xref: /dragonfly/sys/dev/disk/buslogic/bt.c (revision 92fc8b5c)
1 /*
2  * Generic driver for the BusLogic MultiMaster SCSI host adapters
3  * Product specific probe and attach routines can be found in:
4  * sys/dev/buslogic/bt_isa.c	BT-54X, BT-445 cards
5  * sys/dev/buslogic/bt_pci.c	BT-946, BT-948, BT-956, BT-958 cards
6  *
7  * Copyright (c) 1998, 1999 Justin T. Gibbs.
8  * All rights reserved.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions, and the following disclaimer,
15  *    without modification, immediately at the beginning of the file.
16  * 2. The name of the author may not be used to endorse or promote products
17  *    derived from this software without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
23  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  *
31  * $FreeBSD: src/sys/dev/buslogic/bt.c,v 1.25.2.1 2000/08/02 22:32:26 peter Exp $
32  */
33 
34  /*
35   * Special thanks to Leonard N. Zubkoff for writing such a complete and
36   * well documented Mylex/BusLogic MultiMaster driver for Linux.  Support
37   * in this driver for the wide range of MultiMaster controllers and
38   * firmware revisions, with their otherwise undocumented quirks, would not
39   * have been possible without his efforts.
40   */
41 
42 #include <sys/param.h>
43 #include <sys/systm.h>
44 #include <sys/malloc.h>
45 #include <sys/buf.h>
46 #include <sys/kernel.h>
47 #include <sys/sysctl.h>
48 #include <sys/bus.h>
49 #include <sys/rman.h>
50 #include <sys/thread2.h>
51 
52 #include <machine/clock.h>
53 
54 #include <bus/cam/cam.h>
55 #include <bus/cam/cam_ccb.h>
56 #include <bus/cam/cam_sim.h>
57 #include <bus/cam/cam_xpt_sim.h>
58 #include <bus/cam/cam_debug.h>
59 #include <bus/cam/scsi/scsi_message.h>
60 
61 #include <vm/vm.h>
62 #include <vm/pmap.h>
63 
64 #include "btreg.h"
65 
66 /* MailBox Management functions */
67 static __inline void	btnextinbox(struct bt_softc *bt);
68 static __inline void	btnextoutbox(struct bt_softc *bt);
69 
70 static __inline void
71 btnextinbox(struct bt_softc *bt)
72 {
73 	if (bt->cur_inbox == bt->last_inbox)
74 		bt->cur_inbox = bt->in_boxes;
75 	else
76 		bt->cur_inbox++;
77 }
78 
79 static __inline void
80 btnextoutbox(struct bt_softc *bt)
81 {
82 	if (bt->cur_outbox == bt->last_outbox)
83 		bt->cur_outbox = bt->out_boxes;
84 	else
85 		bt->cur_outbox++;
86 }
87 
88 /* CCB Mangement functions */
89 static __inline u_int32_t		btccbvtop(struct bt_softc *bt,
90 						  struct bt_ccb *bccb);
91 static __inline struct bt_ccb*		btccbptov(struct bt_softc *bt,
92 						  u_int32_t ccb_addr);
93 static __inline u_int32_t		btsensepaddr(struct bt_softc *bt,
94 						     struct bt_ccb *bccb);
95 static __inline struct scsi_sense_data* btsensevaddr(struct bt_softc *bt,
96 						     struct bt_ccb *bccb);
97 
98 static __inline u_int32_t
99 btccbvtop(struct bt_softc *bt, struct bt_ccb *bccb)
100 {
101 	return (bt->bt_ccb_physbase
102 	      + (u_int32_t)((caddr_t)bccb - (caddr_t)bt->bt_ccb_array));
103 }
104 
105 static __inline struct bt_ccb *
106 btccbptov(struct bt_softc *bt, u_int32_t ccb_addr)
107 {
108 	return (bt->bt_ccb_array +
109 	        ((struct bt_ccb*)(uintptr_t)ccb_addr-(struct bt_ccb*)(uintptr_t)bt->bt_ccb_physbase));
110 }
111 
112 static __inline u_int32_t
113 btsensepaddr(struct bt_softc *bt, struct bt_ccb *bccb)
114 {
115 	u_int index;
116 
117 	index = (u_int)(bccb - bt->bt_ccb_array);
118 	return (bt->sense_buffers_physbase
119 		+ (index * sizeof(struct scsi_sense_data)));
120 }
121 
122 static __inline struct scsi_sense_data *
123 btsensevaddr(struct bt_softc *bt, struct bt_ccb *bccb)
124 {
125 	u_int index;
126 
127 	index = (u_int)(bccb - bt->bt_ccb_array);
128 	return (bt->sense_buffers + index);
129 }
130 
131 static __inline struct bt_ccb*	btgetccb(struct bt_softc *bt);
132 static __inline void		btfreeccb(struct bt_softc *bt,
133 					  struct bt_ccb *bccb);
134 static void		btallocccbs(struct bt_softc *bt);
135 static bus_dmamap_callback_t btexecuteccb;
136 static void		btdone(struct bt_softc *bt, struct bt_ccb *bccb,
137 			       bt_mbi_comp_code_t comp_code);
138 
139 /* Host adapter command functions */
140 static int	btreset(struct bt_softc* bt, int hard_reset);
141 
142 /* Initialization functions */
143 static int			btinitmboxes(struct bt_softc *bt);
144 static bus_dmamap_callback_t	btmapmboxes;
145 static bus_dmamap_callback_t	btmapccbs;
146 static bus_dmamap_callback_t	btmapsgs;
147 
148 /* Transfer Negotiation Functions */
149 static void btfetchtransinfo(struct bt_softc *bt,
150 			     struct ccb_trans_settings *cts);
151 
152 /* CAM SIM entry points */
153 #define ccb_bccb_ptr spriv_ptr0
154 #define ccb_bt_ptr spriv_ptr1
155 static void	btaction(struct cam_sim *sim, union ccb *ccb);
156 static void	btpoll(struct cam_sim *sim);
157 
158 /* Our timeout handler */
159 timeout_t bttimeout;
160 
161 u_long bt_unit = 0;
162 
163 /*
164  * XXX
165  * Do our own re-probe protection until a configuration
166  * manager can do it for us.  This ensures that we don't
167  * reprobe a card already found by the PCI probes.
168  */
169 struct bt_isa_port bt_isa_ports[] =
170 {
171 	{ 0x130, 0, 4 },
172 	{ 0x134, 0, 5 },
173 	{ 0x230, 0, 2 },
174 	{ 0x234, 0, 3 },
175 	{ 0x330, 0, 0 },
176 	{ 0x334, 0, 1 }
177 };
178 
179 /*
180  * I/O ports listed in the order enumerated by the
181  * card for certain op codes.
182  */
183 u_int16_t bt_board_ports[] =
184 {
185 	0x330,
186 	0x334,
187 	0x230,
188 	0x234,
189 	0x130,
190 	0x134
191 };
192 
193 /* Exported functions */
194 void
195 bt_init_softc(device_t dev, struct resource *port,
196 	      struct resource *irq, struct resource *drq)
197 {
198 	struct bt_softc *bt = device_get_softc(dev);
199 
200 	SLIST_INIT(&bt->free_bt_ccbs);
201 	LIST_INIT(&bt->pending_ccbs);
202 	SLIST_INIT(&bt->sg_maps);
203 	bt->dev = dev;
204 	bt->unit = device_get_unit(dev);
205 	bt->port = port;
206 	bt->irq = irq;
207 	bt->drq = drq;
208 	bt->tag = rman_get_bustag(port);
209 	bt->bsh = rman_get_bushandle(port);
210 }
211 
212 void
213 bt_free_softc(device_t dev)
214 {
215 	struct bt_softc *bt = device_get_softc(dev);
216 
217 	switch (bt->init_level) {
218 	default:
219 	case 11:
220 		bus_dmamap_unload(bt->sense_dmat, bt->sense_dmamap);
221 	case 10:
222 		bus_dmamem_free(bt->sense_dmat, bt->sense_buffers,
223 				bt->sense_dmamap);
224 	case 9:
225 		bus_dma_tag_destroy(bt->sense_dmat);
226 	case 8:
227 	{
228 		struct sg_map_node *sg_map;
229 
230 		while ((sg_map = SLIST_FIRST(&bt->sg_maps))!= NULL) {
231 			SLIST_REMOVE_HEAD(&bt->sg_maps, links);
232 			bus_dmamap_unload(bt->sg_dmat,
233 					  sg_map->sg_dmamap);
234 			bus_dmamem_free(bt->sg_dmat, sg_map->sg_vaddr,
235 					sg_map->sg_dmamap);
236 			kfree(sg_map, M_DEVBUF);
237 		}
238 		bus_dma_tag_destroy(bt->sg_dmat);
239 	}
240 	case 7:
241 		bus_dmamap_unload(bt->ccb_dmat, bt->ccb_dmamap);
242 	case 6:
243 		bus_dmamem_free(bt->ccb_dmat, bt->bt_ccb_array,
244 				bt->ccb_dmamap);
245 		bus_dmamap_destroy(bt->ccb_dmat, bt->ccb_dmamap);
246 	case 5:
247 		bus_dma_tag_destroy(bt->ccb_dmat);
248 	case 4:
249 		bus_dmamap_unload(bt->mailbox_dmat, bt->mailbox_dmamap);
250 	case 3:
251 		bus_dmamem_free(bt->mailbox_dmat, bt->in_boxes,
252 				bt->mailbox_dmamap);
253 		bus_dmamap_destroy(bt->mailbox_dmat, bt->mailbox_dmamap);
254 	case 2:
255 		bus_dma_tag_destroy(bt->buffer_dmat);
256 	case 1:
257 		bus_dma_tag_destroy(bt->mailbox_dmat);
258 	case 0:
259 		break;
260 	}
261 }
262 
263 int
264 bt_port_probe(device_t dev, struct bt_probe_info *info)
265 {
266 	struct bt_softc *bt = device_get_softc(dev);
267 	config_data_t config_data;
268 	int error;
269 
270 	/* See if there is really a card present */
271 	if (bt_probe(dev) || bt_fetch_adapter_info(dev))
272 		return(1);
273 
274 	/*
275 	 * Determine our IRQ, and DMA settings and
276 	 * export them to the configuration system.
277 	 */
278 	error = bt_cmd(bt, BOP_INQUIRE_CONFIG, NULL, /*parmlen*/0,
279 		       (u_int8_t*)&config_data, sizeof(config_data),
280 		       DEFAULT_CMD_TIMEOUT);
281 	if (error != 0) {
282 		kprintf("bt_port_probe: Could not determine IRQ or DMA "
283 		       "settings for adapter.\n");
284 		return (1);
285 	}
286 
287 	if (bt->model[0] == '5') {
288 		/* DMA settings only make sense for ISA cards */
289 		switch (config_data.dma_chan) {
290 		case DMA_CHAN_5:
291 			info->drq = 5;
292 			break;
293 		case DMA_CHAN_6:
294 			info->drq = 6;
295 			break;
296 		case DMA_CHAN_7:
297 			info->drq = 7;
298 			break;
299 		default:
300 			kprintf("bt_port_probe: Invalid DMA setting "
301 			       "detected for adapter.\n");
302 			return (1);
303 		}
304 	} else {
305 		/* VL/EISA/PCI DMA */
306 		info->drq = -1;
307 	}
308 	switch (config_data.irq) {
309 	case IRQ_9:
310 	case IRQ_10:
311 	case IRQ_11:
312 	case IRQ_12:
313 	case IRQ_14:
314 	case IRQ_15:
315 		info->irq = ffs(config_data.irq) + 8;
316 		break;
317 	default:
318 		kprintf("bt_port_probe: Invalid IRQ setting %x"
319 		       "detected for adapter.\n", config_data.irq);
320 		return (1);
321 	}
322 	return (0);
323 }
324 
325 /*
326  * Probe the adapter and verify that the card is a BusLogic.
327  */
328 int
329 bt_probe(device_t dev)
330 {
331 	struct bt_softc *bt = device_get_softc(dev);
332 	esetup_info_data_t esetup_info;
333 	u_int	 status;
334 	u_int	 intstat;
335 	u_int	 geometry;
336 	int	 error;
337 	u_int8_t param;
338 
339 	/*
340 	 * See if the three I/O ports look reasonable.
341 	 * Touch the minimal number of registers in the
342 	 * failure case.
343 	 */
344 	status = bt_inb(bt, STATUS_REG);
345 	if ((status == 0)
346 	 || (status & (DIAG_ACTIVE|CMD_REG_BUSY|
347 		       STATUS_REG_RSVD|CMD_INVALID)) != 0) {
348 		if (bootverbose)
349 			device_printf(dev, "Failed Status Reg Test - %x\n",
350 			       status);
351 		return (ENXIO);
352 	}
353 
354 	intstat = bt_inb(bt, INTSTAT_REG);
355 	if ((intstat & INTSTAT_REG_RSVD) != 0) {
356 		device_printf(dev, "Failed Intstat Reg Test\n");
357 		return (ENXIO);
358 	}
359 
360 	geometry = bt_inb(bt, GEOMETRY_REG);
361 	if (geometry == 0xFF) {
362 		if (bootverbose)
363 			device_printf(dev, "Failed Geometry Reg Test\n");
364 		return (ENXIO);
365 	}
366 
367 	/*
368 	 * Looking good so far.  Final test is to reset the
369 	 * adapter and attempt to fetch the extended setup
370 	 * information.  This should filter out all 1542 cards.
371 	 */
372 	if ((error = btreset(bt, /*hard_reset*/TRUE)) != 0) {
373 		if (bootverbose)
374 			device_printf(dev, "Failed Reset\n");
375 		return (ENXIO);
376 	}
377 
378 	param = sizeof(esetup_info);
379 	error = bt_cmd(bt, BOP_INQUIRE_ESETUP_INFO, &param, /*parmlen*/1,
380 		       (u_int8_t*)&esetup_info, sizeof(esetup_info),
381 		       DEFAULT_CMD_TIMEOUT);
382 	if (error != 0) {
383 		return (ENXIO);
384 	}
385 
386 	return (0);
387 }
388 
389 /*
390  * Pull the boards setup information and record it in our softc.
391  */
392 int
393 bt_fetch_adapter_info(device_t dev)
394 {
395 	struct bt_softc *bt = device_get_softc(dev);
396 	board_id_data_t	board_id;
397 	esetup_info_data_t esetup_info;
398 	config_data_t config_data;
399 	int	 error;
400 	u_int8_t length_param;
401 
402 	/* First record the firmware version */
403 	error = bt_cmd(bt, BOP_INQUIRE_BOARD_ID, NULL, /*parmlen*/0,
404 		       (u_int8_t*)&board_id, sizeof(board_id),
405 		       DEFAULT_CMD_TIMEOUT);
406 	if (error != 0) {
407 		device_printf(dev, "bt_fetch_adapter_info - Failed Get Board Info\n");
408 		return (error);
409 	}
410 	bt->firmware_ver[0] = board_id.firmware_rev_major;
411 	bt->firmware_ver[1] = '.';
412 	bt->firmware_ver[2] = board_id.firmware_rev_minor;
413 	bt->firmware_ver[3] = '\0';
414 
415 	/*
416 	 * Depending on the firmware major and minor version,
417 	 * we may be able to fetch additional minor version info.
418 	 */
419 	if (bt->firmware_ver[0] > '0') {
420 
421 		error = bt_cmd(bt, BOP_INQUIRE_FW_VER_3DIG, NULL, /*parmlen*/0,
422 			       (u_int8_t*)&bt->firmware_ver[3], 1,
423 			       DEFAULT_CMD_TIMEOUT);
424 		if (error != 0) {
425 			device_printf(dev,
426 				      "bt_fetch_adapter_info - Failed Get "
427 				      "Firmware 3rd Digit\n");
428 			return (error);
429 		}
430 		if (bt->firmware_ver[3] == ' ')
431 			bt->firmware_ver[3] = '\0';
432 		bt->firmware_ver[4] = '\0';
433 	}
434 
435 	if (strcmp(bt->firmware_ver, "3.3") >= 0) {
436 
437 		error = bt_cmd(bt, BOP_INQUIRE_FW_VER_4DIG, NULL, /*parmlen*/0,
438 			       (u_int8_t*)&bt->firmware_ver[4], 1,
439 			       DEFAULT_CMD_TIMEOUT);
440 		if (error != 0) {
441 			device_printf(dev,
442 				      "bt_fetch_adapter_info - Failed Get "
443 				      "Firmware 4th Digit\n");
444 			return (error);
445 		}
446 		if (bt->firmware_ver[4] == ' ')
447 			bt->firmware_ver[4] = '\0';
448 		bt->firmware_ver[5] = '\0';
449 	}
450 
451 	/*
452 	 * Some boards do not handle the "recently documented"
453 	 * Inquire Board Model Number command correctly or do not give
454 	 * exact information.  Use the Firmware and Extended Setup
455 	 * information in these cases to come up with the right answer.
456 	 * The major firmware revision number indicates:
457 	 *
458 	 * 	5.xx	BusLogic "W" Series Host Adapters:
459 	 *		BT-948/958/958D
460 	 *	4.xx	BusLogic "C" Series Host Adapters:
461 	 *		BT-946C/956C/956CD/747C/757C/757CD/445C/545C/540CF
462 	 *	3.xx	BusLogic "S" Series Host Adapters:
463 	 *		BT-747S/747D/757S/757D/445S/545S/542D
464 	 *		BT-542B/742A (revision H)
465 	 *	2.xx	BusLogic "A" Series Host Adapters:
466 	 *		BT-542B/742A (revision G and below)
467 	 */
468 	length_param = sizeof(esetup_info);
469 	error = bt_cmd(bt, BOP_INQUIRE_ESETUP_INFO, &length_param, /*parmlen*/1,
470 		       (u_int8_t*)&esetup_info, sizeof(esetup_info),
471 		       DEFAULT_CMD_TIMEOUT);
472 	if (error != 0) {
473 		return (error);
474 	}
475 
476   	bt->bios_addr = esetup_info.bios_addr << 12;
477 
478 	if (esetup_info.bus_type == 'A'
479 	 && bt->firmware_ver[0] == '2') {
480 		ksnprintf(bt->model, sizeof(bt->model), "542B");
481 	} else if (esetup_info.bus_type == 'E'
482 		&& (strncmp(bt->firmware_ver, "2.1", 3) == 0
483 		 || strncmp(bt->firmware_ver, "2.20", 4) == 0)) {
484 		ksnprintf(bt->model, sizeof(bt->model), "742A");
485 	} else {
486 		ha_model_data_t model_data;
487 		int i;
488 
489 		length_param = sizeof(model_data);
490 		error = bt_cmd(bt, BOP_INQUIRE_MODEL, &length_param, 1,
491 			       (u_int8_t*)&model_data, sizeof(model_data),
492 			       DEFAULT_CMD_TIMEOUT);
493 		if (error != 0) {
494 			device_printf(dev,
495 				      "bt_fetch_adapter_info - Failed Inquire "
496 				      "Model Number\n");
497 			return (error);
498 		}
499 		for (i = 0; i < sizeof(model_data.ascii_model); i++) {
500 			bt->model[i] = model_data.ascii_model[i];
501 			if (bt->model[i] == ' ')
502 				break;
503 		}
504 		bt->model[i] = '\0';
505 	}
506 
507 	bt->level_trigger_ints = esetup_info.level_trigger_ints ? 1 : 0;
508 
509 	/* SG element limits */
510 	bt->max_sg = esetup_info.max_sg;
511 
512 	/* Set feature flags */
513 	bt->wide_bus = esetup_info.wide_bus;
514 	bt->diff_bus = esetup_info.diff_bus;
515 	bt->ultra_scsi = esetup_info.ultra_scsi;
516 
517 	if ((bt->firmware_ver[0] == '5')
518 	 || (bt->firmware_ver[0] == '4' && bt->wide_bus))
519 		bt->extended_lun = TRUE;
520 
521 	bt->strict_rr = (strcmp(bt->firmware_ver, "3.31") >= 0);
522 
523 	bt->extended_trans =
524 	    ((bt_inb(bt, GEOMETRY_REG) & EXTENDED_TRANSLATION) != 0);
525 
526 	/*
527 	 * Determine max CCB count and whether tagged queuing is
528 	 * available based on controller type. Tagged queuing
529 	 * only works on 'W' series adapters, 'C' series adapters
530 	 * with firmware of rev 4.42 and higher, and 'S' series
531 	 * adapters with firmware of rev 3.35 and higher.  The
532 	 * maximum CCB counts are as follows:
533 	 *
534 	 *	192	BT-948/958/958D
535 	 *	100	BT-946C/956C/956CD/747C/757C/757CD/445C
536 	 * 	50	BT-545C/540CF
537 	 * 	30	BT-747S/747D/757S/757D/445S/545S/542D/542B/742A
538 	 */
539 	if (bt->firmware_ver[0] == '5') {
540 		bt->max_ccbs = 192;
541 		bt->tag_capable = TRUE;
542 	} else if (bt->firmware_ver[0] == '4') {
543 		if (bt->model[0] == '5')
544 			bt->max_ccbs = 50;
545 		else
546 			bt->max_ccbs = 100;
547 		bt->tag_capable = (strcmp(bt->firmware_ver, "4.22") >= 0);
548 	} else {
549 		bt->max_ccbs = 30;
550 		if (bt->firmware_ver[0] == '3'
551 		 && (strcmp(bt->firmware_ver, "3.35") >= 0))
552 			bt->tag_capable = TRUE;
553 		else
554 			bt->tag_capable = FALSE;
555 	}
556 
557 	if (bt->tag_capable != FALSE)
558 		bt->tags_permitted = ALL_TARGETS;
559 
560 	/* Determine Sync/Wide/Disc settings */
561 	if (bt->firmware_ver[0] >= '4') {
562 		auto_scsi_data_t auto_scsi_data;
563 		fetch_lram_params_t fetch_lram_params;
564 		int error;
565 
566 		/*
567 		 * These settings are stored in the
568 		 * AutoSCSI data in LRAM of 'W' and 'C'
569 		 * adapters.
570 		 */
571 		fetch_lram_params.offset = AUTO_SCSI_BYTE_OFFSET;
572 		fetch_lram_params.response_len = sizeof(auto_scsi_data);
573 		error = bt_cmd(bt, BOP_FETCH_LRAM,
574 			       (u_int8_t*)&fetch_lram_params,
575 			       sizeof(fetch_lram_params),
576 			       (u_int8_t*)&auto_scsi_data,
577 			       sizeof(auto_scsi_data), DEFAULT_CMD_TIMEOUT);
578 
579 		if (error != 0) {
580 			device_printf(dev,
581 				      "bt_fetch_adapter_info - Failed "
582 				      "Get Auto SCSI Info\n");
583 			return (error);
584 		}
585 
586 		bt->disc_permitted = auto_scsi_data.low_disc_permitted
587 				   | (auto_scsi_data.high_disc_permitted << 8);
588 		bt->sync_permitted = auto_scsi_data.low_sync_permitted
589 				   | (auto_scsi_data.high_sync_permitted << 8);
590 		bt->fast_permitted = auto_scsi_data.low_fast_permitted
591 				   | (auto_scsi_data.high_fast_permitted << 8);
592 		bt->ultra_permitted = auto_scsi_data.low_ultra_permitted
593 				   | (auto_scsi_data.high_ultra_permitted << 8);
594 		bt->wide_permitted = auto_scsi_data.low_wide_permitted
595 				   | (auto_scsi_data.high_wide_permitted << 8);
596 
597 		if (bt->ultra_scsi == FALSE)
598 			bt->ultra_permitted = 0;
599 
600 		if (bt->wide_bus == FALSE)
601 			bt->wide_permitted = 0;
602 	} else {
603 		/*
604 		 * 'S' and 'A' series have this information in the setup
605 		 * information structure.
606 		 */
607 		setup_data_t	setup_info;
608 
609 		length_param = sizeof(setup_info);
610 		error = bt_cmd(bt, BOP_INQUIRE_SETUP_INFO, &length_param,
611 			       /*paramlen*/1, (u_int8_t*)&setup_info,
612 			       sizeof(setup_info), DEFAULT_CMD_TIMEOUT);
613 
614 		if (error != 0) {
615 			device_printf(dev,
616 				      "bt_fetch_adapter_info - Failed "
617 				      "Get Setup Info\n");
618 			return (error);
619 		}
620 
621 		if (setup_info.initiate_sync != 0) {
622 			bt->sync_permitted = ALL_TARGETS;
623 
624 			if (bt->model[0] == '7') {
625 				if (esetup_info.sync_neg10MB != 0)
626 					bt->fast_permitted = ALL_TARGETS;
627 				if (strcmp(bt->model, "757") == 0)
628 					bt->wide_permitted = ALL_TARGETS;
629 			}
630 		}
631 		bt->disc_permitted = ALL_TARGETS;
632 	}
633 
634 	/* We need as many mailboxes as we can have ccbs */
635 	bt->num_boxes = bt->max_ccbs;
636 
637 	/* Determine our SCSI ID */
638 
639 	error = bt_cmd(bt, BOP_INQUIRE_CONFIG, NULL, /*parmlen*/0,
640 		       (u_int8_t*)&config_data, sizeof(config_data),
641 		       DEFAULT_CMD_TIMEOUT);
642 	if (error != 0) {
643 		device_printf(dev,
644 			      "bt_fetch_adapter_info - Failed Get Config\n");
645 		return (error);
646 	}
647 	bt->scsi_id = config_data.scsi_id;
648 
649 	return (0);
650 }
651 
652 /*
653  * Start the board, ready for normal operation
654  */
655 int
656 bt_init(device_t dev)
657 {
658 	struct bt_softc *bt = device_get_softc(dev);
659 
660 	/* Announce the Adapter */
661 	device_printf(dev, "BT-%s FW Rev. %s ", bt->model, bt->firmware_ver);
662 
663 	if (bt->ultra_scsi != 0)
664 		kprintf("Ultra ");
665 
666 	if (bt->wide_bus != 0)
667 		kprintf("Wide ");
668 	else
669 		kprintf("Narrow ");
670 
671 	if (bt->diff_bus != 0)
672 		kprintf("Diff ");
673 
674 	kprintf("SCSI Host Adapter, SCSI ID %d, %d CCBs\n", bt->scsi_id,
675 	       bt->max_ccbs);
676 
677 	/*
678 	 * Create our DMA tags.  These tags define the kinds of device
679 	 * accessible memory allocations and memory mappings we will
680 	 * need to perform during normal operation.
681 	 *
682 	 * Unless we need to further restrict the allocation, we rely
683 	 * on the restrictions of the parent dmat, hence the common
684 	 * use of MAXADDR and MAXSIZE.
685 	 */
686 
687 	/* DMA tag for mapping buffers into device visible space. */
688 	if (bus_dma_tag_create(bt->parent_dmat, /*alignment*/1, /*boundary*/0,
689 			       /*lowaddr*/BUS_SPACE_MAXADDR,
690 			       /*highaddr*/BUS_SPACE_MAXADDR,
691 			       /*filter*/NULL, /*filterarg*/NULL,
692 			       /*maxsize*/MAXBSIZE, /*nsegments*/BT_NSEG,
693 			       /*maxsegsz*/BUS_SPACE_MAXSIZE_32BIT,
694 			       /*flags*/BUS_DMA_ALLOCNOW,
695 			       &bt->buffer_dmat) != 0) {
696 		goto error_exit;
697 	}
698 
699 	bt->init_level++;
700 	/* DMA tag for our mailboxes */
701 	if (bus_dma_tag_create(bt->parent_dmat, /*alignment*/1, /*boundary*/0,
702 			       /*lowaddr*/BUS_SPACE_MAXADDR,
703 			       /*highaddr*/BUS_SPACE_MAXADDR,
704 			       /*filter*/NULL, /*filterarg*/NULL,
705 			       bt->num_boxes * (sizeof(bt_mbox_in_t)
706 					      + sizeof(bt_mbox_out_t)),
707 			       /*nsegments*/1,
708 			       /*maxsegsz*/BUS_SPACE_MAXSIZE_32BIT,
709 			       /*flags*/0, &bt->mailbox_dmat) != 0) {
710 		goto error_exit;
711         }
712 
713 	bt->init_level++;
714 
715 	/* Allocation for our mailboxes */
716 	if (bus_dmamem_alloc(bt->mailbox_dmat, (void *)&bt->out_boxes,
717 			     BUS_DMA_NOWAIT, &bt->mailbox_dmamap) != 0) {
718 		goto error_exit;
719 	}
720 
721 	bt->init_level++;
722 
723 	/* And permanently map them */
724 	bus_dmamap_load(bt->mailbox_dmat, bt->mailbox_dmamap,
725        			bt->out_boxes,
726 			bt->num_boxes * (sizeof(bt_mbox_in_t)
727 				       + sizeof(bt_mbox_out_t)),
728 			btmapmboxes, bt, /*flags*/0);
729 
730 	bt->init_level++;
731 
732 	bt->in_boxes = (bt_mbox_in_t *)&bt->out_boxes[bt->num_boxes];
733 
734 	btinitmboxes(bt);
735 
736 	/* DMA tag for our ccb structures */
737 	if (bus_dma_tag_create(bt->parent_dmat, /*alignment*/1, /*boundary*/0,
738 			       /*lowaddr*/BUS_SPACE_MAXADDR,
739 			       /*highaddr*/BUS_SPACE_MAXADDR,
740 			       /*filter*/NULL, /*filterarg*/NULL,
741 			       bt->max_ccbs * sizeof(struct bt_ccb),
742 			       /*nsegments*/1,
743 			       /*maxsegsz*/BUS_SPACE_MAXSIZE_32BIT,
744 			       /*flags*/0, &bt->ccb_dmat) != 0) {
745 		goto error_exit;
746         }
747 
748 	bt->init_level++;
749 
750 	/* Allocation for our ccbs */
751 	if (bus_dmamem_alloc(bt->ccb_dmat, (void *)&bt->bt_ccb_array,
752 			     BUS_DMA_NOWAIT, &bt->ccb_dmamap) != 0) {
753 		goto error_exit;
754 	}
755 
756 	bt->init_level++;
757 
758 	/* And permanently map them */
759 	bus_dmamap_load(bt->ccb_dmat, bt->ccb_dmamap,
760        			bt->bt_ccb_array,
761 			bt->max_ccbs * sizeof(struct bt_ccb),
762 			btmapccbs, bt, /*flags*/0);
763 
764 	bt->init_level++;
765 
766 	/* DMA tag for our S/G structures.  We allocate in page sized chunks */
767 	if (bus_dma_tag_create(bt->parent_dmat, /*alignment*/1, /*boundary*/0,
768 			       /*lowaddr*/BUS_SPACE_MAXADDR,
769 			       /*highaddr*/BUS_SPACE_MAXADDR,
770 			       /*filter*/NULL, /*filterarg*/NULL,
771 			       PAGE_SIZE, /*nsegments*/1,
772 			       /*maxsegsz*/BUS_SPACE_MAXSIZE_32BIT,
773 			       /*flags*/0, &bt->sg_dmat) != 0) {
774 		goto error_exit;
775         }
776 
777 	bt->init_level++;
778 
779 	/* Perform initial CCB allocation */
780 	bzero(bt->bt_ccb_array, bt->max_ccbs * sizeof(struct bt_ccb));
781 	btallocccbs(bt);
782 
783 	if (bt->num_ccbs == 0) {
784 		device_printf(dev,
785 			      "bt_init - Unable to allocate initial ccbs\n");
786 		goto error_exit;
787 	}
788 
789 	/*
790 	 * Note that we are going and return (to probe)
791 	 */
792 	return 0;
793 
794 error_exit:
795 
796 	return (ENXIO);
797 }
798 
799 int
800 bt_attach(device_t dev)
801 {
802 	struct bt_softc *bt = device_get_softc(dev);
803 	int tagged_dev_openings;
804 	struct cam_devq *devq;
805 	int error;
806 
807 	/*
808 	 * We reserve 1 ccb for error recovery, so don't
809 	 * tell the XPT about it.
810 	 */
811 	if (bt->tag_capable != 0)
812 		tagged_dev_openings = bt->max_ccbs - 1;
813 	else
814 		tagged_dev_openings = 0;
815 
816 	/*
817 	 * Create the device queue for our SIM.
818 	 */
819 	devq = cam_simq_alloc(bt->max_ccbs - 1);
820 	if (devq == NULL)
821 		return (ENOMEM);
822 
823 	/*
824 	 * Construct our SIM entry
825 	 */
826 	bt->sim = cam_sim_alloc(btaction, btpoll, "bt", bt, bt->unit,
827 				&sim_mplock, 2, tagged_dev_openings, devq);
828 	cam_simq_release(devq);
829 	if (bt->sim == NULL)
830 		return (ENOMEM);
831 
832 	if (xpt_bus_register(bt->sim, 0) != CAM_SUCCESS) {
833 		cam_sim_free(bt->sim);
834 		return (ENXIO);
835 	}
836 
837 	if (xpt_create_path(&bt->path, /*periph*/NULL,
838 			    cam_sim_path(bt->sim), CAM_TARGET_WILDCARD,
839 			    CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
840 		xpt_bus_deregister(cam_sim_path(bt->sim));
841 		cam_sim_free(bt->sim);
842 		return (ENXIO);
843 	}
844 
845 	/*
846 	 * Setup interrupt.
847 	 */
848 	error = bus_setup_intr(dev, bt->irq, 0,
849 			       bt_intr, bt, &bt->ih, NULL);
850 	if (error) {
851 		device_printf(dev, "bus_setup_intr() failed: %d\n", error);
852 		return (error);
853 	}
854 
855 	return (0);
856 }
857 
858 int
859 bt_check_probed_iop(u_int ioport)
860 {
861 	u_int i;
862 
863 	for (i = 0; i < BT_NUM_ISAPORTS; i++) {
864 		if (bt_isa_ports[i].addr == ioport) {
865 			if (bt_isa_ports[i].probed != 0)
866 				return (1);
867 			else {
868 				return (0);
869 			}
870 		}
871 	}
872 	return (1);
873 }
874 
875 void
876 bt_mark_probed_bio(isa_compat_io_t port)
877 {
878 	if (port < BIO_DISABLED)
879 		bt_mark_probed_iop(bt_board_ports[port]);
880 }
881 
882 void
883 bt_mark_probed_iop(u_int ioport)
884 {
885 	u_int i;
886 
887 	for (i = 0; i < BT_NUM_ISAPORTS; i++) {
888 		if (ioport == bt_isa_ports[i].addr) {
889 			bt_isa_ports[i].probed = 1;
890 			break;
891 		}
892 	}
893 }
894 
895 void
896 bt_find_probe_range(int ioport, int *port_index, int *max_port_index)
897 {
898 	if (ioport > 0) {
899 		int i;
900 
901 		for (i = 0;i < BT_NUM_ISAPORTS; i++)
902 			if (ioport <= bt_isa_ports[i].addr)
903 				break;
904 		if ((i >= BT_NUM_ISAPORTS)
905 		 || (ioport != bt_isa_ports[i].addr)) {
906 			kprintf("\nbt_isa_probe: Invalid baseport of 0x%x specified.\n"
907 			       "bt_isa_probe: Nearest valid baseport is 0x%x.\n"
908 			       "bt_isa_probe: Failing probe.\n",
909 			       ioport,
910 			       (i < BT_NUM_ISAPORTS)
911 				    ? bt_isa_ports[i].addr
912 				    : bt_isa_ports[BT_NUM_ISAPORTS - 1].addr);
913 			*port_index = *max_port_index = -1;
914 			return;
915 		}
916 		*port_index = *max_port_index = bt_isa_ports[i].bio;
917 	} else {
918 		*port_index = 0;
919 		*max_port_index = BT_NUM_ISAPORTS - 1;
920 	}
921 }
922 
923 int
924 bt_iop_from_bio(isa_compat_io_t bio_index)
925 {
926 	if (bio_index >= 0 && bio_index < BT_NUM_ISAPORTS)
927 		return (bt_board_ports[bio_index]);
928 	return (-1);
929 }
930 
931 
932 static void
933 btallocccbs(struct bt_softc *bt)
934 {
935 	struct bt_ccb *next_ccb;
936 	struct sg_map_node *sg_map;
937 	bus_addr_t physaddr;
938 	bt_sg_t *segs;
939 	int newcount;
940 	int i;
941 
942 	if (bt->num_ccbs >= bt->max_ccbs)
943 		/* Can't allocate any more */
944 		return;
945 
946 	next_ccb = &bt->bt_ccb_array[bt->num_ccbs];
947 
948 	sg_map = kmalloc(sizeof(*sg_map), M_DEVBUF, M_WAITOK);
949 
950 	/* Allocate S/G space for the next batch of CCBS */
951 	if (bus_dmamem_alloc(bt->sg_dmat, (void *)&sg_map->sg_vaddr,
952 			     BUS_DMA_NOWAIT, &sg_map->sg_dmamap) != 0) {
953 		kfree(sg_map, M_DEVBUF);
954 		goto error_exit;
955 	}
956 
957 	SLIST_INSERT_HEAD(&bt->sg_maps, sg_map, links);
958 
959 	bus_dmamap_load(bt->sg_dmat, sg_map->sg_dmamap, sg_map->sg_vaddr,
960 			PAGE_SIZE, btmapsgs, bt, /*flags*/0);
961 
962 	segs = sg_map->sg_vaddr;
963 	physaddr = sg_map->sg_physaddr;
964 
965 	newcount = (PAGE_SIZE / (BT_NSEG * sizeof(bt_sg_t)));
966 	for (i = 0; bt->num_ccbs < bt->max_ccbs && i < newcount; i++) {
967 		int error;
968 
969 		next_ccb->sg_list = segs;
970 		next_ccb->sg_list_phys = physaddr;
971 		next_ccb->flags = BCCB_FREE;
972 		error = bus_dmamap_create(bt->buffer_dmat, /*flags*/0,
973 					  &next_ccb->dmamap);
974 		if (error != 0)
975 			break;
976 		SLIST_INSERT_HEAD(&bt->free_bt_ccbs, next_ccb, links);
977 		segs += BT_NSEG;
978 		physaddr += (BT_NSEG * sizeof(bt_sg_t));
979 		next_ccb++;
980 		bt->num_ccbs++;
981 	}
982 
983 	/* Reserve a CCB for error recovery */
984 	if (bt->recovery_bccb == NULL) {
985 		bt->recovery_bccb = SLIST_FIRST(&bt->free_bt_ccbs);
986 		SLIST_REMOVE_HEAD(&bt->free_bt_ccbs, links);
987 	}
988 
989 	if (SLIST_FIRST(&bt->free_bt_ccbs) != NULL)
990 		return;
991 
992 error_exit:
993 	device_printf(bt->dev, "Can't malloc BCCBs\n");
994 }
995 
996 static __inline void
997 btfreeccb(struct bt_softc *bt, struct bt_ccb *bccb)
998 {
999 	crit_enter();
1000 	if ((bccb->flags & BCCB_ACTIVE) != 0)
1001 		LIST_REMOVE(&bccb->ccb->ccb_h, sim_links.le);
1002 	if (bt->resource_shortage != 0
1003 	 && (bccb->ccb->ccb_h.status & CAM_RELEASE_SIMQ) == 0) {
1004 		bccb->ccb->ccb_h.status |= CAM_RELEASE_SIMQ;
1005 		bt->resource_shortage = FALSE;
1006 	}
1007 	bccb->flags = BCCB_FREE;
1008 	SLIST_INSERT_HEAD(&bt->free_bt_ccbs, bccb, links);
1009 	bt->active_ccbs--;
1010 	crit_exit();
1011 }
1012 
1013 static __inline struct bt_ccb*
1014 btgetccb(struct bt_softc *bt)
1015 {
1016 	struct	bt_ccb* bccb;
1017 
1018 	crit_enter();
1019 	if ((bccb = SLIST_FIRST(&bt->free_bt_ccbs)) != NULL) {
1020 		SLIST_REMOVE_HEAD(&bt->free_bt_ccbs, links);
1021 		bt->active_ccbs++;
1022 	} else {
1023 		btallocccbs(bt);
1024 		bccb = SLIST_FIRST(&bt->free_bt_ccbs);
1025 		if (bccb != NULL) {
1026 			SLIST_REMOVE_HEAD(&bt->free_bt_ccbs, links);
1027 			bt->active_ccbs++;
1028 		}
1029 	}
1030 	crit_exit();
1031 
1032 	return (bccb);
1033 }
1034 
1035 static void
1036 btaction(struct cam_sim *sim, union ccb *ccb)
1037 {
1038 	struct	bt_softc *bt;
1039 
1040 	CAM_DEBUG(ccb->ccb_h.path, CAM_DEBUG_TRACE, ("btaction\n"));
1041 
1042 	bt = (struct bt_softc *)cam_sim_softc(sim);
1043 
1044 	switch (ccb->ccb_h.func_code) {
1045 	/* Common cases first */
1046 	case XPT_SCSI_IO:	/* Execute the requested I/O operation */
1047 	case XPT_RESET_DEV:	/* Bus Device Reset the specified SCSI device */
1048 	{
1049 		struct	bt_ccb	*bccb;
1050 		struct	bt_hccb *hccb;
1051 
1052 		/*
1053 		 * get a bccb to use.
1054 		 */
1055 		if ((bccb = btgetccb(bt)) == NULL) {
1056 			crit_enter();
1057 			bt->resource_shortage = TRUE;
1058 			crit_exit();
1059 			xpt_freeze_simq(bt->sim, /*count*/1);
1060 			ccb->ccb_h.status = CAM_REQUEUE_REQ;
1061 			xpt_done(ccb);
1062 			return;
1063 		}
1064 
1065 		hccb = &bccb->hccb;
1066 
1067 		/*
1068 		 * So we can find the BCCB when an abort is requested
1069 		 */
1070 		bccb->ccb = ccb;
1071 		ccb->ccb_h.ccb_bccb_ptr = bccb;
1072 		ccb->ccb_h.ccb_bt_ptr = bt;
1073 
1074 		/*
1075 		 * Put all the arguments for the xfer in the bccb
1076 		 */
1077 		hccb->target_id = ccb->ccb_h.target_id;
1078 		hccb->target_lun = ccb->ccb_h.target_lun;
1079 		hccb->btstat = 0;
1080 		hccb->sdstat = 0;
1081 
1082 		if (ccb->ccb_h.func_code == XPT_SCSI_IO) {
1083 			struct ccb_scsiio *csio;
1084 			struct ccb_hdr *ccbh;
1085 
1086 			csio = &ccb->csio;
1087 			ccbh = &csio->ccb_h;
1088 			hccb->opcode = INITIATOR_CCB_WRESID;
1089 			hccb->datain = (ccb->ccb_h.flags & CAM_DIR_IN) ? 1 : 0;
1090 			hccb->dataout =(ccb->ccb_h.flags & CAM_DIR_OUT) ? 1 : 0;
1091 			hccb->cmd_len = csio->cdb_len;
1092 			if (hccb->cmd_len > sizeof(hccb->scsi_cdb)) {
1093 				ccb->ccb_h.status = CAM_REQ_INVALID;
1094 				btfreeccb(bt, bccb);
1095 				xpt_done(ccb);
1096 				return;
1097 			}
1098 			hccb->sense_len = csio->sense_len;
1099 			if ((ccbh->flags & CAM_TAG_ACTION_VALID) != 0
1100 			 && ccb->csio.tag_action != CAM_TAG_ACTION_NONE) {
1101 				hccb->tag_enable = TRUE;
1102 				hccb->tag_type = (ccb->csio.tag_action & 0x3);
1103 			} else {
1104 				hccb->tag_enable = FALSE;
1105 				hccb->tag_type = 0;
1106 			}
1107 			if ((ccbh->flags & CAM_CDB_POINTER) != 0) {
1108 				if ((ccbh->flags & CAM_CDB_PHYS) == 0) {
1109 					bcopy(csio->cdb_io.cdb_ptr,
1110 					      hccb->scsi_cdb, hccb->cmd_len);
1111 				} else {
1112 					/* I guess I could map it in... */
1113 					ccbh->status = CAM_REQ_INVALID;
1114 					btfreeccb(bt, bccb);
1115 					xpt_done(ccb);
1116 					return;
1117 				}
1118 			} else {
1119 				bcopy(csio->cdb_io.cdb_bytes,
1120 				      hccb->scsi_cdb, hccb->cmd_len);
1121 			}
1122 			/* If need be, bounce our sense buffer */
1123 			if (bt->sense_buffers != NULL) {
1124 				hccb->sense_addr = btsensepaddr(bt, bccb);
1125 			} else {
1126 				hccb->sense_addr = vtophys(&csio->sense_data);
1127 			}
1128 			/*
1129 			 * If we have any data to send with this command,
1130 			 * map it into bus space.
1131 			 */
1132 		        /* Only use S/G if there is a transfer */
1133 			if ((ccbh->flags & CAM_DIR_MASK) != CAM_DIR_NONE) {
1134 				if ((ccbh->flags & CAM_SCATTER_VALID) == 0) {
1135 					/*
1136 					 * We've been given a pointer
1137 					 * to a single buffer.
1138 					 */
1139 					if ((ccbh->flags & CAM_DATA_PHYS)==0) {
1140 						int error;
1141 
1142 						crit_enter();
1143 						error = bus_dmamap_load(
1144 						    bt->buffer_dmat,
1145 						    bccb->dmamap,
1146 						    csio->data_ptr,
1147 						    csio->dxfer_len,
1148 						    btexecuteccb,
1149 						    bccb,
1150 						    /*flags*/0);
1151 						if (error == EINPROGRESS) {
1152 							/*
1153 							 * So as to maintain
1154 							 * ordering, freeze the
1155 							 * controller queue
1156 							 * until our mapping is
1157 							 * returned.
1158 							 */
1159 							xpt_freeze_simq(bt->sim,
1160 									1);
1161 							csio->ccb_h.status |=
1162 							    CAM_RELEASE_SIMQ;
1163 						}
1164 						crit_exit();
1165 					} else {
1166 						struct bus_dma_segment seg;
1167 
1168 						/* Pointer to physical buffer */
1169 						seg.ds_addr =
1170 						    (bus_addr_t)csio->data_ptr;
1171 						seg.ds_len = csio->dxfer_len;
1172 						btexecuteccb(bccb, &seg, 1, 0);
1173 					}
1174 				} else {
1175 					struct bus_dma_segment *segs;
1176 
1177 					if ((ccbh->flags & CAM_DATA_PHYS) != 0)
1178 						panic("btaction - Physical "
1179 						      "segment pointers "
1180 						      "unsupported");
1181 
1182 					if ((ccbh->flags&CAM_SG_LIST_PHYS)==0)
1183 						panic("btaction - Virtual "
1184 						      "segment addresses "
1185 						      "unsupported");
1186 
1187 					/* Just use the segments provided */
1188 					segs = (struct bus_dma_segment *)
1189 					    csio->data_ptr;
1190 					btexecuteccb(bccb, segs,
1191 						     csio->sglist_cnt, 0);
1192 				}
1193 			} else {
1194 				btexecuteccb(bccb, NULL, 0, 0);
1195 			}
1196 		} else {
1197 			hccb->opcode = INITIATOR_BUS_DEV_RESET;
1198 			/* No data transfer */
1199 			hccb->datain = TRUE;
1200 			hccb->dataout = TRUE;
1201 			hccb->cmd_len = 0;
1202 			hccb->sense_len = 0;
1203 			hccb->tag_enable = FALSE;
1204 			hccb->tag_type = 0;
1205 			btexecuteccb(bccb, NULL, 0, 0);
1206 		}
1207 		break;
1208 	}
1209 	case XPT_EN_LUN:		/* Enable LUN as a target */
1210 	case XPT_TARGET_IO:		/* Execute target I/O request */
1211 	case XPT_ACCEPT_TARGET_IO:	/* Accept Host Target Mode CDB */
1212 	case XPT_CONT_TARGET_IO:	/* Continue Host Target I/O Connection*/
1213 	case XPT_ABORT:			/* Abort the specified CCB */
1214 		/* XXX Implement */
1215 		ccb->ccb_h.status = CAM_REQ_INVALID;
1216 		xpt_done(ccb);
1217 		break;
1218 	case XPT_SET_TRAN_SETTINGS:
1219 	{
1220 		/* XXX Implement */
1221 		ccb->ccb_h.status = CAM_PROVIDE_FAIL;
1222 		xpt_done(ccb);
1223 		break;
1224 	}
1225 	case XPT_GET_TRAN_SETTINGS:
1226 	/* Get default/user set transfer settings for the target */
1227 	{
1228 		struct	ccb_trans_settings *cts;
1229 		u_int	target_mask;
1230 
1231 		cts = &ccb->cts;
1232 		target_mask = 0x01 << ccb->ccb_h.target_id;
1233 		if (cts->type == CTS_TYPE_CURRENT_SETTINGS) {
1234 			struct ccb_trans_settings_scsi *scsi =
1235 			    &cts->proto_specific.scsi;
1236 			struct ccb_trans_settings_spi *spi =
1237 			    &cts->xport_specific.spi;
1238 			cts->protocol = PROTO_SCSI;
1239 			cts->protocol_version = SCSI_REV_2;
1240 			cts->transport = XPORT_SPI;
1241 			cts->transport_version = 2;
1242 
1243 			scsi->flags &= ~CTS_SCSI_FLAGS_TAG_ENB;
1244 			spi->flags &= ~CTS_SPI_FLAGS_DISC_ENB;
1245 
1246 			if ((bt->disc_permitted & target_mask) != 0)
1247 				spi->flags |= CTS_SPI_FLAGS_DISC_ENB;
1248 			if ((bt->tags_permitted & target_mask) != 0)
1249 				scsi->flags |= CTS_SCSI_FLAGS_TAG_ENB;
1250 
1251 			if ((bt->ultra_permitted & target_mask) != 0)
1252 				spi->sync_period = 12;
1253 			else if ((bt->fast_permitted & target_mask) != 0)
1254 				spi->sync_period = 25;
1255 			else if ((bt->sync_permitted & target_mask) != 0)
1256 				spi->sync_period = 50;
1257 			else
1258 				spi->sync_period = 0;
1259 
1260 			if (spi->sync_period != 0)
1261 				spi->sync_offset = 15;
1262 
1263 			spi->valid |= CTS_SPI_VALID_SYNC_RATE;
1264 			spi->valid |= CTS_SPI_VALID_SYNC_OFFSET;
1265 
1266 			spi->valid |= CTS_SPI_VALID_BUS_WIDTH;
1267 			if ((bt->wide_permitted & target_mask) != 0)
1268 				spi->bus_width = MSG_EXT_WDTR_BUS_16_BIT;
1269 			else
1270 				spi->bus_width = MSG_EXT_WDTR_BUS_8_BIT;
1271 
1272 			if (cts->ccb_h.target_lun != CAM_LUN_WILDCARD) {
1273 				scsi->valid = CTS_SCSI_VALID_TQ;
1274 				spi->valid |= CTS_SPI_VALID_DISC;
1275 			} else
1276 				scsi->valid = 0;
1277 		} else {
1278 			btfetchtransinfo(bt, cts);
1279 		}
1280 
1281 		ccb->ccb_h.status = CAM_REQ_CMP;
1282 		xpt_done(ccb);
1283 		break;
1284 	}
1285 	case XPT_CALC_GEOMETRY:
1286 	{
1287 		struct	  ccb_calc_geometry *ccg;
1288 		u_int32_t size_mb;
1289 		u_int32_t secs_per_cylinder;
1290 
1291 		ccg = &ccb->ccg;
1292 		size_mb = ccg->volume_size
1293 			/ ((1024L * 1024L) / ccg->block_size);
1294 
1295 		if (size_mb >= 1024 && (bt->extended_trans != 0)) {
1296 			if (size_mb >= 2048) {
1297 				ccg->heads = 255;
1298 				ccg->secs_per_track = 63;
1299 			} else {
1300 				ccg->heads = 128;
1301 				ccg->secs_per_track = 32;
1302 			}
1303 		} else {
1304 			ccg->heads = 64;
1305 			ccg->secs_per_track = 32;
1306 		}
1307 		secs_per_cylinder = ccg->heads * ccg->secs_per_track;
1308 		ccg->cylinders = ccg->volume_size / secs_per_cylinder;
1309 		ccb->ccb_h.status = CAM_REQ_CMP;
1310 		xpt_done(ccb);
1311 		break;
1312 	}
1313 	case XPT_RESET_BUS:		/* Reset the specified SCSI bus */
1314 	{
1315 		btreset(bt, /*hardreset*/TRUE);
1316 		ccb->ccb_h.status = CAM_REQ_CMP;
1317 		xpt_done(ccb);
1318 		break;
1319 	}
1320 	case XPT_TERM_IO:		/* Terminate the I/O process */
1321 		/* XXX Implement */
1322 		ccb->ccb_h.status = CAM_REQ_INVALID;
1323 		xpt_done(ccb);
1324 		break;
1325 	case XPT_PATH_INQ:		/* Path routing inquiry */
1326 	{
1327 		struct ccb_pathinq *cpi = &ccb->cpi;
1328 
1329 		cpi->version_num = 1; /* XXX??? */
1330 		cpi->hba_inquiry = PI_SDTR_ABLE;
1331 		if (bt->tag_capable != 0)
1332 			cpi->hba_inquiry |= PI_TAG_ABLE;
1333 		if (bt->wide_bus != 0)
1334 			cpi->hba_inquiry |= PI_WIDE_16;
1335 		cpi->target_sprt = 0;
1336 		cpi->hba_misc = 0;
1337 		cpi->hba_eng_cnt = 0;
1338 		cpi->max_target = bt->wide_bus ? 15 : 7;
1339 		cpi->max_lun = 7;
1340 		cpi->initiator_id = bt->scsi_id;
1341 		cpi->bus_id = cam_sim_bus(sim);
1342 		cpi->base_transfer_speed = 3300;
1343 		strncpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
1344 		strncpy(cpi->hba_vid, "BusLogic", HBA_IDLEN);
1345 		strncpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
1346 		cpi->unit_number = cam_sim_unit(sim);
1347 		cpi->ccb_h.status = CAM_REQ_CMP;
1348 		cpi->transport = XPORT_SPI;
1349 		cpi->transport_version = 2;
1350 		cpi->protocol = PROTO_SCSI;
1351 		cpi->protocol_version = SCSI_REV_2;
1352 		xpt_done(ccb);
1353 		break;
1354 	}
1355 	default:
1356 		ccb->ccb_h.status = CAM_REQ_INVALID;
1357 		xpt_done(ccb);
1358 		break;
1359 	}
1360 }
1361 
1362 static void
1363 btexecuteccb(void *arg, bus_dma_segment_t *dm_segs, int nseg, int error)
1364 {
1365 	struct	 bt_ccb *bccb;
1366 	union	 ccb *ccb;
1367 	struct	 bt_softc *bt;
1368 
1369 	bccb = (struct bt_ccb *)arg;
1370 	ccb = bccb->ccb;
1371 	bt = (struct bt_softc *)ccb->ccb_h.ccb_bt_ptr;
1372 
1373 	if (error != 0) {
1374 		if (error != EFBIG)
1375 			device_printf(bt->dev,
1376 				      "Unexpected error 0x%x returned from "
1377 				      "bus_dmamap_load\n", error);
1378 		if (ccb->ccb_h.status == CAM_REQ_INPROG) {
1379 			xpt_freeze_devq(ccb->ccb_h.path, /*count*/1);
1380 			ccb->ccb_h.status = CAM_REQ_TOO_BIG|CAM_DEV_QFRZN;
1381 		}
1382 		btfreeccb(bt, bccb);
1383 		xpt_done(ccb);
1384 		return;
1385 	}
1386 
1387 	if (nseg != 0) {
1388 		bt_sg_t *sg;
1389 		bus_dma_segment_t *end_seg;
1390 		bus_dmasync_op_t op;
1391 
1392 		end_seg = dm_segs + nseg;
1393 
1394 		/* Copy the segments into our SG list */
1395 		sg = bccb->sg_list;
1396 		while (dm_segs < end_seg) {
1397 			sg->len = dm_segs->ds_len;
1398 			sg->addr = dm_segs->ds_addr;
1399 			sg++;
1400 			dm_segs++;
1401 		}
1402 
1403 		if (nseg > 1) {
1404 			bccb->hccb.opcode = INITIATOR_SG_CCB_WRESID;
1405 			bccb->hccb.data_len = sizeof(bt_sg_t) * nseg;
1406 			bccb->hccb.data_addr = bccb->sg_list_phys;
1407 		} else {
1408 			bccb->hccb.data_len = bccb->sg_list->len;
1409 			bccb->hccb.data_addr = bccb->sg_list->addr;
1410 		}
1411 
1412 		if ((ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN)
1413 			op = BUS_DMASYNC_PREREAD;
1414 		else
1415 			op = BUS_DMASYNC_PREWRITE;
1416 
1417 		bus_dmamap_sync(bt->buffer_dmat, bccb->dmamap, op);
1418 
1419 	} else {
1420 		bccb->hccb.opcode = INITIATOR_CCB;
1421 		bccb->hccb.data_len = 0;
1422 		bccb->hccb.data_addr = 0;
1423 	}
1424 
1425 	crit_enter();
1426 
1427 	/*
1428 	 * Last time we need to check if this CCB needs to
1429 	 * be aborted.
1430 	 */
1431 	if (ccb->ccb_h.status != CAM_REQ_INPROG) {
1432 		if (nseg != 0)
1433 			bus_dmamap_unload(bt->buffer_dmat, bccb->dmamap);
1434 		btfreeccb(bt, bccb);
1435 		xpt_done(ccb);
1436 		crit_exit();
1437 		return;
1438 	}
1439 
1440 	bccb->flags = BCCB_ACTIVE;
1441 	ccb->ccb_h.status |= CAM_SIM_QUEUED;
1442 	LIST_INSERT_HEAD(&bt->pending_ccbs, &ccb->ccb_h, sim_links.le);
1443 
1444 	callout_reset(&ccb->ccb_h.timeout_ch, (ccb->ccb_h.timeout * hz) / 1000,
1445 	    bttimeout, bccb);
1446 
1447 	/* Tell the adapter about this command */
1448 	bt->cur_outbox->ccb_addr = btccbvtop(bt, bccb);
1449 	if (bt->cur_outbox->action_code != BMBO_FREE) {
1450 		/*
1451 		 * We should never encounter a busy mailbox.
1452 		 * If we do, warn the user, and treat it as
1453 		 * a resource shortage.  If the controller is
1454 		 * hung, one of the pending transactions will
1455 		 * timeout causing us to start recovery operations.
1456 		 */
1457 		device_printf(bt->dev,
1458 			      "Encountered busy mailbox with %d out of %d "
1459 			      "commands active!!!\n", bt->active_ccbs,
1460 			      bt->max_ccbs);
1461 		callout_stop(&ccb->ccb_h.timeout_ch);
1462 		if (nseg != 0)
1463 			bus_dmamap_unload(bt->buffer_dmat, bccb->dmamap);
1464 		btfreeccb(bt, bccb);
1465 		bt->resource_shortage = TRUE;
1466 		xpt_freeze_simq(bt->sim, /*count*/1);
1467 		ccb->ccb_h.status = CAM_REQUEUE_REQ;
1468 		xpt_done(ccb);
1469 		return;
1470 	}
1471 	bt->cur_outbox->action_code = BMBO_START;
1472 	bt_outb(bt, COMMAND_REG, BOP_START_MBOX);
1473 	btnextoutbox(bt);
1474 	crit_exit();
1475 }
1476 
1477 void
1478 bt_intr(void *arg)
1479 {
1480 	struct	bt_softc *bt;
1481 	u_int	intstat;
1482 
1483 	bt = (struct bt_softc *)arg;
1484 	while (((intstat = bt_inb(bt, INTSTAT_REG)) & INTR_PENDING) != 0) {
1485 
1486 		if ((intstat & CMD_COMPLETE) != 0) {
1487 			bt->latched_status = bt_inb(bt, STATUS_REG);
1488 			bt->command_cmp = TRUE;
1489 		}
1490 
1491 		bt_outb(bt, CONTROL_REG, RESET_INTR);
1492 
1493 		if ((intstat & IMB_LOADED) != 0) {
1494 			while (bt->cur_inbox->comp_code != BMBI_FREE) {
1495 				btdone(bt,
1496 				       btccbptov(bt, bt->cur_inbox->ccb_addr),
1497 				       bt->cur_inbox->comp_code);
1498 				bt->cur_inbox->comp_code = BMBI_FREE;
1499 				btnextinbox(bt);
1500 			}
1501 		}
1502 
1503 		if ((intstat & SCSI_BUS_RESET) != 0) {
1504 			btreset(bt, /*hardreset*/FALSE);
1505 		}
1506 	}
1507 }
1508 
1509 static void
1510 btdone(struct bt_softc *bt, struct bt_ccb *bccb, bt_mbi_comp_code_t comp_code)
1511 {
1512 	union  ccb	  *ccb;
1513 	struct ccb_scsiio *csio;
1514 
1515 	ccb = bccb->ccb;
1516 	csio = &bccb->ccb->csio;
1517 
1518 	if ((bccb->flags & BCCB_ACTIVE) == 0) {
1519 		device_printf(bt->dev,
1520 			      "btdone - Attempt to free non-active BCCB %p\n",
1521 			      (void *)bccb);
1522 		return;
1523 	}
1524 
1525 	if ((ccb->ccb_h.flags & CAM_DIR_MASK) != CAM_DIR_NONE) {
1526 		bus_dmasync_op_t op;
1527 
1528 		if ((ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN)
1529 			op = BUS_DMASYNC_POSTREAD;
1530 		else
1531 			op = BUS_DMASYNC_POSTWRITE;
1532 		bus_dmamap_sync(bt->buffer_dmat, bccb->dmamap, op);
1533 		bus_dmamap_unload(bt->buffer_dmat, bccb->dmamap);
1534 	}
1535 
1536 	if (bccb == bt->recovery_bccb) {
1537 		/*
1538 		 * The recovery BCCB does not have a CCB associated
1539 		 * with it, so short circuit the normal error handling.
1540 		 * We now traverse our list of pending CCBs and process
1541 		 * any that were terminated by the recovery CCBs action.
1542 		 * We also reinstate timeouts for all remaining, pending,
1543 		 * CCBs.
1544 		 */
1545 		struct cam_path *path;
1546 		struct ccb_hdr *ccb_h;
1547 		cam_status error;
1548 
1549 		/* Notify all clients that a BDR occured */
1550 		error = xpt_create_path(&path, /*periph*/NULL,
1551 					cam_sim_path(bt->sim),
1552 					bccb->hccb.target_id,
1553 					CAM_LUN_WILDCARD);
1554 
1555 		if (error == CAM_REQ_CMP)
1556 			xpt_async(AC_SENT_BDR, path, NULL);
1557 
1558 		ccb_h = LIST_FIRST(&bt->pending_ccbs);
1559 		while (ccb_h != NULL) {
1560 			struct bt_ccb *pending_bccb;
1561 
1562 			pending_bccb = (struct bt_ccb *)ccb_h->ccb_bccb_ptr;
1563 			if (pending_bccb->hccb.target_id
1564 			 == bccb->hccb.target_id) {
1565 				pending_bccb->hccb.btstat = BTSTAT_HA_BDR;
1566 				ccb_h = LIST_NEXT(ccb_h, sim_links.le);
1567 				btdone(bt, pending_bccb, BMBI_ERROR);
1568 			} else {
1569 				callout_reset(&ccb_h->timeout_ch,
1570 				    (ccb_h->timeout * hz) / 1000,
1571 				    bttimeout, pending_bccb);
1572 				ccb_h = LIST_NEXT(ccb_h, sim_links.le);
1573 			}
1574 		}
1575 		device_printf(bt->dev, "No longer in timeout\n");
1576 		return;
1577 	}
1578 
1579 	callout_stop(&ccb->ccb_h.timeout_ch);
1580 
1581 	switch (comp_code) {
1582 	case BMBI_FREE:
1583 		device_printf(bt->dev,
1584 			      "btdone - CCB completed with free status!\n");
1585 		break;
1586 	case BMBI_NOT_FOUND:
1587 		device_printf(bt->dev,
1588 			      "btdone - CCB Abort failed to find CCB\n");
1589 		break;
1590 	case BMBI_ABORT:
1591 	case BMBI_ERROR:
1592 		if (bootverbose) {
1593 			kprintf("bt: ccb %p - error %x occurred.  "
1594 			       "btstat = %x, sdstat = %x\n",
1595 			       (void *)bccb, comp_code, bccb->hccb.btstat,
1596 			       bccb->hccb.sdstat);
1597 		}
1598 		/* An error occured */
1599 		switch(bccb->hccb.btstat) {
1600 		case BTSTAT_DATARUN_ERROR:
1601 			if (bccb->hccb.data_len == 0) {
1602 				/*
1603 				 * At least firmware 4.22, does this
1604 				 * for a QUEUE FULL condition.
1605 				 */
1606 				bccb->hccb.sdstat = SCSI_STATUS_QUEUE_FULL;
1607 			} else if (bccb->hccb.data_len < 0) {
1608 				csio->ccb_h.status = CAM_DATA_RUN_ERR;
1609 				break;
1610 			}
1611 			/* FALLTHROUGH */
1612 		case BTSTAT_NOERROR:
1613 		case BTSTAT_LINKED_CMD_COMPLETE:
1614 		case BTSTAT_LINKED_CMD_FLAG_COMPLETE:
1615 		case BTSTAT_DATAUNDERUN_ERROR:
1616 
1617 			csio->scsi_status = bccb->hccb.sdstat;
1618 			csio->ccb_h.status |= CAM_SCSI_STATUS_ERROR;
1619 			switch(csio->scsi_status) {
1620 			case SCSI_STATUS_CHECK_COND:
1621 			case SCSI_STATUS_CMD_TERMINATED:
1622 				csio->ccb_h.status |= CAM_AUTOSNS_VALID;
1623 				/* Bounce sense back if necessary */
1624 				if (bt->sense_buffers != NULL) {
1625 					csio->sense_data =
1626 					    *btsensevaddr(bt, bccb);
1627 				}
1628 				break;
1629 			default:
1630 				break;
1631 			case SCSI_STATUS_OK:
1632 				csio->ccb_h.status = CAM_REQ_CMP;
1633 				break;
1634 			}
1635 			csio->resid = bccb->hccb.data_len;
1636 			break;
1637 		case BTSTAT_SELTIMEOUT:
1638 			csio->ccb_h.status = CAM_SEL_TIMEOUT;
1639 			break;
1640 		case BTSTAT_UNEXPECTED_BUSFREE:
1641 			csio->ccb_h.status = CAM_UNEXP_BUSFREE;
1642 			break;
1643 		case BTSTAT_INVALID_PHASE:
1644 			csio->ccb_h.status = CAM_SEQUENCE_FAIL;
1645 			break;
1646 		case BTSTAT_INVALID_ACTION_CODE:
1647 			panic("%s: Inavlid Action code", bt_name(bt));
1648 			break;
1649 		case BTSTAT_INVALID_OPCODE:
1650 			panic("%s: Inavlid CCB Opcode code", bt_name(bt));
1651 			break;
1652 		case BTSTAT_LINKED_CCB_LUN_MISMATCH:
1653 			/* We don't even support linked commands... */
1654 			panic("%s: Linked CCB Lun Mismatch", bt_name(bt));
1655 			break;
1656 		case BTSTAT_INVALID_CCB_OR_SG_PARAM:
1657 			panic("%s: Invalid CCB or SG list", bt_name(bt));
1658 			break;
1659 		case BTSTAT_AUTOSENSE_FAILED:
1660 			csio->ccb_h.status = CAM_AUTOSENSE_FAIL;
1661 			break;
1662 		case BTSTAT_TAGGED_MSG_REJECTED:
1663 		{
1664 			struct ccb_trans_settings neg;
1665 			struct ccb_trans_settings_scsi *scsi =
1666 			    &neg.proto_specific.scsi;
1667 
1668 			neg.protocol = PROTO_SCSI;
1669 			neg.protocol_version = SCSI_REV_2;
1670 			neg.transport = XPORT_SPI;
1671 			neg.transport_version = 2;
1672 			scsi->valid = CTS_SCSI_VALID_TQ;
1673 			scsi->flags = 0;
1674 			xpt_print_path(csio->ccb_h.path);
1675 			kprintf("refuses tagged commands.  Performing "
1676 			       "non-tagged I/O\n");
1677 			xpt_setup_ccb(&neg.ccb_h, csio->ccb_h.path,
1678 				      /*priority*/1);
1679 			xpt_async(AC_TRANSFER_NEG, csio->ccb_h.path, &neg);
1680 			bt->tags_permitted &= ~(0x01 << csio->ccb_h.target_id);
1681 			csio->ccb_h.status = CAM_MSG_REJECT_REC;
1682 			break;
1683 		}
1684 		case BTSTAT_UNSUPPORTED_MSG_RECEIVED:
1685 			/*
1686 			 * XXX You would think that this is
1687 			 *     a recoverable error... Hmmm.
1688 			 */
1689 			csio->ccb_h.status = CAM_REQ_CMP_ERR;
1690 			break;
1691 		case BTSTAT_HA_SOFTWARE_ERROR:
1692 		case BTSTAT_HA_WATCHDOG_ERROR:
1693 		case BTSTAT_HARDWARE_FAILURE:
1694 			/* Hardware reset ??? Can we recover ??? */
1695 			csio->ccb_h.status = CAM_NO_HBA;
1696 			break;
1697 		case BTSTAT_TARGET_IGNORED_ATN:
1698 		case BTSTAT_OTHER_SCSI_BUS_RESET:
1699 		case BTSTAT_HA_SCSI_BUS_RESET:
1700 			if ((csio->ccb_h.status & CAM_STATUS_MASK)
1701 			 != CAM_CMD_TIMEOUT)
1702 				csio->ccb_h.status = CAM_SCSI_BUS_RESET;
1703 			break;
1704 		case BTSTAT_HA_BDR:
1705 			if ((bccb->flags & BCCB_DEVICE_RESET) == 0)
1706 				csio->ccb_h.status = CAM_BDR_SENT;
1707 			else
1708 				csio->ccb_h.status = CAM_CMD_TIMEOUT;
1709 			break;
1710 		case BTSTAT_INVALID_RECONNECT:
1711 		case BTSTAT_ABORT_QUEUE_GENERATED:
1712 			csio->ccb_h.status = CAM_REQ_TERMIO;
1713 			break;
1714 		case BTSTAT_SCSI_PERROR_DETECTED:
1715 			csio->ccb_h.status = CAM_UNCOR_PARITY;
1716 			break;
1717 		}
1718 		if (csio->ccb_h.status != CAM_REQ_CMP) {
1719 			xpt_freeze_devq(csio->ccb_h.path, /*count*/1);
1720 			csio->ccb_h.status |= CAM_DEV_QFRZN;
1721 		}
1722 		if ((bccb->flags & BCCB_RELEASE_SIMQ) != 0)
1723 			ccb->ccb_h.status |= CAM_RELEASE_SIMQ;
1724 		btfreeccb(bt, bccb);
1725 		xpt_done(ccb);
1726 		break;
1727 	case BMBI_OK:
1728 		/* All completed without incident */
1729 		ccb->ccb_h.status |= CAM_REQ_CMP;
1730 		if ((bccb->flags & BCCB_RELEASE_SIMQ) != 0)
1731 			ccb->ccb_h.status |= CAM_RELEASE_SIMQ;
1732 		btfreeccb(bt, bccb);
1733 		xpt_done(ccb);
1734 		break;
1735 	}
1736 }
1737 
1738 static int
1739 btreset(struct bt_softc* bt, int hard_reset)
1740 {
1741 	struct	 ccb_hdr *ccb_h;
1742 	u_int	 status;
1743 	u_int	 timeout;
1744 	u_int8_t reset_type;
1745 
1746 	if (hard_reset != 0)
1747 		reset_type = HARD_RESET;
1748 	else
1749 		reset_type = SOFT_RESET;
1750 	bt_outb(bt, CONTROL_REG, reset_type);
1751 
1752 	/* Wait 5sec. for Diagnostic start */
1753 	timeout = 5 * 10000;
1754 	while (--timeout) {
1755 		status = bt_inb(bt, STATUS_REG);
1756 		if ((status & DIAG_ACTIVE) != 0)
1757 			break;
1758 		DELAY(100);
1759 	}
1760 	if (timeout == 0) {
1761 		if (bootverbose)
1762 			kprintf("%s: btreset - Diagnostic Active failed to "
1763 				"assert. status = 0x%x\n", bt_name(bt), status);
1764 		return (ETIMEDOUT);
1765 	}
1766 
1767 	/* Wait 10sec. for Diagnostic end */
1768 	timeout = 10 * 10000;
1769 	while (--timeout) {
1770 		status = bt_inb(bt, STATUS_REG);
1771 		if ((status & DIAG_ACTIVE) == 0)
1772 			break;
1773 		DELAY(100);
1774 	}
1775 	if (timeout == 0) {
1776 		panic("%s: btreset - Diagnostic Active failed to drop. "
1777 		       "status = 0x%x\n", bt_name(bt), status);
1778 		return (ETIMEDOUT);
1779 	}
1780 
1781 	/* Wait for the host adapter to become ready or report a failure */
1782 	timeout = 10000;
1783 	while (--timeout) {
1784 		status = bt_inb(bt, STATUS_REG);
1785 		if ((status & (DIAG_FAIL|HA_READY|DATAIN_REG_READY)) != 0)
1786 			break;
1787 		DELAY(100);
1788 	}
1789 	if (timeout == 0) {
1790 		kprintf("%s: btreset - Host adapter failed to come ready. "
1791 		       "status = 0x%x\n", bt_name(bt), status);
1792 		return (ETIMEDOUT);
1793 	}
1794 
1795 	/* If the diagnostics failed, tell the user */
1796 	if ((status & DIAG_FAIL) != 0
1797 	 || (status & HA_READY) == 0) {
1798 		kprintf("%s: btreset - Adapter failed diagnostics\n",
1799 		       bt_name(bt));
1800 
1801 		if ((status & DATAIN_REG_READY) != 0)
1802 			kprintf("%s: btreset - Host Adapter Error code = 0x%x\n",
1803 			       bt_name(bt), bt_inb(bt, DATAIN_REG));
1804 		return (ENXIO);
1805 	}
1806 
1807 	/* If we've allocated mailboxes, initialize them */
1808 	if (bt->init_level > 4)
1809 		btinitmboxes(bt);
1810 
1811 	/* If we've attached to the XPT, tell it about the event */
1812 	if (bt->path != NULL)
1813 		xpt_async(AC_BUS_RESET, bt->path, NULL);
1814 
1815 	/*
1816 	 * Perform completion processing for all outstanding CCBs.
1817 	 */
1818 	while ((ccb_h = LIST_FIRST(&bt->pending_ccbs)) != NULL) {
1819 		struct bt_ccb *pending_bccb;
1820 
1821 		pending_bccb = (struct bt_ccb *)ccb_h->ccb_bccb_ptr;
1822 		pending_bccb->hccb.btstat = BTSTAT_HA_SCSI_BUS_RESET;
1823 		btdone(bt, pending_bccb, BMBI_ERROR);
1824 	}
1825 
1826 	return (0);
1827 }
1828 
1829 /*
1830  * Send a command to the adapter.
1831  */
1832 int
1833 bt_cmd(struct bt_softc *bt, bt_op_t opcode, u_int8_t *params, u_int param_len,
1834       u_int8_t *reply_data, u_int reply_len, u_int cmd_timeout)
1835 {
1836 	u_int	timeout;
1837 	u_int	status;
1838 	u_int	saved_status;
1839 	u_int	intstat;
1840 	u_int	reply_buf_size;
1841 	int	cmd_complete;
1842 	int	error;
1843 
1844 	/* No data returned to start */
1845 	reply_buf_size = reply_len;
1846 	reply_len = 0;
1847 	intstat = 0;
1848 	cmd_complete = 0;
1849 	saved_status = 0;
1850 	error = 0;
1851 
1852 	bt->command_cmp = 0;
1853 	/*
1854 	 * Wait up to 10 sec. for the adapter to become
1855 	 * ready to accept commands.
1856 	 */
1857 	timeout = 100000;
1858 	while (--timeout) {
1859 		status = bt_inb(bt, STATUS_REG);
1860 		if ((status & HA_READY) != 0
1861 		 && (status & CMD_REG_BUSY) == 0)
1862 			break;
1863 		/*
1864 		 * Throw away any pending data which may be
1865 		 * left over from earlier commands that we
1866 		 * timedout on.
1867 		 */
1868 		if ((status & DATAIN_REG_READY) != 0)
1869 			(void)bt_inb(bt, DATAIN_REG);
1870 		DELAY(100);
1871 	}
1872 	if (timeout == 0) {
1873 		kprintf("%s: bt_cmd: Timeout waiting for adapter ready, "
1874 		       "status = 0x%x\n", bt_name(bt), status);
1875 		return (ETIMEDOUT);
1876 	}
1877 
1878 	/*
1879 	 * Send the opcode followed by any necessary parameter bytes.
1880 	 */
1881 	bt_outb(bt, COMMAND_REG, opcode);
1882 
1883 	/*
1884 	 * Wait for up to 1sec for each byte of the the
1885 	 * parameter list sent to be sent.
1886 	 */
1887 	timeout = 10000;
1888 	while (param_len && --timeout) {
1889 		DELAY(100);
1890 		crit_enter();
1891 		status = bt_inb(bt, STATUS_REG);
1892 		intstat = bt_inb(bt, INTSTAT_REG);
1893 		crit_exit();
1894 
1895 		if ((intstat & (INTR_PENDING|CMD_COMPLETE))
1896 		 == (INTR_PENDING|CMD_COMPLETE)) {
1897 			saved_status = status;
1898 			cmd_complete = 1;
1899 			break;
1900 		}
1901 		if (bt->command_cmp != 0) {
1902 			saved_status = bt->latched_status;
1903 			cmd_complete = 1;
1904 			break;
1905 		}
1906 		if ((status & DATAIN_REG_READY) != 0)
1907 			break;
1908 		if ((status & CMD_REG_BUSY) == 0) {
1909 			bt_outb(bt, COMMAND_REG, *params++);
1910 			param_len--;
1911 			timeout = 10000;
1912 		}
1913 	}
1914 	if (timeout == 0) {
1915 		kprintf("%s: bt_cmd: Timeout sending parameters, "
1916 		       "status = 0x%x\n", bt_name(bt), status);
1917 		cmd_complete = 1;
1918 		saved_status = status;
1919 		error = ETIMEDOUT;
1920 	}
1921 
1922 	/*
1923 	 * Wait for the command to complete.
1924 	 */
1925 	while (cmd_complete == 0 && --cmd_timeout) {
1926 
1927 		crit_enter();
1928 		status = bt_inb(bt, STATUS_REG);
1929 		intstat = bt_inb(bt, INTSTAT_REG);
1930 		/*
1931 		 * It may be that this command was issued with
1932 		 * controller interrupts disabled.  We'll never
1933 		 * get to our command if an incoming mailbox
1934 		 * interrupt is pending, so take care of completed
1935 		 * mailbox commands by calling our interrupt handler.
1936 		 */
1937 		if ((intstat & (INTR_PENDING|IMB_LOADED))
1938 		 == (INTR_PENDING|IMB_LOADED))
1939 			bt_intr(bt);
1940 		crit_exit();
1941 
1942 		if (bt->command_cmp != 0) {
1943  			/*
1944 			 * Our interrupt handler saw CMD_COMPLETE
1945 			 * status before we did.
1946 			 */
1947 			cmd_complete = 1;
1948 			saved_status = bt->latched_status;
1949 		} else if ((intstat & (INTR_PENDING|CMD_COMPLETE))
1950 			== (INTR_PENDING|CMD_COMPLETE)) {
1951 			/*
1952 			 * Our poll (in case interrupts are blocked)
1953 			 * saw the CMD_COMPLETE interrupt.
1954 			 */
1955 			cmd_complete = 1;
1956 			saved_status = status;
1957 		} else if (opcode == BOP_MODIFY_IO_ADDR
1958 			&& (status & CMD_REG_BUSY) == 0) {
1959 			/*
1960 			 * The BOP_MODIFY_IO_ADDR does not issue a CMD_COMPLETE,
1961 			 * but it should update the status register.  So, we
1962 			 * consider this command complete when the CMD_REG_BUSY
1963 			 * status clears.
1964 			 */
1965 			saved_status = status;
1966 			cmd_complete = 1;
1967 		} else if ((status & DATAIN_REG_READY) != 0) {
1968 			u_int8_t data;
1969 
1970 			data = bt_inb(bt, DATAIN_REG);
1971 			if (reply_len < reply_buf_size) {
1972 				*reply_data++ = data;
1973 			} else {
1974 				kprintf("%s: bt_cmd - Discarded reply data byte "
1975 				       "for opcode 0x%x\n", bt_name(bt),
1976 				       opcode);
1977 			}
1978 			/*
1979 			 * Reset timeout to ensure at least a second
1980 			 * between response bytes.
1981 			 */
1982 			cmd_timeout = MAX(cmd_timeout, 10000);
1983 			reply_len++;
1984 
1985 		} else if ((opcode == BOP_FETCH_LRAM)
1986 			&& (status & HA_READY) != 0) {
1987 				saved_status = status;
1988 				cmd_complete = 1;
1989 		}
1990 		DELAY(100);
1991 	}
1992 	if (cmd_timeout == 0) {
1993 		kprintf("%s: bt_cmd: Timeout waiting for command (%x) "
1994 		       "to complete.\n%s: status = 0x%x, intstat = 0x%x, "
1995 		       "rlen %d\n", bt_name(bt), opcode,
1996 		       bt_name(bt), status, intstat, reply_len);
1997 		error = (ETIMEDOUT);
1998 	}
1999 
2000 	/*
2001 	 * Clear any pending interrupts.  Block interrupts so our
2002 	 * interrupt handler is not re-entered.
2003 	 */
2004 	crit_enter();
2005 	bt_intr(bt);
2006 	crit_exit();
2007 
2008 	if (error != 0)
2009 		return (error);
2010 
2011 	/*
2012 	 * If the command was rejected by the controller, tell the caller.
2013 	 */
2014 	if ((saved_status & CMD_INVALID) != 0) {
2015 		/*
2016 		 * Some early adapters may not recover properly from
2017 		 * an invalid command.  If it appears that the controller
2018 		 * has wedged (i.e. status was not cleared by our interrupt
2019 		 * reset above), perform a soft reset.
2020       		 */
2021 		if (bootverbose)
2022 			kprintf("%s: Invalid Command 0x%x\n", bt_name(bt),
2023 				opcode);
2024 		DELAY(1000);
2025 		status = bt_inb(bt, STATUS_REG);
2026 		if ((status & (CMD_INVALID|STATUS_REG_RSVD|DATAIN_REG_READY|
2027 			      CMD_REG_BUSY|DIAG_FAIL|DIAG_ACTIVE)) != 0
2028 		 || (status & (HA_READY|INIT_REQUIRED))
2029 		  != (HA_READY|INIT_REQUIRED)) {
2030 			btreset(bt, /*hard_reset*/FALSE);
2031 		}
2032 		return (EINVAL);
2033 	}
2034 
2035 	if (param_len > 0) {
2036 		/* The controller did not accept the full argument list */
2037 	 	return (E2BIG);
2038 	}
2039 
2040 	if (reply_len != reply_buf_size) {
2041 		/* Too much or too little data received */
2042 		return (EMSGSIZE);
2043 	}
2044 
2045 	/* We were successful */
2046 	return (0);
2047 }
2048 
2049 static int
2050 btinitmboxes(struct bt_softc *bt) {
2051 	init_32b_mbox_params_t init_mbox;
2052 	int error;
2053 
2054 	bzero(bt->in_boxes, sizeof(bt_mbox_in_t) * bt->num_boxes);
2055 	bzero(bt->out_boxes, sizeof(bt_mbox_out_t) * bt->num_boxes);
2056 	bt->cur_inbox = bt->in_boxes;
2057 	bt->last_inbox = bt->in_boxes + bt->num_boxes - 1;
2058 	bt->cur_outbox = bt->out_boxes;
2059 	bt->last_outbox = bt->out_boxes + bt->num_boxes - 1;
2060 
2061 	/* Tell the adapter about them */
2062 	init_mbox.num_boxes = bt->num_boxes;
2063 	init_mbox.base_addr[0] = bt->mailbox_physbase & 0xFF;
2064 	init_mbox.base_addr[1] = (bt->mailbox_physbase >> 8) & 0xFF;
2065 	init_mbox.base_addr[2] = (bt->mailbox_physbase >> 16) & 0xFF;
2066 	init_mbox.base_addr[3] = (bt->mailbox_physbase >> 24) & 0xFF;
2067 	error = bt_cmd(bt, BOP_INITIALIZE_32BMBOX, (u_int8_t *)&init_mbox,
2068 		       /*parmlen*/sizeof(init_mbox), /*reply_buf*/NULL,
2069 		       /*reply_len*/0, DEFAULT_CMD_TIMEOUT);
2070 
2071 	if (error != 0)
2072 		kprintf("btinitmboxes: Initialization command failed\n");
2073 	else if (bt->strict_rr != 0) {
2074 		/*
2075 		 * If the controller supports
2076 		 * strict round robin mode,
2077 		 * enable it
2078 		 */
2079 		u_int8_t param;
2080 
2081 		param = 0;
2082 		error = bt_cmd(bt, BOP_ENABLE_STRICT_RR, &param, 1,
2083 			       /*reply_buf*/NULL, /*reply_len*/0,
2084 			       DEFAULT_CMD_TIMEOUT);
2085 
2086 		if (error != 0) {
2087 			kprintf("btinitmboxes: Unable to enable strict RR\n");
2088 			error = 0;
2089 		} else if (bootverbose) {
2090 			kprintf("%s: Using Strict Round Robin Mailbox Mode\n",
2091 			       bt_name(bt));
2092 		}
2093 	}
2094 
2095 	return (error);
2096 }
2097 
2098 /*
2099  * Update the XPT's idea of the negotiated transfer
2100  * parameters for a particular target.
2101  */
2102 static void
2103 btfetchtransinfo(struct bt_softc *bt, struct ccb_trans_settings *cts)
2104 {
2105 	setup_data_t	setup_info;
2106 	u_int		target;
2107 	u_int		targ_offset;
2108 	u_int		targ_mask;
2109 	u_int		sync_period;
2110 	u_int		sync_offset;
2111 	u_int		bus_width;
2112 	int		error;
2113 	u_int8_t	param;
2114 	targ_syncinfo_t	sync_info;
2115 	struct ccb_trans_settings_scsi *scsi =
2116 	    &cts->proto_specific.scsi;
2117 	struct ccb_trans_settings_spi *spi =
2118 	    &cts->xport_specific.spi;
2119 
2120 	spi->valid = 0;
2121 	scsi->valid = 0;
2122 
2123 	target = cts->ccb_h.target_id;
2124 	targ_offset = (target & 0x7);
2125 	targ_mask = (0x01 << targ_offset);
2126 
2127 	/*
2128 	 * Inquire Setup Information.  This command retreives the
2129 	 * Wide negotiation status for recent adapters as well as
2130 	 * the sync info for older models.
2131 	 */
2132 	param = sizeof(setup_info);
2133 	error = bt_cmd(bt, BOP_INQUIRE_SETUP_INFO, &param, /*paramlen*/1,
2134 		       (u_int8_t*)&setup_info, sizeof(setup_info),
2135 		       DEFAULT_CMD_TIMEOUT);
2136 
2137 	if (error != 0) {
2138 		kprintf("%s: btfetchtransinfo - Inquire Setup Info Failed %x\n",
2139 		       bt_name(bt), error);
2140 		return;
2141 	}
2142 
2143 	sync_info = (target < 8) ? setup_info.low_syncinfo[targ_offset]
2144 				 : setup_info.high_syncinfo[targ_offset];
2145 
2146 	if (sync_info.sync == 0)
2147 		sync_offset = 0;
2148 	else
2149 		sync_offset = sync_info.offset;
2150 
2151 
2152 	bus_width = MSG_EXT_WDTR_BUS_8_BIT;
2153 	if (strcmp(bt->firmware_ver, "5.06L") >= 0) {
2154 		u_int wide_active;
2155 
2156 		wide_active =
2157 		    (target < 8) ? (setup_info.low_wide_active & targ_mask)
2158 		    		 : (setup_info.high_wide_active & targ_mask);
2159 
2160 		if (wide_active)
2161 			bus_width = MSG_EXT_WDTR_BUS_16_BIT;
2162 	} else if ((bt->wide_permitted & targ_mask) != 0) {
2163 		struct ccb_getdev cgd;
2164 
2165 		/*
2166 		 * Prior to rev 5.06L, wide status isn't provided,
2167 		 * so we "guess" that wide transfers are in effect
2168 		 * if the user settings allow for wide and the inquiry
2169 		 * data for the device indicates that it can handle
2170 		 * wide transfers.
2171 		 */
2172 		xpt_setup_ccb(&cgd.ccb_h, cts->ccb_h.path, /*priority*/1);
2173 		cgd.ccb_h.func_code = XPT_GDEV_TYPE;
2174 		xpt_action((union ccb *)&cgd);
2175 		if ((cgd.ccb_h.status & CAM_STATUS_MASK) == CAM_REQ_CMP
2176 		 && (cgd.inq_data.flags & SID_WBus16) != 0)
2177 			bus_width = MSG_EXT_WDTR_BUS_16_BIT;
2178 	}
2179 
2180 	if (bt->firmware_ver[0] >= '3') {
2181 		/*
2182 		 * For adapters that can do fast or ultra speeds,
2183 		 * use the more exact Target Sync Information command.
2184 		 */
2185 		target_sync_info_data_t sync_info;
2186 
2187 		param = sizeof(sync_info);
2188 		error = bt_cmd(bt, BOP_TARG_SYNC_INFO, &param, /*paramlen*/1,
2189 			       (u_int8_t*)&sync_info, sizeof(sync_info),
2190 			       DEFAULT_CMD_TIMEOUT);
2191 
2192 		if (error != 0) {
2193 			kprintf("%s: btfetchtransinfo - Inquire Sync "
2194 			       "Info Failed 0x%x\n", bt_name(bt), error);
2195 			return;
2196 		}
2197 		sync_period = sync_info.sync_rate[target] * 100;
2198 	} else {
2199 		sync_period = 2000 + (500 * sync_info.period);
2200 	}
2201 
2202 	cts->protocol = PROTO_SCSI;
2203 	cts->protocol_version = SCSI_REV_2;
2204 	cts->transport = XPORT_SPI;
2205 	cts->transport_version = 2;
2206 
2207 	spi->sync_period = sync_period;
2208 	spi->valid |= CTS_SPI_VALID_SYNC_RATE;
2209 	spi->sync_offset = sync_offset;
2210 	spi->valid |= CTS_SPI_VALID_SYNC_OFFSET;
2211 
2212 	spi->valid |= CTS_SPI_VALID_BUS_WIDTH;
2213 	spi->bus_width = bus_width;
2214 
2215 	if (cts->ccb_h.target_lun != CAM_LUN_WILDCARD) {
2216 		scsi->valid = CTS_SCSI_VALID_TQ;
2217 		spi->valid |= CTS_SPI_VALID_DISC;
2218 	} else
2219 		scsi->valid = 0;
2220 
2221         xpt_async(AC_TRANSFER_NEG, cts->ccb_h.path, cts);
2222 }
2223 
2224 static void
2225 btmapmboxes(void *arg, bus_dma_segment_t *segs, int nseg, int error)
2226 {
2227 	struct bt_softc* bt;
2228 
2229 	bt = (struct bt_softc*)arg;
2230 	bt->mailbox_physbase = segs->ds_addr;
2231 }
2232 
2233 static void
2234 btmapccbs(void *arg, bus_dma_segment_t *segs, int nseg, int error)
2235 {
2236 	struct bt_softc* bt;
2237 
2238 	bt = (struct bt_softc*)arg;
2239 	bt->bt_ccb_physbase = segs->ds_addr;
2240 }
2241 
2242 static void
2243 btmapsgs(void *arg, bus_dma_segment_t *segs, int nseg, int error)
2244 {
2245 
2246 	struct bt_softc* bt;
2247 
2248 	bt = (struct bt_softc*)arg;
2249 	SLIST_FIRST(&bt->sg_maps)->sg_physaddr = segs->ds_addr;
2250 }
2251 
2252 static void
2253 btpoll(struct cam_sim *sim)
2254 {
2255 	bt_intr(cam_sim_softc(sim));
2256 }
2257 
2258 void
2259 bttimeout(void *arg)
2260 {
2261 	struct bt_ccb	*bccb;
2262 	union  ccb	*ccb;
2263 	struct bt_softc *bt;
2264 
2265 	bccb = (struct bt_ccb *)arg;
2266 	ccb = bccb->ccb;
2267 	bt = (struct bt_softc *)ccb->ccb_h.ccb_bt_ptr;
2268 	xpt_print_path(ccb->ccb_h.path);
2269 	kprintf("CCB %p - timed out\n", (void *)bccb);
2270 
2271 	crit_enter();
2272 
2273 	if ((bccb->flags & BCCB_ACTIVE) == 0) {
2274 		xpt_print_path(ccb->ccb_h.path);
2275 		kprintf("CCB %p - timed out CCB already completed\n",
2276 		       (void *)bccb);
2277 		crit_exit();
2278 		return;
2279 	}
2280 
2281 	/*
2282 	 * In order to simplify the recovery process, we ask the XPT
2283 	 * layer to halt the queue of new transactions and we traverse
2284 	 * the list of pending CCBs and remove their timeouts. This
2285 	 * means that the driver attempts to clear only one error
2286 	 * condition at a time.  In general, timeouts that occur
2287 	 * close together are related anyway, so there is no benefit
2288 	 * in attempting to handle errors in parrallel.  Timeouts will
2289 	 * be reinstated when the recovery process ends.
2290 	 */
2291 	if ((bccb->flags & BCCB_DEVICE_RESET) == 0) {
2292 		struct ccb_hdr *ccb_h;
2293 
2294 		if ((bccb->flags & BCCB_RELEASE_SIMQ) == 0) {
2295 			xpt_freeze_simq(bt->sim, /*count*/1);
2296 			bccb->flags |= BCCB_RELEASE_SIMQ;
2297 		}
2298 
2299 		ccb_h = LIST_FIRST(&bt->pending_ccbs);
2300 		while (ccb_h != NULL) {
2301 			struct bt_ccb *pending_bccb;
2302 
2303 			pending_bccb = (struct bt_ccb *)ccb_h->ccb_bccb_ptr;
2304 			callout_stop(&ccb_h->timeout_ch);
2305 			ccb_h = LIST_NEXT(ccb_h, sim_links.le);
2306 		}
2307 	}
2308 
2309 	if ((bccb->flags & BCCB_DEVICE_RESET) != 0
2310 	 || bt->cur_outbox->action_code != BMBO_FREE
2311 	 || ((bccb->hccb.tag_enable == TRUE)
2312 	  && (bt->firmware_ver[0] < '5'))) {
2313 		/*
2314 		 * Try a full host adapter/SCSI bus reset.
2315 		 * We do this only if we have already attempted
2316 		 * to clear the condition with a BDR, or we cannot
2317 		 * attempt a BDR for lack of mailbox resources
2318 		 * or because of faulty firmware.  It turns out
2319 		 * that firmware versions prior to 5.xx treat BDRs
2320 		 * as untagged commands that cannot be sent until
2321 		 * all outstanding tagged commands have been processed.
2322 		 * This makes it somewhat difficult to use a BDR to
2323 		 * clear up a problem with an uncompleted tagged command.
2324 		 */
2325 		ccb->ccb_h.status = CAM_CMD_TIMEOUT;
2326 		btreset(bt, /*hardreset*/TRUE);
2327 		kprintf("%s: No longer in timeout\n", bt_name(bt));
2328 	} else {
2329 		/*
2330 		 * Send a Bus Device Reset message:
2331 		 * The target that is holding up the bus may not
2332 		 * be the same as the one that triggered this timeout
2333 		 * (different commands have different timeout lengths),
2334 		 * but we have no way of determining this from our
2335 		 * timeout handler.  Our strategy here is to queue a
2336 		 * BDR message to the target of the timed out command.
2337 		 * If this fails, we'll get another timeout 2 seconds
2338 		 * later which will attempt a bus reset.
2339 		 */
2340 		bccb->flags |= BCCB_DEVICE_RESET;
2341 		callout_reset(&ccb->ccb_h.timeout_ch, 2 * hz, bttimeout, bccb);
2342 
2343 		bt->recovery_bccb->hccb.opcode = INITIATOR_BUS_DEV_RESET;
2344 
2345 		/* No Data Transfer */
2346 		bt->recovery_bccb->hccb.datain = TRUE;
2347 		bt->recovery_bccb->hccb.dataout = TRUE;
2348 		bt->recovery_bccb->hccb.btstat = 0;
2349 		bt->recovery_bccb->hccb.sdstat = 0;
2350 		bt->recovery_bccb->hccb.target_id = ccb->ccb_h.target_id;
2351 
2352 		/* Tell the adapter about this command */
2353 		bt->cur_outbox->ccb_addr = btccbvtop(bt, bt->recovery_bccb);
2354 		bt->cur_outbox->action_code = BMBO_START;
2355 		bt_outb(bt, COMMAND_REG, BOP_START_MBOX);
2356 		btnextoutbox(bt);
2357 	}
2358 
2359 	crit_exit();
2360 }
2361 
2362