1	// SPDX-License-Identifier: GPL-2.0-or-later
2	/*
3	* SBP2 driver (SCSI over IEEE1394)
4	*
5	* Copyright (C) 2005-2007 Kristian Hoegsberg <krh@bitplanet.net>
6	*/
7
8	/*
9	* The basic structure of this driver is based on the old storage driver,
10	* drivers/ieee1394/sbp2.c, originally written by
11	* James Goodwin <jamesg@filanet.com>
12	* with later contributions and ongoing maintenance from
13	* Ben Collins <bcollins@debian.org>,
14	* Stefan Richter <stefanr@s5r6.in-berlin.de>
15	* and many others.
16	*/
17
18	#include <linux/blkdev.h>
19	#include <linux/bug.h>
20	#include <linux/completion.h>
21	#include <linux/delay.h>
22	#include <linux/device.h>
23	#include <linux/dma-mapping.h>
24	#include <linux/firewire.h>
25	#include <linux/firewire-constants.h>
26	#include <linux/init.h>
27	#include <linux/jiffies.h>
28	#include <linux/kernel.h>
29	#include <linux/kref.h>
30	#include <linux/list.h>
31	#include <linux/mod_devicetable.h>
32	#include <linux/module.h>
33	#include <linux/moduleparam.h>
34	#include <linux/scatterlist.h>
35	#include <linux/slab.h>
36	#include <linux/spinlock.h>
37	#include <linux/string.h>
38	#include <linux/stringify.h>
39	#include <linux/workqueue.h>
40
41	#include <asm/byteorder.h>
42
43	#include <scsi/scsi.h>
44	#include <scsi/scsi_cmnd.h>
45	#include <scsi/scsi_device.h>
46	#include <scsi/scsi_host.h>
47
48	/*
49	* So far only bridges from Oxford Semiconductor are known to support
50	* concurrent logins. Depending on firmware, four or two concurrent logins
51	* are possible on OXFW911 and newer Oxsemi bridges.
52	*
53	* Concurrent logins are useful together with cluster filesystems.
54	*/
55	static bool sbp2_param_exclusive_login = 1;
56	module_param_named(exclusive_login, sbp2_param_exclusive_login, bool, 0644);
57	MODULE_PARM_DESC(exclusive_login, "Exclusive login to sbp2 device "
58	"(default = Y, use N for concurrent initiators)");
59
60	/*
61	* Flags for firmware oddities
62	*
63	* - 128kB max transfer
64	* Limit transfer size. Necessary for some old bridges.
65	*
66	* - 36 byte inquiry
67	* When scsi_mod probes the device, let the inquiry command look like that
68	* from MS Windows.
69	*
70	* - skip mode page 8
71	* Suppress sending of mode_sense for mode page 8 if the device pretends to
72	* support the SCSI Primary Block commands instead of Reduced Block Commands.
73	*
74	* - fix capacity
75	* Tell sd_mod to correct the last sector number reported by read_capacity.
76	* Avoids access beyond actual disk limits on devices with an off-by-one bug.
77	* Don't use this with devices which don't have this bug.
78	*
79	* - delay inquiry
80	* Wait extra SBP2_INQUIRY_DELAY seconds after login before SCSI inquiry.
81	*
82	* - power condition
83	* Set the power condition field in the START STOP UNIT commands sent by
84	* sd_mod on suspend, resume, and shutdown (if manage_system_start_stop or
85	* manage_runtime_start_stop is on).
86	* Some disks need this to spin down or to resume properly.
87	*
88	* - override internal blacklist
89	* Instead of adding to the built-in blacklist, use only the workarounds
90	* specified in the module load parameter.
91	* Useful if a blacklist entry interfered with a non-broken device.
92	*/
93	#define SBP2_WORKAROUND_128K_MAX_TRANS 0x1
94	#define SBP2_WORKAROUND_INQUIRY_36 0x2
95	#define SBP2_WORKAROUND_MODE_SENSE_8 0x4
96	#define SBP2_WORKAROUND_FIX_CAPACITY 0x8
97	#define SBP2_WORKAROUND_DELAY_INQUIRY 0x10
98	#define SBP2_INQUIRY_DELAY 12
99	#define SBP2_WORKAROUND_POWER_CONDITION 0x20
100	#define SBP2_WORKAROUND_OVERRIDE 0x100
101
102	static int sbp2_param_workarounds;
103	module_param_named(workarounds, sbp2_param_workarounds, int, 0644);
104	MODULE_PARM_DESC(workarounds, "Work around device bugs (default = 0"
105	", 128kB max transfer = " __stringify(SBP2_WORKAROUND_128K_MAX_TRANS)
106	", 36 byte inquiry = " __stringify(SBP2_WORKAROUND_INQUIRY_36)
107	", skip mode page 8 = " __stringify(SBP2_WORKAROUND_MODE_SENSE_8)
108	", fix capacity = " __stringify(SBP2_WORKAROUND_FIX_CAPACITY)
109	", delay inquiry = " __stringify(SBP2_WORKAROUND_DELAY_INQUIRY)
110	", set power condition in start stop unit = "
111	__stringify(SBP2_WORKAROUND_POWER_CONDITION)
112	", override internal blacklist = " __stringify(SBP2_WORKAROUND_OVERRIDE)
113	", or a combination)");
114
115	/*
116	* We create one struct sbp2_logical_unit per SBP-2 Logical Unit Number Entry
117	* and one struct scsi_device per sbp2_logical_unit.
118	*/
119	struct sbp2_logical_unit {
120	struct sbp2_target *tgt;
121	struct list_head link;
122	struct fw_address_handler address_handler;
123	struct list_head orb_list;
124
125	u64 command_block_agent_address;
126	u16 lun;
127	int login_id;
128
129	/*
130	* The generation is updated once we've logged in or reconnected
131	* to the logical unit. Thus, I/O to the device will automatically
132	* fail and get retried if it happens in a window where the device
133	* is not ready, e.g. after a bus reset but before we reconnect.
134	*/
135	int generation;
136	int retries;
137	work_func_t workfn;
138	struct delayed_work work;
139	bool has_sdev;
140	bool blocked;
141	};
142
143	static void sbp2_queue_work(struct sbp2_logical_unit *lu, unsigned long delay)
144	{
145	queue_delayed_work(wq: fw_workqueue, dwork: &lu->work, delay);
146	}
147
148	/*
149	* We create one struct sbp2_target per IEEE 1212 Unit Directory
150	* and one struct Scsi_Host per sbp2_target.
151	*/
152	struct sbp2_target {
153	struct fw_unit *unit;
154	struct list_head lu_list;
155
156	u64 management_agent_address;
157	u64 guid;
158	int directory_id;
159	int node_id;
160	int address_high;
161	unsigned int workarounds;
162	unsigned int mgt_orb_timeout;
163	unsigned int max_payload;
164
165	spinlock_t lock;
166	int dont_block; /* counter for each logical unit */
167	int blocked; /* ditto */
168	};
169
170	static struct fw_device *target_parent_device(struct sbp2_target *tgt)
171	{
172	return fw_parent_device(tgt->unit);
173	}
174
175	static const struct device *tgt_dev(const struct sbp2_target *tgt)
176	{
177	return &tgt->unit->device;
178	}
179
180	static const struct device *lu_dev(const struct sbp2_logical_unit *lu)
181	{
182	return &lu->tgt->unit->device;
183	}
184
185	/* Impossible login_id, to detect logout attempt before successful login */
186	#define INVALID_LOGIN_ID 0x10000
187
188	#define SBP2_ORB_TIMEOUT 2000U /* Timeout in ms */
189	#define SBP2_ORB_NULL 0x80000000
190	#define SBP2_RETRY_LIMIT 0xf /* 15 retries */
191	#define SBP2_CYCLE_LIMIT (0xc8 << 12) /* 200 125us cycles */
192
193	/*
194	* There is no transport protocol limit to the CDB length, but we implement
195	* a fixed length only. 16 bytes is enough for disks larger than 2 TB.
196	*/
197	#define SBP2_MAX_CDB_SIZE 16
198
199	/*
200	* The maximum SBP-2 data buffer size is 0xffff. We quadlet-align this
201	* for compatibility with earlier versions of this driver.
202	*/
203	#define SBP2_MAX_SEG_SIZE 0xfffc
204
205	/* Unit directory keys */
206	#define SBP2_CSR_UNIT_CHARACTERISTICS 0x3a
207	#define SBP2_CSR_FIRMWARE_REVISION 0x3c
208	#define SBP2_CSR_LOGICAL_UNIT_NUMBER 0x14
209	#define SBP2_CSR_UNIT_UNIQUE_ID 0x8d
210	#define SBP2_CSR_LOGICAL_UNIT_DIRECTORY 0xd4
211
212	/* Management orb opcodes */
213	#define SBP2_LOGIN_REQUEST 0x0
214	#define SBP2_QUERY_LOGINS_REQUEST 0x1
215	#define SBP2_RECONNECT_REQUEST 0x3
216	#define SBP2_SET_PASSWORD_REQUEST 0x4
217	#define SBP2_LOGOUT_REQUEST 0x7
218	#define SBP2_ABORT_TASK_REQUEST 0xb
219	#define SBP2_ABORT_TASK_SET 0xc
220	#define SBP2_LOGICAL_UNIT_RESET 0xe
221	#define SBP2_TARGET_RESET_REQUEST 0xf
222
223	/* Offsets for command block agent registers */
224	#define SBP2_AGENT_STATE 0x00
225	#define SBP2_AGENT_RESET 0x04
226	#define SBP2_ORB_POINTER 0x08
227	#define SBP2_DOORBELL 0x10
228	#define SBP2_UNSOLICITED_STATUS_ENABLE 0x14
229
230	/* Status write response codes */
231	#define SBP2_STATUS_REQUEST_COMPLETE 0x0
232	#define SBP2_STATUS_TRANSPORT_FAILURE 0x1
233	#define SBP2_STATUS_ILLEGAL_REQUEST 0x2
234	#define SBP2_STATUS_VENDOR_DEPENDENT 0x3
235
236	#define STATUS_GET_ORB_HIGH(v) ((v).status & 0xffff)
237	#define STATUS_GET_SBP_STATUS(v) (((v).status >> 16) & 0xff)
238	#define STATUS_GET_LEN(v) (((v).status >> 24) & 0x07)
239	#define STATUS_GET_DEAD(v) (((v).status >> 27) & 0x01)
240	#define STATUS_GET_RESPONSE(v) (((v).status >> 28) & 0x03)
241	#define STATUS_GET_SOURCE(v) (((v).status >> 30) & 0x03)
242	#define STATUS_GET_ORB_LOW(v) ((v).orb_low)
243	#define STATUS_GET_DATA(v) ((v).data)
244
245	struct sbp2_status {
246	u32 status;
247	u32 orb_low;
248	u8 data[24];
249	};
250
251	struct sbp2_pointer {
252	__be32 high;
253	__be32 low;
254	};
255
256	struct sbp2_orb {
257	struct fw_transaction t;
258	struct kref kref;
259	dma_addr_t request_bus;
260	int rcode;
261	void (*callback)(struct sbp2_orb * orb, struct sbp2_status * status);
262	struct sbp2_logical_unit *lu;
263	struct list_head link;
264	};
265
266	#define MANAGEMENT_ORB_LUN(v) ((v))
267	#define MANAGEMENT_ORB_FUNCTION(v) ((v) << 16)
268	#define MANAGEMENT_ORB_RECONNECT(v) ((v) << 20)
269	#define MANAGEMENT_ORB_EXCLUSIVE(v) ((v) ? 1 << 28 : 0)
270	#define MANAGEMENT_ORB_REQUEST_FORMAT(v) ((v) << 29)
271	#define MANAGEMENT_ORB_NOTIFY ((1) << 31)
272
273	#define MANAGEMENT_ORB_RESPONSE_LENGTH(v) ((v))
274	#define MANAGEMENT_ORB_PASSWORD_LENGTH(v) ((v) << 16)
275
276	struct sbp2_management_orb {
277	struct sbp2_orb base;
278	struct {
279	struct sbp2_pointer password;
280	struct sbp2_pointer response;
281	__be32 misc;
282	__be32 length;
283	struct sbp2_pointer status_fifo;
284	} request;
285	__be32 response[4];
286	dma_addr_t response_bus;
287	struct completion done;
288	struct sbp2_status status;
289	};
290
291	struct sbp2_login_response {
292	__be32 misc;
293	struct sbp2_pointer command_block_agent;
294	__be32 reconnect_hold;
295	};
296	#define COMMAND_ORB_DATA_SIZE(v) ((v))
297	#define COMMAND_ORB_PAGE_SIZE(v) ((v) << 16)
298	#define COMMAND_ORB_PAGE_TABLE_PRESENT ((1) << 19)
299	#define COMMAND_ORB_MAX_PAYLOAD(v) ((v) << 20)
300	#define COMMAND_ORB_SPEED(v) ((v) << 24)
301	#define COMMAND_ORB_DIRECTION ((1) << 27)
302	#define COMMAND_ORB_REQUEST_FORMAT(v) ((v) << 29)
303	#define COMMAND_ORB_NOTIFY ((1) << 31)
304
305	struct sbp2_command_orb {
306	struct sbp2_orb base;
307	struct {
308	struct sbp2_pointer next;
309	struct sbp2_pointer data_descriptor;
310	__be32 misc;
311	u8 command_block[SBP2_MAX_CDB_SIZE];
312	} request;
313	struct scsi_cmnd *cmd;
314
315	struct sbp2_pointer page_table[SG_ALL] __attribute__((aligned(8)));
316	dma_addr_t page_table_bus;
317	};
318
319	#define SBP2_ROM_VALUE_WILDCARD ~0 /* match all */
320	#define SBP2_ROM_VALUE_MISSING 0xff000000 /* not present in the unit dir. */
321
322	/*
323	* List of devices with known bugs.
324	*
325	* The firmware_revision field, masked with 0xffff00, is the best
326	* indicator for the type of bridge chip of a device. It yields a few
327	* false positives but this did not break correctly behaving devices
328	* so far.
329	*/
330	static const struct {
331	u32 firmware_revision;
332	u32 model;
333	unsigned int workarounds;
334	} sbp2_workarounds_table[] = {
335	/* DViCO Momobay CX-1 with TSB42AA9 bridge */ {
336	.firmware_revision = 0x002800,
337	.model = 0x001010,
338	.workarounds = SBP2_WORKAROUND_INQUIRY_36 |
339	SBP2_WORKAROUND_MODE_SENSE_8 |
340	SBP2_WORKAROUND_POWER_CONDITION,
341	},
342	/* DViCO Momobay FX-3A with TSB42AA9A bridge */ {
343	.firmware_revision = 0x002800,
344	.model = 0x000000,
345	.workarounds = SBP2_WORKAROUND_POWER_CONDITION,
346	},
347	/* Initio bridges, actually only needed for some older ones */ {
348	.firmware_revision = 0x000200,
349	.model = SBP2_ROM_VALUE_WILDCARD,
350	.workarounds = SBP2_WORKAROUND_INQUIRY_36,
351	},
352	/* PL-3507 bridge with Prolific firmware */ {
353	.firmware_revision = 0x012800,
354	.model = SBP2_ROM_VALUE_WILDCARD,
355	.workarounds = SBP2_WORKAROUND_POWER_CONDITION,
356	},
357	/* Symbios bridge */ {
358	.firmware_revision = 0xa0b800,
359	.model = SBP2_ROM_VALUE_WILDCARD,
360	.workarounds = SBP2_WORKAROUND_128K_MAX_TRANS,
361	},
362	/* Datafab MD2-FW2 with Symbios/LSILogic SYM13FW500 bridge */ {
363	.firmware_revision = 0x002600,
364	.model = SBP2_ROM_VALUE_WILDCARD,
365	.workarounds = SBP2_WORKAROUND_128K_MAX_TRANS,
366	},
367	/*
368	* iPod 2nd generation: needs 128k max transfer size workaround
369	* iPod 3rd generation: needs fix capacity workaround
370	*/
371	{
372	.firmware_revision = 0x0a2700,
373	.model = 0x000000,
374	.workarounds = SBP2_WORKAROUND_128K_MAX_TRANS |
375	SBP2_WORKAROUND_FIX_CAPACITY,
376	},
377	/* iPod 4th generation */ {
378	.firmware_revision = 0x0a2700,
379	.model = 0x000021,
380	.workarounds = SBP2_WORKAROUND_FIX_CAPACITY,
381	},
382	/* iPod mini */ {
383	.firmware_revision = 0x0a2700,
384	.model = 0x000022,
385	.workarounds = SBP2_WORKAROUND_FIX_CAPACITY,
386	},
387	/* iPod mini */ {
388	.firmware_revision = 0x0a2700,
389	.model = 0x000023,
390	.workarounds = SBP2_WORKAROUND_FIX_CAPACITY,
391	},
392	/* iPod Photo */ {
393	.firmware_revision = 0x0a2700,
394	.model = 0x00007e,
395	.workarounds = SBP2_WORKAROUND_FIX_CAPACITY,
396	}
397	};
398
399	static void free_orb(struct kref *kref)
400	{
401	struct sbp2_orb *orb = container_of(kref, struct sbp2_orb, kref);
402
403	kfree(objp: orb);
404	}
405
406	static void sbp2_status_write(struct fw_card *card, struct fw_request *request,
407	int tcode, int destination, int source,
408	int generation, unsigned long long offset,
409	void *payload, size_t length, void *callback_data)
410	{
411	struct sbp2_logical_unit *lu = callback_data;
412	struct sbp2_orb *orb = NULL, *iter;
413	struct sbp2_status status;
414	unsigned long flags;
415
416	if (tcode != TCODE_WRITE_BLOCK_REQUEST ||
417	length < 8 || length > sizeof(status)) {
418	fw_send_response(card, request, RCODE_TYPE_ERROR);
419	return;
420	}
421
422	status.status = be32_to_cpup(p: payload);
423	status.orb_low = be32_to_cpup(p: payload + 4);
424	memset(status.data, 0, sizeof(status.data));
425	if (length > 8)
426	memcpy(status.data, payload + 8, length - 8);
427
428	if (STATUS_GET_SOURCE(status) == 2 || STATUS_GET_SOURCE(status) == 3) {
429	dev_notice(lu_dev(lu),
430	"non-ORB related status write, not handled\n");
431	fw_send_response(card, request, RCODE_COMPLETE);
432	return;
433	}
434
435	/* Lookup the orb corresponding to this status write. */
436	spin_lock_irqsave(&lu->tgt->lock, flags);
437	list_for_each_entry(iter, &lu->orb_list, link) {
438	if (STATUS_GET_ORB_HIGH(status) == 0 &&
439	STATUS_GET_ORB_LOW(status) == iter->request_bus) {
440	iter->rcode = RCODE_COMPLETE;
441	list_del(entry: &iter->link);
442	orb = iter;
443	break;
444	}
445	}
446	spin_unlock_irqrestore(lock: &lu->tgt->lock, flags);
447
448	if (orb) {
449	orb->callback(orb, &status);
450	kref_put(kref: &orb->kref, release: free_orb); /* orb callback reference */
451	} else {
452	dev_err(lu_dev(lu), "status write for unknown ORB\n");
453	}
454
455	fw_send_response(card, request, RCODE_COMPLETE);
456	}
457
458	static void complete_transaction(struct fw_card *card, int rcode,
459	void *payload, size_t length, void *data)
460	{
461	struct sbp2_orb *orb = data;
462	unsigned long flags;
463
464	/*
465	* This is a little tricky. We can get the status write for
466	* the orb before we get this callback. The status write
467	* handler above will assume the orb pointer transaction was
468	* successful and set the rcode to RCODE_COMPLETE for the orb.
469	* So this callback only sets the rcode if it hasn't already
470	* been set and only does the cleanup if the transaction
471	* failed and we didn't already get a status write.
472	*/
473	spin_lock_irqsave(&orb->lu->tgt->lock, flags);
474
475	if (orb->rcode == -1)
476	orb->rcode = rcode;
477	if (orb->rcode != RCODE_COMPLETE) {
478	list_del(entry: &orb->link);
479	spin_unlock_irqrestore(lock: &orb->lu->tgt->lock, flags);
480
481	orb->callback(orb, NULL);
482	kref_put(kref: &orb->kref, release: free_orb); /* orb callback reference */
483	} else {
484	spin_unlock_irqrestore(lock: &orb->lu->tgt->lock, flags);
485	}
486
487	kref_put(kref: &orb->kref, release: free_orb); /* transaction callback reference */
488	}
489
490	static void sbp2_send_orb(struct sbp2_orb *orb, struct sbp2_logical_unit *lu,
491	int node_id, int generation, u64 offset)
492	{
493	struct fw_device *device = target_parent_device(tgt: lu->tgt);
494	struct sbp2_pointer orb_pointer;
495	unsigned long flags;
496
497	orb_pointer.high = 0;
498	orb_pointer.low = cpu_to_be32(orb->request_bus);
499
500	orb->lu = lu;
501	spin_lock_irqsave(&lu->tgt->lock, flags);
502	list_add_tail(new: &orb->link, head: &lu->orb_list);
503	spin_unlock_irqrestore(lock: &lu->tgt->lock, flags);
504
505	kref_get(kref: &orb->kref); /* transaction callback reference */
506	kref_get(kref: &orb->kref); /* orb callback reference */
507
508	fw_send_request(card: device->card, t: &orb->t, TCODE_WRITE_BLOCK_REQUEST,
509	destination_id: node_id, generation, speed: device->max_speed, offset,
510	payload: &orb_pointer, length: 8, callback: complete_transaction, callback_data: orb);
511	}
512
513	static int sbp2_cancel_orbs(struct sbp2_logical_unit *lu)
514	{
515	struct fw_device *device = target_parent_device(tgt: lu->tgt);
516	struct sbp2_orb *orb, *next;
517	struct list_head list;
518	int retval = -ENOENT;
519
520	INIT_LIST_HEAD(list: &list);
521	spin_lock_irq(lock: &lu->tgt->lock);
522	list_splice_init(list: &lu->orb_list, head: &list);
523	spin_unlock_irq(lock: &lu->tgt->lock);
524
525	list_for_each_entry_safe(orb, next, &list, link) {
526	retval = 0;
527	if (fw_cancel_transaction(card: device->card, transaction: &orb->t) == 0)
528	continue;
529
530	orb->rcode = RCODE_CANCELLED;
531	orb->callback(orb, NULL);
532	kref_put(kref: &orb->kref, release: free_orb); /* orb callback reference */
533	}
534
535	return retval;
536	}
537
538	static void complete_management_orb(struct sbp2_orb *base_orb,
539	struct sbp2_status *status)
540	{
541	struct sbp2_management_orb *orb =
542	container_of(base_orb, struct sbp2_management_orb, base);
543
544	if (status)
545	memcpy(&orb->status, status, sizeof(*status));
546	complete(&orb->done);
547	}
548
549	static int sbp2_send_management_orb(struct sbp2_logical_unit *lu, int node_id,
550	int generation, int function,
551	int lun_or_login_id, void *response)
552	{
553	struct fw_device *device = target_parent_device(tgt: lu->tgt);
554	struct sbp2_management_orb *orb;
555	unsigned int timeout;
556	int retval = -ENOMEM;
557
558	if (function == SBP2_LOGOUT_REQUEST && fw_device_is_shutdown(device))
559	return 0;
560
561	orb = kzalloc(size: sizeof(*orb), GFP_NOIO);
562	if (orb == NULL)
563	return -ENOMEM;
564
565	kref_init(kref: &orb->base.kref);
566	orb->response_bus =
567	dma_map_single(device->card->device, &orb->response,
568	sizeof(orb->response), DMA_FROM_DEVICE);
569	if (dma_mapping_error(dev: device->card->device, dma_addr: orb->response_bus))
570	goto fail_mapping_response;
571
572	orb->request.response.high = 0;
573	orb->request.response.low = cpu_to_be32(orb->response_bus);
574
575	orb->request.misc = cpu_to_be32(
576	MANAGEMENT_ORB_NOTIFY |
577	MANAGEMENT_ORB_FUNCTION(function) |
578	MANAGEMENT_ORB_LUN(lun_or_login_id));
579	orb->request.length = cpu_to_be32(
580	MANAGEMENT_ORB_RESPONSE_LENGTH(sizeof(orb->response)));
581
582	orb->request.status_fifo.high =
583	cpu_to_be32(lu->address_handler.offset >> 32);
584	orb->request.status_fifo.low =
585	cpu_to_be32(lu->address_handler.offset);
586
587	if (function == SBP2_LOGIN_REQUEST) {
588	/* Ask for 2^2 == 4 seconds reconnect grace period */
589	orb->request.misc |= cpu_to_be32(
590	MANAGEMENT_ORB_RECONNECT(2) |
591	MANAGEMENT_ORB_EXCLUSIVE(sbp2_param_exclusive_login));
592	timeout = lu->tgt->mgt_orb_timeout;
593	} else {
594	timeout = SBP2_ORB_TIMEOUT;
595	}
596
597	init_completion(x: &orb->done);
598	orb->base.callback = complete_management_orb;
599
600	orb->base.request_bus =
601	dma_map_single(device->card->device, &orb->request,
602	sizeof(orb->request), DMA_TO_DEVICE);
603	if (dma_mapping_error(dev: device->card->device, dma_addr: orb->base.request_bus))
604	goto fail_mapping_request;
605
606	sbp2_send_orb(orb: &orb->base, lu, node_id, generation,
607	offset: lu->tgt->management_agent_address);
608
609	wait_for_completion_timeout(x: &orb->done, timeout: msecs_to_jiffies(m: timeout));
610
611	retval = -EIO;
612	if (sbp2_cancel_orbs(lu) == 0) {
613	dev_err(lu_dev(lu), "ORB reply timed out, rcode 0x%02x\n",
614	orb->base.rcode);
615	goto out;
616	}
617
618	if (orb->base.rcode != RCODE_COMPLETE) {
619	dev_err(lu_dev(lu), "management write failed, rcode 0x%02x\n",
620	orb->base.rcode);
621	goto out;
622	}
623
624	if (STATUS_GET_RESPONSE(orb->status) != 0 ||
625	STATUS_GET_SBP_STATUS(orb->status) != 0) {
626	dev_err(lu_dev(lu), "error status: %d:%d\n",
627	STATUS_GET_RESPONSE(orb->status),
628	STATUS_GET_SBP_STATUS(orb->status));
629	goto out;
630	}
631
632	retval = 0;
633	out:
634	dma_unmap_single(device->card->device, orb->base.request_bus,
635	sizeof(orb->request), DMA_TO_DEVICE);
636	fail_mapping_request:
637	dma_unmap_single(device->card->device, orb->response_bus,
638	sizeof(orb->response), DMA_FROM_DEVICE);
639	fail_mapping_response:
640	if (response)
641	memcpy(response, orb->response, sizeof(orb->response));
642	kref_put(kref: &orb->base.kref, release: free_orb);
643
644	return retval;
645	}
646
647	static void sbp2_agent_reset(struct sbp2_logical_unit *lu)
648	{
649	struct fw_device *device = target_parent_device(tgt: lu->tgt);
650	__be32 d = 0;
651
652	fw_run_transaction(card: device->card, TCODE_WRITE_QUADLET_REQUEST,
653	destination_id: lu->tgt->node_id, generation: lu->generation, speed: device->max_speed,
654	offset: lu->command_block_agent_address + SBP2_AGENT_RESET,
655	payload: &d, length: 4);
656	}
657
658	static void complete_agent_reset_write_no_wait(struct fw_card *card,
659	int rcode, void *payload, size_t length, void *data)
660	{
661	kfree(objp: data);
662	}
663
664	static void sbp2_agent_reset_no_wait(struct sbp2_logical_unit *lu)
665	{
666	struct fw_device *device = target_parent_device(tgt: lu->tgt);
667	struct fw_transaction *t;
668	static __be32 d;
669
670	t = kmalloc(size: sizeof(*t), GFP_ATOMIC);
671	if (t == NULL)
672	return;
673
674	fw_send_request(card: device->card, t, TCODE_WRITE_QUADLET_REQUEST,
675	destination_id: lu->tgt->node_id, generation: lu->generation, speed: device->max_speed,
676	offset: lu->command_block_agent_address + SBP2_AGENT_RESET,
677	payload: &d, length: 4, callback: complete_agent_reset_write_no_wait, callback_data: t);
678	}
679
680	static inline void sbp2_allow_block(struct sbp2_target *tgt)
681	{
682	spin_lock_irq(lock: &tgt->lock);
683	--tgt->dont_block;
684	spin_unlock_irq(lock: &tgt->lock);
685	}
686
687	/*
688	* Blocks lu->tgt if all of the following conditions are met:
689	* - Login, INQUIRY, and high-level SCSI setup of all of the target's
690	* logical units have been finished (indicated by dont_block == 0).
691	* - lu->generation is stale.
692	*
693	* Note, scsi_block_requests() must be called while holding tgt->lock,
694	* otherwise it might foil sbp2_[conditionally_]unblock()'s attempt to
695	* unblock the target.
696	*/
697	static void sbp2_conditionally_block(struct sbp2_logical_unit *lu)
698	{
699	struct sbp2_target *tgt = lu->tgt;
700	struct fw_card *card = target_parent_device(tgt)->card;
701	struct Scsi_Host *shost =
702	container_of((void *)tgt, struct Scsi_Host, hostdata[0]);
703	unsigned long flags;
704
705	spin_lock_irqsave(&tgt->lock, flags);
706	if (!tgt->dont_block && !lu->blocked &&
707	lu->generation != card->generation) {
708	lu->blocked = true;
709	if (++tgt->blocked == 1)
710	scsi_block_requests(shost);
711	}
712	spin_unlock_irqrestore(lock: &tgt->lock, flags);
713	}
714
715	/*
716	* Unblocks lu->tgt as soon as all its logical units can be unblocked.
717	* Note, it is harmless to run scsi_unblock_requests() outside the
718	* tgt->lock protected section. On the other hand, running it inside
719	* the section might clash with shost->host_lock.
720	*/
721	static void sbp2_conditionally_unblock(struct sbp2_logical_unit *lu)
722	{
723	struct sbp2_target *tgt = lu->tgt;
724	struct fw_card *card = target_parent_device(tgt)->card;
725	struct Scsi_Host *shost =
726	container_of((void *)tgt, struct Scsi_Host, hostdata[0]);
727	bool unblock = false;
728
729	spin_lock_irq(lock: &tgt->lock);
730	if (lu->blocked && lu->generation == card->generation) {
731	lu->blocked = false;
732	unblock = --tgt->blocked == 0;
733	}
734	spin_unlock_irq(lock: &tgt->lock);
735
736	if (unblock)
737	scsi_unblock_requests(shost);
738	}
739
740	/*
741	* Prevents future blocking of tgt and unblocks it.
742	* Note, it is harmless to run scsi_unblock_requests() outside the
743	* tgt->lock protected section. On the other hand, running it inside
744	* the section might clash with shost->host_lock.
745	*/
746	static void sbp2_unblock(struct sbp2_target *tgt)
747	{
748	struct Scsi_Host *shost =
749	container_of((void *)tgt, struct Scsi_Host, hostdata[0]);
750
751	spin_lock_irq(lock: &tgt->lock);
752	++tgt->dont_block;
753	spin_unlock_irq(lock: &tgt->lock);
754
755	scsi_unblock_requests(shost);
756	}
757
758	static int sbp2_lun2int(u16 lun)
759	{
760	struct scsi_lun eight_bytes_lun;
761
762	memset(&eight_bytes_lun, 0, sizeof(eight_bytes_lun));
763	eight_bytes_lun.scsi_lun[0] = (lun >> 8) & 0xff;
764	eight_bytes_lun.scsi_lun[1] = lun & 0xff;
765
766	return scsilun_to_int(&eight_bytes_lun);
767	}
768
769	/*
770	* Write retransmit retry values into the BUSY_TIMEOUT register.
771	* - The single-phase retry protocol is supported by all SBP-2 devices, but the
772	* default retry_limit value is 0 (i.e. never retry transmission). We write a
773	* saner value after logging into the device.
774	* - The dual-phase retry protocol is optional to implement, and if not
775	* supported, writes to the dual-phase portion of the register will be
776	* ignored. We try to write the original 1394-1995 default here.
777	* - In the case of devices that are also SBP-3-compliant, all writes are
778	* ignored, as the register is read-only, but contains single-phase retry of
779	* 15, which is what we're trying to set for all SBP-2 device anyway, so this
780	* write attempt is safe and yields more consistent behavior for all devices.
781	*
782	* See section 8.3.2.3.5 of the 1394-1995 spec, section 6.2 of the SBP-2 spec,
783	* and section 6.4 of the SBP-3 spec for further details.
784	*/
785	static void sbp2_set_busy_timeout(struct sbp2_logical_unit *lu)
786	{
787	struct fw_device *device = target_parent_device(tgt: lu->tgt);
788	__be32 d = cpu_to_be32(SBP2_CYCLE_LIMIT | SBP2_RETRY_LIMIT);
789
790	fw_run_transaction(card: device->card, TCODE_WRITE_QUADLET_REQUEST,
791	destination_id: lu->tgt->node_id, generation: lu->generation, speed: device->max_speed,
792	CSR_REGISTER_BASE + CSR_BUSY_TIMEOUT, payload: &d, length: 4);
793	}
794
795	static void sbp2_reconnect(struct work_struct *work);
796
797	static void sbp2_login(struct work_struct *work)
798	{
799	struct sbp2_logical_unit *lu =
800	container_of(work, struct sbp2_logical_unit, work.work);
801	struct sbp2_target *tgt = lu->tgt;
802	struct fw_device *device = target_parent_device(tgt);
803	struct Scsi_Host *shost;
804	struct scsi_device *sdev;
805	struct sbp2_login_response response;
806	int generation, node_id, local_node_id;
807
808	if (fw_device_is_shutdown(device))
809	return;
810
811	generation = device->generation;
812	smp_rmb(); /* node IDs must not be older than generation */
813	node_id = device->node_id;
814	local_node_id = device->card->node_id;
815
816	/* If this is a re-login attempt, log out, or we might be rejected. */
817	if (lu->has_sdev)
818	sbp2_send_management_orb(lu, node_id: device->node_id, generation,
819	SBP2_LOGOUT_REQUEST, lun_or_login_id: lu->login_id, NULL);
820
821	if (sbp2_send_management_orb(lu, node_id, generation,
822	SBP2_LOGIN_REQUEST, lun_or_login_id: lu->lun, response: &response) < 0) {
823	if (lu->retries++ < 5) {
824	sbp2_queue_work(lu, DIV_ROUND_UP(HZ, 5));
825	} else {
826	dev_err(tgt_dev(tgt), "failed to login to LUN %04x\n",
827	lu->lun);
828	/* Let any waiting I/O fail from now on. */
829	sbp2_unblock(tgt: lu->tgt);
830	}
831	return;
832	}
833
834	tgt->node_id = node_id;
835	tgt->address_high = local_node_id << 16;
836	smp_wmb(); /* node IDs must not be older than generation */
837	lu->generation = generation;
838
839	lu->command_block_agent_address =
840	((u64)(be32_to_cpu(response.command_block_agent.high) & 0xffff)
841	<< 32) | be32_to_cpu(response.command_block_agent.low);
842	lu->login_id = be32_to_cpu(response.misc) & 0xffff;
843
844	dev_notice(tgt_dev(tgt), "logged in to LUN %04x (%d retries)\n",
845	lu->lun, lu->retries);
846
847	/* set appropriate retry limit(s) in BUSY_TIMEOUT register */
848	sbp2_set_busy_timeout(lu);
849
850	lu->workfn = sbp2_reconnect;
851	sbp2_agent_reset(lu);
852
853	/* This was a re-login. */
854	if (lu->has_sdev) {
855	sbp2_cancel_orbs(lu);
856	sbp2_conditionally_unblock(lu);
857
858	return;
859	}
860
861	if (lu->tgt->workarounds & SBP2_WORKAROUND_DELAY_INQUIRY)
862	ssleep(SBP2_INQUIRY_DELAY);
863
864	shost = container_of((void *)tgt, struct Scsi_Host, hostdata[0]);
865	sdev = __scsi_add_device(shost, 0, 0, sbp2_lun2int(lun: lu->lun), hostdata: lu);
866	/*
867	* FIXME: We are unable to perform reconnects while in sbp2_login().
868	* Therefore __scsi_add_device() will get into trouble if a bus reset
869	* happens in parallel. It will either fail or leave us with an
870	* unusable sdev. As a workaround we check for this and retry the
871	* whole login and SCSI probing.
872	*/
873
874	/* Reported error during __scsi_add_device() */
875	if (IS_ERR(ptr: sdev))
876	goto out_logout_login;
877
878	/* Unreported error during __scsi_add_device() */
879	smp_rmb(); /* get current card generation */
880	if (generation != device->card->generation) {
881	scsi_remove_device(sdev);
882	scsi_device_put(sdev);
883	goto out_logout_login;
884	}
885
886	/* No error during __scsi_add_device() */
887	lu->has_sdev = true;
888	scsi_device_put(sdev);
889	sbp2_allow_block(tgt);
890
891	return;
892
893	out_logout_login:
894	smp_rmb(); /* generation may have changed */
895	generation = device->generation;
896	smp_rmb(); /* node_id must not be older than generation */
897
898	sbp2_send_management_orb(lu, node_id: device->node_id, generation,
899	SBP2_LOGOUT_REQUEST, lun_or_login_id: lu->login_id, NULL);
900	/*
901	* If a bus reset happened, sbp2_update will have requeued
902	* lu->work already. Reset the work from reconnect to login.
903	*/
904	lu->workfn = sbp2_login;
905	}
906
907	static void sbp2_reconnect(struct work_struct *work)
908	{
909	struct sbp2_logical_unit *lu =
910	container_of(work, struct sbp2_logical_unit, work.work);
911	struct sbp2_target *tgt = lu->tgt;
912	struct fw_device *device = target_parent_device(tgt);
913	int generation, node_id, local_node_id;
914
915	if (fw_device_is_shutdown(device))
916	return;
917
918	generation = device->generation;
919	smp_rmb(); /* node IDs must not be older than generation */
920	node_id = device->node_id;
921	local_node_id = device->card->node_id;
922
923	if (sbp2_send_management_orb(lu, node_id, generation,
924	SBP2_RECONNECT_REQUEST,
925	lun_or_login_id: lu->login_id, NULL) < 0) {
926	/*
927	* If reconnect was impossible even though we are in the
928	* current generation, fall back and try to log in again.
929	*
930	* We could check for "Function rejected" status, but
931	* looking at the bus generation as simpler and more general.
932	*/
933	smp_rmb(); /* get current card generation */
934	if (generation == device->card->generation ||
935	lu->retries++ >= 5) {
936	dev_err(tgt_dev(tgt), "failed to reconnect\n");
937	lu->retries = 0;
938	lu->workfn = sbp2_login;
939	}
940	sbp2_queue_work(lu, DIV_ROUND_UP(HZ, 5));
941
942	return;
943	}
944
945	tgt->node_id = node_id;
946	tgt->address_high = local_node_id << 16;
947	smp_wmb(); /* node IDs must not be older than generation */
948	lu->generation = generation;
949
950	dev_notice(tgt_dev(tgt), "reconnected to LUN %04x (%d retries)\n",
951	lu->lun, lu->retries);
952
953	sbp2_agent_reset(lu);
954	sbp2_cancel_orbs(lu);
955	sbp2_conditionally_unblock(lu);
956	}
957
958	static void sbp2_lu_workfn(struct work_struct *work)
959	{
960	struct sbp2_logical_unit *lu = container_of(to_delayed_work(work),
961	struct sbp2_logical_unit, work);
962	lu->workfn(work);
963	}
964
965	static int sbp2_add_logical_unit(struct sbp2_target *tgt, int lun_entry)
966	{
967	struct sbp2_logical_unit *lu;
968
969	lu = kmalloc(size: sizeof(*lu), GFP_KERNEL);
970	if (!lu)
971	return -ENOMEM;
972
973	lu->address_handler.length = 0x100;
974	lu->address_handler.address_callback = sbp2_status_write;
975	lu->address_handler.callback_data = lu;
976
977	if (fw_core_add_address_handler(handler: &lu->address_handler,
978	region: &fw_high_memory_region) < 0) {
979	kfree(objp: lu);
980	return -ENOMEM;
981	}
982
983	lu->tgt = tgt;
984	lu->lun = lun_entry & 0xffff;
985	lu->login_id = INVALID_LOGIN_ID;
986	lu->retries = 0;
987	lu->has_sdev = false;
988	lu->blocked = false;
989	++tgt->dont_block;
990	INIT_LIST_HEAD(list: &lu->orb_list);
991	lu->workfn = sbp2_login;
992	INIT_DELAYED_WORK(&lu->work, sbp2_lu_workfn);
993
994	list_add_tail(new: &lu->link, head: &tgt->lu_list);
995	return 0;
996	}
997
998	static void sbp2_get_unit_unique_id(struct sbp2_target *tgt,
999	const u32 *leaf)
1000	{
1001	if ((leaf[0] & 0xffff0000) == 0x00020000)
1002	tgt->guid = (u64)leaf[1] << 32 | leaf[2];
1003	}
1004
1005	static int sbp2_scan_logical_unit_dir(struct sbp2_target *tgt,
1006	const u32 *directory)
1007	{
1008	struct fw_csr_iterator ci;
1009	int key, value;
1010
1011	fw_csr_iterator_init(ci: &ci, p: directory);
1012	while (fw_csr_iterator_next(ci: &ci, key: &key, value: &value))
1013	if (key == SBP2_CSR_LOGICAL_UNIT_NUMBER &&
1014	sbp2_add_logical_unit(tgt, lun_entry: value) < 0)
1015	return -ENOMEM;
1016	return 0;
1017	}
1018
1019	static int sbp2_scan_unit_dir(struct sbp2_target *tgt, const u32 *directory,
1020	u32 *model, u32 *firmware_revision)
1021	{
1022	struct fw_csr_iterator ci;
1023	int key, value;
1024
1025	fw_csr_iterator_init(ci: &ci, p: directory);
1026	while (fw_csr_iterator_next(ci: &ci, key: &key, value: &value)) {
1027	switch (key) {
1028
1029	case CSR_DEPENDENT_INFO | CSR_OFFSET:
1030	tgt->management_agent_address =
1031	CSR_REGISTER_BASE + 4 * value;
1032	break;
1033
1034	case CSR_DIRECTORY_ID:
1035	tgt->directory_id = value;
1036	break;
1037
1038	case CSR_MODEL:
1039	*model = value;
1040	break;
1041
1042	case SBP2_CSR_FIRMWARE_REVISION:
1043	*firmware_revision = value;
1044	break;
1045
1046	case SBP2_CSR_UNIT_CHARACTERISTICS:
1047	/* the timeout value is stored in 500ms units */
1048	tgt->mgt_orb_timeout = (value >> 8 & 0xff) * 500;
1049	break;
1050
1051	case SBP2_CSR_LOGICAL_UNIT_NUMBER:
1052	if (sbp2_add_logical_unit(tgt, lun_entry: value) < 0)
1053	return -ENOMEM;
1054	break;
1055
1056	case SBP2_CSR_UNIT_UNIQUE_ID:
1057	sbp2_get_unit_unique_id(tgt, leaf: ci.p - 1 + value);
1058	break;
1059
1060	case SBP2_CSR_LOGICAL_UNIT_DIRECTORY:
1061	/* Adjust for the increment in the iterator */
1062	if (sbp2_scan_logical_unit_dir(tgt, directory: ci.p - 1 + value) < 0)
1063	return -ENOMEM;
1064	break;
1065	}
1066	}
1067	return 0;
1068	}
1069
1070	/*
1071	* Per section 7.4.8 of the SBP-2 spec, a mgt_ORB_timeout value can be
1072	* provided in the config rom. Most devices do provide a value, which
1073	* we'll use for login management orbs, but with some sane limits.
1074	*/
1075	static void sbp2_clamp_management_orb_timeout(struct sbp2_target *tgt)
1076	{
1077	unsigned int timeout = tgt->mgt_orb_timeout;
1078
1079	if (timeout > 40000)
1080	dev_notice(tgt_dev(tgt), "%ds mgt_ORB_timeout limited to 40s\n",
1081	timeout / 1000);
1082
1083	tgt->mgt_orb_timeout = clamp_val(timeout, 5000, 40000);
1084	}
1085
1086	static void sbp2_init_workarounds(struct sbp2_target *tgt, u32 model,
1087	u32 firmware_revision)
1088	{
1089	int i;
1090	unsigned int w = sbp2_param_workarounds;
1091
1092	if (w)
1093	dev_notice(tgt_dev(tgt),
1094	"Please notify linux1394-devel@lists.sf.net "
1095	"if you need the workarounds parameter\n");
1096
1097	if (w & SBP2_WORKAROUND_OVERRIDE)
1098	goto out;
1099
1100	for (i = 0; i < ARRAY_SIZE(sbp2_workarounds_table); i++) {
1101
1102	if (sbp2_workarounds_table[i].firmware_revision !=
1103	(firmware_revision & 0xffffff00))
1104	continue;
1105
1106	if (sbp2_workarounds_table[i].model != model &&
1107	sbp2_workarounds_table[i].model != SBP2_ROM_VALUE_WILDCARD)
1108	continue;
1109
1110	w |= sbp2_workarounds_table[i].workarounds;
1111	break;
1112	}
1113	out:
1114	if (w)
1115	dev_notice(tgt_dev(tgt), "workarounds 0x%x "
1116	"(firmware_revision 0x%06x, model_id 0x%06x)\n",
1117	w, firmware_revision, model);
1118	tgt->workarounds = w;
1119	}
1120
1121	static const struct scsi_host_template scsi_driver_template;
1122	static void sbp2_remove(struct fw_unit *unit);
1123
1124	static int sbp2_probe(struct fw_unit *unit, const struct ieee1394_device_id *id)
1125	{
1126	struct fw_device *device = fw_parent_device(unit);
1127	struct sbp2_target *tgt;
1128	struct sbp2_logical_unit *lu;
1129	struct Scsi_Host *shost;
1130	u32 model, firmware_revision;
1131
1132	/* cannot (or should not) handle targets on the local node */
1133	if (device->is_local)
1134	return -ENODEV;
1135
1136	shost = scsi_host_alloc(&scsi_driver_template, sizeof(*tgt));
1137	if (shost == NULL)
1138	return -ENOMEM;
1139
1140	tgt = (struct sbp2_target *)shost->hostdata;
1141	dev_set_drvdata(dev: &unit->device, data: tgt);
1142	tgt->unit = unit;
1143	INIT_LIST_HEAD(list: &tgt->lu_list);
1144	spin_lock_init(&tgt->lock);
1145	tgt->guid = (u64)device->config_rom[3] << 32 | device->config_rom[4];
1146
1147	if (fw_device_enable_phys_dma(device) < 0)
1148	goto fail_shost_put;
1149
1150	shost->max_cmd_len = SBP2_MAX_CDB_SIZE;
1151
1152	if (scsi_add_host_with_dma(shost, &unit->device,
1153	device->card->device) < 0)
1154	goto fail_shost_put;
1155
1156	/* implicit directory ID */
1157	tgt->directory_id = ((unit->directory - device->config_rom) * 4
1158	+ CSR_CONFIG_ROM) & 0xffffff;
1159
1160	firmware_revision = SBP2_ROM_VALUE_MISSING;
1161	model = SBP2_ROM_VALUE_MISSING;
1162
1163	if (sbp2_scan_unit_dir(tgt, directory: unit->directory, model: &model,
1164	firmware_revision: &firmware_revision) < 0)
1165	goto fail_remove;
1166
1167	sbp2_clamp_management_orb_timeout(tgt);
1168	sbp2_init_workarounds(tgt, model, firmware_revision);
1169
1170	/*
1171	* At S100 we can do 512 bytes per packet, at S200 1024 bytes,
1172	* and so on up to 4096 bytes. The SBP-2 max_payload field
1173	* specifies the max payload size as 2 ^ (max_payload + 2), so
1174	* if we set this to max_speed + 7, we get the right value.
1175	*/
1176	tgt->max_payload = min3(device->max_speed + 7, 10U,
1177	device->card->max_receive - 1);
1178
1179	/* Do the login in a workqueue so we can easily reschedule retries. */
1180	list_for_each_entry(lu, &tgt->lu_list, link)
1181	sbp2_queue_work(lu, DIV_ROUND_UP(HZ, 5));
1182
1183	return 0;
1184
1185	fail_remove:
1186	sbp2_remove(unit);
1187	return -ENOMEM;
1188
1189	fail_shost_put:
1190	scsi_host_put(t: shost);
1191	return -ENOMEM;
1192	}
1193
1194	static void sbp2_update(struct fw_unit *unit)
1195	{
1196	struct sbp2_target *tgt = dev_get_drvdata(dev: &unit->device);
1197	struct sbp2_logical_unit *lu;
1198
1199	fw_device_enable_phys_dma(fw_parent_device(unit));
1200
1201	/*
1202	* Fw-core serializes sbp2_update() against sbp2_remove().
1203	* Iteration over tgt->lu_list is therefore safe here.
1204	*/
1205	list_for_each_entry(lu, &tgt->lu_list, link) {
1206	sbp2_conditionally_block(lu);
1207	lu->retries = 0;
1208	sbp2_queue_work(lu, delay: 0);
1209	}
1210	}
1211
1212	static void sbp2_remove(struct fw_unit *unit)
1213	{
1214	struct fw_device *device = fw_parent_device(unit);
1215	struct sbp2_target *tgt = dev_get_drvdata(dev: &unit->device);
1216	struct sbp2_logical_unit *lu, *next;
1217	struct Scsi_Host *shost =
1218	container_of((void *)tgt, struct Scsi_Host, hostdata[0]);
1219	struct scsi_device *sdev;
1220
1221	/* prevent deadlocks */
1222	sbp2_unblock(tgt);
1223
1224	list_for_each_entry_safe(lu, next, &tgt->lu_list, link) {
1225	cancel_delayed_work_sync(dwork: &lu->work);
1226	sdev = scsi_device_lookup(shost, 0, 0, sbp2_lun2int(lun: lu->lun));
1227	if (sdev) {
1228	scsi_remove_device(sdev);
1229	scsi_device_put(sdev);
1230	}
1231	if (lu->login_id != INVALID_LOGIN_ID) {
1232	int generation, node_id;
1233	/*
1234	* tgt->node_id may be obsolete here if we failed
1235	* during initial login or after a bus reset where
1236	* the topology changed.
1237	*/
1238	generation = device->generation;
1239	smp_rmb(); /* node_id vs. generation */
1240	node_id = device->node_id;
1241	sbp2_send_management_orb(lu, node_id, generation,
1242	SBP2_LOGOUT_REQUEST,
1243	lun_or_login_id: lu->login_id, NULL);
1244	}
1245	fw_core_remove_address_handler(handler: &lu->address_handler);
1246	list_del(entry: &lu->link);
1247	kfree(objp: lu);
1248	}
1249	scsi_remove_host(shost);
1250	dev_notice(&unit->device, "released target %d:0:0\n", shost->host_no);
1251
1252	scsi_host_put(t: shost);
1253	}
1254
1255	#define SBP2_UNIT_SPEC_ID_ENTRY 0x0000609e
1256	#define SBP2_SW_VERSION_ENTRY 0x00010483
1257
1258	static const struct ieee1394_device_id sbp2_id_table[] = {
1259	{
1260	.match_flags = IEEE1394_MATCH_SPECIFIER_ID |
1261	IEEE1394_MATCH_VERSION,
1262	.specifier_id = SBP2_UNIT_SPEC_ID_ENTRY,
1263	.version = SBP2_SW_VERSION_ENTRY,
1264	},
1265	{ }
1266	};
1267
1268	static struct fw_driver sbp2_driver = {
1269	.driver = {
1270	.owner = THIS_MODULE,
1271	.name = KBUILD_MODNAME,
1272	.bus = &fw_bus_type,
1273	},
1274	.probe = sbp2_probe,
1275	.update = sbp2_update,
1276	.remove = sbp2_remove,
1277	.id_table = sbp2_id_table,
1278	};
1279
1280	static void sbp2_unmap_scatterlist(struct device *card_device,
1281	struct sbp2_command_orb *orb)
1282	{
1283	scsi_dma_unmap(cmd: orb->cmd);
1284
1285	if (orb->request.misc & cpu_to_be32(COMMAND_ORB_PAGE_TABLE_PRESENT))
1286	dma_unmap_single(card_device, orb->page_table_bus,
1287	sizeof(orb->page_table), DMA_TO_DEVICE);
1288	}
1289
1290	static unsigned int sbp2_status_to_sense_data(u8 *sbp2_status, u8 *sense_data)
1291	{
1292	int sam_status;
1293	int sfmt = (sbp2_status[0] >> 6) & 0x03;
1294
1295	if (sfmt == 2 || sfmt == 3) {
1296	/*
1297	* Reserved for future standardization (2) or
1298	* Status block format vendor-dependent (3)
1299	*/
1300	return DID_ERROR << 16;
1301	}
1302
1303	sense_data[0] = 0x70 | sfmt | (sbp2_status[1] & 0x80);
1304	sense_data[1] = 0x0;
1305	sense_data[2] = ((sbp2_status[1] << 1) & 0xe0) | (sbp2_status[1] & 0x0f);
1306	sense_data[3] = sbp2_status[4];
1307	sense_data[4] = sbp2_status[5];
1308	sense_data[5] = sbp2_status[6];
1309	sense_data[6] = sbp2_status[7];
1310	sense_data[7] = 10;
1311	sense_data[8] = sbp2_status[8];
1312	sense_data[9] = sbp2_status[9];
1313	sense_data[10] = sbp2_status[10];
1314	sense_data[11] = sbp2_status[11];
1315	sense_data[12] = sbp2_status[2];
1316	sense_data[13] = sbp2_status[3];
1317	sense_data[14] = sbp2_status[12];
1318	sense_data[15] = sbp2_status[13];
1319
1320	sam_status = sbp2_status[0] & 0x3f;
1321
1322	switch (sam_status) {
1323	case SAM_STAT_GOOD:
1324	case SAM_STAT_CHECK_CONDITION:
1325	case SAM_STAT_CONDITION_MET:
1326	case SAM_STAT_BUSY:
1327	case SAM_STAT_RESERVATION_CONFLICT:
1328	case SAM_STAT_COMMAND_TERMINATED:
1329	return DID_OK << 16 | sam_status;
1330
1331	default:
1332	return DID_ERROR << 16;
1333	}
1334	}
1335
1336	static void complete_command_orb(struct sbp2_orb *base_orb,
1337	struct sbp2_status *status)
1338	{
1339	struct sbp2_command_orb *orb =
1340	container_of(base_orb, struct sbp2_command_orb, base);
1341	struct fw_device *device = target_parent_device(tgt: base_orb->lu->tgt);
1342	int result;
1343
1344	if (status != NULL) {
1345	if (STATUS_GET_DEAD(*status))
1346	sbp2_agent_reset_no_wait(lu: base_orb->lu);
1347
1348	switch (STATUS_GET_RESPONSE(*status)) {
1349	case SBP2_STATUS_REQUEST_COMPLETE:
1350	result = DID_OK << 16;
1351	break;
1352	case SBP2_STATUS_TRANSPORT_FAILURE:
1353	result = DID_BUS_BUSY << 16;
1354	break;
1355	case SBP2_STATUS_ILLEGAL_REQUEST:
1356	case SBP2_STATUS_VENDOR_DEPENDENT:
1357	default:
1358	result = DID_ERROR << 16;
1359	break;
1360	}
1361
1362	if (result == DID_OK << 16 && STATUS_GET_LEN(*status) > 1)
1363	result = sbp2_status_to_sense_data(STATUS_GET_DATA(*status),
1364	sense_data: orb->cmd->sense_buffer);
1365	} else {
1366	/*
1367	* If the orb completes with status == NULL, something
1368	* went wrong, typically a bus reset happened mid-orb
1369	* or when sending the write (less likely).
1370	*/
1371	result = DID_BUS_BUSY << 16;
1372	sbp2_conditionally_block(lu: base_orb->lu);
1373	}
1374
1375	dma_unmap_single(device->card->device, orb->base.request_bus,
1376	sizeof(orb->request), DMA_TO_DEVICE);
1377	sbp2_unmap_scatterlist(card_device: device->card->device, orb);
1378
1379	orb->cmd->result = result;
1380	scsi_done(cmd: orb->cmd);
1381	}
1382
1383	static int sbp2_map_scatterlist(struct sbp2_command_orb *orb,
1384	struct fw_device *device, struct sbp2_logical_unit *lu)
1385	{
1386	struct scatterlist *sg = scsi_sglist(cmd: orb->cmd);
1387	int i, n;
1388
1389	n = scsi_dma_map(cmd: orb->cmd);
1390	if (n <= 0)
1391	goto fail;
1392
1393	/*
1394	* Handle the special case where there is only one element in
1395	* the scatter list by converting it to an immediate block
1396	* request. This is also a workaround for broken devices such
1397	* as the second generation iPod which doesn't support page
1398	* tables.
1399	*/
1400	if (n == 1) {
1401	orb->request.data_descriptor.high =
1402	cpu_to_be32(lu->tgt->address_high);
1403	orb->request.data_descriptor.low =
1404	cpu_to_be32(sg_dma_address(sg));
1405	orb->request.misc |=
1406	cpu_to_be32(COMMAND_ORB_DATA_SIZE(sg_dma_len(sg)));
1407	return 0;
1408	}
1409
1410	for_each_sg(sg, sg, n, i) {
1411	orb->page_table[i].high = cpu_to_be32(sg_dma_len(sg) << 16);
1412	orb->page_table[i].low = cpu_to_be32(sg_dma_address(sg));
1413	}
1414
1415	orb->page_table_bus =
1416	dma_map_single(device->card->device, orb->page_table,
1417	sizeof(orb->page_table), DMA_TO_DEVICE);
1418	if (dma_mapping_error(dev: device->card->device, dma_addr: orb->page_table_bus))
1419	goto fail_page_table;
1420
1421	/*
1422	* The data_descriptor pointer is the one case where we need
1423	* to fill in the node ID part of the address. All other
1424	* pointers assume that the data referenced reside on the
1425	* initiator (i.e. us), but data_descriptor can refer to data
1426	* on other nodes so we need to put our ID in descriptor.high.
1427	*/
1428	orb->request.data_descriptor.high = cpu_to_be32(lu->tgt->address_high);
1429	orb->request.data_descriptor.low = cpu_to_be32(orb->page_table_bus);
1430	orb->request.misc |= cpu_to_be32(COMMAND_ORB_PAGE_TABLE_PRESENT |
1431	COMMAND_ORB_DATA_SIZE(n));
1432
1433	return 0;
1434
1435	fail_page_table:
1436	scsi_dma_unmap(cmd: orb->cmd);
1437	fail:
1438	return -ENOMEM;
1439	}
1440
1441	/* SCSI stack integration */
1442
1443	static int sbp2_scsi_queuecommand(struct Scsi_Host *shost,
1444	struct scsi_cmnd *cmd)
1445	{
1446	struct sbp2_logical_unit *lu = cmd->device->hostdata;
1447	struct fw_device *device = target_parent_device(tgt: lu->tgt);
1448	struct sbp2_command_orb *orb;
1449	int generation, retval = SCSI_MLQUEUE_HOST_BUSY;
1450
1451	orb = kzalloc(size: sizeof(*orb), GFP_ATOMIC);
1452	if (orb == NULL)
1453	return SCSI_MLQUEUE_HOST_BUSY;
1454
1455	/* Initialize rcode to something not RCODE_COMPLETE. */
1456	orb->base.rcode = -1;
1457	kref_init(kref: &orb->base.kref);
1458	orb->cmd = cmd;
1459	orb->request.next.high = cpu_to_be32(SBP2_ORB_NULL);
1460	orb->request.misc = cpu_to_be32(
1461	COMMAND_ORB_MAX_PAYLOAD(lu->tgt->max_payload) |
1462	COMMAND_ORB_SPEED(device->max_speed) |
1463	COMMAND_ORB_NOTIFY);
1464
1465	if (cmd->sc_data_direction == DMA_FROM_DEVICE)
1466	orb->request.misc |= cpu_to_be32(COMMAND_ORB_DIRECTION);
1467
1468	generation = device->generation;
1469	smp_rmb(); /* sbp2_map_scatterlist looks at tgt->address_high */
1470
1471	if (scsi_sg_count(cmd) && sbp2_map_scatterlist(orb, device, lu) < 0)
1472	goto out;
1473
1474	memcpy(orb->request.command_block, cmd->cmnd, cmd->cmd_len);
1475
1476	orb->base.callback = complete_command_orb;
1477	orb->base.request_bus =
1478	dma_map_single(device->card->device, &orb->request,
1479	sizeof(orb->request), DMA_TO_DEVICE);
1480	if (dma_mapping_error(dev: device->card->device, dma_addr: orb->base.request_bus)) {
1481	sbp2_unmap_scatterlist(card_device: device->card->device, orb);
1482	goto out;
1483	}
1484
1485	sbp2_send_orb(orb: &orb->base, lu, node_id: lu->tgt->node_id, generation,
1486	offset: lu->command_block_agent_address + SBP2_ORB_POINTER);
1487	retval = 0;
1488	out:
1489	kref_put(kref: &orb->base.kref, release: free_orb);
1490	return retval;
1491	}
1492
1493	static int sbp2_scsi_slave_alloc(struct scsi_device *sdev)
1494	{
1495	struct sbp2_logical_unit *lu = sdev->hostdata;
1496
1497	/* (Re-)Adding logical units via the SCSI stack is not supported. */
1498	if (!lu)
1499	return -ENOSYS;
1500
1501	sdev->allow_restart = 1;
1502
1503	/*
1504	* SBP-2 does not require any alignment, but we set it anyway
1505	* for compatibility with earlier versions of this driver.
1506	*/
1507	blk_queue_update_dma_alignment(sdev->request_queue, 4 - 1);
1508
1509	if (lu->tgt->workarounds & SBP2_WORKAROUND_INQUIRY_36)
1510	sdev->inquiry_len = 36;
1511
1512	return 0;
1513	}
1514
1515	static int sbp2_scsi_slave_configure(struct scsi_device *sdev)
1516	{
1517	struct sbp2_logical_unit *lu = sdev->hostdata;
1518
1519	sdev->use_10_for_rw = 1;
1520
1521	if (sbp2_param_exclusive_login) {
1522	sdev->manage_system_start_stop = true;
1523	sdev->manage_runtime_start_stop = true;
1524	sdev->manage_shutdown = true;
1525	}
1526
1527	if (sdev->type == TYPE_ROM)
1528	sdev->use_10_for_ms = 1;
1529
1530	if (sdev->type == TYPE_DISK &&
1531	lu->tgt->workarounds & SBP2_WORKAROUND_MODE_SENSE_8)
1532	sdev->skip_ms_page_8 = 1;
1533
1534	if (lu->tgt->workarounds & SBP2_WORKAROUND_FIX_CAPACITY)
1535	sdev->fix_capacity = 1;
1536
1537	if (lu->tgt->workarounds & SBP2_WORKAROUND_POWER_CONDITION)
1538	sdev->start_stop_pwr_cond = 1;
1539
1540	if (lu->tgt->workarounds & SBP2_WORKAROUND_128K_MAX_TRANS)
1541	blk_queue_max_hw_sectors(sdev->request_queue, 128 * 1024 / 512);
1542
1543	return 0;
1544	}
1545
1546	/*
1547	* Called by scsi stack when something has really gone wrong. Usually
1548	* called when a command has timed-out for some reason.
1549	*/
1550	static int sbp2_scsi_abort(struct scsi_cmnd *cmd)
1551	{
1552	struct sbp2_logical_unit *lu = cmd->device->hostdata;
1553
1554	dev_notice(lu_dev(lu), "sbp2_scsi_abort\n");
1555	sbp2_agent_reset(lu);
1556	sbp2_cancel_orbs(lu);
1557
1558	return SUCCESS;
1559	}
1560
1561	/*
1562	* Format of /sys/bus/scsi/devices/.../ieee1394_id:
1563	* u64 EUI-64 : u24 directory_ID : u16 LUN (all printed in hexadecimal)
1564	*
1565	* This is the concatenation of target port identifier and logical unit
1566	* identifier as per SAM-2...SAM-4 annex A.
1567	*/
1568	static ssize_t sbp2_sysfs_ieee1394_id_show(struct device *dev,
1569	struct device_attribute *attr, char *buf)
1570	{
1571	struct scsi_device *sdev = to_scsi_device(dev);
1572	struct sbp2_logical_unit *lu;
1573
1574	if (!sdev)
1575	return 0;
1576
1577	lu = sdev->hostdata;
1578
1579	return sprintf(buf, fmt: "%016llx:%06x:%04x\n",
1580	(unsigned long long)lu->tgt->guid,
1581	lu->tgt->directory_id, lu->lun);
1582	}
1583
1584	static DEVICE_ATTR(ieee1394_id, S_IRUGO, sbp2_sysfs_ieee1394_id_show, NULL);
1585
1586	static struct attribute *sbp2_scsi_sysfs_attrs[] = {
1587	&dev_attr_ieee1394_id.attr,
1588	NULL
1589	};
1590
1591	ATTRIBUTE_GROUPS(sbp2_scsi_sysfs);
1592
1593	static const struct scsi_host_template scsi_driver_template = {
1594	.module = THIS_MODULE,
1595	.name = "SBP-2 IEEE-1394",
1596	.proc_name = "sbp2",
1597	.queuecommand = sbp2_scsi_queuecommand,
1598	.slave_alloc = sbp2_scsi_slave_alloc,
1599	.slave_configure = sbp2_scsi_slave_configure,
1600	.eh_abort_handler = sbp2_scsi_abort,
1601	.this_id = -1,
1602	.sg_tablesize = SG_ALL,
1603	.max_segment_size = SBP2_MAX_SEG_SIZE,
1604	.can_queue = 1,
1605	.sdev_groups = sbp2_scsi_sysfs_groups,
1606	};
1607
1608	MODULE_AUTHOR("Kristian Hoegsberg <krh@bitplanet.net>");
1609	MODULE_DESCRIPTION("SCSI over IEEE1394");
1610	MODULE_LICENSE("GPL");
1611	MODULE_DEVICE_TABLE(ieee1394, sbp2_id_table);
1612
1613	/* Provide a module alias so root-on-sbp2 initrds don't break. */
1614	MODULE_ALIAS("sbp2");
1615
1616	static int __init sbp2_init(void)
1617	{
1618	return driver_register(drv: &sbp2_driver.driver);
1619	}
1620
1621	static void __exit sbp2_cleanup(void)
1622	{
1623	driver_unregister(drv: &sbp2_driver.driver);
1624	}
1625
1626	module_init(sbp2_init);
1627	module_exit(sbp2_cleanup);
1628