 	} else {
4779 		scb->hscb->SG_pointer = 0;
4780 		scb->hscb->data = 0;
4781 		scb->hscb->datalen = 0;
4782 	}
4783 
4784 	scb->sg_count = scb->hscb->SG_count = nsegments;
4785 
4786 	s = splcam();
4787 
4788 	/*
4789 	 * Last time we need to check if this SCB needs to
4790 	 * be aborted.
4791 	 */
4792 	if (ahc_ccb_status(ccb) != CAM_REQ_INPROG) {
4793 		if (nsegments != 0)
4794 			bus_dmamap_unload(ahc->buffer_dmat, scb->dmamap);
4795 		ahcfreescb(ahc, scb);
4796 		xpt_done(ccb);
4797 		splx(s);
4798 		return;
4799 	}
4800 
4801 	/* Busy this tcl if we are untagged */
4802 	if ((scb->hscb->control & TAG_ENB) == 0)
4803 		ahc_busy_tcl(ahc, scb);
4804 
4805 	LIST_INSERT_HEAD(&ahc->pending_ccbs, &ccb->ccb_h,
4806 			 sim_links.le);
4807 
4808 	scb->flags |= SCB_ACTIVE;
4809 	ccb->ccb_h.status |= CAM_SIM_QUEUED;
4810 
4811 	ccb->ccb_h.timeout_ch =
4812 	    timeout(ahc_timeout, (caddr_t)scb,
4813 		    (ccb->ccb_h.timeout * hz) / 1000);
4814 
4815 	if ((scb->flags & SCB_TARGET_IMMEDIATE) != 0) {
4816 #if 0
4817 		printf("Continueing Immediate Command %d:%d\n",
4818 		       ccb->ccb_h.target_id, ccb->ccb_h.target_lun);
4819 #endif
4820 		pause_sequencer(ahc);
4821 		if ((ahc->flags & AHC_PAGESCBS) == 0)
4822 			ahc_outb(ahc, SCBPTR, scb->hscb->tag);
4823 		ahc_outb(ahc, SCB_TAG, scb->hscb->tag);
4824 		ahc_outb(ahc, RETURN_1, CONT_MSG_LOOP);
4825 		unpause_sequencer(ahc, /*unpause_always*/FALSE);
4826 	} else {
4827 
4828 		ahc->qinfifo[ahc->qinfifonext++] = scb->hscb->tag;
4829 
4830 		if ((ahc->features & AHC_QUEUE_REGS) != 0) {
4831 			ahc_outb(ahc, HNSCB_QOFF, ahc->qinfifonext);
4832 		} else {
4833 			pause_sequencer(ahc);
4834 			ahc_outb(ahc, KERNEL_QINPOS, ahc->qinfifonext);
4835 			unpause_sequencer(ahc, /*unpause_always*/FALSE);
4836 		}
4837 	}
4838 
4839 	splx(s);
4840 }
4841 
4842 static void
4843 ahc_poll(struct cam_sim *sim)
4844 {
4845 	ahc_intr(cam_sim_softc(sim));
4846 }
4847 
4848 static void
4849 ahc_setup_data(struct ahc_softc *ahc, struct ccb_scsiio *csio,
4850 	       struct scb *scb)
4851 {
4852 	struct hardware_scb *hscb;
4853 	struct ccb_hdr *ccb_h;
4854 
4855 	hscb = scb->hscb;
4856 	ccb_h = &csio->ccb_h;
4857 
4858 	if (ccb_h->func_code == XPT_SCSI_IO) {
4859 		hscb->cmdlen = csio->cdb_len;
4860 		if ((ccb_h->flags & CAM_CDB_POINTER) != 0) {
4861 			if ((ccb_h->flags & CAM_CDB_PHYS) == 0)
4862 				if (hscb->cmdlen <= 16) {
4863 					memcpy(hscb->cmdstore,
4864 					       csio->cdb_io.cdb_ptr,
4865 					       hscb->cmdlen);
4866 					hscb->cmdpointer =
4867 					    hscb->cmdstore_busaddr;
4868 				} else  {
4869 					ahcsetccbstatus(scb->ccb,
4870 							CAM_REQ_INVALID);
4871 					xpt_done(scb->ccb);
4872 					ahcfreescb(ahc, scb);
4873 					return;
4874 				}
4875 			else
4876 				hscb->cmdpointer =
4877 				  ((intptr_t)csio->cdb_io.cdb_ptr) & 0xffffffff;
4878 		} else {
4879 			/*
4880 			 * CCB CDB Data Storage area is only 16 bytes
4881 			 * so no additional testing is required
4882 			 */
4883 			memcpy(hscb->cmdstore, csio->cdb_io.cdb_bytes,
4884 			       hscb->cmdlen);
4885 			hscb->cmdpointer = hscb->cmdstore_busaddr;
4886 		}
4887 	}
4888 
4889 	/* Only use S/G if there is a transfer */
4890 	if ((ccb_h->flags & CAM_DIR_MASK) != CAM_DIR_NONE) {
4891 		if ((ccb_h->flags & CAM_SCATTER_VALID) == 0) {
4892 			/* We've been given a pointer to a single buffer */
4893 			if ((ccb_h->flags & CAM_DATA_PHYS) == 0) {
4894 				int s;
4895 				int error;
4896 
4897 				s = splsoftvm();
4898 				error = bus_dmamap_load(ahc->buffer_dmat,
4899 							scb->dmamap,
4900 							csio->data_ptr,
4901 							csio->dxfer_len,
4902 							ahc_execute_scb,
4903 							scb, /*flags*/0);
4904 				if (error == EINPROGRESS) {
4905 					/*
4906 					 * So as to maintain ordering,
4907 					 * freeze the controller queue
4908 					 * until our mapping is
4909 					 * returned.
4910 					 */
4911 					xpt_freeze_simq(ahc->sim,
4912 							/*count*/1);
4913 					scb->ccb->ccb_h.status |=
4914 					    CAM_RELEASE_SIMQ;
4915 				}
4916 				splx(s);
4917 			} else {
4918 				struct bus_dma_segment seg;
4919 
4920 				/* Pointer to physical buffer */
4921 				if (csio->dxfer_len > AHC_MAXTRANSFER_SIZE)
4922 					panic("ahc_setup_data - Transfer size "
4923 					      "larger than can device max");
4924 
4925 				seg.ds_addr = (bus_addr_t)csio->data_ptr;
4926 				seg.ds_len = csio->dxfer_len;
4927 				ahc_execute_scb(scb, &seg, 1, 0);
4928 			}
4929 		} else {
4930 			struct bus_dma_segment *segs;
4931 
4932 			if ((ccb_h->flags & CAM_DATA_PHYS) != 0)
4933 				panic("ahc_setup_data - Physical segment "
4934 				      "pointers unsupported");
4935 
4936 			if ((ccb_h->flags & CAM_SG_LIST_PHYS) == 0)
4937 				panic("ahc_setup_data - Virtual segment "
4938 				      "addresses unsupported");
4939 
4940 			/* Just use the segments provided */
4941 			segs = (struct bus_dma_segment *)csio->data_ptr;
4942 			ahc_execute_scb(scb, segs, csio->sglist_cnt, 0);
4943 		}
4944 	} else {
4945 		ahc_execute_scb(scb, NULL, 0, 0);
4946 	}
4947 }
4948 
4949 static void
4950 ahc_freeze_devq(struct ahc_softc *ahc, struct cam_path *path)
4951 {
4952 	int	target;
4953 	char	channel;
4954 	int	lun;
4955 
4956 	target = xpt_path_target_id(path);
4957 	lun = xpt_path_lun_id(path);
4958 	channel = xpt_path_sim(path)->bus_id == 0 ? 'A' : 'B';
4959 
4960 	ahc_search_qinfifo(ahc, target, channel, lun,
4961 			   /*tag*/SCB_LIST_NULL, CAM_REQUEUE_REQ,
4962 			   SEARCH_COMPLETE);
4963 }
4964 
4965 static void
4966 ahcallocscbs(struct ahc_softc *ahc)
4967 {
4968 	struct scb_data *scb_data;
4969 	struct scb *next_scb;
4970 	struct sg_map_node *sg_map;
4971 	bus_addr_t physaddr;
4972 	struct ahc_dma_seg *segs;
4973 	int newcount;
4974 	int i;
4975 
4976 	scb_data = ahc->scb_data;
4977 	if (scb_data->numscbs >= AHC_SCB_MAX)
4978 		/* Can't allocate any more */
4979 		return;
4980 
4981 	next_scb = &scb_data->scbarray[scb_data->numscbs];
4982 
4983 	sg_map = malloc(sizeof(*sg_map), M_DEVBUF, M_NOWAIT);
4984 
4985 	if (sg_map == NULL)
4986 		return;
4987 
4988 	/* Allocate S/G space for the next batch of SCBS */
4989 	if (bus_dmamem_alloc(scb_data->sg_dmat, (void **)&sg_map->sg_vaddr,
4990 			     BUS_DMA_NOWAIT, &sg_map->sg_dmamap) != 0) {
4991 		free(sg_map, M_DEVBUF);
4992 		return;
4993 	}
4994 
4995 	SLIST_INSERT_HEAD(&scb_data->sg_maps, sg_map, links);
4996 
4997 	bus_dmamap_load(scb_data->sg_dmat, sg_map->sg_dmamap, sg_map->sg_vaddr,
4998 			PAGE_SIZE, ahcdmamapcb, &sg_map->sg_physaddr,
4999 			/*flags*/0);
5000 
5001 	segs = sg_map->sg_vaddr;
5002 	physaddr = sg_map->sg_physaddr;
5003 
5004 	newcount = (PAGE_SIZE / (AHC_NSEG * sizeof(struct ahc_dma_seg)));
5005 	for (i = 0; scb_data->numscbs < AHC_SCB_MAX && i < newcount; i++) {
5006 		int error;
5007 
5008 		next_scb->sg_list = segs;
5009 		next_scb->sg_list_phys = physaddr;
5010 		next_scb->flags = SCB_FREE;
5011 		error = bus_dmamap_create(ahc->buffer_dmat, /*flags*/0,
5012 					  &next_scb->dmamap);
5013 		if (error != 0)
5014 			break;
5015 		next_scb->hscb = &scb_data->hscbs[scb_data->numscbs];
5016 		next_scb->hscb->tag = ahc->scb_data->numscbs;
5017 		next_scb->hscb->cmdstore_busaddr =
5018 		    ahc_hscb_busaddr(ahc, next_scb->hscb->tag)
5019 		  + offsetof(struct hardware_scb, cmdstore);
5020 		SLIST_INSERT_HEAD(&ahc->scb_data->free_scbs, next_scb, links);
5021 		segs += AHC_NSEG;
5022 		physaddr += (AHC_NSEG * sizeof(struct ahc_dma_seg));
5023 		next_scb++;
5024 		ahc->scb_data->numscbs++;
5025 	}
5026 }
5027 
5028 static void
5029 ahc_loadseq(struct ahc_softc *ahc)
5030 {
5031 	struct patch *cur_patch;
5032 	int i;
5033 	int downloaded;
5034 	int skip_addr;
5035 	u_int8_t download_consts[4];
5036 
5037 	/* Setup downloadable constant table */
5038 #if 0
5039 	/* No downloaded constants are currently defined. */
5040 	download_consts[TMODE_NUMCMDS] = ahc->num_targetcmds;
5041 #endif
5042 
5043 	cur_patch = patches;
5044 	downloaded = 0;
5045 	skip_addr = 0;
5046 	ahc_outb(ahc, SEQCTL, PERRORDIS|FAILDIS|FASTMODE|LOADRAM);
5047 	ahc_outb(ahc, SEQADDR0, 0);
5048 	ahc_outb(ahc, SEQADDR1, 0);
5049 
5050 	for (i = 0; i < sizeof(seqprog)/4; i++) {
5051 		if (ahc_check_patch(ahc, &cur_patch, i, &skip_addr) == 0) {
5052 			/*
5053 			 * Don't download this instruction as it
5054 			 * is in a patch that was removed.
5055 			 */
5056                         continue;
5057 		}
5058 		ahc_download_instr(ahc, i, download_consts);
5059 		downloaded++;
5060 	}
5061 	ahc_outb(ahc, SEQCTL, PERRORDIS|FAILDIS|FASTMODE);
5062 	restart_sequencer(ahc);
5063 
5064 	if (bootverbose)
5065 		printf(" %d instructions downloaded\n", downloaded);
5066 }
5067 
5068 static int
5069 ahc_check_patch(struct ahc_softc *ahc, struct patch **start_patch,
5070 		int start_instr, int *skip_addr)
5071 {
5072 	struct	patch *cur_patch;
5073 	struct	patch *last_patch;
5074 	int	num_patches;
5075 
5076 	num_patches = sizeof(patches)/sizeof(struct patch);
5077 	last_patch = &patches[num_patches];
5078 	cur_patch = *start_patch;
5079 
5080 	while (cur_patch < last_patch && start_instr == cur_patch->begin) {
5081 
5082 		if (cur_patch->patch_func(ahc) == 0) {
5083 
5084 			/* Start rejecting code */
5085 			*skip_addr = start_instr + cur_patch->skip_instr;
5086 			cur_patch += cur_patch->skip_patch;
5087 		} else {
5088 			/* Accepted this patch.  Advance to the next
5089 			 * one and wait for our intruction pointer to
5090 			 * hit this point.
5091 			 */
5092 			cur_patch++;
5093 		}
5094 	}
5095 
5096 	*start_patch = cur_patch;
5097 	if (start_instr < *skip_addr)
5098 		/* Still skipping */
5099 		return (0);
5100 
5101 	return (1);
5102 }
5103 
5104 static void
5105 ahc_download_instr(struct ahc_softc *ahc, int instrptr, u_int8_t *dconsts)
5106 {
5107 	union	ins_formats instr;
5108 	struct	ins_format1 *fmt1_ins;
5109 	struct	ins_format3 *fmt3_ins;
5110 	u_int	opcode;
5111 
5112 	/* Structure copy */
5113 	instr = *(union ins_formats*)&seqprog[instrptr * 4];
5114 
5115 	fmt1_ins = &instr.format1;
5116 	fmt3_ins = NULL;
5117 
5118 	/* Pull the opcode */
5119 	opcode = instr.format1.opcode;
5120 	switch (opcode) {
5121 	case AIC_OP_JMP:
5122 	case AIC_OP_JC:
5123 	case AIC_OP_JNC:
5124 	case AIC_OP_CALL:
5125 	case AIC_OP_JNE:
5126 	case AIC_OP_JNZ:
5127 	case AIC_OP_JE:
5128 	case AIC_OP_JZ:
5129 	{
5130 		struct patch *cur_patch;
5131 		int address_offset;
5132 		u_int address;
5133 		int skip_addr;
5134 		int i;
5135 
5136 		fmt3_ins = &instr.format3;
5137 		address_offset = 0;
5138 		address = fmt3_ins->address;
5139 		cur_patch = patches;
5140 		skip_addr = 0;
5141 
5142 		for (i = 0; i < address;) {
5143 
5144 			ahc_check_patch(ahc, &cur_patch, i, &skip_addr);
5145 
5146 			if (skip_addr > i) {
5147 				int end_addr;
5148 
5149 				end_addr = MIN(address, skip_addr);
5150 				address_offset += end_addr - i;
5151 				i = skip_addr;
5152 			} else {
5153 				i++;
5154 			}
5155 		}
5156 		address -= address_offset;
5157 		fmt3_ins->address = address;
5158 		/* FALLTHROUGH */
5159 	}
5160 	case AIC_OP_OR:
5161 	case AIC_OP_AND:
5162 	case AIC_OP_XOR:
5163 	case AIC_OP_ADD:
5164 	case AIC_OP_ADC:
5165 	case AIC_OP_BMOV:
5166 		if (fmt1_ins->parity != 0) {
5167 			fmt1_ins->immediate = dconsts[fmt1_ins->immediate];
5168 		}
5169 		fmt1_ins->parity = 0;
5170 		/* FALLTHROUGH */
5171 	case AIC_OP_ROL:
5172 		if ((ahc->features & AHC_ULTRA2) != 0) {
5173 			int i, count;
5174 
5175 			/* Calculate odd parity for the instruction */
5176 			for (i = 0, count = 0; i < 31; i++) {
5177 				u_int32_t mask;
5178 
5179 				mask = 0x01 << i;
5180 				if ((instr.integer & mask) != 0)
5181 					count++;
5182 			}
5183 			if ((count & 0x01) == 0)
5184 				instr.format1.parity = 1;
5185 		} else {
5186 			/* Compress the instruction for older sequencers */
5187 			if (fmt3_ins != NULL) {
5188 				instr.integer =
5189 					fmt3_ins->immediate
5190 				      | (fmt3_ins->source << 8)
5191 				      | (fmt3_ins->address << 16)
5192 				      |	(fmt3_ins->opcode << 25);
5193 			} else {
5194 				instr.integer =
5195 					fmt1_ins->immediate
5196 				      | (fmt1_ins->source << 8)
5197 				      | (fmt1_ins->destination << 16)
5198 				      |	(fmt1_ins->ret << 24)
5199 				      |	(fmt1_ins->opcode << 25);
5200 			}
5201 		}
5202 		ahc_outsb(ahc, SEQRAM, instr.bytes, 4);
5203 		break;
5204 	default:
5205 		panic("Unknown opcode encountered in seq program");
5206 		break;
5207 	}
5208 }
5209 
5210 static void
5211 ahc_set_recoveryscb(struct ahc_softc *ahc, struct scb *scb) {
5212 
5213 	if ((scb->flags & SCB_RECOVERY_SCB) == 0) {
5214 		struct ccb_hdr *ccbh;
5215 
5216 		scb->flags |= SCB_RECOVERY_SCB;
5217 
5218 		/*
5219 		 * Take all queued, but not sent SCBs out of the equation.
5220 		 * Also ensure that no new CCBs are queued to us while we
5221 		 * try to fix this problem.
5222 		 */
5223 		if ((scb->ccb->ccb_h.status & CAM_RELEASE_SIMQ) == 0) {
5224 			xpt_freeze_simq(ahc->sim, /*count*/1);
5225 			scb->ccb->ccb_h.status |= CAM_RELEASE_SIMQ;
5226 		}
5227 
5228 		/*
5229 		 * Go through all of our pending SCBs and remove
5230 		 * any scheduled timeouts for them.  We will reschedule
5231 		 * them after we've successfully fixed this problem.
5232 		 */
5233 		ccbh = ahc->pending_ccbs.lh_first;
5234 		while (ccbh != NULL) {
5235 			struct scb *pending_scb;
5236 
5237 			pending_scb = (struct scb *)ccbh->ccb_scb_ptr;
5238 			untimeout(ahc_timeout, pending_scb, ccbh->timeout_ch);
5239 			ccbh = ccbh->sim_links.le.le_next;
5240 		}
5241 	}
5242 }
5243 
5244 static void
5245 ahc_timeout(void *arg)
5246 {
5247 	struct	scb *scb;
5248 	struct	ahc_softc *ahc;
5249 	int	s, found;
5250 	u_int	bus_state;
5251 	int	target;
5252 	int	lun;
5253 	char	channel;
5254 
5255 	scb = (struct scb *)arg;
5256 	ahc = (struct ahc_softc *)scb->ccb->ccb_h.ccb_ahc_ptr;
5257 
5258 	s = splcam();
5259 
5260 	/*
5261 	 * Ensure that the card doesn't do anything
5262 	 * behind our back.  Also make sure that we
5263 	 * didn't "just" miss an interrupt that would
5264 	 * affect this timeout.
5265 	 */
5266 	do {
5267 		ahc_intr(ahc);
5268 		pause_sequencer(ahc);
5269 	} while (ahc_inb(ahc, INTSTAT) & INT_PEND);
5270 
5271 	if ((scb->flags & SCB_ACTIVE) == 0) {
5272 		/* Previous timeout took care of me already */
5273 		printf("Timedout SCB handled by another timeout\n");
5274 		unpause_sequencer(ahc, /*unpause_always*/TRUE);
5275 		splx(s);
5276 		return;
5277 	}
5278 
5279 	target = SCB_TARGET(scb);
5280 	channel = SCB_CHANNEL(scb);
5281 	lun = SCB_LUN(scb);
5282 
5283 	xpt_print_path(scb->ccb->ccb_h.path);
5284 	printf("SCB 0x%x - timed out ", scb->hscb->tag);
5285 	/*
5286 	 * Take a snapshot of the bus state and print out
5287 	 * some information so we can track down driver bugs.
5288 	 */
5289 	bus_state = ahc_inb(ahc, LASTPHASE);
5290 
5291 	switch(bus_state)
5292 	{
5293 	case P_DATAOUT:
5294 		printf("in dataout phase");
5295 		break;
5296 	case P_DATAIN:
5297 		printf("in datain phase");
5298 		break;
5299 	case P_COMMAND:
5300 		printf("in command phase");
5301 		break;
5302 	case P_MESGOUT:
5303 		printf("in message out phase");
5304 		break;
5305 	case P_STATUS:
5306 		printf("in status phase");
5307 		break;
5308 	case P_MESGIN:
5309 		printf("in message in phase");
5310 		break;
5311 	case P_BUSFREE:
5312 		printf("while idle, LASTPHASE == 0x%x",
5313 			bus_state);
5314 		break;
5315 	default:
5316 		/*
5317 		 * We aren't in a valid phase, so assume we're
5318 		 * idle.
5319 		 */
5320 		printf("invalid phase, LASTPHASE == 0x%x",
5321 			bus_state);
5322 		bus_state = P_BUSFREE;
5323 		break;
5324 	}
5325 
5326 	printf(", SEQADDR == 0x%x\n",
5327 	       ahc_inb(ahc, SEQADDR0) | (ahc_inb(ahc, SEQADDR1) << 8));
5328 
5329 #if 0
5330 	printf(", SCSISIGI == 0x%x\n", ahc_inb(ahc, SCSISIGI));
5331 	printf("SIMODE1 = 0x%x\n", ahc_inb(ahc, SIMODE1));
5332 	printf("INTSTAT = 0x%x\n", ahc_inb(ahc, INTSTAT));
5333 	printf("SSTAT1 == 0x%x\n", ahc_inb(ahc, SSTAT1));
5334 	printf("SCSIRATE == 0x%x\n", ahc_inb(ahc, SCSIRATE));
5335 	printf("CCSCBCTL == 0x%x\n", ahc_inb(ahc, CCSCBCTL));
5336 	printf("CCSCBCNT == 0x%x\n", ahc_inb(ahc, CCSCBCNT));
5337 	printf("DFCNTRL == 0x%x\n", ahc_inb(ahc, DFCNTRL));
5338 	printf("DFSTATUS == 0x%x\n", ahc_inb(ahc, DFSTATUS));
5339 	printf("CCHCNT == 0x%x\n", ahc_inb(ahc, CCHCNT));
5340 #endif
5341 	if (scb->flags & SCB_DEVICE_RESET) {
5342 		/*
5343 		 * Been down this road before.
5344 		 * Do a full bus reset.
5345 		 */
5346 bus_reset:
5347 		ahcsetccbstatus(scb->ccb, CAM_CMD_TIMEOUT);
5348 		found = ahc_reset_channel(ahc, channel, /*Initiate Reset*/TRUE);
5349 		printf("%s: Issued Channel %c Bus Reset. "
5350 		       "%d SCBs aborted\n", ahc_name(ahc), channel, found);
5351 	} else {
5352 		/*
5353 		 * If we are a target, transition to bus free and report
5354 		 * the timeout.
5355 		 *
5356 		 * The target/initiator that is holding up the bus may not
5357 		 * be the same as the one that triggered this timeout
5358 		 * (different commands have different timeout lengths).
5359 		 * If the bus is idle and we are actiing as the initiator
5360 		 * for this request, queue a BDR message to the timed out
5361 		 * target.  Otherwise, if the timed out transaction is
5362 		 * active:
5363 		 *   Initiator transaction:
5364 		 *	Stuff the message buffer with a BDR message and assert
5365 		 *	ATN in the hopes that the target will let go of the bus
5366 		 *	and go to the mesgout phase.  If this fails, we'll
5367 		 *	get another timeout 2 seconds later which will attempt
5368 		 *	a bus reset.
5369 		 *
5370 		 *   Target transaction:
5371 		 *	Transition to BUS FREE and report the error.
5372 		 *	It's good to be the target!
5373 		 */
5374 		u_int active_scb_index;
5375 
5376 		active_scb_index = ahc_inb(ahc, SCB_TAG);
5377 
5378 		if (bus_state != P_BUSFREE
5379 		  && (active_scb_index < ahc->scb_data->numscbs)) {
5380 			struct scb *active_scb;
5381 
5382 			/*
5383 			 * If the active SCB is not from our device,
5384 			 * assume that another device is hogging the bus
5385 			 * and wait for it's timeout to expire before
5386 			 * taking additional action.
5387 			 */
5388 			active_scb = &ahc->scb_data->scbarray[active_scb_index];
5389 			if (active_scb->hscb->tcl != scb->hscb->tcl
5390 			 && (scb->flags & SCB_OTHERTCL_TIMEOUT) == 0) {
5391 				struct	ccb_hdr *ccbh;
5392 				u_int	newtimeout;
5393 
5394 				xpt_print_path(scb->ccb->ccb_h.path);
5395 				printf("Other SCB Timeout\n");
5396 				scb->flags |= SCB_OTHERTCL_TIMEOUT;
5397 				newtimeout = MAX(active_scb->ccb->ccb_h.timeout,
5398 						 scb->ccb->ccb_h.timeout);
5399 				ccbh = &scb->ccb->ccb_h;
5400 				scb->ccb->ccb_h.timeout_ch =
5401 				    timeout(ahc_timeout, scb,
5402 					    (newtimeout * hz) / 1000);
5403 				splx(s);
5404 				return;
5405 			}
5406 
5407 			/* It's us */
5408 			if ((scb->hscb->control & TARGET_SCB) != 0) {
5409 
5410 				/*
5411 				 * Send back any queued up transactions
5412 				 * and properly record the error condition.
5413 				 */
5414 				ahc_freeze_devq(ahc, scb->ccb->ccb_h.path);
5415 				ahcsetccbstatus(scb->ccb, CAM_CMD_TIMEOUT);
5416 				ahc_freeze_ccb(scb->ccb);
5417 				ahc_done(ahc, scb);
5418 
5419 				/* Will clear us from the bus */
5420 				restart_sequencer(ahc);
5421 				return;
5422 			}
5423 
5424 			ahc_set_recoveryscb(ahc, active_scb);
5425 			ahc_outb(ahc, MSG_OUT, MSG_BUS_DEV_RESET);
5426 			ahc_outb(ahc, SCSISIGO, bus_state|ATNO);
5427 			xpt_print_path(active_scb->ccb->ccb_h.path);
5428 			printf("BDR message in message buffer\n");
5429 			active_scb->flags |=  SCB_DEVICE_RESET;
5430 			active_scb->ccb->ccb_h.timeout_ch =
5431 			    timeout(ahc_timeout, (caddr_t)active_scb, 2 * hz);
5432 			unpause_sequencer(ahc, /*unpause_always*/FALSE);
5433 		} else {
5434 			int	 disconnected;
5435 
5436 			if ((scb->hscb->control & TARGET_SCB) != 0)
5437 				panic("Timed-out target SCB but bus idle");
5438 
5439 			if (bus_state != P_BUSFREE
5440 			 && (ahc_inb(ahc, SSTAT0) & TARGET) != 0) {
5441 				/* Hung target selection.  Goto busfree */
5442 				printf("%s: Hung target selection\n",
5443 				       ahc_name(ahc));
5444 				restart_sequencer(ahc);
5445 				return;
5446 			}
5447 
5448 			if (ahc_search_qinfifo(ahc, target, channel, lun,
5449 					       scb->hscb->tag, /*status*/0,
5450 					       SEARCH_COUNT) > 0) {
5451 				disconnected = FALSE;
5452 			} else {
5453 				disconnected = TRUE;
5454 			}
5455 
5456 			if (disconnected) {
5457 
5458 				ahc_set_recoveryscb(ahc, scb);
5459 				/*
5460 				 * Simply set the MK_MESSAGE control bit.
5461 				 */
5462 				scb->hscb->control |= MK_MESSAGE;
5463 				scb->flags |= SCB_QUEUED_MSG
5464 					   |  SCB_DEVICE_RESET;
5465 
5466 				/*
5467 				 * Remove this SCB from the disconnected
5468 				 * list so that a reconnect at this point
5469 				 * causes a BDR.
5470 				 */
5471 				ahc_search_disc_list(ahc, target, channel, lun,
5472 						     scb->hscb->tag);
5473 				ahc_index_busy_tcl(ahc, scb->hscb->tcl,
5474 						   /*unbusy*/TRUE);
5475 
5476 				/*
5477 				 * Actually re-queue this SCB in case we can
5478 				 * select the device before it reconnects.
5479 				 * Clear out any entries in the QINFIFO first
5480 				 * so we are the next SCB for this target
5481 				 * to run.
5482 				 */
5483 				ahc_search_qinfifo(ahc, SCB_TARGET(scb),
5484 						   channel, SCB_LUN(scb),
5485 						   SCB_LIST_NULL,
5486 						   CAM_REQUEUE_REQ,
5487 						   SEARCH_COMPLETE);
5488 				xpt_print_path(scb->ccb->ccb_h.path);
5489 				printf("Queuing a BDR SCB\n");
5490 				ahc->qinfifo[ahc->qinfifonext++] =
5491 				    scb->hscb->tag;
5492 				if ((ahc->features & AHC_QUEUE_REGS) != 0) {
5493 					ahc_outb(ahc, HNSCB_QOFF,
5494 						 ahc->qinfifonext);
5495 				} else {
5496 					ahc_outb(ahc, KERNEL_QINPOS,
5497 						 ahc->qinfifonext);
5498 				}
5499 				scb->ccb->ccb_h.timeout_ch =
5500 				    timeout(ahc_timeout, (caddr_t)scb, 2 * hz);
5501 				unpause_sequencer(ahc, /*unpause_always*/FALSE);
5502 			} else {
5503 				/* Go "immediatly" to the bus reset */
5504 				/* This shouldn't happen */
5505 				ahc_set_recoveryscb(ahc, scb);
5506 				xpt_print_path(scb->ccb->ccb_h.path);
5507 				printf("SCB %d: Immediate reset.  "
5508 					"Flags = 0x%x\n", scb->hscb->tag,
5509 					scb->flags);
5510 				goto bus_reset;
5511 			}
5512 		}
5513 	}
5514 	splx(s);
5515 }
5516 
5517 static int
5518 ahc_search_qinfifo(struct ahc_softc *ahc, int target, char channel,
5519 		   int lun, u_int tag, u_int32_t status,
5520 		   ahc_search_action action)
5521 {
5522 	struct	 scb *scbp;
5523 	u_int8_t qinpos;
5524 	u_int8_t qintail;
5525 	int	 found;
5526 
5527 	qinpos = ahc_inb(ahc, QINPOS);
5528 	qintail = ahc->qinfifonext;
5529 	found = 0;
5530 
5531 	/*
5532 	 * Start with an empty queue.  Entries that are not chosen
5533 	 * for removal will be re-added to the queue as we go.
5534 	 */
5535 	ahc->qinfifonext = qinpos;
5536 
5537 	while (qinpos != qintail) {
5538 		scbp = &ahc->scb_data->scbarray[ahc->qinfifo[qinpos]];
5539 		if (ahc_match_scb(scbp, target, channel, lun, tag)) {
5540 			/*
5541 			 * We found an scb that needs to be removed.
5542 			 */
5543 			switch (action) {
5544 			case SEARCH_COMPLETE:
5545 				if (ahc_ccb_status(scbp->ccb) == CAM_REQ_INPROG)
5546 					ahcsetccbstatus(scbp->ccb, status);
5547 				ahc_freeze_ccb(scbp->ccb);
5548 				ahc_done(ahc, scbp);
5549 				break;
5550 			case SEARCH_COUNT:
5551 				ahc->qinfifo[ahc->qinfifonext++] =
5552 				    scbp->hscb->tag;
5553 				break;
5554 			case SEARCH_REMOVE:
5555 				break;
5556 			}
5557 			found++;
5558 		} else {
5559 			ahc->qinfifo[ahc->qinfifonext++] = scbp->hscb->tag;
5560 		}
5561 		qinpos++;
5562 	}
5563 
5564 	if ((ahc->features & AHC_QUEUE_REGS) != 0) {
5565 		ahc_outb(ahc, HNSCB_QOFF, ahc->qinfifonext);
5566 	} else {
5567 		ahc_outb(ahc, KERNEL_QINPOS, ahc->qinfifonext);
5568 	}
5569 
5570 	return (found);
5571 }
5572 
5573 
5574 static void
5575 ahc_abort_ccb(struct ahc_softc *ahc, struct cam_sim *sim, union ccb *ccb)
5576 {
5577 	union ccb *abort_ccb;
5578 
5579 	abort_ccb = ccb->cab.abort_ccb;
5580 	switch (abort_ccb->ccb_h.func_code) {
5581 	case XPT_ACCEPT_TARGET_IO:
5582 	case XPT_IMMED_NOTIFY:
5583 	case XPT_CONT_TARGET_IO:
5584 	{
5585 		struct tmode_tstate *tstate;
5586 		struct tmode_lstate *lstate;
5587 		struct ccb_hdr_slist *list;
5588 		cam_status status;
5589 
5590 		status = ahc_find_tmode_devs(ahc, sim, abort_ccb, &tstate,
5591 					     &lstate, TRUE);
5592 
5593 		if (status != CAM_REQ_CMP) {
5594 			ccb->ccb_h.status = status;
5595 			break;
5596 		}
5597 
5598 		if (abort_ccb->ccb_h.func_code == XPT_ACCEPT_TARGET_IO)
5599 			list = &lstate->accept_tios;
5600 		else if (abort_ccb->ccb_h.func_code == XPT_IMMED_NOTIFY)
5601 			list = &lstate->immed_notifies;
5602 		else
5603 			list = NULL;
5604 
5605 		if (list != NULL) {
5606 			struct ccb_hdr *curelm;
5607 			int found;
5608 
5609 			curelm = SLIST_FIRST(list);
5610 			found = 0;
5611 			if (curelm == &abort_ccb->ccb_h) {
5612 				found = 1;
5613 				SLIST_REMOVE_HEAD(list, sim_links.sle);
5614 			} else {
5615 				while(curelm != NULL) {
5616 					struct ccb_hdr *nextelm;
5617 
5618 					nextelm =
5619 					    SLIST_NEXT(curelm, sim_links.sle);
5620 
5621 					if (nextelm == &abort_ccb->ccb_h) {
5622 						found = 1;
5623 						SLIST_NEXT(curelm,
5624 							   sim_links.sle) =
5625 						    SLIST_NEXT(nextelm,
5626 							       sim_links.sle);
5627 						break;
5628 					}
5629 					curelm = nextelm;
5630 				}
5631 			}
5632 
5633 			if (found) {
5634 				abort_ccb->ccb_h.status = CAM_REQ_ABORTED;
5635 				xpt_done(abort_ccb);
5636 				ccb->ccb_h.status = CAM_REQ_CMP;
5637 			} else {
5638 				printf("Not found\n");
5639 				ccb->ccb_h.status = CAM_PATH_INVALID;
5640 			}
5641 			break;
5642 		}
5643 		/* FALLTHROUGH */
5644 	}
5645 	case XPT_SCSI_IO:
5646 		/* XXX Fully implement the hard ones */
5647 		ccb->ccb_h.status = CAM_UA_ABORT;
5648 		break;
5649 	default:
5650 		ccb->ccb_h.status = CAM_REQ_INVALID;
5651 		break;
5652 	}
5653 	xpt_done(ccb);
5654 }
5655 
5656 /*
5657  * Abort all SCBs that match the given description (target/channel/lun/tag),
5658  * setting their status to the passed in status if the status has not already
5659  * been modified from CAM_REQ_INPROG.  This routine assumes that the sequencer
5660  * is paused before it is called.
5661  */
5662 static int
5663 ahc_abort_scbs(struct ahc_softc *ahc, int target, char channel,
5664 	       int lun, u_int tag, u_int32_t status)
5665 {
5666 	struct	scb *scbp;
5667 	u_int	active_scb;
5668 	int	i;
5669 	int	found;
5670 
5671 	/* restore this when we're done */
5672 	active_scb = ahc_inb(ahc, SCBPTR);
5673 
5674 	found = ahc_search_qinfifo(ahc, target, channel, lun, tag,
5675 				   CAM_REQUEUE_REQ, SEARCH_COMPLETE);
5676 
5677 	/*
5678 	 * Search waiting for selection list.
5679 	 */
5680 	{
5681 		u_int8_t next, prev;
5682 
5683 		next = ahc_inb(ahc, WAITING_SCBH);  /* Start at head of list. */
5684 		prev = SCB_LIST_NULL;
5685 
5686 		while (next != SCB_LIST_NULL) {
5687 			u_int8_t scb_index;
5688 
5689 			ahc_outb(ahc, SCBPTR, next);
5690 			scb_index = ahc_inb(ahc, SCB_TAG);
5691 			if (scb_index >= ahc->scb_data->numscbs) {
5692 				panic("Waiting List inconsistency. "
5693 				      "SCB index == %d, yet numscbs == %d.",
5694 				      scb_index, ahc->scb_data->numscbs);
5695 			}
5696 			scbp = &ahc->scb_data->scbarray[scb_index];
5697 			if (ahc_match_scb(scbp, target, channel, lun, tag)) {
5698 
5699 				next = ahc_abort_wscb(ahc, next, prev);
5700 			} else {
5701 
5702 				prev = next;
5703 				next = ahc_inb(ahc, SCB_NEXT);
5704 			}
5705 		}
5706 	}
5707 	/*
5708 	 * Go through the disconnected list and remove any entries we
5709 	 * have queued for completion, 0'ing their control byte too.
5710 	 */
5711 	ahc_search_disc_list(ahc, target, channel, lun, tag);
5712 
5713 	/*
5714 	 * Go through the hardware SCB array looking for commands that
5715 	 * were active but not on any list.
5716 	 */
5717 	for(i = 0; i < ahc->scb_data->maxhscbs; i++) {
5718 		u_int scbid;
5719 
5720 		ahc_outb(ahc, SCBPTR, i);
5721 		scbid = ahc_inb(ahc, SCB_TAG);
5722 		if (scbid < ahc->scb_data->numscbs) {
5723 			scbp = &ahc->scb_data->scbarray[scbid];
5724 			if (ahc_match_scb(scbp, target, channel, lun, tag)) {
5725 				ahc_add_curscb_to_free_list(ahc);
5726                         }
5727 		}
5728 	}
5729 	/*
5730 	 * Go through the pending CCB list and look for
5731 	 * commands for this target that are still active.
5732 	 * These are other tagged commands that were
5733 	 * disconnected when the reset occured.
5734 	 */
5735 	{
5736 		struct ccb_hdr *ccb_h;
5737 
5738 
5739 		ccb_h = ahc->pending_ccbs.lh_first;
5740 
5741 		while (ccb_h != NULL) {
5742 			scbp = (struct scb *)ccb_h->ccb_scb_ptr;
5743 			ccb_h = ccb_h->sim_links.le.le_next;
5744 			if (ahc_match_scb(scbp, target, channel, lun, tag)) {
5745 				if (ahc_ccb_status(scbp->ccb) == CAM_REQ_INPROG)
5746 					ahcsetccbstatus(scbp->ccb, status);
5747 				ahc_freeze_ccb(scbp->ccb);
5748 				ahc_done(ahc, scbp);
5749 				found++;
5750 			}
5751 		}
5752 	}
5753 	ahc_outb(ahc, SCBPTR, active_scb);
5754 	return found;
5755 }
5756 
5757 static int
5758 ahc_search_disc_list(struct ahc_softc *ahc, int target, char channel,
5759 		     int lun, u_int tag)
5760 {
5761 	struct	scb *scbp;
5762 	u_int	next;
5763 	u_int	prev;
5764 	u_int	count;
5765 	u_int	active_scb;
5766 
5767 	count = 0;
5768 	next = ahc_inb(ahc, DISCONNECTED_SCBH);
5769 	prev = SCB_LIST_NULL;
5770 
5771 	/* restore this when we're done */
5772 	active_scb = ahc_inb(ahc, SCBPTR);
5773 
5774 	while (next != SCB_LIST_NULL) {
5775 		u_int scb_index;
5776 
5777 		ahc_outb(ahc, SCBPTR, next);
5778 		scb_index = ahc_inb(ahc, SCB_TAG);
5779 		if (scb_index >= ahc->scb_data->numscbs) {
5780 			panic("Disconnected List inconsistency. "
5781 			      "SCB index == %d, yet numscbs == %d.",
5782 			      scb_index, ahc->scb_data->numscbs);
5783 		}
5784 		scbp = &ahc->scb_data->scbarray[scb_index];
5785 		if (ahc_match_scb(scbp, target, channel, lun, tag)) {
5786 			next = ahc_rem_scb_from_disc_list(ahc, prev,
5787 							  next);
5788 			count++;
5789 		} else {
5790 			prev = next;
5791 			next = ahc_inb(ahc, SCB_NEXT);
5792 		}
5793 	}
5794 	ahc_outb(ahc, SCBPTR, active_scb);
5795 	return (count);
5796 }
5797 
5798 static u_int
5799 ahc_rem_scb_from_disc_list(struct ahc_softc *ahc, u_int prev, u_int scbptr)
5800 {
5801 	u_int next;
5802 
5803 	ahc_outb(ahc, SCBPTR, scbptr);
5804 	next = ahc_inb(ahc, SCB_NEXT);
5805 
5806 	ahc_outb(ahc, SCB_CONTROL, 0);
5807 
5808 	ahc_add_curscb_to_free_list(ahc);
5809 
5810 	if (prev != SCB_LIST_NULL) {
5811 		ahc_outb(ahc, SCBPTR, prev);
5812 		ahc_outb(ahc, SCB_NEXT, next);
5813 	} else
5814 		ahc_outb(ahc, DISCONNECTED_SCBH, next);
5815 
5816 	return next;
5817 }
5818 
5819 static void
5820 ahc_add_curscb_to_free_list(struct ahc_softc *ahc)
5821 {
5822 	/* Invalidate the tag so that ahc_find_scb doesn't think it's active */
5823 	ahc_outb(ahc, SCB_TAG, SCB_LIST_NULL);
5824 
5825 	ahc_outb(ahc, SCB_NEXT, ahc_inb(ahc, FREE_SCBH));
5826 	ahc_outb(ahc, FREE_SCBH, ahc_inb(ahc, SCBPTR));
5827 }
5828 
5829 /*
5830  * Manipulate the waiting for selection list and return the
5831  * scb that follows the one that we remove.
5832  */
5833 static u_int
5834 ahc_abort_wscb(struct ahc_softc *ahc, u_int scbpos, u_int prev)
5835 {
5836 	u_int curscb, next;
5837 
5838 	/*
5839 	 * Select the SCB we want to abort and
5840 	 * pull the next pointer out of it.
5841 	 */
5842 	curscb = ahc_inb(ahc, SCBPTR);
5843 	ahc_outb(ahc, SCBPTR, scbpos);
5844 	next = ahc_inb(ahc, SCB_NEXT);
5845 
5846 	/* Clear the necessary fields */
5847 	ahc_outb(ahc, SCB_CONTROL, 0);
5848 
5849 	ahc_add_curscb_to_free_list(ahc);
5850 
5851 	/* update the waiting list */
5852 	if (prev == SCB_LIST_NULL) {
5853 		/* First in the list */
5854 		ahc_outb(ahc, WAITING_SCBH, next);
5855 
5856 		/*
5857 		 * Ensure we aren't attempting to perform
5858 		 * selection for this entry.
5859 		 */
5860 		ahc_outb(ahc, SCSISEQ, (ahc_inb(ahc, SCSISEQ) & ~ENSELO));
5861 	} else {
5862 		/*
5863 		 * Select the scb that pointed to us
5864 		 * and update its next pointer.
5865 		 */
5866 		ahc_outb(ahc, SCBPTR, prev);
5867 		ahc_outb(ahc, SCB_NEXT, next);
5868 	}
5869 
5870 	/*
5871 	 * Point us back at the original scb position.
5872 	 */
5873 	ahc_outb(ahc, SCBPTR, curscb);
5874 	return next;
5875 }
5876 
5877 static void
5878 ahc_clear_intstat(struct ahc_softc *ahc)
5879 {
5880 	/* Clear any interrupt conditions this may have caused */
5881 	ahc_outb(ahc, CLRSINT0, CLRSELDO|CLRSELDI|CLRSELINGO);
5882 	ahc_outb(ahc, CLRSINT1, CLRSELTIMEO|CLRATNO|CLRSCSIRSTI
5883 				|CLRBUSFREE|CLRSCSIPERR|CLRPHASECHG|
5884 				CLRREQINIT);
5885 	ahc_outb(ahc, CLRINT, CLRSCSIINT);
5886 }
5887 
5888 static void
5889 ahc_reset_current_bus(struct ahc_softc *ahc)
5890 {
5891 	u_int8_t scsiseq;
5892 
5893 	ahc_outb(ahc, SIMODE1, ahc_inb(ahc, SIMODE1) & ~ENSCSIRST);
5894 	scsiseq = ahc_inb(ahc, SCSISEQ);
5895 	ahc_outb(ahc, SCSISEQ, scsiseq | SCSIRSTO);
5896 	DELAY(AHC_BUSRESET_DELAY);
5897 	/* Turn off the bus reset */
5898 	ahc_outb(ahc, SCSISEQ, scsiseq & ~SCSIRSTO);
5899 
5900 	ahc_clear_intstat(ahc);
5901 
5902 	/* Re-enable reset interrupts */
5903 	ahc_outb(ahc, SIMODE1, ahc_inb(ahc, SIMODE1) | ENSCSIRST);
5904 }
5905 
5906 static int
5907 ahc_reset_channel(struct ahc_softc *ahc, char channel, int initiate_reset)
5908 {
5909 	struct	cam_path *path;
5910 	u_int	initiator, target, max_scsiid;
5911 	u_int	sblkctl;
5912 	u_int	our_id;
5913 	int	found;
5914 	char	cur_channel;
5915 
5916 	ahc->pending_device = NULL;
5917 
5918 	pause_sequencer(ahc);
5919 	/*
5920 	 * Clean up all the state information for the
5921 	 * pending transactions on this bus.
5922 	 */
5923 	found = ahc_abort_scbs(ahc, CAM_TARGET_WILDCARD, channel,
5924 			       CAM_LUN_WILDCARD, SCB_LIST_NULL,
5925 			       CAM_SCSI_BUS_RESET);
5926 	if (channel == 'B') {
5927 		path = ahc->path_b;
5928 		our_id = ahc->our_id_b;
5929 	} else {
5930 		path = ahc->path;
5931 		our_id = ahc->our_id;
5932 	}
5933 
5934 	/* Notify the XPT that a bus reset occurred */
5935 	xpt_async(AC_BUS_RESET, path, NULL);
5936 
5937 	/*
5938 	 * Revert to async/narrow transfers until we renegotiate.
5939 	 */
5940 	max_scsiid = (ahc->features & AHC_WIDE) ? 15 : 7;
5941 	for (target = 0; target <= max_scsiid; target++) {
5942 
5943 		if (ahc->enabled_targets[target] == NULL)
5944 			continue;
5945 		for (initiator = 0; initiator <= max_scsiid; initiator++) {
5946 			struct ahc_devinfo devinfo;
5947 
5948 			ahc_compile_devinfo(&devinfo, target, initiator,
5949 					    CAM_LUN_WILDCARD,
5950 					    channel, ROLE_UNKNOWN);
5951 			ahc_set_width(ahc, &devinfo, path,
5952 				      MSG_EXT_WDTR_BUS_8_BIT,
5953 				      AHC_TRANS_CUR, /*paused*/TRUE);
5954 			ahc_set_syncrate(ahc, &devinfo, path,
5955 					 /*syncrate*/NULL, /*period*/0,
5956 					 /*offset*/0, AHC_TRANS_CUR,
5957 					 /*paused*/TRUE);
5958 		}
5959 	}
5960 
5961 	/*
5962 	 * Reset the bus if we are initiating this reset and
5963 	 * restart/unpause the sequencer
5964 	 */
5965 	sblkctl = ahc_inb(ahc, SBLKCTL);
5966 	cur_channel = 'A';
5967 	if ((ahc->features & AHC_TWIN) != 0
5968 	 && ((sblkctl & SELBUSB) != 0))
5969 	    cur_channel = 'B';
5970 	if (cur_channel != channel) {
5971 		/* Case 1: Command for another bus is active
5972 		 * Stealthily reset the other bus without
5973 		 * upsetting the current bus.
5974 		 */
5975 		ahc_outb(ahc, SBLKCTL, sblkctl ^ SELBUSB);
5976 		ahc_outb(ahc, SIMODE1, ahc_inb(ahc, SIMODE1) & ~ENBUSFREE);
5977 		ahc_outb(ahc, SCSISEQ,
5978 			 ahc_inb(ahc, SCSISEQ) & (ENSELI|ENRSELI|ENAUTOATNP));
5979 		if (initiate_reset)
5980 			ahc_reset_current_bus(ahc);
5981 		ahc_clear_intstat(ahc);
5982 		ahc_outb(ahc, SBLKCTL, sblkctl);
5983 		unpause_sequencer(ahc, /*unpause_always*/FALSE);
5984 	} else {
5985 		/* Case 2: A command from this bus is active or we're idle */
5986 		ahc_clear_msg_state(ahc);
5987 		ahc_outb(ahc, SIMODE1, ahc_inb(ahc, SIMODE1) & ~ENBUSFREE);
5988 		ahc_outb(ahc, SCSISEQ,
5989 			 ahc_inb(ahc, SCSISEQ) & (ENSELI|ENRSELI|ENAUTOATNP));
5990 		if (initiate_reset)
5991 			ahc_reset_current_bus(ahc);
5992 		ahc_clear_intstat(ahc);
5993 		restart_sequencer(ahc);
5994 	}
5995 	return found;
5996 }
5997 
5998 static int
5999 ahc_match_scb (struct scb *scb, int target, char channel, int lun, u_int tag)
6000 {
6001 	int targ = SCB_TARGET(scb);
6002 	char chan = SCB_CHANNEL(scb);
6003 	int slun = SCB_LUN(scb);
6004 	int match;
6005 
6006 	match = ((chan == channel) || (channel == ALL_CHANNELS));
6007 	if (match != 0)
6008 		match = ((targ == target) || (target == CAM_TARGET_WILDCARD));
6009 	if (match != 0)
6010 		match = ((lun == slun) || (lun == CAM_LUN_WILDCARD));
6011 	if (match != 0)
6012 		match = ((tag == scb->hscb->tag) || (tag == SCB_LIST_NULL));
6013 
6014 	return match;
6015 }
6016 
6017 static void
6018 ahc_construct_sdtr(struct ahc_softc *ahc, u_int period, u_int offset)
6019 {
6020 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXTENDED;
6021 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXT_SDTR_LEN;
6022 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXT_SDTR;
6023 	ahc->msgout_buf[ahc->msgout_index++] = period;
6024 	ahc->msgout_buf[ahc->msgout_index++] = offset;
6025 	ahc->msgout_len += 5;
6026 }
6027 
6028 static void
6029 ahc_construct_wdtr(struct ahc_softc *ahc, u_int bus_width)
6030 {
6031 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXTENDED;
6032 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXT_WDTR_LEN;
6033 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXT_WDTR;
6034 	ahc->msgout_buf[ahc->msgout_index++] = bus_width;
6035 	ahc->msgout_len += 4;
6036 }
6037 
6038 static void
6039 ahc_calc_residual(struct scb *scb)
6040 {
6041 	struct	hardware_scb *hscb;
6042 
6043 	hscb = scb->hscb;
6044 
6045 	/*
6046 	 * If the disconnected flag is still set, this is bogus
6047 	 * residual information left over from a sequencer
6048 	 * pagin/pageout, so ignore this case.
6049 	 */
6050 	if ((scb->hscb->control & DISCONNECTED) == 0) {
6051 		u_int32_t resid;
6052 		int	  resid_sgs;
6053 		int	  sg;
6054 
6055 		/*
6056 		 * Remainder of the SG where the transfer
6057 		 * stopped.
6058 		 */
6059 		resid = (hscb->residual_data_count[2] << 16)
6060 		      |	(hscb->residual_data_count[1] <<8)
6061 		      |	(hscb->residual_data_count[0]);
6062 
6063 		/*
6064 		 * Add up the contents of all residual
6065 		 * SG segments that are after the SG where
6066 		 * the transfer stopped.
6067 		 */
6068 		resid_sgs = scb->hscb->residual_SG_count - 1/*current*/;
6069 		sg = scb->sg_count - resid_sgs - 1/*first SG*/;
6070 		while (resid_sgs > 0) {
6071 
6072 			resid += scb->sg_list[sg].len;
6073 			sg++;
6074 			resid_sgs--;
6075 		}
6076 		if ((scb->flags & SCB_SENSE) == 0) {
6077 
6078 			scb->ccb->csio.resid = resid;
6079 		} else {
6080 
6081 			scb->ccb->csio.sense_resid = resid;
6082 		}
6083 	}
6084 
6085 	/*
6086 	 * Clean out the residual information in this SCB for its
6087 	 * next consumer.
6088 	 */
6089 	hscb->residual_data_count[0] = 0;
6090 	hscb->residual_data_count[1] = 0;
6091 	hscb->residual_data_count[2] = 0;
6092 	hscb->residual_SG_count = 0;
6093 
6094 #ifdef AHC_DEBUG
6095 	if (ahc_debug & AHC_SHOWMISC) {
6096 		sc_print_addr(xs->sc_link);
6097 		printf("Handled Residual of %ld bytes\n" ,xs->resid);
6098 	}
6099 #endif
6100 }
6101 
6102 static void
6103 ahc_update_pending_syncrates(struct ahc_softc *ahc)
6104 {
6105 	struct	ccb_hdr *ccbh;
6106 	int	pending_ccb_count;
6107 	int	i;
6108 	u_int	saved_scbptr;
6109 
6110 	/*
6111 	 * Traverse the pending SCB list and ensure that all of the
6112 	 * SCBs there have the proper settings.
6113 	 */
6114 	ccbh = LIST_FIRST(&ahc->pending_ccbs);
6115 	pending_ccb_count = 0;
6116 	while (ccbh != NULL) {
6117 		struct ahc_devinfo devinfo;
6118 		union  ccb *ccb;
6119 		struct scb *pending_scb;
6120 		struct hardware_scb *pending_hscb;
6121 		struct ahc_initiator_tinfo *tinfo;
6122 		struct tmode_tstate *tstate;
6123 		u_int  our_id, remote_id;
6124 
6125 		ccb = (union ccb*)ccbh;
6126 		pending_scb = (struct scb *)ccbh->ccb_scb_ptr;
6127 		pending_hscb = pending_scb->hscb;
6128 		if (ccbh->func_code == XPT_CONT_TARGET_IO) {
6129 			our_id = ccb->ccb_h.target_id;
6130 			remote_id = ccb->ctio.init_id;
6131 		} else {
6132 			our_id = SCB_IS_SCSIBUS_B(pending_scb)
6133 			       ? ahc->our_id_b : ahc->our_id;
6134 			remote_id = ccb->ccb_h.target_id;
6135 		}
6136 		ahc_compile_devinfo(&devinfo, our_id, remote_id,
6137 				    SCB_LUN(pending_scb),
6138 				    SCB_CHANNEL(pending_scb),
6139 				    ROLE_UNKNOWN);
6140 		tinfo = ahc_fetch_transinfo(ahc, devinfo.channel,
6141 					    our_id, remote_id, &tstate);
6142 		pending_hscb->control &= ~ULTRAENB;
6143 		if ((tstate->ultraenb & devinfo.target_mask) != 0)
6144 			pending_hscb->control |= ULTRAENB;
6145 		pending_hscb->scsirate = tinfo->scsirate;
6146 		pending_hscb->scsioffset = tinfo->current.offset;
6147 		pending_ccb_count++;
6148 		ccbh = LIST_NEXT(ccbh, sim_links.le);
6149 	}
6150 
6151 	if (pending_ccb_count == 0)
6152 		return;
6153 
6154 	saved_scbptr = ahc_inb(ahc, SCBPTR);
6155 	/* Ensure that the hscbs down on the card match the new information */
6156 	for (i = 0; i < ahc->scb_data->maxhscbs; i++) {
6157 		u_int scb_tag;
6158 
6159 		ahc_outb(ahc, SCBPTR, i);
6160 		scb_tag = ahc_inb(ahc, SCB_TAG);
6161 		if (scb_tag != SCB_LIST_NULL) {
6162 			struct	ahc_devinfo devinfo;
6163 			union  ccb *ccb;
6164 			struct	scb *pending_scb;
6165 			struct	hardware_scb *pending_hscb;
6166 			struct	ahc_initiator_tinfo *tinfo;
6167 			struct	tmode_tstate *tstate;
6168 			u_int	our_id, remote_id;
6169 			u_int	control;
6170 
6171 			pending_scb = &ahc->scb_data->scbarray[scb_tag];
6172 			if (pending_scb->flags == SCB_FREE)
6173 				continue;
6174 			pending_hscb = pending_scb->hscb;
6175 			ccb = pending_scb->ccb;
6176 			if (ccb->ccb_h.func_code == XPT_CONT_TARGET_IO) {
6177 				our_id = ccb->ccb_h.target_id;
6178 				remote_id = ccb->ctio.init_id;
6179 			} else {
6180 				our_id = SCB_IS_SCSIBUS_B(pending_scb)
6181 				       ? ahc->our_id_b : ahc->our_id;
6182 				remote_id = ccb->ccb_h.target_id;
6183 			}
6184 			ahc_compile_devinfo(&devinfo, our_id, remote_id,
6185 					    SCB_LUN(pending_scb),
6186 					    SCB_CHANNEL(pending_scb),
6187 					    ROLE_UNKNOWN);
6188 			tinfo = ahc_fetch_transinfo(ahc, devinfo.channel,
6189 						    our_id, remote_id, &tstate);
6190 			control = ahc_inb(ahc, SCB_CONTROL);
6191 			control &= ~ULTRAENB;
6192 			if ((tstate->ultraenb & devinfo.target_mask) != 0)
6193 				control |= ULTRAENB;
6194 			ahc_outb(ahc, SCB_CONTROL, control);
6195 			ahc_outb(ahc, SCB_SCSIRATE, tinfo->scsirate);
6196 			ahc_outb(ahc, SCB_SCSIOFFSET, tinfo->current.offset);
6197 		}
6198 	}
6199 	ahc_outb(ahc, SCBPTR, saved_scbptr);
6200 }
6201 
6202 #if UNUSED
6203 static void
6204 ahc_dump_targcmd(struct target_cmd *cmd)
6205 {
6206 	u_int8_t *byte;
6207 	u_int8_t *last_byte;
6208 	int i;
6209 
6210 	byte = &cmd->initiator_channel;
6211 	/* Debugging info for received commands */
6212 	last_byte = &cmd[1].initiator_channel;
6213 
6214 	i = 0;
6215 	while (byte < last_byte) {
6216 		if (i == 0)
6217 			printf("\t");
6218 		printf("%#x", *byte++);
6219 		i++;
6220 		if (i == 8) {
6221 			printf("\n");
6222 			i = 0;
6223 		} else {
6224 			printf(", ");
6225 		}
6226 	}
6227 }
6228 #endif
6229 
6230 static void
6231 ahc_shutdown(int howto, void *arg)
6232 {
6233 	struct	ahc_softc *ahc;
6234 	int	i;
6235 	u_int	sxfrctl1_a, sxfrctl1_b;
6236 
6237 	ahc = (struct ahc_softc *)arg;
6238 
6239 	pause_sequencer(ahc);
6240 
6241 	/*
6242 	 * Preserve the value of the SXFRCTL1 register for all channels.
6243 	 * It contains settings that affect termination and we don't want
6244 	 * to disturb the integrity of the bus during shutdown in case
6245 	 * we are in a multi-initiator setup.
6246 	 */
6247 	sxfrctl1_b = 0;
6248 	if ((ahc->features & AHC_TWIN) != 0) {
6249 		u_int sblkctl;
6250 
6251 		sblkctl = ahc_inb(ahc, SBLKCTL);
6252 		ahc_outb(ahc, SBLKCTL, sblkctl | SELBUSB);
6253 		sxfrctl1_b = ahc_inb(ahc, SXFRCTL1);
6254 		ahc_outb(ahc, SBLKCTL, sblkctl & ~SELBUSB);
6255 	}
6256 
6257 	sxfrctl1_a = ahc_inb(ahc, SXFRCTL1);
6258 
6259 	/* This will reset most registers to 0, but not all */
6260 	ahc_reset(ahc);
6261 
6262 	if ((ahc->features & AHC_TWIN) != 0) {
6263 		u_int sblkctl;
6264 
6265 		sblkctl = ahc_inb(ahc, SBLKCTL);
6266 		ahc_outb(ahc, SBLKCTL, sblkctl | SELBUSB);
6267 		ahc_outb(ahc, SXFRCTL1, sxfrctl1_b);
6268 		ahc_outb(ahc, SBLKCTL, sblkctl & ~SELBUSB);
6269 	}
6270 	ahc_outb(ahc, SXFRCTL1, sxfrctl1_a);
6271 
6272 	ahc_outb(ahc, SCSISEQ, 0);
6273 	ahc_outb(ahc, SXFRCTL0, 0);
6274 	ahc_outb(ahc, DSPCISTATUS, 0);
6275 
6276 	for (i = TARG_SCSIRATE; i < HA_274_BIOSCTRL; i++)
6277 		ahc_outb(ahc, i, 0);
6278 }
6279