[SCSI] ibmvscsi: Abort path fix
[linux-2.6] / drivers / scsi / ibmvscsi / ibmvscsi.c
1 /* ------------------------------------------------------------
2  * ibmvscsi.c
3  * (C) Copyright IBM Corporation 1994, 2004
4  * Authors: Colin DeVilbiss (devilbis@us.ibm.com)
5  *          Santiago Leon (santil@us.ibm.com)
6  *          Dave Boutcher (sleddog@us.ibm.com)
7  *
8  * This program is free software; you can redistribute it and/or modify
9  * it under the terms of the GNU General Public License as published by
10  * the Free Software Foundation; either version 2 of the License, or
11  * (at your option) any later version.
12  *
13  * This program is distributed in the hope that it will be useful,
14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16  * GNU General Public License for more details.
17  *
18  * You should have received a copy of the GNU General Public License
19  * along with this program; if not, write to the Free Software
20  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307
21  * USA
22  *
23  * ------------------------------------------------------------
24  * Emulation of a SCSI host adapter for Virtual I/O devices
25  *
26  * This driver supports the SCSI adapter implemented by the IBM
27  * Power5 firmware.  That SCSI adapter is not a physical adapter,
28  * but allows Linux SCSI peripheral drivers to directly
29  * access devices in another logical partition on the physical system.
30  *
31  * The virtual adapter(s) are present in the open firmware device
32  * tree just like real adapters.
33  *
34  * One of the capabilities provided on these systems is the ability
35  * to DMA between partitions.  The architecture states that for VSCSI,
36  * the server side is allowed to DMA to and from the client.  The client
37  * is never trusted to DMA to or from the server directly.
38  *
39  * Messages are sent between partitions on a "Command/Response Queue" 
40  * (CRQ), which is just a buffer of 16 byte entries in the receiver's 
41  * Senders cannot access the buffer directly, but send messages by
42  * making a hypervisor call and passing in the 16 bytes.  The hypervisor
43  * puts the message in the next 16 byte space in round-robbin fashion,
44  * turns on the high order bit of the message (the valid bit), and 
45  * generates an interrupt to the receiver (if interrupts are turned on.) 
46  * The receiver just turns off the valid bit when they have copied out
47  * the message.
48  *
49  * The VSCSI client builds a SCSI Remote Protocol (SRP) Information Unit
50  * (IU) (as defined in the T10 standard available at www.t10.org), gets 
51  * a DMA address for the message, and sends it to the server as the
52  * payload of a CRQ message.  The server DMAs the SRP IU and processes it,
53  * including doing any additional data transfers.  When it is done, it
54  * DMAs the SRP response back to the same address as the request came from,
55  * and sends a CRQ message back to inform the client that the request has
56  * completed.
57  *
58  * Note that some of the underlying infrastructure is different between
59  * machines conforming to the "RS/6000 Platform Architecture" (RPA) and
60  * the older iSeries hypervisor models.  To support both, some low level
61  * routines have been broken out into rpa_vscsi.c and iseries_vscsi.c.
62  * The Makefile should pick one, not two, not zero, of these.
63  *
64  * TODO: This is currently pretty tied to the IBM i/pSeries hypervisor
65  * interfaces.  It would be really nice to abstract this above an RDMA
66  * layer.
67  */
68
69 #include <linux/module.h>
70 #include <linux/moduleparam.h>
71 #include <linux/dma-mapping.h>
72 #include <linux/delay.h>
73 #include <asm/vio.h>
74 #include <scsi/scsi.h>
75 #include <scsi/scsi_cmnd.h>
76 #include <scsi/scsi_host.h>
77 #include <scsi/scsi_device.h>
78 #include "ibmvscsi.h"
79
80 /* The values below are somewhat arbitrary default values, but 
81  * OS/400 will use 3 busses (disks, CDs, tapes, I think.)
82  * Note that there are 3 bits of channel value, 6 bits of id, and
83  * 5 bits of LUN.
84  */
85 static int max_id = 64;
86 static int max_channel = 3;
87 static int init_timeout = 5;
88 static int max_requests = IBMVSCSI_MAX_REQUESTS_DEFAULT;
89
90 #define IBMVSCSI_VERSION "1.5.8"
91
92 MODULE_DESCRIPTION("IBM Virtual SCSI");
93 MODULE_AUTHOR("Dave Boutcher");
94 MODULE_LICENSE("GPL");
95 MODULE_VERSION(IBMVSCSI_VERSION);
96
97 module_param_named(max_id, max_id, int, S_IRUGO | S_IWUSR);
98 MODULE_PARM_DESC(max_id, "Largest ID value for each channel");
99 module_param_named(max_channel, max_channel, int, S_IRUGO | S_IWUSR);
100 MODULE_PARM_DESC(max_channel, "Largest channel value");
101 module_param_named(init_timeout, init_timeout, int, S_IRUGO | S_IWUSR);
102 MODULE_PARM_DESC(init_timeout, "Initialization timeout in seconds");
103 module_param_named(max_requests, max_requests, int, S_IRUGO | S_IWUSR);
104 MODULE_PARM_DESC(max_requests, "Maximum requests for this adapter");
105
106 /* ------------------------------------------------------------
107  * Routines for the event pool and event structs
108  */
109 /**
110  * initialize_event_pool: - Allocates and initializes the event pool for a host
111  * @pool:       event_pool to be initialized
112  * @size:       Number of events in pool
113  * @hostdata:   ibmvscsi_host_data who owns the event pool
114  *
115  * Returns zero on success.
116 */
117 static int initialize_event_pool(struct event_pool *pool,
118                                  int size, struct ibmvscsi_host_data *hostdata)
119 {
120         int i;
121
122         pool->size = size;
123         pool->next = 0;
124         pool->events = kcalloc(pool->size, sizeof(*pool->events), GFP_KERNEL);
125         if (!pool->events)
126                 return -ENOMEM;
127
128         pool->iu_storage =
129             dma_alloc_coherent(hostdata->dev,
130                                pool->size * sizeof(*pool->iu_storage),
131                                &pool->iu_token, 0);
132         if (!pool->iu_storage) {
133                 kfree(pool->events);
134                 return -ENOMEM;
135         }
136
137         for (i = 0; i < pool->size; ++i) {
138                 struct srp_event_struct *evt = &pool->events[i];
139                 memset(&evt->crq, 0x00, sizeof(evt->crq));
140                 atomic_set(&evt->free, 1);
141                 evt->crq.valid = 0x80;
142                 evt->crq.IU_length = sizeof(*evt->xfer_iu);
143                 evt->crq.IU_data_ptr = pool->iu_token + 
144                         sizeof(*evt->xfer_iu) * i;
145                 evt->xfer_iu = pool->iu_storage + i;
146                 evt->hostdata = hostdata;
147                 evt->ext_list = NULL;
148                 evt->ext_list_token = 0;
149         }
150
151         return 0;
152 }
153
154 /**
155  * release_event_pool: - Frees memory of an event pool of a host
156  * @pool:       event_pool to be released
157  * @hostdata:   ibmvscsi_host_data who owns the even pool
158  *
159  * Returns zero on success.
160 */
161 static void release_event_pool(struct event_pool *pool,
162                                struct ibmvscsi_host_data *hostdata)
163 {
164         int i, in_use = 0;
165         for (i = 0; i < pool->size; ++i) {
166                 if (atomic_read(&pool->events[i].free) != 1)
167                         ++in_use;
168                 if (pool->events[i].ext_list) {
169                         dma_free_coherent(hostdata->dev,
170                                   SG_ALL * sizeof(struct srp_direct_buf),
171                                   pool->events[i].ext_list,
172                                   pool->events[i].ext_list_token);
173                 }
174         }
175         if (in_use)
176                 dev_warn(hostdata->dev, "releasing event pool with %d "
177                          "events still in use?\n", in_use);
178         kfree(pool->events);
179         dma_free_coherent(hostdata->dev,
180                           pool->size * sizeof(*pool->iu_storage),
181                           pool->iu_storage, pool->iu_token);
182 }
183
184 /**
185  * valid_event_struct: - Determines if event is valid.
186  * @pool:       event_pool that contains the event
187  * @evt:        srp_event_struct to be checked for validity
188  *
189  * Returns zero if event is invalid, one otherwise.
190 */
191 static int valid_event_struct(struct event_pool *pool,
192                                 struct srp_event_struct *evt)
193 {
194         int index = evt - pool->events;
195         if (index < 0 || index >= pool->size)   /* outside of bounds */
196                 return 0;
197         if (evt != pool->events + index)        /* unaligned */
198                 return 0;
199         return 1;
200 }
201
202 /**
203  * ibmvscsi_free-event_struct: - Changes status of event to "free"
204  * @pool:       event_pool that contains the event
205  * @evt:        srp_event_struct to be modified
206  *
207 */
208 static void free_event_struct(struct event_pool *pool,
209                                        struct srp_event_struct *evt)
210 {
211         if (!valid_event_struct(pool, evt)) {
212                 dev_err(evt->hostdata->dev, "Freeing invalid event_struct %p "
213                         "(not in pool %p)\n", evt, pool->events);
214                 return;
215         }
216         if (atomic_inc_return(&evt->free) != 1) {
217                 dev_err(evt->hostdata->dev, "Freeing event_struct %p "
218                         "which is not in use!\n", evt);
219                 return;
220         }
221 }
222
223 /**
224  * get_evt_struct: - Gets the next free event in pool
225  * @pool:       event_pool that contains the events to be searched
226  *
227  * Returns the next event in "free" state, and NULL if none are free.
228  * Note that no synchronization is done here, we assume the host_lock
229  * will syncrhonze things.
230 */
231 static struct srp_event_struct *get_event_struct(struct event_pool *pool)
232 {
233         int i;
234         int poolsize = pool->size;
235         int offset = pool->next;
236
237         for (i = 0; i < poolsize; i++) {
238                 offset = (offset + 1) % poolsize;
239                 if (!atomic_dec_if_positive(&pool->events[offset].free)) {
240                         pool->next = offset;
241                         return &pool->events[offset];
242                 }
243         }
244
245         printk(KERN_ERR "ibmvscsi: found no event struct in pool!\n");
246         return NULL;
247 }
248
249 /**
250  * init_event_struct: Initialize fields in an event struct that are always 
251  *                    required.
252  * @evt:        The event
253  * @done:       Routine to call when the event is responded to
254  * @format:     SRP or MAD format
255  * @timeout:    timeout value set in the CRQ
256  */
257 static void init_event_struct(struct srp_event_struct *evt_struct,
258                               void (*done) (struct srp_event_struct *),
259                               u8 format,
260                               int timeout)
261 {
262         evt_struct->cmnd = NULL;
263         evt_struct->cmnd_done = NULL;
264         evt_struct->sync_srp = NULL;
265         evt_struct->crq.format = format;
266         evt_struct->crq.timeout = timeout;
267         evt_struct->done = done;
268 }
269
270 /* ------------------------------------------------------------
271  * Routines for receiving SCSI responses from the hosting partition
272  */
273
274 /**
275  * set_srp_direction: Set the fields in the srp related to data
276  *     direction and number of buffers based on the direction in
277  *     the scsi_cmnd and the number of buffers
278  */
279 static void set_srp_direction(struct scsi_cmnd *cmd,
280                               struct srp_cmd *srp_cmd, 
281                               int numbuf)
282 {
283         u8 fmt;
284
285         if (numbuf == 0)
286                 return;
287         
288         if (numbuf == 1)
289                 fmt = SRP_DATA_DESC_DIRECT;
290         else {
291                 fmt = SRP_DATA_DESC_INDIRECT;
292                 numbuf = min(numbuf, MAX_INDIRECT_BUFS);
293
294                 if (cmd->sc_data_direction == DMA_TO_DEVICE)
295                         srp_cmd->data_out_desc_cnt = numbuf;
296                 else
297                         srp_cmd->data_in_desc_cnt = numbuf;
298         }
299
300         if (cmd->sc_data_direction == DMA_TO_DEVICE)
301                 srp_cmd->buf_fmt = fmt << 4;
302         else
303                 srp_cmd->buf_fmt = fmt;
304 }
305
306 static void unmap_sg_list(int num_entries,
307                 struct device *dev,
308                 struct srp_direct_buf *md)
309 {
310         int i;
311
312         for (i = 0; i < num_entries; ++i)
313                 dma_unmap_single(dev, md[i].va, md[i].len, DMA_BIDIRECTIONAL);
314 }
315
316 /**
317  * unmap_cmd_data: - Unmap data pointed in srp_cmd based on the format
318  * @cmd:        srp_cmd whose additional_data member will be unmapped
319  * @dev:        device for which the memory is mapped
320  *
321 */
322 static void unmap_cmd_data(struct srp_cmd *cmd,
323                            struct srp_event_struct *evt_struct,
324                            struct device *dev)
325 {
326         u8 out_fmt, in_fmt;
327
328         out_fmt = cmd->buf_fmt >> 4;
329         in_fmt = cmd->buf_fmt & ((1U << 4) - 1);
330
331         if (out_fmt == SRP_NO_DATA_DESC && in_fmt == SRP_NO_DATA_DESC)
332                 return;
333         else if (out_fmt == SRP_DATA_DESC_DIRECT ||
334                  in_fmt == SRP_DATA_DESC_DIRECT) {
335                 struct srp_direct_buf *data =
336                         (struct srp_direct_buf *) cmd->add_data;
337                 dma_unmap_single(dev, data->va, data->len, DMA_BIDIRECTIONAL);
338         } else {
339                 struct srp_indirect_buf *indirect =
340                         (struct srp_indirect_buf *) cmd->add_data;
341                 int num_mapped = indirect->table_desc.len /
342                         sizeof(struct srp_direct_buf);
343
344                 if (num_mapped <= MAX_INDIRECT_BUFS) {
345                         unmap_sg_list(num_mapped, dev, &indirect->desc_list[0]);
346                         return;
347                 }
348
349                 unmap_sg_list(num_mapped, dev, evt_struct->ext_list);
350         }
351 }
352
353 static int map_sg_list(int num_entries, 
354                        struct scatterlist *sg,
355                        struct srp_direct_buf *md)
356 {
357         int i;
358         u64 total_length = 0;
359
360         for (i = 0; i < num_entries; ++i) {
361                 struct srp_direct_buf *descr = md + i;
362                 struct scatterlist *sg_entry = &sg[i];
363                 descr->va = sg_dma_address(sg_entry);
364                 descr->len = sg_dma_len(sg_entry);
365                 descr->key = 0;
366                 total_length += sg_dma_len(sg_entry);
367         }
368         return total_length;
369 }
370
371 /**
372  * map_sg_data: - Maps dma for a scatterlist and initializes decriptor fields
373  * @cmd:        Scsi_Cmnd with the scatterlist
374  * @srp_cmd:    srp_cmd that contains the memory descriptor
375  * @dev:        device for which to map dma memory
376  *
377  * Called by map_data_for_srp_cmd() when building srp cmd from scsi cmd.
378  * Returns 1 on success.
379 */
380 static int map_sg_data(struct scsi_cmnd *cmd,
381                        struct srp_event_struct *evt_struct,
382                        struct srp_cmd *srp_cmd, struct device *dev)
383 {
384
385         int sg_mapped;
386         u64 total_length = 0;
387         struct scatterlist *sg = cmd->request_buffer;
388         struct srp_direct_buf *data =
389                 (struct srp_direct_buf *) srp_cmd->add_data;
390         struct srp_indirect_buf *indirect =
391                 (struct srp_indirect_buf *) data;
392
393         sg_mapped = dma_map_sg(dev, sg, cmd->use_sg, DMA_BIDIRECTIONAL);
394
395         if (sg_mapped == 0)
396                 return 0;
397
398         set_srp_direction(cmd, srp_cmd, sg_mapped);
399
400         /* special case; we can use a single direct descriptor */
401         if (sg_mapped == 1) {
402                 data->va = sg_dma_address(&sg[0]);
403                 data->len = sg_dma_len(&sg[0]);
404                 data->key = 0;
405                 return 1;
406         }
407
408         indirect->table_desc.va = 0;
409         indirect->table_desc.len = sg_mapped * sizeof(struct srp_direct_buf);
410         indirect->table_desc.key = 0;
411
412         if (sg_mapped <= MAX_INDIRECT_BUFS) {
413                 total_length = map_sg_list(sg_mapped, sg,
414                                            &indirect->desc_list[0]);
415                 indirect->len = total_length;
416                 return 1;
417         }
418
419         /* get indirect table */
420         if (!evt_struct->ext_list) {
421                 evt_struct->ext_list = (struct srp_direct_buf *)
422                         dma_alloc_coherent(dev, 
423                                            SG_ALL * sizeof(struct srp_direct_buf),
424                                            &evt_struct->ext_list_token, 0);
425                 if (!evt_struct->ext_list) {
426                         sdev_printk(KERN_ERR, cmd->device,
427                                     "Can't allocate memory for indirect table\n");
428                         return 0;
429                 }
430         }
431
432         total_length = map_sg_list(sg_mapped, sg, evt_struct->ext_list);        
433
434         indirect->len = total_length;
435         indirect->table_desc.va = evt_struct->ext_list_token;
436         indirect->table_desc.len = sg_mapped * sizeof(indirect->desc_list[0]);
437         memcpy(indirect->desc_list, evt_struct->ext_list,
438                MAX_INDIRECT_BUFS * sizeof(struct srp_direct_buf));
439         
440         return 1;
441 }
442
443 /**
444  * map_single_data: - Maps memory and initializes memory decriptor fields
445  * @cmd:        struct scsi_cmnd with the memory to be mapped
446  * @srp_cmd:    srp_cmd that contains the memory descriptor
447  * @dev:        device for which to map dma memory
448  *
449  * Called by map_data_for_srp_cmd() when building srp cmd from scsi cmd.
450  * Returns 1 on success.
451 */
452 static int map_single_data(struct scsi_cmnd *cmd,
453                            struct srp_cmd *srp_cmd, struct device *dev)
454 {
455         struct srp_direct_buf *data =
456                 (struct srp_direct_buf *) srp_cmd->add_data;
457
458         data->va =
459                 dma_map_single(dev, cmd->request_buffer,
460                                cmd->request_bufflen,
461                                DMA_BIDIRECTIONAL);
462         if (dma_mapping_error(data->va)) {
463                 sdev_printk(KERN_ERR, cmd->device,
464                             "Unable to map request_buffer for command!\n");
465                 return 0;
466         }
467         data->len = cmd->request_bufflen;
468         data->key = 0;
469
470         set_srp_direction(cmd, srp_cmd, 1);
471
472         return 1;
473 }
474
475 /**
476  * map_data_for_srp_cmd: - Calls functions to map data for srp cmds
477  * @cmd:        struct scsi_cmnd with the memory to be mapped
478  * @srp_cmd:    srp_cmd that contains the memory descriptor
479  * @dev:        dma device for which to map dma memory
480  *
481  * Called by scsi_cmd_to_srp_cmd() when converting scsi cmds to srp cmds 
482  * Returns 1 on success.
483 */
484 static int map_data_for_srp_cmd(struct scsi_cmnd *cmd,
485                                 struct srp_event_struct *evt_struct,
486                                 struct srp_cmd *srp_cmd, struct device *dev)
487 {
488         switch (cmd->sc_data_direction) {
489         case DMA_FROM_DEVICE:
490         case DMA_TO_DEVICE:
491                 break;
492         case DMA_NONE:
493                 return 1;
494         case DMA_BIDIRECTIONAL:
495                 sdev_printk(KERN_ERR, cmd->device,
496                             "Can't map DMA_BIDIRECTIONAL to read/write\n");
497                 return 0;
498         default:
499                 sdev_printk(KERN_ERR, cmd->device,
500                             "Unknown data direction 0x%02x; can't map!\n",
501                             cmd->sc_data_direction);
502                 return 0;
503         }
504
505         if (!cmd->request_buffer)
506                 return 1;
507         if (cmd->use_sg)
508                 return map_sg_data(cmd, evt_struct, srp_cmd, dev);
509         return map_single_data(cmd, srp_cmd, dev);
510 }
511
512 /**
513  * purge_requests: Our virtual adapter just shut down.  purge any sent requests
514  * @hostdata:    the adapter
515  */
516 static void purge_requests(struct ibmvscsi_host_data *hostdata, int error_code)
517 {
518         struct srp_event_struct *tmp_evt, *pos;
519         unsigned long flags;
520
521         spin_lock_irqsave(hostdata->host->host_lock, flags);
522         list_for_each_entry_safe(tmp_evt, pos, &hostdata->sent, list) {
523                 list_del(&tmp_evt->list);
524                 del_timer(&tmp_evt->timer);
525                 if (tmp_evt->cmnd) {
526                         tmp_evt->cmnd->result = (error_code << 16);
527                         unmap_cmd_data(&tmp_evt->iu.srp.cmd,
528                                        tmp_evt,
529                                        tmp_evt->hostdata->dev);
530                         if (tmp_evt->cmnd_done)
531                                 tmp_evt->cmnd_done(tmp_evt->cmnd);
532                 } else if (tmp_evt->done)
533                         tmp_evt->done(tmp_evt);
534                 free_event_struct(&tmp_evt->hostdata->pool, tmp_evt);
535         }
536         spin_unlock_irqrestore(hostdata->host->host_lock, flags);
537 }
538
539 /**
540  * ibmvscsi_reset_host - Reset the connection to the server
541  * @hostdata:   struct ibmvscsi_host_data to reset
542 */
543 static void ibmvscsi_reset_host(struct ibmvscsi_host_data *hostdata)
544 {
545         scsi_block_requests(hostdata->host);
546         atomic_set(&hostdata->request_limit, 0);
547
548         purge_requests(hostdata, DID_ERROR);
549         if ((ibmvscsi_reset_crq_queue(&hostdata->queue, hostdata)) ||
550             (ibmvscsi_send_crq(hostdata, 0xC001000000000000LL, 0)) ||
551             (vio_enable_interrupts(to_vio_dev(hostdata->dev)))) {
552                 atomic_set(&hostdata->request_limit, -1);
553                 dev_err(hostdata->dev, "error after reset\n");
554         }
555
556         scsi_unblock_requests(hostdata->host);
557 }
558
559 /**
560  * ibmvscsi_timeout - Internal command timeout handler
561  * @evt_struct: struct srp_event_struct that timed out
562  *
563  * Called when an internally generated command times out
564 */
565 static void ibmvscsi_timeout(struct srp_event_struct *evt_struct)
566 {
567         struct ibmvscsi_host_data *hostdata = evt_struct->hostdata;
568
569         dev_err(hostdata->dev, "Command timed out (%x). Resetting connection\n",
570                 evt_struct->iu.srp.cmd.opcode);
571
572         ibmvscsi_reset_host(hostdata);
573 }
574
575
576 /* ------------------------------------------------------------
577  * Routines for sending and receiving SRPs
578  */
579 /**
580  * ibmvscsi_send_srp_event: - Transforms event to u64 array and calls send_crq()
581  * @evt_struct: evt_struct to be sent
582  * @hostdata:   ibmvscsi_host_data of host
583  * @timeout:    timeout in seconds - 0 means do not time command
584  *
585  * Returns the value returned from ibmvscsi_send_crq(). (Zero for success)
586  * Note that this routine assumes that host_lock is held for synchronization
587 */
588 static int ibmvscsi_send_srp_event(struct srp_event_struct *evt_struct,
589                                    struct ibmvscsi_host_data *hostdata,
590                                    unsigned long timeout)
591 {
592         u64 *crq_as_u64 = (u64 *) &evt_struct->crq;
593         int request_status;
594         int rc;
595
596         /* If we have exhausted our request limit, just fail this request,
597          * unless it is for a reset or abort.
598          * Note that there are rare cases involving driver generated requests 
599          * (such as task management requests) that the mid layer may think we
600          * can handle more requests (can_queue) when we actually can't
601          */
602         if (evt_struct->crq.format == VIOSRP_SRP_FORMAT) {
603                 request_status =
604                         atomic_dec_if_positive(&hostdata->request_limit);
605                 /* If request limit was -1 when we started, it is now even
606                  * less than that
607                  */
608                 if (request_status < -1)
609                         goto send_error;
610                 /* Otherwise, we may have run out of requests. */
611                 /* Abort and reset calls should make it through.
612                  * Nothing except abort and reset should use the last two
613                  * slots unless we had two or less to begin with.
614                  */
615                 else if (request_status < 2 &&
616                          evt_struct->iu.srp.cmd.opcode != SRP_TSK_MGMT) {
617                         /* In the case that we have less than two requests
618                          * available, check the server limit as a combination
619                          * of the request limit and the number of requests
620                          * in-flight (the size of the send list).  If the
621                          * server limit is greater than 2, return busy so
622                          * that the last two are reserved for reset and abort.
623                          */
624                         int server_limit = request_status;
625                         struct srp_event_struct *tmp_evt;
626
627                         list_for_each_entry(tmp_evt, &hostdata->sent, list) {
628                                 server_limit++;
629                         }
630
631                         if (server_limit > 2)
632                                 goto send_busy;
633                 }
634         }
635
636         /* Copy the IU into the transfer area */
637         *evt_struct->xfer_iu = evt_struct->iu;
638         evt_struct->xfer_iu->srp.rsp.tag = (u64)evt_struct;
639
640         /* Add this to the sent list.  We need to do this 
641          * before we actually send 
642          * in case it comes back REALLY fast
643          */
644         list_add_tail(&evt_struct->list, &hostdata->sent);
645
646         init_timer(&evt_struct->timer);
647         if (timeout) {
648                 evt_struct->timer.data = (unsigned long) evt_struct;
649                 evt_struct->timer.expires = jiffies + (timeout * HZ);
650                 evt_struct->timer.function = (void (*)(unsigned long))ibmvscsi_timeout;
651                 add_timer(&evt_struct->timer);
652         }
653
654         if ((rc =
655              ibmvscsi_send_crq(hostdata, crq_as_u64[0], crq_as_u64[1])) != 0) {
656                 list_del(&evt_struct->list);
657                 del_timer(&evt_struct->timer);
658
659                 dev_err(hostdata->dev, "send error %d\n", rc);
660                 atomic_inc(&hostdata->request_limit);
661                 goto send_error;
662         }
663
664         return 0;
665
666  send_busy:
667         unmap_cmd_data(&evt_struct->iu.srp.cmd, evt_struct, hostdata->dev);
668
669         free_event_struct(&hostdata->pool, evt_struct);
670         atomic_inc(&hostdata->request_limit);
671         return SCSI_MLQUEUE_HOST_BUSY;
672
673  send_error:
674         unmap_cmd_data(&evt_struct->iu.srp.cmd, evt_struct, hostdata->dev);
675
676         if (evt_struct->cmnd != NULL) {
677                 evt_struct->cmnd->result = DID_ERROR << 16;
678                 evt_struct->cmnd_done(evt_struct->cmnd);
679         } else if (evt_struct->done)
680                 evt_struct->done(evt_struct);
681
682         free_event_struct(&hostdata->pool, evt_struct);
683         return 0;
684 }
685
686 /**
687  * handle_cmd_rsp: -  Handle responses from commands
688  * @evt_struct: srp_event_struct to be handled
689  *
690  * Used as a callback by when sending scsi cmds.
691  * Gets called by ibmvscsi_handle_crq()
692 */
693 static void handle_cmd_rsp(struct srp_event_struct *evt_struct)
694 {
695         struct srp_rsp *rsp = &evt_struct->xfer_iu->srp.rsp;
696         struct scsi_cmnd *cmnd = evt_struct->cmnd;
697
698         if (unlikely(rsp->opcode != SRP_RSP)) {
699                 if (printk_ratelimit())
700                         dev_warn(evt_struct->hostdata->dev,
701                                  "bad SRP RSP type %d\n", rsp->opcode);
702         }
703         
704         if (cmnd) {
705                 cmnd->result = rsp->status;
706                 if (((cmnd->result >> 1) & 0x1f) == CHECK_CONDITION)
707                         memcpy(cmnd->sense_buffer,
708                                rsp->data,
709                                rsp->sense_data_len);
710                 unmap_cmd_data(&evt_struct->iu.srp.cmd, 
711                                evt_struct, 
712                                evt_struct->hostdata->dev);
713
714                 if (rsp->flags & SRP_RSP_FLAG_DOOVER)
715                         cmnd->resid = rsp->data_out_res_cnt;
716                 else if (rsp->flags & SRP_RSP_FLAG_DIOVER)
717                         cmnd->resid = rsp->data_in_res_cnt;
718         }
719
720         if (evt_struct->cmnd_done)
721                 evt_struct->cmnd_done(cmnd);
722 }
723
724 /**
725  * lun_from_dev: - Returns the lun of the scsi device
726  * @dev:        struct scsi_device
727  *
728 */
729 static inline u16 lun_from_dev(struct scsi_device *dev)
730 {
731         return (0x2 << 14) | (dev->id << 8) | (dev->channel << 5) | dev->lun;
732 }
733
734 /**
735  * ibmvscsi_queue: - The queuecommand function of the scsi template 
736  * @cmd:        struct scsi_cmnd to be executed
737  * @done:       Callback function to be called when cmd is completed
738 */
739 static int ibmvscsi_queuecommand(struct scsi_cmnd *cmnd,
740                                  void (*done) (struct scsi_cmnd *))
741 {
742         struct srp_cmd *srp_cmd;
743         struct srp_event_struct *evt_struct;
744         struct srp_indirect_buf *indirect;
745         struct ibmvscsi_host_data *hostdata =
746                 (struct ibmvscsi_host_data *)&cmnd->device->host->hostdata;
747         u16 lun = lun_from_dev(cmnd->device);
748         u8 out_fmt, in_fmt;
749
750         evt_struct = get_event_struct(&hostdata->pool);
751         if (!evt_struct)
752                 return SCSI_MLQUEUE_HOST_BUSY;
753
754         /* Set up the actual SRP IU */
755         srp_cmd = &evt_struct->iu.srp.cmd;
756         memset(srp_cmd, 0x00, SRP_MAX_IU_LEN);
757         srp_cmd->opcode = SRP_CMD;
758         memcpy(srp_cmd->cdb, cmnd->cmnd, sizeof(cmnd->cmnd));
759         srp_cmd->lun = ((u64) lun) << 48;
760
761         if (!map_data_for_srp_cmd(cmnd, evt_struct, srp_cmd, hostdata->dev)) {
762                 sdev_printk(KERN_ERR, cmnd->device, "couldn't convert cmd to srp_cmd\n");
763                 free_event_struct(&hostdata->pool, evt_struct);
764                 return SCSI_MLQUEUE_HOST_BUSY;
765         }
766
767         init_event_struct(evt_struct,
768                           handle_cmd_rsp,
769                           VIOSRP_SRP_FORMAT,
770                           cmnd->timeout_per_command/HZ);
771
772         evt_struct->cmnd = cmnd;
773         evt_struct->cmnd_done = done;
774
775         /* Fix up dma address of the buffer itself */
776         indirect = (struct srp_indirect_buf *) srp_cmd->add_data;
777         out_fmt = srp_cmd->buf_fmt >> 4;
778         in_fmt = srp_cmd->buf_fmt & ((1U << 4) - 1);
779         if ((in_fmt == SRP_DATA_DESC_INDIRECT ||
780              out_fmt == SRP_DATA_DESC_INDIRECT) &&
781             indirect->table_desc.va == 0) {
782                 indirect->table_desc.va = evt_struct->crq.IU_data_ptr +
783                         offsetof(struct srp_cmd, add_data) +
784                         offsetof(struct srp_indirect_buf, desc_list);
785         }
786
787         return ibmvscsi_send_srp_event(evt_struct, hostdata, 0);
788 }
789
790 /* ------------------------------------------------------------
791  * Routines for driver initialization
792  */
793 /**
794  * adapter_info_rsp: - Handle response to MAD adapter info request
795  * @evt_struct: srp_event_struct with the response
796  *
797  * Used as a "done" callback by when sending adapter_info. Gets called
798  * by ibmvscsi_handle_crq()
799 */
800 static void adapter_info_rsp(struct srp_event_struct *evt_struct)
801 {
802         struct ibmvscsi_host_data *hostdata = evt_struct->hostdata;
803         dma_unmap_single(hostdata->dev,
804                          evt_struct->iu.mad.adapter_info.buffer,
805                          evt_struct->iu.mad.adapter_info.common.length,
806                          DMA_BIDIRECTIONAL);
807
808         if (evt_struct->xfer_iu->mad.adapter_info.common.status) {
809                 dev_err(hostdata->dev, "error %d getting adapter info\n",
810                         evt_struct->xfer_iu->mad.adapter_info.common.status);
811         } else {
812                 dev_info(hostdata->dev, "host srp version: %s, "
813                          "host partition %s (%d), OS %d, max io %u\n",
814                          hostdata->madapter_info.srp_version,
815                          hostdata->madapter_info.partition_name,
816                          hostdata->madapter_info.partition_number,
817                          hostdata->madapter_info.os_type,
818                          hostdata->madapter_info.port_max_txu[0]);
819                 
820                 if (hostdata->madapter_info.port_max_txu[0]) 
821                         hostdata->host->max_sectors = 
822                                 hostdata->madapter_info.port_max_txu[0] >> 9;
823                 
824                 if (hostdata->madapter_info.os_type == 3 &&
825                     strcmp(hostdata->madapter_info.srp_version, "1.6a") <= 0) {
826                         dev_err(hostdata->dev, "host (Ver. %s) doesn't support large transfers\n",
827                                 hostdata->madapter_info.srp_version);
828                         dev_err(hostdata->dev, "limiting scatterlists to %d\n",
829                                 MAX_INDIRECT_BUFS);
830                         hostdata->host->sg_tablesize = MAX_INDIRECT_BUFS;
831                 }
832         }
833 }
834
835 /**
836  * send_mad_adapter_info: - Sends the mad adapter info request
837  *      and stores the result so it can be retrieved with
838  *      sysfs.  We COULD consider causing a failure if the
839  *      returned SRP version doesn't match ours.
840  * @hostdata:   ibmvscsi_host_data of host
841  * 
842  * Returns zero if successful.
843 */
844 static void send_mad_adapter_info(struct ibmvscsi_host_data *hostdata)
845 {
846         struct viosrp_adapter_info *req;
847         struct srp_event_struct *evt_struct;
848         unsigned long flags;
849         dma_addr_t addr;
850
851         evt_struct = get_event_struct(&hostdata->pool);
852         if (!evt_struct) {
853                 dev_err(hostdata->dev,
854                         "couldn't allocate an event for ADAPTER_INFO_REQ!\n");
855                 return;
856         }
857
858         init_event_struct(evt_struct,
859                           adapter_info_rsp,
860                           VIOSRP_MAD_FORMAT,
861                           init_timeout * HZ);
862         
863         req = &evt_struct->iu.mad.adapter_info;
864         memset(req, 0x00, sizeof(*req));
865         
866         req->common.type = VIOSRP_ADAPTER_INFO_TYPE;
867         req->common.length = sizeof(hostdata->madapter_info);
868         req->buffer = addr = dma_map_single(hostdata->dev,
869                                             &hostdata->madapter_info,
870                                             sizeof(hostdata->madapter_info),
871                                             DMA_BIDIRECTIONAL);
872
873         if (dma_mapping_error(req->buffer)) {
874                 dev_err(hostdata->dev, "Unable to map request_buffer for adapter_info!\n");
875                 free_event_struct(&hostdata->pool, evt_struct);
876                 return;
877         }
878         
879         spin_lock_irqsave(hostdata->host->host_lock, flags);
880         if (ibmvscsi_send_srp_event(evt_struct, hostdata, init_timeout * 2)) {
881                 dev_err(hostdata->dev, "couldn't send ADAPTER_INFO_REQ!\n");
882                 dma_unmap_single(hostdata->dev,
883                                  addr,
884                                  sizeof(hostdata->madapter_info),
885                                  DMA_BIDIRECTIONAL);
886         }
887         spin_unlock_irqrestore(hostdata->host->host_lock, flags);
888 };
889
890 /**
891  * login_rsp: - Handle response to SRP login request
892  * @evt_struct: srp_event_struct with the response
893  *
894  * Used as a "done" callback by when sending srp_login. Gets called
895  * by ibmvscsi_handle_crq()
896 */
897 static void login_rsp(struct srp_event_struct *evt_struct)
898 {
899         struct ibmvscsi_host_data *hostdata = evt_struct->hostdata;
900         switch (evt_struct->xfer_iu->srp.login_rsp.opcode) {
901         case SRP_LOGIN_RSP:     /* it worked! */
902                 break;
903         case SRP_LOGIN_REJ:     /* refused! */
904                 dev_info(hostdata->dev, "SRP_LOGIN_REJ reason %u\n",
905                          evt_struct->xfer_iu->srp.login_rej.reason);
906                 /* Login failed.  */
907                 atomic_set(&hostdata->request_limit, -1);
908                 return;
909         default:
910                 dev_err(hostdata->dev, "Invalid login response typecode 0x%02x!\n",
911                         evt_struct->xfer_iu->srp.login_rsp.opcode);
912                 /* Login failed.  */
913                 atomic_set(&hostdata->request_limit, -1);
914                 return;
915         }
916
917         dev_info(hostdata->dev, "SRP_LOGIN succeeded\n");
918
919         if (evt_struct->xfer_iu->srp.login_rsp.req_lim_delta < 0)
920                 dev_err(hostdata->dev, "Invalid request_limit.\n");
921
922         /* Now we know what the real request-limit is.
923          * This value is set rather than added to request_limit because
924          * request_limit could have been set to -1 by this client.
925          */
926         atomic_set(&hostdata->request_limit,
927                    evt_struct->xfer_iu->srp.login_rsp.req_lim_delta);
928
929         /* If we had any pending I/Os, kick them */
930         scsi_unblock_requests(hostdata->host);
931
932         send_mad_adapter_info(hostdata);
933         return;
934 }
935
936 /**
937  * send_srp_login: - Sends the srp login
938  * @hostdata:   ibmvscsi_host_data of host
939  * 
940  * Returns zero if successful.
941 */
942 static int send_srp_login(struct ibmvscsi_host_data *hostdata)
943 {
944         int rc;
945         unsigned long flags;
946         struct srp_login_req *login;
947         struct srp_event_struct *evt_struct = get_event_struct(&hostdata->pool);
948         if (!evt_struct) {
949                 dev_err(hostdata->dev, "couldn't allocate an event for login req!\n");
950                 return FAILED;
951         }
952
953         init_event_struct(evt_struct,
954                           login_rsp,
955                           VIOSRP_SRP_FORMAT,
956                           init_timeout * HZ);
957
958         login = &evt_struct->iu.srp.login_req;
959         memset(login, 0x00, sizeof(struct srp_login_req));
960         login->opcode = SRP_LOGIN_REQ;
961         login->req_it_iu_len = sizeof(union srp_iu);
962         login->req_buf_fmt = SRP_BUF_FORMAT_DIRECT | SRP_BUF_FORMAT_INDIRECT;
963         
964         spin_lock_irqsave(hostdata->host->host_lock, flags);
965         /* Start out with a request limit of 1, since this is negotiated in
966          * the login request we are just sending
967          */
968         atomic_set(&hostdata->request_limit, 1);
969
970         rc = ibmvscsi_send_srp_event(evt_struct, hostdata, init_timeout * 2);
971         spin_unlock_irqrestore(hostdata->host->host_lock, flags);
972         dev_info(hostdata->dev, "sent SRP login\n");
973         return rc;
974 };
975
976 /**
977  * sync_completion: Signal that a synchronous command has completed
978  * Note that after returning from this call, the evt_struct is freed.
979  * the caller waiting on this completion shouldn't touch the evt_struct
980  * again.
981  */
982 static void sync_completion(struct srp_event_struct *evt_struct)
983 {
984         /* copy the response back */
985         if (evt_struct->sync_srp)
986                 *evt_struct->sync_srp = *evt_struct->xfer_iu;
987         
988         complete(&evt_struct->comp);
989 }
990
991 /**
992  * ibmvscsi_abort: Abort a command...from scsi host template
993  * send this over to the server and wait synchronously for the response
994  */
995 static int ibmvscsi_eh_abort_handler(struct scsi_cmnd *cmd)
996 {
997         struct ibmvscsi_host_data *hostdata =
998             (struct ibmvscsi_host_data *)cmd->device->host->hostdata;
999         struct srp_tsk_mgmt *tsk_mgmt;
1000         struct srp_event_struct *evt;
1001         struct srp_event_struct *tmp_evt, *found_evt;
1002         union viosrp_iu srp_rsp;
1003         int rsp_rc;
1004         unsigned long flags;
1005         u16 lun = lun_from_dev(cmd->device);
1006
1007         /* First, find this command in our sent list so we can figure
1008          * out the correct tag
1009          */
1010         spin_lock_irqsave(hostdata->host->host_lock, flags);
1011         found_evt = NULL;
1012         list_for_each_entry(tmp_evt, &hostdata->sent, list) {
1013                 if (tmp_evt->cmnd == cmd) {
1014                         found_evt = tmp_evt;
1015                         break;
1016                 }
1017         }
1018
1019         if (!found_evt) {
1020                 spin_unlock_irqrestore(hostdata->host->host_lock, flags);
1021                 return SUCCESS;
1022         }
1023
1024         evt = get_event_struct(&hostdata->pool);
1025         if (evt == NULL) {
1026                 spin_unlock_irqrestore(hostdata->host->host_lock, flags);
1027                 sdev_printk(KERN_ERR, cmd->device, "failed to allocate abort event\n");
1028                 return FAILED;
1029         }
1030         
1031         init_event_struct(evt,
1032                           sync_completion,
1033                           VIOSRP_SRP_FORMAT,
1034                           init_timeout * HZ);
1035
1036         tsk_mgmt = &evt->iu.srp.tsk_mgmt;
1037         
1038         /* Set up an abort SRP command */
1039         memset(tsk_mgmt, 0x00, sizeof(*tsk_mgmt));
1040         tsk_mgmt->opcode = SRP_TSK_MGMT;
1041         tsk_mgmt->lun = ((u64) lun) << 48;
1042         tsk_mgmt->tsk_mgmt_func = SRP_TSK_ABORT_TASK;
1043         tsk_mgmt->task_tag = (u64) found_evt;
1044
1045         sdev_printk(KERN_INFO, cmd->device, "aborting command. lun 0x%lx, tag 0x%lx\n",
1046                     tsk_mgmt->lun, tsk_mgmt->task_tag);
1047
1048         evt->sync_srp = &srp_rsp;
1049         init_completion(&evt->comp);
1050         rsp_rc = ibmvscsi_send_srp_event(evt, hostdata, init_timeout * 2);
1051         spin_unlock_irqrestore(hostdata->host->host_lock, flags);
1052         if (rsp_rc != 0) {
1053                 sdev_printk(KERN_ERR, cmd->device,
1054                             "failed to send abort() event. rc=%d\n", rsp_rc);
1055                 return FAILED;
1056         }
1057
1058         wait_for_completion(&evt->comp);
1059
1060         /* make sure we got a good response */
1061         if (unlikely(srp_rsp.srp.rsp.opcode != SRP_RSP)) {
1062                 if (printk_ratelimit())
1063                         sdev_printk(KERN_WARNING, cmd->device, "abort bad SRP RSP type %d\n",
1064                                     srp_rsp.srp.rsp.opcode);
1065                 return FAILED;
1066         }
1067
1068         if (srp_rsp.srp.rsp.flags & SRP_RSP_FLAG_RSPVALID)
1069                 rsp_rc = *((int *)srp_rsp.srp.rsp.data);
1070         else
1071                 rsp_rc = srp_rsp.srp.rsp.status;
1072
1073         if (rsp_rc) {
1074                 if (printk_ratelimit())
1075                         sdev_printk(KERN_WARNING, cmd->device,
1076                                     "abort code %d for task tag 0x%lx\n",
1077                                     rsp_rc, tsk_mgmt->task_tag);
1078                 return FAILED;
1079         }
1080
1081         /* Because we dropped the spinlock above, it's possible
1082          * The event is no longer in our list.  Make sure it didn't
1083          * complete while we were aborting
1084          */
1085         spin_lock_irqsave(hostdata->host->host_lock, flags);
1086         found_evt = NULL;
1087         list_for_each_entry(tmp_evt, &hostdata->sent, list) {
1088                 if (tmp_evt->cmnd == cmd) {
1089                         found_evt = tmp_evt;
1090                         break;
1091                 }
1092         }
1093
1094         if (found_evt == NULL) {
1095                 spin_unlock_irqrestore(hostdata->host->host_lock, flags);
1096                 sdev_printk(KERN_INFO, cmd->device, "aborted task tag 0x%lx completed\n",
1097                             tsk_mgmt->task_tag);
1098                 return SUCCESS;
1099         }
1100
1101         sdev_printk(KERN_INFO, cmd->device, "successfully aborted task tag 0x%lx\n",
1102                     tsk_mgmt->task_tag);
1103
1104         cmd->result = (DID_ABORT << 16);
1105         list_del(&found_evt->list);
1106         unmap_cmd_data(&found_evt->iu.srp.cmd, found_evt,
1107                        found_evt->hostdata->dev);
1108         free_event_struct(&found_evt->hostdata->pool, found_evt);
1109         spin_unlock_irqrestore(hostdata->host->host_lock, flags);
1110         atomic_inc(&hostdata->request_limit);
1111         return SUCCESS;
1112 }
1113
1114 /**
1115  * ibmvscsi_eh_device_reset_handler: Reset a single LUN...from scsi host 
1116  * template send this over to the server and wait synchronously for the 
1117  * response
1118  */
1119 static int ibmvscsi_eh_device_reset_handler(struct scsi_cmnd *cmd)
1120 {
1121         struct ibmvscsi_host_data *hostdata =
1122             (struct ibmvscsi_host_data *)cmd->device->host->hostdata;
1123
1124         struct srp_tsk_mgmt *tsk_mgmt;
1125         struct srp_event_struct *evt;
1126         struct srp_event_struct *tmp_evt, *pos;
1127         union viosrp_iu srp_rsp;
1128         int rsp_rc;
1129         unsigned long flags;
1130         u16 lun = lun_from_dev(cmd->device);
1131
1132         spin_lock_irqsave(hostdata->host->host_lock, flags);
1133         evt = get_event_struct(&hostdata->pool);
1134         if (evt == NULL) {
1135                 spin_unlock_irqrestore(hostdata->host->host_lock, flags);
1136                 sdev_printk(KERN_ERR, cmd->device, "failed to allocate reset event\n");
1137                 return FAILED;
1138         }
1139         
1140         init_event_struct(evt,
1141                           sync_completion,
1142                           VIOSRP_SRP_FORMAT,
1143                           init_timeout * HZ);
1144
1145         tsk_mgmt = &evt->iu.srp.tsk_mgmt;
1146
1147         /* Set up a lun reset SRP command */
1148         memset(tsk_mgmt, 0x00, sizeof(*tsk_mgmt));
1149         tsk_mgmt->opcode = SRP_TSK_MGMT;
1150         tsk_mgmt->lun = ((u64) lun) << 48;
1151         tsk_mgmt->tsk_mgmt_func = SRP_TSK_LUN_RESET;
1152
1153         sdev_printk(KERN_INFO, cmd->device, "resetting device. lun 0x%lx\n",
1154                     tsk_mgmt->lun);
1155
1156         evt->sync_srp = &srp_rsp;
1157         init_completion(&evt->comp);
1158         rsp_rc = ibmvscsi_send_srp_event(evt, hostdata, init_timeout * 2);
1159         spin_unlock_irqrestore(hostdata->host->host_lock, flags);
1160         if (rsp_rc != 0) {
1161                 sdev_printk(KERN_ERR, cmd->device,
1162                             "failed to send reset event. rc=%d\n", rsp_rc);
1163                 return FAILED;
1164         }
1165
1166         wait_for_completion(&evt->comp);
1167
1168         /* make sure we got a good response */
1169         if (unlikely(srp_rsp.srp.rsp.opcode != SRP_RSP)) {
1170                 if (printk_ratelimit())
1171                         sdev_printk(KERN_WARNING, cmd->device, "reset bad SRP RSP type %d\n",
1172                                     srp_rsp.srp.rsp.opcode);
1173                 return FAILED;
1174         }
1175
1176         if (srp_rsp.srp.rsp.flags & SRP_RSP_FLAG_RSPVALID)
1177                 rsp_rc = *((int *)srp_rsp.srp.rsp.data);
1178         else
1179                 rsp_rc = srp_rsp.srp.rsp.status;
1180
1181         if (rsp_rc) {
1182                 if (printk_ratelimit())
1183                         sdev_printk(KERN_WARNING, cmd->device,
1184                                     "reset code %d for task tag 0x%lx\n",
1185                                     rsp_rc, tsk_mgmt->task_tag);
1186                 return FAILED;
1187         }
1188
1189         /* We need to find all commands for this LUN that have not yet been
1190          * responded to, and fail them with DID_RESET
1191          */
1192         spin_lock_irqsave(hostdata->host->host_lock, flags);
1193         list_for_each_entry_safe(tmp_evt, pos, &hostdata->sent, list) {
1194                 if ((tmp_evt->cmnd) && (tmp_evt->cmnd->device == cmd->device)) {
1195                         if (tmp_evt->cmnd)
1196                                 tmp_evt->cmnd->result = (DID_RESET << 16);
1197                         list_del(&tmp_evt->list);
1198                         unmap_cmd_data(&tmp_evt->iu.srp.cmd, tmp_evt,
1199                                        tmp_evt->hostdata->dev);
1200                         free_event_struct(&tmp_evt->hostdata->pool,
1201                                                    tmp_evt);
1202                         atomic_inc(&hostdata->request_limit);
1203                         if (tmp_evt->cmnd_done)
1204                                 tmp_evt->cmnd_done(tmp_evt->cmnd);
1205                         else if (tmp_evt->done)
1206                                 tmp_evt->done(tmp_evt);
1207                 }
1208         }
1209         spin_unlock_irqrestore(hostdata->host->host_lock, flags);
1210         return SUCCESS;
1211 }
1212
1213 /**
1214  * ibmvscsi_eh_host_reset_handler - Reset the connection to the server
1215  * @cmd:        struct scsi_cmnd having problems
1216 */
1217 static int ibmvscsi_eh_host_reset_handler(struct scsi_cmnd *cmd)
1218 {
1219         unsigned long wait_switch = 0;
1220         struct ibmvscsi_host_data *hostdata =
1221                 (struct ibmvscsi_host_data *)cmd->device->host->hostdata;
1222
1223         dev_err(hostdata->dev, "Resetting connection due to error recovery\n");
1224
1225         ibmvscsi_reset_host(hostdata);
1226
1227         for (wait_switch = jiffies + (init_timeout * HZ);
1228              time_before(jiffies, wait_switch) &&
1229                      atomic_read(&hostdata->request_limit) < 2;) {
1230
1231                 msleep(10);
1232         }
1233
1234         if (atomic_read(&hostdata->request_limit) <= 0)
1235                 return FAILED;
1236
1237         return SUCCESS;
1238 }
1239
1240 /**
1241  * ibmvscsi_handle_crq: - Handles and frees received events in the CRQ
1242  * @crq:        Command/Response queue
1243  * @hostdata:   ibmvscsi_host_data of host
1244  *
1245 */
1246 void ibmvscsi_handle_crq(struct viosrp_crq *crq,
1247                          struct ibmvscsi_host_data *hostdata)
1248 {
1249         long rc;
1250         unsigned long flags;
1251         struct srp_event_struct *evt_struct =
1252             (struct srp_event_struct *)crq->IU_data_ptr;
1253         switch (crq->valid) {
1254         case 0xC0:              /* initialization */
1255                 switch (crq->format) {
1256                 case 0x01:      /* Initialization message */
1257                         dev_info(hostdata->dev, "partner initialized\n");
1258                         /* Send back a response */
1259                         if ((rc = ibmvscsi_send_crq(hostdata,
1260                                                     0xC002000000000000LL, 0)) == 0) {
1261                                 /* Now login */
1262                                 send_srp_login(hostdata);
1263                         } else {
1264                                 dev_err(hostdata->dev, "Unable to send init rsp. rc=%ld\n", rc);
1265                         }
1266
1267                         break;
1268                 case 0x02:      /* Initialization response */
1269                         dev_info(hostdata->dev, "partner initialization complete\n");
1270
1271                         /* Now login */
1272                         send_srp_login(hostdata);
1273                         break;
1274                 default:
1275                         dev_err(hostdata->dev, "unknown crq message type: %d\n", crq->format);
1276                 }
1277                 return;
1278         case 0xFF:      /* Hypervisor telling us the connection is closed */
1279                 scsi_block_requests(hostdata->host);
1280                 atomic_set(&hostdata->request_limit, 0);
1281                 if (crq->format == 0x06) {
1282                         /* We need to re-setup the interpartition connection */
1283                         dev_info(hostdata->dev, "Re-enabling adapter!\n");
1284                         purge_requests(hostdata, DID_REQUEUE);
1285                         if ((ibmvscsi_reenable_crq_queue(&hostdata->queue,
1286                                                         hostdata)) ||
1287                             (ibmvscsi_send_crq(hostdata,
1288                                                0xC001000000000000LL, 0))) {
1289                                         atomic_set(&hostdata->request_limit,
1290                                                    -1);
1291                                         dev_err(hostdata->dev, "error after enable\n");
1292                         }
1293                 } else {
1294                         dev_err(hostdata->dev, "Virtual adapter failed rc %d!\n",
1295                                 crq->format);
1296
1297                         purge_requests(hostdata, DID_ERROR);
1298                         if ((ibmvscsi_reset_crq_queue(&hostdata->queue,
1299                                                         hostdata)) ||
1300                             (ibmvscsi_send_crq(hostdata,
1301                                                0xC001000000000000LL, 0))) {
1302                                         atomic_set(&hostdata->request_limit,
1303                                                    -1);
1304                                         dev_err(hostdata->dev, "error after reset\n");
1305                         }
1306                 }
1307                 scsi_unblock_requests(hostdata->host);
1308                 return;
1309         case 0x80:              /* real payload */
1310                 break;
1311         default:
1312                 dev_err(hostdata->dev, "got an invalid message type 0x%02x\n",
1313                         crq->valid);
1314                 return;
1315         }
1316
1317         /* The only kind of payload CRQs we should get are responses to
1318          * things we send. Make sure this response is to something we
1319          * actually sent
1320          */
1321         if (!valid_event_struct(&hostdata->pool, evt_struct)) {
1322                 dev_err(hostdata->dev, "returned correlation_token 0x%p is invalid!\n",
1323                        (void *)crq->IU_data_ptr);
1324                 return;
1325         }
1326
1327         if (atomic_read(&evt_struct->free)) {
1328                 dev_err(hostdata->dev, "received duplicate correlation_token 0x%p!\n",
1329                         (void *)crq->IU_data_ptr);
1330                 return;
1331         }
1332
1333         if (crq->format == VIOSRP_SRP_FORMAT)
1334                 atomic_add(evt_struct->xfer_iu->srp.rsp.req_lim_delta,
1335                            &hostdata->request_limit);
1336
1337         del_timer(&evt_struct->timer);
1338
1339         if (evt_struct->done)
1340                 evt_struct->done(evt_struct);
1341         else
1342                 dev_err(hostdata->dev, "returned done() is NULL; not running it!\n");
1343
1344         /*
1345          * Lock the host_lock before messing with these structures, since we
1346          * are running in a task context
1347          */
1348         spin_lock_irqsave(evt_struct->hostdata->host->host_lock, flags);
1349         list_del(&evt_struct->list);
1350         free_event_struct(&evt_struct->hostdata->pool, evt_struct);
1351         spin_unlock_irqrestore(evt_struct->hostdata->host->host_lock, flags);
1352 }
1353
1354 /**
1355  * ibmvscsi_get_host_config: Send the command to the server to get host
1356  * configuration data.  The data is opaque to us.
1357  */
1358 static int ibmvscsi_do_host_config(struct ibmvscsi_host_data *hostdata,
1359                                    unsigned char *buffer, int length)
1360 {
1361         struct viosrp_host_config *host_config;
1362         struct srp_event_struct *evt_struct;
1363         unsigned long flags;
1364         dma_addr_t addr;
1365         int rc;
1366
1367         evt_struct = get_event_struct(&hostdata->pool);
1368         if (!evt_struct) {
1369                 dev_err(hostdata->dev, "couldn't allocate event for HOST_CONFIG!\n");
1370                 return -1;
1371         }
1372
1373         init_event_struct(evt_struct,
1374                           sync_completion,
1375                           VIOSRP_MAD_FORMAT,
1376                           init_timeout * HZ);
1377
1378         host_config = &evt_struct->iu.mad.host_config;
1379
1380         /* Set up a lun reset SRP command */
1381         memset(host_config, 0x00, sizeof(*host_config));
1382         host_config->common.type = VIOSRP_HOST_CONFIG_TYPE;
1383         host_config->common.length = length;
1384         host_config->buffer = addr = dma_map_single(hostdata->dev, buffer,
1385                                                     length,
1386                                                     DMA_BIDIRECTIONAL);
1387
1388         if (dma_mapping_error(host_config->buffer)) {
1389                 dev_err(hostdata->dev, "dma_mapping error getting host config\n");
1390                 free_event_struct(&hostdata->pool, evt_struct);
1391                 return -1;
1392         }
1393
1394         init_completion(&evt_struct->comp);
1395         spin_lock_irqsave(hostdata->host->host_lock, flags);
1396         rc = ibmvscsi_send_srp_event(evt_struct, hostdata, init_timeout * 2);
1397         spin_unlock_irqrestore(hostdata->host->host_lock, flags);
1398         if (rc == 0)
1399                 wait_for_completion(&evt_struct->comp);
1400         dma_unmap_single(hostdata->dev, addr, length, DMA_BIDIRECTIONAL);
1401
1402         return rc;
1403 }
1404
1405 /**
1406  * ibmvscsi_slave_configure: Set the "allow_restart" flag for each disk.
1407  * @sdev:       struct scsi_device device to configure
1408  *
1409  * Enable allow_restart for a device if it is a disk.  Adjust the
1410  * queue_depth here also as is required by the documentation for
1411  * struct scsi_host_template.
1412  */
1413 static int ibmvscsi_slave_configure(struct scsi_device *sdev)
1414 {
1415         struct Scsi_Host *shost = sdev->host;
1416         unsigned long lock_flags = 0;
1417
1418         spin_lock_irqsave(shost->host_lock, lock_flags);
1419         if (sdev->type == TYPE_DISK)
1420                 sdev->allow_restart = 1;
1421         scsi_adjust_queue_depth(sdev, 0, shost->cmd_per_lun);
1422         spin_unlock_irqrestore(shost->host_lock, lock_flags);
1423         return 0;
1424 }
1425
1426 /**
1427  * ibmvscsi_change_queue_depth - Change the device's queue depth
1428  * @sdev:       scsi device struct
1429  * @qdepth:     depth to set
1430  *
1431  * Return value:
1432  *      actual depth set
1433  **/
1434 static int ibmvscsi_change_queue_depth(struct scsi_device *sdev, int qdepth)
1435 {
1436         if (qdepth > IBMVSCSI_MAX_CMDS_PER_LUN)
1437                 qdepth = IBMVSCSI_MAX_CMDS_PER_LUN;
1438
1439         scsi_adjust_queue_depth(sdev, 0, qdepth);
1440         return sdev->queue_depth;
1441 }
1442
1443 /* ------------------------------------------------------------
1444  * sysfs attributes
1445  */
1446 static ssize_t show_host_srp_version(struct class_device *class_dev, char *buf)
1447 {
1448         struct Scsi_Host *shost = class_to_shost(class_dev);
1449         struct ibmvscsi_host_data *hostdata =
1450             (struct ibmvscsi_host_data *)shost->hostdata;
1451         int len;
1452
1453         len = snprintf(buf, PAGE_SIZE, "%s\n",
1454                        hostdata->madapter_info.srp_version);
1455         return len;
1456 }
1457
1458 static struct class_device_attribute ibmvscsi_host_srp_version = {
1459         .attr = {
1460                  .name = "srp_version",
1461                  .mode = S_IRUGO,
1462                  },
1463         .show = show_host_srp_version,
1464 };
1465
1466 static ssize_t show_host_partition_name(struct class_device *class_dev,
1467                                         char *buf)
1468 {
1469         struct Scsi_Host *shost = class_to_shost(class_dev);
1470         struct ibmvscsi_host_data *hostdata =
1471             (struct ibmvscsi_host_data *)shost->hostdata;
1472         int len;
1473
1474         len = snprintf(buf, PAGE_SIZE, "%s\n",
1475                        hostdata->madapter_info.partition_name);
1476         return len;
1477 }
1478
1479 static struct class_device_attribute ibmvscsi_host_partition_name = {
1480         .attr = {
1481                  .name = "partition_name",
1482                  .mode = S_IRUGO,
1483                  },
1484         .show = show_host_partition_name,
1485 };
1486
1487 static ssize_t show_host_partition_number(struct class_device *class_dev,
1488                                           char *buf)
1489 {
1490         struct Scsi_Host *shost = class_to_shost(class_dev);
1491         struct ibmvscsi_host_data *hostdata =
1492             (struct ibmvscsi_host_data *)shost->hostdata;
1493         int len;
1494
1495         len = snprintf(buf, PAGE_SIZE, "%d\n",
1496                        hostdata->madapter_info.partition_number);
1497         return len;
1498 }
1499
1500 static struct class_device_attribute ibmvscsi_host_partition_number = {
1501         .attr = {
1502                  .name = "partition_number",
1503                  .mode = S_IRUGO,
1504                  },
1505         .show = show_host_partition_number,
1506 };
1507
1508 static ssize_t show_host_mad_version(struct class_device *class_dev, char *buf)
1509 {
1510         struct Scsi_Host *shost = class_to_shost(class_dev);
1511         struct ibmvscsi_host_data *hostdata =
1512             (struct ibmvscsi_host_data *)shost->hostdata;
1513         int len;
1514
1515         len = snprintf(buf, PAGE_SIZE, "%d\n",
1516                        hostdata->madapter_info.mad_version);
1517         return len;
1518 }
1519
1520 static struct class_device_attribute ibmvscsi_host_mad_version = {
1521         .attr = {
1522                  .name = "mad_version",
1523                  .mode = S_IRUGO,
1524                  },
1525         .show = show_host_mad_version,
1526 };
1527
1528 static ssize_t show_host_os_type(struct class_device *class_dev, char *buf)
1529 {
1530         struct Scsi_Host *shost = class_to_shost(class_dev);
1531         struct ibmvscsi_host_data *hostdata =
1532             (struct ibmvscsi_host_data *)shost->hostdata;
1533         int len;
1534
1535         len = snprintf(buf, PAGE_SIZE, "%d\n", hostdata->madapter_info.os_type);
1536         return len;
1537 }
1538
1539 static struct class_device_attribute ibmvscsi_host_os_type = {
1540         .attr = {
1541                  .name = "os_type",
1542                  .mode = S_IRUGO,
1543                  },
1544         .show = show_host_os_type,
1545 };
1546
1547 static ssize_t show_host_config(struct class_device *class_dev, char *buf)
1548 {
1549         struct Scsi_Host *shost = class_to_shost(class_dev);
1550         struct ibmvscsi_host_data *hostdata =
1551             (struct ibmvscsi_host_data *)shost->hostdata;
1552
1553         /* returns null-terminated host config data */
1554         if (ibmvscsi_do_host_config(hostdata, buf, PAGE_SIZE) == 0)
1555                 return strlen(buf);
1556         else
1557                 return 0;
1558 }
1559
1560 static struct class_device_attribute ibmvscsi_host_config = {
1561         .attr = {
1562                  .name = "config",
1563                  .mode = S_IRUGO,
1564                  },
1565         .show = show_host_config,
1566 };
1567
1568 static struct class_device_attribute *ibmvscsi_attrs[] = {
1569         &ibmvscsi_host_srp_version,
1570         &ibmvscsi_host_partition_name,
1571         &ibmvscsi_host_partition_number,
1572         &ibmvscsi_host_mad_version,
1573         &ibmvscsi_host_os_type,
1574         &ibmvscsi_host_config,
1575         NULL
1576 };
1577
1578 /* ------------------------------------------------------------
1579  * SCSI driver registration
1580  */
1581 static struct scsi_host_template driver_template = {
1582         .module = THIS_MODULE,
1583         .name = "IBM POWER Virtual SCSI Adapter " IBMVSCSI_VERSION,
1584         .proc_name = "ibmvscsi",
1585         .queuecommand = ibmvscsi_queuecommand,
1586         .eh_abort_handler = ibmvscsi_eh_abort_handler,
1587         .eh_device_reset_handler = ibmvscsi_eh_device_reset_handler,
1588         .eh_host_reset_handler = ibmvscsi_eh_host_reset_handler,
1589         .slave_configure = ibmvscsi_slave_configure,
1590         .change_queue_depth = ibmvscsi_change_queue_depth,
1591         .cmd_per_lun = 16,
1592         .can_queue = IBMVSCSI_MAX_REQUESTS_DEFAULT,
1593         .this_id = -1,
1594         .sg_tablesize = SG_ALL,
1595         .use_clustering = ENABLE_CLUSTERING,
1596         .shost_attrs = ibmvscsi_attrs,
1597 };
1598
1599 /**
1600  * Called by bus code for each adapter
1601  */
1602 static int ibmvscsi_probe(struct vio_dev *vdev, const struct vio_device_id *id)
1603 {
1604         struct ibmvscsi_host_data *hostdata;
1605         struct Scsi_Host *host;
1606         struct device *dev = &vdev->dev;
1607         unsigned long wait_switch = 0;
1608         int rc;
1609
1610         vdev->dev.driver_data = NULL;
1611
1612         driver_template.can_queue = max_requests;
1613         host = scsi_host_alloc(&driver_template, sizeof(*hostdata));
1614         if (!host) {
1615                 dev_err(&vdev->dev, "couldn't allocate host data\n");
1616                 goto scsi_host_alloc_failed;
1617         }
1618
1619         hostdata = (struct ibmvscsi_host_data *)host->hostdata;
1620         memset(hostdata, 0x00, sizeof(*hostdata));
1621         INIT_LIST_HEAD(&hostdata->sent);
1622         hostdata->host = host;
1623         hostdata->dev = dev;
1624         atomic_set(&hostdata->request_limit, -1);
1625         hostdata->host->max_sectors = 32 * 8; /* default max I/O 32 pages */
1626
1627         rc = ibmvscsi_init_crq_queue(&hostdata->queue, hostdata, max_requests);
1628         if (rc != 0 && rc != H_RESOURCE) {
1629                 dev_err(&vdev->dev, "couldn't initialize crq. rc=%d\n", rc);
1630                 goto init_crq_failed;
1631         }
1632         if (initialize_event_pool(&hostdata->pool, max_requests, hostdata) != 0) {
1633                 dev_err(&vdev->dev, "couldn't initialize event pool\n");
1634                 goto init_pool_failed;
1635         }
1636
1637         host->max_lun = 8;
1638         host->max_id = max_id;
1639         host->max_channel = max_channel;
1640
1641         if (scsi_add_host(hostdata->host, hostdata->dev))
1642                 goto add_host_failed;
1643
1644         /* Try to send an initialization message.  Note that this is allowed
1645          * to fail if the other end is not acive.  In that case we don't
1646          * want to scan
1647          */
1648         if (ibmvscsi_send_crq(hostdata, 0xC001000000000000LL, 0) == 0
1649             || rc == H_RESOURCE) {
1650                 /*
1651                  * Wait around max init_timeout secs for the adapter to finish
1652                  * initializing. When we are done initializing, we will have a
1653                  * valid request_limit.  We don't want Linux scanning before
1654                  * we are ready.
1655                  */
1656                 for (wait_switch = jiffies + (init_timeout * HZ);
1657                      time_before(jiffies, wait_switch) &&
1658                      atomic_read(&hostdata->request_limit) < 2;) {
1659
1660                         msleep(10);
1661                 }
1662
1663                 /* if we now have a valid request_limit, initiate a scan */
1664                 if (atomic_read(&hostdata->request_limit) > 0)
1665                         scsi_scan_host(host);
1666         }
1667
1668         vdev->dev.driver_data = hostdata;
1669         return 0;
1670
1671       add_host_failed:
1672         release_event_pool(&hostdata->pool, hostdata);
1673       init_pool_failed:
1674         ibmvscsi_release_crq_queue(&hostdata->queue, hostdata, max_requests);
1675       init_crq_failed:
1676         scsi_host_put(host);
1677       scsi_host_alloc_failed:
1678         return -1;
1679 }
1680
1681 static int ibmvscsi_remove(struct vio_dev *vdev)
1682 {
1683         struct ibmvscsi_host_data *hostdata = vdev->dev.driver_data;
1684         release_event_pool(&hostdata->pool, hostdata);
1685         ibmvscsi_release_crq_queue(&hostdata->queue, hostdata,
1686                                    max_requests);
1687         
1688         scsi_remove_host(hostdata->host);
1689         scsi_host_put(hostdata->host);
1690
1691         return 0;
1692 }
1693
1694 /**
1695  * ibmvscsi_device_table: Used by vio.c to match devices in the device tree we 
1696  * support.
1697  */
1698 static struct vio_device_id ibmvscsi_device_table[] __devinitdata = {
1699         {"vscsi", "IBM,v-scsi"},
1700         { "", "" }
1701 };
1702 MODULE_DEVICE_TABLE(vio, ibmvscsi_device_table);
1703
1704 static struct vio_driver ibmvscsi_driver = {
1705         .id_table = ibmvscsi_device_table,
1706         .probe = ibmvscsi_probe,
1707         .remove = ibmvscsi_remove,
1708         .driver = {
1709                 .name = "ibmvscsi",
1710                 .owner = THIS_MODULE,
1711         }
1712 };
1713
1714 int __init ibmvscsi_module_init(void)
1715 {
1716         return vio_register_driver(&ibmvscsi_driver);
1717 }
1718
1719 void __exit ibmvscsi_module_exit(void)
1720 {
1721         vio_unregister_driver(&ibmvscsi_driver);
1722 }
1723
1724 module_init(ibmvscsi_module_init);
1725 module_exit(ibmvscsi_module_exit);