xref: /openbmc/linux/drivers/message/fusion/mptctl.c (revision 7dd65feb)
1 /*
2  *  linux/drivers/message/fusion/mptctl.c
3  *      mpt Ioctl driver.
4  *      For use with LSI PCI chip/adapters
5  *      running LSI Fusion MPT (Message Passing Technology) firmware.
6  *
7  *  Copyright (c) 1999-2008 LSI Corporation
8  *  (mailto:DL-MPTFusionLinux@lsi.com)
9  *
10  */
11 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
12 /*
13     This program is free software; you can redistribute it and/or modify
14     it under the terms of the GNU General Public License as published by
15     the Free Software Foundation; version 2 of the License.
16 
17     This program is distributed in the hope that it will be useful,
18     but WITHOUT ANY WARRANTY; without even the implied warranty of
19     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
20     GNU General Public License for more details.
21 
22     NO WARRANTY
23     THE PROGRAM IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR
24     CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED INCLUDING, WITHOUT
25     LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT,
26     MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each Recipient is
27     solely responsible for determining the appropriateness of using and
28     distributing the Program and assumes all risks associated with its
29     exercise of rights under this Agreement, including but not limited to
30     the risks and costs of program errors, damage to or loss of data,
31     programs or equipment, and unavailability or interruption of operations.
32 
33     DISCLAIMER OF LIABILITY
34     NEITHER RECIPIENT NOR ANY CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY
35     DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
36     DAMAGES (INCLUDING WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND
37     ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
38     TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
39     USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS GRANTED
40     HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES
41 
42     You should have received a copy of the GNU General Public License
43     along with this program; if not, write to the Free Software
44     Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
45 */
46 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
47 
48 #include <linux/kernel.h>
49 #include <linux/module.h>
50 #include <linux/errno.h>
51 #include <linux/init.h>
52 #include <linux/slab.h>
53 #include <linux/types.h>
54 #include <linux/pci.h>
55 #include <linux/delay.h>	/* for mdelay */
56 #include <linux/miscdevice.h>
57 #include <linux/smp_lock.h>
58 #include <linux/compat.h>
59 
60 #include <asm/io.h>
61 #include <asm/uaccess.h>
62 
63 #include <scsi/scsi.h>
64 #include <scsi/scsi_cmnd.h>
65 #include <scsi/scsi_device.h>
66 #include <scsi/scsi_host.h>
67 #include <scsi/scsi_tcq.h>
68 
69 #define COPYRIGHT	"Copyright (c) 1999-2008 LSI Corporation"
70 #define MODULEAUTHOR	"LSI Corporation"
71 #include "mptbase.h"
72 #include "mptctl.h"
73 
74 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
75 #define my_NAME		"Fusion MPT misc device (ioctl) driver"
76 #define my_VERSION	MPT_LINUX_VERSION_COMMON
77 #define MYNAM		"mptctl"
78 
79 MODULE_AUTHOR(MODULEAUTHOR);
80 MODULE_DESCRIPTION(my_NAME);
81 MODULE_LICENSE("GPL");
82 MODULE_VERSION(my_VERSION);
83 
84 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
85 
86 static u8 mptctl_id = MPT_MAX_PROTOCOL_DRIVERS;
87 static u8 mptctl_taskmgmt_id = MPT_MAX_PROTOCOL_DRIVERS;
88 
89 static DECLARE_WAIT_QUEUE_HEAD ( mptctl_wait );
90 
91 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
92 
93 struct buflist {
94 	u8	*kptr;
95 	int	 len;
96 };
97 
98 /*
99  * Function prototypes. Called from OS entry point mptctl_ioctl.
100  * arg contents specific to function.
101  */
102 static int mptctl_fw_download(unsigned long arg);
103 static int mptctl_getiocinfo(unsigned long arg, unsigned int cmd);
104 static int mptctl_gettargetinfo(unsigned long arg);
105 static int mptctl_readtest(unsigned long arg);
106 static int mptctl_mpt_command(unsigned long arg);
107 static int mptctl_eventquery(unsigned long arg);
108 static int mptctl_eventenable(unsigned long arg);
109 static int mptctl_eventreport(unsigned long arg);
110 static int mptctl_replace_fw(unsigned long arg);
111 
112 static int mptctl_do_reset(unsigned long arg);
113 static int mptctl_hp_hostinfo(unsigned long arg, unsigned int cmd);
114 static int mptctl_hp_targetinfo(unsigned long arg);
115 
116 static int  mptctl_probe(struct pci_dev *, const struct pci_device_id *);
117 static void mptctl_remove(struct pci_dev *);
118 
119 #ifdef CONFIG_COMPAT
120 static long compat_mpctl_ioctl(struct file *f, unsigned cmd, unsigned long arg);
121 #endif
122 /*
123  * Private function calls.
124  */
125 static int mptctl_do_mpt_command(struct mpt_ioctl_command karg, void __user *mfPtr);
126 static int mptctl_do_fw_download(int ioc, char __user *ufwbuf, size_t fwlen);
127 static MptSge_t *kbuf_alloc_2_sgl(int bytes, u32 dir, int sge_offset, int *frags,
128 		struct buflist **blp, dma_addr_t *sglbuf_dma, MPT_ADAPTER *ioc);
129 static void kfree_sgl(MptSge_t *sgl, dma_addr_t sgl_dma,
130 		struct buflist *buflist, MPT_ADAPTER *ioc);
131 static int mptctl_bus_reset(MPT_ADAPTER *ioc, u8 function);
132 
133 /*
134  * Reset Handler cleanup function
135  */
136 static int  mptctl_ioc_reset(MPT_ADAPTER *ioc, int reset_phase);
137 
138 /*
139  * Event Handler function
140  */
141 static int mptctl_event_process(MPT_ADAPTER *ioc, EventNotificationReply_t *pEvReply);
142 static struct fasync_struct *async_queue=NULL;
143 
144 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
145 /*
146  * Scatter gather list (SGL) sizes and limits...
147  */
148 //#define MAX_SCSI_FRAGS	9
149 #define MAX_FRAGS_SPILL1	9
150 #define MAX_FRAGS_SPILL2	15
151 #define FRAGS_PER_BUCKET	(MAX_FRAGS_SPILL2 + 1)
152 
153 //#define MAX_CHAIN_FRAGS	64
154 //#define MAX_CHAIN_FRAGS	(15+15+15+16)
155 #define MAX_CHAIN_FRAGS		(4 * MAX_FRAGS_SPILL2 + 1)
156 
157 //  Define max sg LIST bytes ( == (#frags + #chains) * 8 bytes each)
158 //  Works out to: 592d bytes!     (9+1)*8 + 4*(15+1)*8
159 //                  ^----------------- 80 + 512
160 #define MAX_SGL_BYTES		((MAX_FRAGS_SPILL1 + 1 + (4 * FRAGS_PER_BUCKET)) * 8)
161 
162 /* linux only seems to ever give 128kB MAX contiguous (GFP_USER) mem bytes */
163 #define MAX_KMALLOC_SZ		(128*1024)
164 
165 #define MPT_IOCTL_DEFAULT_TIMEOUT 10	/* Default timeout value (seconds) */
166 
167 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
168 /**
169  *	mptctl_syscall_down - Down the MPT adapter syscall semaphore.
170  *	@ioc: Pointer to MPT adapter
171  *	@nonblock: boolean, non-zero if O_NONBLOCK is set
172  *
173  *	All of the ioctl commands can potentially sleep, which is illegal
174  *	with a spinlock held, thus we perform mutual exclusion here.
175  *
176  *	Returns negative errno on error, or zero for success.
177  */
178 static inline int
179 mptctl_syscall_down(MPT_ADAPTER *ioc, int nonblock)
180 {
181 	int rc = 0;
182 
183 	if (nonblock) {
184 		if (!mutex_trylock(&ioc->ioctl_cmds.mutex))
185 			rc = -EAGAIN;
186 	} else {
187 		if (mutex_lock_interruptible(&ioc->ioctl_cmds.mutex))
188 			rc = -ERESTARTSYS;
189 	}
190 	return rc;
191 }
192 
193 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
194 /*
195  *  This is the callback for any message we have posted. The message itself
196  *  will be returned to the message pool when we return from the IRQ
197  *
198  *  This runs in irq context so be short and sweet.
199  */
200 static int
201 mptctl_reply(MPT_ADAPTER *ioc, MPT_FRAME_HDR *req, MPT_FRAME_HDR *reply)
202 {
203 	char	*sense_data;
204 	int	req_index;
205 	int	sz;
206 
207 	if (!req)
208 		return 0;
209 
210 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "completing mpi function "
211 	    "(0x%02X), req=%p, reply=%p\n", ioc->name,  req->u.hdr.Function,
212 	    req, reply));
213 
214 	/*
215 	 * Handling continuation of the same reply. Processing the first
216 	 * reply, and eating the other replys that come later.
217 	 */
218 	if (ioc->ioctl_cmds.msg_context != req->u.hdr.MsgContext)
219 		goto out_continuation;
220 
221 	ioc->ioctl_cmds.status |= MPT_MGMT_STATUS_COMMAND_GOOD;
222 
223 	if (!reply)
224 		goto out;
225 
226 	ioc->ioctl_cmds.status |= MPT_MGMT_STATUS_RF_VALID;
227 	sz = min(ioc->reply_sz, 4*reply->u.reply.MsgLength);
228 	memcpy(ioc->ioctl_cmds.reply, reply, sz);
229 
230 	if (reply->u.reply.IOCStatus || reply->u.reply.IOCLogInfo)
231 		dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT
232 		    "iocstatus (0x%04X), loginfo (0x%08X)\n", ioc->name,
233 		    le16_to_cpu(reply->u.reply.IOCStatus),
234 		    le32_to_cpu(reply->u.reply.IOCLogInfo)));
235 
236 	if ((req->u.hdr.Function == MPI_FUNCTION_SCSI_IO_REQUEST) ||
237 		(req->u.hdr.Function ==
238 		 MPI_FUNCTION_RAID_SCSI_IO_PASSTHROUGH)) {
239 
240 		if (reply->u.sreply.SCSIStatus || reply->u.sreply.SCSIState)
241 			dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT
242 			"scsi_status (0x%02x), scsi_state (0x%02x), "
243 			"tag = (0x%04x), transfer_count (0x%08x)\n", ioc->name,
244 			reply->u.sreply.SCSIStatus,
245 			reply->u.sreply.SCSIState,
246 			le16_to_cpu(reply->u.sreply.TaskTag),
247 			le32_to_cpu(reply->u.sreply.TransferCount)));
248 
249 		if (reply->u.sreply.SCSIState &
250 			MPI_SCSI_STATE_AUTOSENSE_VALID) {
251 			sz = req->u.scsireq.SenseBufferLength;
252 			req_index =
253 			    le16_to_cpu(req->u.frame.hwhdr.msgctxu.fld.req_idx);
254 			sense_data = ((u8 *)ioc->sense_buf_pool +
255 			     (req_index * MPT_SENSE_BUFFER_ALLOC));
256 			memcpy(ioc->ioctl_cmds.sense, sense_data, sz);
257 			ioc->ioctl_cmds.status |= MPT_MGMT_STATUS_SENSE_VALID;
258 		}
259 	}
260 
261  out:
262 	/* We are done, issue wake up
263 	 */
264 	if (ioc->ioctl_cmds.status & MPT_MGMT_STATUS_PENDING) {
265 		if (req->u.hdr.Function == MPI_FUNCTION_SCSI_TASK_MGMT)
266 			mpt_clear_taskmgmt_in_progress_flag(ioc);
267 		ioc->ioctl_cmds.status &= ~MPT_MGMT_STATUS_PENDING;
268 		complete(&ioc->ioctl_cmds.done);
269 	}
270 
271  out_continuation:
272 	if (reply && (reply->u.reply.MsgFlags &
273 	    MPI_MSGFLAGS_CONTINUATION_REPLY))
274 		return 0;
275 	return 1;
276 }
277 
278 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
279 /* mptctl_timeout_expired
280  *
281  * Expecting an interrupt, however timed out.
282  *
283  */
284 static void
285 mptctl_timeout_expired(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf)
286 {
287 	unsigned long flags;
288 
289 	dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT ": %s\n",
290 		ioc->name, __func__));
291 
292 	if (mpt_fwfault_debug)
293 		mpt_halt_firmware(ioc);
294 
295 	spin_lock_irqsave(&ioc->taskmgmt_lock, flags);
296 	if (ioc->ioc_reset_in_progress) {
297 		spin_unlock_irqrestore(&ioc->taskmgmt_lock, flags);
298 		CLEAR_MGMT_PENDING_STATUS(ioc->ioctl_cmds.status)
299 		mpt_free_msg_frame(ioc, mf);
300 		return;
301 	}
302 	spin_unlock_irqrestore(&ioc->taskmgmt_lock, flags);
303 
304 
305 	if (!mptctl_bus_reset(ioc, mf->u.hdr.Function))
306 		return;
307 
308 	/* Issue a reset for this device.
309 	 * The IOC is not responding.
310 	 */
311 	dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT "Calling HardReset! \n",
312 		 ioc->name));
313 	CLEAR_MGMT_PENDING_STATUS(ioc->ioctl_cmds.status)
314 	mpt_HardResetHandler(ioc, CAN_SLEEP);
315 	mpt_free_msg_frame(ioc, mf);
316 }
317 
318 static int
319 mptctl_taskmgmt_reply(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
320 {
321 	if (!mf)
322 		return 0;
323 
324 	dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
325 		"TaskMgmt completed (mf=%p, mr=%p)\n",
326 		ioc->name, mf, mr));
327 
328 	ioc->taskmgmt_cmds.status |= MPT_MGMT_STATUS_COMMAND_GOOD;
329 
330 	if (!mr)
331 		goto out;
332 
333 	ioc->taskmgmt_cmds.status |= MPT_MGMT_STATUS_RF_VALID;
334 	memcpy(ioc->taskmgmt_cmds.reply, mr,
335 	    min(MPT_DEFAULT_FRAME_SIZE, 4 * mr->u.reply.MsgLength));
336  out:
337 	if (ioc->taskmgmt_cmds.status & MPT_MGMT_STATUS_PENDING) {
338 		mpt_clear_taskmgmt_in_progress_flag(ioc);
339 		ioc->taskmgmt_cmds.status &= ~MPT_MGMT_STATUS_PENDING;
340 		complete(&ioc->taskmgmt_cmds.done);
341 		return 1;
342 	}
343 	return 0;
344 }
345 
346 /* mptctl_bus_reset
347  *
348  * Bus reset code.
349  *
350  */
351 static int mptctl_bus_reset(MPT_ADAPTER *ioc, u8 function)
352 {
353 	MPT_FRAME_HDR	*mf;
354 	SCSITaskMgmt_t	*pScsiTm;
355 	SCSITaskMgmtReply_t *pScsiTmReply;
356 	int		 ii;
357 	int		 retval;
358 	unsigned long	 timeout;
359 	unsigned long	 time_count;
360 	u16		 iocstatus;
361 
362 	/* bus reset is only good for SCSI IO, RAID PASSTHRU */
363 	if (!(function == MPI_FUNCTION_RAID_SCSI_IO_PASSTHROUGH) ||
364 	    (function == MPI_FUNCTION_SCSI_IO_REQUEST)) {
365 		dtmprintk(ioc, printk(MYIOC_s_WARN_FMT
366 			"TaskMgmt, not SCSI_IO!!\n", ioc->name));
367 		return -EPERM;
368 	}
369 
370 	mutex_lock(&ioc->taskmgmt_cmds.mutex);
371 	if (mpt_set_taskmgmt_in_progress_flag(ioc) != 0) {
372 		mutex_unlock(&ioc->taskmgmt_cmds.mutex);
373 		return -EPERM;
374 	}
375 
376 	retval = 0;
377 
378 	/* Send request
379 	 */
380 	mf = mpt_get_msg_frame(mptctl_taskmgmt_id, ioc);
381 	if (mf == NULL) {
382 		dtmprintk(ioc, printk(MYIOC_s_WARN_FMT
383 			"TaskMgmt, no msg frames!!\n", ioc->name));
384 		mpt_clear_taskmgmt_in_progress_flag(ioc);
385 		retval = -ENOMEM;
386 		goto mptctl_bus_reset_done;
387 	}
388 
389 	dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT "TaskMgmt request (mf=%p)\n",
390 		ioc->name, mf));
391 
392 	pScsiTm = (SCSITaskMgmt_t *) mf;
393 	memset(pScsiTm, 0, sizeof(SCSITaskMgmt_t));
394 	pScsiTm->Function = MPI_FUNCTION_SCSI_TASK_MGMT;
395 	pScsiTm->TaskType = MPI_SCSITASKMGMT_TASKTYPE_RESET_BUS;
396 	pScsiTm->MsgFlags = MPI_SCSITASKMGMT_MSGFLAGS_LIPRESET_RESET_OPTION;
397 	pScsiTm->TargetID = 0;
398 	pScsiTm->Bus = 0;
399 	pScsiTm->ChainOffset = 0;
400 	pScsiTm->Reserved = 0;
401 	pScsiTm->Reserved1 = 0;
402 	pScsiTm->TaskMsgContext = 0;
403 	for (ii= 0; ii < 8; ii++)
404 		pScsiTm->LUN[ii] = 0;
405 	for (ii=0; ii < 7; ii++)
406 		pScsiTm->Reserved2[ii] = 0;
407 
408 	switch (ioc->bus_type) {
409 	case FC:
410 		timeout = 40;
411 		break;
412 	case SAS:
413 		timeout = 30;
414 		break;
415 	case SPI:
416 	default:
417 		timeout = 2;
418 		break;
419 	}
420 
421 	dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
422 		"TaskMgmt type=%d timeout=%ld\n",
423 		ioc->name, MPI_SCSITASKMGMT_TASKTYPE_RESET_BUS, timeout));
424 
425 	INITIALIZE_MGMT_STATUS(ioc->taskmgmt_cmds.status)
426 	CLEAR_MGMT_STATUS(ioc->taskmgmt_cmds.status)
427 	time_count = jiffies;
428 	if ((ioc->facts.IOCCapabilities & MPI_IOCFACTS_CAPABILITY_HIGH_PRI_Q) &&
429 	    (ioc->facts.MsgVersion >= MPI_VERSION_01_05))
430 		mpt_put_msg_frame_hi_pri(mptctl_taskmgmt_id, ioc, mf);
431 	else {
432 		retval = mpt_send_handshake_request(mptctl_taskmgmt_id, ioc,
433 		    sizeof(SCSITaskMgmt_t), (u32 *)pScsiTm, CAN_SLEEP);
434 		if (retval != 0) {
435 			dfailprintk(ioc, printk(MYIOC_s_ERR_FMT
436 				"TaskMgmt send_handshake FAILED!"
437 				" (ioc %p, mf %p, rc=%d) \n", ioc->name,
438 				ioc, mf, retval));
439 			mpt_clear_taskmgmt_in_progress_flag(ioc);
440 			goto mptctl_bus_reset_done;
441 		}
442 	}
443 
444 	/* Now wait for the command to complete */
445 	ii = wait_for_completion_timeout(&ioc->taskmgmt_cmds.done, timeout*HZ);
446 	if (!(ioc->taskmgmt_cmds.status & MPT_MGMT_STATUS_COMMAND_GOOD)) {
447 		dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
448 		    "TaskMgmt failed\n", ioc->name));
449 		mpt_free_msg_frame(ioc, mf);
450 		mpt_clear_taskmgmt_in_progress_flag(ioc);
451 		if (ioc->taskmgmt_cmds.status & MPT_MGMT_STATUS_DID_IOCRESET)
452 			retval = 0;
453 		else
454 			retval = -1; /* return failure */
455 		goto mptctl_bus_reset_done;
456 	}
457 
458 	if (!(ioc->taskmgmt_cmds.status & MPT_MGMT_STATUS_RF_VALID)) {
459 		dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
460 		    "TaskMgmt failed\n", ioc->name));
461 		retval = -1; /* return failure */
462 		goto mptctl_bus_reset_done;
463 	}
464 
465 	pScsiTmReply = (SCSITaskMgmtReply_t *) ioc->taskmgmt_cmds.reply;
466 	dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
467 	    "TaskMgmt fw_channel = %d, fw_id = %d, task_type=0x%02X, "
468 	    "iocstatus=0x%04X\n\tloginfo=0x%08X, response_code=0x%02X, "
469 	    "term_cmnds=%d\n", ioc->name, pScsiTmReply->Bus,
470 	    pScsiTmReply->TargetID, MPI_SCSITASKMGMT_TASKTYPE_RESET_BUS,
471 	    le16_to_cpu(pScsiTmReply->IOCStatus),
472 	    le32_to_cpu(pScsiTmReply->IOCLogInfo),
473 	    pScsiTmReply->ResponseCode,
474 	    le32_to_cpu(pScsiTmReply->TerminationCount)));
475 
476 	iocstatus = le16_to_cpu(pScsiTmReply->IOCStatus) & MPI_IOCSTATUS_MASK;
477 
478 	if (iocstatus == MPI_IOCSTATUS_SCSI_TASK_TERMINATED ||
479 	   iocstatus == MPI_IOCSTATUS_SCSI_IOC_TERMINATED ||
480 	   iocstatus == MPI_IOCSTATUS_SUCCESS)
481 		retval = 0;
482 	else {
483 		dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
484 		    "TaskMgmt failed\n", ioc->name));
485 		retval = -1; /* return failure */
486 	}
487 
488 
489  mptctl_bus_reset_done:
490 	mutex_unlock(&ioc->taskmgmt_cmds.mutex);
491 	CLEAR_MGMT_STATUS(ioc->taskmgmt_cmds.status)
492 	return retval;
493 }
494 
495 
496 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
497 /* mptctl_ioc_reset
498  *
499  * Clean-up functionality. Used only if there has been a
500  * reload of the FW due.
501  *
502  */
503 static int
504 mptctl_ioc_reset(MPT_ADAPTER *ioc, int reset_phase)
505 {
506 	switch(reset_phase) {
507 	case MPT_IOC_SETUP_RESET:
508 		dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
509 		    "%s: MPT_IOC_SETUP_RESET\n", ioc->name, __func__));
510 		break;
511 	case MPT_IOC_PRE_RESET:
512 		dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
513 		    "%s: MPT_IOC_PRE_RESET\n", ioc->name, __func__));
514 		break;
515 	case MPT_IOC_POST_RESET:
516 		dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
517 		    "%s: MPT_IOC_POST_RESET\n", ioc->name, __func__));
518 		if (ioc->ioctl_cmds.status & MPT_MGMT_STATUS_PENDING) {
519 			ioc->ioctl_cmds.status |= MPT_MGMT_STATUS_DID_IOCRESET;
520 			complete(&ioc->ioctl_cmds.done);
521 		}
522 		break;
523 	default:
524 		break;
525 	}
526 
527 	return 1;
528 }
529 
530 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
531 /* ASYNC Event Notification Support */
532 static int
533 mptctl_event_process(MPT_ADAPTER *ioc, EventNotificationReply_t *pEvReply)
534 {
535 	u8 event;
536 
537 	event = le32_to_cpu(pEvReply->Event) & 0xFF;
538 
539 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "%s() called\n",
540 	    ioc->name, __func__));
541 	if(async_queue == NULL)
542 		return 1;
543 
544 	/* Raise SIGIO for persistent events.
545 	 * TODO - this define is not in MPI spec yet,
546 	 * but they plan to set it to 0x21
547 	 */
548 	 if (event == 0x21 ) {
549 		ioc->aen_event_read_flag=1;
550 		dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "Raised SIGIO to application\n",
551 		    ioc->name));
552 		devtverboseprintk(ioc, printk(MYIOC_s_DEBUG_FMT
553 		    "Raised SIGIO to application\n", ioc->name));
554 		kill_fasync(&async_queue, SIGIO, POLL_IN);
555 		return 1;
556 	 }
557 
558 	/* This flag is set after SIGIO was raised, and
559 	 * remains set until the application has read
560 	 * the event log via ioctl=MPTEVENTREPORT
561 	 */
562 	if(ioc->aen_event_read_flag)
563 		return 1;
564 
565 	/* Signal only for the events that are
566 	 * requested for by the application
567 	 */
568 	if (ioc->events && (ioc->eventTypes & ( 1 << event))) {
569 		ioc->aen_event_read_flag=1;
570 		dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT
571 		    "Raised SIGIO to application\n", ioc->name));
572 		devtverboseprintk(ioc, printk(MYIOC_s_DEBUG_FMT
573 		    "Raised SIGIO to application\n", ioc->name));
574 		kill_fasync(&async_queue, SIGIO, POLL_IN);
575 	}
576 	return 1;
577 }
578 
579 static int
580 mptctl_fasync(int fd, struct file *filep, int mode)
581 {
582 	MPT_ADAPTER	*ioc;
583 	int ret;
584 
585 	lock_kernel();
586 	list_for_each_entry(ioc, &ioc_list, list)
587 		ioc->aen_event_read_flag=0;
588 
589 	ret = fasync_helper(fd, filep, mode, &async_queue);
590 	unlock_kernel();
591 	return ret;
592 }
593 
594 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
595 /*
596  *  MPT ioctl handler
597  *  cmd - specify the particular IOCTL command to be issued
598  *  arg - data specific to the command. Must not be null.
599  */
600 static long
601 __mptctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
602 {
603 	mpt_ioctl_header __user *uhdr = (void __user *) arg;
604 	mpt_ioctl_header	 khdr;
605 	int iocnum;
606 	unsigned iocnumX;
607 	int nonblock = (file->f_flags & O_NONBLOCK);
608 	int ret;
609 	MPT_ADAPTER *iocp = NULL;
610 
611 	if (copy_from_user(&khdr, uhdr, sizeof(khdr))) {
612 		printk(KERN_ERR MYNAM "%s::mptctl_ioctl() @%d - "
613 				"Unable to copy mpt_ioctl_header data @ %p\n",
614 				__FILE__, __LINE__, uhdr);
615 		return -EFAULT;
616 	}
617 	ret = -ENXIO;				/* (-6) No such device or address */
618 
619 	/* Verify intended MPT adapter - set iocnum and the adapter
620 	 * pointer (iocp)
621 	 */
622 	iocnumX = khdr.iocnum & 0xFF;
623 	if (((iocnum = mpt_verify_adapter(iocnumX, &iocp)) < 0) ||
624 	    (iocp == NULL))
625 		return -ENODEV;
626 
627 	if (!iocp->active) {
628 		printk(KERN_DEBUG MYNAM "%s::mptctl_ioctl() @%d - Controller disabled.\n",
629 				__FILE__, __LINE__);
630 		return -EFAULT;
631 	}
632 
633 	/* Handle those commands that are just returning
634 	 * information stored in the driver.
635 	 * These commands should never time out and are unaffected
636 	 * by TM and FW reloads.
637 	 */
638 	if ((cmd & ~IOCSIZE_MASK) == (MPTIOCINFO & ~IOCSIZE_MASK)) {
639 		return mptctl_getiocinfo(arg, _IOC_SIZE(cmd));
640 	} else if (cmd == MPTTARGETINFO) {
641 		return mptctl_gettargetinfo(arg);
642 	} else if (cmd == MPTTEST) {
643 		return mptctl_readtest(arg);
644 	} else if (cmd == MPTEVENTQUERY) {
645 		return mptctl_eventquery(arg);
646 	} else if (cmd == MPTEVENTENABLE) {
647 		return mptctl_eventenable(arg);
648 	} else if (cmd == MPTEVENTREPORT) {
649 		return mptctl_eventreport(arg);
650 	} else if (cmd == MPTFWREPLACE) {
651 		return mptctl_replace_fw(arg);
652 	}
653 
654 	/* All of these commands require an interrupt or
655 	 * are unknown/illegal.
656 	 */
657 	if ((ret = mptctl_syscall_down(iocp, nonblock)) != 0)
658 		return ret;
659 
660 	if (cmd == MPTFWDOWNLOAD)
661 		ret = mptctl_fw_download(arg);
662 	else if (cmd == MPTCOMMAND)
663 		ret = mptctl_mpt_command(arg);
664 	else if (cmd == MPTHARDRESET)
665 		ret = mptctl_do_reset(arg);
666 	else if ((cmd & ~IOCSIZE_MASK) == (HP_GETHOSTINFO & ~IOCSIZE_MASK))
667 		ret = mptctl_hp_hostinfo(arg, _IOC_SIZE(cmd));
668 	else if (cmd == HP_GETTARGETINFO)
669 		ret = mptctl_hp_targetinfo(arg);
670 	else
671 		ret = -EINVAL;
672 
673 	mutex_unlock(&iocp->ioctl_cmds.mutex);
674 
675 	return ret;
676 }
677 
678 static long
679 mptctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
680 {
681 	long ret;
682 	lock_kernel();
683 	ret = __mptctl_ioctl(file, cmd, arg);
684 	unlock_kernel();
685 	return ret;
686 }
687 
688 static int mptctl_do_reset(unsigned long arg)
689 {
690 	struct mpt_ioctl_diag_reset __user *urinfo = (void __user *) arg;
691 	struct mpt_ioctl_diag_reset krinfo;
692 	MPT_ADAPTER		*iocp;
693 
694 	if (copy_from_user(&krinfo, urinfo, sizeof(struct mpt_ioctl_diag_reset))) {
695 		printk(KERN_ERR MYNAM "%s@%d::mptctl_do_reset - "
696 				"Unable to copy mpt_ioctl_diag_reset struct @ %p\n",
697 				__FILE__, __LINE__, urinfo);
698 		return -EFAULT;
699 	}
700 
701 	if (mpt_verify_adapter(krinfo.hdr.iocnum, &iocp) < 0) {
702 		printk(KERN_DEBUG MYNAM "%s@%d::mptctl_do_reset - ioc%d not found!\n",
703 				__FILE__, __LINE__, krinfo.hdr.iocnum);
704 		return -ENODEV; /* (-6) No such device or address */
705 	}
706 
707 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "mptctl_do_reset called.\n",
708 	    iocp->name));
709 
710 	if (mpt_HardResetHandler(iocp, CAN_SLEEP) != 0) {
711 		printk (MYIOC_s_ERR_FMT "%s@%d::mptctl_do_reset - reset failed.\n",
712 			iocp->name, __FILE__, __LINE__);
713 		return -1;
714 	}
715 
716 	return 0;
717 }
718 
719 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
720 /*
721  * MPT FW download function.  Cast the arg into the mpt_fw_xfer structure.
722  * This structure contains: iocnum, firmware length (bytes),
723  *      pointer to user space memory where the fw image is stored.
724  *
725  * Outputs:	None.
726  * Return:	0 if successful
727  *		-EFAULT if data unavailable
728  *		-ENXIO  if no such device
729  *		-EAGAIN if resource problem
730  *		-ENOMEM if no memory for SGE
731  *		-EMLINK if too many chain buffers required
732  *		-EBADRQC if adapter does not support FW download
733  *		-EBUSY if adapter is busy
734  *		-ENOMSG if FW upload returned bad status
735  */
736 static int
737 mptctl_fw_download(unsigned long arg)
738 {
739 	struct mpt_fw_xfer __user *ufwdl = (void __user *) arg;
740 	struct mpt_fw_xfer	 kfwdl;
741 
742 	if (copy_from_user(&kfwdl, ufwdl, sizeof(struct mpt_fw_xfer))) {
743 		printk(KERN_ERR MYNAM "%s@%d::_ioctl_fwdl - "
744 				"Unable to copy mpt_fw_xfer struct @ %p\n",
745 				__FILE__, __LINE__, ufwdl);
746 		return -EFAULT;
747 	}
748 
749 	return mptctl_do_fw_download(kfwdl.iocnum, kfwdl.bufp, kfwdl.fwlen);
750 }
751 
752 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
753 /*
754  * FW Download engine.
755  * Outputs:	None.
756  * Return:	0 if successful
757  *		-EFAULT if data unavailable
758  *		-ENXIO  if no such device
759  *		-EAGAIN if resource problem
760  *		-ENOMEM if no memory for SGE
761  *		-EMLINK if too many chain buffers required
762  *		-EBADRQC if adapter does not support FW download
763  *		-EBUSY if adapter is busy
764  *		-ENOMSG if FW upload returned bad status
765  */
766 static int
767 mptctl_do_fw_download(int ioc, char __user *ufwbuf, size_t fwlen)
768 {
769 	FWDownload_t		*dlmsg;
770 	MPT_FRAME_HDR		*mf;
771 	MPT_ADAPTER		*iocp;
772 	FWDownloadTCSGE_t	*ptsge;
773 	MptSge_t		*sgl, *sgIn;
774 	char			*sgOut;
775 	struct buflist		*buflist;
776 	struct buflist		*bl;
777 	dma_addr_t		 sgl_dma;
778 	int			 ret;
779 	int			 numfrags = 0;
780 	int			 maxfrags;
781 	int			 n = 0;
782 	u32			 sgdir;
783 	u32			 nib;
784 	int			 fw_bytes_copied = 0;
785 	int			 i;
786 	int			 sge_offset = 0;
787 	u16			 iocstat;
788 	pFWDownloadReply_t	 ReplyMsg = NULL;
789 	unsigned long		 timeleft;
790 
791 	if (mpt_verify_adapter(ioc, &iocp) < 0) {
792 		printk(KERN_DEBUG MYNAM "ioctl_fwdl - ioc%d not found!\n",
793 				 ioc);
794 		return -ENODEV; /* (-6) No such device or address */
795 	} else {
796 
797 		/*  Valid device. Get a message frame and construct the FW download message.
798 	 	*/
799 		if ((mf = mpt_get_msg_frame(mptctl_id, iocp)) == NULL)
800 			return -EAGAIN;
801 	}
802 
803 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT
804 	    "mptctl_do_fwdl called. mptctl_id = %xh.\n", iocp->name, mptctl_id));
805 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "DbG: kfwdl.bufp  = %p\n",
806 	    iocp->name, ufwbuf));
807 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "DbG: kfwdl.fwlen = %d\n",
808 	    iocp->name, (int)fwlen));
809 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "DbG: kfwdl.ioc   = %04xh\n",
810 	    iocp->name, ioc));
811 
812 	dlmsg = (FWDownload_t*) mf;
813 	ptsge = (FWDownloadTCSGE_t *) &dlmsg->SGL;
814 	sgOut = (char *) (ptsge + 1);
815 
816 	/*
817 	 * Construct f/w download request
818 	 */
819 	dlmsg->ImageType = MPI_FW_DOWNLOAD_ITYPE_FW;
820 	dlmsg->Reserved = 0;
821 	dlmsg->ChainOffset = 0;
822 	dlmsg->Function = MPI_FUNCTION_FW_DOWNLOAD;
823 	dlmsg->Reserved1[0] = dlmsg->Reserved1[1] = dlmsg->Reserved1[2] = 0;
824 	if (iocp->facts.MsgVersion >= MPI_VERSION_01_05)
825 		dlmsg->MsgFlags = MPI_FW_DOWNLOAD_MSGFLGS_LAST_SEGMENT;
826 	else
827 		dlmsg->MsgFlags = 0;
828 
829 
830 	/* Set up the Transaction SGE.
831 	 */
832 	ptsge->Reserved = 0;
833 	ptsge->ContextSize = 0;
834 	ptsge->DetailsLength = 12;
835 	ptsge->Flags = MPI_SGE_FLAGS_TRANSACTION_ELEMENT;
836 	ptsge->Reserved_0100_Checksum = 0;
837 	ptsge->ImageOffset = 0;
838 	ptsge->ImageSize = cpu_to_le32(fwlen);
839 
840 	/* Add the SGL
841 	 */
842 
843 	/*
844 	 * Need to kmalloc area(s) for holding firmware image bytes.
845 	 * But we need to do it piece meal, using a proper
846 	 * scatter gather list (with 128kB MAX hunks).
847 	 *
848 	 * A practical limit here might be # of sg hunks that fit into
849 	 * a single IOC request frame; 12 or 8 (see below), so:
850 	 * For FC9xx: 12 x 128kB == 1.5 mB (max)
851 	 * For C1030:  8 x 128kB == 1   mB (max)
852 	 * We could support chaining, but things get ugly(ier:)
853 	 *
854 	 * Set the sge_offset to the start of the sgl (bytes).
855 	 */
856 	sgdir = 0x04000000;		/* IOC will READ from sys mem */
857 	sge_offset = sizeof(MPIHeader_t) + sizeof(FWDownloadTCSGE_t);
858 	if ((sgl = kbuf_alloc_2_sgl(fwlen, sgdir, sge_offset,
859 				    &numfrags, &buflist, &sgl_dma, iocp)) == NULL)
860 		return -ENOMEM;
861 
862 	/*
863 	 * We should only need SGL with 2 simple_32bit entries (up to 256 kB)
864 	 * for FC9xx f/w image, but calculate max number of sge hunks
865 	 * we can fit into a request frame, and limit ourselves to that.
866 	 * (currently no chain support)
867 	 * maxfrags = (Request Size - FWdownload Size ) / Size of 32 bit SGE
868 	 *	Request		maxfrags
869 	 *	128		12
870 	 *	96		8
871 	 *	64		4
872 	 */
873 	maxfrags = (iocp->req_sz - sizeof(MPIHeader_t) -
874 			sizeof(FWDownloadTCSGE_t))
875 			/ iocp->SGE_size;
876 	if (numfrags > maxfrags) {
877 		ret = -EMLINK;
878 		goto fwdl_out;
879 	}
880 
881 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "DbG: sgl buffer = %p, sgfrags = %d\n",
882 	    iocp->name, sgl, numfrags));
883 
884 	/*
885 	 * Parse SG list, copying sgl itself,
886 	 * plus f/w image hunks from user space as we go...
887 	 */
888 	ret = -EFAULT;
889 	sgIn = sgl;
890 	bl = buflist;
891 	for (i=0; i < numfrags; i++) {
892 
893 		/* Get the SGE type: 0 - TCSGE, 3 - Chain, 1 - Simple SGE
894 		 * Skip everything but Simple. If simple, copy from
895 		 *	user space into kernel space.
896 		 * Note: we should not have anything but Simple as
897 		 *	Chain SGE are illegal.
898 		 */
899 		nib = (sgIn->FlagsLength & 0x30000000) >> 28;
900 		if (nib == 0 || nib == 3) {
901 			;
902 		} else if (sgIn->Address) {
903 			iocp->add_sge(sgOut, sgIn->FlagsLength, sgIn->Address);
904 			n++;
905 			if (copy_from_user(bl->kptr, ufwbuf+fw_bytes_copied, bl->len)) {
906 				printk(MYIOC_s_ERR_FMT "%s@%d::_ioctl_fwdl - "
907 					"Unable to copy f/w buffer hunk#%d @ %p\n",
908 					iocp->name, __FILE__, __LINE__, n, ufwbuf);
909 				goto fwdl_out;
910 			}
911 			fw_bytes_copied += bl->len;
912 		}
913 		sgIn++;
914 		bl++;
915 		sgOut += iocp->SGE_size;
916 	}
917 
918 	DBG_DUMP_FW_DOWNLOAD(iocp, (u32 *)mf, numfrags);
919 
920 	/*
921 	 * Finally, perform firmware download.
922 	 */
923 	ReplyMsg = NULL;
924 	SET_MGMT_MSG_CONTEXT(iocp->ioctl_cmds.msg_context, dlmsg->MsgContext);
925 	INITIALIZE_MGMT_STATUS(iocp->ioctl_cmds.status)
926 	mpt_put_msg_frame(mptctl_id, iocp, mf);
927 
928 	/* Now wait for the command to complete */
929 retry_wait:
930 	timeleft = wait_for_completion_timeout(&iocp->ioctl_cmds.done, HZ*60);
931 	if (!(iocp->ioctl_cmds.status & MPT_MGMT_STATUS_COMMAND_GOOD)) {
932 		ret = -ETIME;
933 		printk(MYIOC_s_WARN_FMT "%s: failed\n", iocp->name, __func__);
934 		if (iocp->ioctl_cmds.status & MPT_MGMT_STATUS_DID_IOCRESET) {
935 			mpt_free_msg_frame(iocp, mf);
936 			goto fwdl_out;
937 		}
938 		if (!timeleft)
939 			mptctl_timeout_expired(iocp, mf);
940 		else
941 			goto retry_wait;
942 		goto fwdl_out;
943 	}
944 
945 	if (!(iocp->ioctl_cmds.status & MPT_MGMT_STATUS_RF_VALID)) {
946 		printk(MYIOC_s_WARN_FMT "%s: failed\n", iocp->name, __func__);
947 		mpt_free_msg_frame(iocp, mf);
948 		ret = -ENODATA;
949 		goto fwdl_out;
950 	}
951 
952 	if (sgl)
953 		kfree_sgl(sgl, sgl_dma, buflist, iocp);
954 
955 	ReplyMsg = (pFWDownloadReply_t)iocp->ioctl_cmds.reply;
956 	iocstat = le16_to_cpu(ReplyMsg->IOCStatus) & MPI_IOCSTATUS_MASK;
957 	if (iocstat == MPI_IOCSTATUS_SUCCESS) {
958 		printk(MYIOC_s_INFO_FMT "F/W update successfull!\n", iocp->name);
959 		return 0;
960 	} else if (iocstat == MPI_IOCSTATUS_INVALID_FUNCTION) {
961 		printk(MYIOC_s_WARN_FMT "Hmmm...  F/W download not supported!?!\n",
962 			iocp->name);
963 		printk(MYIOC_s_WARN_FMT "(time to go bang on somebodies door)\n",
964 			iocp->name);
965 		return -EBADRQC;
966 	} else if (iocstat == MPI_IOCSTATUS_BUSY) {
967 		printk(MYIOC_s_WARN_FMT "IOC_BUSY!\n", iocp->name);
968 		printk(MYIOC_s_WARN_FMT "(try again later?)\n", iocp->name);
969 		return -EBUSY;
970 	} else {
971 		printk(MYIOC_s_WARN_FMT "ioctl_fwdl() returned [bad] status = %04xh\n",
972 			iocp->name, iocstat);
973 		printk(MYIOC_s_WARN_FMT "(bad VooDoo)\n", iocp->name);
974 		return -ENOMSG;
975 	}
976 	return 0;
977 
978 fwdl_out:
979 
980 	CLEAR_MGMT_STATUS(iocp->ioctl_cmds.status);
981 	SET_MGMT_MSG_CONTEXT(iocp->ioctl_cmds.msg_context, 0);
982         kfree_sgl(sgl, sgl_dma, buflist, iocp);
983 	return ret;
984 }
985 
986 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
987 /*
988  * SGE Allocation routine
989  *
990  * Inputs:	bytes - number of bytes to be transferred
991  *		sgdir - data direction
992  *		sge_offset - offset (in bytes) from the start of the request
993  *			frame to the first SGE
994  *		ioc - pointer to the mptadapter
995  * Outputs:	frags - number of scatter gather elements
996  *		blp - point to the buflist pointer
997  *		sglbuf_dma - pointer to the (dma) sgl
998  * Returns:	Null if failes
999  *		pointer to the (virtual) sgl if successful.
1000  */
1001 static MptSge_t *
1002 kbuf_alloc_2_sgl(int bytes, u32 sgdir, int sge_offset, int *frags,
1003 		 struct buflist **blp, dma_addr_t *sglbuf_dma, MPT_ADAPTER *ioc)
1004 {
1005 	MptSge_t	*sglbuf = NULL;		/* pointer to array of SGE */
1006 						/* and chain buffers */
1007 	struct buflist	*buflist = NULL;	/* kernel routine */
1008 	MptSge_t	*sgl;
1009 	int		 numfrags = 0;
1010 	int		 fragcnt = 0;
1011 	int		 alloc_sz = min(bytes,MAX_KMALLOC_SZ);	// avoid kernel warning msg!
1012 	int		 bytes_allocd = 0;
1013 	int		 this_alloc;
1014 	dma_addr_t	 pa;					// phys addr
1015 	int		 i, buflist_ent;
1016 	int		 sg_spill = MAX_FRAGS_SPILL1;
1017 	int		 dir;
1018 	/* initialization */
1019 	*frags = 0;
1020 	*blp = NULL;
1021 
1022 	/* Allocate and initialize an array of kernel
1023 	 * structures for the SG elements.
1024 	 */
1025 	i = MAX_SGL_BYTES / 8;
1026 	buflist = kzalloc(i, GFP_USER);
1027 	if (!buflist)
1028 		return NULL;
1029 	buflist_ent = 0;
1030 
1031 	/* Allocate a single block of memory to store the sg elements and
1032 	 * the chain buffers.  The calling routine is responsible for
1033 	 * copying the data in this array into the correct place in the
1034 	 * request and chain buffers.
1035 	 */
1036 	sglbuf = pci_alloc_consistent(ioc->pcidev, MAX_SGL_BYTES, sglbuf_dma);
1037 	if (sglbuf == NULL)
1038 		goto free_and_fail;
1039 
1040 	if (sgdir & 0x04000000)
1041 		dir = PCI_DMA_TODEVICE;
1042 	else
1043 		dir = PCI_DMA_FROMDEVICE;
1044 
1045 	/* At start:
1046 	 *	sgl = sglbuf = point to beginning of sg buffer
1047 	 *	buflist_ent = 0 = first kernel structure
1048 	 *	sg_spill = number of SGE that can be written before the first
1049 	 *		chain element.
1050 	 *
1051 	 */
1052 	sgl = sglbuf;
1053 	sg_spill = ((ioc->req_sz - sge_offset)/ioc->SGE_size) - 1;
1054 	while (bytes_allocd < bytes) {
1055 		this_alloc = min(alloc_sz, bytes-bytes_allocd);
1056 		buflist[buflist_ent].len = this_alloc;
1057 		buflist[buflist_ent].kptr = pci_alloc_consistent(ioc->pcidev,
1058 								 this_alloc,
1059 								 &pa);
1060 		if (buflist[buflist_ent].kptr == NULL) {
1061 			alloc_sz = alloc_sz / 2;
1062 			if (alloc_sz == 0) {
1063 				printk(MYIOC_s_WARN_FMT "-SG: No can do - "
1064 				    "not enough memory!   :-(\n", ioc->name);
1065 				printk(MYIOC_s_WARN_FMT "-SG: (freeing %d frags)\n",
1066 					ioc->name, numfrags);
1067 				goto free_and_fail;
1068 			}
1069 			continue;
1070 		} else {
1071 			dma_addr_t dma_addr;
1072 
1073 			bytes_allocd += this_alloc;
1074 			sgl->FlagsLength = (0x10000000|sgdir|this_alloc);
1075 			dma_addr = pci_map_single(ioc->pcidev,
1076 				buflist[buflist_ent].kptr, this_alloc, dir);
1077 			sgl->Address = dma_addr;
1078 
1079 			fragcnt++;
1080 			numfrags++;
1081 			sgl++;
1082 			buflist_ent++;
1083 		}
1084 
1085 		if (bytes_allocd >= bytes)
1086 			break;
1087 
1088 		/* Need to chain? */
1089 		if (fragcnt == sg_spill) {
1090 			printk(MYIOC_s_WARN_FMT
1091 			    "-SG: No can do - " "Chain required!   :-(\n", ioc->name);
1092 			printk(MYIOC_s_WARN_FMT "(freeing %d frags)\n", ioc->name, numfrags);
1093 			goto free_and_fail;
1094 		}
1095 
1096 		/* overflow check... */
1097 		if (numfrags*8 > MAX_SGL_BYTES){
1098 			/* GRRRRR... */
1099 			printk(MYIOC_s_WARN_FMT "-SG: No can do - "
1100 				"too many SG frags!   :-(\n", ioc->name);
1101 			printk(MYIOC_s_WARN_FMT "-SG: (freeing %d frags)\n",
1102 				ioc->name, numfrags);
1103 			goto free_and_fail;
1104 		}
1105 	}
1106 
1107 	/* Last sge fixup: set LE+eol+eob bits */
1108 	sgl[-1].FlagsLength |= 0xC1000000;
1109 
1110 	*frags = numfrags;
1111 	*blp = buflist;
1112 
1113 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "-SG: kbuf_alloc_2_sgl() - "
1114 	   "%d SG frags generated!\n", ioc->name, numfrags));
1115 
1116 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "-SG: kbuf_alloc_2_sgl() - "
1117 	   "last (big) alloc_sz=%d\n", ioc->name, alloc_sz));
1118 
1119 	return sglbuf;
1120 
1121 free_and_fail:
1122 	if (sglbuf != NULL) {
1123 		for (i = 0; i < numfrags; i++) {
1124 			dma_addr_t dma_addr;
1125 			u8 *kptr;
1126 			int len;
1127 
1128 			if ((sglbuf[i].FlagsLength >> 24) == 0x30)
1129 				continue;
1130 
1131 			dma_addr = sglbuf[i].Address;
1132 			kptr = buflist[i].kptr;
1133 			len = buflist[i].len;
1134 
1135 			pci_free_consistent(ioc->pcidev, len, kptr, dma_addr);
1136 		}
1137 		pci_free_consistent(ioc->pcidev, MAX_SGL_BYTES, sglbuf, *sglbuf_dma);
1138 	}
1139 	kfree(buflist);
1140 	return NULL;
1141 }
1142 
1143 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1144 /*
1145  * Routine to free the SGL elements.
1146  */
1147 static void
1148 kfree_sgl(MptSge_t *sgl, dma_addr_t sgl_dma, struct buflist *buflist, MPT_ADAPTER *ioc)
1149 {
1150 	MptSge_t	*sg = sgl;
1151 	struct buflist	*bl = buflist;
1152 	u32		 nib;
1153 	int		 dir;
1154 	int		 n = 0;
1155 
1156 	if (sg->FlagsLength & 0x04000000)
1157 		dir = PCI_DMA_TODEVICE;
1158 	else
1159 		dir = PCI_DMA_FROMDEVICE;
1160 
1161 	nib = (sg->FlagsLength & 0xF0000000) >> 28;
1162 	while (! (nib & 0x4)) { /* eob */
1163 		/* skip ignore/chain. */
1164 		if (nib == 0 || nib == 3) {
1165 			;
1166 		} else if (sg->Address) {
1167 			dma_addr_t dma_addr;
1168 			void *kptr;
1169 			int len;
1170 
1171 			dma_addr = sg->Address;
1172 			kptr = bl->kptr;
1173 			len = bl->len;
1174 			pci_unmap_single(ioc->pcidev, dma_addr, len, dir);
1175 			pci_free_consistent(ioc->pcidev, len, kptr, dma_addr);
1176 			n++;
1177 		}
1178 		sg++;
1179 		bl++;
1180 		nib = (le32_to_cpu(sg->FlagsLength) & 0xF0000000) >> 28;
1181 	}
1182 
1183 	/* we're at eob! */
1184 	if (sg->Address) {
1185 		dma_addr_t dma_addr;
1186 		void *kptr;
1187 		int len;
1188 
1189 		dma_addr = sg->Address;
1190 		kptr = bl->kptr;
1191 		len = bl->len;
1192 		pci_unmap_single(ioc->pcidev, dma_addr, len, dir);
1193 		pci_free_consistent(ioc->pcidev, len, kptr, dma_addr);
1194 		n++;
1195 	}
1196 
1197 	pci_free_consistent(ioc->pcidev, MAX_SGL_BYTES, sgl, sgl_dma);
1198 	kfree(buflist);
1199 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "-SG: Free'd 1 SGL buf + %d kbufs!\n",
1200 	    ioc->name, n));
1201 }
1202 
1203 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1204 /*
1205  *	mptctl_getiocinfo - Query the host adapter for IOC information.
1206  *	@arg: User space argument
1207  *
1208  * Outputs:	None.
1209  * Return:	0 if successful
1210  *		-EFAULT if data unavailable
1211  *		-ENODEV  if no such device/adapter
1212  */
1213 static int
1214 mptctl_getiocinfo (unsigned long arg, unsigned int data_size)
1215 {
1216 	struct mpt_ioctl_iocinfo __user *uarg = (void __user *) arg;
1217 	struct mpt_ioctl_iocinfo *karg;
1218 	MPT_ADAPTER		*ioc;
1219 	struct pci_dev		*pdev;
1220 	int			iocnum;
1221 	unsigned int		port;
1222 	int			cim_rev;
1223 	u8			revision;
1224 	struct scsi_device 	*sdev;
1225 	VirtDevice		*vdevice;
1226 
1227 	/* Add of PCI INFO results in unaligned access for
1228 	 * IA64 and Sparc. Reset long to int. Return no PCI
1229 	 * data for obsolete format.
1230 	 */
1231 	if (data_size == sizeof(struct mpt_ioctl_iocinfo_rev0))
1232 		cim_rev = 0;
1233 	else if (data_size == sizeof(struct mpt_ioctl_iocinfo_rev1))
1234 		cim_rev = 1;
1235 	else if (data_size == sizeof(struct mpt_ioctl_iocinfo))
1236 		cim_rev = 2;
1237 	else if (data_size == (sizeof(struct mpt_ioctl_iocinfo_rev0)+12))
1238 		cim_rev = 0;	/* obsolete */
1239 	else
1240 		return -EFAULT;
1241 
1242 	karg = kmalloc(data_size, GFP_KERNEL);
1243 	if (karg == NULL) {
1244 		printk(KERN_ERR MYNAM "%s::mpt_ioctl_iocinfo() @%d - no memory available!\n",
1245 				__FILE__, __LINE__);
1246 		return -ENOMEM;
1247 	}
1248 
1249 	if (copy_from_user(karg, uarg, data_size)) {
1250 		printk(KERN_ERR MYNAM "%s@%d::mptctl_getiocinfo - "
1251 			"Unable to read in mpt_ioctl_iocinfo struct @ %p\n",
1252 				__FILE__, __LINE__, uarg);
1253 		kfree(karg);
1254 		return -EFAULT;
1255 	}
1256 
1257 	if (((iocnum = mpt_verify_adapter(karg->hdr.iocnum, &ioc)) < 0) ||
1258 	    (ioc == NULL)) {
1259 		printk(KERN_DEBUG MYNAM "%s::mptctl_getiocinfo() @%d - ioc%d not found!\n",
1260 				__FILE__, __LINE__, iocnum);
1261 		kfree(karg);
1262 		return -ENODEV;
1263 	}
1264 
1265 	/* Verify the data transfer size is correct. */
1266 	if (karg->hdr.maxDataSize != data_size) {
1267 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_getiocinfo - "
1268 			"Structure size mismatch. Command not completed.\n",
1269 			ioc->name, __FILE__, __LINE__);
1270 		kfree(karg);
1271 		return -EFAULT;
1272 	}
1273 
1274 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_getiocinfo called.\n",
1275 	    ioc->name));
1276 
1277 	/* Fill in the data and return the structure to the calling
1278 	 * program
1279 	 */
1280 	if (ioc->bus_type == SAS)
1281 		karg->adapterType = MPT_IOCTL_INTERFACE_SAS;
1282 	else if (ioc->bus_type == FC)
1283 		karg->adapterType = MPT_IOCTL_INTERFACE_FC;
1284 	else
1285 		karg->adapterType = MPT_IOCTL_INTERFACE_SCSI;
1286 
1287 	if (karg->hdr.port > 1)
1288 		return -EINVAL;
1289 	port = karg->hdr.port;
1290 
1291 	karg->port = port;
1292 	pdev = (struct pci_dev *) ioc->pcidev;
1293 
1294 	karg->pciId = pdev->device;
1295 	pci_read_config_byte(pdev, PCI_CLASS_REVISION, &revision);
1296 	karg->hwRev = revision;
1297 	karg->subSystemDevice = pdev->subsystem_device;
1298 	karg->subSystemVendor = pdev->subsystem_vendor;
1299 
1300 	if (cim_rev == 1) {
1301 		/* Get the PCI bus, device, and function numbers for the IOC
1302 		 */
1303 		karg->pciInfo.u.bits.busNumber = pdev->bus->number;
1304 		karg->pciInfo.u.bits.deviceNumber = PCI_SLOT( pdev->devfn );
1305 		karg->pciInfo.u.bits.functionNumber = PCI_FUNC( pdev->devfn );
1306 	} else if (cim_rev == 2) {
1307 		/* Get the PCI bus, device, function and segment ID numbers
1308 		   for the IOC */
1309 		karg->pciInfo.u.bits.busNumber = pdev->bus->number;
1310 		karg->pciInfo.u.bits.deviceNumber = PCI_SLOT( pdev->devfn );
1311 		karg->pciInfo.u.bits.functionNumber = PCI_FUNC( pdev->devfn );
1312 		karg->pciInfo.segmentID = pci_domain_nr(pdev->bus);
1313 	}
1314 
1315 	/* Get number of devices
1316          */
1317 	karg->numDevices = 0;
1318 	if (ioc->sh) {
1319 		shost_for_each_device(sdev, ioc->sh) {
1320 			vdevice = sdev->hostdata;
1321 			if (vdevice->vtarget->tflags &
1322 			    MPT_TARGET_FLAGS_RAID_COMPONENT)
1323 				continue;
1324 			karg->numDevices++;
1325 		}
1326 	}
1327 
1328 	/* Set the BIOS and FW Version
1329 	 */
1330 	karg->FWVersion = ioc->facts.FWVersion.Word;
1331 	karg->BIOSVersion = ioc->biosVersion;
1332 
1333 	/* Set the Version Strings.
1334 	 */
1335 	strncpy (karg->driverVersion, MPT_LINUX_PACKAGE_NAME, MPT_IOCTL_VERSION_LENGTH);
1336 	karg->driverVersion[MPT_IOCTL_VERSION_LENGTH-1]='\0';
1337 
1338 	karg->busChangeEvent = 0;
1339 	karg->hostId = ioc->pfacts[port].PortSCSIID;
1340 	karg->rsvd[0] = karg->rsvd[1] = 0;
1341 
1342 	/* Copy the data from kernel memory to user memory
1343 	 */
1344 	if (copy_to_user((char __user *)arg, karg, data_size)) {
1345 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_getiocinfo - "
1346 			"Unable to write out mpt_ioctl_iocinfo struct @ %p\n",
1347 			ioc->name, __FILE__, __LINE__, uarg);
1348 		kfree(karg);
1349 		return -EFAULT;
1350 	}
1351 
1352 	kfree(karg);
1353 	return 0;
1354 }
1355 
1356 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1357 /*
1358  *	mptctl_gettargetinfo - Query the host adapter for target information.
1359  *	@arg: User space argument
1360  *
1361  * Outputs:	None.
1362  * Return:	0 if successful
1363  *		-EFAULT if data unavailable
1364  *		-ENODEV  if no such device/adapter
1365  */
1366 static int
1367 mptctl_gettargetinfo (unsigned long arg)
1368 {
1369 	struct mpt_ioctl_targetinfo __user *uarg = (void __user *) arg;
1370 	struct mpt_ioctl_targetinfo karg;
1371 	MPT_ADAPTER		*ioc;
1372 	VirtDevice		*vdevice;
1373 	char			*pmem;
1374 	int			*pdata;
1375 	int			iocnum;
1376 	int			numDevices = 0;
1377 	int			lun;
1378 	int			maxWordsLeft;
1379 	int			numBytes;
1380 	u8			port;
1381 	struct scsi_device 	*sdev;
1382 
1383 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_targetinfo))) {
1384 		printk(KERN_ERR MYNAM "%s@%d::mptctl_gettargetinfo - "
1385 			"Unable to read in mpt_ioctl_targetinfo struct @ %p\n",
1386 				__FILE__, __LINE__, uarg);
1387 		return -EFAULT;
1388 	}
1389 
1390 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
1391 	    (ioc == NULL)) {
1392 		printk(KERN_DEBUG MYNAM "%s::mptctl_gettargetinfo() @%d - ioc%d not found!\n",
1393 				__FILE__, __LINE__, iocnum);
1394 		return -ENODEV;
1395 	}
1396 
1397 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_gettargetinfo called.\n",
1398 	    ioc->name));
1399 	/* Get the port number and set the maximum number of bytes
1400 	 * in the returned structure.
1401 	 * Ignore the port setting.
1402 	 */
1403 	numBytes = karg.hdr.maxDataSize - sizeof(mpt_ioctl_header);
1404 	maxWordsLeft = numBytes/sizeof(int);
1405 	port = karg.hdr.port;
1406 
1407 	if (maxWordsLeft <= 0) {
1408 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_gettargetinfo() - no memory available!\n",
1409 			ioc->name, __FILE__, __LINE__);
1410 		return -ENOMEM;
1411 	}
1412 
1413 	/* Fill in the data and return the structure to the calling
1414 	 * program
1415 	 */
1416 
1417 	/* struct mpt_ioctl_targetinfo does not contain sufficient space
1418 	 * for the target structures so when the IOCTL is called, there is
1419 	 * not sufficient stack space for the structure. Allocate memory,
1420 	 * populate the memory, copy back to the user, then free memory.
1421 	 * targetInfo format:
1422 	 * bits 31-24: reserved
1423 	 *      23-16: LUN
1424 	 *      15- 8: Bus Number
1425 	 *       7- 0: Target ID
1426 	 */
1427 	pmem = kzalloc(numBytes, GFP_KERNEL);
1428 	if (!pmem) {
1429 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_gettargetinfo() - no memory available!\n",
1430 			ioc->name, __FILE__, __LINE__);
1431 		return -ENOMEM;
1432 	}
1433 	pdata =  (int *) pmem;
1434 
1435 	/* Get number of devices
1436          */
1437 	if (ioc->sh){
1438 		shost_for_each_device(sdev, ioc->sh) {
1439 			if (!maxWordsLeft)
1440 				continue;
1441 			vdevice = sdev->hostdata;
1442 			if (vdevice->vtarget->tflags &
1443 			    MPT_TARGET_FLAGS_RAID_COMPONENT)
1444 				continue;
1445 			lun = (vdevice->vtarget->raidVolume) ? 0x80 : vdevice->lun;
1446 			*pdata = (((u8)lun << 16) + (vdevice->vtarget->channel << 8) +
1447 			    (vdevice->vtarget->id ));
1448 			pdata++;
1449 			numDevices++;
1450 			--maxWordsLeft;
1451 		}
1452 	}
1453 	karg.numDevices = numDevices;
1454 
1455 	/* Copy part of the data from kernel memory to user memory
1456 	 */
1457 	if (copy_to_user((char __user *)arg, &karg,
1458 				sizeof(struct mpt_ioctl_targetinfo))) {
1459 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_gettargetinfo - "
1460 			"Unable to write out mpt_ioctl_targetinfo struct @ %p\n",
1461 			ioc->name, __FILE__, __LINE__, uarg);
1462 		kfree(pmem);
1463 		return -EFAULT;
1464 	}
1465 
1466 	/* Copy the remaining data from kernel memory to user memory
1467 	 */
1468 	if (copy_to_user(uarg->targetInfo, pmem, numBytes)) {
1469 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_gettargetinfo - "
1470 			"Unable to write out mpt_ioctl_targetinfo struct @ %p\n",
1471 			ioc->name, __FILE__, __LINE__, pdata);
1472 		kfree(pmem);
1473 		return -EFAULT;
1474 	}
1475 
1476 	kfree(pmem);
1477 
1478 	return 0;
1479 }
1480 
1481 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1482 /* MPT IOCTL Test function.
1483  *
1484  * Outputs:	None.
1485  * Return:	0 if successful
1486  *		-EFAULT if data unavailable
1487  *		-ENODEV  if no such device/adapter
1488  */
1489 static int
1490 mptctl_readtest (unsigned long arg)
1491 {
1492 	struct mpt_ioctl_test __user *uarg = (void __user *) arg;
1493 	struct mpt_ioctl_test	 karg;
1494 	MPT_ADAPTER *ioc;
1495 	int iocnum;
1496 
1497 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_test))) {
1498 		printk(KERN_ERR MYNAM "%s@%d::mptctl_readtest - "
1499 			"Unable to read in mpt_ioctl_test struct @ %p\n",
1500 				__FILE__, __LINE__, uarg);
1501 		return -EFAULT;
1502 	}
1503 
1504 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
1505 	    (ioc == NULL)) {
1506 		printk(KERN_DEBUG MYNAM "%s::mptctl_readtest() @%d - ioc%d not found!\n",
1507 				__FILE__, __LINE__, iocnum);
1508 		return -ENODEV;
1509 	}
1510 
1511 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_readtest called.\n",
1512 	    ioc->name));
1513 	/* Fill in the data and return the structure to the calling
1514 	 * program
1515 	 */
1516 
1517 #ifdef MFCNT
1518 	karg.chip_type = ioc->mfcnt;
1519 #else
1520 	karg.chip_type = ioc->pcidev->device;
1521 #endif
1522 	strncpy (karg.name, ioc->name, MPT_MAX_NAME);
1523 	karg.name[MPT_MAX_NAME-1]='\0';
1524 	strncpy (karg.product, ioc->prod_name, MPT_PRODUCT_LENGTH);
1525 	karg.product[MPT_PRODUCT_LENGTH-1]='\0';
1526 
1527 	/* Copy the data from kernel memory to user memory
1528 	 */
1529 	if (copy_to_user((char __user *)arg, &karg, sizeof(struct mpt_ioctl_test))) {
1530 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_readtest - "
1531 			"Unable to write out mpt_ioctl_test struct @ %p\n",
1532 			ioc->name, __FILE__, __LINE__, uarg);
1533 		return -EFAULT;
1534 	}
1535 
1536 	return 0;
1537 }
1538 
1539 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1540 /*
1541  *	mptctl_eventquery - Query the host adapter for the event types
1542  *	that are being logged.
1543  *	@arg: User space argument
1544  *
1545  * Outputs:	None.
1546  * Return:	0 if successful
1547  *		-EFAULT if data unavailable
1548  *		-ENODEV  if no such device/adapter
1549  */
1550 static int
1551 mptctl_eventquery (unsigned long arg)
1552 {
1553 	struct mpt_ioctl_eventquery __user *uarg = (void __user *) arg;
1554 	struct mpt_ioctl_eventquery	 karg;
1555 	MPT_ADAPTER *ioc;
1556 	int iocnum;
1557 
1558 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_eventquery))) {
1559 		printk(KERN_ERR MYNAM "%s@%d::mptctl_eventquery - "
1560 			"Unable to read in mpt_ioctl_eventquery struct @ %p\n",
1561 				__FILE__, __LINE__, uarg);
1562 		return -EFAULT;
1563 	}
1564 
1565 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
1566 	    (ioc == NULL)) {
1567 		printk(KERN_DEBUG MYNAM "%s::mptctl_eventquery() @%d - ioc%d not found!\n",
1568 				__FILE__, __LINE__, iocnum);
1569 		return -ENODEV;
1570 	}
1571 
1572 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_eventquery called.\n",
1573 	    ioc->name));
1574 	karg.eventEntries = MPTCTL_EVENT_LOG_SIZE;
1575 	karg.eventTypes = ioc->eventTypes;
1576 
1577 	/* Copy the data from kernel memory to user memory
1578 	 */
1579 	if (copy_to_user((char __user *)arg, &karg, sizeof(struct mpt_ioctl_eventquery))) {
1580 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_eventquery - "
1581 			"Unable to write out mpt_ioctl_eventquery struct @ %p\n",
1582 			ioc->name, __FILE__, __LINE__, uarg);
1583 		return -EFAULT;
1584 	}
1585 	return 0;
1586 }
1587 
1588 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1589 static int
1590 mptctl_eventenable (unsigned long arg)
1591 {
1592 	struct mpt_ioctl_eventenable __user *uarg = (void __user *) arg;
1593 	struct mpt_ioctl_eventenable	 karg;
1594 	MPT_ADAPTER *ioc;
1595 	int iocnum;
1596 
1597 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_eventenable))) {
1598 		printk(KERN_ERR MYNAM "%s@%d::mptctl_eventenable - "
1599 			"Unable to read in mpt_ioctl_eventenable struct @ %p\n",
1600 				__FILE__, __LINE__, uarg);
1601 		return -EFAULT;
1602 	}
1603 
1604 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
1605 	    (ioc == NULL)) {
1606 		printk(KERN_DEBUG MYNAM "%s::mptctl_eventenable() @%d - ioc%d not found!\n",
1607 				__FILE__, __LINE__, iocnum);
1608 		return -ENODEV;
1609 	}
1610 
1611 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_eventenable called.\n",
1612 	    ioc->name));
1613 	if (ioc->events == NULL) {
1614 		/* Have not yet allocated memory - do so now.
1615 		 */
1616 		int sz = MPTCTL_EVENT_LOG_SIZE * sizeof(MPT_IOCTL_EVENTS);
1617 		ioc->events = kzalloc(sz, GFP_KERNEL);
1618 		if (!ioc->events) {
1619 			printk(MYIOC_s_ERR_FMT
1620 			    ": ERROR - Insufficient memory to add adapter!\n",
1621 			    ioc->name);
1622 			return -ENOMEM;
1623 		}
1624 		ioc->alloc_total += sz;
1625 
1626 		ioc->eventContext = 0;
1627         }
1628 
1629 	/* Update the IOC event logging flag.
1630 	 */
1631 	ioc->eventTypes = karg.eventTypes;
1632 
1633 	return 0;
1634 }
1635 
1636 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1637 static int
1638 mptctl_eventreport (unsigned long arg)
1639 {
1640 	struct mpt_ioctl_eventreport __user *uarg = (void __user *) arg;
1641 	struct mpt_ioctl_eventreport	 karg;
1642 	MPT_ADAPTER		 *ioc;
1643 	int			 iocnum;
1644 	int			 numBytes, maxEvents, max;
1645 
1646 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_eventreport))) {
1647 		printk(KERN_ERR MYNAM "%s@%d::mptctl_eventreport - "
1648 			"Unable to read in mpt_ioctl_eventreport struct @ %p\n",
1649 				__FILE__, __LINE__, uarg);
1650 		return -EFAULT;
1651 	}
1652 
1653 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
1654 	    (ioc == NULL)) {
1655 		printk(KERN_DEBUG MYNAM "%s::mptctl_eventreport() @%d - ioc%d not found!\n",
1656 				__FILE__, __LINE__, iocnum);
1657 		return -ENODEV;
1658 	}
1659 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_eventreport called.\n",
1660 	    ioc->name));
1661 
1662 	numBytes = karg.hdr.maxDataSize - sizeof(mpt_ioctl_header);
1663 	maxEvents = numBytes/sizeof(MPT_IOCTL_EVENTS);
1664 
1665 
1666 	max = MPTCTL_EVENT_LOG_SIZE < maxEvents ? MPTCTL_EVENT_LOG_SIZE : maxEvents;
1667 
1668 	/* If fewer than 1 event is requested, there must have
1669 	 * been some type of error.
1670 	 */
1671 	if ((max < 1) || !ioc->events)
1672 		return -ENODATA;
1673 
1674 	/* reset this flag so SIGIO can restart */
1675 	ioc->aen_event_read_flag=0;
1676 
1677 	/* Copy the data from kernel memory to user memory
1678 	 */
1679 	numBytes = max * sizeof(MPT_IOCTL_EVENTS);
1680 	if (copy_to_user(uarg->eventData, ioc->events, numBytes)) {
1681 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_eventreport - "
1682 			"Unable to write out mpt_ioctl_eventreport struct @ %p\n",
1683 			ioc->name, __FILE__, __LINE__, ioc->events);
1684 		return -EFAULT;
1685 	}
1686 
1687 	return 0;
1688 }
1689 
1690 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1691 static int
1692 mptctl_replace_fw (unsigned long arg)
1693 {
1694 	struct mpt_ioctl_replace_fw __user *uarg = (void __user *) arg;
1695 	struct mpt_ioctl_replace_fw	 karg;
1696 	MPT_ADAPTER		 *ioc;
1697 	int			 iocnum;
1698 	int			 newFwSize;
1699 
1700 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_replace_fw))) {
1701 		printk(KERN_ERR MYNAM "%s@%d::mptctl_replace_fw - "
1702 			"Unable to read in mpt_ioctl_replace_fw struct @ %p\n",
1703 				__FILE__, __LINE__, uarg);
1704 		return -EFAULT;
1705 	}
1706 
1707 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
1708 	    (ioc == NULL)) {
1709 		printk(KERN_DEBUG MYNAM "%s::mptctl_replace_fw() @%d - ioc%d not found!\n",
1710 				__FILE__, __LINE__, iocnum);
1711 		return -ENODEV;
1712 	}
1713 
1714 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_replace_fw called.\n",
1715 	    ioc->name));
1716 	/* If caching FW, Free the old FW image
1717 	 */
1718 	if (ioc->cached_fw == NULL)
1719 		return 0;
1720 
1721 	mpt_free_fw_memory(ioc);
1722 
1723 	/* Allocate memory for the new FW image
1724 	 */
1725 	newFwSize = karg.newImageSize;
1726 
1727 	if (newFwSize & 0x01)
1728 		newFwSize += 1;
1729 	if (newFwSize & 0x02)
1730 		newFwSize += 2;
1731 
1732 	mpt_alloc_fw_memory(ioc, newFwSize);
1733 	if (ioc->cached_fw == NULL)
1734 		return -ENOMEM;
1735 
1736 	/* Copy the data from user memory to kernel space
1737 	 */
1738 	if (copy_from_user(ioc->cached_fw, uarg->newImage, newFwSize)) {
1739 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_replace_fw - "
1740 				"Unable to read in mpt_ioctl_replace_fw image "
1741 				"@ %p\n", ioc->name, __FILE__, __LINE__, uarg);
1742 		mpt_free_fw_memory(ioc);
1743 		return -EFAULT;
1744 	}
1745 
1746 	/* Update IOCFactsReply
1747 	 */
1748 	ioc->facts.FWImageSize = newFwSize;
1749 	return 0;
1750 }
1751 
1752 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1753 /* MPT IOCTL MPTCOMMAND function.
1754  * Cast the arg into the mpt_ioctl_mpt_command structure.
1755  *
1756  * Outputs:	None.
1757  * Return:	0 if successful
1758  *		-EBUSY  if previous command timeout and IOC reset is not complete.
1759  *		-EFAULT if data unavailable
1760  *		-ENODEV if no such device/adapter
1761  *		-ETIME	if timer expires
1762  *		-ENOMEM if memory allocation error
1763  */
1764 static int
1765 mptctl_mpt_command (unsigned long arg)
1766 {
1767 	struct mpt_ioctl_command __user *uarg = (void __user *) arg;
1768 	struct mpt_ioctl_command  karg;
1769 	MPT_ADAPTER	*ioc;
1770 	int		iocnum;
1771 	int		rc;
1772 
1773 
1774 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_command))) {
1775 		printk(KERN_ERR MYNAM "%s@%d::mptctl_mpt_command - "
1776 			"Unable to read in mpt_ioctl_command struct @ %p\n",
1777 				__FILE__, __LINE__, uarg);
1778 		return -EFAULT;
1779 	}
1780 
1781 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
1782 	    (ioc == NULL)) {
1783 		printk(KERN_DEBUG MYNAM "%s::mptctl_mpt_command() @%d - ioc%d not found!\n",
1784 				__FILE__, __LINE__, iocnum);
1785 		return -ENODEV;
1786 	}
1787 
1788 	rc = mptctl_do_mpt_command (karg, &uarg->MF);
1789 
1790 	return rc;
1791 }
1792 
1793 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1794 /* Worker routine for the IOCTL MPTCOMMAND and MPTCOMMAND32 (sparc) commands.
1795  *
1796  * Outputs:	None.
1797  * Return:	0 if successful
1798  *		-EBUSY  if previous command timeout and IOC reset is not complete.
1799  *		-EFAULT if data unavailable
1800  *		-ENODEV if no such device/adapter
1801  *		-ETIME	if timer expires
1802  *		-ENOMEM if memory allocation error
1803  *		-EPERM if SCSI I/O and target is untagged
1804  */
1805 static int
1806 mptctl_do_mpt_command (struct mpt_ioctl_command karg, void __user *mfPtr)
1807 {
1808 	MPT_ADAPTER	*ioc;
1809 	MPT_FRAME_HDR	*mf = NULL;
1810 	MPIHeader_t	*hdr;
1811 	char		*psge;
1812 	struct buflist	bufIn;	/* data In buffer */
1813 	struct buflist	bufOut; /* data Out buffer */
1814 	dma_addr_t	dma_addr_in;
1815 	dma_addr_t	dma_addr_out;
1816 	int		sgSize = 0;	/* Num SG elements */
1817 	int		iocnum, flagsLength;
1818 	int		sz, rc = 0;
1819 	int		msgContext;
1820 	u16		req_idx;
1821 	ulong 		timeout;
1822 	unsigned long	timeleft;
1823 	struct scsi_device *sdev;
1824 	unsigned long	 flags;
1825 	u8		 function;
1826 
1827 	/* bufIn and bufOut are used for user to kernel space transfers
1828 	 */
1829 	bufIn.kptr = bufOut.kptr = NULL;
1830 	bufIn.len = bufOut.len = 0;
1831 
1832 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
1833 	    (ioc == NULL)) {
1834 		printk(KERN_DEBUG MYNAM "%s::mptctl_do_mpt_command() @%d - ioc%d not found!\n",
1835 				__FILE__, __LINE__, iocnum);
1836 		return -ENODEV;
1837 	}
1838 
1839 	spin_lock_irqsave(&ioc->taskmgmt_lock, flags);
1840 	if (ioc->ioc_reset_in_progress) {
1841 		spin_unlock_irqrestore(&ioc->taskmgmt_lock, flags);
1842 		printk(KERN_ERR MYNAM "%s@%d::mptctl_do_mpt_command - "
1843 			"Busy with diagnostic reset\n", __FILE__, __LINE__);
1844 		return -EBUSY;
1845 	}
1846 	spin_unlock_irqrestore(&ioc->taskmgmt_lock, flags);
1847 
1848 	/* Verify that the final request frame will not be too large.
1849 	 */
1850 	sz = karg.dataSgeOffset * 4;
1851 	if (karg.dataInSize > 0)
1852 		sz += ioc->SGE_size;
1853 	if (karg.dataOutSize > 0)
1854 		sz += ioc->SGE_size;
1855 
1856 	if (sz > ioc->req_sz) {
1857 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
1858 			"Request frame too large (%d) maximum (%d)\n",
1859 			ioc->name, __FILE__, __LINE__, sz, ioc->req_sz);
1860 		return -EFAULT;
1861 	}
1862 
1863 	/* Get a free request frame and save the message context.
1864 	 */
1865         if ((mf = mpt_get_msg_frame(mptctl_id, ioc)) == NULL)
1866                 return -EAGAIN;
1867 
1868 	hdr = (MPIHeader_t *) mf;
1869 	msgContext = le32_to_cpu(hdr->MsgContext);
1870 	req_idx = le16_to_cpu(mf->u.frame.hwhdr.msgctxu.fld.req_idx);
1871 
1872 	/* Copy the request frame
1873 	 * Reset the saved message context.
1874 	 * Request frame in user space
1875 	 */
1876 	if (copy_from_user(mf, mfPtr, karg.dataSgeOffset * 4)) {
1877 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
1878 			"Unable to read MF from mpt_ioctl_command struct @ %p\n",
1879 			ioc->name, __FILE__, __LINE__, mfPtr);
1880 		function = -1;
1881 		rc = -EFAULT;
1882 		goto done_free_mem;
1883 	}
1884 	hdr->MsgContext = cpu_to_le32(msgContext);
1885 	function = hdr->Function;
1886 
1887 
1888 	/* Verify that this request is allowed.
1889 	 */
1890 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sending mpi function (0x%02X), req=%p\n",
1891 	    ioc->name, hdr->Function, mf));
1892 
1893 	switch (function) {
1894 	case MPI_FUNCTION_IOC_FACTS:
1895 	case MPI_FUNCTION_PORT_FACTS:
1896 		karg.dataOutSize  = karg.dataInSize = 0;
1897 		break;
1898 
1899 	case MPI_FUNCTION_CONFIG:
1900 	{
1901 		Config_t *config_frame;
1902 		config_frame = (Config_t *)mf;
1903 		dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "\ttype=0x%02x ext_type=0x%02x "
1904 		    "number=0x%02x action=0x%02x\n", ioc->name,
1905 		    config_frame->Header.PageType,
1906 		    config_frame->ExtPageType,
1907 		    config_frame->Header.PageNumber,
1908 		    config_frame->Action));
1909 		break;
1910 	}
1911 
1912 	case MPI_FUNCTION_FC_COMMON_TRANSPORT_SEND:
1913 	case MPI_FUNCTION_FC_EX_LINK_SRVC_SEND:
1914 	case MPI_FUNCTION_FW_UPLOAD:
1915 	case MPI_FUNCTION_SCSI_ENCLOSURE_PROCESSOR:
1916 	case MPI_FUNCTION_FW_DOWNLOAD:
1917 	case MPI_FUNCTION_FC_PRIMITIVE_SEND:
1918 	case MPI_FUNCTION_TOOLBOX:
1919 	case MPI_FUNCTION_SAS_IO_UNIT_CONTROL:
1920 		break;
1921 
1922 	case MPI_FUNCTION_SCSI_IO_REQUEST:
1923 		if (ioc->sh) {
1924 			SCSIIORequest_t *pScsiReq = (SCSIIORequest_t *) mf;
1925 			int qtag = MPI_SCSIIO_CONTROL_UNTAGGED;
1926 			int scsidir = 0;
1927 			int dataSize;
1928 			u32 id;
1929 
1930 			id = (ioc->devices_per_bus == 0) ? 256 : ioc->devices_per_bus;
1931 			if (pScsiReq->TargetID > id) {
1932 				printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
1933 					"Target ID out of bounds. \n",
1934 					ioc->name, __FILE__, __LINE__);
1935 				rc = -ENODEV;
1936 				goto done_free_mem;
1937 			}
1938 
1939 			if (pScsiReq->Bus >= ioc->number_of_buses) {
1940 				printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
1941 					"Target Bus out of bounds. \n",
1942 					ioc->name, __FILE__, __LINE__);
1943 				rc = -ENODEV;
1944 				goto done_free_mem;
1945 			}
1946 
1947 			pScsiReq->MsgFlags &= ~MPI_SCSIIO_MSGFLGS_SENSE_WIDTH;
1948 			pScsiReq->MsgFlags |= mpt_msg_flags(ioc);
1949 
1950 
1951 			/* verify that app has not requested
1952 			 *	more sense data than driver
1953 			 *	can provide, if so, reset this parameter
1954 			 * set the sense buffer pointer low address
1955 			 * update the control field to specify Q type
1956 			 */
1957 			if (karg.maxSenseBytes > MPT_SENSE_BUFFER_SIZE)
1958 				pScsiReq->SenseBufferLength = MPT_SENSE_BUFFER_SIZE;
1959 			else
1960 				pScsiReq->SenseBufferLength = karg.maxSenseBytes;
1961 
1962 			pScsiReq->SenseBufferLowAddr =
1963 				cpu_to_le32(ioc->sense_buf_low_dma
1964 				   + (req_idx * MPT_SENSE_BUFFER_ALLOC));
1965 
1966 			shost_for_each_device(sdev, ioc->sh) {
1967 				struct scsi_target *starget = scsi_target(sdev);
1968 				VirtTarget *vtarget = starget->hostdata;
1969 
1970 				if ((pScsiReq->TargetID == vtarget->id) &&
1971 				    (pScsiReq->Bus == vtarget->channel) &&
1972 				    (vtarget->tflags & MPT_TARGET_FLAGS_Q_YES))
1973 					qtag = MPI_SCSIIO_CONTROL_SIMPLEQ;
1974 			}
1975 
1976 			/* Have the IOCTL driver set the direction based
1977 			 * on the dataOutSize (ordering issue with Sparc).
1978 			 */
1979 			if (karg.dataOutSize > 0) {
1980 				scsidir = MPI_SCSIIO_CONTROL_WRITE;
1981 				dataSize = karg.dataOutSize;
1982 			} else {
1983 				scsidir = MPI_SCSIIO_CONTROL_READ;
1984 				dataSize = karg.dataInSize;
1985 			}
1986 
1987 			pScsiReq->Control = cpu_to_le32(scsidir | qtag);
1988 			pScsiReq->DataLength = cpu_to_le32(dataSize);
1989 
1990 
1991 		} else {
1992 			printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
1993 				"SCSI driver is not loaded. \n",
1994 				ioc->name, __FILE__, __LINE__);
1995 			rc = -EFAULT;
1996 			goto done_free_mem;
1997 		}
1998 		break;
1999 
2000 	case MPI_FUNCTION_SMP_PASSTHROUGH:
2001 		/* Check mf->PassthruFlags to determine if
2002 		 * transfer is ImmediateMode or not.
2003 		 * Immediate mode returns data in the ReplyFrame.
2004 		 * Else, we are sending request and response data
2005 		 * in two SGLs at the end of the mf.
2006 		 */
2007 		break;
2008 
2009 	case MPI_FUNCTION_SATA_PASSTHROUGH:
2010 		if (!ioc->sh) {
2011 			printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
2012 				"SCSI driver is not loaded. \n",
2013 				ioc->name, __FILE__, __LINE__);
2014 			rc = -EFAULT;
2015 			goto done_free_mem;
2016 		}
2017 		break;
2018 
2019 	case MPI_FUNCTION_RAID_ACTION:
2020 		/* Just add a SGE
2021 		 */
2022 		break;
2023 
2024 	case MPI_FUNCTION_RAID_SCSI_IO_PASSTHROUGH:
2025 		if (ioc->sh) {
2026 			SCSIIORequest_t *pScsiReq = (SCSIIORequest_t *) mf;
2027 			int qtag = MPI_SCSIIO_CONTROL_SIMPLEQ;
2028 			int scsidir = MPI_SCSIIO_CONTROL_READ;
2029 			int dataSize;
2030 
2031 			pScsiReq->MsgFlags &= ~MPI_SCSIIO_MSGFLGS_SENSE_WIDTH;
2032 			pScsiReq->MsgFlags |= mpt_msg_flags(ioc);
2033 
2034 
2035 			/* verify that app has not requested
2036 			 *	more sense data than driver
2037 			 *	can provide, if so, reset this parameter
2038 			 * set the sense buffer pointer low address
2039 			 * update the control field to specify Q type
2040 			 */
2041 			if (karg.maxSenseBytes > MPT_SENSE_BUFFER_SIZE)
2042 				pScsiReq->SenseBufferLength = MPT_SENSE_BUFFER_SIZE;
2043 			else
2044 				pScsiReq->SenseBufferLength = karg.maxSenseBytes;
2045 
2046 			pScsiReq->SenseBufferLowAddr =
2047 				cpu_to_le32(ioc->sense_buf_low_dma
2048 				   + (req_idx * MPT_SENSE_BUFFER_ALLOC));
2049 
2050 			/* All commands to physical devices are tagged
2051 			 */
2052 
2053 			/* Have the IOCTL driver set the direction based
2054 			 * on the dataOutSize (ordering issue with Sparc).
2055 			 */
2056 			if (karg.dataOutSize > 0) {
2057 				scsidir = MPI_SCSIIO_CONTROL_WRITE;
2058 				dataSize = karg.dataOutSize;
2059 			} else {
2060 				scsidir = MPI_SCSIIO_CONTROL_READ;
2061 				dataSize = karg.dataInSize;
2062 			}
2063 
2064 			pScsiReq->Control = cpu_to_le32(scsidir | qtag);
2065 			pScsiReq->DataLength = cpu_to_le32(dataSize);
2066 
2067 		} else {
2068 			printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
2069 				"SCSI driver is not loaded. \n",
2070 				ioc->name, __FILE__, __LINE__);
2071 			rc = -EFAULT;
2072 			goto done_free_mem;
2073 		}
2074 		break;
2075 
2076 	case MPI_FUNCTION_SCSI_TASK_MGMT:
2077 	{
2078 		SCSITaskMgmt_t	*pScsiTm;
2079 		pScsiTm = (SCSITaskMgmt_t *)mf;
2080 		dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT
2081 			"\tTaskType=0x%x MsgFlags=0x%x "
2082 			"TaskMsgContext=0x%x id=%d channel=%d\n",
2083 			ioc->name, pScsiTm->TaskType, le32_to_cpu
2084 			(pScsiTm->TaskMsgContext), pScsiTm->MsgFlags,
2085 			pScsiTm->TargetID, pScsiTm->Bus));
2086 		break;
2087 	}
2088 
2089 	case MPI_FUNCTION_IOC_INIT:
2090 		{
2091 			IOCInit_t	*pInit = (IOCInit_t *) mf;
2092 			u32		high_addr, sense_high;
2093 
2094 			/* Verify that all entries in the IOC INIT match
2095 			 * existing setup (and in LE format).
2096 			 */
2097 			if (sizeof(dma_addr_t) == sizeof(u64)) {
2098 				high_addr = cpu_to_le32((u32)((u64)ioc->req_frames_dma >> 32));
2099 				sense_high= cpu_to_le32((u32)((u64)ioc->sense_buf_pool_dma >> 32));
2100 			} else {
2101 				high_addr = 0;
2102 				sense_high= 0;
2103 			}
2104 
2105 			if ((pInit->Flags != 0) || (pInit->MaxDevices != ioc->facts.MaxDevices) ||
2106 				(pInit->MaxBuses != ioc->facts.MaxBuses) ||
2107 				(pInit->ReplyFrameSize != cpu_to_le16(ioc->reply_sz)) ||
2108 				(pInit->HostMfaHighAddr != high_addr) ||
2109 				(pInit->SenseBufferHighAddr != sense_high)) {
2110 				printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
2111 					"IOC_INIT issued with 1 or more incorrect parameters. Rejected.\n",
2112 					ioc->name, __FILE__, __LINE__);
2113 				rc = -EFAULT;
2114 				goto done_free_mem;
2115 			}
2116 		}
2117 		break;
2118 	default:
2119 		/*
2120 		 * MPI_FUNCTION_PORT_ENABLE
2121 		 * MPI_FUNCTION_TARGET_CMD_BUFFER_POST
2122 		 * MPI_FUNCTION_TARGET_ASSIST
2123 		 * MPI_FUNCTION_TARGET_STATUS_SEND
2124 		 * MPI_FUNCTION_TARGET_MODE_ABORT
2125 		 * MPI_FUNCTION_IOC_MESSAGE_UNIT_RESET
2126 		 * MPI_FUNCTION_IO_UNIT_RESET
2127 		 * MPI_FUNCTION_HANDSHAKE
2128 		 * MPI_FUNCTION_REPLY_FRAME_REMOVAL
2129 		 * MPI_FUNCTION_EVENT_NOTIFICATION
2130 		 *  (driver handles event notification)
2131 		 * MPI_FUNCTION_EVENT_ACK
2132 		 */
2133 
2134 		/*  What to do with these???  CHECK ME!!!
2135 			MPI_FUNCTION_FC_LINK_SRVC_BUF_POST
2136 			MPI_FUNCTION_FC_LINK_SRVC_RSP
2137 			MPI_FUNCTION_FC_ABORT
2138 			MPI_FUNCTION_LAN_SEND
2139 			MPI_FUNCTION_LAN_RECEIVE
2140 		 	MPI_FUNCTION_LAN_RESET
2141 		*/
2142 
2143 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
2144 			"Illegal request (function 0x%x) \n",
2145 			ioc->name, __FILE__, __LINE__, hdr->Function);
2146 		rc = -EFAULT;
2147 		goto done_free_mem;
2148 	}
2149 
2150 	/* Add the SGL ( at most one data in SGE and one data out SGE )
2151 	 * In the case of two SGE's - the data out (write) will always
2152 	 * preceede the data in (read) SGE. psgList is used to free the
2153 	 * allocated memory.
2154 	 */
2155 	psge = (char *) (((int *) mf) + karg.dataSgeOffset);
2156 	flagsLength = 0;
2157 
2158 	if (karg.dataOutSize > 0)
2159 		sgSize ++;
2160 
2161 	if (karg.dataInSize > 0)
2162 		sgSize ++;
2163 
2164 	if (sgSize > 0) {
2165 
2166 		/* Set up the dataOut memory allocation */
2167 		if (karg.dataOutSize > 0) {
2168 			if (karg.dataInSize > 0) {
2169 				flagsLength = ( MPI_SGE_FLAGS_SIMPLE_ELEMENT |
2170 						MPI_SGE_FLAGS_END_OF_BUFFER |
2171 						MPI_SGE_FLAGS_DIRECTION)
2172 						<< MPI_SGE_FLAGS_SHIFT;
2173 			} else {
2174 				flagsLength = MPT_SGE_FLAGS_SSIMPLE_WRITE;
2175 			}
2176 			flagsLength |= karg.dataOutSize;
2177 			bufOut.len = karg.dataOutSize;
2178 			bufOut.kptr = pci_alloc_consistent(
2179 					ioc->pcidev, bufOut.len, &dma_addr_out);
2180 
2181 			if (bufOut.kptr == NULL) {
2182 				rc = -ENOMEM;
2183 				goto done_free_mem;
2184 			} else {
2185 				/* Set up this SGE.
2186 				 * Copy to MF and to sglbuf
2187 				 */
2188 				ioc->add_sge(psge, flagsLength, dma_addr_out);
2189 				psge += ioc->SGE_size;
2190 
2191 				/* Copy user data to kernel space.
2192 				 */
2193 				if (copy_from_user(bufOut.kptr,
2194 						karg.dataOutBufPtr,
2195 						bufOut.len)) {
2196 					printk(MYIOC_s_ERR_FMT
2197 						"%s@%d::mptctl_do_mpt_command - Unable "
2198 						"to read user data "
2199 						"struct @ %p\n",
2200 						ioc->name, __FILE__, __LINE__,karg.dataOutBufPtr);
2201 					rc =  -EFAULT;
2202 					goto done_free_mem;
2203 				}
2204 			}
2205 		}
2206 
2207 		if (karg.dataInSize > 0) {
2208 			flagsLength = MPT_SGE_FLAGS_SSIMPLE_READ;
2209 			flagsLength |= karg.dataInSize;
2210 
2211 			bufIn.len = karg.dataInSize;
2212 			bufIn.kptr = pci_alloc_consistent(ioc->pcidev,
2213 					bufIn.len, &dma_addr_in);
2214 
2215 			if (bufIn.kptr == NULL) {
2216 				rc = -ENOMEM;
2217 				goto done_free_mem;
2218 			} else {
2219 				/* Set up this SGE
2220 				 * Copy to MF and to sglbuf
2221 				 */
2222 				ioc->add_sge(psge, flagsLength, dma_addr_in);
2223 			}
2224 		}
2225 	} else  {
2226 		/* Add a NULL SGE
2227 		 */
2228 		ioc->add_sge(psge, flagsLength, (dma_addr_t) -1);
2229 	}
2230 
2231 	SET_MGMT_MSG_CONTEXT(ioc->ioctl_cmds.msg_context, hdr->MsgContext);
2232 	INITIALIZE_MGMT_STATUS(ioc->ioctl_cmds.status)
2233 	if (hdr->Function == MPI_FUNCTION_SCSI_TASK_MGMT) {
2234 
2235 		mutex_lock(&ioc->taskmgmt_cmds.mutex);
2236 		if (mpt_set_taskmgmt_in_progress_flag(ioc) != 0) {
2237 			mutex_unlock(&ioc->taskmgmt_cmds.mutex);
2238 			goto done_free_mem;
2239 		}
2240 
2241 		DBG_DUMP_TM_REQUEST_FRAME(ioc, (u32 *)mf);
2242 
2243 		if ((ioc->facts.IOCCapabilities & MPI_IOCFACTS_CAPABILITY_HIGH_PRI_Q) &&
2244 		    (ioc->facts.MsgVersion >= MPI_VERSION_01_05))
2245 			mpt_put_msg_frame_hi_pri(mptctl_id, ioc, mf);
2246 		else {
2247 			rc =mpt_send_handshake_request(mptctl_id, ioc,
2248 				sizeof(SCSITaskMgmt_t), (u32*)mf, CAN_SLEEP);
2249 			if (rc != 0) {
2250 				dfailprintk(ioc, printk(MYIOC_s_ERR_FMT
2251 				    "send_handshake FAILED! (ioc %p, mf %p)\n",
2252 				    ioc->name, ioc, mf));
2253 				mpt_clear_taskmgmt_in_progress_flag(ioc);
2254 				rc = -ENODATA;
2255 				mutex_unlock(&ioc->taskmgmt_cmds.mutex);
2256 				goto done_free_mem;
2257 			}
2258 		}
2259 
2260 	} else
2261 		mpt_put_msg_frame(mptctl_id, ioc, mf);
2262 
2263 	/* Now wait for the command to complete */
2264 	timeout = (karg.timeout > 0) ? karg.timeout : MPT_IOCTL_DEFAULT_TIMEOUT;
2265 retry_wait:
2266 	timeleft = wait_for_completion_timeout(&ioc->ioctl_cmds.done,
2267 				HZ*timeout);
2268 	if (!(ioc->ioctl_cmds.status & MPT_MGMT_STATUS_COMMAND_GOOD)) {
2269 		rc = -ETIME;
2270 		dfailprintk(ioc, printk(MYIOC_s_ERR_FMT "%s: TIMED OUT!\n",
2271 		    ioc->name, __func__));
2272 		if (ioc->ioctl_cmds.status & MPT_MGMT_STATUS_DID_IOCRESET) {
2273 			if (function == MPI_FUNCTION_SCSI_TASK_MGMT)
2274 				mutex_unlock(&ioc->taskmgmt_cmds.mutex);
2275 			goto done_free_mem;
2276 		}
2277 		if (!timeleft) {
2278 			if (function == MPI_FUNCTION_SCSI_TASK_MGMT)
2279 				mutex_unlock(&ioc->taskmgmt_cmds.mutex);
2280 			mptctl_timeout_expired(ioc, mf);
2281 			mf = NULL;
2282 		} else
2283 			goto retry_wait;
2284 		goto done_free_mem;
2285 	}
2286 
2287 	if (function == MPI_FUNCTION_SCSI_TASK_MGMT)
2288 		mutex_unlock(&ioc->taskmgmt_cmds.mutex);
2289 
2290 
2291 	mf = NULL;
2292 
2293 	/* If a valid reply frame, copy to the user.
2294 	 * Offset 2: reply length in U32's
2295 	 */
2296 	if (ioc->ioctl_cmds.status & MPT_MGMT_STATUS_RF_VALID) {
2297 		if (karg.maxReplyBytes < ioc->reply_sz) {
2298 			sz = min(karg.maxReplyBytes,
2299 				4*ioc->ioctl_cmds.reply[2]);
2300 		} else {
2301 			 sz = min(ioc->reply_sz, 4*ioc->ioctl_cmds.reply[2]);
2302 		}
2303 		if (sz > 0) {
2304 			if (copy_to_user(karg.replyFrameBufPtr,
2305 				 ioc->ioctl_cmds.reply, sz)){
2306 				 printk(MYIOC_s_ERR_FMT
2307 				     "%s@%d::mptctl_do_mpt_command - "
2308 				 "Unable to write out reply frame %p\n",
2309 				 ioc->name, __FILE__, __LINE__, karg.replyFrameBufPtr);
2310 				 rc =  -ENODATA;
2311 				 goto done_free_mem;
2312 			}
2313 		}
2314 	}
2315 
2316 	/* If valid sense data, copy to user.
2317 	 */
2318 	if (ioc->ioctl_cmds.status & MPT_MGMT_STATUS_SENSE_VALID) {
2319 		sz = min(karg.maxSenseBytes, MPT_SENSE_BUFFER_SIZE);
2320 		if (sz > 0) {
2321 			if (copy_to_user(karg.senseDataPtr,
2322 				ioc->ioctl_cmds.sense, sz)) {
2323 				printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
2324 				"Unable to write sense data to user %p\n",
2325 				ioc->name, __FILE__, __LINE__,
2326 				karg.senseDataPtr);
2327 				rc =  -ENODATA;
2328 				goto done_free_mem;
2329 			}
2330 		}
2331 	}
2332 
2333 	/* If the overall status is _GOOD and data in, copy data
2334 	 * to user.
2335 	 */
2336 	if ((ioc->ioctl_cmds.status & MPT_MGMT_STATUS_COMMAND_GOOD) &&
2337 				(karg.dataInSize > 0) && (bufIn.kptr)) {
2338 
2339 		if (copy_to_user(karg.dataInBufPtr,
2340 				 bufIn.kptr, karg.dataInSize)) {
2341 			printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
2342 				"Unable to write data to user %p\n",
2343 				ioc->name, __FILE__, __LINE__,
2344 				karg.dataInBufPtr);
2345 			rc =  -ENODATA;
2346 		}
2347 	}
2348 
2349 done_free_mem:
2350 
2351 	CLEAR_MGMT_STATUS(ioc->ioctl_cmds.status)
2352 	SET_MGMT_MSG_CONTEXT(ioc->ioctl_cmds.msg_context, 0);
2353 
2354 	/* Free the allocated memory.
2355 	 */
2356 	if (bufOut.kptr != NULL) {
2357 		pci_free_consistent(ioc->pcidev,
2358 			bufOut.len, (void *) bufOut.kptr, dma_addr_out);
2359 	}
2360 
2361 	if (bufIn.kptr != NULL) {
2362 		pci_free_consistent(ioc->pcidev,
2363 			bufIn.len, (void *) bufIn.kptr, dma_addr_in);
2364 	}
2365 
2366 	/* mf is null if command issued successfully
2367 	 * otherwise, failure occured after mf acquired.
2368 	 */
2369 	if (mf)
2370 		mpt_free_msg_frame(ioc, mf);
2371 
2372 	return rc;
2373 }
2374 
2375 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2376 /* Prototype Routine for the HOST INFO command.
2377  *
2378  * Outputs:	None.
2379  * Return:	0 if successful
2380  *		-EFAULT if data unavailable
2381  *		-EBUSY  if previous command timeout and IOC reset is not complete.
2382  *		-ENODEV if no such device/adapter
2383  *		-ETIME	if timer expires
2384  *		-ENOMEM if memory allocation error
2385  */
2386 static int
2387 mptctl_hp_hostinfo(unsigned long arg, unsigned int data_size)
2388 {
2389 	hp_host_info_t	__user *uarg = (void __user *) arg;
2390 	MPT_ADAPTER		*ioc;
2391 	struct pci_dev		*pdev;
2392 	char                    *pbuf=NULL;
2393 	dma_addr_t		buf_dma;
2394 	hp_host_info_t		karg;
2395 	CONFIGPARMS		cfg;
2396 	ConfigPageHeader_t	hdr;
2397 	int			iocnum;
2398 	int			rc, cim_rev;
2399 	ToolboxIstwiReadWriteRequest_t	*IstwiRWRequest;
2400 	MPT_FRAME_HDR		*mf = NULL;
2401 	MPIHeader_t		*mpi_hdr;
2402 	unsigned long		timeleft;
2403 	int			retval;
2404 
2405 	/* Reset long to int. Should affect IA64 and SPARC only
2406 	 */
2407 	if (data_size == sizeof(hp_host_info_t))
2408 		cim_rev = 1;
2409 	else if (data_size == sizeof(hp_host_info_rev0_t))
2410 		cim_rev = 0;	/* obsolete */
2411 	else
2412 		return -EFAULT;
2413 
2414 	if (copy_from_user(&karg, uarg, sizeof(hp_host_info_t))) {
2415 		printk(KERN_ERR MYNAM "%s@%d::mptctl_hp_host_info - "
2416 			"Unable to read in hp_host_info struct @ %p\n",
2417 				__FILE__, __LINE__, uarg);
2418 		return -EFAULT;
2419 	}
2420 
2421 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
2422 	    (ioc == NULL)) {
2423 		printk(KERN_DEBUG MYNAM "%s::mptctl_hp_hostinfo() @%d - ioc%d not found!\n",
2424 				__FILE__, __LINE__, iocnum);
2425 		return -ENODEV;
2426 	}
2427 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT ": mptctl_hp_hostinfo called.\n",
2428 	    ioc->name));
2429 
2430 	/* Fill in the data and return the structure to the calling
2431 	 * program
2432 	 */
2433 	pdev = (struct pci_dev *) ioc->pcidev;
2434 
2435 	karg.vendor = pdev->vendor;
2436 	karg.device = pdev->device;
2437 	karg.subsystem_id = pdev->subsystem_device;
2438 	karg.subsystem_vendor = pdev->subsystem_vendor;
2439 	karg.devfn = pdev->devfn;
2440 	karg.bus = pdev->bus->number;
2441 
2442 	/* Save the SCSI host no. if
2443 	 * SCSI driver loaded
2444 	 */
2445 	if (ioc->sh != NULL)
2446 		karg.host_no = ioc->sh->host_no;
2447 	else
2448 		karg.host_no =  -1;
2449 
2450 	/* Reformat the fw_version into a string
2451 	 */
2452 	karg.fw_version[0] = ioc->facts.FWVersion.Struct.Major >= 10 ?
2453 		((ioc->facts.FWVersion.Struct.Major / 10) + '0') : '0';
2454 	karg.fw_version[1] = (ioc->facts.FWVersion.Struct.Major % 10 ) + '0';
2455 	karg.fw_version[2] = '.';
2456 	karg.fw_version[3] = ioc->facts.FWVersion.Struct.Minor >= 10 ?
2457 		((ioc->facts.FWVersion.Struct.Minor / 10) + '0') : '0';
2458 	karg.fw_version[4] = (ioc->facts.FWVersion.Struct.Minor % 10 ) + '0';
2459 	karg.fw_version[5] = '.';
2460 	karg.fw_version[6] = ioc->facts.FWVersion.Struct.Unit >= 10 ?
2461 		((ioc->facts.FWVersion.Struct.Unit / 10) + '0') : '0';
2462 	karg.fw_version[7] = (ioc->facts.FWVersion.Struct.Unit % 10 ) + '0';
2463 	karg.fw_version[8] = '.';
2464 	karg.fw_version[9] = ioc->facts.FWVersion.Struct.Dev >= 10 ?
2465 		((ioc->facts.FWVersion.Struct.Dev / 10) + '0') : '0';
2466 	karg.fw_version[10] = (ioc->facts.FWVersion.Struct.Dev % 10 ) + '0';
2467 	karg.fw_version[11] = '\0';
2468 
2469 	/* Issue a config request to get the device serial number
2470 	 */
2471 	hdr.PageVersion = 0;
2472 	hdr.PageLength = 0;
2473 	hdr.PageNumber = 0;
2474 	hdr.PageType = MPI_CONFIG_PAGETYPE_MANUFACTURING;
2475 	cfg.cfghdr.hdr = &hdr;
2476 	cfg.physAddr = -1;
2477 	cfg.pageAddr = 0;
2478 	cfg.action = MPI_CONFIG_ACTION_PAGE_HEADER;
2479 	cfg.dir = 0;	/* read */
2480 	cfg.timeout = 10;
2481 
2482 	strncpy(karg.serial_number, " ", 24);
2483 	if (mpt_config(ioc, &cfg) == 0) {
2484 		if (cfg.cfghdr.hdr->PageLength > 0) {
2485 			/* Issue the second config page request */
2486 			cfg.action = MPI_CONFIG_ACTION_PAGE_READ_CURRENT;
2487 
2488 			pbuf = pci_alloc_consistent(ioc->pcidev, hdr.PageLength * 4, &buf_dma);
2489 			if (pbuf) {
2490 				cfg.physAddr = buf_dma;
2491 				if (mpt_config(ioc, &cfg) == 0) {
2492 					ManufacturingPage0_t *pdata = (ManufacturingPage0_t *) pbuf;
2493 					if (strlen(pdata->BoardTracerNumber) > 1) {
2494 						strncpy(karg.serial_number, 									    pdata->BoardTracerNumber, 24);
2495 						karg.serial_number[24-1]='\0';
2496 					}
2497 				}
2498 				pci_free_consistent(ioc->pcidev, hdr.PageLength * 4, pbuf, buf_dma);
2499 				pbuf = NULL;
2500 			}
2501 		}
2502 	}
2503 	rc = mpt_GetIocState(ioc, 1);
2504 	switch (rc) {
2505 	case MPI_IOC_STATE_OPERATIONAL:
2506 		karg.ioc_status =  HP_STATUS_OK;
2507 		break;
2508 
2509 	case MPI_IOC_STATE_FAULT:
2510 		karg.ioc_status =  HP_STATUS_FAILED;
2511 		break;
2512 
2513 	case MPI_IOC_STATE_RESET:
2514 	case MPI_IOC_STATE_READY:
2515 	default:
2516 		karg.ioc_status =  HP_STATUS_OTHER;
2517 		break;
2518 	}
2519 
2520 	karg.base_io_addr = pci_resource_start(pdev, 0);
2521 
2522 	if ((ioc->bus_type == SAS) || (ioc->bus_type == FC))
2523 		karg.bus_phys_width = HP_BUS_WIDTH_UNK;
2524 	else
2525 		karg.bus_phys_width = HP_BUS_WIDTH_16;
2526 
2527 	karg.hard_resets = 0;
2528 	karg.soft_resets = 0;
2529 	karg.timeouts = 0;
2530 	if (ioc->sh != NULL) {
2531 		MPT_SCSI_HOST *hd =  shost_priv(ioc->sh);
2532 
2533 		if (hd && (cim_rev == 1)) {
2534 			karg.hard_resets = ioc->hard_resets;
2535 			karg.soft_resets = ioc->soft_resets;
2536 			karg.timeouts = ioc->timeouts;
2537 		}
2538 	}
2539 
2540 	/*
2541 	 * Gather ISTWI(Industry Standard Two Wire Interface) Data
2542 	 */
2543 	if ((mf = mpt_get_msg_frame(mptctl_id, ioc)) == NULL) {
2544 		dfailprintk(ioc, printk(MYIOC_s_WARN_FMT
2545 			"%s, no msg frames!!\n", ioc->name, __func__));
2546 		goto out;
2547 	}
2548 
2549 	IstwiRWRequest = (ToolboxIstwiReadWriteRequest_t *)mf;
2550 	mpi_hdr = (MPIHeader_t *) mf;
2551 	memset(IstwiRWRequest,0,sizeof(ToolboxIstwiReadWriteRequest_t));
2552 	IstwiRWRequest->Function = MPI_FUNCTION_TOOLBOX;
2553 	IstwiRWRequest->Tool = MPI_TOOLBOX_ISTWI_READ_WRITE_TOOL;
2554 	IstwiRWRequest->MsgContext = mpi_hdr->MsgContext;
2555 	IstwiRWRequest->Flags = MPI_TB_ISTWI_FLAGS_READ;
2556 	IstwiRWRequest->NumAddressBytes = 0x01;
2557 	IstwiRWRequest->DataLength = cpu_to_le16(0x04);
2558 	if (pdev->devfn & 1)
2559 		IstwiRWRequest->DeviceAddr = 0xB2;
2560 	else
2561 		IstwiRWRequest->DeviceAddr = 0xB0;
2562 
2563 	pbuf = pci_alloc_consistent(ioc->pcidev, 4, &buf_dma);
2564 	if (!pbuf)
2565 		goto out;
2566 	ioc->add_sge((char *)&IstwiRWRequest->SGL,
2567 	    (MPT_SGE_FLAGS_SSIMPLE_READ|4), buf_dma);
2568 
2569 	retval = 0;
2570 	SET_MGMT_MSG_CONTEXT(ioc->ioctl_cmds.msg_context,
2571 				IstwiRWRequest->MsgContext);
2572 	INITIALIZE_MGMT_STATUS(ioc->ioctl_cmds.status)
2573 	mpt_put_msg_frame(mptctl_id, ioc, mf);
2574 
2575 retry_wait:
2576 	timeleft = wait_for_completion_timeout(&ioc->ioctl_cmds.done,
2577 			HZ*MPT_IOCTL_DEFAULT_TIMEOUT);
2578 	if (!(ioc->ioctl_cmds.status & MPT_MGMT_STATUS_COMMAND_GOOD)) {
2579 		retval = -ETIME;
2580 		printk(MYIOC_s_WARN_FMT "%s: failed\n", ioc->name, __func__);
2581 		if (ioc->ioctl_cmds.status & MPT_MGMT_STATUS_DID_IOCRESET) {
2582 			mpt_free_msg_frame(ioc, mf);
2583 			goto out;
2584 		}
2585 		if (!timeleft)
2586 			mptctl_timeout_expired(ioc, mf);
2587 		else
2588 			goto retry_wait;
2589 		goto out;
2590 	}
2591 
2592 	/*
2593 	 *ISTWI Data Definition
2594 	 * pbuf[0] = FW_VERSION = 0x4
2595 	 * pbuf[1] = Bay Count = 6 or 4 or 2, depending on
2596 	 *  the config, you should be seeing one out of these three values
2597 	 * pbuf[2] = Drive Installed Map = bit pattern depend on which
2598 	 *   bays have drives in them
2599 	 * pbuf[3] = Checksum (0x100 = (byte0 + byte2 + byte3)
2600 	 */
2601 	if (ioc->ioctl_cmds.status & MPT_MGMT_STATUS_RF_VALID)
2602 		karg.rsvd = *(u32 *)pbuf;
2603 
2604  out:
2605 	CLEAR_MGMT_STATUS(ioc->ioctl_cmds.status)
2606 	SET_MGMT_MSG_CONTEXT(ioc->ioctl_cmds.msg_context, 0);
2607 
2608 	if (pbuf)
2609 		pci_free_consistent(ioc->pcidev, 4, pbuf, buf_dma);
2610 
2611 	/* Copy the data from kernel memory to user memory
2612 	 */
2613 	if (copy_to_user((char __user *)arg, &karg, sizeof(hp_host_info_t))) {
2614 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_hpgethostinfo - "
2615 			"Unable to write out hp_host_info @ %p\n",
2616 			ioc->name, __FILE__, __LINE__, uarg);
2617 		return -EFAULT;
2618 	}
2619 
2620 	return 0;
2621 
2622 }
2623 
2624 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2625 /* Prototype Routine for the TARGET INFO command.
2626  *
2627  * Outputs:	None.
2628  * Return:	0 if successful
2629  *		-EFAULT if data unavailable
2630  *		-EBUSY  if previous command timeout and IOC reset is not complete.
2631  *		-ENODEV if no such device/adapter
2632  *		-ETIME	if timer expires
2633  *		-ENOMEM if memory allocation error
2634  */
2635 static int
2636 mptctl_hp_targetinfo(unsigned long arg)
2637 {
2638 	hp_target_info_t __user *uarg = (void __user *) arg;
2639 	SCSIDevicePage0_t	*pg0_alloc;
2640 	SCSIDevicePage3_t	*pg3_alloc;
2641 	MPT_ADAPTER		*ioc;
2642 	MPT_SCSI_HOST 		*hd = NULL;
2643 	hp_target_info_t	karg;
2644 	int			iocnum;
2645 	int			data_sz;
2646 	dma_addr_t		page_dma;
2647 	CONFIGPARMS	 	cfg;
2648 	ConfigPageHeader_t	hdr;
2649 	int			tmp, np, rc = 0;
2650 
2651 	if (copy_from_user(&karg, uarg, sizeof(hp_target_info_t))) {
2652 		printk(KERN_ERR MYNAM "%s@%d::mptctl_hp_targetinfo - "
2653 			"Unable to read in hp_host_targetinfo struct @ %p\n",
2654 				__FILE__, __LINE__, uarg);
2655 		return -EFAULT;
2656 	}
2657 
2658 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
2659 		(ioc == NULL)) {
2660 		printk(KERN_DEBUG MYNAM "%s::mptctl_hp_targetinfo() @%d - ioc%d not found!\n",
2661 				__FILE__, __LINE__, iocnum);
2662 		return -ENODEV;
2663 	}
2664 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_hp_targetinfo called.\n",
2665 	    ioc->name));
2666 
2667 	/*  There is nothing to do for FCP parts.
2668 	 */
2669 	if ((ioc->bus_type == SAS) || (ioc->bus_type == FC))
2670 		return 0;
2671 
2672 	if ((ioc->spi_data.sdp0length == 0) || (ioc->sh == NULL))
2673 		return 0;
2674 
2675 	if (ioc->sh->host_no != karg.hdr.host)
2676 		return -ENODEV;
2677 
2678        /* Get the data transfer speeds
2679         */
2680 	data_sz = ioc->spi_data.sdp0length * 4;
2681 	pg0_alloc = (SCSIDevicePage0_t *) pci_alloc_consistent(ioc->pcidev, data_sz, &page_dma);
2682 	if (pg0_alloc) {
2683 		hdr.PageVersion = ioc->spi_data.sdp0version;
2684 		hdr.PageLength = data_sz;
2685 		hdr.PageNumber = 0;
2686 		hdr.PageType = MPI_CONFIG_PAGETYPE_SCSI_DEVICE;
2687 
2688 		cfg.cfghdr.hdr = &hdr;
2689 		cfg.action = MPI_CONFIG_ACTION_PAGE_READ_CURRENT;
2690 		cfg.dir = 0;
2691 		cfg.timeout = 0;
2692 		cfg.physAddr = page_dma;
2693 
2694 		cfg.pageAddr = (karg.hdr.channel << 8) | karg.hdr.id;
2695 
2696 		if ((rc = mpt_config(ioc, &cfg)) == 0) {
2697 			np = le32_to_cpu(pg0_alloc->NegotiatedParameters);
2698 			karg.negotiated_width = np & MPI_SCSIDEVPAGE0_NP_WIDE ?
2699 					HP_BUS_WIDTH_16 : HP_BUS_WIDTH_8;
2700 
2701 			if (np & MPI_SCSIDEVPAGE0_NP_NEG_SYNC_OFFSET_MASK) {
2702 				tmp = (np & MPI_SCSIDEVPAGE0_NP_NEG_SYNC_PERIOD_MASK) >> 8;
2703 				if (tmp < 0x09)
2704 					karg.negotiated_speed = HP_DEV_SPEED_ULTRA320;
2705 				else if (tmp <= 0x09)
2706 					karg.negotiated_speed = HP_DEV_SPEED_ULTRA160;
2707 				else if (tmp <= 0x0A)
2708 					karg.negotiated_speed = HP_DEV_SPEED_ULTRA2;
2709 				else if (tmp <= 0x0C)
2710 					karg.negotiated_speed = HP_DEV_SPEED_ULTRA;
2711 				else if (tmp <= 0x25)
2712 					karg.negotiated_speed = HP_DEV_SPEED_FAST;
2713 				else
2714 					karg.negotiated_speed = HP_DEV_SPEED_ASYNC;
2715 			} else
2716 				karg.negotiated_speed = HP_DEV_SPEED_ASYNC;
2717 		}
2718 
2719 		pci_free_consistent(ioc->pcidev, data_sz, (u8 *) pg0_alloc, page_dma);
2720 	}
2721 
2722 	/* Set defaults
2723 	 */
2724 	karg.message_rejects = -1;
2725 	karg.phase_errors = -1;
2726 	karg.parity_errors = -1;
2727 	karg.select_timeouts = -1;
2728 
2729 	/* Get the target error parameters
2730 	 */
2731 	hdr.PageVersion = 0;
2732 	hdr.PageLength = 0;
2733 	hdr.PageNumber = 3;
2734 	hdr.PageType = MPI_CONFIG_PAGETYPE_SCSI_DEVICE;
2735 
2736 	cfg.cfghdr.hdr = &hdr;
2737 	cfg.action = MPI_CONFIG_ACTION_PAGE_HEADER;
2738 	cfg.dir = 0;
2739 	cfg.timeout = 0;
2740 	cfg.physAddr = -1;
2741 	if ((mpt_config(ioc, &cfg) == 0) && (cfg.cfghdr.hdr->PageLength > 0)) {
2742 		/* Issue the second config page request */
2743 		cfg.action = MPI_CONFIG_ACTION_PAGE_READ_CURRENT;
2744 		data_sz = (int) cfg.cfghdr.hdr->PageLength * 4;
2745 		pg3_alloc = (SCSIDevicePage3_t *) pci_alloc_consistent(
2746 							ioc->pcidev, data_sz, &page_dma);
2747 		if (pg3_alloc) {
2748 			cfg.physAddr = page_dma;
2749 			cfg.pageAddr = (karg.hdr.channel << 8) | karg.hdr.id;
2750 			if ((rc = mpt_config(ioc, &cfg)) == 0) {
2751 				karg.message_rejects = (u32) le16_to_cpu(pg3_alloc->MsgRejectCount);
2752 				karg.phase_errors = (u32) le16_to_cpu(pg3_alloc->PhaseErrorCount);
2753 				karg.parity_errors = (u32) le16_to_cpu(pg3_alloc->ParityErrorCount);
2754 			}
2755 			pci_free_consistent(ioc->pcidev, data_sz, (u8 *) pg3_alloc, page_dma);
2756 		}
2757 	}
2758 	hd = shost_priv(ioc->sh);
2759 	if (hd != NULL)
2760 		karg.select_timeouts = hd->sel_timeout[karg.hdr.id];
2761 
2762 	/* Copy the data from kernel memory to user memory
2763 	 */
2764 	if (copy_to_user((char __user *)arg, &karg, sizeof(hp_target_info_t))) {
2765 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_hp_target_info - "
2766 			"Unable to write out mpt_ioctl_targetinfo struct @ %p\n",
2767 			ioc->name, __FILE__, __LINE__, uarg);
2768 		return -EFAULT;
2769 	}
2770 
2771 	return 0;
2772 }
2773 
2774 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2775 
2776 static const struct file_operations mptctl_fops = {
2777 	.owner =	THIS_MODULE,
2778 	.llseek =	no_llseek,
2779 	.fasync = 	mptctl_fasync,
2780 	.unlocked_ioctl = mptctl_ioctl,
2781 #ifdef CONFIG_COMPAT
2782 	.compat_ioctl = compat_mpctl_ioctl,
2783 #endif
2784 };
2785 
2786 static struct miscdevice mptctl_miscdev = {
2787 	MPT_MINOR,
2788 	MYNAM,
2789 	&mptctl_fops
2790 };
2791 
2792 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2793 
2794 #ifdef CONFIG_COMPAT
2795 
2796 static int
2797 compat_mptfwxfer_ioctl(struct file *filp, unsigned int cmd,
2798 			unsigned long arg)
2799 {
2800 	struct mpt_fw_xfer32 kfw32;
2801 	struct mpt_fw_xfer kfw;
2802 	MPT_ADAPTER *iocp = NULL;
2803 	int iocnum, iocnumX;
2804 	int nonblock = (filp->f_flags & O_NONBLOCK);
2805 	int ret;
2806 
2807 
2808 	if (copy_from_user(&kfw32, (char __user *)arg, sizeof(kfw32)))
2809 		return -EFAULT;
2810 
2811 	/* Verify intended MPT adapter */
2812 	iocnumX = kfw32.iocnum & 0xFF;
2813 	if (((iocnum = mpt_verify_adapter(iocnumX, &iocp)) < 0) ||
2814 	    (iocp == NULL)) {
2815 		printk(KERN_DEBUG MYNAM "::compat_mptfwxfer_ioctl @%d - ioc%d not found!\n",
2816 			__LINE__, iocnumX);
2817 		return -ENODEV;
2818 	}
2819 
2820 	if ((ret = mptctl_syscall_down(iocp, nonblock)) != 0)
2821 		return ret;
2822 
2823 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "compat_mptfwxfer_ioctl() called\n",
2824 	    iocp->name));
2825 	kfw.iocnum = iocnum;
2826 	kfw.fwlen = kfw32.fwlen;
2827 	kfw.bufp = compat_ptr(kfw32.bufp);
2828 
2829 	ret = mptctl_do_fw_download(kfw.iocnum, kfw.bufp, kfw.fwlen);
2830 
2831 	mutex_unlock(&iocp->ioctl_cmds.mutex);
2832 
2833 	return ret;
2834 }
2835 
2836 static int
2837 compat_mpt_command(struct file *filp, unsigned int cmd,
2838 			unsigned long arg)
2839 {
2840 	struct mpt_ioctl_command32 karg32;
2841 	struct mpt_ioctl_command32 __user *uarg = (struct mpt_ioctl_command32 __user *) arg;
2842 	struct mpt_ioctl_command karg;
2843 	MPT_ADAPTER *iocp = NULL;
2844 	int iocnum, iocnumX;
2845 	int nonblock = (filp->f_flags & O_NONBLOCK);
2846 	int ret;
2847 
2848 	if (copy_from_user(&karg32, (char __user *)arg, sizeof(karg32)))
2849 		return -EFAULT;
2850 
2851 	/* Verify intended MPT adapter */
2852 	iocnumX = karg32.hdr.iocnum & 0xFF;
2853 	if (((iocnum = mpt_verify_adapter(iocnumX, &iocp)) < 0) ||
2854 	    (iocp == NULL)) {
2855 		printk(KERN_DEBUG MYNAM "::compat_mpt_command @%d - ioc%d not found!\n",
2856 			__LINE__, iocnumX);
2857 		return -ENODEV;
2858 	}
2859 
2860 	if ((ret = mptctl_syscall_down(iocp, nonblock)) != 0)
2861 		return ret;
2862 
2863 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "compat_mpt_command() called\n",
2864 	    iocp->name));
2865 	/* Copy data to karg */
2866 	karg.hdr.iocnum = karg32.hdr.iocnum;
2867 	karg.hdr.port = karg32.hdr.port;
2868 	karg.timeout = karg32.timeout;
2869 	karg.maxReplyBytes = karg32.maxReplyBytes;
2870 
2871 	karg.dataInSize = karg32.dataInSize;
2872 	karg.dataOutSize = karg32.dataOutSize;
2873 	karg.maxSenseBytes = karg32.maxSenseBytes;
2874 	karg.dataSgeOffset = karg32.dataSgeOffset;
2875 
2876 	karg.replyFrameBufPtr = (char __user *)(unsigned long)karg32.replyFrameBufPtr;
2877 	karg.dataInBufPtr = (char __user *)(unsigned long)karg32.dataInBufPtr;
2878 	karg.dataOutBufPtr = (char __user *)(unsigned long)karg32.dataOutBufPtr;
2879 	karg.senseDataPtr = (char __user *)(unsigned long)karg32.senseDataPtr;
2880 
2881 	/* Pass new structure to do_mpt_command
2882 	 */
2883 	ret = mptctl_do_mpt_command (karg, &uarg->MF);
2884 
2885 	mutex_unlock(&iocp->ioctl_cmds.mutex);
2886 
2887 	return ret;
2888 }
2889 
2890 static long compat_mpctl_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
2891 {
2892 	long ret;
2893 	lock_kernel();
2894 	switch (cmd) {
2895 	case MPTIOCINFO:
2896 	case MPTIOCINFO1:
2897 	case MPTIOCINFO2:
2898 	case MPTTARGETINFO:
2899 	case MPTEVENTQUERY:
2900 	case MPTEVENTENABLE:
2901 	case MPTEVENTREPORT:
2902 	case MPTHARDRESET:
2903 	case HP_GETHOSTINFO:
2904 	case HP_GETTARGETINFO:
2905 	case MPTTEST:
2906 		ret = __mptctl_ioctl(f, cmd, arg);
2907 		break;
2908 	case MPTCOMMAND32:
2909 		ret = compat_mpt_command(f, cmd, arg);
2910 		break;
2911 	case MPTFWDOWNLOAD32:
2912 		ret = compat_mptfwxfer_ioctl(f, cmd, arg);
2913 		break;
2914 	default:
2915 		ret = -ENOIOCTLCMD;
2916 		break;
2917 	}
2918 	unlock_kernel();
2919 	return ret;
2920 }
2921 
2922 #endif
2923 
2924 
2925 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2926 /*
2927  *	mptctl_probe - Installs ioctl devices per bus.
2928  *	@pdev: Pointer to pci_dev structure
2929  *
2930  *	Returns 0 for success, non-zero for failure.
2931  *
2932  */
2933 
2934 static int
2935 mptctl_probe(struct pci_dev *pdev, const struct pci_device_id *id)
2936 {
2937 	MPT_ADAPTER *ioc = pci_get_drvdata(pdev);
2938 
2939 	mutex_init(&ioc->ioctl_cmds.mutex);
2940 	init_completion(&ioc->ioctl_cmds.done);
2941 	return 0;
2942 }
2943 
2944 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2945 /*
2946  *	mptctl_remove - Removed ioctl devices
2947  *	@pdev: Pointer to pci_dev structure
2948  *
2949  *
2950  */
2951 static void
2952 mptctl_remove(struct pci_dev *pdev)
2953 {
2954 }
2955 
2956 static struct mpt_pci_driver mptctl_driver = {
2957   .probe		= mptctl_probe,
2958   .remove		= mptctl_remove,
2959 };
2960 
2961 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2962 static int __init mptctl_init(void)
2963 {
2964 	int err;
2965 	int where = 1;
2966 
2967 	show_mptmod_ver(my_NAME, my_VERSION);
2968 
2969 	mpt_device_driver_register(&mptctl_driver, MPTCTL_DRIVER);
2970 
2971 	/* Register this device */
2972 	err = misc_register(&mptctl_miscdev);
2973 	if (err < 0) {
2974 		printk(KERN_ERR MYNAM ": Can't register misc device [minor=%d].\n", MPT_MINOR);
2975 		goto out_fail;
2976 	}
2977 	printk(KERN_INFO MYNAM ": Registered with Fusion MPT base driver\n");
2978 	printk(KERN_INFO MYNAM ": /dev/%s @ (major,minor=%d,%d)\n",
2979 			 mptctl_miscdev.name, MISC_MAJOR, mptctl_miscdev.minor);
2980 
2981 	/*
2982 	 *  Install our handler
2983 	 */
2984 	++where;
2985 	mptctl_id = mpt_register(mptctl_reply, MPTCTL_DRIVER);
2986 	if (!mptctl_id || mptctl_id >= MPT_MAX_PROTOCOL_DRIVERS) {
2987 		printk(KERN_ERR MYNAM ": ERROR: Failed to register with Fusion MPT base driver\n");
2988 		misc_deregister(&mptctl_miscdev);
2989 		err = -EBUSY;
2990 		goto out_fail;
2991 	}
2992 
2993 	mptctl_taskmgmt_id = mpt_register(mptctl_taskmgmt_reply, MPTCTL_DRIVER);
2994 	mpt_reset_register(mptctl_id, mptctl_ioc_reset);
2995 	mpt_event_register(mptctl_id, mptctl_event_process);
2996 
2997 	return 0;
2998 
2999 out_fail:
3000 
3001 	mpt_device_driver_deregister(MPTCTL_DRIVER);
3002 
3003 	return err;
3004 }
3005 
3006 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
3007 static void mptctl_exit(void)
3008 {
3009 	misc_deregister(&mptctl_miscdev);
3010 	printk(KERN_INFO MYNAM ": Deregistered /dev/%s @ (major,minor=%d,%d)\n",
3011 			 mptctl_miscdev.name, MISC_MAJOR, mptctl_miscdev.minor);
3012 
3013 	/* De-register reset handler from base module */
3014 	mpt_reset_deregister(mptctl_id);
3015 
3016 	/* De-register callback handler from base module */
3017 	mpt_deregister(mptctl_id);
3018 	mpt_reset_deregister(mptctl_taskmgmt_id);
3019 
3020         mpt_device_driver_deregister(MPTCTL_DRIVER);
3021 
3022 }
3023 
3024 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
3025 
3026 module_init(mptctl_init);
3027 module_exit(mptctl_exit);
3028