xref: /dragonfly/sys/dev/disk/buslogic/bt.c (revision 52f9f0d9)
1 /*
2  * Generic driver for the BusLogic MultiMaster SCSI host adapters
3  * Product specific probe and attach routines can be found in:
4  * sys/dev/buslogic/bt_isa.c	BT-54X, BT-445 cards
5  * sys/dev/buslogic/bt_pci.c	BT-946, BT-948, BT-956, BT-958 cards
6  *
7  * Copyright (c) 1998, 1999 Justin T. Gibbs.
8  * All rights reserved.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions, and the following disclaimer,
15  *    without modification, immediately at the beginning of the file.
16  * 2. The name of the author may not be used to endorse or promote products
17  *    derived from this software without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
23  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  *
31  * $FreeBSD: src/sys/dev/buslogic/bt.c,v 1.25.2.1 2000/08/02 22:32:26 peter Exp $
32  */
33 
34  /*
35   * Special thanks to Leonard N. Zubkoff for writing such a complete and
36   * well documented Mylex/BusLogic MultiMaster driver for Linux.  Support
37   * in this driver for the wide range of MultiMaster controllers and
38   * firmware revisions, with their otherwise undocumented quirks, would not
39   * have been possible without his efforts.
40   */
41 
42 #include <sys/param.h>
43 #include <sys/systm.h>
44 #include <sys/malloc.h>
45 #include <sys/buf.h>
46 #include <sys/kernel.h>
47 #include <sys/sysctl.h>
48 #include <sys/bus.h>
49 #include <sys/rman.h>
50 #include <sys/thread2.h>
51 
52 #include <machine/clock.h>
53 
54 #include <bus/cam/cam.h>
55 #include <bus/cam/cam_ccb.h>
56 #include <bus/cam/cam_sim.h>
57 #include <bus/cam/cam_xpt_sim.h>
58 #include <bus/cam/cam_debug.h>
59 #include <bus/cam/scsi/scsi_message.h>
60 
61 #include <vm/vm.h>
62 #include <vm/pmap.h>
63 
64 #include "btreg.h"
65 
66 /* MailBox Management functions */
67 static __inline void	btnextinbox(struct bt_softc *bt);
68 static __inline void	btnextoutbox(struct bt_softc *bt);
69 
70 static __inline void
71 btnextinbox(struct bt_softc *bt)
72 {
73 	if (bt->cur_inbox == bt->last_inbox)
74 		bt->cur_inbox = bt->in_boxes;
75 	else
76 		bt->cur_inbox++;
77 }
78 
79 static __inline void
80 btnextoutbox(struct bt_softc *bt)
81 {
82 	if (bt->cur_outbox == bt->last_outbox)
83 		bt->cur_outbox = bt->out_boxes;
84 	else
85 		bt->cur_outbox++;
86 }
87 
88 /* CCB Mangement functions */
89 static __inline u_int32_t		btccbvtop(struct bt_softc *bt,
90 						  struct bt_ccb *bccb);
91 static __inline struct bt_ccb*		btccbptov(struct bt_softc *bt,
92 						  u_int32_t ccb_addr);
93 static __inline u_int32_t		btsensepaddr(struct bt_softc *bt,
94 						     struct bt_ccb *bccb);
95 static __inline struct scsi_sense_data* btsensevaddr(struct bt_softc *bt,
96 						     struct bt_ccb *bccb);
97 
98 static __inline u_int32_t
99 btccbvtop(struct bt_softc *bt, struct bt_ccb *bccb)
100 {
101 	return (bt->bt_ccb_physbase
102 	      + (u_int32_t)((caddr_t)bccb - (caddr_t)bt->bt_ccb_array));
103 }
104 
105 static __inline struct bt_ccb *
106 btccbptov(struct bt_softc *bt, u_int32_t ccb_addr)
107 {
108 	return (bt->bt_ccb_array +
109 	        ((struct bt_ccb*)(uintptr_t)ccb_addr-(struct bt_ccb*)(uintptr_t)bt->bt_ccb_physbase));
110 }
111 
112 static __inline u_int32_t
113 btsensepaddr(struct bt_softc *bt, struct bt_ccb *bccb)
114 {
115 	u_int index;
116 
117 	index = (u_int)(bccb - bt->bt_ccb_array);
118 	return (bt->sense_buffers_physbase
119 		+ (index * sizeof(struct scsi_sense_data)));
120 }
121 
122 static __inline struct scsi_sense_data *
123 btsensevaddr(struct bt_softc *bt, struct bt_ccb *bccb)
124 {
125 	u_int index;
126 
127 	index = (u_int)(bccb - bt->bt_ccb_array);
128 	return (bt->sense_buffers + index);
129 }
130 
131 static __inline struct bt_ccb*	btgetccb(struct bt_softc *bt);
132 static __inline void		btfreeccb(struct bt_softc *bt,
133 					  struct bt_ccb *bccb);
134 static void		btallocccbs(struct bt_softc *bt);
135 static bus_dmamap_callback_t btexecuteccb;
136 static void		btdone(struct bt_softc *bt, struct bt_ccb *bccb,
137 			       bt_mbi_comp_code_t comp_code);
138 
139 /* Host adapter command functions */
140 static int	btreset(struct bt_softc* bt, int hard_reset);
141 
142 /* Initialization functions */
143 static int			btinitmboxes(struct bt_softc *bt);
144 static bus_dmamap_callback_t	btmapmboxes;
145 static bus_dmamap_callback_t	btmapccbs;
146 static bus_dmamap_callback_t	btmapsgs;
147 
148 /* Transfer Negotiation Functions */
149 static void btfetchtransinfo(struct bt_softc *bt,
150 			     struct ccb_trans_settings *cts);
151 
152 /* CAM SIM entry points */
153 #define ccb_bccb_ptr spriv_ptr0
154 #define ccb_bt_ptr spriv_ptr1
155 static void	btaction(struct cam_sim *sim, union ccb *ccb);
156 static void	btpoll(struct cam_sim *sim);
157 
158 /* Our timeout handler */
159 timeout_t bttimeout;
160 
161 u_long bt_unit = 0;
162 
163 /*
164  * XXX
165  * Do our own re-probe protection until a configuration
166  * manager can do it for us.  This ensures that we don't
167  * reprobe a card already found by the PCI probes.
168  */
169 struct bt_isa_port bt_isa_ports[] =
170 {
171 	{ 0x130, 0, 4 },
172 	{ 0x134, 0, 5 },
173 	{ 0x230, 0, 2 },
174 	{ 0x234, 0, 3 },
175 	{ 0x330, 0, 0 },
176 	{ 0x334, 0, 1 }
177 };
178 
179 /*
180  * I/O ports listed in the order enumerated by the
181  * card for certain op codes.
182  */
183 u_int16_t bt_board_ports[] =
184 {
185 	0x330,
186 	0x334,
187 	0x230,
188 	0x234,
189 	0x130,
190 	0x134
191 };
192 
193 /* Exported functions */
194 void
195 bt_init_softc(device_t dev, struct resource *port,
196 	      struct resource *irq, struct resource *drq)
197 {
198 	struct bt_softc *bt = device_get_softc(dev);
199 
200 	SLIST_INIT(&bt->free_bt_ccbs);
201 	LIST_INIT(&bt->pending_ccbs);
202 	SLIST_INIT(&bt->sg_maps);
203 	bt->dev = dev;
204 	bt->unit = device_get_unit(dev);
205 	bt->port = port;
206 	bt->irq = irq;
207 	bt->drq = drq;
208 	bt->tag = rman_get_bustag(port);
209 	bt->bsh = rman_get_bushandle(port);
210 }
211 
212 void
213 bt_free_softc(device_t dev)
214 {
215 	struct bt_softc *bt = device_get_softc(dev);
216 
217 	switch (bt->init_level) {
218 	default:
219 	case 11:
220 		bus_dmamap_unload(bt->sense_dmat, bt->sense_dmamap);
221 	case 10:
222 		bus_dmamem_free(bt->sense_dmat, bt->sense_buffers,
223 				bt->sense_dmamap);
224 	case 9:
225 		bus_dma_tag_destroy(bt->sense_dmat);
226 	case 8:
227 	{
228 		struct sg_map_node *sg_map;
229 
230 		while ((sg_map = SLIST_FIRST(&bt->sg_maps))!= NULL) {
231 			SLIST_REMOVE_HEAD(&bt->sg_maps, links);
232 			bus_dmamap_unload(bt->sg_dmat,
233 					  sg_map->sg_dmamap);
234 			bus_dmamem_free(bt->sg_dmat, sg_map->sg_vaddr,
235 					sg_map->sg_dmamap);
236 			kfree(sg_map, M_DEVBUF);
237 		}
238 		bus_dma_tag_destroy(bt->sg_dmat);
239 	}
240 	case 7:
241 		bus_dmamap_unload(bt->ccb_dmat, bt->ccb_dmamap);
242 	case 6:
243 		bus_dmamem_free(bt->ccb_dmat, bt->bt_ccb_array,
244 				bt->ccb_dmamap);
245 		bus_dmamap_destroy(bt->ccb_dmat, bt->ccb_dmamap);
246 	case 5:
247 		bus_dma_tag_destroy(bt->ccb_dmat);
248 	case 4:
249 		bus_dmamap_unload(bt->mailbox_dmat, bt->mailbox_dmamap);
250 	case 3:
251 		bus_dmamem_free(bt->mailbox_dmat, bt->in_boxes,
252 				bt->mailbox_dmamap);
253 		bus_dmamap_destroy(bt->mailbox_dmat, bt->mailbox_dmamap);
254 	case 2:
255 		bus_dma_tag_destroy(bt->buffer_dmat);
256 	case 1:
257 		bus_dma_tag_destroy(bt->mailbox_dmat);
258 	case 0:
259 		break;
260 	}
261 }
262 
263 int
264 bt_port_probe(device_t dev, struct bt_probe_info *info)
265 {
266 	struct bt_softc *bt = device_get_softc(dev);
267 	config_data_t config_data;
268 	int error;
269 
270 	/* See if there is really a card present */
271 	if (bt_probe(dev) || bt_fetch_adapter_info(dev))
272 		return(1);
273 
274 	/*
275 	 * Determine our IRQ, and DMA settings and
276 	 * export them to the configuration system.
277 	 */
278 	error = bt_cmd(bt, BOP_INQUIRE_CONFIG, NULL, /*parmlen*/0,
279 		       (u_int8_t*)&config_data, sizeof(config_data),
280 		       DEFAULT_CMD_TIMEOUT);
281 	if (error != 0) {
282 		kprintf("bt_port_probe: Could not determine IRQ or DMA "
283 		       "settings for adapter.\n");
284 		return (1);
285 	}
286 
287 	if (bt->model[0] == '5') {
288 		/* DMA settings only make sense for ISA cards */
289 		switch (config_data.dma_chan) {
290 		case DMA_CHAN_5:
291 			info->drq = 5;
292 			break;
293 		case DMA_CHAN_6:
294 			info->drq = 6;
295 			break;
296 		case DMA_CHAN_7:
297 			info->drq = 7;
298 			break;
299 		default:
300 			kprintf("bt_port_probe: Invalid DMA setting "
301 			       "detected for adapter.\n");
302 			return (1);
303 		}
304 	} else {
305 		/* VL/EISA/PCI DMA */
306 		info->drq = -1;
307 	}
308 	switch (config_data.irq) {
309 	case IRQ_9:
310 	case IRQ_10:
311 	case IRQ_11:
312 	case IRQ_12:
313 	case IRQ_14:
314 	case IRQ_15:
315 		info->irq = ffs(config_data.irq) + 8;
316 		break;
317 	default:
318 		kprintf("bt_port_probe: Invalid IRQ setting %x"
319 		       "detected for adapter.\n", config_data.irq);
320 		return (1);
321 	}
322 	return (0);
323 }
324 
325 /*
326  * Probe the adapter and verify that the card is a BusLogic.
327  */
328 int
329 bt_probe(device_t dev)
330 {
331 	struct bt_softc *bt = device_get_softc(dev);
332 	esetup_info_data_t esetup_info;
333 	u_int	 status;
334 	u_int	 intstat;
335 	u_int	 geometry;
336 	int	 error;
337 	u_int8_t param;
338 
339 	/*
340 	 * See if the three I/O ports look reasonable.
341 	 * Touch the minimal number of registers in the
342 	 * failure case.
343 	 */
344 	status = bt_inb(bt, STATUS_REG);
345 	if ((status == 0)
346 	 || (status & (DIAG_ACTIVE|CMD_REG_BUSY|
347 		       STATUS_REG_RSVD|CMD_INVALID)) != 0) {
348 		if (bootverbose)
349 			device_printf(dev, "Failed Status Reg Test - %x\n",
350 			       status);
351 		return (ENXIO);
352 	}
353 
354 	intstat = bt_inb(bt, INTSTAT_REG);
355 	if ((intstat & INTSTAT_REG_RSVD) != 0) {
356 		device_printf(dev, "Failed Intstat Reg Test\n");
357 		return (ENXIO);
358 	}
359 
360 	geometry = bt_inb(bt, GEOMETRY_REG);
361 	if (geometry == 0xFF) {
362 		if (bootverbose)
363 			device_printf(dev, "Failed Geometry Reg Test\n");
364 		return (ENXIO);
365 	}
366 
367 	/*
368 	 * Looking good so far.  Final test is to reset the
369 	 * adapter and attempt to fetch the extended setup
370 	 * information.  This should filter out all 1542 cards.
371 	 */
372 	if ((error = btreset(bt, /*hard_reset*/TRUE)) != 0) {
373 		if (bootverbose)
374 			device_printf(dev, "Failed Reset\n");
375 		return (ENXIO);
376 	}
377 
378 	param = sizeof(esetup_info);
379 	error = bt_cmd(bt, BOP_INQUIRE_ESETUP_INFO, &param, /*parmlen*/1,
380 		       (u_int8_t*)&esetup_info, sizeof(esetup_info),
381 		       DEFAULT_CMD_TIMEOUT);
382 	if (error != 0) {
383 		return (ENXIO);
384 	}
385 
386 	return (0);
387 }
388 
389 /*
390  * Pull the boards setup information and record it in our softc.
391  */
392 int
393 bt_fetch_adapter_info(device_t dev)
394 {
395 	struct bt_softc *bt = device_get_softc(dev);
396 	board_id_data_t	board_id;
397 	esetup_info_data_t esetup_info;
398 	config_data_t config_data;
399 	int	 error;
400 	u_int8_t length_param;
401 
402 	/* First record the firmware version */
403 	error = bt_cmd(bt, BOP_INQUIRE_BOARD_ID, NULL, /*parmlen*/0,
404 		       (u_int8_t*)&board_id, sizeof(board_id),
405 		       DEFAULT_CMD_TIMEOUT);
406 	if (error != 0) {
407 		device_printf(dev, "bt_fetch_adapter_info - Failed Get Board Info\n");
408 		return (error);
409 	}
410 	bt->firmware_ver[0] = board_id.firmware_rev_major;
411 	bt->firmware_ver[1] = '.';
412 	bt->firmware_ver[2] = board_id.firmware_rev_minor;
413 	bt->firmware_ver[3] = '\0';
414 
415 	/*
416 	 * Depending on the firmware major and minor version,
417 	 * we may be able to fetch additional minor version info.
418 	 */
419 	if (bt->firmware_ver[0] > '0') {
420 
421 		error = bt_cmd(bt, BOP_INQUIRE_FW_VER_3DIG, NULL, /*parmlen*/0,
422 			       (u_int8_t*)&bt->firmware_ver[3], 1,
423 			       DEFAULT_CMD_TIMEOUT);
424 		if (error != 0) {
425 			device_printf(dev,
426 				      "bt_fetch_adapter_info - Failed Get "
427 				      "Firmware 3rd Digit\n");
428 			return (error);
429 		}
430 		if (bt->firmware_ver[3] == ' ')
431 			bt->firmware_ver[3] = '\0';
432 		bt->firmware_ver[4] = '\0';
433 	}
434 
435 	if (strcmp(bt->firmware_ver, "3.3") >= 0) {
436 
437 		error = bt_cmd(bt, BOP_INQUIRE_FW_VER_4DIG, NULL, /*parmlen*/0,
438 			       (u_int8_t*)&bt->firmware_ver[4], 1,
439 			       DEFAULT_CMD_TIMEOUT);
440 		if (error != 0) {
441 			device_printf(dev,
442 				      "bt_fetch_adapter_info - Failed Get "
443 				      "Firmware 4th Digit\n");
444 			return (error);
445 		}
446 		if (bt->firmware_ver[4] == ' ')
447 			bt->firmware_ver[4] = '\0';
448 		bt->firmware_ver[5] = '\0';
449 	}
450 
451 	/*
452 	 * Some boards do not handle the "recently documented"
453 	 * Inquire Board Model Number command correctly or do not give
454 	 * exact information.  Use the Firmware and Extended Setup
455 	 * information in these cases to come up with the right answer.
456 	 * The major firmware revision number indicates:
457 	 *
458 	 * 	5.xx	BusLogic "W" Series Host Adapters:
459 	 *		BT-948/958/958D
460 	 *	4.xx	BusLogic "C" Series Host Adapters:
461 	 *		BT-946C/956C/956CD/747C/757C/757CD/445C/545C/540CF
462 	 *	3.xx	BusLogic "S" Series Host Adapters:
463 	 *		BT-747S/747D/757S/757D/445S/545S/542D
464 	 *		BT-542B/742A (revision H)
465 	 *	2.xx	BusLogic "A" Series Host Adapters:
466 	 *		BT-542B/742A (revision G and below)
467 	 */
468 	length_param = sizeof(esetup_info);
469 	error = bt_cmd(bt, BOP_INQUIRE_ESETUP_INFO, &length_param, /*parmlen*/1,
470 		       (u_int8_t*)&esetup_info, sizeof(esetup_info),
471 		       DEFAULT_CMD_TIMEOUT);
472 	if (error != 0) {
473 		return (error);
474 	}
475 
476   	bt->bios_addr = esetup_info.bios_addr << 12;
477 
478 	if (esetup_info.bus_type == 'A'
479 	 && bt->firmware_ver[0] == '2') {
480 		ksnprintf(bt->model, sizeof(bt->model), "542B");
481 	} else if (esetup_info.bus_type == 'E'
482 		&& (strncmp(bt->firmware_ver, "2.1", 3) == 0
483 		 || strncmp(bt->firmware_ver, "2.20", 4) == 0)) {
484 		ksnprintf(bt->model, sizeof(bt->model), "742A");
485 	} else {
486 		ha_model_data_t model_data;
487 		int i;
488 
489 		length_param = sizeof(model_data);
490 		error = bt_cmd(bt, BOP_INQUIRE_MODEL, &length_param, 1,
491 			       (u_int8_t*)&model_data, sizeof(model_data),
492 			       DEFAULT_CMD_TIMEOUT);
493 		if (error != 0) {
494 			device_printf(dev,
495 				      "bt_fetch_adapter_info - Failed Inquire "
496 				      "Model Number\n");
497 			return (error);
498 		}
499 		for (i = 0; i < sizeof(model_data.ascii_model); i++) {
500 			bt->model[i] = model_data.ascii_model[i];
501 			if (bt->model[i] == ' ')
502 				break;
503 		}
504 		bt->model[i] = '\0';
505 	}
506 
507 	bt->level_trigger_ints = esetup_info.level_trigger_ints ? 1 : 0;
508 
509 	/* SG element limits */
510 	bt->max_sg = esetup_info.max_sg;
511 
512 	/* Set feature flags */
513 	bt->wide_bus = esetup_info.wide_bus;
514 	bt->diff_bus = esetup_info.diff_bus;
515 	bt->ultra_scsi = esetup_info.ultra_scsi;
516 
517 	if ((bt->firmware_ver[0] == '5')
518 	 || (bt->firmware_ver[0] == '4' && bt->wide_bus))
519 		bt->extended_lun = TRUE;
520 
521 	bt->strict_rr = (strcmp(bt->firmware_ver, "3.31") >= 0);
522 
523 	bt->extended_trans =
524 	    ((bt_inb(bt, GEOMETRY_REG) & EXTENDED_TRANSLATION) != 0);
525 
526 	/*
527 	 * Determine max CCB count and whether tagged queuing is
528 	 * available based on controller type. Tagged queuing
529 	 * only works on 'W' series adapters, 'C' series adapters
530 	 * with firmware of rev 4.42 and higher, and 'S' series
531 	 * adapters with firmware of rev 3.35 and higher.  The
532 	 * maximum CCB counts are as follows:
533 	 *
534 	 *	192	BT-948/958/958D
535 	 *	100	BT-946C/956C/956CD/747C/757C/757CD/445C
536 	 * 	50	BT-545C/540CF
537 	 * 	30	BT-747S/747D/757S/757D/445S/545S/542D/542B/742A
538 	 */
539 	if (bt->firmware_ver[0] == '5') {
540 		bt->max_ccbs = 192;
541 		bt->tag_capable = TRUE;
542 	} else if (bt->firmware_ver[0] == '4') {
543 		if (bt->model[0] == '5')
544 			bt->max_ccbs = 50;
545 		else
546 			bt->max_ccbs = 100;
547 		bt->tag_capable = (strcmp(bt->firmware_ver, "4.22") >= 0);
548 	} else {
549 		bt->max_ccbs = 30;
550 		if (bt->firmware_ver[0] == '3'
551 		 && (strcmp(bt->firmware_ver, "3.35") >= 0))
552 			bt->tag_capable = TRUE;
553 		else
554 			bt->tag_capable = FALSE;
555 	}
556 
557 	if (bt->tag_capable != FALSE)
558 		bt->tags_permitted = ALL_TARGETS;
559 
560 	/* Determine Sync/Wide/Disc settings */
561 	if (bt->firmware_ver[0] >= '4') {
562 		auto_scsi_data_t auto_scsi_data;
563 		fetch_lram_params_t fetch_lram_params;
564 		int error;
565 
566 		/*
567 		 * These settings are stored in the
568 		 * AutoSCSI data in LRAM of 'W' and 'C'
569 		 * adapters.
570 		 */
571 		fetch_lram_params.offset = AUTO_SCSI_BYTE_OFFSET;
572 		fetch_lram_params.response_len = sizeof(auto_scsi_data);
573 		error = bt_cmd(bt, BOP_FETCH_LRAM,
574 			       (u_int8_t*)&fetch_lram_params,
575 			       sizeof(fetch_lram_params),
576 			       (u_int8_t*)&auto_scsi_data,
577 			       sizeof(auto_scsi_data), DEFAULT_CMD_TIMEOUT);
578 
579 		if (error != 0) {
580 			device_printf(dev,
581 				      "bt_fetch_adapter_info - Failed "
582 				      "Get Auto SCSI Info\n");
583 			return (error);
584 		}
585 
586 		bt->disc_permitted = auto_scsi_data.low_disc_permitted
587 				   | (auto_scsi_data.high_disc_permitted << 8);
588 		bt->sync_permitted = auto_scsi_data.low_sync_permitted
589 				   | (auto_scsi_data.high_sync_permitted << 8);
590 		bt->fast_permitted = auto_scsi_data.low_fast_permitted
591 				   | (auto_scsi_data.high_fast_permitted << 8);
592 		bt->ultra_permitted = auto_scsi_data.low_ultra_permitted
593 				   | (auto_scsi_data.high_ultra_permitted << 8);
594 		bt->wide_permitted = auto_scsi_data.low_wide_permitted
595 				   | (auto_scsi_data.high_wide_permitted << 8);
596 
597 		if (bt->ultra_scsi == FALSE)
598 			bt->ultra_permitted = 0;
599 
600 		if (bt->wide_bus == FALSE)
601 			bt->wide_permitted = 0;
602 	} else {
603 		/*
604 		 * 'S' and 'A' series have this information in the setup
605 		 * information structure.
606 		 */
607 		setup_data_t	setup_info;
608 
609 		length_param = sizeof(setup_info);
610 		error = bt_cmd(bt, BOP_INQUIRE_SETUP_INFO, &length_param,
611 			       /*paramlen*/1, (u_int8_t*)&setup_info,
612 			       sizeof(setup_info), DEFAULT_CMD_TIMEOUT);
613 
614 		if (error != 0) {
615 			device_printf(dev,
616 				      "bt_fetch_adapter_info - Failed "
617 				      "Get Setup Info\n");
618 			return (error);
619 		}
620 
621 		if (setup_info.initiate_sync != 0) {
622 			bt->sync_permitted = ALL_TARGETS;
623 
624 			if (bt->model[0] == '7') {
625 				if (esetup_info.sync_neg10MB != 0)
626 					bt->fast_permitted = ALL_TARGETS;
627 				if (strcmp(bt->model, "757") == 0)
628 					bt->wide_permitted = ALL_TARGETS;
629 			}
630 		}
631 		bt->disc_permitted = ALL_TARGETS;
632 	}
633 
634 	/* We need as many mailboxes as we can have ccbs */
635 	bt->num_boxes = bt->max_ccbs;
636 
637 	/* Determine our SCSI ID */
638 
639 	error = bt_cmd(bt, BOP_INQUIRE_CONFIG, NULL, /*parmlen*/0,
640 		       (u_int8_t*)&config_data, sizeof(config_data),
641 		       DEFAULT_CMD_TIMEOUT);
642 	if (error != 0) {
643 		device_printf(dev,
644 			      "bt_fetch_adapter_info - Failed Get Config\n");
645 		return (error);
646 	}
647 	bt->scsi_id = config_data.scsi_id;
648 
649 	return (0);
650 }
651 
652 /*
653  * Start the board, ready for normal operation
654  */
655 int
656 bt_init(device_t dev)
657 {
658 	struct bt_softc *bt = device_get_softc(dev);
659 
660 	/* Announce the Adapter */
661 	device_printf(dev, "BT-%s FW Rev. %s ", bt->model, bt->firmware_ver);
662 
663 	if (bt->ultra_scsi != 0)
664 		kprintf("Ultra ");
665 
666 	if (bt->wide_bus != 0)
667 		kprintf("Wide ");
668 	else
669 		kprintf("Narrow ");
670 
671 	if (bt->diff_bus != 0)
672 		kprintf("Diff ");
673 
674 	kprintf("SCSI Host Adapter, SCSI ID %d, %d CCBs\n", bt->scsi_id,
675 	       bt->max_ccbs);
676 
677 	/*
678 	 * Create our DMA tags.  These tags define the kinds of device
679 	 * accessible memory allocations and memory mappings we will
680 	 * need to perform during normal operation.
681 	 *
682 	 * Unless we need to further restrict the allocation, we rely
683 	 * on the restrictions of the parent dmat, hence the common
684 	 * use of MAXADDR and MAXSIZE.
685 	 */
686 
687 	/* DMA tag for mapping buffers into device visible space. */
688 	if (bus_dma_tag_create(bt->parent_dmat, /*alignment*/1, /*boundary*/0,
689 			       /*lowaddr*/BUS_SPACE_MAXADDR,
690 			       /*highaddr*/BUS_SPACE_MAXADDR,
691 			       /*filter*/NULL, /*filterarg*/NULL,
692 			       /*maxsize*/MAXBSIZE, /*nsegments*/BT_NSEG,
693 			       /*maxsegsz*/BUS_SPACE_MAXSIZE_32BIT,
694 			       /*flags*/BUS_DMA_ALLOCNOW,
695 			       &bt->buffer_dmat) != 0) {
696 		goto error_exit;
697 	}
698 
699 	bt->init_level++;
700 	/* DMA tag for our mailboxes */
701 	if (bus_dma_tag_create(bt->parent_dmat, /*alignment*/1, /*boundary*/0,
702 			       /*lowaddr*/BUS_SPACE_MAXADDR,
703 			       /*highaddr*/BUS_SPACE_MAXADDR,
704 			       /*filter*/NULL, /*filterarg*/NULL,
705 			       bt->num_boxes * (sizeof(bt_mbox_in_t)
706 					      + sizeof(bt_mbox_out_t)),
707 			       /*nsegments*/1,
708 			       /*maxsegsz*/BUS_SPACE_MAXSIZE_32BIT,
709 			       /*flags*/0, &bt->mailbox_dmat) != 0) {
710 		goto error_exit;
711         }
712 
713 	bt->init_level++;
714 
715 	/* Allocation for our mailboxes */
716 	if (bus_dmamem_alloc(bt->mailbox_dmat, (void *)&bt->out_boxes,
717 			     BUS_DMA_NOWAIT, &bt->mailbox_dmamap) != 0) {
718 		goto error_exit;
719 	}
720 
721 	bt->init_level++;
722 
723 	/* And permanently map them */
724 	bus_dmamap_load(bt->mailbox_dmat, bt->mailbox_dmamap,
725        			bt->out_boxes,
726 			bt->num_boxes * (sizeof(bt_mbox_in_t)
727 				       + sizeof(bt_mbox_out_t)),
728 			btmapmboxes, bt, /*flags*/0);
729 
730 	bt->init_level++;
731 
732 	bt->in_boxes = (bt_mbox_in_t *)&bt->out_boxes[bt->num_boxes];
733 
734 	btinitmboxes(bt);
735 
736 	/* DMA tag for our ccb structures */
737 	if (bus_dma_tag_create(bt->parent_dmat, /*alignment*/1, /*boundary*/0,
738 			       /*lowaddr*/BUS_SPACE_MAXADDR,
739 			       /*highaddr*/BUS_SPACE_MAXADDR,
740 			       /*filter*/NULL, /*filterarg*/NULL,
741 			       bt->max_ccbs * sizeof(struct bt_ccb),
742 			       /*nsegments*/1,
743 			       /*maxsegsz*/BUS_SPACE_MAXSIZE_32BIT,
744 			       /*flags*/0, &bt->ccb_dmat) != 0) {
745 		goto error_exit;
746         }
747 
748 	bt->init_level++;
749 
750 	/* Allocation for our ccbs */
751 	if (bus_dmamem_alloc(bt->ccb_dmat, (void *)&bt->bt_ccb_array,
752 			     BUS_DMA_NOWAIT, &bt->ccb_dmamap) != 0) {
753 		goto error_exit;
754 	}
755 
756 	bt->init_level++;
757 
758 	/* And permanently map them */
759 	bus_dmamap_load(bt->ccb_dmat, bt->ccb_dmamap,
760        			bt->bt_ccb_array,
761 			bt->max_ccbs * sizeof(struct bt_ccb),
762 			btmapccbs, bt, /*flags*/0);
763 
764 	bt->init_level++;
765 
766 	/* DMA tag for our S/G structures.  We allocate in page sized chunks */
767 	if (bus_dma_tag_create(bt->parent_dmat, /*alignment*/1, /*boundary*/0,
768 			       /*lowaddr*/BUS_SPACE_MAXADDR,
769 			       /*highaddr*/BUS_SPACE_MAXADDR,
770 			       /*filter*/NULL, /*filterarg*/NULL,
771 			       PAGE_SIZE, /*nsegments*/1,
772 			       /*maxsegsz*/BUS_SPACE_MAXSIZE_32BIT,
773 			       /*flags*/0, &bt->sg_dmat) != 0) {
774 		goto error_exit;
775         }
776 
777 	bt->init_level++;
778 
779 	/* Perform initial CCB allocation */
780 	bzero(bt->bt_ccb_array, bt->max_ccbs * sizeof(struct bt_ccb));
781 	btallocccbs(bt);
782 
783 	if (bt->num_ccbs == 0) {
784 		device_printf(dev,
785 			      "bt_init - Unable to allocate initial ccbs\n");
786 		goto error_exit;
787 	}
788 
789 	/*
790 	 * Note that we are going and return (to probe)
791 	 */
792 	return 0;
793 
794 error_exit:
795 
796 	return (ENXIO);
797 }
798 
799 int
800 bt_attach(device_t dev)
801 {
802 	struct bt_softc *bt = device_get_softc(dev);
803 	int tagged_dev_openings;
804 	struct cam_devq *devq;
805 	int error;
806 
807 	/*
808 	 * We reserve 1 ccb for error recovery, so don't
809 	 * tell the XPT about it.
810 	 */
811 	if (bt->tag_capable != 0)
812 		tagged_dev_openings = bt->max_ccbs - 1;
813 	else
814 		tagged_dev_openings = 0;
815 
816 	/*
817 	 * Create the device queue for our SIM.
818 	 */
819 	devq = cam_simq_alloc(bt->max_ccbs - 1);
820 	if (devq == NULL)
821 		return (ENOMEM);
822 
823 	/*
824 	 * Construct our SIM entry
825 	 */
826 	bt->sim = cam_sim_alloc(btaction, btpoll, "bt", bt, bt->unit,
827 				&sim_mplock, 2, tagged_dev_openings, devq);
828 	cam_simq_release(devq);
829 	if (bt->sim == NULL)
830 		return (ENOMEM);
831 
832 	if (xpt_bus_register(bt->sim, 0) != CAM_SUCCESS) {
833 		cam_sim_free(bt->sim);
834 		return (ENXIO);
835 	}
836 
837 	if (xpt_create_path(&bt->path, /*periph*/NULL,
838 			    cam_sim_path(bt->sim), CAM_TARGET_WILDCARD,
839 			    CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
840 		xpt_bus_deregister(cam_sim_path(bt->sim));
841 		cam_sim_free(bt->sim);
842 		return (ENXIO);
843 	}
844 
845 	/*
846 	 * Setup interrupt.
847 	 */
848 	error = bus_setup_intr(dev, bt->irq, 0,
849 			       bt_intr, bt, &bt->ih, NULL);
850 	if (error) {
851 		device_printf(dev, "bus_setup_intr() failed: %d\n", error);
852 		return (error);
853 	}
854 
855 	return (0);
856 }
857 
858 int
859 bt_check_probed_iop(u_int ioport)
860 {
861 	u_int i;
862 
863 	for (i = 0; i < BT_NUM_ISAPORTS; i++) {
864 		if (bt_isa_ports[i].addr == ioport) {
865 			if (bt_isa_ports[i].probed != 0)
866 				return (1);
867 			else {
868 				return (0);
869 			}
870 		}
871 	}
872 	return (1);
873 }
874 
875 void
876 bt_mark_probed_bio(isa_compat_io_t port)
877 {
878 	if (port < BIO_DISABLED)
879 		bt_mark_probed_iop(bt_board_ports[port]);
880 }
881 
882 void
883 bt_mark_probed_iop(u_int ioport)
884 {
885 	u_int i;
886 
887 	for (i = 0; i < BT_NUM_ISAPORTS; i++) {
888 		if (ioport == bt_isa_ports[i].addr) {
889 			bt_isa_ports[i].probed = 1;
890 			break;
891 		}
892 	}
893 }
894 
895 void
896 bt_find_probe_range(int ioport, int *port_index, int *max_port_index)
897 {
898 	if (ioport > 0) {
899 		int i;
900 
901 		for (i = 0;i < BT_NUM_ISAPORTS; i++)
902 			if (ioport <= bt_isa_ports[i].addr)
903 				break;
904 		if ((i >= BT_NUM_ISAPORTS)
905 		 || (ioport != bt_isa_ports[i].addr)) {
906 			kprintf("\nbt_isa_probe: Invalid baseport of 0x%x specified.\n"
907 			       "bt_isa_probe: Nearest valid baseport is 0x%x.\n"
908 			       "bt_isa_probe: Failing probe.\n",
909 			       ioport,
910 			       (i < BT_NUM_ISAPORTS)
911 				    ? bt_isa_ports[i].addr
912 				    : bt_isa_ports[BT_NUM_ISAPORTS - 1].addr);
913 			*port_index = *max_port_index = -1;
914 			return;
915 		}
916 		*port_index = *max_port_index = bt_isa_ports[i].bio;
917 	} else {
918 		*port_index = 0;
919 		*max_port_index = BT_NUM_ISAPORTS - 1;
920 	}
921 }
922 
923 int
924 bt_iop_from_bio(isa_compat_io_t bio_index)
925 {
926 	if (bio_index >= 0 && bio_index < BT_NUM_ISAPORTS)
927 		return (bt_board_ports[bio_index]);
928 	return (-1);
929 }
930 
931 
932 static void
933 btallocccbs(struct bt_softc *bt)
934 {
935 	struct bt_ccb *next_ccb;
936 	struct sg_map_node *sg_map;
937 	bus_addr_t physaddr;
938 	bt_sg_t *segs;
939 	int newcount;
940 	int i;
941 
942 	if (bt->num_ccbs >= bt->max_ccbs)
943 		/* Can't allocate any more */
944 		return;
945 
946 	next_ccb = &bt->bt_ccb_array[bt->num_ccbs];
947 
948 	sg_map = kmalloc(sizeof(*sg_map), M_DEVBUF, M_WAITOK);
949 
950 	/* Allocate S/G space for the next batch of CCBS */
951 	if (bus_dmamem_alloc(bt->sg_dmat, (void *)&sg_map->sg_vaddr,
952 			     BUS_DMA_NOWAIT, &sg_map->sg_dmamap) != 0) {
953 		kfree(sg_map, M_DEVBUF);
954 		goto error_exit;
955 	}
956 
957 	SLIST_INSERT_HEAD(&bt->sg_maps, sg_map, links);
958 
959 	bus_dmamap_load(bt->sg_dmat, sg_map->sg_dmamap, sg_map->sg_vaddr,
960 			PAGE_SIZE, btmapsgs, bt, /*flags*/0);
961 
962 	segs = sg_map->sg_vaddr;
963 	physaddr = sg_map->sg_physaddr;
964 
965 	newcount = (PAGE_SIZE / (BT_NSEG * sizeof(bt_sg_t)));
966 	for (i = 0; bt->num_ccbs < bt->max_ccbs && i < newcount; i++) {
967 		int error;
968 
969 		next_ccb->sg_list = segs;
970 		next_ccb->sg_list_phys = physaddr;
971 		next_ccb->flags = BCCB_FREE;
972 		error = bus_dmamap_create(bt->buffer_dmat, /*flags*/0,
973 					  &next_ccb->dmamap);
974 		if (error != 0)
975 			break;
976 		SLIST_INSERT_HEAD(&bt->free_bt_ccbs, next_ccb, links);
977 		segs += BT_NSEG;
978 		physaddr += (BT_NSEG * sizeof(bt_sg_t));
979 		next_ccb++;
980 		bt->num_ccbs++;
981 	}
982 
983 	/* Reserve a CCB for error recovery */
984 	if (bt->recovery_bccb == NULL) {
985 		bt->recovery_bccb = SLIST_FIRST(&bt->free_bt_ccbs);
986 		SLIST_REMOVE_HEAD(&bt->free_bt_ccbs, links);
987 	}
988 
989 	if (SLIST_FIRST(&bt->free_bt_ccbs) != NULL)
990 		return;
991 
992 error_exit:
993 	device_printf(bt->dev, "Can't malloc BCCBs\n");
994 }
995 
996 static __inline void
997 btfreeccb(struct bt_softc *bt, struct bt_ccb *bccb)
998 {
999 	crit_enter();
1000 	if ((bccb->flags & BCCB_ACTIVE) != 0)
1001 		LIST_REMOVE(&bccb->ccb->ccb_h, sim_links.le);
1002 	if (bt->resource_shortage != 0
1003 	 && (bccb->ccb->ccb_h.status & CAM_RELEASE_SIMQ) == 0) {
1004 		bccb->ccb->ccb_h.status |= CAM_RELEASE_SIMQ;
1005 		bt->resource_shortage = FALSE;
1006 	}
1007 	bccb->flags = BCCB_FREE;
1008 	SLIST_INSERT_HEAD(&bt->free_bt_ccbs, bccb, links);
1009 	bt->active_ccbs--;
1010 	crit_exit();
1011 }
1012 
1013 static __inline struct bt_ccb*
1014 btgetccb(struct bt_softc *bt)
1015 {
1016 	struct	bt_ccb* bccb;
1017 
1018 	crit_enter();
1019 	if ((bccb = SLIST_FIRST(&bt->free_bt_ccbs)) != NULL) {
1020 		SLIST_REMOVE_HEAD(&bt->free_bt_ccbs, links);
1021 		bt->active_ccbs++;
1022 	} else {
1023 		btallocccbs(bt);
1024 		bccb = SLIST_FIRST(&bt->free_bt_ccbs);
1025 		if (bccb != NULL) {
1026 			SLIST_REMOVE_HEAD(&bt->free_bt_ccbs, links);
1027 			bt->active_ccbs++;
1028 		}
1029 	}
1030 	crit_exit();
1031 
1032 	return (bccb);
1033 }
1034 
1035 static void
1036 btaction(struct cam_sim *sim, union ccb *ccb)
1037 {
1038 	struct	bt_softc *bt;
1039 
1040 	CAM_DEBUG(ccb->ccb_h.path, CAM_DEBUG_TRACE, ("btaction\n"));
1041 
1042 	bt = (struct bt_softc *)cam_sim_softc(sim);
1043 
1044 	switch (ccb->ccb_h.func_code) {
1045 	/* Common cases first */
1046 	case XPT_SCSI_IO:	/* Execute the requested I/O operation */
1047 	case XPT_RESET_DEV:	/* Bus Device Reset the specified SCSI device */
1048 	{
1049 		struct	bt_ccb	*bccb;
1050 		struct	bt_hccb *hccb;
1051 
1052 		/*
1053 		 * get a bccb to use.
1054 		 */
1055 		if ((bccb = btgetccb(bt)) == NULL) {
1056 			crit_enter();
1057 			bt->resource_shortage = TRUE;
1058 			crit_exit();
1059 			xpt_freeze_simq(bt->sim, /*count*/1);
1060 			ccb->ccb_h.status = CAM_REQUEUE_REQ;
1061 			xpt_done(ccb);
1062 			return;
1063 		}
1064 
1065 		hccb = &bccb->hccb;
1066 
1067 		/*
1068 		 * So we can find the BCCB when an abort is requested
1069 		 */
1070 		bccb->ccb = ccb;
1071 		ccb->ccb_h.ccb_bccb_ptr = bccb;
1072 		ccb->ccb_h.ccb_bt_ptr = bt;
1073 
1074 		/*
1075 		 * Put all the arguments for the xfer in the bccb
1076 		 */
1077 		hccb->target_id = ccb->ccb_h.target_id;
1078 		hccb->target_lun = ccb->ccb_h.target_lun;
1079 		hccb->btstat = 0;
1080 		hccb->sdstat = 0;
1081 
1082 		if (ccb->ccb_h.func_code == XPT_SCSI_IO) {
1083 			struct ccb_scsiio *csio;
1084 			struct ccb_hdr *ccbh;
1085 
1086 			csio = &ccb->csio;
1087 			ccbh = &csio->ccb_h;
1088 			hccb->opcode = INITIATOR_CCB_WRESID;
1089 			hccb->datain = (ccb->ccb_h.flags & CAM_DIR_IN) ? 1 : 0;
1090 			hccb->dataout =(ccb->ccb_h.flags & CAM_DIR_OUT) ? 1 : 0;
1091 			hccb->cmd_len = csio->cdb_len;
1092 			if (hccb->cmd_len > sizeof(hccb->scsi_cdb)) {
1093 				ccb->ccb_h.status = CAM_REQ_INVALID;
1094 				btfreeccb(bt, bccb);
1095 				xpt_done(ccb);
1096 				return;
1097 			}
1098 			hccb->sense_len = csio->sense_len;
1099 			if ((ccbh->flags & CAM_TAG_ACTION_VALID) != 0
1100 			 && ccb->csio.tag_action != CAM_TAG_ACTION_NONE) {
1101 				hccb->tag_enable = TRUE;
1102 				hccb->tag_type = (ccb->csio.tag_action & 0x3);
1103 			} else {
1104 				hccb->tag_enable = FALSE;
1105 				hccb->tag_type = 0;
1106 			}
1107 			if ((ccbh->flags & CAM_CDB_POINTER) != 0) {
1108 				if ((ccbh->flags & CAM_CDB_PHYS) == 0) {
1109 					bcopy(csio->cdb_io.cdb_ptr,
1110 					      hccb->scsi_cdb, hccb->cmd_len);
1111 				} else {
1112 					/* I guess I could map it in... */
1113 					ccbh->status = CAM_REQ_INVALID;
1114 					btfreeccb(bt, bccb);
1115 					xpt_done(ccb);
1116 					return;
1117 				}
1118 			} else {
1119 				bcopy(csio->cdb_io.cdb_bytes,
1120 				      hccb->scsi_cdb, hccb->cmd_len);
1121 			}
1122 			/* If need be, bounce our sense buffer */
1123 			if (bt->sense_buffers != NULL) {
1124 				hccb->sense_addr = btsensepaddr(bt, bccb);
1125 			} else {
1126 				hccb->sense_addr = vtophys(&csio->sense_data);
1127 			}
1128 			/*
1129 			 * If we have any data to send with this command,
1130 			 * map it into bus space.
1131 			 */
1132 		        /* Only use S/G if there is a transfer */
1133 			if ((ccbh->flags & CAM_DIR_MASK) != CAM_DIR_NONE) {
1134 				if ((ccbh->flags & CAM_SCATTER_VALID) == 0) {
1135 					/*
1136 					 * We've been given a pointer
1137 					 * to a single buffer.
1138 					 */
1139 					if ((ccbh->flags & CAM_DATA_PHYS)==0) {
1140 						int error;
1141 
1142 						crit_enter();
1143 						error = bus_dmamap_load(
1144 						    bt->buffer_dmat,
1145 						    bccb->dmamap,
1146 						    csio->data_ptr,
1147 						    csio->dxfer_len,
1148 						    btexecuteccb,
1149 						    bccb,
1150 						    /*flags*/0);
1151 						if (error == EINPROGRESS) {
1152 							/*
1153 							 * So as to maintain
1154 							 * ordering, freeze the
1155 							 * controller queue
1156 							 * until our mapping is
1157 							 * returned.
1158 							 */
1159 							xpt_freeze_simq(bt->sim,
1160 									1);
1161 							csio->ccb_h.status |=
1162 							    CAM_RELEASE_SIMQ;
1163 						}
1164 						crit_exit();
1165 					} else {
1166 						struct bus_dma_segment seg;
1167 
1168 						/* Pointer to physical buffer */
1169 						seg.ds_addr =
1170 						    (bus_addr_t)csio->data_ptr;
1171 						seg.ds_len = csio->dxfer_len;
1172 						btexecuteccb(bccb, &seg, 1, 0);
1173 					}
1174 				} else {
1175 					struct bus_dma_segment *segs;
1176 
1177 					if ((ccbh->flags & CAM_DATA_PHYS) != 0)
1178 						panic("btaction - Physical "
1179 						      "segment pointers "
1180 						      "unsupported");
1181 
1182 					if ((ccbh->flags&CAM_SG_LIST_PHYS)==0)
1183 						panic("btaction - Virtual "
1184 						      "segment addresses "
1185 						      "unsupported");
1186 
1187 					/* Just use the segments provided */
1188 					segs = (struct bus_dma_segment *)
1189 					    csio->data_ptr;
1190 					btexecuteccb(bccb, segs,
1191 						     csio->sglist_cnt, 0);
1192 				}
1193 			} else {
1194 				btexecuteccb(bccb, NULL, 0, 0);
1195 			}
1196 		} else {
1197 			hccb->opcode = INITIATOR_BUS_DEV_RESET;
1198 			/* No data transfer */
1199 			hccb->datain = TRUE;
1200 			hccb->dataout = TRUE;
1201 			hccb->cmd_len = 0;
1202 			hccb->sense_len = 0;
1203 			hccb->tag_enable = FALSE;
1204 			hccb->tag_type = 0;
1205 			btexecuteccb(bccb, NULL, 0, 0);
1206 		}
1207 		break;
1208 	}
1209 	case XPT_EN_LUN:		/* Enable LUN as a target */
1210 	case XPT_TARGET_IO:		/* Execute target I/O request */
1211 	case XPT_ACCEPT_TARGET_IO:	/* Accept Host Target Mode CDB */
1212 	case XPT_CONT_TARGET_IO:	/* Continue Host Target I/O Connection*/
1213 	case XPT_ABORT:			/* Abort the specified CCB */
1214 		/* XXX Implement */
1215 		ccb->ccb_h.status = CAM_REQ_INVALID;
1216 		xpt_done(ccb);
1217 		break;
1218 	case XPT_SET_TRAN_SETTINGS:
1219 	{
1220 		/* XXX Implement */
1221 		ccb->ccb_h.status = CAM_PROVIDE_FAIL;
1222 		xpt_done(ccb);
1223 		break;
1224 	}
1225 	case XPT_GET_TRAN_SETTINGS:
1226 	/* Get default/user set transfer settings for the target */
1227 	{
1228 		struct	ccb_trans_settings *cts;
1229 		u_int	target_mask;
1230 
1231 		cts = &ccb->cts;
1232 		target_mask = 0x01 << ccb->ccb_h.target_id;
1233 		if (cts->type == CTS_TYPE_CURRENT_SETTINGS) {
1234 			struct ccb_trans_settings_scsi *scsi =
1235 			    &cts->proto_specific.scsi;
1236 			struct ccb_trans_settings_spi *spi =
1237 			    &cts->xport_specific.spi;
1238 			cts->protocol = PROTO_SCSI;
1239 			cts->protocol_version = SCSI_REV_2;
1240 			cts->transport = XPORT_SPI;
1241 			cts->transport_version = 2;
1242 
1243 			scsi->flags &= ~CTS_SCSI_FLAGS_TAG_ENB;
1244 			spi->flags &= ~CTS_SPI_FLAGS_DISC_ENB;
1245 
1246 			if ((bt->disc_permitted & target_mask) != 0)
1247 				spi->flags |= CTS_SPI_FLAGS_DISC_ENB;
1248 			if ((bt->tags_permitted & target_mask) != 0)
1249 				scsi->flags |= CTS_SCSI_FLAGS_TAG_ENB;
1250 
1251 			if ((bt->ultra_permitted & target_mask) != 0)
1252 				spi->sync_period = 12;
1253 			else if ((bt->fast_permitted & target_mask) != 0)
1254 				spi->sync_period = 25;
1255 			else if ((bt->sync_permitted & target_mask) != 0)
1256 				spi->sync_period = 50;
1257 			else
1258 				spi->sync_period = 0;
1259 
1260 			if (spi->sync_period != 0)
1261 				spi->sync_offset = 15;
1262 
1263 			spi->valid |= CTS_SPI_VALID_SYNC_RATE;
1264 			spi->valid |= CTS_SPI_VALID_SYNC_OFFSET;
1265 
1266 			spi->valid |= CTS_SPI_VALID_BUS_WIDTH;
1267 			if ((bt->wide_permitted & target_mask) != 0)
1268 				spi->bus_width = MSG_EXT_WDTR_BUS_16_BIT;
1269 			else
1270 				spi->bus_width = MSG_EXT_WDTR_BUS_8_BIT;
1271 
1272 			if (cts->ccb_h.target_lun != CAM_LUN_WILDCARD) {
1273 				scsi->valid = CTS_SCSI_VALID_TQ;
1274 				spi->valid |= CTS_SPI_VALID_DISC;
1275 			} else
1276 				scsi->valid = 0;
1277 		} else {
1278 			btfetchtransinfo(bt, cts);
1279 		}
1280 
1281 		ccb->ccb_h.status = CAM_REQ_CMP;
1282 		xpt_done(ccb);
1283 		break;
1284 	}
1285 	case XPT_CALC_GEOMETRY:
1286 	{
1287 		struct	  ccb_calc_geometry *ccg;
1288 		u_int32_t size_mb;
1289 		u_int32_t secs_per_cylinder;
1290 
1291 		ccg = &ccb->ccg;
1292 		size_mb = ccg->volume_size
1293 			/ ((1024L * 1024L) / ccg->block_size);
1294 
1295 		if (size_mb >= 1024 && (bt->extended_trans != 0)) {
1296 			if (size_mb >= 2048) {
1297 				ccg->heads = 255;
1298 				ccg->secs_per_track = 63;
1299 			} else {
1300 				ccg->heads = 128;
1301 				ccg->secs_per_track = 32;
1302 			}
1303 		} else {
1304 			ccg->heads = 64;
1305 			ccg->secs_per_track = 32;
1306 		}
1307 		secs_per_cylinder = ccg->heads * ccg->secs_per_track;
1308 		ccg->cylinders = ccg->volume_size / secs_per_cylinder;
1309 		ccb->ccb_h.status = CAM_REQ_CMP;
1310 		xpt_done(ccb);
1311 		break;
1312 	}
1313 	case XPT_RESET_BUS:		/* Reset the specified SCSI bus */
1314 	{
1315 		btreset(bt, /*hardreset*/TRUE);
1316 		ccb->ccb_h.status = CAM_REQ_CMP;
1317 		xpt_done(ccb);
1318 		break;
1319 	}
1320 	case XPT_TERM_IO:		/* Terminate the I/O process */
1321 		/* XXX Implement */
1322 		ccb->ccb_h.status = CAM_REQ_INVALID;
1323 		xpt_done(ccb);
1324 		break;
1325 	case XPT_PATH_INQ:		/* Path routing inquiry */
1326 	{
1327 		struct ccb_pathinq *cpi = &ccb->cpi;
1328 
1329 		cpi->version_num = 1; /* XXX??? */
1330 		cpi->hba_inquiry = PI_SDTR_ABLE;
1331 		if (bt->tag_capable != 0)
1332 			cpi->hba_inquiry |= PI_TAG_ABLE;
1333 		if (bt->wide_bus != 0)
1334 			cpi->hba_inquiry |= PI_WIDE_16;
1335 		cpi->target_sprt = 0;
1336 		cpi->hba_misc = 0;
1337 		cpi->hba_eng_cnt = 0;
1338 		cpi->max_target = bt->wide_bus ? 15 : 7;
1339 		cpi->max_lun = 7;
1340 		cpi->initiator_id = bt->scsi_id;
1341 		cpi->bus_id = cam_sim_bus(sim);
1342 		cpi->base_transfer_speed = 3300;
1343 		strncpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
1344 		strncpy(cpi->hba_vid, "BusLogic", HBA_IDLEN);
1345 		strncpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
1346 		cpi->unit_number = cam_sim_unit(sim);
1347 		cpi->ccb_h.status = CAM_REQ_CMP;
1348 		cpi->transport = XPORT_SPI;
1349 		cpi->transport_version = 2;
1350 		cpi->protocol = PROTO_SCSI;
1351 		cpi->protocol_version = SCSI_REV_2;
1352 		xpt_done(ccb);
1353 		break;
1354 	}
1355 	default:
1356 		ccb->ccb_h.status = CAM_REQ_INVALID;
1357 		xpt_done(ccb);
1358 		break;
1359 	}
1360 }
1361 
1362 static void
1363 btexecuteccb(void *arg, bus_dma_segment_t *dm_segs, int nseg, int error)
1364 {
1365 	struct	 bt_ccb *bccb;
1366 	union	 ccb *ccb;
1367 	struct	 bt_softc *bt;
1368 
1369 	bccb = (struct bt_ccb *)arg;
1370 	ccb = bccb->ccb;
1371 	bt = (struct bt_softc *)ccb->ccb_h.ccb_bt_ptr;
1372 
1373 	if (error != 0) {
1374 		if (error != EFBIG)
1375 			device_printf(bt->dev,
1376 				      "Unexpected error 0x%x returned from "
1377 				      "bus_dmamap_load\n", error);
1378 		if (ccb->ccb_h.status == CAM_REQ_INPROG) {
1379 			xpt_freeze_devq(ccb->ccb_h.path, /*count*/1);
1380 			ccb->ccb_h.status = CAM_REQ_TOO_BIG|CAM_DEV_QFRZN;
1381 		}
1382 		btfreeccb(bt, bccb);
1383 		xpt_done(ccb);
1384 		return;
1385 	}
1386 
1387 	if (nseg != 0) {
1388 		bt_sg_t *sg;
1389 		bus_dma_segment_t *end_seg;
1390 		bus_dmasync_op_t op;
1391 
1392 		end_seg = dm_segs + nseg;
1393 
1394 		/* Copy the segments into our SG list */
1395 		sg = bccb->sg_list;
1396 		while (dm_segs < end_seg) {
1397 			sg->len = dm_segs->ds_len;
1398 			sg->addr = dm_segs->ds_addr;
1399 			sg++;
1400 			dm_segs++;
1401 		}
1402 
1403 		if (nseg > 1) {
1404 			bccb->hccb.opcode = INITIATOR_SG_CCB_WRESID;
1405 			bccb->hccb.data_len = sizeof(bt_sg_t) * nseg;
1406 			bccb->hccb.data_addr = bccb->sg_list_phys;
1407 		} else {
1408 			bccb->hccb.data_len = bccb->sg_list->len;
1409 			bccb->hccb.data_addr = bccb->sg_list->addr;
1410 		}
1411 
1412 		if ((ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN)
1413 			op = BUS_DMASYNC_PREREAD;
1414 		else
1415 			op = BUS_DMASYNC_PREWRITE;
1416 
1417 		bus_dmamap_sync(bt->buffer_dmat, bccb->dmamap, op);
1418 
1419 	} else {
1420 		bccb->hccb.opcode = INITIATOR_CCB;
1421 		bccb->hccb.data_len = 0;
1422 		bccb->hccb.data_addr = 0;
1423 	}
1424 
1425 	crit_enter();
1426 
1427 	/*
1428 	 * Last time we need to check if this CCB needs to
1429 	 * be aborted.
1430 	 */
1431 	if (ccb->ccb_h.status != CAM_REQ_INPROG) {
1432 		if (nseg != 0)
1433 			bus_dmamap_unload(bt->buffer_dmat, bccb->dmamap);
1434 		btfreeccb(bt, bccb);
1435 		xpt_done(ccb);
1436 		crit_exit();
1437 		return;
1438 	}
1439 
1440 	bccb->flags = BCCB_ACTIVE;
1441 	ccb->ccb_h.status |= CAM_SIM_QUEUED;
1442 	LIST_INSERT_HEAD(&bt->pending_ccbs, &ccb->ccb_h, sim_links.le);
1443 
1444 	callout_reset(&ccb->ccb_h.timeout_ch, (ccb->ccb_h.timeout * hz) / 1000,
1445 	    bttimeout, bccb);
1446 
1447 	/* Tell the adapter about this command */
1448 	bt->cur_outbox->ccb_addr = btccbvtop(bt, bccb);
1449 	if (bt->cur_outbox->action_code != BMBO_FREE) {
1450 		/*
1451 		 * We should never encounter a busy mailbox.
1452 		 * If we do, warn the user, and treat it as
1453 		 * a resource shortage.  If the controller is
1454 		 * hung, one of the pending transactions will
1455 		 * timeout causing us to start recovery operations.
1456 		 */
1457 		device_printf(bt->dev,
1458 			      "Encountered busy mailbox with %d out of %d "
1459 			      "commands active!!!\n", bt->active_ccbs,
1460 			      bt->max_ccbs);
1461 		callout_stop(&ccb->ccb_h.timeout_ch);
1462 		if (nseg != 0)
1463 			bus_dmamap_unload(bt->buffer_dmat, bccb->dmamap);
1464 		btfreeccb(bt, bccb);
1465 		bt->resource_shortage = TRUE;
1466 		xpt_freeze_simq(bt->sim, /*count*/1);
1467 		ccb->ccb_h.status = CAM_REQUEUE_REQ;
1468 		xpt_done(ccb);
1469 		crit_exit();
1470 		return;
1471 	}
1472 	bt->cur_outbox->action_code = BMBO_START;
1473 	bt_outb(bt, COMMAND_REG, BOP_START_MBOX);
1474 	btnextoutbox(bt);
1475 	crit_exit();
1476 }
1477 
1478 void
1479 bt_intr(void *arg)
1480 {
1481 	struct	bt_softc *bt;
1482 	u_int	intstat;
1483 
1484 	bt = (struct bt_softc *)arg;
1485 	while (((intstat = bt_inb(bt, INTSTAT_REG)) & INTR_PENDING) != 0) {
1486 
1487 		if ((intstat & CMD_COMPLETE) != 0) {
1488 			bt->latched_status = bt_inb(bt, STATUS_REG);
1489 			bt->command_cmp = TRUE;
1490 		}
1491 
1492 		bt_outb(bt, CONTROL_REG, RESET_INTR);
1493 
1494 		if ((intstat & IMB_LOADED) != 0) {
1495 			while (bt->cur_inbox->comp_code != BMBI_FREE) {
1496 				btdone(bt,
1497 				       btccbptov(bt, bt->cur_inbox->ccb_addr),
1498 				       bt->cur_inbox->comp_code);
1499 				bt->cur_inbox->comp_code = BMBI_FREE;
1500 				btnextinbox(bt);
1501 			}
1502 		}
1503 
1504 		if ((intstat & SCSI_BUS_RESET) != 0) {
1505 			btreset(bt, /*hardreset*/FALSE);
1506 		}
1507 	}
1508 }
1509 
1510 static void
1511 btdone(struct bt_softc *bt, struct bt_ccb *bccb, bt_mbi_comp_code_t comp_code)
1512 {
1513 	union  ccb	  *ccb;
1514 	struct ccb_scsiio *csio;
1515 
1516 	ccb = bccb->ccb;
1517 	csio = &bccb->ccb->csio;
1518 
1519 	if ((bccb->flags & BCCB_ACTIVE) == 0) {
1520 		device_printf(bt->dev,
1521 			      "btdone - Attempt to free non-active BCCB %p\n",
1522 			      (void *)bccb);
1523 		return;
1524 	}
1525 
1526 	if ((ccb->ccb_h.flags & CAM_DIR_MASK) != CAM_DIR_NONE) {
1527 		bus_dmasync_op_t op;
1528 
1529 		if ((ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN)
1530 			op = BUS_DMASYNC_POSTREAD;
1531 		else
1532 			op = BUS_DMASYNC_POSTWRITE;
1533 		bus_dmamap_sync(bt->buffer_dmat, bccb->dmamap, op);
1534 		bus_dmamap_unload(bt->buffer_dmat, bccb->dmamap);
1535 	}
1536 
1537 	if (bccb == bt->recovery_bccb) {
1538 		/*
1539 		 * The recovery BCCB does not have a CCB associated
1540 		 * with it, so short circuit the normal error handling.
1541 		 * We now traverse our list of pending CCBs and process
1542 		 * any that were terminated by the recovery CCBs action.
1543 		 * We also reinstate timeouts for all remaining, pending,
1544 		 * CCBs.
1545 		 */
1546 		struct cam_path *path;
1547 		struct ccb_hdr *ccb_h;
1548 		cam_status error;
1549 
1550 		/* Notify all clients that a BDR occured */
1551 		error = xpt_create_path(&path, /*periph*/NULL,
1552 					cam_sim_path(bt->sim),
1553 					bccb->hccb.target_id,
1554 					CAM_LUN_WILDCARD);
1555 
1556 		if (error == CAM_REQ_CMP)
1557 			xpt_async(AC_SENT_BDR, path, NULL);
1558 
1559 		ccb_h = LIST_FIRST(&bt->pending_ccbs);
1560 		while (ccb_h != NULL) {
1561 			struct bt_ccb *pending_bccb;
1562 
1563 			pending_bccb = (struct bt_ccb *)ccb_h->ccb_bccb_ptr;
1564 			if (pending_bccb->hccb.target_id
1565 			 == bccb->hccb.target_id) {
1566 				pending_bccb->hccb.btstat = BTSTAT_HA_BDR;
1567 				ccb_h = LIST_NEXT(ccb_h, sim_links.le);
1568 				btdone(bt, pending_bccb, BMBI_ERROR);
1569 			} else {
1570 				callout_reset(&ccb_h->timeout_ch,
1571 				    (ccb_h->timeout * hz) / 1000,
1572 				    bttimeout, pending_bccb);
1573 				ccb_h = LIST_NEXT(ccb_h, sim_links.le);
1574 			}
1575 		}
1576 		device_printf(bt->dev, "No longer in timeout\n");
1577 		return;
1578 	}
1579 
1580 	callout_stop(&ccb->ccb_h.timeout_ch);
1581 
1582 	switch (comp_code) {
1583 	case BMBI_FREE:
1584 		device_printf(bt->dev,
1585 			      "btdone - CCB completed with free status!\n");
1586 		break;
1587 	case BMBI_NOT_FOUND:
1588 		device_printf(bt->dev,
1589 			      "btdone - CCB Abort failed to find CCB\n");
1590 		break;
1591 	case BMBI_ABORT:
1592 	case BMBI_ERROR:
1593 		if (bootverbose) {
1594 			kprintf("bt: ccb %p - error %x occurred.  "
1595 			       "btstat = %x, sdstat = %x\n",
1596 			       (void *)bccb, comp_code, bccb->hccb.btstat,
1597 			       bccb->hccb.sdstat);
1598 		}
1599 		/* An error occured */
1600 		switch(bccb->hccb.btstat) {
1601 		case BTSTAT_DATARUN_ERROR:
1602 			if (bccb->hccb.data_len == 0) {
1603 				/*
1604 				 * At least firmware 4.22, does this
1605 				 * for a QUEUE FULL condition.
1606 				 */
1607 				bccb->hccb.sdstat = SCSI_STATUS_QUEUE_FULL;
1608 			} else if (bccb->hccb.data_len < 0) {
1609 				csio->ccb_h.status = CAM_DATA_RUN_ERR;
1610 				break;
1611 			}
1612 			/* FALLTHROUGH */
1613 		case BTSTAT_NOERROR:
1614 		case BTSTAT_LINKED_CMD_COMPLETE:
1615 		case BTSTAT_LINKED_CMD_FLAG_COMPLETE:
1616 		case BTSTAT_DATAUNDERUN_ERROR:
1617 
1618 			csio->scsi_status = bccb->hccb.sdstat;
1619 			csio->ccb_h.status |= CAM_SCSI_STATUS_ERROR;
1620 			switch(csio->scsi_status) {
1621 			case SCSI_STATUS_CHECK_COND:
1622 			case SCSI_STATUS_CMD_TERMINATED:
1623 				csio->ccb_h.status |= CAM_AUTOSNS_VALID;
1624 				/* Bounce sense back if necessary */
1625 				if (bt->sense_buffers != NULL) {
1626 					csio->sense_data =
1627 					    *btsensevaddr(bt, bccb);
1628 				}
1629 				break;
1630 			default:
1631 				break;
1632 			case SCSI_STATUS_OK:
1633 				csio->ccb_h.status = CAM_REQ_CMP;
1634 				break;
1635 			}
1636 			csio->resid = bccb->hccb.data_len;
1637 			break;
1638 		case BTSTAT_SELTIMEOUT:
1639 			csio->ccb_h.status = CAM_SEL_TIMEOUT;
1640 			break;
1641 		case BTSTAT_UNEXPECTED_BUSFREE:
1642 			csio->ccb_h.status = CAM_UNEXP_BUSFREE;
1643 			break;
1644 		case BTSTAT_INVALID_PHASE:
1645 			csio->ccb_h.status = CAM_SEQUENCE_FAIL;
1646 			break;
1647 		case BTSTAT_INVALID_ACTION_CODE:
1648 			panic("%s: Inavlid Action code", bt_name(bt));
1649 			break;
1650 		case BTSTAT_INVALID_OPCODE:
1651 			panic("%s: Inavlid CCB Opcode code", bt_name(bt));
1652 			break;
1653 		case BTSTAT_LINKED_CCB_LUN_MISMATCH:
1654 			/* We don't even support linked commands... */
1655 			panic("%s: Linked CCB Lun Mismatch", bt_name(bt));
1656 			break;
1657 		case BTSTAT_INVALID_CCB_OR_SG_PARAM:
1658 			panic("%s: Invalid CCB or SG list", bt_name(bt));
1659 			break;
1660 		case BTSTAT_AUTOSENSE_FAILED:
1661 			csio->ccb_h.status = CAM_AUTOSENSE_FAIL;
1662 			break;
1663 		case BTSTAT_TAGGED_MSG_REJECTED:
1664 		{
1665 			struct ccb_trans_settings neg;
1666 			struct ccb_trans_settings_scsi *scsi =
1667 			    &neg.proto_specific.scsi;
1668 
1669 			neg.protocol = PROTO_SCSI;
1670 			neg.protocol_version = SCSI_REV_2;
1671 			neg.transport = XPORT_SPI;
1672 			neg.transport_version = 2;
1673 			scsi->valid = CTS_SCSI_VALID_TQ;
1674 			scsi->flags = 0;
1675 			xpt_print_path(csio->ccb_h.path);
1676 			kprintf("refuses tagged commands.  Performing "
1677 			       "non-tagged I/O\n");
1678 			xpt_setup_ccb(&neg.ccb_h, csio->ccb_h.path,
1679 				      /*priority*/1);
1680 			xpt_async(AC_TRANSFER_NEG, csio->ccb_h.path, &neg);
1681 			bt->tags_permitted &= ~(0x01 << csio->ccb_h.target_id);
1682 			csio->ccb_h.status = CAM_MSG_REJECT_REC;
1683 			break;
1684 		}
1685 		case BTSTAT_UNSUPPORTED_MSG_RECEIVED:
1686 			/*
1687 			 * XXX You would think that this is
1688 			 *     a recoverable error... Hmmm.
1689 			 */
1690 			csio->ccb_h.status = CAM_REQ_CMP_ERR;
1691 			break;
1692 		case BTSTAT_HA_SOFTWARE_ERROR:
1693 		case BTSTAT_HA_WATCHDOG_ERROR:
1694 		case BTSTAT_HARDWARE_FAILURE:
1695 			/* Hardware reset ??? Can we recover ??? */
1696 			csio->ccb_h.status = CAM_NO_HBA;
1697 			break;
1698 		case BTSTAT_TARGET_IGNORED_ATN:
1699 		case BTSTAT_OTHER_SCSI_BUS_RESET:
1700 		case BTSTAT_HA_SCSI_BUS_RESET:
1701 			if ((csio->ccb_h.status & CAM_STATUS_MASK)
1702 			 != CAM_CMD_TIMEOUT)
1703 				csio->ccb_h.status = CAM_SCSI_BUS_RESET;
1704 			break;
1705 		case BTSTAT_HA_BDR:
1706 			if ((bccb->flags & BCCB_DEVICE_RESET) == 0)
1707 				csio->ccb_h.status = CAM_BDR_SENT;
1708 			else
1709 				csio->ccb_h.status = CAM_CMD_TIMEOUT;
1710 			break;
1711 		case BTSTAT_INVALID_RECONNECT:
1712 		case BTSTAT_ABORT_QUEUE_GENERATED:
1713 			csio->ccb_h.status = CAM_REQ_TERMIO;
1714 			break;
1715 		case BTSTAT_SCSI_PERROR_DETECTED:
1716 			csio->ccb_h.status = CAM_UNCOR_PARITY;
1717 			break;
1718 		}
1719 		if (csio->ccb_h.status != CAM_REQ_CMP) {
1720 			xpt_freeze_devq(csio->ccb_h.path, /*count*/1);
1721 			csio->ccb_h.status |= CAM_DEV_QFRZN;
1722 		}
1723 		if ((bccb->flags & BCCB_RELEASE_SIMQ) != 0)
1724 			ccb->ccb_h.status |= CAM_RELEASE_SIMQ;
1725 		btfreeccb(bt, bccb);
1726 		xpt_done(ccb);
1727 		break;
1728 	case BMBI_OK:
1729 		/* All completed without incident */
1730 		ccb->ccb_h.status |= CAM_REQ_CMP;
1731 		if ((bccb->flags & BCCB_RELEASE_SIMQ) != 0)
1732 			ccb->ccb_h.status |= CAM_RELEASE_SIMQ;
1733 		btfreeccb(bt, bccb);
1734 		xpt_done(ccb);
1735 		break;
1736 	}
1737 }
1738 
1739 static int
1740 btreset(struct bt_softc* bt, int hard_reset)
1741 {
1742 	struct	 ccb_hdr *ccb_h;
1743 	u_int	 status;
1744 	u_int	 timeout;
1745 	u_int8_t reset_type;
1746 
1747 	if (hard_reset != 0)
1748 		reset_type = HARD_RESET;
1749 	else
1750 		reset_type = SOFT_RESET;
1751 	bt_outb(bt, CONTROL_REG, reset_type);
1752 
1753 	/* Wait 5sec. for Diagnostic start */
1754 	timeout = 5 * 10000;
1755 	while (--timeout) {
1756 		status = bt_inb(bt, STATUS_REG);
1757 		if ((status & DIAG_ACTIVE) != 0)
1758 			break;
1759 		DELAY(100);
1760 	}
1761 	if (timeout == 0) {
1762 		if (bootverbose)
1763 			kprintf("%s: btreset - Diagnostic Active failed to "
1764 				"assert. status = 0x%x\n", bt_name(bt), status);
1765 		return (ETIMEDOUT);
1766 	}
1767 
1768 	/* Wait 10sec. for Diagnostic end */
1769 	timeout = 10 * 10000;
1770 	while (--timeout) {
1771 		status = bt_inb(bt, STATUS_REG);
1772 		if ((status & DIAG_ACTIVE) == 0)
1773 			break;
1774 		DELAY(100);
1775 	}
1776 	if (timeout == 0) {
1777 		panic("%s: btreset - Diagnostic Active failed to drop. "
1778 		       "status = 0x%x\n", bt_name(bt), status);
1779 		return (ETIMEDOUT);
1780 	}
1781 
1782 	/* Wait for the host adapter to become ready or report a failure */
1783 	timeout = 10000;
1784 	while (--timeout) {
1785 		status = bt_inb(bt, STATUS_REG);
1786 		if ((status & (DIAG_FAIL|HA_READY|DATAIN_REG_READY)) != 0)
1787 			break;
1788 		DELAY(100);
1789 	}
1790 	if (timeout == 0) {
1791 		kprintf("%s: btreset - Host adapter failed to come ready. "
1792 		       "status = 0x%x\n", bt_name(bt), status);
1793 		return (ETIMEDOUT);
1794 	}
1795 
1796 	/* If the diagnostics failed, tell the user */
1797 	if ((status & DIAG_FAIL) != 0
1798 	 || (status & HA_READY) == 0) {
1799 		kprintf("%s: btreset - Adapter failed diagnostics\n",
1800 		       bt_name(bt));
1801 
1802 		if ((status & DATAIN_REG_READY) != 0)
1803 			kprintf("%s: btreset - Host Adapter Error code = 0x%x\n",
1804 			       bt_name(bt), bt_inb(bt, DATAIN_REG));
1805 		return (ENXIO);
1806 	}
1807 
1808 	/* If we've allocated mailboxes, initialize them */
1809 	if (bt->init_level > 4)
1810 		btinitmboxes(bt);
1811 
1812 	/* If we've attached to the XPT, tell it about the event */
1813 	if (bt->path != NULL)
1814 		xpt_async(AC_BUS_RESET, bt->path, NULL);
1815 
1816 	/*
1817 	 * Perform completion processing for all outstanding CCBs.
1818 	 */
1819 	while ((ccb_h = LIST_FIRST(&bt->pending_ccbs)) != NULL) {
1820 		struct bt_ccb *pending_bccb;
1821 
1822 		pending_bccb = (struct bt_ccb *)ccb_h->ccb_bccb_ptr;
1823 		pending_bccb->hccb.btstat = BTSTAT_HA_SCSI_BUS_RESET;
1824 		btdone(bt, pending_bccb, BMBI_ERROR);
1825 	}
1826 
1827 	return (0);
1828 }
1829 
1830 /*
1831  * Send a command to the adapter.
1832  */
1833 int
1834 bt_cmd(struct bt_softc *bt, bt_op_t opcode, u_int8_t *params, u_int param_len,
1835       u_int8_t *reply_data, u_int reply_len, u_int cmd_timeout)
1836 {
1837 	u_int	timeout;
1838 	u_int	status;
1839 	u_int	saved_status;
1840 	u_int	intstat;
1841 	u_int	reply_buf_size;
1842 	int	cmd_complete;
1843 	int	error;
1844 
1845 	/* No data returned to start */
1846 	reply_buf_size = reply_len;
1847 	reply_len = 0;
1848 	intstat = 0;
1849 	cmd_complete = 0;
1850 	saved_status = 0;
1851 	error = 0;
1852 
1853 	bt->command_cmp = 0;
1854 	/*
1855 	 * Wait up to 10 sec. for the adapter to become
1856 	 * ready to accept commands.
1857 	 */
1858 	timeout = 100000;
1859 	while (--timeout) {
1860 		status = bt_inb(bt, STATUS_REG);
1861 		if ((status & HA_READY) != 0
1862 		 && (status & CMD_REG_BUSY) == 0)
1863 			break;
1864 		/*
1865 		 * Throw away any pending data which may be
1866 		 * left over from earlier commands that we
1867 		 * timedout on.
1868 		 */
1869 		if ((status & DATAIN_REG_READY) != 0)
1870 			(void)bt_inb(bt, DATAIN_REG);
1871 		DELAY(100);
1872 	}
1873 	if (timeout == 0) {
1874 		kprintf("%s: bt_cmd: Timeout waiting for adapter ready, "
1875 		       "status = 0x%x\n", bt_name(bt), status);
1876 		return (ETIMEDOUT);
1877 	}
1878 
1879 	/*
1880 	 * Send the opcode followed by any necessary parameter bytes.
1881 	 */
1882 	bt_outb(bt, COMMAND_REG, opcode);
1883 
1884 	/*
1885 	 * Wait for up to 1sec for each byte of the the
1886 	 * parameter list sent to be sent.
1887 	 */
1888 	timeout = 10000;
1889 	while (param_len && --timeout) {
1890 		DELAY(100);
1891 		crit_enter();
1892 		status = bt_inb(bt, STATUS_REG);
1893 		intstat = bt_inb(bt, INTSTAT_REG);
1894 		crit_exit();
1895 
1896 		if ((intstat & (INTR_PENDING|CMD_COMPLETE))
1897 		 == (INTR_PENDING|CMD_COMPLETE)) {
1898 			saved_status = status;
1899 			cmd_complete = 1;
1900 			break;
1901 		}
1902 		if (bt->command_cmp != 0) {
1903 			saved_status = bt->latched_status;
1904 			cmd_complete = 1;
1905 			break;
1906 		}
1907 		if ((status & DATAIN_REG_READY) != 0)
1908 			break;
1909 		if ((status & CMD_REG_BUSY) == 0) {
1910 			bt_outb(bt, COMMAND_REG, *params++);
1911 			param_len--;
1912 			timeout = 10000;
1913 		}
1914 	}
1915 	if (timeout == 0) {
1916 		kprintf("%s: bt_cmd: Timeout sending parameters, "
1917 		       "status = 0x%x\n", bt_name(bt), status);
1918 		cmd_complete = 1;
1919 		saved_status = status;
1920 		error = ETIMEDOUT;
1921 	}
1922 
1923 	/*
1924 	 * Wait for the command to complete.
1925 	 */
1926 	while (cmd_complete == 0 && --cmd_timeout) {
1927 
1928 		crit_enter();
1929 		status = bt_inb(bt, STATUS_REG);
1930 		intstat = bt_inb(bt, INTSTAT_REG);
1931 		/*
1932 		 * It may be that this command was issued with
1933 		 * controller interrupts disabled.  We'll never
1934 		 * get to our command if an incoming mailbox
1935 		 * interrupt is pending, so take care of completed
1936 		 * mailbox commands by calling our interrupt handler.
1937 		 */
1938 		if ((intstat & (INTR_PENDING|IMB_LOADED))
1939 		 == (INTR_PENDING|IMB_LOADED))
1940 			bt_intr(bt);
1941 		crit_exit();
1942 
1943 		if (bt->command_cmp != 0) {
1944  			/*
1945 			 * Our interrupt handler saw CMD_COMPLETE
1946 			 * status before we did.
1947 			 */
1948 			cmd_complete = 1;
1949 			saved_status = bt->latched_status;
1950 		} else if ((intstat & (INTR_PENDING|CMD_COMPLETE))
1951 			== (INTR_PENDING|CMD_COMPLETE)) {
1952 			/*
1953 			 * Our poll (in case interrupts are blocked)
1954 			 * saw the CMD_COMPLETE interrupt.
1955 			 */
1956 			cmd_complete = 1;
1957 			saved_status = status;
1958 		} else if (opcode == BOP_MODIFY_IO_ADDR
1959 			&& (status & CMD_REG_BUSY) == 0) {
1960 			/*
1961 			 * The BOP_MODIFY_IO_ADDR does not issue a CMD_COMPLETE,
1962 			 * but it should update the status register.  So, we
1963 			 * consider this command complete when the CMD_REG_BUSY
1964 			 * status clears.
1965 			 */
1966 			saved_status = status;
1967 			cmd_complete = 1;
1968 		} else if ((status & DATAIN_REG_READY) != 0) {
1969 			u_int8_t data;
1970 
1971 			data = bt_inb(bt, DATAIN_REG);
1972 			if (reply_len < reply_buf_size) {
1973 				*reply_data++ = data;
1974 			} else {
1975 				kprintf("%s: bt_cmd - Discarded reply data byte "
1976 				       "for opcode 0x%x\n", bt_name(bt),
1977 				       opcode);
1978 			}
1979 			/*
1980 			 * Reset timeout to ensure at least a second
1981 			 * between response bytes.
1982 			 */
1983 			cmd_timeout = MAX(cmd_timeout, 10000);
1984 			reply_len++;
1985 
1986 		} else if ((opcode == BOP_FETCH_LRAM)
1987 			&& (status & HA_READY) != 0) {
1988 				saved_status = status;
1989 				cmd_complete = 1;
1990 		}
1991 		DELAY(100);
1992 	}
1993 	if (cmd_timeout == 0) {
1994 		kprintf("%s: bt_cmd: Timeout waiting for command (%x) "
1995 		       "to complete.\n%s: status = 0x%x, intstat = 0x%x, "
1996 		       "rlen %d\n", bt_name(bt), opcode,
1997 		       bt_name(bt), status, intstat, reply_len);
1998 		error = (ETIMEDOUT);
1999 	}
2000 
2001 	/*
2002 	 * Clear any pending interrupts.  Block interrupts so our
2003 	 * interrupt handler is not re-entered.
2004 	 */
2005 	crit_enter();
2006 	bt_intr(bt);
2007 	crit_exit();
2008 
2009 	if (error != 0)
2010 		return (error);
2011 
2012 	/*
2013 	 * If the command was rejected by the controller, tell the caller.
2014 	 */
2015 	if ((saved_status & CMD_INVALID) != 0) {
2016 		/*
2017 		 * Some early adapters may not recover properly from
2018 		 * an invalid command.  If it appears that the controller
2019 		 * has wedged (i.e. status was not cleared by our interrupt
2020 		 * reset above), perform a soft reset.
2021       		 */
2022 		if (bootverbose)
2023 			kprintf("%s: Invalid Command 0x%x\n", bt_name(bt),
2024 				opcode);
2025 		DELAY(1000);
2026 		status = bt_inb(bt, STATUS_REG);
2027 		if ((status & (CMD_INVALID|STATUS_REG_RSVD|DATAIN_REG_READY|
2028 			      CMD_REG_BUSY|DIAG_FAIL|DIAG_ACTIVE)) != 0
2029 		 || (status & (HA_READY|INIT_REQUIRED))
2030 		  != (HA_READY|INIT_REQUIRED)) {
2031 			btreset(bt, /*hard_reset*/FALSE);
2032 		}
2033 		return (EINVAL);
2034 	}
2035 
2036 	if (param_len > 0) {
2037 		/* The controller did not accept the full argument list */
2038 	 	return (E2BIG);
2039 	}
2040 
2041 	if (reply_len != reply_buf_size) {
2042 		/* Too much or too little data received */
2043 		return (EMSGSIZE);
2044 	}
2045 
2046 	/* We were successful */
2047 	return (0);
2048 }
2049 
2050 static int
2051 btinitmboxes(struct bt_softc *bt) {
2052 	init_32b_mbox_params_t init_mbox;
2053 	int error;
2054 
2055 	bzero(bt->in_boxes, sizeof(bt_mbox_in_t) * bt->num_boxes);
2056 	bzero(bt->out_boxes, sizeof(bt_mbox_out_t) * bt->num_boxes);
2057 	bt->cur_inbox = bt->in_boxes;
2058 	bt->last_inbox = bt->in_boxes + bt->num_boxes - 1;
2059 	bt->cur_outbox = bt->out_boxes;
2060 	bt->last_outbox = bt->out_boxes + bt->num_boxes - 1;
2061 
2062 	/* Tell the adapter about them */
2063 	init_mbox.num_boxes = bt->num_boxes;
2064 	init_mbox.base_addr[0] = bt->mailbox_physbase & 0xFF;
2065 	init_mbox.base_addr[1] = (bt->mailbox_physbase >> 8) & 0xFF;
2066 	init_mbox.base_addr[2] = (bt->mailbox_physbase >> 16) & 0xFF;
2067 	init_mbox.base_addr[3] = (bt->mailbox_physbase >> 24) & 0xFF;
2068 	error = bt_cmd(bt, BOP_INITIALIZE_32BMBOX, (u_int8_t *)&init_mbox,
2069 		       /*parmlen*/sizeof(init_mbox), /*reply_buf*/NULL,
2070 		       /*reply_len*/0, DEFAULT_CMD_TIMEOUT);
2071 
2072 	if (error != 0)
2073 		kprintf("btinitmboxes: Initialization command failed\n");
2074 	else if (bt->strict_rr != 0) {
2075 		/*
2076 		 * If the controller supports
2077 		 * strict round robin mode,
2078 		 * enable it
2079 		 */
2080 		u_int8_t param;
2081 
2082 		param = 0;
2083 		error = bt_cmd(bt, BOP_ENABLE_STRICT_RR, &param, 1,
2084 			       /*reply_buf*/NULL, /*reply_len*/0,
2085 			       DEFAULT_CMD_TIMEOUT);
2086 
2087 		if (error != 0) {
2088 			kprintf("btinitmboxes: Unable to enable strict RR\n");
2089 			error = 0;
2090 		} else if (bootverbose) {
2091 			kprintf("%s: Using Strict Round Robin Mailbox Mode\n",
2092 			       bt_name(bt));
2093 		}
2094 	}
2095 
2096 	return (error);
2097 }
2098 
2099 /*
2100  * Update the XPT's idea of the negotiated transfer
2101  * parameters for a particular target.
2102  */
2103 static void
2104 btfetchtransinfo(struct bt_softc *bt, struct ccb_trans_settings *cts)
2105 {
2106 	setup_data_t	setup_info;
2107 	u_int		target;
2108 	u_int		targ_offset;
2109 	u_int		targ_mask;
2110 	u_int		sync_period;
2111 	u_int		sync_offset;
2112 	u_int		bus_width;
2113 	int		error;
2114 	u_int8_t	param;
2115 	targ_syncinfo_t	sync_info;
2116 	struct ccb_trans_settings_scsi *scsi =
2117 	    &cts->proto_specific.scsi;
2118 	struct ccb_trans_settings_spi *spi =
2119 	    &cts->xport_specific.spi;
2120 
2121 	spi->valid = 0;
2122 	scsi->valid = 0;
2123 
2124 	target = cts->ccb_h.target_id;
2125 	targ_offset = (target & 0x7);
2126 	targ_mask = (0x01 << targ_offset);
2127 
2128 	/*
2129 	 * Inquire Setup Information.  This command retreives the
2130 	 * Wide negotiation status for recent adapters as well as
2131 	 * the sync info for older models.
2132 	 */
2133 	param = sizeof(setup_info);
2134 	error = bt_cmd(bt, BOP_INQUIRE_SETUP_INFO, &param, /*paramlen*/1,
2135 		       (u_int8_t*)&setup_info, sizeof(setup_info),
2136 		       DEFAULT_CMD_TIMEOUT);
2137 
2138 	if (error != 0) {
2139 		kprintf("%s: btfetchtransinfo - Inquire Setup Info Failed %x\n",
2140 		       bt_name(bt), error);
2141 		return;
2142 	}
2143 
2144 	sync_info = (target < 8) ? setup_info.low_syncinfo[targ_offset]
2145 				 : setup_info.high_syncinfo[targ_offset];
2146 
2147 	if (sync_info.sync == 0)
2148 		sync_offset = 0;
2149 	else
2150 		sync_offset = sync_info.offset;
2151 
2152 
2153 	bus_width = MSG_EXT_WDTR_BUS_8_BIT;
2154 	if (strcmp(bt->firmware_ver, "5.06L") >= 0) {
2155 		u_int wide_active;
2156 
2157 		wide_active =
2158 		    (target < 8) ? (setup_info.low_wide_active & targ_mask)
2159 		    		 : (setup_info.high_wide_active & targ_mask);
2160 
2161 		if (wide_active)
2162 			bus_width = MSG_EXT_WDTR_BUS_16_BIT;
2163 	} else if ((bt->wide_permitted & targ_mask) != 0) {
2164 		struct ccb_getdev cgd;
2165 
2166 		/*
2167 		 * Prior to rev 5.06L, wide status isn't provided,
2168 		 * so we "guess" that wide transfers are in effect
2169 		 * if the user settings allow for wide and the inquiry
2170 		 * data for the device indicates that it can handle
2171 		 * wide transfers.
2172 		 */
2173 		xpt_setup_ccb(&cgd.ccb_h, cts->ccb_h.path, /*priority*/1);
2174 		cgd.ccb_h.func_code = XPT_GDEV_TYPE;
2175 		xpt_action((union ccb *)&cgd);
2176 		if ((cgd.ccb_h.status & CAM_STATUS_MASK) == CAM_REQ_CMP
2177 		 && (cgd.inq_data.flags & SID_WBus16) != 0)
2178 			bus_width = MSG_EXT_WDTR_BUS_16_BIT;
2179 	}
2180 
2181 	if (bt->firmware_ver[0] >= '3') {
2182 		/*
2183 		 * For adapters that can do fast or ultra speeds,
2184 		 * use the more exact Target Sync Information command.
2185 		 */
2186 		target_sync_info_data_t sync_info;
2187 
2188 		param = sizeof(sync_info);
2189 		error = bt_cmd(bt, BOP_TARG_SYNC_INFO, &param, /*paramlen*/1,
2190 			       (u_int8_t*)&sync_info, sizeof(sync_info),
2191 			       DEFAULT_CMD_TIMEOUT);
2192 
2193 		if (error != 0) {
2194 			kprintf("%s: btfetchtransinfo - Inquire Sync "
2195 			       "Info Failed 0x%x\n", bt_name(bt), error);
2196 			return;
2197 		}
2198 		sync_period = sync_info.sync_rate[target] * 100;
2199 	} else {
2200 		sync_period = 2000 + (500 * sync_info.period);
2201 	}
2202 
2203 	cts->protocol = PROTO_SCSI;
2204 	cts->protocol_version = SCSI_REV_2;
2205 	cts->transport = XPORT_SPI;
2206 	cts->transport_version = 2;
2207 
2208 	spi->sync_period = sync_period;
2209 	spi->valid |= CTS_SPI_VALID_SYNC_RATE;
2210 	spi->sync_offset = sync_offset;
2211 	spi->valid |= CTS_SPI_VALID_SYNC_OFFSET;
2212 
2213 	spi->valid |= CTS_SPI_VALID_BUS_WIDTH;
2214 	spi->bus_width = bus_width;
2215 
2216 	if (cts->ccb_h.target_lun != CAM_LUN_WILDCARD) {
2217 		scsi->valid = CTS_SCSI_VALID_TQ;
2218 		spi->valid |= CTS_SPI_VALID_DISC;
2219 	} else
2220 		scsi->valid = 0;
2221 
2222         xpt_async(AC_TRANSFER_NEG, cts->ccb_h.path, cts);
2223 }
2224 
2225 static void
2226 btmapmboxes(void *arg, bus_dma_segment_t *segs, int nseg, int error)
2227 {
2228 	struct bt_softc* bt;
2229 
2230 	bt = (struct bt_softc*)arg;
2231 	bt->mailbox_physbase = segs->ds_addr;
2232 }
2233 
2234 static void
2235 btmapccbs(void *arg, bus_dma_segment_t *segs, int nseg, int error)
2236 {
2237 	struct bt_softc* bt;
2238 
2239 	bt = (struct bt_softc*)arg;
2240 	bt->bt_ccb_physbase = segs->ds_addr;
2241 }
2242 
2243 static void
2244 btmapsgs(void *arg, bus_dma_segment_t *segs, int nseg, int error)
2245 {
2246 
2247 	struct bt_softc* bt;
2248 
2249 	bt = (struct bt_softc*)arg;
2250 	SLIST_FIRST(&bt->sg_maps)->sg_physaddr = segs->ds_addr;
2251 }
2252 
2253 static void
2254 btpoll(struct cam_sim *sim)
2255 {
2256 	bt_intr(cam_sim_softc(sim));
2257 }
2258 
2259 void
2260 bttimeout(void *arg)
2261 {
2262 	struct bt_ccb	*bccb;
2263 	union  ccb	*ccb;
2264 	struct bt_softc *bt;
2265 
2266 	bccb = (struct bt_ccb *)arg;
2267 	ccb = bccb->ccb;
2268 	bt = (struct bt_softc *)ccb->ccb_h.ccb_bt_ptr;
2269 	xpt_print_path(ccb->ccb_h.path);
2270 	kprintf("CCB %p - timed out\n", (void *)bccb);
2271 
2272 	crit_enter();
2273 
2274 	if ((bccb->flags & BCCB_ACTIVE) == 0) {
2275 		xpt_print_path(ccb->ccb_h.path);
2276 		kprintf("CCB %p - timed out CCB already completed\n",
2277 		       (void *)bccb);
2278 		crit_exit();
2279 		return;
2280 	}
2281 
2282 	/*
2283 	 * In order to simplify the recovery process, we ask the XPT
2284 	 * layer to halt the queue of new transactions and we traverse
2285 	 * the list of pending CCBs and remove their timeouts. This
2286 	 * means that the driver attempts to clear only one error
2287 	 * condition at a time.  In general, timeouts that occur
2288 	 * close together are related anyway, so there is no benefit
2289 	 * in attempting to handle errors in parrallel.  Timeouts will
2290 	 * be reinstated when the recovery process ends.
2291 	 */
2292 	if ((bccb->flags & BCCB_DEVICE_RESET) == 0) {
2293 		struct ccb_hdr *ccb_h;
2294 
2295 		if ((bccb->flags & BCCB_RELEASE_SIMQ) == 0) {
2296 			xpt_freeze_simq(bt->sim, /*count*/1);
2297 			bccb->flags |= BCCB_RELEASE_SIMQ;
2298 		}
2299 
2300 		ccb_h = LIST_FIRST(&bt->pending_ccbs);
2301 		while (ccb_h != NULL) {
2302 			struct bt_ccb *pending_bccb;
2303 
2304 			pending_bccb = (struct bt_ccb *)ccb_h->ccb_bccb_ptr;
2305 			callout_stop(&ccb_h->timeout_ch);
2306 			ccb_h = LIST_NEXT(ccb_h, sim_links.le);
2307 		}
2308 	}
2309 
2310 	if ((bccb->flags & BCCB_DEVICE_RESET) != 0
2311 	 || bt->cur_outbox->action_code != BMBO_FREE
2312 	 || ((bccb->hccb.tag_enable == TRUE)
2313 	  && (bt->firmware_ver[0] < '5'))) {
2314 		/*
2315 		 * Try a full host adapter/SCSI bus reset.
2316 		 * We do this only if we have already attempted
2317 		 * to clear the condition with a BDR, or we cannot
2318 		 * attempt a BDR for lack of mailbox resources
2319 		 * or because of faulty firmware.  It turns out
2320 		 * that firmware versions prior to 5.xx treat BDRs
2321 		 * as untagged commands that cannot be sent until
2322 		 * all outstanding tagged commands have been processed.
2323 		 * This makes it somewhat difficult to use a BDR to
2324 		 * clear up a problem with an uncompleted tagged command.
2325 		 */
2326 		ccb->ccb_h.status = CAM_CMD_TIMEOUT;
2327 		btreset(bt, /*hardreset*/TRUE);
2328 		kprintf("%s: No longer in timeout\n", bt_name(bt));
2329 	} else {
2330 		/*
2331 		 * Send a Bus Device Reset message:
2332 		 * The target that is holding up the bus may not
2333 		 * be the same as the one that triggered this timeout
2334 		 * (different commands have different timeout lengths),
2335 		 * but we have no way of determining this from our
2336 		 * timeout handler.  Our strategy here is to queue a
2337 		 * BDR message to the target of the timed out command.
2338 		 * If this fails, we'll get another timeout 2 seconds
2339 		 * later which will attempt a bus reset.
2340 		 */
2341 		bccb->flags |= BCCB_DEVICE_RESET;
2342 		callout_reset(&ccb->ccb_h.timeout_ch, 2 * hz, bttimeout, bccb);
2343 
2344 		bt->recovery_bccb->hccb.opcode = INITIATOR_BUS_DEV_RESET;
2345 
2346 		/* No Data Transfer */
2347 		bt->recovery_bccb->hccb.datain = TRUE;
2348 		bt->recovery_bccb->hccb.dataout = TRUE;
2349 		bt->recovery_bccb->hccb.btstat = 0;
2350 		bt->recovery_bccb->hccb.sdstat = 0;
2351 		bt->recovery_bccb->hccb.target_id = ccb->ccb_h.target_id;
2352 
2353 		/* Tell the adapter about this command */
2354 		bt->cur_outbox->ccb_addr = btccbvtop(bt, bt->recovery_bccb);
2355 		bt->cur_outbox->action_code = BMBO_START;
2356 		bt_outb(bt, COMMAND_REG, BOP_START_MBOX);
2357 		btnextoutbox(bt);
2358 	}
2359 
2360 	crit_exit();
2361 }
2362 
2363