xref: /freebsd/sys/dev/isp/isp.c (revision 7660b554bc59a07be0431c17e0e33815818baa69)
1 /* $FreeBSD$ */
2 /*
3  * Machine and OS Independent (well, as best as possible)
4  * code for the Qlogic ISP SCSI adapters.
5  *
6  * Copyright (c) 1997, 1998, 1999, 2000, 2001 by Matthew Jacob
7  * Feral Software
8  * All rights reserved.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice immediately at the beginning of the file, without modification,
15  *    this list of conditions, and the following disclaimer.
16  * 2. The name of the author may not be used to endorse or promote products
17  *    derived from this software without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
23  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  */
31 
32 /*
33  * Inspiration and ideas about this driver are from Erik Moe's Linux driver
34  * (qlogicisp.c) and Dave Miller's SBus version of same (qlogicisp.c). Some
35  * ideas dredged from the Solaris driver.
36  */
37 
38 /*
39  * Include header file appropriate for platform we're building on.
40  */
41 
42 #ifdef	__NetBSD__
43 #include <dev/ic/isp_netbsd.h>
44 #endif
45 #ifdef	__FreeBSD__
46 #include <dev/isp/isp_freebsd.h>
47 #endif
48 #ifdef	__OpenBSD__
49 #include <dev/ic/isp_openbsd.h>
50 #endif
51 #ifdef	__linux__
52 #include "isp_linux.h"
53 #endif
54 #ifdef	__svr4__
55 #include "isp_solaris.h"
56 #endif
57 
58 /*
59  * General defines
60  */
61 
62 #define	MBOX_DELAY_COUNT	1000000 / 100
63 
64 /*
65  * Local static data
66  */
67 static const char portshift[] =
68     "Target %d Loop ID 0x%x (Port 0x%x) => Loop 0x%x (Port 0x%x)";
69 static const char portdup[] =
70     "Target %d duplicates Target %d- killing off both";
71 static const char retained[] =
72     "Retaining Loop ID 0x%x for Target %d (Port 0x%x)";
73 static const char lretained[] =
74     "Retained login of Target %d (Loop ID 0x%x) Port 0x%x";
75 static const char plogout[] =
76     "Logging out Target %d at Loop ID 0x%x (Port 0x%x)";
77 static const char plogierr[] =
78     "Command Error in PLOGI for Port 0x%x (0x%x)";
79 static const char nopdb[] =
80     "Could not get PDB for Device @ Port 0x%x";
81 static const char pdbmfail1[] =
82     "PDB Loop ID info for Device @ Port 0x%x does not match up (0x%x)";
83 static const char pdbmfail2[] =
84     "PDB Port info for Device @ Port 0x%x does not match up (0x%x)";
85 static const char ldumped[] =
86     "Target %d (Loop ID 0x%x) Port 0x%x dumped after login info mismatch";
87 static const char notresp[] =
88   "Not RESPONSE in RESPONSE Queue (type 0x%x) @ idx %d (next %d) nlooked %d";
89 static const char xact1[] =
90     "HBA attempted queued transaction with disconnect not set for %d.%d.%d";
91 static const char xact2[] =
92     "HBA attempted queued transaction to target routine %d on target %d bus %d";
93 static const char xact3[] =
94     "HBA attempted queued cmd for %d.%d.%d when queueing disabled";
95 static const char pskip[] =
96     "SCSI phase skipped for target %d.%d.%d";
97 static const char topology[] =
98     "Loop ID %d, AL_PA 0x%x, Port ID 0x%x, Loop State 0x%x, Topology '%s'";
99 static const char swrej[] =
100     "Fabric Nameserver rejected %s (Reason=0x%x Expl=0x%x) for Port ID 0x%x";
101 static const char finmsg[] =
102     "(%d.%d.%d): FIN dl%d resid %d STS 0x%x SKEY %c XS_ERR=0x%x";
103 static const char sc0[] =
104     "%s CHAN %d FTHRSH %d IID %d RESETD %d RETRYC %d RETRYD %d ASD 0x%x";
105 static const char sc1[] =
106     "%s RAAN 0x%x DLAN 0x%x DDMAB 0x%x CDMAB 0x%x SELTIME %d MQD %d";
107 static const char sc2[] = "%s CHAN %d TGT %d FLAGS 0x%x 0x%x/0x%x";
108 static const char sc3[] = "Generated";
109 static const char sc4[] = "NVRAM";
110 static const char bun[] =
111     "bad underrun for %d.%d (count %d, resid %d, status %s)";
112 
113 /*
114  * Local function prototypes.
115  */
116 static int isp_parse_async(struct ispsoftc *, u_int16_t);
117 static int isp_handle_other_response(struct ispsoftc *, int, isphdr_t *,
118     u_int16_t *);
119 static void
120 isp_parse_status(struct ispsoftc *, ispstatusreq_t *, XS_T *);
121 static void isp_fastpost_complete(struct ispsoftc *, u_int16_t);
122 static int isp_mbox_continue(struct ispsoftc *);
123 static void isp_scsi_init(struct ispsoftc *);
124 static void isp_scsi_channel_init(struct ispsoftc *, int);
125 static void isp_fibre_init(struct ispsoftc *);
126 static void isp_mark_getpdb_all(struct ispsoftc *);
127 static int isp_getmap(struct ispsoftc *, fcpos_map_t *);
128 static int isp_getpdb(struct ispsoftc *, int, isp_pdb_t *);
129 static u_int64_t isp_get_portname(struct ispsoftc *, int, int);
130 static int isp_fclink_test(struct ispsoftc *, int);
131 static char *isp2100_fw_statename(int);
132 static int isp_pdb_sync(struct ispsoftc *);
133 static int isp_scan_loop(struct ispsoftc *);
134 static int isp_fabric_mbox_cmd(struct ispsoftc *, mbreg_t *);
135 static int isp_scan_fabric(struct ispsoftc *, int);
136 static void isp_register_fc4_type(struct ispsoftc *);
137 static void isp_fw_state(struct ispsoftc *);
138 static void isp_mboxcmd_qnw(struct ispsoftc *, mbreg_t *, int);
139 static void isp_mboxcmd(struct ispsoftc *, mbreg_t *, int);
140 
141 static void isp_update(struct ispsoftc *);
142 static void isp_update_bus(struct ispsoftc *, int);
143 static void isp_setdfltparm(struct ispsoftc *, int);
144 static int isp_read_nvram(struct ispsoftc *);
145 static void isp_rdnvram_word(struct ispsoftc *, int, u_int16_t *);
146 static void isp_parse_nvram_1020(struct ispsoftc *, u_int8_t *);
147 static void isp_parse_nvram_1080(struct ispsoftc *, int, u_int8_t *);
148 static void isp_parse_nvram_12160(struct ispsoftc *, int, u_int8_t *);
149 static void isp_parse_nvram_2100(struct ispsoftc *, u_int8_t *);
150 
151 /*
152  * Reset Hardware.
153  *
154  * Hit the chip over the head, download new f/w if available and set it running.
155  *
156  * Locking done elsewhere.
157  */
158 
159 void
160 isp_reset(struct ispsoftc *isp)
161 {
162 	mbreg_t mbs;
163 	u_int16_t code_org;
164 	int loops, i, dodnld = 1;
165 	char *btype = "????";
166 
167 	isp->isp_state = ISP_NILSTATE;
168 
169 	/*
170 	 * Basic types (SCSI, FibreChannel and PCI or SBus)
171 	 * have been set in the MD code. We figure out more
172 	 * here. Possibly more refined types based upon PCI
173 	 * identification. Chip revision has been gathered.
174 	 *
175 	 * After we've fired this chip up, zero out the conf1 register
176 	 * for SCSI adapters and do other settings for the 2100.
177 	 */
178 
179 	/*
180 	 * Get the current running firmware revision out of the
181 	 * chip before we hit it over the head (if this is our
182 	 * first time through). Note that we store this as the
183 	 * 'ROM' firmware revision- which it may not be. In any
184 	 * case, we don't really use this yet, but we may in
185 	 * the future.
186 	 */
187 	if (isp->isp_touched == 0) {
188 		/*
189 		 * First see whether or not we're sitting in the ISP PROM.
190 		 * If we've just been reset, we'll have the string "ISP   "
191 		 * spread through outgoing mailbox registers 1-3. We do
192 		 * this for PCI cards because otherwise we really don't
193 		 * know what state the card is in and we could hang if
194 		 * we try this command otherwise.
195 		 *
196 		 * For SBus cards, we just do this because they almost
197 		 * certainly will be running firmware by now.
198 		 */
199 		if (ISP_READ(isp, OUTMAILBOX1) != 0x4953 ||
200 		    ISP_READ(isp, OUTMAILBOX2) != 0x5020 ||
201 		    ISP_READ(isp, OUTMAILBOX3) != 0x2020) {
202 			/*
203 			 * Just in case it was paused...
204 			 */
205 			ISP_WRITE(isp, HCCR, HCCR_CMD_RELEASE);
206 			mbs.param[0] = MBOX_ABOUT_FIRMWARE;
207 			isp_mboxcmd(isp, &mbs, MBLOGNONE);
208 			if (mbs.param[0] == MBOX_COMMAND_COMPLETE) {
209 				isp->isp_romfw_rev[0] = mbs.param[1];
210 				isp->isp_romfw_rev[1] = mbs.param[2];
211 				isp->isp_romfw_rev[2] = mbs.param[3];
212 			}
213 		}
214 		isp->isp_touched = 1;
215 	}
216 
217 	DISABLE_INTS(isp);
218 
219 	/*
220 	 * Set up default request/response queue in-pointer/out-pointer
221 	 * register indices.
222 	 */
223 	if (IS_23XX(isp)) {
224 		isp->isp_rqstinrp = BIU_REQINP;
225 		isp->isp_rqstoutrp = BIU_REQOUTP;
226 		isp->isp_respinrp = BIU_RSPINP;
227 		isp->isp_respoutrp = BIU_RSPOUTP;
228 	} else {
229 		isp->isp_rqstinrp = INMAILBOX4;
230 		isp->isp_rqstoutrp = OUTMAILBOX4;
231 		isp->isp_respinrp = OUTMAILBOX5;
232 		isp->isp_respoutrp = INMAILBOX5;
233 	}
234 
235 	/*
236 	 * Put the board into PAUSE mode (so we can read the SXP registers
237 	 * or write FPM/FBM registers).
238 	 */
239 	ISP_WRITE(isp, HCCR, HCCR_CMD_PAUSE);
240 
241 	if (IS_FC(isp)) {
242 		switch (isp->isp_type) {
243 		case ISP_HA_FC_2100:
244 			btype = "2100";
245 			break;
246 		case ISP_HA_FC_2200:
247 			btype = "2200";
248 			break;
249 		case ISP_HA_FC_2300:
250 			btype = "2300";
251 			break;
252 		case ISP_HA_FC_2312:
253 			btype = "2312";
254 			break;
255 		default:
256 			break;
257 		}
258 		/*
259 		 * While we're paused, reset the FPM module and FBM fifos.
260 		 */
261 		ISP_WRITE(isp, BIU2100_CSR, BIU2100_FPM0_REGS);
262 		ISP_WRITE(isp, FPM_DIAG_CONFIG, FPM_SOFT_RESET);
263 		ISP_WRITE(isp, BIU2100_CSR, BIU2100_FB_REGS);
264 		ISP_WRITE(isp, FBM_CMD, FBMCMD_FIFO_RESET_ALL);
265 		ISP_WRITE(isp, BIU2100_CSR, BIU2100_RISC_REGS);
266 	} else if (IS_1240(isp)) {
267 		sdparam *sdp = isp->isp_param;
268 		btype = "1240";
269 		isp->isp_clock = 60;
270 		sdp->isp_ultramode = 1;
271 		sdp++;
272 		sdp->isp_ultramode = 1;
273 		/*
274 		 * XXX: Should probably do some bus sensing.
275 		 */
276 	} else if (IS_ULTRA2(isp)) {
277 		static const char m[] = "bus %d is in %s Mode";
278 		u_int16_t l;
279 		sdparam *sdp = isp->isp_param;
280 
281 		isp->isp_clock = 100;
282 
283 		if (IS_1280(isp))
284 			btype = "1280";
285 		else if (IS_1080(isp))
286 			btype = "1080";
287 		else if (IS_10160(isp))
288 			btype = "10160";
289 		else if (IS_12160(isp))
290 			btype = "12160";
291 		else
292 			btype = "<UNKLVD>";
293 
294 		l = ISP_READ(isp, SXP_PINS_DIFF) & ISP1080_MODE_MASK;
295 		switch (l) {
296 		case ISP1080_LVD_MODE:
297 			sdp->isp_lvdmode = 1;
298 			isp_prt(isp, ISP_LOGCONFIG, m, 0, "LVD");
299 			break;
300 		case ISP1080_HVD_MODE:
301 			sdp->isp_diffmode = 1;
302 			isp_prt(isp, ISP_LOGCONFIG, m, 0, "Differential");
303 			break;
304 		case ISP1080_SE_MODE:
305 			sdp->isp_ultramode = 1;
306 			isp_prt(isp, ISP_LOGCONFIG, m, 0, "Single-Ended");
307 			break;
308 		default:
309 			isp_prt(isp, ISP_LOGERR,
310 			    "unknown mode on bus %d (0x%x)", 0, l);
311 			break;
312 		}
313 
314 		if (IS_DUALBUS(isp)) {
315 			sdp++;
316 			l = ISP_READ(isp, SXP_PINS_DIFF|SXP_BANK1_SELECT);
317 			l &= ISP1080_MODE_MASK;
318 			switch(l) {
319 			case ISP1080_LVD_MODE:
320 				sdp->isp_lvdmode = 1;
321 				isp_prt(isp, ISP_LOGCONFIG, m, 1, "LVD");
322 				break;
323 			case ISP1080_HVD_MODE:
324 				sdp->isp_diffmode = 1;
325 				isp_prt(isp, ISP_LOGCONFIG,
326 				    m, 1, "Differential");
327 				break;
328 			case ISP1080_SE_MODE:
329 				sdp->isp_ultramode = 1;
330 				isp_prt(isp, ISP_LOGCONFIG,
331 				    m, 1, "Single-Ended");
332 				break;
333 			default:
334 				isp_prt(isp, ISP_LOGERR,
335 				    "unknown mode on bus %d (0x%x)", 1, l);
336 				break;
337 			}
338 		}
339 	} else {
340 		sdparam *sdp = isp->isp_param;
341 		i = ISP_READ(isp, BIU_CONF0) & BIU_CONF0_HW_MASK;
342 		switch (i) {
343 		default:
344 			isp_prt(isp, ISP_LOGALL, "Unknown Chip Type 0x%x", i);
345 			/* FALLTHROUGH */
346 		case 1:
347 			btype = "1020";
348 			isp->isp_type = ISP_HA_SCSI_1020;
349 			isp->isp_clock = 40;
350 			break;
351 		case 2:
352 			/*
353 			 * Some 1020A chips are Ultra Capable, but don't
354 			 * run the clock rate up for that unless told to
355 			 * do so by the Ultra Capable bits being set.
356 			 */
357 			btype = "1020A";
358 			isp->isp_type = ISP_HA_SCSI_1020A;
359 			isp->isp_clock = 40;
360 			break;
361 		case 3:
362 			btype = "1040";
363 			isp->isp_type = ISP_HA_SCSI_1040;
364 			isp->isp_clock = 60;
365 			break;
366 		case 4:
367 			btype = "1040A";
368 			isp->isp_type = ISP_HA_SCSI_1040A;
369 			isp->isp_clock = 60;
370 			break;
371 		case 5:
372 			btype = "1040B";
373 			isp->isp_type = ISP_HA_SCSI_1040B;
374 			isp->isp_clock = 60;
375 			break;
376 		case 6:
377 			btype = "1040C";
378 			isp->isp_type = ISP_HA_SCSI_1040C;
379 			isp->isp_clock = 60;
380                         break;
381 		}
382 		/*
383 		 * Now, while we're at it, gather info about ultra
384 		 * and/or differential mode.
385 		 */
386 		if (ISP_READ(isp, SXP_PINS_DIFF) & SXP_PINS_DIFF_MODE) {
387 			isp_prt(isp, ISP_LOGCONFIG, "Differential Mode");
388 			sdp->isp_diffmode = 1;
389 		} else {
390 			sdp->isp_diffmode = 0;
391 		}
392 		i = ISP_READ(isp, RISC_PSR);
393 		if (isp->isp_bustype == ISP_BT_SBUS) {
394 			i &= RISC_PSR_SBUS_ULTRA;
395 		} else {
396 			i &= RISC_PSR_PCI_ULTRA;
397 		}
398 		if (i != 0) {
399 			isp_prt(isp, ISP_LOGCONFIG, "Ultra Mode Capable");
400 			sdp->isp_ultramode = 1;
401 			/*
402 			 * If we're in Ultra Mode, we have to be 60MHz clock-
403 			 * even for the SBus version.
404 			 */
405 			isp->isp_clock = 60;
406 		} else {
407 			sdp->isp_ultramode = 0;
408 			/*
409 			 * Clock is known. Gronk.
410 			 */
411 		}
412 
413 		/*
414 		 * Machine dependent clock (if set) overrides
415 		 * our generic determinations.
416 		 */
417 		if (isp->isp_mdvec->dv_clock) {
418 			if (isp->isp_mdvec->dv_clock < isp->isp_clock) {
419 				isp->isp_clock = isp->isp_mdvec->dv_clock;
420 			}
421 		}
422 
423 	}
424 
425 	/*
426 	 * Clear instrumentation
427 	 */
428 	isp->isp_intcnt = isp->isp_intbogus = 0;
429 
430 	/*
431 	 * Do MD specific pre initialization
432 	 */
433 	ISP_RESET0(isp);
434 
435 again:
436 
437 	/*
438 	 * Hit the chip over the head with hammer,
439 	 * and give the ISP a chance to recover.
440 	 */
441 
442 	if (IS_SCSI(isp)) {
443 		ISP_WRITE(isp, BIU_ICR, BIU_ICR_SOFT_RESET);
444 		/*
445 		 * A slight delay...
446 		 */
447 		USEC_DELAY(100);
448 
449 		/*
450 		 * Clear data && control DMA engines.
451 		 */
452 		ISP_WRITE(isp, CDMA_CONTROL,
453 		    DMA_CNTRL_CLEAR_CHAN | DMA_CNTRL_RESET_INT);
454 		ISP_WRITE(isp, DDMA_CONTROL,
455 		    DMA_CNTRL_CLEAR_CHAN | DMA_CNTRL_RESET_INT);
456 
457 
458 	} else {
459 		ISP_WRITE(isp, BIU2100_CSR, BIU2100_SOFT_RESET);
460 		/*
461 		 * A slight delay...
462 		 */
463 		USEC_DELAY(100);
464 
465 		/*
466 		 * Clear data && control DMA engines.
467 		 */
468 		ISP_WRITE(isp, CDMA2100_CONTROL,
469 			DMA_CNTRL2100_CLEAR_CHAN | DMA_CNTRL2100_RESET_INT);
470 		ISP_WRITE(isp, TDMA2100_CONTROL,
471 			DMA_CNTRL2100_CLEAR_CHAN | DMA_CNTRL2100_RESET_INT);
472 		ISP_WRITE(isp, RDMA2100_CONTROL,
473 			DMA_CNTRL2100_CLEAR_CHAN | DMA_CNTRL2100_RESET_INT);
474 	}
475 
476 	/*
477 	 * Wait for ISP to be ready to go...
478 	 */
479 	loops = MBOX_DELAY_COUNT;
480 	for (;;) {
481 		if (IS_SCSI(isp)) {
482 			if (!(ISP_READ(isp, BIU_ICR) & BIU_ICR_SOFT_RESET))
483 				break;
484 		} else {
485 			if (!(ISP_READ(isp, BIU2100_CSR) & BIU2100_SOFT_RESET))
486 				break;
487 		}
488 		USEC_DELAY(100);
489 		if (--loops < 0) {
490 			ISP_DUMPREGS(isp, "chip reset timed out");
491 			return;
492 		}
493 	}
494 
495 	/*
496 	 * After we've fired this chip up, zero out the conf1 register
497 	 * for SCSI adapters and other settings for the 2100.
498 	 */
499 
500 	if (IS_SCSI(isp)) {
501 		ISP_WRITE(isp, BIU_CONF1, 0);
502 	} else {
503 		ISP_WRITE(isp, BIU2100_CSR, 0);
504 	}
505 
506 	/*
507 	 * Reset RISC Processor
508 	 */
509 	ISP_WRITE(isp, HCCR, HCCR_CMD_RESET);
510 	USEC_DELAY(100);
511 	/* Clear semaphore register (just to be sure) */
512 	ISP_WRITE(isp, BIU_SEMA, 0);
513 
514 	/*
515 	 * Establish some initial burst rate stuff.
516 	 * (only for the 1XX0 boards). This really should
517 	 * be done later after fetching from NVRAM.
518 	 */
519 	if (IS_SCSI(isp)) {
520 		u_int16_t tmp = isp->isp_mdvec->dv_conf1;
521 		/*
522 		 * Busted FIFO. Turn off all but burst enables.
523 		 */
524 		if (isp->isp_type == ISP_HA_SCSI_1040A) {
525 			tmp &= BIU_BURST_ENABLE;
526 		}
527 		ISP_SETBITS(isp, BIU_CONF1, tmp);
528 		if (tmp & BIU_BURST_ENABLE) {
529 			ISP_SETBITS(isp, CDMA_CONF, DMA_ENABLE_BURST);
530 			ISP_SETBITS(isp, DDMA_CONF, DMA_ENABLE_BURST);
531 		}
532 #ifdef	PTI_CARDS
533 		if (((sdparam *) isp->isp_param)->isp_ultramode) {
534 			while (ISP_READ(isp, RISC_MTR) != 0x1313) {
535 				ISP_WRITE(isp, RISC_MTR, 0x1313);
536 				ISP_WRITE(isp, HCCR, HCCR_CMD_STEP);
537 			}
538 		} else {
539 			ISP_WRITE(isp, RISC_MTR, 0x1212);
540 		}
541 		/*
542 		 * PTI specific register
543 		 */
544 		ISP_WRITE(isp, RISC_EMB, DUAL_BANK)
545 #else
546 		ISP_WRITE(isp, RISC_MTR, 0x1212);
547 #endif
548 	} else {
549 		ISP_WRITE(isp, RISC_MTR2100, 0x1212);
550 		if (IS_2200(isp) || IS_23XX(isp)) {
551 			ISP_WRITE(isp, HCCR, HCCR_2X00_DISABLE_PARITY_PAUSE);
552 		}
553 	}
554 
555 	ISP_WRITE(isp, HCCR, HCCR_CMD_RELEASE); /* release paused processor */
556 
557 	/*
558 	 * Do MD specific post initialization
559 	 */
560 	ISP_RESET1(isp);
561 
562 	/*
563 	 * Wait for everything to finish firing up.
564 	 *
565 	 * Avoid doing this on the 2312 because you can generate a PCI
566 	 * parity error (chip breakage).
567 	 */
568 	if (IS_23XX(isp)) {
569 		USEC_DELAY(5);
570 	} else {
571 		loops = MBOX_DELAY_COUNT;
572 		while (ISP_READ(isp, OUTMAILBOX0) == MBOX_BUSY) {
573 			USEC_DELAY(100);
574 			if (--loops < 0) {
575 				isp_prt(isp, ISP_LOGERR,
576 				    "MBOX_BUSY never cleared on reset");
577 				return;
578 			}
579 		}
580 	}
581 
582 	/*
583 	 * Up until this point we've done everything by just reading or
584 	 * setting registers. From this point on we rely on at least *some*
585 	 * kind of firmware running in the card.
586 	 */
587 
588 	/*
589 	 * Do some sanity checking.
590 	 */
591 	mbs.param[0] = MBOX_NO_OP;
592 	isp_mboxcmd(isp, &mbs, MBLOGALL);
593 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
594 		return;
595 	}
596 
597 	if (IS_SCSI(isp)) {
598 		mbs.param[0] = MBOX_MAILBOX_REG_TEST;
599 		mbs.param[1] = 0xdead;
600 		mbs.param[2] = 0xbeef;
601 		mbs.param[3] = 0xffff;
602 		mbs.param[4] = 0x1111;
603 		mbs.param[5] = 0xa5a5;
604 		isp_mboxcmd(isp, &mbs, MBLOGALL);
605 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
606 			return;
607 		}
608 		if (mbs.param[1] != 0xdead || mbs.param[2] != 0xbeef ||
609 		    mbs.param[3] != 0xffff || mbs.param[4] != 0x1111 ||
610 		    mbs.param[5] != 0xa5a5) {
611 			isp_prt(isp, ISP_LOGERR,
612 			    "Register Test Failed (0x%x 0x%x 0x%x 0x%x 0x%x)",
613 			    mbs.param[1], mbs.param[2], mbs.param[3],
614 			    mbs.param[4], mbs.param[5]);
615 			return;
616 		}
617 
618 	}
619 
620 	/*
621 	 * Download new Firmware, unless requested not to do so.
622 	 * This is made slightly trickier in some cases where the
623 	 * firmware of the ROM revision is newer than the revision
624 	 * compiled into the driver. So, where we used to compare
625 	 * versions of our f/w and the ROM f/w, now we just see
626 	 * whether we have f/w at all and whether a config flag
627 	 * has disabled our download.
628 	 */
629 	if ((isp->isp_mdvec->dv_ispfw == NULL) ||
630 	    (isp->isp_confopts & ISP_CFG_NORELOAD)) {
631 		dodnld = 0;
632 	}
633 
634 	if (IS_23XX(isp))
635 		code_org = ISP_CODE_ORG_2300;
636 	else
637 		code_org = ISP_CODE_ORG;
638 
639 	if (dodnld) {
640 		isp->isp_mbxworkp = (void *) &isp->isp_mdvec->dv_ispfw[1];
641 		isp->isp_mbxwrk0 = isp->isp_mdvec->dv_ispfw[3] - 1;
642 		isp->isp_mbxwrk1 = code_org + 1;
643 		mbs.param[0] = MBOX_WRITE_RAM_WORD;
644 		mbs.param[1] = code_org;
645 		mbs.param[2] = isp->isp_mdvec->dv_ispfw[0];
646 		isp_mboxcmd(isp, &mbs, MBLOGNONE);
647 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
648 			isp_prt(isp, ISP_LOGERR,
649 			    "F/W download failed at word %d",
650 			    isp->isp_mbxwrk1 - code_org);
651 			dodnld = 0;
652 			goto again;
653 		}
654 		/*
655 		 * Verify that it downloaded correctly.
656 		 */
657 		mbs.param[0] = MBOX_VERIFY_CHECKSUM;
658 		mbs.param[1] = code_org;
659 		isp_mboxcmd(isp, &mbs, MBLOGNONE);
660 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
661 			isp_prt(isp, ISP_LOGERR, "Ram Checksum Failure");
662 			return;
663 		}
664 		isp->isp_loaded_fw = 1;
665 	} else {
666 		isp->isp_loaded_fw = 0;
667 		isp_prt(isp, ISP_LOGDEBUG2, "skipping f/w download");
668 	}
669 
670 	/*
671 	 * Now start it rolling.
672 	 *
673 	 * If we didn't actually download f/w,
674 	 * we still need to (re)start it.
675 	 */
676 
677 
678 	mbs.param[0] = MBOX_EXEC_FIRMWARE;
679 	mbs.param[1] = code_org;
680 	isp_mboxcmd(isp, &mbs, MBLOGNONE);
681 	/*
682 	 * Give it a chance to start.
683 	 */
684 	USEC_DELAY(500);
685 
686 	if (IS_SCSI(isp)) {
687 		/*
688 		 * Set CLOCK RATE, but only if asked to.
689 		 */
690 		if (isp->isp_clock) {
691 			mbs.param[0] = MBOX_SET_CLOCK_RATE;
692 			mbs.param[1] = isp->isp_clock;
693 			isp_mboxcmd(isp, &mbs, MBLOGALL);
694 			/* we will try not to care if this fails */
695 		}
696 	}
697 
698 	mbs.param[0] = MBOX_ABOUT_FIRMWARE;
699 	isp_mboxcmd(isp, &mbs, MBLOGALL);
700 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
701 		return;
702 	}
703 
704 	/*
705 	 * The SBus firmware that we are using apparently does not return
706 	 * major, minor, micro revisions in the mailbox registers, which
707 	 * is really, really, annoying.
708 	 */
709 	if (ISP_SBUS_SUPPORTED && isp->isp_bustype == ISP_BT_SBUS) {
710 		if (dodnld) {
711 #ifdef	ISP_TARGET_MODE
712 			isp->isp_fwrev[0] = 7;
713 			isp->isp_fwrev[1] = 55;
714 #else
715 			isp->isp_fwrev[0] = 1;
716 			isp->isp_fwrev[1] = 37;
717 #endif
718 			isp->isp_fwrev[2] = 0;
719 		}
720 	} else {
721 		isp->isp_fwrev[0] = mbs.param[1];
722 		isp->isp_fwrev[1] = mbs.param[2];
723 		isp->isp_fwrev[2] = mbs.param[3];
724 	}
725 	isp_prt(isp, ISP_LOGCONFIG,
726 	    "Board Type %s, Chip Revision 0x%x, %s F/W Revision %d.%d.%d",
727 	    btype, isp->isp_revision, dodnld? "loaded" : "resident",
728 	    isp->isp_fwrev[0], isp->isp_fwrev[1], isp->isp_fwrev[2]);
729 
730 	if (IS_FC(isp)) {
731 		/*
732 		 * We do not believe firmware attributes for 2100 code less
733 		 * than 1.17.0, unless it's the firmware we specifically
734 		 * are loading.
735 		 *
736 		 * Note that all 22XX and 23XX f/w is greater than 1.X.0.
737 		 */
738 		if (!(ISP_FW_NEWER_THAN(isp, 1, 17, 0))) {
739 #ifdef	USE_SMALLER_2100_FIRMWARE
740 			FCPARAM(isp)->isp_fwattr = ISP_FW_ATTR_SCCLUN;
741 #else
742 			FCPARAM(isp)->isp_fwattr = 0;
743 #endif
744 		} else {
745 			FCPARAM(isp)->isp_fwattr = mbs.param[6];
746 			isp_prt(isp, ISP_LOGDEBUG0,
747 			    "Firmware Attributes = 0x%x", mbs.param[6]);
748 		}
749 		if (ISP_READ(isp, BIU2100_CSR) & BIU2100_PCI64) {
750 			isp_prt(isp, ISP_LOGCONFIG,
751 			    "Installed in 64-Bit PCI slot");
752 		}
753 	}
754 
755 	if (isp->isp_romfw_rev[0] || isp->isp_romfw_rev[1] ||
756 	    isp->isp_romfw_rev[2]) {
757 		isp_prt(isp, ISP_LOGCONFIG, "Last F/W revision was %d.%d.%d",
758 		    isp->isp_romfw_rev[0], isp->isp_romfw_rev[1],
759 		    isp->isp_romfw_rev[2]);
760 	}
761 
762 	mbs.param[0] = MBOX_GET_FIRMWARE_STATUS;
763 	isp_mboxcmd(isp, &mbs, MBLOGALL);
764 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
765 		return;
766 	}
767 	isp->isp_maxcmds = mbs.param[2];
768 	isp_prt(isp, ISP_LOGINFO,
769 	    "%d max I/O commands supported", mbs.param[2]);
770 	isp_fw_state(isp);
771 
772 	/*
773 	 * Set up DMA for the request and result mailboxes.
774 	 */
775 	if (ISP_MBOXDMASETUP(isp) != 0) {
776 		isp_prt(isp, ISP_LOGERR, "Cannot setup DMA");
777 		return;
778 	}
779 	isp->isp_state = ISP_RESETSTATE;
780 
781 	/*
782 	 * Okay- now that we have new firmware running, we now (re)set our
783 	 * notion of how many luns we support. This is somewhat tricky because
784 	 * if we haven't loaded firmware, we sometimes do not have an easy way
785 	 * of knowing how many luns we support.
786 	 *
787 	 * Expanded lun firmware gives you 32 luns for SCSI cards and
788 	 * 16384 luns for Fibre Channel cards.
789 	 *
790 	 * It turns out that even for QLogic 2100s with ROM 1.10 and above
791 	 * we do get a firmware attributes word returned in mailbox register 6.
792 	 *
793 	 * Because the lun is in a different position in the Request Queue
794 	 * Entry structure for Fibre Channel with expanded lun firmware, we
795 	 * can only support one lun (lun zero) when we don't know what kind
796 	 * of firmware we're running.
797 	 */
798 	if (IS_SCSI(isp)) {
799 		if (dodnld) {
800 			if (IS_ULTRA2(isp) || IS_ULTRA3(isp)) {
801 				isp->isp_maxluns = 32;
802 			} else {
803 				isp->isp_maxluns = 8;
804 			}
805 		} else {
806 			isp->isp_maxluns = 8;
807 		}
808 	} else {
809 		if (FCPARAM(isp)->isp_fwattr & ISP_FW_ATTR_SCCLUN) {
810 			isp->isp_maxluns = 16384;
811 		} else {
812 			isp->isp_maxluns = 16;
813 		}
814 	}
815 }
816 
817 /*
818  * Initialize Parameters of Hardware to a known state.
819  *
820  * Locks are held before coming here.
821  */
822 
823 void
824 isp_init(struct ispsoftc *isp)
825 {
826 	/*
827 	 * Must do this first to get defaults established.
828 	 */
829 	isp_setdfltparm(isp, 0);
830 	if (IS_DUALBUS(isp)) {
831 		isp_setdfltparm(isp, 1);
832 	}
833 	if (IS_FC(isp)) {
834 		isp_fibre_init(isp);
835 	} else {
836 		isp_scsi_init(isp);
837 	}
838 }
839 
840 static void
841 isp_scsi_init(struct ispsoftc *isp)
842 {
843 	sdparam *sdp_chan0, *sdp_chan1;
844 	mbreg_t mbs;
845 
846 	sdp_chan0 = isp->isp_param;
847 	sdp_chan1 = sdp_chan0;
848 	if (IS_DUALBUS(isp)) {
849 		sdp_chan1++;
850 	}
851 
852 	/*
853 	 * If we have no role (neither target nor initiator), return.
854 	 */
855 	if (isp->isp_role == ISP_ROLE_NONE) {
856 		return;
857 	}
858 
859 	/* First do overall per-card settings. */
860 
861 	/*
862 	 * If we have fast memory timing enabled, turn it on.
863 	 */
864 	if (sdp_chan0->isp_fast_mttr) {
865 		ISP_WRITE(isp, RISC_MTR, 0x1313);
866 	}
867 
868 	/*
869 	 * Set Retry Delay and Count.
870 	 * You set both channels at the same time.
871 	 */
872 	mbs.param[0] = MBOX_SET_RETRY_COUNT;
873 	mbs.param[1] = sdp_chan0->isp_retry_count;
874 	mbs.param[2] = sdp_chan0->isp_retry_delay;
875 	mbs.param[6] = sdp_chan1->isp_retry_count;
876 	mbs.param[7] = sdp_chan1->isp_retry_delay;
877 
878 	isp_mboxcmd(isp, &mbs, MBLOGALL);
879 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
880 		return;
881 	}
882 
883 	/*
884 	 * Set ASYNC DATA SETUP time. This is very important.
885 	 */
886 	mbs.param[0] = MBOX_SET_ASYNC_DATA_SETUP_TIME;
887 	mbs.param[1] = sdp_chan0->isp_async_data_setup;
888 	mbs.param[2] = sdp_chan1->isp_async_data_setup;
889 	isp_mboxcmd(isp, &mbs, MBLOGALL);
890 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
891 		return;
892 	}
893 
894 	/*
895 	 * Set ACTIVE Negation State.
896 	 */
897 	mbs.param[0] = MBOX_SET_ACT_NEG_STATE;
898 	mbs.param[1] =
899 	    (sdp_chan0->isp_req_ack_active_neg << 4) |
900 	    (sdp_chan0->isp_data_line_active_neg << 5);
901 	mbs.param[2] =
902 	    (sdp_chan1->isp_req_ack_active_neg << 4) |
903 	    (sdp_chan1->isp_data_line_active_neg << 5);
904 
905 	isp_mboxcmd(isp, &mbs, MBLOGNONE);
906 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
907 		isp_prt(isp, ISP_LOGERR,
908 		    "failed to set active negation state (%d,%d), (%d,%d)",
909 		    sdp_chan0->isp_req_ack_active_neg,
910 		    sdp_chan0->isp_data_line_active_neg,
911 		    sdp_chan1->isp_req_ack_active_neg,
912 		    sdp_chan1->isp_data_line_active_neg);
913 		/*
914 		 * But don't return.
915 		 */
916 	}
917 
918 	/*
919 	 * Set the Tag Aging limit
920 	 */
921 	mbs.param[0] = MBOX_SET_TAG_AGE_LIMIT;
922 	mbs.param[1] = sdp_chan0->isp_tag_aging;
923 	mbs.param[2] = sdp_chan1->isp_tag_aging;
924 	isp_mboxcmd(isp, &mbs, MBLOGALL);
925 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
926 		isp_prt(isp, ISP_LOGERR, "failed to set tag age limit (%d,%d)",
927 		    sdp_chan0->isp_tag_aging, sdp_chan1->isp_tag_aging);
928 		return;
929 	}
930 
931 	/*
932 	 * Set selection timeout.
933 	 */
934 	mbs.param[0] = MBOX_SET_SELECT_TIMEOUT;
935 	mbs.param[1] = sdp_chan0->isp_selection_timeout;
936 	mbs.param[2] = sdp_chan1->isp_selection_timeout;
937 	isp_mboxcmd(isp, &mbs, MBLOGALL);
938 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
939 		return;
940 	}
941 
942 	/* now do per-channel settings */
943 	isp_scsi_channel_init(isp, 0);
944 	if (IS_DUALBUS(isp))
945 		isp_scsi_channel_init(isp, 1);
946 
947 	/*
948 	 * Now enable request/response queues
949 	 */
950 
951 	if (IS_ULTRA2(isp) || IS_1240(isp)) {
952 		mbs.param[0] = MBOX_INIT_RES_QUEUE_A64;
953 		mbs.param[1] = RESULT_QUEUE_LEN(isp);
954 		mbs.param[2] = DMA_WD1(isp->isp_result_dma);
955 		mbs.param[3] = DMA_WD0(isp->isp_result_dma);
956 		mbs.param[4] = 0;
957 		mbs.param[6] = DMA_WD3(isp->isp_result_dma);
958 		mbs.param[7] = DMA_WD2(isp->isp_result_dma);
959 		isp_mboxcmd(isp, &mbs, MBLOGALL);
960 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
961 			return;
962 		}
963 		isp->isp_residx = mbs.param[5];
964 
965 		mbs.param[0] = MBOX_INIT_REQ_QUEUE_A64;
966 		mbs.param[1] = RQUEST_QUEUE_LEN(isp);
967 		mbs.param[2] = DMA_WD1(isp->isp_rquest_dma);
968 		mbs.param[3] = DMA_WD0(isp->isp_rquest_dma);
969 		mbs.param[5] = 0;
970 		mbs.param[6] = DMA_WD3(isp->isp_result_dma);
971 		mbs.param[7] = DMA_WD2(isp->isp_result_dma);
972 		isp_mboxcmd(isp, &mbs, MBLOGALL);
973 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
974 			return;
975 		}
976 		isp->isp_reqidx = isp->isp_reqodx = mbs.param[4];
977 	} else {
978 		mbs.param[0] = MBOX_INIT_RES_QUEUE;
979 		mbs.param[1] = RESULT_QUEUE_LEN(isp);
980 		mbs.param[2] = DMA_WD1(isp->isp_result_dma);
981 		mbs.param[3] = DMA_WD0(isp->isp_result_dma);
982 		mbs.param[4] = 0;
983 		isp_mboxcmd(isp, &mbs, MBLOGALL);
984 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
985 			return;
986 		}
987 		isp->isp_residx = mbs.param[5];
988 
989 		mbs.param[0] = MBOX_INIT_REQ_QUEUE;
990 		mbs.param[1] = RQUEST_QUEUE_LEN(isp);
991 		mbs.param[2] = DMA_WD1(isp->isp_rquest_dma);
992 		mbs.param[3] = DMA_WD0(isp->isp_rquest_dma);
993 		mbs.param[5] = 0;
994 		isp_mboxcmd(isp, &mbs, MBLOGALL);
995 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
996 			return;
997 		}
998 		isp->isp_reqidx = isp->isp_reqodx = mbs.param[4];
999 	}
1000 
1001 	/*
1002 	 * Turn on Fast Posting, LVD transitions
1003 	 *
1004 	 * Ultra2 F/W always has had fast posting (and LVD transitions)
1005 	 *
1006 	 * Ultra and older (i.e., SBus) cards may not. It's just safer
1007 	 * to assume not for them.
1008 	 */
1009 
1010 	mbs.param[0] = MBOX_SET_FW_FEATURES;
1011 	mbs.param[1] = 0;
1012 	if (IS_ULTRA2(isp))
1013 		mbs.param[1] |= FW_FEATURE_LVD_NOTIFY;
1014 #ifndef	ISP_NO_RIO
1015 	if (IS_ULTRA2(isp) || IS_1240(isp))
1016 		mbs.param[1] |= FW_FEATURE_RIO_16BIT;
1017 #else
1018 #ifndef	ISP_NO_FASTPOST
1019 	if (IS_ULTRA2(isp) || IS_1240(isp))
1020 		mbs.param[1] |= FW_FEATURE_FAST_POST;
1021 #endif
1022 #endif
1023 	if (mbs.param[1] != 0) {
1024 		u_int16_t sfeat = mbs.param[1];
1025 		isp_mboxcmd(isp, &mbs, MBLOGALL);
1026 		if (mbs.param[0] == MBOX_COMMAND_COMPLETE) {
1027 			isp_prt(isp, ISP_LOGINFO,
1028 			    "Enabled FW features (0x%x)", sfeat);
1029 		}
1030 	}
1031 
1032 	/*
1033 	 * Let the outer layers decide whether to issue a SCSI bus reset.
1034 	 */
1035 	isp->isp_state = ISP_INITSTATE;
1036 }
1037 
1038 static void
1039 isp_scsi_channel_init(struct ispsoftc *isp, int channel)
1040 {
1041 	sdparam *sdp;
1042 	mbreg_t mbs;
1043 	int tgt;
1044 
1045 	sdp = isp->isp_param;
1046 	sdp += channel;
1047 
1048 	/*
1049 	 * Set (possibly new) Initiator ID.
1050 	 */
1051 	mbs.param[0] = MBOX_SET_INIT_SCSI_ID;
1052 	mbs.param[1] = (channel << 7) | sdp->isp_initiator_id;
1053 	isp_mboxcmd(isp, &mbs, MBLOGALL);
1054 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
1055 		return;
1056 	}
1057 	isp_prt(isp, ISP_LOGINFO, "Initiator ID is %d on Channel %d",
1058 	    sdp->isp_initiator_id, channel);
1059 
1060 
1061 	/*
1062 	 * Set current per-target parameters to an initial safe minimum.
1063 	 */
1064 	for (tgt = 0; tgt < MAX_TARGETS; tgt++) {
1065 		int lun;
1066 		u_int16_t sdf;
1067 
1068 		if (sdp->isp_devparam[tgt].dev_enable == 0) {
1069 			continue;
1070 		}
1071 #ifndef	ISP_TARGET_MODE
1072 		sdf = sdp->isp_devparam[tgt].goal_flags;
1073 		sdf &= DPARM_SAFE_DFLT;
1074 		/*
1075 		 * It is not quite clear when this changed over so that
1076 		 * we could force narrow and async for 1000/1020 cards,
1077 		 * but assume that this is only the case for loaded
1078 		 * firmware.
1079 		 */
1080 		if (isp->isp_loaded_fw) {
1081 			sdf |= DPARM_NARROW | DPARM_ASYNC;
1082 		}
1083 #else
1084 		/*
1085 		 * The !$*!)$!$)* f/w uses the same index into some
1086 		 * internal table to decide how to respond to negotiations,
1087 		 * so if we've said "let's be safe" for ID X, and ID X
1088 		 * selects *us*, the negotiations will back to 'safe'
1089 		 * (as in narrow/async). What the f/w *should* do is
1090 		 * use the initiator id settings to decide how to respond.
1091 		 */
1092 		sdp->isp_devparam[tgt].goal_flags = sdf = DPARM_DEFAULT;
1093 #endif
1094 		mbs.param[0] = MBOX_SET_TARGET_PARAMS;
1095 		mbs.param[1] = (channel << 15) | (tgt << 8);
1096 		mbs.param[2] = sdf;
1097 		if ((sdf & DPARM_SYNC) == 0) {
1098 			mbs.param[3] = 0;
1099 		} else {
1100 			mbs.param[3] =
1101 			    (sdp->isp_devparam[tgt].goal_offset << 8) |
1102 			    (sdp->isp_devparam[tgt].goal_period);
1103 		}
1104 		isp_prt(isp, ISP_LOGDEBUG0,
1105 		    "Initial Settings bus%d tgt%d flags 0x%x off 0x%x per 0x%x",
1106 		    channel, tgt, mbs.param[2], mbs.param[3] >> 8,
1107 		    mbs.param[3] & 0xff);
1108 		isp_mboxcmd(isp, &mbs, MBLOGNONE);
1109 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
1110 			sdf = DPARM_SAFE_DFLT;
1111 			mbs.param[0] = MBOX_SET_TARGET_PARAMS;
1112 			mbs.param[1] = (tgt << 8) | (channel << 15);
1113 			mbs.param[2] = sdf;
1114 			mbs.param[3] = 0;
1115 			isp_mboxcmd(isp, &mbs, MBLOGALL);
1116 			if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
1117 				continue;
1118 			}
1119 		}
1120 
1121 		/*
1122 		 * We don't update any information directly from the f/w
1123 		 * because we need to run at least one command to cause a
1124 		 * new state to be latched up. So, we just assume that we
1125 		 * converge to the values we just had set.
1126 		 *
1127 		 * Ensure that we don't believe tagged queuing is enabled yet.
1128 		 * It turns out that sometimes the ISP just ignores our
1129 		 * attempts to set parameters for devices that it hasn't
1130 		 * seen yet.
1131 		 */
1132 		sdp->isp_devparam[tgt].actv_flags = sdf & ~DPARM_TQING;
1133 		for (lun = 0; lun < (int) isp->isp_maxluns; lun++) {
1134 			mbs.param[0] = MBOX_SET_DEV_QUEUE_PARAMS;
1135 			mbs.param[1] = (channel << 15) | (tgt << 8) | lun;
1136 			mbs.param[2] = sdp->isp_max_queue_depth;
1137 			mbs.param[3] = sdp->isp_devparam[tgt].exc_throttle;
1138 			isp_mboxcmd(isp, &mbs, MBLOGALL);
1139 			if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
1140 				break;
1141 			}
1142 		}
1143 	}
1144 	for (tgt = 0; tgt < MAX_TARGETS; tgt++) {
1145 		if (sdp->isp_devparam[tgt].dev_refresh) {
1146 			isp->isp_sendmarker |= (1 << channel);
1147 			isp->isp_update |= (1 << channel);
1148 			break;
1149 		}
1150 	}
1151 }
1152 
1153 /*
1154  * Fibre Channel specific initialization.
1155  *
1156  * Locks are held before coming here.
1157  */
1158 static void
1159 isp_fibre_init(struct ispsoftc *isp)
1160 {
1161 	fcparam *fcp;
1162 	isp_icb_t local, *icbp = &local;
1163 	mbreg_t mbs;
1164 	int loopid;
1165 	u_int64_t nwwn, pwwn;
1166 
1167 	fcp = isp->isp_param;
1168 
1169 	/*
1170 	 * Do this *before* initializing the firmware.
1171 	 */
1172 	isp_mark_getpdb_all(isp);
1173 	fcp->isp_fwstate = FW_CONFIG_WAIT;
1174 	fcp->isp_loopstate = LOOP_NIL;
1175 
1176 	/*
1177 	 * If we have no role (neither target nor initiator), return.
1178 	 */
1179 	if (isp->isp_role == ISP_ROLE_NONE) {
1180 		return;
1181 	}
1182 
1183 	loopid = fcp->isp_loopid;
1184 	MEMZERO(icbp, sizeof (*icbp));
1185 	icbp->icb_version = ICB_VERSION1;
1186 
1187 	/*
1188 	 * Firmware Options are either retrieved from NVRAM or
1189 	 * are patched elsewhere. We check them for sanity here
1190 	 * and make changes based on board revision, but otherwise
1191 	 * let others decide policy.
1192 	 */
1193 
1194 	/*
1195 	 * If this is a 2100 < revision 5, we have to turn off FAIRNESS.
1196 	 */
1197 	if ((isp->isp_type == ISP_HA_FC_2100) && isp->isp_revision < 5) {
1198 		fcp->isp_fwoptions &= ~ICBOPT_FAIRNESS;
1199 	}
1200 
1201 	/*
1202 	 * We have to use FULL LOGIN even though it resets the loop too much
1203 	 * because otherwise port database entries don't get updated after
1204 	 * a LIP- this is a known f/w bug for 2100 f/w less than 1.17.0.
1205 	 */
1206 	if (!ISP_FW_NEWER_THAN(isp, 1, 17, 0)) {
1207 		fcp->isp_fwoptions |= ICBOPT_FULL_LOGIN;
1208 	}
1209 
1210 	/*
1211 	 * Insist on Port Database Update Async notifications
1212 	 */
1213 	fcp->isp_fwoptions |= ICBOPT_PDBCHANGE_AE;
1214 
1215 	/*
1216 	 * Make sure that target role reflects into fwoptions.
1217 	 */
1218 	if (isp->isp_role & ISP_ROLE_TARGET) {
1219 		fcp->isp_fwoptions |= ICBOPT_TGT_ENABLE;
1220 	} else {
1221 		fcp->isp_fwoptions &= ~ICBOPT_TGT_ENABLE;
1222 	}
1223 
1224 	/*
1225 	 * Propagate all of this into the ICB structure.
1226 	 */
1227 	icbp->icb_fwoptions = fcp->isp_fwoptions;
1228 	icbp->icb_maxfrmlen = fcp->isp_maxfrmlen;
1229 	if (icbp->icb_maxfrmlen < ICB_MIN_FRMLEN ||
1230 	    icbp->icb_maxfrmlen > ICB_MAX_FRMLEN) {
1231 		isp_prt(isp, ISP_LOGERR,
1232 		    "bad frame length (%d) from NVRAM- using %d",
1233 		    fcp->isp_maxfrmlen, ICB_DFLT_FRMLEN);
1234 		icbp->icb_maxfrmlen = ICB_DFLT_FRMLEN;
1235 	}
1236 	icbp->icb_maxalloc = fcp->isp_maxalloc;
1237 	if (icbp->icb_maxalloc < 1) {
1238 		isp_prt(isp, ISP_LOGERR,
1239 		    "bad maximum allocation (%d)- using 16", fcp->isp_maxalloc);
1240 		icbp->icb_maxalloc = 16;
1241 	}
1242 	icbp->icb_execthrottle = fcp->isp_execthrottle;
1243 	if (icbp->icb_execthrottle < 1) {
1244 		isp_prt(isp, ISP_LOGERR,
1245 		    "bad execution throttle of %d- using 16",
1246 		    fcp->isp_execthrottle);
1247 		icbp->icb_execthrottle = ICB_DFLT_THROTTLE;
1248 	}
1249 	icbp->icb_retry_delay = fcp->isp_retry_delay;
1250 	icbp->icb_retry_count = fcp->isp_retry_count;
1251 	icbp->icb_hardaddr = loopid;
1252 	if (icbp->icb_hardaddr >= 125) {
1253 		/*
1254 		 * We end up with a Loop ID of 255 for F-Port topologies
1255 		 */
1256 		if (icbp->icb_hardaddr != 255) {
1257 		    isp_prt(isp, ISP_LOGERR,
1258 			"bad hard address %u- resetting to zero",
1259 			icbp->icb_hardaddr);
1260 		}
1261 		icbp->icb_hardaddr = 0;
1262 	}
1263 	/*
1264 	 * Right now we just set extended options to prefer point-to-point
1265 	 * over loop based upon some soft config options.
1266 	 *
1267 	 * NB: for the 2300, ICBOPT_EXTENDED is required.
1268 	 */
1269 	if (IS_2200(isp) || IS_23XX(isp)) {
1270 		icbp->icb_fwoptions |= ICBOPT_EXTENDED;
1271 		/*
1272 		 * Prefer or force Point-To-Point instead Loop?
1273 		 */
1274 		switch(isp->isp_confopts & ISP_CFG_PORT_PREF) {
1275 		case ISP_CFG_NPORT:
1276 			icbp->icb_xfwoptions |= ICBXOPT_PTP_2_LOOP;
1277 			break;
1278 		case ISP_CFG_NPORT_ONLY:
1279 			icbp->icb_xfwoptions |= ICBXOPT_PTP_ONLY;
1280 			break;
1281 		case ISP_CFG_LPORT_ONLY:
1282 			icbp->icb_xfwoptions |= ICBXOPT_LOOP_ONLY;
1283 			break;
1284 		default:
1285 			icbp->icb_xfwoptions |= ICBXOPT_LOOP_2_PTP;
1286 			break;
1287 		}
1288 		if (IS_23XX(isp)) {
1289 			/*
1290 			 * QLogic recommends that FAST Posting be turned
1291 			 * off for 23XX cards and instead allow the HBA
1292 			 * to write response queue entries and interrupt
1293 			 * after a delay (ZIO).
1294 			 *
1295 			 * If we set ZIO, it will disable fast posting,
1296 			 * so we don't need to clear it in fwoptions.
1297 			 */
1298 #ifndef	ISP_NO_ZIO
1299 			icbp->icb_xfwoptions |= ICBXOPT_ZIO;
1300 #else
1301 			icbp->icb_fwoptions |= ICBOPT_FAST_POST;
1302 #endif
1303 #if	0
1304 			/*
1305 			 * Values, in 100us increments. The default
1306 			 * is 2 (200us) if a value 0 (default) is
1307 			 * selected.
1308 			 */
1309 			icbp->icb_idelaytimer = 2;
1310 #endif
1311 
1312 			if (isp->isp_confopts & ISP_CFG_ONEGB) {
1313 				icbp->icb_zfwoptions |= ICBZOPT_RATE_ONEGB;
1314 			} else if (isp->isp_confopts & ISP_CFG_TWOGB) {
1315 				icbp->icb_zfwoptions |= ICBZOPT_RATE_TWOGB;
1316 			} else {
1317 				icbp->icb_zfwoptions |= ICBZOPT_RATE_AUTO;
1318 			}
1319 		}
1320 	}
1321 
1322 #ifndef	ISP_NO_RIO_FC
1323 	/*
1324 	 * RIO seems to be enabled in 2100s for fw >= 1.17.0.
1325 	 *
1326 	 * I've had some questionable problems with RIO on 2200.
1327 	 * More specifically, on a 2204 I had problems with RIO
1328 	 * on a Linux system where I was dropping commands right
1329 	 * and left. It's not clear to me what the actual problem
1330 	 * was.
1331 	 *
1332 	 * 23XX Cards do not support RIO. Instead they support ZIO.
1333 	 */
1334 #if	0
1335 	if (!IS_23XX(isp) && ISP_FW_NEWER_THAN(isp, 1, 17, 0)) {
1336 		icbp->icb_xfwoptions |= ICBXOPT_RIO_16BIT;
1337 		icbp->icb_racctimer = 4;
1338 		icbp->icb_idelaytimer = 8;
1339 	}
1340 #endif
1341 #endif
1342 
1343 	/*
1344 	 * For 22XX > 2.1.26 && 23XX, set someoptions.
1345 	 * XXX: Probably okay for newer 2100 f/w too.
1346 	 */
1347 	if (ISP_FW_NEWER_THAN(isp, 2, 26, 0)) {
1348 		/*
1349 		 * Turn on LIP F8 async event (1)
1350 		 * Turn on generate AE 8013 on all LIP Resets (2)
1351 		 * Disable LIP F7 switching (8)
1352 		 */
1353 		mbs.param[0] = MBOX_SET_FIRMWARE_OPTIONS;
1354 		mbs.param[1] = 0xb;
1355 		mbs.param[2] = 0;
1356 		mbs.param[3] = 0;
1357 		isp_mboxcmd(isp, &mbs, MBLOGALL);
1358 	}
1359 	icbp->icb_logintime = 30;	/* 30 second login timeout */
1360 
1361 	if (IS_23XX(isp)) {
1362 		ISP_WRITE(isp, isp->isp_rqstinrp, 0);
1363         	ISP_WRITE(isp, isp->isp_rqstoutrp, 0);
1364         	ISP_WRITE(isp, isp->isp_respinrp, 0);
1365 		ISP_WRITE(isp, isp->isp_respoutrp, 0);
1366 	}
1367 
1368 	nwwn = ISP_NODEWWN(isp);
1369 	pwwn = ISP_PORTWWN(isp);
1370 	if (nwwn && pwwn) {
1371 		icbp->icb_fwoptions |= ICBOPT_BOTH_WWNS;
1372 		MAKE_NODE_NAME_FROM_WWN(icbp->icb_nodename, nwwn);
1373 		MAKE_NODE_NAME_FROM_WWN(icbp->icb_portname, pwwn);
1374 		isp_prt(isp, ISP_LOGDEBUG1,
1375 		    "Setting ICB Node 0x%08x%08x Port 0x%08x%08x",
1376 		    ((u_int32_t) (nwwn >> 32)),
1377 		    ((u_int32_t) (nwwn & 0xffffffff)),
1378 		    ((u_int32_t) (pwwn >> 32)),
1379 		    ((u_int32_t) (pwwn & 0xffffffff)));
1380 	} else {
1381 		isp_prt(isp, ISP_LOGDEBUG1, "Not using any WWNs");
1382 		icbp->icb_fwoptions &= ~(ICBOPT_BOTH_WWNS|ICBOPT_FULL_LOGIN);
1383 	}
1384 	icbp->icb_rqstqlen = RQUEST_QUEUE_LEN(isp);
1385 	if (icbp->icb_rqstqlen < 1) {
1386 		isp_prt(isp, ISP_LOGERR, "bad request queue length");
1387 	}
1388 	icbp->icb_rsltqlen = RESULT_QUEUE_LEN(isp);
1389 	if (icbp->icb_rsltqlen < 1) {
1390 		isp_prt(isp, ISP_LOGERR, "bad result queue length");
1391 	}
1392 	icbp->icb_rqstaddr[RQRSP_ADDR0015] = DMA_WD0(isp->isp_rquest_dma);
1393 	icbp->icb_rqstaddr[RQRSP_ADDR1631] = DMA_WD1(isp->isp_rquest_dma);
1394 	icbp->icb_rqstaddr[RQRSP_ADDR3247] = DMA_WD2(isp->isp_rquest_dma);
1395 	icbp->icb_rqstaddr[RQRSP_ADDR4863] = DMA_WD3(isp->isp_rquest_dma);
1396 	icbp->icb_respaddr[RQRSP_ADDR0015] = DMA_WD0(isp->isp_result_dma);
1397 	icbp->icb_respaddr[RQRSP_ADDR1631] = DMA_WD1(isp->isp_result_dma);
1398 	icbp->icb_respaddr[RQRSP_ADDR3247] = DMA_WD2(isp->isp_result_dma);
1399 	icbp->icb_respaddr[RQRSP_ADDR4863] = DMA_WD3(isp->isp_result_dma);
1400 	isp_prt(isp, ISP_LOGDEBUG0,
1401 	    "isp_fibre_init: fwopt 0x%x xfwopt 0x%x zfwopt 0x%x",
1402 	    icbp->icb_fwoptions, icbp->icb_xfwoptions, icbp->icb_zfwoptions);
1403 
1404 	FC_SCRATCH_ACQUIRE(isp);
1405 	isp_put_icb(isp, icbp, (isp_icb_t *)fcp->isp_scratch);
1406 
1407 	/*
1408 	 * Init the firmware
1409 	 */
1410 	mbs.param[0] = MBOX_INIT_FIRMWARE;
1411 	mbs.param[1] = 0;
1412 	mbs.param[2] = DMA_WD1(fcp->isp_scdma);
1413 	mbs.param[3] = DMA_WD0(fcp->isp_scdma);
1414 	mbs.param[4] = 0;
1415 	mbs.param[5] = 0;
1416 	mbs.param[6] = DMA_WD3(fcp->isp_scdma);
1417 	mbs.param[7] = DMA_WD2(fcp->isp_scdma);
1418 	isp_mboxcmd(isp, &mbs, MBLOGALL);
1419 	FC_SCRATCH_RELEASE(isp);
1420 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
1421 		return;
1422 	}
1423 	isp->isp_reqidx = isp->isp_reqodx = 0;
1424 	isp->isp_residx = 0;
1425 	isp->isp_sendmarker = 1;
1426 
1427 	/*
1428 	 * Whatever happens, we're now committed to being here.
1429 	 */
1430 	isp->isp_state = ISP_INITSTATE;
1431 }
1432 
1433 /*
1434  * Fibre Channel Support- get the port database for the id.
1435  *
1436  * Locks are held before coming here. Return 0 if success,
1437  * else failure.
1438  */
1439 
1440 static int
1441 isp_getmap(struct ispsoftc *isp, fcpos_map_t *map)
1442 {
1443 	fcparam *fcp = (fcparam *) isp->isp_param;
1444 	mbreg_t mbs;
1445 
1446 	mbs.param[0] = MBOX_GET_FC_AL_POSITION_MAP;
1447 	mbs.param[1] = 0;
1448 	mbs.param[2] = DMA_WD1(fcp->isp_scdma);
1449 	mbs.param[3] = DMA_WD0(fcp->isp_scdma);
1450 	/*
1451 	 * Unneeded. For the 2100, except for initializing f/w, registers
1452 	 * 4/5 have to not be written to.
1453 	 *	mbs.param[4] = 0;
1454 	 *	mbs.param[5] = 0;
1455 	 *
1456 	 */
1457 	mbs.param[6] = 0;
1458 	mbs.param[7] = 0;
1459 	FC_SCRATCH_ACQUIRE(isp);
1460 	isp_mboxcmd(isp, &mbs, MBLOGALL & ~MBOX_COMMAND_PARAM_ERROR);
1461 	if (mbs.param[0] == MBOX_COMMAND_COMPLETE) {
1462 		MEMCPY(map, fcp->isp_scratch, sizeof (fcpos_map_t));
1463 		map->fwmap = mbs.param[1] != 0;
1464 		FC_SCRATCH_RELEASE(isp);
1465 		return (0);
1466 	}
1467 	FC_SCRATCH_RELEASE(isp);
1468 	return (-1);
1469 }
1470 
1471 static void
1472 isp_mark_getpdb_all(struct ispsoftc *isp)
1473 {
1474 	fcparam *fcp = (fcparam *) isp->isp_param;
1475 	int i;
1476 	for (i = 0; i < MAX_FC_TARG; i++) {
1477 		fcp->portdb[i].valid = fcp->portdb[i].fabric_dev = 0;
1478 	}
1479 }
1480 
1481 static int
1482 isp_getpdb(struct ispsoftc *isp, int id, isp_pdb_t *pdbp)
1483 {
1484 	fcparam *fcp = (fcparam *) isp->isp_param;
1485 	mbreg_t mbs;
1486 
1487 	mbs.param[0] = MBOX_GET_PORT_DB;
1488 	mbs.param[1] = id << 8;
1489 	mbs.param[2] = DMA_WD1(fcp->isp_scdma);
1490 	mbs.param[3] = DMA_WD0(fcp->isp_scdma);
1491 	/*
1492 	 * Unneeded. For the 2100, except for initializing f/w, registers
1493 	 * 4/5 have to not be written to.
1494 	 *	mbs.param[4] = 0;
1495 	 *	mbs.param[5] = 0;
1496 	 *
1497 	 */
1498 	mbs.param[6] = DMA_WD3(fcp->isp_scdma);
1499 	mbs.param[7] = DMA_WD2(fcp->isp_scdma);
1500 	FC_SCRATCH_ACQUIRE(isp);
1501 	isp_mboxcmd(isp, &mbs, MBLOGALL & ~MBOX_COMMAND_PARAM_ERROR);
1502 	if (mbs.param[0] == MBOX_COMMAND_COMPLETE) {
1503 		isp_get_pdb(isp, (isp_pdb_t *)fcp->isp_scratch, pdbp);
1504 		FC_SCRATCH_RELEASE(isp);
1505 		return (0);
1506 	}
1507 	FC_SCRATCH_RELEASE(isp);
1508 	return (-1);
1509 }
1510 
1511 static u_int64_t
1512 isp_get_portname(struct ispsoftc *isp, int loopid, int nodename)
1513 {
1514 	u_int64_t wwn = 0;
1515 	mbreg_t mbs;
1516 
1517 	mbs.param[0] = MBOX_GET_PORT_NAME;
1518 	mbs.param[1] = loopid << 8;
1519 	if (nodename)
1520 		mbs.param[1] |= 1;
1521 	isp_mboxcmd(isp, &mbs, MBLOGALL & ~MBOX_COMMAND_PARAM_ERROR);
1522 	if (mbs.param[0] == MBOX_COMMAND_COMPLETE) {
1523 		wwn =
1524 		    (((u_int64_t)(mbs.param[2] & 0xff)) << 56) |
1525 		    (((u_int64_t)(mbs.param[2] >> 8))	<< 48) |
1526 		    (((u_int64_t)(mbs.param[3] & 0xff))	<< 40) |
1527 		    (((u_int64_t)(mbs.param[3] >> 8))	<< 32) |
1528 		    (((u_int64_t)(mbs.param[6] & 0xff))	<< 24) |
1529 		    (((u_int64_t)(mbs.param[6] >> 8))	<< 16) |
1530 		    (((u_int64_t)(mbs.param[7] & 0xff))	<<  8) |
1531 		    (((u_int64_t)(mbs.param[7] >> 8)));
1532 	}
1533 	return (wwn);
1534 }
1535 
1536 /*
1537  * Make sure we have good FC link and know our Loop ID.
1538  */
1539 
1540 static int
1541 isp_fclink_test(struct ispsoftc *isp, int usdelay)
1542 {
1543 	static char *toponames[] = {
1544 		"Private Loop",
1545 		"FL Port",
1546 		"N-Port to N-Port",
1547 		"F Port",
1548 		"F Port (no FLOGI_ACC response)"
1549 	};
1550 	mbreg_t mbs;
1551 	int count, check_for_fabric;
1552 	u_int8_t lwfs;
1553 	fcparam *fcp;
1554 	struct lportdb *lp;
1555 	isp_pdb_t pdb;
1556 
1557 	fcp = isp->isp_param;
1558 
1559 	/*
1560 	 * XXX: Here is where we would start a 'loop dead' timeout
1561 	 */
1562 
1563 	/*
1564 	 * Wait up to N microseconds for F/W to go to a ready state.
1565 	 */
1566 	lwfs = FW_CONFIG_WAIT;
1567 	count = 0;
1568 	while (count < usdelay) {
1569 		u_int64_t enano;
1570 		u_int32_t wrk;
1571 		NANOTIME_T hra, hrb;
1572 
1573 		GET_NANOTIME(&hra);
1574 		isp_fw_state(isp);
1575 		if (lwfs != fcp->isp_fwstate) {
1576 			isp_prt(isp, ISP_LOGINFO, "Firmware State <%s->%s>",
1577 			    isp2100_fw_statename((int)lwfs),
1578 			    isp2100_fw_statename((int)fcp->isp_fwstate));
1579 			lwfs = fcp->isp_fwstate;
1580 		}
1581 		if (fcp->isp_fwstate == FW_READY) {
1582 			break;
1583 		}
1584 		GET_NANOTIME(&hrb);
1585 
1586 		/*
1587 		 * Get the elapsed time in nanoseconds.
1588 		 * Always guaranteed to be non-zero.
1589 		 */
1590 		enano = NANOTIME_SUB(&hrb, &hra);
1591 
1592 		isp_prt(isp, ISP_LOGDEBUG1,
1593 		    "usec%d: 0x%lx->0x%lx enano 0x%x%08x",
1594 		    count, (long) GET_NANOSEC(&hra), (long) GET_NANOSEC(&hrb),
1595 		    (u_int32_t)(enano >> 32), (u_int32_t)(enano & 0xffffffff));
1596 
1597 		/*
1598 		 * If the elapsed time is less than 1 millisecond,
1599 		 * delay a period of time up to that millisecond of
1600 		 * waiting.
1601 		 *
1602 		 * This peculiar code is an attempt to try and avoid
1603 		 * invoking u_int64_t math support functions for some
1604 		 * platforms where linkage is a problem.
1605 		 */
1606 		if (enano < (1000 * 1000)) {
1607 			count += 1000;
1608 			enano = (1000 * 1000) - enano;
1609 			while (enano > (u_int64_t) 4000000000U) {
1610 				USEC_SLEEP(isp, 4000000);
1611 				enano -= (u_int64_t) 4000000000U;
1612 			}
1613 			wrk = enano;
1614 			wrk /= 1000;
1615 			USEC_SLEEP(isp, wrk);
1616 		} else {
1617 			while (enano > (u_int64_t) 4000000000U) {
1618 				count += 4000000;
1619 				enano -= (u_int64_t) 4000000000U;
1620 			}
1621 			wrk = enano;
1622 			count += (wrk / 1000);
1623 		}
1624 	}
1625 
1626 	/*
1627 	 * If we haven't gone to 'ready' state, return.
1628 	 */
1629 	if (fcp->isp_fwstate != FW_READY) {
1630 		return (-1);
1631 	}
1632 
1633 	/*
1634 	 * Get our Loop ID (if possible). We really need to have it.
1635 	 */
1636 	mbs.param[0] = MBOX_GET_LOOP_ID;
1637 	isp_mboxcmd(isp, &mbs, MBLOGALL);
1638 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
1639 		return (-1);
1640 	}
1641 	fcp->isp_loopid = mbs.param[1];
1642 	if (IS_2200(isp) || IS_23XX(isp)) {
1643 		int topo = (int) mbs.param[6];
1644 		if (topo < TOPO_NL_PORT || topo > TOPO_PTP_STUB)
1645 			topo = TOPO_PTP_STUB;
1646 		fcp->isp_topo = topo;
1647 	} else {
1648 		fcp->isp_topo = TOPO_NL_PORT;
1649 	}
1650 	fcp->isp_portid = fcp->isp_alpa = mbs.param[2] & 0xff;
1651 
1652 	/*
1653 	 * Check to see if we're on a fabric by trying to see if we
1654 	 * can talk to the fabric name server. This can be a bit
1655 	 * tricky because if we're a 2100, we should check always
1656 	 * (in case we're connected to a server doing aliasing).
1657 	 */
1658 	fcp->isp_onfabric = 0;
1659 
1660 	if (IS_2100(isp)) {
1661 		/*
1662 		 * Don't bother with fabric if we are using really old
1663 		 * 2100 firmware. It's just not worth it.
1664 		 */
1665 		if (ISP_FW_NEWER_THAN(isp, 1, 15, 37)) {
1666 			check_for_fabric = 1;
1667 		} else {
1668 			check_for_fabric = 0;
1669 		}
1670 	} else if (fcp->isp_topo == TOPO_FL_PORT ||
1671 	    fcp->isp_topo == TOPO_F_PORT) {
1672 		check_for_fabric = 1;
1673 	} else
1674 		check_for_fabric = 0;
1675 
1676 	if (check_for_fabric && isp_getpdb(isp, FL_PORT_ID, &pdb) == 0) {
1677 		int loopid = FL_PORT_ID;
1678 		if (IS_2100(isp)) {
1679 			fcp->isp_topo = TOPO_FL_PORT;
1680 		}
1681 
1682 		if (BITS2WORD(pdb.pdb_portid_bits) == 0) {
1683 			/*
1684 			 * Crock.
1685 			 */
1686 			fcp->isp_topo = TOPO_NL_PORT;
1687 			goto not_on_fabric;
1688 		}
1689 		fcp->isp_portid = mbs.param[2] | ((int) mbs.param[3] << 16);
1690 
1691 		/*
1692 		 * Save the Fabric controller's port database entry.
1693 		 */
1694 		lp = &fcp->portdb[loopid];
1695 		lp->node_wwn =
1696 		    (((u_int64_t)pdb.pdb_nodename[0]) << 56) |
1697 		    (((u_int64_t)pdb.pdb_nodename[1]) << 48) |
1698 		    (((u_int64_t)pdb.pdb_nodename[2]) << 40) |
1699 		    (((u_int64_t)pdb.pdb_nodename[3]) << 32) |
1700 		    (((u_int64_t)pdb.pdb_nodename[4]) << 24) |
1701 		    (((u_int64_t)pdb.pdb_nodename[5]) << 16) |
1702 		    (((u_int64_t)pdb.pdb_nodename[6]) <<  8) |
1703 		    (((u_int64_t)pdb.pdb_nodename[7]));
1704 		lp->port_wwn =
1705 		    (((u_int64_t)pdb.pdb_portname[0]) << 56) |
1706 		    (((u_int64_t)pdb.pdb_portname[1]) << 48) |
1707 		    (((u_int64_t)pdb.pdb_portname[2]) << 40) |
1708 		    (((u_int64_t)pdb.pdb_portname[3]) << 32) |
1709 		    (((u_int64_t)pdb.pdb_portname[4]) << 24) |
1710 		    (((u_int64_t)pdb.pdb_portname[5]) << 16) |
1711 		    (((u_int64_t)pdb.pdb_portname[6]) <<  8) |
1712 		    (((u_int64_t)pdb.pdb_portname[7]));
1713 		lp->roles =
1714 		    (pdb.pdb_prli_svc3 & SVC3_ROLE_MASK) >> SVC3_ROLE_SHIFT;
1715 		lp->portid = BITS2WORD(pdb.pdb_portid_bits);
1716 		lp->loopid = pdb.pdb_loopid;
1717 		lp->loggedin = lp->valid = 1;
1718 		fcp->isp_onfabric = 1;
1719 		(void) isp_async(isp, ISPASYNC_PROMENADE, &loopid);
1720 		isp_register_fc4_type(isp);
1721 	} else {
1722 not_on_fabric:
1723 		fcp->isp_onfabric = 0;
1724 		fcp->portdb[FL_PORT_ID].valid = 0;
1725 	}
1726 
1727 	fcp->isp_gbspeed = 1;
1728 	if (IS_23XX(isp)) {
1729 		mbs.param[0] = MBOX_GET_SET_DATA_RATE;
1730 		mbs.param[1] = MBGSD_GET_RATE;
1731 		/* mbs.param[2] undefined if we're just getting rate */
1732 		isp_mboxcmd(isp, &mbs, MBLOGALL);
1733 		if (mbs.param[0] == MBOX_COMMAND_COMPLETE) {
1734 			if (mbs.param[1] == MBGSD_TWOGB) {
1735 				isp_prt(isp, ISP_LOGINFO, "2Gb link speed/s");
1736 				fcp->isp_gbspeed = 2;
1737 			}
1738 		}
1739 	}
1740 
1741 	isp_prt(isp, ISP_LOGCONFIG, topology, fcp->isp_loopid, fcp->isp_alpa,
1742 	    fcp->isp_portid, fcp->isp_loopstate, toponames[fcp->isp_topo]);
1743 
1744 	/*
1745 	 * Announce ourselves, too. This involves synthesizing an entry.
1746 	 */
1747 	if (fcp->isp_iid_set == 0) {
1748 		fcp->isp_iid_set = 1;
1749 		fcp->isp_iid = fcp->isp_loopid;
1750 		lp = &fcp->portdb[fcp->isp_iid];
1751 	} else {
1752 		lp = &fcp->portdb[fcp->isp_iid];
1753 		if (fcp->isp_portid != lp->portid ||
1754 		    fcp->isp_loopid != lp->loopid ||
1755 		    fcp->isp_nodewwn != ISP_NODEWWN(isp) ||
1756 		    fcp->isp_portwwn != ISP_PORTWWN(isp)) {
1757 			lp->valid = 0;
1758 			count = fcp->isp_iid;
1759 			(void) isp_async(isp, ISPASYNC_PROMENADE, &count);
1760 		}
1761 	}
1762 	lp->loopid = fcp->isp_loopid;
1763 	lp->portid = fcp->isp_portid;
1764 	lp->node_wwn = ISP_NODEWWN(isp);
1765 	lp->port_wwn = ISP_PORTWWN(isp);
1766 	switch (isp->isp_role) {
1767 	case ISP_ROLE_NONE:
1768 		lp->roles = 0;
1769 		break;
1770 	case ISP_ROLE_TARGET:
1771 		lp->roles = SVC3_TGT_ROLE >> SVC3_ROLE_SHIFT;
1772 		break;
1773 	case ISP_ROLE_INITIATOR:
1774 		lp->roles = SVC3_INI_ROLE >> SVC3_ROLE_SHIFT;
1775 		break;
1776 	case ISP_ROLE_BOTH:
1777 		lp->roles = (SVC3_INI_ROLE|SVC3_TGT_ROLE) >> SVC3_ROLE_SHIFT;
1778 		break;
1779 	}
1780 	lp->loggedin = lp->valid = 1;
1781 	count = fcp->isp_iid;
1782 	(void) isp_async(isp, ISPASYNC_PROMENADE, &count);
1783 	return (0);
1784 }
1785 
1786 static char *
1787 isp2100_fw_statename(int state)
1788 {
1789 	switch(state) {
1790 	case FW_CONFIG_WAIT:	return "Config Wait";
1791 	case FW_WAIT_AL_PA:	return "Waiting for AL_PA";
1792 	case FW_WAIT_LOGIN:	return "Wait Login";
1793 	case FW_READY:		return "Ready";
1794 	case FW_LOSS_OF_SYNC:	return "Loss Of Sync";
1795 	case FW_ERROR:		return "Error";
1796 	case FW_REINIT:		return "Re-Init";
1797 	case FW_NON_PART:	return "Nonparticipating";
1798 	default:		return "?????";
1799 	}
1800 }
1801 
1802 /*
1803  * Synchronize our soft copy of the port database with what the f/w thinks
1804  * (with a view toward possibly for a specific target....)
1805  */
1806 
1807 static int
1808 isp_pdb_sync(struct ispsoftc *isp)
1809 {
1810 	struct lportdb *lp;
1811 	fcparam *fcp = isp->isp_param;
1812 	isp_pdb_t pdb;
1813 	int loopid, base, lim;
1814 
1815 	/*
1816 	 * Make sure we're okay for doing this right now.
1817 	 */
1818 	if (fcp->isp_loopstate != LOOP_PDB_RCVD &&
1819 	    fcp->isp_loopstate != LOOP_FSCAN_DONE &&
1820 	    fcp->isp_loopstate != LOOP_LSCAN_DONE) {
1821 		return (-1);
1822 	}
1823 
1824 	if (fcp->isp_topo == TOPO_FL_PORT || fcp->isp_topo == TOPO_NL_PORT ||
1825 	    fcp->isp_topo == TOPO_N_PORT) {
1826 		if (fcp->isp_loopstate < LOOP_LSCAN_DONE) {
1827 			if (isp_scan_loop(isp) != 0) {
1828 				return (-1);
1829 			}
1830 		}
1831 	}
1832 	fcp->isp_loopstate = LOOP_SYNCING_PDB;
1833 
1834 	/*
1835 	 * If we get this far, we've settled our differences with the f/w
1836 	 * (for local loop device) and we can say that the loop state is ready.
1837 	 */
1838 
1839 	if (fcp->isp_topo == TOPO_NL_PORT) {
1840 		fcp->loop_seen_once = 1;
1841 		fcp->isp_loopstate = LOOP_READY;
1842 		return (0);
1843 	}
1844 
1845 	/*
1846 	 * Find all Fabric Entities that didn't make it from one scan to the
1847 	 * next and let the world know they went away. Scan the whole database.
1848 	 */
1849 	for (lp = &fcp->portdb[0]; lp < &fcp->portdb[MAX_FC_TARG]; lp++) {
1850 		if (lp->was_fabric_dev && lp->fabric_dev == 0) {
1851 			loopid = lp - fcp->portdb;
1852 			lp->valid = 0;	/* should already be set */
1853 			(void) isp_async(isp, ISPASYNC_PROMENADE, &loopid);
1854 			MEMZERO((void *) lp, sizeof (*lp));
1855 			continue;
1856 		}
1857 		lp->was_fabric_dev = lp->fabric_dev;
1858 	}
1859 
1860 	if (fcp->isp_topo == TOPO_FL_PORT)
1861 		base = FC_SNS_ID+1;
1862 	else
1863 		base = 0;
1864 
1865 	if (fcp->isp_topo == TOPO_N_PORT)
1866 		lim = 1;
1867 	else
1868 		lim = MAX_FC_TARG;
1869 
1870 	/*
1871 	 * Now log in any fabric devices that the outer layer has
1872 	 * left for us to see. This seems the most sane policy
1873 	 * for the moment.
1874 	 */
1875 	for (lp = &fcp->portdb[base]; lp < &fcp->portdb[lim]; lp++) {
1876 		u_int32_t portid;
1877 		mbreg_t mbs;
1878 
1879 		loopid = lp - fcp->portdb;
1880 		if (loopid >= FL_PORT_ID && loopid <= FC_SNS_ID) {
1881 			continue;
1882 		}
1883 
1884 		/*
1885 		 * Anything here?
1886 		 */
1887 		if (lp->port_wwn == 0) {
1888 			continue;
1889 		}
1890 
1891 		/*
1892 		 * Don't try to log into yourself.
1893 		 */
1894 		if ((portid = lp->portid) == fcp->isp_portid) {
1895 			continue;
1896 		}
1897 
1898 
1899 		/*
1900 		 * If we'd been logged in- see if we still are and we haven't
1901 		 * changed. If so, no need to log ourselves out, etc..
1902 		 *
1903 		 * Unfortunately, our charming Qlogic f/w has decided to
1904 		 * return a valid port database entry for a fabric device
1905 		 * that has, in fact, gone away. And it hangs trying to
1906 		 * log it out.
1907 		 */
1908 		if (lp->loggedin && lp->force_logout == 0 &&
1909 		    isp_getpdb(isp, lp->loopid, &pdb) == 0) {
1910 			int nrole;
1911 			u_int64_t nwwnn, nwwpn;
1912 			nwwnn =
1913 			    (((u_int64_t)pdb.pdb_nodename[0]) << 56) |
1914 			    (((u_int64_t)pdb.pdb_nodename[1]) << 48) |
1915 			    (((u_int64_t)pdb.pdb_nodename[2]) << 40) |
1916 			    (((u_int64_t)pdb.pdb_nodename[3]) << 32) |
1917 			    (((u_int64_t)pdb.pdb_nodename[4]) << 24) |
1918 			    (((u_int64_t)pdb.pdb_nodename[5]) << 16) |
1919 			    (((u_int64_t)pdb.pdb_nodename[6]) <<  8) |
1920 			    (((u_int64_t)pdb.pdb_nodename[7]));
1921 			nwwpn =
1922 			    (((u_int64_t)pdb.pdb_portname[0]) << 56) |
1923 			    (((u_int64_t)pdb.pdb_portname[1]) << 48) |
1924 			    (((u_int64_t)pdb.pdb_portname[2]) << 40) |
1925 			    (((u_int64_t)pdb.pdb_portname[3]) << 32) |
1926 			    (((u_int64_t)pdb.pdb_portname[4]) << 24) |
1927 			    (((u_int64_t)pdb.pdb_portname[5]) << 16) |
1928 			    (((u_int64_t)pdb.pdb_portname[6]) <<  8) |
1929 			    (((u_int64_t)pdb.pdb_portname[7]));
1930 			nrole = (pdb.pdb_prli_svc3 & SVC3_ROLE_MASK) >>
1931 			    SVC3_ROLE_SHIFT;
1932 			if (pdb.pdb_loopid == lp->loopid && lp->portid ==
1933 			    (u_int32_t) BITS2WORD(pdb.pdb_portid_bits) &&
1934 			    nwwnn == lp->node_wwn && nwwpn == lp->port_wwn &&
1935 			    lp->roles == nrole && lp->force_logout == 0) {
1936 				lp->loggedin = lp->valid = 1;
1937 				isp_prt(isp, ISP_LOGCONFIG, lretained,
1938 				    (int) (lp - fcp->portdb),
1939 				    (int) lp->loopid, lp->portid);
1940 				continue;
1941 			}
1942 		}
1943 
1944 		if (fcp->isp_fwstate != FW_READY ||
1945 		    fcp->isp_loopstate != LOOP_SYNCING_PDB) {
1946 			return (-1);
1947 		}
1948 
1949 		/*
1950 		 * Force a logout if we were logged in.
1951 		 */
1952 		if (lp->loggedin) {
1953 			if (lp->force_logout ||
1954 			    isp_getpdb(isp, lp->loopid, &pdb) == 0) {
1955 				mbs.param[0] = MBOX_FABRIC_LOGOUT;
1956 				mbs.param[1] = lp->loopid << 8;
1957 				mbs.param[2] = 0;
1958 				mbs.param[3] = 0;
1959 				isp_mboxcmd(isp, &mbs, MBLOGNONE);
1960 				isp_prt(isp, ISP_LOGINFO, plogout,
1961 				    (int) (lp - fcp->portdb), lp->loopid,
1962 				    lp->portid);
1963 			}
1964 			lp->force_logout = lp->loggedin = 0;
1965 			if (fcp->isp_fwstate != FW_READY ||
1966 			    fcp->isp_loopstate != LOOP_SYNCING_PDB) {
1967 				return (-1);
1968 			}
1969 		}
1970 
1971 		/*
1972 		 * And log in....
1973 		 */
1974 		loopid = lp - fcp->portdb;
1975 		lp->loopid = FL_PORT_ID;
1976 		do {
1977 			mbs.param[0] = MBOX_FABRIC_LOGIN;
1978 			mbs.param[1] = loopid << 8;
1979 			mbs.param[2] = portid >> 16;
1980 			mbs.param[3] = portid & 0xffff;
1981 			isp_mboxcmd(isp, &mbs, MBLOGALL & ~(MBOX_LOOP_ID_USED |
1982 			    MBOX_PORT_ID_USED | MBOX_COMMAND_ERROR));
1983 			if (fcp->isp_fwstate != FW_READY ||
1984 			    fcp->isp_loopstate != LOOP_SYNCING_PDB) {
1985 				return (-1);
1986 			}
1987 			switch (mbs.param[0]) {
1988 			case MBOX_LOOP_ID_USED:
1989 				/*
1990 				 * Try the next available loop id.
1991 				 */
1992 				loopid++;
1993 				break;
1994 			case MBOX_PORT_ID_USED:
1995 				/*
1996 				 * This port is already logged in.
1997 				 * Snaffle the loop id it's using if it's
1998 				 * nonzero, otherwise we're hosed.
1999 				 */
2000 				if (mbs.param[1] != 0) {
2001 					loopid = mbs.param[1];
2002 					isp_prt(isp, ISP_LOGINFO, retained,
2003 					    loopid, (int) (lp - fcp->portdb),
2004 					    lp->portid);
2005 				} else {
2006 					loopid = MAX_FC_TARG;
2007 					break;
2008 				}
2009 				/* FALLTHROUGH */
2010 			case MBOX_COMMAND_COMPLETE:
2011 				lp->loggedin = 1;
2012 				lp->loopid = loopid;
2013 				break;
2014 			case MBOX_COMMAND_ERROR:
2015 				isp_prt(isp, ISP_LOGINFO, plogierr,
2016 				    portid, mbs.param[1]);
2017 				/* FALLTHROUGH */
2018 			case MBOX_ALL_IDS_USED: /* We're outta IDs */
2019 			default:
2020 				loopid = MAX_FC_TARG;
2021 				break;
2022 			}
2023 		} while (lp->loopid == FL_PORT_ID && loopid < MAX_FC_TARG);
2024 
2025 		/*
2026 		 * If we get here and we haven't set a Loop ID,
2027 		 * we failed to log into this device.
2028 		 */
2029 
2030 		if (lp->loopid == FL_PORT_ID) {
2031 			lp->loopid = 0;
2032 			continue;
2033 		}
2034 
2035 		/*
2036 		 * Make sure we can get the approriate port information.
2037 		 */
2038 		if (isp_getpdb(isp, lp->loopid, &pdb) != 0) {
2039 			isp_prt(isp, ISP_LOGWARN, nopdb, lp->portid);
2040 			goto dump_em;
2041 		}
2042 
2043 		if (fcp->isp_fwstate != FW_READY ||
2044 		    fcp->isp_loopstate != LOOP_SYNCING_PDB) {
2045 			return (-1);
2046 		}
2047 
2048 		if (pdb.pdb_loopid != lp->loopid) {
2049 			isp_prt(isp, ISP_LOGWARN, pdbmfail1,
2050 			    lp->portid, pdb.pdb_loopid);
2051 			goto dump_em;
2052 		}
2053 
2054 		if (lp->portid != (u_int32_t) BITS2WORD(pdb.pdb_portid_bits)) {
2055 			isp_prt(isp, ISP_LOGWARN, pdbmfail2,
2056 			    lp->portid, BITS2WORD(pdb.pdb_portid_bits));
2057 			goto dump_em;
2058 		}
2059 
2060 		lp->roles =
2061 		    (pdb.pdb_prli_svc3 & SVC3_ROLE_MASK) >> SVC3_ROLE_SHIFT;
2062 		lp->node_wwn =
2063 		    (((u_int64_t)pdb.pdb_nodename[0]) << 56) |
2064 		    (((u_int64_t)pdb.pdb_nodename[1]) << 48) |
2065 		    (((u_int64_t)pdb.pdb_nodename[2]) << 40) |
2066 		    (((u_int64_t)pdb.pdb_nodename[3]) << 32) |
2067 		    (((u_int64_t)pdb.pdb_nodename[4]) << 24) |
2068 		    (((u_int64_t)pdb.pdb_nodename[5]) << 16) |
2069 		    (((u_int64_t)pdb.pdb_nodename[6]) <<  8) |
2070 		    (((u_int64_t)pdb.pdb_nodename[7]));
2071 		lp->port_wwn =
2072 		    (((u_int64_t)pdb.pdb_portname[0]) << 56) |
2073 		    (((u_int64_t)pdb.pdb_portname[1]) << 48) |
2074 		    (((u_int64_t)pdb.pdb_portname[2]) << 40) |
2075 		    (((u_int64_t)pdb.pdb_portname[3]) << 32) |
2076 		    (((u_int64_t)pdb.pdb_portname[4]) << 24) |
2077 		    (((u_int64_t)pdb.pdb_portname[5]) << 16) |
2078 		    (((u_int64_t)pdb.pdb_portname[6]) <<  8) |
2079 		    (((u_int64_t)pdb.pdb_portname[7]));
2080 		/*
2081 		 * Check to make sure this all makes sense.
2082 		 */
2083 		if (lp->node_wwn && lp->port_wwn) {
2084 			lp->valid = 1;
2085 			loopid = lp - fcp->portdb;
2086 			(void) isp_async(isp, ISPASYNC_PROMENADE, &loopid);
2087 			continue;
2088 		}
2089 dump_em:
2090 		lp->valid = 0;
2091 		isp_prt(isp, ISP_LOGINFO,
2092 		    ldumped, loopid, lp->loopid, lp->portid);
2093 		mbs.param[0] = MBOX_FABRIC_LOGOUT;
2094 		mbs.param[1] = lp->loopid << 8;
2095 		mbs.param[2] = 0;
2096 		mbs.param[3] = 0;
2097 		isp_mboxcmd(isp, &mbs, MBLOGNONE);
2098 		if (fcp->isp_fwstate != FW_READY ||
2099 		    fcp->isp_loopstate != LOOP_SYNCING_PDB) {
2100 			return (-1);
2101 		}
2102 	}
2103 	/*
2104 	 * If we get here, we've for sure seen not only a valid loop
2105 	 * but know what is or isn't on it, so mark this for usage
2106 	 * in isp_start.
2107 	 */
2108 	fcp->loop_seen_once = 1;
2109 	fcp->isp_loopstate = LOOP_READY;
2110 	return (0);
2111 }
2112 
2113 static int
2114 isp_scan_loop(struct ispsoftc *isp)
2115 {
2116 	struct lportdb *lp;
2117 	fcparam *fcp = isp->isp_param;
2118 	isp_pdb_t pdb;
2119 	int loopid, lim, hival;
2120 
2121 	switch (fcp->isp_topo) {
2122 	case TOPO_NL_PORT:
2123 		hival = FL_PORT_ID;
2124 		break;
2125 	case TOPO_N_PORT:
2126 		hival = 2;
2127 		break;
2128 	case TOPO_FL_PORT:
2129 		hival = FC_PORT_ID;
2130 		break;
2131 	default:
2132 		fcp->isp_loopstate = LOOP_LSCAN_DONE;
2133 		return (0);
2134 	}
2135 	fcp->isp_loopstate = LOOP_SCANNING_LOOP;
2136 
2137 	/*
2138 	 * make sure the temp port database is clean...
2139 	 */
2140 	MEMZERO((void *)fcp->tport, sizeof (fcp->tport));
2141 
2142 	/*
2143 	 * Run through the local loop ports and get port database info
2144 	 * for each loop ID.
2145 	 *
2146 	 * There's a somewhat unexplained situation where the f/w passes back
2147 	 * the wrong database entity- if that happens, just restart (up to
2148 	 * FL_PORT_ID times).
2149 	 */
2150 	for (lim = loopid = 0; loopid < hival; loopid++) {
2151 		lp = &fcp->tport[loopid];
2152 
2153 		/*
2154 		 * Don't even try for ourselves...
2155 	 	 */
2156 		if (loopid == fcp->isp_loopid)
2157 			continue;
2158 
2159 		lp->node_wwn = isp_get_portname(isp, loopid, 1);
2160 		if (fcp->isp_loopstate < LOOP_SCANNING_LOOP)
2161 			return (-1);
2162 		if (lp->node_wwn == 0)
2163 			continue;
2164 		lp->port_wwn = isp_get_portname(isp, loopid, 0);
2165 		if (fcp->isp_loopstate < LOOP_SCANNING_LOOP)
2166 			return (-1);
2167 		if (lp->port_wwn == 0) {
2168 			lp->node_wwn = 0;
2169 			continue;
2170 		}
2171 
2172 		/*
2173 		 * Get an entry....
2174 		 */
2175 		if (isp_getpdb(isp, loopid, &pdb) != 0) {
2176 			if (fcp->isp_loopstate < LOOP_SCANNING_LOOP)
2177 				return (-1);
2178 			continue;
2179 		}
2180 		if (fcp->isp_loopstate < LOOP_SCANNING_LOOP) {
2181 			return (-1);
2182 		}
2183 
2184 		/*
2185 		 * If the returned database element doesn't match what we
2186 		 * asked for, restart the process entirely (up to a point...).
2187 		 */
2188 		if (pdb.pdb_loopid != loopid) {
2189 			loopid = 0;
2190 			if (lim++ < hival) {
2191 				continue;
2192 			}
2193 			isp_prt(isp, ISP_LOGWARN,
2194 			    "giving up on synchronizing the port database");
2195 			return (-1);
2196 		}
2197 
2198 		/*
2199 		 * Save the pertinent info locally.
2200 		 */
2201 		lp->node_wwn =
2202 		    (((u_int64_t)pdb.pdb_nodename[0]) << 56) |
2203 		    (((u_int64_t)pdb.pdb_nodename[1]) << 48) |
2204 		    (((u_int64_t)pdb.pdb_nodename[2]) << 40) |
2205 		    (((u_int64_t)pdb.pdb_nodename[3]) << 32) |
2206 		    (((u_int64_t)pdb.pdb_nodename[4]) << 24) |
2207 		    (((u_int64_t)pdb.pdb_nodename[5]) << 16) |
2208 		    (((u_int64_t)pdb.pdb_nodename[6]) <<  8) |
2209 		    (((u_int64_t)pdb.pdb_nodename[7]));
2210 		lp->port_wwn =
2211 		    (((u_int64_t)pdb.pdb_portname[0]) << 56) |
2212 		    (((u_int64_t)pdb.pdb_portname[1]) << 48) |
2213 		    (((u_int64_t)pdb.pdb_portname[2]) << 40) |
2214 		    (((u_int64_t)pdb.pdb_portname[3]) << 32) |
2215 		    (((u_int64_t)pdb.pdb_portname[4]) << 24) |
2216 		    (((u_int64_t)pdb.pdb_portname[5]) << 16) |
2217 		    (((u_int64_t)pdb.pdb_portname[6]) <<  8) |
2218 		    (((u_int64_t)pdb.pdb_portname[7]));
2219 		lp->roles =
2220 		    (pdb.pdb_prli_svc3 & SVC3_ROLE_MASK) >> SVC3_ROLE_SHIFT;
2221 		lp->portid = BITS2WORD(pdb.pdb_portid_bits);
2222 		lp->loopid = pdb.pdb_loopid;
2223 	}
2224 
2225 	/*
2226 	 * Mark all of the permanent local loop database entries as invalid
2227 	 * (except our own entry).
2228 	 */
2229 	for (loopid = 0; loopid < hival; loopid++) {
2230 		if (loopid == fcp->isp_iid) {
2231 			fcp->portdb[loopid].valid = 1;
2232 			fcp->portdb[loopid].loopid = fcp->isp_loopid;
2233 			continue;
2234 		}
2235 		fcp->portdb[loopid].valid = 0;
2236 	}
2237 
2238 	/*
2239 	 * Now merge our local copy of the port database into our saved copy.
2240 	 * Notify the outer layers of new devices arriving.
2241 	 */
2242 	for (loopid = 0; loopid < hival; loopid++) {
2243 		int i;
2244 
2245 		/*
2246 		 * If we don't have a non-zero Port WWN, we're not here.
2247 		 */
2248 		if (fcp->tport[loopid].port_wwn == 0) {
2249 			continue;
2250 		}
2251 
2252 		/*
2253 		 * Skip ourselves.
2254 		 */
2255 		if (loopid == fcp->isp_iid) {
2256 			continue;
2257 		}
2258 
2259 		/*
2260 		 * For the purposes of deciding whether this is the
2261 		 * 'same' device or not, we only search for an identical
2262 		 * Port WWN. Node WWNs may or may not be the same as
2263 		 * the Port WWN, and there may be multiple different
2264 		 * Port WWNs with the same Node WWN. It would be chaos
2265 		 * to have multiple identical Port WWNs, so we don't
2266 		 * allow that.
2267 		 */
2268 
2269 		for (i = 0; i < hival; i++) {
2270 			int j;
2271 			if (fcp->portdb[i].port_wwn == 0)
2272 				continue;
2273 			if (fcp->portdb[i].port_wwn !=
2274 			    fcp->tport[loopid].port_wwn)
2275 				continue;
2276 			/*
2277 			 * We found this WWN elsewhere- it's changed
2278 			 * loopids then. We don't change it's actual
2279 			 * position in our cached port database- we
2280 			 * just change the actual loop ID we'd use.
2281 			 */
2282 			if (fcp->portdb[i].loopid != loopid) {
2283 				isp_prt(isp, ISP_LOGINFO, portshift, i,
2284 				    fcp->portdb[i].loopid,
2285 				    fcp->portdb[i].portid, loopid,
2286 				    fcp->tport[loopid].portid);
2287 			}
2288 			fcp->portdb[i].portid = fcp->tport[loopid].portid;
2289 			fcp->portdb[i].loopid = loopid;
2290 			fcp->portdb[i].valid = 1;
2291 			fcp->portdb[i].roles = fcp->tport[loopid].roles;
2292 
2293 			/*
2294 			 * Now make sure this Port WWN doesn't exist elsewhere
2295 			 * in the port database.
2296 			 */
2297 			for (j = i+1; j < hival; j++) {
2298 				if (fcp->portdb[i].port_wwn !=
2299 				    fcp->portdb[j].port_wwn) {
2300 					continue;
2301 				}
2302 				isp_prt(isp, ISP_LOGWARN, portdup, j, i);
2303 				/*
2304 				 * Invalidate the 'old' *and* 'new' ones.
2305 				 * This is really harsh and not quite right,
2306 				 * but if this happens, we really don't know
2307 				 * who is what at this point.
2308 				 */
2309 				fcp->portdb[i].valid = 0;
2310 				fcp->portdb[j].valid = 0;
2311 			}
2312 			break;
2313 		}
2314 
2315 		/*
2316 		 * If we didn't traverse the entire port database,
2317 		 * then we found (and remapped) an existing entry.
2318 		 * No need to notify anyone- go for the next one.
2319 		 */
2320 		if (i < hival) {
2321 			isp_prt(isp, ISP_LOGINFO, retained,
2322 			    fcp->portdb[i].loopid, i, fcp->portdb[i].portid);
2323 			continue;
2324 		}
2325 
2326 		/*
2327 		 * We've not found this Port WWN anywhere. It's a new entry.
2328 		 * See if we can leave it where it is (with target == loopid).
2329 		 */
2330 		if (fcp->portdb[loopid].port_wwn != 0) {
2331 			for (lim = 0; lim < hival; lim++) {
2332 				if (fcp->portdb[lim].port_wwn == 0)
2333 					break;
2334 			}
2335 			/* "Cannot Happen" */
2336 			if (lim == hival) {
2337 				isp_prt(isp, ISP_LOGWARN, "Remap Overflow");
2338 				continue;
2339 			}
2340 			i = lim;
2341 		} else {
2342 			i = loopid;
2343 		}
2344 
2345 		/*
2346 		 * NB:	The actual loopid we use here is loopid- we may
2347 		 *	in fact be at a completely different index (target).
2348 		 */
2349 		fcp->portdb[i].loopid = loopid;
2350 		fcp->portdb[i].port_wwn = fcp->tport[loopid].port_wwn;
2351 		fcp->portdb[i].node_wwn = fcp->tport[loopid].node_wwn;
2352 		fcp->portdb[i].roles = fcp->tport[loopid].roles;
2353 		fcp->portdb[i].portid = fcp->tport[loopid].portid;
2354 		fcp->portdb[i].valid = 1;
2355 
2356 		/*
2357 		 * Tell the outside world we've arrived.
2358 		 */
2359 		(void) isp_async(isp, ISPASYNC_PROMENADE, &i);
2360 	}
2361 
2362 	/*
2363 	 * Now find all previously used targets that are now invalid and
2364 	 * notify the outer layers that they're gone.
2365 	 */
2366 	for (lp = &fcp->portdb[0]; lp < &fcp->portdb[hival]; lp++) {
2367 		if (lp->valid || lp->port_wwn == 0) {
2368 			continue;
2369 		}
2370 
2371 		/*
2372 		 * Tell the outside world we've gone
2373 		 * away and erase our pdb entry.
2374 		 *
2375 		 */
2376 		loopid = lp - fcp->portdb;
2377 		(void) isp_async(isp, ISPASYNC_PROMENADE, &loopid);
2378 		MEMZERO((void *) lp, sizeof (*lp));
2379 	}
2380 	fcp->isp_loopstate = LOOP_LSCAN_DONE;
2381 	return (0);
2382 }
2383 
2384 
2385 static int
2386 isp_fabric_mbox_cmd(struct ispsoftc *isp, mbreg_t *mbp)
2387 {
2388 	isp_mboxcmd(isp, mbp, MBLOGNONE);
2389 	if (mbp->param[0] != MBOX_COMMAND_COMPLETE) {
2390 		if (FCPARAM(isp)->isp_loopstate == LOOP_SCANNING_FABRIC) {
2391 			FCPARAM(isp)->isp_loopstate = LOOP_PDB_RCVD;
2392 		}
2393 		if (mbp->param[0] == MBOX_COMMAND_ERROR) {
2394 			char tbuf[16];
2395 			char *m;
2396 			switch (mbp->param[1]) {
2397 			case 1:
2398 				m = "No Loop";
2399 				break;
2400 			case 2:
2401 				m = "Failed to allocate IOCB buffer";
2402 				break;
2403 			case 3:
2404 				m = "Failed to allocate XCB buffer";
2405 				break;
2406 			case 4:
2407 				m = "timeout or transmit failed";
2408 				break;
2409 			case 5:
2410 				m = "no fabric loop";
2411 				break;
2412 			case 6:
2413 				m = "remote device not a target";
2414 				break;
2415 			default:
2416 				SNPRINTF(tbuf, sizeof tbuf, "%x",
2417 				    mbp->param[1]);
2418 				m = tbuf;
2419 				break;
2420 			}
2421 			isp_prt(isp, ISP_LOGERR, "SNS Failed- %s", m);
2422 		}
2423 		return (-1);
2424 	}
2425 
2426 	if (FCPARAM(isp)->isp_fwstate != FW_READY ||
2427 	    FCPARAM(isp)->isp_loopstate < LOOP_SCANNING_FABRIC) {
2428 		return (-1);
2429 	}
2430 	return(0);
2431 }
2432 
2433 #ifdef	ISP_USE_GA_NXT
2434 static int
2435 isp_scan_fabric(struct ispsoftc *isp, int ftype)
2436 {
2437 	fcparam *fcp = isp->isp_param;
2438 	u_int32_t portid, first_portid, last_portid;
2439 	int hicap, last_port_same;
2440 
2441 	if (fcp->isp_onfabric == 0) {
2442 		fcp->isp_loopstate = LOOP_FSCAN_DONE;
2443 		return (0);
2444 	}
2445 
2446 	FC_SCRATCH_ACQUIRE(isp);
2447 
2448 	/*
2449 	 * Since Port IDs are 24 bits, we can check against having seen
2450 	 * anything yet with this value.
2451 	 */
2452 	last_port_same = 0;
2453 	last_portid = 0xffffffff;	/* not a port */
2454 	first_portid = portid = fcp->isp_portid;
2455 	fcp->isp_loopstate = LOOP_SCANNING_FABRIC;
2456 
2457 	for (hicap = 0; hicap < GA_NXT_MAX; hicap++) {
2458 		mbreg_t mbs;
2459 		sns_screq_t *rq;
2460 		sns_ga_nxt_rsp_t *rs0, *rs1;
2461 		struct lportdb lcl;
2462 		u_int8_t sc[SNS_GA_NXT_RESP_SIZE];
2463 
2464 		rq = (sns_screq_t *)sc;
2465 		MEMZERO((void *) rq, SNS_GA_NXT_REQ_SIZE);
2466 		rq->snscb_rblen = SNS_GA_NXT_RESP_SIZE >> 1;
2467 		rq->snscb_addr[RQRSP_ADDR0015] = DMA_WD0(fcp->isp_scdma+0x100);
2468 		rq->snscb_addr[RQRSP_ADDR1631] = DMA_WD1(fcp->isp_scdma+0x100);
2469 		rq->snscb_addr[RQRSP_ADDR3247] = DMA_WD2(fcp->isp_scdma+0x100);
2470 		rq->snscb_addr[RQRSP_ADDR4863] = DMA_WD3(fcp->isp_scdma+0x100);
2471 		rq->snscb_sblen = 6;
2472 		rq->snscb_data[0] = SNS_GA_NXT;
2473 		rq->snscb_data[4] = portid & 0xffff;
2474 		rq->snscb_data[5] = (portid >> 16) & 0xff;
2475 		isp_put_sns_request(isp, rq, (sns_screq_t *) fcp->isp_scratch);
2476 		MEMORYBARRIER(isp, SYNC_SFORDEV, 0, SNS_GA_NXT_REQ_SIZE);
2477 		mbs.param[0] = MBOX_SEND_SNS;
2478 		mbs.param[1] = SNS_GA_NXT_REQ_SIZE >> 1;
2479 		mbs.param[2] = DMA_WD1(fcp->isp_scdma);
2480 		mbs.param[3] = DMA_WD0(fcp->isp_scdma);
2481 		/*
2482 		 * Leave 4 and 5 alone
2483 		 */
2484 		mbs.param[6] = DMA_WD3(fcp->isp_scdma);
2485 		mbs.param[7] = DMA_WD2(fcp->isp_scdma);
2486 		if (isp_fabric_mbox_cmd(isp, &mbs)) {
2487 			if (fcp->isp_loopstate >= LOOP_SCANNING_FABRIC) {
2488 				fcp->isp_loopstate = LOOP_PDB_RCVD;
2489 			}
2490 			FC_SCRATCH_RELEASE(isp);
2491 			return (-1);
2492 		}
2493 		MEMORYBARRIER(isp, SYNC_SFORCPU, 0x100, SNS_GA_NXT_RESP_SIZE);
2494 		rs1 = (sns_ga_nxt_rsp_t *) sc;
2495 		rs0 = (sns_ga_nxt_rsp_t *) ((u_int8_t *)fcp->isp_scratch+0x100);
2496 		isp_get_ga_nxt_response(isp, rs0, rs1);
2497 		if (rs1->snscb_cthdr.ct_response != FS_ACC) {
2498 			int level;
2499 			if (rs1->snscb_cthdr.ct_reason == 9 &&
2500 			    rs1->snscb_cthdr.ct_explanation == 7)
2501 				level = ISP_LOGDEBUG0;
2502 			else
2503 				level = ISP_LOGWARN;
2504 			isp_prt(isp, level, swrej, "GA_NXT",
2505 			    rs1->snscb_cthdr.ct_reason,
2506 			    rs1->snscb_cthdr.ct_explanation, portid);
2507 			FC_SCRATCH_RELEASE(isp);
2508 			fcp->isp_loopstate = LOOP_FSCAN_DONE;
2509 			return (0);
2510 		}
2511 		portid =
2512 		    (((u_int32_t) rs1->snscb_port_id[0]) << 16) |
2513 		    (((u_int32_t) rs1->snscb_port_id[1]) << 8) |
2514 		    (((u_int32_t) rs1->snscb_port_id[2]));
2515 
2516 		/*
2517 		 * XXX: We should check to make sure that this entry
2518 		 * XXX: supports the type(s) we are interested in.
2519 		 */
2520 		/*
2521 		 * Okay, we now have information about a fabric object.
2522 		 * If it is the type we're interested in, tell the outer layers
2523 		 * about it. The outer layer needs to  know: Port ID, WWNN,
2524 		 * WWPN, FC4 type, and port type.
2525 		 *
2526 		 * The lportdb structure is adequate for this.
2527 		 */
2528 		MEMZERO(&lcl, sizeof (lcl));
2529 		lcl.port_type = rs1->snscb_port_type;
2530 		lcl.fc4_type = ftype;
2531 		lcl.portid = portid;
2532 		lcl.node_wwn =
2533 		    (((u_int64_t)rs1->snscb_nodename[0]) << 56) |
2534 		    (((u_int64_t)rs1->snscb_nodename[1]) << 48) |
2535 		    (((u_int64_t)rs1->snscb_nodename[2]) << 40) |
2536 		    (((u_int64_t)rs1->snscb_nodename[3]) << 32) |
2537 		    (((u_int64_t)rs1->snscb_nodename[4]) << 24) |
2538 		    (((u_int64_t)rs1->snscb_nodename[5]) << 16) |
2539 		    (((u_int64_t)rs1->snscb_nodename[6]) <<  8) |
2540 		    (((u_int64_t)rs1->snscb_nodename[7]));
2541 		lcl.port_wwn =
2542 		    (((u_int64_t)rs1->snscb_portname[0]) << 56) |
2543 		    (((u_int64_t)rs1->snscb_portname[1]) << 48) |
2544 		    (((u_int64_t)rs1->snscb_portname[2]) << 40) |
2545 		    (((u_int64_t)rs1->snscb_portname[3]) << 32) |
2546 		    (((u_int64_t)rs1->snscb_portname[4]) << 24) |
2547 		    (((u_int64_t)rs1->snscb_portname[5]) << 16) |
2548 		    (((u_int64_t)rs1->snscb_portname[6]) <<  8) |
2549 		    (((u_int64_t)rs1->snscb_portname[7]));
2550 
2551 		/*
2552 		 * Does this fabric object support the type we want?
2553 		 * If not, skip it.
2554 		 */
2555 		if (rs1->snscb_fc4_types[ftype >> 5] & (1 << (ftype & 0x1f))) {
2556 			if (first_portid == portid) {
2557 				lcl.last_fabric_dev = 1;
2558 			} else {
2559 				lcl.last_fabric_dev = 0;
2560 			}
2561 			(void) isp_async(isp, ISPASYNC_FABRIC_DEV, &lcl);
2562 		} else {
2563 			isp_prt(isp, ISP_LOGDEBUG0,
2564 			    "PortID 0x%x doesn't support FC4 type 0x%x",
2565 			    portid, ftype);
2566 		}
2567 		if (first_portid == portid) {
2568 			fcp->isp_loopstate = LOOP_FSCAN_DONE;
2569 			FC_SCRATCH_RELEASE(isp);
2570 			return (0);
2571 		}
2572 		if (portid == last_portid) {
2573 			if (last_port_same++ > 20) {
2574 				isp_prt(isp, ISP_LOGWARN,
2575 				    "tangled fabric database detected");
2576 				break;
2577 			}
2578 		} else {
2579 			last_port_same = 0 ;
2580 			last_portid = portid;
2581 		}
2582 	}
2583 	FC_SCRATCH_RELEASE(isp);
2584 	if (hicap >= GA_NXT_MAX) {
2585 		isp_prt(isp, ISP_LOGWARN, "fabric too big (> %d)", GA_NXT_MAX);
2586 	}
2587 	fcp->isp_loopstate = LOOP_FSCAN_DONE;
2588 	return (0);
2589 }
2590 #else
2591 #define	GIDLEN	((ISP2100_SCRLEN >> 1) + 16)
2592 #define	NGENT	((GIDLEN - 16) >> 2)
2593 
2594 #define	IGPOFF	(ISP2100_SCRLEN - GIDLEN)
2595 #define	GXOFF	(256)
2596 
2597 static int
2598 isp_scan_fabric(struct ispsoftc *isp, int ftype)
2599 {
2600 	fcparam *fcp = FCPARAM(isp);
2601 	mbreg_t mbs;
2602 	int i;
2603 	sns_gid_ft_req_t *rq;
2604 	sns_gid_ft_rsp_t *rs0, *rs1;
2605 
2606 	if (fcp->isp_onfabric == 0) {
2607 		fcp->isp_loopstate = LOOP_FSCAN_DONE;
2608 		return (0);
2609 	}
2610 
2611 	FC_SCRATCH_ACQUIRE(isp);
2612 	fcp->isp_loopstate = LOOP_SCANNING_FABRIC;
2613 
2614 	rq = (sns_gid_ft_req_t *)fcp->tport;
2615 	MEMZERO((void *) rq, SNS_GID_FT_REQ_SIZE);
2616 	rq->snscb_rblen = GIDLEN >> 1;
2617 	rq->snscb_addr[RQRSP_ADDR0015] = DMA_WD0(fcp->isp_scdma+IGPOFF);
2618 	rq->snscb_addr[RQRSP_ADDR1631] = DMA_WD1(fcp->isp_scdma+IGPOFF);
2619 	rq->snscb_addr[RQRSP_ADDR3247] = DMA_WD2(fcp->isp_scdma+IGPOFF);
2620 	rq->snscb_addr[RQRSP_ADDR4863] = DMA_WD3(fcp->isp_scdma+IGPOFF);
2621 	rq->snscb_sblen = 6;
2622 	rq->snscb_cmd = SNS_GID_FT;
2623 	rq->snscb_mword_div_2 = NGENT;
2624 	rq->snscb_fc4_type = ftype;
2625 	isp_put_gid_ft_request(isp, rq, (sns_gid_ft_req_t *) fcp->isp_scratch);
2626 	MEMORYBARRIER(isp, SYNC_SFORDEV, 0, SNS_GID_FT_REQ_SIZE);
2627 	mbs.param[0] = MBOX_SEND_SNS;
2628 	mbs.param[1] = SNS_GID_FT_REQ_SIZE >> 1;
2629 	mbs.param[2] = DMA_WD1(fcp->isp_scdma);
2630 	mbs.param[3] = DMA_WD0(fcp->isp_scdma);
2631 
2632 	/*
2633 	 * Leave 4 and 5 alone
2634 	 */
2635 	mbs.param[6] = DMA_WD3(fcp->isp_scdma);
2636 	mbs.param[7] = DMA_WD2(fcp->isp_scdma);
2637 	if (isp_fabric_mbox_cmd(isp, &mbs)) {
2638 		if (fcp->isp_loopstate >= LOOP_SCANNING_FABRIC) {
2639 			fcp->isp_loopstate = LOOP_PDB_RCVD;
2640 		}
2641 		FC_SCRATCH_RELEASE(isp);
2642 		return (-1);
2643 	}
2644 	if (fcp->isp_loopstate != LOOP_SCANNING_FABRIC) {
2645 		FC_SCRATCH_RELEASE(isp);
2646 		return (-1);
2647 	}
2648 	MEMORYBARRIER(isp, SYNC_SFORCPU, IGPOFF, GIDLEN);
2649 	rs1 = (sns_gid_ft_rsp_t *) fcp->tport;
2650 	rs0 = (sns_gid_ft_rsp_t *) ((u_int8_t *)fcp->isp_scratch+IGPOFF);
2651 	isp_get_gid_ft_response(isp, rs0, rs1, NGENT);
2652 	if (rs1->snscb_cthdr.ct_response != FS_ACC) {
2653 		int level;
2654 		if (rs1->snscb_cthdr.ct_reason == 9 &&
2655 		    rs1->snscb_cthdr.ct_explanation == 7)
2656 			level = ISP_LOGDEBUG0;
2657 		else
2658 			level = ISP_LOGWARN;
2659 		isp_prt(isp, level, swrej, "GID_FT",
2660 		    rs1->snscb_cthdr.ct_reason,
2661 		    rs1->snscb_cthdr.ct_explanation, 0);
2662 		FC_SCRATCH_RELEASE(isp);
2663 		fcp->isp_loopstate = LOOP_FSCAN_DONE;
2664 		return (0);
2665 	}
2666 
2667 	/*
2668 	 * Okay, we now have a list of Port IDs for this class of device.
2669 	 * Go through the list and for each one get the WWPN/WWNN for it
2670 	 * and tell the outer layers about it. The outer layer needs to
2671 	 * know: Port ID, WWNN, WWPN, FC4 type, and (possibly) port type.
2672 	 *
2673 	 * The lportdb structure is adequate for this.
2674 	 */
2675 	i = -1;
2676 	do {
2677 		sns_gxn_id_req_t grqbuf, *gq = &grqbuf;
2678 		sns_gxn_id_rsp_t *gs0, grsbuf, *gs1 = &grsbuf;
2679 		struct lportdb lcl;
2680 #if	0
2681 		sns_gff_id_rsp_t *fs0, ffsbuf, *fs1 = &ffsbuf;
2682 #endif
2683 
2684 		i++;
2685 		MEMZERO(&lcl, sizeof (lcl));
2686 		lcl.fc4_type = ftype;
2687 		lcl.portid =
2688 		    (((u_int32_t) rs1->snscb_ports[i].portid[0]) << 16) |
2689 		    (((u_int32_t) rs1->snscb_ports[i].portid[1]) << 8) |
2690 		    (((u_int32_t) rs1->snscb_ports[i].portid[2]));
2691 
2692 		MEMZERO((void *) gq, sizeof (sns_gxn_id_req_t));
2693 		gq->snscb_rblen = SNS_GXN_ID_RESP_SIZE >> 1;
2694 		gq->snscb_addr[RQRSP_ADDR0015] = DMA_WD0(fcp->isp_scdma+GXOFF);
2695 		gq->snscb_addr[RQRSP_ADDR1631] = DMA_WD1(fcp->isp_scdma+GXOFF);
2696 		gq->snscb_addr[RQRSP_ADDR3247] = DMA_WD2(fcp->isp_scdma+GXOFF);
2697 		gq->snscb_addr[RQRSP_ADDR4863] = DMA_WD3(fcp->isp_scdma+GXOFF);
2698 		gq->snscb_sblen = 6;
2699 		gq->snscb_cmd = SNS_GPN_ID;
2700 		gq->snscb_portid = lcl.portid;
2701 		isp_put_gxn_id_request(isp, gq,
2702 		    (sns_gxn_id_req_t *) fcp->isp_scratch);
2703 		MEMORYBARRIER(isp, SYNC_SFORDEV, 0, SNS_GXN_ID_REQ_SIZE);
2704 		mbs.param[0] = MBOX_SEND_SNS;
2705 		mbs.param[1] = SNS_GXN_ID_REQ_SIZE >> 1;
2706 		mbs.param[2] = DMA_WD1(fcp->isp_scdma);
2707 		mbs.param[3] = DMA_WD0(fcp->isp_scdma);
2708 		/*
2709 		 * Leave 4 and 5 alone
2710 		 */
2711 		mbs.param[6] = DMA_WD3(fcp->isp_scdma);
2712 		mbs.param[7] = DMA_WD2(fcp->isp_scdma);
2713 		if (isp_fabric_mbox_cmd(isp, &mbs)) {
2714 			if (fcp->isp_loopstate >= LOOP_SCANNING_FABRIC) {
2715 				fcp->isp_loopstate = LOOP_PDB_RCVD;
2716 			}
2717 			FC_SCRATCH_RELEASE(isp);
2718 			return (-1);
2719 		}
2720 		if (fcp->isp_loopstate != LOOP_SCANNING_FABRIC) {
2721 			FC_SCRATCH_RELEASE(isp);
2722 			return (-1);
2723 		}
2724 		MEMORYBARRIER(isp, SYNC_SFORCPU, GXOFF, SNS_GXN_ID_RESP_SIZE);
2725 		gs0 = (sns_gxn_id_rsp_t *) ((u_int8_t *)fcp->isp_scratch+GXOFF);
2726 		isp_get_gxn_id_response(isp, gs0, gs1);
2727 		if (gs1->snscb_cthdr.ct_response != FS_ACC) {
2728 			isp_prt(isp, ISP_LOGWARN, swrej, "GPN_ID",
2729 			    gs1->snscb_cthdr.ct_reason,
2730 			    gs1->snscb_cthdr.ct_explanation, lcl.portid);
2731 			if (fcp->isp_loopstate != LOOP_SCANNING_FABRIC) {
2732 				FC_SCRATCH_RELEASE(isp);
2733 				return (-1);
2734 			}
2735 			continue;
2736 		}
2737 		lcl.port_wwn =
2738 		    (((u_int64_t)gs1->snscb_wwn[0]) << 56) |
2739 		    (((u_int64_t)gs1->snscb_wwn[1]) << 48) |
2740 		    (((u_int64_t)gs1->snscb_wwn[2]) << 40) |
2741 		    (((u_int64_t)gs1->snscb_wwn[3]) << 32) |
2742 		    (((u_int64_t)gs1->snscb_wwn[4]) << 24) |
2743 		    (((u_int64_t)gs1->snscb_wwn[5]) << 16) |
2744 		    (((u_int64_t)gs1->snscb_wwn[6]) <<  8) |
2745 		    (((u_int64_t)gs1->snscb_wwn[7]));
2746 
2747 		MEMZERO((void *) gq, sizeof (sns_gxn_id_req_t));
2748 		gq->snscb_rblen = SNS_GXN_ID_RESP_SIZE >> 1;
2749 		gq->snscb_addr[RQRSP_ADDR0015] = DMA_WD0(fcp->isp_scdma+GXOFF);
2750 		gq->snscb_addr[RQRSP_ADDR1631] = DMA_WD1(fcp->isp_scdma+GXOFF);
2751 		gq->snscb_addr[RQRSP_ADDR3247] = DMA_WD2(fcp->isp_scdma+GXOFF);
2752 		gq->snscb_addr[RQRSP_ADDR4863] = DMA_WD3(fcp->isp_scdma+GXOFF);
2753 		gq->snscb_sblen = 6;
2754 		gq->snscb_cmd = SNS_GNN_ID;
2755 		gq->snscb_portid = lcl.portid;
2756 		isp_put_gxn_id_request(isp, gq,
2757 		    (sns_gxn_id_req_t *) fcp->isp_scratch);
2758 		MEMORYBARRIER(isp, SYNC_SFORDEV, 0, SNS_GXN_ID_REQ_SIZE);
2759 		mbs.param[0] = MBOX_SEND_SNS;
2760 		mbs.param[1] = SNS_GXN_ID_REQ_SIZE >> 1;
2761 		mbs.param[2] = DMA_WD1(fcp->isp_scdma);
2762 		mbs.param[3] = DMA_WD0(fcp->isp_scdma);
2763 		/*
2764 		 * Leave 4 and 5 alone
2765 		 */
2766 		mbs.param[6] = DMA_WD3(fcp->isp_scdma);
2767 		mbs.param[7] = DMA_WD2(fcp->isp_scdma);
2768 		if (isp_fabric_mbox_cmd(isp, &mbs)) {
2769 			if (fcp->isp_loopstate >= LOOP_SCANNING_FABRIC) {
2770 				fcp->isp_loopstate = LOOP_PDB_RCVD;
2771 			}
2772 			FC_SCRATCH_RELEASE(isp);
2773 			return (-1);
2774 		}
2775 		if (fcp->isp_loopstate != LOOP_SCANNING_FABRIC) {
2776 			FC_SCRATCH_RELEASE(isp);
2777 			return (-1);
2778 		}
2779 		MEMORYBARRIER(isp, SYNC_SFORCPU, GXOFF, SNS_GXN_ID_RESP_SIZE);
2780 		gs0 = (sns_gxn_id_rsp_t *) ((u_int8_t *)fcp->isp_scratch+GXOFF);
2781 		isp_get_gxn_id_response(isp, gs0, gs1);
2782 		if (gs1->snscb_cthdr.ct_response != FS_ACC) {
2783 			isp_prt(isp, ISP_LOGWARN, swrej, "GNN_ID",
2784 			    gs1->snscb_cthdr.ct_reason,
2785 			    gs1->snscb_cthdr.ct_explanation, lcl.portid);
2786 			if (fcp->isp_loopstate != LOOP_SCANNING_FABRIC) {
2787 				FC_SCRATCH_RELEASE(isp);
2788 				return (-1);
2789 			}
2790 			continue;
2791 		}
2792 		lcl.node_wwn =
2793 		    (((u_int64_t)gs1->snscb_wwn[0]) << 56) |
2794 		    (((u_int64_t)gs1->snscb_wwn[1]) << 48) |
2795 		    (((u_int64_t)gs1->snscb_wwn[2]) << 40) |
2796 		    (((u_int64_t)gs1->snscb_wwn[3]) << 32) |
2797 		    (((u_int64_t)gs1->snscb_wwn[4]) << 24) |
2798 		    (((u_int64_t)gs1->snscb_wwn[5]) << 16) |
2799 		    (((u_int64_t)gs1->snscb_wwn[6]) <<  8) |
2800 		    (((u_int64_t)gs1->snscb_wwn[7]));
2801 
2802 		/*
2803 		 * The QLogic f/w is bouncing this with a parameter error.
2804 		 */
2805 #if	0
2806 		/*
2807 		 * Try and get FC4 Features (FC-GS-3 only).
2808 		 * We can use the sns_gxn_id_req_t for this request.
2809 		 */
2810 		MEMZERO((void *) gq, sizeof (sns_gxn_id_req_t));
2811 		gq->snscb_rblen = SNS_GFF_ID_RESP_SIZE >> 1;
2812 		gq->snscb_addr[RQRSP_ADDR0015] = DMA_WD0(fcp->isp_scdma+GXOFF);
2813 		gq->snscb_addr[RQRSP_ADDR1631] = DMA_WD1(fcp->isp_scdma+GXOFF);
2814 		gq->snscb_addr[RQRSP_ADDR3247] = DMA_WD2(fcp->isp_scdma+GXOFF);
2815 		gq->snscb_addr[RQRSP_ADDR4863] = DMA_WD3(fcp->isp_scdma+GXOFF);
2816 		gq->snscb_sblen = 6;
2817 		gq->snscb_cmd = SNS_GFF_ID;
2818 		gq->snscb_portid = lcl.portid;
2819 		isp_put_gxn_id_request(isp, gq,
2820 		    (sns_gxn_id_req_t *) fcp->isp_scratch);
2821 		MEMORYBARRIER(isp, SYNC_SFORDEV, 0, SNS_GXN_ID_REQ_SIZE);
2822 		mbs.param[0] = MBOX_SEND_SNS;
2823 		mbs.param[1] = SNS_GXN_ID_REQ_SIZE >> 1;
2824 		mbs.param[2] = DMA_WD1(fcp->isp_scdma);
2825 		mbs.param[3] = DMA_WD0(fcp->isp_scdma);
2826 		/*
2827 		 * Leave 4 and 5 alone
2828 		 */
2829 		mbs.param[6] = DMA_WD3(fcp->isp_scdma);
2830 		mbs.param[7] = DMA_WD2(fcp->isp_scdma);
2831 		if (isp_fabric_mbox_cmd(isp, &mbs)) {
2832 			if (fcp->isp_loopstate >= LOOP_SCANNING_FABRIC) {
2833 				fcp->isp_loopstate = LOOP_PDB_RCVD;
2834 			}
2835 			FC_SCRATCH_RELEASE(isp);
2836 			return (-1);
2837 		}
2838 		if (fcp->isp_loopstate != LOOP_SCANNING_FABRIC) {
2839 			FC_SCRATCH_RELEASE(isp);
2840 			return (-1);
2841 		}
2842 		MEMORYBARRIER(isp, SYNC_SFORCPU, GXOFF, SNS_GFF_ID_RESP_SIZE);
2843 		fs0 = (sns_gff_id_rsp_t *) ((u_int8_t *)fcp->isp_scratch+GXOFF);
2844 		isp_get_gff_id_response(isp, fs0, fs1);
2845 		if (fs1->snscb_cthdr.ct_response != FS_ACC) {
2846 			isp_prt(isp, /* ISP_LOGDEBUG0 */ ISP_LOGWARN,
2847 			    swrej, "GFF_ID",
2848 			    fs1->snscb_cthdr.ct_reason,
2849 			    fs1->snscb_cthdr.ct_explanation, lcl.portid);
2850 			if (fcp->isp_loopstate != LOOP_SCANNING_FABRIC) {
2851 				FC_SCRATCH_RELEASE(isp);
2852 				return (-1);
2853 			}
2854 		} else {
2855 			int index = (ftype >> 3);
2856 			int bshft = (ftype & 0x7) * 4;
2857 			int fc4_fval =
2858 			    (fs1->snscb_fc4_features[index] >> bshft) & 0xf;
2859 			if (fc4_fval & 0x1) {
2860 				lcl.roles |=
2861 				    (SVC3_INI_ROLE >> SVC3_ROLE_SHIFT);
2862 			}
2863 			if (fc4_fval & 0x2) {
2864 				lcl.roles |=
2865 				    (SVC3_TGT_ROLE >> SVC3_ROLE_SHIFT);
2866 			}
2867 		}
2868 #endif
2869 
2870 		/*
2871 		 * If we really want to know what kind of port type this is,
2872 		 * we have to run another CT command. Otherwise, we'll leave
2873 		 * it as undefined.
2874 		 *
2875 		lcl.port_type = 0;
2876 		 */
2877 		if (rs1->snscb_ports[i].control & 0x80) {
2878 			lcl.last_fabric_dev = 1;
2879 		} else {
2880 			lcl.last_fabric_dev = 0;
2881 		}
2882 		(void) isp_async(isp, ISPASYNC_FABRIC_DEV, &lcl);
2883 
2884 	} while ((rs1->snscb_ports[i].control & 0x80) == 0 && i < NGENT-1);
2885 
2886 	/*
2887 	 * If we're not at the last entry, our list isn't big enough.
2888 	 */
2889 	if ((rs1->snscb_ports[i].control & 0x80) == 0) {
2890 		isp_prt(isp, ISP_LOGWARN, "fabric too big for scratch area");
2891 	}
2892 
2893 	FC_SCRATCH_RELEASE(isp);
2894 	fcp->isp_loopstate = LOOP_FSCAN_DONE;
2895 	return (0);
2896 }
2897 #endif
2898 
2899 static void
2900 isp_register_fc4_type(struct ispsoftc *isp)
2901 {
2902 	fcparam *fcp = isp->isp_param;
2903 	u_int8_t local[SNS_RFT_ID_REQ_SIZE];
2904 	sns_screq_t *reqp = (sns_screq_t *) local;
2905 	mbreg_t mbs;
2906 
2907 	MEMZERO((void *) reqp, SNS_RFT_ID_REQ_SIZE);
2908 	reqp->snscb_rblen = SNS_RFT_ID_RESP_SIZE >> 1;
2909 	reqp->snscb_addr[RQRSP_ADDR0015] = DMA_WD0(fcp->isp_scdma + 0x100);
2910 	reqp->snscb_addr[RQRSP_ADDR1631] = DMA_WD1(fcp->isp_scdma + 0x100);
2911 	reqp->snscb_addr[RQRSP_ADDR3247] = DMA_WD2(fcp->isp_scdma + 0x100);
2912 	reqp->snscb_addr[RQRSP_ADDR4863] = DMA_WD3(fcp->isp_scdma + 0x100);
2913 	reqp->snscb_sblen = 22;
2914 	reqp->snscb_data[0] = SNS_RFT_ID;
2915 	reqp->snscb_data[4] = fcp->isp_portid & 0xffff;
2916 	reqp->snscb_data[5] = (fcp->isp_portid >> 16) & 0xff;
2917 	reqp->snscb_data[6] = (1 << FC4_SCSI);
2918 #if	0
2919 	reqp->snscb_data[6] |= (1 << FC4_IP);	/* ISO/IEC 8802-2 LLC/SNAP */
2920 #endif
2921 	FC_SCRATCH_ACQUIRE(isp);
2922 	isp_put_sns_request(isp, reqp, (sns_screq_t *) fcp->isp_scratch);
2923 	mbs.param[0] = MBOX_SEND_SNS;
2924 	mbs.param[1] = SNS_RFT_ID_REQ_SIZE >> 1;
2925 	mbs.param[2] = DMA_WD1(fcp->isp_scdma);
2926 	mbs.param[3] = DMA_WD0(fcp->isp_scdma);
2927 	/*
2928 	 * Leave 4 and 5 alone
2929 	 */
2930 	mbs.param[6] = DMA_WD3(fcp->isp_scdma);
2931 	mbs.param[7] = DMA_WD2(fcp->isp_scdma);
2932 	isp_mboxcmd(isp, &mbs, MBLOGALL);
2933 	FC_SCRATCH_RELEASE(isp);
2934 	if (mbs.param[0] == MBOX_COMMAND_COMPLETE) {
2935 		isp_prt(isp, ISP_LOGDEBUG0, "Register FC4 types succeeded");
2936 	}
2937 }
2938 
2939 /*
2940  * Start a command. Locking is assumed done in the caller.
2941  */
2942 
2943 int
2944 isp_start(XS_T *xs)
2945 {
2946 	struct ispsoftc *isp;
2947 	u_int16_t nxti, optr, handle;
2948 	u_int8_t local[QENTRY_LEN];
2949 	ispreq_t *reqp, *qep;
2950 	int target, i;
2951 
2952 	XS_INITERR(xs);
2953 	isp = XS_ISP(xs);
2954 
2955 	/*
2956 	 * Check to make sure we're supporting initiator role.
2957 	 */
2958 	if ((isp->isp_role & ISP_ROLE_INITIATOR) == 0) {
2959 		XS_SETERR(xs, HBA_SELTIMEOUT);
2960 		return (CMD_COMPLETE);
2961 	}
2962 
2963 	/*
2964 	 * Now make sure we're running.
2965 	 */
2966 
2967 	if (isp->isp_state != ISP_RUNSTATE) {
2968 		isp_prt(isp, ISP_LOGERR, "Adapter not at RUNSTATE");
2969 		XS_SETERR(xs, HBA_BOTCH);
2970 		return (CMD_COMPLETE);
2971 	}
2972 
2973 	/*
2974 	 * Check command CDB length, etc.. We really are limited to 16 bytes
2975 	 * for Fibre Channel, but can do up to 44 bytes in parallel SCSI,
2976 	 * but probably only if we're running fairly new firmware (we'll
2977 	 * let the old f/w choke on an extended command queue entry).
2978 	 */
2979 
2980 	if (XS_CDBLEN(xs) > (IS_FC(isp)? 16 : 44) || XS_CDBLEN(xs) == 0) {
2981 		isp_prt(isp, ISP_LOGERR,
2982 		    "unsupported cdb length (%d, CDB[0]=0x%x)",
2983 		    XS_CDBLEN(xs), XS_CDBP(xs)[0] & 0xff);
2984 		XS_SETERR(xs, HBA_BOTCH);
2985 		return (CMD_COMPLETE);
2986 	}
2987 
2988 	/*
2989 	 * Check to see whether we have good firmware state still or
2990 	 * need to refresh our port database for this target.
2991 	 */
2992 	target = XS_TGT(xs);
2993 	if (IS_FC(isp)) {
2994 		fcparam *fcp = isp->isp_param;
2995 		struct lportdb *lp;
2996 #ifdef	HANDLE_LOOPSTATE_IN_OUTER_LAYERS
2997 		if (fcp->isp_fwstate != FW_READY ||
2998 		    fcp->isp_loopstate != LOOP_READY) {
2999 			return (CMD_RQLATER);
3000 		}
3001 
3002 		/*
3003 		 * If we're not on a Fabric, we can't have a target
3004 		 * above FL_PORT_ID-1.
3005 		 *
3006 		 * If we're on a fabric and *not* connected as an F-port,
3007 		 * we can't have a target less than FC_SNS_ID+1. This
3008 		 * keeps us from having to sort out the difference between
3009 		 * local public loop devices and those which we might get
3010 		 * from a switch's database.
3011 		 */
3012 		if (fcp->isp_onfabric == 0) {
3013 			if (target >= FL_PORT_ID) {
3014 				XS_SETERR(xs, HBA_SELTIMEOUT);
3015 				return (CMD_COMPLETE);
3016 			}
3017 		} else {
3018 			if (target >= FL_PORT_ID && target <= FC_SNS_ID) {
3019 				XS_SETERR(xs, HBA_SELTIMEOUT);
3020 				return (CMD_COMPLETE);
3021 			}
3022 			/*
3023 			 * We used to exclude having local loop ports
3024 			 * at the same time that we have fabric ports.
3025 			 * That is, we used to exclude having ports
3026 			 * at < FL_PORT_ID if we're FL-port.
3027 			 *
3028 			 * That's wrong. The only thing that could be
3029 			 * dicey is if the switch you're connected to
3030 			 * has these local loop ports appear on the
3031 			 * fabric and we somehow attach them twice.
3032 			 */
3033 		}
3034 #else
3035 		/*
3036 		 * Check for f/w being in ready state. If the f/w
3037 		 * isn't in ready state, then we don't know our
3038 		 * loop ID and the f/w hasn't completed logging
3039 		 * into all targets on the loop. If this is the
3040 		 * case, then bounce the command. We pretend this is
3041 		 * a SELECTION TIMEOUT error if we've never gone to
3042 		 * FW_READY state at all- in this case we may not
3043 		 * be hooked to a loop at all and we shouldn't hang
3044 		 * the machine for this. Otherwise, defer this command
3045 		 * until later.
3046 		 */
3047 		if (fcp->isp_fwstate != FW_READY) {
3048 			/*
3049 			 * Give ourselves at most a 250ms delay.
3050 			 */
3051 			if (isp_fclink_test(isp, 250000)) {
3052 				XS_SETERR(xs, HBA_SELTIMEOUT);
3053 				if (fcp->loop_seen_once) {
3054 					return (CMD_RQLATER);
3055 				} else {
3056 					return (CMD_COMPLETE);
3057 				}
3058 			}
3059 		}
3060 
3061 		/*
3062 		 * If we're not on a Fabric, we can't have a target
3063 		 * above FL_PORT_ID-1.
3064 		 *
3065 		 * If we're on a fabric and *not* connected as an F-port,
3066 		 * we can't have a target less than FC_SNS_ID+1. This
3067 		 * keeps us from having to sort out the difference between
3068 		 * local public loop devices and those which we might get
3069 		 * from a switch's database.
3070 		 */
3071 		if (fcp->isp_onfabric == 0) {
3072 			if (target >= FL_PORT_ID) {
3073 				XS_SETERR(xs, HBA_SELTIMEOUT);
3074 				return (CMD_COMPLETE);
3075 			}
3076 		} else {
3077 			if (target >= FL_PORT_ID && target <= FC_SNS_ID) {
3078 				XS_SETERR(xs, HBA_SELTIMEOUT);
3079 				return (CMD_COMPLETE);
3080 			}
3081 			if (fcp->isp_topo != TOPO_F_PORT &&
3082 			    target < FL_PORT_ID) {
3083 				XS_SETERR(xs, HBA_SELTIMEOUT);
3084 				return (CMD_COMPLETE);
3085 			}
3086 		}
3087 
3088 		/*
3089 		 * If our loop state is such that we haven't yet received
3090 		 * a "Port Database Changed" notification (after a LIP or
3091 		 * a Loop Reset or firmware initialization), then defer
3092 		 * sending commands for a little while, but only if we've
3093 		 * seen a valid loop at one point (otherwise we can get
3094 		 * stuck at initialization time).
3095 		 */
3096 		if (fcp->isp_loopstate < LOOP_PDB_RCVD) {
3097 			XS_SETERR(xs, HBA_SELTIMEOUT);
3098 			if (fcp->loop_seen_once) {
3099 				return (CMD_RQLATER);
3100 			} else {
3101 				return (CMD_COMPLETE);
3102 			}
3103 		}
3104 
3105 		/*
3106 		 * If we're in the middle of loop or fabric scanning
3107 		 * or merging the port databases, retry this command later.
3108 		 */
3109 		if (fcp->isp_loopstate == LOOP_SCANNING_FABRIC ||
3110 		    fcp->isp_loopstate == LOOP_SCANNING_LOOP ||
3111 		    fcp->isp_loopstate == LOOP_SYNCING_PDB) {
3112 			return (CMD_RQLATER);
3113 		}
3114 
3115 		/*
3116 		 * If our loop state is now such that we've just now
3117 		 * received a Port Database Change notification, then
3118 		 * we have to go off and (re)scan the fabric. We back
3119 		 * out and try again later if this doesn't work.
3120 		 */
3121 		if (fcp->isp_loopstate == LOOP_PDB_RCVD && fcp->isp_onfabric) {
3122 			if (isp_scan_fabric(isp, FC4_SCSI)) {
3123 				return (CMD_RQLATER);
3124 			}
3125 			if (fcp->isp_fwstate != FW_READY ||
3126 			    fcp->isp_loopstate < LOOP_FSCAN_DONE) {
3127 				return (CMD_RQLATER);
3128 			}
3129 		}
3130 
3131 		/*
3132 		 * If our loop state is now such that we've just now
3133 		 * received a Port Database Change notification, then
3134 		 * we have to go off and (re)synchronize our port
3135 		 * database.
3136 		 */
3137 		if (fcp->isp_loopstate < LOOP_READY) {
3138 			if (isp_pdb_sync(isp)) {
3139 				return (CMD_RQLATER);
3140 			}
3141 			if (fcp->isp_fwstate != FW_READY ||
3142 			    fcp->isp_loopstate != LOOP_READY) {
3143 				return (CMD_RQLATER);
3144 			}
3145 		}
3146 
3147 		/*
3148 		 * XXX: Here's were we would cancel any loop_dead flag
3149 		 * XXX: also cancel in dead_loop timeout that's running
3150 		 */
3151 #endif
3152 
3153 		/*
3154 		 * Now check whether we should even think about pursuing this.
3155 		 */
3156 		lp = &fcp->portdb[target];
3157 		if (lp->valid == 0) {
3158 			XS_SETERR(xs, HBA_SELTIMEOUT);
3159 			return (CMD_COMPLETE);
3160 		}
3161 		if ((lp->roles & (SVC3_TGT_ROLE >> SVC3_ROLE_SHIFT)) == 0) {
3162 			isp_prt(isp, ISP_LOGDEBUG2,
3163 			    "Target %d does not have target service", target);
3164 			XS_SETERR(xs, HBA_SELTIMEOUT);
3165 			return (CMD_COMPLETE);
3166 		}
3167 		/*
3168 		 * Now turn target into what the actual Loop ID is.
3169 		 */
3170 		target = lp->loopid;
3171 	}
3172 
3173 	/*
3174 	 * Next check to see if any HBA or Device
3175 	 * parameters need to be updated.
3176 	 */
3177 	if (isp->isp_update != 0) {
3178 		isp_update(isp);
3179 	}
3180 
3181 	if (isp_getrqentry(isp, &nxti, &optr, (void *)&qep)) {
3182 		isp_prt(isp, ISP_LOGDEBUG0, "Request Queue Overflow");
3183 		XS_SETERR(xs, HBA_BOTCH);
3184 		return (CMD_EAGAIN);
3185 	}
3186 
3187 	/*
3188 	 * Now see if we need to synchronize the ISP with respect to anything.
3189 	 * We do dual duty here (cough) for synchronizing for busses other
3190 	 * than which we got here to send a command to.
3191 	 */
3192 	reqp = (ispreq_t *) local;
3193 	if (isp->isp_sendmarker) {
3194 		u_int8_t n = (IS_DUALBUS(isp)? 2: 1);
3195 		/*
3196 		 * Check ports to send markers for...
3197 		 */
3198 		for (i = 0; i < n; i++) {
3199 			if ((isp->isp_sendmarker & (1 << i)) == 0) {
3200 				continue;
3201 			}
3202 			MEMZERO((void *) reqp, QENTRY_LEN);
3203 			reqp->req_header.rqs_entry_count = 1;
3204 			reqp->req_header.rqs_entry_type = RQSTYPE_MARKER;
3205 			reqp->req_modifier = SYNC_ALL;
3206 			reqp->req_target = i << 7;	/* insert bus number */
3207 			isp_put_request(isp, reqp, qep);
3208 			ISP_ADD_REQUEST(isp, nxti);
3209 			isp->isp_sendmarker &= ~(1 << i);
3210 			if (isp_getrqentry(isp, &nxti, &optr, (void *) &qep)) {
3211 				isp_prt(isp, ISP_LOGDEBUG0,
3212 				    "Request Queue Overflow+");
3213 				XS_SETERR(xs, HBA_BOTCH);
3214 				return (CMD_EAGAIN);
3215 			}
3216 		}
3217 	}
3218 
3219 	MEMZERO((void *)reqp, QENTRY_LEN);
3220 	reqp->req_header.rqs_entry_count = 1;
3221 	if (IS_FC(isp)) {
3222 		reqp->req_header.rqs_entry_type = RQSTYPE_T2RQS;
3223 	} else {
3224 		if (XS_CDBLEN(xs) > 12)
3225 			reqp->req_header.rqs_entry_type = RQSTYPE_CMDONLY;
3226 		else
3227 			reqp->req_header.rqs_entry_type = RQSTYPE_REQUEST;
3228 	}
3229 	/* reqp->req_header.rqs_flags = 0; */
3230 	/* reqp->req_header.rqs_seqno = 0; */
3231 	if (IS_FC(isp)) {
3232 		/*
3233 		 * See comment in isp_intr
3234 		 */
3235 		/* XS_RESID(xs) = 0; */
3236 
3237 		/*
3238 		 * Fibre Channel always requires some kind of tag.
3239 		 * The Qlogic drivers seem be happy not to use a tag,
3240 		 * but this breaks for some devices (IBM drives).
3241 		 */
3242 		if (XS_TAG_P(xs)) {
3243 			((ispreqt2_t *)reqp)->req_flags = XS_TAG_TYPE(xs);
3244 		} else {
3245 			/*
3246 			 * If we don't know what tag to use, use HEAD OF QUEUE
3247 			 * for Request Sense or Simple.
3248 			 */
3249 			if (XS_CDBP(xs)[0] == 0x3)	/* REQUEST SENSE */
3250 				((ispreqt2_t *)reqp)->req_flags = REQFLAG_HTAG;
3251 			else
3252 				((ispreqt2_t *)reqp)->req_flags = REQFLAG_STAG;
3253 		}
3254 	} else {
3255 		sdparam *sdp = (sdparam *)isp->isp_param;
3256 		sdp += XS_CHANNEL(xs);
3257 		if ((sdp->isp_devparam[target].actv_flags & DPARM_TQING) &&
3258 		    XS_TAG_P(xs)) {
3259 			reqp->req_flags = XS_TAG_TYPE(xs);
3260 		}
3261 	}
3262 	reqp->req_target = target | (XS_CHANNEL(xs) << 7);
3263 	if (IS_SCSI(isp)) {
3264 		reqp->req_lun_trn = XS_LUN(xs);
3265 		reqp->req_cdblen = XS_CDBLEN(xs);
3266 	} else {
3267 		if (FCPARAM(isp)->isp_fwattr & ISP_FW_ATTR_SCCLUN)
3268 			((ispreqt2_t *)reqp)->req_scclun = XS_LUN(xs);
3269 		else
3270 			((ispreqt2_t *)reqp)->req_lun_trn = XS_LUN(xs);
3271 	}
3272 	MEMCPY(reqp->req_cdb, XS_CDBP(xs), XS_CDBLEN(xs));
3273 
3274 	reqp->req_time = XS_TIME(xs) / 1000;
3275 	if (reqp->req_time == 0 && XS_TIME(xs)) {
3276 		reqp->req_time = 1;
3277 	}
3278 
3279 	if (isp_save_xs(isp, xs, &handle)) {
3280 		isp_prt(isp, ISP_LOGDEBUG0, "out of xflist pointers");
3281 		XS_SETERR(xs, HBA_BOTCH);
3282 		return (CMD_EAGAIN);
3283 	}
3284 	reqp->req_handle = handle;
3285 
3286 	/*
3287 	 * Set up DMA and/or do any bus swizzling of the request entry
3288 	 * so that the Qlogic F/W understands what is being asked of it.
3289 	 */
3290 	i = ISP_DMASETUP(isp, xs, reqp, &nxti, optr);
3291 	if (i != CMD_QUEUED) {
3292 		isp_destroy_handle(isp, handle);
3293 		/*
3294 		 * dmasetup sets actual error in packet, and
3295 		 * return what we were given to return.
3296 		 */
3297 		return (i);
3298 	}
3299 	XS_SETERR(xs, HBA_NOERROR);
3300 	isp_prt(isp, ISP_LOGDEBUG2,
3301 	    "START cmd for %d.%d.%d cmd 0x%x datalen %ld",
3302 	    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs), XS_CDBP(xs)[0],
3303 	    (long) XS_XFRLEN(xs));
3304 	ISP_ADD_REQUEST(isp, nxti);
3305 	isp->isp_nactive++;
3306 	return (CMD_QUEUED);
3307 }
3308 
3309 /*
3310  * isp control
3311  * Locks (ints blocked) assumed held.
3312  */
3313 
3314 int
3315 isp_control(struct ispsoftc *isp, ispctl_t ctl, void *arg)
3316 {
3317 	XS_T *xs;
3318 	mbreg_t mbs;
3319 	int bus, tgt;
3320 	u_int16_t handle;
3321 
3322 	switch (ctl) {
3323 	default:
3324 		isp_prt(isp, ISP_LOGERR, "Unknown Control Opcode 0x%x", ctl);
3325 		break;
3326 
3327 	case ISPCTL_RESET_BUS:
3328 		/*
3329 		 * Issue a bus reset.
3330 		 */
3331 		mbs.param[0] = MBOX_BUS_RESET;
3332 		mbs.param[2] = 0;
3333 		if (IS_SCSI(isp)) {
3334 			mbs.param[1] =
3335 			    ((sdparam *) isp->isp_param)->isp_bus_reset_delay;
3336 			if (mbs.param[1] < 2)
3337 				mbs.param[1] = 2;
3338 			bus = *((int *) arg);
3339 			if (IS_DUALBUS(isp))
3340 				mbs.param[2] = bus;
3341 		} else {
3342 			mbs.param[1] = 10;
3343 			bus = 0;
3344 		}
3345 		isp->isp_sendmarker |= (1 << bus);
3346 		isp_mboxcmd(isp, &mbs, MBLOGALL);
3347 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
3348 			break;
3349 		}
3350 		isp_prt(isp, ISP_LOGINFO,
3351 		    "driver initiated bus reset of bus %d", bus);
3352 		return (0);
3353 
3354 	case ISPCTL_RESET_DEV:
3355 		tgt = (*((int *) arg)) & 0xffff;
3356 		bus = (*((int *) arg)) >> 16;
3357 		mbs.param[0] = MBOX_ABORT_TARGET;
3358 		mbs.param[1] = (tgt << 8) | (bus << 15);
3359 		mbs.param[2] = 3;	/* 'delay', in seconds */
3360 		isp_mboxcmd(isp, &mbs, MBLOGALL);
3361 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
3362 			break;
3363 		}
3364 		isp_prt(isp, ISP_LOGINFO,
3365 		    "Target %d on Bus %d Reset Succeeded", tgt, bus);
3366 		isp->isp_sendmarker |= (1 << bus);
3367 		return (0);
3368 
3369 	case ISPCTL_ABORT_CMD:
3370 		xs = (XS_T *) arg;
3371 		tgt = XS_TGT(xs);
3372 		handle = isp_find_handle(isp, xs);
3373 		if (handle == 0) {
3374 			isp_prt(isp, ISP_LOGWARN,
3375 			    "cannot find handle for command to abort");
3376 			break;
3377 		}
3378 		bus = XS_CHANNEL(xs);
3379 		mbs.param[0] = MBOX_ABORT;
3380 		if (IS_FC(isp)) {
3381 			if (FCPARAM(isp)->isp_fwattr & ISP_FW_ATTR_SCCLUN)  {
3382 				mbs.param[1] = tgt << 8;
3383 				mbs.param[4] = 0;
3384 				mbs.param[5] = 0;
3385 				mbs.param[6] = XS_LUN(xs);
3386 			} else {
3387 				mbs.param[1] = tgt << 8 | XS_LUN(xs);
3388 			}
3389 		} else {
3390 			mbs.param[1] =
3391 			    (bus << 15) | (XS_TGT(xs) << 8) | XS_LUN(xs);
3392 		}
3393 		mbs.param[3] = 0;
3394 		mbs.param[2] = handle;
3395 		isp_mboxcmd(isp, &mbs, MBLOGALL & ~MBOX_COMMAND_ERROR);
3396 		if (mbs.param[0] == MBOX_COMMAND_COMPLETE) {
3397 			return (0);
3398 		}
3399 		/*
3400 		 * XXX: Look for command in the REQUEST QUEUE. That is,
3401 		 * XXX: It hasen't been picked up by firmware yet.
3402 		 */
3403 		break;
3404 
3405 	case ISPCTL_UPDATE_PARAMS:
3406 
3407 		isp_update(isp);
3408 		return (0);
3409 
3410 	case ISPCTL_FCLINK_TEST:
3411 
3412 		if (IS_FC(isp)) {
3413 			int usdelay = (arg)? *((int *) arg) : 250000;
3414 			return (isp_fclink_test(isp, usdelay));
3415 		}
3416 		break;
3417 
3418 	case ISPCTL_SCAN_FABRIC:
3419 
3420 		if (IS_FC(isp)) {
3421 			int ftype = (arg)? *((int *) arg) : FC4_SCSI;
3422 			return (isp_scan_fabric(isp, ftype));
3423 		}
3424 		break;
3425 
3426 	case ISPCTL_SCAN_LOOP:
3427 
3428 		if (IS_FC(isp)) {
3429 			return (isp_scan_loop(isp));
3430 		}
3431 		break;
3432 
3433 	case ISPCTL_PDB_SYNC:
3434 
3435 		if (IS_FC(isp)) {
3436 			return (isp_pdb_sync(isp));
3437 		}
3438 		break;
3439 
3440 	case ISPCTL_SEND_LIP:
3441 
3442 		if (IS_FC(isp)) {
3443 			mbs.param[0] = MBOX_INIT_LIP;
3444 			isp_mboxcmd(isp, &mbs, MBLOGALL);
3445 			if (mbs.param[0] == MBOX_COMMAND_COMPLETE) {
3446 				return (0);
3447 			}
3448 		}
3449 		break;
3450 
3451 	case ISPCTL_GET_POSMAP:
3452 
3453 		if (IS_FC(isp) && arg) {
3454 			return (isp_getmap(isp, arg));
3455 		}
3456 		break;
3457 
3458 	case ISPCTL_RUN_MBOXCMD:
3459 
3460 		isp_mboxcmd(isp, arg, MBLOGALL);
3461 		return(0);
3462 
3463 #ifdef	ISP_TARGET_MODE
3464 	case ISPCTL_TOGGLE_TMODE:
3465 	{
3466 
3467 		/*
3468 		 * We don't check/set against role here- that's the
3469 		 * responsibility for the outer layer to coordinate.
3470 		 */
3471 		if (IS_SCSI(isp)) {
3472 			int param = *(int *)arg;
3473 			mbs.param[0] = MBOX_ENABLE_TARGET_MODE;
3474 			mbs.param[1] = param & 0xffff;
3475 			mbs.param[2] = param >> 16;
3476 			isp_mboxcmd(isp, &mbs, MBLOGALL);
3477 			if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
3478 				break;
3479 			}
3480 		}
3481 		return (0);
3482 	}
3483 #endif
3484 	}
3485 	return (-1);
3486 }
3487 
3488 /*
3489  * Interrupt Service Routine(s).
3490  *
3491  * External (OS) framework has done the appropriate locking,
3492  * and the locking will be held throughout this function.
3493  */
3494 
3495 /*
3496  * Limit our stack depth by sticking with the max likely number
3497  * of completions on a request queue at any one time.
3498  */
3499 #ifndef	MAX_REQUESTQ_COMPLETIONS
3500 #define	MAX_REQUESTQ_COMPLETIONS	64
3501 #endif
3502 
3503 void
3504 isp_intr(struct ispsoftc *isp, u_int16_t isr, u_int16_t sema, u_int16_t mbox)
3505 {
3506 	XS_T *complist[MAX_REQUESTQ_COMPLETIONS], *xs;
3507 	u_int16_t iptr, optr, junk;
3508 	int i, nlooked = 0, ndone = 0;
3509 
3510 again:
3511 	/*
3512 	 * Is this a mailbox related interrupt?
3513 	 * The mailbox semaphore will be nonzero if so.
3514 	 */
3515 	if (sema) {
3516 		if (mbox & 0x4000) {
3517 			isp->isp_intmboxc++;
3518 			if (isp->isp_mboxbsy) {
3519 				int i = 0, obits = isp->isp_obits;
3520 				isp->isp_mboxtmp[i++] = mbox;
3521 				for (i = 1; i < MAX_MAILBOX; i++) {
3522 					if ((obits & (1 << i)) == 0) {
3523 						continue;
3524 					}
3525 					isp->isp_mboxtmp[i] =
3526 					    ISP_READ(isp, MBOX_OFF(i));
3527 				}
3528 				if (isp->isp_mbxwrk0) {
3529 					if (isp_mbox_continue(isp) == 0) {
3530 						return;
3531 					}
3532 				}
3533 				MBOX_NOTIFY_COMPLETE(isp);
3534 			} else {
3535 				isp_prt(isp, ISP_LOGWARN,
3536 				    "Mbox Command Async (0x%x) with no waiters",
3537 				    mbox);
3538 			}
3539 		} else if (isp_parse_async(isp, mbox) < 0) {
3540 			return;
3541 		}
3542 		if ((IS_FC(isp) && mbox != ASYNC_RIO_RESP) ||
3543 		    isp->isp_state != ISP_RUNSTATE) {
3544 			ISP_WRITE(isp, HCCR, HCCR_CMD_CLEAR_RISC_INT);
3545 			ISP_WRITE(isp, BIU_SEMA, 0);
3546 			return;
3547 		}
3548 	}
3549 
3550 	/*
3551 	 * We can't be getting this now.
3552 	 */
3553 	if (isp->isp_state != ISP_RUNSTATE) {
3554 		isp_prt(isp, ISP_LOGWARN,
3555 		    "interrupt (ISR=%x SEMA=%x) when not ready", isr, sema);
3556 		/*
3557 		 * Thank you very much!  *Burrrp*!
3558 		 */
3559 		WRITE_RESPONSE_QUEUE_OUT_POINTER(isp,
3560 		    READ_RESPONSE_QUEUE_IN_POINTER(isp));
3561 
3562 		ISP_WRITE(isp, HCCR, HCCR_CMD_CLEAR_RISC_INT);
3563 		ISP_WRITE(isp, BIU_SEMA, 0);
3564 		return;
3565 	}
3566 
3567 	/*
3568 	 * Get the current Response Queue Out Pointer.
3569 	 *
3570 	 * If we're a 2300, we can ask what hardware what it thinks.
3571 	 */
3572 	if (IS_23XX(isp)) {
3573 		optr = ISP_READ(isp, isp->isp_respoutrp);
3574 		/*
3575 		 * Debug: to be taken out eventually
3576 		 */
3577 		if (isp->isp_residx != optr) {
3578 			isp_prt(isp, ISP_LOGWARN, "optr %x soft optr %x",
3579 			    optr, isp->isp_residx);
3580 		}
3581 	} else {
3582 		optr = isp->isp_residx;
3583 	}
3584 
3585 	/*
3586 	 * You *must* read the Response Queue In Pointer
3587 	 * prior to clearing the RISC interrupt.
3588 	 *
3589 	 * Debounce the 2300 if revision less than 2.
3590 	 */
3591 	if (IS_2100(isp) || (IS_2300(isp) && isp->isp_revision < 2)) {
3592 		i = 0;
3593 		do {
3594 			iptr = READ_RESPONSE_QUEUE_IN_POINTER(isp);
3595 			junk = READ_RESPONSE_QUEUE_IN_POINTER(isp);
3596 		} while (junk != iptr && ++i < 1000);
3597 
3598 		if (iptr != junk) {
3599 			ISP_WRITE(isp, HCCR, HCCR_CMD_CLEAR_RISC_INT);
3600 			isp_prt(isp, ISP_LOGWARN,
3601 			    "Response Queue Out Pointer Unstable (%x, %x)",
3602 			    iptr, junk);
3603 			return;
3604 		}
3605 	} else {
3606 		iptr = READ_RESPONSE_QUEUE_IN_POINTER(isp);
3607 	}
3608 	isp->isp_resodx = iptr;
3609 
3610 
3611 	if (optr == iptr && sema == 0) {
3612 		/*
3613 		 * There are a lot of these- reasons unknown- mostly on
3614 		 * faster Alpha machines.
3615 		 *
3616 		 * I tried delaying after writing HCCR_CMD_CLEAR_RISC_INT to
3617 		 * make sure the old interrupt went away (to avoid 'ringing'
3618 		 * effects), but that didn't stop this from occurring.
3619 		 */
3620 		if (IS_23XX(isp)) {
3621 			USEC_DELAY(100);
3622 			iptr = READ_RESPONSE_QUEUE_IN_POINTER(isp);
3623 			junk = ISP_READ(isp, BIU_R2HSTSLO);
3624 		} else {
3625 			junk = ISP_READ(isp, BIU_ISR);
3626 		}
3627 		if (optr == iptr) {
3628 			if (IS_23XX(isp)) {
3629 				;
3630 			} else {
3631 				sema = ISP_READ(isp, BIU_SEMA);
3632 				mbox = ISP_READ(isp, OUTMAILBOX0);
3633 				if ((sema & 0x3) && (mbox & 0x8000)) {
3634 					goto again;
3635 				}
3636 			}
3637 			isp->isp_intbogus++;
3638 			isp_prt(isp, ISP_LOGDEBUG1,
3639 			    "bogus intr- isr %x (%x) iptr %x optr %x",
3640 			    isr, junk, iptr, optr);
3641 		}
3642 	}
3643 	isp->isp_resodx = iptr;
3644 	ISP_WRITE(isp, HCCR, HCCR_CMD_CLEAR_RISC_INT);
3645 	ISP_WRITE(isp, BIU_SEMA, 0);
3646 
3647 	if (isp->isp_rspbsy) {
3648 		return;
3649 	}
3650 	isp->isp_rspbsy = 1;
3651 
3652 	while (optr != iptr) {
3653 		ispstatusreq_t local, *sp = &local;
3654 		isphdr_t *hp;
3655 		int type;
3656 		u_int16_t oop;
3657 		int buddaboom = 0;
3658 
3659 		hp = (isphdr_t *) ISP_QUEUE_ENTRY(isp->isp_result, optr);
3660 		oop = optr;
3661 		optr = ISP_NXT_QENTRY(optr, RESULT_QUEUE_LEN(isp));
3662 		nlooked++;
3663 		/*
3664 		 * Synchronize our view of this response queue entry.
3665 		 */
3666 		MEMORYBARRIER(isp, SYNC_RESULT, oop, QENTRY_LEN);
3667 
3668 		type = isp_get_response_type(isp, hp);
3669 
3670 		if (type == RQSTYPE_RESPONSE) {
3671 			isp_get_response(isp, (ispstatusreq_t *) hp, sp);
3672 		} else if (type == RQSTYPE_RIO2) {
3673 			isp_rio2_t rio;
3674 			isp_get_rio2(isp, (isp_rio2_t *) hp, &rio);
3675 			for (i = 0; i < rio.req_header.rqs_seqno; i++) {
3676 				isp_fastpost_complete(isp, rio.req_handles[i]);
3677 			}
3678 			if (isp->isp_fpcchiwater < rio.req_header.rqs_seqno)
3679 				isp->isp_fpcchiwater = rio.req_header.rqs_seqno;
3680 			MEMZERO(hp, QENTRY_LEN);	/* PERF */
3681 			continue;
3682 		} else {
3683 			/*
3684 			 * Somebody reachable via isp_handle_other_response
3685 			 * may have updated the response queue pointers for
3686 			 * us, so we reload our goal index.
3687 			 */
3688 			if (isp_handle_other_response(isp, type, hp, &optr)) {
3689 				iptr = isp->isp_resodx;
3690 				MEMZERO(hp, QENTRY_LEN);	/* PERF */
3691 				continue;
3692 			}
3693 
3694 			/*
3695 			 * After this point, we'll just look at the header as
3696 			 * we don't know how to deal with the rest of the
3697 			 * response.
3698 			 */
3699 			isp_get_response(isp, (ispstatusreq_t *) hp, sp);
3700 
3701 			/*
3702 			 * It really has to be a bounced request just copied
3703 			 * from the request queue to the response queue. If
3704 			 * not, something bad has happened.
3705 			 */
3706 			if (sp->req_header.rqs_entry_type != RQSTYPE_REQUEST) {
3707 				isp_prt(isp, ISP_LOGERR, notresp,
3708 				    sp->req_header.rqs_entry_type, oop, optr,
3709 				    nlooked);
3710 				if (isp->isp_dblev & ISP_LOGDEBUG0) {
3711 					isp_print_bytes(isp, "Queue Entry",
3712 					    QENTRY_LEN, sp);
3713 				}
3714 				MEMZERO(hp, QENTRY_LEN);	/* PERF */
3715 				continue;
3716 			}
3717 			buddaboom = 1;
3718 		}
3719 
3720 		if (sp->req_header.rqs_flags & 0xf) {
3721 #define	_RQS_OFLAGS	\
3722 	~(RQSFLAG_CONTINUATION|RQSFLAG_FULL|RQSFLAG_BADHEADER|RQSFLAG_BADPACKET)
3723 			if (sp->req_header.rqs_flags & RQSFLAG_CONTINUATION) {
3724 				isp_prt(isp, ISP_LOGWARN,
3725 				    "continuation segment");
3726 				WRITE_RESPONSE_QUEUE_OUT_POINTER(isp, optr);
3727 				continue;
3728 			}
3729 			if (sp->req_header.rqs_flags & RQSFLAG_FULL) {
3730 				isp_prt(isp, ISP_LOGDEBUG1,
3731 				    "internal queues full");
3732 				/*
3733 				 * We'll synthesize a QUEUE FULL message below.
3734 				 */
3735 			}
3736 			if (sp->req_header.rqs_flags & RQSFLAG_BADHEADER) {
3737 				isp_prt(isp, ISP_LOGERR,  "bad header flag");
3738 				buddaboom++;
3739 			}
3740 			if (sp->req_header.rqs_flags & RQSFLAG_BADPACKET) {
3741 				isp_prt(isp, ISP_LOGERR, "bad request packet");
3742 				buddaboom++;
3743 			}
3744 			if (sp->req_header.rqs_flags & _RQS_OFLAGS) {
3745 				isp_prt(isp, ISP_LOGERR,
3746 				    "unknown flags (0x%x) in response",
3747 				    sp->req_header.rqs_flags);
3748 				buddaboom++;
3749 			}
3750 #undef	_RQS_OFLAGS
3751 		}
3752 		if (sp->req_handle > isp->isp_maxcmds || sp->req_handle < 1) {
3753 			MEMZERO(hp, QENTRY_LEN);	/* PERF */
3754 			isp_prt(isp, ISP_LOGERR,
3755 			    "bad request handle %d (type 0x%x, flags 0x%x)",
3756 			    sp->req_handle, sp->req_header.rqs_entry_type,
3757 			    sp->req_header.rqs_flags);
3758 			WRITE_RESPONSE_QUEUE_OUT_POINTER(isp, optr);
3759 			continue;
3760 		}
3761 		xs = isp_find_xs(isp, sp->req_handle);
3762 		if (xs == NULL) {
3763 			u_int8_t ts = sp->req_completion_status & 0xff;
3764 			MEMZERO(hp, QENTRY_LEN);	/* PERF */
3765 			/*
3766 			 * Only whine if this isn't the expected fallout of
3767 			 * aborting the command.
3768 			 */
3769 			if (sp->req_header.rqs_entry_type != RQSTYPE_RESPONSE) {
3770 				isp_prt(isp, ISP_LOGERR,
3771 				    "cannot find handle 0x%x (type 0x%x)",
3772 				    sp->req_handle,
3773 				    sp->req_header.rqs_entry_type);
3774 			} else if (ts != RQCS_ABORTED) {
3775 				isp_prt(isp, ISP_LOGERR,
3776 				    "cannot find handle 0x%x (status 0x%x)",
3777 				    sp->req_handle, ts);
3778 			}
3779 			WRITE_RESPONSE_QUEUE_OUT_POINTER(isp, optr);
3780 			continue;
3781 		}
3782 		isp_destroy_handle(isp, sp->req_handle);
3783 		if (sp->req_status_flags & RQSTF_BUS_RESET) {
3784 			XS_SETERR(xs, HBA_BUSRESET);
3785 			isp->isp_sendmarker |= (1 << XS_CHANNEL(xs));
3786 		}
3787 		if (buddaboom) {
3788 			XS_SETERR(xs, HBA_BOTCH);
3789 		}
3790 
3791 		if (IS_FC(isp) && (sp->req_scsi_status & RQCS_SV)) {
3792 			/*
3793 			 * Fibre Channel F/W doesn't say we got status
3794 			 * if there's Sense Data instead. I guess they
3795 			 * think it goes w/o saying.
3796 			 */
3797 			sp->req_state_flags |= RQSF_GOT_STATUS;
3798 		}
3799 		if (sp->req_state_flags & RQSF_GOT_STATUS) {
3800 			*XS_STSP(xs) = sp->req_scsi_status & 0xff;
3801 		}
3802 
3803 		switch (sp->req_header.rqs_entry_type) {
3804 		case RQSTYPE_RESPONSE:
3805 			XS_SET_STATE_STAT(isp, xs, sp);
3806 			isp_parse_status(isp, sp, xs);
3807 			if ((XS_NOERR(xs) || XS_ERR(xs) == HBA_NOERROR) &&
3808 			    (*XS_STSP(xs) == SCSI_BUSY)) {
3809 				XS_SETERR(xs, HBA_TGTBSY);
3810 			}
3811 			if (IS_SCSI(isp)) {
3812 				XS_RESID(xs) = sp->req_resid;
3813 				if ((sp->req_state_flags & RQSF_GOT_STATUS) &&
3814 				    (*XS_STSP(xs) == SCSI_CHECK) &&
3815 				    (sp->req_state_flags & RQSF_GOT_SENSE)) {
3816 					XS_SAVE_SENSE(xs, sp);
3817 				}
3818 				/*
3819 				 * A new synchronous rate was negotiated for
3820 				 * this target. Mark state such that we'll go
3821 				 * look up that which has changed later.
3822 				 */
3823 				if (sp->req_status_flags & RQSTF_NEGOTIATION) {
3824 					int t = XS_TGT(xs);
3825 					sdparam *sdp = isp->isp_param;
3826 					sdp += XS_CHANNEL(xs);
3827 					sdp->isp_devparam[t].dev_refresh = 1;
3828 					isp->isp_update |=
3829 					    (1 << XS_CHANNEL(xs));
3830 				}
3831 			} else {
3832 				if (sp->req_status_flags & RQSF_XFER_COMPLETE) {
3833 					XS_RESID(xs) = 0;
3834 				} else if (sp->req_scsi_status & RQCS_RESID) {
3835 					XS_RESID(xs) = sp->req_resid;
3836 				} else {
3837 					XS_RESID(xs) = 0;
3838 				}
3839 				if ((sp->req_state_flags & RQSF_GOT_STATUS) &&
3840 				    (*XS_STSP(xs) == SCSI_CHECK) &&
3841 				    (sp->req_scsi_status & RQCS_SV)) {
3842 					XS_SAVE_SENSE(xs, sp);
3843 					/* solely for the benefit of debug */
3844 					sp->req_state_flags |= RQSF_GOT_SENSE;
3845 				}
3846 			}
3847 			isp_prt(isp, ISP_LOGDEBUG2,
3848 			   "asked for %ld got resid %ld", (long) XS_XFRLEN(xs),
3849 			   (long) sp->req_resid);
3850 			break;
3851 		case RQSTYPE_REQUEST:
3852 			if (sp->req_header.rqs_flags & RQSFLAG_FULL) {
3853 				/*
3854 				 * Force Queue Full status.
3855 				 */
3856 				*XS_STSP(xs) = SCSI_QFULL;
3857 				XS_SETERR(xs, HBA_NOERROR);
3858 			} else if (XS_NOERR(xs)) {
3859 				/*
3860 				 * ????
3861 				 */
3862 				isp_prt(isp, ISP_LOGDEBUG0,
3863 				    "Request Queue Entry bounced back");
3864 				XS_SETERR(xs, HBA_BOTCH);
3865 			}
3866 			XS_RESID(xs) = XS_XFRLEN(xs);
3867 			break;
3868 		default:
3869 			isp_prt(isp, ISP_LOGWARN,
3870 			    "unhandled response queue type 0x%x",
3871 			    sp->req_header.rqs_entry_type);
3872 			if (XS_NOERR(xs)) {
3873 				XS_SETERR(xs, HBA_BOTCH);
3874 			}
3875 			break;
3876 		}
3877 
3878 		/*
3879 		 * Free any DMA resources. As a side effect, this may
3880 		 * also do any cache flushing necessary for data coherence.			 */
3881 		if (XS_XFRLEN(xs)) {
3882 			ISP_DMAFREE(isp, xs, sp->req_handle);
3883 		}
3884 
3885 		if (((isp->isp_dblev & (ISP_LOGDEBUG2|ISP_LOGDEBUG3))) ||
3886 		    ((isp->isp_dblev & ISP_LOGDEBUG1) && ((!XS_NOERR(xs)) ||
3887 		    (*XS_STSP(xs) != SCSI_GOOD)))) {
3888 			char skey;
3889 			if (sp->req_state_flags & RQSF_GOT_SENSE) {
3890 				skey = XS_SNSKEY(xs) & 0xf;
3891 				if (skey < 10)
3892 					skey += '0';
3893 				else
3894 					skey += 'a' - 10;
3895 			} else if (*XS_STSP(xs) == SCSI_CHECK) {
3896 				skey = '?';
3897 			} else {
3898 				skey = '.';
3899 			}
3900 			isp_prt(isp, ISP_LOGALL, finmsg, XS_CHANNEL(xs),
3901 			    XS_TGT(xs), XS_LUN(xs), XS_XFRLEN(xs), XS_RESID(xs),
3902 			    *XS_STSP(xs), skey, XS_ERR(xs));
3903 		}
3904 
3905 		if (isp->isp_nactive > 0)
3906 		    isp->isp_nactive--;
3907 		complist[ndone++] = xs;	/* defer completion call until later */
3908 		MEMZERO(hp, QENTRY_LEN);	/* PERF */
3909 		if (ndone == MAX_REQUESTQ_COMPLETIONS) {
3910 			break;
3911 		}
3912 	}
3913 
3914 	/*
3915 	 * If we looked at any commands, then it's valid to find out
3916 	 * what the outpointer is. It also is a trigger to update the
3917 	 * ISP's notion of what we've seen so far.
3918 	 */
3919 	if (nlooked) {
3920 		WRITE_RESPONSE_QUEUE_OUT_POINTER(isp, optr);
3921 		/*
3922 		 * While we're at it, read the requst queue out pointer.
3923 		 */
3924 		isp->isp_reqodx = READ_REQUEST_QUEUE_OUT_POINTER(isp);
3925 		if (isp->isp_rscchiwater < ndone)
3926 			isp->isp_rscchiwater = ndone;
3927 	}
3928 
3929 	isp->isp_residx = optr;
3930 	isp->isp_rspbsy = 0;
3931 	for (i = 0; i < ndone; i++) {
3932 		xs = complist[i];
3933 		if (xs) {
3934 			isp->isp_rsltccmplt++;
3935 			isp_done(xs);
3936 		}
3937 	}
3938 }
3939 
3940 /*
3941  * Support routines.
3942  */
3943 
3944 static int
3945 isp_parse_async(struct ispsoftc *isp, u_int16_t mbox)
3946 {
3947 	int rval = 0;
3948 	int bus;
3949 
3950 	if (IS_DUALBUS(isp)) {
3951 		bus = ISP_READ(isp, OUTMAILBOX6);
3952 	} else {
3953 		bus = 0;
3954 	}
3955 	isp_prt(isp, ISP_LOGDEBUG2, "Async Mbox 0x%x", mbox);
3956 
3957 	switch (mbox) {
3958 	case ASYNC_BUS_RESET:
3959 		isp->isp_sendmarker |= (1 << bus);
3960 #ifdef	ISP_TARGET_MODE
3961 		if (isp_target_async(isp, bus, mbox))
3962 			rval = -1;
3963 #endif
3964 		isp_async(isp, ISPASYNC_BUS_RESET, &bus);
3965 		break;
3966 	case ASYNC_SYSTEM_ERROR:
3967 #ifdef	ISP_FW_CRASH_DUMP
3968 		/*
3969 		 * If we have crash dumps enabled, it's up to the handler
3970 		 * for isp_async to reinit stuff and restart the firmware
3971 		 * after performing the crash dump. The reason we do things
3972 		 * this way is that we may need to activate a kernel thread
3973 		 * to do all the crash dump goop.
3974 		 */
3975 		isp_async(isp, ISPASYNC_FW_CRASH, NULL);
3976 #else
3977 		isp_async(isp, ISPASYNC_FW_CRASH, NULL);
3978 		isp_reinit(isp);
3979 		isp_async(isp, ISPASYNC_FW_RESTARTED, NULL);
3980 #endif
3981 		rval = -1;
3982 		break;
3983 
3984 	case ASYNC_RQS_XFER_ERR:
3985 		isp_prt(isp, ISP_LOGERR, "Request Queue Transfer Error");
3986 		break;
3987 
3988 	case ASYNC_RSP_XFER_ERR:
3989 		isp_prt(isp, ISP_LOGERR, "Response Queue Transfer Error");
3990 		break;
3991 
3992 	case ASYNC_QWAKEUP:
3993 		/*
3994 		 * We've just been notified that the Queue has woken up.
3995 		 * We don't need to be chatty about this- just unlatch things
3996 		 * and move on.
3997 		 */
3998 		mbox = READ_REQUEST_QUEUE_OUT_POINTER(isp);
3999 		break;
4000 
4001 	case ASYNC_TIMEOUT_RESET:
4002 		isp_prt(isp, ISP_LOGWARN,
4003 		    "timeout initiated SCSI bus reset of bus %d", bus);
4004 		isp->isp_sendmarker |= (1 << bus);
4005 #ifdef	ISP_TARGET_MODE
4006 		if (isp_target_async(isp, bus, mbox))
4007 			rval = -1;
4008 #endif
4009 		break;
4010 
4011 	case ASYNC_DEVICE_RESET:
4012 		isp_prt(isp, ISP_LOGINFO, "device reset on bus %d", bus);
4013 		isp->isp_sendmarker |= (1 << bus);
4014 #ifdef	ISP_TARGET_MODE
4015 		if (isp_target_async(isp, bus, mbox))
4016 			rval = -1;
4017 #endif
4018 		break;
4019 
4020 	case ASYNC_EXTMSG_UNDERRUN:
4021 		isp_prt(isp, ISP_LOGWARN, "extended message underrun");
4022 		break;
4023 
4024 	case ASYNC_SCAM_INT:
4025 		isp_prt(isp, ISP_LOGINFO, "SCAM interrupt");
4026 		break;
4027 
4028 	case ASYNC_HUNG_SCSI:
4029 		isp_prt(isp, ISP_LOGERR,
4030 		    "stalled SCSI Bus after DATA Overrun");
4031 		/* XXX: Need to issue SCSI reset at this point */
4032 		break;
4033 
4034 	case ASYNC_KILLED_BUS:
4035 		isp_prt(isp, ISP_LOGERR, "SCSI Bus reset after DATA Overrun");
4036 		break;
4037 
4038 	case ASYNC_BUS_TRANSIT:
4039 		mbox = ISP_READ(isp, OUTMAILBOX2);
4040 		switch (mbox & 0x1c00) {
4041 		case SXP_PINS_LVD_MODE:
4042 			isp_prt(isp, ISP_LOGINFO, "Transition to LVD mode");
4043 			SDPARAM(isp)->isp_diffmode = 0;
4044 			SDPARAM(isp)->isp_ultramode = 0;
4045 			SDPARAM(isp)->isp_lvdmode = 1;
4046 			break;
4047 		case SXP_PINS_HVD_MODE:
4048 			isp_prt(isp, ISP_LOGINFO,
4049 			    "Transition to Differential mode");
4050 			SDPARAM(isp)->isp_diffmode = 1;
4051 			SDPARAM(isp)->isp_ultramode = 0;
4052 			SDPARAM(isp)->isp_lvdmode = 0;
4053 			break;
4054 		case SXP_PINS_SE_MODE:
4055 			isp_prt(isp, ISP_LOGINFO,
4056 			    "Transition to Single Ended mode");
4057 			SDPARAM(isp)->isp_diffmode = 0;
4058 			SDPARAM(isp)->isp_ultramode = 1;
4059 			SDPARAM(isp)->isp_lvdmode = 0;
4060 			break;
4061 		default:
4062 			isp_prt(isp, ISP_LOGWARN,
4063 			    "Transition to Unknown Mode 0x%x", mbox);
4064 			break;
4065 		}
4066 		/*
4067 		 * XXX: Set up to renegotiate again!
4068 		 */
4069 		/* Can only be for a 1080... */
4070 		isp->isp_sendmarker |= (1 << bus);
4071 		break;
4072 
4073 	/*
4074 	 * We can use bus, which will always be zero for FC cards,
4075 	 * as a mailbox pattern accumulator to be checked below.
4076 	 */
4077 	case ASYNC_RIO5:
4078 		bus = 0x1ce;	/* outgoing mailbox regs 1-3, 6-7 */
4079 		break;
4080 
4081 	case ASYNC_RIO4:
4082 		bus = 0x14e;	/* outgoing mailbox regs 1-3, 6 */
4083 		break;
4084 
4085 	case ASYNC_RIO3:
4086 		bus = 0x10e;	/* outgoing mailbox regs 1-3 */
4087 		break;
4088 
4089 	case ASYNC_RIO2:
4090 		bus = 0x106;	/* outgoing mailbox regs 1-2 */
4091 		break;
4092 
4093 	case ASYNC_RIO1:
4094 	case ASYNC_CMD_CMPLT:
4095 		bus = 0x102;	/* outgoing mailbox regs 1 */
4096 		break;
4097 
4098 	case ASYNC_RIO_RESP:
4099 		return (rval);
4100 
4101 	case ASYNC_CTIO_DONE:
4102 	{
4103 #ifdef	ISP_TARGET_MODE
4104 		int handle =
4105 		    (ISP_READ(isp, OUTMAILBOX2) << 16) |
4106 		    (ISP_READ(isp, OUTMAILBOX1));
4107 		if (isp_target_async(isp, handle, mbox))
4108 			rval = -1;
4109 #else
4110 		isp_prt(isp, ISP_LOGINFO, "Fast Posting CTIO done");
4111 #endif
4112 		isp->isp_fphccmplt++;	/* count it as a fast posting intr */
4113 		break;
4114 	}
4115 	case ASYNC_LIP_F8:
4116 	case ASYNC_LIP_OCCURRED:
4117 		FCPARAM(isp)->isp_lipseq =
4118 		    ISP_READ(isp, OUTMAILBOX1);
4119 		FCPARAM(isp)->isp_fwstate = FW_CONFIG_WAIT;
4120 		FCPARAM(isp)->isp_loopstate = LOOP_LIP_RCVD;
4121 		isp->isp_sendmarker = 1;
4122 		isp_mark_getpdb_all(isp);
4123 		isp_async(isp, ISPASYNC_LIP, NULL);
4124 #ifdef	ISP_TARGET_MODE
4125 		if (isp_target_async(isp, bus, mbox))
4126 			rval = -1;
4127 #endif
4128 		/*
4129 		 * We've had problems with data corruption occuring on
4130 		 * commands that complete (with no apparent error) after
4131 		 * we receive a LIP. This has been observed mostly on
4132 		 * Local Loop topologies. To be safe, let's just mark
4133 		 * all active commands as dead.
4134 		 */
4135 		if (FCPARAM(isp)->isp_topo == TOPO_NL_PORT ||
4136 		    FCPARAM(isp)->isp_topo == TOPO_FL_PORT) {
4137 			int i, j;
4138 			for (i = j = 0; i < isp->isp_maxcmds; i++) {
4139 				XS_T *xs;
4140 				xs = isp->isp_xflist[i];
4141 				if (xs != NULL) {
4142 					j++;
4143 					XS_SETERR(xs, HBA_BUSRESET);
4144 				}
4145 			}
4146 			if (j) {
4147 				isp_prt(isp, ISP_LOGERR,
4148 				    "LIP destroyed %d active commands", j);
4149 			}
4150 		}
4151 		break;
4152 
4153 	case ASYNC_LOOP_UP:
4154 		isp->isp_sendmarker = 1;
4155 		FCPARAM(isp)->isp_fwstate = FW_CONFIG_WAIT;
4156 		FCPARAM(isp)->isp_loopstate = LOOP_LIP_RCVD;
4157 		isp_mark_getpdb_all(isp);
4158 		isp_async(isp, ISPASYNC_LOOP_UP, NULL);
4159 #ifdef	ISP_TARGET_MODE
4160 		if (isp_target_async(isp, bus, mbox))
4161 			rval = -1;
4162 #endif
4163 		break;
4164 
4165 	case ASYNC_LOOP_DOWN:
4166 		isp->isp_sendmarker = 1;
4167 		FCPARAM(isp)->isp_fwstate = FW_CONFIG_WAIT;
4168 		FCPARAM(isp)->isp_loopstate = LOOP_NIL;
4169 		isp_mark_getpdb_all(isp);
4170 		isp_async(isp, ISPASYNC_LOOP_DOWN, NULL);
4171 #ifdef	ISP_TARGET_MODE
4172 		if (isp_target_async(isp, bus, mbox))
4173 			rval = -1;
4174 #endif
4175 		break;
4176 
4177 	case ASYNC_LOOP_RESET:
4178 		isp->isp_sendmarker = 1;
4179 		FCPARAM(isp)->isp_fwstate = FW_CONFIG_WAIT;
4180 		FCPARAM(isp)->isp_loopstate = LOOP_NIL;
4181 		isp_mark_getpdb_all(isp);
4182 		isp_async(isp, ISPASYNC_LOOP_RESET, NULL);
4183 #ifdef	ISP_TARGET_MODE
4184 		if (isp_target_async(isp, bus, mbox))
4185 			rval = -1;
4186 #endif
4187 		break;
4188 
4189 	case ASYNC_PDB_CHANGED:
4190 		isp->isp_sendmarker = 1;
4191 		FCPARAM(isp)->isp_loopstate = LOOP_PDB_RCVD;
4192 		isp_mark_getpdb_all(isp);
4193 		isp_async(isp, ISPASYNC_CHANGE_NOTIFY, ISPASYNC_CHANGE_PDB);
4194 		break;
4195 
4196 	case ASYNC_CHANGE_NOTIFY:
4197 		/*
4198 		 * Not correct, but it will force us to rescan the loop.
4199 		 */
4200 		FCPARAM(isp)->isp_loopstate = LOOP_PDB_RCVD;
4201 		isp_mark_getpdb_all(isp);
4202 		isp_async(isp, ISPASYNC_CHANGE_NOTIFY, ISPASYNC_CHANGE_SNS);
4203 		break;
4204 
4205 	case ASYNC_PTPMODE:
4206 		if (FCPARAM(isp)->isp_onfabric)
4207 			FCPARAM(isp)->isp_topo = TOPO_F_PORT;
4208 		else
4209 			FCPARAM(isp)->isp_topo = TOPO_N_PORT;
4210 		isp_mark_getpdb_all(isp);
4211 		isp->isp_sendmarker = 1;
4212 		FCPARAM(isp)->isp_fwstate = FW_CONFIG_WAIT;
4213 		FCPARAM(isp)->isp_loopstate = LOOP_LIP_RCVD;
4214 		isp_async(isp, ISPASYNC_CHANGE_NOTIFY, ISPASYNC_CHANGE_OTHER);
4215 #ifdef	ISP_TARGET_MODE
4216 		if (isp_target_async(isp, bus, mbox))
4217 			rval = -1;
4218 #endif
4219 		isp_prt(isp, ISP_LOGINFO, "Point-to-Point mode");
4220 		break;
4221 
4222 	case ASYNC_CONNMODE:
4223 		mbox = ISP_READ(isp, OUTMAILBOX1);
4224 		isp_mark_getpdb_all(isp);
4225 		switch (mbox) {
4226 		case ISP_CONN_LOOP:
4227 			isp_prt(isp, ISP_LOGINFO,
4228 			    "Point-to-Point -> Loop mode");
4229 			break;
4230 		case ISP_CONN_PTP:
4231 			isp_prt(isp, ISP_LOGINFO,
4232 			    "Loop -> Point-to-Point mode");
4233 			break;
4234 		case ISP_CONN_BADLIP:
4235 			isp_prt(isp, ISP_LOGWARN,
4236 			    "Point-to-Point -> Loop mode (BAD LIP)");
4237 			break;
4238 		case ISP_CONN_FATAL:
4239 			isp_prt(isp, ISP_LOGERR, "FATAL CONNECTION ERROR");
4240 #ifdef	ISP_FW_CRASH_DUMP
4241 			isp_async(isp, ISPASYNC_FW_CRASH, NULL);
4242 #else
4243 			isp_async(isp, ISPASYNC_FW_CRASH, NULL);
4244 			isp_reinit(isp);
4245 			isp_async(isp, ISPASYNC_FW_RESTARTED, NULL);
4246 #endif
4247 			return (-1);
4248 		case ISP_CONN_LOOPBACK:
4249 			isp_prt(isp, ISP_LOGWARN,
4250 			    "Looped Back in Point-to-Point mode");
4251 			break;
4252 		default:
4253 			isp_prt(isp, ISP_LOGWARN,
4254 			    "Unknown connection mode (0x%x)", mbox);
4255 			break;
4256 		}
4257 		isp_async(isp, ISPASYNC_CHANGE_NOTIFY, ISPASYNC_CHANGE_OTHER);
4258 		isp->isp_sendmarker = 1;
4259 		FCPARAM(isp)->isp_fwstate = FW_CONFIG_WAIT;
4260 		FCPARAM(isp)->isp_loopstate = LOOP_LIP_RCVD;
4261 		break;
4262 
4263 	default:
4264 		isp_prt(isp, ISP_LOGWARN, "Unknown Async Code 0x%x", mbox);
4265 		break;
4266 	}
4267 
4268 	if (bus & 0x100) {
4269 		int i, nh;
4270 		u_int16_t handles[5];
4271 
4272 		for (nh = 0, i = 1; i < MAX_MAILBOX; i++) {
4273 			if ((bus & (1 << i)) == 0) {
4274 				continue;
4275 			}
4276 			handles[nh++] = ISP_READ(isp, MBOX_OFF(i));
4277 		}
4278 		for (i = 0; i < nh; i++) {
4279 			isp_fastpost_complete(isp, handles[i]);
4280 			isp_prt(isp,  ISP_LOGDEBUG3,
4281 			    "fast post completion of %u", handles[i]);
4282 		}
4283 		if (isp->isp_fpcchiwater < nh)
4284 			isp->isp_fpcchiwater = nh;
4285 	} else {
4286 		isp->isp_intoasync++;
4287 	}
4288 	return (rval);
4289 }
4290 
4291 /*
4292  * Handle other response entries. A pointer to the request queue output
4293  * index is here in case we want to eat several entries at once, although
4294  * this is not used currently.
4295  */
4296 
4297 static int
4298 isp_handle_other_response(struct ispsoftc *isp, int type,
4299     isphdr_t *hp, u_int16_t *optrp)
4300 {
4301 	switch (type) {
4302 	case RQSTYPE_STATUS_CONT:
4303 		isp_prt(isp, ISP_LOGINFO, "Ignored Continuation Response");
4304 		return (1);
4305 	case RQSTYPE_ATIO:
4306 	case RQSTYPE_CTIO:
4307 	case RQSTYPE_ENABLE_LUN:
4308 	case RQSTYPE_MODIFY_LUN:
4309 	case RQSTYPE_NOTIFY:
4310 	case RQSTYPE_NOTIFY_ACK:
4311 	case RQSTYPE_CTIO1:
4312 	case RQSTYPE_ATIO2:
4313 	case RQSTYPE_CTIO2:
4314 	case RQSTYPE_CTIO3:
4315 		isp->isp_rsltccmplt++;	/* count as a response completion */
4316 #ifdef	ISP_TARGET_MODE
4317 		if (isp_target_notify(isp, (ispstatusreq_t *) hp, optrp)) {
4318 			return (1);
4319 		}
4320 #endif
4321 		/* FALLTHROUGH */
4322 	case RQSTYPE_REQUEST:
4323 	default:
4324 		if (isp_async(isp, ISPASYNC_UNHANDLED_RESPONSE, hp)) {
4325 			return (1);
4326 		}
4327 		isp_prt(isp, ISP_LOGWARN, "Unhandled Response Type 0x%x",
4328 		    isp_get_response_type(isp, hp));
4329 		return (0);
4330 	}
4331 }
4332 
4333 static void
4334 isp_parse_status(struct ispsoftc *isp, ispstatusreq_t *sp, XS_T *xs)
4335 {
4336 	switch (sp->req_completion_status & 0xff) {
4337 	case RQCS_COMPLETE:
4338 		if (XS_NOERR(xs)) {
4339 			XS_SETERR(xs, HBA_NOERROR);
4340 		}
4341 		return;
4342 
4343 	case RQCS_INCOMPLETE:
4344 		if ((sp->req_state_flags & RQSF_GOT_TARGET) == 0) {
4345 			isp_prt(isp, ISP_LOGDEBUG1,
4346 			    "Selection Timeout for %d.%d.%d",
4347 			    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4348 			if (XS_NOERR(xs)) {
4349 				XS_SETERR(xs, HBA_SELTIMEOUT);
4350 			}
4351 			return;
4352 		}
4353 		isp_prt(isp, ISP_LOGERR,
4354 		    "command incomplete for %d.%d.%d, state 0x%x",
4355 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs),
4356 		    sp->req_state_flags);
4357 		break;
4358 
4359 	case RQCS_DMA_ERROR:
4360 		isp_prt(isp, ISP_LOGERR, "DMA error for command on %d.%d.%d",
4361 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4362 		break;
4363 
4364 	case RQCS_TRANSPORT_ERROR:
4365 	{
4366 		char buf[172];
4367 		SNPRINTF(buf, sizeof (buf), "states=>");
4368 		if (sp->req_state_flags & RQSF_GOT_BUS) {
4369 			SNPRINTF(buf, sizeof (buf), "%s GOT_BUS", buf);
4370 		}
4371 		if (sp->req_state_flags & RQSF_GOT_TARGET) {
4372 			SNPRINTF(buf, sizeof (buf), "%s GOT_TGT", buf);
4373 		}
4374 		if (sp->req_state_flags & RQSF_SENT_CDB) {
4375 			SNPRINTF(buf, sizeof (buf), "%s SENT_CDB", buf);
4376 		}
4377 		if (sp->req_state_flags & RQSF_XFRD_DATA) {
4378 			SNPRINTF(buf, sizeof (buf), "%s XFRD_DATA", buf);
4379 		}
4380 		if (sp->req_state_flags & RQSF_GOT_STATUS) {
4381 			SNPRINTF(buf, sizeof (buf), "%s GOT_STS", buf);
4382 		}
4383 		if (sp->req_state_flags & RQSF_GOT_SENSE) {
4384 			SNPRINTF(buf, sizeof (buf), "%s GOT_SNS", buf);
4385 		}
4386 		if (sp->req_state_flags & RQSF_XFER_COMPLETE) {
4387 			SNPRINTF(buf, sizeof (buf), "%s XFR_CMPLT", buf);
4388 		}
4389 		SNPRINTF(buf, sizeof (buf), "%s\nstatus=>", buf);
4390 		if (sp->req_status_flags & RQSTF_DISCONNECT) {
4391 			SNPRINTF(buf, sizeof (buf), "%s Disconnect", buf);
4392 		}
4393 		if (sp->req_status_flags & RQSTF_SYNCHRONOUS) {
4394 			SNPRINTF(buf, sizeof (buf), "%s Sync_xfr", buf);
4395 		}
4396 		if (sp->req_status_flags & RQSTF_PARITY_ERROR) {
4397 			SNPRINTF(buf, sizeof (buf), "%s Parity", buf);
4398 		}
4399 		if (sp->req_status_flags & RQSTF_BUS_RESET) {
4400 			SNPRINTF(buf, sizeof (buf), "%s Bus_Reset", buf);
4401 		}
4402 		if (sp->req_status_flags & RQSTF_DEVICE_RESET) {
4403 			SNPRINTF(buf, sizeof (buf), "%s Device_Reset", buf);
4404 		}
4405 		if (sp->req_status_flags & RQSTF_ABORTED) {
4406 			SNPRINTF(buf, sizeof (buf), "%s Aborted", buf);
4407 		}
4408 		if (sp->req_status_flags & RQSTF_TIMEOUT) {
4409 			SNPRINTF(buf, sizeof (buf), "%s Timeout", buf);
4410 		}
4411 		if (sp->req_status_flags & RQSTF_NEGOTIATION) {
4412 			SNPRINTF(buf, sizeof (buf), "%s Negotiation", buf);
4413 		}
4414 		isp_prt(isp, ISP_LOGERR, "%s", buf);
4415 		isp_prt(isp, ISP_LOGERR, "transport error for %d.%d.%d:\n%s",
4416 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs), buf);
4417 		break;
4418 	}
4419 	case RQCS_RESET_OCCURRED:
4420 		isp_prt(isp, ISP_LOGWARN,
4421 		    "bus reset destroyed command for %d.%d.%d",
4422 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4423 		isp->isp_sendmarker |= (1 << XS_CHANNEL(xs));
4424 		if (XS_NOERR(xs)) {
4425 			XS_SETERR(xs, HBA_BUSRESET);
4426 		}
4427 		return;
4428 
4429 	case RQCS_ABORTED:
4430 		isp_prt(isp, ISP_LOGERR, "command aborted for %d.%d.%d",
4431 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4432 		isp->isp_sendmarker |= (1 << XS_CHANNEL(xs));
4433 		if (XS_NOERR(xs)) {
4434 			XS_SETERR(xs, HBA_ABORTED);
4435 		}
4436 		return;
4437 
4438 	case RQCS_TIMEOUT:
4439 		isp_prt(isp, ISP_LOGWARN, "command timed out for %d.%d.%d",
4440 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4441 		/*
4442 	 	 * Check to see if we logged out the device.
4443 		 */
4444 		if (IS_FC(isp)) {
4445 			if ((sp->req_completion_status & RQSTF_LOGOUT) &&
4446 			    FCPARAM(isp)->portdb[XS_TGT(xs)].valid &&
4447 			    FCPARAM(isp)->portdb[XS_TGT(xs)].fabric_dev) {
4448 				FCPARAM(isp)->portdb[XS_TGT(xs)].relogin = 1;
4449 			}
4450 		}
4451 		if (XS_NOERR(xs)) {
4452 			XS_SETERR(xs, HBA_CMDTIMEOUT);
4453 		}
4454 		return;
4455 
4456 	case RQCS_DATA_OVERRUN:
4457 		XS_RESID(xs) = sp->req_resid;
4458 		isp_prt(isp, ISP_LOGERR, "data overrun for command on %d.%d.%d",
4459 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4460 		if (XS_NOERR(xs)) {
4461 			XS_SETERR(xs, HBA_DATAOVR);
4462 		}
4463 		return;
4464 
4465 	case RQCS_COMMAND_OVERRUN:
4466 		isp_prt(isp, ISP_LOGERR,
4467 		    "command overrun for command on %d.%d.%d",
4468 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4469 		break;
4470 
4471 	case RQCS_STATUS_OVERRUN:
4472 		isp_prt(isp, ISP_LOGERR,
4473 		    "status overrun for command on %d.%d.%d",
4474 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4475 		break;
4476 
4477 	case RQCS_BAD_MESSAGE:
4478 		isp_prt(isp, ISP_LOGERR,
4479 		    "msg not COMMAND COMPLETE after status %d.%d.%d",
4480 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4481 		break;
4482 
4483 	case RQCS_NO_MESSAGE_OUT:
4484 		isp_prt(isp, ISP_LOGERR,
4485 		    "No MESSAGE OUT phase after selection on %d.%d.%d",
4486 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4487 		break;
4488 
4489 	case RQCS_EXT_ID_FAILED:
4490 		isp_prt(isp, ISP_LOGERR, "EXTENDED IDENTIFY failed %d.%d.%d",
4491 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4492 		break;
4493 
4494 	case RQCS_IDE_MSG_FAILED:
4495 		isp_prt(isp, ISP_LOGERR,
4496 		    "INITIATOR DETECTED ERROR rejected by %d.%d.%d",
4497 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4498 		break;
4499 
4500 	case RQCS_ABORT_MSG_FAILED:
4501 		isp_prt(isp, ISP_LOGERR, "ABORT OPERATION rejected by %d.%d.%d",
4502 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4503 		break;
4504 
4505 	case RQCS_REJECT_MSG_FAILED:
4506 		isp_prt(isp, ISP_LOGERR, "MESSAGE REJECT rejected by %d.%d.%d",
4507 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4508 		break;
4509 
4510 	case RQCS_NOP_MSG_FAILED:
4511 		isp_prt(isp, ISP_LOGERR, "NOP rejected by %d.%d.%d",
4512 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4513 		break;
4514 
4515 	case RQCS_PARITY_ERROR_MSG_FAILED:
4516 		isp_prt(isp, ISP_LOGERR,
4517 		    "MESSAGE PARITY ERROR rejected by %d.%d.%d",
4518 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4519 		break;
4520 
4521 	case RQCS_DEVICE_RESET_MSG_FAILED:
4522 		isp_prt(isp, ISP_LOGWARN,
4523 		    "BUS DEVICE RESET rejected by %d.%d.%d",
4524 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4525 		break;
4526 
4527 	case RQCS_ID_MSG_FAILED:
4528 		isp_prt(isp, ISP_LOGERR, "IDENTIFY rejected by %d.%d.%d",
4529 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4530 		break;
4531 
4532 	case RQCS_UNEXP_BUS_FREE:
4533 		isp_prt(isp, ISP_LOGERR, "%d.%d.%d had an unexpected bus free",
4534 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4535 		break;
4536 
4537 	case RQCS_DATA_UNDERRUN:
4538 	{
4539 		if (IS_FC(isp)) {
4540 			int ru_marked = (sp->req_scsi_status & RQCS_RU) != 0;
4541 			if (!ru_marked || sp->req_resid > XS_XFRLEN(xs)) {
4542 				isp_prt(isp, ISP_LOGWARN, bun, XS_TGT(xs),
4543 				    XS_LUN(xs), XS_XFRLEN(xs), sp->req_resid,
4544 				    (ru_marked)? "marked" : "not marked");
4545 				if (XS_NOERR(xs)) {
4546 					XS_SETERR(xs, HBA_BOTCH);
4547 				}
4548 				return;
4549 			}
4550 		}
4551 		XS_RESID(xs) = sp->req_resid;
4552 		if (XS_NOERR(xs)) {
4553 			XS_SETERR(xs, HBA_NOERROR);
4554 		}
4555 		return;
4556 	}
4557 
4558 	case RQCS_XACT_ERR1:
4559 		isp_prt(isp, ISP_LOGERR, xact1, XS_CHANNEL(xs),
4560 		    XS_TGT(xs), XS_LUN(xs));
4561 		break;
4562 
4563 	case RQCS_XACT_ERR2:
4564 		isp_prt(isp, ISP_LOGERR, xact2,
4565 		    XS_LUN(xs), XS_TGT(xs), XS_CHANNEL(xs));
4566 		break;
4567 
4568 	case RQCS_XACT_ERR3:
4569 		isp_prt(isp, ISP_LOGERR, xact3,
4570 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4571 		break;
4572 
4573 	case RQCS_BAD_ENTRY:
4574 		isp_prt(isp, ISP_LOGERR, "Invalid IOCB entry type detected");
4575 		break;
4576 
4577 	case RQCS_QUEUE_FULL:
4578 		isp_prt(isp, ISP_LOGDEBUG0,
4579 		    "internal queues full for %d.%d.%d status 0x%x",
4580 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs), *XS_STSP(xs));
4581 
4582 		/*
4583 		 * If QFULL or some other status byte is set, then this
4584 		 * isn't an error, per se.
4585 		 *
4586 		 * Unfortunately, some QLogic f/w writers have, in
4587 		 * some cases, ommitted to *set* status to QFULL.
4588 		 *
4589 
4590 		if (*XS_STSP(xs) != SCSI_GOOD && XS_NOERR(xs)) {
4591 			XS_SETERR(xs, HBA_NOERROR);
4592 			return;
4593 		}
4594 
4595 		 *
4596 		 *
4597 		 */
4598 
4599 		*XS_STSP(xs) = SCSI_QFULL;
4600 		XS_SETERR(xs, HBA_NOERROR);
4601 		return;
4602 
4603 	case RQCS_PHASE_SKIPPED:
4604 		isp_prt(isp, ISP_LOGERR, pskip, XS_CHANNEL(xs),
4605 		    XS_TGT(xs), XS_LUN(xs));
4606 		break;
4607 
4608 	case RQCS_ARQS_FAILED:
4609 		isp_prt(isp, ISP_LOGERR,
4610 		    "Auto Request Sense failed for %d.%d.%d",
4611 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4612 		if (XS_NOERR(xs)) {
4613 			XS_SETERR(xs, HBA_ARQFAIL);
4614 		}
4615 		return;
4616 
4617 	case RQCS_WIDE_FAILED:
4618 		isp_prt(isp, ISP_LOGERR,
4619 		    "Wide Negotiation failed for %d.%d.%d",
4620 		    XS_TGT(xs), XS_LUN(xs), XS_CHANNEL(xs));
4621 		if (IS_SCSI(isp)) {
4622 			sdparam *sdp = isp->isp_param;
4623 			sdp += XS_CHANNEL(xs);
4624 			sdp->isp_devparam[XS_TGT(xs)].goal_flags &= ~DPARM_WIDE;
4625 			sdp->isp_devparam[XS_TGT(xs)].dev_update = 1;
4626 			isp->isp_update |= (1 << XS_CHANNEL(xs));
4627 		}
4628 		if (XS_NOERR(xs)) {
4629 			XS_SETERR(xs, HBA_NOERROR);
4630 		}
4631 		return;
4632 
4633 	case RQCS_SYNCXFER_FAILED:
4634 		isp_prt(isp, ISP_LOGERR,
4635 		    "SDTR Message failed for target %d.%d.%d",
4636 		    XS_TGT(xs), XS_LUN(xs), XS_CHANNEL(xs));
4637 		if (IS_SCSI(isp)) {
4638 			sdparam *sdp = isp->isp_param;
4639 			sdp += XS_CHANNEL(xs);
4640 			sdp->isp_devparam[XS_TGT(xs)].goal_flags &= ~DPARM_SYNC;
4641 			sdp->isp_devparam[XS_TGT(xs)].dev_update = 1;
4642 			isp->isp_update |= (1 << XS_CHANNEL(xs));
4643 		}
4644 		break;
4645 
4646 	case RQCS_LVD_BUSERR:
4647 		isp_prt(isp, ISP_LOGERR,
4648 		    "Bad LVD condition while talking to %d.%d.%d",
4649 		    XS_TGT(xs), XS_LUN(xs), XS_CHANNEL(xs));
4650 		break;
4651 
4652 	case RQCS_PORT_UNAVAILABLE:
4653 		/*
4654 		 * No such port on the loop. Moral equivalent of SELTIMEO
4655 		 */
4656 	case RQCS_PORT_LOGGED_OUT:
4657 		/*
4658 		 * It was there (maybe)- treat as a selection timeout.
4659 		 */
4660 		if ((sp->req_completion_status & 0xff) == RQCS_PORT_UNAVAILABLE)
4661 			isp_prt(isp, ISP_LOGINFO,
4662 			    "port unavailable for target %d", XS_TGT(xs));
4663 		else
4664 			isp_prt(isp, ISP_LOGINFO,
4665 			    "port logout for target %d", XS_TGT(xs));
4666 		/*
4667 		 * If we're on a local loop, force a LIP (which is overkill)
4668 		 * to force a re-login of this unit. If we're on fabric,
4669 		 * then we'll have to relogin as a matter of course.
4670 		 */
4671 		if (FCPARAM(isp)->isp_topo == TOPO_NL_PORT ||
4672 		    FCPARAM(isp)->isp_topo == TOPO_FL_PORT) {
4673 			mbreg_t mbs;
4674 			mbs.param[0] = MBOX_INIT_LIP;
4675 			isp_mboxcmd_qnw(isp, &mbs, 1);
4676 		}
4677 
4678 		/*
4679 		 * Probably overkill.
4680 		 */
4681 		isp->isp_sendmarker = 1;
4682 		FCPARAM(isp)->isp_loopstate = LOOP_PDB_RCVD;
4683 		isp_mark_getpdb_all(isp);
4684 		isp_async(isp, ISPASYNC_CHANGE_NOTIFY, ISPASYNC_CHANGE_OTHER);
4685 		if (XS_NOERR(xs)) {
4686 			XS_SETERR(xs, HBA_SELTIMEOUT);
4687 		}
4688 		return;
4689 
4690 	case RQCS_PORT_CHANGED:
4691 		isp_prt(isp, ISP_LOGWARN,
4692 		    "port changed for target %d", XS_TGT(xs));
4693 		if (XS_NOERR(xs)) {
4694 			XS_SETERR(xs, HBA_SELTIMEOUT);
4695 		}
4696 		return;
4697 
4698 	case RQCS_PORT_BUSY:
4699 		isp_prt(isp, ISP_LOGWARN,
4700 		    "port busy for target %d", XS_TGT(xs));
4701 		if (XS_NOERR(xs)) {
4702 			XS_SETERR(xs, HBA_TGTBSY);
4703 		}
4704 		return;
4705 
4706 	default:
4707 		isp_prt(isp, ISP_LOGERR, "Unknown Completion Status 0x%x",
4708 		    sp->req_completion_status);
4709 		break;
4710 	}
4711 	if (XS_NOERR(xs)) {
4712 		XS_SETERR(xs, HBA_BOTCH);
4713 	}
4714 }
4715 
4716 static void
4717 isp_fastpost_complete(struct ispsoftc *isp, u_int16_t fph)
4718 {
4719 	XS_T *xs;
4720 
4721 	if (fph == 0) {
4722 		return;
4723 	}
4724 	xs = isp_find_xs(isp, fph);
4725 	if (xs == NULL) {
4726 		isp_prt(isp, ISP_LOGWARN,
4727 		    "Command for fast post handle 0x%x not found", fph);
4728 		return;
4729 	}
4730 	isp_destroy_handle(isp, fph);
4731 
4732 	/*
4733 	 * Since we don't have a result queue entry item,
4734 	 * we must believe that SCSI status is zero and
4735 	 * that all data transferred.
4736 	 */
4737 	XS_SET_STATE_STAT(isp, xs, NULL);
4738 	XS_RESID(xs) = 0;
4739 	*XS_STSP(xs) = SCSI_GOOD;
4740 	if (XS_XFRLEN(xs)) {
4741 		ISP_DMAFREE(isp, xs, fph);
4742 	}
4743 	if (isp->isp_nactive)
4744 		isp->isp_nactive--;
4745 	isp->isp_fphccmplt++;
4746 	isp_done(xs);
4747 }
4748 
4749 static int
4750 isp_mbox_continue(struct ispsoftc *isp)
4751 {
4752 	mbreg_t mbs;
4753 	u_int16_t *ptr;
4754 
4755 	switch (isp->isp_lastmbxcmd) {
4756 	case MBOX_WRITE_RAM_WORD:
4757 	case MBOX_READ_RAM_WORD:
4758 	case MBOX_READ_RAM_WORD_EXTENDED:
4759 		break;
4760 	default:
4761 		return (1);
4762 	}
4763 	if (isp->isp_mboxtmp[0] != MBOX_COMMAND_COMPLETE) {
4764 		isp->isp_mbxwrk0 = 0;
4765 		return (-1);
4766 	}
4767 
4768 
4769 	/*
4770 	 * Clear the previous interrupt.
4771 	 */
4772 	ISP_WRITE(isp, HCCR, HCCR_CMD_CLEAR_RISC_INT);
4773 	ISP_WRITE(isp, BIU_SEMA, 0);
4774 
4775 	/*
4776 	 * Continue with next word.
4777 	 */
4778 	ptr = isp->isp_mbxworkp;
4779 	switch (isp->isp_lastmbxcmd) {
4780 	case MBOX_WRITE_RAM_WORD:
4781 		mbs.param[2] = *ptr++;
4782 		mbs.param[1] = isp->isp_mbxwrk1++;
4783 		break;
4784 	case MBOX_READ_RAM_WORD:
4785 	case MBOX_READ_RAM_WORD_EXTENDED:
4786 		*ptr++ = isp->isp_mboxtmp[2];
4787 		mbs.param[1] = isp->isp_mbxwrk1++;
4788 		break;
4789 	}
4790 	isp->isp_mbxworkp = ptr;
4791 	mbs.param[0] = isp->isp_lastmbxcmd;
4792 	isp->isp_mbxwrk0 -= 1;
4793 	isp_mboxcmd_qnw(isp, &mbs, 0);
4794 	return (0);
4795 }
4796 
4797 
4798 #define	HIBYT(x)			((x) >> 0x8)
4799 #define	LOBYT(x)			((x)  & 0xff)
4800 #define	ISPOPMAP(a, b)			(((a) << 8) | (b))
4801 static const u_int16_t mbpscsi[] = {
4802 	ISPOPMAP(0x01, 0x01),	/* 0x00: MBOX_NO_OP */
4803 	ISPOPMAP(0x1f, 0x01),	/* 0x01: MBOX_LOAD_RAM */
4804 	ISPOPMAP(0x03, 0x01),	/* 0x02: MBOX_EXEC_FIRMWARE */
4805 	ISPOPMAP(0x1f, 0x01),	/* 0x03: MBOX_DUMP_RAM */
4806 	ISPOPMAP(0x07, 0x07),	/* 0x04: MBOX_WRITE_RAM_WORD */
4807 	ISPOPMAP(0x03, 0x07),	/* 0x05: MBOX_READ_RAM_WORD */
4808 	ISPOPMAP(0x3f, 0x3f),	/* 0x06: MBOX_MAILBOX_REG_TEST */
4809 	ISPOPMAP(0x03, 0x07),	/* 0x07: MBOX_VERIFY_CHECKSUM	*/
4810 	ISPOPMAP(0x01, 0x0f),	/* 0x08: MBOX_ABOUT_FIRMWARE */
4811 	ISPOPMAP(0x00, 0x00),	/* 0x09: */
4812 	ISPOPMAP(0x00, 0x00),	/* 0x0a: */
4813 	ISPOPMAP(0x00, 0x00),	/* 0x0b: */
4814 	ISPOPMAP(0x00, 0x00),	/* 0x0c: */
4815 	ISPOPMAP(0x00, 0x00),	/* 0x0d: */
4816 	ISPOPMAP(0x01, 0x05),	/* 0x0e: MBOX_CHECK_FIRMWARE */
4817 	ISPOPMAP(0x00, 0x00),	/* 0x0f: */
4818 	ISPOPMAP(0x1f, 0x1f),	/* 0x10: MBOX_INIT_REQ_QUEUE */
4819 	ISPOPMAP(0x3f, 0x3f),	/* 0x11: MBOX_INIT_RES_QUEUE */
4820 	ISPOPMAP(0x0f, 0x0f),	/* 0x12: MBOX_EXECUTE_IOCB */
4821 	ISPOPMAP(0x03, 0x03),	/* 0x13: MBOX_WAKE_UP	*/
4822 	ISPOPMAP(0x01, 0x3f),	/* 0x14: MBOX_STOP_FIRMWARE */
4823 	ISPOPMAP(0x0f, 0x0f),	/* 0x15: MBOX_ABORT */
4824 	ISPOPMAP(0x03, 0x03),	/* 0x16: MBOX_ABORT_DEVICE */
4825 	ISPOPMAP(0x07, 0x07),	/* 0x17: MBOX_ABORT_TARGET */
4826 	ISPOPMAP(0x07, 0x07),	/* 0x18: MBOX_BUS_RESET */
4827 	ISPOPMAP(0x03, 0x07),	/* 0x19: MBOX_STOP_QUEUE */
4828 	ISPOPMAP(0x03, 0x07),	/* 0x1a: MBOX_START_QUEUE */
4829 	ISPOPMAP(0x03, 0x07),	/* 0x1b: MBOX_SINGLE_STEP_QUEUE */
4830 	ISPOPMAP(0x03, 0x07),	/* 0x1c: MBOX_ABORT_QUEUE */
4831 	ISPOPMAP(0x03, 0x4f),	/* 0x1d: MBOX_GET_DEV_QUEUE_STATUS */
4832 	ISPOPMAP(0x00, 0x00),	/* 0x1e: */
4833 	ISPOPMAP(0x01, 0x07),	/* 0x1f: MBOX_GET_FIRMWARE_STATUS */
4834 	ISPOPMAP(0x01, 0x07),	/* 0x20: MBOX_GET_INIT_SCSI_ID */
4835 	ISPOPMAP(0x01, 0x07),	/* 0x21: MBOX_GET_SELECT_TIMEOUT */
4836 	ISPOPMAP(0x01, 0xc7),	/* 0x22: MBOX_GET_RETRY_COUNT	*/
4837 	ISPOPMAP(0x01, 0x07),	/* 0x23: MBOX_GET_TAG_AGE_LIMIT */
4838 	ISPOPMAP(0x01, 0x03),	/* 0x24: MBOX_GET_CLOCK_RATE */
4839 	ISPOPMAP(0x01, 0x07),	/* 0x25: MBOX_GET_ACT_NEG_STATE */
4840 	ISPOPMAP(0x01, 0x07),	/* 0x26: MBOX_GET_ASYNC_DATA_SETUP_TIME */
4841 	ISPOPMAP(0x01, 0x07),	/* 0x27: MBOX_GET_PCI_PARAMS */
4842 	ISPOPMAP(0x03, 0x4f),	/* 0x28: MBOX_GET_TARGET_PARAMS */
4843 	ISPOPMAP(0x03, 0x0f),	/* 0x29: MBOX_GET_DEV_QUEUE_PARAMS */
4844 	ISPOPMAP(0x01, 0x07),	/* 0x2a: MBOX_GET_RESET_DELAY_PARAMS */
4845 	ISPOPMAP(0x00, 0x00),	/* 0x2b: */
4846 	ISPOPMAP(0x00, 0x00),	/* 0x2c: */
4847 	ISPOPMAP(0x00, 0x00),	/* 0x2d: */
4848 	ISPOPMAP(0x00, 0x00),	/* 0x2e: */
4849 	ISPOPMAP(0x00, 0x00),	/* 0x2f: */
4850 	ISPOPMAP(0x03, 0x03),	/* 0x30: MBOX_SET_INIT_SCSI_ID */
4851 	ISPOPMAP(0x07, 0x07),	/* 0x31: MBOX_SET_SELECT_TIMEOUT */
4852 	ISPOPMAP(0xc7, 0xc7),	/* 0x32: MBOX_SET_RETRY_COUNT	*/
4853 	ISPOPMAP(0x07, 0x07),	/* 0x33: MBOX_SET_TAG_AGE_LIMIT */
4854 	ISPOPMAP(0x03, 0x03),	/* 0x34: MBOX_SET_CLOCK_RATE */
4855 	ISPOPMAP(0x07, 0x07),	/* 0x35: MBOX_SET_ACT_NEG_STATE */
4856 	ISPOPMAP(0x07, 0x07),	/* 0x36: MBOX_SET_ASYNC_DATA_SETUP_TIME */
4857 	ISPOPMAP(0x07, 0x07),	/* 0x37: MBOX_SET_PCI_CONTROL_PARAMS */
4858 	ISPOPMAP(0x4f, 0x4f),	/* 0x38: MBOX_SET_TARGET_PARAMS */
4859 	ISPOPMAP(0x0f, 0x0f),	/* 0x39: MBOX_SET_DEV_QUEUE_PARAMS */
4860 	ISPOPMAP(0x07, 0x07),	/* 0x3a: MBOX_SET_RESET_DELAY_PARAMS */
4861 	ISPOPMAP(0x00, 0x00),	/* 0x3b: */
4862 	ISPOPMAP(0x00, 0x00),	/* 0x3c: */
4863 	ISPOPMAP(0x00, 0x00),	/* 0x3d: */
4864 	ISPOPMAP(0x00, 0x00),	/* 0x3e: */
4865 	ISPOPMAP(0x00, 0x00),	/* 0x3f: */
4866 	ISPOPMAP(0x01, 0x03),	/* 0x40: MBOX_RETURN_BIOS_BLOCK_ADDR */
4867 	ISPOPMAP(0x3f, 0x01),	/* 0x41: MBOX_WRITE_FOUR_RAM_WORDS */
4868 	ISPOPMAP(0x03, 0x07),	/* 0x42: MBOX_EXEC_BIOS_IOCB */
4869 	ISPOPMAP(0x00, 0x00),	/* 0x43: */
4870 	ISPOPMAP(0x00, 0x00),	/* 0x44: */
4871 	ISPOPMAP(0x03, 0x03),	/* 0x45: SET SYSTEM PARAMETER */
4872 	ISPOPMAP(0x01, 0x03),	/* 0x46: GET SYSTEM PARAMETER */
4873 	ISPOPMAP(0x00, 0x00),	/* 0x47: */
4874 	ISPOPMAP(0x01, 0xcf),	/* 0x48: GET SCAM CONFIGURATION */
4875 	ISPOPMAP(0xcf, 0xcf),	/* 0x49: SET SCAM CONFIGURATION */
4876 	ISPOPMAP(0x03, 0x03),	/* 0x4a: MBOX_SET_FIRMWARE_FEATURES */
4877 	ISPOPMAP(0x01, 0x03),	/* 0x4b: MBOX_GET_FIRMWARE_FEATURES */
4878 	ISPOPMAP(0x00, 0x00),	/* 0x4c: */
4879 	ISPOPMAP(0x00, 0x00),	/* 0x4d: */
4880 	ISPOPMAP(0x00, 0x00),	/* 0x4e: */
4881 	ISPOPMAP(0x00, 0x00),	/* 0x4f: */
4882 	ISPOPMAP(0xdf, 0xdf),	/* 0x50: LOAD RAM A64 */
4883 	ISPOPMAP(0xdf, 0xdf),	/* 0x51: DUMP RAM A64 */
4884 	ISPOPMAP(0xdf, 0xff),	/* 0x52: INITIALIZE REQUEST QUEUE A64 */
4885 	ISPOPMAP(0xef, 0xff),	/* 0x53: INITIALIZE RESPONSE QUEUE A64 */
4886 	ISPOPMAP(0xcf, 0x01),	/* 0x54: EXECUTE IOCB A64 */
4887 	ISPOPMAP(0x07, 0x01),	/* 0x55: ENABLE TARGET MODE */
4888 	ISPOPMAP(0x03, 0x0f),	/* 0x56: GET TARGET STATUS */
4889 	ISPOPMAP(0x00, 0x00),	/* 0x57: */
4890 	ISPOPMAP(0x00, 0x00),	/* 0x58: */
4891 	ISPOPMAP(0x00, 0x00),	/* 0x59: */
4892 	ISPOPMAP(0x03, 0x03),	/* 0x5a: SET DATA OVERRUN RECOVERY MODE */
4893 	ISPOPMAP(0x01, 0x03),	/* 0x5b: GET DATA OVERRUN RECOVERY MODE */
4894 	ISPOPMAP(0x0f, 0x0f),	/* 0x5c: SET HOST DATA */
4895 	ISPOPMAP(0x01, 0x01)	/* 0x5d: GET NOST DATA */
4896 };
4897 
4898 #ifndef	ISP_STRIPPED
4899 static char *scsi_mbcmd_names[] = {
4900 	"NO-OP",
4901 	"LOAD RAM",
4902 	"EXEC FIRMWARE",
4903 	"DUMP RAM",
4904 	"WRITE RAM WORD",
4905 	"READ RAM WORD",
4906 	"MAILBOX REG TEST",
4907 	"VERIFY CHECKSUM",
4908 	"ABOUT FIRMWARE",
4909 	NULL,
4910 	NULL,
4911 	NULL,
4912 	NULL,
4913 	NULL,
4914 	"CHECK FIRMWARE",
4915 	NULL,
4916 	"INIT REQUEST QUEUE",
4917 	"INIT RESULT QUEUE",
4918 	"EXECUTE IOCB",
4919 	"WAKE UP",
4920 	"STOP FIRMWARE",
4921 	"ABORT",
4922 	"ABORT DEVICE",
4923 	"ABORT TARGET",
4924 	"BUS RESET",
4925 	"STOP QUEUE",
4926 	"START QUEUE",
4927 	"SINGLE STEP QUEUE",
4928 	"ABORT QUEUE",
4929 	"GET DEV QUEUE STATUS",
4930 	NULL,
4931 	"GET FIRMWARE STATUS",
4932 	"GET INIT SCSI ID",
4933 	"GET SELECT TIMEOUT",
4934 	"GET RETRY COUNT",
4935 	"GET TAG AGE LIMIT",
4936 	"GET CLOCK RATE",
4937 	"GET ACT NEG STATE",
4938 	"GET ASYNC DATA SETUP TIME",
4939 	"GET PCI PARAMS",
4940 	"GET TARGET PARAMS",
4941 	"GET DEV QUEUE PARAMS",
4942 	"GET RESET DELAY PARAMS",
4943 	NULL,
4944 	NULL,
4945 	NULL,
4946 	NULL,
4947 	NULL,
4948 	"SET INIT SCSI ID",
4949 	"SET SELECT TIMEOUT",
4950 	"SET RETRY COUNT",
4951 	"SET TAG AGE LIMIT",
4952 	"SET CLOCK RATE",
4953 	"SET ACT NEG STATE",
4954 	"SET ASYNC DATA SETUP TIME",
4955 	"SET PCI CONTROL PARAMS",
4956 	"SET TARGET PARAMS",
4957 	"SET DEV QUEUE PARAMS",
4958 	"SET RESET DELAY PARAMS",
4959 	NULL,
4960 	NULL,
4961 	NULL,
4962 	NULL,
4963 	NULL,
4964 	"RETURN BIOS BLOCK ADDR",
4965 	"WRITE FOUR RAM WORDS",
4966 	"EXEC BIOS IOCB",
4967 	NULL,
4968 	NULL,
4969 	"SET SYSTEM PARAMETER",
4970 	"GET SYSTEM PARAMETER",
4971 	NULL,
4972 	"GET SCAM CONFIGURATION",
4973 	"SET SCAM CONFIGURATION",
4974 	"SET FIRMWARE FEATURES",
4975 	"GET FIRMWARE FEATURES",
4976 	NULL,
4977 	NULL,
4978 	NULL,
4979 	NULL,
4980 	"LOAD RAM A64",
4981 	"DUMP RAM A64",
4982 	"INITIALIZE REQUEST QUEUE A64",
4983 	"INITIALIZE RESPONSE QUEUE A64",
4984 	"EXECUTE IOCB A64",
4985 	"ENABLE TARGET MODE",
4986 	"GET TARGET MODE STATE",
4987 	NULL,
4988 	NULL,
4989 	NULL,
4990 	"SET DATA OVERRUN RECOVERY MODE",
4991 	"GET DATA OVERRUN RECOVERY MODE",
4992 	"SET HOST DATA",
4993 	"GET NOST DATA",
4994 };
4995 #endif
4996 
4997 static const u_int16_t mbpfc[] = {
4998 	ISPOPMAP(0x01, 0x01),	/* 0x00: MBOX_NO_OP */
4999 	ISPOPMAP(0x1f, 0x01),	/* 0x01: MBOX_LOAD_RAM */
5000 	ISPOPMAP(0x03, 0x01),	/* 0x02: MBOX_EXEC_FIRMWARE */
5001 	ISPOPMAP(0xdf, 0x01),	/* 0x03: MBOX_DUMP_RAM */
5002 	ISPOPMAP(0x07, 0x07),	/* 0x04: MBOX_WRITE_RAM_WORD */
5003 	ISPOPMAP(0x03, 0x07),	/* 0x05: MBOX_READ_RAM_WORD */
5004 	ISPOPMAP(0xff, 0xff),	/* 0x06: MBOX_MAILBOX_REG_TEST */
5005 	ISPOPMAP(0x03, 0x05),	/* 0x07: MBOX_VERIFY_CHECKSUM	*/
5006 	ISPOPMAP(0x01, 0x4f),	/* 0x08: MBOX_ABOUT_FIRMWARE */
5007 	ISPOPMAP(0xdf, 0x01),	/* 0x09: LOAD RAM */
5008 	ISPOPMAP(0xdf, 0x01),	/* 0x0a: DUMP RAM */
5009 	ISPOPMAP(0x00, 0x00),	/* 0x0b: */
5010 	ISPOPMAP(0x00, 0x00),	/* 0x0c: */
5011 	ISPOPMAP(0x00, 0x00),	/* 0x0d: */
5012 	ISPOPMAP(0x01, 0x05),	/* 0x0e: MBOX_CHECK_FIRMWARE */
5013 	ISPOPMAP(0x03, 0x07),	/* 0x0f: MBOX_READ_RAM_WORD_EXTENDED(1) */
5014 	ISPOPMAP(0x1f, 0x11),	/* 0x10: MBOX_INIT_REQ_QUEUE */
5015 	ISPOPMAP(0x2f, 0x21),	/* 0x11: MBOX_INIT_RES_QUEUE */
5016 	ISPOPMAP(0x0f, 0x01),	/* 0x12: MBOX_EXECUTE_IOCB */
5017 	ISPOPMAP(0x03, 0x03),	/* 0x13: MBOX_WAKE_UP	*/
5018 	ISPOPMAP(0x01, 0xff),	/* 0x14: MBOX_STOP_FIRMWARE */
5019 	ISPOPMAP(0x4f, 0x01),	/* 0x15: MBOX_ABORT */
5020 	ISPOPMAP(0x07, 0x01),	/* 0x16: MBOX_ABORT_DEVICE */
5021 	ISPOPMAP(0x07, 0x01),	/* 0x17: MBOX_ABORT_TARGET */
5022 	ISPOPMAP(0x03, 0x03),	/* 0x18: MBOX_BUS_RESET */
5023 	ISPOPMAP(0x07, 0x05),	/* 0x19: MBOX_STOP_QUEUE */
5024 	ISPOPMAP(0x07, 0x05),	/* 0x1a: MBOX_START_QUEUE */
5025 	ISPOPMAP(0x07, 0x05),	/* 0x1b: MBOX_SINGLE_STEP_QUEUE */
5026 	ISPOPMAP(0x07, 0x05),	/* 0x1c: MBOX_ABORT_QUEUE */
5027 	ISPOPMAP(0x07, 0x03),	/* 0x1d: MBOX_GET_DEV_QUEUE_STATUS */
5028 	ISPOPMAP(0x00, 0x00),	/* 0x1e: */
5029 	ISPOPMAP(0x01, 0x07),	/* 0x1f: MBOX_GET_FIRMWARE_STATUS */
5030 	ISPOPMAP(0x01, 0x4f),	/* 0x20: MBOX_GET_LOOP_ID */
5031 	ISPOPMAP(0x00, 0x00),	/* 0x21: */
5032 	ISPOPMAP(0x01, 0x07),	/* 0x22: MBOX_GET_RETRY_COUNT	*/
5033 	ISPOPMAP(0x00, 0x00),	/* 0x23: */
5034 	ISPOPMAP(0x00, 0x00),	/* 0x24: */
5035 	ISPOPMAP(0x00, 0x00),	/* 0x25: */
5036 	ISPOPMAP(0x00, 0x00),	/* 0x26: */
5037 	ISPOPMAP(0x00, 0x00),	/* 0x27: */
5038 	ISPOPMAP(0x01, 0x03),	/* 0x28: MBOX_GET_FIRMWARE_OPTIONS */
5039 	ISPOPMAP(0x03, 0x07),	/* 0x29: MBOX_GET_PORT_QUEUE_PARAMS */
5040 	ISPOPMAP(0x00, 0x00),	/* 0x2a: */
5041 	ISPOPMAP(0x00, 0x00),	/* 0x2b: */
5042 	ISPOPMAP(0x00, 0x00),	/* 0x2c: */
5043 	ISPOPMAP(0x00, 0x00),	/* 0x2d: */
5044 	ISPOPMAP(0x00, 0x00),	/* 0x2e: */
5045 	ISPOPMAP(0x00, 0x00),	/* 0x2f: */
5046 	ISPOPMAP(0x00, 0x00),	/* 0x30: */
5047 	ISPOPMAP(0x00, 0x00),	/* 0x31: */
5048 	ISPOPMAP(0x07, 0x07),	/* 0x32: MBOX_SET_RETRY_COUNT	*/
5049 	ISPOPMAP(0x00, 0x00),	/* 0x33: */
5050 	ISPOPMAP(0x00, 0x00),	/* 0x34: */
5051 	ISPOPMAP(0x00, 0x00),	/* 0x35: */
5052 	ISPOPMAP(0x00, 0x00),	/* 0x36: */
5053 	ISPOPMAP(0x00, 0x00),	/* 0x37: */
5054 	ISPOPMAP(0x0f, 0x01),	/* 0x38: MBOX_SET_FIRMWARE_OPTIONS */
5055 	ISPOPMAP(0x0f, 0x07),	/* 0x39: MBOX_SET_PORT_QUEUE_PARAMS */
5056 	ISPOPMAP(0x00, 0x00),	/* 0x3a: */
5057 	ISPOPMAP(0x00, 0x00),	/* 0x3b: */
5058 	ISPOPMAP(0x00, 0x00),	/* 0x3c: */
5059 	ISPOPMAP(0x00, 0x00),	/* 0x3d: */
5060 	ISPOPMAP(0x00, 0x00),	/* 0x3e: */
5061 	ISPOPMAP(0x00, 0x00),	/* 0x3f: */
5062 	ISPOPMAP(0x03, 0x01),	/* 0x40: MBOX_LOOP_PORT_BYPASS */
5063 	ISPOPMAP(0x03, 0x01),	/* 0x41: MBOX_LOOP_PORT_ENABLE */
5064 	ISPOPMAP(0x03, 0x07),	/* 0x42: MBOX_GET_RESOURCE_COUNTS */
5065 	ISPOPMAP(0x01, 0x01),	/* 0x43: MBOX_REQUEST_NON_PARTICIPATING_MODE */
5066 	ISPOPMAP(0x00, 0x00),	/* 0x44: */
5067 	ISPOPMAP(0x00, 0x00),	/* 0x45: */
5068 	ISPOPMAP(0x00, 0x00),	/* 0x46: */
5069 	ISPOPMAP(0xcf, 0x03),	/* 0x47: GET PORT_DATABASE ENHANCED */
5070 	ISPOPMAP(0x00, 0x00),	/* 0x48: */
5071 	ISPOPMAP(0x00, 0x00),	/* 0x49: */
5072 	ISPOPMAP(0x00, 0x00),	/* 0x4a: */
5073 	ISPOPMAP(0x00, 0x00),	/* 0x4b: */
5074 	ISPOPMAP(0x00, 0x00),	/* 0x4c: */
5075 	ISPOPMAP(0x00, 0x00),	/* 0x4d: */
5076 	ISPOPMAP(0x00, 0x00),	/* 0x4e: */
5077 	ISPOPMAP(0x00, 0x00),	/* 0x4f: */
5078 	ISPOPMAP(0x00, 0x00),	/* 0x50: */
5079 	ISPOPMAP(0x00, 0x00),	/* 0x51: */
5080 	ISPOPMAP(0x00, 0x00),	/* 0x52: */
5081 	ISPOPMAP(0x00, 0x00),	/* 0x53: */
5082 	ISPOPMAP(0xcf, 0x01),	/* 0x54: EXECUTE IOCB A64 */
5083 	ISPOPMAP(0x00, 0x00),	/* 0x55: */
5084 	ISPOPMAP(0x00, 0x00),	/* 0x56: */
5085 	ISPOPMAP(0x00, 0x00),	/* 0x57: */
5086 	ISPOPMAP(0x00, 0x00),	/* 0x58: */
5087 	ISPOPMAP(0x00, 0x00),	/* 0x59: */
5088 	ISPOPMAP(0x00, 0x00),	/* 0x5a: */
5089 	ISPOPMAP(0x03, 0x01),	/* 0x5b: MBOX_DRIVER_HEARTBEAT */
5090 	ISPOPMAP(0xcf, 0x01),	/* 0x5c: MBOX_FW_HEARTBEAT */
5091 	ISPOPMAP(0x07, 0x03),	/* 0x5d: MBOX_GET_SET_DATA_RATE */
5092 	ISPOPMAP(0x00, 0x00),	/* 0x5e: */
5093 	ISPOPMAP(0x00, 0x00),	/* 0x5f: */
5094 	ISPOPMAP(0xfd, 0x31),	/* 0x60: MBOX_INIT_FIRMWARE */
5095 	ISPOPMAP(0x00, 0x00),	/* 0x61: */
5096 	ISPOPMAP(0x01, 0x01),	/* 0x62: MBOX_INIT_LIP */
5097 	ISPOPMAP(0xcd, 0x03),	/* 0x63: MBOX_GET_FC_AL_POSITION_MAP */
5098 	ISPOPMAP(0xcf, 0x01),	/* 0x64: MBOX_GET_PORT_DB */
5099 	ISPOPMAP(0x07, 0x01),	/* 0x65: MBOX_CLEAR_ACA */
5100 	ISPOPMAP(0x07, 0x01),	/* 0x66: MBOX_TARGET_RESET */
5101 	ISPOPMAP(0x07, 0x01),	/* 0x67: MBOX_CLEAR_TASK_SET */
5102 	ISPOPMAP(0x07, 0x01),	/* 0x68: MBOX_ABORT_TASK_SET */
5103 	ISPOPMAP(0x01, 0x07),	/* 0x69: MBOX_GET_FW_STATE */
5104 	ISPOPMAP(0x03, 0xcf),	/* 0x6a: MBOX_GET_PORT_NAME */
5105 	ISPOPMAP(0xcf, 0x01),	/* 0x6b: MBOX_GET_LINK_STATUS */
5106 	ISPOPMAP(0x0f, 0x01),	/* 0x6c: MBOX_INIT_LIP_RESET */
5107 	ISPOPMAP(0x00, 0x00),	/* 0x6d: */
5108 	ISPOPMAP(0xcf, 0x03),	/* 0x6e: MBOX_SEND_SNS */
5109 	ISPOPMAP(0x0f, 0x07),	/* 0x6f: MBOX_FABRIC_LOGIN */
5110 	ISPOPMAP(0x03, 0x01),	/* 0x70: MBOX_SEND_CHANGE_REQUEST */
5111 	ISPOPMAP(0x03, 0x03),	/* 0x71: MBOX_FABRIC_LOGOUT */
5112 	ISPOPMAP(0x0f, 0x0f),	/* 0x72: MBOX_INIT_LIP_LOGIN */
5113 	ISPOPMAP(0x00, 0x00),	/* 0x73: */
5114 	ISPOPMAP(0x07, 0x01),	/* 0x74: LOGIN LOOP PORT */
5115 	ISPOPMAP(0xcf, 0x03),	/* 0x75: GET PORT/NODE NAME LIST */
5116 	ISPOPMAP(0x4f, 0x01),	/* 0x76: SET VENDOR ID */
5117 	ISPOPMAP(0xcd, 0x01),	/* 0x77: INITIALIZE IP MAILBOX */
5118 	ISPOPMAP(0x00, 0x00),	/* 0x78: */
5119 	ISPOPMAP(0x00, 0x00),	/* 0x79: */
5120 	ISPOPMAP(0x00, 0x00),	/* 0x7a: */
5121 	ISPOPMAP(0x00, 0x00),	/* 0x7b: */
5122 	ISPOPMAP(0x4f, 0x03),	/* 0x7c: Get ID List */
5123 	ISPOPMAP(0xcf, 0x01),	/* 0x7d: SEND LFA */
5124 	ISPOPMAP(0x07, 0x01)	/* 0x7e: Lun RESET */
5125 };
5126 /*
5127  * Footnotes
5128  *
5129  * (1): this sets bits 21..16 in mailbox register #8, which we nominally
5130  *	do not access at this time in the core driver. The caller is
5131  *	responsible for setting this register first (Gross!).
5132  */
5133 
5134 #ifndef	ISP_STRIPPED
5135 static char *fc_mbcmd_names[] = {
5136 	"NO-OP",
5137 	"LOAD RAM",
5138 	"EXEC FIRMWARE",
5139 	"DUMP RAM",
5140 	"WRITE RAM WORD",
5141 	"READ RAM WORD",
5142 	"MAILBOX REG TEST",
5143 	"VERIFY CHECKSUM",
5144 	"ABOUT FIRMWARE",
5145 	"LOAD RAM",
5146 	"DUMP RAM",
5147 	NULL,
5148 	NULL,
5149 	"READ RAM WORD EXTENDED",
5150 	"CHECK FIRMWARE",
5151 	NULL,
5152 	"INIT REQUEST QUEUE",
5153 	"INIT RESULT QUEUE",
5154 	"EXECUTE IOCB",
5155 	"WAKE UP",
5156 	"STOP FIRMWARE",
5157 	"ABORT",
5158 	"ABORT DEVICE",
5159 	"ABORT TARGET",
5160 	"BUS RESET",
5161 	"STOP QUEUE",
5162 	"START QUEUE",
5163 	"SINGLE STEP QUEUE",
5164 	"ABORT QUEUE",
5165 	"GET DEV QUEUE STATUS",
5166 	NULL,
5167 	"GET FIRMWARE STATUS",
5168 	"GET LOOP ID",
5169 	NULL,
5170 	"GET RETRY COUNT",
5171 	NULL,
5172 	NULL,
5173 	NULL,
5174 	NULL,
5175 	NULL,
5176 	"GET FIRMWARE OPTIONS",
5177 	"GET PORT QUEUE PARAMS",
5178 	NULL,
5179 	NULL,
5180 	NULL,
5181 	NULL,
5182 	NULL,
5183 	NULL,
5184 	NULL,
5185 	NULL,
5186 	"SET RETRY COUNT",
5187 	NULL,
5188 	NULL,
5189 	NULL,
5190 	NULL,
5191 	NULL,
5192 	"SET FIRMWARE OPTIONS",
5193 	"SET PORT QUEUE PARAMS",
5194 	NULL,
5195 	NULL,
5196 	NULL,
5197 	NULL,
5198 	NULL,
5199 	NULL,
5200 	"LOOP PORT BYPASS",
5201 	"LOOP PORT ENABLE",
5202 	"GET RESOURCE COUNTS",
5203 	"REQUEST NON PARTICIPATING MODE",
5204 	NULL,
5205 	NULL,
5206 	NULL,
5207 	"GET PORT DATABASE,, ENHANCED",
5208 	NULL,
5209 	NULL,
5210 	NULL,
5211 	NULL,
5212 	NULL,
5213 	NULL,
5214 	NULL,
5215 	NULL,
5216 	NULL,
5217 	NULL,
5218 	NULL,
5219 	NULL,
5220 	"EXECUTE IOCB A64",
5221 	NULL,
5222 	NULL,
5223 	NULL,
5224 	NULL,
5225 	NULL,
5226 	NULL,
5227 	"DRIVER HEARTBEAT",
5228 	NULL,
5229 	"GET/SET DATA RATE",
5230 	NULL,
5231 	NULL,
5232 	"INIT FIRMWARE",
5233 	NULL,
5234 	"INIT LIP",
5235 	"GET FC-AL POSITION MAP",
5236 	"GET PORT DATABASE",
5237 	"CLEAR ACA",
5238 	"TARGET RESET",
5239 	"CLEAR TASK SET",
5240 	"ABORT TASK SET",
5241 	"GET FW STATE",
5242 	"GET PORT NAME",
5243 	"GET LINK STATUS",
5244 	"INIT LIP RESET",
5245 	NULL,
5246 	"SEND SNS",
5247 	"FABRIC LOGIN",
5248 	"SEND CHANGE REQUEST",
5249 	"FABRIC LOGOUT",
5250 	"INIT LIP LOGIN",
5251 	NULL,
5252 	"LOGIN LOOP PORT",
5253 	"GET PORT/NODE NAME LIST",
5254 	"SET VENDOR ID",
5255 	"INITIALIZE IP MAILBOX",
5256 	NULL,
5257 	NULL,
5258 	NULL,
5259 	NULL,
5260 	"Get ID List",
5261 	"SEND LFA",
5262 	"Lun RESET"
5263 };
5264 #endif
5265 
5266 static void
5267 isp_mboxcmd_qnw(struct ispsoftc *isp, mbreg_t *mbp, int nodelay)
5268 {
5269 	unsigned int ibits, obits, box, opcode;
5270 	const u_int16_t *mcp;
5271 
5272 	if (IS_FC(isp)) {
5273 		mcp = mbpfc;
5274 	} else {
5275 		mcp = mbpscsi;
5276 	}
5277 	opcode = mbp->param[0];
5278 	ibits = HIBYT(mcp[opcode]) & NMBOX_BMASK(isp);
5279 	obits = LOBYT(mcp[opcode]) & NMBOX_BMASK(isp);
5280 	for (box = 0; box < MAX_MAILBOX; box++) {
5281 		if (ibits & (1 << box)) {
5282 			ISP_WRITE(isp, MBOX_OFF(box), mbp->param[box]);
5283 		}
5284 		if (nodelay == 0) {
5285 			isp->isp_mboxtmp[box] = mbp->param[box] = 0;
5286 		}
5287 	}
5288 	if (nodelay == 0) {
5289 		isp->isp_lastmbxcmd = opcode;
5290 		isp->isp_obits = obits;
5291 		isp->isp_mboxbsy = 1;
5292 	}
5293 	ISP_WRITE(isp, HCCR, HCCR_CMD_SET_HOST_INT);
5294 	/*
5295 	 * Oddly enough, if we're not delaying for an answer,
5296 	 * delay a bit to give the f/w a chance to pick up the
5297 	 * command.
5298 	 */
5299 	if (nodelay) {
5300 		USEC_DELAY(1000);
5301 	}
5302 }
5303 
5304 static void
5305 isp_mboxcmd(struct ispsoftc *isp, mbreg_t *mbp, int logmask)
5306 {
5307 	char *cname, *xname, tname[16], mname[16];
5308 	unsigned int lim, ibits, obits, box, opcode;
5309 	const u_int16_t *mcp;
5310 
5311 	if (IS_FC(isp)) {
5312 		mcp = mbpfc;
5313 		lim = (sizeof (mbpfc) / sizeof (mbpfc[0]));
5314 	} else {
5315 		mcp = mbpscsi;
5316 		lim = (sizeof (mbpscsi) / sizeof (mbpscsi[0]));
5317 	}
5318 
5319 	if ((opcode = mbp->param[0]) >= lim) {
5320 		mbp->param[0] = MBOX_INVALID_COMMAND;
5321 		isp_prt(isp, ISP_LOGERR, "Unknown Command 0x%x", opcode);
5322 		return;
5323 	}
5324 
5325 	ibits = HIBYT(mcp[opcode]) & NMBOX_BMASK(isp);
5326 	obits = LOBYT(mcp[opcode]) & NMBOX_BMASK(isp);
5327 
5328 	if (ibits == 0 && obits == 0) {
5329 		mbp->param[0] = MBOX_COMMAND_PARAM_ERROR;
5330 		isp_prt(isp, ISP_LOGERR, "no parameters for 0x%x", opcode);
5331 		return;
5332 	}
5333 
5334 	/*
5335 	 * Get exclusive usage of mailbox registers.
5336 	 */
5337 	MBOX_ACQUIRE(isp);
5338 
5339 	for (box = 0; box < MAX_MAILBOX; box++) {
5340 		if (ibits & (1 << box)) {
5341 			ISP_WRITE(isp, MBOX_OFF(box), mbp->param[box]);
5342 		}
5343 		isp->isp_mboxtmp[box] = mbp->param[box] = 0;
5344 	}
5345 
5346 	isp->isp_lastmbxcmd = opcode;
5347 
5348 	/*
5349 	 * We assume that we can't overwrite a previous command.
5350 	 */
5351 	isp->isp_obits = obits;
5352 	isp->isp_mboxbsy = 1;
5353 
5354 	/*
5355 	 * Set Host Interrupt condition so that RISC will pick up mailbox regs.
5356 	 */
5357 	ISP_WRITE(isp, HCCR, HCCR_CMD_SET_HOST_INT);
5358 
5359 	/*
5360 	 * While we haven't finished the command, spin our wheels here.
5361 	 */
5362 	MBOX_WAIT_COMPLETE(isp);
5363 
5364 	if (isp->isp_mboxbsy) {
5365 		/*
5366 		 * Command timed out.
5367 		 */
5368 		isp->isp_mboxbsy = 0;
5369 		MBOX_RELEASE(isp);
5370 		return;
5371 	}
5372 
5373 	/*
5374 	 * Copy back output registers.
5375 	 */
5376 	for (box = 0; box < MAX_MAILBOX; box++) {
5377 		if (obits & (1 << box)) {
5378 			mbp->param[box] = isp->isp_mboxtmp[box];
5379 		}
5380 	}
5381 
5382 	MBOX_RELEASE(isp);
5383 
5384 	if (logmask == 0 || opcode == MBOX_EXEC_FIRMWARE) {
5385 		return;
5386 	}
5387 #ifdef	ISP_STRIPPED
5388 	cname = NULL;
5389 #else
5390 	cname = (IS_FC(isp))? fc_mbcmd_names[opcode] : scsi_mbcmd_names[opcode];
5391 #endif
5392 	if (cname == NULL) {
5393 		cname = tname;
5394 		SNPRINTF(tname, sizeof tname, "opcode %x", opcode);
5395 	}
5396 
5397 	/*
5398 	 * Just to be chatty here...
5399 	 */
5400 	xname = NULL;
5401 	switch (mbp->param[0]) {
5402 	case MBOX_COMMAND_COMPLETE:
5403 		break;
5404 	case MBOX_INVALID_COMMAND:
5405 		if (logmask & MBLOGMASK(MBOX_COMMAND_COMPLETE))
5406 			xname = "INVALID COMMAND";
5407 		break;
5408 	case MBOX_HOST_INTERFACE_ERROR:
5409 		if (logmask & MBLOGMASK(MBOX_HOST_INTERFACE_ERROR))
5410 			xname = "HOST INTERFACE ERROR";
5411 		break;
5412 	case MBOX_TEST_FAILED:
5413 		if (logmask & MBLOGMASK(MBOX_TEST_FAILED))
5414 			xname = "TEST FAILED";
5415 		break;
5416 	case MBOX_COMMAND_ERROR:
5417 		if (logmask & MBLOGMASK(MBOX_COMMAND_ERROR))
5418 			xname = "COMMAND ERROR";
5419 		break;
5420 	case MBOX_COMMAND_PARAM_ERROR:
5421 		if (logmask & MBLOGMASK(MBOX_COMMAND_PARAM_ERROR))
5422 			xname = "COMMAND PARAMETER ERROR";
5423 		break;
5424 	case MBOX_LOOP_ID_USED:
5425 		if (logmask & MBLOGMASK(MBOX_LOOP_ID_USED))
5426 			xname = "LOOP ID ALREADY IN USE";
5427 		break;
5428 	case MBOX_PORT_ID_USED:
5429 		if (logmask & MBLOGMASK(MBOX_PORT_ID_USED))
5430 			xname = "PORT ID ALREADY IN USE";
5431 		break;
5432 	case MBOX_ALL_IDS_USED:
5433 		if (logmask & MBLOGMASK(MBOX_ALL_IDS_USED))
5434 			xname = "ALL LOOP IDS IN USE";
5435 		break;
5436 	case 0:		/* special case */
5437 		xname = "TIMEOUT";
5438 		break;
5439 	default:
5440 		SNPRINTF(mname, sizeof mname, "error 0x%x", mbp->param[0]);
5441 		xname = mname;
5442 		break;
5443 	}
5444 	if (xname)
5445 		isp_prt(isp, ISP_LOGALL, "Mailbox Command '%s' failed (%s)",
5446 		    cname, xname);
5447 }
5448 
5449 static void
5450 isp_fw_state(struct ispsoftc *isp)
5451 {
5452 	if (IS_FC(isp)) {
5453 		mbreg_t mbs;
5454 		fcparam *fcp = isp->isp_param;
5455 
5456 		mbs.param[0] = MBOX_GET_FW_STATE;
5457 		isp_mboxcmd(isp, &mbs, MBLOGALL);
5458 		if (mbs.param[0] == MBOX_COMMAND_COMPLETE) {
5459 			fcp->isp_fwstate = mbs.param[1];
5460 		}
5461 	}
5462 }
5463 
5464 static void
5465 isp_update(struct ispsoftc *isp)
5466 {
5467 	int bus, upmask;
5468 
5469 	for (bus = 0, upmask = isp->isp_update; upmask != 0; bus++) {
5470 		if (upmask & (1 << bus)) {
5471 			isp_update_bus(isp, bus);
5472 		}
5473 		upmask &= ~(1 << bus);
5474 	}
5475 }
5476 
5477 static void
5478 isp_update_bus(struct ispsoftc *isp, int bus)
5479 {
5480 	int tgt;
5481 	mbreg_t mbs;
5482 	sdparam *sdp;
5483 
5484 	isp->isp_update &= ~(1 << bus);
5485 	if (IS_FC(isp)) {
5486 		/*
5487 		 * There are no 'per-bus' settings for Fibre Channel.
5488 		 */
5489 		return;
5490 	}
5491 	sdp = isp->isp_param;
5492 	sdp += bus;
5493 
5494 	for (tgt = 0; tgt < MAX_TARGETS; tgt++) {
5495 		u_int16_t flags, period, offset;
5496 		int get;
5497 
5498 		if (sdp->isp_devparam[tgt].dev_enable == 0) {
5499 			sdp->isp_devparam[tgt].dev_update = 0;
5500 			sdp->isp_devparam[tgt].dev_refresh = 0;
5501 			isp_prt(isp, ISP_LOGDEBUG0,
5502 	 		    "skipping target %d bus %d update", tgt, bus);
5503 			continue;
5504 		}
5505 		/*
5506 		 * If the goal is to update the status of the device,
5507 		 * take what's in goal_flags and try and set the device
5508 		 * toward that. Otherwise, if we're just refreshing the
5509 		 * current device state, get the current parameters.
5510 		 */
5511 
5512 		/*
5513 		 * Refresh overrides set
5514 		 */
5515 		if (sdp->isp_devparam[tgt].dev_refresh) {
5516 			mbs.param[0] = MBOX_GET_TARGET_PARAMS;
5517 			sdp->isp_devparam[tgt].dev_refresh = 0;
5518 			get = 1;
5519 		} else if (sdp->isp_devparam[tgt].dev_update) {
5520 			mbs.param[0] = MBOX_SET_TARGET_PARAMS;
5521 			/*
5522 			 * Make sure goal_flags has "Renegotiate on Error"
5523 			 * on and "Freeze Queue on Error" off.
5524 			 */
5525 			sdp->isp_devparam[tgt].goal_flags |= DPARM_RENEG;
5526 			sdp->isp_devparam[tgt].goal_flags &= ~DPARM_QFRZ;
5527 
5528 			mbs.param[2] = sdp->isp_devparam[tgt].goal_flags;
5529 
5530 			/*
5531 			 * Insist that PARITY must be enabled
5532 			 * if SYNC or WIDE is enabled.
5533 			 */
5534 			if ((mbs.param[2] & (DPARM_SYNC|DPARM_WIDE)) != 0) {
5535 				mbs.param[2] |= DPARM_PARITY;
5536 			}
5537 
5538 			if ((mbs.param[2] & DPARM_SYNC) == 0) {
5539 				mbs.param[3] = 0;
5540 			} else {
5541 				mbs.param[3] =
5542 				    (sdp->isp_devparam[tgt].goal_offset << 8) |
5543 				    (sdp->isp_devparam[tgt].goal_period);
5544 			}
5545 			/*
5546 			 * A command completion later that has
5547 			 * RQSTF_NEGOTIATION set can cause
5548 			 * the dev_refresh/announce cycle also.
5549 			 *
5550 			 * Note: It is really important to update our current
5551 			 * flags with at least the state of TAG capabilities-
5552 			 * otherwise we might try and send a tagged command
5553 			 * when we have it all turned off. So change it here
5554 			 * to say that current already matches goal.
5555 			 */
5556 			sdp->isp_devparam[tgt].actv_flags &= ~DPARM_TQING;
5557 			sdp->isp_devparam[tgt].actv_flags |=
5558 			    (sdp->isp_devparam[tgt].goal_flags & DPARM_TQING);
5559 			isp_prt(isp, ISP_LOGDEBUG0,
5560 			    "bus %d set tgt %d flags 0x%x off 0x%x period 0x%x",
5561 			    bus, tgt, mbs.param[2], mbs.param[3] >> 8,
5562 			    mbs.param[3] & 0xff);
5563 			sdp->isp_devparam[tgt].dev_update = 0;
5564 			sdp->isp_devparam[tgt].dev_refresh = 1;
5565 			get = 0;
5566 		} else {
5567 			continue;
5568 		}
5569 		mbs.param[1] = (bus << 15) | (tgt << 8);
5570 		isp_mboxcmd(isp, &mbs, MBLOGALL);
5571 		if (get == 0) {
5572 			isp->isp_sendmarker |= (1 << bus);
5573 			continue;
5574 		}
5575 		flags = mbs.param[2];
5576 		period = mbs.param[3] & 0xff;
5577 		offset = mbs.param[3] >> 8;
5578 		sdp->isp_devparam[tgt].actv_flags = flags;
5579 		sdp->isp_devparam[tgt].actv_period = period;
5580 		sdp->isp_devparam[tgt].actv_offset = offset;
5581 		get = (bus << 16) | tgt;
5582 		(void) isp_async(isp, ISPASYNC_NEW_TGT_PARAMS, &get);
5583 	}
5584 
5585 	for (tgt = 0; tgt < MAX_TARGETS; tgt++) {
5586 		if (sdp->isp_devparam[tgt].dev_update ||
5587 		    sdp->isp_devparam[tgt].dev_refresh) {
5588 			isp->isp_update |= (1 << bus);
5589 			break;
5590 		}
5591 	}
5592 }
5593 
5594 #ifndef	DEFAULT_FRAMESIZE
5595 #define	DEFAULT_FRAMESIZE(isp)		ICB_DFLT_FRMLEN
5596 #endif
5597 #ifndef	DEFAULT_EXEC_THROTTLE
5598 #define	DEFAULT_EXEC_THROTTLE(isp)	ISP_EXEC_THROTTLE
5599 #endif
5600 
5601 static void
5602 isp_setdfltparm(struct ispsoftc *isp, int channel)
5603 {
5604 	int tgt;
5605 	mbreg_t mbs;
5606 	sdparam *sdp;
5607 
5608 	if (IS_FC(isp)) {
5609 		fcparam *fcp = (fcparam *) isp->isp_param;
5610 		int nvfail;
5611 
5612 		fcp += channel;
5613 		if (fcp->isp_gotdparms) {
5614 			return;
5615 		}
5616 		fcp->isp_gotdparms = 1;
5617 		fcp->isp_maxfrmlen = DEFAULT_FRAMESIZE(isp);
5618 		fcp->isp_maxalloc = ICB_DFLT_ALLOC;
5619 		fcp->isp_execthrottle = DEFAULT_EXEC_THROTTLE(isp);
5620 		fcp->isp_retry_delay = ICB_DFLT_RDELAY;
5621 		fcp->isp_retry_count = ICB_DFLT_RCOUNT;
5622 		/* Platform specific.... */
5623 		fcp->isp_loopid = DEFAULT_LOOPID(isp);
5624 		fcp->isp_nodewwn = DEFAULT_NODEWWN(isp);
5625 		fcp->isp_portwwn = DEFAULT_PORTWWN(isp);
5626 		fcp->isp_fwoptions = 0;
5627 		fcp->isp_fwoptions |= ICBOPT_FAIRNESS;
5628 		fcp->isp_fwoptions |= ICBOPT_PDBCHANGE_AE;
5629 		fcp->isp_fwoptions |= ICBOPT_HARD_ADDRESS;
5630 #ifndef	ISP_NO_FASTPOST_FC
5631 		fcp->isp_fwoptions |= ICBOPT_FAST_POST;
5632 #endif
5633 		if (isp->isp_confopts & ISP_CFG_FULL_DUPLEX)
5634 			fcp->isp_fwoptions |= ICBOPT_FULL_DUPLEX;
5635 
5636 		/*
5637 		 * Make sure this is turned off now until we get
5638 		 * extended options from NVRAM
5639 		 */
5640 		fcp->isp_fwoptions &= ~ICBOPT_EXTENDED;
5641 
5642 		/*
5643 		 * Now try and read NVRAM unless told to not do so.
5644 		 * This will set fcparam's isp_nodewwn && isp_portwwn.
5645 		 */
5646 		if ((isp->isp_confopts & ISP_CFG_NONVRAM) == 0) {
5647 		    	nvfail = isp_read_nvram(isp);
5648 			if (nvfail)
5649 				isp->isp_confopts |= ISP_CFG_NONVRAM;
5650 		} else {
5651 			nvfail = 1;
5652 		}
5653 		/*
5654 		 * Set node && port to override platform set defaults
5655 		 * unless the nvram read failed (or none was done),
5656 		 * or the platform code wants to use what had been
5657 		 * set in the defaults.
5658 		 */
5659 		if (nvfail) {
5660 			isp->isp_confopts |= ISP_CFG_OWNWWPN|ISP_CFG_OWNWWNN;
5661 		}
5662 		if (isp->isp_confopts & ISP_CFG_OWNWWNN) {
5663 			isp_prt(isp, ISP_LOGCONFIG, "Using Node WWN 0x%08x%08x",
5664 			    (u_int32_t) (DEFAULT_NODEWWN(isp) >> 32),
5665 			    (u_int32_t) (DEFAULT_NODEWWN(isp) & 0xffffffff));
5666 			ISP_NODEWWN(isp) = DEFAULT_NODEWWN(isp);
5667 		} else {
5668 			/*
5669 			 * We always start out with values derived
5670 			 * from NVRAM or our platform default.
5671 			 */
5672 			ISP_NODEWWN(isp) = fcp->isp_nodewwn;
5673 		}
5674 		if (isp->isp_confopts & ISP_CFG_OWNWWPN) {
5675 			isp_prt(isp, ISP_LOGCONFIG, "Using Port WWN 0x%08x%08x",
5676 			    (u_int32_t) (DEFAULT_PORTWWN(isp) >> 32),
5677 			    (u_int32_t) (DEFAULT_PORTWWN(isp) & 0xffffffff));
5678 			ISP_PORTWWN(isp) = DEFAULT_PORTWWN(isp);
5679 		} else {
5680 			/*
5681 			 * We always start out with values derived
5682 			 * from NVRAM or our platform default.
5683 			 */
5684 			ISP_PORTWWN(isp) = fcp->isp_portwwn;
5685 		}
5686 		return;
5687 	}
5688 
5689 	sdp = (sdparam *) isp->isp_param;
5690 	sdp += channel;
5691 
5692 	/*
5693 	 * Been there, done that, got the T-shirt...
5694 	 */
5695 	if (sdp->isp_gotdparms) {
5696 		return;
5697 	}
5698 	sdp->isp_gotdparms = 1;
5699 
5700 	/*
5701 	 * Establish some default parameters.
5702 	 */
5703 	sdp->isp_cmd_dma_burst_enable = 0;
5704 	sdp->isp_data_dma_burst_enabl = 1;
5705 	sdp->isp_fifo_threshold = 0;
5706 	sdp->isp_initiator_id = DEFAULT_IID(isp);
5707 	if (isp->isp_type >= ISP_HA_SCSI_1040) {
5708 		sdp->isp_async_data_setup = 9;
5709 	} else {
5710 		sdp->isp_async_data_setup = 6;
5711 	}
5712 	sdp->isp_selection_timeout = 250;
5713 	sdp->isp_max_queue_depth = MAXISPREQUEST(isp);
5714 	sdp->isp_tag_aging = 8;
5715 	sdp->isp_bus_reset_delay = 5;
5716 	/*
5717 	 * Don't retry selection, busy or queue full automatically- reflect
5718 	 * these back to us.
5719 	 */
5720 	sdp->isp_retry_count = 0;
5721 	sdp->isp_retry_delay = 0;
5722 
5723 	for (tgt = 0; tgt < MAX_TARGETS; tgt++) {
5724 		sdp->isp_devparam[tgt].exc_throttle = ISP_EXEC_THROTTLE;
5725 		sdp->isp_devparam[tgt].dev_enable = 1;
5726 	}
5727 
5728 	/*
5729 	 * If we've not been told to avoid reading NVRAM, try and read it.
5730 	 * If we're successful reading it, we can then return because NVRAM
5731 	 * will tell us what the desired settings are. Otherwise, we establish
5732 	 * some reasonable 'fake' nvram and goal defaults.
5733 	 */
5734 
5735 	if ((isp->isp_confopts & ISP_CFG_NONVRAM) == 0) {
5736 		if (isp_read_nvram(isp) == 0) {
5737 			return;
5738 		}
5739 	}
5740 
5741 	/*
5742 	 * Now try and see whether we have specific values for them.
5743 	 */
5744 	if ((isp->isp_confopts & ISP_CFG_NONVRAM) == 0) {
5745 		mbs.param[0] = MBOX_GET_ACT_NEG_STATE;
5746 		isp_mboxcmd(isp, &mbs, MBLOGNONE);
5747 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
5748 			sdp->isp_req_ack_active_neg = 1;
5749 			sdp->isp_data_line_active_neg = 1;
5750 		} else {
5751 			sdp->isp_req_ack_active_neg =
5752 			    (mbs.param[1+channel] >> 4) & 0x1;
5753 			sdp->isp_data_line_active_neg =
5754 			    (mbs.param[1+channel] >> 5) & 0x1;
5755 		}
5756 	}
5757 
5758 	isp_prt(isp, ISP_LOGDEBUG0, sc0, sc3,
5759 	    0, sdp->isp_fifo_threshold, sdp->isp_initiator_id,
5760 	    sdp->isp_bus_reset_delay, sdp->isp_retry_count,
5761 	    sdp->isp_retry_delay, sdp->isp_async_data_setup);
5762 	isp_prt(isp, ISP_LOGDEBUG0, sc1, sc3,
5763 	    sdp->isp_req_ack_active_neg, sdp->isp_data_line_active_neg,
5764 	    sdp->isp_data_dma_burst_enabl, sdp->isp_cmd_dma_burst_enable,
5765 	    sdp->isp_selection_timeout, sdp->isp_max_queue_depth);
5766 
5767 	/*
5768 	 * The trick here is to establish a default for the default (honk!)
5769 	 * state (goal_flags). Then try and get the current status from
5770 	 * the card to fill in the current state. We don't, in fact, set
5771 	 * the default to the SAFE default state- that's not the goal state.
5772 	 */
5773 	for (tgt = 0; tgt < MAX_TARGETS; tgt++) {
5774 		u_int8_t off, per;
5775 		sdp->isp_devparam[tgt].actv_offset = 0;
5776 		sdp->isp_devparam[tgt].actv_period = 0;
5777 		sdp->isp_devparam[tgt].actv_flags = 0;
5778 
5779 		sdp->isp_devparam[tgt].goal_flags =
5780 		    sdp->isp_devparam[tgt].nvrm_flags = DPARM_DEFAULT;
5781 
5782 		/*
5783 		 * We default to Wide/Fast for versions less than a 1040
5784 		 * (unless it's SBus).
5785 		 */
5786 		if (IS_ULTRA3(isp)) {
5787 			off = ISP_80M_SYNCPARMS >> 8;
5788 			per = ISP_80M_SYNCPARMS & 0xff;
5789 		} else if (IS_ULTRA2(isp)) {
5790 			off = ISP_40M_SYNCPARMS >> 8;
5791 			per = ISP_40M_SYNCPARMS & 0xff;
5792 		} else if (IS_1240(isp)) {
5793 			off = ISP_20M_SYNCPARMS >> 8;
5794 			per = ISP_20M_SYNCPARMS & 0xff;
5795 		} else if ((isp->isp_bustype == ISP_BT_SBUS &&
5796 		    isp->isp_type < ISP_HA_SCSI_1020A) ||
5797 		    (isp->isp_bustype == ISP_BT_PCI &&
5798 		    isp->isp_type < ISP_HA_SCSI_1040) ||
5799 		    (isp->isp_clock && isp->isp_clock < 60) ||
5800 		    (sdp->isp_ultramode == 0)) {
5801 			off = ISP_10M_SYNCPARMS >> 8;
5802 			per = ISP_10M_SYNCPARMS & 0xff;
5803 		} else {
5804 			off = ISP_20M_SYNCPARMS_1040 >> 8;
5805 			per = ISP_20M_SYNCPARMS_1040 & 0xff;
5806 		}
5807 		sdp->isp_devparam[tgt].goal_offset =
5808 		    sdp->isp_devparam[tgt].nvrm_offset = off;
5809 		sdp->isp_devparam[tgt].goal_period =
5810 		    sdp->isp_devparam[tgt].nvrm_period = per;
5811 
5812 		isp_prt(isp, ISP_LOGDEBUG0, sc2, sc3,
5813 		    channel, tgt, sdp->isp_devparam[tgt].nvrm_flags,
5814 		    sdp->isp_devparam[tgt].nvrm_offset,
5815 		    sdp->isp_devparam[tgt].nvrm_period);
5816 	}
5817 }
5818 
5819 /*
5820  * Re-initialize the ISP and complete all orphaned commands
5821  * with a 'botched' notice. The reset/init routines should
5822  * not disturb an already active list of commands.
5823  *
5824  * Locks held prior to coming here.
5825  */
5826 
5827 void
5828 isp_reinit(struct ispsoftc *isp)
5829 {
5830 	XS_T *xs;
5831 	u_int16_t handle;
5832 
5833 	if (IS_FC(isp)) {
5834 		isp_mark_getpdb_all(isp);
5835 	}
5836 	isp_reset(isp);
5837 	if (isp->isp_state != ISP_RESETSTATE) {
5838 		isp_prt(isp, ISP_LOGERR, "isp_reinit cannot reset card");
5839 	} else if (isp->isp_role != ISP_ROLE_NONE) {
5840 		isp_init(isp);
5841 		if (isp->isp_state == ISP_INITSTATE) {
5842 			isp->isp_state = ISP_RUNSTATE;
5843 		}
5844 		if (isp->isp_state != ISP_RUNSTATE) {
5845 			isp_prt(isp, ISP_LOGERR,
5846 			    "isp_reinit cannot restart card");
5847 		}
5848 	}
5849 	isp->isp_nactive = 0;
5850 
5851 	for (handle = 1; (int) handle <= isp->isp_maxcmds; handle++) {
5852 		xs = isp_find_xs(isp, handle);
5853 		if (xs == NULL) {
5854 			continue;
5855 		}
5856 		isp_destroy_handle(isp, handle);
5857 		if (XS_XFRLEN(xs)) {
5858 			ISP_DMAFREE(isp, xs, handle);
5859 			XS_RESID(xs) = XS_XFRLEN(xs);
5860 		} else {
5861 			XS_RESID(xs) = 0;
5862 		}
5863 		XS_SETERR(xs, HBA_BUSRESET);
5864 		isp_done(xs);
5865 	}
5866 }
5867 
5868 /*
5869  * NVRAM Routines
5870  */
5871 static int
5872 isp_read_nvram(struct ispsoftc *isp)
5873 {
5874 	int i, amt;
5875 	u_int8_t csum, minversion;
5876 	union {
5877 		u_int8_t _x[ISP2100_NVRAM_SIZE];
5878 		u_int16_t _s[ISP2100_NVRAM_SIZE>>1];
5879 	} _n;
5880 #define	nvram_data	_n._x
5881 #define	nvram_words	_n._s
5882 
5883 	if (IS_FC(isp)) {
5884 		amt = ISP2100_NVRAM_SIZE;
5885 		minversion = 1;
5886 	} else if (IS_ULTRA2(isp)) {
5887 		amt = ISP1080_NVRAM_SIZE;
5888 		minversion = 0;
5889 	} else {
5890 		amt = ISP_NVRAM_SIZE;
5891 		minversion = 2;
5892 	}
5893 
5894 	/*
5895 	 * Just read the first two words first to see if we have a valid
5896 	 * NVRAM to continue reading the rest with.
5897 	 */
5898 	for (i = 0; i < 2; i++) {
5899 		isp_rdnvram_word(isp, i, &nvram_words[i]);
5900 	}
5901 	if (nvram_data[0] != 'I' || nvram_data[1] != 'S' ||
5902 	    nvram_data[2] != 'P') {
5903 		if (isp->isp_bustype != ISP_BT_SBUS) {
5904 			isp_prt(isp, ISP_LOGWARN, "invalid NVRAM header");
5905 			isp_prt(isp, ISP_LOGDEBUG0, "%x %x %x",
5906 			    nvram_data[0], nvram_data[1], nvram_data[2]);
5907 		}
5908 		return (-1);
5909 	}
5910 	for (i = 2; i < amt>>1; i++) {
5911 		isp_rdnvram_word(isp, i, &nvram_words[i]);
5912 	}
5913 	for (csum = 0, i = 0; i < amt; i++) {
5914 		csum += nvram_data[i];
5915 	}
5916 	if (csum != 0) {
5917 		isp_prt(isp, ISP_LOGWARN, "invalid NVRAM checksum");
5918 		return (-1);
5919 	}
5920 	if (ISP_NVRAM_VERSION(nvram_data) < minversion) {
5921 		isp_prt(isp, ISP_LOGWARN, "version %d NVRAM not understood",
5922 		    ISP_NVRAM_VERSION(nvram_data));
5923 		return (-1);
5924 	}
5925 
5926 	if (IS_ULTRA3(isp)) {
5927 		isp_parse_nvram_12160(isp, 0, nvram_data);
5928 		if (IS_12160(isp))
5929 			isp_parse_nvram_12160(isp, 1, nvram_data);
5930 	} else if (IS_1080(isp)) {
5931 		isp_parse_nvram_1080(isp, 0, nvram_data);
5932 	} else if (IS_1280(isp) || IS_1240(isp)) {
5933 		isp_parse_nvram_1080(isp, 0, nvram_data);
5934 		isp_parse_nvram_1080(isp, 1, nvram_data);
5935 	} else if (IS_SCSI(isp)) {
5936 		isp_parse_nvram_1020(isp, nvram_data);
5937 	} else {
5938 		isp_parse_nvram_2100(isp, nvram_data);
5939 	}
5940 	return (0);
5941 #undef	nvram_data
5942 #undef	nvram_words
5943 }
5944 
5945 static void
5946 isp_rdnvram_word(struct ispsoftc *isp, int wo, u_int16_t *rp)
5947 {
5948 	int i, cbits;
5949 	u_int16_t bit, rqst;
5950 
5951 	ISP_WRITE(isp, BIU_NVRAM, BIU_NVRAM_SELECT);
5952 	USEC_DELAY(2);
5953 	ISP_WRITE(isp, BIU_NVRAM, BIU_NVRAM_SELECT|BIU_NVRAM_CLOCK);
5954 	USEC_DELAY(2);
5955 
5956 	if (IS_FC(isp)) {
5957 		wo &= ((ISP2100_NVRAM_SIZE >> 1) - 1);
5958 		if (IS_2312(isp) && isp->isp_port) {
5959 			wo += 128;
5960 		}
5961 		rqst = (ISP_NVRAM_READ << 8) | wo;
5962 		cbits = 10;
5963 	} else if (IS_ULTRA2(isp)) {
5964 		wo &= ((ISP1080_NVRAM_SIZE >> 1) - 1);
5965 		rqst = (ISP_NVRAM_READ << 8) | wo;
5966 		cbits = 10;
5967 	} else {
5968 		wo &= ((ISP_NVRAM_SIZE >> 1) - 1);
5969 		rqst = (ISP_NVRAM_READ << 6) | wo;
5970 		cbits = 8;
5971 	}
5972 
5973 	/*
5974 	 * Clock the word select request out...
5975 	 */
5976 	for (i = cbits; i >= 0; i--) {
5977 		if ((rqst >> i) & 1) {
5978 			bit = BIU_NVRAM_SELECT | BIU_NVRAM_DATAOUT;
5979 		} else {
5980 			bit = BIU_NVRAM_SELECT;
5981 		}
5982 		ISP_WRITE(isp, BIU_NVRAM, bit);
5983 		USEC_DELAY(2);
5984 		ISP_WRITE(isp, BIU_NVRAM, bit | BIU_NVRAM_CLOCK);
5985 		USEC_DELAY(2);
5986 		ISP_WRITE(isp, BIU_NVRAM, bit);
5987 		USEC_DELAY(2);
5988 	}
5989 	/*
5990 	 * Now read the result back in (bits come back in MSB format).
5991 	 */
5992 	*rp = 0;
5993 	for (i = 0; i < 16; i++) {
5994 		u_int16_t rv;
5995 		*rp <<= 1;
5996 		ISP_WRITE(isp, BIU_NVRAM, BIU_NVRAM_SELECT|BIU_NVRAM_CLOCK);
5997 		USEC_DELAY(2);
5998 		rv = ISP_READ(isp, BIU_NVRAM);
5999 		if (rv & BIU_NVRAM_DATAIN) {
6000 			*rp |= 1;
6001 		}
6002 		USEC_DELAY(2);
6003 		ISP_WRITE(isp, BIU_NVRAM, BIU_NVRAM_SELECT);
6004 		USEC_DELAY(2);
6005 	}
6006 	ISP_WRITE(isp, BIU_NVRAM, 0);
6007 	USEC_DELAY(2);
6008 	ISP_SWIZZLE_NVRAM_WORD(isp, rp);
6009 }
6010 
6011 static void
6012 isp_parse_nvram_1020(struct ispsoftc *isp, u_int8_t *nvram_data)
6013 {
6014 	sdparam *sdp = (sdparam *) isp->isp_param;
6015 	int tgt;
6016 
6017 	sdp->isp_fifo_threshold =
6018 		ISP_NVRAM_FIFO_THRESHOLD(nvram_data) |
6019 		(ISP_NVRAM_FIFO_THRESHOLD_128(nvram_data) << 2);
6020 
6021 	if ((isp->isp_confopts & ISP_CFG_OWNLOOPID) == 0)
6022 		sdp->isp_initiator_id =
6023 			ISP_NVRAM_INITIATOR_ID(nvram_data);
6024 
6025 	sdp->isp_bus_reset_delay =
6026 		ISP_NVRAM_BUS_RESET_DELAY(nvram_data);
6027 
6028 	sdp->isp_retry_count =
6029 		ISP_NVRAM_BUS_RETRY_COUNT(nvram_data);
6030 
6031 	sdp->isp_retry_delay =
6032 		ISP_NVRAM_BUS_RETRY_DELAY(nvram_data);
6033 
6034 	sdp->isp_async_data_setup =
6035 		ISP_NVRAM_ASYNC_DATA_SETUP_TIME(nvram_data);
6036 
6037 	if (isp->isp_type >= ISP_HA_SCSI_1040) {
6038 		if (sdp->isp_async_data_setup < 9) {
6039 			sdp->isp_async_data_setup = 9;
6040 		}
6041 	} else {
6042 		if (sdp->isp_async_data_setup != 6) {
6043 			sdp->isp_async_data_setup = 6;
6044 		}
6045 	}
6046 
6047 	sdp->isp_req_ack_active_neg =
6048 		ISP_NVRAM_REQ_ACK_ACTIVE_NEGATION(nvram_data);
6049 
6050 	sdp->isp_data_line_active_neg =
6051 		ISP_NVRAM_DATA_LINE_ACTIVE_NEGATION(nvram_data);
6052 
6053 	sdp->isp_data_dma_burst_enabl =
6054 		ISP_NVRAM_DATA_DMA_BURST_ENABLE(nvram_data);
6055 
6056 	sdp->isp_cmd_dma_burst_enable =
6057 		ISP_NVRAM_CMD_DMA_BURST_ENABLE(nvram_data);
6058 
6059 	sdp->isp_tag_aging =
6060 		ISP_NVRAM_TAG_AGE_LIMIT(nvram_data);
6061 
6062 	sdp->isp_selection_timeout =
6063 		ISP_NVRAM_SELECTION_TIMEOUT(nvram_data);
6064 
6065 	sdp->isp_max_queue_depth =
6066 		ISP_NVRAM_MAX_QUEUE_DEPTH(nvram_data);
6067 
6068 	sdp->isp_fast_mttr = ISP_NVRAM_FAST_MTTR_ENABLE(nvram_data);
6069 
6070 	isp_prt(isp, ISP_LOGDEBUG0, sc0, sc4,
6071 	    0, sdp->isp_fifo_threshold, sdp->isp_initiator_id,
6072 	    sdp->isp_bus_reset_delay, sdp->isp_retry_count,
6073 	    sdp->isp_retry_delay, sdp->isp_async_data_setup);
6074 	isp_prt(isp, ISP_LOGDEBUG0, sc1, sc4,
6075 	    sdp->isp_req_ack_active_neg, sdp->isp_data_line_active_neg,
6076 	    sdp->isp_data_dma_burst_enabl, sdp->isp_cmd_dma_burst_enable,
6077 	    sdp->isp_selection_timeout, sdp->isp_max_queue_depth);
6078 
6079 	for (tgt = 0; tgt < MAX_TARGETS; tgt++) {
6080 		sdp->isp_devparam[tgt].dev_enable =
6081 			ISP_NVRAM_TGT_DEVICE_ENABLE(nvram_data, tgt);
6082 		sdp->isp_devparam[tgt].exc_throttle =
6083 			ISP_NVRAM_TGT_EXEC_THROTTLE(nvram_data, tgt);
6084 		sdp->isp_devparam[tgt].nvrm_offset =
6085 			ISP_NVRAM_TGT_SYNC_OFFSET(nvram_data, tgt);
6086 		sdp->isp_devparam[tgt].nvrm_period =
6087 			ISP_NVRAM_TGT_SYNC_PERIOD(nvram_data, tgt);
6088 		/*
6089 		 * We probably shouldn't lie about this, but it
6090 		 * it makes it much safer if we limit NVRAM values
6091 		 * to sanity.
6092 		 */
6093 		if (isp->isp_type < ISP_HA_SCSI_1040) {
6094 			/*
6095 			 * If we're not ultra, we can't possibly
6096 			 * be a shorter period than this.
6097 			 */
6098 			if (sdp->isp_devparam[tgt].nvrm_period < 0x19) {
6099 				sdp->isp_devparam[tgt].nvrm_period = 0x19;
6100 			}
6101 			if (sdp->isp_devparam[tgt].nvrm_offset > 0xc) {
6102 				sdp->isp_devparam[tgt].nvrm_offset = 0x0c;
6103 			}
6104 		} else {
6105 			if (sdp->isp_devparam[tgt].nvrm_offset > 0x8) {
6106 				sdp->isp_devparam[tgt].nvrm_offset = 0x8;
6107 			}
6108 		}
6109 		sdp->isp_devparam[tgt].nvrm_flags = 0;
6110 		if (ISP_NVRAM_TGT_RENEG(nvram_data, tgt))
6111 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_RENEG;
6112 		sdp->isp_devparam[tgt].nvrm_flags |= DPARM_ARQ;
6113 		if (ISP_NVRAM_TGT_TQING(nvram_data, tgt))
6114 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_TQING;
6115 		if (ISP_NVRAM_TGT_SYNC(nvram_data, tgt))
6116 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_SYNC;
6117 		if (ISP_NVRAM_TGT_WIDE(nvram_data, tgt))
6118 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_WIDE;
6119 		if (ISP_NVRAM_TGT_PARITY(nvram_data, tgt))
6120 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_PARITY;
6121 		if (ISP_NVRAM_TGT_DISC(nvram_data, tgt))
6122 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_DISC;
6123 		sdp->isp_devparam[tgt].actv_flags = 0; /* we don't know */
6124 		isp_prt(isp, ISP_LOGDEBUG0, sc2, sc4,
6125 		    0, tgt, sdp->isp_devparam[tgt].nvrm_flags,
6126 		    sdp->isp_devparam[tgt].nvrm_offset,
6127 		    sdp->isp_devparam[tgt].nvrm_period);
6128 		sdp->isp_devparam[tgt].goal_offset =
6129 		    sdp->isp_devparam[tgt].nvrm_offset;
6130 		sdp->isp_devparam[tgt].goal_period =
6131 		    sdp->isp_devparam[tgt].nvrm_period;
6132 		sdp->isp_devparam[tgt].goal_flags =
6133 		    sdp->isp_devparam[tgt].nvrm_flags;
6134 	}
6135 }
6136 
6137 static void
6138 isp_parse_nvram_1080(struct ispsoftc *isp, int bus, u_int8_t *nvram_data)
6139 {
6140 	sdparam *sdp = (sdparam *) isp->isp_param;
6141 	int tgt;
6142 
6143 	sdp += bus;
6144 
6145 	sdp->isp_fifo_threshold =
6146 	    ISP1080_NVRAM_FIFO_THRESHOLD(nvram_data);
6147 
6148 	if ((isp->isp_confopts & ISP_CFG_OWNLOOPID) == 0)
6149 		sdp->isp_initiator_id =
6150 		    ISP1080_NVRAM_INITIATOR_ID(nvram_data, bus);
6151 
6152 	sdp->isp_bus_reset_delay =
6153 	    ISP1080_NVRAM_BUS_RESET_DELAY(nvram_data, bus);
6154 
6155 	sdp->isp_retry_count =
6156 	    ISP1080_NVRAM_BUS_RETRY_COUNT(nvram_data, bus);
6157 
6158 	sdp->isp_retry_delay =
6159 	    ISP1080_NVRAM_BUS_RETRY_DELAY(nvram_data, bus);
6160 
6161 	sdp->isp_async_data_setup =
6162 	    ISP1080_NVRAM_ASYNC_DATA_SETUP_TIME(nvram_data, bus);
6163 
6164 	sdp->isp_req_ack_active_neg =
6165 	    ISP1080_NVRAM_REQ_ACK_ACTIVE_NEGATION(nvram_data, bus);
6166 
6167 	sdp->isp_data_line_active_neg =
6168 	    ISP1080_NVRAM_DATA_LINE_ACTIVE_NEGATION(nvram_data, bus);
6169 
6170 	sdp->isp_data_dma_burst_enabl =
6171 	    ISP1080_NVRAM_BURST_ENABLE(nvram_data);
6172 
6173 	sdp->isp_cmd_dma_burst_enable =
6174 	    ISP1080_NVRAM_BURST_ENABLE(nvram_data);
6175 
6176 	sdp->isp_selection_timeout =
6177 	    ISP1080_NVRAM_SELECTION_TIMEOUT(nvram_data, bus);
6178 
6179 	sdp->isp_max_queue_depth =
6180 	     ISP1080_NVRAM_MAX_QUEUE_DEPTH(nvram_data, bus);
6181 
6182 	isp_prt(isp, ISP_LOGDEBUG0, sc0, sc4,
6183 	    bus, sdp->isp_fifo_threshold, sdp->isp_initiator_id,
6184 	    sdp->isp_bus_reset_delay, sdp->isp_retry_count,
6185 	    sdp->isp_retry_delay, sdp->isp_async_data_setup);
6186 	isp_prt(isp, ISP_LOGDEBUG0, sc1, sc4,
6187 	    sdp->isp_req_ack_active_neg, sdp->isp_data_line_active_neg,
6188 	    sdp->isp_data_dma_burst_enabl, sdp->isp_cmd_dma_burst_enable,
6189 	    sdp->isp_selection_timeout, sdp->isp_max_queue_depth);
6190 
6191 
6192 	for (tgt = 0; tgt < MAX_TARGETS; tgt++) {
6193 		sdp->isp_devparam[tgt].dev_enable =
6194 		    ISP1080_NVRAM_TGT_DEVICE_ENABLE(nvram_data, tgt, bus);
6195 		sdp->isp_devparam[tgt].exc_throttle =
6196 			ISP1080_NVRAM_TGT_EXEC_THROTTLE(nvram_data, tgt, bus);
6197 		sdp->isp_devparam[tgt].nvrm_offset =
6198 			ISP1080_NVRAM_TGT_SYNC_OFFSET(nvram_data, tgt, bus);
6199 		sdp->isp_devparam[tgt].nvrm_period =
6200 			ISP1080_NVRAM_TGT_SYNC_PERIOD(nvram_data, tgt, bus);
6201 		sdp->isp_devparam[tgt].nvrm_flags = 0;
6202 		if (ISP1080_NVRAM_TGT_RENEG(nvram_data, tgt, bus))
6203 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_RENEG;
6204 		sdp->isp_devparam[tgt].nvrm_flags |= DPARM_ARQ;
6205 		if (ISP1080_NVRAM_TGT_TQING(nvram_data, tgt, bus))
6206 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_TQING;
6207 		if (ISP1080_NVRAM_TGT_SYNC(nvram_data, tgt, bus))
6208 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_SYNC;
6209 		if (ISP1080_NVRAM_TGT_WIDE(nvram_data, tgt, bus))
6210 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_WIDE;
6211 		if (ISP1080_NVRAM_TGT_PARITY(nvram_data, tgt, bus))
6212 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_PARITY;
6213 		if (ISP1080_NVRAM_TGT_DISC(nvram_data, tgt, bus))
6214 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_DISC;
6215 		sdp->isp_devparam[tgt].actv_flags = 0;
6216 		isp_prt(isp, ISP_LOGDEBUG0, sc2, sc4,
6217 		    bus, tgt, sdp->isp_devparam[tgt].nvrm_flags,
6218 		    sdp->isp_devparam[tgt].nvrm_offset,
6219 		    sdp->isp_devparam[tgt].nvrm_period);
6220 		sdp->isp_devparam[tgt].goal_offset =
6221 		    sdp->isp_devparam[tgt].nvrm_offset;
6222 		sdp->isp_devparam[tgt].goal_period =
6223 		    sdp->isp_devparam[tgt].nvrm_period;
6224 		sdp->isp_devparam[tgt].goal_flags =
6225 		    sdp->isp_devparam[tgt].nvrm_flags;
6226 	}
6227 }
6228 
6229 static void
6230 isp_parse_nvram_12160(struct ispsoftc *isp, int bus, u_int8_t *nvram_data)
6231 {
6232 	sdparam *sdp = (sdparam *) isp->isp_param;
6233 	int tgt;
6234 
6235 	sdp += bus;
6236 
6237 	sdp->isp_fifo_threshold =
6238 	    ISP12160_NVRAM_FIFO_THRESHOLD(nvram_data);
6239 
6240 	if ((isp->isp_confopts & ISP_CFG_OWNLOOPID) == 0)
6241 		sdp->isp_initiator_id =
6242 		    ISP12160_NVRAM_INITIATOR_ID(nvram_data, bus);
6243 
6244 	sdp->isp_bus_reset_delay =
6245 	    ISP12160_NVRAM_BUS_RESET_DELAY(nvram_data, bus);
6246 
6247 	sdp->isp_retry_count =
6248 	    ISP12160_NVRAM_BUS_RETRY_COUNT(nvram_data, bus);
6249 
6250 	sdp->isp_retry_delay =
6251 	    ISP12160_NVRAM_BUS_RETRY_DELAY(nvram_data, bus);
6252 
6253 	sdp->isp_async_data_setup =
6254 	    ISP12160_NVRAM_ASYNC_DATA_SETUP_TIME(nvram_data, bus);
6255 
6256 	sdp->isp_req_ack_active_neg =
6257 	    ISP12160_NVRAM_REQ_ACK_ACTIVE_NEGATION(nvram_data, bus);
6258 
6259 	sdp->isp_data_line_active_neg =
6260 	    ISP12160_NVRAM_DATA_LINE_ACTIVE_NEGATION(nvram_data, bus);
6261 
6262 	sdp->isp_data_dma_burst_enabl =
6263 	    ISP12160_NVRAM_BURST_ENABLE(nvram_data);
6264 
6265 	sdp->isp_cmd_dma_burst_enable =
6266 	    ISP12160_NVRAM_BURST_ENABLE(nvram_data);
6267 
6268 	sdp->isp_selection_timeout =
6269 	    ISP12160_NVRAM_SELECTION_TIMEOUT(nvram_data, bus);
6270 
6271 	sdp->isp_max_queue_depth =
6272 	     ISP12160_NVRAM_MAX_QUEUE_DEPTH(nvram_data, bus);
6273 
6274 	isp_prt(isp, ISP_LOGDEBUG0, sc0, sc4,
6275 	    bus, sdp->isp_fifo_threshold, sdp->isp_initiator_id,
6276 	    sdp->isp_bus_reset_delay, sdp->isp_retry_count,
6277 	    sdp->isp_retry_delay, sdp->isp_async_data_setup);
6278 	isp_prt(isp, ISP_LOGDEBUG0, sc1, sc4,
6279 	    sdp->isp_req_ack_active_neg, sdp->isp_data_line_active_neg,
6280 	    sdp->isp_data_dma_burst_enabl, sdp->isp_cmd_dma_burst_enable,
6281 	    sdp->isp_selection_timeout, sdp->isp_max_queue_depth);
6282 
6283 	for (tgt = 0; tgt < MAX_TARGETS; tgt++) {
6284 		sdp->isp_devparam[tgt].dev_enable =
6285 		    ISP12160_NVRAM_TGT_DEVICE_ENABLE(nvram_data, tgt, bus);
6286 		sdp->isp_devparam[tgt].exc_throttle =
6287 			ISP12160_NVRAM_TGT_EXEC_THROTTLE(nvram_data, tgt, bus);
6288 		sdp->isp_devparam[tgt].nvrm_offset =
6289 			ISP12160_NVRAM_TGT_SYNC_OFFSET(nvram_data, tgt, bus);
6290 		sdp->isp_devparam[tgt].nvrm_period =
6291 			ISP12160_NVRAM_TGT_SYNC_PERIOD(nvram_data, tgt, bus);
6292 		sdp->isp_devparam[tgt].nvrm_flags = 0;
6293 		if (ISP12160_NVRAM_TGT_RENEG(nvram_data, tgt, bus))
6294 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_RENEG;
6295 		sdp->isp_devparam[tgt].nvrm_flags |= DPARM_ARQ;
6296 		if (ISP12160_NVRAM_TGT_TQING(nvram_data, tgt, bus))
6297 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_TQING;
6298 		if (ISP12160_NVRAM_TGT_SYNC(nvram_data, tgt, bus))
6299 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_SYNC;
6300 		if (ISP12160_NVRAM_TGT_WIDE(nvram_data, tgt, bus))
6301 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_WIDE;
6302 		if (ISP12160_NVRAM_TGT_PARITY(nvram_data, tgt, bus))
6303 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_PARITY;
6304 		if (ISP12160_NVRAM_TGT_DISC(nvram_data, tgt, bus))
6305 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_DISC;
6306 		sdp->isp_devparam[tgt].actv_flags = 0;
6307 		isp_prt(isp, ISP_LOGDEBUG0, sc2, sc4,
6308 		    bus, tgt, sdp->isp_devparam[tgt].nvrm_flags,
6309 		    sdp->isp_devparam[tgt].nvrm_offset,
6310 		    sdp->isp_devparam[tgt].nvrm_period);
6311 		sdp->isp_devparam[tgt].goal_offset =
6312 		    sdp->isp_devparam[tgt].nvrm_offset;
6313 		sdp->isp_devparam[tgt].goal_period =
6314 		    sdp->isp_devparam[tgt].nvrm_period;
6315 		sdp->isp_devparam[tgt].goal_flags =
6316 		    sdp->isp_devparam[tgt].nvrm_flags;
6317 	}
6318 }
6319 
6320 static void
6321 isp_parse_nvram_2100(struct ispsoftc *isp, u_int8_t *nvram_data)
6322 {
6323 	fcparam *fcp = (fcparam *) isp->isp_param;
6324 	u_int64_t wwn;
6325 
6326 	/*
6327 	 * There is NVRAM storage for both Port and Node entities-
6328 	 * but the Node entity appears to be unused on all the cards
6329 	 * I can find. However, we should account for this being set
6330 	 * at some point in the future.
6331 	 *
6332 	 * Qlogic WWNs have an NAA of 2, but usually nothing shows up in
6333 	 * bits 48..60. In the case of the 2202, it appears that they do
6334 	 * use bit 48 to distinguish between the two instances on the card.
6335 	 * The 2204, which I've never seen, *probably* extends this method.
6336 	 */
6337 	wwn = ISP2100_NVRAM_PORT_NAME(nvram_data);
6338 	if (wwn) {
6339 		isp_prt(isp, ISP_LOGCONFIG, "NVRAM Port WWN 0x%08x%08x",
6340 		    (u_int32_t) (wwn >> 32), (u_int32_t) (wwn & 0xffffffff));
6341 		if ((wwn >> 60) == 0) {
6342 			wwn |= (((u_int64_t) 2)<< 60);
6343 		}
6344 	}
6345 	fcp->isp_portwwn = wwn;
6346 	if (IS_2200(isp) || IS_23XX(isp)) {
6347 		wwn = ISP2200_NVRAM_NODE_NAME(nvram_data);
6348 		if (wwn) {
6349 			isp_prt(isp, ISP_LOGCONFIG, "NVRAM Node WWN 0x%08x%08x",
6350 			    (u_int32_t) (wwn >> 32),
6351 			    (u_int32_t) (wwn & 0xffffffff));
6352 			if ((wwn >> 60) == 0) {
6353 				wwn |= (((u_int64_t) 2)<< 60);
6354 			}
6355 		}
6356 	} else {
6357 		wwn &= ~((u_int64_t) 0xfff << 48);
6358 	}
6359 	fcp->isp_nodewwn = wwn;
6360 
6361 	/*
6362 	 * Make sure we have both Node and Port as non-zero values.
6363 	 */
6364 	if (fcp->isp_nodewwn != 0 && fcp->isp_portwwn == 0) {
6365 		fcp->isp_portwwn = fcp->isp_nodewwn;
6366 	} else if (fcp->isp_nodewwn == 0 && fcp->isp_portwwn != 0) {
6367 		fcp->isp_nodewwn = fcp->isp_portwwn;
6368 	}
6369 
6370 	/*
6371 	 * Make the Node and Port values sane if they're NAA == 2.
6372 	 * This means to clear bits 48..56 for the Node WWN and
6373 	 * make sure that there's some non-zero value in 48..56
6374 	 * for the Port WWN.
6375 	 */
6376 	if (fcp->isp_nodewwn && fcp->isp_portwwn) {
6377 		if ((fcp->isp_nodewwn & (((u_int64_t) 0xfff) << 48)) != 0 &&
6378 		    (fcp->isp_nodewwn >> 60) == 2) {
6379 			fcp->isp_nodewwn &= ~((u_int64_t) 0xfff << 48);
6380 		}
6381 		if ((fcp->isp_portwwn & (((u_int64_t) 0xfff) << 48)) == 0 &&
6382 		    (fcp->isp_portwwn >> 60) == 2) {
6383 			fcp->isp_portwwn |= ((u_int64_t) 1 << 56);
6384 		}
6385 	}
6386 
6387 	isp_prt(isp, ISP_LOGDEBUG0,
6388 	    "NVRAM: maxfrmlen %d execthrottle %d fwoptions 0x%x loopid %x",
6389 	    ISP2100_NVRAM_MAXFRAMELENGTH(nvram_data),
6390 	    ISP2100_NVRAM_EXECUTION_THROTTLE(nvram_data),
6391 	    ISP2100_NVRAM_OPTIONS(nvram_data),
6392 	    ISP2100_NVRAM_HARDLOOPID(nvram_data));
6393 
6394 	fcp->isp_maxalloc =
6395 		ISP2100_NVRAM_MAXIOCBALLOCATION(nvram_data);
6396 	if ((isp->isp_confopts & ISP_CFG_OWNFSZ) == 0)
6397 		fcp->isp_maxfrmlen =
6398 			ISP2100_NVRAM_MAXFRAMELENGTH(nvram_data);
6399 	fcp->isp_retry_delay =
6400 		ISP2100_NVRAM_RETRY_DELAY(nvram_data);
6401 	fcp->isp_retry_count =
6402 		ISP2100_NVRAM_RETRY_COUNT(nvram_data);
6403 	if ((isp->isp_confopts & ISP_CFG_OWNLOOPID) == 0)
6404 		fcp->isp_loopid =
6405 			ISP2100_NVRAM_HARDLOOPID(nvram_data);
6406 	if ((isp->isp_confopts & ISP_CFG_OWNEXCTHROTTLE) == 0)
6407 		fcp->isp_execthrottle =
6408 			ISP2100_NVRAM_EXECUTION_THROTTLE(nvram_data);
6409 	fcp->isp_fwoptions = ISP2100_NVRAM_OPTIONS(nvram_data);
6410 }
6411 
6412 #ifdef	ISP_FW_CRASH_DUMP
6413 static void isp2200_fw_dump(struct ispsoftc *);
6414 static void isp2300_fw_dump(struct ispsoftc *);
6415 
6416 static void
6417 isp2200_fw_dump(struct ispsoftc *isp)
6418 {
6419 	int i, j;
6420 	mbreg_t mbs;
6421 	u_int16_t *ptr;
6422 
6423 	ptr = FCPARAM(isp)->isp_dump_data;
6424 	if (ptr == NULL) {
6425 		isp_prt(isp, ISP_LOGERR,
6426 		   "No place to dump RISC registers and SRAM");
6427 		return;
6428 	}
6429 	if (*ptr++) {
6430 		isp_prt(isp, ISP_LOGERR,
6431 		   "dump area for RISC registers and SRAM already used");
6432 		return;
6433 	}
6434 	ISP_WRITE(isp, HCCR, HCCR_CMD_PAUSE);
6435 	for (i = 0; i < 100; i++) {
6436 		USEC_DELAY(100);
6437 		if (ISP_READ(isp, HCCR) & HCCR_PAUSE) {
6438 			break;
6439 		}
6440 	}
6441 	if (ISP_READ(isp, HCCR) & HCCR_PAUSE) {
6442 		/*
6443 		 * PBIU Registers
6444 		 */
6445 		for (i = 0; i < 8; i++) {
6446 			*ptr++ = ISP_READ(isp, BIU_BLOCK + (i << 1));
6447 		}
6448 
6449 		/*
6450 		 * Mailbox Registers
6451 		 */
6452 		for (i = 0; i < 8; i++) {
6453 			*ptr++ = ISP_READ(isp, MBOX_BLOCK + (i << 1));
6454 		}
6455 
6456 		/*
6457 		 * DMA Registers
6458 		 */
6459 		for (i = 0; i < 48; i++) {
6460 			*ptr++ = ISP_READ(isp, DMA_BLOCK + 0x20 + (i << 1));
6461 		}
6462 
6463 		/*
6464 		 * RISC H/W Registers
6465 		 */
6466 		ISP_WRITE(isp, BIU2100_CSR, 0);
6467 		for (i = 0; i < 16; i++) {
6468 			*ptr++ = ISP_READ(isp, BIU_BLOCK + 0xA0 + (i << 1));
6469 		}
6470 
6471 		/*
6472 		 * RISC GP Registers
6473 		 */
6474 		for (j = 0; j < 8; j++) {
6475 			ISP_WRITE(isp, BIU_BLOCK + 0xA4, 0x2000 + (j << 8));
6476 			for (i = 0; i < 16; i++) {
6477 				*ptr++ =
6478 				    ISP_READ(isp, BIU_BLOCK + 0x80 + (i << 1));
6479 			}
6480 		}
6481 
6482 		/*
6483 		 * Frame Buffer Hardware Registers
6484 		 */
6485 		ISP_WRITE(isp, BIU2100_CSR, 0x10);
6486 		for (i = 0; i < 16; i++) {
6487 			*ptr++ = ISP_READ(isp, BIU_BLOCK + 0x80 + (i << 1));
6488 		}
6489 
6490 		/*
6491 		 * Fibre Protocol Module 0 Hardware Registers
6492 		 */
6493 		ISP_WRITE(isp, BIU2100_CSR, 0x20);
6494 		for (i = 0; i < 64; i++) {
6495 			*ptr++ = ISP_READ(isp, BIU_BLOCK + 0x80 + (i << 1));
6496 		}
6497 
6498 		/*
6499 		 * Fibre Protocol Module 1 Hardware Registers
6500 		 */
6501 		ISP_WRITE(isp, BIU2100_CSR, 0x30);
6502 		for (i = 0; i < 64; i++) {
6503 			*ptr++ = ISP_READ(isp, BIU_BLOCK + 0x80 + (i << 1));
6504 		}
6505 	} else {
6506 		isp_prt(isp, ISP_LOGERR, "RISC Would Not Pause");
6507 		return;
6508 	}
6509 	isp_prt(isp, ISP_LOGALL,
6510 	   "isp_fw_dump: RISC registers dumped successfully");
6511 	ISP_WRITE(isp, BIU2100_CSR, BIU2100_SOFT_RESET);
6512 	for (i = 0; i < 100; i++) {
6513 		USEC_DELAY(100);
6514 		if (ISP_READ(isp, OUTMAILBOX0) == 0) {
6515 			break;
6516 		}
6517 	}
6518 	if (ISP_READ(isp, OUTMAILBOX0) != 0) {
6519 		isp_prt(isp, ISP_LOGERR, "Board Would Not Reset");
6520 		return;
6521 	}
6522 	ISP_WRITE(isp, HCCR, HCCR_CMD_PAUSE);
6523 	for (i = 0; i < 100; i++) {
6524 		USEC_DELAY(100);
6525 		if (ISP_READ(isp, HCCR) & HCCR_PAUSE) {
6526 			break;
6527 		}
6528 	}
6529 	if ((ISP_READ(isp, HCCR) & HCCR_PAUSE) == 0) {
6530 		isp_prt(isp, ISP_LOGERR, "RISC Would Not Pause After Reset");
6531 		return;
6532 	}
6533 	ISP_WRITE(isp, RISC_EMB, 0xf2);
6534 	ISP_WRITE(isp, HCCR, HCCR_CMD_RELEASE);
6535 	for (i = 0; i < 100; i++) {
6536 		USEC_DELAY(100);
6537 		if ((ISP_READ(isp, HCCR) & HCCR_PAUSE) == 0) {
6538 			break;
6539 		}
6540 	}
6541 	ENABLE_INTS(isp);
6542 	mbs.param[0] = MBOX_READ_RAM_WORD;
6543 	mbs.param[1] = 0x1000;
6544 	isp->isp_mbxworkp = (void *) ptr;
6545 	isp->isp_mbxwrk0 = 0xefff;	/* continuation count */
6546 	isp->isp_mbxwrk1 = 0x1001;	/* next SRAM address */
6547 	isp_control(isp, ISPCTL_RUN_MBOXCMD, &mbs);
6548 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
6549 		isp_prt(isp, ISP_LOGWARN,
6550 		    "RAM DUMP FAILED @ WORD %x", isp->isp_mbxwrk1);
6551 		return;
6552 	}
6553 	ptr = isp->isp_mbxworkp;	/* finish fetch of final word */
6554 	*ptr++ = isp->isp_mboxtmp[2];
6555 	isp_prt(isp, ISP_LOGALL, "isp_fw_dump: SRAM dumped successfully");
6556 	FCPARAM(isp)->isp_dump_data[0] = isp->isp_type; /* now used */
6557 	(void) isp_async(isp, ISPASYNC_FW_DUMPED, 0);
6558 }
6559 
6560 static void
6561 isp2300_fw_dump(struct ispsoftc *isp)
6562 {
6563 	int i, j;
6564 	mbreg_t mbs;
6565 	u_int16_t *ptr;
6566 
6567 	ptr = FCPARAM(isp)->isp_dump_data;
6568 	if (ptr == NULL) {
6569 		isp_prt(isp, ISP_LOGERR,
6570 		   "No place to dump RISC registers and SRAM");
6571 		return;
6572 	}
6573 	if (*ptr++) {
6574 		isp_prt(isp, ISP_LOGERR,
6575 		   "dump area for RISC registers and SRAM already used");
6576 		return;
6577 	}
6578 	ISP_WRITE(isp, HCCR, HCCR_CMD_PAUSE);
6579 	for (i = 0; i < 100; i++) {
6580 		USEC_DELAY(100);
6581 		if (ISP_READ(isp, HCCR) & HCCR_PAUSE) {
6582 			break;
6583 		}
6584 	}
6585 	if (ISP_READ(isp, HCCR) & HCCR_PAUSE) {
6586 		/*
6587 		 * PBIU registers
6588 		 */
6589 		for (i = 0; i < 8; i++) {
6590 			*ptr++ = ISP_READ(isp, BIU_BLOCK + (i << 1));
6591 		}
6592 
6593 		/*
6594 		 * ReqQ-RspQ-Risc2Host Status registers
6595 		 */
6596 		for (i = 0; i < 8; i++) {
6597 			*ptr++ = ISP_READ(isp, BIU_BLOCK + 0x10 + (i << 1));
6598 		}
6599 
6600 		/*
6601 		 * Mailbox Registers
6602 		 */
6603 		for (i = 0; i < 32; i++) {
6604 			*ptr++ =
6605 			    ISP_READ(isp, PCI_MBOX_REGS2300_OFF + (i << 1));
6606 		}
6607 
6608 		/*
6609 		 * Auto Request Response DMA registers
6610 		 */
6611 		ISP_WRITE(isp, BIU2100_CSR, 0x40);
6612 		for (i = 0; i < 32; i++) {
6613 			*ptr++ = ISP_READ(isp, BIU_BLOCK + 0x80 + (i << 1));
6614 		}
6615 
6616 		/*
6617 		 * DMA registers
6618 		 */
6619 		ISP_WRITE(isp, BIU2100_CSR, 0x50);
6620 		for (i = 0; i < 48; i++) {
6621 			*ptr++ = ISP_READ(isp, BIU_BLOCK + 0x80 + (i << 1));
6622 		}
6623 
6624 		/*
6625 		 * RISC hardware registers
6626 		 */
6627 		ISP_WRITE(isp, BIU2100_CSR, 0);
6628 		for (i = 0; i < 16; i++) {
6629 			*ptr++ = ISP_READ(isp, BIU_BLOCK + 0xA0 + (i << 1));
6630 		}
6631 
6632 		/*
6633 		 * RISC GP? registers
6634 		 */
6635 		for (j = 0; j < 8; j++) {
6636 			ISP_WRITE(isp, BIU_BLOCK + 0xA4, 0x2000 + (j << 9));
6637 			for (i = 0; i < 16; i++) {
6638 				*ptr++ =
6639 				    ISP_READ(isp, BIU_BLOCK + 0x80 + (i << 1));
6640 			}
6641 		}
6642 
6643 		/*
6644 		 * frame buffer hardware registers
6645 		 */
6646 		ISP_WRITE(isp, BIU2100_CSR, 0x10);
6647 		for (i = 0; i < 64; i++) {
6648 			*ptr++ = ISP_READ(isp, BIU_BLOCK + 0x80 + (i << 1));
6649 		}
6650 
6651 		/*
6652 		 * FPM B0 hardware registers
6653 		 */
6654 		ISP_WRITE(isp, BIU2100_CSR, 0x20);
6655 		for (i = 0; i < 64; i++) {
6656 			*ptr++ = ISP_READ(isp, BIU_BLOCK + 0x80 + (i << 1));
6657 		}
6658 
6659 		/*
6660 		 * FPM B1 hardware registers
6661 		 */
6662 		ISP_WRITE(isp, BIU2100_CSR, 0x30);
6663 		for (i = 0; i < 64; i++) {
6664 			*ptr++ = ISP_READ(isp, BIU_BLOCK + 0x80 + (i << 1));
6665 		}
6666 	} else {
6667 		isp_prt(isp, ISP_LOGERR, "RISC Would Not Pause");
6668 		return;
6669 	}
6670 	isp_prt(isp, ISP_LOGALL,
6671 	   "isp_fw_dump: RISC registers dumped successfully");
6672 	ISP_WRITE(isp, BIU2100_CSR, BIU2100_SOFT_RESET);
6673 	for (i = 0; i < 100; i++) {
6674 		USEC_DELAY(100);
6675 		if (ISP_READ(isp, OUTMAILBOX0) == 0) {
6676 			break;
6677 		}
6678 	}
6679 	if (ISP_READ(isp, OUTMAILBOX0) != 0) {
6680 		isp_prt(isp, ISP_LOGERR, "Board Would Not Reset");
6681 		return;
6682 	}
6683 	ENABLE_INTS(isp);
6684 	mbs.param[0] = MBOX_READ_RAM_WORD;
6685 	mbs.param[1] = 0x800;
6686 	isp->isp_mbxworkp = (void *) ptr;
6687 	isp->isp_mbxwrk0 = 0xf7ff;	/* continuation count */
6688 	isp->isp_mbxwrk1 = 0x801;	/* next SRAM address */
6689 	isp_control(isp, ISPCTL_RUN_MBOXCMD, &mbs);
6690 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
6691 		isp_prt(isp, ISP_LOGWARN,
6692 		    "RAM DUMP FAILED @ WORD %x", isp->isp_mbxwrk1);
6693 		return;
6694 	}
6695 	ptr = isp->isp_mbxworkp;	/* finish fetch of final word */
6696 	*ptr++ = isp->isp_mboxtmp[2];
6697 
6698 	/*
6699 	 * We don't have access to mailbox registers 8.. onward
6700 	 * in our 'common' device model- so we have to set it
6701 	 * here and hope it stays the same!
6702 	 */
6703 	ISP_WRITE(isp, PCI_MBOX_REGS2300_OFF + (8 << 1), 0x1);
6704 
6705 	mbs.param[0] = MBOX_READ_RAM_WORD_EXTENDED;
6706 	mbs.param[1] = 0;
6707 	isp->isp_mbxworkp = (void *) ptr;
6708 	isp->isp_mbxwrk0 = 0xffff;	/* continuation count */
6709 	isp->isp_mbxwrk1 = 0x1;		/* next SRAM address */
6710 	isp_control(isp, ISPCTL_RUN_MBOXCMD, &mbs);
6711 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
6712 		isp_prt(isp, ISP_LOGWARN,
6713 		    "RAM DUMP FAILED @ WORD %x", 0x10000 + isp->isp_mbxwrk1);
6714 		return;
6715 	}
6716 	ptr = isp->isp_mbxworkp;	/* finish final word */
6717 	*ptr++ = mbs.param[2];
6718 	isp_prt(isp, ISP_LOGALL, "isp_fw_dump: SRAM dumped successfully");
6719 	FCPARAM(isp)->isp_dump_data[0] = isp->isp_type; /* now used */
6720 	(void) isp_async(isp, ISPASYNC_FW_DUMPED, 0);
6721 }
6722 
6723 void
6724 isp_fw_dump(struct ispsoftc *isp)
6725 {
6726 	if (IS_2200(isp))
6727 		isp2200_fw_dump(isp);
6728 	else if (IS_23XX(isp))
6729 		isp2300_fw_dump(isp);
6730 }
6731 #endif
6732