xref: /freebsd/sys/dev/aic7xxx/aic7xxx.c (revision aa77200569e397d6ff1fdb4d255d0fa254d0a128)
1 /*-
2  * Core routines and tables shareable across OS platforms.
3  *
4  * Copyright (c) 1994-2002 Justin T. Gibbs.
5  * Copyright (c) 2000-2002 Adaptec Inc.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions, and the following disclaimer,
13  *    without modification.
14  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
15  *    substantially similar to the "NO WARRANTY" disclaimer below
16  *    ("Disclaimer") and any redistribution must be conditioned upon
17  *    including a substantially similar Disclaimer requirement for further
18  *    binary redistribution.
19  * 3. Neither the names of the above-listed copyright holders nor the names
20  *    of any contributors may be used to endorse or promote products derived
21  *    from this software without specific prior written permission.
22  *
23  * Alternatively, this software may be distributed under the terms of the
24  * GNU General Public License ("GPL") version 2 as published by the Free
25  * Software Foundation.
26  *
27  * NO WARRANTY
28  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
29  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
30  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR
31  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
32  * HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
33  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
34  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
35  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
36  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
37  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
38  * POSSIBILITY OF SUCH DAMAGES.
39  *
40  * $Id: //depot/aic7xxx/aic7xxx/aic7xxx.c#155 $
41  */
42 
43 #ifdef __linux__
44 #include "aic7xxx_osm.h"
45 #include "aic7xxx_inline.h"
46 #include "aicasm/aicasm_insformat.h"
47 #else
48 #include <sys/cdefs.h>
49 __FBSDID("$FreeBSD$");
50 #include <dev/aic7xxx/aic7xxx_osm.h>
51 #include <dev/aic7xxx/aic7xxx_inline.h>
52 #include <dev/aic7xxx/aicasm/aicasm_insformat.h>
53 #endif
54 
55 /****************************** Softc Data ************************************/
56 struct ahc_softc_tailq ahc_tailq = TAILQ_HEAD_INITIALIZER(ahc_tailq);
57 
58 /***************************** Lookup Tables **********************************/
59 char *ahc_chip_names[] =
60 {
61 	"NONE",
62 	"aic7770",
63 	"aic7850",
64 	"aic7855",
65 	"aic7859",
66 	"aic7860",
67 	"aic7870",
68 	"aic7880",
69 	"aic7895",
70 	"aic7895C",
71 	"aic7890/91",
72 	"aic7896/97",
73 	"aic7892",
74 	"aic7899"
75 };
76 static const u_int num_chip_names = NUM_ELEMENTS(ahc_chip_names);
77 
78 /*
79  * Hardware error codes.
80  */
81 struct ahc_hard_error_entry {
82         uint8_t errno;
83 	char *errmesg;
84 };
85 
86 static struct ahc_hard_error_entry ahc_hard_errors[] = {
87 	{ ILLHADDR,	"Illegal Host Access" },
88 	{ ILLSADDR,	"Illegal Sequencer Address referrenced" },
89 	{ ILLOPCODE,	"Illegal Opcode in sequencer program" },
90 	{ SQPARERR,	"Sequencer Parity Error" },
91 	{ DPARERR,	"Data-path Parity Error" },
92 	{ MPARERR,	"Scratch or SCB Memory Parity Error" },
93 	{ PCIERRSTAT,	"PCI Error detected" },
94 	{ CIOPARERR,	"CIOBUS Parity Error" },
95 };
96 static const u_int num_errors = NUM_ELEMENTS(ahc_hard_errors);
97 
98 static struct ahc_phase_table_entry ahc_phase_table[] =
99 {
100 	{ P_DATAOUT,	MSG_NOOP,		"in Data-out phase"	},
101 	{ P_DATAIN,	MSG_INITIATOR_DET_ERR,	"in Data-in phase"	},
102 	{ P_DATAOUT_DT,	MSG_NOOP,		"in DT Data-out phase"	},
103 	{ P_DATAIN_DT,	MSG_INITIATOR_DET_ERR,	"in DT Data-in phase"	},
104 	{ P_COMMAND,	MSG_NOOP,		"in Command phase"	},
105 	{ P_MESGOUT,	MSG_NOOP,		"in Message-out phase"	},
106 	{ P_STATUS,	MSG_INITIATOR_DET_ERR,	"in Status phase"	},
107 	{ P_MESGIN,	MSG_PARITY_ERROR,	"in Message-in phase"	},
108 	{ P_BUSFREE,	MSG_NOOP,		"while idle"		},
109 	{ 0,		MSG_NOOP,		"in unknown phase"	}
110 };
111 
112 /*
113  * In most cases we only wish to itterate over real phases, so
114  * exclude the last element from the count.
115  */
116 static const u_int num_phases = NUM_ELEMENTS(ahc_phase_table) - 1;
117 
118 /*
119  * Valid SCSIRATE values.  (p. 3-17)
120  * Provides a mapping of tranfer periods in ns to the proper value to
121  * stick in the scsixfer reg.
122  */
123 static struct ahc_syncrate ahc_syncrates[] =
124 {
125       /* ultra2    fast/ultra  period     rate */
126 	{ 0x42,      0x000,      9,      "80.0" },
127 	{ 0x03,      0x000,     10,      "40.0" },
128 	{ 0x04,      0x000,     11,      "33.0" },
129 	{ 0x05,      0x100,     12,      "20.0" },
130 	{ 0x06,      0x110,     15,      "16.0" },
131 	{ 0x07,      0x120,     18,      "13.4" },
132 	{ 0x08,      0x000,     25,      "10.0" },
133 	{ 0x19,      0x010,     31,      "8.0"  },
134 	{ 0x1a,      0x020,     37,      "6.67" },
135 	{ 0x1b,      0x030,     43,      "5.7"  },
136 	{ 0x1c,      0x040,     50,      "5.0"  },
137 	{ 0x00,      0x050,     56,      "4.4"  },
138 	{ 0x00,      0x060,     62,      "4.0"  },
139 	{ 0x00,      0x070,     68,      "3.6"  },
140 	{ 0x00,      0x000,      0,      NULL   }
141 };
142 
143 /* Our Sequencer Program */
144 #include "aic7xxx_seq.h"
145 
146 /**************************** Function Declarations ***************************/
147 static void		ahc_force_renegotiation(struct ahc_softc *ahc,
148 						struct ahc_devinfo *devinfo);
149 static struct ahc_tmode_tstate*
150 			ahc_alloc_tstate(struct ahc_softc *ahc,
151 					 u_int scsi_id, char channel);
152 #ifdef AHC_TARGET_MODE
153 static void		ahc_free_tstate(struct ahc_softc *ahc,
154 					u_int scsi_id, char channel, int force);
155 #endif
156 static struct ahc_syncrate*
157 			ahc_devlimited_syncrate(struct ahc_softc *ahc,
158 					        struct ahc_initiator_tinfo *,
159 						u_int *period,
160 						u_int *ppr_options,
161 						role_t role);
162 static void		ahc_update_pending_scbs(struct ahc_softc *ahc);
163 static void		ahc_fetch_devinfo(struct ahc_softc *ahc,
164 					  struct ahc_devinfo *devinfo);
165 static void		ahc_scb_devinfo(struct ahc_softc *ahc,
166 					struct ahc_devinfo *devinfo,
167 					struct scb *scb);
168 static void		ahc_assert_atn(struct ahc_softc *ahc);
169 static void		ahc_setup_initiator_msgout(struct ahc_softc *ahc,
170 						   struct ahc_devinfo *devinfo,
171 						   struct scb *scb);
172 static void		ahc_build_transfer_msg(struct ahc_softc *ahc,
173 					       struct ahc_devinfo *devinfo);
174 static void		ahc_construct_sdtr(struct ahc_softc *ahc,
175 					   struct ahc_devinfo *devinfo,
176 					   u_int period, u_int offset);
177 static void		ahc_construct_wdtr(struct ahc_softc *ahc,
178 					   struct ahc_devinfo *devinfo,
179 					   u_int bus_width);
180 static void		ahc_construct_ppr(struct ahc_softc *ahc,
181 					  struct ahc_devinfo *devinfo,
182 					  u_int period, u_int offset,
183 					  u_int bus_width, u_int ppr_options);
184 static void		ahc_clear_msg_state(struct ahc_softc *ahc);
185 static void		ahc_handle_proto_violation(struct ahc_softc *ahc);
186 static void		ahc_handle_message_phase(struct ahc_softc *ahc);
187 typedef enum {
188 	AHCMSG_1B,
189 	AHCMSG_2B,
190 	AHCMSG_EXT
191 } ahc_msgtype;
192 static int		ahc_sent_msg(struct ahc_softc *ahc, ahc_msgtype type,
193 				     u_int msgval, int full);
194 static int		ahc_parse_msg(struct ahc_softc *ahc,
195 				      struct ahc_devinfo *devinfo);
196 static int		ahc_handle_msg_reject(struct ahc_softc *ahc,
197 					      struct ahc_devinfo *devinfo);
198 static void		ahc_handle_ign_wide_residue(struct ahc_softc *ahc,
199 						struct ahc_devinfo *devinfo);
200 static void		ahc_reinitialize_dataptrs(struct ahc_softc *ahc);
201 static void		ahc_handle_devreset(struct ahc_softc *ahc,
202 					    struct ahc_devinfo *devinfo,
203 					    cam_status status, char *message,
204 					    int verbose_level);
205 #ifdef AHC_TARGET_MODE
206 static void		ahc_setup_target_msgin(struct ahc_softc *ahc,
207 					       struct ahc_devinfo *devinfo,
208 					       struct scb *scb);
209 #endif
210 
211 static bus_dmamap_callback_t	ahc_dmamap_cb;
212 static void			ahc_build_free_scb_list(struct ahc_softc *ahc);
213 static int			ahc_init_scbdata(struct ahc_softc *ahc);
214 static void			ahc_fini_scbdata(struct ahc_softc *ahc);
215 static void		ahc_qinfifo_requeue(struct ahc_softc *ahc,
216 					    struct scb *prev_scb,
217 					    struct scb *scb);
218 static int		ahc_qinfifo_count(struct ahc_softc *ahc);
219 static u_int		ahc_rem_scb_from_disc_list(struct ahc_softc *ahc,
220 						   u_int prev, u_int scbptr);
221 static void		ahc_add_curscb_to_free_list(struct ahc_softc *ahc);
222 static u_int		ahc_rem_wscb(struct ahc_softc *ahc,
223 				     u_int scbpos, u_int prev);
224 static void		ahc_reset_current_bus(struct ahc_softc *ahc);
225 #ifdef AHC_DUMP_SEQ
226 static void		ahc_dumpseq(struct ahc_softc *ahc);
227 #endif
228 static int		ahc_loadseq(struct ahc_softc *ahc);
229 static int		ahc_check_patch(struct ahc_softc *ahc,
230 					struct patch **start_patch,
231 					u_int start_instr, u_int *skip_addr);
232 static void		ahc_download_instr(struct ahc_softc *ahc,
233 					   u_int instrptr, uint8_t *dconsts);
234 static int		ahc_other_scb_timeout(struct ahc_softc *ahc,
235 					      struct scb *scb,
236 					      struct scb *other_scb);
237 #ifdef AHC_TARGET_MODE
238 static void		ahc_queue_lstate_event(struct ahc_softc *ahc,
239 					       struct ahc_tmode_lstate *lstate,
240 					       u_int initiator_id,
241 					       u_int event_type,
242 					       u_int event_arg);
243 static void		ahc_update_scsiid(struct ahc_softc *ahc,
244 					  u_int targid_mask);
245 static int		ahc_handle_target_cmd(struct ahc_softc *ahc,
246 					      struct target_cmd *cmd);
247 #endif
248 /************************* Sequencer Execution Control ************************/
249 /*
250  * Restart the sequencer program from address zero
251  */
252 void
253 ahc_restart(struct ahc_softc *ahc)
254 {
255 
256 	ahc_pause(ahc);
257 
258 	/* No more pending messages. */
259 	ahc_clear_msg_state(ahc);
260 
261 	ahc_outb(ahc, SCSISIGO, 0);		/* De-assert BSY */
262 	ahc_outb(ahc, MSG_OUT, MSG_NOOP);	/* No message to send */
263 	ahc_outb(ahc, SXFRCTL1, ahc_inb(ahc, SXFRCTL1) & ~BITBUCKET);
264 	ahc_outb(ahc, LASTPHASE, P_BUSFREE);
265 	ahc_outb(ahc, SAVED_SCSIID, 0xFF);
266 	ahc_outb(ahc, SAVED_LUN, 0xFF);
267 
268 	/*
269 	 * Ensure that the sequencer's idea of TQINPOS
270 	 * matches our own.  The sequencer increments TQINPOS
271 	 * only after it sees a DMA complete and a reset could
272 	 * occur before the increment leaving the kernel to believe
273 	 * the command arrived but the sequencer to not.
274 	 */
275 	ahc_outb(ahc, TQINPOS, ahc->tqinfifonext);
276 
277 	/* Always allow reselection */
278 	ahc_outb(ahc, SCSISEQ,
279 		 ahc_inb(ahc, SCSISEQ_TEMPLATE) & (ENSELI|ENRSELI|ENAUTOATNP));
280 	if ((ahc->features & AHC_CMD_CHAN) != 0) {
281 		/* Ensure that no DMA operations are in progress */
282 		ahc_outb(ahc, CCSCBCNT, 0);
283 		ahc_outb(ahc, CCSGCTL, 0);
284 		ahc_outb(ahc, CCSCBCTL, 0);
285 	}
286 	/*
287 	 * If we were in the process of DMA'ing SCB data into
288 	 * an SCB, replace that SCB on the free list.  This prevents
289 	 * an SCB leak.
290 	 */
291 	if ((ahc_inb(ahc, SEQ_FLAGS2) & SCB_DMA) != 0) {
292 		ahc_add_curscb_to_free_list(ahc);
293 		ahc_outb(ahc, SEQ_FLAGS2,
294 			 ahc_inb(ahc, SEQ_FLAGS2) & ~SCB_DMA);
295 	}
296 
297 	/*
298 	 * Clear any pending sequencer interrupt.  It is no
299 	 * longer relevant since we're resetting the Program
300 	 * Counter.
301 	 */
302 	ahc_outb(ahc, CLRINT, CLRSEQINT);
303 
304 	ahc_outb(ahc, MWI_RESIDUAL, 0);
305 	ahc_outb(ahc, SEQCTL, ahc->seqctl);
306 	ahc_outb(ahc, SEQADDR0, 0);
307 	ahc_outb(ahc, SEQADDR1, 0);
308 
309 	ahc_unpause(ahc);
310 }
311 
312 /************************* Input/Output Queues ********************************/
313 void
314 ahc_run_qoutfifo(struct ahc_softc *ahc)
315 {
316 	struct scb *scb;
317 	u_int  scb_index;
318 
319 	ahc_sync_qoutfifo(ahc, BUS_DMASYNC_POSTREAD);
320 	while (ahc->qoutfifo[ahc->qoutfifonext] != SCB_LIST_NULL) {
321 
322 		scb_index = ahc->qoutfifo[ahc->qoutfifonext];
323 		if ((ahc->qoutfifonext & 0x03) == 0x03) {
324 			u_int modnext;
325 
326 			/*
327 			 * Clear 32bits of QOUTFIFO at a time
328 			 * so that we don't clobber an incoming
329 			 * byte DMA to the array on architectures
330 			 * that only support 32bit load and store
331 			 * operations.
332 			 */
333 			modnext = ahc->qoutfifonext & ~0x3;
334 			*((uint32_t *)(&ahc->qoutfifo[modnext])) = 0xFFFFFFFFUL;
335 			aic_dmamap_sync(ahc, ahc->shared_data_dmat,
336 					ahc->shared_data_dmamap,
337 					/*offset*/modnext, /*len*/4,
338 					BUS_DMASYNC_PREREAD);
339 		}
340 		ahc->qoutfifonext++;
341 
342 		scb = ahc_lookup_scb(ahc, scb_index);
343 		if (scb == NULL) {
344 			printf("%s: WARNING no command for scb %d "
345 			       "(cmdcmplt)\nQOUTPOS = %d\n",
346 			       ahc_name(ahc), scb_index,
347 			       (ahc->qoutfifonext - 1) & 0xFF);
348 			continue;
349 		}
350 
351 		/*
352 		 * Save off the residual
353 		 * if there is one.
354 		 */
355 		ahc_update_residual(ahc, scb);
356 		ahc_done(ahc, scb);
357 	}
358 }
359 
360 void
361 ahc_run_untagged_queues(struct ahc_softc *ahc)
362 {
363 	int i;
364 
365 	for (i = 0; i < 16; i++)
366 		ahc_run_untagged_queue(ahc, &ahc->untagged_queues[i]);
367 }
368 
369 void
370 ahc_run_untagged_queue(struct ahc_softc *ahc, struct scb_tailq *queue)
371 {
372 	struct scb *scb;
373 
374 	if (ahc->untagged_queue_lock != 0)
375 		return;
376 
377 	if ((scb = TAILQ_FIRST(queue)) != NULL
378 	 && (scb->flags & SCB_ACTIVE) == 0) {
379 		scb->flags |= SCB_ACTIVE;
380 		/*
381 		 * Timers are disabled while recovery is in progress.
382 		 */
383 		aic_scb_timer_start(scb);
384 		ahc_queue_scb(ahc, scb);
385 	}
386 }
387 
388 /************************* Interrupt Handling *********************************/
389 void
390 ahc_handle_brkadrint(struct ahc_softc *ahc)
391 {
392 	/*
393 	 * We upset the sequencer :-(
394 	 * Lookup the error message
395 	 */
396 	int i;
397 	int error;
398 
399 	error = ahc_inb(ahc, ERROR);
400 	for (i = 0; error != 1 && i < num_errors; i++)
401 		error >>= 1;
402 	printf("%s: brkadrint, %s at seqaddr = 0x%x\n",
403 	       ahc_name(ahc), ahc_hard_errors[i].errmesg,
404 	       ahc_inb(ahc, SEQADDR0) |
405 	       (ahc_inb(ahc, SEQADDR1) << 8));
406 
407 	ahc_dump_card_state(ahc);
408 
409 	/* Tell everyone that this HBA is no longer available */
410 	ahc_abort_scbs(ahc, CAM_TARGET_WILDCARD, ALL_CHANNELS,
411 		       CAM_LUN_WILDCARD, SCB_LIST_NULL, ROLE_UNKNOWN,
412 		       CAM_NO_HBA);
413 
414 	/* Disable all interrupt sources by resetting the controller */
415 	ahc_shutdown(ahc);
416 }
417 
418 void
419 ahc_handle_seqint(struct ahc_softc *ahc, u_int intstat)
420 {
421 	struct scb *scb;
422 	struct ahc_devinfo devinfo;
423 
424 	ahc_fetch_devinfo(ahc, &devinfo);
425 
426 	/*
427 	 * Clear the upper byte that holds SEQINT status
428 	 * codes and clear the SEQINT bit. We will unpause
429 	 * the sequencer, if appropriate, after servicing
430 	 * the request.
431 	 */
432 	ahc_outb(ahc, CLRINT, CLRSEQINT);
433 	switch (intstat & SEQINT_MASK) {
434 	case BAD_STATUS:
435 	{
436 		u_int  scb_index;
437 		struct hardware_scb *hscb;
438 
439 		/*
440 		 * Set the default return value to 0 (don't
441 		 * send sense).  The sense code will change
442 		 * this if needed.
443 		 */
444 		ahc_outb(ahc, RETURN_1, 0);
445 
446 		/*
447 		 * The sequencer will notify us when a command
448 		 * has an error that would be of interest to
449 		 * the kernel.  This allows us to leave the sequencer
450 		 * running in the common case of command completes
451 		 * without error.  The sequencer will already have
452 		 * dma'd the SCB back up to us, so we can reference
453 		 * the in kernel copy directly.
454 		 */
455 		scb_index = ahc_inb(ahc, SCB_TAG);
456 		scb = ahc_lookup_scb(ahc, scb_index);
457 		if (scb == NULL) {
458 			ahc_print_devinfo(ahc, &devinfo);
459 			printf("ahc_intr - referenced scb "
460 			       "not valid during seqint 0x%x scb(%d)\n",
461 			       intstat, scb_index);
462 			ahc_dump_card_state(ahc);
463 			panic("for safety");
464 			goto unpause;
465 		}
466 
467 		hscb = scb->hscb;
468 
469 		/* Don't want to clobber the original sense code */
470 		if ((scb->flags & SCB_SENSE) != 0) {
471 			/*
472 			 * Clear the SCB_SENSE Flag and have
473 			 * the sequencer do a normal command
474 			 * complete.
475 			 */
476 			scb->flags &= ~SCB_SENSE;
477 			aic_set_transaction_status(scb, CAM_AUTOSENSE_FAIL);
478 			break;
479 		}
480 		aic_set_transaction_status(scb, CAM_SCSI_STATUS_ERROR);
481 		/* Freeze the queue until the client sees the error. */
482 		ahc_freeze_devq(ahc, scb);
483 		aic_freeze_scb(scb);
484 		aic_set_scsi_status(scb, hscb->shared_data.status.scsi_status);
485 		switch (hscb->shared_data.status.scsi_status) {
486 		case SCSI_STATUS_OK:
487 			printf("%s: Interrupted for staus of 0???\n",
488 			       ahc_name(ahc));
489 			break;
490 		case SCSI_STATUS_CMD_TERMINATED:
491 		case SCSI_STATUS_CHECK_COND:
492 		{
493 			struct ahc_dma_seg *sg;
494 			struct scsi_sense *sc;
495 			struct ahc_initiator_tinfo *targ_info;
496 			struct ahc_tmode_tstate *tstate;
497 			struct ahc_transinfo *tinfo;
498 #ifdef AHC_DEBUG
499 			if (ahc_debug & AHC_SHOW_SENSE) {
500 				ahc_print_path(ahc, scb);
501 				printf("SCB %d: requests Check Status\n",
502 				       scb->hscb->tag);
503 			}
504 #endif
505 
506 			if (aic_perform_autosense(scb) == 0)
507 				break;
508 
509 			targ_info = ahc_fetch_transinfo(ahc,
510 							devinfo.channel,
511 							devinfo.our_scsiid,
512 							devinfo.target,
513 							&tstate);
514 			tinfo = &targ_info->curr;
515 			sg = scb->sg_list;
516 			sc = (struct scsi_sense *)(&hscb->shared_data.cdb);
517 			/*
518 			 * Save off the residual if there is one.
519 			 */
520 			ahc_update_residual(ahc, scb);
521 #ifdef AHC_DEBUG
522 			if (ahc_debug & AHC_SHOW_SENSE) {
523 				ahc_print_path(ahc, scb);
524 				printf("Sending Sense\n");
525 			}
526 #endif
527 			sg->addr = ahc_get_sense_bufaddr(ahc, scb);
528 			sg->len = aic_get_sense_bufsize(ahc, scb);
529 			sg->len |= AHC_DMA_LAST_SEG;
530 
531 			/* Fixup byte order */
532 			sg->addr = aic_htole32(sg->addr);
533 			sg->len = aic_htole32(sg->len);
534 
535 			sc->opcode = REQUEST_SENSE;
536 			sc->byte2 = 0;
537 			if (tinfo->protocol_version <= SCSI_REV_2
538 			 && SCB_GET_LUN(scb) < 8)
539 				sc->byte2 = SCB_GET_LUN(scb) << 5;
540 			sc->unused[0] = 0;
541 			sc->unused[1] = 0;
542 			sc->length = sg->len;
543 			sc->control = 0;
544 
545 			/*
546 			 * We can't allow the target to disconnect.
547 			 * This will be an untagged transaction and
548 			 * having the target disconnect will make this
549 			 * transaction indestinguishable from outstanding
550 			 * tagged transactions.
551 			 */
552 			hscb->control = 0;
553 
554 			/*
555 			 * This request sense could be because the
556 			 * the device lost power or in some other
557 			 * way has lost our transfer negotiations.
558 			 * Renegotiate if appropriate.  Unit attention
559 			 * errors will be reported before any data
560 			 * phases occur.
561 			 */
562 			if (aic_get_residual(scb)
563 			 == aic_get_transfer_length(scb)) {
564 				ahc_update_neg_request(ahc, &devinfo,
565 						       tstate, targ_info,
566 						       AHC_NEG_IF_NON_ASYNC);
567 			}
568 			if (tstate->auto_negotiate & devinfo.target_mask) {
569 				hscb->control |= MK_MESSAGE;
570 				scb->flags &= ~SCB_NEGOTIATE;
571 				scb->flags |= SCB_AUTO_NEGOTIATE;
572 			}
573 			hscb->cdb_len = sizeof(*sc);
574 			hscb->dataptr = sg->addr;
575 			hscb->datacnt = sg->len;
576 			hscb->sgptr = scb->sg_list_phys | SG_FULL_RESID;
577 			hscb->sgptr = aic_htole32(hscb->sgptr);
578 			scb->sg_count = 1;
579 			scb->flags |= SCB_SENSE;
580 			ahc_qinfifo_requeue_tail(ahc, scb);
581 			ahc_outb(ahc, RETURN_1, SEND_SENSE);
582 			/*
583 			 * Ensure we have enough time to actually
584 			 * retrieve the sense, but only schedule
585 			 * the timer if we are not in recovery or
586 			 * this is a recovery SCB that is allowed
587 			 * to have an active timer.
588 			 */
589 			if (ahc->scb_data->recovery_scbs == 0
590 			 || (scb->flags & SCB_RECOVERY_SCB) != 0)
591 				aic_scb_timer_reset(scb, 5 * 1000);
592 			break;
593 		}
594 		default:
595 			break;
596 		}
597 		break;
598 	}
599 	case NO_MATCH:
600 	{
601 		/* Ensure we don't leave the selection hardware on */
602 		ahc_outb(ahc, SCSISEQ,
603 			 ahc_inb(ahc, SCSISEQ) & (ENSELI|ENRSELI|ENAUTOATNP));
604 
605 		printf("%s:%c:%d: no active SCB for reconnecting "
606 		       "target - issuing BUS DEVICE RESET\n",
607 		       ahc_name(ahc), devinfo.channel, devinfo.target);
608 		printf("SAVED_SCSIID == 0x%x, SAVED_LUN == 0x%x, "
609 		       "ARG_1 == 0x%x ACCUM = 0x%x\n",
610 		       ahc_inb(ahc, SAVED_SCSIID), ahc_inb(ahc, SAVED_LUN),
611 		       ahc_inb(ahc, ARG_1), ahc_inb(ahc, ACCUM));
612 		printf("SEQ_FLAGS == 0x%x, SCBPTR == 0x%x, BTT == 0x%x, "
613 		       "SINDEX == 0x%x\n",
614 		       ahc_inb(ahc, SEQ_FLAGS), ahc_inb(ahc, SCBPTR),
615 		       ahc_index_busy_tcl(ahc,
616 			    BUILD_TCL(ahc_inb(ahc, SAVED_SCSIID),
617 				      ahc_inb(ahc, SAVED_LUN))),
618 		       ahc_inb(ahc, SINDEX));
619 		printf("SCSIID == 0x%x, SCB_SCSIID == 0x%x, SCB_LUN == 0x%x, "
620 		       "SCB_TAG == 0x%x, SCB_CONTROL == 0x%x\n",
621 		       ahc_inb(ahc, SCSIID), ahc_inb(ahc, SCB_SCSIID),
622 		       ahc_inb(ahc, SCB_LUN), ahc_inb(ahc, SCB_TAG),
623 		       ahc_inb(ahc, SCB_CONTROL));
624 		printf("SCSIBUSL == 0x%x, SCSISIGI == 0x%x\n",
625 		       ahc_inb(ahc, SCSIBUSL), ahc_inb(ahc, SCSISIGI));
626 		printf("SXFRCTL0 == 0x%x\n", ahc_inb(ahc, SXFRCTL0));
627 		printf("SEQCTL == 0x%x\n", ahc_inb(ahc, SEQCTL));
628 		ahc_dump_card_state(ahc);
629 		ahc->msgout_buf[0] = MSG_BUS_DEV_RESET;
630 		ahc->msgout_len = 1;
631 		ahc->msgout_index = 0;
632 		ahc->msg_type = MSG_TYPE_INITIATOR_MSGOUT;
633 		ahc_outb(ahc, MSG_OUT, HOST_MSG);
634 		ahc_assert_atn(ahc);
635 		break;
636 	}
637 	case SEND_REJECT:
638 	{
639 		u_int rejbyte = ahc_inb(ahc, ACCUM);
640 		printf("%s:%c:%d: Warning - unknown message received from "
641 		       "target (0x%x).  Rejecting\n",
642 		       ahc_name(ahc), devinfo.channel, devinfo.target, rejbyte);
643 		break;
644 	}
645 	case PROTO_VIOLATION:
646 	{
647 		ahc_handle_proto_violation(ahc);
648 		break;
649 	}
650 	case IGN_WIDE_RES:
651 		ahc_handle_ign_wide_residue(ahc, &devinfo);
652 		break;
653 	case PDATA_REINIT:
654 		ahc_reinitialize_dataptrs(ahc);
655 		break;
656 	case BAD_PHASE:
657 	{
658 		u_int lastphase;
659 
660 		lastphase = ahc_inb(ahc, LASTPHASE);
661 		printf("%s:%c:%d: unknown scsi bus phase %x, "
662 		       "lastphase = 0x%x.  Attempting to continue\n",
663 		       ahc_name(ahc), devinfo.channel, devinfo.target,
664 		       lastphase, ahc_inb(ahc, SCSISIGI));
665 		break;
666 	}
667 	case MISSED_BUSFREE:
668 	{
669 		u_int lastphase;
670 
671 		lastphase = ahc_inb(ahc, LASTPHASE);
672 		printf("%s:%c:%d: Missed busfree. "
673 		       "Lastphase = 0x%x, Curphase = 0x%x\n",
674 		       ahc_name(ahc), devinfo.channel, devinfo.target,
675 		       lastphase, ahc_inb(ahc, SCSISIGI));
676 		ahc_restart(ahc);
677 		return;
678 	}
679 	case HOST_MSG_LOOP:
680 	{
681 		/*
682 		 * The sequencer has encountered a message phase
683 		 * that requires host assistance for completion.
684 		 * While handling the message phase(s), we will be
685 		 * notified by the sequencer after each byte is
686 		 * transfered so we can track bus phase changes.
687 		 *
688 		 * If this is the first time we've seen a HOST_MSG_LOOP
689 		 * interrupt, initialize the state of the host message
690 		 * loop.
691 		 */
692 		if (ahc->msg_type == MSG_TYPE_NONE) {
693 			struct scb *scb;
694 			u_int scb_index;
695 			u_int bus_phase;
696 
697 			bus_phase = ahc_inb(ahc, SCSISIGI) & PHASE_MASK;
698 			if (bus_phase != P_MESGIN
699 			 && bus_phase != P_MESGOUT) {
700 				printf("ahc_intr: HOST_MSG_LOOP bad "
701 				       "phase 0x%x\n",
702 				      bus_phase);
703 				/*
704 				 * Probably transitioned to bus free before
705 				 * we got here.  Just punt the message.
706 				 */
707 				ahc_clear_intstat(ahc);
708 				ahc_restart(ahc);
709 				return;
710 			}
711 
712 			scb_index = ahc_inb(ahc, SCB_TAG);
713 			scb = ahc_lookup_scb(ahc, scb_index);
714 			if (devinfo.role == ROLE_INITIATOR) {
715 				if (scb == NULL)
716 					panic("HOST_MSG_LOOP with "
717 					      "invalid SCB %x\n", scb_index);
718 
719 				if (bus_phase == P_MESGOUT)
720 					ahc_setup_initiator_msgout(ahc,
721 								   &devinfo,
722 								   scb);
723 				else {
724 					ahc->msg_type =
725 					    MSG_TYPE_INITIATOR_MSGIN;
726 					ahc->msgin_index = 0;
727 				}
728 			}
729 #ifdef AHC_TARGET_MODE
730 			else {
731 				if (bus_phase == P_MESGOUT) {
732 					ahc->msg_type =
733 					    MSG_TYPE_TARGET_MSGOUT;
734 					ahc->msgin_index = 0;
735 				}
736 				else
737 					ahc_setup_target_msgin(ahc,
738 							       &devinfo,
739 							       scb);
740 			}
741 #endif
742 		}
743 
744 		ahc_handle_message_phase(ahc);
745 		break;
746 	}
747 	case PERR_DETECTED:
748 	{
749 		/*
750 		 * If we've cleared the parity error interrupt
751 		 * but the sequencer still believes that SCSIPERR
752 		 * is true, it must be that the parity error is
753 		 * for the currently presented byte on the bus,
754 		 * and we are not in a phase (data-in) where we will
755 		 * eventually ack this byte.  Ack the byte and
756 		 * throw it away in the hope that the target will
757 		 * take us to message out to deliver the appropriate
758 		 * error message.
759 		 */
760 		if ((intstat & SCSIINT) == 0
761 		 && (ahc_inb(ahc, SSTAT1) & SCSIPERR) != 0) {
762 
763 			if ((ahc->features & AHC_DT) == 0) {
764 				u_int curphase;
765 
766 				/*
767 				 * The hardware will only let you ack bytes
768 				 * if the expected phase in SCSISIGO matches
769 				 * the current phase.  Make sure this is
770 				 * currently the case.
771 				 */
772 				curphase = ahc_inb(ahc, SCSISIGI) & PHASE_MASK;
773 				ahc_outb(ahc, LASTPHASE, curphase);
774 				ahc_outb(ahc, SCSISIGO, curphase);
775 			}
776 			if ((ahc_inb(ahc, SCSISIGI) & (CDI|MSGI)) == 0) {
777 				int wait;
778 
779 				/*
780 				 * In a data phase.  Faster to bitbucket
781 				 * the data than to individually ack each
782 				 * byte.  This is also the only strategy
783 				 * that will work with AUTOACK enabled.
784 				 */
785 				ahc_outb(ahc, SXFRCTL1,
786 					 ahc_inb(ahc, SXFRCTL1) | BITBUCKET);
787 				wait = 5000;
788 				while (--wait != 0) {
789 					if ((ahc_inb(ahc, SCSISIGI)
790 					  & (CDI|MSGI)) != 0)
791 						break;
792 					aic_delay(100);
793 				}
794 				ahc_outb(ahc, SXFRCTL1,
795 					 ahc_inb(ahc, SXFRCTL1) & ~BITBUCKET);
796 				if (wait == 0) {
797 					struct	scb *scb;
798 					u_int	scb_index;
799 
800 					ahc_print_devinfo(ahc, &devinfo);
801 					printf("Unable to clear parity error.  "
802 					       "Resetting bus.\n");
803 					scb_index = ahc_inb(ahc, SCB_TAG);
804 					scb = ahc_lookup_scb(ahc, scb_index);
805 					if (scb != NULL)
806 						aic_set_transaction_status(scb,
807 						    CAM_UNCOR_PARITY);
808 					ahc_reset_channel(ahc, devinfo.channel,
809 							  /*init reset*/TRUE);
810 				}
811 			} else {
812 				ahc_inb(ahc, SCSIDATL);
813 			}
814 		}
815 		break;
816 	}
817 	case DATA_OVERRUN:
818 	{
819 		/*
820 		 * When the sequencer detects an overrun, it
821 		 * places the controller in "BITBUCKET" mode
822 		 * and allows the target to complete its transfer.
823 		 * Unfortunately, none of the counters get updated
824 		 * when the controller is in this mode, so we have
825 		 * no way of knowing how large the overrun was.
826 		 */
827 		u_int scbindex = ahc_inb(ahc, SCB_TAG);
828 		u_int lastphase = ahc_inb(ahc, LASTPHASE);
829 		u_int i;
830 
831 		scb = ahc_lookup_scb(ahc, scbindex);
832 		for (i = 0; i < num_phases; i++) {
833 			if (lastphase == ahc_phase_table[i].phase)
834 				break;
835 		}
836 		ahc_print_path(ahc, scb);
837 		printf("data overrun detected %s."
838 		       "  Tag == 0x%x.\n",
839 		       ahc_phase_table[i].phasemsg,
840   		       scb->hscb->tag);
841 		ahc_print_path(ahc, scb);
842 		printf("%s seen Data Phase.  Length = %ld.  NumSGs = %d.\n",
843 		       ahc_inb(ahc, SEQ_FLAGS) & DPHASE ? "Have" : "Haven't",
844 		       aic_get_transfer_length(scb), scb->sg_count);
845 		if (scb->sg_count > 0) {
846 			for (i = 0; i < scb->sg_count; i++) {
847 
848 				printf("sg[%d] - Addr 0x%x%x : Length %d\n",
849 				       i,
850 				       (aic_le32toh(scb->sg_list[i].len) >> 24
851 				        & SG_HIGH_ADDR_BITS),
852 				       aic_le32toh(scb->sg_list[i].addr),
853 				       aic_le32toh(scb->sg_list[i].len)
854 				       & AHC_SG_LEN_MASK);
855 			}
856 		}
857 		/*
858 		 * Set this and it will take effect when the
859 		 * target does a command complete.
860 		 */
861 		ahc_freeze_devq(ahc, scb);
862 		if ((scb->flags & SCB_SENSE) == 0) {
863 			aic_set_transaction_status(scb, CAM_DATA_RUN_ERR);
864 		} else {
865 			scb->flags &= ~SCB_SENSE;
866 			aic_set_transaction_status(scb, CAM_AUTOSENSE_FAIL);
867 		}
868 		aic_freeze_scb(scb);
869 
870 		if ((ahc->features & AHC_ULTRA2) != 0) {
871 			/*
872 			 * Clear the channel in case we return
873 			 * to data phase later.
874 			 */
875 			ahc_outb(ahc, SXFRCTL0,
876 				 ahc_inb(ahc, SXFRCTL0) | CLRSTCNT|CLRCHN);
877 			ahc_outb(ahc, SXFRCTL0,
878 				 ahc_inb(ahc, SXFRCTL0) | CLRSTCNT|CLRCHN);
879 		}
880 		if ((ahc->flags & AHC_39BIT_ADDRESSING) != 0) {
881 			u_int dscommand1;
882 
883 			/* Ensure HHADDR is 0 for future DMA operations. */
884 			dscommand1 = ahc_inb(ahc, DSCOMMAND1);
885 			ahc_outb(ahc, DSCOMMAND1, dscommand1 | HADDLDSEL0);
886 			ahc_outb(ahc, HADDR, 0);
887 			ahc_outb(ahc, DSCOMMAND1, dscommand1);
888 		}
889 		break;
890 	}
891 	case MKMSG_FAILED:
892 	{
893 		u_int scbindex;
894 
895 		printf("%s:%c:%d:%d: Attempt to issue message failed\n",
896 		       ahc_name(ahc), devinfo.channel, devinfo.target,
897 		       devinfo.lun);
898 		scbindex = ahc_inb(ahc, SCB_TAG);
899 		scb = ahc_lookup_scb(ahc, scbindex);
900 		if (scb != NULL
901 		 && (scb->flags & SCB_RECOVERY_SCB) != 0)
902 			/*
903 			 * Ensure that we didn't put a second instance of this
904 			 * SCB into the QINFIFO.
905 			 */
906 			ahc_search_qinfifo(ahc, SCB_GET_TARGET(ahc, scb),
907 					   SCB_GET_CHANNEL(ahc, scb),
908 					   SCB_GET_LUN(scb), scb->hscb->tag,
909 					   ROLE_INITIATOR, /*status*/0,
910 					   SEARCH_REMOVE);
911 		break;
912 	}
913 	case NO_FREE_SCB:
914 	{
915 		printf("%s: No free or disconnected SCBs\n", ahc_name(ahc));
916 		ahc_dump_card_state(ahc);
917 		panic("for safety");
918 		break;
919 	}
920 	case SCB_MISMATCH:
921 	{
922 		u_int scbptr;
923 
924 		scbptr = ahc_inb(ahc, SCBPTR);
925 		printf("Bogus TAG after DMA.  SCBPTR %d, tag %d, our tag %d\n",
926 		       scbptr, ahc_inb(ahc, ARG_1),
927 		       ahc->scb_data->hscbs[scbptr].tag);
928 		ahc_dump_card_state(ahc);
929 		panic("for saftey");
930 		break;
931 	}
932 	case OUT_OF_RANGE:
933 	{
934 		printf("%s: BTT calculation out of range\n", ahc_name(ahc));
935 		printf("SAVED_SCSIID == 0x%x, SAVED_LUN == 0x%x, "
936 		       "ARG_1 == 0x%x ACCUM = 0x%x\n",
937 		       ahc_inb(ahc, SAVED_SCSIID), ahc_inb(ahc, SAVED_LUN),
938 		       ahc_inb(ahc, ARG_1), ahc_inb(ahc, ACCUM));
939 		printf("SEQ_FLAGS == 0x%x, SCBPTR == 0x%x, BTT == 0x%x, "
940 		       "SINDEX == 0x%x\n, A == 0x%x\n",
941 		       ahc_inb(ahc, SEQ_FLAGS), ahc_inb(ahc, SCBPTR),
942 		       ahc_index_busy_tcl(ahc,
943 			    BUILD_TCL(ahc_inb(ahc, SAVED_SCSIID),
944 				      ahc_inb(ahc, SAVED_LUN))),
945 		       ahc_inb(ahc, SINDEX),
946 		       ahc_inb(ahc, ACCUM));
947 		printf("SCSIID == 0x%x, SCB_SCSIID == 0x%x, SCB_LUN == 0x%x, "
948 		       "SCB_TAG == 0x%x, SCB_CONTROL == 0x%x\n",
949 		       ahc_inb(ahc, SCSIID), ahc_inb(ahc, SCB_SCSIID),
950 		       ahc_inb(ahc, SCB_LUN), ahc_inb(ahc, SCB_TAG),
951 		       ahc_inb(ahc, SCB_CONTROL));
952 		printf("SCSIBUSL == 0x%x, SCSISIGI == 0x%x\n",
953 		       ahc_inb(ahc, SCSIBUSL), ahc_inb(ahc, SCSISIGI));
954 		ahc_dump_card_state(ahc);
955 		panic("for safety");
956 		break;
957 	}
958 	default:
959 		printf("ahc_intr: seqint, "
960 		       "intstat == 0x%x, scsisigi = 0x%x\n",
961 		       intstat, ahc_inb(ahc, SCSISIGI));
962 		break;
963 	}
964 unpause:
965 	/*
966 	 *  The sequencer is paused immediately on
967 	 *  a SEQINT, so we should restart it when
968 	 *  we're done.
969 	 */
970 	ahc_unpause(ahc);
971 }
972 
973 void
974 ahc_handle_scsiint(struct ahc_softc *ahc, u_int intstat)
975 {
976 	u_int	scb_index;
977 	u_int	status0;
978 	u_int	status;
979 	struct	scb *scb;
980 	char	cur_channel;
981 	char	intr_channel;
982 
983 	if ((ahc->features & AHC_TWIN) != 0
984 	 && ((ahc_inb(ahc, SBLKCTL) & SELBUSB) != 0))
985 		cur_channel = 'B';
986 	else
987 		cur_channel = 'A';
988 	intr_channel = cur_channel;
989 
990 	if ((ahc->features & AHC_ULTRA2) != 0)
991 		status0 = ahc_inb(ahc, SSTAT0) & IOERR;
992 	else
993 		status0 = 0;
994 	status = ahc_inb(ahc, SSTAT1) & (SELTO|SCSIRSTI|BUSFREE|SCSIPERR);
995 	if (status == 0 && status0 == 0) {
996 		if ((ahc->features & AHC_TWIN) != 0) {
997 			/* Try the other channel */
998 		 	ahc_outb(ahc, SBLKCTL, ahc_inb(ahc, SBLKCTL) ^ SELBUSB);
999 			status = ahc_inb(ahc, SSTAT1)
1000 			       & (SELTO|SCSIRSTI|BUSFREE|SCSIPERR);
1001 			intr_channel = (cur_channel == 'A') ? 'B' : 'A';
1002 		}
1003 		if (status == 0) {
1004 			printf("%s: Spurious SCSI interrupt\n", ahc_name(ahc));
1005 			ahc_outb(ahc, CLRINT, CLRSCSIINT);
1006 			ahc_unpause(ahc);
1007 			return;
1008 		}
1009 	}
1010 
1011 	/* Make sure the sequencer is in a safe location. */
1012 	ahc_clear_critical_section(ahc);
1013 
1014 	scb_index = ahc_inb(ahc, SCB_TAG);
1015 	scb = ahc_lookup_scb(ahc, scb_index);
1016 	if (scb != NULL
1017 	 && (ahc_inb(ahc, SEQ_FLAGS) & NOT_IDENTIFIED) != 0)
1018 		scb = NULL;
1019 
1020 	if ((ahc->features & AHC_ULTRA2) != 0
1021 	 && (status0 & IOERR) != 0) {
1022 		int now_lvd;
1023 
1024 		now_lvd = ahc_inb(ahc, SBLKCTL) & ENAB40;
1025 		printf("%s: Transceiver State Has Changed to %s mode\n",
1026 		       ahc_name(ahc), now_lvd ? "LVD" : "SE");
1027 		ahc_outb(ahc, CLRSINT0, CLRIOERR);
1028 		/*
1029 		 * When transitioning to SE mode, the reset line
1030 		 * glitches, triggering an arbitration bug in some
1031 		 * Ultra2 controllers.  This bug is cleared when we
1032 		 * assert the reset line.  Since a reset glitch has
1033 		 * already occurred with this transition and a
1034 		 * transceiver state change is handled just like
1035 		 * a bus reset anyway, asserting the reset line
1036 		 * ourselves is safe.
1037 		 */
1038 		ahc_reset_channel(ahc, intr_channel,
1039 				 /*Initiate Reset*/now_lvd == 0);
1040 	} else if ((status & SCSIRSTI) != 0) {
1041 		printf("%s: Someone reset channel %c\n",
1042 			ahc_name(ahc), intr_channel);
1043 		if (intr_channel != cur_channel)
1044 		 	ahc_outb(ahc, SBLKCTL, ahc_inb(ahc, SBLKCTL) ^ SELBUSB);
1045 		ahc_reset_channel(ahc, intr_channel, /*Initiate Reset*/FALSE);
1046 	} else if ((status & SCSIPERR) != 0) {
1047 		/*
1048 		 * Determine the bus phase and queue an appropriate message.
1049 		 * SCSIPERR is latched true as soon as a parity error
1050 		 * occurs.  If the sequencer acked the transfer that
1051 		 * caused the parity error and the currently presented
1052 		 * transfer on the bus has correct parity, SCSIPERR will
1053 		 * be cleared by CLRSCSIPERR.  Use this to determine if
1054 		 * we should look at the last phase the sequencer recorded,
1055 		 * or the current phase presented on the bus.
1056 		 */
1057 		struct	ahc_devinfo devinfo;
1058 		u_int	mesg_out;
1059 		u_int	curphase;
1060 		u_int	errorphase;
1061 		u_int	lastphase;
1062 		u_int	scsirate;
1063 		u_int	i;
1064 		u_int	sstat2;
1065 		int	silent;
1066 
1067 		lastphase = ahc_inb(ahc, LASTPHASE);
1068 		curphase = ahc_inb(ahc, SCSISIGI) & PHASE_MASK;
1069 		sstat2 = ahc_inb(ahc, SSTAT2);
1070 		ahc_outb(ahc, CLRSINT1, CLRSCSIPERR);
1071 		/*
1072 		 * For all phases save DATA, the sequencer won't
1073 		 * automatically ack a byte that has a parity error
1074 		 * in it.  So the only way that the current phase
1075 		 * could be 'data-in' is if the parity error is for
1076 		 * an already acked byte in the data phase.  During
1077 		 * synchronous data-in transfers, we may actually
1078 		 * ack bytes before latching the current phase in
1079 		 * LASTPHASE, leading to the discrepancy between
1080 		 * curphase and lastphase.
1081 		 */
1082 		if ((ahc_inb(ahc, SSTAT1) & SCSIPERR) != 0
1083 		 || curphase == P_DATAIN || curphase == P_DATAIN_DT)
1084 			errorphase = curphase;
1085 		else
1086 			errorphase = lastphase;
1087 
1088 		for (i = 0; i < num_phases; i++) {
1089 			if (errorphase == ahc_phase_table[i].phase)
1090 				break;
1091 		}
1092 		mesg_out = ahc_phase_table[i].mesg_out;
1093 		silent = FALSE;
1094 		if (scb != NULL) {
1095 			if (SCB_IS_SILENT(scb))
1096 				silent = TRUE;
1097 			else
1098 				ahc_print_path(ahc, scb);
1099 			scb->flags |= SCB_TRANSMISSION_ERROR;
1100 		} else
1101 			printf("%s:%c:%d: ", ahc_name(ahc), intr_channel,
1102 			       SCSIID_TARGET(ahc, ahc_inb(ahc, SAVED_SCSIID)));
1103 		scsirate = ahc_inb(ahc, SCSIRATE);
1104 		if (silent == FALSE) {
1105 			printf("parity error detected %s. "
1106 			       "SEQADDR(0x%x) SCSIRATE(0x%x)\n",
1107 			       ahc_phase_table[i].phasemsg,
1108 			       ahc_inw(ahc, SEQADDR0),
1109 			       scsirate);
1110 			if ((ahc->features & AHC_DT) != 0) {
1111 				if ((sstat2 & CRCVALERR) != 0)
1112 					printf("\tCRC Value Mismatch\n");
1113 				if ((sstat2 & CRCENDERR) != 0)
1114 					printf("\tNo terminal CRC packet "
1115 					       "recevied\n");
1116 				if ((sstat2 & CRCREQERR) != 0)
1117 					printf("\tIllegal CRC packet "
1118 					       "request\n");
1119 				if ((sstat2 & DUAL_EDGE_ERR) != 0)
1120 					printf("\tUnexpected %sDT Data Phase\n",
1121 					       (scsirate & SINGLE_EDGE)
1122 					     ? "" : "non-");
1123 			}
1124 		}
1125 
1126 		if ((ahc->features & AHC_DT) != 0
1127 		 && (sstat2 & DUAL_EDGE_ERR) != 0) {
1128 			/*
1129 			 * This error applies regardless of
1130 			 * data direction, so ignore the value
1131 			 * in the phase table.
1132 			 */
1133 			mesg_out = MSG_INITIATOR_DET_ERR;
1134 		}
1135 
1136 		/*
1137 		 * We've set the hardware to assert ATN if we
1138 		 * get a parity error on "in" phases, so all we
1139 		 * need to do is stuff the message buffer with
1140 		 * the appropriate message.  "In" phases have set
1141 		 * mesg_out to something other than MSG_NOP.
1142 		 */
1143 		if (mesg_out != MSG_NOOP) {
1144 			if (ahc->msg_type != MSG_TYPE_NONE)
1145 				ahc->send_msg_perror = TRUE;
1146 			else
1147 				ahc_outb(ahc, MSG_OUT, mesg_out);
1148 		}
1149 		/*
1150 		 * Force a renegotiation with this target just in
1151 		 * case we are out of sync for some external reason
1152 		 * unknown (or unreported) by the target.
1153 		 */
1154 		ahc_fetch_devinfo(ahc, &devinfo);
1155 		ahc_force_renegotiation(ahc, &devinfo);
1156 
1157 		ahc_outb(ahc, CLRINT, CLRSCSIINT);
1158 		ahc_unpause(ahc);
1159 	} else if ((status & SELTO) != 0) {
1160 		u_int	scbptr;
1161 
1162 		/* Stop the selection */
1163 		ahc_outb(ahc, SCSISEQ, 0);
1164 
1165 		/* No more pending messages */
1166 		ahc_clear_msg_state(ahc);
1167 
1168 		/* Clear interrupt state */
1169 		ahc_outb(ahc, SIMODE1, ahc_inb(ahc, SIMODE1) & ~ENBUSFREE);
1170 		ahc_outb(ahc, CLRSINT1, CLRSELTIMEO|CLRBUSFREE|CLRSCSIPERR);
1171 
1172 		/*
1173 		 * Although the driver does not care about the
1174 		 * 'Selection in Progress' status bit, the busy
1175 		 * LED does.  SELINGO is only cleared by a sucessfull
1176 		 * selection, so we must manually clear it to insure
1177 		 * the LED turns off just incase no future successful
1178 		 * selections occur (e.g. no devices on the bus).
1179 		 */
1180 		ahc_outb(ahc, CLRSINT0, CLRSELINGO);
1181 
1182 		scbptr = ahc_inb(ahc, WAITING_SCBH);
1183 		ahc_outb(ahc, SCBPTR, scbptr);
1184 		scb_index = ahc_inb(ahc, SCB_TAG);
1185 
1186 		scb = ahc_lookup_scb(ahc, scb_index);
1187 		if (scb == NULL) {
1188 			printf("%s: ahc_intr - referenced scb not "
1189 			       "valid during SELTO scb(%d, %d)\n",
1190 			       ahc_name(ahc), scbptr, scb_index);
1191 			ahc_dump_card_state(ahc);
1192 		} else {
1193 			struct ahc_devinfo devinfo;
1194 #ifdef AHC_DEBUG
1195 			if ((ahc_debug & AHC_SHOW_SELTO) != 0) {
1196 				ahc_print_path(ahc, scb);
1197 				printf("Saw Selection Timeout for SCB 0x%x\n",
1198 				       scb_index);
1199 			}
1200 #endif
1201 			ahc_scb_devinfo(ahc, &devinfo, scb);
1202 			aic_set_transaction_status(scb, CAM_SEL_TIMEOUT);
1203 			ahc_freeze_devq(ahc, scb);
1204 
1205 			/*
1206 			 * Cancel any pending transactions on the device
1207 			 * now that it seems to be missing.  This will
1208 			 * also revert us to async/narrow transfers until
1209 			 * we can renegotiate with the device.
1210 			 */
1211 			ahc_handle_devreset(ahc, &devinfo,
1212 					    CAM_SEL_TIMEOUT,
1213 					    "Selection Timeout",
1214 					    /*verbose_level*/1);
1215 		}
1216 		ahc_outb(ahc, CLRINT, CLRSCSIINT);
1217 		ahc_restart(ahc);
1218 	} else if ((status & BUSFREE) != 0
1219 		&& (ahc_inb(ahc, SIMODE1) & ENBUSFREE) != 0) {
1220 		struct	ahc_devinfo devinfo;
1221 		u_int	lastphase;
1222 		u_int	saved_scsiid;
1223 		u_int	saved_lun;
1224 		u_int	target;
1225 		u_int	initiator_role_id;
1226 		char	channel;
1227 		int	printerror;
1228 
1229 		/*
1230 		 * Clear our selection hardware as soon as possible.
1231 		 * We may have an entry in the waiting Q for this target,
1232 		 * that is affected by this busfree and we don't want to
1233 		 * go about selecting the target while we handle the event.
1234 		 */
1235 		ahc_outb(ahc, SCSISEQ,
1236 			 ahc_inb(ahc, SCSISEQ) & (ENSELI|ENRSELI|ENAUTOATNP));
1237 
1238 		/*
1239 		 * Disable busfree interrupts and clear the busfree
1240 		 * interrupt status.  We do this here so that several
1241 		 * bus transactions occur prior to clearing the SCSIINT
1242 		 * latch.  It can take a bit for the clearing to take effect.
1243 		 */
1244 		ahc_outb(ahc, SIMODE1, ahc_inb(ahc, SIMODE1) & ~ENBUSFREE);
1245 		ahc_outb(ahc, CLRSINT1, CLRBUSFREE|CLRSCSIPERR);
1246 
1247 		/*
1248 		 * Look at what phase we were last in.
1249 		 * If its message out, chances are pretty good
1250 		 * that the busfree was in response to one of
1251 		 * our abort requests.
1252 		 */
1253 		lastphase = ahc_inb(ahc, LASTPHASE);
1254 		saved_scsiid = ahc_inb(ahc, SAVED_SCSIID);
1255 		saved_lun = ahc_inb(ahc, SAVED_LUN);
1256 		target = SCSIID_TARGET(ahc, saved_scsiid);
1257 		initiator_role_id = SCSIID_OUR_ID(saved_scsiid);
1258 		channel = SCSIID_CHANNEL(ahc, saved_scsiid);
1259 		ahc_compile_devinfo(&devinfo, initiator_role_id,
1260 				    target, saved_lun, channel, ROLE_INITIATOR);
1261 		printerror = 1;
1262 
1263 		if (lastphase == P_MESGOUT) {
1264 			u_int tag;
1265 
1266 			tag = SCB_LIST_NULL;
1267 			if (ahc_sent_msg(ahc, AHCMSG_1B, MSG_ABORT_TAG, TRUE)
1268 			 || ahc_sent_msg(ahc, AHCMSG_1B, MSG_ABORT, TRUE)) {
1269 				if (ahc->msgout_buf[ahc->msgout_index - 1]
1270 				 == MSG_ABORT_TAG)
1271 					tag = scb->hscb->tag;
1272 				ahc_print_path(ahc, scb);
1273 				printf("SCB %d - Abort%s Completed.\n",
1274 				       scb->hscb->tag, tag == SCB_LIST_NULL ?
1275 				       "" : " Tag");
1276 				ahc_abort_scbs(ahc, target, channel,
1277 					       saved_lun, tag,
1278 					       ROLE_INITIATOR,
1279 					       CAM_REQ_ABORTED);
1280 				printerror = 0;
1281 			} else if (ahc_sent_msg(ahc, AHCMSG_1B,
1282 						MSG_BUS_DEV_RESET, TRUE)) {
1283 #ifdef __FreeBSD__
1284 				/*
1285 				 * Don't mark the user's request for this BDR
1286 				 * as completing with CAM_BDR_SENT.  CAM3
1287 				 * specifies CAM_REQ_CMP.
1288 				 */
1289 				if (scb != NULL
1290 				 && scb->io_ctx->ccb_h.func_code== XPT_RESET_DEV
1291 				 && ahc_match_scb(ahc, scb, target, channel,
1292 						  CAM_LUN_WILDCARD,
1293 						  SCB_LIST_NULL,
1294 						  ROLE_INITIATOR)) {
1295 					aic_set_transaction_status(scb, CAM_REQ_CMP);
1296 				}
1297 #endif
1298 				ahc_compile_devinfo(&devinfo,
1299 						    initiator_role_id,
1300 						    target,
1301 						    CAM_LUN_WILDCARD,
1302 						    channel,
1303 						    ROLE_INITIATOR);
1304 				ahc_handle_devreset(ahc, &devinfo,
1305 						    CAM_BDR_SENT,
1306 						    "Bus Device Reset",
1307 						    /*verbose_level*/0);
1308 				printerror = 0;
1309 			} else if (ahc_sent_msg(ahc, AHCMSG_EXT,
1310 						MSG_EXT_PPR, FALSE)) {
1311 				struct ahc_initiator_tinfo *tinfo;
1312 				struct ahc_tmode_tstate *tstate;
1313 
1314 				/*
1315 				 * PPR Rejected.  Try non-ppr negotiation
1316 				 * and retry command.
1317 				 */
1318 				tinfo = ahc_fetch_transinfo(ahc,
1319 							    devinfo.channel,
1320 							    devinfo.our_scsiid,
1321 							    devinfo.target,
1322 							    &tstate);
1323 				tinfo->curr.transport_version = 2;
1324 				tinfo->goal.transport_version = 2;
1325 				tinfo->goal.ppr_options = 0;
1326 				ahc_qinfifo_requeue_tail(ahc, scb);
1327 				printerror = 0;
1328 			} else if (ahc_sent_msg(ahc, AHCMSG_EXT,
1329 						MSG_EXT_WDTR, FALSE)) {
1330 				/*
1331 				 * Negotiation Rejected.  Go-narrow and
1332 				 * retry command.
1333 				 */
1334 				ahc_set_width(ahc, &devinfo,
1335 					      MSG_EXT_WDTR_BUS_8_BIT,
1336 					      AHC_TRANS_CUR|AHC_TRANS_GOAL,
1337 					      /*paused*/TRUE);
1338 				ahc_qinfifo_requeue_tail(ahc, scb);
1339 				printerror = 0;
1340 			} else if (ahc_sent_msg(ahc, AHCMSG_EXT,
1341 						MSG_EXT_SDTR, FALSE)) {
1342 				/*
1343 				 * Negotiation Rejected.  Go-async and
1344 				 * retry command.
1345 				 */
1346 				ahc_set_syncrate(ahc, &devinfo,
1347 						/*syncrate*/NULL,
1348 						/*period*/0, /*offset*/0,
1349 						/*ppr_options*/0,
1350 						AHC_TRANS_CUR|AHC_TRANS_GOAL,
1351 						/*paused*/TRUE);
1352 				ahc_qinfifo_requeue_tail(ahc, scb);
1353 				printerror = 0;
1354 			}
1355 		}
1356 		if (printerror != 0) {
1357 			u_int i;
1358 
1359 			if (scb != NULL) {
1360 				u_int tag;
1361 
1362 				if ((scb->hscb->control & TAG_ENB) != 0)
1363 					tag = scb->hscb->tag;
1364 				else
1365 					tag = SCB_LIST_NULL;
1366 				ahc_print_path(ahc, scb);
1367 				ahc_abort_scbs(ahc, target, channel,
1368 					       SCB_GET_LUN(scb), tag,
1369 					       ROLE_INITIATOR,
1370 					       CAM_UNEXP_BUSFREE);
1371 			} else {
1372 				/*
1373 				 * We had not fully identified this connection,
1374 				 * so we cannot abort anything.
1375 				 */
1376 				printf("%s: ", ahc_name(ahc));
1377 			}
1378 			for (i = 0; i < num_phases; i++) {
1379 				if (lastphase == ahc_phase_table[i].phase)
1380 					break;
1381 			}
1382 			if (lastphase != P_BUSFREE) {
1383 				/*
1384 				 * Renegotiate with this device at the
1385 				 * next oportunity just in case this busfree
1386 				 * is due to a negotiation mismatch with the
1387 				 * device.
1388 				 */
1389 				ahc_force_renegotiation(ahc, &devinfo);
1390 			}
1391 			printf("Unexpected busfree %s\n"
1392 			       "SEQADDR == 0x%x\n",
1393 			       ahc_phase_table[i].phasemsg,
1394 			       ahc_inb(ahc, SEQADDR0)
1395 				| (ahc_inb(ahc, SEQADDR1) << 8));
1396 		}
1397 		ahc_outb(ahc, CLRINT, CLRSCSIINT);
1398 		ahc_restart(ahc);
1399 	} else {
1400 		printf("%s: Missing case in ahc_handle_scsiint. status = %x\n",
1401 		       ahc_name(ahc), status);
1402 		ahc_outb(ahc, CLRINT, CLRSCSIINT);
1403 	}
1404 }
1405 
1406 /*
1407  * Force renegotiation to occur the next time we initiate
1408  * a command to the current device.
1409  */
1410 static void
1411 ahc_force_renegotiation(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
1412 {
1413 	struct	ahc_initiator_tinfo *targ_info;
1414 	struct	ahc_tmode_tstate *tstate;
1415 
1416 	targ_info = ahc_fetch_transinfo(ahc,
1417 					devinfo->channel,
1418 					devinfo->our_scsiid,
1419 					devinfo->target,
1420 					&tstate);
1421 	ahc_update_neg_request(ahc, devinfo, tstate,
1422 			       targ_info, AHC_NEG_IF_NON_ASYNC);
1423 }
1424 
1425 #define AHC_MAX_STEPS 2000
1426 void
1427 ahc_clear_critical_section(struct ahc_softc *ahc)
1428 {
1429 	int	stepping;
1430 	int	steps;
1431 	u_int	simode0;
1432 	u_int	simode1;
1433 
1434 	if (ahc->num_critical_sections == 0)
1435 		return;
1436 
1437 	stepping = FALSE;
1438 	steps = 0;
1439 	simode0 = 0;
1440 	simode1 = 0;
1441 	for (;;) {
1442 		struct	cs *cs;
1443 		u_int	seqaddr;
1444 		u_int	i;
1445 
1446 		seqaddr = ahc_inb(ahc, SEQADDR0)
1447 			| (ahc_inb(ahc, SEQADDR1) << 8);
1448 
1449 		/*
1450 		 * Seqaddr represents the next instruction to execute,
1451 		 * so we are really executing the instruction just
1452 		 * before it.
1453 		 */
1454 		cs = ahc->critical_sections;
1455 		for (i = 0; i < ahc->num_critical_sections; i++, cs++) {
1456 
1457 			if (cs->begin < seqaddr && cs->end >= seqaddr)
1458 				break;
1459 		}
1460 
1461 		if (i == ahc->num_critical_sections)
1462 			break;
1463 
1464 		if (steps > AHC_MAX_STEPS) {
1465 			printf("%s: Infinite loop in critical section\n",
1466 			       ahc_name(ahc));
1467 			ahc_dump_card_state(ahc);
1468 			panic("critical section loop");
1469 		}
1470 
1471 		steps++;
1472 		if (stepping == FALSE) {
1473 
1474 			/*
1475 			 * Disable all interrupt sources so that the
1476 			 * sequencer will not be stuck by a pausing
1477 			 * interrupt condition while we attempt to
1478 			 * leave a critical section.
1479 			 */
1480 			simode0 = ahc_inb(ahc, SIMODE0);
1481 			ahc_outb(ahc, SIMODE0, 0);
1482 			simode1 = ahc_inb(ahc, SIMODE1);
1483 			if ((ahc->features & AHC_DT) != 0)
1484 				/*
1485 				 * On DT class controllers, we
1486 				 * use the enhanced busfree logic.
1487 				 * Unfortunately we cannot re-enable
1488 				 * busfree detection within the
1489 				 * current connection, so we must
1490 				 * leave it on while single stepping.
1491 				 */
1492 				ahc_outb(ahc, SIMODE1, simode1 & ENBUSFREE);
1493 			else
1494 				ahc_outb(ahc, SIMODE1, 0);
1495 			ahc_outb(ahc, CLRINT, CLRSCSIINT);
1496 			ahc_outb(ahc, SEQCTL, ahc->seqctl | STEP);
1497 			stepping = TRUE;
1498 		}
1499 		if ((ahc->features & AHC_DT) != 0) {
1500 			ahc_outb(ahc, CLRSINT1, CLRBUSFREE);
1501 			ahc_outb(ahc, CLRINT, CLRSCSIINT);
1502 		}
1503 		ahc_outb(ahc, HCNTRL, ahc->unpause);
1504 		while (!ahc_is_paused(ahc))
1505 			aic_delay(200);
1506 	}
1507 	if (stepping) {
1508 		ahc_outb(ahc, SIMODE0, simode0);
1509 		ahc_outb(ahc, SIMODE1, simode1);
1510 		ahc_outb(ahc, SEQCTL, ahc->seqctl);
1511 	}
1512 }
1513 
1514 /*
1515  * Clear any pending interrupt status.
1516  */
1517 void
1518 ahc_clear_intstat(struct ahc_softc *ahc)
1519 {
1520 	/* Clear any interrupt conditions this may have caused */
1521 	ahc_outb(ahc, CLRSINT1, CLRSELTIMEO|CLRATNO|CLRSCSIRSTI
1522 				|CLRBUSFREE|CLRSCSIPERR|CLRPHASECHG|
1523 				CLRREQINIT);
1524 	ahc_flush_device_writes(ahc);
1525 	ahc_outb(ahc, CLRSINT0, CLRSELDO|CLRSELDI|CLRSELINGO);
1526  	ahc_flush_device_writes(ahc);
1527 	ahc_outb(ahc, CLRINT, CLRSCSIINT);
1528 	ahc_flush_device_writes(ahc);
1529 }
1530 
1531 /**************************** Debugging Routines ******************************/
1532 #ifdef AHC_DEBUG
1533 uint32_t ahc_debug = AHC_DEBUG_OPTS;
1534 #endif
1535 
1536 void
1537 ahc_print_scb(struct scb *scb)
1538 {
1539 	int i;
1540 
1541 	struct hardware_scb *hscb = scb->hscb;
1542 
1543 	printf("scb:%p control:0x%x scsiid:0x%x lun:%d cdb_len:%d\n",
1544 	       (void *)scb,
1545 	       hscb->control,
1546 	       hscb->scsiid,
1547 	       hscb->lun,
1548 	       hscb->cdb_len);
1549 	printf("Shared Data: ");
1550 	for (i = 0; i < sizeof(hscb->shared_data.cdb); i++)
1551 		printf("%#02x", hscb->shared_data.cdb[i]);
1552 	printf("        dataptr:%#x datacnt:%#x sgptr:%#x tag:%#x\n",
1553 		aic_le32toh(hscb->dataptr),
1554 		aic_le32toh(hscb->datacnt),
1555 		aic_le32toh(hscb->sgptr),
1556 		hscb->tag);
1557 	if (scb->sg_count > 0) {
1558 		for (i = 0; i < scb->sg_count; i++) {
1559 			printf("sg[%d] - Addr 0x%x%x : Length %d\n",
1560 			       i,
1561 			       (aic_le32toh(scb->sg_list[i].len) >> 24
1562 			        & SG_HIGH_ADDR_BITS),
1563 			       aic_le32toh(scb->sg_list[i].addr),
1564 			       aic_le32toh(scb->sg_list[i].len));
1565 		}
1566 	}
1567 }
1568 
1569 /************************* Transfer Negotiation *******************************/
1570 /*
1571  * Allocate per target mode instance (ID we respond to as a target)
1572  * transfer negotiation data structures.
1573  */
1574 static struct ahc_tmode_tstate *
1575 ahc_alloc_tstate(struct ahc_softc *ahc, u_int scsi_id, char channel)
1576 {
1577 	struct ahc_tmode_tstate *master_tstate;
1578 	struct ahc_tmode_tstate *tstate;
1579 	int i;
1580 
1581 	master_tstate = ahc->enabled_targets[ahc->our_id];
1582 	if (channel == 'B') {
1583 		scsi_id += 8;
1584 		master_tstate = ahc->enabled_targets[ahc->our_id_b + 8];
1585 	}
1586 	if (ahc->enabled_targets[scsi_id] != NULL
1587 	 && ahc->enabled_targets[scsi_id] != master_tstate)
1588 		panic("%s: ahc_alloc_tstate - Target already allocated",
1589 		      ahc_name(ahc));
1590 	tstate = (struct ahc_tmode_tstate*)malloc(sizeof(*tstate),
1591 						   M_DEVBUF, M_NOWAIT);
1592 	if (tstate == NULL)
1593 		return (NULL);
1594 
1595 	/*
1596 	 * If we have allocated a master tstate, copy user settings from
1597 	 * the master tstate (taken from SRAM or the EEPROM) for this
1598 	 * channel, but reset our current and goal settings to async/narrow
1599 	 * until an initiator talks to us.
1600 	 */
1601 	if (master_tstate != NULL) {
1602 		memcpy(tstate, master_tstate, sizeof(*tstate));
1603 		memset(tstate->enabled_luns, 0, sizeof(tstate->enabled_luns));
1604 		tstate->ultraenb = 0;
1605 		for (i = 0; i < AHC_NUM_TARGETS; i++) {
1606 			memset(&tstate->transinfo[i].curr, 0,
1607 			      sizeof(tstate->transinfo[i].curr));
1608 			memset(&tstate->transinfo[i].goal, 0,
1609 			      sizeof(tstate->transinfo[i].goal));
1610 		}
1611 	} else
1612 		memset(tstate, 0, sizeof(*tstate));
1613 	ahc->enabled_targets[scsi_id] = tstate;
1614 	return (tstate);
1615 }
1616 
1617 #ifdef AHC_TARGET_MODE
1618 /*
1619  * Free per target mode instance (ID we respond to as a target)
1620  * transfer negotiation data structures.
1621  */
1622 static void
1623 ahc_free_tstate(struct ahc_softc *ahc, u_int scsi_id, char channel, int force)
1624 {
1625 	struct ahc_tmode_tstate *tstate;
1626 
1627 	/*
1628 	 * Don't clean up our "master" tstate.
1629 	 * It has our default user settings.
1630 	 */
1631 	if (((channel == 'B' && scsi_id == ahc->our_id_b)
1632 	  || (channel == 'A' && scsi_id == ahc->our_id))
1633 	 && force == FALSE)
1634 		return;
1635 
1636 	if (channel == 'B')
1637 		scsi_id += 8;
1638 	tstate = ahc->enabled_targets[scsi_id];
1639 	if (tstate != NULL)
1640 		free(tstate, M_DEVBUF);
1641 	ahc->enabled_targets[scsi_id] = NULL;
1642 }
1643 #endif
1644 
1645 /*
1646  * Called when we have an active connection to a target on the bus,
1647  * this function finds the nearest syncrate to the input period limited
1648  * by the capabilities of the bus connectivity of and sync settings for
1649  * the target.
1650  */
1651 struct ahc_syncrate *
1652 ahc_devlimited_syncrate(struct ahc_softc *ahc,
1653 			struct ahc_initiator_tinfo *tinfo,
1654 			u_int *period, u_int *ppr_options, role_t role)
1655 {
1656 	struct	ahc_transinfo *transinfo;
1657 	u_int	maxsync;
1658 
1659 	if ((ahc->features & AHC_ULTRA2) != 0) {
1660 		if ((ahc_inb(ahc, SBLKCTL) & ENAB40) != 0
1661 		 && (ahc_inb(ahc, SSTAT2) & EXP_ACTIVE) == 0) {
1662 			maxsync = AHC_SYNCRATE_DT;
1663 		} else {
1664 			maxsync = AHC_SYNCRATE_ULTRA;
1665 			/* Can't do DT on an SE bus */
1666 			*ppr_options &= ~MSG_EXT_PPR_DT_REQ;
1667 		}
1668 	} else if ((ahc->features & AHC_ULTRA) != 0) {
1669 		maxsync = AHC_SYNCRATE_ULTRA;
1670 	} else {
1671 		maxsync = AHC_SYNCRATE_FAST;
1672 	}
1673 	/*
1674 	 * Never allow a value higher than our current goal
1675 	 * period otherwise we may allow a target initiated
1676 	 * negotiation to go above the limit as set by the
1677 	 * user.  In the case of an initiator initiated
1678 	 * sync negotiation, we limit based on the user
1679 	 * setting.  This allows the system to still accept
1680 	 * incoming negotiations even if target initiated
1681 	 * negotiation is not performed.
1682 	 */
1683 	if (role == ROLE_TARGET)
1684 		transinfo = &tinfo->user;
1685 	else
1686 		transinfo = &tinfo->goal;
1687 	*ppr_options &= transinfo->ppr_options;
1688 	if (transinfo->width == MSG_EXT_WDTR_BUS_8_BIT) {
1689 		maxsync = MAX(maxsync, AHC_SYNCRATE_ULTRA2);
1690 		*ppr_options &= ~MSG_EXT_PPR_DT_REQ;
1691 	}
1692 	if (transinfo->period == 0) {
1693 		*period = 0;
1694 		*ppr_options = 0;
1695 		return (NULL);
1696 	}
1697 	*period = MAX(*period, transinfo->period);
1698 	return (ahc_find_syncrate(ahc, period, ppr_options, maxsync));
1699 }
1700 
1701 /*
1702  * Look up the valid period to SCSIRATE conversion in our table.
1703  * Return the period and offset that should be sent to the target
1704  * if this was the beginning of an SDTR.
1705  */
1706 struct ahc_syncrate *
1707 ahc_find_syncrate(struct ahc_softc *ahc, u_int *period,
1708 		  u_int *ppr_options, u_int maxsync)
1709 {
1710 	struct ahc_syncrate *syncrate;
1711 
1712 	if ((ahc->features & AHC_DT) == 0)
1713 		*ppr_options &= ~MSG_EXT_PPR_DT_REQ;
1714 
1715 	/* Skip all DT only entries if DT is not available */
1716 	if ((*ppr_options & MSG_EXT_PPR_DT_REQ) == 0
1717 	 && maxsync < AHC_SYNCRATE_ULTRA2)
1718 		maxsync = AHC_SYNCRATE_ULTRA2;
1719 
1720 	for (syncrate = &ahc_syncrates[maxsync];
1721 	     syncrate->rate != NULL;
1722 	     syncrate++) {
1723 
1724 		/*
1725 		 * The Ultra2 table doesn't go as low
1726 		 * as for the Fast/Ultra cards.
1727 		 */
1728 		if ((ahc->features & AHC_ULTRA2) != 0
1729 		 && (syncrate->sxfr_u2 == 0))
1730 			break;
1731 
1732 		if (*period <= syncrate->period) {
1733 			/*
1734 			 * When responding to a target that requests
1735 			 * sync, the requested rate may fall between
1736 			 * two rates that we can output, but still be
1737 			 * a rate that we can receive.  Because of this,
1738 			 * we want to respond to the target with
1739 			 * the same rate that it sent to us even
1740 			 * if the period we use to send data to it
1741 			 * is lower.  Only lower the response period
1742 			 * if we must.
1743 			 */
1744 			if (syncrate == &ahc_syncrates[maxsync])
1745 				*period = syncrate->period;
1746 
1747 			/*
1748 			 * At some speeds, we only support
1749 			 * ST transfers.
1750 			 */
1751 		 	if ((syncrate->sxfr_u2 & ST_SXFR) != 0)
1752 				*ppr_options &= ~MSG_EXT_PPR_DT_REQ;
1753 			break;
1754 		}
1755 	}
1756 
1757 	if ((*period == 0)
1758 	 || (syncrate->rate == NULL)
1759 	 || ((ahc->features & AHC_ULTRA2) != 0
1760 	  && (syncrate->sxfr_u2 == 0))) {
1761 		/* Use asynchronous transfers. */
1762 		*period = 0;
1763 		syncrate = NULL;
1764 		*ppr_options &= ~MSG_EXT_PPR_DT_REQ;
1765 	}
1766 	return (syncrate);
1767 }
1768 
1769 /*
1770  * Convert from an entry in our syncrate table to the SCSI equivalent
1771  * sync "period" factor.
1772  */
1773 u_int
1774 ahc_find_period(struct ahc_softc *ahc, u_int scsirate, u_int maxsync)
1775 {
1776 	struct ahc_syncrate *syncrate;
1777 
1778 	if ((ahc->features & AHC_ULTRA2) != 0)
1779 		scsirate &= SXFR_ULTRA2;
1780 	else
1781 		scsirate &= SXFR;
1782 
1783 	syncrate = &ahc_syncrates[maxsync];
1784 	while (syncrate->rate != NULL) {
1785 
1786 		if ((ahc->features & AHC_ULTRA2) != 0) {
1787 			if (syncrate->sxfr_u2 == 0)
1788 				break;
1789 			else if (scsirate == (syncrate->sxfr_u2 & SXFR_ULTRA2))
1790 				return (syncrate->period);
1791 		} else if (scsirate == (syncrate->sxfr & SXFR)) {
1792 				return (syncrate->period);
1793 		}
1794 		syncrate++;
1795 	}
1796 	return (0); /* async */
1797 }
1798 
1799 /*
1800  * Truncate the given synchronous offset to a value the
1801  * current adapter type and syncrate are capable of.
1802  */
1803 void
1804 ahc_validate_offset(struct ahc_softc *ahc,
1805 		    struct ahc_initiator_tinfo *tinfo,
1806 		    struct ahc_syncrate *syncrate,
1807 		    u_int *offset, int wide, role_t role)
1808 {
1809 	u_int maxoffset;
1810 
1811 	/* Limit offset to what we can do */
1812 	if (syncrate == NULL) {
1813 		maxoffset = 0;
1814 	} else if ((ahc->features & AHC_ULTRA2) != 0) {
1815 		maxoffset = MAX_OFFSET_ULTRA2;
1816 	} else {
1817 		if (wide)
1818 			maxoffset = MAX_OFFSET_16BIT;
1819 		else
1820 			maxoffset = MAX_OFFSET_8BIT;
1821 	}
1822 	*offset = MIN(*offset, maxoffset);
1823 	if (tinfo != NULL) {
1824 		if (role == ROLE_TARGET)
1825 			*offset = MIN(*offset, tinfo->user.offset);
1826 		else
1827 			*offset = MIN(*offset, tinfo->goal.offset);
1828 	}
1829 }
1830 
1831 /*
1832  * Truncate the given transfer width parameter to a value the
1833  * current adapter type is capable of.
1834  */
1835 void
1836 ahc_validate_width(struct ahc_softc *ahc, struct ahc_initiator_tinfo *tinfo,
1837 		   u_int *bus_width, role_t role)
1838 {
1839 	switch (*bus_width) {
1840 	default:
1841 		if (ahc->features & AHC_WIDE) {
1842 			/* Respond Wide */
1843 			*bus_width = MSG_EXT_WDTR_BUS_16_BIT;
1844 			break;
1845 		}
1846 		/* FALLTHROUGH */
1847 	case MSG_EXT_WDTR_BUS_8_BIT:
1848 		*bus_width = MSG_EXT_WDTR_BUS_8_BIT;
1849 		break;
1850 	}
1851 	if (tinfo != NULL) {
1852 		if (role == ROLE_TARGET)
1853 			*bus_width = MIN(tinfo->user.width, *bus_width);
1854 		else
1855 			*bus_width = MIN(tinfo->goal.width, *bus_width);
1856 	}
1857 }
1858 
1859 /*
1860  * Update the bitmask of targets for which the controller should
1861  * negotiate with at the next convenient oportunity.  This currently
1862  * means the next time we send the initial identify messages for
1863  * a new transaction.
1864  */
1865 int
1866 ahc_update_neg_request(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
1867 		       struct ahc_tmode_tstate *tstate,
1868 		       struct ahc_initiator_tinfo *tinfo, ahc_neg_type neg_type)
1869 {
1870 	u_int auto_negotiate_orig;
1871 
1872 	auto_negotiate_orig = tstate->auto_negotiate;
1873 	if (neg_type == AHC_NEG_ALWAYS) {
1874 		/*
1875 		 * Force our "current" settings to be
1876 		 * unknown so that unless a bus reset
1877 		 * occurs the need to renegotiate is
1878 		 * recorded persistently.
1879 		 */
1880 		if ((ahc->features & AHC_WIDE) != 0)
1881 			tinfo->curr.width = AHC_WIDTH_UNKNOWN;
1882 		tinfo->curr.period = AHC_PERIOD_UNKNOWN;
1883 		tinfo->curr.offset = AHC_OFFSET_UNKNOWN;
1884 	}
1885 	if (tinfo->curr.period != tinfo->goal.period
1886 	 || tinfo->curr.width != tinfo->goal.width
1887 	 || tinfo->curr.offset != tinfo->goal.offset
1888 	 || tinfo->curr.ppr_options != tinfo->goal.ppr_options
1889 	 || (neg_type == AHC_NEG_IF_NON_ASYNC
1890 	  && (tinfo->goal.offset != 0
1891 	   || tinfo->goal.width != MSG_EXT_WDTR_BUS_8_BIT
1892 	   || tinfo->goal.ppr_options != 0)))
1893 		tstate->auto_negotiate |= devinfo->target_mask;
1894 	else
1895 		tstate->auto_negotiate &= ~devinfo->target_mask;
1896 
1897 	return (auto_negotiate_orig != tstate->auto_negotiate);
1898 }
1899 
1900 /*
1901  * Update the user/goal/curr tables of synchronous negotiation
1902  * parameters as well as, in the case of a current or active update,
1903  * any data structures on the host controller.  In the case of an
1904  * active update, the specified target is currently talking to us on
1905  * the bus, so the transfer parameter update must take effect
1906  * immediately.
1907  */
1908 void
1909 ahc_set_syncrate(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
1910 		 struct ahc_syncrate *syncrate, u_int period,
1911 		 u_int offset, u_int ppr_options, u_int type, int paused)
1912 {
1913 	struct	ahc_initiator_tinfo *tinfo;
1914 	struct	ahc_tmode_tstate *tstate;
1915 	u_int	old_period;
1916 	u_int	old_offset;
1917 	u_int	old_ppr;
1918 	int	active;
1919 	int	update_needed;
1920 
1921 	active = (type & AHC_TRANS_ACTIVE) == AHC_TRANS_ACTIVE;
1922 	update_needed = 0;
1923 
1924 	if (syncrate == NULL) {
1925 		period = 0;
1926 		offset = 0;
1927 	}
1928 
1929 	tinfo = ahc_fetch_transinfo(ahc, devinfo->channel, devinfo->our_scsiid,
1930 				    devinfo->target, &tstate);
1931 
1932 	if ((type & AHC_TRANS_USER) != 0) {
1933 		tinfo->user.period = period;
1934 		tinfo->user.offset = offset;
1935 		tinfo->user.ppr_options = ppr_options;
1936 	}
1937 
1938 	if ((type & AHC_TRANS_GOAL) != 0) {
1939 		tinfo->goal.period = period;
1940 		tinfo->goal.offset = offset;
1941 		tinfo->goal.ppr_options = ppr_options;
1942 	}
1943 
1944 	old_period = tinfo->curr.period;
1945 	old_offset = tinfo->curr.offset;
1946 	old_ppr	   = tinfo->curr.ppr_options;
1947 
1948 	if ((type & AHC_TRANS_CUR) != 0
1949 	 && (old_period != period
1950 	  || old_offset != offset
1951 	  || old_ppr != ppr_options)) {
1952 		u_int	scsirate;
1953 
1954 		update_needed++;
1955 		scsirate = tinfo->scsirate;
1956 		if ((ahc->features & AHC_ULTRA2) != 0) {
1957 
1958 			scsirate &= ~(SXFR_ULTRA2|SINGLE_EDGE|ENABLE_CRC);
1959 			if (syncrate != NULL) {
1960 				scsirate |= syncrate->sxfr_u2;
1961 				if ((ppr_options & MSG_EXT_PPR_DT_REQ) != 0)
1962 					scsirate |= ENABLE_CRC;
1963 				else
1964 					scsirate |= SINGLE_EDGE;
1965 			}
1966 		} else {
1967 
1968 			scsirate &= ~(SXFR|SOFS);
1969 			/*
1970 			 * Ensure Ultra mode is set properly for
1971 			 * this target.
1972 			 */
1973 			tstate->ultraenb &= ~devinfo->target_mask;
1974 			if (syncrate != NULL) {
1975 				if (syncrate->sxfr & ULTRA_SXFR) {
1976 					tstate->ultraenb |=
1977 						devinfo->target_mask;
1978 				}
1979 				scsirate |= syncrate->sxfr & SXFR;
1980 				scsirate |= offset & SOFS;
1981 			}
1982 			if (active) {
1983 				u_int sxfrctl0;
1984 
1985 				sxfrctl0 = ahc_inb(ahc, SXFRCTL0);
1986 				sxfrctl0 &= ~FAST20;
1987 				if (tstate->ultraenb & devinfo->target_mask)
1988 					sxfrctl0 |= FAST20;
1989 				ahc_outb(ahc, SXFRCTL0, sxfrctl0);
1990 			}
1991 		}
1992 		if (active) {
1993 			ahc_outb(ahc, SCSIRATE, scsirate);
1994 			if ((ahc->features & AHC_ULTRA2) != 0)
1995 				ahc_outb(ahc, SCSIOFFSET, offset);
1996 		}
1997 
1998 		tinfo->scsirate = scsirate;
1999 		tinfo->curr.period = period;
2000 		tinfo->curr.offset = offset;
2001 		tinfo->curr.ppr_options = ppr_options;
2002 
2003 		ahc_send_async(ahc, devinfo->channel, devinfo->target,
2004 			       CAM_LUN_WILDCARD, AC_TRANSFER_NEG, NULL);
2005 		if (bootverbose) {
2006 			if (offset != 0) {
2007 				printf("%s: target %d synchronous at %sMHz%s, "
2008 				       "offset = 0x%x\n", ahc_name(ahc),
2009 				       devinfo->target, syncrate->rate,
2010 				       (ppr_options & MSG_EXT_PPR_DT_REQ)
2011 				       ? " DT" : "", offset);
2012 			} else {
2013 				printf("%s: target %d using "
2014 				       "asynchronous transfers\n",
2015 				       ahc_name(ahc), devinfo->target);
2016 			}
2017 		}
2018 	}
2019 
2020 	update_needed += ahc_update_neg_request(ahc, devinfo, tstate,
2021 						tinfo, AHC_NEG_TO_GOAL);
2022 
2023 	if (update_needed)
2024 		ahc_update_pending_scbs(ahc);
2025 }
2026 
2027 /*
2028  * Update the user/goal/curr tables of wide negotiation
2029  * parameters as well as, in the case of a current or active update,
2030  * any data structures on the host controller.  In the case of an
2031  * active update, the specified target is currently talking to us on
2032  * the bus, so the transfer parameter update must take effect
2033  * immediately.
2034  */
2035 void
2036 ahc_set_width(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
2037 	      u_int width, u_int type, int paused)
2038 {
2039 	struct	ahc_initiator_tinfo *tinfo;
2040 	struct	ahc_tmode_tstate *tstate;
2041 	u_int	oldwidth;
2042 	int	active;
2043 	int	update_needed;
2044 
2045 	active = (type & AHC_TRANS_ACTIVE) == AHC_TRANS_ACTIVE;
2046 	update_needed = 0;
2047 	tinfo = ahc_fetch_transinfo(ahc, devinfo->channel, devinfo->our_scsiid,
2048 				    devinfo->target, &tstate);
2049 
2050 	if ((type & AHC_TRANS_USER) != 0)
2051 		tinfo->user.width = width;
2052 
2053 	if ((type & AHC_TRANS_GOAL) != 0)
2054 		tinfo->goal.width = width;
2055 
2056 	oldwidth = tinfo->curr.width;
2057 	if ((type & AHC_TRANS_CUR) != 0 && oldwidth != width) {
2058 		u_int	scsirate;
2059 
2060 		update_needed++;
2061 		scsirate =  tinfo->scsirate;
2062 		scsirate &= ~WIDEXFER;
2063 		if (width == MSG_EXT_WDTR_BUS_16_BIT)
2064 			scsirate |= WIDEXFER;
2065 
2066 		tinfo->scsirate = scsirate;
2067 
2068 		if (active)
2069 			ahc_outb(ahc, SCSIRATE, scsirate);
2070 
2071 		tinfo->curr.width = width;
2072 
2073 		ahc_send_async(ahc, devinfo->channel, devinfo->target,
2074 			       CAM_LUN_WILDCARD, AC_TRANSFER_NEG, NULL);
2075 		if (bootverbose) {
2076 			printf("%s: target %d using %dbit transfers\n",
2077 			       ahc_name(ahc), devinfo->target,
2078 			       8 * (0x01 << width));
2079 		}
2080 	}
2081 
2082 	update_needed += ahc_update_neg_request(ahc, devinfo, tstate,
2083 						tinfo, AHC_NEG_TO_GOAL);
2084 	if (update_needed)
2085 		ahc_update_pending_scbs(ahc);
2086 }
2087 
2088 /*
2089  * Update the current state of tagged queuing for a given target.
2090  */
2091 void
2092 ahc_set_tags(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
2093 	     ahc_queue_alg alg)
2094 {
2095  	ahc_platform_set_tags(ahc, devinfo, alg);
2096  	ahc_send_async(ahc, devinfo->channel, devinfo->target,
2097  		       devinfo->lun, AC_TRANSFER_NEG, &alg);
2098 }
2099 
2100 /*
2101  * When the transfer settings for a connection change, update any
2102  * in-transit SCBs to contain the new data so the hardware will
2103  * be set correctly during future (re)selections.
2104  */
2105 static void
2106 ahc_update_pending_scbs(struct ahc_softc *ahc)
2107 {
2108 	struct	scb *pending_scb;
2109 	int	pending_scb_count;
2110 	int	i;
2111 	int	paused;
2112 	u_int	saved_scbptr;
2113 
2114 	/*
2115 	 * Traverse the pending SCB list and ensure that all of the
2116 	 * SCBs there have the proper settings.
2117 	 */
2118 	pending_scb_count = 0;
2119 	LIST_FOREACH(pending_scb, &ahc->pending_scbs, pending_links) {
2120 		struct ahc_devinfo devinfo;
2121 		struct hardware_scb *pending_hscb;
2122 		struct ahc_initiator_tinfo *tinfo;
2123 		struct ahc_tmode_tstate *tstate;
2124 
2125 		ahc_scb_devinfo(ahc, &devinfo, pending_scb);
2126 		tinfo = ahc_fetch_transinfo(ahc, devinfo.channel,
2127 					    devinfo.our_scsiid,
2128 					    devinfo.target, &tstate);
2129 		pending_hscb = pending_scb->hscb;
2130 		pending_hscb->control &= ~ULTRAENB;
2131 		if ((tstate->ultraenb & devinfo.target_mask) != 0)
2132 			pending_hscb->control |= ULTRAENB;
2133 		pending_hscb->scsirate = tinfo->scsirate;
2134 		pending_hscb->scsioffset = tinfo->curr.offset;
2135 		if ((tstate->auto_negotiate & devinfo.target_mask) == 0
2136 		 && (pending_scb->flags & SCB_AUTO_NEGOTIATE) != 0) {
2137 			pending_scb->flags &= ~SCB_AUTO_NEGOTIATE;
2138 			pending_hscb->control &= ~MK_MESSAGE;
2139 		}
2140 		ahc_sync_scb(ahc, pending_scb,
2141 			     BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
2142 		pending_scb_count++;
2143 	}
2144 
2145 	if (pending_scb_count == 0)
2146 		return;
2147 
2148 	if (ahc_is_paused(ahc)) {
2149 		paused = 1;
2150 	} else {
2151 		paused = 0;
2152 		ahc_pause(ahc);
2153 	}
2154 
2155 	saved_scbptr = ahc_inb(ahc, SCBPTR);
2156 	/* Ensure that the hscbs down on the card match the new information */
2157 	for (i = 0; i < ahc->scb_data->maxhscbs; i++) {
2158 		struct	hardware_scb *pending_hscb;
2159 		u_int	control;
2160 		u_int	scb_tag;
2161 
2162 		ahc_outb(ahc, SCBPTR, i);
2163 		scb_tag = ahc_inb(ahc, SCB_TAG);
2164 		pending_scb = ahc_lookup_scb(ahc, scb_tag);
2165 		if (pending_scb == NULL)
2166 			continue;
2167 
2168 		pending_hscb = pending_scb->hscb;
2169 		control = ahc_inb(ahc, SCB_CONTROL);
2170 		control &= ~(ULTRAENB|MK_MESSAGE);
2171 		control |= pending_hscb->control & (ULTRAENB|MK_MESSAGE);
2172 		ahc_outb(ahc, SCB_CONTROL, control);
2173 		ahc_outb(ahc, SCB_SCSIRATE, pending_hscb->scsirate);
2174 		ahc_outb(ahc, SCB_SCSIOFFSET, pending_hscb->scsioffset);
2175 	}
2176 	ahc_outb(ahc, SCBPTR, saved_scbptr);
2177 
2178 	if (paused == 0)
2179 		ahc_unpause(ahc);
2180 }
2181 
2182 /**************************** Pathing Information *****************************/
2183 static void
2184 ahc_fetch_devinfo(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
2185 {
2186 	u_int	saved_scsiid;
2187 	role_t	role;
2188 	int	our_id;
2189 
2190 	if (ahc_inb(ahc, SSTAT0) & TARGET)
2191 		role = ROLE_TARGET;
2192 	else
2193 		role = ROLE_INITIATOR;
2194 
2195 	if (role == ROLE_TARGET
2196 	 && (ahc->features & AHC_MULTI_TID) != 0
2197 	 && (ahc_inb(ahc, SEQ_FLAGS)
2198  	   & (CMDPHASE_PENDING|TARG_CMD_PENDING|NO_DISCONNECT)) != 0) {
2199 		/* We were selected, so pull our id from TARGIDIN */
2200 		our_id = ahc_inb(ahc, TARGIDIN) & OID;
2201 	} else if ((ahc->features & AHC_ULTRA2) != 0)
2202 		our_id = ahc_inb(ahc, SCSIID_ULTRA2) & OID;
2203 	else
2204 		our_id = ahc_inb(ahc, SCSIID) & OID;
2205 
2206 	saved_scsiid = ahc_inb(ahc, SAVED_SCSIID);
2207 	ahc_compile_devinfo(devinfo,
2208 			    our_id,
2209 			    SCSIID_TARGET(ahc, saved_scsiid),
2210 			    ahc_inb(ahc, SAVED_LUN),
2211 			    SCSIID_CHANNEL(ahc, saved_scsiid),
2212 			    role);
2213 }
2214 
2215 struct ahc_phase_table_entry*
2216 ahc_lookup_phase_entry(int phase)
2217 {
2218 	struct ahc_phase_table_entry *entry;
2219 	struct ahc_phase_table_entry *last_entry;
2220 
2221 	/*
2222 	 * num_phases doesn't include the default entry which
2223 	 * will be returned if the phase doesn't match.
2224 	 */
2225 	last_entry = &ahc_phase_table[num_phases];
2226 	for (entry = ahc_phase_table; entry < last_entry; entry++) {
2227 		if (phase == entry->phase)
2228 			break;
2229 	}
2230 	return (entry);
2231 }
2232 
2233 void
2234 ahc_compile_devinfo(struct ahc_devinfo *devinfo, u_int our_id, u_int target,
2235 		    u_int lun, char channel, role_t role)
2236 {
2237 	devinfo->our_scsiid = our_id;
2238 	devinfo->target = target;
2239 	devinfo->lun = lun;
2240 	devinfo->target_offset = target;
2241 	devinfo->channel = channel;
2242 	devinfo->role = role;
2243 	if (channel == 'B')
2244 		devinfo->target_offset += 8;
2245 	devinfo->target_mask = (0x01 << devinfo->target_offset);
2246 }
2247 
2248 void
2249 ahc_print_devinfo(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
2250 {
2251 	printf("%s:%c:%d:%d: ", ahc_name(ahc), devinfo->channel,
2252 	       devinfo->target, devinfo->lun);
2253 }
2254 
2255 static void
2256 ahc_scb_devinfo(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
2257 		struct scb *scb)
2258 {
2259 	role_t	role;
2260 	int	our_id;
2261 
2262 	our_id = SCSIID_OUR_ID(scb->hscb->scsiid);
2263 	role = ROLE_INITIATOR;
2264 	if ((scb->flags & SCB_TARGET_SCB) != 0)
2265 		role = ROLE_TARGET;
2266 	ahc_compile_devinfo(devinfo, our_id, SCB_GET_TARGET(ahc, scb),
2267 			    SCB_GET_LUN(scb), SCB_GET_CHANNEL(ahc, scb), role);
2268 }
2269 
2270 
2271 /************************ Message Phase Processing ****************************/
2272 static void
2273 ahc_assert_atn(struct ahc_softc *ahc)
2274 {
2275 	u_int scsisigo;
2276 
2277 	scsisigo = ATNO;
2278 	if ((ahc->features & AHC_DT) == 0)
2279 		scsisigo |= ahc_inb(ahc, SCSISIGI);
2280 	ahc_outb(ahc, SCSISIGO, scsisigo);
2281 }
2282 
2283 /*
2284  * When an initiator transaction with the MK_MESSAGE flag either reconnects
2285  * or enters the initial message out phase, we are interrupted.  Fill our
2286  * outgoing message buffer with the appropriate message and beging handing
2287  * the message phase(s) manually.
2288  */
2289 static void
2290 ahc_setup_initiator_msgout(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
2291 			   struct scb *scb)
2292 {
2293 	/*
2294 	 * To facilitate adding multiple messages together,
2295 	 * each routine should increment the index and len
2296 	 * variables instead of setting them explicitly.
2297 	 */
2298 	ahc->msgout_index = 0;
2299 	ahc->msgout_len = 0;
2300 
2301 	if ((scb->flags & SCB_DEVICE_RESET) == 0
2302 	 && ahc_inb(ahc, MSG_OUT) == MSG_IDENTIFYFLAG) {
2303 		u_int identify_msg;
2304 
2305 		identify_msg = MSG_IDENTIFYFLAG | SCB_GET_LUN(scb);
2306 		if ((scb->hscb->control & DISCENB) != 0)
2307 			identify_msg |= MSG_IDENTIFY_DISCFLAG;
2308 		ahc->msgout_buf[ahc->msgout_index++] = identify_msg;
2309 		ahc->msgout_len++;
2310 
2311 		if ((scb->hscb->control & TAG_ENB) != 0) {
2312 			ahc->msgout_buf[ahc->msgout_index++] =
2313 			    scb->hscb->control & (TAG_ENB|SCB_TAG_TYPE);
2314 			ahc->msgout_buf[ahc->msgout_index++] = scb->hscb->tag;
2315 			ahc->msgout_len += 2;
2316 		}
2317 	}
2318 
2319 	if (scb->flags & SCB_DEVICE_RESET) {
2320 		ahc->msgout_buf[ahc->msgout_index++] = MSG_BUS_DEV_RESET;
2321 		ahc->msgout_len++;
2322 		ahc_print_path(ahc, scb);
2323 		printf("Bus Device Reset Message Sent\n");
2324 		/*
2325 		 * Clear our selection hardware in advance of
2326 		 * the busfree.  We may have an entry in the waiting
2327 		 * Q for this target, and we don't want to go about
2328 		 * selecting while we handle the busfree and blow it
2329 		 * away.
2330 		 */
2331 		ahc_outb(ahc, SCSISEQ, (ahc_inb(ahc, SCSISEQ) & ~ENSELO));
2332 	} else if ((scb->flags & SCB_ABORT) != 0) {
2333 		if ((scb->hscb->control & TAG_ENB) != 0)
2334 			ahc->msgout_buf[ahc->msgout_index++] = MSG_ABORT_TAG;
2335 		else
2336 			ahc->msgout_buf[ahc->msgout_index++] = MSG_ABORT;
2337 		ahc->msgout_len++;
2338 		ahc_print_path(ahc, scb);
2339 		printf("Abort%s Message Sent\n",
2340 		       (scb->hscb->control & TAG_ENB) != 0 ? " Tag" : "");
2341 		/*
2342 		 * Clear our selection hardware in advance of
2343 		 * the busfree.  We may have an entry in the waiting
2344 		 * Q for this target, and we don't want to go about
2345 		 * selecting while we handle the busfree and blow it
2346 		 * away.
2347 		 */
2348 		ahc_outb(ahc, SCSISEQ, (ahc_inb(ahc, SCSISEQ) & ~ENSELO));
2349 	} else if ((scb->flags & (SCB_AUTO_NEGOTIATE|SCB_NEGOTIATE)) != 0) {
2350 		ahc_build_transfer_msg(ahc, devinfo);
2351 	} else {
2352 		printf("ahc_intr: AWAITING_MSG for an SCB that "
2353 		       "does not have a waiting message\n");
2354 		printf("SCSIID = %x, target_mask = %x\n", scb->hscb->scsiid,
2355 		       devinfo->target_mask);
2356 		panic("SCB = %d, SCB Control = %x, MSG_OUT = %x "
2357 		      "SCB flags = %x", scb->hscb->tag, scb->hscb->control,
2358 		      ahc_inb(ahc, MSG_OUT), scb->flags);
2359 	}
2360 
2361 	/*
2362 	 * Clear the MK_MESSAGE flag from the SCB so we aren't
2363 	 * asked to send this message again.
2364 	 */
2365 	ahc_outb(ahc, SCB_CONTROL, ahc_inb(ahc, SCB_CONTROL) & ~MK_MESSAGE);
2366 	scb->hscb->control &= ~MK_MESSAGE;
2367 	ahc->msgout_index = 0;
2368 	ahc->msg_type = MSG_TYPE_INITIATOR_MSGOUT;
2369 }
2370 
2371 /*
2372  * Build an appropriate transfer negotiation message for the
2373  * currently active target.
2374  */
2375 static void
2376 ahc_build_transfer_msg(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
2377 {
2378 	/*
2379 	 * We need to initiate transfer negotiations.
2380 	 * If our current and goal settings are identical,
2381 	 * we want to renegotiate due to a check condition.
2382 	 */
2383 	struct	ahc_initiator_tinfo *tinfo;
2384 	struct	ahc_tmode_tstate *tstate;
2385 	struct	ahc_syncrate *rate;
2386 	int	dowide;
2387 	int	dosync;
2388 	int	doppr;
2389 	u_int	period;
2390 	u_int	ppr_options;
2391 	u_int	offset;
2392 
2393 	tinfo = ahc_fetch_transinfo(ahc, devinfo->channel, devinfo->our_scsiid,
2394 				    devinfo->target, &tstate);
2395 	/*
2396 	 * Filter our period based on the current connection.
2397 	 * If we can't perform DT transfers on this segment (not in LVD
2398 	 * mode for instance), then our decision to issue a PPR message
2399 	 * may change.
2400 	 */
2401 	period = tinfo->goal.period;
2402 	offset = tinfo->goal.offset;
2403 	ppr_options = tinfo->goal.ppr_options;
2404 	/* Target initiated PPR is not allowed in the SCSI spec */
2405 	if (devinfo->role == ROLE_TARGET)
2406 		ppr_options = 0;
2407 	rate = ahc_devlimited_syncrate(ahc, tinfo, &period,
2408 				       &ppr_options, devinfo->role);
2409 	dowide = tinfo->curr.width != tinfo->goal.width;
2410 	dosync = tinfo->curr.offset != offset || tinfo->curr.period != period;
2411 	/*
2412 	 * Only use PPR if we have options that need it, even if the device
2413 	 * claims to support it.  There might be an expander in the way
2414 	 * that doesn't.
2415 	 */
2416 	doppr = ppr_options != 0;
2417 
2418 	if (!dowide && !dosync && !doppr) {
2419 		dowide = tinfo->goal.width != MSG_EXT_WDTR_BUS_8_BIT;
2420 		dosync = tinfo->goal.offset != 0;
2421 	}
2422 
2423 	if (!dowide && !dosync && !doppr) {
2424 		/*
2425 		 * Force async with a WDTR message if we have a wide bus,
2426 		 * or just issue an SDTR with a 0 offset.
2427 		 */
2428 		if ((ahc->features & AHC_WIDE) != 0)
2429 			dowide = 1;
2430 		else
2431 			dosync = 1;
2432 
2433 		if (bootverbose) {
2434 			ahc_print_devinfo(ahc, devinfo);
2435 			printf("Ensuring async\n");
2436 		}
2437 	}
2438 
2439 	/* Target initiated PPR is not allowed in the SCSI spec */
2440 	if (devinfo->role == ROLE_TARGET)
2441 		doppr = 0;
2442 
2443 	/*
2444 	 * Both the PPR message and SDTR message require the
2445 	 * goal syncrate to be limited to what the target device
2446 	 * is capable of handling (based on whether an LVD->SE
2447 	 * expander is on the bus), so combine these two cases.
2448 	 * Regardless, guarantee that if we are using WDTR and SDTR
2449 	 * messages that WDTR comes first.
2450 	 */
2451 	if (doppr || (dosync && !dowide)) {
2452 
2453 		offset = tinfo->goal.offset;
2454 		ahc_validate_offset(ahc, tinfo, rate, &offset,
2455 				    doppr ? tinfo->goal.width
2456 					  : tinfo->curr.width,
2457 				    devinfo->role);
2458 		if (doppr) {
2459 			ahc_construct_ppr(ahc, devinfo, period, offset,
2460 					  tinfo->goal.width, ppr_options);
2461 		} else {
2462 			ahc_construct_sdtr(ahc, devinfo, period, offset);
2463 		}
2464 	} else {
2465 		ahc_construct_wdtr(ahc, devinfo, tinfo->goal.width);
2466 	}
2467 }
2468 
2469 /*
2470  * Build a synchronous negotiation message in our message
2471  * buffer based on the input parameters.
2472  */
2473 static void
2474 ahc_construct_sdtr(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
2475 		   u_int period, u_int offset)
2476 {
2477 	if (offset == 0)
2478 		period = AHC_ASYNC_XFER_PERIOD;
2479 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXTENDED;
2480 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXT_SDTR_LEN;
2481 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXT_SDTR;
2482 	ahc->msgout_buf[ahc->msgout_index++] = period;
2483 	ahc->msgout_buf[ahc->msgout_index++] = offset;
2484 	ahc->msgout_len += 5;
2485 	if (bootverbose) {
2486 		printf("(%s:%c:%d:%d): Sending SDTR period %x, offset %x\n",
2487 		       ahc_name(ahc), devinfo->channel, devinfo->target,
2488 		       devinfo->lun, period, offset);
2489 	}
2490 }
2491 
2492 /*
2493  * Build a wide negotiation message in our message
2494  * buffer based on the input parameters.
2495  */
2496 static void
2497 ahc_construct_wdtr(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
2498 		   u_int bus_width)
2499 {
2500 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXTENDED;
2501 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXT_WDTR_LEN;
2502 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXT_WDTR;
2503 	ahc->msgout_buf[ahc->msgout_index++] = bus_width;
2504 	ahc->msgout_len += 4;
2505 	if (bootverbose) {
2506 		printf("(%s:%c:%d:%d): Sending WDTR %x\n",
2507 		       ahc_name(ahc), devinfo->channel, devinfo->target,
2508 		       devinfo->lun, bus_width);
2509 	}
2510 }
2511 
2512 /*
2513  * Build a parallel protocol request message in our message
2514  * buffer based on the input parameters.
2515  */
2516 static void
2517 ahc_construct_ppr(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
2518 		  u_int period, u_int offset, u_int bus_width,
2519 		  u_int ppr_options)
2520 {
2521 	if (offset == 0)
2522 		period = AHC_ASYNC_XFER_PERIOD;
2523 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXTENDED;
2524 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXT_PPR_LEN;
2525 	ahc->msgout_buf[ahc->msgout_index++] = MSG_EXT_PPR;
2526 	ahc->msgout_buf[ahc->msgout_index++] = period;
2527 	ahc->msgout_buf[ahc->msgout_index++] = 0;
2528 	ahc->msgout_buf[ahc->msgout_index++] = offset;
2529 	ahc->msgout_buf[ahc->msgout_index++] = bus_width;
2530 	ahc->msgout_buf[ahc->msgout_index++] = ppr_options;
2531 	ahc->msgout_len += 8;
2532 	if (bootverbose) {
2533 		printf("(%s:%c:%d:%d): Sending PPR bus_width %x, period %x, "
2534 		       "offset %x, ppr_options %x\n", ahc_name(ahc),
2535 		       devinfo->channel, devinfo->target, devinfo->lun,
2536 		       bus_width, period, offset, ppr_options);
2537 	}
2538 }
2539 
2540 /*
2541  * Clear any active message state.
2542  */
2543 static void
2544 ahc_clear_msg_state(struct ahc_softc *ahc)
2545 {
2546 	ahc->msgout_len = 0;
2547 	ahc->msgin_index = 0;
2548 	ahc->msg_type = MSG_TYPE_NONE;
2549 	if ((ahc_inb(ahc, SCSISIGI) & ATNI) != 0) {
2550 		/*
2551 		 * The target didn't care to respond to our
2552 		 * message request, so clear ATN.
2553 		 */
2554 		ahc_outb(ahc, CLRSINT1, CLRATNO);
2555 	}
2556 	ahc_outb(ahc, MSG_OUT, MSG_NOOP);
2557 	ahc_outb(ahc, SEQ_FLAGS2,
2558 		 ahc_inb(ahc, SEQ_FLAGS2) & ~TARGET_MSG_PENDING);
2559 }
2560 
2561 static void
2562 ahc_handle_proto_violation(struct ahc_softc *ahc)
2563 {
2564 	struct	ahc_devinfo devinfo;
2565 	struct	scb *scb;
2566 	u_int	scbid;
2567 	u_int	seq_flags;
2568 	u_int	curphase;
2569 	u_int	lastphase;
2570 	int	found;
2571 
2572 	ahc_fetch_devinfo(ahc, &devinfo);
2573 	scbid = ahc_inb(ahc, SCB_TAG);
2574 	scb = ahc_lookup_scb(ahc, scbid);
2575 	seq_flags = ahc_inb(ahc, SEQ_FLAGS);
2576 	curphase = ahc_inb(ahc, SCSISIGI) & PHASE_MASK;
2577 	lastphase = ahc_inb(ahc, LASTPHASE);
2578 	if ((seq_flags & NOT_IDENTIFIED) != 0) {
2579 
2580 		/*
2581 		 * The reconnecting target either did not send an
2582 		 * identify message, or did, but we didn't find an SCB
2583 		 * to match.
2584 		 */
2585 		ahc_print_devinfo(ahc, &devinfo);
2586 		printf("Target did not send an IDENTIFY message. "
2587 		       "LASTPHASE = 0x%x.\n", lastphase);
2588 		scb = NULL;
2589 	} else if (scb == NULL) {
2590 		/*
2591 		 * We don't seem to have an SCB active for this
2592 		 * transaction.  Print an error and reset the bus.
2593 		 */
2594 		ahc_print_devinfo(ahc, &devinfo);
2595 		printf("No SCB found during protocol violation\n");
2596 		goto proto_violation_reset;
2597 	} else {
2598 		aic_set_transaction_status(scb, CAM_SEQUENCE_FAIL);
2599 		if ((seq_flags & NO_CDB_SENT) != 0) {
2600 			ahc_print_path(ahc, scb);
2601 			printf("No or incomplete CDB sent to device.\n");
2602 		} else if ((ahc_inb(ahc, SCB_CONTROL) & STATUS_RCVD) == 0) {
2603 			/*
2604 			 * The target never bothered to provide status to
2605 			 * us prior to completing the command.  Since we don't
2606 			 * know the disposition of this command, we must attempt
2607 			 * to abort it.  Assert ATN and prepare to send an abort
2608 			 * message.
2609 			 */
2610 			ahc_print_path(ahc, scb);
2611 			printf("Completed command without status.\n");
2612 		} else {
2613 			ahc_print_path(ahc, scb);
2614 			printf("Unknown protocol violation.\n");
2615 			ahc_dump_card_state(ahc);
2616 		}
2617 	}
2618 	if ((lastphase & ~P_DATAIN_DT) == 0
2619 	 || lastphase == P_COMMAND) {
2620 proto_violation_reset:
2621 		/*
2622 		 * Target either went directly to data/command
2623 		 * phase or didn't respond to our ATN.
2624 		 * The only safe thing to do is to blow
2625 		 * it away with a bus reset.
2626 		 */
2627 		found = ahc_reset_channel(ahc, 'A', TRUE);
2628 		printf("%s: Issued Channel %c Bus Reset. "
2629 		       "%d SCBs aborted\n", ahc_name(ahc), 'A', found);
2630 	} else {
2631 		/*
2632 		 * Leave the selection hardware off in case
2633 		 * this abort attempt will affect yet to
2634 		 * be sent commands.
2635 		 */
2636 		ahc_outb(ahc, SCSISEQ,
2637 			 ahc_inb(ahc, SCSISEQ) & ~ENSELO);
2638 		ahc_assert_atn(ahc);
2639 		ahc_outb(ahc, MSG_OUT, HOST_MSG);
2640 		if (scb == NULL) {
2641 			ahc_print_devinfo(ahc, &devinfo);
2642 			ahc->msgout_buf[0] = MSG_ABORT_TASK;
2643 			ahc->msgout_len = 1;
2644 			ahc->msgout_index = 0;
2645 			ahc->msg_type = MSG_TYPE_INITIATOR_MSGOUT;
2646 		} else {
2647 			ahc_print_path(ahc, scb);
2648 			scb->flags |= SCB_ABORT;
2649 		}
2650 		printf("Protocol violation %s.  Attempting to abort.\n",
2651 		       ahc_lookup_phase_entry(curphase)->phasemsg);
2652 	}
2653 }
2654 
2655 /*
2656  * Manual message loop handler.
2657  */
2658 static void
2659 ahc_handle_message_phase(struct ahc_softc *ahc)
2660 {
2661 	struct	ahc_devinfo devinfo;
2662 	u_int	bus_phase;
2663 	int	end_session;
2664 
2665 	ahc_fetch_devinfo(ahc, &devinfo);
2666 	end_session = FALSE;
2667 	bus_phase = ahc_inb(ahc, SCSISIGI) & PHASE_MASK;
2668 
2669 reswitch:
2670 	switch (ahc->msg_type) {
2671 	case MSG_TYPE_INITIATOR_MSGOUT:
2672 	{
2673 		int lastbyte;
2674 		int phasemis;
2675 		int msgdone;
2676 
2677 		if (ahc->msgout_len == 0)
2678 			panic("HOST_MSG_LOOP interrupt with no active message");
2679 
2680 #ifdef AHC_DEBUG
2681 		if ((ahc_debug & AHC_SHOW_MESSAGES) != 0) {
2682 			ahc_print_devinfo(ahc, &devinfo);
2683 			printf("INITIATOR_MSG_OUT");
2684 		}
2685 #endif
2686 		phasemis = bus_phase != P_MESGOUT;
2687 		if (phasemis) {
2688 #ifdef AHC_DEBUG
2689 			if ((ahc_debug & AHC_SHOW_MESSAGES) != 0) {
2690 				printf(" PHASEMIS %s\n",
2691 				       ahc_lookup_phase_entry(bus_phase)
2692 							     ->phasemsg);
2693 			}
2694 #endif
2695 			if (bus_phase == P_MESGIN) {
2696 				/*
2697 				 * Change gears and see if
2698 				 * this messages is of interest to
2699 				 * us or should be passed back to
2700 				 * the sequencer.
2701 				 */
2702 				ahc_outb(ahc, CLRSINT1, CLRATNO);
2703 				ahc->send_msg_perror = FALSE;
2704 				ahc->msg_type = MSG_TYPE_INITIATOR_MSGIN;
2705 				ahc->msgin_index = 0;
2706 				goto reswitch;
2707 			}
2708 			end_session = TRUE;
2709 			break;
2710 		}
2711 
2712 		if (ahc->send_msg_perror) {
2713 			ahc_outb(ahc, CLRSINT1, CLRATNO);
2714 			ahc_outb(ahc, CLRSINT1, CLRREQINIT);
2715 #ifdef AHC_DEBUG
2716 			if ((ahc_debug & AHC_SHOW_MESSAGES) != 0)
2717 				printf(" byte 0x%x\n", ahc->send_msg_perror);
2718 #endif
2719 			ahc_outb(ahc, SCSIDATL, MSG_PARITY_ERROR);
2720 			break;
2721 		}
2722 
2723 		msgdone	= ahc->msgout_index == ahc->msgout_len;
2724 		if (msgdone) {
2725 			/*
2726 			 * The target has requested a retry.
2727 			 * Re-assert ATN, reset our message index to
2728 			 * 0, and try again.
2729 			 */
2730 			ahc->msgout_index = 0;
2731 			ahc_assert_atn(ahc);
2732 		}
2733 
2734 		lastbyte = ahc->msgout_index == (ahc->msgout_len - 1);
2735 		if (lastbyte) {
2736 			/* Last byte is signified by dropping ATN */
2737 			ahc_outb(ahc, CLRSINT1, CLRATNO);
2738 		}
2739 
2740 		/*
2741 		 * Clear our interrupt status and present
2742 		 * the next byte on the bus.
2743 		 */
2744 		ahc_outb(ahc, CLRSINT1, CLRREQINIT);
2745 #ifdef AHC_DEBUG
2746 		if ((ahc_debug & AHC_SHOW_MESSAGES) != 0)
2747 			printf(" byte 0x%x\n",
2748 			       ahc->msgout_buf[ahc->msgout_index]);
2749 #endif
2750 		ahc_outb(ahc, SCSIDATL, ahc->msgout_buf[ahc->msgout_index++]);
2751 		break;
2752 	}
2753 	case MSG_TYPE_INITIATOR_MSGIN:
2754 	{
2755 		int phasemis;
2756 		int message_done;
2757 
2758 #ifdef AHC_DEBUG
2759 		if ((ahc_debug & AHC_SHOW_MESSAGES) != 0) {
2760 			ahc_print_devinfo(ahc, &devinfo);
2761 			printf("INITIATOR_MSG_IN");
2762 		}
2763 #endif
2764 		phasemis = bus_phase != P_MESGIN;
2765 		if (phasemis) {
2766 #ifdef AHC_DEBUG
2767 			if ((ahc_debug & AHC_SHOW_MESSAGES) != 0) {
2768 				printf(" PHASEMIS %s\n",
2769 				       ahc_lookup_phase_entry(bus_phase)
2770 							     ->phasemsg);
2771 			}
2772 #endif
2773 			ahc->msgin_index = 0;
2774 			if (bus_phase == P_MESGOUT
2775 			 && (ahc->send_msg_perror == TRUE
2776 			  || (ahc->msgout_len != 0
2777 			   && ahc->msgout_index == 0))) {
2778 				ahc->msg_type = MSG_TYPE_INITIATOR_MSGOUT;
2779 				goto reswitch;
2780 			}
2781 			end_session = TRUE;
2782 			break;
2783 		}
2784 
2785 		/* Pull the byte in without acking it */
2786 		ahc->msgin_buf[ahc->msgin_index] = ahc_inb(ahc, SCSIBUSL);
2787 #ifdef AHC_DEBUG
2788 		if ((ahc_debug & AHC_SHOW_MESSAGES) != 0)
2789 			printf(" byte 0x%x\n",
2790 			       ahc->msgin_buf[ahc->msgin_index]);
2791 #endif
2792 
2793 		message_done = ahc_parse_msg(ahc, &devinfo);
2794 
2795 		if (message_done) {
2796 			/*
2797 			 * Clear our incoming message buffer in case there
2798 			 * is another message following this one.
2799 			 */
2800 			ahc->msgin_index = 0;
2801 
2802 			/*
2803 			 * If this message illicited a response,
2804 			 * assert ATN so the target takes us to the
2805 			 * message out phase.
2806 			 */
2807 			if (ahc->msgout_len != 0) {
2808 #ifdef AHC_DEBUG
2809 				if ((ahc_debug & AHC_SHOW_MESSAGES) != 0) {
2810 					ahc_print_devinfo(ahc, &devinfo);
2811 					printf("Asserting ATN for response\n");
2812 				}
2813 #endif
2814 				ahc_assert_atn(ahc);
2815 			}
2816 		} else
2817 			ahc->msgin_index++;
2818 
2819 		if (message_done == MSGLOOP_TERMINATED) {
2820 			end_session = TRUE;
2821 		} else {
2822 			/* Ack the byte */
2823 			ahc_outb(ahc, CLRSINT1, CLRREQINIT);
2824 			ahc_inb(ahc, SCSIDATL);
2825 		}
2826 		break;
2827 	}
2828 	case MSG_TYPE_TARGET_MSGIN:
2829 	{
2830 		int msgdone;
2831 
2832 		if (ahc->msgout_len == 0)
2833 			panic("Target MSGIN with no active message");
2834 
2835 #ifdef AHC_DEBUG
2836 		if ((ahc_debug & AHC_SHOW_MESSAGES) != 0) {
2837 			ahc_print_devinfo(ahc, &devinfo);
2838 			printf("TARGET_MSG_IN");
2839 		}
2840 #endif
2841 
2842 		/*
2843 		 * If we interrupted a mesgout session, the initiator
2844 		 * will not know this until our first REQ.  So, we
2845 		 * only honor mesgout requests after we've sent our
2846 		 * first byte.
2847 		 */
2848 		if ((ahc_inb(ahc, SCSISIGI) & ATNI) != 0
2849 		 && ahc->msgout_index > 0) {
2850 
2851 			/*
2852 			 * Change gears and see if this messages is
2853 			 * of interest to us or should be passed back
2854 			 * to the sequencer.
2855 			 */
2856 #ifdef AHC_DEBUG
2857 			if ((ahc_debug & AHC_SHOW_MESSAGES) != 0)
2858 				printf(" Honoring ATN Request.\n");
2859 #endif
2860 			ahc->msg_type = MSG_TYPE_TARGET_MSGOUT;
2861 
2862 			/*
2863 			 * Disable SCSI Programmed I/O during the
2864 			 * phase change so as to avoid phantom REQs.
2865 			 */
2866 			ahc_outb(ahc, SXFRCTL0,
2867 				 ahc_inb(ahc, SXFRCTL0) & ~SPIOEN);
2868 
2869 			/*
2870 			 * Since SPIORDY asserts when ACK is asserted
2871 			 * for P_MSGOUT, and SPIORDY's assertion triggered
2872 			 * our entry into this routine, wait for ACK to
2873 			 * *de-assert* before changing phases.
2874 			 */
2875 			while ((ahc_inb(ahc, SCSISIGI) & ACKI) != 0)
2876 				;
2877 
2878 			ahc_outb(ahc, SCSISIGO, P_MESGOUT | BSYO);
2879 
2880 			/*
2881 			 * All phase line changes require a bus
2882 			 * settle delay before REQ is asserted.
2883 			 * [SCSI SPI4 10.7.1]
2884 			 */
2885 			ahc_flush_device_writes(ahc);
2886 			aic_delay(AHC_BUSSETTLE_DELAY);
2887 
2888 			ahc->msgin_index = 0;
2889 			/* Enable SCSI Programmed I/O to REQ for first byte */
2890 			ahc_outb(ahc, SXFRCTL0,
2891 				 ahc_inb(ahc, SXFRCTL0) | SPIOEN);
2892 			break;
2893 		}
2894 
2895 		msgdone = ahc->msgout_index == ahc->msgout_len;
2896 		if (msgdone) {
2897 			ahc_outb(ahc, SXFRCTL0,
2898 				 ahc_inb(ahc, SXFRCTL0) & ~SPIOEN);
2899 			end_session = TRUE;
2900 			break;
2901 		}
2902 
2903 		/*
2904 		 * Present the next byte on the bus.
2905 		 */
2906 #ifdef AHC_DEBUG
2907 		if ((ahc_debug & AHC_SHOW_MESSAGES) != 0)
2908 			printf(" byte 0x%x\n",
2909 			       ahc->msgout_buf[ahc->msgout_index]);
2910 #endif
2911 		ahc_outb(ahc, SXFRCTL0, ahc_inb(ahc, SXFRCTL0) | SPIOEN);
2912 		ahc_outb(ahc, SCSIDATL, ahc->msgout_buf[ahc->msgout_index++]);
2913 		break;
2914 	}
2915 	case MSG_TYPE_TARGET_MSGOUT:
2916 	{
2917 		int lastbyte;
2918 		int msgdone;
2919 
2920 #ifdef AHC_DEBUG
2921 		if ((ahc_debug & AHC_SHOW_MESSAGES) != 0) {
2922 			ahc_print_devinfo(ahc, &devinfo);
2923 			printf("TARGET_MSG_OUT");
2924 		}
2925 #endif
2926 		/*
2927 		 * The initiator signals that this is
2928 		 * the last byte by dropping ATN.
2929 		 */
2930 		lastbyte = (ahc_inb(ahc, SCSISIGI) & ATNI) == 0;
2931 
2932 		/*
2933 		 * Read the latched byte, but turn off SPIOEN first
2934 		 * so that we don't inadvertently cause a REQ for the
2935 		 * next byte.
2936 		 */
2937 		ahc_outb(ahc, SXFRCTL0, ahc_inb(ahc, SXFRCTL0) & ~SPIOEN);
2938 		ahc->msgin_buf[ahc->msgin_index] = ahc_inb(ahc, SCSIDATL);
2939 
2940 #ifdef AHC_DEBUG
2941 		if ((ahc_debug & AHC_SHOW_MESSAGES) != 0)
2942 			printf(" byte 0x%x\n",
2943 			       ahc->msgin_buf[ahc->msgin_index]);
2944 #endif
2945 
2946 		msgdone = ahc_parse_msg(ahc, &devinfo);
2947 		if (msgdone == MSGLOOP_TERMINATED) {
2948 			/*
2949 			 * The message is *really* done in that it caused
2950 			 * us to go to bus free.  The sequencer has already
2951 			 * been reset at this point, so pull the ejection
2952 			 * handle.
2953 			 */
2954 			return;
2955 		}
2956 
2957 		ahc->msgin_index++;
2958 
2959 		/*
2960 		 * XXX Read spec about initiator dropping ATN too soon
2961 		 *     and use msgdone to detect it.
2962 		 */
2963 		if (msgdone == MSGLOOP_MSGCOMPLETE) {
2964 			ahc->msgin_index = 0;
2965 
2966 			/*
2967 			 * If this message illicited a response, transition
2968 			 * to the Message in phase and send it.
2969 			 */
2970 			if (ahc->msgout_len != 0) {
2971 #ifdef AHC_DEBUG
2972 				if ((ahc_debug & AHC_SHOW_MESSAGES) != 0) {
2973 					ahc_print_devinfo(ahc, &devinfo);
2974 					printf(" preparing response.\n");
2975 				}
2976 #endif
2977 				ahc_outb(ahc, SCSISIGO, P_MESGIN | BSYO);
2978 
2979 				/*
2980 				 * All phase line changes require a bus
2981 				 * settle delay before REQ is asserted.
2982 				 * [SCSI SPI4 10.7.1]  When transitioning
2983 				 * from an OUT to an IN phase, we must
2984 				 * also wait a data release delay to allow
2985 				 * the initiator time to release the data
2986 				 * lines. [SCSI SPI4 10.12]
2987 				 */
2988 				ahc_flush_device_writes(ahc);
2989 				aic_delay(AHC_BUSSETTLE_DELAY
2990 					+ AHC_DATARELEASE_DELAY);
2991 
2992 				/*
2993 				 * Enable SCSI Programmed I/O.  This will
2994 				 * immediately cause SPIORDY to assert,
2995 				 * and the sequencer will call our message
2996 				 * loop again.
2997 				 */
2998 				ahc_outb(ahc, SXFRCTL0,
2999 					 ahc_inb(ahc, SXFRCTL0) | SPIOEN);
3000 				ahc->msg_type = MSG_TYPE_TARGET_MSGIN;
3001 				ahc->msgin_index = 0;
3002 				break;
3003 			}
3004 		}
3005 
3006 		if (lastbyte)
3007 			end_session = TRUE;
3008 		else {
3009 			/* Ask for the next byte. */
3010 			ahc_outb(ahc, SXFRCTL0,
3011 				 ahc_inb(ahc, SXFRCTL0) | SPIOEN);
3012 		}
3013 
3014 		break;
3015 	}
3016 	default:
3017 		panic("Unknown REQINIT message type");
3018 	}
3019 
3020 	if (end_session) {
3021 		ahc_clear_msg_state(ahc);
3022 		ahc_outb(ahc, RETURN_1, EXIT_MSG_LOOP);
3023 	} else
3024 		ahc_outb(ahc, RETURN_1, CONT_MSG_LOOP);
3025 }
3026 
3027 /*
3028  * See if we sent a particular extended message to the target.
3029  * If "full" is true, return true only if the target saw the full
3030  * message.  If "full" is false, return true if the target saw at
3031  * least the first byte of the message.
3032  */
3033 static int
3034 ahc_sent_msg(struct ahc_softc *ahc, ahc_msgtype type, u_int msgval, int full)
3035 {
3036 	int found;
3037 	u_int index;
3038 
3039 	found = FALSE;
3040 	index = 0;
3041 
3042 	while (index < ahc->msgout_len) {
3043 		if (ahc->msgout_buf[index] == MSG_EXTENDED) {
3044 			u_int end_index;
3045 
3046 			end_index = index + 1 + ahc->msgout_buf[index + 1];
3047 			if (ahc->msgout_buf[index+2] == msgval
3048 			 && type == AHCMSG_EXT) {
3049 
3050 				if (full) {
3051 					if (ahc->msgout_index > end_index)
3052 						found = TRUE;
3053 				} else if (ahc->msgout_index > index)
3054 					found = TRUE;
3055 			}
3056 			index = end_index;
3057 		} else if (ahc->msgout_buf[index] >= MSG_SIMPLE_TASK
3058 			&& ahc->msgout_buf[index] <= MSG_IGN_WIDE_RESIDUE) {
3059 
3060 			/* Skip tag type and tag id or residue param*/
3061 			index += 2;
3062 		} else {
3063 			/* Single byte message */
3064 			if (type == AHCMSG_1B
3065 			 && ahc->msgout_buf[index] == msgval
3066 			 && ahc->msgout_index > index)
3067 				found = TRUE;
3068 			index++;
3069 		}
3070 
3071 		if (found)
3072 			break;
3073 	}
3074 	return (found);
3075 }
3076 
3077 /*
3078  * Wait for a complete incoming message, parse it, and respond accordingly.
3079  */
3080 static int
3081 ahc_parse_msg(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
3082 {
3083 	struct	ahc_initiator_tinfo *tinfo;
3084 	struct	ahc_tmode_tstate *tstate;
3085 	int	reject;
3086 	int	done;
3087 	int	response;
3088 	u_int	targ_scsirate;
3089 
3090 	done = MSGLOOP_IN_PROG;
3091 	response = FALSE;
3092 	reject = FALSE;
3093 	tinfo = ahc_fetch_transinfo(ahc, devinfo->channel, devinfo->our_scsiid,
3094 				    devinfo->target, &tstate);
3095 	targ_scsirate = tinfo->scsirate;
3096 
3097 	/*
3098 	 * Parse as much of the message as is available,
3099 	 * rejecting it if we don't support it.  When
3100 	 * the entire message is available and has been
3101 	 * handled, return MSGLOOP_MSGCOMPLETE, indicating
3102 	 * that we have parsed an entire message.
3103 	 *
3104 	 * In the case of extended messages, we accept the length
3105 	 * byte outright and perform more checking once we know the
3106 	 * extended message type.
3107 	 */
3108 	switch (ahc->msgin_buf[0]) {
3109 	case MSG_DISCONNECT:
3110 	case MSG_SAVEDATAPOINTER:
3111 	case MSG_CMDCOMPLETE:
3112 	case MSG_RESTOREPOINTERS:
3113 	case MSG_IGN_WIDE_RESIDUE:
3114 		/*
3115 		 * End our message loop as these are messages
3116 		 * the sequencer handles on its own.
3117 		 */
3118 		done = MSGLOOP_TERMINATED;
3119 		break;
3120 	case MSG_MESSAGE_REJECT:
3121 		response = ahc_handle_msg_reject(ahc, devinfo);
3122 		/* FALLTHROUGH */
3123 	case MSG_NOOP:
3124 		done = MSGLOOP_MSGCOMPLETE;
3125 		break;
3126 	case MSG_EXTENDED:
3127 	{
3128 		/* Wait for enough of the message to begin validation */
3129 		if (ahc->msgin_index < 2)
3130 			break;
3131 		switch (ahc->msgin_buf[2]) {
3132 		case MSG_EXT_SDTR:
3133 		{
3134 			struct	 ahc_syncrate *syncrate;
3135 			u_int	 period;
3136 			u_int	 ppr_options;
3137 			u_int	 offset;
3138 			u_int	 saved_offset;
3139 
3140 			if (ahc->msgin_buf[1] != MSG_EXT_SDTR_LEN) {
3141 				reject = TRUE;
3142 				break;
3143 			}
3144 
3145 			/*
3146 			 * Wait until we have both args before validating
3147 			 * and acting on this message.
3148 			 *
3149 			 * Add one to MSG_EXT_SDTR_LEN to account for
3150 			 * the extended message preamble.
3151 			 */
3152 			if (ahc->msgin_index < (MSG_EXT_SDTR_LEN + 1))
3153 				break;
3154 
3155 			period = ahc->msgin_buf[3];
3156 			ppr_options = 0;
3157 			saved_offset = offset = ahc->msgin_buf[4];
3158 			syncrate = ahc_devlimited_syncrate(ahc, tinfo, &period,
3159 							   &ppr_options,
3160 							   devinfo->role);
3161 			ahc_validate_offset(ahc, tinfo, syncrate, &offset,
3162 					    targ_scsirate & WIDEXFER,
3163 					    devinfo->role);
3164 			if (bootverbose) {
3165 				printf("(%s:%c:%d:%d): Received "
3166 				       "SDTR period %x, offset %x\n\t"
3167 				       "Filtered to period %x, offset %x\n",
3168 				       ahc_name(ahc), devinfo->channel,
3169 				       devinfo->target, devinfo->lun,
3170 				       ahc->msgin_buf[3], saved_offset,
3171 				       period, offset);
3172 			}
3173 			ahc_set_syncrate(ahc, devinfo,
3174 					 syncrate, period,
3175 					 offset, ppr_options,
3176 					 AHC_TRANS_ACTIVE|AHC_TRANS_GOAL,
3177 					 /*paused*/TRUE);
3178 
3179 			/*
3180 			 * See if we initiated Sync Negotiation
3181 			 * and didn't have to fall down to async
3182 			 * transfers.
3183 			 */
3184 			if (ahc_sent_msg(ahc, AHCMSG_EXT, MSG_EXT_SDTR, TRUE)) {
3185 				/* We started it */
3186 				if (saved_offset != offset) {
3187 					/* Went too low - force async */
3188 					reject = TRUE;
3189 				}
3190 			} else {
3191 				/*
3192 				 * Send our own SDTR in reply
3193 				 */
3194 				if (bootverbose
3195 				 && devinfo->role == ROLE_INITIATOR) {
3196 					printf("(%s:%c:%d:%d): Target "
3197 					       "Initiated SDTR\n",
3198 					       ahc_name(ahc), devinfo->channel,
3199 					       devinfo->target, devinfo->lun);
3200 				}
3201 				ahc->msgout_index = 0;
3202 				ahc->msgout_len = 0;
3203 				ahc_construct_sdtr(ahc, devinfo,
3204 						   period, offset);
3205 				ahc->msgout_index = 0;
3206 				response = TRUE;
3207 			}
3208 			done = MSGLOOP_MSGCOMPLETE;
3209 			break;
3210 		}
3211 		case MSG_EXT_WDTR:
3212 		{
3213 			u_int bus_width;
3214 			u_int saved_width;
3215 			u_int sending_reply;
3216 
3217 			sending_reply = FALSE;
3218 			if (ahc->msgin_buf[1] != MSG_EXT_WDTR_LEN) {
3219 				reject = TRUE;
3220 				break;
3221 			}
3222 
3223 			/*
3224 			 * Wait until we have our arg before validating
3225 			 * and acting on this message.
3226 			 *
3227 			 * Add one to MSG_EXT_WDTR_LEN to account for
3228 			 * the extended message preamble.
3229 			 */
3230 			if (ahc->msgin_index < (MSG_EXT_WDTR_LEN + 1))
3231 				break;
3232 
3233 			bus_width = ahc->msgin_buf[3];
3234 			saved_width = bus_width;
3235 			ahc_validate_width(ahc, tinfo, &bus_width,
3236 					   devinfo->role);
3237 			if (bootverbose) {
3238 				printf("(%s:%c:%d:%d): Received WDTR "
3239 				       "%x filtered to %x\n",
3240 				       ahc_name(ahc), devinfo->channel,
3241 				       devinfo->target, devinfo->lun,
3242 				       saved_width, bus_width);
3243 			}
3244 
3245 			if (ahc_sent_msg(ahc, AHCMSG_EXT, MSG_EXT_WDTR, TRUE)) {
3246 				/*
3247 				 * Don't send a WDTR back to the
3248 				 * target, since we asked first.
3249 				 * If the width went higher than our
3250 				 * request, reject it.
3251 				 */
3252 				if (saved_width > bus_width) {
3253 					reject = TRUE;
3254 					printf("(%s:%c:%d:%d): requested %dBit "
3255 					       "transfers.  Rejecting...\n",
3256 					       ahc_name(ahc), devinfo->channel,
3257 					       devinfo->target, devinfo->lun,
3258 					       8 * (0x01 << bus_width));
3259 					bus_width = 0;
3260 				}
3261 			} else {
3262 				/*
3263 				 * Send our own WDTR in reply
3264 				 */
3265 				if (bootverbose
3266 				 && devinfo->role == ROLE_INITIATOR) {
3267 					printf("(%s:%c:%d:%d): Target "
3268 					       "Initiated WDTR\n",
3269 					       ahc_name(ahc), devinfo->channel,
3270 					       devinfo->target, devinfo->lun);
3271 				}
3272 				ahc->msgout_index = 0;
3273 				ahc->msgout_len = 0;
3274 				ahc_construct_wdtr(ahc, devinfo, bus_width);
3275 				ahc->msgout_index = 0;
3276 				response = TRUE;
3277 				sending_reply = TRUE;
3278 			}
3279 			/*
3280 			 * After a wide message, we are async, but
3281 			 * some devices don't seem to honor this portion
3282 			 * of the spec.  Force a renegotiation of the
3283 			 * sync component of our transfer agreement even
3284 			 * if our goal is async.  By updating our width
3285 			 * after forcing the negotiation, we avoid
3286 			 * renegotiating for width.
3287 			 */
3288 			ahc_update_neg_request(ahc, devinfo, tstate,
3289 					       tinfo, AHC_NEG_ALWAYS);
3290 			ahc_set_width(ahc, devinfo, bus_width,
3291 				      AHC_TRANS_ACTIVE|AHC_TRANS_GOAL,
3292 				      /*paused*/TRUE);
3293 			if (sending_reply == FALSE && reject == FALSE) {
3294 
3295 				/*
3296 				 * We will always have an SDTR to send.
3297 				 */
3298 				ahc->msgout_index = 0;
3299 				ahc->msgout_len = 0;
3300 				ahc_build_transfer_msg(ahc, devinfo);
3301 				ahc->msgout_index = 0;
3302 				response = TRUE;
3303 			}
3304 			done = MSGLOOP_MSGCOMPLETE;
3305 			break;
3306 		}
3307 		case MSG_EXT_PPR:
3308 		{
3309 			struct	ahc_syncrate *syncrate;
3310 			u_int	period;
3311 			u_int	offset;
3312 			u_int	bus_width;
3313 			u_int	ppr_options;
3314 			u_int	saved_width;
3315 			u_int	saved_offset;
3316 			u_int	saved_ppr_options;
3317 
3318 			if (ahc->msgin_buf[1] != MSG_EXT_PPR_LEN) {
3319 				reject = TRUE;
3320 				break;
3321 			}
3322 
3323 			/*
3324 			 * Wait until we have all args before validating
3325 			 * and acting on this message.
3326 			 *
3327 			 * Add one to MSG_EXT_PPR_LEN to account for
3328 			 * the extended message preamble.
3329 			 */
3330 			if (ahc->msgin_index < (MSG_EXT_PPR_LEN + 1))
3331 				break;
3332 
3333 			period = ahc->msgin_buf[3];
3334 			offset = ahc->msgin_buf[5];
3335 			bus_width = ahc->msgin_buf[6];
3336 			saved_width = bus_width;
3337 			ppr_options = ahc->msgin_buf[7];
3338 			/*
3339 			 * According to the spec, a DT only
3340 			 * period factor with no DT option
3341 			 * set implies async.
3342 			 */
3343 			if ((ppr_options & MSG_EXT_PPR_DT_REQ) == 0
3344 			 && period == 9)
3345 				offset = 0;
3346 			saved_ppr_options = ppr_options;
3347 			saved_offset = offset;
3348 
3349 			/*
3350 			 * Mask out any options we don't support
3351 			 * on any controller.  Transfer options are
3352 			 * only available if we are negotiating wide.
3353 			 */
3354 			ppr_options &= MSG_EXT_PPR_DT_REQ;
3355 			if (bus_width == 0)
3356 				ppr_options = 0;
3357 
3358 			ahc_validate_width(ahc, tinfo, &bus_width,
3359 					   devinfo->role);
3360 			syncrate = ahc_devlimited_syncrate(ahc, tinfo, &period,
3361 							   &ppr_options,
3362 							   devinfo->role);
3363 			ahc_validate_offset(ahc, tinfo, syncrate,
3364 					    &offset, bus_width,
3365 					    devinfo->role);
3366 
3367 			if (ahc_sent_msg(ahc, AHCMSG_EXT, MSG_EXT_PPR, TRUE)) {
3368 				/*
3369 				 * If we are unable to do any of the
3370 				 * requested options (we went too low),
3371 				 * then we'll have to reject the message.
3372 				 */
3373 				if (saved_width > bus_width
3374 				 || saved_offset != offset
3375 				 || saved_ppr_options != ppr_options) {
3376 					reject = TRUE;
3377 					period = 0;
3378 					offset = 0;
3379 					bus_width = 0;
3380 					ppr_options = 0;
3381 					syncrate = NULL;
3382 				}
3383 			} else {
3384 				if (devinfo->role != ROLE_TARGET)
3385 					printf("(%s:%c:%d:%d): Target "
3386 					       "Initiated PPR\n",
3387 					       ahc_name(ahc), devinfo->channel,
3388 					       devinfo->target, devinfo->lun);
3389 				else
3390 					printf("(%s:%c:%d:%d): Initiator "
3391 					       "Initiated PPR\n",
3392 					       ahc_name(ahc), devinfo->channel,
3393 					       devinfo->target, devinfo->lun);
3394 				ahc->msgout_index = 0;
3395 				ahc->msgout_len = 0;
3396 				ahc_construct_ppr(ahc, devinfo, period, offset,
3397 						  bus_width, ppr_options);
3398 				ahc->msgout_index = 0;
3399 				response = TRUE;
3400 			}
3401 			if (bootverbose) {
3402 				printf("(%s:%c:%d:%d): Received PPR width %x, "
3403 				       "period %x, offset %x,options %x\n"
3404 				       "\tFiltered to width %x, period %x, "
3405 				       "offset %x, options %x\n",
3406 				       ahc_name(ahc), devinfo->channel,
3407 				       devinfo->target, devinfo->lun,
3408 				       saved_width, ahc->msgin_buf[3],
3409 				       saved_offset, saved_ppr_options,
3410 				       bus_width, period, offset, ppr_options);
3411 			}
3412 			ahc_set_width(ahc, devinfo, bus_width,
3413 				      AHC_TRANS_ACTIVE|AHC_TRANS_GOAL,
3414 				      /*paused*/TRUE);
3415 			ahc_set_syncrate(ahc, devinfo,
3416 					 syncrate, period,
3417 					 offset, ppr_options,
3418 					 AHC_TRANS_ACTIVE|AHC_TRANS_GOAL,
3419 					 /*paused*/TRUE);
3420 			done = MSGLOOP_MSGCOMPLETE;
3421 			break;
3422 		}
3423 		default:
3424 			/* Unknown extended message.  Reject it. */
3425 			reject = TRUE;
3426 			break;
3427 		}
3428 		break;
3429 	}
3430 #ifdef AHC_TARGET_MODE
3431 	case MSG_BUS_DEV_RESET:
3432 		ahc_handle_devreset(ahc, devinfo,
3433 				    CAM_BDR_SENT,
3434 				    "Bus Device Reset Received",
3435 				    /*verbose_level*/0);
3436 		ahc_restart(ahc);
3437 		done = MSGLOOP_TERMINATED;
3438 		break;
3439 	case MSG_ABORT_TAG:
3440 	case MSG_ABORT:
3441 	case MSG_CLEAR_QUEUE:
3442 	{
3443 		int tag;
3444 
3445 		/* Target mode messages */
3446 		if (devinfo->role != ROLE_TARGET) {
3447 			reject = TRUE;
3448 			break;
3449 		}
3450 		tag = SCB_LIST_NULL;
3451 		if (ahc->msgin_buf[0] == MSG_ABORT_TAG)
3452 			tag = ahc_inb(ahc, INITIATOR_TAG);
3453 		ahc_abort_scbs(ahc, devinfo->target, devinfo->channel,
3454 			       devinfo->lun, tag, ROLE_TARGET,
3455 			       CAM_REQ_ABORTED);
3456 
3457 		tstate = ahc->enabled_targets[devinfo->our_scsiid];
3458 		if (tstate != NULL) {
3459 			struct ahc_tmode_lstate* lstate;
3460 
3461 			lstate = tstate->enabled_luns[devinfo->lun];
3462 			if (lstate != NULL) {
3463 				ahc_queue_lstate_event(ahc, lstate,
3464 						       devinfo->our_scsiid,
3465 						       ahc->msgin_buf[0],
3466 						       /*arg*/tag);
3467 				ahc_send_lstate_events(ahc, lstate);
3468 			}
3469 		}
3470 		ahc_restart(ahc);
3471 		done = MSGLOOP_TERMINATED;
3472 		break;
3473 	}
3474 #endif
3475 	case MSG_TERM_IO_PROC:
3476 	default:
3477 		reject = TRUE;
3478 		break;
3479 	}
3480 
3481 	if (reject) {
3482 		/*
3483 		 * Setup to reject the message.
3484 		 */
3485 		ahc->msgout_index = 0;
3486 		ahc->msgout_len = 1;
3487 		ahc->msgout_buf[0] = MSG_MESSAGE_REJECT;
3488 		done = MSGLOOP_MSGCOMPLETE;
3489 		response = TRUE;
3490 	}
3491 
3492 	if (done != MSGLOOP_IN_PROG && !response)
3493 		/* Clear the outgoing message buffer */
3494 		ahc->msgout_len = 0;
3495 
3496 	return (done);
3497 }
3498 
3499 /*
3500  * Process a message reject message.
3501  */
3502 static int
3503 ahc_handle_msg_reject(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
3504 {
3505 	/*
3506 	 * What we care about here is if we had an
3507 	 * outstanding SDTR or WDTR message for this
3508 	 * target.  If we did, this is a signal that
3509 	 * the target is refusing negotiation.
3510 	 */
3511 	struct scb *scb;
3512 	struct ahc_initiator_tinfo *tinfo;
3513 	struct ahc_tmode_tstate *tstate;
3514 	u_int scb_index;
3515 	u_int last_msg;
3516 	int   response = 0;
3517 
3518 	scb_index = ahc_inb(ahc, SCB_TAG);
3519 	scb = ahc_lookup_scb(ahc, scb_index);
3520 	tinfo = ahc_fetch_transinfo(ahc, devinfo->channel,
3521 				    devinfo->our_scsiid,
3522 				    devinfo->target, &tstate);
3523 	/* Might be necessary */
3524 	last_msg = ahc_inb(ahc, LAST_MSG);
3525 
3526 	if (ahc_sent_msg(ahc, AHCMSG_EXT, MSG_EXT_PPR, /*full*/FALSE)) {
3527 		/*
3528 		 * Target does not support the PPR message.
3529 		 * Attempt to negotiate SPI-2 style.
3530 		 */
3531 		if (bootverbose) {
3532 			printf("(%s:%c:%d:%d): PPR Rejected. "
3533 			       "Trying WDTR/SDTR\n",
3534 			       ahc_name(ahc), devinfo->channel,
3535 			       devinfo->target, devinfo->lun);
3536 		}
3537 		tinfo->goal.ppr_options = 0;
3538 		tinfo->curr.transport_version = 2;
3539 		tinfo->goal.transport_version = 2;
3540 		ahc->msgout_index = 0;
3541 		ahc->msgout_len = 0;
3542 		ahc_build_transfer_msg(ahc, devinfo);
3543 		ahc->msgout_index = 0;
3544 		response = 1;
3545 	} else if (ahc_sent_msg(ahc, AHCMSG_EXT, MSG_EXT_WDTR, /*full*/FALSE)) {
3546 
3547 		/* note 8bit xfers */
3548 		printf("(%s:%c:%d:%d): refuses WIDE negotiation.  Using "
3549 		       "8bit transfers\n", ahc_name(ahc),
3550 		       devinfo->channel, devinfo->target, devinfo->lun);
3551 		ahc_set_width(ahc, devinfo, MSG_EXT_WDTR_BUS_8_BIT,
3552 			      AHC_TRANS_ACTIVE|AHC_TRANS_GOAL,
3553 			      /*paused*/TRUE);
3554 		/*
3555 		 * No need to clear the sync rate.  If the target
3556 		 * did not accept the command, our syncrate is
3557 		 * unaffected.  If the target started the negotiation,
3558 		 * but rejected our response, we already cleared the
3559 		 * sync rate before sending our WDTR.
3560 		 */
3561 		if (tinfo->goal.offset != tinfo->curr.offset) {
3562 
3563 			/* Start the sync negotiation */
3564 			ahc->msgout_index = 0;
3565 			ahc->msgout_len = 0;
3566 			ahc_build_transfer_msg(ahc, devinfo);
3567 			ahc->msgout_index = 0;
3568 			response = 1;
3569 		}
3570 	} else if (ahc_sent_msg(ahc, AHCMSG_EXT, MSG_EXT_SDTR, /*full*/FALSE)) {
3571 		/* note asynch xfers and clear flag */
3572 		ahc_set_syncrate(ahc, devinfo, /*syncrate*/NULL, /*period*/0,
3573 				 /*offset*/0, /*ppr_options*/0,
3574 				 AHC_TRANS_ACTIVE|AHC_TRANS_GOAL,
3575 				 /*paused*/TRUE);
3576 		printf("(%s:%c:%d:%d): refuses synchronous negotiation. "
3577 		       "Using asynchronous transfers\n",
3578 		       ahc_name(ahc), devinfo->channel,
3579 		       devinfo->target, devinfo->lun);
3580 	} else if ((scb->hscb->control & MSG_SIMPLE_TASK) != 0) {
3581 		int tag_type;
3582 		int mask;
3583 
3584 		tag_type = (scb->hscb->control & MSG_SIMPLE_TASK);
3585 
3586 		if (tag_type == MSG_SIMPLE_TASK) {
3587 			printf("(%s:%c:%d:%d): refuses tagged commands.  "
3588 			       "Performing non-tagged I/O\n", ahc_name(ahc),
3589 			       devinfo->channel, devinfo->target, devinfo->lun);
3590 			ahc_set_tags(ahc, devinfo, AHC_QUEUE_NONE);
3591 			mask = ~0x23;
3592 		} else {
3593 			printf("(%s:%c:%d:%d): refuses %s tagged commands.  "
3594 			       "Performing simple queue tagged I/O only\n",
3595 			       ahc_name(ahc), devinfo->channel, devinfo->target,
3596 			       devinfo->lun, tag_type == MSG_ORDERED_TASK
3597 			       ? "ordered" : "head of queue");
3598 			ahc_set_tags(ahc, devinfo, AHC_QUEUE_BASIC);
3599 			mask = ~0x03;
3600 		}
3601 
3602 		/*
3603 		 * Resend the identify for this CCB as the target
3604 		 * may believe that the selection is invalid otherwise.
3605 		 */
3606 		ahc_outb(ahc, SCB_CONTROL,
3607 			 ahc_inb(ahc, SCB_CONTROL) & mask);
3608 	 	scb->hscb->control &= mask;
3609 		aic_set_transaction_tag(scb, /*enabled*/FALSE,
3610 					/*type*/MSG_SIMPLE_TASK);
3611 		ahc_outb(ahc, MSG_OUT, MSG_IDENTIFYFLAG);
3612 		ahc_assert_atn(ahc);
3613 
3614 		/*
3615 		 * This transaction is now at the head of
3616 		 * the untagged queue for this target.
3617 		 */
3618 		if ((ahc->flags & AHC_SCB_BTT) == 0) {
3619 			struct scb_tailq *untagged_q;
3620 
3621 			untagged_q =
3622 			    &(ahc->untagged_queues[devinfo->target_offset]);
3623 			TAILQ_INSERT_HEAD(untagged_q, scb, links.tqe);
3624 			scb->flags |= SCB_UNTAGGEDQ;
3625 		}
3626 		ahc_busy_tcl(ahc, BUILD_TCL(scb->hscb->scsiid, devinfo->lun),
3627 			     scb->hscb->tag);
3628 
3629 		/*
3630 		 * Requeue all tagged commands for this target
3631 		 * currently in our posession so they can be
3632 		 * converted to untagged commands.
3633 		 */
3634 		ahc_search_qinfifo(ahc, SCB_GET_TARGET(ahc, scb),
3635 				   SCB_GET_CHANNEL(ahc, scb),
3636 				   SCB_GET_LUN(scb), /*tag*/SCB_LIST_NULL,
3637 				   ROLE_INITIATOR, CAM_REQUEUE_REQ,
3638 				   SEARCH_COMPLETE);
3639 	} else {
3640 		/*
3641 		 * Otherwise, we ignore it.
3642 		 */
3643 		printf("%s:%c:%d: Message reject for %x -- ignored\n",
3644 		       ahc_name(ahc), devinfo->channel, devinfo->target,
3645 		       last_msg);
3646 	}
3647 	return (response);
3648 }
3649 
3650 /*
3651  * Process an ingnore wide residue message.
3652  */
3653 static void
3654 ahc_handle_ign_wide_residue(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
3655 {
3656 	u_int scb_index;
3657 	struct scb *scb;
3658 
3659 	scb_index = ahc_inb(ahc, SCB_TAG);
3660 	scb = ahc_lookup_scb(ahc, scb_index);
3661 	/*
3662 	 * XXX Actually check data direction in the sequencer?
3663 	 * Perhaps add datadir to some spare bits in the hscb?
3664 	 */
3665 	if ((ahc_inb(ahc, SEQ_FLAGS) & DPHASE) == 0
3666 	 || aic_get_transfer_dir(scb) != CAM_DIR_IN) {
3667 		/*
3668 		 * Ignore the message if we haven't
3669 		 * seen an appropriate data phase yet.
3670 		 */
3671 	} else {
3672 		/*
3673 		 * If the residual occurred on the last
3674 		 * transfer and the transfer request was
3675 		 * expected to end on an odd count, do
3676 		 * nothing.  Otherwise, subtract a byte
3677 		 * and update the residual count accordingly.
3678 		 */
3679 		uint32_t sgptr;
3680 
3681 		sgptr = ahc_inb(ahc, SCB_RESIDUAL_SGPTR);
3682 		if ((sgptr & SG_LIST_NULL) != 0
3683 		 && (ahc_inb(ahc, SCB_LUN) & SCB_XFERLEN_ODD) != 0) {
3684 			/*
3685 			 * If the residual occurred on the last
3686 			 * transfer and the transfer request was
3687 			 * expected to end on an odd count, do
3688 			 * nothing.
3689 			 */
3690 		} else {
3691 			struct ahc_dma_seg *sg;
3692 			uint32_t data_cnt;
3693 			uint32_t data_addr;
3694 			uint32_t sglen;
3695 
3696 			/* Pull in all of the sgptr */
3697 			sgptr = ahc_inl(ahc, SCB_RESIDUAL_SGPTR);
3698 			data_cnt = ahc_inl(ahc, SCB_RESIDUAL_DATACNT);
3699 
3700 			if ((sgptr & SG_LIST_NULL) != 0) {
3701 				/*
3702 				 * The residual data count is not updated
3703 				 * for the command run to completion case.
3704 				 * Explicitly zero the count.
3705 				 */
3706 				data_cnt &= ~AHC_SG_LEN_MASK;
3707 			}
3708 
3709 			data_addr = ahc_inl(ahc, SHADDR);
3710 
3711 			data_cnt += 1;
3712 			data_addr -= 1;
3713 			sgptr &= SG_PTR_MASK;
3714 
3715 			sg = ahc_sg_bus_to_virt(scb, sgptr);
3716 
3717 			/*
3718 			 * The residual sg ptr points to the next S/G
3719 			 * to load so we must go back one.
3720 			 */
3721 			sg--;
3722 			sglen = aic_le32toh(sg->len) & AHC_SG_LEN_MASK;
3723 			if (sg != scb->sg_list
3724 			 && sglen < (data_cnt & AHC_SG_LEN_MASK)) {
3725 
3726 				sg--;
3727 				sglen = aic_le32toh(sg->len);
3728 				/*
3729 				 * Preserve High Address and SG_LIST bits
3730 				 * while setting the count to 1.
3731 				 */
3732 				data_cnt = 1 | (sglen & (~AHC_SG_LEN_MASK));
3733 				data_addr = aic_le32toh(sg->addr)
3734 					  + (sglen & AHC_SG_LEN_MASK) - 1;
3735 
3736 				/*
3737 				 * Increment sg so it points to the
3738 				 * "next" sg.
3739 				 */
3740 				sg++;
3741 				sgptr = ahc_sg_virt_to_bus(scb, sg);
3742 			}
3743 			ahc_outl(ahc, SCB_RESIDUAL_SGPTR, sgptr);
3744 			ahc_outl(ahc, SCB_RESIDUAL_DATACNT, data_cnt);
3745 			/*
3746 			 * Toggle the "oddness" of the transfer length
3747 			 * to handle this mid-transfer ignore wide
3748 			 * residue.  This ensures that the oddness is
3749 			 * correct for subsequent data transfers.
3750 			 */
3751 			ahc_outb(ahc, SCB_LUN,
3752 				 ahc_inb(ahc, SCB_LUN) ^ SCB_XFERLEN_ODD);
3753 		}
3754 	}
3755 }
3756 
3757 
3758 /*
3759  * Reinitialize the data pointers for the active transfer
3760  * based on its current residual.
3761  */
3762 static void
3763 ahc_reinitialize_dataptrs(struct ahc_softc *ahc)
3764 {
3765 	struct	 scb *scb;
3766 	struct	 ahc_dma_seg *sg;
3767 	u_int	 scb_index;
3768 	uint32_t sgptr;
3769 	uint32_t resid;
3770 	uint32_t dataptr;
3771 
3772 	scb_index = ahc_inb(ahc, SCB_TAG);
3773 	scb = ahc_lookup_scb(ahc, scb_index);
3774 	sgptr = (ahc_inb(ahc, SCB_RESIDUAL_SGPTR + 3) << 24)
3775 	      | (ahc_inb(ahc, SCB_RESIDUAL_SGPTR + 2) << 16)
3776 	      | (ahc_inb(ahc, SCB_RESIDUAL_SGPTR + 1) << 8)
3777 	      |	ahc_inb(ahc, SCB_RESIDUAL_SGPTR);
3778 
3779 	sgptr &= SG_PTR_MASK;
3780 	sg = ahc_sg_bus_to_virt(scb, sgptr);
3781 
3782 	/* The residual sg_ptr always points to the next sg */
3783 	sg--;
3784 
3785 	resid = (ahc_inb(ahc, SCB_RESIDUAL_DATACNT + 2) << 16)
3786 	      | (ahc_inb(ahc, SCB_RESIDUAL_DATACNT + 1) << 8)
3787 	      | ahc_inb(ahc, SCB_RESIDUAL_DATACNT);
3788 
3789 	dataptr = aic_le32toh(sg->addr)
3790 		+ (aic_le32toh(sg->len) & AHC_SG_LEN_MASK)
3791 		- resid;
3792 	if ((ahc->flags & AHC_39BIT_ADDRESSING) != 0) {
3793 		u_int dscommand1;
3794 
3795 		dscommand1 = ahc_inb(ahc, DSCOMMAND1);
3796 		ahc_outb(ahc, DSCOMMAND1, dscommand1 | HADDLDSEL0);
3797 		ahc_outb(ahc, HADDR,
3798 			 (aic_le32toh(sg->len) >> 24) & SG_HIGH_ADDR_BITS);
3799 		ahc_outb(ahc, DSCOMMAND1, dscommand1);
3800 	}
3801 	ahc_outb(ahc, HADDR + 3, dataptr >> 24);
3802 	ahc_outb(ahc, HADDR + 2, dataptr >> 16);
3803 	ahc_outb(ahc, HADDR + 1, dataptr >> 8);
3804 	ahc_outb(ahc, HADDR, dataptr);
3805 	ahc_outb(ahc, HCNT + 2, resid >> 16);
3806 	ahc_outb(ahc, HCNT + 1, resid >> 8);
3807 	ahc_outb(ahc, HCNT, resid);
3808 	if ((ahc->features & AHC_ULTRA2) == 0) {
3809 		ahc_outb(ahc, STCNT + 2, resid >> 16);
3810 		ahc_outb(ahc, STCNT + 1, resid >> 8);
3811 		ahc_outb(ahc, STCNT, resid);
3812 	}
3813 }
3814 
3815 /*
3816  * Handle the effects of issuing a bus device reset message.
3817  */
3818 static void
3819 ahc_handle_devreset(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
3820 		    cam_status status, char *message, int verbose_level)
3821 {
3822 #ifdef AHC_TARGET_MODE
3823 	struct ahc_tmode_tstate* tstate;
3824 	u_int lun;
3825 #endif
3826 	int found;
3827 
3828 	found = ahc_abort_scbs(ahc, devinfo->target, devinfo->channel,
3829 			       CAM_LUN_WILDCARD, SCB_LIST_NULL, devinfo->role,
3830 			       status);
3831 
3832 #ifdef AHC_TARGET_MODE
3833 	/*
3834 	 * Send an immediate notify ccb to all target mord peripheral
3835 	 * drivers affected by this action.
3836 	 */
3837 	tstate = ahc->enabled_targets[devinfo->our_scsiid];
3838 	if (tstate != NULL) {
3839 		for (lun = 0; lun < AHC_NUM_LUNS; lun++) {
3840 			struct ahc_tmode_lstate* lstate;
3841 
3842 			lstate = tstate->enabled_luns[lun];
3843 			if (lstate == NULL)
3844 				continue;
3845 
3846 			ahc_queue_lstate_event(ahc, lstate, devinfo->our_scsiid,
3847 					       MSG_BUS_DEV_RESET, /*arg*/0);
3848 			ahc_send_lstate_events(ahc, lstate);
3849 		}
3850 	}
3851 #endif
3852 
3853 	/*
3854 	 * Go back to async/narrow transfers and renegotiate.
3855 	 */
3856 	ahc_set_width(ahc, devinfo, MSG_EXT_WDTR_BUS_8_BIT,
3857 		      AHC_TRANS_CUR, /*paused*/TRUE);
3858 	ahc_set_syncrate(ahc, devinfo, /*syncrate*/NULL,
3859 			 /*period*/0, /*offset*/0, /*ppr_options*/0,
3860 			 AHC_TRANS_CUR, /*paused*/TRUE);
3861 
3862 	if (status != CAM_SEL_TIMEOUT)
3863 		ahc_send_async(ahc, devinfo->channel, devinfo->target,
3864 			       CAM_LUN_WILDCARD, AC_SENT_BDR, NULL);
3865 
3866 	if (message != NULL
3867 	 && (verbose_level <= bootverbose))
3868 		printf("%s: %s on %c:%d. %d SCBs aborted\n", ahc_name(ahc),
3869 		       message, devinfo->channel, devinfo->target, found);
3870 }
3871 
3872 #ifdef AHC_TARGET_MODE
3873 static void
3874 ahc_setup_target_msgin(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
3875 		       struct scb *scb)
3876 {
3877 
3878 	/*
3879 	 * To facilitate adding multiple messages together,
3880 	 * each routine should increment the index and len
3881 	 * variables instead of setting them explicitly.
3882 	 */
3883 	ahc->msgout_index = 0;
3884 	ahc->msgout_len = 0;
3885 
3886 	if (scb != NULL && (scb->flags & SCB_AUTO_NEGOTIATE) != 0)
3887 		ahc_build_transfer_msg(ahc, devinfo);
3888 	else
3889 		panic("ahc_intr: AWAITING target message with no message");
3890 
3891 	ahc->msgout_index = 0;
3892 	ahc->msg_type = MSG_TYPE_TARGET_MSGIN;
3893 }
3894 #endif
3895 /**************************** Initialization **********************************/
3896 /*
3897  * Allocate a controller structure for a new device
3898  * and perform initial initializion.
3899  */
3900 struct ahc_softc *
3901 ahc_alloc(void *platform_arg, char *name)
3902 {
3903 	struct  ahc_softc *ahc;
3904 	int	i;
3905 
3906 #ifndef	__FreeBSD__
3907 	ahc = malloc(sizeof(*ahc), M_DEVBUF, M_NOWAIT);
3908 	if (!ahc) {
3909 		printf("aic7xxx: cannot malloc softc!\n");
3910 		free(name, M_DEVBUF);
3911 		return NULL;
3912 	}
3913 #else
3914 	ahc = device_get_softc((device_t)platform_arg);
3915 #endif
3916 	memset(ahc, 0, sizeof(*ahc));
3917 	ahc->seep_config = malloc(sizeof(*ahc->seep_config),
3918 				  M_DEVBUF, M_NOWAIT);
3919 	if (ahc->seep_config == NULL) {
3920 #ifndef	__FreeBSD__
3921 		free(ahc, M_DEVBUF);
3922 #endif
3923 		free(name, M_DEVBUF);
3924 		return (NULL);
3925 	}
3926 	LIST_INIT(&ahc->pending_scbs);
3927 	LIST_INIT(&ahc->timedout_scbs);
3928 	/* We don't know our unit number until the OSM sets it */
3929 	ahc->name = name;
3930 	ahc->unit = -1;
3931 	ahc->description = NULL;
3932 	ahc->channel = 'A';
3933 	ahc->channel_b = 'B';
3934 	ahc->chip = AHC_NONE;
3935 	ahc->features = AHC_FENONE;
3936 	ahc->bugs = AHC_BUGNONE;
3937 	ahc->flags = AHC_FNONE;
3938 	/*
3939 	 * Default to all error reporting enabled with the
3940 	 * sequencer operating at its fastest speed.
3941 	 * The bus attach code may modify this.
3942 	 */
3943 	ahc->seqctl = FASTMODE;
3944 
3945 	for (i = 0; i < AHC_NUM_TARGETS; i++)
3946 		TAILQ_INIT(&ahc->untagged_queues[i]);
3947 	if (ahc_platform_alloc(ahc, platform_arg) != 0) {
3948 		ahc_free(ahc);
3949 		ahc = NULL;
3950 	}
3951 	ahc_lockinit(ahc);
3952 	return (ahc);
3953 }
3954 
3955 int
3956 ahc_softc_init(struct ahc_softc *ahc)
3957 {
3958 
3959 	/* The IRQMS bit is only valid on VL and EISA chips */
3960 	if ((ahc->chip & AHC_PCI) == 0)
3961 		ahc->unpause = ahc_inb(ahc, HCNTRL) & IRQMS;
3962 	else
3963 		ahc->unpause = 0;
3964 	ahc->pause = ahc->unpause | PAUSE;
3965 	/* XXX The shared scb data stuff should be deprecated */
3966 	if (ahc->scb_data == NULL) {
3967 		ahc->scb_data = malloc(sizeof(*ahc->scb_data),
3968 				       M_DEVBUF, M_NOWAIT);
3969 		if (ahc->scb_data == NULL)
3970 			return (ENOMEM);
3971 		memset(ahc->scb_data, 0, sizeof(*ahc->scb_data));
3972 	}
3973 
3974 	return (0);
3975 }
3976 
3977 void
3978 ahc_softc_insert(struct ahc_softc *ahc)
3979 {
3980 	struct ahc_softc *list_ahc;
3981 
3982 #if AIC_PCI_CONFIG > 0
3983 	/*
3984 	 * Second Function PCI devices need to inherit some
3985 	 * settings from function 0.
3986 	 */
3987 	if ((ahc->chip & AHC_BUS_MASK) == AHC_PCI
3988 	 && (ahc->features & AHC_MULTI_FUNC) != 0) {
3989 		TAILQ_FOREACH(list_ahc, &ahc_tailq, links) {
3990 			aic_dev_softc_t list_pci;
3991 			aic_dev_softc_t pci;
3992 
3993 			list_pci = list_ahc->dev_softc;
3994 			pci = ahc->dev_softc;
3995 			if (aic_get_pci_slot(list_pci) == aic_get_pci_slot(pci)
3996 			 && aic_get_pci_bus(list_pci) == aic_get_pci_bus(pci)) {
3997 				struct ahc_softc *master;
3998 				struct ahc_softc *slave;
3999 
4000 				if (aic_get_pci_function(list_pci) == 0) {
4001 					master = list_ahc;
4002 					slave = ahc;
4003 				} else {
4004 					master = ahc;
4005 					slave = list_ahc;
4006 				}
4007 				slave->flags &= ~AHC_BIOS_ENABLED;
4008 				slave->flags |=
4009 				    master->flags & AHC_BIOS_ENABLED;
4010 				slave->flags &= ~AHC_PRIMARY_CHANNEL;
4011 				slave->flags |=
4012 				    master->flags & AHC_PRIMARY_CHANNEL;
4013 				break;
4014 			}
4015 		}
4016 	}
4017 #endif
4018 
4019 	/*
4020 	 * Insertion sort into our list of softcs.
4021 	 */
4022 	list_ahc = TAILQ_FIRST(&ahc_tailq);
4023 	while (list_ahc != NULL
4024 	    && ahc_softc_comp(ahc, list_ahc) <= 0)
4025 		list_ahc = TAILQ_NEXT(list_ahc, links);
4026 	if (list_ahc != NULL)
4027 		TAILQ_INSERT_BEFORE(list_ahc, ahc, links);
4028 	else
4029 		TAILQ_INSERT_TAIL(&ahc_tailq, ahc, links);
4030 	ahc->init_level++;
4031 }
4032 
4033 void
4034 ahc_set_unit(struct ahc_softc *ahc, int unit)
4035 {
4036 	ahc->unit = unit;
4037 }
4038 
4039 void
4040 ahc_set_name(struct ahc_softc *ahc, char *name)
4041 {
4042 	if (ahc->name != NULL)
4043 		free(ahc->name, M_DEVBUF);
4044 	ahc->name = name;
4045 }
4046 
4047 void
4048 ahc_free(struct ahc_softc *ahc)
4049 {
4050 	int i;
4051 
4052 	ahc_terminate_recovery_thread(ahc);
4053 	switch (ahc->init_level) {
4054 	default:
4055 	case 5:
4056 		ahc_shutdown(ahc);
4057 		/* FALLTHROUGH */
4058 	case 4:
4059 		aic_dmamap_unload(ahc, ahc->shared_data_dmat,
4060 				  ahc->shared_data_dmamap);
4061 		/* FALLTHROUGH */
4062 	case 3:
4063 		aic_dmamem_free(ahc, ahc->shared_data_dmat, ahc->qoutfifo,
4064 				ahc->shared_data_dmamap);
4065 		aic_dmamap_destroy(ahc, ahc->shared_data_dmat,
4066 				   ahc->shared_data_dmamap);
4067 		/* FALLTHROUGH */
4068 	case 2:
4069 		aic_dma_tag_destroy(ahc, ahc->shared_data_dmat);
4070 	case 1:
4071 #ifndef __linux__
4072 		aic_dma_tag_destroy(ahc, ahc->buffer_dmat);
4073 #endif
4074 		break;
4075 	case 0:
4076 		break;
4077 	}
4078 
4079 #ifndef __linux__
4080 	aic_dma_tag_destroy(ahc, ahc->parent_dmat);
4081 #endif
4082 	ahc_platform_free(ahc);
4083 	ahc_fini_scbdata(ahc);
4084 	for (i = 0; i < AHC_NUM_TARGETS; i++) {
4085 		struct ahc_tmode_tstate *tstate;
4086 
4087 		tstate = ahc->enabled_targets[i];
4088 		if (tstate != NULL) {
4089 #ifdef AHC_TARGET_MODE
4090 			int j;
4091 
4092 			for (j = 0; j < AHC_NUM_LUNS; j++) {
4093 				struct ahc_tmode_lstate *lstate;
4094 
4095 				lstate = tstate->enabled_luns[j];
4096 				if (lstate != NULL) {
4097 					xpt_free_path(lstate->path);
4098 					free(lstate, M_DEVBUF);
4099 				}
4100 			}
4101 #endif
4102 			free(tstate, M_DEVBUF);
4103 		}
4104 	}
4105 #ifdef AHC_TARGET_MODE
4106 	if (ahc->black_hole != NULL) {
4107 		xpt_free_path(ahc->black_hole->path);
4108 		free(ahc->black_hole, M_DEVBUF);
4109 	}
4110 #endif
4111 	if (ahc->name != NULL)
4112 		free(ahc->name, M_DEVBUF);
4113 	if (ahc->seep_config != NULL)
4114 		free(ahc->seep_config, M_DEVBUF);
4115 #ifndef __FreeBSD__
4116 	free(ahc, M_DEVBUF);
4117 #endif
4118 	return;
4119 }
4120 
4121 void
4122 ahc_shutdown(void *arg)
4123 {
4124 	struct	ahc_softc *ahc;
4125 	int	i;
4126 
4127 	ahc = (struct ahc_softc *)arg;
4128 
4129 	/* This will reset most registers to 0, but not all */
4130 	ahc_reset(ahc, /*reinit*/FALSE);
4131 	ahc_outb(ahc, SCSISEQ, 0);
4132 	ahc_outb(ahc, SXFRCTL0, 0);
4133 	ahc_outb(ahc, DSPCISTATUS, 0);
4134 
4135 	for (i = TARG_SCSIRATE; i < SCSICONF; i++)
4136 		ahc_outb(ahc, i, 0);
4137 }
4138 
4139 /*
4140  * Reset the controller and record some information about it
4141  * that is only available just after a reset.  If "reinit" is
4142  * non-zero, this reset occured after initial configuration
4143  * and the caller requests that the chip be fully reinitialized
4144  * to a runable state.  Chip interrupts are *not* enabled after
4145  * a reinitialization.  The caller must enable interrupts via
4146  * ahc_intr_enable().
4147  */
4148 int
4149 ahc_reset(struct ahc_softc *ahc, int reinit)
4150 {
4151 	u_int	sblkctl;
4152 	u_int	sxfrctl1_a, sxfrctl1_b;
4153 	int	error;
4154 	int	wait;
4155 
4156 	/*
4157 	 * Preserve the value of the SXFRCTL1 register for all channels.
4158 	 * It contains settings that affect termination and we don't want
4159 	 * to disturb the integrity of the bus.
4160 	 */
4161 	ahc_pause(ahc);
4162 	sxfrctl1_b = 0;
4163 	if ((ahc->chip & AHC_CHIPID_MASK) == AHC_AIC7770) {
4164 		u_int sblkctl;
4165 
4166 		/*
4167 		 * Save channel B's settings in case this chip
4168 		 * is setup for TWIN channel operation.
4169 		 */
4170 		sblkctl = ahc_inb(ahc, SBLKCTL);
4171 		ahc_outb(ahc, SBLKCTL, sblkctl | SELBUSB);
4172 		sxfrctl1_b = ahc_inb(ahc, SXFRCTL1);
4173 		ahc_outb(ahc, SBLKCTL, sblkctl & ~SELBUSB);
4174 	}
4175 	sxfrctl1_a = ahc_inb(ahc, SXFRCTL1);
4176 
4177 	ahc_outb(ahc, HCNTRL, CHIPRST | ahc->pause);
4178 
4179 	/*
4180 	 * Ensure that the reset has finished.  We delay 1000us
4181 	 * prior to reading the register to make sure the chip
4182 	 * has sufficiently completed its reset to handle register
4183 	 * accesses.
4184 	 */
4185 	wait = 1000;
4186 	do {
4187 		aic_delay(1000);
4188 	} while (--wait && !(ahc_inb(ahc, HCNTRL) & CHIPRSTACK));
4189 
4190 	if (wait == 0) {
4191 		printf("%s: WARNING - Failed chip reset!  "
4192 		       "Trying to initialize anyway.\n", ahc_name(ahc));
4193 	}
4194 	ahc_outb(ahc, HCNTRL, ahc->pause);
4195 
4196 	/* Determine channel configuration */
4197 	sblkctl = ahc_inb(ahc, SBLKCTL) & (SELBUSB|SELWIDE);
4198 	/* No Twin Channel PCI cards */
4199 	if ((ahc->chip & AHC_PCI) != 0)
4200 		sblkctl &= ~SELBUSB;
4201 	switch (sblkctl) {
4202 	case 0:
4203 		/* Single Narrow Channel */
4204 		break;
4205 	case 2:
4206 		/* Wide Channel */
4207 		ahc->features |= AHC_WIDE;
4208 		break;
4209 	case 8:
4210 		/* Twin Channel */
4211 		ahc->features |= AHC_TWIN;
4212 		break;
4213 	default:
4214 		printf(" Unsupported adapter type.  Ignoring\n");
4215 		return(-1);
4216 	}
4217 
4218 	/*
4219 	 * Reload sxfrctl1.
4220 	 *
4221 	 * We must always initialize STPWEN to 1 before we
4222 	 * restore the saved values.  STPWEN is initialized
4223 	 * to a tri-state condition which can only be cleared
4224 	 * by turning it on.
4225 	 */
4226 	if ((ahc->features & AHC_TWIN) != 0) {
4227 		u_int sblkctl;
4228 
4229 		sblkctl = ahc_inb(ahc, SBLKCTL);
4230 		ahc_outb(ahc, SBLKCTL, sblkctl | SELBUSB);
4231 		ahc_outb(ahc, SXFRCTL1, sxfrctl1_b);
4232 		ahc_outb(ahc, SBLKCTL, sblkctl & ~SELBUSB);
4233 	}
4234 	ahc_outb(ahc, SXFRCTL1, sxfrctl1_a);
4235 
4236 	error = 0;
4237 	if (reinit != 0)
4238 		/*
4239 		 * If a recovery action has forced a chip reset,
4240 		 * re-initialize the chip to our liking.
4241 		 */
4242 		error = ahc->bus_chip_init(ahc);
4243 #ifdef AHC_DUMP_SEQ
4244 	else
4245 		ahc_dumpseq(ahc);
4246 #endif
4247 
4248 	return (error);
4249 }
4250 
4251 /*
4252  * Determine the number of SCBs available on the controller
4253  */
4254 int
4255 ahc_probe_scbs(struct ahc_softc *ahc) {
4256 	int i;
4257 
4258 	for (i = 0; i < AHC_SCB_MAX; i++) {
4259 
4260 		ahc_outb(ahc, SCBPTR, i);
4261 		ahc_outb(ahc, SCB_BASE, i);
4262 		if (ahc_inb(ahc, SCB_BASE) != i)
4263 			break;
4264 		ahc_outb(ahc, SCBPTR, 0);
4265 		if (ahc_inb(ahc, SCB_BASE) != 0)
4266 			break;
4267 	}
4268 	return (i);
4269 }
4270 
4271 static void
4272 ahc_dmamap_cb(void *arg, bus_dma_segment_t *segs, int nseg, int error)
4273 {
4274 	bus_addr_t *baddr;
4275 
4276 	baddr = (bus_addr_t *)arg;
4277 	*baddr = segs->ds_addr;
4278 }
4279 
4280 static void
4281 ahc_build_free_scb_list(struct ahc_softc *ahc)
4282 {
4283 	int scbsize;
4284 	int i;
4285 
4286 	scbsize = 32;
4287 	if ((ahc->flags & AHC_LSCBS_ENABLED) != 0)
4288 		scbsize = 64;
4289 
4290 	for (i = 0; i < ahc->scb_data->maxhscbs; i++) {
4291 		int j;
4292 
4293 		ahc_outb(ahc, SCBPTR, i);
4294 
4295 		/*
4296 		 * Touch all SCB bytes to avoid parity errors
4297 		 * should one of our debugging routines read
4298 		 * an otherwise uninitiatlized byte.
4299 		 */
4300 		for (j = 0; j < scbsize; j++)
4301 			ahc_outb(ahc, SCB_BASE+j, 0xFF);
4302 
4303 		/* Clear the control byte. */
4304 		ahc_outb(ahc, SCB_CONTROL, 0);
4305 
4306 		/* Set the next pointer */
4307 		if ((ahc->flags & AHC_PAGESCBS) != 0)
4308 			ahc_outb(ahc, SCB_NEXT, i+1);
4309 		else
4310 			ahc_outb(ahc, SCB_NEXT, SCB_LIST_NULL);
4311 
4312 		/* Make the tag number, SCSIID, and lun invalid */
4313 		ahc_outb(ahc, SCB_TAG, SCB_LIST_NULL);
4314 		ahc_outb(ahc, SCB_SCSIID, 0xFF);
4315 		ahc_outb(ahc, SCB_LUN, 0xFF);
4316 	}
4317 
4318 	if ((ahc->flags & AHC_PAGESCBS) != 0) {
4319 		/* SCB 0 heads the free list. */
4320 		ahc_outb(ahc, FREE_SCBH, 0);
4321 	} else {
4322 		/* No free list. */
4323 		ahc_outb(ahc, FREE_SCBH, SCB_LIST_NULL);
4324 	}
4325 
4326 	/* Make sure that the last SCB terminates the free list */
4327 	ahc_outb(ahc, SCBPTR, i-1);
4328 	ahc_outb(ahc, SCB_NEXT, SCB_LIST_NULL);
4329 }
4330 
4331 static int
4332 ahc_init_scbdata(struct ahc_softc *ahc)
4333 {
4334 	struct scb_data *scb_data;
4335 
4336 	scb_data = ahc->scb_data;
4337 	SLIST_INIT(&scb_data->free_scbs);
4338 	SLIST_INIT(&scb_data->sg_maps);
4339 
4340 	/* Allocate SCB resources */
4341 	scb_data->scbarray =
4342 	    (struct scb *)malloc(sizeof(struct scb) * AHC_SCB_MAX_ALLOC,
4343 				 M_DEVBUF, M_NOWAIT);
4344 	if (scb_data->scbarray == NULL)
4345 		return (ENOMEM);
4346 	memset(scb_data->scbarray, 0, sizeof(struct scb) * AHC_SCB_MAX_ALLOC);
4347 
4348 	/* Determine the number of hardware SCBs and initialize them */
4349 
4350 	scb_data->maxhscbs = ahc_probe_scbs(ahc);
4351 	if (ahc->scb_data->maxhscbs == 0) {
4352 		printf("%s: No SCB space found\n", ahc_name(ahc));
4353 		return (ENXIO);
4354 	}
4355 
4356 	/*
4357 	 * Create our DMA tags.  These tags define the kinds of device
4358 	 * accessible memory allocations and memory mappings we will
4359 	 * need to perform during normal operation.
4360 	 *
4361 	 * Unless we need to further restrict the allocation, we rely
4362 	 * on the restrictions of the parent dmat, hence the common
4363 	 * use of MAXADDR and MAXSIZE.
4364 	 */
4365 
4366 	/* DMA tag for our hardware scb structures */
4367 	if (aic_dma_tag_create(ahc, ahc->parent_dmat, /*alignment*/1,
4368 			       /*boundary*/BUS_SPACE_MAXADDR_32BIT + 1,
4369 			       /*lowaddr*/BUS_SPACE_MAXADDR_32BIT,
4370 			       /*highaddr*/BUS_SPACE_MAXADDR,
4371 			       /*filter*/NULL, /*filterarg*/NULL,
4372 			       AHC_SCB_MAX_ALLOC * sizeof(struct hardware_scb),
4373 			       /*nsegments*/1,
4374 			       /*maxsegsz*/BUS_SPACE_MAXSIZE_32BIT,
4375 			       /*flags*/0, &scb_data->hscb_dmat) != 0) {
4376 		goto error_exit;
4377 	}
4378 
4379 	scb_data->init_level++;
4380 
4381 	/* Allocation for our hscbs */
4382 	if (aic_dmamem_alloc(ahc, scb_data->hscb_dmat,
4383 			     (void **)&scb_data->hscbs,
4384 			     BUS_DMA_NOWAIT | BUS_DMA_COHERENT,
4385 			     &scb_data->hscb_dmamap) != 0) {
4386 		goto error_exit;
4387 	}
4388 
4389 	scb_data->init_level++;
4390 
4391 	/* And permanently map them */
4392 	aic_dmamap_load(ahc, scb_data->hscb_dmat, scb_data->hscb_dmamap,
4393 			scb_data->hscbs,
4394 			AHC_SCB_MAX_ALLOC * sizeof(struct hardware_scb),
4395 			ahc_dmamap_cb, &scb_data->hscb_busaddr, /*flags*/0);
4396 
4397 	scb_data->init_level++;
4398 
4399 	/* DMA tag for our sense buffers */
4400 	if (aic_dma_tag_create(ahc, ahc->parent_dmat, /*alignment*/1,
4401 			       /*boundary*/BUS_SPACE_MAXADDR_32BIT + 1,
4402 			       /*lowaddr*/BUS_SPACE_MAXADDR_32BIT,
4403 			       /*highaddr*/BUS_SPACE_MAXADDR,
4404 			       /*filter*/NULL, /*filterarg*/NULL,
4405 			       AHC_SCB_MAX_ALLOC * sizeof(struct scsi_sense_data),
4406 			       /*nsegments*/1,
4407 			       /*maxsegsz*/BUS_SPACE_MAXSIZE_32BIT,
4408 			       /*flags*/0, &scb_data->sense_dmat) != 0) {
4409 		goto error_exit;
4410 	}
4411 
4412 	scb_data->init_level++;
4413 
4414 	/* Allocate them */
4415 	if (aic_dmamem_alloc(ahc, scb_data->sense_dmat,
4416 			     (void **)&scb_data->sense,
4417 			     BUS_DMA_NOWAIT, &scb_data->sense_dmamap) != 0) {
4418 		goto error_exit;
4419 	}
4420 
4421 	scb_data->init_level++;
4422 
4423 	/* And permanently map them */
4424 	aic_dmamap_load(ahc, scb_data->sense_dmat, scb_data->sense_dmamap,
4425 			scb_data->sense,
4426 			AHC_SCB_MAX_ALLOC * sizeof(struct scsi_sense_data),
4427 			ahc_dmamap_cb, &scb_data->sense_busaddr, /*flags*/0);
4428 
4429 	scb_data->init_level++;
4430 
4431 	/* DMA tag for our S/G structures.  We allocate in page sized chunks */
4432 	if (aic_dma_tag_create(ahc, ahc->parent_dmat, /*alignment*/8,
4433 			       /*boundary*/BUS_SPACE_MAXADDR_32BIT + 1,
4434 			       /*lowaddr*/BUS_SPACE_MAXADDR_32BIT,
4435 			       /*highaddr*/BUS_SPACE_MAXADDR,
4436 			       /*filter*/NULL, /*filterarg*/NULL,
4437 			       PAGE_SIZE, /*nsegments*/1,
4438 			       /*maxsegsz*/BUS_SPACE_MAXSIZE_32BIT,
4439 			       /*flags*/0, &scb_data->sg_dmat) != 0) {
4440 		goto error_exit;
4441 	}
4442 
4443 	scb_data->init_level++;
4444 
4445 	/* Perform initial CCB allocation */
4446 	memset(scb_data->hscbs, 0,
4447 	       AHC_SCB_MAX_ALLOC * sizeof(struct hardware_scb));
4448 	while (ahc_alloc_scbs(ahc) != 0)
4449 		;
4450 
4451 	if (scb_data->numscbs == 0) {
4452 		printf("%s: ahc_init_scbdata - "
4453 		       "Unable to allocate initial scbs\n",
4454 		       ahc_name(ahc));
4455 		goto error_exit;
4456 	}
4457 
4458 	/*
4459 	 * Reserve the next queued SCB.
4460 	 */
4461 	ahc->next_queued_scb = ahc_get_scb(ahc);
4462 
4463 	/*
4464 	 * Note that we were successfull
4465 	 */
4466 	return (0);
4467 
4468 error_exit:
4469 
4470 	return (ENOMEM);
4471 }
4472 
4473 static void
4474 ahc_fini_scbdata(struct ahc_softc *ahc)
4475 {
4476 	struct scb_data *scb_data;
4477 
4478 	scb_data = ahc->scb_data;
4479 	if (scb_data == NULL)
4480 		return;
4481 
4482 	switch (scb_data->init_level) {
4483 	default:
4484 	case 7:
4485 	{
4486 		struct sg_map_node *sg_map;
4487 
4488 		while ((sg_map = SLIST_FIRST(&scb_data->sg_maps))!= NULL) {
4489 			SLIST_REMOVE_HEAD(&scb_data->sg_maps, links);
4490 			aic_dmamap_unload(ahc, scb_data->sg_dmat,
4491 					  sg_map->sg_dmamap);
4492 			aic_dmamem_free(ahc, scb_data->sg_dmat,
4493 					sg_map->sg_vaddr,
4494 					sg_map->sg_dmamap);
4495 			free(sg_map, M_DEVBUF);
4496 		}
4497 		aic_dma_tag_destroy(ahc, scb_data->sg_dmat);
4498 	}
4499 	case 6:
4500 		aic_dmamap_unload(ahc, scb_data->sense_dmat,
4501 				  scb_data->sense_dmamap);
4502 	case 5:
4503 		aic_dmamem_free(ahc, scb_data->sense_dmat, scb_data->sense,
4504 				scb_data->sense_dmamap);
4505 		aic_dmamap_destroy(ahc, scb_data->sense_dmat,
4506 				   scb_data->sense_dmamap);
4507 	case 4:
4508 		aic_dma_tag_destroy(ahc, scb_data->sense_dmat);
4509 	case 3:
4510 		aic_dmamap_unload(ahc, scb_data->hscb_dmat,
4511 				  scb_data->hscb_dmamap);
4512 	case 2:
4513 		aic_dmamem_free(ahc, scb_data->hscb_dmat, scb_data->hscbs,
4514 				scb_data->hscb_dmamap);
4515 		aic_dmamap_destroy(ahc, scb_data->hscb_dmat,
4516 				   scb_data->hscb_dmamap);
4517 	case 1:
4518 		aic_dma_tag_destroy(ahc, scb_data->hscb_dmat);
4519 		break;
4520 	case 0:
4521 		break;
4522 	}
4523 	if (scb_data->scbarray != NULL)
4524 		free(scb_data->scbarray, M_DEVBUF);
4525 }
4526 
4527 int
4528 ahc_alloc_scbs(struct ahc_softc *ahc)
4529 {
4530 	struct scb_data *scb_data;
4531 	struct scb *next_scb;
4532 	struct sg_map_node *sg_map;
4533 	bus_addr_t physaddr;
4534 	struct ahc_dma_seg *segs;
4535 	int newcount;
4536 	int i;
4537 
4538 	scb_data = ahc->scb_data;
4539 	if (scb_data->numscbs >= AHC_SCB_MAX_ALLOC)
4540 		/* Can't allocate any more */
4541 		return (0);
4542 
4543 	next_scb = &scb_data->scbarray[scb_data->numscbs];
4544 
4545 	sg_map = malloc(sizeof(*sg_map), M_DEVBUF, M_NOWAIT);
4546 
4547 	if (sg_map == NULL)
4548 		return (0);
4549 
4550 	/* Allocate S/G space for the next batch of SCBS */
4551 	if (aic_dmamem_alloc(ahc, scb_data->sg_dmat,
4552 			     (void **)&sg_map->sg_vaddr,
4553 			     BUS_DMA_NOWAIT | BUS_DMA_COHERENT,
4554 			     &sg_map->sg_dmamap) != 0) {
4555 		free(sg_map, M_DEVBUF);
4556 		return (0);
4557 	}
4558 
4559 	SLIST_INSERT_HEAD(&scb_data->sg_maps, sg_map, links);
4560 
4561 	aic_dmamap_load(ahc, scb_data->sg_dmat, sg_map->sg_dmamap,
4562 			sg_map->sg_vaddr, PAGE_SIZE, ahc_dmamap_cb,
4563 			&sg_map->sg_physaddr, /*flags*/0);
4564 
4565 	segs = sg_map->sg_vaddr;
4566 	physaddr = sg_map->sg_physaddr;
4567 
4568 	newcount = (PAGE_SIZE / (AHC_NSEG * sizeof(struct ahc_dma_seg)));
4569 	newcount = MIN(newcount, (AHC_SCB_MAX_ALLOC - scb_data->numscbs));
4570 	for (i = 0; i < newcount; i++) {
4571 		struct scb_platform_data *pdata;
4572 #ifndef __linux__
4573 		int error;
4574 #endif
4575 		pdata = (struct scb_platform_data *)malloc(sizeof(*pdata),
4576 							   M_DEVBUF, M_NOWAIT);
4577 		if (pdata == NULL)
4578 			break;
4579 		next_scb->platform_data = pdata;
4580 		next_scb->sg_map = sg_map;
4581 		next_scb->sg_list = segs;
4582 		/*
4583 		 * The sequencer always starts with the second entry.
4584 		 * The first entry is embedded in the scb.
4585 		 */
4586 		next_scb->sg_list_phys = physaddr + sizeof(struct ahc_dma_seg);
4587 		next_scb->ahc_softc = ahc;
4588 		next_scb->flags = SCB_FLAG_NONE;
4589 #ifndef __linux__
4590 		error = aic_dmamap_create(ahc, ahc->buffer_dmat, /*flags*/0,
4591 					  &next_scb->dmamap);
4592 		if (error != 0)
4593 			break;
4594 #endif
4595 		next_scb->hscb = &scb_data->hscbs[scb_data->numscbs];
4596 		next_scb->hscb->tag = ahc->scb_data->numscbs;
4597 		aic_timer_init(&next_scb->io_timer);
4598 		SLIST_INSERT_HEAD(&ahc->scb_data->free_scbs,
4599 				  next_scb, links.sle);
4600 		segs += AHC_NSEG;
4601 		physaddr += (AHC_NSEG * sizeof(struct ahc_dma_seg));
4602 		next_scb++;
4603 		ahc->scb_data->numscbs++;
4604 	}
4605 	return (i);
4606 }
4607 
4608 void
4609 ahc_controller_info(struct ahc_softc *ahc, char *buf)
4610 {
4611 	int len;
4612 
4613 	len = sprintf(buf, "%s: ", ahc_chip_names[ahc->chip & AHC_CHIPID_MASK]);
4614 	buf += len;
4615 	if ((ahc->features & AHC_TWIN) != 0)
4616  		len = sprintf(buf, "Twin Channel, A SCSI Id=%d, "
4617 			      "B SCSI Id=%d, primary %c, ",
4618 			      ahc->our_id, ahc->our_id_b,
4619 			      (ahc->flags & AHC_PRIMARY_CHANNEL) + 'A');
4620 	else {
4621 		const char *speed;
4622 		const char *type;
4623 
4624 		speed = "";
4625 		if ((ahc->features & AHC_ULTRA) != 0) {
4626 			speed = "Ultra ";
4627 		} else if ((ahc->features & AHC_DT) != 0) {
4628 			speed = "Ultra160 ";
4629 		} else if ((ahc->features & AHC_ULTRA2) != 0) {
4630 			speed = "Ultra2 ";
4631 		}
4632 		if ((ahc->features & AHC_WIDE) != 0) {
4633 			type = "Wide";
4634 		} else {
4635 			type = "Single";
4636 		}
4637 		len = sprintf(buf, "%s%s Channel %c, SCSI Id=%d, ",
4638 			      speed, type, ahc->channel, ahc->our_id);
4639 	}
4640 	buf += len;
4641 
4642 	if ((ahc->flags & AHC_PAGESCBS) != 0)
4643 		sprintf(buf, "%d/%d SCBs",
4644 			ahc->scb_data->maxhscbs, AHC_MAX_QUEUE);
4645 	else
4646 		sprintf(buf, "%d SCBs", ahc->scb_data->maxhscbs);
4647 }
4648 
4649 int
4650 ahc_chip_init(struct ahc_softc *ahc)
4651 {
4652 	int	 term;
4653 	int	 error;
4654 	u_int	 i;
4655 	u_int	 scsi_conf;
4656 	u_int	 scsiseq_template;
4657 	uint32_t physaddr;
4658 
4659 	ahc_outb(ahc, SEQ_FLAGS, 0);
4660 	ahc_outb(ahc, SEQ_FLAGS2, 0);
4661 
4662 	/* Set the SCSI Id, SXFRCTL0, SXFRCTL1, and SIMODE1, for both channels*/
4663 	if (ahc->features & AHC_TWIN) {
4664 
4665 		/*
4666 		 * Setup Channel B first.
4667 		 */
4668 		ahc_outb(ahc, SBLKCTL, ahc_inb(ahc, SBLKCTL) | SELBUSB);
4669 		term = (ahc->flags & AHC_TERM_ENB_B) != 0 ? STPWEN : 0;
4670 		ahc_outb(ahc, SCSIID, ahc->our_id_b);
4671 		scsi_conf = ahc_inb(ahc, SCSICONF + 1);
4672 		ahc_outb(ahc, SXFRCTL1, (scsi_conf & (ENSPCHK|STIMESEL))
4673 					|term|ahc->seltime_b|ENSTIMER|ACTNEGEN);
4674 		if ((ahc->features & AHC_ULTRA2) != 0)
4675 			ahc_outb(ahc, SIMODE0, ahc_inb(ahc, SIMODE0)|ENIOERR);
4676 		ahc_outb(ahc, SIMODE1, ENSELTIMO|ENSCSIRST|ENSCSIPERR);
4677 		ahc_outb(ahc, SXFRCTL0, DFON|SPIOEN);
4678 
4679 		/* Select Channel A */
4680 		ahc_outb(ahc, SBLKCTL, ahc_inb(ahc, SBLKCTL) & ~SELBUSB);
4681 	}
4682 	term = (ahc->flags & AHC_TERM_ENB_A) != 0 ? STPWEN : 0;
4683 	if ((ahc->features & AHC_ULTRA2) != 0)
4684 		ahc_outb(ahc, SCSIID_ULTRA2, ahc->our_id);
4685 	else
4686 		ahc_outb(ahc, SCSIID, ahc->our_id);
4687 	scsi_conf = ahc_inb(ahc, SCSICONF);
4688 	ahc_outb(ahc, SXFRCTL1, (scsi_conf & (ENSPCHK|STIMESEL))
4689 				|term|ahc->seltime
4690 				|ENSTIMER|ACTNEGEN);
4691 	if ((ahc->features & AHC_ULTRA2) != 0)
4692 		ahc_outb(ahc, SIMODE0, ahc_inb(ahc, SIMODE0)|ENIOERR);
4693 	ahc_outb(ahc, SIMODE1, ENSELTIMO|ENSCSIRST|ENSCSIPERR);
4694 	ahc_outb(ahc, SXFRCTL0, DFON|SPIOEN);
4695 
4696 	/* There are no untagged SCBs active yet. */
4697 	for (i = 0; i < 16; i++) {
4698 		ahc_unbusy_tcl(ahc, BUILD_TCL(i << 4, 0));
4699 		if ((ahc->flags & AHC_SCB_BTT) != 0) {
4700 			int lun;
4701 
4702 			/*
4703 			 * The SCB based BTT allows an entry per
4704 			 * target and lun pair.
4705 			 */
4706 			for (lun = 1; lun < AHC_NUM_LUNS; lun++)
4707 				ahc_unbusy_tcl(ahc, BUILD_TCL(i << 4, lun));
4708 		}
4709 	}
4710 
4711 	/* All of our queues are empty */
4712 	for (i = 0; i < 256; i++)
4713 		ahc->qoutfifo[i] = SCB_LIST_NULL;
4714 	ahc_sync_qoutfifo(ahc, BUS_DMASYNC_PREREAD);
4715 
4716 	for (i = 0; i < 256; i++)
4717 		ahc->qinfifo[i] = SCB_LIST_NULL;
4718 
4719 	if ((ahc->features & AHC_MULTI_TID) != 0) {
4720 		ahc_outb(ahc, TARGID, 0);
4721 		ahc_outb(ahc, TARGID + 1, 0);
4722 	}
4723 
4724 	/*
4725 	 * Tell the sequencer where it can find our arrays in memory.
4726 	 */
4727 	physaddr = ahc->scb_data->hscb_busaddr;
4728 	ahc_outb(ahc, HSCB_ADDR, physaddr & 0xFF);
4729 	ahc_outb(ahc, HSCB_ADDR + 1, (physaddr >> 8) & 0xFF);
4730 	ahc_outb(ahc, HSCB_ADDR + 2, (physaddr >> 16) & 0xFF);
4731 	ahc_outb(ahc, HSCB_ADDR + 3, (physaddr >> 24) & 0xFF);
4732 
4733 	physaddr = ahc->shared_data_busaddr;
4734 	ahc_outb(ahc, SHARED_DATA_ADDR, physaddr & 0xFF);
4735 	ahc_outb(ahc, SHARED_DATA_ADDR + 1, (physaddr >> 8) & 0xFF);
4736 	ahc_outb(ahc, SHARED_DATA_ADDR + 2, (physaddr >> 16) & 0xFF);
4737 	ahc_outb(ahc, SHARED_DATA_ADDR + 3, (physaddr >> 24) & 0xFF);
4738 
4739 	/*
4740 	 * Initialize the group code to command length table.
4741 	 * This overrides the values in TARG_SCSIRATE, so only
4742 	 * setup the table after we have processed that information.
4743 	 */
4744 	ahc_outb(ahc, CMDSIZE_TABLE, 5);
4745 	ahc_outb(ahc, CMDSIZE_TABLE + 1, 9);
4746 	ahc_outb(ahc, CMDSIZE_TABLE + 2, 9);
4747 	ahc_outb(ahc, CMDSIZE_TABLE + 3, 0);
4748 	ahc_outb(ahc, CMDSIZE_TABLE + 4, 15);
4749 	ahc_outb(ahc, CMDSIZE_TABLE + 5, 11);
4750 	ahc_outb(ahc, CMDSIZE_TABLE + 6, 0);
4751 	ahc_outb(ahc, CMDSIZE_TABLE + 7, 0);
4752 
4753 	if ((ahc->features & AHC_HS_MAILBOX) != 0)
4754 		ahc_outb(ahc, HS_MAILBOX, 0);
4755 
4756 	/* Tell the sequencer of our initial queue positions */
4757 	if ((ahc->features & AHC_TARGETMODE) != 0) {
4758 		ahc->tqinfifonext = 1;
4759 		ahc_outb(ahc, KERNEL_TQINPOS, ahc->tqinfifonext - 1);
4760 		ahc_outb(ahc, TQINPOS, ahc->tqinfifonext);
4761 	}
4762 	ahc->qinfifonext = 0;
4763 	ahc->qoutfifonext = 0;
4764 	if ((ahc->features & AHC_QUEUE_REGS) != 0) {
4765 		ahc_outb(ahc, QOFF_CTLSTA, SCB_QSIZE_256);
4766 		ahc_outb(ahc, HNSCB_QOFF, ahc->qinfifonext);
4767 		ahc_outb(ahc, SNSCB_QOFF, ahc->qinfifonext);
4768 		ahc_outb(ahc, SDSCB_QOFF, 0);
4769 	} else {
4770 		ahc_outb(ahc, KERNEL_QINPOS, ahc->qinfifonext);
4771 		ahc_outb(ahc, QINPOS, ahc->qinfifonext);
4772 		ahc_outb(ahc, QOUTPOS, ahc->qoutfifonext);
4773 	}
4774 
4775 	/* We don't have any waiting selections */
4776 	ahc_outb(ahc, WAITING_SCBH, SCB_LIST_NULL);
4777 
4778 	/* Our disconnection list is empty too */
4779 	ahc_outb(ahc, DISCONNECTED_SCBH, SCB_LIST_NULL);
4780 
4781 	/* Message out buffer starts empty */
4782 	ahc_outb(ahc, MSG_OUT, MSG_NOOP);
4783 
4784 	/*
4785 	 * Setup the allowed SCSI Sequences based on operational mode.
4786 	 * If we are a target, we'll enalbe select in operations once
4787 	 * we've had a lun enabled.
4788 	 */
4789 	scsiseq_template = ENSELO|ENAUTOATNO|ENAUTOATNP;
4790 	if ((ahc->flags & AHC_INITIATORROLE) != 0)
4791 		scsiseq_template |= ENRSELI;
4792 	ahc_outb(ahc, SCSISEQ_TEMPLATE, scsiseq_template);
4793 
4794 	/* Initialize our list of free SCBs. */
4795 	ahc_build_free_scb_list(ahc);
4796 
4797 	/*
4798 	 * Tell the sequencer which SCB will be the next one it receives.
4799 	 */
4800 	ahc_outb(ahc, NEXT_QUEUED_SCB, ahc->next_queued_scb->hscb->tag);
4801 
4802 	/*
4803 	 * Load the Sequencer program and Enable the adapter
4804 	 * in "fast" mode.
4805 	 */
4806 	if (bootverbose)
4807 		printf("%s: Downloading Sequencer Program...",
4808 		       ahc_name(ahc));
4809 
4810 	error = ahc_loadseq(ahc);
4811 	if (error != 0)
4812 		return (error);
4813 
4814 	if ((ahc->features & AHC_ULTRA2) != 0) {
4815 		int wait;
4816 
4817 		/*
4818 		 * Wait for up to 500ms for our transceivers
4819 		 * to settle.  If the adapter does not have
4820 		 * a cable attached, the transceivers may
4821 		 * never settle, so don't complain if we
4822 		 * fail here.
4823 		 */
4824 		for (wait = 5000;
4825 		     (ahc_inb(ahc, SBLKCTL) & (ENAB40|ENAB20)) == 0 && wait;
4826 		     wait--)
4827 			aic_delay(100);
4828 	}
4829 	ahc_restart(ahc);
4830 	return (0);
4831 }
4832 
4833 /*
4834  * Start the board, ready for normal operation
4835  */
4836 int
4837 ahc_init(struct ahc_softc *ahc)
4838 {
4839 	int	 max_targ;
4840 	int	 error;
4841 	u_int	 i;
4842 	u_int	 scsi_conf;
4843 	u_int	 ultraenb;
4844 	u_int	 discenable;
4845 	u_int	 tagenable;
4846 	size_t	 driver_data_size;
4847 
4848 #ifdef AHC_DEBUG
4849 	if ((ahc_debug & AHC_DEBUG_SEQUENCER) != 0)
4850 		ahc->flags |= AHC_SEQUENCER_DEBUG;
4851 #endif
4852 
4853 #ifdef AHC_PRINT_SRAM
4854 	printf("Scratch Ram:");
4855 	for (i = 0x20; i < 0x5f; i++) {
4856 		if (((i % 8) == 0) && (i != 0)) {
4857 			printf ("\n              ");
4858 		}
4859 		printf (" 0x%x", ahc_inb(ahc, i));
4860 	}
4861 	if ((ahc->features & AHC_MORE_SRAM) != 0) {
4862 		for (i = 0x70; i < 0x7f; i++) {
4863 			if (((i % 8) == 0) && (i != 0)) {
4864 				printf ("\n              ");
4865 			}
4866 			printf (" 0x%x", ahc_inb(ahc, i));
4867 		}
4868 	}
4869 	printf ("\n");
4870 	/*
4871 	 * Reading uninitialized scratch ram may
4872 	 * generate parity errors.
4873 	 */
4874 	ahc_outb(ahc, CLRINT, CLRPARERR);
4875 	ahc_outb(ahc, CLRINT, CLRBRKADRINT);
4876 #endif
4877 	max_targ = 15;
4878 
4879 	/*
4880 	 * Assume we have a board at this stage and it has been reset.
4881 	 */
4882 	if ((ahc->flags & AHC_USEDEFAULTS) != 0)
4883 		ahc->our_id = ahc->our_id_b = 7;
4884 
4885 	/*
4886 	 * Default to allowing initiator operations.
4887 	 */
4888 	ahc->flags |= AHC_INITIATORROLE;
4889 
4890 	/*
4891 	 * Only allow target mode features if this unit has them enabled.
4892 	 */
4893 	if ((AHC_TMODE_ENABLE & (0x1 << ahc->unit)) == 0)
4894 		ahc->features &= ~AHC_TARGETMODE;
4895 
4896 #ifndef __linux__
4897 	/* DMA tag for mapping buffers into device visible space. */
4898 	if (aic_dma_tag_create(ahc, ahc->parent_dmat, /*alignment*/1,
4899 			       /*boundary*/BUS_SPACE_MAXADDR_32BIT + 1,
4900 			       /*lowaddr*/ahc->flags & AHC_39BIT_ADDRESSING
4901 					? (bus_addr_t)0x7FFFFFFFFFULL
4902 					: BUS_SPACE_MAXADDR_32BIT,
4903 			       /*highaddr*/BUS_SPACE_MAXADDR,
4904 			       /*filter*/NULL, /*filterarg*/NULL,
4905 			       /*maxsize*/(AHC_NSEG - 1) * PAGE_SIZE,
4906 			       /*nsegments*/AHC_NSEG,
4907 			       /*maxsegsz*/AHC_MAXTRANSFER_SIZE,
4908 			       /*flags*/BUS_DMA_ALLOCNOW,
4909 			       &ahc->buffer_dmat) != 0) {
4910 		return (ENOMEM);
4911 	}
4912 #endif
4913 
4914 	ahc->init_level++;
4915 
4916 	/*
4917 	 * DMA tag for our command fifos and other data in system memory
4918 	 * the card's sequencer must be able to access.  For initiator
4919 	 * roles, we need to allocate space for the qinfifo and qoutfifo.
4920 	 * The qinfifo and qoutfifo are composed of 256 1 byte elements.
4921 	 * When providing for the target mode role, we must additionally
4922 	 * provide space for the incoming target command fifo and an extra
4923 	 * byte to deal with a dma bug in some chip versions.
4924 	 */
4925 	driver_data_size = 2 * 256 * sizeof(uint8_t);
4926 	if ((ahc->features & AHC_TARGETMODE) != 0)
4927 		driver_data_size += AHC_TMODE_CMDS * sizeof(struct target_cmd)
4928 				 + /*DMA WideOdd Bug Buffer*/1;
4929 	if (aic_dma_tag_create(ahc, ahc->parent_dmat, /*alignment*/1,
4930 			       /*boundary*/BUS_SPACE_MAXADDR_32BIT + 1,
4931 			       /*lowaddr*/BUS_SPACE_MAXADDR_32BIT,
4932 			       /*highaddr*/BUS_SPACE_MAXADDR,
4933 			       /*filter*/NULL, /*filterarg*/NULL,
4934 			       driver_data_size,
4935 			       /*nsegments*/1,
4936 			       /*maxsegsz*/BUS_SPACE_MAXSIZE_32BIT,
4937 			       /*flags*/0, &ahc->shared_data_dmat) != 0) {
4938 		return (ENOMEM);
4939 	}
4940 
4941 	ahc->init_level++;
4942 
4943 	/* Allocation of driver data */
4944 	if (aic_dmamem_alloc(ahc, ahc->shared_data_dmat,
4945 			     (void **)&ahc->qoutfifo,
4946 			     BUS_DMA_NOWAIT | BUS_DMA_COHERENT,
4947 			     &ahc->shared_data_dmamap) != 0) {
4948 		return (ENOMEM);
4949 	}
4950 
4951 	ahc->init_level++;
4952 
4953 	/* And permanently map it in */
4954 	aic_dmamap_load(ahc, ahc->shared_data_dmat, ahc->shared_data_dmamap,
4955 			ahc->qoutfifo, driver_data_size, ahc_dmamap_cb,
4956 			&ahc->shared_data_busaddr, /*flags*/0);
4957 
4958 	if ((ahc->features & AHC_TARGETMODE) != 0) {
4959 		ahc->targetcmds = (struct target_cmd *)ahc->qoutfifo;
4960 		ahc->qoutfifo = (uint8_t *)&ahc->targetcmds[AHC_TMODE_CMDS];
4961 		ahc->dma_bug_buf = ahc->shared_data_busaddr
4962 				 + driver_data_size - 1;
4963 		/* All target command blocks start out invalid. */
4964 		for (i = 0; i < AHC_TMODE_CMDS; i++)
4965 			ahc->targetcmds[i].cmd_valid = 0;
4966 		ahc_sync_tqinfifo(ahc, BUS_DMASYNC_PREREAD);
4967 		ahc->qoutfifo = (uint8_t *)&ahc->targetcmds[256];
4968 	}
4969 	ahc->qinfifo = &ahc->qoutfifo[256];
4970 
4971 	ahc->init_level++;
4972 
4973 	/* Allocate SCB data now that buffer_dmat is initialized */
4974 	if (ahc->scb_data->maxhscbs == 0)
4975 		if (ahc_init_scbdata(ahc) != 0)
4976 			return (ENOMEM);
4977 
4978 	/*
4979 	 * Allocate a tstate to house information for our
4980 	 * initiator presence on the bus as well as the user
4981 	 * data for any target mode initiator.
4982 	 */
4983 	if (ahc_alloc_tstate(ahc, ahc->our_id, 'A') == NULL) {
4984 		printf("%s: unable to allocate ahc_tmode_tstate.  "
4985 		       "Failing attach\n", ahc_name(ahc));
4986 		return (ENOMEM);
4987 	}
4988 
4989 	if ((ahc->features & AHC_TWIN) != 0) {
4990 		if (ahc_alloc_tstate(ahc, ahc->our_id_b, 'B') == NULL) {
4991 			printf("%s: unable to allocate ahc_tmode_tstate.  "
4992 			       "Failing attach\n", ahc_name(ahc));
4993 			return (ENOMEM);
4994 		}
4995 	}
4996 
4997 	/*
4998 	 * Fire up a recovery thread for this controller.
4999 	 */
5000 	error = ahc_spawn_recovery_thread(ahc);
5001 	if (error != 0)
5002 		return (error);
5003 
5004 	if (ahc->scb_data->maxhscbs < AHC_SCB_MAX_ALLOC) {
5005 		ahc->flags |= AHC_PAGESCBS;
5006 	} else {
5007 		ahc->flags &= ~AHC_PAGESCBS;
5008 	}
5009 
5010 #ifdef AHC_DEBUG
5011 	if (ahc_debug & AHC_SHOW_MISC) {
5012 		printf("%s: hardware scb %u bytes; kernel scb %u bytes; "
5013 		       "ahc_dma %u bytes\n",
5014 			ahc_name(ahc),
5015 			(u_int)sizeof(struct hardware_scb),
5016 			(u_int)sizeof(struct scb),
5017 			(u_int)sizeof(struct ahc_dma_seg));
5018 	}
5019 #endif /* AHC_DEBUG */
5020 
5021 	/*
5022 	 * Look at the information that board initialization or
5023 	 * the board bios has left us.
5024 	 */
5025 	if (ahc->features & AHC_TWIN) {
5026 		scsi_conf = ahc_inb(ahc, SCSICONF + 1);
5027 		if ((scsi_conf & RESET_SCSI) != 0
5028 		 && (ahc->flags & AHC_INITIATORROLE) != 0)
5029 			ahc->flags |= AHC_RESET_BUS_B;
5030 	}
5031 
5032 	scsi_conf = ahc_inb(ahc, SCSICONF);
5033 	if ((scsi_conf & RESET_SCSI) != 0
5034 	 && (ahc->flags & AHC_INITIATORROLE) != 0)
5035 		ahc->flags |= AHC_RESET_BUS_A;
5036 
5037 	ultraenb = 0;
5038 	tagenable = ALL_TARGETS_MASK;
5039 
5040 	/* Grab the disconnection disable table and invert it for our needs */
5041 	if ((ahc->flags & AHC_USEDEFAULTS) != 0) {
5042 		printf("%s: Host Adapter Bios disabled.  Using default SCSI "
5043 			"device parameters\n", ahc_name(ahc));
5044 		ahc->flags |= AHC_EXTENDED_TRANS_A|AHC_EXTENDED_TRANS_B|
5045 			      AHC_TERM_ENB_A|AHC_TERM_ENB_B;
5046 		discenable = ALL_TARGETS_MASK;
5047 		if ((ahc->features & AHC_ULTRA) != 0)
5048 			ultraenb = ALL_TARGETS_MASK;
5049 	} else {
5050 		discenable = ~((ahc_inb(ahc, DISC_DSB + 1) << 8)
5051 			   | ahc_inb(ahc, DISC_DSB));
5052 		if ((ahc->features & (AHC_ULTRA|AHC_ULTRA2)) != 0)
5053 			ultraenb = (ahc_inb(ahc, ULTRA_ENB + 1) << 8)
5054 				      | ahc_inb(ahc, ULTRA_ENB);
5055 	}
5056 
5057 	if ((ahc->features & (AHC_WIDE|AHC_TWIN)) == 0)
5058 		max_targ = 7;
5059 
5060 	for (i = 0; i <= max_targ; i++) {
5061 		struct ahc_initiator_tinfo *tinfo;
5062 		struct ahc_tmode_tstate *tstate;
5063 		u_int our_id;
5064 		u_int target_id;
5065 		char channel;
5066 
5067 		channel = 'A';
5068 		our_id = ahc->our_id;
5069 		target_id = i;
5070 		if (i > 7 && (ahc->features & AHC_TWIN) != 0) {
5071 			channel = 'B';
5072 			our_id = ahc->our_id_b;
5073 			target_id = i % 8;
5074 		}
5075 		tinfo = ahc_fetch_transinfo(ahc, channel, our_id,
5076 					    target_id, &tstate);
5077 		/* Default to async narrow across the board */
5078 		memset(tinfo, 0, sizeof(*tinfo));
5079 		if (ahc->flags & AHC_USEDEFAULTS) {
5080 			if ((ahc->features & AHC_WIDE) != 0)
5081 				tinfo->user.width = MSG_EXT_WDTR_BUS_16_BIT;
5082 
5083 			/*
5084 			 * These will be truncated when we determine the
5085 			 * connection type we have with the target.
5086 			 */
5087 			tinfo->user.period = ahc_syncrates->period;
5088 			tinfo->user.offset = MAX_OFFSET;
5089 		} else {
5090 			u_int scsirate;
5091 			uint16_t mask;
5092 
5093 			/* Take the settings leftover in scratch RAM. */
5094 			scsirate = ahc_inb(ahc, TARG_SCSIRATE + i);
5095 			mask = (0x01 << i);
5096 			if ((ahc->features & AHC_ULTRA2) != 0) {
5097 				u_int offset;
5098 				u_int maxsync;
5099 
5100 				if ((scsirate & SOFS) == 0x0F) {
5101 					/*
5102 					 * Haven't negotiated yet,
5103 					 * so the format is different.
5104 					 */
5105 					scsirate = (scsirate & SXFR) >> 4
5106 						 | (ultraenb & mask)
5107 						  ? 0x08 : 0x0
5108 						 | (scsirate & WIDEXFER);
5109 					offset = MAX_OFFSET_ULTRA2;
5110 				} else
5111 					offset = ahc_inb(ahc, TARG_OFFSET + i);
5112 				if ((scsirate & ~WIDEXFER) == 0 && offset != 0)
5113 					/* Set to the lowest sync rate, 5MHz */
5114 					scsirate |= 0x1c;
5115 				maxsync = AHC_SYNCRATE_ULTRA2;
5116 				if ((ahc->features & AHC_DT) != 0)
5117 					maxsync = AHC_SYNCRATE_DT;
5118 				tinfo->user.period =
5119 				    ahc_find_period(ahc, scsirate, maxsync);
5120 				if (offset == 0)
5121 					tinfo->user.period = 0;
5122 				else
5123 					tinfo->user.offset = MAX_OFFSET;
5124 				if ((scsirate & SXFR_ULTRA2) <= 8/*10MHz*/
5125 				 && (ahc->features & AHC_DT) != 0)
5126 					tinfo->user.ppr_options =
5127 					    MSG_EXT_PPR_DT_REQ;
5128 			} else if ((scsirate & SOFS) != 0) {
5129 				if ((scsirate & SXFR) == 0x40
5130 				 && (ultraenb & mask) != 0) {
5131 					/* Treat 10MHz as a non-ultra speed */
5132 					scsirate &= ~SXFR;
5133 				 	ultraenb &= ~mask;
5134 				}
5135 				tinfo->user.period =
5136 				    ahc_find_period(ahc, scsirate,
5137 						    (ultraenb & mask)
5138 						   ? AHC_SYNCRATE_ULTRA
5139 						   : AHC_SYNCRATE_FAST);
5140 				if (tinfo->user.period != 0)
5141 					tinfo->user.offset = MAX_OFFSET;
5142 			}
5143 			if (tinfo->user.period == 0)
5144 				tinfo->user.offset = 0;
5145 			if ((scsirate & WIDEXFER) != 0
5146 			 && (ahc->features & AHC_WIDE) != 0)
5147 				tinfo->user.width = MSG_EXT_WDTR_BUS_16_BIT;
5148 			tinfo->user.protocol_version = 4;
5149 			if ((ahc->features & AHC_DT) != 0)
5150 				tinfo->user.transport_version = 3;
5151 			else
5152 				tinfo->user.transport_version = 2;
5153 			tinfo->goal.protocol_version = 2;
5154 			tinfo->goal.transport_version = 2;
5155 			tinfo->curr.protocol_version = 2;
5156 			tinfo->curr.transport_version = 2;
5157 		}
5158 		tstate->ultraenb = 0;
5159 	}
5160 	ahc->user_discenable = discenable;
5161 	ahc->user_tagenable = tagenable;
5162 
5163 	return (ahc->bus_chip_init(ahc));
5164 }
5165 
5166 void
5167 ahc_intr_enable(struct ahc_softc *ahc, int enable)
5168 {
5169 	u_int hcntrl;
5170 
5171 	hcntrl = ahc_inb(ahc, HCNTRL);
5172 	hcntrl &= ~INTEN;
5173 	ahc->pause &= ~INTEN;
5174 	ahc->unpause &= ~INTEN;
5175 	if (enable) {
5176 		hcntrl |= INTEN;
5177 		ahc->pause |= INTEN;
5178 		ahc->unpause |= INTEN;
5179 	}
5180 	ahc_outb(ahc, HCNTRL, hcntrl);
5181 }
5182 
5183 /*
5184  * Ensure that the card is paused in a location
5185  * outside of all critical sections and that all
5186  * pending work is completed prior to returning.
5187  * This routine should only be called from outside
5188  * an interrupt context.
5189  */
5190 void
5191 ahc_pause_and_flushwork(struct ahc_softc *ahc)
5192 {
5193 	int intstat;
5194 	int maxloops;
5195 	int paused;
5196 
5197 	maxloops = 1000;
5198 	ahc->flags |= AHC_ALL_INTERRUPTS;
5199 	paused = FALSE;
5200 	do {
5201 		if (paused) {
5202 			ahc_unpause(ahc);
5203 			/*
5204 			 * Give the sequencer some time to service
5205 			 * any active selections.
5206 			 */
5207 			aic_delay(500);
5208 		}
5209 		ahc_intr(ahc);
5210 		ahc_pause(ahc);
5211 		paused = TRUE;
5212 		ahc_outb(ahc, SCSISEQ, ahc_inb(ahc, SCSISEQ) & ~ENSELO);
5213 		intstat = ahc_inb(ahc, INTSTAT);
5214 		if ((intstat & INT_PEND) == 0) {
5215 			ahc_clear_critical_section(ahc);
5216 			intstat = ahc_inb(ahc, INTSTAT);
5217 		}
5218 	} while (--maxloops
5219 	      && (intstat != 0xFF || (ahc->features & AHC_REMOVABLE) == 0)
5220 	      && ((intstat & INT_PEND) != 0
5221 	       || (ahc_inb(ahc, SSTAT0) & (SELDO|SELINGO)) != 0));
5222 	if (maxloops == 0) {
5223 		printf("Infinite interrupt loop, INTSTAT = %x",
5224 		       ahc_inb(ahc, INTSTAT));
5225 	}
5226 	ahc_platform_flushwork(ahc);
5227 	ahc->flags &= ~AHC_ALL_INTERRUPTS;
5228 }
5229 
5230 int
5231 ahc_suspend(struct ahc_softc *ahc)
5232 {
5233 
5234 	ahc_pause_and_flushwork(ahc);
5235 
5236 	if (LIST_FIRST(&ahc->pending_scbs) != NULL) {
5237 		ahc_unpause(ahc);
5238 		return (EBUSY);
5239 	}
5240 
5241 #ifdef AHC_TARGET_MODE
5242 	/*
5243 	 * XXX What about ATIOs that have not yet been serviced?
5244 	 * Perhaps we should just refuse to be suspended if we
5245 	 * are acting in a target role.
5246 	 */
5247 	if (ahc->pending_device != NULL) {
5248 		ahc_unpause(ahc);
5249 		return (EBUSY);
5250 	}
5251 #endif
5252 	ahc_shutdown(ahc);
5253 	return (0);
5254 }
5255 
5256 int
5257 ahc_resume(struct ahc_softc *ahc)
5258 {
5259 
5260 	ahc_reset(ahc, /*reinit*/TRUE);
5261 	ahc_intr_enable(ahc, TRUE);
5262 	ahc_restart(ahc);
5263 	return (0);
5264 }
5265 
5266 /************************** Busy Target Table *********************************/
5267 /*
5268  * Return the untagged transaction id for a given target/channel lun.
5269  * Optionally, clear the entry.
5270  */
5271 u_int
5272 ahc_index_busy_tcl(struct ahc_softc *ahc, u_int tcl)
5273 {
5274 	u_int scbid;
5275 	u_int target_offset;
5276 
5277 	if ((ahc->flags & AHC_SCB_BTT) != 0) {
5278 		u_int saved_scbptr;
5279 
5280 		saved_scbptr = ahc_inb(ahc, SCBPTR);
5281 		ahc_outb(ahc, SCBPTR, TCL_LUN(tcl));
5282 		scbid = ahc_inb(ahc, SCB_64_BTT + TCL_TARGET_OFFSET(tcl));
5283 		ahc_outb(ahc, SCBPTR, saved_scbptr);
5284 	} else {
5285 		target_offset = TCL_TARGET_OFFSET(tcl);
5286 		scbid = ahc_inb(ahc, BUSY_TARGETS + target_offset);
5287 	}
5288 
5289 	return (scbid);
5290 }
5291 
5292 void
5293 ahc_unbusy_tcl(struct ahc_softc *ahc, u_int tcl)
5294 {
5295 	u_int target_offset;
5296 
5297 	if ((ahc->flags & AHC_SCB_BTT) != 0) {
5298 		u_int saved_scbptr;
5299 
5300 		saved_scbptr = ahc_inb(ahc, SCBPTR);
5301 		ahc_outb(ahc, SCBPTR, TCL_LUN(tcl));
5302 		ahc_outb(ahc, SCB_64_BTT+TCL_TARGET_OFFSET(tcl), SCB_LIST_NULL);
5303 		ahc_outb(ahc, SCBPTR, saved_scbptr);
5304 	} else {
5305 		target_offset = TCL_TARGET_OFFSET(tcl);
5306 		ahc_outb(ahc, BUSY_TARGETS + target_offset, SCB_LIST_NULL);
5307 	}
5308 }
5309 
5310 void
5311 ahc_busy_tcl(struct ahc_softc *ahc, u_int tcl, u_int scbid)
5312 {
5313 	u_int target_offset;
5314 
5315 	if ((ahc->flags & AHC_SCB_BTT) != 0) {
5316 		u_int saved_scbptr;
5317 
5318 		saved_scbptr = ahc_inb(ahc, SCBPTR);
5319 		ahc_outb(ahc, SCBPTR, TCL_LUN(tcl));
5320 		ahc_outb(ahc, SCB_64_BTT + TCL_TARGET_OFFSET(tcl), scbid);
5321 		ahc_outb(ahc, SCBPTR, saved_scbptr);
5322 	} else {
5323 		target_offset = TCL_TARGET_OFFSET(tcl);
5324 		ahc_outb(ahc, BUSY_TARGETS + target_offset, scbid);
5325 	}
5326 }
5327 
5328 /************************** SCB and SCB queue management **********************/
5329 int
5330 ahc_match_scb(struct ahc_softc *ahc, struct scb *scb, int target,
5331 	      char channel, int lun, u_int tag, role_t role)
5332 {
5333 	int targ = SCB_GET_TARGET(ahc, scb);
5334 	char chan = SCB_GET_CHANNEL(ahc, scb);
5335 	int slun = SCB_GET_LUN(scb);
5336 	int match;
5337 
5338 	match = ((chan == channel) || (channel == ALL_CHANNELS));
5339 	if (match != 0)
5340 		match = ((targ == target) || (target == CAM_TARGET_WILDCARD));
5341 	if (match != 0)
5342 		match = ((lun == slun) || (lun == CAM_LUN_WILDCARD));
5343 	if (match != 0) {
5344 #ifdef AHC_TARGET_MODE
5345 		int group;
5346 
5347 		group = XPT_FC_GROUP(scb->io_ctx->ccb_h.func_code);
5348 		if (role == ROLE_INITIATOR) {
5349 			match = (group != XPT_FC_GROUP_TMODE)
5350 			      && ((tag == scb->hscb->tag)
5351 			       || (tag == SCB_LIST_NULL));
5352 		} else if (role == ROLE_TARGET) {
5353 			match = (group == XPT_FC_GROUP_TMODE)
5354 			      && ((tag == scb->io_ctx->csio.tag_id)
5355 			       || (tag == SCB_LIST_NULL));
5356 		}
5357 #else /* !AHC_TARGET_MODE */
5358 		match = ((tag == scb->hscb->tag) || (tag == SCB_LIST_NULL));
5359 #endif /* AHC_TARGET_MODE */
5360 	}
5361 
5362 	return match;
5363 }
5364 
5365 void
5366 ahc_freeze_devq(struct ahc_softc *ahc, struct scb *scb)
5367 {
5368 	int	target;
5369 	char	channel;
5370 	int	lun;
5371 
5372 	target = SCB_GET_TARGET(ahc, scb);
5373 	lun = SCB_GET_LUN(scb);
5374 	channel = SCB_GET_CHANNEL(ahc, scb);
5375 
5376 	ahc_search_qinfifo(ahc, target, channel, lun,
5377 			   /*tag*/SCB_LIST_NULL, ROLE_UNKNOWN,
5378 			   CAM_REQUEUE_REQ, SEARCH_COMPLETE);
5379 
5380 	ahc_platform_freeze_devq(ahc, scb);
5381 }
5382 
5383 void
5384 ahc_qinfifo_requeue_tail(struct ahc_softc *ahc, struct scb *scb)
5385 {
5386 	struct scb *prev_scb;
5387 
5388 	prev_scb = NULL;
5389 	if (ahc_qinfifo_count(ahc) != 0) {
5390 		u_int prev_tag;
5391 		uint8_t prev_pos;
5392 
5393 		prev_pos = ahc->qinfifonext - 1;
5394 		prev_tag = ahc->qinfifo[prev_pos];
5395 		prev_scb = ahc_lookup_scb(ahc, prev_tag);
5396 	}
5397 	ahc_qinfifo_requeue(ahc, prev_scb, scb);
5398 	if ((ahc->features & AHC_QUEUE_REGS) != 0) {
5399 		ahc_outb(ahc, HNSCB_QOFF, ahc->qinfifonext);
5400 	} else {
5401 		ahc_outb(ahc, KERNEL_QINPOS, ahc->qinfifonext);
5402 	}
5403 }
5404 
5405 static void
5406 ahc_qinfifo_requeue(struct ahc_softc *ahc, struct scb *prev_scb,
5407 		    struct scb *scb)
5408 {
5409 	if (prev_scb == NULL) {
5410 		ahc_outb(ahc, NEXT_QUEUED_SCB, scb->hscb->tag);
5411 	} else {
5412 		prev_scb->hscb->next = scb->hscb->tag;
5413 		ahc_sync_scb(ahc, prev_scb,
5414 			     BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
5415 	}
5416 	ahc->qinfifo[ahc->qinfifonext++] = scb->hscb->tag;
5417 	scb->hscb->next = ahc->next_queued_scb->hscb->tag;
5418 	ahc_sync_scb(ahc, scb, BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);
5419 }
5420 
5421 static int
5422 ahc_qinfifo_count(struct ahc_softc *ahc)
5423 {
5424 	uint8_t qinpos;
5425 	uint8_t diff;
5426 
5427 	if ((ahc->features & AHC_QUEUE_REGS) != 0) {
5428 		qinpos = ahc_inb(ahc, SNSCB_QOFF);
5429 		ahc_outb(ahc, SNSCB_QOFF, qinpos);
5430 	} else
5431 		qinpos = ahc_inb(ahc, QINPOS);
5432 	diff = ahc->qinfifonext - qinpos;
5433 	return (diff);
5434 }
5435 
5436 int
5437 ahc_search_qinfifo(struct ahc_softc *ahc, int target, char channel,
5438 		   int lun, u_int tag, role_t role, uint32_t status,
5439 		   ahc_search_action action)
5440 {
5441 	struct	scb *scb;
5442 	struct	scb *prev_scb;
5443 	uint8_t qinstart;
5444 	uint8_t qinpos;
5445 	uint8_t qintail;
5446 	uint8_t next;
5447 	uint8_t prev;
5448 	uint8_t curscbptr;
5449 	int	found;
5450 	int	have_qregs;
5451 
5452 	qintail = ahc->qinfifonext;
5453 	have_qregs = (ahc->features & AHC_QUEUE_REGS) != 0;
5454 	if (have_qregs) {
5455 		qinstart = ahc_inb(ahc, SNSCB_QOFF);
5456 		ahc_outb(ahc, SNSCB_QOFF, qinstart);
5457 	} else
5458 		qinstart = ahc_inb(ahc, QINPOS);
5459 	qinpos = qinstart;
5460 	found = 0;
5461 	prev_scb = NULL;
5462 
5463 	if (action == SEARCH_COMPLETE) {
5464 		/*
5465 		 * Don't attempt to run any queued untagged transactions
5466 		 * until we are done with the abort process.
5467 		 */
5468 		ahc_freeze_untagged_queues(ahc);
5469 	}
5470 
5471 	/*
5472 	 * Start with an empty queue.  Entries that are not chosen
5473 	 * for removal will be re-added to the queue as we go.
5474 	 */
5475 	ahc->qinfifonext = qinpos;
5476 	ahc_outb(ahc, NEXT_QUEUED_SCB, ahc->next_queued_scb->hscb->tag);
5477 
5478 	while (qinpos != qintail) {
5479 		scb = ahc_lookup_scb(ahc, ahc->qinfifo[qinpos]);
5480 		if (scb == NULL) {
5481 			printf("qinpos = %d, SCB index = %d\n",
5482 				qinpos, ahc->qinfifo[qinpos]);
5483 			panic("Loop 1\n");
5484 		}
5485 
5486 		if (ahc_match_scb(ahc, scb, target, channel, lun, tag, role)) {
5487 			/*
5488 			 * We found an scb that needs to be acted on.
5489 			 */
5490 			found++;
5491 			switch (action) {
5492 			case SEARCH_COMPLETE:
5493 			{
5494 				cam_status ostat;
5495 				cam_status cstat;
5496 
5497 				ostat = aic_get_transaction_status(scb);
5498 				if (ostat == CAM_REQ_INPROG)
5499 					aic_set_transaction_status(scb, status);
5500 				cstat = aic_get_transaction_status(scb);
5501 				if (cstat != CAM_REQ_CMP)
5502 					aic_freeze_scb(scb);
5503 				if ((scb->flags & SCB_ACTIVE) == 0)
5504 					printf("Inactive SCB in qinfifo\n");
5505 				ahc_done(ahc, scb);
5506 
5507 				/* FALLTHROUGH */
5508 			}
5509 			case SEARCH_REMOVE:
5510 				break;
5511 			case SEARCH_COUNT:
5512 				ahc_qinfifo_requeue(ahc, prev_scb, scb);
5513 				prev_scb = scb;
5514 				break;
5515 			}
5516 		} else {
5517 			ahc_qinfifo_requeue(ahc, prev_scb, scb);
5518 			prev_scb = scb;
5519 		}
5520 		qinpos++;
5521 	}
5522 
5523 	if ((ahc->features & AHC_QUEUE_REGS) != 0) {
5524 		ahc_outb(ahc, HNSCB_QOFF, ahc->qinfifonext);
5525 	} else {
5526 		ahc_outb(ahc, KERNEL_QINPOS, ahc->qinfifonext);
5527 	}
5528 
5529 	if (action != SEARCH_COUNT
5530 	 && (found != 0)
5531 	 && (qinstart != ahc->qinfifonext)) {
5532 		/*
5533 		 * The sequencer may be in the process of dmaing
5534 		 * down the SCB at the beginning of the queue.
5535 		 * This could be problematic if either the first,
5536 		 * or the second SCB is removed from the queue
5537 		 * (the first SCB includes a pointer to the "next"
5538 		 * SCB to dma). If we have removed any entries, swap
5539 		 * the first element in the queue with the next HSCB
5540 		 * so the sequencer will notice that NEXT_QUEUED_SCB
5541 		 * has changed during its dma attempt and will retry
5542 		 * the DMA.
5543 		 */
5544 		scb = ahc_lookup_scb(ahc, ahc->qinfifo[qinstart]);
5545 
5546 		if (scb == NULL) {
5547 			printf("found = %d, qinstart = %d, qinfifionext = %d\n",
5548 				found, qinstart, ahc->qinfifonext);
5549 			panic("First/Second Qinfifo fixup\n");
5550 		}
5551 		/*
5552 		 * ahc_swap_with_next_hscb forces our next pointer to
5553 		 * point to the reserved SCB for future commands.  Save
5554 		 * and restore our original next pointer to maintain
5555 		 * queue integrity.
5556 		 */
5557 		next = scb->hscb->next;
5558 		ahc->scb_data->scbindex[scb->hscb->tag] = NULL;
5559 		ahc_swap_with_next_hscb(ahc, scb);
5560 		scb->hscb->next = next;
5561 		ahc->qinfifo[qinstart] = scb->hscb->tag;
5562 
5563 		/* Tell the card about the new head of the qinfifo. */
5564 		ahc_outb(ahc, NEXT_QUEUED_SCB, scb->hscb->tag);
5565 
5566 		/* Fixup the tail "next" pointer. */
5567 		qintail = ahc->qinfifonext - 1;
5568 		scb = ahc_lookup_scb(ahc, ahc->qinfifo[qintail]);
5569 		scb->hscb->next = ahc->next_queued_scb->hscb->tag;
5570 	}
5571 
5572 	/*
5573 	 * Search waiting for selection list.
5574 	 */
5575 	curscbptr = ahc_inb(ahc, SCBPTR);
5576 	next = ahc_inb(ahc, WAITING_SCBH);  /* Start at head of list. */
5577 	prev = SCB_LIST_NULL;
5578 
5579 	while (next != SCB_LIST_NULL) {
5580 		uint8_t scb_index;
5581 
5582 		ahc_outb(ahc, SCBPTR, next);
5583 		scb_index = ahc_inb(ahc, SCB_TAG);
5584 		if (scb_index >= ahc->scb_data->numscbs) {
5585 			printf("Waiting List inconsistency. "
5586 			       "SCB index == %d, yet numscbs == %d.",
5587 			       scb_index, ahc->scb_data->numscbs);
5588 			ahc_dump_card_state(ahc);
5589 			panic("for safety");
5590 		}
5591 		scb = ahc_lookup_scb(ahc, scb_index);
5592 		if (scb == NULL) {
5593 			printf("scb_index = %d, next = %d\n",
5594 				scb_index, next);
5595 			panic("Waiting List traversal\n");
5596 		}
5597 		if (ahc_match_scb(ahc, scb, target, channel,
5598 				  lun, SCB_LIST_NULL, role)) {
5599 			/*
5600 			 * We found an scb that needs to be acted on.
5601 			 */
5602 			found++;
5603 			switch (action) {
5604 			case SEARCH_COMPLETE:
5605 			{
5606 				cam_status ostat;
5607 				cam_status cstat;
5608 
5609 				ostat = aic_get_transaction_status(scb);
5610 				if (ostat == CAM_REQ_INPROG)
5611 					aic_set_transaction_status(scb,
5612 								   status);
5613 				cstat = aic_get_transaction_status(scb);
5614 				if (cstat != CAM_REQ_CMP)
5615 					aic_freeze_scb(scb);
5616 				if ((scb->flags & SCB_ACTIVE) == 0)
5617 					printf("Inactive SCB in Wait List\n");
5618 				ahc_done(ahc, scb);
5619 				/* FALLTHROUGH */
5620 			}
5621 			case SEARCH_REMOVE:
5622 				next = ahc_rem_wscb(ahc, next, prev);
5623 				break;
5624 			case SEARCH_COUNT:
5625 				prev = next;
5626 				next = ahc_inb(ahc, SCB_NEXT);
5627 				break;
5628 			}
5629 		} else {
5630 
5631 			prev = next;
5632 			next = ahc_inb(ahc, SCB_NEXT);
5633 		}
5634 	}
5635 	ahc_outb(ahc, SCBPTR, curscbptr);
5636 
5637 	found += ahc_search_untagged_queues(ahc, /*aic_io_ctx_t*/NULL, target,
5638 					    channel, lun, status, action);
5639 
5640 	if (action == SEARCH_COMPLETE)
5641 		ahc_release_untagged_queues(ahc);
5642 	return (found);
5643 }
5644 
5645 int
5646 ahc_search_untagged_queues(struct ahc_softc *ahc, aic_io_ctx_t ctx,
5647 			   int target, char channel, int lun, uint32_t status,
5648 			   ahc_search_action action)
5649 {
5650 	struct	scb *scb;
5651 	int	maxtarget;
5652 	int	found;
5653 	int	i;
5654 
5655 	if (action == SEARCH_COMPLETE) {
5656 		/*
5657 		 * Don't attempt to run any queued untagged transactions
5658 		 * until we are done with the abort process.
5659 		 */
5660 		ahc_freeze_untagged_queues(ahc);
5661 	}
5662 
5663 	found = 0;
5664 	i = 0;
5665 	if ((ahc->flags & AHC_SCB_BTT) == 0) {
5666 
5667 		maxtarget = 16;
5668 		if (target != CAM_TARGET_WILDCARD) {
5669 
5670 			i = target;
5671 			if (channel == 'B')
5672 				i += 8;
5673 			maxtarget = i + 1;
5674 		}
5675 	} else {
5676 		maxtarget = 0;
5677 	}
5678 
5679 	for (; i < maxtarget; i++) {
5680 		struct scb_tailq *untagged_q;
5681 		struct scb *next_scb;
5682 
5683 		untagged_q = &(ahc->untagged_queues[i]);
5684 		next_scb = TAILQ_FIRST(untagged_q);
5685 		while (next_scb != NULL) {
5686 
5687 			scb = next_scb;
5688 			next_scb = TAILQ_NEXT(scb, links.tqe);
5689 
5690 			/*
5691 			 * The head of the list may be the currently
5692 			 * active untagged command for a device.
5693 			 * We're only searching for commands that
5694 			 * have not been started.  A transaction
5695 			 * marked active but still in the qinfifo
5696 			 * is removed by the qinfifo scanning code
5697 			 * above.
5698 			 */
5699 			if ((scb->flags & SCB_ACTIVE) != 0)
5700 				continue;
5701 
5702 			if (ahc_match_scb(ahc, scb, target, channel, lun,
5703 					  SCB_LIST_NULL, ROLE_INITIATOR) == 0
5704 			 || (ctx != NULL && ctx != scb->io_ctx))
5705 				continue;
5706 
5707 			/*
5708 			 * We found an scb that needs to be acted on.
5709 			 */
5710 			found++;
5711 			switch (action) {
5712 			case SEARCH_COMPLETE:
5713 			{
5714 				cam_status ostat;
5715 				cam_status cstat;
5716 
5717 				ostat = aic_get_transaction_status(scb);
5718 				if (ostat == CAM_REQ_INPROG)
5719 					aic_set_transaction_status(scb, status);
5720 				cstat = aic_get_transaction_status(scb);
5721 				if (cstat != CAM_REQ_CMP)
5722 					aic_freeze_scb(scb);
5723 				ahc_done(ahc, scb);
5724 				break;
5725 			}
5726 			case SEARCH_REMOVE:
5727 				scb->flags &= ~SCB_UNTAGGEDQ;
5728 				TAILQ_REMOVE(untagged_q, scb, links.tqe);
5729 				break;
5730 			case SEARCH_COUNT:
5731 				break;
5732 			}
5733 		}
5734 	}
5735 
5736 	if (action == SEARCH_COMPLETE)
5737 		ahc_release_untagged_queues(ahc);
5738 	return (found);
5739 }
5740 
5741 int
5742 ahc_search_disc_list(struct ahc_softc *ahc, int target, char channel,
5743 		     int lun, u_int tag, int stop_on_first, int remove,
5744 		     int save_state)
5745 {
5746 	struct	scb *scbp;
5747 	u_int	next;
5748 	u_int	prev;
5749 	u_int	count;
5750 	u_int	active_scb;
5751 
5752 	count = 0;
5753 	next = ahc_inb(ahc, DISCONNECTED_SCBH);
5754 	prev = SCB_LIST_NULL;
5755 
5756 	if (save_state) {
5757 		/* restore this when we're done */
5758 		active_scb = ahc_inb(ahc, SCBPTR);
5759 	} else
5760 		/* Silence compiler */
5761 		active_scb = SCB_LIST_NULL;
5762 
5763 	while (next != SCB_LIST_NULL) {
5764 		u_int scb_index;
5765 
5766 		ahc_outb(ahc, SCBPTR, next);
5767 		scb_index = ahc_inb(ahc, SCB_TAG);
5768 		if (scb_index >= ahc->scb_data->numscbs) {
5769 			printf("Disconnected List inconsistency. "
5770 			       "SCB index == %d, yet numscbs == %d.",
5771 			       scb_index, ahc->scb_data->numscbs);
5772 			ahc_dump_card_state(ahc);
5773 			panic("for safety");
5774 		}
5775 
5776 		if (next == prev) {
5777 			panic("Disconnected List Loop. "
5778 			      "cur SCBPTR == %x, prev SCBPTR == %x.",
5779 			      next, prev);
5780 		}
5781 		scbp = ahc_lookup_scb(ahc, scb_index);
5782 		if (ahc_match_scb(ahc, scbp, target, channel, lun,
5783 				  tag, ROLE_INITIATOR)) {
5784 			count++;
5785 			if (remove) {
5786 				next =
5787 				    ahc_rem_scb_from_disc_list(ahc, prev, next);
5788 			} else {
5789 				prev = next;
5790 				next = ahc_inb(ahc, SCB_NEXT);
5791 			}
5792 			if (stop_on_first)
5793 				break;
5794 		} else {
5795 			prev = next;
5796 			next = ahc_inb(ahc, SCB_NEXT);
5797 		}
5798 	}
5799 	if (save_state)
5800 		ahc_outb(ahc, SCBPTR, active_scb);
5801 	return (count);
5802 }
5803 
5804 /*
5805  * Remove an SCB from the on chip list of disconnected transactions.
5806  * This is empty/unused if we are not performing SCB paging.
5807  */
5808 static u_int
5809 ahc_rem_scb_from_disc_list(struct ahc_softc *ahc, u_int prev, u_int scbptr)
5810 {
5811 	u_int next;
5812 
5813 	ahc_outb(ahc, SCBPTR, scbptr);
5814 	next = ahc_inb(ahc, SCB_NEXT);
5815 
5816 	ahc_outb(ahc, SCB_CONTROL, 0);
5817 
5818 	ahc_add_curscb_to_free_list(ahc);
5819 
5820 	if (prev != SCB_LIST_NULL) {
5821 		ahc_outb(ahc, SCBPTR, prev);
5822 		ahc_outb(ahc, SCB_NEXT, next);
5823 	} else
5824 		ahc_outb(ahc, DISCONNECTED_SCBH, next);
5825 
5826 	return (next);
5827 }
5828 
5829 /*
5830  * Add the SCB as selected by SCBPTR onto the on chip list of
5831  * free hardware SCBs.  This list is empty/unused if we are not
5832  * performing SCB paging.
5833  */
5834 static void
5835 ahc_add_curscb_to_free_list(struct ahc_softc *ahc)
5836 {
5837 	/*
5838 	 * Invalidate the tag so that our abort
5839 	 * routines don't think it's active.
5840 	 */
5841 	ahc_outb(ahc, SCB_TAG, SCB_LIST_NULL);
5842 
5843 	if ((ahc->flags & AHC_PAGESCBS) != 0) {
5844 		ahc_outb(ahc, SCB_NEXT, ahc_inb(ahc, FREE_SCBH));
5845 		ahc_outb(ahc, FREE_SCBH, ahc_inb(ahc, SCBPTR));
5846 	}
5847 }
5848 
5849 /*
5850  * Manipulate the waiting for selection list and return the
5851  * scb that follows the one that we remove.
5852  */
5853 static u_int
5854 ahc_rem_wscb(struct ahc_softc *ahc, u_int scbpos, u_int prev)
5855 {
5856 	u_int curscb, next;
5857 
5858 	/*
5859 	 * Select the SCB we want to abort and
5860 	 * pull the next pointer out of it.
5861 	 */
5862 	curscb = ahc_inb(ahc, SCBPTR);
5863 	ahc_outb(ahc, SCBPTR, scbpos);
5864 	next = ahc_inb(ahc, SCB_NEXT);
5865 
5866 	/* Clear the necessary fields */
5867 	ahc_outb(ahc, SCB_CONTROL, 0);
5868 
5869 	ahc_add_curscb_to_free_list(ahc);
5870 
5871 	/* update the waiting list */
5872 	if (prev == SCB_LIST_NULL) {
5873 		/* First in the list */
5874 		ahc_outb(ahc, WAITING_SCBH, next);
5875 
5876 		/*
5877 		 * Ensure we aren't attempting to perform
5878 		 * selection for this entry.
5879 		 */
5880 		ahc_outb(ahc, SCSISEQ, (ahc_inb(ahc, SCSISEQ) & ~ENSELO));
5881 	} else {
5882 		/*
5883 		 * Select the scb that pointed to us
5884 		 * and update its next pointer.
5885 		 */
5886 		ahc_outb(ahc, SCBPTR, prev);
5887 		ahc_outb(ahc, SCB_NEXT, next);
5888 	}
5889 
5890 	/*
5891 	 * Point us back at the original scb position.
5892 	 */
5893 	ahc_outb(ahc, SCBPTR, curscb);
5894 	return next;
5895 }
5896 
5897 /******************************** Error Handling ******************************/
5898 /*
5899  * Abort all SCBs that match the given description (target/channel/lun/tag),
5900  * setting their status to the passed in status if the status has not already
5901  * been modified from CAM_REQ_INPROG.  This routine assumes that the sequencer
5902  * is paused before it is called.
5903  */
5904 int
5905 ahc_abort_scbs(struct ahc_softc *ahc, int target, char channel,
5906 	       int lun, u_int tag, role_t role, uint32_t status)
5907 {
5908 	struct	scb *scbp;
5909 	struct	scb *scbp_next;
5910 	u_int	active_scb;
5911 	int	i, j;
5912 	int	maxtarget;
5913 	int	minlun;
5914 	int	maxlun;
5915 
5916 	int	found;
5917 
5918 	/*
5919 	 * Don't attempt to run any queued untagged transactions
5920 	 * until we are done with the abort process.
5921 	 */
5922 	ahc_freeze_untagged_queues(ahc);
5923 
5924 	/* restore this when we're done */
5925 	active_scb = ahc_inb(ahc, SCBPTR);
5926 
5927 	found = ahc_search_qinfifo(ahc, target, channel, lun, SCB_LIST_NULL,
5928 				   role, CAM_REQUEUE_REQ, SEARCH_COMPLETE);
5929 
5930 	/*
5931 	 * Clean out the busy target table for any untagged commands.
5932 	 */
5933 	i = 0;
5934 	maxtarget = 16;
5935 	if (target != CAM_TARGET_WILDCARD) {
5936 		i = target;
5937 		if (channel == 'B')
5938 			i += 8;
5939 		maxtarget = i + 1;
5940 	}
5941 
5942 	if (lun == CAM_LUN_WILDCARD) {
5943 
5944 		/*
5945 		 * Unless we are using an SCB based
5946 		 * busy targets table, there is only
5947 		 * one table entry for all luns of
5948 		 * a target.
5949 		 */
5950 		minlun = 0;
5951 		maxlun = 1;
5952 		if ((ahc->flags & AHC_SCB_BTT) != 0)
5953 			maxlun = AHC_NUM_LUNS;
5954 	} else {
5955 		minlun = lun;
5956 		maxlun = lun + 1;
5957 	}
5958 
5959 	if (role != ROLE_TARGET) {
5960 		for (;i < maxtarget; i++) {
5961 			for (j = minlun;j < maxlun; j++) {
5962 				u_int scbid;
5963 				u_int tcl;
5964 
5965 				tcl = BUILD_TCL(i << 4, j);
5966 				scbid = ahc_index_busy_tcl(ahc, tcl);
5967 				scbp = ahc_lookup_scb(ahc, scbid);
5968 				if (scbp == NULL
5969 				 || ahc_match_scb(ahc, scbp, target, channel,
5970 						  lun, tag, role) == 0)
5971 					continue;
5972 				ahc_unbusy_tcl(ahc, BUILD_TCL(i << 4, j));
5973 			}
5974 		}
5975 
5976 		/*
5977 		 * Go through the disconnected list and remove any entries we
5978 		 * have queued for completion, 0'ing their control byte too.
5979 		 * We save the active SCB and restore it ourselves, so there
5980 		 * is no reason for this search to restore it too.
5981 		 */
5982 		ahc_search_disc_list(ahc, target, channel, lun, tag,
5983 				     /*stop_on_first*/FALSE, /*remove*/TRUE,
5984 				     /*save_state*/FALSE);
5985 	}
5986 
5987 	/*
5988 	 * Go through the hardware SCB array looking for commands that
5989 	 * were active but not on any list.  In some cases, these remnants
5990 	 * might not still have mappings in the scbindex array (e.g. unexpected
5991 	 * bus free with the same scb queued for an abort).  Don't hold this
5992 	 * against them.
5993 	 */
5994 	for (i = 0; i < ahc->scb_data->maxhscbs; i++) {
5995 		u_int scbid;
5996 
5997 		ahc_outb(ahc, SCBPTR, i);
5998 		scbid = ahc_inb(ahc, SCB_TAG);
5999 		scbp = ahc_lookup_scb(ahc, scbid);
6000 		if ((scbp == NULL && scbid != SCB_LIST_NULL)
6001 		 || (scbp != NULL
6002 		  && ahc_match_scb(ahc, scbp, target, channel, lun, tag, role)))
6003 			ahc_add_curscb_to_free_list(ahc);
6004 	}
6005 
6006 	/*
6007 	 * Go through the pending CCB list and look for
6008 	 * commands for this target that are still active.
6009 	 * These are other tagged commands that were
6010 	 * disconnected when the reset occurred.
6011 	 */
6012 	scbp_next = LIST_FIRST(&ahc->pending_scbs);
6013 	while (scbp_next != NULL) {
6014 		scbp = scbp_next;
6015 		scbp_next = LIST_NEXT(scbp, pending_links);
6016 		if (ahc_match_scb(ahc, scbp, target, channel, lun, tag, role)) {
6017 			cam_status ostat;
6018 
6019 			ostat = aic_get_transaction_status(scbp);
6020 			if (ostat == CAM_REQ_INPROG)
6021 				aic_set_transaction_status(scbp, status);
6022 			if (aic_get_transaction_status(scbp) != CAM_REQ_CMP)
6023 				aic_freeze_scb(scbp);
6024 			if ((scbp->flags & SCB_ACTIVE) == 0)
6025 				printf("Inactive SCB on pending list\n");
6026 			ahc_done(ahc, scbp);
6027 			found++;
6028 		}
6029 	}
6030 	ahc_outb(ahc, SCBPTR, active_scb);
6031 	ahc_platform_abort_scbs(ahc, target, channel, lun, tag, role, status);
6032 	ahc_release_untagged_queues(ahc);
6033 	return found;
6034 }
6035 
6036 static void
6037 ahc_reset_current_bus(struct ahc_softc *ahc)
6038 {
6039 	uint8_t scsiseq;
6040 
6041 	ahc_outb(ahc, SIMODE1, ahc_inb(ahc, SIMODE1) & ~ENSCSIRST);
6042 	scsiseq = ahc_inb(ahc, SCSISEQ);
6043 	ahc_outb(ahc, SCSISEQ, scsiseq | SCSIRSTO);
6044 	ahc_flush_device_writes(ahc);
6045 	aic_delay(AHC_BUSRESET_DELAY);
6046 	/* Turn off the bus reset */
6047 	ahc_outb(ahc, SCSISEQ, scsiseq & ~SCSIRSTO);
6048 
6049 	ahc_clear_intstat(ahc);
6050 
6051 	/* Re-enable reset interrupts */
6052 	ahc_outb(ahc, SIMODE1, ahc_inb(ahc, SIMODE1) | ENSCSIRST);
6053 }
6054 
6055 int
6056 ahc_reset_channel(struct ahc_softc *ahc, char channel, int initiate_reset)
6057 {
6058 	struct	ahc_devinfo devinfo;
6059 	u_int	initiator, target, max_scsiid;
6060 	u_int	sblkctl;
6061 	u_int	scsiseq;
6062 	u_int	simode1;
6063 	int	found;
6064 	int	restart_needed;
6065 	char	cur_channel;
6066 
6067 	ahc->pending_device = NULL;
6068 
6069 	ahc_compile_devinfo(&devinfo,
6070 			    CAM_TARGET_WILDCARD,
6071 			    CAM_TARGET_WILDCARD,
6072 			    CAM_LUN_WILDCARD,
6073 			    channel, ROLE_UNKNOWN);
6074 	ahc_pause(ahc);
6075 
6076 	/* Make sure the sequencer is in a safe location. */
6077 	ahc_clear_critical_section(ahc);
6078 
6079 	/*
6080 	 * Run our command complete fifos to ensure that we perform
6081 	 * completion processing on any commands that 'completed'
6082 	 * before the reset occurred.
6083 	 */
6084 	ahc_run_qoutfifo(ahc);
6085 #ifdef AHC_TARGET_MODE
6086 	/*
6087 	 * XXX - In Twin mode, the tqinfifo may have commands
6088 	 *	 for an unaffected channel in it.  However, if
6089 	 *	 we have run out of ATIO resources to drain that
6090 	 *	 queue, we may not get them all out here.  Further,
6091 	 *	 the blocked transactions for the reset channel
6092 	 *	 should just be killed off, irrespecitve of whether
6093 	 *	 we are blocked on ATIO resources.  Write a routine
6094 	 *	 to compact the tqinfifo appropriately.
6095 	 */
6096 	if ((ahc->flags & AHC_TARGETROLE) != 0) {
6097 		ahc_run_tqinfifo(ahc, /*paused*/TRUE);
6098 	}
6099 #endif
6100 
6101 	/*
6102 	 * Reset the bus if we are initiating this reset
6103 	 */
6104 	sblkctl = ahc_inb(ahc, SBLKCTL);
6105 	cur_channel = 'A';
6106 	if ((ahc->features & AHC_TWIN) != 0
6107 	 && ((sblkctl & SELBUSB) != 0))
6108 	    cur_channel = 'B';
6109 	scsiseq = ahc_inb(ahc, SCSISEQ_TEMPLATE);
6110 	if (cur_channel != channel) {
6111 		/* Case 1: Command for another bus is active
6112 		 * Stealthily reset the other bus without
6113 		 * upsetting the current bus.
6114 		 */
6115 		ahc_outb(ahc, SBLKCTL, sblkctl ^ SELBUSB);
6116 		simode1 = ahc_inb(ahc, SIMODE1) & ~(ENBUSFREE|ENSCSIRST);
6117 #ifdef AHC_TARGET_MODE
6118 		/*
6119 		 * Bus resets clear ENSELI, so we cannot
6120 		 * defer re-enabling bus reset interrupts
6121 		 * if we are in target mode.
6122 		 */
6123 		if ((ahc->flags & AHC_TARGETROLE) != 0)
6124 			simode1 |= ENSCSIRST;
6125 #endif
6126 		ahc_outb(ahc, SIMODE1, simode1);
6127 		if (initiate_reset)
6128 			ahc_reset_current_bus(ahc);
6129 		ahc_clear_intstat(ahc);
6130 		ahc_outb(ahc, SCSISEQ, scsiseq & (ENSELI|ENRSELI|ENAUTOATNP));
6131 		ahc_outb(ahc, SBLKCTL, sblkctl);
6132 		restart_needed = FALSE;
6133 	} else {
6134 		/* Case 2: A command from this bus is active or we're idle */
6135 		simode1 = ahc_inb(ahc, SIMODE1) & ~(ENBUSFREE|ENSCSIRST);
6136 #ifdef AHC_TARGET_MODE
6137 		/*
6138 		 * Bus resets clear ENSELI, so we cannot
6139 		 * defer re-enabling bus reset interrupts
6140 		 * if we are in target mode.
6141 		 */
6142 		if ((ahc->flags & AHC_TARGETROLE) != 0)
6143 			simode1 |= ENSCSIRST;
6144 #endif
6145 		ahc_outb(ahc, SIMODE1, simode1);
6146 		if (initiate_reset)
6147 			ahc_reset_current_bus(ahc);
6148 		ahc_clear_intstat(ahc);
6149 		ahc_outb(ahc, SCSISEQ, scsiseq & (ENSELI|ENRSELI|ENAUTOATNP));
6150 		restart_needed = TRUE;
6151 	}
6152 
6153 	/*
6154 	 * Clean up all the state information for the
6155 	 * pending transactions on this bus.
6156 	 */
6157 	found = ahc_abort_scbs(ahc, CAM_TARGET_WILDCARD, channel,
6158 			       CAM_LUN_WILDCARD, SCB_LIST_NULL,
6159 			       ROLE_UNKNOWN, CAM_SCSI_BUS_RESET);
6160 
6161 	max_scsiid = (ahc->features & AHC_WIDE) ? 15 : 7;
6162 
6163 #ifdef AHC_TARGET_MODE
6164 	/*
6165 	 * Send an immediate notify ccb to all target more peripheral
6166 	 * drivers affected by this action.
6167 	 */
6168 	for (target = 0; target <= max_scsiid; target++) {
6169 		struct ahc_tmode_tstate* tstate;
6170 		u_int lun;
6171 
6172 		tstate = ahc->enabled_targets[target];
6173 		if (tstate == NULL)
6174 			continue;
6175 		for (lun = 0; lun < AHC_NUM_LUNS; lun++) {
6176 			struct ahc_tmode_lstate* lstate;
6177 
6178 			lstate = tstate->enabled_luns[lun];
6179 			if (lstate == NULL)
6180 				continue;
6181 
6182 			ahc_queue_lstate_event(ahc, lstate, CAM_TARGET_WILDCARD,
6183 					       EVENT_TYPE_BUS_RESET, /*arg*/0);
6184 			ahc_send_lstate_events(ahc, lstate);
6185 		}
6186 	}
6187 #endif
6188 	/* Notify the XPT that a bus reset occurred */
6189 	ahc_send_async(ahc, devinfo.channel, CAM_TARGET_WILDCARD,
6190 		       CAM_LUN_WILDCARD, AC_BUS_RESET, NULL);
6191 
6192 	/*
6193 	 * Revert to async/narrow transfers until we renegotiate.
6194 	 */
6195 	for (target = 0; target <= max_scsiid; target++) {
6196 
6197 		if (ahc->enabled_targets[target] == NULL)
6198 			continue;
6199 		for (initiator = 0; initiator <= max_scsiid; initiator++) {
6200 			struct ahc_devinfo devinfo;
6201 
6202 			ahc_compile_devinfo(&devinfo, target, initiator,
6203 					    CAM_LUN_WILDCARD,
6204 					    channel, ROLE_UNKNOWN);
6205 			ahc_set_width(ahc, &devinfo, MSG_EXT_WDTR_BUS_8_BIT,
6206 				      AHC_TRANS_CUR, /*paused*/TRUE);
6207 			ahc_set_syncrate(ahc, &devinfo, /*syncrate*/NULL,
6208 					 /*period*/0, /*offset*/0,
6209 					 /*ppr_options*/0, AHC_TRANS_CUR,
6210 					 /*paused*/TRUE);
6211 		}
6212 	}
6213 
6214 	if (restart_needed)
6215 		ahc_restart(ahc);
6216 	else
6217 		ahc_unpause(ahc);
6218 	return found;
6219 }
6220 
6221 
6222 /***************************** Residual Processing ****************************/
6223 /*
6224  * Calculate the residual for a just completed SCB.
6225  */
6226 void
6227 ahc_calc_residual(struct ahc_softc *ahc, struct scb *scb)
6228 {
6229 	struct hardware_scb *hscb;
6230 	struct status_pkt *spkt;
6231 	uint32_t sgptr;
6232 	uint32_t resid_sgptr;
6233 	uint32_t resid;
6234 
6235 	/*
6236 	 * 5 cases.
6237 	 * 1) No residual.
6238 	 *    SG_RESID_VALID clear in sgptr.
6239 	 * 2) Transferless command
6240 	 * 3) Never performed any transfers.
6241 	 *    sgptr has SG_FULL_RESID set.
6242 	 * 4) No residual but target did not
6243 	 *    save data pointers after the
6244 	 *    last transfer, so sgptr was
6245 	 *    never updated.
6246 	 * 5) We have a partial residual.
6247 	 *    Use residual_sgptr to determine
6248 	 *    where we are.
6249 	 */
6250 
6251 	hscb = scb->hscb;
6252 	sgptr = aic_le32toh(hscb->sgptr);
6253 	if ((sgptr & SG_RESID_VALID) == 0)
6254 		/* Case 1 */
6255 		return;
6256 	sgptr &= ~SG_RESID_VALID;
6257 
6258 	if ((sgptr & SG_LIST_NULL) != 0)
6259 		/* Case 2 */
6260 		return;
6261 
6262 	spkt = &hscb->shared_data.status;
6263 	resid_sgptr = aic_le32toh(spkt->residual_sg_ptr);
6264 	if ((sgptr & SG_FULL_RESID) != 0) {
6265 		/* Case 3 */
6266 		resid = aic_get_transfer_length(scb);
6267 	} else if ((resid_sgptr & SG_LIST_NULL) != 0) {
6268 		/* Case 4 */
6269 		return;
6270 	} else if ((resid_sgptr & ~SG_PTR_MASK) != 0) {
6271 		panic("Bogus resid sgptr value 0x%x\n", resid_sgptr);
6272 		/* NOTREACHED */
6273 		return;
6274 	} else {
6275 		struct ahc_dma_seg *sg;
6276 
6277 		/*
6278 		 * Remainder of the SG where the transfer
6279 		 * stopped.
6280 		 */
6281 		resid = aic_le32toh(spkt->residual_datacnt) & AHC_SG_LEN_MASK;
6282 		sg = ahc_sg_bus_to_virt(scb, resid_sgptr & SG_PTR_MASK);
6283 
6284 		/* The residual sg_ptr always points to the next sg */
6285 		sg--;
6286 
6287 		/*
6288 		 * Add up the contents of all residual
6289 		 * SG segments that are after the SG where
6290 		 * the transfer stopped.
6291 		 */
6292 		while ((aic_le32toh(sg->len) & AHC_DMA_LAST_SEG) == 0) {
6293 			sg++;
6294 			resid += aic_le32toh(sg->len) & AHC_SG_LEN_MASK;
6295 		}
6296 	}
6297 	if ((scb->flags & SCB_SENSE) == 0)
6298 		aic_set_residual(scb, resid);
6299 	else
6300 		aic_set_sense_residual(scb, resid);
6301 
6302 #ifdef AHC_DEBUG
6303 	if ((ahc_debug & AHC_SHOW_MISC) != 0) {
6304 		ahc_print_path(ahc, scb);
6305 		printf("Handled %sResidual of %d bytes\n",
6306 		       (scb->flags & SCB_SENSE) ? "Sense " : "", resid);
6307 	}
6308 #endif
6309 }
6310 
6311 /******************************* Target Mode **********************************/
6312 #ifdef AHC_TARGET_MODE
6313 /*
6314  * Add a target mode event to this lun's queue
6315  */
6316 static void
6317 ahc_queue_lstate_event(struct ahc_softc *ahc, struct ahc_tmode_lstate *lstate,
6318 		       u_int initiator_id, u_int event_type, u_int event_arg)
6319 {
6320 	struct ahc_tmode_event *event;
6321 	int pending;
6322 
6323 	xpt_freeze_devq(lstate->path, /*count*/1);
6324 	if (lstate->event_w_idx >= lstate->event_r_idx)
6325 		pending = lstate->event_w_idx - lstate->event_r_idx;
6326 	else
6327 		pending = AHC_TMODE_EVENT_BUFFER_SIZE + 1
6328 			- (lstate->event_r_idx - lstate->event_w_idx);
6329 
6330 	if (event_type == EVENT_TYPE_BUS_RESET
6331 	 || event_type == MSG_BUS_DEV_RESET) {
6332 		/*
6333 		 * Any earlier events are irrelevant, so reset our buffer.
6334 		 * This has the effect of allowing us to deal with reset
6335 		 * floods (an external device holding down the reset line)
6336 		 * without losing the event that is really interesting.
6337 		 */
6338 		lstate->event_r_idx = 0;
6339 		lstate->event_w_idx = 0;
6340 		xpt_release_devq(lstate->path, pending, /*runqueue*/FALSE);
6341 	}
6342 
6343 	if (pending == AHC_TMODE_EVENT_BUFFER_SIZE) {
6344 		xpt_print_path(lstate->path);
6345 		printf("immediate event %x:%x lost\n",
6346 		       lstate->event_buffer[lstate->event_r_idx].event_type,
6347 		       lstate->event_buffer[lstate->event_r_idx].event_arg);
6348 		lstate->event_r_idx++;
6349 		if (lstate->event_r_idx == AHC_TMODE_EVENT_BUFFER_SIZE)
6350 			lstate->event_r_idx = 0;
6351 		xpt_release_devq(lstate->path, /*count*/1, /*runqueue*/FALSE);
6352 	}
6353 
6354 	event = &lstate->event_buffer[lstate->event_w_idx];
6355 	event->initiator_id = initiator_id;
6356 	event->event_type = event_type;
6357 	event->event_arg = event_arg;
6358 	lstate->event_w_idx++;
6359 	if (lstate->event_w_idx == AHC_TMODE_EVENT_BUFFER_SIZE)
6360 		lstate->event_w_idx = 0;
6361 }
6362 
6363 /*
6364  * Send any target mode events queued up waiting
6365  * for immediate notify resources.
6366  */
6367 void
6368 ahc_send_lstate_events(struct ahc_softc *ahc, struct ahc_tmode_lstate *lstate)
6369 {
6370 	struct ccb_hdr *ccbh;
6371 	struct ccb_immediate_notify *inot;
6372 
6373 	while (lstate->event_r_idx != lstate->event_w_idx
6374 	    && (ccbh = SLIST_FIRST(&lstate->immed_notifies)) != NULL) {
6375 		struct ahc_tmode_event *event;
6376 
6377 		event = &lstate->event_buffer[lstate->event_r_idx];
6378 		SLIST_REMOVE_HEAD(&lstate->immed_notifies, sim_links.sle);
6379 		inot = (struct ccb_immediate_notify *)ccbh;
6380 		switch (event->event_type) {
6381 		case EVENT_TYPE_BUS_RESET:
6382 			ccbh->status = CAM_SCSI_BUS_RESET|CAM_DEV_QFRZN;
6383 			break;
6384 		default:
6385 			ccbh->status = CAM_MESSAGE_RECV|CAM_DEV_QFRZN;
6386 			inot->arg = event->event_type;
6387 			inot->seq_id = event->event_arg;
6388 			break;
6389 		}
6390 		inot->initiator_id = event->initiator_id;
6391 		xpt_done((union ccb *)inot);
6392 		lstate->event_r_idx++;
6393 		if (lstate->event_r_idx == AHC_TMODE_EVENT_BUFFER_SIZE)
6394 			lstate->event_r_idx = 0;
6395 	}
6396 }
6397 #endif
6398 
6399 /******************** Sequencer Program Patching/Download *********************/
6400 
6401 #ifdef AHC_DUMP_SEQ
6402 void
6403 ahc_dumpseq(struct ahc_softc* ahc)
6404 {
6405 	int i;
6406 
6407 	ahc_outb(ahc, SEQCTL, PERRORDIS|FAILDIS|FASTMODE|LOADRAM);
6408 	ahc_outb(ahc, SEQADDR0, 0);
6409 	ahc_outb(ahc, SEQADDR1, 0);
6410 	for (i = 0; i < ahc->instruction_ram_size; i++) {
6411 		uint8_t ins_bytes[4];
6412 
6413 		ahc_insb(ahc, SEQRAM, ins_bytes, 4);
6414 		printf("0x%08x\n", ins_bytes[0] << 24
6415 				 | ins_bytes[1] << 16
6416 				 | ins_bytes[2] << 8
6417 				 | ins_bytes[3]);
6418 	}
6419 }
6420 #endif
6421 
6422 static int
6423 ahc_loadseq(struct ahc_softc *ahc)
6424 {
6425 	struct	cs cs_table[num_critical_sections];
6426 	u_int	begin_set[num_critical_sections];
6427 	u_int	end_set[num_critical_sections];
6428 	struct	patch *cur_patch;
6429 	u_int	cs_count;
6430 	u_int	cur_cs;
6431 	u_int	i;
6432 	u_int	skip_addr;
6433 	u_int	sg_prefetch_cnt;
6434 	int	downloaded;
6435 	uint8_t	download_consts[7];
6436 
6437 	/*
6438 	 * Start out with 0 critical sections
6439 	 * that apply to this firmware load.
6440 	 */
6441 	cs_count = 0;
6442 	cur_cs = 0;
6443 	memset(begin_set, 0, sizeof(begin_set));
6444 	memset(end_set, 0, sizeof(end_set));
6445 
6446 	/* Setup downloadable constant table */
6447 	download_consts[QOUTFIFO_OFFSET] = 0;
6448 	if (ahc->targetcmds != NULL)
6449 		download_consts[QOUTFIFO_OFFSET] += 32;
6450 	download_consts[QINFIFO_OFFSET] = download_consts[QOUTFIFO_OFFSET] + 1;
6451 	download_consts[CACHESIZE_MASK] = ahc->pci_cachesize - 1;
6452 	download_consts[INVERTED_CACHESIZE_MASK] = ~(ahc->pci_cachesize - 1);
6453 	sg_prefetch_cnt = ahc->pci_cachesize;
6454 	if (sg_prefetch_cnt < (2 * sizeof(struct ahc_dma_seg)))
6455 		sg_prefetch_cnt = 2 * sizeof(struct ahc_dma_seg);
6456 	download_consts[SG_PREFETCH_CNT] = sg_prefetch_cnt;
6457 	download_consts[SG_PREFETCH_ALIGN_MASK] = ~(sg_prefetch_cnt - 1);
6458 	download_consts[SG_PREFETCH_ADDR_MASK] = (sg_prefetch_cnt - 1);
6459 
6460 	cur_patch = patches;
6461 	downloaded = 0;
6462 	skip_addr = 0;
6463 	ahc_outb(ahc, SEQCTL, PERRORDIS|FAILDIS|FASTMODE|LOADRAM);
6464 	ahc_outb(ahc, SEQADDR0, 0);
6465 	ahc_outb(ahc, SEQADDR1, 0);
6466 
6467 	for (i = 0; i < sizeof(seqprog)/4; i++) {
6468 		if (ahc_check_patch(ahc, &cur_patch, i, &skip_addr) == 0) {
6469 			/*
6470 			 * Don't download this instruction as it
6471 			 * is in a patch that was removed.
6472 			 */
6473 			continue;
6474 		}
6475 
6476 		if (downloaded == ahc->instruction_ram_size) {
6477 			/*
6478 			 * We're about to exceed the instruction
6479 			 * storage capacity for this chip.  Fail
6480 			 * the load.
6481 			 */
6482 			printf("\n%s: Program too large for instruction memory "
6483 			       "size of %d!\n", ahc_name(ahc),
6484 			       ahc->instruction_ram_size);
6485 			return (ENOMEM);
6486 		}
6487 
6488 		/*
6489 		 * Move through the CS table until we find a CS
6490 		 * that might apply to this instruction.
6491 		 */
6492 		for (; cur_cs < num_critical_sections; cur_cs++) {
6493 			if (critical_sections[cur_cs].end <= i) {
6494 				if (begin_set[cs_count] == TRUE
6495 				 && end_set[cs_count] == FALSE) {
6496 					cs_table[cs_count].end = downloaded;
6497 				 	end_set[cs_count] = TRUE;
6498 					cs_count++;
6499 				}
6500 				continue;
6501 			}
6502 			if (critical_sections[cur_cs].begin <= i
6503 			 && begin_set[cs_count] == FALSE) {
6504 				cs_table[cs_count].begin = downloaded;
6505 				begin_set[cs_count] = TRUE;
6506 			}
6507 			break;
6508 		}
6509 		ahc_download_instr(ahc, i, download_consts);
6510 		downloaded++;
6511 	}
6512 
6513 	ahc->num_critical_sections = cs_count;
6514 	if (cs_count != 0) {
6515 
6516 		cs_count *= sizeof(struct cs);
6517 		ahc->critical_sections = malloc(cs_count, M_DEVBUF, M_NOWAIT);
6518 		if (ahc->critical_sections == NULL)
6519 			panic("ahc_loadseq: Could not malloc");
6520 		memcpy(ahc->critical_sections, cs_table, cs_count);
6521 	}
6522 	ahc_outb(ahc, SEQCTL, PERRORDIS|FAILDIS|FASTMODE);
6523 
6524 	if (bootverbose) {
6525 		printf(" %d instructions downloaded\n", downloaded);
6526 		printf("%s: Features 0x%x, Bugs 0x%x, Flags 0x%x\n",
6527 		       ahc_name(ahc), ahc->features, ahc->bugs, ahc->flags);
6528 	}
6529 	return (0);
6530 }
6531 
6532 static int
6533 ahc_check_patch(struct ahc_softc *ahc, struct patch **start_patch,
6534 		u_int start_instr, u_int *skip_addr)
6535 {
6536 	struct	patch *cur_patch;
6537 	struct	patch *last_patch;
6538 	u_int	num_patches;
6539 
6540 	num_patches = sizeof(patches)/sizeof(struct patch);
6541 	last_patch = &patches[num_patches];
6542 	cur_patch = *start_patch;
6543 
6544 	while (cur_patch < last_patch && start_instr == cur_patch->begin) {
6545 
6546 		if (cur_patch->patch_func(ahc) == 0) {
6547 
6548 			/* Start rejecting code */
6549 			*skip_addr = start_instr + cur_patch->skip_instr;
6550 			cur_patch += cur_patch->skip_patch;
6551 		} else {
6552 			/* Accepted this patch.  Advance to the next
6553 			 * one and wait for our intruction pointer to
6554 			 * hit this point.
6555 			 */
6556 			cur_patch++;
6557 		}
6558 	}
6559 
6560 	*start_patch = cur_patch;
6561 	if (start_instr < *skip_addr)
6562 		/* Still skipping */
6563 		return (0);
6564 
6565 	return (1);
6566 }
6567 
6568 static void
6569 ahc_download_instr(struct ahc_softc *ahc, u_int instrptr, uint8_t *dconsts)
6570 {
6571 	union	ins_formats instr;
6572 	struct	ins_format1 *fmt1_ins;
6573 	struct	ins_format3 *fmt3_ins;
6574 	u_int	opcode;
6575 
6576 	/*
6577 	 * The firmware is always compiled into a little endian format.
6578 	 */
6579 	instr.integer = aic_le32toh(*(uint32_t*)&seqprog[instrptr * 4]);
6580 
6581 	fmt1_ins = &instr.format1;
6582 	fmt3_ins = NULL;
6583 
6584 	/* Pull the opcode */
6585 	opcode = instr.format1.opcode;
6586 	switch (opcode) {
6587 	case AIC_OP_JMP:
6588 	case AIC_OP_JC:
6589 	case AIC_OP_JNC:
6590 	case AIC_OP_CALL:
6591 	case AIC_OP_JNE:
6592 	case AIC_OP_JNZ:
6593 	case AIC_OP_JE:
6594 	case AIC_OP_JZ:
6595 	{
6596 		struct patch *cur_patch;
6597 		int address_offset;
6598 		u_int address;
6599 		u_int skip_addr;
6600 		u_int i;
6601 
6602 		fmt3_ins = &instr.format3;
6603 		address_offset = 0;
6604 		address = fmt3_ins->address;
6605 		cur_patch = patches;
6606 		skip_addr = 0;
6607 
6608 		for (i = 0; i < address;) {
6609 
6610 			ahc_check_patch(ahc, &cur_patch, i, &skip_addr);
6611 
6612 			if (skip_addr > i) {
6613 				int end_addr;
6614 
6615 				end_addr = MIN(address, skip_addr);
6616 				address_offset += end_addr - i;
6617 				i = skip_addr;
6618 			} else {
6619 				i++;
6620 			}
6621 		}
6622 		address -= address_offset;
6623 		fmt3_ins->address = address;
6624 		/* FALLTHROUGH */
6625 	}
6626 	case AIC_OP_OR:
6627 	case AIC_OP_AND:
6628 	case AIC_OP_XOR:
6629 	case AIC_OP_ADD:
6630 	case AIC_OP_ADC:
6631 	case AIC_OP_BMOV:
6632 		if (fmt1_ins->parity != 0) {
6633 			fmt1_ins->immediate = dconsts[fmt1_ins->immediate];
6634 		}
6635 		fmt1_ins->parity = 0;
6636 		if ((ahc->features & AHC_CMD_CHAN) == 0
6637 		 && opcode == AIC_OP_BMOV) {
6638 			/*
6639 			 * Block move was added at the same time
6640 			 * as the command channel.  Verify that
6641 			 * this is only a move of a single element
6642 			 * and convert the BMOV to a MOV
6643 			 * (AND with an immediate of FF).
6644 			 */
6645 			if (fmt1_ins->immediate != 1)
6646 				panic("%s: BMOV not supported\n",
6647 				      ahc_name(ahc));
6648 			fmt1_ins->opcode = AIC_OP_AND;
6649 			fmt1_ins->immediate = 0xff;
6650 		}
6651 		/* FALLTHROUGH */
6652 	case AIC_OP_ROL:
6653 		if ((ahc->features & AHC_ULTRA2) != 0) {
6654 			int i, count;
6655 
6656 			/* Calculate odd parity for the instruction */
6657 			for (i = 0, count = 0; i < 31; i++) {
6658 				uint32_t mask;
6659 
6660 				mask = 0x01 << i;
6661 				if ((instr.integer & mask) != 0)
6662 					count++;
6663 			}
6664 			if ((count & 0x01) == 0)
6665 				instr.format1.parity = 1;
6666 		} else {
6667 			/* Compress the instruction for older sequencers */
6668 			if (fmt3_ins != NULL) {
6669 				instr.integer =
6670 					fmt3_ins->immediate
6671 				      | (fmt3_ins->source << 8)
6672 				      | (fmt3_ins->address << 16)
6673 				      |	(fmt3_ins->opcode << 25);
6674 			} else {
6675 				instr.integer =
6676 					fmt1_ins->immediate
6677 				      | (fmt1_ins->source << 8)
6678 				      | (fmt1_ins->destination << 16)
6679 				      |	(fmt1_ins->ret << 24)
6680 				      |	(fmt1_ins->opcode << 25);
6681 			}
6682 		}
6683 		/* The sequencer is a little endian cpu */
6684 		instr.integer = aic_htole32(instr.integer);
6685 		ahc_outsb(ahc, SEQRAM, instr.bytes, 4);
6686 		break;
6687 	default:
6688 		panic("Unknown opcode encountered in seq program");
6689 		break;
6690 	}
6691 }
6692 
6693 int
6694 ahc_print_register(ahc_reg_parse_entry_t *table, u_int num_entries,
6695 		   const char *name, u_int address, u_int value,
6696 		   u_int *cur_column, u_int wrap_point)
6697 {
6698 	int	printed;
6699 	u_int	printed_mask;
6700 	u_int	dummy_column;
6701 
6702 	if (cur_column == NULL) {
6703 		dummy_column = 0;
6704 		cur_column = &dummy_column;
6705 	}
6706 
6707 	if (*cur_column >= wrap_point) {
6708 		printf("\n");
6709 		*cur_column = 0;
6710 	}
6711 	printed = printf("%s[0x%x]", name, value);
6712 	if (table == NULL) {
6713 		printed += printf(" ");
6714 		*cur_column += printed;
6715 		return (printed);
6716 	}
6717 	printed_mask = 0;
6718 	while (printed_mask != 0xFF) {
6719 		int entry;
6720 
6721 		for (entry = 0; entry < num_entries; entry++) {
6722 			if (((value & table[entry].mask)
6723 			  != table[entry].value)
6724 			 || ((printed_mask & table[entry].mask)
6725 			  == table[entry].mask))
6726 				continue;
6727 
6728 			printed += printf("%s%s",
6729 					  printed_mask == 0 ? ":(" : "|",
6730 					  table[entry].name);
6731 			printed_mask |= table[entry].mask;
6732 
6733 			break;
6734 		}
6735 		if (entry >= num_entries)
6736 			break;
6737 	}
6738 	if (printed_mask != 0)
6739 		printed += printf(") ");
6740 	else
6741 		printed += printf(" ");
6742 	if (cur_column != NULL)
6743 		*cur_column += printed;
6744 	return (printed);
6745 }
6746 
6747 void
6748 ahc_dump_card_state(struct ahc_softc *ahc)
6749 {
6750 	struct	scb *scb;
6751 	struct	scb_tailq *untagged_q;
6752 	u_int	cur_col;
6753 	int	paused;
6754 	int	target;
6755 	int	maxtarget;
6756 	int	i;
6757 	uint8_t last_phase;
6758 	uint8_t qinpos;
6759 	uint8_t qintail;
6760 	uint8_t qoutpos;
6761 	uint8_t scb_index;
6762 	uint8_t saved_scbptr;
6763 
6764 	if (ahc_is_paused(ahc)) {
6765 		paused = 1;
6766 	} else {
6767 		paused = 0;
6768 		ahc_pause(ahc);
6769 	}
6770 
6771 	saved_scbptr = ahc_inb(ahc, SCBPTR);
6772 	last_phase = ahc_inb(ahc, LASTPHASE);
6773 	printf(">>>>>>>>>>>>>>>>>> Dump Card State Begins <<<<<<<<<<<<<<<<<\n"
6774 	       "%s: Dumping Card State %s, at SEQADDR 0x%x\n",
6775 	       ahc_name(ahc), ahc_lookup_phase_entry(last_phase)->phasemsg,
6776 	       ahc_inb(ahc, SEQADDR0) | (ahc_inb(ahc, SEQADDR1) << 8));
6777 	if (paused)
6778 		printf("Card was paused\n");
6779 	printf("ACCUM = 0x%x, SINDEX = 0x%x, DINDEX = 0x%x, ARG_2 = 0x%x\n",
6780 	       ahc_inb(ahc, ACCUM), ahc_inb(ahc, SINDEX), ahc_inb(ahc, DINDEX),
6781 	       ahc_inb(ahc, ARG_2));
6782 	printf("HCNT = 0x%x SCBPTR = 0x%x\n", ahc_inb(ahc, HCNT),
6783 	       ahc_inb(ahc, SCBPTR));
6784 	cur_col = 0;
6785 	if ((ahc->features & AHC_DT) != 0)
6786 		ahc_scsiphase_print(ahc_inb(ahc, SCSIPHASE), &cur_col, 50);
6787 	ahc_scsisigi_print(ahc_inb(ahc, SCSISIGI), &cur_col, 50);
6788 	ahc_error_print(ahc_inb(ahc, ERROR), &cur_col, 50);
6789 	ahc_scsibusl_print(ahc_inb(ahc, SCSIBUSL), &cur_col, 50);
6790 	ahc_lastphase_print(ahc_inb(ahc, LASTPHASE), &cur_col, 50);
6791 	ahc_scsiseq_print(ahc_inb(ahc, SCSISEQ), &cur_col, 50);
6792 	ahc_sblkctl_print(ahc_inb(ahc, SBLKCTL), &cur_col, 50);
6793 	ahc_scsirate_print(ahc_inb(ahc, SCSIRATE), &cur_col, 50);
6794 	ahc_seqctl_print(ahc_inb(ahc, SEQCTL), &cur_col, 50);
6795 	ahc_seq_flags_print(ahc_inb(ahc, SEQ_FLAGS), &cur_col, 50);
6796 	ahc_sstat0_print(ahc_inb(ahc, SSTAT0), &cur_col, 50);
6797 	ahc_sstat1_print(ahc_inb(ahc, SSTAT1), &cur_col, 50);
6798 	ahc_sstat2_print(ahc_inb(ahc, SSTAT2), &cur_col, 50);
6799 	ahc_sstat3_print(ahc_inb(ahc, SSTAT3), &cur_col, 50);
6800 	ahc_simode0_print(ahc_inb(ahc, SIMODE0), &cur_col, 50);
6801 	ahc_simode1_print(ahc_inb(ahc, SIMODE1), &cur_col, 50);
6802 	ahc_sxfrctl0_print(ahc_inb(ahc, SXFRCTL0), &cur_col, 50);
6803 	ahc_dfcntrl_print(ahc_inb(ahc, DFCNTRL), &cur_col, 50);
6804 	ahc_dfstatus_print(ahc_inb(ahc, DFSTATUS), &cur_col, 50);
6805 	if (cur_col != 0)
6806 		printf("\n");
6807 	printf("STACK:");
6808 	for (i = 0; i < STACK_SIZE; i++)
6809 	       printf(" 0x%x", ahc_inb(ahc, STACK)|(ahc_inb(ahc, STACK) << 8));
6810 	printf("\nSCB count = %d\n", ahc->scb_data->numscbs);
6811 	printf("Kernel NEXTQSCB = %d\n", ahc->next_queued_scb->hscb->tag);
6812 	printf("Card NEXTQSCB = %d\n", ahc_inb(ahc, NEXT_QUEUED_SCB));
6813 	/* QINFIFO */
6814 	printf("QINFIFO entries: ");
6815 	if ((ahc->features & AHC_QUEUE_REGS) != 0) {
6816 		qinpos = ahc_inb(ahc, SNSCB_QOFF);
6817 		ahc_outb(ahc, SNSCB_QOFF, qinpos);
6818 	} else
6819 		qinpos = ahc_inb(ahc, QINPOS);
6820 	qintail = ahc->qinfifonext;
6821 	while (qinpos != qintail) {
6822 		printf("%d ", ahc->qinfifo[qinpos]);
6823 		qinpos++;
6824 	}
6825 	printf("\n");
6826 
6827 	printf("Waiting Queue entries: ");
6828 	scb_index = ahc_inb(ahc, WAITING_SCBH);
6829 	i = 0;
6830 	while (scb_index != SCB_LIST_NULL && i++ < 256) {
6831 		ahc_outb(ahc, SCBPTR, scb_index);
6832 		printf("%d:%d ", scb_index, ahc_inb(ahc, SCB_TAG));
6833 		scb_index = ahc_inb(ahc, SCB_NEXT);
6834 	}
6835 	printf("\n");
6836 
6837 	printf("Disconnected Queue entries: ");
6838 	scb_index = ahc_inb(ahc, DISCONNECTED_SCBH);
6839 	i = 0;
6840 	while (scb_index != SCB_LIST_NULL && i++ < 256) {
6841 		ahc_outb(ahc, SCBPTR, scb_index);
6842 		printf("%d:%d ", scb_index, ahc_inb(ahc, SCB_TAG));
6843 		scb_index = ahc_inb(ahc, SCB_NEXT);
6844 	}
6845 	printf("\n");
6846 
6847 	ahc_sync_qoutfifo(ahc, BUS_DMASYNC_POSTREAD);
6848 	printf("QOUTFIFO entries: ");
6849 	qoutpos = ahc->qoutfifonext;
6850 	i = 0;
6851 	while (ahc->qoutfifo[qoutpos] != SCB_LIST_NULL && i++ < 256) {
6852 		printf("%d ", ahc->qoutfifo[qoutpos]);
6853 		qoutpos++;
6854 	}
6855 	printf("\n");
6856 
6857 	printf("Sequencer Free SCB List: ");
6858 	scb_index = ahc_inb(ahc, FREE_SCBH);
6859 	i = 0;
6860 	while (scb_index != SCB_LIST_NULL && i++ < 256) {
6861 		ahc_outb(ahc, SCBPTR, scb_index);
6862 		printf("%d ", scb_index);
6863 		scb_index = ahc_inb(ahc, SCB_NEXT);
6864 	}
6865 	printf("\n");
6866 
6867 	printf("Sequencer SCB Info: ");
6868 	for (i = 0; i < ahc->scb_data->maxhscbs; i++) {
6869 		ahc_outb(ahc, SCBPTR, i);
6870 		cur_col = printf("\n%3d ", i);
6871 
6872 		ahc_scb_control_print(ahc_inb(ahc, SCB_CONTROL), &cur_col, 60);
6873 		ahc_scb_scsiid_print(ahc_inb(ahc, SCB_SCSIID), &cur_col, 60);
6874 		ahc_scb_lun_print(ahc_inb(ahc, SCB_LUN), &cur_col, 60);
6875 		ahc_scb_tag_print(ahc_inb(ahc, SCB_TAG), &cur_col, 60);
6876 	}
6877 	printf("\n");
6878 
6879 	printf("Pending list: ");
6880 	i = 0;
6881 	LIST_FOREACH(scb, &ahc->pending_scbs, pending_links) {
6882 		if (i++ > 256)
6883 			break;
6884 		cur_col = printf("\n%3d ", scb->hscb->tag);
6885 		ahc_scb_control_print(scb->hscb->control, &cur_col, 60);
6886 		ahc_scb_scsiid_print(scb->hscb->scsiid, &cur_col, 60);
6887 		ahc_scb_lun_print(scb->hscb->lun, &cur_col, 60);
6888 		if ((ahc->flags & AHC_PAGESCBS) == 0) {
6889 			ahc_outb(ahc, SCBPTR, scb->hscb->tag);
6890 			printf("(");
6891 			ahc_scb_control_print(ahc_inb(ahc, SCB_CONTROL),
6892 					      &cur_col, 60);
6893 			ahc_scb_tag_print(ahc_inb(ahc, SCB_TAG), &cur_col, 60);
6894 			printf(")");
6895 		}
6896 	}
6897 	printf("\n");
6898 
6899 	printf("Kernel Free SCB list: ");
6900 	i = 0;
6901 	SLIST_FOREACH(scb, &ahc->scb_data->free_scbs, links.sle) {
6902 		if (i++ > 256)
6903 			break;
6904 		printf("%d ", scb->hscb->tag);
6905 	}
6906 	printf("\n");
6907 
6908 	maxtarget = (ahc->features & (AHC_WIDE|AHC_TWIN)) ? 15 : 7;
6909 	for (target = 0; target <= maxtarget; target++) {
6910 		untagged_q = &ahc->untagged_queues[target];
6911 		if (TAILQ_FIRST(untagged_q) == NULL)
6912 			continue;
6913 		printf("Untagged Q(%d): ", target);
6914 		i = 0;
6915 		TAILQ_FOREACH(scb, untagged_q, links.tqe) {
6916 			if (i++ > 256)
6917 				break;
6918 			printf("%d ", scb->hscb->tag);
6919 		}
6920 		printf("\n");
6921 	}
6922 
6923 	ahc_platform_dump_card_state(ahc);
6924 	printf("\n<<<<<<<<<<<<<<<<< Dump Card State Ends >>>>>>>>>>>>>>>>>>\n");
6925 	ahc_outb(ahc, SCBPTR, saved_scbptr);
6926 	if (paused == 0)
6927 		ahc_unpause(ahc);
6928 }
6929 
6930 /*************************** Timeout Handling *********************************/
6931 void
6932 ahc_timeout(struct scb *scb)
6933 {
6934 	struct ahc_softc *ahc;
6935 
6936 	ahc = scb->ahc_softc;
6937 	if ((scb->flags & SCB_ACTIVE) != 0) {
6938 		if ((scb->flags & SCB_TIMEDOUT) == 0) {
6939 			LIST_INSERT_HEAD(&ahc->timedout_scbs, scb,
6940 					 timedout_links);
6941 			scb->flags |= SCB_TIMEDOUT;
6942 		}
6943 		ahc_wakeup_recovery_thread(ahc);
6944 	}
6945 }
6946 
6947 /*
6948  * Re-schedule a timeout for the passed in SCB if we determine that some
6949  * other SCB is in the process of recovery or an SCB with a longer
6950  * timeout is still pending.  Limit our search to just "other_scb"
6951  * if it is non-NULL.
6952  */
6953 static int
6954 ahc_other_scb_timeout(struct ahc_softc *ahc, struct scb *scb,
6955 		      struct scb *other_scb)
6956 {
6957 	u_int	newtimeout;
6958 	int	found;
6959 
6960 	ahc_print_path(ahc, scb);
6961 	printf("Other SCB Timeout%s",
6962  	       (scb->flags & SCB_OTHERTCL_TIMEOUT) != 0
6963 	       ? " again\n" : "\n");
6964 
6965 	newtimeout = aic_get_timeout(scb);
6966 	scb->flags |= SCB_OTHERTCL_TIMEOUT;
6967 	found = 0;
6968 	if (other_scb != NULL) {
6969 		if ((other_scb->flags
6970 		   & (SCB_OTHERTCL_TIMEOUT|SCB_TIMEDOUT)) == 0
6971 		 || (other_scb->flags & SCB_RECOVERY_SCB) != 0) {
6972 			found++;
6973 			newtimeout = MAX(aic_get_timeout(other_scb),
6974 					 newtimeout);
6975 		}
6976 	} else {
6977 		LIST_FOREACH(other_scb, &ahc->pending_scbs, pending_links) {
6978 			if ((other_scb->flags
6979 			   & (SCB_OTHERTCL_TIMEOUT|SCB_TIMEDOUT)) == 0
6980 			 || (other_scb->flags & SCB_RECOVERY_SCB) != 0) {
6981 				found++;
6982 				newtimeout =
6983 				    MAX(aic_get_timeout(other_scb),
6984 					newtimeout);
6985 			}
6986 		}
6987 	}
6988 
6989 	if (found != 0)
6990 		aic_scb_timer_reset(scb, newtimeout);
6991 	else {
6992 		ahc_print_path(ahc, scb);
6993 		printf("No other SCB worth waiting for...\n");
6994 	}
6995 
6996 	return (found != 0);
6997 }
6998 
6999 /*
7000  * ahc_recover_commands determines if any of the commands that have currently
7001  * timedout are the root cause for this timeout.  Innocent commands are given
7002  * a new timeout while we wait for the command executing on the bus to timeout.
7003  * This routine is invoked from a thread context so we are allowed to sleep.
7004  * Our lock is not held on entry.
7005  */
7006 void
7007 ahc_recover_commands(struct ahc_softc *ahc)
7008 {
7009 	struct	scb *scb;
7010 	int	found;
7011 	int	restart_needed;
7012 	u_int	last_phase;
7013 
7014 	/*
7015 	 * Pause the controller and manually flush any
7016 	 * commands that have just completed but that our
7017 	 * interrupt handler has yet to see.
7018 	 */
7019 	ahc_pause_and_flushwork(ahc);
7020 
7021 	if (LIST_EMPTY(&ahc->timedout_scbs) != 0) {
7022 		/*
7023 		 * The timedout commands have already
7024 		 * completed.  This typically means
7025 		 * that either the timeout value was on
7026 		 * the hairy edge of what the device
7027 		 * requires or - more likely - interrupts
7028 		 * are not happening.
7029 		 */
7030 		printf("%s: Timedout SCBs already complete. "
7031 		       "Interrupts may not be functioning.\n", ahc_name(ahc));
7032 		ahc_unpause(ahc);
7033 		return;
7034 	}
7035 
7036 	restart_needed = 0;
7037 	printf("%s: Recovery Initiated\n", ahc_name(ahc));
7038 	ahc_dump_card_state(ahc);
7039 
7040 	last_phase = ahc_inb(ahc, LASTPHASE);
7041 	while ((scb = LIST_FIRST(&ahc->timedout_scbs)) != NULL) {
7042 		u_int	active_scb_index;
7043 		u_int	saved_scbptr;
7044 		int	target;
7045 		int	lun;
7046 		int	i;
7047 		char	channel;
7048 
7049 		target = SCB_GET_TARGET(ahc, scb);
7050 		channel = SCB_GET_CHANNEL(ahc, scb);
7051 		lun = SCB_GET_LUN(scb);
7052 
7053 		ahc_print_path(ahc, scb);
7054 		printf("SCB 0x%x - timed out\n", scb->hscb->tag);
7055 		if (scb->sg_count > 0) {
7056 			for (i = 0; i < scb->sg_count; i++) {
7057 				printf("sg[%d] - Addr 0x%x : Length %d\n",
7058 				       i,
7059 				       scb->sg_list[i].addr,
7060 				       scb->sg_list[i].len & AHC_SG_LEN_MASK);
7061 			}
7062 		}
7063 		if (scb->flags & (SCB_DEVICE_RESET|SCB_ABORT)) {
7064 			/*
7065 			 * Been down this road before.
7066 			 * Do a full bus reset.
7067 			 */
7068 			aic_set_transaction_status(scb, CAM_CMD_TIMEOUT);
7069 bus_reset:
7070 			found = ahc_reset_channel(ahc, channel,
7071 						  /*Initiate Reset*/TRUE);
7072 			printf("%s: Issued Channel %c Bus Reset. "
7073 			       "%d SCBs aborted\n", ahc_name(ahc), channel,
7074 			       found);
7075 			continue;
7076 		}
7077 
7078 		/*
7079 		 * Remove the command from the timedout list in
7080 		 * preparation for requeing it.
7081 		 */
7082 		LIST_REMOVE(scb, timedout_links);
7083 		scb->flags &= ~SCB_TIMEDOUT;
7084 
7085 		/*
7086 		 * If we are a target, transition to bus free and report
7087 		 * the timeout.
7088 		 *
7089 		 * The target/initiator that is holding up the bus may not
7090 		 * be the same as the one that triggered this timeout
7091 		 * (different commands have different timeout lengths).
7092 		 * If the bus is idle and we are actiing as the initiator
7093 		 * for this request, queue a BDR message to the timed out
7094 		 * target.  Otherwise, if the timed out transaction is
7095 		 * active:
7096 		 *   Initiator transaction:
7097 		 *	Stuff the message buffer with a BDR message and assert
7098 		 *	ATN in the hopes that the target will let go of the bus
7099 		 *	and go to the mesgout phase.  If this fails, we'll
7100 		 *	get another timeout 2 seconds later which will attempt
7101 		 *	a bus reset.
7102 		 *
7103 		 *   Target transaction:
7104 		 *	Transition to BUS FREE and report the error.
7105 		 *	It's good to be the target!
7106 		 */
7107 		saved_scbptr = ahc_inb(ahc, SCBPTR);
7108 		active_scb_index = ahc_inb(ahc, SCB_TAG);
7109 
7110 		if ((ahc_inb(ahc, SEQ_FLAGS) & NOT_IDENTIFIED) == 0
7111 		  && (active_scb_index < ahc->scb_data->numscbs)) {
7112 			struct scb *active_scb;
7113 
7114 			/*
7115 			 * If the active SCB is not us, assume that
7116 			 * the active SCB has a longer timeout than
7117 			 * the timedout SCB, and wait for the active
7118 			 * SCB to timeout.
7119 			 */
7120 			active_scb = ahc_lookup_scb(ahc, active_scb_index);
7121 			if (active_scb != scb) {
7122 				if (ahc_other_scb_timeout(ahc, scb,
7123 							  active_scb) == 0)
7124 					goto bus_reset;
7125 				continue;
7126 			}
7127 
7128 			/* It's us */
7129 			if ((scb->flags & SCB_TARGET_SCB) != 0) {
7130 
7131 				/*
7132 				 * Send back any queued up transactions
7133 				 * and properly record the error condition.
7134 				 */
7135 				ahc_abort_scbs(ahc, SCB_GET_TARGET(ahc, scb),
7136 					       SCB_GET_CHANNEL(ahc, scb),
7137 					       SCB_GET_LUN(scb),
7138 					       scb->hscb->tag,
7139 					       ROLE_TARGET,
7140 					       CAM_CMD_TIMEOUT);
7141 
7142 				/* Will clear us from the bus */
7143 				restart_needed = 1;
7144 				break;
7145 			}
7146 
7147 			ahc_set_recoveryscb(ahc, active_scb);
7148 			ahc_outb(ahc, MSG_OUT, HOST_MSG);
7149 			ahc_outb(ahc, SCSISIGO, last_phase|ATNO);
7150 			ahc_print_path(ahc, active_scb);
7151 			printf("BDR message in message buffer\n");
7152 			active_scb->flags |= SCB_DEVICE_RESET;
7153 			aic_scb_timer_reset(scb, 2 * 1000);
7154 		} else if (last_phase != P_BUSFREE
7155 			&& (ahc_inb(ahc, SSTAT1) & REQINIT) == 0) {
7156 			/*
7157 			 * SCB is not identified, there
7158 			 * is no pending REQ, and the sequencer
7159 			 * has not seen a busfree.  Looks like
7160 			 * a stuck connection waiting to
7161 			 * go busfree.  Reset the bus.
7162 			 */
7163 			printf("%s: Connection stuck awaiting busfree or "
7164 			       "Identify Msg.\n", ahc_name(ahc));
7165 			goto bus_reset;
7166 		} else {
7167 			int	 disconnected;
7168 
7169 			if (last_phase != P_BUSFREE
7170 			 && (ahc_inb(ahc, SSTAT0) & TARGET) != 0) {
7171 				/* Hung target selection.  Goto busfree */
7172 				printf("%s: Hung target selection\n",
7173 				       ahc_name(ahc));
7174 				restart_needed = 1;
7175 				break;
7176 			}
7177 
7178 			/* XXX Shouldn't panic.  Just punt instead? */
7179 			if ((scb->flags & SCB_TARGET_SCB) != 0)
7180 				panic("Timed-out target SCB but bus idle");
7181 
7182 			if (ahc_search_qinfifo(ahc, target, channel, lun,
7183 					       scb->hscb->tag, ROLE_INITIATOR,
7184 					       /*status*/0, SEARCH_COUNT) > 0) {
7185 				disconnected = FALSE;
7186 			} else {
7187 				disconnected = TRUE;
7188 			}
7189 
7190 			if (disconnected) {
7191 
7192 				ahc_set_recoveryscb(ahc, scb);
7193 				/*
7194 				 * Actually re-queue this SCB in an attempt
7195 				 * to select the device before it reconnects.
7196 				 * In either case (selection or reselection),
7197 				 * we will now issue a target reset to the
7198 				 * timed-out device.
7199 				 *
7200 				 * Set the MK_MESSAGE control bit indicating
7201 				 * that we desire to send a message.  We
7202 				 * also set the disconnected flag since
7203 				 * in the paging case there is no guarantee
7204 				 * that our SCB control byte matches the
7205 				 * version on the card.  We don't want the
7206 				 * sequencer to abort the command thinking
7207 				 * an unsolicited reselection occurred.
7208 				 */
7209 				scb->hscb->control |= MK_MESSAGE|DISCONNECTED;
7210 				scb->flags |= SCB_DEVICE_RESET;
7211 
7212 				/*
7213 				 * Remove any cached copy of this SCB in the
7214 				 * disconnected list in preparation for the
7215 				 * queuing of our abort SCB.  We use the
7216 				 * same element in the SCB, SCB_NEXT, for
7217 				 * both the qinfifo and the disconnected list.
7218 				 */
7219 				ahc_search_disc_list(ahc, target, channel,
7220 						     lun, scb->hscb->tag,
7221 						     /*stop_on_first*/TRUE,
7222 						     /*remove*/TRUE,
7223 						     /*save_state*/FALSE);
7224 
7225 				/*
7226 				 * In the non-paging case, the sequencer will
7227 				 * never re-reference the in-core SCB.
7228 				 * To make sure we are notified during
7229 				 * reslection, set the MK_MESSAGE flag in
7230 				 * the card's copy of the SCB.
7231 				 */
7232 				if ((ahc->flags & AHC_PAGESCBS) == 0) {
7233 					ahc_outb(ahc, SCBPTR, scb->hscb->tag);
7234 					ahc_outb(ahc, SCB_CONTROL,
7235 						 ahc_inb(ahc, SCB_CONTROL)
7236 						| MK_MESSAGE);
7237 				}
7238 
7239 				/*
7240 				 * Clear out any entries in the QINFIFO first
7241 				 * so we are the next SCB for this target
7242 				 * to run.
7243 				 */
7244 				ahc_search_qinfifo(ahc,
7245 						   SCB_GET_TARGET(ahc, scb),
7246 						   channel, SCB_GET_LUN(scb),
7247 						   SCB_LIST_NULL,
7248 						   ROLE_INITIATOR,
7249 						   CAM_REQUEUE_REQ,
7250 						   SEARCH_COMPLETE);
7251 				ahc_print_path(ahc, scb);
7252 				printf("Queuing a BDR SCB\n");
7253 				ahc_qinfifo_requeue_tail(ahc, scb);
7254 				ahc_outb(ahc, SCBPTR, saved_scbptr);
7255 				aic_scb_timer_reset(scb, 2 * 1000);
7256 			} else {
7257 				/* Go "immediatly" to the bus reset */
7258 				/* This shouldn't happen */
7259 				ahc_set_recoveryscb(ahc, scb);
7260 				ahc_print_path(ahc, scb);
7261 				printf("SCB %d: Immediate reset.  "
7262 					"Flags = 0x%x\n", scb->hscb->tag,
7263 					scb->flags);
7264 				goto bus_reset;
7265 			}
7266 		}
7267 		break;
7268 	}
7269 
7270 	/*
7271 	 * Any remaining SCBs were not the "culprit", so remove
7272 	 * them from the timeout list.  The timer for these commands
7273 	 * will be reset once the recovery SCB completes.
7274 	 */
7275 	while ((scb = LIST_FIRST(&ahc->timedout_scbs)) != NULL) {
7276 
7277 		LIST_REMOVE(scb, timedout_links);
7278 		scb->flags &= ~SCB_TIMEDOUT;
7279 	}
7280 
7281 	if (restart_needed)
7282 		ahc_restart(ahc);
7283 	else
7284 		ahc_unpause(ahc);
7285 }
7286 
7287 /************************* Target Mode ****************************************/
7288 #ifdef AHC_TARGET_MODE
7289 cam_status
7290 ahc_find_tmode_devs(struct ahc_softc *ahc, struct cam_sim *sim, union ccb *ccb,
7291 		    struct ahc_tmode_tstate **tstate,
7292 		    struct ahc_tmode_lstate **lstate,
7293 		    int notfound_failure)
7294 {
7295 
7296 	if ((ahc->features & AHC_TARGETMODE) == 0)
7297 		return (CAM_REQ_INVALID);
7298 
7299 	/*
7300 	 * Handle the 'black hole' device that sucks up
7301 	 * requests to unattached luns on enabled targets.
7302 	 */
7303 	if (ccb->ccb_h.target_id == CAM_TARGET_WILDCARD
7304 	 && ccb->ccb_h.target_lun == CAM_LUN_WILDCARD) {
7305 		*tstate = NULL;
7306 		*lstate = ahc->black_hole;
7307 	} else {
7308 		u_int max_id;
7309 
7310 		max_id = (ahc->features & AHC_WIDE) ? 15 : 7;
7311 		if (ccb->ccb_h.target_id > max_id)
7312 			return (CAM_TID_INVALID);
7313 
7314 		if (ccb->ccb_h.target_lun >= AHC_NUM_LUNS)
7315 			return (CAM_LUN_INVALID);
7316 
7317 		*tstate = ahc->enabled_targets[ccb->ccb_h.target_id];
7318 		*lstate = NULL;
7319 		if (*tstate != NULL)
7320 			*lstate =
7321 			    (*tstate)->enabled_luns[ccb->ccb_h.target_lun];
7322 	}
7323 
7324 	if (notfound_failure != 0 && *lstate == NULL)
7325 		return (CAM_PATH_INVALID);
7326 
7327 	return (CAM_REQ_CMP);
7328 }
7329 
7330 void
7331 ahc_handle_en_lun(struct ahc_softc *ahc, struct cam_sim *sim, union ccb *ccb)
7332 {
7333 	struct	   ahc_tmode_tstate *tstate;
7334 	struct	   ahc_tmode_lstate *lstate;
7335 	struct	   ccb_en_lun *cel;
7336 	cam_status status;
7337 	u_int	   target;
7338 	u_int	   lun;
7339 	u_int	   target_mask;
7340 	u_int	   our_id;
7341 	int	   error;
7342 	char	   channel;
7343 
7344 	status = ahc_find_tmode_devs(ahc, sim, ccb, &tstate, &lstate,
7345 				     /*notfound_failure*/FALSE);
7346 
7347 	if (status != CAM_REQ_CMP) {
7348 		ccb->ccb_h.status = status;
7349 		return;
7350 	}
7351 
7352 	if (cam_sim_bus(sim) == 0)
7353 		our_id = ahc->our_id;
7354 	else
7355 		our_id = ahc->our_id_b;
7356 
7357 	if (ccb->ccb_h.target_id != our_id) {
7358 		/*
7359 		 * our_id represents our initiator ID, or
7360 		 * the ID of the first target to have an
7361 		 * enabled lun in target mode.  There are
7362 		 * two cases that may preclude enabling a
7363 		 * target id other than our_id.
7364 		 *
7365 		 *   o our_id is for an active initiator role.
7366 		 *     Since the hardware does not support
7367 		 *     reselections to the initiator role at
7368 		 *     anything other than our_id, and our_id
7369 		 *     is used by the hardware to indicate the
7370 		 *     ID to use for both select-out and
7371 		 *     reselect-out operations, the only target
7372 		 *     ID we can support in this mode is our_id.
7373 		 *
7374 		 *   o The MULTARGID feature is not available and
7375 		 *     a previous target mode ID has been enabled.
7376 		 */
7377 		if ((ahc->features & AHC_MULTIROLE) != 0) {
7378 
7379 			if ((ahc->features & AHC_MULTI_TID) != 0
7380 		   	 && (ahc->flags & AHC_INITIATORROLE) != 0) {
7381 				/*
7382 				 * Only allow additional targets if
7383 				 * the initiator role is disabled.
7384 				 * The hardware cannot handle a re-select-in
7385 				 * on the initiator id during a re-select-out
7386 				 * on a different target id.
7387 				 */
7388 				status = CAM_TID_INVALID;
7389 			} else if ((ahc->flags & AHC_INITIATORROLE) != 0
7390 				|| ahc->enabled_luns > 0) {
7391 				/*
7392 				 * Only allow our target id to change
7393 				 * if the initiator role is not configured
7394 				 * and there are no enabled luns which
7395 				 * are attached to the currently registered
7396 				 * scsi id.
7397 				 */
7398 				status = CAM_TID_INVALID;
7399 			}
7400 		} else if ((ahc->features & AHC_MULTI_TID) == 0
7401 			&& ahc->enabled_luns > 0) {
7402 
7403 			status = CAM_TID_INVALID;
7404 		}
7405 	}
7406 
7407 	if (status != CAM_REQ_CMP) {
7408 		ccb->ccb_h.status = status;
7409 		return;
7410 	}
7411 
7412 	/*
7413 	 * We now have an id that is valid.
7414 	 * If we aren't in target mode, switch modes.
7415 	 */
7416 	if ((ahc->flags & AHC_TARGETROLE) == 0
7417 	 && ccb->ccb_h.target_id != CAM_TARGET_WILDCARD) {
7418 		ahc_flag saved_flags;
7419 
7420 		printf("Configuring Target Mode\n");
7421 		if (LIST_FIRST(&ahc->pending_scbs) != NULL) {
7422 			ccb->ccb_h.status = CAM_BUSY;
7423 			return;
7424 		}
7425 		saved_flags = ahc->flags;
7426 		ahc->flags |= AHC_TARGETROLE;
7427 		if ((ahc->features & AHC_MULTIROLE) == 0)
7428 			ahc->flags &= ~AHC_INITIATORROLE;
7429 		ahc_pause(ahc);
7430 		error = ahc_loadseq(ahc);
7431 		if (error != 0) {
7432 			/*
7433 			 * Restore original configuration and notify
7434 			 * the caller that we cannot support target mode.
7435 			 * Since the adapter started out in this
7436 			 * configuration, the firmware load will succeed,
7437 			 * so there is no point in checking ahc_loadseq's
7438 			 * return value.
7439 			 */
7440 			ahc->flags = saved_flags;
7441 			(void)ahc_loadseq(ahc);
7442 			ahc_restart(ahc);
7443 			ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
7444 			return;
7445 		}
7446 		ahc_restart(ahc);
7447 	}
7448 	cel = &ccb->cel;
7449 	target = ccb->ccb_h.target_id;
7450 	lun = ccb->ccb_h.target_lun;
7451 	channel = SIM_CHANNEL(ahc, sim);
7452 	target_mask = 0x01 << target;
7453 	if (channel == 'B')
7454 		target_mask <<= 8;
7455 
7456 	if (cel->enable != 0) {
7457 		u_int scsiseq;
7458 
7459 		/* Are we already enabled?? */
7460 		if (lstate != NULL) {
7461 			xpt_print_path(ccb->ccb_h.path);
7462 			printf("Lun already enabled\n");
7463 			ccb->ccb_h.status = CAM_LUN_ALRDY_ENA;
7464 			return;
7465 		}
7466 
7467 		if (cel->grp6_len != 0
7468 		 || cel->grp7_len != 0) {
7469 			/*
7470 			 * Don't (yet?) support vendor
7471 			 * specific commands.
7472 			 */
7473 			ccb->ccb_h.status = CAM_REQ_INVALID;
7474 			printf("Non-zero Group Codes\n");
7475 			return;
7476 		}
7477 
7478 		/*
7479 		 * Seems to be okay.
7480 		 * Setup our data structures.
7481 		 */
7482 		if (target != CAM_TARGET_WILDCARD && tstate == NULL) {
7483 			tstate = ahc_alloc_tstate(ahc, target, channel);
7484 			if (tstate == NULL) {
7485 				xpt_print_path(ccb->ccb_h.path);
7486 				printf("Couldn't allocate tstate\n");
7487 				ccb->ccb_h.status = CAM_RESRC_UNAVAIL;
7488 				return;
7489 			}
7490 		}
7491 		lstate = malloc(sizeof(*lstate), M_DEVBUF, M_NOWAIT);
7492 		if (lstate == NULL) {
7493 			xpt_print_path(ccb->ccb_h.path);
7494 			printf("Couldn't allocate lstate\n");
7495 			ccb->ccb_h.status = CAM_RESRC_UNAVAIL;
7496 			return;
7497 		}
7498 		memset(lstate, 0, sizeof(*lstate));
7499 		status = xpt_create_path(&lstate->path, /*periph*/NULL,
7500 					 xpt_path_path_id(ccb->ccb_h.path),
7501 					 xpt_path_target_id(ccb->ccb_h.path),
7502 					 xpt_path_lun_id(ccb->ccb_h.path));
7503 		if (status != CAM_REQ_CMP) {
7504 			free(lstate, M_DEVBUF);
7505 			xpt_print_path(ccb->ccb_h.path);
7506 			printf("Couldn't allocate path\n");
7507 			ccb->ccb_h.status = CAM_RESRC_UNAVAIL;
7508 			return;
7509 		}
7510 		SLIST_INIT(&lstate->accept_tios);
7511 		SLIST_INIT(&lstate->immed_notifies);
7512 		ahc_pause(ahc);
7513 		if (target != CAM_TARGET_WILDCARD) {
7514 			tstate->enabled_luns[lun] = lstate;
7515 			ahc->enabled_luns++;
7516 
7517 			if ((ahc->features & AHC_MULTI_TID) != 0) {
7518 				u_int targid_mask;
7519 
7520 				targid_mask = ahc_inb(ahc, TARGID)
7521 					    | (ahc_inb(ahc, TARGID + 1) << 8);
7522 
7523 				targid_mask |= target_mask;
7524 				ahc_outb(ahc, TARGID, targid_mask);
7525 				ahc_outb(ahc, TARGID+1, (targid_mask >> 8));
7526 
7527 				ahc_update_scsiid(ahc, targid_mask);
7528 			} else {
7529 				u_int our_id;
7530 				char  channel;
7531 
7532 				channel = SIM_CHANNEL(ahc, sim);
7533 				our_id = SIM_SCSI_ID(ahc, sim);
7534 
7535 				/*
7536 				 * This can only happen if selections
7537 				 * are not enabled
7538 				 */
7539 				if (target != our_id) {
7540 					u_int sblkctl;
7541 					char  cur_channel;
7542 					int   swap;
7543 
7544 					sblkctl = ahc_inb(ahc, SBLKCTL);
7545 					cur_channel = (sblkctl & SELBUSB)
7546 						    ? 'B' : 'A';
7547 					if ((ahc->features & AHC_TWIN) == 0)
7548 						cur_channel = 'A';
7549 					swap = cur_channel != channel;
7550 					if (channel == 'A')
7551 						ahc->our_id = target;
7552 					else
7553 						ahc->our_id_b = target;
7554 
7555 					if (swap)
7556 						ahc_outb(ahc, SBLKCTL,
7557 							 sblkctl ^ SELBUSB);
7558 
7559 					ahc_outb(ahc, SCSIID, target);
7560 
7561 					if (swap)
7562 						ahc_outb(ahc, SBLKCTL, sblkctl);
7563 				}
7564 			}
7565 		} else
7566 			ahc->black_hole = lstate;
7567 		/* Allow select-in operations */
7568 		if (ahc->black_hole != NULL && ahc->enabled_luns > 0) {
7569 			scsiseq = ahc_inb(ahc, SCSISEQ_TEMPLATE);
7570 			scsiseq |= ENSELI;
7571 			ahc_outb(ahc, SCSISEQ_TEMPLATE, scsiseq);
7572 			scsiseq = ahc_inb(ahc, SCSISEQ);
7573 			scsiseq |= ENSELI;
7574 			ahc_outb(ahc, SCSISEQ, scsiseq);
7575 		}
7576 		ahc_unpause(ahc);
7577 		ccb->ccb_h.status = CAM_REQ_CMP;
7578 		xpt_print_path(ccb->ccb_h.path);
7579 		printf("Lun now enabled for target mode\n");
7580 	} else {
7581 		struct scb *scb;
7582 		int i, empty;
7583 
7584 		if (lstate == NULL) {
7585 			ccb->ccb_h.status = CAM_LUN_INVALID;
7586 			return;
7587 		}
7588 
7589 		ccb->ccb_h.status = CAM_REQ_CMP;
7590 		LIST_FOREACH(scb, &ahc->pending_scbs, pending_links) {
7591 			struct ccb_hdr *ccbh;
7592 
7593 			ccbh = &scb->io_ctx->ccb_h;
7594 			if (ccbh->func_code == XPT_CONT_TARGET_IO
7595 			 && !xpt_path_comp(ccbh->path, ccb->ccb_h.path)){
7596 				printf("CTIO pending\n");
7597 				ccb->ccb_h.status = CAM_REQ_INVALID;
7598 				return;
7599 			}
7600 		}
7601 
7602 		if (SLIST_FIRST(&lstate->accept_tios) != NULL) {
7603 			printf("ATIOs pending\n");
7604 			ccb->ccb_h.status = CAM_REQ_INVALID;
7605 		}
7606 
7607 		if (SLIST_FIRST(&lstate->immed_notifies) != NULL) {
7608 			printf("INOTs pending\n");
7609 			ccb->ccb_h.status = CAM_REQ_INVALID;
7610 		}
7611 
7612 		if (ccb->ccb_h.status != CAM_REQ_CMP) {
7613 			return;
7614 		}
7615 
7616 		xpt_print_path(ccb->ccb_h.path);
7617 		printf("Target mode disabled\n");
7618 		xpt_free_path(lstate->path);
7619 		free(lstate, M_DEVBUF);
7620 
7621 		ahc_pause(ahc);
7622 		/* Can we clean up the target too? */
7623 		if (target != CAM_TARGET_WILDCARD) {
7624 			tstate->enabled_luns[lun] = NULL;
7625 			ahc->enabled_luns--;
7626 			for (empty = 1, i = 0; i < 8; i++)
7627 				if (tstate->enabled_luns[i] != NULL) {
7628 					empty = 0;
7629 					break;
7630 				}
7631 
7632 			if (empty) {
7633 				ahc_free_tstate(ahc, target, channel,
7634 						/*force*/FALSE);
7635 				if (ahc->features & AHC_MULTI_TID) {
7636 					u_int targid_mask;
7637 
7638 					targid_mask = ahc_inb(ahc, TARGID)
7639 						    | (ahc_inb(ahc, TARGID + 1)
7640 						       << 8);
7641 
7642 					targid_mask &= ~target_mask;
7643 					ahc_outb(ahc, TARGID, targid_mask);
7644 					ahc_outb(ahc, TARGID+1,
7645 					 	 (targid_mask >> 8));
7646 					ahc_update_scsiid(ahc, targid_mask);
7647 				}
7648 			}
7649 		} else {
7650 
7651 			ahc->black_hole = NULL;
7652 
7653 			/*
7654 			 * We can't allow selections without
7655 			 * our black hole device.
7656 			 */
7657 			empty = TRUE;
7658 		}
7659 		if (ahc->enabled_luns == 0) {
7660 			/* Disallow select-in */
7661 			u_int scsiseq;
7662 
7663 			scsiseq = ahc_inb(ahc, SCSISEQ_TEMPLATE);
7664 			scsiseq &= ~ENSELI;
7665 			ahc_outb(ahc, SCSISEQ_TEMPLATE, scsiseq);
7666 			scsiseq = ahc_inb(ahc, SCSISEQ);
7667 			scsiseq &= ~ENSELI;
7668 			ahc_outb(ahc, SCSISEQ, scsiseq);
7669 
7670 			if ((ahc->features & AHC_MULTIROLE) == 0) {
7671 				printf("Configuring Initiator Mode\n");
7672 				ahc->flags &= ~AHC_TARGETROLE;
7673 				ahc->flags |= AHC_INITIATORROLE;
7674 				/*
7675 				 * Returning to a configuration that
7676 				 * fit previously will always succeed.
7677 				 */
7678 				(void)ahc_loadseq(ahc);
7679 				ahc_restart(ahc);
7680 				/*
7681 				 * Unpaused.  The extra unpause
7682 				 * that follows is harmless.
7683 				 */
7684 			}
7685 		}
7686 		ahc_unpause(ahc);
7687 	}
7688 }
7689 
7690 static void
7691 ahc_update_scsiid(struct ahc_softc *ahc, u_int targid_mask)
7692 {
7693 	u_int scsiid_mask;
7694 	u_int scsiid;
7695 
7696 	if ((ahc->features & AHC_MULTI_TID) == 0)
7697 		panic("ahc_update_scsiid called on non-multitid unit\n");
7698 
7699 	/*
7700 	 * Since we will rely on the TARGID mask
7701 	 * for selection enables, ensure that OID
7702 	 * in SCSIID is not set to some other ID
7703 	 * that we don't want to allow selections on.
7704 	 */
7705 	if ((ahc->features & AHC_ULTRA2) != 0)
7706 		scsiid = ahc_inb(ahc, SCSIID_ULTRA2);
7707 	else
7708 		scsiid = ahc_inb(ahc, SCSIID);
7709 	scsiid_mask = 0x1 << (scsiid & OID);
7710 	if ((targid_mask & scsiid_mask) == 0) {
7711 		u_int our_id;
7712 
7713 		/* ffs counts from 1 */
7714 		our_id = ffs(targid_mask);
7715 		if (our_id == 0)
7716 			our_id = ahc->our_id;
7717 		else
7718 			our_id--;
7719 		scsiid &= TID;
7720 		scsiid |= our_id;
7721 	}
7722 	if ((ahc->features & AHC_ULTRA2) != 0)
7723 		ahc_outb(ahc, SCSIID_ULTRA2, scsiid);
7724 	else
7725 		ahc_outb(ahc, SCSIID, scsiid);
7726 }
7727 
7728 void
7729 ahc_run_tqinfifo(struct ahc_softc *ahc, int paused)
7730 {
7731 	struct target_cmd *cmd;
7732 
7733 	/*
7734 	 * If the card supports auto-access pause,
7735 	 * we can access the card directly regardless
7736 	 * of whether it is paused or not.
7737 	 */
7738 	if ((ahc->features & AHC_AUTOPAUSE) != 0)
7739 		paused = TRUE;
7740 
7741 	ahc_sync_tqinfifo(ahc, BUS_DMASYNC_POSTREAD);
7742 	while ((cmd = &ahc->targetcmds[ahc->tqinfifonext])->cmd_valid != 0) {
7743 
7744 		/*
7745 		 * Only advance through the queue if we
7746 		 * have the resources to process the command.
7747 		 */
7748 		if (ahc_handle_target_cmd(ahc, cmd) != 0)
7749 			break;
7750 
7751 		cmd->cmd_valid = 0;
7752 		aic_dmamap_sync(ahc, ahc->shared_data_dmat,
7753 				ahc->shared_data_dmamap,
7754 				ahc_targetcmd_offset(ahc, ahc->tqinfifonext),
7755 				sizeof(struct target_cmd),
7756 				BUS_DMASYNC_PREREAD);
7757 		ahc->tqinfifonext++;
7758 
7759 		/*
7760 		 * Lazily update our position in the target mode incoming
7761 		 * command queue as seen by the sequencer.
7762 		 */
7763 		if ((ahc->tqinfifonext & (HOST_TQINPOS - 1)) == 1) {
7764 			if ((ahc->features & AHC_HS_MAILBOX) != 0) {
7765 				u_int hs_mailbox;
7766 
7767 				hs_mailbox = ahc_inb(ahc, HS_MAILBOX);
7768 				hs_mailbox &= ~HOST_TQINPOS;
7769 				hs_mailbox |= ahc->tqinfifonext & HOST_TQINPOS;
7770 				ahc_outb(ahc, HS_MAILBOX, hs_mailbox);
7771 			} else {
7772 				if (!paused)
7773 					ahc_pause(ahc);
7774 				ahc_outb(ahc, KERNEL_TQINPOS,
7775 					 ahc->tqinfifonext & HOST_TQINPOS);
7776 				if (!paused)
7777 					ahc_unpause(ahc);
7778 			}
7779 		}
7780 	}
7781 }
7782 
7783 static int
7784 ahc_handle_target_cmd(struct ahc_softc *ahc, struct target_cmd *cmd)
7785 {
7786 	struct	  ahc_tmode_tstate *tstate;
7787 	struct	  ahc_tmode_lstate *lstate;
7788 	struct	  ccb_accept_tio *atio;
7789 	uint8_t *byte;
7790 	int	  initiator;
7791 	int	  target;
7792 	int	  lun;
7793 
7794 	initiator = SCSIID_TARGET(ahc, cmd->scsiid);
7795 	target = SCSIID_OUR_ID(cmd->scsiid);
7796 	lun    = (cmd->identify & MSG_IDENTIFY_LUNMASK);
7797 
7798 	byte = cmd->bytes;
7799 	tstate = ahc->enabled_targets[target];
7800 	lstate = NULL;
7801 	if (tstate != NULL)
7802 		lstate = tstate->enabled_luns[lun];
7803 
7804 	/*
7805 	 * Commands for disabled luns go to the black hole driver.
7806 	 */
7807 	if (lstate == NULL)
7808 		lstate = ahc->black_hole;
7809 
7810 	atio = (struct ccb_accept_tio*)SLIST_FIRST(&lstate->accept_tios);
7811 	if (atio == NULL) {
7812 		ahc->flags |= AHC_TQINFIFO_BLOCKED;
7813 		/*
7814 		 * Wait for more ATIOs from the peripheral driver for this lun.
7815 		 */
7816 		if (bootverbose)
7817 			printf("%s: ATIOs exhausted\n", ahc_name(ahc));
7818 		return (1);
7819 	} else
7820 		ahc->flags &= ~AHC_TQINFIFO_BLOCKED;
7821 #ifdef AHC_DEBUG
7822 	if (ahc_debug & AHC_SHOW_TQIN) {
7823 		printf("Incoming command from %d for %d:%d%s\n",
7824 		       initiator, target, lun,
7825 		       lstate == ahc->black_hole ? "(Black Holed)" : "");
7826 	}
7827 #endif
7828 	SLIST_REMOVE_HEAD(&lstate->accept_tios, sim_links.sle);
7829 
7830 	if (lstate == ahc->black_hole) {
7831 		/* Fill in the wildcards */
7832 		atio->ccb_h.target_id = target;
7833 		atio->ccb_h.target_lun = lun;
7834 	}
7835 
7836 	/*
7837 	 * Package it up and send it off to
7838 	 * whomever has this lun enabled.
7839 	 */
7840 	atio->sense_len = 0;
7841 	atio->init_id = initiator;
7842 	if (byte[0] != 0xFF) {
7843 		/* Tag was included */
7844 		atio->tag_action = *byte++;
7845 		atio->tag_id = *byte++;
7846 		atio->ccb_h.flags = CAM_TAG_ACTION_VALID;
7847 	} else {
7848 		atio->ccb_h.flags = 0;
7849 	}
7850 	byte++;
7851 
7852 	/* Okay.  Now determine the cdb size based on the command code */
7853 	switch (*byte >> CMD_GROUP_CODE_SHIFT) {
7854 	case 0:
7855 		atio->cdb_len = 6;
7856 		break;
7857 	case 1:
7858 	case 2:
7859 		atio->cdb_len = 10;
7860 		break;
7861 	case 4:
7862 		atio->cdb_len = 16;
7863 		break;
7864 	case 5:
7865 		atio->cdb_len = 12;
7866 		break;
7867 	case 3:
7868 	default:
7869 		/* Only copy the opcode. */
7870 		atio->cdb_len = 1;
7871 		printf("Reserved or VU command code type encountered\n");
7872 		break;
7873 	}
7874 
7875 	memcpy(atio->cdb_io.cdb_bytes, byte, atio->cdb_len);
7876 
7877 	atio->ccb_h.status |= CAM_CDB_RECVD;
7878 
7879 	if ((cmd->identify & MSG_IDENTIFY_DISCFLAG) == 0) {
7880 		/*
7881 		 * We weren't allowed to disconnect.
7882 		 * We're hanging on the bus until a
7883 		 * continue target I/O comes in response
7884 		 * to this accept tio.
7885 		 */
7886 #ifdef AHC_DEBUG
7887 		if (ahc_debug & AHC_SHOW_TQIN) {
7888 			printf("Received Immediate Command %d:%d:%d - %p\n",
7889 			       initiator, target, lun, ahc->pending_device);
7890 		}
7891 #endif
7892 		ahc->pending_device = lstate;
7893 		aic_freeze_ccb((union ccb *)atio);
7894 		atio->ccb_h.flags |= CAM_DIS_DISCONNECT;
7895 	}
7896 	xpt_done((union ccb*)atio);
7897 	return (0);
7898 }
7899 
7900 #endif
7901