xref: /openbmc/linux/drivers/message/fusion/mptctl.c (revision a534ff3f)
1 /*
2  *  linux/drivers/message/fusion/mptctl.c
3  *      mpt Ioctl driver.
4  *      For use with LSI PCI chip/adapters
5  *      running LSI Fusion MPT (Message Passing Technology) firmware.
6  *
7  *  Copyright (c) 1999-2008 LSI Corporation
8  *  (mailto:DL-MPTFusionLinux@lsi.com)
9  *
10  */
11 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
12 /*
13     This program is free software; you can redistribute it and/or modify
14     it under the terms of the GNU General Public License as published by
15     the Free Software Foundation; version 2 of the License.
16 
17     This program is distributed in the hope that it will be useful,
18     but WITHOUT ANY WARRANTY; without even the implied warranty of
19     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
20     GNU General Public License for more details.
21 
22     NO WARRANTY
23     THE PROGRAM IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR
24     CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED INCLUDING, WITHOUT
25     LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT,
26     MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each Recipient is
27     solely responsible for determining the appropriateness of using and
28     distributing the Program and assumes all risks associated with its
29     exercise of rights under this Agreement, including but not limited to
30     the risks and costs of program errors, damage to or loss of data,
31     programs or equipment, and unavailability or interruption of operations.
32 
33     DISCLAIMER OF LIABILITY
34     NEITHER RECIPIENT NOR ANY CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY
35     DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
36     DAMAGES (INCLUDING WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND
37     ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
38     TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
39     USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS GRANTED
40     HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES
41 
42     You should have received a copy of the GNU General Public License
43     along with this program; if not, write to the Free Software
44     Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
45 */
46 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
47 
48 #include <linux/kernel.h>
49 #include <linux/module.h>
50 #include <linux/errno.h>
51 #include <linux/init.h>
52 #include <linux/slab.h>
53 #include <linux/types.h>
54 #include <linux/pci.h>
55 #include <linux/delay.h>	/* for mdelay */
56 #include <linux/miscdevice.h>
57 #include <linux/mutex.h>
58 #include <linux/compat.h>
59 
60 #include <asm/io.h>
61 #include <linux/uaccess.h>
62 
63 #include <scsi/scsi.h>
64 #include <scsi/scsi_cmnd.h>
65 #include <scsi/scsi_device.h>
66 #include <scsi/scsi_host.h>
67 #include <scsi/scsi_tcq.h>
68 
69 #define COPYRIGHT	"Copyright (c) 1999-2008 LSI Corporation"
70 #define MODULEAUTHOR	"LSI Corporation"
71 #include "mptbase.h"
72 #include "mptctl.h"
73 
74 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
75 #define my_NAME		"Fusion MPT misc device (ioctl) driver"
76 #define my_VERSION	MPT_LINUX_VERSION_COMMON
77 #define MYNAM		"mptctl"
78 
79 MODULE_AUTHOR(MODULEAUTHOR);
80 MODULE_DESCRIPTION(my_NAME);
81 MODULE_LICENSE("GPL");
82 MODULE_VERSION(my_VERSION);
83 
84 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
85 
86 static DEFINE_MUTEX(mpctl_mutex);
87 static u8 mptctl_id = MPT_MAX_PROTOCOL_DRIVERS;
88 static u8 mptctl_taskmgmt_id = MPT_MAX_PROTOCOL_DRIVERS;
89 
90 static DECLARE_WAIT_QUEUE_HEAD ( mptctl_wait );
91 
92 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
93 
94 struct buflist {
95 	u8	*kptr;
96 	int	 len;
97 };
98 
99 /*
100  * Function prototypes. Called from OS entry point mptctl_ioctl.
101  * arg contents specific to function.
102  */
103 static int mptctl_fw_download(MPT_ADAPTER *iocp, unsigned long arg);
104 static int mptctl_getiocinfo(MPT_ADAPTER *iocp, unsigned long arg, unsigned int cmd);
105 static int mptctl_gettargetinfo(MPT_ADAPTER *iocp, unsigned long arg);
106 static int mptctl_readtest(MPT_ADAPTER *iocp, unsigned long arg);
107 static int mptctl_mpt_command(MPT_ADAPTER *iocp, unsigned long arg);
108 static int mptctl_eventquery(MPT_ADAPTER *iocp, unsigned long arg);
109 static int mptctl_eventenable(MPT_ADAPTER *iocp, unsigned long arg);
110 static int mptctl_eventreport(MPT_ADAPTER *iocp, unsigned long arg);
111 static int mptctl_replace_fw(MPT_ADAPTER *iocp, unsigned long arg);
112 
113 static int mptctl_do_reset(MPT_ADAPTER *iocp, unsigned long arg);
114 static int mptctl_hp_hostinfo(MPT_ADAPTER *iocp, unsigned long arg, unsigned int cmd);
115 static int mptctl_hp_targetinfo(MPT_ADAPTER *iocp, unsigned long arg);
116 
117 static int  mptctl_probe(struct pci_dev *);
118 static void mptctl_remove(struct pci_dev *);
119 
120 #ifdef CONFIG_COMPAT
121 static long compat_mpctl_ioctl(struct file *f, unsigned cmd, unsigned long arg);
122 #endif
123 /*
124  * Private function calls.
125  */
126 static int mptctl_do_mpt_command(MPT_ADAPTER *iocp, struct mpt_ioctl_command karg, void __user *mfPtr);
127 static int mptctl_do_fw_download(MPT_ADAPTER *iocp, char __user *ufwbuf, size_t fwlen);
128 static MptSge_t *kbuf_alloc_2_sgl(int bytes, u32 dir, int sge_offset, int *frags,
129 		struct buflist **blp, dma_addr_t *sglbuf_dma, MPT_ADAPTER *ioc);
130 static void kfree_sgl(MptSge_t *sgl, dma_addr_t sgl_dma,
131 		struct buflist *buflist, MPT_ADAPTER *ioc);
132 
133 /*
134  * Reset Handler cleanup function
135  */
136 static int  mptctl_ioc_reset(MPT_ADAPTER *ioc, int reset_phase);
137 
138 /*
139  * Event Handler function
140  */
141 static int mptctl_event_process(MPT_ADAPTER *ioc, EventNotificationReply_t *pEvReply);
142 static struct fasync_struct *async_queue=NULL;
143 
144 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
145 /*
146  * Scatter gather list (SGL) sizes and limits...
147  */
148 //#define MAX_SCSI_FRAGS	9
149 #define MAX_FRAGS_SPILL1	9
150 #define MAX_FRAGS_SPILL2	15
151 #define FRAGS_PER_BUCKET	(MAX_FRAGS_SPILL2 + 1)
152 
153 //#define MAX_CHAIN_FRAGS	64
154 //#define MAX_CHAIN_FRAGS	(15+15+15+16)
155 #define MAX_CHAIN_FRAGS		(4 * MAX_FRAGS_SPILL2 + 1)
156 
157 //  Define max sg LIST bytes ( == (#frags + #chains) * 8 bytes each)
158 //  Works out to: 592d bytes!     (9+1)*8 + 4*(15+1)*8
159 //                  ^----------------- 80 + 512
160 #define MAX_SGL_BYTES		((MAX_FRAGS_SPILL1 + 1 + (4 * FRAGS_PER_BUCKET)) * 8)
161 
162 /* linux only seems to ever give 128kB MAX contiguous (GFP_USER) mem bytes */
163 #define MAX_KMALLOC_SZ		(128*1024)
164 
165 #define MPT_IOCTL_DEFAULT_TIMEOUT 10	/* Default timeout value (seconds) */
166 
167 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
168 /**
169  *	mptctl_syscall_down - Down the MPT adapter syscall semaphore.
170  *	@ioc: Pointer to MPT adapter
171  *	@nonblock: boolean, non-zero if O_NONBLOCK is set
172  *
173  *	All of the ioctl commands can potentially sleep, which is illegal
174  *	with a spinlock held, thus we perform mutual exclusion here.
175  *
176  *	Returns negative errno on error, or zero for success.
177  */
178 static inline int
179 mptctl_syscall_down(MPT_ADAPTER *ioc, int nonblock)
180 {
181 	int rc = 0;
182 
183 	if (nonblock) {
184 		if (!mutex_trylock(&ioc->ioctl_cmds.mutex))
185 			rc = -EAGAIN;
186 	} else {
187 		if (mutex_lock_interruptible(&ioc->ioctl_cmds.mutex))
188 			rc = -ERESTARTSYS;
189 	}
190 	return rc;
191 }
192 
193 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
194 /*
195  *  This is the callback for any message we have posted. The message itself
196  *  will be returned to the message pool when we return from the IRQ
197  *
198  *  This runs in irq context so be short and sweet.
199  */
200 static int
201 mptctl_reply(MPT_ADAPTER *ioc, MPT_FRAME_HDR *req, MPT_FRAME_HDR *reply)
202 {
203 	char	*sense_data;
204 	int	req_index;
205 	int	sz;
206 
207 	if (!req)
208 		return 0;
209 
210 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "completing mpi function "
211 	    "(0x%02X), req=%p, reply=%p\n", ioc->name,  req->u.hdr.Function,
212 	    req, reply));
213 
214 	/*
215 	 * Handling continuation of the same reply. Processing the first
216 	 * reply, and eating the other replys that come later.
217 	 */
218 	if (ioc->ioctl_cmds.msg_context != req->u.hdr.MsgContext)
219 		goto out_continuation;
220 
221 	ioc->ioctl_cmds.status |= MPT_MGMT_STATUS_COMMAND_GOOD;
222 
223 	if (!reply)
224 		goto out;
225 
226 	ioc->ioctl_cmds.status |= MPT_MGMT_STATUS_RF_VALID;
227 	sz = min(ioc->reply_sz, 4*reply->u.reply.MsgLength);
228 	memcpy(ioc->ioctl_cmds.reply, reply, sz);
229 
230 	if (reply->u.reply.IOCStatus || reply->u.reply.IOCLogInfo)
231 		dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT
232 		    "iocstatus (0x%04X), loginfo (0x%08X)\n", ioc->name,
233 		    le16_to_cpu(reply->u.reply.IOCStatus),
234 		    le32_to_cpu(reply->u.reply.IOCLogInfo)));
235 
236 	if ((req->u.hdr.Function == MPI_FUNCTION_SCSI_IO_REQUEST) ||
237 		(req->u.hdr.Function ==
238 		 MPI_FUNCTION_RAID_SCSI_IO_PASSTHROUGH)) {
239 
240 		if (reply->u.sreply.SCSIStatus || reply->u.sreply.SCSIState)
241 			dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT
242 			"scsi_status (0x%02x), scsi_state (0x%02x), "
243 			"tag = (0x%04x), transfer_count (0x%08x)\n", ioc->name,
244 			reply->u.sreply.SCSIStatus,
245 			reply->u.sreply.SCSIState,
246 			le16_to_cpu(reply->u.sreply.TaskTag),
247 			le32_to_cpu(reply->u.sreply.TransferCount)));
248 
249 		if (reply->u.sreply.SCSIState &
250 			MPI_SCSI_STATE_AUTOSENSE_VALID) {
251 			sz = req->u.scsireq.SenseBufferLength;
252 			req_index =
253 			    le16_to_cpu(req->u.frame.hwhdr.msgctxu.fld.req_idx);
254 			sense_data = ((u8 *)ioc->sense_buf_pool +
255 			     (req_index * MPT_SENSE_BUFFER_ALLOC));
256 			memcpy(ioc->ioctl_cmds.sense, sense_data, sz);
257 			ioc->ioctl_cmds.status |= MPT_MGMT_STATUS_SENSE_VALID;
258 		}
259 	}
260 
261  out:
262 	/* We are done, issue wake up
263 	 */
264 	if (ioc->ioctl_cmds.status & MPT_MGMT_STATUS_PENDING) {
265 		if (req->u.hdr.Function == MPI_FUNCTION_SCSI_TASK_MGMT) {
266 			mpt_clear_taskmgmt_in_progress_flag(ioc);
267 			ioc->ioctl_cmds.status &= ~MPT_MGMT_STATUS_PENDING;
268 			complete(&ioc->ioctl_cmds.done);
269 			if (ioc->bus_type == SAS)
270 				ioc->schedule_target_reset(ioc);
271 		} else {
272 			ioc->ioctl_cmds.status &= ~MPT_MGMT_STATUS_PENDING;
273 			complete(&ioc->ioctl_cmds.done);
274 		}
275 	}
276 
277  out_continuation:
278 	if (reply && (reply->u.reply.MsgFlags &
279 	    MPI_MSGFLAGS_CONTINUATION_REPLY))
280 		return 0;
281 	return 1;
282 }
283 
284 
285 static int
286 mptctl_taskmgmt_reply(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
287 {
288 	if (!mf)
289 		return 0;
290 
291 	dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
292 		"TaskMgmt completed (mf=%p, mr=%p)\n",
293 		ioc->name, mf, mr));
294 
295 	ioc->taskmgmt_cmds.status |= MPT_MGMT_STATUS_COMMAND_GOOD;
296 
297 	if (!mr)
298 		goto out;
299 
300 	ioc->taskmgmt_cmds.status |= MPT_MGMT_STATUS_RF_VALID;
301 	memcpy(ioc->taskmgmt_cmds.reply, mr,
302 	    min(MPT_DEFAULT_FRAME_SIZE, 4 * mr->u.reply.MsgLength));
303  out:
304 	if (ioc->taskmgmt_cmds.status & MPT_MGMT_STATUS_PENDING) {
305 		mpt_clear_taskmgmt_in_progress_flag(ioc);
306 		ioc->taskmgmt_cmds.status &= ~MPT_MGMT_STATUS_PENDING;
307 		complete(&ioc->taskmgmt_cmds.done);
308 		if (ioc->bus_type == SAS)
309 			ioc->schedule_target_reset(ioc);
310 		return 1;
311 	}
312 	return 0;
313 }
314 
315 static int
316 mptctl_do_taskmgmt(MPT_ADAPTER *ioc, u8 tm_type, u8 bus_id, u8 target_id)
317 {
318 	MPT_FRAME_HDR	*mf;
319 	SCSITaskMgmt_t	*pScsiTm;
320 	SCSITaskMgmtReply_t *pScsiTmReply;
321 	int		 ii;
322 	int		 retval;
323 	unsigned long	 timeout;
324 	u16		 iocstatus;
325 
326 
327 	mutex_lock(&ioc->taskmgmt_cmds.mutex);
328 	if (mpt_set_taskmgmt_in_progress_flag(ioc) != 0) {
329 		mutex_unlock(&ioc->taskmgmt_cmds.mutex);
330 		return -EPERM;
331 	}
332 
333 	retval = 0;
334 
335 	mf = mpt_get_msg_frame(mptctl_taskmgmt_id, ioc);
336 	if (mf == NULL) {
337 		dtmprintk(ioc,
338 			printk(MYIOC_s_WARN_FMT "TaskMgmt, no msg frames!!\n",
339 			ioc->name));
340 		mpt_clear_taskmgmt_in_progress_flag(ioc);
341 		retval = -ENOMEM;
342 		goto tm_done;
343 	}
344 
345 	dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT "TaskMgmt request (mf=%p)\n",
346 		ioc->name, mf));
347 
348 	pScsiTm = (SCSITaskMgmt_t *) mf;
349 	memset(pScsiTm, 0, sizeof(SCSITaskMgmt_t));
350 	pScsiTm->Function = MPI_FUNCTION_SCSI_TASK_MGMT;
351 	pScsiTm->TaskType = tm_type;
352 	if ((tm_type == MPI_SCSITASKMGMT_TASKTYPE_RESET_BUS) &&
353 		(ioc->bus_type == FC))
354 		pScsiTm->MsgFlags =
355 				MPI_SCSITASKMGMT_MSGFLAGS_LIPRESET_RESET_OPTION;
356 	pScsiTm->TargetID = target_id;
357 	pScsiTm->Bus = bus_id;
358 	pScsiTm->ChainOffset = 0;
359 	pScsiTm->Reserved = 0;
360 	pScsiTm->Reserved1 = 0;
361 	pScsiTm->TaskMsgContext = 0;
362 	for (ii= 0; ii < 8; ii++)
363 		pScsiTm->LUN[ii] = 0;
364 	for (ii=0; ii < 7; ii++)
365 		pScsiTm->Reserved2[ii] = 0;
366 
367 	switch (ioc->bus_type) {
368 	case FC:
369 		timeout = 40;
370 		break;
371 	case SAS:
372 		timeout = 30;
373 		break;
374 	case SPI:
375 		default:
376 		timeout = 10;
377 		break;
378 	}
379 
380 	dtmprintk(ioc,
381 		printk(MYIOC_s_DEBUG_FMT "TaskMgmt type=%d timeout=%ld\n",
382 		ioc->name, tm_type, timeout));
383 
384 	INITIALIZE_MGMT_STATUS(ioc->taskmgmt_cmds.status)
385 	if ((ioc->facts.IOCCapabilities & MPI_IOCFACTS_CAPABILITY_HIGH_PRI_Q) &&
386 	    (ioc->facts.MsgVersion >= MPI_VERSION_01_05))
387 		mpt_put_msg_frame_hi_pri(mptctl_taskmgmt_id, ioc, mf);
388 	else {
389 		retval = mpt_send_handshake_request(mptctl_taskmgmt_id, ioc,
390 		    sizeof(SCSITaskMgmt_t), (u32 *)pScsiTm, CAN_SLEEP);
391 		if (retval != 0) {
392 			dfailprintk(ioc,
393 				printk(MYIOC_s_ERR_FMT
394 				"TaskMgmt send_handshake FAILED!"
395 				" (ioc %p, mf %p, rc=%d) \n", ioc->name,
396 				ioc, mf, retval));
397 			mpt_free_msg_frame(ioc, mf);
398 			mpt_clear_taskmgmt_in_progress_flag(ioc);
399 			goto tm_done;
400 		}
401 	}
402 
403 	/* Now wait for the command to complete */
404 	ii = wait_for_completion_timeout(&ioc->taskmgmt_cmds.done, timeout*HZ);
405 
406 	if (!(ioc->taskmgmt_cmds.status & MPT_MGMT_STATUS_COMMAND_GOOD)) {
407 		dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
408 		    "TaskMgmt failed\n", ioc->name));
409 		mpt_free_msg_frame(ioc, mf);
410 		mpt_clear_taskmgmt_in_progress_flag(ioc);
411 		if (ioc->taskmgmt_cmds.status & MPT_MGMT_STATUS_DID_IOCRESET)
412 			retval = 0;
413 		else
414 			retval = -1; /* return failure */
415 		goto tm_done;
416 	}
417 
418 	if (!(ioc->taskmgmt_cmds.status & MPT_MGMT_STATUS_RF_VALID)) {
419 		dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
420 		    "TaskMgmt failed\n", ioc->name));
421 		retval = -1; /* return failure */
422 		goto tm_done;
423 	}
424 
425 	pScsiTmReply = (SCSITaskMgmtReply_t *) ioc->taskmgmt_cmds.reply;
426 	dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
427 	    "TaskMgmt fw_channel = %d, fw_id = %d, task_type=0x%02X, "
428 	    "iocstatus=0x%04X\n\tloginfo=0x%08X, response_code=0x%02X, "
429 	    "term_cmnds=%d\n", ioc->name, pScsiTmReply->Bus,
430 	    pScsiTmReply->TargetID, tm_type,
431 	    le16_to_cpu(pScsiTmReply->IOCStatus),
432 	    le32_to_cpu(pScsiTmReply->IOCLogInfo),
433 	    pScsiTmReply->ResponseCode,
434 	    le32_to_cpu(pScsiTmReply->TerminationCount)));
435 
436 	iocstatus = le16_to_cpu(pScsiTmReply->IOCStatus) & MPI_IOCSTATUS_MASK;
437 
438 	if (iocstatus == MPI_IOCSTATUS_SCSI_TASK_TERMINATED ||
439 	   iocstatus == MPI_IOCSTATUS_SCSI_IOC_TERMINATED ||
440 	   iocstatus == MPI_IOCSTATUS_SUCCESS)
441 		retval = 0;
442 	else {
443 		dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
444 		    "TaskMgmt failed\n", ioc->name));
445 		retval = -1; /* return failure */
446 	}
447 
448  tm_done:
449 	mutex_unlock(&ioc->taskmgmt_cmds.mutex);
450 	CLEAR_MGMT_STATUS(ioc->taskmgmt_cmds.status)
451 	return retval;
452 }
453 
454 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
455 /* mptctl_timeout_expired
456  *
457  * Expecting an interrupt, however timed out.
458  *
459  */
460 static void
461 mptctl_timeout_expired(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf)
462 {
463 	unsigned long flags;
464 	int ret_val = -1;
465 	SCSIIORequest_t *scsi_req = (SCSIIORequest_t *) mf;
466 	u8 function = mf->u.hdr.Function;
467 
468 	dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT ": %s\n",
469 		ioc->name, __func__));
470 
471 	if (mpt_fwfault_debug)
472 		mpt_halt_firmware(ioc);
473 
474 	spin_lock_irqsave(&ioc->taskmgmt_lock, flags);
475 	if (ioc->ioc_reset_in_progress) {
476 		spin_unlock_irqrestore(&ioc->taskmgmt_lock, flags);
477 		CLEAR_MGMT_PENDING_STATUS(ioc->ioctl_cmds.status)
478 		mpt_free_msg_frame(ioc, mf);
479 		return;
480 	}
481 	spin_unlock_irqrestore(&ioc->taskmgmt_lock, flags);
482 
483 
484 	CLEAR_MGMT_PENDING_STATUS(ioc->ioctl_cmds.status)
485 
486 	if (ioc->bus_type == SAS) {
487 		if (function == MPI_FUNCTION_SCSI_IO_REQUEST)
488 			ret_val = mptctl_do_taskmgmt(ioc,
489 				MPI_SCSITASKMGMT_TASKTYPE_TARGET_RESET,
490 				scsi_req->Bus, scsi_req->TargetID);
491 		else if (function == MPI_FUNCTION_RAID_SCSI_IO_PASSTHROUGH)
492 			ret_val = mptctl_do_taskmgmt(ioc,
493 				MPI_SCSITASKMGMT_TASKTYPE_RESET_BUS,
494 				scsi_req->Bus, 0);
495 		if (!ret_val)
496 			return;
497 	} else {
498 		if ((function == MPI_FUNCTION_SCSI_IO_REQUEST) ||
499 			(function == MPI_FUNCTION_RAID_SCSI_IO_PASSTHROUGH))
500 			ret_val = mptctl_do_taskmgmt(ioc,
501 				MPI_SCSITASKMGMT_TASKTYPE_RESET_BUS,
502 				scsi_req->Bus, 0);
503 		if (!ret_val)
504 			return;
505 	}
506 
507 	dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT "Calling Reset! \n",
508 		 ioc->name));
509 	mpt_Soft_Hard_ResetHandler(ioc, CAN_SLEEP);
510 	mpt_free_msg_frame(ioc, mf);
511 }
512 
513 
514 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
515 /* mptctl_ioc_reset
516  *
517  * Clean-up functionality. Used only if there has been a
518  * reload of the FW due.
519  *
520  */
521 static int
522 mptctl_ioc_reset(MPT_ADAPTER *ioc, int reset_phase)
523 {
524 	switch(reset_phase) {
525 	case MPT_IOC_SETUP_RESET:
526 		dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
527 		    "%s: MPT_IOC_SETUP_RESET\n", ioc->name, __func__));
528 		break;
529 	case MPT_IOC_PRE_RESET:
530 		dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
531 		    "%s: MPT_IOC_PRE_RESET\n", ioc->name, __func__));
532 		break;
533 	case MPT_IOC_POST_RESET:
534 		dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
535 		    "%s: MPT_IOC_POST_RESET\n", ioc->name, __func__));
536 		if (ioc->ioctl_cmds.status & MPT_MGMT_STATUS_PENDING) {
537 			ioc->ioctl_cmds.status |= MPT_MGMT_STATUS_DID_IOCRESET;
538 			complete(&ioc->ioctl_cmds.done);
539 		}
540 		break;
541 	default:
542 		break;
543 	}
544 
545 	return 1;
546 }
547 
548 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
549 /* ASYNC Event Notification Support */
550 static int
551 mptctl_event_process(MPT_ADAPTER *ioc, EventNotificationReply_t *pEvReply)
552 {
553 	u8 event;
554 
555 	event = le32_to_cpu(pEvReply->Event) & 0xFF;
556 
557 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "%s() called\n",
558 	    ioc->name, __func__));
559 	if(async_queue == NULL)
560 		return 1;
561 
562 	/* Raise SIGIO for persistent events.
563 	 * TODO - this define is not in MPI spec yet,
564 	 * but they plan to set it to 0x21
565 	 */
566 	if (event == 0x21) {
567 		ioc->aen_event_read_flag=1;
568 		dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "Raised SIGIO to application\n",
569 		    ioc->name));
570 		devtverboseprintk(ioc, printk(MYIOC_s_DEBUG_FMT
571 		    "Raised SIGIO to application\n", ioc->name));
572 		kill_fasync(&async_queue, SIGIO, POLL_IN);
573 		return 1;
574 	 }
575 
576 	/* This flag is set after SIGIO was raised, and
577 	 * remains set until the application has read
578 	 * the event log via ioctl=MPTEVENTREPORT
579 	 */
580 	if(ioc->aen_event_read_flag)
581 		return 1;
582 
583 	/* Signal only for the events that are
584 	 * requested for by the application
585 	 */
586 	if (ioc->events && (ioc->eventTypes & ( 1 << event))) {
587 		ioc->aen_event_read_flag=1;
588 		dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT
589 		    "Raised SIGIO to application\n", ioc->name));
590 		devtverboseprintk(ioc, printk(MYIOC_s_DEBUG_FMT
591 		    "Raised SIGIO to application\n", ioc->name));
592 		kill_fasync(&async_queue, SIGIO, POLL_IN);
593 	}
594 	return 1;
595 }
596 
597 static int
598 mptctl_fasync(int fd, struct file *filep, int mode)
599 {
600 	MPT_ADAPTER	*ioc;
601 	int ret;
602 
603 	mutex_lock(&mpctl_mutex);
604 	list_for_each_entry(ioc, &ioc_list, list)
605 		ioc->aen_event_read_flag=0;
606 
607 	ret = fasync_helper(fd, filep, mode, &async_queue);
608 	mutex_unlock(&mpctl_mutex);
609 	return ret;
610 }
611 
612 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
613 /*
614  *  MPT ioctl handler
615  *  cmd - specify the particular IOCTL command to be issued
616  *  arg - data specific to the command. Must not be null.
617  */
618 static long
619 __mptctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
620 {
621 	mpt_ioctl_header __user *uhdr = (void __user *) arg;
622 	mpt_ioctl_header	 khdr;
623 	int iocnum;
624 	unsigned iocnumX;
625 	int nonblock = (file->f_flags & O_NONBLOCK);
626 	int ret;
627 	MPT_ADAPTER *iocp = NULL;
628 
629 	if (copy_from_user(&khdr, uhdr, sizeof(khdr))) {
630 		printk(KERN_ERR MYNAM "%s::mptctl_ioctl() @%d - "
631 				"Unable to copy mpt_ioctl_header data @ %p\n",
632 				__FILE__, __LINE__, uhdr);
633 		return -EFAULT;
634 	}
635 	ret = -ENXIO;				/* (-6) No such device or address */
636 
637 	/* Verify intended MPT adapter - set iocnum and the adapter
638 	 * pointer (iocp)
639 	 */
640 	iocnumX = khdr.iocnum & 0xFF;
641 	if (((iocnum = mpt_verify_adapter(iocnumX, &iocp)) < 0) ||
642 	    (iocp == NULL))
643 		return -ENODEV;
644 
645 	if (!iocp->active) {
646 		printk(KERN_DEBUG MYNAM "%s::mptctl_ioctl() @%d - Controller disabled.\n",
647 				__FILE__, __LINE__);
648 		return -EFAULT;
649 	}
650 
651 	/* Handle those commands that are just returning
652 	 * information stored in the driver.
653 	 * These commands should never time out and are unaffected
654 	 * by TM and FW reloads.
655 	 */
656 	if ((cmd & ~IOCSIZE_MASK) == (MPTIOCINFO & ~IOCSIZE_MASK)) {
657 		return mptctl_getiocinfo(iocp, arg, _IOC_SIZE(cmd));
658 	} else if (cmd == MPTTARGETINFO) {
659 		return mptctl_gettargetinfo(iocp, arg);
660 	} else if (cmd == MPTTEST) {
661 		return mptctl_readtest(iocp, arg);
662 	} else if (cmd == MPTEVENTQUERY) {
663 		return mptctl_eventquery(iocp, arg);
664 	} else if (cmd == MPTEVENTENABLE) {
665 		return mptctl_eventenable(iocp, arg);
666 	} else if (cmd == MPTEVENTREPORT) {
667 		return mptctl_eventreport(iocp, arg);
668 	} else if (cmd == MPTFWREPLACE) {
669 		return mptctl_replace_fw(iocp, arg);
670 	}
671 
672 	/* All of these commands require an interrupt or
673 	 * are unknown/illegal.
674 	 */
675 	if ((ret = mptctl_syscall_down(iocp, nonblock)) != 0)
676 		return ret;
677 
678 	if (cmd == MPTFWDOWNLOAD)
679 		ret = mptctl_fw_download(iocp, arg);
680 	else if (cmd == MPTCOMMAND)
681 		ret = mptctl_mpt_command(iocp, arg);
682 	else if (cmd == MPTHARDRESET)
683 		ret = mptctl_do_reset(iocp, arg);
684 	else if ((cmd & ~IOCSIZE_MASK) == (HP_GETHOSTINFO & ~IOCSIZE_MASK))
685 		ret = mptctl_hp_hostinfo(iocp, arg, _IOC_SIZE(cmd));
686 	else if (cmd == HP_GETTARGETINFO)
687 		ret = mptctl_hp_targetinfo(iocp, arg);
688 	else
689 		ret = -EINVAL;
690 
691 	mutex_unlock(&iocp->ioctl_cmds.mutex);
692 
693 	return ret;
694 }
695 
696 static long
697 mptctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
698 {
699 	long ret;
700 	mutex_lock(&mpctl_mutex);
701 	ret = __mptctl_ioctl(file, cmd, arg);
702 	mutex_unlock(&mpctl_mutex);
703 	return ret;
704 }
705 
706 static int mptctl_do_reset(MPT_ADAPTER *iocp, unsigned long arg)
707 {
708 	struct mpt_ioctl_diag_reset __user *urinfo = (void __user *) arg;
709 	struct mpt_ioctl_diag_reset krinfo;
710 
711 	if (copy_from_user(&krinfo, urinfo, sizeof(struct mpt_ioctl_diag_reset))) {
712 		printk(KERN_ERR MYNAM "%s@%d::mptctl_do_reset - "
713 				"Unable to copy mpt_ioctl_diag_reset struct @ %p\n",
714 				__FILE__, __LINE__, urinfo);
715 		return -EFAULT;
716 	}
717 
718 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "mptctl_do_reset called.\n",
719 	    iocp->name));
720 
721 	if (mpt_HardResetHandler(iocp, CAN_SLEEP) != 0) {
722 		printk (MYIOC_s_ERR_FMT "%s@%d::mptctl_do_reset - reset failed.\n",
723 			iocp->name, __FILE__, __LINE__);
724 		return -1;
725 	}
726 
727 	return 0;
728 }
729 
730 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
731 /*
732  * MPT FW download function.  Cast the arg into the mpt_fw_xfer structure.
733  * This structure contains: iocnum, firmware length (bytes),
734  *      pointer to user space memory where the fw image is stored.
735  *
736  * Outputs:	None.
737  * Return:	0 if successful
738  *		-EFAULT if data unavailable
739  *		-ENXIO  if no such device
740  *		-EAGAIN if resource problem
741  *		-ENOMEM if no memory for SGE
742  *		-EMLINK if too many chain buffers required
743  *		-EBADRQC if adapter does not support FW download
744  *		-EBUSY if adapter is busy
745  *		-ENOMSG if FW upload returned bad status
746  */
747 static int
748 mptctl_fw_download(MPT_ADAPTER *iocp, unsigned long arg)
749 {
750 	struct mpt_fw_xfer __user *ufwdl = (void __user *) arg;
751 	struct mpt_fw_xfer	 kfwdl;
752 
753 	if (copy_from_user(&kfwdl, ufwdl, sizeof(struct mpt_fw_xfer))) {
754 		printk(KERN_ERR MYNAM "%s@%d::_ioctl_fwdl - "
755 				"Unable to copy mpt_fw_xfer struct @ %p\n",
756 				__FILE__, __LINE__, ufwdl);
757 		return -EFAULT;
758 	}
759 
760 	return mptctl_do_fw_download(iocp, kfwdl.bufp, kfwdl.fwlen);
761 }
762 
763 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
764 /*
765  * FW Download engine.
766  * Outputs:	None.
767  * Return:	0 if successful
768  *		-EFAULT if data unavailable
769  *		-ENXIO  if no such device
770  *		-EAGAIN if resource problem
771  *		-ENOMEM if no memory for SGE
772  *		-EMLINK if too many chain buffers required
773  *		-EBADRQC if adapter does not support FW download
774  *		-EBUSY if adapter is busy
775  *		-ENOMSG if FW upload returned bad status
776  */
777 static int
778 mptctl_do_fw_download(MPT_ADAPTER *iocp, char __user *ufwbuf, size_t fwlen)
779 {
780 	FWDownload_t		*dlmsg;
781 	MPT_FRAME_HDR		*mf;
782 	FWDownloadTCSGE_t	*ptsge;
783 	MptSge_t		*sgl, *sgIn;
784 	char			*sgOut;
785 	struct buflist		*buflist;
786 	struct buflist		*bl;
787 	dma_addr_t		 sgl_dma;
788 	int			 ret;
789 	int			 numfrags = 0;
790 	int			 maxfrags;
791 	int			 n = 0;
792 	u32			 sgdir;
793 	u32			 nib;
794 	int			 fw_bytes_copied = 0;
795 	int			 i;
796 	int			 sge_offset = 0;
797 	u16			 iocstat;
798 	pFWDownloadReply_t	 ReplyMsg = NULL;
799 	unsigned long		 timeleft;
800 
801 	/*  Valid device. Get a message frame and construct the FW download message.
802 	*/
803 	if ((mf = mpt_get_msg_frame(mptctl_id, iocp)) == NULL)
804 		return -EAGAIN;
805 
806 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT
807 	    "mptctl_do_fwdl called. mptctl_id = %xh.\n", iocp->name, mptctl_id));
808 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "DbG: kfwdl.bufp  = %p\n",
809 	    iocp->name, ufwbuf));
810 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "DbG: kfwdl.fwlen = %d\n",
811 	    iocp->name, (int)fwlen));
812 
813 	dlmsg = (FWDownload_t*) mf;
814 	ptsge = (FWDownloadTCSGE_t *) &dlmsg->SGL;
815 	sgOut = (char *) (ptsge + 1);
816 
817 	/*
818 	 * Construct f/w download request
819 	 */
820 	dlmsg->ImageType = MPI_FW_DOWNLOAD_ITYPE_FW;
821 	dlmsg->Reserved = 0;
822 	dlmsg->ChainOffset = 0;
823 	dlmsg->Function = MPI_FUNCTION_FW_DOWNLOAD;
824 	dlmsg->Reserved1[0] = dlmsg->Reserved1[1] = dlmsg->Reserved1[2] = 0;
825 	if (iocp->facts.MsgVersion >= MPI_VERSION_01_05)
826 		dlmsg->MsgFlags = MPI_FW_DOWNLOAD_MSGFLGS_LAST_SEGMENT;
827 	else
828 		dlmsg->MsgFlags = 0;
829 
830 
831 	/* Set up the Transaction SGE.
832 	 */
833 	ptsge->Reserved = 0;
834 	ptsge->ContextSize = 0;
835 	ptsge->DetailsLength = 12;
836 	ptsge->Flags = MPI_SGE_FLAGS_TRANSACTION_ELEMENT;
837 	ptsge->Reserved_0100_Checksum = 0;
838 	ptsge->ImageOffset = 0;
839 	ptsge->ImageSize = cpu_to_le32(fwlen);
840 
841 	/* Add the SGL
842 	 */
843 
844 	/*
845 	 * Need to kmalloc area(s) for holding firmware image bytes.
846 	 * But we need to do it piece meal, using a proper
847 	 * scatter gather list (with 128kB MAX hunks).
848 	 *
849 	 * A practical limit here might be # of sg hunks that fit into
850 	 * a single IOC request frame; 12 or 8 (see below), so:
851 	 * For FC9xx: 12 x 128kB == 1.5 mB (max)
852 	 * For C1030:  8 x 128kB == 1   mB (max)
853 	 * We could support chaining, but things get ugly(ier:)
854 	 *
855 	 * Set the sge_offset to the start of the sgl (bytes).
856 	 */
857 	sgdir = 0x04000000;		/* IOC will READ from sys mem */
858 	sge_offset = sizeof(MPIHeader_t) + sizeof(FWDownloadTCSGE_t);
859 	if ((sgl = kbuf_alloc_2_sgl(fwlen, sgdir, sge_offset,
860 				    &numfrags, &buflist, &sgl_dma, iocp)) == NULL)
861 		return -ENOMEM;
862 
863 	/*
864 	 * We should only need SGL with 2 simple_32bit entries (up to 256 kB)
865 	 * for FC9xx f/w image, but calculate max number of sge hunks
866 	 * we can fit into a request frame, and limit ourselves to that.
867 	 * (currently no chain support)
868 	 * maxfrags = (Request Size - FWdownload Size ) / Size of 32 bit SGE
869 	 *	Request		maxfrags
870 	 *	128		12
871 	 *	96		8
872 	 *	64		4
873 	 */
874 	maxfrags = (iocp->req_sz - sizeof(MPIHeader_t) -
875 			sizeof(FWDownloadTCSGE_t))
876 			/ iocp->SGE_size;
877 	if (numfrags > maxfrags) {
878 		ret = -EMLINK;
879 		goto fwdl_out;
880 	}
881 
882 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "DbG: sgl buffer = %p, sgfrags = %d\n",
883 	    iocp->name, sgl, numfrags));
884 
885 	/*
886 	 * Parse SG list, copying sgl itself,
887 	 * plus f/w image hunks from user space as we go...
888 	 */
889 	ret = -EFAULT;
890 	sgIn = sgl;
891 	bl = buflist;
892 	for (i=0; i < numfrags; i++) {
893 
894 		/* Get the SGE type: 0 - TCSGE, 3 - Chain, 1 - Simple SGE
895 		 * Skip everything but Simple. If simple, copy from
896 		 *	user space into kernel space.
897 		 * Note: we should not have anything but Simple as
898 		 *	Chain SGE are illegal.
899 		 */
900 		nib = (sgIn->FlagsLength & 0x30000000) >> 28;
901 		if (nib == 0 || nib == 3) {
902 			;
903 		} else if (sgIn->Address) {
904 			iocp->add_sge(sgOut, sgIn->FlagsLength, sgIn->Address);
905 			n++;
906 			if (copy_from_user(bl->kptr, ufwbuf+fw_bytes_copied, bl->len)) {
907 				printk(MYIOC_s_ERR_FMT "%s@%d::_ioctl_fwdl - "
908 					"Unable to copy f/w buffer hunk#%d @ %p\n",
909 					iocp->name, __FILE__, __LINE__, n, ufwbuf);
910 				goto fwdl_out;
911 			}
912 			fw_bytes_copied += bl->len;
913 		}
914 		sgIn++;
915 		bl++;
916 		sgOut += iocp->SGE_size;
917 	}
918 
919 	DBG_DUMP_FW_DOWNLOAD(iocp, (u32 *)mf, numfrags);
920 
921 	/*
922 	 * Finally, perform firmware download.
923 	 */
924 	ReplyMsg = NULL;
925 	SET_MGMT_MSG_CONTEXT(iocp->ioctl_cmds.msg_context, dlmsg->MsgContext);
926 	INITIALIZE_MGMT_STATUS(iocp->ioctl_cmds.status)
927 	mpt_put_msg_frame(mptctl_id, iocp, mf);
928 
929 	/* Now wait for the command to complete */
930 retry_wait:
931 	timeleft = wait_for_completion_timeout(&iocp->ioctl_cmds.done, HZ*60);
932 	if (!(iocp->ioctl_cmds.status & MPT_MGMT_STATUS_COMMAND_GOOD)) {
933 		ret = -ETIME;
934 		printk(MYIOC_s_WARN_FMT "%s: failed\n", iocp->name, __func__);
935 		if (iocp->ioctl_cmds.status & MPT_MGMT_STATUS_DID_IOCRESET) {
936 			mpt_free_msg_frame(iocp, mf);
937 			goto fwdl_out;
938 		}
939 		if (!timeleft) {
940 			printk(MYIOC_s_WARN_FMT
941 			       "FW download timeout, doorbell=0x%08x\n",
942 			       iocp->name, mpt_GetIocState(iocp, 0));
943 			mptctl_timeout_expired(iocp, mf);
944 		} else
945 			goto retry_wait;
946 		goto fwdl_out;
947 	}
948 
949 	if (!(iocp->ioctl_cmds.status & MPT_MGMT_STATUS_RF_VALID)) {
950 		printk(MYIOC_s_WARN_FMT "%s: failed\n", iocp->name, __func__);
951 		mpt_free_msg_frame(iocp, mf);
952 		ret = -ENODATA;
953 		goto fwdl_out;
954 	}
955 
956 	if (sgl)
957 		kfree_sgl(sgl, sgl_dma, buflist, iocp);
958 
959 	ReplyMsg = (pFWDownloadReply_t)iocp->ioctl_cmds.reply;
960 	iocstat = le16_to_cpu(ReplyMsg->IOCStatus) & MPI_IOCSTATUS_MASK;
961 	if (iocstat == MPI_IOCSTATUS_SUCCESS) {
962 		printk(MYIOC_s_INFO_FMT "F/W update successful!\n", iocp->name);
963 		return 0;
964 	} else if (iocstat == MPI_IOCSTATUS_INVALID_FUNCTION) {
965 		printk(MYIOC_s_WARN_FMT "Hmmm...  F/W download not supported!?!\n",
966 			iocp->name);
967 		printk(MYIOC_s_WARN_FMT "(time to go bang on somebodies door)\n",
968 			iocp->name);
969 		return -EBADRQC;
970 	} else if (iocstat == MPI_IOCSTATUS_BUSY) {
971 		printk(MYIOC_s_WARN_FMT "IOC_BUSY!\n", iocp->name);
972 		printk(MYIOC_s_WARN_FMT "(try again later?)\n", iocp->name);
973 		return -EBUSY;
974 	} else {
975 		printk(MYIOC_s_WARN_FMT "ioctl_fwdl() returned [bad] status = %04xh\n",
976 			iocp->name, iocstat);
977 		printk(MYIOC_s_WARN_FMT "(bad VooDoo)\n", iocp->name);
978 		return -ENOMSG;
979 	}
980 	return 0;
981 
982 fwdl_out:
983 
984 	CLEAR_MGMT_STATUS(iocp->ioctl_cmds.status);
985 	SET_MGMT_MSG_CONTEXT(iocp->ioctl_cmds.msg_context, 0);
986         kfree_sgl(sgl, sgl_dma, buflist, iocp);
987 	return ret;
988 }
989 
990 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
991 /*
992  * SGE Allocation routine
993  *
994  * Inputs:	bytes - number of bytes to be transferred
995  *		sgdir - data direction
996  *		sge_offset - offset (in bytes) from the start of the request
997  *			frame to the first SGE
998  *		ioc - pointer to the mptadapter
999  * Outputs:	frags - number of scatter gather elements
1000  *		blp - point to the buflist pointer
1001  *		sglbuf_dma - pointer to the (dma) sgl
1002  * Returns:	Null if failes
1003  *		pointer to the (virtual) sgl if successful.
1004  */
1005 static MptSge_t *
1006 kbuf_alloc_2_sgl(int bytes, u32 sgdir, int sge_offset, int *frags,
1007 		 struct buflist **blp, dma_addr_t *sglbuf_dma, MPT_ADAPTER *ioc)
1008 {
1009 	MptSge_t	*sglbuf = NULL;		/* pointer to array of SGE */
1010 						/* and chain buffers */
1011 	struct buflist	*buflist = NULL;	/* kernel routine */
1012 	MptSge_t	*sgl;
1013 	int		 numfrags = 0;
1014 	int		 fragcnt = 0;
1015 	int		 alloc_sz = min(bytes,MAX_KMALLOC_SZ);	// avoid kernel warning msg!
1016 	int		 bytes_allocd = 0;
1017 	int		 this_alloc;
1018 	dma_addr_t	 pa;					// phys addr
1019 	int		 i, buflist_ent;
1020 	int		 sg_spill = MAX_FRAGS_SPILL1;
1021 	int		 dir;
1022 
1023 	if (bytes < 0)
1024 		return NULL;
1025 
1026 	/* initialization */
1027 	*frags = 0;
1028 	*blp = NULL;
1029 
1030 	/* Allocate and initialize an array of kernel
1031 	 * structures for the SG elements.
1032 	 */
1033 	i = MAX_SGL_BYTES / 8;
1034 	buflist = kzalloc(i, GFP_USER);
1035 	if (!buflist)
1036 		return NULL;
1037 	buflist_ent = 0;
1038 
1039 	/* Allocate a single block of memory to store the sg elements and
1040 	 * the chain buffers.  The calling routine is responsible for
1041 	 * copying the data in this array into the correct place in the
1042 	 * request and chain buffers.
1043 	 */
1044 	sglbuf = pci_alloc_consistent(ioc->pcidev, MAX_SGL_BYTES, sglbuf_dma);
1045 	if (sglbuf == NULL)
1046 		goto free_and_fail;
1047 
1048 	if (sgdir & 0x04000000)
1049 		dir = PCI_DMA_TODEVICE;
1050 	else
1051 		dir = PCI_DMA_FROMDEVICE;
1052 
1053 	/* At start:
1054 	 *	sgl = sglbuf = point to beginning of sg buffer
1055 	 *	buflist_ent = 0 = first kernel structure
1056 	 *	sg_spill = number of SGE that can be written before the first
1057 	 *		chain element.
1058 	 *
1059 	 */
1060 	sgl = sglbuf;
1061 	sg_spill = ((ioc->req_sz - sge_offset)/ioc->SGE_size) - 1;
1062 	while (bytes_allocd < bytes) {
1063 		this_alloc = min(alloc_sz, bytes-bytes_allocd);
1064 		buflist[buflist_ent].len = this_alloc;
1065 		buflist[buflist_ent].kptr = pci_alloc_consistent(ioc->pcidev,
1066 								 this_alloc,
1067 								 &pa);
1068 		if (buflist[buflist_ent].kptr == NULL) {
1069 			alloc_sz = alloc_sz / 2;
1070 			if (alloc_sz == 0) {
1071 				printk(MYIOC_s_WARN_FMT "-SG: No can do - "
1072 				    "not enough memory!   :-(\n", ioc->name);
1073 				printk(MYIOC_s_WARN_FMT "-SG: (freeing %d frags)\n",
1074 					ioc->name, numfrags);
1075 				goto free_and_fail;
1076 			}
1077 			continue;
1078 		} else {
1079 			dma_addr_t dma_addr;
1080 
1081 			bytes_allocd += this_alloc;
1082 			sgl->FlagsLength = (0x10000000|sgdir|this_alloc);
1083 			dma_addr = pci_map_single(ioc->pcidev,
1084 				buflist[buflist_ent].kptr, this_alloc, dir);
1085 			sgl->Address = dma_addr;
1086 
1087 			fragcnt++;
1088 			numfrags++;
1089 			sgl++;
1090 			buflist_ent++;
1091 		}
1092 
1093 		if (bytes_allocd >= bytes)
1094 			break;
1095 
1096 		/* Need to chain? */
1097 		if (fragcnt == sg_spill) {
1098 			printk(MYIOC_s_WARN_FMT
1099 			    "-SG: No can do - " "Chain required!   :-(\n", ioc->name);
1100 			printk(MYIOC_s_WARN_FMT "(freeing %d frags)\n", ioc->name, numfrags);
1101 			goto free_and_fail;
1102 		}
1103 
1104 		/* overflow check... */
1105 		if (numfrags*8 > MAX_SGL_BYTES){
1106 			/* GRRRRR... */
1107 			printk(MYIOC_s_WARN_FMT "-SG: No can do - "
1108 				"too many SG frags!   :-(\n", ioc->name);
1109 			printk(MYIOC_s_WARN_FMT "-SG: (freeing %d frags)\n",
1110 				ioc->name, numfrags);
1111 			goto free_and_fail;
1112 		}
1113 	}
1114 
1115 	/* Last sge fixup: set LE+eol+eob bits */
1116 	sgl[-1].FlagsLength |= 0xC1000000;
1117 
1118 	*frags = numfrags;
1119 	*blp = buflist;
1120 
1121 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "-SG: kbuf_alloc_2_sgl() - "
1122 	   "%d SG frags generated!\n", ioc->name, numfrags));
1123 
1124 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "-SG: kbuf_alloc_2_sgl() - "
1125 	   "last (big) alloc_sz=%d\n", ioc->name, alloc_sz));
1126 
1127 	return sglbuf;
1128 
1129 free_and_fail:
1130 	if (sglbuf != NULL) {
1131 		for (i = 0; i < numfrags; i++) {
1132 			dma_addr_t dma_addr;
1133 			u8 *kptr;
1134 			int len;
1135 
1136 			if ((sglbuf[i].FlagsLength >> 24) == 0x30)
1137 				continue;
1138 
1139 			dma_addr = sglbuf[i].Address;
1140 			kptr = buflist[i].kptr;
1141 			len = buflist[i].len;
1142 
1143 			pci_free_consistent(ioc->pcidev, len, kptr, dma_addr);
1144 		}
1145 		pci_free_consistent(ioc->pcidev, MAX_SGL_BYTES, sglbuf, *sglbuf_dma);
1146 	}
1147 	kfree(buflist);
1148 	return NULL;
1149 }
1150 
1151 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1152 /*
1153  * Routine to free the SGL elements.
1154  */
1155 static void
1156 kfree_sgl(MptSge_t *sgl, dma_addr_t sgl_dma, struct buflist *buflist, MPT_ADAPTER *ioc)
1157 {
1158 	MptSge_t	*sg = sgl;
1159 	struct buflist	*bl = buflist;
1160 	u32		 nib;
1161 	int		 dir;
1162 	int		 n = 0;
1163 
1164 	if (sg->FlagsLength & 0x04000000)
1165 		dir = PCI_DMA_TODEVICE;
1166 	else
1167 		dir = PCI_DMA_FROMDEVICE;
1168 
1169 	nib = (sg->FlagsLength & 0xF0000000) >> 28;
1170 	while (! (nib & 0x4)) { /* eob */
1171 		/* skip ignore/chain. */
1172 		if (nib == 0 || nib == 3) {
1173 			;
1174 		} else if (sg->Address) {
1175 			dma_addr_t dma_addr;
1176 			void *kptr;
1177 			int len;
1178 
1179 			dma_addr = sg->Address;
1180 			kptr = bl->kptr;
1181 			len = bl->len;
1182 			pci_unmap_single(ioc->pcidev, dma_addr, len, dir);
1183 			pci_free_consistent(ioc->pcidev, len, kptr, dma_addr);
1184 			n++;
1185 		}
1186 		sg++;
1187 		bl++;
1188 		nib = (le32_to_cpu(sg->FlagsLength) & 0xF0000000) >> 28;
1189 	}
1190 
1191 	/* we're at eob! */
1192 	if (sg->Address) {
1193 		dma_addr_t dma_addr;
1194 		void *kptr;
1195 		int len;
1196 
1197 		dma_addr = sg->Address;
1198 		kptr = bl->kptr;
1199 		len = bl->len;
1200 		pci_unmap_single(ioc->pcidev, dma_addr, len, dir);
1201 		pci_free_consistent(ioc->pcidev, len, kptr, dma_addr);
1202 		n++;
1203 	}
1204 
1205 	pci_free_consistent(ioc->pcidev, MAX_SGL_BYTES, sgl, sgl_dma);
1206 	kfree(buflist);
1207 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "-SG: Free'd 1 SGL buf + %d kbufs!\n",
1208 	    ioc->name, n));
1209 }
1210 
1211 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1212 /*
1213  *	mptctl_getiocinfo - Query the host adapter for IOC information.
1214  *	@arg: User space argument
1215  *
1216  * Outputs:	None.
1217  * Return:	0 if successful
1218  *		-EFAULT if data unavailable
1219  *		-ENODEV  if no such device/adapter
1220  */
1221 static int
1222 mptctl_getiocinfo (MPT_ADAPTER *ioc, unsigned long arg, unsigned int data_size)
1223 {
1224 	struct mpt_ioctl_iocinfo __user *uarg = (void __user *) arg;
1225 	struct mpt_ioctl_iocinfo *karg;
1226 	struct pci_dev		*pdev;
1227 	unsigned int		port;
1228 	int			cim_rev;
1229 	struct scsi_device 	*sdev;
1230 	VirtDevice		*vdevice;
1231 
1232 	/* Add of PCI INFO results in unaligned access for
1233 	 * IA64 and Sparc. Reset long to int. Return no PCI
1234 	 * data for obsolete format.
1235 	 */
1236 	if (data_size == sizeof(struct mpt_ioctl_iocinfo_rev0))
1237 		cim_rev = 0;
1238 	else if (data_size == sizeof(struct mpt_ioctl_iocinfo_rev1))
1239 		cim_rev = 1;
1240 	else if (data_size == sizeof(struct mpt_ioctl_iocinfo))
1241 		cim_rev = 2;
1242 	else if (data_size == (sizeof(struct mpt_ioctl_iocinfo_rev0)+12))
1243 		cim_rev = 0;	/* obsolete */
1244 	else
1245 		return -EFAULT;
1246 
1247 	karg = memdup_user(uarg, data_size);
1248 	if (IS_ERR(karg)) {
1249 		printk(KERN_ERR MYNAM "%s@%d::mpt_ioctl_iocinfo() - memdup_user returned error [%ld]\n",
1250 				__FILE__, __LINE__, PTR_ERR(karg));
1251 		return PTR_ERR(karg);
1252 	}
1253 
1254 	/* Verify the data transfer size is correct. */
1255 	if (karg->hdr.maxDataSize != data_size) {
1256 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_getiocinfo - "
1257 			"Structure size mismatch. Command not completed.\n",
1258 			ioc->name, __FILE__, __LINE__);
1259 		kfree(karg);
1260 		return -EFAULT;
1261 	}
1262 
1263 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_getiocinfo called.\n",
1264 	    ioc->name));
1265 
1266 	/* Fill in the data and return the structure to the calling
1267 	 * program
1268 	 */
1269 	if (ioc->bus_type == SAS)
1270 		karg->adapterType = MPT_IOCTL_INTERFACE_SAS;
1271 	else if (ioc->bus_type == FC)
1272 		karg->adapterType = MPT_IOCTL_INTERFACE_FC;
1273 	else
1274 		karg->adapterType = MPT_IOCTL_INTERFACE_SCSI;
1275 
1276 	if (karg->hdr.port > 1) {
1277 		kfree(karg);
1278 		return -EINVAL;
1279 	}
1280 	port = karg->hdr.port;
1281 
1282 	karg->port = port;
1283 	pdev = (struct pci_dev *) ioc->pcidev;
1284 
1285 	karg->pciId = pdev->device;
1286 	karg->hwRev = pdev->revision;
1287 	karg->subSystemDevice = pdev->subsystem_device;
1288 	karg->subSystemVendor = pdev->subsystem_vendor;
1289 
1290 	if (cim_rev == 1) {
1291 		/* Get the PCI bus, device, and function numbers for the IOC
1292 		 */
1293 		karg->pciInfo.u.bits.busNumber = pdev->bus->number;
1294 		karg->pciInfo.u.bits.deviceNumber = PCI_SLOT( pdev->devfn );
1295 		karg->pciInfo.u.bits.functionNumber = PCI_FUNC( pdev->devfn );
1296 	} else if (cim_rev == 2) {
1297 		/* Get the PCI bus, device, function and segment ID numbers
1298 		   for the IOC */
1299 		karg->pciInfo.u.bits.busNumber = pdev->bus->number;
1300 		karg->pciInfo.u.bits.deviceNumber = PCI_SLOT( pdev->devfn );
1301 		karg->pciInfo.u.bits.functionNumber = PCI_FUNC( pdev->devfn );
1302 		karg->pciInfo.segmentID = pci_domain_nr(pdev->bus);
1303 	}
1304 
1305 	/* Get number of devices
1306          */
1307 	karg->numDevices = 0;
1308 	if (ioc->sh) {
1309 		shost_for_each_device(sdev, ioc->sh) {
1310 			vdevice = sdev->hostdata;
1311 			if (vdevice == NULL || vdevice->vtarget == NULL)
1312 				continue;
1313 			if (vdevice->vtarget->tflags &
1314 			    MPT_TARGET_FLAGS_RAID_COMPONENT)
1315 				continue;
1316 			karg->numDevices++;
1317 		}
1318 	}
1319 
1320 	/* Set the BIOS and FW Version
1321 	 */
1322 	karg->FWVersion = ioc->facts.FWVersion.Word;
1323 	karg->BIOSVersion = ioc->biosVersion;
1324 
1325 	/* Set the Version Strings.
1326 	 */
1327 	strncpy (karg->driverVersion, MPT_LINUX_PACKAGE_NAME, MPT_IOCTL_VERSION_LENGTH);
1328 	karg->driverVersion[MPT_IOCTL_VERSION_LENGTH-1]='\0';
1329 
1330 	karg->busChangeEvent = 0;
1331 	karg->hostId = ioc->pfacts[port].PortSCSIID;
1332 	karg->rsvd[0] = karg->rsvd[1] = 0;
1333 
1334 	/* Copy the data from kernel memory to user memory
1335 	 */
1336 	if (copy_to_user((char __user *)arg, karg, data_size)) {
1337 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_getiocinfo - "
1338 			"Unable to write out mpt_ioctl_iocinfo struct @ %p\n",
1339 			ioc->name, __FILE__, __LINE__, uarg);
1340 		kfree(karg);
1341 		return -EFAULT;
1342 	}
1343 
1344 	kfree(karg);
1345 	return 0;
1346 }
1347 
1348 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1349 /*
1350  *	mptctl_gettargetinfo - Query the host adapter for target information.
1351  *	@arg: User space argument
1352  *
1353  * Outputs:	None.
1354  * Return:	0 if successful
1355  *		-EFAULT if data unavailable
1356  *		-ENODEV  if no such device/adapter
1357  */
1358 static int
1359 mptctl_gettargetinfo (MPT_ADAPTER *ioc, unsigned long arg)
1360 {
1361 	struct mpt_ioctl_targetinfo __user *uarg = (void __user *) arg;
1362 	struct mpt_ioctl_targetinfo karg;
1363 	VirtDevice		*vdevice;
1364 	char			*pmem;
1365 	int			*pdata;
1366 	int			numDevices = 0;
1367 	int			lun;
1368 	int			maxWordsLeft;
1369 	int			numBytes;
1370 	struct scsi_device 	*sdev;
1371 
1372 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_targetinfo))) {
1373 		printk(KERN_ERR MYNAM "%s@%d::mptctl_gettargetinfo - "
1374 			"Unable to read in mpt_ioctl_targetinfo struct @ %p\n",
1375 				__FILE__, __LINE__, uarg);
1376 		return -EFAULT;
1377 	}
1378 
1379 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_gettargetinfo called.\n",
1380 	    ioc->name));
1381 	numBytes = karg.hdr.maxDataSize - sizeof(mpt_ioctl_header);
1382 	maxWordsLeft = numBytes/sizeof(int);
1383 
1384 	if (maxWordsLeft <= 0) {
1385 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_gettargetinfo() - no memory available!\n",
1386 			ioc->name, __FILE__, __LINE__);
1387 		return -ENOMEM;
1388 	}
1389 
1390 	/* Fill in the data and return the structure to the calling
1391 	 * program
1392 	 */
1393 
1394 	/* struct mpt_ioctl_targetinfo does not contain sufficient space
1395 	 * for the target structures so when the IOCTL is called, there is
1396 	 * not sufficient stack space for the structure. Allocate memory,
1397 	 * populate the memory, copy back to the user, then free memory.
1398 	 * targetInfo format:
1399 	 * bits 31-24: reserved
1400 	 *      23-16: LUN
1401 	 *      15- 8: Bus Number
1402 	 *       7- 0: Target ID
1403 	 */
1404 	pmem = kzalloc(numBytes, GFP_KERNEL);
1405 	if (!pmem) {
1406 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_gettargetinfo() - no memory available!\n",
1407 			ioc->name, __FILE__, __LINE__);
1408 		return -ENOMEM;
1409 	}
1410 	pdata =  (int *) pmem;
1411 
1412 	/* Get number of devices
1413          */
1414 	if (ioc->sh){
1415 		shost_for_each_device(sdev, ioc->sh) {
1416 			if (!maxWordsLeft)
1417 				continue;
1418 			vdevice = sdev->hostdata;
1419 			if (vdevice == NULL || vdevice->vtarget == NULL)
1420 				continue;
1421 			if (vdevice->vtarget->tflags &
1422 			    MPT_TARGET_FLAGS_RAID_COMPONENT)
1423 				continue;
1424 			lun = (vdevice->vtarget->raidVolume) ? 0x80 : vdevice->lun;
1425 			*pdata = (((u8)lun << 16) + (vdevice->vtarget->channel << 8) +
1426 			    (vdevice->vtarget->id ));
1427 			pdata++;
1428 			numDevices++;
1429 			--maxWordsLeft;
1430 		}
1431 	}
1432 	karg.numDevices = numDevices;
1433 
1434 	/* Copy part of the data from kernel memory to user memory
1435 	 */
1436 	if (copy_to_user((char __user *)arg, &karg,
1437 				sizeof(struct mpt_ioctl_targetinfo))) {
1438 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_gettargetinfo - "
1439 			"Unable to write out mpt_ioctl_targetinfo struct @ %p\n",
1440 			ioc->name, __FILE__, __LINE__, uarg);
1441 		kfree(pmem);
1442 		return -EFAULT;
1443 	}
1444 
1445 	/* Copy the remaining data from kernel memory to user memory
1446 	 */
1447 	if (copy_to_user(uarg->targetInfo, pmem, numBytes)) {
1448 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_gettargetinfo - "
1449 			"Unable to write out mpt_ioctl_targetinfo struct @ %p\n",
1450 			ioc->name, __FILE__, __LINE__, pdata);
1451 		kfree(pmem);
1452 		return -EFAULT;
1453 	}
1454 
1455 	kfree(pmem);
1456 
1457 	return 0;
1458 }
1459 
1460 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1461 /* MPT IOCTL Test function.
1462  *
1463  * Outputs:	None.
1464  * Return:	0 if successful
1465  *		-EFAULT if data unavailable
1466  *		-ENODEV  if no such device/adapter
1467  */
1468 static int
1469 mptctl_readtest (MPT_ADAPTER *ioc, unsigned long arg)
1470 {
1471 	struct mpt_ioctl_test __user *uarg = (void __user *) arg;
1472 	struct mpt_ioctl_test	 karg;
1473 
1474 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_test))) {
1475 		printk(KERN_ERR MYNAM "%s@%d::mptctl_readtest - "
1476 			"Unable to read in mpt_ioctl_test struct @ %p\n",
1477 				__FILE__, __LINE__, uarg);
1478 		return -EFAULT;
1479 	}
1480 
1481 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_readtest called.\n",
1482 	    ioc->name));
1483 	/* Fill in the data and return the structure to the calling
1484 	 * program
1485 	 */
1486 
1487 #ifdef MFCNT
1488 	karg.chip_type = ioc->mfcnt;
1489 #else
1490 	karg.chip_type = ioc->pcidev->device;
1491 #endif
1492 	strncpy (karg.name, ioc->name, MPT_MAX_NAME);
1493 	karg.name[MPT_MAX_NAME-1]='\0';
1494 	strncpy (karg.product, ioc->prod_name, MPT_PRODUCT_LENGTH);
1495 	karg.product[MPT_PRODUCT_LENGTH-1]='\0';
1496 
1497 	/* Copy the data from kernel memory to user memory
1498 	 */
1499 	if (copy_to_user((char __user *)arg, &karg, sizeof(struct mpt_ioctl_test))) {
1500 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_readtest - "
1501 			"Unable to write out mpt_ioctl_test struct @ %p\n",
1502 			ioc->name, __FILE__, __LINE__, uarg);
1503 		return -EFAULT;
1504 	}
1505 
1506 	return 0;
1507 }
1508 
1509 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1510 /*
1511  *	mptctl_eventquery - Query the host adapter for the event types
1512  *	that are being logged.
1513  *	@arg: User space argument
1514  *
1515  * Outputs:	None.
1516  * Return:	0 if successful
1517  *		-EFAULT if data unavailable
1518  *		-ENODEV  if no such device/adapter
1519  */
1520 static int
1521 mptctl_eventquery (MPT_ADAPTER *ioc, unsigned long arg)
1522 {
1523 	struct mpt_ioctl_eventquery __user *uarg = (void __user *) arg;
1524 	struct mpt_ioctl_eventquery	 karg;
1525 
1526 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_eventquery))) {
1527 		printk(KERN_ERR MYNAM "%s@%d::mptctl_eventquery - "
1528 			"Unable to read in mpt_ioctl_eventquery struct @ %p\n",
1529 				__FILE__, __LINE__, uarg);
1530 		return -EFAULT;
1531 	}
1532 
1533 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_eventquery called.\n",
1534 	    ioc->name));
1535 	karg.eventEntries = MPTCTL_EVENT_LOG_SIZE;
1536 	karg.eventTypes = ioc->eventTypes;
1537 
1538 	/* Copy the data from kernel memory to user memory
1539 	 */
1540 	if (copy_to_user((char __user *)arg, &karg, sizeof(struct mpt_ioctl_eventquery))) {
1541 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_eventquery - "
1542 			"Unable to write out mpt_ioctl_eventquery struct @ %p\n",
1543 			ioc->name, __FILE__, __LINE__, uarg);
1544 		return -EFAULT;
1545 	}
1546 	return 0;
1547 }
1548 
1549 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1550 static int
1551 mptctl_eventenable (MPT_ADAPTER *ioc, unsigned long arg)
1552 {
1553 	struct mpt_ioctl_eventenable __user *uarg = (void __user *) arg;
1554 	struct mpt_ioctl_eventenable	 karg;
1555 
1556 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_eventenable))) {
1557 		printk(KERN_ERR MYNAM "%s@%d::mptctl_eventenable - "
1558 			"Unable to read in mpt_ioctl_eventenable struct @ %p\n",
1559 				__FILE__, __LINE__, uarg);
1560 		return -EFAULT;
1561 	}
1562 
1563 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_eventenable called.\n",
1564 	    ioc->name));
1565 	if (ioc->events == NULL) {
1566 		/* Have not yet allocated memory - do so now.
1567 		 */
1568 		int sz = MPTCTL_EVENT_LOG_SIZE * sizeof(MPT_IOCTL_EVENTS);
1569 		ioc->events = kzalloc(sz, GFP_KERNEL);
1570 		if (!ioc->events) {
1571 			printk(MYIOC_s_ERR_FMT
1572 			    ": ERROR - Insufficient memory to add adapter!\n",
1573 			    ioc->name);
1574 			return -ENOMEM;
1575 		}
1576 		ioc->alloc_total += sz;
1577 
1578 		ioc->eventContext = 0;
1579         }
1580 
1581 	/* Update the IOC event logging flag.
1582 	 */
1583 	ioc->eventTypes = karg.eventTypes;
1584 
1585 	return 0;
1586 }
1587 
1588 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1589 static int
1590 mptctl_eventreport (MPT_ADAPTER *ioc, unsigned long arg)
1591 {
1592 	struct mpt_ioctl_eventreport __user *uarg = (void __user *) arg;
1593 	struct mpt_ioctl_eventreport	 karg;
1594 	int			 numBytes, maxEvents, max;
1595 
1596 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_eventreport))) {
1597 		printk(KERN_ERR MYNAM "%s@%d::mptctl_eventreport - "
1598 			"Unable to read in mpt_ioctl_eventreport struct @ %p\n",
1599 				__FILE__, __LINE__, uarg);
1600 		return -EFAULT;
1601 	}
1602 
1603 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_eventreport called.\n",
1604 	    ioc->name));
1605 
1606 	numBytes = karg.hdr.maxDataSize - sizeof(mpt_ioctl_header);
1607 	maxEvents = numBytes/sizeof(MPT_IOCTL_EVENTS);
1608 
1609 
1610 	max = MPTCTL_EVENT_LOG_SIZE < maxEvents ? MPTCTL_EVENT_LOG_SIZE : maxEvents;
1611 
1612 	/* If fewer than 1 event is requested, there must have
1613 	 * been some type of error.
1614 	 */
1615 	if ((max < 1) || !ioc->events)
1616 		return -ENODATA;
1617 
1618 	/* reset this flag so SIGIO can restart */
1619 	ioc->aen_event_read_flag=0;
1620 
1621 	/* Copy the data from kernel memory to user memory
1622 	 */
1623 	numBytes = max * sizeof(MPT_IOCTL_EVENTS);
1624 	if (copy_to_user(uarg->eventData, ioc->events, numBytes)) {
1625 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_eventreport - "
1626 			"Unable to write out mpt_ioctl_eventreport struct @ %p\n",
1627 			ioc->name, __FILE__, __LINE__, ioc->events);
1628 		return -EFAULT;
1629 	}
1630 
1631 	return 0;
1632 }
1633 
1634 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1635 static int
1636 mptctl_replace_fw (MPT_ADAPTER *ioc, unsigned long arg)
1637 {
1638 	struct mpt_ioctl_replace_fw __user *uarg = (void __user *) arg;
1639 	struct mpt_ioctl_replace_fw	 karg;
1640 	int			 newFwSize;
1641 
1642 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_replace_fw))) {
1643 		printk(KERN_ERR MYNAM "%s@%d::mptctl_replace_fw - "
1644 			"Unable to read in mpt_ioctl_replace_fw struct @ %p\n",
1645 				__FILE__, __LINE__, uarg);
1646 		return -EFAULT;
1647 	}
1648 
1649 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_replace_fw called.\n",
1650 	    ioc->name));
1651 	/* If caching FW, Free the old FW image
1652 	 */
1653 	if (ioc->cached_fw == NULL)
1654 		return 0;
1655 
1656 	mpt_free_fw_memory(ioc);
1657 
1658 	/* Allocate memory for the new FW image
1659 	 */
1660 	newFwSize = ALIGN(karg.newImageSize, 4);
1661 
1662 	mpt_alloc_fw_memory(ioc, newFwSize);
1663 	if (ioc->cached_fw == NULL)
1664 		return -ENOMEM;
1665 
1666 	/* Copy the data from user memory to kernel space
1667 	 */
1668 	if (copy_from_user(ioc->cached_fw, uarg->newImage, newFwSize)) {
1669 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_replace_fw - "
1670 				"Unable to read in mpt_ioctl_replace_fw image "
1671 				"@ %p\n", ioc->name, __FILE__, __LINE__, uarg);
1672 		mpt_free_fw_memory(ioc);
1673 		return -EFAULT;
1674 	}
1675 
1676 	/* Update IOCFactsReply
1677 	 */
1678 	ioc->facts.FWImageSize = newFwSize;
1679 	return 0;
1680 }
1681 
1682 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1683 /* MPT IOCTL MPTCOMMAND function.
1684  * Cast the arg into the mpt_ioctl_mpt_command structure.
1685  *
1686  * Outputs:	None.
1687  * Return:	0 if successful
1688  *		-EBUSY  if previous command timeout and IOC reset is not complete.
1689  *		-EFAULT if data unavailable
1690  *		-ENODEV if no such device/adapter
1691  *		-ETIME	if timer expires
1692  *		-ENOMEM if memory allocation error
1693  */
1694 static int
1695 mptctl_mpt_command (MPT_ADAPTER *ioc, unsigned long arg)
1696 {
1697 	struct mpt_ioctl_command __user *uarg = (void __user *) arg;
1698 	struct mpt_ioctl_command  karg;
1699 	int		rc;
1700 
1701 
1702 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_command))) {
1703 		printk(KERN_ERR MYNAM "%s@%d::mptctl_mpt_command - "
1704 			"Unable to read in mpt_ioctl_command struct @ %p\n",
1705 				__FILE__, __LINE__, uarg);
1706 		return -EFAULT;
1707 	}
1708 
1709 	rc = mptctl_do_mpt_command (ioc, karg, &uarg->MF);
1710 
1711 	return rc;
1712 }
1713 
1714 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1715 /* Worker routine for the IOCTL MPTCOMMAND and MPTCOMMAND32 (sparc) commands.
1716  *
1717  * Outputs:	None.
1718  * Return:	0 if successful
1719  *		-EBUSY  if previous command timeout and IOC reset is not complete.
1720  *		-EFAULT if data unavailable
1721  *		-ENODEV if no such device/adapter
1722  *		-ETIME	if timer expires
1723  *		-ENOMEM if memory allocation error
1724  *		-EPERM if SCSI I/O and target is untagged
1725  */
1726 static int
1727 mptctl_do_mpt_command (MPT_ADAPTER *ioc, struct mpt_ioctl_command karg, void __user *mfPtr)
1728 {
1729 	MPT_FRAME_HDR	*mf = NULL;
1730 	MPIHeader_t	*hdr;
1731 	char		*psge;
1732 	struct buflist	bufIn;	/* data In buffer */
1733 	struct buflist	bufOut; /* data Out buffer */
1734 	dma_addr_t	dma_addr_in;
1735 	dma_addr_t	dma_addr_out;
1736 	int		sgSize = 0;	/* Num SG elements */
1737 	int		flagsLength;
1738 	int		sz, rc = 0;
1739 	int		msgContext;
1740 	u16		req_idx;
1741 	ulong 		timeout;
1742 	unsigned long	timeleft;
1743 	struct scsi_device *sdev;
1744 	unsigned long	 flags;
1745 	u8		 function;
1746 
1747 	/* bufIn and bufOut are used for user to kernel space transfers
1748 	 */
1749 	bufIn.kptr = bufOut.kptr = NULL;
1750 	bufIn.len = bufOut.len = 0;
1751 
1752 	spin_lock_irqsave(&ioc->taskmgmt_lock, flags);
1753 	if (ioc->ioc_reset_in_progress) {
1754 		spin_unlock_irqrestore(&ioc->taskmgmt_lock, flags);
1755 		printk(KERN_ERR MYNAM "%s@%d::mptctl_do_mpt_command - "
1756 			"Busy with diagnostic reset\n", __FILE__, __LINE__);
1757 		return -EBUSY;
1758 	}
1759 	spin_unlock_irqrestore(&ioc->taskmgmt_lock, flags);
1760 
1761 	/* Basic sanity checks to prevent underflows or integer overflows */
1762 	if (karg.maxReplyBytes < 0 ||
1763 	    karg.dataInSize < 0 ||
1764 	    karg.dataOutSize < 0 ||
1765 	    karg.dataSgeOffset < 0 ||
1766 	    karg.maxSenseBytes < 0 ||
1767 	    karg.dataSgeOffset > ioc->req_sz / 4)
1768 		return -EINVAL;
1769 
1770 	/* Verify that the final request frame will not be too large.
1771 	 */
1772 	sz = karg.dataSgeOffset * 4;
1773 	if (karg.dataInSize > 0)
1774 		sz += ioc->SGE_size;
1775 	if (karg.dataOutSize > 0)
1776 		sz += ioc->SGE_size;
1777 
1778 	if (sz > ioc->req_sz) {
1779 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
1780 			"Request frame too large (%d) maximum (%d)\n",
1781 			ioc->name, __FILE__, __LINE__, sz, ioc->req_sz);
1782 		return -EFAULT;
1783 	}
1784 
1785 	/* Get a free request frame and save the message context.
1786 	 */
1787         if ((mf = mpt_get_msg_frame(mptctl_id, ioc)) == NULL)
1788                 return -EAGAIN;
1789 
1790 	hdr = (MPIHeader_t *) mf;
1791 	msgContext = le32_to_cpu(hdr->MsgContext);
1792 	req_idx = le16_to_cpu(mf->u.frame.hwhdr.msgctxu.fld.req_idx);
1793 
1794 	/* Copy the request frame
1795 	 * Reset the saved message context.
1796 	 * Request frame in user space
1797 	 */
1798 	if (copy_from_user(mf, mfPtr, karg.dataSgeOffset * 4)) {
1799 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
1800 			"Unable to read MF from mpt_ioctl_command struct @ %p\n",
1801 			ioc->name, __FILE__, __LINE__, mfPtr);
1802 		function = -1;
1803 		rc = -EFAULT;
1804 		goto done_free_mem;
1805 	}
1806 	hdr->MsgContext = cpu_to_le32(msgContext);
1807 	function = hdr->Function;
1808 
1809 
1810 	/* Verify that this request is allowed.
1811 	 */
1812 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sending mpi function (0x%02X), req=%p\n",
1813 	    ioc->name, hdr->Function, mf));
1814 
1815 	switch (function) {
1816 	case MPI_FUNCTION_IOC_FACTS:
1817 	case MPI_FUNCTION_PORT_FACTS:
1818 		karg.dataOutSize  = karg.dataInSize = 0;
1819 		break;
1820 
1821 	case MPI_FUNCTION_CONFIG:
1822 	{
1823 		Config_t *config_frame;
1824 		config_frame = (Config_t *)mf;
1825 		dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "\ttype=0x%02x ext_type=0x%02x "
1826 		    "number=0x%02x action=0x%02x\n", ioc->name,
1827 		    config_frame->Header.PageType,
1828 		    config_frame->ExtPageType,
1829 		    config_frame->Header.PageNumber,
1830 		    config_frame->Action));
1831 		break;
1832 	}
1833 
1834 	case MPI_FUNCTION_FC_COMMON_TRANSPORT_SEND:
1835 	case MPI_FUNCTION_FC_EX_LINK_SRVC_SEND:
1836 	case MPI_FUNCTION_FW_UPLOAD:
1837 	case MPI_FUNCTION_SCSI_ENCLOSURE_PROCESSOR:
1838 	case MPI_FUNCTION_FW_DOWNLOAD:
1839 	case MPI_FUNCTION_FC_PRIMITIVE_SEND:
1840 	case MPI_FUNCTION_TOOLBOX:
1841 	case MPI_FUNCTION_SAS_IO_UNIT_CONTROL:
1842 		break;
1843 
1844 	case MPI_FUNCTION_SCSI_IO_REQUEST:
1845 		if (ioc->sh) {
1846 			SCSIIORequest_t *pScsiReq = (SCSIIORequest_t *) mf;
1847 			int qtag = MPI_SCSIIO_CONTROL_UNTAGGED;
1848 			int scsidir = 0;
1849 			int dataSize;
1850 			u32 id;
1851 
1852 			id = (ioc->devices_per_bus == 0) ? 256 : ioc->devices_per_bus;
1853 			if (pScsiReq->TargetID > id) {
1854 				printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
1855 					"Target ID out of bounds. \n",
1856 					ioc->name, __FILE__, __LINE__);
1857 				rc = -ENODEV;
1858 				goto done_free_mem;
1859 			}
1860 
1861 			if (pScsiReq->Bus >= ioc->number_of_buses) {
1862 				printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
1863 					"Target Bus out of bounds. \n",
1864 					ioc->name, __FILE__, __LINE__);
1865 				rc = -ENODEV;
1866 				goto done_free_mem;
1867 			}
1868 
1869 			pScsiReq->MsgFlags &= ~MPI_SCSIIO_MSGFLGS_SENSE_WIDTH;
1870 			pScsiReq->MsgFlags |= mpt_msg_flags(ioc);
1871 
1872 
1873 			/* verify that app has not requested
1874 			 *	more sense data than driver
1875 			 *	can provide, if so, reset this parameter
1876 			 * set the sense buffer pointer low address
1877 			 * update the control field to specify Q type
1878 			 */
1879 			if (karg.maxSenseBytes > MPT_SENSE_BUFFER_SIZE)
1880 				pScsiReq->SenseBufferLength = MPT_SENSE_BUFFER_SIZE;
1881 			else
1882 				pScsiReq->SenseBufferLength = karg.maxSenseBytes;
1883 
1884 			pScsiReq->SenseBufferLowAddr =
1885 				cpu_to_le32(ioc->sense_buf_low_dma
1886 				   + (req_idx * MPT_SENSE_BUFFER_ALLOC));
1887 
1888 			shost_for_each_device(sdev, ioc->sh) {
1889 				struct scsi_target *starget = scsi_target(sdev);
1890 				VirtTarget *vtarget = starget->hostdata;
1891 
1892 				if (vtarget == NULL)
1893 					continue;
1894 
1895 				if ((pScsiReq->TargetID == vtarget->id) &&
1896 				    (pScsiReq->Bus == vtarget->channel) &&
1897 				    (vtarget->tflags & MPT_TARGET_FLAGS_Q_YES))
1898 					qtag = MPI_SCSIIO_CONTROL_SIMPLEQ;
1899 			}
1900 
1901 			/* Have the IOCTL driver set the direction based
1902 			 * on the dataOutSize (ordering issue with Sparc).
1903 			 */
1904 			if (karg.dataOutSize > 0) {
1905 				scsidir = MPI_SCSIIO_CONTROL_WRITE;
1906 				dataSize = karg.dataOutSize;
1907 			} else {
1908 				scsidir = MPI_SCSIIO_CONTROL_READ;
1909 				dataSize = karg.dataInSize;
1910 			}
1911 
1912 			pScsiReq->Control = cpu_to_le32(scsidir | qtag);
1913 			pScsiReq->DataLength = cpu_to_le32(dataSize);
1914 
1915 
1916 		} else {
1917 			printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
1918 				"SCSI driver is not loaded. \n",
1919 				ioc->name, __FILE__, __LINE__);
1920 			rc = -EFAULT;
1921 			goto done_free_mem;
1922 		}
1923 		break;
1924 
1925 	case MPI_FUNCTION_SMP_PASSTHROUGH:
1926 		/* Check mf->PassthruFlags to determine if
1927 		 * transfer is ImmediateMode or not.
1928 		 * Immediate mode returns data in the ReplyFrame.
1929 		 * Else, we are sending request and response data
1930 		 * in two SGLs at the end of the mf.
1931 		 */
1932 		break;
1933 
1934 	case MPI_FUNCTION_SATA_PASSTHROUGH:
1935 		if (!ioc->sh) {
1936 			printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
1937 				"SCSI driver is not loaded. \n",
1938 				ioc->name, __FILE__, __LINE__);
1939 			rc = -EFAULT;
1940 			goto done_free_mem;
1941 		}
1942 		break;
1943 
1944 	case MPI_FUNCTION_RAID_ACTION:
1945 		/* Just add a SGE
1946 		 */
1947 		break;
1948 
1949 	case MPI_FUNCTION_RAID_SCSI_IO_PASSTHROUGH:
1950 		if (ioc->sh) {
1951 			SCSIIORequest_t *pScsiReq = (SCSIIORequest_t *) mf;
1952 			int qtag = MPI_SCSIIO_CONTROL_SIMPLEQ;
1953 			int scsidir = MPI_SCSIIO_CONTROL_READ;
1954 			int dataSize;
1955 
1956 			pScsiReq->MsgFlags &= ~MPI_SCSIIO_MSGFLGS_SENSE_WIDTH;
1957 			pScsiReq->MsgFlags |= mpt_msg_flags(ioc);
1958 
1959 
1960 			/* verify that app has not requested
1961 			 *	more sense data than driver
1962 			 *	can provide, if so, reset this parameter
1963 			 * set the sense buffer pointer low address
1964 			 * update the control field to specify Q type
1965 			 */
1966 			if (karg.maxSenseBytes > MPT_SENSE_BUFFER_SIZE)
1967 				pScsiReq->SenseBufferLength = MPT_SENSE_BUFFER_SIZE;
1968 			else
1969 				pScsiReq->SenseBufferLength = karg.maxSenseBytes;
1970 
1971 			pScsiReq->SenseBufferLowAddr =
1972 				cpu_to_le32(ioc->sense_buf_low_dma
1973 				   + (req_idx * MPT_SENSE_BUFFER_ALLOC));
1974 
1975 			/* All commands to physical devices are tagged
1976 			 */
1977 
1978 			/* Have the IOCTL driver set the direction based
1979 			 * on the dataOutSize (ordering issue with Sparc).
1980 			 */
1981 			if (karg.dataOutSize > 0) {
1982 				scsidir = MPI_SCSIIO_CONTROL_WRITE;
1983 				dataSize = karg.dataOutSize;
1984 			} else {
1985 				scsidir = MPI_SCSIIO_CONTROL_READ;
1986 				dataSize = karg.dataInSize;
1987 			}
1988 
1989 			pScsiReq->Control = cpu_to_le32(scsidir | qtag);
1990 			pScsiReq->DataLength = cpu_to_le32(dataSize);
1991 
1992 		} else {
1993 			printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
1994 				"SCSI driver is not loaded. \n",
1995 				ioc->name, __FILE__, __LINE__);
1996 			rc = -EFAULT;
1997 			goto done_free_mem;
1998 		}
1999 		break;
2000 
2001 	case MPI_FUNCTION_SCSI_TASK_MGMT:
2002 	{
2003 		SCSITaskMgmt_t	*pScsiTm;
2004 		pScsiTm = (SCSITaskMgmt_t *)mf;
2005 		dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT
2006 			"\tTaskType=0x%x MsgFlags=0x%x "
2007 			"TaskMsgContext=0x%x id=%d channel=%d\n",
2008 			ioc->name, pScsiTm->TaskType, le32_to_cpu
2009 			(pScsiTm->TaskMsgContext), pScsiTm->MsgFlags,
2010 			pScsiTm->TargetID, pScsiTm->Bus));
2011 		break;
2012 	}
2013 
2014 	case MPI_FUNCTION_IOC_INIT:
2015 		{
2016 			IOCInit_t	*pInit = (IOCInit_t *) mf;
2017 			u32		high_addr, sense_high;
2018 
2019 			/* Verify that all entries in the IOC INIT match
2020 			 * existing setup (and in LE format).
2021 			 */
2022 			if (sizeof(dma_addr_t) == sizeof(u64)) {
2023 				high_addr = cpu_to_le32((u32)((u64)ioc->req_frames_dma >> 32));
2024 				sense_high= cpu_to_le32((u32)((u64)ioc->sense_buf_pool_dma >> 32));
2025 			} else {
2026 				high_addr = 0;
2027 				sense_high= 0;
2028 			}
2029 
2030 			if ((pInit->Flags != 0) || (pInit->MaxDevices != ioc->facts.MaxDevices) ||
2031 				(pInit->MaxBuses != ioc->facts.MaxBuses) ||
2032 				(pInit->ReplyFrameSize != cpu_to_le16(ioc->reply_sz)) ||
2033 				(pInit->HostMfaHighAddr != high_addr) ||
2034 				(pInit->SenseBufferHighAddr != sense_high)) {
2035 				printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
2036 					"IOC_INIT issued with 1 or more incorrect parameters. Rejected.\n",
2037 					ioc->name, __FILE__, __LINE__);
2038 				rc = -EFAULT;
2039 				goto done_free_mem;
2040 			}
2041 		}
2042 		break;
2043 	default:
2044 		/*
2045 		 * MPI_FUNCTION_PORT_ENABLE
2046 		 * MPI_FUNCTION_TARGET_CMD_BUFFER_POST
2047 		 * MPI_FUNCTION_TARGET_ASSIST
2048 		 * MPI_FUNCTION_TARGET_STATUS_SEND
2049 		 * MPI_FUNCTION_TARGET_MODE_ABORT
2050 		 * MPI_FUNCTION_IOC_MESSAGE_UNIT_RESET
2051 		 * MPI_FUNCTION_IO_UNIT_RESET
2052 		 * MPI_FUNCTION_HANDSHAKE
2053 		 * MPI_FUNCTION_REPLY_FRAME_REMOVAL
2054 		 * MPI_FUNCTION_EVENT_NOTIFICATION
2055 		 *  (driver handles event notification)
2056 		 * MPI_FUNCTION_EVENT_ACK
2057 		 */
2058 
2059 		/*  What to do with these???  CHECK ME!!!
2060 			MPI_FUNCTION_FC_LINK_SRVC_BUF_POST
2061 			MPI_FUNCTION_FC_LINK_SRVC_RSP
2062 			MPI_FUNCTION_FC_ABORT
2063 			MPI_FUNCTION_LAN_SEND
2064 			MPI_FUNCTION_LAN_RECEIVE
2065 		 	MPI_FUNCTION_LAN_RESET
2066 		*/
2067 
2068 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
2069 			"Illegal request (function 0x%x) \n",
2070 			ioc->name, __FILE__, __LINE__, hdr->Function);
2071 		rc = -EFAULT;
2072 		goto done_free_mem;
2073 	}
2074 
2075 	/* Add the SGL ( at most one data in SGE and one data out SGE )
2076 	 * In the case of two SGE's - the data out (write) will always
2077 	 * preceede the data in (read) SGE. psgList is used to free the
2078 	 * allocated memory.
2079 	 */
2080 	psge = (char *) (((int *) mf) + karg.dataSgeOffset);
2081 	flagsLength = 0;
2082 
2083 	if (karg.dataOutSize > 0)
2084 		sgSize ++;
2085 
2086 	if (karg.dataInSize > 0)
2087 		sgSize ++;
2088 
2089 	if (sgSize > 0) {
2090 
2091 		/* Set up the dataOut memory allocation */
2092 		if (karg.dataOutSize > 0) {
2093 			if (karg.dataInSize > 0) {
2094 				flagsLength = ( MPI_SGE_FLAGS_SIMPLE_ELEMENT |
2095 						MPI_SGE_FLAGS_END_OF_BUFFER |
2096 						MPI_SGE_FLAGS_DIRECTION)
2097 						<< MPI_SGE_FLAGS_SHIFT;
2098 			} else {
2099 				flagsLength = MPT_SGE_FLAGS_SSIMPLE_WRITE;
2100 			}
2101 			flagsLength |= karg.dataOutSize;
2102 			bufOut.len = karg.dataOutSize;
2103 			bufOut.kptr = pci_alloc_consistent(
2104 					ioc->pcidev, bufOut.len, &dma_addr_out);
2105 
2106 			if (bufOut.kptr == NULL) {
2107 				rc = -ENOMEM;
2108 				goto done_free_mem;
2109 			} else {
2110 				/* Set up this SGE.
2111 				 * Copy to MF and to sglbuf
2112 				 */
2113 				ioc->add_sge(psge, flagsLength, dma_addr_out);
2114 				psge += ioc->SGE_size;
2115 
2116 				/* Copy user data to kernel space.
2117 				 */
2118 				if (copy_from_user(bufOut.kptr,
2119 						karg.dataOutBufPtr,
2120 						bufOut.len)) {
2121 					printk(MYIOC_s_ERR_FMT
2122 						"%s@%d::mptctl_do_mpt_command - Unable "
2123 						"to read user data "
2124 						"struct @ %p\n",
2125 						ioc->name, __FILE__, __LINE__,karg.dataOutBufPtr);
2126 					rc =  -EFAULT;
2127 					goto done_free_mem;
2128 				}
2129 			}
2130 		}
2131 
2132 		if (karg.dataInSize > 0) {
2133 			flagsLength = MPT_SGE_FLAGS_SSIMPLE_READ;
2134 			flagsLength |= karg.dataInSize;
2135 
2136 			bufIn.len = karg.dataInSize;
2137 			bufIn.kptr = pci_alloc_consistent(ioc->pcidev,
2138 					bufIn.len, &dma_addr_in);
2139 
2140 			if (bufIn.kptr == NULL) {
2141 				rc = -ENOMEM;
2142 				goto done_free_mem;
2143 			} else {
2144 				/* Set up this SGE
2145 				 * Copy to MF and to sglbuf
2146 				 */
2147 				ioc->add_sge(psge, flagsLength, dma_addr_in);
2148 			}
2149 		}
2150 	} else  {
2151 		/* Add a NULL SGE
2152 		 */
2153 		ioc->add_sge(psge, flagsLength, (dma_addr_t) -1);
2154 	}
2155 
2156 	SET_MGMT_MSG_CONTEXT(ioc->ioctl_cmds.msg_context, hdr->MsgContext);
2157 	INITIALIZE_MGMT_STATUS(ioc->ioctl_cmds.status)
2158 	if (hdr->Function == MPI_FUNCTION_SCSI_TASK_MGMT) {
2159 
2160 		mutex_lock(&ioc->taskmgmt_cmds.mutex);
2161 		if (mpt_set_taskmgmt_in_progress_flag(ioc) != 0) {
2162 			mutex_unlock(&ioc->taskmgmt_cmds.mutex);
2163 			goto done_free_mem;
2164 		}
2165 
2166 		DBG_DUMP_TM_REQUEST_FRAME(ioc, (u32 *)mf);
2167 
2168 		if ((ioc->facts.IOCCapabilities & MPI_IOCFACTS_CAPABILITY_HIGH_PRI_Q) &&
2169 		    (ioc->facts.MsgVersion >= MPI_VERSION_01_05))
2170 			mpt_put_msg_frame_hi_pri(mptctl_id, ioc, mf);
2171 		else {
2172 			rc =mpt_send_handshake_request(mptctl_id, ioc,
2173 				sizeof(SCSITaskMgmt_t), (u32*)mf, CAN_SLEEP);
2174 			if (rc != 0) {
2175 				dfailprintk(ioc, printk(MYIOC_s_ERR_FMT
2176 				    "send_handshake FAILED! (ioc %p, mf %p)\n",
2177 				    ioc->name, ioc, mf));
2178 				mpt_clear_taskmgmt_in_progress_flag(ioc);
2179 				rc = -ENODATA;
2180 				mutex_unlock(&ioc->taskmgmt_cmds.mutex);
2181 				goto done_free_mem;
2182 			}
2183 		}
2184 
2185 	} else
2186 		mpt_put_msg_frame(mptctl_id, ioc, mf);
2187 
2188 	/* Now wait for the command to complete */
2189 	timeout = (karg.timeout > 0) ? karg.timeout : MPT_IOCTL_DEFAULT_TIMEOUT;
2190 retry_wait:
2191 	timeleft = wait_for_completion_timeout(&ioc->ioctl_cmds.done,
2192 				HZ*timeout);
2193 	if (!(ioc->ioctl_cmds.status & MPT_MGMT_STATUS_COMMAND_GOOD)) {
2194 		rc = -ETIME;
2195 		dfailprintk(ioc, printk(MYIOC_s_ERR_FMT "%s: TIMED OUT!\n",
2196 		    ioc->name, __func__));
2197 		if (ioc->ioctl_cmds.status & MPT_MGMT_STATUS_DID_IOCRESET) {
2198 			if (function == MPI_FUNCTION_SCSI_TASK_MGMT)
2199 				mutex_unlock(&ioc->taskmgmt_cmds.mutex);
2200 			goto done_free_mem;
2201 		}
2202 		if (!timeleft) {
2203 			printk(MYIOC_s_WARN_FMT
2204 			       "mpt cmd timeout, doorbell=0x%08x"
2205 			       " function=0x%x\n",
2206 			       ioc->name, mpt_GetIocState(ioc, 0), function);
2207 			if (function == MPI_FUNCTION_SCSI_TASK_MGMT)
2208 				mutex_unlock(&ioc->taskmgmt_cmds.mutex);
2209 			mptctl_timeout_expired(ioc, mf);
2210 			mf = NULL;
2211 		} else
2212 			goto retry_wait;
2213 		goto done_free_mem;
2214 	}
2215 
2216 	if (function == MPI_FUNCTION_SCSI_TASK_MGMT)
2217 		mutex_unlock(&ioc->taskmgmt_cmds.mutex);
2218 
2219 
2220 	mf = NULL;
2221 
2222 	/* If a valid reply frame, copy to the user.
2223 	 * Offset 2: reply length in U32's
2224 	 */
2225 	if (ioc->ioctl_cmds.status & MPT_MGMT_STATUS_RF_VALID) {
2226 		if (karg.maxReplyBytes < ioc->reply_sz) {
2227 			sz = min(karg.maxReplyBytes,
2228 				4*ioc->ioctl_cmds.reply[2]);
2229 		} else {
2230 			 sz = min(ioc->reply_sz, 4*ioc->ioctl_cmds.reply[2]);
2231 		}
2232 		if (sz > 0) {
2233 			if (copy_to_user(karg.replyFrameBufPtr,
2234 				 ioc->ioctl_cmds.reply, sz)){
2235 				 printk(MYIOC_s_ERR_FMT
2236 				     "%s@%d::mptctl_do_mpt_command - "
2237 				 "Unable to write out reply frame %p\n",
2238 				 ioc->name, __FILE__, __LINE__, karg.replyFrameBufPtr);
2239 				 rc =  -ENODATA;
2240 				 goto done_free_mem;
2241 			}
2242 		}
2243 	}
2244 
2245 	/* If valid sense data, copy to user.
2246 	 */
2247 	if (ioc->ioctl_cmds.status & MPT_MGMT_STATUS_SENSE_VALID) {
2248 		sz = min(karg.maxSenseBytes, MPT_SENSE_BUFFER_SIZE);
2249 		if (sz > 0) {
2250 			if (copy_to_user(karg.senseDataPtr,
2251 				ioc->ioctl_cmds.sense, sz)) {
2252 				printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
2253 				"Unable to write sense data to user %p\n",
2254 				ioc->name, __FILE__, __LINE__,
2255 				karg.senseDataPtr);
2256 				rc =  -ENODATA;
2257 				goto done_free_mem;
2258 			}
2259 		}
2260 	}
2261 
2262 	/* If the overall status is _GOOD and data in, copy data
2263 	 * to user.
2264 	 */
2265 	if ((ioc->ioctl_cmds.status & MPT_MGMT_STATUS_COMMAND_GOOD) &&
2266 				(karg.dataInSize > 0) && (bufIn.kptr)) {
2267 
2268 		if (copy_to_user(karg.dataInBufPtr,
2269 				 bufIn.kptr, karg.dataInSize)) {
2270 			printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
2271 				"Unable to write data to user %p\n",
2272 				ioc->name, __FILE__, __LINE__,
2273 				karg.dataInBufPtr);
2274 			rc =  -ENODATA;
2275 		}
2276 	}
2277 
2278 done_free_mem:
2279 
2280 	CLEAR_MGMT_STATUS(ioc->ioctl_cmds.status)
2281 	SET_MGMT_MSG_CONTEXT(ioc->ioctl_cmds.msg_context, 0);
2282 
2283 	/* Free the allocated memory.
2284 	 */
2285 	if (bufOut.kptr != NULL) {
2286 		pci_free_consistent(ioc->pcidev,
2287 			bufOut.len, (void *) bufOut.kptr, dma_addr_out);
2288 	}
2289 
2290 	if (bufIn.kptr != NULL) {
2291 		pci_free_consistent(ioc->pcidev,
2292 			bufIn.len, (void *) bufIn.kptr, dma_addr_in);
2293 	}
2294 
2295 	/* mf is null if command issued successfully
2296 	 * otherwise, failure occurred after mf acquired.
2297 	 */
2298 	if (mf)
2299 		mpt_free_msg_frame(ioc, mf);
2300 
2301 	return rc;
2302 }
2303 
2304 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2305 /* Prototype Routine for the HOST INFO command.
2306  *
2307  * Outputs:	None.
2308  * Return:	0 if successful
2309  *		-EFAULT if data unavailable
2310  *		-EBUSY  if previous command timeout and IOC reset is not complete.
2311  *		-ENODEV if no such device/adapter
2312  *		-ETIME	if timer expires
2313  *		-ENOMEM if memory allocation error
2314  */
2315 static int
2316 mptctl_hp_hostinfo(MPT_ADAPTER *ioc, unsigned long arg, unsigned int data_size)
2317 {
2318 	hp_host_info_t	__user *uarg = (void __user *) arg;
2319 	struct pci_dev		*pdev;
2320 	char                    *pbuf=NULL;
2321 	dma_addr_t		buf_dma;
2322 	hp_host_info_t		karg;
2323 	CONFIGPARMS		cfg;
2324 	ConfigPageHeader_t	hdr;
2325 	int			rc, cim_rev;
2326 	ToolboxIstwiReadWriteRequest_t	*IstwiRWRequest;
2327 	MPT_FRAME_HDR		*mf = NULL;
2328 	unsigned long		timeleft;
2329 	int			retval;
2330 	u32			msgcontext;
2331 
2332 	/* Reset long to int. Should affect IA64 and SPARC only
2333 	 */
2334 	if (data_size == sizeof(hp_host_info_t))
2335 		cim_rev = 1;
2336 	else if (data_size == sizeof(hp_host_info_rev0_t))
2337 		cim_rev = 0;	/* obsolete */
2338 	else
2339 		return -EFAULT;
2340 
2341 	if (copy_from_user(&karg, uarg, sizeof(hp_host_info_t))) {
2342 		printk(KERN_ERR MYNAM "%s@%d::mptctl_hp_host_info - "
2343 			"Unable to read in hp_host_info struct @ %p\n",
2344 				__FILE__, __LINE__, uarg);
2345 		return -EFAULT;
2346 	}
2347 
2348 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT ": mptctl_hp_hostinfo called.\n",
2349 	    ioc->name));
2350 
2351 	/* Fill in the data and return the structure to the calling
2352 	 * program
2353 	 */
2354 	pdev = (struct pci_dev *) ioc->pcidev;
2355 
2356 	karg.vendor = pdev->vendor;
2357 	karg.device = pdev->device;
2358 	karg.subsystem_id = pdev->subsystem_device;
2359 	karg.subsystem_vendor = pdev->subsystem_vendor;
2360 	karg.devfn = pdev->devfn;
2361 	karg.bus = pdev->bus->number;
2362 
2363 	/* Save the SCSI host no. if
2364 	 * SCSI driver loaded
2365 	 */
2366 	if (ioc->sh != NULL)
2367 		karg.host_no = ioc->sh->host_no;
2368 	else
2369 		karg.host_no =  -1;
2370 
2371 	/* Reformat the fw_version into a string */
2372 	snprintf(karg.fw_version, sizeof(karg.fw_version),
2373 		 "%.2hhu.%.2hhu.%.2hhu.%.2hhu",
2374 		 ioc->facts.FWVersion.Struct.Major,
2375 		 ioc->facts.FWVersion.Struct.Minor,
2376 		 ioc->facts.FWVersion.Struct.Unit,
2377 		 ioc->facts.FWVersion.Struct.Dev);
2378 
2379 	/* Issue a config request to get the device serial number
2380 	 */
2381 	hdr.PageVersion = 0;
2382 	hdr.PageLength = 0;
2383 	hdr.PageNumber = 0;
2384 	hdr.PageType = MPI_CONFIG_PAGETYPE_MANUFACTURING;
2385 	cfg.cfghdr.hdr = &hdr;
2386 	cfg.physAddr = -1;
2387 	cfg.pageAddr = 0;
2388 	cfg.action = MPI_CONFIG_ACTION_PAGE_HEADER;
2389 	cfg.dir = 0;	/* read */
2390 	cfg.timeout = 10;
2391 
2392 	strncpy(karg.serial_number, " ", 24);
2393 	if (mpt_config(ioc, &cfg) == 0) {
2394 		if (cfg.cfghdr.hdr->PageLength > 0) {
2395 			/* Issue the second config page request */
2396 			cfg.action = MPI_CONFIG_ACTION_PAGE_READ_CURRENT;
2397 
2398 			pbuf = pci_alloc_consistent(ioc->pcidev, hdr.PageLength * 4, &buf_dma);
2399 			if (pbuf) {
2400 				cfg.physAddr = buf_dma;
2401 				if (mpt_config(ioc, &cfg) == 0) {
2402 					ManufacturingPage0_t *pdata = (ManufacturingPage0_t *) pbuf;
2403 					if (strlen(pdata->BoardTracerNumber) > 1) {
2404 						strlcpy(karg.serial_number,
2405 							pdata->BoardTracerNumber, 24);
2406 					}
2407 				}
2408 				pci_free_consistent(ioc->pcidev, hdr.PageLength * 4, pbuf, buf_dma);
2409 				pbuf = NULL;
2410 			}
2411 		}
2412 	}
2413 	rc = mpt_GetIocState(ioc, 1);
2414 	switch (rc) {
2415 	case MPI_IOC_STATE_OPERATIONAL:
2416 		karg.ioc_status =  HP_STATUS_OK;
2417 		break;
2418 
2419 	case MPI_IOC_STATE_FAULT:
2420 		karg.ioc_status =  HP_STATUS_FAILED;
2421 		break;
2422 
2423 	case MPI_IOC_STATE_RESET:
2424 	case MPI_IOC_STATE_READY:
2425 	default:
2426 		karg.ioc_status =  HP_STATUS_OTHER;
2427 		break;
2428 	}
2429 
2430 	karg.base_io_addr = pci_resource_start(pdev, 0);
2431 
2432 	if ((ioc->bus_type == SAS) || (ioc->bus_type == FC))
2433 		karg.bus_phys_width = HP_BUS_WIDTH_UNK;
2434 	else
2435 		karg.bus_phys_width = HP_BUS_WIDTH_16;
2436 
2437 	karg.hard_resets = 0;
2438 	karg.soft_resets = 0;
2439 	karg.timeouts = 0;
2440 	if (ioc->sh != NULL) {
2441 		MPT_SCSI_HOST *hd =  shost_priv(ioc->sh);
2442 
2443 		if (hd && (cim_rev == 1)) {
2444 			karg.hard_resets = ioc->hard_resets;
2445 			karg.soft_resets = ioc->soft_resets;
2446 			karg.timeouts = ioc->timeouts;
2447 		}
2448 	}
2449 
2450 	/*
2451 	 * Gather ISTWI(Industry Standard Two Wire Interface) Data
2452 	 */
2453 	if ((mf = mpt_get_msg_frame(mptctl_id, ioc)) == NULL) {
2454 		dfailprintk(ioc, printk(MYIOC_s_WARN_FMT
2455 			"%s, no msg frames!!\n", ioc->name, __func__));
2456 		goto out;
2457 	}
2458 
2459 	IstwiRWRequest = (ToolboxIstwiReadWriteRequest_t *)mf;
2460 	msgcontext = IstwiRWRequest->MsgContext;
2461 	memset(IstwiRWRequest,0,sizeof(ToolboxIstwiReadWriteRequest_t));
2462 	IstwiRWRequest->MsgContext = msgcontext;
2463 	IstwiRWRequest->Function = MPI_FUNCTION_TOOLBOX;
2464 	IstwiRWRequest->Tool = MPI_TOOLBOX_ISTWI_READ_WRITE_TOOL;
2465 	IstwiRWRequest->Flags = MPI_TB_ISTWI_FLAGS_READ;
2466 	IstwiRWRequest->NumAddressBytes = 0x01;
2467 	IstwiRWRequest->DataLength = cpu_to_le16(0x04);
2468 	if (pdev->devfn & 1)
2469 		IstwiRWRequest->DeviceAddr = 0xB2;
2470 	else
2471 		IstwiRWRequest->DeviceAddr = 0xB0;
2472 
2473 	pbuf = pci_alloc_consistent(ioc->pcidev, 4, &buf_dma);
2474 	if (!pbuf)
2475 		goto out;
2476 	ioc->add_sge((char *)&IstwiRWRequest->SGL,
2477 	    (MPT_SGE_FLAGS_SSIMPLE_READ|4), buf_dma);
2478 
2479 	retval = 0;
2480 	SET_MGMT_MSG_CONTEXT(ioc->ioctl_cmds.msg_context,
2481 				IstwiRWRequest->MsgContext);
2482 	INITIALIZE_MGMT_STATUS(ioc->ioctl_cmds.status)
2483 	mpt_put_msg_frame(mptctl_id, ioc, mf);
2484 
2485 retry_wait:
2486 	timeleft = wait_for_completion_timeout(&ioc->ioctl_cmds.done,
2487 			HZ*MPT_IOCTL_DEFAULT_TIMEOUT);
2488 	if (!(ioc->ioctl_cmds.status & MPT_MGMT_STATUS_COMMAND_GOOD)) {
2489 		retval = -ETIME;
2490 		printk(MYIOC_s_WARN_FMT "%s: failed\n", ioc->name, __func__);
2491 		if (ioc->ioctl_cmds.status & MPT_MGMT_STATUS_DID_IOCRESET) {
2492 			mpt_free_msg_frame(ioc, mf);
2493 			goto out;
2494 		}
2495 		if (!timeleft) {
2496 			printk(MYIOC_s_WARN_FMT
2497 			       "HOST INFO command timeout, doorbell=0x%08x\n",
2498 			       ioc->name, mpt_GetIocState(ioc, 0));
2499 			mptctl_timeout_expired(ioc, mf);
2500 		} else
2501 			goto retry_wait;
2502 		goto out;
2503 	}
2504 
2505 	/*
2506 	 *ISTWI Data Definition
2507 	 * pbuf[0] = FW_VERSION = 0x4
2508 	 * pbuf[1] = Bay Count = 6 or 4 or 2, depending on
2509 	 *  the config, you should be seeing one out of these three values
2510 	 * pbuf[2] = Drive Installed Map = bit pattern depend on which
2511 	 *   bays have drives in them
2512 	 * pbuf[3] = Checksum (0x100 = (byte0 + byte2 + byte3)
2513 	 */
2514 	if (ioc->ioctl_cmds.status & MPT_MGMT_STATUS_RF_VALID)
2515 		karg.rsvd = *(u32 *)pbuf;
2516 
2517  out:
2518 	CLEAR_MGMT_STATUS(ioc->ioctl_cmds.status)
2519 	SET_MGMT_MSG_CONTEXT(ioc->ioctl_cmds.msg_context, 0);
2520 
2521 	if (pbuf)
2522 		pci_free_consistent(ioc->pcidev, 4, pbuf, buf_dma);
2523 
2524 	/* Copy the data from kernel memory to user memory
2525 	 */
2526 	if (copy_to_user((char __user *)arg, &karg, sizeof(hp_host_info_t))) {
2527 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_hpgethostinfo - "
2528 			"Unable to write out hp_host_info @ %p\n",
2529 			ioc->name, __FILE__, __LINE__, uarg);
2530 		return -EFAULT;
2531 	}
2532 
2533 	return 0;
2534 
2535 }
2536 
2537 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2538 /* Prototype Routine for the TARGET INFO command.
2539  *
2540  * Outputs:	None.
2541  * Return:	0 if successful
2542  *		-EFAULT if data unavailable
2543  *		-EBUSY  if previous command timeout and IOC reset is not complete.
2544  *		-ENODEV if no such device/adapter
2545  *		-ETIME	if timer expires
2546  *		-ENOMEM if memory allocation error
2547  */
2548 static int
2549 mptctl_hp_targetinfo(MPT_ADAPTER *ioc, unsigned long arg)
2550 {
2551 	hp_target_info_t __user *uarg = (void __user *) arg;
2552 	SCSIDevicePage0_t	*pg0_alloc;
2553 	SCSIDevicePage3_t	*pg3_alloc;
2554 	MPT_SCSI_HOST 		*hd = NULL;
2555 	hp_target_info_t	karg;
2556 	int			data_sz;
2557 	dma_addr_t		page_dma;
2558 	CONFIGPARMS	 	cfg;
2559 	ConfigPageHeader_t	hdr;
2560 	int			tmp, np, rc = 0;
2561 
2562 	if (copy_from_user(&karg, uarg, sizeof(hp_target_info_t))) {
2563 		printk(KERN_ERR MYNAM "%s@%d::mptctl_hp_targetinfo - "
2564 			"Unable to read in hp_host_targetinfo struct @ %p\n",
2565 				__FILE__, __LINE__, uarg);
2566 		return -EFAULT;
2567 	}
2568 
2569 	if (karg.hdr.id >= MPT_MAX_FC_DEVICES)
2570 		return -EINVAL;
2571 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_hp_targetinfo called.\n",
2572 	    ioc->name));
2573 
2574 	/*  There is nothing to do for FCP parts.
2575 	 */
2576 	if ((ioc->bus_type == SAS) || (ioc->bus_type == FC))
2577 		return 0;
2578 
2579 	if ((ioc->spi_data.sdp0length == 0) || (ioc->sh == NULL))
2580 		return 0;
2581 
2582 	if (ioc->sh->host_no != karg.hdr.host)
2583 		return -ENODEV;
2584 
2585        /* Get the data transfer speeds
2586         */
2587 	data_sz = ioc->spi_data.sdp0length * 4;
2588 	pg0_alloc = pci_alloc_consistent(ioc->pcidev, data_sz, &page_dma);
2589 	if (pg0_alloc) {
2590 		hdr.PageVersion = ioc->spi_data.sdp0version;
2591 		hdr.PageLength = data_sz;
2592 		hdr.PageNumber = 0;
2593 		hdr.PageType = MPI_CONFIG_PAGETYPE_SCSI_DEVICE;
2594 
2595 		cfg.cfghdr.hdr = &hdr;
2596 		cfg.action = MPI_CONFIG_ACTION_PAGE_READ_CURRENT;
2597 		cfg.dir = 0;
2598 		cfg.timeout = 0;
2599 		cfg.physAddr = page_dma;
2600 
2601 		cfg.pageAddr = (karg.hdr.channel << 8) | karg.hdr.id;
2602 
2603 		if ((rc = mpt_config(ioc, &cfg)) == 0) {
2604 			np = le32_to_cpu(pg0_alloc->NegotiatedParameters);
2605 			karg.negotiated_width = np & MPI_SCSIDEVPAGE0_NP_WIDE ?
2606 					HP_BUS_WIDTH_16 : HP_BUS_WIDTH_8;
2607 
2608 			if (np & MPI_SCSIDEVPAGE0_NP_NEG_SYNC_OFFSET_MASK) {
2609 				tmp = (np & MPI_SCSIDEVPAGE0_NP_NEG_SYNC_PERIOD_MASK) >> 8;
2610 				if (tmp < 0x09)
2611 					karg.negotiated_speed = HP_DEV_SPEED_ULTRA320;
2612 				else if (tmp <= 0x09)
2613 					karg.negotiated_speed = HP_DEV_SPEED_ULTRA160;
2614 				else if (tmp <= 0x0A)
2615 					karg.negotiated_speed = HP_DEV_SPEED_ULTRA2;
2616 				else if (tmp <= 0x0C)
2617 					karg.negotiated_speed = HP_DEV_SPEED_ULTRA;
2618 				else if (tmp <= 0x25)
2619 					karg.negotiated_speed = HP_DEV_SPEED_FAST;
2620 				else
2621 					karg.negotiated_speed = HP_DEV_SPEED_ASYNC;
2622 			} else
2623 				karg.negotiated_speed = HP_DEV_SPEED_ASYNC;
2624 		}
2625 
2626 		pci_free_consistent(ioc->pcidev, data_sz, (u8 *) pg0_alloc, page_dma);
2627 	}
2628 
2629 	/* Set defaults
2630 	 */
2631 	karg.message_rejects = -1;
2632 	karg.phase_errors = -1;
2633 	karg.parity_errors = -1;
2634 	karg.select_timeouts = -1;
2635 
2636 	/* Get the target error parameters
2637 	 */
2638 	hdr.PageVersion = 0;
2639 	hdr.PageLength = 0;
2640 	hdr.PageNumber = 3;
2641 	hdr.PageType = MPI_CONFIG_PAGETYPE_SCSI_DEVICE;
2642 
2643 	cfg.cfghdr.hdr = &hdr;
2644 	cfg.action = MPI_CONFIG_ACTION_PAGE_HEADER;
2645 	cfg.dir = 0;
2646 	cfg.timeout = 0;
2647 	cfg.physAddr = -1;
2648 	if ((mpt_config(ioc, &cfg) == 0) && (cfg.cfghdr.hdr->PageLength > 0)) {
2649 		/* Issue the second config page request */
2650 		cfg.action = MPI_CONFIG_ACTION_PAGE_READ_CURRENT;
2651 		data_sz = (int) cfg.cfghdr.hdr->PageLength * 4;
2652 		pg3_alloc = pci_alloc_consistent(ioc->pcidev, data_sz, &page_dma);
2653 		if (pg3_alloc) {
2654 			cfg.physAddr = page_dma;
2655 			cfg.pageAddr = (karg.hdr.channel << 8) | karg.hdr.id;
2656 			if ((rc = mpt_config(ioc, &cfg)) == 0) {
2657 				karg.message_rejects = (u32) le16_to_cpu(pg3_alloc->MsgRejectCount);
2658 				karg.phase_errors = (u32) le16_to_cpu(pg3_alloc->PhaseErrorCount);
2659 				karg.parity_errors = (u32) le16_to_cpu(pg3_alloc->ParityErrorCount);
2660 			}
2661 			pci_free_consistent(ioc->pcidev, data_sz, (u8 *) pg3_alloc, page_dma);
2662 		}
2663 	}
2664 	hd = shost_priv(ioc->sh);
2665 	if (hd != NULL)
2666 		karg.select_timeouts = hd->sel_timeout[karg.hdr.id];
2667 
2668 	/* Copy the data from kernel memory to user memory
2669 	 */
2670 	if (copy_to_user((char __user *)arg, &karg, sizeof(hp_target_info_t))) {
2671 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_hp_target_info - "
2672 			"Unable to write out mpt_ioctl_targetinfo struct @ %p\n",
2673 			ioc->name, __FILE__, __LINE__, uarg);
2674 		return -EFAULT;
2675 	}
2676 
2677 	return 0;
2678 }
2679 
2680 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2681 
2682 static const struct file_operations mptctl_fops = {
2683 	.owner =	THIS_MODULE,
2684 	.llseek =	no_llseek,
2685 	.fasync = 	mptctl_fasync,
2686 	.unlocked_ioctl = mptctl_ioctl,
2687 #ifdef CONFIG_COMPAT
2688 	.compat_ioctl = compat_mpctl_ioctl,
2689 #endif
2690 };
2691 
2692 static struct miscdevice mptctl_miscdev = {
2693 	MPT_MINOR,
2694 	MYNAM,
2695 	&mptctl_fops
2696 };
2697 
2698 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2699 
2700 #ifdef CONFIG_COMPAT
2701 
2702 static int
2703 compat_mptfwxfer_ioctl(struct file *filp, unsigned int cmd,
2704 			unsigned long arg)
2705 {
2706 	struct mpt_fw_xfer32 kfw32;
2707 	struct mpt_fw_xfer kfw;
2708 	MPT_ADAPTER *iocp = NULL;
2709 	int iocnum, iocnumX;
2710 	int nonblock = (filp->f_flags & O_NONBLOCK);
2711 	int ret;
2712 
2713 
2714 	if (copy_from_user(&kfw32, (char __user *)arg, sizeof(kfw32)))
2715 		return -EFAULT;
2716 
2717 	/* Verify intended MPT adapter */
2718 	iocnumX = kfw32.iocnum & 0xFF;
2719 	if (((iocnum = mpt_verify_adapter(iocnumX, &iocp)) < 0) ||
2720 	    (iocp == NULL)) {
2721 		printk(KERN_DEBUG MYNAM "::compat_mptfwxfer_ioctl @%d - ioc%d not found!\n",
2722 			__LINE__, iocnumX);
2723 		return -ENODEV;
2724 	}
2725 
2726 	if ((ret = mptctl_syscall_down(iocp, nonblock)) != 0)
2727 		return ret;
2728 
2729 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "compat_mptfwxfer_ioctl() called\n",
2730 	    iocp->name));
2731 	kfw.iocnum = iocnum;
2732 	kfw.fwlen = kfw32.fwlen;
2733 	kfw.bufp = compat_ptr(kfw32.bufp);
2734 
2735 	ret = mptctl_do_fw_download(iocp, kfw.bufp, kfw.fwlen);
2736 
2737 	mutex_unlock(&iocp->ioctl_cmds.mutex);
2738 
2739 	return ret;
2740 }
2741 
2742 static int
2743 compat_mpt_command(struct file *filp, unsigned int cmd,
2744 			unsigned long arg)
2745 {
2746 	struct mpt_ioctl_command32 karg32;
2747 	struct mpt_ioctl_command32 __user *uarg = (struct mpt_ioctl_command32 __user *) arg;
2748 	struct mpt_ioctl_command karg;
2749 	MPT_ADAPTER *iocp = NULL;
2750 	int iocnum, iocnumX;
2751 	int nonblock = (filp->f_flags & O_NONBLOCK);
2752 	int ret;
2753 
2754 	if (copy_from_user(&karg32, (char __user *)arg, sizeof(karg32)))
2755 		return -EFAULT;
2756 
2757 	/* Verify intended MPT adapter */
2758 	iocnumX = karg32.hdr.iocnum & 0xFF;
2759 	if (((iocnum = mpt_verify_adapter(iocnumX, &iocp)) < 0) ||
2760 	    (iocp == NULL)) {
2761 		printk(KERN_DEBUG MYNAM "::compat_mpt_command @%d - ioc%d not found!\n",
2762 			__LINE__, iocnumX);
2763 		return -ENODEV;
2764 	}
2765 
2766 	if ((ret = mptctl_syscall_down(iocp, nonblock)) != 0)
2767 		return ret;
2768 
2769 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "compat_mpt_command() called\n",
2770 	    iocp->name));
2771 	/* Copy data to karg */
2772 	karg.hdr.iocnum = karg32.hdr.iocnum;
2773 	karg.hdr.port = karg32.hdr.port;
2774 	karg.timeout = karg32.timeout;
2775 	karg.maxReplyBytes = karg32.maxReplyBytes;
2776 
2777 	karg.dataInSize = karg32.dataInSize;
2778 	karg.dataOutSize = karg32.dataOutSize;
2779 	karg.maxSenseBytes = karg32.maxSenseBytes;
2780 	karg.dataSgeOffset = karg32.dataSgeOffset;
2781 
2782 	karg.replyFrameBufPtr = (char __user *)(unsigned long)karg32.replyFrameBufPtr;
2783 	karg.dataInBufPtr = (char __user *)(unsigned long)karg32.dataInBufPtr;
2784 	karg.dataOutBufPtr = (char __user *)(unsigned long)karg32.dataOutBufPtr;
2785 	karg.senseDataPtr = (char __user *)(unsigned long)karg32.senseDataPtr;
2786 
2787 	/* Pass new structure to do_mpt_command
2788 	 */
2789 	ret = mptctl_do_mpt_command (iocp, karg, &uarg->MF);
2790 
2791 	mutex_unlock(&iocp->ioctl_cmds.mutex);
2792 
2793 	return ret;
2794 }
2795 
2796 static long compat_mpctl_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
2797 {
2798 	long ret;
2799 	mutex_lock(&mpctl_mutex);
2800 	switch (cmd) {
2801 	case MPTIOCINFO:
2802 	case MPTIOCINFO1:
2803 	case MPTIOCINFO2:
2804 	case MPTTARGETINFO:
2805 	case MPTEVENTQUERY:
2806 	case MPTEVENTENABLE:
2807 	case MPTEVENTREPORT:
2808 	case MPTHARDRESET:
2809 	case HP_GETHOSTINFO:
2810 	case HP_GETTARGETINFO:
2811 	case MPTTEST:
2812 		ret = __mptctl_ioctl(f, cmd, arg);
2813 		break;
2814 	case MPTCOMMAND32:
2815 		ret = compat_mpt_command(f, cmd, arg);
2816 		break;
2817 	case MPTFWDOWNLOAD32:
2818 		ret = compat_mptfwxfer_ioctl(f, cmd, arg);
2819 		break;
2820 	default:
2821 		ret = -ENOIOCTLCMD;
2822 		break;
2823 	}
2824 	mutex_unlock(&mpctl_mutex);
2825 	return ret;
2826 }
2827 
2828 #endif
2829 
2830 
2831 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2832 /*
2833  *	mptctl_probe - Installs ioctl devices per bus.
2834  *	@pdev: Pointer to pci_dev structure
2835  *
2836  *	Returns 0 for success, non-zero for failure.
2837  *
2838  */
2839 
2840 static int
2841 mptctl_probe(struct pci_dev *pdev)
2842 {
2843 	MPT_ADAPTER *ioc = pci_get_drvdata(pdev);
2844 
2845 	mutex_init(&ioc->ioctl_cmds.mutex);
2846 	init_completion(&ioc->ioctl_cmds.done);
2847 	return 0;
2848 }
2849 
2850 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2851 /*
2852  *	mptctl_remove - Removed ioctl devices
2853  *	@pdev: Pointer to pci_dev structure
2854  *
2855  *
2856  */
2857 static void
2858 mptctl_remove(struct pci_dev *pdev)
2859 {
2860 }
2861 
2862 static struct mpt_pci_driver mptctl_driver = {
2863   .probe		= mptctl_probe,
2864   .remove		= mptctl_remove,
2865 };
2866 
2867 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2868 static int __init mptctl_init(void)
2869 {
2870 	int err;
2871 	int where = 1;
2872 
2873 	show_mptmod_ver(my_NAME, my_VERSION);
2874 
2875 	mpt_device_driver_register(&mptctl_driver, MPTCTL_DRIVER);
2876 
2877 	/* Register this device */
2878 	err = misc_register(&mptctl_miscdev);
2879 	if (err < 0) {
2880 		printk(KERN_ERR MYNAM ": Can't register misc device [minor=%d].\n", MPT_MINOR);
2881 		goto out_fail;
2882 	}
2883 	printk(KERN_INFO MYNAM ": Registered with Fusion MPT base driver\n");
2884 	printk(KERN_INFO MYNAM ": /dev/%s @ (major,minor=%d,%d)\n",
2885 			 mptctl_miscdev.name, MISC_MAJOR, mptctl_miscdev.minor);
2886 
2887 	/*
2888 	 *  Install our handler
2889 	 */
2890 	++where;
2891 	mptctl_id = mpt_register(mptctl_reply, MPTCTL_DRIVER,
2892 	    "mptctl_reply");
2893 	if (!mptctl_id || mptctl_id >= MPT_MAX_PROTOCOL_DRIVERS) {
2894 		printk(KERN_ERR MYNAM ": ERROR: Failed to register with Fusion MPT base driver\n");
2895 		misc_deregister(&mptctl_miscdev);
2896 		err = -EBUSY;
2897 		goto out_fail;
2898 	}
2899 
2900 	mptctl_taskmgmt_id = mpt_register(mptctl_taskmgmt_reply, MPTCTL_DRIVER,
2901 	    "mptctl_taskmgmt_reply");
2902 	if (!mptctl_taskmgmt_id || mptctl_taskmgmt_id >= MPT_MAX_PROTOCOL_DRIVERS) {
2903 		printk(KERN_ERR MYNAM ": ERROR: Failed to register with Fusion MPT base driver\n");
2904 		mpt_deregister(mptctl_id);
2905 		misc_deregister(&mptctl_miscdev);
2906 		err = -EBUSY;
2907 		goto out_fail;
2908 	}
2909 
2910 	mpt_reset_register(mptctl_id, mptctl_ioc_reset);
2911 	mpt_event_register(mptctl_id, mptctl_event_process);
2912 
2913 	return 0;
2914 
2915 out_fail:
2916 
2917 	mpt_device_driver_deregister(MPTCTL_DRIVER);
2918 
2919 	return err;
2920 }
2921 
2922 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2923 static void mptctl_exit(void)
2924 {
2925 	misc_deregister(&mptctl_miscdev);
2926 	printk(KERN_INFO MYNAM ": Deregistered /dev/%s @ (major,minor=%d,%d)\n",
2927 			 mptctl_miscdev.name, MISC_MAJOR, mptctl_miscdev.minor);
2928 
2929 	/* De-register event handler from base module */
2930 	mpt_event_deregister(mptctl_id);
2931 
2932 	/* De-register reset handler from base module */
2933 	mpt_reset_deregister(mptctl_id);
2934 
2935 	/* De-register callback handler from base module */
2936 	mpt_deregister(mptctl_taskmgmt_id);
2937 	mpt_deregister(mptctl_id);
2938 
2939         mpt_device_driver_deregister(MPTCTL_DRIVER);
2940 
2941 }
2942 
2943 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2944 
2945 module_init(mptctl_init);
2946 module_exit(mptctl_exit);
2947