xref: /freebsd/sys/dev/firewire/sbp.c (revision d15f2551b25f79ddcbe289faa95e655100b952da)
1 /*-
2  * SPDX-License-Identifier: BSD-4-Clause
3  *
4  * Copyright (c) 2003 Hidetoshi Shimokawa
5  * Copyright (c) 1998-2002 Katsushi Kobayashi and Hidetoshi Shimokawa
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. All advertising materials mentioning features or use of this software
17  *    must display the acknowledgement as bellow:
18  *
19  *    This product includes software developed by K. Kobayashi and H. Shimokawa
20  *
21  * 4. The name of the author may not be used to endorse or promote products
22  *    derived from this software without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
25  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
26  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
27  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
28  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
29  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
30  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
32  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
33  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
34  * POSSIBILITY OF SUCH DAMAGE.
35  *
36  */
37 
38 #include <sys/param.h>
39 #include <sys/systm.h>
40 #include <sys/module.h>
41 #include <sys/bus.h>
42 #include <sys/kernel.h>
43 #include <sys/sysctl.h>
44 #include <machine/bus.h>
45 #include <sys/malloc.h>
46 #include <sys/lock.h>
47 #include <sys/mutex.h>
48 
49 #include <cam/cam.h>
50 #include <cam/cam_ccb.h>
51 #include <cam/cam_sim.h>
52 #include <cam/cam_xpt_sim.h>
53 #include <cam/cam_debug.h>
54 #include <cam/cam_periph.h>
55 #include <cam/scsi/scsi_all.h>
56 
57 #include <dev/firewire/firewire.h>
58 #include <dev/firewire/firewirereg.h>
59 #include <dev/firewire/fwdma.h>
60 #include <dev/firewire/iec13213.h>
61 #include <dev/firewire/sbp.h>
62 
63 #define ccb_sdev_ptr	spriv_ptr0
64 #define ccb_sbp_ptr	spriv_ptr1
65 
66 #define SBP_NUM_TARGETS 8 /* MAX 64 */
67 /*
68  * Scan_bus doesn't work for more than 8 LUNs
69  * because of CAM_SCSI2_MAXLUN in cam_xpt.c
70  */
71 #define SBP_NUM_LUNS 64
72 #define SBP_MAXPHYS  (128 * 1024)
73 #define SBP_DMA_SIZE PAGE_SIZE
74 #define SBP_LOGIN_SIZE sizeof(struct sbp_login_res)
75 #define SBP_QUEUE_LEN ((SBP_DMA_SIZE - SBP_LOGIN_SIZE) / sizeof(struct sbp_ocb))
76 #define SBP_NUM_OCB (SBP_QUEUE_LEN * SBP_NUM_TARGETS)
77 #define SBP_MAX_XFER 5		/* max concurrent xfers per target */
78 
79 /*
80  * STATUS FIFO addressing
81  *   bit
82  *-----------------------
83  *  0- 1( 2): 0 (alignment)
84  *  2- 7( 6): target
85  *  8-15( 8): lun
86  * 16-31( 8): reserved
87  * 32-47(16): SBP_BIND_HI
88  * 48-64(16): bus_id, node_id
89  */
90 #define SBP_BIND_HI 0x1
91 #define SBP_DEV2ADDR(t, l) \
92 	(((u_int64_t)SBP_BIND_HI << 32) \
93 	| (((l) & 0xff) << 8) \
94 	| (((t) & 0x3f) << 2))
95 #define SBP_ADDR2TRG(a)	(((a) >> 2) & 0x3f)
96 #define SBP_ADDR2LUN(a)	(((a) >> 8) & 0xff)
97 #define SBP_INITIATOR 7
98 
99 static char *orb_fun_name[] = {
100 	ORB_FUN_NAMES
101 };
102 
103 static int debug = 0;
104 static int auto_login = 1;
105 static int max_speed = -1;
106 static int sbp_cold = 1;
107 static int ex_login = 1;
108 static int login_delay = 1000;	/* msec */
109 static int scan_delay = 500;	/* msec */
110 static int use_doorbell = 0;
111 static int sbp_tags = 0;
112 
113 SYSCTL_DECL(_hw_firewire);
114 static SYSCTL_NODE(_hw_firewire, OID_AUTO, sbp, CTLFLAG_RD | CTLFLAG_MPSAFE, 0,
115     "SBP-II Subsystem");
116 SYSCTL_INT(_debug, OID_AUTO, sbp_debug, CTLFLAG_RWTUN, &debug, 0,
117 	"SBP debug flag");
118 SYSCTL_INT(_hw_firewire_sbp, OID_AUTO, auto_login, CTLFLAG_RWTUN, &auto_login, 0,
119 	"SBP perform login automatically");
120 SYSCTL_INT(_hw_firewire_sbp, OID_AUTO, max_speed, CTLFLAG_RWTUN, &max_speed, 0,
121 	"SBP transfer max speed");
122 SYSCTL_INT(_hw_firewire_sbp, OID_AUTO, exclusive_login, CTLFLAG_RWTUN,
123 	&ex_login, 0, "SBP enable exclusive login");
124 SYSCTL_INT(_hw_firewire_sbp, OID_AUTO, login_delay, CTLFLAG_RWTUN,
125 	&login_delay, 0, "SBP login delay in msec");
126 SYSCTL_INT(_hw_firewire_sbp, OID_AUTO, scan_delay, CTLFLAG_RWTUN,
127 	&scan_delay, 0, "SBP scan delay in msec");
128 SYSCTL_INT(_hw_firewire_sbp, OID_AUTO, use_doorbell, CTLFLAG_RWTUN,
129 	&use_doorbell, 0, "SBP use doorbell request");
130 SYSCTL_INT(_hw_firewire_sbp, OID_AUTO, tags, CTLFLAG_RWTUN, &sbp_tags, 0,
131 	"SBP tagged queuing support");
132 
133 #define NEED_RESPONSE 0
134 
135 #define SBP_SEG_MAX rounddown(0xffff, PAGE_SIZE)
136 #define SBP_IND_MAX howmany(SBP_MAXPHYS, PAGE_SIZE)
137 struct sbp_ocb {
138 	STAILQ_ENTRY(sbp_ocb)	ocb;
139 	union ccb	*ccb;
140 	bus_addr_t	bus_addr;
141 	uint32_t	orb[8];
142 #define IND_PTR_OFFSET	(8*sizeof(uint32_t))
143 	struct ind_ptr  ind_ptr[SBP_IND_MAX];
144 	struct sbp_dev	*sdev;
145 	int		flags; /* XXX should be removed */
146 	bus_dmamap_t	dmamap;
147 	struct callout	timer;
148 };
149 
150 #define OCB_ACT_MGM 0
151 #define OCB_ACT_CMD 1
152 #define OCB_MATCH(o,s)	((o)->bus_addr == ntohl((s)->orb_lo))
153 
154 struct sbp_dev {
155 #define SBP_DEV_RESET		0	/* accept login */
156 #define SBP_DEV_LOGIN		1	/* to login */
157 #define SBP_DEV_TOATTACH	3	/* to attach */
158 #define SBP_DEV_PROBE		4	/* scan lun */
159 #define SBP_DEV_ATTACHED	5	/* in operation */
160 #define SBP_DEV_DEAD		6	/* unavailable unit */
161 #define SBP_DEV_RETRY		7	/* unavailable unit */
162 	uint8_t status:4,
163 		 timeout:4;
164 	uint8_t type;
165 	uint16_t lun_id;
166 	uint16_t freeze;
167 #define	ORB_LINK_DEAD		(1 << 0)
168 #define	VALID_LUN		(1 << 1)
169 #define	ORB_POINTER_ACTIVE	(1 << 2)
170 #define	ORB_POINTER_NEED	(1 << 3)
171 #define	ORB_DOORBELL_ACTIVE	(1 << 4)
172 #define	ORB_DOORBELL_NEED	(1 << 5)
173 #define	ORB_SHORTAGE		(1 << 6)
174 	uint16_t flags;
175 	struct cam_path *path;
176 	struct sbp_target *target;
177 	struct fwdma_alloc dma;
178 	struct sbp_login_res *login;
179 	struct callout login_callout;
180 	struct sbp_ocb *ocb;
181 	STAILQ_HEAD(, sbp_ocb) ocbs;
182 	STAILQ_HEAD(, sbp_ocb) free_ocbs;
183 	struct sbp_ocb *last_ocb;
184 	char vendor[32];
185 	char product[32];
186 	char revision[10];
187 	char bustgtlun[32];
188 };
189 
190 struct sbp_target {
191 	int target_id;
192 	int num_lun;
193 	struct sbp_dev	**luns;
194 	struct sbp_softc *sbp;
195 	struct fw_device *fwdev;
196 	uint32_t mgm_hi, mgm_lo;
197 	struct sbp_ocb *mgm_ocb_cur;
198 	STAILQ_HEAD(, sbp_ocb) mgm_ocb_queue;
199 	struct callout mgm_ocb_timeout;
200 	struct callout scan_callout;
201 	STAILQ_HEAD(, fw_xfer) xferlist;
202 	int n_xfer;
203 };
204 
205 struct sbp_softc {
206 	struct firewire_dev_comm fd;
207 	struct cam_sim  *sim;
208 	struct cam_path  *path;
209 	struct sbp_target targets[SBP_NUM_TARGETS];
210 	struct fw_bind fwb;
211 	bus_dma_tag_t	dmat;
212 	struct timeval last_busreset;
213 #define SIMQ_FREEZED 1
214 	int flags;
215 	struct mtx mtx;
216 };
217 #define	SBP_LOCK(sbp)		mtx_lock(&(sbp)->mtx)
218 #define	SBP_UNLOCK(sbp)		mtx_unlock(&(sbp)->mtx)
219 #define	SBP_LOCK_ASSERT(sbp)	mtx_assert(&(sbp)->mtx, MA_OWNED)
220 
221 static void sbp_post_explore (void *);
222 static void sbp_recv (struct fw_xfer *);
223 static void sbp_mgm_callback (struct fw_xfer *);
224 static void sbp_orb_pointer (struct sbp_dev *, struct sbp_ocb *);
225 static void sbp_doorbell(struct sbp_dev *);
226 static void sbp_execute_ocb (void *, bus_dma_segment_t *, int, int);
227 static void sbp_free_ocb (struct sbp_dev *, struct sbp_ocb *);
228 static void sbp_abort_ocb (struct sbp_ocb *, int);
229 static void sbp_abort_all_ocbs (struct sbp_dev *, int);
230 static struct fw_xfer * sbp_write_cmd (struct sbp_dev *, int, int);
231 static struct sbp_ocb * sbp_get_ocb (struct sbp_dev *);
232 static struct sbp_ocb * sbp_enqueue_ocb (struct sbp_dev *, struct sbp_ocb *);
233 static struct sbp_ocb * sbp_dequeue_ocb (struct sbp_dev *, struct sbp_status *);
234 static void sbp_cam_detach_sdev(struct sbp_dev *);
235 static void sbp_free_sdev(struct sbp_dev *);
236 static void sbp_cam_detach_target (struct sbp_target *);
237 static void sbp_free_target (struct sbp_target *);
238 static void sbp_mgm_timeout (void *arg);
239 static void sbp_timeout (void *arg);
240 static void sbp_mgm_orb (struct sbp_dev *, int, struct sbp_ocb *);
241 
242 static MALLOC_DEFINE(M_SBP, "sbp", "SBP-II/FireWire");
243 
244 /* cam related functions */
245 static void	sbp_action(struct cam_sim *sim, union ccb *ccb);
246 static void	sbp_poll(struct cam_sim *sim);
247 static void	sbp_cam_scan_lun(struct cam_periph *, union ccb *);
248 static void	sbp_cam_scan_target(void *arg);
249 
250 static char *orb_status0[] = {
251 	/* 0 */ "No additional information to report",
252 	/* 1 */ "Request type not supported",
253 	/* 2 */ "Speed not supported",
254 	/* 3 */ "Page size not supported",
255 	/* 4 */ "Access denied",
256 	/* 5 */ "Logical unit not supported",
257 	/* 6 */ "Maximum payload too small",
258 	/* 7 */ "Reserved for future standardization",
259 	/* 8 */ "Resources unavailable",
260 	/* 9 */ "Function rejected",
261 	/* A */ "Login ID not recognized",
262 	/* B */ "Dummy ORB completed",
263 	/* C */ "Request aborted",
264 	/* FF */ "Unspecified error"
265 #define MAX_ORB_STATUS0 0xd
266 };
267 
268 static char *orb_status1_object[] = {
269 	/* 0 */ "Operation request block (ORB)",
270 	/* 1 */ "Data buffer",
271 	/* 2 */ "Page table",
272 	/* 3 */ "Unable to specify"
273 };
274 
275 static char *orb_status1_serial_bus_error[] = {
276 	/* 0 */ "Missing acknowledge",
277 	/* 1 */ "Reserved; not to be used",
278 	/* 2 */ "Time-out error",
279 	/* 3 */ "Reserved; not to be used",
280 	/* 4 */ "Busy retry limit exceeded(X)",
281 	/* 5 */ "Busy retry limit exceeded(A)",
282 	/* 6 */ "Busy retry limit exceeded(B)",
283 	/* 7 */ "Reserved for future standardization",
284 	/* 8 */ "Reserved for future standardization",
285 	/* 9 */ "Reserved for future standardization",
286 	/* A */ "Reserved for future standardization",
287 	/* B */ "Tardy retry limit exceeded",
288 	/* C */ "Conflict error",
289 	/* D */ "Data error",
290 	/* E */ "Type error",
291 	/* F */ "Address error"
292 };
293 
294 static void
295 sbp_identify(driver_t *driver, device_t parent)
296 {
297 SBP_DEBUG(0)
298 	printf("sbp_identify\n");
299 END_DEBUG
300 
301 	if (device_find_child(parent, "sbp", DEVICE_UNIT_ANY) == NULL)
302 		BUS_ADD_CHILD(parent, 0, "sbp", DEVICE_UNIT_ANY);
303 }
304 
305 /*
306  * sbp_probe()
307  */
308 static int
309 sbp_probe(device_t dev)
310 {
311 
312 SBP_DEBUG(0)
313 	printf("sbp_probe\n");
314 END_DEBUG
315 
316 	if (fw_get_unit(dev) != NULL)
317 		return (ENXIO);
318 
319 	device_set_desc(dev, "SBP-2/SCSI over FireWire");
320 
321 	return (0);
322 }
323 
324 /*
325  * Display device characteristics on the console
326  */
327 static void
328 sbp_show_sdev_info(struct sbp_dev *sdev)
329 {
330 	struct fw_device *fwdev;
331 
332 	fwdev = sdev->target->fwdev;
333 	device_printf(sdev->target->sbp->fd.dev,
334 		"%s: %s: ordered:%d type:%d EUI:%08x%08x node:%d "
335 		"speed:%d maxrec:%d\n",
336 		__func__,
337 		sdev->bustgtlun,
338 		(sdev->type & 0x40) >> 6,
339 		(sdev->type & 0x1f),
340 		fwdev->eui.hi,
341 		fwdev->eui.lo,
342 		fwdev->dst,
343 		fwdev->speed,
344 		fwdev->maxrec);
345 
346 	device_printf(sdev->target->sbp->fd.dev,
347 			"%s: %s '%s' '%s' '%s'\n",
348 			__func__,
349 			sdev->bustgtlun,
350 			sdev->vendor,
351 			sdev->product,
352 			sdev->revision);
353 }
354 
355 static struct {
356 	int bus;
357 	int target;
358 	struct fw_eui64 eui;
359 } wired[] = {
360 	/* Bus	Target	EUI64 */
361 	{-1,	-1,	{0,0}}
362 };
363 
364 static int
365 sbp_new_target(struct sbp_softc *sbp, struct fw_device *fwdev)
366 {
367 	int bus, i, target=-1;
368 	char w[SBP_NUM_TARGETS];
369 
370 	bzero(w, sizeof(w));
371 	bus = device_get_unit(sbp->fd.dev);
372 
373 	/* XXX wired-down configuration should be gotten from
374 					tunable or device hint */
375 	for (i = 0; wired[i].bus >= 0; i++) {
376 		if (wired[i].bus == bus) {
377 			w[wired[i].target] = 1;
378 			if (wired[i].eui.hi == fwdev->eui.hi &&
379 					wired[i].eui.lo == fwdev->eui.lo)
380 				target = wired[i].target;
381 		}
382 	}
383 	if (target >= 0) {
384 		if (target < SBP_NUM_TARGETS &&
385 				sbp->targets[target].fwdev == NULL)
386 			return (target);
387 		device_printf(sbp->fd.dev,
388 			"target %d is not free for %08x:%08x\n",
389 			target, fwdev->eui.hi, fwdev->eui.lo);
390 		target = -1;
391 	}
392 	/* non-wired target */
393 	for (i = 0; i < SBP_NUM_TARGETS; i++)
394 		if (sbp->targets[i].fwdev == NULL && w[i] == 0) {
395 			target = i;
396 			break;
397 		}
398 
399 	return target;
400 }
401 
402 static void
403 sbp_alloc_lun(struct sbp_target *target)
404 {
405 	struct crom_context cc;
406 	struct csrreg *reg;
407 	struct sbp_dev *sdev, **newluns;
408 	struct sbp_softc *sbp;
409 	int maxlun, lun, i;
410 
411 	sbp = target->sbp;
412 	crom_init_context(&cc, target->fwdev->csrrom);
413 	/* XXX shoud parse appropriate unit directories only */
414 	maxlun = -1;
415 	while (cc.depth >= 0) {
416 		reg = crom_search_key(&cc, CROM_LUN);
417 		if (reg == NULL)
418 			break;
419 		lun = reg->val & 0xffff;
420 SBP_DEBUG(0)
421 		printf("target %d lun %d found\n", target->target_id, lun);
422 END_DEBUG
423 		if (maxlun < lun)
424 			maxlun = lun;
425 		crom_next(&cc);
426 	}
427 	if (maxlun < 0)
428 		device_printf(target->sbp->fd.dev, "%d no LUN found\n",
429 		    target->target_id);
430 
431 	maxlun++;
432 	if (maxlun >= SBP_NUM_LUNS)
433 		maxlun = SBP_NUM_LUNS;
434 
435 	/* Invalidiate stale devices */
436 	for (lun = 0; lun < target->num_lun; lun++) {
437 		sdev = target->luns[lun];
438 		if (sdev == NULL)
439 			continue;
440 		sdev->flags &= ~VALID_LUN;
441 		if (lun >= maxlun) {
442 			/* lost device */
443 			sbp_cam_detach_sdev(sdev);
444 			sbp_free_sdev(sdev);
445 			target->luns[lun] = NULL;
446 		}
447 	}
448 
449 	/* Reallocate */
450 	if (maxlun != target->num_lun) {
451 		newluns = (struct sbp_dev **) realloc(target->luns,
452 		    sizeof(struct sbp_dev *) * maxlun,
453 		    M_SBP, M_NOWAIT | M_ZERO);
454 
455 		if (newluns == NULL) {
456 			printf("%s: realloc failed\n", __func__);
457 			newluns = target->luns;
458 			maxlun = target->num_lun;
459 		}
460 
461 		/*
462 		 * We must zero the extended region for the case
463 		 * realloc() doesn't allocate new buffer.
464 		 */
465 		if (maxlun > target->num_lun)
466 			bzero(&newluns[target->num_lun],
467 			    sizeof(struct sbp_dev *) *
468 			    (maxlun - target->num_lun));
469 
470 		target->luns = newluns;
471 		target->num_lun = maxlun;
472 	}
473 
474 	crom_init_context(&cc, target->fwdev->csrrom);
475 	while (cc.depth >= 0) {
476 		int new = 0;
477 
478 		reg = crom_search_key(&cc, CROM_LUN);
479 		if (reg == NULL)
480 			break;
481 		lun = reg->val & 0xffff;
482 		if (lun >= SBP_NUM_LUNS) {
483 			printf("too large lun %d\n", lun);
484 			goto next;
485 		}
486 
487 		sdev = target->luns[lun];
488 		if (sdev == NULL) {
489 			sdev = malloc(sizeof(struct sbp_dev),
490 			    M_SBP, M_NOWAIT | M_ZERO);
491 			if (sdev == NULL) {
492 				printf("%s: malloc failed\n", __func__);
493 				goto next;
494 			}
495 			target->luns[lun] = sdev;
496 			sdev->lun_id = lun;
497 			sdev->target = target;
498 			STAILQ_INIT(&sdev->ocbs);
499 			callout_init_mtx(&sdev->login_callout, &sbp->mtx, 0);
500 			sdev->status = SBP_DEV_RESET;
501 			new = 1;
502 			snprintf(sdev->bustgtlun, 32, "%s:%d:%d",
503 					device_get_nameunit(sdev->target->sbp->fd.dev),
504 					sdev->target->target_id,
505 					sdev->lun_id);
506 		}
507 		sdev->flags |= VALID_LUN;
508 		sdev->type = (reg->val & 0xff0000) >> 16;
509 
510 		if (new == 0)
511 			goto next;
512 
513 		fwdma_malloc(sbp->fd.fc,
514 			/* alignment */ sizeof(uint32_t),
515 			SBP_DMA_SIZE, &sdev->dma, BUS_DMA_NOWAIT |
516 			BUS_DMA_COHERENT);
517 		if (sdev->dma.v_addr == NULL) {
518 			printf("%s: dma space allocation failed\n",
519 							__func__);
520 			free(sdev, M_SBP);
521 			target->luns[lun] = NULL;
522 			goto next;
523 		}
524 		sdev->login = (struct sbp_login_res *) sdev->dma.v_addr;
525 		sdev->ocb = (struct sbp_ocb *)
526 				((char *)sdev->dma.v_addr + SBP_LOGIN_SIZE);
527 		bzero((char *)sdev->ocb,
528 			sizeof(struct sbp_ocb) * SBP_QUEUE_LEN);
529 
530 		STAILQ_INIT(&sdev->free_ocbs);
531 		for (i = 0; i < SBP_QUEUE_LEN; i++) {
532 			struct sbp_ocb *ocb;
533 			ocb = &sdev->ocb[i];
534 			ocb->bus_addr = sdev->dma.bus_addr
535 				+ SBP_LOGIN_SIZE
536 				+ sizeof(struct sbp_ocb) * i
537 				+ offsetof(struct sbp_ocb, orb[0]);
538 			if (bus_dmamap_create(sbp->dmat, 0, &ocb->dmamap)) {
539 				printf("sbp_attach: cannot create dmamap\n");
540 				/* XXX */
541 				goto next;
542 			}
543 			callout_init_mtx(&ocb->timer, &sbp->mtx, 0);
544 			SBP_LOCK(sbp);
545 			sbp_free_ocb(sdev, ocb);
546 			SBP_UNLOCK(sbp);
547 		}
548 next:
549 		crom_next(&cc);
550 	}
551 
552 	for (lun = 0; lun < target->num_lun; lun++) {
553 		sdev = target->luns[lun];
554 		if (sdev != NULL && (sdev->flags & VALID_LUN) == 0) {
555 			sbp_cam_detach_sdev(sdev);
556 			sbp_free_sdev(sdev);
557 			target->luns[lun] = NULL;
558 		}
559 	}
560 }
561 
562 static struct sbp_target *
563 sbp_alloc_target(struct sbp_softc *sbp, struct fw_device *fwdev)
564 {
565 	int i;
566 	struct sbp_target *target;
567 	struct crom_context cc;
568 	struct csrreg *reg;
569 
570 SBP_DEBUG(1)
571 	printf("sbp_alloc_target\n");
572 END_DEBUG
573 	i = sbp_new_target(sbp, fwdev);
574 	if (i < 0) {
575 		device_printf(sbp->fd.dev, "increase SBP_NUM_TARGETS!\n");
576 		return NULL;
577 	}
578 	/* new target */
579 	target = &sbp->targets[i];
580 	target->fwdev = fwdev;
581 	target->target_id = i;
582 	/* XXX we may want to reload mgm port after each bus reset */
583 	/* XXX there might be multiple management agents */
584 	crom_init_context(&cc, target->fwdev->csrrom);
585 	reg = crom_search_key(&cc, CROM_MGM);
586 	if (reg == NULL || reg->val == 0) {
587 		printf("NULL management address\n");
588 		target->fwdev = NULL;
589 		return NULL;
590 	}
591 	target->mgm_hi = 0xffff;
592 	target->mgm_lo = 0xf0000000 | (reg->val << 2);
593 	target->mgm_ocb_cur = NULL;
594 SBP_DEBUG(1)
595 	printf("target:%d mgm_port: %x\n", i, target->mgm_lo);
596 END_DEBUG
597 	STAILQ_INIT(&target->xferlist);
598 	target->n_xfer = 0;
599 	STAILQ_INIT(&target->mgm_ocb_queue);
600 	callout_init_mtx(&target->mgm_ocb_timeout, &sbp->mtx, 0);
601 	callout_init_mtx(&target->scan_callout, &sbp->mtx, 0);
602 
603 	target->luns = NULL;
604 	target->num_lun = 0;
605 	return target;
606 }
607 
608 static void
609 sbp_probe_lun(struct sbp_dev *sdev)
610 {
611 	struct fw_device *fwdev;
612 	struct crom_context c, *cc = &c;
613 	struct csrreg *reg;
614 
615 	bzero(sdev->vendor, sizeof(sdev->vendor));
616 	bzero(sdev->product, sizeof(sdev->product));
617 
618 	fwdev = sdev->target->fwdev;
619 	crom_init_context(cc, fwdev->csrrom);
620 	/* get vendor string */
621 	crom_search_key(cc, CSRKEY_VENDOR);
622 	crom_next(cc);
623 	crom_parse_text(cc, sdev->vendor, sizeof(sdev->vendor));
624 	/* skip to the unit directory for SBP-2 */
625 	while ((reg = crom_search_key(cc, CSRKEY_VER)) != NULL) {
626 		if (reg->val == CSRVAL_T10SBP2)
627 			break;
628 		crom_next(cc);
629 	}
630 	/* get firmware revision */
631 	reg = crom_search_key(cc, CSRKEY_FIRM_VER);
632 	if (reg != NULL)
633 		snprintf(sdev->revision, sizeof(sdev->revision),
634 						"%06x", reg->val);
635 	/* get product string */
636 	crom_search_key(cc, CSRKEY_MODEL);
637 	crom_next(cc);
638 	crom_parse_text(cc, sdev->product, sizeof(sdev->product));
639 }
640 
641 static void
642 sbp_login_callout(void *arg)
643 {
644 	struct sbp_dev *sdev = (struct sbp_dev *)arg;
645 	SBP_LOCK_ASSERT(sdev->target->sbp);
646 	sbp_mgm_orb(sdev, ORB_FUN_LGI, NULL);
647 }
648 
649 static void
650 sbp_login(struct sbp_dev *sdev)
651 {
652 	struct timeval delta;
653 	struct timeval t;
654 	int ticks = 0;
655 
656 	microtime(&delta);
657 	timevalsub(&delta, &sdev->target->sbp->last_busreset);
658 	t.tv_sec = login_delay / 1000;
659 	t.tv_usec = (login_delay % 1000) * 1000;
660 	timevalsub(&t, &delta);
661 	if (t.tv_sec >= 0 && t.tv_usec > 0)
662 		ticks = (t.tv_sec * 1000 + t.tv_usec / 1000) * hz / 1000;
663 SBP_DEBUG(0)
664 	printf("%s: sec = %jd usec = %ld ticks = %d\n", __func__,
665 	    (intmax_t)t.tv_sec, t.tv_usec, ticks);
666 END_DEBUG
667 	callout_reset(&sdev->login_callout, ticks,
668 			sbp_login_callout, (void *)(sdev));
669 }
670 
671 #define SBP_FWDEV_ALIVE(fwdev) (((fwdev)->status == FWDEVATTACHED) \
672 	&& crom_has_specver((fwdev)->csrrom, CSRVAL_ANSIT10, CSRVAL_T10SBP2))
673 
674 static void
675 sbp_probe_target(struct sbp_target *target)
676 {
677 	struct sbp_softc *sbp = target->sbp;
678 	struct sbp_dev *sdev;
679 	int i, alive;
680 
681 	alive = SBP_FWDEV_ALIVE(target->fwdev);
682 SBP_DEBUG(1)
683 	device_printf(sbp->fd.dev, "%s %d%salive\n",
684 		 __func__, target->target_id,
685 		(!alive) ? " not " : "");
686 END_DEBUG
687 
688 	sbp_alloc_lun(target);
689 
690 	/* XXX untimeout mgm_ocb and dequeue */
691 	for (i=0; i < target->num_lun; i++) {
692 		sdev = target->luns[i];
693 		if (sdev == NULL)
694 			continue;
695 		if (alive && (sdev->status != SBP_DEV_DEAD)) {
696 			if (sdev->path != NULL) {
697 				xpt_freeze_devq(sdev->path, 1);
698 				sdev->freeze++;
699 			}
700 			sbp_probe_lun(sdev);
701 			sbp_show_sdev_info(sdev);
702 
703 			SBP_LOCK(sbp);
704 			sbp_abort_all_ocbs(sdev, CAM_SCSI_BUS_RESET);
705 			SBP_UNLOCK(sbp);
706 			switch (sdev->status) {
707 			case SBP_DEV_RESET:
708 				/* new or revived target */
709 				if (auto_login)
710 					sbp_login(sdev);
711 				break;
712 			case SBP_DEV_TOATTACH:
713 			case SBP_DEV_PROBE:
714 			case SBP_DEV_ATTACHED:
715 			case SBP_DEV_RETRY:
716 			default:
717 				sbp_mgm_orb(sdev, ORB_FUN_RCN, NULL);
718 				break;
719 			}
720 		} else {
721 			switch (sdev->status) {
722 			case SBP_DEV_ATTACHED:
723 SBP_DEBUG(0)
724 				/* the device has gone */
725 				device_printf(sbp->fd.dev, "%s: lost target\n",
726 					__func__);
727 END_DEBUG
728 				if (sdev->path) {
729 					xpt_freeze_devq(sdev->path, 1);
730 					sdev->freeze++;
731 				}
732 				sdev->status = SBP_DEV_RETRY;
733 				sbp_cam_detach_sdev(sdev);
734 				sbp_free_sdev(sdev);
735 				target->luns[i] = NULL;
736 				break;
737 			case SBP_DEV_PROBE:
738 			case SBP_DEV_TOATTACH:
739 				sdev->status = SBP_DEV_RESET;
740 				break;
741 			case SBP_DEV_RETRY:
742 			case SBP_DEV_RESET:
743 			case SBP_DEV_DEAD:
744 				break;
745 			}
746 		}
747 	}
748 }
749 
750 static void
751 sbp_post_busreset(void *arg)
752 {
753 	struct sbp_softc *sbp;
754 
755 	sbp = (struct sbp_softc *)arg;
756 SBP_DEBUG(0)
757 	printf("sbp_post_busreset\n");
758 END_DEBUG
759 	SBP_LOCK(sbp);
760 	if ((sbp->flags & SIMQ_FREEZED) == 0) {
761 		xpt_freeze_simq(sbp->sim, /*count*/1);
762 		sbp->flags |= SIMQ_FREEZED;
763 	}
764 	microtime(&sbp->last_busreset);
765 	SBP_UNLOCK(sbp);
766 }
767 
768 static void
769 sbp_post_explore(void *arg)
770 {
771 	struct sbp_softc *sbp = (struct sbp_softc *)arg;
772 	struct sbp_target *target;
773 	struct fw_device *fwdev;
774 	int i, alive;
775 
776 SBP_DEBUG(0)
777 	printf("sbp_post_explore (sbp_cold=%d)\n", sbp_cold);
778 END_DEBUG
779 	/* We need physical access */
780 	if (!firewire_phydma_enable)
781 		return;
782 
783 	if (sbp_cold > 0)
784 		sbp_cold--;
785 
786 	SBP_LOCK(sbp);
787 
788 	/* Garbage Collection */
789 	for (i = 0; i < SBP_NUM_TARGETS; i++) {
790 		target = &sbp->targets[i];
791 		if (target->fwdev == NULL)
792 			continue;
793 
794 		STAILQ_FOREACH(fwdev, &sbp->fd.fc->devices, link)
795 			if (target->fwdev == fwdev)
796 				break;
797 		if (fwdev == NULL) {
798 			/* device has removed in lower driver */
799 			sbp_cam_detach_target(target);
800 			sbp_free_target(target);
801 		}
802 	}
803 
804 	/* traverse device list */
805 	STAILQ_FOREACH(fwdev, &sbp->fd.fc->devices, link) {
806 SBP_DEBUG(0)
807 		device_printf(sbp->fd.dev,"%s:: EUI:%08x%08x %s attached, state=%d\n",
808 				__func__, fwdev->eui.hi, fwdev->eui.lo,
809 				(fwdev->status != FWDEVATTACHED) ? "not" : "",
810 				fwdev->status);
811 END_DEBUG
812 		alive = SBP_FWDEV_ALIVE(fwdev);
813 		for (i = 0; i < SBP_NUM_TARGETS; i++) {
814 			target = &sbp->targets[i];
815 			if (target->fwdev == fwdev) {
816 				/* known target */
817 				break;
818 			}
819 		}
820 		if (i == SBP_NUM_TARGETS) {
821 			if (alive) {
822 				/* new target */
823 				target = sbp_alloc_target(sbp, fwdev);
824 				if (target == NULL)
825 					continue;
826 			} else {
827 				continue;
828 			}
829 		}
830 
831 		/*
832 		 * It is safe to drop the lock here as the target is already
833 		 * reserved, so there should be no contenders for it.
834 		 * And the target is not yet exposed, so there should not be
835 		 * any other accesses to it.
836 		 * Finally, the list being iterated is protected somewhere else.
837 		 */
838 		SBP_UNLOCK(sbp);
839 		sbp_probe_target(target);
840 		SBP_LOCK(sbp);
841 		if (target->num_lun == 0)
842 			sbp_free_target(target);
843 	}
844 	if ((sbp->flags & SIMQ_FREEZED) != 0) {
845 		xpt_release_simq(sbp->sim, /*run queue*/TRUE);
846 		sbp->flags &= ~SIMQ_FREEZED;
847 	}
848 	SBP_UNLOCK(sbp);
849 }
850 
851 #if NEED_RESPONSE
852 static void
853 sbp_loginres_callback(struct fw_xfer *xfer)
854 {
855 	struct sbp_dev *sdev;
856 	sdev = (struct sbp_dev *)xfer->sc;
857 SBP_DEBUG(1)
858 	device_printf(sdev->target->sbp->fd.dev,"%s\n", __func__);
859 END_DEBUG
860 	/* recycle */
861 	SBP_LOCK(sdev->target->sbp);
862 	STAILQ_INSERT_TAIL(&sdev->target->sbp->fwb.xferlist, xfer, link);
863 	SBP_UNLOCK(sdev->target->sbp);
864 	return;
865 }
866 #endif
867 
868 static __inline void
869 sbp_xfer_free(struct fw_xfer *xfer)
870 {
871 	struct sbp_dev *sdev;
872 
873 	sdev = (struct sbp_dev *)xfer->sc;
874 	fw_xfer_unload(xfer);
875 	SBP_LOCK_ASSERT(sdev->target->sbp);
876 	STAILQ_INSERT_TAIL(&sdev->target->xferlist, xfer, link);
877 }
878 
879 static void
880 sbp_reset_start_callback(struct fw_xfer *xfer)
881 {
882 	struct sbp_dev *tsdev, *sdev = (struct sbp_dev *)xfer->sc;
883 	struct sbp_target *target = sdev->target;
884 	int i;
885 
886 	if (xfer->resp != 0) {
887 		device_printf(sdev->target->sbp->fd.dev,
888 			"%s: %s failed: resp=%d\n", __func__, sdev->bustgtlun, xfer->resp);
889 	}
890 
891 	SBP_LOCK(target->sbp);
892 	for (i = 0; i < target->num_lun; i++) {
893 		tsdev = target->luns[i];
894 		if (tsdev != NULL && tsdev->status == SBP_DEV_LOGIN)
895 			sbp_login(tsdev);
896 	}
897 	SBP_UNLOCK(target->sbp);
898 }
899 
900 static void
901 sbp_reset_start(struct sbp_dev *sdev)
902 {
903 	struct fw_xfer *xfer;
904 	struct fw_pkt *fp;
905 
906 SBP_DEBUG(0)
907 	device_printf(sdev->target->sbp->fd.dev,
908 			"%s:%s\n", __func__,sdev->bustgtlun);
909 END_DEBUG
910 
911 	xfer = sbp_write_cmd(sdev, FWTCODE_WREQQ, 0);
912 	xfer->hand = sbp_reset_start_callback;
913 	fp = &xfer->send.hdr;
914 	fp->mode.wreqq.dest_hi = 0xffff;
915 	fp->mode.wreqq.dest_lo = 0xf0000000 | RESET_START;
916 	fp->mode.wreqq.data = htonl(0xf);
917 	fw_asyreq(xfer->fc, -1, xfer);
918 }
919 
920 static void
921 sbp_mgm_callback(struct fw_xfer *xfer)
922 {
923 	struct sbp_dev *sdev;
924 
925 	sdev = (struct sbp_dev *)xfer->sc;
926 
927 SBP_DEBUG(1)
928 	device_printf(sdev->target->sbp->fd.dev,
929 		"%s:%s\n", __func__, sdev->bustgtlun);
930 END_DEBUG
931 	SBP_LOCK(sdev->target->sbp);
932 	sbp_xfer_free(xfer);
933 	SBP_UNLOCK(sdev->target->sbp);
934 }
935 
936 static struct sbp_dev *
937 sbp_next_dev(struct sbp_target *target, int lun)
938 {
939 	struct sbp_dev **sdevp;
940 	int i;
941 
942 	for (i = lun, sdevp = &target->luns[lun]; i < target->num_lun;
943 	    i++, sdevp++)
944 		if (*sdevp != NULL && (*sdevp)->status == SBP_DEV_PROBE)
945 			return (*sdevp);
946 	return (NULL);
947 }
948 
949 #define SCAN_PRI 1
950 static void
951 sbp_cam_scan_lun(struct cam_periph *periph, union ccb *ccb)
952 {
953 	struct sbp_softc *sbp;
954 	struct sbp_target *target;
955 	struct sbp_dev *sdev;
956 
957 	sdev = (struct sbp_dev *) ccb->ccb_h.ccb_sdev_ptr;
958 	target = sdev->target;
959 	sbp = target->sbp;
960 	SBP_LOCK(sbp);
961 SBP_DEBUG(0)
962 	device_printf(sbp->fd.dev,
963 		"%s:%s\n", __func__, sdev->bustgtlun);
964 END_DEBUG
965 	if ((ccb->ccb_h.status & CAM_STATUS_MASK) == CAM_REQ_CMP) {
966 		sdev->status = SBP_DEV_ATTACHED;
967 	} else {
968 		device_printf(sbp->fd.dev,
969 			"%s:%s failed\n", __func__, sdev->bustgtlun);
970 	}
971 	sdev = sbp_next_dev(target, sdev->lun_id + 1);
972 	if (sdev == NULL) {
973 		SBP_UNLOCK(sbp);
974 		xpt_free_ccb(ccb);
975 		return;
976 	}
977 	/* reuse ccb */
978 	xpt_setup_ccb(&ccb->ccb_h, sdev->path, SCAN_PRI);
979 	ccb->ccb_h.ccb_sdev_ptr = sdev;
980 	ccb->ccb_h.flags |= CAM_DEV_QFREEZE;
981 	SBP_UNLOCK(sbp);
982 
983 	xpt_action(ccb);
984 	xpt_release_devq(sdev->path, sdev->freeze, TRUE);
985 	sdev->freeze = 1;
986 }
987 
988 static void
989 sbp_cam_scan_target(void *arg)
990 {
991 	struct sbp_target *target = (struct sbp_target *)arg;
992 	struct sbp_dev *sdev;
993 	union ccb *ccb;
994 
995 	SBP_LOCK_ASSERT(target->sbp);
996 	sdev = sbp_next_dev(target, 0);
997 	if (sdev == NULL) {
998 		printf("sbp_cam_scan_target: nothing to do for target%d\n",
999 							target->target_id);
1000 		return;
1001 	}
1002 SBP_DEBUG(0)
1003 	device_printf(sdev->target->sbp->fd.dev,
1004 		"%s:%s\n", __func__, sdev->bustgtlun);
1005 END_DEBUG
1006 	ccb = xpt_alloc_ccb_nowait();
1007 	if (ccb == NULL) {
1008 		printf("sbp_cam_scan_target: xpt_alloc_ccb_nowait() failed\n");
1009 		return;
1010 	}
1011 	SBP_UNLOCK(target->sbp);
1012 
1013 	xpt_setup_ccb(&ccb->ccb_h, sdev->path, SCAN_PRI);
1014 	ccb->ccb_h.func_code = XPT_SCAN_LUN;
1015 	ccb->ccb_h.cbfcnp = sbp_cam_scan_lun;
1016 	ccb->ccb_h.flags |= CAM_DEV_QFREEZE;
1017 	ccb->crcn.flags = CAM_FLAG_NONE;
1018 	ccb->ccb_h.ccb_sdev_ptr = sdev;
1019 
1020 	/* The scan is in progress now. */
1021 	xpt_action(ccb);
1022 
1023 	SBP_LOCK(target->sbp);
1024 	xpt_release_devq(sdev->path, sdev->freeze, TRUE);
1025 	sdev->freeze = 1;
1026 }
1027 
1028 static __inline void
1029 sbp_scan_dev(struct sbp_dev *sdev)
1030 {
1031 	sdev->status = SBP_DEV_PROBE;
1032 	callout_reset_sbt(&sdev->target->scan_callout, SBT_1MS * scan_delay, 0,
1033 	    sbp_cam_scan_target, (void *)sdev->target, 0);
1034 }
1035 
1036 static void
1037 sbp_do_attach(struct fw_xfer *xfer)
1038 {
1039 	struct sbp_dev *sdev;
1040 	struct sbp_target *target;
1041 	struct sbp_softc *sbp;
1042 
1043 	sdev = (struct sbp_dev *)xfer->sc;
1044 	target = sdev->target;
1045 	sbp = target->sbp;
1046 	SBP_LOCK(sbp);
1047 SBP_DEBUG(0)
1048 	device_printf(sdev->target->sbp->fd.dev,
1049 		"%s:%s\n", __func__, sdev->bustgtlun);
1050 END_DEBUG
1051 	sbp_xfer_free(xfer);
1052 
1053 	if (sdev->path == NULL)
1054 		xpt_create_path(&sdev->path, NULL,
1055 			cam_sim_path(target->sbp->sim),
1056 			target->target_id, sdev->lun_id);
1057 
1058 	/*
1059 	 * Let CAM scan the bus if we are in the boot process.
1060 	 * XXX xpt_scan_bus cannot detect LUN larger than 0
1061 	 * if LUN 0 doesn't exist.
1062 	 */
1063 	if (sbp_cold > 0) {
1064 		sdev->status = SBP_DEV_ATTACHED;
1065 		SBP_UNLOCK(sbp);
1066 		return;
1067 	}
1068 
1069 	sbp_scan_dev(sdev);
1070 	SBP_UNLOCK(sbp);
1071 }
1072 
1073 static void
1074 sbp_agent_reset_callback(struct fw_xfer *xfer)
1075 {
1076 	struct sbp_dev *sdev;
1077 
1078 	sdev = (struct sbp_dev *)xfer->sc;
1079 SBP_DEBUG(1)
1080 	device_printf(sdev->target->sbp->fd.dev,
1081 			"%s:%s\n", __func__, sdev->bustgtlun);
1082 END_DEBUG
1083 	if (xfer->resp != 0) {
1084 		device_printf(sdev->target->sbp->fd.dev,
1085 			"%s:%s resp=%d\n", __func__, sdev->bustgtlun, xfer->resp);
1086 	}
1087 
1088 	SBP_LOCK(sdev->target->sbp);
1089 	sbp_xfer_free(xfer);
1090 	if (sdev->path) {
1091 		xpt_release_devq(sdev->path, sdev->freeze, TRUE);
1092 		sdev->freeze = 0;
1093 	}
1094 	SBP_UNLOCK(sdev->target->sbp);
1095 }
1096 
1097 static void
1098 sbp_agent_reset(struct sbp_dev *sdev)
1099 {
1100 	struct fw_xfer *xfer;
1101 	struct fw_pkt *fp;
1102 
1103 	SBP_LOCK_ASSERT(sdev->target->sbp);
1104 SBP_DEBUG(0)
1105 	device_printf(sdev->target->sbp->fd.dev,
1106 		"%s:%s\n", __func__, sdev->bustgtlun);
1107 END_DEBUG
1108 	xfer = sbp_write_cmd(sdev, FWTCODE_WREQQ, 0x04);
1109 	if (xfer == NULL)
1110 		return;
1111 	if (sdev->status == SBP_DEV_ATTACHED || sdev->status == SBP_DEV_PROBE)
1112 		xfer->hand = sbp_agent_reset_callback;
1113 	else
1114 		xfer->hand = sbp_do_attach;
1115 	fp = &xfer->send.hdr;
1116 	fp->mode.wreqq.data = htonl(0xf);
1117 	fw_asyreq(xfer->fc, -1, xfer);
1118 	sbp_abort_all_ocbs(sdev, CAM_BDR_SENT);
1119 }
1120 
1121 static void
1122 sbp_busy_timeout_callback(struct fw_xfer *xfer)
1123 {
1124 	struct sbp_dev *sdev;
1125 
1126 	sdev = (struct sbp_dev *)xfer->sc;
1127 SBP_DEBUG(1)
1128 	device_printf(sdev->target->sbp->fd.dev,
1129 		"%s:%s\n", __func__, sdev->bustgtlun);
1130 END_DEBUG
1131 	SBP_LOCK(sdev->target->sbp);
1132 	sbp_xfer_free(xfer);
1133 	sbp_agent_reset(sdev);
1134 	SBP_UNLOCK(sdev->target->sbp);
1135 }
1136 
1137 static void
1138 sbp_busy_timeout(struct sbp_dev *sdev)
1139 {
1140 	struct fw_pkt *fp;
1141 	struct fw_xfer *xfer;
1142 SBP_DEBUG(0)
1143 	device_printf(sdev->target->sbp->fd.dev,
1144 		"%s:%s\n", __func__, sdev->bustgtlun);
1145 END_DEBUG
1146 	xfer = sbp_write_cmd(sdev, FWTCODE_WREQQ, 0);
1147 
1148 	xfer->hand = sbp_busy_timeout_callback;
1149 	fp = &xfer->send.hdr;
1150 	fp->mode.wreqq.dest_hi = 0xffff;
1151 	fp->mode.wreqq.dest_lo = 0xf0000000 | BUSY_TIMEOUT;
1152 	fp->mode.wreqq.data = htonl((1 << (13 + 12)) | 0xf);
1153 	fw_asyreq(xfer->fc, -1, xfer);
1154 }
1155 
1156 static void
1157 sbp_orb_pointer_callback(struct fw_xfer *xfer)
1158 {
1159 	struct sbp_dev *sdev;
1160 	sdev = (struct sbp_dev *)xfer->sc;
1161 
1162 SBP_DEBUG(2)
1163 	device_printf(sdev->target->sbp->fd.dev,
1164 		"%s:%s\n", __func__, sdev->bustgtlun);
1165 END_DEBUG
1166 	if (xfer->resp != 0) {
1167 		/* XXX */
1168 		printf("%s: xfer->resp = %d\n", __func__, xfer->resp);
1169 	}
1170 	SBP_LOCK(sdev->target->sbp);
1171 	sbp_xfer_free(xfer);
1172 
1173 	sdev->flags &= ~ORB_POINTER_ACTIVE;
1174 
1175 	if ((sdev->flags & ORB_POINTER_NEED) != 0) {
1176 		struct sbp_ocb *ocb;
1177 
1178 		sdev->flags &= ~ORB_POINTER_NEED;
1179 		ocb = STAILQ_FIRST(&sdev->ocbs);
1180 		if (ocb != NULL)
1181 			sbp_orb_pointer(sdev, ocb);
1182 	}
1183 	SBP_UNLOCK(sdev->target->sbp);
1184 	return;
1185 }
1186 
1187 static void
1188 sbp_orb_pointer(struct sbp_dev *sdev, struct sbp_ocb *ocb)
1189 {
1190 	struct fw_xfer *xfer;
1191 	struct fw_pkt *fp;
1192 SBP_DEBUG(1)
1193 	device_printf(sdev->target->sbp->fd.dev,
1194 		"%s:%s 0x%08x\n",
1195 		__func__, sdev->bustgtlun,
1196 		(uint32_t)ocb->bus_addr);
1197 END_DEBUG
1198 
1199 	SBP_LOCK_ASSERT(sdev->target->sbp);
1200 
1201 	if ((sdev->flags & ORB_POINTER_ACTIVE) != 0) {
1202 SBP_DEBUG(0)
1203 		printf("%s: orb pointer active\n", __func__);
1204 END_DEBUG
1205 		sdev->flags |= ORB_POINTER_NEED;
1206 		return;
1207 	}
1208 
1209 	sdev->flags |= ORB_POINTER_ACTIVE;
1210 	xfer = sbp_write_cmd(sdev, FWTCODE_WREQB, 0x08);
1211 	if (xfer == NULL)
1212 		return;
1213 	xfer->hand = sbp_orb_pointer_callback;
1214 
1215 	fp = &xfer->send.hdr;
1216 	fp->mode.wreqb.len = 8;
1217 	fp->mode.wreqb.extcode = 0;
1218 	xfer->send.payload[0] =
1219 		htonl(((sdev->target->sbp->fd.fc->nodeid | FWLOCALBUS) << 16));
1220 	xfer->send.payload[1] = htonl((uint32_t)ocb->bus_addr);
1221 
1222 	if (fw_asyreq(xfer->fc, -1, xfer) != 0) {
1223 		sbp_xfer_free(xfer);
1224 		ocb->ccb->ccb_h.status = CAM_REQ_INVALID;
1225 		xpt_done(ocb->ccb);
1226 	}
1227 }
1228 
1229 static void
1230 sbp_doorbell_callback(struct fw_xfer *xfer)
1231 {
1232 	struct sbp_dev *sdev;
1233 	sdev = (struct sbp_dev *)xfer->sc;
1234 
1235 SBP_DEBUG(1)
1236 	device_printf(sdev->target->sbp->fd.dev,
1237 		"%s:%s\n", __func__, sdev->bustgtlun);
1238 END_DEBUG
1239 	if (xfer->resp != 0) {
1240 		/* XXX */
1241 		device_printf(sdev->target->sbp->fd.dev,
1242 			"%s: xfer->resp = %d\n", __func__, xfer->resp);
1243 	}
1244 	SBP_LOCK(sdev->target->sbp);
1245 	sbp_xfer_free(xfer);
1246 	sdev->flags &= ~ORB_DOORBELL_ACTIVE;
1247 	if ((sdev->flags & ORB_DOORBELL_NEED) != 0) {
1248 		sdev->flags &= ~ORB_DOORBELL_NEED;
1249 		sbp_doorbell(sdev);
1250 	}
1251 	SBP_UNLOCK(sdev->target->sbp);
1252 }
1253 
1254 static void
1255 sbp_doorbell(struct sbp_dev *sdev)
1256 {
1257 	struct fw_xfer *xfer;
1258 	struct fw_pkt *fp;
1259 SBP_DEBUG(1)
1260 	device_printf(sdev->target->sbp->fd.dev,
1261 		"%s:%s\n", __func__, sdev->bustgtlun);
1262 END_DEBUG
1263 
1264 	if ((sdev->flags & ORB_DOORBELL_ACTIVE) != 0) {
1265 		sdev->flags |= ORB_DOORBELL_NEED;
1266 		return;
1267 	}
1268 	sdev->flags |= ORB_DOORBELL_ACTIVE;
1269 	xfer = sbp_write_cmd(sdev, FWTCODE_WREQQ, 0x10);
1270 	if (xfer == NULL)
1271 		return;
1272 	xfer->hand = sbp_doorbell_callback;
1273 	fp = &xfer->send.hdr;
1274 	fp->mode.wreqq.data = htonl(0xf);
1275 	fw_asyreq(xfer->fc, -1, xfer);
1276 }
1277 
1278 static struct fw_xfer *
1279 sbp_write_cmd(struct sbp_dev *sdev, int tcode, int offset)
1280 {
1281 	struct fw_xfer *xfer;
1282 	struct fw_pkt *fp;
1283 	struct sbp_target *target;
1284 	int new = 0;
1285 
1286 	SBP_LOCK_ASSERT(sdev->target->sbp);
1287 
1288 	target = sdev->target;
1289 	xfer = STAILQ_FIRST(&target->xferlist);
1290 	if (xfer == NULL) {
1291 		if (target->n_xfer > SBP_MAX_XFER) {
1292 			printf("sbp: no more xfer for this target\n");
1293 			return (NULL);
1294 		}
1295 		xfer = fw_xfer_alloc_buf(M_SBP, 8, 0);
1296 		if (xfer == NULL) {
1297 			printf("sbp: fw_xfer_alloc_buf failed\n");
1298 			return NULL;
1299 		}
1300 		target->n_xfer++;
1301 		if (debug)
1302 			printf("sbp: alloc %d xfer\n", target->n_xfer);
1303 		new = 1;
1304 	} else {
1305 		STAILQ_REMOVE_HEAD(&target->xferlist, link);
1306 	}
1307 
1308 	if (new) {
1309 		xfer->recv.pay_len = 0;
1310 		xfer->send.spd = min(sdev->target->fwdev->speed, max_speed);
1311 		xfer->fc = sdev->target->sbp->fd.fc;
1312 	}
1313 
1314 	if (tcode == FWTCODE_WREQB)
1315 		xfer->send.pay_len = 8;
1316 	else
1317 		xfer->send.pay_len = 0;
1318 
1319 	xfer->sc = (caddr_t)sdev;
1320 	fp = &xfer->send.hdr;
1321 	fp->mode.wreqq.dest_hi = sdev->login->cmd_hi;
1322 	fp->mode.wreqq.dest_lo = sdev->login->cmd_lo + offset;
1323 	fp->mode.wreqq.tlrt = 0;
1324 	fp->mode.wreqq.tcode = tcode;
1325 	fp->mode.wreqq.pri = 0;
1326 	fp->mode.wreqq.dst = FWLOCALBUS | sdev->target->fwdev->dst;
1327 
1328 	return xfer;
1329 }
1330 
1331 static void
1332 sbp_mgm_orb(struct sbp_dev *sdev, int func, struct sbp_ocb *aocb)
1333 {
1334 	struct fw_xfer *xfer;
1335 	struct fw_pkt *fp;
1336 	struct sbp_ocb *ocb;
1337 	struct sbp_target *target;
1338 	int nid;
1339 
1340 	target = sdev->target;
1341 	nid = target->sbp->fd.fc->nodeid | FWLOCALBUS;
1342 
1343 	SBP_LOCK_ASSERT(target->sbp);
1344 	if (func == ORB_FUN_RUNQUEUE) {
1345 		ocb = STAILQ_FIRST(&target->mgm_ocb_queue);
1346 		if (target->mgm_ocb_cur != NULL || ocb == NULL) {
1347 			return;
1348 		}
1349 		STAILQ_REMOVE_HEAD(&target->mgm_ocb_queue, ocb);
1350 		goto start;
1351 	}
1352 	if ((ocb = sbp_get_ocb(sdev)) == NULL) {
1353 		/* XXX */
1354 		return;
1355 	}
1356 	ocb->flags = OCB_ACT_MGM;
1357 	ocb->sdev = sdev;
1358 
1359 	bzero((void *)ocb->orb, sizeof(ocb->orb));
1360 	ocb->orb[6] = htonl((nid << 16) | SBP_BIND_HI);
1361 	ocb->orb[7] = htonl(SBP_DEV2ADDR(target->target_id, sdev->lun_id));
1362 
1363 SBP_DEBUG(0)
1364 	device_printf(sdev->target->sbp->fd.dev,
1365 		 "%s:%s %s\n",
1366 		 __func__,sdev->bustgtlun,
1367 		 orb_fun_name[(func >> 16) & 0xf]);
1368 END_DEBUG
1369 	switch (func) {
1370 	case ORB_FUN_LGI:
1371 		ocb->orb[0] = ocb->orb[1] = 0; /* password */
1372 		ocb->orb[2] = htonl(nid << 16);
1373 		ocb->orb[3] = htonl(sdev->dma.bus_addr);
1374 		ocb->orb[4] = htonl(ORB_NOTIFY | sdev->lun_id);
1375 		if (ex_login)
1376 			ocb->orb[4] |= htonl(ORB_EXV);
1377 		ocb->orb[5] = htonl(SBP_LOGIN_SIZE);
1378 		fwdma_sync(&sdev->dma, BUS_DMASYNC_PREREAD);
1379 		break;
1380 	case ORB_FUN_ATA:
1381 		ocb->orb[0] = htonl((0 << 16) | 0);
1382 		ocb->orb[1] = htonl(aocb->bus_addr & 0xffffffff);
1383 		/* fall through */
1384 	case ORB_FUN_RCN:
1385 	case ORB_FUN_LGO:
1386 	case ORB_FUN_LUR:
1387 	case ORB_FUN_RST:
1388 	case ORB_FUN_ATS:
1389 		ocb->orb[4] = htonl(ORB_NOTIFY | func | sdev->login->id);
1390 		break;
1391 	}
1392 
1393 	if (target->mgm_ocb_cur != NULL) {
1394 		/* there is a standing ORB */
1395 		STAILQ_INSERT_TAIL(&sdev->target->mgm_ocb_queue, ocb, ocb);
1396 		return;
1397 	}
1398 start:
1399 	target->mgm_ocb_cur = ocb;
1400 
1401 	callout_reset(&target->mgm_ocb_timeout, 5 * hz,
1402 				sbp_mgm_timeout, (caddr_t)ocb);
1403 	xfer = sbp_write_cmd(sdev, FWTCODE_WREQB, 0);
1404 	if (xfer == NULL) {
1405 		return;
1406 	}
1407 	xfer->hand = sbp_mgm_callback;
1408 
1409 	fp = &xfer->send.hdr;
1410 	fp->mode.wreqb.dest_hi = sdev->target->mgm_hi;
1411 	fp->mode.wreqb.dest_lo = sdev->target->mgm_lo;
1412 	fp->mode.wreqb.len = 8;
1413 	fp->mode.wreqb.extcode = 0;
1414 	xfer->send.payload[0] = htonl(nid << 16);
1415 	xfer->send.payload[1] = htonl(ocb->bus_addr & 0xffffffff);
1416 
1417 	fw_asyreq(xfer->fc, -1, xfer);
1418 }
1419 
1420 static void
1421 sbp_print_scsi_cmd(struct sbp_ocb *ocb)
1422 {
1423 	struct ccb_scsiio *csio;
1424 
1425 	csio = &ocb->ccb->csio;
1426 	printf("%s:%d:%jx XPT_SCSI_IO: "
1427 		"cmd: %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x"
1428 		", flags: 0x%02x, "
1429 		"%db cmd/%db data/%db sense\n",
1430 		device_get_nameunit(ocb->sdev->target->sbp->fd.dev),
1431 		ocb->ccb->ccb_h.target_id,
1432 		(uintmax_t)ocb->ccb->ccb_h.target_lun,
1433 		csio->cdb_io.cdb_bytes[0],
1434 		csio->cdb_io.cdb_bytes[1],
1435 		csio->cdb_io.cdb_bytes[2],
1436 		csio->cdb_io.cdb_bytes[3],
1437 		csio->cdb_io.cdb_bytes[4],
1438 		csio->cdb_io.cdb_bytes[5],
1439 		csio->cdb_io.cdb_bytes[6],
1440 		csio->cdb_io.cdb_bytes[7],
1441 		csio->cdb_io.cdb_bytes[8],
1442 		csio->cdb_io.cdb_bytes[9],
1443 		ocb->ccb->ccb_h.flags & CAM_DIR_MASK,
1444 		csio->cdb_len, csio->dxfer_len,
1445 		csio->sense_len);
1446 }
1447 
1448 static void
1449 sbp_scsi_status(struct sbp_status *sbp_status, struct sbp_ocb *ocb)
1450 {
1451 	struct sbp_cmd_status *sbp_cmd_status;
1452 	struct scsi_sense_data_fixed *sense;
1453 
1454 	sbp_cmd_status = (struct sbp_cmd_status *)sbp_status->data;
1455 	sense = (struct scsi_sense_data_fixed *)&ocb->ccb->csio.sense_data;
1456 
1457 SBP_DEBUG(0)
1458 	sbp_print_scsi_cmd(ocb);
1459 	/* XXX need decode status */
1460 	printf("%s: SCSI status %x sfmt %x valid %x key %x code %x qlfr %x len %d\n",
1461 		ocb->sdev->bustgtlun,
1462 		sbp_cmd_status->status,
1463 		sbp_cmd_status->sfmt,
1464 		sbp_cmd_status->valid,
1465 		sbp_cmd_status->s_key,
1466 		sbp_cmd_status->s_code,
1467 		sbp_cmd_status->s_qlfr,
1468 		sbp_status->len);
1469 END_DEBUG
1470 
1471 	switch (sbp_cmd_status->status) {
1472 	case SCSI_STATUS_CHECK_COND:
1473 	case SCSI_STATUS_BUSY:
1474 	case SCSI_STATUS_CMD_TERMINATED:
1475 		if (sbp_cmd_status->sfmt == SBP_SFMT_CURR) {
1476 			sense->error_code = SSD_CURRENT_ERROR;
1477 		} else {
1478 			sense->error_code = SSD_DEFERRED_ERROR;
1479 		}
1480 		if (sbp_cmd_status->valid)
1481 			sense->error_code |= SSD_ERRCODE_VALID;
1482 		sense->flags = sbp_cmd_status->s_key;
1483 		if (sbp_cmd_status->mark)
1484 			sense->flags |= SSD_FILEMARK;
1485 		if (sbp_cmd_status->eom)
1486 			sense->flags |= SSD_EOM;
1487 		if (sbp_cmd_status->ill_len)
1488 			sense->flags |= SSD_ILI;
1489 
1490 		bcopy(&sbp_cmd_status->info, &sense->info[0], 4);
1491 
1492 		if (sbp_status->len <= 1)
1493 			/* XXX not scsi status. shouldn't be happened */
1494 			sense->extra_len = 0;
1495 		else if (sbp_status->len <= 4)
1496 			/* add_sense_code(_qual), info, cmd_spec_info */
1497 			sense->extra_len = 6;
1498 		else
1499 			/* fru, sense_key_spec */
1500 			sense->extra_len = 10;
1501 
1502 		bcopy(&sbp_cmd_status->cdb, &sense->cmd_spec_info[0], 4);
1503 
1504 		sense->add_sense_code = sbp_cmd_status->s_code;
1505 		sense->add_sense_code_qual = sbp_cmd_status->s_qlfr;
1506 		sense->fru = sbp_cmd_status->fru;
1507 
1508 		bcopy(&sbp_cmd_status->s_keydep[0],
1509 		    &sense->sense_key_spec[0], 3);
1510 
1511 		ocb->ccb->csio.scsi_status = sbp_cmd_status->status;
1512 		ocb->ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
1513 							| CAM_AUTOSNS_VALID;
1514 /*
1515 {
1516 		uint8_t j, *tmp;
1517 		tmp = sense;
1518 		for (j = 0; j < 32; j += 8) {
1519 			printf("sense %02x%02x %02x%02x %02x%02x %02x%02x\n",
1520 				tmp[j], tmp[j + 1], tmp[j + 2], tmp[j + 3],
1521 				tmp[j + 4], tmp[j + 5], tmp[j + 6], tmp[j + 7]);
1522 		}
1523 
1524 }
1525 */
1526 		break;
1527 	default:
1528 		device_printf(ocb->sdev->target->sbp->fd.dev,
1529 				"%s:%s unknown scsi status 0x%x\n",
1530 				__func__, ocb->sdev->bustgtlun,
1531 				sbp_cmd_status->status);
1532 	}
1533 }
1534 
1535 static void
1536 sbp_fix_inq_data(struct sbp_ocb *ocb)
1537 {
1538 	union ccb *ccb;
1539 	struct sbp_dev *sdev;
1540 	struct scsi_inquiry_data *inq;
1541 
1542 	ccb = ocb->ccb;
1543 	sdev = ocb->sdev;
1544 
1545 	if (ccb->csio.cdb_io.cdb_bytes[1] & SI_EVPD)
1546 		return;
1547 SBP_DEBUG(1)
1548 	device_printf(sdev->target->sbp->fd.dev,
1549 		"%s:%s\n", __func__, sdev->bustgtlun);
1550 END_DEBUG
1551 	inq = (struct scsi_inquiry_data *) ccb->csio.data_ptr;
1552 	switch (SID_TYPE(inq)) {
1553 	case T_DIRECT:
1554 		/* fall through */
1555 	case T_RBC:
1556 		/*
1557 		 * Override vendor/product/revision information.
1558 		 * Some devices sometimes return strange strings.
1559 		 */
1560 		bcopy(sdev->vendor, inq->vendor, sizeof(inq->vendor));
1561 		bcopy(sdev->product, inq->product, sizeof(inq->product));
1562 		bcopy(sdev->revision + 2, inq->revision, sizeof(inq->revision));
1563 		break;
1564 	}
1565 	/*
1566 	 * Force to enable/disable tagged queuing.
1567 	 * XXX CAM also checks SCP_QUEUE_DQUE flag in the control mode page.
1568 	 */
1569 	if (sbp_tags > 0)
1570 		inq->flags |= SID_CmdQue;
1571 	else if (sbp_tags < 0)
1572 		inq->flags &= ~SID_CmdQue;
1573 
1574 }
1575 
1576 static void
1577 sbp_recv1(struct fw_xfer *xfer)
1578 {
1579 	struct fw_pkt *rfp;
1580 #if NEED_RESPONSE
1581 	struct fw_pkt *sfp;
1582 #endif
1583 	struct sbp_softc *sbp;
1584 	struct sbp_dev *sdev;
1585 	struct sbp_ocb *ocb;
1586 	struct sbp_login_res *login_res = NULL;
1587 	struct sbp_status *sbp_status;
1588 	struct sbp_target *target;
1589 	int	orb_fun, status_valid0, status_valid, t, l, reset_agent = 0;
1590 	uint32_t addr;
1591 /*
1592 	uint32_t *ld;
1593 	ld = xfer->recv.buf;
1594 printf("sbp %x %d %d %08x %08x %08x %08x\n",
1595 			xfer->resp, xfer->recv.len, xfer->recv.off, ntohl(ld[0]), ntohl(ld[1]), ntohl(ld[2]), ntohl(ld[3]));
1596 printf("sbp %08x %08x %08x %08x\n", ntohl(ld[4]), ntohl(ld[5]), ntohl(ld[6]), ntohl(ld[7]));
1597 printf("sbp %08x %08x %08x %08x\n", ntohl(ld[8]), ntohl(ld[9]), ntohl(ld[10]), ntohl(ld[11]));
1598 */
1599 	sbp = (struct sbp_softc *)xfer->sc;
1600 	SBP_LOCK_ASSERT(sbp);
1601 	if (xfer->resp != 0) {
1602 		printf("sbp_recv: xfer->resp = %d\n", xfer->resp);
1603 		goto done0;
1604 	}
1605 	if (xfer->recv.payload == NULL) {
1606 		printf("sbp_recv: xfer->recv.payload == NULL\n");
1607 		goto done0;
1608 	}
1609 	rfp = &xfer->recv.hdr;
1610 	if (rfp->mode.wreqb.tcode != FWTCODE_WREQB) {
1611 		printf("sbp_recv: tcode = %d\n", rfp->mode.wreqb.tcode);
1612 		goto done0;
1613 	}
1614 	sbp_status = (struct sbp_status *)xfer->recv.payload;
1615 	addr = rfp->mode.wreqb.dest_lo;
1616 SBP_DEBUG(2)
1617 	printf("received address 0x%x\n", addr);
1618 END_DEBUG
1619 	t = SBP_ADDR2TRG(addr);
1620 	if (t >= SBP_NUM_TARGETS) {
1621 		device_printf(sbp->fd.dev,
1622 			"sbp_recv1: invalid target %d\n", t);
1623 		goto done0;
1624 	}
1625 	target = &sbp->targets[t];
1626 	l = SBP_ADDR2LUN(addr);
1627 	if (l >= target->num_lun || target->luns[l] == NULL) {
1628 		device_printf(sbp->fd.dev,
1629 			"sbp_recv1: invalid lun %d (target=%d)\n", l, t);
1630 		goto done0;
1631 	}
1632 	sdev = target->luns[l];
1633 
1634 	ocb = NULL;
1635 	switch (sbp_status->src) {
1636 	case 0:
1637 	case 1:
1638 		/* check mgm_ocb_cur first */
1639 		ocb  = target->mgm_ocb_cur;
1640 		if (ocb != NULL) {
1641 			if (OCB_MATCH(ocb, sbp_status)) {
1642 				callout_stop(&target->mgm_ocb_timeout);
1643 				target->mgm_ocb_cur = NULL;
1644 				break;
1645 			}
1646 		}
1647 		ocb = sbp_dequeue_ocb(sdev, sbp_status);
1648 		if (ocb == NULL) {
1649 			device_printf(sdev->target->sbp->fd.dev,
1650 				"%s:%s No ocb(%x) on the queue\n",
1651 				__func__,sdev->bustgtlun,
1652 				ntohl(sbp_status->orb_lo));
1653 		}
1654 		break;
1655 	case 2:
1656 		/* unsolicit */
1657 		device_printf(sdev->target->sbp->fd.dev,
1658 			"%s:%s unsolicit status received\n",
1659 			__func__, sdev->bustgtlun);
1660 		break;
1661 	default:
1662 		device_printf(sdev->target->sbp->fd.dev,
1663 			"%s:%s unknown sbp_status->src\n",
1664 			__func__, sdev->bustgtlun);
1665 	}
1666 
1667 	status_valid0 = (sbp_status->src < 2
1668 			&& sbp_status->resp == ORB_RES_CMPL
1669 			&& sbp_status->dead == 0);
1670 	status_valid = (status_valid0 && sbp_status->status == 0);
1671 
1672 	if (!status_valid0 || debug > 2) {
1673 		int status;
1674 SBP_DEBUG(0)
1675 		device_printf(sdev->target->sbp->fd.dev,
1676 			"%s:%s ORB status src:%x resp:%x dead:%x"
1677 				" len:%x stat:%x orb:%x%08x\n",
1678 			__func__, sdev->bustgtlun,
1679 			sbp_status->src, sbp_status->resp, sbp_status->dead,
1680 			sbp_status->len, sbp_status->status,
1681 			ntohs(sbp_status->orb_hi), ntohl(sbp_status->orb_lo));
1682 END_DEBUG
1683 		device_printf(sdev->target->sbp->fd.dev,
1684 				"%s\n", sdev->bustgtlun);
1685 		status = sbp_status->status;
1686 		switch (sbp_status->resp) {
1687 		case 0:
1688 			if (status > MAX_ORB_STATUS0)
1689 				printf("%s\n", orb_status0[MAX_ORB_STATUS0]);
1690 			else
1691 				printf("%s\n", orb_status0[status]);
1692 			break;
1693 		case 1:
1694 			printf("Obj: %s, Error: %s\n",
1695 				orb_status1_object[(status >> 6) & 3],
1696 				orb_status1_serial_bus_error[status & 0xf]);
1697 			break;
1698 		case 2:
1699 			printf("Illegal request\n");
1700 			break;
1701 		case 3:
1702 			printf("Vendor dependent\n");
1703 			break;
1704 		default:
1705 			printf("unknown respose code %d\n", sbp_status->resp);
1706 		}
1707 	}
1708 
1709 	/* we have to reset the fetch agent if it's dead */
1710 	if (sbp_status->dead) {
1711 		if (sdev->path) {
1712 			xpt_freeze_devq(sdev->path, 1);
1713 			sdev->freeze++;
1714 		}
1715 		reset_agent = 1;
1716 	}
1717 
1718 	if (ocb == NULL)
1719 		goto done;
1720 
1721 	switch (ntohl(ocb->orb[4]) & ORB_FMT_MSK) {
1722 	case ORB_FMT_NOP:
1723 		break;
1724 	case ORB_FMT_VED:
1725 		break;
1726 	case ORB_FMT_STD:
1727 		switch (ocb->flags) {
1728 		case OCB_ACT_MGM:
1729 			orb_fun = ntohl(ocb->orb[4]) & ORB_FUN_MSK;
1730 			reset_agent = 0;
1731 			switch (orb_fun) {
1732 			case ORB_FUN_LGI:
1733 				fwdma_sync(&sdev->dma, BUS_DMASYNC_POSTREAD);
1734 				login_res = sdev->login;
1735 				login_res->len = ntohs(login_res->len);
1736 				login_res->id = ntohs(login_res->id);
1737 				login_res->cmd_hi = ntohs(login_res->cmd_hi);
1738 				login_res->cmd_lo = ntohl(login_res->cmd_lo);
1739 				if (status_valid) {
1740 SBP_DEBUG(0)
1741 					device_printf(sdev->target->sbp->fd.dev,
1742 						"%s:%s login: len %d, ID %d, cmd %08x%08x, recon_hold %d\n",
1743 						__func__, sdev->bustgtlun,
1744 						login_res->len, login_res->id,
1745 						login_res->cmd_hi, login_res->cmd_lo,
1746 						ntohs(login_res->recon_hold));
1747 END_DEBUG
1748 					sbp_busy_timeout(sdev);
1749 				} else {
1750 					/* forgot logout? */
1751 					device_printf(sdev->target->sbp->fd.dev,
1752 						"%s:%s login failed\n",
1753 						__func__, sdev->bustgtlun);
1754 					sdev->status = SBP_DEV_RESET;
1755 				}
1756 				break;
1757 			case ORB_FUN_RCN:
1758 				login_res = sdev->login;
1759 				if (status_valid) {
1760 SBP_DEBUG(0)
1761 					device_printf(sdev->target->sbp->fd.dev,
1762 						"%s:%s reconnect: len %d, ID %d, cmd %08x%08x\n",
1763 						__func__, sdev->bustgtlun,
1764 						login_res->len, login_res->id,
1765 						login_res->cmd_hi, login_res->cmd_lo);
1766 END_DEBUG
1767 					if (sdev->status == SBP_DEV_ATTACHED)
1768 						sbp_scan_dev(sdev);
1769 					else
1770 						sbp_agent_reset(sdev);
1771 				} else {
1772 					/* reconnection hold time exceed? */
1773 SBP_DEBUG(0)
1774 					device_printf(sdev->target->sbp->fd.dev,
1775 						"%s:%s reconnect failed\n",
1776 						__func__, sdev->bustgtlun);
1777 END_DEBUG
1778 					sbp_login(sdev);
1779 				}
1780 				break;
1781 			case ORB_FUN_LGO:
1782 				sdev->status = SBP_DEV_RESET;
1783 				break;
1784 			case ORB_FUN_RST:
1785 				sbp_busy_timeout(sdev);
1786 				break;
1787 			case ORB_FUN_LUR:
1788 			case ORB_FUN_ATA:
1789 			case ORB_FUN_ATS:
1790 				sbp_agent_reset(sdev);
1791 				break;
1792 			default:
1793 				device_printf(sdev->target->sbp->fd.dev,
1794 					"%s:%s unknown function %d\n",
1795 					__func__, sdev->bustgtlun, orb_fun);
1796 				break;
1797 			}
1798 			sbp_mgm_orb(sdev, ORB_FUN_RUNQUEUE, NULL);
1799 			break;
1800 		case OCB_ACT_CMD:
1801 			sdev->timeout = 0;
1802 			if (ocb->ccb != NULL) {
1803 				union ccb *ccb;
1804 
1805 				ccb = ocb->ccb;
1806 				if (sbp_status->len > 1) {
1807 					sbp_scsi_status(sbp_status, ocb);
1808 				} else {
1809 					if (sbp_status->resp != ORB_RES_CMPL) {
1810 						ccb->ccb_h.status = CAM_REQ_CMP_ERR;
1811 					} else {
1812 						ccb->ccb_h.status = CAM_REQ_CMP;
1813 					}
1814 				}
1815 				/* fix up inq data */
1816 				if (ccb->csio.cdb_io.cdb_bytes[0] == INQUIRY)
1817 					sbp_fix_inq_data(ocb);
1818 				xpt_done(ccb);
1819 			}
1820 			break;
1821 		default:
1822 			break;
1823 		}
1824 	}
1825 
1826 	if (!use_doorbell)
1827 		sbp_free_ocb(sdev, ocb);
1828 done:
1829 	if (reset_agent)
1830 		sbp_agent_reset(sdev);
1831 
1832 done0:
1833 	xfer->recv.pay_len = SBP_RECV_LEN;
1834 /* The received packet is usually small enough to be stored within
1835  * the buffer. In that case, the controller return ack_complete and
1836  * no respose is necessary.
1837  *
1838  * XXX fwohci.c and firewire.c should inform event_code such as
1839  * ack_complete or ack_pending to upper driver.
1840  */
1841 #if NEED_RESPONSE
1842 	xfer->send.off = 0;
1843 	sfp = (struct fw_pkt *)xfer->send.buf;
1844 	sfp->mode.wres.dst = rfp->mode.wreqb.src;
1845 	xfer->dst = sfp->mode.wres.dst;
1846 	xfer->spd = min(sdev->target->fwdev->speed, max_speed);
1847 	xfer->hand = sbp_loginres_callback;
1848 
1849 	sfp->mode.wres.tlrt = rfp->mode.wreqb.tlrt;
1850 	sfp->mode.wres.tcode = FWTCODE_WRES;
1851 	sfp->mode.wres.rtcode = 0;
1852 	sfp->mode.wres.pri = 0;
1853 
1854 	fw_asyreq(xfer->fc, -1, xfer);
1855 #else
1856 	/* recycle */
1857 	STAILQ_INSERT_TAIL(&sbp->fwb.xferlist, xfer, link);
1858 #endif
1859 }
1860 
1861 static void
1862 sbp_recv(struct fw_xfer *xfer)
1863 {
1864 	struct sbp_softc *sbp;
1865 
1866 	sbp = (struct sbp_softc *)xfer->sc;
1867 	SBP_LOCK(sbp);
1868 	sbp_recv1(xfer);
1869 	SBP_UNLOCK(sbp);
1870 }
1871 /*
1872  * sbp_attach()
1873  */
1874 static int
1875 sbp_attach(device_t dev)
1876 {
1877 	struct sbp_softc *sbp;
1878 	struct cam_devq *devq;
1879 	struct firewire_comm *fc;
1880 	int i, error;
1881 
1882 	if (DFLTPHYS > SBP_MAXPHYS)
1883 		device_printf(dev, "Warning, DFLTPHYS(%dKB) is larger than "
1884 			"SBP_MAXPHYS(%dKB).\n", DFLTPHYS / 1024,
1885 			SBP_MAXPHYS / 1024);
1886 
1887 	if (!firewire_phydma_enable)
1888 		device_printf(dev, "Warning, hw.firewire.phydma_enable must be 1 "
1889 			"for SBP over FireWire.\n");
1890 SBP_DEBUG(0)
1891 	printf("sbp_attach (cold=%d)\n", cold);
1892 END_DEBUG
1893 
1894 	if (cold)
1895 		sbp_cold++;
1896 	sbp = device_get_softc(dev);
1897 	sbp->fd.dev = dev;
1898 	sbp->fd.fc = fc = fw_get_comm(dev);
1899 	mtx_init(&sbp->mtx, "sbp", NULL, MTX_DEF);
1900 
1901 	if (max_speed < 0)
1902 		max_speed = fc->speed;
1903 
1904 	error = bus_dma_tag_create(/*parent*/fc->dmat,
1905 				/* XXX shoud be 4 for sane backend? */
1906 				/*alignment*/1,
1907 				/*boundary*/0,
1908 				/*lowaddr*/BUS_SPACE_MAXADDR_32BIT,
1909 				/*highaddr*/BUS_SPACE_MAXADDR,
1910 				/*filter*/NULL, /*filterarg*/NULL,
1911 				/*maxsize*/0x100000, /*nsegments*/SBP_IND_MAX,
1912 				/*maxsegsz*/SBP_SEG_MAX,
1913 				/*flags*/BUS_DMA_ALLOCNOW,
1914 				/*lockfunc*/busdma_lock_mutex,
1915 				/*lockarg*/&sbp->mtx,
1916 				&sbp->dmat);
1917 	if (error != 0) {
1918 		printf("sbp_attach: Could not allocate DMA tag "
1919 			"- error %d\n", error);
1920 			return (ENOMEM);
1921 	}
1922 
1923 	devq = cam_simq_alloc(/*maxopenings*/SBP_NUM_OCB);
1924 	if (devq == NULL)
1925 		return (ENXIO);
1926 
1927 	for (i = 0; i < SBP_NUM_TARGETS; i++) {
1928 		sbp->targets[i].fwdev = NULL;
1929 		sbp->targets[i].luns = NULL;
1930 		sbp->targets[i].sbp = sbp;
1931 	}
1932 
1933 	sbp->sim = cam_sim_alloc(sbp_action, sbp_poll, "sbp", sbp,
1934 				 device_get_unit(dev),
1935 				 &sbp->mtx,
1936 				 /*untagged*/ 1,
1937 				 /*tagged*/ SBP_QUEUE_LEN - 1,
1938 				 devq);
1939 
1940 	if (sbp->sim == NULL) {
1941 		cam_simq_free(devq);
1942 		return (ENXIO);
1943 	}
1944 
1945 	SBP_LOCK(sbp);
1946 	if (xpt_bus_register(sbp->sim, dev, /*bus*/0) != CAM_SUCCESS)
1947 		goto fail;
1948 
1949 	if (xpt_create_path(&sbp->path, NULL, cam_sim_path(sbp->sim),
1950 	    CAM_TARGET_WILDCARD, CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
1951 		xpt_bus_deregister(cam_sim_path(sbp->sim));
1952 		goto fail;
1953 	}
1954 	SBP_UNLOCK(sbp);
1955 
1956 	/* We reserve 16 bit space (4 bytes X 64 targets X 256 luns) */
1957 	sbp->fwb.start = ((u_int64_t)SBP_BIND_HI << 32) | SBP_DEV2ADDR(0, 0);
1958 	sbp->fwb.end = sbp->fwb.start + 0xffff;
1959 	/* pre-allocate xfer */
1960 	STAILQ_INIT(&sbp->fwb.xferlist);
1961 	fw_xferlist_add(&sbp->fwb.xferlist, M_SBP,
1962 	    /*send*/ 0, /*recv*/ SBP_RECV_LEN, SBP_NUM_OCB/2,
1963 	    fc, (void *)sbp, sbp_recv);
1964 
1965 	fw_bindadd(fc, &sbp->fwb);
1966 
1967 	sbp->fd.post_busreset = sbp_post_busreset;
1968 	sbp->fd.post_explore = sbp_post_explore;
1969 
1970 	if (fc->status != -1) {
1971 		sbp_post_busreset(sbp);
1972 		sbp_post_explore(sbp);
1973 	}
1974 	SBP_LOCK(sbp);
1975 	xpt_async(AC_BUS_RESET, sbp->path, /*arg*/ NULL);
1976 	SBP_UNLOCK(sbp);
1977 
1978 	return (0);
1979 fail:
1980 	SBP_UNLOCK(sbp);
1981 	cam_sim_free(sbp->sim, /*free_devq*/TRUE);
1982 	return (ENXIO);
1983 }
1984 
1985 static int
1986 sbp_logout_all(struct sbp_softc *sbp)
1987 {
1988 	struct sbp_target *target;
1989 	struct sbp_dev *sdev;
1990 	int i, j;
1991 
1992 SBP_DEBUG(0)
1993 	printf("sbp_logout_all\n");
1994 END_DEBUG
1995 	SBP_LOCK_ASSERT(sbp);
1996 	for (i = 0; i < SBP_NUM_TARGETS; i++) {
1997 		target = &sbp->targets[i];
1998 		if (target->luns == NULL)
1999 			continue;
2000 		for (j = 0; j < target->num_lun; j++) {
2001 			sdev = target->luns[j];
2002 			if (sdev == NULL)
2003 				continue;
2004 			callout_stop(&sdev->login_callout);
2005 			if (sdev->status >= SBP_DEV_TOATTACH &&
2006 					sdev->status <= SBP_DEV_ATTACHED)
2007 				sbp_mgm_orb(sdev, ORB_FUN_LGO, NULL);
2008 		}
2009 	}
2010 
2011 	return 0;
2012 }
2013 
2014 static int
2015 sbp_shutdown(device_t dev)
2016 {
2017 	struct sbp_softc *sbp = ((struct sbp_softc *)device_get_softc(dev));
2018 
2019 	SBP_LOCK(sbp);
2020 	sbp_logout_all(sbp);
2021 	SBP_UNLOCK(sbp);
2022 	return (0);
2023 }
2024 
2025 static void
2026 sbp_free_sdev(struct sbp_dev *sdev)
2027 {
2028 	struct sbp_softc *sbp;
2029 	int i;
2030 
2031 	if (sdev == NULL)
2032 		return;
2033 	sbp = sdev->target->sbp;
2034 	SBP_UNLOCK(sbp);
2035 	callout_drain(&sdev->login_callout);
2036 	for (i = 0; i < SBP_QUEUE_LEN; i++) {
2037 		callout_drain(&sdev->ocb[i].timer);
2038 		bus_dmamap_destroy(sbp->dmat, sdev->ocb[i].dmamap);
2039 	}
2040 	fwdma_free(sbp->fd.fc, &sdev->dma);
2041 	free(sdev, M_SBP);
2042 	SBP_LOCK(sbp);
2043 }
2044 
2045 static void
2046 sbp_free_target(struct sbp_target *target)
2047 {
2048 	struct sbp_softc *sbp;
2049 	struct fw_xfer *xfer, *next;
2050 	int i;
2051 
2052 	if (target->luns == NULL)
2053 		return;
2054 	sbp = target->sbp;
2055 	SBP_LOCK_ASSERT(sbp);
2056 	SBP_UNLOCK(sbp);
2057 	callout_drain(&target->mgm_ocb_timeout);
2058 	callout_drain(&target->scan_callout);
2059 	SBP_LOCK(sbp);
2060 	for (i = 0; i < target->num_lun; i++)
2061 		sbp_free_sdev(target->luns[i]);
2062 
2063 	STAILQ_FOREACH_SAFE(xfer, &target->xferlist, link, next) {
2064 		fw_xfer_free_buf(xfer);
2065 	}
2066 	STAILQ_INIT(&target->xferlist);
2067 	free(target->luns, M_SBP);
2068 	target->num_lun = 0;
2069 	target->luns = NULL;
2070 	target->fwdev = NULL;
2071 }
2072 
2073 static int
2074 sbp_detach(device_t dev)
2075 {
2076 	struct sbp_softc *sbp = ((struct sbp_softc *)device_get_softc(dev));
2077 	struct firewire_comm *fc = sbp->fd.fc;
2078 	int i;
2079 
2080 SBP_DEBUG(0)
2081 	printf("sbp_detach\n");
2082 END_DEBUG
2083 
2084 	SBP_LOCK(sbp);
2085 	for (i = 0; i < SBP_NUM_TARGETS; i++)
2086 		sbp_cam_detach_target(&sbp->targets[i]);
2087 
2088 	xpt_async(AC_LOST_DEVICE, sbp->path, NULL);
2089 	xpt_free_path(sbp->path);
2090 	xpt_bus_deregister(cam_sim_path(sbp->sim));
2091 	cam_sim_free(sbp->sim, /*free_devq*/ TRUE);
2092 
2093 	sbp_logout_all(sbp);
2094 	SBP_UNLOCK(sbp);
2095 
2096 	/* XXX wait for logout completion */
2097 	pause("sbpdtc", hz/2);
2098 
2099 	SBP_LOCK(sbp);
2100 	for (i = 0; i < SBP_NUM_TARGETS; i++)
2101 		sbp_free_target(&sbp->targets[i]);
2102 	SBP_UNLOCK(sbp);
2103 
2104 	fw_bindremove(fc, &sbp->fwb);
2105 	fw_xferlist_remove(&sbp->fwb.xferlist);
2106 
2107 	bus_dma_tag_destroy(sbp->dmat);
2108 	mtx_destroy(&sbp->mtx);
2109 
2110 	return (0);
2111 }
2112 
2113 static void
2114 sbp_cam_detach_sdev(struct sbp_dev *sdev)
2115 {
2116 	if (sdev == NULL)
2117 		return;
2118 	if (sdev->status == SBP_DEV_DEAD)
2119 		return;
2120 	if (sdev->status == SBP_DEV_RESET)
2121 		return;
2122 	SBP_LOCK_ASSERT(sdev->target->sbp);
2123 	sbp_abort_all_ocbs(sdev, CAM_DEV_NOT_THERE);
2124 	if (sdev->path) {
2125 		xpt_release_devq(sdev->path,
2126 				 sdev->freeze, TRUE);
2127 		sdev->freeze = 0;
2128 		xpt_async(AC_LOST_DEVICE, sdev->path, NULL);
2129 		xpt_free_path(sdev->path);
2130 		sdev->path = NULL;
2131 	}
2132 }
2133 
2134 static void
2135 sbp_cam_detach_target(struct sbp_target *target)
2136 {
2137 	int i;
2138 
2139 	SBP_LOCK_ASSERT(target->sbp);
2140 	if (target->luns != NULL) {
2141 SBP_DEBUG(0)
2142 		printf("sbp_detach_target %d\n", target->target_id);
2143 END_DEBUG
2144 		callout_stop(&target->scan_callout);
2145 		for (i = 0; i < target->num_lun; i++)
2146 			sbp_cam_detach_sdev(target->luns[i]);
2147 	}
2148 }
2149 
2150 static void
2151 sbp_target_reset(struct sbp_dev *sdev, int method)
2152 {
2153 	int i;
2154 	struct sbp_target *target = sdev->target;
2155 	struct sbp_dev *tsdev;
2156 
2157 	SBP_LOCK_ASSERT(target->sbp);
2158 	for (i = 0; i < target->num_lun; i++) {
2159 		tsdev = target->luns[i];
2160 		if (tsdev == NULL)
2161 			continue;
2162 		if (tsdev->status == SBP_DEV_DEAD)
2163 			continue;
2164 		if (tsdev->status == SBP_DEV_RESET)
2165 			continue;
2166 		xpt_freeze_devq(tsdev->path, 1);
2167 		tsdev->freeze++;
2168 		sbp_abort_all_ocbs(tsdev, CAM_CMD_TIMEOUT);
2169 		if (method == 2)
2170 			tsdev->status = SBP_DEV_LOGIN;
2171 	}
2172 	switch (method) {
2173 	case 1:
2174 		printf("target reset\n");
2175 		sbp_mgm_orb(sdev, ORB_FUN_RST, NULL);
2176 		break;
2177 	case 2:
2178 		printf("reset start\n");
2179 		sbp_reset_start(sdev);
2180 		break;
2181 	}
2182 
2183 }
2184 
2185 static void
2186 sbp_mgm_timeout(void *arg)
2187 {
2188 	struct sbp_ocb *ocb = (struct sbp_ocb *)arg;
2189 	struct sbp_dev *sdev = ocb->sdev;
2190 	struct sbp_target *target = sdev->target;
2191 
2192 	SBP_LOCK_ASSERT(target->sbp);
2193 	device_printf(sdev->target->sbp->fd.dev,
2194 		"%s:%s request timeout(mgm orb:0x%08x)\n",
2195 		__func__, sdev->bustgtlun, (uint32_t)ocb->bus_addr);
2196 	target->mgm_ocb_cur = NULL;
2197 	sbp_free_ocb(sdev, ocb);
2198 	device_printf(sdev->target->sbp->fd.dev,
2199 		"%s:%s reset start\n",
2200 		__func__, sdev->bustgtlun);
2201 	sbp_reset_start(sdev);
2202 }
2203 
2204 static void
2205 sbp_timeout(void *arg)
2206 {
2207 	struct sbp_ocb *ocb = (struct sbp_ocb *)arg;
2208 	struct sbp_dev *sdev = ocb->sdev;
2209 
2210 	device_printf(sdev->target->sbp->fd.dev,
2211 		"%s:%s request timeout(cmd orb:0x%08x) ... ",
2212 		__func__, sdev->bustgtlun, (uint32_t)ocb->bus_addr);
2213 
2214 	SBP_LOCK_ASSERT(sdev->target->sbp);
2215 	sdev->timeout++;
2216 	switch (sdev->timeout) {
2217 	case 1:
2218 		printf("agent reset\n");
2219 		xpt_freeze_devq(sdev->path, 1);
2220 		sdev->freeze++;
2221 		sbp_abort_all_ocbs(sdev, CAM_CMD_TIMEOUT);
2222 		sbp_agent_reset(sdev);
2223 		break;
2224 	case 2:
2225 	case 3:
2226 		sbp_target_reset(sdev, sdev->timeout - 1);
2227 		break;
2228 	}
2229 }
2230 
2231 static void
2232 sbp_action(struct cam_sim *sim, union ccb *ccb)
2233 {
2234 
2235 	struct sbp_softc *sbp = cam_sim_softc(sim);
2236 	struct sbp_target *target = NULL;
2237 	struct sbp_dev *sdev = NULL;
2238 
2239 	if (sbp != NULL)
2240 		SBP_LOCK_ASSERT(sbp);
2241 	/* target:lun -> sdev mapping */
2242 	if (sbp != NULL
2243 			&& ccb->ccb_h.target_id != CAM_TARGET_WILDCARD
2244 			&& ccb->ccb_h.target_id < SBP_NUM_TARGETS) {
2245 		target = &sbp->targets[ccb->ccb_h.target_id];
2246 		if (target->fwdev != NULL
2247 				&& ccb->ccb_h.target_lun != CAM_LUN_WILDCARD
2248 				&& ccb->ccb_h.target_lun < target->num_lun) {
2249 			sdev = target->luns[ccb->ccb_h.target_lun];
2250 			if (sdev != NULL && sdev->status != SBP_DEV_ATTACHED &&
2251 				sdev->status != SBP_DEV_PROBE)
2252 				sdev = NULL;
2253 		}
2254 	}
2255 
2256 SBP_DEBUG(1)
2257 	if (sdev == NULL)
2258 		printf("invalid target %d lun %jx\n",
2259 			ccb->ccb_h.target_id, (uintmax_t)ccb->ccb_h.target_lun);
2260 END_DEBUG
2261 
2262 	switch (ccb->ccb_h.func_code) {
2263 	case XPT_SCSI_IO:
2264 	case XPT_RESET_DEV:
2265 	case XPT_GET_TRAN_SETTINGS:
2266 	case XPT_SET_TRAN_SETTINGS:
2267 	case XPT_CALC_GEOMETRY:
2268 		if (sdev == NULL) {
2269 SBP_DEBUG(1)
2270 			printf("%s:%d:%jx:func_code 0x%04x: "
2271 				"Invalid target (target needed)\n",
2272 				device_get_nameunit(sbp->fd.dev),
2273 				ccb->ccb_h.target_id,
2274 				(uintmax_t)ccb->ccb_h.target_lun,
2275 				ccb->ccb_h.func_code);
2276 END_DEBUG
2277 
2278 			ccb->ccb_h.status = CAM_DEV_NOT_THERE;
2279 			xpt_done(ccb);
2280 			return;
2281 		}
2282 		break;
2283 	case XPT_PATH_INQ:
2284 	case XPT_NOOP:
2285 		/* The opcodes sometimes aimed at a target (sc is valid),
2286 		 * sometimes aimed at the SIM (sc is invalid and target is
2287 		 * CAM_TARGET_WILDCARD)
2288 		 */
2289 		if (sbp == NULL &&
2290 			ccb->ccb_h.target_id != CAM_TARGET_WILDCARD) {
2291 SBP_DEBUG(0)
2292 			printf("%s:%d:%jx func_code 0x%04x: "
2293 				"Invalid target (no wildcard)\n",
2294 				device_get_nameunit(sbp->fd.dev),
2295 				ccb->ccb_h.target_id,
2296 				(uintmax_t)ccb->ccb_h.target_lun,
2297 				ccb->ccb_h.func_code);
2298 END_DEBUG
2299 			ccb->ccb_h.status = CAM_DEV_NOT_THERE;
2300 			xpt_done(ccb);
2301 			return;
2302 		}
2303 		break;
2304 	default:
2305 		/* XXX Hm, we should check the input parameters */
2306 		break;
2307 	}
2308 
2309 	switch (ccb->ccb_h.func_code) {
2310 	case XPT_SCSI_IO:
2311 	{
2312 		struct ccb_scsiio *csio;
2313 		struct sbp_ocb *ocb;
2314 		int speed;
2315 		void *cdb;
2316 
2317 		csio = &ccb->csio;
2318 		mtx_assert(sim->mtx, MA_OWNED);
2319 
2320 SBP_DEBUG(2)
2321 		printf("%s:%d:%jx XPT_SCSI_IO: "
2322 			"cmd: %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x"
2323 			", flags: 0x%02x, "
2324 			"%db cmd/%db data/%db sense\n",
2325 			device_get_nameunit(sbp->fd.dev),
2326 			ccb->ccb_h.target_id, (uintmax_t)ccb->ccb_h.target_lun,
2327 			csio->cdb_io.cdb_bytes[0],
2328 			csio->cdb_io.cdb_bytes[1],
2329 			csio->cdb_io.cdb_bytes[2],
2330 			csio->cdb_io.cdb_bytes[3],
2331 			csio->cdb_io.cdb_bytes[4],
2332 			csio->cdb_io.cdb_bytes[5],
2333 			csio->cdb_io.cdb_bytes[6],
2334 			csio->cdb_io.cdb_bytes[7],
2335 			csio->cdb_io.cdb_bytes[8],
2336 			csio->cdb_io.cdb_bytes[9],
2337 			ccb->ccb_h.flags & CAM_DIR_MASK,
2338 			csio->cdb_len, csio->dxfer_len,
2339 			csio->sense_len);
2340 END_DEBUG
2341 		if (sdev == NULL) {
2342 			ccb->ccb_h.status = CAM_DEV_NOT_THERE;
2343 			xpt_done(ccb);
2344 			return;
2345 		}
2346 		if (csio->cdb_len > sizeof(ocb->orb) - 5 * sizeof(uint32_t)) {
2347 			ccb->ccb_h.status = CAM_REQ_INVALID;
2348 			xpt_done(ccb);
2349 			return;
2350 		}
2351 		if ((ocb = sbp_get_ocb(sdev)) == NULL) {
2352 			ccb->ccb_h.status = CAM_RESRC_UNAVAIL;
2353 			if (sdev->freeze == 0) {
2354 				xpt_freeze_devq(sdev->path, 1);
2355 				sdev->freeze++;
2356 			}
2357 			xpt_done(ccb);
2358 			return;
2359 		}
2360 
2361 		ocb->flags = OCB_ACT_CMD;
2362 		ocb->sdev = sdev;
2363 		ocb->ccb = ccb;
2364 		ccb->ccb_h.ccb_sdev_ptr = sdev;
2365 		ocb->orb[0] = htonl(1U << 31);
2366 		ocb->orb[1] = 0;
2367 		ocb->orb[2] = htonl(((sbp->fd.fc->nodeid | FWLOCALBUS) << 16));
2368 		ocb->orb[3] = htonl(ocb->bus_addr + IND_PTR_OFFSET);
2369 		speed = min(target->fwdev->speed, max_speed);
2370 		ocb->orb[4] = htonl(ORB_NOTIFY | ORB_CMD_SPD(speed)
2371 						| ORB_CMD_MAXP(speed + 7));
2372 		if ((ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN) {
2373 			ocb->orb[4] |= htonl(ORB_CMD_IN);
2374 		}
2375 
2376 		if (csio->ccb_h.flags & CAM_CDB_POINTER)
2377 			cdb = (void *)csio->cdb_io.cdb_ptr;
2378 		else
2379 			cdb = (void *)&csio->cdb_io.cdb_bytes;
2380 		bcopy(cdb, (void *)&ocb->orb[5], csio->cdb_len);
2381 /*
2382 printf("ORB %08x %08x %08x %08x\n", ntohl(ocb->orb[0]), ntohl(ocb->orb[1]), ntohl(ocb->orb[2]), ntohl(ocb->orb[3]));
2383 printf("ORB %08x %08x %08x %08x\n", ntohl(ocb->orb[4]), ntohl(ocb->orb[5]), ntohl(ocb->orb[6]), ntohl(ocb->orb[7]));
2384 */
2385 		if (ccb->csio.dxfer_len > 0) {
2386 			int error;
2387 
2388 			error = bus_dmamap_load_ccb(/*dma tag*/sbp->dmat,
2389 					/*dma map*/ocb->dmamap,
2390 					ccb,
2391 					sbp_execute_ocb,
2392 					ocb,
2393 					/*flags*/0);
2394 			if (error)
2395 				printf("sbp: bus_dmamap_load error %d\n", error);
2396 		} else
2397 			sbp_execute_ocb(ocb, NULL, 0, 0);
2398 		break;
2399 	}
2400 	case XPT_CALC_GEOMETRY:
2401 	{
2402 		struct ccb_calc_geometry *ccg;
2403 
2404 		ccg = &ccb->ccg;
2405 		if (ccg->block_size == 0) {
2406 			printf("sbp_action: block_size is 0.\n");
2407 			ccb->ccb_h.status = CAM_REQ_INVALID;
2408 			xpt_done(ccb);
2409 			break;
2410 		}
2411 SBP_DEBUG(1)
2412 		printf("%s:%d:%d:%jx:XPT_CALC_GEOMETRY: "
2413 			"Volume size = %jd\n",
2414 			device_get_nameunit(sbp->fd.dev),
2415 			cam_sim_path(sbp->sim),
2416 			ccb->ccb_h.target_id, (uintmax_t)ccb->ccb_h.target_lun,
2417 			(uintmax_t)ccg->volume_size);
2418 END_DEBUG
2419 
2420 		cam_calc_geometry(ccg, /*extended*/1);
2421 		xpt_done(ccb);
2422 		break;
2423 	}
2424 	case XPT_RESET_BUS:		/* Reset the specified SCSI bus */
2425 	{
2426 
2427 SBP_DEBUG(1)
2428 		printf("%s:%d:XPT_RESET_BUS: \n",
2429 			device_get_nameunit(sbp->fd.dev), cam_sim_path(sbp->sim));
2430 END_DEBUG
2431 
2432 		ccb->ccb_h.status = CAM_REQ_INVALID;
2433 		xpt_done(ccb);
2434 		break;
2435 	}
2436 	case XPT_PATH_INQ:		/* Path routing inquiry */
2437 	{
2438 		struct ccb_pathinq *cpi = &ccb->cpi;
2439 
2440 SBP_DEBUG(1)
2441 		printf("%s:%d:%jx XPT_PATH_INQ:.\n",
2442 			device_get_nameunit(sbp->fd.dev),
2443 			ccb->ccb_h.target_id, (uintmax_t)ccb->ccb_h.target_lun);
2444 END_DEBUG
2445 		cpi->version_num = 1; /* XXX??? */
2446 		cpi->hba_inquiry = PI_TAG_ABLE;
2447 		cpi->target_sprt = 0;
2448 		cpi->hba_misc = PIM_NOBUSRESET | PIM_NO_6_BYTE;
2449 		cpi->hba_eng_cnt = 0;
2450 		cpi->max_target = SBP_NUM_TARGETS - 1;
2451 		cpi->max_lun = SBP_NUM_LUNS - 1;
2452 		cpi->initiator_id = SBP_INITIATOR;
2453 		cpi->bus_id = sim->bus_id;
2454 		cpi->base_transfer_speed = 400 * 1000 / 8;
2455 		strlcpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
2456 		strlcpy(cpi->hba_vid, "SBP", HBA_IDLEN);
2457 		strlcpy(cpi->dev_name, sim->sim_name, DEV_IDLEN);
2458 		cpi->unit_number = sim->unit_number;
2459 		cpi->transport = XPORT_SPI;	/* XX should have a FireWire */
2460 		cpi->transport_version = 2;
2461 		cpi->protocol = PROTO_SCSI;
2462 		cpi->protocol_version = SCSI_REV_2;
2463 
2464 		cpi->ccb_h.status = CAM_REQ_CMP;
2465 		xpt_done(ccb);
2466 		break;
2467 	}
2468 	case XPT_GET_TRAN_SETTINGS:
2469 	{
2470 		struct ccb_trans_settings *cts = &ccb->cts;
2471 		struct ccb_trans_settings_scsi *scsi =
2472 		    &cts->proto_specific.scsi;
2473 		struct ccb_trans_settings_spi *spi =
2474 		    &cts->xport_specific.spi;
2475 
2476 		cts->protocol = PROTO_SCSI;
2477 		cts->protocol_version = SCSI_REV_2;
2478 		cts->transport = XPORT_SPI;	/* should have a FireWire */
2479 		cts->transport_version = 2;
2480 		spi->valid = CTS_SPI_VALID_DISC;
2481 		spi->flags = CTS_SPI_FLAGS_DISC_ENB;
2482 		scsi->valid = CTS_SCSI_VALID_TQ;
2483 		scsi->flags = CTS_SCSI_FLAGS_TAG_ENB;
2484 SBP_DEBUG(1)
2485 		printf("%s:%d:%jx XPT_GET_TRAN_SETTINGS:.\n",
2486 			device_get_nameunit(sbp->fd.dev),
2487 			ccb->ccb_h.target_id, (uintmax_t)ccb->ccb_h.target_lun);
2488 END_DEBUG
2489 		cts->ccb_h.status = CAM_REQ_CMP;
2490 		xpt_done(ccb);
2491 		break;
2492 	}
2493 	case XPT_ABORT:
2494 		ccb->ccb_h.status = CAM_UA_ABORT;
2495 		xpt_done(ccb);
2496 		break;
2497 	case XPT_SET_TRAN_SETTINGS:
2498 		/* XXX */
2499 	default:
2500 		ccb->ccb_h.status = CAM_REQ_INVALID;
2501 		xpt_done(ccb);
2502 		break;
2503 	}
2504 	return;
2505 }
2506 
2507 static void
2508 sbp_execute_ocb(void *arg, bus_dma_segment_t *segments, int seg, int error)
2509 {
2510 	int i;
2511 	struct sbp_ocb *ocb;
2512 	struct sbp_ocb *prev;
2513 	bus_dma_segment_t *s;
2514 
2515 	if (error)
2516 		printf("sbp_execute_ocb: error=%d\n", error);
2517 
2518 	ocb = (struct sbp_ocb *)arg;
2519 
2520 SBP_DEBUG(2)
2521 	printf("sbp_execute_ocb: seg %d", seg);
2522 	for (i = 0; i < seg; i++)
2523 		printf(", %jx:%jd", (uintmax_t)segments[i].ds_addr,
2524 					(uintmax_t)segments[i].ds_len);
2525 	printf("\n");
2526 END_DEBUG
2527 
2528 	if (seg == 1) {
2529 		/* direct pointer */
2530 		s = &segments[0];
2531 		if (s->ds_len > SBP_SEG_MAX)
2532 			panic("ds_len > SBP_SEG_MAX, fix busdma code");
2533 		ocb->orb[3] = htonl(s->ds_addr);
2534 		ocb->orb[4] |= htonl(s->ds_len);
2535 	} else if (seg > 1) {
2536 		/* page table */
2537 		for (i = 0; i < seg; i++) {
2538 			s = &segments[i];
2539 SBP_DEBUG(0)
2540 			/* XXX LSI Logic "< 16 byte" bug might be hit */
2541 			if (s->ds_len < 16)
2542 				printf("sbp_execute_ocb: warning, "
2543 					"segment length(%zd) is less than 16."
2544 					"(seg=%d/%d)\n", (size_t)s->ds_len, i + 1, seg);
2545 END_DEBUG
2546 			if (s->ds_len > SBP_SEG_MAX)
2547 				panic("ds_len > SBP_SEG_MAX, fix busdma code");
2548 			ocb->ind_ptr[i].hi = htonl(s->ds_len << 16);
2549 			ocb->ind_ptr[i].lo = htonl(s->ds_addr);
2550 		}
2551 		ocb->orb[4] |= htonl(ORB_CMD_PTBL | seg);
2552 	}
2553 
2554 	if (seg > 0)
2555 		bus_dmamap_sync(ocb->sdev->target->sbp->dmat, ocb->dmamap,
2556 			(ntohl(ocb->orb[4]) & ORB_CMD_IN) ?
2557 			BUS_DMASYNC_PREREAD : BUS_DMASYNC_PREWRITE);
2558 	prev = sbp_enqueue_ocb(ocb->sdev, ocb);
2559 	fwdma_sync(&ocb->sdev->dma, BUS_DMASYNC_PREWRITE);
2560 	if (use_doorbell) {
2561 		if (prev == NULL) {
2562 			if (ocb->sdev->last_ocb != NULL)
2563 				sbp_doorbell(ocb->sdev);
2564 			else
2565 				sbp_orb_pointer(ocb->sdev, ocb);
2566 		}
2567 	} else {
2568 		if (prev == NULL || (ocb->sdev->flags & ORB_LINK_DEAD) != 0) {
2569 			ocb->sdev->flags &= ~ORB_LINK_DEAD;
2570 			sbp_orb_pointer(ocb->sdev, ocb);
2571 		}
2572 	}
2573 }
2574 
2575 static void
2576 sbp_poll(struct cam_sim *sim)
2577 {
2578 	struct sbp_softc *sbp;
2579 	struct firewire_comm *fc;
2580 
2581 	sbp = cam_sim_softc(sim);
2582 	fc = sbp->fd.fc;
2583 
2584 	fc->poll(fc, 0, -1);
2585 
2586 	return;
2587 }
2588 
2589 static struct sbp_ocb *
2590 sbp_dequeue_ocb(struct sbp_dev *sdev, struct sbp_status *sbp_status)
2591 {
2592 	struct sbp_ocb *ocb;
2593 	struct sbp_ocb *next;
2594 	int order = 0;
2595 
2596 SBP_DEBUG(1)
2597 	device_printf(sdev->target->sbp->fd.dev,
2598 	"%s:%s 0x%08x src %d\n",
2599 	    __func__, sdev->bustgtlun, ntohl(sbp_status->orb_lo), sbp_status->src);
2600 END_DEBUG
2601 	SBP_LOCK_ASSERT(sdev->target->sbp);
2602 	STAILQ_FOREACH_SAFE(ocb, &sdev->ocbs, ocb, next) {
2603 		if (OCB_MATCH(ocb, sbp_status)) {
2604 			/* found */
2605 			STAILQ_REMOVE(&sdev->ocbs, ocb, sbp_ocb, ocb);
2606 			if (ocb->ccb != NULL)
2607 				callout_stop(&ocb->timer);
2608 			if (ntohl(ocb->orb[4]) & 0xffff) {
2609 				bus_dmamap_sync(sdev->target->sbp->dmat,
2610 					ocb->dmamap,
2611 					(ntohl(ocb->orb[4]) & ORB_CMD_IN) ?
2612 					BUS_DMASYNC_POSTREAD :
2613 					BUS_DMASYNC_POSTWRITE);
2614 				bus_dmamap_unload(sdev->target->sbp->dmat,
2615 					ocb->dmamap);
2616 			}
2617 			if (!use_doorbell) {
2618 				if (sbp_status->src == SRC_NO_NEXT) {
2619 					if (next != NULL)
2620 						sbp_orb_pointer(sdev, next);
2621 					else if (order > 0) {
2622 						/*
2623 						 * Unordered execution
2624 						 * We need to send pointer for
2625 						 * next ORB
2626 						 */
2627 						sdev->flags |= ORB_LINK_DEAD;
2628 					}
2629 				}
2630 			} else {
2631 				/*
2632 				 * XXX this is not correct for unordered
2633 				 * execution.
2634 				 */
2635 				if (sdev->last_ocb != NULL) {
2636 					sbp_free_ocb(sdev, sdev->last_ocb);
2637 				}
2638 				sdev->last_ocb = ocb;
2639 				if (next != NULL &&
2640 				    sbp_status->src == SRC_NO_NEXT)
2641 					sbp_doorbell(sdev);
2642 			}
2643 			break;
2644 		} else
2645 			order++;
2646 	}
2647 SBP_DEBUG(0)
2648 	if (ocb && order > 0) {
2649 		device_printf(sdev->target->sbp->fd.dev,
2650 			"%s:%s unordered execution order:%d\n",
2651 			__func__, sdev->bustgtlun, order);
2652 	}
2653 END_DEBUG
2654 	return (ocb);
2655 }
2656 
2657 static struct sbp_ocb *
2658 sbp_enqueue_ocb(struct sbp_dev *sdev, struct sbp_ocb *ocb)
2659 {
2660 	struct sbp_ocb *prev, *prev2;
2661 
2662 	SBP_LOCK_ASSERT(sdev->target->sbp);
2663 SBP_DEBUG(1)
2664 	device_printf(sdev->target->sbp->fd.dev,
2665 	"%s:%s 0x%08jx\n", __func__, sdev->bustgtlun, (uintmax_t)ocb->bus_addr);
2666 END_DEBUG
2667 	prev2 = prev = STAILQ_LAST(&sdev->ocbs, sbp_ocb, ocb);
2668 	STAILQ_INSERT_TAIL(&sdev->ocbs, ocb, ocb);
2669 
2670 	if (ocb->ccb != NULL) {
2671 		callout_reset_sbt(&ocb->timer,
2672 		    SBT_1MS * ocb->ccb->ccb_h.timeout, 0, sbp_timeout,
2673 		    ocb, 0);
2674 	}
2675 
2676 	if (use_doorbell && prev == NULL)
2677 		prev2 = sdev->last_ocb;
2678 
2679 	if (prev2 != NULL && (ocb->sdev->flags & ORB_LINK_DEAD) == 0) {
2680 SBP_DEBUG(1)
2681 		printf("linking chain 0x%jx -> 0x%jx\n",
2682 		    (uintmax_t)prev2->bus_addr, (uintmax_t)ocb->bus_addr);
2683 END_DEBUG
2684 		/*
2685 		 * Suppress compiler optimization so that orb[1] must be written first.
2686 		 * XXX We may need an explicit memory barrier for other architectures
2687 		 * other than i386/amd64.
2688 		 */
2689 		*(volatile uint32_t *)&prev2->orb[1] = htonl(ocb->bus_addr);
2690 		*(volatile uint32_t *)&prev2->orb[0] = 0;
2691 	}
2692 
2693 	return prev;
2694 }
2695 
2696 static struct sbp_ocb *
2697 sbp_get_ocb(struct sbp_dev *sdev)
2698 {
2699 	struct sbp_ocb *ocb;
2700 
2701 	SBP_LOCK_ASSERT(sdev->target->sbp);
2702 	ocb = STAILQ_FIRST(&sdev->free_ocbs);
2703 	if (ocb == NULL) {
2704 		sdev->flags |= ORB_SHORTAGE;
2705 		printf("ocb shortage!!!\n");
2706 		return NULL;
2707 	}
2708 	STAILQ_REMOVE_HEAD(&sdev->free_ocbs, ocb);
2709 	ocb->ccb = NULL;
2710 	return (ocb);
2711 }
2712 
2713 static void
2714 sbp_free_ocb(struct sbp_dev *sdev, struct sbp_ocb *ocb)
2715 {
2716 	ocb->flags = 0;
2717 	ocb->ccb = NULL;
2718 
2719 	SBP_LOCK_ASSERT(sdev->target->sbp);
2720 	STAILQ_INSERT_TAIL(&sdev->free_ocbs, ocb, ocb);
2721 	if ((sdev->flags & ORB_SHORTAGE) != 0) {
2722 		int count;
2723 
2724 		sdev->flags &= ~ORB_SHORTAGE;
2725 		count = sdev->freeze;
2726 		sdev->freeze = 0;
2727 		xpt_release_devq(sdev->path, count, TRUE);
2728 	}
2729 }
2730 
2731 static void
2732 sbp_abort_ocb(struct sbp_ocb *ocb, int status)
2733 {
2734 	struct sbp_dev *sdev;
2735 
2736 	sdev = ocb->sdev;
2737 	SBP_LOCK_ASSERT(sdev->target->sbp);
2738 SBP_DEBUG(0)
2739 	device_printf(sdev->target->sbp->fd.dev,
2740 	"%s:%s 0x%jx\n", __func__, sdev->bustgtlun, (uintmax_t)ocb->bus_addr);
2741 END_DEBUG
2742 SBP_DEBUG(1)
2743 	if (ocb->ccb != NULL)
2744 		sbp_print_scsi_cmd(ocb);
2745 END_DEBUG
2746 	if (ntohl(ocb->orb[4]) & 0xffff) {
2747 		bus_dmamap_sync(sdev->target->sbp->dmat, ocb->dmamap,
2748 			(ntohl(ocb->orb[4]) & ORB_CMD_IN) ?
2749 			BUS_DMASYNC_POSTREAD : BUS_DMASYNC_POSTWRITE);
2750 		bus_dmamap_unload(sdev->target->sbp->dmat, ocb->dmamap);
2751 	}
2752 	if (ocb->ccb != NULL) {
2753 		callout_stop(&ocb->timer);
2754 		ocb->ccb->ccb_h.status = status;
2755 		xpt_done(ocb->ccb);
2756 	}
2757 	sbp_free_ocb(sdev, ocb);
2758 }
2759 
2760 static void
2761 sbp_abort_all_ocbs(struct sbp_dev *sdev, int status)
2762 {
2763 	struct sbp_ocb *ocb, *next;
2764 	STAILQ_HEAD(, sbp_ocb) temp;
2765 
2766 	STAILQ_INIT(&temp);
2767 	SBP_LOCK_ASSERT(sdev->target->sbp);
2768 	STAILQ_CONCAT(&temp, &sdev->ocbs);
2769 	STAILQ_INIT(&sdev->ocbs);
2770 
2771 	STAILQ_FOREACH_SAFE(ocb, &temp, ocb, next) {
2772 		sbp_abort_ocb(ocb, status);
2773 	}
2774 	if (sdev->last_ocb != NULL) {
2775 		sbp_free_ocb(sdev, sdev->last_ocb);
2776 		sdev->last_ocb = NULL;
2777 	}
2778 }
2779 
2780 static device_method_t sbp_methods[] = {
2781 	/* device interface */
2782 	DEVMETHOD(device_identify,	sbp_identify),
2783 	DEVMETHOD(device_probe,		sbp_probe),
2784 	DEVMETHOD(device_attach,	sbp_attach),
2785 	DEVMETHOD(device_detach,	sbp_detach),
2786 	DEVMETHOD(device_shutdown,	sbp_shutdown),
2787 
2788 	DEVMETHOD_END
2789 };
2790 
2791 static driver_t sbp_driver = {
2792 	"sbp",
2793 	sbp_methods,
2794 	sizeof(struct sbp_softc),
2795 };
2796 DRIVER_MODULE(sbp, firewire, sbp_driver, 0, 0);
2797 MODULE_VERSION(sbp, 1);
2798 MODULE_DEPEND(sbp, firewire, 1, 1, 1);
2799 MODULE_DEPEND(sbp, cam, 1, 1, 1);
2800