xref: /openbmc/linux/drivers/message/fusion/mptctl.c (revision 09120a8c)
1 /*
2  *  linux/drivers/message/fusion/mptctl.c
3  *      mpt Ioctl driver.
4  *      For use with LSI Logic PCI chip/adapters
5  *      running LSI Logic Fusion MPT (Message Passing Technology) firmware.
6  *
7  *  Copyright (c) 1999-2007 LSI Logic Corporation
8  *  (mailto:DL-MPTFusionLinux@lsi.com)
9  *
10  */
11 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
12 /*
13     This program is free software; you can redistribute it and/or modify
14     it under the terms of the GNU General Public License as published by
15     the Free Software Foundation; version 2 of the License.
16 
17     This program is distributed in the hope that it will be useful,
18     but WITHOUT ANY WARRANTY; without even the implied warranty of
19     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
20     GNU General Public License for more details.
21 
22     NO WARRANTY
23     THE PROGRAM IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR
24     CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED INCLUDING, WITHOUT
25     LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT,
26     MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each Recipient is
27     solely responsible for determining the appropriateness of using and
28     distributing the Program and assumes all risks associated with its
29     exercise of rights under this Agreement, including but not limited to
30     the risks and costs of program errors, damage to or loss of data,
31     programs or equipment, and unavailability or interruption of operations.
32 
33     DISCLAIMER OF LIABILITY
34     NEITHER RECIPIENT NOR ANY CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY
35     DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
36     DAMAGES (INCLUDING WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND
37     ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
38     TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
39     USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS GRANTED
40     HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES
41 
42     You should have received a copy of the GNU General Public License
43     along with this program; if not, write to the Free Software
44     Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
45 */
46 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
47 
48 #include <linux/kernel.h>
49 #include <linux/module.h>
50 #include <linux/errno.h>
51 #include <linux/init.h>
52 #include <linux/slab.h>
53 #include <linux/types.h>
54 #include <linux/pci.h>
55 #include <linux/delay.h>	/* for mdelay */
56 #include <linux/miscdevice.h>
57 #include <linux/smp_lock.h>
58 #include <linux/compat.h>
59 
60 #include <asm/io.h>
61 #include <asm/uaccess.h>
62 
63 #include <scsi/scsi.h>
64 #include <scsi/scsi_cmnd.h>
65 #include <scsi/scsi_device.h>
66 #include <scsi/scsi_host.h>
67 #include <scsi/scsi_tcq.h>
68 
69 #define COPYRIGHT	"Copyright (c) 1999-2007 LSI Logic Corporation"
70 #define MODULEAUTHOR	"LSI Logic Corporation"
71 #include "mptbase.h"
72 #include "mptctl.h"
73 
74 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
75 #define my_NAME		"Fusion MPT misc device (ioctl) driver"
76 #define my_VERSION	MPT_LINUX_VERSION_COMMON
77 #define MYNAM		"mptctl"
78 
79 MODULE_AUTHOR(MODULEAUTHOR);
80 MODULE_DESCRIPTION(my_NAME);
81 MODULE_LICENSE("GPL");
82 MODULE_VERSION(my_VERSION);
83 
84 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
85 
86 static int mptctl_id = -1;
87 
88 static DECLARE_WAIT_QUEUE_HEAD ( mptctl_wait );
89 
90 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
91 
92 struct buflist {
93 	u8	*kptr;
94 	int	 len;
95 };
96 
97 /*
98  * Function prototypes. Called from OS entry point mptctl_ioctl.
99  * arg contents specific to function.
100  */
101 static int mptctl_fw_download(unsigned long arg);
102 static int mptctl_getiocinfo(unsigned long arg, unsigned int cmd);
103 static int mptctl_gettargetinfo(unsigned long arg);
104 static int mptctl_readtest(unsigned long arg);
105 static int mptctl_mpt_command(unsigned long arg);
106 static int mptctl_eventquery(unsigned long arg);
107 static int mptctl_eventenable(unsigned long arg);
108 static int mptctl_eventreport(unsigned long arg);
109 static int mptctl_replace_fw(unsigned long arg);
110 
111 static int mptctl_do_reset(unsigned long arg);
112 static int mptctl_hp_hostinfo(unsigned long arg, unsigned int cmd);
113 static int mptctl_hp_targetinfo(unsigned long arg);
114 
115 static int  mptctl_probe(struct pci_dev *, const struct pci_device_id *);
116 static void mptctl_remove(struct pci_dev *);
117 
118 #ifdef CONFIG_COMPAT
119 static long compat_mpctl_ioctl(struct file *f, unsigned cmd, unsigned long arg);
120 #endif
121 /*
122  * Private function calls.
123  */
124 static int mptctl_do_mpt_command(struct mpt_ioctl_command karg, void __user *mfPtr);
125 static int mptctl_do_fw_download(int ioc, char __user *ufwbuf, size_t fwlen);
126 static MptSge_t *kbuf_alloc_2_sgl(int bytes, u32 dir, int sge_offset, int *frags,
127 		struct buflist **blp, dma_addr_t *sglbuf_dma, MPT_ADAPTER *ioc);
128 static void kfree_sgl(MptSge_t *sgl, dma_addr_t sgl_dma,
129 		struct buflist *buflist, MPT_ADAPTER *ioc);
130 static void mptctl_timeout_expired (MPT_IOCTL *ioctl);
131 static int  mptctl_bus_reset(MPT_IOCTL *ioctl);
132 static int mptctl_set_tm_flags(MPT_SCSI_HOST *hd);
133 static void mptctl_free_tm_flags(MPT_ADAPTER *ioc);
134 
135 /*
136  * Reset Handler cleanup function
137  */
138 static int  mptctl_ioc_reset(MPT_ADAPTER *ioc, int reset_phase);
139 
140 /*
141  * Event Handler function
142  */
143 static int mptctl_event_process(MPT_ADAPTER *ioc, EventNotificationReply_t *pEvReply);
144 static struct fasync_struct *async_queue=NULL;
145 
146 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
147 /*
148  * Scatter gather list (SGL) sizes and limits...
149  */
150 //#define MAX_SCSI_FRAGS	9
151 #define MAX_FRAGS_SPILL1	9
152 #define MAX_FRAGS_SPILL2	15
153 #define FRAGS_PER_BUCKET	(MAX_FRAGS_SPILL2 + 1)
154 
155 //#define MAX_CHAIN_FRAGS	64
156 //#define MAX_CHAIN_FRAGS	(15+15+15+16)
157 #define MAX_CHAIN_FRAGS		(4 * MAX_FRAGS_SPILL2 + 1)
158 
159 //  Define max sg LIST bytes ( == (#frags + #chains) * 8 bytes each)
160 //  Works out to: 592d bytes!     (9+1)*8 + 4*(15+1)*8
161 //                  ^----------------- 80 + 512
162 #define MAX_SGL_BYTES		((MAX_FRAGS_SPILL1 + 1 + (4 * FRAGS_PER_BUCKET)) * 8)
163 
164 /* linux only seems to ever give 128kB MAX contiguous (GFP_USER) mem bytes */
165 #define MAX_KMALLOC_SZ		(128*1024)
166 
167 #define MPT_IOCTL_DEFAULT_TIMEOUT 10	/* Default timeout value (seconds) */
168 
169 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
170 /**
171  *	mptctl_syscall_down - Down the MPT adapter syscall semaphore.
172  *	@ioc: Pointer to MPT adapter
173  *	@nonblock: boolean, non-zero if O_NONBLOCK is set
174  *
175  *	All of the ioctl commands can potentially sleep, which is illegal
176  *	with a spinlock held, thus we perform mutual exclusion here.
177  *
178  *	Returns negative errno on error, or zero for success.
179  */
180 static inline int
181 mptctl_syscall_down(MPT_ADAPTER *ioc, int nonblock)
182 {
183 	int rc = 0;
184 //	dctlprintk(ioc, printk(KERN_DEBUG MYNAM "::mptctl_syscall_down(%p,%d) called\n", ioc, nonblock));
185 
186 	if (nonblock) {
187 		if (!mutex_trylock(&ioc->ioctl->ioctl_mutex))
188 			rc = -EAGAIN;
189 	} else {
190 		if (mutex_lock_interruptible(&ioc->ioctl->ioctl_mutex))
191 			rc = -ERESTARTSYS;
192 	}
193 //	dctlprintk(ioc, printk(KERN_DEBUG MYNAM "::mptctl_syscall_down return %d\n", rc));
194 	return rc;
195 }
196 
197 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
198 /*
199  *  This is the callback for any message we have posted. The message itself
200  *  will be returned to the message pool when we return from the IRQ
201  *
202  *  This runs in irq context so be short and sweet.
203  */
204 static int
205 mptctl_reply(MPT_ADAPTER *ioc, MPT_FRAME_HDR *req, MPT_FRAME_HDR *reply)
206 {
207 	char *sense_data;
208 	int sz, req_index;
209 	u16 iocStatus;
210 	u8 cmd;
211 
212 	if (req)
213 		 cmd = req->u.hdr.Function;
214 	else
215 		return 1;
216 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "\tcompleting mpi function (0x%02X), req=%p, "
217 	    "reply=%p\n", ioc->name,  req->u.hdr.Function, req, reply));
218 
219 	if (ioc->ioctl) {
220 
221 		if (reply==NULL) {
222 
223 			dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_reply() NULL Reply "
224 				"Function=%x!\n", ioc->name, cmd));
225 
226 			ioc->ioctl->status |= MPT_IOCTL_STATUS_COMMAND_GOOD;
227 			ioc->ioctl->reset &= ~MPTCTL_RESET_OK;
228 
229 			/* We are done, issue wake up
230 	 		*/
231 			ioc->ioctl->wait_done = 1;
232 			wake_up (&mptctl_wait);
233 			return 1;
234 
235 		}
236 
237 		/* Copy the reply frame (which much exist
238 		 * for non-SCSI I/O) to the IOC structure.
239 		 */
240 		memcpy(ioc->ioctl->ReplyFrame, reply,
241 			min(ioc->reply_sz, 4*reply->u.reply.MsgLength));
242 		ioc->ioctl->status |= MPT_IOCTL_STATUS_RF_VALID;
243 
244 		/* Set the command status to GOOD if IOC Status is GOOD
245 		 * OR if SCSI I/O cmd and data underrun or recovered error.
246 		 */
247 		iocStatus = le16_to_cpu(reply->u.reply.IOCStatus) & MPI_IOCSTATUS_MASK;
248 		if (iocStatus  == MPI_IOCSTATUS_SUCCESS)
249 			ioc->ioctl->status |= MPT_IOCTL_STATUS_COMMAND_GOOD;
250 
251 		if (iocStatus || reply->u.reply.IOCLogInfo)
252 			dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "\tiocstatus (0x%04X), "
253 				"loginfo (0x%08X)\n", ioc->name,
254 				iocStatus,
255 				le32_to_cpu(reply->u.reply.IOCLogInfo)));
256 
257 		if ((cmd == MPI_FUNCTION_SCSI_IO_REQUEST) ||
258 			(cmd == MPI_FUNCTION_RAID_SCSI_IO_PASSTHROUGH)) {
259 
260 			if (reply->u.sreply.SCSIStatus || reply->u.sreply.SCSIState)
261 				dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT
262 					"\tscsi_status (0x%02x), scsi_state (0x%02x), "
263 					"tag = (0x%04x), transfer_count (0x%08x)\n", ioc->name,
264 					reply->u.sreply.SCSIStatus,
265 					reply->u.sreply.SCSIState,
266 					le16_to_cpu(reply->u.sreply.TaskTag),
267 					le32_to_cpu(reply->u.sreply.TransferCount)));
268 
269 			ioc->ioctl->reset &= ~MPTCTL_RESET_OK;
270 
271 			if ((iocStatus == MPI_IOCSTATUS_SCSI_DATA_UNDERRUN) ||
272 			(iocStatus == MPI_IOCSTATUS_SCSI_RECOVERED_ERROR)) {
273 			ioc->ioctl->status |= MPT_IOCTL_STATUS_COMMAND_GOOD;
274 			}
275 		}
276 
277 		/* Copy the sense data - if present
278 		 */
279 		if ((cmd == MPI_FUNCTION_SCSI_IO_REQUEST) &&
280 			(reply->u.sreply.SCSIState &
281 			 MPI_SCSI_STATE_AUTOSENSE_VALID)){
282 			sz = req->u.scsireq.SenseBufferLength;
283 			req_index =
284 			    le16_to_cpu(req->u.frame.hwhdr.msgctxu.fld.req_idx);
285 			sense_data =
286 			    ((u8 *)ioc->sense_buf_pool +
287 			     (req_index * MPT_SENSE_BUFFER_ALLOC));
288 			memcpy(ioc->ioctl->sense, sense_data, sz);
289 			ioc->ioctl->status |= MPT_IOCTL_STATUS_SENSE_VALID;
290 		}
291 
292 		if (cmd == MPI_FUNCTION_SCSI_TASK_MGMT)
293 			mptctl_free_tm_flags(ioc);
294 
295 		/* We are done, issue wake up
296 		 */
297 		ioc->ioctl->wait_done = 1;
298 		wake_up (&mptctl_wait);
299 	}
300 	return 1;
301 }
302 
303 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
304 /* mptctl_timeout_expired
305  *
306  * Expecting an interrupt, however timed out.
307  *
308  */
309 static void mptctl_timeout_expired (MPT_IOCTL *ioctl)
310 {
311 	int rc = 1;
312 
313 	dctlprintk(ioctl->ioc, printk(MYIOC_s_DEBUG_FMT ": Timeout Expired! Host %d\n",
314 				ioctl->ioc->name, ioctl->ioc->id));
315 	if (ioctl == NULL)
316 		return;
317 
318 	ioctl->wait_done = 0;
319 	if (ioctl->reset & MPTCTL_RESET_OK)
320 		rc = mptctl_bus_reset(ioctl);
321 
322 	if (rc) {
323 		/* Issue a reset for this device.
324 		 * The IOC is not responding.
325 		 */
326 		dctlprintk(ioctl->ioc, printk(MYIOC_s_DEBUG_FMT "Calling HardReset! \n",
327 			 ioctl->ioc->name));
328 		mpt_HardResetHandler(ioctl->ioc, CAN_SLEEP);
329 	}
330 	return;
331 
332 }
333 
334 /* mptctl_bus_reset
335  *
336  * Bus reset code.
337  *
338  */
339 static int mptctl_bus_reset(MPT_IOCTL *ioctl)
340 {
341 	MPT_FRAME_HDR	*mf;
342 	SCSITaskMgmt_t	*pScsiTm;
343 	MPT_SCSI_HOST	*hd;
344 	int		 ii;
345 	int		 retval;
346 
347 
348 	ioctl->reset &= ~MPTCTL_RESET_OK;
349 
350 	if (ioctl->ioc->sh == NULL)
351 		return -EPERM;
352 
353 	hd = (MPT_SCSI_HOST *) ioctl->ioc->sh->hostdata;
354 	if (hd == NULL)
355 		return -EPERM;
356 
357 	/* Single threading ....
358 	 */
359 	if (mptctl_set_tm_flags(hd) != 0)
360 		return -EPERM;
361 
362 	/* Send request
363 	 */
364 	if ((mf = mpt_get_msg_frame(mptctl_id, ioctl->ioc)) == NULL) {
365 		dtmprintk(ioctl->ioc, printk(MYIOC_s_DEBUG_FMT "IssueTaskMgmt, no msg frames!!\n",
366 				ioctl->ioc->name));
367 
368 		mptctl_free_tm_flags(ioctl->ioc);
369 		return -ENOMEM;
370 	}
371 
372 	dtmprintk(ioctl->ioc, printk(MYIOC_s_DEBUG_FMT "IssueTaskMgmt request @ %p\n",
373 			ioctl->ioc->name, mf));
374 
375 	pScsiTm = (SCSITaskMgmt_t *) mf;
376 	pScsiTm->TargetID = ioctl->id;
377 	pScsiTm->Bus = hd->port;	/* 0 */
378 	pScsiTm->ChainOffset = 0;
379 	pScsiTm->Function = MPI_FUNCTION_SCSI_TASK_MGMT;
380 	pScsiTm->Reserved = 0;
381 	pScsiTm->TaskType = MPI_SCSITASKMGMT_TASKTYPE_RESET_BUS;
382 	pScsiTm->Reserved1 = 0;
383 	pScsiTm->MsgFlags = MPI_SCSITASKMGMT_MSGFLAGS_LIPRESET_RESET_OPTION;
384 
385 	for (ii= 0; ii < 8; ii++)
386 		pScsiTm->LUN[ii] = 0;
387 
388 	for (ii=0; ii < 7; ii++)
389 		pScsiTm->Reserved2[ii] = 0;
390 
391 	pScsiTm->TaskMsgContext = 0;
392 	dtmprintk(ioctl->ioc, printk(MYIOC_s_DEBUG_FMT
393 		"mptctl_bus_reset: issued.\n", ioctl->ioc->name));
394 
395 	DBG_DUMP_TM_REQUEST_FRAME(ioctl->ioc, (u32 *)mf);
396 
397 	ioctl->wait_done=0;
398 	if ((retval = mpt_send_handshake_request(mptctl_id, ioctl->ioc,
399 	     sizeof(SCSITaskMgmt_t), (u32*)pScsiTm, CAN_SLEEP)) != 0) {
400 		dfailprintk(ioctl->ioc, printk(MYIOC_s_ERR_FMT "_send_handshake FAILED!"
401 			" (hd %p, ioc %p, mf %p) \n", hd->ioc->name, hd,
402 			hd->ioc, mf));
403 		goto mptctl_bus_reset_done;
404 	}
405 
406 	/* Now wait for the command to complete */
407 	ii = wait_event_timeout(mptctl_wait,
408 	     ioctl->wait_done == 1,
409 	     HZ*5 /* 5 second timeout */);
410 
411 	if(ii <=0 && (ioctl->wait_done != 1 ))  {
412 		mpt_free_msg_frame(hd->ioc, mf);
413 		ioctl->wait_done = 0;
414 		retval = -1; /* return failure */
415 	}
416 
417 mptctl_bus_reset_done:
418 
419 	mptctl_free_tm_flags(ioctl->ioc);
420 	return retval;
421 }
422 
423 static int
424 mptctl_set_tm_flags(MPT_SCSI_HOST *hd) {
425 	unsigned long flags;
426 
427 	spin_lock_irqsave(&hd->ioc->FreeQlock, flags);
428 
429 	if (hd->tmState == TM_STATE_NONE) {
430 		hd->tmState = TM_STATE_IN_PROGRESS;
431 		hd->tmPending = 1;
432 		spin_unlock_irqrestore(&hd->ioc->FreeQlock, flags);
433 	} else {
434 		spin_unlock_irqrestore(&hd->ioc->FreeQlock, flags);
435 		return -EBUSY;
436 	}
437 
438 	return 0;
439 }
440 
441 static void
442 mptctl_free_tm_flags(MPT_ADAPTER *ioc)
443 {
444 	MPT_SCSI_HOST * hd;
445 	unsigned long flags;
446 
447 	hd = (MPT_SCSI_HOST *) ioc->sh->hostdata;
448 	if (hd == NULL)
449 		return;
450 
451 	spin_lock_irqsave(&ioc->FreeQlock, flags);
452 
453 	hd->tmState = TM_STATE_NONE;
454 	hd->tmPending = 0;
455 	spin_unlock_irqrestore(&ioc->FreeQlock, flags);
456 
457 	return;
458 }
459 
460 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
461 /* mptctl_ioc_reset
462  *
463  * Clean-up functionality. Used only if there has been a
464  * reload of the FW due.
465  *
466  */
467 static int
468 mptctl_ioc_reset(MPT_ADAPTER *ioc, int reset_phase)
469 {
470 	MPT_IOCTL *ioctl = ioc->ioctl;
471 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT ": IOC %s_reset routed to IOCTL driver!\n",ioc->name,
472 		reset_phase==MPT_IOC_SETUP_RESET ? "setup" : (
473 		reset_phase==MPT_IOC_PRE_RESET ? "pre" : "post")));
474 
475 	if(ioctl == NULL)
476 		return 1;
477 
478 	switch(reset_phase) {
479 	case MPT_IOC_SETUP_RESET:
480 		ioctl->status |= MPT_IOCTL_STATUS_DID_IOCRESET;
481 		break;
482 	case MPT_IOC_POST_RESET:
483 		ioctl->status &= ~MPT_IOCTL_STATUS_DID_IOCRESET;
484 		break;
485 	case MPT_IOC_PRE_RESET:
486 	default:
487 		break;
488 	}
489 
490 	return 1;
491 }
492 
493 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
494 /* ASYNC Event Notification Support */
495 static int
496 mptctl_event_process(MPT_ADAPTER *ioc, EventNotificationReply_t *pEvReply)
497 {
498 	u8 event;
499 
500 	event = le32_to_cpu(pEvReply->Event) & 0xFF;
501 
502 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "%s() called\n",
503 	    ioc->name, __FUNCTION__));
504 	if(async_queue == NULL)
505 		return 1;
506 
507 	/* Raise SIGIO for persistent events.
508 	 * TODO - this define is not in MPI spec yet,
509 	 * but they plan to set it to 0x21
510 	 */
511 	 if (event == 0x21 ) {
512 		ioc->aen_event_read_flag=1;
513 		dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "Raised SIGIO to application\n",
514 		    ioc->name));
515 		devtverboseprintk(ioc, printk(MYIOC_s_DEBUG_FMT
516 		    "Raised SIGIO to application\n", ioc->name));
517 		kill_fasync(&async_queue, SIGIO, POLL_IN);
518 		return 1;
519 	 }
520 
521 	/* This flag is set after SIGIO was raised, and
522 	 * remains set until the application has read
523 	 * the event log via ioctl=MPTEVENTREPORT
524 	 */
525 	if(ioc->aen_event_read_flag)
526 		return 1;
527 
528 	/* Signal only for the events that are
529 	 * requested for by the application
530 	 */
531 	if (ioc->events && (ioc->eventTypes & ( 1 << event))) {
532 		ioc->aen_event_read_flag=1;
533 		dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT
534 		    "Raised SIGIO to application\n", ioc->name));
535 		devtverboseprintk(ioc, printk(MYIOC_s_DEBUG_FMT
536 		    "Raised SIGIO to application\n", ioc->name));
537 		kill_fasync(&async_queue, SIGIO, POLL_IN);
538 	}
539 	return 1;
540 }
541 
542 static int
543 mptctl_fasync(int fd, struct file *filep, int mode)
544 {
545 	MPT_ADAPTER	*ioc;
546 
547 	list_for_each_entry(ioc, &ioc_list, list)
548 		ioc->aen_event_read_flag=0;
549 
550 	return fasync_helper(fd, filep, mode, &async_queue);
551 }
552 
553 static int
554 mptctl_release(struct inode *inode, struct file *filep)
555 {
556 	return fasync_helper(-1, filep, 0, &async_queue);
557 }
558 
559 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
560 /*
561  *  MPT ioctl handler
562  *  cmd - specify the particular IOCTL command to be issued
563  *  arg - data specific to the command. Must not be null.
564  */
565 static long
566 __mptctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
567 {
568 	mpt_ioctl_header __user *uhdr = (void __user *) arg;
569 	mpt_ioctl_header	 khdr;
570 	int iocnum;
571 	unsigned iocnumX;
572 	int nonblock = (file->f_flags & O_NONBLOCK);
573 	int ret;
574 	MPT_ADAPTER *iocp = NULL;
575 
576 	if (copy_from_user(&khdr, uhdr, sizeof(khdr))) {
577 		printk(KERN_ERR "%s::mptctl_ioctl() @%d - "
578 				"Unable to copy mpt_ioctl_header data @ %p\n",
579 				__FILE__, __LINE__, uhdr);
580 		return -EFAULT;
581 	}
582 	ret = -ENXIO;				/* (-6) No such device or address */
583 
584 	/* Verify intended MPT adapter - set iocnum and the adapter
585 	 * pointer (iocp)
586 	 */
587 	iocnumX = khdr.iocnum & 0xFF;
588 	if (((iocnum = mpt_verify_adapter(iocnumX, &iocp)) < 0) ||
589 	    (iocp == NULL)) {
590 		printk(KERN_DEBUG "%s::mptctl_ioctl() @%d - ioc%d not found!\n",
591 				__FILE__, __LINE__, iocnumX);
592 		return -ENODEV;
593 	}
594 
595 	if (!iocp->active) {
596 		printk(KERN_DEBUG "%s::mptctl_ioctl() @%d - Controller disabled.\n",
597 				__FILE__, __LINE__);
598 		return -EFAULT;
599 	}
600 
601 	/* Handle those commands that are just returning
602 	 * information stored in the driver.
603 	 * These commands should never time out and are unaffected
604 	 * by TM and FW reloads.
605 	 */
606 	if ((cmd & ~IOCSIZE_MASK) == (MPTIOCINFO & ~IOCSIZE_MASK)) {
607 		return mptctl_getiocinfo(arg, _IOC_SIZE(cmd));
608 	} else if (cmd == MPTTARGETINFO) {
609 		return mptctl_gettargetinfo(arg);
610 	} else if (cmd == MPTTEST) {
611 		return mptctl_readtest(arg);
612 	} else if (cmd == MPTEVENTQUERY) {
613 		return mptctl_eventquery(arg);
614 	} else if (cmd == MPTEVENTENABLE) {
615 		return mptctl_eventenable(arg);
616 	} else if (cmd == MPTEVENTREPORT) {
617 		return mptctl_eventreport(arg);
618 	} else if (cmd == MPTFWREPLACE) {
619 		return mptctl_replace_fw(arg);
620 	}
621 
622 	/* All of these commands require an interrupt or
623 	 * are unknown/illegal.
624 	 */
625 	if ((ret = mptctl_syscall_down(iocp, nonblock)) != 0)
626 		return ret;
627 
628 	if (cmd == MPTFWDOWNLOAD)
629 		ret = mptctl_fw_download(arg);
630 	else if (cmd == MPTCOMMAND)
631 		ret = mptctl_mpt_command(arg);
632 	else if (cmd == MPTHARDRESET)
633 		ret = mptctl_do_reset(arg);
634 	else if ((cmd & ~IOCSIZE_MASK) == (HP_GETHOSTINFO & ~IOCSIZE_MASK))
635 		ret = mptctl_hp_hostinfo(arg, _IOC_SIZE(cmd));
636 	else if (cmd == HP_GETTARGETINFO)
637 		ret = mptctl_hp_targetinfo(arg);
638 	else
639 		ret = -EINVAL;
640 
641 	mutex_unlock(&iocp->ioctl->ioctl_mutex);
642 
643 	return ret;
644 }
645 
646 static long
647 mptctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
648 {
649 	long ret;
650 	lock_kernel();
651 	ret = __mptctl_ioctl(file, cmd, arg);
652 	unlock_kernel();
653 	return ret;
654 }
655 
656 static int mptctl_do_reset(unsigned long arg)
657 {
658 	struct mpt_ioctl_diag_reset __user *urinfo = (void __user *) arg;
659 	struct mpt_ioctl_diag_reset krinfo;
660 	MPT_ADAPTER		*iocp;
661 
662 	if (copy_from_user(&krinfo, urinfo, sizeof(struct mpt_ioctl_diag_reset))) {
663 		printk(KERN_ERR "%s@%d::mptctl_do_reset - "
664 				"Unable to copy mpt_ioctl_diag_reset struct @ %p\n",
665 				__FILE__, __LINE__, urinfo);
666 		return -EFAULT;
667 	}
668 
669 	if (mpt_verify_adapter(krinfo.hdr.iocnum, &iocp) < 0) {
670 		printk(KERN_DEBUG "%s@%d::mptctl_do_reset - ioc%d not found!\n",
671 				__FILE__, __LINE__, krinfo.hdr.iocnum);
672 		return -ENODEV; /* (-6) No such device or address */
673 	}
674 
675 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "mptctl_do_reset called.\n",
676 	    iocp->name));
677 
678 	if (mpt_HardResetHandler(iocp, CAN_SLEEP) != 0) {
679 		printk (KERN_ERR "%s@%d::mptctl_do_reset - reset failed.\n",
680 			__FILE__, __LINE__);
681 		return -1;
682 	}
683 
684 	return 0;
685 }
686 
687 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
688 /*
689  * MPT FW download function.  Cast the arg into the mpt_fw_xfer structure.
690  * This structure contains: iocnum, firmware length (bytes),
691  *      pointer to user space memory where the fw image is stored.
692  *
693  * Outputs:	None.
694  * Return:	0 if successful
695  *		-EFAULT if data unavailable
696  *		-ENXIO  if no such device
697  *		-EAGAIN if resource problem
698  *		-ENOMEM if no memory for SGE
699  *		-EMLINK if too many chain buffers required
700  *		-EBADRQC if adapter does not support FW download
701  *		-EBUSY if adapter is busy
702  *		-ENOMSG if FW upload returned bad status
703  */
704 static int
705 mptctl_fw_download(unsigned long arg)
706 {
707 	struct mpt_fw_xfer __user *ufwdl = (void __user *) arg;
708 	struct mpt_fw_xfer	 kfwdl;
709 
710 	if (copy_from_user(&kfwdl, ufwdl, sizeof(struct mpt_fw_xfer))) {
711 		printk(KERN_ERR "%s@%d::_ioctl_fwdl - "
712 				"Unable to copy mpt_fw_xfer struct @ %p\n",
713 				__FILE__, __LINE__, ufwdl);
714 		return -EFAULT;
715 	}
716 
717 	return mptctl_do_fw_download(kfwdl.iocnum, kfwdl.bufp, kfwdl.fwlen);
718 }
719 
720 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
721 /*
722  * FW Download engine.
723  * Outputs:	None.
724  * Return:	0 if successful
725  *		-EFAULT if data unavailable
726  *		-ENXIO  if no such device
727  *		-EAGAIN if resource problem
728  *		-ENOMEM if no memory for SGE
729  *		-EMLINK if too many chain buffers required
730  *		-EBADRQC if adapter does not support FW download
731  *		-EBUSY if adapter is busy
732  *		-ENOMSG if FW upload returned bad status
733  */
734 static int
735 mptctl_do_fw_download(int ioc, char __user *ufwbuf, size_t fwlen)
736 {
737 	FWDownload_t		*dlmsg;
738 	MPT_FRAME_HDR		*mf;
739 	MPT_ADAPTER		*iocp;
740 	FWDownloadTCSGE_t	*ptsge;
741 	MptSge_t		*sgl, *sgIn;
742 	char			*sgOut;
743 	struct buflist		*buflist;
744 	struct buflist		*bl;
745 	dma_addr_t		 sgl_dma;
746 	int			 ret;
747 	int			 numfrags = 0;
748 	int			 maxfrags;
749 	int			 n = 0;
750 	u32			 sgdir;
751 	u32			 nib;
752 	int			 fw_bytes_copied = 0;
753 	int			 i;
754 	int			 sge_offset = 0;
755 	u16			 iocstat;
756 	pFWDownloadReply_t	 ReplyMsg = NULL;
757 
758 	if (mpt_verify_adapter(ioc, &iocp) < 0) {
759 		printk(KERN_DEBUG "ioctl_fwdl - ioc%d not found!\n",				 ioc);
760 		return -ENODEV; /* (-6) No such device or address */
761 	} else {
762 
763 		/*  Valid device. Get a message frame and construct the FW download message.
764 	 	*/
765 		if ((mf = mpt_get_msg_frame(mptctl_id, iocp)) == NULL)
766 			return -EAGAIN;
767 	}
768 
769 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT
770 	    "mptctl_do_fwdl called. mptctl_id = %xh.\n", iocp->name, mptctl_id));
771 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "DbG: kfwdl.bufp  = %p\n",
772 	    iocp->name, ufwbuf));
773 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "DbG: kfwdl.fwlen = %d\n",
774 	    iocp->name, (int)fwlen));
775 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "DbG: kfwdl.ioc   = %04xh\n",
776 	    iocp->name, ioc));
777 
778 	dlmsg = (FWDownload_t*) mf;
779 	ptsge = (FWDownloadTCSGE_t *) &dlmsg->SGL;
780 	sgOut = (char *) (ptsge + 1);
781 
782 	/*
783 	 * Construct f/w download request
784 	 */
785 	dlmsg->ImageType = MPI_FW_DOWNLOAD_ITYPE_FW;
786 	dlmsg->Reserved = 0;
787 	dlmsg->ChainOffset = 0;
788 	dlmsg->Function = MPI_FUNCTION_FW_DOWNLOAD;
789 	dlmsg->Reserved1[0] = dlmsg->Reserved1[1] = dlmsg->Reserved1[2] = 0;
790 	if (iocp->facts.MsgVersion >= MPI_VERSION_01_05)
791 		dlmsg->MsgFlags = MPI_FW_DOWNLOAD_MSGFLGS_LAST_SEGMENT;
792 	else
793 		dlmsg->MsgFlags = 0;
794 
795 
796 	/* Set up the Transaction SGE.
797 	 */
798 	ptsge->Reserved = 0;
799 	ptsge->ContextSize = 0;
800 	ptsge->DetailsLength = 12;
801 	ptsge->Flags = MPI_SGE_FLAGS_TRANSACTION_ELEMENT;
802 	ptsge->Reserved_0100_Checksum = 0;
803 	ptsge->ImageOffset = 0;
804 	ptsge->ImageSize = cpu_to_le32(fwlen);
805 
806 	/* Add the SGL
807 	 */
808 
809 	/*
810 	 * Need to kmalloc area(s) for holding firmware image bytes.
811 	 * But we need to do it piece meal, using a proper
812 	 * scatter gather list (with 128kB MAX hunks).
813 	 *
814 	 * A practical limit here might be # of sg hunks that fit into
815 	 * a single IOC request frame; 12 or 8 (see below), so:
816 	 * For FC9xx: 12 x 128kB == 1.5 mB (max)
817 	 * For C1030:  8 x 128kB == 1   mB (max)
818 	 * We could support chaining, but things get ugly(ier:)
819 	 *
820 	 * Set the sge_offset to the start of the sgl (bytes).
821 	 */
822 	sgdir = 0x04000000;		/* IOC will READ from sys mem */
823 	sge_offset = sizeof(MPIHeader_t) + sizeof(FWDownloadTCSGE_t);
824 	if ((sgl = kbuf_alloc_2_sgl(fwlen, sgdir, sge_offset,
825 				    &numfrags, &buflist, &sgl_dma, iocp)) == NULL)
826 		return -ENOMEM;
827 
828 	/*
829 	 * We should only need SGL with 2 simple_32bit entries (up to 256 kB)
830 	 * for FC9xx f/w image, but calculate max number of sge hunks
831 	 * we can fit into a request frame, and limit ourselves to that.
832 	 * (currently no chain support)
833 	 * maxfrags = (Request Size - FWdownload Size ) / Size of 32 bit SGE
834 	 *	Request		maxfrags
835 	 *	128		12
836 	 *	96		8
837 	 *	64		4
838 	 */
839 	maxfrags = (iocp->req_sz - sizeof(MPIHeader_t) - sizeof(FWDownloadTCSGE_t))
840 			/ (sizeof(dma_addr_t) + sizeof(u32));
841 	if (numfrags > maxfrags) {
842 		ret = -EMLINK;
843 		goto fwdl_out;
844 	}
845 
846 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "DbG: sgl buffer = %p, sgfrags = %d\n",
847 	    iocp->name, sgl, numfrags));
848 
849 	/*
850 	 * Parse SG list, copying sgl itself,
851 	 * plus f/w image hunks from user space as we go...
852 	 */
853 	ret = -EFAULT;
854 	sgIn = sgl;
855 	bl = buflist;
856 	for (i=0; i < numfrags; i++) {
857 
858 		/* Get the SGE type: 0 - TCSGE, 3 - Chain, 1 - Simple SGE
859 		 * Skip everything but Simple. If simple, copy from
860 		 *	user space into kernel space.
861 		 * Note: we should not have anything but Simple as
862 		 *	Chain SGE are illegal.
863 		 */
864 		nib = (sgIn->FlagsLength & 0x30000000) >> 28;
865 		if (nib == 0 || nib == 3) {
866 			;
867 		} else if (sgIn->Address) {
868 			mpt_add_sge(sgOut, sgIn->FlagsLength, sgIn->Address);
869 			n++;
870 			if (copy_from_user(bl->kptr, ufwbuf+fw_bytes_copied, bl->len)) {
871 				printk(KERN_ERR "%s@%d::_ioctl_fwdl - "
872 						"Unable to copy f/w buffer hunk#%d @ %p\n",
873 						__FILE__, __LINE__, n, ufwbuf);
874 				goto fwdl_out;
875 			}
876 			fw_bytes_copied += bl->len;
877 		}
878 		sgIn++;
879 		bl++;
880 		sgOut += (sizeof(dma_addr_t) + sizeof(u32));
881 	}
882 
883 	DBG_DUMP_FW_DOWNLOAD(iocp, (u32 *)mf, numfrags);
884 
885 	/*
886 	 * Finally, perform firmware download.
887 	 */
888 	ReplyMsg = NULL;
889 	mpt_put_msg_frame(mptctl_id, iocp, mf);
890 
891 	/* Now wait for the command to complete */
892 	ret = wait_event_timeout(mptctl_wait,
893 	     iocp->ioctl->wait_done == 1,
894 	     HZ*60);
895 
896 	if(ret <=0 && (iocp->ioctl->wait_done != 1 )) {
897 	/* Now we need to reset the board */
898 		mptctl_timeout_expired(iocp->ioctl);
899 		ret = -ENODATA;
900 		goto fwdl_out;
901 	}
902 
903 	if (sgl)
904 		kfree_sgl(sgl, sgl_dma, buflist, iocp);
905 
906 	ReplyMsg = (pFWDownloadReply_t)iocp->ioctl->ReplyFrame;
907 	iocstat = le16_to_cpu(ReplyMsg->IOCStatus) & MPI_IOCSTATUS_MASK;
908 	if (iocstat == MPI_IOCSTATUS_SUCCESS) {
909 		printk(KERN_INFO MYNAM ": F/W update successfully sent to %s!\n", iocp->name);
910 		return 0;
911 	} else if (iocstat == MPI_IOCSTATUS_INVALID_FUNCTION) {
912 		printk(KERN_WARNING MYNAM ": ?Hmmm...  %s says it doesn't support F/W download!?!\n",
913 				iocp->name);
914 		printk(KERN_WARNING MYNAM ": (time to go bang on somebodies door)\n");
915 		return -EBADRQC;
916 	} else if (iocstat == MPI_IOCSTATUS_BUSY) {
917 		printk(KERN_WARNING MYNAM ": Warning!  %s says: IOC_BUSY!\n", iocp->name);
918 		printk(KERN_WARNING MYNAM ": (try again later?)\n");
919 		return -EBUSY;
920 	} else {
921 		printk(KERN_WARNING MYNAM "::ioctl_fwdl() ERROR!  %s returned [bad] status = %04xh\n",
922 				    iocp->name, iocstat);
923 		printk(KERN_WARNING MYNAM ": (bad VooDoo)\n");
924 		return -ENOMSG;
925 	}
926 	return 0;
927 
928 fwdl_out:
929         kfree_sgl(sgl, sgl_dma, buflist, iocp);
930 	return ret;
931 }
932 
933 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
934 /*
935  * SGE Allocation routine
936  *
937  * Inputs:	bytes - number of bytes to be transferred
938  *		sgdir - data direction
939  *		sge_offset - offset (in bytes) from the start of the request
940  *			frame to the first SGE
941  *		ioc - pointer to the mptadapter
942  * Outputs:	frags - number of scatter gather elements
943  *		blp - point to the buflist pointer
944  *		sglbuf_dma - pointer to the (dma) sgl
945  * Returns:	Null if failes
946  *		pointer to the (virtual) sgl if successful.
947  */
948 static MptSge_t *
949 kbuf_alloc_2_sgl(int bytes, u32 sgdir, int sge_offset, int *frags,
950 		 struct buflist **blp, dma_addr_t *sglbuf_dma, MPT_ADAPTER *ioc)
951 {
952 	MptSge_t	*sglbuf = NULL;		/* pointer to array of SGE */
953 						/* and chain buffers */
954 	struct buflist	*buflist = NULL;	/* kernel routine */
955 	MptSge_t	*sgl;
956 	int		 numfrags = 0;
957 	int		 fragcnt = 0;
958 	int		 alloc_sz = min(bytes,MAX_KMALLOC_SZ);	// avoid kernel warning msg!
959 	int		 bytes_allocd = 0;
960 	int		 this_alloc;
961 	dma_addr_t	 pa;					// phys addr
962 	int		 i, buflist_ent;
963 	int		 sg_spill = MAX_FRAGS_SPILL1;
964 	int		 dir;
965 	/* initialization */
966 	*frags = 0;
967 	*blp = NULL;
968 
969 	/* Allocate and initialize an array of kernel
970 	 * structures for the SG elements.
971 	 */
972 	i = MAX_SGL_BYTES / 8;
973 	buflist = kmalloc(i, GFP_USER);
974 	if (buflist == NULL)
975 		return NULL;
976 	memset(buflist, 0, i);
977 	buflist_ent = 0;
978 
979 	/* Allocate a single block of memory to store the sg elements and
980 	 * the chain buffers.  The calling routine is responsible for
981 	 * copying the data in this array into the correct place in the
982 	 * request and chain buffers.
983 	 */
984 	sglbuf = pci_alloc_consistent(ioc->pcidev, MAX_SGL_BYTES, sglbuf_dma);
985 	if (sglbuf == NULL)
986 		goto free_and_fail;
987 
988 	if (sgdir & 0x04000000)
989 		dir = PCI_DMA_TODEVICE;
990 	else
991 		dir = PCI_DMA_FROMDEVICE;
992 
993 	/* At start:
994 	 *	sgl = sglbuf = point to beginning of sg buffer
995 	 *	buflist_ent = 0 = first kernel structure
996 	 *	sg_spill = number of SGE that can be written before the first
997 	 *		chain element.
998 	 *
999 	 */
1000 	sgl = sglbuf;
1001 	sg_spill = ((ioc->req_sz - sge_offset)/(sizeof(dma_addr_t) + sizeof(u32))) - 1;
1002 	while (bytes_allocd < bytes) {
1003 		this_alloc = min(alloc_sz, bytes-bytes_allocd);
1004 		buflist[buflist_ent].len = this_alloc;
1005 		buflist[buflist_ent].kptr = pci_alloc_consistent(ioc->pcidev,
1006 								 this_alloc,
1007 								 &pa);
1008 		if (buflist[buflist_ent].kptr == NULL) {
1009 			alloc_sz = alloc_sz / 2;
1010 			if (alloc_sz == 0) {
1011 				printk(KERN_WARNING MYNAM "-SG: No can do - "
1012 						    "not enough memory!   :-(\n");
1013 				printk(KERN_WARNING MYNAM "-SG: (freeing %d frags)\n",
1014 						    numfrags);
1015 				goto free_and_fail;
1016 			}
1017 			continue;
1018 		} else {
1019 			dma_addr_t dma_addr;
1020 
1021 			bytes_allocd += this_alloc;
1022 			sgl->FlagsLength = (0x10000000|MPT_SGE_FLAGS_ADDRESSING|sgdir|this_alloc);
1023 			dma_addr = pci_map_single(ioc->pcidev, buflist[buflist_ent].kptr, this_alloc, dir);
1024 			sgl->Address = dma_addr;
1025 
1026 			fragcnt++;
1027 			numfrags++;
1028 			sgl++;
1029 			buflist_ent++;
1030 		}
1031 
1032 		if (bytes_allocd >= bytes)
1033 			break;
1034 
1035 		/* Need to chain? */
1036 		if (fragcnt == sg_spill) {
1037 			printk(KERN_WARNING MYNAM "-SG: No can do - " "Chain required!   :-(\n");
1038 			printk(KERN_WARNING MYNAM "(freeing %d frags)\n", numfrags);
1039 			goto free_and_fail;
1040 		}
1041 
1042 		/* overflow check... */
1043 		if (numfrags*8 > MAX_SGL_BYTES){
1044 			/* GRRRRR... */
1045 			printk(KERN_WARNING MYNAM "-SG: No can do - "
1046 					    "too many SG frags!   :-(\n");
1047 			printk(KERN_WARNING MYNAM "-SG: (freeing %d frags)\n",
1048 					    numfrags);
1049 			goto free_and_fail;
1050 		}
1051 	}
1052 
1053 	/* Last sge fixup: set LE+eol+eob bits */
1054 	sgl[-1].FlagsLength |= 0xC1000000;
1055 
1056 	*frags = numfrags;
1057 	*blp = buflist;
1058 
1059 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "-SG: kbuf_alloc_2_sgl() - "
1060 	   "%d SG frags generated!\n", ioc->name, numfrags));
1061 
1062 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "-SG: kbuf_alloc_2_sgl() - "
1063 	   "last (big) alloc_sz=%d\n", ioc->name, alloc_sz));
1064 
1065 	return sglbuf;
1066 
1067 free_and_fail:
1068 	if (sglbuf != NULL) {
1069 		int i;
1070 
1071 		for (i = 0; i < numfrags; i++) {
1072 			dma_addr_t dma_addr;
1073 			u8 *kptr;
1074 			int len;
1075 
1076 			if ((sglbuf[i].FlagsLength >> 24) == 0x30)
1077 				continue;
1078 
1079 			dma_addr = sglbuf[i].Address;
1080 			kptr = buflist[i].kptr;
1081 			len = buflist[i].len;
1082 
1083 			pci_free_consistent(ioc->pcidev, len, kptr, dma_addr);
1084 		}
1085 		pci_free_consistent(ioc->pcidev, MAX_SGL_BYTES, sglbuf, *sglbuf_dma);
1086 	}
1087 	kfree(buflist);
1088 	return NULL;
1089 }
1090 
1091 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1092 /*
1093  * Routine to free the SGL elements.
1094  */
1095 static void
1096 kfree_sgl(MptSge_t *sgl, dma_addr_t sgl_dma, struct buflist *buflist, MPT_ADAPTER *ioc)
1097 {
1098 	MptSge_t	*sg = sgl;
1099 	struct buflist	*bl = buflist;
1100 	u32		 nib;
1101 	int		 dir;
1102 	int		 n = 0;
1103 
1104 	if (sg->FlagsLength & 0x04000000)
1105 		dir = PCI_DMA_TODEVICE;
1106 	else
1107 		dir = PCI_DMA_FROMDEVICE;
1108 
1109 	nib = (sg->FlagsLength & 0xF0000000) >> 28;
1110 	while (! (nib & 0x4)) { /* eob */
1111 		/* skip ignore/chain. */
1112 		if (nib == 0 || nib == 3) {
1113 			;
1114 		} else if (sg->Address) {
1115 			dma_addr_t dma_addr;
1116 			void *kptr;
1117 			int len;
1118 
1119 			dma_addr = sg->Address;
1120 			kptr = bl->kptr;
1121 			len = bl->len;
1122 			pci_unmap_single(ioc->pcidev, dma_addr, len, dir);
1123 			pci_free_consistent(ioc->pcidev, len, kptr, dma_addr);
1124 			n++;
1125 		}
1126 		sg++;
1127 		bl++;
1128 		nib = (le32_to_cpu(sg->FlagsLength) & 0xF0000000) >> 28;
1129 	}
1130 
1131 	/* we're at eob! */
1132 	if (sg->Address) {
1133 		dma_addr_t dma_addr;
1134 		void *kptr;
1135 		int len;
1136 
1137 		dma_addr = sg->Address;
1138 		kptr = bl->kptr;
1139 		len = bl->len;
1140 		pci_unmap_single(ioc->pcidev, dma_addr, len, dir);
1141 		pci_free_consistent(ioc->pcidev, len, kptr, dma_addr);
1142 		n++;
1143 	}
1144 
1145 	pci_free_consistent(ioc->pcidev, MAX_SGL_BYTES, sgl, sgl_dma);
1146 	kfree(buflist);
1147 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "-SG: Free'd 1 SGL buf + %d kbufs!\n",
1148 	    ioc->name, n));
1149 }
1150 
1151 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1152 /*
1153  *	mptctl_getiocinfo - Query the host adapter for IOC information.
1154  *	@arg: User space argument
1155  *
1156  * Outputs:	None.
1157  * Return:	0 if successful
1158  *		-EFAULT if data unavailable
1159  *		-ENODEV  if no such device/adapter
1160  */
1161 static int
1162 mptctl_getiocinfo (unsigned long arg, unsigned int data_size)
1163 {
1164 	struct mpt_ioctl_iocinfo __user *uarg = (void __user *) arg;
1165 	struct mpt_ioctl_iocinfo *karg;
1166 	MPT_ADAPTER		*ioc;
1167 	struct pci_dev		*pdev;
1168 	int			iocnum;
1169 	unsigned int		port;
1170 	int			cim_rev;
1171 	u8			revision;
1172 	struct scsi_device 	*sdev;
1173 	VirtDevice		*vdev;
1174 
1175 	/* Add of PCI INFO results in unaligned access for
1176 	 * IA64 and Sparc. Reset long to int. Return no PCI
1177 	 * data for obsolete format.
1178 	 */
1179 	if (data_size == sizeof(struct mpt_ioctl_iocinfo_rev0))
1180 		cim_rev = 0;
1181 	else if (data_size == sizeof(struct mpt_ioctl_iocinfo_rev1))
1182 		cim_rev = 1;
1183 	else if (data_size == sizeof(struct mpt_ioctl_iocinfo))
1184 		cim_rev = 2;
1185 	else if (data_size == (sizeof(struct mpt_ioctl_iocinfo_rev0)+12))
1186 		cim_rev = 0;	/* obsolete */
1187 	else
1188 		return -EFAULT;
1189 
1190 	karg = kmalloc(data_size, GFP_KERNEL);
1191 	if (karg == NULL) {
1192 		printk(KERN_ERR "%s::mpt_ioctl_iocinfo() @%d - no memory available!\n",
1193 				__FILE__, __LINE__);
1194 		return -ENOMEM;
1195 	}
1196 
1197 	if (copy_from_user(karg, uarg, data_size)) {
1198 		printk(KERN_ERR "%s@%d::mptctl_getiocinfo - "
1199 			"Unable to read in mpt_ioctl_iocinfo struct @ %p\n",
1200 				__FILE__, __LINE__, uarg);
1201 		kfree(karg);
1202 		return -EFAULT;
1203 	}
1204 
1205 	if (((iocnum = mpt_verify_adapter(karg->hdr.iocnum, &ioc)) < 0) ||
1206 	    (ioc == NULL)) {
1207 		printk(KERN_DEBUG "%s::mptctl_getiocinfo() @%d - ioc%d not found!\n",
1208 				__FILE__, __LINE__, iocnum);
1209 		kfree(karg);
1210 		return -ENODEV;
1211 	}
1212 
1213 	/* Verify the data transfer size is correct. */
1214 	if (karg->hdr.maxDataSize != data_size) {
1215 		printk(KERN_ERR "%s@%d::mptctl_getiocinfo - "
1216 			"Structure size mismatch. Command not completed.\n",
1217 				__FILE__, __LINE__);
1218 		kfree(karg);
1219 		return -EFAULT;
1220 	}
1221 
1222 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_getiocinfo called.\n",
1223 	    ioc->name));
1224 
1225 	/* Fill in the data and return the structure to the calling
1226 	 * program
1227 	 */
1228 	if (ioc->bus_type == SAS)
1229 		karg->adapterType = MPT_IOCTL_INTERFACE_SAS;
1230 	else if (ioc->bus_type == FC)
1231 		karg->adapterType = MPT_IOCTL_INTERFACE_FC;
1232 	else
1233 		karg->adapterType = MPT_IOCTL_INTERFACE_SCSI;
1234 
1235 	if (karg->hdr.port > 1)
1236 		return -EINVAL;
1237 	port = karg->hdr.port;
1238 
1239 	karg->port = port;
1240 	pdev = (struct pci_dev *) ioc->pcidev;
1241 
1242 	karg->pciId = pdev->device;
1243 	pci_read_config_byte(pdev, PCI_CLASS_REVISION, &revision);
1244 	karg->hwRev = revision;
1245 	karg->subSystemDevice = pdev->subsystem_device;
1246 	karg->subSystemVendor = pdev->subsystem_vendor;
1247 
1248 	if (cim_rev == 1) {
1249 		/* Get the PCI bus, device, and function numbers for the IOC
1250 		 */
1251 		karg->pciInfo.u.bits.busNumber = pdev->bus->number;
1252 		karg->pciInfo.u.bits.deviceNumber = PCI_SLOT( pdev->devfn );
1253 		karg->pciInfo.u.bits.functionNumber = PCI_FUNC( pdev->devfn );
1254 	} else if (cim_rev == 2) {
1255 		/* Get the PCI bus, device, function and segment ID numbers
1256 		   for the IOC */
1257 		karg->pciInfo.u.bits.busNumber = pdev->bus->number;
1258 		karg->pciInfo.u.bits.deviceNumber = PCI_SLOT( pdev->devfn );
1259 		karg->pciInfo.u.bits.functionNumber = PCI_FUNC( pdev->devfn );
1260 		karg->pciInfo.segmentID = pci_domain_nr(pdev->bus);
1261 	}
1262 
1263 	/* Get number of devices
1264          */
1265 	karg->numDevices = 0;
1266 	if (ioc->sh) {
1267 		shost_for_each_device(sdev, ioc->sh) {
1268 			vdev = sdev->hostdata;
1269 			if (vdev->vtarget->tflags &
1270 			    MPT_TARGET_FLAGS_RAID_COMPONENT)
1271 				continue;
1272 			karg->numDevices++;
1273 		}
1274 	}
1275 
1276 	/* Set the BIOS and FW Version
1277 	 */
1278 	karg->FWVersion = ioc->facts.FWVersion.Word;
1279 	karg->BIOSVersion = ioc->biosVersion;
1280 
1281 	/* Set the Version Strings.
1282 	 */
1283 	strncpy (karg->driverVersion, MPT_LINUX_PACKAGE_NAME, MPT_IOCTL_VERSION_LENGTH);
1284 	karg->driverVersion[MPT_IOCTL_VERSION_LENGTH-1]='\0';
1285 
1286 	karg->busChangeEvent = 0;
1287 	karg->hostId = ioc->pfacts[port].PortSCSIID;
1288 	karg->rsvd[0] = karg->rsvd[1] = 0;
1289 
1290 	/* Copy the data from kernel memory to user memory
1291 	 */
1292 	if (copy_to_user((char __user *)arg, karg, data_size)) {
1293 		printk(KERN_ERR "%s@%d::mptctl_getiocinfo - "
1294 			"Unable to write out mpt_ioctl_iocinfo struct @ %p\n",
1295 				__FILE__, __LINE__, uarg);
1296 		kfree(karg);
1297 		return -EFAULT;
1298 	}
1299 
1300 	kfree(karg);
1301 	return 0;
1302 }
1303 
1304 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1305 /*
1306  *	mptctl_gettargetinfo - Query the host adapter for target information.
1307  *	@arg: User space argument
1308  *
1309  * Outputs:	None.
1310  * Return:	0 if successful
1311  *		-EFAULT if data unavailable
1312  *		-ENODEV  if no such device/adapter
1313  */
1314 static int
1315 mptctl_gettargetinfo (unsigned long arg)
1316 {
1317 	struct mpt_ioctl_targetinfo __user *uarg = (void __user *) arg;
1318 	struct mpt_ioctl_targetinfo karg;
1319 	MPT_ADAPTER		*ioc;
1320 	VirtDevice		*vdev;
1321 	char			*pmem;
1322 	int			*pdata;
1323 	int			iocnum;
1324 	int			numDevices = 0;
1325 	int			lun;
1326 	int			maxWordsLeft;
1327 	int			numBytes;
1328 	u8			port;
1329 	struct scsi_device 	*sdev;
1330 
1331 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_targetinfo))) {
1332 		printk(KERN_ERR "%s@%d::mptctl_gettargetinfo - "
1333 			"Unable to read in mpt_ioctl_targetinfo struct @ %p\n",
1334 				__FILE__, __LINE__, uarg);
1335 		return -EFAULT;
1336 	}
1337 
1338 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
1339 	    (ioc == NULL)) {
1340 		printk(KERN_DEBUG "%s::mptctl_gettargetinfo() @%d - ioc%d not found!\n",
1341 				__FILE__, __LINE__, iocnum);
1342 		return -ENODEV;
1343 	}
1344 
1345 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_gettargetinfo called.\n",
1346 	    ioc->name));
1347 	/* Get the port number and set the maximum number of bytes
1348 	 * in the returned structure.
1349 	 * Ignore the port setting.
1350 	 */
1351 	numBytes = karg.hdr.maxDataSize - sizeof(mpt_ioctl_header);
1352 	maxWordsLeft = numBytes/sizeof(int);
1353 	port = karg.hdr.port;
1354 
1355 	if (maxWordsLeft <= 0) {
1356 		printk(KERN_ERR "%s::mptctl_gettargetinfo() @%d - no memory available!\n",
1357 				__FILE__, __LINE__);
1358 		return -ENOMEM;
1359 	}
1360 
1361 	/* Fill in the data and return the structure to the calling
1362 	 * program
1363 	 */
1364 
1365 	/* struct mpt_ioctl_targetinfo does not contain sufficient space
1366 	 * for the target structures so when the IOCTL is called, there is
1367 	 * not sufficient stack space for the structure. Allocate memory,
1368 	 * populate the memory, copy back to the user, then free memory.
1369 	 * targetInfo format:
1370 	 * bits 31-24: reserved
1371 	 *      23-16: LUN
1372 	 *      15- 8: Bus Number
1373 	 *       7- 0: Target ID
1374 	 */
1375 	pmem = kmalloc(numBytes, GFP_KERNEL);
1376 	if (pmem == NULL) {
1377 		printk(KERN_ERR "%s::mptctl_gettargetinfo() @%d - no memory available!\n",
1378 				__FILE__, __LINE__);
1379 		return -ENOMEM;
1380 	}
1381 	memset(pmem, 0, numBytes);
1382 	pdata =  (int *) pmem;
1383 
1384 	/* Get number of devices
1385          */
1386 	if (ioc->sh){
1387 		shost_for_each_device(sdev, ioc->sh) {
1388 			if (!maxWordsLeft)
1389 				continue;
1390 			vdev = sdev->hostdata;
1391 			if (vdev->vtarget->tflags &
1392 			    MPT_TARGET_FLAGS_RAID_COMPONENT)
1393 				continue;
1394 			lun = (vdev->vtarget->raidVolume) ? 0x80 : vdev->lun;
1395 			*pdata = (((u8)lun << 16) + (vdev->vtarget->channel << 8) +
1396 			    (vdev->vtarget->id ));
1397 			pdata++;
1398 			numDevices++;
1399 			--maxWordsLeft;
1400 		}
1401 	}
1402 	karg.numDevices = numDevices;
1403 
1404 	/* Copy part of the data from kernel memory to user memory
1405 	 */
1406 	if (copy_to_user((char __user *)arg, &karg,
1407 				sizeof(struct mpt_ioctl_targetinfo))) {
1408 		printk(KERN_ERR "%s@%d::mptctl_gettargetinfo - "
1409 			"Unable to write out mpt_ioctl_targetinfo struct @ %p\n",
1410 				__FILE__, __LINE__, uarg);
1411 		kfree(pmem);
1412 		return -EFAULT;
1413 	}
1414 
1415 	/* Copy the remaining data from kernel memory to user memory
1416 	 */
1417 	if (copy_to_user(uarg->targetInfo, pmem, numBytes)) {
1418 		printk(KERN_ERR "%s@%d::mptctl_gettargetinfo - "
1419 			"Unable to write out mpt_ioctl_targetinfo struct @ %p\n",
1420 				__FILE__, __LINE__, pdata);
1421 		kfree(pmem);
1422 		return -EFAULT;
1423 	}
1424 
1425 	kfree(pmem);
1426 
1427 	return 0;
1428 }
1429 
1430 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1431 /* MPT IOCTL Test function.
1432  *
1433  * Outputs:	None.
1434  * Return:	0 if successful
1435  *		-EFAULT if data unavailable
1436  *		-ENODEV  if no such device/adapter
1437  */
1438 static int
1439 mptctl_readtest (unsigned long arg)
1440 {
1441 	struct mpt_ioctl_test __user *uarg = (void __user *) arg;
1442 	struct mpt_ioctl_test	 karg;
1443 	MPT_ADAPTER *ioc;
1444 	int iocnum;
1445 
1446 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_test))) {
1447 		printk(KERN_ERR "%s@%d::mptctl_readtest - "
1448 			"Unable to read in mpt_ioctl_test struct @ %p\n",
1449 				__FILE__, __LINE__, uarg);
1450 		return -EFAULT;
1451 	}
1452 
1453 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
1454 	    (ioc == NULL)) {
1455 		printk(KERN_DEBUG "%s::mptctl_readtest() @%d - ioc%d not found!\n",
1456 				__FILE__, __LINE__, iocnum);
1457 		return -ENODEV;
1458 	}
1459 
1460 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_readtest called.\n",
1461 	    ioc->name));
1462 	/* Fill in the data and return the structure to the calling
1463 	 * program
1464 	 */
1465 
1466 #ifdef MFCNT
1467 	karg.chip_type = ioc->mfcnt;
1468 #else
1469 	karg.chip_type = ioc->pcidev->device;
1470 #endif
1471 	strncpy (karg.name, ioc->name, MPT_MAX_NAME);
1472 	karg.name[MPT_MAX_NAME-1]='\0';
1473 	strncpy (karg.product, ioc->prod_name, MPT_PRODUCT_LENGTH);
1474 	karg.product[MPT_PRODUCT_LENGTH-1]='\0';
1475 
1476 	/* Copy the data from kernel memory to user memory
1477 	 */
1478 	if (copy_to_user((char __user *)arg, &karg, sizeof(struct mpt_ioctl_test))) {
1479 		printk(KERN_ERR "%s@%d::mptctl_readtest - "
1480 			"Unable to write out mpt_ioctl_test struct @ %p\n",
1481 				__FILE__, __LINE__, uarg);
1482 		return -EFAULT;
1483 	}
1484 
1485 	return 0;
1486 }
1487 
1488 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1489 /*
1490  *	mptctl_eventquery - Query the host adapter for the event types
1491  *	that are being logged.
1492  *	@arg: User space argument
1493  *
1494  * Outputs:	None.
1495  * Return:	0 if successful
1496  *		-EFAULT if data unavailable
1497  *		-ENODEV  if no such device/adapter
1498  */
1499 static int
1500 mptctl_eventquery (unsigned long arg)
1501 {
1502 	struct mpt_ioctl_eventquery __user *uarg = (void __user *) arg;
1503 	struct mpt_ioctl_eventquery	 karg;
1504 	MPT_ADAPTER *ioc;
1505 	int iocnum;
1506 
1507 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_eventquery))) {
1508 		printk(KERN_ERR "%s@%d::mptctl_eventquery - "
1509 			"Unable to read in mpt_ioctl_eventquery struct @ %p\n",
1510 				__FILE__, __LINE__, uarg);
1511 		return -EFAULT;
1512 	}
1513 
1514 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
1515 	    (ioc == NULL)) {
1516 		printk(KERN_DEBUG "%s::mptctl_eventquery() @%d - ioc%d not found!\n",
1517 				__FILE__, __LINE__, iocnum);
1518 		return -ENODEV;
1519 	}
1520 
1521 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_eventquery called.\n",
1522 	    ioc->name));
1523 	karg.eventEntries = MPTCTL_EVENT_LOG_SIZE;
1524 	karg.eventTypes = ioc->eventTypes;
1525 
1526 	/* Copy the data from kernel memory to user memory
1527 	 */
1528 	if (copy_to_user((char __user *)arg, &karg, sizeof(struct mpt_ioctl_eventquery))) {
1529 		printk(KERN_ERR "%s@%d::mptctl_eventquery - "
1530 			"Unable to write out mpt_ioctl_eventquery struct @ %p\n",
1531 				__FILE__, __LINE__, uarg);
1532 		return -EFAULT;
1533 	}
1534 	return 0;
1535 }
1536 
1537 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1538 static int
1539 mptctl_eventenable (unsigned long arg)
1540 {
1541 	struct mpt_ioctl_eventenable __user *uarg = (void __user *) arg;
1542 	struct mpt_ioctl_eventenable	 karg;
1543 	MPT_ADAPTER *ioc;
1544 	int iocnum;
1545 
1546 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_eventenable))) {
1547 		printk(KERN_ERR "%s@%d::mptctl_eventenable - "
1548 			"Unable to read in mpt_ioctl_eventenable struct @ %p\n",
1549 				__FILE__, __LINE__, uarg);
1550 		return -EFAULT;
1551 	}
1552 
1553 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
1554 	    (ioc == NULL)) {
1555 		printk(KERN_DEBUG "%s::mptctl_eventenable() @%d - ioc%d not found!\n",
1556 				__FILE__, __LINE__, iocnum);
1557 		return -ENODEV;
1558 	}
1559 
1560 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_eventenable called.\n",
1561 	    ioc->name));
1562 	if (ioc->events == NULL) {
1563 		/* Have not yet allocated memory - do so now.
1564 		 */
1565 		int sz = MPTCTL_EVENT_LOG_SIZE * sizeof(MPT_IOCTL_EVENTS);
1566 		ioc->events = kmalloc(sz, GFP_KERNEL);
1567 		if (ioc->events == NULL) {
1568 			printk(KERN_ERR MYNAM ": ERROR - Insufficient memory to add adapter!\n");
1569 			return -ENOMEM;
1570 		}
1571 		memset(ioc->events, 0, sz);
1572 		ioc->alloc_total += sz;
1573 
1574 		ioc->eventContext = 0;
1575         }
1576 
1577 	/* Update the IOC event logging flag.
1578 	 */
1579 	ioc->eventTypes = karg.eventTypes;
1580 
1581 	return 0;
1582 }
1583 
1584 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1585 static int
1586 mptctl_eventreport (unsigned long arg)
1587 {
1588 	struct mpt_ioctl_eventreport __user *uarg = (void __user *) arg;
1589 	struct mpt_ioctl_eventreport	 karg;
1590 	MPT_ADAPTER		 *ioc;
1591 	int			 iocnum;
1592 	int			 numBytes, maxEvents, max;
1593 
1594 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_eventreport))) {
1595 		printk(KERN_ERR "%s@%d::mptctl_eventreport - "
1596 			"Unable to read in mpt_ioctl_eventreport struct @ %p\n",
1597 				__FILE__, __LINE__, uarg);
1598 		return -EFAULT;
1599 	}
1600 
1601 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
1602 	    (ioc == NULL)) {
1603 		printk(KERN_DEBUG "%s::mptctl_eventreport() @%d - ioc%d not found!\n",
1604 				__FILE__, __LINE__, iocnum);
1605 		return -ENODEV;
1606 	}
1607 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_eventreport called.\n",
1608 	    ioc->name));
1609 
1610 	numBytes = karg.hdr.maxDataSize - sizeof(mpt_ioctl_header);
1611 	maxEvents = numBytes/sizeof(MPT_IOCTL_EVENTS);
1612 
1613 
1614 	max = MPTCTL_EVENT_LOG_SIZE < maxEvents ? MPTCTL_EVENT_LOG_SIZE : maxEvents;
1615 
1616 	/* If fewer than 1 event is requested, there must have
1617 	 * been some type of error.
1618 	 */
1619 	if ((max < 1) || !ioc->events)
1620 		return -ENODATA;
1621 
1622 	/* reset this flag so SIGIO can restart */
1623 	ioc->aen_event_read_flag=0;
1624 
1625 	/* Copy the data from kernel memory to user memory
1626 	 */
1627 	numBytes = max * sizeof(MPT_IOCTL_EVENTS);
1628 	if (copy_to_user(uarg->eventData, ioc->events, numBytes)) {
1629 		printk(KERN_ERR "%s@%d::mptctl_eventreport - "
1630 			"Unable to write out mpt_ioctl_eventreport struct @ %p\n",
1631 				__FILE__, __LINE__, ioc->events);
1632 		return -EFAULT;
1633 	}
1634 
1635 	return 0;
1636 }
1637 
1638 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1639 static int
1640 mptctl_replace_fw (unsigned long arg)
1641 {
1642 	struct mpt_ioctl_replace_fw __user *uarg = (void __user *) arg;
1643 	struct mpt_ioctl_replace_fw	 karg;
1644 	MPT_ADAPTER		 *ioc;
1645 	int			 iocnum;
1646 	int			 newFwSize;
1647 
1648 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_replace_fw))) {
1649 		printk(KERN_ERR "%s@%d::mptctl_replace_fw - "
1650 			"Unable to read in mpt_ioctl_replace_fw struct @ %p\n",
1651 				__FILE__, __LINE__, uarg);
1652 		return -EFAULT;
1653 	}
1654 
1655 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
1656 	    (ioc == NULL)) {
1657 		printk(KERN_DEBUG "%s::mptctl_replace_fw() @%d - ioc%d not found!\n",
1658 				__FILE__, __LINE__, iocnum);
1659 		return -ENODEV;
1660 	}
1661 
1662 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_replace_fw called.\n",
1663 	    ioc->name));
1664 	/* If caching FW, Free the old FW image
1665 	 */
1666 	if (ioc->cached_fw == NULL)
1667 		return 0;
1668 
1669 	mpt_free_fw_memory(ioc);
1670 
1671 	/* Allocate memory for the new FW image
1672 	 */
1673 	newFwSize = karg.newImageSize;
1674 
1675 	if (newFwSize & 0x01)
1676 		newFwSize += 1;
1677 	if (newFwSize & 0x02)
1678 		newFwSize += 2;
1679 
1680 	mpt_alloc_fw_memory(ioc, newFwSize);
1681 	if (ioc->cached_fw == NULL)
1682 		return -ENOMEM;
1683 
1684 	/* Copy the data from user memory to kernel space
1685 	 */
1686 	if (copy_from_user(ioc->cached_fw, uarg->newImage, newFwSize)) {
1687 		printk(KERN_ERR "%s@%d::mptctl_replace_fw - "
1688 				"Unable to read in mpt_ioctl_replace_fw image "
1689 				"@ %p\n", __FILE__, __LINE__, uarg);
1690 		mpt_free_fw_memory(ioc);
1691 		return -EFAULT;
1692 	}
1693 
1694 	/* Update IOCFactsReply
1695 	 */
1696 	ioc->facts.FWImageSize = newFwSize;
1697 	return 0;
1698 }
1699 
1700 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1701 /* MPT IOCTL MPTCOMMAND function.
1702  * Cast the arg into the mpt_ioctl_mpt_command structure.
1703  *
1704  * Outputs:	None.
1705  * Return:	0 if successful
1706  *		-EBUSY  if previous command timout and IOC reset is not complete.
1707  *		-EFAULT if data unavailable
1708  *		-ENODEV if no such device/adapter
1709  *		-ETIME	if timer expires
1710  *		-ENOMEM if memory allocation error
1711  */
1712 static int
1713 mptctl_mpt_command (unsigned long arg)
1714 {
1715 	struct mpt_ioctl_command __user *uarg = (void __user *) arg;
1716 	struct mpt_ioctl_command  karg;
1717 	MPT_ADAPTER	*ioc;
1718 	int		iocnum;
1719 	int		rc;
1720 
1721 
1722 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_command))) {
1723 		printk(KERN_ERR "%s@%d::mptctl_mpt_command - "
1724 			"Unable to read in mpt_ioctl_command struct @ %p\n",
1725 				__FILE__, __LINE__, uarg);
1726 		return -EFAULT;
1727 	}
1728 
1729 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
1730 	    (ioc == NULL)) {
1731 		printk(KERN_DEBUG "%s::mptctl_mpt_command() @%d - ioc%d not found!\n",
1732 				__FILE__, __LINE__, iocnum);
1733 		return -ENODEV;
1734 	}
1735 
1736 	rc = mptctl_do_mpt_command (karg, &uarg->MF);
1737 
1738 	return rc;
1739 }
1740 
1741 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1742 /* Worker routine for the IOCTL MPTCOMMAND and MPTCOMMAND32 (sparc) commands.
1743  *
1744  * Outputs:	None.
1745  * Return:	0 if successful
1746  *		-EBUSY  if previous command timout and IOC reset is not complete.
1747  *		-EFAULT if data unavailable
1748  *		-ENODEV if no such device/adapter
1749  *		-ETIME	if timer expires
1750  *		-ENOMEM if memory allocation error
1751  *		-EPERM if SCSI I/O and target is untagged
1752  */
1753 static int
1754 mptctl_do_mpt_command (struct mpt_ioctl_command karg, void __user *mfPtr)
1755 {
1756 	MPT_ADAPTER	*ioc;
1757 	MPT_FRAME_HDR	*mf = NULL;
1758 	MPIHeader_t	*hdr;
1759 	char		*psge;
1760 	struct buflist	bufIn;	/* data In buffer */
1761 	struct buflist	bufOut; /* data Out buffer */
1762 	dma_addr_t	dma_addr_in;
1763 	dma_addr_t	dma_addr_out;
1764 	int		sgSize = 0;	/* Num SG elements */
1765 	int		iocnum, flagsLength;
1766 	int		sz, rc = 0;
1767 	int		msgContext;
1768 	u16		req_idx;
1769 	ulong 		timeout;
1770 	struct scsi_device *sdev;
1771 
1772 	bufIn.kptr = bufOut.kptr = NULL;
1773 
1774 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
1775 	    (ioc == NULL)) {
1776 		printk(KERN_DEBUG "%s::mptctl_do_mpt_command() @%d - ioc%d not found!\n",
1777 				__FILE__, __LINE__, iocnum);
1778 		return -ENODEV;
1779 	}
1780 	if (!ioc->ioctl) {
1781 		printk(KERN_ERR "%s@%d::mptctl_do_mpt_command - "
1782 			"No memory available during driver init.\n",
1783 				__FILE__, __LINE__);
1784 		return -ENOMEM;
1785 	} else if (ioc->ioctl->status & MPT_IOCTL_STATUS_DID_IOCRESET) {
1786 		printk(KERN_ERR "%s@%d::mptctl_do_mpt_command - "
1787 			"Busy with IOC Reset \n", __FILE__, __LINE__);
1788 		return -EBUSY;
1789 	}
1790 
1791 	/* Verify that the final request frame will not be too large.
1792 	 */
1793 	sz = karg.dataSgeOffset * 4;
1794 	if (karg.dataInSize > 0)
1795 		sz += sizeof(dma_addr_t) + sizeof(u32);
1796 	if (karg.dataOutSize > 0)
1797 		sz += sizeof(dma_addr_t) + sizeof(u32);
1798 
1799 	if (sz > ioc->req_sz) {
1800 		printk(KERN_ERR "%s@%d::mptctl_do_mpt_command - "
1801 			"Request frame too large (%d) maximum (%d)\n",
1802 				__FILE__, __LINE__, sz, ioc->req_sz);
1803 		return -EFAULT;
1804 	}
1805 
1806 	/* Get a free request frame and save the message context.
1807 	 */
1808         if ((mf = mpt_get_msg_frame(mptctl_id, ioc)) == NULL)
1809                 return -EAGAIN;
1810 
1811 	hdr = (MPIHeader_t *) mf;
1812 	msgContext = le32_to_cpu(hdr->MsgContext);
1813 	req_idx = le16_to_cpu(mf->u.frame.hwhdr.msgctxu.fld.req_idx);
1814 
1815 	/* Copy the request frame
1816 	 * Reset the saved message context.
1817 	 * Request frame in user space
1818 	 */
1819 	if (copy_from_user(mf, mfPtr, karg.dataSgeOffset * 4)) {
1820 		printk(KERN_ERR "%s@%d::mptctl_do_mpt_command - "
1821 			"Unable to read MF from mpt_ioctl_command struct @ %p\n",
1822 			__FILE__, __LINE__, mfPtr);
1823 		rc = -EFAULT;
1824 		goto done_free_mem;
1825 	}
1826 	hdr->MsgContext = cpu_to_le32(msgContext);
1827 
1828 
1829 	/* Verify that this request is allowed.
1830 	 */
1831 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sending mpi function (0x%02X), req=%p\n",
1832 	    ioc->name, hdr->Function, mf));
1833 
1834 	switch (hdr->Function) {
1835 	case MPI_FUNCTION_IOC_FACTS:
1836 	case MPI_FUNCTION_PORT_FACTS:
1837 		karg.dataOutSize  = karg.dataInSize = 0;
1838 		break;
1839 
1840 	case MPI_FUNCTION_CONFIG:
1841 	{
1842 		Config_t *config_frame;
1843 		config_frame = (Config_t *)mf;
1844 		dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "\ttype=0x%02x ext_type=0x%02x "
1845 		    "number=0x%02x action=0x%02x\n", ioc->name,
1846 		    config_frame->Header.PageType,
1847 		    config_frame->ExtPageType,
1848 		    config_frame->Header.PageNumber,
1849 		    config_frame->Action));
1850 		break;
1851 	}
1852 
1853 	case MPI_FUNCTION_FC_COMMON_TRANSPORT_SEND:
1854 	case MPI_FUNCTION_FC_EX_LINK_SRVC_SEND:
1855 	case MPI_FUNCTION_FW_UPLOAD:
1856 	case MPI_FUNCTION_SCSI_ENCLOSURE_PROCESSOR:
1857 	case MPI_FUNCTION_FW_DOWNLOAD:
1858 	case MPI_FUNCTION_FC_PRIMITIVE_SEND:
1859 	case MPI_FUNCTION_TOOLBOX:
1860 	case MPI_FUNCTION_SAS_IO_UNIT_CONTROL:
1861 		break;
1862 
1863 	case MPI_FUNCTION_SCSI_IO_REQUEST:
1864 		if (ioc->sh) {
1865 			SCSIIORequest_t *pScsiReq = (SCSIIORequest_t *) mf;
1866 			int qtag = MPI_SCSIIO_CONTROL_UNTAGGED;
1867 			int scsidir = 0;
1868 			int dataSize;
1869 			u32 id;
1870 
1871 			id = (ioc->devices_per_bus == 0) ? 256 : ioc->devices_per_bus;
1872 			if (pScsiReq->TargetID > id) {
1873 				printk(KERN_ERR "%s@%d::mptctl_do_mpt_command - "
1874 					"Target ID out of bounds. \n",
1875 					__FILE__, __LINE__);
1876 				rc = -ENODEV;
1877 				goto done_free_mem;
1878 			}
1879 
1880 			if (pScsiReq->Bus >= ioc->number_of_buses) {
1881 				printk(KERN_ERR "%s@%d::mptctl_do_mpt_command - "
1882 					"Target Bus out of bounds. \n",
1883 					__FILE__, __LINE__);
1884 				rc = -ENODEV;
1885 				goto done_free_mem;
1886 			}
1887 
1888 			pScsiReq->MsgFlags &= ~MPI_SCSIIO_MSGFLGS_SENSE_WIDTH;
1889 			pScsiReq->MsgFlags |= mpt_msg_flags();
1890 
1891 
1892 			/* verify that app has not requested
1893 			 *	more sense data than driver
1894 			 *	can provide, if so, reset this parameter
1895 			 * set the sense buffer pointer low address
1896 			 * update the control field to specify Q type
1897 			 */
1898 			if (karg.maxSenseBytes > MPT_SENSE_BUFFER_SIZE)
1899 				pScsiReq->SenseBufferLength = MPT_SENSE_BUFFER_SIZE;
1900 			else
1901 				pScsiReq->SenseBufferLength = karg.maxSenseBytes;
1902 
1903 			pScsiReq->SenseBufferLowAddr =
1904 				cpu_to_le32(ioc->sense_buf_low_dma
1905 				   + (req_idx * MPT_SENSE_BUFFER_ALLOC));
1906 
1907 			shost_for_each_device(sdev, ioc->sh) {
1908 				struct scsi_target *starget = scsi_target(sdev);
1909 				VirtTarget *vtarget = starget->hostdata;
1910 
1911 				if ((pScsiReq->TargetID == vtarget->id) &&
1912 				    (pScsiReq->Bus == vtarget->channel) &&
1913 				    (vtarget->tflags & MPT_TARGET_FLAGS_Q_YES))
1914 					qtag = MPI_SCSIIO_CONTROL_SIMPLEQ;
1915 			}
1916 
1917 			/* Have the IOCTL driver set the direction based
1918 			 * on the dataOutSize (ordering issue with Sparc).
1919 			 */
1920 			if (karg.dataOutSize > 0) {
1921 				scsidir = MPI_SCSIIO_CONTROL_WRITE;
1922 				dataSize = karg.dataOutSize;
1923 			} else {
1924 				scsidir = MPI_SCSIIO_CONTROL_READ;
1925 				dataSize = karg.dataInSize;
1926 			}
1927 
1928 			pScsiReq->Control = cpu_to_le32(scsidir | qtag);
1929 			pScsiReq->DataLength = cpu_to_le32(dataSize);
1930 
1931 			ioc->ioctl->reset = MPTCTL_RESET_OK;
1932 			ioc->ioctl->id = pScsiReq->TargetID;
1933 
1934 		} else {
1935 			printk(KERN_ERR "%s@%d::mptctl_do_mpt_command - "
1936 				"SCSI driver is not loaded. \n",
1937 					__FILE__, __LINE__);
1938 			rc = -EFAULT;
1939 			goto done_free_mem;
1940 		}
1941 		break;
1942 
1943 	case MPI_FUNCTION_SMP_PASSTHROUGH:
1944 		/* Check mf->PassthruFlags to determine if
1945 		 * transfer is ImmediateMode or not.
1946 		 * Immediate mode returns data in the ReplyFrame.
1947 		 * Else, we are sending request and response data
1948 		 * in two SGLs at the end of the mf.
1949 		 */
1950 		break;
1951 
1952 	case MPI_FUNCTION_SATA_PASSTHROUGH:
1953 		if (!ioc->sh) {
1954 			printk(KERN_ERR "%s@%d::mptctl_do_mpt_command - "
1955 				"SCSI driver is not loaded. \n",
1956 					__FILE__, __LINE__);
1957 			rc = -EFAULT;
1958 			goto done_free_mem;
1959 		}
1960 		break;
1961 
1962 	case MPI_FUNCTION_RAID_ACTION:
1963 		/* Just add a SGE
1964 		 */
1965 		break;
1966 
1967 	case MPI_FUNCTION_RAID_SCSI_IO_PASSTHROUGH:
1968 		if (ioc->sh) {
1969 			SCSIIORequest_t *pScsiReq = (SCSIIORequest_t *) mf;
1970 			int qtag = MPI_SCSIIO_CONTROL_SIMPLEQ;
1971 			int scsidir = MPI_SCSIIO_CONTROL_READ;
1972 			int dataSize;
1973 
1974 			pScsiReq->MsgFlags &= ~MPI_SCSIIO_MSGFLGS_SENSE_WIDTH;
1975 			pScsiReq->MsgFlags |= mpt_msg_flags();
1976 
1977 
1978 			/* verify that app has not requested
1979 			 *	more sense data than driver
1980 			 *	can provide, if so, reset this parameter
1981 			 * set the sense buffer pointer low address
1982 			 * update the control field to specify Q type
1983 			 */
1984 			if (karg.maxSenseBytes > MPT_SENSE_BUFFER_SIZE)
1985 				pScsiReq->SenseBufferLength = MPT_SENSE_BUFFER_SIZE;
1986 			else
1987 				pScsiReq->SenseBufferLength = karg.maxSenseBytes;
1988 
1989 			pScsiReq->SenseBufferLowAddr =
1990 				cpu_to_le32(ioc->sense_buf_low_dma
1991 				   + (req_idx * MPT_SENSE_BUFFER_ALLOC));
1992 
1993 			/* All commands to physical devices are tagged
1994 			 */
1995 
1996 			/* Have the IOCTL driver set the direction based
1997 			 * on the dataOutSize (ordering issue with Sparc).
1998 			 */
1999 			if (karg.dataOutSize > 0) {
2000 				scsidir = MPI_SCSIIO_CONTROL_WRITE;
2001 				dataSize = karg.dataOutSize;
2002 			} else {
2003 				scsidir = MPI_SCSIIO_CONTROL_READ;
2004 				dataSize = karg.dataInSize;
2005 			}
2006 
2007 			pScsiReq->Control = cpu_to_le32(scsidir | qtag);
2008 			pScsiReq->DataLength = cpu_to_le32(dataSize);
2009 
2010 			ioc->ioctl->reset = MPTCTL_RESET_OK;
2011 			ioc->ioctl->id = pScsiReq->TargetID;
2012 		} else {
2013 			printk(KERN_ERR "%s@%d::mptctl_do_mpt_command - "
2014 				"SCSI driver is not loaded. \n",
2015 					__FILE__, __LINE__);
2016 			rc = -EFAULT;
2017 			goto done_free_mem;
2018 		}
2019 		break;
2020 
2021 	case MPI_FUNCTION_SCSI_TASK_MGMT:
2022 		{
2023 			MPT_SCSI_HOST *hd = NULL;
2024 			if ((ioc->sh == NULL) || ((hd = (MPT_SCSI_HOST *)ioc->sh->hostdata) == NULL)) {
2025 				printk(KERN_ERR "%s@%d::mptctl_do_mpt_command - "
2026 					"SCSI driver not loaded or SCSI host not found. \n",
2027 					__FILE__, __LINE__);
2028 				rc = -EFAULT;
2029 				goto done_free_mem;
2030 			} else if (mptctl_set_tm_flags(hd) != 0) {
2031 				rc = -EPERM;
2032 				goto done_free_mem;
2033 			}
2034 		}
2035 		break;
2036 
2037 	case MPI_FUNCTION_IOC_INIT:
2038 		{
2039 			IOCInit_t	*pInit = (IOCInit_t *) mf;
2040 			u32		high_addr, sense_high;
2041 
2042 			/* Verify that all entries in the IOC INIT match
2043 			 * existing setup (and in LE format).
2044 			 */
2045 			if (sizeof(dma_addr_t) == sizeof(u64)) {
2046 				high_addr = cpu_to_le32((u32)((u64)ioc->req_frames_dma >> 32));
2047 				sense_high= cpu_to_le32((u32)((u64)ioc->sense_buf_pool_dma >> 32));
2048 			} else {
2049 				high_addr = 0;
2050 				sense_high= 0;
2051 			}
2052 
2053 			if ((pInit->Flags != 0) || (pInit->MaxDevices != ioc->facts.MaxDevices) ||
2054 				(pInit->MaxBuses != ioc->facts.MaxBuses) ||
2055 				(pInit->ReplyFrameSize != cpu_to_le16(ioc->reply_sz)) ||
2056 				(pInit->HostMfaHighAddr != high_addr) ||
2057 				(pInit->SenseBufferHighAddr != sense_high)) {
2058 				printk(KERN_ERR "%s@%d::mptctl_do_mpt_command - "
2059 					"IOC_INIT issued with 1 or more incorrect parameters. Rejected.\n",
2060 					__FILE__, __LINE__);
2061 				rc = -EFAULT;
2062 				goto done_free_mem;
2063 			}
2064 		}
2065 		break;
2066 	default:
2067 		/*
2068 		 * MPI_FUNCTION_PORT_ENABLE
2069 		 * MPI_FUNCTION_TARGET_CMD_BUFFER_POST
2070 		 * MPI_FUNCTION_TARGET_ASSIST
2071 		 * MPI_FUNCTION_TARGET_STATUS_SEND
2072 		 * MPI_FUNCTION_TARGET_MODE_ABORT
2073 		 * MPI_FUNCTION_IOC_MESSAGE_UNIT_RESET
2074 		 * MPI_FUNCTION_IO_UNIT_RESET
2075 		 * MPI_FUNCTION_HANDSHAKE
2076 		 * MPI_FUNCTION_REPLY_FRAME_REMOVAL
2077 		 * MPI_FUNCTION_EVENT_NOTIFICATION
2078 		 *  (driver handles event notification)
2079 		 * MPI_FUNCTION_EVENT_ACK
2080 		 */
2081 
2082 		/*  What to do with these???  CHECK ME!!!
2083 			MPI_FUNCTION_FC_LINK_SRVC_BUF_POST
2084 			MPI_FUNCTION_FC_LINK_SRVC_RSP
2085 			MPI_FUNCTION_FC_ABORT
2086 			MPI_FUNCTION_LAN_SEND
2087 			MPI_FUNCTION_LAN_RECEIVE
2088 		 	MPI_FUNCTION_LAN_RESET
2089 		*/
2090 
2091 		printk(KERN_ERR "%s@%d::mptctl_do_mpt_command - "
2092 			"Illegal request (function 0x%x) \n",
2093 			__FILE__, __LINE__, hdr->Function);
2094 		rc = -EFAULT;
2095 		goto done_free_mem;
2096 	}
2097 
2098 	/* Add the SGL ( at most one data in SGE and one data out SGE )
2099 	 * In the case of two SGE's - the data out (write) will always
2100 	 * preceede the data in (read) SGE. psgList is used to free the
2101 	 * allocated memory.
2102 	 */
2103 	psge = (char *) (((int *) mf) + karg.dataSgeOffset);
2104 	flagsLength = 0;
2105 
2106 	/* bufIn and bufOut are used for user to kernel space transfers
2107 	 */
2108 	bufIn.kptr = bufOut.kptr = NULL;
2109 	bufIn.len = bufOut.len = 0;
2110 
2111 	if (karg.dataOutSize > 0)
2112 		sgSize ++;
2113 
2114 	if (karg.dataInSize > 0)
2115 		sgSize ++;
2116 
2117 	if (sgSize > 0) {
2118 
2119 		/* Set up the dataOut memory allocation */
2120 		if (karg.dataOutSize > 0) {
2121 			if (karg.dataInSize > 0) {
2122 				flagsLength = ( MPI_SGE_FLAGS_SIMPLE_ELEMENT |
2123 						MPI_SGE_FLAGS_END_OF_BUFFER |
2124 						MPI_SGE_FLAGS_DIRECTION |
2125 						mpt_addr_size() )
2126 						<< MPI_SGE_FLAGS_SHIFT;
2127 			} else {
2128 				flagsLength = MPT_SGE_FLAGS_SSIMPLE_WRITE;
2129 			}
2130 			flagsLength |= karg.dataOutSize;
2131 			bufOut.len = karg.dataOutSize;
2132 			bufOut.kptr = pci_alloc_consistent(
2133 					ioc->pcidev, bufOut.len, &dma_addr_out);
2134 
2135 			if (bufOut.kptr == NULL) {
2136 				rc = -ENOMEM;
2137 				goto done_free_mem;
2138 			} else {
2139 				/* Set up this SGE.
2140 				 * Copy to MF and to sglbuf
2141 				 */
2142 				mpt_add_sge(psge, flagsLength, dma_addr_out);
2143 				psge += (sizeof(u32) + sizeof(dma_addr_t));
2144 
2145 				/* Copy user data to kernel space.
2146 				 */
2147 				if (copy_from_user(bufOut.kptr,
2148 						karg.dataOutBufPtr,
2149 						bufOut.len)) {
2150 					printk(KERN_ERR
2151 						"%s@%d::mptctl_do_mpt_command - Unable "
2152 						"to read user data "
2153 						"struct @ %p\n",
2154 						__FILE__, __LINE__,karg.dataOutBufPtr);
2155 					rc =  -EFAULT;
2156 					goto done_free_mem;
2157 				}
2158 			}
2159 		}
2160 
2161 		if (karg.dataInSize > 0) {
2162 			flagsLength = MPT_SGE_FLAGS_SSIMPLE_READ;
2163 			flagsLength |= karg.dataInSize;
2164 
2165 			bufIn.len = karg.dataInSize;
2166 			bufIn.kptr = pci_alloc_consistent(ioc->pcidev,
2167 					bufIn.len, &dma_addr_in);
2168 
2169 			if (bufIn.kptr == NULL) {
2170 				rc = -ENOMEM;
2171 				goto done_free_mem;
2172 			} else {
2173 				/* Set up this SGE
2174 				 * Copy to MF and to sglbuf
2175 				 */
2176 				mpt_add_sge(psge, flagsLength, dma_addr_in);
2177 			}
2178 		}
2179 	} else  {
2180 		/* Add a NULL SGE
2181 		 */
2182 		mpt_add_sge(psge, flagsLength, (dma_addr_t) -1);
2183 	}
2184 
2185 	ioc->ioctl->wait_done = 0;
2186 	if (hdr->Function == MPI_FUNCTION_SCSI_TASK_MGMT) {
2187 
2188 		DBG_DUMP_TM_REQUEST_FRAME(ioc, (u32 *)mf);
2189 
2190 		if (mpt_send_handshake_request(mptctl_id, ioc,
2191 			sizeof(SCSITaskMgmt_t), (u32*)mf,
2192 			CAN_SLEEP) != 0) {
2193 			dfailprintk(ioc, printk(MYIOC_s_ERR_FMT "_send_handshake FAILED!"
2194 				" (ioc %p, mf %p) \n", ioc->name,
2195 				ioc, mf));
2196 			mptctl_free_tm_flags(ioc);
2197 			rc = -ENODATA;
2198 			goto done_free_mem;
2199 		}
2200 
2201 	} else
2202 		mpt_put_msg_frame(mptctl_id, ioc, mf);
2203 
2204 	/* Now wait for the command to complete */
2205 	timeout = (karg.timeout > 0) ? karg.timeout : MPT_IOCTL_DEFAULT_TIMEOUT;
2206 	timeout = wait_event_timeout(mptctl_wait,
2207 	     ioc->ioctl->wait_done == 1,
2208 	     HZ*timeout);
2209 
2210 	if(timeout <=0 && (ioc->ioctl->wait_done != 1 )) {
2211 	/* Now we need to reset the board */
2212 
2213 		if (hdr->Function == MPI_FUNCTION_SCSI_TASK_MGMT)
2214 			mptctl_free_tm_flags(ioc);
2215 
2216 		mptctl_timeout_expired(ioc->ioctl);
2217 		rc = -ENODATA;
2218 		goto done_free_mem;
2219 	}
2220 
2221 	mf = NULL;
2222 
2223 	/* If a valid reply frame, copy to the user.
2224 	 * Offset 2: reply length in U32's
2225 	 */
2226 	if (ioc->ioctl->status & MPT_IOCTL_STATUS_RF_VALID) {
2227 		if (karg.maxReplyBytes < ioc->reply_sz) {
2228 			 sz = min(karg.maxReplyBytes, 4*ioc->ioctl->ReplyFrame[2]);
2229 		} else {
2230 			 sz = min(ioc->reply_sz, 4*ioc->ioctl->ReplyFrame[2]);
2231 		}
2232 
2233 		if (sz > 0) {
2234 			if (copy_to_user(karg.replyFrameBufPtr,
2235 				 &ioc->ioctl->ReplyFrame, sz)){
2236 				 printk(KERN_ERR
2237 				     "%s@%d::mptctl_do_mpt_command - "
2238 				 "Unable to write out reply frame %p\n",
2239 				 __FILE__, __LINE__, karg.replyFrameBufPtr);
2240 				 rc =  -ENODATA;
2241 				 goto done_free_mem;
2242 			}
2243 		}
2244 	}
2245 
2246 	/* If valid sense data, copy to user.
2247 	 */
2248 	if (ioc->ioctl->status & MPT_IOCTL_STATUS_SENSE_VALID) {
2249 		sz = min(karg.maxSenseBytes, MPT_SENSE_BUFFER_SIZE);
2250 		if (sz > 0) {
2251 			if (copy_to_user(karg.senseDataPtr, ioc->ioctl->sense, sz)) {
2252 				printk(KERN_ERR "%s@%d::mptctl_do_mpt_command - "
2253 				"Unable to write sense data to user %p\n",
2254 				__FILE__, __LINE__,
2255 				karg.senseDataPtr);
2256 				rc =  -ENODATA;
2257 				goto done_free_mem;
2258 			}
2259 		}
2260 	}
2261 
2262 	/* If the overall status is _GOOD and data in, copy data
2263 	 * to user.
2264 	 */
2265 	if ((ioc->ioctl->status & MPT_IOCTL_STATUS_COMMAND_GOOD) &&
2266 				(karg.dataInSize > 0) && (bufIn.kptr)) {
2267 
2268 		if (copy_to_user(karg.dataInBufPtr,
2269 				 bufIn.kptr, karg.dataInSize)) {
2270 			printk(KERN_ERR "%s@%d::mptctl_do_mpt_command - "
2271 				"Unable to write data to user %p\n",
2272 				__FILE__, __LINE__,
2273 				karg.dataInBufPtr);
2274 			rc =  -ENODATA;
2275 		}
2276 	}
2277 
2278 done_free_mem:
2279 
2280 	ioc->ioctl->status &= ~(MPT_IOCTL_STATUS_COMMAND_GOOD |
2281 		MPT_IOCTL_STATUS_SENSE_VALID |
2282 		MPT_IOCTL_STATUS_RF_VALID );
2283 
2284 	/* Free the allocated memory.
2285 	 */
2286 	if (bufOut.kptr != NULL) {
2287 		pci_free_consistent(ioc->pcidev,
2288 			bufOut.len, (void *) bufOut.kptr, dma_addr_out);
2289 	}
2290 
2291 	if (bufIn.kptr != NULL) {
2292 		pci_free_consistent(ioc->pcidev,
2293 			bufIn.len, (void *) bufIn.kptr, dma_addr_in);
2294 	}
2295 
2296 	/* mf is null if command issued successfully
2297 	 * otherwise, failure occured after mf acquired.
2298 	 */
2299 	if (mf)
2300 		mpt_free_msg_frame(ioc, mf);
2301 
2302 	return rc;
2303 }
2304 
2305 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2306 /* Prototype Routine for the HOST INFO command.
2307  *
2308  * Outputs:	None.
2309  * Return:	0 if successful
2310  *		-EFAULT if data unavailable
2311  *		-EBUSY  if previous command timout and IOC reset is not complete.
2312  *		-ENODEV if no such device/adapter
2313  *		-ETIME	if timer expires
2314  *		-ENOMEM if memory allocation error
2315  */
2316 static int
2317 mptctl_hp_hostinfo(unsigned long arg, unsigned int data_size)
2318 {
2319 	hp_host_info_t	__user *uarg = (void __user *) arg;
2320 	MPT_ADAPTER		*ioc;
2321 	struct pci_dev		*pdev;
2322 	char                    *pbuf=NULL;
2323 	dma_addr_t		buf_dma;
2324 	hp_host_info_t		karg;
2325 	CONFIGPARMS		cfg;
2326 	ConfigPageHeader_t	hdr;
2327 	int			iocnum;
2328 	int			rc, cim_rev;
2329 	ToolboxIstwiReadWriteRequest_t	*IstwiRWRequest;
2330 	MPT_FRAME_HDR		*mf = NULL;
2331 	MPIHeader_t		*mpi_hdr;
2332 
2333 	/* Reset long to int. Should affect IA64 and SPARC only
2334 	 */
2335 	if (data_size == sizeof(hp_host_info_t))
2336 		cim_rev = 1;
2337 	else if (data_size == sizeof(hp_host_info_rev0_t))
2338 		cim_rev = 0;	/* obsolete */
2339 	else
2340 		return -EFAULT;
2341 
2342 	if (copy_from_user(&karg, uarg, sizeof(hp_host_info_t))) {
2343 		printk(KERN_ERR "%s@%d::mptctl_hp_host_info - "
2344 			"Unable to read in hp_host_info struct @ %p\n",
2345 				__FILE__, __LINE__, uarg);
2346 		return -EFAULT;
2347 	}
2348 
2349 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
2350 	    (ioc == NULL)) {
2351 		printk(KERN_DEBUG "%s::mptctl_hp_hostinfo() @%d - ioc%d not found!\n",
2352 				__FILE__, __LINE__, iocnum);
2353 		return -ENODEV;
2354 	}
2355 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT ": mptctl_hp_hostinfo called.\n",
2356 	    ioc->name));
2357 
2358 	/* Fill in the data and return the structure to the calling
2359 	 * program
2360 	 */
2361 	pdev = (struct pci_dev *) ioc->pcidev;
2362 
2363 	karg.vendor = pdev->vendor;
2364 	karg.device = pdev->device;
2365 	karg.subsystem_id = pdev->subsystem_device;
2366 	karg.subsystem_vendor = pdev->subsystem_vendor;
2367 	karg.devfn = pdev->devfn;
2368 	karg.bus = pdev->bus->number;
2369 
2370 	/* Save the SCSI host no. if
2371 	 * SCSI driver loaded
2372 	 */
2373 	if (ioc->sh != NULL)
2374 		karg.host_no = ioc->sh->host_no;
2375 	else
2376 		karg.host_no =  -1;
2377 
2378 	/* Reformat the fw_version into a string
2379 	 */
2380 	karg.fw_version[0] = ioc->facts.FWVersion.Struct.Major >= 10 ?
2381 		((ioc->facts.FWVersion.Struct.Major / 10) + '0') : '0';
2382 	karg.fw_version[1] = (ioc->facts.FWVersion.Struct.Major % 10 ) + '0';
2383 	karg.fw_version[2] = '.';
2384 	karg.fw_version[3] = ioc->facts.FWVersion.Struct.Minor >= 10 ?
2385 		((ioc->facts.FWVersion.Struct.Minor / 10) + '0') : '0';
2386 	karg.fw_version[4] = (ioc->facts.FWVersion.Struct.Minor % 10 ) + '0';
2387 	karg.fw_version[5] = '.';
2388 	karg.fw_version[6] = ioc->facts.FWVersion.Struct.Unit >= 10 ?
2389 		((ioc->facts.FWVersion.Struct.Unit / 10) + '0') : '0';
2390 	karg.fw_version[7] = (ioc->facts.FWVersion.Struct.Unit % 10 ) + '0';
2391 	karg.fw_version[8] = '.';
2392 	karg.fw_version[9] = ioc->facts.FWVersion.Struct.Dev >= 10 ?
2393 		((ioc->facts.FWVersion.Struct.Dev / 10) + '0') : '0';
2394 	karg.fw_version[10] = (ioc->facts.FWVersion.Struct.Dev % 10 ) + '0';
2395 	karg.fw_version[11] = '\0';
2396 
2397 	/* Issue a config request to get the device serial number
2398 	 */
2399 	hdr.PageVersion = 0;
2400 	hdr.PageLength = 0;
2401 	hdr.PageNumber = 0;
2402 	hdr.PageType = MPI_CONFIG_PAGETYPE_MANUFACTURING;
2403 	cfg.cfghdr.hdr = &hdr;
2404 	cfg.physAddr = -1;
2405 	cfg.pageAddr = 0;
2406 	cfg.action = MPI_CONFIG_ACTION_PAGE_HEADER;
2407 	cfg.dir = 0;	/* read */
2408 	cfg.timeout = 10;
2409 
2410 	strncpy(karg.serial_number, " ", 24);
2411 	if (mpt_config(ioc, &cfg) == 0) {
2412 		if (cfg.cfghdr.hdr->PageLength > 0) {
2413 			/* Issue the second config page request */
2414 			cfg.action = MPI_CONFIG_ACTION_PAGE_READ_CURRENT;
2415 
2416 			pbuf = pci_alloc_consistent(ioc->pcidev, hdr.PageLength * 4, &buf_dma);
2417 			if (pbuf) {
2418 				cfg.physAddr = buf_dma;
2419 				if (mpt_config(ioc, &cfg) == 0) {
2420 					ManufacturingPage0_t *pdata = (ManufacturingPage0_t *) pbuf;
2421 					if (strlen(pdata->BoardTracerNumber) > 1) {
2422 						strncpy(karg.serial_number, 									    pdata->BoardTracerNumber, 24);
2423 						karg.serial_number[24-1]='\0';
2424 					}
2425 				}
2426 				pci_free_consistent(ioc->pcidev, hdr.PageLength * 4, pbuf, buf_dma);
2427 				pbuf = NULL;
2428 			}
2429 		}
2430 	}
2431 	rc = mpt_GetIocState(ioc, 1);
2432 	switch (rc) {
2433 	case MPI_IOC_STATE_OPERATIONAL:
2434 		karg.ioc_status =  HP_STATUS_OK;
2435 		break;
2436 
2437 	case MPI_IOC_STATE_FAULT:
2438 		karg.ioc_status =  HP_STATUS_FAILED;
2439 		break;
2440 
2441 	case MPI_IOC_STATE_RESET:
2442 	case MPI_IOC_STATE_READY:
2443 	default:
2444 		karg.ioc_status =  HP_STATUS_OTHER;
2445 		break;
2446 	}
2447 
2448 	karg.base_io_addr = pci_resource_start(pdev, 0);
2449 
2450 	if ((ioc->bus_type == SAS) || (ioc->bus_type == FC))
2451 		karg.bus_phys_width = HP_BUS_WIDTH_UNK;
2452 	else
2453 		karg.bus_phys_width = HP_BUS_WIDTH_16;
2454 
2455 	karg.hard_resets = 0;
2456 	karg.soft_resets = 0;
2457 	karg.timeouts = 0;
2458 	if (ioc->sh != NULL) {
2459 		MPT_SCSI_HOST *hd =  (MPT_SCSI_HOST *)ioc->sh->hostdata;
2460 
2461 		if (hd && (cim_rev == 1)) {
2462 			karg.hard_resets = hd->hard_resets;
2463 			karg.soft_resets = hd->soft_resets;
2464 			karg.timeouts = hd->timeouts;
2465 		}
2466 	}
2467 
2468 	/*
2469 	 * Gather ISTWI(Industry Standard Two Wire Interface) Data
2470 	 */
2471 	if ((mf = mpt_get_msg_frame(mptctl_id, ioc)) == NULL) {
2472 		dfailprintk(ioc, printk(MYIOC_s_WARN_FMT "%s, no msg frames!!\n",
2473 		    ioc->name,__FUNCTION__));
2474 		goto out;
2475 	}
2476 
2477 	IstwiRWRequest = (ToolboxIstwiReadWriteRequest_t *)mf;
2478 	mpi_hdr = (MPIHeader_t *) mf;
2479 	memset(IstwiRWRequest,0,sizeof(ToolboxIstwiReadWriteRequest_t));
2480 	IstwiRWRequest->Function = MPI_FUNCTION_TOOLBOX;
2481 	IstwiRWRequest->Tool = MPI_TOOLBOX_ISTWI_READ_WRITE_TOOL;
2482 	IstwiRWRequest->MsgContext = mpi_hdr->MsgContext;
2483 	IstwiRWRequest->Flags = MPI_TB_ISTWI_FLAGS_READ;
2484 	IstwiRWRequest->NumAddressBytes = 0x01;
2485 	IstwiRWRequest->DataLength = cpu_to_le16(0x04);
2486 	if (pdev->devfn & 1)
2487 		IstwiRWRequest->DeviceAddr = 0xB2;
2488 	else
2489 		IstwiRWRequest->DeviceAddr = 0xB0;
2490 
2491 	pbuf = pci_alloc_consistent(ioc->pcidev, 4, &buf_dma);
2492 	if (!pbuf)
2493 		goto out;
2494 	mpt_add_sge((char *)&IstwiRWRequest->SGL,
2495 	    (MPT_SGE_FLAGS_SSIMPLE_READ|4), buf_dma);
2496 
2497 	ioc->ioctl->wait_done = 0;
2498 	mpt_put_msg_frame(mptctl_id, ioc, mf);
2499 
2500 	rc = wait_event_timeout(mptctl_wait,
2501 	     ioc->ioctl->wait_done == 1,
2502 	     HZ*MPT_IOCTL_DEFAULT_TIMEOUT /* 10 sec */);
2503 
2504 	if(rc <=0 && (ioc->ioctl->wait_done != 1 )) {
2505 		/*
2506 		 * Now we need to reset the board
2507 		 */
2508 		mpt_free_msg_frame(ioc, mf);
2509 		mptctl_timeout_expired(ioc->ioctl);
2510 		goto out;
2511 	}
2512 
2513 	/*
2514 	 *ISTWI Data Definition
2515 	 * pbuf[0] = FW_VERSION = 0x4
2516 	 * pbuf[1] = Bay Count = 6 or 4 or 2, depending on
2517 	 *  the config, you should be seeing one out of these three values
2518 	 * pbuf[2] = Drive Installed Map = bit pattern depend on which
2519 	 *   bays have drives in them
2520 	 * pbuf[3] = Checksum (0x100 = (byte0 + byte2 + byte3)
2521 	 */
2522 	if (ioc->ioctl->status & MPT_IOCTL_STATUS_RF_VALID)
2523 		karg.rsvd = *(u32 *)pbuf;
2524 
2525  out:
2526 	if (pbuf)
2527 		pci_free_consistent(ioc->pcidev, 4, pbuf, buf_dma);
2528 
2529 	/* Copy the data from kernel memory to user memory
2530 	 */
2531 	if (copy_to_user((char __user *)arg, &karg, sizeof(hp_host_info_t))) {
2532 		printk(KERN_ERR "%s@%d::mptctl_hpgethostinfo - "
2533 			"Unable to write out hp_host_info @ %p\n",
2534 				__FILE__, __LINE__, uarg);
2535 		return -EFAULT;
2536 	}
2537 
2538 	return 0;
2539 
2540 }
2541 
2542 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2543 /* Prototype Routine for the TARGET INFO command.
2544  *
2545  * Outputs:	None.
2546  * Return:	0 if successful
2547  *		-EFAULT if data unavailable
2548  *		-EBUSY  if previous command timout and IOC reset is not complete.
2549  *		-ENODEV if no such device/adapter
2550  *		-ETIME	if timer expires
2551  *		-ENOMEM if memory allocation error
2552  */
2553 static int
2554 mptctl_hp_targetinfo(unsigned long arg)
2555 {
2556 	hp_target_info_t __user *uarg = (void __user *) arg;
2557 	SCSIDevicePage0_t	*pg0_alloc;
2558 	SCSIDevicePage3_t	*pg3_alloc;
2559 	MPT_ADAPTER		*ioc;
2560 	MPT_SCSI_HOST 		*hd = NULL;
2561 	hp_target_info_t	karg;
2562 	int			iocnum;
2563 	int			data_sz;
2564 	dma_addr_t		page_dma;
2565 	CONFIGPARMS	 	cfg;
2566 	ConfigPageHeader_t	hdr;
2567 	int			tmp, np, rc = 0;
2568 
2569 	if (copy_from_user(&karg, uarg, sizeof(hp_target_info_t))) {
2570 		printk(KERN_ERR "%s@%d::mptctl_hp_targetinfo - "
2571 			"Unable to read in hp_host_targetinfo struct @ %p\n",
2572 				__FILE__, __LINE__, uarg);
2573 		return -EFAULT;
2574 	}
2575 
2576 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
2577 		(ioc == NULL)) {
2578 		printk(KERN_DEBUG "%s::mptctl_hp_targetinfo() @%d - ioc%d not found!\n",
2579 				__FILE__, __LINE__, iocnum);
2580 		return -ENODEV;
2581 	}
2582 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT ": mptctl_hp_targetinfo called.\n",
2583 	    ioc->name));
2584 
2585 	/*  There is nothing to do for FCP parts.
2586 	 */
2587 	if ((ioc->bus_type == SAS) || (ioc->bus_type == FC))
2588 		return 0;
2589 
2590 	if ((ioc->spi_data.sdp0length == 0) || (ioc->sh == NULL))
2591 		return 0;
2592 
2593 	if (ioc->sh->host_no != karg.hdr.host)
2594 		return -ENODEV;
2595 
2596        /* Get the data transfer speeds
2597         */
2598 	data_sz = ioc->spi_data.sdp0length * 4;
2599 	pg0_alloc = (SCSIDevicePage0_t *) pci_alloc_consistent(ioc->pcidev, data_sz, &page_dma);
2600 	if (pg0_alloc) {
2601 		hdr.PageVersion = ioc->spi_data.sdp0version;
2602 		hdr.PageLength = data_sz;
2603 		hdr.PageNumber = 0;
2604 		hdr.PageType = MPI_CONFIG_PAGETYPE_SCSI_DEVICE;
2605 
2606 		cfg.cfghdr.hdr = &hdr;
2607 		cfg.action = MPI_CONFIG_ACTION_PAGE_READ_CURRENT;
2608 		cfg.dir = 0;
2609 		cfg.timeout = 0;
2610 		cfg.physAddr = page_dma;
2611 
2612 		cfg.pageAddr = (karg.hdr.channel << 8) | karg.hdr.id;
2613 
2614 		if ((rc = mpt_config(ioc, &cfg)) == 0) {
2615 			np = le32_to_cpu(pg0_alloc->NegotiatedParameters);
2616 			karg.negotiated_width = np & MPI_SCSIDEVPAGE0_NP_WIDE ?
2617 					HP_BUS_WIDTH_16 : HP_BUS_WIDTH_8;
2618 
2619 			if (np & MPI_SCSIDEVPAGE0_NP_NEG_SYNC_OFFSET_MASK) {
2620 				tmp = (np & MPI_SCSIDEVPAGE0_NP_NEG_SYNC_PERIOD_MASK) >> 8;
2621 				if (tmp < 0x09)
2622 					karg.negotiated_speed = HP_DEV_SPEED_ULTRA320;
2623 				else if (tmp <= 0x09)
2624 					karg.negotiated_speed = HP_DEV_SPEED_ULTRA160;
2625 				else if (tmp <= 0x0A)
2626 					karg.negotiated_speed = HP_DEV_SPEED_ULTRA2;
2627 				else if (tmp <= 0x0C)
2628 					karg.negotiated_speed = HP_DEV_SPEED_ULTRA;
2629 				else if (tmp <= 0x25)
2630 					karg.negotiated_speed = HP_DEV_SPEED_FAST;
2631 				else
2632 					karg.negotiated_speed = HP_DEV_SPEED_ASYNC;
2633 			} else
2634 				karg.negotiated_speed = HP_DEV_SPEED_ASYNC;
2635 		}
2636 
2637 		pci_free_consistent(ioc->pcidev, data_sz, (u8 *) pg0_alloc, page_dma);
2638 	}
2639 
2640 	/* Set defaults
2641 	 */
2642 	karg.message_rejects = -1;
2643 	karg.phase_errors = -1;
2644 	karg.parity_errors = -1;
2645 	karg.select_timeouts = -1;
2646 
2647 	/* Get the target error parameters
2648 	 */
2649 	hdr.PageVersion = 0;
2650 	hdr.PageLength = 0;
2651 	hdr.PageNumber = 3;
2652 	hdr.PageType = MPI_CONFIG_PAGETYPE_SCSI_DEVICE;
2653 
2654 	cfg.cfghdr.hdr = &hdr;
2655 	cfg.action = MPI_CONFIG_ACTION_PAGE_HEADER;
2656 	cfg.dir = 0;
2657 	cfg.timeout = 0;
2658 	cfg.physAddr = -1;
2659 	if ((mpt_config(ioc, &cfg) == 0) && (cfg.cfghdr.hdr->PageLength > 0)) {
2660 		/* Issue the second config page request */
2661 		cfg.action = MPI_CONFIG_ACTION_PAGE_READ_CURRENT;
2662 		data_sz = (int) cfg.cfghdr.hdr->PageLength * 4;
2663 		pg3_alloc = (SCSIDevicePage3_t *) pci_alloc_consistent(
2664 							ioc->pcidev, data_sz, &page_dma);
2665 		if (pg3_alloc) {
2666 			cfg.physAddr = page_dma;
2667 			cfg.pageAddr = (karg.hdr.channel << 8) | karg.hdr.id;
2668 			if ((rc = mpt_config(ioc, &cfg)) == 0) {
2669 				karg.message_rejects = (u32) le16_to_cpu(pg3_alloc->MsgRejectCount);
2670 				karg.phase_errors = (u32) le16_to_cpu(pg3_alloc->PhaseErrorCount);
2671 				karg.parity_errors = (u32) le16_to_cpu(pg3_alloc->ParityErrorCount);
2672 			}
2673 			pci_free_consistent(ioc->pcidev, data_sz, (u8 *) pg3_alloc, page_dma);
2674 		}
2675 	}
2676 	hd = (MPT_SCSI_HOST *) ioc->sh->hostdata;
2677 	if (hd != NULL)
2678 		karg.select_timeouts = hd->sel_timeout[karg.hdr.id];
2679 
2680 	/* Copy the data from kernel memory to user memory
2681 	 */
2682 	if (copy_to_user((char __user *)arg, &karg, sizeof(hp_target_info_t))) {
2683 		printk(KERN_ERR "%s@%d::mptctl_hp_target_info - "
2684 			"Unable to write out mpt_ioctl_targetinfo struct @ %p\n",
2685 				__FILE__, __LINE__, uarg);
2686 		return -EFAULT;
2687 	}
2688 
2689 	return 0;
2690 }
2691 
2692 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2693 
2694 static const struct file_operations mptctl_fops = {
2695 	.owner =	THIS_MODULE,
2696 	.llseek =	no_llseek,
2697 	.release =	mptctl_release,
2698 	.fasync = 	mptctl_fasync,
2699 	.unlocked_ioctl = mptctl_ioctl,
2700 #ifdef CONFIG_COMPAT
2701 	.compat_ioctl = compat_mpctl_ioctl,
2702 #endif
2703 };
2704 
2705 static struct miscdevice mptctl_miscdev = {
2706 	MPT_MINOR,
2707 	MYNAM,
2708 	&mptctl_fops
2709 };
2710 
2711 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2712 
2713 #ifdef CONFIG_COMPAT
2714 
2715 static int
2716 compat_mptfwxfer_ioctl(struct file *filp, unsigned int cmd,
2717 			unsigned long arg)
2718 {
2719 	struct mpt_fw_xfer32 kfw32;
2720 	struct mpt_fw_xfer kfw;
2721 	MPT_ADAPTER *iocp = NULL;
2722 	int iocnum, iocnumX;
2723 	int nonblock = (filp->f_flags & O_NONBLOCK);
2724 	int ret;
2725 
2726 
2727 	if (copy_from_user(&kfw32, (char __user *)arg, sizeof(kfw32)))
2728 		return -EFAULT;
2729 
2730 	/* Verify intended MPT adapter */
2731 	iocnumX = kfw32.iocnum & 0xFF;
2732 	if (((iocnum = mpt_verify_adapter(iocnumX, &iocp)) < 0) ||
2733 	    (iocp == NULL)) {
2734 		printk(KERN_DEBUG MYNAM "::compat_mptfwxfer_ioctl @%d - ioc%d not found!\n",
2735 				__LINE__, iocnumX);
2736 		return -ENODEV;
2737 	}
2738 
2739 	if ((ret = mptctl_syscall_down(iocp, nonblock)) != 0)
2740 		return ret;
2741 
2742 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "compat_mptfwxfer_ioctl() called\n",
2743 	    iocp->name));
2744 	kfw.iocnum = iocnum;
2745 	kfw.fwlen = kfw32.fwlen;
2746 	kfw.bufp = compat_ptr(kfw32.bufp);
2747 
2748 	ret = mptctl_do_fw_download(kfw.iocnum, kfw.bufp, kfw.fwlen);
2749 
2750 	mutex_unlock(&iocp->ioctl->ioctl_mutex);
2751 
2752 	return ret;
2753 }
2754 
2755 static int
2756 compat_mpt_command(struct file *filp, unsigned int cmd,
2757 			unsigned long arg)
2758 {
2759 	struct mpt_ioctl_command32 karg32;
2760 	struct mpt_ioctl_command32 __user *uarg = (struct mpt_ioctl_command32 __user *) arg;
2761 	struct mpt_ioctl_command karg;
2762 	MPT_ADAPTER *iocp = NULL;
2763 	int iocnum, iocnumX;
2764 	int nonblock = (filp->f_flags & O_NONBLOCK);
2765 	int ret;
2766 
2767 	if (copy_from_user(&karg32, (char __user *)arg, sizeof(karg32)))
2768 		return -EFAULT;
2769 
2770 	/* Verify intended MPT adapter */
2771 	iocnumX = karg32.hdr.iocnum & 0xFF;
2772 	if (((iocnum = mpt_verify_adapter(iocnumX, &iocp)) < 0) ||
2773 	    (iocp == NULL)) {
2774 		printk(KERN_DEBUG MYNAM "::compat_mpt_command @%d - ioc%d not found!\n",
2775 				__LINE__, iocnumX);
2776 		return -ENODEV;
2777 	}
2778 
2779 	if ((ret = mptctl_syscall_down(iocp, nonblock)) != 0)
2780 		return ret;
2781 
2782 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "compat_mpt_command() called\n",
2783 	    iocp->name));
2784 	/* Copy data to karg */
2785 	karg.hdr.iocnum = karg32.hdr.iocnum;
2786 	karg.hdr.port = karg32.hdr.port;
2787 	karg.timeout = karg32.timeout;
2788 	karg.maxReplyBytes = karg32.maxReplyBytes;
2789 
2790 	karg.dataInSize = karg32.dataInSize;
2791 	karg.dataOutSize = karg32.dataOutSize;
2792 	karg.maxSenseBytes = karg32.maxSenseBytes;
2793 	karg.dataSgeOffset = karg32.dataSgeOffset;
2794 
2795 	karg.replyFrameBufPtr = (char __user *)(unsigned long)karg32.replyFrameBufPtr;
2796 	karg.dataInBufPtr = (char __user *)(unsigned long)karg32.dataInBufPtr;
2797 	karg.dataOutBufPtr = (char __user *)(unsigned long)karg32.dataOutBufPtr;
2798 	karg.senseDataPtr = (char __user *)(unsigned long)karg32.senseDataPtr;
2799 
2800 	/* Pass new structure to do_mpt_command
2801 	 */
2802 	ret = mptctl_do_mpt_command (karg, &uarg->MF);
2803 
2804 	mutex_unlock(&iocp->ioctl->ioctl_mutex);
2805 
2806 	return ret;
2807 }
2808 
2809 static long compat_mpctl_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
2810 {
2811 	long ret;
2812 	lock_kernel();
2813 	switch (cmd) {
2814 	case MPTIOCINFO:
2815 	case MPTIOCINFO1:
2816 	case MPTIOCINFO2:
2817 	case MPTTARGETINFO:
2818 	case MPTEVENTQUERY:
2819 	case MPTEVENTENABLE:
2820 	case MPTEVENTREPORT:
2821 	case MPTHARDRESET:
2822 	case HP_GETHOSTINFO:
2823 	case HP_GETTARGETINFO:
2824 	case MPTTEST:
2825 		ret = __mptctl_ioctl(f, cmd, arg);
2826 		break;
2827 	case MPTCOMMAND32:
2828 		ret = compat_mpt_command(f, cmd, arg);
2829 		break;
2830 	case MPTFWDOWNLOAD32:
2831 		ret = compat_mptfwxfer_ioctl(f, cmd, arg);
2832 		break;
2833 	default:
2834 		ret = -ENOIOCTLCMD;
2835 		break;
2836 	}
2837 	unlock_kernel();
2838 	return ret;
2839 }
2840 
2841 #endif
2842 
2843 
2844 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2845 /*
2846  *	mptctl_probe - Installs ioctl devices per bus.
2847  *	@pdev: Pointer to pci_dev structure
2848  *
2849  *	Returns 0 for success, non-zero for failure.
2850  *
2851  */
2852 
2853 static int
2854 mptctl_probe(struct pci_dev *pdev, const struct pci_device_id *id)
2855 {
2856 	int err;
2857 	int sz;
2858 	u8 *mem;
2859 	MPT_ADAPTER *ioc = pci_get_drvdata(pdev);
2860 
2861 	/*
2862 	 * Allocate and inite a MPT_IOCTL structure
2863 	*/
2864 	sz = sizeof (MPT_IOCTL);
2865 	mem = kmalloc(sz, GFP_KERNEL);
2866 	if (mem == NULL) {
2867 		err = -ENOMEM;
2868 		goto out_fail;
2869 	}
2870 
2871 	memset(mem, 0, sz);
2872 	ioc->ioctl = (MPT_IOCTL *) mem;
2873 	ioc->ioctl->ioc = ioc;
2874 	mutex_init(&ioc->ioctl->ioctl_mutex);
2875 	return 0;
2876 
2877 out_fail:
2878 
2879 	mptctl_remove(pdev);
2880 	return err;
2881 }
2882 
2883 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2884 /*
2885  *	mptctl_remove - Removed ioctl devices
2886  *	@pdev: Pointer to pci_dev structure
2887  *
2888  *
2889  */
2890 static void
2891 mptctl_remove(struct pci_dev *pdev)
2892 {
2893 	MPT_ADAPTER *ioc = pci_get_drvdata(pdev);
2894 
2895 	kfree ( ioc->ioctl );
2896 }
2897 
2898 static struct mpt_pci_driver mptctl_driver = {
2899   .probe		= mptctl_probe,
2900   .remove		= mptctl_remove,
2901 };
2902 
2903 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2904 static int __init mptctl_init(void)
2905 {
2906 	int err;
2907 	int where = 1;
2908 
2909 	show_mptmod_ver(my_NAME, my_VERSION);
2910 
2911 	mpt_device_driver_register(&mptctl_driver, MPTCTL_DRIVER);
2912 
2913 	/* Register this device */
2914 	err = misc_register(&mptctl_miscdev);
2915 	if (err < 0) {
2916 		printk(KERN_ERR MYNAM ": Can't register misc device [minor=%d].\n", MPT_MINOR);
2917 		goto out_fail;
2918 	}
2919 	printk(KERN_INFO MYNAM ": Registered with Fusion MPT base driver\n");
2920 	printk(KERN_INFO MYNAM ": /dev/%s @ (major,minor=%d,%d)\n",
2921 			 mptctl_miscdev.name, MISC_MAJOR, mptctl_miscdev.minor);
2922 
2923 	/*
2924 	 *  Install our handler
2925 	 */
2926 	++where;
2927 	if ((mptctl_id = mpt_register(mptctl_reply, MPTCTL_DRIVER)) < 0) {
2928 		printk(KERN_ERR MYNAM ": ERROR: Failed to register with Fusion MPT base driver\n");
2929 		misc_deregister(&mptctl_miscdev);
2930 		err = -EBUSY;
2931 		goto out_fail;
2932 	}
2933 
2934 	mpt_reset_register(mptctl_id, mptctl_ioc_reset);
2935 	mpt_event_register(mptctl_id, mptctl_event_process);
2936 
2937 	return 0;
2938 
2939 out_fail:
2940 
2941 	mpt_device_driver_deregister(MPTCTL_DRIVER);
2942 
2943 	return err;
2944 }
2945 
2946 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2947 static void mptctl_exit(void)
2948 {
2949 	misc_deregister(&mptctl_miscdev);
2950 	printk(KERN_INFO MYNAM ": Deregistered /dev/%s @ (major,minor=%d,%d)\n",
2951 			 mptctl_miscdev.name, MISC_MAJOR, mptctl_miscdev.minor);
2952 
2953 	/* De-register reset handler from base module */
2954 	mpt_reset_deregister(mptctl_id);
2955 
2956 	/* De-register callback handler from base module */
2957 	mpt_deregister(mptctl_id);
2958 
2959         mpt_device_driver_deregister(MPTCTL_DRIVER);
2960 
2961 }
2962 
2963 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2964 
2965 module_init(mptctl_init);
2966 module_exit(mptctl_exit);
2967