xref: /netbsd-src/sys/dev/ic/isp.c (revision 7c7c171d130af9949261bc7dce2150a03c3d239c)
1 /*	$NetBSD: isp.c,v 1.21 1998/03/24 23:37:53 mjacob Exp $ */
2 
3 /*
4  * Machine Independent (well, as best as possible)
5  * code for the Qlogic ISP SCSI adapters.
6  *
7  * Specific probe attach and support routines for Qlogic ISP SCSI adapters.
8  *
9  * Copyright (c) 1997 by Matthew Jacob
10  * NASA AMES Research Center.
11  * All rights reserved.
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  * 1. Redistributions of source code must retain the above copyright
17  *    notice immediately at the beginning of the file, without modification,
18  *    this list of conditions, and the following disclaimer.
19  * 2. Redistributions in binary form must reproduce the above copyright
20  *    notice, this list of conditions and the following disclaimer in the
21  *    documentation and/or other materials provided with the distribution.
22  * 3. The name of the author may not be used to endorse or promote products
23  *    derived from this software without specific prior written permission.
24  *
25  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
29  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35  * SUCH DAMAGE.
36  */
37 
38 /*
39  * Inspiration and ideas about this driver are from Erik Moe's Linux driver
40  * (qlogicisp.c) and Dave Miller's SBus version of same (qlogicisp.c)
41  */
42 
43 #include <sys/types.h>
44 #include <sys/param.h>
45 #include <sys/systm.h>
46 #include <sys/kernel.h>
47 #include <sys/errno.h>
48 #include <sys/ioctl.h>
49 #include <sys/device.h>
50 #include <sys/malloc.h>
51 #include <sys/buf.h>
52 #include <sys/proc.h>
53 #include <sys/user.h>
54 
55 
56 #include <dev/scsipi/scsi_all.h>
57 #include <dev/scsipi/scsipi_all.h>
58 #include <dev/scsipi/scsiconf.h>
59 
60 #include <dev/scsipi/scsi_message.h>
61 #include <dev/scsipi/scsipi_debug.h>
62 
63 #include <vm/vm.h>
64 #include <vm/vm_param.h>
65 #include <vm/pmap.h>
66 
67 #include <dev/ic/ispreg.h>
68 #include <dev/ic/ispvar.h>
69 #include <dev/ic/ispmbox.h>
70 
71 #define	MBOX_DELAY_COUNT	1000000 / 100
72 
73 static void	ispminphys __P((struct buf *));
74 static int32_t	ispscsicmd __P((struct scsipi_xfer *xs));
75 static void	isp_mboxcmd __P((struct ispsoftc *, mbreg_t *));
76 
77 static struct scsipi_adapter isp_switch = {
78 	ispscsicmd, ispminphys, 0, 0
79 };
80 
81 static struct scsipi_device isp_dev = { NULL, NULL, NULL, NULL };
82 
83 #define	IDPRINTF(lev, x)	if (isp->isp_dblev >= lev) printf x
84 
85 static int isp_poll __P((struct ispsoftc *, struct scsipi_xfer *, int));
86 static int isp_parse_status
87 __P((struct ispsoftc *, ispstatusreq_t *, struct scsipi_xfer *));
88 static void isp_lostcmd
89 __P((struct ispsoftc *, struct scsipi_xfer *, ispreq_t *));
90 static void isp_fibre_init __P((struct ispsoftc *));
91 static void isp_fw_state __P((struct ispsoftc *));
92 static void isp_dumpregs __P((struct ispsoftc *, const char *));
93 static void isp_setdparm __P((struct ispsoftc *));
94 static void isp_prtstst __P((ispstatusreq_t *));
95 
96 #define	WATCHI	(30 * hz)
97 static void isp_watch __P((void *));
98 /*
99  * Reset Hardware.
100  */
101 void
102 isp_reset(isp)
103 	struct ispsoftc *isp;
104 {
105 	mbreg_t mbs;
106 	int loops, i, cf_flags, dodnld = 1;
107 	char *revname;
108 
109 	revname = "(unknown)";
110 
111 	isp->isp_state = ISP_NILSTATE;
112 	cf_flags = isp->isp_dev.dv_cfdata->cf_flags;
113 
114 	/*
115 	 * Basic types have been set in the MD code.
116 	 * See if we can't figure out more here.
117 	 */
118 	if (isp->isp_type & ISP_HA_FC) {
119 		isp->isp_dblev = 3;
120 		revname = "2100";
121 	} else {
122 #ifdef	SCSIDEBUG
123 		isp->isp_dblev = 2;
124 #else
125 		isp->isp_dblev = 1;
126 #endif
127 		i = ISP_READ(isp, BIU_CONF0) & BIU_CONF0_HW_MASK;
128 		switch (i) {
129 		default:
130 			printf("%s: unknown ISP type %x\n", isp->isp_name, i);
131 			isp->isp_type = ISP_HA_SCSI_1020;
132 			break;
133 		case 1:
134 		case 2:
135 			revname = "1020";
136 			isp->isp_type = ISP_HA_SCSI_1020;
137 			break;
138 		case 3:
139 			revname = "1040A";
140 			isp->isp_type = ISP_HA_SCSI_1040A;
141 			break;
142 		case 5:
143 			revname = "1040B";
144 			isp->isp_type = ISP_HA_SCSI_1040B;
145 			break;
146 		}
147 	}
148 
149 	/*
150 	 * Do MD specific pre initialization
151 	 */
152 	ISP_RESET0(isp);
153 	isp_setdparm(isp);
154 
155 	/*
156 	 * Hit the chip over the head with hammer,
157 	 * and give the ISP a chance to recover.
158 	 */
159 
160 	if (isp->isp_type & ISP_HA_SCSI) {
161 		ISP_WRITE(isp, BIU_ICR, BIU_ICR_SOFT_RESET);
162 		/*
163 		 * A slight delay...
164 		 */
165 		delay(100);
166 
167 		/*
168 		 * Clear data && control DMA engines.
169 		 */
170 		ISP_WRITE(isp, CDMA_CONTROL,
171 		      DMA_CNTRL_CLEAR_CHAN | DMA_CNTRL_RESET_INT);
172 		ISP_WRITE(isp, DDMA_CONTROL,
173 		      DMA_CNTRL_CLEAR_CHAN | DMA_CNTRL_RESET_INT);
174 	} else {
175 		ISP_WRITE(isp, BIU2100_CSR, BIU2100_SOFT_RESET);
176 		/*
177 		 * A slight delay...
178 		 */
179 		delay(100);
180 		ISP_WRITE(isp, CDMA2100_CONTROL,
181 			DMA_CNTRL2100_CLEAR_CHAN | DMA_CNTRL2100_RESET_INT);
182 		ISP_WRITE(isp, TDMA2100_CONTROL,
183 			DMA_CNTRL2100_CLEAR_CHAN | DMA_CNTRL2100_RESET_INT);
184 		ISP_WRITE(isp, RDMA2100_CONTROL,
185 			DMA_CNTRL2100_CLEAR_CHAN | DMA_CNTRL2100_RESET_INT);
186 	}
187 
188 	/*
189 	 * Wait for ISP to be ready to go...
190 	 */
191 	loops = MBOX_DELAY_COUNT;
192 	for (;;) {
193 		if (isp->isp_type & ISP_HA_SCSI) {
194 			if (!(ISP_READ(isp, BIU_ICR) & BIU_ICR_SOFT_RESET))
195 				break;
196 		} else {
197 			if (!(ISP_READ(isp, BIU2100_CSR) & BIU2100_SOFT_RESET))
198 				break;
199 		}
200 		delay(100);
201 		if (--loops < 0) {
202 			isp_dumpregs(isp, "chip reset timed out");
203 			return;
204 		}
205 	}
206 	/*
207 	 * More initialization
208 	 */
209 	if (isp->isp_type & ISP_HA_SCSI) {
210 		ISP_WRITE(isp, BIU_CONF1, 0);
211 	} else {
212 		ISP_WRITE(isp, BIU2100_CSR, 0);
213 		ISP_WRITE(isp, RISC_MTR2100, 0x1212);	/* FM */
214 	}
215 
216 	ISP_WRITE(isp, HCCR, HCCR_CMD_RESET);
217 	delay(100);
218 
219 	if (isp->isp_type & ISP_HA_SCSI) {
220 		ISP_SETBITS(isp, BIU_CONF1, isp->isp_mdvec->dv_conf1);
221 		if (isp->isp_mdvec->dv_conf1 & BIU_BURST_ENABLE) {
222 			ISP_SETBITS(isp, CDMA_CONF, DMA_ENABLE_BURST);
223 			ISP_SETBITS(isp, DDMA_CONF, DMA_ENABLE_BURST);
224 		}
225 	}
226 	ISP_WRITE(isp, HCCR, HCCR_CMD_RELEASE); /* release paused processor */
227 
228 	/*
229 	 * Do MD specific post initialization
230 	 */
231 	ISP_RESET1(isp);
232 
233 	/*
234 	 * Enable interrupts
235 	 */
236 	ENABLE_INTS(isp);
237 
238 	/*
239 	 * Do some sanity checking.
240 	 */
241 	mbs.param[0] = MBOX_NO_OP;
242 	isp_mboxcmd(isp, &mbs);
243 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
244 		isp_dumpregs(isp, "NOP test failed");
245 		return;
246 	}
247 
248 	if (isp->isp_type & ISP_HA_SCSI) {
249 		mbs.param[0] = MBOX_MAILBOX_REG_TEST;
250 		mbs.param[1] = 0xdead;
251 		mbs.param[2] = 0xbeef;
252 		mbs.param[3] = 0xffff;
253 		mbs.param[4] = 0x1111;
254 		mbs.param[5] = 0xa5a5;
255 		isp_mboxcmd(isp, &mbs);
256 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
257 			isp_dumpregs(isp,
258 				"Mailbox Register test didn't complete");
259 			return;
260 		}
261 		if (mbs.param[1] != 0xdead || mbs.param[2] != 0xbeef ||
262 		    mbs.param[3] != 0xffff || mbs.param[4] != 0x1111 ||
263 		    mbs.param[5] != 0xa5a5) {
264 			isp_dumpregs(isp, "Register Test Failed");
265 			return;
266 		}
267 
268 	}
269 
270 	/*
271 	 * Download new Firmware, unless requested not to do so.
272 	 * This is made slightly trickier in some cases where the
273 	 * firmware of the ROM revision is newer than the revision
274 	 * compiled into the driver. So, where we used to compare
275 	 * versions of our f/w and the ROM f/w, now we just see
276 	 * whether we have f/w at all and whether a config flag
277 	 * has disabled our download.
278 	 */
279 	if (isp->isp_mdvec->dv_fwlen == 0 || (cf_flags & 0x80) != 0) {
280 		dodnld = 0;
281 	}
282 
283 	if (dodnld) {
284 		for (i = 0; i < isp->isp_mdvec->dv_fwlen; i++) {
285 			mbs.param[0] = MBOX_WRITE_RAM_WORD;
286 			mbs.param[1] = isp->isp_mdvec->dv_codeorg + i;
287 			mbs.param[2] = isp->isp_mdvec->dv_ispfw[i];
288 			isp_mboxcmd(isp, &mbs);
289 			if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
290 				isp_dumpregs(isp, "f/w download failed");
291 
292 				return;
293 			}
294 		}
295 
296 		if (isp->isp_mdvec->dv_fwlen) {
297 			/*
298 			 * Verify that it downloaded correctly.
299 			 */
300 			mbs.param[0] = MBOX_VERIFY_CHECKSUM;
301 			mbs.param[1] = isp->isp_mdvec->dv_codeorg;
302 			isp_mboxcmd(isp, &mbs);
303 			if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
304 				isp_dumpregs(isp, "ram checksum failure");
305 				return;
306 			}
307 		}
308 	} else {
309 		IDPRINTF(3, ("%s: skipping f/w download\n", isp->isp_name));
310 	}
311 
312 	/*
313 	 * Now start it rolling.
314 	 *
315 	 * If we didn't actually download f/w,
316 	 * we still need to (re)start it.
317 	 */
318 
319 	mbs.param[0] = MBOX_EXEC_FIRMWARE;
320 	mbs.param[1] = isp->isp_mdvec->dv_codeorg;
321 	isp_mboxcmd(isp, &mbs);
322 
323 	if (isp->isp_type & ISP_HA_SCSI) {
324 		/*
325 		 * Set CLOCK RATE
326 		 */
327 		if (((sdparam *)isp->isp_param)->isp_clock) {
328 			mbs.param[0] = MBOX_SET_CLOCK_RATE;
329 			mbs.param[1] = ((sdparam *)isp->isp_param)->isp_clock;
330 			isp_mboxcmd(isp, &mbs);
331 			if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
332 				isp_dumpregs(isp, "failed to set CLOCKRATE");
333 				return;
334 			}
335 		}
336 	}
337 	mbs.param[0] = MBOX_ABOUT_FIRMWARE;
338 	isp_mboxcmd(isp, &mbs);
339 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
340 		isp_dumpregs(isp, "ABOUT FIRMWARE command failed");
341 		return;
342 	}
343 	printf("%s: Board Revision %s, %s F/W Revision %d.%d\n",
344 		isp->isp_name, revname, dodnld? "loaded" : "ROM",
345 		mbs.param[1], mbs.param[2]);
346 	isp_fw_state(isp);
347 	isp->isp_state = ISP_RESETSTATE;
348 }
349 
350 /*
351  * Initialize Hardware to known state
352  */
353 void
354 isp_init(isp)
355 	struct ispsoftc *isp;
356 {
357 	sdparam *sdp;
358 	mbreg_t mbs;
359 	int s, i, l;
360 
361 	if (isp->isp_type & ISP_HA_FC) {
362 		isp_fibre_init(isp);
363 		return;
364 	}
365 
366 	sdp = isp->isp_param;
367 
368 	/*
369 	 * Try and figure out if we're connected to a differential bus.
370 	 * You have to pause the RISC processor to read SXP registers.
371 	 */
372 	s = splbio();
373 	ISP_WRITE(isp, HCCR, HCCR_CMD_PAUSE);
374 	if (ISP_READ(isp, SXP_PINS_DIFF) & SXP_PINS_DIFF_SENSE) {
375 		sdp->isp_diffmode = 1;
376 		printf("%s: Differential Mode\n", isp->isp_name);
377 	} else {
378 		/*
379 		 * Force pullups on.
380 		 */
381 		sdp->isp_req_ack_active_neg = 1;
382 		sdp->isp_data_line_active_neg = 1;
383 		sdp->isp_diffmode = 0;
384 	}
385 	ISP_WRITE(isp, HCCR, HCCR_CMD_RELEASE); /* release paused processor */
386 
387 	mbs.param[0] = MBOX_GET_INIT_SCSI_ID;
388 	isp_mboxcmd(isp, &mbs);
389 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
390 		(void) splx(s);
391 		isp_dumpregs(isp, "failed to get initiator id");
392 		return;
393 	}
394 	if (mbs.param[1] != sdp->isp_initiator_id) {
395 		printf("%s: setting Initiator ID to %d\n", isp->isp_name,
396 			sdp->isp_initiator_id);
397 		mbs.param[0] = MBOX_SET_INIT_SCSI_ID;
398 		mbs.param[1] = sdp->isp_initiator_id;
399 		isp_mboxcmd(isp, &mbs);
400 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
401 			(void) splx(s);
402 			isp_dumpregs(isp, "failed to set initiator id");
403 			return;
404 		}
405 	} else {
406 		IDPRINTF(3, ("%s: leaving Initiator ID at %d\n", isp->isp_name,
407 			sdp->isp_initiator_id));
408 	}
409 
410 	mbs.param[0] = MBOX_SET_RETRY_COUNT;
411 	mbs.param[1] = sdp->isp_retry_count;
412 	mbs.param[2] = sdp->isp_retry_delay;
413 	isp_mboxcmd(isp, &mbs);
414 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
415 		(void) splx(s);
416 		isp_dumpregs(isp, "failed to set retry count and delay");
417 		return;
418 	}
419 
420 	mbs.param[0] = MBOX_SET_ASYNC_DATA_SETUP_TIME;
421 	mbs.param[1] = sdp->isp_async_data_setup;
422 	isp_mboxcmd(isp, &mbs);
423 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
424 		(void) splx(s);
425 		isp_dumpregs(isp, "failed to set async data setup time");
426 		return;
427 	}
428 
429 	mbs.param[0] = MBOX_SET_ACTIVE_NEG_STATE;
430 	mbs.param[1] =	(sdp->isp_req_ack_active_neg << 4) |
431 			(sdp->isp_data_line_active_neg << 5);
432 	isp_mboxcmd(isp, &mbs);
433 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
434 		(void) splx(s);
435 		isp_dumpregs(isp, "failed to set active neg state");
436 		return;
437 	}
438 
439 	mbs.param[0] = MBOX_SET_TAG_AGE_LIMIT;
440 	mbs.param[1] = sdp->isp_tag_aging;
441 	isp_mboxcmd(isp, &mbs);
442 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
443 		(void) splx(s);
444 		isp_dumpregs(isp, "failed to set tag age limit");
445 		return;
446 	}
447 
448 	mbs.param[0] = MBOX_SET_SELECT_TIMEOUT;
449 	mbs.param[1] = sdp->isp_selection_timeout;
450 	isp_mboxcmd(isp, &mbs);
451 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
452 		(void) splx(s);
453 		isp_dumpregs(isp, "failed to set selection timeout");
454 		return;
455 	}
456 
457 	IDPRINTF(2, ("%s: devparm, W=wide, S=sync, T=Tag\n", isp->isp_name));
458 	for (i = 0; i < MAX_TARGETS; i++) {
459 		char bz[9];
460 		u_int16_t cj = (sdp->isp_devparam[i].sync_offset << 8) |
461 				(sdp->isp_devparam[i].sync_period);
462 
463 		if (sdp->isp_devparam[i].dev_flags & DPARM_SYNC) {
464 			u_int16_t x;
465 			if (cj == ISP_20M_SYNCPARMS) {
466 				x = 20;
467 			} else if (cj == ISP_10M_SYNCPARMS) {
468 				x = 10;
469 			} else if (cj == ISP_08M_SYNCPARMS) {
470 				x = 8;
471 			} else if (cj == ISP_05M_SYNCPARMS) {
472 				x = 5;
473 			} else if (cj == ISP_04M_SYNCPARMS) {
474 				x = 4;
475 			} else {
476 				x = 0;
477 			}
478 			sprintf(bz, "%02dMHz:", x);
479 		} else {
480 			sprintf(bz, "Async:");
481 		}
482 		if (sdp->isp_devparam[i].dev_flags & DPARM_WIDE)
483 			bz[6] = 'W';
484 		else
485 			bz[6] = ' ';
486 		if (sdp->isp_devparam[i].dev_flags & DPARM_TQING)
487 			bz[7] = 'T';
488 		else
489 			bz[7] = ' ';
490 		bz[8] = 0;
491 		IDPRINTF(2, (" id%x:%s", i, bz));
492 		if (((i+1) & 0x3) == 0)
493 			IDPRINTF(2, ("\n"));
494 		if (sdp->isp_devparam[i].dev_enable == 0)
495 			continue;
496 
497 		/*
498 		 * It is not safe to run the 1020 in ultra mode.
499 		 */
500 		if (isp->isp_type == ISP_HA_SCSI_1020 &&
501 		    cj == ISP_20M_SYNCPARMS) {
502 			printf("%s: an ISP1020 set to Ultra Speed- derating.\n",
503 				isp->isp_name);
504 			sdp->isp_devparam[i].sync_offset =
505 				ISP_10M_SYNCPARMS >> 8;
506 			sdp->isp_devparam[i].sync_period =
507 				ISP_10M_SYNCPARMS & 0xff;
508 		}
509 		mbs.param[0] = MBOX_SET_TARGET_PARAMS;
510 		mbs.param[1] = i << 8;
511 		mbs.param[2] = sdp->isp_devparam[i].dev_flags << 8;
512 		mbs.param[3] =
513 			(sdp->isp_devparam[i].sync_offset << 8) |
514 			(sdp->isp_devparam[i].sync_period);
515 
516 		IDPRINTF(3, ("%s: target %d flags %x offset %x period %x\n",
517 			     isp->isp_name, i, sdp->isp_devparam[i].dev_flags,
518 			     sdp->isp_devparam[i].sync_offset,
519 			     sdp->isp_devparam[i].sync_period));
520 		isp_mboxcmd(isp, &mbs);
521 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
522 			printf("%s: failed to set parameters for target %d\n",
523 				isp->isp_name, i);
524 			printf("%s: flags %x offset %x period %x\n",
525 				isp->isp_name, sdp->isp_devparam[i].dev_flags,
526 				sdp->isp_devparam[i].sync_offset,
527 				sdp->isp_devparam[i].sync_period);
528 			mbs.param[0] = MBOX_SET_TARGET_PARAMS;
529 			mbs.param[1] = i << 8;
530 			mbs.param[2] = DPARM_DEFAULT << 8;
531 			mbs.param[3] = ISP_10M_SYNCPARMS;
532 			isp_mboxcmd(isp, &mbs);
533 			if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
534 				(void) splx(s);
535 				printf("%s: failed even to set defaults\n",
536 					isp->isp_name);
537 				return;
538 			}
539 		}
540 		for (l = 0; l < MAX_LUNS; l++) {
541 			mbs.param[0] = MBOX_SET_DEV_QUEUE_PARAMS;
542 			mbs.param[1] = (i << 8) | l;
543 			mbs.param[2] = sdp->isp_max_queue_depth;
544 			mbs.param[3] = sdp->isp_devparam[i].exc_throttle;
545 			isp_mboxcmd(isp, &mbs);
546 			if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
547 				(void) splx(s);
548 				isp_dumpregs(isp, "failed to set device queue "
549 				       "parameters");
550 				return;
551 			}
552 		}
553 	}
554 
555 	/*
556 	 * Set up DMA for the request and result mailboxes.
557 	 */
558 	if (ISP_MBOXDMASETUP(isp)) {
559 		(void) splx(s);
560 		printf("%s: can't setup dma mailboxes\n", isp->isp_name);
561 		return;
562 	}
563 
564 	mbs.param[0] = MBOX_INIT_RES_QUEUE;
565 	mbs.param[1] = RESULT_QUEUE_LEN(isp);
566 	mbs.param[2] = (u_int16_t) (isp->isp_result_dma >> 16);
567 	mbs.param[3] = (u_int16_t) (isp->isp_result_dma & 0xffff);
568 	mbs.param[4] = 0;
569 	mbs.param[5] = 0;
570 	isp_mboxcmd(isp, &mbs);
571 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
572 		(void) splx(s);
573 		isp_dumpregs(isp, "set of response queue failed");
574 		return;
575 	}
576 	isp->isp_residx = 0;
577 
578 	mbs.param[0] = MBOX_INIT_REQ_QUEUE;
579 	mbs.param[1] = RQUEST_QUEUE_LEN(isp);
580 	mbs.param[2] = (u_int16_t) (isp->isp_rquest_dma >> 16);
581 	mbs.param[3] = (u_int16_t) (isp->isp_rquest_dma & 0xffff);
582 	mbs.param[4] = 0;
583 	mbs.param[5] = 0;
584 	isp_mboxcmd(isp, &mbs);
585 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
586 		(void) splx(s);
587 		isp_dumpregs(isp, "set of request queue failed");
588 		return;
589 	}
590 	isp->isp_reqidx = 0;
591 
592 	/*
593 	 * Unfortunately, this is the only way right now for
594 	 * forcing a sync renegotiation. If we boot off of
595 	 * an Alpha, it's put the chip in SYNC mode, but we
596 	 * haven't necessarily set up the parameters the
597 	 * same, so we'll have to yank the reset line to
598 	 * get everyone to renegotiate.
599 	 */
600 
601 	mbs.param[0] = MBOX_BUS_RESET;
602 	mbs.param[1] = 2;
603 	isp_mboxcmd(isp, &mbs);
604 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
605 		(void) splx(s);
606 		isp_dumpregs(isp, "SCSI bus reset failed");
607 	}
608 	/*
609 	 * This is really important to have set after a bus reset.
610 	 */
611 	isp->isp_sendmarker = 1;
612 	(void) splx(s);
613 	isp->isp_state = ISP_INITSTATE;
614 }
615 
616 static void
617 isp_fibre_init(isp)
618 	struct ispsoftc *isp;
619 {
620 	fcparam *fcp;
621 	isp_icb_t *icbp;
622 	mbreg_t mbs;
623 	int s, count;
624 
625 	fcp = isp->isp_param;
626 
627 	fcp->isp_retry_count = 0;
628 	fcp->isp_retry_delay = 1;
629 
630 	s = splbio();
631 	mbs.param[0] = MBOX_SET_RETRY_COUNT;
632 	mbs.param[1] = fcp->isp_retry_count;
633 	mbs.param[2] = fcp->isp_retry_delay;
634 	isp_mboxcmd(isp, &mbs);
635 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
636 		(void) splx(s);
637 		isp_dumpregs(isp, "failed to set retry count and delay");
638 		return;
639 	}
640 
641 	if (ISP_MBOXDMASETUP(isp)) {
642 		(void) splx(s);
643 		printf("%s: can't setup DMA for mailboxes\n", isp->isp_name);
644 		return;
645 	}
646 
647 	icbp = (isp_icb_t *) fcp->isp_scratch;
648 	bzero(icbp, sizeof (*icbp));
649 #if 0
650 	icbp->icb_maxfrmlen = ICB_DFLT_FRMLEN;
651 	MAKE_NODE_NAME(isp, icbp);
652 	icbp->icb_rqstqlen = RQUEST_QUEUE_LEN(isp);
653 	icbp->icb_rsltqlen = RESULT_QUEUE_LEN(isp);
654 	icbp->icb_rqstaddr[0] = (u_int16_t) (isp->isp_rquest_dma & 0xffff);
655 	icbp->icb_rqstaddr[1] = (u_int16_t) (isp->isp_rquest_dma >> 16);
656 	icbp->icb_respaddr[0] = (u_int16_t) (isp->isp_result_dma & 0xffff);
657 	icbp->icb_respaddr[1] = (u_int16_t) (isp->isp_result_dma >> 16);
658 #endif
659 	icbp->icb_version = 1;
660 	icbp->icb_maxfrmlen = ICB_DFLT_FRMLEN;
661 	icbp->icb_maxalloc = 256;
662 	icbp->icb_execthrottle = 16;
663 	icbp->icb_retry_delay = 5;
664 	icbp->icb_retry_count = 0;
665 	MAKE_NODE_NAME(isp, icbp);
666 	icbp->icb_rqstqlen = RQUEST_QUEUE_LEN(isp);
667 	icbp->icb_rsltqlen = RESULT_QUEUE_LEN(isp);
668 	icbp->icb_rqstaddr[0] = (u_int16_t) (isp->isp_rquest_dma & 0xffff);
669 	icbp->icb_rqstaddr[1] = (u_int16_t) (isp->isp_rquest_dma >> 16);
670 	icbp->icb_respaddr[0] = (u_int16_t) (isp->isp_result_dma & 0xffff);
671 	icbp->icb_respaddr[1] = (u_int16_t) (isp->isp_result_dma >> 16);
672 
673 	mbs.param[0] = MBOX_INIT_FIRMWARE;
674 	mbs.param[1] = 0;
675 	mbs.param[2] = (u_int16_t) (fcp->isp_scdma >> 16);
676 	mbs.param[3] = (u_int16_t) (fcp->isp_scdma & 0xffff);
677 	mbs.param[4] = 0;
678 	mbs.param[5] = 0;
679 	mbs.param[6] = 0;
680 	mbs.param[7] = 0;
681 	isp_mboxcmd(isp, &mbs);
682 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
683 		(void) splx(s);
684 		isp_dumpregs(isp, "INIT FIRMWARE failed");
685 		return;
686 	}
687 	isp->isp_reqidx = 0;
688 	isp->isp_residx = 0;
689 
690 	/*
691 	 * Wait up to 3 seconds for FW to go to READY state.
692 	 *
693 	 * This is all very much not right. The problem here
694 	 * is that the cable may not be plugged in, or there
695 	 * may be many many members of the loop that haven't
696 	 * been logged into.
697 	 *
698 	 * This model of doing things doesn't support dynamic
699 	 * attachment, so we just plain lose (for now).
700 	 */
701 	for (count = 0; count < 3000; count++) {
702 		isp_fw_state(isp);
703 		if (fcp->isp_fwstate == FW_READY)
704 			break;
705 		delay(1000);		/* wait one millisecond */
706 	}
707 
708 	isp->isp_sendmarker = 1;
709 
710 	(void) splx(s);
711 	isp->isp_state = ISP_INITSTATE;
712 }
713 
714 /*
715  * Complete attachment of Hardware, include subdevices.
716  */
717 void
718 isp_attach(isp)
719 	struct ispsoftc *isp;
720 {
721 	/*
722 	 * Start the watchdog timer.
723 	 */
724 	timeout(isp_watch, isp, WATCHI);
725 
726 	/*
727 	 * And complete initialization
728 	 */
729 	isp->isp_state = ISP_RUNSTATE;
730 	isp->isp_link.scsipi_scsi.channel = SCSI_CHANNEL_ONLY_ONE;
731 	isp->isp_link.adapter_softc = isp;
732 	isp->isp_link.device = &isp_dev;
733 	isp->isp_link.adapter = &isp_switch;
734 
735 	if (isp->isp_type & ISP_HA_FC) {
736 		fcparam *fcp = isp->isp_param;
737 		mbreg_t mbs;
738 		int s;
739 
740 		isp->isp_link.scsipi_scsi.max_target = MAX_FC_TARG-1;
741 		isp->isp_link.openings = RQUEST_QUEUE_LEN(isp)/(MAX_FC_TARG-1);
742 		s = splbio();
743 		mbs.param[0] = MBOX_GET_LOOP_ID;
744 		isp_mboxcmd(isp, &mbs);
745 		(void) splx(s);
746 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
747 			isp_dumpregs(isp, "GET LOOP ID failed");
748 			return;
749 		}
750 		fcp->isp_loopid = mbs.param[1];
751 		if (fcp->isp_loopid) {
752 			printf("%s: Loop ID 0x%x\n", isp->isp_name,
753 				fcp->isp_loopid);
754 		}
755 		isp->isp_link.scsipi_scsi.adapter_target = 0xff;
756 	} else {
757 		isp->isp_link.openings = RQUEST_QUEUE_LEN(isp)/(MAX_TARGETS-1);
758 		isp->isp_link.scsipi_scsi.max_target = MAX_TARGETS-1;
759 		isp->isp_link.scsipi_scsi.adapter_target =
760 			((sdparam *)isp->isp_param)->isp_initiator_id;
761 	}
762 	if (isp->isp_link.openings < 2)
763 		isp->isp_link.openings = 2;
764 	isp->isp_link.type = BUS_SCSI;
765 	config_found((void *)isp, &isp->isp_link, scsiprint);
766 }
767 
768 
769 /*
770  * Free any associated resources prior to decommissioning.
771  */
772 void
773 isp_uninit(isp)
774 	struct ispsoftc *isp;
775 {
776 	untimeout(isp_watch, isp);
777 }
778 
779 /*
780  * minphys our xfers
781  *
782  * Unfortunately, the buffer pointer describes the target device- not the
783  * adapter device, so we can't use the pointer to find out what kind of
784  * adapter we are and adjust accordingly.
785  */
786 
787 static void
788 ispminphys(bp)
789 	struct buf *bp;
790 {
791 	/*
792 	 * XX: Only the 1020 has a 24 bit limit.
793 	 */
794 	if (bp->b_bcount >= (1 << 24)) {
795 		bp->b_bcount = (1 << 24);
796 	}
797 	minphys(bp);
798 }
799 
800 /*
801  * start an xfer
802  */
803 static int32_t
804 ispscsicmd(xs)
805 	struct scsipi_xfer *xs;
806 {
807 	struct ispsoftc *isp;
808 	u_int8_t iptr, optr;
809 	union {
810 		ispreq_t *_reqp;
811 		ispreqt2_t *_t2reqp;
812 	} _u;
813 #define	reqp	_u._reqp
814 #define	t2reqp	_u._t2reqp
815 #define	UZSIZE	max(sizeof (ispreq_t), sizeof (ispreqt2_t))
816 	int s, i;
817 
818 	isp = xs->sc_link->adapter_softc;
819 
820 	if (isp->isp_type & ISP_HA_FC) {
821 		if (xs->cmdlen > 12) {
822 			printf("%s: unsupported cdb length for fibre (%d)\n",
823 				isp->isp_name, xs->cmdlen);
824 			xs->error = XS_DRIVER_STUFFUP;
825 			return (COMPLETE);
826 		}
827 	}
828 	optr = ISP_READ(isp, OUTMAILBOX4);
829 	iptr = isp->isp_reqidx;
830 
831 	reqp = (ispreq_t *) ISP_QUEUE_ENTRY(isp->isp_rquest, iptr);
832 	iptr = (iptr + 1) & (RQUEST_QUEUE_LEN(isp) - 1);
833 	if (iptr == optr) {
834 		printf("%s: Request Queue Overflow\n", isp->isp_name);
835 		xs->error = XS_DRIVER_STUFFUP;
836 		return (TRY_AGAIN_LATER);
837 	}
838 
839 	s = splbio();
840 	if (isp->isp_type & ISP_HA_FC)
841 		DISABLE_INTS(isp);
842 
843 	if (isp->isp_sendmarker) {
844 		ispmarkreq_t *marker = (ispmarkreq_t *) reqp;
845 
846 		bzero((void *) marker, sizeof (*marker));
847 		marker->req_header.rqs_entry_count = 1;
848 		marker->req_header.rqs_entry_type = RQSTYPE_MARKER;
849 		marker->req_modifier = SYNC_ALL;
850 
851 		isp->isp_sendmarker = 0;
852 
853 		if (((iptr + 1) & (RQUEST_QUEUE_LEN(isp) - 1)) == optr) {
854 			ISP_WRITE(isp, INMAILBOX4, iptr);
855 			isp->isp_reqidx = iptr;
856 
857 			if (isp->isp_type & ISP_HA_FC)
858 				ENABLE_INTS(isp);
859 			(void) splx(s);
860 			printf("%s: Request Queue Overflow+\n", isp->isp_name);
861 			xs->error = XS_DRIVER_STUFFUP;
862 			return (TRY_AGAIN_LATER);
863 		}
864 		reqp = (ispreq_t *) ISP_QUEUE_ENTRY(isp->isp_rquest, iptr);
865 		iptr = (iptr + 1) & (RQUEST_QUEUE_LEN(isp) - 1);
866 	}
867 
868 	bzero((void *) reqp, UZSIZE);
869 	reqp->req_header.rqs_entry_count = 1;
870 	if (isp->isp_type & ISP_HA_FC) {
871 		reqp->req_header.rqs_entry_type = RQSTYPE_T2RQS;
872 	} else {
873 		reqp->req_header.rqs_entry_type = RQSTYPE_REQUEST;
874 	}
875 	reqp->req_header.rqs_flags = 0;
876 	reqp->req_header.rqs_seqno = isp->isp_seqno++;
877 
878 	for (i = 0; i < RQUEST_QUEUE_LEN(isp); i++) {
879 		if (isp->isp_xflist[i] == NULL)
880 			break;
881 	}
882 	if (i == RQUEST_QUEUE_LEN(isp)) {
883 		panic("%s: ran out of xflist pointers\n", isp->isp_name);
884 		/* NOTREACHED */
885 	} else {
886 		/*
887 		 * Never have a handle that is zero, so
888 		 * set req_handle off by one.
889 		 */
890 		isp->isp_xflist[i] = xs;
891 		reqp->req_handle = i+1;
892 	}
893 
894 	if (isp->isp_type & ISP_HA_FC) {
895 		/*
896 		 * See comment in isp_intr
897 		 */
898 		xs->resid = 0;
899 		/*
900 		 * Fibre Channel always requires some kind of tag.
901 		 */
902 		if (xs->flags & SCSI_POLL) {
903 			t2reqp->req_flags = REQFLAG_STAG;
904 		} else {
905 			t2reqp->req_flags = REQFLAG_OTAG;
906 		}
907 	} else {
908 		if (xs->flags & SCSI_POLL) {
909 			reqp->req_flags = 0;
910 		} else {
911 			reqp->req_flags = REQFLAG_OTAG;
912 		}
913 	}
914 	reqp->req_lun_trn = xs->sc_link->scsipi_scsi.lun;
915 	reqp->req_target = xs->sc_link->scsipi_scsi.target;
916 	if (isp->isp_type & ISP_HA_SCSI) {
917 		reqp->req_cdblen = xs->cmdlen;
918 	}
919 	bcopy((void *)xs->cmd, reqp->req_cdb, xs->cmdlen);
920 
921 	IDPRINTF(6, ("%s(%d.%d): START%d cmd 0x%x datalen %d\n", isp->isp_name,
922 		xs->sc_link->scsipi_scsi.target, xs->sc_link->scsipi_scsi.lun,
923 		reqp->req_header.rqs_seqno, *(u_char *) xs->cmd, xs->datalen));
924 
925 	reqp->req_time = xs->timeout / 1000;
926 	if (reqp->req_time == 0 && xs->timeout)
927 		reqp->req_time = 1;
928 	if (ISP_DMASETUP(isp, xs, reqp, &iptr, optr)) {
929 		if (isp->isp_type & ISP_HA_FC)
930 			ENABLE_INTS(isp);
931 		(void) splx(s);
932 		xs->error = XS_DRIVER_STUFFUP;
933 		return (COMPLETE);
934 	}
935 	xs->error = 0;
936 	ISP_WRITE(isp, INMAILBOX4, iptr);
937 	isp->isp_reqidx = iptr;
938 	if (isp->isp_type & ISP_HA_FC)
939 		ENABLE_INTS(isp);
940 	(void) splx(s);
941 	if ((xs->flags & SCSI_POLL) == 0) {
942 		return (SUCCESSFULLY_QUEUED);
943 	}
944 
945 	/*
946 	 * If we can't use interrupts, poll on completion.
947 	 */
948 	if (isp_poll(isp, xs, xs->timeout)) {
949 #if 0
950 		/* XXX try to abort it, or whatever */
951 		if (isp_poll(isp, xs, xs->timeout) {
952 			/* XXX really nuke it */
953 		}
954 #endif
955 		/*
956 		 * If no other error occurred but we didn't finish,
957 		 * something bad happened.
958 		 */
959 		if ((xs->flags & ITSDONE) == 0 && xs->error == XS_NOERROR) {
960 			isp_lostcmd(isp, xs, reqp);
961 			xs->error = XS_DRIVER_STUFFUP;
962 		}
963 	}
964 	return (COMPLETE);
965 #undef	reqp
966 #undef	t2reqp
967 }
968 
969 /*
970  * Interrupt Service Routine(s)
971  */
972 
973 int
974 isp_poll(isp, xs, mswait)
975 	struct ispsoftc *isp;
976 	struct scsipi_xfer *xs;
977 	int mswait;
978 {
979 
980 	while (mswait) {
981 		/* Try the interrupt handling routine */
982 		(void)isp_intr((void *)isp);
983 
984 		/* See if the xs is now done */
985 		if (xs->flags & ITSDONE)
986 			return (0);
987 		delay(1000);		/* wait one millisecond */
988 		mswait--;
989 	}
990 	return (1);
991 }
992 
993 int
994 isp_intr(arg)
995 	void *arg;
996 {
997 	struct scsipi_xfer *xs;
998 	struct ispsoftc *isp = arg;
999 	u_int16_t iptr, optr, isr;
1000 
1001 	isr = ISP_READ(isp, BIU_ISR);
1002 	if (isp->isp_type & ISP_HA_FC) {
1003 		if (isr == 0 || (isr & BIU2100_ISR_RISC_INT) == 0) {
1004 			if (isr) {
1005 				IDPRINTF(4, ("%s: isp_intr isr=%x\n",
1006 					     isp->isp_name, isr));
1007 			}
1008 			return (0);
1009 		}
1010 	} else {
1011 		if (isr == 0 || (isr & BIU_ISR_RISC_INT) == 0) {
1012 			if (isr) {
1013 				IDPRINTF(4, ("%s: isp_intr isr=%x\n",
1014 					     isp->isp_name, isr));
1015 			}
1016 			return (0);
1017 		}
1018 	}
1019 
1020 	optr = isp->isp_residx;
1021 	if (ISP_READ(isp, BIU_SEMA) & 1) {
1022 		u_int16_t mbox0 = ISP_READ(isp, OUTMAILBOX0);
1023 		switch (mbox0) {
1024 		case ASYNC_BUS_RESET:
1025 		case ASYNC_TIMEOUT_RESET:
1026 			printf("%s: bus or timeout reset\n", isp->isp_name);
1027 			isp->isp_sendmarker = 1;
1028 			break;
1029 		case ASYNC_LIP_OCCURRED:
1030 			printf("%s: LIP occurred\n", isp->isp_name);
1031 			break;
1032 		case ASYNC_LOOP_UP:
1033 			printf("%s: Loop UP\n", isp->isp_name);
1034 			break;
1035 		case ASYNC_LOOP_DOWN:
1036 			printf("%s: Loop DOWN\n", isp->isp_name);
1037 			break;
1038 		case ASYNC_LOOP_RESET:
1039 			printf("%s: Loop RESET\n", isp->isp_name);
1040 			break;
1041 		default:
1042 			printf("%s: async %x\n", isp->isp_name, mbox0);
1043 			break;
1044 		}
1045 		ISP_WRITE(isp, BIU_SEMA, 0);
1046 	}
1047 
1048 	ISP_WRITE(isp, HCCR, HCCR_CMD_CLEAR_RISC_INT);
1049 	iptr = ISP_READ(isp, OUTMAILBOX5);
1050 	if (optr == iptr) {
1051 		IDPRINTF(4, ("why intr? isr %x iptr %x optr %x\n",
1052 			isr, optr, iptr));
1053 	}
1054 	ENABLE_INTS(isp);
1055 
1056 	while (optr != iptr) {
1057 		ispstatusreq_t *sp;
1058 		int buddaboom = 0;
1059 
1060 		sp = (ispstatusreq_t *) ISP_QUEUE_ENTRY(isp->isp_result, optr);
1061 
1062 		optr = (optr + 1) & (RESULT_QUEUE_LEN(isp)-1);
1063 		if (sp->req_header.rqs_entry_type != RQSTYPE_RESPONSE) {
1064 			printf("%s: not RESPONSE in RESPONSE Queue (0x%x)\n",
1065 				isp->isp_name, sp->req_header.rqs_entry_type);
1066 			if (sp->req_header.rqs_entry_type != RQSTYPE_REQUEST) {
1067 				ISP_WRITE(isp, INMAILBOX5, optr);
1068 				continue;
1069 			}
1070 			buddaboom = 1;
1071 		}
1072 
1073 		if (sp->req_header.rqs_flags & 0xf) {
1074 			if (sp->req_header.rqs_flags & RQSFLAG_CONTINUATION) {
1075 				ISP_WRITE(isp, INMAILBOX5, optr);
1076 				continue;
1077 			}
1078 			printf("%s: rqs_flags=%x\n", isp->isp_name,
1079 				sp->req_header.rqs_flags & 0xf);
1080 		}
1081 		if (sp->req_handle > RQUEST_QUEUE_LEN(isp) ||
1082 		    sp->req_handle < 1) {
1083 			printf("%s: bad request handle %d\n", isp->isp_name,
1084 				sp->req_handle);
1085 			ISP_WRITE(isp, INMAILBOX5, optr);
1086 			continue;
1087 		}
1088 		xs = (struct scsipi_xfer *) isp->isp_xflist[sp->req_handle - 1];
1089 		if (xs == NULL) {
1090 			printf("%s: NULL xs in xflist\n", isp->isp_name);
1091 			ISP_WRITE(isp, INMAILBOX5, optr);
1092 			continue;
1093 		}
1094 		isp->isp_xflist[sp->req_handle - 1] = NULL;
1095 		if (sp->req_status_flags & RQSTF_BUS_RESET) {
1096 			isp->isp_sendmarker = 1;
1097 		}
1098 		if (buddaboom) {
1099 			xs->error = XS_DRIVER_STUFFUP;
1100 		}
1101 		xs->status = sp->req_scsi_status & 0xff;
1102 		if (isp->isp_type & ISP_HA_SCSI) {
1103 			if (sp->req_state_flags & RQSF_GOT_SENSE) {
1104 				bcopy(sp->req_sense_data, &xs->sense.scsi_sense,
1105 					sizeof (xs->sense.scsi_sense));
1106 				xs->error = XS_SENSE;
1107 			}
1108 		} else {
1109 			if (xs->status == SCSI_CHECK) {
1110 				xs->error = XS_SENSE;
1111 				bcopy(sp->req_sense_data, &xs->sense.scsi_sense,
1112 					sizeof (xs->sense.scsi_sense));
1113 				sp->req_state_flags |= RQSF_GOT_SENSE;
1114 			}
1115 		}
1116 		if (xs->error == 0 && xs->status == SCSI_BUSY) {
1117 			xs->error = XS_BUSY;
1118 		}
1119 
1120 		if (sp->req_header.rqs_entry_type == RQSTYPE_RESPONSE) {
1121 			if (xs->error == 0 && sp->req_completion_status)
1122 				xs->error = isp_parse_status(isp, sp, xs);
1123 		} else {
1124 			printf("%s: unknown return %x\n", isp->isp_name,
1125 				sp->req_header.rqs_entry_type);
1126 			if (xs->error == 0)
1127 				xs->error = XS_DRIVER_STUFFUP;
1128 		}
1129 		if (isp->isp_type & ISP_HA_SCSI) {
1130 			xs->resid = sp->req_resid;
1131 		} else if (sp->req_scsi_status & RQCS_RU) {
1132 			xs->resid = sp->req_resid;
1133 			IDPRINTF(4, ("%s: cnt %d rsd %d\n", isp->isp_name,
1134 				xs->datalen, sp->req_resid));
1135 		}
1136 		xs->flags |= ITSDONE;
1137 		if (xs->datalen) {
1138 			ISP_DMAFREE(isp, xs, sp->req_handle - 1);
1139 		}
1140 		if (isp->isp_dblev >= 5) {
1141 			printf("%s(%d.%d): FINISH%d cmd 0x%x resid %d STS %x",
1142 			       isp->isp_name, xs->sc_link->scsipi_scsi.target,
1143 			       xs->sc_link->scsipi_scsi.lun, sp->req_header.rqs_seqno,
1144 			       *(u_char *) xs->cmd, xs->resid, xs->status);
1145 			if (sp->req_state_flags & RQSF_GOT_SENSE) {
1146 				printf(" Skey: %x", xs->sense.scsi_sense.flags);
1147 				if (xs->error != XS_SENSE) {
1148 					printf(" BUT NOT SET");
1149 				}
1150 			}
1151 			printf(" xs->error %d\n", xs->error);
1152 		}
1153 		ISP_WRITE(isp, INMAILBOX5, optr);
1154 		scsipi_done(xs);
1155 	}
1156 	isp->isp_residx = optr;
1157 	return (1);
1158 }
1159 
1160 /*
1161  * Support routines.
1162  */
1163 
1164 static int
1165 isp_parse_status(isp, sp, xs)
1166 	struct ispsoftc *isp;
1167 	ispstatusreq_t *sp;
1168 	struct scsipi_xfer *xs;
1169 {
1170 	switch (sp->req_completion_status) {
1171 	case RQCS_COMPLETE:
1172 		return (XS_NOERROR);
1173 		break;
1174 
1175 	case RQCS_INCOMPLETE:
1176 		if ((sp->req_state_flags & RQSF_GOT_TARGET) == 0) {
1177 			return (XS_SELTIMEOUT);
1178 		}
1179 		printf("%s: incomplete, state %x\n",
1180 			isp->isp_name, sp->req_state_flags);
1181 		break;
1182 
1183 	case RQCS_TRANSPORT_ERROR:
1184 		printf("%s: transport error\n", isp->isp_name);
1185 		isp_prtstst(sp);
1186 		break;
1187 
1188 	case RQCS_DATA_OVERRUN:
1189 		if (isp->isp_type & ISP_HA_FC) {
1190 			xs->resid = sp->req_resid;
1191 			break;
1192 		}
1193 		return (XS_NOERROR);
1194 
1195 	case RQCS_DATA_UNDERRUN:
1196 		if (isp->isp_type & ISP_HA_FC) {
1197 			xs->resid = sp->req_resid;
1198 			break;
1199 		}
1200 		return (XS_NOERROR);
1201 
1202 	case RQCS_TIMEOUT:
1203 		return (XS_TIMEOUT);
1204 
1205 	case RQCS_RESET_OCCURRED:
1206 		printf("%s: reset occurred\n", isp->isp_name);
1207 		isp->isp_sendmarker = 1;
1208 		break;
1209 
1210 	case RQCS_ABORTED:
1211 		printf("%s: command aborted\n", isp->isp_name);
1212 		isp->isp_sendmarker = 1;
1213 		break;
1214 
1215 	case RQCS_PORT_UNAVAILABLE:
1216 		/*
1217 		 * No such port on the loop. Moral equivalent of SELTIMEO
1218 		 */
1219 		return (XS_SELTIMEOUT);
1220 
1221 	case RQCS_PORT_LOGGED_OUT:
1222 		printf("%s: port logout for target %d\n",
1223 			isp->isp_name, xs->sc_link->scsipi_scsi.target);
1224 		break;
1225 
1226 	case RQCS_PORT_CHANGED:
1227 		printf("%s: port changed for target %d\n",
1228 			isp->isp_name, xs->sc_link->scsipi_scsi.target);
1229 		break;
1230 
1231 	case RQCS_PORT_BUSY:
1232 		printf("%s: port busy for target %d\n",
1233 			isp->isp_name, xs->sc_link->scsipi_scsi.target);
1234 		return (XS_BUSY);
1235 
1236 	default:
1237 		printf("%s: comp status %x\n", isp->isp_name,
1238 		       sp->req_completion_status);
1239 		break;
1240 	}
1241 	return (XS_DRIVER_STUFFUP);
1242 }
1243 
1244 #define	HINIB(x)			((x) >> 0x4)
1245 #define	LONIB(x)			((x)  & 0xf)
1246 #define MAKNIB(a, b)			(((a) << 4) | (b))
1247 static u_int8_t mbpcnt[] = {
1248 	MAKNIB(1, 1),	/* 0x00: MBOX_NO_OP */
1249 	MAKNIB(5, 5),	/* 0x01: MBOX_LOAD_RAM */
1250 	MAKNIB(2, 0),	/* 0x02: MBOX_EXEC_FIRMWARE */
1251 	MAKNIB(5, 5),	/* 0x03: MBOX_DUMP_RAM */
1252 	MAKNIB(3, 3),	/* 0x04: MBOX_WRITE_RAM_WORD */
1253 	MAKNIB(2, 3),	/* 0x05: MBOX_READ_RAM_WORD */
1254 	MAKNIB(6, 6),	/* 0x06: MBOX_MAILBOX_REG_TEST */
1255 	MAKNIB(2, 3),	/* 0x07: MBOX_VERIFY_CHECKSUM	*/
1256 	MAKNIB(1, 3),	/* 0x08: MBOX_ABOUT_FIRMWARE */
1257 	MAKNIB(0, 0),	/* 0x09: */
1258 	MAKNIB(0, 0),	/* 0x0a: */
1259 	MAKNIB(0, 0),	/* 0x0b: */
1260 	MAKNIB(0, 0),	/* 0x0c: */
1261 	MAKNIB(0, 0),	/* 0x0d: */
1262 	MAKNIB(1, 2),	/* 0x0e: MBOX_CHECK_FIRMWARE */
1263 	MAKNIB(0, 0),	/* 0x0f: */
1264 	MAKNIB(5, 5),	/* 0x10: MBOX_INIT_REQ_QUEUE */
1265 	MAKNIB(6, 6),	/* 0x11: MBOX_INIT_RES_QUEUE */
1266 	MAKNIB(4, 4),	/* 0x12: MBOX_EXECUTE_IOCB */
1267 	MAKNIB(2, 2),	/* 0x13: MBOX_WAKE_UP	*/
1268 	MAKNIB(1, 6),	/* 0x14: MBOX_STOP_FIRMWARE */
1269 	MAKNIB(4, 4),	/* 0x15: MBOX_ABORT */
1270 	MAKNIB(2, 2),	/* 0x16: MBOX_ABORT_DEVICE */
1271 	MAKNIB(3, 3),	/* 0x17: MBOX_ABORT_TARGET */
1272 	MAKNIB(2, 2),	/* 0x18: MBOX_BUS_RESET */
1273 	MAKNIB(2, 3),	/* 0x19: MBOX_STOP_QUEUE */
1274 	MAKNIB(2, 3),	/* 0x1a: MBOX_START_QUEUE */
1275 	MAKNIB(2, 3),	/* 0x1b: MBOX_SINGLE_STEP_QUEUE */
1276 	MAKNIB(2, 3),	/* 0x1c: MBOX_ABORT_QUEUE */
1277 	MAKNIB(2, 4),	/* 0x1d: MBOX_GET_DEV_QUEUE_STATUS */
1278 	MAKNIB(0, 0),	/* 0x1e: */
1279 	MAKNIB(1, 3),	/* 0x1f: MBOX_GET_FIRMWARE_STATUS */
1280 	MAKNIB(1, 2),	/* 0x20: MBOX_GET_INIT_SCSI_ID */
1281 	MAKNIB(1, 2),	/* 0x21: MBOX_GET_SELECT_TIMEOUT */
1282 	MAKNIB(1, 3),	/* 0x22: MBOX_GET_RETRY_COUNT	*/
1283 	MAKNIB(1, 2),	/* 0x23: MBOX_GET_TAG_AGE_LIMIT */
1284 	MAKNIB(1, 2),	/* 0x24: MBOX_GET_CLOCK_RATE */
1285 	MAKNIB(1, 2),	/* 0x25: MBOX_GET_ACT_NEG_STATE */
1286 	MAKNIB(1, 2),	/* 0x26: MBOX_GET_ASYNC_DATA_SETUP_TIME */
1287 	MAKNIB(1, 3),	/* 0x27: MBOX_GET_PCI_PARAMS */
1288 	MAKNIB(2, 4),	/* 0x28: MBOX_GET_TARGET_PARAMS */
1289 	MAKNIB(2, 4),	/* 0x29: MBOX_GET_DEV_QUEUE_PARAMS */
1290 	MAKNIB(0, 0),	/* 0x2a: */
1291 	MAKNIB(0, 0),	/* 0x2b: */
1292 	MAKNIB(0, 0),	/* 0x2c: */
1293 	MAKNIB(0, 0),	/* 0x2d: */
1294 	MAKNIB(0, 0),	/* 0x2e: */
1295 	MAKNIB(0, 0),	/* 0x2f: */
1296 	MAKNIB(2, 2),	/* 0x30: MBOX_SET_INIT_SCSI_ID */
1297 	MAKNIB(2, 2),	/* 0x31: MBOX_SET_SELECT_TIMEOUT */
1298 	MAKNIB(3, 3),	/* 0x32: MBOX_SET_RETRY_COUNT	*/
1299 	MAKNIB(2, 2),	/* 0x33: MBOX_SET_TAG_AGE_LIMIT */
1300 	MAKNIB(2, 2),	/* 0x34: MBOX_SET_CLOCK_RATE */
1301 	MAKNIB(2, 2),	/* 0x35: MBOX_SET_ACTIVE_NEG_STATE */
1302 	MAKNIB(2, 2),	/* 0x36: MBOX_SET_ASYNC_DATA_SETUP_TIME */
1303 	MAKNIB(3, 3),	/* 0x37: MBOX_SET_PCI_CONTROL_PARAMS */
1304 	MAKNIB(4, 4),	/* 0x38: MBOX_SET_TARGET_PARAMS */
1305 	MAKNIB(4, 4),	/* 0x39: MBOX_SET_DEV_QUEUE_PARAMS */
1306 	MAKNIB(0, 0),	/* 0x3a: */
1307 	MAKNIB(0, 0),	/* 0x3b: */
1308 	MAKNIB(0, 0),	/* 0x3c: */
1309 	MAKNIB(0, 0),	/* 0x3d: */
1310 	MAKNIB(0, 0),	/* 0x3e: */
1311 	MAKNIB(0, 0),	/* 0x3f: */
1312 	MAKNIB(1, 2),	/* 0x40: MBOX_RETURN_BIOS_BLOCK_ADDR */
1313 	MAKNIB(6, 1),	/* 0x41: MBOX_WRITE_FOUR_RAM_WORDS */
1314 	MAKNIB(2, 3),	/* 0x42: MBOX_EXEC_BIOS_IOCB */
1315 	MAKNIB(0, 0),	/* 0x43: */
1316 	MAKNIB(0, 0),	/* 0x44: */
1317 	MAKNIB(0, 0),	/* 0x45: */
1318 	MAKNIB(0, 0),	/* 0x46: */
1319 	MAKNIB(0, 0),	/* 0x47: */
1320 	MAKNIB(0, 0),	/* 0x48: */
1321 	MAKNIB(0, 0),	/* 0x49: */
1322 	MAKNIB(0, 0),	/* 0x4a: */
1323 	MAKNIB(0, 0),	/* 0x4b: */
1324 	MAKNIB(0, 0),	/* 0x4c: */
1325 	MAKNIB(0, 0),	/* 0x4d: */
1326 	MAKNIB(0, 0),	/* 0x4e: */
1327 	MAKNIB(0, 0),	/* 0x4f: */
1328 	MAKNIB(0, 0),	/* 0x50: */
1329 	MAKNIB(0, 0),	/* 0x51: */
1330 	MAKNIB(0, 0),	/* 0x52: */
1331 	MAKNIB(0, 0),	/* 0x53: */
1332 	MAKNIB(8, 0),	/* 0x54: MBOX_EXEC_COMMAND_IOCB_A64 */
1333 	MAKNIB(0, 0),	/* 0x55: */
1334 	MAKNIB(0, 0),	/* 0x56: */
1335 	MAKNIB(0, 0),	/* 0x57: */
1336 	MAKNIB(0, 0),	/* 0x58: */
1337 	MAKNIB(0, 0),	/* 0x59: */
1338 	MAKNIB(0, 0),	/* 0x5a: */
1339 	MAKNIB(0, 0),	/* 0x5b: */
1340 	MAKNIB(0, 0),	/* 0x5c: */
1341 	MAKNIB(0, 0),	/* 0x5d: */
1342 	MAKNIB(0, 0),	/* 0x5e: */
1343 	MAKNIB(0, 0),	/* 0x5f: */
1344 	MAKNIB(8, 6),	/* 0x60: MBOX_INIT_FIRMWARE */
1345 	MAKNIB(0, 0),	/* 0x60: MBOX_GET_INIT_CONTROL_BLOCK  (FORMAT?) */
1346 	MAKNIB(2, 1),	/* 0x62: MBOX_INIT_LIP */
1347 	MAKNIB(8, 1),	/* 0x63: MBOX_GET_FC_AL_POSITION_MAP */
1348 	MAKNIB(8, 1),	/* 0x64: MBOX_GET_PORT_DB */
1349 	MAKNIB(3, 1),	/* 0x65: MBOX_CLEAR_ACA */
1350 	MAKNIB(3, 1),	/* 0x66: MBOX_TARGET_RESET */
1351 	MAKNIB(3, 1),	/* 0x67: MBOX_CLEAR_TASK_SET */
1352 	MAKNIB(3, 1),	/* 0x69: MBOX_ABORT_TASK_SET */
1353 	MAKNIB(1, 2)	/* 0x69: MBOX_GET_FW_STATE */
1354 };
1355 #define	NMBCOM	(sizeof (mbpcnt) / sizeof (mbpcnt[0]))
1356 
1357 static void
1358 isp_mboxcmd(isp, mbp)
1359 	struct ispsoftc *isp;
1360 	mbreg_t *mbp;
1361 {
1362 	int outparam, inparam;
1363 	int loops;
1364 	u_int8_t opcode;
1365 
1366 	if (mbp->param[0] == ISP2100_SET_PCI_PARAM) {
1367 		opcode = mbp->param[0] = MBOX_SET_PCI_PARAMETERS;
1368 		inparam = 4;
1369 		outparam = 4;
1370 		goto command_known;
1371 	} else if (mbp->param[0] > NMBCOM) {
1372 		printf("%s: bad command %x\n", isp->isp_name, mbp->param[0]);
1373 		return;
1374 	}
1375 
1376 	opcode = mbp->param[0];
1377 	inparam = HINIB(mbpcnt[mbp->param[0]]);
1378 	outparam =  LONIB(mbpcnt[mbp->param[0]]);
1379 
1380 	if (inparam == 0 && outparam == 0) {
1381 		printf("%s: no parameters for %x\n", isp->isp_name,
1382 			mbp->param[0]);
1383 		return;
1384 	}
1385 
1386 
1387 command_known:
1388 	/*
1389 	 * Make sure we can send some words..
1390 	 */
1391 
1392 	loops = MBOX_DELAY_COUNT;
1393 	while ((ISP_READ(isp, HCCR) & HCCR_HOST_INT) != 0) {
1394 		delay(100);
1395 		if (--loops < 0) {
1396 			printf("%s: isp_mboxcmd timeout #1\n", isp->isp_name);
1397 			return;
1398 		}
1399 	}
1400 
1401 	/*
1402 	 * Write input parameters
1403 	 */
1404 	switch (inparam) {
1405 	case 8: ISP_WRITE(isp, INMAILBOX7, mbp->param[7]); mbp->param[7] = 0;
1406 	case 7: ISP_WRITE(isp, INMAILBOX6, mbp->param[6]); mbp->param[6] = 0;
1407 	case 6: ISP_WRITE(isp, INMAILBOX5, mbp->param[5]); mbp->param[5] = 0;
1408 	case 5: ISP_WRITE(isp, INMAILBOX4, mbp->param[4]); mbp->param[4] = 0;
1409 	case 4: ISP_WRITE(isp, INMAILBOX3, mbp->param[3]); mbp->param[3] = 0;
1410 	case 3: ISP_WRITE(isp, INMAILBOX2, mbp->param[2]); mbp->param[2] = 0;
1411 	case 2: ISP_WRITE(isp, INMAILBOX1, mbp->param[1]); mbp->param[1] = 0;
1412 	case 1: ISP_WRITE(isp, INMAILBOX0, mbp->param[0]); mbp->param[0] = 0;
1413 	}
1414 
1415 	/*
1416 	 * Clear semaphore on mailbox registers
1417 	 */
1418 	ISP_WRITE(isp, BIU_SEMA, 0);
1419 
1420 	/*
1421 	 * Clear RISC int condition.
1422 	 */
1423 	ISP_WRITE(isp, HCCR, HCCR_CMD_CLEAR_RISC_INT);
1424 
1425 	/*
1426 	 * Set Host Interrupt condition so that RISC will pick up mailbox regs.
1427 	 */
1428 	ISP_WRITE(isp, HCCR, HCCR_CMD_SET_HOST_INT);
1429 
1430 	/*
1431 	 * Wait until RISC int is set, except 2100
1432 	 */
1433 	if ((isp->isp_type & ISP_HA_FC) == 0) {
1434 		loops = MBOX_DELAY_COUNT;
1435 		while ((ISP_READ(isp, BIU_ISR) & BIU_ISR_RISC_INT) == 0) {
1436 			delay(100);
1437 			if (--loops < 0) {
1438 				printf("%s: isp_mboxcmd timeout #2\n",
1439 				    isp->isp_name);
1440 				return;
1441 			}
1442 		}
1443 	}
1444 
1445 	/*
1446 	 * Check to make sure that the semaphore has been set.
1447 	 */
1448 	loops = MBOX_DELAY_COUNT;
1449 	while ((ISP_READ(isp, BIU_SEMA) & 1) == 0) {
1450 		delay(100);
1451 		if (--loops < 0) {
1452 			printf("%s: isp_mboxcmd timeout #3\n", isp->isp_name);
1453 			return;
1454 		}
1455 	}
1456 
1457 	/*
1458 	 * Make sure that the MBOX_BUSY has gone away
1459 	 */
1460 	loops = MBOX_DELAY_COUNT;
1461 	while (ISP_READ(isp, OUTMAILBOX0) == MBOX_BUSY) {
1462 		delay(100);
1463 		if (--loops < 0) {
1464 			printf("%s: isp_mboxcmd timeout #4\n", isp->isp_name);
1465 			return;
1466 		}
1467 	}
1468 
1469 
1470 	/*
1471 	 * Pick up output parameters.
1472 	 */
1473 	switch (outparam) {
1474 	case 8: mbp->param[7] = ISP_READ(isp, OUTMAILBOX7);
1475 	case 7: mbp->param[6] = ISP_READ(isp, OUTMAILBOX6);
1476 	case 6: mbp->param[5] = ISP_READ(isp, OUTMAILBOX5);
1477 	case 5: mbp->param[4] = ISP_READ(isp, OUTMAILBOX4);
1478 	case 4: mbp->param[3] = ISP_READ(isp, OUTMAILBOX3);
1479 	case 3: mbp->param[2] = ISP_READ(isp, OUTMAILBOX2);
1480 	case 2: mbp->param[1] = ISP_READ(isp, OUTMAILBOX1);
1481 	case 1: mbp->param[0] = ISP_READ(isp, OUTMAILBOX0);
1482 	}
1483 
1484 	/*
1485 	 * Clear RISC int.
1486 	 */
1487 	ISP_WRITE(isp, HCCR, HCCR_CMD_CLEAR_RISC_INT);
1488 
1489 	/*
1490 	 * Release semaphore on mailbox registers
1491 	 */
1492 	ISP_WRITE(isp, BIU_SEMA, 0);
1493 
1494 	/*
1495 	 * Just to be chatty here...
1496 	 */
1497 	switch(mbp->param[0]) {
1498 	case MBOX_COMMAND_COMPLETE:
1499 		break;
1500 	case MBOX_INVALID_COMMAND:
1501 		/*
1502 		 * GET_CLOCK_RATE can fail a lot
1503 		 * So can a couple of other commands.
1504 		 */
1505 		if (isp->isp_dblev > 2  && opcode != MBOX_GET_CLOCK_RATE) {
1506 			printf("%s: mbox cmd %x failed with INVALID_COMMAND\n",
1507 				isp->isp_name, opcode);
1508 		}
1509 		break;
1510 	case MBOX_HOST_INTERFACE_ERROR:
1511 		printf("%s: mbox cmd %x failed with HOST_INTERFACE_ERROR\n",
1512 			isp->isp_name, opcode);
1513 		break;
1514 	case MBOX_TEST_FAILED:
1515 		printf("%s: mbox cmd %x failed with TEST_FAILED\n",
1516 			isp->isp_name, opcode);
1517 		break;
1518 	case MBOX_COMMAND_ERROR:
1519 		printf("%s: mbox cmd %x failed with COMMAND_ERROR\n",
1520 			isp->isp_name, opcode);
1521 		break;
1522 	case MBOX_COMMAND_PARAM_ERROR:
1523 		printf("%s: mbox cmd %x failed with COMMAND_PARAM_ERROR\n",
1524 			isp->isp_name, opcode);
1525 		break;
1526 
1527 	case ASYNC_LIP_OCCURRED:
1528 		break;
1529 
1530 	default:
1531 		/*
1532 		 * The expected return of EXEC_FIRMWARE is zero.
1533 		 */
1534 		if ((opcode == MBOX_EXEC_FIRMWARE && mbp->param[0] != 0) ||
1535 		    (opcode != MBOX_EXEC_FIRMWARE)) {
1536 			printf("%s: mbox cmd %x failed with error %x\n",
1537 				isp->isp_name, opcode, mbp->param[0]);
1538 		}
1539 		break;
1540 	}
1541 }
1542 
1543 static void
1544 isp_lostcmd(struct ispsoftc *isp, struct scsipi_xfer *xs, ispreq_t *req)
1545 {
1546 	mbreg_t mbs;
1547 
1548 	mbs.param[0] = MBOX_GET_FIRMWARE_STATUS;
1549 	isp_mboxcmd(isp, &mbs);
1550 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
1551 		isp_dumpregs(isp, "couldn't GET FIRMWARE STATUS");
1552 		return;
1553 	}
1554 	if (mbs.param[1]) {
1555 		printf("%s: %d commands on completion queue\n",
1556 		       isp->isp_name, mbs.param[1]);
1557 	}
1558 	if (xs == NULL || xs->sc_link == NULL)
1559 		return;
1560 
1561 	mbs.param[0] = MBOX_GET_DEV_QUEUE_STATUS;
1562 	mbs.param[1] =
1563 		xs->sc_link->scsipi_scsi.target << 8 | xs->sc_link->scsipi_scsi.lun;
1564 	isp_mboxcmd(isp, &mbs);
1565 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
1566 		isp_dumpregs(isp, "couldn't GET DEVICE QUEUE STATUS");
1567 		return;
1568 	}
1569 	printf("%s: lost command for target %d lun %d, %d active of %d, "
1570 		"Queue State: %x\n", isp->isp_name, xs->sc_link->scsipi_scsi.target,
1571 		xs->sc_link->scsipi_scsi.lun, mbs.param[2], mbs.param[3], mbs.param[1]);
1572 
1573 	isp_dumpregs(isp, "lost command");
1574 	/*
1575 	 * XXX: Need to try and do something to recover.
1576 	 */
1577 #if	0
1578 	mbs.param[0] = MBOX_STOP_QUEUE;
1579 	mbs.param[1] =
1580 		xs->sc_link->scsipi_scsi.target << 8 | xs->sc_link->scsipi_scsi.lun;
1581 	isp_mboxcmd(isp, &mbs);
1582 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
1583 		isp_dumpregs(isp, "couldn't stop device queue");
1584 		return;
1585 	}
1586 	printf("%s: tgt %d lun %d, state %x\n", isp->isp_name,
1587 		xs->sc_link->scsipi_scsi.target, xs->sc_link->scsipi_scsi.lun,
1588 		mbs.param[2] & 0xff);
1589 
1590 	/*
1591 	 * If Queue Aborted, need to do a SendMarker
1592 	 */
1593 	if (mbs.param[1] & 0x1)
1594 		isp->isp_sendmarker = 1;
1595 	if (req == NULL)
1596 		return;
1597 
1598 	isp->isp_sendmarker = 1;
1599 
1600 	mbs.param[0] = MBOX_ABORT;
1601 	mbs.param[1] =
1602 		(xs->sc_link->scsipi_scsi.target << 8) | xs->sc_link->scsipi_scsi.lun;
1603 	mbs.param[2] = (req->req_handle - 1) >> 16;
1604 	mbs.param[3] = (req->req_handle - 1) & 0xffff;
1605 	isp_mboxcmd(isp, &mbs);
1606 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
1607 		printf("%s: couldn't abort command\n", isp->isp_name );
1608 		mbs.param[0] = MBOX_ABORT_DEVICE;
1609 		mbs.param[1] = (xs->sc_link->scsipi_scsi.target << 8) |
1610 			xs->sc_link->scsipi_scsi.lun;
1611 		isp_mboxcmd(isp, &mbs);
1612 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
1613 			printf("%s: couldn't abort device\n", isp->isp_name );
1614 		} else {
1615 			if (isp_poll(isp, xs, xs->timeout)) {
1616 				isp_lostcmd(isp, xs, NULL);
1617 			}
1618 		}
1619 	} else {
1620 		if (isp_poll(isp, xs, xs->timeout)) {
1621 			isp_lostcmd(isp, xs, NULL);
1622 		}
1623 	}
1624 	mbs.param[0] = MBOX_START_QUEUE;
1625 	mbs.param[1] =
1626 		xs->sc_link->scsipi_scsi.target << 8 | xs->sc_link->scsipi_scsi.lun;
1627 	isp_mboxcmd(isp, &mbs);
1628 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
1629 		isp_dumpregs(isp, "couldn't start device queue");
1630 	}
1631 #endif
1632 }
1633 
1634 static void
1635 isp_dumpregs(struct ispsoftc *isp, const char *msg)
1636 {
1637 	printf("%s: %s\n", isp->isp_name, msg);
1638 	if (isp->isp_type & ISP_HA_SCSI)
1639 		printf("\tbiu_conf1=%x", ISP_READ(isp, BIU_CONF1));
1640 	else
1641 		printf("\tbiu_csr=%x", ISP_READ(isp, BIU2100_CSR));
1642 	printf(" biu_icr=%x biu_isr=%x biu_sema=%x ", ISP_READ(isp, BIU_ICR),
1643 	       ISP_READ(isp, BIU_ISR), ISP_READ(isp, BIU_SEMA));
1644 	printf("risc_hccr=%x\n", ISP_READ(isp, HCCR));
1645 
1646 	if (isp->isp_type & ISP_HA_SCSI) {
1647 		ISP_WRITE(isp, HCCR, HCCR_CMD_PAUSE);
1648 		printf("\tcdma_conf=%x cdma_sts=%x cdma_fifostat=%x\n",
1649 			ISP_READ(isp, CDMA_CONF), ISP_READ(isp, CDMA_STATUS),
1650 			ISP_READ(isp, CDMA_FIFO_STS));
1651 		printf("\tddma_conf=%x ddma_sts=%x ddma_fifostat=%x\n",
1652 			ISP_READ(isp, DDMA_CONF), ISP_READ(isp, DDMA_STATUS),
1653 			ISP_READ(isp, DDMA_FIFO_STS));
1654 		printf("\tsxp_int=%x sxp_gross=%x sxp(scsi_ctrl)=%x\n",
1655 			ISP_READ(isp, SXP_INTERRUPT),
1656 			ISP_READ(isp, SXP_GROSS_ERR),
1657 			ISP_READ(isp, SXP_PINS_CONTROL));
1658 		ISP_WRITE(isp, HCCR, HCCR_CMD_RELEASE);
1659 	}
1660 	ISP_DUMPREGS(isp);
1661 }
1662 
1663 static void
1664 isp_fw_state(struct ispsoftc *isp)
1665 {
1666 	mbreg_t mbs;
1667 	if (isp->isp_type & ISP_HA_FC) {
1668 		int once = 0;
1669 		fcparam *fcp = isp->isp_param;
1670 again:
1671 		mbs.param[0] = MBOX_GET_FW_STATE;
1672 		isp_mboxcmd(isp, &mbs);
1673 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
1674 			if (mbs.param[0] == ASYNC_LIP_OCCURRED) {
1675 				if (!once++) {
1676 					goto again;
1677 				}
1678 			}
1679 			isp_dumpregs(isp, "GET FIRMWARE STATE failed");
1680 			return;
1681 		}
1682 		fcp->isp_fwstate = mbs.param[1];
1683 	}
1684 }
1685 
1686 static void
1687 isp_setdparm(struct ispsoftc *isp)
1688 {
1689 	int i;
1690 	mbreg_t mbs;
1691 	sdparam *sdp;
1692 
1693 	isp->isp_fwrev = 0;
1694 	if (isp->isp_type & ISP_HA_FC) {
1695 		/*
1696 		 * ROM in 2100 doesn't appear to support ABOUT_FIRMWARE
1697 		 */
1698 		return;
1699 	}
1700 
1701 	mbs.param[0] = MBOX_ABOUT_FIRMWARE;
1702 	isp_mboxcmd(isp, &mbs);
1703 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
1704 		IDPRINTF(3, ("1st ABOUT FIRMWARE command failed"));
1705 	} else {
1706 		isp->isp_fwrev =
1707 			(((u_int16_t) mbs.param[1]) << 10) + mbs.param[2];
1708 	}
1709 
1710 
1711 	sdp = (sdparam *) isp->isp_param;
1712 	/*
1713 	 * Try and get old clock rate out before we hit the
1714 	 * chip over the head- but if and only if we don't
1715 	 * know our desired clock rate.
1716 	 */
1717 	if (isp->isp_mdvec->dv_clock == 0) {
1718 		mbs.param[0] = MBOX_GET_CLOCK_RATE;
1719 		isp_mboxcmd(isp, &mbs);
1720 		if (mbs.param[0] == MBOX_COMMAND_COMPLETE) {
1721 			sdp->isp_clock = mbs.param[1];
1722 			printf("%s: using board clock 0x%x\n",
1723 				isp->isp_name, sdp->isp_clock);
1724 		}
1725 	} else {
1726 		sdp->isp_clock = isp->isp_mdvec->dv_clock;
1727 	}
1728 
1729 	mbs.param[0] = MBOX_GET_ACT_NEG_STATE;
1730 	isp_mboxcmd(isp, &mbs);
1731 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
1732 		IDPRINTF(2, ("could not GET ACT NEG STATE"));
1733 		sdp->isp_req_ack_active_neg = 1;
1734 		sdp->isp_data_line_active_neg = 1;
1735 	} else {
1736 		sdp->isp_req_ack_active_neg = (mbs.param[1] >> 4) & 0x1;
1737 		sdp->isp_data_line_active_neg = (mbs.param[1] >> 5) & 0x1;
1738 	}
1739 	for (i = 0; i < MAX_TARGETS; i++) {
1740 		mbs.param[0] = MBOX_GET_TARGET_PARAMS;
1741 		mbs.param[1] = i << 8;
1742 		isp_mboxcmd(isp, &mbs);
1743 		if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
1744 			IDPRINTF(2, ("cannot get params for target %d", i));
1745 			sdp->isp_devparam[i].sync_period =
1746 				ISP_10M_SYNCPARMS & 0xff;
1747 			sdp->isp_devparam[i].sync_offset =
1748 				ISP_10M_SYNCPARMS >> 8;
1749 			sdp->isp_devparam[i].dev_flags = DPARM_DEFAULT;
1750 		} else {
1751 #if	0
1752 			printf("%s: target %d - flags 0x%x, sync %x\n",
1753 			       isp->isp_name, i, mbs.param[2], mbs.param[3]);
1754 #endif
1755 			sdp->isp_devparam[i].dev_flags = mbs.param[2] >> 8;
1756 			/*
1757 			 * The maximum period we can really see
1758 			 * here is 100 (decimal), or 400 ns.
1759 			 * For some unknown reason we sometimes
1760 			 * get back wildass numbers from the
1761 			 * boot device's paramaters.
1762 			 */
1763 			if ((mbs.param[3] & 0xff) <= 0x64) {
1764 				sdp->isp_devparam[i].sync_period =
1765 					mbs.param[3] & 0xff;
1766 				sdp->isp_devparam[i].sync_offset =
1767 					mbs.param[3] >> 8;
1768 			}
1769 		}
1770 	}
1771 
1772 	/*
1773 	 * Set Default Host Adapter Parameters
1774 	 * XXX: Should try and get them out of NVRAM
1775 	 */
1776 	sdp->isp_adapter_enabled = 1;
1777 	sdp->isp_cmd_dma_burst_enable = 1;
1778 	sdp->isp_data_dma_burst_enabl = 1;
1779 	sdp->isp_fifo_threshold = 2;
1780 	sdp->isp_initiator_id = 7;
1781 	sdp->isp_async_data_setup = 6;
1782 	sdp->isp_selection_timeout = 250;
1783 	sdp->isp_max_queue_depth = 256;
1784 	sdp->isp_tag_aging = 8;
1785 	sdp->isp_bus_reset_delay = 3;
1786 	sdp->isp_retry_count = 0;
1787 	sdp->isp_retry_delay = 1;
1788 
1789 	for (i = 0; i < MAX_TARGETS; i++) {
1790 		sdp->isp_devparam[i].exc_throttle = 16;
1791 		sdp->isp_devparam[i].dev_enable = 1;
1792 	}
1793 }
1794 
1795 static void
1796 isp_phoenix(struct ispsoftc *isp)
1797 {
1798 	struct scsipi_xfer *tlist[MAXISPREQUEST], *xs;
1799 	int i;
1800 
1801 	for (i = 0; i < RQUEST_QUEUE_LEN(isp); i++) {
1802 		tlist[i] = (struct scsipi_xfer *) isp->isp_xflist[i];
1803 	}
1804 	isp_reset(isp);
1805 	isp_init(isp);
1806 	isp->isp_state = ISP_RUNSTATE;
1807 
1808 	for (i = 0; i < RQUEST_QUEUE_LEN(isp); i++) {
1809 		xs = tlist[i];
1810 		if (xs == NULL)
1811 			continue;
1812 		xs->resid = xs->datalen;
1813 		xs->error = XS_DRIVER_STUFFUP;
1814 		xs->flags |= ITSDONE;
1815 		scsipi_done(xs);
1816 	}
1817 }
1818 
1819 static void
1820 isp_watch(void *arg)
1821 {
1822 	int s, i;
1823 	struct ispsoftc *isp = arg;
1824 	struct scsipi_xfer *xs;
1825 
1826 	/*
1827 	 * Look for completely dead commands (but not polled ones)
1828 	 */
1829 	s = splbio();
1830 	for (i = 0; i < RQUEST_QUEUE_LEN(isp); i++) {
1831 		if ((xs = (struct scsipi_xfer *) isp->isp_xflist[i]) == NULL) {
1832 			continue;
1833 		}
1834 		if (xs->flags & SCSI_POLL)
1835 			continue;
1836 		if (xs->timeout == 0) {
1837 			continue;
1838 		}
1839 		xs->timeout -= (WATCHI * 1000);
1840 		if (xs->timeout > -(2 * WATCHI * 1000)) {
1841 			continue;
1842 		}
1843 		printf("%s: commands really timed out!\n", isp->isp_name);
1844 
1845 		isp_phoenix(isp);
1846 		break;
1847 	}
1848 	(void) splx(s);
1849 	timeout(isp_watch, arg, WATCHI);
1850 }
1851 
1852 static void
1853 isp_prtstst(ispstatusreq_t *sp)
1854 {
1855 	printf("states->");
1856 	if (sp->req_state_flags & RQSF_GOT_BUS)
1857 		printf("GOT_BUS ");
1858 	if (sp->req_state_flags & RQSF_GOT_TARGET)
1859 		printf("GOT_TGT ");
1860 	if (sp->req_state_flags & RQSF_SENT_CDB)
1861 		printf("SENT_CDB ");
1862 	if (sp->req_state_flags & RQSF_XFRD_DATA)
1863 		printf("XFRD_DATA ");
1864 	if (sp->req_state_flags & RQSF_GOT_STATUS)
1865 		printf("GOT_STS ");
1866 	if (sp->req_state_flags & RQSF_GOT_SENSE)
1867 		printf("GOT_SNS ");
1868 	if (sp->req_state_flags & RQSF_XFER_COMPLETE)
1869 		printf("XFR_CMPLT ");
1870 	printf("\n");
1871 	printf("status->");
1872 	if (sp->req_status_flags & RQSTF_DISCONNECT)
1873 		printf("Disconnect ");
1874 	if (sp->req_status_flags & RQSTF_SYNCHRONOUS)
1875 		printf("Sync_xfr ");
1876 	if (sp->req_status_flags & RQSTF_PARITY_ERROR)
1877 		printf("Parity ");
1878 	if (sp->req_status_flags & RQSTF_BUS_RESET)
1879 		printf("Bus_Reset ");
1880 	if (sp->req_status_flags & RQSTF_DEVICE_RESET)
1881 		printf("Device_Reset ");
1882 	if (sp->req_status_flags & RQSTF_ABORTED)
1883 		printf("Aborted ");
1884 	if (sp->req_status_flags & RQSTF_TIMEOUT)
1885 		printf("Timeout ");
1886 	if (sp->req_status_flags & RQSTF_NEGOTIATION)
1887 		printf("Negotiation ");
1888 	printf("\n");
1889 }
1890