xref: /freebsd/sys/dev/isp/isp_freebsd.c (revision 57c4583f70ab9d25b3aed17f20ec7843f9673539)
1 /*-
2  *
3  * Copyright (c) 1997-2006 by Matthew Jacob
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice immediately at the beginning of the file, without modification,
11  *    this list of conditions, and the following disclaimer.
12  * 2. The name of the author may not be used to endorse or promote products
13  *    derived from this software without specific prior written permission.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
19  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25  * SUCH DAMAGE.
26  */
27 
28 /*
29  * Platform (FreeBSD) dependent common attachment code for Qlogic adapters.
30  */
31 #include <sys/cdefs.h>
32 __FBSDID("$FreeBSD$");
33 #include <dev/isp/isp_freebsd.h>
34 #include <sys/unistd.h>
35 #include <sys/kthread.h>
36 #include <machine/stdarg.h>	/* for use by isp_prt below */
37 #include <sys/conf.h>
38 #include <sys/module.h>
39 #include <sys/ioccom.h>
40 #include <dev/isp/isp_ioctl.h>
41 #if	__FreeBSD_version >= 500000
42 #include <sys/sysctl.h>
43 #endif
44 #include <cam/cam_periph.h>
45 
46 
47 MODULE_VERSION(isp, 1);
48 MODULE_DEPEND(isp, cam, 1, 1, 1);
49 int isp_announced = 0;
50 int isp_fabric_hysteresis = 5;
51 int isp_loop_down_limit = 300;	/* default loop down limit */
52 int isp_change_is_bad = 0;	/* "changed" devices are bad */
53 int isp_quickboot_time = 15;	/* don't wait more than N secs for loop up */
54 int isp_gone_device_time = 30;	/* grace time before reporting device lost */
55 static const char *roles[4] = {
56     "(none)", "Target", "Initiator", "Target/Initiator"
57 };
58 static const char prom3[] =
59     "PortID 0x%06x Departed from Target %u because of %s";
60 
61 static void isp_freeze_loopdown(ispsoftc_t *, char *);
62 static d_ioctl_t ispioctl;
63 static void isp_intr_enable(void *);
64 static void isp_cam_async(void *, uint32_t, struct cam_path *, void *);
65 static void isp_poll(struct cam_sim *);
66 static timeout_t isp_watchdog;
67 static timeout_t isp_ldt;
68 static void isp_kthread(void *);
69 static void isp_action(struct cam_sim *, union ccb *);
70 
71 #if __FreeBSD_version < 700000
72 ispfwfunc *isp_get_firmware_p = NULL;
73 #endif
74 
75 #if __FreeBSD_version < 500000
76 #define ISP_CDEV_MAJOR	248
77 static struct cdevsw isp_cdevsw = {
78 	/* open */	nullopen,
79 	/* close */	nullclose,
80 	/* read */	noread,
81 	/* write */	nowrite,
82 	/* ioctl */	ispioctl,
83 	/* poll */	nopoll,
84 	/* mmap */	nommap,
85 	/* strategy */	nostrategy,
86 	/* name */	"isp",
87 	/* maj */	ISP_CDEV_MAJOR,
88 	/* dump */	nodump,
89 	/* psize */	nopsize,
90 	/* flags */	D_TAPE,
91 };
92 #define	isp_sysctl_update(x)	do { ; } while (0)
93 #else
94 static struct cdevsw isp_cdevsw = {
95 	.d_version =	D_VERSION,
96 	.d_flags =	D_NEEDGIANT,
97 	.d_ioctl =	ispioctl,
98 	.d_name =	"isp",
99 };
100 static void isp_sysctl_update(ispsoftc_t *);
101 #endif
102 
103 static ispsoftc_t *isplist = NULL;
104 
105 void
106 isp_attach(ispsoftc_t *isp)
107 {
108 	int primary, secondary;
109 	struct ccb_setasync csa;
110 	struct cam_devq *devq;
111 	struct cam_sim *sim;
112 	struct cam_path *path;
113 
114 	/*
115 	 * Establish (in case of 12X0) which bus is the primary.
116 	 */
117 
118 	primary = 0;
119 	secondary = 1;
120 
121 	/*
122 	 * Create the device queue for our SIM(s).
123 	 */
124 	devq = cam_simq_alloc(isp->isp_maxcmds);
125 	if (devq == NULL) {
126 		return;
127 	}
128 
129 	/*
130 	 * Construct our SIM entry.
131 	 */
132 	ISPLOCK_2_CAMLOCK(isp);
133 	sim = cam_sim_alloc(isp_action, isp_poll, "isp", isp,
134 	    device_get_unit(isp->isp_dev), 1, isp->isp_maxcmds, devq);
135 	if (sim == NULL) {
136 		cam_simq_free(devq);
137 		CAMLOCK_2_ISPLOCK(isp);
138 		return;
139 	}
140 	CAMLOCK_2_ISPLOCK(isp);
141 
142 	isp->isp_osinfo.ehook.ich_func = isp_intr_enable;
143 	isp->isp_osinfo.ehook.ich_arg = isp;
144 	ISPLOCK_2_CAMLOCK(isp);
145 	if (config_intrhook_establish(&isp->isp_osinfo.ehook) != 0) {
146 		cam_sim_free(sim, TRUE);
147 		CAMLOCK_2_ISPLOCK(isp);
148 		isp_prt(isp, ISP_LOGERR,
149 		    "could not establish interrupt enable hook");
150 		return;
151 	}
152 
153 	if (xpt_bus_register(sim, primary) != CAM_SUCCESS) {
154 		cam_sim_free(sim, TRUE);
155 		CAMLOCK_2_ISPLOCK(isp);
156 		return;
157 	}
158 
159 	if (xpt_create_path(&path, NULL, cam_sim_path(sim),
160 	    CAM_TARGET_WILDCARD, CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
161 		xpt_bus_deregister(cam_sim_path(sim));
162 		cam_sim_free(sim, TRUE);
163 		config_intrhook_disestablish(&isp->isp_osinfo.ehook);
164 		CAMLOCK_2_ISPLOCK(isp);
165 		return;
166 	}
167 
168 	xpt_setup_ccb(&csa.ccb_h, path, 5);
169 	csa.ccb_h.func_code = XPT_SASYNC_CB;
170 	csa.event_enable = AC_LOST_DEVICE;
171 	csa.callback = isp_cam_async;
172 	csa.callback_arg = sim;
173 	xpt_action((union ccb *)&csa);
174 	CAMLOCK_2_ISPLOCK(isp);
175 	isp->isp_sim = sim;
176 	isp->isp_path = path;
177 	/*
178 	 * Create a kernel thread for fibre channel instances. We
179 	 * don't have dual channel FC cards.
180 	 */
181 	if (IS_FC(isp)) {
182 		ISPLOCK_2_CAMLOCK(isp);
183 #if __FreeBSD_version >= 500000
184 		cv_init(&isp->isp_osinfo.kthread_cv, "isp_kthread_cv");
185 		if (kthread_create(isp_kthread, isp, &isp->isp_osinfo.kproc,
186 		    RFHIGHPID, 0, "%s: fc_thrd",
187 		    device_get_nameunit(isp->isp_dev)))
188 #else
189 		if (kthread_create(isp_kthread, isp, &isp->isp_osinfo.kproc,
190 		    "%s: fc_thrd", device_get_nameunit(isp->isp_dev)))
191 #endif
192 		{
193 			xpt_bus_deregister(cam_sim_path(sim));
194 			cam_sim_free(sim, TRUE);
195 			config_intrhook_disestablish(&isp->isp_osinfo.ehook);
196 			CAMLOCK_2_ISPLOCK(isp);
197 			isp_prt(isp, ISP_LOGERR, "could not create kthread");
198 			return;
199 		}
200 		CAMLOCK_2_ISPLOCK(isp);
201 		/*
202 		 * We start by being "loop down" if we have an initiator role
203 		 */
204 		if (isp->isp_role & ISP_ROLE_INITIATOR) {
205 			isp_freeze_loopdown(isp, "isp_attach");
206 			isp->isp_osinfo.ldt =
207 			    timeout(isp_ldt, isp, isp_quickboot_time * hz);
208 			isp->isp_osinfo.ldt_running = 1;
209 			isp_prt(isp, ISP_LOGSANCFG|ISP_LOGDEBUG0,
210 			   "Starting Initial Loop Down Timer");
211 		}
212 	}
213 
214 
215 	/*
216 	 * If we have a second channel, construct SIM entry for that.
217 	 */
218 	if (IS_DUALBUS(isp)) {
219 		ISPLOCK_2_CAMLOCK(isp);
220 		sim = cam_sim_alloc(isp_action, isp_poll, "isp", isp,
221 		    device_get_unit(isp->isp_dev), 1, isp->isp_maxcmds, devq);
222 		if (sim == NULL) {
223 			xpt_bus_deregister(cam_sim_path(isp->isp_sim));
224 			xpt_free_path(isp->isp_path);
225 			cam_simq_free(devq);
226 			config_intrhook_disestablish(&isp->isp_osinfo.ehook);
227 			return;
228 		}
229 		if (xpt_bus_register(sim, secondary) != CAM_SUCCESS) {
230 			xpt_bus_deregister(cam_sim_path(isp->isp_sim));
231 			xpt_free_path(isp->isp_path);
232 			cam_sim_free(sim, TRUE);
233 			config_intrhook_disestablish(&isp->isp_osinfo.ehook);
234 			CAMLOCK_2_ISPLOCK(isp);
235 			return;
236 		}
237 
238 		if (xpt_create_path(&path, NULL, cam_sim_path(sim),
239 		    CAM_TARGET_WILDCARD, CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
240 			xpt_bus_deregister(cam_sim_path(isp->isp_sim));
241 			xpt_free_path(isp->isp_path);
242 			xpt_bus_deregister(cam_sim_path(sim));
243 			cam_sim_free(sim, TRUE);
244 			config_intrhook_disestablish(&isp->isp_osinfo.ehook);
245 			CAMLOCK_2_ISPLOCK(isp);
246 			return;
247 		}
248 
249 		xpt_setup_ccb(&csa.ccb_h, path, 5);
250 		csa.ccb_h.func_code = XPT_SASYNC_CB;
251 		csa.event_enable = AC_LOST_DEVICE;
252 		csa.callback = isp_cam_async;
253 		csa.callback_arg = sim;
254 		xpt_action((union ccb *)&csa);
255 		CAMLOCK_2_ISPLOCK(isp);
256 		isp->isp_sim2 = sim;
257 		isp->isp_path2 = path;
258 	}
259 
260 	/*
261 	 * Create device nodes
262 	 */
263 	(void) make_dev(&isp_cdevsw, device_get_unit(isp->isp_dev), UID_ROOT,
264 	    GID_OPERATOR, 0600, "%s", device_get_nameunit(isp->isp_dev));
265 
266 	if (isp->isp_role != ISP_ROLE_NONE) {
267 		isp->isp_state = ISP_RUNSTATE;
268 		ISP_ENABLE_INTS(isp);
269 	}
270 	if (isplist == NULL) {
271 		isplist = isp;
272 	} else {
273 		ispsoftc_t *tmp = isplist;
274 		while (tmp->isp_osinfo.next) {
275 			tmp = tmp->isp_osinfo.next;
276 		}
277 		tmp->isp_osinfo.next = isp;
278 	}
279 	isp_sysctl_update(isp);
280 }
281 
282 static void
283 isp_freeze_loopdown(ispsoftc_t *isp, char *msg)
284 {
285 	if (isp->isp_osinfo.simqfrozen == 0) {
286 		isp_prt(isp, ISP_LOGDEBUG0, "%s: freeze simq (loopdown)", msg);
287 		isp->isp_osinfo.simqfrozen |= SIMQFRZ_LOOPDOWN;
288 		ISPLOCK_2_CAMLOCK(isp);
289 		xpt_freeze_simq(isp->isp_sim, 1);
290 		CAMLOCK_2_ISPLOCK(isp);
291 	} else {
292 		isp_prt(isp, ISP_LOGDEBUG0, "%s: mark frozen (loopdown)", msg);
293 		isp->isp_osinfo.simqfrozen |= SIMQFRZ_LOOPDOWN;
294 	}
295 }
296 
297 
298 #if __FreeBSD_version < 500000
299 #define	_DEV	dev_t
300 #define	_IOP	struct proc
301 #else
302 #define	_IOP	struct thread
303 #define	_DEV	struct cdev *
304 #endif
305 
306 static int
307 ispioctl(_DEV dev, u_long c, caddr_t addr, int flags, _IOP *td)
308 {
309 	ispsoftc_t *isp;
310 	int nr, retval = ENOTTY;
311 
312 	isp = isplist;
313 	while (isp) {
314 		if (minor(dev) == device_get_unit(isp->isp_dev)) {
315 			break;
316 		}
317 		isp = isp->isp_osinfo.next;
318 	}
319 	if (isp == NULL)
320 		return (ENXIO);
321 
322 	switch (c) {
323 #ifdef	ISP_FW_CRASH_DUMP
324 	case ISP_GET_FW_CRASH_DUMP:
325 		if (IS_FC(isp)) {
326 			uint16_t *ptr = FCPARAM(isp)->isp_dump_data;
327 			size_t sz;
328 
329 			retval = 0;
330 			if (IS_2200(isp)) {
331 				sz = QLA2200_RISC_IMAGE_DUMP_SIZE;
332 			} else {
333 				sz = QLA2300_RISC_IMAGE_DUMP_SIZE;
334 			}
335 			ISP_LOCK(isp);
336 			if (ptr && *ptr) {
337 				void *uaddr = *((void **) addr);
338 				if (copyout(ptr, uaddr, sz)) {
339 					retval = EFAULT;
340 				} else {
341 					*ptr = 0;
342 				}
343 			} else {
344 				retval = ENXIO;
345 			}
346 			ISP_UNLOCK(isp);
347 		}
348 		break;
349 	case ISP_FORCE_CRASH_DUMP:
350 		if (IS_FC(isp)) {
351 			ISP_LOCK(isp);
352 			isp_freeze_loopdown(isp,
353 			    "ispioctl(ISP_FORCE_CRASH_DUMP)");
354 			isp_fw_dump(isp);
355 			isp_reinit(isp);
356 			ISP_UNLOCK(isp);
357 			retval = 0;
358 		}
359 		break;
360 #endif
361 	case ISP_SDBLEV:
362 	{
363 		int olddblev = isp->isp_dblev;
364 		isp->isp_dblev = *(int *)addr;
365 		*(int *)addr = olddblev;
366 		retval = 0;
367 		break;
368 	}
369 	case ISP_GETROLE:
370 		*(int *)addr = isp->isp_role;
371 		retval = 0;
372 		break;
373 	case ISP_SETROLE:
374 		nr = *(int *)addr;
375 		if (nr & ~(ISP_ROLE_INITIATOR|ISP_ROLE_TARGET)) {
376 			retval = EINVAL;
377 			break;
378 		}
379 		*(int *)addr = isp->isp_role;
380 		isp->isp_role = nr;
381 		/* FALLTHROUGH */
382 	case ISP_RESETHBA:
383 		ISP_LOCK(isp);
384 		isp_reinit(isp);
385 		ISP_UNLOCK(isp);
386 		retval = 0;
387 		break;
388 	case ISP_RESCAN:
389 		if (IS_FC(isp)) {
390 			ISP_LOCK(isp);
391 			if (isp_fc_runstate(isp, 5 * 1000000)) {
392 				retval = EIO;
393 			} else {
394 				retval = 0;
395 			}
396 			ISP_UNLOCK(isp);
397 		}
398 		break;
399 	case ISP_FC_LIP:
400 		if (IS_FC(isp)) {
401 			ISP_LOCK(isp);
402 			if (isp_control(isp, ISPCTL_SEND_LIP, 0)) {
403 				retval = EIO;
404 			} else {
405 				retval = 0;
406 			}
407 			ISP_UNLOCK(isp);
408 		}
409 		break;
410 	case ISP_FC_GETDINFO:
411 	{
412 		struct isp_fc_device *ifc = (struct isp_fc_device *) addr;
413 		fcportdb_t *lp;
414 
415 		if (IS_SCSI(isp)) {
416 			break;
417 		}
418 		if (ifc->loopid < 0 || ifc->loopid >= MAX_FC_TARG) {
419 			retval = EINVAL;
420 			break;
421 		}
422 		ISP_LOCK(isp);
423 		lp = &FCPARAM(isp)->portdb[ifc->loopid];
424 		if (lp->state == FC_PORTDB_STATE_VALID) {
425 			ifc->role = lp->roles;
426 			ifc->loopid = lp->handle;
427 			ifc->portid = lp->portid;
428 			ifc->node_wwn = lp->node_wwn;
429 			ifc->port_wwn = lp->port_wwn;
430 			retval = 0;
431 		} else {
432 			retval = ENODEV;
433 		}
434 		ISP_UNLOCK(isp);
435 		break;
436 	}
437 	case ISP_GET_STATS:
438 	{
439 		isp_stats_t *sp = (isp_stats_t *) addr;
440 
441 		MEMZERO(sp, sizeof (*sp));
442 		sp->isp_stat_version = ISP_STATS_VERSION;
443 		sp->isp_type = isp->isp_type;
444 		sp->isp_revision = isp->isp_revision;
445 		ISP_LOCK(isp);
446 		sp->isp_stats[ISP_INTCNT] = isp->isp_intcnt;
447 		sp->isp_stats[ISP_INTBOGUS] = isp->isp_intbogus;
448 		sp->isp_stats[ISP_INTMBOXC] = isp->isp_intmboxc;
449 		sp->isp_stats[ISP_INGOASYNC] = isp->isp_intoasync;
450 		sp->isp_stats[ISP_RSLTCCMPLT] = isp->isp_rsltccmplt;
451 		sp->isp_stats[ISP_FPHCCMCPLT] = isp->isp_fphccmplt;
452 		sp->isp_stats[ISP_RSCCHIWAT] = isp->isp_rscchiwater;
453 		sp->isp_stats[ISP_FPCCHIWAT] = isp->isp_fpcchiwater;
454 		ISP_UNLOCK(isp);
455 		retval = 0;
456 		break;
457 	}
458 	case ISP_CLR_STATS:
459 		ISP_LOCK(isp);
460 		isp->isp_intcnt = 0;
461 		isp->isp_intbogus = 0;
462 		isp->isp_intmboxc = 0;
463 		isp->isp_intoasync = 0;
464 		isp->isp_rsltccmplt = 0;
465 		isp->isp_fphccmplt = 0;
466 		isp->isp_rscchiwater = 0;
467 		isp->isp_fpcchiwater = 0;
468 		ISP_UNLOCK(isp);
469 		retval = 0;
470 		break;
471 	case ISP_FC_GETHINFO:
472 	{
473 		struct isp_hba_device *hba = (struct isp_hba_device *) addr;
474 		MEMZERO(hba, sizeof (*hba));
475 
476 		hba->fc_fw_major = ISP_FW_MAJORX(isp->isp_fwrev);
477 		hba->fc_fw_minor = ISP_FW_MINORX(isp->isp_fwrev);
478 		hba->fc_fw_micro = ISP_FW_MICROX(isp->isp_fwrev);
479 		if (IS_FC(isp)) {
480 			hba->fc_speed = FCPARAM(isp)->isp_gbspeed;
481 			hba->fc_scsi_supported = 1;
482 			hba->fc_topology = FCPARAM(isp)->isp_topo + 1;
483 			hba->fc_loopid = FCPARAM(isp)->isp_loopid;
484 			hba->nvram_node_wwn = FCPARAM(isp)->isp_nodewwn;
485 			hba->nvram_port_wwn = FCPARAM(isp)->isp_portwwn;
486 			hba->active_node_wwn = ISP_NODEWWN(isp);
487 			hba->active_port_wwn = ISP_PORTWWN(isp);
488 		}
489 		retval = 0;
490 		break;
491 	}
492 	case ISP_GET_FC_PARAM:
493 	{
494 		struct isp_fc_param *f = (struct isp_fc_param *) addr;
495 
496 		if (IS_SCSI(isp)) {
497 			break;
498 		}
499 		f->parameter = 0;
500 		if (strcmp(f->param_name, "framelength") == 0) {
501 			f->parameter = FCPARAM(isp)->isp_maxfrmlen;
502 			retval = 0;
503 			break;
504 		}
505 		if (strcmp(f->param_name, "exec_throttle") == 0) {
506 			f->parameter = FCPARAM(isp)->isp_execthrottle;
507 			retval = 0;
508 			break;
509 		}
510 		if (strcmp(f->param_name, "fullduplex") == 0) {
511 			if (FCPARAM(isp)->isp_fwoptions & ICBOPT_FULL_DUPLEX)
512 				f->parameter = 1;
513 			retval = 0;
514 			break;
515 		}
516 		if (strcmp(f->param_name, "loopid") == 0) {
517 			f->parameter = FCPARAM(isp)->isp_loopid;
518 			retval = 0;
519 			break;
520 		}
521 		retval = EINVAL;
522 		break;
523 	}
524 	case ISP_SET_FC_PARAM:
525 	{
526 		struct isp_fc_param *f = (struct isp_fc_param *) addr;
527 		uint32_t param = f->parameter;
528 
529 		if (IS_SCSI(isp)) {
530 			break;
531 		}
532 		f->parameter = 0;
533 		if (strcmp(f->param_name, "framelength") == 0) {
534 			if (param != 512 && param != 1024 && param != 1024) {
535 				retval = EINVAL;
536 				break;
537 			}
538 			FCPARAM(isp)->isp_maxfrmlen = param;
539 			retval = 0;
540 			break;
541 		}
542 		if (strcmp(f->param_name, "exec_throttle") == 0) {
543 			if (param < 16 || param > 255) {
544 				retval = EINVAL;
545 				break;
546 			}
547 			FCPARAM(isp)->isp_execthrottle = param;
548 			retval = 0;
549 			break;
550 		}
551 		if (strcmp(f->param_name, "fullduplex") == 0) {
552 			if (param != 0 && param != 1) {
553 				retval = EINVAL;
554 				break;
555 			}
556 			if (param) {
557 				FCPARAM(isp)->isp_fwoptions |=
558 				    ICBOPT_FULL_DUPLEX;
559 			} else {
560 				FCPARAM(isp)->isp_fwoptions &=
561 				    ~ICBOPT_FULL_DUPLEX;
562 			}
563 			retval = 0;
564 			break;
565 		}
566 		if (strcmp(f->param_name, "loopid") == 0) {
567 			if (param < 0 || param > 125) {
568 				retval = EINVAL;
569 				break;
570 			}
571 			FCPARAM(isp)->isp_loopid = param;
572 			retval = 0;
573 			break;
574 		}
575 		retval = EINVAL;
576 		break;
577 	}
578 	case ISP_TSK_MGMT:
579 	{
580 		int needmarker;
581 		struct isp_fc_tsk_mgmt *fct = (struct isp_fc_tsk_mgmt *) addr;
582 		uint16_t loopid;
583 		mbreg_t mbs;
584 
585 		if (IS_SCSI(isp)) {
586 			break;
587 		}
588 
589 		memset(&mbs, 0, sizeof (mbs));
590 		needmarker = retval = 0;
591 		loopid = fct->loopid;
592 		if (FCPARAM(isp)->isp_2klogin == 0) {
593 			loopid <<= 8;
594 		}
595 		switch (fct->action) {
596 		case IPT_CLEAR_ACA:
597 			mbs.param[0] = MBOX_CLEAR_ACA;
598 			mbs.param[1] = loopid;
599 			mbs.param[2] = fct->lun;
600 			break;
601 		case IPT_TARGET_RESET:
602 			mbs.param[0] = MBOX_TARGET_RESET;
603 			mbs.param[1] = loopid;
604 			needmarker = 1;
605 			break;
606 		case IPT_LUN_RESET:
607 			mbs.param[0] = MBOX_LUN_RESET;
608 			mbs.param[1] = loopid;
609 			mbs.param[2] = fct->lun;
610 			needmarker = 1;
611 			break;
612 		case IPT_CLEAR_TASK_SET:
613 			mbs.param[0] = MBOX_CLEAR_TASK_SET;
614 			mbs.param[1] = loopid;
615 			mbs.param[2] = fct->lun;
616 			needmarker = 1;
617 			break;
618 		case IPT_ABORT_TASK_SET:
619 			mbs.param[0] = MBOX_ABORT_TASK_SET;
620 			mbs.param[1] = loopid;
621 			mbs.param[2] = fct->lun;
622 			needmarker = 1;
623 			break;
624 		default:
625 			retval = EINVAL;
626 			break;
627 		}
628 		if (retval == 0) {
629 			ISP_LOCK(isp);
630 			if (needmarker) {
631 				isp->isp_sendmarker |= 1;
632 			}
633 			retval = isp_control(isp, ISPCTL_RUN_MBOXCMD, &mbs);
634 			ISP_UNLOCK(isp);
635 			if (retval)
636 				retval = EIO;
637 		}
638 		break;
639 	}
640 	default:
641 		break;
642 	}
643 	return (retval);
644 }
645 
646 #if __FreeBSD_version >= 500000
647 static void
648 isp_sysctl_update(ispsoftc_t *isp)
649 {
650 	struct sysctl_ctx_list *ctx =
651 	    device_get_sysctl_ctx(isp->isp_osinfo.dev);
652 	struct sysctl_oid *tree = device_get_sysctl_tree(isp->isp_osinfo.dev);
653 
654 	if (IS_SCSI(isp)) {
655 		return;
656 	}
657 
658 	snprintf(isp->isp_osinfo.sysctl_info.fc.wwnn,
659 	    sizeof (isp->isp_osinfo.sysctl_info.fc.wwnn), "0x%08x%08x",
660 	    (uint32_t) (ISP_NODEWWN(isp) >> 32), (uint32_t) ISP_NODEWWN(isp));
661 
662 	snprintf(isp->isp_osinfo.sysctl_info.fc.wwpn,
663 	    sizeof (isp->isp_osinfo.sysctl_info.fc.wwpn), "0x%08x%08x",
664 	    (uint32_t) (ISP_PORTWWN(isp) >> 32), (uint32_t) ISP_PORTWWN(isp));
665 
666 	SYSCTL_ADD_STRING(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
667 	       "wwnn", CTLFLAG_RD, isp->isp_osinfo.sysctl_info.fc.wwnn, 0,
668 	       "World Wide Node Name");
669 
670 	SYSCTL_ADD_STRING(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
671 	       "wwpn", CTLFLAG_RD, isp->isp_osinfo.sysctl_info.fc.wwpn, 0,
672 	       "World Wide Port Name");
673 
674 	SYSCTL_ADD_UINT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
675 	    "loop_down_limit",
676 	    CTLFLAG_RW, &isp->isp_osinfo.loop_down_limit, 0,
677 	    "How long to wait for loop to come back up");
678 
679 	SYSCTL_ADD_UINT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
680 	    "gone_device_time",
681 	    CTLFLAG_RW, &isp->isp_osinfo.gone_device_time, 0,
682 	    "How long to wait for a device to reappear");
683 }
684 #endif
685 
686 static void
687 isp_intr_enable(void *arg)
688 {
689 	ispsoftc_t *isp = arg;
690 	if (isp->isp_role != ISP_ROLE_NONE) {
691 		ISP_ENABLE_INTS(isp);
692 	}
693 	/* Release our hook so that the boot can continue. */
694 	config_intrhook_disestablish(&isp->isp_osinfo.ehook);
695 }
696 
697 /*
698  * Put the target mode functions here, because some are inlines
699  */
700 
701 #ifdef	ISP_TARGET_MODE
702 
703 static __inline int is_lun_enabled(ispsoftc_t *, int, lun_id_t);
704 static __inline int are_any_luns_enabled(ispsoftc_t *, int);
705 static __inline tstate_t *get_lun_statep(ispsoftc_t *, int, lun_id_t);
706 static __inline void rls_lun_statep(ispsoftc_t *, tstate_t *);
707 static __inline atio_private_data_t *isp_get_atpd(ispsoftc_t *, int);
708 static cam_status
709 create_lun_state(ispsoftc_t *, int, struct cam_path *, tstate_t **);
710 static void destroy_lun_state(ispsoftc_t *, tstate_t *);
711 static int isp_en_lun(ispsoftc_t *, union ccb *);
712 static void isp_ledone(ispsoftc_t *, lun_entry_t *);
713 static cam_status isp_abort_tgt_ccb(ispsoftc_t *, union ccb *);
714 static timeout_t isp_refire_putback_atio;
715 static void isp_complete_ctio(union ccb *);
716 static void isp_target_putback_atio(union ccb *);
717 static void isp_target_start_ctio(ispsoftc_t *, union ccb *);
718 static int isp_handle_platform_atio(ispsoftc_t *, at_entry_t *);
719 static int isp_handle_platform_atio2(ispsoftc_t *, at2_entry_t *);
720 static int isp_handle_platform_ctio(ispsoftc_t *, void *);
721 static int isp_handle_platform_notify_scsi(ispsoftc_t *, in_entry_t *);
722 static int isp_handle_platform_notify_fc(ispsoftc_t *, in_fcentry_t *);
723 
724 static __inline int
725 is_lun_enabled(ispsoftc_t *isp, int bus, lun_id_t lun)
726 {
727 	tstate_t *tptr;
728 	tptr = isp->isp_osinfo.lun_hash[LUN_HASH_FUNC(isp, bus, lun)];
729 	if (tptr == NULL) {
730 		return (0);
731 	}
732 	do {
733 		if (tptr->lun == (lun_id_t) lun && tptr->bus == bus) {
734 			return (1);
735 		}
736 	} while ((tptr = tptr->next) != NULL);
737 	return (0);
738 }
739 
740 static __inline int
741 are_any_luns_enabled(ispsoftc_t *isp, int port)
742 {
743 	int lo, hi;
744 	if (IS_DUALBUS(isp)) {
745 		lo = (port * (LUN_HASH_SIZE >> 1));
746 		hi = lo + (LUN_HASH_SIZE >> 1);
747 	} else {
748 		lo = 0;
749 		hi = LUN_HASH_SIZE;
750 	}
751 	for (lo = 0; lo < hi; lo++) {
752 		if (isp->isp_osinfo.lun_hash[lo]) {
753 			return (1);
754 		}
755 	}
756 	return (0);
757 }
758 
759 static __inline tstate_t *
760 get_lun_statep(ispsoftc_t *isp, int bus, lun_id_t lun)
761 {
762 	tstate_t *tptr = NULL;
763 
764 	if (lun == CAM_LUN_WILDCARD) {
765 		if (isp->isp_osinfo.tmflags[bus] & TM_WILDCARD_ENABLED) {
766 			tptr = &isp->isp_osinfo.tsdflt[bus];
767 			tptr->hold++;
768 			return (tptr);
769 		}
770 		return (NULL);
771 	} else {
772 		tptr = isp->isp_osinfo.lun_hash[LUN_HASH_FUNC(isp, bus, lun)];
773 		if (tptr == NULL) {
774 			return (NULL);
775 		}
776 	}
777 
778 	do {
779 		if (tptr->lun == lun && tptr->bus == bus) {
780 			tptr->hold++;
781 			return (tptr);
782 		}
783 	} while ((tptr = tptr->next) != NULL);
784 	return (tptr);
785 }
786 
787 static __inline void
788 rls_lun_statep(ispsoftc_t *isp, tstate_t *tptr)
789 {
790 	if (tptr->hold)
791 		tptr->hold--;
792 }
793 
794 static __inline atio_private_data_t *
795 isp_get_atpd(ispsoftc_t *isp, int tag)
796 {
797 	atio_private_data_t *atp;
798 	for (atp = isp->isp_osinfo.atpdp;
799 	    atp < &isp->isp_osinfo.atpdp[ATPDPSIZE]; atp++) {
800 		if (atp->tag == tag)
801 			return (atp);
802 	}
803 	return (NULL);
804 }
805 
806 static cam_status
807 create_lun_state(ispsoftc_t *isp, int bus,
808     struct cam_path *path, tstate_t **rslt)
809 {
810 	cam_status status;
811 	lun_id_t lun;
812 	int hfx;
813 	tstate_t *tptr, *new;
814 
815 	lun = xpt_path_lun_id(path);
816 	if (lun < 0) {
817 		return (CAM_LUN_INVALID);
818 	}
819 	if (is_lun_enabled(isp, bus, lun)) {
820 		return (CAM_LUN_ALRDY_ENA);
821 	}
822 	new = (tstate_t *) malloc(sizeof (tstate_t), M_DEVBUF, M_NOWAIT|M_ZERO);
823 	if (new == NULL) {
824 		return (CAM_RESRC_UNAVAIL);
825 	}
826 
827 	status = xpt_create_path(&new->owner, NULL, xpt_path_path_id(path),
828 	    xpt_path_target_id(path), xpt_path_lun_id(path));
829 	if (status != CAM_REQ_CMP) {
830 		free(new, M_DEVBUF);
831 		return (status);
832 	}
833 	new->bus = bus;
834 	new->lun = lun;
835 	SLIST_INIT(&new->atios);
836 	SLIST_INIT(&new->inots);
837 	new->hold = 1;
838 
839 	hfx = LUN_HASH_FUNC(isp, new->bus, new->lun);
840 	tptr = isp->isp_osinfo.lun_hash[hfx];
841 	if (tptr == NULL) {
842 		isp->isp_osinfo.lun_hash[hfx] = new;
843 	} else {
844 		while (tptr->next)
845 			tptr = tptr->next;
846 		tptr->next = new;
847 	}
848 	*rslt = new;
849 	return (CAM_REQ_CMP);
850 }
851 
852 static __inline void
853 destroy_lun_state(ispsoftc_t *isp, tstate_t *tptr)
854 {
855 	int hfx;
856 	tstate_t *lw, *pw;
857 
858 	if (tptr->hold) {
859 		return;
860 	}
861 	hfx = LUN_HASH_FUNC(isp, tptr->bus, tptr->lun);
862 	pw = isp->isp_osinfo.lun_hash[hfx];
863 	if (pw == NULL) {
864 		return;
865 	} else if (pw->lun == tptr->lun && pw->bus == tptr->bus) {
866 		isp->isp_osinfo.lun_hash[hfx] = pw->next;
867 	} else {
868 		lw = pw;
869 		pw = lw->next;
870 		while (pw) {
871 			if (pw->lun == tptr->lun && pw->bus == tptr->bus) {
872 				lw->next = pw->next;
873 				break;
874 			}
875 			lw = pw;
876 			pw = pw->next;
877 		}
878 		if (pw == NULL) {
879 			return;
880 		}
881 	}
882 	free(tptr, M_DEVBUF);
883 }
884 
885 /*
886  * Enable luns.
887  */
888 static int
889 isp_en_lun(ispsoftc_t *isp, union ccb *ccb)
890 {
891 	struct ccb_en_lun *cel = &ccb->cel;
892 	tstate_t *tptr;
893 	uint32_t seq;
894 	int bus, cmd, av, wildcard, tm_on;
895 	lun_id_t lun;
896 	target_id_t tgt;
897 
898 	bus = XS_CHANNEL(ccb);
899 	if (bus > 1) {
900 		xpt_print_path(ccb->ccb_h.path);
901 		printf("illegal bus %d\n", bus);
902 		ccb->ccb_h.status = CAM_PATH_INVALID;
903 		return (-1);
904 	}
905 	tgt = ccb->ccb_h.target_id;
906 	lun = ccb->ccb_h.target_lun;
907 
908 	isp_prt(isp, ISP_LOGTDEBUG0,
909 	    "isp_en_lun: %sabling lun 0x%x on channel %d",
910 	    cel->enable? "en" : "dis", lun, bus);
911 
912 
913 	if ((lun != CAM_LUN_WILDCARD) &&
914 	    (lun < 0 || lun >= (lun_id_t) isp->isp_maxluns)) {
915 		ccb->ccb_h.status = CAM_LUN_INVALID;
916 		return (-1);
917 	}
918 
919 	if (IS_SCSI(isp)) {
920 		sdparam *sdp = isp->isp_param;
921 		sdp += bus;
922 		if (tgt != CAM_TARGET_WILDCARD &&
923 		    tgt != sdp->isp_initiator_id) {
924 			ccb->ccb_h.status = CAM_TID_INVALID;
925 			return (-1);
926 		}
927 	} else {
928 		/*
929 		 * There's really no point in doing this yet w/o multi-tid
930 		 * capability. Even then, it's problematic.
931 		 */
932 #if	0
933 		if (tgt != CAM_TARGET_WILDCARD &&
934 		    tgt != FCPARAM(isp)->isp_iid) {
935 			ccb->ccb_h.status = CAM_TID_INVALID;
936 			return (-1);
937 		}
938 #endif
939 		/*
940 		 * This is as a good a place as any to check f/w capabilities.
941 		 */
942 		if (FCPARAM(isp)->isp_tmode == 0) {
943 			isp_prt(isp, ISP_LOGERR,
944 			    "firmware does not support target mode");
945 			ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
946 			return (-1);
947 		}
948 		/*
949 		 * XXX: We *could* handle non-SCCLUN f/w, but we'd have to
950 		 * XXX: dorks with our already fragile enable/disable code.
951 		 */
952 		if (FCPARAM(isp)->isp_sccfw == 0) {
953 			isp_prt(isp, ISP_LOGERR, "firmware not SCCLUN capable");
954 			ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
955 			return (-1);
956 		}
957 	}
958 
959 	if (tgt == CAM_TARGET_WILDCARD) {
960 		if (lun == CAM_LUN_WILDCARD) {
961 			wildcard = 1;
962 		} else {
963 			ccb->ccb_h.status = CAM_LUN_INVALID;
964 			return (-1);
965 		}
966 	} else {
967 		wildcard = 0;
968 	}
969 
970 	tm_on = (isp->isp_osinfo.tmflags[bus] & TM_TMODE_ENABLED) != 0;
971 
972 	/*
973 	 * Next check to see whether this is a target/lun wildcard action.
974 	 *
975 	 * If so, we know that we can accept commands for luns that haven't
976 	 * been enabled yet and send them upstream. Otherwise, we have to
977 	 * handle them locally (if we see them at all).
978 	 */
979 
980 	if (wildcard) {
981 		tptr = &isp->isp_osinfo.tsdflt[bus];
982 		if (cel->enable) {
983 			if (tm_on) {
984 				ccb->ccb_h.status = CAM_LUN_ALRDY_ENA;
985 				return (-1);
986 			}
987 			ccb->ccb_h.status =
988 			    xpt_create_path(&tptr->owner, NULL,
989 			    xpt_path_path_id(ccb->ccb_h.path),
990 			    xpt_path_target_id(ccb->ccb_h.path),
991 			    xpt_path_lun_id(ccb->ccb_h.path));
992 			if (ccb->ccb_h.status != CAM_REQ_CMP) {
993 				return (-1);
994 			}
995 			SLIST_INIT(&tptr->atios);
996 			SLIST_INIT(&tptr->inots);
997 			isp->isp_osinfo.tmflags[bus] |= TM_WILDCARD_ENABLED;
998 		} else {
999 			if (tm_on == 0) {
1000 				ccb->ccb_h.status = CAM_REQ_CMP;
1001 				return (-1);
1002 			}
1003 			if (tptr->hold) {
1004 				ccb->ccb_h.status = CAM_SCSI_BUSY;
1005 				return (-1);
1006 			}
1007 			xpt_free_path(tptr->owner);
1008 			isp->isp_osinfo.tmflags[bus] &= ~TM_WILDCARD_ENABLED;
1009 		}
1010 	}
1011 
1012 	/*
1013 	 * Now check to see whether this bus needs to be
1014 	 * enabled/disabled with respect to target mode.
1015 	 */
1016 	av = bus << 31;
1017 	if (cel->enable && tm_on == 0) {
1018 		av |= ENABLE_TARGET_FLAG;
1019 		av = isp_control(isp, ISPCTL_TOGGLE_TMODE, &av);
1020 		if (av) {
1021 			ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
1022 			if (wildcard) {
1023 				isp->isp_osinfo.tmflags[bus] &=
1024 				    ~TM_WILDCARD_ENABLED;
1025 				xpt_free_path(tptr->owner);
1026 			}
1027 			return (-1);
1028 		}
1029 		isp->isp_osinfo.tmflags[bus] |= TM_TMODE_ENABLED;
1030 		isp_prt(isp, ISP_LOGINFO,
1031 		    "Target Mode enabled on channel %d", bus);
1032 	} else if (cel->enable == 0 && tm_on && wildcard) {
1033 		if (are_any_luns_enabled(isp, bus)) {
1034 			ccb->ccb_h.status = CAM_SCSI_BUSY;
1035 			return (-1);
1036 		}
1037 		av = isp_control(isp, ISPCTL_TOGGLE_TMODE, &av);
1038 		if (av) {
1039 			ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
1040 			return (-1);
1041 		}
1042 		isp->isp_osinfo.tmflags[bus] &= ~TM_TMODE_ENABLED;
1043 		isp_prt(isp, ISP_LOGINFO,
1044 		    "Target Mode disabled on channel %d", bus);
1045 	}
1046 
1047 	if (wildcard) {
1048 		ccb->ccb_h.status = CAM_REQ_CMP;
1049 		return (-1);
1050 	}
1051 
1052 	/*
1053 	 * Find an empty slot
1054 	 */
1055 	for (seq = 0; seq < NLEACT; seq++) {
1056 		if (isp->isp_osinfo.leact[seq] == 0) {
1057 			break;
1058 		}
1059 	}
1060 	if (seq >= NLEACT) {
1061 		ccb->ccb_h.status = CAM_RESRC_UNAVAIL;
1062 		return (-1);
1063 
1064 	}
1065 	isp->isp_osinfo.leact[seq] = ccb;
1066 
1067 	if (cel->enable) {
1068 		ccb->ccb_h.status =
1069 		    create_lun_state(isp, bus, ccb->ccb_h.path, &tptr);
1070 		if (ccb->ccb_h.status != CAM_REQ_CMP) {
1071 			isp->isp_osinfo.leact[seq] = 0;
1072 			return (-1);
1073 		}
1074 	} else {
1075 		tptr = get_lun_statep(isp, bus, lun);
1076 		if (tptr == NULL) {
1077 			ccb->ccb_h.status = CAM_LUN_INVALID;
1078 			return (-1);
1079 		}
1080 	}
1081 
1082 	if (cel->enable) {
1083 		int c, n, ulun = lun;
1084 
1085 		cmd = RQSTYPE_ENABLE_LUN;
1086 		c = DFLT_CMND_CNT;
1087 		n = DFLT_INOT_CNT;
1088 		if (IS_FC(isp) && lun != 0) {
1089 			cmd = RQSTYPE_MODIFY_LUN;
1090 			n = 0;
1091 			/*
1092 		 	 * For SCC firmware, we only deal with setting
1093 			 * (enabling or modifying) lun 0.
1094 			 */
1095 			ulun = 0;
1096 		}
1097 		if (isp_lun_cmd(isp, cmd, bus, tgt, ulun, c, n, seq+1) == 0) {
1098 			rls_lun_statep(isp, tptr);
1099 			ccb->ccb_h.status = CAM_REQ_INPROG;
1100 			return (seq);
1101 		}
1102 	} else {
1103 		int c, n, ulun = lun;
1104 
1105 		cmd = -RQSTYPE_MODIFY_LUN;
1106 		c = DFLT_CMND_CNT;
1107 		n = DFLT_INOT_CNT;
1108 		if (IS_FC(isp) && lun != 0) {
1109 			n = 0;
1110 			/*
1111 		 	 * For SCC firmware, we only deal with setting
1112 			 * (enabling or modifying) lun 0.
1113 			 */
1114 			ulun = 0;
1115 		}
1116 		if (isp_lun_cmd(isp, cmd, bus, tgt, ulun, c, n, seq+1) == 0) {
1117 			rls_lun_statep(isp, tptr);
1118 			ccb->ccb_h.status = CAM_REQ_INPROG;
1119 			return (seq);
1120 		}
1121 	}
1122 	rls_lun_statep(isp, tptr);
1123 	xpt_print_path(ccb->ccb_h.path);
1124 	printf("isp_lun_cmd failed\n");
1125 	isp->isp_osinfo.leact[seq] = 0;
1126 	ccb->ccb_h.status = CAM_REQ_CMP_ERR;
1127 	return (-1);
1128 }
1129 
1130 static void
1131 isp_ledone(ispsoftc_t *isp, lun_entry_t *lep)
1132 {
1133 	const char lfmt[] = "lun %d now %sabled for target mode on channel %d";
1134 	union ccb *ccb;
1135 	uint32_t seq;
1136 	tstate_t *tptr;
1137 	int av;
1138 	struct ccb_en_lun *cel;
1139 
1140 	seq = lep->le_reserved - 1;
1141 	if (seq >= NLEACT) {
1142 		isp_prt(isp, ISP_LOGERR,
1143 		    "seq out of range (%u) in isp_ledone", seq);
1144 		return;
1145 	}
1146 	ccb = isp->isp_osinfo.leact[seq];
1147 	if (ccb == 0) {
1148 		isp_prt(isp, ISP_LOGERR,
1149 		    "no ccb for seq %u in isp_ledone", seq);
1150 		return;
1151 	}
1152 	cel = &ccb->cel;
1153 	tptr = get_lun_statep(isp, XS_CHANNEL(ccb), XS_LUN(ccb));
1154 	if (tptr == NULL) {
1155 		xpt_print_path(ccb->ccb_h.path);
1156 		printf("null tptr in isp_ledone\n");
1157 		isp->isp_osinfo.leact[seq] = 0;
1158 		return;
1159 	}
1160 
1161 	if (lep->le_status != LUN_OK) {
1162 		xpt_print_path(ccb->ccb_h.path);
1163 		printf("ENABLE/MODIFY LUN returned 0x%x\n", lep->le_status);
1164 err:
1165 		ccb->ccb_h.status = CAM_REQ_CMP_ERR;
1166 		xpt_print_path(ccb->ccb_h.path);
1167 		rls_lun_statep(isp, tptr);
1168 		isp->isp_osinfo.leact[seq] = 0;
1169 		ISPLOCK_2_CAMLOCK(isp);
1170 		xpt_done(ccb);
1171 		CAMLOCK_2_ISPLOCK(isp);
1172 		return;
1173 	} else {
1174 		isp_prt(isp, ISP_LOGTDEBUG0,
1175 		    "isp_ledone: ENABLE/MODIFY done okay");
1176 	}
1177 
1178 
1179 	if (cel->enable) {
1180 		ccb->ccb_h.status = CAM_REQ_CMP;
1181 		isp_prt(isp, ISP_LOGINFO, lfmt,
1182 		    XS_LUN(ccb), "en", XS_CHANNEL(ccb));
1183 		rls_lun_statep(isp, tptr);
1184 		isp->isp_osinfo.leact[seq] = 0;
1185 		ISPLOCK_2_CAMLOCK(isp);
1186 		xpt_done(ccb);
1187 		CAMLOCK_2_ISPLOCK(isp);
1188 		return;
1189 	}
1190 
1191 	if (lep->le_header.rqs_entry_type == RQSTYPE_MODIFY_LUN) {
1192 		if (isp_lun_cmd(isp, -RQSTYPE_ENABLE_LUN, XS_CHANNEL(ccb),
1193 		    XS_TGT(ccb), XS_LUN(ccb), 0, 0, seq+1)) {
1194 			xpt_print_path(ccb->ccb_h.path);
1195 			printf("isp_ledone: isp_lun_cmd failed\n");
1196 			goto err;
1197 		}
1198 		rls_lun_statep(isp, tptr);
1199 		return;
1200 	}
1201 
1202 	isp_prt(isp, ISP_LOGINFO, lfmt, XS_LUN(ccb), "dis", XS_CHANNEL(ccb));
1203 	rls_lun_statep(isp, tptr);
1204 	destroy_lun_state(isp, tptr);
1205 	ccb->ccb_h.status = CAM_REQ_CMP;
1206 	isp->isp_osinfo.leact[seq] = 0;
1207 	ISPLOCK_2_CAMLOCK(isp);
1208 	xpt_done(ccb);
1209 	CAMLOCK_2_ISPLOCK(isp);
1210 	if (are_any_luns_enabled(isp, XS_CHANNEL(ccb)) == 0) {
1211 		int bus = XS_CHANNEL(ccb);
1212 		av = bus << 31;
1213 		av = isp_control(isp, ISPCTL_TOGGLE_TMODE, &av);
1214 		if (av) {
1215 			isp_prt(isp, ISP_LOGWARN,
1216 			    "disable target mode on channel %d failed", bus);
1217 		} else {
1218 			isp_prt(isp, ISP_LOGINFO,
1219 			    "Target Mode disabled on channel %d", bus);
1220 		}
1221 		isp->isp_osinfo.tmflags[bus] &= ~TM_TMODE_ENABLED;
1222 	}
1223 }
1224 
1225 
1226 static cam_status
1227 isp_abort_tgt_ccb(ispsoftc_t *isp, union ccb *ccb)
1228 {
1229 	tstate_t *tptr;
1230 	struct ccb_hdr_slist *lp;
1231 	struct ccb_hdr *curelm;
1232 	int found, *ctr;
1233 	union ccb *accb = ccb->cab.abort_ccb;
1234 
1235 	isp_prt(isp, ISP_LOGTDEBUG0, "aborting ccb %p", accb);
1236 	if (accb->ccb_h.target_id != CAM_TARGET_WILDCARD) {
1237 		int badpath = 0;
1238 		if (IS_FC(isp) && (accb->ccb_h.target_id !=
1239 		    ((fcparam *) isp->isp_param)->isp_loopid)) {
1240 			badpath = 1;
1241 		} else if (IS_SCSI(isp) && (accb->ccb_h.target_id !=
1242 		    ((sdparam *) isp->isp_param)->isp_initiator_id)) {
1243 			badpath = 1;
1244 		}
1245 		if (badpath) {
1246 			/*
1247 			 * Being restrictive about target ids is really about
1248 			 * making sure we're aborting for the right multi-tid
1249 			 * path. This doesn't really make much sense at present.
1250 			 */
1251 #if	0
1252 			return (CAM_PATH_INVALID);
1253 #endif
1254 		}
1255 	}
1256 	tptr = get_lun_statep(isp, XS_CHANNEL(ccb), accb->ccb_h.target_lun);
1257 	if (tptr == NULL) {
1258 		isp_prt(isp, ISP_LOGTDEBUG0,
1259 		    "isp_abort_tgt_ccb: can't get statep");
1260 		return (CAM_PATH_INVALID);
1261 	}
1262 	if (accb->ccb_h.func_code == XPT_ACCEPT_TARGET_IO) {
1263 		lp = &tptr->atios;
1264 		ctr = &tptr->atio_count;
1265 	} else if (accb->ccb_h.func_code == XPT_IMMED_NOTIFY) {
1266 		lp = &tptr->inots;
1267 		ctr = &tptr->inot_count;
1268 	} else {
1269 		rls_lun_statep(isp, tptr);
1270 		isp_prt(isp, ISP_LOGTDEBUG0,
1271 		    "isp_abort_tgt_ccb: bad func %d\n", accb->ccb_h.func_code);
1272 		return (CAM_UA_ABORT);
1273 	}
1274 	curelm = SLIST_FIRST(lp);
1275 	found = 0;
1276 	if (curelm == &accb->ccb_h) {
1277 		found = 1;
1278 		SLIST_REMOVE_HEAD(lp, sim_links.sle);
1279 	} else {
1280 		while(curelm != NULL) {
1281 			struct ccb_hdr *nextelm;
1282 
1283 			nextelm = SLIST_NEXT(curelm, sim_links.sle);
1284 			if (nextelm == &accb->ccb_h) {
1285 				found = 1;
1286 				SLIST_NEXT(curelm, sim_links.sle) =
1287 				    SLIST_NEXT(nextelm, sim_links.sle);
1288 				break;
1289 			}
1290 			curelm = nextelm;
1291 		}
1292 	}
1293 	rls_lun_statep(isp, tptr);
1294 	if (found) {
1295 		(*ctr)--;
1296 		accb->ccb_h.status = CAM_REQ_ABORTED;
1297 		xpt_done(accb);
1298 		return (CAM_REQ_CMP);
1299 	}
1300 	isp_prt(isp, ISP_LOGTDEBUG0,
1301 	    "isp_abort_tgt_ccb: CCB %p not found\n", ccb);
1302 	return (CAM_PATH_INVALID);
1303 }
1304 
1305 static void
1306 isp_target_start_ctio(ispsoftc_t *isp, union ccb *ccb)
1307 {
1308 	void *qe;
1309 	struct ccb_scsiio *cso = &ccb->csio;
1310 	uint32_t nxti, optr, handle;
1311 	uint8_t local[QENTRY_LEN];
1312 
1313 
1314 	if (isp_getrqentry(isp, &nxti, &optr, &qe)) {
1315 		xpt_print_path(ccb->ccb_h.path);
1316 		printf("Request Queue Overflow in isp_target_start_ctio\n");
1317 		XS_SETERR(ccb, CAM_REQUEUE_REQ);
1318 		goto out;
1319 	}
1320 	memset(local, 0, QENTRY_LEN);
1321 
1322 	/*
1323 	 * We're either moving data or completing a command here.
1324 	 */
1325 
1326 	if (IS_FC(isp)) {
1327 		atio_private_data_t *atp;
1328 		ct2_entry_t *cto = (ct2_entry_t *) local;
1329 
1330 		cto->ct_header.rqs_entry_type = RQSTYPE_CTIO2;
1331 		cto->ct_header.rqs_entry_count = 1;
1332 		if (FCPARAM(isp)->isp_2klogin) {
1333 			((ct2e_entry_t *)cto)->ct_iid = cso->init_id;
1334 		} else {
1335 			cto->ct_iid = cso->init_id;
1336 			if (FCPARAM(isp)->isp_sccfw == 0) {
1337 				cto->ct_lun = ccb->ccb_h.target_lun;
1338 			}
1339 		}
1340 
1341 		atp = isp_get_atpd(isp, cso->tag_id);
1342 		if (atp == NULL) {
1343 			isp_prt(isp, ISP_LOGERR,
1344 			    "cannot find private data adjunct for tag %x",
1345 			    cso->tag_id);
1346 			XS_SETERR(ccb, CAM_REQ_CMP_ERR);
1347 			goto out;
1348 		}
1349 
1350 		cto->ct_rxid = cso->tag_id;
1351 		if (cso->dxfer_len == 0) {
1352 			cto->ct_flags |= CT2_FLAG_MODE1 | CT2_NO_DATA;
1353 			if (ccb->ccb_h.flags & CAM_SEND_STATUS) {
1354 				cto->ct_flags |= CT2_SENDSTATUS;
1355 				cto->rsp.m1.ct_scsi_status = cso->scsi_status;
1356 				cto->ct_resid =
1357 				    atp->orig_datalen - atp->bytes_xfered;
1358 				if (cto->ct_resid < 0) {
1359 					cto->rsp.m1.ct_scsi_status |=
1360 					    CT2_DATA_OVER;
1361 				} else if (cto->ct_resid > 0) {
1362 					cto->rsp.m1.ct_scsi_status |=
1363 					    CT2_DATA_UNDER;
1364 				}
1365 			}
1366 			if ((ccb->ccb_h.flags & CAM_SEND_SENSE) != 0) {
1367 				int m = min(cso->sense_len, MAXRESPLEN);
1368 				memcpy(cto->rsp.m1.ct_resp,
1369 				    &cso->sense_data, m);
1370 				cto->rsp.m1.ct_senselen = m;
1371 				cto->rsp.m1.ct_scsi_status |= CT2_SNSLEN_VALID;
1372 			}
1373 		} else {
1374 			cto->ct_flags |= CT2_FLAG_MODE0;
1375 			if ((cso->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN) {
1376 				cto->ct_flags |= CT2_DATA_IN;
1377 			} else {
1378 				cto->ct_flags |= CT2_DATA_OUT;
1379 			}
1380 			cto->ct_reloff = atp->bytes_xfered;
1381 			if ((ccb->ccb_h.flags & CAM_SEND_STATUS) != 0) {
1382 				cto->ct_flags |= CT2_SENDSTATUS;
1383 				cto->rsp.m0.ct_scsi_status = cso->scsi_status;
1384 				cto->ct_resid =
1385 				    atp->orig_datalen -
1386 				    (atp->bytes_xfered + cso->dxfer_len);
1387 				if (cto->ct_resid < 0) {
1388 					cto->rsp.m0.ct_scsi_status |=
1389 					    CT2_DATA_OVER;
1390 				} else if (cto->ct_resid > 0) {
1391 					cto->rsp.m0.ct_scsi_status |=
1392 					    CT2_DATA_UNDER;
1393 				}
1394 			} else {
1395 				atp->last_xframt = cso->dxfer_len;
1396 			}
1397 			/*
1398 			 * If we're sending data and status back together,
1399 			 * we can't also send back sense data as well.
1400 			 */
1401 			ccb->ccb_h.flags &= ~CAM_SEND_SENSE;
1402 		}
1403 
1404 		if (cto->ct_flags & CT2_SENDSTATUS) {
1405 			isp_prt(isp, ISP_LOGTDEBUG0,
1406 			    "CTIO2[%x] STATUS %x origd %u curd %u resid %u",
1407 			    cto->ct_rxid, cso->scsi_status, atp->orig_datalen,
1408 			    cso->dxfer_len, cto->ct_resid);
1409 			cto->ct_flags |= CT2_CCINCR;
1410 			atp->state = ATPD_STATE_LAST_CTIO;
1411 		} else {
1412 			atp->state = ATPD_STATE_CTIO;
1413 		}
1414 		cto->ct_timeout = 10;
1415 	} else {
1416 		ct_entry_t *cto = (ct_entry_t *) local;
1417 
1418 		cto->ct_header.rqs_entry_type = RQSTYPE_CTIO;
1419 		cto->ct_header.rqs_entry_count = 1;
1420 		cto->ct_iid = cso->init_id;
1421 		cto->ct_iid |= XS_CHANNEL(ccb) << 7;
1422 		cto->ct_tgt = ccb->ccb_h.target_id;
1423 		cto->ct_lun = ccb->ccb_h.target_lun;
1424 		cto->ct_fwhandle = AT_GET_HANDLE(cso->tag_id);
1425 		if (AT_HAS_TAG(cso->tag_id)) {
1426 			cto->ct_tag_val = (uint8_t) AT_GET_TAG(cso->tag_id);
1427 			cto->ct_flags |= CT_TQAE;
1428 		}
1429 		if (ccb->ccb_h.flags & CAM_DIS_DISCONNECT) {
1430 			cto->ct_flags |= CT_NODISC;
1431 		}
1432 		if (cso->dxfer_len == 0) {
1433 			cto->ct_flags |= CT_NO_DATA;
1434 		} else if ((cso->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN) {
1435 			cto->ct_flags |= CT_DATA_IN;
1436 		} else {
1437 			cto->ct_flags |= CT_DATA_OUT;
1438 		}
1439 		if (ccb->ccb_h.flags & CAM_SEND_STATUS) {
1440 			cto->ct_flags |= CT_SENDSTATUS|CT_CCINCR;
1441 			cto->ct_scsi_status = cso->scsi_status;
1442 			cto->ct_resid = cso->resid;
1443 			isp_prt(isp, ISP_LOGTDEBUG0,
1444 			    "CTIO[%x] SCSI STATUS 0x%x resid %d tag_id %x",
1445 			    cto->ct_fwhandle, cso->scsi_status, cso->resid,
1446 			    cso->tag_id);
1447 		}
1448 		ccb->ccb_h.flags &= ~CAM_SEND_SENSE;
1449 		cto->ct_timeout = 10;
1450 	}
1451 
1452 	if (isp_save_xs_tgt(isp, ccb, &handle)) {
1453 		xpt_print_path(ccb->ccb_h.path);
1454 		printf("No XFLIST pointers for isp_target_start_ctio\n");
1455 		XS_SETERR(ccb, CAM_REQUEUE_REQ);
1456 		goto out;
1457 	}
1458 
1459 
1460 	/*
1461 	 * Call the dma setup routines for this entry (and any subsequent
1462 	 * CTIOs) if there's data to move, and then tell the f/w it's got
1463 	 * new things to play with. As with isp_start's usage of DMA setup,
1464 	 * any swizzling is done in the machine dependent layer. Because
1465 	 * of this, we put the request onto the queue area first in native
1466 	 * format.
1467 	 */
1468 
1469 	if (IS_FC(isp)) {
1470 		ct2_entry_t *cto = (ct2_entry_t *) local;
1471 		cto->ct_syshandle = handle;
1472 	} else {
1473 		ct_entry_t *cto = (ct_entry_t *) local;
1474 		cto->ct_syshandle = handle;
1475 	}
1476 
1477 	switch (ISP_DMASETUP(isp, cso, (ispreq_t *) local, &nxti, optr)) {
1478 	case CMD_QUEUED:
1479 		ISP_ADD_REQUEST(isp, nxti);
1480 		ccb->ccb_h.status |= CAM_SIM_QUEUED;
1481 		return;
1482 
1483 	case CMD_EAGAIN:
1484 		XS_SETERR(ccb, CAM_REQUEUE_REQ);
1485 		break;
1486 
1487 	default:
1488 		break;
1489 	}
1490 	isp_destroy_tgt_handle(isp, handle);
1491 
1492 out:
1493 	ISPLOCK_2_CAMLOCK(isp);
1494 	xpt_done(ccb);
1495 	CAMLOCK_2_ISPLOCK(isp);
1496 }
1497 
1498 static void
1499 isp_refire_putback_atio(void *arg)
1500 {
1501 	int s = splcam();
1502 	isp_target_putback_atio(arg);
1503 	splx(s);
1504 }
1505 
1506 static void
1507 isp_target_putback_atio(union ccb *ccb)
1508 {
1509 	ispsoftc_t *isp;
1510 	struct ccb_scsiio *cso;
1511 	uint32_t nxti, optr;
1512 	void *qe;
1513 
1514 	isp = XS_ISP(ccb);
1515 
1516 	if (isp_getrqentry(isp, &nxti, &optr, &qe)) {
1517 		(void) timeout(isp_refire_putback_atio, ccb, 10);
1518 		isp_prt(isp, ISP_LOGWARN,
1519 		    "isp_target_putback_atio: Request Queue Overflow");
1520 		return;
1521 	}
1522 	memset(qe, 0, QENTRY_LEN);
1523 	cso = &ccb->csio;
1524 	if (IS_FC(isp)) {
1525 		at2_entry_t local, *at = &local;
1526 		MEMZERO(at, sizeof (at2_entry_t));
1527 		at->at_header.rqs_entry_type = RQSTYPE_ATIO2;
1528 		at->at_header.rqs_entry_count = 1;
1529 		if (FCPARAM(isp)->isp_sccfw) {
1530 			at->at_scclun = (uint16_t) ccb->ccb_h.target_lun;
1531 		} else {
1532 			at->at_lun = (uint8_t) ccb->ccb_h.target_lun;
1533 		}
1534 		at->at_status = CT_OK;
1535 		at->at_rxid = cso->tag_id;
1536 		at->at_iid = cso->ccb_h.target_id;
1537 		isp_put_atio2(isp, at, qe);
1538 	} else {
1539 		at_entry_t local, *at = &local;
1540 		MEMZERO(at, sizeof (at_entry_t));
1541 		at->at_header.rqs_entry_type = RQSTYPE_ATIO;
1542 		at->at_header.rqs_entry_count = 1;
1543 		at->at_iid = cso->init_id;
1544 		at->at_iid |= XS_CHANNEL(ccb) << 7;
1545 		at->at_tgt = cso->ccb_h.target_id;
1546 		at->at_lun = cso->ccb_h.target_lun;
1547 		at->at_status = CT_OK;
1548 		at->at_tag_val = AT_GET_TAG(cso->tag_id);
1549 		at->at_handle = AT_GET_HANDLE(cso->tag_id);
1550 		isp_put_atio(isp, at, qe);
1551 	}
1552 	ISP_TDQE(isp, "isp_target_putback_atio", (int) optr, qe);
1553 	ISP_ADD_REQUEST(isp, nxti);
1554 	isp_complete_ctio(ccb);
1555 }
1556 
1557 static void
1558 isp_complete_ctio(union ccb *ccb)
1559 {
1560 	ISPLOCK_2_CAMLOCK(isp);
1561 	if ((ccb->ccb_h.status & CAM_STATUS_MASK) == CAM_REQ_INPROG) {
1562 		ccb->ccb_h.status |= CAM_REQ_CMP;
1563 	}
1564 	ccb->ccb_h.status &= ~CAM_SIM_QUEUED;
1565 	xpt_done(ccb);
1566 	CAMLOCK_2_ISPLOCK(isp);
1567 }
1568 
1569 /*
1570  * Handle ATIO stuff that the generic code can't.
1571  * This means handling CDBs.
1572  */
1573 
1574 static int
1575 isp_handle_platform_atio(ispsoftc_t *isp, at_entry_t *aep)
1576 {
1577 	tstate_t *tptr;
1578 	int status, bus, iswildcard;
1579 	struct ccb_accept_tio *atiop;
1580 
1581 	/*
1582 	 * The firmware status (except for the QLTM_SVALID bit)
1583 	 * indicates why this ATIO was sent to us.
1584 	 *
1585 	 * If QLTM_SVALID is set, the firware has recommended Sense Data.
1586 	 *
1587 	 * If the DISCONNECTS DISABLED bit is set in the flags field,
1588 	 * we're still connected on the SCSI bus.
1589 	 */
1590 	status = aep->at_status;
1591 	if ((status & ~QLTM_SVALID) == AT_PHASE_ERROR) {
1592 		/*
1593 		 * Bus Phase Sequence error. We should have sense data
1594 		 * suggested by the f/w. I'm not sure quite yet what
1595 		 * to do about this for CAM.
1596 		 */
1597 		isp_prt(isp, ISP_LOGWARN, "PHASE ERROR");
1598 		isp_endcmd(isp, aep, SCSI_STATUS_BUSY, 0);
1599 		return (0);
1600 	}
1601 	if ((status & ~QLTM_SVALID) != AT_CDB) {
1602 		isp_prt(isp, ISP_LOGWARN, "bad atio (0x%x) leaked to platform",
1603 		    status);
1604 		isp_endcmd(isp, aep, SCSI_STATUS_BUSY, 0);
1605 		return (0);
1606 	}
1607 
1608 	bus = GET_BUS_VAL(aep->at_iid);
1609 	tptr = get_lun_statep(isp, bus, aep->at_lun);
1610 	if (tptr == NULL) {
1611 		tptr = get_lun_statep(isp, bus, CAM_LUN_WILDCARD);
1612 		if (tptr == NULL) {
1613 			/*
1614 			 * Because we can't autofeed sense data back with
1615 			 * a command for parallel SCSI, we can't give back
1616 			 * a CHECK CONDITION. We'll give back a BUSY status
1617 			 * instead. This works out okay because the only
1618 			 * time we should, in fact, get this, is in the
1619 			 * case that somebody configured us without the
1620 			 * blackhole driver, so they get what they deserve.
1621 			 */
1622 			isp_endcmd(isp, aep, SCSI_STATUS_BUSY, 0);
1623 			return (0);
1624 		}
1625 		iswildcard = 1;
1626 	} else {
1627 		iswildcard = 0;
1628 	}
1629 
1630 	atiop = (struct ccb_accept_tio *) SLIST_FIRST(&tptr->atios);
1631 	if (atiop == NULL) {
1632 		/*
1633 		 * Because we can't autofeed sense data back with
1634 		 * a command for parallel SCSI, we can't give back
1635 		 * a CHECK CONDITION. We'll give back a QUEUE FULL status
1636 		 * instead. This works out okay because the only time we
1637 		 * should, in fact, get this, is in the case that we've
1638 		 * run out of ATIOS.
1639 		 */
1640 		xpt_print_path(tptr->owner);
1641 		isp_prt(isp, ISP_LOGWARN,
1642 		    "no ATIOS for lun %d from initiator %d on channel %d",
1643 		    aep->at_lun, GET_IID_VAL(aep->at_iid), bus);
1644 		if (aep->at_flags & AT_TQAE)
1645 			isp_endcmd(isp, aep, SCSI_STATUS_QUEUE_FULL, 0);
1646 		else
1647 			isp_endcmd(isp, aep, SCSI_STATUS_BUSY, 0);
1648 		rls_lun_statep(isp, tptr);
1649 		return (0);
1650 	}
1651 	SLIST_REMOVE_HEAD(&tptr->atios, sim_links.sle);
1652 	tptr->atio_count--;
1653 	isp_prt(isp, ISP_LOGTDEBUG0, "Take FREE ATIO lun %d, count now %d",
1654 	    aep->at_lun, tptr->atio_count);
1655 	if (iswildcard) {
1656 		atiop->ccb_h.target_id = aep->at_tgt;
1657 		atiop->ccb_h.target_lun = aep->at_lun;
1658 	}
1659 	if (aep->at_flags & AT_NODISC) {
1660 		atiop->ccb_h.flags = CAM_DIS_DISCONNECT;
1661 	} else {
1662 		atiop->ccb_h.flags = 0;
1663 	}
1664 
1665 	if (status & QLTM_SVALID) {
1666 		size_t amt = imin(QLTM_SENSELEN, sizeof (atiop->sense_data));
1667 		atiop->sense_len = amt;
1668 		MEMCPY(&atiop->sense_data, aep->at_sense, amt);
1669 	} else {
1670 		atiop->sense_len = 0;
1671 	}
1672 
1673 	atiop->init_id = GET_IID_VAL(aep->at_iid);
1674 	atiop->cdb_len = aep->at_cdblen;
1675 	MEMCPY(atiop->cdb_io.cdb_bytes, aep->at_cdb, aep->at_cdblen);
1676 	atiop->ccb_h.status = CAM_CDB_RECVD;
1677 	/*
1678 	 * Construct a tag 'id' based upon tag value (which may be 0..255)
1679 	 * and the handle (which we have to preserve).
1680 	 */
1681 	AT_MAKE_TAGID(atiop->tag_id,  device_get_unit(isp->isp_dev), aep);
1682 	if (aep->at_flags & AT_TQAE) {
1683 		atiop->tag_action = aep->at_tag_type;
1684 		atiop->ccb_h.status |= CAM_TAG_ACTION_VALID;
1685 	}
1686 	xpt_done((union ccb*)atiop);
1687 	isp_prt(isp, ISP_LOGTDEBUG0,
1688 	    "ATIO[%x] CDB=0x%x bus %d iid%d->lun%d tag 0x%x ttype 0x%x %s",
1689 	    aep->at_handle, aep->at_cdb[0] & 0xff, GET_BUS_VAL(aep->at_iid),
1690 	    GET_IID_VAL(aep->at_iid), aep->at_lun, aep->at_tag_val & 0xff,
1691 	    aep->at_tag_type, (aep->at_flags & AT_NODISC)?
1692 	    "nondisc" : "disconnecting");
1693 	rls_lun_statep(isp, tptr);
1694 	return (0);
1695 }
1696 
1697 static int
1698 isp_handle_platform_atio2(ispsoftc_t *isp, at2_entry_t *aep)
1699 {
1700 	lun_id_t lun;
1701 	tstate_t *tptr;
1702 	struct ccb_accept_tio *atiop;
1703 	atio_private_data_t *atp;
1704 
1705 	/*
1706 	 * The firmware status (except for the QLTM_SVALID bit)
1707 	 * indicates why this ATIO was sent to us.
1708 	 *
1709 	 * If QLTM_SVALID is set, the firware has recommended Sense Data.
1710 	 */
1711 	if ((aep->at_status & ~QLTM_SVALID) != AT_CDB) {
1712 		isp_prt(isp, ISP_LOGWARN,
1713 		    "bogus atio (0x%x) leaked to platform", aep->at_status);
1714 		isp_endcmd(isp, aep, SCSI_STATUS_BUSY, 0);
1715 		return (0);
1716 	}
1717 
1718 	if (FCPARAM(isp)->isp_sccfw) {
1719 		lun = aep->at_scclun;
1720 	} else {
1721 		lun = aep->at_lun;
1722 	}
1723 	tptr = get_lun_statep(isp, 0, lun);
1724 	if (tptr == NULL) {
1725 		isp_prt(isp, ISP_LOGTDEBUG0,
1726 		    "[0x%x] no state pointer for lun %d", aep->at_rxid, lun);
1727 		tptr = get_lun_statep(isp, 0, CAM_LUN_WILDCARD);
1728 		if (tptr == NULL) {
1729 			isp_endcmd(isp, aep,
1730 			    SCSI_STATUS_CHECK_COND | ECMD_SVALID |
1731 			    (0x5 << 12) | (0x25 << 16), 0);
1732 			return (0);
1733 		}
1734 	}
1735 
1736 	atp = isp_get_atpd(isp, 0);
1737 	atiop = (struct ccb_accept_tio *) SLIST_FIRST(&tptr->atios);
1738 	if (atiop == NULL || atp == NULL) {
1739 
1740 		/*
1741 		 * Because we can't autofeed sense data back with
1742 		 * a command for parallel SCSI, we can't give back
1743 		 * a CHECK CONDITION. We'll give back a QUEUE FULL status
1744 		 * instead. This works out okay because the only time we
1745 		 * should, in fact, get this, is in the case that we've
1746 		 * run out of ATIOS.
1747 		 */
1748 		xpt_print_path(tptr->owner);
1749 		isp_prt(isp, ISP_LOGWARN,
1750 		    "no %s for lun %d from initiator %d",
1751 		    (atp == NULL && atiop == NULL)? "ATIO2s *or* ATPS" :
1752 		    ((atp == NULL)? "ATPs" : "ATIO2s"), lun, aep->at_iid);
1753 		rls_lun_statep(isp, tptr);
1754 		isp_endcmd(isp, aep, SCSI_STATUS_QUEUE_FULL, 0);
1755 		return (0);
1756 	}
1757 	atp->state = ATPD_STATE_ATIO;
1758 	SLIST_REMOVE_HEAD(&tptr->atios, sim_links.sle);
1759 	tptr->atio_count--;
1760 	isp_prt(isp, ISP_LOGTDEBUG0, "Take FREE ATIO lun %d, count now %d",
1761 	    lun, tptr->atio_count);
1762 
1763 	if (tptr == &isp->isp_osinfo.tsdflt[0]) {
1764 		atiop->ccb_h.target_id = FCPARAM(isp)->isp_loopid;
1765 		atiop->ccb_h.target_lun = lun;
1766 	}
1767 	/*
1768 	 * We don't get 'suggested' sense data as we do with SCSI cards.
1769 	 */
1770 	atiop->sense_len = 0;
1771 
1772 	atiop->init_id = aep->at_iid;
1773 	atiop->cdb_len = ATIO2_CDBLEN;
1774 	MEMCPY(atiop->cdb_io.cdb_bytes, aep->at_cdb, ATIO2_CDBLEN);
1775 	atiop->ccb_h.status = CAM_CDB_RECVD;
1776 	atiop->tag_id = aep->at_rxid;
1777 	switch (aep->at_taskflags & ATIO2_TC_ATTR_MASK) {
1778 	case ATIO2_TC_ATTR_SIMPLEQ:
1779 		atiop->tag_action = MSG_SIMPLE_Q_TAG;
1780 		break;
1781         case ATIO2_TC_ATTR_HEADOFQ:
1782 		atiop->tag_action = MSG_HEAD_OF_Q_TAG;
1783 		break;
1784         case ATIO2_TC_ATTR_ORDERED:
1785 		atiop->tag_action = MSG_ORDERED_Q_TAG;
1786 		break;
1787         case ATIO2_TC_ATTR_ACAQ:		/* ?? */
1788 	case ATIO2_TC_ATTR_UNTAGGED:
1789 	default:
1790 		atiop->tag_action = 0;
1791 		break;
1792 	}
1793 	atiop->ccb_h.flags = CAM_TAG_ACTION_VALID;
1794 
1795 	atp->tag = atiop->tag_id;
1796 	atp->lun = lun;
1797 	atp->orig_datalen = aep->at_datalen;
1798 	atp->last_xframt = 0;
1799 	atp->bytes_xfered = 0;
1800 	atp->state = ATPD_STATE_CAM;
1801 	ISPLOCK_2_CAMLOCK(siP);
1802 	xpt_done((union ccb*)atiop);
1803 
1804 	isp_prt(isp, ISP_LOGTDEBUG0,
1805 	    "ATIO2[%x] CDB=0x%x iid%d->lun%d tattr 0x%x datalen %u",
1806 	    aep->at_rxid, aep->at_cdb[0] & 0xff, aep->at_iid,
1807 	    lun, aep->at_taskflags, aep->at_datalen);
1808 	rls_lun_statep(isp, tptr);
1809 	return (0);
1810 }
1811 
1812 static int
1813 isp_handle_platform_ctio(ispsoftc_t *isp, void *arg)
1814 {
1815 	union ccb *ccb;
1816 	int sentstatus, ok, notify_cam, resid = 0;
1817 	uint16_t tval;
1818 
1819 	/*
1820 	 * CTIO and CTIO2 are close enough....
1821 	 */
1822 
1823 	ccb = isp_find_xs_tgt(isp, ((ct_entry_t *)arg)->ct_syshandle);
1824 	KASSERT((ccb != NULL), ("null ccb in isp_handle_platform_ctio"));
1825 	isp_destroy_tgt_handle(isp, ((ct_entry_t *)arg)->ct_syshandle);
1826 
1827 	if (IS_FC(isp)) {
1828 		ct2_entry_t *ct = arg;
1829 		atio_private_data_t *atp = isp_get_atpd(isp, ct->ct_rxid);
1830 		if (atp == NULL) {
1831 			isp_prt(isp, ISP_LOGERR,
1832 			    "cannot find adjunct for %x after I/O",
1833 			    ct->ct_rxid);
1834 			return (0);
1835 		}
1836 		sentstatus = ct->ct_flags & CT2_SENDSTATUS;
1837 		ok = (ct->ct_status & ~QLTM_SVALID) == CT_OK;
1838 		if (ok && sentstatus && (ccb->ccb_h.flags & CAM_SEND_SENSE)) {
1839 			ccb->ccb_h.status |= CAM_SENT_SENSE;
1840 		}
1841 		notify_cam = ct->ct_header.rqs_seqno & 0x1;
1842 		if ((ct->ct_flags & CT2_DATAMASK) != CT2_NO_DATA) {
1843 			resid = ct->ct_resid;
1844 			atp->bytes_xfered += (atp->last_xframt - resid);
1845 			atp->last_xframt = 0;
1846 		}
1847 		if (sentstatus || !ok) {
1848 			atp->tag = 0;
1849 		}
1850 		isp_prt(isp, ok? ISP_LOGTDEBUG0 : ISP_LOGWARN,
1851 		    "CTIO2[%x] sts 0x%x flg 0x%x sns %d resid %d %s",
1852 		    ct->ct_rxid, ct->ct_status, ct->ct_flags,
1853 		    (ccb->ccb_h.status & CAM_SENT_SENSE) != 0,
1854 		    resid, sentstatus? "FIN" : "MID");
1855 		tval = ct->ct_rxid;
1856 
1857 		/* XXX: should really come after isp_complete_ctio */
1858 		atp->state = ATPD_STATE_PDON;
1859 	} else {
1860 		ct_entry_t *ct = arg;
1861 		sentstatus = ct->ct_flags & CT_SENDSTATUS;
1862 		ok = (ct->ct_status  & ~QLTM_SVALID) == CT_OK;
1863 		/*
1864 		 * We *ought* to be able to get back to the original ATIO
1865 		 * here, but for some reason this gets lost. It's just as
1866 		 * well because it's squirrelled away as part of periph
1867 		 * private data.
1868 		 *
1869 		 * We can live without it as long as we continue to use
1870 		 * the auto-replenish feature for CTIOs.
1871 		 */
1872 		notify_cam = ct->ct_header.rqs_seqno & 0x1;
1873 		if (ct->ct_status & QLTM_SVALID) {
1874 			char *sp = (char *)ct;
1875 			sp += CTIO_SENSE_OFFSET;
1876 			ccb->csio.sense_len =
1877 			    min(sizeof (ccb->csio.sense_data), QLTM_SENSELEN);
1878 			MEMCPY(&ccb->csio.sense_data, sp, ccb->csio.sense_len);
1879 			ccb->ccb_h.status |= CAM_AUTOSNS_VALID;
1880 		}
1881 		if ((ct->ct_flags & CT_DATAMASK) != CT_NO_DATA) {
1882 			resid = ct->ct_resid;
1883 		}
1884 		isp_prt(isp, ISP_LOGTDEBUG0,
1885 		    "CTIO[%x] tag %x iid %d lun %d sts %x flg %x resid %d %s",
1886 		    ct->ct_fwhandle, ct->ct_tag_val, ct->ct_iid, ct->ct_lun,
1887 		    ct->ct_status, ct->ct_flags, resid,
1888 		    sentstatus? "FIN" : "MID");
1889 		tval = ct->ct_fwhandle;
1890 	}
1891 	ccb->csio.resid += resid;
1892 
1893 	/*
1894 	 * We're here either because intermediate data transfers are done
1895 	 * and/or the final status CTIO (which may have joined with a
1896 	 * Data Transfer) is done.
1897 	 *
1898 	 * In any case, for this platform, the upper layers figure out
1899 	 * what to do next, so all we do here is collect status and
1900 	 * pass information along. Any DMA handles have already been
1901 	 * freed.
1902 	 */
1903 	if (notify_cam == 0) {
1904 		isp_prt(isp, ISP_LOGTDEBUG0, "  INTER CTIO[0x%x] done", tval);
1905 		return (0);
1906 	}
1907 
1908 	isp_prt(isp, ISP_LOGTDEBUG0, "%s CTIO[0x%x] done",
1909 	    (sentstatus)? "  FINAL " : "MIDTERM ", tval);
1910 
1911 	if (!ok) {
1912 		isp_target_putback_atio(ccb);
1913 	} else {
1914 		isp_complete_ctio(ccb);
1915 
1916 	}
1917 	return (0);
1918 }
1919 
1920 static int
1921 isp_handle_platform_notify_scsi(ispsoftc_t *isp, in_entry_t *inp)
1922 {
1923 	return (0);	/* XXXX */
1924 }
1925 
1926 static int
1927 isp_handle_platform_notify_fc(ispsoftc_t *isp, in_fcentry_t *inp)
1928 {
1929 
1930 	switch (inp->in_status) {
1931 	case IN_PORT_LOGOUT:
1932 		isp_prt(isp, ISP_LOGWARN, "port logout of iid %d",
1933 		   inp->in_iid);
1934 		break;
1935 	case IN_PORT_CHANGED:
1936 		isp_prt(isp, ISP_LOGWARN, "port changed for iid %d",
1937 		   inp->in_iid);
1938 		break;
1939 	case IN_GLOBAL_LOGO:
1940 		isp_prt(isp, ISP_LOGINFO, "all ports logged out");
1941 		break;
1942 	case IN_ABORT_TASK:
1943 	{
1944 		atio_private_data_t *atp = isp_get_atpd(isp, inp->in_seqid);
1945 		struct ccb_immed_notify *inot = NULL;
1946 
1947 		if (atp) {
1948 			tstate_t *tptr = get_lun_statep(isp, 0, atp->lun);
1949 			if (tptr) {
1950 				inot = (struct ccb_immed_notify *)
1951 				    SLIST_FIRST(&tptr->inots);
1952 				if (inot) {
1953 					tptr->inot_count--;
1954 					SLIST_REMOVE_HEAD(&tptr->inots,
1955 					    sim_links.sle);
1956 					isp_prt(isp, ISP_LOGTDEBUG0,
1957 					    "Take FREE INOT count now %d",
1958 					    tptr->inot_count);
1959 				}
1960 			}
1961 			isp_prt(isp, ISP_LOGWARN,
1962 			   "abort task RX_ID %x IID %d state %d",
1963 			   inp->in_seqid, inp->in_iid, atp->state);
1964 		} else {
1965 			isp_prt(isp, ISP_LOGWARN,
1966 			   "abort task RX_ID %x from iid %d, state unknown",
1967 			   inp->in_seqid, inp->in_iid);
1968 		}
1969 		if (inot) {
1970 			inot->initiator_id = inp->in_iid;
1971 			inot->sense_len = 0;
1972 			inot->message_args[0] = MSG_ABORT_TAG;
1973 			inot->message_args[1] = inp->in_seqid & 0xff;
1974 			inot->message_args[2] = (inp->in_seqid >> 8) & 0xff;
1975 			inot->ccb_h.status = CAM_MESSAGE_RECV;
1976 			xpt_done((union ccb *)inot);
1977 		}
1978 		break;
1979 	}
1980 	default:
1981 		break;
1982 	}
1983 	return (0);
1984 }
1985 #endif
1986 
1987 static void
1988 isp_cam_async(void *cbarg, uint32_t code, struct cam_path *path, void *arg)
1989 {
1990 	struct cam_sim *sim;
1991 	ispsoftc_t *isp;
1992 
1993 	sim = (struct cam_sim *)cbarg;
1994 	isp = (ispsoftc_t *) cam_sim_softc(sim);
1995 	switch (code) {
1996 	case AC_LOST_DEVICE:
1997 		if (IS_SCSI(isp)) {
1998 			uint16_t oflags, nflags;
1999 			sdparam *sdp = isp->isp_param;
2000 			int tgt;
2001 
2002 			tgt = xpt_path_target_id(path);
2003 			if (tgt >= 0) {
2004 				sdp += cam_sim_bus(sim);
2005 				ISP_LOCK(isp);
2006 				nflags = sdp->isp_devparam[tgt].nvrm_flags;
2007 #ifndef	ISP_TARGET_MODE
2008 				nflags &= DPARM_SAFE_DFLT;
2009 				if (isp->isp_loaded_fw) {
2010 					nflags |= DPARM_NARROW | DPARM_ASYNC;
2011 				}
2012 #else
2013 				nflags = DPARM_DEFAULT;
2014 #endif
2015 				oflags = sdp->isp_devparam[tgt].goal_flags;
2016 				sdp->isp_devparam[tgt].goal_flags = nflags;
2017 				sdp->isp_devparam[tgt].dev_update = 1;
2018 				isp->isp_update |= (1 << cam_sim_bus(sim));
2019 				(void) isp_control(isp,
2020 				    ISPCTL_UPDATE_PARAMS, NULL);
2021 				sdp->isp_devparam[tgt].goal_flags = oflags;
2022 				ISP_UNLOCK(isp);
2023 			}
2024 		}
2025 		break;
2026 	default:
2027 		isp_prt(isp, ISP_LOGWARN, "isp_cam_async: Code 0x%x", code);
2028 		break;
2029 	}
2030 }
2031 
2032 static void
2033 isp_poll(struct cam_sim *sim)
2034 {
2035 	ispsoftc_t *isp = cam_sim_softc(sim);
2036 	uint32_t isr;
2037 	uint16_t sema, mbox;
2038 
2039 	ISP_LOCK(isp);
2040 	if (ISP_READ_ISR(isp, &isr, &sema, &mbox)) {
2041 		isp_intr(isp, isr, sema, mbox);
2042 	}
2043 	ISP_UNLOCK(isp);
2044 }
2045 
2046 
2047 static int isp_watchdog_work(ispsoftc_t *, XS_T *);
2048 
2049 static int
2050 isp_watchdog_work(ispsoftc_t *isp, XS_T *xs)
2051 {
2052 	uint32_t handle;
2053 
2054 	/*
2055 	 * We've decided this command is dead. Make sure we're not trying
2056 	 * to kill a command that's already dead by getting it's handle and
2057 	 * and seeing whether it's still alive.
2058 	 */
2059 	ISP_LOCK(isp);
2060 	handle = isp_find_handle(isp, xs);
2061 	if (handle) {
2062 		uint32_t isr;
2063 		uint16_t sema, mbox;
2064 
2065 		if (XS_CMD_DONE_P(xs)) {
2066 			isp_prt(isp, ISP_LOGDEBUG1,
2067 			    "watchdog found done cmd (handle 0x%x)", handle);
2068 			ISP_UNLOCK(isp);
2069 			return (1);;
2070 		}
2071 
2072 		if (XS_CMD_WDOG_P(xs)) {
2073 			isp_prt(isp, ISP_LOGDEBUG2,
2074 			    "recursive watchdog (handle 0x%x)", handle);
2075 			ISP_UNLOCK(isp);
2076 			return (1);
2077 		}
2078 
2079 		XS_CMD_S_WDOG(xs);
2080 		if (ISP_READ_ISR(isp, &isr, &sema, &mbox)) {
2081 			isp_intr(isp, isr, sema, mbox);
2082 		}
2083 		if (XS_CMD_DONE_P(xs)) {
2084 			isp_prt(isp, ISP_LOGDEBUG2,
2085 			    "watchdog cleanup for handle 0x%x", handle);
2086 			ISPLOCK_2_CAMLOCK(isp);
2087 			xpt_done((union ccb *) xs);
2088 			CAMLOCK_2_ISPLOCK(isp);
2089 		} else if (XS_CMD_GRACE_P(xs)) {
2090 			/*
2091 			 * Make sure the command is *really* dead before we
2092 			 * release the handle (and DMA resources) for reuse.
2093 			 */
2094 			(void) isp_control(isp, ISPCTL_ABORT_CMD, xs);
2095 
2096 			/*
2097 			 * After this point, the comamnd is really dead.
2098 			 */
2099 			if (XS_XFRLEN(xs)) {
2100 				ISP_DMAFREE(isp, xs, handle);
2101                 	}
2102 			isp_destroy_handle(isp, handle);
2103 			xpt_print_path(xs->ccb_h.path);
2104 			isp_prt(isp, ISP_LOGWARN,
2105 			    "watchdog timeout for handle 0x%x", handle);
2106 			XS_SETERR(xs, CAM_CMD_TIMEOUT);
2107 			XS_CMD_C_WDOG(xs);
2108 			ISPLOCK_2_CAMLOCK(isp);
2109 			isp_done(xs);
2110 			CAMLOCK_2_ISPLOCK(isp);
2111 		} else {
2112 			XS_CMD_C_WDOG(xs);
2113 			xs->ccb_h.timeout_ch = timeout(isp_watchdog, xs, hz);
2114 			XS_CMD_S_GRACE(xs);
2115 			isp->isp_sendmarker |= 1 << XS_CHANNEL(xs);
2116 		}
2117 		ISP_UNLOCK(isp);
2118 		return (1);
2119 	}
2120 	ISP_UNLOCK(isp);
2121 	return (0);
2122 }
2123 
2124 static void
2125 isp_watchdog(void *arg)
2126 {
2127 	ispsoftc_t *isp;
2128 	XS_T *xs = arg;
2129 	for (isp = isplist; isp != NULL; isp = isp->isp_osinfo.next) {
2130 		if (isp_watchdog_work(isp, xs)) {
2131 			break;
2132 		}
2133 	}
2134 	if (isp == NULL) {
2135 		printf("isp_watchdog: nobody had %p active\n", arg);
2136 	}
2137 }
2138 
2139 
2140 #if __FreeBSD_version >= 500000
2141 #define	isp_make_here(isp, tgt)	isp_announce(isp, tgt, AC_FOUND_DEVICE)
2142 #define	isp_make_gone(isp, tgt)	isp_announce(isp, tgt, AC_LOST_DEVICE)
2143 
2144 /*
2145  * Support function for Announcement
2146  */
2147 static void
2148 isp_announce(ispsoftc_t *isp, int tgt, int action)
2149 {
2150 	struct cam_path *tmppath;
2151 	ISPLOCK_2_CAMLOCK(isp);
2152 	if (xpt_create_path(&tmppath, NULL, cam_sim_path(isp->isp_sim), tgt,
2153 	    CAM_LUN_WILDCARD) == CAM_REQ_CMP) {
2154 		xpt_async(action, tmppath, NULL);
2155 		xpt_free_path(tmppath);
2156 	}
2157 	CAMLOCK_2_ISPLOCK(isp);
2158 }
2159 #else
2160 #define	isp_make_here(isp, tgt)	do { ; } while (0)
2161 #define	isp_make_gone(isp, tgt)	do { ; } while (0)
2162 #endif
2163 
2164 
2165 /*
2166  * Gone Device Timer Function- when we have decided that a device has gone
2167  * away, we wait a specific period of time prior to telling the OS it has
2168  * gone away.
2169  *
2170  * This timer function fires once a second and then scans the port database
2171  * for devices that are marked dead but still have a virtual target assigned.
2172  * We decrement a counter for that port database entry, and when it hits zero,
2173  * we tell the OS the device has gone away.
2174  */
2175 static void
2176 isp_gdt(void *arg)
2177 {
2178 	ispsoftc_t *isp = arg;
2179 	fcportdb_t *lp;
2180 	int dbidx, tgt, more_to_do = 0;
2181 
2182 	isp_prt(isp, ISP_LOGDEBUG0, "GDT timer expired");
2183 	ISP_LOCK(isp);
2184 	for (dbidx = 0; dbidx < MAX_FC_TARG; dbidx++) {
2185 		lp = &FCPARAM(isp)->portdb[dbidx];
2186 
2187 		if (lp->state != FC_PORTDB_STATE_ZOMBIE) {
2188 			continue;
2189 		}
2190 		if (lp->ini_map_idx == 0) {
2191 			continue;
2192 		}
2193 		if (lp->new_reserved == 0) {
2194 			continue;
2195 		}
2196 		lp->new_reserved -= 1;
2197 		if (lp->new_reserved != 0) {
2198 			more_to_do++;
2199 			continue;
2200 		}
2201 		tgt = lp->ini_map_idx - 1;
2202 		FCPARAM(isp)->isp_ini_map[tgt] = 0;
2203 		lp->ini_map_idx = 0;
2204 		lp->state = FC_PORTDB_STATE_NIL;
2205 		isp_prt(isp, ISP_LOGCONFIG, prom3, lp->portid, tgt,
2206 		    "Gone Device Timeout");
2207 		isp_make_gone(isp, tgt);
2208 	}
2209 	if (more_to_do) {
2210 		isp->isp_osinfo.gdt = timeout(isp_gdt, isp, hz);
2211 	} else {
2212 		isp_prt(isp, ISP_LOGSANCFG|ISP_LOGDEBUG0,
2213 		    "stopping Gone Device Timer");
2214 		isp->isp_osinfo.gdt_running = 0;
2215 	}
2216 	ISP_UNLOCK(isp);
2217 }
2218 
2219 /*
2220  * Loop Down Timer Function- when loop goes down, a timer is started and
2221  * and after it expires we come here and take all probational devices that
2222  * the OS knows about and the tell the OS that they've gone away.
2223  *
2224  * We don't clear the devices out of our port database because, when loop
2225  * come back up, we have to do some actual cleanup with the chip at that
2226  * point (implicit PLOGO, e.g., to get the chip's port database state right).
2227  */
2228 static void
2229 isp_ldt(void *arg)
2230 {
2231 	ispsoftc_t *isp = arg;
2232 	fcportdb_t *lp;
2233 	int dbidx, tgt;
2234 
2235 	isp_prt(isp, ISP_LOGSANCFG|ISP_LOGDEBUG0, "Loop Down Timer expired");
2236 	ISP_LOCK(isp);
2237 
2238 	/*
2239 	 * Notify to the OS all targets who we now consider have departed.
2240 	 */
2241 	for (dbidx = 0; dbidx < MAX_FC_TARG; dbidx++) {
2242 		lp = &FCPARAM(isp)->portdb[dbidx];
2243 
2244 		if (lp->state != FC_PORTDB_STATE_PROBATIONAL) {
2245 			continue;
2246 		}
2247 		if (lp->ini_map_idx == 0) {
2248 			continue;
2249 		}
2250 
2251 		/*
2252 		 * XXX: CLEAN UP AND COMPLETE ANY PENDING COMMANDS FIRST!
2253 		 */
2254 
2255 		/*
2256 		 * Mark that we've announced that this device is gone....
2257 		 */
2258 		lp->reserved = 1;
2259 
2260 		/*
2261 		 * but *don't* change the state of the entry. Just clear
2262 		 * any target id stuff and announce to CAM that the
2263 		 * device is gone. This way any necessary PLOGO stuff
2264 		 * will happen when loop comes back up.
2265 		 */
2266 
2267 		tgt = lp->ini_map_idx - 1;
2268 		FCPARAM(isp)->isp_ini_map[tgt] = 0;
2269 		lp->ini_map_idx = 0;
2270 		isp_prt(isp, ISP_LOGCONFIG, prom3, lp->portid, tgt,
2271 		    "Loop Down Timeout");
2272 		isp_make_gone(isp, tgt);
2273 	}
2274 
2275 	/*
2276 	 * The loop down timer has expired. Wake up the kthread
2277 	 * to notice that fact (or make it false).
2278 	 */
2279 	isp->isp_osinfo.loop_down_time = isp->isp_osinfo.loop_down_limit+1;
2280 #if __FreeBSD_version < 500000
2281 	wakeup(&isp->isp_osinfo.kproc);
2282 #else
2283 #ifdef	ISP_SMPLOCK
2284 	cv_signal(&isp->isp_osinfo.kthread_cv);
2285 #else
2286 	wakeup(&isp->isp_osinfo.kthread_cv);
2287 #endif
2288 #endif
2289 	ISP_UNLOCK(isp);
2290 }
2291 
2292 static void
2293 isp_kthread(void *arg)
2294 {
2295 	ispsoftc_t *isp = arg;
2296 	int slp = 0;
2297 #if __FreeBSD_version < 500000
2298         int s;
2299 
2300         s = splcam();
2301 #else
2302 #ifdef	ISP_SMPLOCK
2303 	mtx_lock(&isp->isp_lock);
2304 #else
2305 	mtx_lock(&Giant);
2306 #endif
2307 #endif
2308 	/*
2309 	 * The first loop is for our usage where we have yet to have
2310 	 * gotten good fibre channel state.
2311 	 */
2312 	for (;;) {
2313 		int wasfrozen, lb, lim;
2314 
2315 		isp_prt(isp, ISP_LOGSANCFG|ISP_LOGDEBUG0,
2316 		    "isp_kthread: checking FC state");
2317 		isp->isp_osinfo.mbox_sleep_ok = 1;
2318 		lb = isp_fc_runstate(isp, 250000);
2319 		isp->isp_osinfo.mbox_sleep_ok = 0;
2320 		if (lb) {
2321 			/*
2322 			 * Increment loop down time by the last sleep interval
2323 			 */
2324 			isp->isp_osinfo.loop_down_time += slp;
2325 
2326 			if (lb < 0) {
2327 				isp_prt(isp, ISP_LOGSANCFG|ISP_LOGDEBUG0,
2328 				    "kthread: FC loop not up (down count %d)",
2329 				    isp->isp_osinfo.loop_down_time);
2330 			} else {
2331 				isp_prt(isp, ISP_LOGSANCFG|ISP_LOGDEBUG0,
2332 				    "kthread: FC got to %d (down count %d)",
2333 				    lb, isp->isp_osinfo.loop_down_time);
2334 			}
2335 
2336 
2337 			/*
2338 			 * If we've never seen loop up and we've waited longer
2339 			 * than quickboot time, or we've seen loop up but we've
2340 			 * waited longer than loop_down_limit, give up and go
2341 			 * to sleep until loop comes up.
2342 			 */
2343 			if (FCPARAM(isp)->loop_seen_once == 0) {
2344 				lim = isp_quickboot_time;
2345 			} else {
2346 				lim = isp->isp_osinfo.loop_down_limit;
2347 			}
2348 			if (isp->isp_osinfo.loop_down_time >= lim) {
2349 				isp_freeze_loopdown(isp, "loop limit hit");
2350 				slp = 0;
2351 			} else if (isp->isp_osinfo.loop_down_time < 10) {
2352 				slp = 1;
2353 			} else if (isp->isp_osinfo.loop_down_time < 30) {
2354 				slp = 5;
2355 			} else if (isp->isp_osinfo.loop_down_time < 60) {
2356 				slp = 10;
2357 			} else if (isp->isp_osinfo.loop_down_time < 120) {
2358 				slp = 20;
2359 			} else {
2360 				slp = 30;
2361 			}
2362 
2363 		} else {
2364 			isp_prt(isp, ISP_LOGSANCFG|ISP_LOGDEBUG0,
2365 			    "isp_kthread: FC state OK");
2366 			isp->isp_osinfo.loop_down_time = 0;
2367 			slp = 0;
2368 		}
2369 
2370 		/*
2371 		 * If we'd frozen the simq, unfreeze it now so that CAM
2372 		 * can start sending us commands. If the FC state isn't
2373 		 * okay yet, they'll hit that in isp_start which will
2374 		 * freeze the queue again.
2375 		 */
2376 		wasfrozen = isp->isp_osinfo.simqfrozen & SIMQFRZ_LOOPDOWN;
2377 		isp->isp_osinfo.simqfrozen &= ~SIMQFRZ_LOOPDOWN;
2378 		if (wasfrozen && isp->isp_osinfo.simqfrozen == 0) {
2379 			isp_prt(isp, ISP_LOGSANCFG|ISP_LOGDEBUG0,
2380 			    "isp_kthread: releasing simq");
2381 			ISPLOCK_2_CAMLOCK(isp);
2382 			xpt_release_simq(isp->isp_sim, 1);
2383 			CAMLOCK_2_ISPLOCK(isp);
2384 		}
2385 		isp_prt(isp, ISP_LOGSANCFG|ISP_LOGDEBUG0,
2386 		    "isp_kthread: sleep time %d", slp);
2387 #if __FreeBSD_version < 500000
2388 		tsleep(&isp->isp_osinfo.kproc, PRIBIO, "ispf",
2389 		    slp * hz);
2390 #else
2391 #ifdef	ISP_SMPLOCK
2392 		cv_timed_wait(&isp->isp_osinfo.kthread_cv, &isp->isp_lock,
2393 		    slp * hz);
2394 #else
2395 		(void) tsleep(&isp->isp_osinfo.kthread_cv, PRIBIO, "ispf",
2396 		    slp * hz);
2397 #endif
2398 #endif
2399 		/*
2400 		 * If slp is zero, we're waking up for the first time after
2401 		 * things have been okay. In this case, we set a deferral state
2402 		 * for all commands and delay hysteresis seconds before starting
2403 		 * the FC state evaluation. This gives the loop/fabric a chance
2404 		 * to settle.
2405 		 */
2406 		if (slp == 0 && isp->isp_osinfo.hysteresis) {
2407 			isp_prt(isp, ISP_LOGSANCFG|ISP_LOGDEBUG0,
2408 			    "isp_kthread: sleep hysteresis tick time %d",
2409 			    isp->isp_osinfo.hysteresis * hz);
2410 			(void) tsleep(&isp_fabric_hysteresis, PRIBIO, "ispT",
2411 			    (isp->isp_osinfo.hysteresis * hz));
2412 		}
2413 	}
2414 }
2415 
2416 static void
2417 isp_action(struct cam_sim *sim, union ccb *ccb)
2418 {
2419 	int bus, tgt, error, lim;
2420 	ispsoftc_t *isp;
2421 	struct ccb_trans_settings *cts;
2422 
2423 	CAM_DEBUG(ccb->ccb_h.path, CAM_DEBUG_TRACE, ("isp_action\n"));
2424 
2425 	isp = (ispsoftc_t *)cam_sim_softc(sim);
2426 	ccb->ccb_h.sim_priv.entries[0].field = 0;
2427 	ccb->ccb_h.sim_priv.entries[1].ptr = isp;
2428 	if (isp->isp_state != ISP_RUNSTATE &&
2429 	    ccb->ccb_h.func_code == XPT_SCSI_IO) {
2430 		CAMLOCK_2_ISPLOCK(isp);
2431 		isp_init(isp);
2432 		if (isp->isp_state != ISP_INITSTATE) {
2433 			ISP_UNLOCK(isp);
2434 			/*
2435 			 * Lie. Say it was a selection timeout.
2436 			 */
2437 			ccb->ccb_h.status = CAM_SEL_TIMEOUT | CAM_DEV_QFRZN;
2438 			xpt_freeze_devq(ccb->ccb_h.path, 1);
2439 			xpt_done(ccb);
2440 			return;
2441 		}
2442 		isp->isp_state = ISP_RUNSTATE;
2443 		ISPLOCK_2_CAMLOCK(isp);
2444 	}
2445 	isp_prt(isp, ISP_LOGDEBUG2, "isp_action code %x", ccb->ccb_h.func_code);
2446 
2447 
2448 	switch (ccb->ccb_h.func_code) {
2449 	case XPT_SCSI_IO:	/* Execute the requested I/O operation */
2450 		/*
2451 		 * Do a couple of preliminary checks...
2452 		 */
2453 		if ((ccb->ccb_h.flags & CAM_CDB_POINTER) != 0) {
2454 			if ((ccb->ccb_h.flags & CAM_CDB_PHYS) != 0) {
2455 				ccb->ccb_h.status = CAM_REQ_INVALID;
2456 				xpt_done(ccb);
2457 				break;
2458 			}
2459 		}
2460 #ifdef	DIAGNOSTIC
2461 		if (ccb->ccb_h.target_id > (ISP_MAX_TARGETS(isp) - 1)) {
2462 			ccb->ccb_h.status = CAM_PATH_INVALID;
2463 		} else if (ccb->ccb_h.target_lun > (ISP_MAX_LUNS(isp) - 1)) {
2464 			ccb->ccb_h.status = CAM_PATH_INVALID;
2465 		}
2466 		if (ccb->ccb_h.status == CAM_PATH_INVALID) {
2467 			isp_prt(isp, ISP_LOGERR,
2468 			    "invalid tgt/lun (%d.%d) in XPT_SCSI_IO",
2469 			    ccb->ccb_h.target_id, ccb->ccb_h.target_lun);
2470 			xpt_done(ccb);
2471 			break;
2472 		}
2473 #endif
2474 		((struct ccb_scsiio *) ccb)->scsi_status = SCSI_STATUS_OK;
2475 		CAMLOCK_2_ISPLOCK(isp);
2476 		error = isp_start((XS_T *) ccb);
2477 		switch (error) {
2478 		case CMD_QUEUED:
2479 			XS_CMD_S_CLEAR(ccb);
2480 			ISPLOCK_2_CAMLOCK(isp);
2481 			ccb->ccb_h.status |= CAM_SIM_QUEUED;
2482 			if (ccb->ccb_h.timeout != CAM_TIME_INFINITY) {
2483 				int ms = ccb->ccb_h.timeout;
2484 				if (ms == CAM_TIME_DEFAULT) {
2485 					ms = 60*1000;
2486 				}
2487 				ccb->ccb_h.timeout_ch =
2488 				    timeout(isp_watchdog, ccb, isp_mstohz(ms));
2489 			} else {
2490 				callout_handle_init(&ccb->ccb_h.timeout_ch);
2491 			}
2492 			break;
2493 		case CMD_RQLATER:
2494 			/*
2495 			 * This can only happen for Fibre Channel
2496 			 */
2497 			KASSERT((IS_FC(isp)), ("CMD_RQLATER for FC only"));
2498 
2499 			/*
2500 			 * Handle initial and subsequent loop down cases
2501 			 */
2502 			if (FCPARAM(isp)->loop_seen_once == 0) {
2503 				lim = isp_quickboot_time;
2504 			} else {
2505 				lim = isp->isp_osinfo.loop_down_limit;
2506 			}
2507 			if (isp->isp_osinfo.loop_down_time >= lim) {
2508 				isp_prt(isp, ISP_LOGDEBUG0,
2509 				    "%d.%d downtime (%d) > lim (%d)",
2510 				    XS_TGT(ccb), XS_LUN(ccb),
2511 				    isp->isp_osinfo.loop_down_time, lim);
2512 				ccb->ccb_h.status =
2513 				    CAM_SEL_TIMEOUT|CAM_DEV_QFRZN;
2514 				xpt_freeze_devq(ccb->ccb_h.path, 1);
2515 				ISPLOCK_2_CAMLOCK(isp);
2516 				xpt_done(ccb);
2517 				break;
2518 			}
2519 			isp_prt(isp, ISP_LOGDEBUG0,
2520 			    "%d.%d retry later", XS_TGT(ccb), XS_LUN(ccb));
2521 			/*
2522 			 * Otherwise, retry in a while.
2523 			 */
2524 			ISPLOCK_2_CAMLOCK(isp);
2525 			cam_freeze_devq(ccb->ccb_h.path);
2526 			cam_release_devq(ccb->ccb_h.path,
2527 			    RELSIM_RELEASE_AFTER_TIMEOUT, 0, 1000, 0);
2528 			XS_SETERR(ccb, CAM_REQUEUE_REQ);
2529 			xpt_done(ccb);
2530 			break;
2531 		case CMD_EAGAIN:
2532 			ISPLOCK_2_CAMLOCK(isp);
2533 			cam_freeze_devq(ccb->ccb_h.path);
2534 			cam_release_devq(ccb->ccb_h.path,
2535 			    RELSIM_RELEASE_AFTER_TIMEOUT, 0, 250, 0);
2536 			xpt_done(ccb);
2537 			break;
2538 		case CMD_COMPLETE:
2539 			isp_done((struct ccb_scsiio *) ccb);
2540 			ISPLOCK_2_CAMLOCK(isp);
2541 			break;
2542 		default:
2543 			ISPLOCK_2_CAMLOCK(isp);
2544 			isp_prt(isp, ISP_LOGERR,
2545 			    "What's this? 0x%x at %d in file %s",
2546 			    error, __LINE__, __FILE__);
2547 			XS_SETERR(ccb, CAM_REQ_CMP_ERR);
2548 			xpt_done(ccb);
2549 		}
2550 		break;
2551 
2552 #ifdef	ISP_TARGET_MODE
2553 	case XPT_EN_LUN:		/* Enable LUN as a target */
2554 	{
2555 		int seq, i;
2556 		CAMLOCK_2_ISPLOCK(isp);
2557 		seq = isp_en_lun(isp, ccb);
2558 		if (seq < 0) {
2559 			ISPLOCK_2_CAMLOCK(isp);
2560 			xpt_done(ccb);
2561 			break;
2562 		}
2563 		for (i = 0; isp->isp_osinfo.leact[seq] && i < 30 * 1000; i++) {
2564 			uint32_t isr;
2565 			uint16_t sema, mbox;
2566 			if (ISP_READ_ISR(isp, &isr, &sema, &mbox)) {
2567 				isp_intr(isp, isr, sema, mbox);
2568 			}
2569 			DELAY(1000);
2570 		}
2571 		ISPLOCK_2_CAMLOCK(isp);
2572 		break;
2573 	}
2574 	case XPT_NOTIFY_ACK:		/* recycle notify ack */
2575 	case XPT_IMMED_NOTIFY:		/* Add Immediate Notify Resource */
2576 	case XPT_ACCEPT_TARGET_IO:	/* Add Accept Target IO Resource */
2577 	{
2578 		tstate_t *tptr =
2579 		    get_lun_statep(isp, XS_CHANNEL(ccb), ccb->ccb_h.target_lun);
2580 		if (tptr == NULL) {
2581 			ccb->ccb_h.status = CAM_LUN_INVALID;
2582 			xpt_done(ccb);
2583 			break;
2584 		}
2585 		ccb->ccb_h.sim_priv.entries[0].field = 0;
2586 		ccb->ccb_h.sim_priv.entries[1].ptr = isp;
2587 		ccb->ccb_h.flags = 0;
2588 
2589 		CAMLOCK_2_ISPLOCK(isp);
2590 		if (ccb->ccb_h.func_code == XPT_ACCEPT_TARGET_IO) {
2591 			/*
2592 			 * Note that the command itself may not be done-
2593 			 * it may not even have had the first CTIO sent.
2594 			 */
2595 			tptr->atio_count++;
2596 			isp_prt(isp, ISP_LOGTDEBUG0,
2597 			    "Put FREE ATIO, lun %d, count now %d",
2598 			    ccb->ccb_h.target_lun, tptr->atio_count);
2599 			SLIST_INSERT_HEAD(&tptr->atios, &ccb->ccb_h,
2600 			    sim_links.sle);
2601 		} else if (ccb->ccb_h.func_code == XPT_IMMED_NOTIFY) {
2602 			tptr->inot_count++;
2603 			isp_prt(isp, ISP_LOGTDEBUG0,
2604 			    "Put FREE INOT, lun %d, count now %d",
2605 			    ccb->ccb_h.target_lun, tptr->inot_count);
2606 			SLIST_INSERT_HEAD(&tptr->inots, &ccb->ccb_h,
2607 			    sim_links.sle);
2608 		} else {
2609 			isp_prt(isp, ISP_LOGWARN, "Got Notify ACK");;
2610 		}
2611 		rls_lun_statep(isp, tptr);
2612 		ccb->ccb_h.status = CAM_REQ_INPROG;
2613 		ISPLOCK_2_CAMLOCK(isp);
2614 		break;
2615 	}
2616 	case XPT_CONT_TARGET_IO:
2617 	{
2618 		CAMLOCK_2_ISPLOCK(isp);
2619 		isp_target_start_ctio(isp, ccb);
2620 		ISPLOCK_2_CAMLOCK(isp);
2621 		break;
2622 	}
2623 #endif
2624 	case XPT_RESET_DEV:		/* BDR the specified SCSI device */
2625 
2626 		bus = cam_sim_bus(xpt_path_sim(ccb->ccb_h.path));
2627 		tgt = ccb->ccb_h.target_id;
2628 		tgt |= (bus << 16);
2629 
2630 		CAMLOCK_2_ISPLOCK(isp);
2631 		error = isp_control(isp, ISPCTL_RESET_DEV, &tgt);
2632 		ISPLOCK_2_CAMLOCK(isp);
2633 		if (error) {
2634 			ccb->ccb_h.status = CAM_REQ_CMP_ERR;
2635 		} else {
2636 			ccb->ccb_h.status = CAM_REQ_CMP;
2637 		}
2638 		xpt_done(ccb);
2639 		break;
2640 	case XPT_ABORT:			/* Abort the specified CCB */
2641 	{
2642 		union ccb *accb = ccb->cab.abort_ccb;
2643 		CAMLOCK_2_ISPLOCK(isp);
2644 		switch (accb->ccb_h.func_code) {
2645 #ifdef	ISP_TARGET_MODE
2646 		case XPT_ACCEPT_TARGET_IO:
2647 		case XPT_IMMED_NOTIFY:
2648         		ccb->ccb_h.status = isp_abort_tgt_ccb(isp, ccb);
2649 			break;
2650 		case XPT_CONT_TARGET_IO:
2651 			isp_prt(isp, ISP_LOGERR, "cannot abort CTIOs yet");
2652 			ccb->ccb_h.status = CAM_UA_ABORT;
2653 			break;
2654 #endif
2655 		case XPT_SCSI_IO:
2656 			error = isp_control(isp, ISPCTL_ABORT_CMD, ccb);
2657 			if (error) {
2658 				ccb->ccb_h.status = CAM_UA_ABORT;
2659 			} else {
2660 				ccb->ccb_h.status = CAM_REQ_CMP;
2661 			}
2662 			break;
2663 		default:
2664 			ccb->ccb_h.status = CAM_REQ_INVALID;
2665 			break;
2666 		}
2667 		ISPLOCK_2_CAMLOCK(isp);
2668 		xpt_done(ccb);
2669 		break;
2670 	}
2671 #define	IS_CURRENT_SETTINGS(c)	(c->type == CTS_TYPE_CURRENT_SETTINGS)
2672 	case XPT_SET_TRAN_SETTINGS:	/* Nexus Settings */
2673 		cts = &ccb->cts;
2674 		if (!IS_CURRENT_SETTINGS(cts)) {
2675 			ccb->ccb_h.status = CAM_REQ_INVALID;
2676 			xpt_done(ccb);
2677 			break;
2678 		}
2679 		tgt = cts->ccb_h.target_id;
2680 		CAMLOCK_2_ISPLOCK(isp);
2681 		if (IS_SCSI(isp)) {
2682 			struct ccb_trans_settings_scsi *scsi =
2683 			    &cts->proto_specific.scsi;
2684 			struct ccb_trans_settings_spi *spi =
2685 			    &cts->xport_specific.spi;
2686 			sdparam *sdp = isp->isp_param;
2687 			uint16_t *dptr;
2688 
2689 			bus = cam_sim_bus(xpt_path_sim(cts->ccb_h.path));
2690 			sdp += bus;
2691 			/*
2692 			 * We always update (internally) from goal_flags
2693 			 * so any request to change settings just gets
2694 			 * vectored to that location.
2695 			 */
2696 			dptr = &sdp->isp_devparam[tgt].goal_flags;
2697 
2698 			if ((spi->valid & CTS_SPI_VALID_DISC) != 0) {
2699 				if ((spi->flags & CTS_SPI_FLAGS_DISC_ENB) != 0)
2700 					*dptr |= DPARM_DISC;
2701 				else
2702 					*dptr &= ~DPARM_DISC;
2703 			}
2704 
2705 			if ((scsi->valid & CTS_SCSI_VALID_TQ) != 0) {
2706 				if ((scsi->flags & CTS_SCSI_FLAGS_TAG_ENB) != 0)
2707 					*dptr |= DPARM_TQING;
2708 				else
2709 					*dptr &= ~DPARM_TQING;
2710 			}
2711 
2712 			if ((spi->valid & CTS_SPI_VALID_BUS_WIDTH) != 0) {
2713 				if (spi->bus_width == MSG_EXT_WDTR_BUS_16_BIT)
2714 					*dptr |= DPARM_WIDE;
2715 				else
2716 					*dptr &= ~DPARM_WIDE;
2717 			}
2718 
2719 			/*
2720 			 * XXX: FIX ME
2721 			 */
2722 			if ((spi->valid & CTS_SPI_VALID_SYNC_OFFSET) &&
2723 			    (spi->valid & CTS_SPI_VALID_SYNC_RATE) &&
2724 			    (spi->sync_period && spi->sync_offset)) {
2725 				*dptr |= DPARM_SYNC;
2726 				/*
2727 				 * XXX: CHECK FOR LEGALITY
2728 				 */
2729 				sdp->isp_devparam[tgt].goal_period =
2730 				    spi->sync_period;
2731 				sdp->isp_devparam[tgt].goal_offset =
2732 				    spi->sync_offset;
2733 			} else {
2734 				*dptr &= ~DPARM_SYNC;
2735 			}
2736 			isp_prt(isp, ISP_LOGDEBUG0,
2737 			    "SET bus %d targ %d to flags %x off %x per %x",
2738 			    bus, tgt, sdp->isp_devparam[tgt].goal_flags,
2739 			    sdp->isp_devparam[tgt].goal_offset,
2740 			    sdp->isp_devparam[tgt].goal_period);
2741 			sdp->isp_devparam[tgt].dev_update = 1;
2742 			isp->isp_update |= (1 << bus);
2743 		}
2744 		ISPLOCK_2_CAMLOCK(isp);
2745 		ccb->ccb_h.status = CAM_REQ_CMP;
2746 		xpt_done(ccb);
2747 		break;
2748 	case XPT_GET_TRAN_SETTINGS:
2749 		cts = &ccb->cts;
2750 		tgt = cts->ccb_h.target_id;
2751 		CAMLOCK_2_ISPLOCK(isp);
2752 		if (IS_FC(isp)) {
2753 			fcparam *fcp = isp->isp_param;
2754 			struct ccb_trans_settings_fc *fc =
2755 			    &cts->xport_specific.fc;
2756 
2757 			cts->protocol = PROTO_SCSI;
2758 			cts->protocol_version = SCSI_REV_2;
2759 			cts->transport = XPORT_FC;
2760 			cts->transport_version = 0;
2761 
2762 			fc->valid = CTS_FC_VALID_SPEED;
2763 			if (fcp->isp_gbspeed == 2)
2764 				fc->bitrate = 200000;
2765 			else
2766 				fc->bitrate = 100000;
2767 			if (tgt > 0 && tgt < MAX_FC_TARG) {
2768 				fcportdb_t *lp = &fcp->portdb[tgt];
2769 				fc->wwnn = lp->node_wwn;
2770 				fc->wwpn = lp->port_wwn;
2771 				fc->port = lp->portid;
2772 				fc->valid |= CTS_FC_VALID_WWNN |
2773 				    CTS_FC_VALID_WWPN | CTS_FC_VALID_PORT;
2774 			}
2775 		} else {
2776 			struct ccb_trans_settings_scsi *scsi =
2777 			    &cts->proto_specific.scsi;
2778 			struct ccb_trans_settings_spi *spi =
2779 			    &cts->xport_specific.spi;
2780 			sdparam *sdp = isp->isp_param;
2781 			int bus = cam_sim_bus(xpt_path_sim(cts->ccb_h.path));
2782 			uint16_t dval, pval, oval;
2783 
2784 			sdp += bus;
2785 
2786 			if (IS_CURRENT_SETTINGS(cts)) {
2787 				sdp->isp_devparam[tgt].dev_refresh = 1;
2788 				isp->isp_update |= (1 << bus);
2789 				(void) isp_control(isp, ISPCTL_UPDATE_PARAMS,
2790 				    NULL);
2791 				dval = sdp->isp_devparam[tgt].actv_flags;
2792 				oval = sdp->isp_devparam[tgt].actv_offset;
2793 				pval = sdp->isp_devparam[tgt].actv_period;
2794 			} else {
2795 				dval = sdp->isp_devparam[tgt].nvrm_flags;
2796 				oval = sdp->isp_devparam[tgt].nvrm_offset;
2797 				pval = sdp->isp_devparam[tgt].nvrm_period;
2798 			}
2799 
2800 			cts->protocol = PROTO_SCSI;
2801 			cts->protocol_version = SCSI_REV_2;
2802 			cts->transport = XPORT_SPI;
2803 			cts->transport_version = 2;
2804 
2805 			scsi->flags &= ~CTS_SCSI_FLAGS_TAG_ENB;
2806 			spi->flags &= ~CTS_SPI_FLAGS_DISC_ENB;
2807 			if (dval & DPARM_DISC) {
2808 				spi->flags |= CTS_SPI_FLAGS_DISC_ENB;
2809 			}
2810 			if (dval & DPARM_TQING) {
2811 				scsi->flags |= CTS_SCSI_FLAGS_TAG_ENB;
2812 			}
2813 			if ((dval & DPARM_SYNC) && oval && pval) {
2814 				spi->sync_offset = oval;
2815 				spi->sync_period = pval;
2816 				spi->valid |= CTS_SPI_VALID_SYNC_OFFSET;
2817 				spi->valid |= CTS_SPI_VALID_SYNC_RATE;
2818 			}
2819 			spi->valid |= CTS_SPI_VALID_BUS_WIDTH;
2820 			if (dval & DPARM_WIDE) {
2821 				spi->bus_width = MSG_EXT_WDTR_BUS_16_BIT;
2822 			} else {
2823 				spi->bus_width = MSG_EXT_WDTR_BUS_8_BIT;
2824 			}
2825 			if (cts->ccb_h.target_lun != CAM_LUN_WILDCARD) {
2826 				scsi->valid = CTS_SCSI_VALID_TQ;
2827 				spi->valid |= CTS_SPI_VALID_DISC;
2828 			} else {
2829 				scsi->valid = 0;
2830 			}
2831 			isp_prt(isp, ISP_LOGDEBUG0,
2832 			    "GET %s bus %d targ %d to flags %x off %x per %x",
2833 			    IS_CURRENT_SETTINGS(cts)? "ACTIVE" : "NVRAM",
2834 			    bus, tgt, dval, oval, pval);
2835 		}
2836 		ISPLOCK_2_CAMLOCK(isp);
2837 		ccb->ccb_h.status = CAM_REQ_CMP;
2838 		xpt_done(ccb);
2839 		break;
2840 
2841 	case XPT_CALC_GEOMETRY:
2842 #if __FreeBSD_version < 500000
2843 	{
2844 		struct ccb_calc_geometry *ccg;
2845 		u_int32_t secs_per_cylinder;
2846 		u_int32_t size_mb;
2847 
2848 		ccg = &ccb->ccg;
2849 		if (ccg->block_size == 0) {
2850 			ccb->ccb_h.status = CAM_REQ_INVALID;
2851 			xpt_done(ccb);
2852 			break;
2853 		}
2854 		size_mb = ccg->volume_size /((1024L * 1024L) / ccg->block_size);
2855 		if (size_mb > 1024) {
2856 			ccg->heads = 255;
2857 			ccg->secs_per_track = 63;
2858 		} else {
2859 			ccg->heads = 64;
2860 			ccg->secs_per_track = 32;
2861 		}
2862 		secs_per_cylinder = ccg->heads * ccg->secs_per_track;
2863 		ccg->cylinders = ccg->volume_size / secs_per_cylinder;
2864 		ccb->ccb_h.status = CAM_REQ_CMP;
2865 		xpt_done(ccb);
2866 		break;
2867 	}
2868 #else
2869 	{
2870 		cam_calc_geometry(&ccb->ccg, /*extended*/1);
2871 		xpt_done(ccb);
2872 		break;
2873 	}
2874 #endif
2875 	case XPT_RESET_BUS:		/* Reset the specified bus */
2876 		bus = cam_sim_bus(sim);
2877 		CAMLOCK_2_ISPLOCK(isp);
2878 		error = isp_control(isp, ISPCTL_RESET_BUS, &bus);
2879 		ISPLOCK_2_CAMLOCK(isp);
2880 		if (error)
2881 			ccb->ccb_h.status = CAM_REQ_CMP_ERR;
2882 		else {
2883 			if (cam_sim_bus(sim) && isp->isp_path2 != NULL)
2884 				xpt_async(AC_BUS_RESET, isp->isp_path2, NULL);
2885 			else if (isp->isp_path != NULL)
2886 				xpt_async(AC_BUS_RESET, isp->isp_path, NULL);
2887 			ccb->ccb_h.status = CAM_REQ_CMP;
2888 		}
2889 		xpt_done(ccb);
2890 		break;
2891 
2892 	case XPT_TERM_IO:		/* Terminate the I/O process */
2893 		ccb->ccb_h.status = CAM_REQ_INVALID;
2894 		xpt_done(ccb);
2895 		break;
2896 
2897 	case XPT_PATH_INQ:		/* Path routing inquiry */
2898 	{
2899 		struct ccb_pathinq *cpi = &ccb->cpi;
2900 
2901 		cpi->version_num = 1;
2902 #ifdef	ISP_TARGET_MODE
2903 		cpi->target_sprt = PIT_PROCESSOR | PIT_DISCONNECT | PIT_TERM_IO;
2904 #else
2905 		cpi->target_sprt = 0;
2906 #endif
2907 		cpi->hba_eng_cnt = 0;
2908 		cpi->max_target = ISP_MAX_TARGETS(isp) - 1;
2909 		cpi->max_lun = ISP_MAX_LUNS(isp) - 1;
2910 		cpi->bus_id = cam_sim_bus(sim);
2911 		if (IS_FC(isp)) {
2912 			cpi->hba_misc = PIM_NOBUSRESET;
2913 			/*
2914 			 * Because our loop ID can shift from time to time,
2915 			 * make our initiator ID out of range of our bus.
2916 			 */
2917 			cpi->initiator_id = cpi->max_target + 1;
2918 
2919 			/*
2920 			 * Set base transfer capabilities for Fibre Channel.
2921 			 * Technically not correct because we don't know
2922 			 * what media we're running on top of- but we'll
2923 			 * look good if we always say 100MB/s.
2924 			 */
2925 			if (FCPARAM(isp)->isp_gbspeed == 2)
2926 				cpi->base_transfer_speed = 200000;
2927 			else
2928 				cpi->base_transfer_speed = 100000;
2929 			cpi->hba_inquiry = PI_TAG_ABLE;
2930 			cpi->transport = XPORT_FC;
2931 			cpi->transport_version = 0;	/* WHAT'S THIS FOR? */
2932 		} else {
2933 			sdparam *sdp = isp->isp_param;
2934 			sdp += cam_sim_bus(xpt_path_sim(cpi->ccb_h.path));
2935 			cpi->hba_inquiry = PI_SDTR_ABLE|PI_TAG_ABLE|PI_WIDE_16;
2936 			cpi->hba_misc = 0;
2937 			cpi->initiator_id = sdp->isp_initiator_id;
2938 			cpi->base_transfer_speed = 3300;
2939 			cpi->transport = XPORT_SPI;
2940 			cpi->transport_version = 2;	/* WHAT'S THIS FOR? */
2941 		}
2942 		cpi->protocol = PROTO_SCSI;
2943 		cpi->protocol_version = SCSI_REV_2;
2944 		strncpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
2945 		strncpy(cpi->hba_vid, "Qlogic", HBA_IDLEN);
2946 		strncpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
2947 		cpi->unit_number = cam_sim_unit(sim);
2948 		cpi->ccb_h.status = CAM_REQ_CMP;
2949 		xpt_done(ccb);
2950 		break;
2951 	}
2952 	default:
2953 		ccb->ccb_h.status = CAM_REQ_INVALID;
2954 		xpt_done(ccb);
2955 		break;
2956 	}
2957 }
2958 
2959 #define	ISPDDB	(CAM_DEBUG_INFO|CAM_DEBUG_TRACE|CAM_DEBUG_CDB)
2960 
2961 void
2962 isp_done(struct ccb_scsiio *sccb)
2963 {
2964 	ispsoftc_t *isp = XS_ISP(sccb);
2965 
2966 	if (XS_NOERR(sccb))
2967 		XS_SETERR(sccb, CAM_REQ_CMP);
2968 
2969 	if ((sccb->ccb_h.status & CAM_STATUS_MASK) == CAM_REQ_CMP &&
2970 	    (sccb->scsi_status != SCSI_STATUS_OK)) {
2971 		sccb->ccb_h.status &= ~CAM_STATUS_MASK;
2972 		if ((sccb->scsi_status == SCSI_STATUS_CHECK_COND) &&
2973 		    (sccb->ccb_h.status & CAM_AUTOSNS_VALID) == 0) {
2974 			sccb->ccb_h.status |= CAM_AUTOSENSE_FAIL;
2975 		} else {
2976 			sccb->ccb_h.status |= CAM_SCSI_STATUS_ERROR;
2977 		}
2978 	}
2979 
2980 	sccb->ccb_h.status &= ~CAM_SIM_QUEUED;
2981 	if ((sccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
2982 		isp_prt(isp, ISP_LOGDEBUG0,
2983 		    "target %d lun %d CAM status 0x%x SCSI status 0x%x",
2984 		    XS_TGT(sccb), XS_LUN(sccb), sccb->ccb_h.status,
2985 		    sccb->scsi_status);
2986 		if ((sccb->ccb_h.status & CAM_DEV_QFRZN) == 0) {
2987 			sccb->ccb_h.status |= CAM_DEV_QFRZN;
2988 			xpt_freeze_devq(sccb->ccb_h.path, 1);
2989 		}
2990 	}
2991 
2992 	if ((CAM_DEBUGGED(sccb->ccb_h.path, ISPDDB)) &&
2993 	    (sccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
2994 		xpt_print_path(sccb->ccb_h.path);
2995 		isp_prt(isp, ISP_LOGINFO,
2996 		    "cam completion status 0x%x", sccb->ccb_h.status);
2997 	}
2998 
2999 	XS_CMD_S_DONE(sccb);
3000 	if (XS_CMD_WDOG_P(sccb) == 0) {
3001 		untimeout(isp_watchdog, sccb, sccb->ccb_h.timeout_ch);
3002 		if (XS_CMD_GRACE_P(sccb)) {
3003 			isp_prt(isp, ISP_LOGDEBUG2,
3004 			    "finished command on borrowed time");
3005 		}
3006 		XS_CMD_S_CLEAR(sccb);
3007 		ISPLOCK_2_CAMLOCK(isp);
3008 		xpt_done((union ccb *) sccb);
3009 		CAMLOCK_2_ISPLOCK(isp);
3010 	}
3011 }
3012 
3013 int
3014 isp_async(ispsoftc_t *isp, ispasync_t cmd, void *arg)
3015 {
3016 	int bus, rv = 0;
3017 	static const char prom[] =
3018 	    "PortID 0x%06x handle 0x%x role %s %s\n"
3019 	    "      WWNN 0x%08x%08x WWPN 0x%08x%08x";
3020 	static const char prom2[] =
3021 	    "PortID 0x%06x handle 0x%x role %s %s tgt %u\n"
3022 	    "      WWNN 0x%08x%08x WWPN 0x%08x%08x";
3023 	char *msg = NULL;
3024 	target_id_t tgt;
3025 	fcportdb_t *lp;
3026 	struct cam_path *tmppath;
3027 
3028 	switch (cmd) {
3029 	case ISPASYNC_NEW_TGT_PARAMS:
3030 	{
3031 		struct ccb_trans_settings_scsi *scsi;
3032 		struct ccb_trans_settings_spi *spi;
3033 		int flags, tgt;
3034 		sdparam *sdp = isp->isp_param;
3035 		struct ccb_trans_settings cts;
3036 
3037 		memset(&cts, 0, sizeof (struct ccb_trans_settings));
3038 
3039 		tgt = *((int *)arg);
3040 		bus = (tgt >> 16) & 0xffff;
3041 		tgt &= 0xffff;
3042 		sdp += bus;
3043 		ISPLOCK_2_CAMLOCK(isp);
3044 		if (xpt_create_path(&tmppath, NULL,
3045 		    cam_sim_path(bus? isp->isp_sim2 : isp->isp_sim),
3046 		    tgt, CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
3047 			CAMLOCK_2_ISPLOCK(isp);
3048 			isp_prt(isp, ISP_LOGWARN,
3049 			    "isp_async cannot make temp path for %d.%d",
3050 			    tgt, bus);
3051 			rv = -1;
3052 			break;
3053 		}
3054 		CAMLOCK_2_ISPLOCK(isp);
3055 		flags = sdp->isp_devparam[tgt].actv_flags;
3056 		cts.type = CTS_TYPE_CURRENT_SETTINGS;
3057 		cts.protocol = PROTO_SCSI;
3058 		cts.transport = XPORT_SPI;
3059 
3060 		scsi = &cts.proto_specific.scsi;
3061 		spi = &cts.xport_specific.spi;
3062 
3063 		if (flags & DPARM_TQING) {
3064 			scsi->valid |= CTS_SCSI_VALID_TQ;
3065 			scsi->flags |= CTS_SCSI_FLAGS_TAG_ENB;
3066 		}
3067 
3068 		if (flags & DPARM_DISC) {
3069 			spi->valid |= CTS_SPI_VALID_DISC;
3070 			spi->flags |= CTS_SPI_FLAGS_DISC_ENB;
3071 		}
3072 		spi->flags |= CTS_SPI_VALID_BUS_WIDTH;
3073 		if (flags & DPARM_WIDE) {
3074 			spi->bus_width = MSG_EXT_WDTR_BUS_16_BIT;
3075 		} else {
3076 			spi->bus_width = MSG_EXT_WDTR_BUS_8_BIT;
3077 		}
3078 		if (flags & DPARM_SYNC) {
3079 			spi->valid |= CTS_SPI_VALID_SYNC_RATE;
3080 			spi->valid |= CTS_SPI_VALID_SYNC_OFFSET;
3081 			spi->sync_period = sdp->isp_devparam[tgt].actv_period;
3082 			spi->sync_offset = sdp->isp_devparam[tgt].actv_offset;
3083 		}
3084 		isp_prt(isp, ISP_LOGDEBUG2,
3085 		    "NEW_TGT_PARAMS bus %d tgt %d period %x offset %x flags %x",
3086 		    bus, tgt, sdp->isp_devparam[tgt].actv_period,
3087 		    sdp->isp_devparam[tgt].actv_offset, flags);
3088 		xpt_setup_ccb(&cts.ccb_h, tmppath, 1);
3089 		ISPLOCK_2_CAMLOCK(isp);
3090 		xpt_async(AC_TRANSFER_NEG, tmppath, &cts);
3091 		xpt_free_path(tmppath);
3092 		CAMLOCK_2_ISPLOCK(isp);
3093 		break;
3094 	}
3095 	case ISPASYNC_BUS_RESET:
3096 		bus = *((int *)arg);
3097 		isp_prt(isp, ISP_LOGINFO, "SCSI bus reset on bus %d detected",
3098 		    bus);
3099 		if (bus > 0 && isp->isp_path2) {
3100 			ISPLOCK_2_CAMLOCK(isp);
3101 			xpt_async(AC_BUS_RESET, isp->isp_path2, NULL);
3102 			CAMLOCK_2_ISPLOCK(isp);
3103 		} else if (isp->isp_path) {
3104 			ISPLOCK_2_CAMLOCK(isp);
3105 			xpt_async(AC_BUS_RESET, isp->isp_path, NULL);
3106 			CAMLOCK_2_ISPLOCK(isp);
3107 		}
3108 		break;
3109 	case ISPASYNC_LIP:
3110 		if (msg == NULL) {
3111 			msg = "LIP Received";
3112 		}
3113 		/* FALLTHROUGH */
3114 	case ISPASYNC_LOOP_RESET:
3115 		if (msg == NULL) {
3116 			msg = "LOOP Reset";
3117 		}
3118 		/* FALLTHROUGH */
3119 	case ISPASYNC_LOOP_DOWN:
3120 		if (msg == NULL) {
3121 			msg = "LOOP Down";
3122 		}
3123 		if (isp->isp_path) {
3124 			isp_freeze_loopdown(isp, msg);
3125 		}
3126 		if (isp->isp_osinfo.ldt_running == 0) {
3127 			isp->isp_osinfo.ldt = timeout(isp_ldt, isp,
3128 			    isp->isp_osinfo.loop_down_limit * hz);
3129 			isp->isp_osinfo.ldt_running = 1;
3130 			isp_prt(isp, ISP_LOGSANCFG|ISP_LOGDEBUG0,
3131 			   "starting Loop Down Timer");
3132 		}
3133 		isp_prt(isp, ISP_LOGINFO, msg);
3134 		break;
3135 	case ISPASYNC_LOOP_UP:
3136 		/*
3137 		 * Now we just note that Loop has come up. We don't
3138 		 * actually do anything because we're waiting for a
3139 		 * Change Notify before activating the FC cleanup
3140 		 * thread to look at the state of the loop again.
3141 		 */
3142 		isp_prt(isp, ISP_LOGINFO, "Loop UP");
3143 		break;
3144 	case ISPASYNC_DEV_ARRIVED:
3145 		lp = arg;
3146 		lp->reserved = 0;
3147 		if ((isp->isp_role & ISP_ROLE_INITIATOR) &&
3148 		    (lp->roles & (SVC3_TGT_ROLE >> SVC3_ROLE_SHIFT))) {
3149 			int dbidx = lp - FCPARAM(isp)->portdb;
3150 			int i;
3151 
3152 			for (i = 0; i < MAX_FC_TARG; i++) {
3153 				if (i >= FL_ID && i <= SNS_ID) {
3154 					continue;
3155 				}
3156 				if (FCPARAM(isp)->isp_ini_map[i] == 0) {
3157 					break;
3158 				}
3159 			}
3160 			if (i < MAX_FC_TARG) {
3161 				FCPARAM(isp)->isp_ini_map[i] = dbidx + 1;
3162 				lp->ini_map_idx = i + 1;
3163 			} else {
3164 				isp_prt(isp, ISP_LOGWARN, "out of target ids");
3165 				isp_dump_portdb(isp);
3166 			}
3167 		}
3168 		if (lp->ini_map_idx) {
3169 			tgt = lp->ini_map_idx - 1;
3170 			isp_prt(isp, ISP_LOGCONFIG, prom2,
3171 			    lp->portid, lp->handle,
3172 		            roles[lp->roles], "arrived at", tgt,
3173 		    	    (uint32_t) (lp->node_wwn >> 32),
3174 			    (uint32_t) lp->node_wwn,
3175 		    	    (uint32_t) (lp->port_wwn >> 32),
3176 			    (uint32_t) lp->port_wwn);
3177 			isp_make_here(isp, tgt);
3178 		} else {
3179 			isp_prt(isp, ISP_LOGCONFIG, prom,
3180 			    lp->portid, lp->handle,
3181 		            roles[lp->roles], "arrived",
3182 		    	    (uint32_t) (lp->node_wwn >> 32),
3183 			    (uint32_t) lp->node_wwn,
3184 		    	    (uint32_t) (lp->port_wwn >> 32),
3185 			    (uint32_t) lp->port_wwn);
3186 		}
3187 		break;
3188 	case ISPASYNC_DEV_CHANGED:
3189 		lp = arg;
3190 		if (isp_change_is_bad) {
3191 			lp->state = FC_PORTDB_STATE_NIL;
3192 			if (lp->ini_map_idx) {
3193 				tgt = lp->ini_map_idx - 1;
3194 				FCPARAM(isp)->isp_ini_map[tgt] = 0;
3195 				lp->ini_map_idx = 0;
3196 				isp_prt(isp, ISP_LOGCONFIG, prom3,
3197 				    lp->portid, tgt, "change is bad");
3198 				isp_make_gone(isp, tgt);
3199 			} else {
3200 				isp_prt(isp, ISP_LOGCONFIG, prom,
3201 				    lp->portid, lp->handle,
3202 				    roles[lp->roles],
3203 				    "changed and departed",
3204 				    (uint32_t) (lp->node_wwn >> 32),
3205 				    (uint32_t) lp->node_wwn,
3206 				    (uint32_t) (lp->port_wwn >> 32),
3207 				    (uint32_t) lp->port_wwn);
3208 			}
3209 		} else {
3210 			lp->portid = lp->new_portid;
3211 			lp->roles = lp->new_roles;
3212 			if (lp->ini_map_idx) {
3213 				int t = lp->ini_map_idx - 1;
3214 				FCPARAM(isp)->isp_ini_map[t] =
3215 				    (lp - FCPARAM(isp)->portdb) + 1;
3216 				tgt = lp->ini_map_idx - 1;
3217 				isp_prt(isp, ISP_LOGCONFIG, prom2,
3218 				    lp->portid, lp->handle,
3219 				    roles[lp->roles], "changed at", tgt,
3220 				    (uint32_t) (lp->node_wwn >> 32),
3221 				    (uint32_t) lp->node_wwn,
3222 				    (uint32_t) (lp->port_wwn >> 32),
3223 				    (uint32_t) lp->port_wwn);
3224 			} else {
3225 				isp_prt(isp, ISP_LOGCONFIG, prom,
3226 				    lp->portid, lp->handle,
3227 				    roles[lp->roles], "changed",
3228 				    (uint32_t) (lp->node_wwn >> 32),
3229 				    (uint32_t) lp->node_wwn,
3230 				    (uint32_t) (lp->port_wwn >> 32),
3231 				    (uint32_t) lp->port_wwn);
3232 			}
3233 		}
3234 		break;
3235 	case ISPASYNC_DEV_STAYED:
3236 		lp = arg;
3237 		if (lp->ini_map_idx) {
3238 			tgt = lp->ini_map_idx - 1;
3239 			isp_prt(isp, ISP_LOGCONFIG, prom2,
3240 			    lp->portid, lp->handle,
3241 		    	    roles[lp->roles], "stayed at", tgt,
3242 			    (uint32_t) (lp->node_wwn >> 32),
3243 			    (uint32_t) lp->node_wwn,
3244 		    	    (uint32_t) (lp->port_wwn >> 32),
3245 			    (uint32_t) lp->port_wwn);
3246 		} else {
3247 			isp_prt(isp, ISP_LOGCONFIG, prom,
3248 			    lp->portid, lp->handle,
3249 		    	    roles[lp->roles], "stayed",
3250 			    (uint32_t) (lp->node_wwn >> 32),
3251 			    (uint32_t) lp->node_wwn,
3252 		    	    (uint32_t) (lp->port_wwn >> 32),
3253 			    (uint32_t) lp->port_wwn);
3254 		}
3255 		break;
3256 	case ISPASYNC_DEV_GONE:
3257 		lp = arg;
3258 		/*
3259 		 * If this has a virtual target and we haven't marked it
3260 		 * that we're going to have isp_gdt tell the OS it's gone,
3261 		 * set the isp_gdt timer running on it.
3262 		 *
3263 		 * If it isn't marked that isp_gdt is going to get rid of it,
3264 		 * announce that it's gone.
3265 		 */
3266 		if (lp->ini_map_idx && lp->reserved == 0) {
3267 			lp->reserved = 1;
3268 			lp->new_reserved = isp->isp_osinfo.gone_device_time;
3269 			lp->state = FC_PORTDB_STATE_ZOMBIE;
3270 			if (isp->isp_osinfo.gdt_running == 0) {
3271 				isp_prt(isp, ISP_LOGSANCFG|ISP_LOGDEBUG0,
3272 				    "starting Gone Device Timer");
3273 				isp->isp_osinfo.gdt = timeout(isp_gdt, isp, hz);
3274 				isp->isp_osinfo.gdt_running = 1;
3275 			}
3276 			tgt = lp->ini_map_idx - 1;
3277 			isp_prt(isp, ISP_LOGCONFIG, prom2,
3278 			    lp->portid, lp->handle,
3279 		            roles[lp->roles], "gone zombie at", tgt,
3280 		    	    (uint32_t) (lp->node_wwn >> 32),
3281 			    (uint32_t) lp->node_wwn,
3282 		    	    (uint32_t) (lp->port_wwn >> 32),
3283 			    (uint32_t) lp->port_wwn);
3284 		} else if (lp->reserved == 0) {
3285 			isp_prt(isp, ISP_LOGCONFIG, prom,
3286 			    lp->portid, lp->handle,
3287 			    roles[lp->roles], "departed",
3288 			    (uint32_t) (lp->node_wwn >> 32),
3289 			    (uint32_t) lp->node_wwn,
3290 			    (uint32_t) (lp->port_wwn >> 32),
3291 			    (uint32_t) lp->port_wwn);
3292 		}
3293 		break;
3294 	case ISPASYNC_CHANGE_NOTIFY:
3295 	{
3296 		char *msg;
3297 		if (arg == ISPASYNC_CHANGE_PDB) {
3298 			msg = "Port Database Changed";
3299 		} else if (arg == ISPASYNC_CHANGE_SNS) {
3300 			msg = "Name Server Database Changed";
3301 		} else {
3302 			msg = "Other Change Notify";
3303 		}
3304 		/*
3305 		 * If the loop down timer is running, cancel it.
3306 		 */
3307 		if (isp->isp_osinfo.ldt_running) {
3308 			isp_prt(isp, ISP_LOGSANCFG|ISP_LOGDEBUG0,
3309 			   "Stopping Loop Down Timer");
3310 			isp->isp_osinfo.ldt_running = 0;
3311 			untimeout(isp_ldt, isp, isp->isp_osinfo.ldt);
3312 			callout_handle_init(&isp->isp_osinfo.ldt);
3313 		}
3314 		isp_prt(isp, ISP_LOGINFO, msg);
3315 		isp_freeze_loopdown(isp, msg);
3316 #if __FreeBSD_version < 500000
3317 		wakeup(&isp->isp_osinfo.kproc);
3318 #else
3319 #ifdef	ISP_SMPLOCK
3320 		cv_signal(&isp->isp_osinfo.kthread_cv);
3321 #else
3322 		wakeup(&isp->isp_osinfo.kthread_cv);
3323 #endif
3324 #endif
3325 		break;
3326 	}
3327 #ifdef	ISP_TARGET_MODE
3328 	case ISPASYNC_TARGET_NOTIFY:
3329 	{
3330 		tmd_notify_t *nt = arg;
3331 		isp_prt(isp, ISP_LOGALL,
3332 		    "target notify code 0x%x", nt->nt_ncode);
3333 		break;
3334 	}
3335 	case ISPASYNC_TARGET_ACTION:
3336 		switch (((isphdr_t *)arg)->rqs_entry_type) {
3337 		default:
3338 			isp_prt(isp, ISP_LOGWARN,
3339 			   "event 0x%x for unhandled target action",
3340 			    ((isphdr_t *)arg)->rqs_entry_type);
3341 			break;
3342 		case RQSTYPE_NOTIFY:
3343 			if (IS_SCSI(isp)) {
3344 				rv = isp_handle_platform_notify_scsi(isp,
3345 				    (in_entry_t *) arg);
3346 			} else {
3347 				rv = isp_handle_platform_notify_fc(isp,
3348 				    (in_fcentry_t *) arg);
3349 			}
3350 			break;
3351 		case RQSTYPE_ATIO:
3352 			rv = isp_handle_platform_atio(isp, (at_entry_t *) arg);
3353 			break;
3354 		case RQSTYPE_ATIO2:
3355 			rv = isp_handle_platform_atio2(isp, (at2_entry_t *)arg);
3356 			break;
3357 		case RQSTYPE_CTIO3:
3358 		case RQSTYPE_CTIO2:
3359 		case RQSTYPE_CTIO:
3360 			rv = isp_handle_platform_ctio(isp, arg);
3361 			break;
3362 		case RQSTYPE_ENABLE_LUN:
3363 		case RQSTYPE_MODIFY_LUN:
3364 			isp_ledone(isp, (lun_entry_t *) arg);
3365 			break;
3366 		}
3367 		break;
3368 #endif
3369 	case ISPASYNC_FW_CRASH:
3370 	{
3371 		uint16_t mbox1, mbox6;
3372 		mbox1 = ISP_READ(isp, OUTMAILBOX1);
3373 		if (IS_DUALBUS(isp)) {
3374 			mbox6 = ISP_READ(isp, OUTMAILBOX6);
3375 		} else {
3376 			mbox6 = 0;
3377 		}
3378                 isp_prt(isp, ISP_LOGERR,
3379                     "Internal Firmware Error on bus %d @ RISC Address 0x%x",
3380                     mbox6, mbox1);
3381 #ifdef	ISP_FW_CRASH_DUMP
3382 		/*
3383 		 * XXX: really need a thread to do this right.
3384 		 */
3385 		if (IS_FC(isp)) {
3386 			FCPARAM(isp)->isp_fwstate = FW_CONFIG_WAIT;
3387 			FCPARAM(isp)->isp_loopstate = LOOP_NIL;
3388 			isp_freeze_loopdown(isp, "f/w crash");
3389 			isp_fw_dump(isp);
3390 		}
3391 		isp_reinit(isp);
3392 		isp_async(isp, ISPASYNC_FW_RESTARTED, NULL);
3393 #endif
3394 		break;
3395 	}
3396 	case ISPASYNC_UNHANDLED_RESPONSE:
3397 		break;
3398 	default:
3399 		isp_prt(isp, ISP_LOGERR, "unknown isp_async event %d", cmd);
3400 		break;
3401 	}
3402 	return (rv);
3403 }
3404 
3405 
3406 /*
3407  * Locks are held before coming here.
3408  */
3409 void
3410 isp_uninit(ispsoftc_t *isp)
3411 {
3412 	if (IS_24XX(isp)) {
3413 		ISP_WRITE(isp, BIU2400_HCCR, HCCR_2400_CMD_RESET);
3414 	} else {
3415 		ISP_WRITE(isp, HCCR, HCCR_CMD_RESET);
3416 	}
3417 	ISP_DISABLE_INTS(isp);
3418 }
3419 
3420 void
3421 isp_prt(ispsoftc_t *isp, int level, const char *fmt, ...)
3422 {
3423 	va_list ap;
3424 	if (level != ISP_LOGALL && (level & isp->isp_dblev) == 0) {
3425 		return;
3426 	}
3427 	printf("%s: ", device_get_nameunit(isp->isp_dev));
3428 	va_start(ap, fmt);
3429 	vprintf(fmt, ap);
3430 	va_end(ap);
3431 	printf("\n");
3432 }
3433 
3434 uint64_t
3435 isp_nanotime_sub(struct timespec *b, struct timespec *a)
3436 {
3437 	uint64_t elapsed;
3438 	struct timespec x = *b;
3439 	timespecsub(&x, a);
3440 	elapsed = GET_NANOSEC(&x);
3441 	if (elapsed == 0)
3442 		elapsed++;
3443 	return (elapsed);
3444 }
3445 
3446 int
3447 isp_mbox_acquire(ispsoftc_t *isp)
3448 {
3449 	if (isp->isp_osinfo.mboxbsy) {
3450 		return (1);
3451 	} else {
3452 		isp->isp_osinfo.mboxcmd_done = 0;
3453 		isp->isp_osinfo.mboxbsy = 1;
3454 		return (0);
3455 	}
3456 }
3457 
3458 void
3459 isp_mbox_wait_complete(ispsoftc_t *isp, mbreg_t *mbp)
3460 {
3461 	int usecs = mbp->timeout;
3462 	int j;
3463 
3464 	if (usecs == 0) {
3465 		usecs = MBCMD_DEFAULT_TIMEOUT;
3466 	}
3467 	if (isp->isp_mbxwrk0) {
3468 		usecs *= isp->isp_mbxwrk0;
3469 	}
3470 	if (isp->isp_osinfo.mbox_sleep_ok) {
3471 		int ms = usecs / 1000;
3472 		isp->isp_osinfo.mbox_sleep_ok = 0;
3473 		isp->isp_osinfo.mbox_sleeping = 1;
3474 #if __FreeBSD_version < 500000  || !defined(ISP_SMPLOCK)
3475 		tsleep(&isp->isp_mbxworkp, PRIBIO, "ispmbx_sleep",
3476 		    isp_mstohz(ms));
3477 #else
3478 		msleep(&isp->isp_mbxworkp, &isp->isp_mtx, PRIBIO,
3479 		    "ispmbx_sleep", isp_mstohz(ms));
3480 #endif
3481 		isp->isp_osinfo.mbox_sleep_ok = 1;
3482 		isp->isp_osinfo.mbox_sleeping = 0;
3483 	} else {
3484 		for (j = 0; j < usecs; j += 100) {
3485 			uint32_t isr;
3486 			uint16_t sema, mbox;
3487 			if (isp->isp_osinfo.mboxcmd_done) {
3488 				break;
3489 			}
3490 			if (ISP_READ_ISR(isp, &isr, &sema, &mbox)) {
3491 				isp_intr(isp, isr, sema, mbox);
3492 				if (isp->isp_osinfo.mboxcmd_done) {
3493 					break;
3494 				}
3495 			}
3496 			USEC_DELAY(100);
3497 		}
3498 	}
3499 	if (isp->isp_osinfo.mboxcmd_done == 0) {
3500 		isp_prt(isp, ISP_LOGWARN,
3501 		    "%s Mailbox Command (0x%x) Timeout",
3502 		    isp->isp_osinfo.mbox_sleep_ok? "Interrupting" : "Polled",
3503 		    isp->isp_lastmbxcmd);
3504 		mbp->param[0] = MBOX_TIMEOUT;
3505 		isp->isp_osinfo.mboxcmd_done = 1;
3506 	}
3507 }
3508 
3509 void
3510 isp_mbox_notify_done(ispsoftc_t *isp)
3511 {
3512 	if (isp->isp_osinfo.mbox_sleeping) {
3513 		wakeup(&isp->isp_mbxworkp);
3514 	}
3515 	isp->isp_osinfo.mboxcmd_done = 1;
3516 }
3517 
3518 void
3519 isp_mbox_release(ispsoftc_t *isp)
3520 {
3521 	isp->isp_osinfo.mboxbsy = 0;
3522 }
3523 
3524 int
3525 isp_mstohz(int ms)
3526 {
3527 	struct timeval t;
3528 	t.tv_sec = ms / 1000;
3529 	t.tv_usec = (ms % 1000) * 1000;
3530 	ms = tvtohz(&t);
3531 	if (ms < 0) {
3532 		ms = 0x7fffffff;
3533 	}
3534 	return (ms);
3535 }
3536