drivers/firewire/fw-sbp2.c

   1 /*
   2  * SBP2 driver (SCSI over IEEE1394)
   3  *
   4  * Copyright (C) 2005-2007  Kristian Hoegsberg <krh@bitplanet.net>
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 2 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program; if not, write to the Free Software Foundation,
  18  * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  19  */
  20
  21 /*
  22  * The basic structure of this driver is based on the old storage driver,
  23  * drivers/ieee1394/sbp2.c, originally written by
  24  *     James Goodwin <jamesg@filanet.com>
  25  * with later contributions and ongoing maintenance from
  26  *     Ben Collins <bcollins@debian.org>,
  27  *     Stefan Richter <stefanr@s5r6.in-berlin.de>
  28  * and many others.
  29  */
  30
  31 #include <linux/kernel.h>
  32 #include <linux/module.h>
  33 #include <linux/moduleparam.h>
  34 #include <linux/mod_devicetable.h>
  35 #include <linux/device.h>
  36 #include <linux/scatterlist.h>
  37 #include <linux/dma-mapping.h>
  38 #include <linux/blkdev.h>
  39 #include <linux/string.h>
  40 #include <linux/stringify.h>
  41 #include <linux/timer.h>
  42 #include <linux/workqueue.h>
  43
  44 #include <scsi/scsi.h>
  45 #include <scsi/scsi_cmnd.h>
  46 #include <scsi/scsi_device.h>
  47 #include <scsi/scsi_host.h>
  48
  49 #include "fw-transaction.h"
  50 #include "fw-topology.h"
  51 #include "fw-device.h"
  52
  53 /*
  54  * So far only bridges from Oxford Semiconductor are known to support
  55  * concurrent logins. Depending on firmware, four or two concurrent logins
  56  * are possible on OXFW911 and newer Oxsemi bridges.
  57  *
  58  * Concurrent logins are useful together with cluster filesystems.
  59  */
  60 static int sbp2_param_exclusive_login = 1;
  61 module_param_named(exclusive_login, sbp2_param_exclusive_login, bool, 0644);
  62 MODULE_PARM_DESC(exclusive_login, "Exclusive login to sbp2 device "
  63                  "(default = Y, use N for concurrent initiators)");
  64
  65 /*
  66  * Flags for firmware oddities
  67  *
  68  * - 128kB max transfer
  69  *   Limit transfer size. Necessary for some old bridges.
  70  *
  71  * - 36 byte inquiry
  72  *   When scsi_mod probes the device, let the inquiry command look like that
  73  *   from MS Windows.
  74  *
  75  * - skip mode page 8
  76  *   Suppress sending of mode_sense for mode page 8 if the device pretends to
  77  *   support the SCSI Primary Block commands instead of Reduced Block Commands.
  78  *
  79  * - fix capacity
  80  *   Tell sd_mod to correct the last sector number reported by read_capacity.
  81  *   Avoids access beyond actual disk limits on devices with an off-by-one bug.
  82  *   Don't use this with devices which don't have this bug.
  83  *
  84  * - override internal blacklist
  85  *   Instead of adding to the built-in blacklist, use only the workarounds
  86  *   specified in the module load parameter.
  87  *   Useful if a blacklist entry interfered with a non-broken device.
  88  */
  89 #define SBP2_WORKAROUND_128K_MAX_TRANS  0x1
  90 #define SBP2_WORKAROUND_INQUIRY_36      0x2
  91 #define SBP2_WORKAROUND_MODE_SENSE_8    0x4
  92 #define SBP2_WORKAROUND_FIX_CAPACITY    0x8
  93 #define SBP2_WORKAROUND_OVERRIDE        0x100
  94
  95 static int sbp2_param_workarounds;
  96 module_param_named(workarounds, sbp2_param_workarounds, int, 0644);
  97 MODULE_PARM_DESC(workarounds, "Work around device bugs (default = 0"
  98         ", 128kB max transfer = " __stringify(SBP2_WORKAROUND_128K_MAX_TRANS)
  99         ", 36 byte inquiry = "    __stringify(SBP2_WORKAROUND_INQUIRY_36)
 100         ", skip mode page 8 = "   __stringify(SBP2_WORKAROUND_MODE_SENSE_8)
 101         ", fix capacity = "       __stringify(SBP2_WORKAROUND_FIX_CAPACITY)
 102         ", override internal blacklist = " __stringify(SBP2_WORKAROUND_OVERRIDE)
 103         ", or a combination)");
 104
 105 /* I don't know why the SCSI stack doesn't define something like this... */
 106 typedef void (*scsi_done_fn_t)(struct scsi_cmnd *);
 107
 108 static const char sbp2_driver_name[] = "sbp2";
 109
 110 /*
 111  * We create one struct sbp2_logical_unit per SBP-2 Logical Unit Number Entry
 112  * and one struct scsi_device per sbp2_logical_unit.
 113  */
 114 struct sbp2_logical_unit {
 115         struct sbp2_target *tgt;
 116         struct list_head link;
 117         struct scsi_device *sdev;
 118         struct fw_address_handler address_handler;
 119         struct list_head orb_list;
 120
 121         u64 command_block_agent_address;
 122         u16 lun;
 123         int login_id;
 124
 125         /*
 126          * The generation is updated once we've logged in or reconnected
 127          * to the logical unit.  Thus, I/O to the device will automatically
 128          * fail and get retried if it happens in a window where the device
 129          * is not ready, e.g. after a bus reset but before we reconnect.
 130          */
 131         int generation;
 132         int retries;
 133         struct delayed_work work;
 134 };
 135
 136 /*
 137  * We create one struct sbp2_target per IEEE 1212 Unit Directory
 138  * and one struct Scsi_Host per sbp2_target.
 139  */
 140 struct sbp2_target {
 141         struct kref kref;
 142         struct fw_unit *unit;
 143
 144         u64 management_agent_address;
 145         int directory_id;
 146         int node_id;
 147         int address_high;
 148
 149         unsigned workarounds;
 150         struct list_head lu_list;
 151 };
 152
 153 #define SBP2_MAX_SG_ELEMENT_LENGTH      0xf000
 154 #define SBP2_ORB_TIMEOUT                2000    /* Timeout in ms */
 155 #define SBP2_ORB_NULL                   0x80000000
 156
 157 #define SBP2_DIRECTION_TO_MEDIA         0x0
 158 #define SBP2_DIRECTION_FROM_MEDIA       0x1
 159
 160 /* Unit directory keys */
 161 #define SBP2_CSR_FIRMWARE_REVISION      0x3c
 162 #define SBP2_CSR_LOGICAL_UNIT_NUMBER    0x14
 163 #define SBP2_CSR_LOGICAL_UNIT_DIRECTORY 0xd4
 164
 165 /* Management orb opcodes */
 166 #define SBP2_LOGIN_REQUEST              0x0
 167 #define SBP2_QUERY_LOGINS_REQUEST       0x1
 168 #define SBP2_RECONNECT_REQUEST          0x3
 169 #define SBP2_SET_PASSWORD_REQUEST       0x4
 170 #define SBP2_LOGOUT_REQUEST             0x7
 171 #define SBP2_ABORT_TASK_REQUEST         0xb
 172 #define SBP2_ABORT_TASK_SET             0xc
 173 #define SBP2_LOGICAL_UNIT_RESET         0xe
 174 #define SBP2_TARGET_RESET_REQUEST       0xf
 175
 176 /* Offsets for command block agent registers */
 177 #define SBP2_AGENT_STATE                0x00
 178 #define SBP2_AGENT_RESET                0x04
 179 #define SBP2_ORB_POINTER                0x08
 180 #define SBP2_DOORBELL                   0x10
 181 #define SBP2_UNSOLICITED_STATUS_ENABLE  0x14
 182
 183 /* Status write response codes */
 184 #define SBP2_STATUS_REQUEST_COMPLETE    0x0
 185 #define SBP2_STATUS_TRANSPORT_FAILURE   0x1
 186 #define SBP2_STATUS_ILLEGAL_REQUEST     0x2
 187 #define SBP2_STATUS_VENDOR_DEPENDENT    0x3
 188
 189 #define STATUS_GET_ORB_HIGH(v)          ((v).status & 0xffff)
 190 #define STATUS_GET_SBP_STATUS(v)        (((v).status >> 16) & 0xff)
 191 #define STATUS_GET_LEN(v)               (((v).status >> 24) & 0x07)
 192 #define STATUS_GET_DEAD(v)              (((v).status >> 27) & 0x01)
 193 #define STATUS_GET_RESPONSE(v)          (((v).status >> 28) & 0x03)
 194 #define STATUS_GET_SOURCE(v)            (((v).status >> 30) & 0x03)
 195 #define STATUS_GET_ORB_LOW(v)           ((v).orb_low)
 196 #define STATUS_GET_DATA(v)              ((v).data)
 197
 198 struct sbp2_status {
 199         u32 status;
 200         u32 orb_low;
 201         u8 data[24];
 202 };
 203
 204 struct sbp2_pointer {
 205         u32 high;
 206         u32 low;
 207 };
 208
 209 struct sbp2_orb {
 210         struct fw_transaction t;
 211         struct kref kref;
 212         dma_addr_t request_bus;
 213         int rcode;
 214         struct sbp2_pointer pointer;
 215         void (*callback)(struct sbp2_orb * orb, struct sbp2_status * status);
 216         struct list_head link;
 217 };
 218
 219 #define MANAGEMENT_ORB_LUN(v)                   ((v))
 220 #define MANAGEMENT_ORB_FUNCTION(v)              ((v) << 16)
 221 #define MANAGEMENT_ORB_RECONNECT(v)             ((v) << 20)
 222 #define MANAGEMENT_ORB_EXCLUSIVE(v)             ((v) ? 1 << 28 : 0)
 223 #define MANAGEMENT_ORB_REQUEST_FORMAT(v)        ((v) << 29)
 224 #define MANAGEMENT_ORB_NOTIFY                   ((1) << 31)
 225
 226 #define MANAGEMENT_ORB_RESPONSE_LENGTH(v)       ((v))
 227 #define MANAGEMENT_ORB_PASSWORD_LENGTH(v)       ((v) << 16)
 228
 229 struct sbp2_management_orb {
 230         struct sbp2_orb base;
 231         struct {
 232                 struct sbp2_pointer password;
 233                 struct sbp2_pointer response;
 234                 u32 misc;
 235                 u32 length;
 236                 struct sbp2_pointer status_fifo;
 237         } request;
 238         __be32 response[4];
 239         dma_addr_t response_bus;
 240         struct completion done;
 241         struct sbp2_status status;
 242 };
 243
 244 #define LOGIN_RESPONSE_GET_LOGIN_ID(v)  ((v).misc & 0xffff)
 245 #define LOGIN_RESPONSE_GET_LENGTH(v)    (((v).misc >> 16) & 0xffff)
 246
 247 struct sbp2_login_response {
 248         u32 misc;
 249         struct sbp2_pointer command_block_agent;
 250         u32 reconnect_hold;
 251 };
 252 #define COMMAND_ORB_DATA_SIZE(v)        ((v))
 253 #define COMMAND_ORB_PAGE_SIZE(v)        ((v) << 16)
 254 #define COMMAND_ORB_PAGE_TABLE_PRESENT  ((1) << 19)
 255 #define COMMAND_ORB_MAX_PAYLOAD(v)      ((v) << 20)
 256 #define COMMAND_ORB_SPEED(v)            ((v) << 24)
 257 #define COMMAND_ORB_DIRECTION(v)        ((v) << 27)
 258 #define COMMAND_ORB_REQUEST_FORMAT(v)   ((v) << 29)
 259 #define COMMAND_ORB_NOTIFY              ((1) << 31)
 260
 261 struct sbp2_command_orb {
 262         struct sbp2_orb base;
 263         struct {
 264                 struct sbp2_pointer next;
 265                 struct sbp2_pointer data_descriptor;
 266                 u32 misc;
 267                 u8 command_block[12];
 268         } request;
 269         struct scsi_cmnd *cmd;
 270         scsi_done_fn_t done;
 271         struct sbp2_logical_unit *lu;
 272
 273         struct sbp2_pointer page_table[SG_ALL] __attribute__((aligned(8)));
 274         dma_addr_t page_table_bus;
 275 };
 276
 277 /*
 278  * List of devices with known bugs.
 279  *
 280  * The firmware_revision field, masked with 0xffff00, is the best
 281  * indicator for the type of bridge chip of a device.  It yields a few
 282  * false positives but this did not break correctly behaving devices
 283  * so far.  We use ~0 as a wildcard, since the 24 bit values we get
 284  * from the config rom can never match that.
 285  */
 286 static const struct {
 287         u32 firmware_revision;
 288         u32 model;
 289         unsigned workarounds;
 290 } sbp2_workarounds_table[] = {
 291         /* DViCO Momobay CX-1 with TSB42AA9 bridge */ {
 292                 .firmware_revision      = 0x002800,
 293                 .model                  = 0x001010,
 294                 .workarounds            = SBP2_WORKAROUND_INQUIRY_36 |
 295                                           SBP2_WORKAROUND_MODE_SENSE_8,
 296         },
 297         /* Initio bridges, actually only needed for some older ones */ {
 298                 .firmware_revision      = 0x000200,
 299                 .model                  = ~0,
 300                 .workarounds            = SBP2_WORKAROUND_INQUIRY_36,
 301         },
 302         /* Symbios bridge */ {
 303                 .firmware_revision      = 0xa0b800,
 304                 .model                  = ~0,
 305                 .workarounds            = SBP2_WORKAROUND_128K_MAX_TRANS,
 306         },
 307
 308         /*
 309          * There are iPods (2nd gen, 3rd gen) with model_id == 0, but
 310          * these iPods do not feature the read_capacity bug according
 311          * to one report.  Read_capacity behaviour as well as model_id
 312          * could change due to Apple-supplied firmware updates though.
 313          */
 314
 315         /* iPod 4th generation. */ {
 316                 .firmware_revision      = 0x0a2700,
 317                 .model                  = 0x000021,
 318                 .workarounds            = SBP2_WORKAROUND_FIX_CAPACITY,
 319         },
 320         /* iPod mini */ {
 321                 .firmware_revision      = 0x0a2700,
 322                 .model                  = 0x000023,
 323                 .workarounds            = SBP2_WORKAROUND_FIX_CAPACITY,
 324         },
 325         /* iPod Photo */ {
 326                 .firmware_revision      = 0x0a2700,
 327                 .model                  = 0x00007e,
 328                 .workarounds            = SBP2_WORKAROUND_FIX_CAPACITY,
 329         }
 330 };
 331
 332 static void
 333 free_orb(struct kref *kref)
 334 {
 335         struct sbp2_orb *orb = container_of(kref, struct sbp2_orb, kref);
 336
 337         kfree(orb);
 338 }
 339
 340 static void
 341 sbp2_status_write(struct fw_card *card, struct fw_request *request,
 342                   int tcode, int destination, int source,
 343                   int generation, int speed,
 344                   unsigned long long offset,
 345                   void *payload, size_t length, void *callback_data)
 346 {
 347         struct sbp2_logical_unit *lu = callback_data;
 348         struct sbp2_orb *orb;
 349         struct sbp2_status status;
 350         size_t header_size;
 351         unsigned long flags;
 352
 353         if (tcode != TCODE_WRITE_BLOCK_REQUEST ||
 354             length == 0 || length > sizeof(status)) {
 355                 fw_send_response(card, request, RCODE_TYPE_ERROR);
 356                 return;
 357         }
 358
 359         header_size = min(length, 2 * sizeof(u32));
 360         fw_memcpy_from_be32(&status, payload, header_size);
 361         if (length > header_size)
 362                 memcpy(status.data, payload + 8, length - header_size);
 363         if (STATUS_GET_SOURCE(status) == 2 || STATUS_GET_SOURCE(status) == 3) {
 364                 fw_notify("non-orb related status write, not handled\n");
 365                 fw_send_response(card, request, RCODE_COMPLETE);
 366                 return;
 367         }
 368
 369         /* Lookup the orb corresponding to this status write. */
 370         spin_lock_irqsave(&card->lock, flags);
 371         list_for_each_entry(orb, &lu->orb_list, link) {
 372                 if (STATUS_GET_ORB_HIGH(status) == 0 &&
 373                     STATUS_GET_ORB_LOW(status) == orb->request_bus) {
 374                         orb->rcode = RCODE_COMPLETE;
 375                         list_del(&orb->link);
 376                         break;
 377                 }
 378         }
 379         spin_unlock_irqrestore(&card->lock, flags);
 380
 381         if (&orb->link != &lu->orb_list)
 382                 orb->callback(orb, &status);
 383         else
 384                 fw_error("status write for unknown orb\n");
 385
 386         kref_put(&orb->kref, free_orb);
 387
 388         fw_send_response(card, request, RCODE_COMPLETE);
 389 }
 390
 391 static void
 392 complete_transaction(struct fw_card *card, int rcode,
 393                      void *payload, size_t length, void *data)
 394 {
 395         struct sbp2_orb *orb = data;
 396         unsigned long flags;
 397
 398         /*
 399          * This is a little tricky.  We can get the status write for
 400          * the orb before we get this callback.  The status write
 401          * handler above will assume the orb pointer transaction was
 402          * successful and set the rcode to RCODE_COMPLETE for the orb.
 403          * So this callback only sets the rcode if it hasn't already
 404          * been set and only does the cleanup if the transaction
 405          * failed and we didn't already get a status write.
 406          */
 407         spin_lock_irqsave(&card->lock, flags);
 408
 409         if (orb->rcode == -1)
 410                 orb->rcode = rcode;
 411         if (orb->rcode != RCODE_COMPLETE) {
 412                 list_del(&orb->link);
 413                 spin_unlock_irqrestore(&card->lock, flags);
 414                 orb->callback(orb, NULL);
 415         } else {
 416                 spin_unlock_irqrestore(&card->lock, flags);
 417         }
 418
 419         kref_put(&orb->kref, free_orb);
 420 }
 421
 422 static void
 423 sbp2_send_orb(struct sbp2_orb *orb, struct sbp2_logical_unit *lu,
 424               int node_id, int generation, u64 offset)
 425 {
 426         struct fw_device *device = fw_device(lu->tgt->unit->device.parent);
 427         unsigned long flags;
 428
 429         orb->pointer.high = 0;
 430         orb->pointer.low = orb->request_bus;
 431         fw_memcpy_to_be32(&orb->pointer, &orb->pointer, sizeof(orb->pointer));
 432
 433         spin_lock_irqsave(&device->card->lock, flags);
 434         list_add_tail(&orb->link, &lu->orb_list);
 435         spin_unlock_irqrestore(&device->card->lock, flags);
 436
 437         /* Take a ref for the orb list and for the transaction callback. */
 438         kref_get(&orb->kref);
 439         kref_get(&orb->kref);
 440
 441         fw_send_request(device->card, &orb->t, TCODE_WRITE_BLOCK_REQUEST,
 442                         node_id, generation, device->max_speed, offset,
 443                         &orb->pointer, sizeof(orb->pointer),
 444                         complete_transaction, orb);
 445 }
 446
 447 static int sbp2_cancel_orbs(struct sbp2_logical_unit *lu)
 448 {
 449         struct fw_device *device = fw_device(lu->tgt->unit->device.parent);
 450         struct sbp2_orb *orb, *next;
 451         struct list_head list;
 452         unsigned long flags;
 453         int retval = -ENOENT;
 454
 455         INIT_LIST_HEAD(&list);
 456         spin_lock_irqsave(&device->card->lock, flags);
 457         list_splice_init(&lu->orb_list, &list);
 458         spin_unlock_irqrestore(&device->card->lock, flags);
 459
 460         list_for_each_entry_safe(orb, next, &list, link) {
 461                 retval = 0;
 462                 if (fw_cancel_transaction(device->card, &orb->t) == 0)
 463                         continue;
 464
 465                 orb->rcode = RCODE_CANCELLED;
 466                 orb->callback(orb, NULL);
 467         }
 468
 469         return retval;
 470 }
 471
 472 static void
 473 complete_management_orb(struct sbp2_orb *base_orb, struct sbp2_status *status)
 474 {
 475         struct sbp2_management_orb *orb =
 476                 container_of(base_orb, struct sbp2_management_orb, base);
 477
 478         if (status)
 479                 memcpy(&orb->status, status, sizeof(*status));
 480         complete(&orb->done);
 481 }
 482
 483 static int
 484 sbp2_send_management_orb(struct sbp2_logical_unit *lu, int node_id,
 485                          int generation, int function, int lun_or_login_id,
 486                          void *response)
 487 {
 488         struct fw_device *device = fw_device(lu->tgt->unit->device.parent);
 489         struct sbp2_management_orb *orb;
 490         int retval = -ENOMEM;
 491
 492         orb = kzalloc(sizeof(*orb), GFP_ATOMIC);
 493         if (orb == NULL)
 494                 return -ENOMEM;
 495
 496         kref_init(&orb->base.kref);
 497         orb->response_bus =
 498                 dma_map_single(device->card->device, &orb->response,
 499                                sizeof(orb->response), DMA_FROM_DEVICE);
 500         if (dma_mapping_error(orb->response_bus))
 501                 goto fail_mapping_response;
 502
 503         orb->request.response.high    = 0;
 504         orb->request.response.low     = orb->response_bus;
 505
 506         orb->request.misc =
 507                 MANAGEMENT_ORB_NOTIFY |
 508                 MANAGEMENT_ORB_FUNCTION(function) |
 509                 MANAGEMENT_ORB_LUN(lun_or_login_id);
 510         orb->request.length =
 511                 MANAGEMENT_ORB_RESPONSE_LENGTH(sizeof(orb->response));
 512
 513         orb->request.status_fifo.high = lu->address_handler.offset >> 32;
 514         orb->request.status_fifo.low  = lu->address_handler.offset;
 515
 516         if (function == SBP2_LOGIN_REQUEST) {
 517                 orb->request.misc |=
 518                         MANAGEMENT_ORB_EXCLUSIVE(sbp2_param_exclusive_login) |
 519                         MANAGEMENT_ORB_RECONNECT(0);
 520         }
 521
 522         fw_memcpy_to_be32(&orb->request, &orb->request, sizeof(orb->request));
 523
 524         init_completion(&orb->done);
 525         orb->base.callback = complete_management_orb;
 526
 527         orb->base.request_bus =
 528                 dma_map_single(device->card->device, &orb->request,
 529                                sizeof(orb->request), DMA_TO_DEVICE);
 530         if (dma_mapping_error(orb->base.request_bus))
 531                 goto fail_mapping_request;
 532
 533         sbp2_send_orb(&orb->base, lu, node_id, generation,
 534                       lu->tgt->management_agent_address);
 535
 536         wait_for_completion_timeout(&orb->done,
 537                                     msecs_to_jiffies(SBP2_ORB_TIMEOUT));
 538
 539         retval = -EIO;
 540         if (sbp2_cancel_orbs(lu) == 0) {
 541                 fw_error("orb reply timed out, rcode=0x%02x\n",
 542                          orb->base.rcode);
 543                 goto out;
 544         }
 545
 546         if (orb->base.rcode != RCODE_COMPLETE) {
 547                 fw_error("management write failed, rcode 0x%02x\n",
 548                          orb->base.rcode);
 549                 goto out;
 550         }
 551
 552         if (STATUS_GET_RESPONSE(orb->status) != 0 ||
 553             STATUS_GET_SBP_STATUS(orb->status) != 0) {
 554                 fw_error("error status: %d:%d\n",
 555                          STATUS_GET_RESPONSE(orb->status),
 556                          STATUS_GET_SBP_STATUS(orb->status));
 557                 goto out;
 558         }
 559
 560         retval = 0;
 561  out:
 562         dma_unmap_single(device->card->device, orb->base.request_bus,
 563                          sizeof(orb->request), DMA_TO_DEVICE);
 564  fail_mapping_request:
 565         dma_unmap_single(device->card->device, orb->response_bus,
 566                          sizeof(orb->response), DMA_FROM_DEVICE);
 567  fail_mapping_response:
 568         if (response)
 569                 fw_memcpy_from_be32(response,
 570                                     orb->response, sizeof(orb->response));
 571         kref_put(&orb->base.kref, free_orb);
 572
 573         return retval;
 574 }
 575
 576 static void
 577 complete_agent_reset_write(struct fw_card *card, int rcode,
 578                            void *payload, size_t length, void *data)
 579 {
 580         struct fw_transaction *t = data;
 581
 582         kfree(t);
 583 }
 584
 585 static int sbp2_agent_reset(struct sbp2_logical_unit *lu)
 586 {
 587         struct fw_device *device = fw_device(lu->tgt->unit->device.parent);
 588         struct fw_transaction *t;
 589         static u32 zero;
 590
 591         t = kzalloc(sizeof(*t), GFP_ATOMIC);
 592         if (t == NULL)
 593                 return -ENOMEM;
 594
 595         fw_send_request(device->card, t, TCODE_WRITE_QUADLET_REQUEST,
 596                         lu->tgt->node_id, lu->generation, device->max_speed,
 597                         lu->command_block_agent_address + SBP2_AGENT_RESET,
 598                         &zero, sizeof(zero), complete_agent_reset_write, t);
 599
 600         return 0;
 601 }
 602
 603 static void sbp2_release_target(struct kref *kref)
 604 {
 605         struct sbp2_target *tgt = container_of(kref, struct sbp2_target, kref);
 606         struct sbp2_logical_unit *lu, *next;
 607         struct Scsi_Host *shost =
 608                 container_of((void *)tgt, struct Scsi_Host, hostdata[0]);
 609         struct fw_device *device = fw_device(tgt->unit->device.parent);
 610
 611         list_for_each_entry_safe(lu, next, &tgt->lu_list, link) {
 612                 if (lu->sdev)
 613                         scsi_remove_device(lu->sdev);
 614
 615                 if (!fw_device_is_shutdown(device))
 616                         sbp2_send_management_orb(lu, tgt->node_id,
 617                                         lu->generation, SBP2_LOGOUT_REQUEST,
 618                                         lu->login_id, NULL);
 619
 620                 fw_core_remove_address_handler(&lu->address_handler);
 621                 list_del(&lu->link);
 622                 kfree(lu);
 623         }
 624         scsi_remove_host(shost);
 625         fw_notify("released %s\n", tgt->unit->device.bus_id);
 626
 627         put_device(&tgt->unit->device);
 628         scsi_host_put(shost);
 629 }
 630
 631 static struct workqueue_struct *sbp2_wq;
 632
 633 /*
 634  * Always get the target's kref when scheduling work on one its units.
 635  * Each workqueue job is responsible to call sbp2_target_put() upon return.
 636  */
 637 static void sbp2_queue_work(struct sbp2_logical_unit *lu, unsigned long delay)
 638 {
 639         if (queue_delayed_work(sbp2_wq, &lu->work, delay))
 640                 kref_get(&lu->tgt->kref);
 641 }
 642
 643 static void sbp2_target_put(struct sbp2_target *tgt)
 644 {
 645         kref_put(&tgt->kref, sbp2_release_target);
 646 }
 647
 648 static void sbp2_reconnect(struct work_struct *work);
 649
 650 static void sbp2_login(struct work_struct *work)
 651 {
 652         struct sbp2_logical_unit *lu =
 653                 container_of(work, struct sbp2_logical_unit, work.work);
 654         struct Scsi_Host *shost =
 655                 container_of((void *)lu->tgt, struct Scsi_Host, hostdata[0]);
 656         struct scsi_device *sdev;
 657         struct scsi_lun eight_bytes_lun;
 658         struct fw_unit *unit = lu->tgt->unit;
 659         struct fw_device *device = fw_device(unit->device.parent);
 660         struct sbp2_login_response response;
 661         int generation, node_id, local_node_id;
 662
 663         generation    = device->card->generation;
 664         node_id       = device->node->node_id;
 665         local_node_id = device->card->local_node->node_id;
 666
 667         if (sbp2_send_management_orb(lu, node_id, generation,
 668                                 SBP2_LOGIN_REQUEST, lu->lun, &response) < 0) {
 669                 if (lu->retries++ < 5)
 670                         sbp2_queue_work(lu, DIV_ROUND_UP(HZ, 5));
 671                 else
 672                         fw_error("failed to login to %s LUN %04x\n",
 673                                  unit->device.bus_id, lu->lun);
 674                 goto out;
 675         }
 676
 677         lu->generation        = generation;
 678         lu->tgt->node_id      = node_id;
 679         lu->tgt->address_high = local_node_id << 16;
 680
 681         /* Get command block agent offset and login id. */
 682         lu->command_block_agent_address =
 683                 ((u64) (response.command_block_agent.high & 0xffff) << 32) |
 684                 response.command_block_agent.low;
 685         lu->login_id = LOGIN_RESPONSE_GET_LOGIN_ID(response);
 686
 687         fw_notify("logged in to %s LUN %04x (%d retries)\n",
 688                   unit->device.bus_id, lu->lun, lu->retries);
 689
 690 #if 0
 691         /* FIXME: The linux1394 sbp2 does this last step. */
 692         sbp2_set_busy_timeout(scsi_id);
 693 #endif
 694
 695         PREPARE_DELAYED_WORK(&lu->work, sbp2_reconnect);
 696         sbp2_agent_reset(lu);
 697
 698         memset(&eight_bytes_lun, 0, sizeof(eight_bytes_lun));
 699         eight_bytes_lun.scsi_lun[0] = (lu->lun >> 8) & 0xff;
 700         eight_bytes_lun.scsi_lun[1] = lu->lun & 0xff;
 701
 702         sdev = __scsi_add_device(shost, 0, 0,
 703                                  scsilun_to_int(&eight_bytes_lun), lu);
 704         if (IS_ERR(sdev)) {
 705                 sbp2_send_management_orb(lu, node_id, generation,
 706                                 SBP2_LOGOUT_REQUEST, lu->login_id, NULL);
 707                 /*
 708                  * Set this back to sbp2_login so we fall back and
 709                  * retry login on bus reset.
 710                  */
 711                 PREPARE_DELAYED_WORK(&lu->work, sbp2_login);
 712         } else {
 713                 lu->sdev = sdev;
 714                 scsi_device_put(sdev);
 715         }
 716  out:
 717         sbp2_target_put(lu->tgt);
 718 }
 719
 720 static int sbp2_add_logical_unit(struct sbp2_target *tgt, int lun_entry)
 721 {
 722         struct sbp2_logical_unit *lu;
 723
 724         lu = kmalloc(sizeof(*lu), GFP_KERNEL);
 725         if (!lu)
 726                 return -ENOMEM;
 727
 728         lu->address_handler.length           = 0x100;
 729         lu->address_handler.address_callback = sbp2_status_write;
 730         lu->address_handler.callback_data    = lu;
 731
 732         if (fw_core_add_address_handler(&lu->address_handler,
 733                                         &fw_high_memory_region) < 0) {
 734                 kfree(lu);
 735                 return -ENOMEM;
 736         }
 737
 738         lu->tgt  = tgt;
 739         lu->sdev = NULL;
 740         lu->lun  = lun_entry & 0xffff;
 741         lu->retries = 0;
 742         INIT_LIST_HEAD(&lu->orb_list);
 743         INIT_DELAYED_WORK(&lu->work, sbp2_login);
 744
 745         list_add_tail(&lu->link, &tgt->lu_list);
 746         return 0;
 747 }
 748
 749 static int sbp2_scan_logical_unit_dir(struct sbp2_target *tgt, u32 *directory)
 750 {
 751         struct fw_csr_iterator ci;
 752         int key, value;
 753
 754         fw_csr_iterator_init(&ci, directory);
 755         while (fw_csr_iterator_next(&ci, &key, &value))
 756                 if (key == SBP2_CSR_LOGICAL_UNIT_NUMBER &&
 757                     sbp2_add_logical_unit(tgt, value) < 0)
 758                         return -ENOMEM;
 759         return 0;
 760 }
 761
 762 static int sbp2_scan_unit_dir(struct sbp2_target *tgt, u32 *directory,
 763                               u32 *model, u32 *firmware_revision)
 764 {
 765         struct fw_csr_iterator ci;
 766         int key, value;
 767
 768         fw_csr_iterator_init(&ci, directory);
 769         while (fw_csr_iterator_next(&ci, &key, &value)) {
 770                 switch (key) {
 771
 772                 case CSR_DEPENDENT_INFO | CSR_OFFSET:
 773                         tgt->management_agent_address =
 774                                         CSR_REGISTER_BASE + 4 * value;
 775                         break;
 776
 777                 case CSR_DIRECTORY_ID:
 778                         tgt->directory_id = value;
 779                         break;
 780
 781                 case CSR_MODEL:
 782                         *model = value;
 783                         break;
 784
 785                 case SBP2_CSR_FIRMWARE_REVISION:
 786                         *firmware_revision = value;
 787                         break;
 788
 789                 case SBP2_CSR_LOGICAL_UNIT_NUMBER:
 790                         if (sbp2_add_logical_unit(tgt, value) < 0)
 791                                 return -ENOMEM;
 792                         break;
 793
 794                 case SBP2_CSR_LOGICAL_UNIT_DIRECTORY:
 795                         if (sbp2_scan_logical_unit_dir(tgt, ci.p + value) < 0)
 796                                 return -ENOMEM;
 797                         break;
 798                 }
 799         }
 800         return 0;
 801 }
 802
 803 static void sbp2_init_workarounds(struct sbp2_target *tgt, u32 model,
 804                                   u32 firmware_revision)
 805 {
 806         int i;
 807         unsigned w = sbp2_param_workarounds;
 808
 809         if (w)
 810                 fw_notify("Please notify linux1394-devel@lists.sourceforge.net "
 811                           "if you need the workarounds parameter for %s\n",
 812                           tgt->unit->device.bus_id);
 813
 814         if (w & SBP2_WORKAROUND_OVERRIDE)
 815                 goto out;
 816
 817         for (i = 0; i < ARRAY_SIZE(sbp2_workarounds_table); i++) {
 818
 819                 if (sbp2_workarounds_table[i].firmware_revision !=
 820                     (firmware_revision & 0xffffff00))
 821                         continue;
 822
 823                 if (sbp2_workarounds_table[i].model != model &&
 824                     sbp2_workarounds_table[i].model != ~0)
 825                         continue;
 826
 827                 w |= sbp2_workarounds_table[i].workarounds;
 828                 break;
 829         }
 830  out:
 831         if (w)
 832                 fw_notify("Workarounds for %s: 0x%x "
 833                           "(firmware_revision 0x%06x, model_id 0x%06x)\n",
 834                           tgt->unit->device.bus_id,
 835                           w, firmware_revision, model);
 836         tgt->workarounds = w;
 837 }
 838
 839 static struct scsi_host_template scsi_driver_template;
 840
 841 static int sbp2_probe(struct device *dev)
 842 {
 843         struct fw_unit *unit = fw_unit(dev);
 844         struct fw_device *device = fw_device(unit->device.parent);
 845         struct sbp2_target *tgt;
 846         struct sbp2_logical_unit *lu;
 847         struct Scsi_Host *shost;
 848         u32 model, firmware_revision;
 849
 850         shost = scsi_host_alloc(&scsi_driver_template, sizeof(*tgt));
 851         if (shost == NULL)
 852                 return -ENOMEM;
 853
 854         tgt = (struct sbp2_target *)shost->hostdata;
 855         unit->device.driver_data = tgt;
 856         tgt->unit = unit;
 857         kref_init(&tgt->kref);
 858         INIT_LIST_HEAD(&tgt->lu_list);
 859
 860         if (fw_device_enable_phys_dma(device) < 0)
 861                 goto fail_shost_put;
 862
 863         if (scsi_add_host(shost, &unit->device) < 0)
 864                 goto fail_shost_put;
 865
 866         /* Initialize to values that won't match anything in our table. */
 867         firmware_revision = 0xff000000;
 868         model = 0xff000000;
 869
 870         /* implicit directory ID */
 871         tgt->directory_id = ((unit->directory - device->config_rom) * 4
 872                              + CSR_CONFIG_ROM) & 0xffffff;
 873
 874         if (sbp2_scan_unit_dir(tgt, unit->directory, &model,
 875                                &firmware_revision) < 0)
 876                 goto fail_tgt_put;
 877
 878         sbp2_init_workarounds(tgt, model, firmware_revision);
 879
 880         get_device(&unit->device);
 881
 882         /* Do the login in a workqueue so we can easily reschedule retries. */
 883         list_for_each_entry(lu, &tgt->lu_list, link)
 884                 sbp2_queue_work(lu, 0);
 885         return 0;
 886
 887  fail_tgt_put:
 888         sbp2_target_put(tgt);
 889         return -ENOMEM;
 890
 891  fail_shost_put:
 892         scsi_host_put(shost);
 893         return -ENOMEM;
 894 }
 895
 896 static int sbp2_remove(struct device *dev)
 897 {
 898         struct fw_unit *unit = fw_unit(dev);
 899         struct sbp2_target *tgt = unit->device.driver_data;
 900
 901         sbp2_target_put(tgt);
 902         return 0;
 903 }
 904
 905 static void sbp2_reconnect(struct work_struct *work)
 906 {
 907         struct sbp2_logical_unit *lu =
 908                 container_of(work, struct sbp2_logical_unit, work.work);
 909         struct fw_unit *unit = lu->tgt->unit;
 910         struct fw_device *device = fw_device(unit->device.parent);
 911         int generation, node_id, local_node_id;
 912
 913         generation    = device->card->generation;
 914         node_id       = device->node->node_id;
 915         local_node_id = device->card->local_node->node_id;
 916
 917         if (sbp2_send_management_orb(lu, node_id, generation,
 918                                      SBP2_RECONNECT_REQUEST,
 919                                      lu->login_id, NULL) < 0) {
 920                 if (lu->retries++ >= 5) {
 921                         fw_error("failed to reconnect to %s\n",
 922                                  unit->device.bus_id);
 923                         /* Fall back and try to log in again. */
 924                         lu->retries = 0;
 925                         PREPARE_DELAYED_WORK(&lu->work, sbp2_login);
 926                 }
 927                 sbp2_queue_work(lu, DIV_ROUND_UP(HZ, 5));
 928                 goto out;
 929         }
 930
 931         lu->generation        = generation;
 932         lu->tgt->node_id      = node_id;
 933         lu->tgt->address_high = local_node_id << 16;
 934
 935         fw_notify("reconnected to %s LUN %04x (%d retries)\n",
 936                   unit->device.bus_id, lu->lun, lu->retries);
 937
 938         sbp2_agent_reset(lu);
 939         sbp2_cancel_orbs(lu);
 940  out:
 941         sbp2_target_put(lu->tgt);
 942 }
 943
 944 static void sbp2_update(struct fw_unit *unit)
 945 {
 946         struct sbp2_target *tgt = unit->device.driver_data;
 947         struct sbp2_logical_unit *lu;
 948
 949         fw_device_enable_phys_dma(fw_device(unit->device.parent));
 950
 951         /*
 952          * Fw-core serializes sbp2_update() against sbp2_remove().
 953          * Iteration over tgt->lu_list is therefore safe here.
 954          */
 955         list_for_each_entry(lu, &tgt->lu_list, link) {
 956                 lu->retries = 0;
 957                 sbp2_queue_work(lu, 0);
 958         }
 959 }
 960
 961 #define SBP2_UNIT_SPEC_ID_ENTRY 0x0000609e
 962 #define SBP2_SW_VERSION_ENTRY   0x00010483
 963
 964 static const struct fw_device_id sbp2_id_table[] = {
 965         {
 966                 .match_flags  = FW_MATCH_SPECIFIER_ID | FW_MATCH_VERSION,
 967                 .specifier_id = SBP2_UNIT_SPEC_ID_ENTRY,
 968                 .version      = SBP2_SW_VERSION_ENTRY,
 969         },
 970         { }
 971 };
 972
 973 static struct fw_driver sbp2_driver = {
 974         .driver   = {
 975                 .owner  = THIS_MODULE,
 976                 .name   = sbp2_driver_name,
 977                 .bus    = &fw_bus_type,
 978                 .probe  = sbp2_probe,
 979                 .remove = sbp2_remove,
 980         },
 981         .update   = sbp2_update,
 982         .id_table = sbp2_id_table,
 983 };
 984
 985 static unsigned int
 986 sbp2_status_to_sense_data(u8 *sbp2_status, u8 *sense_data)
 987 {
 988         int sam_status;
 989
 990         sense_data[0] = 0x70;
 991         sense_data[1] = 0x0;
 992         sense_data[2] = sbp2_status[1];
 993         sense_data[3] = sbp2_status[4];
 994         sense_data[4] = sbp2_status[5];
 995         sense_data[5] = sbp2_status[6];
 996         sense_data[6] = sbp2_status[7];
 997         sense_data[7] = 10;
 998         sense_data[8] = sbp2_status[8];
 999         sense_data[9] = sbp2_status[9];
1000         sense_data[10] = sbp2_status[10];
1001         sense_data[11] = sbp2_status[11];
1002         sense_data[12] = sbp2_status[2];
1003         sense_data[13] = sbp2_status[3];
1004         sense_data[14] = sbp2_status[12];
1005         sense_data[15] = sbp2_status[13];
1006
1007         sam_status = sbp2_status[0] & 0x3f;
1008
1009         switch (sam_status) {
1010         case SAM_STAT_GOOD:
1011         case SAM_STAT_CHECK_CONDITION:
1012         case SAM_STAT_CONDITION_MET:
1013         case SAM_STAT_BUSY:
1014         case SAM_STAT_RESERVATION_CONFLICT:
1015         case SAM_STAT_COMMAND_TERMINATED:
1016                 return DID_OK << 16 | sam_status;
1017
1018         default:
1019                 return DID_ERROR << 16;
1020         }
1021 }
1022
1023 static void
1024 complete_command_orb(struct sbp2_orb *base_orb, struct sbp2_status *status)
1025 {
1026         struct sbp2_command_orb *orb =
1027                 container_of(base_orb, struct sbp2_command_orb, base);
1028         struct fw_device *device = fw_device(orb->lu->tgt->unit->device.parent);
1029         int result;
1030
1031         if (status != NULL) {
1032                 if (STATUS_GET_DEAD(*status))
1033                         sbp2_agent_reset(orb->lu);
1034
1035                 switch (STATUS_GET_RESPONSE(*status)) {
1036                 case SBP2_STATUS_REQUEST_COMPLETE:
1037                         result = DID_OK << 16;
1038                         break;
1039                 case SBP2_STATUS_TRANSPORT_FAILURE:
1040                         result = DID_BUS_BUSY << 16;
1041                         break;
1042                 case SBP2_STATUS_ILLEGAL_REQUEST:
1043                 case SBP2_STATUS_VENDOR_DEPENDENT:
1044                 default:
1045                         result = DID_ERROR << 16;
1046                         break;
1047                 }
1048
1049                 if (result == DID_OK << 16 && STATUS_GET_LEN(*status) > 1)
1050                         result = sbp2_status_to_sense_data(STATUS_GET_DATA(*status),
1051                                                            orb->cmd->sense_buffer);
1052         } else {
1053                 /*
1054                  * If the orb completes with status == NULL, something
1055                  * went wrong, typically a bus reset happened mid-orb
1056                  * or when sending the write (less likely).
1057                  */
1058                 result = DID_BUS_BUSY << 16;
1059         }
1060
1061         dma_unmap_single(device->card->device, orb->base.request_bus,
1062                          sizeof(orb->request), DMA_TO_DEVICE);
1063
1064         if (scsi_sg_count(orb->cmd) > 0)
1065                 dma_unmap_sg(device->card->device, scsi_sglist(orb->cmd),
1066                              scsi_sg_count(orb->cmd),
1067                              orb->cmd->sc_data_direction);
1068
1069         if (orb->page_table_bus != 0)
1070                 dma_unmap_single(device->card->device, orb->page_table_bus,
1071                                  sizeof(orb->page_table), DMA_TO_DEVICE);
1072
1073         orb->cmd->result = result;
1074         orb->done(orb->cmd);
1075 }
1076
1077 static int
1078 sbp2_map_scatterlist(struct sbp2_command_orb *orb, struct fw_device *device,
1079                      struct sbp2_logical_unit *lu)
1080 {
1081         struct scatterlist *sg;
1082         int sg_len, l, i, j, count;
1083         dma_addr_t sg_addr;
1084
1085         sg = scsi_sglist(orb->cmd);
1086         count = dma_map_sg(device->card->device, sg, scsi_sg_count(orb->cmd),
1087                            orb->cmd->sc_data_direction);
1088         if (count == 0)
1089                 goto fail;
1090
1091         /*
1092          * Handle the special case where there is only one element in
1093          * the scatter list by converting it to an immediate block
1094          * request. This is also a workaround for broken devices such
1095          * as the second generation iPod which doesn't support page
1096          * tables.
1097          */
1098         if (count == 1 && sg_dma_len(sg) < SBP2_MAX_SG_ELEMENT_LENGTH) {
1099                 orb->request.data_descriptor.high = lu->tgt->address_high;
1100                 orb->request.data_descriptor.low  = sg_dma_address(sg);
1101                 orb->request.misc |= COMMAND_ORB_DATA_SIZE(sg_dma_len(sg));
1102                 return 0;
1103         }
1104
1105         /*
1106          * Convert the scatterlist to an sbp2 page table.  If any
1107          * scatterlist entries are too big for sbp2, we split them as we
1108          * go.  Even if we ask the block I/O layer to not give us sg
1109          * elements larger than 65535 bytes, some IOMMUs may merge sg elements
1110          * during DMA mapping, and Linux currently doesn't prevent this.
1111          */
1112         for (i = 0, j = 0; i < count; i++, sg = sg_next(sg)) {
1113                 sg_len = sg_dma_len(sg);
1114                 sg_addr = sg_dma_address(sg);
1115                 while (sg_len) {
1116                         /* FIXME: This won't get us out of the pinch. */
1117                         if (unlikely(j >= ARRAY_SIZE(orb->page_table))) {
1118                                 fw_error("page table overflow\n");
1119                                 goto fail_page_table;
1120                         }
1121                         l = min(sg_len, SBP2_MAX_SG_ELEMENT_LENGTH);
1122                         orb->page_table[j].low = sg_addr;
1123                         orb->page_table[j].high = (l << 16);
1124                         sg_addr += l;
1125                         sg_len -= l;
1126                         j++;
1127                 }
1128         }
1129
1130         fw_memcpy_to_be32(orb->page_table, orb->page_table,
1131                           sizeof(orb->page_table[0]) * j);
1132         orb->page_table_bus =
1133                 dma_map_single(device->card->device, orb->page_table,
1134                                sizeof(orb->page_table), DMA_TO_DEVICE);
1135         if (dma_mapping_error(orb->page_table_bus))
1136                 goto fail_page_table;
1137
1138         /*
1139          * The data_descriptor pointer is the one case where we need
1140          * to fill in the node ID part of the address.  All other
1141          * pointers assume that the data referenced reside on the
1142          * initiator (i.e. us), but data_descriptor can refer to data
1143          * on other nodes so we need to put our ID in descriptor.high.
1144          */
1145         orb->request.data_descriptor.high = lu->tgt->address_high;
1146         orb->request.data_descriptor.low  = orb->page_table_bus;
1147         orb->request.misc |=
1148                 COMMAND_ORB_PAGE_TABLE_PRESENT |
1149                 COMMAND_ORB_DATA_SIZE(j);
1150
1151         return 0;
1152
1153  fail_page_table:
1154         dma_unmap_sg(device->card->device, sg, scsi_sg_count(orb->cmd),
1155                      orb->cmd->sc_data_direction);
1156  fail:
1157         return -ENOMEM;
1158 }
1159
1160 /* SCSI stack integration */
1161
1162 static int sbp2_scsi_queuecommand(struct scsi_cmnd *cmd, scsi_done_fn_t done)
1163 {
1164         struct sbp2_logical_unit *lu = cmd->device->hostdata;
1165         struct fw_device *device = fw_device(lu->tgt->unit->device.parent);
1166         struct sbp2_command_orb *orb;
1167         unsigned max_payload;
1168         int retval = SCSI_MLQUEUE_HOST_BUSY;
1169
1170         /*
1171          * Bidirectional commands are not yet implemented, and unknown
1172          * transfer direction not handled.
1173          */
1174         if (cmd->sc_data_direction == DMA_BIDIRECTIONAL) {
1175                 fw_error("Can't handle DMA_BIDIRECTIONAL, rejecting command\n");
1176                 cmd->result = DID_ERROR << 16;
1177                 done(cmd);
1178                 return 0;
1179         }
1180
1181         orb = kzalloc(sizeof(*orb), GFP_ATOMIC);
1182         if (orb == NULL) {
1183                 fw_notify("failed to alloc orb\n");
1184                 return SCSI_MLQUEUE_HOST_BUSY;
1185         }
1186
1187         /* Initialize rcode to something not RCODE_COMPLETE. */
1188         orb->base.rcode = -1;
1189         kref_init(&orb->base.kref);
1190
1191         orb->lu   = lu;
1192         orb->done = done;
1193         orb->cmd  = cmd;
1194
1195         orb->request.next.high   = SBP2_ORB_NULL;
1196         orb->request.next.low    = 0x0;
1197         /*
1198          * At speed 100 we can do 512 bytes per packet, at speed 200,
1199          * 1024 bytes per packet etc.  The SBP-2 max_payload field
1200          * specifies the max payload size as 2 ^ (max_payload + 2), so
1201          * if we set this to max_speed + 7, we get the right value.
1202          */
1203         max_payload = min(device->max_speed + 7,
1204                           device->card->max_receive - 1);
1205         orb->request.misc =
1206                 COMMAND_ORB_MAX_PAYLOAD(max_payload) |
1207                 COMMAND_ORB_SPEED(device->max_speed) |
1208                 COMMAND_ORB_NOTIFY;
1209
1210         if (cmd->sc_data_direction == DMA_FROM_DEVICE)
1211                 orb->request.misc |=
1212                         COMMAND_ORB_DIRECTION(SBP2_DIRECTION_FROM_MEDIA);
1213         else if (cmd->sc_data_direction == DMA_TO_DEVICE)
1214                 orb->request.misc |=
1215                         COMMAND_ORB_DIRECTION(SBP2_DIRECTION_TO_MEDIA);
1216
1217         if (scsi_sg_count(cmd) && sbp2_map_scatterlist(orb, device, lu) < 0)
1218                 goto out;
1219
1220         fw_memcpy_to_be32(&orb->request, &orb->request, sizeof(orb->request));
1221
1222         memset(orb->request.command_block,
1223                0, sizeof(orb->request.command_block));
1224         memcpy(orb->request.command_block, cmd->cmnd, COMMAND_SIZE(*cmd->cmnd));
1225
1226         orb->base.callback = complete_command_orb;
1227         orb->base.request_bus =
1228                 dma_map_single(device->card->device, &orb->request,
1229                                sizeof(orb->request), DMA_TO_DEVICE);
1230         if (dma_mapping_error(orb->base.request_bus))
1231                 goto out;
1232
1233         sbp2_send_orb(&orb->base, lu, lu->tgt->node_id, lu->generation,
1234                       lu->command_block_agent_address + SBP2_ORB_POINTER);
1235         retval = 0;
1236  out:
1237         kref_put(&orb->base.kref, free_orb);
1238         return retval;
1239 }
1240
1241 static int sbp2_scsi_slave_alloc(struct scsi_device *sdev)
1242 {
1243         struct sbp2_logical_unit *lu = sdev->hostdata;
1244
1245         sdev->allow_restart = 1;
1246
1247         /*
1248          * Update the dma alignment (minimum alignment requirements for
1249          * start and end of DMA transfers) to be a sector
1250          */
1251         blk_queue_update_dma_alignment(sdev->request_queue, 511);
1252
1253         if (lu->tgt->workarounds & SBP2_WORKAROUND_INQUIRY_36)
1254                 sdev->inquiry_len = 36;
1255
1256         return 0;
1257 }
1258
1259 static int sbp2_scsi_slave_configure(struct scsi_device *sdev)
1260 {
1261         struct sbp2_logical_unit *lu = sdev->hostdata;
1262
1263         sdev->use_10_for_rw = 1;
1264
1265         if (sdev->type == TYPE_ROM)
1266                 sdev->use_10_for_ms = 1;
1267
1268         if (sdev->type == TYPE_DISK &&
1269             lu->tgt->workarounds & SBP2_WORKAROUND_MODE_SENSE_8)
1270                 sdev->skip_ms_page_8 = 1;
1271
1272         if (lu->tgt->workarounds & SBP2_WORKAROUND_FIX_CAPACITY)
1273                 sdev->fix_capacity = 1;
1274
1275         if (lu->tgt->workarounds & SBP2_WORKAROUND_128K_MAX_TRANS)
1276                 blk_queue_max_sectors(sdev->request_queue, 128 * 1024 / 512);
1277
1278         return 0;
1279 }
1280
1281 /*
1282  * Called by scsi stack when something has really gone wrong.  Usually
1283  * called when a command has timed-out for some reason.
1284  */
1285 static int sbp2_scsi_abort(struct scsi_cmnd *cmd)
1286 {
1287         struct sbp2_logical_unit *lu = cmd->device->hostdata;
1288
1289         fw_notify("sbp2_scsi_abort\n");
1290         sbp2_agent_reset(lu);
1291         sbp2_cancel_orbs(lu);
1292
1293         return SUCCESS;
1294 }
1295
1296 /*
1297  * Format of /sys/bus/scsi/devices/.../ieee1394_id:
1298  * u64 EUI-64 : u24 directory_ID : u16 LUN  (all printed in hexadecimal)
1299  *
1300  * This is the concatenation of target port identifier and logical unit
1301  * identifier as per SAM-2...SAM-4 annex A.
1302  */
1303 static ssize_t
1304 sbp2_sysfs_ieee1394_id_show(struct device *dev, struct device_attribute *attr,
1305                             char *buf)
1306 {
1307         struct scsi_device *sdev = to_scsi_device(dev);
1308         struct sbp2_logical_unit *lu;
1309         struct fw_device *device;
1310
1311         if (!sdev)
1312                 return 0;
1313
1314         lu = sdev->hostdata;
1315         device = fw_device(lu->tgt->unit->device.parent);
1316
1317         return sprintf(buf, "%08x%08x:%06x:%04x\n",
1318                         device->config_rom[3], device->config_rom[4],
1319                         lu->tgt->directory_id, lu->lun);
1320 }
1321
1322 static DEVICE_ATTR(ieee1394_id, S_IRUGO, sbp2_sysfs_ieee1394_id_show, NULL);
1323
1324 static struct device_attribute *sbp2_scsi_sysfs_attrs[] = {
1325         &dev_attr_ieee1394_id,
1326         NULL
1327 };
1328
1329 static struct scsi_host_template scsi_driver_template = {
1330         .module                 = THIS_MODULE,
1331         .name                   = "SBP-2 IEEE-1394",
1332         .proc_name              = sbp2_driver_name,
1333         .queuecommand           = sbp2_scsi_queuecommand,
1334         .slave_alloc            = sbp2_scsi_slave_alloc,
1335         .slave_configure        = sbp2_scsi_slave_configure,
1336         .eh_abort_handler       = sbp2_scsi_abort,
1337         .this_id                = -1,
1338         .sg_tablesize           = SG_ALL,
1339         .use_clustering         = ENABLE_CLUSTERING,
1340         .cmd_per_lun            = 1,
1341         .can_queue              = 1,
1342         .sdev_attrs             = sbp2_scsi_sysfs_attrs,
1343 };
1344
1345 MODULE_AUTHOR("Kristian Hoegsberg <krh@bitplanet.net>");
1346 MODULE_DESCRIPTION("SCSI over IEEE1394");
1347 MODULE_LICENSE("GPL");
1348 MODULE_DEVICE_TABLE(ieee1394, sbp2_id_table);
1349
1350 /* Provide a module alias so root-on-sbp2 initrds don't break. */
1351 #ifndef CONFIG_IEEE1394_SBP2_MODULE
1352 MODULE_ALIAS("sbp2");
1353 #endif
1354
1355 static int __init sbp2_init(void)
1356 {
1357         sbp2_wq = create_singlethread_workqueue(KBUILD_MODNAME);
1358         if (!sbp2_wq)
1359                 return -ENOMEM;
1360
1361         return driver_register(&sbp2_driver.driver);
1362 }
1363
1364 static void __exit sbp2_cleanup(void)
1365 {
1366         driver_unregister(&sbp2_driver.driver);
1367         destroy_workqueue(sbp2_wq);
1368 }
1369
1370 module_init(sbp2_init);
1371 module_exit(sbp2_cleanup);