xref: /freebsd/sys/dev/firewire/sbp_targ.c (revision 8ef24a0d4b28fe230e20637f56869cc4148cd2ca)
1 /*-
2  * Copyright (C) 2003
3  * 	Hidetoshi Shimokawa. All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. All advertising materials mentioning features or use of this software
14  *    must display the following acknowledgement:
15  *
16  *	This product includes software developed by Hidetoshi Shimokawa.
17  *
18  * 4. Neither the name of the author nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  * $FreeBSD$
35  */
36 
37 #include <sys/param.h>
38 #include <sys/kernel.h>
39 #include <sys/systm.h>
40 #include <sys/sysctl.h>
41 #include <sys/types.h>
42 #include <sys/conf.h>
43 #include <sys/malloc.h>
44 #include <sys/endian.h>
45 
46 #include <sys/bus.h>
47 #include <machine/bus.h>
48 
49 #include <dev/firewire/firewire.h>
50 #include <dev/firewire/firewirereg.h>
51 #include <dev/firewire/iec13213.h>
52 #include <dev/firewire/sbp.h>
53 #include <dev/firewire/fwmem.h>
54 
55 #include <cam/cam.h>
56 #include <cam/cam_ccb.h>
57 #include <cam/cam_sim.h>
58 #include <cam/cam_xpt_sim.h>
59 #include <cam/cam_debug.h>
60 #include <cam/cam_periph.h>
61 #include <cam/scsi/scsi_all.h>
62 #include <cam/scsi/scsi_message.h>
63 
64 #define SBP_TARG_RECV_LEN	8
65 #define MAX_INITIATORS		8
66 #define MAX_LUN			63
67 #define MAX_LOGINS		63
68 #define MAX_NODES		63
69 /*
70  * management/command block agent registers
71  *
72  * BASE 0xffff f001 0000 management port
73  * BASE 0xffff f001 0020 command port for login id 0
74  * BASE 0xffff f001 0040 command port for login id 1
75  *
76  */
77 #define SBP_TARG_MGM	 0x10000	/* offset from 0xffff f000 000 */
78 #define SBP_TARG_BIND_HI	0xffff
79 #define SBP_TARG_BIND_LO(l)	(0xf0000000 + SBP_TARG_MGM + 0x20 * ((l) + 1))
80 #define SBP_TARG_BIND_START	(((u_int64_t)SBP_TARG_BIND_HI << 32) | \
81 				    SBP_TARG_BIND_LO(-1))
82 #define SBP_TARG_BIND_END	(((u_int64_t)SBP_TARG_BIND_HI << 32) | \
83 				    SBP_TARG_BIND_LO(MAX_LOGINS))
84 #define SBP_TARG_LOGIN_ID(lo)	(((lo) - SBP_TARG_BIND_LO(0))/0x20)
85 
86 #define FETCH_MGM	0
87 #define FETCH_CMD	1
88 #define FETCH_POINTER	2
89 
90 #define F_LINK_ACTIVE	(1 << 0)
91 #define F_ATIO_STARVED	(1 << 1)
92 #define F_LOGIN		(1 << 2)
93 #define F_HOLD		(1 << 3)
94 #define F_FREEZED	(1 << 4)
95 
96 static MALLOC_DEFINE(M_SBP_TARG, "sbp_targ", "SBP-II/FireWire target mode");
97 
98 static int debug = 0;
99 
100 SYSCTL_INT(_debug, OID_AUTO, sbp_targ_debug, CTLFLAG_RW, &debug, 0,
101         "SBP target mode debug flag");
102 
103 struct sbp_targ_login {
104 	struct sbp_targ_lstate *lstate;
105 	struct fw_device *fwdev;
106 	struct sbp_login_res loginres;
107 	uint16_t fifo_hi;
108 	uint16_t last_hi;
109 	uint32_t fifo_lo;
110 	uint32_t last_lo;
111 	STAILQ_HEAD(, orb_info) orbs;
112 	STAILQ_ENTRY(sbp_targ_login) link;
113 	uint16_t hold_sec;
114 	uint16_t id;
115 	uint8_t flags;
116 	uint8_t spd;
117 	struct callout hold_callout;
118 };
119 
120 struct sbp_targ_lstate {
121 	uint16_t lun;
122 	struct sbp_targ_softc *sc;
123 	struct cam_path *path;
124 	struct ccb_hdr_slist accept_tios;
125 	struct ccb_hdr_slist immed_notifies;
126 	struct crom_chunk model;
127 	uint32_t flags;
128 	STAILQ_HEAD(, sbp_targ_login) logins;
129 };
130 
131 struct sbp_targ_softc {
132         struct firewire_dev_comm fd;
133 	struct cam_sim *sim;
134 	struct cam_path *path;
135 	struct fw_bind fwb;
136 	int ndevs;
137 	int flags;
138 	struct crom_chunk unit;
139 	struct sbp_targ_lstate *lstate[MAX_LUN];
140 	struct sbp_targ_lstate *black_hole;
141 	struct sbp_targ_login *logins[MAX_LOGINS];
142 	struct mtx mtx;
143 };
144 #define SBP_LOCK(sc) mtx_lock(&(sc)->mtx)
145 #define SBP_UNLOCK(sc) mtx_unlock(&(sc)->mtx)
146 
147 struct corb4 {
148 #if BYTE_ORDER == BIG_ENDIAN
149 	uint32_t n:1,
150 		  rq_fmt:2,
151 		  :1,
152 		  dir:1,
153 		  spd:3,
154 		  max_payload:4,
155 		  page_table_present:1,
156 		  page_size:3,
157 		  data_size:16;
158 #else
159 	uint32_t data_size:16,
160 		  page_size:3,
161 		  page_table_present:1,
162 		  max_payload:4,
163 		  spd:3,
164 		  dir:1,
165 		  :1,
166 		  rq_fmt:2,
167 		  n:1;
168 #endif
169 };
170 
171 struct morb4 {
172 #if BYTE_ORDER == BIG_ENDIAN
173 	uint32_t n:1,
174 		  rq_fmt:2,
175 		  :9,
176 		  fun:4,
177 		  id:16;
178 #else
179 	uint32_t id:16,
180 		  fun:4,
181 		  :9,
182 		  rq_fmt:2,
183 		  n:1;
184 #endif
185 };
186 
187 
188 /*
189  * Urestricted page table format
190  * states that the segment length
191  * and high base addr are in the first
192  * 32 bits and the base low is in
193  * the second
194  */
195 struct unrestricted_page_table_fmt {
196 	uint16_t segment_len;
197 	uint16_t segment_base_high;
198 	uint32_t segment_base_low;
199 };
200 
201 
202 struct orb_info {
203 	struct sbp_targ_softc *sc;
204 	struct fw_device *fwdev;
205 	struct sbp_targ_login *login;
206 	union ccb *ccb;
207 	struct ccb_accept_tio *atio;
208 	uint8_t state;
209 #define ORBI_STATUS_NONE	0
210 #define ORBI_STATUS_FETCH	1
211 #define ORBI_STATUS_ATIO	2
212 #define ORBI_STATUS_CTIO	3
213 #define ORBI_STATUS_STATUS	4
214 #define ORBI_STATUS_POINTER	5
215 #define ORBI_STATUS_ABORTED	7
216 	uint8_t refcount;
217 	uint16_t orb_hi;
218 	uint32_t orb_lo;
219 	uint32_t data_hi;
220 	uint32_t data_lo;
221 	struct corb4 orb4;
222 	STAILQ_ENTRY(orb_info) link;
223 	uint32_t orb[8];
224 	struct unrestricted_page_table_fmt *page_table;
225 	struct unrestricted_page_table_fmt *cur_pte;
226 	struct unrestricted_page_table_fmt *last_pte;
227 	uint32_t  last_block_read;
228 	struct sbp_status status;
229 };
230 
231 static char *orb_fun_name[] = {
232 	ORB_FUN_NAMES
233 };
234 
235 static void sbp_targ_recv(struct fw_xfer *);
236 static void sbp_targ_fetch_orb(struct sbp_targ_softc *, struct fw_device *,
237     uint16_t, uint32_t, struct sbp_targ_login *, int);
238 static void sbp_targ_xfer_pt(struct orb_info *);
239 static void sbp_targ_abort(struct sbp_targ_softc *, struct orb_info *);
240 
241 static void
242 sbp_targ_identify(driver_t *driver, device_t parent)
243 {
244 	BUS_ADD_CHILD(parent, 0, "sbp_targ", device_get_unit(parent));
245 }
246 
247 static int
248 sbp_targ_probe(device_t dev)
249 {
250 	device_t pa;
251 
252 	pa = device_get_parent(dev);
253 	if (device_get_unit(dev) != device_get_unit(pa)) {
254 		return (ENXIO);
255 	}
256 
257 	device_set_desc(dev, "SBP-2/SCSI over FireWire target mode");
258 	return (0);
259 }
260 
261 static void
262 sbp_targ_dealloc_login(struct sbp_targ_login *login)
263 {
264 	struct orb_info *orbi, *next;
265 
266 	if (login == NULL) {
267 		printf("%s: login = NULL\n", __func__);
268 		return;
269 	}
270 	for (orbi = STAILQ_FIRST(&login->orbs); orbi != NULL; orbi = next) {
271 		next = STAILQ_NEXT(orbi, link);
272 		if (debug)
273 			printf("%s: free orbi %p\n", __func__, orbi);
274 		free(orbi, M_SBP_TARG);
275 		orbi = NULL;
276 	}
277 	callout_stop(&login->hold_callout);
278 
279 	STAILQ_REMOVE(&login->lstate->logins, login, sbp_targ_login, link);
280 	login->lstate->sc->logins[login->id] = NULL;
281 	if (debug)
282 		printf("%s: free login %p\n", __func__, login);
283 	free((void *)login, M_SBP_TARG);
284 	login = NULL;
285 }
286 
287 static void
288 sbp_targ_hold_expire(void *arg)
289 {
290 	struct sbp_targ_login *login;
291 
292 	login = (struct sbp_targ_login *)arg;
293 
294 	if (login->flags & F_HOLD) {
295 		printf("%s: login_id=%d expired\n", __func__, login->id);
296 		sbp_targ_dealloc_login(login);
297 	} else {
298 		printf("%s: login_id=%d not hold\n", __func__, login->id);
299 	}
300 }
301 
302 static void
303 sbp_targ_post_busreset(void *arg)
304 {
305 	struct sbp_targ_softc *sc;
306 	struct crom_src *src;
307 	struct crom_chunk *root;
308 	struct crom_chunk *unit;
309 	struct sbp_targ_lstate *lstate;
310 	struct sbp_targ_login *login;
311 	int i;
312 
313 	sc = (struct sbp_targ_softc *)arg;
314 	src = sc->fd.fc->crom_src;
315 	root = sc->fd.fc->crom_root;
316 
317 	unit = &sc->unit;
318 
319 	if ((sc->flags & F_FREEZED) == 0) {
320 		SBP_LOCK(sc);
321 		sc->flags |= F_FREEZED;
322 		xpt_freeze_simq(sc->sim, /*count*/1);
323 		SBP_UNLOCK(sc);
324 	} else {
325 		printf("%s: already freezed\n", __func__);
326 	}
327 
328 	bzero(unit, sizeof(struct crom_chunk));
329 
330 	crom_add_chunk(src, root, unit, CROM_UDIR);
331 	crom_add_entry(unit, CSRKEY_SPEC, CSRVAL_ANSIT10);
332 	crom_add_entry(unit, CSRKEY_VER, CSRVAL_T10SBP2);
333 	crom_add_entry(unit, CSRKEY_COM_SPEC, CSRVAL_ANSIT10);
334 	crom_add_entry(unit, CSRKEY_COM_SET, CSRVAL_SCSI);
335 
336 	crom_add_entry(unit, CROM_MGM, SBP_TARG_MGM >> 2);
337 	crom_add_entry(unit, CSRKEY_UNIT_CH, (10<<8) | 8);
338 
339 	for (i = 0; i < MAX_LUN; i++) {
340 		lstate = sc->lstate[i];
341 		if (lstate == NULL)
342 			continue;
343 		crom_add_entry(unit, CSRKEY_FIRM_VER, 1);
344 		crom_add_entry(unit, CROM_LUN, i);
345 		crom_add_entry(unit, CSRKEY_MODEL, 1);
346 		crom_add_simple_text(src, unit, &lstate->model, "TargetMode");
347 	}
348 
349 	/* Process for reconnection hold time */
350 	for (i = 0; i < MAX_LOGINS; i++) {
351 		login = sc->logins[i];
352 		if (login == NULL)
353 			continue;
354 		sbp_targ_abort(sc, STAILQ_FIRST(&login->orbs));
355 		if (login->flags & F_LOGIN) {
356 			login->flags |= F_HOLD;
357 			callout_reset(&login->hold_callout,
358 			    hz * login->hold_sec,
359 			    sbp_targ_hold_expire, (void *)login);
360 		}
361 	}
362 }
363 
364 static void
365 sbp_targ_post_explore(void *arg)
366 {
367 	struct sbp_targ_softc *sc;
368 
369 	sc = (struct sbp_targ_softc *)arg;
370 	SBP_LOCK(sc);
371 	sc->flags &= ~F_FREEZED;
372 	xpt_release_simq(sc->sim, /*run queue*/TRUE);
373 	SBP_UNLOCK(sc);
374 	return;
375 }
376 
377 static cam_status
378 sbp_targ_find_devs(struct sbp_targ_softc *sc, union ccb *ccb,
379     struct sbp_targ_lstate **lstate, int notfound_failure)
380 {
381 	u_int lun;
382 
383 	/* XXX 0 is the only vaild target_id */
384 	if (ccb->ccb_h.target_id == CAM_TARGET_WILDCARD &&
385 	    ccb->ccb_h.target_lun == CAM_LUN_WILDCARD) {
386 		*lstate = sc->black_hole;
387 		if (debug)
388 			printf("setting black hole for this target id(%d)\n", ccb->ccb_h.target_id);
389 		return (CAM_REQ_CMP);
390 	}
391 
392 	lun = ccb->ccb_h.target_lun;
393 	if (lun >= MAX_LUN)
394 		return (CAM_LUN_INVALID);
395 
396 	*lstate = sc->lstate[lun];
397 
398 	if (notfound_failure != 0 && *lstate == NULL) {
399 		if (debug)
400 			printf("%s: lstate for lun is invalid, target(%d), lun(%d)\n",
401 				__func__, ccb->ccb_h.target_id, lun);
402 		return (CAM_PATH_INVALID);
403 	} else
404 		if (debug)
405 			printf("%s: setting lstate for tgt(%d) lun(%d)\n",
406 				__func__,ccb->ccb_h.target_id, lun);
407 
408 	return (CAM_REQ_CMP);
409 }
410 
411 static void
412 sbp_targ_en_lun(struct sbp_targ_softc *sc, union ccb *ccb)
413 {
414 	struct ccb_en_lun *cel = &ccb->cel;
415 	struct sbp_targ_lstate *lstate;
416 	cam_status status;
417 
418 	status = sbp_targ_find_devs(sc, ccb, &lstate, 0);
419 	if (status != CAM_REQ_CMP) {
420 		ccb->ccb_h.status = status;
421 		return;
422 	}
423 
424 	if (cel->enable != 0) {
425 		if (lstate != NULL) {
426 			xpt_print_path(ccb->ccb_h.path);
427 			printf("Lun already enabled\n");
428 			ccb->ccb_h.status = CAM_LUN_ALRDY_ENA;
429 			return;
430 		}
431 		if (cel->grp6_len != 0 || cel->grp7_len != 0) {
432 			ccb->ccb_h.status = CAM_REQ_INVALID;
433 			printf("Non-zero Group Codes\n");
434 			return;
435 		}
436 		lstate = (struct sbp_targ_lstate *)
437 		    malloc(sizeof(*lstate), M_SBP_TARG, M_NOWAIT | M_ZERO);
438 		if (lstate == NULL) {
439 			xpt_print_path(ccb->ccb_h.path);
440 			printf("Couldn't allocate lstate\n");
441 			ccb->ccb_h.status = CAM_RESRC_UNAVAIL;
442 			return;
443 		} else {
444 			if (debug)
445 				printf("%s: malloc'd lstate %p\n",__func__, lstate);
446 		}
447 		if (ccb->ccb_h.target_id == CAM_TARGET_WILDCARD) {
448 			sc->black_hole = lstate;
449 			if (debug)
450 				printf("Blackhole set due to target id == %d\n",
451 					ccb->ccb_h.target_id);
452 		} else
453 			sc->lstate[ccb->ccb_h.target_lun] = lstate;
454 
455 		memset(lstate, 0, sizeof(*lstate));
456 		lstate->sc = sc;
457 		status = xpt_create_path(&lstate->path, /*periph*/NULL,
458 					 xpt_path_path_id(ccb->ccb_h.path),
459 					 xpt_path_target_id(ccb->ccb_h.path),
460 					 xpt_path_lun_id(ccb->ccb_h.path));
461 		if (status != CAM_REQ_CMP) {
462 			free(lstate, M_SBP_TARG);
463 			lstate = NULL;
464 			xpt_print_path(ccb->ccb_h.path);
465 			printf("Couldn't allocate path\n");
466 			ccb->ccb_h.status = CAM_RESRC_UNAVAIL;
467 			return;
468 		}
469 		SLIST_INIT(&lstate->accept_tios);
470 		SLIST_INIT(&lstate->immed_notifies);
471 		STAILQ_INIT(&lstate->logins);
472 
473 		ccb->ccb_h.status = CAM_REQ_CMP;
474 		xpt_print_path(ccb->ccb_h.path);
475 		printf("Lun now enabled for target mode\n");
476 		/* bus reset */
477 		sc->fd.fc->ibr(sc->fd.fc);
478 	} else {
479 		struct sbp_targ_login *login, *next;
480 
481 		if (lstate == NULL) {
482 			ccb->ccb_h.status = CAM_LUN_INVALID;
483 			printf("Invalid lstate for this target\n");
484 			return;
485 		}
486 		ccb->ccb_h.status = CAM_REQ_CMP;
487 
488 		if (SLIST_FIRST(&lstate->accept_tios) != NULL) {
489 			printf("ATIOs pending\n");
490 			ccb->ccb_h.status = CAM_REQ_INVALID;
491 		}
492 
493 		if (SLIST_FIRST(&lstate->immed_notifies) != NULL) {
494 			printf("INOTs pending\n");
495 			ccb->ccb_h.status = CAM_REQ_INVALID;
496 		}
497 
498 		if (ccb->ccb_h.status != CAM_REQ_CMP) {
499 			printf("status != CAM_REQ_CMP\n");
500 			return;
501 		}
502 
503 		xpt_print_path(ccb->ccb_h.path);
504 		printf("Target mode disabled\n");
505 		xpt_free_path(lstate->path);
506 
507 		for (login = STAILQ_FIRST(&lstate->logins); login != NULL;
508 		    login = next) {
509 			next = STAILQ_NEXT(login, link);
510 			sbp_targ_dealloc_login(login);
511 		}
512 
513 		if (ccb->ccb_h.target_id == CAM_TARGET_WILDCARD)
514 			sc->black_hole = NULL;
515 		else
516 			sc->lstate[ccb->ccb_h.target_lun] = NULL;
517 		if (debug)
518 			printf("%s: free lstate %p\n", __func__, lstate);
519 		free(lstate, M_SBP_TARG);
520 		lstate = NULL;
521 
522 		/* bus reset */
523 		sc->fd.fc->ibr(sc->fd.fc);
524 	}
525 }
526 
527 static void
528 sbp_targ_send_lstate_events(struct sbp_targ_softc *sc,
529     struct sbp_targ_lstate *lstate)
530 {
531 #if 0
532 	struct ccb_hdr *ccbh;
533 	struct ccb_immediate_notify *inot;
534 
535 	printf("%s: not implemented yet\n", __func__);
536 #endif
537 }
538 
539 
540 static __inline void
541 sbp_targ_remove_orb_info_locked(struct sbp_targ_login *login, struct orb_info *orbi)
542 {
543 	STAILQ_REMOVE(&login->orbs, orbi, orb_info, link);
544 }
545 
546 static __inline void
547 sbp_targ_remove_orb_info(struct sbp_targ_login *login, struct orb_info *orbi)
548 {
549 	SBP_LOCK(orbi->sc);
550 	STAILQ_REMOVE(&login->orbs, orbi, orb_info, link);
551 	SBP_UNLOCK(orbi->sc);
552 }
553 
554 /*
555  * tag_id/init_id encoding
556  *
557  * tag_id and init_id has only 32bit for each.
558  * scsi_target can handle very limited number(up to 15) of init_id.
559  * we have to encode 48bit orb and 64bit EUI64 into these
560  * variables.
561  *
562  * tag_id represents lower 32bit of ORB address.
563  * init_id represents login_id.
564  *
565  */
566 
567 static struct orb_info *
568 sbp_targ_get_orb_info(struct sbp_targ_lstate *lstate,
569     u_int tag_id, u_int init_id)
570 {
571 	struct sbp_targ_login *login;
572 	struct orb_info *orbi;
573 
574 	login = lstate->sc->logins[init_id];
575 	if (login == NULL) {
576 		printf("%s: no such login\n", __func__);
577 		return (NULL);
578 	}
579 	STAILQ_FOREACH(orbi, &login->orbs, link)
580 		if (orbi->orb_lo == tag_id)
581 			goto found;
582 	printf("%s: orb not found tag_id=0x%08x init_id=%d\n",
583 			 __func__, tag_id, init_id);
584 	return (NULL);
585 found:
586 	return (orbi);
587 }
588 
589 static void
590 sbp_targ_abort(struct sbp_targ_softc *sc, struct orb_info *orbi)
591 {
592 	struct orb_info *norbi;
593 
594 	SBP_LOCK(sc);
595 	for (; orbi != NULL; orbi = norbi) {
596 		printf("%s: status=%d ccb=%p\n", __func__, orbi->state, orbi->ccb);
597 		norbi = STAILQ_NEXT(orbi, link);
598 		if (orbi->state != ORBI_STATUS_ABORTED) {
599 			if (orbi->ccb != NULL) {
600 				orbi->ccb->ccb_h.status = CAM_REQ_ABORTED;
601 				xpt_done(orbi->ccb);
602 				orbi->ccb = NULL;
603 			}
604 			if (orbi->state <= ORBI_STATUS_ATIO) {
605 				sbp_targ_remove_orb_info_locked(orbi->login, orbi);
606 				if (debug)
607 					printf("%s: free orbi %p\n", __func__, orbi);
608 				free(orbi, M_SBP_TARG);
609 				orbi = NULL;
610 			} else
611 				orbi->state = ORBI_STATUS_ABORTED;
612 		}
613 	}
614 	SBP_UNLOCK(sc);
615 }
616 
617 static void
618 sbp_targ_free_orbi(struct fw_xfer *xfer)
619 {
620 	struct orb_info *orbi;
621 
622 	if (xfer->resp != 0) {
623 		/* XXX */
624 		printf("%s: xfer->resp = %d\n", __func__, xfer->resp);
625 	}
626 	orbi = (struct orb_info *)xfer->sc;
627 	if ( orbi->page_table != NULL ) {
628 		if (debug)
629 			printf("%s:  free orbi->page_table %p\n", __func__, orbi->page_table);
630 		free(orbi->page_table, M_SBP_TARG);
631 		orbi->page_table = NULL;
632 	}
633 	if (debug)
634 		printf("%s: free orbi %p\n", __func__, orbi);
635 	free(orbi, M_SBP_TARG);
636 	orbi = NULL;
637 	fw_xfer_free(xfer);
638 }
639 
640 static void
641 sbp_targ_status_FIFO(struct orb_info *orbi,
642     uint32_t fifo_hi, uint32_t fifo_lo, int dequeue)
643 {
644 	struct fw_xfer *xfer;
645 
646 	if (dequeue)
647 		sbp_targ_remove_orb_info(orbi->login, orbi);
648 
649 	xfer = fwmem_write_block(orbi->fwdev, (void *)orbi,
650 	    /*spd*/FWSPD_S400, fifo_hi, fifo_lo,
651 	    sizeof(uint32_t) * (orbi->status.len + 1), (char *)&orbi->status,
652 	    sbp_targ_free_orbi);
653 
654 	if (xfer == NULL) {
655 		/* XXX */
656 		printf("%s: xfer == NULL\n", __func__);
657 	}
658 }
659 
660 /*
661  * Generate the appropriate CAM status for the
662  * target.
663  */
664 static void
665 sbp_targ_send_status(struct orb_info *orbi, union ccb *ccb)
666 {
667 	struct sbp_status *sbp_status;
668 #if	0
669 	struct orb_info *norbi;
670 #endif
671 
672 	sbp_status = &orbi->status;
673 
674 	orbi->state = ORBI_STATUS_STATUS;
675 
676 	sbp_status->resp = 0; /* XXX */
677 	sbp_status->status = 0; /* XXX */
678 	sbp_status->dead = 0; /* XXX */
679 
680 	ccb->ccb_h.status= CAM_REQ_CMP;
681 
682 	switch (ccb->csio.scsi_status) {
683 	case SCSI_STATUS_OK:
684 		if (debug)
685 			printf("%s: STATUS_OK\n", __func__);
686 		sbp_status->len = 1;
687 		break;
688 	case SCSI_STATUS_CHECK_COND:
689 		if (debug)
690 			printf("%s: STATUS SCSI_STATUS_CHECK_COND\n", __func__);
691 		goto process_scsi_status;
692 	case SCSI_STATUS_BUSY:
693 		if (debug)
694 			printf("%s: STATUS SCSI_STATUS_BUSY\n", __func__);
695 		goto process_scsi_status;
696 	case SCSI_STATUS_CMD_TERMINATED:
697 process_scsi_status:
698 	{
699 		struct sbp_cmd_status *sbp_cmd_status;
700 		struct scsi_sense_data *sense;
701 		int error_code, sense_key, asc, ascq;
702 		uint8_t stream_bits;
703 		uint8_t sks[3];
704 		uint64_t info;
705 		int64_t sinfo;
706 		int sense_len;
707 
708 		sbp_cmd_status = (struct sbp_cmd_status *)&sbp_status->data[0];
709 		sbp_cmd_status->status = ccb->csio.scsi_status;
710 		sense = &ccb->csio.sense_data;
711 
712 #if 0		/* XXX What we should do? */
713 #if 0
714 		sbp_targ_abort(orbi->sc, STAILQ_NEXT(orbi, link));
715 #else
716 		norbi = STAILQ_NEXT(orbi, link);
717 		while (norbi) {
718 			printf("%s: status=%d\n", __func__, norbi->state);
719 			if (norbi->ccb != NULL) {
720 				norbi->ccb->ccb_h.status = CAM_REQ_ABORTED;
721 				xpt_done(norbi->ccb);
722 				norbi->ccb = NULL;
723 			}
724 			sbp_targ_remove_orb_info_locked(orbi->login, norbi);
725 			norbi = STAILQ_NEXT(norbi, link);
726 			free(norbi, M_SBP_TARG);
727 		}
728 #endif
729 #endif
730 
731 		sense_len = ccb->csio.sense_len - ccb->csio.sense_resid;
732 		scsi_extract_sense_len(sense, sense_len, &error_code,
733 		    &sense_key, &asc, &ascq, /*show_errors*/ 0);
734 
735 		switch (error_code) {
736 		case SSD_CURRENT_ERROR:
737 		case SSD_DESC_CURRENT_ERROR:
738 			sbp_cmd_status->sfmt = SBP_SFMT_CURR;
739 			break;
740 		default:
741 			sbp_cmd_status->sfmt = SBP_SFMT_DEFER;
742 			break;
743 		}
744 
745 		if (scsi_get_sense_info(sense, sense_len, SSD_DESC_INFO, &info,
746 					&sinfo) == 0) {
747 			uint32_t info_trunc;
748 			sbp_cmd_status->valid = 1;
749 			info_trunc = info;
750 
751 			sbp_cmd_status->info = htobe32(info_trunc);
752 		} else {
753 			sbp_cmd_status->valid = 0;
754 		}
755 
756 		sbp_cmd_status->s_key = sense_key;
757 
758 		if (scsi_get_stream_info(sense, sense_len, NULL,
759 					 &stream_bits) == 0) {
760 			sbp_cmd_status->mark =
761 			    (stream_bits & SSD_FILEMARK) ? 1 : 0;
762 			sbp_cmd_status->eom =
763 			    (stream_bits & SSD_EOM) ? 1 : 0;
764 			sbp_cmd_status->ill_len =
765 			    (stream_bits & SSD_ILI) ? 1 : 0;
766 		} else {
767 			sbp_cmd_status->mark = 0;
768 			sbp_cmd_status->eom = 0;
769 			sbp_cmd_status->ill_len = 0;
770 		}
771 
772 
773 		/* add_sense_code(_qual), info, cmd_spec_info */
774 		sbp_status->len = 4;
775 
776 		if (scsi_get_sense_info(sense, sense_len, SSD_DESC_COMMAND,
777 					&info, &sinfo) == 0) {
778 			uint32_t cmdspec_trunc;
779 
780 			cmdspec_trunc = info;
781 
782 			sbp_cmd_status->cdb = htobe32(cmdspec_trunc);
783 		}
784 
785 		sbp_cmd_status->s_code = asc;
786 		sbp_cmd_status->s_qlfr = ascq;
787 
788 		if (scsi_get_sense_info(sense, sense_len, SSD_DESC_FRU, &info,
789 					&sinfo) == 0) {
790 			sbp_cmd_status->fru = (uint8_t)info;
791 			sbp_status->len = 5;
792 		} else {
793 			sbp_cmd_status->fru = 0;
794 		}
795 
796 		if (scsi_get_sks(sense, sense_len, sks) == 0) {
797 			bcopy(sks, &sbp_cmd_status->s_keydep[0], sizeof(sks));
798 			sbp_status->len = 5;
799 			ccb->ccb_h.status |= CAM_SENT_SENSE;
800 		}
801 
802 		break;
803 	}
804 	default:
805 		printf("%s: unknown scsi status 0x%x\n", __func__,
806 		    sbp_status->status);
807 	}
808 
809 
810 	sbp_targ_status_FIFO(orbi,
811 	    orbi->login->fifo_hi, orbi->login->fifo_lo, /*dequeue*/1);
812 }
813 
814 /*
815  * Invoked as a callback handler from fwmem_read/write_block
816  *
817  * Process read/write of initiator address space
818  * completion and pass status onto the backend target.
819  * If this is a partial read/write for a CCB then
820  * we decrement the orbi's refcount to indicate
821  * the status of the read/write is complete
822  */
823 static void
824 sbp_targ_cam_done(struct fw_xfer *xfer)
825 {
826 	struct orb_info *orbi;
827 	union ccb *ccb;
828 
829 	orbi = (struct orb_info *)xfer->sc;
830 
831 	if (debug)
832 		printf("%s: resp=%d refcount=%d\n", __func__,
833 			xfer->resp, orbi->refcount);
834 
835 	if (xfer->resp != 0) {
836 		printf("%s: xfer->resp = %d\n", __func__, xfer->resp);
837 		orbi->status.resp = SBP_TRANS_FAIL;
838 		orbi->status.status = OBJ_DATA | SBE_TIMEOUT/*XXX*/;
839 		orbi->status.dead = 1;
840 		sbp_targ_abort(orbi->sc, STAILQ_NEXT(orbi, link));
841 	}
842 
843 	orbi->refcount--;
844 
845 	ccb = orbi->ccb;
846 	if (orbi->refcount == 0) {
847 		orbi->ccb = NULL;
848 		if (orbi->state == ORBI_STATUS_ABORTED) {
849 			if (debug)
850 				printf("%s: orbi aborted\n", __func__);
851 			sbp_targ_remove_orb_info(orbi->login, orbi);
852 			if (orbi->page_table != NULL) {
853 				if (debug)
854 					printf("%s: free orbi->page_table %p\n",
855 						__func__, orbi->page_table);
856 				free(orbi->page_table, M_SBP_TARG);
857 			}
858 			if (debug)
859 				printf("%s: free orbi %p\n", __func__, orbi);
860 			free(orbi, M_SBP_TARG);
861 			orbi = NULL;
862 		} else if (orbi->status.resp == ORBI_STATUS_NONE) {
863 			if ((ccb->ccb_h.flags & CAM_SEND_STATUS) != 0) {
864 				if (debug)
865 					printf("%s: CAM_SEND_STATUS set %0x\n", __func__, ccb->ccb_h.flags);
866 				sbp_targ_send_status(orbi, ccb);
867 			} else {
868 				if (debug)
869 					printf("%s: CAM_SEND_STATUS not set %0x\n", __func__, ccb->ccb_h.flags);
870 				ccb->ccb_h.status = CAM_REQ_CMP;
871 			}
872 			SBP_LOCK(orbi->sc);
873 			xpt_done(ccb);
874 			SBP_UNLOCK(orbi->sc);
875 		} else {
876 			orbi->status.len = 1;
877 			sbp_targ_status_FIFO(orbi,
878 		    	    orbi->login->fifo_hi, orbi->login->fifo_lo,
879 			    /*dequeue*/1);
880 			ccb->ccb_h.status = CAM_REQ_ABORTED;
881 			SBP_LOCK(orbi->sc);
882 			xpt_done(ccb);
883 			SBP_UNLOCK(orbi->sc);
884 		}
885 	}
886 
887 	fw_xfer_free(xfer);
888 }
889 
890 static cam_status
891 sbp_targ_abort_ccb(struct sbp_targ_softc *sc, union ccb *ccb)
892 {
893 	union ccb *accb;
894 	struct sbp_targ_lstate *lstate;
895 	struct ccb_hdr_slist *list;
896 	struct ccb_hdr *curelm;
897 	int found;
898 	cam_status status;
899 
900 	status = sbp_targ_find_devs(sc, ccb, &lstate, 0);
901 	if (status != CAM_REQ_CMP)
902 		return (status);
903 
904 	accb = ccb->cab.abort_ccb;
905 
906 	if (accb->ccb_h.func_code == XPT_ACCEPT_TARGET_IO)
907 		list = &lstate->accept_tios;
908 	else if (accb->ccb_h.func_code == XPT_IMMEDIATE_NOTIFY)
909 		list = &lstate->immed_notifies;
910 	else
911 		return (CAM_UA_ABORT);
912 
913 	curelm = SLIST_FIRST(list);
914 	found = 0;
915 	if (curelm == &accb->ccb_h) {
916 		found = 1;
917 		SLIST_REMOVE_HEAD(list, sim_links.sle);
918 	} else {
919 		while (curelm != NULL) {
920 			struct ccb_hdr *nextelm;
921 
922 			nextelm = SLIST_NEXT(curelm, sim_links.sle);
923 			if (nextelm == &accb->ccb_h) {
924 				found = 1;
925 				SLIST_NEXT(curelm, sim_links.sle) =
926 				    SLIST_NEXT(nextelm, sim_links.sle);
927 				break;
928 			}
929 			curelm = nextelm;
930 		}
931 	}
932 	if (found) {
933 		accb->ccb_h.status = CAM_REQ_ABORTED;
934 		xpt_done(accb);
935 		return (CAM_REQ_CMP);
936 	}
937 	printf("%s: not found\n", __func__);
938 	return (CAM_PATH_INVALID);
939 }
940 
941 /*
942  * directly execute a read or write to the initiator
943  * address space and set hand(sbp_targ_cam_done) to
944  * process the completion from the SIM to the target.
945  * set orbi->refcount to inidicate that a read/write
946  * is inflight to/from the initiator.
947  */
948 static void
949 sbp_targ_xfer_buf(struct orb_info *orbi, u_int offset,
950     uint16_t dst_hi, uint32_t dst_lo, u_int size,
951     void (*hand)(struct fw_xfer *))
952 {
953 	struct fw_xfer *xfer;
954 	u_int len, ccb_dir, off = 0;
955 	char *ptr;
956 
957 	if (debug > 1)
958 		printf("%s: offset=%d size=%d\n", __func__, offset, size);
959 	ccb_dir = orbi->ccb->ccb_h.flags & CAM_DIR_MASK;
960 	ptr = (char *)orbi->ccb->csio.data_ptr + offset;
961 
962 	while (size > 0) {
963 		/* XXX assume dst_lo + off doesn't overflow */
964 		len = MIN(size, 2048 /* XXX */);
965 		size -= len;
966 		orbi->refcount ++;
967 		if (ccb_dir == CAM_DIR_OUT) {
968 			if (debug)
969 				printf("%s: CAM_DIR_OUT --> read block in?\n",__func__);
970 			xfer = fwmem_read_block(orbi->fwdev,
971 			   (void *)orbi, /*spd*/FWSPD_S400,
972 			    dst_hi, dst_lo + off, len,
973 			    ptr + off, hand);
974 		} else {
975 			if (debug)
976 				printf("%s: CAM_DIR_IN --> write block out?\n",__func__);
977 			xfer = fwmem_write_block(orbi->fwdev,
978 			   (void *)orbi, /*spd*/FWSPD_S400,
979 			    dst_hi, dst_lo + off, len,
980 			    ptr + off, hand);
981 		}
982 		if (xfer == NULL) {
983 			printf("%s: xfer == NULL", __func__);
984 			/* XXX what should we do?? */
985 			orbi->refcount--;
986 		}
987 		off += len;
988 	}
989 }
990 
991 static void
992 sbp_targ_pt_done(struct fw_xfer *xfer)
993 {
994 	struct orb_info *orbi;
995 	struct unrestricted_page_table_fmt *pt;
996 	uint32_t i;
997 
998 	orbi = (struct orb_info *)xfer->sc;
999 
1000 	if (orbi->state == ORBI_STATUS_ABORTED) {
1001 		if (debug)
1002 			printf("%s: orbi aborted\n", __func__);
1003 		sbp_targ_remove_orb_info(orbi->login, orbi);
1004 		if (debug) {
1005 			printf("%s: free orbi->page_table %p\n", __func__, orbi->page_table);
1006 			printf("%s: free orbi %p\n", __func__, orbi);
1007 		}
1008 		free(orbi->page_table, M_SBP_TARG);
1009 		free(orbi, M_SBP_TARG);
1010 		orbi = NULL;
1011 		fw_xfer_free(xfer);
1012 		return;
1013 	}
1014 	if (xfer->resp != 0) {
1015 		printf("%s: xfer->resp = %d\n", __func__, xfer->resp);
1016 		orbi->status.resp = SBP_TRANS_FAIL;
1017 		orbi->status.status = OBJ_PT | SBE_TIMEOUT/*XXX*/;
1018 		orbi->status.dead = 1;
1019 		orbi->status.len = 1;
1020 		sbp_targ_abort(orbi->sc, STAILQ_NEXT(orbi, link));
1021 
1022 		if (debug)
1023 			printf("%s: free orbi->page_table %p\n", __func__, orbi->page_table);
1024 
1025 		sbp_targ_status_FIFO(orbi,
1026 		    orbi->login->fifo_hi, orbi->login->fifo_lo, /*dequeue*/1);
1027 		free(orbi->page_table, M_SBP_TARG);
1028 		orbi->page_table = NULL;
1029 		fw_xfer_free(xfer);
1030 		return;
1031 	}
1032 	orbi->refcount++;
1033 /*
1034  * Set endianness here so we don't have
1035  * to deal with is later
1036  */
1037 	for (i = 0, pt = orbi->page_table; i < orbi->orb4.data_size; i++, pt++) {
1038 		pt->segment_len = ntohs(pt->segment_len);
1039 		if (debug)
1040 			printf("%s:segment_len = %u\n", __func__,pt->segment_len);
1041 		pt->segment_base_high = ntohs(pt->segment_base_high);
1042 		pt->segment_base_low = ntohl(pt->segment_base_low);
1043 	}
1044 
1045 	sbp_targ_xfer_pt(orbi);
1046 
1047 	orbi->refcount--;
1048 	if (orbi->refcount == 0)
1049 		printf("%s: refcount == 0\n", __func__);
1050 
1051 	fw_xfer_free(xfer);
1052 	return;
1053 }
1054 
1055 static void sbp_targ_xfer_pt(struct orb_info *orbi)
1056 {
1057 	union ccb *ccb;
1058 	uint32_t res, offset, len;
1059 
1060 	ccb = orbi->ccb;
1061 	if (debug)
1062 		printf("%s: dxfer_len=%d\n", __func__, ccb->csio.dxfer_len);
1063 	res = ccb->csio.dxfer_len;
1064 	/*
1065 	 * If the page table required multiple CTIO's to
1066 	 * complete, then cur_pte is non NULL
1067 	 * and we need to start from the last position
1068 	 * If this is the first pass over a page table
1069 	 * then we just start at the beginning of the page
1070 	 * table.
1071 	 *
1072 	 * Parse the unrestricted page table and figure out where we need
1073 	 * to shove the data from this read request.
1074 	 */
1075 	for (offset = 0, len = 0; (res != 0) && (orbi->cur_pte < orbi->last_pte); offset += len) {
1076 		len = MIN(orbi->cur_pte->segment_len, res);
1077 		res -= len;
1078 		if (debug)
1079 			printf("%s:page_table: %04x:%08x segment_len(%u) res(%u) len(%u)\n",
1080 				__func__, orbi->cur_pte->segment_base_high,
1081 				orbi->cur_pte->segment_base_low,
1082 				orbi->cur_pte->segment_len,
1083 				res, len);
1084 		sbp_targ_xfer_buf(orbi, offset,
1085 				orbi->cur_pte->segment_base_high,
1086 				orbi->cur_pte->segment_base_low,
1087 				len, sbp_targ_cam_done);
1088 		/*
1089 		 * If we have only written partially to
1090 		 * this page table, then we need to save
1091 		 * our position for the next CTIO.  If we
1092 		 * have completed the page table, then we
1093 		 * are safe to move on to the next entry.
1094 		 */
1095 		if (len == orbi->cur_pte->segment_len) {
1096 			orbi->cur_pte++;
1097 		} else {
1098 			uint32_t saved_base_low;
1099 
1100 			/* Handle transfers that cross a 4GB boundary. */
1101 			saved_base_low = orbi->cur_pte->segment_base_low;
1102 			orbi->cur_pte->segment_base_low += len;
1103 			if (orbi->cur_pte->segment_base_low < saved_base_low)
1104 				orbi->cur_pte->segment_base_high++;
1105 
1106 			orbi->cur_pte->segment_len -= len;
1107 		}
1108 	}
1109 	if (debug) {
1110 		printf("%s: base_low(%08x) page_table_off(%p) last_block(%u)\n",
1111 			__func__, orbi->cur_pte->segment_base_low,
1112 			orbi->cur_pte, orbi->last_block_read);
1113 	}
1114 	if (res != 0)
1115 		printf("Warning - short pt encountered.  "
1116 			"Could not transfer all data.\n");
1117 	return;
1118 }
1119 
1120 /*
1121  * Create page table in local memory
1122  * and transfer it from the initiator
1123  * in order to know where we are supposed
1124  * to put the data.
1125  */
1126 
1127 static void
1128 sbp_targ_fetch_pt(struct orb_info *orbi)
1129 {
1130 	struct fw_xfer *xfer;
1131 
1132 	/*
1133 	 * Pull in page table from initiator
1134 	 * and setup for data from our
1135 	 * backend device.
1136 	 */
1137 	if (orbi->page_table == NULL) {
1138 		orbi->page_table = malloc(orbi->orb4.data_size*
1139 					  sizeof(struct unrestricted_page_table_fmt),
1140 					  M_SBP_TARG, M_NOWAIT|M_ZERO);
1141 		if (orbi->page_table == NULL)
1142 			goto error;
1143 		orbi->cur_pte = orbi->page_table;
1144 		orbi->last_pte = orbi->page_table + orbi->orb4.data_size;
1145 		orbi->last_block_read = orbi->orb4.data_size;
1146 		if (debug && orbi->page_table != NULL)
1147 			printf("%s: malloc'd orbi->page_table(%p), orb4.data_size(%u)\n",
1148  				__func__, orbi->page_table, orbi->orb4.data_size);
1149 
1150 		xfer = fwmem_read_block(orbi->fwdev, (void *)orbi, /*spd*/FWSPD_S400,
1151 					orbi->data_hi, orbi->data_lo, orbi->orb4.data_size*
1152 					sizeof(struct unrestricted_page_table_fmt),
1153 					(void *)orbi->page_table, sbp_targ_pt_done);
1154 
1155 		if (xfer != NULL)
1156 			return;
1157 	} else {
1158 		/*
1159 		 * This is a CTIO for a page table we have
1160 		 * already malloc'd, so just directly invoke
1161 		 * the xfer function on the orbi.
1162 		 */
1163 		sbp_targ_xfer_pt(orbi);
1164 		return;
1165 	}
1166 error:
1167 	orbi->ccb->ccb_h.status = CAM_RESRC_UNAVAIL;
1168 	if (debug)
1169 		printf("%s: free orbi->page_table %p due to xfer == NULL\n", __func__, orbi->page_table);
1170 	if (orbi->page_table != NULL) {
1171 		free(orbi->page_table, M_SBP_TARG);
1172 		orbi->page_table = NULL;
1173 	}
1174 	xpt_done(orbi->ccb);
1175 	return;
1176 }
1177 
1178 static void
1179 sbp_targ_action1(struct cam_sim *sim, union ccb *ccb)
1180 {
1181 	struct sbp_targ_softc *sc;
1182 	struct sbp_targ_lstate *lstate;
1183 	cam_status status;
1184 	u_int ccb_dir;
1185 
1186 	sc =  (struct sbp_targ_softc *)cam_sim_softc(sim);
1187 
1188 	status = sbp_targ_find_devs(sc, ccb, &lstate, TRUE);
1189 
1190 	switch (ccb->ccb_h.func_code) {
1191 	case XPT_CONT_TARGET_IO:
1192 	{
1193 		struct orb_info *orbi;
1194 
1195 		if (debug)
1196 			printf("%s: XPT_CONT_TARGET_IO (0x%08x)\n",
1197 					 __func__, ccb->csio.tag_id);
1198 
1199 		if (status != CAM_REQ_CMP) {
1200 			ccb->ccb_h.status = status;
1201 			xpt_done(ccb);
1202 			break;
1203 		}
1204 		/* XXX transfer from/to initiator */
1205 		orbi = sbp_targ_get_orb_info(lstate,
1206 		    ccb->csio.tag_id, ccb->csio.init_id);
1207 		if (orbi == NULL) {
1208 			ccb->ccb_h.status = CAM_REQ_ABORTED; /* XXX */
1209 			xpt_done(ccb);
1210 			break;
1211 		}
1212 		if (orbi->state == ORBI_STATUS_ABORTED) {
1213 			if (debug)
1214 				printf("%s: ctio aborted\n", __func__);
1215 			sbp_targ_remove_orb_info_locked(orbi->login, orbi);
1216 			if (debug)
1217 				printf("%s: free orbi %p\n", __func__, orbi);
1218 			free(orbi, M_SBP_TARG);
1219 			ccb->ccb_h.status = CAM_REQ_ABORTED;
1220 			xpt_done(ccb);
1221 			break;
1222 		}
1223 		orbi->state = ORBI_STATUS_CTIO;
1224 
1225 		orbi->ccb = ccb;
1226 		ccb_dir = ccb->ccb_h.flags & CAM_DIR_MASK;
1227 
1228 		/* XXX */
1229 		if (ccb->csio.dxfer_len == 0)
1230 			ccb_dir = CAM_DIR_NONE;
1231 
1232 		/* Sanity check */
1233 		if (ccb_dir == CAM_DIR_IN && orbi->orb4.dir == 0)
1234 			printf("%s: direction mismatch\n", __func__);
1235 
1236 		/* check page table */
1237 		if (ccb_dir != CAM_DIR_NONE && orbi->orb4.page_table_present) {
1238 			if (debug)
1239 				printf("%s: page_table_present\n",
1240 				    __func__);
1241 			if (orbi->orb4.page_size != 0) {
1242 				printf("%s: unsupported pagesize %d != 0\n",
1243 			 	    __func__, orbi->orb4.page_size);
1244 				ccb->ccb_h.status = CAM_REQ_INVALID;
1245 				xpt_done(ccb);
1246 				break;
1247 			}
1248 			sbp_targ_fetch_pt(orbi);
1249 			break;
1250 		}
1251 
1252 		/* Sanity check */
1253 		if (ccb_dir != CAM_DIR_NONE) {
1254 			sbp_targ_xfer_buf(orbi, 0, orbi->data_hi,
1255 			    orbi->data_lo,
1256 			    MIN(orbi->orb4.data_size, ccb->csio.dxfer_len),
1257 			    sbp_targ_cam_done);
1258 			if ( orbi->orb4.data_size > ccb->csio.dxfer_len ) {
1259 				orbi->data_lo += ccb->csio.dxfer_len;
1260 				orbi->orb4.data_size -= ccb->csio.dxfer_len;
1261 			}
1262 		}
1263 
1264 		if (ccb_dir == CAM_DIR_NONE) {
1265 			if ((ccb->ccb_h.flags & CAM_SEND_STATUS) != 0) {
1266 				/* XXX */
1267 				SBP_UNLOCK(sc);
1268 				sbp_targ_send_status(orbi, ccb);
1269 				SBP_LOCK(sc);
1270 			}
1271 			ccb->ccb_h.status = CAM_REQ_CMP;
1272 			xpt_done(ccb);
1273 		}
1274 		break;
1275 	}
1276 	case XPT_ACCEPT_TARGET_IO:	/* Add Accept Target IO Resource */
1277 		if (status != CAM_REQ_CMP) {
1278 			ccb->ccb_h.status = status;
1279 			xpt_done(ccb);
1280 			break;
1281 		}
1282 		SLIST_INSERT_HEAD(&lstate->accept_tios, &ccb->ccb_h,
1283 		    sim_links.sle);
1284 		ccb->ccb_h.status = CAM_REQ_INPROG;
1285 		if ((lstate->flags & F_ATIO_STARVED) != 0) {
1286 			struct sbp_targ_login *login;
1287 
1288 			if (debug)
1289 				printf("%s: new atio arrived\n", __func__);
1290 			lstate->flags &= ~F_ATIO_STARVED;
1291 			STAILQ_FOREACH(login, &lstate->logins, link)
1292 				if ((login->flags & F_ATIO_STARVED) != 0) {
1293 					login->flags &= ~F_ATIO_STARVED;
1294 					sbp_targ_fetch_orb(lstate->sc,
1295 					    login->fwdev,
1296 					    login->last_hi, login->last_lo,
1297 					    login, FETCH_CMD);
1298 				}
1299 		}
1300 		break;
1301 	case XPT_NOTIFY_ACKNOWLEDGE:	/* recycle notify ack */
1302 	case XPT_IMMEDIATE_NOTIFY:	/* Add Immediate Notify Resource */
1303 		if (status != CAM_REQ_CMP) {
1304 			ccb->ccb_h.status = status;
1305 			xpt_done(ccb);
1306 			break;
1307 		}
1308 		SLIST_INSERT_HEAD(&lstate->immed_notifies, &ccb->ccb_h,
1309 		    sim_links.sle);
1310 		ccb->ccb_h.status = CAM_REQ_INPROG;
1311 		sbp_targ_send_lstate_events(sc, lstate);
1312 		break;
1313 	case XPT_EN_LUN:
1314 		sbp_targ_en_lun(sc, ccb);
1315 		xpt_done(ccb);
1316 		break;
1317 	case XPT_PATH_INQ:
1318 	{
1319 		struct ccb_pathinq *cpi = &ccb->cpi;
1320 
1321 		cpi->version_num = 1; /* XXX??? */
1322 		cpi->hba_inquiry = PI_TAG_ABLE;
1323 		cpi->target_sprt = PIT_PROCESSOR
1324 				 | PIT_DISCONNECT
1325 				 | PIT_TERM_IO;
1326 		cpi->transport = XPORT_SPI; /* FIXME add XPORT_FW type to cam */
1327 		cpi->hba_misc = PIM_NOBUSRESET | PIM_NO_6_BYTE;
1328 		cpi->hba_eng_cnt = 0;
1329 		cpi->max_target = 7; /* XXX */
1330 		cpi->max_lun = MAX_LUN - 1;
1331 		cpi->initiator_id = 7; /* XXX */
1332 		cpi->bus_id = sim->bus_id;
1333 		cpi->base_transfer_speed = 400 * 1000 / 8;
1334 		strncpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
1335 		strncpy(cpi->hba_vid, "SBP_TARG", HBA_IDLEN);
1336 		strncpy(cpi->dev_name, sim->sim_name, DEV_IDLEN);
1337 		cpi->unit_number = sim->unit_number;
1338 
1339 		cpi->ccb_h.status = CAM_REQ_CMP;
1340 		xpt_done(ccb);
1341 		break;
1342 	}
1343 	case XPT_ABORT:
1344 	{
1345 		union ccb *accb = ccb->cab.abort_ccb;
1346 
1347 		switch (accb->ccb_h.func_code) {
1348 		case XPT_ACCEPT_TARGET_IO:
1349 		case XPT_IMMEDIATE_NOTIFY:
1350 			ccb->ccb_h.status = sbp_targ_abort_ccb(sc, ccb);
1351 			break;
1352 		case XPT_CONT_TARGET_IO:
1353 			/* XXX */
1354 			ccb->ccb_h.status = CAM_UA_ABORT;
1355 			break;
1356 		default:
1357 			printf("%s: aborting unknown function %d\n",
1358 				__func__, accb->ccb_h.func_code);
1359 			ccb->ccb_h.status = CAM_REQ_INVALID;
1360 			break;
1361 		}
1362 		xpt_done(ccb);
1363 		break;
1364 	}
1365 #ifdef CAM_NEW_TRAN_CODE
1366 	case XPT_SET_TRAN_SETTINGS:
1367 		ccb->ccb_h.status = CAM_REQ_INVALID;
1368 		xpt_done(ccb);
1369 		break;
1370 	case XPT_GET_TRAN_SETTINGS:
1371 	{
1372 		struct ccb_trans_settings *cts = &ccb->cts;
1373 		struct ccb_trans_settings_scsi *scsi =
1374 			&cts->proto_specific.scsi;
1375 		struct ccb_trans_settings_spi *spi =
1376 			&cts->xport_specific.spi;
1377 
1378 		cts->protocol = PROTO_SCSI;
1379 		cts->protocol_version = SCSI_REV_2;
1380 		cts->transport = XPORT_FW;     /* should have a FireWire */
1381 		cts->transport_version = 2;
1382 		spi->valid = CTS_SPI_VALID_DISC;
1383 		spi->flags = CTS_SPI_FLAGS_DISC_ENB;
1384 		scsi->valid = CTS_SCSI_VALID_TQ;
1385 		scsi->flags = CTS_SCSI_FLAGS_TAG_ENB;
1386 #if 0
1387 		printf("%s:%d:%d XPT_GET_TRAN_SETTINGS:\n",
1388 			device_get_nameunit(sc->fd.dev),
1389 			ccb->ccb_h.target_id, ccb->ccb_h.target_lun);
1390 #endif
1391 		cts->ccb_h.status = CAM_REQ_CMP;
1392 		xpt_done(ccb);
1393 		break;
1394 	}
1395 #endif
1396 
1397 	default:
1398 		printf("%s: unknown function 0x%x\n",
1399 		    __func__, ccb->ccb_h.func_code);
1400 		ccb->ccb_h.status = CAM_PROVIDE_FAIL;
1401 		xpt_done(ccb);
1402 		break;
1403 	}
1404 	return;
1405 }
1406 
1407 static void
1408 sbp_targ_action(struct cam_sim *sim, union ccb *ccb)
1409 {
1410 	int s;
1411 
1412 	s = splfw();
1413 	sbp_targ_action1(sim, ccb);
1414 	splx(s);
1415 }
1416 
1417 static void
1418 sbp_targ_poll(struct cam_sim *sim)
1419 {
1420 	/* XXX */
1421 	return;
1422 }
1423 
1424 static void
1425 sbp_targ_cmd_handler(struct fw_xfer *xfer)
1426 {
1427 	struct fw_pkt *fp;
1428 	uint32_t *orb;
1429 	struct corb4 *orb4;
1430 	struct orb_info *orbi;
1431 	struct ccb_accept_tio *atio;
1432 	u_char *bytes;
1433 	int i;
1434 
1435 	orbi = (struct orb_info *)xfer->sc;
1436 	if (xfer->resp != 0) {
1437 		printf("%s: xfer->resp = %d\n", __func__, xfer->resp);
1438 		orbi->status.resp = SBP_TRANS_FAIL;
1439 		orbi->status.status = OBJ_ORB | SBE_TIMEOUT/*XXX*/;
1440 		orbi->status.dead = 1;
1441 		orbi->status.len = 1;
1442 		sbp_targ_abort(orbi->sc, STAILQ_NEXT(orbi, link));
1443 
1444 		sbp_targ_status_FIFO(orbi,
1445 		    orbi->login->fifo_hi, orbi->login->fifo_lo, /*dequeue*/1);
1446 		fw_xfer_free(xfer);
1447 		return;
1448 	}
1449 	fp = &xfer->recv.hdr;
1450 
1451 	atio = orbi->atio;
1452 
1453 	if (orbi->state == ORBI_STATUS_ABORTED) {
1454 		printf("%s: aborted\n", __func__);
1455 		sbp_targ_remove_orb_info(orbi->login, orbi);
1456 		free(orbi, M_SBP_TARG);
1457 		atio->ccb_h.status = CAM_REQ_ABORTED;
1458 		SBP_LOCK(orbi->sc);
1459 		xpt_done((union ccb*)atio);
1460 		SBP_UNLOCK(orbi->sc);
1461 		goto done0;
1462 	}
1463 	orbi->state = ORBI_STATUS_ATIO;
1464 
1465 	orb = orbi->orb;
1466 	/* swap payload except SCSI command */
1467 	for (i = 0; i < 5; i++)
1468 		orb[i] = ntohl(orb[i]);
1469 
1470 	orb4 = (struct corb4 *)&orb[4];
1471 	if (orb4->rq_fmt != 0) {
1472 		/* XXX */
1473 		printf("%s: rq_fmt(%d) != 0\n", __func__, orb4->rq_fmt);
1474 	}
1475 
1476 	atio->ccb_h.target_id = 0; /* XXX */
1477 	atio->ccb_h.target_lun = orbi->login->lstate->lun;
1478 	atio->sense_len = 0;
1479 	atio->tag_action = MSG_SIMPLE_TASK;
1480 	atio->tag_id = orbi->orb_lo;
1481 	atio->init_id = orbi->login->id;
1482 
1483 	atio->ccb_h.flags |= CAM_TAG_ACTION_VALID;
1484 	bytes = (u_char *)&orb[5];
1485 	if (debug)
1486 		printf("%s: %p %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x\n",
1487 		    __func__, (void *)atio,
1488 		    bytes[0], bytes[1], bytes[2], bytes[3], bytes[4],
1489 		    bytes[5], bytes[6], bytes[7], bytes[8], bytes[9]);
1490 	switch (bytes[0] >> 5) {
1491 	case 0:
1492 		atio->cdb_len = 6;
1493 		break;
1494 	case 1:
1495 	case 2:
1496 		atio->cdb_len = 10;
1497 		break;
1498 	case 4:
1499 		atio->cdb_len = 16;
1500 		break;
1501 	case 5:
1502 		atio->cdb_len = 12;
1503 		break;
1504 	case 3:
1505 	default:
1506 		/* Only copy the opcode. */
1507 		atio->cdb_len = 1;
1508 		printf("Reserved or VU command code type encountered\n");
1509 		break;
1510 	}
1511 
1512 	memcpy(atio->cdb_io.cdb_bytes, bytes, atio->cdb_len);
1513 
1514 	atio->ccb_h.status |= CAM_CDB_RECVD;
1515 
1516 	/* next ORB */
1517 	if ((orb[0] & (1<<31)) == 0) {
1518 		if (debug)
1519 			printf("%s: fetch next orb\n", __func__);
1520 		orbi->status.src = SRC_NEXT_EXISTS;
1521 		sbp_targ_fetch_orb(orbi->sc, orbi->fwdev,
1522 		    orb[0], orb[1], orbi->login, FETCH_CMD);
1523 	} else {
1524 		orbi->status.src = SRC_NO_NEXT;
1525 		orbi->login->flags &= ~F_LINK_ACTIVE;
1526 	}
1527 
1528 	orbi->data_hi = orb[2];
1529 	orbi->data_lo = orb[3];
1530 	orbi->orb4 = *orb4;
1531 
1532 	SBP_LOCK(orbi->sc);
1533 	xpt_done((union ccb*)atio);
1534 	SBP_UNLOCK(orbi->sc);
1535 done0:
1536 	fw_xfer_free(xfer);
1537 	return;
1538 }
1539 
1540 static struct sbp_targ_login *
1541 sbp_targ_get_login(struct sbp_targ_softc *sc, struct fw_device *fwdev, int lun)
1542 {
1543 	struct sbp_targ_lstate *lstate;
1544 	struct sbp_targ_login *login;
1545 	int i;
1546 
1547 	lstate = sc->lstate[lun];
1548 
1549 	STAILQ_FOREACH(login, &lstate->logins, link)
1550 		if (login->fwdev == fwdev)
1551 			return (login);
1552 
1553 	for (i = 0; i < MAX_LOGINS; i++)
1554 		if (sc->logins[i] == NULL)
1555 			goto found;
1556 
1557 	printf("%s: increase MAX_LOGIN\n", __func__);
1558 	return (NULL);
1559 
1560 found:
1561 	login = (struct sbp_targ_login *)malloc(
1562 	    sizeof(struct sbp_targ_login), M_SBP_TARG, M_NOWAIT | M_ZERO);
1563 
1564 	if (login == NULL) {
1565 		printf("%s: malloc failed\n", __func__);
1566 		return (NULL);
1567 	}
1568 
1569 	login->id = i;
1570 	login->fwdev = fwdev;
1571 	login->lstate = lstate;
1572 	login->last_hi = 0xffff;
1573 	login->last_lo = 0xffffffff;
1574 	login->hold_sec = 1;
1575 	STAILQ_INIT(&login->orbs);
1576 	CALLOUT_INIT(&login->hold_callout);
1577 	sc->logins[i] = login;
1578 	return (login);
1579 }
1580 
1581 static void
1582 sbp_targ_mgm_handler(struct fw_xfer *xfer)
1583 {
1584 	struct sbp_targ_lstate *lstate;
1585 	struct sbp_targ_login *login;
1586 	struct fw_pkt *fp;
1587 	uint32_t *orb;
1588 	struct morb4 *orb4;
1589 	struct orb_info *orbi;
1590 	int i;
1591 
1592 	orbi = (struct orb_info *)xfer->sc;
1593 	if (xfer->resp != 0) {
1594 		printf("%s: xfer->resp = %d\n", __func__, xfer->resp);
1595 		orbi->status.resp = SBP_TRANS_FAIL;
1596 		orbi->status.status = OBJ_ORB | SBE_TIMEOUT/*XXX*/;
1597 		orbi->status.dead = 1;
1598 		orbi->status.len = 1;
1599 		sbp_targ_abort(orbi->sc, STAILQ_NEXT(orbi, link));
1600 
1601 		sbp_targ_status_FIFO(orbi,
1602 		    orbi->login->fifo_hi, orbi->login->fifo_lo, /*dequeue*/0);
1603 		fw_xfer_free(xfer);
1604 		return;
1605 	}
1606 	fp = &xfer->recv.hdr;
1607 
1608 	orb = orbi->orb;
1609 	/* swap payload */
1610 	for (i = 0; i < 8; i++) {
1611 		orb[i] = ntohl(orb[i]);
1612 	}
1613 	orb4 = (struct morb4 *)&orb[4];
1614 	if (debug)
1615 		printf("%s: %s\n", __func__, orb_fun_name[orb4->fun]);
1616 
1617 	orbi->status.src = SRC_NO_NEXT;
1618 
1619 	switch (orb4->fun << 16) {
1620 	case ORB_FUN_LGI:
1621 	{
1622 		int exclusive = 0, lun;
1623 
1624 		if (orb[4] & ORB_EXV)
1625 			exclusive = 1;
1626 
1627 		lun = orb4->id;
1628 		lstate = orbi->sc->lstate[lun];
1629 
1630 		if (lun >= MAX_LUN || lstate == NULL ||
1631 		    (exclusive &&
1632 		    STAILQ_FIRST(&lstate->logins) != NULL &&
1633 		    STAILQ_FIRST(&lstate->logins)->fwdev != orbi->fwdev)
1634 		   ) {
1635 			/* error */
1636 			orbi->status.dead = 1;
1637 			orbi->status.status = STATUS_ACCESS_DENY;
1638 			orbi->status.len = 1;
1639 			break;
1640 		}
1641 
1642 		/* allocate login */
1643 		login = sbp_targ_get_login(orbi->sc, orbi->fwdev, lun);
1644 		if (login == NULL) {
1645 			printf("%s: sbp_targ_get_login failed\n",
1646 			    __func__);
1647 			orbi->status.dead = 1;
1648 			orbi->status.status = STATUS_RES_UNAVAIL;
1649 			orbi->status.len = 1;
1650 			break;
1651 		}
1652 		printf("%s: login id=%d\n", __func__, login->id);
1653 
1654 		login->fifo_hi = orb[6];
1655 		login->fifo_lo = orb[7];
1656 		login->loginres.len = htons(sizeof(uint32_t) * 4);
1657 		login->loginres.id = htons(login->id);
1658 		login->loginres.cmd_hi = htons(SBP_TARG_BIND_HI);
1659 		login->loginres.cmd_lo = htonl(SBP_TARG_BIND_LO(login->id));
1660 		login->loginres.recon_hold = htons(login->hold_sec);
1661 
1662 		STAILQ_INSERT_TAIL(&lstate->logins, login, link);
1663 		fwmem_write_block(orbi->fwdev, NULL, /*spd*/FWSPD_S400, orb[2], orb[3],
1664 		    sizeof(struct sbp_login_res), (void *)&login->loginres,
1665 		    fw_asy_callback_free);
1666 		/* XXX return status after loginres is successfully written */
1667 		break;
1668 	}
1669 	case ORB_FUN_RCN:
1670 		login = orbi->sc->logins[orb4->id];
1671 		if (login != NULL && login->fwdev == orbi->fwdev) {
1672 			login->flags &= ~F_HOLD;
1673 			callout_stop(&login->hold_callout);
1674 			printf("%s: reconnected id=%d\n",
1675 			    __func__, login->id);
1676 		} else {
1677 			orbi->status.dead = 1;
1678 			orbi->status.status = STATUS_ACCESS_DENY;
1679 			printf("%s: reconnection faild id=%d\n",
1680 			    __func__, orb4->id);
1681 		}
1682 		break;
1683 	case ORB_FUN_LGO:
1684 		login = orbi->sc->logins[orb4->id];
1685 		if (login->fwdev != orbi->fwdev) {
1686 			printf("%s: wrong initiator\n", __func__);
1687 			break;
1688 		}
1689 		sbp_targ_dealloc_login(login);
1690 		break;
1691 	default:
1692 		printf("%s: %s not implemented yet\n",
1693 		    __func__, orb_fun_name[orb4->fun]);
1694 		break;
1695 	}
1696 	orbi->status.len = 1;
1697 	sbp_targ_status_FIFO(orbi, orb[6], orb[7], /*dequeue*/0);
1698 	fw_xfer_free(xfer);
1699 	return;
1700 }
1701 
1702 static void
1703 sbp_targ_pointer_handler(struct fw_xfer *xfer)
1704 {
1705 	struct orb_info *orbi;
1706 	uint32_t orb0, orb1;
1707 
1708 	orbi = (struct orb_info *)xfer->sc;
1709 	if (xfer->resp != 0) {
1710 		printf("%s: xfer->resp = %d\n", __func__, xfer->resp);
1711 		goto done;
1712 	}
1713 
1714 	orb0 = ntohl(orbi->orb[0]);
1715 	orb1 = ntohl(orbi->orb[1]);
1716 	if ((orb0 & (1U << 31)) != 0) {
1717 		printf("%s: invalid pointer\n", __func__);
1718 		goto done;
1719 	}
1720 	sbp_targ_fetch_orb(orbi->login->lstate->sc, orbi->fwdev,
1721 	    (uint16_t)orb0, orb1, orbi->login, FETCH_CMD);
1722 done:
1723 	free(orbi, M_SBP_TARG);
1724 	fw_xfer_free(xfer);
1725 	return;
1726 }
1727 
1728 static void
1729 sbp_targ_fetch_orb(struct sbp_targ_softc *sc, struct fw_device *fwdev,
1730     uint16_t orb_hi, uint32_t orb_lo, struct sbp_targ_login *login,
1731     int mode)
1732 {
1733 	struct orb_info *orbi;
1734 
1735 	if (debug)
1736 		printf("%s: fetch orb %04x:%08x\n", __func__, orb_hi, orb_lo);
1737 	orbi = malloc(sizeof(struct orb_info), M_SBP_TARG, M_NOWAIT | M_ZERO);
1738 	if (orbi == NULL) {
1739 		printf("%s: malloc failed\n", __func__);
1740 		return;
1741 	}
1742 	orbi->sc = sc;
1743 	orbi->fwdev = fwdev;
1744 	orbi->login = login;
1745 	orbi->orb_hi = orb_hi;
1746 	orbi->orb_lo = orb_lo;
1747 	orbi->status.orb_hi = htons(orb_hi);
1748 	orbi->status.orb_lo = htonl(orb_lo);
1749 	orbi->page_table = NULL;
1750 
1751 	switch (mode) {
1752 	case FETCH_MGM:
1753 		fwmem_read_block(fwdev, (void *)orbi, /*spd*/FWSPD_S400, orb_hi, orb_lo,
1754 		    sizeof(uint32_t) * 8, &orbi->orb[0],
1755 		    sbp_targ_mgm_handler);
1756 		break;
1757 	case FETCH_CMD:
1758 		orbi->state = ORBI_STATUS_FETCH;
1759 		login->last_hi = orb_hi;
1760 		login->last_lo = orb_lo;
1761 		login->flags |= F_LINK_ACTIVE;
1762 		/* dequeue */
1763 		SBP_LOCK(sc);
1764 		orbi->atio = (struct ccb_accept_tio *)
1765 		    SLIST_FIRST(&login->lstate->accept_tios);
1766 		if (orbi->atio == NULL) {
1767 			SBP_UNLOCK(sc);
1768 			printf("%s: no free atio\n", __func__);
1769 			login->lstate->flags |= F_ATIO_STARVED;
1770 			login->flags |= F_ATIO_STARVED;
1771 #if 0
1772 			/* XXX ?? */
1773 			login->fwdev = fwdev;
1774 #endif
1775 			break;
1776 		}
1777 		SLIST_REMOVE_HEAD(&login->lstate->accept_tios, sim_links.sle);
1778 		STAILQ_INSERT_TAIL(&login->orbs, orbi, link);
1779 		SBP_UNLOCK(sc);
1780 		fwmem_read_block(fwdev, (void *)orbi, /*spd*/FWSPD_S400, orb_hi, orb_lo,
1781 		    sizeof(uint32_t) * 8, &orbi->orb[0],
1782 		    sbp_targ_cmd_handler);
1783 		break;
1784 	case FETCH_POINTER:
1785 		orbi->state = ORBI_STATUS_POINTER;
1786 		login->flags |= F_LINK_ACTIVE;
1787 		fwmem_read_block(fwdev, (void *)orbi, /*spd*/FWSPD_S400, orb_hi, orb_lo,
1788 		    sizeof(uint32_t) * 2, &orbi->orb[0],
1789 		    sbp_targ_pointer_handler);
1790 		break;
1791 	default:
1792 		printf("%s: invalid mode %d\n", __func__, mode);
1793 	}
1794 }
1795 
1796 static void
1797 sbp_targ_resp_callback(struct fw_xfer *xfer)
1798 {
1799 	struct sbp_targ_softc *sc;
1800 	int s;
1801 
1802 	if (debug)
1803 		printf("%s: xfer=%p\n", __func__, xfer);
1804 	sc = (struct sbp_targ_softc *)xfer->sc;
1805 	fw_xfer_unload(xfer);
1806 	xfer->recv.pay_len = SBP_TARG_RECV_LEN;
1807 	xfer->hand = sbp_targ_recv;
1808 	s = splfw();
1809 	STAILQ_INSERT_TAIL(&sc->fwb.xferlist, xfer, link);
1810 	splx(s);
1811 }
1812 
1813 static int
1814 sbp_targ_cmd(struct fw_xfer *xfer, struct fw_device *fwdev, int login_id,
1815     int reg)
1816 {
1817 	struct sbp_targ_login *login;
1818 	struct sbp_targ_softc *sc;
1819 	int rtcode = 0;
1820 
1821 	if (login_id < 0 || login_id >= MAX_LOGINS)
1822 		return (RESP_ADDRESS_ERROR);
1823 
1824 	sc = (struct sbp_targ_softc *)xfer->sc;
1825 	login = sc->logins[login_id];
1826 	if (login == NULL)
1827 		return (RESP_ADDRESS_ERROR);
1828 
1829 	if (login->fwdev != fwdev) {
1830 		/* XXX */
1831 		return (RESP_ADDRESS_ERROR);
1832 	}
1833 
1834 	switch (reg) {
1835 	case 0x08:	/* ORB_POINTER */
1836 		if (debug)
1837 			printf("%s: ORB_POINTER(%d)\n", __func__, login_id);
1838 		if ((login->flags & F_LINK_ACTIVE) != 0) {
1839 			if (debug)
1840 				printf("link active (ORB_POINTER)\n");
1841 			break;
1842 		}
1843 		sbp_targ_fetch_orb(sc, fwdev,
1844 		    ntohl(xfer->recv.payload[0]),
1845 		    ntohl(xfer->recv.payload[1]),
1846 		    login, FETCH_CMD);
1847 		break;
1848 	case 0x04:	/* AGENT_RESET */
1849 		if (debug)
1850 			printf("%s: AGENT RESET(%d)\n", __func__, login_id);
1851 		login->last_hi = 0xffff;
1852 		login->last_lo = 0xffffffff;
1853 		sbp_targ_abort(sc, STAILQ_FIRST(&login->orbs));
1854 		break;
1855 	case 0x10:	/* DOORBELL */
1856 		if (debug)
1857 			printf("%s: DOORBELL(%d)\n", __func__, login_id);
1858 		if (login->last_hi == 0xffff &&
1859 		    login->last_lo == 0xffffffff) {
1860 			printf("%s: no previous pointer(DOORBELL)\n",
1861 			    __func__);
1862 			break;
1863 		}
1864 		if ((login->flags & F_LINK_ACTIVE) != 0) {
1865 			if (debug)
1866 				printf("link active (DOORBELL)\n");
1867 			break;
1868 		}
1869 		sbp_targ_fetch_orb(sc, fwdev,
1870 		    login->last_hi, login->last_lo,
1871 		    login, FETCH_POINTER);
1872 		break;
1873 	case 0x00:	/* AGENT_STATE */
1874 		printf("%s: AGENT_STATE (%d:ignore)\n", __func__, login_id);
1875 		break;
1876 	case 0x14:	/* UNSOLICITED_STATE_ENABLE */
1877 		printf("%s: UNSOLICITED_STATE_ENABLE (%d:ignore)\n",
1878 							 __func__, login_id);
1879 		break;
1880 	default:
1881 		printf("%s: invalid register %d(%d)\n",
1882 						 __func__, reg, login_id);
1883 		rtcode = RESP_ADDRESS_ERROR;
1884 	}
1885 
1886 	return (rtcode);
1887 }
1888 
1889 static int
1890 sbp_targ_mgm(struct fw_xfer *xfer, struct fw_device *fwdev)
1891 {
1892 	struct sbp_targ_softc *sc;
1893 	struct fw_pkt *fp;
1894 
1895 	sc = (struct sbp_targ_softc *)xfer->sc;
1896 
1897 	fp = &xfer->recv.hdr;
1898 	if (fp->mode.wreqb.tcode != FWTCODE_WREQB) {
1899 		printf("%s: tcode = %d\n", __func__, fp->mode.wreqb.tcode);
1900 		return (RESP_TYPE_ERROR);
1901         }
1902 
1903 	sbp_targ_fetch_orb(sc, fwdev,
1904 	    ntohl(xfer->recv.payload[0]),
1905 	    ntohl(xfer->recv.payload[1]),
1906 	    NULL, FETCH_MGM);
1907 
1908 	return (0);
1909 }
1910 
1911 static void
1912 sbp_targ_recv(struct fw_xfer *xfer)
1913 {
1914 	struct fw_pkt *fp, *sfp;
1915 	struct fw_device *fwdev;
1916 	uint32_t lo;
1917 	int s, rtcode;
1918 	struct sbp_targ_softc *sc;
1919 
1920 	s = splfw();
1921 	sc = (struct sbp_targ_softc *)xfer->sc;
1922 	fp = &xfer->recv.hdr;
1923 	fwdev = fw_noderesolve_nodeid(sc->fd.fc, fp->mode.wreqb.src & 0x3f);
1924 	if (fwdev == NULL) {
1925 		printf("%s: cannot resolve nodeid=%d\n",
1926 		    __func__, fp->mode.wreqb.src & 0x3f);
1927 		rtcode = RESP_TYPE_ERROR; /* XXX */
1928 		goto done;
1929 	}
1930 	lo = fp->mode.wreqb.dest_lo;
1931 
1932 	if (lo == SBP_TARG_BIND_LO(-1))
1933 		rtcode = sbp_targ_mgm(xfer, fwdev);
1934 	else if (lo >= SBP_TARG_BIND_LO(0))
1935 		rtcode = sbp_targ_cmd(xfer, fwdev, SBP_TARG_LOGIN_ID(lo),
1936 		    lo % 0x20);
1937 	else
1938 		rtcode = RESP_ADDRESS_ERROR;
1939 
1940 done:
1941 	if (rtcode != 0)
1942 		printf("%s: rtcode = %d\n", __func__, rtcode);
1943 	sfp = &xfer->send.hdr;
1944 	xfer->send.spd = FWSPD_S400;
1945 	xfer->hand = sbp_targ_resp_callback;
1946 	sfp->mode.wres.dst = fp->mode.wreqb.src;
1947 	sfp->mode.wres.tlrt = fp->mode.wreqb.tlrt;
1948 	sfp->mode.wres.tcode = FWTCODE_WRES;
1949 	sfp->mode.wres.rtcode = rtcode;
1950 	sfp->mode.wres.pri = 0;
1951 
1952 	fw_asyreq(xfer->fc, -1, xfer);
1953 	splx(s);
1954 }
1955 
1956 static int
1957 sbp_targ_attach(device_t dev)
1958 {
1959 	struct sbp_targ_softc *sc;
1960 	struct cam_devq *devq;
1961 	struct firewire_comm *fc;
1962 
1963         sc = (struct sbp_targ_softc *) device_get_softc(dev);
1964 	bzero((void *)sc, sizeof(struct sbp_targ_softc));
1965 
1966 	mtx_init(&sc->mtx, "sbp_targ", NULL, MTX_DEF);
1967 	sc->fd.fc = fc = device_get_ivars(dev);
1968 	sc->fd.dev = dev;
1969 	sc->fd.post_explore = (void *) sbp_targ_post_explore;
1970 	sc->fd.post_busreset = (void *) sbp_targ_post_busreset;
1971 
1972         devq = cam_simq_alloc(/*maxopenings*/MAX_LUN*MAX_INITIATORS);
1973 	if (devq == NULL)
1974 		return (ENXIO);
1975 
1976 	sc->sim = cam_sim_alloc(sbp_targ_action, sbp_targ_poll,
1977 	    "sbp_targ", sc, device_get_unit(dev), &sc->mtx,
1978 	    /*untagged*/ 1, /*tagged*/ 1, devq);
1979 	if (sc->sim == NULL) {
1980 		cam_simq_free(devq);
1981 		return (ENXIO);
1982 	}
1983 
1984 	SBP_LOCK(sc);
1985 	if (xpt_bus_register(sc->sim, dev, /*bus*/0) != CAM_SUCCESS)
1986 		goto fail;
1987 
1988 	if (xpt_create_path(&sc->path, /*periph*/ NULL, cam_sim_path(sc->sim),
1989 	    CAM_TARGET_WILDCARD, CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
1990 		xpt_bus_deregister(cam_sim_path(sc->sim));
1991 		goto fail;
1992 	}
1993 	SBP_UNLOCK(sc);
1994 
1995 	sc->fwb.start = SBP_TARG_BIND_START;
1996 	sc->fwb.end = SBP_TARG_BIND_END;
1997 
1998 	/* pre-allocate xfer */
1999 	STAILQ_INIT(&sc->fwb.xferlist);
2000 	fw_xferlist_add(&sc->fwb.xferlist, M_SBP_TARG,
2001 	    /*send*/ 0, /*recv*/ SBP_TARG_RECV_LEN, MAX_LUN /* XXX */,
2002 	    fc, (void *)sc, sbp_targ_recv);
2003 	fw_bindadd(fc, &sc->fwb);
2004 	return 0;
2005 
2006 fail:
2007 	SBP_UNLOCK(sc);
2008 	cam_sim_free(sc->sim, /*free_devq*/TRUE);
2009 	return (ENXIO);
2010 }
2011 
2012 static int
2013 sbp_targ_detach(device_t dev)
2014 {
2015 	struct sbp_targ_softc *sc;
2016 	struct sbp_targ_lstate *lstate;
2017 	int i;
2018 
2019 	sc = (struct sbp_targ_softc *)device_get_softc(dev);
2020 	sc->fd.post_busreset = NULL;
2021 
2022 	SBP_LOCK(sc);
2023 	xpt_free_path(sc->path);
2024 	xpt_bus_deregister(cam_sim_path(sc->sim));
2025 	SBP_UNLOCK(sc);
2026 	cam_sim_free(sc->sim, /*free_devq*/TRUE);
2027 
2028 	for (i = 0; i < MAX_LUN; i++) {
2029 		lstate = sc->lstate[i];
2030 		if (lstate != NULL) {
2031 			xpt_free_path(lstate->path);
2032 			free(lstate, M_SBP_TARG);
2033 		}
2034 	}
2035 	if (sc->black_hole != NULL) {
2036 		xpt_free_path(sc->black_hole->path);
2037 		free(sc->black_hole, M_SBP_TARG);
2038 	}
2039 
2040 	fw_bindremove(sc->fd.fc, &sc->fwb);
2041 	fw_xferlist_remove(&sc->fwb.xferlist);
2042 
2043 	mtx_destroy(&sc->mtx);
2044 
2045 	return 0;
2046 }
2047 
2048 static devclass_t sbp_targ_devclass;
2049 
2050 static device_method_t sbp_targ_methods[] = {
2051 	/* device interface */
2052 	DEVMETHOD(device_identify,	sbp_targ_identify),
2053 	DEVMETHOD(device_probe,		sbp_targ_probe),
2054 	DEVMETHOD(device_attach,	sbp_targ_attach),
2055 	DEVMETHOD(device_detach,	sbp_targ_detach),
2056 	{ 0, 0 }
2057 };
2058 
2059 static driver_t sbp_targ_driver = {
2060 	"sbp_targ",
2061 	sbp_targ_methods,
2062 	sizeof(struct sbp_targ_softc),
2063 };
2064 
2065 DRIVER_MODULE(sbp_targ, firewire, sbp_targ_driver, sbp_targ_devclass, 0, 0);
2066 MODULE_VERSION(sbp_targ, 1);
2067 MODULE_DEPEND(sbp_targ, firewire, 1, 1, 1);
2068 MODULE_DEPEND(sbp_targ, cam, 1, 1, 1);
2069