xref: /freebsd/sys/dev/isp/isp_freebsd.c (revision acd3428b7d3e94cef0e1881c868cb4b131d4ff41)
1 /*-
2  *
3  * Copyright (c) 1997-2006 by Matthew Jacob
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice immediately at the beginning of the file, without modification,
11  *    this list of conditions, and the following disclaimer.
12  * 2. The name of the author may not be used to endorse or promote products
13  *    derived from this software without specific prior written permission.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
19  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25  * SUCH DAMAGE.
26  */
27 
28 /*
29  * Platform (FreeBSD) dependent common attachment code for Qlogic adapters.
30  */
31 #include <sys/cdefs.h>
32 __FBSDID("$FreeBSD$");
33 #include <dev/isp/isp_freebsd.h>
34 #include <sys/unistd.h>
35 #include <sys/kthread.h>
36 #include <machine/stdarg.h>	/* for use by isp_prt below */
37 #include <sys/conf.h>
38 #include <sys/module.h>
39 #include <sys/ioccom.h>
40 #include <dev/isp/isp_ioctl.h>
41 #if	__FreeBSD_version >= 500000
42 #include <sys/sysctl.h>
43 #endif
44 
45 
46 MODULE_VERSION(isp, 1);
47 MODULE_DEPEND(isp, cam, 1, 1, 1);
48 int isp_announced = 0;
49 int isp_fabric_hysteresis = 5;
50 int isp_loop_down_limit = 300;	/* default loop down limit */
51 int isp_quickboot_time = 5;	/* don't wait more than N secs for loop up */
52 
53 static d_ioctl_t ispioctl;
54 static void isp_intr_enable(void *);
55 static void isp_cam_async(void *, uint32_t, struct cam_path *, void *);
56 static void isp_poll(struct cam_sim *);
57 static timeout_t isp_watchdog;
58 static void isp_kthread(void *);
59 static void isp_action(struct cam_sim *, union ccb *);
60 
61 #if __FreeBSD_version < 700000
62 ispfwfunc *isp_get_firmware_p = NULL;
63 #endif
64 
65 #if __FreeBSD_version < 500000
66 #define ISP_CDEV_MAJOR	248
67 static struct cdevsw isp_cdevsw = {
68 	/* open */	nullopen,
69 	/* close */	nullclose,
70 	/* read */	noread,
71 	/* write */	nowrite,
72 	/* ioctl */	ispioctl,
73 	/* poll */	nopoll,
74 	/* mmap */	nommap,
75 	/* strategy */	nostrategy,
76 	/* name */	"isp",
77 	/* maj */	ISP_CDEV_MAJOR,
78 	/* dump */	nodump,
79 	/* psize */	nopsize,
80 	/* flags */	D_TAPE,
81 };
82 #define	isp_sysctl_update(x)	do { ; } while (0)
83 #else
84 static struct cdevsw isp_cdevsw = {
85 	.d_version =	D_VERSION,
86 	.d_flags =	D_NEEDGIANT,
87 	.d_ioctl =	ispioctl,
88 	.d_name =	"isp",
89 };
90 static void isp_sysctl_update(ispsoftc_t *);
91 #endif
92 
93 static ispsoftc_t *isplist = NULL;
94 
95 void
96 isp_attach(ispsoftc_t *isp)
97 {
98 	int primary, secondary;
99 	struct ccb_setasync csa;
100 	struct cam_devq *devq;
101 	struct cam_sim *sim;
102 	struct cam_path *path;
103 
104 	/*
105 	 * Establish (in case of 12X0) which bus is the primary.
106 	 */
107 
108 	primary = 0;
109 	secondary = 1;
110 
111 	/*
112 	 * Create the device queue for our SIM(s).
113 	 */
114 	devq = cam_simq_alloc(isp->isp_maxcmds);
115 	if (devq == NULL) {
116 		return;
117 	}
118 
119 	/*
120 	 * Construct our SIM entry.
121 	 */
122 	ISPLOCK_2_CAMLOCK(isp);
123 	sim = cam_sim_alloc(isp_action, isp_poll, "isp", isp,
124 	    device_get_unit(isp->isp_dev), 1, isp->isp_maxcmds, devq);
125 	if (sim == NULL) {
126 		cam_simq_free(devq);
127 		CAMLOCK_2_ISPLOCK(isp);
128 		return;
129 	}
130 	CAMLOCK_2_ISPLOCK(isp);
131 
132 	isp->isp_osinfo.ehook.ich_func = isp_intr_enable;
133 	isp->isp_osinfo.ehook.ich_arg = isp;
134 	ISPLOCK_2_CAMLOCK(isp);
135 	if (config_intrhook_establish(&isp->isp_osinfo.ehook) != 0) {
136 		cam_sim_free(sim, TRUE);
137 		CAMLOCK_2_ISPLOCK(isp);
138 		isp_prt(isp, ISP_LOGERR,
139 		    "could not establish interrupt enable hook");
140 		return;
141 	}
142 
143 	if (xpt_bus_register(sim, primary) != CAM_SUCCESS) {
144 		cam_sim_free(sim, TRUE);
145 		CAMLOCK_2_ISPLOCK(isp);
146 		return;
147 	}
148 
149 	if (xpt_create_path(&path, NULL, cam_sim_path(sim),
150 	    CAM_TARGET_WILDCARD, CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
151 		xpt_bus_deregister(cam_sim_path(sim));
152 		cam_sim_free(sim, TRUE);
153 		config_intrhook_disestablish(&isp->isp_osinfo.ehook);
154 		CAMLOCK_2_ISPLOCK(isp);
155 		return;
156 	}
157 
158 	xpt_setup_ccb(&csa.ccb_h, path, 5);
159 	csa.ccb_h.func_code = XPT_SASYNC_CB;
160 	csa.event_enable = AC_LOST_DEVICE;
161 	csa.callback = isp_cam_async;
162 	csa.callback_arg = sim;
163 	xpt_action((union ccb *)&csa);
164 	CAMLOCK_2_ISPLOCK(isp);
165 	isp->isp_sim = sim;
166 	isp->isp_path = path;
167 	/*
168 	 * Create a kernel thread for fibre channel instances. We
169 	 * don't have dual channel FC cards.
170 	 */
171 	if (IS_FC(isp)) {
172 		ISPLOCK_2_CAMLOCK(isp);
173 #if __FreeBSD_version >= 500000
174 		/* XXX: LOCK VIOLATION */
175 		cv_init(&isp->isp_osinfo.kthread_cv, "isp_kthread_cv");
176 		if (kthread_create(isp_kthread, isp, &isp->isp_osinfo.kproc,
177 		    RFHIGHPID, 0, "%s: fc_thrd",
178 		    device_get_nameunit(isp->isp_dev)))
179 #else
180 		if (kthread_create(isp_kthread, isp, &isp->isp_osinfo.kproc,
181 		    "%s: fc_thrd", device_get_nameunit(isp->isp_dev)))
182 #endif
183 		{
184 			xpt_bus_deregister(cam_sim_path(sim));
185 			cam_sim_free(sim, TRUE);
186 			config_intrhook_disestablish(&isp->isp_osinfo.ehook);
187 			CAMLOCK_2_ISPLOCK(isp);
188 			isp_prt(isp, ISP_LOGERR, "could not create kthread");
189 			return;
190 		}
191 		CAMLOCK_2_ISPLOCK(isp);
192 	}
193 
194 
195 	/*
196 	 * If we have a second channel, construct SIM entry for that.
197 	 */
198 	if (IS_DUALBUS(isp)) {
199 		ISPLOCK_2_CAMLOCK(isp);
200 		sim = cam_sim_alloc(isp_action, isp_poll, "isp", isp,
201 		    device_get_unit(isp->isp_dev), 1, isp->isp_maxcmds, devq);
202 		if (sim == NULL) {
203 			xpt_bus_deregister(cam_sim_path(isp->isp_sim));
204 			xpt_free_path(isp->isp_path);
205 			cam_simq_free(devq);
206 			config_intrhook_disestablish(&isp->isp_osinfo.ehook);
207 			return;
208 		}
209 		if (xpt_bus_register(sim, secondary) != CAM_SUCCESS) {
210 			xpt_bus_deregister(cam_sim_path(isp->isp_sim));
211 			xpt_free_path(isp->isp_path);
212 			cam_sim_free(sim, TRUE);
213 			config_intrhook_disestablish(&isp->isp_osinfo.ehook);
214 			CAMLOCK_2_ISPLOCK(isp);
215 			return;
216 		}
217 
218 		if (xpt_create_path(&path, NULL, cam_sim_path(sim),
219 		    CAM_TARGET_WILDCARD, CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
220 			xpt_bus_deregister(cam_sim_path(isp->isp_sim));
221 			xpt_free_path(isp->isp_path);
222 			xpt_bus_deregister(cam_sim_path(sim));
223 			cam_sim_free(sim, TRUE);
224 			config_intrhook_disestablish(&isp->isp_osinfo.ehook);
225 			CAMLOCK_2_ISPLOCK(isp);
226 			return;
227 		}
228 
229 		xpt_setup_ccb(&csa.ccb_h, path, 5);
230 		csa.ccb_h.func_code = XPT_SASYNC_CB;
231 		csa.event_enable = AC_LOST_DEVICE;
232 		csa.callback = isp_cam_async;
233 		csa.callback_arg = sim;
234 		xpt_action((union ccb *)&csa);
235 		CAMLOCK_2_ISPLOCK(isp);
236 		isp->isp_sim2 = sim;
237 		isp->isp_path2 = path;
238 	}
239 
240 	/*
241 	 * Create device nodes
242 	 */
243 	(void) make_dev(&isp_cdevsw, device_get_unit(isp->isp_dev), UID_ROOT,
244 	    GID_OPERATOR, 0600, "%s", device_get_nameunit(isp->isp_dev));
245 
246 	if (isp->isp_role != ISP_ROLE_NONE) {
247 		isp->isp_state = ISP_RUNSTATE;
248 		ISP_ENABLE_INTS(isp);
249 	}
250 	if (isplist == NULL) {
251 		isplist = isp;
252 	} else {
253 		ispsoftc_t *tmp = isplist;
254 		while (tmp->isp_osinfo.next) {
255 			tmp = tmp->isp_osinfo.next;
256 		}
257 		tmp->isp_osinfo.next = isp;
258 	}
259 	isp_sysctl_update(isp);
260 }
261 
262 static __inline void
263 isp_freeze_loopdown(ispsoftc_t *isp, char *msg)
264 {
265 	if (isp->isp_osinfo.simqfrozen == 0) {
266 		isp_prt(isp, ISP_LOGDEBUG0, "%s: freeze simq (loopdown)", msg);
267 		isp->isp_osinfo.simqfrozen |= SIMQFRZ_LOOPDOWN;
268 		ISPLOCK_2_CAMLOCK(isp);
269 		xpt_freeze_simq(isp->isp_sim, 1);
270 		CAMLOCK_2_ISPLOCK(isp);
271 	} else {
272 		isp_prt(isp, ISP_LOGDEBUG0, "%s: mark frozen (loopdown)", msg);
273 		isp->isp_osinfo.simqfrozen |= SIMQFRZ_LOOPDOWN;
274 	}
275 }
276 
277 
278 #if __FreeBSD_version < 500000
279 #define	_DEV	dev_t
280 #define	_IOP	struct proc
281 #else
282 #define	_IOP	struct thread
283 #define	_DEV	struct cdev *
284 #endif
285 
286 static int
287 ispioctl(_DEV dev, u_long c, caddr_t addr, int flags, _IOP *td)
288 {
289 	ispsoftc_t *isp;
290 	int nr, retval = ENOTTY;
291 
292 	isp = isplist;
293 	while (isp) {
294 		if (minor(dev) == device_get_unit(isp->isp_dev)) {
295 			break;
296 		}
297 		isp = isp->isp_osinfo.next;
298 	}
299 	if (isp == NULL)
300 		return (ENXIO);
301 
302 	switch (c) {
303 #ifdef	ISP_FW_CRASH_DUMP
304 	case ISP_GET_FW_CRASH_DUMP:
305 		if (IS_FC(isp)) {
306 			uint16_t *ptr = FCPARAM(isp)->isp_dump_data;
307 			size_t sz;
308 
309 			retval = 0;
310 			if (IS_2200(isp)) {
311 				sz = QLA2200_RISC_IMAGE_DUMP_SIZE;
312 			} else {
313 				sz = QLA2300_RISC_IMAGE_DUMP_SIZE;
314 			}
315 			ISP_LOCK(isp);
316 			if (ptr && *ptr) {
317 				void *uaddr = *((void **) addr);
318 				if (copyout(ptr, uaddr, sz)) {
319 					retval = EFAULT;
320 				} else {
321 					*ptr = 0;
322 				}
323 			} else {
324 				retval = ENXIO;
325 			}
326 			ISP_UNLOCK(isp);
327 		}
328 		break;
329 	case ISP_FORCE_CRASH_DUMP:
330 		if (IS_FC(isp)) {
331 			ISP_LOCK(isp);
332 			isp_freeze_loopdown(isp,
333 			    "ispioctl(ISP_FORCE_CRASH_DUMP)");
334 			isp_fw_dump(isp);
335 			isp_reinit(isp);
336 			ISP_UNLOCK(isp);
337 			retval = 0;
338 		}
339 		break;
340 #endif
341 	case ISP_SDBLEV:
342 	{
343 		int olddblev = isp->isp_dblev;
344 		isp->isp_dblev = *(int *)addr;
345 		*(int *)addr = olddblev;
346 		retval = 0;
347 		break;
348 	}
349 	case ISP_GETROLE:
350 		*(int *)addr = isp->isp_role;
351 		retval = 0;
352 		break;
353 	case ISP_SETROLE:
354 		nr = *(int *)addr;
355 		if (nr & ~(ISP_ROLE_INITIATOR|ISP_ROLE_TARGET)) {
356 			retval = EINVAL;
357 			break;
358 		}
359 		*(int *)addr = isp->isp_role;
360 		isp->isp_role = nr;
361 		/* FALLTHROUGH */
362 	case ISP_RESETHBA:
363 		ISP_LOCK(isp);
364 		isp_reinit(isp);
365 		ISP_UNLOCK(isp);
366 		retval = 0;
367 		break;
368 	case ISP_RESCAN:
369 		if (IS_FC(isp)) {
370 			ISP_LOCK(isp);
371 			if (isp_fc_runstate(isp, 5 * 1000000)) {
372 				retval = EIO;
373 			} else {
374 				retval = 0;
375 			}
376 			ISP_UNLOCK(isp);
377 		}
378 		break;
379 	case ISP_FC_LIP:
380 		if (IS_FC(isp)) {
381 			ISP_LOCK(isp);
382 			if (isp_control(isp, ISPCTL_SEND_LIP, 0)) {
383 				retval = EIO;
384 			} else {
385 				retval = 0;
386 			}
387 			ISP_UNLOCK(isp);
388 		}
389 		break;
390 	case ISP_FC_GETDINFO:
391 	{
392 		struct isp_fc_device *ifc = (struct isp_fc_device *) addr;
393 		fcportdb_t *lp;
394 
395 		if (IS_SCSI(isp)) {
396 			break;
397 		}
398 		if (ifc->loopid < 0 || ifc->loopid >= MAX_FC_TARG) {
399 			retval = EINVAL;
400 			break;
401 		}
402 		ISP_LOCK(isp);
403 		lp = &FCPARAM(isp)->portdb[ifc->loopid];
404 		if (lp->state == FC_PORTDB_STATE_VALID) {
405 			ifc->role = lp->roles;
406 			ifc->loopid = lp->handle;
407 			ifc->portid = lp->portid;
408 			ifc->node_wwn = lp->node_wwn;
409 			ifc->port_wwn = lp->port_wwn;
410 			retval = 0;
411 		} else {
412 			retval = ENODEV;
413 		}
414 		ISP_UNLOCK(isp);
415 		break;
416 	}
417 	case ISP_GET_STATS:
418 	{
419 		isp_stats_t *sp = (isp_stats_t *) addr;
420 
421 		MEMZERO(sp, sizeof (*sp));
422 		sp->isp_stat_version = ISP_STATS_VERSION;
423 		sp->isp_type = isp->isp_type;
424 		sp->isp_revision = isp->isp_revision;
425 		ISP_LOCK(isp);
426 		sp->isp_stats[ISP_INTCNT] = isp->isp_intcnt;
427 		sp->isp_stats[ISP_INTBOGUS] = isp->isp_intbogus;
428 		sp->isp_stats[ISP_INTMBOXC] = isp->isp_intmboxc;
429 		sp->isp_stats[ISP_INGOASYNC] = isp->isp_intoasync;
430 		sp->isp_stats[ISP_RSLTCCMPLT] = isp->isp_rsltccmplt;
431 		sp->isp_stats[ISP_FPHCCMCPLT] = isp->isp_fphccmplt;
432 		sp->isp_stats[ISP_RSCCHIWAT] = isp->isp_rscchiwater;
433 		sp->isp_stats[ISP_FPCCHIWAT] = isp->isp_fpcchiwater;
434 		ISP_UNLOCK(isp);
435 		retval = 0;
436 		break;
437 	}
438 	case ISP_CLR_STATS:
439 		ISP_LOCK(isp);
440 		isp->isp_intcnt = 0;
441 		isp->isp_intbogus = 0;
442 		isp->isp_intmboxc = 0;
443 		isp->isp_intoasync = 0;
444 		isp->isp_rsltccmplt = 0;
445 		isp->isp_fphccmplt = 0;
446 		isp->isp_rscchiwater = 0;
447 		isp->isp_fpcchiwater = 0;
448 		ISP_UNLOCK(isp);
449 		retval = 0;
450 		break;
451 	case ISP_FC_GETHINFO:
452 	{
453 		struct isp_hba_device *hba = (struct isp_hba_device *) addr;
454 		MEMZERO(hba, sizeof (*hba));
455 
456 		hba->fc_fw_major = ISP_FW_MAJORX(isp->isp_fwrev);
457 		hba->fc_fw_minor = ISP_FW_MINORX(isp->isp_fwrev);
458 		hba->fc_fw_micro = ISP_FW_MICROX(isp->isp_fwrev);
459 		if (IS_FC(isp)) {
460 			hba->fc_speed = FCPARAM(isp)->isp_gbspeed;
461 			hba->fc_scsi_supported = 1;
462 			hba->fc_topology = FCPARAM(isp)->isp_topo + 1;
463 			hba->fc_loopid = FCPARAM(isp)->isp_loopid;
464 			hba->nvram_node_wwn = FCPARAM(isp)->isp_nodewwn;
465 			hba->nvram_port_wwn = FCPARAM(isp)->isp_portwwn;
466 			hba->active_node_wwn = ISP_NODEWWN(isp);
467 			hba->active_port_wwn = ISP_PORTWWN(isp);
468 		}
469 		retval = 0;
470 		break;
471 	}
472 	case ISP_GET_FC_PARAM:
473 	{
474 		struct isp_fc_param *f = (struct isp_fc_param *) addr;
475 
476 		if (IS_SCSI(isp)) {
477 			break;
478 		}
479 		f->parameter = 0;
480 		if (strcmp(f->param_name, "framelength") == 0) {
481 			f->parameter = FCPARAM(isp)->isp_maxfrmlen;
482 			retval = 0;
483 			break;
484 		}
485 		if (strcmp(f->param_name, "exec_throttle") == 0) {
486 			f->parameter = FCPARAM(isp)->isp_execthrottle;
487 			retval = 0;
488 			break;
489 		}
490 		if (strcmp(f->param_name, "fullduplex") == 0) {
491 			if (FCPARAM(isp)->isp_fwoptions & ICBOPT_FULL_DUPLEX)
492 				f->parameter = 1;
493 			retval = 0;
494 			break;
495 		}
496 		if (strcmp(f->param_name, "loopid") == 0) {
497 			f->parameter = FCPARAM(isp)->isp_loopid;
498 			retval = 0;
499 			break;
500 		}
501 		retval = EINVAL;
502 		break;
503 	}
504 	case ISP_SET_FC_PARAM:
505 	{
506 		struct isp_fc_param *f = (struct isp_fc_param *) addr;
507 		uint32_t param = f->parameter;
508 
509 		if (IS_SCSI(isp)) {
510 			break;
511 		}
512 		f->parameter = 0;
513 		if (strcmp(f->param_name, "framelength") == 0) {
514 			if (param != 512 && param != 1024 && param != 1024) {
515 				retval = EINVAL;
516 				break;
517 			}
518 			FCPARAM(isp)->isp_maxfrmlen = param;
519 			retval = 0;
520 			break;
521 		}
522 		if (strcmp(f->param_name, "exec_throttle") == 0) {
523 			if (param < 16 || param > 255) {
524 				retval = EINVAL;
525 				break;
526 			}
527 			FCPARAM(isp)->isp_execthrottle = param;
528 			retval = 0;
529 			break;
530 		}
531 		if (strcmp(f->param_name, "fullduplex") == 0) {
532 			if (param != 0 && param != 1) {
533 				retval = EINVAL;
534 				break;
535 			}
536 			if (param) {
537 				FCPARAM(isp)->isp_fwoptions |=
538 				    ICBOPT_FULL_DUPLEX;
539 			} else {
540 				FCPARAM(isp)->isp_fwoptions &=
541 				    ~ICBOPT_FULL_DUPLEX;
542 			}
543 			retval = 0;
544 			break;
545 		}
546 		if (strcmp(f->param_name, "loopid") == 0) {
547 			if (param < 0 || param > 125) {
548 				retval = EINVAL;
549 				break;
550 			}
551 			FCPARAM(isp)->isp_loopid = param;
552 			retval = 0;
553 			break;
554 		}
555 		retval = EINVAL;
556 		break;
557 	}
558 	case ISP_TSK_MGMT:
559 	{
560 		int needmarker;
561 		struct isp_fc_tsk_mgmt *fct = (struct isp_fc_tsk_mgmt *) addr;
562 		uint16_t loopid;
563 		mbreg_t mbs;
564 
565 		if (IS_SCSI(isp)) {
566 			break;
567 		}
568 
569 		memset(&mbs, 0, sizeof (mbs));
570 		needmarker = retval = 0;
571 		loopid = fct->loopid;
572 		if (FCPARAM(isp)->isp_2klogin == 0) {
573 			loopid <<= 8;
574 		}
575 		switch (fct->action) {
576 		case IPT_CLEAR_ACA:
577 			mbs.param[0] = MBOX_CLEAR_ACA;
578 			mbs.param[1] = loopid;
579 			mbs.param[2] = fct->lun;
580 			break;
581 		case IPT_TARGET_RESET:
582 			mbs.param[0] = MBOX_TARGET_RESET;
583 			mbs.param[1] = loopid;
584 			needmarker = 1;
585 			break;
586 		case IPT_LUN_RESET:
587 			mbs.param[0] = MBOX_LUN_RESET;
588 			mbs.param[1] = loopid;
589 			mbs.param[2] = fct->lun;
590 			needmarker = 1;
591 			break;
592 		case IPT_CLEAR_TASK_SET:
593 			mbs.param[0] = MBOX_CLEAR_TASK_SET;
594 			mbs.param[1] = loopid;
595 			mbs.param[2] = fct->lun;
596 			needmarker = 1;
597 			break;
598 		case IPT_ABORT_TASK_SET:
599 			mbs.param[0] = MBOX_ABORT_TASK_SET;
600 			mbs.param[1] = loopid;
601 			mbs.param[2] = fct->lun;
602 			needmarker = 1;
603 			break;
604 		default:
605 			retval = EINVAL;
606 			break;
607 		}
608 		if (retval == 0) {
609 			ISP_LOCK(isp);
610 			if (needmarker) {
611 				isp->isp_sendmarker |= 1;
612 			}
613 			retval = isp_control(isp, ISPCTL_RUN_MBOXCMD, &mbs);
614 			ISP_UNLOCK(isp);
615 			if (retval)
616 				retval = EIO;
617 		}
618 		break;
619 	}
620 	default:
621 		break;
622 	}
623 	return (retval);
624 }
625 
626 #if __FreeBSD_version >= 500000
627 static void
628 isp_sysctl_update(ispsoftc_t *isp)
629 {
630 	struct sysctl_ctx_list *ctx =
631 	    device_get_sysctl_ctx(isp->isp_osinfo.dev);
632 	struct sysctl_oid *tree = device_get_sysctl_tree(isp->isp_osinfo.dev);
633 
634 	if (IS_SCSI(isp)) {
635 		isp->isp_osinfo.sysctl_info.spi.iid = DEFAULT_IID(isp);
636 		SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO, "iid",
637 		    CTLFLAG_RD, &isp->isp_osinfo.sysctl_info.spi.iid, 0,
638 		    "Initiator ID");
639 		return;
640 	}
641 	snprintf(isp->isp_osinfo.sysctl_info.fc.wwnn,
642 	    sizeof (isp->isp_osinfo.sysctl_info.fc.wwnn), "0x%08x%08x",
643 	    (uint32_t) (ISP_NODEWWN(isp) >> 32), (uint32_t) ISP_NODEWWN(isp));
644 
645 	snprintf(isp->isp_osinfo.sysctl_info.fc.wwpn,
646 	    sizeof (isp->isp_osinfo.sysctl_info.fc.wwpn), "0x%08x%08x",
647 	    (uint32_t) (ISP_PORTWWN(isp) >> 32), (uint32_t) ISP_PORTWWN(isp));
648 
649 	SYSCTL_ADD_STRING(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
650 	       "wwnn", CTLFLAG_RD, isp->isp_osinfo.sysctl_info.fc.wwnn, 0,
651 	       "World Wide Node Name");
652 	SYSCTL_ADD_STRING(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
653 	       "wwpn", CTLFLAG_RD, isp->isp_osinfo.sysctl_info.fc.wwpn, 0,
654 	       "World Wide Port Name");
655 }
656 #endif
657 
658 static void
659 isp_intr_enable(void *arg)
660 {
661 	ispsoftc_t *isp = arg;
662 	if (isp->isp_role != ISP_ROLE_NONE) {
663 		ISP_ENABLE_INTS(isp);
664 	}
665 	/* Release our hook so that the boot can continue. */
666 	config_intrhook_disestablish(&isp->isp_osinfo.ehook);
667 }
668 
669 /*
670  * Put the target mode functions here, because some are inlines
671  */
672 
673 #ifdef	ISP_TARGET_MODE
674 
675 static __inline int is_lun_enabled(ispsoftc_t *, int, lun_id_t);
676 static __inline int are_any_luns_enabled(ispsoftc_t *, int);
677 static __inline tstate_t *get_lun_statep(ispsoftc_t *, int, lun_id_t);
678 static __inline void rls_lun_statep(ispsoftc_t *, tstate_t *);
679 static __inline atio_private_data_t *isp_get_atpd(ispsoftc_t *, int);
680 static cam_status
681 create_lun_state(ispsoftc_t *, int, struct cam_path *, tstate_t **);
682 static void destroy_lun_state(ispsoftc_t *, tstate_t *);
683 static int isp_en_lun(ispsoftc_t *, union ccb *);
684 static void isp_ledone(ispsoftc_t *, lun_entry_t *);
685 static cam_status isp_abort_tgt_ccb(ispsoftc_t *, union ccb *);
686 static timeout_t isp_refire_putback_atio;
687 static void isp_complete_ctio(union ccb *);
688 static void isp_target_putback_atio(union ccb *);
689 static void isp_target_start_ctio(ispsoftc_t *, union ccb *);
690 static int isp_handle_platform_atio(ispsoftc_t *, at_entry_t *);
691 static int isp_handle_platform_atio2(ispsoftc_t *, at2_entry_t *);
692 static int isp_handle_platform_ctio(ispsoftc_t *, void *);
693 static int isp_handle_platform_notify_scsi(ispsoftc_t *, in_entry_t *);
694 static int isp_handle_platform_notify_fc(ispsoftc_t *, in_fcentry_t *);
695 
696 static __inline int
697 is_lun_enabled(ispsoftc_t *isp, int bus, lun_id_t lun)
698 {
699 	tstate_t *tptr;
700 	tptr = isp->isp_osinfo.lun_hash[LUN_HASH_FUNC(isp, bus, lun)];
701 	if (tptr == NULL) {
702 		return (0);
703 	}
704 	do {
705 		if (tptr->lun == (lun_id_t) lun && tptr->bus == bus) {
706 			return (1);
707 		}
708 	} while ((tptr = tptr->next) != NULL);
709 	return (0);
710 }
711 
712 static __inline int
713 are_any_luns_enabled(ispsoftc_t *isp, int port)
714 {
715 	int lo, hi;
716 	if (IS_DUALBUS(isp)) {
717 		lo = (port * (LUN_HASH_SIZE >> 1));
718 		hi = lo + (LUN_HASH_SIZE >> 1);
719 	} else {
720 		lo = 0;
721 		hi = LUN_HASH_SIZE;
722 	}
723 	for (lo = 0; lo < hi; lo++) {
724 		if (isp->isp_osinfo.lun_hash[lo]) {
725 			return (1);
726 		}
727 	}
728 	return (0);
729 }
730 
731 static __inline tstate_t *
732 get_lun_statep(ispsoftc_t *isp, int bus, lun_id_t lun)
733 {
734 	tstate_t *tptr = NULL;
735 
736 	if (lun == CAM_LUN_WILDCARD) {
737 		if (isp->isp_osinfo.tmflags[bus] & TM_WILDCARD_ENABLED) {
738 			tptr = &isp->isp_osinfo.tsdflt[bus];
739 			tptr->hold++;
740 			return (tptr);
741 		}
742 		return (NULL);
743 	} else {
744 		tptr = isp->isp_osinfo.lun_hash[LUN_HASH_FUNC(isp, bus, lun)];
745 		if (tptr == NULL) {
746 			return (NULL);
747 		}
748 	}
749 
750 	do {
751 		if (tptr->lun == lun && tptr->bus == bus) {
752 			tptr->hold++;
753 			return (tptr);
754 		}
755 	} while ((tptr = tptr->next) != NULL);
756 	return (tptr);
757 }
758 
759 static __inline void
760 rls_lun_statep(ispsoftc_t *isp, tstate_t *tptr)
761 {
762 	if (tptr->hold)
763 		tptr->hold--;
764 }
765 
766 static __inline atio_private_data_t *
767 isp_get_atpd(ispsoftc_t *isp, int tag)
768 {
769 	atio_private_data_t *atp;
770 	for (atp = isp->isp_osinfo.atpdp;
771 	    atp < &isp->isp_osinfo.atpdp[ATPDPSIZE]; atp++) {
772 		if (atp->tag == tag)
773 			return (atp);
774 	}
775 	return (NULL);
776 }
777 
778 static cam_status
779 create_lun_state(ispsoftc_t *isp, int bus,
780     struct cam_path *path, tstate_t **rslt)
781 {
782 	cam_status status;
783 	lun_id_t lun;
784 	int hfx;
785 	tstate_t *tptr, *new;
786 
787 	lun = xpt_path_lun_id(path);
788 	if (lun < 0) {
789 		return (CAM_LUN_INVALID);
790 	}
791 	if (is_lun_enabled(isp, bus, lun)) {
792 		return (CAM_LUN_ALRDY_ENA);
793 	}
794 	new = (tstate_t *) malloc(sizeof (tstate_t), M_DEVBUF, M_NOWAIT|M_ZERO);
795 	if (new == NULL) {
796 		return (CAM_RESRC_UNAVAIL);
797 	}
798 
799 	status = xpt_create_path(&new->owner, NULL, xpt_path_path_id(path),
800 	    xpt_path_target_id(path), xpt_path_lun_id(path));
801 	if (status != CAM_REQ_CMP) {
802 		free(new, M_DEVBUF);
803 		return (status);
804 	}
805 	new->bus = bus;
806 	new->lun = lun;
807 	SLIST_INIT(&new->atios);
808 	SLIST_INIT(&new->inots);
809 	new->hold = 1;
810 
811 	hfx = LUN_HASH_FUNC(isp, new->bus, new->lun);
812 	tptr = isp->isp_osinfo.lun_hash[hfx];
813 	if (tptr == NULL) {
814 		isp->isp_osinfo.lun_hash[hfx] = new;
815 	} else {
816 		while (tptr->next)
817 			tptr = tptr->next;
818 		tptr->next = new;
819 	}
820 	*rslt = new;
821 	return (CAM_REQ_CMP);
822 }
823 
824 static __inline void
825 destroy_lun_state(ispsoftc_t *isp, tstate_t *tptr)
826 {
827 	int hfx;
828 	tstate_t *lw, *pw;
829 
830 	if (tptr->hold) {
831 		return;
832 	}
833 	hfx = LUN_HASH_FUNC(isp, tptr->bus, tptr->lun);
834 	pw = isp->isp_osinfo.lun_hash[hfx];
835 	if (pw == NULL) {
836 		return;
837 	} else if (pw->lun == tptr->lun && pw->bus == tptr->bus) {
838 		isp->isp_osinfo.lun_hash[hfx] = pw->next;
839 	} else {
840 		lw = pw;
841 		pw = lw->next;
842 		while (pw) {
843 			if (pw->lun == tptr->lun && pw->bus == tptr->bus) {
844 				lw->next = pw->next;
845 				break;
846 			}
847 			lw = pw;
848 			pw = pw->next;
849 		}
850 		if (pw == NULL) {
851 			return;
852 		}
853 	}
854 	free(tptr, M_DEVBUF);
855 }
856 
857 /*
858  * Enable luns.
859  */
860 static int
861 isp_en_lun(ispsoftc_t *isp, union ccb *ccb)
862 {
863 	struct ccb_en_lun *cel = &ccb->cel;
864 	tstate_t *tptr;
865 	uint32_t seq;
866 	int bus, cmd, av, wildcard, tm_on;
867 	lun_id_t lun;
868 	target_id_t tgt;
869 
870 	bus = XS_CHANNEL(ccb);
871 	if (bus > 1) {
872 		xpt_print_path(ccb->ccb_h.path);
873 		printf("illegal bus %d\n", bus);
874 		ccb->ccb_h.status = CAM_PATH_INVALID;
875 		return (-1);
876 	}
877 	tgt = ccb->ccb_h.target_id;
878 	lun = ccb->ccb_h.target_lun;
879 
880 	isp_prt(isp, ISP_LOGTDEBUG0,
881 	    "isp_en_lun: %sabling lun 0x%x on channel %d",
882 	    cel->enable? "en" : "dis", lun, bus);
883 
884 
885 	if ((lun != CAM_LUN_WILDCARD) &&
886 	    (lun < 0 || lun >= (lun_id_t) isp->isp_maxluns)) {
887 		ccb->ccb_h.status = CAM_LUN_INVALID;
888 		return (-1);
889 	}
890 
891 	if (IS_SCSI(isp)) {
892 		sdparam *sdp = isp->isp_param;
893 		sdp += bus;
894 		if (tgt != CAM_TARGET_WILDCARD &&
895 		    tgt != sdp->isp_initiator_id) {
896 			ccb->ccb_h.status = CAM_TID_INVALID;
897 			return (-1);
898 		}
899 	} else {
900 		/*
901 		 * There's really no point in doing this yet w/o multi-tid
902 		 * capability. Even then, it's problematic.
903 		 */
904 #if	0
905 		if (tgt != CAM_TARGET_WILDCARD &&
906 		    tgt != FCPARAM(isp)->isp_iid) {
907 			ccb->ccb_h.status = CAM_TID_INVALID;
908 			return (-1);
909 		}
910 #endif
911 		/*
912 		 * This is as a good a place as any to check f/w capabilities.
913 		 */
914 		if (FCPARAM(isp)->isp_tmode == 0) {
915 			isp_prt(isp, ISP_LOGERR,
916 			    "firmware does not support target mode");
917 			ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
918 			return (-1);
919 		}
920 		/*
921 		 * XXX: We *could* handle non-SCCLUN f/w, but we'd have to
922 		 * XXX: dorks with our already fragile enable/disable code.
923 		 */
924 		if (FCPARAM(isp)->isp_sccfw == 0) {
925 			isp_prt(isp, ISP_LOGERR, "firmware not SCCLUN capable");
926 			ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
927 			return (-1);
928 		}
929 	}
930 
931 	if (tgt == CAM_TARGET_WILDCARD) {
932 		if (lun == CAM_LUN_WILDCARD) {
933 			wildcard = 1;
934 		} else {
935 			ccb->ccb_h.status = CAM_LUN_INVALID;
936 			return (-1);
937 		}
938 	} else {
939 		wildcard = 0;
940 	}
941 
942 	tm_on = (isp->isp_osinfo.tmflags[bus] & TM_TMODE_ENABLED) != 0;
943 
944 	/*
945 	 * Next check to see whether this is a target/lun wildcard action.
946 	 *
947 	 * If so, we know that we can accept commands for luns that haven't
948 	 * been enabled yet and send them upstream. Otherwise, we have to
949 	 * handle them locally (if we see them at all).
950 	 */
951 
952 	if (wildcard) {
953 		tptr = &isp->isp_osinfo.tsdflt[bus];
954 		if (cel->enable) {
955 			if (tm_on) {
956 				ccb->ccb_h.status = CAM_LUN_ALRDY_ENA;
957 				return (-1);
958 			}
959 			ccb->ccb_h.status =
960 			    xpt_create_path(&tptr->owner, NULL,
961 			    xpt_path_path_id(ccb->ccb_h.path),
962 			    xpt_path_target_id(ccb->ccb_h.path),
963 			    xpt_path_lun_id(ccb->ccb_h.path));
964 			if (ccb->ccb_h.status != CAM_REQ_CMP) {
965 				return (-1);
966 			}
967 			SLIST_INIT(&tptr->atios);
968 			SLIST_INIT(&tptr->inots);
969 			isp->isp_osinfo.tmflags[bus] |= TM_WILDCARD_ENABLED;
970 		} else {
971 			if (tm_on == 0) {
972 				ccb->ccb_h.status = CAM_REQ_CMP;
973 				return (-1);
974 			}
975 			if (tptr->hold) {
976 				ccb->ccb_h.status = CAM_SCSI_BUSY;
977 				return (-1);
978 			}
979 			xpt_free_path(tptr->owner);
980 			isp->isp_osinfo.tmflags[bus] &= ~TM_WILDCARD_ENABLED;
981 		}
982 	}
983 
984 	/*
985 	 * Now check to see whether this bus needs to be
986 	 * enabled/disabled with respect to target mode.
987 	 */
988 	av = bus << 31;
989 	if (cel->enable && tm_on == 0) {
990 		av |= ENABLE_TARGET_FLAG;
991 		av = isp_control(isp, ISPCTL_TOGGLE_TMODE, &av);
992 		if (av) {
993 			ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
994 			if (wildcard) {
995 				isp->isp_osinfo.tmflags[bus] &=
996 				    ~TM_WILDCARD_ENABLED;
997 				xpt_free_path(tptr->owner);
998 			}
999 			return (-1);
1000 		}
1001 		isp->isp_osinfo.tmflags[bus] |= TM_TMODE_ENABLED;
1002 		isp_prt(isp, ISP_LOGINFO,
1003 		    "Target Mode enabled on channel %d", bus);
1004 	} else if (cel->enable == 0 && tm_on && wildcard) {
1005 		if (are_any_luns_enabled(isp, bus)) {
1006 			ccb->ccb_h.status = CAM_SCSI_BUSY;
1007 			return (-1);
1008 		}
1009 		av = isp_control(isp, ISPCTL_TOGGLE_TMODE, &av);
1010 		if (av) {
1011 			ccb->ccb_h.status = CAM_FUNC_NOTAVAIL;
1012 			return (-1);
1013 		}
1014 		isp->isp_osinfo.tmflags[bus] &= ~TM_TMODE_ENABLED;
1015 		isp_prt(isp, ISP_LOGINFO,
1016 		    "Target Mode disabled on channel %d", bus);
1017 	}
1018 
1019 	if (wildcard) {
1020 		ccb->ccb_h.status = CAM_REQ_CMP;
1021 		return (-1);
1022 	}
1023 
1024 	/*
1025 	 * Find an empty slot
1026 	 */
1027 	for (seq = 0; seq < NLEACT; seq++) {
1028 		if (isp->isp_osinfo.leact[seq] == 0) {
1029 			break;
1030 		}
1031 	}
1032 	if (seq >= NLEACT) {
1033 		ccb->ccb_h.status = CAM_RESRC_UNAVAIL;
1034 		return (-1);
1035 
1036 	}
1037 	isp->isp_osinfo.leact[seq] = ccb;
1038 
1039 	if (cel->enable) {
1040 		ccb->ccb_h.status =
1041 		    create_lun_state(isp, bus, ccb->ccb_h.path, &tptr);
1042 		if (ccb->ccb_h.status != CAM_REQ_CMP) {
1043 			isp->isp_osinfo.leact[seq] = 0;
1044 			return (-1);
1045 		}
1046 	} else {
1047 		tptr = get_lun_statep(isp, bus, lun);
1048 		if (tptr == NULL) {
1049 			ccb->ccb_h.status = CAM_LUN_INVALID;
1050 			return (-1);
1051 		}
1052 	}
1053 
1054 	if (cel->enable) {
1055 		int c, n, ulun = lun;
1056 
1057 		cmd = RQSTYPE_ENABLE_LUN;
1058 		c = DFLT_CMND_CNT;
1059 		n = DFLT_INOT_CNT;
1060 		if (IS_FC(isp) && lun != 0) {
1061 			cmd = RQSTYPE_MODIFY_LUN;
1062 			n = 0;
1063 			/*
1064 		 	 * For SCC firmware, we only deal with setting
1065 			 * (enabling or modifying) lun 0.
1066 			 */
1067 			ulun = 0;
1068 		}
1069 		if (isp_lun_cmd(isp, cmd, bus, tgt, ulun, c, n, seq+1) == 0) {
1070 			rls_lun_statep(isp, tptr);
1071 			ccb->ccb_h.status = CAM_REQ_INPROG;
1072 			return (seq);
1073 		}
1074 	} else {
1075 		int c, n, ulun = lun;
1076 
1077 		cmd = -RQSTYPE_MODIFY_LUN;
1078 		c = DFLT_CMND_CNT;
1079 		n = DFLT_INOT_CNT;
1080 		if (IS_FC(isp) && lun != 0) {
1081 			n = 0;
1082 			/*
1083 		 	 * For SCC firmware, we only deal with setting
1084 			 * (enabling or modifying) lun 0.
1085 			 */
1086 			ulun = 0;
1087 		}
1088 		if (isp_lun_cmd(isp, cmd, bus, tgt, ulun, c, n, seq+1) == 0) {
1089 			rls_lun_statep(isp, tptr);
1090 			ccb->ccb_h.status = CAM_REQ_INPROG;
1091 			return (seq);
1092 		}
1093 	}
1094 	rls_lun_statep(isp, tptr);
1095 	xpt_print_path(ccb->ccb_h.path);
1096 	printf("isp_lun_cmd failed\n");
1097 	isp->isp_osinfo.leact[seq] = 0;
1098 	ccb->ccb_h.status = CAM_REQ_CMP_ERR;
1099 	return (-1);
1100 }
1101 
1102 static void
1103 isp_ledone(ispsoftc_t *isp, lun_entry_t *lep)
1104 {
1105 	const char lfmt[] = "lun %d now %sabled for target mode on channel %d";
1106 	union ccb *ccb;
1107 	uint32_t seq;
1108 	tstate_t *tptr;
1109 	int av;
1110 	struct ccb_en_lun *cel;
1111 
1112 	seq = lep->le_reserved - 1;
1113 	if (seq >= NLEACT) {
1114 		isp_prt(isp, ISP_LOGERR,
1115 		    "seq out of range (%u) in isp_ledone", seq);
1116 		return;
1117 	}
1118 	ccb = isp->isp_osinfo.leact[seq];
1119 	if (ccb == 0) {
1120 		isp_prt(isp, ISP_LOGERR,
1121 		    "no ccb for seq %u in isp_ledone", seq);
1122 		return;
1123 	}
1124 	cel = &ccb->cel;
1125 	tptr = get_lun_statep(isp, XS_CHANNEL(ccb), XS_LUN(ccb));
1126 	if (tptr == NULL) {
1127 		xpt_print_path(ccb->ccb_h.path);
1128 		printf("null tptr in isp_ledone\n");
1129 		isp->isp_osinfo.leact[seq] = 0;
1130 		return;
1131 	}
1132 
1133 	if (lep->le_status != LUN_OK) {
1134 		xpt_print_path(ccb->ccb_h.path);
1135 		printf("ENABLE/MODIFY LUN returned 0x%x\n", lep->le_status);
1136 err:
1137 		ccb->ccb_h.status = CAM_REQ_CMP_ERR;
1138 		xpt_print_path(ccb->ccb_h.path);
1139 		rls_lun_statep(isp, tptr);
1140 		isp->isp_osinfo.leact[seq] = 0;
1141 		ISPLOCK_2_CAMLOCK(isp);
1142 		xpt_done(ccb);
1143 		CAMLOCK_2_ISPLOCK(isp);
1144 		return;
1145 	} else {
1146 		isp_prt(isp, ISP_LOGTDEBUG0,
1147 		    "isp_ledone: ENABLE/MODIFY done okay");
1148 	}
1149 
1150 
1151 	if (cel->enable) {
1152 		ccb->ccb_h.status = CAM_REQ_CMP;
1153 		isp_prt(isp, ISP_LOGINFO, lfmt,
1154 		    XS_LUN(ccb), "en", XS_CHANNEL(ccb));
1155 		rls_lun_statep(isp, tptr);
1156 		isp->isp_osinfo.leact[seq] = 0;
1157 		ISPLOCK_2_CAMLOCK(isp);
1158 		xpt_done(ccb);
1159 		CAMLOCK_2_ISPLOCK(isp);
1160 		return;
1161 	}
1162 
1163 	if (lep->le_header.rqs_entry_type == RQSTYPE_MODIFY_LUN) {
1164 		if (isp_lun_cmd(isp, -RQSTYPE_ENABLE_LUN, XS_CHANNEL(ccb),
1165 		    XS_TGT(ccb), XS_LUN(ccb), 0, 0, seq+1)) {
1166 			xpt_print_path(ccb->ccb_h.path);
1167 			printf("isp_ledone: isp_lun_cmd failed\n");
1168 			goto err;
1169 		}
1170 		rls_lun_statep(isp, tptr);
1171 		return;
1172 	}
1173 
1174 	isp_prt(isp, ISP_LOGINFO, lfmt, XS_LUN(ccb), "dis", XS_CHANNEL(ccb));
1175 	rls_lun_statep(isp, tptr);
1176 	destroy_lun_state(isp, tptr);
1177 	ccb->ccb_h.status = CAM_REQ_CMP;
1178 	isp->isp_osinfo.leact[seq] = 0;
1179 	ISPLOCK_2_CAMLOCK(isp);
1180 	xpt_done(ccb);
1181 	CAMLOCK_2_ISPLOCK(isp);
1182 	if (are_any_luns_enabled(isp, XS_CHANNEL(ccb)) == 0) {
1183 		int bus = XS_CHANNEL(ccb);
1184 		av = bus << 31;
1185 		av = isp_control(isp, ISPCTL_TOGGLE_TMODE, &av);
1186 		if (av) {
1187 			isp_prt(isp, ISP_LOGWARN,
1188 			    "disable target mode on channel %d failed", bus);
1189 		} else {
1190 			isp_prt(isp, ISP_LOGINFO,
1191 			    "Target Mode disabled on channel %d", bus);
1192 		}
1193 		isp->isp_osinfo.tmflags[bus] &= ~TM_TMODE_ENABLED;
1194 	}
1195 }
1196 
1197 
1198 static cam_status
1199 isp_abort_tgt_ccb(ispsoftc_t *isp, union ccb *ccb)
1200 {
1201 	tstate_t *tptr;
1202 	struct ccb_hdr_slist *lp;
1203 	struct ccb_hdr *curelm;
1204 	int found, *ctr;
1205 	union ccb *accb = ccb->cab.abort_ccb;
1206 
1207 	isp_prt(isp, ISP_LOGTDEBUG0, "aborting ccb %p", accb);
1208 	if (accb->ccb_h.target_id != CAM_TARGET_WILDCARD) {
1209 		int badpath = 0;
1210 		if (IS_FC(isp) && (accb->ccb_h.target_id !=
1211 		    ((fcparam *) isp->isp_param)->isp_loopid)) {
1212 			badpath = 1;
1213 		} else if (IS_SCSI(isp) && (accb->ccb_h.target_id !=
1214 		    ((sdparam *) isp->isp_param)->isp_initiator_id)) {
1215 			badpath = 1;
1216 		}
1217 		if (badpath) {
1218 			/*
1219 			 * Being restrictive about target ids is really about
1220 			 * making sure we're aborting for the right multi-tid
1221 			 * path. This doesn't really make much sense at present.
1222 			 */
1223 #if	0
1224 			return (CAM_PATH_INVALID);
1225 #endif
1226 		}
1227 	}
1228 	tptr = get_lun_statep(isp, XS_CHANNEL(ccb), accb->ccb_h.target_lun);
1229 	if (tptr == NULL) {
1230 		isp_prt(isp, ISP_LOGTDEBUG0,
1231 		    "isp_abort_tgt_ccb: can't get statep");
1232 		return (CAM_PATH_INVALID);
1233 	}
1234 	if (accb->ccb_h.func_code == XPT_ACCEPT_TARGET_IO) {
1235 		lp = &tptr->atios;
1236 		ctr = &tptr->atio_count;
1237 	} else if (accb->ccb_h.func_code == XPT_IMMED_NOTIFY) {
1238 		lp = &tptr->inots;
1239 		ctr = &tptr->inot_count;
1240 	} else {
1241 		rls_lun_statep(isp, tptr);
1242 		isp_prt(isp, ISP_LOGTDEBUG0,
1243 		    "isp_abort_tgt_ccb: bad func %d\n", accb->ccb_h.func_code);
1244 		return (CAM_UA_ABORT);
1245 	}
1246 	curelm = SLIST_FIRST(lp);
1247 	found = 0;
1248 	if (curelm == &accb->ccb_h) {
1249 		found = 1;
1250 		SLIST_REMOVE_HEAD(lp, sim_links.sle);
1251 	} else {
1252 		while(curelm != NULL) {
1253 			struct ccb_hdr *nextelm;
1254 
1255 			nextelm = SLIST_NEXT(curelm, sim_links.sle);
1256 			if (nextelm == &accb->ccb_h) {
1257 				found = 1;
1258 				SLIST_NEXT(curelm, sim_links.sle) =
1259 				    SLIST_NEXT(nextelm, sim_links.sle);
1260 				break;
1261 			}
1262 			curelm = nextelm;
1263 		}
1264 	}
1265 	rls_lun_statep(isp, tptr);
1266 	if (found) {
1267 		(*ctr)--;
1268 		accb->ccb_h.status = CAM_REQ_ABORTED;
1269 		xpt_done(accb);
1270 		return (CAM_REQ_CMP);
1271 	}
1272 	isp_prt(isp, ISP_LOGTDEBUG0,
1273 	    "isp_abort_tgt_ccb: CCB %p not found\n", ccb);
1274 	return (CAM_PATH_INVALID);
1275 }
1276 
1277 static void
1278 isp_target_start_ctio(ispsoftc_t *isp, union ccb *ccb)
1279 {
1280 	void *qe;
1281 	struct ccb_scsiio *cso = &ccb->csio;
1282 	uint32_t nxti, optr, handle;
1283 	uint8_t local[QENTRY_LEN];
1284 
1285 
1286 	if (isp_getrqentry(isp, &nxti, &optr, &qe)) {
1287 		xpt_print_path(ccb->ccb_h.path);
1288 		printf("Request Queue Overflow in isp_target_start_ctio\n");
1289 		XS_SETERR(ccb, CAM_REQUEUE_REQ);
1290 		goto out;
1291 	}
1292 	memset(local, 0, QENTRY_LEN);
1293 
1294 	/*
1295 	 * We're either moving data or completing a command here.
1296 	 */
1297 
1298 	if (IS_FC(isp)) {
1299 		atio_private_data_t *atp;
1300 		ct2_entry_t *cto = (ct2_entry_t *) local;
1301 
1302 		cto->ct_header.rqs_entry_type = RQSTYPE_CTIO2;
1303 		cto->ct_header.rqs_entry_count = 1;
1304 		if (FCPARAM(isp)->isp_2klogin) {
1305 			((ct2e_entry_t *)cto)->ct_iid = cso->init_id;
1306 		} else {
1307 			cto->ct_iid = cso->init_id;
1308 			if (FCPARAM(isp)->isp_sccfw == 0) {
1309 				cto->ct_lun = ccb->ccb_h.target_lun;
1310 			}
1311 		}
1312 
1313 		atp = isp_get_atpd(isp, cso->tag_id);
1314 		if (atp == NULL) {
1315 			isp_prt(isp, ISP_LOGERR,
1316 			    "cannot find private data adjunct for tag %x",
1317 			    cso->tag_id);
1318 			XS_SETERR(ccb, CAM_REQ_CMP_ERR);
1319 			goto out;
1320 		}
1321 
1322 		cto->ct_rxid = cso->tag_id;
1323 		if (cso->dxfer_len == 0) {
1324 			cto->ct_flags |= CT2_FLAG_MODE1 | CT2_NO_DATA;
1325 			if (ccb->ccb_h.flags & CAM_SEND_STATUS) {
1326 				cto->ct_flags |= CT2_SENDSTATUS;
1327 				cto->rsp.m1.ct_scsi_status = cso->scsi_status;
1328 				cto->ct_resid =
1329 				    atp->orig_datalen - atp->bytes_xfered;
1330 				if (cto->ct_resid < 0) {
1331 					cto->rsp.m1.ct_scsi_status |=
1332 					    CT2_DATA_OVER;
1333 				} else if (cto->ct_resid > 0) {
1334 					cto->rsp.m1.ct_scsi_status |=
1335 					    CT2_DATA_UNDER;
1336 				}
1337 			}
1338 			if ((ccb->ccb_h.flags & CAM_SEND_SENSE) != 0) {
1339 				int m = min(cso->sense_len, MAXRESPLEN);
1340 				memcpy(cto->rsp.m1.ct_resp,
1341 				    &cso->sense_data, m);
1342 				cto->rsp.m1.ct_senselen = m;
1343 				cto->rsp.m1.ct_scsi_status |= CT2_SNSLEN_VALID;
1344 			}
1345 		} else {
1346 			cto->ct_flags |= CT2_FLAG_MODE0;
1347 			if ((cso->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN) {
1348 				cto->ct_flags |= CT2_DATA_IN;
1349 			} else {
1350 				cto->ct_flags |= CT2_DATA_OUT;
1351 			}
1352 			cto->ct_reloff = atp->bytes_xfered;
1353 			if ((ccb->ccb_h.flags & CAM_SEND_STATUS) != 0) {
1354 				cto->ct_flags |= CT2_SENDSTATUS;
1355 				cto->rsp.m0.ct_scsi_status = cso->scsi_status;
1356 				cto->ct_resid =
1357 				    atp->orig_datalen -
1358 				    (atp->bytes_xfered + cso->dxfer_len);
1359 				if (cto->ct_resid < 0) {
1360 					cto->rsp.m0.ct_scsi_status |=
1361 					    CT2_DATA_OVER;
1362 				} else if (cto->ct_resid > 0) {
1363 					cto->rsp.m0.ct_scsi_status |=
1364 					    CT2_DATA_UNDER;
1365 				}
1366 			} else {
1367 				atp->last_xframt = cso->dxfer_len;
1368 			}
1369 			/*
1370 			 * If we're sending data and status back together,
1371 			 * we can't also send back sense data as well.
1372 			 */
1373 			ccb->ccb_h.flags &= ~CAM_SEND_SENSE;
1374 		}
1375 
1376 		if (cto->ct_flags & CT2_SENDSTATUS) {
1377 			isp_prt(isp, ISP_LOGTDEBUG0,
1378 			    "CTIO2[%x] STATUS %x origd %u curd %u resid %u",
1379 			    cto->ct_rxid, cso->scsi_status, atp->orig_datalen,
1380 			    cso->dxfer_len, cto->ct_resid);
1381 			cto->ct_flags |= CT2_CCINCR;
1382 			atp->state = ATPD_STATE_LAST_CTIO;
1383 		} else {
1384 			atp->state = ATPD_STATE_CTIO;
1385 		}
1386 		cto->ct_timeout = 10;
1387 	} else {
1388 		ct_entry_t *cto = (ct_entry_t *) local;
1389 
1390 		cto->ct_header.rqs_entry_type = RQSTYPE_CTIO;
1391 		cto->ct_header.rqs_entry_count = 1;
1392 		cto->ct_iid = cso->init_id;
1393 		cto->ct_iid |= XS_CHANNEL(ccb) << 7;
1394 		cto->ct_tgt = ccb->ccb_h.target_id;
1395 		cto->ct_lun = ccb->ccb_h.target_lun;
1396 		cto->ct_fwhandle = AT_GET_HANDLE(cso->tag_id);
1397 		if (AT_HAS_TAG(cso->tag_id)) {
1398 			cto->ct_tag_val = (uint8_t) AT_GET_TAG(cso->tag_id);
1399 			cto->ct_flags |= CT_TQAE;
1400 		}
1401 		if (ccb->ccb_h.flags & CAM_DIS_DISCONNECT) {
1402 			cto->ct_flags |= CT_NODISC;
1403 		}
1404 		if (cso->dxfer_len == 0) {
1405 			cto->ct_flags |= CT_NO_DATA;
1406 		} else if ((cso->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN) {
1407 			cto->ct_flags |= CT_DATA_IN;
1408 		} else {
1409 			cto->ct_flags |= CT_DATA_OUT;
1410 		}
1411 		if (ccb->ccb_h.flags & CAM_SEND_STATUS) {
1412 			cto->ct_flags |= CT_SENDSTATUS|CT_CCINCR;
1413 			cto->ct_scsi_status = cso->scsi_status;
1414 			cto->ct_resid = cso->resid;
1415 			isp_prt(isp, ISP_LOGTDEBUG0,
1416 			    "CTIO[%x] SCSI STATUS 0x%x resid %d tag_id %x",
1417 			    cto->ct_fwhandle, cso->scsi_status, cso->resid,
1418 			    cso->tag_id);
1419 		}
1420 		ccb->ccb_h.flags &= ~CAM_SEND_SENSE;
1421 		cto->ct_timeout = 10;
1422 	}
1423 
1424 	if (isp_save_xs_tgt(isp, ccb, &handle)) {
1425 		xpt_print_path(ccb->ccb_h.path);
1426 		printf("No XFLIST pointers for isp_target_start_ctio\n");
1427 		XS_SETERR(ccb, CAM_REQUEUE_REQ);
1428 		goto out;
1429 	}
1430 
1431 
1432 	/*
1433 	 * Call the dma setup routines for this entry (and any subsequent
1434 	 * CTIOs) if there's data to move, and then tell the f/w it's got
1435 	 * new things to play with. As with isp_start's usage of DMA setup,
1436 	 * any swizzling is done in the machine dependent layer. Because
1437 	 * of this, we put the request onto the queue area first in native
1438 	 * format.
1439 	 */
1440 
1441 	if (IS_FC(isp)) {
1442 		ct2_entry_t *cto = (ct2_entry_t *) local;
1443 		cto->ct_syshandle = handle;
1444 	} else {
1445 		ct_entry_t *cto = (ct_entry_t *) local;
1446 		cto->ct_syshandle = handle;
1447 	}
1448 
1449 	switch (ISP_DMASETUP(isp, cso, (ispreq_t *) local, &nxti, optr)) {
1450 	case CMD_QUEUED:
1451 		ISP_ADD_REQUEST(isp, nxti);
1452 		ccb->ccb_h.status |= CAM_SIM_QUEUED;
1453 		return;
1454 
1455 	case CMD_EAGAIN:
1456 		XS_SETERR(ccb, CAM_REQUEUE_REQ);
1457 		break;
1458 
1459 	default:
1460 		break;
1461 	}
1462 	isp_destroy_tgt_handle(isp, handle);
1463 
1464 out:
1465 	ISPLOCK_2_CAMLOCK(isp);
1466 	xpt_done(ccb);
1467 	CAMLOCK_2_ISPLOCK(isp);
1468 }
1469 
1470 static void
1471 isp_refire_putback_atio(void *arg)
1472 {
1473 	int s = splcam();
1474 	isp_target_putback_atio(arg);
1475 	splx(s);
1476 }
1477 
1478 static void
1479 isp_target_putback_atio(union ccb *ccb)
1480 {
1481 	ispsoftc_t *isp;
1482 	struct ccb_scsiio *cso;
1483 	uint32_t nxti, optr;
1484 	void *qe;
1485 
1486 	isp = XS_ISP(ccb);
1487 
1488 	if (isp_getrqentry(isp, &nxti, &optr, &qe)) {
1489 		(void) timeout(isp_refire_putback_atio, ccb, 10);
1490 		isp_prt(isp, ISP_LOGWARN,
1491 		    "isp_target_putback_atio: Request Queue Overflow");
1492 		return;
1493 	}
1494 	memset(qe, 0, QENTRY_LEN);
1495 	cso = &ccb->csio;
1496 	if (IS_FC(isp)) {
1497 		at2_entry_t local, *at = &local;
1498 		MEMZERO(at, sizeof (at2_entry_t));
1499 		at->at_header.rqs_entry_type = RQSTYPE_ATIO2;
1500 		at->at_header.rqs_entry_count = 1;
1501 		if (FCPARAM(isp)->isp_sccfw) {
1502 			at->at_scclun = (uint16_t) ccb->ccb_h.target_lun;
1503 		} else {
1504 			at->at_lun = (uint8_t) ccb->ccb_h.target_lun;
1505 		}
1506 		at->at_status = CT_OK;
1507 		at->at_rxid = cso->tag_id;
1508 		at->at_iid = cso->ccb_h.target_id;
1509 		isp_put_atio2(isp, at, qe);
1510 	} else {
1511 		at_entry_t local, *at = &local;
1512 		MEMZERO(at, sizeof (at_entry_t));
1513 		at->at_header.rqs_entry_type = RQSTYPE_ATIO;
1514 		at->at_header.rqs_entry_count = 1;
1515 		at->at_iid = cso->init_id;
1516 		at->at_iid |= XS_CHANNEL(ccb) << 7;
1517 		at->at_tgt = cso->ccb_h.target_id;
1518 		at->at_lun = cso->ccb_h.target_lun;
1519 		at->at_status = CT_OK;
1520 		at->at_tag_val = AT_GET_TAG(cso->tag_id);
1521 		at->at_handle = AT_GET_HANDLE(cso->tag_id);
1522 		isp_put_atio(isp, at, qe);
1523 	}
1524 	ISP_TDQE(isp, "isp_target_putback_atio", (int) optr, qe);
1525 	ISP_ADD_REQUEST(isp, nxti);
1526 	isp_complete_ctio(ccb);
1527 }
1528 
1529 static void
1530 isp_complete_ctio(union ccb *ccb)
1531 {
1532 	ISPLOCK_2_CAMLOCK(isp);
1533 	if ((ccb->ccb_h.status & CAM_STATUS_MASK) == CAM_REQ_INPROG) {
1534 		ccb->ccb_h.status |= CAM_REQ_CMP;
1535 	}
1536 	ccb->ccb_h.status &= ~CAM_SIM_QUEUED;
1537 	xpt_done(ccb);
1538 	CAMLOCK_2_ISPLOCK(isp);
1539 }
1540 
1541 /*
1542  * Handle ATIO stuff that the generic code can't.
1543  * This means handling CDBs.
1544  */
1545 
1546 static int
1547 isp_handle_platform_atio(ispsoftc_t *isp, at_entry_t *aep)
1548 {
1549 	tstate_t *tptr;
1550 	int status, bus, iswildcard;
1551 	struct ccb_accept_tio *atiop;
1552 
1553 	/*
1554 	 * The firmware status (except for the QLTM_SVALID bit)
1555 	 * indicates why this ATIO was sent to us.
1556 	 *
1557 	 * If QLTM_SVALID is set, the firware has recommended Sense Data.
1558 	 *
1559 	 * If the DISCONNECTS DISABLED bit is set in the flags field,
1560 	 * we're still connected on the SCSI bus.
1561 	 */
1562 	status = aep->at_status;
1563 	if ((status & ~QLTM_SVALID) == AT_PHASE_ERROR) {
1564 		/*
1565 		 * Bus Phase Sequence error. We should have sense data
1566 		 * suggested by the f/w. I'm not sure quite yet what
1567 		 * to do about this for CAM.
1568 		 */
1569 		isp_prt(isp, ISP_LOGWARN, "PHASE ERROR");
1570 		isp_endcmd(isp, aep, SCSI_STATUS_BUSY, 0);
1571 		return (0);
1572 	}
1573 	if ((status & ~QLTM_SVALID) != AT_CDB) {
1574 		isp_prt(isp, ISP_LOGWARN, "bad atio (0x%x) leaked to platform",
1575 		    status);
1576 		isp_endcmd(isp, aep, SCSI_STATUS_BUSY, 0);
1577 		return (0);
1578 	}
1579 
1580 	bus = GET_BUS_VAL(aep->at_iid);
1581 	tptr = get_lun_statep(isp, bus, aep->at_lun);
1582 	if (tptr == NULL) {
1583 		tptr = get_lun_statep(isp, bus, CAM_LUN_WILDCARD);
1584 		if (tptr == NULL) {
1585 			/*
1586 			 * Because we can't autofeed sense data back with
1587 			 * a command for parallel SCSI, we can't give back
1588 			 * a CHECK CONDITION. We'll give back a BUSY status
1589 			 * instead. This works out okay because the only
1590 			 * time we should, in fact, get this, is in the
1591 			 * case that somebody configured us without the
1592 			 * blackhole driver, so they get what they deserve.
1593 			 */
1594 			isp_endcmd(isp, aep, SCSI_STATUS_BUSY, 0);
1595 			return (0);
1596 		}
1597 		iswildcard = 1;
1598 	} else {
1599 		iswildcard = 0;
1600 	}
1601 
1602 	atiop = (struct ccb_accept_tio *) SLIST_FIRST(&tptr->atios);
1603 	if (atiop == NULL) {
1604 		/*
1605 		 * Because we can't autofeed sense data back with
1606 		 * a command for parallel SCSI, we can't give back
1607 		 * a CHECK CONDITION. We'll give back a QUEUE FULL status
1608 		 * instead. This works out okay because the only time we
1609 		 * should, in fact, get this, is in the case that we've
1610 		 * run out of ATIOS.
1611 		 */
1612 		xpt_print_path(tptr->owner);
1613 		isp_prt(isp, ISP_LOGWARN,
1614 		    "no ATIOS for lun %d from initiator %d on channel %d",
1615 		    aep->at_lun, GET_IID_VAL(aep->at_iid), bus);
1616 		if (aep->at_flags & AT_TQAE)
1617 			isp_endcmd(isp, aep, SCSI_STATUS_QUEUE_FULL, 0);
1618 		else
1619 			isp_endcmd(isp, aep, SCSI_STATUS_BUSY, 0);
1620 		rls_lun_statep(isp, tptr);
1621 		return (0);
1622 	}
1623 	SLIST_REMOVE_HEAD(&tptr->atios, sim_links.sle);
1624 	tptr->atio_count--;
1625 	isp_prt(isp, ISP_LOGTDEBUG0, "Take FREE ATIO lun %d, count now %d",
1626 	    aep->at_lun, tptr->atio_count);
1627 	if (iswildcard) {
1628 		atiop->ccb_h.target_id = aep->at_tgt;
1629 		atiop->ccb_h.target_lun = aep->at_lun;
1630 	}
1631 	if (aep->at_flags & AT_NODISC) {
1632 		atiop->ccb_h.flags = CAM_DIS_DISCONNECT;
1633 	} else {
1634 		atiop->ccb_h.flags = 0;
1635 	}
1636 
1637 	if (status & QLTM_SVALID) {
1638 		size_t amt = imin(QLTM_SENSELEN, sizeof (atiop->sense_data));
1639 		atiop->sense_len = amt;
1640 		MEMCPY(&atiop->sense_data, aep->at_sense, amt);
1641 	} else {
1642 		atiop->sense_len = 0;
1643 	}
1644 
1645 	atiop->init_id = GET_IID_VAL(aep->at_iid);
1646 	atiop->cdb_len = aep->at_cdblen;
1647 	MEMCPY(atiop->cdb_io.cdb_bytes, aep->at_cdb, aep->at_cdblen);
1648 	atiop->ccb_h.status = CAM_CDB_RECVD;
1649 	/*
1650 	 * Construct a tag 'id' based upon tag value (which may be 0..255)
1651 	 * and the handle (which we have to preserve).
1652 	 */
1653 	AT_MAKE_TAGID(atiop->tag_id,  device_get_unit(isp->isp_dev), aep);
1654 	if (aep->at_flags & AT_TQAE) {
1655 		atiop->tag_action = aep->at_tag_type;
1656 		atiop->ccb_h.status |= CAM_TAG_ACTION_VALID;
1657 	}
1658 	xpt_done((union ccb*)atiop);
1659 	isp_prt(isp, ISP_LOGTDEBUG0,
1660 	    "ATIO[%x] CDB=0x%x bus %d iid%d->lun%d tag 0x%x ttype 0x%x %s",
1661 	    aep->at_handle, aep->at_cdb[0] & 0xff, GET_BUS_VAL(aep->at_iid),
1662 	    GET_IID_VAL(aep->at_iid), aep->at_lun, aep->at_tag_val & 0xff,
1663 	    aep->at_tag_type, (aep->at_flags & AT_NODISC)?
1664 	    "nondisc" : "disconnecting");
1665 	rls_lun_statep(isp, tptr);
1666 	return (0);
1667 }
1668 
1669 static int
1670 isp_handle_platform_atio2(ispsoftc_t *isp, at2_entry_t *aep)
1671 {
1672 	lun_id_t lun;
1673 	tstate_t *tptr;
1674 	struct ccb_accept_tio *atiop;
1675 	atio_private_data_t *atp;
1676 
1677 	/*
1678 	 * The firmware status (except for the QLTM_SVALID bit)
1679 	 * indicates why this ATIO was sent to us.
1680 	 *
1681 	 * If QLTM_SVALID is set, the firware has recommended Sense Data.
1682 	 */
1683 	if ((aep->at_status & ~QLTM_SVALID) != AT_CDB) {
1684 		isp_prt(isp, ISP_LOGWARN,
1685 		    "bogus atio (0x%x) leaked to platform", aep->at_status);
1686 		isp_endcmd(isp, aep, SCSI_STATUS_BUSY, 0);
1687 		return (0);
1688 	}
1689 
1690 	if (FCPARAM(isp)->isp_sccfw) {
1691 		lun = aep->at_scclun;
1692 	} else {
1693 		lun = aep->at_lun;
1694 	}
1695 	tptr = get_lun_statep(isp, 0, lun);
1696 	if (tptr == NULL) {
1697 		isp_prt(isp, ISP_LOGTDEBUG0,
1698 		    "[0x%x] no state pointer for lun %d", aep->at_rxid, lun);
1699 		tptr = get_lun_statep(isp, 0, CAM_LUN_WILDCARD);
1700 		if (tptr == NULL) {
1701 			isp_endcmd(isp, aep,
1702 			    SCSI_STATUS_CHECK_COND | ECMD_SVALID |
1703 			    (0x5 << 12) | (0x25 << 16), 0);
1704 			return (0);
1705 		}
1706 	}
1707 
1708 	atp = isp_get_atpd(isp, 0);
1709 	atiop = (struct ccb_accept_tio *) SLIST_FIRST(&tptr->atios);
1710 	if (atiop == NULL || atp == NULL) {
1711 
1712 		/*
1713 		 * Because we can't autofeed sense data back with
1714 		 * a command for parallel SCSI, we can't give back
1715 		 * a CHECK CONDITION. We'll give back a QUEUE FULL status
1716 		 * instead. This works out okay because the only time we
1717 		 * should, in fact, get this, is in the case that we've
1718 		 * run out of ATIOS.
1719 		 */
1720 		xpt_print_path(tptr->owner);
1721 		isp_prt(isp, ISP_LOGWARN,
1722 		    "no %s for lun %d from initiator %d",
1723 		    (atp == NULL && atiop == NULL)? "ATIO2s *or* ATPS" :
1724 		    ((atp == NULL)? "ATPs" : "ATIO2s"), lun, aep->at_iid);
1725 		rls_lun_statep(isp, tptr);
1726 		isp_endcmd(isp, aep, SCSI_STATUS_QUEUE_FULL, 0);
1727 		return (0);
1728 	}
1729 	atp->state = ATPD_STATE_ATIO;
1730 	SLIST_REMOVE_HEAD(&tptr->atios, sim_links.sle);
1731 	tptr->atio_count--;
1732 	isp_prt(isp, ISP_LOGTDEBUG0, "Take FREE ATIO lun %d, count now %d",
1733 	    lun, tptr->atio_count);
1734 
1735 	if (tptr == &isp->isp_osinfo.tsdflt[0]) {
1736 		atiop->ccb_h.target_id = FCPARAM(isp)->isp_loopid;
1737 		atiop->ccb_h.target_lun = lun;
1738 	}
1739 	/*
1740 	 * We don't get 'suggested' sense data as we do with SCSI cards.
1741 	 */
1742 	atiop->sense_len = 0;
1743 
1744 	atiop->init_id = aep->at_iid;
1745 	atiop->cdb_len = ATIO2_CDBLEN;
1746 	MEMCPY(atiop->cdb_io.cdb_bytes, aep->at_cdb, ATIO2_CDBLEN);
1747 	atiop->ccb_h.status = CAM_CDB_RECVD;
1748 	atiop->tag_id = aep->at_rxid;
1749 	switch (aep->at_taskflags & ATIO2_TC_ATTR_MASK) {
1750 	case ATIO2_TC_ATTR_SIMPLEQ:
1751 		atiop->tag_action = MSG_SIMPLE_Q_TAG;
1752 		break;
1753         case ATIO2_TC_ATTR_HEADOFQ:
1754 		atiop->tag_action = MSG_HEAD_OF_Q_TAG;
1755 		break;
1756         case ATIO2_TC_ATTR_ORDERED:
1757 		atiop->tag_action = MSG_ORDERED_Q_TAG;
1758 		break;
1759         case ATIO2_TC_ATTR_ACAQ:		/* ?? */
1760 	case ATIO2_TC_ATTR_UNTAGGED:
1761 	default:
1762 		atiop->tag_action = 0;
1763 		break;
1764 	}
1765 	atiop->ccb_h.flags = CAM_TAG_ACTION_VALID;
1766 
1767 	atp->tag = atiop->tag_id;
1768 	atp->lun = lun;
1769 	atp->orig_datalen = aep->at_datalen;
1770 	atp->last_xframt = 0;
1771 	atp->bytes_xfered = 0;
1772 	atp->state = ATPD_STATE_CAM;
1773 	ISPLOCK_2_CAMLOCK(siP);
1774 	xpt_done((union ccb*)atiop);
1775 
1776 	isp_prt(isp, ISP_LOGTDEBUG0,
1777 	    "ATIO2[%x] CDB=0x%x iid%d->lun%d tattr 0x%x datalen %u",
1778 	    aep->at_rxid, aep->at_cdb[0] & 0xff, aep->at_iid,
1779 	    lun, aep->at_taskflags, aep->at_datalen);
1780 	rls_lun_statep(isp, tptr);
1781 	return (0);
1782 }
1783 
1784 static int
1785 isp_handle_platform_ctio(ispsoftc_t *isp, void *arg)
1786 {
1787 	union ccb *ccb;
1788 	int sentstatus, ok, notify_cam, resid = 0;
1789 	uint16_t tval;
1790 
1791 	/*
1792 	 * CTIO and CTIO2 are close enough....
1793 	 */
1794 
1795 	ccb = isp_find_xs_tgt(isp, ((ct_entry_t *)arg)->ct_syshandle);
1796 	KASSERT((ccb != NULL), ("null ccb in isp_handle_platform_ctio"));
1797 	isp_destroy_tgt_handle(isp, ((ct_entry_t *)arg)->ct_syshandle);
1798 
1799 	if (IS_FC(isp)) {
1800 		ct2_entry_t *ct = arg;
1801 		atio_private_data_t *atp = isp_get_atpd(isp, ct->ct_rxid);
1802 		if (atp == NULL) {
1803 			isp_prt(isp, ISP_LOGERR,
1804 			    "cannot find adjunct for %x after I/O",
1805 			    ct->ct_rxid);
1806 			return (0);
1807 		}
1808 		sentstatus = ct->ct_flags & CT2_SENDSTATUS;
1809 		ok = (ct->ct_status & ~QLTM_SVALID) == CT_OK;
1810 		if (ok && sentstatus && (ccb->ccb_h.flags & CAM_SEND_SENSE)) {
1811 			ccb->ccb_h.status |= CAM_SENT_SENSE;
1812 		}
1813 		notify_cam = ct->ct_header.rqs_seqno & 0x1;
1814 		if ((ct->ct_flags & CT2_DATAMASK) != CT2_NO_DATA) {
1815 			resid = ct->ct_resid;
1816 			atp->bytes_xfered += (atp->last_xframt - resid);
1817 			atp->last_xframt = 0;
1818 		}
1819 		if (sentstatus || !ok) {
1820 			atp->tag = 0;
1821 		}
1822 		isp_prt(isp, ok? ISP_LOGTDEBUG0 : ISP_LOGWARN,
1823 		    "CTIO2[%x] sts 0x%x flg 0x%x sns %d resid %d %s",
1824 		    ct->ct_rxid, ct->ct_status, ct->ct_flags,
1825 		    (ccb->ccb_h.status & CAM_SENT_SENSE) != 0,
1826 		    resid, sentstatus? "FIN" : "MID");
1827 		tval = ct->ct_rxid;
1828 
1829 		/* XXX: should really come after isp_complete_ctio */
1830 		atp->state = ATPD_STATE_PDON;
1831 	} else {
1832 		ct_entry_t *ct = arg;
1833 		sentstatus = ct->ct_flags & CT_SENDSTATUS;
1834 		ok = (ct->ct_status  & ~QLTM_SVALID) == CT_OK;
1835 		/*
1836 		 * We *ought* to be able to get back to the original ATIO
1837 		 * here, but for some reason this gets lost. It's just as
1838 		 * well because it's squirrelled away as part of periph
1839 		 * private data.
1840 		 *
1841 		 * We can live without it as long as we continue to use
1842 		 * the auto-replenish feature for CTIOs.
1843 		 */
1844 		notify_cam = ct->ct_header.rqs_seqno & 0x1;
1845 		if (ct->ct_status & QLTM_SVALID) {
1846 			char *sp = (char *)ct;
1847 			sp += CTIO_SENSE_OFFSET;
1848 			ccb->csio.sense_len =
1849 			    min(sizeof (ccb->csio.sense_data), QLTM_SENSELEN);
1850 			MEMCPY(&ccb->csio.sense_data, sp, ccb->csio.sense_len);
1851 			ccb->ccb_h.status |= CAM_AUTOSNS_VALID;
1852 		}
1853 		if ((ct->ct_flags & CT_DATAMASK) != CT_NO_DATA) {
1854 			resid = ct->ct_resid;
1855 		}
1856 		isp_prt(isp, ISP_LOGTDEBUG0,
1857 		    "CTIO[%x] tag %x iid %d lun %d sts %x flg %x resid %d %s",
1858 		    ct->ct_fwhandle, ct->ct_tag_val, ct->ct_iid, ct->ct_lun,
1859 		    ct->ct_status, ct->ct_flags, resid,
1860 		    sentstatus? "FIN" : "MID");
1861 		tval = ct->ct_fwhandle;
1862 	}
1863 	ccb->csio.resid += resid;
1864 
1865 	/*
1866 	 * We're here either because intermediate data transfers are done
1867 	 * and/or the final status CTIO (which may have joined with a
1868 	 * Data Transfer) is done.
1869 	 *
1870 	 * In any case, for this platform, the upper layers figure out
1871 	 * what to do next, so all we do here is collect status and
1872 	 * pass information along. Any DMA handles have already been
1873 	 * freed.
1874 	 */
1875 	if (notify_cam == 0) {
1876 		isp_prt(isp, ISP_LOGTDEBUG0, "  INTER CTIO[0x%x] done", tval);
1877 		return (0);
1878 	}
1879 
1880 	isp_prt(isp, ISP_LOGTDEBUG0, "%s CTIO[0x%x] done",
1881 	    (sentstatus)? "  FINAL " : "MIDTERM ", tval);
1882 
1883 	if (!ok) {
1884 		isp_target_putback_atio(ccb);
1885 	} else {
1886 		isp_complete_ctio(ccb);
1887 
1888 	}
1889 	return (0);
1890 }
1891 
1892 static int
1893 isp_handle_platform_notify_scsi(ispsoftc_t *isp, in_entry_t *inp)
1894 {
1895 	return (0);	/* XXXX */
1896 }
1897 
1898 static int
1899 isp_handle_platform_notify_fc(ispsoftc_t *isp, in_fcentry_t *inp)
1900 {
1901 
1902 	switch (inp->in_status) {
1903 	case IN_PORT_LOGOUT:
1904 		isp_prt(isp, ISP_LOGWARN, "port logout of iid %d",
1905 		   inp->in_iid);
1906 		break;
1907 	case IN_PORT_CHANGED:
1908 		isp_prt(isp, ISP_LOGWARN, "port changed for iid %d",
1909 		   inp->in_iid);
1910 		break;
1911 	case IN_GLOBAL_LOGO:
1912 		isp_prt(isp, ISP_LOGINFO, "all ports logged out");
1913 		break;
1914 	case IN_ABORT_TASK:
1915 	{
1916 		atio_private_data_t *atp = isp_get_atpd(isp, inp->in_seqid);
1917 		struct ccb_immed_notify *inot = NULL;
1918 
1919 		if (atp) {
1920 			tstate_t *tptr = get_lun_statep(isp, 0, atp->lun);
1921 			if (tptr) {
1922 				inot = (struct ccb_immed_notify *)
1923 				    SLIST_FIRST(&tptr->inots);
1924 				if (inot) {
1925 					tptr->inot_count--;
1926 					SLIST_REMOVE_HEAD(&tptr->inots,
1927 					    sim_links.sle);
1928 					isp_prt(isp, ISP_LOGTDEBUG0,
1929 					    "Take FREE INOT count now %d",
1930 					    tptr->inot_count);
1931 				}
1932 			}
1933 			isp_prt(isp, ISP_LOGWARN,
1934 			   "abort task RX_ID %x IID %d state %d",
1935 			   inp->in_seqid, inp->in_iid, atp->state);
1936 		} else {
1937 			isp_prt(isp, ISP_LOGWARN,
1938 			   "abort task RX_ID %x from iid %d, state unknown",
1939 			   inp->in_seqid, inp->in_iid);
1940 		}
1941 		if (inot) {
1942 			inot->initiator_id = inp->in_iid;
1943 			inot->sense_len = 0;
1944 			inot->message_args[0] = MSG_ABORT_TAG;
1945 			inot->message_args[1] = inp->in_seqid & 0xff;
1946 			inot->message_args[2] = (inp->in_seqid >> 8) & 0xff;
1947 			inot->ccb_h.status = CAM_MESSAGE_RECV;
1948 			xpt_done((union ccb *)inot);
1949 		}
1950 		break;
1951 	}
1952 	default:
1953 		break;
1954 	}
1955 	return (0);
1956 }
1957 #endif
1958 
1959 static void
1960 isp_cam_async(void *cbarg, uint32_t code, struct cam_path *path, void *arg)
1961 {
1962 	struct cam_sim *sim;
1963 	ispsoftc_t *isp;
1964 
1965 	sim = (struct cam_sim *)cbarg;
1966 	isp = (ispsoftc_t *) cam_sim_softc(sim);
1967 	switch (code) {
1968 	case AC_LOST_DEVICE:
1969 		if (IS_SCSI(isp)) {
1970 			uint16_t oflags, nflags;
1971 			sdparam *sdp = isp->isp_param;
1972 			int tgt;
1973 
1974 			tgt = xpt_path_target_id(path);
1975 			if (tgt >= 0) {
1976 				sdp += cam_sim_bus(sim);
1977 				ISP_LOCK(isp);
1978 				nflags = sdp->isp_devparam[tgt].nvrm_flags;
1979 #ifndef	ISP_TARGET_MODE
1980 				nflags &= DPARM_SAFE_DFLT;
1981 				if (isp->isp_loaded_fw) {
1982 					nflags |= DPARM_NARROW | DPARM_ASYNC;
1983 				}
1984 #else
1985 				nflags = DPARM_DEFAULT;
1986 #endif
1987 				oflags = sdp->isp_devparam[tgt].goal_flags;
1988 				sdp->isp_devparam[tgt].goal_flags = nflags;
1989 				sdp->isp_devparam[tgt].dev_update = 1;
1990 				isp->isp_update |= (1 << cam_sim_bus(sim));
1991 				(void) isp_control(isp,
1992 				    ISPCTL_UPDATE_PARAMS, NULL);
1993 				sdp->isp_devparam[tgt].goal_flags = oflags;
1994 				ISP_UNLOCK(isp);
1995 			}
1996 		}
1997 		break;
1998 	default:
1999 		isp_prt(isp, ISP_LOGWARN, "isp_cam_async: Code 0x%x", code);
2000 		break;
2001 	}
2002 }
2003 
2004 static void
2005 isp_poll(struct cam_sim *sim)
2006 {
2007 	ispsoftc_t *isp = cam_sim_softc(sim);
2008 	uint32_t isr;
2009 	uint16_t sema, mbox;
2010 
2011 	ISP_LOCK(isp);
2012 	if (ISP_READ_ISR(isp, &isr, &sema, &mbox)) {
2013 		isp_intr(isp, isr, sema, mbox);
2014 	}
2015 	ISP_UNLOCK(isp);
2016 }
2017 
2018 
2019 static void
2020 isp_watchdog(void *arg)
2021 {
2022 	XS_T *xs = arg;
2023 	ispsoftc_t *isp = XS_ISP(xs);
2024 	uint32_t handle;
2025 
2026 	/*
2027 	 * We've decided this command is dead. Make sure we're not trying
2028 	 * to kill a command that's already dead by getting it's handle and
2029 	 * and seeing whether it's still alive.
2030 	 */
2031 	ISP_LOCK(isp);
2032 	handle = isp_find_handle(isp, xs);
2033 	if (handle) {
2034 		uint32_t isr;
2035 		uint16_t sema, mbox;
2036 
2037 		if (XS_CMD_DONE_P(xs)) {
2038 			isp_prt(isp, ISP_LOGDEBUG1,
2039 			    "watchdog found done cmd (handle 0x%x)", handle);
2040 			ISP_UNLOCK(isp);
2041 			return;
2042 		}
2043 
2044 		if (XS_CMD_WDOG_P(xs)) {
2045 			isp_prt(isp, ISP_LOGDEBUG2,
2046 			    "recursive watchdog (handle 0x%x)", handle);
2047 			ISP_UNLOCK(isp);
2048 			return;
2049 		}
2050 
2051 		XS_CMD_S_WDOG(xs);
2052 		if (ISP_READ_ISR(isp, &isr, &sema, &mbox)) {
2053 			isp_intr(isp, isr, sema, mbox);
2054 		}
2055 		if (XS_CMD_DONE_P(xs)) {
2056 			isp_prt(isp, ISP_LOGDEBUG2,
2057 			    "watchdog cleanup for handle 0x%x", handle);
2058 			xpt_done((union ccb *) xs);
2059 		} else if (XS_CMD_GRACE_P(xs)) {
2060 			/*
2061 			 * Make sure the command is *really* dead before we
2062 			 * release the handle (and DMA resources) for reuse.
2063 			 */
2064 			(void) isp_control(isp, ISPCTL_ABORT_CMD, arg);
2065 
2066 			/*
2067 			 * After this point, the comamnd is really dead.
2068 			 */
2069 			if (XS_XFRLEN(xs)) {
2070 				ISP_DMAFREE(isp, xs, handle);
2071                 	}
2072 			isp_destroy_handle(isp, handle);
2073 			xpt_print_path(xs->ccb_h.path);
2074 			isp_prt(isp, ISP_LOGWARN,
2075 			    "watchdog timeout for handle 0x%x", handle);
2076 			XS_SETERR(xs, CAM_CMD_TIMEOUT);
2077 			XS_CMD_C_WDOG(xs);
2078 			isp_done(xs);
2079 		} else {
2080 			XS_CMD_C_WDOG(xs);
2081 			xs->ccb_h.timeout_ch = timeout(isp_watchdog, xs, hz);
2082 			XS_CMD_S_GRACE(xs);
2083 			isp->isp_sendmarker |= 1 << XS_CHANNEL(xs);
2084 		}
2085 	} else {
2086 		isp_prt(isp, ISP_LOGDEBUG2, "watchdog with no command");
2087 	}
2088 	ISP_UNLOCK(isp);
2089 }
2090 
2091 static void
2092 isp_kthread(void *arg)
2093 {
2094 	ispsoftc_t *isp = arg;
2095 	int slp;
2096 
2097 
2098 #if __FreeBSD_version < 500000
2099         int s;
2100 
2101         s = splcam();
2102 #else
2103 #ifdef	ISP_SMPLOCK
2104 	mtx_lock(&isp->isp_lock);
2105 #else
2106 	mtx_lock(&Giant);
2107 #endif
2108 #endif
2109 	/*
2110 	 * The first loop is for our usage where we have yet to have
2111 	 * gotten good fibre channel state.
2112 	 */
2113 	for (;;) {
2114 		int wasfrozen, lb;
2115 
2116 		isp_prt(isp, ISP_LOGDEBUG0, "kthread: checking FC state");
2117 		lb = isp_fc_runstate(isp, 250000);
2118 		if (lb) {
2119 			unsigned int inc = 1;
2120 
2121 			if (lb < 0) {
2122 				isp_prt(isp, ISP_LOGDEBUG0,
2123 				    "kthread: FC loop not up (down count %d)",
2124 				    isp->isp_osinfo.loop_down_time);
2125 			} else {
2126 				isp_prt(isp, ISP_LOGDEBUG0,
2127 				    "kthread: FC got to %d (down count %d)",
2128 				    lb, isp->isp_osinfo.loop_down_time);
2129 			}
2130 
2131 
2132 			/*
2133 			 * If we've never seen loop up and we've waited longer
2134 			 * than quickboot time, give up and go to sleep until
2135 			 * loop comes up. Otherwise, increment the loop down
2136 			 * time and figure out how long to sleep to the next
2137 			 * check.
2138 			 */
2139 			if (FCPARAM(isp)->loop_seen_once == 0 &&
2140 			    isp->isp_osinfo.loop_down_time >=
2141 			    isp_quickboot_time) {
2142 				isp->isp_osinfo.loop_down_time = 0xffff;
2143 				slp = 0;
2144 			} else if (isp->isp_osinfo.loop_down_time > 30) {
2145 				inc = 30;
2146 				slp = 30 * hz;
2147 			} else if (isp->isp_osinfo.loop_down_time > 1) {
2148 				slp = hz;
2149 			} else {
2150 				slp = 1;
2151 			}
2152 
2153 			inc += isp->isp_osinfo.loop_down_time;
2154 			if (inc < 0xffff) {
2155 				isp->isp_osinfo.loop_down_time = inc;
2156 			} else {
2157 				isp->isp_osinfo.loop_down_time = 0xfffe;
2158 			}
2159 		} else {
2160 			isp_prt(isp, ISP_LOGDEBUG0, "kthread: FC state OK");
2161 			isp->isp_osinfo.loop_down_time = 0;
2162 			slp = 0;
2163 		}
2164 
2165 		/*
2166 		 * If we'd frozen the simq, unfreeze it now so that CAM
2167 		 * can start sending us commands. If the FC state isn't
2168 		 * okay yet, they'll hit that in isp_start which will
2169 		 * freeze the queue again.
2170 		 */
2171 		wasfrozen = isp->isp_osinfo.simqfrozen & SIMQFRZ_LOOPDOWN;
2172 		isp->isp_osinfo.simqfrozen &= ~SIMQFRZ_LOOPDOWN;
2173 		if (wasfrozen && isp->isp_osinfo.simqfrozen == 0) {
2174 			isp_prt(isp, ISP_LOGDEBUG0, "kthread: releasing simq");
2175 			ISPLOCK_2_CAMLOCK(isp);
2176 			xpt_release_simq(isp->isp_sim, 1);
2177 			CAMLOCK_2_ISPLOCK(isp);
2178 		}
2179 #if __FreeBSD_version < 500000
2180 		tsleep(&isp->isp_osinfo.kproc, PRIBIO, "ispf", slp);
2181 #else
2182 #ifdef	ISP_SMPLOCK
2183 		cv_timed_wait(&isp->isp_osinfo.kthread_cv, &isp->isp_lock, slp);
2184 #else
2185 		(void) tsleep(&isp->isp_osinfo.kthread_cv, PRIBIO, "ispf", slp);
2186 #endif
2187 #endif
2188 		/*
2189 		 * If slp is zero, we're waking up for the first time after
2190 		 * things have been okay. In this case, we set a deferral state
2191 		 * for all commands and delay hysteresis seconds before starting
2192 		 * the FC state evaluation. This gives the loop/fabric a chance
2193 		 * to settle.
2194 		 */
2195 		if (slp == 0 && isp->isp_osinfo.hysteresis) {
2196 			(void) tsleep(&isp_fabric_hysteresis, PRIBIO, "ispT",
2197 			    (isp->isp_osinfo.hysteresis * hz));
2198 		}
2199 	}
2200 }
2201 
2202 static void
2203 isp_action(struct cam_sim *sim, union ccb *ccb)
2204 {
2205 	int bus, tgt, error;
2206 	ispsoftc_t *isp;
2207 	struct ccb_trans_settings *cts;
2208 
2209 	CAM_DEBUG(ccb->ccb_h.path, CAM_DEBUG_TRACE, ("isp_action\n"));
2210 
2211 	isp = (ispsoftc_t *)cam_sim_softc(sim);
2212 	ccb->ccb_h.sim_priv.entries[0].field = 0;
2213 	ccb->ccb_h.sim_priv.entries[1].ptr = isp;
2214 	if (isp->isp_state != ISP_RUNSTATE &&
2215 	    ccb->ccb_h.func_code == XPT_SCSI_IO) {
2216 		CAMLOCK_2_ISPLOCK(isp);
2217 		isp_init(isp);
2218 		if (isp->isp_state != ISP_INITSTATE) {
2219 			ISP_UNLOCK(isp);
2220 			/*
2221 			 * Lie. Say it was a selection timeout.
2222 			 */
2223 			ccb->ccb_h.status = CAM_SEL_TIMEOUT | CAM_DEV_QFRZN;
2224 			xpt_freeze_devq(ccb->ccb_h.path, 1);
2225 			xpt_done(ccb);
2226 			return;
2227 		}
2228 		isp->isp_state = ISP_RUNSTATE;
2229 		ISPLOCK_2_CAMLOCK(isp);
2230 	}
2231 	isp_prt(isp, ISP_LOGDEBUG2, "isp_action code %x", ccb->ccb_h.func_code);
2232 
2233 
2234 	switch (ccb->ccb_h.func_code) {
2235 	case XPT_SCSI_IO:	/* Execute the requested I/O operation */
2236 		/*
2237 		 * Do a couple of preliminary checks...
2238 		 */
2239 		if ((ccb->ccb_h.flags & CAM_CDB_POINTER) != 0) {
2240 			if ((ccb->ccb_h.flags & CAM_CDB_PHYS) != 0) {
2241 				ccb->ccb_h.status = CAM_REQ_INVALID;
2242 				xpt_done(ccb);
2243 				break;
2244 			}
2245 		}
2246 #ifdef	DIAGNOSTIC
2247 		if (ccb->ccb_h.target_id > (ISP_MAX_TARGETS(isp) - 1)) {
2248 			ccb->ccb_h.status = CAM_PATH_INVALID;
2249 		} else if (ccb->ccb_h.target_lun > (ISP_MAX_LUNS(isp) - 1)) {
2250 			ccb->ccb_h.status = CAM_PATH_INVALID;
2251 		}
2252 		if (ccb->ccb_h.status == CAM_PATH_INVALID) {
2253 			isp_prt(isp, ISP_LOGERR,
2254 			    "invalid tgt/lun (%d.%d) in XPT_SCSI_IO",
2255 			    ccb->ccb_h.target_id, ccb->ccb_h.target_lun);
2256 			xpt_done(ccb);
2257 			break;
2258 		}
2259 #endif
2260 		((struct ccb_scsiio *) ccb)->scsi_status = SCSI_STATUS_OK;
2261 		CAMLOCK_2_ISPLOCK(isp);
2262 		error = isp_start((XS_T *) ccb);
2263 		switch (error) {
2264 		case CMD_QUEUED:
2265 			ccb->ccb_h.status |= CAM_SIM_QUEUED;
2266 			if (ccb->ccb_h.timeout != CAM_TIME_INFINITY) {
2267 				uint64_t ticks = (uint64_t) hz;
2268 				if (ccb->ccb_h.timeout == CAM_TIME_DEFAULT)
2269 					ticks = 60 * 1000 * ticks;
2270 				else
2271 					ticks = ccb->ccb_h.timeout * hz;
2272 				ticks = ((ticks + 999) / 1000) + hz + hz;
2273 				if (ticks >= 0x80000000) {
2274 					isp_prt(isp, ISP_LOGERR,
2275 					    "timeout overflow");
2276 					ticks = 0x7fffffff;
2277 				}
2278 				ccb->ccb_h.timeout_ch = timeout(isp_watchdog,
2279 				    (caddr_t)ccb, (int)ticks);
2280 			} else {
2281 				callout_handle_init(&ccb->ccb_h.timeout_ch);
2282 			}
2283 			ISPLOCK_2_CAMLOCK(isp);
2284 			break;
2285 		case CMD_RQLATER:
2286 			/*
2287 			 * This can only happen for Fibre Channel
2288 			 */
2289 			KASSERT((IS_FC(isp)), ("CMD_RQLATER for FC only"));
2290 			/*
2291 			 * If we've exceeded the loop down limit start
2292 			 * failing commands.
2293 			 */
2294 			if (isp->isp_osinfo.loop_down_time >
2295 			    isp->isp_osinfo.loop_down_limit) {
2296 				ISPLOCK_2_CAMLOCK(isp);
2297 				XS_SETERR(ccb, CAM_SEL_TIMEOUT);
2298 				xpt_done(ccb);
2299 				break;
2300 			}
2301 #if __FreeBSD_version < 500000
2302 			wakeup(&isp->isp_osinfo.kproc);
2303 #else
2304 #ifdef	ISP_SMPLOCK
2305 			cv_signal(&isp->isp_osinfo.kthread_cv);
2306 #else
2307 			wakeup(&isp->isp_osinfo.kthread_cv);
2308 #endif
2309 #endif
2310 			isp_freeze_loopdown(isp, "isp_action(RQLATER)");
2311 			XS_SETERR(ccb, CAM_REQUEUE_REQ);
2312 			ISPLOCK_2_CAMLOCK(isp);
2313 			xpt_done(ccb);
2314 			break;
2315 		case CMD_EAGAIN:
2316 			XS_SETERR(ccb, CAM_REQUEUE_REQ);
2317 			ISPLOCK_2_CAMLOCK(isp);
2318 			xpt_done(ccb);
2319 			break;
2320 		case CMD_COMPLETE:
2321 			isp_done((struct ccb_scsiio *) ccb);
2322 			ISPLOCK_2_CAMLOCK(isp);
2323 			break;
2324 		default:
2325 			isp_prt(isp, ISP_LOGERR,
2326 			    "What's this? 0x%x at %d in file %s",
2327 			    error, __LINE__, __FILE__);
2328 			XS_SETERR(ccb, CAM_REQ_CMP_ERR);
2329 			xpt_done(ccb);
2330 			ISPLOCK_2_CAMLOCK(isp);
2331 		}
2332 		break;
2333 
2334 #ifdef	ISP_TARGET_MODE
2335 	case XPT_EN_LUN:		/* Enable LUN as a target */
2336 	{
2337 		int seq, i;
2338 		CAMLOCK_2_ISPLOCK(isp);
2339 		seq = isp_en_lun(isp, ccb);
2340 		if (seq < 0) {
2341 			ISPLOCK_2_CAMLOCK(isp);
2342 			xpt_done(ccb);
2343 			break;
2344 		}
2345 		for (i = 0; isp->isp_osinfo.leact[seq] && i < 30 * 1000; i++) {
2346 			uint32_t isr;
2347 			uint16_t sema, mbox;
2348 			if (ISP_READ_ISR(isp, &isr, &sema, &mbox)) {
2349 				isp_intr(isp, isr, sema, mbox);
2350 			}
2351 			DELAY(1000);
2352 		}
2353 		ISPLOCK_2_CAMLOCK(isp);
2354 		break;
2355 	}
2356 	case XPT_NOTIFY_ACK:		/* recycle notify ack */
2357 	case XPT_IMMED_NOTIFY:		/* Add Immediate Notify Resource */
2358 	case XPT_ACCEPT_TARGET_IO:	/* Add Accept Target IO Resource */
2359 	{
2360 		tstate_t *tptr =
2361 		    get_lun_statep(isp, XS_CHANNEL(ccb), ccb->ccb_h.target_lun);
2362 		if (tptr == NULL) {
2363 			ccb->ccb_h.status = CAM_LUN_INVALID;
2364 			xpt_done(ccb);
2365 			break;
2366 		}
2367 		ccb->ccb_h.sim_priv.entries[0].field = 0;
2368 		ccb->ccb_h.sim_priv.entries[1].ptr = isp;
2369 		ccb->ccb_h.flags = 0;
2370 
2371 		CAMLOCK_2_ISPLOCK(isp);
2372 		if (ccb->ccb_h.func_code == XPT_ACCEPT_TARGET_IO) {
2373 			/*
2374 			 * Note that the command itself may not be done-
2375 			 * it may not even have had the first CTIO sent.
2376 			 */
2377 			tptr->atio_count++;
2378 			isp_prt(isp, ISP_LOGTDEBUG0,
2379 			    "Put FREE ATIO, lun %d, count now %d",
2380 			    ccb->ccb_h.target_lun, tptr->atio_count);
2381 			SLIST_INSERT_HEAD(&tptr->atios, &ccb->ccb_h,
2382 			    sim_links.sle);
2383 		} else if (ccb->ccb_h.func_code == XPT_IMMED_NOTIFY) {
2384 			tptr->inot_count++;
2385 			isp_prt(isp, ISP_LOGTDEBUG0,
2386 			    "Put FREE INOT, lun %d, count now %d",
2387 			    ccb->ccb_h.target_lun, tptr->inot_count);
2388 			SLIST_INSERT_HEAD(&tptr->inots, &ccb->ccb_h,
2389 			    sim_links.sle);
2390 		} else {
2391 			isp_prt(isp, ISP_LOGWARN, "Got Notify ACK");;
2392 		}
2393 		rls_lun_statep(isp, tptr);
2394 		ccb->ccb_h.status = CAM_REQ_INPROG;
2395 		ISPLOCK_2_CAMLOCK(isp);
2396 		break;
2397 	}
2398 	case XPT_CONT_TARGET_IO:
2399 	{
2400 		CAMLOCK_2_ISPLOCK(isp);
2401 		isp_target_start_ctio(isp, ccb);
2402 		ISPLOCK_2_CAMLOCK(isp);
2403 		break;
2404 	}
2405 #endif
2406 	case XPT_RESET_DEV:		/* BDR the specified SCSI device */
2407 
2408 		bus = cam_sim_bus(xpt_path_sim(ccb->ccb_h.path));
2409 		tgt = ccb->ccb_h.target_id;
2410 		tgt |= (bus << 16);
2411 
2412 		CAMLOCK_2_ISPLOCK(isp);
2413 		error = isp_control(isp, ISPCTL_RESET_DEV, &tgt);
2414 		ISPLOCK_2_CAMLOCK(isp);
2415 		if (error) {
2416 			ccb->ccb_h.status = CAM_REQ_CMP_ERR;
2417 		} else {
2418 			ccb->ccb_h.status = CAM_REQ_CMP;
2419 		}
2420 		xpt_done(ccb);
2421 		break;
2422 	case XPT_ABORT:			/* Abort the specified CCB */
2423 	{
2424 		union ccb *accb = ccb->cab.abort_ccb;
2425 		CAMLOCK_2_ISPLOCK(isp);
2426 		switch (accb->ccb_h.func_code) {
2427 #ifdef	ISP_TARGET_MODE
2428 		case XPT_ACCEPT_TARGET_IO:
2429 		case XPT_IMMED_NOTIFY:
2430         		ccb->ccb_h.status = isp_abort_tgt_ccb(isp, ccb);
2431 			break;
2432 		case XPT_CONT_TARGET_IO:
2433 			isp_prt(isp, ISP_LOGERR, "cannot abort CTIOs yet");
2434 			ccb->ccb_h.status = CAM_UA_ABORT;
2435 			break;
2436 #endif
2437 		case XPT_SCSI_IO:
2438 			error = isp_control(isp, ISPCTL_ABORT_CMD, ccb);
2439 			if (error) {
2440 				ccb->ccb_h.status = CAM_UA_ABORT;
2441 			} else {
2442 				ccb->ccb_h.status = CAM_REQ_CMP;
2443 			}
2444 			break;
2445 		default:
2446 			ccb->ccb_h.status = CAM_REQ_INVALID;
2447 			break;
2448 		}
2449 		ISPLOCK_2_CAMLOCK(isp);
2450 		xpt_done(ccb);
2451 		break;
2452 	}
2453 #define	IS_CURRENT_SETTINGS(c)	(c->type == CTS_TYPE_CURRENT_SETTINGS)
2454 	case XPT_SET_TRAN_SETTINGS:	/* Nexus Settings */
2455 		cts = &ccb->cts;
2456 		if (!IS_CURRENT_SETTINGS(cts)) {
2457 			ccb->ccb_h.status = CAM_REQ_INVALID;
2458 			xpt_done(ccb);
2459 			break;
2460 		}
2461 		tgt = cts->ccb_h.target_id;
2462 		CAMLOCK_2_ISPLOCK(isp);
2463 		if (IS_SCSI(isp)) {
2464 			struct ccb_trans_settings_scsi *scsi =
2465 			    &cts->proto_specific.scsi;
2466 			struct ccb_trans_settings_spi *spi =
2467 			    &cts->xport_specific.spi;
2468 			sdparam *sdp = isp->isp_param;
2469 			uint16_t *dptr;
2470 
2471 			bus = cam_sim_bus(xpt_path_sim(cts->ccb_h.path));
2472 			sdp += bus;
2473 			/*
2474 			 * We always update (internally) from goal_flags
2475 			 * so any request to change settings just gets
2476 			 * vectored to that location.
2477 			 */
2478 			dptr = &sdp->isp_devparam[tgt].goal_flags;
2479 
2480 			if ((spi->valid & CTS_SPI_VALID_DISC) != 0) {
2481 				if ((spi->flags & CTS_SPI_FLAGS_DISC_ENB) != 0)
2482 					*dptr |= DPARM_DISC;
2483 				else
2484 					*dptr &= ~DPARM_DISC;
2485 			}
2486 
2487 			if ((scsi->valid & CTS_SCSI_VALID_TQ) != 0) {
2488 				if ((scsi->flags & CTS_SCSI_FLAGS_TAG_ENB) != 0)
2489 					*dptr |= DPARM_TQING;
2490 				else
2491 					*dptr &= ~DPARM_TQING;
2492 			}
2493 
2494 			if ((spi->valid & CTS_SPI_VALID_BUS_WIDTH) != 0) {
2495 				if (spi->bus_width == MSG_EXT_WDTR_BUS_16_BIT)
2496 					*dptr |= DPARM_WIDE;
2497 				else
2498 					*dptr &= ~DPARM_WIDE;
2499 			}
2500 
2501 			/*
2502 			 * XXX: FIX ME
2503 			 */
2504 			if ((spi->valid & CTS_SPI_VALID_SYNC_OFFSET) &&
2505 			    (spi->valid & CTS_SPI_VALID_SYNC_RATE) &&
2506 			    (spi->sync_period && spi->sync_offset)) {
2507 				*dptr |= DPARM_SYNC;
2508 				/*
2509 				 * XXX: CHECK FOR LEGALITY
2510 				 */
2511 				sdp->isp_devparam[tgt].goal_period =
2512 				    spi->sync_period;
2513 				sdp->isp_devparam[tgt].goal_offset =
2514 				    spi->sync_offset;
2515 			} else {
2516 				*dptr &= ~DPARM_SYNC;
2517 			}
2518 			isp_prt(isp, ISP_LOGDEBUG0,
2519 			    "SET bus %d targ %d to flags %x off %x per %x",
2520 			    bus, tgt, sdp->isp_devparam[tgt].goal_flags,
2521 			    sdp->isp_devparam[tgt].goal_offset,
2522 			    sdp->isp_devparam[tgt].goal_period);
2523 			sdp->isp_devparam[tgt].dev_update = 1;
2524 			isp->isp_update |= (1 << bus);
2525 		}
2526 		ISPLOCK_2_CAMLOCK(isp);
2527 		ccb->ccb_h.status = CAM_REQ_CMP;
2528 		xpt_done(ccb);
2529 		break;
2530 	case XPT_GET_TRAN_SETTINGS:
2531 		cts = &ccb->cts;
2532 		tgt = cts->ccb_h.target_id;
2533 		CAMLOCK_2_ISPLOCK(isp);
2534 		if (IS_FC(isp)) {
2535 			fcparam *fcp = isp->isp_param;
2536 			struct ccb_trans_settings_fc *fc =
2537 			    &cts->xport_specific.fc;
2538 
2539 			cts->protocol = PROTO_SCSI;
2540 			cts->protocol_version = SCSI_REV_2;
2541 			cts->transport = XPORT_FC;
2542 			cts->transport_version = 0;
2543 
2544 			fc->valid = CTS_FC_VALID_SPEED;
2545 			if (fcp->isp_gbspeed == 2)
2546 				fc->bitrate = 200000;
2547 			else
2548 				fc->bitrate = 100000;
2549 			if (tgt > 0 && tgt < MAX_FC_TARG) {
2550 				fcportdb_t *lp = &fcp->portdb[tgt];
2551 				fc->wwnn = lp->node_wwn;
2552 				fc->wwpn = lp->port_wwn;
2553 				fc->port = lp->portid;
2554 				fc->valid |= CTS_FC_VALID_WWNN |
2555 				    CTS_FC_VALID_WWPN | CTS_FC_VALID_PORT;
2556 			}
2557 		} else {
2558 			struct ccb_trans_settings_scsi *scsi =
2559 			    &cts->proto_specific.scsi;
2560 			struct ccb_trans_settings_spi *spi =
2561 			    &cts->xport_specific.spi;
2562 			sdparam *sdp = isp->isp_param;
2563 			int bus = cam_sim_bus(xpt_path_sim(cts->ccb_h.path));
2564 			uint16_t dval, pval, oval;
2565 
2566 			sdp += bus;
2567 
2568 			if (IS_CURRENT_SETTINGS(cts)) {
2569 				sdp->isp_devparam[tgt].dev_refresh = 1;
2570 				isp->isp_update |= (1 << bus);
2571 				(void) isp_control(isp, ISPCTL_UPDATE_PARAMS,
2572 				    NULL);
2573 				dval = sdp->isp_devparam[tgt].actv_flags;
2574 				oval = sdp->isp_devparam[tgt].actv_offset;
2575 				pval = sdp->isp_devparam[tgt].actv_period;
2576 			} else {
2577 				dval = sdp->isp_devparam[tgt].nvrm_flags;
2578 				oval = sdp->isp_devparam[tgt].nvrm_offset;
2579 				pval = sdp->isp_devparam[tgt].nvrm_period;
2580 			}
2581 
2582 			cts->protocol = PROTO_SCSI;
2583 			cts->protocol_version = SCSI_REV_2;
2584 			cts->transport = XPORT_SPI;
2585 			cts->transport_version = 2;
2586 
2587 			scsi->flags &= ~CTS_SCSI_FLAGS_TAG_ENB;
2588 			spi->flags &= ~CTS_SPI_FLAGS_DISC_ENB;
2589 			if (dval & DPARM_DISC) {
2590 				spi->flags |= CTS_SPI_FLAGS_DISC_ENB;
2591 			}
2592 			if (dval & DPARM_TQING) {
2593 				scsi->flags |= CTS_SCSI_FLAGS_TAG_ENB;
2594 			}
2595 			if ((dval & DPARM_SYNC) && oval && pval) {
2596 				spi->sync_offset = oval;
2597 				spi->sync_period = pval;
2598 				spi->valid |= CTS_SPI_VALID_SYNC_OFFSET;
2599 				spi->valid |= CTS_SPI_VALID_SYNC_RATE;
2600 			}
2601 			spi->valid |= CTS_SPI_VALID_BUS_WIDTH;
2602 			if (dval & DPARM_WIDE) {
2603 				spi->bus_width = MSG_EXT_WDTR_BUS_16_BIT;
2604 			} else {
2605 				spi->bus_width = MSG_EXT_WDTR_BUS_8_BIT;
2606 			}
2607 			if (cts->ccb_h.target_lun != CAM_LUN_WILDCARD) {
2608 				scsi->valid = CTS_SCSI_VALID_TQ;
2609 				spi->valid |= CTS_SPI_VALID_DISC;
2610 			} else {
2611 				scsi->valid = 0;
2612 			}
2613 			isp_prt(isp, ISP_LOGDEBUG0,
2614 			    "GET %s bus %d targ %d to flags %x off %x per %x",
2615 			    IS_CURRENT_SETTINGS(cts)? "ACTIVE" : "NVRAM",
2616 			    bus, tgt, dval, oval, pval);
2617 		}
2618 		ISPLOCK_2_CAMLOCK(isp);
2619 		ccb->ccb_h.status = CAM_REQ_CMP;
2620 		xpt_done(ccb);
2621 		break;
2622 
2623 	case XPT_CALC_GEOMETRY:
2624 #if __FreeBSD_version < 500000
2625 	{
2626 		struct ccb_calc_geometry *ccg;
2627 		u_int32_t secs_per_cylinder;
2628 		u_int32_t size_mb;
2629 
2630 		ccg = &ccb->ccg;
2631 		if (ccg->block_size == 0) {
2632 			ccb->ccb_h.status = CAM_REQ_INVALID;
2633 			xpt_done(ccb);
2634 			break;
2635 		}
2636 		size_mb = ccg->volume_size /((1024L * 1024L) / ccg->block_size);
2637 		if (size_mb > 1024) {
2638 			ccg->heads = 255;
2639 			ccg->secs_per_track = 63;
2640 		} else {
2641 			ccg->heads = 64;
2642 			ccg->secs_per_track = 32;
2643 		}
2644 		secs_per_cylinder = ccg->heads * ccg->secs_per_track;
2645 		ccg->cylinders = ccg->volume_size / secs_per_cylinder;
2646 		ccb->ccb_h.status = CAM_REQ_CMP;
2647 		xpt_done(ccb);
2648 		break;
2649 	}
2650 #else
2651 	{
2652 		cam_calc_geometry(&ccb->ccg, /*extended*/1);
2653 		xpt_done(ccb);
2654 		break;
2655 	}
2656 #endif
2657 	case XPT_RESET_BUS:		/* Reset the specified bus */
2658 		bus = cam_sim_bus(sim);
2659 		CAMLOCK_2_ISPLOCK(isp);
2660 		error = isp_control(isp, ISPCTL_RESET_BUS, &bus);
2661 		ISPLOCK_2_CAMLOCK(isp);
2662 		if (error)
2663 			ccb->ccb_h.status = CAM_REQ_CMP_ERR;
2664 		else {
2665 			if (cam_sim_bus(sim) && isp->isp_path2 != NULL)
2666 				xpt_async(AC_BUS_RESET, isp->isp_path2, NULL);
2667 			else if (isp->isp_path != NULL)
2668 				xpt_async(AC_BUS_RESET, isp->isp_path, NULL);
2669 			ccb->ccb_h.status = CAM_REQ_CMP;
2670 		}
2671 		xpt_done(ccb);
2672 		break;
2673 
2674 	case XPT_TERM_IO:		/* Terminate the I/O process */
2675 		ccb->ccb_h.status = CAM_REQ_INVALID;
2676 		xpt_done(ccb);
2677 		break;
2678 
2679 	case XPT_PATH_INQ:		/* Path routing inquiry */
2680 	{
2681 		struct ccb_pathinq *cpi = &ccb->cpi;
2682 
2683 		cpi->version_num = 1;
2684 #ifdef	ISP_TARGET_MODE
2685 		cpi->target_sprt = PIT_PROCESSOR | PIT_DISCONNECT | PIT_TERM_IO;
2686 #else
2687 		cpi->target_sprt = 0;
2688 #endif
2689 		cpi->hba_eng_cnt = 0;
2690 		cpi->max_target = ISP_MAX_TARGETS(isp) - 1;
2691 		cpi->max_lun = ISP_MAX_LUNS(isp) - 1;
2692 		cpi->bus_id = cam_sim_bus(sim);
2693 		if (IS_FC(isp)) {
2694 			cpi->hba_misc = PIM_NOBUSRESET;
2695 			/*
2696 			 * Because our loop ID can shift from time to time,
2697 			 * make our initiator ID out of range of our bus.
2698 			 */
2699 			cpi->initiator_id = cpi->max_target + 1;
2700 
2701 			/*
2702 			 * Set base transfer capabilities for Fibre Channel.
2703 			 * Technically not correct because we don't know
2704 			 * what media we're running on top of- but we'll
2705 			 * look good if we always say 100MB/s.
2706 			 */
2707 			if (FCPARAM(isp)->isp_gbspeed == 2)
2708 				cpi->base_transfer_speed = 200000;
2709 			else
2710 				cpi->base_transfer_speed = 100000;
2711 			cpi->hba_inquiry = PI_TAG_ABLE;
2712 			cpi->transport = XPORT_FC;
2713 			cpi->transport_version = 0;	/* WHAT'S THIS FOR? */
2714 		} else {
2715 			sdparam *sdp = isp->isp_param;
2716 			sdp += cam_sim_bus(xpt_path_sim(cpi->ccb_h.path));
2717 			cpi->hba_inquiry = PI_SDTR_ABLE|PI_TAG_ABLE|PI_WIDE_16;
2718 			cpi->hba_misc = 0;
2719 			cpi->initiator_id = sdp->isp_initiator_id;
2720 			cpi->base_transfer_speed = 3300;
2721 			cpi->transport = XPORT_SPI;
2722 			cpi->transport_version = 2;	/* WHAT'S THIS FOR? */
2723 		}
2724 		cpi->protocol = PROTO_SCSI;
2725 		cpi->protocol_version = SCSI_REV_2;
2726 		strncpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
2727 		strncpy(cpi->hba_vid, "Qlogic", HBA_IDLEN);
2728 		strncpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
2729 		cpi->unit_number = cam_sim_unit(sim);
2730 		cpi->ccb_h.status = CAM_REQ_CMP;
2731 		xpt_done(ccb);
2732 		break;
2733 	}
2734 	default:
2735 		ccb->ccb_h.status = CAM_REQ_INVALID;
2736 		xpt_done(ccb);
2737 		break;
2738 	}
2739 }
2740 
2741 #define	ISPDDB	(CAM_DEBUG_INFO|CAM_DEBUG_TRACE|CAM_DEBUG_CDB)
2742 void
2743 isp_done(struct ccb_scsiio *sccb)
2744 {
2745 	ispsoftc_t *isp = XS_ISP(sccb);
2746 
2747 	if (XS_NOERR(sccb))
2748 		XS_SETERR(sccb, CAM_REQ_CMP);
2749 
2750 	if ((sccb->ccb_h.status & CAM_STATUS_MASK) == CAM_REQ_CMP &&
2751 	    (sccb->scsi_status != SCSI_STATUS_OK)) {
2752 		sccb->ccb_h.status &= ~CAM_STATUS_MASK;
2753 		if ((sccb->scsi_status == SCSI_STATUS_CHECK_COND) &&
2754 		    (sccb->ccb_h.status & CAM_AUTOSNS_VALID) == 0) {
2755 			sccb->ccb_h.status |= CAM_AUTOSENSE_FAIL;
2756 		} else {
2757 			sccb->ccb_h.status |= CAM_SCSI_STATUS_ERROR;
2758 		}
2759 	}
2760 
2761 	sccb->ccb_h.status &= ~CAM_SIM_QUEUED;
2762 	if ((sccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
2763 		if ((sccb->ccb_h.status & CAM_DEV_QFRZN) == 0) {
2764 			sccb->ccb_h.status |= CAM_DEV_QFRZN;
2765 			xpt_freeze_devq(sccb->ccb_h.path, 1);
2766 			isp_prt(isp, ISP_LOGDEBUG0,
2767 			    "freeze devq %d.%d cam sts %x scsi sts %x",
2768 			    sccb->ccb_h.target_id, sccb->ccb_h.target_lun,
2769 			    sccb->ccb_h.status, sccb->scsi_status);
2770 		}
2771 	}
2772 
2773 	if ((CAM_DEBUGGED(sccb->ccb_h.path, ISPDDB)) &&
2774 	    (sccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
2775 		xpt_print_path(sccb->ccb_h.path);
2776 		isp_prt(isp, ISP_LOGINFO,
2777 		    "cam completion status 0x%x", sccb->ccb_h.status);
2778 	}
2779 
2780 	XS_CMD_S_DONE(sccb);
2781 	if (XS_CMD_WDOG_P(sccb) == 0) {
2782 		untimeout(isp_watchdog, (caddr_t)sccb, sccb->ccb_h.timeout_ch);
2783 		if (XS_CMD_GRACE_P(sccb)) {
2784 			isp_prt(isp, ISP_LOGDEBUG2,
2785 			    "finished command on borrowed time");
2786 		}
2787 		XS_CMD_S_CLEAR(sccb);
2788 		ISPLOCK_2_CAMLOCK(isp);
2789 		xpt_done((union ccb *) sccb);
2790 		CAMLOCK_2_ISPLOCK(isp);
2791 	}
2792 }
2793 
2794 int
2795 isp_async(ispsoftc_t *isp, ispasync_t cmd, void *arg)
2796 {
2797 	int bus, rv = 0;
2798 	static const char *roles[4] = {
2799 	    "(none)", "Target", "Initiator", "Target/Initiator"
2800 	};
2801 	static const char prom[] =
2802 	    "PortID 0x%06x handle 0x%x role %s %s\n"
2803             "      WWNN 0x%08x%08x WWPN 0x%08x%08x";
2804 	static const char prom2[] =
2805 	    "PortID 0x%06x handle 0x%x role %s %s tgt %u\n"
2806             "      WWNN 0x%08x%08x WWPN 0x%08x%08x";
2807 	target_id_t tgt;
2808 	fcportdb_t *lp;
2809 	struct cam_path *tmppath;
2810 
2811 	switch (cmd) {
2812 	case ISPASYNC_NEW_TGT_PARAMS:
2813 	{
2814 		struct ccb_trans_settings_scsi *scsi;
2815 		struct ccb_trans_settings_spi *spi;
2816 		int flags, tgt;
2817 		sdparam *sdp = isp->isp_param;
2818 		struct ccb_trans_settings cts;
2819 
2820 		memset(&cts, 0, sizeof (struct ccb_trans_settings));
2821 
2822 		tgt = *((int *)arg);
2823 		bus = (tgt >> 16) & 0xffff;
2824 		tgt &= 0xffff;
2825 		sdp += bus;
2826 		ISPLOCK_2_CAMLOCK(isp);
2827 		if (xpt_create_path(&tmppath, NULL,
2828 		    cam_sim_path(bus? isp->isp_sim2 : isp->isp_sim),
2829 		    tgt, CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
2830 			CAMLOCK_2_ISPLOCK(isp);
2831 			isp_prt(isp, ISP_LOGWARN,
2832 			    "isp_async cannot make temp path for %d.%d",
2833 			    tgt, bus);
2834 			rv = -1;
2835 			break;
2836 		}
2837 		CAMLOCK_2_ISPLOCK(isp);
2838 		flags = sdp->isp_devparam[tgt].actv_flags;
2839 		cts.type = CTS_TYPE_CURRENT_SETTINGS;
2840 		cts.protocol = PROTO_SCSI;
2841 		cts.transport = XPORT_SPI;
2842 
2843 		scsi = &cts.proto_specific.scsi;
2844 		spi = &cts.xport_specific.spi;
2845 
2846 		if (flags & DPARM_TQING) {
2847 			scsi->valid |= CTS_SCSI_VALID_TQ;
2848 			scsi->flags |= CTS_SCSI_FLAGS_TAG_ENB;
2849 		}
2850 
2851 		if (flags & DPARM_DISC) {
2852 			spi->valid |= CTS_SPI_VALID_DISC;
2853 			spi->flags |= CTS_SPI_FLAGS_DISC_ENB;
2854 		}
2855 		spi->flags |= CTS_SPI_VALID_BUS_WIDTH;
2856 		if (flags & DPARM_WIDE) {
2857 			spi->bus_width = MSG_EXT_WDTR_BUS_16_BIT;
2858 		} else {
2859 			spi->bus_width = MSG_EXT_WDTR_BUS_8_BIT;
2860 		}
2861 		if (flags & DPARM_SYNC) {
2862 			spi->valid |= CTS_SPI_VALID_SYNC_RATE;
2863 			spi->valid |= CTS_SPI_VALID_SYNC_OFFSET;
2864 			spi->sync_period = sdp->isp_devparam[tgt].actv_period;
2865 			spi->sync_offset = sdp->isp_devparam[tgt].actv_offset;
2866 		}
2867 		isp_prt(isp, ISP_LOGDEBUG2,
2868 		    "NEW_TGT_PARAMS bus %d tgt %d period %x offset %x flags %x",
2869 		    bus, tgt, sdp->isp_devparam[tgt].actv_period,
2870 		    sdp->isp_devparam[tgt].actv_offset, flags);
2871 		xpt_setup_ccb(&cts.ccb_h, tmppath, 1);
2872 		ISPLOCK_2_CAMLOCK(isp);
2873 		xpt_async(AC_TRANSFER_NEG, tmppath, &cts);
2874 		xpt_free_path(tmppath);
2875 		CAMLOCK_2_ISPLOCK(isp);
2876 		break;
2877 	}
2878 	case ISPASYNC_BUS_RESET:
2879 		bus = *((int *)arg);
2880 		isp_prt(isp, ISP_LOGINFO, "SCSI bus reset on bus %d detected",
2881 		    bus);
2882 		if (bus > 0 && isp->isp_path2) {
2883 			ISPLOCK_2_CAMLOCK(isp);
2884 			xpt_async(AC_BUS_RESET, isp->isp_path2, NULL);
2885 			CAMLOCK_2_ISPLOCK(isp);
2886 		} else if (isp->isp_path) {
2887 			ISPLOCK_2_CAMLOCK(isp);
2888 			xpt_async(AC_BUS_RESET, isp->isp_path, NULL);
2889 			CAMLOCK_2_ISPLOCK(isp);
2890 		}
2891 		break;
2892 	case ISPASYNC_LIP:
2893 		if (isp->isp_path) {
2894 			isp_freeze_loopdown(isp, "ISPASYNC_LIP");
2895 		}
2896 		isp_prt(isp, ISP_LOGINFO, "LIP Received");
2897 		break;
2898 	case ISPASYNC_LOOP_RESET:
2899 		if (isp->isp_path) {
2900 			isp_freeze_loopdown(isp, "ISPASYNC_LOOP_RESET");
2901 		}
2902 		isp_prt(isp, ISP_LOGINFO, "Loop Reset Received");
2903 		break;
2904 	case ISPASYNC_LOOP_DOWN:
2905 		if (isp->isp_path) {
2906 			isp_freeze_loopdown(isp, "ISPASYNC_LOOP_DOWN");
2907 		}
2908 		isp_prt(isp, ISP_LOGINFO, "Loop DOWN");
2909 		break;
2910 	case ISPASYNC_LOOP_UP:
2911 		/*
2912 		 * Now we just note that Loop has come up. We don't
2913 		 * actually do anything because we're waiting for a
2914 		 * Change Notify before activating the FC cleanup
2915 		 * thread to look at the state of the loop again.
2916 		 */
2917 		isp_prt(isp, ISP_LOGINFO, "Loop UP");
2918 		break;
2919 	case ISPASYNC_DEV_ARRIVED:
2920 		lp = arg;
2921 
2922 		if (lp->ini_map_idx) {
2923 			tgt = lp->ini_map_idx - 1;
2924 			isp_prt(isp, ISP_LOGCONFIG, prom2,
2925 			    lp->portid, lp->handle,
2926 		            roles[lp->roles & 0x3], "arrived at", tgt,
2927 		    	    (uint32_t) (lp->node_wwn >> 32),
2928 			    (uint32_t) lp->node_wwn,
2929 		    	    (uint32_t) (lp->port_wwn >> 32),
2930 			    (uint32_t) lp->port_wwn);
2931 #if __FreeBSD_version >= 500000
2932 			ISPLOCK_2_CAMLOCK(isp);
2933 			if (xpt_create_path(&tmppath, NULL,
2934 			    cam_sim_path(isp->isp_sim), tgt,
2935 			    CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
2936 				CAMLOCK_2_ISPLOCK(isp);
2937 				break;
2938 			}
2939 			xpt_async(AC_FOUND_DEVICE, tmppath, NULL);
2940 			xpt_free_path(tmppath);
2941 			CAMLOCK_2_ISPLOCK(isp);
2942 #endif
2943 		} else {
2944 			isp_prt(isp, ISP_LOGCONFIG, prom,
2945 			    lp->portid, lp->handle,
2946 		            roles[lp->roles & 0x3], "arrived",
2947 		    	    (uint32_t) (lp->node_wwn >> 32),
2948 			    (uint32_t) lp->node_wwn,
2949 		    	    (uint32_t) (lp->port_wwn >> 32),
2950 			    (uint32_t) lp->port_wwn);
2951 		}
2952 		break;
2953 	case ISPASYNC_DEV_CHANGED:
2954 		lp = arg;
2955 		if (lp->ini_map_idx) {
2956 			tgt = lp->ini_map_idx - 1;
2957 			isp_prt(isp, ISP_LOGCONFIG, prom2,
2958 			    lp->portid, lp->handle,
2959 		    	    roles[lp->roles & 0x3], "changed at", tgt,
2960 			    (uint32_t) (lp->node_wwn >> 32),
2961 			    (uint32_t) lp->node_wwn,
2962 		    	    (uint32_t) (lp->port_wwn >> 32),
2963 			    (uint32_t) lp->port_wwn);
2964 		} else {
2965 			isp_prt(isp, ISP_LOGCONFIG, prom,
2966 			    lp->portid, lp->handle,
2967 		    	    roles[lp->roles & 0x3], "changed",
2968 			    (uint32_t) (lp->node_wwn >> 32),
2969 			    (uint32_t) lp->node_wwn,
2970 		    	    (uint32_t) (lp->port_wwn >> 32),
2971 			    (uint32_t) lp->port_wwn);
2972 		}
2973 		break;
2974 	case ISPASYNC_DEV_STAYED:
2975 		lp = arg;
2976 		if (lp->ini_map_idx) {
2977 			tgt = lp->ini_map_idx - 1;
2978 			isp_prt(isp, ISP_LOGCONFIG, prom2,
2979 			    lp->portid, lp->handle,
2980 		    	    roles[lp->roles & 0x3], "stayed at", tgt,
2981 			    (uint32_t) (lp->node_wwn >> 32),
2982 			    (uint32_t) lp->node_wwn,
2983 		    	    (uint32_t) (lp->port_wwn >> 32),
2984 			    (uint32_t) lp->port_wwn);
2985 		} else {
2986 			isp_prt(isp, ISP_LOGCONFIG, prom,
2987 			    lp->portid, lp->handle,
2988 		    	    roles[lp->roles & 0x3], "stayed",
2989 			    (uint32_t) (lp->node_wwn >> 32),
2990 			    (uint32_t) lp->node_wwn,
2991 		    	    (uint32_t) (lp->port_wwn >> 32),
2992 			    (uint32_t) lp->port_wwn);
2993 		}
2994 		break;
2995 	case ISPASYNC_DEV_GONE:
2996 		lp = arg;
2997 		if (lp->ini_map_idx) {
2998 			tgt = lp->ini_map_idx - 1;
2999 			isp_prt(isp, ISP_LOGCONFIG, prom2,
3000 			    lp->portid, lp->handle,
3001 		            roles[lp->roles & 0x3], "departed from", tgt,
3002 		    	    (uint32_t) (lp->node_wwn >> 32),
3003 			    (uint32_t) lp->node_wwn,
3004 		    	    (uint32_t) (lp->port_wwn >> 32),
3005 			    (uint32_t) lp->port_wwn);
3006 #if __FreeBSD_version >= 500000
3007 			ISPLOCK_2_CAMLOCK(isp);
3008 			if (xpt_create_path(&tmppath, NULL,
3009 			    cam_sim_path(isp->isp_sim), tgt,
3010 			    CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
3011 				CAMLOCK_2_ISPLOCK(isp);
3012 				break;
3013 			}
3014 			xpt_async(AC_LOST_DEVICE, tmppath, NULL);
3015 			xpt_free_path(tmppath);
3016 			CAMLOCK_2_ISPLOCK(isp);
3017 #endif
3018 		} else {
3019 			isp_prt(isp, ISP_LOGCONFIG, prom,
3020 			    lp->portid, lp->handle,
3021 		            roles[lp->roles & 0x3], "departed",
3022 		    	    (uint32_t) (lp->node_wwn >> 32),
3023 			    (uint32_t) lp->node_wwn,
3024 		    	    (uint32_t) (lp->port_wwn >> 32),
3025 			    (uint32_t) lp->port_wwn);
3026 		}
3027 		break;
3028 	case ISPASYNC_CHANGE_NOTIFY:
3029 	{
3030 		char *msg;
3031 		if (arg == ISPASYNC_CHANGE_PDB) {
3032 			msg = "Port Database Changed";
3033 		} else if (arg == ISPASYNC_CHANGE_SNS) {
3034 			msg = "Name Server Database Changed";
3035 		} else {
3036 			msg = "Other Change Notify";
3037 		}
3038 		isp_prt(isp, ISP_LOGINFO, msg);
3039 		isp_freeze_loopdown(isp, msg);
3040 #if __FreeBSD_version < 500000
3041 		wakeup(&isp->isp_osinfo.kproc);
3042 #else
3043 #ifdef	ISP_SMPLOCK
3044 		cv_signal(&isp->isp_osinfo.kthread_cv);
3045 #else
3046 		wakeup(&isp->isp_osinfo.kthread_cv);
3047 #endif
3048 #endif
3049 		break;
3050 	}
3051 #ifdef	ISP_TARGET_MODE
3052 	case ISPASYNC_TARGET_NOTIFY:
3053 	{
3054 		tmd_notify_t *nt = arg;
3055 		isp_prt(isp, ISP_LOGALL,
3056 		    "target notify code 0x%x", nt->nt_ncode);
3057 		break;
3058 	}
3059 	case ISPASYNC_TARGET_ACTION:
3060 		switch (((isphdr_t *)arg)->rqs_entry_type) {
3061 		default:
3062 			isp_prt(isp, ISP_LOGWARN,
3063 			   "event 0x%x for unhandled target action",
3064 			    ((isphdr_t *)arg)->rqs_entry_type);
3065 			break;
3066 		case RQSTYPE_NOTIFY:
3067 			if (IS_SCSI(isp)) {
3068 				rv = isp_handle_platform_notify_scsi(isp,
3069 				    (in_entry_t *) arg);
3070 			} else {
3071 				rv = isp_handle_platform_notify_fc(isp,
3072 				    (in_fcentry_t *) arg);
3073 			}
3074 			break;
3075 		case RQSTYPE_ATIO:
3076 			rv = isp_handle_platform_atio(isp, (at_entry_t *) arg);
3077 			break;
3078 		case RQSTYPE_ATIO2:
3079 			rv = isp_handle_platform_atio2(isp, (at2_entry_t *)arg);
3080 			break;
3081 		case RQSTYPE_CTIO3:
3082 		case RQSTYPE_CTIO2:
3083 		case RQSTYPE_CTIO:
3084 			rv = isp_handle_platform_ctio(isp, arg);
3085 			break;
3086 		case RQSTYPE_ENABLE_LUN:
3087 		case RQSTYPE_MODIFY_LUN:
3088 			isp_ledone(isp, (lun_entry_t *) arg);
3089 			break;
3090 		}
3091 		break;
3092 #endif
3093 	case ISPASYNC_FW_CRASH:
3094 	{
3095 		uint16_t mbox1, mbox6;
3096 		mbox1 = ISP_READ(isp, OUTMAILBOX1);
3097 		if (IS_DUALBUS(isp)) {
3098 			mbox6 = ISP_READ(isp, OUTMAILBOX6);
3099 		} else {
3100 			mbox6 = 0;
3101 		}
3102                 isp_prt(isp, ISP_LOGERR,
3103                     "Internal Firmware Error on bus %d @ RISC Address 0x%x",
3104                     mbox6, mbox1);
3105 #ifdef	ISP_FW_CRASH_DUMP
3106 		/*
3107 		 * XXX: really need a thread to do this right.
3108 		 */
3109 		if (IS_FC(isp)) {
3110 			FCPARAM(isp)->isp_fwstate = FW_CONFIG_WAIT;
3111 			FCPARAM(isp)->isp_loopstate = LOOP_NIL;
3112 			isp_freeze_loopdown(isp, "f/w crash");
3113 			isp_fw_dump(isp);
3114 		}
3115 		isp_reinit(isp);
3116 		isp_async(isp, ISPASYNC_FW_RESTARTED, NULL);
3117 #endif
3118 		break;
3119 	}
3120 	case ISPASYNC_UNHANDLED_RESPONSE:
3121 		break;
3122 	default:
3123 		isp_prt(isp, ISP_LOGERR, "unknown isp_async event %d", cmd);
3124 		break;
3125 	}
3126 	return (rv);
3127 }
3128 
3129 
3130 /*
3131  * Locks are held before coming here.
3132  */
3133 void
3134 isp_uninit(ispsoftc_t *isp)
3135 {
3136 	if (IS_24XX(isp)) {
3137 		ISP_WRITE(isp, BIU2400_HCCR, HCCR_2400_CMD_RESET);
3138 	} else {
3139 		ISP_WRITE(isp, HCCR, HCCR_CMD_RESET);
3140 	}
3141 	ISP_DISABLE_INTS(isp);
3142 }
3143 
3144 void
3145 isp_prt(ispsoftc_t *isp, int level, const char *fmt, ...)
3146 {
3147 	va_list ap;
3148 	if (level != ISP_LOGALL && (level & isp->isp_dblev) == 0) {
3149 		return;
3150 	}
3151 	printf("%s: ", device_get_nameunit(isp->isp_dev));
3152 	va_start(ap, fmt);
3153 	vprintf(fmt, ap);
3154 	va_end(ap);
3155 	printf("\n");
3156 }
3157