sbp.c revision 315812
1/*-
2 * Copyright (c) 2003 Hidetoshi Shimokawa
3 * Copyright (c) 1998-2002 Katsushi Kobayashi and Hidetoshi Shimokawa
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 *    notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 *    notice, this list of conditions and the following disclaimer in the
13 *    documentation and/or other materials provided with the distribution.
14 * 3. All advertising materials mentioning features or use of this software
15 *    must display the acknowledgement as bellow:
16 *
17 *    This product includes software developed by K. Kobayashi and H. Shimokawa
18 *
19 * 4. The name of the author may not be used to endorse or promote products
20 *    derived from this software without specific prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
23 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
24 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
25 * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
26 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
27 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
28 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
30 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
31 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
32 * POSSIBILITY OF SUCH DAMAGE.
33 *
34 * $FreeBSD: stable/11/sys/dev/firewire/sbp.c 315812 2017-03-23 06:40:20Z mav $
35 *
36 */
37
38#include <sys/param.h>
39#include <sys/systm.h>
40#include <sys/module.h>
41#include <sys/bus.h>
42#include <sys/kernel.h>
43#include <sys/sysctl.h>
44#include <machine/bus.h>
45#include <sys/malloc.h>
46#include <sys/lock.h>
47#include <sys/mutex.h>
48
49#include <cam/cam.h>
50#include <cam/cam_ccb.h>
51#include <cam/cam_sim.h>
52#include <cam/cam_xpt_sim.h>
53#include <cam/cam_debug.h>
54#include <cam/cam_periph.h>
55#include <cam/scsi/scsi_all.h>
56
57#include <dev/firewire/firewire.h>
58#include <dev/firewire/firewirereg.h>
59#include <dev/firewire/fwdma.h>
60#include <dev/firewire/iec13213.h>
61#include <dev/firewire/sbp.h>
62
63#define ccb_sdev_ptr	spriv_ptr0
64#define ccb_sbp_ptr	spriv_ptr1
65
66#define SBP_NUM_TARGETS 8 /* MAX 64 */
67/*
68 * Scan_bus doesn't work for more than 8 LUNs
69 * because of CAM_SCSI2_MAXLUN in cam_xpt.c
70 */
71#define SBP_NUM_LUNS 64
72#define SBP_MAXPHYS  MIN(MAXPHYS, (512*1024) /* 512KB */)
73#define SBP_DMA_SIZE PAGE_SIZE
74#define SBP_LOGIN_SIZE sizeof(struct sbp_login_res)
75#define SBP_QUEUE_LEN ((SBP_DMA_SIZE - SBP_LOGIN_SIZE) / sizeof(struct sbp_ocb))
76#define SBP_NUM_OCB (SBP_QUEUE_LEN * SBP_NUM_TARGETS)
77
78/*
79 * STATUS FIFO addressing
80 *   bit
81 *-----------------------
82 *  0- 1( 2): 0 (alignment)
83 *  2- 7( 6): target
84 *  8-15( 8): lun
85 * 16-31( 8): reserved
86 * 32-47(16): SBP_BIND_HI
87 * 48-64(16): bus_id, node_id
88 */
89#define SBP_BIND_HI 0x1
90#define SBP_DEV2ADDR(t, l) \
91	(((u_int64_t)SBP_BIND_HI << 32) \
92	| (((l) & 0xff) << 8) \
93	| (((t) & 0x3f) << 2))
94#define SBP_ADDR2TRG(a)	(((a) >> 2) & 0x3f)
95#define SBP_ADDR2LUN(a)	(((a) >> 8) & 0xff)
96#define SBP_INITIATOR 7
97
98static char *orb_fun_name[] = {
99	ORB_FUN_NAMES
100};
101
102static int debug = 0;
103static int auto_login = 1;
104static int max_speed = -1;
105static int sbp_cold = 1;
106static int ex_login = 1;
107static int login_delay = 1000;	/* msec */
108static int scan_delay = 500;	/* msec */
109static int use_doorbell = 0;
110static int sbp_tags = 0;
111
112SYSCTL_DECL(_hw_firewire);
113static SYSCTL_NODE(_hw_firewire, OID_AUTO, sbp, CTLFLAG_RD, 0,
114	"SBP-II Subsystem");
115SYSCTL_INT(_debug, OID_AUTO, sbp_debug, CTLFLAG_RWTUN, &debug, 0,
116	"SBP debug flag");
117SYSCTL_INT(_hw_firewire_sbp, OID_AUTO, auto_login, CTLFLAG_RWTUN, &auto_login, 0,
118	"SBP perform login automatically");
119SYSCTL_INT(_hw_firewire_sbp, OID_AUTO, max_speed, CTLFLAG_RWTUN, &max_speed, 0,
120	"SBP transfer max speed");
121SYSCTL_INT(_hw_firewire_sbp, OID_AUTO, exclusive_login, CTLFLAG_RWTUN,
122	&ex_login, 0, "SBP enable exclusive login");
123SYSCTL_INT(_hw_firewire_sbp, OID_AUTO, login_delay, CTLFLAG_RWTUN,
124	&login_delay, 0, "SBP login delay in msec");
125SYSCTL_INT(_hw_firewire_sbp, OID_AUTO, scan_delay, CTLFLAG_RWTUN,
126	&scan_delay, 0, "SBP scan delay in msec");
127SYSCTL_INT(_hw_firewire_sbp, OID_AUTO, use_doorbell, CTLFLAG_RWTUN,
128	&use_doorbell, 0, "SBP use doorbell request");
129SYSCTL_INT(_hw_firewire_sbp, OID_AUTO, tags, CTLFLAG_RWTUN, &sbp_tags, 0,
130	"SBP tagged queuing support");
131
132#define NEED_RESPONSE 0
133
134#define SBP_SEG_MAX rounddown(0xffff, PAGE_SIZE)
135#ifdef __sparc64__ /* iommu */
136#define SBP_IND_MAX howmany(SBP_MAXPHYS, SBP_SEG_MAX)
137#else
138#define SBP_IND_MAX howmany(SBP_MAXPHYS, PAGE_SIZE)
139#endif
140struct sbp_ocb {
141	STAILQ_ENTRY(sbp_ocb)	ocb;
142	union ccb	*ccb;
143	bus_addr_t	bus_addr;
144	uint32_t	orb[8];
145#define IND_PTR_OFFSET	(8*sizeof(uint32_t))
146	struct ind_ptr  ind_ptr[SBP_IND_MAX];
147	struct sbp_dev	*sdev;
148	int		flags; /* XXX should be removed */
149	bus_dmamap_t	dmamap;
150	struct callout	timer;
151};
152
153#define OCB_ACT_MGM 0
154#define OCB_ACT_CMD 1
155#define OCB_MATCH(o,s)	((o)->bus_addr == ntohl((s)->orb_lo))
156
157struct sbp_dev {
158#define SBP_DEV_RESET		0	/* accept login */
159#define SBP_DEV_LOGIN		1	/* to login */
160#if 0
161#define SBP_DEV_RECONN		2	/* to reconnect */
162#endif
163#define SBP_DEV_TOATTACH	3	/* to attach */
164#define SBP_DEV_PROBE		4	/* scan lun */
165#define SBP_DEV_ATTACHED	5	/* in operation */
166#define SBP_DEV_DEAD		6	/* unavailable unit */
167#define SBP_DEV_RETRY		7	/* unavailable unit */
168	uint8_t status:4,
169		 timeout:4;
170	uint8_t type;
171	uint16_t lun_id;
172	uint16_t freeze;
173#define	ORB_LINK_DEAD		(1 << 0)
174#define	VALID_LUN		(1 << 1)
175#define	ORB_POINTER_ACTIVE	(1 << 2)
176#define	ORB_POINTER_NEED	(1 << 3)
177#define	ORB_DOORBELL_ACTIVE	(1 << 4)
178#define	ORB_DOORBELL_NEED	(1 << 5)
179#define	ORB_SHORTAGE		(1 << 6)
180	uint16_t flags;
181	struct cam_path *path;
182	struct sbp_target *target;
183	struct fwdma_alloc dma;
184	struct sbp_login_res *login;
185	struct callout login_callout;
186	struct sbp_ocb *ocb;
187	STAILQ_HEAD(, sbp_ocb) ocbs;
188	STAILQ_HEAD(, sbp_ocb) free_ocbs;
189	struct sbp_ocb *last_ocb;
190	char vendor[32];
191	char product[32];
192	char revision[10];
193	char bustgtlun[32];
194};
195
196struct sbp_target {
197	int target_id;
198	int num_lun;
199	struct sbp_dev	**luns;
200	struct sbp_softc *sbp;
201	struct fw_device *fwdev;
202	uint32_t mgm_hi, mgm_lo;
203	struct sbp_ocb *mgm_ocb_cur;
204	STAILQ_HEAD(, sbp_ocb) mgm_ocb_queue;
205	struct callout mgm_ocb_timeout;
206	struct callout scan_callout;
207	STAILQ_HEAD(, fw_xfer) xferlist;
208	int n_xfer;
209};
210
211struct sbp_softc {
212	struct firewire_dev_comm fd;
213	struct cam_sim  *sim;
214	struct cam_path  *path;
215	struct sbp_target targets[SBP_NUM_TARGETS];
216	struct fw_bind fwb;
217	bus_dma_tag_t	dmat;
218	struct timeval last_busreset;
219#define SIMQ_FREEZED 1
220	int flags;
221	struct mtx mtx;
222};
223#define	SBP_LOCK(sbp)		mtx_lock(&(sbp)->mtx)
224#define	SBP_UNLOCK(sbp)		mtx_unlock(&(sbp)->mtx)
225#define	SBP_LOCK_ASSERT(sbp)	mtx_assert(&(sbp)->mtx, MA_OWNED)
226
227static void sbp_post_explore (void *);
228static void sbp_recv (struct fw_xfer *);
229static void sbp_mgm_callback (struct fw_xfer *);
230#if 0
231static void sbp_cmd_callback (struct fw_xfer *);
232#endif
233static void sbp_orb_pointer (struct sbp_dev *, struct sbp_ocb *);
234static void sbp_doorbell(struct sbp_dev *);
235static void sbp_execute_ocb (void *, bus_dma_segment_t *, int, int);
236static void sbp_free_ocb (struct sbp_dev *, struct sbp_ocb *);
237static void sbp_abort_ocb (struct sbp_ocb *, int);
238static void sbp_abort_all_ocbs (struct sbp_dev *, int);
239static struct fw_xfer * sbp_write_cmd (struct sbp_dev *, int, int);
240static struct sbp_ocb * sbp_get_ocb (struct sbp_dev *);
241static struct sbp_ocb * sbp_enqueue_ocb (struct sbp_dev *, struct sbp_ocb *);
242static struct sbp_ocb * sbp_dequeue_ocb (struct sbp_dev *, struct sbp_status *);
243static void sbp_cam_detach_sdev(struct sbp_dev *);
244static void sbp_free_sdev(struct sbp_dev *);
245static void sbp_cam_detach_target (struct sbp_target *);
246static void sbp_free_target (struct sbp_target *);
247static void sbp_mgm_timeout (void *arg);
248static void sbp_timeout (void *arg);
249static void sbp_mgm_orb (struct sbp_dev *, int, struct sbp_ocb *);
250
251static MALLOC_DEFINE(M_SBP, "sbp", "SBP-II/FireWire");
252
253/* cam related functions */
254static void	sbp_action(struct cam_sim *sim, union ccb *ccb);
255static void	sbp_poll(struct cam_sim *sim);
256static void	sbp_cam_scan_lun(struct cam_periph *, union ccb *);
257static void	sbp_cam_scan_target(void *arg);
258
259static char *orb_status0[] = {
260	/* 0 */ "No additional information to report",
261	/* 1 */ "Request type not supported",
262	/* 2 */ "Speed not supported",
263	/* 3 */ "Page size not supported",
264	/* 4 */ "Access denied",
265	/* 5 */ "Logical unit not supported",
266	/* 6 */ "Maximum payload too small",
267	/* 7 */ "Reserved for future standardization",
268	/* 8 */ "Resources unavailable",
269	/* 9 */ "Function rejected",
270	/* A */ "Login ID not recognized",
271	/* B */ "Dummy ORB completed",
272	/* C */ "Request aborted",
273	/* FF */ "Unspecified error"
274#define MAX_ORB_STATUS0 0xd
275};
276
277static char *orb_status1_object[] = {
278	/* 0 */ "Operation request block (ORB)",
279	/* 1 */ "Data buffer",
280	/* 2 */ "Page table",
281	/* 3 */ "Unable to specify"
282};
283
284static char *orb_status1_serial_bus_error[] = {
285	/* 0 */ "Missing acknowledge",
286	/* 1 */ "Reserved; not to be used",
287	/* 2 */ "Time-out error",
288	/* 3 */ "Reserved; not to be used",
289	/* 4 */ "Busy retry limit exceeded(X)",
290	/* 5 */ "Busy retry limit exceeded(A)",
291	/* 6 */ "Busy retry limit exceeded(B)",
292	/* 7 */ "Reserved for future standardization",
293	/* 8 */ "Reserved for future standardization",
294	/* 9 */ "Reserved for future standardization",
295	/* A */ "Reserved for future standardization",
296	/* B */ "Tardy retry limit exceeded",
297	/* C */ "Conflict error",
298	/* D */ "Data error",
299	/* E */ "Type error",
300	/* F */ "Address error"
301};
302
303static void
304sbp_identify(driver_t *driver, device_t parent)
305{
306SBP_DEBUG(0)
307	printf("sbp_identify\n");
308END_DEBUG
309
310	if (device_find_child(parent, "sbp", -1) == NULL)
311		BUS_ADD_CHILD(parent, 0, "sbp", -1);
312}
313
314/*
315 * sbp_probe()
316 */
317static int
318sbp_probe(device_t dev)
319{
320
321SBP_DEBUG(0)
322	printf("sbp_probe\n");
323END_DEBUG
324
325	device_set_desc(dev, "SBP-2/SCSI over FireWire");
326
327#if 0
328	if (bootverbose)
329		debug = bootverbose;
330#endif
331
332	return (0);
333}
334
335/*
336 * Display device characteristics on the console
337 */
338static void
339sbp_show_sdev_info(struct sbp_dev *sdev)
340{
341	struct fw_device *fwdev;
342
343	fwdev = sdev->target->fwdev;
344	device_printf(sdev->target->sbp->fd.dev,
345		"%s: %s: ordered:%d type:%d EUI:%08x%08x node:%d "
346		"speed:%d maxrec:%d\n",
347		__func__,
348		sdev->bustgtlun,
349		(sdev->type & 0x40) >> 6,
350		(sdev->type & 0x1f),
351		fwdev->eui.hi,
352		fwdev->eui.lo,
353		fwdev->dst,
354		fwdev->speed,
355		fwdev->maxrec);
356
357	device_printf(sdev->target->sbp->fd.dev,
358			"%s: %s '%s' '%s' '%s'\n",
359			__func__,
360			sdev->bustgtlun,
361			sdev->vendor,
362			sdev->product,
363			sdev->revision);
364}
365
366static struct {
367	int bus;
368	int target;
369	struct fw_eui64 eui;
370} wired[] = {
371	/* Bus	Target	EUI64 */
372#if 0
373	{0,	2,	{0x00018ea0, 0x01fd0154}},	/* Logitec HDD */
374	{0,	0,	{0x00018ea6, 0x00100682}},	/* Logitec DVD */
375	{0,	1,	{0x00d03200, 0xa412006a}},	/* Yano HDD */
376#endif
377	{-1,	-1,	{0,0}}
378};
379
380static int
381sbp_new_target(struct sbp_softc *sbp, struct fw_device *fwdev)
382{
383	int bus, i, target=-1;
384	char w[SBP_NUM_TARGETS];
385
386	bzero(w, sizeof(w));
387	bus = device_get_unit(sbp->fd.dev);
388
389	/* XXX wired-down configuration should be gotten from
390					tunable or device hint */
391	for (i = 0; wired[i].bus >= 0; i++) {
392		if (wired[i].bus == bus) {
393			w[wired[i].target] = 1;
394			if (wired[i].eui.hi == fwdev->eui.hi &&
395					wired[i].eui.lo == fwdev->eui.lo)
396				target = wired[i].target;
397		}
398	}
399	if (target >= 0) {
400		if (target < SBP_NUM_TARGETS &&
401				sbp->targets[target].fwdev == NULL)
402			return (target);
403		device_printf(sbp->fd.dev,
404			"target %d is not free for %08x:%08x\n",
405			target, fwdev->eui.hi, fwdev->eui.lo);
406		target = -1;
407	}
408	/* non-wired target */
409	for (i = 0; i < SBP_NUM_TARGETS; i++)
410		if (sbp->targets[i].fwdev == NULL && w[i] == 0) {
411			target = i;
412			break;
413		}
414
415	return target;
416}
417
418static void
419sbp_alloc_lun(struct sbp_target *target)
420{
421	struct crom_context cc;
422	struct csrreg *reg;
423	struct sbp_dev *sdev, **newluns;
424	struct sbp_softc *sbp;
425	int maxlun, lun, i;
426
427	sbp = target->sbp;
428	SBP_LOCK_ASSERT(sbp);
429	crom_init_context(&cc, target->fwdev->csrrom);
430	/* XXX shoud parse appropriate unit directories only */
431	maxlun = -1;
432	while (cc.depth >= 0) {
433		reg = crom_search_key(&cc, CROM_LUN);
434		if (reg == NULL)
435			break;
436		lun = reg->val & 0xffff;
437SBP_DEBUG(0)
438		printf("target %d lun %d found\n", target->target_id, lun);
439END_DEBUG
440		if (maxlun < lun)
441			maxlun = lun;
442		crom_next(&cc);
443	}
444	if (maxlun < 0)
445		device_printf(target->sbp->fd.dev, "%d no LUN found\n",
446		    target->target_id);
447
448	maxlun++;
449	if (maxlun >= SBP_NUM_LUNS)
450		maxlun = SBP_NUM_LUNS;
451
452	/* Invalidiate stale devices */
453	for (lun = 0; lun < target->num_lun; lun++) {
454		sdev = target->luns[lun];
455		if (sdev == NULL)
456			continue;
457		sdev->flags &= ~VALID_LUN;
458		if (lun >= maxlun) {
459			/* lost device */
460			sbp_cam_detach_sdev(sdev);
461			sbp_free_sdev(sdev);
462			target->luns[lun] = NULL;
463		}
464	}
465
466	/* Reallocate */
467	if (maxlun != target->num_lun) {
468		newluns = (struct sbp_dev **) realloc(target->luns,
469		    sizeof(struct sbp_dev *) * maxlun,
470		    M_SBP, M_NOWAIT | M_ZERO);
471
472		if (newluns == NULL) {
473			printf("%s: realloc failed\n", __func__);
474			newluns = target->luns;
475			maxlun = target->num_lun;
476		}
477
478		/*
479		 * We must zero the extended region for the case
480		 * realloc() doesn't allocate new buffer.
481		 */
482		if (maxlun > target->num_lun)
483			bzero(&newluns[target->num_lun],
484			    sizeof(struct sbp_dev *) *
485			    (maxlun - target->num_lun));
486
487		target->luns = newluns;
488		target->num_lun = maxlun;
489	}
490
491	crom_init_context(&cc, target->fwdev->csrrom);
492	while (cc.depth >= 0) {
493		int new = 0;
494
495		reg = crom_search_key(&cc, CROM_LUN);
496		if (reg == NULL)
497			break;
498		lun = reg->val & 0xffff;
499		if (lun >= SBP_NUM_LUNS) {
500			printf("too large lun %d\n", lun);
501			goto next;
502		}
503
504		sdev = target->luns[lun];
505		if (sdev == NULL) {
506			sdev = malloc(sizeof(struct sbp_dev),
507			    M_SBP, M_NOWAIT | M_ZERO);
508			if (sdev == NULL) {
509				printf("%s: malloc failed\n", __func__);
510				goto next;
511			}
512			target->luns[lun] = sdev;
513			sdev->lun_id = lun;
514			sdev->target = target;
515			STAILQ_INIT(&sdev->ocbs);
516			callout_init_mtx(&sdev->login_callout, &sbp->mtx, 0);
517			sdev->status = SBP_DEV_RESET;
518			new = 1;
519			snprintf(sdev->bustgtlun, 32, "%s:%d:%d",
520					device_get_nameunit(sdev->target->sbp->fd.dev),
521					sdev->target->target_id,
522					sdev->lun_id);
523		}
524		sdev->flags |= VALID_LUN;
525		sdev->type = (reg->val & 0xff0000) >> 16;
526
527		if (new == 0)
528			goto next;
529
530		fwdma_malloc(sbp->fd.fc,
531			/* alignment */ sizeof(uint32_t),
532			SBP_DMA_SIZE, &sdev->dma, BUS_DMA_NOWAIT |
533			BUS_DMA_COHERENT);
534		if (sdev->dma.v_addr == NULL) {
535			printf("%s: dma space allocation failed\n",
536							__func__);
537			free(sdev, M_SBP);
538			target->luns[lun] = NULL;
539			goto next;
540		}
541		sdev->login = (struct sbp_login_res *) sdev->dma.v_addr;
542		sdev->ocb = (struct sbp_ocb *)
543				((char *)sdev->dma.v_addr + SBP_LOGIN_SIZE);
544		bzero((char *)sdev->ocb,
545			sizeof(struct sbp_ocb) * SBP_QUEUE_LEN);
546
547		STAILQ_INIT(&sdev->free_ocbs);
548		for (i = 0; i < SBP_QUEUE_LEN; i++) {
549			struct sbp_ocb *ocb;
550			ocb = &sdev->ocb[i];
551			ocb->bus_addr = sdev->dma.bus_addr
552				+ SBP_LOGIN_SIZE
553				+ sizeof(struct sbp_ocb) * i
554				+ offsetof(struct sbp_ocb, orb[0]);
555			if (bus_dmamap_create(sbp->dmat, 0, &ocb->dmamap)) {
556				printf("sbp_attach: cannot create dmamap\n");
557				/* XXX */
558				goto next;
559			}
560			callout_init_mtx(&ocb->timer, &sbp->mtx, 0);
561			sbp_free_ocb(sdev, ocb);
562		}
563next:
564		crom_next(&cc);
565	}
566
567	for (lun = 0; lun < target->num_lun; lun++) {
568		sdev = target->luns[lun];
569		if (sdev != NULL && (sdev->flags & VALID_LUN) == 0) {
570			sbp_cam_detach_sdev(sdev);
571			sbp_free_sdev(sdev);
572			target->luns[lun] = NULL;
573		}
574	}
575}
576
577static struct sbp_target *
578sbp_alloc_target(struct sbp_softc *sbp, struct fw_device *fwdev)
579{
580	int i;
581	struct sbp_target *target;
582	struct crom_context cc;
583	struct csrreg *reg;
584
585SBP_DEBUG(1)
586	printf("sbp_alloc_target\n");
587END_DEBUG
588	i = sbp_new_target(sbp, fwdev);
589	if (i < 0) {
590		device_printf(sbp->fd.dev, "increase SBP_NUM_TARGETS!\n");
591		return NULL;
592	}
593	/* new target */
594	target = &sbp->targets[i];
595	target->fwdev = fwdev;
596	target->target_id = i;
597	/* XXX we may want to reload mgm port after each bus reset */
598	/* XXX there might be multiple management agents */
599	crom_init_context(&cc, target->fwdev->csrrom);
600	reg = crom_search_key(&cc, CROM_MGM);
601	if (reg == NULL || reg->val == 0) {
602		printf("NULL management address\n");
603		target->fwdev = NULL;
604		return NULL;
605	}
606	target->mgm_hi = 0xffff;
607	target->mgm_lo = 0xf0000000 | (reg->val << 2);
608	target->mgm_ocb_cur = NULL;
609SBP_DEBUG(1)
610	printf("target:%d mgm_port: %x\n", i, target->mgm_lo);
611END_DEBUG
612	STAILQ_INIT(&target->xferlist);
613	target->n_xfer = 0;
614	STAILQ_INIT(&target->mgm_ocb_queue);
615	callout_init_mtx(&target->mgm_ocb_timeout, &sbp->mtx, 0);
616	callout_init_mtx(&target->scan_callout, &sbp->mtx, 0);
617
618	target->luns = NULL;
619	target->num_lun = 0;
620	return target;
621}
622
623static void
624sbp_probe_lun(struct sbp_dev *sdev)
625{
626	struct fw_device *fwdev;
627	struct crom_context c, *cc = &c;
628	struct csrreg *reg;
629
630	bzero(sdev->vendor, sizeof(sdev->vendor));
631	bzero(sdev->product, sizeof(sdev->product));
632
633	fwdev = sdev->target->fwdev;
634	crom_init_context(cc, fwdev->csrrom);
635	/* get vendor string */
636	crom_search_key(cc, CSRKEY_VENDOR);
637	crom_next(cc);
638	crom_parse_text(cc, sdev->vendor, sizeof(sdev->vendor));
639	/* skip to the unit directory for SBP-2 */
640	while ((reg = crom_search_key(cc, CSRKEY_VER)) != NULL) {
641		if (reg->val == CSRVAL_T10SBP2)
642			break;
643		crom_next(cc);
644	}
645	/* get firmware revision */
646	reg = crom_search_key(cc, CSRKEY_FIRM_VER);
647	if (reg != NULL)
648		snprintf(sdev->revision, sizeof(sdev->revision),
649						"%06x", reg->val);
650	/* get product string */
651	crom_search_key(cc, CSRKEY_MODEL);
652	crom_next(cc);
653	crom_parse_text(cc, sdev->product, sizeof(sdev->product));
654}
655
656static void
657sbp_login_callout(void *arg)
658{
659	struct sbp_dev *sdev = (struct sbp_dev *)arg;
660	SBP_LOCK_ASSERT(sdev->target->sbp);
661	sbp_mgm_orb(sdev, ORB_FUN_LGI, NULL);
662}
663
664static void
665sbp_login(struct sbp_dev *sdev)
666{
667	struct timeval delta;
668	struct timeval t;
669	int ticks = 0;
670
671	microtime(&delta);
672	timevalsub(&delta, &sdev->target->sbp->last_busreset);
673	t.tv_sec = login_delay / 1000;
674	t.tv_usec = (login_delay % 1000) * 1000;
675	timevalsub(&t, &delta);
676	if (t.tv_sec >= 0 && t.tv_usec > 0)
677		ticks = (t.tv_sec * 1000 + t.tv_usec / 1000) * hz / 1000;
678SBP_DEBUG(0)
679	printf("%s: sec = %jd usec = %ld ticks = %d\n", __func__,
680	    (intmax_t)t.tv_sec, t.tv_usec, ticks);
681END_DEBUG
682	callout_reset(&sdev->login_callout, ticks,
683			sbp_login_callout, (void *)(sdev));
684}
685
686#define SBP_FWDEV_ALIVE(fwdev) (((fwdev)->status == FWDEVATTACHED) \
687	&& crom_has_specver((fwdev)->csrrom, CSRVAL_ANSIT10, CSRVAL_T10SBP2))
688
689static void
690sbp_probe_target(void *arg)
691{
692	struct sbp_target *target = (struct sbp_target *)arg;
693	struct sbp_softc *sbp = target->sbp;
694	struct sbp_dev *sdev;
695	int i, alive;
696
697	alive = SBP_FWDEV_ALIVE(target->fwdev);
698SBP_DEBUG(1)
699	device_printf(sbp->fd.dev, "%s %d%salive\n",
700		 __func__, target->target_id,
701		(!alive) ? " not " : "");
702END_DEBUG
703
704	sbp = target->sbp;
705	SBP_LOCK_ASSERT(sbp);
706	sbp_alloc_lun(target);
707
708	/* XXX untimeout mgm_ocb and dequeue */
709	for (i=0; i < target->num_lun; i++) {
710		sdev = target->luns[i];
711		if (sdev == NULL)
712			continue;
713		if (alive && (sdev->status != SBP_DEV_DEAD)) {
714			if (sdev->path != NULL) {
715				xpt_freeze_devq(sdev->path, 1);
716				sdev->freeze++;
717			}
718			sbp_probe_lun(sdev);
719			sbp_show_sdev_info(sdev);
720
721			sbp_abort_all_ocbs(sdev, CAM_SCSI_BUS_RESET);
722			switch (sdev->status) {
723			case SBP_DEV_RESET:
724				/* new or revived target */
725				if (auto_login)
726					sbp_login(sdev);
727				break;
728			case SBP_DEV_TOATTACH:
729			case SBP_DEV_PROBE:
730			case SBP_DEV_ATTACHED:
731			case SBP_DEV_RETRY:
732			default:
733				sbp_mgm_orb(sdev, ORB_FUN_RCN, NULL);
734				break;
735			}
736		} else {
737			switch (sdev->status) {
738			case SBP_DEV_ATTACHED:
739SBP_DEBUG(0)
740				/* the device has gone */
741				device_printf(sbp->fd.dev, "%s: lost target\n",
742					__func__);
743END_DEBUG
744				if (sdev->path) {
745					xpt_freeze_devq(sdev->path, 1);
746					sdev->freeze++;
747				}
748				sdev->status = SBP_DEV_RETRY;
749				sbp_cam_detach_sdev(sdev);
750				sbp_free_sdev(sdev);
751				target->luns[i] = NULL;
752				break;
753			case SBP_DEV_PROBE:
754			case SBP_DEV_TOATTACH:
755				sdev->status = SBP_DEV_RESET;
756				break;
757			case SBP_DEV_RETRY:
758			case SBP_DEV_RESET:
759			case SBP_DEV_DEAD:
760				break;
761			}
762		}
763	}
764}
765
766static void
767sbp_post_busreset(void *arg)
768{
769	struct sbp_softc *sbp;
770
771	sbp = (struct sbp_softc *)arg;
772SBP_DEBUG(0)
773	printf("sbp_post_busreset\n");
774END_DEBUG
775	SBP_LOCK(sbp);
776	if ((sbp->sim->flags & SIMQ_FREEZED) == 0) {
777		xpt_freeze_simq(sbp->sim, /*count*/1);
778		sbp->sim->flags |= SIMQ_FREEZED;
779	}
780	microtime(&sbp->last_busreset);
781	SBP_UNLOCK(sbp);
782}
783
784static void
785sbp_post_explore(void *arg)
786{
787	struct sbp_softc *sbp = (struct sbp_softc *)arg;
788	struct sbp_target *target;
789	struct fw_device *fwdev;
790	int i, alive;
791
792SBP_DEBUG(0)
793	printf("sbp_post_explore (sbp_cold=%d)\n", sbp_cold);
794END_DEBUG
795	/* We need physical access */
796	if (!firewire_phydma_enable)
797		return;
798
799	if (sbp_cold > 0)
800		sbp_cold--;
801
802	SBP_LOCK(sbp);
803#if 0
804	/*
805	 * XXX don't let CAM the bus rest.
806	 * CAM tries to do something with freezed (DEV_RETRY) devices.
807	 */
808	xpt_async(AC_BUS_RESET, sbp->path, /*arg*/ NULL);
809#endif
810
811	/* Garbage Collection */
812	for (i = 0; i < SBP_NUM_TARGETS; i++) {
813		target = &sbp->targets[i];
814		STAILQ_FOREACH(fwdev, &sbp->fd.fc->devices, link)
815			if (target->fwdev == NULL || target->fwdev == fwdev)
816				break;
817		if (fwdev == NULL) {
818			/* device has removed in lower driver */
819			sbp_cam_detach_target(target);
820			sbp_free_target(target);
821		}
822	}
823	/* traverse device list */
824	STAILQ_FOREACH(fwdev, &sbp->fd.fc->devices, link) {
825SBP_DEBUG(0)
826		device_printf(sbp->fd.dev,"%s:: EUI:%08x%08x %s attached, state=%d\n",
827				__func__, fwdev->eui.hi, fwdev->eui.lo,
828				(fwdev->status != FWDEVATTACHED) ? "not" : "",
829				fwdev->status);
830END_DEBUG
831		alive = SBP_FWDEV_ALIVE(fwdev);
832		for (i = 0; i < SBP_NUM_TARGETS; i++) {
833			target = &sbp->targets[i];
834			if (target->fwdev == fwdev) {
835				/* known target */
836				break;
837			}
838		}
839		if (i == SBP_NUM_TARGETS) {
840			if (alive) {
841				/* new target */
842				target = sbp_alloc_target(sbp, fwdev);
843				if (target == NULL)
844					continue;
845			} else {
846				continue;
847			}
848		}
849		sbp_probe_target((void *)target);
850		if (target->num_lun == 0)
851			sbp_free_target(target);
852	}
853	xpt_release_simq(sbp->sim, /*run queue*/TRUE);
854	sbp->sim->flags &= ~SIMQ_FREEZED;
855	SBP_UNLOCK(sbp);
856}
857
858#if NEED_RESPONSE
859static void
860sbp_loginres_callback(struct fw_xfer *xfer)
861{
862	struct sbp_dev *sdev;
863	sdev = (struct sbp_dev *)xfer->sc;
864SBP_DEBUG(1)
865	device_printf(sdev->target->sbp->fd.dev,"%s\n", __func__);
866END_DEBUG
867	/* recycle */
868	SBP_LOCK(sdev->target->sbp);
869	STAILQ_INSERT_TAIL(&sdev->target->sbp->fwb.xferlist, xfer, link);
870	SBP_UNLOCK(sdev->target->sbp);
871	return;
872}
873#endif
874
875static __inline void
876sbp_xfer_free(struct fw_xfer *xfer)
877{
878	struct sbp_dev *sdev;
879
880	sdev = (struct sbp_dev *)xfer->sc;
881	fw_xfer_unload(xfer);
882	SBP_LOCK_ASSERT(sdev->target->sbp);
883	STAILQ_INSERT_TAIL(&sdev->target->xferlist, xfer, link);
884}
885
886static void
887sbp_reset_start_callback(struct fw_xfer *xfer)
888{
889	struct sbp_dev *tsdev, *sdev = (struct sbp_dev *)xfer->sc;
890	struct sbp_target *target = sdev->target;
891	int i;
892
893	if (xfer->resp != 0) {
894		device_printf(sdev->target->sbp->fd.dev,
895			"%s: %s failed: resp=%d\n", __func__, sdev->bustgtlun, xfer->resp);
896	}
897
898	SBP_LOCK(target->sbp);
899	for (i = 0; i < target->num_lun; i++) {
900		tsdev = target->luns[i];
901		if (tsdev != NULL && tsdev->status == SBP_DEV_LOGIN)
902			sbp_login(tsdev);
903	}
904	SBP_UNLOCK(target->sbp);
905}
906
907static void
908sbp_reset_start(struct sbp_dev *sdev)
909{
910	struct fw_xfer *xfer;
911	struct fw_pkt *fp;
912
913SBP_DEBUG(0)
914	device_printf(sdev->target->sbp->fd.dev,
915			"%s:%s\n", __func__,sdev->bustgtlun);
916END_DEBUG
917
918	xfer = sbp_write_cmd(sdev, FWTCODE_WREQQ, 0);
919	xfer->hand = sbp_reset_start_callback;
920	fp = &xfer->send.hdr;
921	fp->mode.wreqq.dest_hi = 0xffff;
922	fp->mode.wreqq.dest_lo = 0xf0000000 | RESET_START;
923	fp->mode.wreqq.data = htonl(0xf);
924	fw_asyreq(xfer->fc, -1, xfer);
925}
926
927static void
928sbp_mgm_callback(struct fw_xfer *xfer)
929{
930	struct sbp_dev *sdev;
931	int resp;
932
933	sdev = (struct sbp_dev *)xfer->sc;
934
935SBP_DEBUG(1)
936	device_printf(sdev->target->sbp->fd.dev,
937		"%s:%s\n", __func__, sdev->bustgtlun);
938END_DEBUG
939	resp = xfer->resp;
940	SBP_LOCK(sdev->target->sbp);
941	sbp_xfer_free(xfer);
942	SBP_UNLOCK(sdev->target->sbp);
943}
944
945static struct sbp_dev *
946sbp_next_dev(struct sbp_target *target, int lun)
947{
948	struct sbp_dev **sdevp;
949	int i;
950
951	for (i = lun, sdevp = &target->luns[lun]; i < target->num_lun;
952	    i++, sdevp++)
953		if (*sdevp != NULL && (*sdevp)->status == SBP_DEV_PROBE)
954			return (*sdevp);
955	return (NULL);
956}
957
958#define SCAN_PRI 1
959static void
960sbp_cam_scan_lun(struct cam_periph *periph, union ccb *ccb)
961{
962	struct sbp_target *target;
963	struct sbp_dev *sdev;
964
965	sdev = (struct sbp_dev *) ccb->ccb_h.ccb_sdev_ptr;
966	target = sdev->target;
967	SBP_LOCK_ASSERT(target->sbp);
968SBP_DEBUG(0)
969	device_printf(sdev->target->sbp->fd.dev,
970		"%s:%s\n", __func__, sdev->bustgtlun);
971END_DEBUG
972	if ((ccb->ccb_h.status & CAM_STATUS_MASK) == CAM_REQ_CMP) {
973		sdev->status = SBP_DEV_ATTACHED;
974	} else {
975		device_printf(sdev->target->sbp->fd.dev,
976			"%s:%s failed\n", __func__, sdev->bustgtlun);
977	}
978	sdev = sbp_next_dev(target, sdev->lun_id + 1);
979	if (sdev == NULL) {
980		free(ccb, M_SBP);
981		return;
982	}
983	/* reuse ccb */
984	xpt_setup_ccb(&ccb->ccb_h, sdev->path, SCAN_PRI);
985	ccb->ccb_h.ccb_sdev_ptr = sdev;
986	xpt_action(ccb);
987	xpt_release_devq(sdev->path, sdev->freeze, TRUE);
988	sdev->freeze = 1;
989}
990
991static void
992sbp_cam_scan_target(void *arg)
993{
994	struct sbp_target *target = (struct sbp_target *)arg;
995	struct sbp_dev *sdev;
996	union ccb *ccb;
997
998	SBP_LOCK_ASSERT(target->sbp);
999	sdev = sbp_next_dev(target, 0);
1000	if (sdev == NULL) {
1001		printf("sbp_cam_scan_target: nothing to do for target%d\n",
1002							target->target_id);
1003		return;
1004	}
1005SBP_DEBUG(0)
1006	device_printf(sdev->target->sbp->fd.dev,
1007		"%s:%s\n", __func__, sdev->bustgtlun);
1008END_DEBUG
1009	ccb = malloc(sizeof(union ccb), M_SBP, M_NOWAIT | M_ZERO);
1010	if (ccb == NULL) {
1011		printf("sbp_cam_scan_target: malloc failed\n");
1012		return;
1013	}
1014	xpt_setup_ccb(&ccb->ccb_h, sdev->path, SCAN_PRI);
1015	ccb->ccb_h.func_code = XPT_SCAN_LUN;
1016	ccb->ccb_h.cbfcnp = sbp_cam_scan_lun;
1017	ccb->ccb_h.flags |= CAM_DEV_QFREEZE;
1018	ccb->crcn.flags = CAM_FLAG_NONE;
1019	ccb->ccb_h.ccb_sdev_ptr = sdev;
1020
1021	/* The scan is in progress now. */
1022	xpt_action(ccb);
1023	xpt_release_devq(sdev->path, sdev->freeze, TRUE);
1024	sdev->freeze = 1;
1025}
1026
1027static __inline void
1028sbp_scan_dev(struct sbp_dev *sdev)
1029{
1030	sdev->status = SBP_DEV_PROBE;
1031	callout_reset_sbt(&sdev->target->scan_callout, SBT_1MS * scan_delay, 0,
1032	    sbp_cam_scan_target, (void *)sdev->target, 0);
1033}
1034
1035static void
1036sbp_do_attach(struct fw_xfer *xfer)
1037{
1038	struct sbp_dev *sdev;
1039	struct sbp_target *target;
1040	struct sbp_softc *sbp;
1041
1042	sdev = (struct sbp_dev *)xfer->sc;
1043	target = sdev->target;
1044	sbp = target->sbp;
1045	SBP_LOCK(sbp);
1046SBP_DEBUG(0)
1047	device_printf(sdev->target->sbp->fd.dev,
1048		"%s:%s\n", __func__, sdev->bustgtlun);
1049END_DEBUG
1050	sbp_xfer_free(xfer);
1051
1052	if (sdev->path == NULL)
1053		xpt_create_path(&sdev->path, NULL,
1054			cam_sim_path(target->sbp->sim),
1055			target->target_id, sdev->lun_id);
1056
1057	/*
1058	 * Let CAM scan the bus if we are in the boot process.
1059	 * XXX xpt_scan_bus cannot detect LUN larger than 0
1060	 * if LUN 0 doesn't exist.
1061	 */
1062	if (sbp_cold > 0) {
1063		sdev->status = SBP_DEV_ATTACHED;
1064		SBP_UNLOCK(sbp);
1065		return;
1066	}
1067
1068	sbp_scan_dev(sdev);
1069	SBP_UNLOCK(sbp);
1070}
1071
1072static void
1073sbp_agent_reset_callback(struct fw_xfer *xfer)
1074{
1075	struct sbp_dev *sdev;
1076
1077	sdev = (struct sbp_dev *)xfer->sc;
1078SBP_DEBUG(1)
1079	device_printf(sdev->target->sbp->fd.dev,
1080			"%s:%s\n", __func__, sdev->bustgtlun);
1081END_DEBUG
1082	if (xfer->resp != 0) {
1083		device_printf(sdev->target->sbp->fd.dev,
1084			"%s:%s resp=%d\n", __func__, sdev->bustgtlun, xfer->resp);
1085	}
1086
1087	SBP_LOCK(sdev->target->sbp);
1088	sbp_xfer_free(xfer);
1089	if (sdev->path) {
1090		xpt_release_devq(sdev->path, sdev->freeze, TRUE);
1091		sdev->freeze = 0;
1092	}
1093	SBP_UNLOCK(sdev->target->sbp);
1094}
1095
1096static void
1097sbp_agent_reset(struct sbp_dev *sdev)
1098{
1099	struct fw_xfer *xfer;
1100	struct fw_pkt *fp;
1101
1102	SBP_LOCK_ASSERT(sdev->target->sbp);
1103SBP_DEBUG(0)
1104	device_printf(sdev->target->sbp->fd.dev,
1105		"%s:%s\n", __func__, sdev->bustgtlun);
1106END_DEBUG
1107	xfer = sbp_write_cmd(sdev, FWTCODE_WREQQ, 0x04);
1108	if (xfer == NULL)
1109		return;
1110	if (sdev->status == SBP_DEV_ATTACHED || sdev->status == SBP_DEV_PROBE)
1111		xfer->hand = sbp_agent_reset_callback;
1112	else
1113		xfer->hand = sbp_do_attach;
1114	fp = &xfer->send.hdr;
1115	fp->mode.wreqq.data = htonl(0xf);
1116	fw_asyreq(xfer->fc, -1, xfer);
1117	sbp_abort_all_ocbs(sdev, CAM_BDR_SENT);
1118}
1119
1120static void
1121sbp_busy_timeout_callback(struct fw_xfer *xfer)
1122{
1123	struct sbp_dev *sdev;
1124
1125	sdev = (struct sbp_dev *)xfer->sc;
1126SBP_DEBUG(1)
1127	device_printf(sdev->target->sbp->fd.dev,
1128		"%s:%s\n", __func__, sdev->bustgtlun);
1129END_DEBUG
1130	SBP_LOCK(sdev->target->sbp);
1131	sbp_xfer_free(xfer);
1132	sbp_agent_reset(sdev);
1133	SBP_UNLOCK(sdev->target->sbp);
1134}
1135
1136static void
1137sbp_busy_timeout(struct sbp_dev *sdev)
1138{
1139	struct fw_pkt *fp;
1140	struct fw_xfer *xfer;
1141SBP_DEBUG(0)
1142	device_printf(sdev->target->sbp->fd.dev,
1143		"%s:%s\n", __func__, sdev->bustgtlun);
1144END_DEBUG
1145	xfer = sbp_write_cmd(sdev, FWTCODE_WREQQ, 0);
1146
1147	xfer->hand = sbp_busy_timeout_callback;
1148	fp = &xfer->send.hdr;
1149	fp->mode.wreqq.dest_hi = 0xffff;
1150	fp->mode.wreqq.dest_lo = 0xf0000000 | BUSY_TIMEOUT;
1151	fp->mode.wreqq.data = htonl((1 << (13 + 12)) | 0xf);
1152	fw_asyreq(xfer->fc, -1, xfer);
1153}
1154
1155static void
1156sbp_orb_pointer_callback(struct fw_xfer *xfer)
1157{
1158	struct sbp_dev *sdev;
1159	sdev = (struct sbp_dev *)xfer->sc;
1160
1161SBP_DEBUG(2)
1162	device_printf(sdev->target->sbp->fd.dev,
1163		"%s:%s\n", __func__, sdev->bustgtlun);
1164END_DEBUG
1165	if (xfer->resp != 0) {
1166		/* XXX */
1167		printf("%s: xfer->resp = %d\n", __func__, xfer->resp);
1168	}
1169	SBP_LOCK(sdev->target->sbp);
1170	sbp_xfer_free(xfer);
1171
1172	sdev->flags &= ~ORB_POINTER_ACTIVE;
1173
1174	if ((sdev->flags & ORB_POINTER_NEED) != 0) {
1175		struct sbp_ocb *ocb;
1176
1177		sdev->flags &= ~ORB_POINTER_NEED;
1178		ocb = STAILQ_FIRST(&sdev->ocbs);
1179		if (ocb != NULL)
1180			sbp_orb_pointer(sdev, ocb);
1181	}
1182	SBP_UNLOCK(sdev->target->sbp);
1183	return;
1184}
1185
1186static void
1187sbp_orb_pointer(struct sbp_dev *sdev, struct sbp_ocb *ocb)
1188{
1189	struct fw_xfer *xfer;
1190	struct fw_pkt *fp;
1191SBP_DEBUG(1)
1192	device_printf(sdev->target->sbp->fd.dev,
1193		"%s:%s 0x%08x\n",
1194		__func__, sdev->bustgtlun,
1195		(uint32_t)ocb->bus_addr);
1196END_DEBUG
1197
1198	SBP_LOCK_ASSERT(sdev->target->sbp);
1199
1200	if ((sdev->flags & ORB_POINTER_ACTIVE) != 0) {
1201SBP_DEBUG(0)
1202		printf("%s: orb pointer active\n", __func__);
1203END_DEBUG
1204		sdev->flags |= ORB_POINTER_NEED;
1205		return;
1206	}
1207
1208	sdev->flags |= ORB_POINTER_ACTIVE;
1209	xfer = sbp_write_cmd(sdev, FWTCODE_WREQB, 0x08);
1210	if (xfer == NULL)
1211		return;
1212	xfer->hand = sbp_orb_pointer_callback;
1213
1214	fp = &xfer->send.hdr;
1215	fp->mode.wreqb.len = 8;
1216	fp->mode.wreqb.extcode = 0;
1217	xfer->send.payload[0] =
1218		htonl(((sdev->target->sbp->fd.fc->nodeid | FWLOCALBUS) << 16));
1219	xfer->send.payload[1] = htonl((uint32_t)ocb->bus_addr);
1220
1221	if (fw_asyreq(xfer->fc, -1, xfer) != 0) {
1222		sbp_xfer_free(xfer);
1223		ocb->ccb->ccb_h.status = CAM_REQ_INVALID;
1224		xpt_done(ocb->ccb);
1225	}
1226}
1227
1228static void
1229sbp_doorbell_callback(struct fw_xfer *xfer)
1230{
1231	struct sbp_dev *sdev;
1232	sdev = (struct sbp_dev *)xfer->sc;
1233
1234SBP_DEBUG(1)
1235	device_printf(sdev->target->sbp->fd.dev,
1236		"%s:%s\n", __func__, sdev->bustgtlun);
1237END_DEBUG
1238	if (xfer->resp != 0) {
1239		/* XXX */
1240		device_printf(sdev->target->sbp->fd.dev,
1241			"%s: xfer->resp = %d\n", __func__, xfer->resp);
1242	}
1243	SBP_LOCK(sdev->target->sbp);
1244	sbp_xfer_free(xfer);
1245	sdev->flags &= ~ORB_DOORBELL_ACTIVE;
1246	if ((sdev->flags & ORB_DOORBELL_NEED) != 0) {
1247		sdev->flags &= ~ORB_DOORBELL_NEED;
1248		sbp_doorbell(sdev);
1249	}
1250	SBP_UNLOCK(sdev->target->sbp);
1251}
1252
1253static void
1254sbp_doorbell(struct sbp_dev *sdev)
1255{
1256	struct fw_xfer *xfer;
1257	struct fw_pkt *fp;
1258SBP_DEBUG(1)
1259	device_printf(sdev->target->sbp->fd.dev,
1260		"%s:%s\n", __func__, sdev->bustgtlun);
1261END_DEBUG
1262
1263	if ((sdev->flags & ORB_DOORBELL_ACTIVE) != 0) {
1264		sdev->flags |= ORB_DOORBELL_NEED;
1265		return;
1266	}
1267	sdev->flags |= ORB_DOORBELL_ACTIVE;
1268	xfer = sbp_write_cmd(sdev, FWTCODE_WREQQ, 0x10);
1269	if (xfer == NULL)
1270		return;
1271	xfer->hand = sbp_doorbell_callback;
1272	fp = &xfer->send.hdr;
1273	fp->mode.wreqq.data = htonl(0xf);
1274	fw_asyreq(xfer->fc, -1, xfer);
1275}
1276
1277static struct fw_xfer *
1278sbp_write_cmd(struct sbp_dev *sdev, int tcode, int offset)
1279{
1280	struct fw_xfer *xfer;
1281	struct fw_pkt *fp;
1282	struct sbp_target *target;
1283	int new = 0;
1284
1285	SBP_LOCK_ASSERT(sdev->target->sbp);
1286
1287	target = sdev->target;
1288	xfer = STAILQ_FIRST(&target->xferlist);
1289	if (xfer == NULL) {
1290		if (target->n_xfer > 5 /* XXX */) {
1291			printf("sbp: no more xfer for this target\n");
1292			return (NULL);
1293		}
1294		xfer = fw_xfer_alloc_buf(M_SBP, 8, 0);
1295		if (xfer == NULL) {
1296			printf("sbp: fw_xfer_alloc_buf failed\n");
1297			return NULL;
1298		}
1299		target->n_xfer++;
1300		if (debug)
1301			printf("sbp: alloc %d xfer\n", target->n_xfer);
1302		new = 1;
1303	} else {
1304		STAILQ_REMOVE_HEAD(&target->xferlist, link);
1305	}
1306
1307	if (new) {
1308		xfer->recv.pay_len = 0;
1309		xfer->send.spd = min(sdev->target->fwdev->speed, max_speed);
1310		xfer->fc = sdev->target->sbp->fd.fc;
1311	}
1312
1313	if (tcode == FWTCODE_WREQB)
1314		xfer->send.pay_len = 8;
1315	else
1316		xfer->send.pay_len = 0;
1317
1318	xfer->sc = (caddr_t)sdev;
1319	fp = &xfer->send.hdr;
1320	fp->mode.wreqq.dest_hi = sdev->login->cmd_hi;
1321	fp->mode.wreqq.dest_lo = sdev->login->cmd_lo + offset;
1322	fp->mode.wreqq.tlrt = 0;
1323	fp->mode.wreqq.tcode = tcode;
1324	fp->mode.wreqq.pri = 0;
1325	fp->mode.wreqq.dst = FWLOCALBUS | sdev->target->fwdev->dst;
1326
1327	return xfer;
1328}
1329
1330static void
1331sbp_mgm_orb(struct sbp_dev *sdev, int func, struct sbp_ocb *aocb)
1332{
1333	struct fw_xfer *xfer;
1334	struct fw_pkt *fp;
1335	struct sbp_ocb *ocb;
1336	struct sbp_target *target;
1337	int nid;
1338
1339	target = sdev->target;
1340	nid = target->sbp->fd.fc->nodeid | FWLOCALBUS;
1341
1342	SBP_LOCK_ASSERT(target->sbp);
1343	if (func == ORB_FUN_RUNQUEUE) {
1344		ocb = STAILQ_FIRST(&target->mgm_ocb_queue);
1345		if (target->mgm_ocb_cur != NULL || ocb == NULL) {
1346			return;
1347		}
1348		STAILQ_REMOVE_HEAD(&target->mgm_ocb_queue, ocb);
1349		goto start;
1350	}
1351	if ((ocb = sbp_get_ocb(sdev)) == NULL) {
1352		/* XXX */
1353		return;
1354	}
1355	ocb->flags = OCB_ACT_MGM;
1356	ocb->sdev = sdev;
1357
1358	bzero((void *)ocb->orb, sizeof(ocb->orb));
1359	ocb->orb[6] = htonl((nid << 16) | SBP_BIND_HI);
1360	ocb->orb[7] = htonl(SBP_DEV2ADDR(target->target_id, sdev->lun_id));
1361
1362SBP_DEBUG(0)
1363	device_printf(sdev->target->sbp->fd.dev,
1364		 "%s:%s %s\n",
1365		 __func__,sdev->bustgtlun,
1366		 orb_fun_name[(func >> 16) & 0xf]);
1367END_DEBUG
1368	switch (func) {
1369	case ORB_FUN_LGI:
1370		ocb->orb[0] = ocb->orb[1] = 0; /* password */
1371		ocb->orb[2] = htonl(nid << 16);
1372		ocb->orb[3] = htonl(sdev->dma.bus_addr);
1373		ocb->orb[4] = htonl(ORB_NOTIFY | sdev->lun_id);
1374		if (ex_login)
1375			ocb->orb[4] |= htonl(ORB_EXV);
1376		ocb->orb[5] = htonl(SBP_LOGIN_SIZE);
1377		fwdma_sync(&sdev->dma, BUS_DMASYNC_PREREAD);
1378		break;
1379	case ORB_FUN_ATA:
1380		ocb->orb[0] = htonl((0 << 16) | 0);
1381		ocb->orb[1] = htonl(aocb->bus_addr & 0xffffffff);
1382		/* fall through */
1383	case ORB_FUN_RCN:
1384	case ORB_FUN_LGO:
1385	case ORB_FUN_LUR:
1386	case ORB_FUN_RST:
1387	case ORB_FUN_ATS:
1388		ocb->orb[4] = htonl(ORB_NOTIFY | func | sdev->login->id);
1389		break;
1390	}
1391
1392	if (target->mgm_ocb_cur != NULL) {
1393		/* there is a standing ORB */
1394		STAILQ_INSERT_TAIL(&sdev->target->mgm_ocb_queue, ocb, ocb);
1395		return;
1396	}
1397start:
1398	target->mgm_ocb_cur = ocb;
1399
1400	callout_reset(&target->mgm_ocb_timeout, 5 * hz,
1401				sbp_mgm_timeout, (caddr_t)ocb);
1402	xfer = sbp_write_cmd(sdev, FWTCODE_WREQB, 0);
1403	if (xfer == NULL) {
1404		return;
1405	}
1406	xfer->hand = sbp_mgm_callback;
1407
1408	fp = &xfer->send.hdr;
1409	fp->mode.wreqb.dest_hi = sdev->target->mgm_hi;
1410	fp->mode.wreqb.dest_lo = sdev->target->mgm_lo;
1411	fp->mode.wreqb.len = 8;
1412	fp->mode.wreqb.extcode = 0;
1413	xfer->send.payload[0] = htonl(nid << 16);
1414	xfer->send.payload[1] = htonl(ocb->bus_addr & 0xffffffff);
1415
1416	fw_asyreq(xfer->fc, -1, xfer);
1417}
1418
1419static void
1420sbp_print_scsi_cmd(struct sbp_ocb *ocb)
1421{
1422	struct ccb_scsiio *csio;
1423
1424	csio = &ocb->ccb->csio;
1425	printf("%s:%d:%jx XPT_SCSI_IO: "
1426		"cmd: %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x"
1427		", flags: 0x%02x, "
1428		"%db cmd/%db data/%db sense\n",
1429		device_get_nameunit(ocb->sdev->target->sbp->fd.dev),
1430		ocb->ccb->ccb_h.target_id,
1431		(uintmax_t)ocb->ccb->ccb_h.target_lun,
1432		csio->cdb_io.cdb_bytes[0],
1433		csio->cdb_io.cdb_bytes[1],
1434		csio->cdb_io.cdb_bytes[2],
1435		csio->cdb_io.cdb_bytes[3],
1436		csio->cdb_io.cdb_bytes[4],
1437		csio->cdb_io.cdb_bytes[5],
1438		csio->cdb_io.cdb_bytes[6],
1439		csio->cdb_io.cdb_bytes[7],
1440		csio->cdb_io.cdb_bytes[8],
1441		csio->cdb_io.cdb_bytes[9],
1442		ocb->ccb->ccb_h.flags & CAM_DIR_MASK,
1443		csio->cdb_len, csio->dxfer_len,
1444		csio->sense_len);
1445}
1446
1447static void
1448sbp_scsi_status(struct sbp_status *sbp_status, struct sbp_ocb *ocb)
1449{
1450	struct sbp_cmd_status *sbp_cmd_status;
1451	struct scsi_sense_data_fixed *sense;
1452
1453	sbp_cmd_status = (struct sbp_cmd_status *)sbp_status->data;
1454	sense = (struct scsi_sense_data_fixed *)&ocb->ccb->csio.sense_data;
1455
1456SBP_DEBUG(0)
1457	sbp_print_scsi_cmd(ocb);
1458	/* XXX need decode status */
1459	printf("%s: SCSI status %x sfmt %x valid %x key %x code %x qlfr %x len %d\n",
1460		ocb->sdev->bustgtlun,
1461		sbp_cmd_status->status,
1462		sbp_cmd_status->sfmt,
1463		sbp_cmd_status->valid,
1464		sbp_cmd_status->s_key,
1465		sbp_cmd_status->s_code,
1466		sbp_cmd_status->s_qlfr,
1467		sbp_status->len);
1468END_DEBUG
1469
1470	switch (sbp_cmd_status->status) {
1471	case SCSI_STATUS_CHECK_COND:
1472	case SCSI_STATUS_BUSY:
1473	case SCSI_STATUS_CMD_TERMINATED:
1474		if (sbp_cmd_status->sfmt == SBP_SFMT_CURR) {
1475			sense->error_code = SSD_CURRENT_ERROR;
1476		} else {
1477			sense->error_code = SSD_DEFERRED_ERROR;
1478		}
1479		if (sbp_cmd_status->valid)
1480			sense->error_code |= SSD_ERRCODE_VALID;
1481		sense->flags = sbp_cmd_status->s_key;
1482		if (sbp_cmd_status->mark)
1483			sense->flags |= SSD_FILEMARK;
1484		if (sbp_cmd_status->eom)
1485			sense->flags |= SSD_EOM;
1486		if (sbp_cmd_status->ill_len)
1487			sense->flags |= SSD_ILI;
1488
1489		bcopy(&sbp_cmd_status->info, &sense->info[0], 4);
1490
1491		if (sbp_status->len <= 1)
1492			/* XXX not scsi status. shouldn't be happened */
1493			sense->extra_len = 0;
1494		else if (sbp_status->len <= 4)
1495			/* add_sense_code(_qual), info, cmd_spec_info */
1496			sense->extra_len = 6;
1497		else
1498			/* fru, sense_key_spec */
1499			sense->extra_len = 10;
1500
1501		bcopy(&sbp_cmd_status->cdb, &sense->cmd_spec_info[0], 4);
1502
1503		sense->add_sense_code = sbp_cmd_status->s_code;
1504		sense->add_sense_code_qual = sbp_cmd_status->s_qlfr;
1505		sense->fru = sbp_cmd_status->fru;
1506
1507		bcopy(&sbp_cmd_status->s_keydep[0],
1508		    &sense->sense_key_spec[0], 3);
1509
1510		ocb->ccb->csio.scsi_status = sbp_cmd_status->status;
1511		ocb->ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
1512							| CAM_AUTOSNS_VALID;
1513/*
1514{
1515		uint8_t j, *tmp;
1516		tmp = sense;
1517		for (j = 0; j < 32; j += 8) {
1518			printf("sense %02x%02x %02x%02x %02x%02x %02x%02x\n",
1519				tmp[j], tmp[j + 1], tmp[j + 2], tmp[j + 3],
1520				tmp[j + 4], tmp[j + 5], tmp[j + 6], tmp[j + 7]);
1521		}
1522
1523}
1524*/
1525		break;
1526	default:
1527		device_printf(ocb->sdev->target->sbp->fd.dev,
1528				"%s:%s unknown scsi status 0x%x\n",
1529				__func__, ocb->sdev->bustgtlun,
1530				sbp_cmd_status->status);
1531	}
1532}
1533
1534static void
1535sbp_fix_inq_data(struct sbp_ocb *ocb)
1536{
1537	union ccb *ccb;
1538	struct sbp_dev *sdev;
1539	struct scsi_inquiry_data *inq;
1540
1541	ccb = ocb->ccb;
1542	sdev = ocb->sdev;
1543
1544	if (ccb->csio.cdb_io.cdb_bytes[1] & SI_EVPD)
1545		return;
1546SBP_DEBUG(1)
1547	device_printf(sdev->target->sbp->fd.dev,
1548		"%s:%s\n", __func__, sdev->bustgtlun);
1549END_DEBUG
1550	inq = (struct scsi_inquiry_data *) ccb->csio.data_ptr;
1551	switch (SID_TYPE(inq)) {
1552	case T_DIRECT:
1553#if 0
1554		/*
1555		 * XXX Convert Direct Access device to RBC.
1556		 * I've never seen FireWire DA devices which support READ_6.
1557		 */
1558		if (SID_TYPE(inq) == T_DIRECT)
1559			inq->device |= T_RBC; /*  T_DIRECT == 0 */
1560#endif
1561		/* fall through */
1562	case T_RBC:
1563		/*
1564		 * Override vendor/product/revision information.
1565		 * Some devices sometimes return strange strings.
1566		 */
1567#if 1
1568		bcopy(sdev->vendor, inq->vendor, sizeof(inq->vendor));
1569		bcopy(sdev->product, inq->product, sizeof(inq->product));
1570		bcopy(sdev->revision + 2, inq->revision, sizeof(inq->revision));
1571#endif
1572		break;
1573	}
1574	/*
1575	 * Force to enable/disable tagged queuing.
1576	 * XXX CAM also checks SCP_QUEUE_DQUE flag in the control mode page.
1577	 */
1578	if (sbp_tags > 0)
1579		inq->flags |= SID_CmdQue;
1580	else if (sbp_tags < 0)
1581		inq->flags &= ~SID_CmdQue;
1582
1583}
1584
1585static void
1586sbp_recv1(struct fw_xfer *xfer)
1587{
1588	struct fw_pkt *rfp;
1589#if NEED_RESPONSE
1590	struct fw_pkt *sfp;
1591#endif
1592	struct sbp_softc *sbp;
1593	struct sbp_dev *sdev;
1594	struct sbp_ocb *ocb;
1595	struct sbp_login_res *login_res = NULL;
1596	struct sbp_status *sbp_status;
1597	struct sbp_target *target;
1598	int	orb_fun, status_valid0, status_valid, t, l, reset_agent = 0;
1599	uint32_t addr;
1600/*
1601	uint32_t *ld;
1602	ld = xfer->recv.buf;
1603printf("sbp %x %d %d %08x %08x %08x %08x\n",
1604			xfer->resp, xfer->recv.len, xfer->recv.off, ntohl(ld[0]), ntohl(ld[1]), ntohl(ld[2]), ntohl(ld[3]));
1605printf("sbp %08x %08x %08x %08x\n", ntohl(ld[4]), ntohl(ld[5]), ntohl(ld[6]), ntohl(ld[7]));
1606printf("sbp %08x %08x %08x %08x\n", ntohl(ld[8]), ntohl(ld[9]), ntohl(ld[10]), ntohl(ld[11]));
1607*/
1608	sbp = (struct sbp_softc *)xfer->sc;
1609	SBP_LOCK_ASSERT(sbp);
1610	if (xfer->resp != 0) {
1611		printf("sbp_recv: xfer->resp = %d\n", xfer->resp);
1612		goto done0;
1613	}
1614	if (xfer->recv.payload == NULL) {
1615		printf("sbp_recv: xfer->recv.payload == NULL\n");
1616		goto done0;
1617	}
1618	rfp = &xfer->recv.hdr;
1619	if (rfp->mode.wreqb.tcode != FWTCODE_WREQB) {
1620		printf("sbp_recv: tcode = %d\n", rfp->mode.wreqb.tcode);
1621		goto done0;
1622	}
1623	sbp_status = (struct sbp_status *)xfer->recv.payload;
1624	addr = rfp->mode.wreqb.dest_lo;
1625SBP_DEBUG(2)
1626	printf("received address 0x%x\n", addr);
1627END_DEBUG
1628	t = SBP_ADDR2TRG(addr);
1629	if (t >= SBP_NUM_TARGETS) {
1630		device_printf(sbp->fd.dev,
1631			"sbp_recv1: invalid target %d\n", t);
1632		goto done0;
1633	}
1634	target = &sbp->targets[t];
1635	l = SBP_ADDR2LUN(addr);
1636	if (l >= target->num_lun || target->luns[l] == NULL) {
1637		device_printf(sbp->fd.dev,
1638			"sbp_recv1: invalid lun %d (target=%d)\n", l, t);
1639		goto done0;
1640	}
1641	sdev = target->luns[l];
1642
1643	ocb = NULL;
1644	switch (sbp_status->src) {
1645	case 0:
1646	case 1:
1647		/* check mgm_ocb_cur first */
1648		ocb  = target->mgm_ocb_cur;
1649		if (ocb != NULL) {
1650			if (OCB_MATCH(ocb, sbp_status)) {
1651				callout_stop(&target->mgm_ocb_timeout);
1652				target->mgm_ocb_cur = NULL;
1653				break;
1654			}
1655		}
1656		ocb = sbp_dequeue_ocb(sdev, sbp_status);
1657		if (ocb == NULL) {
1658			device_printf(sdev->target->sbp->fd.dev,
1659				"%s:%s No ocb(%x) on the queue\n",
1660				__func__,sdev->bustgtlun,
1661				ntohl(sbp_status->orb_lo));
1662		}
1663		break;
1664	case 2:
1665		/* unsolicit */
1666		device_printf(sdev->target->sbp->fd.dev,
1667			"%s:%s unsolicit status received\n",
1668			__func__, sdev->bustgtlun);
1669		break;
1670	default:
1671		device_printf(sdev->target->sbp->fd.dev,
1672			"%s:%s unknown sbp_status->src\n",
1673			__func__, sdev->bustgtlun);
1674	}
1675
1676	status_valid0 = (sbp_status->src < 2
1677			&& sbp_status->resp == ORB_RES_CMPL
1678			&& sbp_status->dead == 0);
1679	status_valid = (status_valid0 && sbp_status->status == 0);
1680
1681	if (!status_valid0 || debug > 2) {
1682		int status;
1683SBP_DEBUG(0)
1684		device_printf(sdev->target->sbp->fd.dev,
1685			"%s:%s ORB status src:%x resp:%x dead:%x"
1686				" len:%x stat:%x orb:%x%08x\n",
1687			__func__, sdev->bustgtlun,
1688			sbp_status->src, sbp_status->resp, sbp_status->dead,
1689			sbp_status->len, sbp_status->status,
1690			ntohs(sbp_status->orb_hi), ntohl(sbp_status->orb_lo));
1691END_DEBUG
1692		device_printf(sdev->target->sbp->fd.dev,
1693				"%s\n", sdev->bustgtlun);
1694		status = sbp_status->status;
1695		switch (sbp_status->resp) {
1696		case 0:
1697			if (status > MAX_ORB_STATUS0)
1698				printf("%s\n", orb_status0[MAX_ORB_STATUS0]);
1699			else
1700				printf("%s\n", orb_status0[status]);
1701			break;
1702		case 1:
1703			printf("Obj: %s, Error: %s\n",
1704				orb_status1_object[(status >> 6) & 3],
1705				orb_status1_serial_bus_error[status & 0xf]);
1706			break;
1707		case 2:
1708			printf("Illegal request\n");
1709			break;
1710		case 3:
1711			printf("Vendor dependent\n");
1712			break;
1713		default:
1714			printf("unknown respose code %d\n", sbp_status->resp);
1715		}
1716	}
1717
1718	/* we have to reset the fetch agent if it's dead */
1719	if (sbp_status->dead) {
1720		if (sdev->path) {
1721			xpt_freeze_devq(sdev->path, 1);
1722			sdev->freeze++;
1723		}
1724		reset_agent = 1;
1725	}
1726
1727	if (ocb == NULL)
1728		goto done;
1729
1730	switch (ntohl(ocb->orb[4]) & ORB_FMT_MSK) {
1731	case ORB_FMT_NOP:
1732		break;
1733	case ORB_FMT_VED:
1734		break;
1735	case ORB_FMT_STD:
1736		switch (ocb->flags) {
1737		case OCB_ACT_MGM:
1738			orb_fun = ntohl(ocb->orb[4]) & ORB_FUN_MSK;
1739			reset_agent = 0;
1740			switch (orb_fun) {
1741			case ORB_FUN_LGI:
1742				fwdma_sync(&sdev->dma, BUS_DMASYNC_POSTREAD);
1743				login_res = sdev->login;
1744				login_res->len = ntohs(login_res->len);
1745				login_res->id = ntohs(login_res->id);
1746				login_res->cmd_hi = ntohs(login_res->cmd_hi);
1747				login_res->cmd_lo = ntohl(login_res->cmd_lo);
1748				if (status_valid) {
1749SBP_DEBUG(0)
1750					device_printf(sdev->target->sbp->fd.dev,
1751						"%s:%s login: len %d, ID %d, cmd %08x%08x, recon_hold %d\n",
1752						__func__, sdev->bustgtlun,
1753						login_res->len, login_res->id,
1754						login_res->cmd_hi, login_res->cmd_lo,
1755						ntohs(login_res->recon_hold));
1756END_DEBUG
1757					sbp_busy_timeout(sdev);
1758				} else {
1759					/* forgot logout? */
1760					device_printf(sdev->target->sbp->fd.dev,
1761						"%s:%s login failed\n",
1762						__func__, sdev->bustgtlun);
1763					sdev->status = SBP_DEV_RESET;
1764				}
1765				break;
1766			case ORB_FUN_RCN:
1767				login_res = sdev->login;
1768				if (status_valid) {
1769SBP_DEBUG(0)
1770					device_printf(sdev->target->sbp->fd.dev,
1771						"%s:%s reconnect: len %d, ID %d, cmd %08x%08x\n",
1772						__func__, sdev->bustgtlun,
1773						login_res->len, login_res->id,
1774						login_res->cmd_hi, login_res->cmd_lo);
1775END_DEBUG
1776					if (sdev->status == SBP_DEV_ATTACHED)
1777						sbp_scan_dev(sdev);
1778					else
1779						sbp_agent_reset(sdev);
1780				} else {
1781					/* reconnection hold time exceed? */
1782SBP_DEBUG(0)
1783					device_printf(sdev->target->sbp->fd.dev,
1784						"%s:%s reconnect failed\n",
1785						__func__, sdev->bustgtlun);
1786END_DEBUG
1787					sbp_login(sdev);
1788				}
1789				break;
1790			case ORB_FUN_LGO:
1791				sdev->status = SBP_DEV_RESET;
1792				break;
1793			case ORB_FUN_RST:
1794				sbp_busy_timeout(sdev);
1795				break;
1796			case ORB_FUN_LUR:
1797			case ORB_FUN_ATA:
1798			case ORB_FUN_ATS:
1799				sbp_agent_reset(sdev);
1800				break;
1801			default:
1802				device_printf(sdev->target->sbp->fd.dev,
1803					"%s:%s unknown function %d\n",
1804					__func__, sdev->bustgtlun, orb_fun);
1805				break;
1806			}
1807			sbp_mgm_orb(sdev, ORB_FUN_RUNQUEUE, NULL);
1808			break;
1809		case OCB_ACT_CMD:
1810			sdev->timeout = 0;
1811			if (ocb->ccb != NULL) {
1812				union ccb *ccb;
1813
1814				ccb = ocb->ccb;
1815				if (sbp_status->len > 1) {
1816					sbp_scsi_status(sbp_status, ocb);
1817				} else {
1818					if (sbp_status->resp != ORB_RES_CMPL) {
1819						ccb->ccb_h.status = CAM_REQ_CMP_ERR;
1820					} else {
1821						ccb->ccb_h.status = CAM_REQ_CMP;
1822					}
1823				}
1824				/* fix up inq data */
1825				if (ccb->csio.cdb_io.cdb_bytes[0] == INQUIRY)
1826					sbp_fix_inq_data(ocb);
1827				xpt_done(ccb);
1828			}
1829			break;
1830		default:
1831			break;
1832		}
1833	}
1834
1835	if (!use_doorbell)
1836		sbp_free_ocb(sdev, ocb);
1837done:
1838	if (reset_agent)
1839		sbp_agent_reset(sdev);
1840
1841done0:
1842	xfer->recv.pay_len = SBP_RECV_LEN;
1843/* The received packet is usually small enough to be stored within
1844 * the buffer. In that case, the controller return ack_complete and
1845 * no respose is necessary.
1846 *
1847 * XXX fwohci.c and firewire.c should inform event_code such as
1848 * ack_complete or ack_pending to upper driver.
1849 */
1850#if NEED_RESPONSE
1851	xfer->send.off = 0;
1852	sfp = (struct fw_pkt *)xfer->send.buf;
1853	sfp->mode.wres.dst = rfp->mode.wreqb.src;
1854	xfer->dst = sfp->mode.wres.dst;
1855	xfer->spd = min(sdev->target->fwdev->speed, max_speed);
1856	xfer->hand = sbp_loginres_callback;
1857
1858	sfp->mode.wres.tlrt = rfp->mode.wreqb.tlrt;
1859	sfp->mode.wres.tcode = FWTCODE_WRES;
1860	sfp->mode.wres.rtcode = 0;
1861	sfp->mode.wres.pri = 0;
1862
1863	fw_asyreq(xfer->fc, -1, xfer);
1864#else
1865	/* recycle */
1866	STAILQ_INSERT_TAIL(&sbp->fwb.xferlist, xfer, link);
1867#endif
1868}
1869
1870static void
1871sbp_recv(struct fw_xfer *xfer)
1872{
1873	struct sbp_softc *sbp;
1874
1875	sbp = (struct sbp_softc *)xfer->sc;
1876	SBP_LOCK(sbp);
1877	sbp_recv1(xfer);
1878	SBP_UNLOCK(sbp);
1879}
1880/*
1881 * sbp_attach()
1882 */
1883static int
1884sbp_attach(device_t dev)
1885{
1886	struct sbp_softc *sbp;
1887	struct cam_devq *devq;
1888	struct firewire_comm *fc;
1889	int i, error;
1890
1891	if (DFLTPHYS > SBP_MAXPHYS)
1892		device_printf(dev, "Warning, DFLTPHYS(%dKB) is larger than "
1893			"SBP_MAXPHYS(%dKB).\n", DFLTPHYS / 1024,
1894			SBP_MAXPHYS / 1024);
1895
1896	if (!firewire_phydma_enable)
1897		device_printf(dev, "Warning, hw.firewire.phydma_enable must be 1 "
1898			"for SBP over FireWire.\n");
1899SBP_DEBUG(0)
1900	printf("sbp_attach (cold=%d)\n", cold);
1901END_DEBUG
1902
1903	if (cold)
1904		sbp_cold++;
1905	sbp = device_get_softc(dev);
1906	sbp->fd.dev = dev;
1907	sbp->fd.fc = fc = device_get_ivars(dev);
1908	mtx_init(&sbp->mtx, "sbp", NULL, MTX_DEF);
1909
1910	if (max_speed < 0)
1911		max_speed = fc->speed;
1912
1913	error = bus_dma_tag_create(/*parent*/fc->dmat,
1914				/* XXX shoud be 4 for sane backend? */
1915				/*alignment*/1,
1916				/*boundary*/0,
1917				/*lowaddr*/BUS_SPACE_MAXADDR_32BIT,
1918				/*highaddr*/BUS_SPACE_MAXADDR,
1919				/*filter*/NULL, /*filterarg*/NULL,
1920				/*maxsize*/0x100000, /*nsegments*/SBP_IND_MAX,
1921				/*maxsegsz*/SBP_SEG_MAX,
1922				/*flags*/BUS_DMA_ALLOCNOW,
1923				/*lockfunc*/busdma_lock_mutex,
1924				/*lockarg*/&sbp->mtx,
1925				&sbp->dmat);
1926	if (error != 0) {
1927		printf("sbp_attach: Could not allocate DMA tag "
1928			"- error %d\n", error);
1929			return (ENOMEM);
1930	}
1931
1932	devq = cam_simq_alloc(/*maxopenings*/SBP_NUM_OCB);
1933	if (devq == NULL)
1934		return (ENXIO);
1935
1936	for (i = 0; i < SBP_NUM_TARGETS; i++) {
1937		sbp->targets[i].fwdev = NULL;
1938		sbp->targets[i].luns = NULL;
1939		sbp->targets[i].sbp = sbp;
1940	}
1941
1942	sbp->sim = cam_sim_alloc(sbp_action, sbp_poll, "sbp", sbp,
1943				 device_get_unit(dev),
1944				 &sbp->mtx,
1945				 /*untagged*/ 1,
1946				 /*tagged*/ SBP_QUEUE_LEN - 1,
1947				 devq);
1948
1949	if (sbp->sim == NULL) {
1950		cam_simq_free(devq);
1951		return (ENXIO);
1952	}
1953
1954	SBP_LOCK(sbp);
1955	if (xpt_bus_register(sbp->sim, dev, /*bus*/0) != CAM_SUCCESS)
1956		goto fail;
1957
1958	if (xpt_create_path(&sbp->path, NULL, cam_sim_path(sbp->sim),
1959	    CAM_TARGET_WILDCARD, CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
1960		xpt_bus_deregister(cam_sim_path(sbp->sim));
1961		goto fail;
1962	}
1963	SBP_UNLOCK(sbp);
1964
1965	/* We reserve 16 bit space (4 bytes X 64 targets X 256 luns) */
1966	sbp->fwb.start = ((u_int64_t)SBP_BIND_HI << 32) | SBP_DEV2ADDR(0, 0);
1967	sbp->fwb.end = sbp->fwb.start + 0xffff;
1968	/* pre-allocate xfer */
1969	STAILQ_INIT(&sbp->fwb.xferlist);
1970	fw_xferlist_add(&sbp->fwb.xferlist, M_SBP,
1971	    /*send*/ 0, /*recv*/ SBP_RECV_LEN, SBP_NUM_OCB/2,
1972	    fc, (void *)sbp, sbp_recv);
1973
1974	fw_bindadd(fc, &sbp->fwb);
1975
1976	sbp->fd.post_busreset = sbp_post_busreset;
1977	sbp->fd.post_explore = sbp_post_explore;
1978
1979	if (fc->status != -1) {
1980		sbp_post_busreset((void *)sbp);
1981		sbp_post_explore((void *)sbp);
1982	}
1983	SBP_LOCK(sbp);
1984	xpt_async(AC_BUS_RESET, sbp->path, /*arg*/ NULL);
1985	SBP_UNLOCK(sbp);
1986
1987	return (0);
1988fail:
1989	SBP_UNLOCK(sbp);
1990	cam_sim_free(sbp->sim, /*free_devq*/TRUE);
1991	return (ENXIO);
1992}
1993
1994static int
1995sbp_logout_all(struct sbp_softc *sbp)
1996{
1997	struct sbp_target *target;
1998	struct sbp_dev *sdev;
1999	int i, j;
2000
2001SBP_DEBUG(0)
2002	printf("sbp_logout_all\n");
2003END_DEBUG
2004	SBP_LOCK_ASSERT(sbp);
2005	for (i = 0; i < SBP_NUM_TARGETS; i++) {
2006		target = &sbp->targets[i];
2007		if (target->luns == NULL)
2008			continue;
2009		for (j = 0; j < target->num_lun; j++) {
2010			sdev = target->luns[j];
2011			if (sdev == NULL)
2012				continue;
2013			callout_stop(&sdev->login_callout);
2014			if (sdev->status >= SBP_DEV_TOATTACH &&
2015					sdev->status <= SBP_DEV_ATTACHED)
2016				sbp_mgm_orb(sdev, ORB_FUN_LGO, NULL);
2017		}
2018	}
2019
2020	return 0;
2021}
2022
2023static int
2024sbp_shutdown(device_t dev)
2025{
2026	struct sbp_softc *sbp = ((struct sbp_softc *)device_get_softc(dev));
2027
2028	SBP_LOCK(sbp);
2029	sbp_logout_all(sbp);
2030	SBP_UNLOCK(sbp);
2031	return (0);
2032}
2033
2034static void
2035sbp_free_sdev(struct sbp_dev *sdev)
2036{
2037	struct sbp_softc *sbp;
2038	int i;
2039
2040	if (sdev == NULL)
2041		return;
2042	sbp = sdev->target->sbp;
2043	SBP_UNLOCK(sbp);
2044	callout_drain(&sdev->login_callout);
2045	for (i = 0; i < SBP_QUEUE_LEN; i++) {
2046		callout_drain(&sdev->ocb[i].timer);
2047		bus_dmamap_destroy(sbp->dmat, sdev->ocb[i].dmamap);
2048	}
2049	fwdma_free(sbp->fd.fc, &sdev->dma);
2050	free(sdev, M_SBP);
2051	SBP_LOCK(sbp);
2052}
2053
2054static void
2055sbp_free_target(struct sbp_target *target)
2056{
2057	struct sbp_softc *sbp;
2058	struct fw_xfer *xfer, *next;
2059	int i;
2060
2061	if (target->luns == NULL)
2062		return;
2063	sbp = target->sbp;
2064	SBP_LOCK_ASSERT(sbp);
2065	SBP_UNLOCK(sbp);
2066	callout_drain(&target->mgm_ocb_timeout);
2067	callout_drain(&target->scan_callout);
2068	SBP_LOCK(sbp);
2069	for (i = 0; i < target->num_lun; i++)
2070		sbp_free_sdev(target->luns[i]);
2071
2072	STAILQ_FOREACH_SAFE(xfer, &target->xferlist, link, next) {
2073		fw_xfer_free_buf(xfer);
2074	}
2075	STAILQ_INIT(&target->xferlist);
2076	free(target->luns, M_SBP);
2077	target->num_lun = 0;
2078	target->luns = NULL;
2079	target->fwdev = NULL;
2080}
2081
2082static int
2083sbp_detach(device_t dev)
2084{
2085	struct sbp_softc *sbp = ((struct sbp_softc *)device_get_softc(dev));
2086	struct firewire_comm *fc = sbp->fd.fc;
2087	int i;
2088
2089SBP_DEBUG(0)
2090	printf("sbp_detach\n");
2091END_DEBUG
2092
2093	SBP_LOCK(sbp);
2094	for (i = 0; i < SBP_NUM_TARGETS; i++)
2095		sbp_cam_detach_target(&sbp->targets[i]);
2096
2097	xpt_async(AC_LOST_DEVICE, sbp->path, NULL);
2098	xpt_free_path(sbp->path);
2099	xpt_bus_deregister(cam_sim_path(sbp->sim));
2100	cam_sim_free(sbp->sim, /*free_devq*/ TRUE);
2101
2102	sbp_logout_all(sbp);
2103	SBP_UNLOCK(sbp);
2104
2105	/* XXX wait for logout completion */
2106	pause("sbpdtc", hz/2);
2107
2108	SBP_LOCK(sbp);
2109	for (i = 0; i < SBP_NUM_TARGETS; i++)
2110		sbp_free_target(&sbp->targets[i]);
2111	SBP_UNLOCK(sbp);
2112
2113	fw_bindremove(fc, &sbp->fwb);
2114	fw_xferlist_remove(&sbp->fwb.xferlist);
2115
2116	bus_dma_tag_destroy(sbp->dmat);
2117	mtx_destroy(&sbp->mtx);
2118
2119	return (0);
2120}
2121
2122static void
2123sbp_cam_detach_sdev(struct sbp_dev *sdev)
2124{
2125	if (sdev == NULL)
2126		return;
2127	if (sdev->status == SBP_DEV_DEAD)
2128		return;
2129	if (sdev->status == SBP_DEV_RESET)
2130		return;
2131	SBP_LOCK_ASSERT(sdev->target->sbp);
2132	sbp_abort_all_ocbs(sdev, CAM_DEV_NOT_THERE);
2133	if (sdev->path) {
2134		xpt_release_devq(sdev->path,
2135				 sdev->freeze, TRUE);
2136		sdev->freeze = 0;
2137		xpt_async(AC_LOST_DEVICE, sdev->path, NULL);
2138		xpt_free_path(sdev->path);
2139		sdev->path = NULL;
2140	}
2141}
2142
2143static void
2144sbp_cam_detach_target(struct sbp_target *target)
2145{
2146	int i;
2147
2148	SBP_LOCK_ASSERT(target->sbp);
2149	if (target->luns != NULL) {
2150SBP_DEBUG(0)
2151		printf("sbp_detach_target %d\n", target->target_id);
2152END_DEBUG
2153		callout_stop(&target->scan_callout);
2154		for (i = 0; i < target->num_lun; i++)
2155			sbp_cam_detach_sdev(target->luns[i]);
2156	}
2157}
2158
2159static void
2160sbp_target_reset(struct sbp_dev *sdev, int method)
2161{
2162	int i;
2163	struct sbp_target *target = sdev->target;
2164	struct sbp_dev *tsdev;
2165
2166	SBP_LOCK_ASSERT(target->sbp);
2167	for (i = 0; i < target->num_lun; i++) {
2168		tsdev = target->luns[i];
2169		if (tsdev == NULL)
2170			continue;
2171		if (tsdev->status == SBP_DEV_DEAD)
2172			continue;
2173		if (tsdev->status == SBP_DEV_RESET)
2174			continue;
2175		xpt_freeze_devq(tsdev->path, 1);
2176		tsdev->freeze++;
2177		sbp_abort_all_ocbs(tsdev, CAM_CMD_TIMEOUT);
2178		if (method == 2)
2179			tsdev->status = SBP_DEV_LOGIN;
2180	}
2181	switch (method) {
2182	case 1:
2183		printf("target reset\n");
2184		sbp_mgm_orb(sdev, ORB_FUN_RST, NULL);
2185		break;
2186	case 2:
2187		printf("reset start\n");
2188		sbp_reset_start(sdev);
2189		break;
2190	}
2191
2192}
2193
2194static void
2195sbp_mgm_timeout(void *arg)
2196{
2197	struct sbp_ocb *ocb = (struct sbp_ocb *)arg;
2198	struct sbp_dev *sdev = ocb->sdev;
2199	struct sbp_target *target = sdev->target;
2200
2201	SBP_LOCK_ASSERT(target->sbp);
2202	device_printf(sdev->target->sbp->fd.dev,
2203		"%s:%s request timeout(mgm orb:0x%08x)\n",
2204		__func__, sdev->bustgtlun, (uint32_t)ocb->bus_addr);
2205	target->mgm_ocb_cur = NULL;
2206	sbp_free_ocb(sdev, ocb);
2207#if 0
2208	/* XXX */
2209	printf("run next request\n");
2210	sbp_mgm_orb(sdev, ORB_FUN_RUNQUEUE, NULL);
2211#endif
2212	device_printf(sdev->target->sbp->fd.dev,
2213		"%s:%s reset start\n",
2214		__func__, sdev->bustgtlun);
2215	sbp_reset_start(sdev);
2216}
2217
2218static void
2219sbp_timeout(void *arg)
2220{
2221	struct sbp_ocb *ocb = (struct sbp_ocb *)arg;
2222	struct sbp_dev *sdev = ocb->sdev;
2223
2224	device_printf(sdev->target->sbp->fd.dev,
2225		"%s:%s request timeout(cmd orb:0x%08x) ... ",
2226		__func__, sdev->bustgtlun, (uint32_t)ocb->bus_addr);
2227
2228	SBP_LOCK_ASSERT(sdev->target->sbp);
2229	sdev->timeout++;
2230	switch (sdev->timeout) {
2231	case 1:
2232		printf("agent reset\n");
2233		xpt_freeze_devq(sdev->path, 1);
2234		sdev->freeze++;
2235		sbp_abort_all_ocbs(sdev, CAM_CMD_TIMEOUT);
2236		sbp_agent_reset(sdev);
2237		break;
2238	case 2:
2239	case 3:
2240		sbp_target_reset(sdev, sdev->timeout - 1);
2241		break;
2242#if 0
2243	default:
2244		/* XXX give up */
2245		sbp_cam_detach_target(target);
2246		if (target->luns != NULL)
2247			free(target->luns, M_SBP);
2248		target->num_lun = 0;
2249		target->luns = NULL;
2250		target->fwdev = NULL;
2251#endif
2252	}
2253}
2254
2255static void
2256sbp_action(struct cam_sim *sim, union ccb *ccb)
2257{
2258
2259	struct sbp_softc *sbp = (struct sbp_softc *)sim->softc;
2260	struct sbp_target *target = NULL;
2261	struct sbp_dev *sdev = NULL;
2262
2263	if (sbp != NULL)
2264		SBP_LOCK_ASSERT(sbp);
2265	/* target:lun -> sdev mapping */
2266	if (sbp != NULL
2267			&& ccb->ccb_h.target_id != CAM_TARGET_WILDCARD
2268			&& ccb->ccb_h.target_id < SBP_NUM_TARGETS) {
2269		target = &sbp->targets[ccb->ccb_h.target_id];
2270		if (target->fwdev != NULL
2271				&& ccb->ccb_h.target_lun != CAM_LUN_WILDCARD
2272				&& ccb->ccb_h.target_lun < target->num_lun) {
2273			sdev = target->luns[ccb->ccb_h.target_lun];
2274			if (sdev != NULL && sdev->status != SBP_DEV_ATTACHED &&
2275				sdev->status != SBP_DEV_PROBE)
2276				sdev = NULL;
2277		}
2278	}
2279
2280SBP_DEBUG(1)
2281	if (sdev == NULL)
2282		printf("invalid target %d lun %jx\n",
2283			ccb->ccb_h.target_id, (uintmax_t)ccb->ccb_h.target_lun);
2284END_DEBUG
2285
2286	switch (ccb->ccb_h.func_code) {
2287	case XPT_SCSI_IO:
2288	case XPT_RESET_DEV:
2289	case XPT_GET_TRAN_SETTINGS:
2290	case XPT_SET_TRAN_SETTINGS:
2291	case XPT_CALC_GEOMETRY:
2292		if (sdev == NULL) {
2293SBP_DEBUG(1)
2294			printf("%s:%d:%jx:func_code 0x%04x: "
2295				"Invalid target (target needed)\n",
2296				device_get_nameunit(sbp->fd.dev),
2297				ccb->ccb_h.target_id,
2298				(uintmax_t)ccb->ccb_h.target_lun,
2299				ccb->ccb_h.func_code);
2300END_DEBUG
2301
2302			ccb->ccb_h.status = CAM_DEV_NOT_THERE;
2303			xpt_done(ccb);
2304			return;
2305		}
2306		break;
2307	case XPT_PATH_INQ:
2308	case XPT_NOOP:
2309		/* The opcodes sometimes aimed at a target (sc is valid),
2310		 * sometimes aimed at the SIM (sc is invalid and target is
2311		 * CAM_TARGET_WILDCARD)
2312		 */
2313		if (sbp == NULL &&
2314			ccb->ccb_h.target_id != CAM_TARGET_WILDCARD) {
2315SBP_DEBUG(0)
2316			printf("%s:%d:%jx func_code 0x%04x: "
2317				"Invalid target (no wildcard)\n",
2318				device_get_nameunit(sbp->fd.dev),
2319				ccb->ccb_h.target_id,
2320				(uintmax_t)ccb->ccb_h.target_lun,
2321				ccb->ccb_h.func_code);
2322END_DEBUG
2323			ccb->ccb_h.status = CAM_DEV_NOT_THERE;
2324			xpt_done(ccb);
2325			return;
2326		}
2327		break;
2328	default:
2329		/* XXX Hm, we should check the input parameters */
2330		break;
2331	}
2332
2333	switch (ccb->ccb_h.func_code) {
2334	case XPT_SCSI_IO:
2335	{
2336		struct ccb_scsiio *csio;
2337		struct sbp_ocb *ocb;
2338		int speed;
2339		void *cdb;
2340
2341		csio = &ccb->csio;
2342		mtx_assert(sim->mtx, MA_OWNED);
2343
2344SBP_DEBUG(2)
2345		printf("%s:%d:%jx XPT_SCSI_IO: "
2346			"cmd: %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x"
2347			", flags: 0x%02x, "
2348			"%db cmd/%db data/%db sense\n",
2349			device_get_nameunit(sbp->fd.dev),
2350			ccb->ccb_h.target_id, (uintmax_t)ccb->ccb_h.target_lun,
2351			csio->cdb_io.cdb_bytes[0],
2352			csio->cdb_io.cdb_bytes[1],
2353			csio->cdb_io.cdb_bytes[2],
2354			csio->cdb_io.cdb_bytes[3],
2355			csio->cdb_io.cdb_bytes[4],
2356			csio->cdb_io.cdb_bytes[5],
2357			csio->cdb_io.cdb_bytes[6],
2358			csio->cdb_io.cdb_bytes[7],
2359			csio->cdb_io.cdb_bytes[8],
2360			csio->cdb_io.cdb_bytes[9],
2361			ccb->ccb_h.flags & CAM_DIR_MASK,
2362			csio->cdb_len, csio->dxfer_len,
2363			csio->sense_len);
2364END_DEBUG
2365		if (sdev == NULL) {
2366			ccb->ccb_h.status = CAM_DEV_NOT_THERE;
2367			xpt_done(ccb);
2368			return;
2369		}
2370		if (csio->cdb_len > sizeof(ocb->orb) - 5 * sizeof(uint32_t)) {
2371			ccb->ccb_h.status = CAM_REQ_INVALID;
2372			xpt_done(ccb);
2373			return;
2374		}
2375#if 0
2376		/* if we are in probe stage, pass only probe commands */
2377		if (sdev->status == SBP_DEV_PROBE) {
2378			char *name;
2379			name = xpt_path_periph(ccb->ccb_h.path)->periph_name;
2380			printf("probe stage, periph name: %s\n", name);
2381			if (strcmp(name, "probe") != 0) {
2382				ccb->ccb_h.status = CAM_REQUEUE_REQ;
2383				xpt_done(ccb);
2384				return;
2385			}
2386		}
2387#endif
2388		if ((ocb = sbp_get_ocb(sdev)) == NULL) {
2389			ccb->ccb_h.status = CAM_RESRC_UNAVAIL;
2390			if (sdev->freeze == 0) {
2391				xpt_freeze_devq(sdev->path, 1);
2392				sdev->freeze++;
2393			}
2394			xpt_done(ccb);
2395			return;
2396		}
2397
2398		ocb->flags = OCB_ACT_CMD;
2399		ocb->sdev = sdev;
2400		ocb->ccb = ccb;
2401		ccb->ccb_h.ccb_sdev_ptr = sdev;
2402		ocb->orb[0] = htonl(1U << 31);
2403		ocb->orb[1] = 0;
2404		ocb->orb[2] = htonl(((sbp->fd.fc->nodeid | FWLOCALBUS) << 16));
2405		ocb->orb[3] = htonl(ocb->bus_addr + IND_PTR_OFFSET);
2406		speed = min(target->fwdev->speed, max_speed);
2407		ocb->orb[4] = htonl(ORB_NOTIFY | ORB_CMD_SPD(speed)
2408						| ORB_CMD_MAXP(speed + 7));
2409		if ((ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN) {
2410			ocb->orb[4] |= htonl(ORB_CMD_IN);
2411		}
2412
2413		if (csio->ccb_h.flags & CAM_CDB_POINTER)
2414			cdb = (void *)csio->cdb_io.cdb_ptr;
2415		else
2416			cdb = (void *)&csio->cdb_io.cdb_bytes;
2417		bcopy(cdb, (void *)&ocb->orb[5], csio->cdb_len);
2418/*
2419printf("ORB %08x %08x %08x %08x\n", ntohl(ocb->orb[0]), ntohl(ocb->orb[1]), ntohl(ocb->orb[2]), ntohl(ocb->orb[3]));
2420printf("ORB %08x %08x %08x %08x\n", ntohl(ocb->orb[4]), ntohl(ocb->orb[5]), ntohl(ocb->orb[6]), ntohl(ocb->orb[7]));
2421*/
2422		if (ccb->csio.dxfer_len > 0) {
2423			int error;
2424
2425			error = bus_dmamap_load_ccb(/*dma tag*/sbp->dmat,
2426					/*dma map*/ocb->dmamap,
2427					ccb,
2428					sbp_execute_ocb,
2429					ocb,
2430					/*flags*/0);
2431			if (error)
2432				printf("sbp: bus_dmamap_load error %d\n", error);
2433		} else
2434			sbp_execute_ocb(ocb, NULL, 0, 0);
2435		break;
2436	}
2437	case XPT_CALC_GEOMETRY:
2438	{
2439		struct ccb_calc_geometry *ccg;
2440
2441		ccg = &ccb->ccg;
2442		if (ccg->block_size == 0) {
2443			printf("sbp_action: block_size is 0.\n");
2444			ccb->ccb_h.status = CAM_REQ_INVALID;
2445			xpt_done(ccb);
2446			break;
2447		}
2448SBP_DEBUG(1)
2449		printf("%s:%d:%d:%jx:XPT_CALC_GEOMETRY: "
2450			"Volume size = %jd\n",
2451			device_get_nameunit(sbp->fd.dev),
2452			cam_sim_path(sbp->sim),
2453			ccb->ccb_h.target_id, (uintmax_t)ccb->ccb_h.target_lun,
2454			(uintmax_t)ccg->volume_size);
2455END_DEBUG
2456
2457		cam_calc_geometry(ccg, /*extended*/1);
2458		xpt_done(ccb);
2459		break;
2460	}
2461	case XPT_RESET_BUS:		/* Reset the specified SCSI bus */
2462	{
2463
2464SBP_DEBUG(1)
2465		printf("%s:%d:XPT_RESET_BUS: \n",
2466			device_get_nameunit(sbp->fd.dev), cam_sim_path(sbp->sim));
2467END_DEBUG
2468
2469		ccb->ccb_h.status = CAM_REQ_INVALID;
2470		xpt_done(ccb);
2471		break;
2472	}
2473	case XPT_PATH_INQ:		/* Path routing inquiry */
2474	{
2475		struct ccb_pathinq *cpi = &ccb->cpi;
2476
2477SBP_DEBUG(1)
2478		printf("%s:%d:%jx XPT_PATH_INQ:.\n",
2479			device_get_nameunit(sbp->fd.dev),
2480			ccb->ccb_h.target_id, (uintmax_t)ccb->ccb_h.target_lun);
2481END_DEBUG
2482		cpi->version_num = 1; /* XXX??? */
2483		cpi->hba_inquiry = PI_TAG_ABLE;
2484		cpi->target_sprt = 0;
2485		cpi->hba_misc = PIM_NOBUSRESET | PIM_NO_6_BYTE;
2486		cpi->hba_eng_cnt = 0;
2487		cpi->max_target = SBP_NUM_TARGETS - 1;
2488		cpi->max_lun = SBP_NUM_LUNS - 1;
2489		cpi->initiator_id = SBP_INITIATOR;
2490		cpi->bus_id = sim->bus_id;
2491		cpi->base_transfer_speed = 400 * 1000 / 8;
2492		strlcpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
2493		strlcpy(cpi->hba_vid, "SBP", HBA_IDLEN);
2494		strlcpy(cpi->dev_name, sim->sim_name, DEV_IDLEN);
2495		cpi->unit_number = sim->unit_number;
2496                cpi->transport = XPORT_SPI;	/* XX should have a FireWire */
2497                cpi->transport_version = 2;
2498                cpi->protocol = PROTO_SCSI;
2499                cpi->protocol_version = SCSI_REV_2;
2500
2501		cpi->ccb_h.status = CAM_REQ_CMP;
2502		xpt_done(ccb);
2503		break;
2504	}
2505	case XPT_GET_TRAN_SETTINGS:
2506	{
2507		struct ccb_trans_settings *cts = &ccb->cts;
2508		struct ccb_trans_settings_scsi *scsi =
2509		    &cts->proto_specific.scsi;
2510		struct ccb_trans_settings_spi *spi =
2511		    &cts->xport_specific.spi;
2512
2513		cts->protocol = PROTO_SCSI;
2514		cts->protocol_version = SCSI_REV_2;
2515		cts->transport = XPORT_SPI;	/* should have a FireWire */
2516		cts->transport_version = 2;
2517		spi->valid = CTS_SPI_VALID_DISC;
2518		spi->flags = CTS_SPI_FLAGS_DISC_ENB;
2519		scsi->valid = CTS_SCSI_VALID_TQ;
2520		scsi->flags = CTS_SCSI_FLAGS_TAG_ENB;
2521SBP_DEBUG(1)
2522		printf("%s:%d:%jx XPT_GET_TRAN_SETTINGS:.\n",
2523			device_get_nameunit(sbp->fd.dev),
2524			ccb->ccb_h.target_id, (uintmax_t)ccb->ccb_h.target_lun);
2525END_DEBUG
2526		cts->ccb_h.status = CAM_REQ_CMP;
2527		xpt_done(ccb);
2528		break;
2529	}
2530	case XPT_ABORT:
2531		ccb->ccb_h.status = CAM_UA_ABORT;
2532		xpt_done(ccb);
2533		break;
2534	case XPT_SET_TRAN_SETTINGS:
2535		/* XXX */
2536	default:
2537		ccb->ccb_h.status = CAM_REQ_INVALID;
2538		xpt_done(ccb);
2539		break;
2540	}
2541	return;
2542}
2543
2544static void
2545sbp_execute_ocb(void *arg, bus_dma_segment_t *segments, int seg, int error)
2546{
2547	int i;
2548	struct sbp_ocb *ocb;
2549	struct sbp_ocb *prev;
2550	bus_dma_segment_t *s;
2551
2552	if (error)
2553		printf("sbp_execute_ocb: error=%d\n", error);
2554
2555	ocb = (struct sbp_ocb *)arg;
2556
2557SBP_DEBUG(2)
2558	printf("sbp_execute_ocb: seg %d", seg);
2559	for (i = 0; i < seg; i++)
2560		printf(", %jx:%jd", (uintmax_t)segments[i].ds_addr,
2561					(uintmax_t)segments[i].ds_len);
2562	printf("\n");
2563END_DEBUG
2564
2565	if (seg == 1) {
2566		/* direct pointer */
2567		s = &segments[0];
2568		if (s->ds_len > SBP_SEG_MAX)
2569			panic("ds_len > SBP_SEG_MAX, fix busdma code");
2570		ocb->orb[3] = htonl(s->ds_addr);
2571		ocb->orb[4] |= htonl(s->ds_len);
2572	} else if (seg > 1) {
2573		/* page table */
2574		for (i = 0; i < seg; i++) {
2575			s = &segments[i];
2576SBP_DEBUG(0)
2577			/* XXX LSI Logic "< 16 byte" bug might be hit */
2578			if (s->ds_len < 16)
2579				printf("sbp_execute_ocb: warning, "
2580					"segment length(%zd) is less than 16."
2581					"(seg=%d/%d)\n", (size_t)s->ds_len, i + 1, seg);
2582END_DEBUG
2583			if (s->ds_len > SBP_SEG_MAX)
2584				panic("ds_len > SBP_SEG_MAX, fix busdma code");
2585			ocb->ind_ptr[i].hi = htonl(s->ds_len << 16);
2586			ocb->ind_ptr[i].lo = htonl(s->ds_addr);
2587		}
2588		ocb->orb[4] |= htonl(ORB_CMD_PTBL | seg);
2589	}
2590
2591	if (seg > 0)
2592		bus_dmamap_sync(ocb->sdev->target->sbp->dmat, ocb->dmamap,
2593			(ntohl(ocb->orb[4]) & ORB_CMD_IN) ?
2594			BUS_DMASYNC_PREREAD : BUS_DMASYNC_PREWRITE);
2595	prev = sbp_enqueue_ocb(ocb->sdev, ocb);
2596	fwdma_sync(&ocb->sdev->dma, BUS_DMASYNC_PREWRITE);
2597	if (use_doorbell) {
2598		if (prev == NULL) {
2599			if (ocb->sdev->last_ocb != NULL)
2600				sbp_doorbell(ocb->sdev);
2601			else
2602				sbp_orb_pointer(ocb->sdev, ocb);
2603		}
2604	} else {
2605		if (prev == NULL || (ocb->sdev->flags & ORB_LINK_DEAD) != 0) {
2606			ocb->sdev->flags &= ~ORB_LINK_DEAD;
2607			sbp_orb_pointer(ocb->sdev, ocb);
2608		}
2609	}
2610}
2611
2612static void
2613sbp_poll(struct cam_sim *sim)
2614{
2615	struct sbp_softc *sbp;
2616	struct firewire_comm *fc;
2617
2618	sbp = (struct sbp_softc *)sim->softc;
2619	fc = sbp->fd.fc;
2620
2621	fc->poll(fc, 0, -1);
2622
2623	return;
2624}
2625
2626static struct sbp_ocb *
2627sbp_dequeue_ocb(struct sbp_dev *sdev, struct sbp_status *sbp_status)
2628{
2629	struct sbp_ocb *ocb;
2630	struct sbp_ocb *next;
2631	int order = 0;
2632
2633SBP_DEBUG(1)
2634	device_printf(sdev->target->sbp->fd.dev,
2635	"%s:%s 0x%08x src %d\n",
2636	    __func__, sdev->bustgtlun, ntohl(sbp_status->orb_lo), sbp_status->src);
2637END_DEBUG
2638	SBP_LOCK_ASSERT(sdev->target->sbp);
2639	STAILQ_FOREACH_SAFE(ocb, &sdev->ocbs, ocb, next) {
2640		if (OCB_MATCH(ocb, sbp_status)) {
2641			/* found */
2642			STAILQ_REMOVE(&sdev->ocbs, ocb, sbp_ocb, ocb);
2643			if (ocb->ccb != NULL)
2644				callout_stop(&ocb->timer);
2645			if (ntohl(ocb->orb[4]) & 0xffff) {
2646				bus_dmamap_sync(sdev->target->sbp->dmat,
2647					ocb->dmamap,
2648					(ntohl(ocb->orb[4]) & ORB_CMD_IN) ?
2649					BUS_DMASYNC_POSTREAD :
2650					BUS_DMASYNC_POSTWRITE);
2651				bus_dmamap_unload(sdev->target->sbp->dmat,
2652					ocb->dmamap);
2653			}
2654			if (!use_doorbell) {
2655				if (sbp_status->src == SRC_NO_NEXT) {
2656					if (next != NULL)
2657						sbp_orb_pointer(sdev, next);
2658					else if (order > 0) {
2659						/*
2660						 * Unordered execution
2661						 * We need to send pointer for
2662						 * next ORB
2663						 */
2664						sdev->flags |= ORB_LINK_DEAD;
2665					}
2666				}
2667			} else {
2668				/*
2669				 * XXX this is not correct for unordered
2670				 * execution.
2671				 */
2672				if (sdev->last_ocb != NULL) {
2673					sbp_free_ocb(sdev, sdev->last_ocb);
2674				}
2675				sdev->last_ocb = ocb;
2676				if (next != NULL &&
2677				    sbp_status->src == SRC_NO_NEXT)
2678					sbp_doorbell(sdev);
2679			}
2680			break;
2681		} else
2682			order++;
2683	}
2684SBP_DEBUG(0)
2685	if (ocb && order > 0) {
2686		device_printf(sdev->target->sbp->fd.dev,
2687			"%s:%s unordered execution order:%d\n",
2688			__func__, sdev->bustgtlun, order);
2689	}
2690END_DEBUG
2691	return (ocb);
2692}
2693
2694static struct sbp_ocb *
2695sbp_enqueue_ocb(struct sbp_dev *sdev, struct sbp_ocb *ocb)
2696{
2697	struct sbp_ocb *prev, *prev2;
2698
2699	SBP_LOCK_ASSERT(sdev->target->sbp);
2700SBP_DEBUG(1)
2701	device_printf(sdev->target->sbp->fd.dev,
2702	"%s:%s 0x%08jx\n", __func__, sdev->bustgtlun, (uintmax_t)ocb->bus_addr);
2703END_DEBUG
2704	prev2 = prev = STAILQ_LAST(&sdev->ocbs, sbp_ocb, ocb);
2705	STAILQ_INSERT_TAIL(&sdev->ocbs, ocb, ocb);
2706
2707	if (ocb->ccb != NULL) {
2708		callout_reset_sbt(&ocb->timer,
2709		    SBT_1MS * ocb->ccb->ccb_h.timeout, 0, sbp_timeout,
2710		    ocb, 0);
2711	}
2712
2713	if (use_doorbell && prev == NULL)
2714		prev2 = sdev->last_ocb;
2715
2716	if (prev2 != NULL && (ocb->sdev->flags & ORB_LINK_DEAD) == 0) {
2717SBP_DEBUG(1)
2718		printf("linking chain 0x%jx -> 0x%jx\n",
2719		    (uintmax_t)prev2->bus_addr, (uintmax_t)ocb->bus_addr);
2720END_DEBUG
2721		/*
2722		 * Suppress compiler optimization so that orb[1] must be written first.
2723		 * XXX We may need an explicit memory barrier for other architectures
2724		 * other than i386/amd64.
2725		 */
2726		*(volatile uint32_t *)&prev2->orb[1] = htonl(ocb->bus_addr);
2727		*(volatile uint32_t *)&prev2->orb[0] = 0;
2728	}
2729
2730	return prev;
2731}
2732
2733static struct sbp_ocb *
2734sbp_get_ocb(struct sbp_dev *sdev)
2735{
2736	struct sbp_ocb *ocb;
2737
2738	SBP_LOCK_ASSERT(sdev->target->sbp);
2739	ocb = STAILQ_FIRST(&sdev->free_ocbs);
2740	if (ocb == NULL) {
2741		sdev->flags |= ORB_SHORTAGE;
2742		printf("ocb shortage!!!\n");
2743		return NULL;
2744	}
2745	STAILQ_REMOVE_HEAD(&sdev->free_ocbs, ocb);
2746	ocb->ccb = NULL;
2747	return (ocb);
2748}
2749
2750static void
2751sbp_free_ocb(struct sbp_dev *sdev, struct sbp_ocb *ocb)
2752{
2753	ocb->flags = 0;
2754	ocb->ccb = NULL;
2755
2756	SBP_LOCK_ASSERT(sdev->target->sbp);
2757	STAILQ_INSERT_TAIL(&sdev->free_ocbs, ocb, ocb);
2758	if ((sdev->flags & ORB_SHORTAGE) != 0) {
2759		int count;
2760
2761		sdev->flags &= ~ORB_SHORTAGE;
2762		count = sdev->freeze;
2763		sdev->freeze = 0;
2764		xpt_release_devq(sdev->path, count, TRUE);
2765	}
2766}
2767
2768static void
2769sbp_abort_ocb(struct sbp_ocb *ocb, int status)
2770{
2771	struct sbp_dev *sdev;
2772
2773	sdev = ocb->sdev;
2774	SBP_LOCK_ASSERT(sdev->target->sbp);
2775SBP_DEBUG(0)
2776	device_printf(sdev->target->sbp->fd.dev,
2777	"%s:%s 0x%jx\n", __func__, sdev->bustgtlun, (uintmax_t)ocb->bus_addr);
2778END_DEBUG
2779SBP_DEBUG(1)
2780	if (ocb->ccb != NULL)
2781		sbp_print_scsi_cmd(ocb);
2782END_DEBUG
2783	if (ntohl(ocb->orb[4]) & 0xffff) {
2784		bus_dmamap_sync(sdev->target->sbp->dmat, ocb->dmamap,
2785			(ntohl(ocb->orb[4]) & ORB_CMD_IN) ?
2786			BUS_DMASYNC_POSTREAD : BUS_DMASYNC_POSTWRITE);
2787		bus_dmamap_unload(sdev->target->sbp->dmat, ocb->dmamap);
2788	}
2789	if (ocb->ccb != NULL) {
2790		callout_stop(&ocb->timer);
2791		ocb->ccb->ccb_h.status = status;
2792		xpt_done(ocb->ccb);
2793	}
2794	sbp_free_ocb(sdev, ocb);
2795}
2796
2797static void
2798sbp_abort_all_ocbs(struct sbp_dev *sdev, int status)
2799{
2800	struct sbp_ocb *ocb, *next;
2801	STAILQ_HEAD(, sbp_ocb) temp;
2802
2803	STAILQ_INIT(&temp);
2804	SBP_LOCK_ASSERT(sdev->target->sbp);
2805	STAILQ_CONCAT(&temp, &sdev->ocbs);
2806	STAILQ_INIT(&sdev->ocbs);
2807
2808	STAILQ_FOREACH_SAFE(ocb, &temp, ocb, next) {
2809		sbp_abort_ocb(ocb, status);
2810	}
2811	if (sdev->last_ocb != NULL) {
2812		sbp_free_ocb(sdev, sdev->last_ocb);
2813		sdev->last_ocb = NULL;
2814	}
2815}
2816
2817static devclass_t sbp_devclass;
2818
2819static device_method_t sbp_methods[] = {
2820	/* device interface */
2821	DEVMETHOD(device_identify,	sbp_identify),
2822	DEVMETHOD(device_probe,		sbp_probe),
2823	DEVMETHOD(device_attach,	sbp_attach),
2824	DEVMETHOD(device_detach,	sbp_detach),
2825	DEVMETHOD(device_shutdown,	sbp_shutdown),
2826
2827	{ 0, 0 }
2828};
2829
2830static driver_t sbp_driver = {
2831	"sbp",
2832	sbp_methods,
2833	sizeof(struct sbp_softc),
2834};
2835DRIVER_MODULE(sbp, firewire, sbp_driver, sbp_devclass, 0, 0);
2836MODULE_VERSION(sbp, 1);
2837MODULE_DEPEND(sbp, firewire, 1, 1, 1);
2838MODULE_DEPEND(sbp, cam, 1, 1, 1);
2839