sys/dev/firewire/sbp.c

   1 /*-
   2  * Copyright (c) 2003 Hidetoshi Shimokawa
   3  * Copyright (c) 1998-2002 Katsushi Kobayashi and Hidetoshi Shimokawa
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  * 2. Redistributions in binary form must reproduce the above copyright
  12  *    notice, this list of conditions and the following disclaimer in the
  13  *    documentation and/or other materials provided with the distribution.
  14  * 3. All advertising materials mentioning features or use of this software
  15  *    must display the acknowledgement as bellow:
  16  *
  17  *    This product includes software developed by K. Kobayashi and H. Shimokawa
  18  *
  19  * 4. The name of the author may not be used to endorse or promote products
  20  *    derived from this software without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  23  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  24  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  25  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
  26  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  27  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  28  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  30  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  31  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  32  * POSSIBILITY OF SUCH DAMAGE.
  33  *
  34  * $FreeBSD$
  35  *
  36  */
  37
  38 #include <sys/param.h>
  39 #include <sys/systm.h>
  40 #include <sys/module.h>
  41 #include <sys/bus.h>
  42 #include <sys/kernel.h>
  43 #include <sys/sysctl.h>
  44 #include <machine/bus.h>
  45 #include <sys/malloc.h>
  46 #include <sys/lock.h>
  47 #include <sys/mutex.h>
  48
  49 #include <cam/cam.h>
  50 #include <cam/cam_ccb.h>
  51 #include <cam/cam_sim.h>
  52 #include <cam/cam_xpt_sim.h>
  53 #include <cam/cam_debug.h>
  54 #include <cam/cam_periph.h>
  55 #include <cam/scsi/scsi_all.h>
  56
  57 #include <dev/firewire/firewire.h>
  58 #include <dev/firewire/firewirereg.h>
  59 #include <dev/firewire/fwdma.h>
  60 #include <dev/firewire/iec13213.h>
  61 #include <dev/firewire/sbp.h>
  62
  63 #define ccb_sdev_ptr    spriv_ptr0
  64 #define ccb_sbp_ptr     spriv_ptr1
  65
  66 #define SBP_NUM_TARGETS 8 /* MAX 64 */
  67 /*
  68  * Scan_bus doesn't work for more than 8 LUNs
  69  * because of CAM_SCSI2_MAXLUN in cam_xpt.c
  70  */
  71 #define SBP_NUM_LUNS 64
  72 #define SBP_MAXPHYS  MIN(MAXPHYS, (512*1024) /* 512KB */)
  73 #define SBP_DMA_SIZE PAGE_SIZE
  74 #define SBP_LOGIN_SIZE sizeof(struct sbp_login_res)
  75 #define SBP_QUEUE_LEN ((SBP_DMA_SIZE - SBP_LOGIN_SIZE) / sizeof(struct sbp_ocb))
  76 #define SBP_NUM_OCB (SBP_QUEUE_LEN * SBP_NUM_TARGETS)
  77
  78 /*
  79  * STATUS FIFO addressing
  80  *   bit
  81  *-----------------------
  82  *  0- 1( 2): 0 (alignment)
  83  *  2- 7( 6): target
  84  *  8-15( 8): lun
  85  * 16-31( 8): reserved
  86  * 32-47(16): SBP_BIND_HI
  87  * 48-64(16): bus_id, node_id
  88  */
  89 #define SBP_BIND_HI 0x1
  90 #define SBP_DEV2ADDR(t, l) \
  91         (((u_int64_t)SBP_BIND_HI << 32) \
  92         | (((l) & 0xff) << 8) \
  93         | (((t) & 0x3f) << 2))
  94 #define SBP_ADDR2TRG(a) (((a) >> 2) & 0x3f)
  95 #define SBP_ADDR2LUN(a) (((a) >> 8) & 0xff)
  96 #define SBP_INITIATOR 7
  97
  98 static char *orb_fun_name[] = {
  99         ORB_FUN_NAMES
 100 };
 101
 102 static int debug = 0;
 103 static int auto_login = 1;
 104 static int max_speed = -1;
 105 static int sbp_cold = 1;
 106 static int ex_login = 1;
 107 static int login_delay = 1000;  /* msec */
 108 static int scan_delay = 500;    /* msec */
 109 static int use_doorbell = 0;
 110 static int sbp_tags = 0;
 111
 112 SYSCTL_DECL(_hw_firewire);
 113 static SYSCTL_NODE(_hw_firewire, OID_AUTO, sbp, CTLFLAG_RD, 0,
 114         "SBP-II Subsystem");
 115 SYSCTL_INT(_debug, OID_AUTO, sbp_debug, CTLFLAG_RWTUN, &debug, 0,
 116         "SBP debug flag");
 117 SYSCTL_INT(_hw_firewire_sbp, OID_AUTO, auto_login, CTLFLAG_RWTUN, &auto_login, 0,
 118         "SBP perform login automatically");
 119 SYSCTL_INT(_hw_firewire_sbp, OID_AUTO, max_speed, CTLFLAG_RWTUN, &max_speed, 0,
 120         "SBP transfer max speed");
 121 SYSCTL_INT(_hw_firewire_sbp, OID_AUTO, exclusive_login, CTLFLAG_RWTUN,
 122         &ex_login, 0, "SBP enable exclusive login");
 123 SYSCTL_INT(_hw_firewire_sbp, OID_AUTO, login_delay, CTLFLAG_RWTUN,
 124         &login_delay, 0, "SBP login delay in msec");
 125 SYSCTL_INT(_hw_firewire_sbp, OID_AUTO, scan_delay, CTLFLAG_RWTUN,
 126         &scan_delay, 0, "SBP scan delay in msec");
 127 SYSCTL_INT(_hw_firewire_sbp, OID_AUTO, use_doorbell, CTLFLAG_RWTUN,
 128         &use_doorbell, 0, "SBP use doorbell request");
 129 SYSCTL_INT(_hw_firewire_sbp, OID_AUTO, tags, CTLFLAG_RWTUN, &sbp_tags, 0,
 130         "SBP tagged queuing support");
 131
 132 #define NEED_RESPONSE 0
 133
 134 #define SBP_SEG_MAX rounddown(0xffff, PAGE_SIZE)
 135 #ifdef __sparc64__ /* iommu */
 136 #define SBP_IND_MAX howmany(SBP_MAXPHYS, SBP_SEG_MAX)
 137 #else
 138 #define SBP_IND_MAX howmany(SBP_MAXPHYS, PAGE_SIZE)
 139 #endif
 140 struct sbp_ocb {
 141         STAILQ_ENTRY(sbp_ocb)   ocb;
 142         union ccb       *ccb;
 143         bus_addr_t      bus_addr;
 144         uint32_t        orb[8];
 145 #define IND_PTR_OFFSET  (8*sizeof(uint32_t))
 146         struct ind_ptr  ind_ptr[SBP_IND_MAX];
 147         struct sbp_dev  *sdev;
 148         int             flags; /* XXX should be removed */
 149         bus_dmamap_t    dmamap;
 150         struct callout  timer;
 151 };
 152
 153 #define OCB_ACT_MGM 0
 154 #define OCB_ACT_CMD 1
 155 #define OCB_MATCH(o,s)  ((o)->bus_addr == ntohl((s)->orb_lo))
 156
 157 struct sbp_dev {
 158 #define SBP_DEV_RESET           0       /* accept login */
 159 #define SBP_DEV_LOGIN           1       /* to login */
 160 #if 0
 161 #define SBP_DEV_RECONN          2       /* to reconnect */
 162 #endif
 163 #define SBP_DEV_TOATTACH        3       /* to attach */
 164 #define SBP_DEV_PROBE           4       /* scan lun */
 165 #define SBP_DEV_ATTACHED        5       /* in operation */
 166 #define SBP_DEV_DEAD            6       /* unavailable unit */
 167 #define SBP_DEV_RETRY           7       /* unavailable unit */
 168         uint8_t status:4,
 169                  timeout:4;
 170         uint8_t type;
 171         uint16_t lun_id;
 172         uint16_t freeze;
 173 #define ORB_LINK_DEAD           (1 << 0)
 174 #define VALID_LUN               (1 << 1)
 175 #define ORB_POINTER_ACTIVE      (1 << 2)
 176 #define ORB_POINTER_NEED        (1 << 3)
 177 #define ORB_DOORBELL_ACTIVE     (1 << 4)
 178 #define ORB_DOORBELL_NEED       (1 << 5)
 179 #define ORB_SHORTAGE            (1 << 6)
 180         uint16_t flags;
 181         struct cam_path *path;
 182         struct sbp_target *target;
 183         struct fwdma_alloc dma;
 184         struct sbp_login_res *login;
 185         struct callout login_callout;
 186         struct sbp_ocb *ocb;
 187         STAILQ_HEAD(, sbp_ocb) ocbs;
 188         STAILQ_HEAD(, sbp_ocb) free_ocbs;
 189         struct sbp_ocb *last_ocb;
 190         char vendor[32];
 191         char product[32];
 192         char revision[10];
 193         char bustgtlun[32];
 194 };
 195
 196 struct sbp_target {
 197         int target_id;
 198         int num_lun;
 199         struct sbp_dev  **luns;
 200         struct sbp_softc *sbp;
 201         struct fw_device *fwdev;
 202         uint32_t mgm_hi, mgm_lo;
 203         struct sbp_ocb *mgm_ocb_cur;
 204         STAILQ_HEAD(, sbp_ocb) mgm_ocb_queue;
 205         struct callout mgm_ocb_timeout;
 206         struct callout scan_callout;
 207         STAILQ_HEAD(, fw_xfer) xferlist;
 208         int n_xfer;
 209 };
 210
 211 struct sbp_softc {
 212         struct firewire_dev_comm fd;
 213         struct cam_sim  *sim;
 214         struct cam_path  *path;
 215         struct sbp_target targets[SBP_NUM_TARGETS];
 216         struct fw_bind fwb;
 217         bus_dma_tag_t   dmat;
 218         struct timeval last_busreset;
 219 #define SIMQ_FREEZED 1
 220         int flags;
 221         struct mtx mtx;
 222 };
 223 #define SBP_LOCK(sbp)           mtx_lock(&(sbp)->mtx)
 224 #define SBP_UNLOCK(sbp)         mtx_unlock(&(sbp)->mtx)
 225 #define SBP_LOCK_ASSERT(sbp)    mtx_assert(&(sbp)->mtx, MA_OWNED)
 226
 227 static void sbp_post_explore (void *);
 228 static void sbp_recv (struct fw_xfer *);
 229 static void sbp_mgm_callback (struct fw_xfer *);
 230 #if 0
 231 static void sbp_cmd_callback (struct fw_xfer *);
 232 #endif
 233 static void sbp_orb_pointer (struct sbp_dev *, struct sbp_ocb *);
 234 static void sbp_doorbell(struct sbp_dev *);
 235 static void sbp_execute_ocb (void *, bus_dma_segment_t *, int, int);
 236 static void sbp_free_ocb (struct sbp_dev *, struct sbp_ocb *);
 237 static void sbp_abort_ocb (struct sbp_ocb *, int);
 238 static void sbp_abort_all_ocbs (struct sbp_dev *, int);
 239 static struct fw_xfer * sbp_write_cmd (struct sbp_dev *, int, int);
 240 static struct sbp_ocb * sbp_get_ocb (struct sbp_dev *);
 241 static struct sbp_ocb * sbp_enqueue_ocb (struct sbp_dev *, struct sbp_ocb *);
 242 static struct sbp_ocb * sbp_dequeue_ocb (struct sbp_dev *, struct sbp_status *);
 243 static void sbp_cam_detach_sdev(struct sbp_dev *);
 244 static void sbp_free_sdev(struct sbp_dev *);
 245 static void sbp_cam_detach_target (struct sbp_target *);
 246 static void sbp_free_target (struct sbp_target *);
 247 static void sbp_mgm_timeout (void *arg);
 248 static void sbp_timeout (void *arg);
 249 static void sbp_mgm_orb (struct sbp_dev *, int, struct sbp_ocb *);
 250
 251 static MALLOC_DEFINE(M_SBP, "sbp", "SBP-II/FireWire");
 252
 253 /* cam related functions */
 254 static void     sbp_action(struct cam_sim *sim, union ccb *ccb);
 255 static void     sbp_poll(struct cam_sim *sim);
 256 static void     sbp_cam_scan_lun(struct cam_periph *, union ccb *);
 257 static void     sbp_cam_scan_target(void *arg);
 258
 259 static char *orb_status0[] = {
 260         /* 0 */ "No additional information to report",
 261         /* 1 */ "Request type not supported",
 262         /* 2 */ "Speed not supported",
 263         /* 3 */ "Page size not supported",
 264         /* 4 */ "Access denied",
 265         /* 5 */ "Logical unit not supported",
 266         /* 6 */ "Maximum payload too small",
 267         /* 7 */ "Reserved for future standardization",
 268         /* 8 */ "Resources unavailable",
 269         /* 9 */ "Function rejected",
 270         /* A */ "Login ID not recognized",
 271         /* B */ "Dummy ORB completed",
 272         /* C */ "Request aborted",
 273         /* FF */ "Unspecified error"
 274 #define MAX_ORB_STATUS0 0xd
 275 };
 276
 277 static char *orb_status1_object[] = {
 278         /* 0 */ "Operation request block (ORB)",
 279         /* 1 */ "Data buffer",
 280         /* 2 */ "Page table",
 281         /* 3 */ "Unable to specify"
 282 };
 283
 284 static char *orb_status1_serial_bus_error[] = {
 285         /* 0 */ "Missing acknowledge",
 286         /* 1 */ "Reserved; not to be used",
 287         /* 2 */ "Time-out error",
 288         /* 3 */ "Reserved; not to be used",
 289         /* 4 */ "Busy retry limit exceeded(X)",
 290         /* 5 */ "Busy retry limit exceeded(A)",
 291         /* 6 */ "Busy retry limit exceeded(B)",
 292         /* 7 */ "Reserved for future standardization",
 293         /* 8 */ "Reserved for future standardization",
 294         /* 9 */ "Reserved for future standardization",
 295         /* A */ "Reserved for future standardization",
 296         /* B */ "Tardy retry limit exceeded",
 297         /* C */ "Conflict error",
 298         /* D */ "Data error",
 299         /* E */ "Type error",
 300         /* F */ "Address error"
 301 };
 302
 303 static void
 304 sbp_identify(driver_t *driver, device_t parent)
 305 {
 306 SBP_DEBUG(0)
 307         printf("sbp_identify\n");
 308 END_DEBUG
 309
 310         if (device_find_child(parent, "sbp", -1) == NULL)
 311                 BUS_ADD_CHILD(parent, 0, "sbp", -1);
 312 }
 313
 314 /*
 315  * sbp_probe()
 316  */
 317 static int
 318 sbp_probe(device_t dev)
 319 {
 320
 321 SBP_DEBUG(0)
 322         printf("sbp_probe\n");
 323 END_DEBUG
 324
 325         device_set_desc(dev, "SBP-2/SCSI over FireWire");
 326
 327 #if 0
 328         if (bootverbose)
 329                 debug = bootverbose;
 330 #endif
 331
 332         return (0);
 333 }
 334
 335 /*
 336  * Display device characteristics on the console
 337  */
 338 static void
 339 sbp_show_sdev_info(struct sbp_dev *sdev)
 340 {
 341         struct fw_device *fwdev;
 342
 343         fwdev = sdev->target->fwdev;
 344         device_printf(sdev->target->sbp->fd.dev,
 345                 "%s: %s: ordered:%d type:%d EUI:%08x%08x node:%d "
 346                 "speed:%d maxrec:%d\n",
 347                 __func__,
 348                 sdev->bustgtlun,
 349                 (sdev->type & 0x40) >> 6,
 350                 (sdev->type & 0x1f),
 351                 fwdev->eui.hi,
 352                 fwdev->eui.lo,
 353                 fwdev->dst,
 354                 fwdev->speed,
 355                 fwdev->maxrec);
 356
 357         device_printf(sdev->target->sbp->fd.dev,
 358                         "%s: %s '%s' '%s' '%s'\n",
 359                         __func__,
 360                         sdev->bustgtlun,
 361                         sdev->vendor,
 362                         sdev->product,
 363                         sdev->revision);
 364 }
 365
 366 static struct {
 367         int bus;
 368         int target;
 369         struct fw_eui64 eui;
 370 } wired[] = {
 371         /* Bus  Target  EUI64 */
 372 #if 0
 373         {0,     2,      {0x00018ea0, 0x01fd0154}},      /* Logitec HDD */
 374         {0,     0,      {0x00018ea6, 0x00100682}},      /* Logitec DVD */
 375         {0,     1,      {0x00d03200, 0xa412006a}},      /* Yano HDD */
 376 #endif
 377         {-1,    -1,     {0,0}}
 378 };
 379
 380 static int
 381 sbp_new_target(struct sbp_softc *sbp, struct fw_device *fwdev)
 382 {
 383         int bus, i, target=-1;
 384         char w[SBP_NUM_TARGETS];
 385
 386         bzero(w, sizeof(w));
 387         bus = device_get_unit(sbp->fd.dev);
 388
 389         /* XXX wired-down configuration should be gotten from
 390                                         tunable or device hint */
 391         for (i = 0; wired[i].bus >= 0; i++) {
 392                 if (wired[i].bus == bus) {
 393                         w[wired[i].target] = 1;
 394                         if (wired[i].eui.hi == fwdev->eui.hi &&
 395                                         wired[i].eui.lo == fwdev->eui.lo)
 396                                 target = wired[i].target;
 397                 }
 398         }
 399         if (target >= 0) {
 400                 if (target < SBP_NUM_TARGETS &&
 401                                 sbp->targets[target].fwdev == NULL)
 402                         return (target);
 403                 device_printf(sbp->fd.dev,
 404                         "target %d is not free for %08x:%08x\n",
 405                         target, fwdev->eui.hi, fwdev->eui.lo);
 406                 target = -1;
 407         }
 408         /* non-wired target */
 409         for (i = 0; i < SBP_NUM_TARGETS; i++)
 410                 if (sbp->targets[i].fwdev == NULL && w[i] == 0) {
 411                         target = i;
 412                         break;
 413                 }
 414
 415         return target;
 416 }
 417
 418 static void
 419 sbp_alloc_lun(struct sbp_target *target)
 420 {
 421         struct crom_context cc;
 422         struct csrreg *reg;
 423         struct sbp_dev *sdev, **newluns;
 424         struct sbp_softc *sbp;
 425         int maxlun, lun, i;
 426
 427         sbp = target->sbp;
 428         SBP_LOCK_ASSERT(sbp);
 429         crom_init_context(&cc, target->fwdev->csrrom);
 430         /* XXX shoud parse appropriate unit directories only */
 431         maxlun = -1;
 432         while (cc.depth >= 0) {
 433                 reg = crom_search_key(&cc, CROM_LUN);
 434                 if (reg == NULL)
 435                         break;
 436                 lun = reg->val & 0xffff;
 437 SBP_DEBUG(0)
 438                 printf("target %d lun %d found\n", target->target_id, lun);
 439 END_DEBUG
 440                 if (maxlun < lun)
 441                         maxlun = lun;
 442                 crom_next(&cc);
 443         }
 444         if (maxlun < 0)
 445                 device_printf(target->sbp->fd.dev, "%d no LUN found\n",
 446                     target->target_id);
 447
 448         maxlun++;
 449         if (maxlun >= SBP_NUM_LUNS)
 450                 maxlun = SBP_NUM_LUNS;
 451
 452         /* Invalidiate stale devices */
 453         for (lun = 0; lun < target->num_lun; lun++) {
 454                 sdev = target->luns[lun];
 455                 if (sdev == NULL)
 456                         continue;
 457                 sdev->flags &= ~VALID_LUN;
 458                 if (lun >= maxlun) {
 459                         /* lost device */
 460                         sbp_cam_detach_sdev(sdev);
 461                         sbp_free_sdev(sdev);
 462                         target->luns[lun] = NULL;
 463                 }
 464         }
 465
 466         /* Reallocate */
 467         if (maxlun != target->num_lun) {
 468                 newluns = (struct sbp_dev **) realloc(target->luns,
 469                     sizeof(struct sbp_dev *) * maxlun,
 470                     M_SBP, M_NOWAIT | M_ZERO);
 471
 472                 if (newluns == NULL) {
 473                         printf("%s: realloc failed\n", __func__);
 474                         newluns = target->luns;
 475                         maxlun = target->num_lun;
 476                 }
 477
 478                 /*
 479                  * We must zero the extended region for the case
 480                  * realloc() doesn't allocate new buffer.
 481                  */
 482                 if (maxlun > target->num_lun)
 483                         bzero(&newluns[target->num_lun],
 484                             sizeof(struct sbp_dev *) *
 485                             (maxlun - target->num_lun));
 486
 487                 target->luns = newluns;
 488                 target->num_lun = maxlun;
 489         }
 490
 491         crom_init_context(&cc, target->fwdev->csrrom);
 492         while (cc.depth >= 0) {
 493                 int new = 0;
 494
 495                 reg = crom_search_key(&cc, CROM_LUN);
 496                 if (reg == NULL)
 497                         break;
 498                 lun = reg->val & 0xffff;
 499                 if (lun >= SBP_NUM_LUNS) {
 500                         printf("too large lun %d\n", lun);
 501                         goto next;
 502                 }
 503
 504                 sdev = target->luns[lun];
 505                 if (sdev == NULL) {
 506                         sdev = malloc(sizeof(struct sbp_dev),
 507                             M_SBP, M_NOWAIT | M_ZERO);
 508                         if (sdev == NULL) {
 509                                 printf("%s: malloc failed\n", __func__);
 510                                 goto next;
 511                         }
 512                         target->luns[lun] = sdev;
 513                         sdev->lun_id = lun;
 514                         sdev->target = target;
 515                         STAILQ_INIT(&sdev->ocbs);
 516                         callout_init_mtx(&sdev->login_callout, &sbp->mtx, 0);
 517                         sdev->status = SBP_DEV_RESET;
 518                         new = 1;
 519                         snprintf(sdev->bustgtlun, 32, "%s:%d:%d",
 520                                         device_get_nameunit(sdev->target->sbp->fd.dev),
 521                                         sdev->target->target_id,
 522                                         sdev->lun_id);
 523                 }
 524                 sdev->flags |= VALID_LUN;
 525                 sdev->type = (reg->val & 0xff0000) >> 16;
 526
 527                 if (new == 0)
 528                         goto next;
 529
 530                 fwdma_malloc(sbp->fd.fc,
 531                         /* alignment */ sizeof(uint32_t),
 532                         SBP_DMA_SIZE, &sdev->dma, BUS_DMA_NOWAIT |
 533                         BUS_DMA_COHERENT);
 534                 if (sdev->dma.v_addr == NULL) {
 535                         printf("%s: dma space allocation failed\n",
 536                                                         __func__);
 537                         free(sdev, M_SBP);
 538                         target->luns[lun] = NULL;
 539                         goto next;
 540                 }
 541                 sdev->login = (struct sbp_login_res *) sdev->dma.v_addr;
 542                 sdev->ocb = (struct sbp_ocb *)
 543                                 ((char *)sdev->dma.v_addr + SBP_LOGIN_SIZE);
 544                 bzero((char *)sdev->ocb,
 545                         sizeof(struct sbp_ocb) * SBP_QUEUE_LEN);
 546
 547                 STAILQ_INIT(&sdev->free_ocbs);
 548                 for (i = 0; i < SBP_QUEUE_LEN; i++) {
 549                         struct sbp_ocb *ocb;
 550                         ocb = &sdev->ocb[i];
 551                         ocb->bus_addr = sdev->dma.bus_addr
 552                                 + SBP_LOGIN_SIZE
 553                                 + sizeof(struct sbp_ocb) * i
 554                                 + offsetof(struct sbp_ocb, orb[0]);
 555                         if (bus_dmamap_create(sbp->dmat, 0, &ocb->dmamap)) {
 556                                 printf("sbp_attach: cannot create dmamap\n");
 557                                 /* XXX */
 558                                 goto next;
 559                         }
 560                         callout_init_mtx(&ocb->timer, &sbp->mtx, 0);
 561                         sbp_free_ocb(sdev, ocb);
 562                 }
 563 next:
 564                 crom_next(&cc);
 565         }
 566
 567         for (lun = 0; lun < target->num_lun; lun++) {
 568                 sdev = target->luns[lun];
 569                 if (sdev != NULL && (sdev->flags & VALID_LUN) == 0) {
 570                         sbp_cam_detach_sdev(sdev);
 571                         sbp_free_sdev(sdev);
 572                         target->luns[lun] = NULL;
 573                 }
 574         }
 575 }
 576
 577 static struct sbp_target *
 578 sbp_alloc_target(struct sbp_softc *sbp, struct fw_device *fwdev)
 579 {
 580         int i;
 581         struct sbp_target *target;
 582         struct crom_context cc;
 583         struct csrreg *reg;
 584
 585 SBP_DEBUG(1)
 586         printf("sbp_alloc_target\n");
 587 END_DEBUG
 588         i = sbp_new_target(sbp, fwdev);
 589         if (i < 0) {
 590                 device_printf(sbp->fd.dev, "increase SBP_NUM_TARGETS!\n");
 591                 return NULL;
 592         }
 593         /* new target */
 594         target = &sbp->targets[i];
 595         target->fwdev = fwdev;
 596         target->target_id = i;
 597         /* XXX we may want to reload mgm port after each bus reset */
 598         /* XXX there might be multiple management agents */
 599         crom_init_context(&cc, target->fwdev->csrrom);
 600         reg = crom_search_key(&cc, CROM_MGM);
 601         if (reg == NULL || reg->val == 0) {
 602                 printf("NULL management address\n");
 603                 target->fwdev = NULL;
 604                 return NULL;
 605         }
 606         target->mgm_hi = 0xffff;
 607         target->mgm_lo = 0xf0000000 | (reg->val << 2);
 608         target->mgm_ocb_cur = NULL;
 609 SBP_DEBUG(1)
 610         printf("target:%d mgm_port: %x\n", i, target->mgm_lo);
 611 END_DEBUG
 612         STAILQ_INIT(&target->xferlist);
 613         target->n_xfer = 0;
 614         STAILQ_INIT(&target->mgm_ocb_queue);
 615         callout_init_mtx(&target->mgm_ocb_timeout, &sbp->mtx, 0);
 616         callout_init_mtx(&target->scan_callout, &sbp->mtx, 0);
 617
 618         target->luns = NULL;
 619         target->num_lun = 0;
 620         return target;
 621 }
 622
 623 static void
 624 sbp_probe_lun(struct sbp_dev *sdev)
 625 {
 626         struct fw_device *fwdev;
 627         struct crom_context c, *cc = &c;
 628         struct csrreg *reg;
 629
 630         bzero(sdev->vendor, sizeof(sdev->vendor));
 631         bzero(sdev->product, sizeof(sdev->product));
 632
 633         fwdev = sdev->target->fwdev;
 634         crom_init_context(cc, fwdev->csrrom);
 635         /* get vendor string */
 636         crom_search_key(cc, CSRKEY_VENDOR);
 637         crom_next(cc);
 638         crom_parse_text(cc, sdev->vendor, sizeof(sdev->vendor));
 639         /* skip to the unit directory for SBP-2 */
 640         while ((reg = crom_search_key(cc, CSRKEY_VER)) != NULL) {
 641                 if (reg->val == CSRVAL_T10SBP2)
 642                         break;
 643                 crom_next(cc);
 644         }
 645         /* get firmware revision */
 646         reg = crom_search_key(cc, CSRKEY_FIRM_VER);
 647         if (reg != NULL)
 648                 snprintf(sdev->revision, sizeof(sdev->revision),
 649                                                 "%06x", reg->val);
 650         /* get product string */
 651         crom_search_key(cc, CSRKEY_MODEL);
 652         crom_next(cc);
 653         crom_parse_text(cc, sdev->product, sizeof(sdev->product));
 654 }
 655
 656 static void
 657 sbp_login_callout(void *arg)
 658 {
 659         struct sbp_dev *sdev = (struct sbp_dev *)arg;
 660         SBP_LOCK_ASSERT(sdev->target->sbp);
 661         sbp_mgm_orb(sdev, ORB_FUN_LGI, NULL);
 662 }
 663
 664 static void
 665 sbp_login(struct sbp_dev *sdev)
 666 {
 667         struct timeval delta;
 668         struct timeval t;
 669         int ticks = 0;
 670
 671         microtime(&delta);
 672         timevalsub(&delta, &sdev->target->sbp->last_busreset);
 673         t.tv_sec = login_delay / 1000;
 674         t.tv_usec = (login_delay % 1000) * 1000;
 675         timevalsub(&t, &delta);
 676         if (t.tv_sec >= 0 && t.tv_usec > 0)
 677                 ticks = (t.tv_sec * 1000 + t.tv_usec / 1000) * hz / 1000;
 678 SBP_DEBUG(0)
 679         printf("%s: sec = %jd usec = %ld ticks = %d\n", __func__,
 680             (intmax_t)t.tv_sec, t.tv_usec, ticks);
 681 END_DEBUG
 682         callout_reset(&sdev->login_callout, ticks,
 683                         sbp_login_callout, (void *)(sdev));
 684 }
 685
 686 #define SBP_FWDEV_ALIVE(fwdev) (((fwdev)->status == FWDEVATTACHED) \
 687         && crom_has_specver((fwdev)->csrrom, CSRVAL_ANSIT10, CSRVAL_T10SBP2))
 688
 689 static void
 690 sbp_probe_target(void *arg)
 691 {
 692         struct sbp_target *target = (struct sbp_target *)arg;
 693         struct sbp_softc *sbp = target->sbp;
 694         struct sbp_dev *sdev;
 695         int i, alive;
 696
 697         alive = SBP_FWDEV_ALIVE(target->fwdev);
 698 SBP_DEBUG(1)
 699         device_printf(sbp->fd.dev, "%s %d%salive\n",
 700                  __func__, target->target_id,
 701                 (!alive) ? " not " : "");
 702 END_DEBUG
 703
 704         sbp = target->sbp;
 705         SBP_LOCK_ASSERT(sbp);
 706         sbp_alloc_lun(target);
 707
 708         /* XXX untimeout mgm_ocb and dequeue */
 709         for (i=0; i < target->num_lun; i++) {
 710                 sdev = target->luns[i];
 711                 if (sdev == NULL)
 712                         continue;
 713                 if (alive && (sdev->status != SBP_DEV_DEAD)) {
 714                         if (sdev->path != NULL) {
 715                                 xpt_freeze_devq(sdev->path, 1);
 716                                 sdev->freeze++;
 717                         }
 718                         sbp_probe_lun(sdev);
 719                         sbp_show_sdev_info(sdev);
 720
 721                         sbp_abort_all_ocbs(sdev, CAM_SCSI_BUS_RESET);
 722                         switch (sdev->status) {
 723                         case SBP_DEV_RESET:
 724                                 /* new or revived target */
 725                                 if (auto_login)
 726                                         sbp_login(sdev);
 727                                 break;
 728                         case SBP_DEV_TOATTACH:
 729                         case SBP_DEV_PROBE:
 730                         case SBP_DEV_ATTACHED:
 731                         case SBP_DEV_RETRY:
 732                         default:
 733                                 sbp_mgm_orb(sdev, ORB_FUN_RCN, NULL);
 734                                 break;
 735                         }
 736                 } else {
 737                         switch (sdev->status) {
 738                         case SBP_DEV_ATTACHED:
 739 SBP_DEBUG(0)
 740                                 /* the device has gone */
 741                                 device_printf(sbp->fd.dev, "%s: lost target\n",
 742                                         __func__);
 743 END_DEBUG
 744                                 if (sdev->path) {
 745                                         xpt_freeze_devq(sdev->path, 1);
 746                                         sdev->freeze++;
 747                                 }
 748                                 sdev->status = SBP_DEV_RETRY;
 749                                 sbp_cam_detach_sdev(sdev);
 750                                 sbp_free_sdev(sdev);
 751                                 target->luns[i] = NULL;
 752                                 break;
 753                         case SBP_DEV_PROBE:
 754                         case SBP_DEV_TOATTACH:
 755                                 sdev->status = SBP_DEV_RESET;
 756                                 break;
 757                         case SBP_DEV_RETRY:
 758                         case SBP_DEV_RESET:
 759                         case SBP_DEV_DEAD:
 760                                 break;
 761                         }
 762                 }
 763         }
 764 }
 765
 766 static void
 767 sbp_post_busreset(void *arg)
 768 {
 769         struct sbp_softc *sbp;
 770
 771         sbp = (struct sbp_softc *)arg;
 772 SBP_DEBUG(0)
 773         printf("sbp_post_busreset\n");
 774 END_DEBUG
 775         SBP_LOCK(sbp);
 776         if ((sbp->sim->flags & SIMQ_FREEZED) == 0) {
 777                 xpt_freeze_simq(sbp->sim, /*count*/1);
 778                 sbp->sim->flags |= SIMQ_FREEZED;
 779         }
 780         microtime(&sbp->last_busreset);
 781         SBP_UNLOCK(sbp);
 782 }
 783
 784 static void
 785 sbp_post_explore(void *arg)
 786 {
 787         struct sbp_softc *sbp = (struct sbp_softc *)arg;
 788         struct sbp_target *target;
 789         struct fw_device *fwdev;
 790         int i, alive;
 791
 792 SBP_DEBUG(0)
 793         printf("sbp_post_explore (sbp_cold=%d)\n", sbp_cold);
 794 END_DEBUG
 795         /* We need physical access */
 796         if (!firewire_phydma_enable)
 797                 return;
 798
 799         if (sbp_cold > 0)
 800                 sbp_cold--;
 801
 802         SBP_LOCK(sbp);
 803 #if 0
 804         /*
 805          * XXX don't let CAM the bus rest.
 806          * CAM tries to do something with freezed (DEV_RETRY) devices.
 807          */
 808         xpt_async(AC_BUS_RESET, sbp->path, /*arg*/ NULL);
 809 #endif
 810
 811         /* Garbage Collection */
 812         for (i = 0; i < SBP_NUM_TARGETS; i++) {
 813                 target = &sbp->targets[i];
 814                 STAILQ_FOREACH(fwdev, &sbp->fd.fc->devices, link)
 815                         if (target->fwdev == NULL || target->fwdev == fwdev)
 816                                 break;
 817                 if (fwdev == NULL) {
 818                         /* device has removed in lower driver */
 819                         sbp_cam_detach_target(target);
 820                         sbp_free_target(target);
 821                 }
 822         }
 823         /* traverse device list */
 824         STAILQ_FOREACH(fwdev, &sbp->fd.fc->devices, link) {
 825 SBP_DEBUG(0)
 826                 device_printf(sbp->fd.dev,"%s:: EUI:%08x%08x %s attached, state=%d\n",
 827                                 __func__, fwdev->eui.hi, fwdev->eui.lo,
 828                                 (fwdev->status != FWDEVATTACHED) ? "not" : "",
 829                                 fwdev->status);
 830 END_DEBUG
 831                 alive = SBP_FWDEV_ALIVE(fwdev);
 832                 for (i = 0; i < SBP_NUM_TARGETS; i++) {
 833                         target = &sbp->targets[i];
 834                         if (target->fwdev == fwdev) {
 835                                 /* known target */
 836                                 break;
 837                         }
 838                 }
 839                 if (i == SBP_NUM_TARGETS) {
 840                         if (alive) {
 841                                 /* new target */
 842                                 target = sbp_alloc_target(sbp, fwdev);
 843                                 if (target == NULL)
 844                                         continue;
 845                         } else {
 846                                 continue;
 847                         }
 848                 }
 849                 sbp_probe_target((void *)target);
 850                 if (target->num_lun == 0)
 851                         sbp_free_target(target);
 852         }
 853         xpt_release_simq(sbp->sim, /*run queue*/TRUE);
 854         sbp->sim->flags &= ~SIMQ_FREEZED;
 855         SBP_UNLOCK(sbp);
 856 }
 857
 858 #if NEED_RESPONSE
 859 static void
 860 sbp_loginres_callback(struct fw_xfer *xfer)
 861 {
 862         struct sbp_dev *sdev;
 863         sdev = (struct sbp_dev *)xfer->sc;
 864 SBP_DEBUG(1)
 865         device_printf(sdev->target->sbp->fd.dev,"%s\n", __func__);
 866 END_DEBUG
 867         /* recycle */
 868         SBP_LOCK(sdev->target->sbp);
 869         STAILQ_INSERT_TAIL(&sdev->target->sbp->fwb.xferlist, xfer, link);
 870         SBP_UNLOCK(sdev->target->sbp);
 871         return;
 872 }
 873 #endif
 874
 875 static __inline void
 876 sbp_xfer_free(struct fw_xfer *xfer)
 877 {
 878         struct sbp_dev *sdev;
 879
 880         sdev = (struct sbp_dev *)xfer->sc;
 881         fw_xfer_unload(xfer);
 882         SBP_LOCK_ASSERT(sdev->target->sbp);
 883         STAILQ_INSERT_TAIL(&sdev->target->xferlist, xfer, link);
 884 }
 885
 886 static void
 887 sbp_reset_start_callback(struct fw_xfer *xfer)
 888 {
 889         struct sbp_dev *tsdev, *sdev = (struct sbp_dev *)xfer->sc;
 890         struct sbp_target *target = sdev->target;
 891         int i;
 892
 893         if (xfer->resp != 0) {
 894                 device_printf(sdev->target->sbp->fd.dev,
 895                         "%s: %s failed: resp=%d\n", __func__, sdev->bustgtlun, xfer->resp);
 896         }
 897
 898         SBP_LOCK(target->sbp);
 899         for (i = 0; i < target->num_lun; i++) {
 900                 tsdev = target->luns[i];
 901                 if (tsdev != NULL && tsdev->status == SBP_DEV_LOGIN)
 902                         sbp_login(tsdev);
 903         }
 904         SBP_UNLOCK(target->sbp);
 905 }
 906
 907 static void
 908 sbp_reset_start(struct sbp_dev *sdev)
 909 {
 910         struct fw_xfer *xfer;
 911         struct fw_pkt *fp;
 912
 913 SBP_DEBUG(0)
 914         device_printf(sdev->target->sbp->fd.dev,
 915                         "%s:%s\n", __func__,sdev->bustgtlun);
 916 END_DEBUG
 917
 918         xfer = sbp_write_cmd(sdev, FWTCODE_WREQQ, 0);
 919         xfer->hand = sbp_reset_start_callback;
 920         fp = &xfer->send.hdr;
 921         fp->mode.wreqq.dest_hi = 0xffff;
 922         fp->mode.wreqq.dest_lo = 0xf0000000 | RESET_START;
 923         fp->mode.wreqq.data = htonl(0xf);
 924         fw_asyreq(xfer->fc, -1, xfer);
 925 }
 926
 927 static void
 928 sbp_mgm_callback(struct fw_xfer *xfer)
 929 {
 930         struct sbp_dev *sdev;
 931         int resp;
 932
 933         sdev = (struct sbp_dev *)xfer->sc;
 934
 935 SBP_DEBUG(1)
 936         device_printf(sdev->target->sbp->fd.dev,
 937                 "%s:%s\n", __func__, sdev->bustgtlun);
 938 END_DEBUG
 939         resp = xfer->resp;
 940         SBP_LOCK(sdev->target->sbp);
 941         sbp_xfer_free(xfer);
 942         SBP_UNLOCK(sdev->target->sbp);
 943 }
 944
 945 static struct sbp_dev *
 946 sbp_next_dev(struct sbp_target *target, int lun)
 947 {
 948         struct sbp_dev **sdevp;
 949         int i;
 950
 951         for (i = lun, sdevp = &target->luns[lun]; i < target->num_lun;
 952             i++, sdevp++)
 953                 if (*sdevp != NULL && (*sdevp)->status == SBP_DEV_PROBE)
 954                         return (*sdevp);
 955         return (NULL);
 956 }
 957
 958 #define SCAN_PRI 1
 959 static void
 960 sbp_cam_scan_lun(struct cam_periph *periph, union ccb *ccb)
 961 {
 962         struct sbp_target *target;
 963         struct sbp_dev *sdev;
 964
 965         sdev = (struct sbp_dev *) ccb->ccb_h.ccb_sdev_ptr;
 966         target = sdev->target;
 967         SBP_LOCK_ASSERT(target->sbp);
 968 SBP_DEBUG(0)
 969         device_printf(sdev->target->sbp->fd.dev,
 970                 "%s:%s\n", __func__, sdev->bustgtlun);
 971 END_DEBUG
 972         if ((ccb->ccb_h.status & CAM_STATUS_MASK) == CAM_REQ_CMP) {
 973                 sdev->status = SBP_DEV_ATTACHED;
 974         } else {
 975                 device_printf(sdev->target->sbp->fd.dev,
 976                         "%s:%s failed\n", __func__, sdev->bustgtlun);
 977         }
 978         sdev = sbp_next_dev(target, sdev->lun_id + 1);
 979         if (sdev == NULL) {
 980                 free(ccb, M_SBP);
 981                 return;
 982         }
 983         /* reuse ccb */
 984         xpt_setup_ccb(&ccb->ccb_h, sdev->path, SCAN_PRI);
 985         ccb->ccb_h.ccb_sdev_ptr = sdev;
 986         xpt_action(ccb);
 987         xpt_release_devq(sdev->path, sdev->freeze, TRUE);
 988         sdev->freeze = 1;
 989 }
 990
 991 static void
 992 sbp_cam_scan_target(void *arg)
 993 {
 994         struct sbp_target *target = (struct sbp_target *)arg;
 995         struct sbp_dev *sdev;
 996         union ccb *ccb;
 997
 998         SBP_LOCK_ASSERT(target->sbp);
 999         sdev = sbp_next_dev(target, 0);
1000         if (sdev == NULL) {
1001                 printf("sbp_cam_scan_target: nothing to do for target%d\n",
1002                                                         target->target_id);
1003                 return;
1004         }
1005 SBP_DEBUG(0)
1006         device_printf(sdev->target->sbp->fd.dev,
1007                 "%s:%s\n", __func__, sdev->bustgtlun);
1008 END_DEBUG
1009         ccb = malloc(sizeof(union ccb), M_SBP, M_NOWAIT | M_ZERO);
1010         if (ccb == NULL) {
1011                 printf("sbp_cam_scan_target: malloc failed\n");
1012                 return;
1013         }
1014         xpt_setup_ccb(&ccb->ccb_h, sdev->path, SCAN_PRI);
1015         ccb->ccb_h.func_code = XPT_SCAN_LUN;
1016         ccb->ccb_h.cbfcnp = sbp_cam_scan_lun;
1017         ccb->ccb_h.flags |= CAM_DEV_QFREEZE;
1018         ccb->crcn.flags = CAM_FLAG_NONE;
1019         ccb->ccb_h.ccb_sdev_ptr = sdev;
1020
1021         /* The scan is in progress now. */
1022         xpt_action(ccb);
1023         xpt_release_devq(sdev->path, sdev->freeze, TRUE);
1024         sdev->freeze = 1;
1025 }
1026
1027 static __inline void
1028 sbp_scan_dev(struct sbp_dev *sdev)
1029 {
1030         sdev->status = SBP_DEV_PROBE;
1031         callout_reset_sbt(&sdev->target->scan_callout, SBT_1MS * scan_delay, 0,
1032             sbp_cam_scan_target, (void *)sdev->target, 0);
1033 }
1034
1035 static void
1036 sbp_do_attach(struct fw_xfer *xfer)
1037 {
1038         struct sbp_dev *sdev;
1039         struct sbp_target *target;
1040         struct sbp_softc *sbp;
1041
1042         sdev = (struct sbp_dev *)xfer->sc;
1043         target = sdev->target;
1044         sbp = target->sbp;
1045         SBP_LOCK(sbp);
1046 SBP_DEBUG(0)
1047         device_printf(sdev->target->sbp->fd.dev,
1048                 "%s:%s\n", __func__, sdev->bustgtlun);
1049 END_DEBUG
1050         sbp_xfer_free(xfer);
1051
1052         if (sdev->path == NULL)
1053                 xpt_create_path(&sdev->path, NULL,
1054                         cam_sim_path(target->sbp->sim),
1055                         target->target_id, sdev->lun_id);
1056
1057         /*
1058          * Let CAM scan the bus if we are in the boot process.
1059          * XXX xpt_scan_bus cannot detect LUN larger than 0
1060          * if LUN 0 doesn't exist.
1061          */
1062         if (sbp_cold > 0) {
1063                 sdev->status = SBP_DEV_ATTACHED;
1064                 SBP_UNLOCK(sbp);
1065                 return;
1066         }
1067
1068         sbp_scan_dev(sdev);
1069         SBP_UNLOCK(sbp);
1070 }
1071
1072 static void
1073 sbp_agent_reset_callback(struct fw_xfer *xfer)
1074 {
1075         struct sbp_dev *sdev;
1076
1077         sdev = (struct sbp_dev *)xfer->sc;
1078 SBP_DEBUG(1)
1079         device_printf(sdev->target->sbp->fd.dev,
1080                         "%s:%s\n", __func__, sdev->bustgtlun);
1081 END_DEBUG
1082         if (xfer->resp != 0) {
1083                 device_printf(sdev->target->sbp->fd.dev,
1084                         "%s:%s resp=%d\n", __func__, sdev->bustgtlun, xfer->resp);
1085         }
1086
1087         SBP_LOCK(sdev->target->sbp);
1088         sbp_xfer_free(xfer);
1089         if (sdev->path) {
1090                 xpt_release_devq(sdev->path, sdev->freeze, TRUE);
1091                 sdev->freeze = 0;
1092         }
1093         SBP_UNLOCK(sdev->target->sbp);
1094 }
1095
1096 static void
1097 sbp_agent_reset(struct sbp_dev *sdev)
1098 {
1099         struct fw_xfer *xfer;
1100         struct fw_pkt *fp;
1101
1102         SBP_LOCK_ASSERT(sdev->target->sbp);
1103 SBP_DEBUG(0)
1104         device_printf(sdev->target->sbp->fd.dev,
1105                 "%s:%s\n", __func__, sdev->bustgtlun);
1106 END_DEBUG
1107         xfer = sbp_write_cmd(sdev, FWTCODE_WREQQ, 0x04);
1108         if (xfer == NULL)
1109                 return;
1110         if (sdev->status == SBP_DEV_ATTACHED || sdev->status == SBP_DEV_PROBE)
1111                 xfer->hand = sbp_agent_reset_callback;
1112         else
1113                 xfer->hand = sbp_do_attach;
1114         fp = &xfer->send.hdr;
1115         fp->mode.wreqq.data = htonl(0xf);
1116         fw_asyreq(xfer->fc, -1, xfer);
1117         sbp_abort_all_ocbs(sdev, CAM_BDR_SENT);
1118 }
1119
1120 static void
1121 sbp_busy_timeout_callback(struct fw_xfer *xfer)
1122 {
1123         struct sbp_dev *sdev;
1124
1125         sdev = (struct sbp_dev *)xfer->sc;
1126 SBP_DEBUG(1)
1127         device_printf(sdev->target->sbp->fd.dev,
1128                 "%s:%s\n", __func__, sdev->bustgtlun);
1129 END_DEBUG
1130         SBP_LOCK(sdev->target->sbp);
1131         sbp_xfer_free(xfer);
1132         sbp_agent_reset(sdev);
1133         SBP_UNLOCK(sdev->target->sbp);
1134 }
1135
1136 static void
1137 sbp_busy_timeout(struct sbp_dev *sdev)
1138 {
1139         struct fw_pkt *fp;
1140         struct fw_xfer *xfer;
1141 SBP_DEBUG(0)
1142         device_printf(sdev->target->sbp->fd.dev,
1143                 "%s:%s\n", __func__, sdev->bustgtlun);
1144 END_DEBUG
1145         xfer = sbp_write_cmd(sdev, FWTCODE_WREQQ, 0);
1146
1147         xfer->hand = sbp_busy_timeout_callback;
1148         fp = &xfer->send.hdr;
1149         fp->mode.wreqq.dest_hi = 0xffff;
1150         fp->mode.wreqq.dest_lo = 0xf0000000 | BUSY_TIMEOUT;
1151         fp->mode.wreqq.data = htonl((1 << (13 + 12)) | 0xf);
1152         fw_asyreq(xfer->fc, -1, xfer);
1153 }
1154
1155 static void
1156 sbp_orb_pointer_callback(struct fw_xfer *xfer)
1157 {
1158         struct sbp_dev *sdev;
1159         sdev = (struct sbp_dev *)xfer->sc;
1160
1161 SBP_DEBUG(2)
1162         device_printf(sdev->target->sbp->fd.dev,
1163                 "%s:%s\n", __func__, sdev->bustgtlun);
1164 END_DEBUG
1165         if (xfer->resp != 0) {
1166                 /* XXX */
1167                 printf("%s: xfer->resp = %d\n", __func__, xfer->resp);
1168         }
1169         SBP_LOCK(sdev->target->sbp);
1170         sbp_xfer_free(xfer);
1171
1172         sdev->flags &= ~ORB_POINTER_ACTIVE;
1173
1174         if ((sdev->flags & ORB_POINTER_NEED) != 0) {
1175                 struct sbp_ocb *ocb;
1176
1177                 sdev->flags &= ~ORB_POINTER_NEED;
1178                 ocb = STAILQ_FIRST(&sdev->ocbs);
1179                 if (ocb != NULL)
1180                         sbp_orb_pointer(sdev, ocb);
1181         }
1182         SBP_UNLOCK(sdev->target->sbp);
1183         return;
1184 }
1185
1186 static void
1187 sbp_orb_pointer(struct sbp_dev *sdev, struct sbp_ocb *ocb)
1188 {
1189         struct fw_xfer *xfer;
1190         struct fw_pkt *fp;
1191 SBP_DEBUG(1)
1192         device_printf(sdev->target->sbp->fd.dev,
1193                 "%s:%s 0x%08x\n",
1194                 __func__, sdev->bustgtlun,
1195                 (uint32_t)ocb->bus_addr);
1196 END_DEBUG
1197
1198         SBP_LOCK_ASSERT(sdev->target->sbp);
1199
1200         if ((sdev->flags & ORB_POINTER_ACTIVE) != 0) {
1201 SBP_DEBUG(0)
1202                 printf("%s: orb pointer active\n", __func__);
1203 END_DEBUG
1204                 sdev->flags |= ORB_POINTER_NEED;
1205                 return;
1206         }
1207
1208         sdev->flags |= ORB_POINTER_ACTIVE;
1209         xfer = sbp_write_cmd(sdev, FWTCODE_WREQB, 0x08);
1210         if (xfer == NULL)
1211                 return;
1212         xfer->hand = sbp_orb_pointer_callback;
1213
1214         fp = &xfer->send.hdr;
1215         fp->mode.wreqb.len = 8;
1216         fp->mode.wreqb.extcode = 0;
1217         xfer->send.payload[0] =
1218                 htonl(((sdev->target->sbp->fd.fc->nodeid | FWLOCALBUS) << 16));
1219         xfer->send.payload[1] = htonl((uint32_t)ocb->bus_addr);
1220
1221         if (fw_asyreq(xfer->fc, -1, xfer) != 0) {
1222                 sbp_xfer_free(xfer);
1223                 ocb->ccb->ccb_h.status = CAM_REQ_INVALID;
1224                 xpt_done(ocb->ccb);
1225         }
1226 }
1227
1228 static void
1229 sbp_doorbell_callback(struct fw_xfer *xfer)
1230 {
1231         struct sbp_dev *sdev;
1232         sdev = (struct sbp_dev *)xfer->sc;
1233
1234 SBP_DEBUG(1)
1235         device_printf(sdev->target->sbp->fd.dev,
1236                 "%s:%s\n", __func__, sdev->bustgtlun);
1237 END_DEBUG
1238         if (xfer->resp != 0) {
1239                 /* XXX */
1240                 device_printf(sdev->target->sbp->fd.dev,
1241                         "%s: xfer->resp = %d\n", __func__, xfer->resp);
1242         }
1243         SBP_LOCK(sdev->target->sbp);
1244         sbp_xfer_free(xfer);
1245         sdev->flags &= ~ORB_DOORBELL_ACTIVE;
1246         if ((sdev->flags & ORB_DOORBELL_NEED) != 0) {
1247                 sdev->flags &= ~ORB_DOORBELL_NEED;
1248                 sbp_doorbell(sdev);
1249         }
1250         SBP_UNLOCK(sdev->target->sbp);
1251 }
1252
1253 static void
1254 sbp_doorbell(struct sbp_dev *sdev)
1255 {
1256         struct fw_xfer *xfer;
1257         struct fw_pkt *fp;
1258 SBP_DEBUG(1)
1259         device_printf(sdev->target->sbp->fd.dev,
1260                 "%s:%s\n", __func__, sdev->bustgtlun);
1261 END_DEBUG
1262
1263         if ((sdev->flags & ORB_DOORBELL_ACTIVE) != 0) {
1264                 sdev->flags |= ORB_DOORBELL_NEED;
1265                 return;
1266         }
1267         sdev->flags |= ORB_DOORBELL_ACTIVE;
1268         xfer = sbp_write_cmd(sdev, FWTCODE_WREQQ, 0x10);
1269         if (xfer == NULL)
1270                 return;
1271         xfer->hand = sbp_doorbell_callback;
1272         fp = &xfer->send.hdr;
1273         fp->mode.wreqq.data = htonl(0xf);
1274         fw_asyreq(xfer->fc, -1, xfer);
1275 }
1276
1277 static struct fw_xfer *
1278 sbp_write_cmd(struct sbp_dev *sdev, int tcode, int offset)
1279 {
1280         struct fw_xfer *xfer;
1281         struct fw_pkt *fp;
1282         struct sbp_target *target;
1283         int new = 0;
1284
1285         SBP_LOCK_ASSERT(sdev->target->sbp);
1286
1287         target = sdev->target;
1288         xfer = STAILQ_FIRST(&target->xferlist);
1289         if (xfer == NULL) {
1290                 if (target->n_xfer > 5 /* XXX */) {
1291                         printf("sbp: no more xfer for this target\n");
1292                         return (NULL);
1293                 }
1294                 xfer = fw_xfer_alloc_buf(M_SBP, 8, 0);
1295                 if (xfer == NULL) {
1296                         printf("sbp: fw_xfer_alloc_buf failed\n");
1297                         return NULL;
1298                 }
1299                 target->n_xfer++;
1300                 if (debug)
1301                         printf("sbp: alloc %d xfer\n", target->n_xfer);
1302                 new = 1;
1303         } else {
1304                 STAILQ_REMOVE_HEAD(&target->xferlist, link);
1305         }
1306
1307         if (new) {
1308                 xfer->recv.pay_len = 0;
1309                 xfer->send.spd = min(sdev->target->fwdev->speed, max_speed);
1310                 xfer->fc = sdev->target->sbp->fd.fc;
1311         }
1312
1313         if (tcode == FWTCODE_WREQB)
1314                 xfer->send.pay_len = 8;
1315         else
1316                 xfer->send.pay_len = 0;
1317
1318         xfer->sc = (caddr_t)sdev;
1319         fp = &xfer->send.hdr;
1320         fp->mode.wreqq.dest_hi = sdev->login->cmd_hi;
1321         fp->mode.wreqq.dest_lo = sdev->login->cmd_lo + offset;
1322         fp->mode.wreqq.tlrt = 0;
1323         fp->mode.wreqq.tcode = tcode;
1324         fp->mode.wreqq.pri = 0;
1325         fp->mode.wreqq.dst = FWLOCALBUS | sdev->target->fwdev->dst;
1326
1327         return xfer;
1328 }
1329
1330 static void
1331 sbp_mgm_orb(struct sbp_dev *sdev, int func, struct sbp_ocb *aocb)
1332 {
1333         struct fw_xfer *xfer;
1334         struct fw_pkt *fp;
1335         struct sbp_ocb *ocb;
1336         struct sbp_target *target;
1337         int nid;
1338
1339         target = sdev->target;
1340         nid = target->sbp->fd.fc->nodeid | FWLOCALBUS;
1341
1342         SBP_LOCK_ASSERT(target->sbp);
1343         if (func == ORB_FUN_RUNQUEUE) {
1344                 ocb = STAILQ_FIRST(&target->mgm_ocb_queue);
1345                 if (target->mgm_ocb_cur != NULL || ocb == NULL) {
1346                         return;
1347                 }
1348                 STAILQ_REMOVE_HEAD(&target->mgm_ocb_queue, ocb);
1349                 goto start;
1350         }
1351         if ((ocb = sbp_get_ocb(sdev)) == NULL) {
1352                 /* XXX */
1353                 return;
1354         }
1355         ocb->flags = OCB_ACT_MGM;
1356         ocb->sdev = sdev;
1357
1358         bzero((void *)ocb->orb, sizeof(ocb->orb));
1359         ocb->orb[6] = htonl((nid << 16) | SBP_BIND_HI);
1360         ocb->orb[7] = htonl(SBP_DEV2ADDR(target->target_id, sdev->lun_id));
1361
1362 SBP_DEBUG(0)
1363         device_printf(sdev->target->sbp->fd.dev,
1364                  "%s:%s %s\n",
1365                  __func__,sdev->bustgtlun,
1366                  orb_fun_name[(func >> 16) & 0xf]);
1367 END_DEBUG
1368         switch (func) {
1369         case ORB_FUN_LGI:
1370                 ocb->orb[0] = ocb->orb[1] = 0; /* password */
1371                 ocb->orb[2] = htonl(nid << 16);
1372                 ocb->orb[3] = htonl(sdev->dma.bus_addr);
1373                 ocb->orb[4] = htonl(ORB_NOTIFY | sdev->lun_id);
1374                 if (ex_login)
1375                         ocb->orb[4] |= htonl(ORB_EXV);
1376                 ocb->orb[5] = htonl(SBP_LOGIN_SIZE);
1377                 fwdma_sync(&sdev->dma, BUS_DMASYNC_PREREAD);
1378                 break;
1379         case ORB_FUN_ATA:
1380                 ocb->orb[0] = htonl((0 << 16) | 0);
1381                 ocb->orb[1] = htonl(aocb->bus_addr & 0xffffffff);
1382                 /* fall through */
1383         case ORB_FUN_RCN:
1384         case ORB_FUN_LGO:
1385         case ORB_FUN_LUR:
1386         case ORB_FUN_RST:
1387         case ORB_FUN_ATS:
1388                 ocb->orb[4] = htonl(ORB_NOTIFY | func | sdev->login->id);
1389                 break;
1390         }
1391
1392         if (target->mgm_ocb_cur != NULL) {
1393                 /* there is a standing ORB */
1394                 STAILQ_INSERT_TAIL(&sdev->target->mgm_ocb_queue, ocb, ocb);
1395                 return;
1396         }
1397 start:
1398         target->mgm_ocb_cur = ocb;
1399
1400         callout_reset(&target->mgm_ocb_timeout, 5 * hz,
1401                                 sbp_mgm_timeout, (caddr_t)ocb);
1402         xfer = sbp_write_cmd(sdev, FWTCODE_WREQB, 0);
1403         if (xfer == NULL) {
1404                 return;
1405         }
1406         xfer->hand = sbp_mgm_callback;
1407
1408         fp = &xfer->send.hdr;
1409         fp->mode.wreqb.dest_hi = sdev->target->mgm_hi;
1410         fp->mode.wreqb.dest_lo = sdev->target->mgm_lo;
1411         fp->mode.wreqb.len = 8;
1412         fp->mode.wreqb.extcode = 0;
1413         xfer->send.payload[0] = htonl(nid << 16);
1414         xfer->send.payload[1] = htonl(ocb->bus_addr & 0xffffffff);
1415
1416         fw_asyreq(xfer->fc, -1, xfer);
1417 }
1418
1419 static void
1420 sbp_print_scsi_cmd(struct sbp_ocb *ocb)
1421 {
1422         struct ccb_scsiio *csio;
1423
1424         csio = &ocb->ccb->csio;
1425         printf("%s:%d:%jx XPT_SCSI_IO: "
1426                 "cmd: %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x"
1427                 ", flags: 0x%02x, "
1428                 "%db cmd/%db data/%db sense\n",
1429                 device_get_nameunit(ocb->sdev->target->sbp->fd.dev),
1430                 ocb->ccb->ccb_h.target_id,
1431                 (uintmax_t)ocb->ccb->ccb_h.target_lun,
1432                 csio->cdb_io.cdb_bytes[0],
1433                 csio->cdb_io.cdb_bytes[1],
1434                 csio->cdb_io.cdb_bytes[2],
1435                 csio->cdb_io.cdb_bytes[3],
1436                 csio->cdb_io.cdb_bytes[4],
1437                 csio->cdb_io.cdb_bytes[5],
1438                 csio->cdb_io.cdb_bytes[6],
1439                 csio->cdb_io.cdb_bytes[7],
1440                 csio->cdb_io.cdb_bytes[8],
1441                 csio->cdb_io.cdb_bytes[9],
1442                 ocb->ccb->ccb_h.flags & CAM_DIR_MASK,
1443                 csio->cdb_len, csio->dxfer_len,
1444                 csio->sense_len);
1445 }
1446
1447 static void
1448 sbp_scsi_status(struct sbp_status *sbp_status, struct sbp_ocb *ocb)
1449 {
1450         struct sbp_cmd_status *sbp_cmd_status;
1451         struct scsi_sense_data_fixed *sense;
1452
1453         sbp_cmd_status = (struct sbp_cmd_status *)sbp_status->data;
1454         sense = (struct scsi_sense_data_fixed *)&ocb->ccb->csio.sense_data;
1455
1456 SBP_DEBUG(0)
1457         sbp_print_scsi_cmd(ocb);
1458         /* XXX need decode status */
1459         printf("%s: SCSI status %x sfmt %x valid %x key %x code %x qlfr %x len %d\n",
1460                 ocb->sdev->bustgtlun,
1461                 sbp_cmd_status->status,
1462                 sbp_cmd_status->sfmt,
1463                 sbp_cmd_status->valid,
1464                 sbp_cmd_status->s_key,
1465                 sbp_cmd_status->s_code,
1466                 sbp_cmd_status->s_qlfr,
1467                 sbp_status->len);
1468 END_DEBUG
1469
1470         switch (sbp_cmd_status->status) {
1471         case SCSI_STATUS_CHECK_COND:
1472         case SCSI_STATUS_BUSY:
1473         case SCSI_STATUS_CMD_TERMINATED:
1474                 if (sbp_cmd_status->sfmt == SBP_SFMT_CURR) {
1475                         sense->error_code = SSD_CURRENT_ERROR;
1476                 } else {
1477                         sense->error_code = SSD_DEFERRED_ERROR;
1478                 }
1479                 if (sbp_cmd_status->valid)
1480                         sense->error_code |= SSD_ERRCODE_VALID;
1481                 sense->flags = sbp_cmd_status->s_key;
1482                 if (sbp_cmd_status->mark)
1483                         sense->flags |= SSD_FILEMARK;
1484                 if (sbp_cmd_status->eom)
1485                         sense->flags |= SSD_EOM;
1486                 if (sbp_cmd_status->ill_len)
1487                         sense->flags |= SSD_ILI;
1488
1489                 bcopy(&sbp_cmd_status->info, &sense->info[0], 4);
1490
1491                 if (sbp_status->len <= 1)
1492                         /* XXX not scsi status. shouldn't be happened */
1493                         sense->extra_len = 0;
1494                 else if (sbp_status->len <= 4)
1495                         /* add_sense_code(_qual), info, cmd_spec_info */
1496                         sense->extra_len = 6;
1497                 else
1498                         /* fru, sense_key_spec */
1499                         sense->extra_len = 10;
1500
1501                 bcopy(&sbp_cmd_status->cdb, &sense->cmd_spec_info[0], 4);
1502
1503                 sense->add_sense_code = sbp_cmd_status->s_code;
1504                 sense->add_sense_code_qual = sbp_cmd_status->s_qlfr;
1505                 sense->fru = sbp_cmd_status->fru;
1506
1507                 bcopy(&sbp_cmd_status->s_keydep[0],
1508                     &sense->sense_key_spec[0], 3);
1509
1510                 ocb->ccb->csio.scsi_status = sbp_cmd_status->status;
1511                 ocb->ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR
1512                                                         | CAM_AUTOSNS_VALID;
1513 /*
1514 {
1515                 uint8_t j, *tmp;
1516                 tmp = sense;
1517                 for (j = 0; j < 32; j += 8) {
1518                         printf("sense %02x%02x %02x%02x %02x%02x %02x%02x\n",
1519                                 tmp[j], tmp[j + 1], tmp[j + 2], tmp[j + 3],
1520                                 tmp[j + 4], tmp[j + 5], tmp[j + 6], tmp[j + 7]);
1521                 }
1522
1523 }
1524 */
1525                 break;
1526         default:
1527                 device_printf(ocb->sdev->target->sbp->fd.dev,
1528                                 "%s:%s unknown scsi status 0x%x\n",
1529                                 __func__, ocb->sdev->bustgtlun,
1530                                 sbp_cmd_status->status);
1531         }
1532 }
1533
1534 static void
1535 sbp_fix_inq_data(struct sbp_ocb *ocb)
1536 {
1537         union ccb *ccb;
1538         struct sbp_dev *sdev;
1539         struct scsi_inquiry_data *inq;
1540
1541         ccb = ocb->ccb;
1542         sdev = ocb->sdev;
1543
1544         if (ccb->csio.cdb_io.cdb_bytes[1] & SI_EVPD)
1545                 return;
1546 SBP_DEBUG(1)
1547         device_printf(sdev->target->sbp->fd.dev,
1548                 "%s:%s\n", __func__, sdev->bustgtlun);
1549 END_DEBUG
1550         inq = (struct scsi_inquiry_data *) ccb->csio.data_ptr;
1551         switch (SID_TYPE(inq)) {
1552         case T_DIRECT:
1553 #if 0
1554                 /*
1555                  * XXX Convert Direct Access device to RBC.
1556                  * I've never seen FireWire DA devices which support READ_6.
1557                  */
1558                 if (SID_TYPE(inq) == T_DIRECT)
1559                         inq->device |= T_RBC; /*  T_DIRECT == 0 */
1560 #endif
1561                 /* fall through */
1562         case T_RBC:
1563                 /*
1564                  * Override vendor/product/revision information.
1565                  * Some devices sometimes return strange strings.
1566                  */
1567 #if 1
1568                 bcopy(sdev->vendor, inq->vendor, sizeof(inq->vendor));
1569                 bcopy(sdev->product, inq->product, sizeof(inq->product));
1570                 bcopy(sdev->revision + 2, inq->revision, sizeof(inq->revision));
1571 #endif
1572                 break;
1573         }
1574         /*
1575          * Force to enable/disable tagged queuing.
1576          * XXX CAM also checks SCP_QUEUE_DQUE flag in the control mode page.
1577          */
1578         if (sbp_tags > 0)
1579                 inq->flags |= SID_CmdQue;
1580         else if (sbp_tags < 0)
1581                 inq->flags &= ~SID_CmdQue;
1582
1583 }
1584
1585 static void
1586 sbp_recv1(struct fw_xfer *xfer)
1587 {
1588         struct fw_pkt *rfp;
1589 #if NEED_RESPONSE
1590         struct fw_pkt *sfp;
1591 #endif
1592         struct sbp_softc *sbp;
1593         struct sbp_dev *sdev;
1594         struct sbp_ocb *ocb;
1595         struct sbp_login_res *login_res = NULL;
1596         struct sbp_status *sbp_status;
1597         struct sbp_target *target;
1598         int     orb_fun, status_valid0, status_valid, t, l, reset_agent = 0;
1599         uint32_t addr;
1600 /*
1601         uint32_t *ld;
1602         ld = xfer->recv.buf;
1603 printf("sbp %x %d %d %08x %08x %08x %08x\n",
1604                         xfer->resp, xfer->recv.len, xfer->recv.off, ntohl(ld[0]), ntohl(ld[1]), ntohl(ld[2]), ntohl(ld[3]));
1605 printf("sbp %08x %08x %08x %08x\n", ntohl(ld[4]), ntohl(ld[5]), ntohl(ld[6]), ntohl(ld[7]));
1606 printf("sbp %08x %08x %08x %08x\n", ntohl(ld[8]), ntohl(ld[9]), ntohl(ld[10]), ntohl(ld[11]));
1607 */
1608         sbp = (struct sbp_softc *)xfer->sc;
1609         SBP_LOCK_ASSERT(sbp);
1610         if (xfer->resp != 0) {
1611                 printf("sbp_recv: xfer->resp = %d\n", xfer->resp);
1612                 goto done0;
1613         }
1614         if (xfer->recv.payload == NULL) {
1615                 printf("sbp_recv: xfer->recv.payload == NULL\n");
1616                 goto done0;
1617         }
1618         rfp = &xfer->recv.hdr;
1619         if (rfp->mode.wreqb.tcode != FWTCODE_WREQB) {
1620                 printf("sbp_recv: tcode = %d\n", rfp->mode.wreqb.tcode);
1621                 goto done0;
1622         }
1623         sbp_status = (struct sbp_status *)xfer->recv.payload;
1624         addr = rfp->mode.wreqb.dest_lo;
1625 SBP_DEBUG(2)
1626         printf("received address 0x%x\n", addr);
1627 END_DEBUG
1628         t = SBP_ADDR2TRG(addr);
1629         if (t >= SBP_NUM_TARGETS) {
1630                 device_printf(sbp->fd.dev,
1631                         "sbp_recv1: invalid target %d\n", t);
1632                 goto done0;
1633         }
1634         target = &sbp->targets[t];
1635         l = SBP_ADDR2LUN(addr);
1636         if (l >= target->num_lun || target->luns[l] == NULL) {
1637                 device_printf(sbp->fd.dev,
1638                         "sbp_recv1: invalid lun %d (target=%d)\n", l, t);
1639                 goto done0;
1640         }
1641         sdev = target->luns[l];
1642
1643         ocb = NULL;
1644         switch (sbp_status->src) {
1645         case 0:
1646         case 1:
1647                 /* check mgm_ocb_cur first */
1648                 ocb  = target->mgm_ocb_cur;
1649                 if (ocb != NULL) {
1650                         if (OCB_MATCH(ocb, sbp_status)) {
1651                                 callout_stop(&target->mgm_ocb_timeout);
1652                                 target->mgm_ocb_cur = NULL;
1653                                 break;
1654                         }
1655                 }
1656                 ocb = sbp_dequeue_ocb(sdev, sbp_status);
1657                 if (ocb == NULL) {
1658                         device_printf(sdev->target->sbp->fd.dev,
1659                                 "%s:%s No ocb(%x) on the queue\n",
1660                                 __func__,sdev->bustgtlun,
1661                                 ntohl(sbp_status->orb_lo));
1662                 }
1663                 break;
1664         case 2:
1665                 /* unsolicit */
1666                 device_printf(sdev->target->sbp->fd.dev,
1667                         "%s:%s unsolicit status received\n",
1668                         __func__, sdev->bustgtlun);
1669                 break;
1670         default:
1671                 device_printf(sdev->target->sbp->fd.dev,
1672                         "%s:%s unknown sbp_status->src\n",
1673                         __func__, sdev->bustgtlun);
1674         }
1675
1676         status_valid0 = (sbp_status->src < 2
1677                         && sbp_status->resp == ORB_RES_CMPL
1678                         && sbp_status->dead == 0);
1679         status_valid = (status_valid0 && sbp_status->status == 0);
1680
1681         if (!status_valid0 || debug > 2) {
1682                 int status;
1683 SBP_DEBUG(0)
1684                 device_printf(sdev->target->sbp->fd.dev,
1685                         "%s:%s ORB status src:%x resp:%x dead:%x"
1686                                 " len:%x stat:%x orb:%x%08x\n",
1687                         __func__, sdev->bustgtlun,
1688                         sbp_status->src, sbp_status->resp, sbp_status->dead,
1689                         sbp_status->len, sbp_status->status,
1690                         ntohs(sbp_status->orb_hi), ntohl(sbp_status->orb_lo));
1691 END_DEBUG
1692                 device_printf(sdev->target->sbp->fd.dev,
1693                                 "%s\n", sdev->bustgtlun);
1694                 status = sbp_status->status;
1695                 switch (sbp_status->resp) {
1696                 case 0:
1697                         if (status > MAX_ORB_STATUS0)
1698                                 printf("%s\n", orb_status0[MAX_ORB_STATUS0]);
1699                         else
1700                                 printf("%s\n", orb_status0[status]);
1701                         break;
1702                 case 1:
1703                         printf("Obj: %s, Error: %s\n",
1704                                 orb_status1_object[(status >> 6) & 3],
1705                                 orb_status1_serial_bus_error[status & 0xf]);
1706                         break;
1707                 case 2:
1708                         printf("Illegal request\n");
1709                         break;
1710                 case 3:
1711                         printf("Vendor dependent\n");
1712                         break;
1713                 default:
1714                         printf("unknown respose code %d\n", sbp_status->resp);
1715                 }
1716         }
1717
1718         /* we have to reset the fetch agent if it's dead */
1719         if (sbp_status->dead) {
1720                 if (sdev->path) {
1721                         xpt_freeze_devq(sdev->path, 1);
1722                         sdev->freeze++;
1723                 }
1724                 reset_agent = 1;
1725         }
1726
1727         if (ocb == NULL)
1728                 goto done;
1729
1730         switch (ntohl(ocb->orb[4]) & ORB_FMT_MSK) {
1731         case ORB_FMT_NOP:
1732                 break;
1733         case ORB_FMT_VED:
1734                 break;
1735         case ORB_FMT_STD:
1736                 switch (ocb->flags) {
1737                 case OCB_ACT_MGM:
1738                         orb_fun = ntohl(ocb->orb[4]) & ORB_FUN_MSK;
1739                         reset_agent = 0;
1740                         switch (orb_fun) {
1741                         case ORB_FUN_LGI:
1742                                 fwdma_sync(&sdev->dma, BUS_DMASYNC_POSTREAD);
1743                                 login_res = sdev->login;
1744                                 login_res->len = ntohs(login_res->len);
1745                                 login_res->id = ntohs(login_res->id);
1746                                 login_res->cmd_hi = ntohs(login_res->cmd_hi);
1747                                 login_res->cmd_lo = ntohl(login_res->cmd_lo);
1748                                 if (status_valid) {
1749 SBP_DEBUG(0)
1750                                         device_printf(sdev->target->sbp->fd.dev,
1751                                                 "%s:%s login: len %d, ID %d, cmd %08x%08x, recon_hold %d\n",
1752                                                 __func__, sdev->bustgtlun,
1753                                                 login_res->len, login_res->id,
1754                                                 login_res->cmd_hi, login_res->cmd_lo,
1755                                                 ntohs(login_res->recon_hold));
1756 END_DEBUG
1757                                         sbp_busy_timeout(sdev);
1758                                 } else {
1759                                         /* forgot logout? */
1760                                         device_printf(sdev->target->sbp->fd.dev,
1761                                                 "%s:%s login failed\n",
1762                                                 __func__, sdev->bustgtlun);
1763                                         sdev->status = SBP_DEV_RESET;
1764                                 }
1765                                 break;
1766                         case ORB_FUN_RCN:
1767                                 login_res = sdev->login;
1768                                 if (status_valid) {
1769 SBP_DEBUG(0)
1770                                         device_printf(sdev->target->sbp->fd.dev,
1771                                                 "%s:%s reconnect: len %d, ID %d, cmd %08x%08x\n",
1772                                                 __func__, sdev->bustgtlun,
1773                                                 login_res->len, login_res->id,
1774                                                 login_res->cmd_hi, login_res->cmd_lo);
1775 END_DEBUG
1776                                         if (sdev->status == SBP_DEV_ATTACHED)
1777                                                 sbp_scan_dev(sdev);
1778                                         else
1779                                                 sbp_agent_reset(sdev);
1780                                 } else {
1781                                         /* reconnection hold time exceed? */
1782 SBP_DEBUG(0)
1783                                         device_printf(sdev->target->sbp->fd.dev,
1784                                                 "%s:%s reconnect failed\n",
1785                                                 __func__, sdev->bustgtlun);
1786 END_DEBUG
1787                                         sbp_login(sdev);
1788                                 }
1789                                 break;
1790                         case ORB_FUN_LGO:
1791                                 sdev->status = SBP_DEV_RESET;
1792                                 break;
1793                         case ORB_FUN_RST:
1794                                 sbp_busy_timeout(sdev);
1795                                 break;
1796                         case ORB_FUN_LUR:
1797                         case ORB_FUN_ATA:
1798                         case ORB_FUN_ATS:
1799                                 sbp_agent_reset(sdev);
1800                                 break;
1801                         default:
1802                                 device_printf(sdev->target->sbp->fd.dev,
1803                                         "%s:%s unknown function %d\n",
1804                                         __func__, sdev->bustgtlun, orb_fun);
1805                                 break;
1806                         }
1807                         sbp_mgm_orb(sdev, ORB_FUN_RUNQUEUE, NULL);
1808                         break;
1809                 case OCB_ACT_CMD:
1810                         sdev->timeout = 0;
1811                         if (ocb->ccb != NULL) {
1812                                 union ccb *ccb;
1813
1814                                 ccb = ocb->ccb;
1815                                 if (sbp_status->len > 1) {
1816                                         sbp_scsi_status(sbp_status, ocb);
1817                                 } else {
1818                                         if (sbp_status->resp != ORB_RES_CMPL) {
1819                                                 ccb->ccb_h.status = CAM_REQ_CMP_ERR;
1820                                         } else {
1821                                                 ccb->ccb_h.status = CAM_REQ_CMP;
1822                                         }
1823                                 }
1824                                 /* fix up inq data */
1825                                 if (ccb->csio.cdb_io.cdb_bytes[0] == INQUIRY)
1826                                         sbp_fix_inq_data(ocb);
1827                                 xpt_done(ccb);
1828                         }
1829                         break;
1830                 default:
1831                         break;
1832                 }
1833         }
1834
1835         if (!use_doorbell)
1836                 sbp_free_ocb(sdev, ocb);
1837 done:
1838         if (reset_agent)
1839                 sbp_agent_reset(sdev);
1840
1841 done0:
1842         xfer->recv.pay_len = SBP_RECV_LEN;
1843 /* The received packet is usually small enough to be stored within
1844  * the buffer. In that case, the controller return ack_complete and
1845  * no respose is necessary.
1846  *
1847  * XXX fwohci.c and firewire.c should inform event_code such as
1848  * ack_complete or ack_pending to upper driver.
1849  */
1850 #if NEED_RESPONSE
1851         xfer->send.off = 0;
1852         sfp = (struct fw_pkt *)xfer->send.buf;
1853         sfp->mode.wres.dst = rfp->mode.wreqb.src;
1854         xfer->dst = sfp->mode.wres.dst;
1855         xfer->spd = min(sdev->target->fwdev->speed, max_speed);
1856         xfer->hand = sbp_loginres_callback;
1857
1858         sfp->mode.wres.tlrt = rfp->mode.wreqb.tlrt;
1859         sfp->mode.wres.tcode = FWTCODE_WRES;
1860         sfp->mode.wres.rtcode = 0;
1861         sfp->mode.wres.pri = 0;
1862
1863         fw_asyreq(xfer->fc, -1, xfer);
1864 #else
1865         /* recycle */
1866         STAILQ_INSERT_TAIL(&sbp->fwb.xferlist, xfer, link);
1867 #endif
1868 }
1869
1870 static void
1871 sbp_recv(struct fw_xfer *xfer)
1872 {
1873         struct sbp_softc *sbp;
1874
1875         sbp = (struct sbp_softc *)xfer->sc;
1876         SBP_LOCK(sbp);
1877         sbp_recv1(xfer);
1878         SBP_UNLOCK(sbp);
1879 }
1880 /*
1881  * sbp_attach()
1882  */
1883 static int
1884 sbp_attach(device_t dev)
1885 {
1886         struct sbp_softc *sbp;
1887         struct cam_devq *devq;
1888         struct firewire_comm *fc;
1889         int i, error;
1890
1891         if (DFLTPHYS > SBP_MAXPHYS)
1892                 device_printf(dev, "Warning, DFLTPHYS(%dKB) is larger than "
1893                         "SBP_MAXPHYS(%dKB).\n", DFLTPHYS / 1024,
1894                         SBP_MAXPHYS / 1024);
1895
1896         if (!firewire_phydma_enable)
1897                 device_printf(dev, "Warning, hw.firewire.phydma_enable must be 1 "
1898                         "for SBP over FireWire.\n");
1899 SBP_DEBUG(0)
1900         printf("sbp_attach (cold=%d)\n", cold);
1901 END_DEBUG
1902
1903         if (cold)
1904                 sbp_cold++;
1905         sbp = device_get_softc(dev);
1906         sbp->fd.dev = dev;
1907         sbp->fd.fc = fc = device_get_ivars(dev);
1908         mtx_init(&sbp->mtx, "sbp", NULL, MTX_DEF);
1909
1910         if (max_speed < 0)
1911                 max_speed = fc->speed;
1912
1913         error = bus_dma_tag_create(/*parent*/fc->dmat,
1914                                 /* XXX shoud be 4 for sane backend? */
1915                                 /*alignment*/1,
1916                                 /*boundary*/0,
1917                                 /*lowaddr*/BUS_SPACE_MAXADDR_32BIT,
1918                                 /*highaddr*/BUS_SPACE_MAXADDR,
1919                                 /*filter*/NULL, /*filterarg*/NULL,
1920                                 /*maxsize*/0x100000, /*nsegments*/SBP_IND_MAX,
1921                                 /*maxsegsz*/SBP_SEG_MAX,
1922                                 /*flags*/BUS_DMA_ALLOCNOW,
1923                                 /*lockfunc*/busdma_lock_mutex,
1924                                 /*lockarg*/&sbp->mtx,
1925                                 &sbp->dmat);
1926         if (error != 0) {
1927                 printf("sbp_attach: Could not allocate DMA tag "
1928                         "- error %d\n", error);
1929                         return (ENOMEM);
1930         }
1931
1932         devq = cam_simq_alloc(/*maxopenings*/SBP_NUM_OCB);
1933         if (devq == NULL)
1934                 return (ENXIO);
1935
1936         for (i = 0; i < SBP_NUM_TARGETS; i++) {
1937                 sbp->targets[i].fwdev = NULL;
1938                 sbp->targets[i].luns = NULL;
1939                 sbp->targets[i].sbp = sbp;
1940         }
1941
1942         sbp->sim = cam_sim_alloc(sbp_action, sbp_poll, "sbp", sbp,
1943                                  device_get_unit(dev),
1944                                  &sbp->mtx,
1945                                  /*untagged*/ 1,
1946                                  /*tagged*/ SBP_QUEUE_LEN - 1,
1947                                  devq);
1948
1949         if (sbp->sim == NULL) {
1950                 cam_simq_free(devq);
1951                 return (ENXIO);
1952         }
1953
1954         SBP_LOCK(sbp);
1955         if (xpt_bus_register(sbp->sim, dev, /*bus*/0) != CAM_SUCCESS)
1956                 goto fail;
1957
1958         if (xpt_create_path(&sbp->path, NULL, cam_sim_path(sbp->sim),
1959             CAM_TARGET_WILDCARD, CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
1960                 xpt_bus_deregister(cam_sim_path(sbp->sim));
1961                 goto fail;
1962         }
1963         SBP_UNLOCK(sbp);
1964
1965         /* We reserve 16 bit space (4 bytes X 64 targets X 256 luns) */
1966         sbp->fwb.start = ((u_int64_t)SBP_BIND_HI << 32) | SBP_DEV2ADDR(0, 0);
1967         sbp->fwb.end = sbp->fwb.start + 0xffff;
1968         /* pre-allocate xfer */
1969         STAILQ_INIT(&sbp->fwb.xferlist);
1970         fw_xferlist_add(&sbp->fwb.xferlist, M_SBP,
1971             /*send*/ 0, /*recv*/ SBP_RECV_LEN, SBP_NUM_OCB/2,
1972             fc, (void *)sbp, sbp_recv);
1973
1974         fw_bindadd(fc, &sbp->fwb);
1975
1976         sbp->fd.post_busreset = sbp_post_busreset;
1977         sbp->fd.post_explore = sbp_post_explore;
1978
1979         if (fc->status != -1) {
1980                 sbp_post_busreset((void *)sbp);
1981                 sbp_post_explore((void *)sbp);
1982         }
1983         SBP_LOCK(sbp);
1984         xpt_async(AC_BUS_RESET, sbp->path, /*arg*/ NULL);
1985         SBP_UNLOCK(sbp);
1986
1987         return (0);
1988 fail:
1989         SBP_UNLOCK(sbp);
1990         cam_sim_free(sbp->sim, /*free_devq*/TRUE);
1991         return (ENXIO);
1992 }
1993
1994 static int
1995 sbp_logout_all(struct sbp_softc *sbp)
1996 {
1997         struct sbp_target *target;
1998         struct sbp_dev *sdev;
1999         int i, j;
2000
2001 SBP_DEBUG(0)
2002         printf("sbp_logout_all\n");
2003 END_DEBUG
2004         SBP_LOCK_ASSERT(sbp);
2005         for (i = 0; i < SBP_NUM_TARGETS; i++) {
2006                 target = &sbp->targets[i];
2007                 if (target->luns == NULL)
2008                         continue;
2009                 for (j = 0; j < target->num_lun; j++) {
2010                         sdev = target->luns[j];
2011                         if (sdev == NULL)
2012                                 continue;
2013                         callout_stop(&sdev->login_callout);
2014                         if (sdev->status >= SBP_DEV_TOATTACH &&
2015                                         sdev->status <= SBP_DEV_ATTACHED)
2016                                 sbp_mgm_orb(sdev, ORB_FUN_LGO, NULL);
2017                 }
2018         }
2019
2020         return 0;
2021 }
2022
2023 static int
2024 sbp_shutdown(device_t dev)
2025 {
2026         struct sbp_softc *sbp = ((struct sbp_softc *)device_get_softc(dev));
2027
2028         SBP_LOCK(sbp);
2029         sbp_logout_all(sbp);
2030         SBP_UNLOCK(sbp);
2031         return (0);
2032 }
2033
2034 static void
2035 sbp_free_sdev(struct sbp_dev *sdev)
2036 {
2037         struct sbp_softc *sbp;
2038         int i;
2039
2040         if (sdev == NULL)
2041                 return;
2042         sbp = sdev->target->sbp;
2043         SBP_UNLOCK(sbp);
2044         callout_drain(&sdev->login_callout);
2045         for (i = 0; i < SBP_QUEUE_LEN; i++) {
2046                 callout_drain(&sdev->ocb[i].timer);
2047                 bus_dmamap_destroy(sbp->dmat, sdev->ocb[i].dmamap);
2048         }
2049         fwdma_free(sbp->fd.fc, &sdev->dma);
2050         free(sdev, M_SBP);
2051         SBP_LOCK(sbp);
2052 }
2053
2054 static void
2055 sbp_free_target(struct sbp_target *target)
2056 {
2057         struct sbp_softc *sbp;
2058         struct fw_xfer *xfer, *next;
2059         int i;
2060
2061         if (target->luns == NULL)
2062                 return;
2063         sbp = target->sbp;
2064         SBP_LOCK_ASSERT(sbp);
2065         SBP_UNLOCK(sbp);
2066         callout_drain(&target->mgm_ocb_timeout);
2067         callout_drain(&target->scan_callout);
2068         SBP_LOCK(sbp);
2069         for (i = 0; i < target->num_lun; i++)
2070                 sbp_free_sdev(target->luns[i]);
2071
2072         STAILQ_FOREACH_SAFE(xfer, &target->xferlist, link, next) {
2073                 fw_xfer_free_buf(xfer);
2074         }
2075         STAILQ_INIT(&target->xferlist);
2076         free(target->luns, M_SBP);
2077         target->num_lun = 0;
2078         target->luns = NULL;
2079         target->fwdev = NULL;
2080 }
2081
2082 static int
2083 sbp_detach(device_t dev)
2084 {
2085         struct sbp_softc *sbp = ((struct sbp_softc *)device_get_softc(dev));
2086         struct firewire_comm *fc = sbp->fd.fc;
2087         int i;
2088
2089 SBP_DEBUG(0)
2090         printf("sbp_detach\n");
2091 END_DEBUG
2092
2093         SBP_LOCK(sbp);
2094         for (i = 0; i < SBP_NUM_TARGETS; i++)
2095                 sbp_cam_detach_target(&sbp->targets[i]);
2096
2097         xpt_async(AC_LOST_DEVICE, sbp->path, NULL);
2098         xpt_free_path(sbp->path);
2099         xpt_bus_deregister(cam_sim_path(sbp->sim));
2100         cam_sim_free(sbp->sim, /*free_devq*/ TRUE);
2101
2102         sbp_logout_all(sbp);
2103         SBP_UNLOCK(sbp);
2104
2105         /* XXX wait for logout completion */
2106         pause("sbpdtc", hz/2);
2107
2108         SBP_LOCK(sbp);
2109         for (i = 0; i < SBP_NUM_TARGETS; i++)
2110                 sbp_free_target(&sbp->targets[i]);
2111         SBP_UNLOCK(sbp);
2112
2113         fw_bindremove(fc, &sbp->fwb);
2114         fw_xferlist_remove(&sbp->fwb.xferlist);
2115
2116         bus_dma_tag_destroy(sbp->dmat);
2117         mtx_destroy(&sbp->mtx);
2118
2119         return (0);
2120 }
2121
2122 static void
2123 sbp_cam_detach_sdev(struct sbp_dev *sdev)
2124 {
2125         if (sdev == NULL)
2126                 return;
2127         if (sdev->status == SBP_DEV_DEAD)
2128                 return;
2129         if (sdev->status == SBP_DEV_RESET)
2130                 return;
2131         SBP_LOCK_ASSERT(sdev->target->sbp);
2132         sbp_abort_all_ocbs(sdev, CAM_DEV_NOT_THERE);
2133         if (sdev->path) {
2134                 xpt_release_devq(sdev->path,
2135                                  sdev->freeze, TRUE);
2136                 sdev->freeze = 0;
2137                 xpt_async(AC_LOST_DEVICE, sdev->path, NULL);
2138                 xpt_free_path(sdev->path);
2139                 sdev->path = NULL;
2140         }
2141 }
2142
2143 static void
2144 sbp_cam_detach_target(struct sbp_target *target)
2145 {
2146         int i;
2147
2148         SBP_LOCK_ASSERT(target->sbp);
2149         if (target->luns != NULL) {
2150 SBP_DEBUG(0)
2151                 printf("sbp_detach_target %d\n", target->target_id);
2152 END_DEBUG
2153                 callout_stop(&target->scan_callout);
2154                 for (i = 0; i < target->num_lun; i++)
2155                         sbp_cam_detach_sdev(target->luns[i]);
2156         }
2157 }
2158
2159 static void
2160 sbp_target_reset(struct sbp_dev *sdev, int method)
2161 {
2162         int i;
2163         struct sbp_target *target = sdev->target;
2164         struct sbp_dev *tsdev;
2165
2166         SBP_LOCK_ASSERT(target->sbp);
2167         for (i = 0; i < target->num_lun; i++) {
2168                 tsdev = target->luns[i];
2169                 if (tsdev == NULL)
2170                         continue;
2171                 if (tsdev->status == SBP_DEV_DEAD)
2172                         continue;
2173                 if (tsdev->status == SBP_DEV_RESET)
2174                         continue;
2175                 xpt_freeze_devq(tsdev->path, 1);
2176                 tsdev->freeze++;
2177                 sbp_abort_all_ocbs(tsdev, CAM_CMD_TIMEOUT);
2178                 if (method == 2)
2179                         tsdev->status = SBP_DEV_LOGIN;
2180         }
2181         switch (method) {
2182         case 1:
2183                 printf("target reset\n");
2184                 sbp_mgm_orb(sdev, ORB_FUN_RST, NULL);
2185                 break;
2186         case 2:
2187                 printf("reset start\n");
2188                 sbp_reset_start(sdev);
2189                 break;
2190         }
2191
2192 }
2193
2194 static void
2195 sbp_mgm_timeout(void *arg)
2196 {
2197         struct sbp_ocb *ocb = (struct sbp_ocb *)arg;
2198         struct sbp_dev *sdev = ocb->sdev;
2199         struct sbp_target *target = sdev->target;
2200
2201         SBP_LOCK_ASSERT(target->sbp);
2202         device_printf(sdev->target->sbp->fd.dev,
2203                 "%s:%s request timeout(mgm orb:0x%08x)\n",
2204                 __func__, sdev->bustgtlun, (uint32_t)ocb->bus_addr);
2205         target->mgm_ocb_cur = NULL;
2206         sbp_free_ocb(sdev, ocb);
2207 #if 0
2208         /* XXX */
2209         printf("run next request\n");
2210         sbp_mgm_orb(sdev, ORB_FUN_RUNQUEUE, NULL);
2211 #endif
2212         device_printf(sdev->target->sbp->fd.dev,
2213                 "%s:%s reset start\n",
2214                 __func__, sdev->bustgtlun);
2215         sbp_reset_start(sdev);
2216 }
2217
2218 static void
2219 sbp_timeout(void *arg)
2220 {
2221         struct sbp_ocb *ocb = (struct sbp_ocb *)arg;
2222         struct sbp_dev *sdev = ocb->sdev;
2223
2224         device_printf(sdev->target->sbp->fd.dev,
2225                 "%s:%s request timeout(cmd orb:0x%08x) ... ",
2226                 __func__, sdev->bustgtlun, (uint32_t)ocb->bus_addr);
2227
2228         SBP_LOCK_ASSERT(sdev->target->sbp);
2229         sdev->timeout++;
2230         switch (sdev->timeout) {
2231         case 1:
2232                 printf("agent reset\n");
2233                 xpt_freeze_devq(sdev->path, 1);
2234                 sdev->freeze++;
2235                 sbp_abort_all_ocbs(sdev, CAM_CMD_TIMEOUT);
2236                 sbp_agent_reset(sdev);
2237                 break;
2238         case 2:
2239         case 3:
2240                 sbp_target_reset(sdev, sdev->timeout - 1);
2241                 break;
2242 #if 0
2243         default:
2244                 /* XXX give up */
2245                 sbp_cam_detach_target(target);
2246                 if (target->luns != NULL)
2247                         free(target->luns, M_SBP);
2248                 target->num_lun = 0;
2249                 target->luns = NULL;
2250                 target->fwdev = NULL;
2251 #endif
2252         }
2253 }
2254
2255 static void
2256 sbp_action(struct cam_sim *sim, union ccb *ccb)
2257 {
2258
2259         struct sbp_softc *sbp = (struct sbp_softc *)sim->softc;
2260         struct sbp_target *target = NULL;
2261         struct sbp_dev *sdev = NULL;
2262
2263         if (sbp != NULL)
2264                 SBP_LOCK_ASSERT(sbp);
2265         /* target:lun -> sdev mapping */
2266         if (sbp != NULL
2267                         && ccb->ccb_h.target_id != CAM_TARGET_WILDCARD
2268                         && ccb->ccb_h.target_id < SBP_NUM_TARGETS) {
2269                 target = &sbp->targets[ccb->ccb_h.target_id];
2270                 if (target->fwdev != NULL
2271                                 && ccb->ccb_h.target_lun != CAM_LUN_WILDCARD
2272                                 && ccb->ccb_h.target_lun < target->num_lun) {
2273                         sdev = target->luns[ccb->ccb_h.target_lun];
2274                         if (sdev != NULL && sdev->status != SBP_DEV_ATTACHED &&
2275                                 sdev->status != SBP_DEV_PROBE)
2276                                 sdev = NULL;
2277                 }
2278         }
2279
2280 SBP_DEBUG(1)
2281         if (sdev == NULL)
2282                 printf("invalid target %d lun %jx\n",
2283                         ccb->ccb_h.target_id, (uintmax_t)ccb->ccb_h.target_lun);
2284 END_DEBUG
2285
2286         switch (ccb->ccb_h.func_code) {
2287         case XPT_SCSI_IO:
2288         case XPT_RESET_DEV:
2289         case XPT_GET_TRAN_SETTINGS:
2290         case XPT_SET_TRAN_SETTINGS:
2291         case XPT_CALC_GEOMETRY:
2292                 if (sdev == NULL) {
2293 SBP_DEBUG(1)
2294                         printf("%s:%d:%jx:func_code 0x%04x: "
2295                                 "Invalid target (target needed)\n",
2296                                 device_get_nameunit(sbp->fd.dev),
2297                                 ccb->ccb_h.target_id,
2298                                 (uintmax_t)ccb->ccb_h.target_lun,
2299                                 ccb->ccb_h.func_code);
2300 END_DEBUG
2301
2302                         ccb->ccb_h.status = CAM_DEV_NOT_THERE;
2303                         xpt_done(ccb);
2304                         return;
2305                 }
2306                 break;
2307         case XPT_PATH_INQ:
2308         case XPT_NOOP:
2309                 /* The opcodes sometimes aimed at a target (sc is valid),
2310                  * sometimes aimed at the SIM (sc is invalid and target is
2311                  * CAM_TARGET_WILDCARD)
2312                  */
2313                 if (sbp == NULL &&
2314                         ccb->ccb_h.target_id != CAM_TARGET_WILDCARD) {
2315 SBP_DEBUG(0)
2316                         printf("%s:%d:%jx func_code 0x%04x: "
2317                                 "Invalid target (no wildcard)\n",
2318                                 device_get_nameunit(sbp->fd.dev),
2319                                 ccb->ccb_h.target_id,
2320                                 (uintmax_t)ccb->ccb_h.target_lun,
2321                                 ccb->ccb_h.func_code);
2322 END_DEBUG
2323                         ccb->ccb_h.status = CAM_DEV_NOT_THERE;
2324                         xpt_done(ccb);
2325                         return;
2326                 }
2327                 break;
2328         default:
2329                 /* XXX Hm, we should check the input parameters */
2330                 break;
2331         }
2332
2333         switch (ccb->ccb_h.func_code) {
2334         case XPT_SCSI_IO:
2335         {
2336                 struct ccb_scsiio *csio;
2337                 struct sbp_ocb *ocb;
2338                 int speed;
2339                 void *cdb;
2340
2341                 csio = &ccb->csio;
2342                 mtx_assert(sim->mtx, MA_OWNED);
2343
2344 SBP_DEBUG(2)
2345                 printf("%s:%d:%jx XPT_SCSI_IO: "
2346                         "cmd: %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x"
2347                         ", flags: 0x%02x, "
2348                         "%db cmd/%db data/%db sense\n",
2349                         device_get_nameunit(sbp->fd.dev),
2350                         ccb->ccb_h.target_id, (uintmax_t)ccb->ccb_h.target_lun,
2351                         csio->cdb_io.cdb_bytes[0],
2352                         csio->cdb_io.cdb_bytes[1],
2353                         csio->cdb_io.cdb_bytes[2],
2354                         csio->cdb_io.cdb_bytes[3],
2355                         csio->cdb_io.cdb_bytes[4],
2356                         csio->cdb_io.cdb_bytes[5],
2357                         csio->cdb_io.cdb_bytes[6],
2358                         csio->cdb_io.cdb_bytes[7],
2359                         csio->cdb_io.cdb_bytes[8],
2360                         csio->cdb_io.cdb_bytes[9],
2361                         ccb->ccb_h.flags & CAM_DIR_MASK,
2362                         csio->cdb_len, csio->dxfer_len,
2363                         csio->sense_len);
2364 END_DEBUG
2365                 if (sdev == NULL) {
2366                         ccb->ccb_h.status = CAM_DEV_NOT_THERE;
2367                         xpt_done(ccb);
2368                         return;
2369                 }
2370 #if 0
2371                 /* if we are in probe stage, pass only probe commands */
2372                 if (sdev->status == SBP_DEV_PROBE) {
2373                         char *name;
2374                         name = xpt_path_periph(ccb->ccb_h.path)->periph_name;
2375                         printf("probe stage, periph name: %s\n", name);
2376                         if (strcmp(name, "probe") != 0) {
2377                                 ccb->ccb_h.status = CAM_REQUEUE_REQ;
2378                                 xpt_done(ccb);
2379                                 return;
2380                         }
2381                 }
2382 #endif
2383                 if ((ocb = sbp_get_ocb(sdev)) == NULL) {
2384                         ccb->ccb_h.status = CAM_RESRC_UNAVAIL;
2385                         if (sdev->freeze == 0) {
2386                                 xpt_freeze_devq(sdev->path, 1);
2387                                 sdev->freeze++;
2388                         }
2389                         xpt_done(ccb);
2390                         return;
2391                 }
2392
2393                 ocb->flags = OCB_ACT_CMD;
2394                 ocb->sdev = sdev;
2395                 ocb->ccb = ccb;
2396                 ccb->ccb_h.ccb_sdev_ptr = sdev;
2397                 ocb->orb[0] = htonl(1U << 31);
2398                 ocb->orb[1] = 0;
2399                 ocb->orb[2] = htonl(((sbp->fd.fc->nodeid | FWLOCALBUS) << 16));
2400                 ocb->orb[3] = htonl(ocb->bus_addr + IND_PTR_OFFSET);
2401                 speed = min(target->fwdev->speed, max_speed);
2402                 ocb->orb[4] = htonl(ORB_NOTIFY | ORB_CMD_SPD(speed)
2403                                                 | ORB_CMD_MAXP(speed + 7));
2404                 if ((ccb->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN) {
2405                         ocb->orb[4] |= htonl(ORB_CMD_IN);
2406                 }
2407
2408                 if (csio->ccb_h.flags & CAM_CDB_POINTER)
2409                         cdb = (void *)csio->cdb_io.cdb_ptr;
2410                 else
2411                         cdb = (void *)&csio->cdb_io.cdb_bytes;
2412                 bcopy(cdb, (void *)&ocb->orb[5], csio->cdb_len);
2413 /*
2414 printf("ORB %08x %08x %08x %08x\n", ntohl(ocb->orb[0]), ntohl(ocb->orb[1]), ntohl(ocb->orb[2]), ntohl(ocb->orb[3]));
2415 printf("ORB %08x %08x %08x %08x\n", ntohl(ocb->orb[4]), ntohl(ocb->orb[5]), ntohl(ocb->orb[6]), ntohl(ocb->orb[7]));
2416 */
2417                 if (ccb->csio.dxfer_len > 0) {
2418                         int error;
2419
2420                         error = bus_dmamap_load_ccb(/*dma tag*/sbp->dmat,
2421                                         /*dma map*/ocb->dmamap,
2422                                         ccb,
2423                                         sbp_execute_ocb,
2424                                         ocb,
2425                                         /*flags*/0);
2426                         if (error)
2427                                 printf("sbp: bus_dmamap_load error %d\n", error);
2428                 } else
2429                         sbp_execute_ocb(ocb, NULL, 0, 0);
2430                 break;
2431         }
2432         case XPT_CALC_GEOMETRY:
2433         {
2434                 struct ccb_calc_geometry *ccg;
2435
2436                 ccg = &ccb->ccg;
2437                 if (ccg->block_size == 0) {
2438                         printf("sbp_action: block_size is 0.\n");
2439                         ccb->ccb_h.status = CAM_REQ_INVALID;
2440                         xpt_done(ccb);
2441                         break;
2442                 }
2443 SBP_DEBUG(1)
2444                 printf("%s:%d:%d:%jx:XPT_CALC_GEOMETRY: "
2445                         "Volume size = %jd\n",
2446                         device_get_nameunit(sbp->fd.dev),
2447                         cam_sim_path(sbp->sim),
2448                         ccb->ccb_h.target_id, (uintmax_t)ccb->ccb_h.target_lun,
2449                         (uintmax_t)ccg->volume_size);
2450 END_DEBUG
2451
2452                 cam_calc_geometry(ccg, /*extended*/1);
2453                 xpt_done(ccb);
2454                 break;
2455         }
2456         case XPT_RESET_BUS:             /* Reset the specified SCSI bus */
2457         {
2458
2459 SBP_DEBUG(1)
2460                 printf("%s:%d:XPT_RESET_BUS: \n",
2461                         device_get_nameunit(sbp->fd.dev), cam_sim_path(sbp->sim));
2462 END_DEBUG
2463
2464                 ccb->ccb_h.status = CAM_REQ_INVALID;
2465                 xpt_done(ccb);
2466                 break;
2467         }
2468         case XPT_PATH_INQ:              /* Path routing inquiry */
2469         {
2470                 struct ccb_pathinq *cpi = &ccb->cpi;
2471
2472 SBP_DEBUG(1)
2473                 printf("%s:%d:%jx XPT_PATH_INQ:.\n",
2474                         device_get_nameunit(sbp->fd.dev),
2475                         ccb->ccb_h.target_id, (uintmax_t)ccb->ccb_h.target_lun);
2476 END_DEBUG
2477                 cpi->version_num = 1; /* XXX??? */
2478                 cpi->hba_inquiry = PI_TAG_ABLE;
2479                 cpi->target_sprt = 0;
2480                 cpi->hba_misc = PIM_NOBUSRESET | PIM_NO_6_BYTE;
2481                 cpi->hba_eng_cnt = 0;
2482                 cpi->max_target = SBP_NUM_TARGETS - 1;
2483                 cpi->max_lun = SBP_NUM_LUNS - 1;
2484                 cpi->initiator_id = SBP_INITIATOR;
2485                 cpi->bus_id = sim->bus_id;
2486                 cpi->base_transfer_speed = 400 * 1000 / 8;
2487                 strncpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
2488                 strncpy(cpi->hba_vid, "SBP", HBA_IDLEN);
2489                 strncpy(cpi->dev_name, sim->sim_name, DEV_IDLEN);
2490                 cpi->unit_number = sim->unit_number;
2491                 cpi->transport = XPORT_SPI;     /* XX should have a FireWire */
2492                 cpi->transport_version = 2;
2493                 cpi->protocol = PROTO_SCSI;
2494                 cpi->protocol_version = SCSI_REV_2;
2495
2496                 cpi->ccb_h.status = CAM_REQ_CMP;
2497                 xpt_done(ccb);
2498                 break;
2499         }
2500         case XPT_GET_TRAN_SETTINGS:
2501         {
2502                 struct ccb_trans_settings *cts = &ccb->cts;
2503                 struct ccb_trans_settings_scsi *scsi =
2504                     &cts->proto_specific.scsi;
2505                 struct ccb_trans_settings_spi *spi =
2506                     &cts->xport_specific.spi;
2507
2508                 cts->protocol = PROTO_SCSI;
2509                 cts->protocol_version = SCSI_REV_2;
2510                 cts->transport = XPORT_SPI;     /* should have a FireWire */
2511                 cts->transport_version = 2;
2512                 spi->valid = CTS_SPI_VALID_DISC;
2513                 spi->flags = CTS_SPI_FLAGS_DISC_ENB;
2514                 scsi->valid = CTS_SCSI_VALID_TQ;
2515                 scsi->flags = CTS_SCSI_FLAGS_TAG_ENB;
2516 SBP_DEBUG(1)
2517                 printf("%s:%d:%jx XPT_GET_TRAN_SETTINGS:.\n",
2518                         device_get_nameunit(sbp->fd.dev),
2519                         ccb->ccb_h.target_id, (uintmax_t)ccb->ccb_h.target_lun);
2520 END_DEBUG
2521                 cts->ccb_h.status = CAM_REQ_CMP;
2522                 xpt_done(ccb);
2523                 break;
2524         }
2525         case XPT_ABORT:
2526                 ccb->ccb_h.status = CAM_UA_ABORT;
2527                 xpt_done(ccb);
2528                 break;
2529         case XPT_SET_TRAN_SETTINGS:
2530                 /* XXX */
2531         default:
2532                 ccb->ccb_h.status = CAM_REQ_INVALID;
2533                 xpt_done(ccb);
2534                 break;
2535         }
2536         return;
2537 }
2538
2539 static void
2540 sbp_execute_ocb(void *arg, bus_dma_segment_t *segments, int seg, int error)
2541 {
2542         int i;
2543         struct sbp_ocb *ocb;
2544         struct sbp_ocb *prev;
2545         bus_dma_segment_t *s;
2546
2547         if (error)
2548                 printf("sbp_execute_ocb: error=%d\n", error);
2549
2550         ocb = (struct sbp_ocb *)arg;
2551
2552 SBP_DEBUG(2)
2553         printf("sbp_execute_ocb: seg %d", seg);
2554         for (i = 0; i < seg; i++)
2555                 printf(", %jx:%jd", (uintmax_t)segments[i].ds_addr,
2556                                         (uintmax_t)segments[i].ds_len);
2557         printf("\n");
2558 END_DEBUG
2559
2560         if (seg == 1) {
2561                 /* direct pointer */
2562                 s = &segments[0];
2563                 if (s->ds_len > SBP_SEG_MAX)
2564                         panic("ds_len > SBP_SEG_MAX, fix busdma code");
2565                 ocb->orb[3] = htonl(s->ds_addr);
2566                 ocb->orb[4] |= htonl(s->ds_len);
2567         } else if (seg > 1) {
2568                 /* page table */
2569                 for (i = 0; i < seg; i++) {
2570                         s = &segments[i];
2571 SBP_DEBUG(0)
2572                         /* XXX LSI Logic "< 16 byte" bug might be hit */
2573                         if (s->ds_len < 16)
2574                                 printf("sbp_execute_ocb: warning, "
2575                                         "segment length(%zd) is less than 16."
2576                                         "(seg=%d/%d)\n", (size_t)s->ds_len, i + 1, seg);
2577 END_DEBUG
2578                         if (s->ds_len > SBP_SEG_MAX)
2579                                 panic("ds_len > SBP_SEG_MAX, fix busdma code");
2580                         ocb->ind_ptr[i].hi = htonl(s->ds_len << 16);
2581                         ocb->ind_ptr[i].lo = htonl(s->ds_addr);
2582                 }
2583                 ocb->orb[4] |= htonl(ORB_CMD_PTBL | seg);
2584         }
2585
2586         if (seg > 0)
2587                 bus_dmamap_sync(ocb->sdev->target->sbp->dmat, ocb->dmamap,
2588                         (ntohl(ocb->orb[4]) & ORB_CMD_IN) ?
2589                         BUS_DMASYNC_PREREAD : BUS_DMASYNC_PREWRITE);
2590         prev = sbp_enqueue_ocb(ocb->sdev, ocb);
2591         fwdma_sync(&ocb->sdev->dma, BUS_DMASYNC_PREWRITE);
2592         if (use_doorbell) {
2593                 if (prev == NULL) {
2594                         if (ocb->sdev->last_ocb != NULL)
2595                                 sbp_doorbell(ocb->sdev);
2596                         else
2597                                 sbp_orb_pointer(ocb->sdev, ocb);
2598                 }
2599         } else {
2600                 if (prev == NULL || (ocb->sdev->flags & ORB_LINK_DEAD) != 0) {
2601                         ocb->sdev->flags &= ~ORB_LINK_DEAD;
2602                         sbp_orb_pointer(ocb->sdev, ocb);
2603                 }
2604         }
2605 }
2606
2607 static void
2608 sbp_poll(struct cam_sim *sim)
2609 {
2610         struct sbp_softc *sbp;
2611         struct firewire_comm *fc;
2612
2613         sbp = (struct sbp_softc *)sim->softc;
2614         fc = sbp->fd.fc;
2615
2616         fc->poll(fc, 0, -1);
2617
2618         return;
2619 }
2620
2621 static struct sbp_ocb *
2622 sbp_dequeue_ocb(struct sbp_dev *sdev, struct sbp_status *sbp_status)
2623 {
2624         struct sbp_ocb *ocb;
2625         struct sbp_ocb *next;
2626         int order = 0;
2627
2628 SBP_DEBUG(1)
2629         device_printf(sdev->target->sbp->fd.dev,
2630         "%s:%s 0x%08x src %d\n",
2631             __func__, sdev->bustgtlun, ntohl(sbp_status->orb_lo), sbp_status->src);
2632 END_DEBUG
2633         SBP_LOCK_ASSERT(sdev->target->sbp);
2634         STAILQ_FOREACH_SAFE(ocb, &sdev->ocbs, ocb, next) {
2635                 if (OCB_MATCH(ocb, sbp_status)) {
2636                         /* found */
2637                         STAILQ_REMOVE(&sdev->ocbs, ocb, sbp_ocb, ocb);
2638                         if (ocb->ccb != NULL)
2639                                 callout_stop(&ocb->timer);
2640                         if (ntohl(ocb->orb[4]) & 0xffff) {
2641                                 bus_dmamap_sync(sdev->target->sbp->dmat,
2642                                         ocb->dmamap,
2643                                         (ntohl(ocb->orb[4]) & ORB_CMD_IN) ?
2644                                         BUS_DMASYNC_POSTREAD :
2645                                         BUS_DMASYNC_POSTWRITE);
2646                                 bus_dmamap_unload(sdev->target->sbp->dmat,
2647                                         ocb->dmamap);
2648                         }
2649                         if (!use_doorbell) {
2650                                 if (sbp_status->src == SRC_NO_NEXT) {
2651                                         if (next != NULL)
2652                                                 sbp_orb_pointer(sdev, next);
2653                                         else if (order > 0) {
2654                                                 /*
2655                                                  * Unordered execution
2656                                                  * We need to send pointer for
2657                                                  * next ORB
2658                                                  */
2659                                                 sdev->flags |= ORB_LINK_DEAD;
2660                                         }
2661                                 }
2662                         } else {
2663                                 /*
2664                                  * XXX this is not correct for unordered
2665                                  * execution.
2666                                  */
2667                                 if (sdev->last_ocb != NULL) {
2668                                         sbp_free_ocb(sdev, sdev->last_ocb);
2669                                 }
2670                                 sdev->last_ocb = ocb;
2671                                 if (next != NULL &&
2672                                     sbp_status->src == SRC_NO_NEXT)
2673                                         sbp_doorbell(sdev);
2674                         }
2675                         break;
2676                 } else
2677                         order++;
2678         }
2679 SBP_DEBUG(0)
2680         if (ocb && order > 0) {
2681                 device_printf(sdev->target->sbp->fd.dev,
2682                         "%s:%s unordered execution order:%d\n",
2683                         __func__, sdev->bustgtlun, order);
2684         }
2685 END_DEBUG
2686         return (ocb);
2687 }
2688
2689 static struct sbp_ocb *
2690 sbp_enqueue_ocb(struct sbp_dev *sdev, struct sbp_ocb *ocb)
2691 {
2692         struct sbp_ocb *prev, *prev2;
2693
2694         SBP_LOCK_ASSERT(sdev->target->sbp);
2695 SBP_DEBUG(1)
2696         device_printf(sdev->target->sbp->fd.dev,
2697         "%s:%s 0x%08jx\n", __func__, sdev->bustgtlun, (uintmax_t)ocb->bus_addr);
2698 END_DEBUG
2699         prev2 = prev = STAILQ_LAST(&sdev->ocbs, sbp_ocb, ocb);
2700         STAILQ_INSERT_TAIL(&sdev->ocbs, ocb, ocb);
2701
2702         if (ocb->ccb != NULL) {
2703                 callout_reset_sbt(&ocb->timer,
2704                     SBT_1MS * ocb->ccb->ccb_h.timeout, 0, sbp_timeout,
2705                     ocb, 0);
2706         }
2707
2708         if (use_doorbell && prev == NULL)
2709                 prev2 = sdev->last_ocb;
2710
2711         if (prev2 != NULL && (ocb->sdev->flags & ORB_LINK_DEAD) == 0) {
2712 SBP_DEBUG(1)
2713                 printf("linking chain 0x%jx -> 0x%jx\n",
2714                     (uintmax_t)prev2->bus_addr, (uintmax_t)ocb->bus_addr);
2715 END_DEBUG
2716                 /*
2717                  * Suppress compiler optimization so that orb[1] must be written first.
2718                  * XXX We may need an explicit memory barrier for other architectures
2719                  * other than i386/amd64.
2720                  */
2721                 *(volatile uint32_t *)&prev2->orb[1] = htonl(ocb->bus_addr);
2722                 *(volatile uint32_t *)&prev2->orb[0] = 0;
2723         }
2724
2725         return prev;
2726 }
2727
2728 static struct sbp_ocb *
2729 sbp_get_ocb(struct sbp_dev *sdev)
2730 {
2731         struct sbp_ocb *ocb;
2732
2733         SBP_LOCK_ASSERT(sdev->target->sbp);
2734         ocb = STAILQ_FIRST(&sdev->free_ocbs);
2735         if (ocb == NULL) {
2736                 sdev->flags |= ORB_SHORTAGE;
2737                 printf("ocb shortage!!!\n");
2738                 return NULL;
2739         }
2740         STAILQ_REMOVE_HEAD(&sdev->free_ocbs, ocb);
2741         ocb->ccb = NULL;
2742         return (ocb);
2743 }
2744
2745 static void
2746 sbp_free_ocb(struct sbp_dev *sdev, struct sbp_ocb *ocb)
2747 {
2748         ocb->flags = 0;
2749         ocb->ccb = NULL;
2750
2751         SBP_LOCK_ASSERT(sdev->target->sbp);
2752         STAILQ_INSERT_TAIL(&sdev->free_ocbs, ocb, ocb);
2753         if ((sdev->flags & ORB_SHORTAGE) != 0) {
2754                 int count;
2755
2756                 sdev->flags &= ~ORB_SHORTAGE;
2757                 count = sdev->freeze;
2758                 sdev->freeze = 0;
2759                 xpt_release_devq(sdev->path, count, TRUE);
2760         }
2761 }
2762
2763 static void
2764 sbp_abort_ocb(struct sbp_ocb *ocb, int status)
2765 {
2766         struct sbp_dev *sdev;
2767
2768         sdev = ocb->sdev;
2769         SBP_LOCK_ASSERT(sdev->target->sbp);
2770 SBP_DEBUG(0)
2771         device_printf(sdev->target->sbp->fd.dev,
2772         "%s:%s 0x%jx\n", __func__, sdev->bustgtlun, (uintmax_t)ocb->bus_addr);
2773 END_DEBUG
2774 SBP_DEBUG(1)
2775         if (ocb->ccb != NULL)
2776                 sbp_print_scsi_cmd(ocb);
2777 END_DEBUG
2778         if (ntohl(ocb->orb[4]) & 0xffff) {
2779                 bus_dmamap_sync(sdev->target->sbp->dmat, ocb->dmamap,
2780                         (ntohl(ocb->orb[4]) & ORB_CMD_IN) ?
2781                         BUS_DMASYNC_POSTREAD : BUS_DMASYNC_POSTWRITE);
2782                 bus_dmamap_unload(sdev->target->sbp->dmat, ocb->dmamap);
2783         }
2784         if (ocb->ccb != NULL) {
2785                 callout_stop(&ocb->timer);
2786                 ocb->ccb->ccb_h.status = status;
2787                 xpt_done(ocb->ccb);
2788         }
2789         sbp_free_ocb(sdev, ocb);
2790 }
2791
2792 static void
2793 sbp_abort_all_ocbs(struct sbp_dev *sdev, int status)
2794 {
2795         struct sbp_ocb *ocb, *next;
2796         STAILQ_HEAD(, sbp_ocb) temp;
2797
2798         STAILQ_INIT(&temp);
2799         SBP_LOCK_ASSERT(sdev->target->sbp);
2800         STAILQ_CONCAT(&temp, &sdev->ocbs);
2801         STAILQ_INIT(&sdev->ocbs);
2802
2803         STAILQ_FOREACH_SAFE(ocb, &temp, ocb, next) {
2804                 sbp_abort_ocb(ocb, status);
2805         }
2806         if (sdev->last_ocb != NULL) {
2807                 sbp_free_ocb(sdev, sdev->last_ocb);
2808                 sdev->last_ocb = NULL;
2809         }
2810 }
2811
2812 static devclass_t sbp_devclass;
2813
2814 static device_method_t sbp_methods[] = {
2815         /* device interface */
2816         DEVMETHOD(device_identify,      sbp_identify),
2817         DEVMETHOD(device_probe,         sbp_probe),
2818         DEVMETHOD(device_attach,        sbp_attach),
2819         DEVMETHOD(device_detach,        sbp_detach),
2820         DEVMETHOD(device_shutdown,      sbp_shutdown),
2821
2822         { 0, 0 }
2823 };
2824
2825 static driver_t sbp_driver = {
2826         "sbp",
2827         sbp_methods,
2828         sizeof(struct sbp_softc),
2829 };
2830 DRIVER_MODULE(sbp, firewire, sbp_driver, sbp_devclass, 0, 0);
2831 MODULE_VERSION(sbp, 1);
2832 MODULE_DEPEND(sbp, firewire, 1, 1, 1);
2833 MODULE_DEPEND(sbp, cam, 1, 1, 1);