Switch to using 16 bit handles instead of 32 bit handles.

This is a pretty invasive change, but there are three good
reasons to do this:

1. We'll never have > 16 bits of handle.
2. We can (eventually) enable the RIO (Reduced Interrupt Operation)
bits which return multiple completing 16 bit handles in mailbox
registers.
3. The !)$*)$*~)@$*~)$* Qlogic target mode for parallel SCSI spec
changed such that at_reserved (which was 32 bits) was split into
two pieces- and one of which was a 16 bit handle id that functions
like the at_rxid for Fibre Channel (a tag for the f/w to correlate
CTIOs with a particular command). Since we had to muck with that
and this changed the whole handler architecture, we might as well...

Propagate new at_handle on through int ct_fwhandle. Follow
implications of changing to 16 bit handles.

These above changes at least get Qlogic 1040 cards working in target
mode again. 1080/12160 cards don't work yet.

In isp.c:
Prepare for doing all loop management in outer layers.

6 files changed, 150 insertions, 87 deletions

diff --git a/sys/dev/isp/isp.c b/sys/dev/isp/isp.c
index 6b14f12..8545ff8 100644
--- a/sys/dev/isp/isp.c
+++ b/sys/dev/isp/isp.c
@@ -3,7 +3,7 @@
  * Machine and OS Independent (well, as best as possible)
  * code for the Qlogic ISP SCSI adapters.
  *
- * Copyright (c) 1997, 1998, 1999, 2000 by Matthew Jacob
+ * Copyright (c) 1997, 1998, 1999, 2000, 2001 by Matthew Jacob
  * Feral Software
  * All rights reserved.
  *
@@ -108,7 +108,7 @@ static int isp_handle_other_response
 __P((struct ispsoftc *, ispstatusreq_t *, u_int16_t *));
 static void isp_parse_status
 __P((struct ispsoftc *, ispstatusreq_t *, XS_T *));
-static void isp_fastpost_complete __P((struct ispsoftc *, u_int32_t));
+static void isp_fastpost_complete __P((struct ispsoftc *, u_int16_t));
 static void isp_scsi_init __P((struct ispsoftc *));
 static void isp_scsi_channel_init __P((struct ispsoftc *, int));
 static void isp_fibre_init __P((struct ispsoftc *));
@@ -933,7 +933,8 @@ isp_scsi_channel_init(isp, channel)
 	if (mbs.param[0] != MBOX_COMMAND_COMPLETE) {
 		return;
 	}
-	isp_prt(isp, ISP_LOGINFO, "Initiator ID is %d", sdp->isp_initiator_id);
+	isp_prt(isp, ISP_LOGINFO, "Initiator ID is %d on Channel %d",
+	    sdp->isp_initiator_id, channel);
 
 
 	/*
@@ -2245,7 +2246,7 @@ isp_start(xs)
 	XS_T *xs;
 {
 	struct ispsoftc *isp;
-	u_int16_t iptr, optr;
+	u_int16_t iptr, optr, handle;
 	union {
 		ispreq_t *_reqp;
 		ispreqt2_t *_t2reqp;
@@ -2300,6 +2301,39 @@ isp_start(xs)
 	if (IS_FC(isp)) {
 		fcparam *fcp = isp->isp_param;
 		struct lportdb *lp;
+#ifdef	HANDLE_LOOPSTATE_IN_OUTER_LAYERS
+		if (fcp->isp_fwstate != FW_READY ||
+		    fcp->isp_loopstate != LOOP_READY) {
+			return (CMD_RQLATER);
+		}
+
+		/*
+		 * If we're not on a Fabric, we can't have a target
+		 * above FL_PORT_ID-1.
+		 *
+		 * If we're on a fabric and *not* connected as an F-port,
+		 * we can't have a target less than FC_SNS_ID+1. This
+		 * keeps us from having to sort out the difference between
+		 * local public loop devices and those which we might get
+		 * from a switch's database.
+		 */
+		if (fcp->isp_onfabric == 0) {
+			if (target >= FL_PORT_ID) {
+				XS_SETERR(xs, HBA_SELTIMEOUT);
+				return (CMD_COMPLETE);
+			}
+		} else {
+			if (target >= FL_PORT_ID && target <= FC_SNS_ID) {
+				XS_SETERR(xs, HBA_SELTIMEOUT);
+				return (CMD_COMPLETE);
+			}
+			if (fcp->isp_topo != TOPO_F_PORT &&
+			    target < FL_PORT_ID) {
+				XS_SETERR(xs, HBA_SELTIMEOUT);
+				return (CMD_COMPLETE);
+			}
+		}
+#else
 		/*
 		 * Check for f/w being in ready state. If the f/w
 		 * isn't in ready state, then we don't know our
@@ -2416,6 +2450,7 @@ isp_start(xs)
 		 * XXX: Here's were we would cancel any loop_dead flag
 		 * XXX: also cancel in dead_loop timeout that's running
 		 */
+#endif
 
 		/*
 		 * Now check whether we should even think about pursuing this.
@@ -2547,18 +2582,19 @@ isp_start(xs)
 	if (isp->isp_sendmarker && reqp->req_time < 5) {
 		reqp->req_time = 5;
 	}
-	if (isp_save_xs(isp, xs, &reqp->req_handle)) {
+	if (isp_save_xs(isp, xs, &handle)) {
 		isp_prt(isp, ISP_LOGDEBUG1, "out of xflist pointers");
 		XS_SETERR(xs, HBA_BOTCH);
 		return (CMD_EAGAIN);
 	}
+	reqp->req_handle = handle;
 	/*
 	 * Set up DMA and/or do any bus swizzling of the request entry
 	 * so that the Qlogic F/W understands what is being asked of it.
  	*/
 	i = ISP_DMASETUP(isp, xs, reqp, &iptr, optr);
 	if (i != CMD_QUEUED) {
-		isp_destroy_handle(isp, reqp->req_handle);
+		isp_destroy_handle(isp, handle);
 		/*
 		 * dmasetup sets actual error in packet, and
 		 * return what we were given to return.
@@ -2593,7 +2629,7 @@ isp_control(isp, ctl, arg)
 	XS_T *xs;
 	mbreg_t mbs;
 	int bus, tgt;
-	u_int32_t handle;
+	u_int16_t handle;
 
 	switch (ctl) {
 	default:
@@ -2666,8 +2702,8 @@ isp_control(isp, ctl, arg)
 			mbs.param[1] =
 			    (bus << 15) | (XS_TGT(xs) << 8) | XS_LUN(xs);
 		}
-		mbs.param[3] = handle >> 16;
-		mbs.param[2] = handle & 0xffff;
+		mbs.param[3] = 0;
+		mbs.param[2] = handle;
 		isp_mboxcmd(isp, &mbs, MBLOGALL & ~MBOX_COMMAND_ERROR);
 		if (mbs.param[0] == MBOX_COMMAND_COMPLETE) {
 			return (0);
@@ -2850,10 +2886,10 @@ isp_intr(arg)
 				    mbox);
 			}
 		} else {
-			u_int32_t fhandle = isp_parse_async(isp, (int) mbox);
+			int fhandle = isp_parse_async(isp, (int) mbox);
 			isp_prt(isp, ISP_LOGDEBUG2, "Async Mbox 0x%x", mbox);
 			if (fhandle > 0) {
-				isp_fastpost_complete(isp, fhandle);
+				isp_fastpost_complete(isp, (u_int16_t) fhandle);
 			}
 		}
 		if (IS_FC(isp) || isp->isp_state != ISP_RUNSTATE) {
@@ -3162,7 +3198,7 @@ isp_parse_async(isp, mbox)
 	int mbox;
 {
 	int bus;
-	u_int32_t fast_post_handle = 0;
+	u_int16_t fast_post_handle = 0;
 
 	if (IS_DUALBUS(isp)) {
 		bus = ISP_READ(isp, OUTMAILBOX6);
@@ -3278,8 +3314,7 @@ isp_parse_async(isp, mbox)
 		break;
 
 	case ASYNC_CMD_CMPLT:
-		fast_post_handle = (ISP_READ(isp, OUTMAILBOX2) << 16) |
-		    ISP_READ(isp, OUTMAILBOX1);
+		fast_post_handle = ISP_READ(isp, OUTMAILBOX1);
 		isp_prt(isp, ISP_LOGDEBUG3, "fast post completion of %u",
 		    fast_post_handle);
 		break;
@@ -3803,11 +3838,11 @@ isp_parse_status(isp, sp, xs)
 static void
 isp_fastpost_complete(isp, fph)
 	struct ispsoftc *isp;
-	u_int32_t fph;
+	u_int16_t fph;
 {
 	XS_T *xs;
 
-	if (fph < 1) {
+	if (fph == 0) {
 		return;
 	}
 	xs = isp_find_xs(isp, fph);
diff --git a/sys/dev/isp/isp_freebsd.c b/sys/dev/isp/isp_freebsd.c
index d203653..7365b2e 100644
--- a/sys/dev/isp/isp_freebsd.c
+++ b/sys/dev/isp/isp_freebsd.c
@@ -2,7 +2,7 @@
 /*
  * Platform (FreeBSD) dependent common attachment code for Qlogic adapters.
  *
- * Copyright (c) 1997, 1998, 1999, 2000 by Matthew Jacob
+ * Copyright (c) 1997, 1998, 1999, 2000, 2001 by Matthew Jacob
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -401,6 +401,12 @@ isp_en_lun(struct ispsoftc *isp, union ccb *ccb)
 
 
 	bus = XS_CHANNEL(ccb);
+	if (bus != 0) {
+		isp_prt(isp, ISP_LOGERR,
+		    "second channel target mode not supported");
+		ccb->ccb_h.status = CAM_REQ_CMP_ERR;
+		return;
+	}
 	tgt = ccb->ccb_h.target_id;
 	lun = ccb->ccb_h.target_lun;
 
@@ -735,7 +741,7 @@ isp_target_start_ctio(struct ispsoftc *isp, union ccb *ccb)
 {
 	void *qe;
 	struct ccb_scsiio *cso = &ccb->csio;
-	u_int32_t *hp, save_handle;
+	u_int16_t *hp, save_handle;
 	u_int16_t iptr, optr;
 
 
@@ -773,8 +779,8 @@ isp_target_start_ctio(struct ispsoftc *isp, union ccb *ccb)
 		}
 
 		/*
-		 * We always have to use the tag_id- it has the RX_ID
-		 * for this exchage.
+		 * We always have to use the tag_id- it has the responder
+		 * exchange id in it.
 		 */
 		cto->ct_rxid = cso->tag_id;
 		if (cso->dxfer_len == 0) {
@@ -808,24 +814,29 @@ isp_target_start_ctio(struct ispsoftc *isp, union ccb *ccb)
 		}
 		if (cto->ct_flags & CAM_SEND_STATUS) {
 			isp_prt(isp, ISP_LOGTDEBUG2,
-			    "CTIO2 RX_ID 0x%x SCSI STATUS 0x%x datalength %u",
+			    "CTIO2[%x] SCSI STATUS 0x%x datalength %u",
 			    cto->ct_rxid, cso->scsi_status, cto->ct_resid);
 		}
-		hp = &cto->ct_reserved;
+		hp = &cto->ct_syshandle;
 	} else {
 		ct_entry_t *cto = qe;
 
+		/*
+		 * We always have to use the tag_id- it has the handle
+		 * for this command.
+		 */
 		cto->ct_header.rqs_entry_type = RQSTYPE_CTIO;
 		cto->ct_header.rqs_entry_count = 1;
 		cto->ct_iid = cso->init_id;
 		cto->ct_tgt = ccb->ccb_h.target_id;
 		cto->ct_lun = ccb->ccb_h.target_lun;
+		cto->ct_fwhandle = cso->tag_id >> 8;
 		if (cso->tag_id && cso->tag_action) {
 			/*
 			 * We don't specify a tag type for regular SCSI.
 			 * Just the tag value and set the flag.
 			 */
-			cto->ct_tag_val = cso->tag_id;
+			cto->ct_tag_val = cso->tag_id & 0xff;
 			cto->ct_flags |= CT_TQAE;
 		}
 		if (ccb->ccb_h.flags & CAM_DIS_DISCONNECT) {
@@ -848,7 +859,7 @@ isp_target_start_ctio(struct ispsoftc *isp, union ccb *ccb)
 			    "CTIO SCSI STATUS 0x%x resid %d",
 			    cso->scsi_status, cso->resid);
 		}
-		hp = &cto->ct_reserved;
+		hp = &cto->ct_syshandle;
 		ccb->ccb_h.flags &= ~CAM_SEND_SENSE;
 	}
 
@@ -922,7 +933,8 @@ isp_target_putback_atio(struct ispsoftc *isp, union ccb *ccb)
 		if (atiop->ccb_h.status & CAM_TAG_ACTION_VALID) {
 			at->at_tag_type = atiop->tag_action;
 		}
-		at->at_tag_val = atiop->tag_id;
+		at->at_tag_val = atiop->tag_id & 0xff;
+		at->at_handle = atiop->tag_id >> 8;
 		ISP_SWIZ_ATIO(isp, qe, qe);
 	}
 	ISP_TDQE(isp, "isp_target_putback_atio", (int) optr, qe);
@@ -1048,14 +1060,14 @@ isp_handle_platform_atio(struct ispsoftc *isp, at_entry_t *aep)
 	atiop->cdb_len = aep->at_cdblen;
 	MEMCPY(atiop->cdb_io.cdb_bytes, aep->at_cdb, aep->at_cdblen);
 	atiop->ccb_h.status = CAM_CDB_RECVD;
-	atiop->tag_id = aep->at_tag_val;
+	atiop->tag_id = aep->at_tag_val | (aep->at_handle << 8);
 	if ((atiop->tag_action = aep->at_tag_type) != 0) {
 		atiop->ccb_h.status |= CAM_TAG_ACTION_VALID;
 	}
 	xpt_done((union ccb*)atiop);
 	isp_prt(isp, ISP_LOGTDEBUG2,
-	    "ATIO CDB=0x%x iid%d->lun%d tag 0x%x ttype 0x%x %s",
-	    aep->at_cdb[0] & 0xff, aep->at_iid, aep->at_lun,
+	    "ATIO[%x] CDB=0x%x iid%d->lun%d tag 0x%x ttype 0x%x %s",
+	    aep->at_handle, aep->at_cdb[0] & 0xff, aep->at_iid, aep->at_lun,
 	    aep->at_tag_val & 0xff, aep->at_tag_type,
 	    (aep->at_flags & AT_NODISC)? "nondisc" : "disconnecting");
 	rls_lun_statep(isp, tptr);
@@ -1196,8 +1208,8 @@ isp_handle_platform_atio2(struct ispsoftc *isp, at2_entry_t *aep)
 
 	xpt_done((union ccb*)atiop);
 	isp_prt(isp, ISP_LOGTDEBUG2,
-	    "ATIO2 RX_ID 0x%x CDB=0x%x iid%d->lun%d tattr 0x%x datalen %u",
-	    aep->at_rxid & 0xffff, aep->at_cdb[0] & 0xff, aep->at_iid,
+	    "ATIO2[%x] CDB=0x%x iid%d->lun%d tattr 0x%x datalen %u",
+	    aep->at_rxid, aep->at_cdb[0] & 0xff, aep->at_iid,
 	    lun, aep->at_taskflags, aep->at_datalen);
 	rls_lun_statep(isp, tptr);
 	return (0);
@@ -1213,9 +1225,9 @@ isp_handle_platform_ctio(struct ispsoftc *isp, void *arg)
 	 * CTIO and CTIO2 are close enough....
 	 */
 
-	ccb = (union ccb *) isp_find_xs(isp, ((ct_entry_t *)arg)->ct_reserved);
+	ccb = (union ccb *) isp_find_xs(isp, ((ct_entry_t *)arg)->ct_syshandle);
 	KASSERT((ccb != NULL), ("null ccb in isp_handle_platform_ctio"));
-	isp_destroy_handle(isp, ((ct_entry_t *)arg)->ct_reserved);
+	isp_destroy_handle(isp, ((ct_entry_t *)arg)->ct_syshandle);
 
 	if (IS_FC(isp)) {
 		ct2_entry_t *ct = arg;
@@ -1225,7 +1237,7 @@ isp_handle_platform_ctio(struct ispsoftc *isp, void *arg)
 			ccb->ccb_h.status |= CAM_SENT_SENSE;
 		}
 		isp_prt(isp, ISP_LOGTDEBUG2,
-		    "CTIO2 RX_ID 0x%x sts 0x%x flg 0x%x sns %d FIN",
+		    "CTIO2[%x] sts 0x%x flg 0x%x sns %d FIN",
 		    ct->ct_rxid, ct->ct_status, ct->ct_flags,
 		    (ccb->ccb_h.status & CAM_SENT_SENSE) != 0);
 		notify_cam = ct->ct_header.rqs_seqno;
@@ -1885,7 +1897,12 @@ isp_action(struct cam_sim *sim, union ccb *ccb)
 
 		cpi->version_num = 1;
 #ifdef	ISP_TARGET_MODE
-		cpi->target_sprt = PIT_PROCESSOR | PIT_DISCONNECT | PIT_TERM_IO;
+		/* XXX: we don't support 2nd bus target mode yet */
+		if (cam_sim_bus(sim) == 0)
+			cpi->target_sprt =
+			    PIT_PROCESSOR | PIT_DISCONNECT | PIT_TERM_IO;
+		else
+			cpi->target_sprt = 0;
 #else
 		cpi->target_sprt = 0;
 #endif
diff --git a/sys/dev/isp/isp_inline.h b/sys/dev/isp/isp_inline.h
index cd7bd3d..4417d36 100644
--- a/sys/dev/isp/isp_inline.h
+++ b/sys/dev/isp/isp_inline.h
@@ -2,7 +2,7 @@
 /*
  * Qlogic Host Adapter Inline Functions
  *
- * Copyright (c) 1999, 2000 by Matthew Jacob
+ * Copyright (c) 1999, 2000, 2001 by Matthew Jacob
  * Feral Software
  * All rights reserved.
  * mjacob@feral.com
@@ -40,19 +40,19 @@
  */
 
 static INLINE int
-isp_save_xs __P((struct ispsoftc *, XS_T *, u_int32_t *));
+isp_save_xs __P((struct ispsoftc *, XS_T *, u_int16_t *));
 
 static INLINE XS_T *
-isp_find_xs __P((struct ispsoftc *, u_int32_t));
+isp_find_xs __P((struct ispsoftc *, u_int16_t));
 
-static INLINE u_int32_t
+static INLINE u_int16_t
 isp_find_handle __P((struct ispsoftc *, XS_T *));
 
 static INLINE int
-isp_handle_index __P((u_int32_t));
+isp_handle_index __P((u_int16_t));
 
 static INLINE void
-isp_destroy_handle __P((struct ispsoftc *, u_int32_t));
+isp_destroy_handle __P((struct ispsoftc *, u_int16_t));
 
 static INLINE void
 isp_remove_handle __P((struct ispsoftc *, XS_T *));
@@ -61,7 +61,7 @@ static INLINE int
 isp_save_xs(isp, xs, handlep)
 	struct ispsoftc *isp;
 	XS_T *xs;
-	u_int32_t *handlep;
+	u_int16_t *handlep;
 {
 	int i, j;
 
@@ -87,16 +87,16 @@ isp_save_xs(isp, xs, handlep)
 static INLINE XS_T *
 isp_find_xs(isp, handle)
 	struct ispsoftc *isp;
-	u_int32_t handle;
+	u_int16_t handle;
 {
-	if (handle < 1 || handle > (u_int32_t) isp->isp_maxcmds) {
+	if (handle < 1 || handle > (u_int16_t) isp->isp_maxcmds) {
 		return (NULL);
 	} else {
 		return (isp->isp_xflist[handle - 1]);
 	}
 }
 
-static INLINE u_int32_t
+static INLINE u_int16_t
 isp_find_handle(isp, xs)
 	struct ispsoftc *isp;
 	XS_T *xs;
@@ -105,7 +105,7 @@ isp_find_handle(isp, xs)
 	if (xs != NULL) {
 		for (i = 0; i < isp->isp_maxcmds; i++) {
 			if (isp->isp_xflist[i] == xs) {
-				return ((u_int32_t) i+1);
+				return ((u_int16_t) i+1);
 			}
 		}
 	}
@@ -114,7 +114,7 @@ isp_find_handle(isp, xs)
 
 static INLINE int
 isp_handle_index(handle)
-	u_int32_t handle;
+	u_int16_t handle;
 {
 	return (handle-1);
 }
@@ -122,9 +122,9 @@ isp_handle_index(handle)
 static INLINE void
 isp_destroy_handle(isp, handle)
 	struct ispsoftc *isp;
-	u_int32_t handle;
+	u_int16_t handle;
 {
-	if (handle > 0 && handle <= (u_int32_t) isp->isp_maxcmds) {
+	if (handle > 0 && handle <= (u_int16_t) isp->isp_maxcmds) {
 		isp->isp_xflist[isp_handle_index(handle)] = NULL;
 	}
 }
diff --git a/sys/dev/isp/isp_pci.c b/sys/dev/isp/isp_pci.c
index f914bde..56b317b 100644
--- a/sys/dev/isp/isp_pci.c
+++ b/sys/dev/isp/isp_pci.c
@@ -3,7 +3,7 @@
  * PCI specific probe and attach routines for Qlogic ISP SCSI adapters.
  * FreeBSD Version.
  *
- * Copyright (c) 1997, 1998, 1999, 2000 by Matthew Jacob
+ * Copyright (c) 1997, 1998, 1999, 2000, 2001 by Matthew Jacob
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -1033,7 +1033,8 @@ tdma_mk(void *arg, bus_dma_segment_t *dm_segs, int nseg, int error)
 	bus_dmamap_t *dp;
 	u_int8_t scsi_status;
 	ct_entry_t *cto;
-	u_int32_t handle, totxfr, sflags;
+	u_int16_t handle;
+	u_int32_t totxfr, sflags;
 	int nctios, send_status;
 	int32_t resid;
 
@@ -1054,9 +1055,10 @@ tdma_mk(void *arg, bus_dma_segment_t *dm_segs, int nseg, int error)
 		cto->ct_header.rqs_seqno = 1;
 		ISP_TDQE(mp->isp, "tdma_mk[no data]", *mp->iptrp, cto);
 		isp_prt(mp->isp, ISP_LOGTDEBUG1,
-		    "CTIO lun %d->iid%d flgs 0x%x sts 0x%x ssts 0x%x res %d",
-		    csio->ccb_h.target_lun, cto->ct_iid, cto->ct_flags,
-		    cto->ct_status, cto->ct_scsi_status, cto->ct_resid);
+		    "CTIO[%x] lun%d->iid%d flgs 0x%x sts 0x%x ssts 0x%x res %d",
+		    cto->ct_fwhandle, csio->ccb_h.target_lun, cto->ct_iid,
+		    cto->ct_flags, cto->ct_status, cto->ct_scsi_status,
+		    cto->ct_resid);
 		ISP_SWIZ_CTIO(mp->isp, cto, cto);
 		return;
 	}
@@ -1067,11 +1069,11 @@ tdma_mk(void *arg, bus_dma_segment_t *dm_segs, int nseg, int error)
 	}
 
 	/*
-	 * Save handle, and potentially any SCSI status, which we'll reinsert
-	 * on the last CTIO we're going to send.
+	 * Save syshandle, and potentially any SCSI status, which we'll
+	 * reinsert on the last CTIO we're going to send.
 	 */
-	handle = cto->ct_reserved;
-	cto->ct_reserved = 0;
+	handle = cto->ct_syshandle;
+	cto->ct_syshandle = 0;
 	cto->ct_header.rqs_seqno = 0;
 	send_status = (cto->ct_flags & CT_SENDSTATUS) != 0;
 
@@ -1162,7 +1164,7 @@ tdma_mk(void *arg, bus_dma_segment_t *dm_segs, int nseg, int error)
 			 * and do whatever else we need to do to finish the
 			 * rest of the command.
 			 */
-			cto->ct_reserved = handle;
+			cto->ct_syshandle = handle;
 			cto->ct_header.rqs_seqno = 1;
 
 			if (send_status) {
@@ -1172,15 +1174,15 @@ tdma_mk(void *arg, bus_dma_segment_t *dm_segs, int nseg, int error)
 			}
 			if (send_status) {
 				isp_prt(mp->isp, ISP_LOGTDEBUG1,
-				    "CTIO lun%d for ID %d ct_flags 0x%x scsi "
-				    "status %x resid %d",
-				    csio->ccb_h.target_lun,
+				    "CTIO[%x] lun%d for ID %d ct_flags 0x%x "
+				    "scsi status %x resid %d",
+				    cto->ct_fwhandle, csio->ccb_h.target_lun,
 				    cto->ct_iid, cto->ct_flags,
 				    cto->ct_scsi_status, cto->ct_resid);
 			} else {
 				isp_prt(mp->isp, ISP_LOGTDEBUG1,
-				    "CTIO lun%d for ID%d ct_flags 0x%x",
-				    csio->ccb_h.target_lun,
+				    "CTIO[%x] lun%d for ID%d ct_flags 0x%x",
+				    cto->ct_fwhandle, csio->ccb_h.target_lun,
 				    cto->ct_iid, cto->ct_flags);
 			}
 			ISP_TDQE(mp->isp, "last tdma_mk", *mp->iptrp, cto);
@@ -1189,14 +1191,15 @@ tdma_mk(void *arg, bus_dma_segment_t *dm_segs, int nseg, int error)
 			ct_entry_t     *octo = cto;
 
 			/*
-			 * Make sure handle fields are clean
+			 * Make sure syshandle fields are clean
 			 */
-			cto->ct_reserved = 0;
+			cto->ct_syshandle = 0;
 			cto->ct_header.rqs_seqno = 0;
 
 			isp_prt(mp->isp, ISP_LOGTDEBUG1,
-			    "CTIO lun%d for ID%d ct_flags 0x%x",
-			    csio->ccb_h.target_lun, cto->ct_iid, cto->ct_flags);
+			    "CTIO[%x] lun%d for ID%d ct_flags 0x%x",
+			    cto->ct_fwhandle, csio->ccb_h.target_lun,
+			    cto->ct_iid, cto->ct_flags);
 			ISP_TDQE(mp->isp, "tdma_mk", *mp->iptrp, cto);
 
 			/*
@@ -1207,7 +1210,7 @@ tdma_mk(void *arg, bus_dma_segment_t *dm_segs, int nseg, int error)
 			*mp->iptrp = 
 			    ISP_NXT_QENTRY(*mp->iptrp, RQUEST_QUEUE_LEN(isp));
 			if (*mp->iptrp == mp->optr) {
-				isp_prt(mp->isp, ISP_LOGWARN,
+				isp_prt(mp->isp, ISP_LOGTDEBUG0,
 				    "Queue Overflow in tdma_mk");
 				mp->error = MUSHERR_NOQENTRIES;
 				return;
@@ -1217,6 +1220,7 @@ tdma_mk(void *arg, bus_dma_segment_t *dm_segs, int nseg, int error)
 			 */
 			cto->ct_header.rqs_entry_type = RQSTYPE_CTIO;
 			cto->ct_header.rqs_entry_count = 1;
+			cto->ct_fwhandle = octo->ct_fwhandle;
 			cto->ct_header.rqs_flags = 0;
 			cto->ct_lun = octo->ct_lun;
 			cto->ct_iid = octo->ct_iid;
@@ -1249,8 +1253,8 @@ tdma_mkfc(void *arg, bus_dma_segment_t *dm_segs, int nseg, int error)
 	struct isp_pcisoftc *pci;
 	bus_dmamap_t *dp;
 	ct2_entry_t *cto;
-	u_int16_t scsi_status, send_status, send_sense;
-	u_int32_t handle, totxfr, datalen;
+	u_int16_t scsi_status, send_status, send_sense, handle;
+	u_int32_t totxfr, datalen;
 	u_int8_t sense[QLTM_SENSELEN];
 	int nctios;
 
@@ -1273,7 +1277,7 @@ tdma_mkfc(void *arg, bus_dma_segment_t *dm_segs, int nseg, int error)
 		}
 	 	cto->ct_header.rqs_entry_count = 1;
 		cto->ct_header.rqs_seqno = 1;
-		/* ct_reserved contains the handle set by caller */
+		/* ct_syshandle contains the handle set by caller */
 		/*
 		 * We preserve ct_lun, ct_iid, ct_rxid. We set the data
 		 * flags to NO DATA and clear relative offset flags.
@@ -1288,7 +1292,7 @@ tdma_mkfc(void *arg, bus_dma_segment_t *dm_segs, int nseg, int error)
 		cto->ct_reloff = 0;
 		ISP_TDQE(mp->isp, "dma2_tgt_fc[no data]", *mp->iptrp, cto);
 		isp_prt(mp->isp, ISP_LOGTDEBUG1,
-		    "CTIO2 RX_ID 0x%x lun %d->iid%d flgs 0x%x sts 0x%x ssts "
+		    "CTIO2[%x] lun %d->iid%d flgs 0x%x sts 0x%x ssts "
 		    "0x%x res %d", cto->ct_rxid, csio->ccb_h.target_lun,
 		    cto->ct_iid, cto->ct_flags, cto->ct_status,
 		    cto->rsp.m1.ct_scsi_status, cto->ct_resid);
@@ -1321,8 +1325,8 @@ tdma_mkfc(void *arg, bus_dma_segment_t *dm_segs, int nseg, int error)
 	 * of order).
 	 */
 
-	handle = cto->ct_reserved;
-	cto->ct_reserved = 0;
+	handle = cto->ct_syshandle;
+	cto->ct_syshandle = 0;
 
 	if ((send_status = (cto->ct_flags & CT2_SENDSTATUS)) != 0) {
 		cto->ct_flags &= ~CT2_SENDSTATUS;
@@ -1424,7 +1428,7 @@ tdma_mkfc(void *arg, bus_dma_segment_t *dm_segs, int nseg, int error)
 			 * of the command.
 			 */
 
-			cto->ct_reserved = handle;
+			cto->ct_syshandle = handle;
 			cto->ct_header.rqs_seqno = 1;
 
 			if (send_status) {
@@ -1456,7 +1460,7 @@ tdma_mkfc(void *arg, bus_dma_segment_t *dm_segs, int nseg, int error)
 			}
 			ISP_TDQE(mp->isp, "last dma2_tgt_fc", *mp->iptrp, cto);
 			isp_prt(mp->isp, ISP_LOGTDEBUG1,
-			    "CTIO2 RX_ID 0x%x lun %d->iid%d flgs 0x%x sts 0x%x"
+			    "CTIO2[%x] lun %d->iid%d flgs 0x%x sts 0x%x"
 			    " ssts 0x%x res %d", cto->ct_rxid,
 			    csio->ccb_h.target_lun, (int) cto->ct_iid,
 			    cto->ct_flags, cto->ct_status,
@@ -1468,12 +1472,12 @@ tdma_mkfc(void *arg, bus_dma_segment_t *dm_segs, int nseg, int error)
 			/*
 			 * Make sure handle fields are clean
 			 */
-			cto->ct_reserved = 0;
+			cto->ct_syshandle = 0;
 			cto->ct_header.rqs_seqno = 0;
 
 			ISP_TDQE(mp->isp, "dma2_tgt_fc", *mp->iptrp, cto);
 			isp_prt(mp->isp, ISP_LOGTDEBUG1,
-			    "CTIO2 RX_ID 0x%x lun %d->iid%d flgs 0x%x",
+			    "CTIO2[%x] lun %d->iid%d flgs 0x%x",
 			    cto->ct_rxid, csio->ccb_h.target_lun,
 			    (int) cto->ct_iid, cto->ct_flags);
 			/*
@@ -1496,7 +1500,8 @@ tdma_mkfc(void *arg, bus_dma_segment_t *dm_segs, int nseg, int error)
 			cto->ct_header.rqs_entry_type = RQSTYPE_CTIO2;
 			cto->ct_header.rqs_entry_count = 1;
 			cto->ct_header.rqs_flags = 0;
-			/* ct_header.rqs_seqno && ct_reserved done later */
+			/* ct_header.rqs_seqno && ct_syshandle done later */
+			cto->ct_fwhandle = octo->ct_fwhandle;
 			cto->ct_lun = octo->ct_lun;
 			cto->ct_iid = octo->ct_iid;
 			cto->ct_rxid = octo->ct_rxid;
diff --git a/sys/dev/isp/isp_target.c b/sys/dev/isp/isp_target.c
index b0f7245..51b78fb8 100644
--- a/sys/dev/isp/isp_target.c
+++ b/sys/dev/isp/isp_target.c
@@ -2,7 +2,7 @@
 /*
  * Machine and OS Independent Target Mode Code for the Qlogic SCSI/FC adapters.
  *
- * Copyright (c) 1999, 2000 by Matthew Jacob
+ * Copyright (c) 1999, 2000, 2001 by Matthew Jacob
  * All rights reserved.
  * mjacob@feral.com
  *
@@ -420,7 +420,7 @@ isp_target_put_atio(isp, iid, tgt, lun, ttype, tval)
  */
 
 int
-isp_endcmd(struct ispsoftc *isp, void *arg, u_int32_t code, u_int32_t hdl)
+isp_endcmd(struct ispsoftc *isp, void *arg, u_int32_t code, u_int16_t hdl)
 {
 	int sts;
 	union {
@@ -467,6 +467,7 @@ isp_endcmd(struct ispsoftc *isp, void *arg, u_int32_t code, u_int32_t hdl)
 
 		cto->ct_header.rqs_entry_type = RQSTYPE_CTIO;
 		cto->ct_header.rqs_entry_count = 1;
+		cto->ct_fwhandle = aep->at_handle;
 		cto->ct_iid = aep->at_iid;
 		cto->ct_tgt = aep->at_tgt;
 		cto->ct_lun = aep->at_lun;
diff --git a/sys/dev/isp/isp_target.h b/sys/dev/isp/isp_target.h
index 8600024..93b2626 100644
--- a/sys/dev/isp/isp_target.h
+++ b/sys/dev/isp/isp_target.h
@@ -7,7 +7,7 @@
  * pms@psconsult.com
  * All rights reserved.
  *
- * Additional Copyright (c) 1999< 2000
+ * Additional Copyright (c) 1999, 2000, 2001
  * Matthew Jacob
  * mjacob@feral.com
  * All rights reserved.
@@ -212,7 +212,8 @@ typedef struct {
 
 typedef struct {
 	isphdr_t	at_header;
-	u_int32_t	at_reserved;
+	u_int16_t	at_reserved;
+	u_int16_t	at_handle;
 	u_int8_t	at_lun;		/* lun */
 	u_int8_t	at_iid;		/* initiator */
 	u_int8_t	at_cdblen; 	/* cdb length */
@@ -285,7 +286,9 @@ typedef struct {
  */
 typedef struct {
 	isphdr_t	ct_header;
-	u_int32_t	ct_reserved;
+	u_int16_t	ct_reserved;
+#define	ct_syshandle	ct_reserved	/* we use this */
+	u_int16_t	ct_fwhandle;	/* required by f/w */
 	u_int8_t	ct_lun;	/* lun */
 	u_int8_t	ct_iid;	/* initiator id */
 	u_int8_t	ct_reserved2;
@@ -375,7 +378,8 @@ typedef struct {
 #define	MAXRESPLEN	26
 typedef struct {
 	isphdr_t	ct_header;
-	u_int32_t	ct_reserved;
+	u_int16_t	ct_reserved;
+	u_int16_t	ct_fwhandle;	/* just to match CTIO */
 	u_int8_t	ct_lun;	/* lun */
 	u_int8_t	ct_iid;	/* initiator id */
 	u_int16_t	ct_rxid; /* response ID */
@@ -495,7 +499,7 @@ typedef struct {
 		vdst = dest;						\
 	}								\
 	vdst->at_header = source->at_header;				\
-	vdst->at_reserved2 = source->at_reserved2;			\
+	vdst->at_reserved = source->at_reserved;			\
 	ISP_SBUS_SWOZZLE(isp, source, vdst, at_lun, at_iid);		\
 	ISP_SBUS_SWOZZLE(isp, source, vdst, at_cdblen, at_tgt);		\
 	vdst->at_flags = source->at_flags;				\
@@ -517,6 +521,7 @@ typedef struct {
 	}								\
 	vdst->ct_header = source->ct_header;				\
 	vdst->ct_reserved = source->ct_reserved;			\
+	vdst->ct_fwhandle = source->ct_fwhandle;			\
 	ISP_SBUS_SWOZZLE(isp, source, vdst, ct_lun, ct_iid);		\
 	ISP_SBUS_SWOZZLE(isp, source, vdst, ct_rsvd, ct_tgt);		\
 	vdst->ct_flags = source->ct_flags;				\
@@ -647,7 +652,7 @@ isp_target_put_atio __P((struct ispsoftc *, int, int, int, int, int));
  * local responses.
  */
 int
-isp_endcmd __P((struct ispsoftc *, void *, u_int32_t, u_int32_t));
+isp_endcmd __P((struct ispsoftc *, void *, u_int32_t, u_int16_t));
 #define	ECMD_SVALID	0x100
 
 /*