xref: /netbsd-src/sys/dev/ic/isp.c (revision bada23909e740596d0a3785a73bd3583a9807fb8)
1 /* $NetBSD: isp.c,v 1.33 1999/03/17 06:15:47 mjacob Exp $ */
2 /* release_03_16_99 */
3 /*
4  * Machine and OS Independent (well, as best as possible)
5  * code for the Qlogic ISP SCSI adapters.
6  *
7  *---------------------------------------
8  * Copyright (c) 1997, 1998 by Matthew Jacob
9  * NASA/Ames Research Center
10  * All rights reserved.
11  *---------------------------------------
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  * 1. Redistributions of source code must retain the above copyright
17  *    notice immediately at the beginning of the file, without modification,
18  *    this list of conditions, and the following disclaimer.
19  * 2. Redistributions in binary form must reproduce the above copyright
20  *    notice, this list of conditions and the following disclaimer in the
21  *    documentation and/or other materials provided with the distribution.
22  * 3. The name of the author may not be used to endorse or promote products
23  *    derived from this software without specific prior written permission.
24  *
25  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
29  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35  * SUCH DAMAGE.
36  */
37 
38 /*
39  * Inspiration and ideas about this driver are from Erik Moe's Linux driver
40  * (qlogicisp.c) and Dave Miller's SBus version of same (qlogicisp.c). Some
41  * ideas dredged from the Solaris driver.
42  */
43 
44 /*
45  * Include header file appropriate for platform we're building on.
46  */
47 
48 #ifdef	__NetBSD__
49 #include <dev/ic/isp_netbsd.h>
50 #endif
51 #ifdef	__FreeBSD__
52 #include <dev/isp/isp_freebsd.h>
53 #endif
54 #ifdef	__OpenBSD__
55 #include <dev/ic/isp_openbsd.h>
56 #endif
57 #ifdef	__linux__
58 #include "isp_linux.h"
59 #endif
60 
61 /*
62  * General defines
63  */
64 
65 #define	MBOX_DELAY_COUNT	1000000 / 100
66 
67 /*
68  * Local static data
69  */
70 #ifdef	ISP_TARGET_MODE
71 static const char tgtiqd[36] = {
72 	0x03, 0x00, 0x02, 0x02, 0x00, 0x00, 0x00, 0x00,
73 	0x51, 0x4C, 0x4F, 0x47, 0x49, 0x43, 0x20, 0x20,
74 #ifdef	__NetBSD__
75 	0x4E, 0x45, 0x54, 0x42, 0x53, 0x44, 0x20, 0x20,
76 #else
77 # ifdef	__FreeBSD__
78 	0x46, 0x52, 0x45, 0x45, 0x42, 0x52, 0x44, 0x20,
79 # else
80 #  ifdef __OpenBSD__
81 	0x4F, 0x50, 0x45, 0x4E, 0x42, 0x52, 0x44, 0x20,
82 #  else
83 #   ifdef linux
84 	0x4C, 0x49, 0x4E, 0x55, 0x58, 0x20, 0x20, 0x20,
85 #   else
86 #   endif
87 #  endif
88 # endif
89 #endif
90 	0x54, 0x41, 0x52, 0x47, 0x45, 0x54, 0x20, 0x20,
91 	0x20, 0x20, 0x20, 0x31
92 };
93 #endif
94 
95 
96 /*
97  * Local function prototypes.
98  */
99 static int isp_parse_async __P((struct ispsoftc *, int));
100 static int isp_handle_other_response
101 __P((struct ispsoftc *, ispstatusreq_t *, u_int8_t *));
102 #ifdef	ISP_TARGET_MODE
103 static int isp_modify_lun __P((struct ispsoftc *, int, int, int));
104 static void isp_notify_ack __P((struct ispsoftc *, void *));
105 static void isp_handle_atio __P((struct ispsoftc *, void *));
106 static void isp_handle_atio2 __P((struct ispsoftc *, void *));
107 static void isp_handle_ctio __P((struct ispsoftc *, void *));
108 static void isp_handle_ctio2 __P((struct ispsoftc *, void *));
109 #endif
110 static void isp_parse_status
111 __P((struct ispsoftc *, ispstatusreq_t *, ISP_SCSI_XFER_T *));
112 static void isp_fastpost_complete __P((struct ispsoftc *, int));
113 static void isp_fibre_init __P((struct ispsoftc *));
114 static void isp_mark_getpdb_all __P((struct ispsoftc *));
115 static int isp_getpdb __P((struct ispsoftc *, int, isp_pdb_t *));
116 static int isp_fclink_test __P((struct ispsoftc *));
117 static void isp_fw_state __P((struct ispsoftc *));
118 static void isp_dumpregs __P((struct ispsoftc *, const char *));
119 static void isp_dumpxflist __P((struct ispsoftc *));
120 static void isp_mboxcmd __P((struct ispsoftc *, mbreg_t *));
121 
122 static void isp_update  __P((struct ispsoftc *));
123 static void isp_setdfltparm __P((struct ispsoftc *));
124 static int isp_read_nvram __P((struct ispsoftc *));
125 static void isp_rdnvram_word __P((struct ispsoftc *, int, u_int16_t *));
126 
127 /*
128  * Reset Hardware.
129  *
130  * Hit the chip over the head, download new f/w and set it running.
131  *
132  * Locking done elsewhere.
133  */
134 void
135 isp_reset(isp)
136 	struct ispsoftc *isp;
137 {
138 	mbreg_t mbs;
139 	int loops, i, dodnld = 1;
140 	char *revname;
141 
142 	isp->isp_state = ISP_NILSTATE;
143 
144 	/*
145 	 * Basic types (SCSI, FibreChannel and PCI or SBus)
146 	 * have been set in the MD code. We figure out more
147 	 * here.
148 	 */
149 	isp->isp_dblev = DFLT_DBLEVEL;
150 
151 	/*
152 	 * After we've fired this chip up, zero out the conf1 register
153 	 * for SCSI adapters and other settings for the 2100.
154 	 */
155 
156 	/*
157 	 * Get the current running firmware revision out of the
158 	 * chip before we hit it over the head (if this is our
159 	 * first time through). Note that we store this as the
160 	 * 'ROM' firmware revision- which it may not be. In any
161 	 * case, we don't really use this yet, but we may in
162 	 * the future.
163 	 */
164 	if (isp->isp_used == 0) {
165 		/*
166 		 * Just in case it was paused...
167 		 */
168 		ISP_WRITE(isp, HCCR, HCCR_CMD_RELEASE);
169 		mbs.param[0] = MBOX_ABOUT_FIRMWARE;
170 		isp_mboxcmd(isp, &mbs);
171 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
172 			/*
173 			 * If this fails, it probably means we're running
174 			 * an old prom, if anything at all...
175 			 */
176 			isp->isp_romfw_rev = 0;
177 		} else {
178 			isp->isp_romfw_rev =
179 			    (((u_int16_t) mbs.param[1]) << 10) + mbs.param[2];
180 		}
181 		isp->isp_used = 1;
182 	}
183 
184 	/*
185 	 * Put it into PAUSE mode.
186 	 */
187 	ISP_WRITE(isp, HCCR, HCCR_CMD_PAUSE);
188 
189 	if (IS_FC(isp)) {
190 		revname = "2100";
191 	} else if (IS_1080(isp)) {
192 		sdparam *sdp = isp->isp_param;
193 		revname = "1080";
194 		sdp->isp_clock = 0;	/* don't set clock */
195 		sdp->isp_diffmode = 1;
196 		sdp->isp_ultramode = 1;
197 	} else {
198 		sdparam *sdp = isp->isp_param;
199 		i = ISP_READ(isp, BIU_CONF0) & BIU_CONF0_HW_MASK;
200 		switch (i) {
201 		default:
202 			PRINTF("%s: unknown chip rev. 0x%x- assuming a 1020\n",
203 			    isp->isp_name, i);
204 			/* FALLTHROUGH */
205 		case 1:
206 			revname = "1020";
207 			isp->isp_type = ISP_HA_SCSI_1020;
208 			sdp->isp_clock = 40;
209 			break;
210 		case 2:
211 			/*
212 			 * Some 1020A chips are Ultra Capable, but don't
213 			 * run the clock rate up for that unless told to
214 			 * do so by the Ultra Capable bits being set.
215 			 */
216 			revname = "1020A";
217 			isp->isp_type = ISP_HA_SCSI_1020A;
218 			sdp->isp_clock = 40;
219 			break;
220 		case 3:
221 			revname = "1040";
222 			isp->isp_type = ISP_HA_SCSI_1040;
223 			sdp->isp_clock = 60;
224 			break;
225 		case 4:
226 			revname = "1040A";
227 			isp->isp_type = ISP_HA_SCSI_1040A;
228 			sdp->isp_clock = 60;
229 			break;
230 		case 5:
231 			revname = "1040B";
232 			isp->isp_type = ISP_HA_SCSI_1040B;
233 			sdp->isp_clock = 60;
234 			break;
235 		}
236 		/*
237 		 * Now, while we're at it, gather info about ultra
238 		 * and/or differential mode.
239 		 */
240 		if (ISP_READ(isp, SXP_PINS_DIFF) & SXP_PINS_DIFF_MODE) {
241 			PRINTF("%s: Differential Mode\n", isp->isp_name);
242 			sdp->isp_diffmode = 1;
243 		} else {
244 			sdp->isp_diffmode = 0;
245 		}
246 		i = ISP_READ(isp, RISC_PSR);
247 		if (isp->isp_bustype == ISP_BT_SBUS) {
248 			i &= RISC_PSR_SBUS_ULTRA;
249 		} else {
250 			i &= RISC_PSR_PCI_ULTRA;
251 		}
252 		if (i != 0) {
253 			PRINTF("%s: Ultra Mode Capable\n", isp->isp_name);
254 			sdp->isp_ultramode = 1;
255 			/*
256 			 * If we're in Ultra Mode, we have to be 60Mhz clock-
257 			 * even for the SBus version.
258 			 */
259 			sdp->isp_clock = 60;
260                 } else {
261 			sdp->isp_ultramode = 0;
262 			/*
263 			 * Clock is known. Gronk.
264 			 */
265 		}
266 
267 		/*
268 		 * Machine dependent clock (if set) overrides
269 		 * our generic determinations.
270 		 */
271 		if (isp->isp_mdvec->dv_clock) {
272 			if (isp->isp_mdvec->dv_clock < sdp->isp_clock) {
273 				sdp->isp_clock = isp->isp_mdvec->dv_clock;
274 			}
275 		}
276 
277 	}
278 
279 	/*
280 	 * Do MD specific pre initialization
281 	 */
282 	ISP_RESET0(isp);
283 
284 again:
285 
286 	/*
287 	 * Hit the chip over the head with hammer,
288 	 * and give the ISP a chance to recover.
289 	 */
290 
291 	if (IS_SCSI(isp)) {
292 		ISP_WRITE(isp, BIU_ICR, BIU_ICR_SOFT_RESET);
293 		/*
294 		 * A slight delay...
295 		 */
296 		SYS_DELAY(100);
297 
298 #if	0
299 		PRINTF("%s: mbox0-5: 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x\n",
300 		    isp->isp_name, ISP_READ(isp, OUTMAILBOX0),
301 		    ISP_READ(isp, OUTMAILBOX1), ISP_READ(isp, OUTMAILBOX2),
302 		    ISP_READ(isp, OUTMAILBOX3), ISP_READ(isp, OUTMAILBOX4),
303 		    ISP_READ(isp, OUTMAILBOX5));
304 #endif
305 
306 		/*
307 		 * Clear data && control DMA engines.
308 		 */
309 		ISP_WRITE(isp, CDMA_CONTROL,
310 		      DMA_CNTRL_CLEAR_CHAN | DMA_CNTRL_RESET_INT);
311 		ISP_WRITE(isp, DDMA_CONTROL,
312 		      DMA_CNTRL_CLEAR_CHAN | DMA_CNTRL_RESET_INT);
313 
314 
315 	} else {
316 		ISP_WRITE(isp, BIU2100_CSR, BIU2100_SOFT_RESET);
317 		/*
318 		 * A slight delay...
319 		 */
320 		SYS_DELAY(100);
321 
322 		/*
323 		 * Clear data && control DMA engines.
324 		 */
325 		ISP_WRITE(isp, CDMA2100_CONTROL,
326 			DMA_CNTRL2100_CLEAR_CHAN | DMA_CNTRL2100_RESET_INT);
327 		ISP_WRITE(isp, TDMA2100_CONTROL,
328 			DMA_CNTRL2100_CLEAR_CHAN | DMA_CNTRL2100_RESET_INT);
329 		ISP_WRITE(isp, RDMA2100_CONTROL,
330 			DMA_CNTRL2100_CLEAR_CHAN | DMA_CNTRL2100_RESET_INT);
331 	}
332 
333 	/*
334 	 * Wait for ISP to be ready to go...
335 	 */
336 	loops = MBOX_DELAY_COUNT;
337 	for (;;) {
338 		if (isp->isp_type & ISP_HA_SCSI) {
339 			if (!(ISP_READ(isp, BIU_ICR) & BIU_ICR_SOFT_RESET))
340 				break;
341 		} else {
342 			if (!(ISP_READ(isp, BIU2100_CSR) & BIU2100_SOFT_RESET))
343 				break;
344 		}
345 		SYS_DELAY(100);
346 		if (--loops < 0) {
347 			isp_dumpregs(isp, "chip reset timed out");
348 			return;
349 		}
350 	}
351 
352 	/*
353 	 * After we've fired this chip up, zero out the conf1 register
354 	 * for SCSI adapters and other settings for the 2100.
355 	 */
356 
357 	if (IS_SCSI(isp)) {
358 		ISP_WRITE(isp, BIU_CONF1, 0);
359 	} else {
360 		ISP_WRITE(isp, BIU2100_CSR, 0);
361 	}
362 
363 	/*
364 	 * Reset RISC Processor
365 	 */
366 	ISP_WRITE(isp, HCCR, HCCR_CMD_RESET);
367 	SYS_DELAY(100);
368 
369 	/*
370 	 * Establish some initial burst rate stuff.
371 	 * (only for the 1XX0 boards). This really should
372 	 * be done later after fetching from NVRAM.
373 	 */
374 	if (IS_SCSI(isp)) {
375 		u_int16_t tmp = isp->isp_mdvec->dv_conf1;
376 		/*
377 		 * Busted FIFO. Turn off all but burst enables.
378 		 */
379 		if (isp->isp_type == ISP_HA_SCSI_1040A) {
380 			tmp &= BIU_BURST_ENABLE;
381 		}
382 		ISP_SETBITS(isp, BIU_CONF1, tmp);
383 		if (tmp & BIU_BURST_ENABLE) {
384 			ISP_SETBITS(isp, CDMA_CONF, DMA_ENABLE_BURST);
385 			ISP_SETBITS(isp, DDMA_CONF, DMA_ENABLE_BURST);
386 		}
387 #ifdef	PTI_CARDS
388 		if (((sdparam *) isp->isp_param)->isp_ultramode) {
389                 	while(ISP_READ(isp, RISC_MTR) != 0x1313) {
390 				ISP_WRITE(isp, RISC_MTR, 0x1313);
391 				ISP_WRITE(isp, HCCR, HCCR_CMD_STEP);
392 			}
393                 } else {
394 			ISP_WRITE(isp, RISC_MTR, 0x1212);
395 		}
396 		/*
397 		 * PTI specific register
398 		 */
399 		ISP_WRITE(isp, RISC_EMB, DUAL_BANK)
400 #else
401 		ISP_WRITE(isp, RISC_MTR, 0x1212);
402 #endif
403 	} else {
404 		ISP_WRITE(isp, RISC_MTR2100, 0x1212);
405 	}
406 
407 	ISP_WRITE(isp, HCCR, HCCR_CMD_RELEASE); /* release paused processor */
408 
409 	/*
410 	 * Do MD specific post initialization
411 	 */
412 	ISP_RESET1(isp);
413 
414 	/*
415 	 * Enable interrupts
416 	 */
417 	ENABLE_INTS(isp);
418 
419 	/*
420 	 * Wait for everything to finish firing up...
421 	 */
422 	loops = MBOX_DELAY_COUNT;
423 	while (ISP_READ(isp, OUTMAILBOX0) == MBOX_BUSY) {
424 		SYS_DELAY(100);
425 		if (--loops < 0) {
426 			PRINTF("%s: MBOX_BUSY never cleared on reset\n",
427 			    isp->isp_name);
428 			return;
429 		}
430 	}
431 
432 	/*
433 	 * Up until this point we've done everything by just reading or
434 	 * setting registers. From this point on we rely on at least *some*
435 	 * kind of firmware running in the card.
436 	 */
437 
438 	/*
439 	 * Do some sanity checking.
440 	 */
441 	mbs.param[0] = MBOX_NO_OP;
442 	isp_mboxcmd(isp, &mbs);
443 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
444 		isp_dumpregs(isp, "NOP test failed");
445 		return;
446 	}
447 
448 	if (isp->isp_type & ISP_HA_SCSI) {
449 		mbs.param[0] = MBOX_MAILBOX_REG_TEST;
450 		mbs.param[1] = 0xdead;
451 		mbs.param[2] = 0xbeef;
452 		mbs.param[3] = 0xffff;
453 		mbs.param[4] = 0x1111;
454 		mbs.param[5] = 0xa5a5;
455 		isp_mboxcmd(isp, &mbs);
456 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
457 			isp_dumpregs(isp,
458 				"Mailbox Register test didn't complete");
459 			return;
460 		}
461 		if (mbs.param[1] != 0xdead || mbs.param[2] != 0xbeef ||
462 		    mbs.param[3] != 0xffff || mbs.param[4] != 0x1111 ||
463 		    mbs.param[5] != 0xa5a5) {
464 			isp_dumpregs(isp, "Register Test Failed");
465 			return;
466 		}
467 
468 	}
469 
470 	/*
471 	 * Download new Firmware, unless requested not to do so.
472 	 * This is made slightly trickier in some cases where the
473 	 * firmware of the ROM revision is newer than the revision
474 	 * compiled into the driver. So, where we used to compare
475 	 * versions of our f/w and the ROM f/w, now we just see
476 	 * whether we have f/w at all and whether a config flag
477 	 * has disabled our download.
478 	 */
479 	if ((isp->isp_mdvec->dv_fwlen == 0) ||
480 	    (isp->isp_confopts & ISP_CFG_NORELOAD)) {
481 		dodnld = 0;
482 	}
483 
484 	if (dodnld && isp->isp_mdvec->dv_fwlen) {
485 		for (i = 0; i < isp->isp_mdvec->dv_fwlen; i++) {
486 			mbs.param[0] = MBOX_WRITE_RAM_WORD;
487 			mbs.param[1] = isp->isp_mdvec->dv_codeorg + i;
488 			mbs.param[2] = isp->isp_mdvec->dv_ispfw[i];
489 			isp_mboxcmd(isp, &mbs);
490 			if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
491 				PRINTF("%s: F/W download failed at word %d\n",
492 				    isp->isp_name, i);
493 				dodnld = 0;
494 				goto again;
495 			}
496 		}
497 
498 		/*
499 		 * Verify that it downloaded correctly.
500 		 */
501 		mbs.param[0] = MBOX_VERIFY_CHECKSUM;
502 		mbs.param[1] = isp->isp_mdvec->dv_codeorg;
503 		isp_mboxcmd(isp, &mbs);
504 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
505 			isp_dumpregs(isp, "ram checksum failure");
506 			return;
507 		}
508 	} else {
509 		IDPRINTF(3, ("%s: skipping f/w download\n", isp->isp_name));
510 	}
511 
512 	/*
513 	 * Now start it rolling.
514 	 *
515 	 * If we didn't actually download f/w,
516 	 * we still need to (re)start it.
517 	 */
518 
519 	mbs.param[0] = MBOX_EXEC_FIRMWARE;
520 	if (isp->isp_mdvec->dv_codeorg)
521 		mbs.param[1] = isp->isp_mdvec->dv_codeorg;
522 	else
523 		mbs.param[1] = 0x1000;
524 	isp_mboxcmd(isp, &mbs);
525 
526 	if (isp->isp_type & ISP_HA_SCSI) {
527 		sdparam *sdp = isp->isp_param;
528 		/*
529 		 * Set CLOCK RATE, but only if asked to.
530 		 */
531 		if (sdp->isp_clock) {
532 			mbs.param[0] = MBOX_SET_CLOCK_RATE;
533 			mbs.param[1] = sdp->isp_clock;
534 			isp_mboxcmd(isp, &mbs);
535 			if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
536 				isp_dumpregs(isp, "failed to set CLOCKRATE");
537 				/* but continue */
538 			} else {
539 				IDPRINTF(3, ("%s: setting input clock to %d\n",
540 				    isp->isp_name, sdp->isp_clock));
541 			}
542 		}
543 	}
544 	mbs.param[0] = MBOX_ABOUT_FIRMWARE;
545 	isp_mboxcmd(isp, &mbs);
546 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
547 		isp_dumpregs(isp, "ABOUT FIRMWARE command failed");
548 		return;
549 	}
550 	PRINTF("%s: Board Revision %s, %s F/W Revision %d.%d\n",
551 		isp->isp_name, revname, dodnld? "loaded" : "resident",
552 		mbs.param[1], mbs.param[2]);
553 	if (isp->isp_type & ISP_HA_FC) {
554 		if (ISP_READ(isp, BIU2100_CSR) & BIU2100_PCI64) {
555 			PRINTF("%s: in 64-Bit PCI slot\n", isp->isp_name);
556 		}
557 	}
558 	isp->isp_fwrev = (((u_int16_t) mbs.param[1]) << 10) + mbs.param[2];
559 	if (isp->isp_romfw_rev && dodnld) {
560 		PRINTF("%s: Last F/W revision was %d.%d\n", isp->isp_name,
561 		    isp->isp_romfw_rev >> 10, isp->isp_romfw_rev & 0x3ff);
562 	}
563 	isp_fw_state(isp);
564 	isp->isp_state = ISP_RESETSTATE;
565 }
566 
567 /*
568  * Initialize Parameters of Hardware to a known state.
569  *
570  * Locks are held before coming here.
571  */
572 
573 void
574 isp_init(isp)
575 	struct ispsoftc *isp;
576 {
577 	sdparam *sdp;
578 	mbreg_t mbs;
579 	int tgt;
580 
581 	/*
582 	 * Must do first.
583 	 */
584 	isp_setdfltparm(isp);
585 
586 	/*
587 	 * Set up DMA for the request and result mailboxes.
588 	 */
589 	if (ISP_MBOXDMASETUP(isp) != 0) {
590 		PRINTF("%s: can't setup dma mailboxes\n", isp->isp_name);
591 		return;
592 	}
593 
594 	/*
595 	 * If we're fibre, we have a completely different
596 	 * initialization method.
597 	 */
598 	if (IS_FC(isp)) {
599 		isp_fibre_init(isp);
600 		return;
601 	}
602 	sdp = isp->isp_param;
603 
604 	/*
605 	 * If we have fast memory timing enabled, turn it on.
606 	 */
607 	if (sdp->isp_fast_mttr) {
608 		ISP_WRITE(isp, RISC_MTR, 0x1313);
609 	}
610 
611 	/*
612 	 * Set (possibly new) Initiator ID.
613 	 */
614 	mbs.param[0] = MBOX_SET_INIT_SCSI_ID;
615 	mbs.param[1] = sdp->isp_initiator_id;
616 	isp_mboxcmd(isp, &mbs);
617 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
618 		isp_dumpregs(isp, "failed to set initiator id");
619 		return;
620 	}
621 
622 	/*
623 	 * Set Retry Delay and Count
624 	 */
625 	mbs.param[0] = MBOX_SET_RETRY_COUNT;
626 	mbs.param[1] = sdp->isp_retry_count;
627 	mbs.param[2] = sdp->isp_retry_delay;
628 	isp_mboxcmd(isp, &mbs);
629 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
630 		isp_dumpregs(isp, "failed to set retry count and delay");
631 		return;
632 	}
633 
634 	/*
635 	 * Set ASYNC DATA SETUP time. This is very important.
636 	 */
637 	mbs.param[0] = MBOX_SET_ASYNC_DATA_SETUP_TIME;
638 	mbs.param[1] = sdp->isp_async_data_setup;
639 	isp_mboxcmd(isp, &mbs);
640 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
641 		isp_dumpregs(isp, "failed to set async data setup time");
642 		return;
643 	}
644 
645 	/*
646 	 * Set ACTIVE Negation State.
647 	 */
648 	mbs.param[0] = MBOX_SET_ACTIVE_NEG_STATE;
649 	mbs.param[1] =
650 	    (sdp->isp_req_ack_active_neg << 4) |
651 	    (sdp->isp_data_line_active_neg << 5);
652 	isp_mboxcmd(isp, &mbs);
653 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
654 		isp_dumpregs(isp, "failed to set active neg state");
655 		return;
656 	}
657 
658 	/*
659 	 * Set the Tag Aging limit
660 	 */
661 
662 	mbs.param[0] = MBOX_SET_TAG_AGE_LIMIT;
663 	mbs.param[1] = sdp->isp_tag_aging;
664 	isp_mboxcmd(isp, &mbs);
665 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
666 		isp_dumpregs(isp, "failed to set tag age limit");
667 		return;
668 	}
669 
670 	/*
671 	 * Set selection timeout.
672 	 */
673 
674 	mbs.param[0] = MBOX_SET_SELECT_TIMEOUT;
675 	mbs.param[1] = sdp->isp_selection_timeout;
676 	isp_mboxcmd(isp, &mbs);
677 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
678 		isp_dumpregs(isp, "failed to set selection timeout");
679 		return;
680 	}
681 
682 	/*
683 	 * Set current per-target parameters to a safe minimum.
684 	 */
685 	for (tgt = 0; tgt < MAX_TARGETS; tgt++) {
686 		int maxlun, lun;
687 		u_int16_t sdf;
688 
689 		if (sdp->isp_devparam[tgt].dev_enable == 0)
690 			continue;
691 
692 		sdf = DPARM_SAFE_DFLT;
693 		/*
694 		 * It is not quite clear when this changed over so that
695 		 * we could force narrow and async, so assume >= 7.55.
696 		 *
697 		 * Otherwise, a SCSI bus reset issued below will force
698 		 * the back to the narrow, async state (but see note
699 		 * below also). Technically we should also do without
700 		 * Parity.
701 		 */
702 		if (isp->isp_fwrev >= ISP_FW_REV(7, 55)) {
703 			sdf |= DPARM_NARROW | DPARM_ASYNC;
704 		}
705 
706 		mbs.param[0] = MBOX_SET_TARGET_PARAMS;
707 		mbs.param[1] = tgt << 8;
708 		mbs.param[2] = sdf;
709 		mbs.param[3] = 0;
710 		isp_mboxcmd(isp, &mbs);
711 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
712 			sdf = DPARM_SAFE_DFLT;
713 			mbs.param[0] = MBOX_SET_TARGET_PARAMS;
714 			mbs.param[1] = tgt << 8;
715 			mbs.param[2] = sdf;
716 			mbs.param[3] = 0;
717 			isp_mboxcmd(isp, &mbs);
718 			if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
719 				PRINTF("%s: failed even to set defaults for "
720 				    "target %d\n", isp->isp_name, tgt);
721 				continue;
722 			}
723 		}
724 		sdp->isp_devparam[tgt].cur_dflags = sdf;
725 
726 		maxlun = (isp->isp_fwrev >= ISP_FW_REV(7, 55))? 32 : 8;
727 		for (lun = 0; lun < maxlun; lun++) {
728 			mbs.param[0] = MBOX_SET_DEV_QUEUE_PARAMS;
729 			mbs.param[1] = (tgt << 8) | lun;
730 			mbs.param[2] = sdp->isp_max_queue_depth;
731 			mbs.param[3] = sdp->isp_devparam[tgt].exc_throttle;
732 			isp_mboxcmd(isp, &mbs);
733 			if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
734 				PRINTF("%s: failed to set device queue "
735 				    "parameters for target %d, lun %d\n",
736 				    isp->isp_name, tgt, lun);
737 				break;
738 			}
739 		}
740 		/*
741 		 * And mark this as an unannounced device
742 		 */
743 		sdp->isp_devparam[tgt].dev_announced = 0;
744 	}
745 
746 	mbs.param[0] = MBOX_INIT_RES_QUEUE;
747 	mbs.param[1] = RESULT_QUEUE_LEN;
748 	mbs.param[2] = (u_int16_t) (isp->isp_result_dma >> 16);
749 	mbs.param[3] = (u_int16_t) (isp->isp_result_dma & 0xffff);
750 	mbs.param[4] = 0;
751 	mbs.param[5] = 0;
752 	isp_mboxcmd(isp, &mbs);
753 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
754 		isp_dumpregs(isp, "set of response queue failed");
755 		return;
756 	}
757 	isp->isp_residx = 0;
758 
759 	mbs.param[0] = MBOX_INIT_REQ_QUEUE;
760 	mbs.param[1] = RQUEST_QUEUE_LEN;
761 	mbs.param[2] = (u_int16_t) (isp->isp_rquest_dma >> 16);
762 	mbs.param[3] = (u_int16_t) (isp->isp_rquest_dma & 0xffff);
763 	mbs.param[4] = 0;
764 	mbs.param[5] = 0;
765 	isp_mboxcmd(isp, &mbs);
766 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
767 		isp_dumpregs(isp, "set of request queue failed");
768 		return;
769 	}
770 	isp->isp_reqidx = isp->isp_reqodx = 0;
771 
772 	/*
773 	 *  Turn on Fast Posting
774 	 */
775 #ifndef	ISP_NO_FASTPOST_SCSI
776 	if (isp->isp_fwrev >= ISP_FW_REV(7, 55)) {
777 		mbs.param[0] = MBOX_SET_FW_FEATURES;
778 		mbs.param[1] = FW_FEATURE_FAST_POST;
779 		isp_mboxcmd(isp, &mbs);
780 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
781 			PRINTF("%s: unable to enable FAST Posting\n",
782 			    isp->isp_name);
783 		}
784 	}
785 #endif
786 
787 	/*
788 	 * Let the outer layers decide whether to issue a SCSI bus reset.
789 	 */
790 #if	0
791 	/*
792 	 * XXX: See whether or not for 7.55 F/W or later we
793 	 * XXX: can do without this, and see whether we should
794 	 * XXX: honor the NVRAM SCSI_RESET_DISABLE token.
795 	 */
796 	mbs.param[0] = MBOX_BUS_RESET;
797 	mbs.param[1] = 3;
798 	isp_mboxcmd(isp, &mbs);
799 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
800 		isp_dumpregs(isp, "SCSI bus reset failed");
801 	}
802 	/*
803 	 * This is really important to have set after a bus reset.
804 	 */
805 	isp->isp_sendmarker = 1;
806 #endif
807 	isp->isp_state = ISP_INITSTATE;
808 }
809 
810 /*
811  * Fibre Channel specific initialization.
812  *
813  * Locks are held before coming here.
814  */
815 static void
816 isp_fibre_init(isp)
817 	struct ispsoftc *isp;
818 {
819 	fcparam *fcp;
820 	isp_icb_t *icbp;
821 	mbreg_t mbs;
822 	int count, loopid;
823 
824 	fcp = isp->isp_param;
825 
826 	/*
827 	 * For systems that don't have BIOS methods for which
828 	 * we can easily change the NVRAM based loopid, we'll
829 	 * override that here. Note that when we initialize
830 	 * the firmware we may get back a different loopid than
831 	 * we asked for anyway. XXX This is probably not the
832 	 * best way to figure this out XXX
833 	 */
834 #ifndef	__i386__
835 	loopid = DEFAULT_LOOPID;
836 #else
837 	loopid = fcp->isp_loopid;
838 #endif
839 
840 #if	defined(ISP2100_FABRIC) && defined(ISP2100_SCCLUN)
841 	PRINTF("%s: Fabric Support, Expanded Lun Support\n", isp->isp_name);
842 #endif
843 #if	defined(ISP2100_FABRIC) && !defined(ISP2100_SCCLUN)
844 	PRINTF("%s: Fabric Support\n", isp->isp_name);
845 #endif
846 #if	!defined(ISP2100_FABRIC) && defined(ISP2100_SCCLUN)
847 	PRINTF("%s: Expanded Lun Support\n", isp->isp_name);
848 #endif
849 
850 	icbp = (isp_icb_t *) fcp->isp_scratch;
851 	MEMZERO(icbp, sizeof (*icbp));
852 
853 	icbp->icb_version = ICB_VERSION1;
854 #ifdef	ISP_TARGET_MODE
855 	fcp->isp_fwoptions = ICBOPT_TGT_ENABLE|ICBOPT_INI_TGTTYPE;
856 #else
857 	fcp->isp_fwoptions = 0;
858 #endif
859 	fcp->isp_fwoptions |= ICBOPT_INI_ADISC|ICBOPT_FAIRNESS;
860 	fcp->isp_fwoptions |= ICBOPT_PDBCHANGE_AE;
861 	fcp->isp_fwoptions |= ICBOPT_HARD_ADDRESS;
862 #ifndef	ISP_NO_FASTPOST_FC
863 	fcp->isp_fwoptions |= ICBOPT_FAST_POST;
864 #endif
865 #ifdef	CHECKME
866 	fcp->isp_fwoptions |= ICBOPT_USE_PORTNAME;
867 #endif
868 #ifdef	ISP2100_FABRIC
869 	fcp->isp_fwoptions |= ICBOPT_FULL_LOGIN;
870 #endif
871 
872 	icbp->icb_fwoptions = fcp->isp_fwoptions;
873 	icbp->icb_maxfrmlen = fcp->isp_maxfrmlen;
874 	if (icbp->icb_maxfrmlen < ICB_MIN_FRMLEN ||
875 	    icbp->icb_maxfrmlen > ICB_MAX_FRMLEN) {
876 		PRINTF("%s: bad frame length (%d) from NVRAM- using %d\n",
877 		    isp->isp_name, fcp->isp_maxfrmlen, ICB_DFLT_FRMLEN);
878 	}
879 	icbp->icb_maxalloc = fcp->isp_maxalloc;
880 	icbp->icb_execthrottle = fcp->isp_execthrottle;
881 	icbp->icb_retry_delay = fcp->isp_retry_delay;
882 	icbp->icb_retry_count = fcp->isp_retry_count;
883 	icbp->icb_hardaddr = loopid;
884 
885 	MAKE_NODE_NAME_FROM_WWN(icbp->icb_nodename, fcp->isp_wwn);
886 	if (icbp->icb_fwoptions & ICBOPT_USE_PORTNAME) {
887 		u_int64_t portname = fcp->isp_wwn | (2LL << 56);
888 		MAKE_NODE_NAME_FROM_WWN(icbp->icb_nodename, portname);
889 	}
890 	icbp->icb_rqstqlen = RQUEST_QUEUE_LEN;
891 	icbp->icb_rsltqlen = RESULT_QUEUE_LEN;
892 	icbp->icb_rqstaddr[RQRSP_ADDR0015] =
893 	    (u_int16_t) (isp->isp_rquest_dma & 0xffff);
894 	icbp->icb_rqstaddr[RQRSP_ADDR1631] =
895 	    (u_int16_t) (isp->isp_rquest_dma >> 16);
896 	icbp->icb_respaddr[RQRSP_ADDR0015] =
897 	    (u_int16_t) (isp->isp_result_dma & 0xffff);
898 	icbp->icb_respaddr[RQRSP_ADDR1631] =
899 	    (u_int16_t) (isp->isp_result_dma >> 16);
900 	MemoryBarrier();
901 
902 	for (count = 0; count < 10; count++) {
903 		mbs.param[0] = MBOX_INIT_FIRMWARE;
904 		mbs.param[1] = 0;
905 		mbs.param[2] = (u_int16_t) (fcp->isp_scdma >> 16);
906 		mbs.param[3] = (u_int16_t) (fcp->isp_scdma & 0xffff);
907 		mbs.param[4] = 0;
908 		mbs.param[5] = 0;
909 		mbs.param[6] = 0;
910 		mbs.param[7] = 0;
911 
912 		isp_mboxcmd(isp, &mbs);
913 
914 		switch (mbs.param[0]) {
915 		case MBOX_COMMAND_COMPLETE:
916 			count = 10;
917 			break;
918 		case ASYNC_PDB_CHANGED:
919 			isp_mark_getpdb_all(isp);
920 			/* FALL THROUGH */
921 		case ASYNC_LIP_OCCURRED:
922 		case ASYNC_LOOP_UP:
923 		case ASYNC_LOOP_DOWN:
924 		case ASYNC_LOOP_RESET:
925 		case ASYNC_CHANGE_NOTIFY:
926 			if (count > 9) {
927 				PRINTF("%s: too many retries to get going- "
928 				    "giving up\n", isp->isp_name);
929 				return;
930 			}
931 			break;
932 		default:
933 			isp_dumpregs(isp, "INIT FIRMWARE failed");
934 			return;
935 		}
936 	}
937 	isp->isp_reqidx = isp->isp_reqodx = 0;
938 	isp->isp_residx = 0;
939 	isp->isp_sendmarker = 1;
940 
941 	/*
942 	 * Whatever happens, we're now committed to being here.
943 	 */
944 	isp->isp_state = ISP_INITSTATE;
945 	fcp->isp_fwstate = FW_CONFIG_WAIT;
946 
947 #ifdef	ISP_TARGET_MODE
948 	if (isp_modify_lun(isp, 0, 1, 1)) {
949 		PRINTF("%s: failed to enable target mode\n", isp->isp_name);
950 	}
951 #endif
952 }
953 
954 /*
955  * Fibre Channel Support- get the port database for the id.
956  *
957  * Locks are held before coming here. Return 0 if success,
958  * else failure.
959  */
960 
961 static void
962 isp_mark_getpdb_all(isp)
963 	struct ispsoftc *isp;
964 {
965 	isp_pdb_t *p;
966 	fcparam *fcp = (fcparam *) isp->isp_param;
967 	for (p = &fcp->isp_pdb[0]; p < &fcp->isp_pdb[MAX_FC_TARG]; p++) {
968 		p->pdb_options = INVALID_PDB_OPTIONS;
969 	}
970 }
971 
972 static int
973 isp_getpdb(isp, id, pdbp)
974 	struct ispsoftc *isp;
975 	int id;
976 	isp_pdb_t *pdbp;
977 {
978 #ifdef	GETPDB_WORKING_YET
979 	fcparam *fcp = (fcparam *) isp->isp_param;
980 	mbreg_t mbs;
981 
982 	/*
983 	 * Get Port Queue Parameters first- this is
984 	 * a Q&D way to see whether we're logged into
985 	 * this port.
986 	 */
987 	mbs.param[0] = MBOX_GET_DEV_QUEUE_PARAMS;
988 	mbs.param[1] = id << 8;
989 	mbs.param[2] = 0;
990 #ifdef	ISP2100_SCCLUN
991 	mbs.param[3] = 0;
992 #endif
993 	isp_mboxcmd(isp, &mbs);
994 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE)
995 		return (-1);
996 
997 	mbs.param[0] = MBOX_GET_PORT_DB;
998 	mbs.param[1] = id << 8;
999 	mbs.param[2] = (u_int16_t) (fcp->isp_scdma >> 16);
1000 	mbs.param[3] = (u_int16_t) (fcp->isp_scdma & 0xffff);
1001 	mbs.param[4] = 0;
1002 	mbs.param[5] = 0;
1003 	mbs.param[6] = 0;
1004 	mbs.param[7] = 0;
1005 	isp_mboxcmd(isp, &mbs);
1006 	switch (mbs.param[0]) {
1007 	case MBOX_COMMAND_COMPLETE:
1008 		MemoryBarrier();
1009 		MEMCPY(pdbp, fcp->isp_scratch, sizeof (isp_pdb_t));
1010 		break;
1011 	case MBOX_HOST_INTERFACE_ERROR:
1012 		PRINTF("%s: DMA error getting port database\n", isp->isp_name);
1013 		return (-1);
1014 	case MBOX_COMMAND_PARAM_ERROR:
1015 		/* Not Logged In */
1016 		IDPRINTF(3, ("%s: Comand Param Error on Get Port Database\n",
1017 		   isp->isp_name));
1018 		return (-1);
1019 	default:
1020 		PRINTF("%s: error 0x%x getting port database for ID %d\n",
1021 		    isp->isp_name, mbs.param[0], id);
1022 		return (-1);
1023 	}
1024 #else
1025 	pdbp->pdb_options = 1;
1026 #endif
1027 	return (0);
1028 }
1029 
1030 /*
1031  * Make sure we have good FC link and know our Loop ID.
1032  */
1033 
1034 static int
1035 isp_fclink_test(isp)
1036 	struct ispsoftc *isp;
1037 {
1038 	mbreg_t mbs;
1039 	int count;
1040 	u_int8_t lwfs;
1041 	fcparam *fcp;
1042 
1043 	fcp = isp->isp_param;
1044 
1045 	/*
1046 	 * Wait up to N microseconds for F/W to go to a ready state.
1047 	 * This is a platform specific
1048 	 */
1049 	lwfs = FW_CONFIG_WAIT;
1050 	for (count = 0; count < FC_FW_READY_DELAY; count += 100) {
1051 		isp_fw_state(isp);
1052 		if (lwfs != fcp->isp_fwstate) {
1053 			PRINTF("%s: Firmware State %s -> %s\n",
1054 			    isp->isp_name, isp2100_fw_statename((int)lwfs),
1055 			    isp2100_fw_statename((int)fcp->isp_fwstate));
1056 			lwfs = fcp->isp_fwstate;
1057 		}
1058 		if (fcp->isp_fwstate == FW_READY) {
1059 			break;
1060 		}
1061 		SYS_DELAY(100);	/* wait 100 microseconds */
1062 	}
1063 
1064 	/*
1065 	 * If we haven't gone to 'ready' state, return.
1066 	 */
1067 	if (fcp->isp_fwstate != FW_READY) {
1068 		return (-1);
1069 	}
1070 	/*
1071 	 * Get our Loop ID (if possible). We really need to have it.
1072 	 */
1073 	mbs.param[0] = MBOX_GET_LOOP_ID;
1074 	isp_mboxcmd(isp, &mbs);
1075 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
1076 		PRINTF("%s: GET LOOP ID failed\n", isp->isp_name);
1077 		return (-1);
1078 	}
1079 	fcp->isp_loopid = mbs.param[1];
1080 	fcp->isp_alpa = mbs.param[2];
1081 	PRINTF("%s: Loop ID %d, ALPA 0x%x\n", isp->isp_name,
1082 	    fcp->isp_loopid, fcp->isp_alpa);
1083 	return (0);
1084 
1085 }
1086 
1087 /*
1088  * Start a command. Locking is assumed done in the caller.
1089  */
1090 
1091 int32_t
1092 ispscsicmd(xs)
1093 	ISP_SCSI_XFER_T *xs;
1094 {
1095 	struct ispsoftc *isp;
1096 	u_int8_t iptr, optr;
1097 	union {
1098 		ispreq_t *_reqp;
1099 		ispreqt2_t *_t2reqp;
1100 	} _u;
1101 #define	reqp	_u._reqp
1102 #define	t2reqp	_u._t2reqp
1103 #define	UZSIZE	max(sizeof (ispreq_t), sizeof (ispreqt2_t))
1104 	int i, rqidx;
1105 
1106 	XS_INITERR(xs);
1107 	isp = XS_ISP(xs);
1108 
1109 	if (isp->isp_state != ISP_RUNSTATE) {
1110 		PRINTF("%s: adapter not ready\n", isp->isp_name);
1111 		XS_SETERR(xs, HBA_BOTCH);
1112 		return (CMD_COMPLETE);
1113 	}
1114 
1115 	/*
1116 	 * We *could* do the different sequence type that has close
1117 	 * to the whole Queue Entry for the command,...
1118 	 */
1119 
1120 	if (XS_CDBLEN(xs) > ((isp->isp_type & ISP_HA_FC)? 16 : 12)) {
1121 		PRINTF("%s: unsupported cdb length (%d)\n",
1122 		    isp->isp_name, XS_CDBLEN(xs));
1123 		XS_SETERR(xs, HBA_BOTCH);
1124 		return (CMD_COMPLETE);
1125 	}
1126 
1127 	/*
1128 	 * Check to see whether we have good firmware state still or
1129 	 * need to refresh our port database for this target.
1130 	 */
1131 	if (IS_FC(isp)) {
1132 		fcparam *fcp = isp->isp_param;
1133 		isp_pdb_t *pdbp = &fcp->isp_pdb[XS_TGT(xs)];
1134 
1135 		/*
1136 		 * Check for f/w being in ready state. Well, okay,
1137 		 * our cached copy of it...
1138 		 */
1139 		if (fcp->isp_fwstate != FW_READY) {
1140 			if (isp_fclink_test(isp)) {
1141 				XS_SETERR(xs, HBA_SELTIMEOUT);
1142 				return (CMD_COMPLETE);
1143 			}
1144 		}
1145 		/*
1146 		 * Here's the spot we would need to find out whether
1147 		 * the port names have changed, whether it's still
1148 		 * a target role, etc..
1149 		 */
1150 		if (pdbp->pdb_options == INVALID_PDB_OPTIONS) {
1151 			/*
1152 			 * If we don't know what it is- don't talk to it.
1153 			 * This also handles cases where it's not logged
1154 			 * into this port/target.
1155 			 */
1156 			if (isp_getpdb(isp, XS_TGT(xs), pdbp)) {
1157 				XS_SETERR(xs, HBA_SELTIMEOUT);
1158 				return (CMD_COMPLETE);
1159 #ifdef	GETPDB_WORKING_YET
1160 			} else {
1161 				isp_async(isp, ISPASYNC_PDB_CHANGE_COMPLETE,
1162 				    (void *) (long) XS_TGT(xs));
1163 #endif
1164 			}
1165 		}
1166 	}
1167 
1168 	/*
1169 	 * Next check to see if any HBA or Device
1170 	 * parameters need to be updated.
1171 	 */
1172 	if (isp->isp_update) {
1173 		isp_update(isp);
1174 	}
1175 
1176 	optr = isp->isp_reqodx = ISP_READ(isp, OUTMAILBOX4);
1177 	iptr = isp->isp_reqidx;
1178 
1179 	reqp = (ispreq_t *) ISP_QUEUE_ENTRY(isp->isp_rquest, iptr);
1180 	iptr = ISP_NXT_QENTRY(iptr, RQUEST_QUEUE_LEN);
1181 	if (iptr == optr) {
1182 		IDPRINTF(2, ("%s: Request Queue Overflow\n", isp->isp_name));
1183 		XS_SETERR(xs, HBA_BOTCH);
1184 		return (CMD_EAGAIN);
1185 	}
1186 
1187 	if (isp->isp_sendmarker) {
1188 		u_int8_t niptr;
1189 		ispmarkreq_t *marker = (ispmarkreq_t *) reqp;
1190 
1191 		MEMZERO((void *) marker, sizeof (*marker));
1192 		marker->req_header.rqs_entry_count = 1;
1193 		marker->req_header.rqs_entry_type = RQSTYPE_MARKER;
1194 		marker->req_modifier = SYNC_ALL;
1195 
1196 		/*
1197 		 * Unconditionally update the input pointer anyway.
1198 		 */
1199 		ISP_WRITE(isp, INMAILBOX4, iptr);
1200 		isp->isp_reqidx = iptr;
1201 
1202 		niptr = ISP_NXT_QENTRY(iptr, RQUEST_QUEUE_LEN);
1203 		if (niptr == optr) {
1204 			IDPRINTF(2, ("%s: Request Queue Overflow+\n",
1205 			    isp->isp_name));
1206 			XS_SETERR(xs, HBA_BOTCH);
1207 			return (CMD_EAGAIN);
1208 		}
1209 		reqp = (ispreq_t *) ISP_QUEUE_ENTRY(isp->isp_rquest, iptr);
1210 		iptr = niptr;
1211 	}
1212 
1213 	MEMZERO((void *) reqp, UZSIZE);
1214 	reqp->req_header.rqs_entry_count = 1;
1215 	if (isp->isp_type & ISP_HA_FC) {
1216 		reqp->req_header.rqs_entry_type = RQSTYPE_T2RQS;
1217 	} else {
1218 		reqp->req_header.rqs_entry_type = RQSTYPE_REQUEST;
1219 	}
1220 	reqp->req_header.rqs_flags = 0;
1221 	reqp->req_header.rqs_seqno = isp->isp_seqno++;
1222 
1223 	for (rqidx = 0; rqidx < RQUEST_QUEUE_LEN; rqidx++) {
1224 		if (isp->isp_xflist[rqidx] == NULL)
1225 			break;
1226 	}
1227 	if (rqidx == RQUEST_QUEUE_LEN) {
1228 		IDPRINTF(2, ("%s: out of xflist pointers\n", isp->isp_name));
1229 		XS_SETERR(xs, HBA_BOTCH);
1230 		return (CMD_EAGAIN);
1231 	} else {
1232 		/*
1233 		 * Never have a handle that is zero, so
1234 		 * set req_handle off by one.
1235 		 */
1236 		isp->isp_xflist[rqidx] = xs;
1237 		reqp->req_handle = rqidx+1;
1238 	}
1239 
1240 	if (isp->isp_type & ISP_HA_FC) {
1241 		/*
1242 		 * See comment in isp_intr
1243 		 */
1244 		XS_RESID(xs) = 0;
1245 		/*
1246 		 * Fibre Channel always requires some kind of tag.
1247 		 * If we're marked as "Can't Tag", just do simple
1248 		 * instead of ordered tags. It's pretty clear to me
1249 		 * that we shouldn't do head of queue tagging in
1250 		 * this case.
1251 		 */
1252 		if (XS_CANTAG(xs)) {
1253 			t2reqp->req_flags = XS_KINDOF_TAG(xs);
1254 		} else {
1255  			t2reqp->req_flags = REQFLAG_STAG;
1256 		}
1257 	} else {
1258 		sdparam *sdp = (sdparam *)isp->isp_param;
1259 		if ((sdp->isp_devparam[XS_TGT(xs)].cur_dflags & DPARM_TQING) &&
1260 		    XS_CANTAG(xs)) {
1261 			reqp->req_flags = XS_KINDOF_TAG(xs);
1262 		} else {
1263 			reqp->req_flags = 0;
1264 		}
1265 	}
1266 	reqp->req_target = XS_TGT(xs);
1267 	if (isp->isp_type & ISP_HA_SCSI) {
1268 		reqp->req_lun_trn = XS_LUN(xs);
1269 		reqp->req_cdblen = XS_CDBLEN(xs);
1270 	} else {
1271 #ifdef	ISP2100_SCCLUN
1272 		reqp->req_scclun = XS_LUN(xs);
1273 #else
1274 		reqp->req_lun_trn = XS_LUN(xs);
1275 #endif
1276 
1277 	}
1278 	MEMCPY(reqp->req_cdb, XS_CDBP(xs), XS_CDBLEN(xs));
1279 
1280 	IDPRINTF(5, ("%s(%d.%d): START%d cmd 0x%x datalen %d\n", isp->isp_name,
1281 	    XS_TGT(xs), XS_LUN(xs), reqp->req_header.rqs_seqno,
1282 	    reqp->req_cdb[0], XS_XFRLEN(xs)));
1283 
1284 	reqp->req_time = XS_TIME(xs) / 1000;
1285 	if (reqp->req_time == 0 && XS_TIME(xs))
1286 		reqp->req_time = 1;
1287 
1288 	/*
1289 	 * Always give a bit more leeway to commands after a bus reset.
1290 	 */
1291 	if (isp->isp_sendmarker && reqp->req_time < 5)
1292 		reqp->req_time = 5;
1293 
1294 	i = ISP_DMASETUP(isp, xs, reqp, &iptr, optr);
1295 	if (i != CMD_QUEUED) {
1296 		/*
1297 		 * Take memory of it away...
1298 		 */
1299 		isp->isp_xflist[rqidx] = NULL;
1300 		/*
1301 		 * dmasetup sets actual error in packet, and
1302 		 * return what we were given to return.
1303 		 */
1304 		return (i);
1305 	}
1306 	XS_SETERR(xs, HBA_NOERROR);
1307 	MemoryBarrier();
1308 	ISP_WRITE(isp, INMAILBOX4, iptr);
1309 	isp->isp_reqidx = iptr;
1310 	isp->isp_nactive++;
1311 	if (isp->isp_sendmarker)
1312 		isp->isp_sendmarker = 0;
1313 	return (CMD_QUEUED);
1314 #undef	reqp
1315 #undef	t2reqp
1316 }
1317 
1318 /*
1319  * isp control
1320  * Locks (ints blocked) assumed held.
1321  */
1322 
1323 int
1324 isp_control(isp, ctl, arg)
1325 	struct ispsoftc *isp;
1326 	ispctl_t ctl;
1327 	void *arg;
1328 {
1329 	ISP_SCSI_XFER_T *xs;
1330 	mbreg_t mbs;
1331 	int i;
1332 
1333 	switch (ctl) {
1334 	default:
1335 		PRINTF("%s: isp_control unknown control op %x\n",
1336 		    isp->isp_name, ctl);
1337 		break;
1338 
1339 	case ISPCTL_RESET_BUS:
1340 		/*
1341 		 * This is really important to have set after a bus reset.
1342 		 */
1343 		isp->isp_sendmarker = 1;
1344 
1345 		/*
1346 		 * Issue a bus reset.
1347 		 */
1348 		mbs.param[0] = MBOX_BUS_RESET;
1349 		if (isp->isp_type & ISP_HA_SCSI) {
1350 			mbs.param[1] =
1351 			    ((sdparam *) isp->isp_param)->isp_bus_reset_delay;
1352 			if (mbs.param[1] < 2)
1353 				mbs.param[1] = 2;
1354 		} else {
1355 			/*
1356 			 * Unparameterized.
1357 			 */
1358 			mbs.param[1] = 5;
1359 		}
1360 		isp_mboxcmd(isp, &mbs);
1361 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
1362 			isp_dumpregs(isp, "isp_control SCSI bus reset failed");
1363 			break;
1364 		}
1365 		PRINTF("%s: driver initiated bus reset\n", isp->isp_name);
1366 		return (0);
1367 
1368         case ISPCTL_RESET_DEV:
1369 		mbs.param[0] = MBOX_ABORT_TARGET;
1370 		mbs.param[1] = ((long)arg) << 8;
1371 		mbs.param[2] = 3;	/* 'delay', in seconds */
1372 		isp_mboxcmd(isp, &mbs);
1373 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
1374 			isp_dumpregs(isp, "Target Reset Failed");
1375 			break;
1376 		}
1377 		PRINTF("%s: Target %d Reset Succeeded\n", isp->isp_name,
1378 		    (int) ((long) arg));
1379 		isp->isp_sendmarker = 1;
1380 		return (0);
1381 
1382         case ISPCTL_ABORT_CMD:
1383 		xs = (ISP_SCSI_XFER_T *) arg;
1384 		for (i = 0; i < RQUEST_QUEUE_LEN; i++) {
1385 			if (xs == isp->isp_xflist[i]) {
1386 				break;
1387 			}
1388 		}
1389 		if (i == RQUEST_QUEUE_LEN) {
1390 			PRINTF("%s: isp_control- cannot find command to abort "
1391 			    "in active list\n", isp->isp_name);
1392 			break;
1393 		}
1394 		mbs.param[0] = MBOX_ABORT;
1395 #ifdef	ISP2100_SCCLUN
1396 		if (isp->isp_type & ISP_HA_FC) {
1397 			mbs.param[1] = XS_TGT(xs) << 8;
1398 			mbs.param[4] = 0;
1399 			mbs.param[5] = 0;
1400 			mbs.param[6] = XS_LUN(xs);
1401 		} else {
1402 			mbs.param[1] = XS_TGT(xs) << 8 | XS_LUN(xs);
1403 		}
1404 #else
1405 		mbs.param[1] = XS_TGT(xs) << 8 | XS_LUN(xs);
1406 #endif
1407 		mbs.param[2] = (i+1) >> 16;
1408 		mbs.param[3] = (i+1) & 0xffff;
1409 		isp_mboxcmd(isp, &mbs);
1410 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
1411 			PRINTF("%s: isp_control MBOX_ABORT failure (code %x)\n",
1412 			    isp->isp_name, mbs.param[0]);
1413 			break;
1414 		}
1415 		PRINTF("%s: command for target %d lun %d was aborted\n",
1416 		    isp->isp_name, XS_TGT(xs), XS_LUN(xs));
1417 		return (0);
1418 
1419 	case ISPCTL_UPDATE_PARAMS:
1420 		isp_update(isp);
1421 		return(0);
1422 
1423 	case ISPCTL_FCLINK_TEST:
1424 		return (isp_fclink_test(isp));
1425 	}
1426 	return (-1);
1427 }
1428 
1429 /*
1430  * Interrupt Service Routine(s).
1431  *
1432  * External (OS) framework has done the appropriate locking,
1433  * and the locking will be held throughout this function.
1434  */
1435 
1436 int
1437 isp_intr(arg)
1438 	void *arg;
1439 {
1440 	ISP_SCSI_XFER_T *complist[RESULT_QUEUE_LEN], *xs;
1441 	struct ispsoftc *isp = arg;
1442 	u_int8_t iptr, optr;
1443 	u_int16_t isr;
1444 	int i, nlooked = 0, ndone = 0;
1445 
1446 	isr = ISP_READ(isp, BIU_ISR);
1447 	if (isp->isp_type & ISP_HA_FC) {
1448 		if (isr == 0 || (isr & BIU2100_ISR_RISC_INT) == 0) {
1449 			if (isr) {
1450 				IDPRINTF(4, ("%s: isp_intr isr=%x\n",
1451 					     isp->isp_name, isr));
1452 			}
1453 			return (0);
1454 		}
1455 	} else {
1456 		if (isr == 0 || (isr & BIU_ISR_RISC_INT) == 0) {
1457 			if (isr) {
1458 				IDPRINTF(4, ("%s: isp_intr isr=%x\n",
1459 					     isp->isp_name, isr));
1460 			}
1461 			return (0);
1462 		}
1463 	}
1464 
1465 	if (ISP_READ(isp, BIU_SEMA) & 1) {
1466 		u_int16_t mbox = ISP_READ(isp, OUTMAILBOX0);
1467 		if (mbox & 0x4000) {
1468 			if (mbox != MBOX_COMMAND_COMPLETE) {
1469 				PRINTF("%s: isp_intr sees 0x%x\n",
1470 				    isp->isp_name,mbox);
1471 			}
1472 			ISP_WRITE(isp, BIU_SEMA, 0);
1473 		} else {
1474 			u_int32_t fhandle = isp_parse_async(isp, (int) mbox);
1475 			ISP_WRITE(isp, BIU_SEMA, 0);
1476 			if (fhandle < 0) {
1477 				return (1);
1478 			} else if (fhandle > 0) {
1479 				xs = (ISP_SCSI_XFER_T *)
1480 				    isp->isp_xflist[fhandle - 1];
1481 				isp->isp_xflist[fhandle - 1] = NULL;
1482 				/*
1483 				 * Since we don't have a result queue entry
1484 				 * item, we must believe that SCSI status is
1485 				 * zero and that all data transferred.
1486 				 */
1487 				XS_RESID(xs) = 0;
1488 				XS_STS(xs) = 0;
1489 				if (XS_XFRLEN(xs)) {
1490 					ISP_DMAFREE(isp, xs, fhandle - 1);
1491 				}
1492 				if (isp->isp_nactive > 0)
1493 				    isp->isp_nactive--;
1494 				complist[ndone++] = xs;
1495 			}
1496 		}
1497 	}
1498 	ISP_WRITE(isp, HCCR, HCCR_CMD_CLEAR_RISC_INT);
1499 
1500 	optr = isp->isp_residx;
1501 	iptr = ISP_READ(isp, OUTMAILBOX5);
1502 
1503 	if (optr == iptr) {
1504 		IDPRINTF(4, ("why intr? isr %x iptr %x optr %x\n",
1505 		    isr, optr, iptr));
1506 	}
1507 	ENABLE_INTS(isp);
1508 
1509 	while (optr != iptr) {
1510 		ispstatusreq_t *sp;
1511 		u_int8_t oop;
1512 		int buddaboom = 0;
1513 
1514 		sp = (ispstatusreq_t *) ISP_QUEUE_ENTRY(isp->isp_result, optr);
1515 		oop = optr;
1516 		optr = ISP_NXT_QENTRY(optr, RESULT_QUEUE_LEN);
1517 		nlooked++;
1518 		MemoryBarrier();
1519 		if (sp->req_header.rqs_entry_type != RQSTYPE_RESPONSE) {
1520 			if (isp_handle_other_response(isp, sp, &optr) == 0) {
1521 				ISP_WRITE(isp, INMAILBOX5, optr);
1522 				continue;
1523 			}
1524 			/*
1525 			 * It really has to be a bounced request just copied
1526 			 * from the request queue to the response queue.
1527 			 */
1528 
1529 			if (sp->req_header.rqs_entry_type != RQSTYPE_REQUEST) {
1530 				ISP_WRITE(isp, INMAILBOX5, optr);
1531 				continue;
1532 			}
1533 			PRINTF("%s: not RESPONSE in RESPONSE Queue "
1534 			    "(type 0x%x) @ idx %d (next %d)\n", isp->isp_name,
1535 			    sp->req_header.rqs_entry_type, oop, optr);
1536 			buddaboom = 1;
1537 		}
1538 
1539 		if (sp->req_header.rqs_flags & 0xf) {
1540 			if (sp->req_header.rqs_flags & RQSFLAG_CONTINUATION) {
1541 				ISP_WRITE(isp, INMAILBOX5, optr);
1542 				continue;
1543 			}
1544 			PRINTF("%s: rqs_flags=%x", isp->isp_name,
1545 				sp->req_header.rqs_flags & 0xf);
1546 			if (sp->req_header.rqs_flags & RQSFLAG_FULL) {
1547 				PRINTF("%s: internal queues full\n",
1548 				    isp->isp_name);
1549 				/* XXXX: this command *could* get restarted */
1550 				buddaboom++;
1551 			}
1552 			if (sp->req_header.rqs_flags & RQSFLAG_BADHEADER) {
1553 				PRINTF("%s: bad header\n", isp->isp_name);
1554 				buddaboom++;
1555 			}
1556 			if (sp->req_header.rqs_flags & RQSFLAG_BADPACKET) {
1557 				PRINTF("%s: bad request packet\n",
1558 				    isp->isp_name);
1559 				buddaboom++;
1560 			}
1561 		}
1562 		if (sp->req_handle > RQUEST_QUEUE_LEN || sp->req_handle < 1) {
1563 			PRINTF("%s: bad request handle %d\n", isp->isp_name,
1564 				sp->req_handle);
1565 			ISP_WRITE(isp, INMAILBOX5, optr);
1566 			continue;
1567 		}
1568 		xs = (ISP_SCSI_XFER_T *) isp->isp_xflist[sp->req_handle - 1];
1569 		if (xs == NULL) {
1570 			PRINTF("%s: NULL xs in xflist (handle %x)\n",
1571 			    isp->isp_name, sp->req_handle);
1572 			isp_dumpxflist(isp);
1573 			ISP_WRITE(isp, INMAILBOX5, optr);
1574 			continue;
1575 		}
1576 		isp->isp_xflist[sp->req_handle - 1] = NULL;
1577 		if (sp->req_status_flags & RQSTF_BUS_RESET) {
1578 			isp->isp_sendmarker = 1;
1579 		}
1580 		if (buddaboom) {
1581 			XS_SETERR(xs, HBA_BOTCH);
1582 		}
1583 		XS_STS(xs) = sp->req_scsi_status & 0xff;
1584 		if (isp->isp_type & ISP_HA_SCSI) {
1585 			if (sp->req_state_flags & RQSF_GOT_SENSE) {
1586 				MEMCPY(XS_SNSP(xs), sp->req_sense_data,
1587 					XS_SNSLEN(xs));
1588 				XS_SNS_IS_VALID(xs);
1589 			}
1590 			/*
1591 			 * A new synchronous rate was negotiated for this
1592 			 * target. Mark state such that we'll go look up
1593 			 * that which has changed later.
1594 			 */
1595 			if (sp->req_status_flags & RQSTF_NEGOTIATION) {
1596 				sdparam *sdp = isp->isp_param;
1597 				isp->isp_update = 1;
1598 				sdp->isp_devparam[XS_TGT(xs)].dev_refresh = 1;
1599 			}
1600 		} else {
1601 			if (XS_STS(xs) == SCSI_CHECK) {
1602 				XS_SNS_IS_VALID(xs);
1603 				MEMCPY(XS_SNSP(xs), sp->req_sense_data,
1604 					XS_SNSLEN(xs));
1605 				sp->req_state_flags |= RQSF_GOT_SENSE;
1606 			}
1607 		}
1608 		if (XS_NOERR(xs) && XS_STS(xs) == SCSI_BUSY) {
1609 			XS_SETERR(xs, HBA_TGTBSY);
1610 		}
1611 
1612 		if (sp->req_header.rqs_entry_type == RQSTYPE_RESPONSE) {
1613 			if (XS_NOERR(xs)) {
1614 			    if (sp->req_completion_status != RQCS_COMPLETE) {
1615 				isp_parse_status(isp, sp, xs);
1616 			    } else {
1617 				XS_SETERR(xs, HBA_NOERROR);
1618 			    }
1619 			}
1620 		} else {
1621 			PRINTF("%s: unknown return %x\n", isp->isp_name,
1622 				sp->req_header.rqs_entry_type);
1623 			if (XS_NOERR(xs)) {
1624 				XS_SETERR(xs, HBA_BOTCH);
1625 			}
1626 		}
1627 		if (isp->isp_type & ISP_HA_SCSI) {
1628 			XS_RESID(xs) = sp->req_resid;
1629 		} else if (sp->req_scsi_status & RQCS_RU) {
1630 			XS_RESID(xs) = sp->req_resid;
1631 			IDPRINTF(4, ("%s: cnt %d rsd %d\n", isp->isp_name,
1632 				XS_XFRLEN(xs), sp->req_resid));
1633 		}
1634 		if (XS_XFRLEN(xs)) {
1635 			ISP_DMAFREE(isp, xs, sp->req_handle - 1);
1636 		}
1637 		/*
1638 		 * XXX: If we have a check condition, but no Sense Data,
1639 		 * XXX: mark it as an error (ARQ failed). We need to
1640 		 * XXX: to do a more distinct job because there may
1641 		 * XXX: cases where ARQ is disabled.
1642 		 */
1643 		if (XS_STS(xs) == SCSI_CHECK && !(XS_IS_SNS_VALID(xs))) {
1644 			if (XS_NOERR(xs)) {
1645 				PRINTF("%s: ARQ failure for target %d lun %d\n",
1646 				    isp->isp_name, XS_TGT(xs), XS_LUN(xs));
1647 				XS_SETERR(xs, HBA_ARQFAIL);
1648 			}
1649 		}
1650 		if ((isp->isp_dblev >= 5) ||
1651 		    (isp->isp_dblev > 2 && !XS_NOERR(xs))) {
1652 			PRINTF("%s(%d.%d): FIN%d dl%d resid%d STS %x",
1653 			    isp->isp_name, XS_TGT(xs), XS_LUN(xs),
1654 			    sp->req_header.rqs_seqno, XS_XFRLEN(xs),
1655 			    XS_RESID(xs), XS_STS(xs));
1656 			if (sp->req_state_flags & RQSF_GOT_SENSE) {
1657 				PRINTF(" Skey: %x", XS_SNSKEY(xs));
1658 				if (!(XS_IS_SNS_VALID(xs))) {
1659 					PRINTF(" BUT NOT SET");
1660 				}
1661 			}
1662 			PRINTF(" XS_ERR=0x%x\n", (unsigned int) XS_ERR(xs));
1663 		}
1664 
1665 		if (isp->isp_nactive > 0)
1666 		    isp->isp_nactive--;
1667 		complist[ndone++] = xs;	/* defer completion call until later */
1668 	}
1669 
1670 	/*
1671 	 * If we looked at any commands, then it's valid to find out
1672 	 * what the outpointer is. It also is a trigger to update the
1673 	 * ISP's notion of what we've seen so far.
1674 	 */
1675 	if (nlooked) {
1676 		ISP_WRITE(isp, INMAILBOX5, optr);
1677 	 	isp->isp_reqodx = ISP_READ(isp, OUTMAILBOX4);
1678 	}
1679 	isp->isp_residx = optr;
1680 	for (i = 0; i < ndone; i++) {
1681 		xs = complist[i];
1682 		if (xs) {
1683 			XS_CMD_DONE(xs);
1684 		}
1685 	}
1686 	return (1);
1687 }
1688 
1689 /*
1690  * Support routines.
1691  */
1692 
1693 static int
1694 isp_parse_async(isp, mbox)
1695 	struct ispsoftc *isp;
1696 	int mbox;
1697 {
1698 	u_int32_t fast_post_handle = 0;
1699 
1700 	switch (mbox) {
1701 	case MBOX_COMMAND_COMPLETE:	/* sometimes these show up */
1702 		break;
1703 	case ASYNC_BUS_RESET:
1704 		isp_async(isp, ISPASYNC_BUS_RESET, NULL);
1705 		isp->isp_sendmarker = 1;
1706 #ifdef	ISP_TARGET_MODE
1707 		isp_notify_ack(isp, NULL);
1708 #endif
1709 		break;
1710 
1711 	case ASYNC_SYSTEM_ERROR:
1712 		mbox = ISP_READ(isp, OUTMAILBOX1);
1713 		PRINTF("%s: Internal FW Error @ RISC Addr 0x%x\n",
1714 		    isp->isp_name, mbox);
1715 		isp_restart(isp);
1716 		/* no point continuing after this */
1717 		return (-1);
1718 
1719 	case ASYNC_RQS_XFER_ERR:
1720 		PRINTF("%s: Request Queue Transfer Error\n", isp->isp_name);
1721 		break;
1722 
1723 	case ASYNC_RSP_XFER_ERR:
1724 		PRINTF("%s: Response Queue Transfer Error\n", isp->isp_name);
1725 		break;
1726 
1727 	case ASYNC_QWAKEUP:
1728 		/* don't need to be chatty */
1729 		mbox = ISP_READ(isp, OUTMAILBOX4);
1730 		break;
1731 
1732 	case ASYNC_TIMEOUT_RESET:
1733 		PRINTF("%s: timeout initiated SCSI bus reset\n", isp->isp_name);
1734 		isp->isp_sendmarker = 1;
1735 #ifdef	ISP_TARGET_MODE
1736 		isp_notify_ack(isp, NULL);
1737 #endif
1738 		break;
1739 
1740 	case ASYNC_DEVICE_RESET:
1741 		isp->isp_sendmarker = 1;
1742 		PRINTF("%s: device reset\n", isp->isp_name);
1743 #ifdef	ISP_TARGET_MODE
1744 		isp_notify_ack(isp, NULL);
1745 #endif
1746 		break;
1747 
1748 	case ASYNC_EXTMSG_UNDERRUN:
1749 		PRINTF("%s: extended message underrun\n", isp->isp_name);
1750 		break;
1751 
1752 	case ASYNC_SCAM_INT:
1753 		PRINTF("%s: SCAM interrupt\n", isp->isp_name);
1754 		break;
1755 
1756 	case ASYNC_HUNG_SCSI:
1757 		PRINTF("%s: stalled SCSI Bus after DATA Overrun\n",
1758 		    isp->isp_name);
1759 		/* XXX: Need to issue SCSI reset at this point */
1760 		break;
1761 
1762 	case ASYNC_KILLED_BUS:
1763 		PRINTF("%s: SCSI Bus reset after DATA Overrun\n",
1764 		    isp->isp_name);
1765 		break;
1766 
1767 	case ASYNC_BUS_TRANSIT:
1768 		PRINTF("%s: LBD->HVD Transition 0x%x\n",
1769 		    isp->isp_name, ISP_READ(isp, OUTMAILBOX1));
1770 		break;
1771 
1772 	case ASYNC_CMD_CMPLT:
1773 		fast_post_handle = (ISP_READ(isp, OUTMAILBOX2) << 16) |
1774 		    ISP_READ(isp, OUTMAILBOX1);
1775 		IDPRINTF(3, ("%s: fast post completion of %u\n", isp->isp_name,
1776 		    fast_post_handle));
1777 		break;
1778 
1779 	case ASYNC_CTIO_DONE:
1780 		/* Should only occur when Fast Posting Set for 2100s */
1781 		PRINTF("%s: CTIO done\n", isp->isp_name);
1782 		break;
1783 
1784 	case ASYNC_LIP_OCCURRED:
1785 		isp->isp_sendmarker = 1;
1786 		PRINTF("%s: LIP occurred\n", isp->isp_name);
1787 		break;
1788 
1789 	case ASYNC_LOOP_UP:
1790 		isp->isp_sendmarker = 1;
1791 		isp_async(isp, ISPASYNC_LOOP_UP, NULL);
1792 		break;
1793 
1794 	case ASYNC_LOOP_DOWN:
1795 		isp_async(isp, ISPASYNC_LOOP_DOWN, NULL);
1796 		break;
1797 
1798 	case ASYNC_LOOP_RESET:
1799 		isp->isp_sendmarker = 1;
1800 		PRINTF("%s: Loop RESET\n", isp->isp_name);
1801 #ifdef	ISP_TARGET_MODE
1802 		isp_notify_ack(isp, NULL);
1803 #endif
1804 		break;
1805 
1806 	case ASYNC_PDB_CHANGED:
1807 		isp->isp_sendmarker = 1;
1808 		isp_mark_getpdb_all(isp);
1809 		PRINTF("%s: Port Database Changed\n", isp->isp_name);
1810 		break;
1811 
1812 	case ASYNC_CHANGE_NOTIFY:
1813 		break;
1814 
1815 	default:
1816 		PRINTF("%s: unknown async code 0x%x\n", isp->isp_name, mbox);
1817 		break;
1818 	}
1819 	return (fast_post_handle);
1820 }
1821 
1822 static int
1823 isp_handle_other_response(isp, sp, optrp)
1824 	struct ispsoftc *isp;
1825 	ispstatusreq_t *sp;
1826 	u_int8_t *optrp;
1827 {
1828 	u_int8_t iptr, optr;
1829 	int reqsize = 0;
1830 	void *ireqp = NULL;
1831 #ifdef	ISP_TARGET_MODE
1832 	union {
1833 		at_entry_t	*atio;
1834 		at2_entry_t	*at2io;
1835 		ct_entry_t	*ctio;
1836 		ct2_entry_t	*ct2io;
1837 		lun_entry_t	*lunen;
1838 		in_entry_t	*inot;
1839 		in_fcentry_t	*inot_fc;
1840 		na_entry_t	*nack;
1841 		na_fcentry_t	*nack_fc;
1842 		void            *voidp;
1843 #define	atio	un.atio
1844 #define	at2io	un.at2io
1845 #define	ctio	un.ctio
1846 #define	ct2io	un.ct2io
1847 #define	lunen	un.lunen
1848 #define	inot	un.inot
1849 #define	inot_fc	un.inot_fc
1850 #define	nack	un.nack
1851 #define	nack_fc	un.nack_fc
1852 	} un;
1853 
1854 	un.voidp = sp;
1855 #endif
1856 
1857 
1858 	switch (sp->req_header.rqs_entry_type) {
1859 	case RQSTYPE_REQUEST:
1860 		return (-1);
1861 #ifdef	ISP_TARGET_MODE
1862 	case RQSTYPE_NOTIFY_ACK:
1863 	{
1864 		static const char *f =
1865 			"%s: Notify Ack Status 0x%x Sequence Id 0x%x\n"
1866 		/*
1867 		 * The ISP is acknowleding our ack of an Immediate Notify.
1868 		 */
1869 		if (isp->isp_type & ISP_HA_FC) {
1870 			PRINTF(f, isp->isp_name,
1871 			    nack_fc->na-status, nack_fc->na_seqid);
1872 		} else {
1873 			PRINTF(f, isp->isp_name,
1874 			    nack->na_status, nack->na_seqid);
1875 		}
1876 		break;
1877 	}
1878 	case RQSTYPE_NOTIFY:
1879 	{
1880 		u_int16_t seqid, status;
1881 
1882 		/*
1883 		 * Either the ISP received a SCSI message it cannot handle
1884 		 * or some other out of band condition (e.g., Port Logout)
1885 		 * or it is returning an Immediate Notify entry we sent.
1886 		 */
1887 		if (isp->isp_type & ISP_HA_FC) {
1888 			status = inot_fc->status;
1889 			seqid = inot_fc->in_seqid;
1890 		} else {
1891 			status = inot->status;
1892 			seqid = inot->seqid & 0xff;
1893 		}
1894 		PRINTF("%s: Immediate Notify Status 0x%x Sequence Id 0x%x\n",
1895 		    isp->isp_name, status, seqid);
1896 
1897 		switch (status) {
1898 		case IN_MSG_RECEIVED:
1899 		case IN_IDE_RECEIVED:
1900 			ptisp_got_msg(ptp, &inot);
1901 			break;
1902 		case IN_RSRC_UNAVAIL:
1903                         PRINTF("%s: Firmware out of ATIOs\n", isp->isp_name);
1904                         break;
1905                 case IN_ABORT_TASK:
1906 			PRINTF("%s: Abort Task iid %d rx_id 0x%x\n",
1907 			    inot_fc->in_iid, seqid);
1908                         break;
1909                 case IN_PORT_LOGOUT:
1910 			PRINTF("%s: Port Logout for Initiator %d\n",
1911 			    isp->isp_name, inot_fc->in_iid);
1912                         break;
1913                 default:
1914 			PRINTF("%s: bad status (0x%x) in Immediate Notify\n",
1915                             isp->isp_name, status);
1916                         break;
1917 
1918 		}
1919 		isp_notify_ack(isp, un.voidp);
1920 		reqsize = 0;
1921 		break;
1922 	}
1923 	case RQSTYPE_ENABLE_LUN:
1924 	case RQSTYPE_MODIFY_LUN:
1925 		if (lunen->req_status != 1) {
1926 		    PRINTF("%s: ENABLE/MODIFY LUN returned status 0x%x\n",
1927 			isp->isp_name, lunen->req_status);
1928 		}
1929 		break;
1930 	case RQSTYPE_ATIO2:
1931 	{
1932 		fcparam *fcp = isp->isp_param;
1933 		ispctiot2_t local, *ct2 = NULL;
1934 		ispatiot2_t *at2 = (ispatiot2_t *) sp;
1935 		int s, lun;
1936 
1937 #ifdef	ISP2100_SCCLUN
1938 		lun = at2->req_scclun;
1939 #else
1940 		lun = at2->req_lun;
1941 #endif
1942 		PRINTF("%s: atio2 loopid %d for lun %d rxid 0x%x flags0x%x "
1943 		    "tflags0x%x ecodes0x%x rqstatus0x%x\n", isp->isp_name,
1944 		    at2->req_initiator, lun, at2->req_rxid,
1945 		    at2->req_flags, at2->req_taskflags, at2->req_execodes,
1946 		    at2->req_status);
1947 
1948 		switch (at2->req_status & ~ATIO_SENSEVALID) {
1949 		case ATIO_PATH_INVALID:
1950 			PRINTF("%s: ATIO2 Path Invalid\n", isp->isp_name);
1951 			break;
1952 		case ATIO_NOCAP:
1953 			PRINTF("%s: ATIO2 No Cap\n", isp->isp_name);
1954 			break;
1955 		case ATIO_BDR_MSG:
1956 			PRINTF("%s: ATIO2 BDR Received\n", isp->isp_name);
1957 			break;
1958 		case ATIO_CDB_RECEIVED:
1959 			ct2 = &local;
1960 			break;
1961 		default:
1962 			PRINTF("%s: unknown req_status 0x%x\n", isp->isp_name,
1963 			    at2->req_status);
1964 			break;
1965 		}
1966 		if (ct2 == NULL) {
1967 			/*
1968 			 * Just do an ACCEPT on this fellow.
1969 			 */
1970 			at2->req_header.rqs_entry_type = RQSTYPE_ATIO2;
1971 			at2->req_header.rqs_flags = 0;
1972 			at2->req_flags = 1;
1973 			ireqp = at2;
1974 			reqsize = sizeof (*at2);
1975 			break;
1976 		}
1977 		PRINTF("%s: datalen %d cdb0=0x%x\n", isp->isp_name,
1978 		    at2->req_datalen, at2->req_cdb[0]);
1979 		MEMZERO((void *) ct2, sizeof (*ct2));
1980 		ct2->req_header.rqs_entry_type = RQSTYPE_CTIO2;
1981 		ct2->req_header.rqs_entry_count = 1;
1982 		ct2->req_header.rqs_flags = 0;
1983 		ct2->req_header.rqs_seqno = isp->isp_seqno++;
1984 		ct2->req_handle = (at2->req_initiator << 16) | lun;
1985 #ifndef	ISP2100_SCCLUN
1986 		ct2->req_lun = lun;
1987 #endif
1988 		ct2->req_initiator = at2->req_initiator;
1989 		ct2->req_rxid = at2->req_rxid;
1990 
1991 		ct2->req_flags = CTIO_SEND_STATUS;
1992 		switch (at2->req_cdb[0]) {
1993 		case 0x0:		/* TUR */
1994 			ct2->req_flags |= CTIO_NODATA | CTIO2_SMODE0;
1995 			ct2->req_m.mode0.req_scsi_status = CTIO2_STATUS_VALID;
1996 			break;
1997 
1998 		case 0x3:		/* REQUEST SENSE */
1999 		case 0x12:		/* INQUIRE */
2000 			ct2->req_flags |= CTIO_SEND_DATA | CTIO2_SMODE0;
2001 			ct2->req_m.mode0.req_scsi_status = CTIO2_STATUS_VALID;
2002 			ct2->req_seg_count = 1;
2003 			if (at2->req_cdb[0] == 0x12) {
2004 				s = sizeof(tgtiqd);
2005 				MEMCPY(fcp->isp_scratch, tgtiqd, s);
2006 			} else {
2007 				s = at2->req_datalen;
2008 				MEMZERO(fcp->isp_scratch, s);
2009 			}
2010 			ct2->req_m.mode0.req_dataseg[0].ds_base =
2011 			    fcp->isp_scdma;
2012 			ct2->req_m.mode0.req_dataseg[0].ds_count = s;
2013 			ct2->req_m.mode0.req_datalen = s;
2014 #if	1
2015 			if (at2->req_datalen < s) {
2016 				ct2->req_m.mode1.req_scsi_status |=
2017 				    CTIO2_RESP_VALID|CTIO2_RSPOVERUN;
2018 			} else if (at2->req_datalen > s) {
2019 				ct2->req_m.mode1.req_scsi_status |=
2020 				    CTIO2_RESP_VALID|CTIO2_RSPUNDERUN;
2021 			}
2022 #endif
2023 			break;
2024 
2025 		default:		/* ALL OTHERS */
2026 			ct2->req_flags |= CTIO_NODATA | CTIO2_SMODE1;
2027 			ct2->req_m.mode1.req_scsi_status = 0;
2028 #if	1
2029 			if (at2->req_datalen) {
2030 				ct2->req_m.mode1.req_scsi_status |=
2031 				    CTIO2_RSPUNDERUN;
2032 #if	BYTE_ORDER == BIG_ENDIAN
2033 				ct2->req_resid[1] = at2->req_datalen & 0xff;
2034 				ct2->req_resid[0] =
2035 					(at2->req_datalen >> 8) & 0xff;
2036 				ct2->req_resid[3] =
2037 					(at2->req_datalen >> 16) & 0xff;
2038 				ct2->req_resid[2] =
2039 					(at2->req_datalen >> 24) & 0xff;
2040 #else
2041 				ct2->req_resid[0] = at2->req_datalen & 0xff;
2042 				ct2->req_resid[1] =
2043 					(at2->req_datalen >> 8) & 0xff;
2044 				ct2->req_resid[2] =
2045 					(at2->req_datalen >> 16) & 0xff;
2046 				ct2->req_resid[3] =
2047 					(at2->req_datalen >> 24) & 0xff;
2048 #endif
2049 			}
2050 #endif
2051 			if ((at2->req_status & ATIO_SENSEVALID) == 0) {
2052 				ct2->req_m.mode1.req_sense_len = 18;
2053 				ct2->req_m.mode1.req_scsi_status |= 2;
2054 				ct2->req_m.mode1.req_response[0] = 0x70;
2055 				ct2->req_m.mode1.req_response[2] = 0x2;
2056 			} else {
2057 				ct2->req_m.mode1.req_sense_len = 18;
2058 				ct2->req_m.mode1.req_scsi_status |=
2059 				    at2->req_scsi_status;
2060 				MEMCPY(ct2->req_m.mode1.req_response,
2061 				    at2->req_sense, sizeof (at2->req_sense));
2062 			}
2063 			break;
2064 		}
2065 		reqsize = sizeof (*ct2);
2066 		ireqp = ct2;
2067 		break;
2068 	}
2069 	case RQSTYPE_CTIO2:
2070 	{
2071 		ispatiot2_t *at2;
2072 		ispctiot2_t *ct2 = (ispctiot2_t *) sp;
2073 		PRINTF("%s: CTIO2 returned status 0x%x\n", isp->isp_name,
2074 		    ct2->req_status);
2075 		/*
2076 	 	 * Return the ATIO to the board.
2077 		 */
2078 		at2 = (ispatiot2_t *) sp;
2079 		at2->req_header.rqs_entry_type = RQSTYPE_ATIO2;
2080 		at2->req_header.rqs_entry_count = 1;
2081 		at2->req_header.rqs_flags = 0;
2082 		at2->req_header.rqs_seqno = isp->isp_seqno++;
2083 		at2->req_status = 1;
2084 		reqsize = sizeof (*at2);
2085 		ireqp = at2;
2086 		break;
2087 	}
2088 #undef	atio
2089 #undef	at2io
2090 #undef	ctio
2091 #undef	ct2io
2092 #undef	lunen
2093 #undef	inot
2094 #undef	inot_fc
2095 #undef	nack
2096 #undef	nack_fc
2097 #endif
2098 	default:
2099 		PRINTF("%s: other response type %x\n", isp->isp_name,
2100 		    sp->req_header.rqs_entry_type);
2101 		break;
2102 	}
2103 	if (reqsize) {
2104 		void *reqp;
2105 		optr = isp->isp_reqodx = ISP_READ(isp, OUTMAILBOX4);
2106 		iptr = isp->isp_reqidx;
2107 		reqp = (void *) ISP_QUEUE_ENTRY(isp->isp_rquest, iptr);
2108 		iptr = ISP_NXT_QENTRY(iptr, RQUEST_QUEUE_LEN);
2109 		if (iptr == optr) {
2110 			PRINTF("%s: Request Queue Overflow other response\n",
2111 			    isp->isp_name);
2112 		} else {
2113 			MEMCPY(reqp, ireqp, reqsize);
2114 			ISP_WRITE(isp, INMAILBOX4, iptr);
2115 			isp->isp_reqidx = iptr;
2116 		}
2117 	}
2118 	return (0);
2119 }
2120 
2121 #ifdef	ISP_TARGET_MODE
2122 
2123 static void isp_tmd_newcmd_dflt __P((void *, tmd_cmd_t *));
2124 static void isp_tmd_event_dflt __P((void *, int));
2125 static void isp_tmd_notify_dflt __P((void *, tmd_notify_t *));
2126 
2127 static void isp_tgt_data_xfer __P ((tmd_cmd_t *));
2128 static void isp_tgt_endcmd __P ((tmd_cmd_t *, u_int8_t));
2129 static void isp_tgt_done __P ((tmd_cmd_t *));
2130 
2131 static void
2132 isp_tmd_newcmd_dflt(arg0, cmdp)
2133 	void *arg0;
2134 	tmd_cmd_t *cmdp;
2135 {
2136 }
2137 
2138 static void
2139 isp_tmd_event_dflt(arg0, event)
2140 	void *arg0;
2141 	int event;
2142 {
2143 }
2144 
2145 static void
2146 isp_tmd_notify_dflt(arg0, npt)
2147 	void *arg0;
2148 	tmd_notify_t *npt;
2149 {
2150 }
2151 
2152 /*
2153  * Locks held, and ints disabled (if FC).
2154  *
2155  * XXX: SETUP ONLY FOR INITIAL ENABLING RIGHT NOW
2156  */
2157 static int
2158 isp_modify_lun(isp, lun, icnt, ccnt)
2159 	struct ispsoftc *isp;
2160 	int lun;	/* logical unit to enable, modify, or disable */
2161 	int icnt;	/* immediate notify count */
2162 	int ccnt;	/* command count */
2163 {
2164 	isplun_t *ip = NULL;
2165 	u_int8_t iptr, optr;
2166 
2167 	optr = isp->isp_reqodx = ISP_READ(isp, OUTMAILBOX4);
2168 	iptr = isp->isp_reqidx;
2169 	ip = (isplun_t *) ISP_QUEUE_ENTRY(isp->isp_rquest, iptr);
2170 	iptr = ISP_NXT_QENTRY(iptr, RQUEST_QUEUE_LEN);
2171 	if (iptr == optr) {
2172 		PRINTF("%s: Request Queue Overflow in isp_modify_lun\n",
2173 		    isp->isp_name);
2174 		return (-1);
2175 	}
2176 
2177 	MEMZERO((void *) ip, sizeof (*ip));
2178 	ip->req_header.rqs_entry_type = RQSTYPE_ENABLE_LUN;
2179 	ip->req_header.rqs_entry_count = 1;
2180 	ip->req_header.rqs_seqno = isp->isp_seqno++;
2181 	ip->req_handle = RQSTYPE_ENABLE_LUN;
2182 	if (isp->isp_type & ISP_HA_SCSI) {
2183 		ip->req_lun = lun;
2184 	}
2185 	ip->req_cmdcount = ccnt;
2186 	ip->req_imcount = icnt;
2187 	ip->req_timeout = 0;	/* default 30 seconds */
2188 	ISP_WRITE(isp, INMAILBOX4, iptr);
2189 	isp->isp_reqidx = iptr;
2190 	return (0);
2191 }
2192 
2193 static void
2194 isp_notify_ack(isp, ptrp)
2195 	struct ispsoftc *isp;
2196 	void *ptrp;
2197 {
2198 	void *reqp;
2199 	u_int8_t iptr, optr;
2200 	union {
2201 		na_fcentry_t _naf;
2202 		na_entry_t _nas;
2203 	} un;
2204 
2205 	MEMZERO((caddr_t)&un, sizeof (un));
2206 	un._nas.na_header.rqs_entry_type = RQSTYPE_NOTIFY_ACK;
2207 	un._nas.na_header.rqs_entry_count = 1;
2208 
2209 	if (isp->isp_type & ISP_HA_FC) {
2210 		na_fcentry_t *na = &un._nas;
2211 		if (ptrp) {
2212 			in_fcentry_t *inp = ptrp;
2213 			na->na_iid = inp->in_iid;
2214 			na->na_lun = inp->in_lun;
2215 			na->na_task_flags = inp->in_task_flags;
2216 			na->na_seqid = inp->in_seqid;
2217 			na->na_status = inp->in_status;
2218 		} else {
2219 			na->na_flags = NAFC_RST_CLRD;
2220 		}
2221 	} else {
2222 		na_entry_t *na = &un._nas;
2223 		if (ptrp) {
2224 			in_entry_t *inp = ptrp;
2225 			na->na_iid = inp->in_iid;
2226 			na->na_lun = inp->in_lun;
2227 			na->na_tgt = inp->in_tgt;
2228 			na->na_seqid = inp->in_seqid;
2229 		} else {
2230 			na->na_flags = NA_RST_CLRD;
2231 		}
2232 	}
2233 	optr = isp->isp_reqodx = ISP_READ(isp, OUTMAILBOX4);
2234 	iptr = isp->isp_reqidx;
2235 	reqp = (void *) ISP_QUEUE_ENTRY(isp->isp_rquest, iptr);
2236 	iptr = ISP_NXT_QENTRY(iptr, RQUEST_QUEUE_LEN);
2237 	if (iptr == optr) {
2238 		PRINTF("%s: Request Queue Overflow For isp_notify_ack\n",
2239 		    isp->isp_name);
2240 	} else {
2241 		MEMCPY(reqp, ireqp, sizeof (un));
2242 		ISP_WRITE(isp, INMAILBOX4, iptr);
2243 		isp->isp_reqidx = iptr;
2244 	}
2245 }
2246 
2247 /*
2248  * These are dummy stubs for now until the outside framework is plugged in.
2249  */
2250 
2251 static void
2252 isp_handle_atio (isp, aep)
2253 	struct ispsoftc *isp;
2254 	at_entry_t *aep;
2255 {
2256 	int status, connected;
2257 	tmd_cmd_t local, *cdp = &local;
2258 
2259 	/*
2260 	 * Get the ATIO status and see if we're still connected.
2261 	 */
2262 	status = aep->at_status;
2263 	connected = ((aep->at_flags & AT_NODISC) != 0);
2264 
2265 	PRINTF("%s: ATIO status=0x%x, connected=%d\n", isp->isp_name,
2266 	    status, connected);
2267 
2268 	/*
2269 	 * The firmware status (except for the SenseValid bit) indicates
2270 	 * why this ATIO was sent to us.
2271 	 * If SenseValid is set, the firware has recommended Sense Data.
2272 	 * If the Disconnects Disabled bit is set in the flags field,
2273 	 * we're still connected on the SCSI bus - i.e. the initiator
2274 	 * did not set DiscPriv in the identify message. We don't care
2275 	 * about this so it's ignored.
2276 	 */
2277 	switch(status & ~TGTSVALID) {
2278 	case AT_PATH_INVALID:
2279 		/*
2280 		 * ATIO rejected by the firmware due to disabled lun.
2281 		 */
2282 		PRINTF("%s: Firmware rejected ATIO for disabled lun %d\n",
2283 		    isp->isp_name, aep->at_lun);
2284 		break;
2285 
2286 	case AT_PHASE_ERROR:
2287 		/*
2288 		 * Bus Pase Sequence error.
2289 		 *
2290 		 * The firmware should have filled in the correct
2291 		 * sense data.
2292 		 */
2293 
2294 
2295 		if (status & TGTSVALID) {
2296 			MEMCPY(&cdp->cd_sensedata, aep->at_sense,
2297 			    sizeof (cdp->cd_sensedata));
2298 			PRINTF("%s: Bus Phase Sequence error key 0x%x\n",
2299 			    isp->isp_name, cdp->cd_sensedata[2] & 0xf);
2300 		} else {
2301 			PRINTF("%s: Bus Phase Sequence With No Sense\n",
2302 			    isp->isp_name);
2303 		}
2304 		(*isp->isp_tmd_newcmd)(isp, cdp);
2305 		break;
2306 
2307 	case AT_NOCAP:
2308 		/*
2309 		 * Requested Capability not available
2310 		 * We sent an ATIO that overflowed the firmware's
2311 		 * command resource count.
2312 		 */
2313 		PRINTF("%s: Firmware rejected ATIO, command count overflow\n",
2314 		    isp->isp_name);
2315 		break;
2316 
2317 	case AT_BDR_MSG:
2318 		/*
2319 		 * If we send an ATIO to the firmware to increment
2320 		 * its command resource count, and the firmware is
2321 		 * recovering from a Bus Device Reset, it returns
2322 		 * the ATIO with this status.
2323 		 */
2324 		PRINTF("%s: ATIO returned with BDR received\n", isp->isp_name);
2325 		break;
2326 
2327 	case AT_CDB:
2328 		/*
2329 		 * New CDB
2330 		 */
2331 		cdp->cd_hba = isp;
2332 		cdp->cd_iid = aep->at_iid;
2333 		cdp->cd_tgt = aep->at_tgt;
2334 		cdp->cd_lun = aep->at_lun;
2335 		cdp->cd_tagtype = aep->at_tag_type;
2336 		cdp->cd_tagval = aep->at_tag_val;
2337 		MEMCPY(cdp->cd_cdb, aep->at_cdb, 16);
2338 		PRINTF("%s: CDB 0x%x itl %d/%d/%d\n", isp->isp_name,
2339 		    cdp->cd_cdb[0], cdp->cd_iid, cdp->cd_tgt, cdp->cd_lun);
2340 		(*isp->isp_tmd_newcmd)(isp, cdp);
2341 		break;
2342 
2343 	default:
2344 		PRINTF("%s: Unknown status (0x%x) in ATIO\n",
2345 		    isp->isp_name, status);
2346 		cdp->cd_hba = isp;
2347 		cdp->cd_iid = aep->at_iid;
2348 		cdp->cd_tgt = aep->at_tgt;
2349 		cdp->cd_lun = aep->at_lun;
2350 		cdp->cd_tagtype = aep->at_tag_type;
2351 		cdp->cd_tagval = aep->at_tag_val;
2352 		isp_tgtcmd_done(cdp);
2353 		break;
2354 	}
2355 }
2356 
2357 static void
2358 isp_handle_atio2(isp, aep)
2359 	struct ispsoftc *isp;
2360 	at2_entry_t *aep;
2361 {
2362 	int status;
2363 	tmd_cmd_t local, *cdp = &local;
2364 
2365 	/*
2366 	 * Get the ATIO2 status.
2367 	 */
2368 	status = aep->at_status;
2369 	PRINTD("%s: ATIO2 status=0x%x\n", status);
2370 
2371 	/*
2372 	 * The firmware status (except for the SenseValid bit) indicates
2373 	 * why this ATIO was sent to us.
2374 	 * If SenseValid is set, the firware has recommended Sense Data.
2375 	 */
2376 	switch(status & ~TGTSVALID) {
2377 	case AT_PATH_INVALID:
2378 		/*
2379 		 * ATIO rejected by the firmware due to disabled lun.
2380 		 */
2381 		PRINTF("%s: Firmware rejected ATIO2 for disabled lun %d\n",
2382 		    isp->isp_name, aep->at_lun);
2383 		break;
2384 
2385 	case AT_NOCAP:
2386 		/*
2387 		 * Requested Capability not available
2388 		 * We sent an ATIO that overflowed the firmware's
2389 		 * command resource count.
2390 		 */
2391 		PRINTF("%s: Firmware rejected ATIO2, command count overflow\n",
2392 		    isp->isp_name);
2393 		break;
2394 
2395 	case AT_BDR_MSG:
2396 		/*
2397 		 * If we send an ATIO to the firmware to increment
2398 		 * its command resource count, and the firmware is
2399 		 * recovering from a Bus Device Reset, it returns
2400 		 * the ATIO with this status.
2401 		 */
2402 		PRINTF("%s: ATIO2 returned with BDR rcvd\n", isp->isp_name);
2403 		break;
2404 
2405 	case AT_CDB:
2406 		/*
2407 		 * New CDB
2408 		 */
2409 		cdp->cd_hba = isp;
2410 		cdp->cd_iid = aep->at_iid;
2411 		cdp->cd_tgt = 0;
2412 		cdp->cd_lun = aep->at_lun;
2413 		MEMCPY(cdp->cd_cdb, aep->at_cdb, 16);
2414 		cdp->cd_rxid = aep->at_rxid;
2415 		cdp->cp_origdlen = aep->at_datalen;
2416 		cdp->cp_totbytes = 0;
2417 		PRINTF("%s: CDB 0x%x rx_id 0x%x itl %d/%d/%d dlen %d\n",
2418 		    isp->isp_name, cdp->cd_cdb[0], cdp->cd_tagval, cdp->cd_iid,
2419 		    cdp->cd_tgt, cdp->cd_lun, aep->at_datalen);
2420 		(*isp->isp_tmd_newcmd)(isp, cdp);
2421 		break;
2422 
2423 	default:
2424 		PRINTF("%s: Unknown status (0x%x) in ATIO2\n",
2425 		    isp->isp_name, status);
2426 		cdp->cd_hba = isp;
2427 		cdp->cd_iid = aep->at_iid;
2428 		cdp->cd_tgt = aep->at_tgt;
2429 		cdp->cd_lun = aep->at_lun;
2430 		cdp->cp_rxid = aep->at_rxid;
2431 		isp_tgtcmd_done(cdp);
2432 		break;
2433 	}
2434 }
2435 
2436 static void
2437 isp_handle_ctio(isp, cep)
2438 	struct ispsoftc *isp;
2439 	ct_entry_t *aep;
2440 {
2441 }
2442 
2443 static void
2444 isp_handle_ctio2(isp, cep)
2445 	struct ispsoftc *isp;
2446 	at2_entry_t *aep;
2447 {
2448 }
2449 #endif
2450 
2451 static void
2452 isp_parse_status(isp, sp, xs)
2453 	struct ispsoftc *isp;
2454 	ispstatusreq_t *sp;
2455 	ISP_SCSI_XFER_T *xs;
2456 {
2457 	switch (sp->req_completion_status) {
2458 	case RQCS_COMPLETE:
2459 		XS_SETERR(xs, HBA_NOERROR);
2460 		return;
2461 
2462 	case RQCS_INCOMPLETE:
2463 		if ((sp->req_state_flags & RQSF_GOT_TARGET) == 0) {
2464 			IDPRINTF(3, ("%s: Selection Timeout for target %d\n",
2465 			    isp->isp_name, XS_TGT(xs)));
2466 			XS_SETERR(xs, HBA_SELTIMEOUT);
2467 			return;
2468 		}
2469 		PRINTF("%s: command incomplete for target %d lun %d, state "
2470 		    "0x%x\n", isp->isp_name, XS_TGT(xs), XS_LUN(xs),
2471 		    sp->req_state_flags);
2472 		break;
2473 
2474 	case RQCS_DMA_ERROR:
2475 		PRINTF("%s: DMA error for command on target %d, lun %d\n",
2476 		    isp->isp_name, XS_TGT(xs), XS_LUN(xs));
2477 		break;
2478 
2479 	case RQCS_TRANSPORT_ERROR:
2480 		PRINTF("%s: transport error\n", isp->isp_name);
2481 		isp_prtstst(sp);
2482 		break;
2483 
2484 	case RQCS_RESET_OCCURRED:
2485 		IDPRINTF(2, ("%s: bus reset destroyed command for target %d "
2486 		    "lun %d\n", isp->isp_name, XS_TGT(xs), XS_LUN(xs)));
2487 		isp->isp_sendmarker = 1;
2488 		XS_SETERR(xs, HBA_BUSRESET);
2489 		return;
2490 
2491 	case RQCS_ABORTED:
2492 		PRINTF("%s: command aborted for target %d lun %d\n",
2493 		    isp->isp_name, XS_TGT(xs), XS_LUN(xs));
2494 		isp->isp_sendmarker = 1;
2495 		XS_SETERR(xs, HBA_ABORTED);
2496 		return;
2497 
2498 	case RQCS_TIMEOUT:
2499 		IDPRINTF(2, ("%s: command timed out for target %d lun %d\n",
2500 		    isp->isp_name, XS_TGT(xs), XS_LUN(xs)));
2501 		XS_SETERR(xs, HBA_CMDTIMEOUT);
2502 		return;
2503 
2504 	case RQCS_DATA_OVERRUN:
2505 		if (isp->isp_type & ISP_HA_FC) {
2506 			XS_RESID(xs) = sp->req_resid;
2507 			break;
2508 		}
2509 		XS_SETERR(xs, HBA_DATAOVR);
2510 		return;
2511 
2512 	case RQCS_COMMAND_OVERRUN:
2513 		PRINTF("%s: command overrun for command on target %d, lun %d\n",
2514 		    isp->isp_name, XS_TGT(xs), XS_LUN(xs));
2515 		break;
2516 
2517 	case RQCS_STATUS_OVERRUN:
2518 		PRINTF("%s: status overrun for command on target %d, lun %d\n",
2519 		    isp->isp_name, XS_TGT(xs), XS_LUN(xs));
2520 		break;
2521 
2522 	case RQCS_BAD_MESSAGE:
2523 		PRINTF("%s: message not COMMAND COMPLETE after status on "
2524 		    "target %d, lun %d\n", isp->isp_name, XS_TGT(xs),
2525 		    XS_LUN(xs));
2526 		break;
2527 
2528 	case RQCS_NO_MESSAGE_OUT:
2529 		PRINTF("%s: No MESSAGE OUT phase after selection on "
2530 		    "target %d, lun %d\n", isp->isp_name, XS_TGT(xs),
2531 		    XS_LUN(xs));
2532 		break;
2533 
2534 	case RQCS_EXT_ID_FAILED:
2535 		PRINTF("%s: EXTENDED IDENTIFY failed on target %d, lun %d\n",
2536 		    isp->isp_name, XS_TGT(xs), XS_LUN(xs));
2537 		break;
2538 
2539 	case RQCS_IDE_MSG_FAILED:
2540 		PRINTF("%s: target %d lun %d rejected INITIATOR DETECTED "
2541 		    "ERROR message\n", isp->isp_name, XS_TGT(xs), XS_LUN(xs));
2542 		break;
2543 
2544 	case RQCS_ABORT_MSG_FAILED:
2545 		PRINTF("%s: target %d lun %d rejected ABORT message\n",
2546 		    isp->isp_name, XS_TGT(xs), XS_LUN(xs));
2547 		break;
2548 
2549 	case RQCS_REJECT_MSG_FAILED:
2550 		PRINTF("%s: target %d lun %d rejected MESSAGE REJECT message\n",
2551 		    isp->isp_name, XS_TGT(xs), XS_LUN(xs));
2552 		break;
2553 
2554 	case RQCS_NOP_MSG_FAILED:
2555 		PRINTF("%s: target %d lun %d rejected NOP message\n",
2556 		    isp->isp_name, XS_TGT(xs), XS_LUN(xs));
2557 		break;
2558 
2559 	case RQCS_PARITY_ERROR_MSG_FAILED:
2560 		PRINTF("%s: target %d lun %d rejected MESSAGE PARITY ERROR "
2561 		    "message\n", isp->isp_name, XS_TGT(xs), XS_LUN(xs));
2562 		break;
2563 
2564 	case RQCS_DEVICE_RESET_MSG_FAILED:
2565 		PRINTF("%s: target %d lun %d rejected BUS DEVICE RESET "
2566 		    "message\n", isp->isp_name, XS_TGT(xs), XS_LUN(xs));
2567 		break;
2568 
2569 	case RQCS_ID_MSG_FAILED:
2570 		PRINTF("%s: target %d lun %d rejected IDENTIFY "
2571 		    "message\n", isp->isp_name, XS_TGT(xs), XS_LUN(xs));
2572 		break;
2573 
2574 	case RQCS_UNEXP_BUS_FREE:
2575 		PRINTF("%s: target %d lun %d had an unexpected bus free\n",
2576 		    isp->isp_name, XS_TGT(xs), XS_LUN(xs));
2577 		break;
2578 
2579 	case RQCS_DATA_UNDERRUN:
2580 		if (isp->isp_type & ISP_HA_FC) {
2581 			XS_RESID(xs) = sp->req_resid;
2582 			/* an UNDERRUN is not a botch ??? */
2583 		}
2584 		XS_SETERR(xs, HBA_NOERROR);
2585 		return;
2586 
2587 	case RQCS_XACT_ERR1:
2588 		PRINTF("%s: HBA attempted queued transaction with disconnect "
2589 		    "not set for target %d lun %d\n", isp->isp_name, XS_TGT(xs),
2590 		    XS_LUN(xs));
2591 		break;
2592 
2593 	case RQCS_XACT_ERR2:
2594 		PRINTF("%s: HBA attempted queued transaction to target "
2595 		    "routine %d on target %d\n", isp->isp_name, XS_LUN(xs),
2596 		    XS_TGT(xs));
2597 		break;
2598 
2599 	case RQCS_XACT_ERR3:
2600 		PRINTF("%s: HBA attempted queued transaction for target %d lun "
2601 		    "%d when queueing disabled\n", isp->isp_name, XS_TGT(xs),
2602 		    XS_LUN(xs));
2603 		break;
2604 
2605 	case RQCS_BAD_ENTRY:
2606 		PRINTF("%s: invalid IOCB entry type detected\n", isp->isp_name);
2607 		break;
2608 
2609 	case RQCS_QUEUE_FULL:
2610 		PRINTF("%s: internal queues full for target %d lun %d "
2611 		    "status 0x%x\n", isp->isp_name, XS_TGT(xs), XS_LUN(xs),
2612 		    XS_STS(xs));
2613 		/*
2614 		 * If QFULL or some other status byte is set, then this
2615 		 * isn't an error, per se.
2616 		 */
2617 		if (XS_STS(xs) != 0) {
2618 			XS_SETERR(xs, HBA_NOERROR);
2619 			return;
2620 		}
2621 		break;
2622 
2623 	case RQCS_PHASE_SKIPPED:
2624 		PRINTF("%s: SCSI phase skipped (e.g., COMMAND COMPLETE w/o "
2625 		    "STATUS phase) for target %d lun %d\n", isp->isp_name,
2626 		    XS_TGT(xs), XS_LUN(xs));
2627 		break;
2628 
2629 	case RQCS_ARQS_FAILED:
2630 		PRINTF("%s: Auto Request Sense failed for target %d lun %d\n",
2631 		    isp->isp_name, XS_TGT(xs), XS_LUN(xs));
2632 		XS_SETERR(xs, HBA_ARQFAIL);
2633 		return;
2634 
2635 	case RQCS_WIDE_FAILED:
2636 		PRINTF("%s: Wide Negotiation failed for target %d lun %d\n",
2637 		    isp->isp_name, XS_TGT(xs), XS_LUN(xs));
2638 		if (isp->isp_type & ISP_HA_SCSI) {
2639 			sdparam *sdp = isp->isp_param;
2640 			isp->isp_update = 1;
2641 			sdp->isp_devparam[XS_TGT(xs)].dev_flags &= ~DPARM_WIDE;
2642 			sdp->isp_devparam[XS_TGT(xs)].dev_update = 1;
2643 		}
2644 		XS_SETERR(xs, HBA_NOERROR);
2645 		return;
2646 
2647 	case RQCS_SYNCXFER_FAILED:
2648 		PRINTF("%s: SDTR Message failed for target %d lun %d\n",
2649 		    isp->isp_name, XS_TGT(xs), XS_LUN(xs));
2650 		if (isp->isp_type & ISP_HA_SCSI) {
2651 			sdparam *sdp = isp->isp_param;
2652 			isp->isp_update = 1;
2653 			sdp->isp_devparam[XS_TGT(xs)].dev_flags &= ~DPARM_SYNC;
2654 			sdp->isp_devparam[XS_TGT(xs)].dev_update = 1;
2655 		}
2656 		break;
2657 
2658 	case RQCS_LVD_BUSERR:
2659 		PRINTF("%s: Bad LVD Bus condition while talking to target %d "
2660 		    "lun %d\n", isp->isp_name, XS_TGT(xs), XS_LUN(xs));
2661 		break;
2662 
2663 	case RQCS_PORT_UNAVAILABLE:
2664 		/*
2665 		 * No such port on the loop. Moral equivalent of SELTIMEO
2666 		 */
2667 		IDPRINTF(3, ("%s: Port Unavailable for target %d\n",
2668 		    isp->isp_name, XS_TGT(xs)));
2669 		XS_SETERR(xs, HBA_SELTIMEOUT);
2670 		return;
2671 
2672 	case RQCS_PORT_LOGGED_OUT:
2673 		/*
2674 		 * It was there (maybe)- treat as a selection timeout.
2675 		 */
2676 		PRINTF("%s: port logout for target %d\n",
2677 			isp->isp_name, XS_TGT(xs));
2678 		XS_SETERR(xs, HBA_SELTIMEOUT);
2679 		return;
2680 
2681 	case RQCS_PORT_CHANGED:
2682 		PRINTF("%s: port changed for target %d\n",
2683 			isp->isp_name, XS_TGT(xs));
2684 		break;
2685 
2686 	case RQCS_PORT_BUSY:
2687 		PRINTF("%s: port busy for target %d\n",
2688 			isp->isp_name, XS_TGT(xs));
2689 		XS_SETERR(xs, HBA_TGTBSY);
2690 		return;
2691 
2692 	default:
2693 		PRINTF("%s: comp status %x\n", isp->isp_name,
2694 		       sp->req_completion_status);
2695 		break;
2696 	}
2697 	XS_SETERR(xs, HBA_BOTCH);
2698 }
2699 
2700 static void
2701 isp_fastpost_complete(isp, fph)
2702 	struct ispsoftc *isp;
2703 	int fph;
2704 {
2705 	ISP_SCSI_XFER_T *xs;
2706 
2707 	if (fph < 1)
2708 		return;
2709 	xs = (ISP_SCSI_XFER_T *) isp->isp_xflist[fph - 1];
2710 	isp->isp_xflist[fph - 1] = NULL;
2711 	if (xs == NULL) {
2712 		PRINTF("%s: fast posting handle 0x%x not found\n",
2713 		    isp->isp_name, fph - 1);
2714 		return;
2715 	}
2716 	/*
2717 	 * Since we don't have a result queue entry item,
2718 	 * we must believe that SCSI status is zero and
2719 	 * that all data transferred.
2720 	 */
2721 	XS_RESID(xs) = 0;
2722 	XS_STS(xs) = 0;
2723 	if (XS_XFRLEN(xs)) {
2724 		ISP_DMAFREE(isp, xs, fph - 1);
2725 	}
2726 	XS_CMD_DONE(xs);
2727 }
2728 
2729 #define	HINIB(x)			((x) >> 0x4)
2730 #define	LONIB(x)			((x)  & 0xf)
2731 #define MAKNIB(a, b)			(((a) << 4) | (b))
2732 static u_int8_t mbpcnt[] = {
2733 	MAKNIB(1, 1),	/* 0x00: MBOX_NO_OP */
2734 	MAKNIB(5, 5),	/* 0x01: MBOX_LOAD_RAM */
2735 	MAKNIB(2, 0),	/* 0x02: MBOX_EXEC_FIRMWARE */
2736 	MAKNIB(5, 5),	/* 0x03: MBOX_DUMP_RAM */
2737 	MAKNIB(3, 3),	/* 0x04: MBOX_WRITE_RAM_WORD */
2738 	MAKNIB(2, 3),	/* 0x05: MBOX_READ_RAM_WORD */
2739 	MAKNIB(6, 6),	/* 0x06: MBOX_MAILBOX_REG_TEST */
2740 	MAKNIB(2, 3),	/* 0x07: MBOX_VERIFY_CHECKSUM	*/
2741 	MAKNIB(1, 3),	/* 0x08: MBOX_ABOUT_FIRMWARE */
2742 	MAKNIB(0, 0),	/* 0x09: */
2743 	MAKNIB(0, 0),	/* 0x0a: */
2744 	MAKNIB(0, 0),	/* 0x0b: */
2745 	MAKNIB(0, 0),	/* 0x0c: */
2746 	MAKNIB(0, 0),	/* 0x0d: */
2747 	MAKNIB(1, 2),	/* 0x0e: MBOX_CHECK_FIRMWARE */
2748 	MAKNIB(0, 0),	/* 0x0f: */
2749 	MAKNIB(5, 5),	/* 0x10: MBOX_INIT_REQ_QUEUE */
2750 	MAKNIB(6, 6),	/* 0x11: MBOX_INIT_RES_QUEUE */
2751 	MAKNIB(4, 4),	/* 0x12: MBOX_EXECUTE_IOCB */
2752 	MAKNIB(2, 2),	/* 0x13: MBOX_WAKE_UP	*/
2753 	MAKNIB(1, 6),	/* 0x14: MBOX_STOP_FIRMWARE */
2754 	MAKNIB(4, 4),	/* 0x15: MBOX_ABORT */
2755 	MAKNIB(2, 2),	/* 0x16: MBOX_ABORT_DEVICE */
2756 	MAKNIB(3, 3),	/* 0x17: MBOX_ABORT_TARGET */
2757 	MAKNIB(2, 2),	/* 0x18: MBOX_BUS_RESET */
2758 	MAKNIB(2, 3),	/* 0x19: MBOX_STOP_QUEUE */
2759 	MAKNIB(2, 3),	/* 0x1a: MBOX_START_QUEUE */
2760 	MAKNIB(2, 3),	/* 0x1b: MBOX_SINGLE_STEP_QUEUE */
2761 	MAKNIB(2, 3),	/* 0x1c: MBOX_ABORT_QUEUE */
2762 	MAKNIB(2, 4),	/* 0x1d: MBOX_GET_DEV_QUEUE_STATUS */
2763 	MAKNIB(0, 0),	/* 0x1e: */
2764 	MAKNIB(1, 3),	/* 0x1f: MBOX_GET_FIRMWARE_STATUS */
2765 	MAKNIB(1, 3),	/* 0x20: MBOX_GET_INIT_SCSI_ID, MBOX_GET_LOOP_ID */
2766 	MAKNIB(1, 2),	/* 0x21: MBOX_GET_SELECT_TIMEOUT */
2767 	MAKNIB(1, 3),	/* 0x22: MBOX_GET_RETRY_COUNT	*/
2768 	MAKNIB(1, 2),	/* 0x23: MBOX_GET_TAG_AGE_LIMIT */
2769 	MAKNIB(1, 2),	/* 0x24: MBOX_GET_CLOCK_RATE */
2770 	MAKNIB(1, 2),	/* 0x25: MBOX_GET_ACT_NEG_STATE */
2771 	MAKNIB(1, 2),	/* 0x26: MBOX_GET_ASYNC_DATA_SETUP_TIME */
2772 	MAKNIB(1, 3),	/* 0x27: MBOX_GET_PCI_PARAMS */
2773 	MAKNIB(2, 4),	/* 0x28: MBOX_GET_TARGET_PARAMS */
2774 	MAKNIB(2, 4),	/* 0x29: MBOX_GET_DEV_QUEUE_PARAMS */
2775 	MAKNIB(0, 0),	/* 0x2a: */
2776 	MAKNIB(0, 0),	/* 0x2b: */
2777 	MAKNIB(0, 0),	/* 0x2c: */
2778 	MAKNIB(0, 0),	/* 0x2d: */
2779 	MAKNIB(0, 0),	/* 0x2e: */
2780 	MAKNIB(0, 0),	/* 0x2f: */
2781 	MAKNIB(2, 2),	/* 0x30: MBOX_SET_INIT_SCSI_ID */
2782 	MAKNIB(2, 2),	/* 0x31: MBOX_SET_SELECT_TIMEOUT */
2783 	MAKNIB(3, 3),	/* 0x32: MBOX_SET_RETRY_COUNT	*/
2784 	MAKNIB(2, 2),	/* 0x33: MBOX_SET_TAG_AGE_LIMIT */
2785 	MAKNIB(2, 2),	/* 0x34: MBOX_SET_CLOCK_RATE */
2786 	MAKNIB(2, 2),	/* 0x35: MBOX_SET_ACTIVE_NEG_STATE */
2787 	MAKNIB(2, 2),	/* 0x36: MBOX_SET_ASYNC_DATA_SETUP_TIME */
2788 	MAKNIB(3, 3),	/* 0x37: MBOX_SET_PCI_CONTROL_PARAMS */
2789 	MAKNIB(4, 4),	/* 0x38: MBOX_SET_TARGET_PARAMS */
2790 	MAKNIB(4, 4),	/* 0x39: MBOX_SET_DEV_QUEUE_PARAMS */
2791 	MAKNIB(0, 0),	/* 0x3a: */
2792 	MAKNIB(0, 0),	/* 0x3b: */
2793 	MAKNIB(0, 0),	/* 0x3c: */
2794 	MAKNIB(0, 0),	/* 0x3d: */
2795 	MAKNIB(0, 0),	/* 0x3e: */
2796 	MAKNIB(0, 0),	/* 0x3f: */
2797 	MAKNIB(1, 2),	/* 0x40: MBOX_RETURN_BIOS_BLOCK_ADDR */
2798 	MAKNIB(6, 1),	/* 0x41: MBOX_WRITE_FOUR_RAM_WORDS */
2799 	MAKNIB(2, 3),	/* 0x42: MBOX_EXEC_BIOS_IOCB */
2800 	MAKNIB(0, 0),	/* 0x43: */
2801 	MAKNIB(0, 0),	/* 0x44: */
2802 	MAKNIB(0, 0),	/* 0x45: */
2803 	MAKNIB(0, 0),	/* 0x46: */
2804 	MAKNIB(0, 0),	/* 0x47: */
2805 	MAKNIB(0, 0),	/* 0x48: */
2806 	MAKNIB(0, 0),	/* 0x49: */
2807 	MAKNIB(2, 1),	/* 0x4a: MBOX_SET_FIRMWARE_FEATURES */
2808 	MAKNIB(1, 2),	/* 0x4b: MBOX_GET_FIRMWARE_FEATURES */
2809 	MAKNIB(0, 0),	/* 0x4c: */
2810 	MAKNIB(0, 0),	/* 0x4d: */
2811 	MAKNIB(0, 0),	/* 0x4e: */
2812 	MAKNIB(0, 0),	/* 0x4f: */
2813 	MAKNIB(0, 0),	/* 0x50: */
2814 	MAKNIB(0, 0),	/* 0x51: */
2815 	MAKNIB(0, 0),	/* 0x52: */
2816 	MAKNIB(0, 0),	/* 0x53: */
2817 	MAKNIB(8, 0),	/* 0x54: MBOX_EXEC_COMMAND_IOCB_A64 */
2818 	MAKNIB(0, 0),	/* 0x55: */
2819 	MAKNIB(0, 0),	/* 0x56: */
2820 	MAKNIB(0, 0),	/* 0x57: */
2821 	MAKNIB(0, 0),	/* 0x58: */
2822 	MAKNIB(0, 0),	/* 0x59: */
2823 	MAKNIB(0, 0),	/* 0x5a: */
2824 	MAKNIB(0, 0),	/* 0x5b: */
2825 	MAKNIB(0, 0),	/* 0x5c: */
2826 	MAKNIB(0, 0),	/* 0x5d: */
2827 	MAKNIB(0, 0),	/* 0x5e: */
2828 	MAKNIB(0, 0),	/* 0x5f: */
2829 	MAKNIB(8, 6),	/* 0x60: MBOX_INIT_FIRMWARE */
2830 	MAKNIB(0, 0),	/* 0x60: MBOX_GET_INIT_CONTROL_BLOCK  (FORMAT?) */
2831 	MAKNIB(2, 1),	/* 0x62: MBOX_INIT_LIP */
2832 	MAKNIB(8, 1),	/* 0x63: MBOX_GET_FC_AL_POSITION_MAP */
2833 	MAKNIB(8, 1),	/* 0x64: MBOX_GET_PORT_DB */
2834 	MAKNIB(3, 1),	/* 0x65: MBOX_CLEAR_ACA */
2835 	MAKNIB(3, 1),	/* 0x66: MBOX_TARGET_RESET */
2836 	MAKNIB(3, 1),	/* 0x67: MBOX_CLEAR_TASK_SET */
2837 	MAKNIB(3, 1),	/* 0x68: MBOX_ABORT_TASK_SET */
2838 	MAKNIB(1, 2),	/* 0x69: MBOX_GET_FW_STATE */
2839 	MAKNIB(2, 8),	/* 0x6a: MBOX_GET_PORT_NAME */
2840 	MAKNIB(8, 1),	/* 0x6b: MBOX_GET_LINK_STATUS */
2841 	MAKNIB(4, 4),	/* 0x6c: MBOX_INIT_LIP_RESET */
2842 	MAKNIB(0, 0),	/* 0x6d: */
2843 	MAKNIB(0, 0),	/* 0x6e: */
2844 	MAKNIB(0, 0),	/* 0x6f: */
2845 	MAKNIB(0, 0),	/* 0x70: */
2846 	MAKNIB(0, 0),	/* 0x71: */
2847 	MAKNIB(4, 1)	/* 0x72: MBOX_INIT_LIP_LOGIN */
2848 };
2849 #define	NMBCOM	(sizeof (mbpcnt) / sizeof (mbpcnt[0]))
2850 
2851 static void
2852 isp_mboxcmd(isp, mbp)
2853 	struct ispsoftc *isp;
2854 	mbreg_t *mbp;
2855 {
2856 	int outparam, inparam;
2857 	int loops, dld = 0;
2858 	u_int8_t opcode;
2859 
2860 	if (mbp->param[0] == ISP2100_SET_PCI_PARAM) {
2861 		opcode = mbp->param[0] = MBOX_SET_PCI_PARAMETERS;
2862 		inparam = 4;
2863 		outparam = 4;
2864 		goto command_known;
2865 	} else if (mbp->param[0] > NMBCOM) {
2866 		PRINTF("%s: bad command %x\n", isp->isp_name, mbp->param[0]);
2867 		return;
2868 	}
2869 
2870 	opcode = mbp->param[0];
2871 	inparam = HINIB(mbpcnt[mbp->param[0]]);
2872 	outparam =  LONIB(mbpcnt[mbp->param[0]]);
2873 
2874 	if (inparam == 0 && outparam == 0) {
2875 		PRINTF("%s: no parameters for %x\n", isp->isp_name,
2876 			mbp->param[0]);
2877 		return;
2878 	}
2879 
2880 
2881 	/*
2882 	 * Check for variants
2883 	 */
2884 #ifdef	ISP2100_SCCLUN
2885 	if (isp->isp_type & ISP_HA_FC) {
2886 		switch (mbp->param[0]) {
2887 		case MBOX_ABORT:
2888 			inparam = 7;
2889 			break;
2890 		case MBOX_ABORT_DEVICE:
2891 		case MBOX_START_QUEUE:
2892 		case MBOX_STOP_QUEUE:
2893 		case MBOX_SINGLE_STEP_QUEUE:
2894 		case MBOX_ABORT_QUEUE:
2895 		case MBOX_GET_DEV_QUEUE_STATUS:
2896 			inparam = 3;
2897 			break;
2898 		default:
2899 			break;
2900 		}
2901 	}
2902 #endif
2903 
2904 command_known:
2905 
2906 #define	NEW_MB_WAY	1
2907 #ifdef	NEW_MB_WAY
2908 	/*
2909 	 * Set semaphore on mailbox registers to win any races to acquire them.
2910 	 */
2911 	ISP_WRITE(isp, BIU_SEMA, 1);
2912 #endif
2913 
2914 
2915 	/*
2916 	 * Make sure we can send some words. Check to see id there's
2917 	 * an async mbox event pending.
2918 	 */
2919 
2920 	loops = MBOX_DELAY_COUNT;
2921 	while ((ISP_READ(isp, HCCR) & HCCR_HOST_INT) != 0) {
2922 		SYS_DELAY(100);
2923 		if (ISP_READ(isp, BIU_SEMA) & 1) {
2924 			int fph;
2925 			u_int16_t mbox = ISP_READ(isp, OUTMAILBOX0);
2926 			/*
2927 			 * We have a pending MBOX async event.
2928 			 */
2929 			if (mbox & 0x8000) {
2930 				fph = isp_parse_async(isp, (int) mbox);
2931 				ISP_WRITE(isp, BIU_SEMA, 0);
2932 				ISP_WRITE(isp, HCCR, HCCR_CMD_CLEAR_RISC_INT);
2933 				if (fph < 0) {
2934 					return;
2935 				} else if (fph > 0) {
2936 					isp_fastpost_complete(isp, fph);
2937 				}
2938 				SYS_DELAY(100);
2939 				goto command_known;
2940 			}
2941 			/*
2942 			 * We have a pending MBOX completion? Might be
2943 			 * from a previous command. We can't (sometimes)
2944 			 * just clear HOST INTERRUPT, so we'll just silently
2945 			 * eat this here.
2946 			 */
2947 			if (mbox == MBOX_COMMAND_COMPLETE) {
2948 				ISP_WRITE(isp, BIU_SEMA, 0);
2949 				ISP_WRITE(isp, HCCR, HCCR_CMD_CLEAR_RISC_INT);
2950 				SYS_DELAY(100);
2951 				goto command_known;
2952 			}
2953 		}
2954 		if (--loops < 0) {
2955 			if (dld++ > 10) {
2956 				PRINTF("%s: isp_mboxcmd could not get command "
2957 				    "started\n", isp->isp_name);
2958 				return;
2959 			}
2960 			ISP_WRITE(isp, BIU_SEMA, 0);
2961 			ISP_WRITE(isp, HCCR, HCCR_CMD_CLEAR_RISC_INT);
2962 			goto command_known;
2963 		}
2964 	}
2965 
2966 	/*
2967 	 * Write input parameters.
2968 	 */
2969 	switch (inparam) {
2970 	case 8: ISP_WRITE(isp, INMAILBOX7, mbp->param[7]); mbp->param[7] = 0;
2971 	case 7: ISP_WRITE(isp, INMAILBOX6, mbp->param[6]); mbp->param[6] = 0;
2972 	case 6: ISP_WRITE(isp, INMAILBOX5, mbp->param[5]); mbp->param[5] = 0;
2973 	case 5: ISP_WRITE(isp, INMAILBOX4, mbp->param[4]); mbp->param[4] = 0;
2974 	case 4: ISP_WRITE(isp, INMAILBOX3, mbp->param[3]); mbp->param[3] = 0;
2975 	case 3: ISP_WRITE(isp, INMAILBOX2, mbp->param[2]); mbp->param[2] = 0;
2976 	case 2: ISP_WRITE(isp, INMAILBOX1, mbp->param[1]); mbp->param[1] = 0;
2977 	case 1: ISP_WRITE(isp, INMAILBOX0, mbp->param[0]); mbp->param[0] = 0;
2978 	}
2979 
2980 	/*
2981 	 * Clear RISC int condition.
2982 	 */
2983 	ISP_WRITE(isp, HCCR, HCCR_CMD_CLEAR_RISC_INT);
2984 
2985 	/*
2986 	 * Clear semaphore on mailbox registers so that the Qlogic
2987 	 * may update outgoing registers.
2988 	 */
2989 	ISP_WRITE(isp, BIU_SEMA, 0);
2990 
2991 	ENABLE_INTS(isp);
2992 	/*
2993 	 * Set Host Interrupt condition so that RISC will pick up mailbox regs.
2994 	 */
2995 	ISP_WRITE(isp, HCCR, HCCR_CMD_SET_HOST_INT);
2996 
2997 #ifndef	NEW_MB_WAY
2998 	/*
2999 	 * Wait until RISC int is set, except 2100
3000 	 */
3001 	if ((isp->isp_type & ISP_HA_FC) == 0) {
3002 		loops = MBOX_DELAY_COUNT;
3003 		while ((ISP_READ(isp, BIU_ISR) & BIU_ISR_RISC_INT) == 0) {
3004 			SYS_DELAY(100);
3005 			if (--loops < 0) {
3006 				PRINTF("%s: isp_mboxcmd timeout #2\n",
3007 				    isp->isp_name);
3008 				return;
3009 			}
3010 		}
3011 	}
3012 
3013 	/*
3014 	 * Check to make sure that the semaphore has been set.
3015 	 */
3016 	loops = MBOX_DELAY_COUNT;
3017 	while ((ISP_READ(isp, BIU_SEMA) & 1) == 0) {
3018 		SYS_DELAY(100);
3019 		/*
3020 		 * Wierd- I've seen the case where the semaphore register
3021 		 * isn't getting set- sort of a violation of the protocol..
3022 		 */
3023 		if (ISP_READ(isp, OUTMAILBOX0) & 0x4000)
3024 			break;
3025 		if (--loops < 0) {
3026 			PRINTF("%s: isp_mboxcmd timeout #3\n", isp->isp_name);
3027 			return;
3028 		}
3029 	}
3030 #else
3031 	/*
3032 	 * Wait until HOST INT has gone away (meaning that the Qlogic
3033 	 * has picked up the mailbox command. Wait a long time.
3034 	 */
3035 	loops = MBOX_DELAY_COUNT * 5;
3036 	while ((ISP_READ(isp, HCCR) & HCCR_CMD_CLEAR_RISC_INT) != 0) {
3037 		SYS_DELAY(100);
3038 		if (--loops < 0) {
3039 			PRINTF("%s: isp_mboxcmd timeout #2\n", isp->isp_name);
3040 			return;
3041 		}
3042 	}
3043 
3044 	/*
3045 	 * While the Semaphore registers isn't set, wait for the Qlogic
3046 	 * to process the mailbox command. Again- wait a long time.
3047 	 */
3048 	loops = MBOX_DELAY_COUNT * 5;
3049 	while ((ISP_READ(isp, BIU_SEMA) & 1) == 0) {
3050 		SYS_DELAY(100);
3051 		/*
3052 		 * Wierd- I've seen the case where the semaphore register
3053 		 * isn't getting set- sort of a violation of the protocol..
3054 		 */
3055 		if (ISP_READ(isp, OUTMAILBOX0) & 0x4000)
3056 			break;
3057 		if (--loops < 0) {
3058 			PRINTF("%s: isp_mboxcmd timeout #3\n", isp->isp_name);
3059 			return;
3060 		}
3061 	}
3062 #endif
3063 
3064 	/*
3065 	 * Make sure that the MBOX_BUSY has gone away
3066 	 */
3067 	loops = MBOX_DELAY_COUNT;
3068 	for (;;) {
3069 		u_int16_t mbox = ISP_READ(isp, OUTMAILBOX0);
3070 		if (mbox == MBOX_BUSY) {
3071 			if (--loops < 0) {
3072 				PRINTF("%s: isp_mboxcmd timeout #4\n",
3073 				    isp->isp_name);
3074 				return;
3075 			}
3076 			SYS_DELAY(100);
3077 			continue;
3078 		}
3079 		/*
3080 		 * We have a pending MBOX async event.
3081 		 */
3082 		if (mbox & 0x8000) {
3083 			int fph = isp_parse_async(isp, (int) mbox);
3084 			ISP_WRITE(isp, BIU_SEMA, 0);
3085 			ISP_WRITE(isp, HCCR, HCCR_CMD_CLEAR_RISC_INT);
3086 			if (fph < 0) {
3087 				return;
3088 			} else if (fph > 0) {
3089 				isp_fastpost_complete(isp, fph);
3090 			}
3091 			SYS_DELAY(100);
3092 			continue;
3093 		}
3094 		break;
3095 	}
3096 
3097 	/*
3098 	 * Pick up output parameters.
3099 	 */
3100 	switch (outparam) {
3101 	case 8: mbp->param[7] = ISP_READ(isp, OUTMAILBOX7);
3102 	case 7: mbp->param[6] = ISP_READ(isp, OUTMAILBOX6);
3103 	case 6: mbp->param[5] = ISP_READ(isp, OUTMAILBOX5);
3104 	case 5: mbp->param[4] = ISP_READ(isp, OUTMAILBOX4);
3105 	case 4: mbp->param[3] = ISP_READ(isp, OUTMAILBOX3);
3106 	case 3: mbp->param[2] = ISP_READ(isp, OUTMAILBOX2);
3107 	case 2: mbp->param[1] = ISP_READ(isp, OUTMAILBOX1);
3108 	case 1: mbp->param[0] = ISP_READ(isp, OUTMAILBOX0);
3109 	}
3110 
3111 	/*
3112 	 * Clear RISC int.
3113 	 */
3114 	ISP_WRITE(isp, HCCR, HCCR_CMD_CLEAR_RISC_INT);
3115 
3116 	/*
3117 	 * Release semaphore on mailbox registers
3118 	 */
3119 	ISP_WRITE(isp, BIU_SEMA, 0);
3120 
3121 	/*
3122 	 * Just to be chatty here...
3123 	 */
3124 	switch(mbp->param[0]) {
3125 	case MBOX_COMMAND_COMPLETE:
3126 		break;
3127 	case MBOX_INVALID_COMMAND:
3128 		IDPRINTF(2, ("%s: mbox cmd %x failed with INVALID_COMMAND\n",
3129 		    isp->isp_name, opcode));
3130 		break;
3131 	case MBOX_HOST_INTERFACE_ERROR:
3132 		PRINTF("%s: mbox cmd %x failed with HOST_INTERFACE_ERROR\n",
3133 		    isp->isp_name, opcode);
3134 		break;
3135 	case MBOX_TEST_FAILED:
3136 		PRINTF("%s: mbox cmd %x failed with TEST_FAILED\n",
3137 		    isp->isp_name, opcode);
3138 		break;
3139 	case MBOX_COMMAND_ERROR:
3140 		PRINTF("%s: mbox cmd %x failed with COMMAND_ERROR\n",
3141 		    isp->isp_name, opcode);
3142 		break;
3143 	case MBOX_COMMAND_PARAM_ERROR:
3144 		switch (opcode) {
3145 		case MBOX_GET_PORT_DB:
3146 		case MBOX_GET_PORT_NAME:
3147 		case MBOX_GET_DEV_QUEUE_PARAMS:
3148 			break;
3149 		default:
3150 			PRINTF("%s: mbox cmd %x failed with "
3151 			    "COMMAND_PARAM_ERROR\n", isp->isp_name, opcode);
3152 		}
3153 		break;
3154 
3155 	/*
3156 	 * Be silent about these...
3157 	 */
3158 
3159 	case ASYNC_LIP_OCCURRED:
3160 	case ASYNC_LOOP_UP:
3161 	case ASYNC_LOOP_DOWN:
3162 	case ASYNC_LOOP_RESET:
3163 	case ASYNC_CHANGE_NOTIFY:
3164 		break;
3165 	case ASYNC_PDB_CHANGED:
3166 		isp_mark_getpdb_all(isp);
3167 		break;
3168 
3169 	default:
3170 		/*
3171 		 * The expected return of EXEC_FIRMWARE is zero.
3172 		 */
3173 		if ((opcode == MBOX_EXEC_FIRMWARE && mbp->param[0] != 0) ||
3174 		    (opcode != MBOX_EXEC_FIRMWARE)) {
3175 			PRINTF("%s: mbox cmd %x failed with error %x\n",
3176 				isp->isp_name, opcode, mbp->param[0]);
3177 		}
3178 		break;
3179 	}
3180 }
3181 
3182 void
3183 isp_lostcmd(isp, xs)
3184 	struct ispsoftc *isp;
3185 	ISP_SCSI_XFER_T *xs;
3186 {
3187 	mbreg_t mbs;
3188 
3189 	mbs.param[0] = MBOX_GET_FIRMWARE_STATUS;
3190 	isp_mboxcmd(isp, &mbs);
3191 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
3192 		isp_dumpregs(isp, "couldn't GET FIRMWARE STATUS");
3193 		return;
3194 	}
3195 	if (mbs.param[1]) {
3196 		PRINTF("%s: %d commands on completion queue\n",
3197 		       isp->isp_name, mbs.param[1]);
3198 	}
3199 	if (XS_NULL(xs))
3200 		return;
3201 
3202 	mbs.param[0] = MBOX_GET_DEV_QUEUE_STATUS;
3203 	mbs.param[1] = (XS_TGT(xs) << 8) | XS_LUN(xs);
3204 	isp_mboxcmd(isp, &mbs);
3205 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
3206 		isp_dumpregs(isp, "couldn't GET DEVICE QUEUE STATUS");
3207 		return;
3208 	}
3209 	PRINTF("%s: lost command for target %d lun %d, %d active of %d, "
3210 		"Queue State: %x\n", isp->isp_name, XS_TGT(xs),
3211 		XS_LUN(xs), mbs.param[2], mbs.param[3], mbs.param[1]);
3212 
3213 	isp_dumpregs(isp, "lost command");
3214 	/*
3215 	 * XXX: Need to try and do something to recover.
3216 	 */
3217 }
3218 
3219 static void
3220 isp_dumpregs(isp, msg)
3221 	struct ispsoftc *isp;
3222 	const char *msg;
3223 {
3224 	PRINTF("%s: %s\n", isp->isp_name, msg);
3225 	if (isp->isp_type & ISP_HA_SCSI)
3226 		PRINTF("    biu_conf1=%x", ISP_READ(isp, BIU_CONF1));
3227 	else
3228 		PRINTF("    biu_csr=%x", ISP_READ(isp, BIU2100_CSR));
3229 	PRINTF(" biu_icr=%x biu_isr=%x biu_sema=%x ", ISP_READ(isp, BIU_ICR),
3230 	       ISP_READ(isp, BIU_ISR), ISP_READ(isp, BIU_SEMA));
3231 	PRINTF("risc_hccr=%x\n", ISP_READ(isp, HCCR));
3232 
3233 
3234 	if (isp->isp_type & ISP_HA_SCSI) {
3235 		ISP_WRITE(isp, HCCR, HCCR_CMD_PAUSE);
3236 		PRINTF("    cdma_conf=%x cdma_sts=%x cdma_fifostat=%x\n",
3237 			ISP_READ(isp, CDMA_CONF), ISP_READ(isp, CDMA_STATUS),
3238 			ISP_READ(isp, CDMA_FIFO_STS));
3239 		PRINTF("    ddma_conf=%x ddma_sts=%x ddma_fifostat=%x\n",
3240 			ISP_READ(isp, DDMA_CONF), ISP_READ(isp, DDMA_STATUS),
3241 			ISP_READ(isp, DDMA_FIFO_STS));
3242 		PRINTF("    sxp_int=%x sxp_gross=%x sxp(scsi_ctrl)=%x\n",
3243 			ISP_READ(isp, SXP_INTERRUPT),
3244 			ISP_READ(isp, SXP_GROSS_ERR),
3245 			ISP_READ(isp, SXP_PINS_CONTROL));
3246 		ISP_WRITE(isp, HCCR, HCCR_CMD_RELEASE);
3247 	}
3248 	PRINTF("    mbox regs: %x %x %x %x %x\n",
3249 	    ISP_READ(isp, OUTMAILBOX0), ISP_READ(isp, OUTMAILBOX1),
3250 	    ISP_READ(isp, OUTMAILBOX2), ISP_READ(isp, OUTMAILBOX3),
3251 	    ISP_READ(isp, OUTMAILBOX4));
3252 	ISP_DUMPREGS(isp);
3253 }
3254 
3255 static void
3256 isp_dumpxflist(isp)
3257 	struct ispsoftc *isp;
3258 {
3259 	volatile ISP_SCSI_XFER_T *xs;
3260 	int i, hdp;
3261 
3262 	for (hdp = i = 0; i < RQUEST_QUEUE_LEN; i++) {
3263 		xs = isp->isp_xflist[i];
3264 		if (xs == NULL) {
3265 			continue;
3266 		}
3267 		if (hdp == 0) {
3268 			PRINTF("%s: active requests\n", isp->isp_name);
3269 			hdp++;
3270 		}
3271 		PRINTF(" Active Handle %d: tgt %d lun %d dlen %d\n",
3272 		    i+1, XS_TGT(xs), XS_LUN(xs), XS_XFRLEN(xs));
3273 	}
3274 }
3275 
3276 static void
3277 isp_fw_state(isp)
3278 	struct ispsoftc *isp;
3279 {
3280 	mbreg_t mbs;
3281 	if (isp->isp_type & ISP_HA_FC) {
3282 		int once = 0;
3283 		fcparam *fcp = isp->isp_param;
3284 again:
3285 		mbs.param[0] = MBOX_GET_FW_STATE;
3286 		isp_mboxcmd(isp, &mbs);
3287 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
3288 			switch (mbs.param[0]) {
3289 			case ASYNC_PDB_CHANGED:
3290 				isp_mark_getpdb_all(isp);
3291 				/* FALL THROUGH */
3292 			case ASYNC_LIP_OCCURRED:
3293 			case ASYNC_LOOP_UP:
3294 			case ASYNC_LOOP_DOWN:
3295 			case ASYNC_LOOP_RESET:
3296 			case ASYNC_CHANGE_NOTIFY:
3297 				if (once++ < 2) {
3298 					goto again;
3299 				}
3300 				break;
3301 			}
3302 			isp_dumpregs(isp, "GET FIRMWARE STATE failed");
3303 			return;
3304 		}
3305 		fcp->isp_fwstate = mbs.param[1];
3306 	}
3307 }
3308 
3309 static void
3310 isp_update(isp)
3311 	struct ispsoftc *isp;
3312 {
3313 	int tgt;
3314 	mbreg_t mbs;
3315 	sdparam *sdp;
3316 
3317 	isp->isp_update = 0;
3318 
3319 	if (isp->isp_type & ISP_HA_FC) {
3320 		return;
3321 	}
3322 
3323 	sdp = isp->isp_param;
3324 	for (tgt = 0; tgt < MAX_TARGETS; tgt++) {
3325 		u_int16_t flags, period, offset, changed;
3326 		int get;
3327 
3328 		if (sdp->isp_devparam[tgt].dev_enable == 0) {
3329 			continue;
3330 		}
3331 
3332 		if (sdp->isp_devparam[tgt].dev_update) {
3333 			mbs.param[0] = MBOX_SET_TARGET_PARAMS;
3334 			mbs.param[2] = sdp->isp_devparam[tgt].dev_flags;
3335 			mbs.param[3] =
3336 				(sdp->isp_devparam[tgt].sync_offset << 8) |
3337 				(sdp->isp_devparam[tgt].sync_period);
3338 			sdp->isp_devparam[tgt].dev_update = 0;
3339 			sdp->isp_devparam[tgt].dev_refresh = 1;
3340 			isp->isp_update = 1;
3341 			get = 0;
3342 		} else if (sdp->isp_devparam[tgt].dev_refresh) {
3343 			mbs.param[0] = MBOX_GET_TARGET_PARAMS;
3344 			sdp->isp_devparam[tgt].dev_refresh = 0;
3345 			get = 1;
3346 		} else {
3347 			continue;
3348 		}
3349 		mbs.param[1] = tgt << 8;
3350 		isp_mboxcmd(isp, &mbs);
3351 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
3352 			PRINTF("%s: failed to %cet SCSI parameters for "
3353 			    "target %d\n", isp->isp_name, (get)? 'g' : 's',
3354 			    tgt);
3355 			continue;
3356 		}
3357 
3358 		if (get == 0) {
3359 			/*
3360 			 * XXX: Need a SYNC_TARGET for efficiency...
3361 			 */
3362 			isp->isp_sendmarker = 1;
3363 			sdp->isp_devparam[tgt].cur_dflags =
3364 			    sdp->isp_devparam[tgt].dev_flags;
3365 			continue;
3366 		}
3367 		flags = mbs.param[2];
3368 		period = mbs.param[3] & 0xff;
3369 		offset = mbs.param[3] >> 8;
3370 		if (sdp->isp_devparam[tgt].cur_dflags != flags ||
3371 		    sdp->isp_devparam[tgt].sync_period != period ||
3372 		    sdp->isp_devparam[tgt].sync_offset != offset) {
3373 			IDPRINTF(3, ("%s: tgt %d flags 0x%x period %d "
3374 			    "off %d\n", isp->isp_name, tgt, flags,
3375 			    period, offset));
3376 			changed = 1;
3377 		} else {
3378 			changed = 0;
3379 		}
3380 
3381 		sdp->isp_devparam[tgt].cur_dflags = flags;
3382 		sdp->isp_devparam[tgt].dev_flags = flags;
3383 		sdp->isp_devparam[tgt].sync_period = period;
3384 		sdp->isp_devparam[tgt].sync_offset = offset;
3385 		if (sdp->isp_devparam[tgt].dev_announced == 0 || changed) {
3386 			if (isp_async(isp, ISPASYNC_NEW_TGT_PARAMS, &tgt))
3387 				sdp->isp_devparam[tgt].dev_announced = 0;
3388 			else
3389 				sdp->isp_devparam[tgt].dev_announced = 1;
3390 		}
3391 	}
3392 }
3393 
3394 static void
3395 isp_setdfltparm(isp)
3396 	struct ispsoftc *isp;
3397 {
3398 	int i;
3399 	mbreg_t mbs;
3400 	sdparam *sdp;
3401 
3402 	/*
3403 	 * Been there, done that, got the T-shirt...
3404 	 */
3405 	if (isp->isp_gotdparms) {
3406 		IDPRINTF(3, ("%s: already have dparms\n", isp->isp_name));
3407 		return;
3408 	}
3409 	isp->isp_gotdparms = 1;
3410 
3411 	if ((isp->isp_confopts & ISP_CFG_NONVRAM) == 0 &&
3412 	    (isp_read_nvram(isp) == 0)) {
3413 		return;
3414 	}
3415 	if (IS_FC(isp)) {
3416 		fcparam *fcp = (fcparam *) isp->isp_param;
3417 		fcp->isp_maxfrmlen = ICB_DFLT_FRMLEN;
3418 		fcp->isp_maxalloc = 256;
3419 		fcp->isp_execthrottle = 16;
3420 		fcp->isp_retry_delay = 5;
3421 		fcp->isp_retry_count = 0;
3422 		/*
3423 		 * It would be nice to fake up a WWN in case we don't
3424 		 * get one out of NVRAM. Solaris does this for SOCAL
3425 		 * cards that don't have SBus properties- it sets up
3426 		 * a WWN based upon the system MAC Address.
3427 		 */
3428 		fcp->isp_wwn = 0;
3429 		return;
3430 	}
3431 
3432 	sdp = (sdparam *) isp->isp_param;
3433 	mbs.param[0] = MBOX_GET_ACT_NEG_STATE;
3434 	isp_mboxcmd(isp, &mbs);
3435 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
3436 		IDPRINTF(2, ("could not GET ACT NEG STATE\n"));
3437 		sdp->isp_req_ack_active_neg = 1;
3438 		sdp->isp_data_line_active_neg = 1;
3439 	} else {
3440 		sdp->isp_req_ack_active_neg = (mbs.param[1] >> 4) & 0x1;
3441 		sdp->isp_data_line_active_neg = (mbs.param[1] >> 5) & 0x1;
3442 	}
3443 
3444 	for (i = 0; i < MAX_TARGETS; i++) {
3445 		sdp->isp_devparam[i].dev_flags = DPARM_DEFAULT;
3446 		sdp->isp_devparam[i].cur_dflags = DPARM_SAFE_DFLT;
3447 		if (isp->isp_type < ISP_HA_SCSI_1040 ||
3448 		    (sdp->isp_clock && sdp->isp_clock < 60)) {
3449 			sdp->isp_devparam[i].sync_offset =
3450 			    ISP_10M_SYNCPARMS >> 8;
3451 			sdp->isp_devparam[i].sync_period =
3452 			    ISP_10M_SYNCPARMS & 0xff;
3453 		} else {
3454 			sdp->isp_devparam[i].sync_offset =
3455 			    ISP_20M_SYNCPARMS >> 8;
3456 			sdp->isp_devparam[i].sync_period =
3457 			    ISP_20M_SYNCPARMS & 0xff;
3458 		}
3459 
3460 		/*
3461 		 * Don't get current target parameters if we've been
3462 		 * told not to use NVRAM- it's really the same thing.
3463 		 */
3464 		if (isp->isp_confopts & ISP_CFG_NONVRAM)
3465 			continue;
3466 
3467 		mbs.param[0] = MBOX_GET_TARGET_PARAMS;
3468 		mbs.param[1] = i << 8;
3469 		isp_mboxcmd(isp, &mbs);
3470 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
3471 			continue;
3472 		}
3473 		sdp->isp_devparam[i].dev_flags = mbs.param[2];
3474 		/*
3475 		 * The maximum period we can really see
3476 		 * here is 100 (decimal), or 400 ns.
3477 		 * For some unknown reason we sometimes
3478 		 * get back wildass numbers from the
3479 		 * boot device's parameters.
3480 		 *
3481 		 * XXX: Hmm- this may be based on a different
3482 		 * XXX: clock rate.
3483 		 */
3484 		if ((mbs.param[3] & 0xff) <= 0x64) {
3485 			sdp->isp_devparam[i].sync_period = mbs.param[3] & 0xff;
3486 			sdp->isp_devparam[i].sync_offset = mbs.param[3] >> 8;
3487 		}
3488 
3489 		/*
3490 		 * It is not safe to run Ultra Mode with a clock < 60.
3491 		 */
3492 		if (((sdp->isp_clock && sdp->isp_clock < 60) ||
3493 		    (isp->isp_type < ISP_HA_SCSI_1020A)) &&
3494 		    (sdp->isp_devparam[i].sync_period ==
3495 		    (ISP_20M_SYNCPARMS & 0xff))) {
3496 			sdp->isp_devparam[i].sync_offset =
3497 			    ISP_10M_SYNCPARMS >> 8;
3498 			sdp->isp_devparam[i].sync_period =
3499 			    ISP_10M_SYNCPARMS & 0xff;
3500 		}
3501 	}
3502 
3503 	/*
3504 	 * Set Default Host Adapter Parameters
3505 	 */
3506 	sdp->isp_cmd_dma_burst_enable = 1;
3507 	sdp->isp_data_dma_burst_enabl = 1;
3508 	sdp->isp_fifo_threshold = 0;
3509 	sdp->isp_initiator_id = 7;
3510 	if (isp->isp_type >= ISP_HA_SCSI_1040) {
3511 		sdp->isp_async_data_setup = 9;
3512 	} else {
3513 		sdp->isp_async_data_setup = 6;
3514 	}
3515 	sdp->isp_selection_timeout = 250;
3516 	sdp->isp_max_queue_depth = 128;
3517 	sdp->isp_tag_aging = 8;
3518 	sdp->isp_bus_reset_delay = 3;
3519 	sdp->isp_retry_count = 0;
3520 	sdp->isp_retry_delay = 1;
3521 
3522 	for (i = 0; i < MAX_TARGETS; i++) {
3523 		sdp->isp_devparam[i].exc_throttle = 16;
3524 		sdp->isp_devparam[i].dev_enable = 1;
3525 	}
3526 }
3527 
3528 /*
3529  * Re-initialize the ISP and complete all orphaned commands
3530  * with a 'botched' notice.
3531  *
3532  * Locks held prior to coming here.
3533  */
3534 
3535 void
3536 isp_restart(isp)
3537 	struct ispsoftc *isp;
3538 {
3539 	ISP_SCSI_XFER_T *tlist[RQUEST_QUEUE_LEN], *xs;
3540 	int i;
3541 
3542 	for (i = 0; i < RQUEST_QUEUE_LEN; i++) {
3543 		tlist[i] = (ISP_SCSI_XFER_T *) isp->isp_xflist[i];
3544 		isp->isp_xflist[i] = NULL;
3545 	}
3546 	isp_reset(isp);
3547 	if (isp->isp_state == ISP_RESETSTATE) {
3548 		isp_init(isp);
3549 		if (isp->isp_state == ISP_INITSTATE) {
3550 			isp->isp_state = ISP_RUNSTATE;
3551 		}
3552 	}
3553 	if (isp->isp_state != ISP_RUNSTATE) {
3554 		PRINTF("%s: isp_restart cannot restart ISP\n", isp->isp_name);
3555 	}
3556 
3557 	for (i = 0; i < RQUEST_QUEUE_LEN; i++) {
3558 		xs = tlist[i];
3559 		if (XS_NULL(xs)) {
3560 			continue;
3561 		}
3562 		if (isp->isp_nactive > 0)
3563 		    isp->isp_nactive--;
3564 		XS_RESID(xs) = XS_XFRLEN(xs);
3565 		XS_SETERR(xs, HBA_BUSRESET);
3566 		XS_CMD_DONE(xs);
3567 	}
3568 }
3569 
3570 /*
3571  * NVRAM Routines
3572  */
3573 
3574 static int
3575 isp_read_nvram(isp)
3576 	struct ispsoftc *isp;
3577 {
3578 	int i, amt;
3579 	u_int8_t csum, minversion;
3580 	union {
3581 		u_int8_t _x[ISP2100_NVRAM_SIZE];
3582 		u_int16_t _s[ISP2100_NVRAM_SIZE>>1];
3583 	} _n;
3584 #define	nvram_data	_n._x
3585 #define	nvram_words	_n._s
3586 
3587 	if (IS_FC(isp)) {
3588 		amt = ISP2100_NVRAM_SIZE;
3589 		minversion = 1;
3590 	} else {
3591 		amt = ISP_NVRAM_SIZE;
3592 		minversion = 2;
3593 	}
3594 
3595 	/*
3596 	 * Just read the first two words first to see if we have a valid
3597 	 * NVRAM to continue reading the rest with.
3598 	 */
3599 	for (i = 0; i < 2; i++) {
3600 		isp_rdnvram_word(isp, i, &nvram_words[i]);
3601 	}
3602 	if (nvram_data[0] != 'I' || nvram_data[1] != 'S' ||
3603 	    nvram_data[2] != 'P') {
3604 		if (isp->isp_bustype != ISP_BT_SBUS) {
3605 			PRINTF("%s: invalid NVRAM header\n", isp->isp_name);
3606 		}
3607 		return (-1);
3608 	}
3609 	for (i = 2; i < amt>>1; i++) {
3610 		isp_rdnvram_word(isp, i, &nvram_words[i]);
3611 	}
3612 	for (csum = 0, i = 0; i < amt; i++) {
3613 		csum += nvram_data[i];
3614 	}
3615 	if (csum != 0) {
3616 		PRINTF("%s: invalid NVRAM checksum\n", isp->isp_name);
3617 		return (-1);
3618 	}
3619 	if (ISP_NVRAM_VERSION(nvram_data) < minversion) {
3620 		PRINTF("%s: version %d NVRAM not understood\n", isp->isp_name,
3621 		    ISP_NVRAM_VERSION(nvram_data));
3622 		return (-1);
3623 	}
3624 
3625 	if (isp->isp_type & ISP_HA_SCSI) {
3626 		sdparam *sdp = (sdparam *) isp->isp_param;
3627 
3628 		sdp->isp_fifo_threshold =
3629 			ISP_NVRAM_FIFO_THRESHOLD(nvram_data) |
3630 			(ISP_NVRAM_FIFO_THRESHOLD_128(nvram_data) << 2);
3631 
3632 		sdp->isp_initiator_id =
3633 			ISP_NVRAM_INITIATOR_ID(nvram_data);
3634 
3635 		sdp->isp_bus_reset_delay =
3636 			ISP_NVRAM_BUS_RESET_DELAY(nvram_data);
3637 
3638 		sdp->isp_retry_count =
3639 			ISP_NVRAM_BUS_RETRY_COUNT(nvram_data);
3640 
3641 		sdp->isp_retry_delay =
3642 			ISP_NVRAM_BUS_RETRY_DELAY(nvram_data);
3643 
3644 		sdp->isp_async_data_setup =
3645 			ISP_NVRAM_ASYNC_DATA_SETUP_TIME(nvram_data);
3646 
3647 		if (isp->isp_type >= ISP_HA_SCSI_1040) {
3648 			if (sdp->isp_async_data_setup < 9) {
3649 				sdp->isp_async_data_setup = 9;
3650 			}
3651 		} else {
3652 			if (sdp->isp_async_data_setup != 6) {
3653 				sdp->isp_async_data_setup = 6;
3654 			}
3655 		}
3656 
3657 		sdp->isp_req_ack_active_neg =
3658 			ISP_NVRAM_REQ_ACK_ACTIVE_NEGATION(nvram_data);
3659 
3660 		sdp->isp_data_line_active_neg =
3661 			ISP_NVRAM_DATA_LINE_ACTIVE_NEGATION(nvram_data);
3662 
3663 		sdp->isp_data_dma_burst_enabl =
3664 			ISP_NVRAM_DATA_DMA_BURST_ENABLE(nvram_data);
3665 
3666 		sdp->isp_cmd_dma_burst_enable =
3667 			ISP_NVRAM_CMD_DMA_BURST_ENABLE(nvram_data);
3668 
3669 		sdp->isp_tag_aging =
3670 			ISP_NVRAM_TAG_AGE_LIMIT(nvram_data);
3671 
3672 		sdp->isp_selection_timeout =
3673 			ISP_NVRAM_SELECTION_TIMEOUT(nvram_data);
3674 
3675 		sdp->isp_max_queue_depth =
3676 			ISP_NVRAM_MAX_QUEUE_DEPTH(nvram_data);
3677 
3678 		sdp->isp_fast_mttr = ISP_NVRAM_FAST_MTTR_ENABLE(nvram_data);
3679 		if (isp->isp_dblev > 2) {
3680 			static char *true = "true";
3681 			static char *false = "false";
3682 			PRINTF("%s: NVRAM values:\n", isp->isp_name);
3683 			PRINTF("             Fifo Threshold = 0x%x\n",
3684 			    sdp->isp_fifo_threshold);
3685 			PRINTF("            Bus Reset Delay = %d\n",
3686 			    sdp->isp_bus_reset_delay);
3687 			PRINTF("                Retry Count = %d\n",
3688 			    sdp->isp_retry_count);
3689 			PRINTF("                Retry Delay = %d\n",
3690 			    sdp->isp_retry_delay);
3691 			PRINTF("              Tag Age Limit = %d\n",
3692 			    sdp->isp_tag_aging);
3693 			PRINTF("          Selection Timeout = %d\n",
3694 			    sdp->isp_selection_timeout);
3695 			PRINTF("            Max Queue Depth = %d\n",
3696 			    sdp->isp_max_queue_depth);
3697 			PRINTF("           Async Data Setup = 0x%x\n",
3698 			    sdp->isp_async_data_setup);
3699 			PRINTF("    REQ/ACK Active Negation = %s\n",
3700 			    sdp->isp_req_ack_active_neg? true : false);
3701 			PRINTF("  Data Line Active Negation = %s\n",
3702 			    sdp->isp_data_line_active_neg? true : false);
3703 			PRINTF("      Data DMA Burst Enable = %s\n",
3704 			    sdp->isp_data_dma_burst_enabl? true : false);
3705 			PRINTF("       Cmd DMA Burst Enable = %s\n",
3706 			    sdp->isp_cmd_dma_burst_enable? true : false);
3707 			PRINTF("                  Fast MTTR = %s\n",
3708 			    sdp->isp_fast_mttr? true : false);
3709 		}
3710 		for (i = 0; i < MAX_TARGETS; i++) {
3711 			sdp->isp_devparam[i].dev_enable =
3712 				ISP_NVRAM_TGT_DEVICE_ENABLE(nvram_data, i);
3713 			sdp->isp_devparam[i].exc_throttle =
3714 				ISP_NVRAM_TGT_EXEC_THROTTLE(nvram_data, i);
3715 			sdp->isp_devparam[i].sync_offset =
3716 				ISP_NVRAM_TGT_SYNC_OFFSET(nvram_data, i);
3717 			sdp->isp_devparam[i].sync_period =
3718 				ISP_NVRAM_TGT_SYNC_PERIOD(nvram_data, i);
3719 
3720 			if (isp->isp_type < ISP_HA_SCSI_1040) {
3721 				/*
3722 				 * If we're not ultra, we can't possibly
3723 				 * be a shorter period than this.
3724 				 */
3725 				if (sdp->isp_devparam[i].sync_period < 0x19) {
3726 					sdp->isp_devparam[i].sync_period =
3727 					    0x19;
3728 				}
3729 				if (sdp->isp_devparam[i].sync_offset > 0xc) {
3730 					sdp->isp_devparam[i].sync_offset =
3731 					    0x0c;
3732 				}
3733 			} else {
3734 				if (sdp->isp_devparam[i].sync_offset > 0x8) {
3735 					sdp->isp_devparam[i].sync_offset = 0x8;
3736 				}
3737 			}
3738 			sdp->isp_devparam[i].dev_flags = 0;
3739 			if (ISP_NVRAM_TGT_RENEG(nvram_data, i))
3740 				sdp->isp_devparam[i].dev_flags |= DPARM_RENEG;
3741 			if (ISP_NVRAM_TGT_QFRZ(nvram_data, i)) {
3742 				PRINTF("%s: not supporting QFRZ option for "
3743 				    "target %d\n", isp->isp_name, i);
3744 			}
3745 			sdp->isp_devparam[i].dev_flags |= DPARM_ARQ;
3746 			if (ISP_NVRAM_TGT_ARQ(nvram_data, i) == 0) {
3747 				PRINTF("%s: not disabling ARQ option for "
3748 				    "target %d\n", isp->isp_name, i);
3749 			}
3750 			if (ISP_NVRAM_TGT_TQING(nvram_data, i))
3751 				sdp->isp_devparam[i].dev_flags |= DPARM_TQING;
3752 			if (ISP_NVRAM_TGT_SYNC(nvram_data, i))
3753 				sdp->isp_devparam[i].dev_flags |= DPARM_SYNC;
3754 			if (ISP_NVRAM_TGT_WIDE(nvram_data, i))
3755 				sdp->isp_devparam[i].dev_flags |= DPARM_WIDE;
3756 			if (ISP_NVRAM_TGT_PARITY(nvram_data, i))
3757 				sdp->isp_devparam[i].dev_flags |= DPARM_PARITY;
3758 			if (ISP_NVRAM_TGT_DISC(nvram_data, i))
3759 				sdp->isp_devparam[i].dev_flags |= DPARM_DISC;
3760 			if (isp->isp_dblev > 2) {
3761 				PRINTF("   Target %d: Enabled %d Throttle %d "
3762 				    "Offset %d Period %d Flags 0x%x\n", i,
3763 				    sdp->isp_devparam[i].dev_enable,
3764 				    sdp->isp_devparam[i].exc_throttle,
3765 				    sdp->isp_devparam[i].sync_offset,
3766 				    sdp->isp_devparam[i].sync_period,
3767 				    sdp->isp_devparam[i].dev_flags);
3768 			}
3769 		}
3770 	} else {
3771 		fcparam *fcp = (fcparam *) isp->isp_param;
3772 		union {
3773 			struct {
3774 #if	BYTE_ORDER == BIG_ENDIAN
3775 				u_int32_t hi32;
3776 				u_int32_t lo32;
3777 #else
3778 				u_int32_t lo32;
3779 				u_int32_t hi32;
3780 #endif
3781 			} wds;
3782 			u_int64_t full64;
3783 		} wwnstore;
3784 
3785 		wwnstore.full64 = ISP2100_NVRAM_NODE_NAME(nvram_data);
3786 		PRINTF("%s: Adapter WWN 0x%08x%08x\n", isp->isp_name,
3787 		    wwnstore.wds.hi32, wwnstore.wds.lo32);
3788 		fcp->isp_wwn = wwnstore.full64;
3789 		wwnstore.full64 = ISP2100_NVRAM_BOOT_NODE_NAME(nvram_data);
3790 		if (wwnstore.full64 != 0) {
3791 			PRINTF("%s: BOOT DEVICE WWN 0x%08x%08x\n",
3792 			    isp->isp_name, wwnstore.wds.hi32,
3793 			    wwnstore.wds.lo32);
3794 		}
3795 		fcp->isp_maxalloc =
3796 			ISP2100_NVRAM_MAXIOCBALLOCATION(nvram_data);
3797 		fcp->isp_maxfrmlen =
3798 			ISP2100_NVRAM_MAXFRAMELENGTH(nvram_data);
3799 		fcp->isp_retry_delay =
3800 			ISP2100_NVRAM_RETRY_DELAY(nvram_data);
3801 		fcp->isp_retry_count =
3802 			ISP2100_NVRAM_RETRY_COUNT(nvram_data);
3803 		fcp->isp_loopid =
3804 			ISP2100_NVRAM_HARDLOOPID(nvram_data);
3805 		fcp->isp_execthrottle =
3806 			ISP2100_NVRAM_EXECUTION_THROTTLE(nvram_data);
3807 		fcp->isp_fwoptions = ISP2100_NVRAM_OPTIONS(nvram_data);
3808 		if (isp->isp_dblev > 2) {
3809 			PRINTF("%s: NVRAM values:\n", isp->isp_name);
3810 			PRINTF("  Max IOCB Allocation = %d\n",
3811 			    fcp->isp_maxalloc);
3812 			PRINTF("     Max Frame Length = %d\n",
3813 			    fcp->isp_maxfrmlen);
3814 			PRINTF("   Execution Throttle = %d\n",
3815 			    fcp->isp_execthrottle);
3816 			PRINTF("          Retry Count = %d\n",
3817 			    fcp->isp_retry_count);
3818 			PRINTF("          Retry Delay = %d\n",
3819 			    fcp->isp_retry_delay);
3820 			PRINTF("         Hard Loop ID = %d\n",
3821 			    fcp->isp_loopid);
3822 			PRINTF("              Options = 0x%x\n",
3823 			    fcp->isp_fwoptions);
3824 			PRINTF("          HBA Options = 0x%x\n",
3825 			    ISP2100_NVRAM_HBA_OPTIONS(nvram_data));
3826 		}
3827 	}
3828 	IDPRINTF(3, ("%s: NVRAM is valid\n", isp->isp_name));
3829 	return (0);
3830 }
3831 
3832 static void
3833 isp_rdnvram_word(isp, wo, rp)
3834 	struct ispsoftc *isp;
3835 	int wo;
3836 	u_int16_t *rp;
3837 {
3838 	int i, cbits;
3839 	u_int16_t bit, rqst;
3840 
3841 	ISP_WRITE(isp, BIU_NVRAM, BIU_NVRAM_SELECT);
3842 	SYS_DELAY(2);
3843 	ISP_WRITE(isp, BIU_NVRAM, BIU_NVRAM_SELECT|BIU_NVRAM_CLOCK);
3844 	SYS_DELAY(2);
3845 
3846 	if (isp->isp_type & ISP_HA_FC) {
3847 		wo &= ((ISP2100_NVRAM_SIZE >> 1) - 1);
3848 		rqst = (ISP_NVRAM_READ << 8) | wo;
3849 		cbits = 10;
3850 	} else {
3851 		wo &= ((ISP_NVRAM_SIZE >> 1) - 1);
3852 		rqst = (ISP_NVRAM_READ << 6) | wo;
3853 		cbits = 8;
3854 	}
3855 
3856 	/*
3857 	 * Clock the word select request out...
3858 	 */
3859 	for (i = cbits; i >= 0; i--) {
3860 		if ((rqst >> i) & 1) {
3861 			bit = BIU_NVRAM_SELECT | BIU_NVRAM_DATAOUT;
3862 		} else {
3863 			bit = BIU_NVRAM_SELECT;
3864 		}
3865 		ISP_WRITE(isp, BIU_NVRAM, bit);
3866 		SYS_DELAY(2);
3867 		ISP_WRITE(isp, BIU_NVRAM, bit | BIU_NVRAM_CLOCK);
3868 		SYS_DELAY(2);
3869 		ISP_WRITE(isp, BIU_NVRAM, bit);
3870 		SYS_DELAY(2);
3871 	}
3872 	/*
3873 	 * Now read the result back in (bits come back in MSB format).
3874 	 */
3875 	*rp = 0;
3876 	for (i = 0; i < 16; i++) {
3877 		u_int16_t rv;
3878 		*rp <<= 1;
3879 		ISP_WRITE(isp, BIU_NVRAM, BIU_NVRAM_SELECT|BIU_NVRAM_CLOCK);
3880 		SYS_DELAY(2);
3881 		rv = ISP_READ(isp, BIU_NVRAM);
3882 		if (rv & BIU_NVRAM_DATAIN) {
3883 			*rp |= 1;
3884 		}
3885 		SYS_DELAY(2);
3886 		ISP_WRITE(isp, BIU_NVRAM, BIU_NVRAM_SELECT);
3887 		SYS_DELAY(2);
3888 	}
3889 	ISP_WRITE(isp, BIU_NVRAM, 0);
3890 	SYS_DELAY(2);
3891 #if	BYTE_ORDER == BIG_ENDIAN
3892 	*rp = ((*rp >> 8) | ((*rp & 0xff) << 8));
3893 #endif
3894 }
3895