sys/dev/firewire/sbp_targ.c

   1 /*-
   2  * SPDX-License-Identifier: BSD-4-Clause
   3  *
   4  * Copyright (C) 2003
   5  *      Hidetoshi Shimokawa. All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. All advertising materials mentioning features or use of this software
  16  *    must display the following acknowledgement:
  17  *
  18  *      This product includes software developed by Hidetoshi Shimokawa.
  19  *
  20  * 4. Neither the name of the author nor the names of its contributors
  21  *    may be used to endorse or promote products derived from this software
  22  *    without specific prior written permission.
  23  *
  24  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  34  * SUCH DAMAGE.
  35  *
  36  * $FreeBSD$
  37  */
  38
  39 #include <sys/param.h>
  40 #include <sys/kernel.h>
  41 #include <sys/systm.h>
  42 #include <sys/sysctl.h>
  43 #include <sys/types.h>
  44 #include <sys/conf.h>
  45 #include <sys/malloc.h>
  46 #include <sys/endian.h>
  47
  48 #include <sys/bus.h>
  49 #include <machine/bus.h>
  50
  51 #include <dev/firewire/firewire.h>
  52 #include <dev/firewire/firewirereg.h>
  53 #include <dev/firewire/iec13213.h>
  54 #include <dev/firewire/sbp.h>
  55 #include <dev/firewire/fwmem.h>
  56
  57 #include <cam/cam.h>
  58 #include <cam/cam_ccb.h>
  59 #include <cam/cam_sim.h>
  60 #include <cam/cam_xpt_sim.h>
  61 #include <cam/cam_debug.h>
  62 #include <cam/cam_periph.h>
  63 #include <cam/scsi/scsi_all.h>
  64 #include <cam/scsi/scsi_message.h>
  65
  66 #define SBP_TARG_RECV_LEN       8
  67 #define MAX_INITIATORS          8
  68 #define MAX_LUN                 63
  69 #define MAX_LOGINS              63
  70 #define MAX_NODES               63
  71 /*
  72  * management/command block agent registers
  73  *
  74  * BASE 0xffff f001 0000 management port
  75  * BASE 0xffff f001 0020 command port for login id 0
  76  * BASE 0xffff f001 0040 command port for login id 1
  77  *
  78  */
  79 #define SBP_TARG_MGM     0x10000        /* offset from 0xffff f000 000 */
  80 #define SBP_TARG_BIND_HI        0xffff
  81 #define SBP_TARG_BIND_LO(l)     (0xf0000000 + SBP_TARG_MGM + 0x20 * ((l) + 1))
  82 #define SBP_TARG_BIND_START     (((u_int64_t)SBP_TARG_BIND_HI << 32) | \
  83                                     SBP_TARG_BIND_LO(-1))
  84 #define SBP_TARG_BIND_END       (((u_int64_t)SBP_TARG_BIND_HI << 32) | \
  85                                     SBP_TARG_BIND_LO(MAX_LOGINS))
  86 #define SBP_TARG_LOGIN_ID(lo)   (((lo) - SBP_TARG_BIND_LO(0))/0x20)
  87
  88 #define FETCH_MGM       0
  89 #define FETCH_CMD       1
  90 #define FETCH_POINTER   2
  91
  92 #define F_LINK_ACTIVE   (1 << 0)
  93 #define F_ATIO_STARVED  (1 << 1)
  94 #define F_LOGIN         (1 << 2)
  95 #define F_HOLD          (1 << 3)
  96 #define F_FREEZED       (1 << 4)
  97
  98 static MALLOC_DEFINE(M_SBP_TARG, "sbp_targ", "SBP-II/FireWire target mode");
  99
 100 static int debug = 0;
 101
 102 SYSCTL_INT(_debug, OID_AUTO, sbp_targ_debug, CTLFLAG_RW, &debug, 0,
 103         "SBP target mode debug flag");
 104
 105 struct sbp_targ_login {
 106         struct sbp_targ_lstate *lstate;
 107         struct fw_device *fwdev;
 108         struct sbp_login_res loginres;
 109         uint16_t fifo_hi;
 110         uint16_t last_hi;
 111         uint32_t fifo_lo;
 112         uint32_t last_lo;
 113         STAILQ_HEAD(, orb_info) orbs;
 114         STAILQ_ENTRY(sbp_targ_login) link;
 115         uint16_t hold_sec;
 116         uint16_t id;
 117         uint8_t flags;
 118         uint8_t spd;
 119         struct callout hold_callout;
 120 };
 121
 122 struct sbp_targ_lstate {
 123         uint16_t lun;
 124         struct sbp_targ_softc *sc;
 125         struct cam_path *path;
 126         struct ccb_hdr_slist accept_tios;
 127         struct ccb_hdr_slist immed_notifies;
 128         struct crom_chunk model;
 129         uint32_t flags;
 130         STAILQ_HEAD(, sbp_targ_login) logins;
 131 };
 132
 133 struct sbp_targ_softc {
 134         struct firewire_dev_comm fd;
 135         struct cam_sim *sim;
 136         struct cam_path *path;
 137         struct fw_bind fwb;
 138         int ndevs;
 139         int flags;
 140         struct crom_chunk unit;
 141         struct sbp_targ_lstate *lstate[MAX_LUN];
 142         struct sbp_targ_lstate *black_hole;
 143         struct sbp_targ_login *logins[MAX_LOGINS];
 144         struct mtx mtx;
 145 };
 146 #define SBP_LOCK(sc) mtx_lock(&(sc)->mtx)
 147 #define SBP_UNLOCK(sc) mtx_unlock(&(sc)->mtx)
 148
 149 struct corb4 {
 150 #if BYTE_ORDER == BIG_ENDIAN
 151         uint32_t n:1,
 152                   rq_fmt:2,
 153                   :1,
 154                   dir:1,
 155                   spd:3,
 156                   max_payload:4,
 157                   page_table_present:1,
 158                   page_size:3,
 159                   data_size:16;
 160 #else
 161         uint32_t data_size:16,
 162                   page_size:3,
 163                   page_table_present:1,
 164                   max_payload:4,
 165                   spd:3,
 166                   dir:1,
 167                   :1,
 168                   rq_fmt:2,
 169                   n:1;
 170 #endif
 171 };
 172
 173 struct morb4 {
 174 #if BYTE_ORDER == BIG_ENDIAN
 175         uint32_t n:1,
 176                   rq_fmt:2,
 177                   :9,
 178                   fun:4,
 179                   id:16;
 180 #else
 181         uint32_t id:16,
 182                   fun:4,
 183                   :9,
 184                   rq_fmt:2,
 185                   n:1;
 186 #endif
 187 };
 188
 189
 190 /*
 191  * Urestricted page table format
 192  * states that the segment length
 193  * and high base addr are in the first
 194  * 32 bits and the base low is in
 195  * the second
 196  */
 197 struct unrestricted_page_table_fmt {
 198         uint16_t segment_len;
 199         uint16_t segment_base_high;
 200         uint32_t segment_base_low;
 201 };
 202
 203
 204 struct orb_info {
 205         struct sbp_targ_softc *sc;
 206         struct fw_device *fwdev;
 207         struct sbp_targ_login *login;
 208         union ccb *ccb;
 209         struct ccb_accept_tio *atio;
 210         uint8_t state;
 211 #define ORBI_STATUS_NONE        0
 212 #define ORBI_STATUS_FETCH       1
 213 #define ORBI_STATUS_ATIO        2
 214 #define ORBI_STATUS_CTIO        3
 215 #define ORBI_STATUS_STATUS      4
 216 #define ORBI_STATUS_POINTER     5
 217 #define ORBI_STATUS_ABORTED     7
 218         uint8_t refcount;
 219         uint16_t orb_hi;
 220         uint32_t orb_lo;
 221         uint32_t data_hi;
 222         uint32_t data_lo;
 223         struct corb4 orb4;
 224         STAILQ_ENTRY(orb_info) link;
 225         uint32_t orb[8];
 226         struct unrestricted_page_table_fmt *page_table;
 227         struct unrestricted_page_table_fmt *cur_pte;
 228         struct unrestricted_page_table_fmt *last_pte;
 229         uint32_t  last_block_read;
 230         struct sbp_status status;
 231 };
 232
 233 static char *orb_fun_name[] = {
 234         ORB_FUN_NAMES
 235 };
 236
 237 static void sbp_targ_recv(struct fw_xfer *);
 238 static void sbp_targ_fetch_orb(struct sbp_targ_softc *, struct fw_device *,
 239     uint16_t, uint32_t, struct sbp_targ_login *, int);
 240 static void sbp_targ_xfer_pt(struct orb_info *);
 241 static void sbp_targ_abort(struct sbp_targ_softc *, struct orb_info *);
 242
 243 static void
 244 sbp_targ_identify(driver_t *driver, device_t parent)
 245 {
 246         BUS_ADD_CHILD(parent, 0, "sbp_targ", device_get_unit(parent));
 247 }
 248
 249 static int
 250 sbp_targ_probe(device_t dev)
 251 {
 252         device_t pa;
 253
 254         pa = device_get_parent(dev);
 255         if (device_get_unit(dev) != device_get_unit(pa)) {
 256                 return (ENXIO);
 257         }
 258
 259         device_set_desc(dev, "SBP-2/SCSI over FireWire target mode");
 260         return (0);
 261 }
 262
 263 static void
 264 sbp_targ_dealloc_login(struct sbp_targ_login *login)
 265 {
 266         struct orb_info *orbi, *next;
 267
 268         if (login == NULL) {
 269                 printf("%s: login = NULL\n", __func__);
 270                 return;
 271         }
 272         for (orbi = STAILQ_FIRST(&login->orbs); orbi != NULL; orbi = next) {
 273                 next = STAILQ_NEXT(orbi, link);
 274                 if (debug)
 275                         printf("%s: free orbi %p\n", __func__, orbi);
 276                 free(orbi, M_SBP_TARG);
 277                 orbi = NULL;
 278         }
 279         callout_stop(&login->hold_callout);
 280
 281         STAILQ_REMOVE(&login->lstate->logins, login, sbp_targ_login, link);
 282         login->lstate->sc->logins[login->id] = NULL;
 283         if (debug)
 284                 printf("%s: free login %p\n", __func__, login);
 285         free((void *)login, M_SBP_TARG);
 286         login = NULL;
 287 }
 288
 289 static void
 290 sbp_targ_hold_expire(void *arg)
 291 {
 292         struct sbp_targ_login *login;
 293
 294         login = (struct sbp_targ_login *)arg;
 295
 296         if (login->flags & F_HOLD) {
 297                 printf("%s: login_id=%d expired\n", __func__, login->id);
 298                 sbp_targ_dealloc_login(login);
 299         } else {
 300                 printf("%s: login_id=%d not hold\n", __func__, login->id);
 301         }
 302 }
 303
 304 static void
 305 sbp_targ_post_busreset(void *arg)
 306 {
 307         struct sbp_targ_softc *sc;
 308         struct crom_src *src;
 309         struct crom_chunk *root;
 310         struct crom_chunk *unit;
 311         struct sbp_targ_lstate *lstate;
 312         struct sbp_targ_login *login;
 313         int i;
 314
 315         sc = (struct sbp_targ_softc *)arg;
 316         src = sc->fd.fc->crom_src;
 317         root = sc->fd.fc->crom_root;
 318
 319         unit = &sc->unit;
 320
 321         if ((sc->flags & F_FREEZED) == 0) {
 322                 sc->flags |= F_FREEZED;
 323                 xpt_freeze_simq(sc->sim, /*count*/1);
 324         } else {
 325                 printf("%s: already freezed\n", __func__);
 326         }
 327
 328         bzero(unit, sizeof(struct crom_chunk));
 329
 330         crom_add_chunk(src, root, unit, CROM_UDIR);
 331         crom_add_entry(unit, CSRKEY_SPEC, CSRVAL_ANSIT10);
 332         crom_add_entry(unit, CSRKEY_VER, CSRVAL_T10SBP2);
 333         crom_add_entry(unit, CSRKEY_COM_SPEC, CSRVAL_ANSIT10);
 334         crom_add_entry(unit, CSRKEY_COM_SET, CSRVAL_SCSI);
 335
 336         crom_add_entry(unit, CROM_MGM, SBP_TARG_MGM >> 2);
 337         crom_add_entry(unit, CSRKEY_UNIT_CH, (10<<8) | 8);
 338
 339         for (i = 0; i < MAX_LUN; i++) {
 340                 lstate = sc->lstate[i];
 341                 if (lstate == NULL)
 342                         continue;
 343                 crom_add_entry(unit, CSRKEY_FIRM_VER, 1);
 344                 crom_add_entry(unit, CROM_LUN, i);
 345                 crom_add_entry(unit, CSRKEY_MODEL, 1);
 346                 crom_add_simple_text(src, unit, &lstate->model, "TargetMode");
 347         }
 348
 349         /* Process for reconnection hold time */
 350         for (i = 0; i < MAX_LOGINS; i++) {
 351                 login = sc->logins[i];
 352                 if (login == NULL)
 353                         continue;
 354                 sbp_targ_abort(sc, STAILQ_FIRST(&login->orbs));
 355                 if (login->flags & F_LOGIN) {
 356                         login->flags |= F_HOLD;
 357                         callout_reset(&login->hold_callout,
 358                             hz * login->hold_sec,
 359                             sbp_targ_hold_expire, (void *)login);
 360                 }
 361         }
 362 }
 363
 364 static void
 365 sbp_targ_post_explore(void *arg)
 366 {
 367         struct sbp_targ_softc *sc;
 368
 369         sc = (struct sbp_targ_softc *)arg;
 370         sc->flags &= ~F_FREEZED;
 371         xpt_release_simq(sc->sim, /*run queue*/TRUE);
 372         return;
 373 }
 374
 375 static cam_status
 376 sbp_targ_find_devs(struct sbp_targ_softc *sc, union ccb *ccb,
 377     struct sbp_targ_lstate **lstate, int notfound_failure)
 378 {
 379         u_int lun;
 380
 381         /* XXX 0 is the only vaild target_id */
 382         if (ccb->ccb_h.target_id == CAM_TARGET_WILDCARD &&
 383             ccb->ccb_h.target_lun == CAM_LUN_WILDCARD) {
 384                 *lstate = sc->black_hole;
 385                 if (debug)
 386                         printf("setting black hole for this target id(%d)\n", ccb->ccb_h.target_id);
 387                 return (CAM_REQ_CMP);
 388         }
 389
 390         lun = ccb->ccb_h.target_lun;
 391         if (lun >= MAX_LUN)
 392                 return (CAM_LUN_INVALID);
 393
 394         *lstate = sc->lstate[lun];
 395
 396         if (notfound_failure != 0 && *lstate == NULL) {
 397                 if (debug)
 398                         printf("%s: lstate for lun is invalid, target(%d), lun(%d)\n",
 399                                 __func__, ccb->ccb_h.target_id, lun);
 400                 return (CAM_PATH_INVALID);
 401         } else
 402                 if (debug)
 403                         printf("%s: setting lstate for tgt(%d) lun(%d)\n",
 404                                 __func__,ccb->ccb_h.target_id, lun);
 405
 406         return (CAM_REQ_CMP);
 407 }
 408
 409 static void
 410 sbp_targ_en_lun(struct sbp_targ_softc *sc, union ccb *ccb)
 411 {
 412         struct ccb_en_lun *cel = &ccb->cel;
 413         struct sbp_targ_lstate *lstate;
 414         cam_status status;
 415
 416         status = sbp_targ_find_devs(sc, ccb, &lstate, 0);
 417         if (status != CAM_REQ_CMP) {
 418                 ccb->ccb_h.status = status;
 419                 return;
 420         }
 421
 422         if (cel->enable != 0) {
 423                 if (lstate != NULL) {
 424                         xpt_print_path(ccb->ccb_h.path);
 425                         printf("Lun already enabled\n");
 426                         ccb->ccb_h.status = CAM_LUN_ALRDY_ENA;
 427                         return;
 428                 }
 429                 if (cel->grp6_len != 0 || cel->grp7_len != 0) {
 430                         ccb->ccb_h.status = CAM_REQ_INVALID;
 431                         printf("Non-zero Group Codes\n");
 432                         return;
 433                 }
 434                 lstate = (struct sbp_targ_lstate *)
 435                     malloc(sizeof(*lstate), M_SBP_TARG, M_NOWAIT | M_ZERO);
 436                 if (lstate == NULL) {
 437                         xpt_print_path(ccb->ccb_h.path);
 438                         printf("Couldn't allocate lstate\n");
 439                         ccb->ccb_h.status = CAM_RESRC_UNAVAIL;
 440                         return;
 441                 } else {
 442                         if (debug)
 443                                 printf("%s: malloc'd lstate %p\n",__func__, lstate);
 444                 }
 445                 if (ccb->ccb_h.target_id == CAM_TARGET_WILDCARD) {
 446                         sc->black_hole = lstate;
 447                         if (debug)
 448                                 printf("Blackhole set due to target id == %d\n",
 449                                         ccb->ccb_h.target_id);
 450                 } else
 451                         sc->lstate[ccb->ccb_h.target_lun] = lstate;
 452
 453                 memset(lstate, 0, sizeof(*lstate));
 454                 lstate->sc = sc;
 455                 status = xpt_create_path(&lstate->path, /*periph*/NULL,
 456                                          xpt_path_path_id(ccb->ccb_h.path),
 457                                          xpt_path_target_id(ccb->ccb_h.path),
 458                                          xpt_path_lun_id(ccb->ccb_h.path));
 459                 if (status != CAM_REQ_CMP) {
 460                         free(lstate, M_SBP_TARG);
 461                         lstate = NULL;
 462                         xpt_print_path(ccb->ccb_h.path);
 463                         printf("Couldn't allocate path\n");
 464                         ccb->ccb_h.status = CAM_RESRC_UNAVAIL;
 465                         return;
 466                 }
 467                 SLIST_INIT(&lstate->accept_tios);
 468                 SLIST_INIT(&lstate->immed_notifies);
 469                 STAILQ_INIT(&lstate->logins);
 470
 471                 ccb->ccb_h.status = CAM_REQ_CMP;
 472                 xpt_print_path(ccb->ccb_h.path);
 473                 printf("Lun now enabled for target mode\n");
 474                 /* bus reset */
 475                 sc->fd.fc->ibr(sc->fd.fc);
 476         } else {
 477                 struct sbp_targ_login *login, *next;
 478
 479                 if (lstate == NULL) {
 480                         ccb->ccb_h.status = CAM_LUN_INVALID;
 481                         printf("Invalid lstate for this target\n");
 482                         return;
 483                 }
 484                 ccb->ccb_h.status = CAM_REQ_CMP;
 485
 486                 if (SLIST_FIRST(&lstate->accept_tios) != NULL) {
 487                         printf("ATIOs pending\n");
 488                         ccb->ccb_h.status = CAM_REQ_INVALID;
 489                 }
 490
 491                 if (SLIST_FIRST(&lstate->immed_notifies) != NULL) {
 492                         printf("INOTs pending\n");
 493                         ccb->ccb_h.status = CAM_REQ_INVALID;
 494                 }
 495
 496                 if (ccb->ccb_h.status != CAM_REQ_CMP) {
 497                         printf("status != CAM_REQ_CMP\n");
 498                         return;
 499                 }
 500
 501                 xpt_print_path(ccb->ccb_h.path);
 502                 printf("Target mode disabled\n");
 503                 xpt_free_path(lstate->path);
 504
 505                 for (login = STAILQ_FIRST(&lstate->logins); login != NULL;
 506                     login = next) {
 507                         next = STAILQ_NEXT(login, link);
 508                         sbp_targ_dealloc_login(login);
 509                 }
 510
 511                 if (ccb->ccb_h.target_id == CAM_TARGET_WILDCARD)
 512                         sc->black_hole = NULL;
 513                 else
 514                         sc->lstate[ccb->ccb_h.target_lun] = NULL;
 515                 if (debug)
 516                         printf("%s: free lstate %p\n", __func__, lstate);
 517                 free(lstate, M_SBP_TARG);
 518                 lstate = NULL;
 519
 520                 /* bus reset */
 521                 sc->fd.fc->ibr(sc->fd.fc);
 522         }
 523 }
 524
 525 static void
 526 sbp_targ_send_lstate_events(struct sbp_targ_softc *sc,
 527     struct sbp_targ_lstate *lstate)
 528 {
 529 #if 0
 530         struct ccb_hdr *ccbh;
 531         struct ccb_immediate_notify *inot;
 532
 533         printf("%s: not implemented yet\n", __func__);
 534 #endif
 535 }
 536
 537
 538 static __inline void
 539 sbp_targ_remove_orb_info_locked(struct sbp_targ_login *login, struct orb_info *orbi)
 540 {
 541         STAILQ_REMOVE(&login->orbs, orbi, orb_info, link);
 542 }
 543
 544 static __inline void
 545 sbp_targ_remove_orb_info(struct sbp_targ_login *login, struct orb_info *orbi)
 546 {
 547         SBP_LOCK(orbi->sc);
 548         STAILQ_REMOVE(&login->orbs, orbi, orb_info, link);
 549         SBP_UNLOCK(orbi->sc);
 550 }
 551
 552 /*
 553  * tag_id/init_id encoding
 554  *
 555  * tag_id and init_id has only 32bit for each.
 556  * scsi_target can handle very limited number(up to 15) of init_id.
 557  * we have to encode 48bit orb and 64bit EUI64 into these
 558  * variables.
 559  *
 560  * tag_id represents lower 32bit of ORB address.
 561  * init_id represents login_id.
 562  *
 563  */
 564
 565 static struct orb_info *
 566 sbp_targ_get_orb_info(struct sbp_targ_lstate *lstate,
 567     u_int tag_id, u_int init_id)
 568 {
 569         struct sbp_targ_login *login;
 570         struct orb_info *orbi;
 571
 572         login = lstate->sc->logins[init_id];
 573         if (login == NULL) {
 574                 printf("%s: no such login\n", __func__);
 575                 return (NULL);
 576         }
 577         STAILQ_FOREACH(orbi, &login->orbs, link)
 578                 if (orbi->orb_lo == tag_id)
 579                         goto found;
 580         printf("%s: orb not found tag_id=0x%08x init_id=%d\n",
 581                          __func__, tag_id, init_id);
 582         return (NULL);
 583 found:
 584         return (orbi);
 585 }
 586
 587 static void
 588 sbp_targ_abort(struct sbp_targ_softc *sc, struct orb_info *orbi)
 589 {
 590         struct orb_info *norbi;
 591
 592         SBP_LOCK(sc);
 593         for (; orbi != NULL; orbi = norbi) {
 594                 printf("%s: status=%d ccb=%p\n", __func__, orbi->state, orbi->ccb);
 595                 norbi = STAILQ_NEXT(orbi, link);
 596                 if (orbi->state != ORBI_STATUS_ABORTED) {
 597                         if (orbi->ccb != NULL) {
 598                                 orbi->ccb->ccb_h.status = CAM_REQ_ABORTED;
 599                                 xpt_done(orbi->ccb);
 600                                 orbi->ccb = NULL;
 601                         }
 602                         if (orbi->state <= ORBI_STATUS_ATIO) {
 603                                 sbp_targ_remove_orb_info_locked(orbi->login, orbi);
 604                                 if (debug)
 605                                         printf("%s: free orbi %p\n", __func__, orbi);
 606                                 free(orbi, M_SBP_TARG);
 607                                 orbi = NULL;
 608                         } else
 609                                 orbi->state = ORBI_STATUS_ABORTED;
 610                 }
 611         }
 612         SBP_UNLOCK(sc);
 613 }
 614
 615 static void
 616 sbp_targ_free_orbi(struct fw_xfer *xfer)
 617 {
 618         struct orb_info *orbi;
 619
 620         if (xfer->resp != 0) {
 621                 /* XXX */
 622                 printf("%s: xfer->resp = %d\n", __func__, xfer->resp);
 623         }
 624         orbi = (struct orb_info *)xfer->sc;
 625         if ( orbi->page_table != NULL ) {
 626                 if (debug)
 627                         printf("%s:  free orbi->page_table %p\n", __func__, orbi->page_table);
 628                 free(orbi->page_table, M_SBP_TARG);
 629                 orbi->page_table = NULL;
 630         }
 631         if (debug)
 632                 printf("%s: free orbi %p\n", __func__, orbi);
 633         free(orbi, M_SBP_TARG);
 634         orbi = NULL;
 635         fw_xfer_free(xfer);
 636 }
 637
 638 static void
 639 sbp_targ_status_FIFO(struct orb_info *orbi,
 640     uint32_t fifo_hi, uint32_t fifo_lo, int dequeue)
 641 {
 642         struct fw_xfer *xfer;
 643
 644         if (dequeue)
 645                 sbp_targ_remove_orb_info(orbi->login, orbi);
 646
 647         xfer = fwmem_write_block(orbi->fwdev, (void *)orbi,
 648             /*spd*/FWSPD_S400, fifo_hi, fifo_lo,
 649             sizeof(uint32_t) * (orbi->status.len + 1), (char *)&orbi->status,
 650             sbp_targ_free_orbi);
 651
 652         if (xfer == NULL) {
 653                 /* XXX */
 654                 printf("%s: xfer == NULL\n", __func__);
 655         }
 656 }
 657
 658 /*
 659  * Generate the appropriate CAM status for the
 660  * target.
 661  */
 662 static void
 663 sbp_targ_send_status(struct orb_info *orbi, union ccb *ccb)
 664 {
 665         struct sbp_status *sbp_status;
 666 #if     0
 667         struct orb_info *norbi;
 668 #endif
 669
 670         sbp_status = &orbi->status;
 671
 672         orbi->state = ORBI_STATUS_STATUS;
 673
 674         sbp_status->resp = 0; /* XXX */
 675         sbp_status->status = 0; /* XXX */
 676         sbp_status->dead = 0; /* XXX */
 677
 678         ccb->ccb_h.status= CAM_REQ_CMP;
 679
 680         switch (ccb->csio.scsi_status) {
 681         case SCSI_STATUS_OK:
 682                 if (debug)
 683                         printf("%s: STATUS_OK\n", __func__);
 684                 sbp_status->len = 1;
 685                 break;
 686         case SCSI_STATUS_CHECK_COND:
 687                 if (debug)
 688                         printf("%s: STATUS SCSI_STATUS_CHECK_COND\n", __func__);
 689                 goto process_scsi_status;
 690         case SCSI_STATUS_BUSY:
 691                 if (debug)
 692                         printf("%s: STATUS SCSI_STATUS_BUSY\n", __func__);
 693                 goto process_scsi_status;
 694         case SCSI_STATUS_CMD_TERMINATED:
 695 process_scsi_status:
 696         {
 697                 struct sbp_cmd_status *sbp_cmd_status;
 698                 struct scsi_sense_data *sense;
 699                 int error_code, sense_key, asc, ascq;
 700                 uint8_t stream_bits;
 701                 uint8_t sks[3];
 702                 uint64_t info;
 703                 int64_t sinfo;
 704                 int sense_len;
 705
 706                 sbp_cmd_status = (struct sbp_cmd_status *)&sbp_status->data[0];
 707                 sbp_cmd_status->status = ccb->csio.scsi_status;
 708                 sense = &ccb->csio.sense_data;
 709
 710 #if 0           /* XXX What we should do? */
 711 #if 0
 712                 sbp_targ_abort(orbi->sc, STAILQ_NEXT(orbi, link));
 713 #else
 714                 norbi = STAILQ_NEXT(orbi, link);
 715                 while (norbi) {
 716                         printf("%s: status=%d\n", __func__, norbi->state);
 717                         if (norbi->ccb != NULL) {
 718                                 norbi->ccb->ccb_h.status = CAM_REQ_ABORTED;
 719                                 xpt_done(norbi->ccb);
 720                                 norbi->ccb = NULL;
 721                         }
 722                         sbp_targ_remove_orb_info_locked(orbi->login, norbi);
 723                         norbi = STAILQ_NEXT(norbi, link);
 724                         free(norbi, M_SBP_TARG);
 725                 }
 726 #endif
 727 #endif
 728
 729                 sense_len = ccb->csio.sense_len - ccb->csio.sense_resid;
 730                 scsi_extract_sense_len(sense, sense_len, &error_code,
 731                     &sense_key, &asc, &ascq, /*show_errors*/ 0);
 732
 733                 switch (error_code) {
 734                 case SSD_CURRENT_ERROR:
 735                 case SSD_DESC_CURRENT_ERROR:
 736                         sbp_cmd_status->sfmt = SBP_SFMT_CURR;
 737                         break;
 738                 default:
 739                         sbp_cmd_status->sfmt = SBP_SFMT_DEFER;
 740                         break;
 741                 }
 742
 743                 if (scsi_get_sense_info(sense, sense_len, SSD_DESC_INFO, &info,
 744                                         &sinfo) == 0) {
 745                         uint32_t info_trunc;
 746                         sbp_cmd_status->valid = 1;
 747                         info_trunc = info;
 748
 749                         sbp_cmd_status->info = htobe32(info_trunc);
 750                 } else {
 751                         sbp_cmd_status->valid = 0;
 752                 }
 753
 754                 sbp_cmd_status->s_key = sense_key;
 755
 756                 if (scsi_get_stream_info(sense, sense_len, NULL,
 757                                          &stream_bits) == 0) {
 758                         sbp_cmd_status->mark =
 759                             (stream_bits & SSD_FILEMARK) ? 1 : 0;
 760                         sbp_cmd_status->eom =
 761                             (stream_bits & SSD_EOM) ? 1 : 0;
 762                         sbp_cmd_status->ill_len =
 763                             (stream_bits & SSD_ILI) ? 1 : 0;
 764                 } else {
 765                         sbp_cmd_status->mark = 0;
 766                         sbp_cmd_status->eom = 0;
 767                         sbp_cmd_status->ill_len = 0;
 768                 }
 769
 770
 771                 /* add_sense_code(_qual), info, cmd_spec_info */
 772                 sbp_status->len = 4;
 773
 774                 if (scsi_get_sense_info(sense, sense_len, SSD_DESC_COMMAND,
 775                                         &info, &sinfo) == 0) {
 776                         uint32_t cmdspec_trunc;
 777
 778                         cmdspec_trunc = info;
 779
 780                         sbp_cmd_status->cdb = htobe32(cmdspec_trunc);
 781                 }
 782
 783                 sbp_cmd_status->s_code = asc;
 784                 sbp_cmd_status->s_qlfr = ascq;
 785
 786                 if (scsi_get_sense_info(sense, sense_len, SSD_DESC_FRU, &info,
 787                                         &sinfo) == 0) {
 788                         sbp_cmd_status->fru = (uint8_t)info;
 789                         sbp_status->len = 5;
 790                 } else {
 791                         sbp_cmd_status->fru = 0;
 792                 }
 793
 794                 if (scsi_get_sks(sense, sense_len, sks) == 0) {
 795                         bcopy(sks, &sbp_cmd_status->s_keydep[0], sizeof(sks));
 796                         sbp_status->len = 5;
 797                         ccb->ccb_h.status |= CAM_SENT_SENSE;
 798                 }
 799
 800                 break;
 801         }
 802         default:
 803                 printf("%s: unknown scsi status 0x%x\n", __func__,
 804                     sbp_status->status);
 805         }
 806
 807
 808         sbp_targ_status_FIFO(orbi,
 809             orbi->login->fifo_hi, orbi->login->fifo_lo, /*dequeue*/1);
 810 }
 811
 812 /*
 813  * Invoked as a callback handler from fwmem_read/write_block
 814  *
 815  * Process read/write of initiator address space
 816  * completion and pass status onto the backend target.
 817  * If this is a partial read/write for a CCB then
 818  * we decrement the orbi's refcount to indicate
 819  * the status of the read/write is complete
 820  */
 821 static void
 822 sbp_targ_cam_done(struct fw_xfer *xfer)
 823 {
 824         struct orb_info *orbi;
 825         union ccb *ccb;
 826
 827         orbi = (struct orb_info *)xfer->sc;
 828
 829         if (debug)
 830                 printf("%s: resp=%d refcount=%d\n", __func__,
 831                         xfer->resp, orbi->refcount);
 832
 833         if (xfer->resp != 0) {
 834                 printf("%s: xfer->resp = %d\n", __func__, xfer->resp);
 835                 orbi->status.resp = SBP_TRANS_FAIL;
 836                 orbi->status.status = OBJ_DATA | SBE_TIMEOUT/*XXX*/;
 837                 orbi->status.dead = 1;
 838                 sbp_targ_abort(orbi->sc, STAILQ_NEXT(orbi, link));
 839         }
 840
 841         orbi->refcount--;
 842
 843         ccb = orbi->ccb;
 844         if (orbi->refcount == 0) {
 845                 orbi->ccb = NULL;
 846                 if (orbi->state == ORBI_STATUS_ABORTED) {
 847                         if (debug)
 848                                 printf("%s: orbi aborted\n", __func__);
 849                         sbp_targ_remove_orb_info(orbi->login, orbi);
 850                         if (orbi->page_table != NULL) {
 851                                 if (debug)
 852                                         printf("%s: free orbi->page_table %p\n",
 853                                                 __func__, orbi->page_table);
 854                                 free(orbi->page_table, M_SBP_TARG);
 855                         }
 856                         if (debug)
 857                                 printf("%s: free orbi %p\n", __func__, orbi);
 858                         free(orbi, M_SBP_TARG);
 859                         orbi = NULL;
 860                 } else if (orbi->status.resp == ORBI_STATUS_NONE) {
 861                         if ((ccb->ccb_h.flags & CAM_SEND_STATUS) != 0) {
 862                                 if (debug)
 863                                         printf("%s: CAM_SEND_STATUS set %0x\n", __func__, ccb->ccb_h.flags);
 864                                 sbp_targ_send_status(orbi, ccb);
 865                         } else {
 866                                 if (debug)
 867                                         printf("%s: CAM_SEND_STATUS not set %0x\n", __func__, ccb->ccb_h.flags);
 868                                 ccb->ccb_h.status = CAM_REQ_CMP;
 869                         }
 870                         xpt_done(ccb);
 871                 } else {
 872                         orbi->status.len = 1;
 873                         sbp_targ_status_FIFO(orbi,
 874                             orbi->login->fifo_hi, orbi->login->fifo_lo,
 875                             /*dequeue*/1);
 876                         ccb->ccb_h.status = CAM_REQ_ABORTED;
 877                         xpt_done(ccb);
 878                 }
 879         }
 880
 881         fw_xfer_free(xfer);
 882 }
 883
 884 static cam_status
 885 sbp_targ_abort_ccb(struct sbp_targ_softc *sc, union ccb *ccb)
 886 {
 887         union ccb *accb;
 888         struct sbp_targ_lstate *lstate;
 889         struct ccb_hdr_slist *list;
 890         struct ccb_hdr *curelm;
 891         int found;
 892         cam_status status;
 893
 894         status = sbp_targ_find_devs(sc, ccb, &lstate, 0);
 895         if (status != CAM_REQ_CMP)
 896                 return (status);
 897
 898         accb = ccb->cab.abort_ccb;
 899
 900         if (accb->ccb_h.func_code == XPT_ACCEPT_TARGET_IO)
 901                 list = &lstate->accept_tios;
 902         else if (accb->ccb_h.func_code == XPT_IMMEDIATE_NOTIFY)
 903                 list = &lstate->immed_notifies;
 904         else
 905                 return (CAM_UA_ABORT);
 906
 907         curelm = SLIST_FIRST(list);
 908         found = 0;
 909         if (curelm == &accb->ccb_h) {
 910                 found = 1;
 911                 SLIST_REMOVE_HEAD(list, sim_links.sle);
 912         } else {
 913                 while (curelm != NULL) {
 914                         struct ccb_hdr *nextelm;
 915
 916                         nextelm = SLIST_NEXT(curelm, sim_links.sle);
 917                         if (nextelm == &accb->ccb_h) {
 918                                 found = 1;
 919                                 SLIST_NEXT(curelm, sim_links.sle) =
 920                                     SLIST_NEXT(nextelm, sim_links.sle);
 921                                 break;
 922                         }
 923                         curelm = nextelm;
 924                 }
 925         }
 926         if (found) {
 927                 accb->ccb_h.status = CAM_REQ_ABORTED;
 928                 xpt_done(accb);
 929                 return (CAM_REQ_CMP);
 930         }
 931         printf("%s: not found\n", __func__);
 932         return (CAM_PATH_INVALID);
 933 }
 934
 935 /*
 936  * directly execute a read or write to the initiator
 937  * address space and set hand(sbp_targ_cam_done) to
 938  * process the completion from the SIM to the target.
 939  * set orbi->refcount to inidicate that a read/write
 940  * is inflight to/from the initiator.
 941  */
 942 static void
 943 sbp_targ_xfer_buf(struct orb_info *orbi, u_int offset,
 944     uint16_t dst_hi, uint32_t dst_lo, u_int size,
 945     void (*hand)(struct fw_xfer *))
 946 {
 947         struct fw_xfer *xfer;
 948         u_int len, ccb_dir, off = 0;
 949         char *ptr;
 950
 951         if (debug > 1)
 952                 printf("%s: offset=%d size=%d\n", __func__, offset, size);
 953         ccb_dir = orbi->ccb->ccb_h.flags & CAM_DIR_MASK;
 954         ptr = (char *)orbi->ccb->csio.data_ptr + offset;
 955
 956         while (size > 0) {
 957                 /* XXX assume dst_lo + off doesn't overflow */
 958                 len = MIN(size, 2048 /* XXX */);
 959                 size -= len;
 960                 orbi->refcount ++;
 961                 if (ccb_dir == CAM_DIR_OUT) {
 962                         if (debug)
 963                                 printf("%s: CAM_DIR_OUT --> read block in?\n",__func__);
 964                         xfer = fwmem_read_block(orbi->fwdev,
 965                            (void *)orbi, /*spd*/FWSPD_S400,
 966                             dst_hi, dst_lo + off, len,
 967                             ptr + off, hand);
 968                 } else {
 969                         if (debug)
 970                                 printf("%s: CAM_DIR_IN --> write block out?\n",__func__);
 971                         xfer = fwmem_write_block(orbi->fwdev,
 972                            (void *)orbi, /*spd*/FWSPD_S400,
 973                             dst_hi, dst_lo + off, len,
 974                             ptr + off, hand);
 975                 }
 976                 if (xfer == NULL) {
 977                         printf("%s: xfer == NULL", __func__);
 978                         /* XXX what should we do?? */
 979                         orbi->refcount--;
 980                 }
 981                 off += len;
 982         }
 983 }
 984
 985 static void
 986 sbp_targ_pt_done(struct fw_xfer *xfer)
 987 {
 988         struct orb_info *orbi;
 989         struct unrestricted_page_table_fmt *pt;
 990         uint32_t i;
 991
 992         orbi = (struct orb_info *)xfer->sc;
 993
 994         if (orbi->state == ORBI_STATUS_ABORTED) {
 995                 if (debug)
 996                         printf("%s: orbi aborted\n", __func__);
 997                 sbp_targ_remove_orb_info(orbi->login, orbi);
 998                 if (debug) {
 999                         printf("%s: free orbi->page_table %p\n", __func__, orbi->page_table);
1000                         printf("%s: free orbi %p\n", __func__, orbi);
1001                 }
1002                 free(orbi->page_table, M_SBP_TARG);
1003                 free(orbi, M_SBP_TARG);
1004                 orbi = NULL;
1005                 fw_xfer_free(xfer);
1006                 return;
1007         }
1008         if (xfer->resp != 0) {
1009                 printf("%s: xfer->resp = %d\n", __func__, xfer->resp);
1010                 orbi->status.resp = SBP_TRANS_FAIL;
1011                 orbi->status.status = OBJ_PT | SBE_TIMEOUT/*XXX*/;
1012                 orbi->status.dead = 1;
1013                 orbi->status.len = 1;
1014                 sbp_targ_abort(orbi->sc, STAILQ_NEXT(orbi, link));
1015
1016                 if (debug)
1017                         printf("%s: free orbi->page_table %p\n", __func__, orbi->page_table);
1018
1019                 sbp_targ_status_FIFO(orbi,
1020                     orbi->login->fifo_hi, orbi->login->fifo_lo, /*dequeue*/1);
1021                 free(orbi->page_table, M_SBP_TARG);
1022                 orbi->page_table = NULL;
1023                 fw_xfer_free(xfer);
1024                 return;
1025         }
1026         orbi->refcount++;
1027 /*
1028  * Set endianness here so we don't have
1029  * to deal with is later
1030  */
1031         for (i = 0, pt = orbi->page_table; i < orbi->orb4.data_size; i++, pt++) {
1032                 pt->segment_len = ntohs(pt->segment_len);
1033                 if (debug)
1034                         printf("%s:segment_len = %u\n", __func__,pt->segment_len);
1035                 pt->segment_base_high = ntohs(pt->segment_base_high);
1036                 pt->segment_base_low = ntohl(pt->segment_base_low);
1037         }
1038
1039         sbp_targ_xfer_pt(orbi);
1040
1041         orbi->refcount--;
1042         if (orbi->refcount == 0)
1043                 printf("%s: refcount == 0\n", __func__);
1044
1045         fw_xfer_free(xfer);
1046         return;
1047 }
1048
1049 static void sbp_targ_xfer_pt(struct orb_info *orbi)
1050 {
1051         union ccb *ccb;
1052         uint32_t res, offset, len;
1053
1054         ccb = orbi->ccb;
1055         if (debug)
1056                 printf("%s: dxfer_len=%d\n", __func__, ccb->csio.dxfer_len);
1057         res = ccb->csio.dxfer_len;
1058         /*
1059          * If the page table required multiple CTIO's to
1060          * complete, then cur_pte is non NULL
1061          * and we need to start from the last position
1062          * If this is the first pass over a page table
1063          * then we just start at the beginning of the page
1064          * table.
1065          *
1066          * Parse the unrestricted page table and figure out where we need
1067          * to shove the data from this read request.
1068          */
1069         for (offset = 0, len = 0; (res != 0) && (orbi->cur_pte < orbi->last_pte); offset += len) {
1070                 len = MIN(orbi->cur_pte->segment_len, res);
1071                 res -= len;
1072                 if (debug)
1073                         printf("%s:page_table: %04x:%08x segment_len(%u) res(%u) len(%u)\n",
1074                                 __func__, orbi->cur_pte->segment_base_high,
1075                                 orbi->cur_pte->segment_base_low,
1076                                 orbi->cur_pte->segment_len,
1077                                 res, len);
1078                 sbp_targ_xfer_buf(orbi, offset,
1079                                 orbi->cur_pte->segment_base_high,
1080                                 orbi->cur_pte->segment_base_low,
1081                                 len, sbp_targ_cam_done);
1082                 /*
1083                  * If we have only written partially to
1084                  * this page table, then we need to save
1085                  * our position for the next CTIO.  If we
1086                  * have completed the page table, then we
1087                  * are safe to move on to the next entry.
1088                  */
1089                 if (len == orbi->cur_pte->segment_len) {
1090                         orbi->cur_pte++;
1091                 } else {
1092                         uint32_t saved_base_low;
1093
1094                         /* Handle transfers that cross a 4GB boundary. */
1095                         saved_base_low = orbi->cur_pte->segment_base_low;
1096                         orbi->cur_pte->segment_base_low += len;
1097                         if (orbi->cur_pte->segment_base_low < saved_base_low)
1098                                 orbi->cur_pte->segment_base_high++;
1099
1100                         orbi->cur_pte->segment_len -= len;
1101                 }
1102         }
1103         if (debug) {
1104                 printf("%s: base_low(%08x) page_table_off(%p) last_block(%u)\n",
1105                         __func__, orbi->cur_pte->segment_base_low,
1106                         orbi->cur_pte, orbi->last_block_read);
1107         }
1108         if (res != 0)
1109                 printf("Warning - short pt encountered.  "
1110                         "Could not transfer all data.\n");
1111         return;
1112 }
1113
1114 /*
1115  * Create page table in local memory
1116  * and transfer it from the initiator
1117  * in order to know where we are supposed
1118  * to put the data.
1119  */
1120
1121 static void
1122 sbp_targ_fetch_pt(struct orb_info *orbi)
1123 {
1124         struct fw_xfer *xfer;
1125
1126         /*
1127          * Pull in page table from initiator
1128          * and setup for data from our
1129          * backend device.
1130          */
1131         if (orbi->page_table == NULL) {
1132                 orbi->page_table = malloc(orbi->orb4.data_size*
1133                                           sizeof(struct unrestricted_page_table_fmt),
1134                                           M_SBP_TARG, M_NOWAIT|M_ZERO);
1135                 if (orbi->page_table == NULL)
1136                         goto error;
1137                 orbi->cur_pte = orbi->page_table;
1138                 orbi->last_pte = orbi->page_table + orbi->orb4.data_size;
1139                 orbi->last_block_read = orbi->orb4.data_size;
1140                 if (debug && orbi->page_table != NULL)
1141                         printf("%s: malloc'd orbi->page_table(%p), orb4.data_size(%u)\n",
1142                                 __func__, orbi->page_table, orbi->orb4.data_size);
1143
1144                 xfer = fwmem_read_block(orbi->fwdev, (void *)orbi, /*spd*/FWSPD_S400,
1145                                         orbi->data_hi, orbi->data_lo, orbi->orb4.data_size*
1146                                         sizeof(struct unrestricted_page_table_fmt),
1147                                         (void *)orbi->page_table, sbp_targ_pt_done);
1148
1149                 if (xfer != NULL)
1150                         return;
1151         } else {
1152                 /*
1153                  * This is a CTIO for a page table we have
1154                  * already malloc'd, so just directly invoke
1155                  * the xfer function on the orbi.
1156                  */
1157                 sbp_targ_xfer_pt(orbi);
1158                 return;
1159         }
1160 error:
1161         orbi->ccb->ccb_h.status = CAM_RESRC_UNAVAIL;
1162         if (debug)
1163                 printf("%s: free orbi->page_table %p due to xfer == NULL\n", __func__, orbi->page_table);
1164         if (orbi->page_table != NULL) {
1165                 free(orbi->page_table, M_SBP_TARG);
1166                 orbi->page_table = NULL;
1167         }
1168         xpt_done(orbi->ccb);
1169         return;
1170 }
1171
1172 static void
1173 sbp_targ_action1(struct cam_sim *sim, union ccb *ccb)
1174 {
1175         struct sbp_targ_softc *sc;
1176         struct sbp_targ_lstate *lstate;
1177         cam_status status;
1178         u_int ccb_dir;
1179
1180         sc =  (struct sbp_targ_softc *)cam_sim_softc(sim);
1181
1182         status = sbp_targ_find_devs(sc, ccb, &lstate, TRUE);
1183
1184         switch (ccb->ccb_h.func_code) {
1185         case XPT_CONT_TARGET_IO:
1186         {
1187                 struct orb_info *orbi;
1188
1189                 if (debug)
1190                         printf("%s: XPT_CONT_TARGET_IO (0x%08x)\n",
1191                                          __func__, ccb->csio.tag_id);
1192
1193                 if (status != CAM_REQ_CMP) {
1194                         ccb->ccb_h.status = status;
1195                         xpt_done(ccb);
1196                         break;
1197                 }
1198                 /* XXX transfer from/to initiator */
1199                 orbi = sbp_targ_get_orb_info(lstate,
1200                     ccb->csio.tag_id, ccb->csio.init_id);
1201                 if (orbi == NULL) {
1202                         ccb->ccb_h.status = CAM_REQ_ABORTED; /* XXX */
1203                         xpt_done(ccb);
1204                         break;
1205                 }
1206                 if (orbi->state == ORBI_STATUS_ABORTED) {
1207                         if (debug)
1208                                 printf("%s: ctio aborted\n", __func__);
1209                         sbp_targ_remove_orb_info_locked(orbi->login, orbi);
1210                         if (debug)
1211                                 printf("%s: free orbi %p\n", __func__, orbi);
1212                         free(orbi, M_SBP_TARG);
1213                         ccb->ccb_h.status = CAM_REQ_ABORTED;
1214                         xpt_done(ccb);
1215                         break;
1216                 }
1217                 orbi->state = ORBI_STATUS_CTIO;
1218
1219                 orbi->ccb = ccb;
1220                 ccb_dir = ccb->ccb_h.flags & CAM_DIR_MASK;
1221
1222                 /* XXX */
1223                 if (ccb->csio.dxfer_len == 0)
1224                         ccb_dir = CAM_DIR_NONE;
1225
1226                 /* Sanity check */
1227                 if (ccb_dir == CAM_DIR_IN && orbi->orb4.dir == 0)
1228                         printf("%s: direction mismatch\n", __func__);
1229
1230                 /* check page table */
1231                 if (ccb_dir != CAM_DIR_NONE && orbi->orb4.page_table_present) {
1232                         if (debug)
1233                                 printf("%s: page_table_present\n",
1234                                     __func__);
1235                         if (orbi->orb4.page_size != 0) {
1236                                 printf("%s: unsupported pagesize %d != 0\n",
1237                                     __func__, orbi->orb4.page_size);
1238                                 ccb->ccb_h.status = CAM_REQ_INVALID;
1239                                 xpt_done(ccb);
1240                                 break;
1241                         }
1242                         sbp_targ_fetch_pt(orbi);
1243                         break;
1244                 }
1245
1246                 /* Sanity check */
1247                 if (ccb_dir != CAM_DIR_NONE) {
1248                         sbp_targ_xfer_buf(orbi, 0, orbi->data_hi,
1249                             orbi->data_lo,
1250                             MIN(orbi->orb4.data_size, ccb->csio.dxfer_len),
1251                             sbp_targ_cam_done);
1252                         if ( orbi->orb4.data_size > ccb->csio.dxfer_len ) {
1253                                 orbi->data_lo += ccb->csio.dxfer_len;
1254                                 orbi->orb4.data_size -= ccb->csio.dxfer_len;
1255                         }
1256                 }
1257
1258                 if (ccb_dir == CAM_DIR_NONE) {
1259                         if ((ccb->ccb_h.flags & CAM_SEND_STATUS) != 0) {
1260                                 /* XXX */
1261                                 SBP_UNLOCK(sc);
1262                                 sbp_targ_send_status(orbi, ccb);
1263                                 SBP_LOCK(sc);
1264                         }
1265                         ccb->ccb_h.status = CAM_REQ_CMP;
1266                         xpt_done(ccb);
1267                 }
1268                 break;
1269         }
1270         case XPT_ACCEPT_TARGET_IO:      /* Add Accept Target IO Resource */
1271                 if (status != CAM_REQ_CMP) {
1272                         ccb->ccb_h.status = status;
1273                         xpt_done(ccb);
1274                         break;
1275                 }
1276                 SLIST_INSERT_HEAD(&lstate->accept_tios, &ccb->ccb_h,
1277                     sim_links.sle);
1278                 ccb->ccb_h.status = CAM_REQ_INPROG;
1279                 if ((lstate->flags & F_ATIO_STARVED) != 0) {
1280                         struct sbp_targ_login *login;
1281
1282                         if (debug)
1283                                 printf("%s: new atio arrived\n", __func__);
1284                         lstate->flags &= ~F_ATIO_STARVED;
1285                         STAILQ_FOREACH(login, &lstate->logins, link)
1286                                 if ((login->flags & F_ATIO_STARVED) != 0) {
1287                                         login->flags &= ~F_ATIO_STARVED;
1288                                         sbp_targ_fetch_orb(lstate->sc,
1289                                             login->fwdev,
1290                                             login->last_hi, login->last_lo,
1291                                             login, FETCH_CMD);
1292                                 }
1293                 }
1294                 break;
1295         case XPT_NOTIFY_ACKNOWLEDGE:    /* recycle notify ack */
1296         case XPT_IMMEDIATE_NOTIFY:      /* Add Immediate Notify Resource */
1297                 if (status != CAM_REQ_CMP) {
1298                         ccb->ccb_h.status = status;
1299                         xpt_done(ccb);
1300                         break;
1301                 }
1302                 SLIST_INSERT_HEAD(&lstate->immed_notifies, &ccb->ccb_h,
1303                     sim_links.sle);
1304                 ccb->ccb_h.status = CAM_REQ_INPROG;
1305                 sbp_targ_send_lstate_events(sc, lstate);
1306                 break;
1307         case XPT_EN_LUN:
1308                 sbp_targ_en_lun(sc, ccb);
1309                 xpt_done(ccb);
1310                 break;
1311         case XPT_PATH_INQ:
1312         {
1313                 struct ccb_pathinq *cpi = &ccb->cpi;
1314
1315                 cpi->version_num = 1; /* XXX??? */
1316                 cpi->hba_inquiry = PI_TAG_ABLE;
1317                 cpi->target_sprt = PIT_PROCESSOR
1318                                  | PIT_DISCONNECT
1319                                  | PIT_TERM_IO;
1320                 cpi->transport = XPORT_SPI; /* FIXME add XPORT_FW type to cam */
1321                 cpi->hba_misc = PIM_NOINITIATOR | PIM_NOBUSRESET |
1322                     PIM_NO_6_BYTE;
1323                 cpi->hba_eng_cnt = 0;
1324                 cpi->max_target = 7; /* XXX */
1325                 cpi->max_lun = MAX_LUN - 1;
1326                 cpi->initiator_id = 7; /* XXX */
1327                 cpi->bus_id = sim->bus_id;
1328                 cpi->base_transfer_speed = 400 * 1000 / 8;
1329                 strlcpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
1330                 strlcpy(cpi->hba_vid, "SBP_TARG", HBA_IDLEN);
1331                 strlcpy(cpi->dev_name, sim->sim_name, DEV_IDLEN);
1332                 cpi->unit_number = sim->unit_number;
1333
1334                 cpi->ccb_h.status = CAM_REQ_CMP;
1335                 xpt_done(ccb);
1336                 break;
1337         }
1338         case XPT_ABORT:
1339         {
1340                 union ccb *accb = ccb->cab.abort_ccb;
1341
1342                 switch (accb->ccb_h.func_code) {
1343                 case XPT_ACCEPT_TARGET_IO:
1344                 case XPT_IMMEDIATE_NOTIFY:
1345                         ccb->ccb_h.status = sbp_targ_abort_ccb(sc, ccb);
1346                         break;
1347                 case XPT_CONT_TARGET_IO:
1348                         /* XXX */
1349                         ccb->ccb_h.status = CAM_UA_ABORT;
1350                         break;
1351                 default:
1352                         printf("%s: aborting unknown function %d\n",
1353                                 __func__, accb->ccb_h.func_code);
1354                         ccb->ccb_h.status = CAM_REQ_INVALID;
1355                         break;
1356                 }
1357                 xpt_done(ccb);
1358                 break;
1359         }
1360 #ifdef CAM_NEW_TRAN_CODE
1361         case XPT_SET_TRAN_SETTINGS:
1362                 ccb->ccb_h.status = CAM_REQ_INVALID;
1363                 xpt_done(ccb);
1364                 break;
1365         case XPT_GET_TRAN_SETTINGS:
1366         {
1367                 struct ccb_trans_settings *cts = &ccb->cts;
1368                 struct ccb_trans_settings_scsi *scsi =
1369                         &cts->proto_specific.scsi;
1370                 struct ccb_trans_settings_spi *spi =
1371                         &cts->xport_specific.spi;
1372
1373                 cts->protocol = PROTO_SCSI;
1374                 cts->protocol_version = SCSI_REV_2;
1375                 cts->transport = XPORT_FW;     /* should have a FireWire */
1376                 cts->transport_version = 2;
1377                 spi->valid = CTS_SPI_VALID_DISC;
1378                 spi->flags = CTS_SPI_FLAGS_DISC_ENB;
1379                 scsi->valid = CTS_SCSI_VALID_TQ;
1380                 scsi->flags = CTS_SCSI_FLAGS_TAG_ENB;
1381 #if 0
1382                 printf("%s:%d:%d XPT_GET_TRAN_SETTINGS:\n",
1383                         device_get_nameunit(sc->fd.dev),
1384                         ccb->ccb_h.target_id, ccb->ccb_h.target_lun);
1385 #endif
1386                 cts->ccb_h.status = CAM_REQ_CMP;
1387                 xpt_done(ccb);
1388                 break;
1389         }
1390 #endif
1391
1392         default:
1393                 printf("%s: unknown function 0x%x\n",
1394                     __func__, ccb->ccb_h.func_code);
1395                 ccb->ccb_h.status = CAM_PROVIDE_FAIL;
1396                 xpt_done(ccb);
1397                 break;
1398         }
1399         return;
1400 }
1401
1402 static void
1403 sbp_targ_action(struct cam_sim *sim, union ccb *ccb)
1404 {
1405         int s;
1406
1407         s = splfw();
1408         sbp_targ_action1(sim, ccb);
1409         splx(s);
1410 }
1411
1412 static void
1413 sbp_targ_poll(struct cam_sim *sim)
1414 {
1415         /* XXX */
1416         return;
1417 }
1418
1419 static void
1420 sbp_targ_cmd_handler(struct fw_xfer *xfer)
1421 {
1422         struct fw_pkt *fp;
1423         uint32_t *orb;
1424         struct corb4 *orb4;
1425         struct orb_info *orbi;
1426         struct ccb_accept_tio *atio;
1427         u_char *bytes;
1428         int i;
1429
1430         orbi = (struct orb_info *)xfer->sc;
1431         if (xfer->resp != 0) {
1432                 printf("%s: xfer->resp = %d\n", __func__, xfer->resp);
1433                 orbi->status.resp = SBP_TRANS_FAIL;
1434                 orbi->status.status = OBJ_ORB | SBE_TIMEOUT/*XXX*/;
1435                 orbi->status.dead = 1;
1436                 orbi->status.len = 1;
1437                 sbp_targ_abort(orbi->sc, STAILQ_NEXT(orbi, link));
1438
1439                 sbp_targ_status_FIFO(orbi,
1440                     orbi->login->fifo_hi, orbi->login->fifo_lo, /*dequeue*/1);
1441                 fw_xfer_free(xfer);
1442                 return;
1443         }
1444         fp = &xfer->recv.hdr;
1445
1446         atio = orbi->atio;
1447
1448         if (orbi->state == ORBI_STATUS_ABORTED) {
1449                 printf("%s: aborted\n", __func__);
1450                 sbp_targ_remove_orb_info(orbi->login, orbi);
1451                 free(orbi, M_SBP_TARG);
1452                 atio->ccb_h.status = CAM_REQ_ABORTED;
1453                 xpt_done((union ccb*)atio);
1454                 goto done0;
1455         }
1456         orbi->state = ORBI_STATUS_ATIO;
1457
1458         orb = orbi->orb;
1459         /* swap payload except SCSI command */
1460         for (i = 0; i < 5; i++)
1461                 orb[i] = ntohl(orb[i]);
1462
1463         orb4 = (struct corb4 *)&orb[4];
1464         if (orb4->rq_fmt != 0) {
1465                 /* XXX */
1466                 printf("%s: rq_fmt(%d) != 0\n", __func__, orb4->rq_fmt);
1467         }
1468
1469         atio->ccb_h.target_id = 0; /* XXX */
1470         atio->ccb_h.target_lun = orbi->login->lstate->lun;
1471         atio->sense_len = 0;
1472         atio->tag_action = MSG_SIMPLE_TASK;
1473         atio->tag_id = orbi->orb_lo;
1474         atio->init_id = orbi->login->id;
1475
1476         atio->ccb_h.flags |= CAM_TAG_ACTION_VALID;
1477         bytes = (u_char *)&orb[5];
1478         if (debug)
1479                 printf("%s: %p %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x\n",
1480                     __func__, (void *)atio,
1481                     bytes[0], bytes[1], bytes[2], bytes[3], bytes[4],
1482                     bytes[5], bytes[6], bytes[7], bytes[8], bytes[9]);
1483         switch (bytes[0] >> 5) {
1484         case 0:
1485                 atio->cdb_len = 6;
1486                 break;
1487         case 1:
1488         case 2:
1489                 atio->cdb_len = 10;
1490                 break;
1491         case 4:
1492                 atio->cdb_len = 16;
1493                 break;
1494         case 5:
1495                 atio->cdb_len = 12;
1496                 break;
1497         case 3:
1498         default:
1499                 /* Only copy the opcode. */
1500                 atio->cdb_len = 1;
1501                 printf("Reserved or VU command code type encountered\n");
1502                 break;
1503         }
1504
1505         memcpy(atio->cdb_io.cdb_bytes, bytes, atio->cdb_len);
1506
1507         atio->ccb_h.status |= CAM_CDB_RECVD;
1508
1509         /* next ORB */
1510         if ((orb[0] & (1<<31)) == 0) {
1511                 if (debug)
1512                         printf("%s: fetch next orb\n", __func__);
1513                 orbi->status.src = SRC_NEXT_EXISTS;
1514                 sbp_targ_fetch_orb(orbi->sc, orbi->fwdev,
1515                     orb[0], orb[1], orbi->login, FETCH_CMD);
1516         } else {
1517                 orbi->status.src = SRC_NO_NEXT;
1518                 orbi->login->flags &= ~F_LINK_ACTIVE;
1519         }
1520
1521         orbi->data_hi = orb[2];
1522         orbi->data_lo = orb[3];
1523         orbi->orb4 = *orb4;
1524
1525         xpt_done((union ccb*)atio);
1526 done0:
1527         fw_xfer_free(xfer);
1528         return;
1529 }
1530
1531 static struct sbp_targ_login *
1532 sbp_targ_get_login(struct sbp_targ_softc *sc, struct fw_device *fwdev, int lun)
1533 {
1534         struct sbp_targ_lstate *lstate;
1535         struct sbp_targ_login *login;
1536         int i;
1537
1538         lstate = sc->lstate[lun];
1539
1540         STAILQ_FOREACH(login, &lstate->logins, link)
1541                 if (login->fwdev == fwdev)
1542                         return (login);
1543
1544         for (i = 0; i < MAX_LOGINS; i++)
1545                 if (sc->logins[i] == NULL)
1546                         goto found;
1547
1548         printf("%s: increase MAX_LOGIN\n", __func__);
1549         return (NULL);
1550
1551 found:
1552         login = (struct sbp_targ_login *)malloc(
1553             sizeof(struct sbp_targ_login), M_SBP_TARG, M_NOWAIT | M_ZERO);
1554
1555         if (login == NULL) {
1556                 printf("%s: malloc failed\n", __func__);
1557                 return (NULL);
1558         }
1559
1560         login->id = i;
1561         login->fwdev = fwdev;
1562         login->lstate = lstate;
1563         login->last_hi = 0xffff;
1564         login->last_lo = 0xffffffff;
1565         login->hold_sec = 1;
1566         STAILQ_INIT(&login->orbs);
1567         CALLOUT_INIT(&login->hold_callout);
1568         sc->logins[i] = login;
1569         return (login);
1570 }
1571
1572 static void
1573 sbp_targ_mgm_handler(struct fw_xfer *xfer)
1574 {
1575         struct sbp_targ_lstate *lstate;
1576         struct sbp_targ_login *login;
1577         struct fw_pkt *fp;
1578         uint32_t *orb;
1579         struct morb4 *orb4;
1580         struct orb_info *orbi;
1581         int i;
1582
1583         orbi = (struct orb_info *)xfer->sc;
1584         if (xfer->resp != 0) {
1585                 printf("%s: xfer->resp = %d\n", __func__, xfer->resp);
1586                 orbi->status.resp = SBP_TRANS_FAIL;
1587                 orbi->status.status = OBJ_ORB | SBE_TIMEOUT/*XXX*/;
1588                 orbi->status.dead = 1;
1589                 orbi->status.len = 1;
1590                 sbp_targ_abort(orbi->sc, STAILQ_NEXT(orbi, link));
1591
1592                 sbp_targ_status_FIFO(orbi,
1593                     orbi->login->fifo_hi, orbi->login->fifo_lo, /*dequeue*/0);
1594                 fw_xfer_free(xfer);
1595                 return;
1596         }
1597         fp = &xfer->recv.hdr;
1598
1599         orb = orbi->orb;
1600         /* swap payload */
1601         for (i = 0; i < 8; i++) {
1602                 orb[i] = ntohl(orb[i]);
1603         }
1604         orb4 = (struct morb4 *)&orb[4];
1605         if (debug)
1606                 printf("%s: %s\n", __func__, orb_fun_name[orb4->fun]);
1607
1608         orbi->status.src = SRC_NO_NEXT;
1609
1610         switch (orb4->fun << 16) {
1611         case ORB_FUN_LGI:
1612         {
1613                 int exclusive = 0, lun;
1614
1615                 if (orb[4] & ORB_EXV)
1616                         exclusive = 1;
1617
1618                 lun = orb4->id;
1619                 lstate = orbi->sc->lstate[lun];
1620
1621                 if (lun >= MAX_LUN || lstate == NULL ||
1622                     (exclusive &&
1623                     STAILQ_FIRST(&lstate->logins) != NULL &&
1624                     STAILQ_FIRST(&lstate->logins)->fwdev != orbi->fwdev)
1625                    ) {
1626                         /* error */
1627                         orbi->status.dead = 1;
1628                         orbi->status.status = STATUS_ACCESS_DENY;
1629                         orbi->status.len = 1;
1630                         break;
1631                 }
1632
1633                 /* allocate login */
1634                 login = sbp_targ_get_login(orbi->sc, orbi->fwdev, lun);
1635                 if (login == NULL) {
1636                         printf("%s: sbp_targ_get_login failed\n",
1637                             __func__);
1638                         orbi->status.dead = 1;
1639                         orbi->status.status = STATUS_RES_UNAVAIL;
1640                         orbi->status.len = 1;
1641                         break;
1642                 }
1643                 printf("%s: login id=%d\n", __func__, login->id);
1644
1645                 login->fifo_hi = orb[6];
1646                 login->fifo_lo = orb[7];
1647                 login->loginres.len = htons(sizeof(uint32_t) * 4);
1648                 login->loginres.id = htons(login->id);
1649                 login->loginres.cmd_hi = htons(SBP_TARG_BIND_HI);
1650                 login->loginres.cmd_lo = htonl(SBP_TARG_BIND_LO(login->id));
1651                 login->loginres.recon_hold = htons(login->hold_sec);
1652
1653                 STAILQ_INSERT_TAIL(&lstate->logins, login, link);
1654                 fwmem_write_block(orbi->fwdev, NULL, /*spd*/FWSPD_S400, orb[2], orb[3],
1655                     sizeof(struct sbp_login_res), (void *)&login->loginres,
1656                     fw_asy_callback_free);
1657                 /* XXX return status after loginres is successfully written */
1658                 break;
1659         }
1660         case ORB_FUN_RCN:
1661                 login = orbi->sc->logins[orb4->id];
1662                 if (login != NULL && login->fwdev == orbi->fwdev) {
1663                         login->flags &= ~F_HOLD;
1664                         callout_stop(&login->hold_callout);
1665                         printf("%s: reconnected id=%d\n",
1666                             __func__, login->id);
1667                 } else {
1668                         orbi->status.dead = 1;
1669                         orbi->status.status = STATUS_ACCESS_DENY;
1670                         printf("%s: reconnection faild id=%d\n",
1671                             __func__, orb4->id);
1672                 }
1673                 break;
1674         case ORB_FUN_LGO:
1675                 login = orbi->sc->logins[orb4->id];
1676                 if (login->fwdev != orbi->fwdev) {
1677                         printf("%s: wrong initiator\n", __func__);
1678                         break;
1679                 }
1680                 sbp_targ_dealloc_login(login);
1681                 break;
1682         default:
1683                 printf("%s: %s not implemented yet\n",
1684                     __func__, orb_fun_name[orb4->fun]);
1685                 break;
1686         }
1687         orbi->status.len = 1;
1688         sbp_targ_status_FIFO(orbi, orb[6], orb[7], /*dequeue*/0);
1689         fw_xfer_free(xfer);
1690         return;
1691 }
1692
1693 static void
1694 sbp_targ_pointer_handler(struct fw_xfer *xfer)
1695 {
1696         struct orb_info *orbi;
1697         uint32_t orb0, orb1;
1698
1699         orbi = (struct orb_info *)xfer->sc;
1700         if (xfer->resp != 0) {
1701                 printf("%s: xfer->resp = %d\n", __func__, xfer->resp);
1702                 goto done;
1703         }
1704
1705         orb0 = ntohl(orbi->orb[0]);
1706         orb1 = ntohl(orbi->orb[1]);
1707         if ((orb0 & (1U << 31)) != 0) {
1708                 printf("%s: invalid pointer\n", __func__);
1709                 goto done;
1710         }
1711         sbp_targ_fetch_orb(orbi->login->lstate->sc, orbi->fwdev,
1712             (uint16_t)orb0, orb1, orbi->login, FETCH_CMD);
1713 done:
1714         free(orbi, M_SBP_TARG);
1715         fw_xfer_free(xfer);
1716         return;
1717 }
1718
1719 static void
1720 sbp_targ_fetch_orb(struct sbp_targ_softc *sc, struct fw_device *fwdev,
1721     uint16_t orb_hi, uint32_t orb_lo, struct sbp_targ_login *login,
1722     int mode)
1723 {
1724         struct orb_info *orbi;
1725
1726         if (debug)
1727                 printf("%s: fetch orb %04x:%08x\n", __func__, orb_hi, orb_lo);
1728         orbi = malloc(sizeof(struct orb_info), M_SBP_TARG, M_NOWAIT | M_ZERO);
1729         if (orbi == NULL) {
1730                 printf("%s: malloc failed\n", __func__);
1731                 return;
1732         }
1733         orbi->sc = sc;
1734         orbi->fwdev = fwdev;
1735         orbi->login = login;
1736         orbi->orb_hi = orb_hi;
1737         orbi->orb_lo = orb_lo;
1738         orbi->status.orb_hi = htons(orb_hi);
1739         orbi->status.orb_lo = htonl(orb_lo);
1740         orbi->page_table = NULL;
1741
1742         switch (mode) {
1743         case FETCH_MGM:
1744                 fwmem_read_block(fwdev, (void *)orbi, /*spd*/FWSPD_S400, orb_hi, orb_lo,
1745                     sizeof(uint32_t) * 8, &orbi->orb[0],
1746                     sbp_targ_mgm_handler);
1747                 break;
1748         case FETCH_CMD:
1749                 orbi->state = ORBI_STATUS_FETCH;
1750                 login->last_hi = orb_hi;
1751                 login->last_lo = orb_lo;
1752                 login->flags |= F_LINK_ACTIVE;
1753                 /* dequeue */
1754                 SBP_LOCK(sc);
1755                 orbi->atio = (struct ccb_accept_tio *)
1756                     SLIST_FIRST(&login->lstate->accept_tios);
1757                 if (orbi->atio == NULL) {
1758                         SBP_UNLOCK(sc);
1759                         printf("%s: no free atio\n", __func__);
1760                         login->lstate->flags |= F_ATIO_STARVED;
1761                         login->flags |= F_ATIO_STARVED;
1762 #if 0
1763                         /* XXX ?? */
1764                         login->fwdev = fwdev;
1765 #endif
1766                         break;
1767                 }
1768                 SLIST_REMOVE_HEAD(&login->lstate->accept_tios, sim_links.sle);
1769                 STAILQ_INSERT_TAIL(&login->orbs, orbi, link);
1770                 SBP_UNLOCK(sc);
1771                 fwmem_read_block(fwdev, (void *)orbi, /*spd*/FWSPD_S400, orb_hi, orb_lo,
1772                     sizeof(uint32_t) * 8, &orbi->orb[0],
1773                     sbp_targ_cmd_handler);
1774                 break;
1775         case FETCH_POINTER:
1776                 orbi->state = ORBI_STATUS_POINTER;
1777                 login->flags |= F_LINK_ACTIVE;
1778                 fwmem_read_block(fwdev, (void *)orbi, /*spd*/FWSPD_S400, orb_hi, orb_lo,
1779                     sizeof(uint32_t) * 2, &orbi->orb[0],
1780                     sbp_targ_pointer_handler);
1781                 break;
1782         default:
1783                 printf("%s: invalid mode %d\n", __func__, mode);
1784         }
1785 }
1786
1787 static void
1788 sbp_targ_resp_callback(struct fw_xfer *xfer)
1789 {
1790         struct sbp_targ_softc *sc;
1791         int s;
1792
1793         if (debug)
1794                 printf("%s: xfer=%p\n", __func__, xfer);
1795         sc = (struct sbp_targ_softc *)xfer->sc;
1796         fw_xfer_unload(xfer);
1797         xfer->recv.pay_len = SBP_TARG_RECV_LEN;
1798         xfer->hand = sbp_targ_recv;
1799         s = splfw();
1800         STAILQ_INSERT_TAIL(&sc->fwb.xferlist, xfer, link);
1801         splx(s);
1802 }
1803
1804 static int
1805 sbp_targ_cmd(struct fw_xfer *xfer, struct fw_device *fwdev, int login_id,
1806     int reg)
1807 {
1808         struct sbp_targ_login *login;
1809         struct sbp_targ_softc *sc;
1810         int rtcode = 0;
1811
1812         if (login_id < 0 || login_id >= MAX_LOGINS)
1813                 return (RESP_ADDRESS_ERROR);
1814
1815         sc = (struct sbp_targ_softc *)xfer->sc;
1816         login = sc->logins[login_id];
1817         if (login == NULL)
1818                 return (RESP_ADDRESS_ERROR);
1819
1820         if (login->fwdev != fwdev) {
1821                 /* XXX */
1822                 return (RESP_ADDRESS_ERROR);
1823         }
1824
1825         switch (reg) {
1826         case 0x08:      /* ORB_POINTER */
1827                 if (debug)
1828                         printf("%s: ORB_POINTER(%d)\n", __func__, login_id);
1829                 if ((login->flags & F_LINK_ACTIVE) != 0) {
1830                         if (debug)
1831                                 printf("link active (ORB_POINTER)\n");
1832                         break;
1833                 }
1834                 sbp_targ_fetch_orb(sc, fwdev,
1835                     ntohl(xfer->recv.payload[0]),
1836                     ntohl(xfer->recv.payload[1]),
1837                     login, FETCH_CMD);
1838                 break;
1839         case 0x04:      /* AGENT_RESET */
1840                 if (debug)
1841                         printf("%s: AGENT RESET(%d)\n", __func__, login_id);
1842                 login->last_hi = 0xffff;
1843                 login->last_lo = 0xffffffff;
1844                 sbp_targ_abort(sc, STAILQ_FIRST(&login->orbs));
1845                 break;
1846         case 0x10:      /* DOORBELL */
1847                 if (debug)
1848                         printf("%s: DOORBELL(%d)\n", __func__, login_id);
1849                 if (login->last_hi == 0xffff &&
1850                     login->last_lo == 0xffffffff) {
1851                         printf("%s: no previous pointer(DOORBELL)\n",
1852                             __func__);
1853                         break;
1854                 }
1855                 if ((login->flags & F_LINK_ACTIVE) != 0) {
1856                         if (debug)
1857                                 printf("link active (DOORBELL)\n");
1858                         break;
1859                 }
1860                 sbp_targ_fetch_orb(sc, fwdev,
1861                     login->last_hi, login->last_lo,
1862                     login, FETCH_POINTER);
1863                 break;
1864         case 0x00:      /* AGENT_STATE */
1865                 printf("%s: AGENT_STATE (%d:ignore)\n", __func__, login_id);
1866                 break;
1867         case 0x14:      /* UNSOLICITED_STATE_ENABLE */
1868                 printf("%s: UNSOLICITED_STATE_ENABLE (%d:ignore)\n",
1869                                                          __func__, login_id);
1870                 break;
1871         default:
1872                 printf("%s: invalid register %d(%d)\n",
1873                                                  __func__, reg, login_id);
1874                 rtcode = RESP_ADDRESS_ERROR;
1875         }
1876
1877         return (rtcode);
1878 }
1879
1880 static int
1881 sbp_targ_mgm(struct fw_xfer *xfer, struct fw_device *fwdev)
1882 {
1883         struct sbp_targ_softc *sc;
1884         struct fw_pkt *fp;
1885
1886         sc = (struct sbp_targ_softc *)xfer->sc;
1887
1888         fp = &xfer->recv.hdr;
1889         if (fp->mode.wreqb.tcode != FWTCODE_WREQB) {
1890                 printf("%s: tcode = %d\n", __func__, fp->mode.wreqb.tcode);
1891                 return (RESP_TYPE_ERROR);
1892         }
1893
1894         sbp_targ_fetch_orb(sc, fwdev,
1895             ntohl(xfer->recv.payload[0]),
1896             ntohl(xfer->recv.payload[1]),
1897             NULL, FETCH_MGM);
1898
1899         return (0);
1900 }
1901
1902 static void
1903 sbp_targ_recv(struct fw_xfer *xfer)
1904 {
1905         struct fw_pkt *fp, *sfp;
1906         struct fw_device *fwdev;
1907         uint32_t lo;
1908         int s, rtcode;
1909         struct sbp_targ_softc *sc;
1910
1911         s = splfw();
1912         sc = (struct sbp_targ_softc *)xfer->sc;
1913         fp = &xfer->recv.hdr;
1914         fwdev = fw_noderesolve_nodeid(sc->fd.fc, fp->mode.wreqb.src & 0x3f);
1915         if (fwdev == NULL) {
1916                 printf("%s: cannot resolve nodeid=%d\n",
1917                     __func__, fp->mode.wreqb.src & 0x3f);
1918                 rtcode = RESP_TYPE_ERROR; /* XXX */
1919                 goto done;
1920         }
1921         lo = fp->mode.wreqb.dest_lo;
1922
1923         if (lo == SBP_TARG_BIND_LO(-1))
1924                 rtcode = sbp_targ_mgm(xfer, fwdev);
1925         else if (lo >= SBP_TARG_BIND_LO(0))
1926                 rtcode = sbp_targ_cmd(xfer, fwdev, SBP_TARG_LOGIN_ID(lo),
1927                     lo % 0x20);
1928         else
1929                 rtcode = RESP_ADDRESS_ERROR;
1930
1931 done:
1932         if (rtcode != 0)
1933                 printf("%s: rtcode = %d\n", __func__, rtcode);
1934         sfp = &xfer->send.hdr;
1935         xfer->send.spd = FWSPD_S400;
1936         xfer->hand = sbp_targ_resp_callback;
1937         sfp->mode.wres.dst = fp->mode.wreqb.src;
1938         sfp->mode.wres.tlrt = fp->mode.wreqb.tlrt;
1939         sfp->mode.wres.tcode = FWTCODE_WRES;
1940         sfp->mode.wres.rtcode = rtcode;
1941         sfp->mode.wres.pri = 0;
1942
1943         fw_asyreq(xfer->fc, -1, xfer);
1944         splx(s);
1945 }
1946
1947 static int
1948 sbp_targ_attach(device_t dev)
1949 {
1950         struct sbp_targ_softc *sc;
1951         struct cam_devq *devq;
1952         struct firewire_comm *fc;
1953
1954         sc = (struct sbp_targ_softc *) device_get_softc(dev);
1955         bzero((void *)sc, sizeof(struct sbp_targ_softc));
1956
1957         mtx_init(&sc->mtx, "sbp_targ", NULL, MTX_DEF);
1958         sc->fd.fc = fc = device_get_ivars(dev);
1959         sc->fd.dev = dev;
1960         sc->fd.post_explore = (void *) sbp_targ_post_explore;
1961         sc->fd.post_busreset = (void *) sbp_targ_post_busreset;
1962
1963         devq = cam_simq_alloc(/*maxopenings*/MAX_LUN*MAX_INITIATORS);
1964         if (devq == NULL)
1965                 return (ENXIO);
1966
1967         sc->sim = cam_sim_alloc(sbp_targ_action, sbp_targ_poll,
1968             "sbp_targ", sc, device_get_unit(dev), &sc->mtx,
1969             /*untagged*/ 1, /*tagged*/ 1, devq);
1970         if (sc->sim == NULL) {
1971                 cam_simq_free(devq);
1972                 return (ENXIO);
1973         }
1974
1975         SBP_LOCK(sc);
1976         if (xpt_bus_register(sc->sim, dev, /*bus*/0) != CAM_SUCCESS)
1977                 goto fail;
1978
1979         if (xpt_create_path(&sc->path, /*periph*/ NULL, cam_sim_path(sc->sim),
1980             CAM_TARGET_WILDCARD, CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
1981                 xpt_bus_deregister(cam_sim_path(sc->sim));
1982                 goto fail;
1983         }
1984         SBP_UNLOCK(sc);
1985
1986         sc->fwb.start = SBP_TARG_BIND_START;
1987         sc->fwb.end = SBP_TARG_BIND_END;
1988
1989         /* pre-allocate xfer */
1990         STAILQ_INIT(&sc->fwb.xferlist);
1991         fw_xferlist_add(&sc->fwb.xferlist, M_SBP_TARG,
1992             /*send*/ 0, /*recv*/ SBP_TARG_RECV_LEN, MAX_LUN /* XXX */,
1993             fc, (void *)sc, sbp_targ_recv);
1994         fw_bindadd(fc, &sc->fwb);
1995         return 0;
1996
1997 fail:
1998         SBP_UNLOCK(sc);
1999         cam_sim_free(sc->sim, /*free_devq*/TRUE);
2000         return (ENXIO);
2001 }
2002
2003 static int
2004 sbp_targ_detach(device_t dev)
2005 {
2006         struct sbp_targ_softc *sc;
2007         struct sbp_targ_lstate *lstate;
2008         int i;
2009
2010         sc = (struct sbp_targ_softc *)device_get_softc(dev);
2011         sc->fd.post_busreset = NULL;
2012
2013         SBP_LOCK(sc);
2014         xpt_free_path(sc->path);
2015         xpt_bus_deregister(cam_sim_path(sc->sim));
2016         cam_sim_free(sc->sim, /*free_devq*/TRUE);
2017         SBP_UNLOCK(sc);
2018
2019         for (i = 0; i < MAX_LUN; i++) {
2020                 lstate = sc->lstate[i];
2021                 if (lstate != NULL) {
2022                         xpt_free_path(lstate->path);
2023                         free(lstate, M_SBP_TARG);
2024                 }
2025         }
2026         if (sc->black_hole != NULL) {
2027                 xpt_free_path(sc->black_hole->path);
2028                 free(sc->black_hole, M_SBP_TARG);
2029         }
2030
2031         fw_bindremove(sc->fd.fc, &sc->fwb);
2032         fw_xferlist_remove(&sc->fwb.xferlist);
2033
2034         mtx_destroy(&sc->mtx);
2035
2036         return 0;
2037 }
2038
2039 static devclass_t sbp_targ_devclass;
2040
2041 static device_method_t sbp_targ_methods[] = {
2042         /* device interface */
2043         DEVMETHOD(device_identify,      sbp_targ_identify),
2044         DEVMETHOD(device_probe,         sbp_targ_probe),
2045         DEVMETHOD(device_attach,        sbp_targ_attach),
2046         DEVMETHOD(device_detach,        sbp_targ_detach),
2047         { 0, 0 }
2048 };
2049
2050 static driver_t sbp_targ_driver = {
2051         "sbp_targ",
2052         sbp_targ_methods,
2053         sizeof(struct sbp_targ_softc),
2054 };
2055
2056 DRIVER_MODULE(sbp_targ, firewire, sbp_targ_driver, sbp_targ_devclass, 0, 0);
2057 MODULE_VERSION(sbp_targ, 1);
2058 MODULE_DEPEND(sbp_targ, firewire, 1, 1, 1);
2059 MODULE_DEPEND(sbp_targ, cam, 1, 1, 1);