xref: /freebsd/sys/dev/isp/isp.c (revision c11e094d96120a2e0e726ed9705ae0ec08db49b6)
1 /* $FreeBSD$ */
2 /*
3  * Machine and OS Independent (well, as best as possible)
4  * code for the Qlogic ISP SCSI adapters.
5  *
6  * Copyright (c) 1997, 1998, 1999, 2000, 2001 by Matthew Jacob
7  * Feral Software
8  * All rights reserved.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice immediately at the beginning of the file, without modification,
15  *    this list of conditions, and the following disclaimer.
16  * 2. The name of the author may not be used to endorse or promote products
17  *    derived from this software without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
23  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  */
31 
32 /*
33  * Inspiration and ideas about this driver are from Erik Moe's Linux driver
34  * (qlogicisp.c) and Dave Miller's SBus version of same (qlogicisp.c). Some
35  * ideas dredged from the Solaris driver.
36  */
37 
38 /*
39  * Include header file appropriate for platform we're building on.
40  */
41 
42 #ifdef	__NetBSD__
43 #include <dev/ic/isp_netbsd.h>
44 #endif
45 #ifdef	__FreeBSD__
46 #include <dev/isp/isp_freebsd.h>
47 #endif
48 #ifdef	__OpenBSD__
49 #include <dev/ic/isp_openbsd.h>
50 #endif
51 #ifdef	__linux__
52 #include "isp_linux.h"
53 #endif
54 #ifdef	__svr4__
55 #include "isp_solaris.h"
56 #endif
57 
58 /*
59  * General defines
60  */
61 
62 #define	MBOX_DELAY_COUNT	1000000 / 100
63 
64 /*
65  * Local static data
66  */
67 static const char portshift[] =
68     "Target %d Loop ID 0x%x (Port 0x%x) => Loop 0x%x (Port 0x%x)";
69 static const char portdup[] =
70     "Target %d duplicates Target %d- killing off both";
71 static const char retained[] =
72     "Retaining Loop ID 0x%x for Target %d (Port 0x%x)";
73 static const char lretained[] =
74     "Retained login of Target %d (Loop ID 0x%x) Port 0x%x";
75 static const char plogout[] =
76     "Logging out Target %d at Loop ID 0x%x (Port 0x%x)";
77 static const char plogierr[] =
78     "Command Error in PLOGI for Port 0x%x (0x%x)";
79 static const char nopdb[] =
80     "Could not get PDB for Device @ Port 0x%x";
81 static const char pdbmfail1[] =
82     "PDB Loop ID info for Device @ Port 0x%x does not match up (0x%x)";
83 static const char pdbmfail2[] =
84     "PDB Port info for Device @ Port 0x%x does not match up (0x%x)";
85 static const char ldumped[] =
86     "Target %d (Loop ID 0x%x) Port 0x%x dumped after login info mismatch";
87 static const char notresp[] =
88   "Not RESPONSE in RESPONSE Queue (type 0x%x) @ idx %d (next %d) nlooked %d";
89 static const char xact1[] =
90     "HBA attempted queued transaction with disconnect not set for %d.%d.%d";
91 static const char xact2[] =
92     "HBA attempted queued transaction to target routine %d on target %d bus %d";
93 static const char xact3[] =
94     "HBA attempted queued cmd for %d.%d.%d when queueing disabled";
95 static const char pskip[] =
96     "SCSI phase skipped for target %d.%d.%d";
97 static const char topology[] =
98     "Loop ID %d, AL_PA 0x%x, Port ID 0x%x, Loop State 0x%x, Topology '%s'";
99 static const char swrej[] =
100     "Fabric Nameserver rejected %s (Reason=0x%x Expl=0x%x) for Port ID 0x%x";
101 static const char finmsg[] =
102     "(%d.%d.%d): FIN dl%d resid %d STS 0x%x SKEY %c XS_ERR=0x%x";
103 static const char sc0[] =
104     "%s CHAN %d FTHRSH %d IID %d RESETD %d RETRYC %d RETRYD %d ASD 0x%x";
105 static const char sc1[] =
106     "%s RAAN 0x%x DLAN 0x%x DDMAB 0x%x CDMAB 0x%x SELTIME %d MQD %d";
107 static const char sc2[] = "%s CHAN %d TGT %d FLAGS 0x%x 0x%x/0x%x";
108 static const char sc3[] = "Generated";
109 static const char sc4[] = "NVRAM";
110 static const char bun[] =
111     "bad underrun for %d.%d (count %d, resid %d, status %s)";
112 
113 /*
114  * Local function prototypes.
115  */
116 static int isp_parse_async(struct ispsoftc *, u_int16_t);
117 static int isp_handle_other_response(struct ispsoftc *, int, isphdr_t *,
118     u_int16_t *);
119 static void
120 isp_parse_status(struct ispsoftc *, ispstatusreq_t *, XS_T *);
121 static void isp_fastpost_complete(struct ispsoftc *, u_int16_t);
122 static int isp_mbox_continue(struct ispsoftc *);
123 static void isp_scsi_init(struct ispsoftc *);
124 static void isp_scsi_channel_init(struct ispsoftc *, int);
125 static void isp_fibre_init(struct ispsoftc *);
126 static void isp_mark_getpdb_all(struct ispsoftc *);
127 static int isp_getmap(struct ispsoftc *, fcpos_map_t *);
128 static int isp_getpdb(struct ispsoftc *, int, isp_pdb_t *);
129 static u_int64_t isp_get_portname(struct ispsoftc *, int, int);
130 static int isp_fclink_test(struct ispsoftc *, int);
131 static char *isp2100_fw_statename(int);
132 static int isp_pdb_sync(struct ispsoftc *);
133 static int isp_scan_loop(struct ispsoftc *);
134 static int isp_fabric_mbox_cmd(struct ispsoftc *, mbreg_t *);
135 static int isp_scan_fabric(struct ispsoftc *, int);
136 static void isp_register_fc4_type(struct ispsoftc *);
137 static void isp_fw_state(struct ispsoftc *);
138 static void isp_mboxcmd_qnw(struct ispsoftc *, mbreg_t *, int);
139 static void isp_mboxcmd(struct ispsoftc *, mbreg_t *, int);
140 
141 static void isp_update(struct ispsoftc *);
142 static void isp_update_bus(struct ispsoftc *, int);
143 static void isp_setdfltparm(struct ispsoftc *, int);
144 static int isp_read_nvram(struct ispsoftc *);
145 static void isp_rdnvram_word(struct ispsoftc *, int, u_int16_t *);
146 static void isp_parse_nvram_1020(struct ispsoftc *, u_int8_t *);
147 static void isp_parse_nvram_1080(struct ispsoftc *, int, u_int8_t *);
148 static void isp_parse_nvram_12160(struct ispsoftc *, int, u_int8_t *);
149 static void isp_parse_nvram_2100(struct ispsoftc *, u_int8_t *);
150 
151 /*
152  * Reset Hardware.
153  *
154  * Hit the chip over the head, download new f/w if available and set it running.
155  *
156  * Locking done elsewhere.
157  */
158 
159 void
160 isp_reset(struct ispsoftc *isp)
161 {
162 	mbreg_t mbs;
163 	u_int16_t code_org;
164 	int loops, i, touched, dodnld = 1;
165 	char *btype = "????";
166 
167 	isp->isp_state = ISP_NILSTATE;
168 
169 	/*
170 	 * Basic types (SCSI, FibreChannel and PCI or SBus)
171 	 * have been set in the MD code. We figure out more
172 	 * here. Possibly more refined types based upon PCI
173 	 * identification. Chip revision has been gathered.
174 	 *
175 	 * After we've fired this chip up, zero out the conf1 register
176 	 * for SCSI adapters and do other settings for the 2100.
177 	 */
178 
179 	/*
180 	 * Get the current running firmware revision out of the
181 	 * chip before we hit it over the head (if this is our
182 	 * first time through). Note that we store this as the
183 	 * 'ROM' firmware revision- which it may not be. In any
184 	 * case, we don't really use this yet, but we may in
185 	 * the future.
186 	 */
187 	if ((touched = isp->isp_touched) == 0) {
188 		/*
189 		 * First see whether or not we're sitting in the ISP PROM.
190 		 * If we've just been reset, we'll have the string "ISP   "
191 		 * spread through outgoing mailbox registers 1-3. We do
192 		 * this for PCI cards because otherwise we really don't
193 		 * know what state the card is in and we could hang if
194 		 * we try this command otherwise.
195 		 *
196 		 * For SBus cards, we just do this because they almost
197 		 * certainly will be running firmware by now.
198 		 */
199 		if (ISP_READ(isp, OUTMAILBOX1) != 0x4953 ||
200 		    ISP_READ(isp, OUTMAILBOX2) != 0x5020 ||
201 		    ISP_READ(isp, OUTMAILBOX3) != 0x2020) {
202 			/*
203 			 * Just in case it was paused...
204 			 */
205 			ISP_WRITE(isp, HCCR, HCCR_CMD_RELEASE);
206 			mbs.param[0] = MBOX_ABOUT_FIRMWARE;
207 			isp_mboxcmd(isp, &mbs, MBLOGNONE);
208 			if (mbs.param[0] == MBOX_COMMAND_COMPLETE) {
209 				isp->isp_romfw_rev[0] = mbs.param[1];
210 				isp->isp_romfw_rev[1] = mbs.param[2];
211 				isp->isp_romfw_rev[2] = mbs.param[3];
212 			}
213 		}
214 		isp->isp_touched = 1;
215 	}
216 
217 	DISABLE_INTS(isp);
218 
219 	/*
220 	 * Set up default request/response queue in-pointer/out-pointer
221 	 * register indices.
222 	 */
223 	if (IS_23XX(isp)) {
224 		isp->isp_rqstinrp = BIU_REQINP;
225 		isp->isp_rqstoutrp = BIU_REQOUTP;
226 		isp->isp_respinrp = BIU_RSPINP;
227 		isp->isp_respoutrp = BIU_RSPOUTP;
228 	} else {
229 		isp->isp_rqstinrp = INMAILBOX4;
230 		isp->isp_rqstoutrp = OUTMAILBOX4;
231 		isp->isp_respinrp = OUTMAILBOX5;
232 		isp->isp_respoutrp = INMAILBOX5;
233 	}
234 
235 	/*
236 	 * Put the board into PAUSE mode (so we can read the SXP registers
237 	 * or write FPM/FBM registers).
238 	 */
239 	ISP_WRITE(isp, HCCR, HCCR_CMD_PAUSE);
240 
241 	if (IS_FC(isp)) {
242 		switch (isp->isp_type) {
243 		case ISP_HA_FC_2100:
244 			btype = "2100";
245 			break;
246 		case ISP_HA_FC_2200:
247 			btype = "2200";
248 			break;
249 		case ISP_HA_FC_2300:
250 			btype = "2300";
251 			break;
252 		case ISP_HA_FC_2312:
253 			btype = "2312";
254 			break;
255 		default:
256 			break;
257 		}
258 		/*
259 		 * While we're paused, reset the FPM module and FBM fifos.
260 		 */
261 		ISP_WRITE(isp, BIU2100_CSR, BIU2100_FPM0_REGS);
262 		ISP_WRITE(isp, FPM_DIAG_CONFIG, FPM_SOFT_RESET);
263 		ISP_WRITE(isp, BIU2100_CSR, BIU2100_FB_REGS);
264 		ISP_WRITE(isp, FBM_CMD, FBMCMD_FIFO_RESET_ALL);
265 		ISP_WRITE(isp, BIU2100_CSR, BIU2100_RISC_REGS);
266 	} else if (IS_1240(isp)) {
267 		sdparam *sdp = isp->isp_param;
268 		btype = "1240";
269 		isp->isp_clock = 60;
270 		sdp->isp_ultramode = 1;
271 		sdp++;
272 		sdp->isp_ultramode = 1;
273 		/*
274 		 * XXX: Should probably do some bus sensing.
275 		 */
276 	} else if (IS_ULTRA2(isp)) {
277 		static const char m[] = "bus %d is in %s Mode";
278 		u_int16_t l;
279 		sdparam *sdp = isp->isp_param;
280 
281 		isp->isp_clock = 100;
282 
283 		if (IS_1280(isp))
284 			btype = "1280";
285 		else if (IS_1080(isp))
286 			btype = "1080";
287 		else if (IS_12160(isp))
288 			btype = "12160";
289 		else
290 			btype = "<UNKLVD>";
291 
292 		l = ISP_READ(isp, SXP_PINS_DIFF) & ISP1080_MODE_MASK;
293 		switch (l) {
294 		case ISP1080_LVD_MODE:
295 			sdp->isp_lvdmode = 1;
296 			isp_prt(isp, ISP_LOGCONFIG, m, 0, "LVD");
297 			break;
298 		case ISP1080_HVD_MODE:
299 			sdp->isp_diffmode = 1;
300 			isp_prt(isp, ISP_LOGCONFIG, m, 0, "Differential");
301 			break;
302 		case ISP1080_SE_MODE:
303 			sdp->isp_ultramode = 1;
304 			isp_prt(isp, ISP_LOGCONFIG, m, 0, "Single-Ended");
305 			break;
306 		default:
307 			isp_prt(isp, ISP_LOGERR,
308 			    "unknown mode on bus %d (0x%x)", 0, l);
309 			break;
310 		}
311 
312 		if (IS_DUALBUS(isp)) {
313 			sdp++;
314 			l = ISP_READ(isp, SXP_PINS_DIFF|SXP_BANK1_SELECT);
315 			l &= ISP1080_MODE_MASK;
316 			switch(l) {
317 			case ISP1080_LVD_MODE:
318 				sdp->isp_lvdmode = 1;
319 				isp_prt(isp, ISP_LOGCONFIG, m, 1, "LVD");
320 				break;
321 			case ISP1080_HVD_MODE:
322 				sdp->isp_diffmode = 1;
323 				isp_prt(isp, ISP_LOGCONFIG,
324 				    m, 1, "Differential");
325 				break;
326 			case ISP1080_SE_MODE:
327 				sdp->isp_ultramode = 1;
328 				isp_prt(isp, ISP_LOGCONFIG,
329 				    m, 1, "Single-Ended");
330 				break;
331 			default:
332 				isp_prt(isp, ISP_LOGERR,
333 				    "unknown mode on bus %d (0x%x)", 1, l);
334 				break;
335 			}
336 		}
337 	} else {
338 		sdparam *sdp = isp->isp_param;
339 		i = ISP_READ(isp, BIU_CONF0) & BIU_CONF0_HW_MASK;
340 		switch (i) {
341 		default:
342 			isp_prt(isp, ISP_LOGALL, "Unknown Chip Type 0x%x", i);
343 			/* FALLTHROUGH */
344 		case 1:
345 			btype = "1020";
346 			isp->isp_type = ISP_HA_SCSI_1020;
347 			isp->isp_clock = 40;
348 			break;
349 		case 2:
350 			/*
351 			 * Some 1020A chips are Ultra Capable, but don't
352 			 * run the clock rate up for that unless told to
353 			 * do so by the Ultra Capable bits being set.
354 			 */
355 			btype = "1020A";
356 			isp->isp_type = ISP_HA_SCSI_1020A;
357 			isp->isp_clock = 40;
358 			break;
359 		case 3:
360 			btype = "1040";
361 			isp->isp_type = ISP_HA_SCSI_1040;
362 			isp->isp_clock = 60;
363 			break;
364 		case 4:
365 			btype = "1040A";
366 			isp->isp_type = ISP_HA_SCSI_1040A;
367 			isp->isp_clock = 60;
368 			break;
369 		case 5:
370 			btype = "1040B";
371 			isp->isp_type = ISP_HA_SCSI_1040B;
372 			isp->isp_clock = 60;
373 			break;
374 		case 6:
375 			btype = "1040C";
376 			isp->isp_type = ISP_HA_SCSI_1040C;
377 			isp->isp_clock = 60;
378                         break;
379 		}
380 		/*
381 		 * Now, while we're at it, gather info about ultra
382 		 * and/or differential mode.
383 		 */
384 		if (ISP_READ(isp, SXP_PINS_DIFF) & SXP_PINS_DIFF_MODE) {
385 			isp_prt(isp, ISP_LOGCONFIG, "Differential Mode");
386 			sdp->isp_diffmode = 1;
387 		} else {
388 			sdp->isp_diffmode = 0;
389 		}
390 		i = ISP_READ(isp, RISC_PSR);
391 		if (isp->isp_bustype == ISP_BT_SBUS) {
392 			i &= RISC_PSR_SBUS_ULTRA;
393 		} else {
394 			i &= RISC_PSR_PCI_ULTRA;
395 		}
396 		if (i != 0) {
397 			isp_prt(isp, ISP_LOGCONFIG, "Ultra Mode Capable");
398 			sdp->isp_ultramode = 1;
399 			/*
400 			 * If we're in Ultra Mode, we have to be 60Mhz clock-
401 			 * even for the SBus version.
402 			 */
403 			isp->isp_clock = 60;
404 		} else {
405 			sdp->isp_ultramode = 0;
406 			/*
407 			 * Clock is known. Gronk.
408 			 */
409 		}
410 
411 		/*
412 		 * Machine dependent clock (if set) overrides
413 		 * our generic determinations.
414 		 */
415 		if (isp->isp_mdvec->dv_clock) {
416 			if (isp->isp_mdvec->dv_clock < isp->isp_clock) {
417 				isp->isp_clock = isp->isp_mdvec->dv_clock;
418 			}
419 		}
420 
421 	}
422 
423 	/*
424 	 * Clear instrumentation
425 	 */
426 	isp->isp_intcnt = isp->isp_intbogus = 0;
427 
428 	/*
429 	 * Do MD specific pre initialization
430 	 */
431 	ISP_RESET0(isp);
432 
433 again:
434 
435 	/*
436 	 * Hit the chip over the head with hammer,
437 	 * and give the ISP a chance to recover.
438 	 */
439 
440 	if (IS_SCSI(isp)) {
441 		ISP_WRITE(isp, BIU_ICR, BIU_ICR_SOFT_RESET);
442 		/*
443 		 * A slight delay...
444 		 */
445 		USEC_DELAY(100);
446 
447 		/*
448 		 * Clear data && control DMA engines.
449 		 */
450 		ISP_WRITE(isp, CDMA_CONTROL,
451 		    DMA_CNTRL_CLEAR_CHAN | DMA_CNTRL_RESET_INT);
452 		ISP_WRITE(isp, DDMA_CONTROL,
453 		    DMA_CNTRL_CLEAR_CHAN | DMA_CNTRL_RESET_INT);
454 
455 
456 	} else {
457 		ISP_WRITE(isp, BIU2100_CSR, BIU2100_SOFT_RESET);
458 		/*
459 		 * A slight delay...
460 		 */
461 		USEC_DELAY(100);
462 
463 		/*
464 		 * Clear data && control DMA engines.
465 		 */
466 		ISP_WRITE(isp, CDMA2100_CONTROL,
467 			DMA_CNTRL2100_CLEAR_CHAN | DMA_CNTRL2100_RESET_INT);
468 		ISP_WRITE(isp, TDMA2100_CONTROL,
469 			DMA_CNTRL2100_CLEAR_CHAN | DMA_CNTRL2100_RESET_INT);
470 		ISP_WRITE(isp, RDMA2100_CONTROL,
471 			DMA_CNTRL2100_CLEAR_CHAN | DMA_CNTRL2100_RESET_INT);
472 	}
473 
474 	/*
475 	 * Wait for ISP to be ready to go...
476 	 */
477 	loops = MBOX_DELAY_COUNT;
478 	for (;;) {
479 		if (IS_SCSI(isp)) {
480 			if (!(ISP_READ(isp, BIU_ICR) & BIU_ICR_SOFT_RESET))
481 				break;
482 		} else {
483 			if (!(ISP_READ(isp, BIU2100_CSR) & BIU2100_SOFT_RESET))
484 				break;
485 		}
486 		USEC_DELAY(100);
487 		if (--loops < 0) {
488 			ISP_DUMPREGS(isp, "chip reset timed out");
489 			return;
490 		}
491 	}
492 
493 	/*
494 	 * After we've fired this chip up, zero out the conf1 register
495 	 * for SCSI adapters and other settings for the 2100.
496 	 */
497 
498 	if (IS_SCSI(isp)) {
499 		ISP_WRITE(isp, BIU_CONF1, 0);
500 	} else {
501 		ISP_WRITE(isp, BIU2100_CSR, 0);
502 	}
503 
504 	/*
505 	 * Reset RISC Processor
506 	 */
507 	ISP_WRITE(isp, HCCR, HCCR_CMD_RESET);
508 	USEC_DELAY(100);
509 	/* Clear semaphore register (just to be sure) */
510 	ISP_WRITE(isp, BIU_SEMA, 0);
511 
512 	/*
513 	 * Establish some initial burst rate stuff.
514 	 * (only for the 1XX0 boards). This really should
515 	 * be done later after fetching from NVRAM.
516 	 */
517 	if (IS_SCSI(isp)) {
518 		u_int16_t tmp = isp->isp_mdvec->dv_conf1;
519 		/*
520 		 * Busted FIFO. Turn off all but burst enables.
521 		 */
522 		if (isp->isp_type == ISP_HA_SCSI_1040A) {
523 			tmp &= BIU_BURST_ENABLE;
524 		}
525 		ISP_SETBITS(isp, BIU_CONF1, tmp);
526 		if (tmp & BIU_BURST_ENABLE) {
527 			ISP_SETBITS(isp, CDMA_CONF, DMA_ENABLE_BURST);
528 			ISP_SETBITS(isp, DDMA_CONF, DMA_ENABLE_BURST);
529 		}
530 #ifdef	PTI_CARDS
531 		if (((sdparam *) isp->isp_param)->isp_ultramode) {
532 			while (ISP_READ(isp, RISC_MTR) != 0x1313) {
533 				ISP_WRITE(isp, RISC_MTR, 0x1313);
534 				ISP_WRITE(isp, HCCR, HCCR_CMD_STEP);
535 			}
536 		} else {
537 			ISP_WRITE(isp, RISC_MTR, 0x1212);
538 		}
539 		/*
540 		 * PTI specific register
541 		 */
542 		ISP_WRITE(isp, RISC_EMB, DUAL_BANK)
543 #else
544 		ISP_WRITE(isp, RISC_MTR, 0x1212);
545 #endif
546 	} else {
547 		ISP_WRITE(isp, RISC_MTR2100, 0x1212);
548 		if (IS_2200(isp) || IS_23XX(isp)) {
549 			ISP_WRITE(isp, HCCR, HCCR_2X00_DISABLE_PARITY_PAUSE);
550 		}
551 	}
552 
553 	ISP_WRITE(isp, HCCR, HCCR_CMD_RELEASE); /* release paused processor */
554 
555 	/*
556 	 * Do MD specific post initialization
557 	 */
558 	ISP_RESET1(isp);
559 
560 	/*
561 	 * Wait for everything to finish firing up.
562 	 *
563 	 * Avoid doing this on the 2312 because you can generate a PCI
564 	 * parity error (chip breakage).
565 	 */
566 	if (IS_23XX(isp)) {
567 		USEC_DELAY(5);
568 	} else {
569 		loops = MBOX_DELAY_COUNT;
570 		while (ISP_READ(isp, OUTMAILBOX0) == MBOX_BUSY) {
571 			USEC_DELAY(100);
572 			if (--loops < 0) {
573 				isp_prt(isp, ISP_LOGERR,
574 				    "MBOX_BUSY never cleared on reset");
575 				return;
576 			}
577 		}
578 	}
579 
580 	/*
581 	 * Up until this point we've done everything by just reading or
582 	 * setting registers. From this point on we rely on at least *some*
583 	 * kind of firmware running in the card.
584 	 */
585 
586 	/*
587 	 * Do some sanity checking.
588 	 */
589 	mbs.param[0] = MBOX_NO_OP;
590 	isp_mboxcmd(isp, &mbs, MBLOGALL);
591 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
592 		return;
593 	}
594 
595 	if (IS_SCSI(isp)) {
596 		mbs.param[0] = MBOX_MAILBOX_REG_TEST;
597 		mbs.param[1] = 0xdead;
598 		mbs.param[2] = 0xbeef;
599 		mbs.param[3] = 0xffff;
600 		mbs.param[4] = 0x1111;
601 		mbs.param[5] = 0xa5a5;
602 		isp_mboxcmd(isp, &mbs, MBLOGALL);
603 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
604 			return;
605 		}
606 		if (mbs.param[1] != 0xdead || mbs.param[2] != 0xbeef ||
607 		    mbs.param[3] != 0xffff || mbs.param[4] != 0x1111 ||
608 		    mbs.param[5] != 0xa5a5) {
609 			isp_prt(isp, ISP_LOGERR,
610 			    "Register Test Failed (0x%x 0x%x 0x%x 0x%x 0x%x)",
611 			    mbs.param[1], mbs.param[2], mbs.param[3],
612 			    mbs.param[4], mbs.param[5]);
613 			return;
614 		}
615 
616 	}
617 
618 	/*
619 	 * Download new Firmware, unless requested not to do so.
620 	 * This is made slightly trickier in some cases where the
621 	 * firmware of the ROM revision is newer than the revision
622 	 * compiled into the driver. So, where we used to compare
623 	 * versions of our f/w and the ROM f/w, now we just see
624 	 * whether we have f/w at all and whether a config flag
625 	 * has disabled our download.
626 	 */
627 	if ((isp->isp_mdvec->dv_ispfw == NULL) ||
628 	    (isp->isp_confopts & ISP_CFG_NORELOAD)) {
629 		dodnld = 0;
630 	}
631 
632 	if (IS_23XX(isp))
633 		code_org = ISP_CODE_ORG_2300;
634 	else
635 		code_org = ISP_CODE_ORG;
636 
637 	if (dodnld) {
638 		isp->isp_mbxworkp = (void *) &isp->isp_mdvec->dv_ispfw[1];
639 		isp->isp_mbxwrk0 = isp->isp_mdvec->dv_ispfw[3] - 1;
640 		isp->isp_mbxwrk1 = code_org + 1;
641 		mbs.param[0] = MBOX_WRITE_RAM_WORD;
642 		mbs.param[1] = code_org;
643 		mbs.param[2] = isp->isp_mdvec->dv_ispfw[0];
644 		isp_mboxcmd(isp, &mbs, MBLOGNONE);
645 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
646 			isp_prt(isp, ISP_LOGERR,
647 			    "F/W download failed at word %d",
648 			    isp->isp_mbxwrk1 - code_org);
649 			dodnld = 0;
650 			goto again;
651 		}
652 		/*
653 		 * Verify that it downloaded correctly.
654 		 */
655 		mbs.param[0] = MBOX_VERIFY_CHECKSUM;
656 		mbs.param[1] = code_org;
657 		isp_mboxcmd(isp, &mbs, MBLOGNONE);
658 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
659 			isp_prt(isp, ISP_LOGERR, "Ram Checksum Failure");
660 			return;
661 		}
662 		isp->isp_loaded_fw = 1;
663 	} else {
664 		isp->isp_loaded_fw = 0;
665 		isp_prt(isp, ISP_LOGDEBUG2, "skipping f/w download");
666 	}
667 
668 	/*
669 	 * Now start it rolling.
670 	 *
671 	 * If we didn't actually download f/w,
672 	 * we still need to (re)start it.
673 	 */
674 
675 
676 	mbs.param[0] = MBOX_EXEC_FIRMWARE;
677 	mbs.param[1] = code_org;
678 	isp_mboxcmd(isp, &mbs, MBLOGNONE);
679 	/* give it a chance to start */
680 	USEC_SLEEP(isp, 500);
681 
682 	if (IS_SCSI(isp)) {
683 		/*
684 		 * Set CLOCK RATE, but only if asked to.
685 		 */
686 		if (isp->isp_clock) {
687 			mbs.param[0] = MBOX_SET_CLOCK_RATE;
688 			mbs.param[1] = isp->isp_clock;
689 			isp_mboxcmd(isp, &mbs, MBLOGALL);
690 			/* we will try not to care if this fails */
691 		}
692 	}
693 
694 	mbs.param[0] = MBOX_ABOUT_FIRMWARE;
695 	isp_mboxcmd(isp, &mbs, MBLOGALL);
696 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
697 		return;
698 	}
699 
700 	/*
701 	 * The SBus firmware that we are using apparently does not return
702 	 * major, minor, micro revisions in the mailbox registers, which
703 	 * is really, really, annoying.
704 	 */
705 	if (ISP_SBUS_SUPPORTED && isp->isp_bustype == ISP_BT_SBUS) {
706 		if (dodnld) {
707 #ifdef	ISP_TARGET_MODE
708 			isp->isp_fwrev[0] = 7;
709 			isp->isp_fwrev[1] = 55;
710 #else
711 			isp->isp_fwrev[0] = 1;
712 			isp->isp_fwrev[1] = 37;
713 #endif
714 			isp->isp_fwrev[2] = 0;
715 		}
716 	} else {
717 		isp->isp_fwrev[0] = mbs.param[1];
718 		isp->isp_fwrev[1] = mbs.param[2];
719 		isp->isp_fwrev[2] = mbs.param[3];
720 	}
721 	isp_prt(isp, ISP_LOGCONFIG,
722 	    "Board Type %s, Chip Revision 0x%x, %s F/W Revision %d.%d.%d",
723 	    btype, isp->isp_revision, dodnld? "loaded" : "resident",
724 	    isp->isp_fwrev[0], isp->isp_fwrev[1], isp->isp_fwrev[2]);
725 
726 	if (IS_FC(isp)) {
727 		/*
728 		 * We do not believe firmware attributes for 2100 code less
729 		 * than 1.17.0.
730 		 */
731 		if (IS_2100(isp) &&
732 		   (ISP_FW_REVX(isp->isp_fwrev) < ISP_FW_REV(1, 17, 0))) {
733 			FCPARAM(isp)->isp_fwattr = 0;
734 		} else {
735 			FCPARAM(isp)->isp_fwattr = mbs.param[6];
736 			isp_prt(isp, ISP_LOGDEBUG0,
737 			    "Firmware Attributes = 0x%x", mbs.param[6]);
738 		}
739 		if (ISP_READ(isp, BIU2100_CSR) & BIU2100_PCI64) {
740 			isp_prt(isp, ISP_LOGCONFIG,
741 			    "Installed in 64-Bit PCI slot");
742 		}
743 	}
744 
745 	if (isp->isp_romfw_rev[0] || isp->isp_romfw_rev[1] ||
746 	    isp->isp_romfw_rev[2]) {
747 		isp_prt(isp, ISP_LOGCONFIG, "Last F/W revision was %d.%d.%d",
748 		    isp->isp_romfw_rev[0], isp->isp_romfw_rev[1],
749 		    isp->isp_romfw_rev[2]);
750 	}
751 
752 	mbs.param[0] = MBOX_GET_FIRMWARE_STATUS;
753 	isp_mboxcmd(isp, &mbs, MBLOGALL);
754 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
755 		return;
756 	}
757 	isp->isp_maxcmds = mbs.param[2];
758 	isp_prt(isp, ISP_LOGINFO,
759 	    "%d max I/O commands supported", mbs.param[2]);
760 	isp_fw_state(isp);
761 
762 	/*
763 	 * Set up DMA for the request and result mailboxes.
764 	 */
765 	if (ISP_MBOXDMASETUP(isp) != 0) {
766 		isp_prt(isp, ISP_LOGERR, "Cannot setup DMA");
767 		return;
768 	}
769 	isp->isp_state = ISP_RESETSTATE;
770 
771 	/*
772 	 * Okay- now that we have new firmware running, we now (re)set our
773 	 * notion of how many luns we support. This is somewhat tricky because
774 	 * if we haven't loaded firmware, we sometimes do not have an easy way
775 	 * of knowing how many luns we support.
776 	 *
777 	 * Expanded lun firmware gives you 32 luns for SCSI cards and
778 	 * 16384 luns for Fibre Channel cards.
779 	 *
780 	 * It turns out that even for QLogic 2100s with ROM 1.10 and above
781 	 * we do get a firmware attributes word returned in mailbox register 6.
782 	 *
783 	 * Because the lun is in a a different position in the Request Queue
784 	 * Entry structure for Fibre Channel with expanded lun firmware, we
785 	 * can only support one lun (lun zero) when we don't know what kind
786 	 * of firmware we're running.
787 	 *
788 	 * Note that we only do this once (the first time thru isp_reset)
789 	 * because we may be called again after firmware has been loaded once
790 	 * and released.
791 	 */
792 	if (touched == 0) {
793 		if (IS_SCSI(isp)) {
794 			if (dodnld) {
795 				isp->isp_maxluns = 32;
796 			} else {
797 				isp->isp_maxluns = 8;
798 			}
799 		} else {
800 			if (FCPARAM(isp)->isp_fwattr & ISP_FW_ATTR_SCCLUN) {
801 				isp->isp_maxluns = 16384;
802 			} else {
803 				isp->isp_maxluns = 16;
804 			}
805 		}
806 	}
807 }
808 
809 /*
810  * Initialize Parameters of Hardware to a known state.
811  *
812  * Locks are held before coming here.
813  */
814 
815 void
816 isp_init(struct ispsoftc *isp)
817 {
818 	/*
819 	 * Must do this first to get defaults established.
820 	 */
821 	isp_setdfltparm(isp, 0);
822 	if (IS_DUALBUS(isp)) {
823 		isp_setdfltparm(isp, 1);
824 	}
825 	if (IS_FC(isp)) {
826 		isp_fibre_init(isp);
827 	} else {
828 		isp_scsi_init(isp);
829 	}
830 }
831 
832 static void
833 isp_scsi_init(struct ispsoftc *isp)
834 {
835 	sdparam *sdp_chan0, *sdp_chan1;
836 	mbreg_t mbs;
837 
838 	sdp_chan0 = isp->isp_param;
839 	sdp_chan1 = sdp_chan0;
840 	if (IS_DUALBUS(isp)) {
841 		sdp_chan1++;
842 	}
843 
844 	/*
845 	 * If we have no role (neither target nor initiator), return.
846 	 */
847 	if (isp->isp_role == ISP_ROLE_NONE) {
848 		return;
849 	}
850 
851 	/* First do overall per-card settings. */
852 
853 	/*
854 	 * If we have fast memory timing enabled, turn it on.
855 	 */
856 	if (sdp_chan0->isp_fast_mttr) {
857 		ISP_WRITE(isp, RISC_MTR, 0x1313);
858 	}
859 
860 	/*
861 	 * Set Retry Delay and Count.
862 	 * You set both channels at the same time.
863 	 */
864 	mbs.param[0] = MBOX_SET_RETRY_COUNT;
865 	mbs.param[1] = sdp_chan0->isp_retry_count;
866 	mbs.param[2] = sdp_chan0->isp_retry_delay;
867 	mbs.param[6] = sdp_chan1->isp_retry_count;
868 	mbs.param[7] = sdp_chan1->isp_retry_delay;
869 
870 	isp_mboxcmd(isp, &mbs, MBLOGALL);
871 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
872 		return;
873 	}
874 
875 	/*
876 	 * Set ASYNC DATA SETUP time. This is very important.
877 	 */
878 	mbs.param[0] = MBOX_SET_ASYNC_DATA_SETUP_TIME;
879 	mbs.param[1] = sdp_chan0->isp_async_data_setup;
880 	mbs.param[2] = sdp_chan1->isp_async_data_setup;
881 	isp_mboxcmd(isp, &mbs, MBLOGALL);
882 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
883 		return;
884 	}
885 
886 	/*
887 	 * Set ACTIVE Negation State.
888 	 */
889 	mbs.param[0] = MBOX_SET_ACT_NEG_STATE;
890 	mbs.param[1] =
891 	    (sdp_chan0->isp_req_ack_active_neg << 4) |
892 	    (sdp_chan0->isp_data_line_active_neg << 5);
893 	mbs.param[2] =
894 	    (sdp_chan1->isp_req_ack_active_neg << 4) |
895 	    (sdp_chan1->isp_data_line_active_neg << 5);
896 
897 	isp_mboxcmd(isp, &mbs, MBLOGNONE);
898 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
899 		isp_prt(isp, ISP_LOGERR,
900 		    "failed to set active negation state (%d,%d), (%d,%d)",
901 		    sdp_chan0->isp_req_ack_active_neg,
902 		    sdp_chan0->isp_data_line_active_neg,
903 		    sdp_chan1->isp_req_ack_active_neg,
904 		    sdp_chan1->isp_data_line_active_neg);
905 		/*
906 		 * But don't return.
907 		 */
908 	}
909 
910 	/*
911 	 * Set the Tag Aging limit
912 	 */
913 	mbs.param[0] = MBOX_SET_TAG_AGE_LIMIT;
914 	mbs.param[1] = sdp_chan0->isp_tag_aging;
915 	mbs.param[2] = sdp_chan1->isp_tag_aging;
916 	isp_mboxcmd(isp, &mbs, MBLOGALL);
917 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
918 		isp_prt(isp, ISP_LOGERR, "failed to set tag age limit (%d,%d)",
919 		    sdp_chan0->isp_tag_aging, sdp_chan1->isp_tag_aging);
920 		return;
921 	}
922 
923 	/*
924 	 * Set selection timeout.
925 	 */
926 	mbs.param[0] = MBOX_SET_SELECT_TIMEOUT;
927 	mbs.param[1] = sdp_chan0->isp_selection_timeout;
928 	mbs.param[2] = sdp_chan1->isp_selection_timeout;
929 	isp_mboxcmd(isp, &mbs, MBLOGALL);
930 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
931 		return;
932 	}
933 
934 	/* now do per-channel settings */
935 	isp_scsi_channel_init(isp, 0);
936 	if (IS_DUALBUS(isp))
937 		isp_scsi_channel_init(isp, 1);
938 
939 	/*
940 	 * Now enable request/response queues
941 	 */
942 
943 	mbs.param[0] = MBOX_INIT_RES_QUEUE;
944 	mbs.param[1] = RESULT_QUEUE_LEN(isp);
945 	mbs.param[2] = DMA_WD1(isp->isp_result_dma);
946 	mbs.param[3] = DMA_WD0(isp->isp_result_dma);
947 	mbs.param[4] = 0;
948 	mbs.param[5] = 0;
949 	isp_mboxcmd(isp, &mbs, MBLOGALL);
950 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
951 		return;
952 	}
953 	isp->isp_residx = mbs.param[5];
954 
955 	mbs.param[0] = MBOX_INIT_REQ_QUEUE;
956 	mbs.param[1] = RQUEST_QUEUE_LEN(isp);
957 	mbs.param[2] = DMA_WD1(isp->isp_rquest_dma);
958 	mbs.param[3] = DMA_WD0(isp->isp_rquest_dma);
959 	mbs.param[4] = 0;
960 	isp_mboxcmd(isp, &mbs, MBLOGALL);
961 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
962 		return;
963 	}
964 	isp->isp_reqidx = isp->isp_reqodx = mbs.param[4];
965 
966 	/*
967 	 * Turn on Fast Posting, LVD transitions
968 	 *
969 	 * Ultra2 F/W always has had fast posting (and LVD transitions)
970 	 *
971 	 * Ultra and older (i.e., SBus) cards may not. It's just safer
972 	 * to assume not for them.
973 	 */
974 
975 	mbs.param[0] = MBOX_SET_FW_FEATURES;
976 	mbs.param[1] = 0;
977 	if (IS_ULTRA2(isp))
978 		mbs.param[1] |= FW_FEATURE_LVD_NOTIFY;
979 #ifndef	ISP_NO_RIO
980 	if (IS_ULTRA2(isp) || IS_1240(isp))
981 		mbs.param[1] |= FW_FEATURE_RIO_16BIT;
982 #else
983 #ifndef	ISP_NO_FASTPOST
984 	if (IS_ULTRA2(isp) || IS_1240(isp))
985 		mbs.param[1] |= FW_FEATURE_FAST_POST;
986 #endif
987 #endif
988 	if (mbs.param[1] != 0) {
989 		u_int16_t sfeat = mbs.param[1];
990 		isp_mboxcmd(isp, &mbs, MBLOGALL);
991 		if (mbs.param[0] == MBOX_COMMAND_COMPLETE) {
992 			isp_prt(isp, ISP_LOGINFO,
993 			    "Enabled FW features (0x%x)", sfeat);
994 		}
995 	}
996 
997 	/*
998 	 * Let the outer layers decide whether to issue a SCSI bus reset.
999 	 */
1000 	isp->isp_state = ISP_INITSTATE;
1001 }
1002 
1003 static void
1004 isp_scsi_channel_init(struct ispsoftc *isp, int channel)
1005 {
1006 	sdparam *sdp;
1007 	mbreg_t mbs;
1008 	int tgt;
1009 
1010 	sdp = isp->isp_param;
1011 	sdp += channel;
1012 
1013 	/*
1014 	 * Set (possibly new) Initiator ID.
1015 	 */
1016 	mbs.param[0] = MBOX_SET_INIT_SCSI_ID;
1017 	mbs.param[1] = (channel << 7) | sdp->isp_initiator_id;
1018 	isp_mboxcmd(isp, &mbs, MBLOGALL);
1019 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
1020 		return;
1021 	}
1022 	isp_prt(isp, ISP_LOGINFO, "Initiator ID is %d on Channel %d",
1023 	    sdp->isp_initiator_id, channel);
1024 
1025 
1026 	/*
1027 	 * Set current per-target parameters to an initial safe minimum.
1028 	 */
1029 	for (tgt = 0; tgt < MAX_TARGETS; tgt++) {
1030 		int lun;
1031 		u_int16_t sdf;
1032 
1033 		if (sdp->isp_devparam[tgt].dev_enable == 0) {
1034 			continue;
1035 		}
1036 #ifndef	ISP_TARGET_MODE
1037 		sdf = sdp->isp_devparam[tgt].goal_flags;
1038 		sdf &= DPARM_SAFE_DFLT;
1039 		/*
1040 		 * It is not quite clear when this changed over so that
1041 		 * we could force narrow and async for 1000/1020 cards,
1042 		 * but assume that this is only the case for loaded
1043 		 * firmware.
1044 		 */
1045 		if (isp->isp_loaded_fw) {
1046 			sdf |= DPARM_NARROW | DPARM_ASYNC;
1047 		}
1048 #else
1049 		/*
1050 		 * The !$*!)$!$)* f/w uses the same index into some
1051 		 * internal table to decide how to respond to negotiations,
1052 		 * so if we've said "let's be safe" for ID X, and ID X
1053 		 * selects *us*, the negotiations will back to 'safe'
1054 		 * (as in narrow/async). What the f/w *should* do is
1055 		 * use the initiator id settings to decide how to respond.
1056 		 */
1057 		sdp->isp_devparam[tgt].goal_flags = sdf = DPARM_DEFAULT;
1058 #endif
1059 		mbs.param[0] = MBOX_SET_TARGET_PARAMS;
1060 		mbs.param[1] = (channel << 15) | (tgt << 8);
1061 		mbs.param[2] = sdf;
1062 		if ((sdf & DPARM_SYNC) == 0) {
1063 			mbs.param[3] = 0;
1064 		} else {
1065 			mbs.param[3] =
1066 			    (sdp->isp_devparam[tgt].goal_offset << 8) |
1067 			    (sdp->isp_devparam[tgt].goal_period);
1068 		}
1069 		isp_prt(isp, ISP_LOGDEBUG0,
1070 		    "Initial Settings bus%d tgt%d flags 0x%x off 0x%x per 0x%x",
1071 		    channel, tgt, mbs.param[2], mbs.param[3] >> 8,
1072 		    mbs.param[3] & 0xff);
1073 		isp_mboxcmd(isp, &mbs, MBLOGNONE);
1074 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
1075 			sdf = DPARM_SAFE_DFLT;
1076 			mbs.param[0] = MBOX_SET_TARGET_PARAMS;
1077 			mbs.param[1] = (tgt << 8) | (channel << 15);
1078 			mbs.param[2] = sdf;
1079 			mbs.param[3] = 0;
1080 			isp_mboxcmd(isp, &mbs, MBLOGALL);
1081 			if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
1082 				continue;
1083 			}
1084 		}
1085 
1086 		/*
1087 		 * We don't update any information directly from the f/w
1088 		 * because we need to run at least one command to cause a
1089 		 * new state to be latched up. So, we just assume that we
1090 		 * converge to the values we just had set.
1091 		 *
1092 		 * Ensure that we don't believe tagged queuing is enabled yet.
1093 		 * It turns out that sometimes the ISP just ignores our
1094 		 * attempts to set parameters for devices that it hasn't
1095 		 * seen yet.
1096 		 */
1097 		sdp->isp_devparam[tgt].actv_flags = sdf & ~DPARM_TQING;
1098 		for (lun = 0; lun < (int) isp->isp_maxluns; lun++) {
1099 			mbs.param[0] = MBOX_SET_DEV_QUEUE_PARAMS;
1100 			mbs.param[1] = (channel << 15) | (tgt << 8) | lun;
1101 			mbs.param[2] = sdp->isp_max_queue_depth;
1102 			mbs.param[3] = sdp->isp_devparam[tgt].exc_throttle;
1103 			isp_mboxcmd(isp, &mbs, MBLOGALL);
1104 			if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
1105 				break;
1106 			}
1107 		}
1108 	}
1109 	for (tgt = 0; tgt < MAX_TARGETS; tgt++) {
1110 		if (sdp->isp_devparam[tgt].dev_refresh) {
1111 			isp->isp_sendmarker |= (1 << channel);
1112 			isp->isp_update |= (1 << channel);
1113 			break;
1114 		}
1115 	}
1116 }
1117 
1118 /*
1119  * Fibre Channel specific initialization.
1120  *
1121  * Locks are held before coming here.
1122  */
1123 static void
1124 isp_fibre_init(struct ispsoftc *isp)
1125 {
1126 	fcparam *fcp;
1127 	isp_icb_t local, *icbp = &local;
1128 	mbreg_t mbs;
1129 	int loopid;
1130 	u_int64_t nwwn, pwwn;
1131 
1132 	fcp = isp->isp_param;
1133 
1134 	/*
1135 	 * Do this *before* initializing the firmware.
1136 	 */
1137 	isp_mark_getpdb_all(isp);
1138 	fcp->isp_fwstate = FW_CONFIG_WAIT;
1139 	fcp->isp_loopstate = LOOP_NIL;
1140 
1141 	/*
1142 	 * If we have no role (neither target nor initiator), return.
1143 	 */
1144 	if (isp->isp_role == ISP_ROLE_NONE) {
1145 		return;
1146 	}
1147 
1148 	loopid = fcp->isp_loopid;
1149 	MEMZERO(icbp, sizeof (*icbp));
1150 	icbp->icb_version = ICB_VERSION1;
1151 
1152 	/*
1153 	 * Firmware Options are either retrieved from NVRAM or
1154 	 * are patched elsewhere. We check them for sanity here
1155 	 * and make changes based on board revision, but otherwise
1156 	 * let others decide policy.
1157 	 */
1158 
1159 	/*
1160 	 * If this is a 2100 < revision 5, we have to turn off FAIRNESS.
1161 	 */
1162 	if ((isp->isp_type == ISP_HA_FC_2100) && isp->isp_revision < 5) {
1163 		fcp->isp_fwoptions &= ~ICBOPT_FAIRNESS;
1164 	}
1165 
1166 	/*
1167 	 * We have to use FULL LOGIN even though it resets the loop too much
1168 	 * because otherwise port database entries don't get updated after
1169 	 * a LIP- this is a known f/w bug for 2100 f/w less than 1.17.0.
1170 	 */
1171 	if (ISP_FW_REVX(isp->isp_fwrev) < ISP_FW_REV(1, 17, 0)) {
1172 		fcp->isp_fwoptions |= ICBOPT_FULL_LOGIN;
1173 	}
1174 
1175 	/*
1176 	 * Insist on Port Database Update Async notifications
1177 	 */
1178 	fcp->isp_fwoptions |= ICBOPT_PDBCHANGE_AE;
1179 
1180 
1181 	/*
1182 	 * Make sure that target role reflects into fwoptions.
1183 	 */
1184 	if (isp->isp_role & ISP_ROLE_TARGET) {
1185 		fcp->isp_fwoptions |= ICBOPT_TGT_ENABLE;
1186 	} else {
1187 		fcp->isp_fwoptions &= ~ICBOPT_TGT_ENABLE;
1188 	}
1189 
1190 	/*
1191 	 * Propagate all of this into the ICB structure.
1192 	 */
1193 	icbp->icb_fwoptions = fcp->isp_fwoptions;
1194 	icbp->icb_maxfrmlen = fcp->isp_maxfrmlen;
1195 	if (icbp->icb_maxfrmlen < ICB_MIN_FRMLEN ||
1196 	    icbp->icb_maxfrmlen > ICB_MAX_FRMLEN) {
1197 		isp_prt(isp, ISP_LOGERR,
1198 		    "bad frame length (%d) from NVRAM- using %d",
1199 		    fcp->isp_maxfrmlen, ICB_DFLT_FRMLEN);
1200 		icbp->icb_maxfrmlen = ICB_DFLT_FRMLEN;
1201 	}
1202 	icbp->icb_maxalloc = fcp->isp_maxalloc;
1203 	if (icbp->icb_maxalloc < 1) {
1204 		isp_prt(isp, ISP_LOGERR,
1205 		    "bad maximum allocation (%d)- using 16", fcp->isp_maxalloc);
1206 		icbp->icb_maxalloc = 16;
1207 	}
1208 	icbp->icb_execthrottle = fcp->isp_execthrottle;
1209 	if (icbp->icb_execthrottle < 1) {
1210 		isp_prt(isp, ISP_LOGERR,
1211 		    "bad execution throttle of %d- using 16",
1212 		    fcp->isp_execthrottle);
1213 		icbp->icb_execthrottle = ICB_DFLT_THROTTLE;
1214 	}
1215 	icbp->icb_retry_delay = fcp->isp_retry_delay;
1216 	icbp->icb_retry_count = fcp->isp_retry_count;
1217 	icbp->icb_hardaddr = loopid;
1218 	/*
1219 	 * Right now we just set extended options to prefer point-to-point
1220 	 * over loop based upon some soft config options.
1221 	 *
1222 	 * NB: for the 2300, ICBOPT_EXTENDED is required.
1223 	 */
1224 	if (IS_2200(isp) || IS_23XX(isp)) {
1225 		icbp->icb_fwoptions |= ICBOPT_EXTENDED;
1226 		/*
1227 		 * Prefer or force Point-To-Point instead Loop?
1228 		 */
1229 		switch(isp->isp_confopts & ISP_CFG_PORT_PREF) {
1230 		case ISP_CFG_NPORT:
1231 			icbp->icb_xfwoptions |= ICBXOPT_PTP_2_LOOP;
1232 			break;
1233 		case ISP_CFG_NPORT_ONLY:
1234 			icbp->icb_xfwoptions |= ICBXOPT_PTP_ONLY;
1235 			break;
1236 		case ISP_CFG_LPORT_ONLY:
1237 			icbp->icb_xfwoptions |= ICBXOPT_LOOP_ONLY;
1238 			break;
1239 		default:
1240 			icbp->icb_xfwoptions |= ICBXOPT_LOOP_2_PTP;
1241 			break;
1242 		}
1243 		if (IS_23XX(isp)) {
1244 			if (IS_2300(isp) && isp->isp_revision < 2) {
1245 				icbp->icb_fwoptions &= ~ICBOPT_FAST_POST;
1246 			}
1247 			if (isp->isp_confopts & ISP_CFG_ONEGB) {
1248 				icbp->icb_zfwoptions |= ICBZOPT_RATE_ONEGB;
1249 			} else if (isp->isp_confopts & ISP_CFG_TWOGB) {
1250 				icbp->icb_zfwoptions |= ICBZOPT_RATE_TWOGB;
1251 			} else {
1252 				icbp->icb_zfwoptions |= ICBZOPT_RATE_AUTO;
1253 			}
1254 		}
1255 	}
1256 
1257 #ifndef	ISP_NO_RIO_FC
1258 	/*
1259 	 * RIO seems to be enabled in 2100s for fw >= 1.17.0.
1260 	 *
1261 	 * I've had some questionable problems with RIO on 2200.
1262 	 * More specifically, on a 2204 I had problems with RIO
1263 	 * on a Linux system where I was dropping commands right
1264 	 * and left. It's not clear to me what the actual problem
1265 	 * was, but it seems safer to only support this on the
1266 	 * 23XX cards.
1267 	 *
1268 	 * I have it disabled if we support a target mode role for
1269 	 * reasons I can't now remember.
1270 	 */
1271 	if ((isp->isp_role & ISP_ROLE_TARGET) == 0 && IS_23XX(isp)) {
1272 		icbp->icb_xfwoptions |= ICBXOPT_RIO_16BIT;
1273 		icbp->icb_racctimer = 4;
1274 		icbp->icb_idelaytimer = 8;
1275 	}
1276 #endif
1277 
1278 	if ((IS_2200(isp) && ISP_FW_REVX(isp->isp_fwrev) >=
1279 	    ISP_FW_REV(2, 1, 26)) || IS_23XX(isp)) {
1280 		/*
1281 		 * Turn on LIP F8 async event (1)
1282 		 * Turn on generate AE 8013 on all LIP Resets (2)
1283 		 * Disable LIP F7 switching (8)
1284 		 */
1285 		mbs.param[0] = MBOX_SET_FIRMWARE_OPTIONS;
1286 		mbs.param[1] = 0xb;
1287 		mbs.param[2] = 0;
1288 		mbs.param[3] = 0;
1289 		isp_mboxcmd(isp, &mbs, MBLOGALL);
1290 	}
1291 	icbp->icb_logintime = 30;	/* 30 second login timeout */
1292 
1293 	if (IS_23XX(isp)) {
1294 		ISP_WRITE(isp, isp->isp_rqstinrp, 0);
1295         	ISP_WRITE(isp, isp->isp_rqstoutrp, 0);
1296         	ISP_WRITE(isp, isp->isp_respinrp, 0);
1297 		ISP_WRITE(isp, isp->isp_respoutrp, 0);
1298 	}
1299 
1300 	nwwn = ISP_NODEWWN(isp);
1301 	pwwn = ISP_PORTWWN(isp);
1302 	if (nwwn && pwwn) {
1303 		icbp->icb_fwoptions |= ICBOPT_BOTH_WWNS;
1304 		MAKE_NODE_NAME_FROM_WWN(icbp->icb_nodename, nwwn);
1305 		MAKE_NODE_NAME_FROM_WWN(icbp->icb_portname, pwwn);
1306 		isp_prt(isp, ISP_LOGDEBUG1,
1307 		    "Setting ICB Node 0x%08x%08x Port 0x%08x%08x",
1308 		    ((u_int32_t) (nwwn >> 32)),
1309 		    ((u_int32_t) (nwwn & 0xffffffff)),
1310 		    ((u_int32_t) (pwwn >> 32)),
1311 		    ((u_int32_t) (pwwn & 0xffffffff)));
1312 	} else {
1313 		isp_prt(isp, ISP_LOGDEBUG1, "Not using any WWNs");
1314 		icbp->icb_fwoptions &= ~(ICBOPT_BOTH_WWNS|ICBOPT_FULL_LOGIN);
1315 	}
1316 	icbp->icb_rqstqlen = RQUEST_QUEUE_LEN(isp);
1317 	icbp->icb_rsltqlen = RESULT_QUEUE_LEN(isp);
1318 	icbp->icb_rqstaddr[RQRSP_ADDR0015] = DMA_WD0(isp->isp_rquest_dma);
1319 	icbp->icb_rqstaddr[RQRSP_ADDR1631] = DMA_WD1(isp->isp_rquest_dma);
1320 	icbp->icb_rqstaddr[RQRSP_ADDR3247] = DMA_WD2(isp->isp_rquest_dma);
1321 	icbp->icb_rqstaddr[RQRSP_ADDR4863] = DMA_WD3(isp->isp_rquest_dma);
1322 	icbp->icb_respaddr[RQRSP_ADDR0015] = DMA_WD0(isp->isp_result_dma);
1323 	icbp->icb_respaddr[RQRSP_ADDR1631] = DMA_WD1(isp->isp_result_dma);
1324 	icbp->icb_respaddr[RQRSP_ADDR3247] = DMA_WD2(isp->isp_result_dma);
1325 	icbp->icb_respaddr[RQRSP_ADDR4863] = DMA_WD3(isp->isp_result_dma);
1326 	isp_prt(isp, ISP_LOGDEBUG1,
1327 	    "isp_fibre_init: fwoptions 0x%x", fcp->isp_fwoptions);
1328 
1329 	FC_SCRATCH_ACQUIRE(isp);
1330 	isp_put_icb(isp, icbp, (isp_icb_t *)fcp->isp_scratch);
1331 
1332 	/*
1333 	 * Init the firmware
1334 	 */
1335 	mbs.param[0] = MBOX_INIT_FIRMWARE;
1336 	mbs.param[1] = 0;
1337 	mbs.param[2] = DMA_WD1(fcp->isp_scdma);
1338 	mbs.param[3] = DMA_WD0(fcp->isp_scdma);
1339 	mbs.param[4] = 0;
1340 	mbs.param[5] = 0;
1341 	mbs.param[6] = DMA_WD3(fcp->isp_scdma);
1342 	mbs.param[7] = DMA_WD2(fcp->isp_scdma);
1343 	isp_mboxcmd(isp, &mbs, MBLOGALL);
1344 	FC_SCRATCH_RELEASE(isp);
1345 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
1346 		return;
1347 	}
1348 	isp->isp_reqidx = isp->isp_reqodx = 0;
1349 	isp->isp_residx = 0;
1350 	isp->isp_sendmarker = 1;
1351 
1352 	/*
1353 	 * Whatever happens, we're now committed to being here.
1354 	 */
1355 	isp->isp_state = ISP_INITSTATE;
1356 }
1357 
1358 /*
1359  * Fibre Channel Support- get the port database for the id.
1360  *
1361  * Locks are held before coming here. Return 0 if success,
1362  * else failure.
1363  */
1364 
1365 static int
1366 isp_getmap(struct ispsoftc *isp, fcpos_map_t *map)
1367 {
1368 	fcparam *fcp = (fcparam *) isp->isp_param;
1369 	mbreg_t mbs;
1370 
1371 	mbs.param[0] = MBOX_GET_FC_AL_POSITION_MAP;
1372 	mbs.param[1] = 0;
1373 	mbs.param[2] = DMA_WD1(fcp->isp_scdma);
1374 	mbs.param[3] = DMA_WD0(fcp->isp_scdma);
1375 	/*
1376 	 * Unneeded. For the 2100, except for initializing f/w, registers
1377 	 * 4/5 have to not be written to.
1378 	 *	mbs.param[4] = 0;
1379 	 *	mbs.param[5] = 0;
1380 	 *
1381 	 */
1382 	mbs.param[6] = 0;
1383 	mbs.param[7] = 0;
1384 	FC_SCRATCH_ACQUIRE(isp);
1385 	isp_mboxcmd(isp, &mbs, MBLOGALL & ~MBOX_COMMAND_PARAM_ERROR);
1386 	if (mbs.param[0] == MBOX_COMMAND_COMPLETE) {
1387 		MEMCPY(map, fcp->isp_scratch, sizeof (fcpos_map_t));
1388 		map->fwmap = mbs.param[1] != 0;
1389 		FC_SCRATCH_RELEASE(isp);
1390 		return (0);
1391 	}
1392 	FC_SCRATCH_RELEASE(isp);
1393 	return (-1);
1394 }
1395 
1396 static void
1397 isp_mark_getpdb_all(struct ispsoftc *isp)
1398 {
1399 	fcparam *fcp = (fcparam *) isp->isp_param;
1400 	int i;
1401 	for (i = 0; i < MAX_FC_TARG; i++) {
1402 		fcp->portdb[i].valid = fcp->portdb[i].fabric_dev = 0;
1403 	}
1404 }
1405 
1406 static int
1407 isp_getpdb(struct ispsoftc *isp, int id, isp_pdb_t *pdbp)
1408 {
1409 	fcparam *fcp = (fcparam *) isp->isp_param;
1410 	mbreg_t mbs;
1411 
1412 	mbs.param[0] = MBOX_GET_PORT_DB;
1413 	mbs.param[1] = id << 8;
1414 	mbs.param[2] = DMA_WD1(fcp->isp_scdma);
1415 	mbs.param[3] = DMA_WD0(fcp->isp_scdma);
1416 	/*
1417 	 * Unneeded. For the 2100, except for initializing f/w, registers
1418 	 * 4/5 have to not be written to.
1419 	 *	mbs.param[4] = 0;
1420 	 *	mbs.param[5] = 0;
1421 	 *
1422 	 */
1423 	mbs.param[6] = DMA_WD3(fcp->isp_scdma);
1424 	mbs.param[7] = DMA_WD2(fcp->isp_scdma);
1425 	FC_SCRATCH_ACQUIRE(isp);
1426 	isp_mboxcmd(isp, &mbs, MBLOGALL & ~MBOX_COMMAND_PARAM_ERROR);
1427 	if (mbs.param[0] == MBOX_COMMAND_COMPLETE) {
1428 		isp_get_pdb(isp, (isp_pdb_t *)fcp->isp_scratch, pdbp);
1429 		FC_SCRATCH_RELEASE(isp);
1430 		return (0);
1431 	}
1432 	FC_SCRATCH_RELEASE(isp);
1433 	return (-1);
1434 }
1435 
1436 static u_int64_t
1437 isp_get_portname(struct ispsoftc *isp, int loopid, int nodename)
1438 {
1439 	u_int64_t wwn = 0;
1440 	mbreg_t mbs;
1441 
1442 	mbs.param[0] = MBOX_GET_PORT_NAME;
1443 	mbs.param[1] = loopid << 8;
1444 	if (nodename)
1445 		mbs.param[1] |= 1;
1446 	isp_mboxcmd(isp, &mbs, MBLOGALL & ~MBOX_COMMAND_PARAM_ERROR);
1447 	if (mbs.param[0] == MBOX_COMMAND_COMPLETE) {
1448 		wwn =
1449 		    (((u_int64_t)(mbs.param[2] & 0xff)) << 56) |
1450 		    (((u_int64_t)(mbs.param[2] >> 8))	<< 48) |
1451 		    (((u_int64_t)(mbs.param[3] & 0xff))	<< 40) |
1452 		    (((u_int64_t)(mbs.param[3] >> 8))	<< 32) |
1453 		    (((u_int64_t)(mbs.param[6] & 0xff))	<< 24) |
1454 		    (((u_int64_t)(mbs.param[6] >> 8))	<< 16) |
1455 		    (((u_int64_t)(mbs.param[7] & 0xff))	<<  8) |
1456 		    (((u_int64_t)(mbs.param[7] >> 8)));
1457 	}
1458 	return (wwn);
1459 }
1460 
1461 /*
1462  * Make sure we have good FC link and know our Loop ID.
1463  */
1464 
1465 static int
1466 isp_fclink_test(struct ispsoftc *isp, int usdelay)
1467 {
1468 	static char *toponames[] = {
1469 		"Private Loop",
1470 		"FL Port",
1471 		"N-Port to N-Port",
1472 		"F Port",
1473 		"F Port (no FLOGI_ACC response)"
1474 	};
1475 	mbreg_t mbs;
1476 	int count, check_for_fabric;
1477 	u_int8_t lwfs;
1478 	fcparam *fcp;
1479 	struct lportdb *lp;
1480 	isp_pdb_t pdb;
1481 
1482 	fcp = isp->isp_param;
1483 
1484 	/*
1485 	 * XXX: Here is where we would start a 'loop dead' timeout
1486 	 */
1487 
1488 	/*
1489 	 * Wait up to N microseconds for F/W to go to a ready state.
1490 	 */
1491 	lwfs = FW_CONFIG_WAIT;
1492 	count = 0;
1493 	while (count < usdelay) {
1494 		u_int64_t enano;
1495 		u_int32_t wrk;
1496 		NANOTIME_T hra, hrb;
1497 
1498 		GET_NANOTIME(&hra);
1499 		isp_fw_state(isp);
1500 		if (lwfs != fcp->isp_fwstate) {
1501 			isp_prt(isp, ISP_LOGINFO, "Firmware State <%s->%s>",
1502 			    isp2100_fw_statename((int)lwfs),
1503 			    isp2100_fw_statename((int)fcp->isp_fwstate));
1504 			lwfs = fcp->isp_fwstate;
1505 		}
1506 		if (fcp->isp_fwstate == FW_READY) {
1507 			break;
1508 		}
1509 		GET_NANOTIME(&hrb);
1510 
1511 		/*
1512 		 * Get the elapsed time in nanoseconds.
1513 		 * Always guaranteed to be non-zero.
1514 		 */
1515 		enano = NANOTIME_SUB(&hrb, &hra);
1516 
1517 		isp_prt(isp, ISP_LOGDEBUG1,
1518 		    "usec%d: 0x%lx->0x%lx enano 0x%x%08x",
1519 		    count, (long) GET_NANOSEC(&hra), (long) GET_NANOSEC(&hrb),
1520 		    (u_int32_t)(enano >> 32), (u_int32_t)(enano & 0xffffffff));
1521 
1522 		/*
1523 		 * If the elapsed time is less than 1 millisecond,
1524 		 * delay a period of time up to that millisecond of
1525 		 * waiting.
1526 		 *
1527 		 * This peculiar code is an attempt to try and avoid
1528 		 * invoking u_int64_t math support functions for some
1529 		 * platforms where linkage is a problem.
1530 		 */
1531 		if (enano < (1000 * 1000)) {
1532 			count += 1000;
1533 			enano = (1000 * 1000) - enano;
1534 			while (enano > (u_int64_t) 4000000000U) {
1535 				USEC_SLEEP(isp, 4000000);
1536 				enano -= (u_int64_t) 4000000000U;
1537 			}
1538 			wrk = enano;
1539 			wrk /= 1000;
1540 			USEC_SLEEP(isp, wrk);
1541 		} else {
1542 			while (enano > (u_int64_t) 4000000000U) {
1543 				count += 4000000;
1544 				enano -= (u_int64_t) 4000000000U;
1545 			}
1546 			wrk = enano;
1547 			count += (wrk / 1000);
1548 		}
1549 	}
1550 
1551 	/*
1552 	 * If we haven't gone to 'ready' state, return.
1553 	 */
1554 	if (fcp->isp_fwstate != FW_READY) {
1555 		return (-1);
1556 	}
1557 
1558 	/*
1559 	 * Get our Loop ID (if possible). We really need to have it.
1560 	 */
1561 	mbs.param[0] = MBOX_GET_LOOP_ID;
1562 	isp_mboxcmd(isp, &mbs, MBLOGALL);
1563 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
1564 		return (-1);
1565 	}
1566 	fcp->isp_loopid = mbs.param[1];
1567 	if (IS_2200(isp) || IS_23XX(isp)) {
1568 		int topo = (int) mbs.param[6];
1569 		if (topo < TOPO_NL_PORT || topo > TOPO_PTP_STUB)
1570 			topo = TOPO_PTP_STUB;
1571 		fcp->isp_topo = topo;
1572 	} else {
1573 		fcp->isp_topo = TOPO_NL_PORT;
1574 	}
1575 	fcp->isp_portid = fcp->isp_alpa = mbs.param[2] & 0xff;
1576 
1577 	/*
1578 	 * Check to see if we're on a fabric by trying to see if we
1579 	 * can talk to the fabric name server. This can be a bit
1580 	 * tricky because if we're a 2100, we should check always
1581 	 * (in case we're connected to an server doing aliasing).
1582 	 */
1583 	fcp->isp_onfabric = 0;
1584 
1585 	if (IS_2100(isp))
1586 		check_for_fabric = 1;
1587 	else if (fcp->isp_topo == TOPO_FL_PORT || fcp->isp_topo == TOPO_F_PORT)
1588 		check_for_fabric = 1;
1589 	else
1590 		check_for_fabric = 0;
1591 
1592 	if (check_for_fabric && isp_getpdb(isp, FL_PORT_ID, &pdb) == 0) {
1593 		int loopid = FL_PORT_ID;
1594 		if (IS_2100(isp)) {
1595 			fcp->isp_topo = TOPO_FL_PORT;
1596 		}
1597 
1598 		if (BITS2WORD(pdb.pdb_portid_bits) == 0) {
1599 			/*
1600 			 * Crock.
1601 			 */
1602 			fcp->isp_topo = TOPO_NL_PORT;
1603 			goto not_on_fabric;
1604 		}
1605 		fcp->isp_portid = mbs.param[2] | ((int) mbs.param[3] << 16);
1606 
1607 		/*
1608 		 * Save the Fabric controller's port database entry.
1609 		 */
1610 		lp = &fcp->portdb[loopid];
1611 		lp->node_wwn =
1612 		    (((u_int64_t)pdb.pdb_nodename[0]) << 56) |
1613 		    (((u_int64_t)pdb.pdb_nodename[1]) << 48) |
1614 		    (((u_int64_t)pdb.pdb_nodename[2]) << 40) |
1615 		    (((u_int64_t)pdb.pdb_nodename[3]) << 32) |
1616 		    (((u_int64_t)pdb.pdb_nodename[4]) << 24) |
1617 		    (((u_int64_t)pdb.pdb_nodename[5]) << 16) |
1618 		    (((u_int64_t)pdb.pdb_nodename[6]) <<  8) |
1619 		    (((u_int64_t)pdb.pdb_nodename[7]));
1620 		lp->port_wwn =
1621 		    (((u_int64_t)pdb.pdb_portname[0]) << 56) |
1622 		    (((u_int64_t)pdb.pdb_portname[1]) << 48) |
1623 		    (((u_int64_t)pdb.pdb_portname[2]) << 40) |
1624 		    (((u_int64_t)pdb.pdb_portname[3]) << 32) |
1625 		    (((u_int64_t)pdb.pdb_portname[4]) << 24) |
1626 		    (((u_int64_t)pdb.pdb_portname[5]) << 16) |
1627 		    (((u_int64_t)pdb.pdb_portname[6]) <<  8) |
1628 		    (((u_int64_t)pdb.pdb_portname[7]));
1629 		lp->roles =
1630 		    (pdb.pdb_prli_svc3 & SVC3_ROLE_MASK) >> SVC3_ROLE_SHIFT;
1631 		lp->portid = BITS2WORD(pdb.pdb_portid_bits);
1632 		lp->loopid = pdb.pdb_loopid;
1633 		lp->loggedin = lp->valid = 1;
1634 		fcp->isp_onfabric = 1;
1635 		(void) isp_async(isp, ISPASYNC_PROMENADE, &loopid);
1636 		isp_register_fc4_type(isp);
1637 	} else {
1638 not_on_fabric:
1639 		fcp->isp_onfabric = 0;
1640 		fcp->portdb[FL_PORT_ID].valid = 0;
1641 	}
1642 
1643 	fcp->isp_gbspeed = 1;
1644 	if (IS_23XX(isp)) {
1645 		mbs.param[0] = MBOX_GET_SET_DATA_RATE;
1646 		mbs.param[1] = MBGSD_GET_RATE;
1647 		/* mbs.param[2] undefined if we're just getting rate */
1648 		isp_mboxcmd(isp, &mbs, MBLOGALL);
1649 		if (mbs.param[0] == MBOX_COMMAND_COMPLETE) {
1650 			if (mbs.param[1] == MBGSD_TWOGB) {
1651 				isp_prt(isp, ISP_LOGINFO, "2Gb link speed/s");
1652 				fcp->isp_gbspeed = 2;
1653 			}
1654 		}
1655 	}
1656 
1657 	isp_prt(isp, ISP_LOGCONFIG, topology, fcp->isp_loopid, fcp->isp_alpa,
1658 	    fcp->isp_portid, fcp->isp_loopstate, toponames[fcp->isp_topo]);
1659 
1660 	/*
1661 	 * Announce ourselves, too. This involves synthesizing an entry.
1662 	 */
1663 	if (fcp->isp_iid_set == 0) {
1664 		fcp->isp_iid_set = 1;
1665 		fcp->isp_iid = fcp->isp_loopid;
1666 		lp = &fcp->portdb[fcp->isp_iid];
1667 	} else {
1668 		lp = &fcp->portdb[fcp->isp_iid];
1669 		if (fcp->isp_portid != lp->portid ||
1670 		    fcp->isp_loopid != lp->loopid ||
1671 		    fcp->isp_nodewwn != ISP_NODEWWN(isp) ||
1672 		    fcp->isp_portwwn != ISP_PORTWWN(isp)) {
1673 			lp->valid = 0;
1674 			count = fcp->isp_iid;
1675 			(void) isp_async(isp, ISPASYNC_PROMENADE, &count);
1676 		}
1677 	}
1678 	lp->loopid = fcp->isp_loopid;
1679 	lp->portid = fcp->isp_portid;
1680 	lp->node_wwn = ISP_NODEWWN(isp);
1681 	lp->port_wwn = ISP_PORTWWN(isp);
1682 	switch (isp->isp_role) {
1683 	case ISP_ROLE_NONE:
1684 		lp->roles = 0;
1685 		break;
1686 	case ISP_ROLE_TARGET:
1687 		lp->roles = SVC3_TGT_ROLE >> SVC3_ROLE_SHIFT;
1688 		break;
1689 	case ISP_ROLE_INITIATOR:
1690 		lp->roles = SVC3_INI_ROLE >> SVC3_ROLE_SHIFT;
1691 		break;
1692 	case ISP_ROLE_BOTH:
1693 		lp->roles = (SVC3_INI_ROLE|SVC3_TGT_ROLE) >> SVC3_ROLE_SHIFT;
1694 		break;
1695 	}
1696 	lp->loggedin = lp->valid = 1;
1697 	count = fcp->isp_iid;
1698 	(void) isp_async(isp, ISPASYNC_PROMENADE, &count);
1699 	return (0);
1700 }
1701 
1702 static char *
1703 isp2100_fw_statename(int state)
1704 {
1705 	switch(state) {
1706 	case FW_CONFIG_WAIT:	return "Config Wait";
1707 	case FW_WAIT_AL_PA:	return "Waiting for AL_PA";
1708 	case FW_WAIT_LOGIN:	return "Wait Login";
1709 	case FW_READY:		return "Ready";
1710 	case FW_LOSS_OF_SYNC:	return "Loss Of Sync";
1711 	case FW_ERROR:		return "Error";
1712 	case FW_REINIT:		return "Re-Init";
1713 	case FW_NON_PART:	return "Nonparticipating";
1714 	default:		return "?????";
1715 	}
1716 }
1717 
1718 /*
1719  * Synchronize our soft copy of the port database with what the f/w thinks
1720  * (with a view toward possibly for a specific target....)
1721  */
1722 
1723 static int
1724 isp_pdb_sync(struct ispsoftc *isp)
1725 {
1726 	struct lportdb *lp;
1727 	fcparam *fcp = isp->isp_param;
1728 	isp_pdb_t pdb;
1729 	int loopid, base, lim;
1730 
1731 	/*
1732 	 * Make sure we're okay for doing this right now.
1733 	 */
1734 	if (fcp->isp_loopstate != LOOP_PDB_RCVD &&
1735 	    fcp->isp_loopstate != LOOP_FSCAN_DONE &&
1736 	    fcp->isp_loopstate != LOOP_LSCAN_DONE) {
1737 		return (-1);
1738 	}
1739 
1740 	if (fcp->isp_topo == TOPO_FL_PORT || fcp->isp_topo == TOPO_NL_PORT ||
1741 	    fcp->isp_topo == TOPO_N_PORT) {
1742 		if (fcp->isp_loopstate < LOOP_LSCAN_DONE) {
1743 			if (isp_scan_loop(isp) != 0) {
1744 				return (-1);
1745 			}
1746 		}
1747 	}
1748 	fcp->isp_loopstate = LOOP_SYNCING_PDB;
1749 
1750 	/*
1751 	 * If we get this far, we've settled our differences with the f/w
1752 	 * (for local loop device) and we can say that the loop state is ready.
1753 	 */
1754 
1755 	if (fcp->isp_topo == TOPO_NL_PORT) {
1756 		fcp->loop_seen_once = 1;
1757 		fcp->isp_loopstate = LOOP_READY;
1758 		return (0);
1759 	}
1760 
1761 	/*
1762 	 * Find all Fabric Entities that didn't make it from one scan to the
1763 	 * next and let the world know they went away. Scan the whole database.
1764 	 */
1765 	for (lp = &fcp->portdb[0]; lp < &fcp->portdb[MAX_FC_TARG]; lp++) {
1766 		if (lp->was_fabric_dev && lp->fabric_dev == 0) {
1767 			loopid = lp - fcp->portdb;
1768 			lp->valid = 0;	/* should already be set */
1769 			(void) isp_async(isp, ISPASYNC_PROMENADE, &loopid);
1770 			MEMZERO((void *) lp, sizeof (*lp));
1771 			continue;
1772 		}
1773 		lp->was_fabric_dev = lp->fabric_dev;
1774 	}
1775 
1776 	if (fcp->isp_topo == TOPO_FL_PORT)
1777 		base = FC_SNS_ID+1;
1778 	else
1779 		base = 0;
1780 
1781 	if (fcp->isp_topo == TOPO_N_PORT)
1782 		lim = 1;
1783 	else
1784 		lim = MAX_FC_TARG;
1785 
1786 	/*
1787 	 * Now log in any fabric devices that the outer layer has
1788 	 * left for us to see. This seems the most sane policy
1789 	 * for the moment.
1790 	 */
1791 	for (lp = &fcp->portdb[base]; lp < &fcp->portdb[lim]; lp++) {
1792 		u_int32_t portid;
1793 		mbreg_t mbs;
1794 
1795 		loopid = lp - fcp->portdb;
1796 		if (loopid >= FL_PORT_ID && loopid <= FC_SNS_ID) {
1797 			continue;
1798 		}
1799 
1800 		/*
1801 		 * Anything here?
1802 		 */
1803 		if (lp->port_wwn == 0) {
1804 			continue;
1805 		}
1806 
1807 		/*
1808 		 * Don't try to log into yourself.
1809 		 */
1810 		if ((portid = lp->portid) == fcp->isp_portid) {
1811 			continue;
1812 		}
1813 
1814 
1815 		/*
1816 		 * If we'd been logged in- see if we still are and we haven't
1817 		 * changed. If so, no need to log ourselves out, etc..
1818 		 *
1819 		 * Unfortunately, our charming Qlogic f/w has decided to
1820 		 * return a valid port database entry for a fabric device
1821 		 * that has, in fact, gone away. And it hangs trying to
1822 		 * log it out.
1823 		 */
1824 		if (lp->loggedin && lp->force_logout == 0 &&
1825 		    isp_getpdb(isp, lp->loopid, &pdb) == 0) {
1826 			int nrole;
1827 			u_int64_t nwwnn, nwwpn;
1828 			nwwnn =
1829 			    (((u_int64_t)pdb.pdb_nodename[0]) << 56) |
1830 			    (((u_int64_t)pdb.pdb_nodename[1]) << 48) |
1831 			    (((u_int64_t)pdb.pdb_nodename[2]) << 40) |
1832 			    (((u_int64_t)pdb.pdb_nodename[3]) << 32) |
1833 			    (((u_int64_t)pdb.pdb_nodename[4]) << 24) |
1834 			    (((u_int64_t)pdb.pdb_nodename[5]) << 16) |
1835 			    (((u_int64_t)pdb.pdb_nodename[6]) <<  8) |
1836 			    (((u_int64_t)pdb.pdb_nodename[7]));
1837 			nwwpn =
1838 			    (((u_int64_t)pdb.pdb_portname[0]) << 56) |
1839 			    (((u_int64_t)pdb.pdb_portname[1]) << 48) |
1840 			    (((u_int64_t)pdb.pdb_portname[2]) << 40) |
1841 			    (((u_int64_t)pdb.pdb_portname[3]) << 32) |
1842 			    (((u_int64_t)pdb.pdb_portname[4]) << 24) |
1843 			    (((u_int64_t)pdb.pdb_portname[5]) << 16) |
1844 			    (((u_int64_t)pdb.pdb_portname[6]) <<  8) |
1845 			    (((u_int64_t)pdb.pdb_portname[7]));
1846 			nrole = (pdb.pdb_prli_svc3 & SVC3_ROLE_MASK) >>
1847 			    SVC3_ROLE_SHIFT;
1848 			if (pdb.pdb_loopid == lp->loopid && lp->portid ==
1849 			    (u_int32_t) BITS2WORD(pdb.pdb_portid_bits) &&
1850 			    nwwnn == lp->node_wwn && nwwpn == lp->port_wwn &&
1851 			    lp->roles == nrole && lp->force_logout == 0) {
1852 				lp->loggedin = lp->valid = 1;
1853 				isp_prt(isp, ISP_LOGCONFIG, lretained,
1854 				    (int) (lp - fcp->portdb),
1855 				    (int) lp->loopid, lp->portid);
1856 				continue;
1857 			}
1858 		}
1859 
1860 		if (fcp->isp_fwstate != FW_READY ||
1861 		    fcp->isp_loopstate != LOOP_SYNCING_PDB) {
1862 			return (-1);
1863 		}
1864 
1865 		/*
1866 		 * Force a logout if we were logged in.
1867 		 */
1868 		if (lp->loggedin) {
1869 			if (lp->force_logout ||
1870 			    isp_getpdb(isp, lp->loopid, &pdb) == 0) {
1871 				mbs.param[0] = MBOX_FABRIC_LOGOUT;
1872 				mbs.param[1] = lp->loopid << 8;
1873 				mbs.param[2] = 0;
1874 				mbs.param[3] = 0;
1875 				isp_mboxcmd(isp, &mbs, MBLOGNONE);
1876 				isp_prt(isp, ISP_LOGINFO, plogout,
1877 				    (int) (lp - fcp->portdb), lp->loopid,
1878 				    lp->portid);
1879 			}
1880 			lp->force_logout = lp->loggedin = 0;
1881 			if (fcp->isp_fwstate != FW_READY ||
1882 			    fcp->isp_loopstate != LOOP_SYNCING_PDB) {
1883 				return (-1);
1884 			}
1885 		}
1886 
1887 		/*
1888 		 * And log in....
1889 		 */
1890 		loopid = lp - fcp->portdb;
1891 		lp->loopid = FL_PORT_ID;
1892 		do {
1893 			mbs.param[0] = MBOX_FABRIC_LOGIN;
1894 			mbs.param[1] = loopid << 8;
1895 			mbs.param[2] = portid >> 16;
1896 			mbs.param[3] = portid & 0xffff;
1897 			isp_mboxcmd(isp, &mbs, MBLOGALL & ~(MBOX_LOOP_ID_USED |
1898 			    MBOX_PORT_ID_USED | MBOX_COMMAND_ERROR));
1899 			if (fcp->isp_fwstate != FW_READY ||
1900 			    fcp->isp_loopstate != LOOP_SYNCING_PDB) {
1901 				return (-1);
1902 			}
1903 			switch (mbs.param[0]) {
1904 			case MBOX_LOOP_ID_USED:
1905 				/*
1906 				 * Try the next available loop id.
1907 				 */
1908 				loopid++;
1909 				break;
1910 			case MBOX_PORT_ID_USED:
1911 				/*
1912 				 * This port is already logged in.
1913 				 * Snaffle the loop id it's using if it's
1914 				 * nonzero, otherwise we're hosed.
1915 				 */
1916 				if (mbs.param[1] != 0) {
1917 					loopid = mbs.param[1];
1918 					isp_prt(isp, ISP_LOGINFO, retained,
1919 					    loopid, (int) (lp - fcp->portdb),
1920 					    lp->portid);
1921 				} else {
1922 					loopid = MAX_FC_TARG;
1923 					break;
1924 				}
1925 				/* FALLTHROUGH */
1926 			case MBOX_COMMAND_COMPLETE:
1927 				lp->loggedin = 1;
1928 				lp->loopid = loopid;
1929 				break;
1930 			case MBOX_COMMAND_ERROR:
1931 				isp_prt(isp, ISP_LOGINFO, plogierr,
1932 				    portid, mbs.param[1]);
1933 				/* FALLTHROUGH */
1934 			case MBOX_ALL_IDS_USED: /* We're outta IDs */
1935 			default:
1936 				loopid = MAX_FC_TARG;
1937 				break;
1938 			}
1939 		} while (lp->loopid == FL_PORT_ID && loopid < MAX_FC_TARG);
1940 
1941 		/*
1942 		 * If we get here and we haven't set a Loop ID,
1943 		 * we failed to log into this device.
1944 		 */
1945 
1946 		if (lp->loopid == FL_PORT_ID) {
1947 			lp->loopid = 0;
1948 			continue;
1949 		}
1950 
1951 		/*
1952 		 * Make sure we can get the approriate port information.
1953 		 */
1954 		if (isp_getpdb(isp, lp->loopid, &pdb) != 0) {
1955 			isp_prt(isp, ISP_LOGWARN, nopdb, lp->portid);
1956 			goto dump_em;
1957 		}
1958 
1959 		if (fcp->isp_fwstate != FW_READY ||
1960 		    fcp->isp_loopstate != LOOP_SYNCING_PDB) {
1961 			return (-1);
1962 		}
1963 
1964 		if (pdb.pdb_loopid != lp->loopid) {
1965 			isp_prt(isp, ISP_LOGWARN, pdbmfail1,
1966 			    lp->portid, pdb.pdb_loopid);
1967 			goto dump_em;
1968 		}
1969 
1970 		if (lp->portid != (u_int32_t) BITS2WORD(pdb.pdb_portid_bits)) {
1971 			isp_prt(isp, ISP_LOGWARN, pdbmfail2,
1972 			    lp->portid, BITS2WORD(pdb.pdb_portid_bits));
1973 			goto dump_em;
1974 		}
1975 
1976 		lp->roles =
1977 		    (pdb.pdb_prli_svc3 & SVC3_ROLE_MASK) >> SVC3_ROLE_SHIFT;
1978 		lp->node_wwn =
1979 		    (((u_int64_t)pdb.pdb_nodename[0]) << 56) |
1980 		    (((u_int64_t)pdb.pdb_nodename[1]) << 48) |
1981 		    (((u_int64_t)pdb.pdb_nodename[2]) << 40) |
1982 		    (((u_int64_t)pdb.pdb_nodename[3]) << 32) |
1983 		    (((u_int64_t)pdb.pdb_nodename[4]) << 24) |
1984 		    (((u_int64_t)pdb.pdb_nodename[5]) << 16) |
1985 		    (((u_int64_t)pdb.pdb_nodename[6]) <<  8) |
1986 		    (((u_int64_t)pdb.pdb_nodename[7]));
1987 		lp->port_wwn =
1988 		    (((u_int64_t)pdb.pdb_portname[0]) << 56) |
1989 		    (((u_int64_t)pdb.pdb_portname[1]) << 48) |
1990 		    (((u_int64_t)pdb.pdb_portname[2]) << 40) |
1991 		    (((u_int64_t)pdb.pdb_portname[3]) << 32) |
1992 		    (((u_int64_t)pdb.pdb_portname[4]) << 24) |
1993 		    (((u_int64_t)pdb.pdb_portname[5]) << 16) |
1994 		    (((u_int64_t)pdb.pdb_portname[6]) <<  8) |
1995 		    (((u_int64_t)pdb.pdb_portname[7]));
1996 		/*
1997 		 * Check to make sure this all makes sense.
1998 		 */
1999 		if (lp->node_wwn && lp->port_wwn) {
2000 			lp->valid = 1;
2001 			loopid = lp - fcp->portdb;
2002 			(void) isp_async(isp, ISPASYNC_PROMENADE, &loopid);
2003 			continue;
2004 		}
2005 dump_em:
2006 		lp->valid = 0;
2007 		isp_prt(isp, ISP_LOGINFO,
2008 		    ldumped, loopid, lp->loopid, lp->portid);
2009 		mbs.param[0] = MBOX_FABRIC_LOGOUT;
2010 		mbs.param[1] = lp->loopid << 8;
2011 		mbs.param[2] = 0;
2012 		mbs.param[3] = 0;
2013 		isp_mboxcmd(isp, &mbs, MBLOGNONE);
2014 		if (fcp->isp_fwstate != FW_READY ||
2015 		    fcp->isp_loopstate != LOOP_SYNCING_PDB) {
2016 			return (-1);
2017 		}
2018 	}
2019 	/*
2020 	 * If we get here, we've for sure seen not only a valid loop
2021 	 * but know what is or isn't on it, so mark this for usage
2022 	 * in isp_start.
2023 	 */
2024 	fcp->loop_seen_once = 1;
2025 	fcp->isp_loopstate = LOOP_READY;
2026 	return (0);
2027 }
2028 
2029 static int
2030 isp_scan_loop(struct ispsoftc *isp)
2031 {
2032 	struct lportdb *lp;
2033 	fcparam *fcp = isp->isp_param;
2034 	isp_pdb_t pdb;
2035 	int loopid, lim, hival;
2036 
2037 	switch (fcp->isp_topo) {
2038 	case TOPO_NL_PORT:
2039 		hival = FL_PORT_ID;
2040 		break;
2041 	case TOPO_N_PORT:
2042 		hival = 2;
2043 		break;
2044 	case TOPO_FL_PORT:
2045 		hival = FC_PORT_ID;
2046 		break;
2047 	default:
2048 		fcp->isp_loopstate = LOOP_LSCAN_DONE;
2049 		return (0);
2050 	}
2051 	fcp->isp_loopstate = LOOP_SCANNING_LOOP;
2052 
2053 	/*
2054 	 * make sure the temp port database is clean...
2055 	 */
2056 	MEMZERO((void *)fcp->tport, sizeof (fcp->tport));
2057 
2058 	/*
2059 	 * Run through the local loop ports and get port database info
2060 	 * for each loop ID.
2061 	 *
2062 	 * There's a somewhat unexplained situation where the f/w passes back
2063 	 * the wrong database entity- if that happens, just restart (up to
2064 	 * FL_PORT_ID times).
2065 	 */
2066 	for (lim = loopid = 0; loopid < hival; loopid++) {
2067 		lp = &fcp->tport[loopid];
2068 
2069 		/*
2070 		 * Don't even try for ourselves...
2071 	 	 */
2072 		if (loopid == fcp->isp_loopid)
2073 			continue;
2074 
2075 		lp->node_wwn = isp_get_portname(isp, loopid, 1);
2076 		if (fcp->isp_loopstate < LOOP_SCANNING_LOOP)
2077 			return (-1);
2078 		if (lp->node_wwn == 0)
2079 			continue;
2080 		lp->port_wwn = isp_get_portname(isp, loopid, 0);
2081 		if (fcp->isp_loopstate < LOOP_SCANNING_LOOP)
2082 			return (-1);
2083 		if (lp->port_wwn == 0) {
2084 			lp->node_wwn = 0;
2085 			continue;
2086 		}
2087 
2088 		/*
2089 		 * Get an entry....
2090 		 */
2091 		if (isp_getpdb(isp, loopid, &pdb) != 0) {
2092 			if (fcp->isp_loopstate < LOOP_SCANNING_LOOP)
2093 				return (-1);
2094 			continue;
2095 		}
2096 		if (fcp->isp_loopstate < LOOP_SCANNING_LOOP) {
2097 			return (-1);
2098 		}
2099 
2100 		/*
2101 		 * If the returned database element doesn't match what we
2102 		 * asked for, restart the process entirely (up to a point...).
2103 		 */
2104 		if (pdb.pdb_loopid != loopid) {
2105 			loopid = 0;
2106 			if (lim++ < hival) {
2107 				continue;
2108 			}
2109 			isp_prt(isp, ISP_LOGWARN,
2110 			    "giving up on synchronizing the port database");
2111 			return (-1);
2112 		}
2113 
2114 		/*
2115 		 * Save the pertinent info locally.
2116 		 */
2117 		lp->node_wwn =
2118 		    (((u_int64_t)pdb.pdb_nodename[0]) << 56) |
2119 		    (((u_int64_t)pdb.pdb_nodename[1]) << 48) |
2120 		    (((u_int64_t)pdb.pdb_nodename[2]) << 40) |
2121 		    (((u_int64_t)pdb.pdb_nodename[3]) << 32) |
2122 		    (((u_int64_t)pdb.pdb_nodename[4]) << 24) |
2123 		    (((u_int64_t)pdb.pdb_nodename[5]) << 16) |
2124 		    (((u_int64_t)pdb.pdb_nodename[6]) <<  8) |
2125 		    (((u_int64_t)pdb.pdb_nodename[7]));
2126 		lp->port_wwn =
2127 		    (((u_int64_t)pdb.pdb_portname[0]) << 56) |
2128 		    (((u_int64_t)pdb.pdb_portname[1]) << 48) |
2129 		    (((u_int64_t)pdb.pdb_portname[2]) << 40) |
2130 		    (((u_int64_t)pdb.pdb_portname[3]) << 32) |
2131 		    (((u_int64_t)pdb.pdb_portname[4]) << 24) |
2132 		    (((u_int64_t)pdb.pdb_portname[5]) << 16) |
2133 		    (((u_int64_t)pdb.pdb_portname[6]) <<  8) |
2134 		    (((u_int64_t)pdb.pdb_portname[7]));
2135 		lp->roles =
2136 		    (pdb.pdb_prli_svc3 & SVC3_ROLE_MASK) >> SVC3_ROLE_SHIFT;
2137 		lp->portid = BITS2WORD(pdb.pdb_portid_bits);
2138 		lp->loopid = pdb.pdb_loopid;
2139 	}
2140 
2141 	/*
2142 	 * Mark all of the permanent local loop database entries as invalid
2143 	 * (except our own entry).
2144 	 */
2145 	for (loopid = 0; loopid < hival; loopid++) {
2146 		if (loopid == fcp->isp_iid) {
2147 			fcp->portdb[loopid].valid = 1;
2148 			fcp->portdb[loopid].loopid = fcp->isp_loopid;
2149 			continue;
2150 		}
2151 		fcp->portdb[loopid].valid = 0;
2152 	}
2153 
2154 	/*
2155 	 * Now merge our local copy of the port database into our saved copy.
2156 	 * Notify the outer layers of new devices arriving.
2157 	 */
2158 	for (loopid = 0; loopid < hival; loopid++) {
2159 		int i;
2160 
2161 		/*
2162 		 * If we don't have a non-zero Port WWN, we're not here.
2163 		 */
2164 		if (fcp->tport[loopid].port_wwn == 0) {
2165 			continue;
2166 		}
2167 
2168 		/*
2169 		 * Skip ourselves.
2170 		 */
2171 		if (loopid == fcp->isp_iid) {
2172 			continue;
2173 		}
2174 
2175 		/*
2176 		 * For the purposes of deciding whether this is the
2177 		 * 'same' device or not, we only search for an identical
2178 		 * Port WWN. Node WWNs may or may not be the same as
2179 		 * the Port WWN, and there may be multiple different
2180 		 * Port WWNs with the same Node WWN. It would be chaos
2181 		 * to have multiple identical Port WWNs, so we don't
2182 		 * allow that.
2183 		 */
2184 
2185 		for (i = 0; i < hival; i++) {
2186 			int j;
2187 			if (fcp->portdb[i].port_wwn == 0)
2188 				continue;
2189 			if (fcp->portdb[i].port_wwn !=
2190 			    fcp->tport[loopid].port_wwn)
2191 				continue;
2192 			/*
2193 			 * We found this WWN elsewhere- it's changed
2194 			 * loopids then. We don't change it's actual
2195 			 * position in our cached port database- we
2196 			 * just change the actual loop ID we'd use.
2197 			 */
2198 			if (fcp->portdb[i].loopid != loopid) {
2199 				isp_prt(isp, ISP_LOGINFO, portshift, i,
2200 				    fcp->portdb[i].loopid,
2201 				    fcp->portdb[i].portid, loopid,
2202 				    fcp->tport[loopid].portid);
2203 			}
2204 			fcp->portdb[i].portid = fcp->tport[loopid].portid;
2205 			fcp->portdb[i].loopid = loopid;
2206 			fcp->portdb[i].valid = 1;
2207 			fcp->portdb[i].roles = fcp->tport[loopid].roles;
2208 
2209 			/*
2210 			 * Now make sure this Port WWN doesn't exist elsewhere
2211 			 * in the port database.
2212 			 */
2213 			for (j = i+1; j < hival; j++) {
2214 				if (fcp->portdb[i].port_wwn !=
2215 				    fcp->portdb[j].port_wwn) {
2216 					continue;
2217 				}
2218 				isp_prt(isp, ISP_LOGWARN, portdup, j, i);
2219 				/*
2220 				 * Invalidate the 'old' *and* 'new' ones.
2221 				 * This is really harsh and not quite right,
2222 				 * but if this happens, we really don't know
2223 				 * who is what at this point.
2224 				 */
2225 				fcp->portdb[i].valid = 0;
2226 				fcp->portdb[j].valid = 0;
2227 			}
2228 			break;
2229 		}
2230 
2231 		/*
2232 		 * If we didn't traverse the entire port database,
2233 		 * then we found (and remapped) an existing entry.
2234 		 * No need to notify anyone- go for the next one.
2235 		 */
2236 		if (i < hival) {
2237 			isp_prt(isp, ISP_LOGINFO, retained,
2238 			    fcp->portdb[i].loopid, i, fcp->portdb[i].portid);
2239 			continue;
2240 		}
2241 
2242 		/*
2243 		 * We've not found this Port WWN anywhere. It's a new entry.
2244 		 * See if we can leave it where it is (with target == loopid).
2245 		 */
2246 		if (fcp->portdb[loopid].port_wwn != 0) {
2247 			for (lim = 0; lim < hival; lim++) {
2248 				if (fcp->portdb[lim].port_wwn == 0)
2249 					break;
2250 			}
2251 			/* "Cannot Happen" */
2252 			if (lim == hival) {
2253 				isp_prt(isp, ISP_LOGWARN, "Remap Overflow");
2254 				continue;
2255 			}
2256 			i = lim;
2257 		} else {
2258 			i = loopid;
2259 		}
2260 
2261 		/*
2262 		 * NB:	The actual loopid we use here is loopid- we may
2263 		 *	in fact be at a completely different index (target).
2264 		 */
2265 		fcp->portdb[i].loopid = loopid;
2266 		fcp->portdb[i].port_wwn = fcp->tport[loopid].port_wwn;
2267 		fcp->portdb[i].node_wwn = fcp->tport[loopid].node_wwn;
2268 		fcp->portdb[i].roles = fcp->tport[loopid].roles;
2269 		fcp->portdb[i].portid = fcp->tport[loopid].portid;
2270 		fcp->portdb[i].valid = 1;
2271 
2272 		/*
2273 		 * Tell the outside world we've arrived.
2274 		 */
2275 		(void) isp_async(isp, ISPASYNC_PROMENADE, &i);
2276 	}
2277 
2278 	/*
2279 	 * Now find all previously used targets that are now invalid and
2280 	 * notify the outer layers that they're gone.
2281 	 */
2282 	for (lp = &fcp->portdb[0]; lp < &fcp->portdb[hival]; lp++) {
2283 		if (lp->valid || lp->port_wwn == 0) {
2284 			continue;
2285 		}
2286 
2287 		/*
2288 		 * Tell the outside world we've gone
2289 		 * away and erase our pdb entry.
2290 		 *
2291 		 */
2292 		loopid = lp - fcp->portdb;
2293 		(void) isp_async(isp, ISPASYNC_PROMENADE, &loopid);
2294 		MEMZERO((void *) lp, sizeof (*lp));
2295 	}
2296 	fcp->isp_loopstate = LOOP_LSCAN_DONE;
2297 	return (0);
2298 }
2299 
2300 
2301 static int
2302 isp_fabric_mbox_cmd(struct ispsoftc *isp, mbreg_t *mbp)
2303 {
2304 	isp_mboxcmd(isp, mbp, MBLOGNONE);
2305 	if (mbp->param[0] != MBOX_COMMAND_COMPLETE) {
2306 		if (FCPARAM(isp)->isp_loopstate == LOOP_SCANNING_FABRIC) {
2307 			FCPARAM(isp)->isp_loopstate = LOOP_PDB_RCVD;
2308 		}
2309 		if (mbp->param[0] == MBOX_COMMAND_ERROR) {
2310 			char tbuf[16];
2311 			char *m;
2312 			switch (mbp->param[1]) {
2313 			case 1:
2314 				m = "No Loop";
2315 				break;
2316 			case 2:
2317 				m = "Failed to allocate IOCB buffer";
2318 				break;
2319 			case 3:
2320 				m = "Failed to allocate XCB buffer";
2321 				break;
2322 			case 4:
2323 				m = "timeout or transmit failed";
2324 				break;
2325 			case 5:
2326 				m = "no fabric loop";
2327 				break;
2328 			case 6:
2329 				m = "remote device not a target";
2330 				break;
2331 			default:
2332 				SNPRINTF(tbuf, sizeof tbuf, "%x",
2333 				    mbp->param[1]);
2334 				m = tbuf;
2335 				break;
2336 			}
2337 			isp_prt(isp, ISP_LOGERR, "SNS Failed- %s", m);
2338 		}
2339 		return (-1);
2340 	}
2341 
2342 	if (FCPARAM(isp)->isp_fwstate != FW_READY ||
2343 	    FCPARAM(isp)->isp_loopstate < LOOP_SCANNING_FABRIC) {
2344 		return (-1);
2345 	}
2346 	return(0);
2347 }
2348 
2349 #ifdef	ISP_USE_GA_NXT
2350 static int
2351 isp_scan_fabric(struct ispsoftc *isp, int ftype)
2352 {
2353 	fcparam *fcp = isp->isp_param;
2354 	u_int32_t portid, first_portid, last_portid;
2355 	int hicap, last_port_same;
2356 
2357 	if (fcp->isp_onfabric == 0) {
2358 		fcp->isp_loopstate = LOOP_FSCAN_DONE;
2359 		return (0);
2360 	}
2361 
2362 	FC_SCRATCH_ACQUIRE(isp);
2363 
2364 	/*
2365 	 * Since Port IDs are 24 bits, we can check against having seen
2366 	 * anything yet with this value.
2367 	 */
2368 	last_port_same = 0;
2369 	last_portid = 0xffffffff;	/* not a port */
2370 	first_portid = portid = fcp->isp_portid;
2371 	fcp->isp_loopstate = LOOP_SCANNING_FABRIC;
2372 
2373 	for (hicap = 0; hicap < GA_NXT_MAX; hicap++) {
2374 		mbreg_t mbs;
2375 		sns_screq_t *rq;
2376 		sns_ga_nxt_rsp_t *rs0, *rs1;
2377 		struct lportdb lcl;
2378 		u_int8_t sc[SNS_GA_NXT_RESP_SIZE];
2379 
2380 		rq = (sns_screq_t *)sc;
2381 		MEMZERO((void *) rq, SNS_GA_NXT_REQ_SIZE);
2382 		rq->snscb_rblen = SNS_GA_NXT_RESP_SIZE >> 1;
2383 		rq->snscb_addr[RQRSP_ADDR0015] = DMA_WD0(fcp->isp_scdma+0x100);
2384 		rq->snscb_addr[RQRSP_ADDR1631] = DMA_WD1(fcp->isp_scdma+0x100);
2385 		rq->snscb_addr[RQRSP_ADDR3247] = DMA_WD2(fcp->isp_scdma+0x100);
2386 		rq->snscb_addr[RQRSP_ADDR4863] = DMA_WD3(fcp->isp_scdma+0x100);
2387 		rq->snscb_sblen = 6;
2388 		rq->snscb_data[0] = SNS_GA_NXT;
2389 		rq->snscb_data[4] = portid & 0xffff;
2390 		rq->snscb_data[5] = (portid >> 16) & 0xff;
2391 		isp_put_sns_request(isp, rq, (sns_screq_t *) fcp->isp_scratch);
2392 		MEMORYBARRIER(isp, SYNC_SFORDEV, 0, SNS_GA_NXT_REQ_SIZE);
2393 		mbs.param[0] = MBOX_SEND_SNS;
2394 		mbs.param[1] = SNS_GA_NXT_REQ_SIZE >> 1;
2395 		mbs.param[2] = DMA_WD1(fcp->isp_scdma);
2396 		mbs.param[3] = DMA_WD0(fcp->isp_scdma);
2397 		/*
2398 		 * Leave 4 and 5 alone
2399 		 */
2400 		mbs.param[6] = DMA_WD3(fcp->isp_scdma);
2401 		mbs.param[7] = DMA_WD2(fcp->isp_scdma);
2402 		if (isp_fabric_mbox_cmd(isp, &mbs)) {
2403 			if (fcp->isp_loopstate >= LOOP_SCANNING_FABRIC) {
2404 				fcp->isp_loopstate = LOOP_PDB_RCVD;
2405 			}
2406 			FC_SCRATCH_RELEASE(isp);
2407 			return (-1);
2408 		}
2409 		MEMORYBARRIER(isp, SYNC_SFORCPU, 0x100, SNS_GA_NXT_RESP_SIZE);
2410 		rs1 = (sns_ga_nxt_rsp_t *) sc;
2411 		rs0 = (sns_ga_nxt_rsp_t *) ((u_int8_t *)fcp->isp_scratch+0x100);
2412 		isp_get_ga_nxt_response(isp, rs0, rs1);
2413 		if (rs1->snscb_cthdr.ct_response != FS_ACC) {
2414 			isp_prt(isp, ISP_LOGWARN, swrej, "GA_NXT",
2415 			    rs1->snscb_cthdr.ct_reason,
2416 			    rs1->snscb_cthdr.ct_explanation, portid);
2417 			FC_SCRATCH_RELEASE(isp);
2418 			fcp->isp_loopstate = LOOP_FSCAN_DONE;
2419 			return (0);
2420 		}
2421 		portid =
2422 		    (((u_int32_t) rs1->snscb_port_id[0]) << 16) |
2423 		    (((u_int32_t) rs1->snscb_port_id[1]) << 8) |
2424 		    (((u_int32_t) rs1->snscb_port_id[2]));
2425 
2426 		/*
2427 		 * Okay, we now have information about a fabric object.
2428 		 * If it is the type we're interested in, tell the outer layers
2429 		 * about it. The outer layer needs to  know: Port ID, WWNN,
2430 		 * WWPN, FC4 type, and port type.
2431 		 *
2432 		 * The lportdb structure is adequate for this.
2433 		 */
2434 		MEMZERO(&lcl, sizeof (lcl));
2435 		lcl.port_type = rs1->snscb_port_type;
2436 		lcl.fc4_type = ftype;
2437 		lcl.portid = portid;
2438 		lcl.node_wwn =
2439 		    (((u_int64_t)rs1->snscb_nodename[0]) << 56) |
2440 		    (((u_int64_t)rs1->snscb_nodename[1]) << 48) |
2441 		    (((u_int64_t)rs1->snscb_nodename[2]) << 40) |
2442 		    (((u_int64_t)rs1->snscb_nodename[3]) << 32) |
2443 		    (((u_int64_t)rs1->snscb_nodename[4]) << 24) |
2444 		    (((u_int64_t)rs1->snscb_nodename[5]) << 16) |
2445 		    (((u_int64_t)rs1->snscb_nodename[6]) <<  8) |
2446 		    (((u_int64_t)rs1->snscb_nodename[7]));
2447 		lcl.port_wwn =
2448 		    (((u_int64_t)rs1->snscb_portname[0]) << 56) |
2449 		    (((u_int64_t)rs1->snscb_portname[1]) << 48) |
2450 		    (((u_int64_t)rs1->snscb_portname[2]) << 40) |
2451 		    (((u_int64_t)rs1->snscb_portname[3]) << 32) |
2452 		    (((u_int64_t)rs1->snscb_portname[4]) << 24) |
2453 		    (((u_int64_t)rs1->snscb_portname[5]) << 16) |
2454 		    (((u_int64_t)rs1->snscb_portname[6]) <<  8) |
2455 		    (((u_int64_t)rs1->snscb_portname[7]));
2456 
2457 		/*
2458 		 * Does this fabric object support the type we want?
2459 		 * If not, skip it.
2460 		 */
2461 		if (rs1->snscb_fc4_types[ftype >> 5] & (1 << (ftype & 0x1f))) {
2462 			if (first_portid == portid) {
2463 				lcl.last_fabric_dev = 1;
2464 			} else {
2465 				lcl.last_fabric_dev = 0;
2466 			}
2467 			(void) isp_async(isp, ISPASYNC_FABRIC_DEV, &lcl);
2468 		} else {
2469 			isp_prt(isp, ISP_LOGDEBUG0,
2470 			    "PortID 0x%x doesn't support FC4 type 0x%x",
2471 			    portid, ftype);
2472 		}
2473 		if (first_portid == portid) {
2474 			fcp->isp_loopstate = LOOP_FSCAN_DONE;
2475 			FC_SCRATCH_RELEASE(isp);
2476 			return (0);
2477 		}
2478 		if (portid == last_portid) {
2479 			if (last_port_same++ > 20) {
2480 				isp_prt(isp, ISP_LOGWARN,
2481 				    "tangled fabric database detected");
2482 				break;
2483 			}
2484 		} else {
2485 			last_port_same = 0 ;
2486 			last_portid = portid;
2487 		}
2488 	}
2489 	FC_SCRATCH_RELEASE(isp);
2490 	if (hicap >= GA_NXT_MAX) {
2491 		isp_prt(isp, ISP_LOGWARN, "fabric too big (> %d)", GA_NXT_MAX);
2492 	}
2493 	fcp->isp_loopstate = LOOP_FSCAN_DONE;
2494 	return (0);
2495 }
2496 #else
2497 #define	GIDLEN	((ISP2100_SCRLEN >> 1) + 16)
2498 #define	NGENT	((GIDLEN - 16) >> 2)
2499 
2500 #define	IGPOFF	(ISP2100_SCRLEN - GIDLEN)
2501 #define	GXOFF	(256)
2502 
2503 static int
2504 isp_scan_fabric(struct ispsoftc *isp, int ftype)
2505 {
2506 	fcparam *fcp = FCPARAM(isp);
2507 	mbreg_t mbs;
2508 	int i;
2509 	sns_gid_ft_req_t *rq;
2510 	sns_gid_ft_rsp_t *rs0, *rs1;
2511 
2512 	if (fcp->isp_onfabric == 0) {
2513 		fcp->isp_loopstate = LOOP_FSCAN_DONE;
2514 		return (0);
2515 	}
2516 
2517 	FC_SCRATCH_ACQUIRE(isp);
2518 	fcp->isp_loopstate = LOOP_SCANNING_FABRIC;
2519 
2520 	rq = (sns_gid_ft_req_t *)fcp->tport;
2521 	MEMZERO((void *) rq, SNS_GID_FT_REQ_SIZE);
2522 	rq->snscb_rblen = GIDLEN >> 1;
2523 	rq->snscb_addr[RQRSP_ADDR0015] = DMA_WD0(fcp->isp_scdma+IGPOFF);
2524 	rq->snscb_addr[RQRSP_ADDR1631] = DMA_WD1(fcp->isp_scdma+IGPOFF);
2525 	rq->snscb_addr[RQRSP_ADDR3247] = DMA_WD2(fcp->isp_scdma+IGPOFF);
2526 	rq->snscb_addr[RQRSP_ADDR4863] = DMA_WD3(fcp->isp_scdma+IGPOFF);
2527 	rq->snscb_sblen = 6;
2528 	rq->snscb_cmd = SNS_GID_FT;
2529 	rq->snscb_mword_div_2 = NGENT;
2530 	rq->snscb_fc4_type = ftype;
2531 	isp_put_gid_ft_request(isp, rq, (sns_gid_ft_req_t *) fcp->isp_scratch);
2532 	MEMORYBARRIER(isp, SYNC_SFORDEV, 0, SNS_GID_FT_REQ_SIZE);
2533 	mbs.param[0] = MBOX_SEND_SNS;
2534 	mbs.param[1] = SNS_GID_FT_REQ_SIZE >> 1;
2535 	mbs.param[2] = DMA_WD1(fcp->isp_scdma);
2536 	mbs.param[3] = DMA_WD0(fcp->isp_scdma);
2537 
2538 	/*
2539 	 * Leave 4 and 5 alone
2540 	 */
2541 	mbs.param[6] = DMA_WD3(fcp->isp_scdma);
2542 	mbs.param[7] = DMA_WD2(fcp->isp_scdma);
2543 	if (isp_fabric_mbox_cmd(isp, &mbs)) {
2544 		if (fcp->isp_loopstate >= LOOP_SCANNING_FABRIC) {
2545 			fcp->isp_loopstate = LOOP_PDB_RCVD;
2546 		}
2547 		FC_SCRATCH_RELEASE(isp);
2548 		return (-1);
2549 	}
2550 	if (fcp->isp_loopstate != LOOP_SCANNING_FABRIC) {
2551 		FC_SCRATCH_RELEASE(isp);
2552 		return (-1);
2553 	}
2554 	MEMORYBARRIER(isp, SYNC_SFORCPU, IGPOFF, GIDLEN);
2555 	rs1 = (sns_gid_ft_rsp_t *) fcp->tport;
2556 	rs0 = (sns_gid_ft_rsp_t *) ((u_int8_t *)fcp->isp_scratch+IGPOFF);
2557 	isp_get_gid_ft_response(isp, rs0, rs1, NGENT);
2558 	if (rs1->snscb_cthdr.ct_response != FS_ACC) {
2559 		isp_prt(isp, ISP_LOGWARN, swrej, "GID_FT",
2560 		    rs1->snscb_cthdr.ct_reason,
2561 		    rs1->snscb_cthdr.ct_explanation, 0);
2562 		FC_SCRATCH_RELEASE(isp);
2563 		fcp->isp_loopstate = LOOP_FSCAN_DONE;
2564 		return (0);
2565 	}
2566 
2567 	/*
2568 	 * Okay, we now have a list of Port IDs for this class of device.
2569 	 * Go through the list and for each one get the WWPN/WWNN for it
2570 	 * and tell the outer layers about it. The outer layer needs to
2571 	 * know: Port ID, WWNN, WWPN, FC4 type, and (possibly) port type.
2572 	 *
2573 	 * The lportdb structure is adequate for this.
2574 	 */
2575 	i = -1;
2576 	do {
2577 		sns_gxn_id_req_t grqbuf, *gq = &grqbuf;
2578 		sns_gxn_id_rsp_t *gs0, grsbuf, *gs1 = &grsbuf;
2579 		struct lportdb lcl;
2580 #if	0
2581 		sns_gff_id_rsp_t *fs0, ffsbuf, *fs1 = &ffsbuf;
2582 #endif
2583 
2584 		i++;
2585 		MEMZERO(&lcl, sizeof (lcl));
2586 		lcl.fc4_type = ftype;
2587 		lcl.portid =
2588 		    (((u_int32_t) rs1->snscb_ports[i].portid[0]) << 16) |
2589 		    (((u_int32_t) rs1->snscb_ports[i].portid[1]) << 8) |
2590 		    (((u_int32_t) rs1->snscb_ports[i].portid[2]));
2591 
2592 		MEMZERO((void *) gq, sizeof (sns_gxn_id_req_t));
2593 		gq->snscb_rblen = SNS_GXN_ID_RESP_SIZE >> 1;
2594 		gq->snscb_addr[RQRSP_ADDR0015] = DMA_WD0(fcp->isp_scdma+GXOFF);
2595 		gq->snscb_addr[RQRSP_ADDR1631] = DMA_WD1(fcp->isp_scdma+GXOFF);
2596 		gq->snscb_addr[RQRSP_ADDR3247] = DMA_WD2(fcp->isp_scdma+GXOFF);
2597 		gq->snscb_addr[RQRSP_ADDR4863] = DMA_WD3(fcp->isp_scdma+GXOFF);
2598 		gq->snscb_sblen = 6;
2599 		gq->snscb_cmd = SNS_GPN_ID;
2600 		gq->snscb_portid = lcl.portid;
2601 		isp_put_gxn_id_request(isp, gq,
2602 		    (sns_gxn_id_req_t *) fcp->isp_scratch);
2603 		MEMORYBARRIER(isp, SYNC_SFORDEV, 0, SNS_GXN_ID_REQ_SIZE);
2604 		mbs.param[0] = MBOX_SEND_SNS;
2605 		mbs.param[1] = SNS_GXN_ID_REQ_SIZE >> 1;
2606 		mbs.param[2] = DMA_WD1(fcp->isp_scdma);
2607 		mbs.param[3] = DMA_WD0(fcp->isp_scdma);
2608 		/*
2609 		 * Leave 4 and 5 alone
2610 		 */
2611 		mbs.param[6] = DMA_WD3(fcp->isp_scdma);
2612 		mbs.param[7] = DMA_WD2(fcp->isp_scdma);
2613 		if (isp_fabric_mbox_cmd(isp, &mbs)) {
2614 			if (fcp->isp_loopstate >= LOOP_SCANNING_FABRIC) {
2615 				fcp->isp_loopstate = LOOP_PDB_RCVD;
2616 			}
2617 			FC_SCRATCH_RELEASE(isp);
2618 			return (-1);
2619 		}
2620 		if (fcp->isp_loopstate != LOOP_SCANNING_FABRIC) {
2621 			FC_SCRATCH_RELEASE(isp);
2622 			return (-1);
2623 		}
2624 		MEMORYBARRIER(isp, SYNC_SFORCPU, GXOFF, SNS_GXN_ID_RESP_SIZE);
2625 		gs0 = (sns_gxn_id_rsp_t *) ((u_int8_t *)fcp->isp_scratch+GXOFF);
2626 		isp_get_gxn_id_response(isp, gs0, gs1);
2627 		if (gs1->snscb_cthdr.ct_response != FS_ACC) {
2628 			isp_prt(isp, ISP_LOGWARN, swrej, "GPN_ID",
2629 			    gs1->snscb_cthdr.ct_reason,
2630 			    gs1->snscb_cthdr.ct_explanation, lcl.portid);
2631 			if (fcp->isp_loopstate != LOOP_SCANNING_FABRIC) {
2632 				FC_SCRATCH_RELEASE(isp);
2633 				return (-1);
2634 			}
2635 			continue;
2636 		}
2637 		lcl.port_wwn =
2638 		    (((u_int64_t)gs1->snscb_wwn[0]) << 56) |
2639 		    (((u_int64_t)gs1->snscb_wwn[1]) << 48) |
2640 		    (((u_int64_t)gs1->snscb_wwn[2]) << 40) |
2641 		    (((u_int64_t)gs1->snscb_wwn[3]) << 32) |
2642 		    (((u_int64_t)gs1->snscb_wwn[4]) << 24) |
2643 		    (((u_int64_t)gs1->snscb_wwn[5]) << 16) |
2644 		    (((u_int64_t)gs1->snscb_wwn[6]) <<  8) |
2645 		    (((u_int64_t)gs1->snscb_wwn[7]));
2646 
2647 		MEMZERO((void *) gq, sizeof (sns_gxn_id_req_t));
2648 		gq->snscb_rblen = SNS_GXN_ID_RESP_SIZE >> 1;
2649 		gq->snscb_addr[RQRSP_ADDR0015] = DMA_WD0(fcp->isp_scdma+GXOFF);
2650 		gq->snscb_addr[RQRSP_ADDR1631] = DMA_WD1(fcp->isp_scdma+GXOFF);
2651 		gq->snscb_addr[RQRSP_ADDR3247] = DMA_WD2(fcp->isp_scdma+GXOFF);
2652 		gq->snscb_addr[RQRSP_ADDR4863] = DMA_WD3(fcp->isp_scdma+GXOFF);
2653 		gq->snscb_sblen = 6;
2654 		gq->snscb_cmd = SNS_GNN_ID;
2655 		gq->snscb_portid = lcl.portid;
2656 		isp_put_gxn_id_request(isp, gq,
2657 		    (sns_gxn_id_req_t *) fcp->isp_scratch);
2658 		MEMORYBARRIER(isp, SYNC_SFORDEV, 0, SNS_GXN_ID_REQ_SIZE);
2659 		mbs.param[0] = MBOX_SEND_SNS;
2660 		mbs.param[1] = SNS_GXN_ID_REQ_SIZE >> 1;
2661 		mbs.param[2] = DMA_WD1(fcp->isp_scdma);
2662 		mbs.param[3] = DMA_WD0(fcp->isp_scdma);
2663 		/*
2664 		 * Leave 4 and 5 alone
2665 		 */
2666 		mbs.param[6] = DMA_WD3(fcp->isp_scdma);
2667 		mbs.param[7] = DMA_WD2(fcp->isp_scdma);
2668 		if (isp_fabric_mbox_cmd(isp, &mbs)) {
2669 			if (fcp->isp_loopstate >= LOOP_SCANNING_FABRIC) {
2670 				fcp->isp_loopstate = LOOP_PDB_RCVD;
2671 			}
2672 			FC_SCRATCH_RELEASE(isp);
2673 			return (-1);
2674 		}
2675 		if (fcp->isp_loopstate != LOOP_SCANNING_FABRIC) {
2676 			FC_SCRATCH_RELEASE(isp);
2677 			return (-1);
2678 		}
2679 		MEMORYBARRIER(isp, SYNC_SFORCPU, GXOFF, SNS_GXN_ID_RESP_SIZE);
2680 		gs0 = (sns_gxn_id_rsp_t *) ((u_int8_t *)fcp->isp_scratch+GXOFF);
2681 		isp_get_gxn_id_response(isp, gs0, gs1);
2682 		if (gs1->snscb_cthdr.ct_response != FS_ACC) {
2683 			isp_prt(isp, ISP_LOGWARN, swrej, "GNN_ID",
2684 			    gs1->snscb_cthdr.ct_reason,
2685 			    gs1->snscb_cthdr.ct_explanation, lcl.portid);
2686 			if (fcp->isp_loopstate != LOOP_SCANNING_FABRIC) {
2687 				FC_SCRATCH_RELEASE(isp);
2688 				return (-1);
2689 			}
2690 			continue;
2691 		}
2692 		lcl.node_wwn =
2693 		    (((u_int64_t)gs1->snscb_wwn[0]) << 56) |
2694 		    (((u_int64_t)gs1->snscb_wwn[1]) << 48) |
2695 		    (((u_int64_t)gs1->snscb_wwn[2]) << 40) |
2696 		    (((u_int64_t)gs1->snscb_wwn[3]) << 32) |
2697 		    (((u_int64_t)gs1->snscb_wwn[4]) << 24) |
2698 		    (((u_int64_t)gs1->snscb_wwn[5]) << 16) |
2699 		    (((u_int64_t)gs1->snscb_wwn[6]) <<  8) |
2700 		    (((u_int64_t)gs1->snscb_wwn[7]));
2701 
2702 		/*
2703 		 * The QLogic f/w is bouncing this with a parameter error.
2704 		 */
2705 #if	0
2706 		/*
2707 		 * Try and get FC4 Features (FC-GS-3 only).
2708 		 * We can use the sns_gxn_id_req_t for this request.
2709 		 */
2710 		MEMZERO((void *) gq, sizeof (sns_gxn_id_req_t));
2711 		gq->snscb_rblen = SNS_GFF_ID_RESP_SIZE >> 1;
2712 		gq->snscb_addr[RQRSP_ADDR0015] = DMA_WD0(fcp->isp_scdma+GXOFF);
2713 		gq->snscb_addr[RQRSP_ADDR1631] = DMA_WD1(fcp->isp_scdma+GXOFF);
2714 		gq->snscb_addr[RQRSP_ADDR3247] = DMA_WD2(fcp->isp_scdma+GXOFF);
2715 		gq->snscb_addr[RQRSP_ADDR4863] = DMA_WD3(fcp->isp_scdma+GXOFF);
2716 		gq->snscb_sblen = 6;
2717 		gq->snscb_cmd = SNS_GFF_ID;
2718 		gq->snscb_portid = lcl.portid;
2719 		isp_put_gxn_id_request(isp, gq,
2720 		    (sns_gxn_id_req_t *) fcp->isp_scratch);
2721 		MEMORYBARRIER(isp, SYNC_SFORDEV, 0, SNS_GXN_ID_REQ_SIZE);
2722 		mbs.param[0] = MBOX_SEND_SNS;
2723 		mbs.param[1] = SNS_GXN_ID_REQ_SIZE >> 1;
2724 		mbs.param[2] = DMA_WD1(fcp->isp_scdma);
2725 		mbs.param[3] = DMA_WD0(fcp->isp_scdma);
2726 		/*
2727 		 * Leave 4 and 5 alone
2728 		 */
2729 		mbs.param[6] = DMA_WD3(fcp->isp_scdma);
2730 		mbs.param[7] = DMA_WD2(fcp->isp_scdma);
2731 		if (isp_fabric_mbox_cmd(isp, &mbs)) {
2732 			if (fcp->isp_loopstate >= LOOP_SCANNING_FABRIC) {
2733 				fcp->isp_loopstate = LOOP_PDB_RCVD;
2734 			}
2735 			FC_SCRATCH_RELEASE(isp);
2736 			return (-1);
2737 		}
2738 		if (fcp->isp_loopstate != LOOP_SCANNING_FABRIC) {
2739 			FC_SCRATCH_RELEASE(isp);
2740 			return (-1);
2741 		}
2742 		MEMORYBARRIER(isp, SYNC_SFORCPU, GXOFF, SNS_GFF_ID_RESP_SIZE);
2743 		fs0 = (sns_gff_id_rsp_t *) ((u_int8_t *)fcp->isp_scratch+GXOFF);
2744 		isp_get_gff_id_response(isp, fs0, fs1);
2745 		if (fs1->snscb_cthdr.ct_response != FS_ACC) {
2746 			isp_prt(isp, /* ISP_LOGDEBUG0 */ ISP_LOGWARN,
2747 			    swrej, "GFF_ID",
2748 			    fs1->snscb_cthdr.ct_reason,
2749 			    fs1->snscb_cthdr.ct_explanation, lcl.portid);
2750 			if (fcp->isp_loopstate != LOOP_SCANNING_FABRIC) {
2751 				FC_SCRATCH_RELEASE(isp);
2752 				return (-1);
2753 			}
2754 		} else {
2755 			int index = (ftype >> 3);
2756 			int bshft = (ftype & 0x7) * 4;
2757 			int fc4_fval =
2758 			    (fs1->snscb_fc4_features[index] >> bshft) & 0xf;
2759 			if (fc4_fval & 0x1) {
2760 				lcl.roles |=
2761 				    (SVC3_INI_ROLE >> SVC3_ROLE_SHIFT);
2762 			}
2763 			if (fc4_fval & 0x2) {
2764 				lcl.roles |=
2765 				    (SVC3_TGT_ROLE >> SVC3_ROLE_SHIFT);
2766 			}
2767 		}
2768 #endif
2769 
2770 		/*
2771 		 * If we really want to know what kind of port type this is,
2772 		 * we have to run another CT command. Otherwise, we'll leave
2773 		 * it as undefined.
2774 		 *
2775 		lcl.port_type = 0;
2776 		 */
2777 		if (rs1->snscb_ports[i].control & 0x80) {
2778 			lcl.last_fabric_dev = 1;
2779 		} else {
2780 			lcl.last_fabric_dev = 0;
2781 		}
2782 		(void) isp_async(isp, ISPASYNC_FABRIC_DEV, &lcl);
2783 
2784 	} while ((rs1->snscb_ports[i].control & 0x80) == 0 && i < NGENT-1);
2785 
2786 	/*
2787 	 * If we're not at the last entry, our list isn't big enough.
2788 	 */
2789 	if ((rs1->snscb_ports[i].control & 0x80) == 0) {
2790 		isp_prt(isp, ISP_LOGWARN, "fabric too big for scratch area");
2791 	}
2792 
2793 	FC_SCRATCH_RELEASE(isp);
2794 	fcp->isp_loopstate = LOOP_FSCAN_DONE;
2795 	return (0);
2796 }
2797 #endif
2798 
2799 static void
2800 isp_register_fc4_type(struct ispsoftc *isp)
2801 {
2802 	fcparam *fcp = isp->isp_param;
2803 	u_int8_t local[SNS_RFT_ID_REQ_SIZE];
2804 	sns_screq_t *reqp = (sns_screq_t *) local;
2805 	mbreg_t mbs;
2806 
2807 	MEMZERO((void *) reqp, SNS_RFT_ID_REQ_SIZE);
2808 	reqp->snscb_rblen = SNS_RFT_ID_RESP_SIZE >> 1;
2809 	reqp->snscb_addr[RQRSP_ADDR0015] = DMA_WD0(fcp->isp_scdma + 0x100);
2810 	reqp->snscb_addr[RQRSP_ADDR1631] = DMA_WD1(fcp->isp_scdma + 0x100);
2811 	reqp->snscb_addr[RQRSP_ADDR3247] = DMA_WD2(fcp->isp_scdma + 0x100);
2812 	reqp->snscb_addr[RQRSP_ADDR4863] = DMA_WD3(fcp->isp_scdma + 0x100);
2813 	reqp->snscb_sblen = 22;
2814 	reqp->snscb_data[0] = SNS_RFT_ID;
2815 	reqp->snscb_data[4] = fcp->isp_portid & 0xffff;
2816 	reqp->snscb_data[5] = (fcp->isp_portid >> 16) & 0xff;
2817 	reqp->snscb_data[6] = (1 << FC4_SCSI);
2818 #if	0
2819 	reqp->snscb_data[6] |= (1 << FC4_IP);	/* ISO/IEC 8802-2 LLC/SNAP */
2820 #endif
2821 	FC_SCRATCH_ACQUIRE(isp);
2822 	isp_put_sns_request(isp, reqp, (sns_screq_t *) fcp->isp_scratch);
2823 	mbs.param[0] = MBOX_SEND_SNS;
2824 	mbs.param[1] = SNS_RFT_ID_REQ_SIZE >> 1;
2825 	mbs.param[2] = DMA_WD1(fcp->isp_scdma);
2826 	mbs.param[3] = DMA_WD0(fcp->isp_scdma);
2827 	/*
2828 	 * Leave 4 and 5 alone
2829 	 */
2830 	mbs.param[6] = DMA_WD3(fcp->isp_scdma);
2831 	mbs.param[7] = DMA_WD2(fcp->isp_scdma);
2832 	isp_mboxcmd(isp, &mbs, MBLOGALL);
2833 	FC_SCRATCH_RELEASE(isp);
2834 	if (mbs.param[0] == MBOX_COMMAND_COMPLETE) {
2835 		isp_prt(isp, ISP_LOGDEBUG0, "Register FC4 types succeeded");
2836 	}
2837 }
2838 
2839 /*
2840  * Start a command. Locking is assumed done in the caller.
2841  */
2842 
2843 int
2844 isp_start(XS_T *xs)
2845 {
2846 	struct ispsoftc *isp;
2847 	u_int16_t nxti, optr, handle;
2848 	u_int8_t local[QENTRY_LEN];
2849 	ispreq_t *reqp, *qep;
2850 	int target, i;
2851 
2852 	XS_INITERR(xs);
2853 	isp = XS_ISP(xs);
2854 
2855 	/*
2856 	 * Check to make sure we're supporting initiator role.
2857 	 */
2858 	if ((isp->isp_role & ISP_ROLE_INITIATOR) == 0) {
2859 		XS_SETERR(xs, HBA_SELTIMEOUT);
2860 		return (CMD_COMPLETE);
2861 	}
2862 
2863 	/*
2864 	 * Now make sure we're running.
2865 	 */
2866 
2867 	if (isp->isp_state != ISP_RUNSTATE) {
2868 		isp_prt(isp, ISP_LOGERR, "Adapter not at RUNSTATE");
2869 		XS_SETERR(xs, HBA_BOTCH);
2870 		return (CMD_COMPLETE);
2871 	}
2872 
2873 	/*
2874 	 * Check command CDB length, etc.. We really are limited to 16 bytes
2875 	 * for Fibre Channel, but can do up to 44 bytes in parallel SCSI,
2876 	 * but probably only if we're running fairly new firmware (we'll
2877 	 * let the old f/w choke on an extended command queue entry).
2878 	 */
2879 
2880 	if (XS_CDBLEN(xs) > (IS_FC(isp)? 16 : 44) || XS_CDBLEN(xs) == 0) {
2881 		isp_prt(isp, ISP_LOGERR,
2882 		    "unsupported cdb length (%d, CDB[0]=0x%x)",
2883 		    XS_CDBLEN(xs), XS_CDBP(xs)[0] & 0xff);
2884 		XS_SETERR(xs, HBA_BOTCH);
2885 		return (CMD_COMPLETE);
2886 	}
2887 
2888 	/*
2889 	 * Check to see whether we have good firmware state still or
2890 	 * need to refresh our port database for this target.
2891 	 */
2892 	target = XS_TGT(xs);
2893 	if (IS_FC(isp)) {
2894 		fcparam *fcp = isp->isp_param;
2895 		struct lportdb *lp;
2896 #ifdef	HANDLE_LOOPSTATE_IN_OUTER_LAYERS
2897 		if (fcp->isp_fwstate != FW_READY ||
2898 		    fcp->isp_loopstate != LOOP_READY) {
2899 			return (CMD_RQLATER);
2900 		}
2901 
2902 		/*
2903 		 * If we're not on a Fabric, we can't have a target
2904 		 * above FL_PORT_ID-1.
2905 		 *
2906 		 * If we're on a fabric and *not* connected as an F-port,
2907 		 * we can't have a target less than FC_SNS_ID+1. This
2908 		 * keeps us from having to sort out the difference between
2909 		 * local public loop devices and those which we might get
2910 		 * from a switch's database.
2911 		 */
2912 		if (fcp->isp_onfabric == 0) {
2913 			if (target >= FL_PORT_ID) {
2914 				XS_SETERR(xs, HBA_SELTIMEOUT);
2915 				return (CMD_COMPLETE);
2916 			}
2917 		} else {
2918 			if (target >= FL_PORT_ID && target <= FC_SNS_ID) {
2919 				XS_SETERR(xs, HBA_SELTIMEOUT);
2920 				return (CMD_COMPLETE);
2921 			}
2922 			/*
2923 			 * We used to exclude having local loop ports
2924 			 * at the same time that we have fabric ports.
2925 			 * That is, we used to exclude having ports
2926 			 * at < FL_PORT_ID if we're FL-port.
2927 			 *
2928 			 * That's wrong. The only thing that could be
2929 			 * dicey is if the switch you're connected to
2930 			 * has these local loop ports appear on the
2931 			 * fabric and we somehow attach them twice.
2932 			 */
2933 		}
2934 #else
2935 		/*
2936 		 * Check for f/w being in ready state. If the f/w
2937 		 * isn't in ready state, then we don't know our
2938 		 * loop ID and the f/w hasn't completed logging
2939 		 * into all targets on the loop. If this is the
2940 		 * case, then bounce the command. We pretend this is
2941 		 * a SELECTION TIMEOUT error if we've never gone to
2942 		 * FW_READY state at all- in this case we may not
2943 		 * be hooked to a loop at all and we shouldn't hang
2944 		 * the machine for this. Otherwise, defer this command
2945 		 * until later.
2946 		 */
2947 		if (fcp->isp_fwstate != FW_READY) {
2948 			/*
2949 			 * Give ourselves at most a 250ms delay.
2950 			 */
2951 			if (isp_fclink_test(isp, 250000)) {
2952 				XS_SETERR(xs, HBA_SELTIMEOUT);
2953 				if (fcp->loop_seen_once) {
2954 					return (CMD_RQLATER);
2955 				} else {
2956 					return (CMD_COMPLETE);
2957 				}
2958 			}
2959 		}
2960 
2961 		/*
2962 		 * If we're not on a Fabric, we can't have a target
2963 		 * above FL_PORT_ID-1.
2964 		 *
2965 		 * If we're on a fabric and *not* connected as an F-port,
2966 		 * we can't have a target less than FC_SNS_ID+1. This
2967 		 * keeps us from having to sort out the difference between
2968 		 * local public loop devices and those which we might get
2969 		 * from a switch's database.
2970 		 */
2971 		if (fcp->isp_onfabric == 0) {
2972 			if (target >= FL_PORT_ID) {
2973 				XS_SETERR(xs, HBA_SELTIMEOUT);
2974 				return (CMD_COMPLETE);
2975 			}
2976 		} else {
2977 			if (target >= FL_PORT_ID && target <= FC_SNS_ID) {
2978 				XS_SETERR(xs, HBA_SELTIMEOUT);
2979 				return (CMD_COMPLETE);
2980 			}
2981 			if (fcp->isp_topo != TOPO_F_PORT &&
2982 			    target < FL_PORT_ID) {
2983 				XS_SETERR(xs, HBA_SELTIMEOUT);
2984 				return (CMD_COMPLETE);
2985 			}
2986 		}
2987 
2988 		/*
2989 		 * If our loop state is such that we haven't yet received
2990 		 * a "Port Database Changed" notification (after a LIP or
2991 		 * a Loop Reset or firmware initialization), then defer
2992 		 * sending commands for a little while, but only if we've
2993 		 * seen a valid loop at one point (otherwise we can get
2994 		 * stuck at initialization time).
2995 		 */
2996 		if (fcp->isp_loopstate < LOOP_PDB_RCVD) {
2997 			XS_SETERR(xs, HBA_SELTIMEOUT);
2998 			if (fcp->loop_seen_once) {
2999 				return (CMD_RQLATER);
3000 			} else {
3001 				return (CMD_COMPLETE);
3002 			}
3003 		}
3004 
3005 		/*
3006 		 * If we're in the middle of loop or fabric scanning
3007 		 * or merging the port databases, retry this command later.
3008 		 */
3009 		if (fcp->isp_loopstate == LOOP_SCANNING_FABRIC ||
3010 		    fcp->isp_loopstate == LOOP_SCANNING_LOOP ||
3011 		    fcp->isp_loopstate == LOOP_SYNCING_PDB) {
3012 			return (CMD_RQLATER);
3013 		}
3014 
3015 		/*
3016 		 * If our loop state is now such that we've just now
3017 		 * received a Port Database Change notification, then
3018 		 * we have to go off and (re)scan the fabric. We back
3019 		 * out and try again later if this doesn't work.
3020 		 */
3021 		if (fcp->isp_loopstate == LOOP_PDB_RCVD && fcp->isp_onfabric) {
3022 			if (isp_scan_fabric(isp, FC4_SCSI)) {
3023 				return (CMD_RQLATER);
3024 			}
3025 			if (fcp->isp_fwstate != FW_READY ||
3026 			    fcp->isp_loopstate < LOOP_PDB_RCVD) {
3027 				return (CMD_RQLATER);
3028 			}
3029 		}
3030 
3031 		/*
3032 		 * If our loop state is now such that we've just now
3033 		 * received a Port Database Change notification, then
3034 		 * we have to go off and (re)synchronize our port
3035 		 * database.
3036 		 */
3037 		if (fcp->isp_loopstate < LOOP_READY) {
3038 			if (isp_pdb_sync(isp)) {
3039 				return (CMD_RQLATER);
3040 			}
3041 			if (fcp->isp_fwstate != FW_READY ||
3042 			    fcp->isp_loopstate != LOOP_READY) {
3043 				return (CMD_RQLATER);
3044 			}
3045 		}
3046 
3047 		/*
3048 		 * XXX: Here's were we would cancel any loop_dead flag
3049 		 * XXX: also cancel in dead_loop timeout that's running
3050 		 */
3051 #endif
3052 
3053 		/*
3054 		 * Now check whether we should even think about pursuing this.
3055 		 */
3056 		lp = &fcp->portdb[target];
3057 		if (lp->valid == 0) {
3058 			XS_SETERR(xs, HBA_SELTIMEOUT);
3059 			return (CMD_COMPLETE);
3060 		}
3061 		if ((lp->roles & (SVC3_TGT_ROLE >> SVC3_ROLE_SHIFT)) == 0) {
3062 			isp_prt(isp, ISP_LOGDEBUG2,
3063 			    "Target %d does not have target service", target);
3064 			XS_SETERR(xs, HBA_SELTIMEOUT);
3065 			return (CMD_COMPLETE);
3066 		}
3067 		/*
3068 		 * Now turn target into what the actual Loop ID is.
3069 		 */
3070 		target = lp->loopid;
3071 	}
3072 
3073 	/*
3074 	 * Next check to see if any HBA or Device
3075 	 * parameters need to be updated.
3076 	 */
3077 	if (isp->isp_update != 0) {
3078 		isp_update(isp);
3079 	}
3080 
3081 	if (isp_getrqentry(isp, &nxti, &optr, (void **)&qep)) {
3082 		isp_prt(isp, ISP_LOGDEBUG0, "Request Queue Overflow");
3083 		XS_SETERR(xs, HBA_BOTCH);
3084 		return (CMD_EAGAIN);
3085 	}
3086 
3087 	/*
3088 	 * Now see if we need to synchronize the ISP with respect to anything.
3089 	 * We do dual duty here (cough) for synchronizing for busses other
3090 	 * than which we got here to send a command to.
3091 	 */
3092 	reqp = (ispreq_t *) local;
3093 	if (isp->isp_sendmarker) {
3094 		u_int8_t n = (IS_DUALBUS(isp)? 2: 1);
3095 		/*
3096 		 * Check ports to send markers for...
3097 		 */
3098 		for (i = 0; i < n; i++) {
3099 			if ((isp->isp_sendmarker & (1 << i)) == 0) {
3100 				continue;
3101 			}
3102 			MEMZERO((void *) reqp, QENTRY_LEN);
3103 			reqp->req_header.rqs_entry_count = 1;
3104 			reqp->req_header.rqs_entry_type = RQSTYPE_MARKER;
3105 			reqp->req_modifier = SYNC_ALL;
3106 			reqp->req_target = i << 7;	/* insert bus number */
3107 			isp_put_request(isp, reqp, qep);
3108 			ISP_ADD_REQUEST(isp, nxti);
3109 			isp->isp_sendmarker &= ~(1 << i);
3110 			if (isp_getrqentry(isp, &nxti, &optr, (void **) &qep)) {
3111 				isp_prt(isp, ISP_LOGDEBUG0,
3112 				    "Request Queue Overflow+");
3113 				XS_SETERR(xs, HBA_BOTCH);
3114 				return (CMD_EAGAIN);
3115 			}
3116 		}
3117 	}
3118 
3119 	MEMZERO((void *)reqp, QENTRY_LEN);
3120 	reqp->req_header.rqs_entry_count = 1;
3121 	if (IS_FC(isp)) {
3122 		reqp->req_header.rqs_entry_type = RQSTYPE_T2RQS;
3123 	} else {
3124 		if (XS_CDBLEN(xs) > 12)
3125 			reqp->req_header.rqs_entry_type = RQSTYPE_CMDONLY;
3126 		else
3127 			reqp->req_header.rqs_entry_type = RQSTYPE_REQUEST;
3128 	}
3129 	/* reqp->req_header.rqs_flags = 0; */
3130 	/* reqp->req_header.rqs_seqno = 0; */
3131 	if (IS_FC(isp)) {
3132 		/*
3133 		 * See comment in isp_intr
3134 		 */
3135 		/* XS_RESID(xs) = 0; */
3136 
3137 		/*
3138 		 * Fibre Channel always requires some kind of tag.
3139 		 * The Qlogic drivers seem be happy not to use a tag,
3140 		 * but this breaks for some devices (IBM drives).
3141 		 */
3142 		if (XS_TAG_P(xs)) {
3143 			((ispreqt2_t *)reqp)->req_flags = XS_TAG_TYPE(xs);
3144 		} else {
3145 			/*
3146 			 * If we don't know what tag to use, use HEAD OF QUEUE
3147 			 * for Request Sense or Simple.
3148 			 */
3149 			if (XS_CDBP(xs)[0] == 0x3)	/* REQUEST SENSE */
3150 				((ispreqt2_t *)reqp)->req_flags = REQFLAG_HTAG;
3151 			else
3152 				((ispreqt2_t *)reqp)->req_flags = REQFLAG_STAG;
3153 		}
3154 	} else {
3155 		sdparam *sdp = (sdparam *)isp->isp_param;
3156 		sdp += XS_CHANNEL(xs);
3157 		if ((sdp->isp_devparam[target].actv_flags & DPARM_TQING) &&
3158 		    XS_TAG_P(xs)) {
3159 			reqp->req_flags = XS_TAG_TYPE(xs);
3160 		}
3161 	}
3162 	reqp->req_target = target | (XS_CHANNEL(xs) << 7);
3163 	if (IS_SCSI(isp)) {
3164 		reqp->req_lun_trn = XS_LUN(xs);
3165 		reqp->req_cdblen = XS_CDBLEN(xs);
3166 	} else {
3167 		if (FCPARAM(isp)->isp_fwattr & ISP_FW_ATTR_SCCLUN)
3168 			((ispreqt2_t *)reqp)->req_scclun = XS_LUN(xs);
3169 		else
3170 			((ispreqt2_t *)reqp)->req_lun_trn = XS_LUN(xs);
3171 	}
3172 	MEMCPY(reqp->req_cdb, XS_CDBP(xs), XS_CDBLEN(xs));
3173 
3174 	reqp->req_time = XS_TIME(xs) / 1000;
3175 	if (reqp->req_time == 0 && XS_TIME(xs)) {
3176 		reqp->req_time = 1;
3177 	}
3178 
3179 	if (isp_save_xs(isp, xs, &handle)) {
3180 		isp_prt(isp, ISP_LOGDEBUG0, "out of xflist pointers");
3181 		XS_SETERR(xs, HBA_BOTCH);
3182 		return (CMD_EAGAIN);
3183 	}
3184 	reqp->req_handle = handle;
3185 
3186 	/*
3187 	 * Set up DMA and/or do any bus swizzling of the request entry
3188 	 * so that the Qlogic F/W understands what is being asked of it.
3189 	 */
3190 	i = ISP_DMASETUP(isp, xs, reqp, &nxti, optr);
3191 	if (i != CMD_QUEUED) {
3192 		isp_destroy_handle(isp, handle);
3193 		/*
3194 		 * dmasetup sets actual error in packet, and
3195 		 * return what we were given to return.
3196 		 */
3197 		return (i);
3198 	}
3199 	XS_SETERR(xs, HBA_NOERROR);
3200 	isp_prt(isp, ISP_LOGDEBUG2,
3201 	    "START cmd for %d.%d.%d cmd 0x%x datalen %ld",
3202 	    XS_CHANNEL(xs), target, XS_LUN(xs), XS_CDBP(xs)[0],
3203 	    (long) XS_XFRLEN(xs));
3204 	ISP_ADD_REQUEST(isp, nxti);
3205 	isp->isp_nactive++;
3206 	return (CMD_QUEUED);
3207 }
3208 
3209 /*
3210  * isp control
3211  * Locks (ints blocked) assumed held.
3212  */
3213 
3214 int
3215 isp_control(struct ispsoftc *isp, ispctl_t ctl, void *arg)
3216 {
3217 	XS_T *xs;
3218 	mbreg_t mbs;
3219 	int bus, tgt;
3220 	u_int16_t handle;
3221 
3222 	switch (ctl) {
3223 	default:
3224 		isp_prt(isp, ISP_LOGERR, "Unknown Control Opcode 0x%x", ctl);
3225 		break;
3226 
3227 	case ISPCTL_RESET_BUS:
3228 		/*
3229 		 * Issue a bus reset.
3230 		 */
3231 		mbs.param[0] = MBOX_BUS_RESET;
3232 		mbs.param[2] = 0;
3233 		if (IS_SCSI(isp)) {
3234 			mbs.param[1] =
3235 			    ((sdparam *) isp->isp_param)->isp_bus_reset_delay;
3236 			if (mbs.param[1] < 2)
3237 				mbs.param[1] = 2;
3238 			bus = *((int *) arg);
3239 			if (IS_DUALBUS(isp))
3240 				mbs.param[2] = bus;
3241 		} else {
3242 			mbs.param[1] = 10;
3243 			bus = 0;
3244 		}
3245 		isp->isp_sendmarker |= (1 << bus);
3246 		isp_mboxcmd(isp, &mbs, MBLOGALL);
3247 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
3248 			break;
3249 		}
3250 		isp_prt(isp, ISP_LOGINFO,
3251 		    "driver initiated bus reset of bus %d", bus);
3252 		return (0);
3253 
3254 	case ISPCTL_RESET_DEV:
3255 		tgt = (*((int *) arg)) & 0xffff;
3256 		bus = (*((int *) arg)) >> 16;
3257 		mbs.param[0] = MBOX_ABORT_TARGET;
3258 		mbs.param[1] = (tgt << 8) | (bus << 15);
3259 		mbs.param[2] = 3;	/* 'delay', in seconds */
3260 		isp_mboxcmd(isp, &mbs, MBLOGALL);
3261 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
3262 			break;
3263 		}
3264 		isp_prt(isp, ISP_LOGINFO,
3265 		    "Target %d on Bus %d Reset Succeeded", tgt, bus);
3266 		isp->isp_sendmarker |= (1 << bus);
3267 		return (0);
3268 
3269 	case ISPCTL_ABORT_CMD:
3270 		xs = (XS_T *) arg;
3271 		tgt = XS_TGT(xs);
3272 		handle = isp_find_handle(isp, xs);
3273 		if (handle == 0) {
3274 			isp_prt(isp, ISP_LOGWARN,
3275 			    "cannot find handle for command to abort");
3276 			break;
3277 		}
3278 		bus = XS_CHANNEL(xs);
3279 		mbs.param[0] = MBOX_ABORT;
3280 		if (IS_FC(isp)) {
3281 			if (FCPARAM(isp)->isp_fwattr & ISP_FW_ATTR_SCCLUN)  {
3282 				mbs.param[1] = tgt << 8;
3283 				mbs.param[4] = 0;
3284 				mbs.param[5] = 0;
3285 				mbs.param[6] = XS_LUN(xs);
3286 			} else {
3287 				mbs.param[1] = tgt << 8 | XS_LUN(xs);
3288 			}
3289 		} else {
3290 			mbs.param[1] =
3291 			    (bus << 15) | (XS_TGT(xs) << 8) | XS_LUN(xs);
3292 		}
3293 		mbs.param[3] = 0;
3294 		mbs.param[2] = handle;
3295 		isp_mboxcmd(isp, &mbs, MBLOGALL & ~MBOX_COMMAND_ERROR);
3296 		if (mbs.param[0] == MBOX_COMMAND_COMPLETE) {
3297 			return (0);
3298 		}
3299 		/*
3300 		 * XXX: Look for command in the REQUEST QUEUE. That is,
3301 		 * XXX: It hasen't been picked up by firmware yet.
3302 		 */
3303 		break;
3304 
3305 	case ISPCTL_UPDATE_PARAMS:
3306 
3307 		isp_update(isp);
3308 		return (0);
3309 
3310 	case ISPCTL_FCLINK_TEST:
3311 
3312 		if (IS_FC(isp)) {
3313 			int usdelay = (arg)? *((int *) arg) : 250000;
3314 			return (isp_fclink_test(isp, usdelay));
3315 		}
3316 		break;
3317 
3318 	case ISPCTL_SCAN_FABRIC:
3319 
3320 		if (IS_FC(isp)) {
3321 			int ftype = (arg)? *((int *) arg) : FC4_SCSI;
3322 			return (isp_scan_fabric(isp, ftype));
3323 		}
3324 		break;
3325 
3326 	case ISPCTL_SCAN_LOOP:
3327 
3328 		if (IS_FC(isp)) {
3329 			return (isp_scan_loop(isp));
3330 		}
3331 		break;
3332 
3333 	case ISPCTL_PDB_SYNC:
3334 
3335 		if (IS_FC(isp)) {
3336 			return (isp_pdb_sync(isp));
3337 		}
3338 		break;
3339 
3340 	case ISPCTL_SEND_LIP:
3341 
3342 		if (IS_FC(isp)) {
3343 			mbs.param[0] = MBOX_INIT_LIP;
3344 			isp_mboxcmd(isp, &mbs, MBLOGALL);
3345 			if (mbs.param[0] == MBOX_COMMAND_COMPLETE) {
3346 				return (0);
3347 			}
3348 		}
3349 		break;
3350 
3351 	case ISPCTL_GET_POSMAP:
3352 
3353 		if (IS_FC(isp) && arg) {
3354 			return (isp_getmap(isp, arg));
3355 		}
3356 		break;
3357 
3358 	case ISPCTL_RUN_MBOXCMD:
3359 
3360 		isp_mboxcmd(isp, arg, MBLOGALL);
3361 		return(0);
3362 
3363 #ifdef	ISP_TARGET_MODE
3364 	case ISPCTL_TOGGLE_TMODE:
3365 	{
3366 
3367 		/*
3368 		 * We don't check/set against role here- that's the
3369 		 * responsibility for the outer layer to coordinate.
3370 		 */
3371 		if (IS_SCSI(isp)) {
3372 			int param = *(int *)arg;
3373 			mbs.param[0] = MBOX_ENABLE_TARGET_MODE;
3374 			mbs.param[1] = param & 0xffff;
3375 			mbs.param[2] = param >> 16;
3376 			isp_mboxcmd(isp, &mbs, MBLOGALL);
3377 			if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
3378 				break;
3379 			}
3380 		}
3381 		return (0);
3382 	}
3383 #endif
3384 	}
3385 	return (-1);
3386 }
3387 
3388 /*
3389  * Interrupt Service Routine(s).
3390  *
3391  * External (OS) framework has done the appropriate locking,
3392  * and the locking will be held throughout this function.
3393  */
3394 
3395 /*
3396  * Limit our stack depth by sticking with the max likely number
3397  * of completions on a request queue at any one time.
3398  */
3399 #ifndef	MAX_REQUESTQ_COMPLETIONS
3400 #define	MAX_REQUESTQ_COMPLETIONS	64
3401 #endif
3402 
3403 void
3404 isp_intr(struct ispsoftc *isp, u_int16_t isr, u_int16_t sema, u_int16_t mbox)
3405 {
3406 	XS_T *complist[MAX_REQUESTQ_COMPLETIONS], *xs;
3407 	u_int16_t iptr, optr, junk;
3408 	int i, nlooked = 0, ndone = 0;
3409 
3410 again:
3411 	/*
3412 	 * Is this a mailbox related interrupt?
3413 	 * The mailbox semaphore will be nonzero if so.
3414 	 */
3415 	if (sema) {
3416 		if (mbox & 0x4000) {
3417 			isp->isp_intmboxc++;
3418 			if (isp->isp_mboxbsy) {
3419 				int i = 0, obits = isp->isp_obits;
3420 				isp->isp_mboxtmp[i++] = mbox;
3421 				for (i = 1; i < MAX_MAILBOX; i++) {
3422 					if ((obits & (1 << i)) == 0) {
3423 						continue;
3424 					}
3425 					isp->isp_mboxtmp[i] =
3426 					    ISP_READ(isp, MBOX_OFF(i));
3427 				}
3428 				if (isp->isp_mbxwrk0) {
3429 					if (isp_mbox_continue(isp) == 0) {
3430 						return;
3431 					}
3432 				}
3433 				MBOX_NOTIFY_COMPLETE(isp);
3434 			} else {
3435 				isp_prt(isp, ISP_LOGWARN,
3436 				    "Mbox Command Async (0x%x) with no waiters",
3437 				    mbox);
3438 			}
3439 		} else if (isp_parse_async(isp, mbox) < 0) {
3440 			return;
3441 		}
3442 		if (IS_FC(isp) || isp->isp_state != ISP_RUNSTATE) {
3443 			ISP_WRITE(isp, HCCR, HCCR_CMD_CLEAR_RISC_INT);
3444 			ISP_WRITE(isp, BIU_SEMA, 0);
3445 			return;
3446 		}
3447 	}
3448 
3449 	/*
3450 	 * We can't be getting this now.
3451 	 */
3452 	if (isp->isp_state != ISP_RUNSTATE) {
3453 		isp_prt(isp, ISP_LOGWARN,
3454 		    "interrupt (ISR=%x SEMA=%x) when not ready", isr, sema);
3455 		/*
3456 		 * Thank you very much!  *Burrrp*!
3457 		 */
3458 		WRITE_RESPONSE_QUEUE_OUT_POINTER(isp,
3459 		    READ_RESPONSE_QUEUE_IN_POINTER(isp));
3460 
3461 		ISP_WRITE(isp, HCCR, HCCR_CMD_CLEAR_RISC_INT);
3462 		ISP_WRITE(isp, BIU_SEMA, 0);
3463 		return;
3464 	}
3465 
3466 	/*
3467 	 * Get the current Response Queue Out Pointer.
3468 	 *
3469 	 * If we're a 2300, we can ask what hardware what it thinks.
3470 	 */
3471 	if (IS_23XX(isp)) {
3472 		optr = ISP_READ(isp, isp->isp_respoutrp);
3473 		/*
3474 		 * Debug: to be taken out eventually
3475 		 */
3476 		if (isp->isp_residx != optr) {
3477 			isp_prt(isp, ISP_LOGWARN, "optr %x soft optr %x",
3478 			    optr, isp->isp_residx);
3479 		}
3480 	} else {
3481 		optr = isp->isp_residx;
3482 	}
3483 
3484 	/*
3485 	 * You *must* read the Response Queue In Pointer
3486 	 * prior to clearing the RISC interrupt.
3487 	 *
3488 	 * Debounce the 2300 if revision less than 2.
3489 	 */
3490 	if (IS_2100(isp) || (IS_2300(isp) && isp->isp_revision < 2)) {
3491 		i = 0;
3492 		do {
3493 			iptr = READ_RESPONSE_QUEUE_IN_POINTER(isp);
3494 			junk = READ_RESPONSE_QUEUE_IN_POINTER(isp);
3495 		} while (junk != iptr && ++i < 1000);
3496 
3497 		if (iptr != junk) {
3498 			ISP_WRITE(isp, HCCR, HCCR_CMD_CLEAR_RISC_INT);
3499 			isp_prt(isp, ISP_LOGWARN,
3500 			    "Response Queue Out Pointer Unstable (%x, %x)",
3501 			    iptr, junk);
3502 			return;
3503 		}
3504 	} else {
3505 		iptr = READ_RESPONSE_QUEUE_IN_POINTER(isp);
3506 	}
3507 	isp->isp_resodx = iptr;
3508 
3509 
3510 	if (optr == iptr && sema == 0) {
3511 		/*
3512 		 * There are a lot of these- reasons unknown- mostly on
3513 		 * faster Alpha machines.
3514 		 *
3515 		 * I tried delaying after writing HCCR_CMD_CLEAR_RISC_INT to
3516 		 * make sure the old interrupt went away (to avoid 'ringing'
3517 		 * effects), but that didn't stop this from occurring.
3518 		 */
3519 		if (IS_23XX(isp)) {
3520 			USEC_DELAY(100);
3521 			iptr = READ_RESPONSE_QUEUE_IN_POINTER(isp);
3522 			junk = ISP_READ(isp, BIU_R2HSTSLO);
3523 		} else {
3524 			junk = ISP_READ(isp, BIU_ISR);
3525 		}
3526 		if (optr == iptr) {
3527 			if (IS_23XX(isp)) {
3528 				;
3529 			} else {
3530 				sema = ISP_READ(isp, BIU_SEMA);
3531 				mbox = ISP_READ(isp, OUTMAILBOX0);
3532 				if ((sema & 0x3) && (mbox & 0x8000)) {
3533 					goto again;
3534 				}
3535 			}
3536 			isp->isp_intbogus++;
3537 			isp_prt(isp, ISP_LOGDEBUG1,
3538 			    "bogus intr- isr %x (%x) iptr %x optr %x",
3539 			    isr, junk, iptr, optr);
3540 		}
3541 	}
3542 	isp->isp_resodx = iptr;
3543 	ISP_WRITE(isp, HCCR, HCCR_CMD_CLEAR_RISC_INT);
3544 	ISP_WRITE(isp, BIU_SEMA, 0);
3545 
3546 	if (isp->isp_rspbsy) {
3547 		return;
3548 	}
3549 	isp->isp_rspbsy = 1;
3550 
3551 	while (optr != iptr) {
3552 		ispstatusreq_t local, *sp = &local;
3553 		isphdr_t *hp;
3554 		int type;
3555 		u_int16_t oop;
3556 		int buddaboom = 0;
3557 
3558 		hp = (isphdr_t *) ISP_QUEUE_ENTRY(isp->isp_result, optr);
3559 		oop = optr;
3560 		optr = ISP_NXT_QENTRY(optr, RESULT_QUEUE_LEN(isp));
3561 		nlooked++;
3562 		/*
3563 		 * Synchronize our view of this response queue entry.
3564 		 */
3565 		MEMORYBARRIER(isp, SYNC_RESULT, oop, QENTRY_LEN);
3566 
3567 		type = isp_get_response_type(isp, hp);
3568 
3569 		if (type == RQSTYPE_RESPONSE) {
3570 			isp_get_response(isp, (ispstatusreq_t *) hp, sp);
3571 		} else if (type == RQSTYPE_RIO2) {
3572 			isp_rio2_t rio;
3573 			isp_get_rio2(isp, (isp_rio2_t *) hp, &rio);
3574 			for (i = 0; i < rio.req_header.rqs_seqno; i++) {
3575 				isp_fastpost_complete(isp, rio.req_handles[i]);
3576 			}
3577 			if (isp->isp_fpcchiwater < rio.req_header.rqs_seqno)
3578 				isp->isp_fpcchiwater = rio.req_header.rqs_seqno;
3579 			MEMZERO(hp, QENTRY_LEN);	/* PERF */
3580 			continue;
3581 		} else {
3582 			/*
3583 			 * Somebody reachable via isp_handle_other_response
3584 			 * may have updated the response queue pointers for
3585 			 * us, so we reload our goal index.
3586 			 */
3587 			if (isp_handle_other_response(isp, type, hp, &optr)) {
3588 				iptr = isp->isp_resodx;
3589 				MEMZERO(hp, QENTRY_LEN);	/* PERF */
3590 				continue;
3591 			}
3592 
3593 			/*
3594 			 * After this point, we'll just look at the header as
3595 			 * we don't know how to deal with the rest of the
3596 			 * response.
3597 			 */
3598 			isp_get_response(isp, (ispstatusreq_t *) hp, sp);
3599 
3600 			/*
3601 			 * It really has to be a bounced request just copied
3602 			 * from the request queue to the response queue. If
3603 			 * not, something bad has happened.
3604 			 */
3605 			if (sp->req_header.rqs_entry_type != RQSTYPE_REQUEST) {
3606 				isp_prt(isp, ISP_LOGERR, notresp,
3607 				    sp->req_header.rqs_entry_type, oop, optr,
3608 				    nlooked);
3609 				if (isp->isp_dblev & ISP_LOGDEBUG0) {
3610 					isp_print_bytes(isp, "Queue Entry",
3611 					    QENTRY_LEN, sp);
3612 				}
3613 				MEMZERO(hp, QENTRY_LEN);	/* PERF */
3614 				continue;
3615 			}
3616 			buddaboom = 1;
3617 		}
3618 
3619 		if (sp->req_header.rqs_flags & 0xf) {
3620 #define	_RQS_OFLAGS	\
3621 	~(RQSFLAG_CONTINUATION|RQSFLAG_FULL|RQSFLAG_BADHEADER|RQSFLAG_BADPACKET)
3622 			if (sp->req_header.rqs_flags & RQSFLAG_CONTINUATION) {
3623 				isp_prt(isp, ISP_LOGWARN,
3624 				    "continuation segment");
3625 				WRITE_RESPONSE_QUEUE_OUT_POINTER(isp, optr);
3626 				continue;
3627 			}
3628 			if (sp->req_header.rqs_flags & RQSFLAG_FULL) {
3629 				isp_prt(isp, ISP_LOGDEBUG1,
3630 				    "internal queues full");
3631 				/*
3632 				 * We'll synthesize a QUEUE FULL message below.
3633 				 */
3634 			}
3635 			if (sp->req_header.rqs_flags & RQSFLAG_BADHEADER) {
3636 				isp_prt(isp, ISP_LOGERR,  "bad header flag");
3637 				buddaboom++;
3638 			}
3639 			if (sp->req_header.rqs_flags & RQSFLAG_BADPACKET) {
3640 				isp_prt(isp, ISP_LOGERR, "bad request packet");
3641 				buddaboom++;
3642 			}
3643 			if (sp->req_header.rqs_flags & _RQS_OFLAGS) {
3644 				isp_prt(isp, ISP_LOGERR,
3645 				    "unknown flags (0x%x) in response",
3646 				    sp->req_header.rqs_flags);
3647 				buddaboom++;
3648 			}
3649 #undef	_RQS_OFLAGS
3650 		}
3651 		if (sp->req_handle > isp->isp_maxcmds || sp->req_handle < 1) {
3652 			MEMZERO(hp, QENTRY_LEN);	/* PERF */
3653 			isp_prt(isp, ISP_LOGERR,
3654 			    "bad request handle %d (type 0x%x, flags 0x%x)",
3655 			    sp->req_handle, sp->req_header.rqs_entry_type,
3656 			    sp->req_header.rqs_flags);
3657 			WRITE_RESPONSE_QUEUE_OUT_POINTER(isp, optr);
3658 			continue;
3659 		}
3660 		xs = isp_find_xs(isp, sp->req_handle);
3661 		if (xs == NULL) {
3662 			u_int8_t ts = sp->req_completion_status & 0xff;
3663 			MEMZERO(hp, QENTRY_LEN);	/* PERF */
3664 			/*
3665 			 * Only whine if this isn't the expected fallout of
3666 			 * aborting the command.
3667 			 */
3668 			if (sp->req_header.rqs_entry_type != RQSTYPE_RESPONSE ||
3669 			    ts != RQCS_ABORTED) {
3670 				isp_prt(isp, ISP_LOGERR,
3671 				    "cannot find handle 0x%x in xflist",
3672 				    sp->req_handle);
3673 			}
3674 			WRITE_RESPONSE_QUEUE_OUT_POINTER(isp, optr);
3675 			continue;
3676 		}
3677 		isp_destroy_handle(isp, sp->req_handle);
3678 		if (sp->req_status_flags & RQSTF_BUS_RESET) {
3679 			XS_SETERR(xs, HBA_BUSRESET);
3680 			isp->isp_sendmarker |= (1 << XS_CHANNEL(xs));
3681 		}
3682 		if (buddaboom) {
3683 			XS_SETERR(xs, HBA_BOTCH);
3684 		}
3685 
3686 		if (IS_FC(isp) && (sp->req_scsi_status & RQCS_SV)) {
3687 			/*
3688 			 * Fibre Channel F/W doesn't say we got status
3689 			 * if there's Sense Data instead. I guess they
3690 			 * think it goes w/o saying.
3691 			 */
3692 			sp->req_state_flags |= RQSF_GOT_STATUS;
3693 		}
3694 		if (sp->req_state_flags & RQSF_GOT_STATUS) {
3695 			*XS_STSP(xs) = sp->req_scsi_status & 0xff;
3696 		}
3697 
3698 		switch (sp->req_header.rqs_entry_type) {
3699 		case RQSTYPE_RESPONSE:
3700 			XS_SET_STATE_STAT(isp, xs, sp);
3701 			isp_parse_status(isp, sp, xs);
3702 			if ((XS_NOERR(xs) || XS_ERR(xs) == HBA_NOERROR) &&
3703 			    (*XS_STSP(xs) == SCSI_BUSY)) {
3704 				XS_SETERR(xs, HBA_TGTBSY);
3705 			}
3706 			if (IS_SCSI(isp)) {
3707 				XS_RESID(xs) = sp->req_resid;
3708 				if ((sp->req_state_flags & RQSF_GOT_STATUS) &&
3709 				    (*XS_STSP(xs) == SCSI_CHECK) &&
3710 				    (sp->req_state_flags & RQSF_GOT_SENSE)) {
3711 					XS_SAVE_SENSE(xs, sp);
3712 				}
3713 				/*
3714 				 * A new synchronous rate was negotiated for
3715 				 * this target. Mark state such that we'll go
3716 				 * look up that which has changed later.
3717 				 */
3718 				if (sp->req_status_flags & RQSTF_NEGOTIATION) {
3719 					int t = XS_TGT(xs);
3720 					sdparam *sdp = isp->isp_param;
3721 					sdp += XS_CHANNEL(xs);
3722 					sdp->isp_devparam[t].dev_refresh = 1;
3723 					isp->isp_update |=
3724 					    (1 << XS_CHANNEL(xs));
3725 				}
3726 			} else {
3727 				if (sp->req_status_flags & RQSF_XFER_COMPLETE) {
3728 					XS_RESID(xs) = 0;
3729 				} else if (sp->req_scsi_status & RQCS_RESID) {
3730 					XS_RESID(xs) = sp->req_resid;
3731 				} else {
3732 					XS_RESID(xs) = 0;
3733 				}
3734 				if ((sp->req_state_flags & RQSF_GOT_STATUS) &&
3735 				    (*XS_STSP(xs) == SCSI_CHECK) &&
3736 				    (sp->req_scsi_status & RQCS_SV)) {
3737 					XS_SAVE_SENSE(xs, sp);
3738 					/* solely for the benefit of debug */
3739 					sp->req_state_flags |= RQSF_GOT_SENSE;
3740 				}
3741 			}
3742 			isp_prt(isp, ISP_LOGDEBUG2,
3743 			   "asked for %ld got resid %ld", (long) XS_XFRLEN(xs),
3744 			   (long) sp->req_resid);
3745 			break;
3746 		case RQSTYPE_REQUEST:
3747 			if (sp->req_header.rqs_flags & RQSFLAG_FULL) {
3748 				/*
3749 				 * Force Queue Full status.
3750 				 */
3751 				*XS_STSP(xs) = SCSI_QFULL;
3752 				XS_SETERR(xs, HBA_NOERROR);
3753 			} else if (XS_NOERR(xs)) {
3754 				/*
3755 				 * ????
3756 				 */
3757 				isp_prt(isp, ISP_LOGDEBUG0,
3758 				    "Request Queue Entry bounced back");
3759 				XS_SETERR(xs, HBA_BOTCH);
3760 			}
3761 			XS_RESID(xs) = XS_XFRLEN(xs);
3762 			break;
3763 		default:
3764 			isp_prt(isp, ISP_LOGWARN,
3765 			    "unhandled response queue type 0x%x",
3766 			    sp->req_header.rqs_entry_type);
3767 			if (XS_NOERR(xs)) {
3768 				XS_SETERR(xs, HBA_BOTCH);
3769 			}
3770 			break;
3771 		}
3772 
3773 		/*
3774 		 * Free any dma resources. As a side effect, this may
3775 		 * also do any cache flushing necessary for data coherence.			 */
3776 		if (XS_XFRLEN(xs)) {
3777 			ISP_DMAFREE(isp, xs, sp->req_handle);
3778 		}
3779 
3780 		if (((isp->isp_dblev & (ISP_LOGDEBUG2|ISP_LOGDEBUG3))) ||
3781 		    ((isp->isp_dblev & ISP_LOGDEBUG1) && ((!XS_NOERR(xs)) ||
3782 		    (*XS_STSP(xs) != SCSI_GOOD)))) {
3783 			char skey;
3784 			if (sp->req_state_flags & RQSF_GOT_SENSE) {
3785 				skey = XS_SNSKEY(xs) & 0xf;
3786 				if (skey < 10)
3787 					skey += '0';
3788 				else
3789 					skey += 'a' - 10;
3790 			} else if (*XS_STSP(xs) == SCSI_CHECK) {
3791 				skey = '?';
3792 			} else {
3793 				skey = '.';
3794 			}
3795 			isp_prt(isp, ISP_LOGALL, finmsg, XS_CHANNEL(xs),
3796 			    XS_TGT(xs), XS_LUN(xs), XS_XFRLEN(xs), XS_RESID(xs),
3797 			    *XS_STSP(xs), skey, XS_ERR(xs));
3798 		}
3799 
3800 		if (isp->isp_nactive > 0)
3801 		    isp->isp_nactive--;
3802 		complist[ndone++] = xs;	/* defer completion call until later */
3803 		MEMZERO(hp, QENTRY_LEN);	/* PERF */
3804 		if (ndone == MAX_REQUESTQ_COMPLETIONS) {
3805 			break;
3806 		}
3807 	}
3808 
3809 	/*
3810 	 * If we looked at any commands, then it's valid to find out
3811 	 * what the outpointer is. It also is a trigger to update the
3812 	 * ISP's notion of what we've seen so far.
3813 	 */
3814 	if (nlooked) {
3815 		WRITE_RESPONSE_QUEUE_OUT_POINTER(isp, optr);
3816 		/*
3817 		 * While we're at it, read the requst queue out pointer.
3818 		 */
3819 		isp->isp_reqodx = READ_REQUEST_QUEUE_OUT_POINTER(isp);
3820 		if (isp->isp_rscchiwater < ndone)
3821 			isp->isp_rscchiwater = ndone;
3822 	}
3823 
3824 	isp->isp_residx = optr;
3825 	isp->isp_rspbsy = 0;
3826 	for (i = 0; i < ndone; i++) {
3827 		xs = complist[i];
3828 		if (xs) {
3829 			isp->isp_rsltccmplt++;
3830 			isp_done(xs);
3831 		}
3832 	}
3833 }
3834 
3835 /*
3836  * Support routines.
3837  */
3838 
3839 static int
3840 isp_parse_async(struct ispsoftc *isp, u_int16_t mbox)
3841 {
3842 	int bus;
3843 
3844 	if (IS_DUALBUS(isp)) {
3845 		bus = ISP_READ(isp, OUTMAILBOX6);
3846 	} else {
3847 		bus = 0;
3848 	}
3849 	isp_prt(isp, ISP_LOGDEBUG2, "Async Mbox 0x%x", mbox);
3850 
3851 	switch (mbox) {
3852 	case ASYNC_BUS_RESET:
3853 		isp->isp_sendmarker |= (1 << bus);
3854 #ifdef	ISP_TARGET_MODE
3855 		isp_target_async(isp, bus, mbox);
3856 #endif
3857 		isp_async(isp, ISPASYNC_BUS_RESET, &bus);
3858 		break;
3859 	case ASYNC_SYSTEM_ERROR:
3860 		isp_async(isp, ISPASYNC_FW_CRASH, NULL);
3861 		/* no point continuing after this */
3862 		return (-1);
3863 
3864 	case ASYNC_RQS_XFER_ERR:
3865 		isp_prt(isp, ISP_LOGERR, "Request Queue Transfer Error");
3866 		break;
3867 
3868 	case ASYNC_RSP_XFER_ERR:
3869 		isp_prt(isp, ISP_LOGERR, "Response Queue Transfer Error");
3870 		break;
3871 
3872 	case ASYNC_QWAKEUP:
3873 		/*
3874 		 * We've just been notified that the Queue has woken up.
3875 		 * We don't need to be chatty about this- just unlatch things
3876 		 * and move on.
3877 		 */
3878 		mbox = READ_REQUEST_QUEUE_OUT_POINTER(isp);
3879 		break;
3880 
3881 	case ASYNC_TIMEOUT_RESET:
3882 		isp_prt(isp, ISP_LOGWARN,
3883 		    "timeout initiated SCSI bus reset of bus %d", bus);
3884 		isp->isp_sendmarker |= (1 << bus);
3885 #ifdef	ISP_TARGET_MODE
3886 		isp_target_async(isp, bus, mbox);
3887 #endif
3888 		break;
3889 
3890 	case ASYNC_DEVICE_RESET:
3891 		isp_prt(isp, ISP_LOGINFO, "device reset on bus %d", bus);
3892 		isp->isp_sendmarker |= (1 << bus);
3893 #ifdef	ISP_TARGET_MODE
3894 		isp_target_async(isp, bus, mbox);
3895 #endif
3896 		break;
3897 
3898 	case ASYNC_EXTMSG_UNDERRUN:
3899 		isp_prt(isp, ISP_LOGWARN, "extended message underrun");
3900 		break;
3901 
3902 	case ASYNC_SCAM_INT:
3903 		isp_prt(isp, ISP_LOGINFO, "SCAM interrupt");
3904 		break;
3905 
3906 	case ASYNC_HUNG_SCSI:
3907 		isp_prt(isp, ISP_LOGERR,
3908 		    "stalled SCSI Bus after DATA Overrun");
3909 		/* XXX: Need to issue SCSI reset at this point */
3910 		break;
3911 
3912 	case ASYNC_KILLED_BUS:
3913 		isp_prt(isp, ISP_LOGERR, "SCSI Bus reset after DATA Overrun");
3914 		break;
3915 
3916 	case ASYNC_BUS_TRANSIT:
3917 		mbox = ISP_READ(isp, OUTMAILBOX2);
3918 		switch (mbox & 0x1c00) {
3919 		case SXP_PINS_LVD_MODE:
3920 			isp_prt(isp, ISP_LOGINFO, "Transition to LVD mode");
3921 			SDPARAM(isp)->isp_diffmode = 0;
3922 			SDPARAM(isp)->isp_ultramode = 0;
3923 			SDPARAM(isp)->isp_lvdmode = 1;
3924 			break;
3925 		case SXP_PINS_HVD_MODE:
3926 			isp_prt(isp, ISP_LOGINFO,
3927 			    "Transition to Differential mode");
3928 			SDPARAM(isp)->isp_diffmode = 1;
3929 			SDPARAM(isp)->isp_ultramode = 0;
3930 			SDPARAM(isp)->isp_lvdmode = 0;
3931 			break;
3932 		case SXP_PINS_SE_MODE:
3933 			isp_prt(isp, ISP_LOGINFO,
3934 			    "Transition to Single Ended mode");
3935 			SDPARAM(isp)->isp_diffmode = 0;
3936 			SDPARAM(isp)->isp_ultramode = 1;
3937 			SDPARAM(isp)->isp_lvdmode = 0;
3938 			break;
3939 		default:
3940 			isp_prt(isp, ISP_LOGWARN,
3941 			    "Transition to Unknown Mode 0x%x", mbox);
3942 			break;
3943 		}
3944 		/*
3945 		 * XXX: Set up to renegotiate again!
3946 		 */
3947 		/* Can only be for a 1080... */
3948 		isp->isp_sendmarker |= (1 << bus);
3949 		break;
3950 
3951 	/*
3952 	 * We can use bus, which will always be zero for FC cards,
3953 	 * as a mailbox pattern accumulator to be checked below.
3954 	 */
3955 	case ASYNC_RIO5:
3956 		bus = 0x1ce;	/* outgoing mailbox regs 1-3, 6-7 */
3957 		break;
3958 
3959 	case ASYNC_RIO4:
3960 		bus = 0x14e;	/* outgoing mailbox regs 1-3, 6 */
3961 		break;
3962 
3963 	case ASYNC_RIO3:
3964 		bus = 0x10e;	/* outgoing mailbox regs 1-3 */
3965 		break;
3966 
3967 	case ASYNC_RIO2:
3968 		bus = 0x106;	/* outgoing mailbox regs 1-2 */
3969 		break;
3970 
3971 	case ASYNC_RIO1:
3972 	case ASYNC_CMD_CMPLT:
3973 		bus = 0x102;	/* outgoing mailbox regs 1 */
3974 		break;
3975 
3976 	case ASYNC_RIO_RESP:
3977 		break;
3978 
3979 	case ASYNC_CTIO_DONE:
3980 #ifdef	ISP_TARGET_MODE
3981 		/*
3982 		 * Bus gets overloaded with the handle. Dual bus
3983 		 * cards don't put bus# into the handle.
3984 		 */
3985 		isp_target_async(isp, ((ISP_READ(isp, OUTMAILBOX2) << 16) |
3986 		    ISP_READ(isp, OUTMAILBOX1)), mbox);
3987 #else
3988 		isp_prt(isp, ISP_LOGINFO, "Fast Posting CTIO done");
3989 #endif
3990 		isp->isp_fphccmplt++;	/* count it as a fast posting intr */
3991 		return (0);
3992 
3993 	case ASYNC_LIP_F8:
3994 	case ASYNC_LIP_OCCURRED:
3995 		FCPARAM(isp)->isp_lipseq =
3996 		    ISP_READ(isp, OUTMAILBOX1);
3997 		FCPARAM(isp)->isp_fwstate = FW_CONFIG_WAIT;
3998 		FCPARAM(isp)->isp_loopstate = LOOP_LIP_RCVD;
3999 		isp->isp_sendmarker = 1;
4000 		isp_mark_getpdb_all(isp);
4001 		isp_async(isp, ISPASYNC_LIP, NULL);
4002 #ifdef	ISP_TARGET_MODE
4003 		isp_target_async(isp, bus, mbox);
4004 #endif
4005 		/*
4006 		 * We've had problems with data corruption occuring on
4007 		 * commands that complete (with no apparent error) after
4008 		 * we receive a LIP. This has been observed mostly on
4009 		 * Local Loop topologies. To be safe, let's just mark
4010 		 * all active commands as dead.
4011 		 */
4012 		if (FCPARAM(isp)->isp_topo == TOPO_NL_PORT ||
4013 		    FCPARAM(isp)->isp_topo == TOPO_FL_PORT) {
4014 			int i, j;
4015 			for (i = j = 0; i < isp->isp_maxcmds; i++) {
4016 				XS_T *xs;
4017 				xs = isp->isp_xflist[i];
4018 				if (xs != NULL) {
4019 					j++;
4020 					XS_SETERR(xs, HBA_BUSRESET);
4021 				}
4022 			}
4023 			if (j) {
4024 				isp_prt(isp, ISP_LOGERR,
4025 				    "LIP destroyed %d active commands", j);
4026 			}
4027 		}
4028 		break;
4029 
4030 	case ASYNC_LOOP_UP:
4031 		isp->isp_sendmarker = 1;
4032 		FCPARAM(isp)->isp_fwstate = FW_CONFIG_WAIT;
4033 		FCPARAM(isp)->isp_loopstate = LOOP_LIP_RCVD;
4034 		isp_mark_getpdb_all(isp);
4035 		isp_async(isp, ISPASYNC_LOOP_UP, NULL);
4036 #ifdef	ISP_TARGET_MODE
4037 		isp_target_async(isp, bus, mbox);
4038 #endif
4039 		break;
4040 
4041 	case ASYNC_LOOP_DOWN:
4042 		isp->isp_sendmarker = 1;
4043 		FCPARAM(isp)->isp_fwstate = FW_CONFIG_WAIT;
4044 		FCPARAM(isp)->isp_loopstate = LOOP_NIL;
4045 		isp_mark_getpdb_all(isp);
4046 		isp_async(isp, ISPASYNC_LOOP_DOWN, NULL);
4047 #ifdef	ISP_TARGET_MODE
4048 		isp_target_async(isp, bus, mbox);
4049 #endif
4050 		break;
4051 
4052 	case ASYNC_LOOP_RESET:
4053 		isp->isp_sendmarker = 1;
4054 		FCPARAM(isp)->isp_fwstate = FW_CONFIG_WAIT;
4055 		FCPARAM(isp)->isp_loopstate = LOOP_NIL;
4056 		isp_mark_getpdb_all(isp);
4057 		isp_async(isp, ISPASYNC_LOOP_RESET, NULL);
4058 #ifdef	ISP_TARGET_MODE
4059 		isp_target_async(isp, bus, mbox);
4060 #endif
4061 		break;
4062 
4063 	case ASYNC_PDB_CHANGED:
4064 		isp->isp_sendmarker = 1;
4065 		FCPARAM(isp)->isp_loopstate = LOOP_PDB_RCVD;
4066 		isp_mark_getpdb_all(isp);
4067 		isp_async(isp, ISPASYNC_CHANGE_NOTIFY, ISPASYNC_CHANGE_PDB);
4068 		break;
4069 
4070 	case ASYNC_CHANGE_NOTIFY:
4071 		/*
4072 		 * Not correct, but it will force us to rescan the loop.
4073 		 */
4074 		FCPARAM(isp)->isp_loopstate = LOOP_PDB_RCVD;
4075 		isp_mark_getpdb_all(isp);
4076 		isp_async(isp, ISPASYNC_CHANGE_NOTIFY, ISPASYNC_CHANGE_SNS);
4077 		break;
4078 
4079 	case ASYNC_PTPMODE:
4080 		if (FCPARAM(isp)->isp_onfabric)
4081 			FCPARAM(isp)->isp_topo = TOPO_F_PORT;
4082 		else
4083 			FCPARAM(isp)->isp_topo = TOPO_N_PORT;
4084 		isp_mark_getpdb_all(isp);
4085 		isp->isp_sendmarker = 1;
4086 		FCPARAM(isp)->isp_fwstate = FW_CONFIG_WAIT;
4087 		FCPARAM(isp)->isp_loopstate = LOOP_LIP_RCVD;
4088 		isp_async(isp, ISPASYNC_CHANGE_NOTIFY, ISPASYNC_CHANGE_OTHER);
4089 #ifdef	ISP_TARGET_MODE
4090 		isp_target_async(isp, bus, mbox);
4091 #endif
4092 		isp_prt(isp, ISP_LOGINFO, "Point-to-Point mode");
4093 		break;
4094 
4095 	case ASYNC_CONNMODE:
4096 		mbox = ISP_READ(isp, OUTMAILBOX1);
4097 		isp_mark_getpdb_all(isp);
4098 		switch (mbox) {
4099 		case ISP_CONN_LOOP:
4100 			isp_prt(isp, ISP_LOGINFO,
4101 			    "Point-to-Point -> Loop mode");
4102 			break;
4103 		case ISP_CONN_PTP:
4104 			isp_prt(isp, ISP_LOGINFO,
4105 			    "Loop -> Point-to-Point mode");
4106 			break;
4107 		case ISP_CONN_BADLIP:
4108 			isp_prt(isp, ISP_LOGWARN,
4109 			    "Point-to-Point -> Loop mode (BAD LIP)");
4110 			break;
4111 		case ISP_CONN_FATAL:
4112 			isp_prt(isp, ISP_LOGERR, "FATAL CONNECTION ERROR");
4113 			isp_reinit(isp);
4114 #ifdef	ISP_TARGET_MODE
4115 			isp_target_async(isp, bus, ASYNC_SYSTEM_ERROR);
4116 #endif
4117 			/* no point continuing after this */
4118 			return (-1);
4119 		case ISP_CONN_LOOPBACK:
4120 			isp_prt(isp, ISP_LOGWARN,
4121 			    "Looped Back in Point-to-Point mode");
4122 			break;
4123 		default:
4124 			isp_prt(isp, ISP_LOGWARN,
4125 			    "Unknown connection mode (0x%x)", mbox);
4126 			break;
4127 		}
4128 		isp_async(isp, ISPASYNC_CHANGE_NOTIFY, ISPASYNC_CHANGE_OTHER);
4129 		isp->isp_sendmarker = 1;
4130 		FCPARAM(isp)->isp_fwstate = FW_CONFIG_WAIT;
4131 		FCPARAM(isp)->isp_loopstate = LOOP_LIP_RCVD;
4132 		break;
4133 
4134 	default:
4135 		isp_prt(isp, ISP_LOGWARN, "Unknown Async Code 0x%x", mbox);
4136 		break;
4137 	}
4138 
4139 	if (bus & 0x100) {
4140 		int i, nh;
4141 		u_int16_t handles[5];
4142 
4143 		for (nh = 0, i = 1; i < MAX_MAILBOX; i++) {
4144 			if ((bus & (1 << i)) == 0) {
4145 				continue;
4146 			}
4147 			handles[nh++] = ISP_READ(isp, MBOX_OFF(i));
4148 		}
4149 		for (i = 0; i < nh; i++) {
4150 			isp_fastpost_complete(isp, handles[i]);
4151 			isp_prt(isp,  ISP_LOGDEBUG3,
4152 			    "fast post completion of %u", handles[i]);
4153 		}
4154 		if (isp->isp_fpcchiwater < nh)
4155 			isp->isp_fpcchiwater = nh;
4156 	} else {
4157 		isp->isp_intoasync++;
4158 	}
4159 	return (0);
4160 }
4161 
4162 /*
4163  * Handle other response entries. A pointer to the request queue output
4164  * index is here in case we want to eat several entries at once, although
4165  * this is not used currently.
4166  */
4167 
4168 static int
4169 isp_handle_other_response(struct ispsoftc *isp, int type,
4170     isphdr_t *hp, u_int16_t *optrp)
4171 {
4172 	switch (type) {
4173 	case RQSTYPE_STATUS_CONT:
4174 		isp_prt(isp, ISP_LOGINFO, "Ignored Continuation Response");
4175 		return (1);
4176 	case RQSTYPE_ATIO:
4177 	case RQSTYPE_CTIO:
4178 	case RQSTYPE_ENABLE_LUN:
4179 	case RQSTYPE_MODIFY_LUN:
4180 	case RQSTYPE_NOTIFY:
4181 	case RQSTYPE_NOTIFY_ACK:
4182 	case RQSTYPE_CTIO1:
4183 	case RQSTYPE_ATIO2:
4184 	case RQSTYPE_CTIO2:
4185 	case RQSTYPE_CTIO3:
4186 		isp->isp_rsltccmplt++;	/* count as a response completion */
4187 #ifdef	ISP_TARGET_MODE
4188 		if (isp_target_notify(isp, (ispstatusreq_t *) hp, optrp)) {
4189 			return (1);
4190 		}
4191 #else
4192 		optrp = optrp;
4193 		/* FALLTHROUGH */
4194 #endif
4195 	case RQSTYPE_REQUEST:
4196 	default:
4197 		if (isp_async(isp, ISPASYNC_UNHANDLED_RESPONSE, hp)) {
4198 			return (1);
4199 		}
4200 		isp_prt(isp, ISP_LOGWARN, "Unhandled Response Type 0x%x",
4201 		    isp_get_response_type(isp, hp));
4202 		return (0);
4203 	}
4204 }
4205 
4206 static void
4207 isp_parse_status(struct ispsoftc *isp, ispstatusreq_t *sp, XS_T *xs)
4208 {
4209 	switch (sp->req_completion_status & 0xff) {
4210 	case RQCS_COMPLETE:
4211 		if (XS_NOERR(xs)) {
4212 			XS_SETERR(xs, HBA_NOERROR);
4213 		}
4214 		return;
4215 
4216 	case RQCS_INCOMPLETE:
4217 		if ((sp->req_state_flags & RQSF_GOT_TARGET) == 0) {
4218 			isp_prt(isp, ISP_LOGDEBUG1,
4219 			    "Selection Timeout for %d.%d.%d",
4220 			    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4221 			if (XS_NOERR(xs)) {
4222 				XS_SETERR(xs, HBA_SELTIMEOUT);
4223 			}
4224 			return;
4225 		}
4226 		isp_prt(isp, ISP_LOGERR,
4227 		    "command incomplete for %d.%d.%d, state 0x%x",
4228 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs),
4229 		    sp->req_state_flags);
4230 		break;
4231 
4232 	case RQCS_DMA_ERROR:
4233 		isp_prt(isp, ISP_LOGERR, "DMA error for command on %d.%d.%d",
4234 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4235 		break;
4236 
4237 	case RQCS_TRANSPORT_ERROR:
4238 	{
4239 		char buf[172];
4240 		buf[0] = 0;
4241 		STRNCAT(buf, "states=>", sizeof buf);
4242 		if (sp->req_state_flags & RQSF_GOT_BUS) {
4243 			STRNCAT(buf, " GOT_BUS", sizeof buf);
4244 		}
4245 		if (sp->req_state_flags & RQSF_GOT_TARGET) {
4246 			STRNCAT(buf, " GOT_TGT", sizeof buf);
4247 		}
4248 		if (sp->req_state_flags & RQSF_SENT_CDB) {
4249 			STRNCAT(buf, " SENT_CDB", sizeof buf);
4250 		}
4251 		if (sp->req_state_flags & RQSF_XFRD_DATA) {
4252 			STRNCAT(buf, " XFRD_DATA", sizeof buf);
4253 		}
4254 		if (sp->req_state_flags & RQSF_GOT_STATUS) {
4255 			STRNCAT(buf, " GOT_STS", sizeof buf);
4256 		}
4257 		if (sp->req_state_flags & RQSF_GOT_SENSE) {
4258 			STRNCAT(buf, " GOT_SNS", sizeof buf);
4259 		}
4260 		if (sp->req_state_flags & RQSF_XFER_COMPLETE) {
4261 			STRNCAT(buf, " XFR_CMPLT", sizeof buf);
4262 		}
4263 		STRNCAT(buf, "\nstatus=>", sizeof buf);
4264 		if (sp->req_status_flags & RQSTF_DISCONNECT) {
4265 			STRNCAT(buf, " Disconnect", sizeof buf);
4266 		}
4267 		if (sp->req_status_flags & RQSTF_SYNCHRONOUS) {
4268 			STRNCAT(buf, " Sync_xfr", sizeof buf);
4269 		}
4270 		if (sp->req_status_flags & RQSTF_PARITY_ERROR) {
4271 			STRNCAT(buf, " Parity", sizeof buf);
4272 		}
4273 		if (sp->req_status_flags & RQSTF_BUS_RESET) {
4274 			STRNCAT(buf, " Bus_Reset", sizeof buf);
4275 		}
4276 		if (sp->req_status_flags & RQSTF_DEVICE_RESET) {
4277 			STRNCAT(buf, " Device_Reset", sizeof buf);
4278 		}
4279 		if (sp->req_status_flags & RQSTF_ABORTED) {
4280 			STRNCAT(buf, " Aborted", sizeof buf);
4281 		}
4282 		if (sp->req_status_flags & RQSTF_TIMEOUT) {
4283 			STRNCAT(buf, " Timeout", sizeof buf);
4284 		}
4285 		if (sp->req_status_flags & RQSTF_NEGOTIATION) {
4286 			STRNCAT(buf, " Negotiation", sizeof buf);
4287 		}
4288 		isp_prt(isp, ISP_LOGERR, "%s", buf);
4289 		isp_prt(isp, ISP_LOGERR, "transport error for %d.%d.%d:\n%s",
4290 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs), buf);
4291 		break;
4292 	}
4293 	case RQCS_RESET_OCCURRED:
4294 		isp_prt(isp, ISP_LOGWARN,
4295 		    "bus reset destroyed command for %d.%d.%d",
4296 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4297 		isp->isp_sendmarker |= (1 << XS_CHANNEL(xs));
4298 		if (XS_NOERR(xs)) {
4299 			XS_SETERR(xs, HBA_BUSRESET);
4300 		}
4301 		return;
4302 
4303 	case RQCS_ABORTED:
4304 		isp_prt(isp, ISP_LOGERR, "command aborted for %d.%d.%d",
4305 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4306 		isp->isp_sendmarker |= (1 << XS_CHANNEL(xs));
4307 		if (XS_NOERR(xs)) {
4308 			XS_SETERR(xs, HBA_ABORTED);
4309 		}
4310 		return;
4311 
4312 	case RQCS_TIMEOUT:
4313 		isp_prt(isp, ISP_LOGWARN, "command timed out for %d.%d.%d",
4314 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4315 		if (XS_NOERR(xs)) {
4316 			XS_SETERR(xs, HBA_CMDTIMEOUT);
4317 		}
4318 		return;
4319 
4320 	case RQCS_DATA_OVERRUN:
4321 		XS_RESID(xs) = sp->req_resid;
4322 		isp_prt(isp, ISP_LOGERR, "data overrun for command on %d.%d.%d",
4323 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4324 		if (XS_NOERR(xs)) {
4325 			XS_SETERR(xs, HBA_DATAOVR);
4326 		}
4327 		return;
4328 
4329 	case RQCS_COMMAND_OVERRUN:
4330 		isp_prt(isp, ISP_LOGERR,
4331 		    "command overrun for command on %d.%d.%d",
4332 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4333 		break;
4334 
4335 	case RQCS_STATUS_OVERRUN:
4336 		isp_prt(isp, ISP_LOGERR,
4337 		    "status overrun for command on %d.%d.%d",
4338 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4339 		break;
4340 
4341 	case RQCS_BAD_MESSAGE:
4342 		isp_prt(isp, ISP_LOGERR,
4343 		    "msg not COMMAND COMPLETE after status %d.%d.%d",
4344 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4345 		break;
4346 
4347 	case RQCS_NO_MESSAGE_OUT:
4348 		isp_prt(isp, ISP_LOGERR,
4349 		    "No MESSAGE OUT phase after selection on %d.%d.%d",
4350 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4351 		break;
4352 
4353 	case RQCS_EXT_ID_FAILED:
4354 		isp_prt(isp, ISP_LOGERR, "EXTENDED IDENTIFY failed %d.%d.%d",
4355 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4356 		break;
4357 
4358 	case RQCS_IDE_MSG_FAILED:
4359 		isp_prt(isp, ISP_LOGERR,
4360 		    "INITIATOR DETECTED ERROR rejected by %d.%d.%d",
4361 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4362 		break;
4363 
4364 	case RQCS_ABORT_MSG_FAILED:
4365 		isp_prt(isp, ISP_LOGERR, "ABORT OPERATION rejected by %d.%d.%d",
4366 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4367 		break;
4368 
4369 	case RQCS_REJECT_MSG_FAILED:
4370 		isp_prt(isp, ISP_LOGERR, "MESSAGE REJECT rejected by %d.%d.%d",
4371 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4372 		break;
4373 
4374 	case RQCS_NOP_MSG_FAILED:
4375 		isp_prt(isp, ISP_LOGERR, "NOP rejected by %d.%d.%d",
4376 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4377 		break;
4378 
4379 	case RQCS_PARITY_ERROR_MSG_FAILED:
4380 		isp_prt(isp, ISP_LOGERR,
4381 		    "MESSAGE PARITY ERROR rejected by %d.%d.%d",
4382 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4383 		break;
4384 
4385 	case RQCS_DEVICE_RESET_MSG_FAILED:
4386 		isp_prt(isp, ISP_LOGWARN,
4387 		    "BUS DEVICE RESET rejected by %d.%d.%d",
4388 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4389 		break;
4390 
4391 	case RQCS_ID_MSG_FAILED:
4392 		isp_prt(isp, ISP_LOGERR, "IDENTIFY rejected by %d.%d.%d",
4393 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4394 		break;
4395 
4396 	case RQCS_UNEXP_BUS_FREE:
4397 		isp_prt(isp, ISP_LOGERR, "%d.%d.%d had an unexpected bus free",
4398 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4399 		break;
4400 
4401 	case RQCS_DATA_UNDERRUN:
4402 	{
4403 		if (IS_FC(isp)) {
4404 			int ru_marked = (sp->req_scsi_status & RQCS_RU) != 0;
4405 			if (!ru_marked || sp->req_resid > XS_XFRLEN(xs)) {
4406 				isp_prt(isp, ISP_LOGWARN, bun, XS_TGT(xs),
4407 				    XS_LUN(xs), XS_XFRLEN(xs), sp->req_resid,
4408 				    (ru_marked)? "marked" : "not marked");
4409 				if (XS_NOERR(xs)) {
4410 					XS_SETERR(xs, HBA_BOTCH);
4411 				}
4412 				return;
4413 			}
4414 		}
4415 		XS_RESID(xs) = sp->req_resid;
4416 		if (XS_NOERR(xs)) {
4417 			XS_SETERR(xs, HBA_NOERROR);
4418 		}
4419 		return;
4420 	}
4421 
4422 	case RQCS_XACT_ERR1:
4423 		isp_prt(isp, ISP_LOGERR, xact1, XS_CHANNEL(xs),
4424 		    XS_TGT(xs), XS_LUN(xs));
4425 		break;
4426 
4427 	case RQCS_XACT_ERR2:
4428 		isp_prt(isp, ISP_LOGERR, xact2,
4429 		    XS_LUN(xs), XS_TGT(xs), XS_CHANNEL(xs));
4430 		break;
4431 
4432 	case RQCS_XACT_ERR3:
4433 		isp_prt(isp, ISP_LOGERR, xact3,
4434 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4435 		break;
4436 
4437 	case RQCS_BAD_ENTRY:
4438 		isp_prt(isp, ISP_LOGERR, "Invalid IOCB entry type detected");
4439 		break;
4440 
4441 	case RQCS_QUEUE_FULL:
4442 		isp_prt(isp, ISP_LOGDEBUG0,
4443 		    "internal queues full for %d.%d.%d status 0x%x",
4444 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs), *XS_STSP(xs));
4445 
4446 		/*
4447 		 * If QFULL or some other status byte is set, then this
4448 		 * isn't an error, per se.
4449 		 *
4450 		 * Unfortunately, some QLogic f/w writers have, in
4451 		 * some cases, ommitted to *set* status to QFULL.
4452 		 *
4453 
4454 		if (*XS_STSP(xs) != SCSI_GOOD && XS_NOERR(xs)) {
4455 			XS_SETERR(xs, HBA_NOERROR);
4456 			return;
4457 		}
4458 
4459 		 *
4460 		 *
4461 		 */
4462 
4463 		*XS_STSP(xs) = SCSI_QFULL;
4464 		XS_SETERR(xs, HBA_NOERROR);
4465 		return;
4466 
4467 	case RQCS_PHASE_SKIPPED:
4468 		isp_prt(isp, ISP_LOGERR, pskip, XS_CHANNEL(xs),
4469 		    XS_TGT(xs), XS_LUN(xs));
4470 		break;
4471 
4472 	case RQCS_ARQS_FAILED:
4473 		isp_prt(isp, ISP_LOGERR,
4474 		    "Auto Request Sense failed for %d.%d.%d",
4475 		    XS_CHANNEL(xs), XS_TGT(xs), XS_LUN(xs));
4476 		if (XS_NOERR(xs)) {
4477 			XS_SETERR(xs, HBA_ARQFAIL);
4478 		}
4479 		return;
4480 
4481 	case RQCS_WIDE_FAILED:
4482 		isp_prt(isp, ISP_LOGERR,
4483 		    "Wide Negotiation failed for %d.%d.%d",
4484 		    XS_TGT(xs), XS_LUN(xs), XS_CHANNEL(xs));
4485 		if (IS_SCSI(isp)) {
4486 			sdparam *sdp = isp->isp_param;
4487 			sdp += XS_CHANNEL(xs);
4488 			sdp->isp_devparam[XS_TGT(xs)].goal_flags &= ~DPARM_WIDE;
4489 			sdp->isp_devparam[XS_TGT(xs)].dev_update = 1;
4490 			isp->isp_update |= (1 << XS_CHANNEL(xs));
4491 		}
4492 		if (XS_NOERR(xs)) {
4493 			XS_SETERR(xs, HBA_NOERROR);
4494 		}
4495 		return;
4496 
4497 	case RQCS_SYNCXFER_FAILED:
4498 		isp_prt(isp, ISP_LOGERR,
4499 		    "SDTR Message failed for target %d.%d.%d",
4500 		    XS_TGT(xs), XS_LUN(xs), XS_CHANNEL(xs));
4501 		if (IS_SCSI(isp)) {
4502 			sdparam *sdp = isp->isp_param;
4503 			sdp += XS_CHANNEL(xs);
4504 			sdp->isp_devparam[XS_TGT(xs)].goal_flags &= ~DPARM_SYNC;
4505 			sdp->isp_devparam[XS_TGT(xs)].dev_update = 1;
4506 			isp->isp_update |= (1 << XS_CHANNEL(xs));
4507 		}
4508 		break;
4509 
4510 	case RQCS_LVD_BUSERR:
4511 		isp_prt(isp, ISP_LOGERR,
4512 		    "Bad LVD condition while talking to %d.%d.%d",
4513 		    XS_TGT(xs), XS_LUN(xs), XS_CHANNEL(xs));
4514 		break;
4515 
4516 	case RQCS_PORT_UNAVAILABLE:
4517 		/*
4518 		 * No such port on the loop. Moral equivalent of SELTIMEO
4519 		 */
4520 	case RQCS_PORT_LOGGED_OUT:
4521 		/*
4522 		 * It was there (maybe)- treat as a selection timeout.
4523 		 */
4524 		if ((sp->req_completion_status & 0xff) == RQCS_PORT_UNAVAILABLE)
4525 			isp_prt(isp, ISP_LOGINFO,
4526 			    "port unavailable for target %d", XS_TGT(xs));
4527 		else
4528 			isp_prt(isp, ISP_LOGINFO,
4529 			    "port logout for target %d", XS_TGT(xs));
4530 		/*
4531 		 * If we're on a local loop, force a LIP (which is overkill)
4532 		 * to force a re-login of this unit. If we're on fabric,
4533 		 * then we'll have to relogin as a matter of course.
4534 		 */
4535 		if (FCPARAM(isp)->isp_topo == TOPO_NL_PORT ||
4536 		    FCPARAM(isp)->isp_topo == TOPO_FL_PORT) {
4537 			mbreg_t mbs;
4538 			mbs.param[0] = MBOX_INIT_LIP;
4539 			isp_mboxcmd_qnw(isp, &mbs, 1);
4540 		}
4541 
4542 		/*
4543 		 * Probably overkill.
4544 		 */
4545 		isp->isp_sendmarker = 1;
4546 		FCPARAM(isp)->isp_loopstate = LOOP_PDB_RCVD;
4547 		isp_mark_getpdb_all(isp);
4548 		isp_async(isp, ISPASYNC_CHANGE_NOTIFY, ISPASYNC_CHANGE_OTHER);
4549 		if (XS_NOERR(xs)) {
4550 			XS_SETERR(xs, HBA_SELTIMEOUT);
4551 		}
4552 		return;
4553 
4554 	case RQCS_PORT_CHANGED:
4555 		isp_prt(isp, ISP_LOGWARN,
4556 		    "port changed for target %d", XS_TGT(xs));
4557 		if (XS_NOERR(xs)) {
4558 			XS_SETERR(xs, HBA_SELTIMEOUT);
4559 		}
4560 		return;
4561 
4562 	case RQCS_PORT_BUSY:
4563 		isp_prt(isp, ISP_LOGWARN,
4564 		    "port busy for target %d", XS_TGT(xs));
4565 		if (XS_NOERR(xs)) {
4566 			XS_SETERR(xs, HBA_TGTBSY);
4567 		}
4568 		return;
4569 
4570 	default:
4571 		isp_prt(isp, ISP_LOGERR, "Unknown Completion Status 0x%x",
4572 		    sp->req_completion_status);
4573 		break;
4574 	}
4575 	if (XS_NOERR(xs)) {
4576 		XS_SETERR(xs, HBA_BOTCH);
4577 	}
4578 }
4579 
4580 static void
4581 isp_fastpost_complete(struct ispsoftc *isp, u_int16_t fph)
4582 {
4583 	XS_T *xs;
4584 
4585 	if (fph == 0) {
4586 		return;
4587 	}
4588 	xs = isp_find_xs(isp, fph);
4589 	if (xs == NULL) {
4590 		isp_prt(isp, ISP_LOGWARN,
4591 		    "Command for fast post handle 0x%x not found", fph);
4592 		return;
4593 	}
4594 	isp_destroy_handle(isp, fph);
4595 
4596 	/*
4597 	 * Since we don't have a result queue entry item,
4598 	 * we must believe that SCSI status is zero and
4599 	 * that all data transferred.
4600 	 */
4601 	XS_SET_STATE_STAT(isp, xs, NULL);
4602 	XS_RESID(xs) = 0;
4603 	*XS_STSP(xs) = SCSI_GOOD;
4604 	if (XS_XFRLEN(xs)) {
4605 		ISP_DMAFREE(isp, xs, fph);
4606 	}
4607 	if (isp->isp_nactive)
4608 		isp->isp_nactive--;
4609 	isp->isp_fphccmplt++;
4610 	isp_done(xs);
4611 }
4612 
4613 static int
4614 isp_mbox_continue(struct ispsoftc *isp)
4615 {
4616 	mbreg_t mbs;
4617 	u_int16_t *ptr;
4618 
4619 	switch (isp->isp_lastmbxcmd) {
4620 	case MBOX_WRITE_RAM_WORD:
4621 	case MBOX_READ_RAM_WORD:
4622 	case MBOX_READ_RAM_WORD_EXTENDED:
4623 		break;
4624 	default:
4625 		return (1);
4626 	}
4627 	if (isp->isp_mboxtmp[0] != MBOX_COMMAND_COMPLETE) {
4628 		isp->isp_mbxwrk0 = 0;
4629 		return (-1);
4630 	}
4631 
4632 
4633 	/*
4634 	 * Clear the previous interrupt.
4635 	 */
4636 	ISP_WRITE(isp, HCCR, HCCR_CMD_CLEAR_RISC_INT);
4637 	ISP_WRITE(isp, BIU_SEMA, 0);
4638 
4639 	/*
4640 	 * Continue with next word.
4641 	 */
4642 	ptr = isp->isp_mbxworkp;
4643 	switch (isp->isp_lastmbxcmd) {
4644 	case MBOX_WRITE_RAM_WORD:
4645 		mbs.param[2] = *ptr++;
4646 		mbs.param[1] = isp->isp_mbxwrk1++;
4647 		break;
4648 	case MBOX_READ_RAM_WORD:
4649 	case MBOX_READ_RAM_WORD_EXTENDED:
4650 		*ptr++ = isp->isp_mboxtmp[2];
4651 		mbs.param[1] = isp->isp_mbxwrk1++;
4652 		break;
4653 	}
4654 	isp->isp_mbxworkp = ptr;
4655 	mbs.param[0] = isp->isp_lastmbxcmd;
4656 	isp->isp_mbxwrk0 -= 1;
4657 	isp_mboxcmd_qnw(isp, &mbs, 0);
4658 	return (0);
4659 }
4660 
4661 
4662 #define	HIBYT(x)			((x) >> 0x8)
4663 #define	LOBYT(x)			((x)  & 0xff)
4664 #define	ISPOPMAP(a, b)			(((a) << 8) | (b))
4665 static u_int16_t mbpscsi[] = {
4666 	ISPOPMAP(0x01, 0x01),	/* 0x00: MBOX_NO_OP */
4667 	ISPOPMAP(0x1f, 0x01),	/* 0x01: MBOX_LOAD_RAM */
4668 	ISPOPMAP(0x03, 0x01),	/* 0x02: MBOX_EXEC_FIRMWARE */
4669 	ISPOPMAP(0x1f, 0x01),	/* 0x03: MBOX_DUMP_RAM */
4670 	ISPOPMAP(0x07, 0x07),	/* 0x04: MBOX_WRITE_RAM_WORD */
4671 	ISPOPMAP(0x03, 0x07),	/* 0x05: MBOX_READ_RAM_WORD */
4672 	ISPOPMAP(0x3f, 0x3f),	/* 0x06: MBOX_MAILBOX_REG_TEST */
4673 	ISPOPMAP(0x03, 0x07),	/* 0x07: MBOX_VERIFY_CHECKSUM	*/
4674 	ISPOPMAP(0x01, 0x0f),	/* 0x08: MBOX_ABOUT_FIRMWARE */
4675 	ISPOPMAP(0x00, 0x00),	/* 0x09: */
4676 	ISPOPMAP(0x00, 0x00),	/* 0x0a: */
4677 	ISPOPMAP(0x00, 0x00),	/* 0x0b: */
4678 	ISPOPMAP(0x00, 0x00),	/* 0x0c: */
4679 	ISPOPMAP(0x00, 0x00),	/* 0x0d: */
4680 	ISPOPMAP(0x01, 0x05),	/* 0x0e: MBOX_CHECK_FIRMWARE */
4681 	ISPOPMAP(0x00, 0x00),	/* 0x0f: */
4682 	ISPOPMAP(0x1f, 0x1f),	/* 0x10: MBOX_INIT_REQ_QUEUE */
4683 	ISPOPMAP(0x3f, 0x3f),	/* 0x11: MBOX_INIT_RES_QUEUE */
4684 	ISPOPMAP(0x0f, 0x0f),	/* 0x12: MBOX_EXECUTE_IOCB */
4685 	ISPOPMAP(0x03, 0x03),	/* 0x13: MBOX_WAKE_UP	*/
4686 	ISPOPMAP(0x01, 0x3f),	/* 0x14: MBOX_STOP_FIRMWARE */
4687 	ISPOPMAP(0x0f, 0x0f),	/* 0x15: MBOX_ABORT */
4688 	ISPOPMAP(0x03, 0x03),	/* 0x16: MBOX_ABORT_DEVICE */
4689 	ISPOPMAP(0x07, 0x07),	/* 0x17: MBOX_ABORT_TARGET */
4690 	ISPOPMAP(0x07, 0x07),	/* 0x18: MBOX_BUS_RESET */
4691 	ISPOPMAP(0x03, 0x07),	/* 0x19: MBOX_STOP_QUEUE */
4692 	ISPOPMAP(0x03, 0x07),	/* 0x1a: MBOX_START_QUEUE */
4693 	ISPOPMAP(0x03, 0x07),	/* 0x1b: MBOX_SINGLE_STEP_QUEUE */
4694 	ISPOPMAP(0x03, 0x07),	/* 0x1c: MBOX_ABORT_QUEUE */
4695 	ISPOPMAP(0x03, 0x4f),	/* 0x1d: MBOX_GET_DEV_QUEUE_STATUS */
4696 	ISPOPMAP(0x00, 0x00),	/* 0x1e: */
4697 	ISPOPMAP(0x01, 0x07),	/* 0x1f: MBOX_GET_FIRMWARE_STATUS */
4698 	ISPOPMAP(0x01, 0x07),	/* 0x20: MBOX_GET_INIT_SCSI_ID */
4699 	ISPOPMAP(0x01, 0x07),	/* 0x21: MBOX_GET_SELECT_TIMEOUT */
4700 	ISPOPMAP(0x01, 0xc7),	/* 0x22: MBOX_GET_RETRY_COUNT	*/
4701 	ISPOPMAP(0x01, 0x07),	/* 0x23: MBOX_GET_TAG_AGE_LIMIT */
4702 	ISPOPMAP(0x01, 0x03),	/* 0x24: MBOX_GET_CLOCK_RATE */
4703 	ISPOPMAP(0x01, 0x07),	/* 0x25: MBOX_GET_ACT_NEG_STATE */
4704 	ISPOPMAP(0x01, 0x07),	/* 0x26: MBOX_GET_ASYNC_DATA_SETUP_TIME */
4705 	ISPOPMAP(0x01, 0x07),	/* 0x27: MBOX_GET_PCI_PARAMS */
4706 	ISPOPMAP(0x03, 0x4f),	/* 0x28: MBOX_GET_TARGET_PARAMS */
4707 	ISPOPMAP(0x03, 0x0f),	/* 0x29: MBOX_GET_DEV_QUEUE_PARAMS */
4708 	ISPOPMAP(0x01, 0x07),	/* 0x2a: MBOX_GET_RESET_DELAY_PARAMS */
4709 	ISPOPMAP(0x00, 0x00),	/* 0x2b: */
4710 	ISPOPMAP(0x00, 0x00),	/* 0x2c: */
4711 	ISPOPMAP(0x00, 0x00),	/* 0x2d: */
4712 	ISPOPMAP(0x00, 0x00),	/* 0x2e: */
4713 	ISPOPMAP(0x00, 0x00),	/* 0x2f: */
4714 	ISPOPMAP(0x03, 0x03),	/* 0x30: MBOX_SET_INIT_SCSI_ID */
4715 	ISPOPMAP(0x07, 0x07),	/* 0x31: MBOX_SET_SELECT_TIMEOUT */
4716 	ISPOPMAP(0xc7, 0xc7),	/* 0x32: MBOX_SET_RETRY_COUNT	*/
4717 	ISPOPMAP(0x07, 0x07),	/* 0x33: MBOX_SET_TAG_AGE_LIMIT */
4718 	ISPOPMAP(0x03, 0x03),	/* 0x34: MBOX_SET_CLOCK_RATE */
4719 	ISPOPMAP(0x07, 0x07),	/* 0x35: MBOX_SET_ACT_NEG_STATE */
4720 	ISPOPMAP(0x07, 0x07),	/* 0x36: MBOX_SET_ASYNC_DATA_SETUP_TIME */
4721 	ISPOPMAP(0x07, 0x07),	/* 0x37: MBOX_SET_PCI_CONTROL_PARAMS */
4722 	ISPOPMAP(0x4f, 0x4f),	/* 0x38: MBOX_SET_TARGET_PARAMS */
4723 	ISPOPMAP(0x0f, 0x0f),	/* 0x39: MBOX_SET_DEV_QUEUE_PARAMS */
4724 	ISPOPMAP(0x07, 0x07),	/* 0x3a: MBOX_SET_RESET_DELAY_PARAMS */
4725 	ISPOPMAP(0x00, 0x00),	/* 0x3b: */
4726 	ISPOPMAP(0x00, 0x00),	/* 0x3c: */
4727 	ISPOPMAP(0x00, 0x00),	/* 0x3d: */
4728 	ISPOPMAP(0x00, 0x00),	/* 0x3e: */
4729 	ISPOPMAP(0x00, 0x00),	/* 0x3f: */
4730 	ISPOPMAP(0x01, 0x03),	/* 0x40: MBOX_RETURN_BIOS_BLOCK_ADDR */
4731 	ISPOPMAP(0x3f, 0x01),	/* 0x41: MBOX_WRITE_FOUR_RAM_WORDS */
4732 	ISPOPMAP(0x03, 0x07),	/* 0x42: MBOX_EXEC_BIOS_IOCB */
4733 	ISPOPMAP(0x00, 0x00),	/* 0x43: */
4734 	ISPOPMAP(0x00, 0x00),	/* 0x44: */
4735 	ISPOPMAP(0x03, 0x03),	/* 0x45: SET SYSTEM PARAMETER */
4736 	ISPOPMAP(0x01, 0x03),	/* 0x46: GET SYSTEM PARAMETER */
4737 	ISPOPMAP(0x00, 0x00),	/* 0x47: */
4738 	ISPOPMAP(0x01, 0xcf),	/* 0x48: GET SCAM CONFIGURATION */
4739 	ISPOPMAP(0xcf, 0xcf),	/* 0x49: SET SCAM CONFIGURATION */
4740 	ISPOPMAP(0x03, 0x03),	/* 0x4a: MBOX_SET_FIRMWARE_FEATURES */
4741 	ISPOPMAP(0x01, 0x03),	/* 0x4b: MBOX_GET_FIRMWARE_FEATURES */
4742 	ISPOPMAP(0x00, 0x00),	/* 0x4c: */
4743 	ISPOPMAP(0x00, 0x00),	/* 0x4d: */
4744 	ISPOPMAP(0x00, 0x00),	/* 0x4e: */
4745 	ISPOPMAP(0x00, 0x00),	/* 0x4f: */
4746 	ISPOPMAP(0xdf, 0xdf),	/* 0x50: LOAD RAM A64 */
4747 	ISPOPMAP(0xdf, 0xdf),	/* 0x51: DUMP RAM A64 */
4748 	ISPOPMAP(0xdf, 0xdf),	/* 0x52: INITIALIZE REQUEST QUEUE A64 */
4749 	ISPOPMAP(0xff, 0xff),	/* 0x53: INITIALIZE RESPONSE QUEUE A64 */
4750 	ISPOPMAP(0xcf, 0x01),	/* 0x54: EXECUTE IOCB A64 */
4751 	ISPOPMAP(0x07, 0x01),	/* 0x55: ENABLE TARGET MODE */
4752 	ISPOPMAP(0x03, 0x0f),	/* 0x56: GET TARGET STATUS */
4753 	ISPOPMAP(0x00, 0x00),	/* 0x57: */
4754 	ISPOPMAP(0x00, 0x00),	/* 0x58: */
4755 	ISPOPMAP(0x00, 0x00),	/* 0x59: */
4756 	ISPOPMAP(0x03, 0x03),	/* 0x5a: SET DATA OVERRUN RECOVERY MODE */
4757 	ISPOPMAP(0x01, 0x03),	/* 0x5b: GET DATA OVERRUN RECOVERY MODE */
4758 	ISPOPMAP(0x0f, 0x0f),	/* 0x5c: SET HOST DATA */
4759 	ISPOPMAP(0x01, 0x01)	/* 0x5d: GET NOST DATA */
4760 };
4761 
4762 #ifndef	ISP_STRIPPED
4763 static char *scsi_mbcmd_names[] = {
4764 	"NO-OP",
4765 	"LOAD RAM",
4766 	"EXEC FIRMWARE",
4767 	"DUMP RAM",
4768 	"WRITE RAM WORD",
4769 	"READ RAM WORD",
4770 	"MAILBOX REG TEST",
4771 	"VERIFY CHECKSUM",
4772 	"ABOUT FIRMWARE",
4773 	NULL,
4774 	NULL,
4775 	NULL,
4776 	NULL,
4777 	NULL,
4778 	"CHECK FIRMWARE",
4779 	NULL,
4780 	"INIT REQUEST QUEUE",
4781 	"INIT RESULT QUEUE",
4782 	"EXECUTE IOCB",
4783 	"WAKE UP",
4784 	"STOP FIRMWARE",
4785 	"ABORT",
4786 	"ABORT DEVICE",
4787 	"ABORT TARGET",
4788 	"BUS RESET",
4789 	"STOP QUEUE",
4790 	"START QUEUE",
4791 	"SINGLE STEP QUEUE",
4792 	"ABORT QUEUE",
4793 	"GET DEV QUEUE STATUS",
4794 	NULL,
4795 	"GET FIRMWARE STATUS",
4796 	"GET INIT SCSI ID",
4797 	"GET SELECT TIMEOUT",
4798 	"GET RETRY COUNT",
4799 	"GET TAG AGE LIMIT",
4800 	"GET CLOCK RATE",
4801 	"GET ACT NEG STATE",
4802 	"GET ASYNC DATA SETUP TIME",
4803 	"GET PCI PARAMS",
4804 	"GET TARGET PARAMS",
4805 	"GET DEV QUEUE PARAMS",
4806 	"GET RESET DELAY PARAMS",
4807 	NULL,
4808 	NULL,
4809 	NULL,
4810 	NULL,
4811 	NULL,
4812 	"SET INIT SCSI ID",
4813 	"SET SELECT TIMEOUT",
4814 	"SET RETRY COUNT",
4815 	"SET TAG AGE LIMIT",
4816 	"SET CLOCK RATE",
4817 	"SET ACT NEG STATE",
4818 	"SET ASYNC DATA SETUP TIME",
4819 	"SET PCI CONTROL PARAMS",
4820 	"SET TARGET PARAMS",
4821 	"SET DEV QUEUE PARAMS",
4822 	"SET RESET DELAY PARAMS",
4823 	NULL,
4824 	NULL,
4825 	NULL,
4826 	NULL,
4827 	NULL,
4828 	"RETURN BIOS BLOCK ADDR",
4829 	"WRITE FOUR RAM WORDS",
4830 	"EXEC BIOS IOCB",
4831 	NULL,
4832 	NULL,
4833 	"SET SYSTEM PARAMETER",
4834 	"GET SYSTEM PARAMETER",
4835 	NULL,
4836 	"GET SCAM CONFIGURATION",
4837 	"SET SCAM CONFIGURATION",
4838 	"SET FIRMWARE FEATURES",
4839 	"GET FIRMWARE FEATURES",
4840 	NULL,
4841 	NULL,
4842 	NULL,
4843 	NULL,
4844 	"LOAD RAM A64",
4845 	"DUMP RAM A64",
4846 	"INITIALIZE REQUEST QUEUE A64",
4847 	"INITIALIZE RESPONSE QUEUE A64",
4848 	"EXECUTE IOCB A64",
4849 	"ENABLE TARGET MODE",
4850 	"GET TARGET MODE STATE",
4851 	NULL,
4852 	NULL,
4853 	NULL,
4854 	"SET DATA OVERRUN RECOVERY MODE",
4855 	"GET DATA OVERRUN RECOVERY MODE",
4856 	"SET HOST DATA",
4857 	"GET NOST DATA",
4858 };
4859 #endif
4860 
4861 static u_int16_t mbpfc[] = {
4862 	ISPOPMAP(0x01, 0x01),	/* 0x00: MBOX_NO_OP */
4863 	ISPOPMAP(0x1f, 0x01),	/* 0x01: MBOX_LOAD_RAM */
4864 	ISPOPMAP(0x03, 0x01),	/* 0x02: MBOX_EXEC_FIRMWARE */
4865 	ISPOPMAP(0xdf, 0x01),	/* 0x03: MBOX_DUMP_RAM */
4866 	ISPOPMAP(0x07, 0x07),	/* 0x04: MBOX_WRITE_RAM_WORD */
4867 	ISPOPMAP(0x03, 0x07),	/* 0x05: MBOX_READ_RAM_WORD */
4868 	ISPOPMAP(0xff, 0xff),	/* 0x06: MBOX_MAILBOX_REG_TEST */
4869 	ISPOPMAP(0x03, 0x05),	/* 0x07: MBOX_VERIFY_CHECKSUM	*/
4870 	ISPOPMAP(0x01, 0x4f),	/* 0x08: MBOX_ABOUT_FIRMWARE */
4871 	ISPOPMAP(0xdf, 0x01),	/* 0x09: LOAD RAM */
4872 	ISPOPMAP(0xdf, 0x01),	/* 0x0a: DUMP RAM */
4873 	ISPOPMAP(0x00, 0x00),	/* 0x0b: */
4874 	ISPOPMAP(0x00, 0x00),	/* 0x0c: */
4875 	ISPOPMAP(0x00, 0x00),	/* 0x0d: */
4876 	ISPOPMAP(0x01, 0x05),	/* 0x0e: MBOX_CHECK_FIRMWARE */
4877 	ISPOPMAP(0x03, 0x07),	/* 0x0f: MBOX_READ_RAM_WORD_EXTENDED(1) */
4878 	ISPOPMAP(0x1f, 0x11),	/* 0x10: MBOX_INIT_REQ_QUEUE */
4879 	ISPOPMAP(0x2f, 0x21),	/* 0x11: MBOX_INIT_RES_QUEUE */
4880 	ISPOPMAP(0x0f, 0x01),	/* 0x12: MBOX_EXECUTE_IOCB */
4881 	ISPOPMAP(0x03, 0x03),	/* 0x13: MBOX_WAKE_UP	*/
4882 	ISPOPMAP(0x01, 0xff),	/* 0x14: MBOX_STOP_FIRMWARE */
4883 	ISPOPMAP(0x4f, 0x01),	/* 0x15: MBOX_ABORT */
4884 	ISPOPMAP(0x07, 0x01),	/* 0x16: MBOX_ABORT_DEVICE */
4885 	ISPOPMAP(0x07, 0x01),	/* 0x17: MBOX_ABORT_TARGET */
4886 	ISPOPMAP(0x03, 0x03),	/* 0x18: MBOX_BUS_RESET */
4887 	ISPOPMAP(0x07, 0x05),	/* 0x19: MBOX_STOP_QUEUE */
4888 	ISPOPMAP(0x07, 0x05),	/* 0x1a: MBOX_START_QUEUE */
4889 	ISPOPMAP(0x07, 0x05),	/* 0x1b: MBOX_SINGLE_STEP_QUEUE */
4890 	ISPOPMAP(0x07, 0x05),	/* 0x1c: MBOX_ABORT_QUEUE */
4891 	ISPOPMAP(0x07, 0x03),	/* 0x1d: MBOX_GET_DEV_QUEUE_STATUS */
4892 	ISPOPMAP(0x00, 0x00),	/* 0x1e: */
4893 	ISPOPMAP(0x01, 0x07),	/* 0x1f: MBOX_GET_FIRMWARE_STATUS */
4894 	ISPOPMAP(0x01, 0x4f),	/* 0x20: MBOX_GET_LOOP_ID */
4895 	ISPOPMAP(0x00, 0x00),	/* 0x21: */
4896 	ISPOPMAP(0x01, 0x07),	/* 0x22: MBOX_GET_RETRY_COUNT	*/
4897 	ISPOPMAP(0x00, 0x00),	/* 0x23: */
4898 	ISPOPMAP(0x00, 0x00),	/* 0x24: */
4899 	ISPOPMAP(0x00, 0x00),	/* 0x25: */
4900 	ISPOPMAP(0x00, 0x00),	/* 0x26: */
4901 	ISPOPMAP(0x00, 0x00),	/* 0x27: */
4902 	ISPOPMAP(0x01, 0x03),	/* 0x28: MBOX_GET_FIRMWARE_OPTIONS */
4903 	ISPOPMAP(0x03, 0x07),	/* 0x29: MBOX_GET_PORT_QUEUE_PARAMS */
4904 	ISPOPMAP(0x00, 0x00),	/* 0x2a: */
4905 	ISPOPMAP(0x00, 0x00),	/* 0x2b: */
4906 	ISPOPMAP(0x00, 0x00),	/* 0x2c: */
4907 	ISPOPMAP(0x00, 0x00),	/* 0x2d: */
4908 	ISPOPMAP(0x00, 0x00),	/* 0x2e: */
4909 	ISPOPMAP(0x00, 0x00),	/* 0x2f: */
4910 	ISPOPMAP(0x00, 0x00),	/* 0x30: */
4911 	ISPOPMAP(0x00, 0x00),	/* 0x31: */
4912 	ISPOPMAP(0x07, 0x07),	/* 0x32: MBOX_SET_RETRY_COUNT	*/
4913 	ISPOPMAP(0x00, 0x00),	/* 0x33: */
4914 	ISPOPMAP(0x00, 0x00),	/* 0x34: */
4915 	ISPOPMAP(0x00, 0x00),	/* 0x35: */
4916 	ISPOPMAP(0x00, 0x00),	/* 0x36: */
4917 	ISPOPMAP(0x00, 0x00),	/* 0x37: */
4918 	ISPOPMAP(0x0f, 0x01),	/* 0x38: MBOX_SET_FIRMWARE_OPTIONS */
4919 	ISPOPMAP(0x0f, 0x07),	/* 0x39: MBOX_SET_PORT_QUEUE_PARAMS */
4920 	ISPOPMAP(0x00, 0x00),	/* 0x3a: */
4921 	ISPOPMAP(0x00, 0x00),	/* 0x3b: */
4922 	ISPOPMAP(0x00, 0x00),	/* 0x3c: */
4923 	ISPOPMAP(0x00, 0x00),	/* 0x3d: */
4924 	ISPOPMAP(0x00, 0x00),	/* 0x3e: */
4925 	ISPOPMAP(0x00, 0x00),	/* 0x3f: */
4926 	ISPOPMAP(0x03, 0x01),	/* 0x40: MBOX_LOOP_PORT_BYPASS */
4927 	ISPOPMAP(0x03, 0x01),	/* 0x41: MBOX_LOOP_PORT_ENABLE */
4928 	ISPOPMAP(0x03, 0x07),	/* 0x42: MBOX_GET_RESOURCE_COUNTS */
4929 	ISPOPMAP(0x01, 0x01),	/* 0x43: MBOX_REQUEST_NON_PARTICIPATING_MODE */
4930 	ISPOPMAP(0x00, 0x00),	/* 0x44: */
4931 	ISPOPMAP(0x00, 0x00),	/* 0x45: */
4932 	ISPOPMAP(0x00, 0x00),	/* 0x46: */
4933 	ISPOPMAP(0xcf, 0x03),	/* 0x47: GET PORT_DATABASE ENHANCED */
4934 	ISPOPMAP(0x00, 0x00),	/* 0x48: */
4935 	ISPOPMAP(0x00, 0x00),	/* 0x49: */
4936 	ISPOPMAP(0x00, 0x00),	/* 0x4a: */
4937 	ISPOPMAP(0x00, 0x00),	/* 0x4b: */
4938 	ISPOPMAP(0x00, 0x00),	/* 0x4c: */
4939 	ISPOPMAP(0x00, 0x00),	/* 0x4d: */
4940 	ISPOPMAP(0x00, 0x00),	/* 0x4e: */
4941 	ISPOPMAP(0x00, 0x00),	/* 0x4f: */
4942 	ISPOPMAP(0x00, 0x00),	/* 0x50: */
4943 	ISPOPMAP(0x00, 0x00),	/* 0x51: */
4944 	ISPOPMAP(0x00, 0x00),	/* 0x52: */
4945 	ISPOPMAP(0x00, 0x00),	/* 0x53: */
4946 	ISPOPMAP(0xcf, 0x01),	/* 0x54: EXECUTE IOCB A64 */
4947 	ISPOPMAP(0x00, 0x00),	/* 0x55: */
4948 	ISPOPMAP(0x00, 0x00),	/* 0x56: */
4949 	ISPOPMAP(0x00, 0x00),	/* 0x57: */
4950 	ISPOPMAP(0x00, 0x00),	/* 0x58: */
4951 	ISPOPMAP(0x00, 0x00),	/* 0x59: */
4952 	ISPOPMAP(0x00, 0x00),	/* 0x5a: */
4953 	ISPOPMAP(0x03, 0x01),	/* 0x5b: MBOX_DRIVER_HEARTBEAT */
4954 	ISPOPMAP(0xcf, 0x01),	/* 0x5c: MBOX_FW_HEARTBEAT */
4955 	ISPOPMAP(0x07, 0x03),	/* 0x5d: MBOX_GET_SET_DATA_RATE */
4956 	ISPOPMAP(0x00, 0x00),	/* 0x5e: */
4957 	ISPOPMAP(0x00, 0x00),	/* 0x5f: */
4958 	ISPOPMAP(0xfd, 0x31),	/* 0x60: MBOX_INIT_FIRMWARE */
4959 	ISPOPMAP(0x00, 0x00),	/* 0x61: */
4960 	ISPOPMAP(0x01, 0x01),	/* 0x62: MBOX_INIT_LIP */
4961 	ISPOPMAP(0xcd, 0x03),	/* 0x63: MBOX_GET_FC_AL_POSITION_MAP */
4962 	ISPOPMAP(0xcf, 0x01),	/* 0x64: MBOX_GET_PORT_DB */
4963 	ISPOPMAP(0x07, 0x01),	/* 0x65: MBOX_CLEAR_ACA */
4964 	ISPOPMAP(0x07, 0x01),	/* 0x66: MBOX_TARGET_RESET */
4965 	ISPOPMAP(0x07, 0x01),	/* 0x67: MBOX_CLEAR_TASK_SET */
4966 	ISPOPMAP(0x07, 0x01),	/* 0x68: MBOX_ABORT_TASK_SET */
4967 	ISPOPMAP(0x01, 0x07),	/* 0x69: MBOX_GET_FW_STATE */
4968 	ISPOPMAP(0x03, 0xcf),	/* 0x6a: MBOX_GET_PORT_NAME */
4969 	ISPOPMAP(0xcf, 0x01),	/* 0x6b: MBOX_GET_LINK_STATUS */
4970 	ISPOPMAP(0x0f, 0x01),	/* 0x6c: MBOX_INIT_LIP_RESET */
4971 	ISPOPMAP(0x00, 0x00),	/* 0x6d: */
4972 	ISPOPMAP(0xcf, 0x03),	/* 0x6e: MBOX_SEND_SNS */
4973 	ISPOPMAP(0x0f, 0x07),	/* 0x6f: MBOX_FABRIC_LOGIN */
4974 	ISPOPMAP(0x03, 0x01),	/* 0x70: MBOX_SEND_CHANGE_REQUEST */
4975 	ISPOPMAP(0x03, 0x03),	/* 0x71: MBOX_FABRIC_LOGOUT */
4976 	ISPOPMAP(0x0f, 0x0f),	/* 0x72: MBOX_INIT_LIP_LOGIN */
4977 	ISPOPMAP(0x00, 0x00),	/* 0x73: */
4978 	ISPOPMAP(0x07, 0x01),	/* 0x74: LOGIN LOOP PORT */
4979 	ISPOPMAP(0xcf, 0x03),	/* 0x75: GET PORT/NODE NAME LIST */
4980 	ISPOPMAP(0x4f, 0x01),	/* 0x76: SET VENDOR ID */
4981 	ISPOPMAP(0xcd, 0x01),	/* 0x77: INITIALIZE IP MAILBOX */
4982 	ISPOPMAP(0x00, 0x00),	/* 0x78: */
4983 	ISPOPMAP(0x00, 0x00),	/* 0x79: */
4984 	ISPOPMAP(0x00, 0x00),	/* 0x7a: */
4985 	ISPOPMAP(0x00, 0x00),	/* 0x7b: */
4986 	ISPOPMAP(0x4f, 0x03),	/* 0x7c: Get ID List */
4987 	ISPOPMAP(0xcf, 0x01),	/* 0x7d: SEND LFA */
4988 	ISPOPMAP(0x07, 0x01)	/* 0x7e: Lun RESET */
4989 };
4990 /*
4991  * Footnotes
4992  *
4993  * (1): this sets bits 21..16 in mailbox register #8, which we nominally
4994  *	do not access at this time in the core driver. The caller is
4995  *	responsible for setting this register first (Gross!).
4996  */
4997 
4998 #ifndef	ISP_STRIPPED
4999 static char *fc_mbcmd_names[] = {
5000 	"NO-OP",
5001 	"LOAD RAM",
5002 	"EXEC FIRMWARE",
5003 	"DUMP RAM",
5004 	"WRITE RAM WORD",
5005 	"READ RAM WORD",
5006 	"MAILBOX REG TEST",
5007 	"VERIFY CHECKSUM",
5008 	"ABOUT FIRMWARE",
5009 	"LOAD RAM",
5010 	"DUMP RAM",
5011 	NULL,
5012 	NULL,
5013 	"READ RAM WORD EXTENDED",
5014 	"CHECK FIRMWARE",
5015 	NULL,
5016 	"INIT REQUEST QUEUE",
5017 	"INIT RESULT QUEUE",
5018 	"EXECUTE IOCB",
5019 	"WAKE UP",
5020 	"STOP FIRMWARE",
5021 	"ABORT",
5022 	"ABORT DEVICE",
5023 	"ABORT TARGET",
5024 	"BUS RESET",
5025 	"STOP QUEUE",
5026 	"START QUEUE",
5027 	"SINGLE STEP QUEUE",
5028 	"ABORT QUEUE",
5029 	"GET DEV QUEUE STATUS",
5030 	NULL,
5031 	"GET FIRMWARE STATUS",
5032 	"GET LOOP ID",
5033 	NULL,
5034 	"GET RETRY COUNT",
5035 	NULL,
5036 	NULL,
5037 	NULL,
5038 	NULL,
5039 	NULL,
5040 	"GET FIRMWARE OPTIONS",
5041 	"GET PORT QUEUE PARAMS",
5042 	NULL,
5043 	NULL,
5044 	NULL,
5045 	NULL,
5046 	NULL,
5047 	NULL,
5048 	NULL,
5049 	NULL,
5050 	"SET RETRY COUNT",
5051 	NULL,
5052 	NULL,
5053 	NULL,
5054 	NULL,
5055 	NULL,
5056 	"SET FIRMWARE OPTIONS",
5057 	"SET PORT QUEUE PARAMS",
5058 	NULL,
5059 	NULL,
5060 	NULL,
5061 	NULL,
5062 	NULL,
5063 	NULL,
5064 	"LOOP PORT BYPASS",
5065 	"LOOP PORT ENABLE",
5066 	"GET RESOURCE COUNTS",
5067 	"REQUEST NON PARTICIPATING MODE",
5068 	NULL,
5069 	NULL,
5070 	NULL,
5071 	"GET PORT DATABASE,, ENHANCED",
5072 	NULL,
5073 	NULL,
5074 	NULL,
5075 	NULL,
5076 	NULL,
5077 	NULL,
5078 	NULL,
5079 	NULL,
5080 	NULL,
5081 	NULL,
5082 	NULL,
5083 	NULL,
5084 	"EXECUTE IOCB A64",
5085 	NULL,
5086 	NULL,
5087 	NULL,
5088 	NULL,
5089 	NULL,
5090 	NULL,
5091 	NULL,
5092 	NULL,
5093 	"GET/SET DATA RATE",
5094 	NULL,
5095 	NULL,
5096 	"INIT FIRMWARE",
5097 	NULL,
5098 	"INIT LIP",
5099 	"GET FC-AL POSITION MAP",
5100 	"GET PORT DATABASE",
5101 	"CLEAR ACA",
5102 	"TARGET RESET",
5103 	"CLEAR TASK SET",
5104 	"ABORT TASK SET",
5105 	"GET FW STATE",
5106 	"GET PORT NAME",
5107 	"GET LINK STATUS",
5108 	"INIT LIP RESET",
5109 	NULL,
5110 	"SEND SNS",
5111 	"FABRIC LOGIN",
5112 	"SEND CHANGE REQUEST",
5113 	"FABRIC LOGOUT",
5114 	"INIT LIP LOGIN",
5115 	NULL,
5116 	"LOGIN LOOP PORT",
5117 	"GET PORT/NODE NAME LIST",
5118 	"SET VENDOR ID",
5119 	"INITIALIZE IP MAILBOX",
5120 	NULL,
5121 	NULL,
5122 	NULL,
5123 	NULL,
5124 	"Get ID List",
5125 	"SEND LFA",
5126 	"Lun RESET"
5127 };
5128 #endif
5129 
5130 static void
5131 isp_mboxcmd_qnw(struct ispsoftc *isp, mbreg_t *mbp, int nodelay)
5132 {
5133 	unsigned int lim, ibits, obits, box, opcode;
5134 	u_int16_t *mcp;
5135 
5136 	if (IS_FC(isp)) {
5137 		mcp = mbpfc;
5138 		lim = (sizeof (mbpfc) / sizeof (mbpfc[0]));
5139 	} else {
5140 		mcp = mbpscsi;
5141 		lim = (sizeof (mbpscsi) / sizeof (mbpscsi[0]));
5142 	}
5143 	opcode = mbp->param[0];
5144 	ibits = HIBYT(mcp[opcode]) & NMBOX_BMASK(isp);
5145 	obits = LOBYT(mcp[opcode]) & NMBOX_BMASK(isp);
5146 	for (box = 0; box < MAX_MAILBOX; box++) {
5147 		if (ibits & (1 << box)) {
5148 			ISP_WRITE(isp, MBOX_OFF(box), mbp->param[box]);
5149 		}
5150 		if (nodelay == 0) {
5151 			isp->isp_mboxtmp[box] = mbp->param[box] = 0;
5152 		}
5153 	}
5154 	if (nodelay == 0) {
5155 		isp->isp_lastmbxcmd = opcode;
5156 		isp->isp_obits = obits;
5157 		isp->isp_mboxbsy = 1;
5158 	}
5159 	ISP_WRITE(isp, HCCR, HCCR_CMD_SET_HOST_INT);
5160 	/*
5161 	 * Oddly enough, if we're not delaying for an answer,
5162 	 * delay a bit to give the f/w a chance to pick up the
5163 	 * command.
5164 	 */
5165 	if (nodelay) {
5166 		USEC_DELAY(1000);
5167 	}
5168 }
5169 
5170 static void
5171 isp_mboxcmd(struct ispsoftc *isp, mbreg_t *mbp, int logmask)
5172 {
5173 	char *cname, *xname, tname[16], mname[16];
5174 	unsigned int lim, ibits, obits, box, opcode;
5175 	u_int16_t *mcp;
5176 
5177 	if (IS_FC(isp)) {
5178 		mcp = mbpfc;
5179 		lim = (sizeof (mbpfc) / sizeof (mbpfc[0]));
5180 	} else {
5181 		mcp = mbpscsi;
5182 		lim = (sizeof (mbpscsi) / sizeof (mbpscsi[0]));
5183 	}
5184 
5185 	if ((opcode = mbp->param[0]) >= lim) {
5186 		mbp->param[0] = MBOX_INVALID_COMMAND;
5187 		isp_prt(isp, ISP_LOGERR, "Unknown Command 0x%x", opcode);
5188 		return;
5189 	}
5190 
5191 	ibits = HIBYT(mcp[opcode]) & NMBOX_BMASK(isp);
5192 	obits = LOBYT(mcp[opcode]) & NMBOX_BMASK(isp);
5193 
5194 	if (ibits == 0 && obits == 0) {
5195 		mbp->param[0] = MBOX_COMMAND_PARAM_ERROR;
5196 		isp_prt(isp, ISP_LOGERR, "no parameters for 0x%x", opcode);
5197 		return;
5198 	}
5199 
5200 	/*
5201 	 * Get exclusive usage of mailbox registers.
5202 	 */
5203 	MBOX_ACQUIRE(isp);
5204 
5205 	for (box = 0; box < MAX_MAILBOX; box++) {
5206 		if (ibits & (1 << box)) {
5207 			ISP_WRITE(isp, MBOX_OFF(box), mbp->param[box]);
5208 		}
5209 		isp->isp_mboxtmp[box] = mbp->param[box] = 0;
5210 	}
5211 
5212 	isp->isp_lastmbxcmd = opcode;
5213 
5214 	/*
5215 	 * We assume that we can't overwrite a previous command.
5216 	 */
5217 	isp->isp_obits = obits;
5218 	isp->isp_mboxbsy = 1;
5219 
5220 	/*
5221 	 * Set Host Interrupt condition so that RISC will pick up mailbox regs.
5222 	 */
5223 	ISP_WRITE(isp, HCCR, HCCR_CMD_SET_HOST_INT);
5224 
5225 	/*
5226 	 * While we haven't finished the command, spin our wheels here.
5227 	 */
5228 	MBOX_WAIT_COMPLETE(isp);
5229 
5230 	if (isp->isp_mboxbsy) {
5231 		/*
5232 		 * Command timed out.
5233 		 */
5234 		isp->isp_mboxbsy = 0;
5235 		MBOX_RELEASE(isp);
5236 		return;
5237 	}
5238 
5239 	/*
5240 	 * Copy back output registers.
5241 	 */
5242 	for (box = 0; box < MAX_MAILBOX; box++) {
5243 		if (obits & (1 << box)) {
5244 			mbp->param[box] = isp->isp_mboxtmp[box];
5245 		}
5246 	}
5247 
5248 	MBOX_RELEASE(isp);
5249 
5250 	if (logmask == 0 || opcode == MBOX_EXEC_FIRMWARE) {
5251 		return;
5252 	}
5253 #ifdef	ISP_STRIPPED
5254 	cname = NULL;
5255 #else
5256 	cname = (IS_FC(isp))? fc_mbcmd_names[opcode] : scsi_mbcmd_names[opcode];
5257 #endif
5258 	if (cname == NULL) {
5259 		cname = tname;
5260 		SNPRINTF(tname, sizeof tname, "opcode %x", opcode);
5261 	}
5262 
5263 	/*
5264 	 * Just to be chatty here...
5265 	 */
5266 	xname = NULL;
5267 	switch (mbp->param[0]) {
5268 	case MBOX_COMMAND_COMPLETE:
5269 		break;
5270 	case MBOX_INVALID_COMMAND:
5271 		if (logmask & MBLOGMASK(MBOX_COMMAND_COMPLETE))
5272 			xname = "INVALID COMMAND";
5273 		break;
5274 	case MBOX_HOST_INTERFACE_ERROR:
5275 		if (logmask & MBLOGMASK(MBOX_HOST_INTERFACE_ERROR))
5276 			xname = "HOST INTERFACE ERROR";
5277 		break;
5278 	case MBOX_TEST_FAILED:
5279 		if (logmask & MBLOGMASK(MBOX_TEST_FAILED))
5280 			xname = "TEST FAILED";
5281 		break;
5282 	case MBOX_COMMAND_ERROR:
5283 		if (logmask & MBLOGMASK(MBOX_COMMAND_ERROR))
5284 			xname = "COMMAND ERROR";
5285 		break;
5286 	case MBOX_COMMAND_PARAM_ERROR:
5287 		if (logmask & MBLOGMASK(MBOX_COMMAND_PARAM_ERROR))
5288 			xname = "COMMAND PARAMETER ERROR";
5289 		break;
5290 	case MBOX_LOOP_ID_USED:
5291 		if (logmask & MBLOGMASK(MBOX_LOOP_ID_USED))
5292 			xname = "LOOP ID ALREADY IN USE";
5293 		break;
5294 	case MBOX_PORT_ID_USED:
5295 		if (logmask & MBLOGMASK(MBOX_PORT_ID_USED))
5296 			xname = "PORT ID ALREADY IN USE";
5297 		break;
5298 	case MBOX_ALL_IDS_USED:
5299 		if (logmask & MBLOGMASK(MBOX_ALL_IDS_USED))
5300 			xname = "ALL LOOP IDS IN USE";
5301 		break;
5302 	case 0:		/* special case */
5303 		xname = "TIMEOUT";
5304 		break;
5305 	default:
5306 		SNPRINTF(mname, sizeof mname, "error 0x%x", mbp->param[0]);
5307 		xname = mname;
5308 		break;
5309 	}
5310 	if (xname)
5311 		isp_prt(isp, ISP_LOGALL, "Mailbox Command '%s' failed (%s)",
5312 		    cname, xname);
5313 }
5314 
5315 static void
5316 isp_fw_state(struct ispsoftc *isp)
5317 {
5318 	if (IS_FC(isp)) {
5319 		mbreg_t mbs;
5320 		fcparam *fcp = isp->isp_param;
5321 
5322 		mbs.param[0] = MBOX_GET_FW_STATE;
5323 		isp_mboxcmd(isp, &mbs, MBLOGALL);
5324 		if (mbs.param[0] == MBOX_COMMAND_COMPLETE) {
5325 			fcp->isp_fwstate = mbs.param[1];
5326 		}
5327 	}
5328 }
5329 
5330 static void
5331 isp_update(struct ispsoftc *isp)
5332 {
5333 	int bus, upmask;
5334 
5335 	for (bus = 0, upmask = isp->isp_update; upmask != 0; bus++) {
5336 		if (upmask & (1 << bus)) {
5337 			isp_update_bus(isp, bus);
5338 		}
5339 		upmask &= ~(1 << bus);
5340 	}
5341 }
5342 
5343 static void
5344 isp_update_bus(struct ispsoftc *isp, int bus)
5345 {
5346 	int tgt;
5347 	mbreg_t mbs;
5348 	sdparam *sdp;
5349 
5350 	isp->isp_update &= ~(1 << bus);
5351 	if (IS_FC(isp)) {
5352 		/*
5353 		 * There are no 'per-bus' settings for Fibre Channel.
5354 		 */
5355 		return;
5356 	}
5357 	sdp = isp->isp_param;
5358 	sdp += bus;
5359 
5360 	for (tgt = 0; tgt < MAX_TARGETS; tgt++) {
5361 		u_int16_t flags, period, offset;
5362 		int get;
5363 
5364 		if (sdp->isp_devparam[tgt].dev_enable == 0) {
5365 			sdp->isp_devparam[tgt].dev_update = 0;
5366 			sdp->isp_devparam[tgt].dev_refresh = 0;
5367 			isp_prt(isp, ISP_LOGDEBUG0,
5368 	 		    "skipping target %d bus %d update", tgt, bus);
5369 			continue;
5370 		}
5371 		/*
5372 		 * If the goal is to update the status of the device,
5373 		 * take what's in goal_flags and try and set the device
5374 		 * toward that. Otherwise, if we're just refreshing the
5375 		 * current device state, get the current parameters.
5376 		 */
5377 
5378 		/*
5379 		 * Refresh overrides set
5380 		 */
5381 		if (sdp->isp_devparam[tgt].dev_refresh) {
5382 			mbs.param[0] = MBOX_GET_TARGET_PARAMS;
5383 			sdp->isp_devparam[tgt].dev_refresh = 0;
5384 			get = 1;
5385 		} else if (sdp->isp_devparam[tgt].dev_update) {
5386 			mbs.param[0] = MBOX_SET_TARGET_PARAMS;
5387 			/*
5388 			 * Make sure goal_flags has "Renegotiate on Error"
5389 			 * on and "Freeze Queue on Error" off.
5390 			 */
5391 			sdp->isp_devparam[tgt].goal_flags |= DPARM_RENEG;
5392 			sdp->isp_devparam[tgt].goal_flags &= ~DPARM_QFRZ;
5393 
5394 			mbs.param[2] = sdp->isp_devparam[tgt].goal_flags;
5395 
5396 			/*
5397 			 * Insist that PARITY must be enabled
5398 			 * if SYNC or WIDE is enabled.
5399 			 */
5400 			if ((mbs.param[2] & (DPARM_SYNC|DPARM_WIDE)) != 0) {
5401 				mbs.param[2] |= DPARM_PARITY;
5402 			}
5403 
5404 			if ((mbs.param[2] & DPARM_SYNC) == 0) {
5405 				mbs.param[3] = 0;
5406 			} else {
5407 				mbs.param[3] =
5408 				    (sdp->isp_devparam[tgt].goal_offset << 8) |
5409 				    (sdp->isp_devparam[tgt].goal_period);
5410 			}
5411 			/*
5412 			 * A command completion later that has
5413 			 * RQSTF_NEGOTIATION set can cause
5414 			 * the dev_refresh/announce cycle also.
5415 			 *
5416 			 * Note: It is really important to update our current
5417 			 * flags with at least the state of TAG capabilities-
5418 			 * otherwise we might try and send a tagged command
5419 			 * when we have it all turned off. So change it here
5420 			 * to say that current already matches goal.
5421 			 */
5422 			sdp->isp_devparam[tgt].actv_flags &= ~DPARM_TQING;
5423 			sdp->isp_devparam[tgt].actv_flags |=
5424 			    (sdp->isp_devparam[tgt].goal_flags & DPARM_TQING);
5425 			isp_prt(isp, ISP_LOGDEBUG0,
5426 			    "bus %d set tgt %d flags 0x%x off 0x%x period 0x%x",
5427 			    bus, tgt, mbs.param[2], mbs.param[3] >> 8,
5428 			    mbs.param[3] & 0xff);
5429 			sdp->isp_devparam[tgt].dev_update = 0;
5430 			sdp->isp_devparam[tgt].dev_refresh = 1;
5431 			get = 0;
5432 		} else {
5433 			continue;
5434 		}
5435 		mbs.param[1] = (bus << 15) | (tgt << 8);
5436 		isp_mboxcmd(isp, &mbs, MBLOGALL);
5437 		if (get == 0) {
5438 			isp->isp_sendmarker |= (1 << bus);
5439 			continue;
5440 		}
5441 		flags = mbs.param[2];
5442 		period = mbs.param[3] & 0xff;
5443 		offset = mbs.param[3] >> 8;
5444 		sdp->isp_devparam[tgt].actv_flags = flags;
5445 		sdp->isp_devparam[tgt].actv_period = period;
5446 		sdp->isp_devparam[tgt].actv_offset = offset;
5447 		get = (bus << 16) | tgt;
5448 		(void) isp_async(isp, ISPASYNC_NEW_TGT_PARAMS, &get);
5449 	}
5450 
5451 	for (tgt = 0; tgt < MAX_TARGETS; tgt++) {
5452 		if (sdp->isp_devparam[tgt].dev_update ||
5453 		    sdp->isp_devparam[tgt].dev_refresh) {
5454 			isp->isp_update |= (1 << bus);
5455 			break;
5456 		}
5457 	}
5458 }
5459 
5460 static void
5461 isp_setdfltparm(struct ispsoftc *isp, int channel)
5462 {
5463 	int tgt;
5464 	mbreg_t mbs;
5465 	sdparam *sdp;
5466 
5467 	if (IS_FC(isp)) {
5468 		fcparam *fcp = (fcparam *) isp->isp_param;
5469 		int nvfail;
5470 
5471 		fcp += channel;
5472 		if (fcp->isp_gotdparms) {
5473 			return;
5474 		}
5475 		fcp->isp_gotdparms = 1;
5476 		fcp->isp_maxfrmlen = ICB_DFLT_FRMLEN;
5477 		fcp->isp_maxalloc = ICB_DFLT_ALLOC;
5478 		fcp->isp_execthrottle = ISP_EXEC_THROTTLE;
5479 		fcp->isp_retry_delay = ICB_DFLT_RDELAY;
5480 		fcp->isp_retry_count = ICB_DFLT_RCOUNT;
5481 		/* Platform specific.... */
5482 		fcp->isp_loopid = DEFAULT_LOOPID(isp);
5483 		fcp->isp_nodewwn = DEFAULT_NODEWWN(isp);
5484 		fcp->isp_portwwn = DEFAULT_PORTWWN(isp);
5485 		fcp->isp_fwoptions = 0;
5486 		fcp->isp_fwoptions |= ICBOPT_FAIRNESS;
5487 		fcp->isp_fwoptions |= ICBOPT_PDBCHANGE_AE;
5488 		fcp->isp_fwoptions |= ICBOPT_HARD_ADDRESS;
5489 #ifndef	ISP_NO_FASTPOST_FC
5490 		fcp->isp_fwoptions |= ICBOPT_FAST_POST;
5491 #endif
5492 		if (isp->isp_confopts & ISP_CFG_FULL_DUPLEX)
5493 			fcp->isp_fwoptions |= ICBOPT_FULL_DUPLEX;
5494 
5495 		/*
5496 		 * Make sure this is turned off now until we get
5497 		 * extended options from NVRAM
5498 		 */
5499 		fcp->isp_fwoptions &= ~ICBOPT_EXTENDED;
5500 
5501 		/*
5502 		 * Now try and read NVRAM unless told to not do so.
5503 		 * This will set fcparam's isp_nodewwn && isp_portwwn.
5504 		 */
5505 		if ((isp->isp_confopts & ISP_CFG_NONVRAM) == 0) {
5506 		    	nvfail = isp_read_nvram(isp);
5507 			if (nvfail)
5508 				isp->isp_confopts |= ISP_CFG_NONVRAM;
5509 		} else {
5510 			nvfail = 1;
5511 		}
5512 		/*
5513 		 * Set node && port to override platform set defaults
5514 		 * unless the nvram read failed (or none was done),
5515 		 * or the platform code wants to use what had been
5516 		 * set in the defaults.
5517 		 */
5518 		if (nvfail) {
5519 			isp->isp_confopts |= ISP_CFG_OWNWWPN|ISP_CFG_OWNWWNN;
5520 		}
5521 		if (isp->isp_confopts & ISP_CFG_OWNWWNN) {
5522 			isp_prt(isp, ISP_LOGCONFIG, "Using Node WWN 0x%08x%08x",
5523 			    (u_int32_t) (DEFAULT_NODEWWN(isp) >> 32),
5524 			    (u_int32_t) (DEFAULT_NODEWWN(isp) & 0xffffffff));
5525 			ISP_NODEWWN(isp) = DEFAULT_NODEWWN(isp);
5526 		} else {
5527 			/*
5528 			 * We always start out with values derived
5529 			 * from NVRAM or our platform default.
5530 			 */
5531 			ISP_NODEWWN(isp) = fcp->isp_nodewwn;
5532 		}
5533 		if (isp->isp_confopts & ISP_CFG_OWNWWPN) {
5534 			isp_prt(isp, ISP_LOGCONFIG, "Using Port WWN 0x%08x%08x",
5535 			    (u_int32_t) (DEFAULT_PORTWWN(isp) >> 32),
5536 			    (u_int32_t) (DEFAULT_PORTWWN(isp) & 0xffffffff));
5537 			ISP_PORTWWN(isp) = DEFAULT_PORTWWN(isp);
5538 		} else {
5539 			/*
5540 			 * We always start out with values derived
5541 			 * from NVRAM or our platform default.
5542 			 */
5543 			ISP_PORTWWN(isp) = fcp->isp_portwwn;
5544 		}
5545 		return;
5546 	}
5547 
5548 	sdp = (sdparam *) isp->isp_param;
5549 	sdp += channel;
5550 
5551 	/*
5552 	 * Been there, done that, got the T-shirt...
5553 	 */
5554 	if (sdp->isp_gotdparms) {
5555 		return;
5556 	}
5557 	sdp->isp_gotdparms = 1;
5558 
5559 	/*
5560 	 * Establish some default parameters.
5561 	 */
5562 	sdp->isp_cmd_dma_burst_enable = 0;
5563 	sdp->isp_data_dma_burst_enabl = 1;
5564 	sdp->isp_fifo_threshold = 0;
5565 	sdp->isp_initiator_id = DEFAULT_IID(isp);
5566 	if (isp->isp_type >= ISP_HA_SCSI_1040) {
5567 		sdp->isp_async_data_setup = 9;
5568 	} else {
5569 		sdp->isp_async_data_setup = 6;
5570 	}
5571 	sdp->isp_selection_timeout = 250;
5572 	sdp->isp_max_queue_depth = MAXISPREQUEST(isp);
5573 	sdp->isp_tag_aging = 8;
5574 	sdp->isp_bus_reset_delay = 5;
5575 	/*
5576 	 * Don't retry selection, busy or queue full automatically- reflect
5577 	 * these back to us.
5578 	 */
5579 	sdp->isp_retry_count = 0;
5580 	sdp->isp_retry_delay = 0;
5581 
5582 	for (tgt = 0; tgt < MAX_TARGETS; tgt++) {
5583 		sdp->isp_devparam[tgt].exc_throttle = ISP_EXEC_THROTTLE;
5584 		sdp->isp_devparam[tgt].dev_enable = 1;
5585 	}
5586 
5587 	/*
5588 	 * If we've not been told to avoid reading NVRAM, try and read it.
5589 	 * If we're successful reading it, we can then return because NVRAM
5590 	 * will tell us what the desired settings are. Otherwise, we establish
5591 	 * some reasonable 'fake' nvram and goal defaults.
5592 	 */
5593 
5594 	if ((isp->isp_confopts & ISP_CFG_NONVRAM) == 0) {
5595 		if (isp_read_nvram(isp) == 0) {
5596 			return;
5597 		}
5598 	}
5599 
5600 	/*
5601 	 * Now try and see whether we have specific values for them.
5602 	 */
5603 	if ((isp->isp_confopts & ISP_CFG_NONVRAM) == 0) {
5604 		mbs.param[0] = MBOX_GET_ACT_NEG_STATE;
5605 		isp_mboxcmd(isp, &mbs, MBLOGNONE);
5606 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
5607 			sdp->isp_req_ack_active_neg = 1;
5608 			sdp->isp_data_line_active_neg = 1;
5609 		} else {
5610 			sdp->isp_req_ack_active_neg =
5611 			    (mbs.param[1+channel] >> 4) & 0x1;
5612 			sdp->isp_data_line_active_neg =
5613 			    (mbs.param[1+channel] >> 5) & 0x1;
5614 		}
5615 	}
5616 
5617 	isp_prt(isp, ISP_LOGDEBUG0, sc0, sc3,
5618 	    0, sdp->isp_fifo_threshold, sdp->isp_initiator_id,
5619 	    sdp->isp_bus_reset_delay, sdp->isp_retry_count,
5620 	    sdp->isp_retry_delay, sdp->isp_async_data_setup);
5621 	isp_prt(isp, ISP_LOGDEBUG0, sc1, sc3,
5622 	    sdp->isp_req_ack_active_neg, sdp->isp_data_line_active_neg,
5623 	    sdp->isp_data_dma_burst_enabl, sdp->isp_cmd_dma_burst_enable,
5624 	    sdp->isp_selection_timeout, sdp->isp_max_queue_depth);
5625 
5626 	/*
5627 	 * The trick here is to establish a default for the default (honk!)
5628 	 * state (goal_flags). Then try and get the current status from
5629 	 * the card to fill in the current state. We don't, in fact, set
5630 	 * the default to the SAFE default state- that's not the goal state.
5631 	 */
5632 	for (tgt = 0; tgt < MAX_TARGETS; tgt++) {
5633 		u_int8_t off, per;
5634 		sdp->isp_devparam[tgt].actv_offset = 0;
5635 		sdp->isp_devparam[tgt].actv_period = 0;
5636 		sdp->isp_devparam[tgt].actv_flags = 0;
5637 
5638 		sdp->isp_devparam[tgt].goal_flags =
5639 		    sdp->isp_devparam[tgt].nvrm_flags = DPARM_DEFAULT;
5640 
5641 		/*
5642 		 * We default to Wide/Fast for versions less than a 1040
5643 		 * (unless it's SBus).
5644 		 */
5645 		if (IS_ULTRA3(isp)) {
5646 			off = ISP_80M_SYNCPARMS >> 8;
5647 			per = ISP_80M_SYNCPARMS & 0xff;
5648 		} else if (IS_ULTRA2(isp)) {
5649 			off = ISP_40M_SYNCPARMS >> 8;
5650 			per = ISP_40M_SYNCPARMS & 0xff;
5651 		} else if (IS_1240(isp)) {
5652 			off = ISP_20M_SYNCPARMS >> 8;
5653 			per = ISP_20M_SYNCPARMS & 0xff;
5654 		} else if ((isp->isp_bustype == ISP_BT_SBUS &&
5655 		    isp->isp_type < ISP_HA_SCSI_1020A) ||
5656 		    (isp->isp_bustype == ISP_BT_PCI &&
5657 		    isp->isp_type < ISP_HA_SCSI_1040) ||
5658 		    (isp->isp_clock && isp->isp_clock < 60) ||
5659 		    (sdp->isp_ultramode == 0)) {
5660 			off = ISP_10M_SYNCPARMS >> 8;
5661 			per = ISP_10M_SYNCPARMS & 0xff;
5662 		} else {
5663 			off = ISP_20M_SYNCPARMS_1040 >> 8;
5664 			per = ISP_20M_SYNCPARMS_1040 & 0xff;
5665 		}
5666 		sdp->isp_devparam[tgt].goal_offset =
5667 		    sdp->isp_devparam[tgt].nvrm_offset = off;
5668 		sdp->isp_devparam[tgt].goal_period =
5669 		    sdp->isp_devparam[tgt].nvrm_period = per;
5670 
5671 		isp_prt(isp, ISP_LOGDEBUG0, sc2, sc3,
5672 		    channel, tgt, sdp->isp_devparam[tgt].nvrm_flags,
5673 		    sdp->isp_devparam[tgt].nvrm_offset,
5674 		    sdp->isp_devparam[tgt].nvrm_period);
5675 	}
5676 }
5677 
5678 /*
5679  * Re-initialize the ISP and complete all orphaned commands
5680  * with a 'botched' notice. The reset/init routines should
5681  * not disturb an already active list of commands.
5682  *
5683  * Locks held prior to coming here.
5684  */
5685 
5686 void
5687 isp_reinit(struct ispsoftc *isp)
5688 {
5689 	XS_T *xs;
5690 	u_int16_t handle;
5691 
5692 	isp_reset(isp);
5693 	if (isp->isp_state != ISP_RESETSTATE) {
5694 		isp_prt(isp, ISP_LOGERR, "isp_reinit cannot reset card");
5695 		goto skip;
5696 	}
5697 	isp_init(isp);
5698 	if (isp->isp_role == ISP_ROLE_NONE) {
5699 		goto skip;
5700 	}
5701 	if (isp->isp_state == ISP_INITSTATE) {
5702 		isp->isp_state = ISP_RUNSTATE;
5703 	}
5704 	if (isp->isp_state != ISP_RUNSTATE) {
5705 		isp_prt(isp, ISP_LOGERR, "isp_reinit cannot restart card");
5706 	}
5707 skip:
5708 	isp->isp_nactive = 0;
5709 
5710 	for (handle = 1; (int) handle <= isp->isp_maxcmds; handle++) {
5711 		xs = isp_find_xs(isp, handle);
5712 		if (xs == NULL) {
5713 			continue;
5714 		}
5715 		isp_destroy_handle(isp, handle);
5716 		if (XS_XFRLEN(xs)) {
5717 			ISP_DMAFREE(isp, xs, handle);
5718 			XS_RESID(xs) = XS_XFRLEN(xs);
5719 		} else {
5720 			XS_RESID(xs) = 0;
5721 		}
5722 		XS_SETERR(xs, HBA_BUSRESET);
5723 		isp_done(xs);
5724 	}
5725 }
5726 
5727 /*
5728  * NVRAM Routines
5729  */
5730 static int
5731 isp_read_nvram(struct ispsoftc *isp)
5732 {
5733 	int i, amt;
5734 	u_int8_t csum, minversion;
5735 	union {
5736 		u_int8_t _x[ISP2100_NVRAM_SIZE];
5737 		u_int16_t _s[ISP2100_NVRAM_SIZE>>1];
5738 	} _n;
5739 #define	nvram_data	_n._x
5740 #define	nvram_words	_n._s
5741 
5742 	if (IS_FC(isp)) {
5743 		amt = ISP2100_NVRAM_SIZE;
5744 		minversion = 1;
5745 	} else if (IS_ULTRA2(isp)) {
5746 		amt = ISP1080_NVRAM_SIZE;
5747 		minversion = 0;
5748 	} else {
5749 		amt = ISP_NVRAM_SIZE;
5750 		minversion = 2;
5751 	}
5752 
5753 	/*
5754 	 * Just read the first two words first to see if we have a valid
5755 	 * NVRAM to continue reading the rest with.
5756 	 */
5757 	for (i = 0; i < 2; i++) {
5758 		isp_rdnvram_word(isp, i, &nvram_words[i]);
5759 	}
5760 	if (nvram_data[0] != 'I' || nvram_data[1] != 'S' ||
5761 	    nvram_data[2] != 'P') {
5762 		if (isp->isp_bustype != ISP_BT_SBUS) {
5763 			isp_prt(isp, ISP_LOGWARN, "invalid NVRAM header");
5764 			isp_prt(isp, ISP_LOGDEBUG0, "%x %x %x",
5765 			    nvram_data[0], nvram_data[1], nvram_data[2]);
5766 		}
5767 		return (-1);
5768 	}
5769 	for (i = 2; i < amt>>1; i++) {
5770 		isp_rdnvram_word(isp, i, &nvram_words[i]);
5771 	}
5772 	for (csum = 0, i = 0; i < amt; i++) {
5773 		csum += nvram_data[i];
5774 	}
5775 	if (csum != 0) {
5776 		isp_prt(isp, ISP_LOGWARN, "invalid NVRAM checksum");
5777 		return (-1);
5778 	}
5779 	if (ISP_NVRAM_VERSION(nvram_data) < minversion) {
5780 		isp_prt(isp, ISP_LOGWARN, "version %d NVRAM not understood",
5781 		    ISP_NVRAM_VERSION(nvram_data));
5782 		return (-1);
5783 	}
5784 
5785 	if (IS_ULTRA3(isp)) {
5786 		isp_parse_nvram_12160(isp, 0, nvram_data);
5787 		isp_parse_nvram_12160(isp, 1, nvram_data);
5788 	} else if (IS_1080(isp)) {
5789 		isp_parse_nvram_1080(isp, 0, nvram_data);
5790 	} else if (IS_1280(isp) || IS_1240(isp)) {
5791 		isp_parse_nvram_1080(isp, 0, nvram_data);
5792 		isp_parse_nvram_1080(isp, 1, nvram_data);
5793 	} else if (IS_SCSI(isp)) {
5794 		isp_parse_nvram_1020(isp, nvram_data);
5795 	} else {
5796 		isp_parse_nvram_2100(isp, nvram_data);
5797 	}
5798 	return (0);
5799 #undef	nvram_data
5800 #undef	nvram_words
5801 }
5802 
5803 static void
5804 isp_rdnvram_word(struct ispsoftc *isp, int wo, u_int16_t *rp)
5805 {
5806 	int i, cbits;
5807 	u_int16_t bit, rqst;
5808 
5809 	ISP_WRITE(isp, BIU_NVRAM, BIU_NVRAM_SELECT);
5810 	USEC_DELAY(2);
5811 	ISP_WRITE(isp, BIU_NVRAM, BIU_NVRAM_SELECT|BIU_NVRAM_CLOCK);
5812 	USEC_DELAY(2);
5813 
5814 	if (IS_FC(isp)) {
5815 		wo &= ((ISP2100_NVRAM_SIZE >> 1) - 1);
5816 		if (IS_2312(isp) && isp->isp_port) {
5817 			wo += 128;
5818 		}
5819 		rqst = (ISP_NVRAM_READ << 8) | wo;
5820 		cbits = 10;
5821 	} else if (IS_ULTRA2(isp)) {
5822 		wo &= ((ISP1080_NVRAM_SIZE >> 1) - 1);
5823 		rqst = (ISP_NVRAM_READ << 8) | wo;
5824 		cbits = 10;
5825 	} else {
5826 		wo &= ((ISP_NVRAM_SIZE >> 1) - 1);
5827 		rqst = (ISP_NVRAM_READ << 6) | wo;
5828 		cbits = 8;
5829 	}
5830 
5831 	/*
5832 	 * Clock the word select request out...
5833 	 */
5834 	for (i = cbits; i >= 0; i--) {
5835 		if ((rqst >> i) & 1) {
5836 			bit = BIU_NVRAM_SELECT | BIU_NVRAM_DATAOUT;
5837 		} else {
5838 			bit = BIU_NVRAM_SELECT;
5839 		}
5840 		ISP_WRITE(isp, BIU_NVRAM, bit);
5841 		USEC_DELAY(2);
5842 		ISP_WRITE(isp, BIU_NVRAM, bit | BIU_NVRAM_CLOCK);
5843 		USEC_DELAY(2);
5844 		ISP_WRITE(isp, BIU_NVRAM, bit);
5845 		USEC_DELAY(2);
5846 	}
5847 	/*
5848 	 * Now read the result back in (bits come back in MSB format).
5849 	 */
5850 	*rp = 0;
5851 	for (i = 0; i < 16; i++) {
5852 		u_int16_t rv;
5853 		*rp <<= 1;
5854 		ISP_WRITE(isp, BIU_NVRAM, BIU_NVRAM_SELECT|BIU_NVRAM_CLOCK);
5855 		USEC_DELAY(2);
5856 		rv = ISP_READ(isp, BIU_NVRAM);
5857 		if (rv & BIU_NVRAM_DATAIN) {
5858 			*rp |= 1;
5859 		}
5860 		USEC_DELAY(2);
5861 		ISP_WRITE(isp, BIU_NVRAM, BIU_NVRAM_SELECT);
5862 		USEC_DELAY(2);
5863 	}
5864 	ISP_WRITE(isp, BIU_NVRAM, 0);
5865 	USEC_DELAY(2);
5866 	ISP_SWIZZLE_NVRAM_WORD(isp, rp);
5867 }
5868 
5869 static void
5870 isp_parse_nvram_1020(struct ispsoftc *isp, u_int8_t *nvram_data)
5871 {
5872 	sdparam *sdp = (sdparam *) isp->isp_param;
5873 	int tgt;
5874 
5875 	sdp->isp_fifo_threshold =
5876 		ISP_NVRAM_FIFO_THRESHOLD(nvram_data) |
5877 		(ISP_NVRAM_FIFO_THRESHOLD_128(nvram_data) << 2);
5878 
5879 	sdp->isp_initiator_id =
5880 		ISP_NVRAM_INITIATOR_ID(nvram_data);
5881 
5882 	sdp->isp_bus_reset_delay =
5883 		ISP_NVRAM_BUS_RESET_DELAY(nvram_data);
5884 
5885 	sdp->isp_retry_count =
5886 		ISP_NVRAM_BUS_RETRY_COUNT(nvram_data);
5887 
5888 	sdp->isp_retry_delay =
5889 		ISP_NVRAM_BUS_RETRY_DELAY(nvram_data);
5890 
5891 	sdp->isp_async_data_setup =
5892 		ISP_NVRAM_ASYNC_DATA_SETUP_TIME(nvram_data);
5893 
5894 	if (isp->isp_type >= ISP_HA_SCSI_1040) {
5895 		if (sdp->isp_async_data_setup < 9) {
5896 			sdp->isp_async_data_setup = 9;
5897 		}
5898 	} else {
5899 		if (sdp->isp_async_data_setup != 6) {
5900 			sdp->isp_async_data_setup = 6;
5901 		}
5902 	}
5903 
5904 	sdp->isp_req_ack_active_neg =
5905 		ISP_NVRAM_REQ_ACK_ACTIVE_NEGATION(nvram_data);
5906 
5907 	sdp->isp_data_line_active_neg =
5908 		ISP_NVRAM_DATA_LINE_ACTIVE_NEGATION(nvram_data);
5909 
5910 	sdp->isp_data_dma_burst_enabl =
5911 		ISP_NVRAM_DATA_DMA_BURST_ENABLE(nvram_data);
5912 
5913 	sdp->isp_cmd_dma_burst_enable =
5914 		ISP_NVRAM_CMD_DMA_BURST_ENABLE(nvram_data);
5915 
5916 	sdp->isp_tag_aging =
5917 		ISP_NVRAM_TAG_AGE_LIMIT(nvram_data);
5918 
5919 	sdp->isp_selection_timeout =
5920 		ISP_NVRAM_SELECTION_TIMEOUT(nvram_data);
5921 
5922 	sdp->isp_max_queue_depth =
5923 		ISP_NVRAM_MAX_QUEUE_DEPTH(nvram_data);
5924 
5925 	sdp->isp_fast_mttr = ISP_NVRAM_FAST_MTTR_ENABLE(nvram_data);
5926 
5927 	isp_prt(isp, ISP_LOGDEBUG0, sc0, sc4,
5928 	    0, sdp->isp_fifo_threshold, sdp->isp_initiator_id,
5929 	    sdp->isp_bus_reset_delay, sdp->isp_retry_count,
5930 	    sdp->isp_retry_delay, sdp->isp_async_data_setup);
5931 	isp_prt(isp, ISP_LOGDEBUG0, sc1, sc4,
5932 	    sdp->isp_req_ack_active_neg, sdp->isp_data_line_active_neg,
5933 	    sdp->isp_data_dma_burst_enabl, sdp->isp_cmd_dma_burst_enable,
5934 	    sdp->isp_selection_timeout, sdp->isp_max_queue_depth);
5935 
5936 	for (tgt = 0; tgt < MAX_TARGETS; tgt++) {
5937 		sdp->isp_devparam[tgt].dev_enable =
5938 			ISP_NVRAM_TGT_DEVICE_ENABLE(nvram_data, tgt);
5939 		sdp->isp_devparam[tgt].exc_throttle =
5940 			ISP_NVRAM_TGT_EXEC_THROTTLE(nvram_data, tgt);
5941 		sdp->isp_devparam[tgt].nvrm_offset =
5942 			ISP_NVRAM_TGT_SYNC_OFFSET(nvram_data, tgt);
5943 		sdp->isp_devparam[tgt].nvrm_period =
5944 			ISP_NVRAM_TGT_SYNC_PERIOD(nvram_data, tgt);
5945 		/*
5946 		 * We probably shouldn't lie about this, but it
5947 		 * it makes it much safer if we limit NVRAM values
5948 		 * to sanity.
5949 		 */
5950 		if (isp->isp_type < ISP_HA_SCSI_1040) {
5951 			/*
5952 			 * If we're not ultra, we can't possibly
5953 			 * be a shorter period than this.
5954 			 */
5955 			if (sdp->isp_devparam[tgt].nvrm_period < 0x19) {
5956 				sdp->isp_devparam[tgt].nvrm_period = 0x19;
5957 			}
5958 			if (sdp->isp_devparam[tgt].nvrm_offset > 0xc) {
5959 				sdp->isp_devparam[tgt].nvrm_offset = 0x0c;
5960 			}
5961 		} else {
5962 			if (sdp->isp_devparam[tgt].nvrm_offset > 0x8) {
5963 				sdp->isp_devparam[tgt].nvrm_offset = 0x8;
5964 			}
5965 		}
5966 		sdp->isp_devparam[tgt].nvrm_flags = 0;
5967 		if (ISP_NVRAM_TGT_RENEG(nvram_data, tgt))
5968 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_RENEG;
5969 		sdp->isp_devparam[tgt].nvrm_flags |= DPARM_ARQ;
5970 		if (ISP_NVRAM_TGT_TQING(nvram_data, tgt))
5971 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_TQING;
5972 		if (ISP_NVRAM_TGT_SYNC(nvram_data, tgt))
5973 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_SYNC;
5974 		if (ISP_NVRAM_TGT_WIDE(nvram_data, tgt))
5975 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_WIDE;
5976 		if (ISP_NVRAM_TGT_PARITY(nvram_data, tgt))
5977 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_PARITY;
5978 		if (ISP_NVRAM_TGT_DISC(nvram_data, tgt))
5979 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_DISC;
5980 		sdp->isp_devparam[tgt].actv_flags = 0; /* we don't know */
5981 		isp_prt(isp, ISP_LOGDEBUG0, sc2, sc4,
5982 		    0, tgt, sdp->isp_devparam[tgt].nvrm_flags,
5983 		    sdp->isp_devparam[tgt].nvrm_offset,
5984 		    sdp->isp_devparam[tgt].nvrm_period);
5985 		sdp->isp_devparam[tgt].goal_offset =
5986 		    sdp->isp_devparam[tgt].nvrm_offset;
5987 		sdp->isp_devparam[tgt].goal_period =
5988 		    sdp->isp_devparam[tgt].nvrm_period;
5989 		sdp->isp_devparam[tgt].goal_flags =
5990 		    sdp->isp_devparam[tgt].nvrm_flags;
5991 	}
5992 }
5993 
5994 static void
5995 isp_parse_nvram_1080(struct ispsoftc *isp, int bus, u_int8_t *nvram_data)
5996 {
5997 	sdparam *sdp = (sdparam *) isp->isp_param;
5998 	int tgt;
5999 
6000 	sdp += bus;
6001 
6002 	sdp->isp_fifo_threshold =
6003 	    ISP1080_NVRAM_FIFO_THRESHOLD(nvram_data);
6004 
6005 	sdp->isp_initiator_id =
6006 	    ISP1080_NVRAM_INITIATOR_ID(nvram_data, bus);
6007 
6008 	sdp->isp_bus_reset_delay =
6009 	    ISP1080_NVRAM_BUS_RESET_DELAY(nvram_data, bus);
6010 
6011 	sdp->isp_retry_count =
6012 	    ISP1080_NVRAM_BUS_RETRY_COUNT(nvram_data, bus);
6013 
6014 	sdp->isp_retry_delay =
6015 	    ISP1080_NVRAM_BUS_RETRY_DELAY(nvram_data, bus);
6016 
6017 	sdp->isp_async_data_setup =
6018 	    ISP1080_NVRAM_ASYNC_DATA_SETUP_TIME(nvram_data, bus);
6019 
6020 	sdp->isp_req_ack_active_neg =
6021 	    ISP1080_NVRAM_REQ_ACK_ACTIVE_NEGATION(nvram_data, bus);
6022 
6023 	sdp->isp_data_line_active_neg =
6024 	    ISP1080_NVRAM_DATA_LINE_ACTIVE_NEGATION(nvram_data, bus);
6025 
6026 	sdp->isp_data_dma_burst_enabl =
6027 	    ISP1080_NVRAM_BURST_ENABLE(nvram_data);
6028 
6029 	sdp->isp_cmd_dma_burst_enable =
6030 	    ISP1080_NVRAM_BURST_ENABLE(nvram_data);
6031 
6032 	sdp->isp_selection_timeout =
6033 	    ISP1080_NVRAM_SELECTION_TIMEOUT(nvram_data, bus);
6034 
6035 	sdp->isp_max_queue_depth =
6036 	     ISP1080_NVRAM_MAX_QUEUE_DEPTH(nvram_data, bus);
6037 
6038 	isp_prt(isp, ISP_LOGDEBUG0, sc0, sc4,
6039 	    bus, sdp->isp_fifo_threshold, sdp->isp_initiator_id,
6040 	    sdp->isp_bus_reset_delay, sdp->isp_retry_count,
6041 	    sdp->isp_retry_delay, sdp->isp_async_data_setup);
6042 	isp_prt(isp, ISP_LOGDEBUG0, sc1, sc4,
6043 	    sdp->isp_req_ack_active_neg, sdp->isp_data_line_active_neg,
6044 	    sdp->isp_data_dma_burst_enabl, sdp->isp_cmd_dma_burst_enable,
6045 	    sdp->isp_selection_timeout, sdp->isp_max_queue_depth);
6046 
6047 
6048 	for (tgt = 0; tgt < MAX_TARGETS; tgt++) {
6049 		sdp->isp_devparam[tgt].dev_enable =
6050 		    ISP1080_NVRAM_TGT_DEVICE_ENABLE(nvram_data, tgt, bus);
6051 		sdp->isp_devparam[tgt].exc_throttle =
6052 			ISP1080_NVRAM_TGT_EXEC_THROTTLE(nvram_data, tgt, bus);
6053 		sdp->isp_devparam[tgt].nvrm_offset =
6054 			ISP1080_NVRAM_TGT_SYNC_OFFSET(nvram_data, tgt, bus);
6055 		sdp->isp_devparam[tgt].nvrm_period =
6056 			ISP1080_NVRAM_TGT_SYNC_PERIOD(nvram_data, tgt, bus);
6057 		sdp->isp_devparam[tgt].nvrm_flags = 0;
6058 		if (ISP1080_NVRAM_TGT_RENEG(nvram_data, tgt, bus))
6059 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_RENEG;
6060 		sdp->isp_devparam[tgt].nvrm_flags |= DPARM_ARQ;
6061 		if (ISP1080_NVRAM_TGT_TQING(nvram_data, tgt, bus))
6062 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_TQING;
6063 		if (ISP1080_NVRAM_TGT_SYNC(nvram_data, tgt, bus))
6064 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_SYNC;
6065 		if (ISP1080_NVRAM_TGT_WIDE(nvram_data, tgt, bus))
6066 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_WIDE;
6067 		if (ISP1080_NVRAM_TGT_PARITY(nvram_data, tgt, bus))
6068 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_PARITY;
6069 		if (ISP1080_NVRAM_TGT_DISC(nvram_data, tgt, bus))
6070 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_DISC;
6071 		sdp->isp_devparam[tgt].actv_flags = 0;
6072 		isp_prt(isp, ISP_LOGDEBUG0, sc2, sc4,
6073 		    bus, tgt, sdp->isp_devparam[tgt].nvrm_flags,
6074 		    sdp->isp_devparam[tgt].nvrm_offset,
6075 		    sdp->isp_devparam[tgt].nvrm_period);
6076 		sdp->isp_devparam[tgt].goal_offset =
6077 		    sdp->isp_devparam[tgt].nvrm_offset;
6078 		sdp->isp_devparam[tgt].goal_period =
6079 		    sdp->isp_devparam[tgt].nvrm_period;
6080 		sdp->isp_devparam[tgt].goal_flags =
6081 		    sdp->isp_devparam[tgt].nvrm_flags;
6082 	}
6083 }
6084 
6085 static void
6086 isp_parse_nvram_12160(struct ispsoftc *isp, int bus, u_int8_t *nvram_data)
6087 {
6088 	sdparam *sdp = (sdparam *) isp->isp_param;
6089 	int tgt;
6090 
6091 	sdp += bus;
6092 
6093 	sdp->isp_fifo_threshold =
6094 	    ISP12160_NVRAM_FIFO_THRESHOLD(nvram_data);
6095 
6096 	sdp->isp_initiator_id =
6097 	    ISP12160_NVRAM_INITIATOR_ID(nvram_data, bus);
6098 
6099 	sdp->isp_bus_reset_delay =
6100 	    ISP12160_NVRAM_BUS_RESET_DELAY(nvram_data, bus);
6101 
6102 	sdp->isp_retry_count =
6103 	    ISP12160_NVRAM_BUS_RETRY_COUNT(nvram_data, bus);
6104 
6105 	sdp->isp_retry_delay =
6106 	    ISP12160_NVRAM_BUS_RETRY_DELAY(nvram_data, bus);
6107 
6108 	sdp->isp_async_data_setup =
6109 	    ISP12160_NVRAM_ASYNC_DATA_SETUP_TIME(nvram_data, bus);
6110 
6111 	sdp->isp_req_ack_active_neg =
6112 	    ISP12160_NVRAM_REQ_ACK_ACTIVE_NEGATION(nvram_data, bus);
6113 
6114 	sdp->isp_data_line_active_neg =
6115 	    ISP12160_NVRAM_DATA_LINE_ACTIVE_NEGATION(nvram_data, bus);
6116 
6117 	sdp->isp_data_dma_burst_enabl =
6118 	    ISP12160_NVRAM_BURST_ENABLE(nvram_data);
6119 
6120 	sdp->isp_cmd_dma_burst_enable =
6121 	    ISP12160_NVRAM_BURST_ENABLE(nvram_data);
6122 
6123 	sdp->isp_selection_timeout =
6124 	    ISP12160_NVRAM_SELECTION_TIMEOUT(nvram_data, bus);
6125 
6126 	sdp->isp_max_queue_depth =
6127 	     ISP12160_NVRAM_MAX_QUEUE_DEPTH(nvram_data, bus);
6128 
6129 	isp_prt(isp, ISP_LOGDEBUG0, sc0, sc4,
6130 	    bus, sdp->isp_fifo_threshold, sdp->isp_initiator_id,
6131 	    sdp->isp_bus_reset_delay, sdp->isp_retry_count,
6132 	    sdp->isp_retry_delay, sdp->isp_async_data_setup);
6133 	isp_prt(isp, ISP_LOGDEBUG0, sc1, sc4,
6134 	    sdp->isp_req_ack_active_neg, sdp->isp_data_line_active_neg,
6135 	    sdp->isp_data_dma_burst_enabl, sdp->isp_cmd_dma_burst_enable,
6136 	    sdp->isp_selection_timeout, sdp->isp_max_queue_depth);
6137 
6138 	for (tgt = 0; tgt < MAX_TARGETS; tgt++) {
6139 		sdp->isp_devparam[tgt].dev_enable =
6140 		    ISP12160_NVRAM_TGT_DEVICE_ENABLE(nvram_data, tgt, bus);
6141 		sdp->isp_devparam[tgt].exc_throttle =
6142 			ISP12160_NVRAM_TGT_EXEC_THROTTLE(nvram_data, tgt, bus);
6143 		sdp->isp_devparam[tgt].nvrm_offset =
6144 			ISP12160_NVRAM_TGT_SYNC_OFFSET(nvram_data, tgt, bus);
6145 		sdp->isp_devparam[tgt].nvrm_period =
6146 			ISP12160_NVRAM_TGT_SYNC_PERIOD(nvram_data, tgt, bus);
6147 		sdp->isp_devparam[tgt].nvrm_flags = 0;
6148 		if (ISP12160_NVRAM_TGT_RENEG(nvram_data, tgt, bus))
6149 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_RENEG;
6150 		sdp->isp_devparam[tgt].nvrm_flags |= DPARM_ARQ;
6151 		if (ISP12160_NVRAM_TGT_TQING(nvram_data, tgt, bus))
6152 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_TQING;
6153 		if (ISP12160_NVRAM_TGT_SYNC(nvram_data, tgt, bus))
6154 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_SYNC;
6155 		if (ISP12160_NVRAM_TGT_WIDE(nvram_data, tgt, bus))
6156 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_WIDE;
6157 		if (ISP12160_NVRAM_TGT_PARITY(nvram_data, tgt, bus))
6158 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_PARITY;
6159 		if (ISP12160_NVRAM_TGT_DISC(nvram_data, tgt, bus))
6160 			sdp->isp_devparam[tgt].nvrm_flags |= DPARM_DISC;
6161 		sdp->isp_devparam[tgt].actv_flags = 0;
6162 		isp_prt(isp, ISP_LOGDEBUG0, sc2, sc4,
6163 		    bus, tgt, sdp->isp_devparam[tgt].nvrm_flags,
6164 		    sdp->isp_devparam[tgt].nvrm_offset,
6165 		    sdp->isp_devparam[tgt].nvrm_period);
6166 		sdp->isp_devparam[tgt].goal_offset =
6167 		    sdp->isp_devparam[tgt].nvrm_offset;
6168 		sdp->isp_devparam[tgt].goal_period =
6169 		    sdp->isp_devparam[tgt].nvrm_period;
6170 		sdp->isp_devparam[tgt].goal_flags =
6171 		    sdp->isp_devparam[tgt].nvrm_flags;
6172 	}
6173 }
6174 
6175 static void
6176 isp_parse_nvram_2100(struct ispsoftc *isp, u_int8_t *nvram_data)
6177 {
6178 	fcparam *fcp = (fcparam *) isp->isp_param;
6179 	u_int64_t wwn;
6180 
6181 	/*
6182 	 * There is NVRAM storage for both Port and Node entities-
6183 	 * but the Node entity appears to be unused on all the cards
6184 	 * I can find. However, we should account for this being set
6185 	 * at some point in the future.
6186 	 *
6187 	 * Qlogic WWNs have an NAA of 2, but usually nothing shows up in
6188 	 * bits 48..60. In the case of the 2202, it appears that they do
6189 	 * use bit 48 to distinguish between the two instances on the card.
6190 	 * The 2204, which I've never seen, *probably* extends this method.
6191 	 */
6192 	wwn = ISP2100_NVRAM_PORT_NAME(nvram_data);
6193 	if (wwn) {
6194 		isp_prt(isp, ISP_LOGCONFIG, "NVRAM Port WWN 0x%08x%08x",
6195 		    (u_int32_t) (wwn >> 32), (u_int32_t) (wwn & 0xffffffff));
6196 		if ((wwn >> 60) == 0) {
6197 			wwn |= (((u_int64_t) 2)<< 60);
6198 		}
6199 	}
6200 	fcp->isp_portwwn = wwn;
6201 	if (IS_2200(isp) || IS_23XX(isp)) {
6202 		wwn = ISP2200_NVRAM_NODE_NAME(nvram_data);
6203 		if (wwn) {
6204 			isp_prt(isp, ISP_LOGCONFIG, "NVRAM Node WWN 0x%08x%08x",
6205 			    (u_int32_t) (wwn >> 32),
6206 			    (u_int32_t) (wwn & 0xffffffff));
6207 			if ((wwn >> 60) == 0) {
6208 				wwn |= (((u_int64_t) 2)<< 60);
6209 			}
6210 		}
6211 	} else {
6212 		wwn &= ~((u_int64_t) 0xfff << 48);
6213 	}
6214 	fcp->isp_nodewwn = wwn;
6215 
6216 	/*
6217 	 * Make sure we have both Node and Port as non-zero values.
6218 	 */
6219 	if (fcp->isp_nodewwn != 0 && fcp->isp_portwwn == 0) {
6220 		fcp->isp_portwwn = fcp->isp_nodewwn;
6221 	} else if (fcp->isp_nodewwn == 0 && fcp->isp_portwwn != 0) {
6222 		fcp->isp_nodewwn = fcp->isp_portwwn;
6223 	}
6224 
6225 	/*
6226 	 * Make the Node and Port values sane if they're NAA == 2.
6227 	 * This means to clear bits 48..56 for the Node WWN and
6228 	 * make sure that there's some non-zero value in 48..56
6229 	 * for the Port WWN.
6230 	 */
6231 	if (fcp->isp_nodewwn && fcp->isp_portwwn) {
6232 		if ((fcp->isp_nodewwn & (((u_int64_t) 0xfff) << 48)) != 0 &&
6233 		    (fcp->isp_nodewwn >> 60) == 2) {
6234 			fcp->isp_nodewwn &= ~((u_int64_t) 0xfff << 48);
6235 		}
6236 		if ((fcp->isp_portwwn & (((u_int64_t) 0xfff) << 48)) == 0 &&
6237 		    (fcp->isp_portwwn >> 60) == 2) {
6238 			fcp->isp_portwwn |= ((u_int64_t) 1 << 56);
6239 		}
6240 	}
6241 
6242 	fcp->isp_maxalloc =
6243 		ISP2100_NVRAM_MAXIOCBALLOCATION(nvram_data);
6244 	fcp->isp_maxfrmlen =
6245 		ISP2100_NVRAM_MAXFRAMELENGTH(nvram_data);
6246 	fcp->isp_retry_delay =
6247 		ISP2100_NVRAM_RETRY_DELAY(nvram_data);
6248 	fcp->isp_retry_count =
6249 		ISP2100_NVRAM_RETRY_COUNT(nvram_data);
6250 	fcp->isp_loopid =
6251 		ISP2100_NVRAM_HARDLOOPID(nvram_data);
6252 	fcp->isp_execthrottle =
6253 		ISP2100_NVRAM_EXECUTION_THROTTLE(nvram_data);
6254 	fcp->isp_fwoptions = ISP2100_NVRAM_OPTIONS(nvram_data);
6255 	isp_prt(isp, ISP_LOGDEBUG0,
6256 	    "NVRAM: maxfrmlen %d execthrottle %d fwoptions 0x%x",
6257 	    fcp->isp_maxfrmlen, fcp->isp_execthrottle, fcp->isp_fwoptions);
6258 }
6259 
6260 #ifdef	ISP_FW_CRASH_DUMP
6261 static void isp2200_fw_dump(struct ispsoftc *);
6262 static void isp2300_fw_dump(struct ispsoftc *);
6263 
6264 static void
6265 isp2200_fw_dump(struct ispsoftc *isp)
6266 {
6267 	int i, j;
6268 	mbreg_t mbs;
6269 	u_int16_t *ptr;
6270 
6271 	ptr = FCPARAM(isp)->isp_dump_data;
6272 	if (ptr == NULL) {
6273 		isp_prt(isp, ISP_LOGERR,
6274 		   "No place to dump RISC registers and SRAM");
6275 		return;
6276 	}
6277 	if (*ptr++) {
6278 		isp_prt(isp, ISP_LOGERR,
6279 		   "dump area for RISC registers and SRAM already used");
6280 		return;
6281 	}
6282 	ISP_WRITE(isp, HCCR, HCCR_CMD_PAUSE);
6283 	for (i = 0; i < 100; i++) {
6284 		USEC_DELAY(100);
6285 		if (ISP_READ(isp, HCCR) & HCCR_PAUSE) {
6286 			break;
6287 		}
6288 	}
6289 	if (ISP_READ(isp, HCCR) & HCCR_PAUSE) {
6290 		/*
6291 		 * PBIU Registers
6292 		 */
6293 		for (i = 0; i < 8; i++) {
6294 			*ptr++ = ISP_READ(isp, BIU_BLOCK + (i << 1));
6295 		}
6296 
6297 		/*
6298 		 * Mailbox Registers
6299 		 */
6300 		for (i = 0; i < 8; i++) {
6301 			*ptr++ = ISP_READ(isp, MBOX_BLOCK + (i << 1));
6302 		}
6303 
6304 		/*
6305 		 * DMA Registers
6306 		 */
6307 		for (i = 0; i < 48; i++) {
6308 			*ptr++ = ISP_READ(isp, DMA_BLOCK + 0x20 + (i << 1));
6309 		}
6310 
6311 		/*
6312 		 * RISC H/W Registers
6313 		 */
6314 		ISP_WRITE(isp, BIU2100_CSR, 0);
6315 		for (i = 0; i < 16; i++) {
6316 			*ptr++ = ISP_READ(isp, BIU_BLOCK + 0xA0 + (i << 1));
6317 		}
6318 
6319 		/*
6320 		 * RISC GP Registers
6321 		 */
6322 		for (j = 0; j < 8; j++) {
6323 			ISP_WRITE(isp, BIU_BLOCK + 0xA4, 0x2000 + (j << 8));
6324 			for (i = 0; i < 16; i++) {
6325 				*ptr++ =
6326 				    ISP_READ(isp, BIU_BLOCK + 0x80 + (i << 1));
6327 			}
6328 		}
6329 
6330 		/*
6331 		 * Frame Buffer Hardware Registers
6332 		 */
6333 		ISP_WRITE(isp, BIU2100_CSR, 0x10);
6334 		for (i = 0; i < 16; i++) {
6335 			*ptr++ = ISP_READ(isp, BIU_BLOCK + 0x80 + (i << 1));
6336 		}
6337 
6338 		/*
6339 		 * Fibre Protocol Module 0 Hardware Registers
6340 		 */
6341 		ISP_WRITE(isp, BIU2100_CSR, 0x20);
6342 		for (i = 0; i < 64; i++) {
6343 			*ptr++ = ISP_READ(isp, BIU_BLOCK + 0x80 + (i << 1));
6344 		}
6345 
6346 		/*
6347 		 * Fibre Protocol Module 1 Hardware Registers
6348 		 */
6349 		ISP_WRITE(isp, BIU2100_CSR, 0x30);
6350 		for (i = 0; i < 64; i++) {
6351 			*ptr++ = ISP_READ(isp, BIU_BLOCK + 0x80 + (i << 1));
6352 		}
6353 	} else {
6354 		isp_prt(isp, ISP_LOGERR, "RISC Would Not Pause");
6355 		return;
6356 	}
6357 	isp_prt(isp, ISP_LOGALL,
6358 	   "isp_fw_dump: RISC registers dumped successfully");
6359 	ISP_WRITE(isp, BIU2100_CSR, BIU2100_SOFT_RESET);
6360 	for (i = 0; i < 100; i++) {
6361 		USEC_DELAY(100);
6362 		if (ISP_READ(isp, OUTMAILBOX0) == 0) {
6363 			break;
6364 		}
6365 	}
6366 	if (ISP_READ(isp, OUTMAILBOX0) != 0) {
6367 		isp_prt(isp, ISP_LOGERR, "Board Would Not Reset");
6368 		return;
6369 	}
6370 	ISP_WRITE(isp, HCCR, HCCR_CMD_PAUSE);
6371 	for (i = 0; i < 100; i++) {
6372 		USEC_DELAY(100);
6373 		if (ISP_READ(isp, HCCR) & HCCR_PAUSE) {
6374 			break;
6375 		}
6376 	}
6377 	if ((ISP_READ(isp, HCCR) & HCCR_PAUSE) == 0) {
6378 		isp_prt(isp, ISP_LOGERR, "RISC Would Not Pause After Reset");
6379 		return;
6380 	}
6381 	ISP_WRITE(isp, RISC_EMB, 0xf2);
6382 	ISP_WRITE(isp, HCCR, HCCR_CMD_RELEASE);
6383 	for (i = 0; i < 100; i++) {
6384 		USEC_DELAY(100);
6385 		if ((ISP_READ(isp, HCCR) & HCCR_PAUSE) == 0) {
6386 			break;
6387 		}
6388 	}
6389 	ENABLE_INTS(isp);
6390 	mbs.param[0] = MBOX_READ_RAM_WORD;
6391 	mbs.param[1] = 0x1000;
6392 	isp->isp_mbxworkp = (void *) ptr;
6393 	isp->isp_mbxwrk0 = 0xefff;	/* continuation count */
6394 	isp->isp_mbxwrk1 = 0x1001;	/* next SRAM address */
6395 	isp_control(isp, ISPCTL_RUN_MBOXCMD, &mbs);
6396 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
6397 		isp_prt(isp, ISP_LOGWARN,
6398 		    "RAM DUMP FAILED @ WORD %x", isp->isp_mbxwrk1);
6399 		return;
6400 	}
6401 	ptr = isp->isp_mbxworkp;	/* finish fetch of final word */
6402 	*ptr++ = isp->isp_mboxtmp[2];
6403 	isp_prt(isp, ISP_LOGALL, "isp_fw_dump: SRAM dumped succesfully");
6404 	FCPARAM(isp)->isp_dump_data[0] = isp->isp_type; /* now used */
6405 }
6406 
6407 static void
6408 isp2300_fw_dump(struct ispsoftc *isp)
6409 {
6410 	int i, j;
6411 	mbreg_t mbs;
6412 	u_int16_t *ptr;
6413 
6414 	ptr = FCPARAM(isp)->isp_dump_data;
6415 	if (ptr == NULL) {
6416 		isp_prt(isp, ISP_LOGERR,
6417 		   "No place to dump RISC registers and SRAM");
6418 		return;
6419 	}
6420 	if (*ptr++) {
6421 		isp_prt(isp, ISP_LOGERR,
6422 		   "dump area for RISC registers and SRAM already used");
6423 		return;
6424 	}
6425 	ISP_WRITE(isp, HCCR, HCCR_CMD_PAUSE);
6426 	for (i = 0; i < 100; i++) {
6427 		USEC_DELAY(100);
6428 		if (ISP_READ(isp, HCCR) & HCCR_PAUSE) {
6429 			break;
6430 		}
6431 	}
6432 	if (ISP_READ(isp, HCCR) & HCCR_PAUSE) {
6433 		/*
6434 		 * PBIU registers
6435 		 */
6436 		for (i = 0; i < 8; i++) {
6437 			*ptr++ = ISP_READ(isp, BIU_BLOCK + (i << 1));
6438 		}
6439 
6440 		/*
6441 		 * ReqQ-RspQ-Risc2Host Status registers
6442 		 */
6443 		for (i = 0; i < 8; i++) {
6444 			*ptr++ = ISP_READ(isp, BIU_BLOCK + 0x10 + (i << 1));
6445 		}
6446 
6447 		/*
6448 		 * Mailbox Registers
6449 		 */
6450 		for (i = 0; i < 32; i++) {
6451 			*ptr++ =
6452 			    ISP_READ(isp, PCI_MBOX_REGS2300_OFF + (i << 1));
6453 		}
6454 
6455 		/*
6456 		 * Auto Request Response DMA registers
6457 		 */
6458 		ISP_WRITE(isp, BIU2100_CSR, 0x40);
6459 		for (i = 0; i < 32; i++) {
6460 			*ptr++ = ISP_READ(isp, BIU_BLOCK + 0x80 + (i << 1));
6461 		}
6462 
6463 		/*
6464 		 * DMA registers
6465 		 */
6466 		ISP_WRITE(isp, BIU2100_CSR, 0x50);
6467 		for (i = 0; i < 48; i++) {
6468 			*ptr++ = ISP_READ(isp, BIU_BLOCK + 0x80 + (i << 1));
6469 		}
6470 
6471 		/*
6472 		 * RISC hardware registers
6473 		 */
6474 		ISP_WRITE(isp, BIU2100_CSR, 0);
6475 		for (i = 0; i < 16; i++) {
6476 			*ptr++ = ISP_READ(isp, BIU_BLOCK + 0xA0 + (i << 1));
6477 		}
6478 
6479 		/*
6480 		 * RISC GP? registers
6481 		 */
6482 		for (j = 0; j < 8; j++) {
6483 			ISP_WRITE(isp, BIU_BLOCK + 0xA4, 0x2000 + (j << 9));
6484 			for (i = 0; i < 16; i++) {
6485 				*ptr++ =
6486 				    ISP_READ(isp, BIU_BLOCK + 0x80 + (i << 1));
6487 			}
6488 		}
6489 
6490 		/*
6491 		 * frame buffer hardware registers
6492 		 */
6493 		ISP_WRITE(isp, BIU2100_CSR, 0x10);
6494 		for (i = 0; i < 64; i++) {
6495 			*ptr++ = ISP_READ(isp, BIU_BLOCK + 0x80 + (i << 1));
6496 		}
6497 
6498 		/*
6499 		 * FPM B0 hardware registers
6500 		 */
6501 		ISP_WRITE(isp, BIU2100_CSR, 0x20);
6502 		for (i = 0; i < 64; i++) {
6503 			*ptr++ = ISP_READ(isp, BIU_BLOCK + 0x80 + (i << 1));
6504 		}
6505 
6506 		/*
6507 		 * FPM B1 hardware registers
6508 		 */
6509 		ISP_WRITE(isp, BIU2100_CSR, 0x30);
6510 		for (i = 0; i < 64; i++) {
6511 			*ptr++ = ISP_READ(isp, BIU_BLOCK + 0x80 + (i << 1));
6512 		}
6513 	} else {
6514 		isp_prt(isp, ISP_LOGERR, "RISC Would Not Pause");
6515 		return;
6516 	}
6517 	isp_prt(isp, ISP_LOGALL,
6518 	   "isp_fw_dump: RISC registers dumped successfully");
6519 	ISP_WRITE(isp, BIU2100_CSR, BIU2100_SOFT_RESET);
6520 	for (i = 0; i < 100; i++) {
6521 		USEC_DELAY(100);
6522 		if (ISP_READ(isp, OUTMAILBOX0) == 0) {
6523 			break;
6524 		}
6525 	}
6526 	if (ISP_READ(isp, OUTMAILBOX0) != 0) {
6527 		isp_prt(isp, ISP_LOGERR, "Board Would Not Reset");
6528 		return;
6529 	}
6530 	ENABLE_INTS(isp);
6531 	mbs.param[0] = MBOX_READ_RAM_WORD;
6532 	mbs.param[1] = 0x800;
6533 	isp->isp_mbxworkp = (void *) ptr;
6534 	isp->isp_mbxwrk0 = 0xf7ff;	/* continuation count */
6535 	isp->isp_mbxwrk1 = 0x801;	/* next SRAM address */
6536 	isp_control(isp, ISPCTL_RUN_MBOXCMD, &mbs);
6537 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
6538 		isp_prt(isp, ISP_LOGWARN,
6539 		    "RAM DUMP FAILED @ WORD %x", isp->isp_mbxwrk1);
6540 		return;
6541 	}
6542 	ptr = isp->isp_mbxworkp;	/* finish fetch of final word */
6543 	*ptr++ = isp->isp_mboxtmp[2];
6544 
6545 	/*
6546 	 * We don't have access to mailbox registers 8.. onward
6547 	 * in our 'common' device model- so we have to set it
6548 	 * here and hope it stays the same!
6549 	 */
6550 	ISP_WRITE(isp, PCI_MBOX_REGS2300_OFF + (8 << 1), 0x1);
6551 
6552 	mbs.param[0] = MBOX_READ_RAM_WORD_EXTENDED;
6553 	mbs.param[1] = 0;
6554 	isp->isp_mbxworkp = (void *) ptr;
6555 	isp->isp_mbxwrk0 = 0xffff;	/* continuation count */
6556 	isp->isp_mbxwrk1 = 0x1;		/* next SRAM address */
6557 	isp_control(isp, ISPCTL_RUN_MBOXCMD, &mbs);
6558 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
6559 		isp_prt(isp, ISP_LOGWARN,
6560 		    "RAM DUMP FAILED @ WORD %x", 0x10000 + isp->isp_mbxwrk1);
6561 		return;
6562 	}
6563 	ptr = isp->isp_mbxworkp;	/* finish final word */
6564 	*ptr++ = mbs.param[2];
6565 	isp_prt(isp, ISP_LOGALL, "isp_fw_dump: SRAM dumped succesfully");
6566 	FCPARAM(isp)->isp_dump_data[0] = isp->isp_type; /* now used */
6567 }
6568 
6569 void
6570 isp_fw_dump(struct ispsoftc *isp)
6571 {
6572 	if (IS_2200(isp))
6573 		isp2200_fw_dump(isp);
6574 	else if (IS_23XX(isp))
6575 		isp2300_fw_dump(isp);
6576 }
6577 #endif
6578