pktcdvd: Fix a recently introduced NULL pointer dereference
[platform/kernel/linux-rpi.git] / drivers / block / sx8.c
1 /*
2  *  sx8.c: Driver for Promise SATA SX8 looks-like-I2O hardware
3  *
4  *  Copyright 2004-2005 Red Hat, Inc.
5  *
6  *  Author/maintainer:  Jeff Garzik <jgarzik@pobox.com>
7  *
8  *  This file is subject to the terms and conditions of the GNU General Public
9  *  License.  See the file "COPYING" in the main directory of this archive
10  *  for more details.
11  */
12
13 #include <linux/kernel.h>
14 #include <linux/module.h>
15 #include <linux/init.h>
16 #include <linux/pci.h>
17 #include <linux/slab.h>
18 #include <linux/spinlock.h>
19 #include <linux/blkdev.h>
20 #include <linux/sched.h>
21 #include <linux/interrupt.h>
22 #include <linux/compiler.h>
23 #include <linux/workqueue.h>
24 #include <linux/bitops.h>
25 #include <linux/delay.h>
26 #include <linux/ktime.h>
27 #include <linux/hdreg.h>
28 #include <linux/dma-mapping.h>
29 #include <linux/completion.h>
30 #include <linux/scatterlist.h>
31 #include <asm/io.h>
32 #include <linux/uaccess.h>
33
34 #if 0
35 #define CARM_DEBUG
36 #define CARM_VERBOSE_DEBUG
37 #else
38 #undef CARM_DEBUG
39 #undef CARM_VERBOSE_DEBUG
40 #endif
41 #undef CARM_NDEBUG
42
43 #define DRV_NAME "sx8"
44 #define DRV_VERSION "1.0"
45 #define PFX DRV_NAME ": "
46
47 MODULE_AUTHOR("Jeff Garzik");
48 MODULE_LICENSE("GPL");
49 MODULE_DESCRIPTION("Promise SATA SX8 block driver");
50 MODULE_VERSION(DRV_VERSION);
51
52 /*
53  * SX8 hardware has a single message queue for all ATA ports.
54  * When this driver was written, the hardware (firmware?) would
55  * corrupt data eventually, if more than one request was outstanding.
56  * As one can imagine, having 8 ports bottlenecking on a single
57  * command hurts performance.
58  *
59  * Based on user reports, later versions of the hardware (firmware?)
60  * seem to be able to survive with more than one command queued.
61  *
62  * Therefore, we default to the safe option -- 1 command -- but
63  * allow the user to increase this.
64  *
65  * SX8 should be able to support up to ~60 queued commands (CARM_MAX_REQ),
66  * but problems seem to occur when you exceed ~30, even on newer hardware.
67  */
68 static int max_queue = 1;
69 module_param(max_queue, int, 0444);
70 MODULE_PARM_DESC(max_queue, "Maximum number of queued commands. (min==1, max==30, safe==1)");
71
72
73 #define NEXT_RESP(idx)  ((idx + 1) % RMSG_Q_LEN)
74
75 /* 0xf is just arbitrary, non-zero noise; this is sorta like poisoning */
76 #define TAG_ENCODE(tag) (((tag) << 16) | 0xf)
77 #define TAG_DECODE(tag) (((tag) >> 16) & 0x1f)
78 #define TAG_VALID(tag)  ((((tag) & 0xf) == 0xf) && (TAG_DECODE(tag) < 32))
79
80 /* note: prints function name for you */
81 #ifdef CARM_DEBUG
82 #define DPRINTK(fmt, args...) printk(KERN_ERR "%s: " fmt, __func__, ## args)
83 #ifdef CARM_VERBOSE_DEBUG
84 #define VPRINTK(fmt, args...) printk(KERN_ERR "%s: " fmt, __func__, ## args)
85 #else
86 #define VPRINTK(fmt, args...)
87 #endif  /* CARM_VERBOSE_DEBUG */
88 #else
89 #define DPRINTK(fmt, args...)
90 #define VPRINTK(fmt, args...)
91 #endif  /* CARM_DEBUG */
92
93 #ifdef CARM_NDEBUG
94 #define assert(expr)
95 #else
96 #define assert(expr) \
97         if(unlikely(!(expr))) {                                   \
98         printk(KERN_ERR "Assertion failed! %s,%s,%s,line=%d\n", \
99         #expr, __FILE__, __func__, __LINE__);          \
100         }
101 #endif
102
103 /* defines only for the constants which don't work well as enums */
104 struct carm_host;
105
106 enum {
107         /* adapter-wide limits */
108         CARM_MAX_PORTS          = 8,
109         CARM_SHM_SIZE           = (4096 << 7),
110         CARM_MINORS_PER_MAJOR   = 256 / CARM_MAX_PORTS,
111         CARM_MAX_WAIT_Q         = CARM_MAX_PORTS + 1,
112
113         /* command message queue limits */
114         CARM_MAX_REQ            = 64,          /* max command msgs per host */
115         CARM_MSG_LOW_WATER      = (CARM_MAX_REQ / 4),        /* refill mark */
116
117         /* S/G limits, host-wide and per-request */
118         CARM_MAX_REQ_SG         = 32,        /* max s/g entries per request */
119         CARM_MAX_HOST_SG        = 600,          /* max s/g entries per host */
120         CARM_SG_LOW_WATER       = (CARM_MAX_HOST_SG / 4),   /* re-fill mark */
121
122         /* hardware registers */
123         CARM_IHQP               = 0x1c,
124         CARM_INT_STAT           = 0x10, /* interrupt status */
125         CARM_INT_MASK           = 0x14, /* interrupt mask */
126         CARM_HMUC               = 0x18, /* host message unit control */
127         RBUF_ADDR_LO            = 0x20, /* response msg DMA buf low 32 bits */
128         RBUF_ADDR_HI            = 0x24, /* response msg DMA buf high 32 bits */
129         RBUF_BYTE_SZ            = 0x28,
130         CARM_RESP_IDX           = 0x2c,
131         CARM_CMS0               = 0x30, /* command message size reg 0 */
132         CARM_LMUC               = 0x48,
133         CARM_HMPHA              = 0x6c,
134         CARM_INITC              = 0xb5,
135
136         /* bits in CARM_INT_{STAT,MASK} */
137         INT_RESERVED            = 0xfffffff0,
138         INT_WATCHDOG            = (1 << 3),     /* watchdog timer */
139         INT_Q_OVERFLOW          = (1 << 2),     /* cmd msg q overflow */
140         INT_Q_AVAILABLE         = (1 << 1),     /* cmd msg q has free space */
141         INT_RESPONSE            = (1 << 0),     /* response msg available */
142         INT_ACK_MASK            = INT_WATCHDOG | INT_Q_OVERFLOW,
143         INT_DEF_MASK            = INT_RESERVED | INT_Q_OVERFLOW |
144                                   INT_RESPONSE,
145
146         /* command messages, and related register bits */
147         CARM_HAVE_RESP          = 0x01,
148         CARM_MSG_READ           = 1,
149         CARM_MSG_WRITE          = 2,
150         CARM_MSG_VERIFY         = 3,
151         CARM_MSG_GET_CAPACITY   = 4,
152         CARM_MSG_FLUSH          = 5,
153         CARM_MSG_IOCTL          = 6,
154         CARM_MSG_ARRAY          = 8,
155         CARM_MSG_MISC           = 9,
156         CARM_CME                = (1 << 2),
157         CARM_RME                = (1 << 1),
158         CARM_WZBC               = (1 << 0),
159         CARM_RMI                = (1 << 0),
160         CARM_Q_FULL             = (1 << 3),
161         CARM_MSG_SIZE           = 288,
162         CARM_Q_LEN              = 48,
163
164         /* CARM_MSG_IOCTL messages */
165         CARM_IOC_SCAN_CHAN      = 5,    /* scan channels for devices */
166         CARM_IOC_GET_TCQ        = 13,   /* get tcq/ncq depth */
167         CARM_IOC_SET_TCQ        = 14,   /* set tcq/ncq depth */
168
169         IOC_SCAN_CHAN_NODEV     = 0x1f,
170         IOC_SCAN_CHAN_OFFSET    = 0x40,
171
172         /* CARM_MSG_ARRAY messages */
173         CARM_ARRAY_INFO         = 0,
174
175         ARRAY_NO_EXIST          = (1 << 31),
176
177         /* response messages */
178         RMSG_SZ                 = 8,    /* sizeof(struct carm_response) */
179         RMSG_Q_LEN              = 48,   /* resp. msg list length */
180         RMSG_OK                 = 1,    /* bit indicating msg was successful */
181                                         /* length of entire resp. msg buffer */
182         RBUF_LEN                = RMSG_SZ * RMSG_Q_LEN,
183
184         PDC_SHM_SIZE            = (4096 << 7), /* length of entire h/w buffer */
185
186         /* CARM_MSG_MISC messages */
187         MISC_GET_FW_VER         = 2,
188         MISC_ALLOC_MEM          = 3,
189         MISC_SET_TIME           = 5,
190
191         /* MISC_GET_FW_VER feature bits */
192         FW_VER_4PORT            = (1 << 2), /* 1=4 ports, 0=8 ports */
193         FW_VER_NON_RAID         = (1 << 1), /* 1=non-RAID firmware, 0=RAID */
194         FW_VER_ZCR              = (1 << 0), /* zero channel RAID (whatever that is) */
195
196         /* carm_host flags */
197         FL_NON_RAID             = FW_VER_NON_RAID,
198         FL_4PORT                = FW_VER_4PORT,
199         FL_FW_VER_MASK          = (FW_VER_NON_RAID | FW_VER_4PORT),
200         FL_DAC                  = (1 << 16),
201         FL_DYN_MAJOR            = (1 << 17),
202 };
203
204 enum {
205         CARM_SG_BOUNDARY        = 0xffffUL,         /* s/g segment boundary */
206 };
207
208 enum scatter_gather_types {
209         SGT_32BIT               = 0,
210         SGT_64BIT               = 1,
211 };
212
213 enum host_states {
214         HST_INVALID,            /* invalid state; never used */
215         HST_ALLOC_BUF,          /* setting up master SHM area */
216         HST_ERROR,              /* we never leave here */
217         HST_PORT_SCAN,          /* start dev scan */
218         HST_DEV_SCAN_START,     /* start per-device probe */
219         HST_DEV_SCAN,           /* continue per-device probe */
220         HST_DEV_ACTIVATE,       /* activate devices we found */
221         HST_PROBE_FINISHED,     /* probe is complete */
222         HST_PROBE_START,        /* initiate probe */
223         HST_SYNC_TIME,          /* tell firmware what time it is */
224         HST_GET_FW_VER,         /* get firmware version, adapter port cnt */
225 };
226
227 #ifdef CARM_DEBUG
228 static const char *state_name[] = {
229         "HST_INVALID",
230         "HST_ALLOC_BUF",
231         "HST_ERROR",
232         "HST_PORT_SCAN",
233         "HST_DEV_SCAN_START",
234         "HST_DEV_SCAN",
235         "HST_DEV_ACTIVATE",
236         "HST_PROBE_FINISHED",
237         "HST_PROBE_START",
238         "HST_SYNC_TIME",
239         "HST_GET_FW_VER",
240 };
241 #endif
242
243 struct carm_port {
244         unsigned int                    port_no;
245         struct gendisk                  *disk;
246         struct carm_host                *host;
247
248         /* attached device characteristics */
249         u64                             capacity;
250         char                            name[41];
251         u16                             dev_geom_head;
252         u16                             dev_geom_sect;
253         u16                             dev_geom_cyl;
254 };
255
256 struct carm_request {
257         unsigned int                    tag;
258         int                             n_elem;
259         unsigned int                    msg_type;
260         unsigned int                    msg_subtype;
261         unsigned int                    msg_bucket;
262         struct request                  *rq;
263         struct carm_port                *port;
264         struct scatterlist              sg[CARM_MAX_REQ_SG];
265 };
266
267 struct carm_host {
268         unsigned long                   flags;
269         void                            __iomem *mmio;
270         void                            *shm;
271         dma_addr_t                      shm_dma;
272
273         int                             major;
274         int                             id;
275         char                            name[32];
276
277         spinlock_t                      lock;
278         struct pci_dev                  *pdev;
279         unsigned int                    state;
280         u32                             fw_ver;
281
282         struct request_queue            *oob_q;
283         unsigned int                    n_oob;
284
285         unsigned int                    hw_sg_used;
286
287         unsigned int                    resp_idx;
288
289         unsigned int                    wait_q_prod;
290         unsigned int                    wait_q_cons;
291         struct request_queue            *wait_q[CARM_MAX_WAIT_Q];
292
293         unsigned int                    n_msgs;
294         u64                             msg_alloc;
295         struct carm_request             req[CARM_MAX_REQ];
296         void                            *msg_base;
297         dma_addr_t                      msg_dma;
298
299         int                             cur_scan_dev;
300         unsigned long                   dev_active;
301         unsigned long                   dev_present;
302         struct carm_port                port[CARM_MAX_PORTS];
303
304         struct work_struct              fsm_task;
305
306         struct completion               probe_comp;
307 };
308
309 struct carm_response {
310         __le32 ret_handle;
311         __le32 status;
312 }  __attribute__((packed));
313
314 struct carm_msg_sg {
315         __le32 start;
316         __le32 len;
317 }  __attribute__((packed));
318
319 struct carm_msg_rw {
320         u8 type;
321         u8 id;
322         u8 sg_count;
323         u8 sg_type;
324         __le32 handle;
325         __le32 lba;
326         __le16 lba_count;
327         __le16 lba_high;
328         struct carm_msg_sg sg[32];
329 }  __attribute__((packed));
330
331 struct carm_msg_allocbuf {
332         u8 type;
333         u8 subtype;
334         u8 n_sg;
335         u8 sg_type;
336         __le32 handle;
337         __le32 addr;
338         __le32 len;
339         __le32 evt_pool;
340         __le32 n_evt;
341         __le32 rbuf_pool;
342         __le32 n_rbuf;
343         __le32 msg_pool;
344         __le32 n_msg;
345         struct carm_msg_sg sg[8];
346 }  __attribute__((packed));
347
348 struct carm_msg_ioctl {
349         u8 type;
350         u8 subtype;
351         u8 array_id;
352         u8 reserved1;
353         __le32 handle;
354         __le32 data_addr;
355         u32 reserved2;
356 }  __attribute__((packed));
357
358 struct carm_msg_sync_time {
359         u8 type;
360         u8 subtype;
361         u16 reserved1;
362         __le32 handle;
363         u32 reserved2;
364         __le32 timestamp;
365 }  __attribute__((packed));
366
367 struct carm_msg_get_fw_ver {
368         u8 type;
369         u8 subtype;
370         u16 reserved1;
371         __le32 handle;
372         __le32 data_addr;
373         u32 reserved2;
374 }  __attribute__((packed));
375
376 struct carm_fw_ver {
377         __le32 version;
378         u8 features;
379         u8 reserved1;
380         u16 reserved2;
381 }  __attribute__((packed));
382
383 struct carm_array_info {
384         __le32 size;
385
386         __le16 size_hi;
387         __le16 stripe_size;
388
389         __le32 mode;
390
391         __le16 stripe_blk_sz;
392         __le16 reserved1;
393
394         __le16 cyl;
395         __le16 head;
396
397         __le16 sect;
398         u8 array_id;
399         u8 reserved2;
400
401         char name[40];
402
403         __le32 array_status;
404
405         /* device list continues beyond this point? */
406 }  __attribute__((packed));
407
408 static int carm_init_one (struct pci_dev *pdev, const struct pci_device_id *ent);
409 static void carm_remove_one (struct pci_dev *pdev);
410 static int carm_bdev_getgeo(struct block_device *bdev, struct hd_geometry *geo);
411
412 static const struct pci_device_id carm_pci_tbl[] = {
413         { PCI_VENDOR_ID_PROMISE, 0x8000, PCI_ANY_ID, PCI_ANY_ID, 0, 0, },
414         { PCI_VENDOR_ID_PROMISE, 0x8002, PCI_ANY_ID, PCI_ANY_ID, 0, 0, },
415         { }     /* terminate list */
416 };
417 MODULE_DEVICE_TABLE(pci, carm_pci_tbl);
418
419 static struct pci_driver carm_driver = {
420         .name           = DRV_NAME,
421         .id_table       = carm_pci_tbl,
422         .probe          = carm_init_one,
423         .remove         = carm_remove_one,
424 };
425
426 static const struct block_device_operations carm_bd_ops = {
427         .owner          = THIS_MODULE,
428         .getgeo         = carm_bdev_getgeo,
429 };
430
431 static unsigned int carm_host_id;
432 static unsigned long carm_major_alloc;
433
434
435
436 static int carm_bdev_getgeo(struct block_device *bdev, struct hd_geometry *geo)
437 {
438         struct carm_port *port = bdev->bd_disk->private_data;
439
440         geo->heads = (u8) port->dev_geom_head;
441         geo->sectors = (u8) port->dev_geom_sect;
442         geo->cylinders = port->dev_geom_cyl;
443         return 0;
444 }
445
446 static const u32 msg_sizes[] = { 32, 64, 128, CARM_MSG_SIZE };
447
448 static inline int carm_lookup_bucket(u32 msg_size)
449 {
450         int i;
451
452         for (i = 0; i < ARRAY_SIZE(msg_sizes); i++)
453                 if (msg_size <= msg_sizes[i])
454                         return i;
455
456         return -ENOENT;
457 }
458
459 static void carm_init_buckets(void __iomem *mmio)
460 {
461         unsigned int i;
462
463         for (i = 0; i < ARRAY_SIZE(msg_sizes); i++)
464                 writel(msg_sizes[i], mmio + CARM_CMS0 + (4 * i));
465 }
466
467 static inline void *carm_ref_msg(struct carm_host *host,
468                                  unsigned int msg_idx)
469 {
470         return host->msg_base + (msg_idx * CARM_MSG_SIZE);
471 }
472
473 static inline dma_addr_t carm_ref_msg_dma(struct carm_host *host,
474                                           unsigned int msg_idx)
475 {
476         return host->msg_dma + (msg_idx * CARM_MSG_SIZE);
477 }
478
479 static int carm_send_msg(struct carm_host *host,
480                          struct carm_request *crq)
481 {
482         void __iomem *mmio = host->mmio;
483         u32 msg = (u32) carm_ref_msg_dma(host, crq->tag);
484         u32 cm_bucket = crq->msg_bucket;
485         u32 tmp;
486         int rc = 0;
487
488         VPRINTK("ENTER\n");
489
490         tmp = readl(mmio + CARM_HMUC);
491         if (tmp & CARM_Q_FULL) {
492 #if 0
493                 tmp = readl(mmio + CARM_INT_MASK);
494                 tmp |= INT_Q_AVAILABLE;
495                 writel(tmp, mmio + CARM_INT_MASK);
496                 readl(mmio + CARM_INT_MASK);    /* flush */
497 #endif
498                 DPRINTK("host msg queue full\n");
499                 rc = -EBUSY;
500         } else {
501                 writel(msg | (cm_bucket << 1), mmio + CARM_IHQP);
502                 readl(mmio + CARM_IHQP);        /* flush */
503         }
504
505         return rc;
506 }
507
508 static struct carm_request *carm_get_request(struct carm_host *host)
509 {
510         unsigned int i;
511
512         /* obey global hardware limit on S/G entries */
513         if (host->hw_sg_used >= (CARM_MAX_HOST_SG - CARM_MAX_REQ_SG))
514                 return NULL;
515
516         for (i = 0; i < max_queue; i++)
517                 if ((host->msg_alloc & (1ULL << i)) == 0) {
518                         struct carm_request *crq = &host->req[i];
519                         crq->port = NULL;
520                         crq->n_elem = 0;
521
522                         host->msg_alloc |= (1ULL << i);
523                         host->n_msgs++;
524
525                         assert(host->n_msgs <= CARM_MAX_REQ);
526                         sg_init_table(crq->sg, CARM_MAX_REQ_SG);
527                         return crq;
528                 }
529
530         DPRINTK("no request available, returning NULL\n");
531         return NULL;
532 }
533
534 static int carm_put_request(struct carm_host *host, struct carm_request *crq)
535 {
536         assert(crq->tag < max_queue);
537
538         if (unlikely((host->msg_alloc & (1ULL << crq->tag)) == 0))
539                 return -EINVAL; /* tried to clear a tag that was not active */
540
541         assert(host->hw_sg_used >= crq->n_elem);
542
543         host->msg_alloc &= ~(1ULL << crq->tag);
544         host->hw_sg_used -= crq->n_elem;
545         host->n_msgs--;
546
547         return 0;
548 }
549
550 static struct carm_request *carm_get_special(struct carm_host *host)
551 {
552         unsigned long flags;
553         struct carm_request *crq = NULL;
554         struct request *rq;
555         int tries = 5000;
556
557         while (tries-- > 0) {
558                 spin_lock_irqsave(&host->lock, flags);
559                 crq = carm_get_request(host);
560                 spin_unlock_irqrestore(&host->lock, flags);
561
562                 if (crq)
563                         break;
564                 msleep(10);
565         }
566
567         if (!crq)
568                 return NULL;
569
570         rq = blk_get_request(host->oob_q, REQ_OP_DRV_OUT, GFP_KERNEL);
571         if (IS_ERR(rq)) {
572                 spin_lock_irqsave(&host->lock, flags);
573                 carm_put_request(host, crq);
574                 spin_unlock_irqrestore(&host->lock, flags);
575                 return NULL;
576         }
577
578         crq->rq = rq;
579         return crq;
580 }
581
582 static int carm_array_info (struct carm_host *host, unsigned int array_idx)
583 {
584         struct carm_msg_ioctl *ioc;
585         unsigned int idx;
586         u32 msg_data;
587         dma_addr_t msg_dma;
588         struct carm_request *crq;
589         int rc;
590
591         crq = carm_get_special(host);
592         if (!crq) {
593                 rc = -ENOMEM;
594                 goto err_out;
595         }
596
597         idx = crq->tag;
598
599         ioc = carm_ref_msg(host, idx);
600         msg_dma = carm_ref_msg_dma(host, idx);
601         msg_data = (u32) (msg_dma + sizeof(struct carm_array_info));
602
603         crq->msg_type = CARM_MSG_ARRAY;
604         crq->msg_subtype = CARM_ARRAY_INFO;
605         rc = carm_lookup_bucket(sizeof(struct carm_msg_ioctl) +
606                                 sizeof(struct carm_array_info));
607         BUG_ON(rc < 0);
608         crq->msg_bucket = (u32) rc;
609
610         memset(ioc, 0, sizeof(*ioc));
611         ioc->type       = CARM_MSG_ARRAY;
612         ioc->subtype    = CARM_ARRAY_INFO;
613         ioc->array_id   = (u8) array_idx;
614         ioc->handle     = cpu_to_le32(TAG_ENCODE(idx));
615         ioc->data_addr  = cpu_to_le32(msg_data);
616
617         spin_lock_irq(&host->lock);
618         assert(host->state == HST_DEV_SCAN_START ||
619                host->state == HST_DEV_SCAN);
620         spin_unlock_irq(&host->lock);
621
622         DPRINTK("blk_execute_rq_nowait, tag == %u\n", idx);
623         crq->rq->special = crq;
624         blk_execute_rq_nowait(host->oob_q, NULL, crq->rq, true, NULL);
625
626         return 0;
627
628 err_out:
629         spin_lock_irq(&host->lock);
630         host->state = HST_ERROR;
631         spin_unlock_irq(&host->lock);
632         return rc;
633 }
634
635 typedef unsigned int (*carm_sspc_t)(struct carm_host *, unsigned int, void *);
636
637 static int carm_send_special (struct carm_host *host, carm_sspc_t func)
638 {
639         struct carm_request *crq;
640         struct carm_msg_ioctl *ioc;
641         void *mem;
642         unsigned int idx, msg_size;
643         int rc;
644
645         crq = carm_get_special(host);
646         if (!crq)
647                 return -ENOMEM;
648
649         idx = crq->tag;
650
651         mem = carm_ref_msg(host, idx);
652
653         msg_size = func(host, idx, mem);
654
655         ioc = mem;
656         crq->msg_type = ioc->type;
657         crq->msg_subtype = ioc->subtype;
658         rc = carm_lookup_bucket(msg_size);
659         BUG_ON(rc < 0);
660         crq->msg_bucket = (u32) rc;
661
662         DPRINTK("blk_execute_rq_nowait, tag == %u\n", idx);
663         crq->rq->special = crq;
664         blk_execute_rq_nowait(host->oob_q, NULL, crq->rq, true, NULL);
665
666         return 0;
667 }
668
669 static unsigned int carm_fill_sync_time(struct carm_host *host,
670                                         unsigned int idx, void *mem)
671 {
672         struct carm_msg_sync_time *st = mem;
673
674         time64_t tv = ktime_get_real_seconds();
675
676         memset(st, 0, sizeof(*st));
677         st->type        = CARM_MSG_MISC;
678         st->subtype     = MISC_SET_TIME;
679         st->handle      = cpu_to_le32(TAG_ENCODE(idx));
680         st->timestamp   = cpu_to_le32(tv);
681
682         return sizeof(struct carm_msg_sync_time);
683 }
684
685 static unsigned int carm_fill_alloc_buf(struct carm_host *host,
686                                         unsigned int idx, void *mem)
687 {
688         struct carm_msg_allocbuf *ab = mem;
689
690         memset(ab, 0, sizeof(*ab));
691         ab->type        = CARM_MSG_MISC;
692         ab->subtype     = MISC_ALLOC_MEM;
693         ab->handle      = cpu_to_le32(TAG_ENCODE(idx));
694         ab->n_sg        = 1;
695         ab->sg_type     = SGT_32BIT;
696         ab->addr        = cpu_to_le32(host->shm_dma + (PDC_SHM_SIZE >> 1));
697         ab->len         = cpu_to_le32(PDC_SHM_SIZE >> 1);
698         ab->evt_pool    = cpu_to_le32(host->shm_dma + (16 * 1024));
699         ab->n_evt       = cpu_to_le32(1024);
700         ab->rbuf_pool   = cpu_to_le32(host->shm_dma);
701         ab->n_rbuf      = cpu_to_le32(RMSG_Q_LEN);
702         ab->msg_pool    = cpu_to_le32(host->shm_dma + RBUF_LEN);
703         ab->n_msg       = cpu_to_le32(CARM_Q_LEN);
704         ab->sg[0].start = cpu_to_le32(host->shm_dma + (PDC_SHM_SIZE >> 1));
705         ab->sg[0].len   = cpu_to_le32(65536);
706
707         return sizeof(struct carm_msg_allocbuf);
708 }
709
710 static unsigned int carm_fill_scan_channels(struct carm_host *host,
711                                             unsigned int idx, void *mem)
712 {
713         struct carm_msg_ioctl *ioc = mem;
714         u32 msg_data = (u32) (carm_ref_msg_dma(host, idx) +
715                               IOC_SCAN_CHAN_OFFSET);
716
717         memset(ioc, 0, sizeof(*ioc));
718         ioc->type       = CARM_MSG_IOCTL;
719         ioc->subtype    = CARM_IOC_SCAN_CHAN;
720         ioc->handle     = cpu_to_le32(TAG_ENCODE(idx));
721         ioc->data_addr  = cpu_to_le32(msg_data);
722
723         /* fill output data area with "no device" default values */
724         mem += IOC_SCAN_CHAN_OFFSET;
725         memset(mem, IOC_SCAN_CHAN_NODEV, CARM_MAX_PORTS);
726
727         return IOC_SCAN_CHAN_OFFSET + CARM_MAX_PORTS;
728 }
729
730 static unsigned int carm_fill_get_fw_ver(struct carm_host *host,
731                                          unsigned int idx, void *mem)
732 {
733         struct carm_msg_get_fw_ver *ioc = mem;
734         u32 msg_data = (u32) (carm_ref_msg_dma(host, idx) + sizeof(*ioc));
735
736         memset(ioc, 0, sizeof(*ioc));
737         ioc->type       = CARM_MSG_MISC;
738         ioc->subtype    = MISC_GET_FW_VER;
739         ioc->handle     = cpu_to_le32(TAG_ENCODE(idx));
740         ioc->data_addr  = cpu_to_le32(msg_data);
741
742         return sizeof(struct carm_msg_get_fw_ver) +
743                sizeof(struct carm_fw_ver);
744 }
745
746 static inline void carm_end_request_queued(struct carm_host *host,
747                                            struct carm_request *crq,
748                                            blk_status_t error)
749 {
750         struct request *req = crq->rq;
751         int rc;
752
753         __blk_end_request_all(req, error);
754
755         rc = carm_put_request(host, crq);
756         assert(rc == 0);
757 }
758
759 static inline void carm_push_q (struct carm_host *host, struct request_queue *q)
760 {
761         unsigned int idx = host->wait_q_prod % CARM_MAX_WAIT_Q;
762
763         blk_stop_queue(q);
764         VPRINTK("STOPPED QUEUE %p\n", q);
765
766         host->wait_q[idx] = q;
767         host->wait_q_prod++;
768         BUG_ON(host->wait_q_prod == host->wait_q_cons); /* overrun */
769 }
770
771 static inline struct request_queue *carm_pop_q(struct carm_host *host)
772 {
773         unsigned int idx;
774
775         if (host->wait_q_prod == host->wait_q_cons)
776                 return NULL;
777
778         idx = host->wait_q_cons % CARM_MAX_WAIT_Q;
779         host->wait_q_cons++;
780
781         return host->wait_q[idx];
782 }
783
784 static inline void carm_round_robin(struct carm_host *host)
785 {
786         struct request_queue *q = carm_pop_q(host);
787         if (q) {
788                 blk_start_queue(q);
789                 VPRINTK("STARTED QUEUE %p\n", q);
790         }
791 }
792
793 static inline void carm_end_rq(struct carm_host *host, struct carm_request *crq,
794                                blk_status_t error)
795 {
796         carm_end_request_queued(host, crq, error);
797         if (max_queue == 1)
798                 carm_round_robin(host);
799         else if ((host->n_msgs <= CARM_MSG_LOW_WATER) &&
800                  (host->hw_sg_used <= CARM_SG_LOW_WATER)) {
801                 carm_round_robin(host);
802         }
803 }
804
805 static void carm_oob_rq_fn(struct request_queue *q)
806 {
807         struct carm_host *host = q->queuedata;
808         struct carm_request *crq;
809         struct request *rq;
810         int rc;
811
812         while (1) {
813                 DPRINTK("get req\n");
814                 rq = blk_fetch_request(q);
815                 if (!rq)
816                         break;
817
818                 crq = rq->special;
819                 assert(crq != NULL);
820                 assert(crq->rq == rq);
821
822                 crq->n_elem = 0;
823
824                 DPRINTK("send req\n");
825                 rc = carm_send_msg(host, crq);
826                 if (rc) {
827                         blk_requeue_request(q, rq);
828                         carm_push_q(host, q);
829                         return;         /* call us again later, eventually */
830                 }
831         }
832 }
833
834 static void carm_rq_fn(struct request_queue *q)
835 {
836         struct carm_port *port = q->queuedata;
837         struct carm_host *host = port->host;
838         struct carm_msg_rw *msg;
839         struct carm_request *crq;
840         struct request *rq;
841         struct scatterlist *sg;
842         int writing = 0, pci_dir, i, n_elem, rc;
843         u32 tmp;
844         unsigned int msg_size;
845
846 queue_one_request:
847         VPRINTK("get req\n");
848         rq = blk_peek_request(q);
849         if (!rq)
850                 return;
851
852         crq = carm_get_request(host);
853         if (!crq) {
854                 carm_push_q(host, q);
855                 return;         /* call us again later, eventually */
856         }
857         crq->rq = rq;
858
859         blk_start_request(rq);
860
861         if (rq_data_dir(rq) == WRITE) {
862                 writing = 1;
863                 pci_dir = PCI_DMA_TODEVICE;
864         } else {
865                 pci_dir = PCI_DMA_FROMDEVICE;
866         }
867
868         /* get scatterlist from block layer */
869         sg = &crq->sg[0];
870         n_elem = blk_rq_map_sg(q, rq, sg);
871         if (n_elem <= 0) {
872                 carm_end_rq(host, crq, BLK_STS_IOERR);
873                 return;         /* request with no s/g entries? */
874         }
875
876         /* map scatterlist to PCI bus addresses */
877         n_elem = pci_map_sg(host->pdev, sg, n_elem, pci_dir);
878         if (n_elem <= 0) {
879                 carm_end_rq(host, crq, BLK_STS_IOERR);
880                 return;         /* request with no s/g entries? */
881         }
882         crq->n_elem = n_elem;
883         crq->port = port;
884         host->hw_sg_used += n_elem;
885
886         /*
887          * build read/write message
888          */
889
890         VPRINTK("build msg\n");
891         msg = (struct carm_msg_rw *) carm_ref_msg(host, crq->tag);
892
893         if (writing) {
894                 msg->type = CARM_MSG_WRITE;
895                 crq->msg_type = CARM_MSG_WRITE;
896         } else {
897                 msg->type = CARM_MSG_READ;
898                 crq->msg_type = CARM_MSG_READ;
899         }
900
901         msg->id         = port->port_no;
902         msg->sg_count   = n_elem;
903         msg->sg_type    = SGT_32BIT;
904         msg->handle     = cpu_to_le32(TAG_ENCODE(crq->tag));
905         msg->lba        = cpu_to_le32(blk_rq_pos(rq) & 0xffffffff);
906         tmp             = (blk_rq_pos(rq) >> 16) >> 16;
907         msg->lba_high   = cpu_to_le16( (u16) tmp );
908         msg->lba_count  = cpu_to_le16(blk_rq_sectors(rq));
909
910         msg_size = sizeof(struct carm_msg_rw) - sizeof(msg->sg);
911         for (i = 0; i < n_elem; i++) {
912                 struct carm_msg_sg *carm_sg = &msg->sg[i];
913                 carm_sg->start = cpu_to_le32(sg_dma_address(&crq->sg[i]));
914                 carm_sg->len = cpu_to_le32(sg_dma_len(&crq->sg[i]));
915                 msg_size += sizeof(struct carm_msg_sg);
916         }
917
918         rc = carm_lookup_bucket(msg_size);
919         BUG_ON(rc < 0);
920         crq->msg_bucket = (u32) rc;
921
922         /*
923          * queue read/write message to hardware
924          */
925
926         VPRINTK("send msg, tag == %u\n", crq->tag);
927         rc = carm_send_msg(host, crq);
928         if (rc) {
929                 carm_put_request(host, crq);
930                 blk_requeue_request(q, rq);
931                 carm_push_q(host, q);
932                 return;         /* call us again later, eventually */
933         }
934
935         goto queue_one_request;
936 }
937
938 static void carm_handle_array_info(struct carm_host *host,
939                                    struct carm_request *crq, u8 *mem,
940                                    blk_status_t error)
941 {
942         struct carm_port *port;
943         u8 *msg_data = mem + sizeof(struct carm_array_info);
944         struct carm_array_info *desc = (struct carm_array_info *) msg_data;
945         u64 lo, hi;
946         int cur_port;
947         size_t slen;
948
949         DPRINTK("ENTER\n");
950
951         carm_end_rq(host, crq, error);
952
953         if (error)
954                 goto out;
955         if (le32_to_cpu(desc->array_status) & ARRAY_NO_EXIST)
956                 goto out;
957
958         cur_port = host->cur_scan_dev;
959
960         /* should never occur */
961         if ((cur_port < 0) || (cur_port >= CARM_MAX_PORTS)) {
962                 printk(KERN_ERR PFX "BUG: cur_scan_dev==%d, array_id==%d\n",
963                        cur_port, (int) desc->array_id);
964                 goto out;
965         }
966
967         port = &host->port[cur_port];
968
969         lo = (u64) le32_to_cpu(desc->size);
970         hi = (u64) le16_to_cpu(desc->size_hi);
971
972         port->capacity = lo | (hi << 32);
973         port->dev_geom_head = le16_to_cpu(desc->head);
974         port->dev_geom_sect = le16_to_cpu(desc->sect);
975         port->dev_geom_cyl = le16_to_cpu(desc->cyl);
976
977         host->dev_active |= (1 << cur_port);
978
979         strncpy(port->name, desc->name, sizeof(port->name));
980         port->name[sizeof(port->name) - 1] = 0;
981         slen = strlen(port->name);
982         while (slen && (port->name[slen - 1] == ' ')) {
983                 port->name[slen - 1] = 0;
984                 slen--;
985         }
986
987         printk(KERN_INFO DRV_NAME "(%s): port %u device %Lu sectors\n",
988                pci_name(host->pdev), port->port_no,
989                (unsigned long long) port->capacity);
990         printk(KERN_INFO DRV_NAME "(%s): port %u device \"%s\"\n",
991                pci_name(host->pdev), port->port_no, port->name);
992
993 out:
994         assert(host->state == HST_DEV_SCAN);
995         schedule_work(&host->fsm_task);
996 }
997
998 static void carm_handle_scan_chan(struct carm_host *host,
999                                   struct carm_request *crq, u8 *mem,
1000                                   blk_status_t error)
1001 {
1002         u8 *msg_data = mem + IOC_SCAN_CHAN_OFFSET;
1003         unsigned int i, dev_count = 0;
1004         int new_state = HST_DEV_SCAN_START;
1005
1006         DPRINTK("ENTER\n");
1007
1008         carm_end_rq(host, crq, error);
1009
1010         if (error) {
1011                 new_state = HST_ERROR;
1012                 goto out;
1013         }
1014
1015         /* TODO: scan and support non-disk devices */
1016         for (i = 0; i < 8; i++)
1017                 if (msg_data[i] == 0) { /* direct-access device (disk) */
1018                         host->dev_present |= (1 << i);
1019                         dev_count++;
1020                 }
1021
1022         printk(KERN_INFO DRV_NAME "(%s): found %u interesting devices\n",
1023                pci_name(host->pdev), dev_count);
1024
1025 out:
1026         assert(host->state == HST_PORT_SCAN);
1027         host->state = new_state;
1028         schedule_work(&host->fsm_task);
1029 }
1030
1031 static void carm_handle_generic(struct carm_host *host,
1032                                 struct carm_request *crq, blk_status_t error,
1033                                 int cur_state, int next_state)
1034 {
1035         DPRINTK("ENTER\n");
1036
1037         carm_end_rq(host, crq, error);
1038
1039         assert(host->state == cur_state);
1040         if (error)
1041                 host->state = HST_ERROR;
1042         else
1043                 host->state = next_state;
1044         schedule_work(&host->fsm_task);
1045 }
1046
1047 static inline void carm_handle_rw(struct carm_host *host,
1048                                   struct carm_request *crq, blk_status_t error)
1049 {
1050         int pci_dir;
1051
1052         VPRINTK("ENTER\n");
1053
1054         if (rq_data_dir(crq->rq) == WRITE)
1055                 pci_dir = PCI_DMA_TODEVICE;
1056         else
1057                 pci_dir = PCI_DMA_FROMDEVICE;
1058
1059         pci_unmap_sg(host->pdev, &crq->sg[0], crq->n_elem, pci_dir);
1060
1061         carm_end_rq(host, crq, error);
1062 }
1063
1064 static inline void carm_handle_resp(struct carm_host *host,
1065                                     __le32 ret_handle_le, u32 status)
1066 {
1067         u32 handle = le32_to_cpu(ret_handle_le);
1068         unsigned int msg_idx;
1069         struct carm_request *crq;
1070         blk_status_t error = (status == RMSG_OK) ? 0 : BLK_STS_IOERR;
1071         u8 *mem;
1072
1073         VPRINTK("ENTER, handle == 0x%x\n", handle);
1074
1075         if (unlikely(!TAG_VALID(handle))) {
1076                 printk(KERN_ERR DRV_NAME "(%s): BUG: invalid tag 0x%x\n",
1077                        pci_name(host->pdev), handle);
1078                 return;
1079         }
1080
1081         msg_idx = TAG_DECODE(handle);
1082         VPRINTK("tag == %u\n", msg_idx);
1083
1084         crq = &host->req[msg_idx];
1085
1086         /* fast path */
1087         if (likely(crq->msg_type == CARM_MSG_READ ||
1088                    crq->msg_type == CARM_MSG_WRITE)) {
1089                 carm_handle_rw(host, crq, error);
1090                 return;
1091         }
1092
1093         mem = carm_ref_msg(host, msg_idx);
1094
1095         switch (crq->msg_type) {
1096         case CARM_MSG_IOCTL: {
1097                 switch (crq->msg_subtype) {
1098                 case CARM_IOC_SCAN_CHAN:
1099                         carm_handle_scan_chan(host, crq, mem, error);
1100                         break;
1101                 default:
1102                         /* unknown / invalid response */
1103                         goto err_out;
1104                 }
1105                 break;
1106         }
1107
1108         case CARM_MSG_MISC: {
1109                 switch (crq->msg_subtype) {
1110                 case MISC_ALLOC_MEM:
1111                         carm_handle_generic(host, crq, error,
1112                                             HST_ALLOC_BUF, HST_SYNC_TIME);
1113                         break;
1114                 case MISC_SET_TIME:
1115                         carm_handle_generic(host, crq, error,
1116                                             HST_SYNC_TIME, HST_GET_FW_VER);
1117                         break;
1118                 case MISC_GET_FW_VER: {
1119                         struct carm_fw_ver *ver = (struct carm_fw_ver *)
1120                                 (mem + sizeof(struct carm_msg_get_fw_ver));
1121                         if (!error) {
1122                                 host->fw_ver = le32_to_cpu(ver->version);
1123                                 host->flags |= (ver->features & FL_FW_VER_MASK);
1124                         }
1125                         carm_handle_generic(host, crq, error,
1126                                             HST_GET_FW_VER, HST_PORT_SCAN);
1127                         break;
1128                 }
1129                 default:
1130                         /* unknown / invalid response */
1131                         goto err_out;
1132                 }
1133                 break;
1134         }
1135
1136         case CARM_MSG_ARRAY: {
1137                 switch (crq->msg_subtype) {
1138                 case CARM_ARRAY_INFO:
1139                         carm_handle_array_info(host, crq, mem, error);
1140                         break;
1141                 default:
1142                         /* unknown / invalid response */
1143                         goto err_out;
1144                 }
1145                 break;
1146         }
1147
1148         default:
1149                 /* unknown / invalid response */
1150                 goto err_out;
1151         }
1152
1153         return;
1154
1155 err_out:
1156         printk(KERN_WARNING DRV_NAME "(%s): BUG: unhandled message type %d/%d\n",
1157                pci_name(host->pdev), crq->msg_type, crq->msg_subtype);
1158         carm_end_rq(host, crq, BLK_STS_IOERR);
1159 }
1160
1161 static inline void carm_handle_responses(struct carm_host *host)
1162 {
1163         void __iomem *mmio = host->mmio;
1164         struct carm_response *resp = (struct carm_response *) host->shm;
1165         unsigned int work = 0;
1166         unsigned int idx = host->resp_idx % RMSG_Q_LEN;
1167
1168         while (1) {
1169                 u32 status = le32_to_cpu(resp[idx].status);
1170
1171                 if (status == 0xffffffff) {
1172                         VPRINTK("ending response on index %u\n", idx);
1173                         writel(idx << 3, mmio + CARM_RESP_IDX);
1174                         break;
1175                 }
1176
1177                 /* response to a message we sent */
1178                 else if ((status & (1 << 31)) == 0) {
1179                         VPRINTK("handling msg response on index %u\n", idx);
1180                         carm_handle_resp(host, resp[idx].ret_handle, status);
1181                         resp[idx].status = cpu_to_le32(0xffffffff);
1182                 }
1183
1184                 /* asynchronous events the hardware throws our way */
1185                 else if ((status & 0xff000000) == (1 << 31)) {
1186                         u8 *evt_type_ptr = (u8 *) &resp[idx];
1187                         u8 evt_type = *evt_type_ptr;
1188                         printk(KERN_WARNING DRV_NAME "(%s): unhandled event type %d\n",
1189                                pci_name(host->pdev), (int) evt_type);
1190                         resp[idx].status = cpu_to_le32(0xffffffff);
1191                 }
1192
1193                 idx = NEXT_RESP(idx);
1194                 work++;
1195         }
1196
1197         VPRINTK("EXIT, work==%u\n", work);
1198         host->resp_idx += work;
1199 }
1200
1201 static irqreturn_t carm_interrupt(int irq, void *__host)
1202 {
1203         struct carm_host *host = __host;
1204         void __iomem *mmio;
1205         u32 mask;
1206         int handled = 0;
1207         unsigned long flags;
1208
1209         if (!host) {
1210                 VPRINTK("no host\n");
1211                 return IRQ_NONE;
1212         }
1213
1214         spin_lock_irqsave(&host->lock, flags);
1215
1216         mmio = host->mmio;
1217
1218         /* reading should also clear interrupts */
1219         mask = readl(mmio + CARM_INT_STAT);
1220
1221         if (mask == 0 || mask == 0xffffffff) {
1222                 VPRINTK("no work, mask == 0x%x\n", mask);
1223                 goto out;
1224         }
1225
1226         if (mask & INT_ACK_MASK)
1227                 writel(mask, mmio + CARM_INT_STAT);
1228
1229         if (unlikely(host->state == HST_INVALID)) {
1230                 VPRINTK("not initialized yet, mask = 0x%x\n", mask);
1231                 goto out;
1232         }
1233
1234         if (mask & CARM_HAVE_RESP) {
1235                 handled = 1;
1236                 carm_handle_responses(host);
1237         }
1238
1239 out:
1240         spin_unlock_irqrestore(&host->lock, flags);
1241         VPRINTK("EXIT\n");
1242         return IRQ_RETVAL(handled);
1243 }
1244
1245 static void carm_fsm_task (struct work_struct *work)
1246 {
1247         struct carm_host *host =
1248                 container_of(work, struct carm_host, fsm_task);
1249         unsigned long flags;
1250         unsigned int state;
1251         int rc, i, next_dev;
1252         int reschedule = 0;
1253         int new_state = HST_INVALID;
1254
1255         spin_lock_irqsave(&host->lock, flags);
1256         state = host->state;
1257         spin_unlock_irqrestore(&host->lock, flags);
1258
1259         DPRINTK("ENTER, state == %s\n", state_name[state]);
1260
1261         switch (state) {
1262         case HST_PROBE_START:
1263                 new_state = HST_ALLOC_BUF;
1264                 reschedule = 1;
1265                 break;
1266
1267         case HST_ALLOC_BUF:
1268                 rc = carm_send_special(host, carm_fill_alloc_buf);
1269                 if (rc) {
1270                         new_state = HST_ERROR;
1271                         reschedule = 1;
1272                 }
1273                 break;
1274
1275         case HST_SYNC_TIME:
1276                 rc = carm_send_special(host, carm_fill_sync_time);
1277                 if (rc) {
1278                         new_state = HST_ERROR;
1279                         reschedule = 1;
1280                 }
1281                 break;
1282
1283         case HST_GET_FW_VER:
1284                 rc = carm_send_special(host, carm_fill_get_fw_ver);
1285                 if (rc) {
1286                         new_state = HST_ERROR;
1287                         reschedule = 1;
1288                 }
1289                 break;
1290
1291         case HST_PORT_SCAN:
1292                 rc = carm_send_special(host, carm_fill_scan_channels);
1293                 if (rc) {
1294                         new_state = HST_ERROR;
1295                         reschedule = 1;
1296                 }
1297                 break;
1298
1299         case HST_DEV_SCAN_START:
1300                 host->cur_scan_dev = -1;
1301                 new_state = HST_DEV_SCAN;
1302                 reschedule = 1;
1303                 break;
1304
1305         case HST_DEV_SCAN:
1306                 next_dev = -1;
1307                 for (i = host->cur_scan_dev + 1; i < CARM_MAX_PORTS; i++)
1308                         if (host->dev_present & (1 << i)) {
1309                                 next_dev = i;
1310                                 break;
1311                         }
1312
1313                 if (next_dev >= 0) {
1314                         host->cur_scan_dev = next_dev;
1315                         rc = carm_array_info(host, next_dev);
1316                         if (rc) {
1317                                 new_state = HST_ERROR;
1318                                 reschedule = 1;
1319                         }
1320                 } else {
1321                         new_state = HST_DEV_ACTIVATE;
1322                         reschedule = 1;
1323                 }
1324                 break;
1325
1326         case HST_DEV_ACTIVATE: {
1327                 int activated = 0;
1328                 for (i = 0; i < CARM_MAX_PORTS; i++)
1329                         if (host->dev_active & (1 << i)) {
1330                                 struct carm_port *port = &host->port[i];
1331                                 struct gendisk *disk = port->disk;
1332
1333                                 set_capacity(disk, port->capacity);
1334                                 add_disk(disk);
1335                                 activated++;
1336                         }
1337
1338                 printk(KERN_INFO DRV_NAME "(%s): %d ports activated\n",
1339                        pci_name(host->pdev), activated);
1340
1341                 new_state = HST_PROBE_FINISHED;
1342                 reschedule = 1;
1343                 break;
1344         }
1345
1346         case HST_PROBE_FINISHED:
1347                 complete(&host->probe_comp);
1348                 break;
1349
1350         case HST_ERROR:
1351                 /* FIXME: TODO */
1352                 break;
1353
1354         default:
1355                 /* should never occur */
1356                 printk(KERN_ERR PFX "BUG: unknown state %d\n", state);
1357                 assert(0);
1358                 break;
1359         }
1360
1361         if (new_state != HST_INVALID) {
1362                 spin_lock_irqsave(&host->lock, flags);
1363                 host->state = new_state;
1364                 spin_unlock_irqrestore(&host->lock, flags);
1365         }
1366         if (reschedule)
1367                 schedule_work(&host->fsm_task);
1368 }
1369
1370 static int carm_init_wait(void __iomem *mmio, u32 bits, unsigned int test_bit)
1371 {
1372         unsigned int i;
1373
1374         for (i = 0; i < 50000; i++) {
1375                 u32 tmp = readl(mmio + CARM_LMUC);
1376                 udelay(100);
1377
1378                 if (test_bit) {
1379                         if ((tmp & bits) == bits)
1380                                 return 0;
1381                 } else {
1382                         if ((tmp & bits) == 0)
1383                                 return 0;
1384                 }
1385
1386                 cond_resched();
1387         }
1388
1389         printk(KERN_ERR PFX "carm_init_wait timeout, bits == 0x%x, test_bit == %s\n",
1390                bits, test_bit ? "yes" : "no");
1391         return -EBUSY;
1392 }
1393
1394 static void carm_init_responses(struct carm_host *host)
1395 {
1396         void __iomem *mmio = host->mmio;
1397         unsigned int i;
1398         struct carm_response *resp = (struct carm_response *) host->shm;
1399
1400         for (i = 0; i < RMSG_Q_LEN; i++)
1401                 resp[i].status = cpu_to_le32(0xffffffff);
1402
1403         writel(0, mmio + CARM_RESP_IDX);
1404 }
1405
1406 static int carm_init_host(struct carm_host *host)
1407 {
1408         void __iomem *mmio = host->mmio;
1409         u32 tmp;
1410         u8 tmp8;
1411         int rc;
1412
1413         DPRINTK("ENTER\n");
1414
1415         writel(0, mmio + CARM_INT_MASK);
1416
1417         tmp8 = readb(mmio + CARM_INITC);
1418         if (tmp8 & 0x01) {
1419                 tmp8 &= ~0x01;
1420                 writeb(tmp8, mmio + CARM_INITC);
1421                 readb(mmio + CARM_INITC);       /* flush */
1422
1423                 DPRINTK("snooze...\n");
1424                 msleep(5000);
1425         }
1426
1427         tmp = readl(mmio + CARM_HMUC);
1428         if (tmp & CARM_CME) {
1429                 DPRINTK("CME bit present, waiting\n");
1430                 rc = carm_init_wait(mmio, CARM_CME, 1);
1431                 if (rc) {
1432                         DPRINTK("EXIT, carm_init_wait 1 failed\n");
1433                         return rc;
1434                 }
1435         }
1436         if (tmp & CARM_RME) {
1437                 DPRINTK("RME bit present, waiting\n");
1438                 rc = carm_init_wait(mmio, CARM_RME, 1);
1439                 if (rc) {
1440                         DPRINTK("EXIT, carm_init_wait 2 failed\n");
1441                         return rc;
1442                 }
1443         }
1444
1445         tmp &= ~(CARM_RME | CARM_CME);
1446         writel(tmp, mmio + CARM_HMUC);
1447         readl(mmio + CARM_HMUC);        /* flush */
1448
1449         rc = carm_init_wait(mmio, CARM_RME | CARM_CME, 0);
1450         if (rc) {
1451                 DPRINTK("EXIT, carm_init_wait 3 failed\n");
1452                 return rc;
1453         }
1454
1455         carm_init_buckets(mmio);
1456
1457         writel(host->shm_dma & 0xffffffff, mmio + RBUF_ADDR_LO);
1458         writel((host->shm_dma >> 16) >> 16, mmio + RBUF_ADDR_HI);
1459         writel(RBUF_LEN, mmio + RBUF_BYTE_SZ);
1460
1461         tmp = readl(mmio + CARM_HMUC);
1462         tmp |= (CARM_RME | CARM_CME | CARM_WZBC);
1463         writel(tmp, mmio + CARM_HMUC);
1464         readl(mmio + CARM_HMUC);        /* flush */
1465
1466         rc = carm_init_wait(mmio, CARM_RME | CARM_CME, 1);
1467         if (rc) {
1468                 DPRINTK("EXIT, carm_init_wait 4 failed\n");
1469                 return rc;
1470         }
1471
1472         writel(0, mmio + CARM_HMPHA);
1473         writel(INT_DEF_MASK, mmio + CARM_INT_MASK);
1474
1475         carm_init_responses(host);
1476
1477         /* start initialization, probing state machine */
1478         spin_lock_irq(&host->lock);
1479         assert(host->state == HST_INVALID);
1480         host->state = HST_PROBE_START;
1481         spin_unlock_irq(&host->lock);
1482         schedule_work(&host->fsm_task);
1483
1484         DPRINTK("EXIT\n");
1485         return 0;
1486 }
1487
1488 static int carm_init_disks(struct carm_host *host)
1489 {
1490         unsigned int i;
1491         int rc = 0;
1492
1493         for (i = 0; i < CARM_MAX_PORTS; i++) {
1494                 struct gendisk *disk;
1495                 struct request_queue *q;
1496                 struct carm_port *port;
1497
1498                 port = &host->port[i];
1499                 port->host = host;
1500                 port->port_no = i;
1501
1502                 disk = alloc_disk(CARM_MINORS_PER_MAJOR);
1503                 if (!disk) {
1504                         rc = -ENOMEM;
1505                         break;
1506                 }
1507
1508                 port->disk = disk;
1509                 sprintf(disk->disk_name, DRV_NAME "/%u",
1510                         (unsigned int) (host->id * CARM_MAX_PORTS) + i);
1511                 disk->major = host->major;
1512                 disk->first_minor = i * CARM_MINORS_PER_MAJOR;
1513                 disk->fops = &carm_bd_ops;
1514                 disk->private_data = port;
1515
1516                 q = blk_init_queue(carm_rq_fn, &host->lock);
1517                 if (!q) {
1518                         rc = -ENOMEM;
1519                         break;
1520                 }
1521                 disk->queue = q;
1522                 blk_queue_max_segments(q, CARM_MAX_REQ_SG);
1523                 blk_queue_segment_boundary(q, CARM_SG_BOUNDARY);
1524
1525                 q->queuedata = port;
1526         }
1527
1528         return rc;
1529 }
1530
1531 static void carm_free_disks(struct carm_host *host)
1532 {
1533         unsigned int i;
1534
1535         for (i = 0; i < CARM_MAX_PORTS; i++) {
1536                 struct gendisk *disk = host->port[i].disk;
1537                 if (disk) {
1538                         struct request_queue *q = disk->queue;
1539
1540                         if (disk->flags & GENHD_FL_UP)
1541                                 del_gendisk(disk);
1542                         if (q)
1543                                 blk_cleanup_queue(q);
1544                         put_disk(disk);
1545                 }
1546         }
1547 }
1548
1549 static int carm_init_shm(struct carm_host *host)
1550 {
1551         host->shm = pci_alloc_consistent(host->pdev, CARM_SHM_SIZE,
1552                                          &host->shm_dma);
1553         if (!host->shm)
1554                 return -ENOMEM;
1555
1556         host->msg_base = host->shm + RBUF_LEN;
1557         host->msg_dma = host->shm_dma + RBUF_LEN;
1558
1559         memset(host->shm, 0xff, RBUF_LEN);
1560         memset(host->msg_base, 0, PDC_SHM_SIZE - RBUF_LEN);
1561
1562         return 0;
1563 }
1564
1565 static int carm_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
1566 {
1567         struct carm_host *host;
1568         unsigned int pci_dac;
1569         int rc;
1570         struct request_queue *q;
1571         unsigned int i;
1572
1573         printk_once(KERN_DEBUG DRV_NAME " version " DRV_VERSION "\n");
1574
1575         rc = pci_enable_device(pdev);
1576         if (rc)
1577                 return rc;
1578
1579         rc = pci_request_regions(pdev, DRV_NAME);
1580         if (rc)
1581                 goto err_out;
1582
1583 #ifdef IF_64BIT_DMA_IS_POSSIBLE /* grrrr... */
1584         rc = pci_set_dma_mask(pdev, DMA_BIT_MASK(64));
1585         if (!rc) {
1586                 rc = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64));
1587                 if (rc) {
1588                         printk(KERN_ERR DRV_NAME "(%s): consistent DMA mask failure\n",
1589                                 pci_name(pdev));
1590                         goto err_out_regions;
1591                 }
1592                 pci_dac = 1;
1593         } else {
1594 #endif
1595                 rc = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
1596                 if (rc) {
1597                         printk(KERN_ERR DRV_NAME "(%s): DMA mask failure\n",
1598                                 pci_name(pdev));
1599                         goto err_out_regions;
1600                 }
1601                 pci_dac = 0;
1602 #ifdef IF_64BIT_DMA_IS_POSSIBLE /* grrrr... */
1603         }
1604 #endif
1605
1606         host = kzalloc(sizeof(*host), GFP_KERNEL);
1607         if (!host) {
1608                 printk(KERN_ERR DRV_NAME "(%s): memory alloc failure\n",
1609                        pci_name(pdev));
1610                 rc = -ENOMEM;
1611                 goto err_out_regions;
1612         }
1613
1614         host->pdev = pdev;
1615         host->flags = pci_dac ? FL_DAC : 0;
1616         spin_lock_init(&host->lock);
1617         INIT_WORK(&host->fsm_task, carm_fsm_task);
1618         init_completion(&host->probe_comp);
1619
1620         for (i = 0; i < ARRAY_SIZE(host->req); i++)
1621                 host->req[i].tag = i;
1622
1623         host->mmio = ioremap(pci_resource_start(pdev, 0),
1624                              pci_resource_len(pdev, 0));
1625         if (!host->mmio) {
1626                 printk(KERN_ERR DRV_NAME "(%s): MMIO alloc failure\n",
1627                        pci_name(pdev));
1628                 rc = -ENOMEM;
1629                 goto err_out_kfree;
1630         }
1631
1632         rc = carm_init_shm(host);
1633         if (rc) {
1634                 printk(KERN_ERR DRV_NAME "(%s): DMA SHM alloc failure\n",
1635                        pci_name(pdev));
1636                 goto err_out_iounmap;
1637         }
1638
1639         q = blk_init_queue(carm_oob_rq_fn, &host->lock);
1640         if (!q) {
1641                 printk(KERN_ERR DRV_NAME "(%s): OOB queue alloc failure\n",
1642                        pci_name(pdev));
1643                 rc = -ENOMEM;
1644                 goto err_out_pci_free;
1645         }
1646         host->oob_q = q;
1647         q->queuedata = host;
1648
1649         /*
1650          * Figure out which major to use: 160, 161, or dynamic
1651          */
1652         if (!test_and_set_bit(0, &carm_major_alloc))
1653                 host->major = 160;
1654         else if (!test_and_set_bit(1, &carm_major_alloc))
1655                 host->major = 161;
1656         else
1657                 host->flags |= FL_DYN_MAJOR;
1658
1659         host->id = carm_host_id;
1660         sprintf(host->name, DRV_NAME "%d", carm_host_id);
1661
1662         rc = register_blkdev(host->major, host->name);
1663         if (rc < 0)
1664                 goto err_out_free_majors;
1665         if (host->flags & FL_DYN_MAJOR)
1666                 host->major = rc;
1667
1668         rc = carm_init_disks(host);
1669         if (rc)
1670                 goto err_out_blkdev_disks;
1671
1672         pci_set_master(pdev);
1673
1674         rc = request_irq(pdev->irq, carm_interrupt, IRQF_SHARED, DRV_NAME, host);
1675         if (rc) {
1676                 printk(KERN_ERR DRV_NAME "(%s): irq alloc failure\n",
1677                        pci_name(pdev));
1678                 goto err_out_blkdev_disks;
1679         }
1680
1681         rc = carm_init_host(host);
1682         if (rc)
1683                 goto err_out_free_irq;
1684
1685         DPRINTK("waiting for probe_comp\n");
1686         wait_for_completion(&host->probe_comp);
1687
1688         printk(KERN_INFO "%s: pci %s, ports %d, io %llx, irq %u, major %d\n",
1689                host->name, pci_name(pdev), (int) CARM_MAX_PORTS,
1690                (unsigned long long)pci_resource_start(pdev, 0),
1691                    pdev->irq, host->major);
1692
1693         carm_host_id++;
1694         pci_set_drvdata(pdev, host);
1695         return 0;
1696
1697 err_out_free_irq:
1698         free_irq(pdev->irq, host);
1699 err_out_blkdev_disks:
1700         carm_free_disks(host);
1701         unregister_blkdev(host->major, host->name);
1702 err_out_free_majors:
1703         if (host->major == 160)
1704                 clear_bit(0, &carm_major_alloc);
1705         else if (host->major == 161)
1706                 clear_bit(1, &carm_major_alloc);
1707         blk_cleanup_queue(host->oob_q);
1708 err_out_pci_free:
1709         pci_free_consistent(pdev, CARM_SHM_SIZE, host->shm, host->shm_dma);
1710 err_out_iounmap:
1711         iounmap(host->mmio);
1712 err_out_kfree:
1713         kfree(host);
1714 err_out_regions:
1715         pci_release_regions(pdev);
1716 err_out:
1717         pci_disable_device(pdev);
1718         return rc;
1719 }
1720
1721 static void carm_remove_one (struct pci_dev *pdev)
1722 {
1723         struct carm_host *host = pci_get_drvdata(pdev);
1724
1725         if (!host) {
1726                 printk(KERN_ERR PFX "BUG: no host data for PCI(%s)\n",
1727                        pci_name(pdev));
1728                 return;
1729         }
1730
1731         free_irq(pdev->irq, host);
1732         carm_free_disks(host);
1733         unregister_blkdev(host->major, host->name);
1734         if (host->major == 160)
1735                 clear_bit(0, &carm_major_alloc);
1736         else if (host->major == 161)
1737                 clear_bit(1, &carm_major_alloc);
1738         blk_cleanup_queue(host->oob_q);
1739         pci_free_consistent(pdev, CARM_SHM_SIZE, host->shm, host->shm_dma);
1740         iounmap(host->mmio);
1741         kfree(host);
1742         pci_release_regions(pdev);
1743         pci_disable_device(pdev);
1744 }
1745
1746 module_pci_driver(carm_driver);