xref: /freebsd/sys/dev/isp/isp_pci.c (revision 095dae9d7a615448609268e249bc2d9c380dd200)
1 /* $FreeBSD$ */
2 /*
3  * PCI specific probe and attach routines for Qlogic ISP SCSI adapters.
4  * FreeBSD Version.
5  *
6  * Copyright (c) 1997, 1998, 1999, 2000, 2001 by Matthew Jacob
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice immediately at the beginning of the file, without modification,
13  *    this list of conditions, and the following disclaimer.
14  * 2. The name of the author may not be used to endorse or promote products
15  *    derived from this software without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
21  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 
30 #include <sys/param.h>
31 #include <sys/systm.h>
32 #include <sys/kernel.h>
33 #include <sys/module.h>
34 #include <sys/bus.h>
35 
36 #include <pci/pcireg.h>
37 #include <pci/pcivar.h>
38 
39 #include <machine/bus_memio.h>
40 #include <machine/bus_pio.h>
41 #include <machine/bus.h>
42 #include <machine/resource.h>
43 #include <sys/rman.h>
44 #include <sys/malloc.h>
45 
46 #include <dev/isp/isp_freebsd.h>
47 
48 static u_int16_t isp_pci_rd_reg(struct ispsoftc *, int);
49 static void isp_pci_wr_reg(struct ispsoftc *, int, u_int16_t);
50 static u_int16_t isp_pci_rd_reg_1080(struct ispsoftc *, int);
51 static void isp_pci_wr_reg_1080(struct ispsoftc *, int, u_int16_t);
52 static int
53 isp_pci_rd_isr(struct ispsoftc *, u_int16_t *, u_int16_t *, u_int16_t *);
54 static int
55 isp_pci_rd_isr_2300(struct ispsoftc *, u_int16_t *, u_int16_t *, u_int16_t *);
56 static int isp_pci_mbxdma(struct ispsoftc *);
57 static int
58 isp_pci_dmasetup(struct ispsoftc *, XS_T *, ispreq_t *, u_int16_t *, u_int16_t);
59 static void
60 isp_pci_dmateardown(struct ispsoftc *, XS_T *, u_int16_t);
61 
62 static void isp_pci_reset1(struct ispsoftc *);
63 static void isp_pci_dumpregs(struct ispsoftc *, const char *);
64 
65 #ifndef	ISP_CODE_ORG
66 #define	ISP_CODE_ORG		0x1000
67 #endif
68 
69 static struct ispmdvec mdvec = {
70 	isp_pci_rd_isr,
71 	isp_pci_rd_reg,
72 	isp_pci_wr_reg,
73 	isp_pci_mbxdma,
74 	isp_pci_dmasetup,
75 	isp_pci_dmateardown,
76 	NULL,
77 	isp_pci_reset1,
78 	isp_pci_dumpregs,
79 	NULL,
80 	BIU_BURST_ENABLE|BIU_PCI_CONF1_FIFO_64
81 };
82 
83 static struct ispmdvec mdvec_1080 = {
84 	isp_pci_rd_isr,
85 	isp_pci_rd_reg_1080,
86 	isp_pci_wr_reg_1080,
87 	isp_pci_mbxdma,
88 	isp_pci_dmasetup,
89 	isp_pci_dmateardown,
90 	NULL,
91 	isp_pci_reset1,
92 	isp_pci_dumpregs,
93 	NULL,
94 	BIU_BURST_ENABLE|BIU_PCI_CONF1_FIFO_64
95 };
96 
97 static struct ispmdvec mdvec_12160 = {
98 	isp_pci_rd_isr,
99 	isp_pci_rd_reg_1080,
100 	isp_pci_wr_reg_1080,
101 	isp_pci_mbxdma,
102 	isp_pci_dmasetup,
103 	isp_pci_dmateardown,
104 	NULL,
105 	isp_pci_reset1,
106 	isp_pci_dumpregs,
107 	NULL,
108 	BIU_BURST_ENABLE|BIU_PCI_CONF1_FIFO_64
109 };
110 
111 static struct ispmdvec mdvec_2100 = {
112 	isp_pci_rd_isr,
113 	isp_pci_rd_reg,
114 	isp_pci_wr_reg,
115 	isp_pci_mbxdma,
116 	isp_pci_dmasetup,
117 	isp_pci_dmateardown,
118 	NULL,
119 	isp_pci_reset1,
120 	isp_pci_dumpregs
121 };
122 
123 static struct ispmdvec mdvec_2200 = {
124 	isp_pci_rd_isr,
125 	isp_pci_rd_reg,
126 	isp_pci_wr_reg,
127 	isp_pci_mbxdma,
128 	isp_pci_dmasetup,
129 	isp_pci_dmateardown,
130 	NULL,
131 	isp_pci_reset1,
132 	isp_pci_dumpregs
133 };
134 
135 static struct ispmdvec mdvec_2300 = {
136 	isp_pci_rd_isr_2300,
137 	isp_pci_rd_reg,
138 	isp_pci_wr_reg,
139 	isp_pci_mbxdma,
140 	isp_pci_dmasetup,
141 	isp_pci_dmateardown,
142 	NULL,
143 	isp_pci_reset1,
144 	isp_pci_dumpregs
145 };
146 
147 #ifndef	PCIM_CMD_INVEN
148 #define	PCIM_CMD_INVEN			0x10
149 #endif
150 #ifndef	PCIM_CMD_BUSMASTEREN
151 #define	PCIM_CMD_BUSMASTEREN		0x0004
152 #endif
153 #ifndef	PCIM_CMD_PERRESPEN
154 #define	PCIM_CMD_PERRESPEN		0x0040
155 #endif
156 #ifndef	PCIM_CMD_SEREN
157 #define	PCIM_CMD_SEREN			0x0100
158 #endif
159 
160 #ifndef	PCIR_COMMAND
161 #define	PCIR_COMMAND			0x04
162 #endif
163 
164 #ifndef	PCIR_CACHELNSZ
165 #define	PCIR_CACHELNSZ			0x0c
166 #endif
167 
168 #ifndef	PCIR_LATTIMER
169 #define	PCIR_LATTIMER			0x0d
170 #endif
171 
172 #ifndef	PCIR_ROMADDR
173 #define	PCIR_ROMADDR			0x30
174 #endif
175 
176 #ifndef	PCI_VENDOR_QLOGIC
177 #define	PCI_VENDOR_QLOGIC		0x1077
178 #endif
179 
180 #ifndef	PCI_PRODUCT_QLOGIC_ISP1020
181 #define	PCI_PRODUCT_QLOGIC_ISP1020	0x1020
182 #endif
183 
184 #ifndef	PCI_PRODUCT_QLOGIC_ISP1080
185 #define	PCI_PRODUCT_QLOGIC_ISP1080	0x1080
186 #endif
187 
188 #ifndef	PCI_PRODUCT_QLOGIC_ISP12160
189 #define	PCI_PRODUCT_QLOGIC_ISP12160	0x1216
190 #endif
191 
192 #ifndef	PCI_PRODUCT_QLOGIC_ISP1240
193 #define	PCI_PRODUCT_QLOGIC_ISP1240	0x1240
194 #endif
195 
196 #ifndef	PCI_PRODUCT_QLOGIC_ISP1280
197 #define	PCI_PRODUCT_QLOGIC_ISP1280	0x1280
198 #endif
199 
200 #ifndef	PCI_PRODUCT_QLOGIC_ISP2100
201 #define	PCI_PRODUCT_QLOGIC_ISP2100	0x2100
202 #endif
203 
204 #ifndef	PCI_PRODUCT_QLOGIC_ISP2200
205 #define	PCI_PRODUCT_QLOGIC_ISP2200	0x2200
206 #endif
207 
208 #ifndef	PCI_PRODUCT_QLOGIC_ISP2300
209 #define	PCI_PRODUCT_QLOGIC_ISP2300	0x2300
210 #endif
211 
212 #ifndef	PCI_PRODUCT_QLOGIC_ISP2312
213 #define	PCI_PRODUCT_QLOGIC_ISP2312	0x2312
214 #endif
215 
216 #define	PCI_QLOGIC_ISP1020	\
217 	((PCI_PRODUCT_QLOGIC_ISP1020 << 16) | PCI_VENDOR_QLOGIC)
218 
219 #define	PCI_QLOGIC_ISP1080	\
220 	((PCI_PRODUCT_QLOGIC_ISP1080 << 16) | PCI_VENDOR_QLOGIC)
221 
222 #define	PCI_QLOGIC_ISP12160	\
223 	((PCI_PRODUCT_QLOGIC_ISP12160 << 16) | PCI_VENDOR_QLOGIC)
224 
225 #define	PCI_QLOGIC_ISP1240	\
226 	((PCI_PRODUCT_QLOGIC_ISP1240 << 16) | PCI_VENDOR_QLOGIC)
227 
228 #define	PCI_QLOGIC_ISP1280	\
229 	((PCI_PRODUCT_QLOGIC_ISP1280 << 16) | PCI_VENDOR_QLOGIC)
230 
231 #define	PCI_QLOGIC_ISP2100	\
232 	((PCI_PRODUCT_QLOGIC_ISP2100 << 16) | PCI_VENDOR_QLOGIC)
233 
234 #define	PCI_QLOGIC_ISP2200	\
235 	((PCI_PRODUCT_QLOGIC_ISP2200 << 16) | PCI_VENDOR_QLOGIC)
236 
237 #define	PCI_QLOGIC_ISP2300	\
238 	((PCI_PRODUCT_QLOGIC_ISP2300 << 16) | PCI_VENDOR_QLOGIC)
239 
240 #define	PCI_QLOGIC_ISP2312	\
241 	((PCI_PRODUCT_QLOGIC_ISP2312 << 16) | PCI_VENDOR_QLOGIC)
242 
243 /*
244  * Odd case for some AMI raid cards... We need to *not* attach to this.
245  */
246 #define	AMI_RAID_SUBVENDOR_ID	0x101e
247 
248 #define	IO_MAP_REG	0x10
249 #define	MEM_MAP_REG	0x14
250 
251 #define	PCI_DFLT_LTNCY	0x40
252 #define	PCI_DFLT_LNSZ	0x10
253 
254 static int isp_pci_probe (device_t);
255 static int isp_pci_attach (device_t);
256 
257 struct isp_pcisoftc {
258 	struct ispsoftc			pci_isp;
259 	device_t			pci_dev;
260 	struct resource *		pci_reg;
261 	bus_space_tag_t			pci_st;
262 	bus_space_handle_t		pci_sh;
263 	void *				ih;
264 	int16_t				pci_poff[_NREG_BLKS];
265 	bus_dma_tag_t			parent_dmat;
266 	bus_dma_tag_t			cntrol_dmat;
267 	bus_dmamap_t			cntrol_dmap;
268 	bus_dmamap_t			*dmaps;
269 };
270 ispfwfunc *isp_get_firmware_p = NULL;
271 
272 static device_method_t isp_pci_methods[] = {
273 	/* Device interface */
274 	DEVMETHOD(device_probe,		isp_pci_probe),
275 	DEVMETHOD(device_attach,	isp_pci_attach),
276 	{ 0, 0 }
277 };
278 static void isp_pci_intr(void *);
279 
280 static driver_t isp_pci_driver = {
281 	"isp", isp_pci_methods, sizeof (struct isp_pcisoftc)
282 };
283 static devclass_t isp_devclass;
284 DRIVER_MODULE(isp, pci, isp_pci_driver, isp_devclass, 0, 0);
285 MODULE_VERSION(isp, 1);
286 
287 static int
288 isp_pci_probe(device_t dev)
289 {
290         switch ((pci_get_device(dev) << 16) | (pci_get_vendor(dev))) {
291 	case PCI_QLOGIC_ISP1020:
292 		device_set_desc(dev, "Qlogic ISP 1020/1040 PCI SCSI Adapter");
293 		break;
294 	case PCI_QLOGIC_ISP1080:
295 		device_set_desc(dev, "Qlogic ISP 1080 PCI SCSI Adapter");
296 		break;
297 	case PCI_QLOGIC_ISP1240:
298 		device_set_desc(dev, "Qlogic ISP 1240 PCI SCSI Adapter");
299 		break;
300 	case PCI_QLOGIC_ISP1280:
301 		device_set_desc(dev, "Qlogic ISP 1280 PCI SCSI Adapter");
302 		break;
303 	case PCI_QLOGIC_ISP12160:
304 		if (pci_get_subvendor(dev) == AMI_RAID_SUBVENDOR_ID) {
305 			return (ENXIO);
306 		}
307 		device_set_desc(dev, "Qlogic ISP 12160 PCI SCSI Adapter");
308 		break;
309 	case PCI_QLOGIC_ISP2100:
310 		device_set_desc(dev, "Qlogic ISP 2100 PCI FC-AL Adapter");
311 		break;
312 	case PCI_QLOGIC_ISP2200:
313 		device_set_desc(dev, "Qlogic ISP 2200 PCI FC-AL Adapter");
314 		break;
315 	case PCI_QLOGIC_ISP2300:
316 		device_set_desc(dev, "Qlogic ISP 2300 PCI FC-AL Adapter");
317 		break;
318 	case PCI_QLOGIC_ISP2312:
319 		device_set_desc(dev, "Qlogic ISP 2312 PCI FC-AL Adapter");
320 		break;
321 	default:
322 		return (ENXIO);
323 	}
324 	if (device_get_unit(dev) == 0 && bootverbose) {
325 		printf("Qlogic ISP Driver, FreeBSD Version %d.%d, "
326 		    "Core Version %d.%d\n",
327 		    ISP_PLATFORM_VERSION_MAJOR, ISP_PLATFORM_VERSION_MINOR,
328 		    ISP_CORE_VERSION_MAJOR, ISP_CORE_VERSION_MINOR);
329 	}
330 	/*
331 	 * XXXX: Here is where we might load the f/w module
332 	 * XXXX: (or increase a reference count to it).
333 	 */
334 	return (0);
335 }
336 
337 static int
338 isp_pci_attach(device_t dev)
339 {
340 	struct resource *regs, *irq;
341 	int tval, rtp, rgd, iqd, m1, m2, isp_debug, role;
342 	u_int32_t data, cmd, linesz, psize, basetype;
343 	struct isp_pcisoftc *pcs;
344 	struct ispsoftc *isp = NULL;
345 	struct ispmdvec *mdvp;
346 	bus_size_t lim;
347 	const char *sptr;
348 	int locksetup = 0;
349 
350 	/*
351 	 * Figure out if we're supposed to skip this one.
352 	 * If we are, we actually go to ISP_ROLE_NONE.
353 	 */
354 
355 	tval = 0;
356 	if (resource_int_value(device_get_name(dev), device_get_unit(dev),
357 	    "disable", &tval) == 0 && tval) {
358 		device_printf(dev, "device is disabled\n");
359 		/* but return 0 so the !$)$)*!$*) unit isn't reused */
360 		return (0);
361 	}
362 
363 	role = 0;
364 	if (resource_int_value(device_get_name(dev), device_get_unit(dev),
365 	    "role", &role) == 0 &&
366 	    ((role & ~(ISP_ROLE_INITIATOR|ISP_ROLE_TARGET)) == 0)) {
367 		device_printf(dev, "setting role to 0x%x\n", role);
368 	} else {
369 #ifdef	ISP_TARGET_MODE
370 		role = ISP_ROLE_INITIATOR|ISP_ROLE_TARGET;
371 #else
372 		role = ISP_DEFAULT_ROLES;
373 #endif
374 	}
375 
376 	pcs = malloc(sizeof (struct isp_pcisoftc), M_DEVBUF, M_NOWAIT | M_ZERO);
377 	if (pcs == NULL) {
378 		device_printf(dev, "cannot allocate softc\n");
379 		return (ENOMEM);
380 	}
381 
382 	/*
383 	 * Figure out which we should try first - memory mapping or i/o mapping?
384 	 */
385 #ifdef	__alpha__
386 	m1 = PCIM_CMD_MEMEN;
387 	m2 = PCIM_CMD_PORTEN;
388 #else
389 	m1 = PCIM_CMD_PORTEN;
390 	m2 = PCIM_CMD_MEMEN;
391 #endif
392 
393 	tval = 0;
394         if (resource_int_value(device_get_name(dev), device_get_unit(dev),
395             "prefer_iomap", &tval) == 0 && tval != 0) {
396 		m1 = PCIM_CMD_PORTEN;
397 		m2 = PCIM_CMD_MEMEN;
398 	}
399 	tval = 0;
400         if (resource_int_value(device_get_name(dev), device_get_unit(dev),
401             "prefer_memmap", &tval) == 0 && tval != 0) {
402 		m1 = PCIM_CMD_MEMEN;
403 		m2 = PCIM_CMD_PORTEN;
404 	}
405 
406 	linesz = PCI_DFLT_LNSZ;
407 	irq = regs = NULL;
408 	rgd = rtp = iqd = 0;
409 
410 	cmd = pci_read_config(dev, PCIR_COMMAND, 1);
411 	if (cmd & m1) {
412 		rtp = (m1 == PCIM_CMD_MEMEN)? SYS_RES_MEMORY : SYS_RES_IOPORT;
413 		rgd = (m1 == PCIM_CMD_MEMEN)? MEM_MAP_REG : IO_MAP_REG;
414 		regs = bus_alloc_resource(dev, rtp, &rgd, 0, ~0, 1, RF_ACTIVE);
415 	}
416 	if (regs == NULL && (cmd & m2)) {
417 		rtp = (m2 == PCIM_CMD_MEMEN)? SYS_RES_MEMORY : SYS_RES_IOPORT;
418 		rgd = (m2 == PCIM_CMD_MEMEN)? MEM_MAP_REG : IO_MAP_REG;
419 		regs = bus_alloc_resource(dev, rtp, &rgd, 0, ~0, 1, RF_ACTIVE);
420 	}
421 	if (regs == NULL) {
422 		device_printf(dev, "unable to map any ports\n");
423 		goto bad;
424 	}
425 	if (bootverbose)
426 		device_printf(dev, "using %s space register mapping\n",
427 		    (rgd == IO_MAP_REG)? "I/O" : "Memory");
428 	pcs->pci_dev = dev;
429 	pcs->pci_reg = regs;
430 	pcs->pci_st = rman_get_bustag(regs);
431 	pcs->pci_sh = rman_get_bushandle(regs);
432 
433 	pcs->pci_poff[BIU_BLOCK >> _BLK_REG_SHFT] = BIU_REGS_OFF;
434 	pcs->pci_poff[MBOX_BLOCK >> _BLK_REG_SHFT] = PCI_MBOX_REGS_OFF;
435 	pcs->pci_poff[SXP_BLOCK >> _BLK_REG_SHFT] = PCI_SXP_REGS_OFF;
436 	pcs->pci_poff[RISC_BLOCK >> _BLK_REG_SHFT] = PCI_RISC_REGS_OFF;
437 	pcs->pci_poff[DMA_BLOCK >> _BLK_REG_SHFT] = DMA_REGS_OFF;
438 	mdvp = &mdvec;
439 	basetype = ISP_HA_SCSI_UNKNOWN;
440 	psize = sizeof (sdparam);
441 	lim = BUS_SPACE_MAXSIZE_32BIT;
442 	if (pci_get_devid(dev) == PCI_QLOGIC_ISP1020) {
443 		mdvp = &mdvec;
444 		basetype = ISP_HA_SCSI_UNKNOWN;
445 		psize = sizeof (sdparam);
446 		lim = BUS_SPACE_MAXSIZE_24BIT;
447 	}
448 	if (pci_get_devid(dev) == PCI_QLOGIC_ISP1080) {
449 		mdvp = &mdvec_1080;
450 		basetype = ISP_HA_SCSI_1080;
451 		psize = sizeof (sdparam);
452 		pcs->pci_poff[DMA_BLOCK >> _BLK_REG_SHFT] =
453 		    ISP1080_DMA_REGS_OFF;
454 	}
455 	if (pci_get_devid(dev) == PCI_QLOGIC_ISP1240) {
456 		mdvp = &mdvec_1080;
457 		basetype = ISP_HA_SCSI_1240;
458 		psize = 2 * sizeof (sdparam);
459 		pcs->pci_poff[DMA_BLOCK >> _BLK_REG_SHFT] =
460 		    ISP1080_DMA_REGS_OFF;
461 	}
462 	if (pci_get_devid(dev) == PCI_QLOGIC_ISP1280) {
463 		mdvp = &mdvec_1080;
464 		basetype = ISP_HA_SCSI_1280;
465 		psize = 2 * sizeof (sdparam);
466 		pcs->pci_poff[DMA_BLOCK >> _BLK_REG_SHFT] =
467 		    ISP1080_DMA_REGS_OFF;
468 	}
469 	if (pci_get_devid(dev) == PCI_QLOGIC_ISP12160) {
470 		mdvp = &mdvec_12160;
471 		basetype = ISP_HA_SCSI_12160;
472 		psize = 2 * sizeof (sdparam);
473 		pcs->pci_poff[DMA_BLOCK >> _BLK_REG_SHFT] =
474 		    ISP1080_DMA_REGS_OFF;
475 	}
476 	if (pci_get_devid(dev) == PCI_QLOGIC_ISP2100) {
477 		mdvp = &mdvec_2100;
478 		basetype = ISP_HA_FC_2100;
479 		psize = sizeof (fcparam);
480 		pcs->pci_poff[MBOX_BLOCK >> _BLK_REG_SHFT] =
481 		    PCI_MBOX_REGS2100_OFF;
482 		if (pci_get_revid(dev) < 3) {
483 			/*
484 			 * XXX: Need to get the actual revision
485 			 * XXX: number of the 2100 FB. At any rate,
486 			 * XXX: lower cache line size for early revision
487 			 * XXX; boards.
488 			 */
489 			linesz = 1;
490 		}
491 	}
492 	if (pci_get_devid(dev) == PCI_QLOGIC_ISP2200) {
493 		mdvp = &mdvec_2200;
494 		basetype = ISP_HA_FC_2200;
495 		psize = sizeof (fcparam);
496 		pcs->pci_poff[MBOX_BLOCK >> _BLK_REG_SHFT] =
497 		    PCI_MBOX_REGS2100_OFF;
498 	}
499 	if (pci_get_devid(dev) == PCI_QLOGIC_ISP2300) {
500 		mdvp = &mdvec_2300;
501 		basetype = ISP_HA_FC_2300;
502 		psize = sizeof (fcparam);
503 		pcs->pci_poff[MBOX_BLOCK >> _BLK_REG_SHFT] =
504 		    PCI_MBOX_REGS2300_OFF;
505 	}
506 	if (pci_get_devid(dev) == PCI_QLOGIC_ISP2312) {
507 		mdvp = &mdvec_2300;
508 		basetype = ISP_HA_FC_2312;
509 		psize = sizeof (fcparam);
510 		pcs->pci_poff[MBOX_BLOCK >> _BLK_REG_SHFT] =
511 		    PCI_MBOX_REGS2300_OFF;
512 	}
513 	isp = &pcs->pci_isp;
514 	isp->isp_param = malloc(psize, M_DEVBUF, M_NOWAIT | M_ZERO);
515 	if (isp->isp_param == NULL) {
516 		device_printf(dev, "cannot allocate parameter data\n");
517 		goto bad;
518 	}
519 	isp->isp_mdvec = mdvp;
520 	isp->isp_type = basetype;
521 	isp->isp_revision = pci_get_revid(dev);
522 	isp->isp_role = role;
523 	isp->isp_dev = dev;
524 
525 	/*
526 	 * Try and find firmware for this device.
527 	 */
528 
529 	if (isp_get_firmware_p) {
530 		int device = (int) pci_get_device(dev);
531 #ifdef	ISP_TARGET_MODE
532 		(*isp_get_firmware_p)(0, 1, device, &mdvp->dv_ispfw);
533 #else
534 		(*isp_get_firmware_p)(0, 0, device, &mdvp->dv_ispfw);
535 #endif
536 	}
537 
538 	/*
539 	 * Make sure that SERR, PERR, WRITE INVALIDATE and BUSMASTER
540 	 * are set.
541 	 */
542 	cmd |= PCIM_CMD_SEREN | PCIM_CMD_PERRESPEN |
543 		PCIM_CMD_BUSMASTEREN | PCIM_CMD_INVEN;
544 	if (IS_2300(isp)) {	/* per QLogic errata */
545 		cmd &= ~PCIM_CMD_INVEN;
546 	}
547 	pci_write_config(dev, PCIR_COMMAND, cmd, 1);
548 
549 	/*
550 	 * Make sure the Cache Line Size register is set sensibly.
551 	 */
552 	data = pci_read_config(dev, PCIR_CACHELNSZ, 1);
553 	if (data != linesz) {
554 		data = PCI_DFLT_LNSZ;
555 		isp_prt(isp, ISP_LOGCONFIG, "set PCI line size to %d", data);
556 		pci_write_config(dev, PCIR_CACHELNSZ, data, 1);
557 	}
558 
559 	/*
560 	 * Make sure the Latency Timer is sane.
561 	 */
562 	data = pci_read_config(dev, PCIR_LATTIMER, 1);
563 	if (data < PCI_DFLT_LTNCY) {
564 		data = PCI_DFLT_LTNCY;
565 		isp_prt(isp, ISP_LOGCONFIG, "set PCI latency to %d", data);
566 		pci_write_config(dev, PCIR_LATTIMER, data, 1);
567 	}
568 
569 	/*
570 	 * Make sure we've disabled the ROM.
571 	 */
572 	data = pci_read_config(dev, PCIR_ROMADDR, 4);
573 	data &= ~1;
574 	pci_write_config(dev, PCIR_ROMADDR, data, 4);
575 
576 
577 	if (bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
578 	    BUS_SPACE_MAXADDR, NULL, NULL, lim + 1,
579 	    255, lim, 0, &pcs->parent_dmat) != 0) {
580 		device_printf(dev, "could not create master dma tag\n");
581 		free(isp->isp_param, M_DEVBUF);
582 		free(pcs, M_DEVBUF);
583 		return (ENXIO);
584 	}
585 
586 	iqd = 0;
587 	irq = bus_alloc_resource(dev, SYS_RES_IRQ, &iqd, 0, ~0,
588 	    1, RF_ACTIVE | RF_SHAREABLE);
589 	if (irq == NULL) {
590 		device_printf(dev, "could not allocate interrupt\n");
591 		goto bad;
592 	}
593 
594 	tval = 0;
595         if (resource_int_value(device_get_name(dev), device_get_unit(dev),
596             "fwload_disable", &tval) == 0 && tval != 0) {
597 		isp->isp_confopts |= ISP_CFG_NORELOAD;
598 	}
599 	tval = 0;
600         if (resource_int_value(device_get_name(dev), device_get_unit(dev),
601             "ignore_nvram", &tval) == 0 && tval != 0) {
602 		isp->isp_confopts |= ISP_CFG_NONVRAM;
603 	}
604 	tval = 0;
605         if (resource_int_value(device_get_name(dev), device_get_unit(dev),
606             "fullduplex", &tval) == 0 && tval != 0) {
607 		isp->isp_confopts |= ISP_CFG_FULL_DUPLEX;
608 	}
609 
610 	sptr = 0;
611         if (resource_string_value(device_get_name(dev), device_get_unit(dev),
612             "topology", (const char **) &sptr) == 0 && sptr != 0) {
613 		if (strcmp(sptr, "lport") == 0) {
614 			isp->isp_confopts |= ISP_CFG_LPORT;
615 		} else if (strcmp(sptr, "nport") == 0) {
616 			isp->isp_confopts |= ISP_CFG_NPORT;
617 		} else if (strcmp(sptr, "lport-only") == 0) {
618 			isp->isp_confopts |= ISP_CFG_LPORT_ONLY;
619 		} else if (strcmp(sptr, "nport-only") == 0) {
620 			isp->isp_confopts |= ISP_CFG_NPORT_ONLY;
621 		}
622 	}
623 
624 	/*
625 	 * Because the resource_*_value functions can neither return
626 	 * 64 bit integer values, nor can they be directly coerced
627 	 * to interpret the right hand side of the assignment as
628 	 * you want them to interpret it, we have to force WWN
629 	 * hint replacement to specify WWN strings with a leading
630 	 * 'w' (e..g w50000000aaaa0001). Sigh.
631 	 */
632 	sptr = 0;
633 	tval = resource_string_value(device_get_name(dev), device_get_unit(dev),
634             "portwwn", (const char **) &sptr);
635 	if (tval == 0 && sptr != 0 && *sptr++ == 'w') {
636 		char *eptr = 0;
637 		isp->isp_osinfo.default_port_wwn = strtouq(sptr, &eptr, 16);
638 		if (eptr < sptr + 16 || isp->isp_osinfo.default_port_wwn == 0) {
639 			device_printf(dev, "mangled portwwn hint '%s'\n", sptr);
640 			isp->isp_osinfo.default_port_wwn = 0;
641 		} else {
642 			isp->isp_confopts |= ISP_CFG_OWNWWPN;
643 		}
644 	}
645 	if (isp->isp_osinfo.default_port_wwn == 0) {
646 		isp->isp_osinfo.default_port_wwn = 0x400000007F000009ull;
647 	}
648 
649 	sptr = 0;
650 	tval = resource_string_value(device_get_name(dev), device_get_unit(dev),
651             "nodewwn", (const char **) &sptr);
652 	if (tval == 0 && sptr != 0 && *sptr++ == 'w') {
653 		char *eptr = 0;
654 		isp->isp_osinfo.default_node_wwn = strtouq(sptr, &eptr, 16);
655 		if (eptr < sptr + 16 || isp->isp_osinfo.default_node_wwn == 0) {
656 			device_printf(dev, "mangled nodewwn hint '%s'\n", sptr);
657 			isp->isp_osinfo.default_node_wwn = 0;
658 		} else {
659 			isp->isp_confopts |= ISP_CFG_OWNWWNN;
660 		}
661 	}
662 	if (isp->isp_osinfo.default_node_wwn == 0) {
663 		isp->isp_osinfo.default_node_wwn = 0x400000007F000009ull;
664 	}
665 
666 	isp_debug = 0;
667         (void) resource_int_value(device_get_name(dev), device_get_unit(dev),
668             "debug", &isp_debug);
669 
670 	/* Make sure the lock is set up. */
671 	mtx_init(&isp->isp_osinfo.lock, "isp", MTX_DEF);
672 	locksetup++;
673 
674 #ifdef	ISP_SMPLOCK
675 #define	INTR_FLAGS	INTR_TYPE_CAM | INTR_MPSAFE | INTR_ENTROPY
676 #else
677 #define	INTR_FLAGS	INTR_TYPE_CAM | INTR_ENTROPY
678 #endif
679 	if (bus_setup_intr(dev, irq, INTR_FLAGS, isp_pci_intr, isp, &pcs->ih)) {
680 		device_printf(dev, "could not setup interrupt\n");
681 		goto bad;
682 	}
683 
684 	/*
685 	 * Set up logging levels.
686 	 */
687 	if (isp_debug) {
688 		isp->isp_dblev = isp_debug;
689 	} else {
690 		isp->isp_dblev = ISP_LOGWARN|ISP_LOGERR;
691 	}
692 	if (bootverbose)
693 		isp->isp_dblev |= ISP_LOGCONFIG|ISP_LOGINFO;
694 
695 	/*
696 	 * Last minute checks...
697 	 */
698 	if (IS_2312(isp)) {
699 		isp->isp_port = pci_get_function(dev);
700 	}
701 
702 	/*
703 	 * Make sure we're in reset state.
704 	 */
705 	ISP_LOCK(isp);
706 	isp_reset(isp);
707 	if (isp->isp_state != ISP_RESETSTATE) {
708 		ISP_UNLOCK(isp);
709 		goto bad;
710 	}
711 	isp_init(isp);
712 	if (isp->isp_role != ISP_ROLE_NONE && isp->isp_state != ISP_INITSTATE) {
713 		isp_uninit(isp);
714 		ISP_UNLOCK(isp);
715 		goto bad;
716 	}
717 	isp_attach(isp);
718 	if (isp->isp_role != ISP_ROLE_NONE && isp->isp_state != ISP_RUNSTATE) {
719 		isp_uninit(isp);
720 		ISP_UNLOCK(isp);
721 		goto bad;
722 	}
723 	/*
724 	 * XXXX: Here is where we might unload the f/w module
725 	 * XXXX: (or decrease the reference count to it).
726 	 */
727 	ISP_UNLOCK(isp);
728 	return (0);
729 
730 bad:
731 
732 	if (pcs && pcs->ih) {
733 		(void) bus_teardown_intr(dev, irq, pcs->ih);
734 	}
735 
736 	if (locksetup && isp) {
737 		mtx_destroy(&isp->isp_osinfo.lock);
738 	}
739 
740 	if (irq) {
741 		(void) bus_release_resource(dev, SYS_RES_IRQ, iqd, irq);
742 	}
743 
744 
745 	if (regs) {
746 		(void) bus_release_resource(dev, rtp, rgd, regs);
747 	}
748 
749 	if (pcs) {
750 		if (pcs->pci_isp.isp_param)
751 			free(pcs->pci_isp.isp_param, M_DEVBUF);
752 		free(pcs, M_DEVBUF);
753 	}
754 
755 	/*
756 	 * XXXX: Here is where we might unload the f/w module
757 	 * XXXX: (or decrease the reference count to it).
758 	 */
759 	return (ENXIO);
760 }
761 
762 static void
763 isp_pci_intr(void *arg)
764 {
765 	struct ispsoftc *isp = arg;
766 	u_int16_t isr, sema, mbox;
767 
768 	ISP_LOCK(isp);
769 	isp->isp_intcnt++;
770 	if (ISP_READ_ISR(isp, &isr, &sema, &mbox) == 0) {
771 		isp->isp_intbogus++;
772 	} else {
773 		int iok = isp->isp_osinfo.intsok;
774 		isp->isp_osinfo.intsok = 0;
775 		isp_intr(isp, isr, sema, mbox);
776 		isp->isp_osinfo.intsok = iok;
777 	}
778 	ISP_UNLOCK(isp);
779 }
780 
781 
782 #define	IspVirt2Off(a, x)	\
783 	(((struct isp_pcisoftc *)a)->pci_poff[((x) & _BLK_REG_MASK) >> \
784 	_BLK_REG_SHFT] + ((x) & 0xff))
785 
786 #define	BXR2(pcs, off)		\
787 	bus_space_read_2(pcs->pci_st, pcs->pci_sh, off)
788 #define	BXW2(pcs, off, v)	\
789 	bus_space_write_2(pcs->pci_st, pcs->pci_sh, off, v)
790 
791 
792 static INLINE int
793 isp_pci_rd_debounced(struct ispsoftc *isp, int off, u_int16_t *rp)
794 {
795 	struct isp_pcisoftc *pcs = (struct isp_pcisoftc *) isp;
796 	u_int16_t val0, val1;
797 	int i = 0;
798 
799 	do {
800 		val0 = BXR2(pcs, IspVirt2Off(isp, off));
801 		val1 = BXR2(pcs, IspVirt2Off(isp, off));
802 	} while (val0 != val1 && ++i < 1000);
803 	if (val0 != val1) {
804 		return (1);
805 	}
806 	*rp = val0;
807 	return (0);
808 }
809 
810 static int
811 isp_pci_rd_isr(struct ispsoftc *isp, u_int16_t *isrp,
812     u_int16_t *semap, u_int16_t *mbp)
813 {
814 	struct isp_pcisoftc *pcs = (struct isp_pcisoftc *) isp;
815 	u_int16_t isr, sema;
816 
817 	if (IS_2100(isp)) {
818 		if (isp_pci_rd_debounced(isp, BIU_ISR, &isr)) {
819 		    return (0);
820 		}
821 		if (isp_pci_rd_debounced(isp, BIU_SEMA, &sema)) {
822 		    return (0);
823 		}
824 	} else {
825 		isr = BXR2(pcs, IspVirt2Off(isp, BIU_ISR));
826 		sema = BXR2(pcs, IspVirt2Off(isp, BIU_SEMA));
827 	}
828 	isp_prt(isp, ISP_LOGDEBUG3, "ISR 0x%x SEMA 0x%x", isr, sema);
829 	isr &= INT_PENDING_MASK(isp);
830 	sema &= BIU_SEMA_LOCK;
831 	if (isr == 0 && sema == 0) {
832 		return (0);
833 	}
834 	*isrp = isr;
835 	if ((*semap = sema) != 0) {
836 		if (IS_2100(isp)) {
837 			if (isp_pci_rd_debounced(isp, OUTMAILBOX0, mbp)) {
838 				return (0);
839 			}
840 		} else {
841 			*mbp = BXR2(pcs, IspVirt2Off(isp, OUTMAILBOX0));
842 		}
843 	}
844 	return (1);
845 }
846 
847 static int
848 isp_pci_rd_isr_2300(struct ispsoftc *isp, u_int16_t *isrp,
849     u_int16_t *semap, u_int16_t *mbox0p)
850 {
851 	struct isp_pcisoftc *pcs = (struct isp_pcisoftc *) isp;
852 	u_int32_t r2hisr;
853 
854 	if (!(BXR2(pcs, IspVirt2Off(isp, BIU_ISR) & BIU2100_ISR_RISC_INT))) {
855 		*isrp = 0;
856 		return (0);
857 	}
858 	r2hisr = bus_space_read_4(pcs->pci_st, pcs->pci_sh,
859 	    IspVirt2Off(pcs, BIU_R2HSTSLO));
860 	isp_prt(isp, ISP_LOGDEBUG3, "RISC2HOST ISR 0x%x", r2hisr);
861 	if ((r2hisr & BIU_R2HST_INTR) == 0) {
862 		*isrp = 0;
863 		return (0);
864 	}
865 	switch (r2hisr & BIU_R2HST_ISTAT_MASK) {
866 	case ISPR2HST_ROM_MBX_OK:
867 	case ISPR2HST_ROM_MBX_FAIL:
868 	case ISPR2HST_MBX_OK:
869 	case ISPR2HST_MBX_FAIL:
870 	case ISPR2HST_ASYNC_EVENT:
871 	case ISPR2HST_RIO_16:
872 	case ISPR2HST_FPOST:
873 	case ISPR2HST_FPOST_CTIO:
874 		*isrp = r2hisr & 0xffff;
875 		*mbox0p = (r2hisr >> 16);
876 		*semap = 1;
877 		return (1);
878 	case ISPR2HST_RSPQ_UPDATE:
879 		*isrp = r2hisr & 0xffff;
880 		*mbox0p = 0;
881 		*semap = 0;
882 		return (1);
883 	default:
884 		return (0);
885 	}
886 }
887 
888 static u_int16_t
889 isp_pci_rd_reg(struct ispsoftc *isp, int regoff)
890 {
891 	u_int16_t rv;
892 	struct isp_pcisoftc *pcs = (struct isp_pcisoftc *) isp;
893 	int oldconf = 0;
894 
895 	if ((regoff & _BLK_REG_MASK) == SXP_BLOCK) {
896 		/*
897 		 * We will assume that someone has paused the RISC processor.
898 		 */
899 		oldconf = BXR2(pcs, IspVirt2Off(isp, BIU_CONF1));
900 		BXW2(pcs, IspVirt2Off(isp, BIU_CONF1),
901 		    oldconf | BIU_PCI_CONF1_SXP);
902 	}
903 	rv = BXR2(pcs, IspVirt2Off(isp, regoff));
904 	if ((regoff & _BLK_REG_MASK) == SXP_BLOCK) {
905 		BXW2(pcs, IspVirt2Off(isp, BIU_CONF1), oldconf);
906 	}
907 	return (rv);
908 }
909 
910 static void
911 isp_pci_wr_reg(struct ispsoftc *isp, int regoff, u_int16_t val)
912 {
913 	struct isp_pcisoftc *pcs = (struct isp_pcisoftc *) isp;
914 	int oldconf = 0;
915 
916 	if ((regoff & _BLK_REG_MASK) == SXP_BLOCK) {
917 		/*
918 		 * We will assume that someone has paused the RISC processor.
919 		 */
920 		oldconf = BXR2(pcs, IspVirt2Off(isp, BIU_CONF1));
921 		BXW2(pcs, IspVirt2Off(isp, BIU_CONF1),
922 		    oldconf | BIU_PCI_CONF1_SXP);
923 	}
924 	BXW2(pcs, IspVirt2Off(isp, regoff), val);
925 	if ((regoff & _BLK_REG_MASK) == SXP_BLOCK) {
926 		BXW2(pcs, IspVirt2Off(isp, BIU_CONF1), oldconf);
927 	}
928 }
929 
930 static u_int16_t
931 isp_pci_rd_reg_1080(struct ispsoftc *isp, int regoff)
932 {
933 	u_int16_t rv, oc = 0;
934 	struct isp_pcisoftc *pcs = (struct isp_pcisoftc *) isp;
935 
936 	if ((regoff & _BLK_REG_MASK) == SXP_BLOCK ||
937 	    (regoff & _BLK_REG_MASK) == (SXP_BLOCK|SXP_BANK1_SELECT)) {
938 		u_int16_t tc;
939 		/*
940 		 * We will assume that someone has paused the RISC processor.
941 		 */
942 		oc = BXR2(pcs, IspVirt2Off(isp, BIU_CONF1));
943 		tc = oc & ~BIU_PCI1080_CONF1_DMA;
944 		if (regoff & SXP_BANK1_SELECT)
945 			tc |= BIU_PCI1080_CONF1_SXP1;
946 		else
947 			tc |= BIU_PCI1080_CONF1_SXP0;
948 		BXW2(pcs, IspVirt2Off(isp, BIU_CONF1), tc);
949 	} else if ((regoff & _BLK_REG_MASK) == DMA_BLOCK) {
950 		oc = BXR2(pcs, IspVirt2Off(isp, BIU_CONF1));
951 		BXW2(pcs, IspVirt2Off(isp, BIU_CONF1),
952 		    oc | BIU_PCI1080_CONF1_DMA);
953 	}
954 	rv = BXR2(pcs, IspVirt2Off(isp, regoff));
955 	if (oc) {
956 		BXW2(pcs, IspVirt2Off(isp, BIU_CONF1), oc);
957 	}
958 	return (rv);
959 }
960 
961 static void
962 isp_pci_wr_reg_1080(struct ispsoftc *isp, int regoff, u_int16_t val)
963 {
964 	struct isp_pcisoftc *pcs = (struct isp_pcisoftc *) isp;
965 	int oc = 0;
966 
967 	if ((regoff & _BLK_REG_MASK) == SXP_BLOCK ||
968 	    (regoff & _BLK_REG_MASK) == (SXP_BLOCK|SXP_BANK1_SELECT)) {
969 		u_int16_t tc;
970 		/*
971 		 * We will assume that someone has paused the RISC processor.
972 		 */
973 		oc = BXR2(pcs, IspVirt2Off(isp, BIU_CONF1));
974 		tc = oc & ~BIU_PCI1080_CONF1_DMA;
975 		if (regoff & SXP_BANK1_SELECT)
976 			tc |= BIU_PCI1080_CONF1_SXP1;
977 		else
978 			tc |= BIU_PCI1080_CONF1_SXP0;
979 		BXW2(pcs, IspVirt2Off(isp, BIU_CONF1), tc);
980 	} else if ((regoff & _BLK_REG_MASK) == DMA_BLOCK) {
981 		oc = BXR2(pcs, IspVirt2Off(isp, BIU_CONF1));
982 		BXW2(pcs, IspVirt2Off(isp, BIU_CONF1),
983 		    oc | BIU_PCI1080_CONF1_DMA);
984 	}
985 	BXW2(pcs, IspVirt2Off(isp, regoff), val);
986 	if (oc) {
987 		BXW2(pcs, IspVirt2Off(isp, BIU_CONF1), oc);
988 	}
989 }
990 
991 static void isp_map_rquest(void *, bus_dma_segment_t *, int, int);
992 static void isp_map_result(void *, bus_dma_segment_t *, int, int);
993 static void isp_map_fcscrt(void *, bus_dma_segment_t *, int, int);
994 
995 struct imush {
996 	struct ispsoftc *isp;
997 	int error;
998 };
999 
1000 static void
1001 isp_map_rquest(void *arg, bus_dma_segment_t *segs, int nseg, int error)
1002 {
1003 	struct imush *imushp = (struct imush *) arg;
1004 	if (error) {
1005 		imushp->error = error;
1006 	} else {
1007 		imushp->isp->isp_rquest_dma = segs->ds_addr;
1008 	}
1009 }
1010 
1011 static void
1012 isp_map_result(void *arg, bus_dma_segment_t *segs, int nseg, int error)
1013 {
1014 	struct imush *imushp = (struct imush *) arg;
1015 	if (error) {
1016 		imushp->error = error;
1017 	} else {
1018 		imushp->isp->isp_result_dma = segs->ds_addr;
1019 	}
1020 }
1021 
1022 static void
1023 isp_map_fcscrt(void *arg, bus_dma_segment_t *segs, int nseg, int error)
1024 {
1025 	struct imush *imushp = (struct imush *) arg;
1026 	if (error) {
1027 		imushp->error = error;
1028 	} else {
1029 		fcparam *fcp = imushp->isp->isp_param;
1030 		fcp->isp_scdma = segs->ds_addr;
1031 	}
1032 }
1033 
1034 static int
1035 isp_pci_mbxdma(struct ispsoftc *isp)
1036 {
1037 	struct isp_pcisoftc *pci = (struct isp_pcisoftc *)isp;
1038 	caddr_t base;
1039 	u_int32_t len;
1040 	int i, error;
1041 	bus_size_t lim;
1042 	struct imush im;
1043 
1044 
1045 	/*
1046 	 * Already been here? If so, leave...
1047 	 */
1048 	if (isp->isp_rquest) {
1049 		return (0);
1050 	}
1051 
1052 	len = sizeof (XS_T **) * isp->isp_maxcmds;
1053 	isp->isp_xflist = (XS_T **) malloc(len, M_DEVBUF, M_WAITOK | M_ZERO);
1054 	if (isp->isp_xflist == NULL) {
1055 		isp_prt(isp, ISP_LOGERR, "cannot alloc xflist array");
1056 		return (1);
1057 	}
1058 	len = sizeof (bus_dmamap_t) * isp->isp_maxcmds;
1059 	pci->dmaps = (bus_dmamap_t *) malloc(len, M_DEVBUF,  M_WAITOK);
1060 	if (pci->dmaps == NULL) {
1061 		isp_prt(isp, ISP_LOGERR, "can't alloc dma maps");
1062 		free(isp->isp_xflist, M_DEVBUF);
1063 		return (1);
1064 	}
1065 
1066 	if (IS_FC(isp) || IS_ULTRA2(isp))
1067 		lim = BUS_SPACE_MAXADDR + 1;
1068 	else
1069 		lim = BUS_SPACE_MAXADDR_24BIT + 1;
1070 
1071 	/*
1072 	 * Allocate and map the request, result queues, plus FC scratch area.
1073 	 */
1074 	len = ISP_QUEUE_SIZE(RQUEST_QUEUE_LEN(isp));
1075 	len += ISP_QUEUE_SIZE(RESULT_QUEUE_LEN(isp));
1076 	if (IS_FC(isp)) {
1077 		len += ISP2100_SCRLEN;
1078 	}
1079 	if (bus_dma_tag_create(pci->parent_dmat, PAGE_SIZE, lim,
1080 	    BUS_SPACE_MAXADDR, BUS_SPACE_MAXADDR, NULL, NULL, len, 1,
1081 	    BUS_SPACE_MAXSIZE_32BIT, 0, &pci->cntrol_dmat) != 0) {
1082 		isp_prt(isp, ISP_LOGERR,
1083 		    "cannot create a dma tag for control spaces");
1084 		free(isp->isp_xflist, M_DEVBUF);
1085 		free(pci->dmaps, M_DEVBUF);
1086 		return (1);
1087 	}
1088 	if (bus_dmamem_alloc(pci->cntrol_dmat, (void **)&base,
1089 	    BUS_DMA_NOWAIT, &pci->cntrol_dmap) != 0) {
1090 		isp_prt(isp, ISP_LOGERR,
1091 		    "cannot allocate %d bytes of CCB memory", len);
1092 		free(isp->isp_xflist, M_DEVBUF);
1093 		free(pci->dmaps, M_DEVBUF);
1094 		return (1);
1095 	}
1096 
1097 	isp->isp_rquest = base;
1098 	im.isp = isp;
1099 	im.error = 0;
1100 	bus_dmamap_load(pci->cntrol_dmat, pci->cntrol_dmap, isp->isp_rquest,
1101 	    ISP_QUEUE_SIZE(RQUEST_QUEUE_LEN(isp)), isp_map_rquest, &im, 0);
1102 	if (im.error) {
1103 		isp_prt(isp, ISP_LOGERR,
1104 		    "error %d loading dma map for DMA request queue", im.error);
1105 		free(isp->isp_xflist, M_DEVBUF);
1106 		free(pci->dmaps, M_DEVBUF);
1107 		isp->isp_rquest = NULL;
1108 		return (1);
1109 	}
1110 	isp->isp_result = base + ISP_QUEUE_SIZE(RQUEST_QUEUE_LEN(isp));
1111 	im.error = 0;
1112 	bus_dmamap_load(pci->cntrol_dmat, pci->cntrol_dmap, isp->isp_result,
1113 	    ISP_QUEUE_SIZE(RESULT_QUEUE_LEN(isp)), isp_map_result, &im, 0);
1114 	if (im.error) {
1115 		isp_prt(isp, ISP_LOGERR,
1116 		    "error %d loading dma map for DMA result queue", im.error);
1117 		free(isp->isp_xflist, M_DEVBUF);
1118 		free(pci->dmaps, M_DEVBUF);
1119 		isp->isp_rquest = NULL;
1120 		return (1);
1121 	}
1122 
1123 	for (i = 0; i < isp->isp_maxcmds; i++) {
1124 		error = bus_dmamap_create(pci->parent_dmat, 0, &pci->dmaps[i]);
1125 		if (error) {
1126 			isp_prt(isp, ISP_LOGERR,
1127 			    "error %d creating per-cmd DMA maps", error);
1128 			free(isp->isp_xflist, M_DEVBUF);
1129 			free(pci->dmaps, M_DEVBUF);
1130 			isp->isp_rquest = NULL;
1131 			return (1);
1132 		}
1133 	}
1134 
1135 	if (IS_FC(isp)) {
1136 		fcparam *fcp = (fcparam *) isp->isp_param;
1137 		fcp->isp_scratch = base +
1138 			ISP_QUEUE_SIZE(RQUEST_QUEUE_LEN(isp)) +
1139 			ISP_QUEUE_SIZE(RESULT_QUEUE_LEN(isp));
1140 		im.error = 0;
1141 		bus_dmamap_load(pci->cntrol_dmat, pci->cntrol_dmap,
1142 		    fcp->isp_scratch, ISP2100_SCRLEN, isp_map_fcscrt, &im, 0);
1143 		if (im.error) {
1144 			isp_prt(isp, ISP_LOGERR,
1145 			    "error %d loading FC scratch area", im.error);
1146 			free(isp->isp_xflist, M_DEVBUF);
1147 			free(pci->dmaps, M_DEVBUF);
1148 			isp->isp_rquest = NULL;
1149 			return (1);
1150 		}
1151 	}
1152 	return (0);
1153 }
1154 
1155 typedef struct {
1156 	struct ispsoftc *isp;
1157 	void *cmd_token;
1158 	void *rq;
1159 	u_int16_t *nxtip;
1160 	u_int16_t optr;
1161 	u_int error;
1162 } mush_t;
1163 
1164 #define	MUSHERR_NOQENTRIES	-2
1165 
1166 #ifdef	ISP_TARGET_MODE
1167 /*
1168  * We need to handle DMA for target mode differently from initiator mode.
1169  *
1170  * DMA mapping and construction and submission of CTIO Request Entries
1171  * and rendevous for completion are very tightly coupled because we start
1172  * out by knowing (per platform) how much data we have to move, but we
1173  * don't know, up front, how many DMA mapping segments will have to be used
1174  * cover that data, so we don't know how many CTIO Request Entries we
1175  * will end up using. Further, for performance reasons we may want to
1176  * (on the last CTIO for Fibre Channel), send status too (if all went well).
1177  *
1178  * The standard vector still goes through isp_pci_dmasetup, but the callback
1179  * for the DMA mapping routines comes here instead with the whole transfer
1180  * mapped and a pointer to a partially filled in already allocated request
1181  * queue entry. We finish the job.
1182  */
1183 static void tdma_mk(void *, bus_dma_segment_t *, int, int);
1184 static void tdma_mkfc(void *, bus_dma_segment_t *, int, int);
1185 
1186 #define	STATUS_WITH_DATA	1
1187 
1188 static void
1189 tdma_mk(void *arg, bus_dma_segment_t *dm_segs, int nseg, int error)
1190 {
1191 	mush_t *mp;
1192 	struct ccb_scsiio *csio;
1193 	struct ispsoftc *isp;
1194 	struct isp_pcisoftc *pci;
1195 	bus_dmamap_t *dp;
1196 	ct_entry_t *cto, *qe;
1197 	u_int8_t scsi_status;
1198 	u_int16_t curi, nxti, handle;
1199 	u_int32_t sflags;
1200 	int32_t resid;
1201 	int nth_ctio, nctios, send_status;
1202 
1203 	mp = (mush_t *) arg;
1204 	if (error) {
1205 		mp->error = error;
1206 		return;
1207 	}
1208 
1209 	isp = mp->isp;
1210 	csio = mp->cmd_token;
1211 	cto = mp->rq;
1212 	curi = isp->isp_reqidx;
1213 	qe = (ct_entry_t *) ISP_QUEUE_ENTRY(isp->isp_rquest, curi);
1214 
1215 	cto->ct_xfrlen = 0;
1216 	cto->ct_seg_count = 0;
1217 	cto->ct_header.rqs_entry_count = 1;
1218 	MEMZERO(cto->ct_dataseg, sizeof(cto->ct_dataseg));
1219 
1220 	if (nseg == 0) {
1221 		cto->ct_header.rqs_seqno = 1;
1222 		isp_prt(isp, ISP_LOGTDEBUG1,
1223 		    "CTIO[%x] lun%d iid%d tag %x flgs %x sts %x ssts %x res %d",
1224 		    cto->ct_fwhandle, csio->ccb_h.target_lun, cto->ct_iid,
1225 		    cto->ct_tag_val, cto->ct_flags, cto->ct_status,
1226 		    cto->ct_scsi_status, cto->ct_resid);
1227 		ISP_TDQE(isp, "tdma_mk[no data]", curi, cto);
1228 		isp_put_ctio(isp, cto, qe);
1229 		return;
1230 	}
1231 
1232 	nctios = nseg / ISP_RQDSEG;
1233 	if (nseg % ISP_RQDSEG) {
1234 		nctios++;
1235 	}
1236 
1237 	/*
1238 	 * Save syshandle, and potentially any SCSI status, which we'll
1239 	 * reinsert on the last CTIO we're going to send.
1240 	 */
1241 
1242 	handle = cto->ct_syshandle;
1243 	cto->ct_syshandle = 0;
1244 	cto->ct_header.rqs_seqno = 0;
1245 	send_status = (cto->ct_flags & CT_SENDSTATUS) != 0;
1246 
1247 	if (send_status) {
1248 		sflags = cto->ct_flags & (CT_SENDSTATUS | CT_CCINCR);
1249 		cto->ct_flags &= ~(CT_SENDSTATUS | CT_CCINCR);
1250 		/*
1251 		 * Preserve residual.
1252 		 */
1253 		resid = cto->ct_resid;
1254 
1255 		/*
1256 		 * Save actual SCSI status.
1257 		 */
1258 		scsi_status = cto->ct_scsi_status;
1259 
1260 #ifndef	STATUS_WITH_DATA
1261 		sflags |= CT_NO_DATA;
1262 		/*
1263 		 * We can't do a status at the same time as a data CTIO, so
1264 		 * we need to synthesize an extra CTIO at this level.
1265 		 */
1266 		nctios++;
1267 #endif
1268 	} else {
1269 		sflags = scsi_status = resid = 0;
1270 	}
1271 
1272 	cto->ct_resid = 0;
1273 	cto->ct_scsi_status = 0;
1274 
1275 	pci = (struct isp_pcisoftc *)isp;
1276 	dp = &pci->dmaps[isp_handle_index(handle)];
1277 	if ((csio->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN) {
1278 		bus_dmamap_sync(pci->parent_dmat, *dp, BUS_DMASYNC_PREREAD);
1279 	} else {
1280 		bus_dmamap_sync(pci->parent_dmat, *dp, BUS_DMASYNC_PREWRITE);
1281 	}
1282 
1283 	nxti = *mp->nxtip;
1284 
1285 	for (nth_ctio = 0; nth_ctio < nctios; nth_ctio++) {
1286 		int seglim;
1287 
1288 		seglim = nseg;
1289 		if (seglim) {
1290 			int seg;
1291 
1292 			if (seglim > ISP_RQDSEG)
1293 				seglim = ISP_RQDSEG;
1294 
1295 			for (seg = 0; seg < seglim; seg++, nseg--) {
1296 				/*
1297 				 * Unlike normal initiator commands, we don't
1298 				 * do any swizzling here.
1299 				 */
1300 				cto->ct_dataseg[seg].ds_count = dm_segs->ds_len;
1301 				cto->ct_dataseg[seg].ds_base = dm_segs->ds_addr;
1302 				cto->ct_xfrlen += dm_segs->ds_len;
1303 				dm_segs++;
1304 			}
1305 			cto->ct_seg_count = seg;
1306 		} else {
1307 			/*
1308 			 * This case should only happen when we're sending an
1309 			 * extra CTIO with final status.
1310 			 */
1311 			if (send_status == 0) {
1312 				isp_prt(isp, ISP_LOGWARN,
1313 				    "tdma_mk ran out of segments");
1314 				mp->error = EINVAL;
1315 				return;
1316 			}
1317 		}
1318 
1319 		/*
1320 		 * At this point, the fields ct_lun, ct_iid, ct_tagval,
1321 		 * ct_tagtype, and ct_timeout have been carried over
1322 		 * unchanged from what our caller had set.
1323 		 *
1324 		 * The dataseg fields and the seg_count fields we just got
1325 		 * through setting. The data direction we've preserved all
1326 		 * along and only clear it if we're now sending status.
1327 		 */
1328 
1329 		if (nth_ctio == nctios - 1) {
1330 			/*
1331 			 * We're the last in a sequence of CTIOs, so mark
1332 			 * this CTIO and save the handle to the CCB such that
1333 			 * when this CTIO completes we can free dma resources
1334 			 * and do whatever else we need to do to finish the
1335 			 * rest of the command. We *don't* give this to the
1336 			 * firmware to work on- the caller will do that.
1337 			 */
1338 
1339 			cto->ct_syshandle = handle;
1340 			cto->ct_header.rqs_seqno = 1;
1341 
1342 			if (send_status) {
1343 				cto->ct_scsi_status = scsi_status;
1344 				cto->ct_flags |= sflags;
1345 				cto->ct_resid = resid;
1346 			}
1347 			if (send_status) {
1348 				isp_prt(isp, ISP_LOGTDEBUG1,
1349 				    "CTIO[%x] lun%d iid %d tag %x ct_flags %x "
1350 				    "scsi status %x resid %d",
1351 				    cto->ct_fwhandle, csio->ccb_h.target_lun,
1352 				    cto->ct_iid, cto->ct_tag_val, cto->ct_flags,
1353 				    cto->ct_scsi_status, cto->ct_resid);
1354 			} else {
1355 				isp_prt(isp, ISP_LOGTDEBUG1,
1356 				    "CTIO[%x] lun%d iid%d tag %x ct_flags 0x%x",
1357 				    cto->ct_fwhandle, csio->ccb_h.target_lun,
1358 				    cto->ct_iid, cto->ct_tag_val,
1359 				    cto->ct_flags);
1360 			}
1361 			isp_put_ctio(isp, cto, qe);
1362 			ISP_TDQE(isp, "last tdma_mk", curi, cto);
1363 			if (nctios > 1) {
1364 				MEMORYBARRIER(isp, SYNC_REQUEST,
1365 				    curi, QENTRY_LEN);
1366 			}
1367 		} else {
1368 			ct_entry_t *oqe = qe;
1369 
1370 			/*
1371 			 * Make sure syshandle fields are clean
1372 			 */
1373 			cto->ct_syshandle = 0;
1374 			cto->ct_header.rqs_seqno = 0;
1375 
1376 			isp_prt(isp, ISP_LOGTDEBUG1,
1377 			    "CTIO[%x] lun%d for ID%d ct_flags 0x%x",
1378 			    cto->ct_fwhandle, csio->ccb_h.target_lun,
1379 			    cto->ct_iid, cto->ct_flags);
1380 
1381 			/*
1382 			 * Get a new CTIO
1383 			 */
1384 			qe = (ct_entry_t *)
1385 			    ISP_QUEUE_ENTRY(isp->isp_rquest, nxti);
1386 			nxti = ISP_NXT_QENTRY(nxti, RQUEST_QUEUE_LEN(isp));
1387 			if (nxti == mp->optr) {
1388 				isp_prt(isp, ISP_LOGTDEBUG0,
1389 				    "Queue Overflow in tdma_mk");
1390 				mp->error = MUSHERR_NOQENTRIES;
1391 				return;
1392 			}
1393 
1394 			/*
1395 			 * Now that we're done with the old CTIO,
1396 			 * flush it out to the request queue.
1397 			 */
1398 			ISP_TDQE(isp, "dma_tgt_fc", curi, cto);
1399 			isp_put_ctio(isp, cto, oqe);
1400 			if (nth_ctio != 0) {
1401 				MEMORYBARRIER(isp, SYNC_REQUEST, curi,
1402 				    QENTRY_LEN);
1403 			}
1404 			curi = ISP_NXT_QENTRY(curi, RQUEST_QUEUE_LEN(isp));
1405 
1406 			/*
1407 			 * Reset some fields in the CTIO so we can reuse
1408 			 * for the next one we'll flush to the request
1409 			 * queue.
1410 			 */
1411 			cto->ct_header.rqs_entry_type = RQSTYPE_CTIO;
1412 			cto->ct_header.rqs_entry_count = 1;
1413 			cto->ct_header.rqs_flags = 0;
1414 			cto->ct_status = 0;
1415 			cto->ct_scsi_status = 0;
1416 			cto->ct_xfrlen = 0;
1417 			cto->ct_resid = 0;
1418 			cto->ct_seg_count = 0;
1419 			MEMZERO(cto->ct_dataseg, sizeof(cto->ct_dataseg));
1420 		}
1421 	}
1422 	*mp->nxtip = nxti;
1423 }
1424 
1425 static void
1426 tdma_mkfc(void *arg, bus_dma_segment_t *dm_segs, int nseg, int error)
1427 {
1428 	mush_t *mp;
1429 	u_int8_t sense[QLTM_SENSELEN];
1430 	struct ccb_scsiio *csio;
1431 	struct ispsoftc *isp;
1432 	struct isp_pcisoftc *pci;
1433 	bus_dmamap_t *dp;
1434 	ct2_entry_t *cto, *qe;
1435 	u_int16_t scsi_status, send_status, send_sense, handle;
1436 	u_int16_t curi, nxti;
1437 	int32_t resid;
1438 	int nth_ctio, nctios;
1439 
1440 	mp = (mush_t *) arg;
1441 	if (error) {
1442 		mp->error = error;
1443 		return;
1444 	}
1445 
1446 	isp = mp->isp;
1447 	csio = mp->cmd_token;
1448 	cto = mp->rq;
1449 	curi = isp->isp_reqidx;
1450 	qe = (ct2_entry_t *) ISP_QUEUE_ENTRY(isp->isp_rquest, curi);
1451 
1452 	if (nseg == 0) {
1453 		if ((cto->ct_flags & CT2_FLAG_MMASK) != CT2_FLAG_MODE1) {
1454 			isp_prt(isp, ISP_LOGWARN,
1455 			    "dma2_tgt_fc, a status CTIO2 without MODE1 "
1456 			    "set (0x%x)", cto->ct_flags);
1457 			mp->error = EINVAL;
1458 			return;
1459 		}
1460 	 	cto->ct_header.rqs_entry_count = 1;
1461 		cto->ct_header.rqs_seqno = 1;
1462 		/* ct_syshandle contains the handle set by caller */
1463 		/*
1464 		 * We preserve ct_lun, ct_iid, ct_rxid. We set the data
1465 		 * flags to NO DATA and clear relative offset flags.
1466 		 * We preserve the ct_resid and the response area.
1467 		 */
1468 		cto->ct_flags |= CT2_NO_DATA;
1469 		if (cto->ct_resid > 0)
1470 			cto->rsp.m1.ct_scsi_status |= CT2_DATA_UNDER;
1471 		else if (cto->ct_resid < 0)
1472 			cto->rsp.m1.ct_scsi_status |= CT2_DATA_OVER;
1473 		cto->ct_seg_count = 0;
1474 		cto->ct_reloff = 0;
1475 		isp_prt(isp, ISP_LOGTDEBUG1,
1476 		    "CTIO2[%x] lun %d->iid%d flgs 0x%x sts 0x%x ssts "
1477 		    "0x%x res %d", cto->ct_rxid, csio->ccb_h.target_lun,
1478 		    cto->ct_iid, cto->ct_flags, cto->ct_status,
1479 		    cto->rsp.m1.ct_scsi_status, cto->ct_resid);
1480 		isp_put_ctio2(isp, cto, qe);
1481 		ISP_TDQE(isp, "dma2_tgt_fc[no data]", curi, qe);
1482 		return;
1483 	}
1484 
1485 	if ((cto->ct_flags & CT2_FLAG_MMASK) != CT2_FLAG_MODE0) {
1486 		isp_prt(isp, ISP_LOGWARN,
1487 		    "dma2_tgt_fc, a data CTIO2 without MODE0 set "
1488 		    "(0x%x)", cto->ct_flags);
1489 		mp->error = EINVAL;
1490 		return;
1491 	}
1492 
1493 
1494 	nctios = nseg / ISP_RQDSEG_T2;
1495 	if (nseg % ISP_RQDSEG_T2) {
1496 		nctios++;
1497 	}
1498 
1499 	/*
1500 	 * Save the handle, status, reloff, and residual. We'll reinsert the
1501 	 * handle into the last CTIO2 we're going to send, and reinsert status
1502 	 * and residual (and possibly sense data) if that's to be sent as well.
1503 	 *
1504 	 * We preserve ct_reloff and adjust it for each data CTIO2 we send past
1505 	 * the first one. This is needed so that the FCP DATA IUs being sent
1506 	 * out have the correct offset (they can arrive at the other end out
1507 	 * of order).
1508 	 */
1509 
1510 	handle = cto->ct_syshandle;
1511 	cto->ct_syshandle = 0;
1512 	send_status = (cto->ct_flags & CT2_SENDSTATUS) != 0;
1513 
1514 	if (send_status) {
1515 		cto->ct_flags &= ~(CT2_SENDSTATUS|CT2_CCINCR);
1516 
1517 		/*
1518 		 * Preserve residual.
1519 		 */
1520 		resid = cto->ct_resid;
1521 
1522 		/*
1523 		 * Save actual SCSI status. We'll reinsert the
1524 		 * CT2_SNSLEN_VALID later if appropriate.
1525 		 */
1526 		scsi_status = cto->rsp.m0.ct_scsi_status & 0xff;
1527 		send_sense = cto->rsp.m0.ct_scsi_status & CT2_SNSLEN_VALID;
1528 
1529 		/*
1530 		 * If we're sending status and have a CHECK CONDTION and
1531 		 * have sense data,  we send one more CTIO2 with just the
1532 		 * status and sense data. The upper layers have stashed
1533 		 * the sense data in the dataseg structure for us.
1534 		 */
1535 
1536 		if ((scsi_status & 0xf) == SCSI_STATUS_CHECK_COND &&
1537 		    send_sense) {
1538 			bcopy(cto->rsp.m0.ct_dataseg, sense, QLTM_SENSELEN);
1539 			nctios++;
1540 		}
1541 	} else {
1542 		scsi_status = send_sense = resid = 0;
1543 	}
1544 
1545 	cto->ct_resid = 0;
1546 	cto->rsp.m0.ct_scsi_status = 0;
1547 	MEMZERO(&cto->rsp, sizeof (cto->rsp));
1548 
1549 	pci = (struct isp_pcisoftc *)isp;
1550 	dp = &pci->dmaps[isp_handle_index(handle)];
1551 	if ((csio->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN) {
1552 		bus_dmamap_sync(pci->parent_dmat, *dp, BUS_DMASYNC_PREREAD);
1553 	} else {
1554 		bus_dmamap_sync(pci->parent_dmat, *dp, BUS_DMASYNC_PREWRITE);
1555 	}
1556 
1557 	nxti = *mp->nxtip;
1558 
1559 	for (nth_ctio = 0; nth_ctio < nctios; nth_ctio++) {
1560 		u_int32_t oxfrlen;
1561 		int seglim;
1562 
1563 		seglim = nseg;
1564 		if (seglim) {
1565 			int seg;
1566 			if (seglim > ISP_RQDSEG_T2)
1567 				seglim = ISP_RQDSEG_T2;
1568 			for (seg = 0; seg < seglim; seg++) {
1569 				cto->rsp.m0.ct_dataseg[seg].ds_base =
1570 				    dm_segs->ds_addr;
1571 				cto->rsp.m0.ct_dataseg[seg].ds_count =
1572 				    dm_segs->ds_len;
1573 				cto->rsp.m0.ct_xfrlen += dm_segs->ds_len;
1574 				dm_segs++;
1575 			}
1576 			cto->ct_seg_count = seg;
1577 			oxfrlen = cto->rsp.m0.ct_xfrlen;
1578 		} else {
1579 			/*
1580 			 * This case should only happen when we're sending a
1581 			 * synthesized MODE1 final status with sense data.
1582 			 */
1583 			if (send_sense == 0) {
1584 				isp_prt(isp, ISP_LOGWARN,
1585 				    "dma2_tgt_fc ran out of segments, "
1586 				    "no SENSE DATA");
1587 				mp->error = EINVAL;
1588 				return;
1589 			}
1590 			oxfrlen = 0;
1591 		}
1592 
1593 
1594 		/*
1595 		 * At this point, the fields ct_lun, ct_iid, ct_rxid,
1596 		 * ct_timeout have been carried over unchanged from what
1597 		 * our caller had set.
1598 		 *
1599 		 * The field ct_reloff is either what the caller set, or
1600 		 * what we've added to below.
1601 		 *
1602 		 * The dataseg fields and the seg_count fields we just got
1603 		 * through setting. The data direction we've preserved all
1604 		 * along and only clear it if we're sending a MODE1 status
1605 		 * as the last CTIO.
1606 		 *
1607 		 */
1608 
1609 		if (nth_ctio == nctios - 1) {
1610 			/*
1611 			 * We're the last in a sequence of CTIO2s, so mark this
1612 			 * CTIO2 and save the handle to the CCB such that when
1613 			 * this CTIO2 completes we can free dma resources and
1614 			 * do whatever else we need to do to finish the rest
1615 			 * of the command.
1616 			 */
1617 
1618 			cto->ct_syshandle = handle;
1619 			cto->ct_header.rqs_seqno = 1;
1620 
1621 			if (send_status) {
1622 				/*
1623 				 * Get 'real' residual and set flags based
1624 				 * on it.
1625 				 */
1626 				cto->ct_resid = resid;
1627 				if (send_sense) {
1628 					MEMCPY(cto->rsp.m1.ct_resp, sense,
1629 					    QLTM_SENSELEN);
1630 					cto->rsp.m1.ct_senselen =
1631 					    QLTM_SENSELEN;
1632 					scsi_status |= CT2_SNSLEN_VALID;
1633 					cto->rsp.m1.ct_scsi_status =
1634 					    scsi_status;
1635 					cto->ct_flags &= CT2_FLAG_MMASK;
1636 					cto->ct_flags |= CT2_FLAG_MODE1 |
1637 					    CT2_NO_DATA | CT2_SENDSTATUS |
1638 					    CT2_CCINCR;
1639 					if (cto->ct_resid > 0)
1640 						cto->rsp.m1.ct_scsi_status |=
1641 						    CT2_DATA_UNDER;
1642 					else if (cto->ct_resid < 0)
1643 						cto->rsp.m1.ct_scsi_status |=
1644 						    CT2_DATA_OVER;
1645 				} else {
1646 					cto->rsp.m0.ct_scsi_status =
1647 					    scsi_status;
1648 					cto->ct_flags |=
1649 					    CT2_SENDSTATUS | CT2_CCINCR;
1650 					if (cto->ct_resid > 0)
1651 						cto->rsp.m0.ct_scsi_status |=
1652 						    CT2_DATA_UNDER;
1653 					else if (cto->ct_resid < 0)
1654 						cto->rsp.m0.ct_scsi_status |=
1655 						    CT2_DATA_OVER;
1656 				}
1657 			}
1658 			isp_prt(isp, ISP_LOGTDEBUG1,
1659 			    "CTIO2[%x] lun %d->iid%d flgs 0x%x sts 0x%x"
1660 			    " ssts 0x%x res %d", cto->ct_rxid,
1661 			    csio->ccb_h.target_lun, (int) cto->ct_iid,
1662 			    cto->ct_flags, cto->ct_status,
1663 			    cto->rsp.m1.ct_scsi_status, cto->ct_resid);
1664 			isp_put_ctio2(isp, cto, qe);
1665 			ISP_TDQE(isp, "last dma2_tgt_fc", curi, qe);
1666 			if (nctios > 1) {
1667 				MEMORYBARRIER(isp, SYNC_REQUEST,
1668 				    curi, QENTRY_LEN);
1669 			}
1670 		} else {
1671 			ct2_entry_t *oqe = qe;
1672 
1673 			/*
1674 			 * Make sure handle fields are clean
1675 			 */
1676 			cto->ct_syshandle = 0;
1677 			cto->ct_header.rqs_seqno = 0;
1678 			isp_prt(isp, ISP_LOGTDEBUG1,
1679 			    "CTIO2[%x] lun %d->iid%d flgs 0x%x",
1680 			    cto->ct_rxid, csio->ccb_h.target_lun,
1681 			    (int) cto->ct_iid, cto->ct_flags);
1682 			/*
1683 			 * Get a new CTIO2 entry from the request queue.
1684 			 */
1685 			qe = (ct2_entry_t *)
1686 			    ISP_QUEUE_ENTRY(isp->isp_rquest, nxti);
1687 			nxti = ISP_NXT_QENTRY(nxti, RQUEST_QUEUE_LEN(isp));
1688 			if (nxti == mp->optr) {
1689 				isp_prt(isp, ISP_LOGWARN,
1690 				    "Queue Overflow in dma2_tgt_fc");
1691 				mp->error = MUSHERR_NOQENTRIES;
1692 				return;
1693 			}
1694 
1695 			/*
1696 			 * Now that we're done with the old CTIO2,
1697 			 * flush it out to the request queue.
1698 			 */
1699 			ISP_TDQE(isp, "tdma_mkfc", curi, cto);
1700 			isp_put_ctio2(isp, cto, oqe);
1701 			if (nth_ctio != 0) {
1702 				MEMORYBARRIER(isp, SYNC_REQUEST, curi,
1703 				    QENTRY_LEN);
1704 			}
1705 			curi = ISP_NXT_QENTRY(curi, RQUEST_QUEUE_LEN(isp));
1706 
1707 			/*
1708 			 * Reset some fields in the CTIO2 so we can reuse
1709 			 * for the next one we'll flush to the request
1710 			 * queue.
1711 			 */
1712 			cto->ct_header.rqs_entry_type = RQSTYPE_CTIO2;
1713 			cto->ct_header.rqs_entry_count = 1;
1714 			cto->ct_header.rqs_flags = 0;
1715 			cto->ct_status = 0;
1716 			cto->ct_resid = 0;
1717 			cto->ct_seg_count = 0;
1718 			/*
1719 			 * Adjust the new relative offset by the amount which
1720 			 * is recorded in the data segment of the old CTIO2 we
1721 			 * just finished filling out.
1722 			 */
1723 			cto->ct_reloff += oxfrlen;
1724 			MEMZERO(&cto->rsp, sizeof (cto->rsp));
1725 		}
1726 	}
1727 	*mp->nxtip = nxti;
1728 }
1729 #endif
1730 
1731 static void dma2(void *, bus_dma_segment_t *, int, int);
1732 
1733 static void
1734 dma2(void *arg, bus_dma_segment_t *dm_segs, int nseg, int error)
1735 {
1736 	mush_t *mp;
1737 	struct ispsoftc *isp;
1738 	struct ccb_scsiio *csio;
1739 	struct isp_pcisoftc *pci;
1740 	bus_dmamap_t *dp;
1741 	bus_dma_segment_t *eseg;
1742 	ispreq_t *rq;
1743 	int seglim, datalen;
1744 	u_int16_t nxti;
1745 
1746 	mp = (mush_t *) arg;
1747 	if (error) {
1748 		mp->error = error;
1749 		return;
1750 	}
1751 
1752 	if (nseg < 1) {
1753 		isp_prt(mp->isp, ISP_LOGERR, "bad segment count (%d)", nseg);
1754 		mp->error = EFAULT;
1755 		return;
1756 	}
1757 	csio = mp->cmd_token;
1758 	isp = mp->isp;
1759 	rq = mp->rq;
1760 	pci = (struct isp_pcisoftc *)mp->isp;
1761 	dp = &pci->dmaps[isp_handle_index(rq->req_handle)];
1762 	nxti = *mp->nxtip;
1763 
1764 	if ((csio->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN) {
1765 		bus_dmamap_sync(pci->parent_dmat, *dp, BUS_DMASYNC_PREREAD);
1766 	} else {
1767 		bus_dmamap_sync(pci->parent_dmat, *dp, BUS_DMASYNC_PREWRITE);
1768 	}
1769 
1770 	datalen = XS_XFRLEN(csio);
1771 
1772 	/*
1773 	 * We're passed an initial partially filled in entry that
1774 	 * has most fields filled in except for data transfer
1775 	 * related values.
1776 	 *
1777 	 * Our job is to fill in the initial request queue entry and
1778 	 * then to start allocating and filling in continuation entries
1779 	 * until we've covered the entire transfer.
1780 	 */
1781 
1782 	if (IS_FC(isp)) {
1783 		seglim = ISP_RQDSEG_T2;
1784 		((ispreqt2_t *)rq)->req_totalcnt = datalen;
1785 		if ((csio->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN) {
1786 			((ispreqt2_t *)rq)->req_flags |= REQFLAG_DATA_IN;
1787 		} else {
1788 			((ispreqt2_t *)rq)->req_flags |= REQFLAG_DATA_OUT;
1789 		}
1790 	} else {
1791 		if (csio->cdb_len > 12) {
1792 			seglim = 0;
1793 		} else {
1794 			seglim = ISP_RQDSEG;
1795 		}
1796 		if ((csio->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN) {
1797 			rq->req_flags |= REQFLAG_DATA_IN;
1798 		} else {
1799 			rq->req_flags |= REQFLAG_DATA_OUT;
1800 		}
1801 	}
1802 
1803 	eseg = dm_segs + nseg;
1804 
1805 	while (datalen != 0 && rq->req_seg_count < seglim && dm_segs != eseg) {
1806 		if (IS_FC(isp)) {
1807 			ispreqt2_t *rq2 = (ispreqt2_t *)rq;
1808 			rq2->req_dataseg[rq2->req_seg_count].ds_base =
1809 			    dm_segs->ds_addr;
1810 			rq2->req_dataseg[rq2->req_seg_count].ds_count =
1811 			    dm_segs->ds_len;
1812 		} else {
1813 			rq->req_dataseg[rq->req_seg_count].ds_base =
1814 				dm_segs->ds_addr;
1815 			rq->req_dataseg[rq->req_seg_count].ds_count =
1816 				dm_segs->ds_len;
1817 		}
1818 		datalen -= dm_segs->ds_len;
1819 		rq->req_seg_count++;
1820 		dm_segs++;
1821 	}
1822 
1823 	while (datalen > 0 && dm_segs != eseg) {
1824 		u_int16_t onxti;
1825 		ispcontreq_t local, *crq = &local, *cqe;
1826 
1827 		cqe = (ispcontreq_t *) ISP_QUEUE_ENTRY(isp->isp_rquest, nxti);
1828 		onxti = nxti;
1829 		nxti = ISP_NXT_QENTRY(onxti, RQUEST_QUEUE_LEN(isp));
1830 		if (nxti == mp->optr) {
1831 			isp_prt(isp, ISP_LOGDEBUG0, "Request Queue Overflow++");
1832 			mp->error = MUSHERR_NOQENTRIES;
1833 			return;
1834 		}
1835 		rq->req_header.rqs_entry_count++;
1836 		MEMZERO((void *)crq, sizeof (*crq));
1837 		crq->req_header.rqs_entry_count = 1;
1838 		crq->req_header.rqs_entry_type = RQSTYPE_DATASEG;
1839 
1840 		seglim = 0;
1841 		while (datalen > 0 && seglim < ISP_CDSEG && dm_segs != eseg) {
1842 			crq->req_dataseg[seglim].ds_base =
1843 			    dm_segs->ds_addr;
1844 			crq->req_dataseg[seglim].ds_count =
1845 			    dm_segs->ds_len;
1846 			rq->req_seg_count++;
1847 			dm_segs++;
1848 			seglim++;
1849 			datalen -= dm_segs->ds_len;
1850 		}
1851 		isp_put_cont_req(isp, crq, cqe);
1852 		MEMORYBARRIER(isp, SYNC_REQUEST, onxti, QENTRY_LEN);
1853 	}
1854 	*mp->nxtip = nxti;
1855 }
1856 
1857 static int
1858 isp_pci_dmasetup(struct ispsoftc *isp, struct ccb_scsiio *csio, ispreq_t *rq,
1859 	u_int16_t *nxtip, u_int16_t optr)
1860 {
1861 	struct isp_pcisoftc *pci = (struct isp_pcisoftc *)isp;
1862 	ispreq_t *qep;
1863 	bus_dmamap_t *dp = NULL;
1864 	mush_t mush, *mp;
1865 	void (*eptr)(void *, bus_dma_segment_t *, int, int);
1866 
1867 	qep = (ispreq_t *) ISP_QUEUE_ENTRY(isp->isp_rquest, isp->isp_reqidx);
1868 #ifdef	ISP_TARGET_MODE
1869 	if (csio->ccb_h.func_code == XPT_CONT_TARGET_IO) {
1870 		if (IS_FC(isp)) {
1871 			eptr = tdma_mkfc;
1872 		} else {
1873 			eptr = tdma_mk;
1874 		}
1875 		if ((csio->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_NONE ||
1876 		    (csio->dxfer_len == 0)) {
1877 			mp = &mush;
1878 			mp->isp = isp;
1879 			mp->cmd_token = csio;
1880 			mp->rq = rq;	/* really a ct_entry_t or ct2_entry_t */
1881 			mp->nxtip = nxtip;
1882 			mp->optr = optr;
1883 			mp->error = 0;
1884 			(*eptr)(mp, NULL, 0, 0);
1885 			goto mbxsync;
1886 		}
1887 	} else
1888 #endif
1889 	eptr = dma2;
1890 
1891 
1892 	if ((csio->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_NONE ||
1893 	    (csio->dxfer_len == 0)) {
1894 		rq->req_seg_count = 1;
1895 		goto mbxsync;
1896 	}
1897 
1898 	/*
1899 	 * Do a virtual grapevine step to collect info for
1900 	 * the callback dma allocation that we have to use...
1901 	 */
1902 	mp = &mush;
1903 	mp->isp = isp;
1904 	mp->cmd_token = csio;
1905 	mp->rq = rq;
1906 	mp->nxtip = nxtip;
1907 	mp->optr = optr;
1908 	mp->error = 0;
1909 
1910 	if ((csio->ccb_h.flags & CAM_SCATTER_VALID) == 0) {
1911 		if ((csio->ccb_h.flags & CAM_DATA_PHYS) == 0) {
1912 			int error, s;
1913 			dp = &pci->dmaps[isp_handle_index(rq->req_handle)];
1914 			s = splsoftvm();
1915 			error = bus_dmamap_load(pci->parent_dmat, *dp,
1916 			    csio->data_ptr, csio->dxfer_len, eptr, mp, 0);
1917 			if (error == EINPROGRESS) {
1918 				bus_dmamap_unload(pci->parent_dmat, *dp);
1919 				mp->error = EINVAL;
1920 				isp_prt(isp, ISP_LOGERR,
1921 				    "deferred dma allocation not supported");
1922 			} else if (error && mp->error == 0) {
1923 #ifdef	DIAGNOSTIC
1924 				isp_prt(isp, ISP_LOGERR,
1925 				    "error %d in dma mapping code", error);
1926 #endif
1927 				mp->error = error;
1928 			}
1929 			splx(s);
1930 		} else {
1931 			/* Pointer to physical buffer */
1932 			struct bus_dma_segment seg;
1933 			seg.ds_addr = (bus_addr_t)csio->data_ptr;
1934 			seg.ds_len = csio->dxfer_len;
1935 			(*eptr)(mp, &seg, 1, 0);
1936 		}
1937 	} else {
1938 		struct bus_dma_segment *segs;
1939 
1940 		if ((csio->ccb_h.flags & CAM_DATA_PHYS) != 0) {
1941 			isp_prt(isp, ISP_LOGERR,
1942 			    "Physical segment pointers unsupported");
1943 			mp->error = EINVAL;
1944 		} else if ((csio->ccb_h.flags & CAM_SG_LIST_PHYS) == 0) {
1945 			isp_prt(isp, ISP_LOGERR,
1946 			    "Virtual segment addresses unsupported");
1947 			mp->error = EINVAL;
1948 		} else {
1949 			/* Just use the segments provided */
1950 			segs = (struct bus_dma_segment *) csio->data_ptr;
1951 			(*eptr)(mp, segs, csio->sglist_cnt, 0);
1952 		}
1953 	}
1954 	if (mp->error) {
1955 		int retval = CMD_COMPLETE;
1956 		if (mp->error == MUSHERR_NOQENTRIES) {
1957 			retval = CMD_EAGAIN;
1958 		} else if (mp->error == EFBIG) {
1959 			XS_SETERR(csio, CAM_REQ_TOO_BIG);
1960 		} else if (mp->error == EINVAL) {
1961 			XS_SETERR(csio, CAM_REQ_INVALID);
1962 		} else {
1963 			XS_SETERR(csio, CAM_UNREC_HBA_ERROR);
1964 		}
1965 		return (retval);
1966 	}
1967 mbxsync:
1968 	switch (rq->req_header.rqs_entry_type) {
1969 	case RQSTYPE_REQUEST:
1970 		isp_put_request(isp, rq, qep);
1971 		break;
1972 	case RQSTYPE_CMDONLY:
1973 		isp_put_extended_request(isp, (ispextreq_t *)rq,
1974 		    (ispextreq_t *)qep);
1975 		break;
1976 	case RQSTYPE_T2RQS:
1977 		isp_put_request_t2(isp, (ispreqt2_t *) rq, (ispreqt2_t *) qep);
1978 		break;
1979 	}
1980 	return (CMD_QUEUED);
1981 }
1982 
1983 static void
1984 isp_pci_dmateardown(struct ispsoftc *isp, XS_T *xs, u_int16_t handle)
1985 {
1986 	struct isp_pcisoftc *pci = (struct isp_pcisoftc *)isp;
1987 	bus_dmamap_t *dp = &pci->dmaps[isp_handle_index(handle)];
1988 	if ((xs->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN) {
1989 		bus_dmamap_sync(pci->parent_dmat, *dp, BUS_DMASYNC_POSTREAD);
1990 	} else {
1991 		bus_dmamap_sync(pci->parent_dmat, *dp, BUS_DMASYNC_POSTWRITE);
1992 	}
1993 	bus_dmamap_unload(pci->parent_dmat, *dp);
1994 }
1995 
1996 
1997 static void
1998 isp_pci_reset1(struct ispsoftc *isp)
1999 {
2000 	/* Make sure the BIOS is disabled */
2001 	isp_pci_wr_reg(isp, HCCR, PCI_HCCR_CMD_BIOS);
2002 	/* and enable interrupts */
2003 	ENABLE_INTS(isp);
2004 }
2005 
2006 static void
2007 isp_pci_dumpregs(struct ispsoftc *isp, const char *msg)
2008 {
2009 	struct isp_pcisoftc *pci = (struct isp_pcisoftc *)isp;
2010 	if (msg)
2011 		printf("%s: %s\n", device_get_nameunit(isp->isp_dev), msg);
2012 	else
2013 		printf("%s:\n", device_get_nameunit(isp->isp_dev));
2014 	if (IS_SCSI(isp))
2015 		printf("    biu_conf1=%x", ISP_READ(isp, BIU_CONF1));
2016 	else
2017 		printf("    biu_csr=%x", ISP_READ(isp, BIU2100_CSR));
2018 	printf(" biu_icr=%x biu_isr=%x biu_sema=%x ", ISP_READ(isp, BIU_ICR),
2019 	    ISP_READ(isp, BIU_ISR), ISP_READ(isp, BIU_SEMA));
2020 	printf("risc_hccr=%x\n", ISP_READ(isp, HCCR));
2021 
2022 
2023 	if (IS_SCSI(isp)) {
2024 		ISP_WRITE(isp, HCCR, HCCR_CMD_PAUSE);
2025 		printf("    cdma_conf=%x cdma_sts=%x cdma_fifostat=%x\n",
2026 			ISP_READ(isp, CDMA_CONF), ISP_READ(isp, CDMA_STATUS),
2027 			ISP_READ(isp, CDMA_FIFO_STS));
2028 		printf("    ddma_conf=%x ddma_sts=%x ddma_fifostat=%x\n",
2029 			ISP_READ(isp, DDMA_CONF), ISP_READ(isp, DDMA_STATUS),
2030 			ISP_READ(isp, DDMA_FIFO_STS));
2031 		printf("    sxp_int=%x sxp_gross=%x sxp(scsi_ctrl)=%x\n",
2032 			ISP_READ(isp, SXP_INTERRUPT),
2033 			ISP_READ(isp, SXP_GROSS_ERR),
2034 			ISP_READ(isp, SXP_PINS_CTRL));
2035 		ISP_WRITE(isp, HCCR, HCCR_CMD_RELEASE);
2036 	}
2037 	printf("    mbox regs: %x %x %x %x %x\n",
2038 	    ISP_READ(isp, OUTMAILBOX0), ISP_READ(isp, OUTMAILBOX1),
2039 	    ISP_READ(isp, OUTMAILBOX2), ISP_READ(isp, OUTMAILBOX3),
2040 	    ISP_READ(isp, OUTMAILBOX4));
2041 	printf("    PCI Status Command/Status=%x\n",
2042 	    pci_read_config(pci->pci_dev, PCIR_COMMAND, 1));
2043 }
2044