ocfs2: fix possible use-after-free with AIO
[linux/fpc-iii.git] / drivers / scsi / sun3_scsi_vme.c
blobfbba78e5722e604f09555c0ae713c5db3afb8c5d
1 /*
2 * Sun3 SCSI stuff by Erik Verbruggen (erik@bigmama.xtdnet.nl)
4 * Sun3 DMA routines added by Sam Creasey (sammy@sammy.net)
6 * VME support added by Sam Creasey
8 * Adapted from sun3_scsi.c -- see there for other headers
10 * TODO: modify this driver to support multiple Sun3 SCSI VME boards
14 #define AUTOSENSE
16 #include <linux/types.h>
17 #include <linux/stddef.h>
18 #include <linux/ctype.h>
19 #include <linux/delay.h>
21 #include <linux/module.h>
22 #include <linux/signal.h>
23 #include <linux/ioport.h>
24 #include <linux/init.h>
25 #include <linux/blkdev.h>
27 #include <asm/io.h>
28 #include <asm/system.h>
30 #include <asm/sun3ints.h>
31 #include <asm/dvma.h>
32 #include <asm/idprom.h>
33 #include <asm/machines.h>
35 #define SUN3_SCSI_VME
37 #undef SUN3_SCSI_DEBUG
39 /* dma on! */
40 #define REAL_DMA
42 #define NDEBUG 0
44 #define NDEBUG_ABORT 0x00100000
45 #define NDEBUG_TAGS 0x00200000
46 #define NDEBUG_MERGING 0x00400000
48 #include "scsi.h"
49 #include "initio.h"
50 #include <scsi/scsi_host.h>
51 #include "sun3_scsi.h"
53 extern int sun3_map_test(unsigned long, char *);
55 #define USE_WRAPPER
56 /*#define RESET_BOOT */
57 #define DRIVER_SETUP
60 * BUG can be used to trigger a strange code-size related hang on 2.1 kernels
62 #ifdef BUG
63 #undef RESET_BOOT
64 #undef DRIVER_SETUP
65 #endif
67 /* #define SUPPORT_TAGS */
69 //#define ENABLE_IRQ() enable_irq( SUN3_VEC_VMESCSI0 );
70 #define ENABLE_IRQ()
73 static irqreturn_t scsi_sun3_intr(int irq, void *dummy);
74 static inline unsigned char sun3scsi_read(int reg);
75 static inline void sun3scsi_write(int reg, int value);
77 static int setup_can_queue = -1;
78 module_param(setup_can_queue, int, 0);
79 static int setup_cmd_per_lun = -1;
80 module_param(setup_cmd_per_lun, int, 0);
81 static int setup_sg_tablesize = -1;
82 module_param(setup_sg_tablesize, int, 0);
83 #ifdef SUPPORT_TAGS
84 static int setup_use_tagged_queuing = -1;
85 module_param(setup_use_tagged_queuing, int, 0);
86 #endif
87 static int setup_hostid = -1;
88 module_param(setup_hostid, int, 0);
90 static struct scsi_cmnd *sun3_dma_setup_done = NULL;
92 #define AFTER_RESET_DELAY (HZ/2)
94 /* ms to wait after hitting dma regs */
95 #define SUN3_DMA_DELAY 10
97 /* dvma buffer to allocate -- 32k should hopefully be more than sufficient */
98 #define SUN3_DVMA_BUFSIZE 0xe000
100 /* minimum number of bytes to do dma on */
101 #define SUN3_DMA_MINSIZE 128
103 static volatile unsigned char *sun3_scsi_regp;
104 static volatile struct sun3_dma_regs *dregs;
105 #ifdef OLDDMA
106 static unsigned char *dmabuf = NULL; /* dma memory buffer */
107 #endif
108 static unsigned char *sun3_dma_orig_addr = NULL;
109 static unsigned long sun3_dma_orig_count = 0;
110 static int sun3_dma_active = 0;
111 static unsigned long last_residual = 0;
114 * NCR 5380 register access functions
117 static inline unsigned char sun3scsi_read(int reg)
119 return( sun3_scsi_regp[reg] );
122 static inline void sun3scsi_write(int reg, int value)
124 sun3_scsi_regp[reg] = value;
128 * XXX: status debug
130 static struct Scsi_Host *default_instance;
133 * Function : int sun3scsi_detect(struct scsi_host_template * tpnt)
135 * Purpose : initializes mac NCR5380 driver based on the
136 * command line / compile time port and irq definitions.
138 * Inputs : tpnt - template for this SCSI adapter.
140 * Returns : 1 if a host adapter was found, 0 if not.
144 static int __init sun3scsi_detect(struct scsi_host_template * tpnt)
146 unsigned long ioaddr, irq = 0;
147 static int called = 0;
148 struct Scsi_Host *instance;
149 int i;
150 unsigned long addrs[3] = { IOBASE_SUN3_VMESCSI,
151 IOBASE_SUN3_VMESCSI + 0x4000,
152 0 };
153 unsigned long vecs[3] = { SUN3_VEC_VMESCSI0,
154 SUN3_VEC_VMESCSI1,
155 0 };
156 /* check that this machine has an onboard 5380 */
157 switch(idprom->id_machtype) {
158 case SM_SUN3|SM_3_160:
159 case SM_SUN3|SM_3_260:
160 break;
162 default:
163 return 0;
166 if(called)
167 return 0;
169 tpnt->proc_name = "Sun3 5380 VME SCSI";
171 /* setup variables */
172 tpnt->can_queue =
173 (setup_can_queue > 0) ? setup_can_queue : CAN_QUEUE;
174 tpnt->cmd_per_lun =
175 (setup_cmd_per_lun > 0) ? setup_cmd_per_lun : CMD_PER_LUN;
176 tpnt->sg_tablesize =
177 (setup_sg_tablesize >= 0) ? setup_sg_tablesize : SG_TABLESIZE;
179 if (setup_hostid >= 0)
180 tpnt->this_id = setup_hostid;
181 else {
182 /* use 7 as default */
183 tpnt->this_id = 7;
186 ioaddr = 0;
187 for(i = 0; addrs[i] != 0; i++) {
188 unsigned char x;
190 ioaddr = (unsigned long)sun3_ioremap(addrs[i], PAGE_SIZE,
191 SUN3_PAGE_TYPE_VME16);
192 irq = vecs[i];
193 sun3_scsi_regp = (unsigned char *)ioaddr;
195 dregs = (struct sun3_dma_regs *)(((unsigned char *)ioaddr) + 8);
197 if(sun3_map_test((unsigned long)dregs, &x)) {
198 unsigned short oldcsr;
200 oldcsr = dregs->csr;
201 dregs->csr = 0;
202 udelay(SUN3_DMA_DELAY);
203 if(dregs->csr == 0x1400)
204 break;
206 dregs->csr = oldcsr;
209 iounmap((void *)ioaddr);
210 ioaddr = 0;
213 if(!ioaddr)
214 return 0;
216 #ifdef SUPPORT_TAGS
217 if (setup_use_tagged_queuing < 0)
218 setup_use_tagged_queuing = USE_TAGGED_QUEUING;
219 #endif
221 instance = scsi_register (tpnt, sizeof(struct NCR5380_hostdata));
222 if(instance == NULL)
223 return 0;
225 default_instance = instance;
227 instance->io_port = (unsigned long) ioaddr;
228 instance->irq = irq;
230 NCR5380_init(instance, 0);
232 instance->n_io_port = 32;
234 ((struct NCR5380_hostdata *)instance->hostdata)->ctrl = 0;
236 if (request_irq(instance->irq, scsi_sun3_intr,
237 0, "Sun3SCSI-5380VME", instance)) {
238 #ifndef REAL_DMA
239 printk("scsi%d: IRQ%d not free, interrupts disabled\n",
240 instance->host_no, instance->irq);
241 instance->irq = SCSI_IRQ_NONE;
242 #else
243 printk("scsi%d: IRQ%d not free, bailing out\n",
244 instance->host_no, instance->irq);
245 return 0;
246 #endif
249 printk("scsi%d: Sun3 5380 VME at port %lX irq", instance->host_no, instance->io_port);
250 if (instance->irq == SCSI_IRQ_NONE)
251 printk ("s disabled");
252 else
253 printk (" %d", instance->irq);
254 printk(" options CAN_QUEUE=%d CMD_PER_LUN=%d release=%d",
255 instance->can_queue, instance->cmd_per_lun,
256 SUN3SCSI_PUBLIC_RELEASE);
257 printk("\nscsi%d:", instance->host_no);
258 NCR5380_print_options(instance);
259 printk("\n");
261 dregs->csr = 0;
262 udelay(SUN3_DMA_DELAY);
263 dregs->csr = CSR_SCSI | CSR_FIFO | CSR_INTR;
264 udelay(SUN3_DMA_DELAY);
265 dregs->fifo_count = 0;
266 dregs->fifo_count_hi = 0;
267 dregs->dma_addr_hi = 0;
268 dregs->dma_addr_lo = 0;
269 dregs->dma_count_hi = 0;
270 dregs->dma_count_lo = 0;
272 dregs->ivect = VME_DATA24 | (instance->irq & 0xff);
274 called = 1;
276 #ifdef RESET_BOOT
277 sun3_scsi_reset_boot(instance);
278 #endif
280 return 1;
283 int sun3scsi_release (struct Scsi_Host *shpnt)
285 if (shpnt->irq != SCSI_IRQ_NONE)
286 free_irq(shpnt->irq, shpnt);
288 iounmap((void *)sun3_scsi_regp);
290 NCR5380_exit(shpnt);
291 return 0;
294 #ifdef RESET_BOOT
296 * Our 'bus reset on boot' function
299 static void sun3_scsi_reset_boot(struct Scsi_Host *instance)
301 unsigned long end;
303 NCR5380_local_declare();
304 NCR5380_setup(instance);
307 * Do a SCSI reset to clean up the bus during initialization. No
308 * messing with the queues, interrupts, or locks necessary here.
311 printk( "Sun3 SCSI: resetting the SCSI bus..." );
313 /* switch off SCSI IRQ - catch an interrupt without IRQ bit set else */
314 // sun3_disable_irq( IRQ_SUN3_SCSI );
316 /* get in phase */
317 NCR5380_write( TARGET_COMMAND_REG,
318 PHASE_SR_TO_TCR( NCR5380_read(STATUS_REG) ));
320 /* assert RST */
321 NCR5380_write( INITIATOR_COMMAND_REG, ICR_BASE | ICR_ASSERT_RST );
323 /* The min. reset hold time is 25us, so 40us should be enough */
324 udelay( 50 );
326 /* reset RST and interrupt */
327 NCR5380_write( INITIATOR_COMMAND_REG, ICR_BASE );
328 NCR5380_read( RESET_PARITY_INTERRUPT_REG );
330 for( end = jiffies + AFTER_RESET_DELAY; time_before(jiffies, end); )
331 barrier();
333 /* switch on SCSI IRQ again */
334 // sun3_enable_irq( IRQ_SUN3_SCSI );
336 printk( " done\n" );
338 #endif
340 static const char * sun3scsi_info (struct Scsi_Host *spnt) {
341 return "";
344 // safe bits for the CSR
345 #define CSR_GOOD 0x060f
347 static irqreturn_t scsi_sun3_intr(int irq, void *dummy)
349 unsigned short csr = dregs->csr;
350 int handled = 0;
352 dregs->csr &= ~CSR_DMA_ENABLE;
355 #ifdef SUN3_SCSI_DEBUG
356 printk("scsi_intr csr %x\n", csr);
357 #endif
359 if(csr & ~CSR_GOOD) {
360 if(csr & CSR_DMA_BUSERR) {
361 printk("scsi%d: bus error in dma\n", default_instance->host_no);
362 #ifdef SUN3_SCSI_DEBUG
363 printk("scsi: residual %x count %x addr %p dmaaddr %x\n",
364 dregs->fifo_count,
365 dregs->dma_count_lo | (dregs->dma_count_hi << 16),
366 sun3_dma_orig_addr,
367 dregs->dma_addr_lo | (dregs->dma_addr_hi << 16));
368 #endif
371 if(csr & CSR_DMA_CONFLICT) {
372 printk("scsi%d: dma conflict\n", default_instance->host_no);
374 handled = 1;
377 if(csr & (CSR_SDB_INT | CSR_DMA_INT)) {
378 NCR5380_intr(irq, dummy);
379 handled = 1;
382 return IRQ_RETVAL(handled);
386 * Debug stuff - to be called on NMI, or sysrq key. Use at your own risk;
387 * reentering NCR5380_print_status seems to have ugly side effects
390 /* this doesn't seem to get used at all -- sam */
391 #if 0
392 void sun3_sun3_debug (void)
394 unsigned long flags;
395 NCR5380_local_declare();
397 if (default_instance) {
398 local_irq_save(flags);
399 NCR5380_print_status(default_instance);
400 local_irq_restore(flags);
403 #endif
406 /* sun3scsi_dma_setup() -- initialize the dma controller for a read/write */
407 static unsigned long sun3scsi_dma_setup(void *data, unsigned long count, int write_flag)
409 void *addr;
411 if(sun3_dma_orig_addr != NULL)
412 dvma_unmap(sun3_dma_orig_addr);
414 // addr = sun3_dvma_page((unsigned long)data, (unsigned long)dmabuf);
415 addr = (void *)dvma_map_vme((unsigned long) data, count);
417 sun3_dma_orig_addr = addr;
418 sun3_dma_orig_count = count;
420 #ifdef SUN3_SCSI_DEBUG
421 printk("scsi: dma_setup addr %p count %x\n", addr, count);
422 #endif
424 // dregs->fifo_count = 0;
425 #if 0
426 /* reset fifo */
427 dregs->csr &= ~CSR_FIFO;
428 dregs->csr |= CSR_FIFO;
429 #endif
430 /* set direction */
431 if(write_flag)
432 dregs->csr |= CSR_SEND;
433 else
434 dregs->csr &= ~CSR_SEND;
436 /* reset fifo */
437 // dregs->csr &= ~CSR_FIFO;
438 // dregs->csr |= CSR_FIFO;
440 dregs->csr |= CSR_PACK_ENABLE;
442 dregs->dma_addr_hi = ((unsigned long)addr >> 16);
443 dregs->dma_addr_lo = ((unsigned long)addr & 0xffff);
445 dregs->dma_count_hi = 0;
446 dregs->dma_count_lo = 0;
447 dregs->fifo_count_hi = 0;
448 dregs->fifo_count = 0;
450 #ifdef SUN3_SCSI_DEBUG
451 printk("scsi: dma_setup done csr %x\n", dregs->csr);
452 #endif
453 return count;
457 static inline unsigned long sun3scsi_dma_residual(struct Scsi_Host *instance)
459 return last_residual;
462 static inline unsigned long sun3scsi_dma_xfer_len(unsigned long wanted,
463 struct scsi_cmnd *cmd,
464 int write_flag)
466 if (cmd->request->cmd_type == REQ_TYPE_FS)
467 return wanted;
468 else
469 return 0;
472 static int sun3scsi_dma_start(unsigned long count, char *data)
475 unsigned short csr;
477 csr = dregs->csr;
478 #ifdef SUN3_SCSI_DEBUG
479 printk("scsi: dma_start data %p count %x csr %x fifo %x\n", data, count, csr, dregs->fifo_count);
480 #endif
482 dregs->dma_count_hi = (sun3_dma_orig_count >> 16);
483 dregs->dma_count_lo = (sun3_dma_orig_count & 0xffff);
485 dregs->fifo_count_hi = (sun3_dma_orig_count >> 16);
486 dregs->fifo_count = (sun3_dma_orig_count & 0xffff);
488 // if(!(csr & CSR_DMA_ENABLE))
489 // dregs->csr |= CSR_DMA_ENABLE;
491 return 0;
494 /* clean up after our dma is done */
495 static int sun3scsi_dma_finish(int write_flag)
497 unsigned short fifo;
498 int ret = 0;
500 sun3_dma_active = 0;
502 dregs->csr &= ~CSR_DMA_ENABLE;
504 fifo = dregs->fifo_count;
505 if(write_flag) {
506 if((fifo > 0) && (fifo < sun3_dma_orig_count))
507 fifo++;
510 last_residual = fifo;
511 #ifdef SUN3_SCSI_DEBUG
512 printk("scsi: residual %x total %x\n", fifo, sun3_dma_orig_count);
513 #endif
514 /* empty bytes from the fifo which didn't make it */
515 if((!write_flag) && (dregs->csr & CSR_LEFT)) {
516 unsigned char *vaddr;
518 #ifdef SUN3_SCSI_DEBUG
519 printk("scsi: got left over bytes\n");
520 #endif
522 vaddr = (unsigned char *)dvma_vmetov(sun3_dma_orig_addr);
524 vaddr += (sun3_dma_orig_count - fifo);
525 vaddr--;
527 switch(dregs->csr & CSR_LEFT) {
528 case CSR_LEFT_3:
529 *vaddr = (dregs->bpack_lo & 0xff00) >> 8;
530 vaddr--;
532 case CSR_LEFT_2:
533 *vaddr = (dregs->bpack_hi & 0x00ff);
534 vaddr--;
536 case CSR_LEFT_1:
537 *vaddr = (dregs->bpack_hi & 0xff00) >> 8;
538 break;
544 dvma_unmap(sun3_dma_orig_addr);
545 sun3_dma_orig_addr = NULL;
547 dregs->dma_addr_hi = 0;
548 dregs->dma_addr_lo = 0;
549 dregs->dma_count_hi = 0;
550 dregs->dma_count_lo = 0;
552 dregs->fifo_count = 0;
553 dregs->fifo_count_hi = 0;
555 dregs->csr &= ~CSR_SEND;
557 // dregs->csr |= CSR_DMA_ENABLE;
559 #if 0
560 /* reset fifo */
561 dregs->csr &= ~CSR_FIFO;
562 dregs->csr |= CSR_FIFO;
563 #endif
564 sun3_dma_setup_done = NULL;
566 return ret;
570 #include "sun3_NCR5380.c"
572 static struct scsi_host_template driver_template = {
573 .name = SUN3_SCSI_NAME,
574 .detect = sun3scsi_detect,
575 .release = sun3scsi_release,
576 .info = sun3scsi_info,
577 .queuecommand = sun3scsi_queue_command,
578 .eh_abort_handler = sun3scsi_abort,
579 .eh_bus_reset_handler = sun3scsi_bus_reset,
580 .can_queue = CAN_QUEUE,
581 .this_id = 7,
582 .sg_tablesize = SG_TABLESIZE,
583 .cmd_per_lun = CMD_PER_LUN,
584 .use_clustering = DISABLE_CLUSTERING
588 #include "scsi_module.c"
590 MODULE_LICENSE("GPL");