The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/dev/sym/sym_hipd.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * SPDX-License-Identifier: BSD-3-Clause
    3  *
    4  *  Device driver optimized for the Symbios/LSI 53C896/53C895A/53C1010
    5  *  PCI-SCSI controllers.
    6  *
    7  *  Copyright (C) 1999-2001  Gerard Roudier <groudier@free.fr>
    8  *
    9  *  This driver also supports the following Symbios/LSI PCI-SCSI chips:
   10  *      53C810A, 53C825A, 53C860, 53C875, 53C876, 53C885, 53C895,
   11  *      53C810,  53C815,  53C825 and the 53C1510D is 53C8XX mode.
   12  *
   13  *
   14  *  This driver for FreeBSD-CAM is derived from the Linux sym53c8xx driver.
   15  *  Copyright (C) 1998-1999  Gerard Roudier
   16  *
   17  *  The sym53c8xx driver is derived from the ncr53c8xx driver that had been
   18  *  a port of the FreeBSD ncr driver to Linux-1.2.13.
   19  *
   20  *  The original ncr driver has been written for 386bsd and FreeBSD by
   21  *          Wolfgang Stanglmeier        <wolf@cologne.de>
   22  *          Stefan Esser                <se@mi.Uni-Koeln.de>
   23  *  Copyright (C) 1994  Wolfgang Stanglmeier
   24  *
   25  *  The initialisation code, and part of the code that addresses
   26  *  FreeBSD-CAM services is based on the aic7xxx driver for FreeBSD-CAM
   27  *  written by Justin T. Gibbs.
   28  *
   29  *  Other major contributions:
   30  *
   31  *  NVRAM detection and reading.
   32  *  Copyright (C) 1997 Richard Waltham <dormouse@farsrobt.demon.co.uk>
   33  *
   34  *-----------------------------------------------------------------------------
   35  *
   36  * Redistribution and use in source and binary forms, with or without
   37  * modification, are permitted provided that the following conditions
   38  * are met:
   39  * 1. Redistributions of source code must retain the above copyright
   40  *    notice, this list of conditions and the following disclaimer.
   41  * 2. Redistributions in binary form must reproduce the above copyright
   42  *    notice, this list of conditions and the following disclaimer in the
   43  *    documentation and/or other materials provided with the distribution.
   44  * 3. The name of the author may not be used to endorse or promote products
   45  *    derived from this software without specific prior written permission.
   46  *
   47  * THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
   48  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   49  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   50  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
   51  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   52  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   53  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   54  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   55  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   56  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   57  * SUCH DAMAGE.
   58  */
   59 
   60 #include <sys/cdefs.h>
   61 __FBSDID("$FreeBSD$");
   62 
   63 #define SYM_DRIVER_NAME "sym-1.6.5-20000902"
   64 
   65 /* #define SYM_DEBUG_GENERIC_SUPPORT */
   66 
   67 #include <sys/param.h>
   68 
   69 /*
   70  *  Driver configuration options.
   71  */
   72 #include "opt_sym.h"
   73 #include <dev/sym/sym_conf.h>
   74 
   75 #include <sys/systm.h>
   76 #include <sys/malloc.h>
   77 #include <sys/endian.h>
   78 #include <sys/kernel.h>
   79 #include <sys/lock.h>
   80 #include <sys/mutex.h>
   81 #include <sys/module.h>
   82 #include <sys/bus.h>
   83 
   84 #include <sys/proc.h>
   85 
   86 #include <dev/pci/pcireg.h>
   87 #include <dev/pci/pcivar.h>
   88 
   89 #include <machine/bus.h>
   90 #include <machine/resource.h>
   91 #include <machine/atomic.h>
   92 
   93 #ifdef __sparc64__
   94 #include <dev/ofw/openfirm.h>
   95 #include <machine/ofw_machdep.h>
   96 #endif
   97 
   98 #include <sys/rman.h>
   99 
  100 #include <cam/cam.h>
  101 #include <cam/cam_ccb.h>
  102 #include <cam/cam_sim.h>
  103 #include <cam/cam_xpt_sim.h>
  104 #include <cam/cam_debug.h>
  105 
  106 #include <cam/scsi/scsi_all.h>
  107 #include <cam/scsi/scsi_message.h>
  108 
  109 /* Short and quite clear integer types */
  110 typedef int8_t    s8;
  111 typedef int16_t   s16;
  112 typedef int32_t   s32;
  113 typedef u_int8_t  u8;
  114 typedef u_int16_t u16;
  115 typedef u_int32_t u32;
  116 
  117 /*
  118  *  Driver definitions.
  119  */
  120 #include <dev/sym/sym_defs.h>
  121 #include <dev/sym/sym_fw.h>
  122 
  123 /*
  124  *  IA32 architecture does not reorder STORES and prevents
  125  *  LOADS from passing STORES. It is called `program order'
  126  *  by Intel and allows device drivers to deal with memory
  127  *  ordering by only ensuring that the code is not reordered
  128  *  by the compiler when ordering is required.
  129  *  Other architectures implement a weaker ordering that
  130  *  requires memory barriers (and also IO barriers when they
  131  *  make sense) to be used.
  132  */
  133 #if     defined __i386__ || defined __amd64__
  134 #define MEMORY_BARRIER()        do { ; } while(0)
  135 #elif   defined __powerpc__
  136 #define MEMORY_BARRIER()        __asm__ volatile("eieio; sync" : : : "memory")
  137 #elif   defined __sparc64__
  138 #define MEMORY_BARRIER()        __asm__ volatile("membar #Sync" : : : "memory")
  139 #elif   defined __arm__
  140 #define MEMORY_BARRIER()        dmb()
  141 #elif   defined __aarch64__
  142 #define MEMORY_BARRIER()        dmb(sy)
  143 #elif   defined __riscv
  144 #define MEMORY_BARRIER()        fence()
  145 #else
  146 #error  "Not supported platform"
  147 #endif
  148 
  149 /*
  150  *  A la VMS/CAM-3 queue management.
  151  */
  152 typedef struct sym_quehead {
  153         struct sym_quehead *flink;      /* Forward  pointer */
  154         struct sym_quehead *blink;      /* Backward pointer */
  155 } SYM_QUEHEAD;
  156 
  157 #define sym_que_init(ptr) do { \
  158         (ptr)->flink = (ptr); (ptr)->blink = (ptr); \
  159 } while (0)
  160 
  161 static __inline void __sym_que_add(struct sym_quehead * new,
  162         struct sym_quehead * blink,
  163         struct sym_quehead * flink)
  164 {
  165         flink->blink    = new;
  166         new->flink      = flink;
  167         new->blink      = blink;
  168         blink->flink    = new;
  169 }
  170 
  171 static __inline void __sym_que_del(struct sym_quehead * blink,
  172         struct sym_quehead * flink)
  173 {
  174         flink->blink = blink;
  175         blink->flink = flink;
  176 }
  177 
  178 static __inline int sym_que_empty(struct sym_quehead *head)
  179 {
  180         return head->flink == head;
  181 }
  182 
  183 static __inline void sym_que_splice(struct sym_quehead *list,
  184         struct sym_quehead *head)
  185 {
  186         struct sym_quehead *first = list->flink;
  187 
  188         if (first != list) {
  189                 struct sym_quehead *last = list->blink;
  190                 struct sym_quehead *at   = head->flink;
  191 
  192                 first->blink = head;
  193                 head->flink  = first;
  194 
  195                 last->flink = at;
  196                 at->blink   = last;
  197         }
  198 }
  199 
  200 #define sym_que_entry(ptr, type, member) \
  201         ((type *)((char *)(ptr)-(size_t)(&((type *)0)->member)))
  202 
  203 #define sym_insque(new, pos)            __sym_que_add(new, pos, (pos)->flink)
  204 
  205 #define sym_remque(el)                  __sym_que_del((el)->blink, (el)->flink)
  206 
  207 #define sym_insque_head(new, head)      __sym_que_add(new, head, (head)->flink)
  208 
  209 static __inline struct sym_quehead *sym_remque_head(struct sym_quehead *head)
  210 {
  211         struct sym_quehead *elem = head->flink;
  212 
  213         if (elem != head)
  214                 __sym_que_del(head, elem->flink);
  215         else
  216                 elem = NULL;
  217         return elem;
  218 }
  219 
  220 #define sym_insque_tail(new, head)      __sym_que_add(new, (head)->blink, head)
  221 
  222 /*
  223  *  This one may be useful.
  224  */
  225 #define FOR_EACH_QUEUED_ELEMENT(head, qp) \
  226         for (qp = (head)->flink; qp != (head); qp = qp->flink)
  227 /*
  228  *  FreeBSD does not offer our kind of queue in the CAM CCB.
  229  *  So, we have to cast.
  230  */
  231 #define sym_qptr(p)     ((struct sym_quehead *) (p))
  232 
  233 /*
  234  *  Simple bitmap operations.
  235  */
  236 #define sym_set_bit(p, n)       (((u32 *)(p))[(n)>>5] |=  (1<<((n)&0x1f)))
  237 #define sym_clr_bit(p, n)       (((u32 *)(p))[(n)>>5] &= ~(1<<((n)&0x1f)))
  238 #define sym_is_bit(p, n)        (((u32 *)(p))[(n)>>5] &   (1<<((n)&0x1f)))
  239 
  240 /*
  241  *  Number of tasks per device we want to handle.
  242  */
  243 #if     SYM_CONF_MAX_TAG_ORDER > 8
  244 #error  "more than 256 tags per logical unit not allowed."
  245 #endif
  246 #define SYM_CONF_MAX_TASK       (1<<SYM_CONF_MAX_TAG_ORDER)
  247 
  248 /*
  249  *  Donnot use more tasks that we can handle.
  250  */
  251 #ifndef SYM_CONF_MAX_TAG
  252 #define SYM_CONF_MAX_TAG        SYM_CONF_MAX_TASK
  253 #endif
  254 #if     SYM_CONF_MAX_TAG > SYM_CONF_MAX_TASK
  255 #undef  SYM_CONF_MAX_TAG
  256 #define SYM_CONF_MAX_TAG        SYM_CONF_MAX_TASK
  257 #endif
  258 
  259 /*
  260  *    This one means 'NO TAG for this job'
  261  */
  262 #define NO_TAG  (256)
  263 
  264 /*
  265  *  Number of SCSI targets.
  266  */
  267 #if     SYM_CONF_MAX_TARGET > 16
  268 #error  "more than 16 targets not allowed."
  269 #endif
  270 
  271 /*
  272  *  Number of logical units per target.
  273  */
  274 #if     SYM_CONF_MAX_LUN > 64
  275 #error  "more than 64 logical units per target not allowed."
  276 #endif
  277 
  278 /*
  279  *    Asynchronous pre-scaler (ns). Shall be 40 for
  280  *    the SCSI timings to be compliant.
  281  */
  282 #define SYM_CONF_MIN_ASYNC (40)
  283 
  284 /*
  285  *  Number of entries in the START and DONE queues.
  286  *
  287  *  We limit to 1 PAGE in order to succeed allocation of
  288  *  these queues. Each entry is 8 bytes long (2 DWORDS).
  289  */
  290 #ifdef  SYM_CONF_MAX_START
  291 #define SYM_CONF_MAX_QUEUE (SYM_CONF_MAX_START+2)
  292 #else
  293 #define SYM_CONF_MAX_QUEUE (7*SYM_CONF_MAX_TASK+2)
  294 #define SYM_CONF_MAX_START (SYM_CONF_MAX_QUEUE-2)
  295 #endif
  296 
  297 #if     SYM_CONF_MAX_QUEUE > PAGE_SIZE/8
  298 #undef  SYM_CONF_MAX_QUEUE
  299 #define SYM_CONF_MAX_QUEUE   PAGE_SIZE/8
  300 #undef  SYM_CONF_MAX_START
  301 #define SYM_CONF_MAX_START (SYM_CONF_MAX_QUEUE-2)
  302 #endif
  303 
  304 /*
  305  *  For this one, we want a short name :-)
  306  */
  307 #define MAX_QUEUE       SYM_CONF_MAX_QUEUE
  308 
  309 /*
  310  *  Active debugging tags and verbosity.
  311  */
  312 #define DEBUG_ALLOC     (0x0001)
  313 #define DEBUG_PHASE     (0x0002)
  314 #define DEBUG_POLL      (0x0004)
  315 #define DEBUG_QUEUE     (0x0008)
  316 #define DEBUG_RESULT    (0x0010)
  317 #define DEBUG_SCATTER   (0x0020)
  318 #define DEBUG_SCRIPT    (0x0040)
  319 #define DEBUG_TINY      (0x0080)
  320 #define DEBUG_TIMING    (0x0100)
  321 #define DEBUG_NEGO      (0x0200)
  322 #define DEBUG_TAGS      (0x0400)
  323 #define DEBUG_POINTER   (0x0800)
  324 
  325 #if 0
  326 static int sym_debug = 0;
  327         #define DEBUG_FLAGS sym_debug
  328 #else
  329 /*      #define DEBUG_FLAGS (0x0631) */
  330         #define DEBUG_FLAGS (0x0000)
  331 
  332 #endif
  333 #define sym_verbose     (np->verbose)
  334 
  335 /*
  336  *  Insert a delay in micro-seconds and milli-seconds.
  337  */
  338 static void UDELAY(int us) { DELAY(us); }
  339 static void MDELAY(int ms) { while (ms--) UDELAY(1000); }
  340 
  341 /*
  342  *  Simple power of two buddy-like allocator.
  343  *
  344  *  This simple code is not intended to be fast, but to
  345  *  provide power of 2 aligned memory allocations.
  346  *  Since the SCRIPTS processor only supplies 8 bit arithmetic,
  347  *  this allocator allows simple and fast address calculations
  348  *  from the SCRIPTS code. In addition, cache line alignment
  349  *  is guaranteed for power of 2 cache line size.
  350  *
  351  *  This allocator has been developed for the Linux sym53c8xx
  352  *  driver, since this O/S does not provide naturally aligned
  353  *  allocations.
  354  *  It has the advantage of allowing the driver to use private
  355  *  pages of memory that will be useful if we ever need to deal
  356  *  with IO MMUs for PCI.
  357  */
  358 #define MEMO_SHIFT      4       /* 16 bytes minimum memory chunk */
  359 #define MEMO_PAGE_ORDER 0       /* 1 PAGE  maximum */
  360 #if 0
  361 #define MEMO_FREE_UNUSED        /* Free unused pages immediately */
  362 #endif
  363 #define MEMO_WARN       1
  364 #define MEMO_CLUSTER_SHIFT      (PAGE_SHIFT+MEMO_PAGE_ORDER)
  365 #define MEMO_CLUSTER_SIZE       (1UL << MEMO_CLUSTER_SHIFT)
  366 #define MEMO_CLUSTER_MASK       (MEMO_CLUSTER_SIZE-1)
  367 
  368 #define get_pages()             malloc(MEMO_CLUSTER_SIZE, M_DEVBUF, M_NOWAIT)
  369 #define free_pages(p)           free((p), M_DEVBUF)
  370 
  371 typedef u_long m_addr_t;        /* Enough bits to bit-hack addresses */
  372 
  373 typedef struct m_link {         /* Link between free memory chunks */
  374         struct m_link *next;
  375 } m_link_s;
  376 
  377 typedef struct m_vtob {         /* Virtual to Bus address translation */
  378         struct m_vtob   *next;
  379         bus_dmamap_t    dmamap; /* Map for this chunk */
  380         m_addr_t        vaddr;  /* Virtual address */
  381         m_addr_t        baddr;  /* Bus physical address */
  382 } m_vtob_s;
  383 /* Hash this stuff a bit to speed up translations */
  384 #define VTOB_HASH_SHIFT         5
  385 #define VTOB_HASH_SIZE          (1UL << VTOB_HASH_SHIFT)
  386 #define VTOB_HASH_MASK          (VTOB_HASH_SIZE-1)
  387 #define VTOB_HASH_CODE(m)       \
  388         ((((m_addr_t) (m)) >> MEMO_CLUSTER_SHIFT) & VTOB_HASH_MASK)
  389 
  390 typedef struct m_pool {         /* Memory pool of a given kind */
  391         bus_dma_tag_t    dev_dmat;      /* Identifies the pool */
  392         bus_dma_tag_t    dmat;          /* Tag for our fixed allocations */
  393         m_addr_t (*getp)(struct m_pool *);
  394 #ifdef  MEMO_FREE_UNUSED
  395         void (*freep)(struct m_pool *, m_addr_t);
  396 #endif
  397 #define M_GETP()                mp->getp(mp)
  398 #define M_FREEP(p)              mp->freep(mp, p)
  399         int nump;
  400         m_vtob_s *(vtob[VTOB_HASH_SIZE]);
  401         struct m_pool *next;
  402         struct m_link h[MEMO_CLUSTER_SHIFT - MEMO_SHIFT + 1];
  403 } m_pool_s;
  404 
  405 static void *___sym_malloc(m_pool_s *mp, int size)
  406 {
  407         int i = 0;
  408         int s = (1 << MEMO_SHIFT);
  409         int j;
  410         m_addr_t a;
  411         m_link_s *h = mp->h;
  412 
  413         if (size > MEMO_CLUSTER_SIZE)
  414                 return NULL;
  415 
  416         while (size > s) {
  417                 s <<= 1;
  418                 ++i;
  419         }
  420 
  421         j = i;
  422         while (!h[j].next) {
  423                 if (s == MEMO_CLUSTER_SIZE) {
  424                         h[j].next = (m_link_s *) M_GETP();
  425                         if (h[j].next)
  426                                 h[j].next->next = NULL;
  427                         break;
  428                 }
  429                 ++j;
  430                 s <<= 1;
  431         }
  432         a = (m_addr_t) h[j].next;
  433         if (a) {
  434                 h[j].next = h[j].next->next;
  435                 while (j > i) {
  436                         j -= 1;
  437                         s >>= 1;
  438                         h[j].next = (m_link_s *) (a+s);
  439                         h[j].next->next = NULL;
  440                 }
  441         }
  442 #ifdef DEBUG
  443         printf("___sym_malloc(%d) = %p\n", size, (void *) a);
  444 #endif
  445         return (void *) a;
  446 }
  447 
  448 static void ___sym_mfree(m_pool_s *mp, void *ptr, int size)
  449 {
  450         int i = 0;
  451         int s = (1 << MEMO_SHIFT);
  452         m_link_s *q;
  453         m_addr_t a, b;
  454         m_link_s *h = mp->h;
  455 
  456 #ifdef DEBUG
  457         printf("___sym_mfree(%p, %d)\n", ptr, size);
  458 #endif
  459 
  460         if (size > MEMO_CLUSTER_SIZE)
  461                 return;
  462 
  463         while (size > s) {
  464                 s <<= 1;
  465                 ++i;
  466         }
  467 
  468         a = (m_addr_t) ptr;
  469 
  470         while (1) {
  471 #ifdef MEMO_FREE_UNUSED
  472                 if (s == MEMO_CLUSTER_SIZE) {
  473                         M_FREEP(a);
  474                         break;
  475                 }
  476 #endif
  477                 b = a ^ s;
  478                 q = &h[i];
  479                 while (q->next && q->next != (m_link_s *) b) {
  480                         q = q->next;
  481                 }
  482                 if (!q->next) {
  483                         ((m_link_s *) a)->next = h[i].next;
  484                         h[i].next = (m_link_s *) a;
  485                         break;
  486                 }
  487                 q->next = q->next->next;
  488                 a = a & b;
  489                 s <<= 1;
  490                 ++i;
  491         }
  492 }
  493 
  494 static void *__sym_calloc2(m_pool_s *mp, int size, char *name, int uflags)
  495 {
  496         void *p;
  497 
  498         p = ___sym_malloc(mp, size);
  499 
  500         if (DEBUG_FLAGS & DEBUG_ALLOC)
  501                 printf ("new %-10s[%4d] @%p.\n", name, size, p);
  502 
  503         if (p)
  504                 bzero(p, size);
  505         else if (uflags & MEMO_WARN)
  506                 printf ("__sym_calloc2: failed to allocate %s[%d]\n", name, size);
  507 
  508         return p;
  509 }
  510 
  511 #define __sym_calloc(mp, s, n)  __sym_calloc2(mp, s, n, MEMO_WARN)
  512 
  513 static void __sym_mfree(m_pool_s *mp, void *ptr, int size, char *name)
  514 {
  515         if (DEBUG_FLAGS & DEBUG_ALLOC)
  516                 printf ("freeing %-10s[%4d] @%p.\n", name, size, ptr);
  517 
  518         ___sym_mfree(mp, ptr, size);
  519 
  520 }
  521 
  522 /*
  523  * Default memory pool we donnot need to involve in DMA.
  524  */
  525 /*
  526  * With the `bus dma abstraction', we use a separate pool for
  527  * memory we donnot need to involve in DMA.
  528  */
  529 static m_addr_t ___mp0_getp(m_pool_s *mp)
  530 {
  531         m_addr_t m = (m_addr_t) get_pages();
  532         if (m)
  533                 ++mp->nump;
  534         return m;
  535 }
  536 
  537 #ifdef  MEMO_FREE_UNUSED
  538 static void ___mp0_freep(m_pool_s *mp, m_addr_t m)
  539 {
  540         free_pages(m);
  541         --mp->nump;
  542 }
  543 #endif
  544 
  545 #ifdef  MEMO_FREE_UNUSED
  546 static m_pool_s mp0 = {0, 0, ___mp0_getp, ___mp0_freep};
  547 #else
  548 static m_pool_s mp0 = {0, 0, ___mp0_getp};
  549 #endif
  550 
  551 /*
  552  * Actual memory allocation routine for non-DMAed memory.
  553  */
  554 static void *sym_calloc(int size, char *name)
  555 {
  556         void *m;
  557         /* Lock */
  558         m = __sym_calloc(&mp0, size, name);
  559         /* Unlock */
  560         return m;
  561 }
  562 
  563 /*
  564  * Actual memory allocation routine for non-DMAed memory.
  565  */
  566 static void sym_mfree(void *ptr, int size, char *name)
  567 {
  568         /* Lock */
  569         __sym_mfree(&mp0, ptr, size, name);
  570         /* Unlock */
  571 }
  572 
  573 /*
  574  * DMAable pools.
  575  */
  576 /*
  577  * With `bus dma abstraction', we use a separate pool per parent
  578  * BUS handle. A reverse table (hashed) is maintained for virtual
  579  * to BUS address translation.
  580  */
  581 static void getbaddrcb(void *arg, bus_dma_segment_t *segs, int nseg __unused,
  582     int error)
  583 {
  584         bus_addr_t *baddr;
  585 
  586         KASSERT(nseg == 1, ("%s: too many DMA segments (%d)", __func__, nseg));
  587 
  588         baddr = (bus_addr_t *)arg;
  589         if (error)
  590                 *baddr = 0;
  591         else
  592                 *baddr = segs->ds_addr;
  593 }
  594 
  595 static m_addr_t ___dma_getp(m_pool_s *mp)
  596 {
  597         m_vtob_s *vbp;
  598         void *vaddr = NULL;
  599         bus_addr_t baddr = 0;
  600 
  601         vbp = __sym_calloc(&mp0, sizeof(*vbp), "VTOB");
  602         if (!vbp)
  603                 goto out_err;
  604 
  605         if (bus_dmamem_alloc(mp->dmat, &vaddr,
  606                         BUS_DMA_COHERENT | BUS_DMA_WAITOK, &vbp->dmamap))
  607                 goto out_err;
  608         bus_dmamap_load(mp->dmat, vbp->dmamap, vaddr,
  609                         MEMO_CLUSTER_SIZE, getbaddrcb, &baddr, BUS_DMA_NOWAIT);
  610         if (baddr) {
  611                 int hc = VTOB_HASH_CODE(vaddr);
  612                 vbp->vaddr = (m_addr_t) vaddr;
  613                 vbp->baddr = (m_addr_t) baddr;
  614                 vbp->next = mp->vtob[hc];
  615                 mp->vtob[hc] = vbp;
  616                 ++mp->nump;
  617                 return (m_addr_t) vaddr;
  618         }
  619 out_err:
  620         if (baddr)
  621                 bus_dmamap_unload(mp->dmat, vbp->dmamap);
  622         if (vaddr)
  623                 bus_dmamem_free(mp->dmat, vaddr, vbp->dmamap);
  624         if (vbp)
  625                 __sym_mfree(&mp0, vbp, sizeof(*vbp), "VTOB");
  626         return 0;
  627 }
  628 
  629 #ifdef  MEMO_FREE_UNUSED
  630 static void ___dma_freep(m_pool_s *mp, m_addr_t m)
  631 {
  632         m_vtob_s **vbpp, *vbp;
  633         int hc = VTOB_HASH_CODE(m);
  634 
  635         vbpp = &mp->vtob[hc];
  636         while (*vbpp && (*vbpp)->vaddr != m)
  637                 vbpp = &(*vbpp)->next;
  638         if (*vbpp) {
  639                 vbp = *vbpp;
  640                 *vbpp = (*vbpp)->next;
  641                 bus_dmamap_unload(mp->dmat, vbp->dmamap);
  642                 bus_dmamem_free(mp->dmat, (void *) vbp->vaddr, vbp->dmamap);
  643                 __sym_mfree(&mp0, vbp, sizeof(*vbp), "VTOB");
  644                 --mp->nump;
  645         }
  646 }
  647 #endif
  648 
  649 static __inline m_pool_s *___get_dma_pool(bus_dma_tag_t dev_dmat)
  650 {
  651         m_pool_s *mp;
  652         for (mp = mp0.next; mp && mp->dev_dmat != dev_dmat; mp = mp->next);
  653         return mp;
  654 }
  655 
  656 static m_pool_s *___cre_dma_pool(bus_dma_tag_t dev_dmat)
  657 {
  658         m_pool_s *mp = NULL;
  659 
  660         mp = __sym_calloc(&mp0, sizeof(*mp), "MPOOL");
  661         if (mp) {
  662                 mp->dev_dmat = dev_dmat;
  663                 if (!bus_dma_tag_create(dev_dmat, 1, MEMO_CLUSTER_SIZE,
  664                                BUS_SPACE_MAXADDR_32BIT,
  665                                BUS_SPACE_MAXADDR,
  666                                NULL, NULL, MEMO_CLUSTER_SIZE, 1,
  667                                MEMO_CLUSTER_SIZE, 0,
  668                                NULL, NULL, &mp->dmat)) {
  669                         mp->getp = ___dma_getp;
  670 #ifdef  MEMO_FREE_UNUSED
  671                         mp->freep = ___dma_freep;
  672 #endif
  673                         mp->next = mp0.next;
  674                         mp0.next = mp;
  675                         return mp;
  676                 }
  677         }
  678         if (mp)
  679                 __sym_mfree(&mp0, mp, sizeof(*mp), "MPOOL");
  680         return NULL;
  681 }
  682 
  683 #ifdef  MEMO_FREE_UNUSED
  684 static void ___del_dma_pool(m_pool_s *p)
  685 {
  686         struct m_pool **pp = &mp0.next;
  687 
  688         while (*pp && *pp != p)
  689                 pp = &(*pp)->next;
  690         if (*pp) {
  691                 *pp = (*pp)->next;
  692                 bus_dma_tag_destroy(p->dmat);
  693                 __sym_mfree(&mp0, p, sizeof(*p), "MPOOL");
  694         }
  695 }
  696 #endif
  697 
  698 static void *__sym_calloc_dma(bus_dma_tag_t dev_dmat, int size, char *name)
  699 {
  700         struct m_pool *mp;
  701         void *m = NULL;
  702 
  703         /* Lock */
  704         mp = ___get_dma_pool(dev_dmat);
  705         if (!mp)
  706                 mp = ___cre_dma_pool(dev_dmat);
  707         if (mp)
  708                 m = __sym_calloc(mp, size, name);
  709 #ifdef  MEMO_FREE_UNUSED
  710         if (mp && !mp->nump)
  711                 ___del_dma_pool(mp);
  712 #endif
  713         /* Unlock */
  714 
  715         return m;
  716 }
  717 
  718 static void
  719 __sym_mfree_dma(bus_dma_tag_t dev_dmat, void *m, int size, char *name)
  720 {
  721         struct m_pool *mp;
  722 
  723         /* Lock */
  724         mp = ___get_dma_pool(dev_dmat);
  725         if (mp)
  726                 __sym_mfree(mp, m, size, name);
  727 #ifdef  MEMO_FREE_UNUSED
  728         if (mp && !mp->nump)
  729                 ___del_dma_pool(mp);
  730 #endif
  731         /* Unlock */
  732 }
  733 
  734 static m_addr_t __vtobus(bus_dma_tag_t dev_dmat, void *m)
  735 {
  736         m_pool_s *mp;
  737         int hc = VTOB_HASH_CODE(m);
  738         m_vtob_s *vp = NULL;
  739         m_addr_t a = ((m_addr_t) m) & ~MEMO_CLUSTER_MASK;
  740 
  741         /* Lock */
  742         mp = ___get_dma_pool(dev_dmat);
  743         if (mp) {
  744                 vp = mp->vtob[hc];
  745                 while (vp && (m_addr_t) vp->vaddr != a)
  746                         vp = vp->next;
  747         }
  748         /* Unlock */
  749         if (!vp)
  750                 panic("sym: VTOBUS FAILED!\n");
  751         return vp ? vp->baddr + (((m_addr_t) m) - a) : 0;
  752 }
  753 
  754 /*
  755  * Verbs for DMAable memory handling.
  756  * The _uvptv_ macro avoids a nasty warning about pointer to volatile
  757  * being discarded.
  758  */
  759 #define _uvptv_(p) ((void *)((vm_offset_t)(p)))
  760 #define _sym_calloc_dma(np, s, n)       __sym_calloc_dma(np->bus_dmat, s, n)
  761 #define _sym_mfree_dma(np, p, s, n)     \
  762                                 __sym_mfree_dma(np->bus_dmat, _uvptv_(p), s, n)
  763 #define sym_calloc_dma(s, n)            _sym_calloc_dma(np, s, n)
  764 #define sym_mfree_dma(p, s, n)          _sym_mfree_dma(np, p, s, n)
  765 #define _vtobus(np, p)                  __vtobus(np->bus_dmat, _uvptv_(p))
  766 #define vtobus(p)                       _vtobus(np, p)
  767 
  768 /*
  769  *  Print a buffer in hexadecimal format.
  770  */
  771 static void sym_printb_hex (u_char *p, int n)
  772 {
  773         while (n-- > 0)
  774                 printf (" %x", *p++);
  775 }
  776 
  777 /*
  778  *  Same with a label at beginning and .\n at end.
  779  */
  780 static void sym_printl_hex (char *label, u_char *p, int n)
  781 {
  782         printf ("%s", label);
  783         sym_printb_hex (p, n);
  784         printf (".\n");
  785 }
  786 
  787 /*
  788  *  Return a string for SCSI BUS mode.
  789  */
  790 static const char *sym_scsi_bus_mode(int mode)
  791 {
  792         switch(mode) {
  793         case SMODE_HVD: return "HVD";
  794         case SMODE_SE:  return "SE";
  795         case SMODE_LVD: return "LVD";
  796         }
  797         return "??";
  798 }
  799 
  800 /*
  801  *  Some poor and bogus sync table that refers to Tekram NVRAM layout.
  802  */
  803 #ifdef SYM_CONF_NVRAM_SUPPORT
  804 static const u_char Tekram_sync[16] =
  805         {25,31,37,43, 50,62,75,125, 12,15,18,21, 6,7,9,10};
  806 #endif
  807 
  808 /*
  809  *  Union of supported NVRAM formats.
  810  */
  811 struct sym_nvram {
  812         int type;
  813 #define SYM_SYMBIOS_NVRAM       (1)
  814 #define SYM_TEKRAM_NVRAM        (2)
  815 #ifdef  SYM_CONF_NVRAM_SUPPORT
  816         union {
  817                 Symbios_nvram Symbios;
  818                 Tekram_nvram Tekram;
  819         } data;
  820 #endif
  821 };
  822 
  823 /*
  824  *  This one is hopefully useless, but actually useful. :-)
  825  */
  826 #ifndef assert
  827 #define assert(expression) { \
  828         if (!(expression)) { \
  829                 (void)panic( \
  830                         "assertion \"%s\" failed: file \"%s\", line %d\n", \
  831                         #expression, \
  832                         __FILE__, __LINE__); \
  833         } \
  834 }
  835 #endif
  836 
  837 /*
  838  *  Some provision for a possible big endian mode supported by
  839  *  Symbios chips (never seen, by the way).
  840  *  For now, this stuff does not deserve any comments. :)
  841  */
  842 #define sym_offb(o)     (o)
  843 #define sym_offw(o)     (o)
  844 
  845 /*
  846  *  Some provision for support for BIG ENDIAN CPU.
  847  */
  848 #define cpu_to_scr(dw)  htole32(dw)
  849 #define scr_to_cpu(dw)  le32toh(dw)
  850 
  851 /*
  852  *  Access to the chip IO registers and on-chip RAM.
  853  *  We use the `bus space' interface under FreeBSD-4 and
  854  *  later kernel versions.
  855  */
  856 #if defined(SYM_CONF_IOMAPPED)
  857 
  858 #define INB_OFF(o)      bus_read_1(np->io_res, (o))
  859 #define INW_OFF(o)      bus_read_2(np->io_res, (o))
  860 #define INL_OFF(o)      bus_read_4(np->io_res, (o))
  861 
  862 #define OUTB_OFF(o, v)  bus_write_1(np->io_res, (o), (v))
  863 #define OUTW_OFF(o, v)  bus_write_2(np->io_res, (o), (v))
  864 #define OUTL_OFF(o, v)  bus_write_4(np->io_res, (o), (v))
  865 
  866 #else   /* Memory mapped IO */
  867 
  868 #define INB_OFF(o)      bus_read_1(np->mmio_res, (o))
  869 #define INW_OFF(o)      bus_read_2(np->mmio_res, (o))
  870 #define INL_OFF(o)      bus_read_4(np->mmio_res, (o))
  871 
  872 #define OUTB_OFF(o, v)  bus_write_1(np->mmio_res, (o), (v))
  873 #define OUTW_OFF(o, v)  bus_write_2(np->mmio_res, (o), (v))
  874 #define OUTL_OFF(o, v)  bus_write_4(np->mmio_res, (o), (v))
  875 
  876 #endif  /* SYM_CONF_IOMAPPED */
  877 
  878 #define OUTRAM_OFF(o, a, l)     \
  879         bus_write_region_1(np->ram_res, (o), (a), (l))
  880 
  881 /*
  882  *  Common definitions for both bus space and legacy IO methods.
  883  */
  884 #define INB(r)          INB_OFF(offsetof(struct sym_reg,r))
  885 #define INW(r)          INW_OFF(offsetof(struct sym_reg,r))
  886 #define INL(r)          INL_OFF(offsetof(struct sym_reg,r))
  887 
  888 #define OUTB(r, v)      OUTB_OFF(offsetof(struct sym_reg,r), (v))
  889 #define OUTW(r, v)      OUTW_OFF(offsetof(struct sym_reg,r), (v))
  890 #define OUTL(r, v)      OUTL_OFF(offsetof(struct sym_reg,r), (v))
  891 
  892 #define OUTONB(r, m)    OUTB(r, INB(r) | (m))
  893 #define OUTOFFB(r, m)   OUTB(r, INB(r) & ~(m))
  894 #define OUTONW(r, m)    OUTW(r, INW(r) | (m))
  895 #define OUTOFFW(r, m)   OUTW(r, INW(r) & ~(m))
  896 #define OUTONL(r, m)    OUTL(r, INL(r) | (m))
  897 #define OUTOFFL(r, m)   OUTL(r, INL(r) & ~(m))
  898 
  899 /*
  900  *  We normally want the chip to have a consistent view
  901  *  of driver internal data structures when we restart it.
  902  *  Thus these macros.
  903  */
  904 #define OUTL_DSP(v)                             \
  905         do {                                    \
  906                 MEMORY_BARRIER();               \
  907                 OUTL (nc_dsp, (v));             \
  908         } while (0)
  909 
  910 #define OUTONB_STD()                            \
  911         do {                                    \
  912                 MEMORY_BARRIER();               \
  913                 OUTONB (nc_dcntl, (STD|NOCOM)); \
  914         } while (0)
  915 
  916 /*
  917  *  Command control block states.
  918  */
  919 #define HS_IDLE         (0)
  920 #define HS_BUSY         (1)
  921 #define HS_NEGOTIATE    (2)     /* sync/wide data transfer*/
  922 #define HS_DISCONNECT   (3)     /* Disconnected by target */
  923 #define HS_WAIT         (4)     /* waiting for resource   */
  924 
  925 #define HS_DONEMASK     (0x80)
  926 #define HS_COMPLETE     (4|HS_DONEMASK)
  927 #define HS_SEL_TIMEOUT  (5|HS_DONEMASK) /* Selection timeout      */
  928 #define HS_UNEXPECTED   (6|HS_DONEMASK) /* Unexpected disconnect  */
  929 #define HS_COMP_ERR     (7|HS_DONEMASK) /* Completed with error   */
  930 
  931 /*
  932  *  Software Interrupt Codes
  933  */
  934 #define SIR_BAD_SCSI_STATUS     (1)
  935 #define SIR_SEL_ATN_NO_MSG_OUT  (2)
  936 #define SIR_MSG_RECEIVED        (3)
  937 #define SIR_MSG_WEIRD           (4)
  938 #define SIR_NEGO_FAILED         (5)
  939 #define SIR_NEGO_PROTO          (6)
  940 #define SIR_SCRIPT_STOPPED      (7)
  941 #define SIR_REJECT_TO_SEND      (8)
  942 #define SIR_SWIDE_OVERRUN       (9)
  943 #define SIR_SODL_UNDERRUN       (10)
  944 #define SIR_RESEL_NO_MSG_IN     (11)
  945 #define SIR_RESEL_NO_IDENTIFY   (12)
  946 #define SIR_RESEL_BAD_LUN       (13)
  947 #define SIR_TARGET_SELECTED     (14)
  948 #define SIR_RESEL_BAD_I_T_L     (15)
  949 #define SIR_RESEL_BAD_I_T_L_Q   (16)
  950 #define SIR_ABORT_SENT          (17)
  951 #define SIR_RESEL_ABORTED       (18)
  952 #define SIR_MSG_OUT_DONE        (19)
  953 #define SIR_COMPLETE_ERROR      (20)
  954 #define SIR_DATA_OVERRUN        (21)
  955 #define SIR_BAD_PHASE           (22)
  956 #define SIR_MAX                 (22)
  957 
  958 /*
  959  *  Extended error bit codes.
  960  *  xerr_status field of struct sym_ccb.
  961  */
  962 #define XE_EXTRA_DATA   (1)     /* unexpected data phase         */
  963 #define XE_BAD_PHASE    (1<<1)  /* illegal phase (4/5)           */
  964 #define XE_PARITY_ERR   (1<<2)  /* unrecovered SCSI parity error */
  965 #define XE_SODL_UNRUN   (1<<3)  /* ODD transfer in DATA OUT phase */
  966 #define XE_SWIDE_OVRUN  (1<<4)  /* ODD transfer in DATA IN phase */
  967 
  968 /*
  969  *  Negotiation status.
  970  *  nego_status field of struct sym_ccb.
  971  */
  972 #define NS_SYNC         (1)
  973 #define NS_WIDE         (2)
  974 #define NS_PPR          (3)
  975 
  976 /*
  977  *  A CCB hashed table is used to retrieve CCB address
  978  *  from DSA value.
  979  */
  980 #define CCB_HASH_SHIFT          8
  981 #define CCB_HASH_SIZE           (1UL << CCB_HASH_SHIFT)
  982 #define CCB_HASH_MASK           (CCB_HASH_SIZE-1)
  983 #define CCB_HASH_CODE(dsa)      (((dsa) >> 9) & CCB_HASH_MASK)
  984 
  985 /*
  986  *  Device flags.
  987  */
  988 #define SYM_DISC_ENABLED        (1)
  989 #define SYM_TAGS_ENABLED        (1<<1)
  990 #define SYM_SCAN_BOOT_DISABLED  (1<<2)
  991 #define SYM_SCAN_LUNS_DISABLED  (1<<3)
  992 
  993 /*
  994  *  Host adapter miscellaneous flags.
  995  */
  996 #define SYM_AVOID_BUS_RESET     (1)
  997 #define SYM_SCAN_TARGETS_HILO   (1<<1)
  998 
  999 /*
 1000  *  Device quirks.
 1001  *  Some devices, for example the CHEETAH 2 LVD, disconnects without
 1002  *  saving the DATA POINTER then reselects and terminates the IO.
 1003  *  On reselection, the automatic RESTORE DATA POINTER makes the
 1004  *  CURRENT DATA POINTER not point at the end of the IO.
 1005  *  This behaviour just breaks our calculation of the residual.
 1006  *  For now, we just force an AUTO SAVE on disconnection and will
 1007  *  fix that in a further driver version.
 1008  */
 1009 #define SYM_QUIRK_AUTOSAVE 1
 1010 
 1011 /*
 1012  *  Misc.
 1013  */
 1014 #define SYM_LOCK()              mtx_lock(&np->mtx)
 1015 #define SYM_LOCK_ASSERT(_what)  mtx_assert(&np->mtx, (_what))
 1016 #define SYM_LOCK_DESTROY()      mtx_destroy(&np->mtx)
 1017 #define SYM_LOCK_INIT()         mtx_init(&np->mtx, "sym_lock", NULL, MTX_DEF)
 1018 #define SYM_LOCK_INITIALIZED()  mtx_initialized(&np->mtx)
 1019 #define SYM_UNLOCK()            mtx_unlock(&np->mtx)
 1020 
 1021 #define SYM_SNOOP_TIMEOUT (10000000)
 1022 #define SYM_PCI_IO      PCIR_BAR(0)
 1023 #define SYM_PCI_MMIO    PCIR_BAR(1)
 1024 #define SYM_PCI_RAM     PCIR_BAR(2)
 1025 #define SYM_PCI_RAM64   PCIR_BAR(3)
 1026 
 1027 /*
 1028  *  Back-pointer from the CAM CCB to our data structures.
 1029  */
 1030 #define sym_hcb_ptr     spriv_ptr0
 1031 /* #define sym_ccb_ptr  spriv_ptr1 */
 1032 
 1033 /*
 1034  *  We mostly have to deal with pointers.
 1035  *  Thus these typedef's.
 1036  */
 1037 typedef struct sym_tcb *tcb_p;
 1038 typedef struct sym_lcb *lcb_p;
 1039 typedef struct sym_ccb *ccb_p;
 1040 typedef struct sym_hcb *hcb_p;
 1041 
 1042 /*
 1043  *  Gather negotiable parameters value
 1044  */
 1045 struct sym_trans {
 1046         u8 scsi_version;
 1047         u8 spi_version;
 1048         u8 period;
 1049         u8 offset;
 1050         u8 width;
 1051         u8 options;     /* PPR options */
 1052 };
 1053 
 1054 struct sym_tinfo {
 1055         struct sym_trans current;
 1056         struct sym_trans goal;
 1057         struct sym_trans user;
 1058 };
 1059 
 1060 #define BUS_8_BIT       MSG_EXT_WDTR_BUS_8_BIT
 1061 #define BUS_16_BIT      MSG_EXT_WDTR_BUS_16_BIT
 1062 
 1063 /*
 1064  *  Global TCB HEADER.
 1065  *
 1066  *  Due to lack of indirect addressing on earlier NCR chips,
 1067  *  this substructure is copied from the TCB to a global
 1068  *  address after selection.
 1069  *  For SYMBIOS chips that support LOAD/STORE this copy is
 1070  *  not needed and thus not performed.
 1071  */
 1072 struct sym_tcbh {
 1073         /*
 1074          *  Scripts bus addresses of LUN table accessed from scripts.
 1075          *  LUN #0 is a special case, since multi-lun devices are rare,
 1076          *  and we we want to speed-up the general case and not waste
 1077          *  resources.
 1078          */
 1079         u32     luntbl_sa;      /* bus address of this table    */
 1080         u32     lun0_sa;        /* bus address of LCB #0        */
 1081         /*
 1082          *  Actual SYNC/WIDE IO registers value for this target.
 1083          *  'sval', 'wval' and 'uval' are read from SCRIPTS and
 1084          *  so have alignment constraints.
 1085          */
 1086 /**/   u_char  uval;           /* -> SCNTL4 register           */
 1087 /*1*/   u_char  sval;           /* -> SXFER  io register        */
 1088 /*2*/   u_char  filler1;
 1089 /*3*/   u_char  wval;           /* -> SCNTL3 io register        */
 1090 };
 1091 
 1092 /*
 1093  *  Target Control Block
 1094  */
 1095 struct sym_tcb {
 1096         /*
 1097          *  TCB header.
 1098          *  Assumed at offset 0.
 1099          */
 1100 /**/   struct sym_tcbh head;
 1101 
 1102         /*
 1103          *  LUN table used by the SCRIPTS processor.
 1104          *  An array of bus addresses is used on reselection.
 1105          */
 1106         u32     *luntbl;        /* LCBs bus address table       */
 1107 
 1108         /*
 1109          *  LUN table used by the C code.
 1110          */
 1111         lcb_p   lun0p;          /* LCB of LUN #0 (usual case)   */
 1112 #if SYM_CONF_MAX_LUN > 1
 1113         lcb_p   *lunmp;         /* Other LCBs [1..MAX_LUN]      */
 1114 #endif
 1115 
 1116         /*
 1117          *  Bitmap that tells about LUNs that succeeded at least
 1118          *  1 IO and therefore assumed to be a real device.
 1119          *  Avoid useless allocation of the LCB structure.
 1120          */
 1121         u32     lun_map[(SYM_CONF_MAX_LUN+31)/32];
 1122 
 1123         /*
 1124          *  Bitmap that tells about LUNs that haven't yet an LCB
 1125          *  allocated (not discovered or LCB allocation failed).
 1126          */
 1127         u32     busy0_map[(SYM_CONF_MAX_LUN+31)/32];
 1128 
 1129         /*
 1130          *  Transfer capabilities (SIP)
 1131          */
 1132         struct sym_tinfo tinfo;
 1133 
 1134         /*
 1135          * Keep track of the CCB used for the negotiation in order
 1136          * to ensure that only 1 negotiation is queued at a time.
 1137          */
 1138         ccb_p   nego_cp;        /* CCB used for the nego                */
 1139 
 1140         /*
 1141          *  Set when we want to reset the device.
 1142          */
 1143         u_char  to_reset;
 1144 
 1145         /*
 1146          *  Other user settable limits and options.
 1147          *  These limits are read from the NVRAM if present.
 1148          */
 1149         u_char  usrflags;
 1150         u_short usrtags;
 1151 };
 1152 
 1153 /*
 1154  *  Assert some alignments required by the chip.
 1155  */
 1156 CTASSERT(((offsetof(struct sym_reg, nc_sxfer) ^
 1157     offsetof(struct sym_tcb, head.sval)) &3) == 0);
 1158 CTASSERT(((offsetof(struct sym_reg, nc_scntl3) ^
 1159     offsetof(struct sym_tcb, head.wval)) &3) == 0);
 1160 
 1161 /*
 1162  *  Global LCB HEADER.
 1163  *
 1164  *  Due to lack of indirect addressing on earlier NCR chips,
 1165  *  this substructure is copied from the LCB to a global
 1166  *  address after selection.
 1167  *  For SYMBIOS chips that support LOAD/STORE this copy is
 1168  *  not needed and thus not performed.
 1169  */
 1170 struct sym_lcbh {
 1171         /*
 1172          *  SCRIPTS address jumped by SCRIPTS on reselection.
 1173          *  For not probed logical units, this address points to
 1174          *  SCRIPTS that deal with bad LU handling (must be at
 1175          *  offset zero of the LCB for that reason).
 1176          */
 1177 /**/   u32     resel_sa;
 1178 
 1179         /*
 1180          *  Task (bus address of a CCB) read from SCRIPTS that points
 1181          *  to the unique ITL nexus allowed to be disconnected.
 1182          */
 1183         u32     itl_task_sa;
 1184 
 1185         /*
 1186          *  Task table bus address (read from SCRIPTS).
 1187          */
 1188         u32     itlq_tbl_sa;
 1189 };
 1190 
 1191 /*
 1192  *  Logical Unit Control Block
 1193  */
 1194 struct sym_lcb {
 1195         /*
 1196          *  TCB header.
 1197          *  Assumed at offset 0.
 1198          */
 1199 /**/   struct sym_lcbh head;
 1200 
 1201         /*
 1202          *  Task table read from SCRIPTS that contains pointers to
 1203          *  ITLQ nexuses. The bus address read from SCRIPTS is
 1204          *  inside the header.
 1205          */
 1206         u32     *itlq_tbl;      /* Kernel virtual address       */
 1207 
 1208         /*
 1209          *  Busy CCBs management.
 1210          */
 1211         u_short busy_itlq;      /* Number of busy tagged CCBs   */
 1212         u_short busy_itl;       /* Number of busy untagged CCBs */
 1213 
 1214         /*
 1215          *  Circular tag allocation buffer.
 1216          */
 1217         u_short ia_tag;         /* Tag allocation index         */
 1218         u_short if_tag;         /* Tag release index            */
 1219         u_char  *cb_tags;       /* Circular tags buffer         */
 1220 
 1221         /*
 1222          *  Set when we want to clear all tasks.
 1223          */
 1224         u_char to_clear;
 1225 
 1226         /*
 1227          *  Capabilities.
 1228          */
 1229         u_char  user_flags;
 1230         u_char  current_flags;
 1231 };
 1232 
 1233 /*
 1234  *  Action from SCRIPTS on a task.
 1235  *  Is part of the CCB, but is also used separately to plug
 1236  *  error handling action to perform from SCRIPTS.
 1237  */
 1238 struct sym_actscr {
 1239         u32     start;          /* Jumped by SCRIPTS after selection    */
 1240         u32     restart;        /* Jumped by SCRIPTS on relection       */
 1241 };
 1242 
 1243 /*
 1244  *  Phase mismatch context.
 1245  *
 1246  *  It is part of the CCB and is used as parameters for the
 1247  *  DATA pointer. We need two contexts to handle correctly the
 1248  *  SAVED DATA POINTER.
 1249  */
 1250 struct sym_pmc {
 1251         struct  sym_tblmove sg; /* Updated interrupted SG block */
 1252         u32     ret;            /* SCRIPT return address        */
 1253 };
 1254 
 1255 /*
 1256  *  LUN control block lookup.
 1257  *  We use a direct pointer for LUN #0, and a table of
 1258  *  pointers which is only allocated for devices that support
 1259  *  LUN(s) > 0.
 1260  */
 1261 #if SYM_CONF_MAX_LUN <= 1
 1262 #define sym_lp(tp, lun) (!lun) ? (tp)->lun0p : 0
 1263 #else
 1264 #define sym_lp(tp, lun) \
 1265         (!lun) ? (tp)->lun0p : (tp)->lunmp ? (tp)->lunmp[(lun)] : 0
 1266 #endif
 1267 
 1268 /*
 1269  *  Status are used by the host and the script processor.
 1270  *
 1271  *  The last four bytes (status[4]) are copied to the
 1272  *  scratchb register (declared as scr0..scr3) just after the
 1273  *  select/reselect, and copied back just after disconnecting.
 1274  *  Inside the script the XX_REG are used.
 1275  */
 1276 
 1277 /*
 1278  *  Last four bytes (script)
 1279  */
 1280 #define  QU_REG scr0
 1281 #define  HS_REG scr1
 1282 #define  HS_PRT nc_scr1
 1283 #define  SS_REG scr2
 1284 #define  SS_PRT nc_scr2
 1285 #define  HF_REG scr3
 1286 #define  HF_PRT nc_scr3
 1287 
 1288 /*
 1289  *  Last four bytes (host)
 1290  */
 1291 #define  actualquirks  phys.head.status[0]
 1292 #define  host_status   phys.head.status[1]
 1293 #define  ssss_status   phys.head.status[2]
 1294 #define  host_flags    phys.head.status[3]
 1295 
 1296 /*
 1297  *  Host flags
 1298  */
 1299 #define HF_IN_PM0       1u
 1300 #define HF_IN_PM1       (1u<<1)
 1301 #define HF_ACT_PM       (1u<<2)
 1302 #define HF_DP_SAVED     (1u<<3)
 1303 #define HF_SENSE        (1u<<4)
 1304 #define HF_EXT_ERR      (1u<<5)
 1305 #define HF_DATA_IN      (1u<<6)
 1306 #ifdef SYM_CONF_IARB_SUPPORT
 1307 #define HF_HINT_IARB    (1u<<7)
 1308 #endif
 1309 
 1310 /*
 1311  *  Global CCB HEADER.
 1312  *
 1313  *  Due to lack of indirect addressing on earlier NCR chips,
 1314  *  this substructure is copied from the ccb to a global
 1315  *  address after selection (or reselection) and copied back
 1316  *  before disconnect.
 1317  *  For SYMBIOS chips that support LOAD/STORE this copy is
 1318  *  not needed and thus not performed.
 1319  */
 1320 struct sym_ccbh {
 1321         /*
 1322          *  Start and restart SCRIPTS addresses (must be at 0).
 1323          */
 1324 /**/   struct sym_actscr go;
 1325 
 1326         /*
 1327          *  SCRIPTS jump address that deal with data pointers.
 1328          *  'savep' points to the position in the script responsible
 1329          *  for the actual transfer of data.
 1330          *  It's written on reception of a SAVE_DATA_POINTER message.
 1331          */
 1332         u32     savep;          /* Jump address to saved data pointer   */
 1333         u32     lastp;          /* SCRIPTS address at end of data       */
 1334         u32     goalp;          /* Not accessed for now from SCRIPTS    */
 1335 
 1336         /*
 1337          *  Status fields.
 1338          */
 1339         u8      status[4];
 1340 };
 1341 
 1342 /*
 1343  *  Data Structure Block
 1344  *
 1345  *  During execution of a ccb by the script processor, the
 1346  *  DSA (data structure address) register points to this
 1347  *  substructure of the ccb.
 1348  */
 1349 struct sym_dsb {
 1350         /*
 1351          *  CCB header.
 1352          *  Also assumed at offset 0 of the sym_ccb structure.
 1353          */
 1354 /**/   struct sym_ccbh head;
 1355 
 1356         /*
 1357          *  Phase mismatch contexts.
 1358          *  We need two to handle correctly the SAVED DATA POINTER.
 1359          *  MUST BOTH BE AT OFFSET < 256, due to using 8 bit arithmetic
 1360          *  for address calculation from SCRIPTS.
 1361          */
 1362         struct sym_pmc pm0;
 1363         struct sym_pmc pm1;
 1364 
 1365         /*
 1366          *  Table data for Script
 1367          */
 1368         struct sym_tblsel  select;
 1369         struct sym_tblmove smsg;
 1370         struct sym_tblmove smsg_ext;
 1371         struct sym_tblmove cmd;
 1372         struct sym_tblmove sense;
 1373         struct sym_tblmove wresid;
 1374         struct sym_tblmove data [SYM_CONF_MAX_SG];
 1375 };
 1376 
 1377 /*
 1378  *  Our Command Control Block
 1379  */
 1380 struct sym_ccb {
 1381         /*
 1382          *  This is the data structure which is pointed by the DSA
 1383          *  register when it is executed by the script processor.
 1384          *  It must be the first entry.
 1385          */
 1386         struct sym_dsb phys;
 1387 
 1388         /*
 1389          *  Pointer to CAM ccb and related stuff.
 1390          */
 1391         struct callout ch;      /* callout handle               */
 1392         union ccb *cam_ccb;     /* CAM scsiio ccb               */
 1393         u8      cdb_buf[16];    /* Copy of CDB                  */
 1394         u8      *sns_bbuf;      /* Bounce buffer for sense data */
 1395 #define SYM_SNS_BBUF_LEN        sizeof(struct scsi_sense_data)
 1396         int     data_len;       /* Total data length            */
 1397         int     segments;       /* Number of SG segments        */
 1398 
 1399         /*
 1400          *  Miscellaneous status'.
 1401          */
 1402         u_char  nego_status;    /* Negotiation status           */
 1403         u_char  xerr_status;    /* Extended error flags         */
 1404         u32     extra_bytes;    /* Extraneous bytes transferred */
 1405 
 1406         /*
 1407          *  Message areas.
 1408          *  We prepare a message to be sent after selection.
 1409          *  We may use a second one if the command is rescheduled
 1410          *  due to CHECK_CONDITION or COMMAND TERMINATED.
 1411          *  Contents are IDENTIFY and SIMPLE_TAG.
 1412          *  While negotiating sync or wide transfer,
 1413          *  a SDTR or WDTR message is appended.
 1414          */
 1415         u_char  scsi_smsg [12];
 1416         u_char  scsi_smsg2[12];
 1417 
 1418         /*
 1419          *  Auto request sense related fields.
 1420          */
 1421         u_char  sensecmd[6];    /* Request Sense command        */
 1422         u_char  sv_scsi_status; /* Saved SCSI status            */
 1423         u_char  sv_xerr_status; /* Saved extended status        */
 1424         int     sv_resid;       /* Saved residual               */
 1425 
 1426         /*
 1427          *  Map for the DMA of user data.
 1428          */
 1429         void            *arg;   /* Argument for some callback   */
 1430         bus_dmamap_t    dmamap; /* DMA map for user data        */
 1431         u_char          dmamapped;
 1432 #define SYM_DMA_NONE    0
 1433 #define SYM_DMA_READ    1
 1434 #define SYM_DMA_WRITE   2
 1435         /*
 1436          *  Other fields.
 1437          */
 1438         u32     ccb_ba;         /* BUS address of this CCB      */
 1439         u_short tag;            /* Tag for this transfer        */
 1440                                 /*  NO_TAG means no tag         */
 1441         u_char  target;
 1442         u_char  lun;
 1443         ccb_p   link_ccbh;      /* Host adapter CCB hash chain  */
 1444         SYM_QUEHEAD
 1445                 link_ccbq;      /* Link to free/busy CCB queue  */
 1446         u32     startp;         /* Initial data pointer         */
 1447         int     ext_sg;         /* Extreme data pointer, used   */
 1448         int     ext_ofs;        /*  to calculate the residual.  */
 1449         u_char  to_abort;       /* Want this IO to be aborted   */
 1450 };
 1451 
 1452 #define CCB_BA(cp,lbl)  (cp->ccb_ba + offsetof(struct sym_ccb, lbl))
 1453 
 1454 /*
 1455  *  Host Control Block
 1456  */
 1457 struct sym_hcb {
 1458         struct mtx      mtx;
 1459 
 1460         /*
 1461          *  Global headers.
 1462          *  Due to poorness of addressing capabilities, earlier
 1463          *  chips (810, 815, 825) copy part of the data structures
 1464          *  (CCB, TCB and LCB) in fixed areas.
 1465          */
 1466 #ifdef  SYM_CONF_GENERIC_SUPPORT
 1467         struct sym_ccbh ccb_head;
 1468         struct sym_tcbh tcb_head;
 1469         struct sym_lcbh lcb_head;
 1470 #endif
 1471         /*
 1472          *  Idle task and invalid task actions and
 1473          *  their bus addresses.
 1474          */
 1475         struct sym_actscr idletask, notask, bad_itl, bad_itlq;
 1476         vm_offset_t idletask_ba, notask_ba, bad_itl_ba, bad_itlq_ba;
 1477 
 1478         /*
 1479          *  Dummy lun table to protect us against target
 1480          *  returning bad lun number on reselection.
 1481          */
 1482         u32     *badluntbl;     /* Table physical address       */
 1483         u32     badlun_sa;      /* SCRIPT handler BUS address   */
 1484 
 1485         /*
 1486          *  Bus address of this host control block.
 1487          */
 1488         u32     hcb_ba;
 1489 
 1490         /*
 1491          *  Bit 32-63 of the on-chip RAM bus address in LE format.
 1492          *  The START_RAM64 script loads the MMRS and MMWS from this
 1493          *  field.
 1494          */
 1495         u32     scr_ram_seg;
 1496 
 1497         /*
 1498          *  Chip and controller indentification.
 1499          */
 1500         device_t device;
 1501 
 1502         /*
 1503          *  Initial value of some IO register bits.
 1504          *  These values are assumed to have been set by BIOS, and may
 1505          *  be used to probe adapter implementation differences.
 1506          */
 1507         u_char  sv_scntl0, sv_scntl3, sv_dmode, sv_dcntl, sv_ctest3, sv_ctest4,
 1508                 sv_ctest5, sv_gpcntl, sv_stest2, sv_stest4, sv_scntl4,
 1509                 sv_stest1;
 1510 
 1511         /*
 1512          *  Actual initial value of IO register bits used by the
 1513          *  driver. They are loaded at initialisation according to
 1514          *  features that are to be enabled/disabled.
 1515          */
 1516         u_char  rv_scntl0, rv_scntl3, rv_dmode, rv_dcntl, rv_ctest3, rv_ctest4,
 1517                 rv_ctest5, rv_stest2, rv_ccntl0, rv_ccntl1, rv_scntl4;
 1518 
 1519         /*
 1520          *  Target data.
 1521          */
 1522 #ifdef __amd64__
 1523         struct sym_tcb  *target;
 1524 #else
 1525         struct sym_tcb  target[SYM_CONF_MAX_TARGET];
 1526 #endif
 1527 
 1528         /*
 1529          *  Target control block bus address array used by the SCRIPT
 1530          *  on reselection.
 1531          */
 1532         u32             *targtbl;
 1533         u32             targtbl_ba;
 1534 
 1535         /*
 1536          *  CAM SIM information for this instance.
 1537          */
 1538         struct          cam_sim  *sim;
 1539         struct          cam_path *path;
 1540 
 1541         /*
 1542          *  Allocated hardware resources.
 1543          */
 1544         struct resource *irq_res;
 1545         struct resource *io_res;
 1546         struct resource *mmio_res;
 1547         struct resource *ram_res;
 1548         int             ram_id;
 1549         void *intr;
 1550 
 1551         /*
 1552          *  Bus stuff.
 1553          *
 1554          *  My understanding of PCI is that all agents must share the
 1555          *  same addressing range and model.
 1556          *  But some hardware architecture guys provide complex and
 1557          *  brain-deaded stuff that makes shit.
 1558          *  This driver only support PCI compliant implementations and
 1559          *  deals with part of the BUS stuff complexity only to fit O/S
 1560          *  requirements.
 1561          */
 1562 
 1563         /*
 1564          *  DMA stuff.
 1565          */
 1566         bus_dma_tag_t   bus_dmat;       /* DMA tag from parent BUS      */
 1567         bus_dma_tag_t   data_dmat;      /* DMA tag for user data        */
 1568         /*
 1569          *  BUS addresses of the chip
 1570          */
 1571         vm_offset_t     mmio_ba;        /* MMIO BUS address             */
 1572         int             mmio_ws;        /* MMIO Window size             */
 1573 
 1574         vm_offset_t     ram_ba;         /* RAM BUS address              */
 1575         int             ram_ws;         /* RAM window size              */
 1576 
 1577         /*
 1578          *  SCRIPTS virtual and physical bus addresses.
 1579          *  'script'  is loaded in the on-chip RAM if present.
 1580          *  'scripth' stays in main memory for all chips except the
 1581          *  53C895A, 53C896 and 53C1010 that provide 8K on-chip RAM.
 1582          */
 1583         u_char          *scripta0;      /* Copies of script and scripth */
 1584         u_char          *scriptb0;      /* Copies of script and scripth */
 1585         vm_offset_t     scripta_ba;     /* Actual script and scripth    */
 1586         vm_offset_t     scriptb_ba;     /*  bus addresses.              */
 1587         vm_offset_t     scriptb0_ba;
 1588         u_short         scripta_sz;     /* Actual size of script A      */
 1589         u_short         scriptb_sz;     /* Actual size of script B      */
 1590 
 1591         /*
 1592          *  Bus addresses, setup and patch methods for
 1593          *  the selected firmware.
 1594          */
 1595         struct sym_fwa_ba fwa_bas;      /* Useful SCRIPTA bus addresses */
 1596         struct sym_fwb_ba fwb_bas;      /* Useful SCRIPTB bus addresses */
 1597         void            (*fw_setup)(hcb_p np, const struct sym_fw *fw);
 1598         void            (*fw_patch)(hcb_p np);
 1599         const char      *fw_name;
 1600 
 1601         /*
 1602          *  General controller parameters and configuration.
 1603          */
 1604         u_short device_id;      /* PCI device id                */
 1605         u_char  revision_id;    /* PCI device revision id       */
 1606         u_int   features;       /* Chip features map            */
 1607         u_char  myaddr;         /* SCSI id of the adapter       */
 1608         u_char  maxburst;       /* log base 2 of dwords burst   */
 1609         u_char  maxwide;        /* Maximum transfer width       */
 1610         u_char  minsync;        /* Min sync period factor (ST)  */
 1611         u_char  maxsync;        /* Max sync period factor (ST)  */
 1612         u_char  maxoffs;        /* Max scsi offset        (ST)  */
 1613         u_char  minsync_dt;     /* Min sync period factor (DT)  */
 1614         u_char  maxsync_dt;     /* Max sync period factor (DT)  */
 1615         u_char  maxoffs_dt;     /* Max scsi offset        (DT)  */
 1616         u_char  multiplier;     /* Clock multiplier (1,2,4)     */
 1617         u_char  clock_divn;     /* Number of clock divisors     */
 1618         u32     clock_khz;      /* SCSI clock frequency in KHz  */
 1619         u32     pciclk_khz;     /* Estimated PCI clock  in KHz  */
 1620         /*
 1621          *  Start queue management.
 1622          *  It is filled up by the host processor and accessed by the
 1623          *  SCRIPTS processor in order to start SCSI commands.
 1624          */
 1625         volatile                /* Prevent code optimizations   */
 1626         u32     *squeue;        /* Start queue virtual address  */
 1627         u32     squeue_ba;      /* Start queue BUS address      */
 1628         u_short squeueput;      /* Next free slot of the queue  */
 1629         u_short actccbs;        /* Number of allocated CCBs     */
 1630 
 1631         /*
 1632          *  Command completion queue.
 1633          *  It is the same size as the start queue to avoid overflow.
 1634          */
 1635         u_short dqueueget;      /* Next position to scan        */
 1636         volatile                /* Prevent code optimizations   */
 1637         u32     *dqueue;        /* Completion (done) queue      */
 1638         u32     dqueue_ba;      /* Done queue BUS address       */
 1639 
 1640         /*
 1641          *  Miscellaneous buffers accessed by the scripts-processor.
 1642          *  They shall be DWORD aligned, because they may be read or
 1643          *  written with a script command.
 1644          */
 1645         u_char          msgout[8];      /* Buffer for MESSAGE OUT       */
 1646         u_char          msgin [8];      /* Buffer for MESSAGE IN        */
 1647         u32             lastmsg;        /* Last SCSI message sent       */
 1648         u_char          scratch;        /* Scratch for SCSI receive     */
 1649 
 1650         /*
 1651          *  Miscellaneous configuration and status parameters.
 1652          */
 1653         u_char          usrflags;       /* Miscellaneous user flags     */
 1654         u_char          scsi_mode;      /* Current SCSI BUS mode        */
 1655         u_char          verbose;        /* Verbosity for this controller*/
 1656         u32             cache;          /* Used for cache test at init. */
 1657 
 1658         /*
 1659          *  CCB lists and queue.
 1660          */
 1661         ccb_p ccbh[CCB_HASH_SIZE];      /* CCB hashed by DSA value      */
 1662         SYM_QUEHEAD     free_ccbq;      /* Queue of available CCBs      */
 1663         SYM_QUEHEAD     busy_ccbq;      /* Queue of busy CCBs           */
 1664 
 1665         /*
 1666          *  During error handling and/or recovery,
 1667          *  active CCBs that are to be completed with
 1668          *  error or requeued are moved from the busy_ccbq
 1669          *  to the comp_ccbq prior to completion.
 1670          */
 1671         SYM_QUEHEAD     comp_ccbq;
 1672 
 1673         /*
 1674          *  CAM CCB pending queue.
 1675          */
 1676         SYM_QUEHEAD     cam_ccbq;
 1677 
 1678         /*
 1679          *  IMMEDIATE ARBITRATION (IARB) control.
 1680          *
 1681          *  We keep track in 'last_cp' of the last CCB that has been
 1682          *  queued to the SCRIPTS processor and clear 'last_cp' when
 1683          *  this CCB completes. If last_cp is not zero at the moment
 1684          *  we queue a new CCB, we set a flag in 'last_cp' that is
 1685          *  used by the SCRIPTS as a hint for setting IARB.
 1686          *  We donnot set more than 'iarb_max' consecutive hints for
 1687          *  IARB in order to leave devices a chance to reselect.
 1688          *  By the way, any non zero value of 'iarb_max' is unfair. :)
 1689          */
 1690 #ifdef SYM_CONF_IARB_SUPPORT
 1691         u_short         iarb_max;       /* Max. # consecutive IARB hints*/
 1692         u_short         iarb_count;     /* Actual # of these hints      */
 1693         ccb_p           last_cp;
 1694 #endif
 1695 
 1696         /*
 1697          *  Command abort handling.
 1698          *  We need to synchronize tightly with the SCRIPTS
 1699          *  processor in order to handle things correctly.
 1700          */
 1701         u_char          abrt_msg[4];    /* Message to send buffer       */
 1702         struct sym_tblmove abrt_tbl;    /* Table for the MOV of it      */
 1703         struct sym_tblsel  abrt_sel;    /* Sync params for selection    */
 1704         u_char          istat_sem;      /* Tells the chip to stop (SEM) */
 1705 };
 1706 
 1707 #define HCB_BA(np, lbl)     (np->hcb_ba      + offsetof(struct sym_hcb, lbl))
 1708 
 1709 /*
 1710  *  Return the name of the controller.
 1711  */
 1712 static __inline const char *sym_name(hcb_p np)
 1713 {
 1714         return device_get_nameunit(np->device);
 1715 }
 1716 
 1717 /*--------------------------------------------------------------------------*/
 1718 /*------------------------------ FIRMWARES ---------------------------------*/
 1719 /*--------------------------------------------------------------------------*/
 1720 
 1721 /*
 1722  *  This stuff will be moved to a separate source file when
 1723  *  the driver will be broken into several source modules.
 1724  */
 1725 
 1726 /*
 1727  *  Macros used for all firmwares.
 1728  */
 1729 #define SYM_GEN_A(s, label)     ((short) offsetof(s, label)),
 1730 #define SYM_GEN_B(s, label)     ((short) offsetof(s, label)),
 1731 #define PADDR_A(label)          SYM_GEN_PADDR_A(struct SYM_FWA_SCR, label)
 1732 #define PADDR_B(label)          SYM_GEN_PADDR_B(struct SYM_FWB_SCR, label)
 1733 
 1734 #ifdef  SYM_CONF_GENERIC_SUPPORT
 1735 /*
 1736  *  Allocate firmware #1 script area.
 1737  */
 1738 #define SYM_FWA_SCR             sym_fw1a_scr
 1739 #define SYM_FWB_SCR             sym_fw1b_scr
 1740 #include <dev/sym/sym_fw1.h>
 1741 static const struct sym_fwa_ofs sym_fw1a_ofs = {
 1742         SYM_GEN_FW_A(struct SYM_FWA_SCR)
 1743 };
 1744 static const struct sym_fwb_ofs sym_fw1b_ofs = {
 1745         SYM_GEN_FW_B(struct SYM_FWB_SCR)
 1746 };
 1747 #undef  SYM_FWA_SCR
 1748 #undef  SYM_FWB_SCR
 1749 #endif  /* SYM_CONF_GENERIC_SUPPORT */
 1750 
 1751 /*
 1752  *  Allocate firmware #2 script area.
 1753  */
 1754 #define SYM_FWA_SCR             sym_fw2a_scr
 1755 #define SYM_FWB_SCR             sym_fw2b_scr
 1756 #include <dev/sym/sym_fw2.h>
 1757 static const struct sym_fwa_ofs sym_fw2a_ofs = {
 1758         SYM_GEN_FW_A(struct SYM_FWA_SCR)
 1759 };
 1760 static const struct sym_fwb_ofs sym_fw2b_ofs = {
 1761         SYM_GEN_FW_B(struct SYM_FWB_SCR)
 1762         SYM_GEN_B(struct SYM_FWB_SCR, start64)
 1763         SYM_GEN_B(struct SYM_FWB_SCR, pm_handle)
 1764 };
 1765 #undef  SYM_FWA_SCR
 1766 #undef  SYM_FWB_SCR
 1767 
 1768 #undef  SYM_GEN_A
 1769 #undef  SYM_GEN_B
 1770 #undef  PADDR_A
 1771 #undef  PADDR_B
 1772 
 1773 #ifdef  SYM_CONF_GENERIC_SUPPORT
 1774 /*
 1775  *  Patch routine for firmware #1.
 1776  */
 1777 static void
 1778 sym_fw1_patch(hcb_p np)
 1779 {
 1780         struct sym_fw1a_scr *scripta0;
 1781         struct sym_fw1b_scr *scriptb0;
 1782 
 1783         scripta0 = (struct sym_fw1a_scr *) np->scripta0;
 1784         scriptb0 = (struct sym_fw1b_scr *) np->scriptb0;
 1785 
 1786         /*
 1787          *  Remove LED support if not needed.
 1788          */
 1789         if (!(np->features & FE_LED0)) {
 1790                 scripta0->idle[0]       = cpu_to_scr(SCR_NO_OP);
 1791                 scripta0->reselected[0] = cpu_to_scr(SCR_NO_OP);
 1792                 scripta0->start[0]      = cpu_to_scr(SCR_NO_OP);
 1793         }
 1794 
 1795 #ifdef SYM_CONF_IARB_SUPPORT
 1796         /*
 1797          *    If user does not want to use IMMEDIATE ARBITRATION
 1798          *    when we are reselected while attempting to arbitrate,
 1799          *    patch the SCRIPTS accordingly with a SCRIPT NO_OP.
 1800          */
 1801         if (!SYM_CONF_SET_IARB_ON_ARB_LOST)
 1802                 scripta0->ungetjob[0] = cpu_to_scr(SCR_NO_OP);
 1803 #endif
 1804         /*
 1805          *  Patch some data in SCRIPTS.
 1806          *  - start and done queue initial bus address.
 1807          *  - target bus address table bus address.
 1808          */
 1809         scriptb0->startpos[0]   = cpu_to_scr(np->squeue_ba);
 1810         scriptb0->done_pos[0]   = cpu_to_scr(np->dqueue_ba);
 1811         scriptb0->targtbl[0]    = cpu_to_scr(np->targtbl_ba);
 1812 }
 1813 #endif  /* SYM_CONF_GENERIC_SUPPORT */
 1814 
 1815 /*
 1816  *  Patch routine for firmware #2.
 1817  */
 1818 static void
 1819 sym_fw2_patch(hcb_p np)
 1820 {
 1821         struct sym_fw2a_scr *scripta0;
 1822         struct sym_fw2b_scr *scriptb0;
 1823 
 1824         scripta0 = (struct sym_fw2a_scr *) np->scripta0;
 1825         scriptb0 = (struct sym_fw2b_scr *) np->scriptb0;
 1826 
 1827         /*
 1828          *  Remove LED support if not needed.
 1829          */
 1830         if (!(np->features & FE_LED0)) {
 1831                 scripta0->idle[0]       = cpu_to_scr(SCR_NO_OP);
 1832                 scripta0->reselected[0] = cpu_to_scr(SCR_NO_OP);
 1833                 scripta0->start[0]      = cpu_to_scr(SCR_NO_OP);
 1834         }
 1835 
 1836 #ifdef SYM_CONF_IARB_SUPPORT
 1837         /*
 1838          *    If user does not want to use IMMEDIATE ARBITRATION
 1839          *    when we are reselected while attempting to arbitrate,
 1840          *    patch the SCRIPTS accordingly with a SCRIPT NO_OP.
 1841          */
 1842         if (!SYM_CONF_SET_IARB_ON_ARB_LOST)
 1843                 scripta0->ungetjob[0] = cpu_to_scr(SCR_NO_OP);
 1844 #endif
 1845         /*
 1846          *  Patch some variable in SCRIPTS.
 1847          *  - start and done queue initial bus address.
 1848          *  - target bus address table bus address.
 1849          */
 1850         scriptb0->startpos[0]   = cpu_to_scr(np->squeue_ba);
 1851         scriptb0->done_pos[0]   = cpu_to_scr(np->dqueue_ba);
 1852         scriptb0->targtbl[0]    = cpu_to_scr(np->targtbl_ba);
 1853 
 1854         /*
 1855          *  Remove the load of SCNTL4 on reselection if not a C10.
 1856          */
 1857         if (!(np->features & FE_C10)) {
 1858                 scripta0->resel_scntl4[0] = cpu_to_scr(SCR_NO_OP);
 1859                 scripta0->resel_scntl4[1] = cpu_to_scr(0);
 1860         }
 1861 
 1862         /*
 1863          *  Remove a couple of work-arounds specific to C1010 if
 1864          *  they are not desirable. See `sym_fw2.h' for more details.
 1865          */
 1866         if (!(np->device_id == PCI_ID_LSI53C1010_2 &&
 1867               np->revision_id < 0x1 &&
 1868               np->pciclk_khz < 60000)) {
 1869                 scripta0->datao_phase[0] = cpu_to_scr(SCR_NO_OP);
 1870                 scripta0->datao_phase[1] = cpu_to_scr(0);
 1871         }
 1872         if (!(np->device_id == PCI_ID_LSI53C1010 &&
 1873               /* np->revision_id < 0xff */ 1)) {
 1874                 scripta0->sel_done[0] = cpu_to_scr(SCR_NO_OP);
 1875                 scripta0->sel_done[1] = cpu_to_scr(0);
 1876         }
 1877 
 1878         /*
 1879          *  Patch some other variables in SCRIPTS.
 1880          *  These ones are loaded by the SCRIPTS processor.
 1881          */
 1882         scriptb0->pm0_data_addr[0] =
 1883                 cpu_to_scr(np->scripta_ba +
 1884                            offsetof(struct sym_fw2a_scr, pm0_data));
 1885         scriptb0->pm1_data_addr[0] =
 1886                 cpu_to_scr(np->scripta_ba +
 1887                            offsetof(struct sym_fw2a_scr, pm1_data));
 1888 }
 1889 
 1890 /*
 1891  *  Fill the data area in scripts.
 1892  *  To be done for all firmwares.
 1893  */
 1894 static void
 1895 sym_fw_fill_data (u32 *in, u32 *out)
 1896 {
 1897         int     i;
 1898 
 1899         for (i = 0; i < SYM_CONF_MAX_SG; i++) {
 1900                 *in++  = SCR_CHMOV_TBL ^ SCR_DATA_IN;
 1901                 *in++  = offsetof (struct sym_dsb, data[i]);
 1902                 *out++ = SCR_CHMOV_TBL ^ SCR_DATA_OUT;
 1903                 *out++ = offsetof (struct sym_dsb, data[i]);
 1904         }
 1905 }
 1906 
 1907 /*
 1908  *  Setup useful script bus addresses.
 1909  *  To be done for all firmwares.
 1910  */
 1911 static void
 1912 sym_fw_setup_bus_addresses(hcb_p np, const struct sym_fw *fw)
 1913 {
 1914         u32 *pa;
 1915         const u_short *po;
 1916         int i;
 1917 
 1918         /*
 1919          *  Build the bus address table for script A
 1920          *  from the script A offset table.
 1921          */
 1922         po = (const u_short *) fw->a_ofs;
 1923         pa = (u32 *) &np->fwa_bas;
 1924         for (i = 0 ; i < sizeof(np->fwa_bas)/sizeof(u32) ; i++)
 1925                 pa[i] = np->scripta_ba + po[i];
 1926 
 1927         /*
 1928          *  Same for script B.
 1929          */
 1930         po = (const u_short *) fw->b_ofs;
 1931         pa = (u32 *) &np->fwb_bas;
 1932         for (i = 0 ; i < sizeof(np->fwb_bas)/sizeof(u32) ; i++)
 1933                 pa[i] = np->scriptb_ba + po[i];
 1934 }
 1935 
 1936 #ifdef  SYM_CONF_GENERIC_SUPPORT
 1937 /*
 1938  *  Setup routine for firmware #1.
 1939  */
 1940 static void
 1941 sym_fw1_setup(hcb_p np, const struct sym_fw *fw)
 1942 {
 1943         struct sym_fw1a_scr *scripta0;
 1944 
 1945         scripta0 = (struct sym_fw1a_scr *) np->scripta0;
 1946 
 1947         /*
 1948          *  Fill variable parts in scripts.
 1949          */
 1950         sym_fw_fill_data(scripta0->data_in, scripta0->data_out);
 1951 
 1952         /*
 1953          *  Setup bus addresses used from the C code..
 1954          */
 1955         sym_fw_setup_bus_addresses(np, fw);
 1956 }
 1957 #endif  /* SYM_CONF_GENERIC_SUPPORT */
 1958 
 1959 /*
 1960  *  Setup routine for firmware #2.
 1961  */
 1962 static void
 1963 sym_fw2_setup(hcb_p np, const struct sym_fw *fw)
 1964 {
 1965         struct sym_fw2a_scr *scripta0;
 1966 
 1967         scripta0 = (struct sym_fw2a_scr *) np->scripta0;
 1968 
 1969         /*
 1970          *  Fill variable parts in scripts.
 1971          */
 1972         sym_fw_fill_data(scripta0->data_in, scripta0->data_out);
 1973 
 1974         /*
 1975          *  Setup bus addresses used from the C code..
 1976          */
 1977         sym_fw_setup_bus_addresses(np, fw);
 1978 }
 1979 
 1980 /*
 1981  *  Allocate firmware descriptors.
 1982  */
 1983 #ifdef  SYM_CONF_GENERIC_SUPPORT
 1984 static const struct sym_fw sym_fw1 = SYM_FW_ENTRY(sym_fw1, "NCR-generic");
 1985 #endif  /* SYM_CONF_GENERIC_SUPPORT */
 1986 static const struct sym_fw sym_fw2 = SYM_FW_ENTRY(sym_fw2, "LOAD/STORE-based");
 1987 
 1988 /*
 1989  *  Find the most appropriate firmware for a chip.
 1990  */
 1991 static const struct sym_fw *
 1992 sym_find_firmware(const struct sym_pci_chip *chip)
 1993 {
 1994         if (chip->features & FE_LDSTR)
 1995                 return &sym_fw2;
 1996 #ifdef  SYM_CONF_GENERIC_SUPPORT
 1997         else if (!(chip->features & (FE_PFEN|FE_NOPM|FE_DAC)))
 1998                 return &sym_fw1;
 1999 #endif
 2000         else
 2001                 return NULL;
 2002 }
 2003 
 2004 /*
 2005  *  Bind a script to physical addresses.
 2006  */
 2007 static void sym_fw_bind_script (hcb_p np, u32 *start, int len)
 2008 {
 2009         u32 opcode, new, old, tmp1, tmp2;
 2010         u32 *end, *cur;
 2011         int relocs;
 2012 
 2013         cur = start;
 2014         end = start + len/4;
 2015 
 2016         while (cur < end) {
 2017 
 2018                 opcode = *cur;
 2019 
 2020                 /*
 2021                  *  If we forget to change the length
 2022                  *  in scripts, a field will be
 2023                  *  padded with 0. This is an illegal
 2024                  *  command.
 2025                  */
 2026                 if (opcode == 0) {
 2027                         printf ("%s: ERROR0 IN SCRIPT at %d.\n",
 2028                                 sym_name(np), (int) (cur-start));
 2029                         MDELAY (10000);
 2030                         ++cur;
 2031                         continue;
 2032                 }
 2033 
 2034                 /*
 2035                  *  We use the bogus value 0xf00ff00f ;-)
 2036                  *  to reserve data area in SCRIPTS.
 2037                  */
 2038                 if (opcode == SCR_DATA_ZERO) {
 2039                         *cur++ = 0;
 2040                         continue;
 2041                 }
 2042 
 2043                 if (DEBUG_FLAGS & DEBUG_SCRIPT)
 2044                         printf ("%d:  <%x>\n", (int) (cur-start),
 2045                                 (unsigned)opcode);
 2046 
 2047                 /*
 2048                  *  We don't have to decode ALL commands
 2049                  */
 2050                 switch (opcode >> 28) {
 2051                 case 0xf:
 2052                         /*
 2053                          *  LOAD / STORE DSA relative, don't relocate.
 2054                          */
 2055                         relocs = 0;
 2056                         break;
 2057                 case 0xe:
 2058                         /*
 2059                          *  LOAD / STORE absolute.
 2060                          */
 2061                         relocs = 1;
 2062                         break;
 2063                 case 0xc:
 2064                         /*
 2065                          *  COPY has TWO arguments.
 2066                          */
 2067                         relocs = 2;
 2068                         tmp1 = cur[1];
 2069                         tmp2 = cur[2];
 2070                         if ((tmp1 ^ tmp2) & 3) {
 2071                                 printf ("%s: ERROR1 IN SCRIPT at %d.\n",
 2072                                         sym_name(np), (int) (cur-start));
 2073                                 MDELAY (10000);
 2074                         }
 2075                         /*
 2076                          *  If PREFETCH feature not enabled, remove
 2077                          *  the NO FLUSH bit if present.
 2078                          */
 2079                         if ((opcode & SCR_NO_FLUSH) &&
 2080                             !(np->features & FE_PFEN)) {
 2081                                 opcode = (opcode & ~SCR_NO_FLUSH);
 2082                         }
 2083                         break;
 2084                 case 0x0:
 2085                         /*
 2086                          *  MOVE/CHMOV (absolute address)
 2087                          */
 2088                         if (!(np->features & FE_WIDE))
 2089                                 opcode = (opcode | OPC_MOVE);
 2090                         relocs = 1;
 2091                         break;
 2092                 case 0x1:
 2093                         /*
 2094                          *  MOVE/CHMOV (table indirect)
 2095                          */
 2096                         if (!(np->features & FE_WIDE))
 2097                                 opcode = (opcode | OPC_MOVE);
 2098                         relocs = 0;
 2099                         break;
 2100                 case 0x8:
 2101                         /*
 2102                          *  JUMP / CALL
 2103                          *  dont't relocate if relative :-)
 2104                          */
 2105                         if (opcode & 0x00800000)
 2106                                 relocs = 0;
 2107                         else if ((opcode & 0xf8400000) == 0x80400000)/*JUMP64*/
 2108                                 relocs = 2;
 2109                         else
 2110                                 relocs = 1;
 2111                         break;
 2112                 case 0x4:
 2113                 case 0x5:
 2114                 case 0x6:
 2115                 case 0x7:
 2116                         relocs = 1;
 2117                         break;
 2118                 default:
 2119                         relocs = 0;
 2120                         break;
 2121                 }
 2122 
 2123                 /*
 2124                  *  Scriptify:) the opcode.
 2125                  */
 2126                 *cur++ = cpu_to_scr(opcode);
 2127 
 2128                 /*
 2129                  *  If no relocation, assume 1 argument
 2130                  *  and just scriptize:) it.
 2131                  */
 2132                 if (!relocs) {
 2133                         *cur = cpu_to_scr(*cur);
 2134                         ++cur;
 2135                         continue;
 2136                 }
 2137 
 2138                 /*
 2139                  *  Otherwise performs all needed relocations.
 2140                  */
 2141                 while (relocs--) {
 2142                         old = *cur;
 2143 
 2144                         switch (old & RELOC_MASK) {
 2145                         case RELOC_REGISTER:
 2146                                 new = (old & ~RELOC_MASK) + np->mmio_ba;
 2147                                 break;
 2148                         case RELOC_LABEL_A:
 2149                                 new = (old & ~RELOC_MASK) + np->scripta_ba;
 2150                                 break;
 2151                         case RELOC_LABEL_B:
 2152                                 new = (old & ~RELOC_MASK) + np->scriptb_ba;
 2153                                 break;
 2154                         case RELOC_SOFTC:
 2155                                 new = (old & ~RELOC_MASK) + np->hcb_ba;
 2156                                 break;
 2157                         case 0:
 2158                                 /*
 2159                                  *  Don't relocate a 0 address.
 2160                                  *  They are mostly used for patched or
 2161                                  *  script self-modified areas.
 2162                                  */
 2163                                 if (old == 0) {
 2164                                         new = old;
 2165                                         break;
 2166                                 }
 2167                                 /* fall through */
 2168                         default:
 2169                                 new = 0;
 2170                                 panic("sym_fw_bind_script: "
 2171                                       "weird relocation %x\n", old);
 2172                                 break;
 2173                         }
 2174 
 2175                         *cur++ = cpu_to_scr(new);
 2176                 }
 2177         }
 2178 }
 2179 
 2180 /*---------------------------------------------------------------------------*/
 2181 /*--------------------------- END OF FIRMWARES  -----------------------------*/
 2182 /*---------------------------------------------------------------------------*/
 2183 
 2184 /*
 2185  *  Function prototypes.
 2186  */
 2187 static void sym_save_initial_setting (hcb_p np);
 2188 static int  sym_prepare_setting (hcb_p np, struct sym_nvram *nvram);
 2189 static int  sym_prepare_nego (hcb_p np, ccb_p cp, int nego, u_char *msgptr);
 2190 static void sym_put_start_queue (hcb_p np, ccb_p cp);
 2191 static void sym_chip_reset (hcb_p np);
 2192 static void sym_soft_reset (hcb_p np);
 2193 static void sym_start_reset (hcb_p np);
 2194 static int  sym_reset_scsi_bus (hcb_p np, int enab_int);
 2195 static int  sym_wakeup_done (hcb_p np);
 2196 static void sym_flush_busy_queue (hcb_p np, int cam_status);
 2197 static void sym_flush_comp_queue (hcb_p np, int cam_status);
 2198 static void sym_init (hcb_p np, int reason);
 2199 static int  sym_getsync(hcb_p np, u_char dt, u_char sfac, u_char *divp,
 2200                         u_char *fakp);
 2201 static void sym_setsync (hcb_p np, ccb_p cp, u_char ofs, u_char per,
 2202                          u_char div, u_char fak);
 2203 static void sym_setwide (hcb_p np, ccb_p cp, u_char wide);
 2204 static void sym_setpprot(hcb_p np, ccb_p cp, u_char dt, u_char ofs,
 2205                          u_char per, u_char wide, u_char div, u_char fak);
 2206 static void sym_settrans(hcb_p np, ccb_p cp, u_char dt, u_char ofs,
 2207                          u_char per, u_char wide, u_char div, u_char fak);
 2208 static void sym_log_hard_error (hcb_p np, u_short sist, u_char dstat);
 2209 static void sym_intr (void *arg);
 2210 static void sym_poll (struct cam_sim *sim);
 2211 static void sym_recover_scsi_int (hcb_p np, u_char hsts);
 2212 static void sym_int_sto (hcb_p np);
 2213 static void sym_int_udc (hcb_p np);
 2214 static void sym_int_sbmc (hcb_p np);
 2215 static void sym_int_par (hcb_p np, u_short sist);
 2216 static void sym_int_ma (hcb_p np);
 2217 static int  sym_dequeue_from_squeue(hcb_p np, int i, int target, int lun,
 2218                                     int task);
 2219 static void sym_sir_bad_scsi_status (hcb_p np, ccb_p cp);
 2220 static int  sym_clear_tasks (hcb_p np, int status, int targ, int lun, int task);
 2221 static void sym_sir_task_recovery (hcb_p np, int num);
 2222 static int  sym_evaluate_dp (hcb_p np, ccb_p cp, u32 scr, int *ofs);
 2223 static void sym_modify_dp(hcb_p np, ccb_p cp, int ofs);
 2224 static int  sym_compute_residual (hcb_p np, ccb_p cp);
 2225 static int  sym_show_msg (u_char * msg);
 2226 static void sym_print_msg (ccb_p cp, char *label, u_char *msg);
 2227 static void sym_sync_nego (hcb_p np, tcb_p tp, ccb_p cp);
 2228 static void sym_ppr_nego (hcb_p np, tcb_p tp, ccb_p cp);
 2229 static void sym_wide_nego (hcb_p np, tcb_p tp, ccb_p cp);
 2230 static void sym_nego_default (hcb_p np, tcb_p tp, ccb_p cp);
 2231 static void sym_nego_rejected (hcb_p np, tcb_p tp, ccb_p cp);
 2232 static void sym_int_sir (hcb_p np);
 2233 static void sym_free_ccb (hcb_p np, ccb_p cp);
 2234 static ccb_p sym_get_ccb (hcb_p np, u_char tn, u_char ln, u_char tag_order);
 2235 static ccb_p sym_alloc_ccb (hcb_p np);
 2236 static ccb_p sym_ccb_from_dsa (hcb_p np, u32 dsa);
 2237 static lcb_p sym_alloc_lcb (hcb_p np, u_char tn, u_char ln);
 2238 static void sym_alloc_lcb_tags (hcb_p np, u_char tn, u_char ln);
 2239 static int  sym_snooptest (hcb_p np);
 2240 static void sym_selectclock(hcb_p np, u_char scntl3);
 2241 static void sym_getclock (hcb_p np, int mult);
 2242 static int  sym_getpciclock (hcb_p np);
 2243 static void sym_complete_ok (hcb_p np, ccb_p cp);
 2244 static void sym_complete_error (hcb_p np, ccb_p cp);
 2245 static void sym_callout (void *arg);
 2246 static int  sym_abort_scsiio (hcb_p np, union ccb *ccb, int timed_out);
 2247 static void sym_reset_dev (hcb_p np, union ccb *ccb);
 2248 static void sym_action (struct cam_sim *sim, union ccb *ccb);
 2249 static int  sym_setup_cdb (hcb_p np, struct ccb_scsiio *csio, ccb_p cp);
 2250 static void sym_setup_data_and_start (hcb_p np, struct ccb_scsiio *csio,
 2251                                       ccb_p cp);
 2252 static int sym_fast_scatter_sg_physical(hcb_p np, ccb_p cp,
 2253                                         bus_dma_segment_t *psegs, int nsegs);
 2254 static int sym_scatter_sg_physical (hcb_p np, ccb_p cp,
 2255                                     bus_dma_segment_t *psegs, int nsegs);
 2256 static void sym_action2 (struct cam_sim *sim, union ccb *ccb);
 2257 static void sym_update_trans(hcb_p np, struct sym_trans *tip,
 2258                               struct ccb_trans_settings *cts);
 2259 static void sym_update_dflags(hcb_p np, u_char *flags,
 2260                               struct ccb_trans_settings *cts);
 2261 
 2262 static const struct sym_pci_chip *sym_find_pci_chip (device_t dev);
 2263 static int  sym_pci_probe (device_t dev);
 2264 static int  sym_pci_attach (device_t dev);
 2265 
 2266 static void sym_pci_free (hcb_p np);
 2267 static int  sym_cam_attach (hcb_p np);
 2268 static void sym_cam_free (hcb_p np);
 2269 
 2270 static void sym_nvram_setup_host (hcb_p np, struct sym_nvram *nvram);
 2271 static void sym_nvram_setup_target (hcb_p np, int targ, struct sym_nvram *nvp);
 2272 static int sym_read_nvram (hcb_p np, struct sym_nvram *nvp);
 2273 
 2274 /*
 2275  *  Print something which allows to retrieve the controller type,
 2276  *  unit, target, lun concerned by a kernel message.
 2277  */
 2278 static void PRINT_TARGET (hcb_p np, int target)
 2279 {
 2280         printf ("%s:%d:", sym_name(np), target);
 2281 }
 2282 
 2283 static void PRINT_LUN(hcb_p np, int target, int lun)
 2284 {
 2285         printf ("%s:%d:%d:", sym_name(np), target, lun);
 2286 }
 2287 
 2288 static void PRINT_ADDR (ccb_p cp)
 2289 {
 2290         if (cp && cp->cam_ccb)
 2291                 xpt_print_path(cp->cam_ccb->ccb_h.path);
 2292 }
 2293 
 2294 /*
 2295  *  Take into account this ccb in the freeze count.
 2296  */
 2297 static void sym_freeze_cam_ccb(union ccb *ccb)
 2298 {
 2299         if (!(ccb->ccb_h.flags & CAM_DEV_QFRZDIS)) {
 2300                 if (!(ccb->ccb_h.status & CAM_DEV_QFRZN)) {
 2301                         ccb->ccb_h.status |= CAM_DEV_QFRZN;
 2302                         xpt_freeze_devq(ccb->ccb_h.path, 1);
 2303                 }
 2304         }
 2305 }
 2306 
 2307 /*
 2308  *  Set the status field of a CAM CCB.
 2309  */
 2310 static __inline void sym_set_cam_status(union ccb *ccb, cam_status status)
 2311 {
 2312         ccb->ccb_h.status &= ~CAM_STATUS_MASK;
 2313         ccb->ccb_h.status |= status;
 2314 }
 2315 
 2316 /*
 2317  *  Get the status field of a CAM CCB.
 2318  */
 2319 static __inline int sym_get_cam_status(union ccb *ccb)
 2320 {
 2321         return ccb->ccb_h.status & CAM_STATUS_MASK;
 2322 }
 2323 
 2324 /*
 2325  *  Enqueue a CAM CCB.
 2326  */
 2327 static void sym_enqueue_cam_ccb(ccb_p cp)
 2328 {
 2329         hcb_p np;
 2330         union ccb *ccb;
 2331 
 2332         ccb = cp->cam_ccb;
 2333         np = (hcb_p) cp->arg;
 2334 
 2335         assert(!(ccb->ccb_h.status & CAM_SIM_QUEUED));
 2336         ccb->ccb_h.status = CAM_REQ_INPROG;
 2337 
 2338         callout_reset_sbt(&cp->ch, SBT_1MS * ccb->ccb_h.timeout, 0, sym_callout,
 2339             (caddr_t)ccb, 0);
 2340         ccb->ccb_h.status |= CAM_SIM_QUEUED;
 2341         ccb->ccb_h.sym_hcb_ptr = np;
 2342 
 2343         sym_insque_tail(sym_qptr(&ccb->ccb_h.sim_links), &np->cam_ccbq);
 2344 }
 2345 
 2346 /*
 2347  *  Complete a pending CAM CCB.
 2348  */
 2349 
 2350 static void sym_xpt_done(hcb_p np, union ccb *ccb, ccb_p cp)
 2351 {
 2352 
 2353         SYM_LOCK_ASSERT(MA_OWNED);
 2354 
 2355         if (ccb->ccb_h.status & CAM_SIM_QUEUED) {
 2356                 callout_stop(&cp->ch);
 2357                 sym_remque(sym_qptr(&ccb->ccb_h.sim_links));
 2358                 ccb->ccb_h.status &= ~CAM_SIM_QUEUED;
 2359                 ccb->ccb_h.sym_hcb_ptr = NULL;
 2360         }
 2361         xpt_done(ccb);
 2362 }
 2363 
 2364 static void sym_xpt_done2(hcb_p np, union ccb *ccb, int cam_status)
 2365 {
 2366 
 2367         SYM_LOCK_ASSERT(MA_OWNED);
 2368 
 2369         sym_set_cam_status(ccb, cam_status);
 2370         xpt_done(ccb);
 2371 }
 2372 
 2373 /*
 2374  *  SYMBIOS chip clock divisor table.
 2375  *
 2376  *  Divisors are multiplied by 10,000,000 in order to make
 2377  *  calculations more simple.
 2378  */
 2379 #define _5M 5000000
 2380 static const u32 div_10M[] =
 2381         {2*_5M, 3*_5M, 4*_5M, 6*_5M, 8*_5M, 12*_5M, 16*_5M};
 2382 
 2383 /*
 2384  *  SYMBIOS chips allow burst lengths of 2, 4, 8, 16, 32, 64,
 2385  *  128 transfers. All chips support at least 16 transfers
 2386  *  bursts. The 825A, 875 and 895 chips support bursts of up
 2387  *  to 128 transfers and the 895A and 896 support bursts of up
 2388  *  to 64 transfers. All other chips support up to 16
 2389  *  transfers bursts.
 2390  *
 2391  *  For PCI 32 bit data transfers each transfer is a DWORD.
 2392  *  It is a QUADWORD (8 bytes) for PCI 64 bit data transfers.
 2393  *
 2394  *  We use log base 2 (burst length) as internal code, with
 2395  *  value 0 meaning "burst disabled".
 2396  */
 2397 
 2398 /*
 2399  *  Burst length from burst code.
 2400  */
 2401 #define burst_length(bc) (!(bc))? 0 : 1 << (bc)
 2402 
 2403 /*
 2404  *  Burst code from io register bits.
 2405  */
 2406 #define burst_code(dmode, ctest4, ctest5) \
 2407         (ctest4) & 0x80? 0 : (((dmode) & 0xc0) >> 6) + ((ctest5) & 0x04) + 1
 2408 
 2409 /*
 2410  *  Set initial io register bits from burst code.
 2411  */
 2412 static __inline void sym_init_burst(hcb_p np, u_char bc)
 2413 {
 2414         np->rv_ctest4   &= ~0x80;
 2415         np->rv_dmode    &= ~(0x3 << 6);
 2416         np->rv_ctest5   &= ~0x4;
 2417 
 2418         if (!bc) {
 2419                 np->rv_ctest4   |= 0x80;
 2420         }
 2421         else {
 2422                 --bc;
 2423                 np->rv_dmode    |= ((bc & 0x3) << 6);
 2424                 np->rv_ctest5   |= (bc & 0x4);
 2425         }
 2426 }
 2427 
 2428 /*
 2429  * Print out the list of targets that have some flag disabled by user.
 2430  */
 2431 static void sym_print_targets_flag(hcb_p np, int mask, char *msg)
 2432 {
 2433         int cnt;
 2434         int i;
 2435 
 2436         for (cnt = 0, i = 0 ; i < SYM_CONF_MAX_TARGET ; i++) {
 2437                 if (i == np->myaddr)
 2438                         continue;
 2439                 if (np->target[i].usrflags & mask) {
 2440                         if (!cnt++)
 2441                                 printf("%s: %s disabled for targets",
 2442                                         sym_name(np), msg);
 2443                         printf(" %d", i);
 2444                 }
 2445         }
 2446         if (cnt)
 2447                 printf(".\n");
 2448 }
 2449 
 2450 /*
 2451  *  Save initial settings of some IO registers.
 2452  *  Assumed to have been set by BIOS.
 2453  *  We cannot reset the chip prior to reading the
 2454  *  IO registers, since informations will be lost.
 2455  *  Since the SCRIPTS processor may be running, this
 2456  *  is not safe on paper, but it seems to work quite
 2457  *  well. :)
 2458  */
 2459 static void sym_save_initial_setting (hcb_p np)
 2460 {
 2461         np->sv_scntl0   = INB(nc_scntl0) & 0x0a;
 2462         np->sv_scntl3   = INB(nc_scntl3) & 0x07;
 2463         np->sv_dmode    = INB(nc_dmode)  & 0xce;
 2464         np->sv_dcntl    = INB(nc_dcntl)  & 0xa8;
 2465         np->sv_ctest3   = INB(nc_ctest3) & 0x01;
 2466         np->sv_ctest4   = INB(nc_ctest4) & 0x80;
 2467         np->sv_gpcntl   = INB(nc_gpcntl);
 2468         np->sv_stest1   = INB(nc_stest1);
 2469         np->sv_stest2   = INB(nc_stest2) & 0x20;
 2470         np->sv_stest4   = INB(nc_stest4);
 2471         if (np->features & FE_C10) {    /* Always large DMA fifo + ultra3 */
 2472                 np->sv_scntl4   = INB(nc_scntl4);
 2473                 np->sv_ctest5   = INB(nc_ctest5) & 0x04;
 2474         }
 2475         else
 2476                 np->sv_ctest5   = INB(nc_ctest5) & 0x24;
 2477 }
 2478 
 2479 /*
 2480  *  Prepare io register values used by sym_init() according
 2481  *  to selected and supported features.
 2482  */
 2483 static int sym_prepare_setting(hcb_p np, struct sym_nvram *nvram)
 2484 {
 2485         u_char  burst_max;
 2486         u32     period;
 2487         int i;
 2488 
 2489         /*
 2490          *  Wide ?
 2491          */
 2492         np->maxwide     = (np->features & FE_WIDE)? 1 : 0;
 2493 
 2494         /*
 2495          *  Get the frequency of the chip's clock.
 2496          */
 2497         if      (np->features & FE_QUAD)
 2498                 np->multiplier  = 4;
 2499         else if (np->features & FE_DBLR)
 2500                 np->multiplier  = 2;
 2501         else
 2502                 np->multiplier  = 1;
 2503 
 2504         np->clock_khz   = (np->features & FE_CLK80)? 80000 : 40000;
 2505         np->clock_khz   *= np->multiplier;
 2506 
 2507         if (np->clock_khz != 40000)
 2508                 sym_getclock(np, np->multiplier);
 2509 
 2510         /*
 2511          * Divisor to be used for async (timer pre-scaler).
 2512          */
 2513         i = np->clock_divn - 1;
 2514         while (--i >= 0) {
 2515                 if (10ul * SYM_CONF_MIN_ASYNC * np->clock_khz > div_10M[i]) {
 2516                         ++i;
 2517                         break;
 2518                 }
 2519         }
 2520         np->rv_scntl3 = i+1;
 2521 
 2522         /*
 2523          * The C1010 uses hardwired divisors for async.
 2524          * So, we just throw away, the async. divisor.:-)
 2525          */
 2526         if (np->features & FE_C10)
 2527                 np->rv_scntl3 = 0;
 2528 
 2529         /*
 2530          * Minimum synchronous period factor supported by the chip.
 2531          * Btw, 'period' is in tenths of nanoseconds.
 2532          */
 2533         period = howmany(4 * div_10M[0], np->clock_khz);
 2534         if      (period <= 250)         np->minsync = 10;
 2535         else if (period <= 303)         np->minsync = 11;
 2536         else if (period <= 500)         np->minsync = 12;
 2537         else                            np->minsync = howmany(period, 40);
 2538 
 2539         /*
 2540          * Check against chip SCSI standard support (SCSI-2,ULTRA,ULTRA2).
 2541          */
 2542         if      (np->minsync < 25 &&
 2543                  !(np->features & (FE_ULTRA|FE_ULTRA2|FE_ULTRA3)))
 2544                 np->minsync = 25;
 2545         else if (np->minsync < 12 &&
 2546                  !(np->features & (FE_ULTRA2|FE_ULTRA3)))
 2547                 np->minsync = 12;
 2548 
 2549         /*
 2550          * Maximum synchronous period factor supported by the chip.
 2551          */
 2552         period = (11 * div_10M[np->clock_divn - 1]) / (4 * np->clock_khz);
 2553         np->maxsync = period > 2540 ? 254 : period / 10;
 2554 
 2555         /*
 2556          * If chip is a C1010, guess the sync limits in DT mode.
 2557          */
 2558         if ((np->features & (FE_C10|FE_ULTRA3)) == (FE_C10|FE_ULTRA3)) {
 2559                 if (np->clock_khz == 160000) {
 2560                         np->minsync_dt = 9;
 2561                         np->maxsync_dt = 50;
 2562                         np->maxoffs_dt = 62;
 2563                 }
 2564         }
 2565 
 2566         /*
 2567          *  64 bit addressing  (895A/896/1010) ?
 2568          */
 2569         if (np->features & FE_DAC)
 2570 #ifdef __LP64__
 2571                 np->rv_ccntl1   |= (XTIMOD | EXTIBMV);
 2572 #else
 2573                 np->rv_ccntl1   |= (DDAC);
 2574 #endif
 2575 
 2576         /*
 2577          *  Phase mismatch handled by SCRIPTS (895A/896/1010) ?
 2578          */
 2579         if (np->features & FE_NOPM)
 2580                 np->rv_ccntl0   |= (ENPMJ);
 2581 
 2582         /*
 2583          *  C1010 Errata.
 2584          *  In dual channel mode, contention occurs if internal cycles
 2585          *  are used. Disable internal cycles.
 2586          */
 2587         if (np->device_id == PCI_ID_LSI53C1010 &&
 2588             np->revision_id < 0x2)
 2589                 np->rv_ccntl0   |=  DILS;
 2590 
 2591         /*
 2592          *  Select burst length (dwords)
 2593          */
 2594         burst_max       = SYM_SETUP_BURST_ORDER;
 2595         if (burst_max == 255)
 2596                 burst_max = burst_code(np->sv_dmode, np->sv_ctest4,
 2597                                        np->sv_ctest5);
 2598         if (burst_max > 7)
 2599                 burst_max = 7;
 2600         if (burst_max > np->maxburst)
 2601                 burst_max = np->maxburst;
 2602 
 2603         /*
 2604          *  DEL 352 - 53C810 Rev x11 - Part Number 609-0392140 - ITEM 2.
 2605          *  This chip and the 860 Rev 1 may wrongly use PCI cache line
 2606          *  based transactions on LOAD/STORE instructions. So we have
 2607          *  to prevent these chips from using such PCI transactions in
 2608          *  this driver. The generic ncr driver that does not use
 2609          *  LOAD/STORE instructions does not need this work-around.
 2610          */
 2611         if ((np->device_id == PCI_ID_SYM53C810 &&
 2612              np->revision_id >= 0x10 && np->revision_id <= 0x11) ||
 2613             (np->device_id == PCI_ID_SYM53C860 &&
 2614              np->revision_id <= 0x1))
 2615                 np->features &= ~(FE_WRIE|FE_ERL|FE_ERMP);
 2616 
 2617         /*
 2618          *  Select all supported special features.
 2619          *  If we are using on-board RAM for scripts, prefetch (PFEN)
 2620          *  does not help, but burst op fetch (BOF) does.
 2621          *  Disabling PFEN makes sure BOF will be used.
 2622          */
 2623         if (np->features & FE_ERL)
 2624                 np->rv_dmode    |= ERL;         /* Enable Read Line */
 2625         if (np->features & FE_BOF)
 2626                 np->rv_dmode    |= BOF;         /* Burst Opcode Fetch */
 2627         if (np->features & FE_ERMP)
 2628                 np->rv_dmode    |= ERMP;        /* Enable Read Multiple */
 2629 #if 1
 2630         if ((np->features & FE_PFEN) && !np->ram_ba)
 2631 #else
 2632         if (np->features & FE_PFEN)
 2633 #endif
 2634                 np->rv_dcntl    |= PFEN;        /* Prefetch Enable */
 2635         if (np->features & FE_CLSE)
 2636                 np->rv_dcntl    |= CLSE;        /* Cache Line Size Enable */
 2637         if (np->features & FE_WRIE)
 2638                 np->rv_ctest3   |= WRIE;        /* Write and Invalidate */
 2639         if (np->features & FE_DFS)
 2640                 np->rv_ctest5   |= DFS;         /* Dma Fifo Size */
 2641 
 2642         /*
 2643          *  Select some other
 2644          */
 2645         if (SYM_SETUP_PCI_PARITY)
 2646                 np->rv_ctest4   |= MPEE; /* Master parity checking */
 2647         if (SYM_SETUP_SCSI_PARITY)
 2648                 np->rv_scntl0   |= 0x0a; /*  full arb., ena parity, par->ATN  */
 2649 
 2650         /*
 2651          *  Get parity checking, host ID and verbose mode from NVRAM
 2652          */
 2653         np->myaddr = 255;
 2654         sym_nvram_setup_host (np, nvram);
 2655 #ifdef __sparc64__
 2656         np->myaddr = OF_getscsinitid(np->device);
 2657 #endif
 2658 
 2659         /*
 2660          *  Get SCSI addr of host adapter (set by bios?).
 2661          */
 2662         if (np->myaddr == 255) {
 2663                 np->myaddr = INB(nc_scid) & 0x07;
 2664                 if (!np->myaddr)
 2665                         np->myaddr = SYM_SETUP_HOST_ID;
 2666         }
 2667 
 2668         /*
 2669          *  Prepare initial io register bits for burst length
 2670          */
 2671         sym_init_burst(np, burst_max);
 2672 
 2673         /*
 2674          *  Set SCSI BUS mode.
 2675          *  - LVD capable chips (895/895A/896/1010) report the
 2676          *    current BUS mode through the STEST4 IO register.
 2677          *  - For previous generation chips (825/825A/875),
 2678          *    user has to tell us how to check against HVD,
 2679          *    since a 100% safe algorithm is not possible.
 2680          */
 2681         np->scsi_mode = SMODE_SE;
 2682         if (np->features & (FE_ULTRA2|FE_ULTRA3))
 2683                 np->scsi_mode = (np->sv_stest4 & SMODE);
 2684         else if (np->features & FE_DIFF) {
 2685                 if (SYM_SETUP_SCSI_DIFF == 1) {
 2686                         if (np->sv_scntl3) {
 2687                                 if (np->sv_stest2 & 0x20)
 2688                                         np->scsi_mode = SMODE_HVD;
 2689                         }
 2690                         else if (nvram->type == SYM_SYMBIOS_NVRAM) {
 2691                                 if (!(INB(nc_gpreg) & 0x08))
 2692                                         np->scsi_mode = SMODE_HVD;
 2693                         }
 2694                 }
 2695                 else if (SYM_SETUP_SCSI_DIFF == 2)
 2696                         np->scsi_mode = SMODE_HVD;
 2697         }
 2698         if (np->scsi_mode == SMODE_HVD)
 2699                 np->rv_stest2 |= 0x20;
 2700 
 2701         /*
 2702          *  Set LED support from SCRIPTS.
 2703          *  Ignore this feature for boards known to use a
 2704          *  specific GPIO wiring and for the 895A, 896
 2705          *  and 1010 that drive the LED directly.
 2706          */
 2707         if ((SYM_SETUP_SCSI_LED ||
 2708              (nvram->type == SYM_SYMBIOS_NVRAM ||
 2709               (nvram->type == SYM_TEKRAM_NVRAM &&
 2710                np->device_id == PCI_ID_SYM53C895))) &&
 2711             !(np->features & FE_LEDC) && !(np->sv_gpcntl & 0x01))
 2712                 np->features |= FE_LED0;
 2713 
 2714         /*
 2715          *  Set irq mode.
 2716          */
 2717         switch(SYM_SETUP_IRQ_MODE & 3) {
 2718         case 2:
 2719                 np->rv_dcntl    |= IRQM;
 2720                 break;
 2721         case 1:
 2722                 np->rv_dcntl    |= (np->sv_dcntl & IRQM);
 2723                 break;
 2724         default:
 2725                 break;
 2726         }
 2727 
 2728         /*
 2729          *  Configure targets according to driver setup.
 2730          *  If NVRAM present get targets setup from NVRAM.
 2731          */
 2732         for (i = 0 ; i < SYM_CONF_MAX_TARGET ; i++) {
 2733                 tcb_p tp = &np->target[i];
 2734 
 2735                 tp->tinfo.user.scsi_version = tp->tinfo.current.scsi_version= 2;
 2736                 tp->tinfo.user.spi_version  = tp->tinfo.current.spi_version = 2;
 2737                 tp->tinfo.user.period = np->minsync;
 2738                 if (np->features & FE_ULTRA3)
 2739                         tp->tinfo.user.period = np->minsync_dt;
 2740                 tp->tinfo.user.offset = np->maxoffs;
 2741                 tp->tinfo.user.width  = np->maxwide ? BUS_16_BIT : BUS_8_BIT;
 2742                 tp->usrflags |= (SYM_DISC_ENABLED | SYM_TAGS_ENABLED);
 2743                 tp->usrtags = SYM_SETUP_MAX_TAG;
 2744 
 2745                 sym_nvram_setup_target (np, i, nvram);
 2746 
 2747                 /*
 2748                  *  For now, guess PPR/DT support from the period
 2749                  *  and BUS width.
 2750                  */
 2751                 if (np->features & FE_ULTRA3) {
 2752                         if (tp->tinfo.user.period <= 9  &&
 2753                             tp->tinfo.user.width == BUS_16_BIT) {
 2754                                 tp->tinfo.user.options |= PPR_OPT_DT;
 2755                                 tp->tinfo.user.offset   = np->maxoffs_dt;
 2756                                 tp->tinfo.user.spi_version = 3;
 2757                         }
 2758                 }
 2759 
 2760                 if (!tp->usrtags)
 2761                         tp->usrflags &= ~SYM_TAGS_ENABLED;
 2762         }
 2763 
 2764         /*
 2765          *  Let user know about the settings.
 2766          */
 2767         i = nvram->type;
 2768         printf("%s: %s NVRAM, ID %d, Fast-%d, %s, %s\n", sym_name(np),
 2769                 i  == SYM_SYMBIOS_NVRAM ? "Symbios" :
 2770                 (i == SYM_TEKRAM_NVRAM  ? "Tekram" : "No"),
 2771                 np->myaddr,
 2772                 (np->features & FE_ULTRA3) ? 80 :
 2773                 (np->features & FE_ULTRA2) ? 40 :
 2774                 (np->features & FE_ULTRA)  ? 20 : 10,
 2775                 sym_scsi_bus_mode(np->scsi_mode),
 2776                 (np->rv_scntl0 & 0xa)   ? "parity checking" : "NO parity");
 2777         /*
 2778          *  Tell him more on demand.
 2779          */
 2780         if (sym_verbose) {
 2781                 printf("%s: %s IRQ line driver%s\n",
 2782                         sym_name(np),
 2783                         np->rv_dcntl & IRQM ? "totem pole" : "open drain",
 2784                         np->ram_ba ? ", using on-chip SRAM" : "");
 2785                 printf("%s: using %s firmware.\n", sym_name(np), np->fw_name);
 2786                 if (np->features & FE_NOPM)
 2787                         printf("%s: handling phase mismatch from SCRIPTS.\n",
 2788                                sym_name(np));
 2789         }
 2790         /*
 2791          *  And still more.
 2792          */
 2793         if (sym_verbose > 1) {
 2794                 printf ("%s: initial SCNTL3/DMODE/DCNTL/CTEST3/4/5 = "
 2795                         "(hex) %02x/%02x/%02x/%02x/%02x/%02x\n",
 2796                         sym_name(np), np->sv_scntl3, np->sv_dmode, np->sv_dcntl,
 2797                         np->sv_ctest3, np->sv_ctest4, np->sv_ctest5);
 2798 
 2799                 printf ("%s: final   SCNTL3/DMODE/DCNTL/CTEST3/4/5 = "
 2800                         "(hex) %02x/%02x/%02x/%02x/%02x/%02x\n",
 2801                         sym_name(np), np->rv_scntl3, np->rv_dmode, np->rv_dcntl,
 2802                         np->rv_ctest3, np->rv_ctest4, np->rv_ctest5);
 2803         }
 2804         /*
 2805          *  Let user be aware of targets that have some disable flags set.
 2806          */
 2807         sym_print_targets_flag(np, SYM_SCAN_BOOT_DISABLED, "SCAN AT BOOT");
 2808         if (sym_verbose)
 2809                 sym_print_targets_flag(np, SYM_SCAN_LUNS_DISABLED,
 2810                                        "SCAN FOR LUNS");
 2811 
 2812         return 0;
 2813 }
 2814 
 2815 /*
 2816  *  Prepare the next negotiation message if needed.
 2817  *
 2818  *  Fill in the part of message buffer that contains the
 2819  *  negotiation and the nego_status field of the CCB.
 2820  *  Returns the size of the message in bytes.
 2821  */
 2822 static int sym_prepare_nego(hcb_p np, ccb_p cp, int nego, u_char *msgptr)
 2823 {
 2824         tcb_p tp = &np->target[cp->target];
 2825         int msglen = 0;
 2826 
 2827         /*
 2828          *  Early C1010 chips need a work-around for DT
 2829          *  data transfer to work.
 2830          */
 2831         if (!(np->features & FE_U3EN))
 2832                 tp->tinfo.goal.options = 0;
 2833         /*
 2834          *  negotiate using PPR ?
 2835          */
 2836         if (tp->tinfo.goal.options & PPR_OPT_MASK)
 2837                 nego = NS_PPR;
 2838         /*
 2839          *  negotiate wide transfers ?
 2840          */
 2841         else if (tp->tinfo.current.width != tp->tinfo.goal.width)
 2842                 nego = NS_WIDE;
 2843         /*
 2844          *  negotiate synchronous transfers?
 2845          */
 2846         else if (tp->tinfo.current.period != tp->tinfo.goal.period ||
 2847                  tp->tinfo.current.offset != tp->tinfo.goal.offset)
 2848                 nego = NS_SYNC;
 2849 
 2850         switch (nego) {
 2851         case NS_SYNC:
 2852                 msgptr[msglen++] = M_EXTENDED;
 2853                 msgptr[msglen++] = 3;
 2854                 msgptr[msglen++] = M_X_SYNC_REQ;
 2855                 msgptr[msglen++] = tp->tinfo.goal.period;
 2856                 msgptr[msglen++] = tp->tinfo.goal.offset;
 2857                 break;
 2858         case NS_WIDE:
 2859                 msgptr[msglen++] = M_EXTENDED;
 2860                 msgptr[msglen++] = 2;
 2861                 msgptr[msglen++] = M_X_WIDE_REQ;
 2862                 msgptr[msglen++] = tp->tinfo.goal.width;
 2863                 break;
 2864         case NS_PPR:
 2865                 msgptr[msglen++] = M_EXTENDED;
 2866                 msgptr[msglen++] = 6;
 2867                 msgptr[msglen++] = M_X_PPR_REQ;
 2868                 msgptr[msglen++] = tp->tinfo.goal.period;
 2869                 msgptr[msglen++] = 0;
 2870                 msgptr[msglen++] = tp->tinfo.goal.offset;
 2871                 msgptr[msglen++] = tp->tinfo.goal.width;
 2872                 msgptr[msglen++] = tp->tinfo.goal.options & PPR_OPT_DT;
 2873                 break;
 2874         }
 2875 
 2876         cp->nego_status = nego;
 2877 
 2878         if (nego) {
 2879                 tp->nego_cp = cp; /* Keep track a nego will be performed */
 2880                 if (DEBUG_FLAGS & DEBUG_NEGO) {
 2881                         sym_print_msg(cp, nego == NS_SYNC ? "sync msgout" :
 2882                                           nego == NS_WIDE ? "wide msgout" :
 2883                                           "ppr msgout", msgptr);
 2884                 }
 2885         }
 2886 
 2887         return msglen;
 2888 }
 2889 
 2890 /*
 2891  *  Insert a job into the start queue.
 2892  */
 2893 static void sym_put_start_queue(hcb_p np, ccb_p cp)
 2894 {
 2895         u_short qidx;
 2896 
 2897 #ifdef SYM_CONF_IARB_SUPPORT
 2898         /*
 2899          *  If the previously queued CCB is not yet done,
 2900          *  set the IARB hint. The SCRIPTS will go with IARB
 2901          *  for this job when starting the previous one.
 2902          *  We leave devices a chance to win arbitration by
 2903          *  not using more than 'iarb_max' consecutive
 2904          *  immediate arbitrations.
 2905          */
 2906         if (np->last_cp && np->iarb_count < np->iarb_max) {
 2907                 np->last_cp->host_flags |= HF_HINT_IARB;
 2908                 ++np->iarb_count;
 2909         }
 2910         else
 2911                 np->iarb_count = 0;
 2912         np->last_cp = cp;
 2913 #endif
 2914 
 2915         /*
 2916          *  Insert first the idle task and then our job.
 2917          *  The MB should ensure proper ordering.
 2918          */
 2919         qidx = np->squeueput + 2;
 2920         if (qidx >= MAX_QUEUE*2) qidx = 0;
 2921 
 2922         np->squeue [qidx]          = cpu_to_scr(np->idletask_ba);
 2923         MEMORY_BARRIER();
 2924         np->squeue [np->squeueput] = cpu_to_scr(cp->ccb_ba);
 2925 
 2926         np->squeueput = qidx;
 2927 
 2928         if (DEBUG_FLAGS & DEBUG_QUEUE)
 2929                 printf ("%s: queuepos=%d.\n", sym_name (np), np->squeueput);
 2930 
 2931         /*
 2932          *  Script processor may be waiting for reselect.
 2933          *  Wake it up.
 2934          */
 2935         MEMORY_BARRIER();
 2936         OUTB (nc_istat, SIGP|np->istat_sem);
 2937 }
 2938 
 2939 /*
 2940  *  Soft reset the chip.
 2941  *
 2942  *  Raising SRST when the chip is running may cause
 2943  *  problems on dual function chips (see below).
 2944  *  On the other hand, LVD devices need some delay
 2945  *  to settle and report actual BUS mode in STEST4.
 2946  */
 2947 static void sym_chip_reset (hcb_p np)
 2948 {
 2949         OUTB (nc_istat, SRST);
 2950         UDELAY (10);
 2951         OUTB (nc_istat, 0);
 2952         UDELAY(2000);   /* For BUS MODE to settle */
 2953 }
 2954 
 2955 /*
 2956  *  Soft reset the chip.
 2957  *
 2958  *  Some 896 and 876 chip revisions may hang-up if we set
 2959  *  the SRST (soft reset) bit at the wrong time when SCRIPTS
 2960  *  are running.
 2961  *  So, we need to abort the current operation prior to
 2962  *  soft resetting the chip.
 2963  */
 2964 static void sym_soft_reset (hcb_p np)
 2965 {
 2966         u_char istat;
 2967         int i;
 2968 
 2969         OUTB (nc_istat, CABRT);
 2970         for (i = 1000000 ; i ; --i) {
 2971                 istat = INB (nc_istat);
 2972                 if (istat & SIP) {
 2973                         INW (nc_sist);
 2974                         continue;
 2975                 }
 2976                 if (istat & DIP) {
 2977                         OUTB (nc_istat, 0);
 2978                         INB (nc_dstat);
 2979                         break;
 2980                 }
 2981         }
 2982         if (!i)
 2983                 printf("%s: unable to abort current chip operation.\n",
 2984                         sym_name(np));
 2985         sym_chip_reset (np);
 2986 }
 2987 
 2988 /*
 2989  *  Start reset process.
 2990  *
 2991  *  The interrupt handler will reinitialize the chip.
 2992  */
 2993 static void sym_start_reset(hcb_p np)
 2994 {
 2995         (void) sym_reset_scsi_bus(np, 1);
 2996 }
 2997 
 2998 static int sym_reset_scsi_bus(hcb_p np, int enab_int)
 2999 {
 3000         u32 term;
 3001         int retv = 0;
 3002 
 3003         sym_soft_reset(np);     /* Soft reset the chip */
 3004         if (enab_int)
 3005                 OUTW (nc_sien, RST);
 3006         /*
 3007          *  Enable Tolerant, reset IRQD if present and
 3008          *  properly set IRQ mode, prior to resetting the bus.
 3009          */
 3010         OUTB (nc_stest3, TE);
 3011         OUTB (nc_dcntl, (np->rv_dcntl & IRQM));
 3012         OUTB (nc_scntl1, CRST);
 3013         UDELAY (200);
 3014 
 3015         if (!SYM_SETUP_SCSI_BUS_CHECK)
 3016                 goto out;
 3017         /*
 3018          *  Check for no terminators or SCSI bus shorts to ground.
 3019          *  Read SCSI data bus, data parity bits and control signals.
 3020          *  We are expecting RESET to be TRUE and other signals to be
 3021          *  FALSE.
 3022          */
 3023         term =  INB(nc_sstat0);
 3024         term =  ((term & 2) << 7) + ((term & 1) << 17); /* rst sdp0 */
 3025         term |= ((INB(nc_sstat2) & 0x01) << 26) |       /* sdp1     */
 3026                 ((INW(nc_sbdl) & 0xff)   << 9)  |       /* d7-0     */
 3027                 ((INW(nc_sbdl) & 0xff00) << 10) |       /* d15-8    */
 3028                 INB(nc_sbcl);   /* req ack bsy sel atn msg cd io    */
 3029 
 3030         if (!(np->features & FE_WIDE))
 3031                 term &= 0x3ffff;
 3032 
 3033         if (term != (2<<7)) {
 3034                 printf("%s: suspicious SCSI data while resetting the BUS.\n",
 3035                         sym_name(np));
 3036                 printf("%s: %sdp0,d7-0,rst,req,ack,bsy,sel,atn,msg,c/d,i/o = "
 3037                         "0x%lx, expecting 0x%lx\n",
 3038                         sym_name(np),
 3039                         (np->features & FE_WIDE) ? "dp1,d15-8," : "",
 3040                         (u_long)term, (u_long)(2<<7));
 3041                 if (SYM_SETUP_SCSI_BUS_CHECK == 1)
 3042                         retv = 1;
 3043         }
 3044 out:
 3045         OUTB (nc_scntl1, 0);
 3046         /* MDELAY(100); */
 3047         return retv;
 3048 }
 3049 
 3050 /*
 3051  *  The chip may have completed jobs. Look at the DONE QUEUE.
 3052  *
 3053  *  On architectures that may reorder LOAD/STORE operations,
 3054  *  a memory barrier may be needed after the reading of the
 3055  *  so-called `flag' and prior to dealing with the data.
 3056  */
 3057 static int sym_wakeup_done (hcb_p np)
 3058 {
 3059         ccb_p cp;
 3060         int i, n;
 3061         u32 dsa;
 3062 
 3063         SYM_LOCK_ASSERT(MA_OWNED);
 3064 
 3065         n = 0;
 3066         i = np->dqueueget;
 3067         while (1) {
 3068                 dsa = scr_to_cpu(np->dqueue[i]);
 3069                 if (!dsa)
 3070                         break;
 3071                 np->dqueue[i] = 0;
 3072                 if ((i = i+2) >= MAX_QUEUE*2)
 3073                         i = 0;
 3074 
 3075                 cp = sym_ccb_from_dsa(np, dsa);
 3076                 if (cp) {
 3077                         MEMORY_BARRIER();
 3078                         sym_complete_ok (np, cp);
 3079                         ++n;
 3080                 }
 3081                 else
 3082                         printf ("%s: bad DSA (%x) in done queue.\n",
 3083                                 sym_name(np), (u_int) dsa);
 3084         }
 3085         np->dqueueget = i;
 3086 
 3087         return n;
 3088 }
 3089 
 3090 /*
 3091  *  Complete all active CCBs with error.
 3092  *  Used on CHIP/SCSI RESET.
 3093  */
 3094 static void sym_flush_busy_queue (hcb_p np, int cam_status)
 3095 {
 3096         /*
 3097          *  Move all active CCBs to the COMP queue
 3098          *  and flush this queue.
 3099          */
 3100         sym_que_splice(&np->busy_ccbq, &np->comp_ccbq);
 3101         sym_que_init(&np->busy_ccbq);
 3102         sym_flush_comp_queue(np, cam_status);
 3103 }
 3104 
 3105 /*
 3106  *  Start chip.
 3107  *
 3108  *  'reason' means:
 3109  *     0: initialisation.
 3110  *     1: SCSI BUS RESET delivered or received.
 3111  *     2: SCSI BUS MODE changed.
 3112  */
 3113 static void sym_init (hcb_p np, int reason)
 3114 {
 3115         int     i;
 3116         u32     phys;
 3117 
 3118         SYM_LOCK_ASSERT(MA_OWNED);
 3119 
 3120         /*
 3121          *  Reset chip if asked, otherwise just clear fifos.
 3122          */
 3123         if (reason == 1)
 3124                 sym_soft_reset(np);
 3125         else {
 3126                 OUTB (nc_stest3, TE|CSF);
 3127                 OUTONB (nc_ctest3, CLF);
 3128         }
 3129 
 3130         /*
 3131          *  Clear Start Queue
 3132          */
 3133         phys = np->squeue_ba;
 3134         for (i = 0; i < MAX_QUEUE*2; i += 2) {
 3135                 np->squeue[i]   = cpu_to_scr(np->idletask_ba);
 3136                 np->squeue[i+1] = cpu_to_scr(phys + (i+2)*4);
 3137         }
 3138         np->squeue[MAX_QUEUE*2-1] = cpu_to_scr(phys);
 3139 
 3140         /*
 3141          *  Start at first entry.
 3142          */
 3143         np->squeueput = 0;
 3144 
 3145         /*
 3146          *  Clear Done Queue
 3147          */
 3148         phys = np->dqueue_ba;
 3149         for (i = 0; i < MAX_QUEUE*2; i += 2) {
 3150                 np->dqueue[i]   = 0;
 3151                 np->dqueue[i+1] = cpu_to_scr(phys + (i+2)*4);
 3152         }
 3153         np->dqueue[MAX_QUEUE*2-1] = cpu_to_scr(phys);
 3154 
 3155         /*
 3156          *  Start at first entry.
 3157          */
 3158         np->dqueueget = 0;
 3159 
 3160         /*
 3161          *  Install patches in scripts.
 3162          *  This also let point to first position the start
 3163          *  and done queue pointers used from SCRIPTS.
 3164          */
 3165         np->fw_patch(np);
 3166 
 3167         /*
 3168          *  Wakeup all pending jobs.
 3169          */
 3170         sym_flush_busy_queue(np, CAM_SCSI_BUS_RESET);
 3171 
 3172         /*
 3173          *  Init chip.
 3174          */
 3175         OUTB (nc_istat,  0x00   );      /*  Remove Reset, abort */
 3176         UDELAY (2000);  /* The 895 needs time for the bus mode to settle */
 3177 
 3178         OUTB (nc_scntl0, np->rv_scntl0 | 0xc0);
 3179                                         /*  full arb., ena parity, par->ATN  */
 3180         OUTB (nc_scntl1, 0x00);         /*  odd parity, and remove CRST!! */
 3181 
 3182         sym_selectclock(np, np->rv_scntl3);     /* Select SCSI clock */
 3183 
 3184         OUTB (nc_scid  , RRE|np->myaddr);       /* Adapter SCSI address */
 3185         OUTW (nc_respid, 1ul<<np->myaddr);      /* Id to respond to */
 3186         OUTB (nc_istat , SIGP   );              /*  Signal Process */
 3187         OUTB (nc_dmode , np->rv_dmode);         /* Burst length, dma mode */
 3188         OUTB (nc_ctest5, np->rv_ctest5);        /* Large fifo + large burst */
 3189 
 3190         OUTB (nc_dcntl , NOCOM|np->rv_dcntl);   /* Protect SFBR */
 3191         OUTB (nc_ctest3, np->rv_ctest3);        /* Write and invalidate */
 3192         OUTB (nc_ctest4, np->rv_ctest4);        /* Master parity checking */
 3193 
 3194         /* Extended Sreq/Sack filtering not supported on the C10 */
 3195         if (np->features & FE_C10)
 3196                 OUTB (nc_stest2, np->rv_stest2);
 3197         else
 3198                 OUTB (nc_stest2, EXT|np->rv_stest2);
 3199 
 3200         OUTB (nc_stest3, TE);                   /* TolerANT enable */
 3201         OUTB (nc_stime0, 0x0c);                 /* HTH disabled  STO 0.25 sec */
 3202 
 3203         /*
 3204          *  For now, disable AIP generation on C1010-66.
 3205          */
 3206         if (np->device_id == PCI_ID_LSI53C1010_2)
 3207                 OUTB (nc_aipcntl1, DISAIP);
 3208 
 3209         /*
 3210          *  C10101 Errata.
 3211          *  Errant SGE's when in narrow. Write bits 4 & 5 of
 3212          *  STEST1 register to disable SGE. We probably should do
 3213          *  that from SCRIPTS for each selection/reselection, but
 3214          *  I just don't want. :)
 3215          */
 3216         if (np->device_id == PCI_ID_LSI53C1010 &&
 3217             /* np->revision_id < 0xff */ 1)
 3218                 OUTB (nc_stest1, INB(nc_stest1) | 0x30);
 3219 
 3220         /*
 3221          *  DEL 441 - 53C876 Rev 5 - Part Number 609-0392787/2788 - ITEM 2.
 3222          *  Disable overlapped arbitration for some dual function devices,
 3223          *  regardless revision id (kind of post-chip-design feature. ;-))
 3224          */
 3225         if (np->device_id == PCI_ID_SYM53C875)
 3226                 OUTB (nc_ctest0, (1<<5));
 3227         else if (np->device_id == PCI_ID_SYM53C896)
 3228                 np->rv_ccntl0 |= DPR;
 3229 
 3230         /*
 3231          *  Write CCNTL0/CCNTL1 for chips capable of 64 bit addressing
 3232          *  and/or hardware phase mismatch, since only such chips
 3233          *  seem to support those IO registers.
 3234          */
 3235         if (np->features & (FE_DAC|FE_NOPM)) {
 3236                 OUTB (nc_ccntl0, np->rv_ccntl0);
 3237                 OUTB (nc_ccntl1, np->rv_ccntl1);
 3238         }
 3239 
 3240         /*
 3241          *  If phase mismatch handled by scripts (895A/896/1010),
 3242          *  set PM jump addresses.
 3243          */
 3244         if (np->features & FE_NOPM) {
 3245                 OUTL (nc_pmjad1, SCRIPTB_BA (np, pm_handle));
 3246                 OUTL (nc_pmjad2, SCRIPTB_BA (np, pm_handle));
 3247         }
 3248 
 3249         /*
 3250          *    Enable GPIO0 pin for writing if LED support from SCRIPTS.
 3251          *    Also set GPIO5 and clear GPIO6 if hardware LED control.
 3252          */
 3253         if (np->features & FE_LED0)
 3254                 OUTB(nc_gpcntl, INB(nc_gpcntl) & ~0x01);
 3255         else if (np->features & FE_LEDC)
 3256                 OUTB(nc_gpcntl, (INB(nc_gpcntl) & ~0x41) | 0x20);
 3257 
 3258         /*
 3259          *      enable ints
 3260          */
 3261         OUTW (nc_sien , STO|HTH|MA|SGE|UDC|RST|PAR);
 3262         OUTB (nc_dien , MDPE|BF|SSI|SIR|IID);
 3263 
 3264         /*
 3265          *  For 895/6 enable SBMC interrupt and save current SCSI bus mode.
 3266          *  Try to eat the spurious SBMC interrupt that may occur when
 3267          *  we reset the chip but not the SCSI BUS (at initialization).
 3268          */
 3269         if (np->features & (FE_ULTRA2|FE_ULTRA3)) {
 3270                 OUTONW (nc_sien, SBMC);
 3271                 if (reason == 0) {
 3272                         MDELAY(100);
 3273                         INW (nc_sist);
 3274                 }
 3275                 np->scsi_mode = INB (nc_stest4) & SMODE;
 3276         }
 3277 
 3278         /*
 3279          *  Fill in target structure.
 3280          *  Reinitialize usrsync.
 3281          *  Reinitialize usrwide.
 3282          *  Prepare sync negotiation according to actual SCSI bus mode.
 3283          */
 3284         for (i=0;i<SYM_CONF_MAX_TARGET;i++) {
 3285                 tcb_p tp = &np->target[i];
 3286 
 3287                 tp->to_reset  = 0;
 3288                 tp->head.sval = 0;
 3289                 tp->head.wval = np->rv_scntl3;
 3290                 tp->head.uval = 0;
 3291 
 3292                 tp->tinfo.current.period = 0;
 3293                 tp->tinfo.current.offset = 0;
 3294                 tp->tinfo.current.width  = BUS_8_BIT;
 3295                 tp->tinfo.current.options = 0;
 3296         }
 3297 
 3298         /*
 3299          *  Download SCSI SCRIPTS to on-chip RAM if present,
 3300          *  and start script processor.
 3301          */
 3302         if (np->ram_ba) {
 3303                 if (sym_verbose > 1)
 3304                         printf ("%s: Downloading SCSI SCRIPTS.\n",
 3305                                 sym_name(np));
 3306                 if (np->ram_ws == 8192) {
 3307                         OUTRAM_OFF(4096, np->scriptb0, np->scriptb_sz);
 3308                         OUTL (nc_mmws, np->scr_ram_seg);
 3309                         OUTL (nc_mmrs, np->scr_ram_seg);
 3310                         OUTL (nc_sfs,  np->scr_ram_seg);
 3311                         phys = SCRIPTB_BA (np, start64);
 3312                 }
 3313                 else
 3314                         phys = SCRIPTA_BA (np, init);
 3315                 OUTRAM_OFF(0, np->scripta0, np->scripta_sz);
 3316         }
 3317         else
 3318                 phys = SCRIPTA_BA (np, init);
 3319 
 3320         np->istat_sem = 0;
 3321 
 3322         OUTL (nc_dsa, np->hcb_ba);
 3323         OUTL_DSP (phys);
 3324 
 3325         /*
 3326          *  Notify the XPT about the RESET condition.
 3327          */
 3328         if (reason != 0)
 3329                 xpt_async(AC_BUS_RESET, np->path, NULL);
 3330 }
 3331 
 3332 /*
 3333  *  Get clock factor and sync divisor for a given
 3334  *  synchronous factor period.
 3335  */
 3336 static int
 3337 sym_getsync(hcb_p np, u_char dt, u_char sfac, u_char *divp, u_char *fakp)
 3338 {
 3339         u32     clk = np->clock_khz;    /* SCSI clock frequency in kHz  */
 3340         int     div = np->clock_divn;   /* Number of divisors supported */
 3341         u32     fak;                    /* Sync factor in sxfer         */
 3342         u32     per;                    /* Period in tenths of ns       */
 3343         u32     kpc;                    /* (per * clk)                  */
 3344         int     ret;
 3345 
 3346         /*
 3347          *  Compute the synchronous period in tenths of nano-seconds
 3348          */
 3349         if (dt && sfac <= 9)    per = 125;
 3350         else if (sfac <= 10)    per = 250;
 3351         else if (sfac == 11)    per = 303;
 3352         else if (sfac == 12)    per = 500;
 3353         else                    per = 40 * sfac;
 3354         ret = per;
 3355 
 3356         kpc = per * clk;
 3357         if (dt)
 3358                 kpc <<= 1;
 3359 
 3360         /*
 3361          *  For earliest C10 revision 0, we cannot use extra
 3362          *  clocks for the setting of the SCSI clocking.
 3363          *  Note that this limits the lowest sync data transfer
 3364          *  to 5 Mega-transfers per second and may result in
 3365          *  using higher clock divisors.
 3366          */
 3367 #if 1
 3368         if ((np->features & (FE_C10|FE_U3EN)) == FE_C10) {
 3369                 /*
 3370                  *  Look for the lowest clock divisor that allows an
 3371                  *  output speed not faster than the period.
 3372                  */
 3373                 while (div > 0) {
 3374                         --div;
 3375                         if (kpc > (div_10M[div] << 2)) {
 3376                                 ++div;
 3377                                 break;
 3378                         }
 3379                 }
 3380                 fak = 0;                        /* No extra clocks */
 3381                 if (div == np->clock_divn) {    /* Are we too fast ? */
 3382                         ret = -1;
 3383                 }
 3384                 *divp = div;
 3385                 *fakp = fak;
 3386                 return ret;
 3387         }
 3388 #endif
 3389 
 3390         /*
 3391          *  Look for the greatest clock divisor that allows an
 3392          *  input speed faster than the period.
 3393          */
 3394         while (div-- > 0)
 3395                 if (kpc >= (div_10M[div] << 2)) break;
 3396 
 3397         /*
 3398          *  Calculate the lowest clock factor that allows an output
 3399          *  speed not faster than the period, and the max output speed.
 3400          *  If fak >= 1 we will set both XCLKH_ST and XCLKH_DT.
 3401          *  If fak >= 2 we will also set XCLKS_ST and XCLKS_DT.
 3402          */
 3403         if (dt) {
 3404                 fak = (kpc - 1) / (div_10M[div] << 1) + 1 - 2;
 3405                 /* ret = ((2+fak)*div_10M[div])/np->clock_khz; */
 3406         }
 3407         else {
 3408                 fak = (kpc - 1) / div_10M[div] + 1 - 4;
 3409                 /* ret = ((4+fak)*div_10M[div])/np->clock_khz; */
 3410         }
 3411 
 3412         /*
 3413          *  Check against our hardware limits, or bugs :).
 3414          */
 3415         if (fak > 2)    {fak = 2; ret = -1;}
 3416 
 3417         /*
 3418          *  Compute and return sync parameters.
 3419          */
 3420         *divp = div;
 3421         *fakp = fak;
 3422 
 3423         return ret;
 3424 }
 3425 
 3426 /*
 3427  *  Tell the SCSI layer about the new transfer parameters.
 3428  */
 3429 static void
 3430 sym_xpt_async_transfer_neg(hcb_p np, int target, u_int spi_valid)
 3431 {
 3432         struct ccb_trans_settings cts;
 3433         struct cam_path *path;
 3434         int sts;
 3435         tcb_p tp = &np->target[target];
 3436 
 3437         sts = xpt_create_path(&path, NULL, cam_sim_path(np->sim), target,
 3438                               CAM_LUN_WILDCARD);
 3439         if (sts != CAM_REQ_CMP)
 3440                 return;
 3441 
 3442         bzero(&cts, sizeof(cts));
 3443 
 3444 #define cts__scsi (cts.proto_specific.scsi)
 3445 #define cts__spi  (cts.xport_specific.spi)
 3446 
 3447         cts.type      = CTS_TYPE_CURRENT_SETTINGS;
 3448         cts.protocol  = PROTO_SCSI;
 3449         cts.transport = XPORT_SPI;
 3450         cts.protocol_version  = tp->tinfo.current.scsi_version;
 3451         cts.transport_version = tp->tinfo.current.spi_version;
 3452 
 3453         cts__spi.valid = spi_valid;
 3454         if (spi_valid & CTS_SPI_VALID_SYNC_RATE)
 3455                 cts__spi.sync_period = tp->tinfo.current.period;
 3456         if (spi_valid & CTS_SPI_VALID_SYNC_OFFSET)
 3457                 cts__spi.sync_offset = tp->tinfo.current.offset;
 3458         if (spi_valid & CTS_SPI_VALID_BUS_WIDTH)
 3459                 cts__spi.bus_width   = tp->tinfo.current.width;
 3460         if (spi_valid & CTS_SPI_VALID_PPR_OPTIONS)
 3461                 cts__spi.ppr_options = tp->tinfo.current.options;
 3462 #undef cts__spi
 3463 #undef cts__scsi
 3464         xpt_setup_ccb(&cts.ccb_h, path, /*priority*/1);
 3465         xpt_async(AC_TRANSFER_NEG, path, &cts);
 3466         xpt_free_path(path);
 3467 }
 3468 
 3469 #define SYM_SPI_VALID_WDTR              \
 3470         CTS_SPI_VALID_BUS_WIDTH |       \
 3471         CTS_SPI_VALID_SYNC_RATE |       \
 3472         CTS_SPI_VALID_SYNC_OFFSET
 3473 #define SYM_SPI_VALID_SDTR              \
 3474         CTS_SPI_VALID_SYNC_RATE |       \
 3475         CTS_SPI_VALID_SYNC_OFFSET
 3476 #define SYM_SPI_VALID_PPR               \
 3477         CTS_SPI_VALID_PPR_OPTIONS |     \
 3478         CTS_SPI_VALID_BUS_WIDTH |       \
 3479         CTS_SPI_VALID_SYNC_RATE |       \
 3480         CTS_SPI_VALID_SYNC_OFFSET
 3481 
 3482 /*
 3483  *  We received a WDTR.
 3484  *  Let everything be aware of the changes.
 3485  */
 3486 static void sym_setwide(hcb_p np, ccb_p cp, u_char wide)
 3487 {
 3488         tcb_p tp = &np->target[cp->target];
 3489 
 3490         sym_settrans(np, cp, 0, 0, 0, wide, 0, 0);
 3491 
 3492         /*
 3493          *  Tell the SCSI layer about the new transfer parameters.
 3494          */
 3495         tp->tinfo.goal.width = tp->tinfo.current.width = wide;
 3496         tp->tinfo.current.offset = 0;
 3497         tp->tinfo.current.period = 0;
 3498         tp->tinfo.current.options = 0;
 3499 
 3500         sym_xpt_async_transfer_neg(np, cp->target, SYM_SPI_VALID_WDTR);
 3501 }
 3502 
 3503 /*
 3504  *  We received a SDTR.
 3505  *  Let everything be aware of the changes.
 3506  */
 3507 static void
 3508 sym_setsync(hcb_p np, ccb_p cp, u_char ofs, u_char per, u_char div, u_char fak)
 3509 {
 3510         tcb_p tp = &np->target[cp->target];
 3511         u_char wide = (cp->phys.select.sel_scntl3 & EWS) ? 1 : 0;
 3512 
 3513         sym_settrans(np, cp, 0, ofs, per, wide, div, fak);
 3514 
 3515         /*
 3516          *  Tell the SCSI layer about the new transfer parameters.
 3517          */
 3518         tp->tinfo.goal.period   = tp->tinfo.current.period  = per;
 3519         tp->tinfo.goal.offset   = tp->tinfo.current.offset  = ofs;
 3520         tp->tinfo.goal.options  = tp->tinfo.current.options = 0;
 3521 
 3522         sym_xpt_async_transfer_neg(np, cp->target, SYM_SPI_VALID_SDTR);
 3523 }
 3524 
 3525 /*
 3526  *  We received a PPR.
 3527  *  Let everything be aware of the changes.
 3528  */
 3529 static void sym_setpprot(hcb_p np, ccb_p cp, u_char dt, u_char ofs,
 3530                          u_char per, u_char wide, u_char div, u_char fak)
 3531 {
 3532         tcb_p tp = &np->target[cp->target];
 3533 
 3534         sym_settrans(np, cp, dt, ofs, per, wide, div, fak);
 3535 
 3536         /*
 3537          *  Tell the SCSI layer about the new transfer parameters.
 3538          */
 3539         tp->tinfo.goal.width    = tp->tinfo.current.width  = wide;
 3540         tp->tinfo.goal.period   = tp->tinfo.current.period = per;
 3541         tp->tinfo.goal.offset   = tp->tinfo.current.offset = ofs;
 3542         tp->tinfo.goal.options  = tp->tinfo.current.options = dt;
 3543 
 3544         sym_xpt_async_transfer_neg(np, cp->target, SYM_SPI_VALID_PPR);
 3545 }
 3546 
 3547 /*
 3548  *  Switch trans mode for current job and it's target.
 3549  */
 3550 static void sym_settrans(hcb_p np, ccb_p cp, u_char dt, u_char ofs,
 3551                          u_char per, u_char wide, u_char div, u_char fak)
 3552 {
 3553         SYM_QUEHEAD *qp;
 3554         union   ccb *ccb;
 3555         tcb_p tp;
 3556         u_char target = INB (nc_sdid) & 0x0f;
 3557         u_char sval, wval, uval;
 3558 
 3559         assert (cp);
 3560         if (!cp) return;
 3561         ccb = cp->cam_ccb;
 3562         assert (ccb);
 3563         if (!ccb) return;
 3564         assert (target == (cp->target & 0xf));
 3565         tp = &np->target[target];
 3566 
 3567         sval = tp->head.sval;
 3568         wval = tp->head.wval;
 3569         uval = tp->head.uval;
 3570 
 3571 #if 0
 3572         printf("XXXX sval=%x wval=%x uval=%x (%x)\n",
 3573                 sval, wval, uval, np->rv_scntl3);
 3574 #endif
 3575         /*
 3576          *  Set the offset.
 3577          */
 3578         if (!(np->features & FE_C10))
 3579                 sval = (sval & ~0x1f) | ofs;
 3580         else
 3581                 sval = (sval & ~0x3f) | ofs;
 3582 
 3583         /*
 3584          *  Set the sync divisor and extra clock factor.
 3585          */
 3586         if (ofs != 0) {
 3587                 wval = (wval & ~0x70) | ((div+1) << 4);
 3588                 if (!(np->features & FE_C10))
 3589                         sval = (sval & ~0xe0) | (fak << 5);
 3590                 else {
 3591                         uval = uval & ~(XCLKH_ST|XCLKH_DT|XCLKS_ST|XCLKS_DT);
 3592                         if (fak >= 1) uval |= (XCLKH_ST|XCLKH_DT);
 3593                         if (fak >= 2) uval |= (XCLKS_ST|XCLKS_DT);
 3594                 }
 3595         }
 3596 
 3597         /*
 3598          *  Set the bus width.
 3599          */
 3600         wval = wval & ~EWS;
 3601         if (wide != 0)
 3602                 wval |= EWS;
 3603 
 3604         /*
 3605          *  Set misc. ultra enable bits.
 3606          */
 3607         if (np->features & FE_C10) {
 3608                 uval = uval & ~(U3EN|AIPCKEN);
 3609                 if (dt) {
 3610                         assert(np->features & FE_U3EN);
 3611                         uval |= U3EN;
 3612                 }
 3613         }
 3614         else {
 3615                 wval = wval & ~ULTRA;
 3616                 if (per <= 12)  wval |= ULTRA;
 3617         }
 3618 
 3619         /*
 3620          *   Stop there if sync parameters are unchanged.
 3621          */
 3622         if (tp->head.sval == sval &&
 3623             tp->head.wval == wval &&
 3624             tp->head.uval == uval)
 3625                 return;
 3626         tp->head.sval = sval;
 3627         tp->head.wval = wval;
 3628         tp->head.uval = uval;
 3629 
 3630         /*
 3631          *  Disable extended Sreq/Sack filtering if per < 50.
 3632          *  Not supported on the C1010.
 3633          */
 3634         if (per < 50 && !(np->features & FE_C10))
 3635                 OUTOFFB (nc_stest2, EXT);
 3636 
 3637         /*
 3638          *  set actual value and sync_status
 3639          */
 3640         OUTB (nc_sxfer,  tp->head.sval);
 3641         OUTB (nc_scntl3, tp->head.wval);
 3642 
 3643         if (np->features & FE_C10) {
 3644                 OUTB (nc_scntl4, tp->head.uval);
 3645         }
 3646 
 3647         /*
 3648          *  patch ALL busy ccbs of this target.
 3649          */
 3650         FOR_EACH_QUEUED_ELEMENT(&np->busy_ccbq, qp) {
 3651                 cp = sym_que_entry(qp, struct sym_ccb, link_ccbq);
 3652                 if (cp->target != target)
 3653                         continue;
 3654                 cp->phys.select.sel_scntl3 = tp->head.wval;
 3655                 cp->phys.select.sel_sxfer  = tp->head.sval;
 3656                 if (np->features & FE_C10) {
 3657                         cp->phys.select.sel_scntl4 = tp->head.uval;
 3658                 }
 3659         }
 3660 }
 3661 
 3662 /*
 3663  *  log message for real hard errors
 3664  *
 3665  *  sym0 targ 0?: ERROR (ds:si) (so-si-sd) (sxfer/scntl3) @ name (dsp:dbc).
 3666  *            reg: r0 r1 r2 r3 r4 r5 r6 ..... rf.
 3667  *
 3668  *  exception register:
 3669  *      ds:     dstat
 3670  *      si:     sist
 3671  *
 3672  *  SCSI bus lines:
 3673  *      so:     control lines as driven by chip.
 3674  *      si:     control lines as seen by chip.
 3675  *      sd:     scsi data lines as seen by chip.
 3676  *
 3677  *  wide/fastmode:
 3678  *      sxfer:  (see the manual)
 3679  *      scntl3: (see the manual)
 3680  *
 3681  *  current script command:
 3682  *      dsp:    script address (relative to start of script).
 3683  *      dbc:    first word of script command.
 3684  *
 3685  *  First 24 register of the chip:
 3686  *      r0..rf
 3687  */
 3688 static void sym_log_hard_error(hcb_p np, u_short sist, u_char dstat)
 3689 {
 3690         u32     dsp;
 3691         int     script_ofs;
 3692         int     script_size;
 3693         char    *script_name;
 3694         u_char  *script_base;
 3695         int     i;
 3696 
 3697         dsp     = INL (nc_dsp);
 3698 
 3699         if      (dsp > np->scripta_ba &&
 3700                  dsp <= np->scripta_ba + np->scripta_sz) {
 3701                 script_ofs      = dsp - np->scripta_ba;
 3702                 script_size     = np->scripta_sz;
 3703                 script_base     = (u_char *) np->scripta0;
 3704                 script_name     = "scripta";
 3705         }
 3706         else if (np->scriptb_ba < dsp &&
 3707                  dsp <= np->scriptb_ba + np->scriptb_sz) {
 3708                 script_ofs      = dsp - np->scriptb_ba;
 3709                 script_size     = np->scriptb_sz;
 3710                 script_base     = (u_char *) np->scriptb0;
 3711                 script_name     = "scriptb";
 3712         } else {
 3713                 script_ofs      = dsp;
 3714                 script_size     = 0;
 3715                 script_base     = NULL;
 3716                 script_name     = "mem";
 3717         }
 3718 
 3719         printf ("%s:%d: ERROR (%x:%x) (%x-%x-%x) (%x/%x) @ (%s %x:%08x).\n",
 3720                 sym_name (np), (unsigned)INB (nc_sdid)&0x0f, dstat, sist,
 3721                 (unsigned)INB (nc_socl), (unsigned)INB (nc_sbcl),
 3722                 (unsigned)INB (nc_sbdl), (unsigned)INB (nc_sxfer),
 3723                 (unsigned)INB (nc_scntl3), script_name, script_ofs,
 3724                 (unsigned)INL (nc_dbc));
 3725 
 3726         if (((script_ofs & 3) == 0) &&
 3727             (unsigned)script_ofs < script_size) {
 3728                 printf ("%s: script cmd = %08x\n", sym_name(np),
 3729                         scr_to_cpu((int) *(u32 *)(script_base + script_ofs)));
 3730         }
 3731 
 3732         printf ("%s: regdump:", sym_name(np));
 3733         for (i=0; i<24;i++)
 3734             printf (" %02x", (unsigned)INB_OFF(i));
 3735         printf (".\n");
 3736 
 3737         /*
 3738          *  PCI BUS error, read the PCI ststus register.
 3739          */
 3740         if (dstat & (MDPE|BF)) {
 3741                 u_short pci_sts;
 3742                 pci_sts = pci_read_config(np->device, PCIR_STATUS, 2);
 3743                 if (pci_sts & 0xf900) {
 3744                         pci_write_config(np->device, PCIR_STATUS, pci_sts, 2);
 3745                         printf("%s: PCI STATUS = 0x%04x\n",
 3746                                 sym_name(np), pci_sts & 0xf900);
 3747                 }
 3748         }
 3749 }
 3750 
 3751 /*
 3752  *  chip interrupt handler
 3753  *
 3754  *  In normal situations, interrupt conditions occur one at
 3755  *  a time. But when something bad happens on the SCSI BUS,
 3756  *  the chip may raise several interrupt flags before
 3757  *  stopping and interrupting the CPU. The additionnal
 3758  *  interrupt flags are stacked in some extra registers
 3759  *  after the SIP and/or DIP flag has been raised in the
 3760  *  ISTAT. After the CPU has read the interrupt condition
 3761  *  flag from SIST or DSTAT, the chip unstacks the other
 3762  *  interrupt flags and sets the corresponding bits in
 3763  *  SIST or DSTAT. Since the chip starts stacking once the
 3764  *  SIP or DIP flag is set, there is a small window of time
 3765  *  where the stacking does not occur.
 3766  *
 3767  *  Typically, multiple interrupt conditions may happen in
 3768  *  the following situations:
 3769  *
 3770  *  - SCSI parity error + Phase mismatch  (PAR|MA)
 3771  *    When a parity error is detected in input phase
 3772  *    and the device switches to msg-in phase inside a
 3773  *    block MOV.
 3774  *  - SCSI parity error + Unexpected disconnect (PAR|UDC)
 3775  *    When a stupid device does not want to handle the
 3776  *    recovery of an SCSI parity error.
 3777  *  - Some combinations of STO, PAR, UDC, ...
 3778  *    When using non compliant SCSI stuff, when user is
 3779  *    doing non compliant hot tampering on the BUS, when
 3780  *    something really bad happens to a device, etc ...
 3781  *
 3782  *  The heuristic suggested by SYMBIOS to handle
 3783  *  multiple interrupts is to try unstacking all
 3784  *  interrupts conditions and to handle them on some
 3785  *  priority based on error severity.
 3786  *  This will work when the unstacking has been
 3787  *  successful, but we cannot be 100 % sure of that,
 3788  *  since the CPU may have been faster to unstack than
 3789  *  the chip is able to stack. Hmmm ... But it seems that
 3790  *  such a situation is very unlikely to happen.
 3791  *
 3792  *  If this happen, for example STO caught by the CPU
 3793  *  then UDC happenning before the CPU have restarted
 3794  *  the SCRIPTS, the driver may wrongly complete the
 3795  *  same command on UDC, since the SCRIPTS didn't restart
 3796  *  and the DSA still points to the same command.
 3797  *  We avoid this situation by setting the DSA to an
 3798  *  invalid value when the CCB is completed and before
 3799  *  restarting the SCRIPTS.
 3800  *
 3801  *  Another issue is that we need some section of our
 3802  *  recovery procedures to be somehow uninterruptible but
 3803  *  the SCRIPTS processor does not provides such a
 3804  *  feature. For this reason, we handle recovery preferently
 3805  *  from the C code and check against some SCRIPTS critical
 3806  *  sections from the C code.
 3807  *
 3808  *  Hopefully, the interrupt handling of the driver is now
 3809  *  able to resist to weird BUS error conditions, but donnot
 3810  *  ask me for any guarantee that it will never fail. :-)
 3811  *  Use at your own decision and risk.
 3812  */
 3813 static void sym_intr1 (hcb_p np)
 3814 {
 3815         u_char  istat, istatc;
 3816         u_char  dstat;
 3817         u_short sist;
 3818 
 3819         SYM_LOCK_ASSERT(MA_OWNED);
 3820 
 3821         /*
 3822          *  interrupt on the fly ?
 3823          *
 3824          *  A `dummy read' is needed to ensure that the
 3825          *  clear of the INTF flag reaches the device
 3826          *  before the scanning of the DONE queue.
 3827          */
 3828         istat = INB (nc_istat);
 3829         if (istat & INTF) {
 3830                 OUTB (nc_istat, (istat & SIGP) | INTF | np->istat_sem);
 3831                 istat = INB (nc_istat);         /* DUMMY READ */
 3832                 if (DEBUG_FLAGS & DEBUG_TINY) printf ("F ");
 3833                 (void)sym_wakeup_done (np);
 3834         }
 3835 
 3836         if (!(istat & (SIP|DIP)))
 3837                 return;
 3838 
 3839 #if 0   /* We should never get this one */
 3840         if (istat & CABRT)
 3841                 OUTB (nc_istat, CABRT);
 3842 #endif
 3843 
 3844         /*
 3845          *  PAR and MA interrupts may occur at the same time,
 3846          *  and we need to know of both in order to handle
 3847          *  this situation properly. We try to unstack SCSI
 3848          *  interrupts for that reason. BTW, I dislike a LOT
 3849          *  such a loop inside the interrupt routine.
 3850          *  Even if DMA interrupt stacking is very unlikely to
 3851          *  happen, we also try unstacking these ones, since
 3852          *  this has no performance impact.
 3853          */
 3854         sist    = 0;
 3855         dstat   = 0;
 3856         istatc  = istat;
 3857         do {
 3858                 if (istatc & SIP)
 3859                         sist  |= INW (nc_sist);
 3860                 if (istatc & DIP)
 3861                         dstat |= INB (nc_dstat);
 3862                 istatc = INB (nc_istat);
 3863                 istat |= istatc;
 3864         } while (istatc & (SIP|DIP));
 3865 
 3866         if (DEBUG_FLAGS & DEBUG_TINY)
 3867                 printf ("<%d|%x:%x|%x:%x>",
 3868                         (int)INB(nc_scr0),
 3869                         dstat,sist,
 3870                         (unsigned)INL(nc_dsp),
 3871                         (unsigned)INL(nc_dbc));
 3872         /*
 3873          *  On paper, a memory barrier may be needed here.
 3874          *  And since we are paranoid ... :)
 3875          */
 3876         MEMORY_BARRIER();
 3877 
 3878         /*
 3879          *  First, interrupts we want to service cleanly.
 3880          *
 3881          *  Phase mismatch (MA) is the most frequent interrupt
 3882          *  for chip earlier than the 896 and so we have to service
 3883          *  it as quickly as possible.
 3884          *  A SCSI parity error (PAR) may be combined with a phase
 3885          *  mismatch condition (MA).
 3886          *  Programmed interrupts (SIR) are used to call the C code
 3887          *  from SCRIPTS.
 3888          *  The single step interrupt (SSI) is not used in this
 3889          *  driver.
 3890          */
 3891         if (!(sist  & (STO|GEN|HTH|SGE|UDC|SBMC|RST)) &&
 3892             !(dstat & (MDPE|BF|ABRT|IID))) {
 3893                 if      (sist & PAR)    sym_int_par (np, sist);
 3894                 else if (sist & MA)     sym_int_ma (np);
 3895                 else if (dstat & SIR)   sym_int_sir (np);
 3896                 else if (dstat & SSI)   OUTONB_STD ();
 3897                 else                    goto unknown_int;
 3898                 return;
 3899         }
 3900 
 3901         /*
 3902          *  Now, interrupts that donnot happen in normal
 3903          *  situations and that we may need to recover from.
 3904          *
 3905          *  On SCSI RESET (RST), we reset everything.
 3906          *  On SCSI BUS MODE CHANGE (SBMC), we complete all
 3907          *  active CCBs with RESET status, prepare all devices
 3908          *  for negotiating again and restart the SCRIPTS.
 3909          *  On STO and UDC, we complete the CCB with the corres-
 3910          *  ponding status and restart the SCRIPTS.
 3911          */
 3912         if (sist & RST) {
 3913                 xpt_print_path(np->path);
 3914                 printf("SCSI BUS reset detected.\n");
 3915                 sym_init (np, 1);
 3916                 return;
 3917         }
 3918 
 3919         OUTB (nc_ctest3, np->rv_ctest3 | CLF);  /* clear dma fifo  */
 3920         OUTB (nc_stest3, TE|CSF);               /* clear scsi fifo */
 3921 
 3922         if (!(sist  & (GEN|HTH|SGE)) &&
 3923             !(dstat & (MDPE|BF|ABRT|IID))) {
 3924                 if      (sist & SBMC)   sym_int_sbmc (np);
 3925                 else if (sist & STO)    sym_int_sto (np);
 3926                 else if (sist & UDC)    sym_int_udc (np);
 3927                 else                    goto unknown_int;
 3928                 return;
 3929         }
 3930 
 3931         /*
 3932          *  Now, interrupts we are not able to recover cleanly.
 3933          *
 3934          *  Log message for hard errors.
 3935          *  Reset everything.
 3936          */
 3937 
 3938         sym_log_hard_error(np, sist, dstat);
 3939 
 3940         if ((sist & (GEN|HTH|SGE)) ||
 3941                 (dstat & (MDPE|BF|ABRT|IID))) {
 3942                 sym_start_reset(np);
 3943                 return;
 3944         }
 3945 
 3946 unknown_int:
 3947         /*
 3948          *  We just miss the cause of the interrupt. :(
 3949          *  Print a message. The timeout will do the real work.
 3950          */
 3951         printf( "%s: unknown interrupt(s) ignored, "
 3952                 "ISTAT=0x%x DSTAT=0x%x SIST=0x%x\n",
 3953                 sym_name(np), istat, dstat, sist);
 3954 }
 3955 
 3956 static void sym_intr(void *arg)
 3957 {
 3958         hcb_p np = arg;
 3959 
 3960         SYM_LOCK();
 3961 
 3962         if (DEBUG_FLAGS & DEBUG_TINY) printf ("[");
 3963         sym_intr1((hcb_p) arg);
 3964         if (DEBUG_FLAGS & DEBUG_TINY) printf ("]");
 3965 
 3966         SYM_UNLOCK();
 3967 }
 3968 
 3969 static void sym_poll(struct cam_sim *sim)
 3970 {
 3971         sym_intr1(cam_sim_softc(sim));
 3972 }
 3973 
 3974 /*
 3975  *  generic recovery from scsi interrupt
 3976  *
 3977  *  The doc says that when the chip gets an SCSI interrupt,
 3978  *  it tries to stop in an orderly fashion, by completing
 3979  *  an instruction fetch that had started or by flushing
 3980  *  the DMA fifo for a write to memory that was executing.
 3981  *  Such a fashion is not enough to know if the instruction
 3982  *  that was just before the current DSP value has been
 3983  *  executed or not.
 3984  *
 3985  *  There are some small SCRIPTS sections that deal with
 3986  *  the start queue and the done queue that may break any
 3987  *  assomption from the C code if we are interrupted
 3988  *  inside, so we reset if this happens. Btw, since these
 3989  *  SCRIPTS sections are executed while the SCRIPTS hasn't
 3990  *  started SCSI operations, it is very unlikely to happen.
 3991  *
 3992  *  All the driver data structures are supposed to be
 3993  *  allocated from the same 4 GB memory window, so there
 3994  *  is a 1 to 1 relationship between DSA and driver data
 3995  *  structures. Since we are careful :) to invalidate the
 3996  *  DSA when we complete a command or when the SCRIPTS
 3997  *  pushes a DSA into a queue, we can trust it when it
 3998  *  points to a CCB.
 3999  */
 4000 static void sym_recover_scsi_int (hcb_p np, u_char hsts)
 4001 {
 4002         u32     dsp     = INL (nc_dsp);
 4003         u32     dsa     = INL (nc_dsa);
 4004         ccb_p cp        = sym_ccb_from_dsa(np, dsa);
 4005 
 4006         /*
 4007          *  If we haven't been interrupted inside the SCRIPTS
 4008          *  critical paths, we can safely restart the SCRIPTS
 4009          *  and trust the DSA value if it matches a CCB.
 4010          */
 4011         if ((!(dsp > SCRIPTA_BA (np, getjob_begin) &&
 4012                dsp < SCRIPTA_BA (np, getjob_end) + 1)) &&
 4013             (!(dsp > SCRIPTA_BA (np, ungetjob) &&
 4014                dsp < SCRIPTA_BA (np, reselect) + 1)) &&
 4015             (!(dsp > SCRIPTB_BA (np, sel_for_abort) &&
 4016                dsp < SCRIPTB_BA (np, sel_for_abort_1) + 1)) &&
 4017             (!(dsp > SCRIPTA_BA (np, done) &&
 4018                dsp < SCRIPTA_BA (np, done_end) + 1))) {
 4019                 OUTB (nc_ctest3, np->rv_ctest3 | CLF);  /* clear dma fifo  */
 4020                 OUTB (nc_stest3, TE|CSF);               /* clear scsi fifo */
 4021                 /*
 4022                  *  If we have a CCB, let the SCRIPTS call us back for
 4023                  *  the handling of the error with SCRATCHA filled with
 4024                  *  STARTPOS. This way, we will be able to freeze the
 4025                  *  device queue and requeue awaiting IOs.
 4026                  */
 4027                 if (cp) {
 4028                         cp->host_status = hsts;
 4029                         OUTL_DSP (SCRIPTA_BA (np, complete_error));
 4030                 }
 4031                 /*
 4032                  *  Otherwise just restart the SCRIPTS.
 4033                  */
 4034                 else {
 4035                         OUTL (nc_dsa, 0xffffff);
 4036                         OUTL_DSP (SCRIPTA_BA (np, start));
 4037                 }
 4038         }
 4039         else
 4040                 goto reset_all;
 4041 
 4042         return;
 4043 
 4044 reset_all:
 4045         sym_start_reset(np);
 4046 }
 4047 
 4048 /*
 4049  *  chip exception handler for selection timeout
 4050  */
 4051 static void sym_int_sto (hcb_p np)
 4052 {
 4053         u32 dsp = INL (nc_dsp);
 4054 
 4055         if (DEBUG_FLAGS & DEBUG_TINY) printf ("T");
 4056 
 4057         if (dsp == SCRIPTA_BA (np, wf_sel_done) + 8)
 4058                 sym_recover_scsi_int(np, HS_SEL_TIMEOUT);
 4059         else
 4060                 sym_start_reset(np);
 4061 }
 4062 
 4063 /*
 4064  *  chip exception handler for unexpected disconnect
 4065  */
 4066 static void sym_int_udc (hcb_p np)
 4067 {
 4068         printf ("%s: unexpected disconnect\n", sym_name(np));
 4069         sym_recover_scsi_int(np, HS_UNEXPECTED);
 4070 }
 4071 
 4072 /*
 4073  *  chip exception handler for SCSI bus mode change
 4074  *
 4075  *  spi2-r12 11.2.3 says a transceiver mode change must
 4076  *  generate a reset event and a device that detects a reset
 4077  *  event shall initiate a hard reset. It says also that a
 4078  *  device that detects a mode change shall set data transfer
 4079  *  mode to eight bit asynchronous, etc...
 4080  *  So, just reinitializing all except chip should be enough.
 4081  */
 4082 static void sym_int_sbmc (hcb_p np)
 4083 {
 4084         u_char scsi_mode = INB (nc_stest4) & SMODE;
 4085 
 4086         /*
 4087          *  Notify user.
 4088          */
 4089         xpt_print_path(np->path);
 4090         printf("SCSI BUS mode change from %s to %s.\n",
 4091                 sym_scsi_bus_mode(np->scsi_mode), sym_scsi_bus_mode(scsi_mode));
 4092 
 4093         /*
 4094          *  Should suspend command processing for a few seconds and
 4095          *  reinitialize all except the chip.
 4096          */
 4097         sym_init (np, 2);
 4098 }
 4099 
 4100 /*
 4101  *  chip exception handler for SCSI parity error.
 4102  *
 4103  *  When the chip detects a SCSI parity error and is
 4104  *  currently executing a (CH)MOV instruction, it does
 4105  *  not interrupt immediately, but tries to finish the
 4106  *  transfer of the current scatter entry before
 4107  *  interrupting. The following situations may occur:
 4108  *
 4109  *  - The complete scatter entry has been transferred
 4110  *    without the device having changed phase.
 4111  *    The chip will then interrupt with the DSP pointing
 4112  *    to the instruction that follows the MOV.
 4113  *
 4114  *  - A phase mismatch occurs before the MOV finished
 4115  *    and phase errors are to be handled by the C code.
 4116  *    The chip will then interrupt with both PAR and MA
 4117  *    conditions set.
 4118  *
 4119  *  - A phase mismatch occurs before the MOV finished and
 4120  *    phase errors are to be handled by SCRIPTS.
 4121  *    The chip will load the DSP with the phase mismatch
 4122  *    JUMP address and interrupt the host processor.
 4123  */
 4124 static void sym_int_par (hcb_p np, u_short sist)
 4125 {
 4126         u_char  hsts    = INB (HS_PRT);
 4127         u32     dsp     = INL (nc_dsp);
 4128         u32     dbc     = INL (nc_dbc);
 4129         u32     dsa     = INL (nc_dsa);
 4130         u_char  sbcl    = INB (nc_sbcl);
 4131         u_char  cmd     = dbc >> 24;
 4132         int phase       = cmd & 7;
 4133         ccb_p   cp      = sym_ccb_from_dsa(np, dsa);
 4134 
 4135         printf("%s: SCSI parity error detected: SCR1=%d DBC=%x SBCL=%x\n",
 4136                 sym_name(np), hsts, dbc, sbcl);
 4137 
 4138         /*
 4139          *  Check that the chip is connected to the SCSI BUS.
 4140          */
 4141         if (!(INB (nc_scntl1) & ISCON)) {
 4142                 sym_recover_scsi_int(np, HS_UNEXPECTED);
 4143                 return;
 4144         }
 4145 
 4146         /*
 4147          *  If the nexus is not clearly identified, reset the bus.
 4148          *  We will try to do better later.
 4149          */
 4150         if (!cp)
 4151                 goto reset_all;
 4152 
 4153         /*
 4154          *  Check instruction was a MOV, direction was INPUT and
 4155          *  ATN is asserted.
 4156          */
 4157         if ((cmd & 0xc0) || !(phase & 1) || !(sbcl & 0x8))
 4158                 goto reset_all;
 4159 
 4160         /*
 4161          *  Keep track of the parity error.
 4162          */
 4163         OUTONB (HF_PRT, HF_EXT_ERR);
 4164         cp->xerr_status |= XE_PARITY_ERR;
 4165 
 4166         /*
 4167          *  Prepare the message to send to the device.
 4168          */
 4169         np->msgout[0] = (phase == 7) ? M_PARITY : M_ID_ERROR;
 4170 
 4171         /*
 4172          *  If the old phase was DATA IN phase, we have to deal with
 4173          *  the 3 situations described above.
 4174          *  For other input phases (MSG IN and STATUS), the device
 4175          *  must resend the whole thing that failed parity checking
 4176          *  or signal error. So, jumping to dispatcher should be OK.
 4177          */
 4178         if (phase == 1 || phase == 5) {
 4179                 /* Phase mismatch handled by SCRIPTS */
 4180                 if (dsp == SCRIPTB_BA (np, pm_handle))
 4181                         OUTL_DSP (dsp);
 4182                 /* Phase mismatch handled by the C code */
 4183                 else if (sist & MA)
 4184                         sym_int_ma (np);
 4185                 /* No phase mismatch occurred */
 4186                 else {
 4187                         OUTL (nc_temp, dsp);
 4188                         OUTL_DSP (SCRIPTA_BA (np, dispatch));
 4189                 }
 4190         }
 4191         else
 4192                 OUTL_DSP (SCRIPTA_BA (np, clrack));
 4193         return;
 4194 
 4195 reset_all:
 4196         sym_start_reset(np);
 4197 }
 4198 
 4199 /*
 4200  *  chip exception handler for phase errors.
 4201  *
 4202  *  We have to construct a new transfer descriptor,
 4203  *  to transfer the rest of the current block.
 4204  */
 4205 static void sym_int_ma (hcb_p np)
 4206 {
 4207         u32     dbc;
 4208         u32     rest;
 4209         u32     dsp;
 4210         u32     dsa;
 4211         u32     nxtdsp;
 4212         u32     *vdsp;
 4213         u32     oadr, olen;
 4214         u32     *tblp;
 4215         u32     newcmd;
 4216         u_int   delta;
 4217         u_char  cmd;
 4218         u_char  hflags, hflags0;
 4219         struct  sym_pmc *pm;
 4220         ccb_p   cp;
 4221 
 4222         dsp     = INL (nc_dsp);
 4223         dbc     = INL (nc_dbc);
 4224         dsa     = INL (nc_dsa);
 4225 
 4226         cmd     = dbc >> 24;
 4227         rest    = dbc & 0xffffff;
 4228         delta   = 0;
 4229 
 4230         /*
 4231          *  locate matching cp if any.
 4232          */
 4233         cp = sym_ccb_from_dsa(np, dsa);
 4234 
 4235         /*
 4236          *  Donnot take into account dma fifo and various buffers in
 4237          *  INPUT phase since the chip flushes everything before
 4238          *  raising the MA interrupt for interrupted INPUT phases.
 4239          *  For DATA IN phase, we will check for the SWIDE later.
 4240          */
 4241         if ((cmd & 7) != 1 && (cmd & 7) != 5) {
 4242                 u_char ss0, ss2;
 4243 
 4244                 if (np->features & FE_DFBC)
 4245                         delta = INW (nc_dfbc);
 4246                 else {
 4247                         u32 dfifo;
 4248 
 4249                         /*
 4250                          * Read DFIFO, CTEST[4-6] using 1 PCI bus ownership.
 4251                          */
 4252                         dfifo = INL(nc_dfifo);
 4253 
 4254                         /*
 4255                          *  Calculate remaining bytes in DMA fifo.
 4256                          *  (CTEST5 = dfifo >> 16)
 4257                          */
 4258                         if (dfifo & (DFS << 16))
 4259                                 delta = ((((dfifo >> 8) & 0x300) |
 4260                                           (dfifo & 0xff)) - rest) & 0x3ff;
 4261                         else
 4262                                 delta = ((dfifo & 0xff) - rest) & 0x7f;
 4263                 }
 4264 
 4265                 /*
 4266                  *  The data in the dma fifo has not been transferred to
 4267                  *  the target -> add the amount to the rest
 4268                  *  and clear the data.
 4269                  *  Check the sstat2 register in case of wide transfer.
 4270                  */
 4271                 rest += delta;
 4272                 ss0  = INB (nc_sstat0);
 4273                 if (ss0 & OLF) rest++;
 4274                 if (!(np->features & FE_C10))
 4275                         if (ss0 & ORF) rest++;
 4276                 if (cp && (cp->phys.select.sel_scntl3 & EWS)) {
 4277                         ss2 = INB (nc_sstat2);
 4278                         if (ss2 & OLF1) rest++;
 4279                         if (!(np->features & FE_C10))
 4280                                 if (ss2 & ORF1) rest++;
 4281                 }
 4282 
 4283                 /*
 4284                  *  Clear fifos.
 4285                  */
 4286                 OUTB (nc_ctest3, np->rv_ctest3 | CLF);  /* dma fifo  */
 4287                 OUTB (nc_stest3, TE|CSF);               /* scsi fifo */
 4288         }
 4289 
 4290         /*
 4291          *  log the information
 4292          */
 4293         if (DEBUG_FLAGS & (DEBUG_TINY|DEBUG_PHASE))
 4294                 printf ("P%x%x RL=%d D=%d ", cmd&7, INB(nc_sbcl)&7,
 4295                         (unsigned) rest, (unsigned) delta);
 4296 
 4297         /*
 4298          *  try to find the interrupted script command,
 4299          *  and the address at which to continue.
 4300          */
 4301         vdsp    = NULL;
 4302         nxtdsp  = 0;
 4303         if      (dsp >  np->scripta_ba &&
 4304                  dsp <= np->scripta_ba + np->scripta_sz) {
 4305                 vdsp = (u32 *)((char*)np->scripta0 + (dsp-np->scripta_ba-8));
 4306                 nxtdsp = dsp;
 4307         }
 4308         else if (dsp >  np->scriptb_ba &&
 4309                  dsp <= np->scriptb_ba + np->scriptb_sz) {
 4310                 vdsp = (u32 *)((char*)np->scriptb0 + (dsp-np->scriptb_ba-8));
 4311                 nxtdsp = dsp;
 4312         }
 4313 
 4314         /*
 4315          *  log the information
 4316          */
 4317         if (DEBUG_FLAGS & DEBUG_PHASE) {
 4318                 printf ("\nCP=%p DSP=%x NXT=%x VDSP=%p CMD=%x ",
 4319                         cp, (unsigned)dsp, (unsigned)nxtdsp, vdsp, cmd);
 4320         }
 4321 
 4322         if (!vdsp) {
 4323                 printf ("%s: interrupted SCRIPT address not found.\n",
 4324                         sym_name (np));
 4325                 goto reset_all;
 4326         }
 4327 
 4328         if (!cp) {
 4329                 printf ("%s: SCSI phase error fixup: CCB already dequeued.\n",
 4330                         sym_name (np));
 4331                 goto reset_all;
 4332         }
 4333 
 4334         /*
 4335          *  get old startaddress and old length.
 4336          */
 4337         oadr = scr_to_cpu(vdsp[1]);
 4338 
 4339         if (cmd & 0x10) {       /* Table indirect */
 4340                 tblp = (u32 *) ((char*) &cp->phys + oadr);
 4341                 olen = scr_to_cpu(tblp[0]);
 4342                 oadr = scr_to_cpu(tblp[1]);
 4343         } else {
 4344                 tblp = (u32 *) 0;
 4345                 olen = scr_to_cpu(vdsp[0]) & 0xffffff;
 4346         }
 4347 
 4348         if (DEBUG_FLAGS & DEBUG_PHASE) {
 4349                 printf ("OCMD=%x\nTBLP=%p OLEN=%x OADR=%x\n",
 4350                         (unsigned) (scr_to_cpu(vdsp[0]) >> 24),
 4351                         tblp,
 4352                         (unsigned) olen,
 4353                         (unsigned) oadr);
 4354         }
 4355 
 4356         /*
 4357          *  check cmd against assumed interrupted script command.
 4358          *  If dt data phase, the MOVE instruction hasn't bit 4 of
 4359          *  the phase.
 4360          */
 4361         if (((cmd & 2) ? cmd : (cmd & ~4)) != (scr_to_cpu(vdsp[0]) >> 24)) {
 4362                 PRINT_ADDR(cp);
 4363                 printf ("internal error: cmd=%02x != %02x=(vdsp[0] >> 24)\n",
 4364                         (unsigned)cmd, (unsigned)scr_to_cpu(vdsp[0]) >> 24);
 4365 
 4366                 goto reset_all;
 4367         }
 4368 
 4369         /*
 4370          *  if old phase not dataphase, leave here.
 4371          */
 4372         if (cmd & 2) {
 4373                 PRINT_ADDR(cp);
 4374                 printf ("phase change %x-%x %d@%08x resid=%d.\n",
 4375                         cmd&7, INB(nc_sbcl)&7, (unsigned)olen,
 4376                         (unsigned)oadr, (unsigned)rest);
 4377                 goto unexpected_phase;
 4378         }
 4379 
 4380         /*
 4381          *  Choose the correct PM save area.
 4382          *
 4383          *  Look at the PM_SAVE SCRIPT if you want to understand
 4384          *  this stuff. The equivalent code is implemented in
 4385          *  SCRIPTS for the 895A, 896 and 1010 that are able to
 4386          *  handle PM from the SCRIPTS processor.
 4387          */
 4388         hflags0 = INB (HF_PRT);
 4389         hflags = hflags0;
 4390 
 4391         if (hflags & (HF_IN_PM0 | HF_IN_PM1 | HF_DP_SAVED)) {
 4392                 if (hflags & HF_IN_PM0)
 4393                         nxtdsp = scr_to_cpu(cp->phys.pm0.ret);
 4394                 else if (hflags & HF_IN_PM1)
 4395                         nxtdsp = scr_to_cpu(cp->phys.pm1.ret);
 4396 
 4397                 if (hflags & HF_DP_SAVED)
 4398                         hflags ^= HF_ACT_PM;
 4399         }
 4400 
 4401         if (!(hflags & HF_ACT_PM)) {
 4402                 pm = &cp->phys.pm0;
 4403                 newcmd = SCRIPTA_BA (np, pm0_data);
 4404         }
 4405         else {
 4406                 pm = &cp->phys.pm1;
 4407                 newcmd = SCRIPTA_BA (np, pm1_data);
 4408         }
 4409 
 4410         hflags &= ~(HF_IN_PM0 | HF_IN_PM1 | HF_DP_SAVED);
 4411         if (hflags != hflags0)
 4412                 OUTB (HF_PRT, hflags);
 4413 
 4414         /*
 4415          *  fillin the phase mismatch context
 4416          */
 4417         pm->sg.addr = cpu_to_scr(oadr + olen - rest);
 4418         pm->sg.size = cpu_to_scr(rest);
 4419         pm->ret     = cpu_to_scr(nxtdsp);
 4420 
 4421         /*
 4422          *  If we have a SWIDE,
 4423          *  - prepare the address to write the SWIDE from SCRIPTS,
 4424          *  - compute the SCRIPTS address to restart from,
 4425          *  - move current data pointer context by one byte.
 4426          */
 4427         nxtdsp = SCRIPTA_BA (np, dispatch);
 4428         if ((cmd & 7) == 1 && cp && (cp->phys.select.sel_scntl3 & EWS) &&
 4429             (INB (nc_scntl2) & WSR)) {
 4430                 u32 tmp;
 4431 
 4432                 /*
 4433                  *  Set up the table indirect for the MOVE
 4434                  *  of the residual byte and adjust the data
 4435                  *  pointer context.
 4436                  */
 4437                 tmp = scr_to_cpu(pm->sg.addr);
 4438                 cp->phys.wresid.addr = cpu_to_scr(tmp);
 4439                 pm->sg.addr = cpu_to_scr(tmp + 1);
 4440                 tmp = scr_to_cpu(pm->sg.size);
 4441                 cp->phys.wresid.size = cpu_to_scr((tmp&0xff000000) | 1);
 4442                 pm->sg.size = cpu_to_scr(tmp - 1);
 4443 
 4444                 /*
 4445                  *  If only the residual byte is to be moved,
 4446                  *  no PM context is needed.
 4447                  */
 4448                 if ((tmp&0xffffff) == 1)
 4449                         newcmd = pm->ret;
 4450 
 4451                 /*
 4452                  *  Prepare the address of SCRIPTS that will
 4453                  *  move the residual byte to memory.
 4454                  */
 4455                 nxtdsp = SCRIPTB_BA (np, wsr_ma_helper);
 4456         }
 4457 
 4458         if (DEBUG_FLAGS & DEBUG_PHASE) {
 4459                 PRINT_ADDR(cp);
 4460                 printf ("PM %x %x %x / %x %x %x.\n",
 4461                         hflags0, hflags, newcmd,
 4462                         (unsigned)scr_to_cpu(pm->sg.addr),
 4463                         (unsigned)scr_to_cpu(pm->sg.size),
 4464                         (unsigned)scr_to_cpu(pm->ret));
 4465         }
 4466 
 4467         /*
 4468          *  Restart the SCRIPTS processor.
 4469          */
 4470         OUTL (nc_temp, newcmd);
 4471         OUTL_DSP (nxtdsp);
 4472         return;
 4473 
 4474         /*
 4475          *  Unexpected phase changes that occurs when the current phase
 4476          *  is not a DATA IN or DATA OUT phase are due to error conditions.
 4477          *  Such event may only happen when the SCRIPTS is using a
 4478          *  multibyte SCSI MOVE.
 4479          *
 4480          *  Phase change                Some possible cause
 4481          *
 4482          *  COMMAND  --> MSG IN SCSI parity error detected by target.
 4483          *  COMMAND  --> STATUS Bad command or refused by target.
 4484          *  MSG OUT  --> MSG IN     Message rejected by target.
 4485          *  MSG OUT  --> COMMAND    Bogus target that discards extended
 4486          *                      negotiation messages.
 4487          *
 4488          *  The code below does not care of the new phase and so
 4489          *  trusts the target. Why to annoy it ?
 4490          *  If the interrupted phase is COMMAND phase, we restart at
 4491          *  dispatcher.
 4492          *  If a target does not get all the messages after selection,
 4493          *  the code assumes blindly that the target discards extended
 4494          *  messages and clears the negotiation status.
 4495          *  If the target does not want all our response to negotiation,
 4496          *  we force a SIR_NEGO_PROTO interrupt (it is a hack that avoids
 4497          *  bloat for such a should_not_happen situation).
 4498          *  In all other situation, we reset the BUS.
 4499          *  Are these assumptions reasonnable ? (Wait and see ...)
 4500          */
 4501 unexpected_phase:
 4502         dsp -= 8;
 4503         nxtdsp = 0;
 4504 
 4505         switch (cmd & 7) {
 4506         case 2: /* COMMAND phase */
 4507                 nxtdsp = SCRIPTA_BA (np, dispatch);
 4508                 break;
 4509 #if 0
 4510         case 3: /* STATUS  phase */
 4511                 nxtdsp = SCRIPTA_BA (np, dispatch);
 4512                 break;
 4513 #endif
 4514         case 6: /* MSG OUT phase */
 4515                 /*
 4516                  *  If the device may want to use untagged when we want
 4517                  *  tagged, we prepare an IDENTIFY without disc. granted,
 4518                  *  since we will not be able to handle reselect.
 4519                  *  Otherwise, we just don't care.
 4520                  */
 4521                 if      (dsp == SCRIPTA_BA (np, send_ident)) {
 4522                         if (cp->tag != NO_TAG && olen - rest <= 3) {
 4523                                 cp->host_status = HS_BUSY;
 4524                                 np->msgout[0] = M_IDENTIFY | cp->lun;
 4525                                 nxtdsp = SCRIPTB_BA (np, ident_break_atn);
 4526                         }
 4527                         else
 4528                                 nxtdsp = SCRIPTB_BA (np, ident_break);
 4529                 }
 4530                 else if (dsp == SCRIPTB_BA (np, send_wdtr) ||
 4531                          dsp == SCRIPTB_BA (np, send_sdtr) ||
 4532                          dsp == SCRIPTB_BA (np, send_ppr)) {
 4533                         nxtdsp = SCRIPTB_BA (np, nego_bad_phase);
 4534                 }
 4535                 break;
 4536 #if 0
 4537         case 7: /* MSG IN  phase */
 4538                 nxtdsp = SCRIPTA_BA (np, clrack);
 4539                 break;
 4540 #endif
 4541         }
 4542 
 4543         if (nxtdsp) {
 4544                 OUTL_DSP (nxtdsp);
 4545                 return;
 4546         }
 4547 
 4548 reset_all:
 4549         sym_start_reset(np);
 4550 }
 4551 
 4552 /*
 4553  *  Dequeue from the START queue all CCBs that match
 4554  *  a given target/lun/task condition (-1 means all),
 4555  *  and move them from the BUSY queue to the COMP queue
 4556  *  with CAM_REQUEUE_REQ status condition.
 4557  *  This function is used during error handling/recovery.
 4558  *  It is called with SCRIPTS not running.
 4559  */
 4560 static int
 4561 sym_dequeue_from_squeue(hcb_p np, int i, int target, int lun, int task)
 4562 {
 4563         int j;
 4564         ccb_p cp;
 4565 
 4566         /*
 4567          *  Make sure the starting index is within range.
 4568          */
 4569         assert((i >= 0) && (i < 2*MAX_QUEUE));
 4570 
 4571         /*
 4572          *  Walk until end of START queue and dequeue every job
 4573          *  that matches the target/lun/task condition.
 4574          */
 4575         j = i;
 4576         while (i != np->squeueput) {
 4577                 cp = sym_ccb_from_dsa(np, scr_to_cpu(np->squeue[i]));
 4578                 assert(cp);
 4579 #ifdef SYM_CONF_IARB_SUPPORT
 4580                 /* Forget hints for IARB, they may be no longer relevant */
 4581                 cp->host_flags &= ~HF_HINT_IARB;
 4582 #endif
 4583                 if ((target == -1 || cp->target == target) &&
 4584                     (lun    == -1 || cp->lun    == lun)    &&
 4585                     (task   == -1 || cp->tag    == task)) {
 4586                         sym_set_cam_status(cp->cam_ccb, CAM_REQUEUE_REQ);
 4587                         sym_remque(&cp->link_ccbq);
 4588                         sym_insque_tail(&cp->link_ccbq, &np->comp_ccbq);
 4589                 }
 4590                 else {
 4591                         if (i != j)
 4592                                 np->squeue[j] = np->squeue[i];
 4593                         if ((j += 2) >= MAX_QUEUE*2) j = 0;
 4594                 }
 4595                 if ((i += 2) >= MAX_QUEUE*2) i = 0;
 4596         }
 4597         if (i != j)             /* Copy back the idle task if needed */
 4598                 np->squeue[j] = np->squeue[i];
 4599         np->squeueput = j;      /* Update our current start queue pointer */
 4600 
 4601         return (i - j) / 2;
 4602 }
 4603 
 4604 /*
 4605  *  Complete all CCBs queued to the COMP queue.
 4606  *
 4607  *  These CCBs are assumed:
 4608  *  - Not to be referenced either by devices or
 4609  *    SCRIPTS-related queues and datas.
 4610  *  - To have to be completed with an error condition
 4611  *    or requeued.
 4612  *
 4613  *  The device queue freeze count is incremented
 4614  *  for each CCB that does not prevent this.
 4615  *  This function is called when all CCBs involved
 4616  *  in error handling/recovery have been reaped.
 4617  */
 4618 static void
 4619 sym_flush_comp_queue(hcb_p np, int cam_status)
 4620 {
 4621         SYM_QUEHEAD *qp;
 4622         ccb_p cp;
 4623 
 4624         while ((qp = sym_remque_head(&np->comp_ccbq)) != NULL) {
 4625                 union ccb *ccb;
 4626                 cp = sym_que_entry(qp, struct sym_ccb, link_ccbq);
 4627                 sym_insque_tail(&cp->link_ccbq, &np->busy_ccbq);
 4628                 /* Leave quiet CCBs waiting for resources */
 4629                 if (cp->host_status == HS_WAIT)
 4630                         continue;
 4631                 ccb = cp->cam_ccb;
 4632                 if (cam_status)
 4633                         sym_set_cam_status(ccb, cam_status);
 4634                 sym_freeze_cam_ccb(ccb);
 4635                 sym_xpt_done(np, ccb, cp);
 4636                 sym_free_ccb(np, cp);
 4637         }
 4638 }
 4639 
 4640 /*
 4641  *  chip handler for bad SCSI status condition
 4642  *
 4643  *  In case of bad SCSI status, we unqueue all the tasks
 4644  *  currently queued to the controller but not yet started
 4645  *  and then restart the SCRIPTS processor immediately.
 4646  *
 4647  *  QUEUE FULL and BUSY conditions are handled the same way.
 4648  *  Basically all the not yet started tasks are requeued in
 4649  *  device queue and the queue is frozen until a completion.
 4650  *
 4651  *  For CHECK CONDITION and COMMAND TERMINATED status, we use
 4652  *  the CCB of the failed command to prepare a REQUEST SENSE
 4653  *  SCSI command and queue it to the controller queue.
 4654  *
 4655  *  SCRATCHA is assumed to have been loaded with STARTPOS
 4656  *  before the SCRIPTS called the C code.
 4657  */
 4658 static void sym_sir_bad_scsi_status(hcb_p np, ccb_p cp)
 4659 {
 4660         tcb_p tp        = &np->target[cp->target];
 4661         u32             startp;
 4662         u_char          s_status = cp->ssss_status;
 4663         u_char          h_flags  = cp->host_flags;
 4664         int             msglen;
 4665         int             nego;
 4666         int             i;
 4667 
 4668         SYM_LOCK_ASSERT(MA_OWNED);
 4669 
 4670         /*
 4671          *  Compute the index of the next job to start from SCRIPTS.
 4672          */
 4673         i = (INL (nc_scratcha) - np->squeue_ba) / 4;
 4674 
 4675         /*
 4676          *  The last CCB queued used for IARB hint may be
 4677          *  no longer relevant. Forget it.
 4678          */
 4679 #ifdef SYM_CONF_IARB_SUPPORT
 4680         if (np->last_cp)
 4681                 np->last_cp = NULL;
 4682 #endif
 4683 
 4684         /*
 4685          *  Now deal with the SCSI status.
 4686          */
 4687         switch(s_status) {
 4688         case S_BUSY:
 4689         case S_QUEUE_FULL:
 4690                 if (sym_verbose >= 2) {
 4691                         PRINT_ADDR(cp);
 4692                         printf (s_status == S_BUSY ? "BUSY" : "QUEUE FULL\n");
 4693                 }
 4694         default:        /* S_INT, S_INT_COND_MET, S_CONFLICT */
 4695                 sym_complete_error (np, cp);
 4696                 break;
 4697         case S_TERMINATED:
 4698         case S_CHECK_COND:
 4699                 /*
 4700                  *  If we get an SCSI error when requesting sense, give up.
 4701                  */
 4702                 if (h_flags & HF_SENSE) {
 4703                         sym_complete_error (np, cp);
 4704                         break;
 4705                 }
 4706 
 4707                 /*
 4708                  *  Dequeue all queued CCBs for that device not yet started,
 4709                  *  and restart the SCRIPTS processor immediately.
 4710                  */
 4711                 (void) sym_dequeue_from_squeue(np, i, cp->target, cp->lun, -1);
 4712                 OUTL_DSP (SCRIPTA_BA (np, start));
 4713 
 4714                 /*
 4715                  *  Save some info of the actual IO.
 4716                  *  Compute the data residual.
 4717                  */
 4718                 cp->sv_scsi_status = cp->ssss_status;
 4719                 cp->sv_xerr_status = cp->xerr_status;
 4720                 cp->sv_resid = sym_compute_residual(np, cp);
 4721 
 4722                 /*
 4723                  *  Prepare all needed data structures for
 4724                  *  requesting sense data.
 4725                  */
 4726 
 4727                 /*
 4728                  *  identify message
 4729                  */
 4730                 cp->scsi_smsg2[0] = M_IDENTIFY | cp->lun;
 4731                 msglen = 1;
 4732 
 4733                 /*
 4734                  *  If we are currently using anything different from
 4735                  *  async. 8 bit data transfers with that target,
 4736                  *  start a negotiation, since the device may want
 4737                  *  to report us a UNIT ATTENTION condition due to
 4738                  *  a cause we currently ignore, and we donnot want
 4739                  *  to be stuck with WIDE and/or SYNC data transfer.
 4740                  *
 4741                  *  cp->nego_status is filled by sym_prepare_nego().
 4742                  */
 4743                 cp->nego_status = 0;
 4744                 nego = 0;
 4745                 if      (tp->tinfo.current.options & PPR_OPT_MASK)
 4746                         nego = NS_PPR;
 4747                 else if (tp->tinfo.current.width != BUS_8_BIT)
 4748                         nego = NS_WIDE;
 4749                 else if (tp->tinfo.current.offset != 0)
 4750                         nego = NS_SYNC;
 4751                 if (nego)
 4752                         msglen +=
 4753                         sym_prepare_nego (np,cp, nego, &cp->scsi_smsg2[msglen]);
 4754                 /*
 4755                  *  Message table indirect structure.
 4756                  */
 4757                 cp->phys.smsg.addr      = cpu_to_scr(CCB_BA (cp, scsi_smsg2));
 4758                 cp->phys.smsg.size      = cpu_to_scr(msglen);
 4759 
 4760                 /*
 4761                  *  sense command
 4762                  */
 4763                 cp->phys.cmd.addr       = cpu_to_scr(CCB_BA (cp, sensecmd));
 4764                 cp->phys.cmd.size       = cpu_to_scr(6);
 4765 
 4766                 /*
 4767                  *  patch requested size into sense command
 4768                  */
 4769                 cp->sensecmd[0]         = 0x03;
 4770                 cp->sensecmd[1]         = cp->lun << 5;
 4771                 if (tp->tinfo.current.scsi_version > 2 || cp->lun > 7)
 4772                         cp->sensecmd[1] = 0;
 4773                 cp->sensecmd[4]         = SYM_SNS_BBUF_LEN;
 4774                 cp->data_len            = SYM_SNS_BBUF_LEN;
 4775 
 4776                 /*
 4777                  *  sense data
 4778                  */
 4779                 bzero(cp->sns_bbuf, SYM_SNS_BBUF_LEN);
 4780                 cp->phys.sense.addr     = cpu_to_scr(vtobus(cp->sns_bbuf));
 4781                 cp->phys.sense.size     = cpu_to_scr(SYM_SNS_BBUF_LEN);
 4782 
 4783                 /*
 4784                  *  requeue the command.
 4785                  */
 4786                 startp = SCRIPTB_BA (np, sdata_in);
 4787 
 4788                 cp->phys.head.savep     = cpu_to_scr(startp);
 4789                 cp->phys.head.goalp     = cpu_to_scr(startp + 16);
 4790                 cp->phys.head.lastp     = cpu_to_scr(startp);
 4791                 cp->startp      = cpu_to_scr(startp);
 4792 
 4793                 cp->actualquirks = SYM_QUIRK_AUTOSAVE;
 4794                 cp->host_status = cp->nego_status ? HS_NEGOTIATE : HS_BUSY;
 4795                 cp->ssss_status = S_ILLEGAL;
 4796                 cp->host_flags  = (HF_SENSE|HF_DATA_IN);
 4797                 cp->xerr_status = 0;
 4798                 cp->extra_bytes = 0;
 4799 
 4800                 cp->phys.head.go.start = cpu_to_scr(SCRIPTA_BA (np, select));
 4801 
 4802                 /*
 4803                  *  Requeue the command.
 4804                  */
 4805                 sym_put_start_queue(np, cp);
 4806 
 4807                 /*
 4808                  *  Give back to upper layer everything we have dequeued.
 4809                  */
 4810                 sym_flush_comp_queue(np, 0);
 4811                 break;
 4812         }
 4813 }
 4814 
 4815 /*
 4816  *  After a device has accepted some management message
 4817  *  as BUS DEVICE RESET, ABORT TASK, etc ..., or when
 4818  *  a device signals a UNIT ATTENTION condition, some
 4819  *  tasks are thrown away by the device. We are required
 4820  *  to reflect that on our tasks list since the device
 4821  *  will never complete these tasks.
 4822  *
 4823  *  This function move from the BUSY queue to the COMP
 4824  *  queue all disconnected CCBs for a given target that
 4825  *  match the following criteria:
 4826  *  - lun=-1  means any logical UNIT otherwise a given one.
 4827  *  - task=-1 means any task, otherwise a given one.
 4828  */
 4829 static int
 4830 sym_clear_tasks(hcb_p np, int cam_status, int target, int lun, int task)
 4831 {
 4832         SYM_QUEHEAD qtmp, *qp;
 4833         int i = 0;
 4834         ccb_p cp;
 4835 
 4836         /*
 4837          *  Move the entire BUSY queue to our temporary queue.
 4838          */
 4839         sym_que_init(&qtmp);
 4840         sym_que_splice(&np->busy_ccbq, &qtmp);
 4841         sym_que_init(&np->busy_ccbq);
 4842 
 4843         /*
 4844          *  Put all CCBs that matches our criteria into
 4845          *  the COMP queue and put back other ones into
 4846          *  the BUSY queue.
 4847          */
 4848         while ((qp = sym_remque_head(&qtmp)) != NULL) {
 4849                 union ccb *ccb;
 4850                 cp = sym_que_entry(qp, struct sym_ccb, link_ccbq);
 4851                 ccb = cp->cam_ccb;
 4852                 if (cp->host_status != HS_DISCONNECT ||
 4853                     cp->target != target             ||
 4854                     (lun  != -1 && cp->lun != lun)   ||
 4855                     (task != -1 &&
 4856                         (cp->tag != NO_TAG && cp->scsi_smsg[2] != task))) {
 4857                         sym_insque_tail(&cp->link_ccbq, &np->busy_ccbq);
 4858                         continue;
 4859                 }
 4860                 sym_insque_tail(&cp->link_ccbq, &np->comp_ccbq);
 4861 
 4862                 /* Preserve the software timeout condition */
 4863                 if (sym_get_cam_status(ccb) != CAM_CMD_TIMEOUT)
 4864                         sym_set_cam_status(ccb, cam_status);
 4865                 ++i;
 4866 #if 0
 4867 printf("XXXX TASK @%p CLEARED\n", cp);
 4868 #endif
 4869         }
 4870         return i;
 4871 }
 4872 
 4873 /*
 4874  *  chip handler for TASKS recovery
 4875  *
 4876  *  We cannot safely abort a command, while the SCRIPTS
 4877  *  processor is running, since we just would be in race
 4878  *  with it.
 4879  *
 4880  *  As long as we have tasks to abort, we keep the SEM
 4881  *  bit set in the ISTAT. When this bit is set, the
 4882  *  SCRIPTS processor interrupts (SIR_SCRIPT_STOPPED)
 4883  *  each time it enters the scheduler.
 4884  *
 4885  *  If we have to reset a target, clear tasks of a unit,
 4886  *  or to perform the abort of a disconnected job, we
 4887  *  restart the SCRIPTS for selecting the target. Once
 4888  *  selected, the SCRIPTS interrupts (SIR_TARGET_SELECTED).
 4889  *  If it loses arbitration, the SCRIPTS will interrupt again
 4890  *  the next time it will enter its scheduler, and so on ...
 4891  *
 4892  *  On SIR_TARGET_SELECTED, we scan for the more
 4893  *  appropriate thing to do:
 4894  *
 4895  *  - If nothing, we just sent a M_ABORT message to the
 4896  *    target to get rid of the useless SCSI bus ownership.
 4897  *    According to the specs, no tasks shall be affected.
 4898  *  - If the target is to be reset, we send it a M_RESET
 4899  *    message.
 4900  *  - If a logical UNIT is to be cleared , we send the
 4901  *    IDENTIFY(lun) + M_ABORT.
 4902  *  - If an untagged task is to be aborted, we send the
 4903  *    IDENTIFY(lun) + M_ABORT.
 4904  *  - If a tagged task is to be aborted, we send the
 4905  *    IDENTIFY(lun) + task attributes + M_ABORT_TAG.
 4906  *
 4907  *  Once our 'kiss of death' :) message has been accepted
 4908  *  by the target, the SCRIPTS interrupts again
 4909  *  (SIR_ABORT_SENT). On this interrupt, we complete
 4910  *  all the CCBs that should have been aborted by the
 4911  *  target according to our message.
 4912  */
 4913 static void sym_sir_task_recovery(hcb_p np, int num)
 4914 {
 4915         SYM_QUEHEAD *qp;
 4916         ccb_p cp;
 4917         tcb_p tp;
 4918         int target=-1, lun=-1, task;
 4919         int i, k;
 4920 
 4921         switch(num) {
 4922         /*
 4923          *  The SCRIPTS processor stopped before starting
 4924          *  the next command in order to allow us to perform
 4925          *  some task recovery.
 4926          */
 4927         case SIR_SCRIPT_STOPPED:
 4928                 /*
 4929                  *  Do we have any target to reset or unit to clear ?
 4930                  */
 4931                 for (i = 0 ; i < SYM_CONF_MAX_TARGET ; i++) {
 4932                         tp = &np->target[i];
 4933                         if (tp->to_reset ||
 4934                             (tp->lun0p && tp->lun0p->to_clear)) {
 4935                                 target = i;
 4936                                 break;
 4937                         }
 4938                         if (!tp->lunmp)
 4939                                 continue;
 4940                         for (k = 1 ; k < SYM_CONF_MAX_LUN ; k++) {
 4941                                 if (tp->lunmp[k] && tp->lunmp[k]->to_clear) {
 4942                                         target  = i;
 4943                                         break;
 4944                                 }
 4945                         }
 4946                         if (target != -1)
 4947                                 break;
 4948                 }
 4949 
 4950                 /*
 4951                  *  If not, walk the busy queue for any
 4952                  *  disconnected CCB to be aborted.
 4953                  */
 4954                 if (target == -1) {
 4955                         FOR_EACH_QUEUED_ELEMENT(&np->busy_ccbq, qp) {
 4956                                 cp = sym_que_entry(qp,struct sym_ccb,link_ccbq);
 4957                                 if (cp->host_status != HS_DISCONNECT)
 4958                                         continue;
 4959                                 if (cp->to_abort) {
 4960                                         target = cp->target;
 4961                                         break;
 4962                                 }
 4963                         }
 4964                 }
 4965 
 4966                 /*
 4967                  *  If some target is to be selected,
 4968                  *  prepare and start the selection.
 4969                  */
 4970                 if (target != -1) {
 4971                         tp = &np->target[target];
 4972                         np->abrt_sel.sel_id     = target;
 4973                         np->abrt_sel.sel_scntl3 = tp->head.wval;
 4974                         np->abrt_sel.sel_sxfer  = tp->head.sval;
 4975                         OUTL(nc_dsa, np->hcb_ba);
 4976                         OUTL_DSP (SCRIPTB_BA (np, sel_for_abort));
 4977                         return;
 4978                 }
 4979 
 4980                 /*
 4981                  *  Now look for a CCB to abort that haven't started yet.
 4982                  *  Btw, the SCRIPTS processor is still stopped, so
 4983                  *  we are not in race.
 4984                  */
 4985                 i = 0;
 4986                 cp = NULL;
 4987                 FOR_EACH_QUEUED_ELEMENT(&np->busy_ccbq, qp) {
 4988                         cp = sym_que_entry(qp, struct sym_ccb, link_ccbq);
 4989                         if (cp->host_status != HS_BUSY &&
 4990                             cp->host_status != HS_NEGOTIATE)
 4991                                 continue;
 4992                         if (!cp->to_abort)
 4993                                 continue;
 4994 #ifdef SYM_CONF_IARB_SUPPORT
 4995                         /*
 4996                          *    If we are using IMMEDIATE ARBITRATION, we donnot
 4997                          *    want to cancel the last queued CCB, since the
 4998                          *    SCRIPTS may have anticipated the selection.
 4999                          */
 5000                         if (cp == np->last_cp) {
 5001                                 cp->to_abort = 0;
 5002                                 continue;
 5003                         }
 5004 #endif
 5005                         i = 1;  /* Means we have found some */
 5006                         break;
 5007                 }
 5008                 if (!i) {
 5009                         /*
 5010                          *  We are done, so we donnot need
 5011                          *  to synchronize with the SCRIPTS anylonger.
 5012                          *  Remove the SEM flag from the ISTAT.
 5013                          */
 5014                         np->istat_sem = 0;
 5015                         OUTB (nc_istat, SIGP);
 5016                         break;
 5017                 }
 5018                 /*
 5019                  *  Compute index of next position in the start
 5020                  *  queue the SCRIPTS intends to start and dequeue
 5021                  *  all CCBs for that device that haven't been started.
 5022                  */
 5023                 i = (INL (nc_scratcha) - np->squeue_ba) / 4;
 5024                 i = sym_dequeue_from_squeue(np, i, cp->target, cp->lun, -1);
 5025 
 5026                 /*
 5027                  *  Make sure at least our IO to abort has been dequeued.
 5028                  */
 5029                 assert(i && sym_get_cam_status(cp->cam_ccb) == CAM_REQUEUE_REQ);
 5030 
 5031                 /*
 5032                  *  Keep track in cam status of the reason of the abort.
 5033                  */
 5034                 if (cp->to_abort == 2)
 5035                         sym_set_cam_status(cp->cam_ccb, CAM_CMD_TIMEOUT);
 5036                 else
 5037                         sym_set_cam_status(cp->cam_ccb, CAM_REQ_ABORTED);
 5038 
 5039                 /*
 5040                  *  Complete with error everything that we have dequeued.
 5041                  */
 5042                 sym_flush_comp_queue(np, 0);
 5043                 break;
 5044         /*
 5045          *  The SCRIPTS processor has selected a target
 5046          *  we may have some manual recovery to perform for.
 5047          */
 5048         case SIR_TARGET_SELECTED:
 5049                 target = (INB (nc_sdid) & 0xf);
 5050                 tp = &np->target[target];
 5051 
 5052                 np->abrt_tbl.addr = cpu_to_scr(vtobus(np->abrt_msg));
 5053 
 5054                 /*
 5055                  *  If the target is to be reset, prepare a
 5056                  *  M_RESET message and clear the to_reset flag
 5057                  *  since we donnot expect this operation to fail.
 5058                  */
 5059                 if (tp->to_reset) {
 5060                         np->abrt_msg[0] = M_RESET;
 5061                         np->abrt_tbl.size = 1;
 5062                         tp->to_reset = 0;
 5063                         break;
 5064                 }
 5065 
 5066                 /*
 5067                  *  Otherwise, look for some logical unit to be cleared.
 5068                  */
 5069                 if (tp->lun0p && tp->lun0p->to_clear)
 5070                         lun = 0;
 5071                 else if (tp->lunmp) {
 5072                         for (k = 1 ; k < SYM_CONF_MAX_LUN ; k++) {
 5073                                 if (tp->lunmp[k] && tp->lunmp[k]->to_clear) {
 5074                                         lun = k;
 5075                                         break;
 5076                                 }
 5077                         }
 5078                 }
 5079 
 5080                 /*
 5081                  *  If a logical unit is to be cleared, prepare
 5082                  *  an IDENTIFY(lun) + ABORT MESSAGE.
 5083                  */
 5084                 if (lun != -1) {
 5085                         lcb_p lp = sym_lp(tp, lun);
 5086                         lp->to_clear = 0; /* We donnot expect to fail here */
 5087                         np->abrt_msg[0] = M_IDENTIFY | lun;
 5088                         np->abrt_msg[1] = M_ABORT;
 5089                         np->abrt_tbl.size = 2;
 5090                         break;
 5091                 }
 5092 
 5093                 /*
 5094                  *  Otherwise, look for some disconnected job to
 5095                  *  abort for this target.
 5096                  */
 5097                 i = 0;
 5098                 cp = NULL;
 5099                 FOR_EACH_QUEUED_ELEMENT(&np->busy_ccbq, qp) {
 5100                         cp = sym_que_entry(qp, struct sym_ccb, link_ccbq);
 5101                         if (cp->host_status != HS_DISCONNECT)
 5102                                 continue;
 5103                         if (cp->target != target)
 5104                                 continue;
 5105                         if (!cp->to_abort)
 5106                                 continue;
 5107                         i = 1;  /* Means we have some */
 5108                         break;
 5109                 }
 5110 
 5111                 /*
 5112                  *  If we have none, probably since the device has
 5113                  *  completed the command before we won abitration,
 5114                  *  send a M_ABORT message without IDENTIFY.
 5115                  *  According to the specs, the device must just
 5116                  *  disconnect the BUS and not abort any task.
 5117                  */
 5118                 if (!i) {
 5119                         np->abrt_msg[0] = M_ABORT;
 5120                         np->abrt_tbl.size = 1;
 5121                         break;
 5122                 }
 5123 
 5124                 /*
 5125                  *  We have some task to abort.
 5126                  *  Set the IDENTIFY(lun)
 5127                  */
 5128                 np->abrt_msg[0] = M_IDENTIFY | cp->lun;
 5129 
 5130                 /*
 5131                  *  If we want to abort an untagged command, we
 5132                  *  will send an IDENTIFY + M_ABORT.
 5133                  *  Otherwise (tagged command), we will send
 5134                  *  an IDENTIFY + task attributes + ABORT TAG.
 5135                  */
 5136                 if (cp->tag == NO_TAG) {
 5137                         np->abrt_msg[1] = M_ABORT;
 5138                         np->abrt_tbl.size = 2;
 5139                 }
 5140                 else {
 5141                         np->abrt_msg[1] = cp->scsi_smsg[1];
 5142                         np->abrt_msg[2] = cp->scsi_smsg[2];
 5143                         np->abrt_msg[3] = M_ABORT_TAG;
 5144                         np->abrt_tbl.size = 4;
 5145                 }
 5146                 /*
 5147                  *  Keep track of software timeout condition, since the
 5148                  *  peripheral driver may not count retries on abort
 5149                  *  conditions not due to timeout.
 5150                  */
 5151                 if (cp->to_abort == 2)
 5152                         sym_set_cam_status(cp->cam_ccb, CAM_CMD_TIMEOUT);
 5153                 cp->to_abort = 0; /* We donnot expect to fail here */
 5154                 break;
 5155 
 5156         /*
 5157          *  The target has accepted our message and switched
 5158          *  to BUS FREE phase as we expected.
 5159          */
 5160         case SIR_ABORT_SENT:
 5161                 target = (INB (nc_sdid) & 0xf);
 5162                 tp = &np->target[target];
 5163 
 5164                 /*
 5165                 **  If we didn't abort anything, leave here.
 5166                 */
 5167                 if (np->abrt_msg[0] == M_ABORT)
 5168                         break;
 5169 
 5170                 /*
 5171                  *  If we sent a M_RESET, then a hardware reset has
 5172                  *  been performed by the target.
 5173                  *  - Reset everything to async 8 bit
 5174                  *  - Tell ourself to negotiate next time :-)
 5175                  *  - Prepare to clear all disconnected CCBs for
 5176                  *    this target from our task list (lun=task=-1)
 5177                  */
 5178                 lun = -1;
 5179                 task = -1;
 5180                 if (np->abrt_msg[0] == M_RESET) {
 5181                         tp->head.sval = 0;
 5182                         tp->head.wval = np->rv_scntl3;
 5183                         tp->head.uval = 0;
 5184                         tp->tinfo.current.period = 0;
 5185                         tp->tinfo.current.offset = 0;
 5186                         tp->tinfo.current.width  = BUS_8_BIT;
 5187                         tp->tinfo.current.options = 0;
 5188                 }
 5189 
 5190                 /*
 5191                  *  Otherwise, check for the LUN and TASK(s)
 5192                  *  concerned by the cancellation.
 5193                  *  If it is not ABORT_TAG then it is CLEAR_QUEUE
 5194                  *  or an ABORT message :-)
 5195                  */
 5196                 else {
 5197                         lun = np->abrt_msg[0] & 0x3f;
 5198                         if (np->abrt_msg[1] == M_ABORT_TAG)
 5199                                 task = np->abrt_msg[2];
 5200                 }
 5201 
 5202                 /*
 5203                  *  Complete all the CCBs the device should have
 5204                  *  aborted due to our 'kiss of death' message.
 5205                  */
 5206                 i = (INL (nc_scratcha) - np->squeue_ba) / 4;
 5207                 (void) sym_dequeue_from_squeue(np, i, target, lun, -1);
 5208                 (void) sym_clear_tasks(np, CAM_REQ_ABORTED, target, lun, task);
 5209                 sym_flush_comp_queue(np, 0);
 5210 
 5211                 /*
 5212                  *  If we sent a BDR, make uper layer aware of that.
 5213                  */
 5214                 if (np->abrt_msg[0] == M_RESET)
 5215                         xpt_async(AC_SENT_BDR, np->path, NULL);
 5216                 break;
 5217         }
 5218 
 5219         /*
 5220          *  Print to the log the message we intend to send.
 5221          */
 5222         if (num == SIR_TARGET_SELECTED) {
 5223                 PRINT_TARGET(np, target);
 5224                 sym_printl_hex("control msgout:", np->abrt_msg,
 5225                               np->abrt_tbl.size);
 5226                 np->abrt_tbl.size = cpu_to_scr(np->abrt_tbl.size);
 5227         }
 5228 
 5229         /*
 5230          *  Let the SCRIPTS processor continue.
 5231          */
 5232         OUTONB_STD ();
 5233 }
 5234 
 5235 /*
 5236  *  Gerard's alchemy:) that deals with with the data
 5237  *  pointer for both MDP and the residual calculation.
 5238  *
 5239  *  I didn't want to bloat the code by more than 200
 5240  *  lignes for the handling of both MDP and the residual.
 5241  *  This has been achieved by using a data pointer
 5242  *  representation consisting in an index in the data
 5243  *  array (dp_sg) and a negative offset (dp_ofs) that
 5244  *  have the following meaning:
 5245  *
 5246  *  - dp_sg = SYM_CONF_MAX_SG
 5247  *    we are at the end of the data script.
 5248  *  - dp_sg < SYM_CONF_MAX_SG
 5249  *    dp_sg points to the next entry of the scatter array
 5250  *    we want to transfer.
 5251  *  - dp_ofs < 0
 5252  *    dp_ofs represents the residual of bytes of the
 5253  *    previous entry scatter entry we will send first.
 5254  *  - dp_ofs = 0
 5255  *    no residual to send first.
 5256  *
 5257  *  The function sym_evaluate_dp() accepts an arbitray
 5258  *  offset (basically from the MDP message) and returns
 5259  *  the corresponding values of dp_sg and dp_ofs.
 5260  */
 5261 static int sym_evaluate_dp(hcb_p np, ccb_p cp, u32 scr, int *ofs)
 5262 {
 5263         u32     dp_scr;
 5264         int     dp_ofs, dp_sg, dp_sgmin;
 5265         int     tmp;
 5266         struct sym_pmc *pm;
 5267 
 5268         /*
 5269          *  Compute the resulted data pointer in term of a script
 5270          *  address within some DATA script and a signed byte offset.
 5271          */
 5272         dp_scr = scr;
 5273         dp_ofs = *ofs;
 5274         if      (dp_scr == SCRIPTA_BA (np, pm0_data))
 5275                 pm = &cp->phys.pm0;
 5276         else if (dp_scr == SCRIPTA_BA (np, pm1_data))
 5277                 pm = &cp->phys.pm1;
 5278         else
 5279                 pm = NULL;
 5280 
 5281         if (pm) {
 5282                 dp_scr  = scr_to_cpu(pm->ret);
 5283                 dp_ofs -= scr_to_cpu(pm->sg.size);
 5284         }
 5285 
 5286         /*
 5287          *  If we are auto-sensing, then we are done.
 5288          */
 5289         if (cp->host_flags & HF_SENSE) {
 5290                 *ofs = dp_ofs;
 5291                 return 0;
 5292         }
 5293 
 5294         /*
 5295          *  Deduce the index of the sg entry.
 5296          *  Keep track of the index of the first valid entry.
 5297          *  If result is dp_sg = SYM_CONF_MAX_SG, then we are at the
 5298          *  end of the data.
 5299          */
 5300         tmp = scr_to_cpu(cp->phys.head.goalp);
 5301         dp_sg = SYM_CONF_MAX_SG;
 5302         if (dp_scr != tmp)
 5303                 dp_sg -= (tmp - 8 - (int)dp_scr) / (2*4);
 5304         dp_sgmin = SYM_CONF_MAX_SG - cp->segments;
 5305 
 5306         /*
 5307          *  Move to the sg entry the data pointer belongs to.
 5308          *
 5309          *  If we are inside the data area, we expect result to be:
 5310          *
 5311          *  Either,
 5312          *      dp_ofs = 0 and dp_sg is the index of the sg entry
 5313          *      the data pointer belongs to (or the end of the data)
 5314          *  Or,
 5315          *      dp_ofs < 0 and dp_sg is the index of the sg entry
 5316          *      the data pointer belongs to + 1.
 5317          */
 5318         if (dp_ofs < 0) {
 5319                 int n;
 5320                 while (dp_sg > dp_sgmin) {
 5321                         --dp_sg;
 5322                         tmp = scr_to_cpu(cp->phys.data[dp_sg].size);
 5323                         n = dp_ofs + (tmp & 0xffffff);
 5324                         if (n > 0) {
 5325                                 ++dp_sg;
 5326                                 break;
 5327                         }
 5328                         dp_ofs = n;
 5329                 }
 5330         }
 5331         else if (dp_ofs > 0) {
 5332                 while (dp_sg < SYM_CONF_MAX_SG) {
 5333                         tmp = scr_to_cpu(cp->phys.data[dp_sg].size);
 5334                         dp_ofs -= (tmp & 0xffffff);
 5335                         ++dp_sg;
 5336                         if (dp_ofs <= 0)
 5337                                 break;
 5338                 }
 5339         }
 5340 
 5341         /*
 5342          *  Make sure the data pointer is inside the data area.
 5343          *  If not, return some error.
 5344          */
 5345         if      (dp_sg < dp_sgmin || (dp_sg == dp_sgmin && dp_ofs < 0))
 5346                 goto out_err;
 5347         else if (dp_sg > SYM_CONF_MAX_SG ||
 5348                  (dp_sg == SYM_CONF_MAX_SG && dp_ofs > 0))
 5349                 goto out_err;
 5350 
 5351         /*
 5352          *  Save the extreme pointer if needed.
 5353          */
 5354         if (dp_sg > cp->ext_sg ||
 5355             (dp_sg == cp->ext_sg && dp_ofs > cp->ext_ofs)) {
 5356                 cp->ext_sg  = dp_sg;
 5357                 cp->ext_ofs = dp_ofs;
 5358         }
 5359 
 5360         /*
 5361          *  Return data.
 5362          */
 5363         *ofs = dp_ofs;
 5364         return dp_sg;
 5365 
 5366 out_err:
 5367         return -1;
 5368 }
 5369 
 5370 /*
 5371  *  chip handler for MODIFY DATA POINTER MESSAGE
 5372  *
 5373  *  We also call this function on IGNORE WIDE RESIDUE
 5374  *  messages that do not match a SWIDE full condition.
 5375  *  Btw, we assume in that situation that such a message
 5376  *  is equivalent to a MODIFY DATA POINTER (offset=-1).
 5377  */
 5378 static void sym_modify_dp(hcb_p np, ccb_p cp, int ofs)
 5379 {
 5380         int dp_ofs      = ofs;
 5381         u32     dp_scr  = INL (nc_temp);
 5382         u32     dp_ret;
 5383         u32     tmp;
 5384         u_char  hflags;
 5385         int     dp_sg;
 5386         struct  sym_pmc *pm;
 5387 
 5388         /*
 5389          *  Not supported for auto-sense.
 5390          */
 5391         if (cp->host_flags & HF_SENSE)
 5392                 goto out_reject;
 5393 
 5394         /*
 5395          *  Apply our alchemy:) (see comments in sym_evaluate_dp()),
 5396          *  to the resulted data pointer.
 5397          */
 5398         dp_sg = sym_evaluate_dp(np, cp, dp_scr, &dp_ofs);
 5399         if (dp_sg < 0)
 5400                 goto out_reject;
 5401 
 5402         /*
 5403          *  And our alchemy:) allows to easily calculate the data
 5404          *  script address we want to return for the next data phase.
 5405          */
 5406         dp_ret = cpu_to_scr(cp->phys.head.goalp);
 5407         dp_ret = dp_ret - 8 - (SYM_CONF_MAX_SG - dp_sg) * (2*4);
 5408 
 5409         /*
 5410          *  If offset / scatter entry is zero we donnot need
 5411          *  a context for the new current data pointer.
 5412          */
 5413         if (dp_ofs == 0) {
 5414                 dp_scr = dp_ret;
 5415                 goto out_ok;
 5416         }
 5417 
 5418         /*
 5419          *  Get a context for the new current data pointer.
 5420          */
 5421         hflags = INB (HF_PRT);
 5422 
 5423         if (hflags & HF_DP_SAVED)
 5424                 hflags ^= HF_ACT_PM;
 5425 
 5426         if (!(hflags & HF_ACT_PM)) {
 5427                 pm  = &cp->phys.pm0;
 5428                 dp_scr = SCRIPTA_BA (np, pm0_data);
 5429         }
 5430         else {
 5431                 pm = &cp->phys.pm1;
 5432                 dp_scr = SCRIPTA_BA (np, pm1_data);
 5433         }
 5434 
 5435         hflags &= ~(HF_DP_SAVED);
 5436 
 5437         OUTB (HF_PRT, hflags);
 5438 
 5439         /*
 5440          *  Set up the new current data pointer.
 5441          *  ofs < 0 there, and for the next data phase, we
 5442          *  want to transfer part of the data of the sg entry
 5443          *  corresponding to index dp_sg-1 prior to returning
 5444          *  to the main data script.
 5445          */
 5446         pm->ret = cpu_to_scr(dp_ret);
 5447         tmp  = scr_to_cpu(cp->phys.data[dp_sg-1].addr);
 5448         tmp += scr_to_cpu(cp->phys.data[dp_sg-1].size) + dp_ofs;
 5449         pm->sg.addr = cpu_to_scr(tmp);
 5450         pm->sg.size = cpu_to_scr(-dp_ofs);
 5451 
 5452 out_ok:
 5453         OUTL (nc_temp, dp_scr);
 5454         OUTL_DSP (SCRIPTA_BA (np, clrack));
 5455         return;
 5456 
 5457 out_reject:
 5458         OUTL_DSP (SCRIPTB_BA (np, msg_bad));
 5459 }
 5460 
 5461 /*
 5462  *  chip calculation of the data residual.
 5463  *
 5464  *  As I used to say, the requirement of data residual
 5465  *  in SCSI is broken, useless and cannot be achieved
 5466  *  without huge complexity.
 5467  *  But most OSes and even the official CAM require it.
 5468  *  When stupidity happens to be so widely spread inside
 5469  *  a community, it gets hard to convince.
 5470  *
 5471  *  Anyway, I don't care, since I am not going to use
 5472  *  any software that considers this data residual as
 5473  *  a relevant information. :)
 5474  */
 5475 static int sym_compute_residual(hcb_p np, ccb_p cp)
 5476 {
 5477         int dp_sg, dp_sgmin, resid = 0;
 5478         int dp_ofs = 0;
 5479 
 5480         /*
 5481          *  Check for some data lost or just thrown away.
 5482          *  We are not required to be quite accurate in this
 5483          *  situation. Btw, if we are odd for output and the
 5484          *  device claims some more data, it may well happen
 5485          *  than our residual be zero. :-)
 5486          */
 5487         if (cp->xerr_status & (XE_EXTRA_DATA|XE_SODL_UNRUN|XE_SWIDE_OVRUN)) {
 5488                 if (cp->xerr_status & XE_EXTRA_DATA)
 5489                         resid -= cp->extra_bytes;
 5490                 if (cp->xerr_status & XE_SODL_UNRUN)
 5491                         ++resid;
 5492                 if (cp->xerr_status & XE_SWIDE_OVRUN)
 5493                         --resid;
 5494         }
 5495 
 5496         /*
 5497          *  If all data has been transferred,
 5498          *  there is no residual.
 5499          */
 5500         if (cp->phys.head.lastp == cp->phys.head.goalp)
 5501                 return resid;
 5502 
 5503         /*
 5504          *  If no data transfer occurs, or if the data
 5505          *  pointer is weird, return full residual.
 5506          */
 5507         if (cp->startp == cp->phys.head.lastp ||
 5508             sym_evaluate_dp(np, cp, scr_to_cpu(cp->phys.head.lastp),
 5509                             &dp_ofs) < 0) {
 5510                 return cp->data_len;
 5511         }
 5512 
 5513         /*
 5514          *  If we were auto-sensing, then we are done.
 5515          */
 5516         if (cp->host_flags & HF_SENSE) {
 5517                 return -dp_ofs;
 5518         }
 5519 
 5520         /*
 5521          *  We are now full comfortable in the computation
 5522          *  of the data residual (2's complement).
 5523          */
 5524         dp_sgmin = SYM_CONF_MAX_SG - cp->segments;
 5525         resid = -cp->ext_ofs;
 5526         for (dp_sg = cp->ext_sg; dp_sg < SYM_CONF_MAX_SG; ++dp_sg) {
 5527                 u_int tmp = scr_to_cpu(cp->phys.data[dp_sg].size);
 5528                 resid += (tmp & 0xffffff);
 5529         }
 5530 
 5531         /*
 5532          *  Hopefully, the result is not too wrong.
 5533          */
 5534         return resid;
 5535 }
 5536 
 5537 /*
 5538  *  Print out the content of a SCSI message.
 5539  */
 5540 static int sym_show_msg (u_char * msg)
 5541 {
 5542         u_char i;
 5543         printf ("%x",*msg);
 5544         if (*msg==M_EXTENDED) {
 5545                 for (i=1;i<8;i++) {
 5546                         if (i-1>msg[1]) break;
 5547                         printf ("-%x",msg[i]);
 5548                 }
 5549                 return (i+1);
 5550         } else if ((*msg & 0xf0) == 0x20) {
 5551                 printf ("-%x",msg[1]);
 5552                 return (2);
 5553         }
 5554         return (1);
 5555 }
 5556 
 5557 static void sym_print_msg (ccb_p cp, char *label, u_char *msg)
 5558 {
 5559         PRINT_ADDR(cp);
 5560         if (label)
 5561                 printf ("%s: ", label);
 5562 
 5563         (void) sym_show_msg (msg);
 5564         printf (".\n");
 5565 }
 5566 
 5567 /*
 5568  *  Negotiation for WIDE and SYNCHRONOUS DATA TRANSFER.
 5569  *
 5570  *  When we try to negotiate, we append the negotiation message
 5571  *  to the identify and (maybe) simple tag message.
 5572  *  The host status field is set to HS_NEGOTIATE to mark this
 5573  *  situation.
 5574  *
 5575  *  If the target doesn't answer this message immediately
 5576  *  (as required by the standard), the SIR_NEGO_FAILED interrupt
 5577  *  will be raised eventually.
 5578  *  The handler removes the HS_NEGOTIATE status, and sets the
 5579  *  negotiated value to the default (async / nowide).
 5580  *
 5581  *  If we receive a matching answer immediately, we check it
 5582  *  for validity, and set the values.
 5583  *
 5584  *  If we receive a Reject message immediately, we assume the
 5585  *  negotiation has failed, and fall back to standard values.
 5586  *
 5587  *  If we receive a negotiation message while not in HS_NEGOTIATE
 5588  *  state, it's a target initiated negotiation. We prepare a
 5589  *  (hopefully) valid answer, set our parameters, and send back
 5590  *  this answer to the target.
 5591  *
 5592  *  If the target doesn't fetch the answer (no message out phase),
 5593  *  we assume the negotiation has failed, and fall back to default
 5594  *  settings (SIR_NEGO_PROTO interrupt).
 5595  *
 5596  *  When we set the values, we adjust them in all ccbs belonging
 5597  *  to this target, in the controller's register, and in the "phys"
 5598  *  field of the controller's struct sym_hcb.
 5599  */
 5600 
 5601 /*
 5602  *  chip handler for SYNCHRONOUS DATA TRANSFER REQUEST (SDTR) message.
 5603  */
 5604 static void sym_sync_nego(hcb_p np, tcb_p tp, ccb_p cp)
 5605 {
 5606         u_char  chg, ofs, per, fak, div;
 5607         int     req = 1;
 5608 
 5609         /*
 5610          *  Synchronous request message received.
 5611          */
 5612         if (DEBUG_FLAGS & DEBUG_NEGO) {
 5613                 sym_print_msg(cp, "sync msgin", np->msgin);
 5614         }
 5615 
 5616         /*
 5617          * request or answer ?
 5618          */
 5619         if (INB (HS_PRT) == HS_NEGOTIATE) {
 5620                 OUTB (HS_PRT, HS_BUSY);
 5621                 if (cp->nego_status && cp->nego_status != NS_SYNC)
 5622                         goto reject_it;
 5623                 req = 0;
 5624         }
 5625 
 5626         /*
 5627          *  get requested values.
 5628          */
 5629         chg = 0;
 5630         per = np->msgin[3];
 5631         ofs = np->msgin[4];
 5632 
 5633         /*
 5634          *  check values against our limits.
 5635          */
 5636         if (ofs) {
 5637                 if (ofs > np->maxoffs)
 5638                         {chg = 1; ofs = np->maxoffs;}
 5639                 if (req) {
 5640                         if (ofs > tp->tinfo.user.offset)
 5641                                 {chg = 1; ofs = tp->tinfo.user.offset;}
 5642                 }
 5643         }
 5644 
 5645         if (ofs) {
 5646                 if (per < np->minsync)
 5647                         {chg = 1; per = np->minsync;}
 5648                 if (req) {
 5649                         if (per < tp->tinfo.user.period)
 5650                                 {chg = 1; per = tp->tinfo.user.period;}
 5651                 }
 5652         }
 5653 
 5654         div = fak = 0;
 5655         if (ofs && sym_getsync(np, 0, per, &div, &fak) < 0)
 5656                 goto reject_it;
 5657 
 5658         if (DEBUG_FLAGS & DEBUG_NEGO) {
 5659                 PRINT_ADDR(cp);
 5660                 printf ("sdtr: ofs=%d per=%d div=%d fak=%d chg=%d.\n",
 5661                         ofs, per, div, fak, chg);
 5662         }
 5663 
 5664         /*
 5665          *  This was an answer message
 5666          */
 5667         if (req == 0) {
 5668                 if (chg)        /* Answer wasn't acceptable. */
 5669                         goto reject_it;
 5670                 sym_setsync (np, cp, ofs, per, div, fak);
 5671                 OUTL_DSP (SCRIPTA_BA (np, clrack));
 5672                 return;
 5673         }
 5674 
 5675         /*
 5676          *  It was a request. Set value and
 5677          *  prepare an answer message
 5678          */
 5679         sym_setsync (np, cp, ofs, per, div, fak);
 5680 
 5681         np->msgout[0] = M_EXTENDED;
 5682         np->msgout[1] = 3;
 5683         np->msgout[2] = M_X_SYNC_REQ;
 5684         np->msgout[3] = per;
 5685         np->msgout[4] = ofs;
 5686 
 5687         cp->nego_status = NS_SYNC;
 5688 
 5689         if (DEBUG_FLAGS & DEBUG_NEGO) {
 5690                 sym_print_msg(cp, "sync msgout", np->msgout);
 5691         }
 5692 
 5693         np->msgin [0] = M_NOOP;
 5694 
 5695         OUTL_DSP (SCRIPTB_BA (np, sdtr_resp));
 5696         return;
 5697 reject_it:
 5698         sym_setsync (np, cp, 0, 0, 0, 0);
 5699         OUTL_DSP (SCRIPTB_BA (np, msg_bad));
 5700 }
 5701 
 5702 /*
 5703  *  chip handler for PARALLEL PROTOCOL REQUEST (PPR) message.
 5704  */
 5705 static void sym_ppr_nego(hcb_p np, tcb_p tp, ccb_p cp)
 5706 {
 5707         u_char  chg, ofs, per, fak, dt, div, wide;
 5708         int     req = 1;
 5709 
 5710         /*
 5711          * Synchronous request message received.
 5712          */
 5713         if (DEBUG_FLAGS & DEBUG_NEGO) {
 5714                 sym_print_msg(cp, "ppr msgin", np->msgin);
 5715         }
 5716 
 5717         /*
 5718          *  get requested values.
 5719          */
 5720         chg  = 0;
 5721         per  = np->msgin[3];
 5722         ofs  = np->msgin[5];
 5723         wide = np->msgin[6];
 5724         dt   = np->msgin[7] & PPR_OPT_DT;
 5725 
 5726         /*
 5727          * request or answer ?
 5728          */
 5729         if (INB (HS_PRT) == HS_NEGOTIATE) {
 5730                 OUTB (HS_PRT, HS_BUSY);
 5731                 if (cp->nego_status && cp->nego_status != NS_PPR)
 5732                         goto reject_it;
 5733                 req = 0;
 5734         }
 5735 
 5736         /*
 5737          *  check values against our limits.
 5738          */
 5739         if (wide > np->maxwide)
 5740                 {chg = 1; wide = np->maxwide;}
 5741         if (!wide || !(np->features & FE_ULTRA3))
 5742                 dt &= ~PPR_OPT_DT;
 5743         if (req) {
 5744                 if (wide > tp->tinfo.user.width)
 5745                         {chg = 1; wide = tp->tinfo.user.width;}
 5746         }
 5747 
 5748         if (!(np->features & FE_U3EN))  /* Broken U3EN bit not supported */
 5749                 dt &= ~PPR_OPT_DT;
 5750 
 5751         if (dt != (np->msgin[7] & PPR_OPT_MASK)) chg = 1;
 5752 
 5753         if (ofs) {
 5754                 if (dt) {
 5755                         if (ofs > np->maxoffs_dt)
 5756                                 {chg = 1; ofs = np->maxoffs_dt;}
 5757                 }
 5758                 else if (ofs > np->maxoffs)
 5759                         {chg = 1; ofs = np->maxoffs;}
 5760                 if (req) {
 5761                         if (ofs > tp->tinfo.user.offset)
 5762                                 {chg = 1; ofs = tp->tinfo.user.offset;}
 5763                 }
 5764         }
 5765 
 5766         if (ofs) {
 5767                 if (dt) {
 5768                         if (per < np->minsync_dt)
 5769                                 {chg = 1; per = np->minsync_dt;}
 5770                 }
 5771                 else if (per < np->minsync)
 5772                         {chg = 1; per = np->minsync;}
 5773                 if (req) {
 5774                         if (per < tp->tinfo.user.period)
 5775                                 {chg = 1; per = tp->tinfo.user.period;}
 5776                 }
 5777         }
 5778 
 5779         div = fak = 0;
 5780         if (ofs && sym_getsync(np, dt, per, &div, &fak) < 0)
 5781                 goto reject_it;
 5782 
 5783         if (DEBUG_FLAGS & DEBUG_NEGO) {
 5784                 PRINT_ADDR(cp);
 5785                 printf ("ppr: "
 5786                         "dt=%x ofs=%d per=%d wide=%d div=%d fak=%d chg=%d.\n",
 5787                         dt, ofs, per, wide, div, fak, chg);
 5788         }
 5789 
 5790         /*
 5791          *  It was an answer.
 5792          */
 5793         if (req == 0) {
 5794                 if (chg)        /* Answer wasn't acceptable */
 5795                         goto reject_it;
 5796                 sym_setpprot (np, cp, dt, ofs, per, wide, div, fak);
 5797                 OUTL_DSP (SCRIPTA_BA (np, clrack));
 5798                 return;
 5799         }
 5800 
 5801         /*
 5802          *  It was a request. Set value and
 5803          *  prepare an answer message
 5804          */
 5805         sym_setpprot (np, cp, dt, ofs, per, wide, div, fak);
 5806 
 5807         np->msgout[0] = M_EXTENDED;
 5808         np->msgout[1] = 6;
 5809         np->msgout[2] = M_X_PPR_REQ;
 5810         np->msgout[3] = per;
 5811         np->msgout[4] = 0;
 5812         np->msgout[5] = ofs;
 5813         np->msgout[6] = wide;
 5814         np->msgout[7] = dt;
 5815 
 5816         cp->nego_status = NS_PPR;
 5817 
 5818         if (DEBUG_FLAGS & DEBUG_NEGO) {
 5819                 sym_print_msg(cp, "ppr msgout", np->msgout);
 5820         }
 5821 
 5822         np->msgin [0] = M_NOOP;
 5823 
 5824         OUTL_DSP (SCRIPTB_BA (np, ppr_resp));
 5825         return;
 5826 reject_it:
 5827         sym_setpprot (np, cp, 0, 0, 0, 0, 0, 0);
 5828         OUTL_DSP (SCRIPTB_BA (np, msg_bad));
 5829         /*
 5830          *  If it was a device response that should result in
 5831          *  ST, we may want to try a legacy negotiation later.
 5832          */
 5833         if (!req && !dt) {
 5834                 tp->tinfo.goal.options = 0;
 5835                 tp->tinfo.goal.width   = wide;
 5836                 tp->tinfo.goal.period  = per;
 5837                 tp->tinfo.goal.offset  = ofs;
 5838         }
 5839 }
 5840 
 5841 /*
 5842  *  chip handler for WIDE DATA TRANSFER REQUEST (WDTR) message.
 5843  */
 5844 static void sym_wide_nego(hcb_p np, tcb_p tp, ccb_p cp)
 5845 {
 5846         u_char  chg, wide;
 5847         int     req = 1;
 5848 
 5849         /*
 5850          *  Wide request message received.
 5851          */
 5852         if (DEBUG_FLAGS & DEBUG_NEGO) {
 5853                 sym_print_msg(cp, "wide msgin", np->msgin);
 5854         }
 5855 
 5856         /*
 5857          * Is it a request from the device?
 5858          */
 5859         if (INB (HS_PRT) == HS_NEGOTIATE) {
 5860                 OUTB (HS_PRT, HS_BUSY);
 5861                 if (cp->nego_status && cp->nego_status != NS_WIDE)
 5862                         goto reject_it;
 5863                 req = 0;
 5864         }
 5865 
 5866         /*
 5867          *  get requested values.
 5868          */
 5869         chg  = 0;
 5870         wide = np->msgin[3];
 5871 
 5872         /*
 5873          *  check values against driver limits.
 5874          */
 5875         if (wide > np->maxwide)
 5876                 {chg = 1; wide = np->maxwide;}
 5877         if (req) {
 5878                 if (wide > tp->tinfo.user.width)
 5879                         {chg = 1; wide = tp->tinfo.user.width;}
 5880         }
 5881 
 5882         if (DEBUG_FLAGS & DEBUG_NEGO) {
 5883                 PRINT_ADDR(cp);
 5884                 printf ("wdtr: wide=%d chg=%d.\n", wide, chg);
 5885         }
 5886 
 5887         /*
 5888          * This was an answer message
 5889          */
 5890         if (req == 0) {
 5891                 if (chg)        /*  Answer wasn't acceptable. */
 5892                         goto reject_it;
 5893                 sym_setwide (np, cp, wide);
 5894 
 5895                 /*
 5896                  * Negotiate for SYNC immediately after WIDE response.
 5897                  * This allows to negotiate for both WIDE and SYNC on
 5898                  * a single SCSI command (Suggested by Justin Gibbs).
 5899                  */
 5900                 if (tp->tinfo.goal.offset) {
 5901                         np->msgout[0] = M_EXTENDED;
 5902                         np->msgout[1] = 3;
 5903                         np->msgout[2] = M_X_SYNC_REQ;
 5904                         np->msgout[3] = tp->tinfo.goal.period;
 5905                         np->msgout[4] = tp->tinfo.goal.offset;
 5906 
 5907                         if (DEBUG_FLAGS & DEBUG_NEGO) {
 5908                                 sym_print_msg(cp, "sync msgout", np->msgout);
 5909                         }
 5910 
 5911                         cp->nego_status = NS_SYNC;
 5912                         OUTB (HS_PRT, HS_NEGOTIATE);
 5913                         OUTL_DSP (SCRIPTB_BA (np, sdtr_resp));
 5914                         return;
 5915                 }
 5916 
 5917                 OUTL_DSP (SCRIPTA_BA (np, clrack));
 5918                 return;
 5919         }
 5920 
 5921         /*
 5922          *  It was a request, set value and
 5923          *  prepare an answer message
 5924          */
 5925         sym_setwide (np, cp, wide);
 5926 
 5927         np->msgout[0] = M_EXTENDED;
 5928         np->msgout[1] = 2;
 5929         np->msgout[2] = M_X_WIDE_REQ;
 5930         np->msgout[3] = wide;
 5931 
 5932         np->msgin [0] = M_NOOP;
 5933 
 5934         cp->nego_status = NS_WIDE;
 5935 
 5936         if (DEBUG_FLAGS & DEBUG_NEGO) {
 5937                 sym_print_msg(cp, "wide msgout", np->msgout);
 5938         }
 5939 
 5940         OUTL_DSP (SCRIPTB_BA (np, wdtr_resp));
 5941         return;
 5942 reject_it:
 5943         OUTL_DSP (SCRIPTB_BA (np, msg_bad));
 5944 }
 5945 
 5946 /*
 5947  *  Reset SYNC or WIDE to default settings.
 5948  *
 5949  *  Called when a negotiation does not succeed either
 5950  *  on rejection or on protocol error.
 5951  *
 5952  *  If it was a PPR that made problems, we may want to
 5953  *  try a legacy negotiation later.
 5954  */
 5955 static void sym_nego_default(hcb_p np, tcb_p tp, ccb_p cp)
 5956 {
 5957         /*
 5958          *  any error in negotiation:
 5959          *  fall back to default mode.
 5960          */
 5961         switch (cp->nego_status) {
 5962         case NS_PPR:
 5963 #if 0
 5964                 sym_setpprot (np, cp, 0, 0, 0, 0, 0, 0);
 5965 #else
 5966                 tp->tinfo.goal.options = 0;
 5967                 if (tp->tinfo.goal.period < np->minsync)
 5968                         tp->tinfo.goal.period = np->minsync;
 5969                 if (tp->tinfo.goal.offset > np->maxoffs)
 5970                         tp->tinfo.goal.offset = np->maxoffs;
 5971 #endif
 5972                 break;
 5973         case NS_SYNC:
 5974                 sym_setsync (np, cp, 0, 0, 0, 0);
 5975                 break;
 5976         case NS_WIDE:
 5977                 sym_setwide (np, cp, 0);
 5978                 break;
 5979         }
 5980         np->msgin [0] = M_NOOP;
 5981         np->msgout[0] = M_NOOP;
 5982         cp->nego_status = 0;
 5983 }
 5984 
 5985 /*
 5986  *  chip handler for MESSAGE REJECT received in response to
 5987  *  a WIDE or SYNCHRONOUS negotiation.
 5988  */
 5989 static void sym_nego_rejected(hcb_p np, tcb_p tp, ccb_p cp)
 5990 {
 5991         sym_nego_default(np, tp, cp);
 5992         OUTB (HS_PRT, HS_BUSY);
 5993 }
 5994 
 5995 /*
 5996  *  chip exception handler for programmed interrupts.
 5997  */
 5998 static void sym_int_sir (hcb_p np)
 5999 {
 6000         u_char  num     = INB (nc_dsps);
 6001         u32     dsa     = INL (nc_dsa);
 6002         ccb_p   cp      = sym_ccb_from_dsa(np, dsa);
 6003         u_char  target  = INB (nc_sdid) & 0x0f;
 6004         tcb_p   tp      = &np->target[target];
 6005         int     tmp;
 6006 
 6007         SYM_LOCK_ASSERT(MA_OWNED);
 6008 
 6009         if (DEBUG_FLAGS & DEBUG_TINY) printf ("I#%d", num);
 6010 
 6011         switch (num) {
 6012         /*
 6013          *  Command has been completed with error condition
 6014          *  or has been auto-sensed.
 6015          */
 6016         case SIR_COMPLETE_ERROR:
 6017                 sym_complete_error(np, cp);
 6018                 return;
 6019         /*
 6020          *  The C code is currently trying to recover from something.
 6021          *  Typically, user want to abort some command.
 6022          */
 6023         case SIR_SCRIPT_STOPPED:
 6024         case SIR_TARGET_SELECTED:
 6025         case SIR_ABORT_SENT:
 6026                 sym_sir_task_recovery(np, num);
 6027                 return;
 6028         /*
 6029          *  The device didn't go to MSG OUT phase after having
 6030          *  been selected with ATN. We donnot want to handle
 6031          *  that.
 6032          */
 6033         case SIR_SEL_ATN_NO_MSG_OUT:
 6034                 printf ("%s:%d: No MSG OUT phase after selection with ATN.\n",
 6035                         sym_name (np), target);
 6036                 goto out_stuck;
 6037         /*
 6038          *  The device didn't switch to MSG IN phase after
 6039          *  having reseleted the initiator.
 6040          */
 6041         case SIR_RESEL_NO_MSG_IN:
 6042                 printf ("%s:%d: No MSG IN phase after reselection.\n",
 6043                         sym_name (np), target);
 6044                 goto out_stuck;
 6045         /*
 6046          *  After reselection, the device sent a message that wasn't
 6047          *  an IDENTIFY.
 6048          */
 6049         case SIR_RESEL_NO_IDENTIFY:
 6050                 printf ("%s:%d: No IDENTIFY after reselection.\n",
 6051                         sym_name (np), target);
 6052                 goto out_stuck;
 6053         /*
 6054          *  The device reselected a LUN we donnot know about.
 6055          */
 6056         case SIR_RESEL_BAD_LUN:
 6057                 np->msgout[0] = M_RESET;
 6058                 goto out;
 6059         /*
 6060          *  The device reselected for an untagged nexus and we
 6061          *  haven't any.
 6062          */
 6063         case SIR_RESEL_BAD_I_T_L:
 6064                 np->msgout[0] = M_ABORT;
 6065                 goto out;
 6066         /*
 6067          *  The device reselected for a tagged nexus that we donnot
 6068          *  have.
 6069          */
 6070         case SIR_RESEL_BAD_I_T_L_Q:
 6071                 np->msgout[0] = M_ABORT_TAG;
 6072                 goto out;
 6073         /*
 6074          *  The SCRIPTS let us know that the device has grabbed
 6075          *  our message and will abort the job.
 6076          */
 6077         case SIR_RESEL_ABORTED:
 6078                 np->lastmsg = np->msgout[0];
 6079                 np->msgout[0] = M_NOOP;
 6080                 printf ("%s:%d: message %x sent on bad reselection.\n",
 6081                         sym_name (np), target, np->lastmsg);
 6082                 goto out;
 6083         /*
 6084          *  The SCRIPTS let us know that a message has been
 6085          *  successfully sent to the device.
 6086          */
 6087         case SIR_MSG_OUT_DONE:
 6088                 np->lastmsg = np->msgout[0];
 6089                 np->msgout[0] = M_NOOP;
 6090                 /* Should we really care of that */
 6091                 if (np->lastmsg == M_PARITY || np->lastmsg == M_ID_ERROR) {
 6092                         if (cp) {
 6093                                 cp->xerr_status &= ~XE_PARITY_ERR;
 6094                                 if (!cp->xerr_status)
 6095                                         OUTOFFB (HF_PRT, HF_EXT_ERR);
 6096                         }
 6097                 }
 6098                 goto out;
 6099         /*
 6100          *  The device didn't send a GOOD SCSI status.
 6101          *  We may have some work to do prior to allow
 6102          *  the SCRIPTS processor to continue.
 6103          */
 6104         case SIR_BAD_SCSI_STATUS:
 6105                 if (!cp)
 6106                         goto out;
 6107                 sym_sir_bad_scsi_status(np, cp);
 6108                 return;
 6109         /*
 6110          *  We are asked by the SCRIPTS to prepare a
 6111          *  REJECT message.
 6112          */
 6113         case SIR_REJECT_TO_SEND:
 6114                 sym_print_msg(cp, "M_REJECT to send for ", np->msgin);
 6115                 np->msgout[0] = M_REJECT;
 6116                 goto out;
 6117         /*
 6118          *  We have been ODD at the end of a DATA IN
 6119          *  transfer and the device didn't send a
 6120          *  IGNORE WIDE RESIDUE message.
 6121          *  It is a data overrun condition.
 6122          */
 6123         case SIR_SWIDE_OVERRUN:
 6124                 if (cp) {
 6125                         OUTONB (HF_PRT, HF_EXT_ERR);
 6126                         cp->xerr_status |= XE_SWIDE_OVRUN;
 6127                 }
 6128                 goto out;
 6129         /*
 6130          *  We have been ODD at the end of a DATA OUT
 6131          *  transfer.
 6132          *  It is a data underrun condition.
 6133          */
 6134         case SIR_SODL_UNDERRUN:
 6135                 if (cp) {
 6136                         OUTONB (HF_PRT, HF_EXT_ERR);
 6137                         cp->xerr_status |= XE_SODL_UNRUN;
 6138                 }
 6139                 goto out;
 6140         /*
 6141          *  The device wants us to transfer more data than
 6142          *  expected or in the wrong direction.
 6143          *  The number of extra bytes is in scratcha.
 6144          *  It is a data overrun condition.
 6145          */
 6146         case SIR_DATA_OVERRUN:
 6147                 if (cp) {
 6148                         OUTONB (HF_PRT, HF_EXT_ERR);
 6149                         cp->xerr_status |= XE_EXTRA_DATA;
 6150                         cp->extra_bytes += INL (nc_scratcha);
 6151                 }
 6152                 goto out;
 6153         /*
 6154          *  The device switched to an illegal phase (4/5).
 6155          */
 6156         case SIR_BAD_PHASE:
 6157                 if (cp) {
 6158                         OUTONB (HF_PRT, HF_EXT_ERR);
 6159                         cp->xerr_status |= XE_BAD_PHASE;
 6160                 }
 6161                 goto out;
 6162         /*
 6163          *  We received a message.
 6164          */
 6165         case SIR_MSG_RECEIVED:
 6166                 if (!cp)
 6167                         goto out_stuck;
 6168                 switch (np->msgin [0]) {
 6169                 /*
 6170                  *  We received an extended message.
 6171                  *  We handle MODIFY DATA POINTER, SDTR, WDTR
 6172                  *  and reject all other extended messages.
 6173                  */
 6174                 case M_EXTENDED:
 6175                         switch (np->msgin [2]) {
 6176                         case M_X_MODIFY_DP:
 6177                                 if (DEBUG_FLAGS & DEBUG_POINTER)
 6178                                         sym_print_msg(cp,"modify DP",np->msgin);
 6179                                 tmp = (np->msgin[3]<<24) + (np->msgin[4]<<16) +
 6180                                       (np->msgin[5]<<8)  + (np->msgin[6]);
 6181                                 sym_modify_dp(np, cp, tmp);
 6182                                 return;
 6183                         case M_X_SYNC_REQ:
 6184                                 sym_sync_nego(np, tp, cp);
 6185                                 return;
 6186                         case M_X_PPR_REQ:
 6187                                 sym_ppr_nego(np, tp, cp);
 6188                                 return;
 6189                         case M_X_WIDE_REQ:
 6190                                 sym_wide_nego(np, tp, cp);
 6191                                 return;
 6192                         default:
 6193                                 goto out_reject;
 6194                         }
 6195                         break;
 6196                 /*
 6197                  *  We received a 1/2 byte message not handled from SCRIPTS.
 6198                  *  We are only expecting MESSAGE REJECT and IGNORE WIDE
 6199                  *  RESIDUE messages that haven't been anticipated by
 6200                  *  SCRIPTS on SWIDE full condition. Unanticipated IGNORE
 6201                  *  WIDE RESIDUE messages are aliased as MODIFY DP (-1).
 6202                  */
 6203                 case M_IGN_RESIDUE:
 6204                         if (DEBUG_FLAGS & DEBUG_POINTER)
 6205                                 sym_print_msg(cp,"ign wide residue", np->msgin);
 6206                         sym_modify_dp(np, cp, -1);
 6207                         return;
 6208                 case M_REJECT:
 6209                         if (INB (HS_PRT) == HS_NEGOTIATE)
 6210                                 sym_nego_rejected(np, tp, cp);
 6211                         else {
 6212                                 PRINT_ADDR(cp);
 6213                                 printf ("M_REJECT received (%x:%x).\n",
 6214                                         scr_to_cpu(np->lastmsg), np->msgout[0]);
 6215                         }
 6216                         goto out_clrack;
 6217                         break;
 6218                 default:
 6219                         goto out_reject;
 6220                 }
 6221                 break;
 6222         /*
 6223          *  We received an unknown message.
 6224          *  Ignore all MSG IN phases and reject it.
 6225          */
 6226         case SIR_MSG_WEIRD:
 6227                 sym_print_msg(cp, "WEIRD message received", np->msgin);
 6228                 OUTL_DSP (SCRIPTB_BA (np, msg_weird));
 6229                 return;
 6230         /*
 6231          *  Negotiation failed.
 6232          *  Target does not send us the reply.
 6233          *  Remove the HS_NEGOTIATE status.
 6234          */
 6235         case SIR_NEGO_FAILED:
 6236                 OUTB (HS_PRT, HS_BUSY);
 6237         /*
 6238          *  Negotiation failed.
 6239          *  Target does not want answer message.
 6240          */
 6241         case SIR_NEGO_PROTO:
 6242                 sym_nego_default(np, tp, cp);
 6243                 goto out;
 6244         }
 6245 
 6246 out:
 6247         OUTONB_STD ();
 6248         return;
 6249 out_reject:
 6250         OUTL_DSP (SCRIPTB_BA (np, msg_bad));
 6251         return;
 6252 out_clrack:
 6253         OUTL_DSP (SCRIPTA_BA (np, clrack));
 6254         return;
 6255 out_stuck:
 6256         return;
 6257 }
 6258 
 6259 /*
 6260  *  Acquire a control block
 6261  */
 6262 static  ccb_p sym_get_ccb (hcb_p np, u_char tn, u_char ln, u_char tag_order)
 6263 {
 6264         tcb_p tp = &np->target[tn];
 6265         lcb_p lp = sym_lp(tp, ln);
 6266         u_short tag = NO_TAG;
 6267         SYM_QUEHEAD *qp;
 6268         ccb_p cp = (ccb_p) NULL;
 6269 
 6270         /*
 6271          *  Look for a free CCB
 6272          */
 6273         if (sym_que_empty(&np->free_ccbq))
 6274                 goto out;
 6275         qp = sym_remque_head(&np->free_ccbq);
 6276         if (!qp)
 6277                 goto out;
 6278         cp = sym_que_entry(qp, struct sym_ccb, link_ccbq);
 6279 
 6280         /*
 6281          *  If the LCB is not yet available and the LUN
 6282          *  has been probed ok, try to allocate the LCB.
 6283          */
 6284         if (!lp && sym_is_bit(tp->lun_map, ln)) {
 6285                 lp = sym_alloc_lcb(np, tn, ln);
 6286                 if (!lp)
 6287                         goto out_free;
 6288         }
 6289 
 6290         /*
 6291          *  If the LCB is not available here, then the
 6292          *  logical unit is not yet discovered. For those
 6293          *  ones only accept 1 SCSI IO per logical unit,
 6294          *  since we cannot allow disconnections.
 6295          */
 6296         if (!lp) {
 6297                 if (!sym_is_bit(tp->busy0_map, ln))
 6298                         sym_set_bit(tp->busy0_map, ln);
 6299                 else
 6300                         goto out_free;
 6301         } else {
 6302                 /*
 6303                  *  If we have been asked for a tagged command.
 6304                  */
 6305                 if (tag_order) {
 6306                         /*
 6307                          *  Debugging purpose.
 6308                          */
 6309                         assert(lp->busy_itl == 0);
 6310                         /*
 6311                          *  Allocate resources for tags if not yet.
 6312                          */
 6313                         if (!lp->cb_tags) {
 6314                                 sym_alloc_lcb_tags(np, tn, ln);
 6315                                 if (!lp->cb_tags)
 6316                                         goto out_free;
 6317                         }
 6318                         /*
 6319                          *  Get a tag for this SCSI IO and set up
 6320                          *  the CCB bus address for reselection,
 6321                          *  and count it for this LUN.
 6322                          *  Toggle reselect path to tagged.
 6323                          */
 6324                         if (lp->busy_itlq < SYM_CONF_MAX_TASK) {
 6325                                 tag = lp->cb_tags[lp->ia_tag];
 6326                                 if (++lp->ia_tag == SYM_CONF_MAX_TASK)
 6327                                         lp->ia_tag = 0;
 6328                                 lp->itlq_tbl[tag] = cpu_to_scr(cp->ccb_ba);
 6329                                 ++lp->busy_itlq;
 6330                                 lp->head.resel_sa =
 6331                                         cpu_to_scr(SCRIPTA_BA (np, resel_tag));
 6332                         }
 6333                         else
 6334                                 goto out_free;
 6335                 }
 6336                 /*
 6337                  *  This command will not be tagged.
 6338                  *  If we already have either a tagged or untagged
 6339                  *  one, refuse to overlap this untagged one.
 6340                  */
 6341                 else {
 6342                         /*
 6343                          *  Debugging purpose.
 6344                          */
 6345                         assert(lp->busy_itl == 0 && lp->busy_itlq == 0);
 6346                         /*
 6347                          *  Count this nexus for this LUN.
 6348                          *  Set up the CCB bus address for reselection.
 6349                          *  Toggle reselect path to untagged.
 6350                          */
 6351                         if (++lp->busy_itl == 1) {
 6352                                 lp->head.itl_task_sa = cpu_to_scr(cp->ccb_ba);
 6353                                 lp->head.resel_sa =
 6354                                       cpu_to_scr(SCRIPTA_BA (np, resel_no_tag));
 6355                         }
 6356                         else
 6357                                 goto out_free;
 6358                 }
 6359         }
 6360         /*
 6361          *  Put the CCB into the busy queue.
 6362          */
 6363         sym_insque_tail(&cp->link_ccbq, &np->busy_ccbq);
 6364 
 6365         /*
 6366          *  Remember all informations needed to free this CCB.
 6367          */
 6368         cp->to_abort = 0;
 6369         cp->tag    = tag;
 6370         cp->target = tn;
 6371         cp->lun    = ln;
 6372 
 6373         if (DEBUG_FLAGS & DEBUG_TAGS) {
 6374                 PRINT_LUN(np, tn, ln);
 6375                 printf ("ccb @%p using tag %d.\n", cp, tag);
 6376         }
 6377 
 6378 out:
 6379         return cp;
 6380 out_free:
 6381         sym_insque_head(&cp->link_ccbq, &np->free_ccbq);
 6382         return NULL;
 6383 }
 6384 
 6385 /*
 6386  *  Release one control block
 6387  */
 6388 static void sym_free_ccb(hcb_p np, ccb_p cp)
 6389 {
 6390         tcb_p tp = &np->target[cp->target];
 6391         lcb_p lp = sym_lp(tp, cp->lun);
 6392 
 6393         if (DEBUG_FLAGS & DEBUG_TAGS) {
 6394                 PRINT_LUN(np, cp->target, cp->lun);
 6395                 printf ("ccb @%p freeing tag %d.\n", cp, cp->tag);
 6396         }
 6397 
 6398         /*
 6399          *  If LCB available,
 6400          */
 6401         if (lp) {
 6402                 /*
 6403                  *  If tagged, release the tag, set the relect path
 6404                  */
 6405                 if (cp->tag != NO_TAG) {
 6406                         /*
 6407                          *  Free the tag value.
 6408                          */
 6409                         lp->cb_tags[lp->if_tag] = cp->tag;
 6410                         if (++lp->if_tag == SYM_CONF_MAX_TASK)
 6411                                 lp->if_tag = 0;
 6412                         /*
 6413                          *  Make the reselect path invalid,
 6414                          *  and uncount this CCB.
 6415                          */
 6416                         lp->itlq_tbl[cp->tag] = cpu_to_scr(np->bad_itlq_ba);
 6417                         --lp->busy_itlq;
 6418                 } else {        /* Untagged */
 6419                         /*
 6420                          *  Make the reselect path invalid,
 6421                          *  and uncount this CCB.
 6422                          */
 6423                         lp->head.itl_task_sa = cpu_to_scr(np->bad_itl_ba);
 6424                         --lp->busy_itl;
 6425                 }
 6426                 /*
 6427                  *  If no JOB active, make the LUN reselect path invalid.
 6428                  */
 6429                 if (lp->busy_itlq == 0 && lp->busy_itl == 0)
 6430                         lp->head.resel_sa =
 6431                                 cpu_to_scr(SCRIPTB_BA (np, resel_bad_lun));
 6432         }
 6433         /*
 6434          *  Otherwise, we only accept 1 IO per LUN.
 6435          *  Clear the bit that keeps track of this IO.
 6436          */
 6437         else
 6438                 sym_clr_bit(tp->busy0_map, cp->lun);
 6439 
 6440         /*
 6441          *  We donnot queue more than 1 ccb per target
 6442          *  with negotiation at any time. If this ccb was
 6443          *  used for negotiation, clear this info in the tcb.
 6444          */
 6445         if (cp == tp->nego_cp)
 6446                 tp->nego_cp = NULL;
 6447 
 6448 #ifdef SYM_CONF_IARB_SUPPORT
 6449         /*
 6450          *  If we just complete the last queued CCB,
 6451          *  clear this info that is no longer relevant.
 6452          */
 6453         if (cp == np->last_cp)
 6454                 np->last_cp = NULL;
 6455 #endif
 6456 
 6457         /*
 6458          *  Unmap user data from DMA map if needed.
 6459          */
 6460         if (cp->dmamapped) {
 6461                 bus_dmamap_unload(np->data_dmat, cp->dmamap);
 6462                 cp->dmamapped = 0;
 6463         }
 6464 
 6465         /*
 6466          *  Make this CCB available.
 6467          */
 6468         cp->cam_ccb = NULL;
 6469         cp->host_status = HS_IDLE;
 6470         sym_remque(&cp->link_ccbq);
 6471         sym_insque_head(&cp->link_ccbq, &np->free_ccbq);
 6472 }
 6473 
 6474 /*
 6475  *  Allocate a CCB from memory and initialize its fixed part.
 6476  */
 6477 static ccb_p sym_alloc_ccb(hcb_p np)
 6478 {
 6479         ccb_p cp = NULL;
 6480         int hcode;
 6481 
 6482         SYM_LOCK_ASSERT(MA_NOTOWNED);
 6483 
 6484         /*
 6485          *  Prevent from allocating more CCBs than we can
 6486          *  queue to the controller.
 6487          */
 6488         if (np->actccbs >= SYM_CONF_MAX_START)
 6489                 return NULL;
 6490 
 6491         /*
 6492          *  Allocate memory for this CCB.
 6493          */
 6494         cp = sym_calloc_dma(sizeof(struct sym_ccb), "CCB");
 6495         if (!cp)
 6496                 return NULL;
 6497 
 6498         /*
 6499          *  Allocate a bounce buffer for sense data.
 6500          */
 6501         cp->sns_bbuf = sym_calloc_dma(SYM_SNS_BBUF_LEN, "SNS_BBUF");
 6502         if (!cp->sns_bbuf)
 6503                 goto out_free;
 6504 
 6505         /*
 6506          *  Allocate a map for the DMA of user data.
 6507          */
 6508         if (bus_dmamap_create(np->data_dmat, 0, &cp->dmamap))
 6509                 goto out_free;
 6510         /*
 6511          *  Count it.
 6512          */
 6513         np->actccbs++;
 6514 
 6515         /*
 6516          * Initialize the callout.
 6517          */
 6518         callout_init(&cp->ch, 1);
 6519 
 6520         /*
 6521          *  Compute the bus address of this ccb.
 6522          */
 6523         cp->ccb_ba = vtobus(cp);
 6524 
 6525         /*
 6526          *  Insert this ccb into the hashed list.
 6527          */
 6528         hcode = CCB_HASH_CODE(cp->ccb_ba);
 6529         cp->link_ccbh = np->ccbh[hcode];
 6530         np->ccbh[hcode] = cp;
 6531 
 6532         /*
 6533          *  Initialize the start and restart actions.
 6534          */
 6535         cp->phys.head.go.start   = cpu_to_scr(SCRIPTA_BA (np, idle));
 6536         cp->phys.head.go.restart = cpu_to_scr(SCRIPTB_BA (np, bad_i_t_l));
 6537 
 6538         /*
 6539          *  Initilialyze some other fields.
 6540          */
 6541         cp->phys.smsg_ext.addr = cpu_to_scr(HCB_BA(np, msgin[2]));
 6542 
 6543         /*
 6544          *  Chain into free ccb queue.
 6545          */
 6546         sym_insque_head(&cp->link_ccbq, &np->free_ccbq);
 6547 
 6548         return cp;
 6549 out_free:
 6550         if (cp->sns_bbuf)
 6551                 sym_mfree_dma(cp->sns_bbuf, SYM_SNS_BBUF_LEN, "SNS_BBUF");
 6552         sym_mfree_dma(cp, sizeof(*cp), "CCB");
 6553         return NULL;
 6554 }
 6555 
 6556 /*
 6557  *  Look up a CCB from a DSA value.
 6558  */
 6559 static ccb_p sym_ccb_from_dsa(hcb_p np, u32 dsa)
 6560 {
 6561         int hcode;
 6562         ccb_p cp;
 6563 
 6564         hcode = CCB_HASH_CODE(dsa);
 6565         cp = np->ccbh[hcode];
 6566         while (cp) {
 6567                 if (cp->ccb_ba == dsa)
 6568                         break;
 6569                 cp = cp->link_ccbh;
 6570         }
 6571 
 6572         return cp;
 6573 }
 6574 
 6575 /*
 6576  *  Lun control block allocation and initialization.
 6577  */
 6578 static lcb_p sym_alloc_lcb (hcb_p np, u_char tn, u_char ln)
 6579 {
 6580         tcb_p tp = &np->target[tn];
 6581         lcb_p lp = sym_lp(tp, ln);
 6582 
 6583         /*
 6584          *  Already done, just return.
 6585          */
 6586         if (lp)
 6587                 return lp;
 6588         /*
 6589          *  Check against some race.
 6590          */
 6591         assert(!sym_is_bit(tp->busy0_map, ln));
 6592 
 6593         /*
 6594          *  Allocate the LCB bus address array.
 6595          *  Compute the bus address of this table.
 6596          */
 6597         if (ln && !tp->luntbl) {
 6598                 int i;
 6599 
 6600                 tp->luntbl = sym_calloc_dma(256, "LUNTBL");
 6601                 if (!tp->luntbl)
 6602                         goto fail;
 6603                 for (i = 0 ; i < 64 ; i++)
 6604                         tp->luntbl[i] = cpu_to_scr(vtobus(&np->badlun_sa));
 6605                 tp->head.luntbl_sa = cpu_to_scr(vtobus(tp->luntbl));
 6606         }
 6607 
 6608         /*
 6609          *  Allocate the table of pointers for LUN(s) > 0, if needed.
 6610          */
 6611         if (ln && !tp->lunmp) {
 6612                 tp->lunmp = sym_calloc(SYM_CONF_MAX_LUN * sizeof(lcb_p),
 6613                                    "LUNMP");
 6614                 if (!tp->lunmp)
 6615                         goto fail;
 6616         }
 6617 
 6618         /*
 6619          *  Allocate the lcb.
 6620          *  Make it available to the chip.
 6621          */
 6622         lp = sym_calloc_dma(sizeof(struct sym_lcb), "LCB");
 6623         if (!lp)
 6624                 goto fail;
 6625         if (ln) {
 6626                 tp->lunmp[ln] = lp;
 6627                 tp->luntbl[ln] = cpu_to_scr(vtobus(lp));
 6628         }
 6629         else {
 6630                 tp->lun0p = lp;
 6631                 tp->head.lun0_sa = cpu_to_scr(vtobus(lp));
 6632         }
 6633 
 6634         /*
 6635          *  Let the itl task point to error handling.
 6636          */
 6637         lp->head.itl_task_sa = cpu_to_scr(np->bad_itl_ba);
 6638 
 6639         /*
 6640          *  Set the reselect pattern to our default. :)
 6641          */
 6642         lp->head.resel_sa = cpu_to_scr(SCRIPTB_BA (np, resel_bad_lun));
 6643 
 6644         /*
 6645          *  Set user capabilities.
 6646          */
 6647         lp->user_flags = tp->usrflags & (SYM_DISC_ENABLED | SYM_TAGS_ENABLED);
 6648 
 6649 fail:
 6650         return lp;
 6651 }
 6652 
 6653 /*
 6654  *  Allocate LCB resources for tagged command queuing.
 6655  */
 6656 static void sym_alloc_lcb_tags (hcb_p np, u_char tn, u_char ln)
 6657 {
 6658         tcb_p tp = &np->target[tn];
 6659         lcb_p lp = sym_lp(tp, ln);
 6660         int i;
 6661 
 6662         /*
 6663          *  If LCB not available, try to allocate it.
 6664          */
 6665         if (!lp && !(lp = sym_alloc_lcb(np, tn, ln)))
 6666                 return;
 6667 
 6668         /*
 6669          *  Allocate the task table and and the tag allocation
 6670          *  circular buffer. We want both or none.
 6671          */
 6672         lp->itlq_tbl = sym_calloc_dma(SYM_CONF_MAX_TASK*4, "ITLQ_TBL");
 6673         if (!lp->itlq_tbl)
 6674                 return;
 6675         lp->cb_tags = sym_calloc(SYM_CONF_MAX_TASK, "CB_TAGS");
 6676         if (!lp->cb_tags) {
 6677                 sym_mfree_dma(lp->itlq_tbl, SYM_CONF_MAX_TASK*4, "ITLQ_TBL");
 6678                 lp->itlq_tbl = NULL;
 6679                 return;
 6680         }
 6681 
 6682         /*
 6683          *  Initialize the task table with invalid entries.
 6684          */
 6685         for (i = 0 ; i < SYM_CONF_MAX_TASK ; i++)
 6686                 lp->itlq_tbl[i] = cpu_to_scr(np->notask_ba);
 6687 
 6688         /*
 6689          *  Fill up the tag buffer with tag numbers.
 6690          */
 6691         for (i = 0 ; i < SYM_CONF_MAX_TASK ; i++)
 6692                 lp->cb_tags[i] = i;
 6693 
 6694         /*
 6695          *  Make the task table available to SCRIPTS,
 6696          *  And accept tagged commands now.
 6697          */
 6698         lp->head.itlq_tbl_sa = cpu_to_scr(vtobus(lp->itlq_tbl));
 6699 }
 6700 
 6701 /*
 6702  *  Test the pci bus snoop logic :-(
 6703  *
 6704  *  Has to be called with interrupts disabled.
 6705  */
 6706 #ifndef SYM_CONF_IOMAPPED
 6707 static int sym_regtest (hcb_p np)
 6708 {
 6709         register volatile u32 data;
 6710         /*
 6711          *  chip registers may NOT be cached.
 6712          *  write 0xffffffff to a read only register area,
 6713          *  and try to read it back.
 6714          */
 6715         data = 0xffffffff;
 6716         OUTL_OFF(offsetof(struct sym_reg, nc_dstat), data);
 6717         data = INL_OFF(offsetof(struct sym_reg, nc_dstat));
 6718 #if 1
 6719         if (data == 0xffffffff) {
 6720 #else
 6721         if ((data & 0xe2f0fffd) != 0x02000080) {
 6722 #endif
 6723                 printf ("CACHE TEST FAILED: reg dstat-sstat2 readback %x.\n",
 6724                         (unsigned) data);
 6725                 return (0x10);
 6726         }
 6727         return (0);
 6728 }
 6729 #endif
 6730 
 6731 static int sym_snooptest (hcb_p np)
 6732 {
 6733         u32     sym_rd, sym_wr, sym_bk, host_rd, host_wr, pc, dstat;
 6734         int     i, err=0;
 6735 #ifndef SYM_CONF_IOMAPPED
 6736         err |= sym_regtest (np);
 6737         if (err) return (err);
 6738 #endif
 6739 restart_test:
 6740         /*
 6741          *  Enable Master Parity Checking as we intend
 6742          *  to enable it for normal operations.
 6743          */
 6744         OUTB (nc_ctest4, (np->rv_ctest4 & MPEE));
 6745         /*
 6746          *  init
 6747          */
 6748         pc  = SCRIPTB0_BA (np, snooptest);
 6749         host_wr = 1;
 6750         sym_wr  = 2;
 6751         /*
 6752          *  Set memory and register.
 6753          */
 6754         np->cache = cpu_to_scr(host_wr);
 6755         OUTL (nc_temp, sym_wr);
 6756         /*
 6757          *  Start script (exchange values)
 6758          */
 6759         OUTL (nc_dsa, np->hcb_ba);
 6760         OUTL_DSP (pc);
 6761         /*
 6762          *  Wait 'til done (with timeout)
 6763          */
 6764         for (i=0; i<SYM_SNOOP_TIMEOUT; i++)
 6765                 if (INB(nc_istat) & (INTF|SIP|DIP))
 6766                         break;
 6767         if (i>=SYM_SNOOP_TIMEOUT) {
 6768                 printf ("CACHE TEST FAILED: timeout.\n");
 6769                 return (0x20);
 6770         }
 6771         /*
 6772          *  Check for fatal DMA errors.
 6773          */
 6774         dstat = INB (nc_dstat);
 6775 #if 1   /* Band aiding for broken hardwares that fail PCI parity */
 6776         if ((dstat & MDPE) && (np->rv_ctest4 & MPEE)) {
 6777                 printf ("%s: PCI DATA PARITY ERROR DETECTED - "
 6778                         "DISABLING MASTER DATA PARITY CHECKING.\n",
 6779                         sym_name(np));
 6780                 np->rv_ctest4 &= ~MPEE;
 6781                 goto restart_test;
 6782         }
 6783 #endif
 6784         if (dstat & (MDPE|BF|IID)) {
 6785                 printf ("CACHE TEST FAILED: DMA error (dstat=0x%02x).", dstat);
 6786                 return (0x80);
 6787         }
 6788         /*
 6789          *  Save termination position.
 6790          */
 6791         pc = INL (nc_dsp);
 6792         /*
 6793          *  Read memory and register.
 6794          */
 6795         host_rd = scr_to_cpu(np->cache);
 6796         sym_rd  = INL (nc_scratcha);
 6797         sym_bk  = INL (nc_temp);
 6798 
 6799         /*
 6800          *  Check termination position.
 6801          */
 6802         if (pc != SCRIPTB0_BA (np, snoopend)+8) {
 6803                 printf ("CACHE TEST FAILED: script execution failed.\n");
 6804                 printf ("start=%08lx, pc=%08lx, end=%08lx\n",
 6805                         (u_long) SCRIPTB0_BA (np, snooptest), (u_long) pc,
 6806                         (u_long) SCRIPTB0_BA (np, snoopend) +8);
 6807                 return (0x40);
 6808         }
 6809         /*
 6810          *  Show results.
 6811          */
 6812         if (host_wr != sym_rd) {
 6813                 printf ("CACHE TEST FAILED: host wrote %d, chip read %d.\n",
 6814                         (int) host_wr, (int) sym_rd);
 6815                 err |= 1;
 6816         }
 6817         if (host_rd != sym_wr) {
 6818                 printf ("CACHE TEST FAILED: chip wrote %d, host read %d.\n",
 6819                         (int) sym_wr, (int) host_rd);
 6820                 err |= 2;
 6821         }
 6822         if (sym_bk != sym_wr) {
 6823                 printf ("CACHE TEST FAILED: chip wrote %d, read back %d.\n",
 6824                         (int) sym_wr, (int) sym_bk);
 6825                 err |= 4;
 6826         }
 6827 
 6828         return (err);
 6829 }
 6830 
 6831 /*
 6832  *  Determine the chip's clock frequency.
 6833  *
 6834  *  This is essential for the negotiation of the synchronous
 6835  *  transfer rate.
 6836  *
 6837  *  Note: we have to return the correct value.
 6838  *  THERE IS NO SAFE DEFAULT VALUE.
 6839  *
 6840  *  Most NCR/SYMBIOS boards are delivered with a 40 Mhz clock.
 6841  *  53C860 and 53C875 rev. 1 support fast20 transfers but
 6842  *  do not have a clock doubler and so are provided with a
 6843  *  80 MHz clock. All other fast20 boards incorporate a doubler
 6844  *  and so should be delivered with a 40 MHz clock.
 6845  *  The recent fast40 chips (895/896/895A/1010) use a 40 Mhz base
 6846  *  clock and provide a clock quadrupler (160 Mhz).
 6847  */
 6848 
 6849 /*
 6850  *  Select SCSI clock frequency
 6851  */
 6852 static void sym_selectclock(hcb_p np, u_char scntl3)
 6853 {
 6854         /*
 6855          *  If multiplier not present or not selected, leave here.
 6856          */
 6857         if (np->multiplier <= 1) {
 6858                 OUTB(nc_scntl3, scntl3);
 6859                 return;
 6860         }
 6861 
 6862         if (sym_verbose >= 2)
 6863                 printf ("%s: enabling clock multiplier\n", sym_name(np));
 6864 
 6865         OUTB(nc_stest1, DBLEN);    /* Enable clock multiplier             */
 6866         /*
 6867          *  Wait for the LCKFRQ bit to be set if supported by the chip.
 6868          *  Otherwise wait 20 micro-seconds.
 6869          */
 6870         if (np->features & FE_LCKFRQ) {
 6871                 int i = 20;
 6872                 while (!(INB(nc_stest4) & LCKFRQ) && --i > 0)
 6873                         UDELAY (20);
 6874                 if (!i)
 6875                         printf("%s: the chip cannot lock the frequency\n",
 6876                                 sym_name(np));
 6877         } else
 6878                 UDELAY (20);
 6879         OUTB(nc_stest3, HSC);           /* Halt the scsi clock          */
 6880         OUTB(nc_scntl3, scntl3);
 6881         OUTB(nc_stest1, (DBLEN|DBLSEL));/* Select clock multiplier      */
 6882         OUTB(nc_stest3, 0x00);          /* Restart scsi clock           */
 6883 }
 6884 
 6885 /*
 6886  *  calculate SCSI clock frequency (in KHz)
 6887  */
 6888 static unsigned getfreq (hcb_p np, int gen)
 6889 {
 6890         unsigned int ms = 0;
 6891         unsigned int f;
 6892 
 6893         /*
 6894          * Measure GEN timer delay in order
 6895          * to calculate SCSI clock frequency
 6896          *
 6897          * This code will never execute too
 6898          * many loop iterations (if DELAY is
 6899          * reasonably correct). It could get
 6900          * too low a delay (too high a freq.)
 6901          * if the CPU is slow executing the
 6902          * loop for some reason (an NMI, for
 6903          * example). For this reason we will
 6904          * if multiple measurements are to be
 6905          * performed trust the higher delay
 6906          * (lower frequency returned).
 6907          */
 6908         OUTW (nc_sien , 0);     /* mask all scsi interrupts */
 6909         (void) INW (nc_sist);   /* clear pending scsi interrupt */
 6910         OUTB (nc_dien , 0);     /* mask all dma interrupts */
 6911         (void) INW (nc_sist);   /* another one, just to be sure :) */
 6912         OUTB (nc_scntl3, 4);    /* set pre-scaler to divide by 3 */
 6913         OUTB (nc_stime1, 0);    /* disable general purpose timer */
 6914         OUTB (nc_stime1, gen);  /* set to nominal delay of 1<<gen * 125us */
 6915         while (!(INW(nc_sist) & GEN) && ms++ < 100000)
 6916                 UDELAY (1000);  /* count ms */
 6917         OUTB (nc_stime1, 0);    /* disable general purpose timer */
 6918         /*
 6919          * set prescaler to divide by whatever 0 means
 6920          * 0 ought to choose divide by 2, but appears
 6921          * to set divide by 3.5 mode in my 53c810 ...
 6922          */
 6923         OUTB (nc_scntl3, 0);
 6924 
 6925         /*
 6926          * adjust for prescaler, and convert into KHz
 6927          */
 6928         f = ms ? ((1 << gen) * 4340) / ms : 0;
 6929 
 6930         if (sym_verbose >= 2)
 6931                 printf ("%s: Delay (GEN=%d): %u msec, %u KHz\n",
 6932                         sym_name(np), gen, ms, f);
 6933 
 6934         return f;
 6935 }
 6936 
 6937 static unsigned sym_getfreq (hcb_p np)
 6938 {
 6939         u_int f1, f2;
 6940         int gen = 11;
 6941 
 6942         (void) getfreq (np, gen);       /* throw away first result */
 6943         f1 = getfreq (np, gen);
 6944         f2 = getfreq (np, gen);
 6945         if (f1 > f2) f1 = f2;           /* trust lower result   */
 6946         return f1;
 6947 }
 6948 
 6949 /*
 6950  *  Get/probe chip SCSI clock frequency
 6951  */
 6952 static void sym_getclock (hcb_p np, int mult)
 6953 {
 6954         unsigned char scntl3 = np->sv_scntl3;
 6955         unsigned char stest1 = np->sv_stest1;
 6956         unsigned f1;
 6957 
 6958         /*
 6959          *  For the C10 core, assume 40 MHz.
 6960          */
 6961         if (np->features & FE_C10) {
 6962                 np->multiplier = mult;
 6963                 np->clock_khz = 40000 * mult;
 6964                 return;
 6965         }
 6966 
 6967         np->multiplier = 1;
 6968         f1 = 40000;
 6969         /*
 6970          *  True with 875/895/896/895A with clock multiplier selected
 6971          */
 6972         if (mult > 1 && (stest1 & (DBLEN+DBLSEL)) == DBLEN+DBLSEL) {
 6973                 if (sym_verbose >= 2)
 6974                         printf ("%s: clock multiplier found\n", sym_name(np));
 6975                 np->multiplier = mult;
 6976         }
 6977 
 6978         /*
 6979          *  If multiplier not found or scntl3 not 7,5,3,
 6980          *  reset chip and get frequency from general purpose timer.
 6981          *  Otherwise trust scntl3 BIOS setting.
 6982          */
 6983         if (np->multiplier != mult || (scntl3 & 7) < 3 || !(scntl3 & 1)) {
 6984                 OUTB (nc_stest1, 0);            /* make sure doubler is OFF */
 6985                 f1 = sym_getfreq (np);
 6986 
 6987                 if (sym_verbose)
 6988                         printf ("%s: chip clock is %uKHz\n", sym_name(np), f1);
 6989 
 6990                 if      (f1 <   45000)          f1 =  40000;
 6991                 else if (f1 <   55000)          f1 =  50000;
 6992                 else                            f1 =  80000;
 6993 
 6994                 if (f1 < 80000 && mult > 1) {
 6995                         if (sym_verbose >= 2)
 6996                                 printf ("%s: clock multiplier assumed\n",
 6997                                         sym_name(np));
 6998                         np->multiplier  = mult;
 6999                 }
 7000         } else {
 7001                 if      ((scntl3 & 7) == 3)     f1 =  40000;
 7002                 else if ((scntl3 & 7) == 5)     f1 =  80000;
 7003                 else                            f1 = 160000;
 7004 
 7005                 f1 /= np->multiplier;
 7006         }
 7007 
 7008         /*
 7009          *  Compute controller synchronous parameters.
 7010          */
 7011         f1              *= np->multiplier;
 7012         np->clock_khz   = f1;
 7013 }
 7014 
 7015 /*
 7016  *  Get/probe PCI clock frequency
 7017  */
 7018 static int sym_getpciclock (hcb_p np)
 7019 {
 7020         int f = 0;
 7021 
 7022         /*
 7023          *  For the C1010-33, this doesn't work.
 7024          *  For the C1010-66, this will be tested when I'll have
 7025          *  such a beast to play with.
 7026          */
 7027         if (!(np->features & FE_C10)) {
 7028                 OUTB (nc_stest1, SCLK); /* Use the PCI clock as SCSI clock */
 7029                 f = (int) sym_getfreq (np);
 7030                 OUTB (nc_stest1, 0);
 7031         }
 7032         np->pciclk_khz = f;
 7033 
 7034         return f;
 7035 }
 7036 
 7037 /*============= DRIVER ACTION/COMPLETION ====================*/
 7038 
 7039 /*
 7040  *  Print something that tells about extended errors.
 7041  */
 7042 static void sym_print_xerr(ccb_p cp, int x_status)
 7043 {
 7044         if (x_status & XE_PARITY_ERR) {
 7045                 PRINT_ADDR(cp);
 7046                 printf ("unrecovered SCSI parity error.\n");
 7047         }
 7048         if (x_status & XE_EXTRA_DATA) {
 7049                 PRINT_ADDR(cp);
 7050                 printf ("extraneous data discarded.\n");
 7051         }
 7052         if (x_status & XE_BAD_PHASE) {
 7053                 PRINT_ADDR(cp);
 7054                 printf ("illegal scsi phase (4/5).\n");
 7055         }
 7056         if (x_status & XE_SODL_UNRUN) {
 7057                 PRINT_ADDR(cp);
 7058                 printf ("ODD transfer in DATA OUT phase.\n");
 7059         }
 7060         if (x_status & XE_SWIDE_OVRUN) {
 7061                 PRINT_ADDR(cp);
 7062                 printf ("ODD transfer in DATA IN phase.\n");
 7063         }
 7064 }
 7065 
 7066 /*
 7067  *  Choose the more appropriate CAM status if
 7068  *  the IO encountered an extended error.
 7069  */
 7070 static int sym_xerr_cam_status(int cam_status, int x_status)
 7071 {
 7072         if (x_status) {
 7073                 if      (x_status & XE_PARITY_ERR)
 7074                         cam_status = CAM_UNCOR_PARITY;
 7075                 else if (x_status &(XE_EXTRA_DATA|XE_SODL_UNRUN|XE_SWIDE_OVRUN))
 7076                         cam_status = CAM_DATA_RUN_ERR;
 7077                 else if (x_status & XE_BAD_PHASE)
 7078                         cam_status = CAM_REQ_CMP_ERR;
 7079                 else
 7080                         cam_status = CAM_REQ_CMP_ERR;
 7081         }
 7082         return cam_status;
 7083 }
 7084 
 7085 /*
 7086  *  Complete execution of a SCSI command with extented
 7087  *  error, SCSI status error, or having been auto-sensed.
 7088  *
 7089  *  The SCRIPTS processor is not running there, so we
 7090  *  can safely access IO registers and remove JOBs from
 7091  *  the START queue.
 7092  *  SCRATCHA is assumed to have been loaded with STARTPOS
 7093  *  before the SCRIPTS called the C code.
 7094  */
 7095 static void sym_complete_error (hcb_p np, ccb_p cp)
 7096 {
 7097         struct ccb_scsiio *csio;
 7098         u_int cam_status;
 7099         int i, sense_returned;
 7100 
 7101         SYM_LOCK_ASSERT(MA_OWNED);
 7102 
 7103         /*
 7104          *  Paranoid check. :)
 7105          */
 7106         if (!cp || !cp->cam_ccb)
 7107                 return;
 7108 
 7109         if (DEBUG_FLAGS & (DEBUG_TINY|DEBUG_RESULT)) {
 7110                 printf ("CCB=%lx STAT=%x/%x/%x DEV=%d/%d\n", (unsigned long)cp,
 7111                         cp->host_status, cp->ssss_status, cp->host_flags,
 7112                         cp->target, cp->lun);
 7113                 MDELAY(100);
 7114         }
 7115 
 7116         /*
 7117          *  Get CAM command pointer.
 7118          */
 7119         csio = &cp->cam_ccb->csio;
 7120 
 7121         /*
 7122          *  Check for extended errors.
 7123          */
 7124         if (cp->xerr_status) {
 7125                 if (sym_verbose)
 7126                         sym_print_xerr(cp, cp->xerr_status);
 7127                 if (cp->host_status == HS_COMPLETE)
 7128                         cp->host_status = HS_COMP_ERR;
 7129         }
 7130 
 7131         /*
 7132          *  Calculate the residual.
 7133          */
 7134         csio->sense_resid = 0;
 7135         csio->resid = sym_compute_residual(np, cp);
 7136 
 7137         if (!SYM_CONF_RESIDUAL_SUPPORT) {/* If user does not want residuals */
 7138                 csio->resid  = 0;       /* throw them away. :)             */
 7139                 cp->sv_resid = 0;
 7140         }
 7141 
 7142         if (cp->host_flags & HF_SENSE) {                /* Auto sense     */
 7143                 csio->scsi_status = cp->sv_scsi_status; /* Restore status */
 7144                 csio->sense_resid = csio->resid;        /* Swap residuals */
 7145                 csio->resid       = cp->sv_resid;
 7146                 cp->sv_resid      = 0;
 7147                 if (sym_verbose && cp->sv_xerr_status)
 7148                         sym_print_xerr(cp, cp->sv_xerr_status);
 7149                 if (cp->host_status == HS_COMPLETE &&
 7150                     cp->ssss_status == S_GOOD &&
 7151                     cp->xerr_status == 0) {
 7152                         cam_status = sym_xerr_cam_status(CAM_SCSI_STATUS_ERROR,
 7153                                                          cp->sv_xerr_status);
 7154                         cam_status |= CAM_AUTOSNS_VALID;
 7155                         /*
 7156                          *  Bounce back the sense data to user and
 7157                          *  fix the residual.
 7158                          */
 7159                         bzero(&csio->sense_data, sizeof(csio->sense_data));
 7160                         sense_returned = SYM_SNS_BBUF_LEN - csio->sense_resid;
 7161                         if (sense_returned < csio->sense_len)
 7162                                 csio->sense_resid = csio->sense_len -
 7163                                     sense_returned;
 7164                         else
 7165                                 csio->sense_resid = 0;
 7166                         bcopy(cp->sns_bbuf, &csio->sense_data,
 7167                             MIN(csio->sense_len, sense_returned));
 7168 #if 0
 7169                         /*
 7170                          *  If the device reports a UNIT ATTENTION condition
 7171                          *  due to a RESET condition, we should consider all
 7172                          *  disconnect CCBs for this unit as aborted.
 7173                          */
 7174                         if (1) {
 7175                                 u_char *p;
 7176                                 p  = (u_char *) csio->sense_data;
 7177                                 if (p[0]==0x70 && p[2]==0x6 && p[12]==0x29)
 7178                                         sym_clear_tasks(np, CAM_REQ_ABORTED,
 7179                                                         cp->target,cp->lun, -1);
 7180                         }
 7181 #endif
 7182                 }
 7183                 else
 7184                         cam_status = CAM_AUTOSENSE_FAIL;
 7185         }
 7186         else if (cp->host_status == HS_COMPLETE) {      /* Bad SCSI status */
 7187                 csio->scsi_status = cp->ssss_status;
 7188                 cam_status = CAM_SCSI_STATUS_ERROR;
 7189         }
 7190         else if (cp->host_status == HS_SEL_TIMEOUT)     /* Selection timeout */
 7191                 cam_status = CAM_SEL_TIMEOUT;
 7192         else if (cp->host_status == HS_UNEXPECTED)      /* Unexpected BUS FREE*/
 7193                 cam_status = CAM_UNEXP_BUSFREE;
 7194         else {                                          /* Extended error */
 7195                 if (sym_verbose) {
 7196                         PRINT_ADDR(cp);
 7197                         printf ("COMMAND FAILED (%x %x %x).\n",
 7198                                 cp->host_status, cp->ssss_status,
 7199                                 cp->xerr_status);
 7200                 }
 7201                 csio->scsi_status = cp->ssss_status;
 7202                 /*
 7203                  *  Set the most appropriate value for CAM status.
 7204                  */
 7205                 cam_status = sym_xerr_cam_status(CAM_REQ_CMP_ERR,
 7206                                                  cp->xerr_status);
 7207         }
 7208 
 7209         /*
 7210          *  Dequeue all queued CCBs for that device
 7211          *  not yet started by SCRIPTS.
 7212          */
 7213         i = (INL (nc_scratcha) - np->squeue_ba) / 4;
 7214         (void) sym_dequeue_from_squeue(np, i, cp->target, cp->lun, -1);
 7215 
 7216         /*
 7217          *  Restart the SCRIPTS processor.
 7218          */
 7219         OUTL_DSP (SCRIPTA_BA (np, start));
 7220 
 7221         /*
 7222          *  Synchronize DMA map if needed.
 7223          */
 7224         if (cp->dmamapped) {
 7225                 bus_dmamap_sync(np->data_dmat, cp->dmamap,
 7226                         (cp->dmamapped == SYM_DMA_READ ?
 7227                                 BUS_DMASYNC_POSTREAD : BUS_DMASYNC_POSTWRITE));
 7228         }
 7229         /*
 7230          *  Add this one to the COMP queue.
 7231          *  Complete all those commands with either error
 7232          *  or requeue condition.
 7233          */
 7234         sym_set_cam_status((union ccb *) csio, cam_status);
 7235         sym_remque(&cp->link_ccbq);
 7236         sym_insque_head(&cp->link_ccbq, &np->comp_ccbq);
 7237         sym_flush_comp_queue(np, 0);
 7238 }
 7239 
 7240 /*
 7241  *  Complete execution of a successful SCSI command.
 7242  *
 7243  *  Only successful commands go to the DONE queue,
 7244  *  since we need to have the SCRIPTS processor
 7245  *  stopped on any error condition.
 7246  *  The SCRIPTS processor is running while we are
 7247  *  completing successful commands.
 7248  */
 7249 static void sym_complete_ok (hcb_p np, ccb_p cp)
 7250 {
 7251         struct ccb_scsiio *csio;
 7252         tcb_p tp;
 7253         lcb_p lp;
 7254 
 7255         SYM_LOCK_ASSERT(MA_OWNED);
 7256 
 7257         /*
 7258          *  Paranoid check. :)
 7259          */
 7260         if (!cp || !cp->cam_ccb)
 7261                 return;
 7262         assert (cp->host_status == HS_COMPLETE);
 7263 
 7264         /*
 7265          *  Get command, target and lun pointers.
 7266          */
 7267         csio = &cp->cam_ccb->csio;
 7268         tp = &np->target[cp->target];
 7269         lp = sym_lp(tp, cp->lun);
 7270 
 7271         /*
 7272          *  Assume device discovered on first success.
 7273          */
 7274         if (!lp)
 7275                 sym_set_bit(tp->lun_map, cp->lun);
 7276 
 7277         /*
 7278          *  If all data have been transferred, given than no
 7279          *  extended error did occur, there is no residual.
 7280          */
 7281         csio->resid = 0;
 7282         if (cp->phys.head.lastp != cp->phys.head.goalp)
 7283                 csio->resid = sym_compute_residual(np, cp);
 7284 
 7285         /*
 7286          *  Wrong transfer residuals may be worse than just always
 7287          *  returning zero. User can disable this feature from
 7288          *  sym_conf.h. Residual support is enabled by default.
 7289          */
 7290         if (!SYM_CONF_RESIDUAL_SUPPORT)
 7291                 csio->resid  = 0;
 7292 
 7293         /*
 7294          *  Synchronize DMA map if needed.
 7295          */
 7296         if (cp->dmamapped) {
 7297                 bus_dmamap_sync(np->data_dmat, cp->dmamap,
 7298                         (cp->dmamapped == SYM_DMA_READ ?
 7299                                 BUS_DMASYNC_POSTREAD : BUS_DMASYNC_POSTWRITE));
 7300         }
 7301         /*
 7302          *  Set status and complete the command.
 7303          */
 7304         csio->scsi_status = cp->ssss_status;
 7305         sym_set_cam_status((union ccb *) csio, CAM_REQ_CMP);
 7306         sym_xpt_done(np, (union ccb *) csio, cp);
 7307         sym_free_ccb(np, cp);
 7308 }
 7309 
 7310 /*
 7311  *  Our callout handler
 7312  */
 7313 static void sym_callout(void *arg)
 7314 {
 7315         union ccb *ccb = (union ccb *) arg;
 7316         hcb_p np = ccb->ccb_h.sym_hcb_ptr;
 7317 
 7318         /*
 7319          *  Check that the CAM CCB is still queued.
 7320          */
 7321         if (!np)
 7322                 return;
 7323 
 7324         SYM_LOCK();
 7325 
 7326         switch(ccb->ccb_h.func_code) {
 7327         case XPT_SCSI_IO:
 7328                 (void) sym_abort_scsiio(np, ccb, 1);
 7329                 break;
 7330         default:
 7331                 break;
 7332         }
 7333 
 7334         SYM_UNLOCK();
 7335 }
 7336 
 7337 /*
 7338  *  Abort an SCSI IO.
 7339  */
 7340 static int sym_abort_scsiio(hcb_p np, union ccb *ccb, int timed_out)
 7341 {
 7342         ccb_p cp;
 7343         SYM_QUEHEAD *qp;
 7344 
 7345         SYM_LOCK_ASSERT(MA_OWNED);
 7346 
 7347         /*
 7348          *  Look up our CCB control block.
 7349          */
 7350         cp = NULL;
 7351         FOR_EACH_QUEUED_ELEMENT(&np->busy_ccbq, qp) {
 7352                 ccb_p cp2 = sym_que_entry(qp, struct sym_ccb, link_ccbq);
 7353                 if (cp2->cam_ccb == ccb) {
 7354                         cp = cp2;
 7355                         break;
 7356                 }
 7357         }
 7358         if (!cp || cp->host_status == HS_WAIT)
 7359                 return -1;
 7360 
 7361         /*
 7362          *  If a previous abort didn't succeed in time,
 7363          *  perform a BUS reset.
 7364          */
 7365         if (cp->to_abort) {
 7366                 sym_reset_scsi_bus(np, 1);
 7367                 return 0;
 7368         }
 7369 
 7370         /*
 7371          *  Mark the CCB for abort and allow time for.
 7372          */
 7373         cp->to_abort = timed_out ? 2 : 1;
 7374         callout_reset(&cp->ch, 10 * hz, sym_callout, (caddr_t) ccb);
 7375 
 7376         /*
 7377          *  Tell the SCRIPTS processor to stop and synchronize with us.
 7378          */
 7379         np->istat_sem = SEM;
 7380         OUTB (nc_istat, SIGP|SEM);
 7381         return 0;
 7382 }
 7383 
 7384 /*
 7385  *  Reset a SCSI device (all LUNs of a target).
 7386  */
 7387 static void sym_reset_dev(hcb_p np, union ccb *ccb)
 7388 {
 7389         tcb_p tp;
 7390         struct ccb_hdr *ccb_h = &ccb->ccb_h;
 7391 
 7392         SYM_LOCK_ASSERT(MA_OWNED);
 7393 
 7394         if (ccb_h->target_id   == np->myaddr ||
 7395             ccb_h->target_id   >= SYM_CONF_MAX_TARGET ||
 7396             ccb_h->target_lun  >= SYM_CONF_MAX_LUN) {
 7397                 sym_xpt_done2(np, ccb, CAM_DEV_NOT_THERE);
 7398                 return;
 7399         }
 7400 
 7401         tp = &np->target[ccb_h->target_id];
 7402 
 7403         tp->to_reset = 1;
 7404         sym_xpt_done2(np, ccb, CAM_REQ_CMP);
 7405 
 7406         np->istat_sem = SEM;
 7407         OUTB (nc_istat, SIGP|SEM);
 7408 }
 7409 
 7410 /*
 7411  *  SIM action entry point.
 7412  */
 7413 static void sym_action(struct cam_sim *sim, union ccb *ccb)
 7414 {
 7415         hcb_p   np;
 7416         tcb_p   tp;
 7417         lcb_p   lp;
 7418         ccb_p   cp;
 7419         int     tmp;
 7420         u_char  idmsg, *msgptr;
 7421         u_int   msglen;
 7422         struct  ccb_scsiio *csio;
 7423         struct  ccb_hdr  *ccb_h;
 7424 
 7425         CAM_DEBUG(ccb->ccb_h.path, CAM_DEBUG_TRACE, ("sym_action\n"));
 7426 
 7427         /*
 7428          *  Retrieve our controller data structure.
 7429          */
 7430         np = (hcb_p) cam_sim_softc(sim);
 7431 
 7432         SYM_LOCK_ASSERT(MA_OWNED);
 7433 
 7434         /*
 7435          *  The common case is SCSI IO.
 7436          *  We deal with other ones elsewhere.
 7437          */
 7438         if (ccb->ccb_h.func_code != XPT_SCSI_IO) {
 7439                 sym_action2(sim, ccb);
 7440                 return;
 7441         }
 7442         csio  = &ccb->csio;
 7443         ccb_h = &csio->ccb_h;
 7444 
 7445         /*
 7446          *  Work around races.
 7447          */
 7448         if ((ccb_h->status & CAM_STATUS_MASK) != CAM_REQ_INPROG) {
 7449                 xpt_done(ccb);
 7450                 return;
 7451         }
 7452 
 7453         /*
 7454          *  Minimal checkings, so that we will not
 7455          *  go outside our tables.
 7456          */
 7457         if (ccb_h->target_id   == np->myaddr ||
 7458             ccb_h->target_id   >= SYM_CONF_MAX_TARGET ||
 7459             ccb_h->target_lun  >= SYM_CONF_MAX_LUN) {
 7460                 sym_xpt_done2(np, ccb, CAM_DEV_NOT_THERE);
 7461                 return;
 7462         }
 7463 
 7464         /*
 7465          *  Retrieve the target and lun descriptors.
 7466          */
 7467         tp = &np->target[ccb_h->target_id];
 7468         lp = sym_lp(tp, ccb_h->target_lun);
 7469 
 7470         /*
 7471          *  Complete the 1st INQUIRY command with error
 7472          *  condition if the device is flagged NOSCAN
 7473          *  at BOOT in the NVRAM. This may speed up
 7474          *  the boot and maintain coherency with BIOS
 7475          *  device numbering. Clearing the flag allows
 7476          *  user to rescan skipped devices later.
 7477          *  We also return error for devices not flagged
 7478          *  for SCAN LUNS in the NVRAM since some mono-lun
 7479          *  devices behave badly when asked for some non
 7480          *  zero LUN. Btw, this is an absolute hack.:-)
 7481          */
 7482         if (!(ccb_h->flags & CAM_CDB_PHYS) &&
 7483             (0x12 == ((ccb_h->flags & CAM_CDB_POINTER) ?
 7484                   csio->cdb_io.cdb_ptr[0] : csio->cdb_io.cdb_bytes[0]))) {
 7485                 if ((tp->usrflags & SYM_SCAN_BOOT_DISABLED) ||
 7486                     ((tp->usrflags & SYM_SCAN_LUNS_DISABLED) &&
 7487                      ccb_h->target_lun != 0)) {
 7488                         tp->usrflags &= ~SYM_SCAN_BOOT_DISABLED;
 7489                         sym_xpt_done2(np, ccb, CAM_DEV_NOT_THERE);
 7490                         return;
 7491                 }
 7492         }
 7493 
 7494         /*
 7495          *  Get a control block for this IO.
 7496          */
 7497         tmp = ((ccb_h->flags & CAM_TAG_ACTION_VALID) != 0);
 7498         cp = sym_get_ccb(np, ccb_h->target_id, ccb_h->target_lun, tmp);
 7499         if (!cp) {
 7500                 sym_xpt_done2(np, ccb, CAM_RESRC_UNAVAIL);
 7501                 return;
 7502         }
 7503 
 7504         /*
 7505          *  Keep track of the IO in our CCB.
 7506          */
 7507         cp->cam_ccb = ccb;
 7508 
 7509         /*
 7510          *  Build the IDENTIFY message.
 7511          */
 7512         idmsg = M_IDENTIFY | cp->lun;
 7513         if (cp->tag != NO_TAG || (lp && (lp->current_flags & SYM_DISC_ENABLED)))
 7514                 idmsg |= 0x40;
 7515 
 7516         msgptr = cp->scsi_smsg;
 7517         msglen = 0;
 7518         msgptr[msglen++] = idmsg;
 7519 
 7520         /*
 7521          *  Build the tag message if present.
 7522          */
 7523         if (cp->tag != NO_TAG) {
 7524                 u_char order = csio->tag_action;
 7525 
 7526                 switch(order) {
 7527                 case M_ORDERED_TAG:
 7528                         break;
 7529                 case M_HEAD_TAG:
 7530                         break;
 7531                 default:
 7532                         order = M_SIMPLE_TAG;
 7533                 }
 7534                 msgptr[msglen++] = order;
 7535 
 7536                 /*
 7537                  *  For less than 128 tags, actual tags are numbered
 7538                  *  1,3,5,..2*MAXTAGS+1,since we may have to deal
 7539                  *  with devices that have problems with #TAG 0 or too
 7540                  *  great #TAG numbers. For more tags (up to 256),
 7541                  *  we use directly our tag number.
 7542                  */
 7543 #if SYM_CONF_MAX_TASK > (512/4)
 7544                 msgptr[msglen++] = cp->tag;
 7545 #else
 7546                 msgptr[msglen++] = (cp->tag << 1) + 1;
 7547 #endif
 7548         }
 7549 
 7550         /*
 7551          *  Build a negotiation message if needed.
 7552          *  (nego_status is filled by sym_prepare_nego())
 7553          */
 7554         cp->nego_status = 0;
 7555         if (tp->tinfo.current.width   != tp->tinfo.goal.width  ||
 7556             tp->tinfo.current.period  != tp->tinfo.goal.period ||
 7557             tp->tinfo.current.offset  != tp->tinfo.goal.offset ||
 7558             tp->tinfo.current.options != tp->tinfo.goal.options) {
 7559                 if (!tp->nego_cp && lp)
 7560                         msglen += sym_prepare_nego(np, cp, 0, msgptr + msglen);
 7561         }
 7562 
 7563         /*
 7564          *  Fill in our ccb
 7565          */
 7566 
 7567         /*
 7568          *  Startqueue
 7569          */
 7570         cp->phys.head.go.start   = cpu_to_scr(SCRIPTA_BA (np, select));
 7571         cp->phys.head.go.restart = cpu_to_scr(SCRIPTA_BA (np, resel_dsa));
 7572 
 7573         /*
 7574          *  select
 7575          */
 7576         cp->phys.select.sel_id          = cp->target;
 7577         cp->phys.select.sel_scntl3      = tp->head.wval;
 7578         cp->phys.select.sel_sxfer       = tp->head.sval;
 7579         cp->phys.select.sel_scntl4      = tp->head.uval;
 7580 
 7581         /*
 7582          *  message
 7583          */
 7584         cp->phys.smsg.addr      = cpu_to_scr(CCB_BA (cp, scsi_smsg));
 7585         cp->phys.smsg.size      = cpu_to_scr(msglen);
 7586 
 7587         /*
 7588          *  command
 7589          */
 7590         if (sym_setup_cdb(np, csio, cp) < 0) {
 7591                 sym_xpt_done(np, ccb, cp);
 7592                 sym_free_ccb(np, cp);
 7593                 return;
 7594         }
 7595 
 7596         /*
 7597          *  status
 7598          */
 7599 #if     0       /* Provision */
 7600         cp->actualquirks        = tp->quirks;
 7601 #endif
 7602         cp->actualquirks        = SYM_QUIRK_AUTOSAVE;
 7603         cp->host_status         = cp->nego_status ? HS_NEGOTIATE : HS_BUSY;
 7604         cp->ssss_status         = S_ILLEGAL;
 7605         cp->xerr_status         = 0;
 7606         cp->host_flags          = 0;
 7607         cp->extra_bytes         = 0;
 7608 
 7609         /*
 7610          *  extreme data pointer.
 7611          *  shall be positive, so -1 is lower than lowest.:)
 7612          */
 7613         cp->ext_sg  = -1;
 7614         cp->ext_ofs = 0;
 7615 
 7616         /*
 7617          *  Build the data descriptor block
 7618          *  and start the IO.
 7619          */
 7620         sym_setup_data_and_start(np, csio, cp);
 7621 }
 7622 
 7623 /*
 7624  *  Setup buffers and pointers that address the CDB.
 7625  *  I bet, physical CDBs will never be used on the planet,
 7626  *  since they can be bounced without significant overhead.
 7627  */
 7628 static int sym_setup_cdb(hcb_p np, struct ccb_scsiio *csio, ccb_p cp)
 7629 {
 7630         struct ccb_hdr *ccb_h;
 7631         u32     cmd_ba;
 7632         int     cmd_len;
 7633 
 7634         SYM_LOCK_ASSERT(MA_OWNED);
 7635 
 7636         ccb_h = &csio->ccb_h;
 7637 
 7638         /*
 7639          *  CDB is 16 bytes max.
 7640          */
 7641         if (csio->cdb_len > sizeof(cp->cdb_buf)) {
 7642                 sym_set_cam_status(cp->cam_ccb, CAM_REQ_INVALID);
 7643                 return -1;
 7644         }
 7645         cmd_len = csio->cdb_len;
 7646 
 7647         if (ccb_h->flags & CAM_CDB_POINTER) {
 7648                 /* CDB is a pointer */
 7649                 if (!(ccb_h->flags & CAM_CDB_PHYS)) {
 7650                         /* CDB pointer is virtual */
 7651                         bcopy(csio->cdb_io.cdb_ptr, cp->cdb_buf, cmd_len);
 7652                         cmd_ba = CCB_BA (cp, cdb_buf[0]);
 7653                 } else {
 7654                         /* CDB pointer is physical */
 7655 #if 0
 7656                         cmd_ba = ((u32)csio->cdb_io.cdb_ptr) & 0xffffffff;
 7657 #else
 7658                         sym_set_cam_status(cp->cam_ccb, CAM_REQ_INVALID);
 7659                         return -1;
 7660 #endif
 7661                 }
 7662         } else {
 7663                 /* CDB is in the CAM ccb (buffer) */
 7664                 bcopy(csio->cdb_io.cdb_bytes, cp->cdb_buf, cmd_len);
 7665                 cmd_ba = CCB_BA (cp, cdb_buf[0]);
 7666         }
 7667 
 7668         cp->phys.cmd.addr       = cpu_to_scr(cmd_ba);
 7669         cp->phys.cmd.size       = cpu_to_scr(cmd_len);
 7670 
 7671         return 0;
 7672 }
 7673 
 7674 /*
 7675  *  Set up data pointers used by SCRIPTS.
 7676  */
 7677 static void __inline
 7678 sym_setup_data_pointers(hcb_p np, ccb_p cp, int dir)
 7679 {
 7680         u32 lastp, goalp;
 7681 
 7682         SYM_LOCK_ASSERT(MA_OWNED);
 7683 
 7684         /*
 7685          *  No segments means no data.
 7686          */
 7687         if (!cp->segments)
 7688                 dir = CAM_DIR_NONE;
 7689 
 7690         /*
 7691          *  Set the data pointer.
 7692          */
 7693         switch(dir) {
 7694         case CAM_DIR_OUT:
 7695                 goalp = SCRIPTA_BA (np, data_out2) + 8;
 7696                 lastp = goalp - 8 - (cp->segments * (2*4));
 7697                 break;
 7698         case CAM_DIR_IN:
 7699                 cp->host_flags |= HF_DATA_IN;
 7700                 goalp = SCRIPTA_BA (np, data_in2) + 8;
 7701                 lastp = goalp - 8 - (cp->segments * (2*4));
 7702                 break;
 7703         case CAM_DIR_NONE:
 7704         default:
 7705                 lastp = goalp = SCRIPTB_BA (np, no_data);
 7706                 break;
 7707         }
 7708 
 7709         cp->phys.head.lastp = cpu_to_scr(lastp);
 7710         cp->phys.head.goalp = cpu_to_scr(goalp);
 7711         cp->phys.head.savep = cpu_to_scr(lastp);
 7712         cp->startp          = cp->phys.head.savep;
 7713 }
 7714 
 7715 /*
 7716  *  Call back routine for the DMA map service.
 7717  *  If bounce buffers are used (why ?), we may sleep and then
 7718  *  be called there in another context.
 7719  */
 7720 static void
 7721 sym_execute_ccb(void *arg, bus_dma_segment_t *psegs, int nsegs, int error)
 7722 {
 7723         ccb_p   cp;
 7724         hcb_p   np;
 7725         union   ccb *ccb;
 7726 
 7727         cp  = (ccb_p) arg;
 7728         ccb = cp->cam_ccb;
 7729         np  = (hcb_p) cp->arg;
 7730 
 7731         SYM_LOCK_ASSERT(MA_OWNED);
 7732 
 7733         /*
 7734          *  Deal with weird races.
 7735          */
 7736         if (sym_get_cam_status(ccb) != CAM_REQ_INPROG)
 7737                 goto out_abort;
 7738 
 7739         /*
 7740          *  Deal with weird errors.
 7741          */
 7742         if (error) {
 7743                 cp->dmamapped = 0;
 7744                 sym_set_cam_status(cp->cam_ccb, CAM_REQ_ABORTED);
 7745                 goto out_abort;
 7746         }
 7747 
 7748         /*
 7749          *  Build the data descriptor for the chip.
 7750          */
 7751         if (nsegs) {
 7752                 int retv;
 7753                 /* 896 rev 1 requires to be careful about boundaries */
 7754                 if (np->device_id == PCI_ID_SYM53C896 && np->revision_id <= 1)
 7755                         retv = sym_scatter_sg_physical(np, cp, psegs, nsegs);
 7756                 else
 7757                         retv = sym_fast_scatter_sg_physical(np,cp, psegs,nsegs);
 7758                 if (retv < 0) {
 7759                         sym_set_cam_status(cp->cam_ccb, CAM_REQ_TOO_BIG);
 7760                         goto out_abort;
 7761                 }
 7762         }
 7763 
 7764         /*
 7765          *  Synchronize the DMA map only if we have
 7766          *  actually mapped the data.
 7767          */
 7768         if (cp->dmamapped) {
 7769                 bus_dmamap_sync(np->data_dmat, cp->dmamap,
 7770                         (cp->dmamapped == SYM_DMA_READ ?
 7771                                 BUS_DMASYNC_PREREAD : BUS_DMASYNC_PREWRITE));
 7772         }
 7773 
 7774         /*
 7775          *  Set host status to busy state.
 7776          *  May have been set back to HS_WAIT to avoid a race.
 7777          */
 7778         cp->host_status = cp->nego_status ? HS_NEGOTIATE : HS_BUSY;
 7779 
 7780         /*
 7781          *  Set data pointers.
 7782          */
 7783         sym_setup_data_pointers(np, cp,  (ccb->ccb_h.flags & CAM_DIR_MASK));
 7784 
 7785         /*
 7786          *  Enqueue this IO in our pending queue.
 7787          */
 7788         sym_enqueue_cam_ccb(cp);
 7789 
 7790         /*
 7791          *  When `#ifed 1', the code below makes the driver
 7792          *  panic on the first attempt to write to a SCSI device.
 7793          *  It is the first test we want to do after a driver
 7794          *  change that does not seem obviously safe. :)
 7795          */
 7796 #if 0
 7797         switch (cp->cdb_buf[0]) {
 7798         case 0x0A: case 0x2A: case 0xAA:
 7799                 panic("XXXXXXXXXXXXX WRITE NOT YET ALLOWED XXXXXXXXXXXXXX\n");
 7800                 MDELAY(10000);
 7801                 break;
 7802         default:
 7803                 break;
 7804         }
 7805 #endif
 7806         /*
 7807          *  Activate this job.
 7808          */
 7809         sym_put_start_queue(np, cp);
 7810         return;
 7811 out_abort:
 7812         sym_xpt_done(np, ccb, cp);
 7813         sym_free_ccb(np, cp);
 7814 }
 7815 
 7816 /*
 7817  *  How complex it gets to deal with the data in CAM.
 7818  *  The Bus Dma stuff makes things still more complex.
 7819  */
 7820 static void
 7821 sym_setup_data_and_start(hcb_p np, struct ccb_scsiio *csio, ccb_p cp)
 7822 {
 7823         struct ccb_hdr *ccb_h;
 7824         int dir, retv;
 7825 
 7826         SYM_LOCK_ASSERT(MA_OWNED);
 7827 
 7828         ccb_h = &csio->ccb_h;
 7829 
 7830         /*
 7831          *  Now deal with the data.
 7832          */
 7833         cp->data_len = csio->dxfer_len;
 7834         cp->arg      = np;
 7835 
 7836         /*
 7837          *  No direction means no data.
 7838          */
 7839         dir = (ccb_h->flags & CAM_DIR_MASK);
 7840         if (dir == CAM_DIR_NONE) {
 7841                 sym_execute_ccb(cp, NULL, 0, 0);
 7842                 return;
 7843         }
 7844 
 7845         cp->dmamapped = (dir == CAM_DIR_IN) ?  SYM_DMA_READ : SYM_DMA_WRITE;
 7846         retv = bus_dmamap_load_ccb(np->data_dmat, cp->dmamap,
 7847                                (union ccb *)csio, sym_execute_ccb, cp, 0);
 7848         if (retv == EINPROGRESS) {
 7849                 cp->host_status = HS_WAIT;
 7850                 xpt_freeze_simq(np->sim, 1);
 7851                 csio->ccb_h.status |= CAM_RELEASE_SIMQ;
 7852         }
 7853 }
 7854 
 7855 /*
 7856  *  Move the scatter list to our data block.
 7857  */
 7858 static int
 7859 sym_fast_scatter_sg_physical(hcb_p np, ccb_p cp,
 7860                              bus_dma_segment_t *psegs, int nsegs)
 7861 {
 7862         struct sym_tblmove *data;
 7863         bus_dma_segment_t *psegs2;
 7864 
 7865         SYM_LOCK_ASSERT(MA_OWNED);
 7866 
 7867         if (nsegs > SYM_CONF_MAX_SG)
 7868                 return -1;
 7869 
 7870         data   = &cp->phys.data[SYM_CONF_MAX_SG-1];
 7871         psegs2 = &psegs[nsegs-1];
 7872         cp->segments = nsegs;
 7873 
 7874         while (1) {
 7875                 data->addr = cpu_to_scr(psegs2->ds_addr);
 7876                 data->size = cpu_to_scr(psegs2->ds_len);
 7877                 if (DEBUG_FLAGS & DEBUG_SCATTER) {
 7878                         printf ("%s scatter: paddr=%lx len=%ld\n",
 7879                                 sym_name(np), (long) psegs2->ds_addr,
 7880                                 (long) psegs2->ds_len);
 7881                 }
 7882                 if (psegs2 != psegs) {
 7883                         --data;
 7884                         --psegs2;
 7885                         continue;
 7886                 }
 7887                 break;
 7888         }
 7889         return 0;
 7890 }
 7891 
 7892 /*
 7893  *  Scatter a SG list with physical addresses into bus addressable chunks.
 7894  */
 7895 static int
 7896 sym_scatter_sg_physical(hcb_p np, ccb_p cp, bus_dma_segment_t *psegs, int nsegs)
 7897 {
 7898         u_long  ps, pe, pn;
 7899         u_long  k;
 7900         int s, t;
 7901 
 7902         SYM_LOCK_ASSERT(MA_OWNED);
 7903 
 7904         s  = SYM_CONF_MAX_SG - 1;
 7905         t  = nsegs - 1;
 7906         ps = psegs[t].ds_addr;
 7907         pe = ps + psegs[t].ds_len;
 7908 
 7909         while (s >= 0) {
 7910                 pn = rounddown2(pe - 1, SYM_CONF_DMA_BOUNDARY);
 7911                 if (pn <= ps)
 7912                         pn = ps;
 7913                 k = pe - pn;
 7914                 if (DEBUG_FLAGS & DEBUG_SCATTER) {
 7915                         printf ("%s scatter: paddr=%lx len=%ld\n",
 7916                                 sym_name(np), pn, k);
 7917                 }
 7918                 cp->phys.data[s].addr = cpu_to_scr(pn);
 7919                 cp->phys.data[s].size = cpu_to_scr(k);
 7920                 --s;
 7921                 if (pn == ps) {
 7922                         if (--t < 0)
 7923                                 break;
 7924                         ps = psegs[t].ds_addr;
 7925                         pe = ps + psegs[t].ds_len;
 7926                 }
 7927                 else
 7928                         pe = pn;
 7929         }
 7930 
 7931         cp->segments = SYM_CONF_MAX_SG - 1 - s;
 7932 
 7933         return t >= 0 ? -1 : 0;
 7934 }
 7935 
 7936 /*
 7937  *  SIM action for non performance critical stuff.
 7938  */
 7939 static void sym_action2(struct cam_sim *sim, union ccb *ccb)
 7940 {
 7941         union ccb *abort_ccb;
 7942         struct ccb_hdr *ccb_h;
 7943         struct ccb_pathinq *cpi;
 7944         struct ccb_trans_settings *cts;
 7945         struct sym_trans *tip;
 7946         hcb_p   np;
 7947         tcb_p   tp;
 7948         lcb_p   lp;
 7949         u_char dflags;
 7950 
 7951         /*
 7952          *  Retrieve our controller data structure.
 7953          */
 7954         np = (hcb_p) cam_sim_softc(sim);
 7955 
 7956         SYM_LOCK_ASSERT(MA_OWNED);
 7957 
 7958         ccb_h = &ccb->ccb_h;
 7959 
 7960         switch (ccb_h->func_code) {
 7961         case XPT_SET_TRAN_SETTINGS:
 7962                 cts  = &ccb->cts;
 7963                 tp = &np->target[ccb_h->target_id];
 7964 
 7965                 /*
 7966                  *  Update SPI transport settings in TARGET control block.
 7967                  *  Update SCSI device settings in LUN control block.
 7968                  */
 7969                 lp = sym_lp(tp, ccb_h->target_lun);
 7970                 if (cts->type == CTS_TYPE_CURRENT_SETTINGS) {
 7971                         sym_update_trans(np, &tp->tinfo.goal, cts);
 7972                         if (lp)
 7973                                 sym_update_dflags(np, &lp->current_flags, cts);
 7974                 }
 7975                 if (cts->type == CTS_TYPE_USER_SETTINGS) {
 7976                         sym_update_trans(np, &tp->tinfo.user, cts);
 7977                         if (lp)
 7978                                 sym_update_dflags(np, &lp->user_flags, cts);
 7979                 }
 7980 
 7981                 sym_xpt_done2(np, ccb, CAM_REQ_CMP);
 7982                 break;
 7983         case XPT_GET_TRAN_SETTINGS:
 7984                 cts = &ccb->cts;
 7985                 tp = &np->target[ccb_h->target_id];
 7986                 lp = sym_lp(tp, ccb_h->target_lun);
 7987 
 7988 #define cts__scsi (&cts->proto_specific.scsi)
 7989 #define cts__spi  (&cts->xport_specific.spi)
 7990                 if (cts->type == CTS_TYPE_CURRENT_SETTINGS) {
 7991                         tip = &tp->tinfo.current;
 7992                         dflags = lp ? lp->current_flags : 0;
 7993                 }
 7994                 else {
 7995                         tip = &tp->tinfo.user;
 7996                         dflags = lp ? lp->user_flags : tp->usrflags;
 7997                 }
 7998 
 7999                 cts->protocol  = PROTO_SCSI;
 8000                 cts->transport = XPORT_SPI;
 8001                 cts->protocol_version  = tip->scsi_version;
 8002                 cts->transport_version = tip->spi_version;
 8003 
 8004                 cts__spi->sync_period = tip->period;
 8005                 cts__spi->sync_offset = tip->offset;
 8006                 cts__spi->bus_width   = tip->width;
 8007                 cts__spi->ppr_options = tip->options;
 8008 
 8009                 cts__spi->valid = CTS_SPI_VALID_SYNC_RATE
 8010                                 | CTS_SPI_VALID_SYNC_OFFSET
 8011                                 | CTS_SPI_VALID_BUS_WIDTH
 8012                                 | CTS_SPI_VALID_PPR_OPTIONS;
 8013 
 8014                 cts__spi->flags &= ~CTS_SPI_FLAGS_DISC_ENB;
 8015                 if (dflags & SYM_DISC_ENABLED)
 8016                         cts__spi->flags |= CTS_SPI_FLAGS_DISC_ENB;
 8017                 cts__spi->valid |= CTS_SPI_VALID_DISC;
 8018 
 8019                 cts__scsi->flags &= ~CTS_SCSI_FLAGS_TAG_ENB;
 8020                 if (dflags & SYM_TAGS_ENABLED)
 8021                         cts__scsi->flags |= CTS_SCSI_FLAGS_TAG_ENB;
 8022                 cts__scsi->valid |= CTS_SCSI_VALID_TQ;
 8023 #undef  cts__spi
 8024 #undef  cts__scsi
 8025                 sym_xpt_done2(np, ccb, CAM_REQ_CMP);
 8026                 break;
 8027         case XPT_CALC_GEOMETRY:
 8028                 cam_calc_geometry(&ccb->ccg, /*extended*/1);
 8029                 sym_xpt_done2(np, ccb, CAM_REQ_CMP);
 8030                 break;
 8031         case XPT_PATH_INQ:
 8032                 cpi = &ccb->cpi;
 8033                 cpi->version_num = 1;
 8034                 cpi->hba_inquiry = PI_MDP_ABLE|PI_SDTR_ABLE|PI_TAG_ABLE;
 8035                 if ((np->features & FE_WIDE) != 0)
 8036                         cpi->hba_inquiry |= PI_WIDE_16;
 8037                 cpi->target_sprt = 0;
 8038                 cpi->hba_misc = PIM_UNMAPPED;
 8039                 if (np->usrflags & SYM_SCAN_TARGETS_HILO)
 8040                         cpi->hba_misc |= PIM_SCANHILO;
 8041                 if (np->usrflags & SYM_AVOID_BUS_RESET)
 8042                         cpi->hba_misc |= PIM_NOBUSRESET;
 8043                 cpi->hba_eng_cnt = 0;
 8044                 cpi->max_target = (np->features & FE_WIDE) ? 15 : 7;
 8045                 /* Semantic problem:)LUN number max = max number of LUNs - 1 */
 8046                 cpi->max_lun = SYM_CONF_MAX_LUN-1;
 8047                 if (SYM_SETUP_MAX_LUN < SYM_CONF_MAX_LUN)
 8048                         cpi->max_lun = SYM_SETUP_MAX_LUN-1;
 8049                 cpi->bus_id = cam_sim_bus(sim);
 8050                 cpi->initiator_id = np->myaddr;
 8051                 cpi->base_transfer_speed = 3300;
 8052                 strlcpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
 8053                 strlcpy(cpi->hba_vid, "Symbios", HBA_IDLEN);
 8054                 strlcpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
 8055                 cpi->unit_number = cam_sim_unit(sim);
 8056 
 8057                 cpi->protocol = PROTO_SCSI;
 8058                 cpi->protocol_version = SCSI_REV_2;
 8059                 cpi->transport = XPORT_SPI;
 8060                 cpi->transport_version = 2;
 8061                 cpi->xport_specific.spi.ppr_options = SID_SPI_CLOCK_ST;
 8062                 if (np->features & FE_ULTRA3) {
 8063                         cpi->transport_version = 3;
 8064                         cpi->xport_specific.spi.ppr_options =
 8065                             SID_SPI_CLOCK_DT_ST;
 8066                 }
 8067                 cpi->maxio = SYM_CONF_MAX_SG * PAGE_SIZE;
 8068                 sym_xpt_done2(np, ccb, CAM_REQ_CMP);
 8069                 break;
 8070         case XPT_ABORT:
 8071                 abort_ccb = ccb->cab.abort_ccb;
 8072                 switch(abort_ccb->ccb_h.func_code) {
 8073                 case XPT_SCSI_IO:
 8074                         if (sym_abort_scsiio(np, abort_ccb, 0) == 0) {
 8075                                 sym_xpt_done2(np, ccb, CAM_REQ_CMP);
 8076                                 break;
 8077                         }
 8078                 default:
 8079                         sym_xpt_done2(np, ccb, CAM_UA_ABORT);
 8080                         break;
 8081                 }
 8082                 break;
 8083         case XPT_RESET_DEV:
 8084                 sym_reset_dev(np, ccb);
 8085                 break;
 8086         case XPT_RESET_BUS:
 8087                 sym_reset_scsi_bus(np, 0);
 8088                 if (sym_verbose) {
 8089                         xpt_print_path(np->path);
 8090                         printf("SCSI BUS reset delivered.\n");
 8091                 }
 8092                 sym_init (np, 1);
 8093                 sym_xpt_done2(np, ccb, CAM_REQ_CMP);
 8094                 break;
 8095         case XPT_TERM_IO:
 8096         default:
 8097                 sym_xpt_done2(np, ccb, CAM_REQ_INVALID);
 8098                 break;
 8099         }
 8100 }
 8101 
 8102 /*
 8103  *  Asynchronous notification handler.
 8104  */
 8105 static void
 8106 sym_async(void *cb_arg, u32 code, struct cam_path *path, void *args __unused)
 8107 {
 8108         hcb_p np;
 8109         struct cam_sim *sim;
 8110         u_int tn;
 8111         tcb_p tp;
 8112 
 8113         sim = (struct cam_sim *) cb_arg;
 8114         np  = (hcb_p) cam_sim_softc(sim);
 8115 
 8116         SYM_LOCK_ASSERT(MA_OWNED);
 8117 
 8118         switch (code) {
 8119         case AC_LOST_DEVICE:
 8120                 tn = xpt_path_target_id(path);
 8121                 if (tn >= SYM_CONF_MAX_TARGET)
 8122                         break;
 8123 
 8124                 tp = &np->target[tn];
 8125 
 8126                 tp->to_reset  = 0;
 8127                 tp->head.sval = 0;
 8128                 tp->head.wval = np->rv_scntl3;
 8129                 tp->head.uval = 0;
 8130 
 8131                 tp->tinfo.current.period  = tp->tinfo.goal.period = 0;
 8132                 tp->tinfo.current.offset  = tp->tinfo.goal.offset = 0;
 8133                 tp->tinfo.current.width   = tp->tinfo.goal.width  = BUS_8_BIT;
 8134                 tp->tinfo.current.options = tp->tinfo.goal.options = 0;
 8135 
 8136                 break;
 8137         default:
 8138                 break;
 8139         }
 8140 }
 8141 
 8142 /*
 8143  *  Update transfer settings of a target.
 8144  */
 8145 static void sym_update_trans(hcb_p np, struct sym_trans *tip,
 8146     struct ccb_trans_settings *cts)
 8147 {
 8148 
 8149         SYM_LOCK_ASSERT(MA_OWNED);
 8150 
 8151         /*
 8152          *  Update the infos.
 8153          */
 8154 #define cts__spi (&cts->xport_specific.spi)
 8155         if ((cts__spi->valid & CTS_SPI_VALID_BUS_WIDTH) != 0)
 8156                 tip->width = cts__spi->bus_width;
 8157         if ((cts__spi->valid & CTS_SPI_VALID_SYNC_OFFSET) != 0)
 8158                 tip->offset = cts__spi->sync_offset;
 8159         if ((cts__spi->valid & CTS_SPI_VALID_SYNC_RATE) != 0)
 8160                 tip->period = cts__spi->sync_period;
 8161         if ((cts__spi->valid & CTS_SPI_VALID_PPR_OPTIONS) != 0)
 8162                 tip->options = (cts__spi->ppr_options & PPR_OPT_DT);
 8163         if (cts->protocol_version != PROTO_VERSION_UNSPECIFIED &&
 8164             cts->protocol_version != PROTO_VERSION_UNKNOWN)
 8165                 tip->scsi_version = cts->protocol_version;
 8166         if (cts->transport_version != XPORT_VERSION_UNSPECIFIED &&
 8167             cts->transport_version != XPORT_VERSION_UNKNOWN)
 8168                 tip->spi_version = cts->transport_version;
 8169 #undef cts__spi
 8170         /*
 8171          *  Scale against driver configuration limits.
 8172          */
 8173         if (tip->width  > SYM_SETUP_MAX_WIDE) tip->width  = SYM_SETUP_MAX_WIDE;
 8174         if (tip->period && tip->offset) {
 8175                 if (tip->offset > SYM_SETUP_MAX_OFFS) tip->offset = SYM_SETUP_MAX_OFFS;
 8176                 if (tip->period < SYM_SETUP_MIN_SYNC) tip->period = SYM_SETUP_MIN_SYNC;
 8177         } else {
 8178                 tip->offset = 0;
 8179                 tip->period = 0;
 8180         }
 8181 
 8182         /*
 8183          *  Scale against actual controller BUS width.
 8184          */
 8185         if (tip->width > np->maxwide)
 8186                 tip->width  = np->maxwide;
 8187 
 8188         /*
 8189          *  Only accept DT if controller supports and SYNC/WIDE asked.
 8190          */
 8191         if (!((np->features & (FE_C10|FE_ULTRA3)) == (FE_C10|FE_ULTRA3)) ||
 8192             !(tip->width == BUS_16_BIT && tip->offset)) {
 8193                 tip->options &= ~PPR_OPT_DT;
 8194         }
 8195 
 8196         /*
 8197          *  Scale period factor and offset against controller limits.
 8198          */
 8199         if (tip->offset && tip->period) {
 8200                 if (tip->options & PPR_OPT_DT) {
 8201                         if (tip->period < np->minsync_dt)
 8202                                 tip->period = np->minsync_dt;
 8203                         if (tip->period > np->maxsync_dt)
 8204                                 tip->period = np->maxsync_dt;
 8205                         if (tip->offset > np->maxoffs_dt)
 8206                                 tip->offset = np->maxoffs_dt;
 8207                 }
 8208                 else {
 8209                         if (tip->period < np->minsync)
 8210                                 tip->period = np->minsync;
 8211                         if (tip->period > np->maxsync)
 8212                                 tip->period = np->maxsync;
 8213                         if (tip->offset > np->maxoffs)
 8214                                 tip->offset = np->maxoffs;
 8215                 }
 8216         }
 8217 }
 8218 
 8219 /*
 8220  *  Update flags for a device (logical unit).
 8221  */
 8222 static void
 8223 sym_update_dflags(hcb_p np, u_char *flags, struct ccb_trans_settings *cts)
 8224 {
 8225 
 8226         SYM_LOCK_ASSERT(MA_OWNED);
 8227 
 8228 #define cts__scsi (&cts->proto_specific.scsi)
 8229 #define cts__spi  (&cts->xport_specific.spi)
 8230         if ((cts__spi->valid & CTS_SPI_VALID_DISC) != 0) {
 8231                 if ((cts__spi->flags & CTS_SPI_FLAGS_DISC_ENB) != 0)
 8232                         *flags |= SYM_DISC_ENABLED;
 8233                 else
 8234                         *flags &= ~SYM_DISC_ENABLED;
 8235         }
 8236 
 8237         if ((cts__scsi->valid & CTS_SCSI_VALID_TQ) != 0) {
 8238                 if ((cts__scsi->flags & CTS_SCSI_FLAGS_TAG_ENB) != 0)
 8239                         *flags |= SYM_TAGS_ENABLED;
 8240                 else
 8241                         *flags &= ~SYM_TAGS_ENABLED;
 8242         }
 8243 #undef  cts__spi
 8244 #undef  cts__scsi
 8245 }
 8246 
 8247 /*============= DRIVER INITIALISATION ==================*/
 8248 
 8249 static device_method_t sym_pci_methods[] = {
 8250         DEVMETHOD(device_probe,  sym_pci_probe),
 8251         DEVMETHOD(device_attach, sym_pci_attach),
 8252         DEVMETHOD_END
 8253 };
 8254 
 8255 static driver_t sym_pci_driver = {
 8256         "sym",
 8257         sym_pci_methods,
 8258         1       /* no softc */
 8259 };
 8260 
 8261 static devclass_t sym_devclass;
 8262 
 8263 DRIVER_MODULE(sym, pci, sym_pci_driver, sym_devclass, NULL, NULL);
 8264 MODULE_DEPEND(sym, cam, 1, 1, 1);
 8265 MODULE_DEPEND(sym, pci, 1, 1, 1);
 8266 
 8267 static const struct sym_pci_chip sym_pci_dev_table[] = {
 8268  {PCI_ID_SYM53C810, 0x0f, "810", 4, 8, 4, 64,
 8269  FE_ERL}
 8270  ,
 8271 #ifdef SYM_DEBUG_GENERIC_SUPPORT
 8272  {PCI_ID_SYM53C810, 0xff, "810a", 4,  8, 4, 1,
 8273  FE_BOF}
 8274  ,
 8275 #else
 8276  {PCI_ID_SYM53C810, 0xff, "810a", 4,  8, 4, 1,
 8277  FE_CACHE_SET|FE_LDSTR|FE_PFEN|FE_BOF}
 8278  ,
 8279 #endif
 8280  {PCI_ID_SYM53C815, 0xff, "815", 4,  8, 4, 64,
 8281  FE_BOF|FE_ERL}
 8282  ,
 8283  {PCI_ID_SYM53C825, 0x0f, "825", 6,  8, 4, 64,
 8284  FE_WIDE|FE_BOF|FE_ERL|FE_DIFF}
 8285  ,
 8286  {PCI_ID_SYM53C825, 0xff, "825a", 6,  8, 4, 2,
 8287  FE_WIDE|FE_CACHE0_SET|FE_BOF|FE_DFS|FE_LDSTR|FE_PFEN|FE_RAM|FE_DIFF}
 8288  ,
 8289  {PCI_ID_SYM53C860, 0xff, "860", 4,  8, 5, 1,
 8290  FE_ULTRA|FE_CLK80|FE_CACHE_SET|FE_BOF|FE_LDSTR|FE_PFEN}
 8291  ,
 8292  {PCI_ID_SYM53C875, 0x01, "875", 6, 16, 5, 2,
 8293  FE_WIDE|FE_ULTRA|FE_CLK80|FE_CACHE0_SET|FE_BOF|FE_DFS|FE_LDSTR|FE_PFEN|
 8294  FE_RAM|FE_DIFF}
 8295  ,
 8296  {PCI_ID_SYM53C875, 0xff, "875", 6, 16, 5, 2,
 8297  FE_WIDE|FE_ULTRA|FE_DBLR|FE_CACHE0_SET|FE_BOF|FE_DFS|FE_LDSTR|FE_PFEN|
 8298  FE_RAM|FE_DIFF}
 8299  ,
 8300  {PCI_ID_SYM53C875_2, 0xff, "875", 6, 16, 5, 2,
 8301  FE_WIDE|FE_ULTRA|FE_DBLR|FE_CACHE0_SET|FE_BOF|FE_DFS|FE_LDSTR|FE_PFEN|
 8302  FE_RAM|FE_DIFF}
 8303  ,
 8304  {PCI_ID_SYM53C885, 0xff, "885", 6, 16, 5, 2,
 8305  FE_WIDE|FE_ULTRA|FE_DBLR|FE_CACHE0_SET|FE_BOF|FE_DFS|FE_LDSTR|FE_PFEN|
 8306  FE_RAM|FE_DIFF}
 8307  ,
 8308 #ifdef SYM_DEBUG_GENERIC_SUPPORT
 8309  {PCI_ID_SYM53C895, 0xff, "895", 6, 31, 7, 2,
 8310  FE_WIDE|FE_ULTRA2|FE_QUAD|FE_CACHE_SET|FE_BOF|FE_DFS|
 8311  FE_RAM|FE_LCKFRQ}
 8312  ,
 8313 #else
 8314  {PCI_ID_SYM53C895, 0xff, "895", 6, 31, 7, 2,
 8315  FE_WIDE|FE_ULTRA2|FE_QUAD|FE_CACHE_SET|FE_BOF|FE_DFS|FE_LDSTR|FE_PFEN|
 8316  FE_RAM|FE_LCKFRQ}
 8317  ,
 8318 #endif
 8319  {PCI_ID_SYM53C896, 0xff, "896", 6, 31, 7, 4,
 8320  FE_WIDE|FE_ULTRA2|FE_QUAD|FE_CACHE_SET|FE_BOF|FE_DFS|FE_LDSTR|FE_PFEN|
 8321  FE_RAM|FE_RAM8K|FE_64BIT|FE_DAC|FE_IO256|FE_NOPM|FE_LEDC|FE_LCKFRQ}
 8322  ,
 8323  {PCI_ID_SYM53C895A, 0xff, "895a", 6, 31, 7, 4,
 8324  FE_WIDE|FE_ULTRA2|FE_QUAD|FE_CACHE_SET|FE_BOF|FE_DFS|FE_LDSTR|FE_PFEN|
 8325  FE_RAM|FE_RAM8K|FE_DAC|FE_IO256|FE_NOPM|FE_LEDC|FE_LCKFRQ}
 8326  ,
 8327  {PCI_ID_LSI53C1010, 0x00, "1010-33", 6, 31, 7, 8,
 8328  FE_WIDE|FE_ULTRA3|FE_QUAD|FE_CACHE_SET|FE_BOF|FE_DFBC|FE_LDSTR|FE_PFEN|
 8329  FE_RAM|FE_RAM8K|FE_64BIT|FE_DAC|FE_IO256|FE_NOPM|FE_LEDC|FE_CRC|
 8330  FE_C10}
 8331  ,
 8332  {PCI_ID_LSI53C1010, 0xff, "1010-33", 6, 31, 7, 8,
 8333  FE_WIDE|FE_ULTRA3|FE_QUAD|FE_CACHE_SET|FE_BOF|FE_DFBC|FE_LDSTR|FE_PFEN|
 8334  FE_RAM|FE_RAM8K|FE_64BIT|FE_DAC|FE_IO256|FE_NOPM|FE_LEDC|FE_CRC|
 8335  FE_C10|FE_U3EN}
 8336  ,
 8337  {PCI_ID_LSI53C1010_2, 0xff, "1010-66", 6, 31, 7, 8,
 8338  FE_WIDE|FE_ULTRA3|FE_QUAD|FE_CACHE_SET|FE_BOF|FE_DFBC|FE_LDSTR|FE_PFEN|
 8339  FE_RAM|FE_RAM8K|FE_64BIT|FE_DAC|FE_IO256|FE_NOPM|FE_LEDC|FE_66MHZ|FE_CRC|
 8340  FE_C10|FE_U3EN}
 8341  ,
 8342  {PCI_ID_LSI53C1510D, 0xff, "1510d", 6, 31, 7, 4,
 8343  FE_WIDE|FE_ULTRA2|FE_QUAD|FE_CACHE_SET|FE_BOF|FE_DFS|FE_LDSTR|FE_PFEN|
 8344  FE_RAM|FE_IO256|FE_LEDC}
 8345 };
 8346 
 8347 /*
 8348  *  Look up the chip table.
 8349  *
 8350  *  Return a pointer to the chip entry if found,
 8351  *  zero otherwise.
 8352  */
 8353 static const struct sym_pci_chip *
 8354 sym_find_pci_chip(device_t dev)
 8355 {
 8356         const struct    sym_pci_chip *chip;
 8357         int     i;
 8358         u_short device_id;
 8359         u_char  revision;
 8360 
 8361         if (pci_get_vendor(dev) != PCI_VENDOR_NCR)
 8362                 return NULL;
 8363 
 8364         device_id = pci_get_device(dev);
 8365         revision  = pci_get_revid(dev);
 8366 
 8367         for (i = 0; i < nitems(sym_pci_dev_table); i++) {
 8368                 chip = &sym_pci_dev_table[i];
 8369                 if (device_id != chip->device_id)
 8370                         continue;
 8371                 if (revision > chip->revision_id)
 8372                         continue;
 8373                 return chip;
 8374         }
 8375 
 8376         return NULL;
 8377 }
 8378 
 8379 /*
 8380  *  Tell upper layer if the chip is supported.
 8381  */
 8382 static int
 8383 sym_pci_probe(device_t dev)
 8384 {
 8385         const struct    sym_pci_chip *chip;
 8386 
 8387         chip = sym_find_pci_chip(dev);
 8388         if (chip && sym_find_firmware(chip)) {
 8389                 device_set_desc(dev, chip->name);
 8390                 return (chip->lp_probe_bit & SYM_SETUP_LP_PROBE_MAP)?
 8391                   BUS_PROBE_LOW_PRIORITY : BUS_PROBE_DEFAULT;
 8392         }
 8393         return ENXIO;
 8394 }
 8395 
 8396 /*
 8397  *  Attach a sym53c8xx device.
 8398  */
 8399 static int
 8400 sym_pci_attach(device_t dev)
 8401 {
 8402         const struct    sym_pci_chip *chip;
 8403         u_short command;
 8404         u_char  cachelnsz;
 8405         struct  sym_hcb *np = NULL;
 8406         struct  sym_nvram nvram;
 8407         const struct    sym_fw *fw = NULL;
 8408         int     i;
 8409         bus_dma_tag_t   bus_dmat;
 8410 
 8411         bus_dmat = bus_get_dma_tag(dev);
 8412 
 8413         /*
 8414          *  Only probed devices should be attached.
 8415          *  We just enjoy being paranoid. :)
 8416          */
 8417         chip = sym_find_pci_chip(dev);
 8418         if (chip == NULL || (fw = sym_find_firmware(chip)) == NULL)
 8419                 return (ENXIO);
 8420 
 8421         /*
 8422          *  Allocate immediately the host control block,
 8423          *  since we are only expecting to succeed. :)
 8424          *  We keep track in the HCB of all the resources that
 8425          *  are to be released on error.
 8426          */
 8427         np = __sym_calloc_dma(bus_dmat, sizeof(*np), "HCB");
 8428         if (np)
 8429                 np->bus_dmat = bus_dmat;
 8430         else
 8431                 return (ENXIO);
 8432         device_set_softc(dev, np);
 8433 
 8434         SYM_LOCK_INIT();
 8435 
 8436         /*
 8437          *  Copy some useful infos to the HCB.
 8438          */
 8439         np->hcb_ba       = vtobus(np);
 8440         np->verbose      = bootverbose;
 8441         np->device       = dev;
 8442         np->device_id    = pci_get_device(dev);
 8443         np->revision_id  = pci_get_revid(dev);
 8444         np->features     = chip->features;
 8445         np->clock_divn   = chip->nr_divisor;
 8446         np->maxoffs      = chip->offset_max;
 8447         np->maxburst     = chip->burst_max;
 8448         np->scripta_sz   = fw->a_size;
 8449         np->scriptb_sz   = fw->b_size;
 8450         np->fw_setup     = fw->setup;
 8451         np->fw_patch     = fw->patch;
 8452         np->fw_name      = fw->name;
 8453 
 8454 #ifdef __amd64__
 8455         np->target = sym_calloc_dma(SYM_CONF_MAX_TARGET * sizeof(*(np->target)),
 8456                         "TARGET");
 8457         if (!np->target)
 8458                 goto attach_failed;
 8459 #endif
 8460 
 8461         /*
 8462          *  Initialize the CCB free and busy queues.
 8463          */
 8464         sym_que_init(&np->free_ccbq);
 8465         sym_que_init(&np->busy_ccbq);
 8466         sym_que_init(&np->comp_ccbq);
 8467         sym_que_init(&np->cam_ccbq);
 8468 
 8469         /*
 8470          *  Allocate a tag for the DMA of user data.
 8471          */
 8472         if (bus_dma_tag_create(np->bus_dmat, 1, SYM_CONF_DMA_BOUNDARY,
 8473             BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
 8474             BUS_SPACE_MAXSIZE_32BIT, SYM_CONF_MAX_SG, SYM_CONF_DMA_BOUNDARY,
 8475             0, busdma_lock_mutex, &np->mtx, &np->data_dmat)) {
 8476                 device_printf(dev, "failed to create DMA tag.\n");
 8477                 goto attach_failed;
 8478         }
 8479 
 8480         /*
 8481          *  Read and apply some fix-ups to the PCI COMMAND
 8482          *  register. We want the chip to be enabled for:
 8483          *  - BUS mastering
 8484          *  - PCI parity checking (reporting would also be fine)
 8485          *  - Write And Invalidate.
 8486          */
 8487         command = pci_read_config(dev, PCIR_COMMAND, 2);
 8488         command |= PCIM_CMD_BUSMASTEREN | PCIM_CMD_PERRESPEN |
 8489             PCIM_CMD_MWRICEN;
 8490         pci_write_config(dev, PCIR_COMMAND, command, 2);
 8491 
 8492         /*
 8493          *  Let the device know about the cache line size,
 8494          *  if it doesn't yet.
 8495          */
 8496         cachelnsz = pci_read_config(dev, PCIR_CACHELNSZ, 1);
 8497         if (!cachelnsz) {
 8498                 cachelnsz = 8;
 8499                 pci_write_config(dev, PCIR_CACHELNSZ, cachelnsz, 1);
 8500         }
 8501 
 8502         /*
 8503          *  Alloc/get/map/retrieve everything that deals with MMIO.
 8504          */
 8505         i = SYM_PCI_MMIO;
 8506         np->mmio_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &i,
 8507             RF_ACTIVE);
 8508         if (!np->mmio_res) {
 8509                 device_printf(dev, "failed to allocate MMIO resources\n");
 8510                 goto attach_failed;
 8511         }
 8512         np->mmio_ba = rman_get_start(np->mmio_res);
 8513 
 8514         /*
 8515          *  Allocate the IRQ.
 8516          */
 8517         i = 0;
 8518         np->irq_res = bus_alloc_resource_any(dev, SYS_RES_IRQ, &i,
 8519                                              RF_ACTIVE | RF_SHAREABLE);
 8520         if (!np->irq_res) {
 8521                 device_printf(dev, "failed to allocate IRQ resource\n");
 8522                 goto attach_failed;
 8523         }
 8524 
 8525 #ifdef  SYM_CONF_IOMAPPED
 8526         /*
 8527          *  User want us to use normal IO with PCI.
 8528          *  Alloc/get/map/retrieve everything that deals with IO.
 8529          */
 8530         i = SYM_PCI_IO;
 8531         np->io_res = bus_alloc_resource_any(dev, SYS_RES_IOPORT, &i, RF_ACTIVE);
 8532         if (!np->io_res) {
 8533                 device_printf(dev, "failed to allocate IO resources\n");
 8534                 goto attach_failed;
 8535         }
 8536 
 8537 #endif /* SYM_CONF_IOMAPPED */
 8538 
 8539         /*
 8540          *  If the chip has RAM.
 8541          *  Alloc/get/map/retrieve the corresponding resources.
 8542          */
 8543         if (np->features & (FE_RAM|FE_RAM8K)) {
 8544                 int regs_id = SYM_PCI_RAM;
 8545                 if (np->features & FE_64BIT)
 8546                         regs_id = SYM_PCI_RAM64;
 8547                 np->ram_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY,
 8548                                                      &regs_id, RF_ACTIVE);
 8549                 if (!np->ram_res) {
 8550                         device_printf(dev,"failed to allocate RAM resources\n");
 8551                         goto attach_failed;
 8552                 }
 8553                 np->ram_id  = regs_id;
 8554                 np->ram_ba = rman_get_start(np->ram_res);
 8555         }
 8556 
 8557         /*
 8558          *  Save setting of some IO registers, so we will
 8559          *  be able to probe specific implementations.
 8560          */
 8561         sym_save_initial_setting (np);
 8562 
 8563         /*
 8564          *  Reset the chip now, since it has been reported
 8565          *  that SCSI clock calibration may not work properly
 8566          *  if the chip is currently active.
 8567          */
 8568         sym_chip_reset (np);
 8569 
 8570         /*
 8571          *  Try to read the user set-up.
 8572          */
 8573         (void) sym_read_nvram(np, &nvram);
 8574 
 8575         /*
 8576          *  Prepare controller and devices settings, according
 8577          *  to chip features, user set-up and driver set-up.
 8578          */
 8579         (void) sym_prepare_setting(np, &nvram);
 8580 
 8581         /*
 8582          *  Check the PCI clock frequency.
 8583          *  Must be performed after prepare_setting since it destroys
 8584          *  STEST1 that is used to probe for the clock doubler.
 8585          */
 8586         i = sym_getpciclock(np);
 8587         if (i > 37000)
 8588                 device_printf(dev, "PCI BUS clock seems too high: %u KHz.\n",i);
 8589 
 8590         /*
 8591          *  Allocate the start queue.
 8592          */
 8593         np->squeue = (u32 *) sym_calloc_dma(sizeof(u32)*(MAX_QUEUE*2),"SQUEUE");
 8594         if (!np->squeue)
 8595                 goto attach_failed;
 8596         np->squeue_ba = vtobus(np->squeue);
 8597 
 8598         /*
 8599          *  Allocate the done queue.
 8600          */
 8601         np->dqueue = (u32 *) sym_calloc_dma(sizeof(u32)*(MAX_QUEUE*2),"DQUEUE");
 8602         if (!np->dqueue)
 8603                 goto attach_failed;
 8604         np->dqueue_ba = vtobus(np->dqueue);
 8605 
 8606         /*
 8607          *  Allocate the target bus address array.
 8608          */
 8609         np->targtbl = (u32 *) sym_calloc_dma(256, "TARGTBL");
 8610         if (!np->targtbl)
 8611                 goto attach_failed;
 8612         np->targtbl_ba = vtobus(np->targtbl);
 8613 
 8614         /*
 8615          *  Allocate SCRIPTS areas.
 8616          */
 8617         np->scripta0 = sym_calloc_dma(np->scripta_sz, "SCRIPTA0");
 8618         np->scriptb0 = sym_calloc_dma(np->scriptb_sz, "SCRIPTB0");
 8619         if (!np->scripta0 || !np->scriptb0)
 8620                 goto attach_failed;
 8621 
 8622         /*
 8623          *  Allocate the CCBs. We need at least ONE.
 8624          */
 8625         for (i = 0; sym_alloc_ccb(np) != NULL; i++)
 8626                 ;
 8627         if (i < 1)
 8628                 goto attach_failed;
 8629 
 8630         /*
 8631          *  Calculate BUS addresses where we are going
 8632          *  to load the SCRIPTS.
 8633          */
 8634         np->scripta_ba  = vtobus(np->scripta0);
 8635         np->scriptb_ba  = vtobus(np->scriptb0);
 8636         np->scriptb0_ba = np->scriptb_ba;
 8637 
 8638         if (np->ram_ba) {
 8639                 np->scripta_ba  = np->ram_ba;
 8640                 if (np->features & FE_RAM8K) {
 8641                         np->ram_ws = 8192;
 8642                         np->scriptb_ba = np->scripta_ba + 4096;
 8643 #ifdef __LP64__
 8644                         np->scr_ram_seg = cpu_to_scr(np->scripta_ba >> 32);
 8645 #endif
 8646                 }
 8647                 else
 8648                         np->ram_ws = 4096;
 8649         }
 8650 
 8651         /*
 8652          *  Copy scripts to controller instance.
 8653          */
 8654         bcopy(fw->a_base, np->scripta0, np->scripta_sz);
 8655         bcopy(fw->b_base, np->scriptb0, np->scriptb_sz);
 8656 
 8657         /*
 8658          *  Setup variable parts in scripts and compute
 8659          *  scripts bus addresses used from the C code.
 8660          */
 8661         np->fw_setup(np, fw);
 8662 
 8663         /*
 8664          *  Bind SCRIPTS with physical addresses usable by the
 8665          *  SCRIPTS processor (as seen from the BUS = BUS addresses).
 8666          */
 8667         sym_fw_bind_script(np, (u32 *) np->scripta0, np->scripta_sz);
 8668         sym_fw_bind_script(np, (u32 *) np->scriptb0, np->scriptb_sz);
 8669 
 8670 #ifdef SYM_CONF_IARB_SUPPORT
 8671         /*
 8672          *    If user wants IARB to be set when we win arbitration
 8673          *    and have other jobs, compute the max number of consecutive
 8674          *    settings of IARB hints before we leave devices a chance to
 8675          *    arbitrate for reselection.
 8676          */
 8677 #ifdef  SYM_SETUP_IARB_MAX
 8678         np->iarb_max = SYM_SETUP_IARB_MAX;
 8679 #else
 8680         np->iarb_max = 4;
 8681 #endif
 8682 #endif
 8683 
 8684         /*
 8685          *  Prepare the idle and invalid task actions.
 8686          */
 8687         np->idletask.start      = cpu_to_scr(SCRIPTA_BA (np, idle));
 8688         np->idletask.restart    = cpu_to_scr(SCRIPTB_BA (np, bad_i_t_l));
 8689         np->idletask_ba         = vtobus(&np->idletask);
 8690 
 8691         np->notask.start        = cpu_to_scr(SCRIPTA_BA (np, idle));
 8692         np->notask.restart      = cpu_to_scr(SCRIPTB_BA (np, bad_i_t_l));
 8693         np->notask_ba           = vtobus(&np->notask);
 8694 
 8695         np->bad_itl.start       = cpu_to_scr(SCRIPTA_BA (np, idle));
 8696         np->bad_itl.restart     = cpu_to_scr(SCRIPTB_BA (np, bad_i_t_l));
 8697         np->bad_itl_ba          = vtobus(&np->bad_itl);
 8698 
 8699         np->bad_itlq.start      = cpu_to_scr(SCRIPTA_BA (np, idle));
 8700         np->bad_itlq.restart    = cpu_to_scr(SCRIPTB_BA (np,bad_i_t_l_q));
 8701         np->bad_itlq_ba         = vtobus(&np->bad_itlq);
 8702 
 8703         /*
 8704          *  Allocate and prepare the lun JUMP table that is used
 8705          *  for a target prior the probing of devices (bad lun table).
 8706          *  A private table will be allocated for the target on the
 8707          *  first INQUIRY response received.
 8708          */
 8709         np->badluntbl = sym_calloc_dma(256, "BADLUNTBL");
 8710         if (!np->badluntbl)
 8711                 goto attach_failed;
 8712 
 8713         np->badlun_sa = cpu_to_scr(SCRIPTB_BA (np, resel_bad_lun));
 8714         for (i = 0 ; i < 64 ; i++)      /* 64 luns/target, no less */
 8715                 np->badluntbl[i] = cpu_to_scr(vtobus(&np->badlun_sa));
 8716 
 8717         /*
 8718          *  Prepare the bus address array that contains the bus
 8719          *  address of each target control block.
 8720          *  For now, assume all logical units are wrong. :)
 8721          */
 8722         for (i = 0 ; i < SYM_CONF_MAX_TARGET ; i++) {
 8723                 np->targtbl[i] = cpu_to_scr(vtobus(&np->target[i]));
 8724                 np->target[i].head.luntbl_sa =
 8725                                 cpu_to_scr(vtobus(np->badluntbl));
 8726                 np->target[i].head.lun0_sa =
 8727                                 cpu_to_scr(vtobus(&np->badlun_sa));
 8728         }
 8729 
 8730         /*
 8731          *  Now check the cache handling of the pci chipset.
 8732          */
 8733         if (sym_snooptest (np)) {
 8734                 device_printf(dev, "CACHE INCORRECTLY CONFIGURED.\n");
 8735                 goto attach_failed;
 8736         }
 8737 
 8738         /*
 8739          *  Now deal with CAM.
 8740          *  Hopefully, we will succeed with that one.:)
 8741          */
 8742         if (!sym_cam_attach(np))
 8743                 goto attach_failed;
 8744 
 8745         /*
 8746          *  Sigh! we are done.
 8747          */
 8748         return 0;
 8749 
 8750         /*
 8751          *  We have failed.
 8752          *  We will try to free all the resources we have
 8753          *  allocated, but if we are a boot device, this
 8754          *  will not help that much.;)
 8755          */
 8756 attach_failed:
 8757         if (np)
 8758                 sym_pci_free(np);
 8759         return ENXIO;
 8760 }
 8761 
 8762 /*
 8763  *  Free everything that have been allocated for this device.
 8764  */
 8765 static void sym_pci_free(hcb_p np)
 8766 {
 8767         SYM_QUEHEAD *qp;
 8768         ccb_p cp;
 8769         tcb_p tp;
 8770         lcb_p lp;
 8771         int target, lun;
 8772 
 8773         /*
 8774          *  First free CAM resources.
 8775          */
 8776         sym_cam_free(np);
 8777 
 8778         /*
 8779          *  Now every should be quiet for us to
 8780          *  free other resources.
 8781          */
 8782         if (np->ram_res)
 8783                 bus_release_resource(np->device, SYS_RES_MEMORY,
 8784                                      np->ram_id, np->ram_res);
 8785         if (np->mmio_res)
 8786                 bus_release_resource(np->device, SYS_RES_MEMORY,
 8787                                      SYM_PCI_MMIO, np->mmio_res);
 8788         if (np->io_res)
 8789                 bus_release_resource(np->device, SYS_RES_IOPORT,
 8790                                      SYM_PCI_IO, np->io_res);
 8791         if (np->irq_res)
 8792                 bus_release_resource(np->device, SYS_RES_IRQ,
 8793                                      0, np->irq_res);
 8794 
 8795         if (np->scriptb0)
 8796                 sym_mfree_dma(np->scriptb0, np->scriptb_sz, "SCRIPTB0");
 8797         if (np->scripta0)
 8798                 sym_mfree_dma(np->scripta0, np->scripta_sz, "SCRIPTA0");
 8799         if (np->squeue)
 8800                 sym_mfree_dma(np->squeue, sizeof(u32)*(MAX_QUEUE*2), "SQUEUE");
 8801         if (np->dqueue)
 8802                 sym_mfree_dma(np->dqueue, sizeof(u32)*(MAX_QUEUE*2), "DQUEUE");
 8803 
 8804         while ((qp = sym_remque_head(&np->free_ccbq)) != NULL) {
 8805                 cp = sym_que_entry(qp, struct sym_ccb, link_ccbq);
 8806                 bus_dmamap_destroy(np->data_dmat, cp->dmamap);
 8807                 sym_mfree_dma(cp->sns_bbuf, SYM_SNS_BBUF_LEN, "SNS_BBUF");
 8808                 sym_mfree_dma(cp, sizeof(*cp), "CCB");
 8809         }
 8810 
 8811         if (np->badluntbl)
 8812                 sym_mfree_dma(np->badluntbl, 256,"BADLUNTBL");
 8813 
 8814         for (target = 0; target < SYM_CONF_MAX_TARGET ; target++) {
 8815                 tp = &np->target[target];
 8816                 for (lun = 0 ; lun < SYM_CONF_MAX_LUN ; lun++) {
 8817                         lp = sym_lp(tp, lun);
 8818                         if (!lp)
 8819                                 continue;
 8820                         if (lp->itlq_tbl)
 8821                                 sym_mfree_dma(lp->itlq_tbl, SYM_CONF_MAX_TASK*4,
 8822                                        "ITLQ_TBL");
 8823                         if (lp->cb_tags)
 8824                                 sym_mfree(lp->cb_tags, SYM_CONF_MAX_TASK,
 8825                                        "CB_TAGS");
 8826                         sym_mfree_dma(lp, sizeof(*lp), "LCB");
 8827                 }
 8828 #if SYM_CONF_MAX_LUN > 1
 8829                 if (tp->lunmp)
 8830                         sym_mfree(tp->lunmp, SYM_CONF_MAX_LUN*sizeof(lcb_p),
 8831                                "LUNMP");
 8832 #endif
 8833         }
 8834 #ifdef __amd64__
 8835         if (np->target)
 8836                 sym_mfree_dma(np->target,
 8837                         SYM_CONF_MAX_TARGET * sizeof(*(np->target)), "TARGET");
 8838 #endif
 8839         if (np->targtbl)
 8840                 sym_mfree_dma(np->targtbl, 256, "TARGTBL");
 8841         if (np->data_dmat)
 8842                 bus_dma_tag_destroy(np->data_dmat);
 8843         if (SYM_LOCK_INITIALIZED() != 0)
 8844                 SYM_LOCK_DESTROY();
 8845         device_set_softc(np->device, NULL);
 8846         sym_mfree_dma(np, sizeof(*np), "HCB");
 8847 }
 8848 
 8849 /*
 8850  *  Allocate CAM resources and register a bus to CAM.
 8851  */
 8852 static int sym_cam_attach(hcb_p np)
 8853 {
 8854         struct cam_devq *devq = NULL;
 8855         struct cam_sim *sim = NULL;
 8856         struct cam_path *path = NULL;
 8857         int err;
 8858 
 8859         /*
 8860          *  Establish our interrupt handler.
 8861          */
 8862         err = bus_setup_intr(np->device, np->irq_res,
 8863                         INTR_ENTROPY | INTR_MPSAFE | INTR_TYPE_CAM,
 8864                         NULL, sym_intr, np, &np->intr);
 8865         if (err) {
 8866                 device_printf(np->device, "bus_setup_intr() failed: %d\n",
 8867                               err);
 8868                 goto fail;
 8869         }
 8870 
 8871         /*
 8872          *  Create the device queue for our sym SIM.
 8873          */
 8874         devq = cam_simq_alloc(SYM_CONF_MAX_START);
 8875         if (!devq)
 8876                 goto fail;
 8877 
 8878         /*
 8879          *  Construct our SIM entry.
 8880          */
 8881         sim = cam_sim_alloc(sym_action, sym_poll, "sym", np,
 8882                         device_get_unit(np->device),
 8883                         &np->mtx, 1, SYM_SETUP_MAX_TAG, devq);
 8884         if (!sim)
 8885                 goto fail;
 8886 
 8887         SYM_LOCK();
 8888 
 8889         if (xpt_bus_register(sim, np->device, 0) != CAM_SUCCESS)
 8890                 goto fail;
 8891         np->sim = sim;
 8892         sim = NULL;
 8893 
 8894         if (xpt_create_path(&path, NULL,
 8895                             cam_sim_path(np->sim), CAM_TARGET_WILDCARD,
 8896                             CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
 8897                 goto fail;
 8898         }
 8899         np->path = path;
 8900 
 8901         /*
 8902          *  Establish our async notification handler.
 8903          */
 8904         if (xpt_register_async(AC_LOST_DEVICE, sym_async, np->sim, path) !=
 8905             CAM_REQ_CMP)
 8906                 goto fail;
 8907 
 8908         /*
 8909          *  Start the chip now, without resetting the BUS, since
 8910          *  it seems that this must stay under control of CAM.
 8911          *  With LVD/SE capable chips and BUS in SE mode, we may
 8912          *  get a spurious SMBC interrupt.
 8913          */
 8914         sym_init (np, 0);
 8915 
 8916         SYM_UNLOCK();
 8917 
 8918         return 1;
 8919 fail:
 8920         if (sim)
 8921                 cam_sim_free(sim, FALSE);
 8922         if (devq)
 8923                 cam_simq_free(devq);
 8924 
 8925         SYM_UNLOCK();
 8926 
 8927         sym_cam_free(np);
 8928 
 8929         return 0;
 8930 }
 8931 
 8932 /*
 8933  *  Free everything that deals with CAM.
 8934  */
 8935 static void sym_cam_free(hcb_p np)
 8936 {
 8937 
 8938         SYM_LOCK_ASSERT(MA_NOTOWNED);
 8939 
 8940         if (np->intr) {
 8941                 bus_teardown_intr(np->device, np->irq_res, np->intr);
 8942                 np->intr = NULL;
 8943         }
 8944 
 8945         SYM_LOCK();
 8946 
 8947         if (np->sim) {
 8948                 xpt_bus_deregister(cam_sim_path(np->sim));
 8949                 cam_sim_free(np->sim, /*free_devq*/ TRUE);
 8950                 np->sim = NULL;
 8951         }
 8952         if (np->path) {
 8953                 xpt_free_path(np->path);
 8954                 np->path = NULL;
 8955         }
 8956 
 8957         SYM_UNLOCK();
 8958 }
 8959 
 8960 /*============ OPTIONNAL NVRAM SUPPORT =================*/
 8961 
 8962 /*
 8963  *  Get host setup from NVRAM.
 8964  */
 8965 static void sym_nvram_setup_host (hcb_p np, struct sym_nvram *nvram)
 8966 {
 8967 #ifdef SYM_CONF_NVRAM_SUPPORT
 8968         /*
 8969          *  Get parity checking, host ID, verbose mode
 8970          *  and miscellaneous host flags from NVRAM.
 8971          */
 8972         switch(nvram->type) {
 8973         case SYM_SYMBIOS_NVRAM:
 8974                 if (!(nvram->data.Symbios.flags & SYMBIOS_PARITY_ENABLE))
 8975                         np->rv_scntl0  &= ~0x0a;
 8976                 np->myaddr = nvram->data.Symbios.host_id & 0x0f;
 8977                 if (nvram->data.Symbios.flags & SYMBIOS_VERBOSE_MSGS)
 8978                         np->verbose += 1;
 8979                 if (nvram->data.Symbios.flags1 & SYMBIOS_SCAN_HI_LO)
 8980                         np->usrflags |= SYM_SCAN_TARGETS_HILO;
 8981                 if (nvram->data.Symbios.flags2 & SYMBIOS_AVOID_BUS_RESET)
 8982                         np->usrflags |= SYM_AVOID_BUS_RESET;
 8983                 break;
 8984         case SYM_TEKRAM_NVRAM:
 8985                 np->myaddr = nvram->data.Tekram.host_id & 0x0f;
 8986                 break;
 8987         default:
 8988                 break;
 8989         }
 8990 #endif
 8991 }
 8992 
 8993 /*
 8994  *  Get target setup from NVRAM.
 8995  */
 8996 #ifdef SYM_CONF_NVRAM_SUPPORT
 8997 static void sym_Symbios_setup_target(hcb_p np,int target, Symbios_nvram *nvram);
 8998 static void sym_Tekram_setup_target(hcb_p np,int target, Tekram_nvram *nvram);
 8999 #endif
 9000 
 9001 static void
 9002 sym_nvram_setup_target (hcb_p np, int target, struct sym_nvram *nvp)
 9003 {
 9004 #ifdef SYM_CONF_NVRAM_SUPPORT
 9005         switch(nvp->type) {
 9006         case SYM_SYMBIOS_NVRAM:
 9007                 sym_Symbios_setup_target (np, target, &nvp->data.Symbios);
 9008                 break;
 9009         case SYM_TEKRAM_NVRAM:
 9010                 sym_Tekram_setup_target (np, target, &nvp->data.Tekram);
 9011                 break;
 9012         default:
 9013                 break;
 9014         }
 9015 #endif
 9016 }
 9017 
 9018 #ifdef SYM_CONF_NVRAM_SUPPORT
 9019 /*
 9020  *  Get target set-up from Symbios format NVRAM.
 9021  */
 9022 static void
 9023 sym_Symbios_setup_target(hcb_p np, int target, Symbios_nvram *nvram)
 9024 {
 9025         tcb_p tp = &np->target[target];
 9026         Symbios_target *tn = &nvram->target[target];
 9027 
 9028         tp->tinfo.user.period = tn->sync_period ? (tn->sync_period + 3) / 4 : 0;
 9029         tp->tinfo.user.width  = tn->bus_width == 0x10 ? BUS_16_BIT : BUS_8_BIT;
 9030         tp->usrtags =
 9031                 (tn->flags & SYMBIOS_QUEUE_TAGS_ENABLED)? SYM_SETUP_MAX_TAG : 0;
 9032 
 9033         if (!(tn->flags & SYMBIOS_DISCONNECT_ENABLE))
 9034                 tp->usrflags &= ~SYM_DISC_ENABLED;
 9035         if (!(tn->flags & SYMBIOS_SCAN_AT_BOOT_TIME))
 9036                 tp->usrflags |= SYM_SCAN_BOOT_DISABLED;
 9037         if (!(tn->flags & SYMBIOS_SCAN_LUNS))
 9038                 tp->usrflags |= SYM_SCAN_LUNS_DISABLED;
 9039 }
 9040 
 9041 /*
 9042  *  Get target set-up from Tekram format NVRAM.
 9043  */
 9044 static void
 9045 sym_Tekram_setup_target(hcb_p np, int target, Tekram_nvram *nvram)
 9046 {
 9047         tcb_p tp = &np->target[target];
 9048         struct Tekram_target *tn = &nvram->target[target];
 9049         int i;
 9050 
 9051         if (tn->flags & TEKRAM_SYNC_NEGO) {
 9052                 i = tn->sync_index & 0xf;
 9053                 tp->tinfo.user.period = Tekram_sync[i];
 9054         }
 9055 
 9056         tp->tinfo.user.width =
 9057                 (tn->flags & TEKRAM_WIDE_NEGO) ? BUS_16_BIT : BUS_8_BIT;
 9058 
 9059         if (tn->flags & TEKRAM_TAGGED_COMMANDS) {
 9060                 tp->usrtags = 2 << nvram->max_tags_index;
 9061         }
 9062 
 9063         if (tn->flags & TEKRAM_DISCONNECT_ENABLE)
 9064                 tp->usrflags |= SYM_DISC_ENABLED;
 9065 
 9066         /* If any device does not support parity, we will not use this option */
 9067         if (!(tn->flags & TEKRAM_PARITY_CHECK))
 9068                 np->rv_scntl0  &= ~0x0a; /* SCSI parity checking disabled */
 9069 }
 9070 
 9071 #ifdef  SYM_CONF_DEBUG_NVRAM
 9072 /*
 9073  *  Dump Symbios format NVRAM for debugging purpose.
 9074  */
 9075 static void sym_display_Symbios_nvram(hcb_p np, Symbios_nvram *nvram)
 9076 {
 9077         int i;
 9078 
 9079         /* display Symbios nvram host data */
 9080         printf("%s: HOST ID=%d%s%s%s%s%s%s\n",
 9081                 sym_name(np), nvram->host_id & 0x0f,
 9082                 (nvram->flags  & SYMBIOS_SCAM_ENABLE)   ? " SCAM"       :"",
 9083                 (nvram->flags  & SYMBIOS_PARITY_ENABLE) ? " PARITY"     :"",
 9084                 (nvram->flags  & SYMBIOS_VERBOSE_MSGS)  ? " VERBOSE"    :"",
 9085                 (nvram->flags  & SYMBIOS_CHS_MAPPING)   ? " CHS_ALT"    :"",
 9086                 (nvram->flags2 & SYMBIOS_AVOID_BUS_RESET)?" NO_RESET"   :"",
 9087                 (nvram->flags1 & SYMBIOS_SCAN_HI_LO)    ? " HI_LO"      :"");
 9088 
 9089         /* display Symbios nvram drive data */
 9090         for (i = 0 ; i < 15 ; i++) {
 9091                 struct Symbios_target *tn = &nvram->target[i];
 9092                 printf("%s-%d:%s%s%s%s WIDTH=%d SYNC=%d TMO=%d\n",
 9093                 sym_name(np), i,
 9094                 (tn->flags & SYMBIOS_DISCONNECT_ENABLE) ? " DISC"       : "",
 9095                 (tn->flags & SYMBIOS_SCAN_AT_BOOT_TIME) ? " SCAN_BOOT"  : "",
 9096                 (tn->flags & SYMBIOS_SCAN_LUNS)         ? " SCAN_LUNS"  : "",
 9097                 (tn->flags & SYMBIOS_QUEUE_TAGS_ENABLED)? " TCQ"        : "",
 9098                 tn->bus_width,
 9099                 tn->sync_period / 4,
 9100                 tn->timeout);
 9101         }
 9102 }
 9103 
 9104 /*
 9105  *  Dump TEKRAM format NVRAM for debugging purpose.
 9106  */
 9107 static const u_char Tekram_boot_delay[7] = {3, 5, 10, 20, 30, 60, 120};
 9108 static void sym_display_Tekram_nvram(hcb_p np, Tekram_nvram *nvram)
 9109 {
 9110         int i, tags, boot_delay;
 9111         char *rem;
 9112 
 9113         /* display Tekram nvram host data */
 9114         tags = 2 << nvram->max_tags_index;
 9115         boot_delay = 0;
 9116         if (nvram->boot_delay_index < 6)
 9117                 boot_delay = Tekram_boot_delay[nvram->boot_delay_index];
 9118         switch((nvram->flags & TEKRAM_REMOVABLE_FLAGS) >> 6) {
 9119         default:
 9120         case 0: rem = "";                       break;
 9121         case 1: rem = " REMOVABLE=boot device"; break;
 9122         case 2: rem = " REMOVABLE=all";         break;
 9123         }
 9124 
 9125         printf("%s: HOST ID=%d%s%s%s%s%s%s%s%s%s BOOT DELAY=%d tags=%d\n",
 9126                 sym_name(np), nvram->host_id & 0x0f,
 9127                 (nvram->flags1 & SYMBIOS_SCAM_ENABLE)   ? " SCAM"       :"",
 9128                 (nvram->flags & TEKRAM_MORE_THAN_2_DRIVES) ? " >2DRIVES"        :"",
 9129                 (nvram->flags & TEKRAM_DRIVES_SUP_1GB)  ? " >1GB"       :"",
 9130                 (nvram->flags & TEKRAM_RESET_ON_POWER_ON) ? " RESET"    :"",
 9131                 (nvram->flags & TEKRAM_ACTIVE_NEGATION) ? " ACT_NEG"    :"",
 9132                 (nvram->flags & TEKRAM_IMMEDIATE_SEEK)  ? " IMM_SEEK"   :"",
 9133                 (nvram->flags & TEKRAM_SCAN_LUNS)       ? " SCAN_LUNS"  :"",
 9134                 (nvram->flags1 & TEKRAM_F2_F6_ENABLED)  ? " F2_F6"      :"",
 9135                 rem, boot_delay, tags);
 9136 
 9137         /* display Tekram nvram drive data */
 9138         for (i = 0; i <= 15; i++) {
 9139                 int sync, j;
 9140                 struct Tekram_target *tn = &nvram->target[i];
 9141                 j = tn->sync_index & 0xf;
 9142                 sync = Tekram_sync[j];
 9143                 printf("%s-%d:%s%s%s%s%s%s PERIOD=%d\n",
 9144                 sym_name(np), i,
 9145                 (tn->flags & TEKRAM_PARITY_CHECK)       ? " PARITY"     : "",
 9146                 (tn->flags & TEKRAM_SYNC_NEGO)          ? " SYNC"       : "",
 9147                 (tn->flags & TEKRAM_DISCONNECT_ENABLE)  ? " DISC"       : "",
 9148                 (tn->flags & TEKRAM_START_CMD)          ? " START"      : "",
 9149                 (tn->flags & TEKRAM_TAGGED_COMMANDS)    ? " TCQ"        : "",
 9150                 (tn->flags & TEKRAM_WIDE_NEGO)          ? " WIDE"       : "",
 9151                 sync);
 9152         }
 9153 }
 9154 #endif  /* SYM_CONF_DEBUG_NVRAM */
 9155 #endif  /* SYM_CONF_NVRAM_SUPPORT */
 9156 
 9157 /*
 9158  *  Try reading Symbios or Tekram NVRAM
 9159  */
 9160 #ifdef SYM_CONF_NVRAM_SUPPORT
 9161 static int sym_read_Symbios_nvram (hcb_p np, Symbios_nvram *nvram);
 9162 static int sym_read_Tekram_nvram  (hcb_p np, Tekram_nvram *nvram);
 9163 #endif
 9164 
 9165 static int sym_read_nvram(hcb_p np, struct sym_nvram *nvp)
 9166 {
 9167 #ifdef SYM_CONF_NVRAM_SUPPORT
 9168         /*
 9169          *  Try to read SYMBIOS nvram.
 9170          *  Try to read TEKRAM nvram if Symbios nvram not found.
 9171          */
 9172         if      (SYM_SETUP_SYMBIOS_NVRAM &&
 9173                  !sym_read_Symbios_nvram (np, &nvp->data.Symbios)) {
 9174                 nvp->type = SYM_SYMBIOS_NVRAM;
 9175 #ifdef SYM_CONF_DEBUG_NVRAM
 9176                 sym_display_Symbios_nvram(np, &nvp->data.Symbios);
 9177 #endif
 9178         }
 9179         else if (SYM_SETUP_TEKRAM_NVRAM &&
 9180                  !sym_read_Tekram_nvram (np, &nvp->data.Tekram)) {
 9181                 nvp->type = SYM_TEKRAM_NVRAM;
 9182 #ifdef SYM_CONF_DEBUG_NVRAM
 9183                 sym_display_Tekram_nvram(np, &nvp->data.Tekram);
 9184 #endif
 9185         }
 9186         else
 9187                 nvp->type = 0;
 9188 #else
 9189         nvp->type = 0;
 9190 #endif
 9191         return nvp->type;
 9192 }
 9193 
 9194 #ifdef SYM_CONF_NVRAM_SUPPORT
 9195 /*
 9196  *  24C16 EEPROM reading.
 9197  *
 9198  *  GPOI0 - data in/data out
 9199  *  GPIO1 - clock
 9200  *  Symbios NVRAM wiring now also used by Tekram.
 9201  */
 9202 
 9203 #define SET_BIT 0
 9204 #define CLR_BIT 1
 9205 #define SET_CLK 2
 9206 #define CLR_CLK 3
 9207 
 9208 /*
 9209  *  Set/clear data/clock bit in GPIO0
 9210  */
 9211 static void S24C16_set_bit(hcb_p np, u_char write_bit, u_char *gpreg,
 9212                           int bit_mode)
 9213 {
 9214         UDELAY (5);
 9215         switch (bit_mode){
 9216         case SET_BIT:
 9217                 *gpreg |= write_bit;
 9218                 break;
 9219         case CLR_BIT:
 9220                 *gpreg &= 0xfe;
 9221                 break;
 9222         case SET_CLK:
 9223                 *gpreg |= 0x02;
 9224                 break;
 9225         case CLR_CLK:
 9226                 *gpreg &= 0xfd;
 9227                 break;
 9228 
 9229         }
 9230         OUTB (nc_gpreg, *gpreg);
 9231         UDELAY (5);
 9232 }
 9233 
 9234 /*
 9235  *  Send START condition to NVRAM to wake it up.
 9236  */
 9237 static void S24C16_start(hcb_p np, u_char *gpreg)
 9238 {
 9239         S24C16_set_bit(np, 1, gpreg, SET_BIT);
 9240         S24C16_set_bit(np, 0, gpreg, SET_CLK);
 9241         S24C16_set_bit(np, 0, gpreg, CLR_BIT);
 9242         S24C16_set_bit(np, 0, gpreg, CLR_CLK);
 9243 }
 9244 
 9245 /*
 9246  *  Send STOP condition to NVRAM - puts NVRAM to sleep... ZZzzzz!!
 9247  */
 9248 static void S24C16_stop(hcb_p np, u_char *gpreg)
 9249 {
 9250         S24C16_set_bit(np, 0, gpreg, SET_CLK);
 9251         S24C16_set_bit(np, 1, gpreg, SET_BIT);
 9252 }
 9253 
 9254 /*
 9255  *  Read or write a bit to the NVRAM,
 9256  *  read if GPIO0 input else write if GPIO0 output
 9257  */
 9258 static void S24C16_do_bit(hcb_p np, u_char *read_bit, u_char write_bit,
 9259                          u_char *gpreg)
 9260 {
 9261         S24C16_set_bit(np, write_bit, gpreg, SET_BIT);
 9262         S24C16_set_bit(np, 0, gpreg, SET_CLK);
 9263         if (read_bit)
 9264                 *read_bit = INB (nc_gpreg);
 9265         S24C16_set_bit(np, 0, gpreg, CLR_CLK);
 9266         S24C16_set_bit(np, 0, gpreg, CLR_BIT);
 9267 }
 9268 
 9269 /*
 9270  *  Output an ACK to the NVRAM after reading,
 9271  *  change GPIO0 to output and when done back to an input
 9272  */
 9273 static void S24C16_write_ack(hcb_p np, u_char write_bit, u_char *gpreg,
 9274                             u_char *gpcntl)
 9275 {
 9276         OUTB (nc_gpcntl, *gpcntl & 0xfe);
 9277         S24C16_do_bit(np, 0, write_bit, gpreg);
 9278         OUTB (nc_gpcntl, *gpcntl);
 9279 }
 9280 
 9281 /*
 9282  *  Input an ACK from NVRAM after writing,
 9283  *  change GPIO0 to input and when done back to an output
 9284  */
 9285 static void S24C16_read_ack(hcb_p np, u_char *read_bit, u_char *gpreg,
 9286                            u_char *gpcntl)
 9287 {
 9288         OUTB (nc_gpcntl, *gpcntl | 0x01);
 9289         S24C16_do_bit(np, read_bit, 1, gpreg);
 9290         OUTB (nc_gpcntl, *gpcntl);
 9291 }
 9292 
 9293 /*
 9294  *  WRITE a byte to the NVRAM and then get an ACK to see it was accepted OK,
 9295  *  GPIO0 must already be set as an output
 9296  */
 9297 static void S24C16_write_byte(hcb_p np, u_char *ack_data, u_char write_data,
 9298                              u_char *gpreg, u_char *gpcntl)
 9299 {
 9300         int x;
 9301 
 9302         for (x = 0; x < 8; x++)
 9303                 S24C16_do_bit(np, 0, (write_data >> (7 - x)) & 0x01, gpreg);
 9304 
 9305         S24C16_read_ack(np, ack_data, gpreg, gpcntl);
 9306 }
 9307 
 9308 /*
 9309  *  READ a byte from the NVRAM and then send an ACK to say we have got it,
 9310  *  GPIO0 must already be set as an input
 9311  */
 9312 static void S24C16_read_byte(hcb_p np, u_char *read_data, u_char ack_data,
 9313                             u_char *gpreg, u_char *gpcntl)
 9314 {
 9315         int x;
 9316         u_char read_bit;
 9317 
 9318         *read_data = 0;
 9319         for (x = 0; x < 8; x++) {
 9320                 S24C16_do_bit(np, &read_bit, 1, gpreg);
 9321                 *read_data |= ((read_bit & 0x01) << (7 - x));
 9322         }
 9323 
 9324         S24C16_write_ack(np, ack_data, gpreg, gpcntl);
 9325 }
 9326 
 9327 /*
 9328  *  Read 'len' bytes starting at 'offset'.
 9329  */
 9330 static int sym_read_S24C16_nvram (hcb_p np, int offset, u_char *data, int len)
 9331 {
 9332         u_char  gpcntl, gpreg;
 9333         u_char  old_gpcntl, old_gpreg;
 9334         u_char  ack_data;
 9335         int     retv = 1;
 9336         int     x;
 9337 
 9338         /* save current state of GPCNTL and GPREG */
 9339         old_gpreg       = INB (nc_gpreg);
 9340         old_gpcntl      = INB (nc_gpcntl);
 9341         gpcntl          = old_gpcntl & 0x1c;
 9342 
 9343         /* set up GPREG & GPCNTL to set GPIO0 and GPIO1 in to known state */
 9344         OUTB (nc_gpreg,  old_gpreg);
 9345         OUTB (nc_gpcntl, gpcntl);
 9346 
 9347         /* this is to set NVRAM into a known state with GPIO0/1 both low */
 9348         gpreg = old_gpreg;
 9349         S24C16_set_bit(np, 0, &gpreg, CLR_CLK);
 9350         S24C16_set_bit(np, 0, &gpreg, CLR_BIT);
 9351 
 9352         /* now set NVRAM inactive with GPIO0/1 both high */
 9353         S24C16_stop(np, &gpreg);
 9354 
 9355         /* activate NVRAM */
 9356         S24C16_start(np, &gpreg);
 9357 
 9358         /* write device code and random address MSB */
 9359         S24C16_write_byte(np, &ack_data,
 9360                 0xa0 | ((offset >> 7) & 0x0e), &gpreg, &gpcntl);
 9361         if (ack_data & 0x01)
 9362                 goto out;
 9363 
 9364         /* write random address LSB */
 9365         S24C16_write_byte(np, &ack_data,
 9366                 offset & 0xff, &gpreg, &gpcntl);
 9367         if (ack_data & 0x01)
 9368                 goto out;
 9369 
 9370         /* regenerate START state to set up for reading */
 9371         S24C16_start(np, &gpreg);
 9372 
 9373         /* rewrite device code and address MSB with read bit set (lsb = 0x01) */
 9374         S24C16_write_byte(np, &ack_data,
 9375                 0xa1 | ((offset >> 7) & 0x0e), &gpreg, &gpcntl);
 9376         if (ack_data & 0x01)
 9377                 goto out;
 9378 
 9379         /* now set up GPIO0 for inputting data */
 9380         gpcntl |= 0x01;
 9381         OUTB (nc_gpcntl, gpcntl);
 9382 
 9383         /* input all requested data - only part of total NVRAM */
 9384         for (x = 0; x < len; x++)
 9385                 S24C16_read_byte(np, &data[x], (x == (len-1)), &gpreg, &gpcntl);
 9386 
 9387         /* finally put NVRAM back in inactive mode */
 9388         gpcntl &= 0xfe;
 9389         OUTB (nc_gpcntl, gpcntl);
 9390         S24C16_stop(np, &gpreg);
 9391         retv = 0;
 9392 out:
 9393         /* return GPIO0/1 to original states after having accessed NVRAM */
 9394         OUTB (nc_gpcntl, old_gpcntl);
 9395         OUTB (nc_gpreg,  old_gpreg);
 9396 
 9397         return retv;
 9398 }
 9399 
 9400 #undef SET_BIT /* 0 */
 9401 #undef CLR_BIT /* 1 */
 9402 #undef SET_CLK /* 2 */
 9403 #undef CLR_CLK /* 3 */
 9404 
 9405 /*
 9406  *  Try reading Symbios NVRAM.
 9407  *  Return 0 if OK.
 9408  */
 9409 static int sym_read_Symbios_nvram (hcb_p np, Symbios_nvram *nvram)
 9410 {
 9411         static u_char Symbios_trailer[6] = {0xfe, 0xfe, 0, 0, 0, 0};
 9412         u_char *data = (u_char *) nvram;
 9413         int len  = sizeof(*nvram);
 9414         u_short csum;
 9415         int x;
 9416 
 9417         /* probe the 24c16 and read the SYMBIOS 24c16 area */
 9418         if (sym_read_S24C16_nvram (np, SYMBIOS_NVRAM_ADDRESS, data, len))
 9419                 return 1;
 9420 
 9421         /* check valid NVRAM signature, verify byte count and checksum */
 9422         if (nvram->type != 0 ||
 9423             bcmp(nvram->trailer, Symbios_trailer, 6) ||
 9424             nvram->byte_count != len - 12)
 9425                 return 1;
 9426 
 9427         /* verify checksum */
 9428         for (x = 6, csum = 0; x < len - 6; x++)
 9429                 csum += data[x];
 9430         if (csum != nvram->checksum)
 9431                 return 1;
 9432 
 9433         return 0;
 9434 }
 9435 
 9436 /*
 9437  *  93C46 EEPROM reading.
 9438  *
 9439  *  GPOI0 - data in
 9440  *  GPIO1 - data out
 9441  *  GPIO2 - clock
 9442  *  GPIO4 - chip select
 9443  *
 9444  *  Used by Tekram.
 9445  */
 9446 
 9447 /*
 9448  *  Pulse clock bit in GPIO0
 9449  */
 9450 static void T93C46_Clk(hcb_p np, u_char *gpreg)
 9451 {
 9452         OUTB (nc_gpreg, *gpreg | 0x04);
 9453         UDELAY (2);
 9454         OUTB (nc_gpreg, *gpreg);
 9455 }
 9456 
 9457 /*
 9458  *  Read bit from NVRAM
 9459  */
 9460 static void T93C46_Read_Bit(hcb_p np, u_char *read_bit, u_char *gpreg)
 9461 {
 9462         UDELAY (2);
 9463         T93C46_Clk(np, gpreg);
 9464         *read_bit = INB (nc_gpreg);
 9465 }
 9466 
 9467 /*
 9468  *  Write bit to GPIO0
 9469  */
 9470 static void T93C46_Write_Bit(hcb_p np, u_char write_bit, u_char *gpreg)
 9471 {
 9472         if (write_bit & 0x01)
 9473                 *gpreg |= 0x02;
 9474         else
 9475                 *gpreg &= 0xfd;
 9476 
 9477         *gpreg |= 0x10;
 9478 
 9479         OUTB (nc_gpreg, *gpreg);
 9480         UDELAY (2);
 9481 
 9482         T93C46_Clk(np, gpreg);
 9483 }
 9484 
 9485 /*
 9486  *  Send STOP condition to NVRAM - puts NVRAM to sleep... ZZZzzz!!
 9487  */
 9488 static void T93C46_Stop(hcb_p np, u_char *gpreg)
 9489 {
 9490         *gpreg &= 0xef;
 9491         OUTB (nc_gpreg, *gpreg);
 9492         UDELAY (2);
 9493 
 9494         T93C46_Clk(np, gpreg);
 9495 }
 9496 
 9497 /*
 9498  *  Send read command and address to NVRAM
 9499  */
 9500 static void T93C46_Send_Command(hcb_p np, u_short write_data,
 9501                                 u_char *read_bit, u_char *gpreg)
 9502 {
 9503         int x;
 9504 
 9505         /* send 9 bits, start bit (1), command (2), address (6)  */
 9506         for (x = 0; x < 9; x++)
 9507                 T93C46_Write_Bit(np, (u_char) (write_data >> (8 - x)), gpreg);
 9508 
 9509         *read_bit = INB (nc_gpreg);
 9510 }
 9511 
 9512 /*
 9513  *  READ 2 bytes from the NVRAM
 9514  */
 9515 static void T93C46_Read_Word(hcb_p np, u_short *nvram_data, u_char *gpreg)
 9516 {
 9517         int x;
 9518         u_char read_bit;
 9519 
 9520         *nvram_data = 0;
 9521         for (x = 0; x < 16; x++) {
 9522                 T93C46_Read_Bit(np, &read_bit, gpreg);
 9523 
 9524                 if (read_bit & 0x01)
 9525                         *nvram_data |=  (0x01 << (15 - x));
 9526                 else
 9527                         *nvram_data &= ~(0x01 << (15 - x));
 9528         }
 9529 }
 9530 
 9531 /*
 9532  *  Read Tekram NvRAM data.
 9533  */
 9534 static int T93C46_Read_Data(hcb_p np, u_short *data,int len,u_char *gpreg)
 9535 {
 9536         u_char  read_bit;
 9537         int     x;
 9538 
 9539         for (x = 0; x < len; x++)  {
 9540 
 9541                 /* output read command and address */
 9542                 T93C46_Send_Command(np, 0x180 | x, &read_bit, gpreg);
 9543                 if (read_bit & 0x01)
 9544                         return 1; /* Bad */
 9545                 T93C46_Read_Word(np, &data[x], gpreg);
 9546                 T93C46_Stop(np, gpreg);
 9547         }
 9548 
 9549         return 0;
 9550 }
 9551 
 9552 /*
 9553  *  Try reading 93C46 Tekram NVRAM.
 9554  */
 9555 static int sym_read_T93C46_nvram (hcb_p np, Tekram_nvram *nvram)
 9556 {
 9557         u_char gpcntl, gpreg;
 9558         u_char old_gpcntl, old_gpreg;
 9559         int retv = 1;
 9560 
 9561         /* save current state of GPCNTL and GPREG */
 9562         old_gpreg       = INB (nc_gpreg);
 9563         old_gpcntl      = INB (nc_gpcntl);
 9564 
 9565         /* set up GPREG & GPCNTL to set GPIO0/1/2/4 in to known state, 0 in,
 9566            1/2/4 out */
 9567         gpreg = old_gpreg & 0xe9;
 9568         OUTB (nc_gpreg, gpreg);
 9569         gpcntl = (old_gpcntl & 0xe9) | 0x09;
 9570         OUTB (nc_gpcntl, gpcntl);
 9571 
 9572         /* input all of NVRAM, 64 words */
 9573         retv = T93C46_Read_Data(np, (u_short *) nvram,
 9574                                 sizeof(*nvram) / sizeof(short), &gpreg);
 9575 
 9576         /* return GPIO0/1/2/4 to original states after having accessed NVRAM */
 9577         OUTB (nc_gpcntl, old_gpcntl);
 9578         OUTB (nc_gpreg,  old_gpreg);
 9579 
 9580         return retv;
 9581 }
 9582 
 9583 /*
 9584  *  Try reading Tekram NVRAM.
 9585  *  Return 0 if OK.
 9586  */
 9587 static int sym_read_Tekram_nvram (hcb_p np, Tekram_nvram *nvram)
 9588 {
 9589         u_char *data = (u_char *) nvram;
 9590         int len = sizeof(*nvram);
 9591         u_short csum;
 9592         int x;
 9593 
 9594         switch (np->device_id) {
 9595         case PCI_ID_SYM53C885:
 9596         case PCI_ID_SYM53C895:
 9597         case PCI_ID_SYM53C896:
 9598                 x = sym_read_S24C16_nvram(np, TEKRAM_24C16_NVRAM_ADDRESS,
 9599                                           data, len);
 9600                 break;
 9601         case PCI_ID_SYM53C875:
 9602                 x = sym_read_S24C16_nvram(np, TEKRAM_24C16_NVRAM_ADDRESS,
 9603                                           data, len);
 9604                 if (!x)
 9605                         break;
 9606         default:
 9607                 x = sym_read_T93C46_nvram(np, nvram);
 9608                 break;
 9609         }
 9610         if (x)
 9611                 return 1;
 9612 
 9613         /* verify checksum */
 9614         for (x = 0, csum = 0; x < len - 1; x += 2)
 9615                 csum += data[x] + (data[x+1] << 8);
 9616         if (csum != 0x1234)
 9617                 return 1;
 9618 
 9619         return 0;
 9620 }
 9621 
 9622 #endif  /* SYM_CONF_NVRAM_SUPPORT */

Cache object: 30edb05d0197f2b1a2553288a9409a50


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.