cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

imm.c (30272B)


      1// SPDX-License-Identifier: GPL-2.0-only
      2/* imm.c   --  low level driver for the IOMEGA MatchMaker
      3 * parallel port SCSI host adapter.
      4 * 
      5 * (The IMM is the embedded controller in the ZIP Plus drive.)
      6 * 
      7 * My unofficial company acronym list is 21 pages long:
      8 *      FLA:    Four letter acronym with built in facility for
      9 *              future expansion to five letters.
     10 */
     11
     12#include <linux/init.h>
     13#include <linux/kernel.h>
     14#include <linux/module.h>
     15#include <linux/blkdev.h>
     16#include <linux/parport.h>
     17#include <linux/workqueue.h>
     18#include <linux/delay.h>
     19#include <linux/slab.h>
     20#include <asm/io.h>
     21
     22#include <scsi/scsi.h>
     23#include <scsi/scsi_cmnd.h>
     24#include <scsi/scsi_device.h>
     25#include <scsi/scsi_host.h>
     26
     27/* The following #define is to avoid a clash with hosts.c */
     28#define IMM_PROBE_SPP   0x0001
     29#define IMM_PROBE_PS2   0x0002
     30#define IMM_PROBE_ECR   0x0010
     31#define IMM_PROBE_EPP17 0x0100
     32#define IMM_PROBE_EPP19 0x0200
     33
     34
     35typedef struct {
     36	struct pardevice *dev;	/* Parport device entry         */
     37	int base;		/* Actual port address          */
     38	int base_hi;		/* Hi Base address for ECP-ISA chipset */
     39	int mode;		/* Transfer mode                */
     40	struct scsi_cmnd *cur_cmd;	/* Current queued command       */
     41	struct delayed_work imm_tq;	/* Polling interrupt stuff       */
     42	unsigned long jstart;	/* Jiffies at start             */
     43	unsigned failed:1;	/* Failure flag                 */
     44	unsigned dp:1;		/* Data phase present           */
     45	unsigned rd:1;		/* Read data in data phase      */
     46	unsigned wanted:1;	/* Parport sharing busy flag    */
     47	unsigned int dev_no;	/* Device number		*/
     48	wait_queue_head_t *waiting;
     49	struct Scsi_Host *host;
     50	struct list_head list;
     51} imm_struct;
     52
     53static void imm_reset_pulse(unsigned int base);
     54static int device_check(imm_struct *dev);
     55
     56#include "imm.h"
     57
     58static inline imm_struct *imm_dev(struct Scsi_Host *host)
     59{
     60	return *(imm_struct **)&host->hostdata;
     61}
     62
     63static DEFINE_SPINLOCK(arbitration_lock);
     64
     65static void got_it(imm_struct *dev)
     66{
     67	dev->base = dev->dev->port->base;
     68	if (dev->cur_cmd)
     69		imm_scsi_pointer(dev->cur_cmd)->phase = 1;
     70	else
     71		wake_up(dev->waiting);
     72}
     73
     74static void imm_wakeup(void *ref)
     75{
     76	imm_struct *dev = (imm_struct *) ref;
     77	unsigned long flags;
     78
     79	spin_lock_irqsave(&arbitration_lock, flags);
     80	if (dev->wanted) {
     81		if (parport_claim(dev->dev) == 0) {
     82			got_it(dev);
     83			dev->wanted = 0;
     84		}
     85	}
     86	spin_unlock_irqrestore(&arbitration_lock, flags);
     87}
     88
     89static int imm_pb_claim(imm_struct *dev)
     90{
     91	unsigned long flags;
     92	int res = 1;
     93	spin_lock_irqsave(&arbitration_lock, flags);
     94	if (parport_claim(dev->dev) == 0) {
     95		got_it(dev);
     96		res = 0;
     97	}
     98	dev->wanted = res;
     99	spin_unlock_irqrestore(&arbitration_lock, flags);
    100	return res;
    101}
    102
    103static void imm_pb_dismiss(imm_struct *dev)
    104{
    105	unsigned long flags;
    106	int wanted;
    107	spin_lock_irqsave(&arbitration_lock, flags);
    108	wanted = dev->wanted;
    109	dev->wanted = 0;
    110	spin_unlock_irqrestore(&arbitration_lock, flags);
    111	if (!wanted)
    112		parport_release(dev->dev);
    113}
    114
    115static inline void imm_pb_release(imm_struct *dev)
    116{
    117	parport_release(dev->dev);
    118}
    119
    120/* This is to give the imm driver a way to modify the timings (and other
    121 * parameters) by writing to the /proc/scsi/imm/0 file.
    122 * Very simple method really... (Too simple, no error checking :( )
    123 * Reason: Kernel hackers HATE having to unload and reload modules for
    124 * testing...
    125 * Also gives a method to use a script to obtain optimum timings (TODO)
    126 */
    127static int imm_write_info(struct Scsi_Host *host, char *buffer, int length)
    128{
    129	imm_struct *dev = imm_dev(host);
    130
    131	if ((length > 5) && (strncmp(buffer, "mode=", 5) == 0)) {
    132		dev->mode = simple_strtoul(buffer + 5, NULL, 0);
    133		return length;
    134	}
    135	printk("imm /proc: invalid variable\n");
    136	return -EINVAL;
    137}
    138
    139static int imm_show_info(struct seq_file *m, struct Scsi_Host *host)
    140{
    141	imm_struct *dev = imm_dev(host);
    142
    143	seq_printf(m, "Version : %s\n", IMM_VERSION);
    144	seq_printf(m, "Parport : %s\n", dev->dev->port->name);
    145	seq_printf(m, "Mode    : %s\n", IMM_MODE_STRING[dev->mode]);
    146	return 0;
    147}
    148
    149#if IMM_DEBUG > 0
    150#define imm_fail(x,y) printk("imm: imm_fail(%i) from %s at line %d\n",\
    151	   y, __func__, __LINE__); imm_fail_func(x,y);
    152static inline void
    153imm_fail_func(imm_struct *dev, int error_code)
    154#else
    155static inline void
    156imm_fail(imm_struct *dev, int error_code)
    157#endif
    158{
    159	/* If we fail a device then we trash status / message bytes */
    160	if (dev->cur_cmd) {
    161		dev->cur_cmd->result = error_code << 16;
    162		dev->failed = 1;
    163	}
    164}
    165
    166/*
    167 * Wait for the high bit to be set.
    168 * 
    169 * In principle, this could be tied to an interrupt, but the adapter
    170 * doesn't appear to be designed to support interrupts.  We spin on
    171 * the 0x80 ready bit. 
    172 */
    173static unsigned char imm_wait(imm_struct *dev)
    174{
    175	int k;
    176	unsigned short ppb = dev->base;
    177	unsigned char r;
    178
    179	w_ctr(ppb, 0x0c);
    180
    181	k = IMM_SPIN_TMO;
    182	do {
    183		r = r_str(ppb);
    184		k--;
    185		udelay(1);
    186	}
    187	while (!(r & 0x80) && (k));
    188
    189	/*
    190	 * STR register (LPT base+1) to SCSI mapping:
    191	 *
    192	 * STR      imm     imm
    193	 * ===================================
    194	 * 0x80     S_REQ   S_REQ
    195	 * 0x40     !S_BSY  (????)
    196	 * 0x20     !S_CD   !S_CD
    197	 * 0x10     !S_IO   !S_IO
    198	 * 0x08     (????)  !S_BSY
    199	 *
    200	 * imm      imm     meaning
    201	 * ==================================
    202	 * 0xf0     0xb8    Bit mask
    203	 * 0xc0     0x88    ZIP wants more data
    204	 * 0xd0     0x98    ZIP wants to send more data
    205	 * 0xe0     0xa8    ZIP is expecting SCSI command data
    206	 * 0xf0     0xb8    end of transfer, ZIP is sending status
    207	 */
    208	w_ctr(ppb, 0x04);
    209	if (k)
    210		return (r & 0xb8);
    211
    212	/* Counter expired - Time out occurred */
    213	imm_fail(dev, DID_TIME_OUT);
    214	printk("imm timeout in imm_wait\n");
    215	return 0;		/* command timed out */
    216}
    217
    218static int imm_negotiate(imm_struct * tmp)
    219{
    220	/*
    221	 * The following is supposedly the IEEE 1284-1994 negotiate
    222	 * sequence. I have yet to obtain a copy of the above standard
    223	 * so this is a bit of a guess...
    224	 *
    225	 * A fair chunk of this is based on the Linux parport implementation
    226	 * of IEEE 1284.
    227	 *
    228	 * Return 0 if data available
    229	 *        1 if no data available
    230	 */
    231
    232	unsigned short base = tmp->base;
    233	unsigned char a, mode;
    234
    235	switch (tmp->mode) {
    236	case IMM_NIBBLE:
    237		mode = 0x00;
    238		break;
    239	case IMM_PS2:
    240		mode = 0x01;
    241		break;
    242	default:
    243		return 0;
    244	}
    245
    246	w_ctr(base, 0x04);
    247	udelay(5);
    248	w_dtr(base, mode);
    249	udelay(100);
    250	w_ctr(base, 0x06);
    251	udelay(5);
    252	a = (r_str(base) & 0x20) ? 0 : 1;
    253	udelay(5);
    254	w_ctr(base, 0x07);
    255	udelay(5);
    256	w_ctr(base, 0x06);
    257
    258	if (a) {
    259		printk
    260		    ("IMM: IEEE1284 negotiate indicates no data available.\n");
    261		imm_fail(tmp, DID_ERROR);
    262	}
    263	return a;
    264}
    265
    266/* 
    267 * Clear EPP timeout bit. 
    268 */
    269static inline void epp_reset(unsigned short ppb)
    270{
    271	int i;
    272
    273	i = r_str(ppb);
    274	w_str(ppb, i);
    275	w_str(ppb, i & 0xfe);
    276}
    277
    278/* 
    279 * Wait for empty ECP fifo (if we are in ECP fifo mode only)
    280 */
    281static inline void ecp_sync(imm_struct *dev)
    282{
    283	int i, ppb_hi = dev->base_hi;
    284
    285	if (ppb_hi == 0)
    286		return;
    287
    288	if ((r_ecr(ppb_hi) & 0xe0) == 0x60) {	/* mode 011 == ECP fifo mode */
    289		for (i = 0; i < 100; i++) {
    290			if (r_ecr(ppb_hi) & 0x01)
    291				return;
    292			udelay(5);
    293		}
    294		printk("imm: ECP sync failed as data still present in FIFO.\n");
    295	}
    296}
    297
    298static int imm_byte_out(unsigned short base, const char *buffer, int len)
    299{
    300	int i;
    301
    302	w_ctr(base, 0x4);	/* apparently a sane mode */
    303	for (i = len >> 1; i; i--) {
    304		w_dtr(base, *buffer++);
    305		w_ctr(base, 0x5);	/* Drop STROBE low */
    306		w_dtr(base, *buffer++);
    307		w_ctr(base, 0x0);	/* STROBE high + INIT low */
    308	}
    309	w_ctr(base, 0x4);	/* apparently a sane mode */
    310	return 1;		/* All went well - we hope! */
    311}
    312
    313static int imm_nibble_in(unsigned short base, char *buffer, int len)
    314{
    315	unsigned char l;
    316	int i;
    317
    318	/*
    319	 * The following is based on documented timing signals
    320	 */
    321	w_ctr(base, 0x4);
    322	for (i = len; i; i--) {
    323		w_ctr(base, 0x6);
    324		l = (r_str(base) & 0xf0) >> 4;
    325		w_ctr(base, 0x5);
    326		*buffer++ = (r_str(base) & 0xf0) | l;
    327		w_ctr(base, 0x4);
    328	}
    329	return 1;		/* All went well - we hope! */
    330}
    331
    332static int imm_byte_in(unsigned short base, char *buffer, int len)
    333{
    334	int i;
    335
    336	/*
    337	 * The following is based on documented timing signals
    338	 */
    339	w_ctr(base, 0x4);
    340	for (i = len; i; i--) {
    341		w_ctr(base, 0x26);
    342		*buffer++ = r_dtr(base);
    343		w_ctr(base, 0x25);
    344	}
    345	return 1;		/* All went well - we hope! */
    346}
    347
    348static int imm_out(imm_struct *dev, char *buffer, int len)
    349{
    350	unsigned short ppb = dev->base;
    351	int r = imm_wait(dev);
    352
    353	/*
    354	 * Make sure that:
    355	 * a) the SCSI bus is BUSY (device still listening)
    356	 * b) the device is listening
    357	 */
    358	if ((r & 0x18) != 0x08) {
    359		imm_fail(dev, DID_ERROR);
    360		printk("IMM: returned SCSI status %2x\n", r);
    361		return 0;
    362	}
    363	switch (dev->mode) {
    364	case IMM_EPP_32:
    365	case IMM_EPP_16:
    366	case IMM_EPP_8:
    367		epp_reset(ppb);
    368		w_ctr(ppb, 0x4);
    369#ifdef CONFIG_SCSI_IZIP_EPP16
    370		if (!(((long) buffer | len) & 0x01))
    371			outsw(ppb + 4, buffer, len >> 1);
    372#else
    373		if (!(((long) buffer | len) & 0x03))
    374			outsl(ppb + 4, buffer, len >> 2);
    375#endif
    376		else
    377			outsb(ppb + 4, buffer, len);
    378		w_ctr(ppb, 0xc);
    379		r = !(r_str(ppb) & 0x01);
    380		w_ctr(ppb, 0xc);
    381		ecp_sync(dev);
    382		break;
    383
    384	case IMM_NIBBLE:
    385	case IMM_PS2:
    386		/* 8 bit output, with a loop */
    387		r = imm_byte_out(ppb, buffer, len);
    388		break;
    389
    390	default:
    391		printk("IMM: bug in imm_out()\n");
    392		r = 0;
    393	}
    394	return r;
    395}
    396
    397static int imm_in(imm_struct *dev, char *buffer, int len)
    398{
    399	unsigned short ppb = dev->base;
    400	int r = imm_wait(dev);
    401
    402	/*
    403	 * Make sure that:
    404	 * a) the SCSI bus is BUSY (device still listening)
    405	 * b) the device is sending data
    406	 */
    407	if ((r & 0x18) != 0x18) {
    408		imm_fail(dev, DID_ERROR);
    409		return 0;
    410	}
    411	switch (dev->mode) {
    412	case IMM_NIBBLE:
    413		/* 4 bit input, with a loop */
    414		r = imm_nibble_in(ppb, buffer, len);
    415		w_ctr(ppb, 0xc);
    416		break;
    417
    418	case IMM_PS2:
    419		/* 8 bit input, with a loop */
    420		r = imm_byte_in(ppb, buffer, len);
    421		w_ctr(ppb, 0xc);
    422		break;
    423
    424	case IMM_EPP_32:
    425	case IMM_EPP_16:
    426	case IMM_EPP_8:
    427		epp_reset(ppb);
    428		w_ctr(ppb, 0x24);
    429#ifdef CONFIG_SCSI_IZIP_EPP16
    430		if (!(((long) buffer | len) & 0x01))
    431			insw(ppb + 4, buffer, len >> 1);
    432#else
    433		if (!(((long) buffer | len) & 0x03))
    434			insl(ppb + 4, buffer, len >> 2);
    435#endif
    436		else
    437			insb(ppb + 4, buffer, len);
    438		w_ctr(ppb, 0x2c);
    439		r = !(r_str(ppb) & 0x01);
    440		w_ctr(ppb, 0x2c);
    441		ecp_sync(dev);
    442		break;
    443
    444	default:
    445		printk("IMM: bug in imm_ins()\n");
    446		r = 0;
    447		break;
    448	}
    449	return r;
    450}
    451
    452static int imm_cpp(unsigned short ppb, unsigned char b)
    453{
    454	/*
    455	 * Comments on udelay values refer to the
    456	 * Command Packet Protocol (CPP) timing diagram.
    457	 */
    458
    459	unsigned char s1, s2, s3;
    460	w_ctr(ppb, 0x0c);
    461	udelay(2);		/* 1 usec - infinite */
    462	w_dtr(ppb, 0xaa);
    463	udelay(10);		/* 7 usec - infinite */
    464	w_dtr(ppb, 0x55);
    465	udelay(10);		/* 7 usec - infinite */
    466	w_dtr(ppb, 0x00);
    467	udelay(10);		/* 7 usec - infinite */
    468	w_dtr(ppb, 0xff);
    469	udelay(10);		/* 7 usec - infinite */
    470	s1 = r_str(ppb) & 0xb8;
    471	w_dtr(ppb, 0x87);
    472	udelay(10);		/* 7 usec - infinite */
    473	s2 = r_str(ppb) & 0xb8;
    474	w_dtr(ppb, 0x78);
    475	udelay(10);		/* 7 usec - infinite */
    476	s3 = r_str(ppb) & 0x38;
    477	/*
    478	 * Values for b are:
    479	 * 0000 00aa    Assign address aa to current device
    480	 * 0010 00aa    Select device aa in EPP Winbond mode
    481	 * 0010 10aa    Select device aa in EPP mode
    482	 * 0011 xxxx    Deselect all devices
    483	 * 0110 00aa    Test device aa
    484	 * 1101 00aa    Select device aa in ECP mode
    485	 * 1110 00aa    Select device aa in Compatible mode
    486	 */
    487	w_dtr(ppb, b);
    488	udelay(2);		/* 1 usec - infinite */
    489	w_ctr(ppb, 0x0c);
    490	udelay(10);		/* 7 usec - infinite */
    491	w_ctr(ppb, 0x0d);
    492	udelay(2);		/* 1 usec - infinite */
    493	w_ctr(ppb, 0x0c);
    494	udelay(10);		/* 7 usec - infinite */
    495	w_dtr(ppb, 0xff);
    496	udelay(10);		/* 7 usec - infinite */
    497
    498	/*
    499	 * The following table is electrical pin values.
    500	 * (BSY is inverted at the CTR register)
    501	 *
    502	 *       BSY  ACK  POut SEL  Fault
    503	 * S1    0    X    1    1    1
    504	 * S2    1    X    0    1    1
    505	 * S3    L    X    1    1    S
    506	 *
    507	 * L => Last device in chain
    508	 * S => Selected
    509	 *
    510	 * Observered values for S1,S2,S3 are:
    511	 * Disconnect => f8/58/78
    512	 * Connect    => f8/58/70
    513	 */
    514	if ((s1 == 0xb8) && (s2 == 0x18) && (s3 == 0x30))
    515		return 1;	/* Connected */
    516	if ((s1 == 0xb8) && (s2 == 0x18) && (s3 == 0x38))
    517		return 0;	/* Disconnected */
    518
    519	return -1;		/* No device present */
    520}
    521
    522static inline int imm_connect(imm_struct *dev, int flag)
    523{
    524	unsigned short ppb = dev->base;
    525
    526	imm_cpp(ppb, 0xe0);	/* Select device 0 in compatible mode */
    527	imm_cpp(ppb, 0x30);	/* Disconnect all devices */
    528
    529	if ((dev->mode == IMM_EPP_8) ||
    530	    (dev->mode == IMM_EPP_16) ||
    531	    (dev->mode == IMM_EPP_32))
    532		return imm_cpp(ppb, 0x28);	/* Select device 0 in EPP mode */
    533	return imm_cpp(ppb, 0xe0);	/* Select device 0 in compatible mode */
    534}
    535
    536static void imm_disconnect(imm_struct *dev)
    537{
    538	imm_cpp(dev->base, 0x30);	/* Disconnect all devices */
    539}
    540
    541static int imm_select(imm_struct *dev, int target)
    542{
    543	int k;
    544	unsigned short ppb = dev->base;
    545
    546	/*
    547	 * Firstly we want to make sure there is nothing
    548	 * holding onto the SCSI bus.
    549	 */
    550	w_ctr(ppb, 0xc);
    551
    552	k = IMM_SELECT_TMO;
    553	do {
    554		k--;
    555	} while ((r_str(ppb) & 0x08) && (k));
    556
    557	if (!k)
    558		return 0;
    559
    560	/*
    561	 * Now assert the SCSI ID (HOST and TARGET) on the data bus
    562	 */
    563	w_ctr(ppb, 0x4);
    564	w_dtr(ppb, 0x80 | (1 << target));
    565	udelay(1);
    566
    567	/*
    568	 * Deassert SELIN first followed by STROBE
    569	 */
    570	w_ctr(ppb, 0xc);
    571	w_ctr(ppb, 0xd);
    572
    573	/*
    574	 * ACK should drop low while SELIN is deasserted.
    575	 * FAULT should drop low when the SCSI device latches the bus.
    576	 */
    577	k = IMM_SELECT_TMO;
    578	do {
    579		k--;
    580	}
    581	while (!(r_str(ppb) & 0x08) && (k));
    582
    583	/*
    584	 * Place the interface back into a sane state (status mode)
    585	 */
    586	w_ctr(ppb, 0xc);
    587	return (k) ? 1 : 0;
    588}
    589
    590static int imm_init(imm_struct *dev)
    591{
    592	if (imm_connect(dev, 0) != 1)
    593		return -EIO;
    594	imm_reset_pulse(dev->base);
    595	mdelay(1);	/* Delay to allow devices to settle */
    596	imm_disconnect(dev);
    597	mdelay(1);	/* Another delay to allow devices to settle */
    598	return device_check(dev);
    599}
    600
    601static inline int imm_send_command(struct scsi_cmnd *cmd)
    602{
    603	imm_struct *dev = imm_dev(cmd->device->host);
    604	int k;
    605
    606	/* NOTE: IMM uses byte pairs */
    607	for (k = 0; k < cmd->cmd_len; k += 2)
    608		if (!imm_out(dev, &cmd->cmnd[k], 2))
    609			return 0;
    610	return 1;
    611}
    612
    613/*
    614 * The bulk flag enables some optimisations in the data transfer loops,
    615 * it should be true for any command that transfers data in integral
    616 * numbers of sectors.
    617 * 
    618 * The driver appears to remain stable if we speed up the parallel port
    619 * i/o in this function, but not elsewhere.
    620 */
    621static int imm_completion(struct scsi_cmnd *const cmd)
    622{
    623	/* Return codes:
    624	 * -1     Error
    625	 *  0     Told to schedule
    626	 *  1     Finished data transfer
    627	 */
    628	struct scsi_pointer *scsi_pointer = imm_scsi_pointer(cmd);
    629	imm_struct *dev = imm_dev(cmd->device->host);
    630	unsigned short ppb = dev->base;
    631	unsigned long start_jiffies = jiffies;
    632
    633	unsigned char r, v;
    634	int fast, bulk, status;
    635
    636	v = cmd->cmnd[0];
    637	bulk = ((v == READ_6) ||
    638		(v == READ_10) || (v == WRITE_6) || (v == WRITE_10));
    639
    640	/*
    641	 * We only get here if the drive is ready to comunicate,
    642	 * hence no need for a full imm_wait.
    643	 */
    644	w_ctr(ppb, 0x0c);
    645	r = (r_str(ppb) & 0xb8);
    646
    647	/*
    648	 * while (device is not ready to send status byte)
    649	 *     loop;
    650	 */
    651	while (r != (unsigned char) 0xb8) {
    652		/*
    653		 * If we have been running for more than a full timer tick
    654		 * then take a rest.
    655		 */
    656		if (time_after(jiffies, start_jiffies + 1))
    657			return 0;
    658
    659		/*
    660		 * FAIL if:
    661		 * a) Drive status is screwy (!ready && !present)
    662		 * b) Drive is requesting/sending more data than expected
    663		 */
    664		if ((r & 0x88) != 0x88 || scsi_pointer->this_residual <= 0) {
    665			imm_fail(dev, DID_ERROR);
    666			return -1;	/* ERROR_RETURN */
    667		}
    668		/* determine if we should use burst I/O */
    669		if (dev->rd == 0) {
    670			fast = bulk && scsi_pointer->this_residual >=
    671				IMM_BURST_SIZE ? IMM_BURST_SIZE : 2;
    672			status = imm_out(dev, scsi_pointer->ptr, fast);
    673		} else {
    674			fast = bulk && scsi_pointer->this_residual >=
    675				IMM_BURST_SIZE ? IMM_BURST_SIZE : 1;
    676			status = imm_in(dev, scsi_pointer->ptr, fast);
    677		}
    678
    679		scsi_pointer->ptr += fast;
    680		scsi_pointer->this_residual -= fast;
    681
    682		if (!status) {
    683			imm_fail(dev, DID_BUS_BUSY);
    684			return -1;	/* ERROR_RETURN */
    685		}
    686		if (scsi_pointer->buffer && !scsi_pointer->this_residual) {
    687			/* if scatter/gather, advance to the next segment */
    688			if (scsi_pointer->buffers_residual--) {
    689				scsi_pointer->buffer =
    690					sg_next(scsi_pointer->buffer);
    691				scsi_pointer->this_residual =
    692				    scsi_pointer->buffer->length;
    693				scsi_pointer->ptr = sg_virt(scsi_pointer->buffer);
    694
    695				/*
    696				 * Make sure that we transfer even number of bytes
    697				 * otherwise it makes imm_byte_out() messy.
    698				 */
    699				if (scsi_pointer->this_residual & 0x01)
    700					scsi_pointer->this_residual++;
    701			}
    702		}
    703		/* Now check to see if the drive is ready to comunicate */
    704		w_ctr(ppb, 0x0c);
    705		r = (r_str(ppb) & 0xb8);
    706
    707		/* If not, drop back down to the scheduler and wait a timer tick */
    708		if (!(r & 0x80))
    709			return 0;
    710	}
    711	return 1;		/* FINISH_RETURN */
    712}
    713
    714/*
    715 * Since the IMM itself doesn't generate interrupts, we use
    716 * the scheduler's task queue to generate a stream of call-backs and
    717 * complete the request when the drive is ready.
    718 */
    719static void imm_interrupt(struct work_struct *work)
    720{
    721	imm_struct *dev = container_of(work, imm_struct, imm_tq.work);
    722	struct scsi_cmnd *cmd = dev->cur_cmd;
    723	struct Scsi_Host *host = cmd->device->host;
    724	unsigned long flags;
    725
    726	if (imm_engine(dev, cmd)) {
    727		schedule_delayed_work(&dev->imm_tq, 1);
    728		return;
    729	}
    730	/* Command must of completed hence it is safe to let go... */
    731#if IMM_DEBUG > 0
    732	switch ((cmd->result >> 16) & 0xff) {
    733	case DID_OK:
    734		break;
    735	case DID_NO_CONNECT:
    736		printk("imm: no device at SCSI ID %i\n", cmd->device->id);
    737		break;
    738	case DID_BUS_BUSY:
    739		printk("imm: BUS BUSY - EPP timeout detected\n");
    740		break;
    741	case DID_TIME_OUT:
    742		printk("imm: unknown timeout\n");
    743		break;
    744	case DID_ABORT:
    745		printk("imm: told to abort\n");
    746		break;
    747	case DID_PARITY:
    748		printk("imm: parity error (???)\n");
    749		break;
    750	case DID_ERROR:
    751		printk("imm: internal driver error\n");
    752		break;
    753	case DID_RESET:
    754		printk("imm: told to reset device\n");
    755		break;
    756	case DID_BAD_INTR:
    757		printk("imm: bad interrupt (???)\n");
    758		break;
    759	default:
    760		printk("imm: bad return code (%02x)\n",
    761		       (cmd->result >> 16) & 0xff);
    762	}
    763#endif
    764
    765	if (imm_scsi_pointer(cmd)->phase > 1)
    766		imm_disconnect(dev);
    767
    768	imm_pb_dismiss(dev);
    769
    770	spin_lock_irqsave(host->host_lock, flags);
    771	dev->cur_cmd = NULL;
    772	scsi_done(cmd);
    773	spin_unlock_irqrestore(host->host_lock, flags);
    774	return;
    775}
    776
    777static int imm_engine(imm_struct *dev, struct scsi_cmnd *const cmd)
    778{
    779	struct scsi_pointer *scsi_pointer = imm_scsi_pointer(cmd);
    780	unsigned short ppb = dev->base;
    781	unsigned char l = 0, h = 0;
    782	int retv, x;
    783
    784	/* First check for any errors that may have occurred
    785	 * Here we check for internal errors
    786	 */
    787	if (dev->failed)
    788		return 0;
    789
    790	switch (scsi_pointer->phase) {
    791	case 0:		/* Phase 0 - Waiting for parport */
    792		if (time_after(jiffies, dev->jstart + HZ)) {
    793			/*
    794			 * We waited more than a second
    795			 * for parport to call us
    796			 */
    797			imm_fail(dev, DID_BUS_BUSY);
    798			return 0;
    799		}
    800		return 1;	/* wait until imm_wakeup claims parport */
    801
    802	case 1:		/* Phase 1 - Connected */
    803		imm_connect(dev, CONNECT_EPP_MAYBE);
    804		scsi_pointer->phase++;
    805		fallthrough;
    806
    807	case 2:		/* Phase 2 - We are now talking to the scsi bus */
    808		if (!imm_select(dev, scmd_id(cmd))) {
    809			imm_fail(dev, DID_NO_CONNECT);
    810			return 0;
    811		}
    812		scsi_pointer->phase++;
    813		fallthrough;
    814
    815	case 3:		/* Phase 3 - Ready to accept a command */
    816		w_ctr(ppb, 0x0c);
    817		if (!(r_str(ppb) & 0x80))
    818			return 1;
    819
    820		if (!imm_send_command(cmd))
    821			return 0;
    822		scsi_pointer->phase++;
    823		fallthrough;
    824
    825	case 4:		/* Phase 4 - Setup scatter/gather buffers */
    826		if (scsi_bufflen(cmd)) {
    827			scsi_pointer->buffer = scsi_sglist(cmd);
    828			scsi_pointer->this_residual = scsi_pointer->buffer->length;
    829			scsi_pointer->ptr = sg_virt(scsi_pointer->buffer);
    830		} else {
    831			scsi_pointer->buffer = NULL;
    832			scsi_pointer->this_residual = 0;
    833			scsi_pointer->ptr = NULL;
    834		}
    835		scsi_pointer->buffers_residual = scsi_sg_count(cmd) - 1;
    836		scsi_pointer->phase++;
    837		if (scsi_pointer->this_residual & 0x01)
    838			scsi_pointer->this_residual++;
    839		fallthrough;
    840
    841	case 5:		/* Phase 5 - Pre-Data transfer stage */
    842		/* Spin lock for BUSY */
    843		w_ctr(ppb, 0x0c);
    844		if (!(r_str(ppb) & 0x80))
    845			return 1;
    846
    847		/* Require negotiation for read requests */
    848		x = (r_str(ppb) & 0xb8);
    849		dev->rd = (x & 0x10) ? 1 : 0;
    850		dev->dp = (x & 0x20) ? 0 : 1;
    851
    852		if ((dev->dp) && (dev->rd))
    853			if (imm_negotiate(dev))
    854				return 0;
    855		scsi_pointer->phase++;
    856		fallthrough;
    857
    858	case 6:		/* Phase 6 - Data transfer stage */
    859		/* Spin lock for BUSY */
    860		w_ctr(ppb, 0x0c);
    861		if (!(r_str(ppb) & 0x80))
    862			return 1;
    863
    864		if (dev->dp) {
    865			retv = imm_completion(cmd);
    866			if (retv == -1)
    867				return 0;
    868			if (retv == 0)
    869				return 1;
    870		}
    871		scsi_pointer->phase++;
    872		fallthrough;
    873
    874	case 7:		/* Phase 7 - Post data transfer stage */
    875		if ((dev->dp) && (dev->rd)) {
    876			if ((dev->mode == IMM_NIBBLE) || (dev->mode == IMM_PS2)) {
    877				w_ctr(ppb, 0x4);
    878				w_ctr(ppb, 0xc);
    879				w_ctr(ppb, 0xe);
    880				w_ctr(ppb, 0x4);
    881			}
    882		}
    883		scsi_pointer->phase++;
    884		fallthrough;
    885
    886	case 8:		/* Phase 8 - Read status/message */
    887		/* Check for data overrun */
    888		if (imm_wait(dev) != (unsigned char) 0xb8) {
    889			imm_fail(dev, DID_ERROR);
    890			return 0;
    891		}
    892		if (imm_negotiate(dev))
    893			return 0;
    894		if (imm_in(dev, &l, 1)) {	/* read status byte */
    895			/* Check for optional message byte */
    896			if (imm_wait(dev) == (unsigned char) 0xb8)
    897				imm_in(dev, &h, 1);
    898			cmd->result = (DID_OK << 16) | (l & STATUS_MASK);
    899		}
    900		if ((dev->mode == IMM_NIBBLE) || (dev->mode == IMM_PS2)) {
    901			w_ctr(ppb, 0x4);
    902			w_ctr(ppb, 0xc);
    903			w_ctr(ppb, 0xe);
    904			w_ctr(ppb, 0x4);
    905		}
    906		return 0;	/* Finished */
    907
    908	default:
    909		printk("imm: Invalid scsi phase\n");
    910	}
    911	return 0;
    912}
    913
    914static int imm_queuecommand_lck(struct scsi_cmnd *cmd)
    915{
    916	imm_struct *dev = imm_dev(cmd->device->host);
    917
    918	if (dev->cur_cmd) {
    919		printk("IMM: bug in imm_queuecommand\n");
    920		return 0;
    921	}
    922	dev->failed = 0;
    923	dev->jstart = jiffies;
    924	dev->cur_cmd = cmd;
    925	cmd->result = DID_ERROR << 16;	/* default return code */
    926	imm_scsi_pointer(cmd)->phase = 0;	/* bus free */
    927
    928	schedule_delayed_work(&dev->imm_tq, 0);
    929
    930	imm_pb_claim(dev);
    931
    932	return 0;
    933}
    934
    935static DEF_SCSI_QCMD(imm_queuecommand)
    936
    937/*
    938 * Apparently the disk->capacity attribute is off by 1 sector 
    939 * for all disk drives.  We add the one here, but it should really
    940 * be done in sd.c.  Even if it gets fixed there, this will still
    941 * work.
    942 */
    943static int imm_biosparam(struct scsi_device *sdev, struct block_device *dev,
    944			 sector_t capacity, int ip[])
    945{
    946	ip[0] = 0x40;
    947	ip[1] = 0x20;
    948	ip[2] = ((unsigned long) capacity + 1) / (ip[0] * ip[1]);
    949	if (ip[2] > 1024) {
    950		ip[0] = 0xff;
    951		ip[1] = 0x3f;
    952		ip[2] = ((unsigned long) capacity + 1) / (ip[0] * ip[1]);
    953	}
    954	return 0;
    955}
    956
    957static int imm_abort(struct scsi_cmnd *cmd)
    958{
    959	imm_struct *dev = imm_dev(cmd->device->host);
    960	/*
    961	 * There is no method for aborting commands since Iomega
    962	 * have tied the SCSI_MESSAGE line high in the interface
    963	 */
    964
    965	switch (imm_scsi_pointer(cmd)->phase) {
    966	case 0:		/* Do not have access to parport */
    967	case 1:		/* Have not connected to interface */
    968		dev->cur_cmd = NULL;	/* Forget the problem */
    969		return SUCCESS;
    970	default:		/* SCSI command sent, can not abort */
    971		return FAILED;
    972	}
    973}
    974
    975static void imm_reset_pulse(unsigned int base)
    976{
    977	w_ctr(base, 0x04);
    978	w_dtr(base, 0x40);
    979	udelay(1);
    980	w_ctr(base, 0x0c);
    981	w_ctr(base, 0x0d);
    982	udelay(50);
    983	w_ctr(base, 0x0c);
    984	w_ctr(base, 0x04);
    985}
    986
    987static int imm_reset(struct scsi_cmnd *cmd)
    988{
    989	imm_struct *dev = imm_dev(cmd->device->host);
    990
    991	if (imm_scsi_pointer(cmd)->phase)
    992		imm_disconnect(dev);
    993	dev->cur_cmd = NULL;	/* Forget the problem */
    994
    995	imm_connect(dev, CONNECT_NORMAL);
    996	imm_reset_pulse(dev->base);
    997	mdelay(1);		/* device settle delay */
    998	imm_disconnect(dev);
    999	mdelay(1);		/* device settle delay */
   1000	return SUCCESS;
   1001}
   1002
   1003static int device_check(imm_struct *dev)
   1004{
   1005	/* This routine looks for a device and then attempts to use EPP
   1006	   to send a command. If all goes as planned then EPP is available. */
   1007
   1008	static char cmd[6] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
   1009	int loop, old_mode, status, k, ppb = dev->base;
   1010	unsigned char l;
   1011
   1012	old_mode = dev->mode;
   1013	for (loop = 0; loop < 8; loop++) {
   1014		/* Attempt to use EPP for Test Unit Ready */
   1015		if ((ppb & 0x0007) == 0x0000)
   1016			dev->mode = IMM_EPP_32;
   1017
   1018	      second_pass:
   1019		imm_connect(dev, CONNECT_EPP_MAYBE);
   1020		/* Select SCSI device */
   1021		if (!imm_select(dev, loop)) {
   1022			imm_disconnect(dev);
   1023			continue;
   1024		}
   1025		printk("imm: Found device at ID %i, Attempting to use %s\n",
   1026		       loop, IMM_MODE_STRING[dev->mode]);
   1027
   1028		/* Send SCSI command */
   1029		status = 1;
   1030		w_ctr(ppb, 0x0c);
   1031		for (l = 0; (l < 3) && (status); l++)
   1032			status = imm_out(dev, &cmd[l << 1], 2);
   1033
   1034		if (!status) {
   1035			imm_disconnect(dev);
   1036			imm_connect(dev, CONNECT_EPP_MAYBE);
   1037			imm_reset_pulse(dev->base);
   1038			udelay(1000);
   1039			imm_disconnect(dev);
   1040			udelay(1000);
   1041			if (dev->mode == IMM_EPP_32) {
   1042				dev->mode = old_mode;
   1043				goto second_pass;
   1044			}
   1045			printk("imm: Unable to establish communication\n");
   1046			return -EIO;
   1047		}
   1048		w_ctr(ppb, 0x0c);
   1049
   1050		k = 1000000;	/* 1 Second */
   1051		do {
   1052			l = r_str(ppb);
   1053			k--;
   1054			udelay(1);
   1055		} while (!(l & 0x80) && (k));
   1056
   1057		l &= 0xb8;
   1058
   1059		if (l != 0xb8) {
   1060			imm_disconnect(dev);
   1061			imm_connect(dev, CONNECT_EPP_MAYBE);
   1062			imm_reset_pulse(dev->base);
   1063			udelay(1000);
   1064			imm_disconnect(dev);
   1065			udelay(1000);
   1066			if (dev->mode == IMM_EPP_32) {
   1067				dev->mode = old_mode;
   1068				goto second_pass;
   1069			}
   1070			printk
   1071			    ("imm: Unable to establish communication\n");
   1072			return -EIO;
   1073		}
   1074		imm_disconnect(dev);
   1075		printk
   1076		    ("imm: Communication established at 0x%x with ID %i using %s\n",
   1077		     ppb, loop, IMM_MODE_STRING[dev->mode]);
   1078		imm_connect(dev, CONNECT_EPP_MAYBE);
   1079		imm_reset_pulse(dev->base);
   1080		udelay(1000);
   1081		imm_disconnect(dev);
   1082		udelay(1000);
   1083		return 0;
   1084	}
   1085	printk("imm: No devices found\n");
   1086	return -ENODEV;
   1087}
   1088
   1089/*
   1090 * imm cannot deal with highmem, so this causes all IO pages for this host
   1091 * to reside in low memory (hence mapped)
   1092 */
   1093static int imm_adjust_queue(struct scsi_device *device)
   1094{
   1095	blk_queue_bounce_limit(device->request_queue, BLK_BOUNCE_HIGH);
   1096	return 0;
   1097}
   1098
   1099static struct scsi_host_template imm_template = {
   1100	.module			= THIS_MODULE,
   1101	.proc_name		= "imm",
   1102	.show_info		= imm_show_info,
   1103	.write_info		= imm_write_info,
   1104	.name			= "Iomega VPI2 (imm) interface",
   1105	.queuecommand		= imm_queuecommand,
   1106	.eh_abort_handler	= imm_abort,
   1107	.eh_host_reset_handler	= imm_reset,
   1108	.bios_param		= imm_biosparam,
   1109	.this_id		= 7,
   1110	.sg_tablesize		= SG_ALL,
   1111	.can_queue		= 1,
   1112	.slave_alloc		= imm_adjust_queue,
   1113	.cmd_size		= sizeof(struct scsi_pointer),
   1114};
   1115
   1116/***************************************************************************
   1117 *                   Parallel port probing routines                        *
   1118 ***************************************************************************/
   1119
   1120static LIST_HEAD(imm_hosts);
   1121
   1122/*
   1123 * Finds the first available device number that can be alloted to the
   1124 * new imm device and returns the address of the previous node so that
   1125 * we can add to the tail and have a list in the ascending order.
   1126 */
   1127
   1128static inline imm_struct *find_parent(void)
   1129{
   1130	imm_struct *dev, *par = NULL;
   1131	unsigned int cnt = 0;
   1132
   1133	if (list_empty(&imm_hosts))
   1134		return NULL;
   1135
   1136	list_for_each_entry(dev, &imm_hosts, list) {
   1137		if (dev->dev_no != cnt)
   1138			return par;
   1139		cnt++;
   1140		par = dev;
   1141	}
   1142
   1143	return par;
   1144}
   1145
   1146static int __imm_attach(struct parport *pb)
   1147{
   1148	struct Scsi_Host *host;
   1149	imm_struct *dev, *temp;
   1150	DECLARE_WAIT_QUEUE_HEAD_ONSTACK(waiting);
   1151	DEFINE_WAIT(wait);
   1152	int ports;
   1153	int modes, ppb;
   1154	int err = -ENOMEM;
   1155	struct pardev_cb imm_cb;
   1156
   1157	init_waitqueue_head(&waiting);
   1158
   1159	dev = kzalloc(sizeof(imm_struct), GFP_KERNEL);
   1160	if (!dev)
   1161		return -ENOMEM;
   1162
   1163
   1164	dev->base = -1;
   1165	dev->mode = IMM_AUTODETECT;
   1166	INIT_LIST_HEAD(&dev->list);
   1167
   1168	temp = find_parent();
   1169	if (temp)
   1170		dev->dev_no = temp->dev_no + 1;
   1171
   1172	memset(&imm_cb, 0, sizeof(imm_cb));
   1173	imm_cb.private = dev;
   1174	imm_cb.wakeup = imm_wakeup;
   1175
   1176	dev->dev = parport_register_dev_model(pb, "imm", &imm_cb, dev->dev_no);
   1177	if (!dev->dev)
   1178		goto out;
   1179
   1180
   1181	/* Claim the bus so it remembers what we do to the control
   1182	 * registers. [ CTR and ECP ]
   1183	 */
   1184	err = -EBUSY;
   1185	dev->waiting = &waiting;
   1186	prepare_to_wait(&waiting, &wait, TASK_UNINTERRUPTIBLE);
   1187	if (imm_pb_claim(dev))
   1188		schedule_timeout(3 * HZ);
   1189	if (dev->wanted) {
   1190		printk(KERN_ERR "imm%d: failed to claim parport because "
   1191			"a pardevice is owning the port for too long "
   1192			"time!\n", pb->number);
   1193		imm_pb_dismiss(dev);
   1194		dev->waiting = NULL;
   1195		finish_wait(&waiting, &wait);
   1196		goto out1;
   1197	}
   1198	dev->waiting = NULL;
   1199	finish_wait(&waiting, &wait);
   1200	ppb = dev->base = dev->dev->port->base;
   1201	dev->base_hi = dev->dev->port->base_hi;
   1202	w_ctr(ppb, 0x0c);
   1203	modes = dev->dev->port->modes;
   1204
   1205	/* Mode detection works up the chain of speed
   1206	 * This avoids a nasty if-then-else-if-... tree
   1207	 */
   1208	dev->mode = IMM_NIBBLE;
   1209
   1210	if (modes & PARPORT_MODE_TRISTATE)
   1211		dev->mode = IMM_PS2;
   1212
   1213	/* Done configuration */
   1214
   1215	err = imm_init(dev);
   1216
   1217	imm_pb_release(dev);
   1218
   1219	if (err)
   1220		goto out1;
   1221
   1222	/* now the glue ... */
   1223	if (dev->mode == IMM_NIBBLE || dev->mode == IMM_PS2)
   1224		ports = 3;
   1225	else
   1226		ports = 8;
   1227
   1228	INIT_DELAYED_WORK(&dev->imm_tq, imm_interrupt);
   1229
   1230	err = -ENOMEM;
   1231	host = scsi_host_alloc(&imm_template, sizeof(imm_struct *));
   1232	if (!host)
   1233		goto out1;
   1234	host->io_port = pb->base;
   1235	host->n_io_port = ports;
   1236	host->dma_channel = -1;
   1237	host->unique_id = pb->number;
   1238	*(imm_struct **)&host->hostdata = dev;
   1239	dev->host = host;
   1240	if (!temp)
   1241		list_add_tail(&dev->list, &imm_hosts);
   1242	else
   1243		list_add_tail(&dev->list, &temp->list);
   1244	err = scsi_add_host(host, NULL);
   1245	if (err)
   1246		goto out2;
   1247	scsi_scan_host(host);
   1248	return 0;
   1249
   1250out2:
   1251	list_del_init(&dev->list);
   1252	scsi_host_put(host);
   1253out1:
   1254	parport_unregister_device(dev->dev);
   1255out:
   1256	kfree(dev);
   1257	return err;
   1258}
   1259
   1260static void imm_attach(struct parport *pb)
   1261{
   1262	__imm_attach(pb);
   1263}
   1264
   1265static void imm_detach(struct parport *pb)
   1266{
   1267	imm_struct *dev;
   1268	list_for_each_entry(dev, &imm_hosts, list) {
   1269		if (dev->dev->port == pb) {
   1270			list_del_init(&dev->list);
   1271			scsi_remove_host(dev->host);
   1272			scsi_host_put(dev->host);
   1273			parport_unregister_device(dev->dev);
   1274			kfree(dev);
   1275			break;
   1276		}
   1277	}
   1278}
   1279
   1280static struct parport_driver imm_driver = {
   1281	.name		= "imm",
   1282	.match_port	= imm_attach,
   1283	.detach		= imm_detach,
   1284	.devmodel	= true,
   1285};
   1286module_parport_driver(imm_driver);
   1287
   1288MODULE_LICENSE("GPL");