xref: /openbmc/linux/drivers/message/fusion/mptctl.c (revision b114dda6)
1 /*
2  *  linux/drivers/message/fusion/mptctl.c
3  *      mpt Ioctl driver.
4  *      For use with LSI PCI chip/adapters
5  *      running LSI Fusion MPT (Message Passing Technology) firmware.
6  *
7  *  Copyright (c) 1999-2008 LSI Corporation
8  *  (mailto:DL-MPTFusionLinux@lsi.com)
9  *
10  */
11 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
12 /*
13     This program is free software; you can redistribute it and/or modify
14     it under the terms of the GNU General Public License as published by
15     the Free Software Foundation; version 2 of the License.
16 
17     This program is distributed in the hope that it will be useful,
18     but WITHOUT ANY WARRANTY; without even the implied warranty of
19     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
20     GNU General Public License for more details.
21 
22     NO WARRANTY
23     THE PROGRAM IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR
24     CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED INCLUDING, WITHOUT
25     LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT,
26     MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each Recipient is
27     solely responsible for determining the appropriateness of using and
28     distributing the Program and assumes all risks associated with its
29     exercise of rights under this Agreement, including but not limited to
30     the risks and costs of program errors, damage to or loss of data,
31     programs or equipment, and unavailability or interruption of operations.
32 
33     DISCLAIMER OF LIABILITY
34     NEITHER RECIPIENT NOR ANY CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY
35     DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
36     DAMAGES (INCLUDING WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND
37     ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
38     TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
39     USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS GRANTED
40     HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES
41 
42     You should have received a copy of the GNU General Public License
43     along with this program; if not, write to the Free Software
44     Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
45 */
46 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
47 
48 #include <linux/kernel.h>
49 #include <linux/module.h>
50 #include <linux/errno.h>
51 #include <linux/init.h>
52 #include <linux/slab.h>
53 #include <linux/types.h>
54 #include <linux/pci.h>
55 #include <linux/delay.h>	/* for mdelay */
56 #include <linux/miscdevice.h>
57 #include <linux/mutex.h>
58 #include <linux/compat.h>
59 
60 #include <asm/io.h>
61 #include <linux/uaccess.h>
62 
63 #include <scsi/scsi.h>
64 #include <scsi/scsi_cmnd.h>
65 #include <scsi/scsi_device.h>
66 #include <scsi/scsi_host.h>
67 #include <scsi/scsi_tcq.h>
68 
69 #define COPYRIGHT	"Copyright (c) 1999-2008 LSI Corporation"
70 #define MODULEAUTHOR	"LSI Corporation"
71 #include "mptbase.h"
72 #include "mptctl.h"
73 
74 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
75 #define my_NAME		"Fusion MPT misc device (ioctl) driver"
76 #define my_VERSION	MPT_LINUX_VERSION_COMMON
77 #define MYNAM		"mptctl"
78 
79 MODULE_AUTHOR(MODULEAUTHOR);
80 MODULE_DESCRIPTION(my_NAME);
81 MODULE_LICENSE("GPL");
82 MODULE_VERSION(my_VERSION);
83 
84 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
85 
86 static DEFINE_MUTEX(mpctl_mutex);
87 static u8 mptctl_id = MPT_MAX_PROTOCOL_DRIVERS;
88 static u8 mptctl_taskmgmt_id = MPT_MAX_PROTOCOL_DRIVERS;
89 
90 static DECLARE_WAIT_QUEUE_HEAD ( mptctl_wait );
91 
92 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
93 
94 struct buflist {
95 	u8	*kptr;
96 	int	 len;
97 };
98 
99 /*
100  * Function prototypes. Called from OS entry point mptctl_ioctl.
101  * arg contents specific to function.
102  */
103 static int mptctl_fw_download(MPT_ADAPTER *iocp, unsigned long arg);
104 static int mptctl_getiocinfo(MPT_ADAPTER *iocp, unsigned long arg, unsigned int cmd);
105 static int mptctl_gettargetinfo(MPT_ADAPTER *iocp, unsigned long arg);
106 static int mptctl_readtest(MPT_ADAPTER *iocp, unsigned long arg);
107 static int mptctl_mpt_command(MPT_ADAPTER *iocp, unsigned long arg);
108 static int mptctl_eventquery(MPT_ADAPTER *iocp, unsigned long arg);
109 static int mptctl_eventenable(MPT_ADAPTER *iocp, unsigned long arg);
110 static int mptctl_eventreport(MPT_ADAPTER *iocp, unsigned long arg);
111 static int mptctl_replace_fw(MPT_ADAPTER *iocp, unsigned long arg);
112 
113 static int mptctl_do_reset(MPT_ADAPTER *iocp, unsigned long arg);
114 static int mptctl_hp_hostinfo(MPT_ADAPTER *iocp, unsigned long arg, unsigned int cmd);
115 static int mptctl_hp_targetinfo(MPT_ADAPTER *iocp, unsigned long arg);
116 
117 static int  mptctl_probe(struct pci_dev *);
118 static void mptctl_remove(struct pci_dev *);
119 
120 #ifdef CONFIG_COMPAT
121 static long compat_mpctl_ioctl(struct file *f, unsigned cmd, unsigned long arg);
122 #endif
123 /*
124  * Private function calls.
125  */
126 static int mptctl_do_mpt_command(MPT_ADAPTER *iocp, struct mpt_ioctl_command karg, void __user *mfPtr);
127 static int mptctl_do_fw_download(MPT_ADAPTER *iocp, char __user *ufwbuf, size_t fwlen);
128 static MptSge_t *kbuf_alloc_2_sgl(int bytes, u32 dir, int sge_offset, int *frags,
129 		struct buflist **blp, dma_addr_t *sglbuf_dma, MPT_ADAPTER *ioc);
130 static void kfree_sgl(MptSge_t *sgl, dma_addr_t sgl_dma,
131 		struct buflist *buflist, MPT_ADAPTER *ioc);
132 
133 /*
134  * Reset Handler cleanup function
135  */
136 static int  mptctl_ioc_reset(MPT_ADAPTER *ioc, int reset_phase);
137 
138 /*
139  * Event Handler function
140  */
141 static int mptctl_event_process(MPT_ADAPTER *ioc, EventNotificationReply_t *pEvReply);
142 static struct fasync_struct *async_queue=NULL;
143 
144 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
145 /*
146  * Scatter gather list (SGL) sizes and limits...
147  */
148 //#define MAX_SCSI_FRAGS	9
149 #define MAX_FRAGS_SPILL1	9
150 #define MAX_FRAGS_SPILL2	15
151 #define FRAGS_PER_BUCKET	(MAX_FRAGS_SPILL2 + 1)
152 
153 //#define MAX_CHAIN_FRAGS	64
154 //#define MAX_CHAIN_FRAGS	(15+15+15+16)
155 #define MAX_CHAIN_FRAGS		(4 * MAX_FRAGS_SPILL2 + 1)
156 
157 //  Define max sg LIST bytes ( == (#frags + #chains) * 8 bytes each)
158 //  Works out to: 592d bytes!     (9+1)*8 + 4*(15+1)*8
159 //                  ^----------------- 80 + 512
160 #define MAX_SGL_BYTES		((MAX_FRAGS_SPILL1 + 1 + (4 * FRAGS_PER_BUCKET)) * 8)
161 
162 /* linux only seems to ever give 128kB MAX contiguous (GFP_USER) mem bytes */
163 #define MAX_KMALLOC_SZ		(128*1024)
164 
165 #define MPT_IOCTL_DEFAULT_TIMEOUT 10	/* Default timeout value (seconds) */
166 
167 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
168 /**
169  *	mptctl_syscall_down - Down the MPT adapter syscall semaphore.
170  *	@ioc: Pointer to MPT adapter
171  *	@nonblock: boolean, non-zero if O_NONBLOCK is set
172  *
173  *	All of the ioctl commands can potentially sleep, which is illegal
174  *	with a spinlock held, thus we perform mutual exclusion here.
175  *
176  *	Returns negative errno on error, or zero for success.
177  */
178 static inline int
179 mptctl_syscall_down(MPT_ADAPTER *ioc, int nonblock)
180 {
181 	int rc = 0;
182 
183 	if (nonblock) {
184 		if (!mutex_trylock(&ioc->ioctl_cmds.mutex))
185 			rc = -EAGAIN;
186 	} else {
187 		if (mutex_lock_interruptible(&ioc->ioctl_cmds.mutex))
188 			rc = -ERESTARTSYS;
189 	}
190 	return rc;
191 }
192 
193 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
194 /*
195  *  This is the callback for any message we have posted. The message itself
196  *  will be returned to the message pool when we return from the IRQ
197  *
198  *  This runs in irq context so be short and sweet.
199  */
200 static int
201 mptctl_reply(MPT_ADAPTER *ioc, MPT_FRAME_HDR *req, MPT_FRAME_HDR *reply)
202 {
203 	char	*sense_data;
204 	int	req_index;
205 	int	sz;
206 
207 	if (!req)
208 		return 0;
209 
210 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "completing mpi function "
211 	    "(0x%02X), req=%p, reply=%p\n", ioc->name,  req->u.hdr.Function,
212 	    req, reply));
213 
214 	/*
215 	 * Handling continuation of the same reply. Processing the first
216 	 * reply, and eating the other replys that come later.
217 	 */
218 	if (ioc->ioctl_cmds.msg_context != req->u.hdr.MsgContext)
219 		goto out_continuation;
220 
221 	ioc->ioctl_cmds.status |= MPT_MGMT_STATUS_COMMAND_GOOD;
222 
223 	if (!reply)
224 		goto out;
225 
226 	ioc->ioctl_cmds.status |= MPT_MGMT_STATUS_RF_VALID;
227 	sz = min(ioc->reply_sz, 4*reply->u.reply.MsgLength);
228 	memcpy(ioc->ioctl_cmds.reply, reply, sz);
229 
230 	if (reply->u.reply.IOCStatus || reply->u.reply.IOCLogInfo)
231 		dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT
232 		    "iocstatus (0x%04X), loginfo (0x%08X)\n", ioc->name,
233 		    le16_to_cpu(reply->u.reply.IOCStatus),
234 		    le32_to_cpu(reply->u.reply.IOCLogInfo)));
235 
236 	if ((req->u.hdr.Function == MPI_FUNCTION_SCSI_IO_REQUEST) ||
237 		(req->u.hdr.Function ==
238 		 MPI_FUNCTION_RAID_SCSI_IO_PASSTHROUGH)) {
239 
240 		if (reply->u.sreply.SCSIStatus || reply->u.sreply.SCSIState)
241 			dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT
242 			"scsi_status (0x%02x), scsi_state (0x%02x), "
243 			"tag = (0x%04x), transfer_count (0x%08x)\n", ioc->name,
244 			reply->u.sreply.SCSIStatus,
245 			reply->u.sreply.SCSIState,
246 			le16_to_cpu(reply->u.sreply.TaskTag),
247 			le32_to_cpu(reply->u.sreply.TransferCount)));
248 
249 		if (reply->u.sreply.SCSIState &
250 			MPI_SCSI_STATE_AUTOSENSE_VALID) {
251 			sz = req->u.scsireq.SenseBufferLength;
252 			req_index =
253 			    le16_to_cpu(req->u.frame.hwhdr.msgctxu.fld.req_idx);
254 			sense_data = ((u8 *)ioc->sense_buf_pool +
255 			     (req_index * MPT_SENSE_BUFFER_ALLOC));
256 			memcpy(ioc->ioctl_cmds.sense, sense_data, sz);
257 			ioc->ioctl_cmds.status |= MPT_MGMT_STATUS_SENSE_VALID;
258 		}
259 	}
260 
261  out:
262 	/* We are done, issue wake up
263 	 */
264 	if (ioc->ioctl_cmds.status & MPT_MGMT_STATUS_PENDING) {
265 		if (req->u.hdr.Function == MPI_FUNCTION_SCSI_TASK_MGMT) {
266 			mpt_clear_taskmgmt_in_progress_flag(ioc);
267 			ioc->ioctl_cmds.status &= ~MPT_MGMT_STATUS_PENDING;
268 			complete(&ioc->ioctl_cmds.done);
269 			if (ioc->bus_type == SAS)
270 				ioc->schedule_target_reset(ioc);
271 		} else {
272 			ioc->ioctl_cmds.status &= ~MPT_MGMT_STATUS_PENDING;
273 			complete(&ioc->ioctl_cmds.done);
274 		}
275 	}
276 
277  out_continuation:
278 	if (reply && (reply->u.reply.MsgFlags &
279 	    MPI_MSGFLAGS_CONTINUATION_REPLY))
280 		return 0;
281 	return 1;
282 }
283 
284 
285 static int
286 mptctl_taskmgmt_reply(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
287 {
288 	if (!mf)
289 		return 0;
290 
291 	dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
292 		"TaskMgmt completed (mf=%p, mr=%p)\n",
293 		ioc->name, mf, mr));
294 
295 	ioc->taskmgmt_cmds.status |= MPT_MGMT_STATUS_COMMAND_GOOD;
296 
297 	if (!mr)
298 		goto out;
299 
300 	ioc->taskmgmt_cmds.status |= MPT_MGMT_STATUS_RF_VALID;
301 	memcpy(ioc->taskmgmt_cmds.reply, mr,
302 	    min(MPT_DEFAULT_FRAME_SIZE, 4 * mr->u.reply.MsgLength));
303  out:
304 	if (ioc->taskmgmt_cmds.status & MPT_MGMT_STATUS_PENDING) {
305 		mpt_clear_taskmgmt_in_progress_flag(ioc);
306 		ioc->taskmgmt_cmds.status &= ~MPT_MGMT_STATUS_PENDING;
307 		complete(&ioc->taskmgmt_cmds.done);
308 		if (ioc->bus_type == SAS)
309 			ioc->schedule_target_reset(ioc);
310 		return 1;
311 	}
312 	return 0;
313 }
314 
315 static int
316 mptctl_do_taskmgmt(MPT_ADAPTER *ioc, u8 tm_type, u8 bus_id, u8 target_id)
317 {
318 	MPT_FRAME_HDR	*mf;
319 	SCSITaskMgmt_t	*pScsiTm;
320 	SCSITaskMgmtReply_t *pScsiTmReply;
321 	int		 ii;
322 	int		 retval;
323 	unsigned long	 timeout;
324 	u16		 iocstatus;
325 
326 
327 	mutex_lock(&ioc->taskmgmt_cmds.mutex);
328 	if (mpt_set_taskmgmt_in_progress_flag(ioc) != 0) {
329 		mutex_unlock(&ioc->taskmgmt_cmds.mutex);
330 		return -EPERM;
331 	}
332 
333 	retval = 0;
334 
335 	mf = mpt_get_msg_frame(mptctl_taskmgmt_id, ioc);
336 	if (mf == NULL) {
337 		dtmprintk(ioc,
338 			printk(MYIOC_s_WARN_FMT "TaskMgmt, no msg frames!!\n",
339 			ioc->name));
340 		mpt_clear_taskmgmt_in_progress_flag(ioc);
341 		retval = -ENOMEM;
342 		goto tm_done;
343 	}
344 
345 	dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT "TaskMgmt request (mf=%p)\n",
346 		ioc->name, mf));
347 
348 	pScsiTm = (SCSITaskMgmt_t *) mf;
349 	memset(pScsiTm, 0, sizeof(SCSITaskMgmt_t));
350 	pScsiTm->Function = MPI_FUNCTION_SCSI_TASK_MGMT;
351 	pScsiTm->TaskType = tm_type;
352 	if ((tm_type == MPI_SCSITASKMGMT_TASKTYPE_RESET_BUS) &&
353 		(ioc->bus_type == FC))
354 		pScsiTm->MsgFlags =
355 				MPI_SCSITASKMGMT_MSGFLAGS_LIPRESET_RESET_OPTION;
356 	pScsiTm->TargetID = target_id;
357 	pScsiTm->Bus = bus_id;
358 	pScsiTm->ChainOffset = 0;
359 	pScsiTm->Reserved = 0;
360 	pScsiTm->Reserved1 = 0;
361 	pScsiTm->TaskMsgContext = 0;
362 	for (ii= 0; ii < 8; ii++)
363 		pScsiTm->LUN[ii] = 0;
364 	for (ii=0; ii < 7; ii++)
365 		pScsiTm->Reserved2[ii] = 0;
366 
367 	switch (ioc->bus_type) {
368 	case FC:
369 		timeout = 40;
370 		break;
371 	case SAS:
372 		timeout = 30;
373 		break;
374 	case SPI:
375 		default:
376 		timeout = 10;
377 		break;
378 	}
379 
380 	dtmprintk(ioc,
381 		printk(MYIOC_s_DEBUG_FMT "TaskMgmt type=%d timeout=%ld\n",
382 		ioc->name, tm_type, timeout));
383 
384 	INITIALIZE_MGMT_STATUS(ioc->taskmgmt_cmds.status)
385 	if ((ioc->facts.IOCCapabilities & MPI_IOCFACTS_CAPABILITY_HIGH_PRI_Q) &&
386 	    (ioc->facts.MsgVersion >= MPI_VERSION_01_05))
387 		mpt_put_msg_frame_hi_pri(mptctl_taskmgmt_id, ioc, mf);
388 	else {
389 		retval = mpt_send_handshake_request(mptctl_taskmgmt_id, ioc,
390 		    sizeof(SCSITaskMgmt_t), (u32 *)pScsiTm, CAN_SLEEP);
391 		if (retval != 0) {
392 			dfailprintk(ioc,
393 				printk(MYIOC_s_ERR_FMT
394 				"TaskMgmt send_handshake FAILED!"
395 				" (ioc %p, mf %p, rc=%d) \n", ioc->name,
396 				ioc, mf, retval));
397 			mpt_free_msg_frame(ioc, mf);
398 			mpt_clear_taskmgmt_in_progress_flag(ioc);
399 			goto tm_done;
400 		}
401 	}
402 
403 	/* Now wait for the command to complete */
404 	ii = wait_for_completion_timeout(&ioc->taskmgmt_cmds.done, timeout*HZ);
405 
406 	if (!(ioc->taskmgmt_cmds.status & MPT_MGMT_STATUS_COMMAND_GOOD)) {
407 		dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
408 		    "TaskMgmt failed\n", ioc->name));
409 		mpt_free_msg_frame(ioc, mf);
410 		mpt_clear_taskmgmt_in_progress_flag(ioc);
411 		if (ioc->taskmgmt_cmds.status & MPT_MGMT_STATUS_DID_IOCRESET)
412 			retval = 0;
413 		else
414 			retval = -1; /* return failure */
415 		goto tm_done;
416 	}
417 
418 	if (!(ioc->taskmgmt_cmds.status & MPT_MGMT_STATUS_RF_VALID)) {
419 		dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
420 		    "TaskMgmt failed\n", ioc->name));
421 		retval = -1; /* return failure */
422 		goto tm_done;
423 	}
424 
425 	pScsiTmReply = (SCSITaskMgmtReply_t *) ioc->taskmgmt_cmds.reply;
426 	dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
427 	    "TaskMgmt fw_channel = %d, fw_id = %d, task_type=0x%02X, "
428 	    "iocstatus=0x%04X\n\tloginfo=0x%08X, response_code=0x%02X, "
429 	    "term_cmnds=%d\n", ioc->name, pScsiTmReply->Bus,
430 	    pScsiTmReply->TargetID, tm_type,
431 	    le16_to_cpu(pScsiTmReply->IOCStatus),
432 	    le32_to_cpu(pScsiTmReply->IOCLogInfo),
433 	    pScsiTmReply->ResponseCode,
434 	    le32_to_cpu(pScsiTmReply->TerminationCount)));
435 
436 	iocstatus = le16_to_cpu(pScsiTmReply->IOCStatus) & MPI_IOCSTATUS_MASK;
437 
438 	if (iocstatus == MPI_IOCSTATUS_SCSI_TASK_TERMINATED ||
439 	   iocstatus == MPI_IOCSTATUS_SCSI_IOC_TERMINATED ||
440 	   iocstatus == MPI_IOCSTATUS_SUCCESS)
441 		retval = 0;
442 	else {
443 		dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
444 		    "TaskMgmt failed\n", ioc->name));
445 		retval = -1; /* return failure */
446 	}
447 
448  tm_done:
449 	mutex_unlock(&ioc->taskmgmt_cmds.mutex);
450 	CLEAR_MGMT_STATUS(ioc->taskmgmt_cmds.status)
451 	return retval;
452 }
453 
454 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
455 /* mptctl_timeout_expired
456  *
457  * Expecting an interrupt, however timed out.
458  *
459  */
460 static void
461 mptctl_timeout_expired(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf)
462 {
463 	unsigned long flags;
464 	int ret_val = -1;
465 	SCSIIORequest_t *scsi_req = (SCSIIORequest_t *) mf;
466 	u8 function = mf->u.hdr.Function;
467 
468 	dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT ": %s\n",
469 		ioc->name, __func__));
470 
471 	if (mpt_fwfault_debug)
472 		mpt_halt_firmware(ioc);
473 
474 	spin_lock_irqsave(&ioc->taskmgmt_lock, flags);
475 	if (ioc->ioc_reset_in_progress) {
476 		spin_unlock_irqrestore(&ioc->taskmgmt_lock, flags);
477 		CLEAR_MGMT_PENDING_STATUS(ioc->ioctl_cmds.status)
478 		mpt_free_msg_frame(ioc, mf);
479 		return;
480 	}
481 	spin_unlock_irqrestore(&ioc->taskmgmt_lock, flags);
482 
483 
484 	CLEAR_MGMT_PENDING_STATUS(ioc->ioctl_cmds.status)
485 
486 	if (ioc->bus_type == SAS) {
487 		if (function == MPI_FUNCTION_SCSI_IO_REQUEST)
488 			ret_val = mptctl_do_taskmgmt(ioc,
489 				MPI_SCSITASKMGMT_TASKTYPE_TARGET_RESET,
490 				scsi_req->Bus, scsi_req->TargetID);
491 		else if (function == MPI_FUNCTION_RAID_SCSI_IO_PASSTHROUGH)
492 			ret_val = mptctl_do_taskmgmt(ioc,
493 				MPI_SCSITASKMGMT_TASKTYPE_RESET_BUS,
494 				scsi_req->Bus, 0);
495 		if (!ret_val)
496 			return;
497 	} else {
498 		if ((function == MPI_FUNCTION_SCSI_IO_REQUEST) ||
499 			(function == MPI_FUNCTION_RAID_SCSI_IO_PASSTHROUGH))
500 			ret_val = mptctl_do_taskmgmt(ioc,
501 				MPI_SCSITASKMGMT_TASKTYPE_RESET_BUS,
502 				scsi_req->Bus, 0);
503 		if (!ret_val)
504 			return;
505 	}
506 
507 	dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT "Calling Reset! \n",
508 		 ioc->name));
509 	mpt_Soft_Hard_ResetHandler(ioc, CAN_SLEEP);
510 	mpt_free_msg_frame(ioc, mf);
511 }
512 
513 
514 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
515 /* mptctl_ioc_reset
516  *
517  * Clean-up functionality. Used only if there has been a
518  * reload of the FW due.
519  *
520  */
521 static int
522 mptctl_ioc_reset(MPT_ADAPTER *ioc, int reset_phase)
523 {
524 	switch(reset_phase) {
525 	case MPT_IOC_SETUP_RESET:
526 		dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
527 		    "%s: MPT_IOC_SETUP_RESET\n", ioc->name, __func__));
528 		break;
529 	case MPT_IOC_PRE_RESET:
530 		dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
531 		    "%s: MPT_IOC_PRE_RESET\n", ioc->name, __func__));
532 		break;
533 	case MPT_IOC_POST_RESET:
534 		dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
535 		    "%s: MPT_IOC_POST_RESET\n", ioc->name, __func__));
536 		if (ioc->ioctl_cmds.status & MPT_MGMT_STATUS_PENDING) {
537 			ioc->ioctl_cmds.status |= MPT_MGMT_STATUS_DID_IOCRESET;
538 			complete(&ioc->ioctl_cmds.done);
539 		}
540 		break;
541 	default:
542 		break;
543 	}
544 
545 	return 1;
546 }
547 
548 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
549 /* ASYNC Event Notification Support */
550 static int
551 mptctl_event_process(MPT_ADAPTER *ioc, EventNotificationReply_t *pEvReply)
552 {
553 	u8 event;
554 
555 	event = le32_to_cpu(pEvReply->Event) & 0xFF;
556 
557 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "%s() called\n",
558 	    ioc->name, __func__));
559 	if(async_queue == NULL)
560 		return 1;
561 
562 	/* Raise SIGIO for persistent events.
563 	 * TODO - this define is not in MPI spec yet,
564 	 * but they plan to set it to 0x21
565 	 */
566 	if (event == 0x21) {
567 		ioc->aen_event_read_flag=1;
568 		dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "Raised SIGIO to application\n",
569 		    ioc->name));
570 		devtverboseprintk(ioc, printk(MYIOC_s_DEBUG_FMT
571 		    "Raised SIGIO to application\n", ioc->name));
572 		kill_fasync(&async_queue, SIGIO, POLL_IN);
573 		return 1;
574 	 }
575 
576 	/* This flag is set after SIGIO was raised, and
577 	 * remains set until the application has read
578 	 * the event log via ioctl=MPTEVENTREPORT
579 	 */
580 	if(ioc->aen_event_read_flag)
581 		return 1;
582 
583 	/* Signal only for the events that are
584 	 * requested for by the application
585 	 */
586 	if (ioc->events && (ioc->eventTypes & ( 1 << event))) {
587 		ioc->aen_event_read_flag=1;
588 		dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT
589 		    "Raised SIGIO to application\n", ioc->name));
590 		devtverboseprintk(ioc, printk(MYIOC_s_DEBUG_FMT
591 		    "Raised SIGIO to application\n", ioc->name));
592 		kill_fasync(&async_queue, SIGIO, POLL_IN);
593 	}
594 	return 1;
595 }
596 
597 static int
598 mptctl_fasync(int fd, struct file *filep, int mode)
599 {
600 	MPT_ADAPTER	*ioc;
601 	int ret;
602 
603 	mutex_lock(&mpctl_mutex);
604 	list_for_each_entry(ioc, &ioc_list, list)
605 		ioc->aen_event_read_flag=0;
606 
607 	ret = fasync_helper(fd, filep, mode, &async_queue);
608 	mutex_unlock(&mpctl_mutex);
609 	return ret;
610 }
611 
612 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
613 /*
614  *  MPT ioctl handler
615  *  cmd - specify the particular IOCTL command to be issued
616  *  arg - data specific to the command. Must not be null.
617  */
618 static long
619 __mptctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
620 {
621 	mpt_ioctl_header __user *uhdr = (void __user *) arg;
622 	mpt_ioctl_header	 khdr;
623 	int iocnum;
624 	unsigned iocnumX;
625 	int nonblock = (file->f_flags & O_NONBLOCK);
626 	int ret;
627 	MPT_ADAPTER *iocp = NULL;
628 
629 	if (copy_from_user(&khdr, uhdr, sizeof(khdr))) {
630 		printk(KERN_ERR MYNAM "%s::mptctl_ioctl() @%d - "
631 				"Unable to copy mpt_ioctl_header data @ %p\n",
632 				__FILE__, __LINE__, uhdr);
633 		return -EFAULT;
634 	}
635 	ret = -ENXIO;				/* (-6) No such device or address */
636 
637 	/* Verify intended MPT adapter - set iocnum and the adapter
638 	 * pointer (iocp)
639 	 */
640 	iocnumX = khdr.iocnum & 0xFF;
641 	if (((iocnum = mpt_verify_adapter(iocnumX, &iocp)) < 0) ||
642 	    (iocp == NULL))
643 		return -ENODEV;
644 
645 	if (!iocp->active) {
646 		printk(KERN_DEBUG MYNAM "%s::mptctl_ioctl() @%d - Controller disabled.\n",
647 				__FILE__, __LINE__);
648 		return -EFAULT;
649 	}
650 
651 	/* Handle those commands that are just returning
652 	 * information stored in the driver.
653 	 * These commands should never time out and are unaffected
654 	 * by TM and FW reloads.
655 	 */
656 	if ((cmd & ~IOCSIZE_MASK) == (MPTIOCINFO & ~IOCSIZE_MASK)) {
657 		return mptctl_getiocinfo(iocp, arg, _IOC_SIZE(cmd));
658 	} else if (cmd == MPTTARGETINFO) {
659 		return mptctl_gettargetinfo(iocp, arg);
660 	} else if (cmd == MPTTEST) {
661 		return mptctl_readtest(iocp, arg);
662 	} else if (cmd == MPTEVENTQUERY) {
663 		return mptctl_eventquery(iocp, arg);
664 	} else if (cmd == MPTEVENTENABLE) {
665 		return mptctl_eventenable(iocp, arg);
666 	} else if (cmd == MPTEVENTREPORT) {
667 		return mptctl_eventreport(iocp, arg);
668 	} else if (cmd == MPTFWREPLACE) {
669 		return mptctl_replace_fw(iocp, arg);
670 	}
671 
672 	/* All of these commands require an interrupt or
673 	 * are unknown/illegal.
674 	 */
675 	if ((ret = mptctl_syscall_down(iocp, nonblock)) != 0)
676 		return ret;
677 
678 	if (cmd == MPTFWDOWNLOAD)
679 		ret = mptctl_fw_download(iocp, arg);
680 	else if (cmd == MPTCOMMAND)
681 		ret = mptctl_mpt_command(iocp, arg);
682 	else if (cmd == MPTHARDRESET)
683 		ret = mptctl_do_reset(iocp, arg);
684 	else if ((cmd & ~IOCSIZE_MASK) == (HP_GETHOSTINFO & ~IOCSIZE_MASK))
685 		ret = mptctl_hp_hostinfo(iocp, arg, _IOC_SIZE(cmd));
686 	else if (cmd == HP_GETTARGETINFO)
687 		ret = mptctl_hp_targetinfo(iocp, arg);
688 	else
689 		ret = -EINVAL;
690 
691 	mutex_unlock(&iocp->ioctl_cmds.mutex);
692 
693 	return ret;
694 }
695 
696 static long
697 mptctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
698 {
699 	long ret;
700 	mutex_lock(&mpctl_mutex);
701 	ret = __mptctl_ioctl(file, cmd, arg);
702 	mutex_unlock(&mpctl_mutex);
703 	return ret;
704 }
705 
706 static int mptctl_do_reset(MPT_ADAPTER *iocp, unsigned long arg)
707 {
708 	struct mpt_ioctl_diag_reset __user *urinfo = (void __user *) arg;
709 	struct mpt_ioctl_diag_reset krinfo;
710 
711 	if (copy_from_user(&krinfo, urinfo, sizeof(struct mpt_ioctl_diag_reset))) {
712 		printk(KERN_ERR MYNAM "%s@%d::mptctl_do_reset - "
713 				"Unable to copy mpt_ioctl_diag_reset struct @ %p\n",
714 				__FILE__, __LINE__, urinfo);
715 		return -EFAULT;
716 	}
717 
718 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "mptctl_do_reset called.\n",
719 	    iocp->name));
720 
721 	if (mpt_HardResetHandler(iocp, CAN_SLEEP) != 0) {
722 		printk (MYIOC_s_ERR_FMT "%s@%d::mptctl_do_reset - reset failed.\n",
723 			iocp->name, __FILE__, __LINE__);
724 		return -1;
725 	}
726 
727 	return 0;
728 }
729 
730 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
731 /*
732  * MPT FW download function.  Cast the arg into the mpt_fw_xfer structure.
733  * This structure contains: iocnum, firmware length (bytes),
734  *      pointer to user space memory where the fw image is stored.
735  *
736  * Outputs:	None.
737  * Return:	0 if successful
738  *		-EFAULT if data unavailable
739  *		-ENXIO  if no such device
740  *		-EAGAIN if resource problem
741  *		-ENOMEM if no memory for SGE
742  *		-EMLINK if too many chain buffers required
743  *		-EBADRQC if adapter does not support FW download
744  *		-EBUSY if adapter is busy
745  *		-ENOMSG if FW upload returned bad status
746  */
747 static int
748 mptctl_fw_download(MPT_ADAPTER *iocp, unsigned long arg)
749 {
750 	struct mpt_fw_xfer __user *ufwdl = (void __user *) arg;
751 	struct mpt_fw_xfer	 kfwdl;
752 
753 	if (copy_from_user(&kfwdl, ufwdl, sizeof(struct mpt_fw_xfer))) {
754 		printk(KERN_ERR MYNAM "%s@%d::_ioctl_fwdl - "
755 				"Unable to copy mpt_fw_xfer struct @ %p\n",
756 				__FILE__, __LINE__, ufwdl);
757 		return -EFAULT;
758 	}
759 
760 	return mptctl_do_fw_download(iocp, kfwdl.bufp, kfwdl.fwlen);
761 }
762 
763 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
764 /*
765  * FW Download engine.
766  * Outputs:	None.
767  * Return:	0 if successful
768  *		-EFAULT if data unavailable
769  *		-ENXIO  if no such device
770  *		-EAGAIN if resource problem
771  *		-ENOMEM if no memory for SGE
772  *		-EMLINK if too many chain buffers required
773  *		-EBADRQC if adapter does not support FW download
774  *		-EBUSY if adapter is busy
775  *		-ENOMSG if FW upload returned bad status
776  */
777 static int
778 mptctl_do_fw_download(MPT_ADAPTER *iocp, char __user *ufwbuf, size_t fwlen)
779 {
780 	FWDownload_t		*dlmsg;
781 	MPT_FRAME_HDR		*mf;
782 	FWDownloadTCSGE_t	*ptsge;
783 	MptSge_t		*sgl, *sgIn;
784 	char			*sgOut;
785 	struct buflist		*buflist;
786 	struct buflist		*bl;
787 	dma_addr_t		 sgl_dma;
788 	int			 ret;
789 	int			 numfrags = 0;
790 	int			 maxfrags;
791 	int			 n = 0;
792 	u32			 sgdir;
793 	u32			 nib;
794 	int			 fw_bytes_copied = 0;
795 	int			 i;
796 	int			 sge_offset = 0;
797 	u16			 iocstat;
798 	pFWDownloadReply_t	 ReplyMsg = NULL;
799 	unsigned long		 timeleft;
800 
801 	/*  Valid device. Get a message frame and construct the FW download message.
802 	*/
803 	if ((mf = mpt_get_msg_frame(mptctl_id, iocp)) == NULL)
804 		return -EAGAIN;
805 
806 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT
807 	    "mptctl_do_fwdl called. mptctl_id = %xh.\n", iocp->name, mptctl_id));
808 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "DbG: kfwdl.bufp  = %p\n",
809 	    iocp->name, ufwbuf));
810 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "DbG: kfwdl.fwlen = %d\n",
811 	    iocp->name, (int)fwlen));
812 
813 	dlmsg = (FWDownload_t*) mf;
814 	ptsge = (FWDownloadTCSGE_t *) &dlmsg->SGL;
815 	sgOut = (char *) (ptsge + 1);
816 
817 	/*
818 	 * Construct f/w download request
819 	 */
820 	dlmsg->ImageType = MPI_FW_DOWNLOAD_ITYPE_FW;
821 	dlmsg->Reserved = 0;
822 	dlmsg->ChainOffset = 0;
823 	dlmsg->Function = MPI_FUNCTION_FW_DOWNLOAD;
824 	dlmsg->Reserved1[0] = dlmsg->Reserved1[1] = dlmsg->Reserved1[2] = 0;
825 	if (iocp->facts.MsgVersion >= MPI_VERSION_01_05)
826 		dlmsg->MsgFlags = MPI_FW_DOWNLOAD_MSGFLGS_LAST_SEGMENT;
827 	else
828 		dlmsg->MsgFlags = 0;
829 
830 
831 	/* Set up the Transaction SGE.
832 	 */
833 	ptsge->Reserved = 0;
834 	ptsge->ContextSize = 0;
835 	ptsge->DetailsLength = 12;
836 	ptsge->Flags = MPI_SGE_FLAGS_TRANSACTION_ELEMENT;
837 	ptsge->Reserved_0100_Checksum = 0;
838 	ptsge->ImageOffset = 0;
839 	ptsge->ImageSize = cpu_to_le32(fwlen);
840 
841 	/* Add the SGL
842 	 */
843 
844 	/*
845 	 * Need to kmalloc area(s) for holding firmware image bytes.
846 	 * But we need to do it piece meal, using a proper
847 	 * scatter gather list (with 128kB MAX hunks).
848 	 *
849 	 * A practical limit here might be # of sg hunks that fit into
850 	 * a single IOC request frame; 12 or 8 (see below), so:
851 	 * For FC9xx: 12 x 128kB == 1.5 mB (max)
852 	 * For C1030:  8 x 128kB == 1   mB (max)
853 	 * We could support chaining, but things get ugly(ier:)
854 	 *
855 	 * Set the sge_offset to the start of the sgl (bytes).
856 	 */
857 	sgdir = 0x04000000;		/* IOC will READ from sys mem */
858 	sge_offset = sizeof(MPIHeader_t) + sizeof(FWDownloadTCSGE_t);
859 	if ((sgl = kbuf_alloc_2_sgl(fwlen, sgdir, sge_offset,
860 				    &numfrags, &buflist, &sgl_dma, iocp)) == NULL)
861 		return -ENOMEM;
862 
863 	/*
864 	 * We should only need SGL with 2 simple_32bit entries (up to 256 kB)
865 	 * for FC9xx f/w image, but calculate max number of sge hunks
866 	 * we can fit into a request frame, and limit ourselves to that.
867 	 * (currently no chain support)
868 	 * maxfrags = (Request Size - FWdownload Size ) / Size of 32 bit SGE
869 	 *	Request		maxfrags
870 	 *	128		12
871 	 *	96		8
872 	 *	64		4
873 	 */
874 	maxfrags = (iocp->req_sz - sizeof(MPIHeader_t) -
875 			sizeof(FWDownloadTCSGE_t))
876 			/ iocp->SGE_size;
877 	if (numfrags > maxfrags) {
878 		ret = -EMLINK;
879 		goto fwdl_out;
880 	}
881 
882 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "DbG: sgl buffer = %p, sgfrags = %d\n",
883 	    iocp->name, sgl, numfrags));
884 
885 	/*
886 	 * Parse SG list, copying sgl itself,
887 	 * plus f/w image hunks from user space as we go...
888 	 */
889 	ret = -EFAULT;
890 	sgIn = sgl;
891 	bl = buflist;
892 	for (i=0; i < numfrags; i++) {
893 
894 		/* Get the SGE type: 0 - TCSGE, 3 - Chain, 1 - Simple SGE
895 		 * Skip everything but Simple. If simple, copy from
896 		 *	user space into kernel space.
897 		 * Note: we should not have anything but Simple as
898 		 *	Chain SGE are illegal.
899 		 */
900 		nib = (sgIn->FlagsLength & 0x30000000) >> 28;
901 		if (nib == 0 || nib == 3) {
902 			;
903 		} else if (sgIn->Address) {
904 			iocp->add_sge(sgOut, sgIn->FlagsLength, sgIn->Address);
905 			n++;
906 			if (copy_from_user(bl->kptr, ufwbuf+fw_bytes_copied, bl->len)) {
907 				printk(MYIOC_s_ERR_FMT "%s@%d::_ioctl_fwdl - "
908 					"Unable to copy f/w buffer hunk#%d @ %p\n",
909 					iocp->name, __FILE__, __LINE__, n, ufwbuf);
910 				goto fwdl_out;
911 			}
912 			fw_bytes_copied += bl->len;
913 		}
914 		sgIn++;
915 		bl++;
916 		sgOut += iocp->SGE_size;
917 	}
918 
919 	DBG_DUMP_FW_DOWNLOAD(iocp, (u32 *)mf, numfrags);
920 
921 	/*
922 	 * Finally, perform firmware download.
923 	 */
924 	ReplyMsg = NULL;
925 	SET_MGMT_MSG_CONTEXT(iocp->ioctl_cmds.msg_context, dlmsg->MsgContext);
926 	INITIALIZE_MGMT_STATUS(iocp->ioctl_cmds.status)
927 	mpt_put_msg_frame(mptctl_id, iocp, mf);
928 
929 	/* Now wait for the command to complete */
930 retry_wait:
931 	timeleft = wait_for_completion_timeout(&iocp->ioctl_cmds.done, HZ*60);
932 	if (!(iocp->ioctl_cmds.status & MPT_MGMT_STATUS_COMMAND_GOOD)) {
933 		ret = -ETIME;
934 		printk(MYIOC_s_WARN_FMT "%s: failed\n", iocp->name, __func__);
935 		if (iocp->ioctl_cmds.status & MPT_MGMT_STATUS_DID_IOCRESET) {
936 			mpt_free_msg_frame(iocp, mf);
937 			goto fwdl_out;
938 		}
939 		if (!timeleft) {
940 			printk(MYIOC_s_WARN_FMT
941 			       "FW download timeout, doorbell=0x%08x\n",
942 			       iocp->name, mpt_GetIocState(iocp, 0));
943 			mptctl_timeout_expired(iocp, mf);
944 		} else
945 			goto retry_wait;
946 		goto fwdl_out;
947 	}
948 
949 	if (!(iocp->ioctl_cmds.status & MPT_MGMT_STATUS_RF_VALID)) {
950 		printk(MYIOC_s_WARN_FMT "%s: failed\n", iocp->name, __func__);
951 		mpt_free_msg_frame(iocp, mf);
952 		ret = -ENODATA;
953 		goto fwdl_out;
954 	}
955 
956 	if (sgl)
957 		kfree_sgl(sgl, sgl_dma, buflist, iocp);
958 
959 	ReplyMsg = (pFWDownloadReply_t)iocp->ioctl_cmds.reply;
960 	iocstat = le16_to_cpu(ReplyMsg->IOCStatus) & MPI_IOCSTATUS_MASK;
961 	if (iocstat == MPI_IOCSTATUS_SUCCESS) {
962 		printk(MYIOC_s_INFO_FMT "F/W update successful!\n", iocp->name);
963 		return 0;
964 	} else if (iocstat == MPI_IOCSTATUS_INVALID_FUNCTION) {
965 		printk(MYIOC_s_WARN_FMT "Hmmm...  F/W download not supported!?!\n",
966 			iocp->name);
967 		printk(MYIOC_s_WARN_FMT "(time to go bang on somebodies door)\n",
968 			iocp->name);
969 		return -EBADRQC;
970 	} else if (iocstat == MPI_IOCSTATUS_BUSY) {
971 		printk(MYIOC_s_WARN_FMT "IOC_BUSY!\n", iocp->name);
972 		printk(MYIOC_s_WARN_FMT "(try again later?)\n", iocp->name);
973 		return -EBUSY;
974 	} else {
975 		printk(MYIOC_s_WARN_FMT "ioctl_fwdl() returned [bad] status = %04xh\n",
976 			iocp->name, iocstat);
977 		printk(MYIOC_s_WARN_FMT "(bad VooDoo)\n", iocp->name);
978 		return -ENOMSG;
979 	}
980 	return 0;
981 
982 fwdl_out:
983 
984 	CLEAR_MGMT_STATUS(iocp->ioctl_cmds.status);
985 	SET_MGMT_MSG_CONTEXT(iocp->ioctl_cmds.msg_context, 0);
986         kfree_sgl(sgl, sgl_dma, buflist, iocp);
987 	return ret;
988 }
989 
990 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
991 /*
992  * SGE Allocation routine
993  *
994  * Inputs:	bytes - number of bytes to be transferred
995  *		sgdir - data direction
996  *		sge_offset - offset (in bytes) from the start of the request
997  *			frame to the first SGE
998  *		ioc - pointer to the mptadapter
999  * Outputs:	frags - number of scatter gather elements
1000  *		blp - point to the buflist pointer
1001  *		sglbuf_dma - pointer to the (dma) sgl
1002  * Returns:	Null if failes
1003  *		pointer to the (virtual) sgl if successful.
1004  */
1005 static MptSge_t *
1006 kbuf_alloc_2_sgl(int bytes, u32 sgdir, int sge_offset, int *frags,
1007 		 struct buflist **blp, dma_addr_t *sglbuf_dma, MPT_ADAPTER *ioc)
1008 {
1009 	MptSge_t	*sglbuf = NULL;		/* pointer to array of SGE */
1010 						/* and chain buffers */
1011 	struct buflist	*buflist = NULL;	/* kernel routine */
1012 	MptSge_t	*sgl;
1013 	int		 numfrags = 0;
1014 	int		 fragcnt = 0;
1015 	int		 alloc_sz = min(bytes,MAX_KMALLOC_SZ);	// avoid kernel warning msg!
1016 	int		 bytes_allocd = 0;
1017 	int		 this_alloc;
1018 	dma_addr_t	 pa;					// phys addr
1019 	int		 i, buflist_ent;
1020 	int		 sg_spill = MAX_FRAGS_SPILL1;
1021 	int		 dir;
1022 
1023 	if (bytes < 0)
1024 		return NULL;
1025 
1026 	/* initialization */
1027 	*frags = 0;
1028 	*blp = NULL;
1029 
1030 	/* Allocate and initialize an array of kernel
1031 	 * structures for the SG elements.
1032 	 */
1033 	i = MAX_SGL_BYTES / 8;
1034 	buflist = kzalloc(i, GFP_USER);
1035 	if (!buflist)
1036 		return NULL;
1037 	buflist_ent = 0;
1038 
1039 	/* Allocate a single block of memory to store the sg elements and
1040 	 * the chain buffers.  The calling routine is responsible for
1041 	 * copying the data in this array into the correct place in the
1042 	 * request and chain buffers.
1043 	 */
1044 	sglbuf = pci_alloc_consistent(ioc->pcidev, MAX_SGL_BYTES, sglbuf_dma);
1045 	if (sglbuf == NULL)
1046 		goto free_and_fail;
1047 
1048 	if (sgdir & 0x04000000)
1049 		dir = DMA_TO_DEVICE;
1050 	else
1051 		dir = DMA_FROM_DEVICE;
1052 
1053 	/* At start:
1054 	 *	sgl = sglbuf = point to beginning of sg buffer
1055 	 *	buflist_ent = 0 = first kernel structure
1056 	 *	sg_spill = number of SGE that can be written before the first
1057 	 *		chain element.
1058 	 *
1059 	 */
1060 	sgl = sglbuf;
1061 	sg_spill = ((ioc->req_sz - sge_offset)/ioc->SGE_size) - 1;
1062 	while (bytes_allocd < bytes) {
1063 		this_alloc = min(alloc_sz, bytes-bytes_allocd);
1064 		buflist[buflist_ent].len = this_alloc;
1065 		buflist[buflist_ent].kptr = pci_alloc_consistent(ioc->pcidev,
1066 								 this_alloc,
1067 								 &pa);
1068 		if (buflist[buflist_ent].kptr == NULL) {
1069 			alloc_sz = alloc_sz / 2;
1070 			if (alloc_sz == 0) {
1071 				printk(MYIOC_s_WARN_FMT "-SG: No can do - "
1072 				    "not enough memory!   :-(\n", ioc->name);
1073 				printk(MYIOC_s_WARN_FMT "-SG: (freeing %d frags)\n",
1074 					ioc->name, numfrags);
1075 				goto free_and_fail;
1076 			}
1077 			continue;
1078 		} else {
1079 			dma_addr_t dma_addr;
1080 
1081 			bytes_allocd += this_alloc;
1082 			sgl->FlagsLength = (0x10000000|sgdir|this_alloc);
1083 			dma_addr = dma_map_single(&ioc->pcidev->dev,
1084 						  buflist[buflist_ent].kptr,
1085 						  this_alloc, dir);
1086 			sgl->Address = dma_addr;
1087 
1088 			fragcnt++;
1089 			numfrags++;
1090 			sgl++;
1091 			buflist_ent++;
1092 		}
1093 
1094 		if (bytes_allocd >= bytes)
1095 			break;
1096 
1097 		/* Need to chain? */
1098 		if (fragcnt == sg_spill) {
1099 			printk(MYIOC_s_WARN_FMT
1100 			    "-SG: No can do - " "Chain required!   :-(\n", ioc->name);
1101 			printk(MYIOC_s_WARN_FMT "(freeing %d frags)\n", ioc->name, numfrags);
1102 			goto free_and_fail;
1103 		}
1104 
1105 		/* overflow check... */
1106 		if (numfrags*8 > MAX_SGL_BYTES){
1107 			/* GRRRRR... */
1108 			printk(MYIOC_s_WARN_FMT "-SG: No can do - "
1109 				"too many SG frags!   :-(\n", ioc->name);
1110 			printk(MYIOC_s_WARN_FMT "-SG: (freeing %d frags)\n",
1111 				ioc->name, numfrags);
1112 			goto free_and_fail;
1113 		}
1114 	}
1115 
1116 	/* Last sge fixup: set LE+eol+eob bits */
1117 	sgl[-1].FlagsLength |= 0xC1000000;
1118 
1119 	*frags = numfrags;
1120 	*blp = buflist;
1121 
1122 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "-SG: kbuf_alloc_2_sgl() - "
1123 	   "%d SG frags generated!\n", ioc->name, numfrags));
1124 
1125 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "-SG: kbuf_alloc_2_sgl() - "
1126 	   "last (big) alloc_sz=%d\n", ioc->name, alloc_sz));
1127 
1128 	return sglbuf;
1129 
1130 free_and_fail:
1131 	if (sglbuf != NULL) {
1132 		for (i = 0; i < numfrags; i++) {
1133 			dma_addr_t dma_addr;
1134 			u8 *kptr;
1135 			int len;
1136 
1137 			if ((sglbuf[i].FlagsLength >> 24) == 0x30)
1138 				continue;
1139 
1140 			dma_addr = sglbuf[i].Address;
1141 			kptr = buflist[i].kptr;
1142 			len = buflist[i].len;
1143 
1144 			dma_free_coherent(&ioc->pcidev->dev, len, kptr,
1145 					  dma_addr);
1146 		}
1147 		dma_free_coherent(&ioc->pcidev->dev, MAX_SGL_BYTES, sglbuf,
1148 				  *sglbuf_dma);
1149 	}
1150 	kfree(buflist);
1151 	return NULL;
1152 }
1153 
1154 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1155 /*
1156  * Routine to free the SGL elements.
1157  */
1158 static void
1159 kfree_sgl(MptSge_t *sgl, dma_addr_t sgl_dma, struct buflist *buflist, MPT_ADAPTER *ioc)
1160 {
1161 	MptSge_t	*sg = sgl;
1162 	struct buflist	*bl = buflist;
1163 	u32		 nib;
1164 	int		 dir;
1165 	int		 n = 0;
1166 
1167 	if (sg->FlagsLength & 0x04000000)
1168 		dir = DMA_TO_DEVICE;
1169 	else
1170 		dir = DMA_FROM_DEVICE;
1171 
1172 	nib = (sg->FlagsLength & 0xF0000000) >> 28;
1173 	while (! (nib & 0x4)) { /* eob */
1174 		/* skip ignore/chain. */
1175 		if (nib == 0 || nib == 3) {
1176 			;
1177 		} else if (sg->Address) {
1178 			dma_addr_t dma_addr;
1179 			void *kptr;
1180 			int len;
1181 
1182 			dma_addr = sg->Address;
1183 			kptr = bl->kptr;
1184 			len = bl->len;
1185 			dma_unmap_single(&ioc->pcidev->dev, dma_addr, len,
1186 					 dir);
1187 			dma_free_coherent(&ioc->pcidev->dev, len, kptr,
1188 					  dma_addr);
1189 			n++;
1190 		}
1191 		sg++;
1192 		bl++;
1193 		nib = (le32_to_cpu(sg->FlagsLength) & 0xF0000000) >> 28;
1194 	}
1195 
1196 	/* we're at eob! */
1197 	if (sg->Address) {
1198 		dma_addr_t dma_addr;
1199 		void *kptr;
1200 		int len;
1201 
1202 		dma_addr = sg->Address;
1203 		kptr = bl->kptr;
1204 		len = bl->len;
1205 		dma_unmap_single(&ioc->pcidev->dev, dma_addr, len, dir);
1206 		dma_free_coherent(&ioc->pcidev->dev, len, kptr, dma_addr);
1207 		n++;
1208 	}
1209 
1210 	dma_free_coherent(&ioc->pcidev->dev, MAX_SGL_BYTES, sgl, sgl_dma);
1211 	kfree(buflist);
1212 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "-SG: Free'd 1 SGL buf + %d kbufs!\n",
1213 	    ioc->name, n));
1214 }
1215 
1216 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1217 /*
1218  *	mptctl_getiocinfo - Query the host adapter for IOC information.
1219  *	@arg: User space argument
1220  *
1221  * Outputs:	None.
1222  * Return:	0 if successful
1223  *		-EFAULT if data unavailable
1224  *		-ENODEV  if no such device/adapter
1225  */
1226 static int
1227 mptctl_getiocinfo (MPT_ADAPTER *ioc, unsigned long arg, unsigned int data_size)
1228 {
1229 	struct mpt_ioctl_iocinfo __user *uarg = (void __user *) arg;
1230 	struct mpt_ioctl_iocinfo *karg;
1231 	struct pci_dev		*pdev;
1232 	unsigned int		port;
1233 	int			cim_rev;
1234 	struct scsi_device 	*sdev;
1235 	VirtDevice		*vdevice;
1236 
1237 	/* Add of PCI INFO results in unaligned access for
1238 	 * IA64 and Sparc. Reset long to int. Return no PCI
1239 	 * data for obsolete format.
1240 	 */
1241 	if (data_size == sizeof(struct mpt_ioctl_iocinfo_rev0))
1242 		cim_rev = 0;
1243 	else if (data_size == sizeof(struct mpt_ioctl_iocinfo_rev1))
1244 		cim_rev = 1;
1245 	else if (data_size == sizeof(struct mpt_ioctl_iocinfo))
1246 		cim_rev = 2;
1247 	else if (data_size == (sizeof(struct mpt_ioctl_iocinfo_rev0)+12))
1248 		cim_rev = 0;	/* obsolete */
1249 	else
1250 		return -EFAULT;
1251 
1252 	karg = memdup_user(uarg, data_size);
1253 	if (IS_ERR(karg)) {
1254 		printk(KERN_ERR MYNAM "%s@%d::mpt_ioctl_iocinfo() - memdup_user returned error [%ld]\n",
1255 				__FILE__, __LINE__, PTR_ERR(karg));
1256 		return PTR_ERR(karg);
1257 	}
1258 
1259 	/* Verify the data transfer size is correct. */
1260 	if (karg->hdr.maxDataSize != data_size) {
1261 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_getiocinfo - "
1262 			"Structure size mismatch. Command not completed.\n",
1263 			ioc->name, __FILE__, __LINE__);
1264 		kfree(karg);
1265 		return -EFAULT;
1266 	}
1267 
1268 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_getiocinfo called.\n",
1269 	    ioc->name));
1270 
1271 	/* Fill in the data and return the structure to the calling
1272 	 * program
1273 	 */
1274 	if (ioc->bus_type == SAS)
1275 		karg->adapterType = MPT_IOCTL_INTERFACE_SAS;
1276 	else if (ioc->bus_type == FC)
1277 		karg->adapterType = MPT_IOCTL_INTERFACE_FC;
1278 	else
1279 		karg->adapterType = MPT_IOCTL_INTERFACE_SCSI;
1280 
1281 	if (karg->hdr.port > 1) {
1282 		kfree(karg);
1283 		return -EINVAL;
1284 	}
1285 	port = karg->hdr.port;
1286 
1287 	karg->port = port;
1288 	pdev = (struct pci_dev *) ioc->pcidev;
1289 
1290 	karg->pciId = pdev->device;
1291 	karg->hwRev = pdev->revision;
1292 	karg->subSystemDevice = pdev->subsystem_device;
1293 	karg->subSystemVendor = pdev->subsystem_vendor;
1294 
1295 	if (cim_rev == 1) {
1296 		/* Get the PCI bus, device, and function numbers for the IOC
1297 		 */
1298 		karg->pciInfo.u.bits.busNumber = pdev->bus->number;
1299 		karg->pciInfo.u.bits.deviceNumber = PCI_SLOT( pdev->devfn );
1300 		karg->pciInfo.u.bits.functionNumber = PCI_FUNC( pdev->devfn );
1301 	} else if (cim_rev == 2) {
1302 		/* Get the PCI bus, device, function and segment ID numbers
1303 		   for the IOC */
1304 		karg->pciInfo.u.bits.busNumber = pdev->bus->number;
1305 		karg->pciInfo.u.bits.deviceNumber = PCI_SLOT( pdev->devfn );
1306 		karg->pciInfo.u.bits.functionNumber = PCI_FUNC( pdev->devfn );
1307 		karg->pciInfo.segmentID = pci_domain_nr(pdev->bus);
1308 	}
1309 
1310 	/* Get number of devices
1311          */
1312 	karg->numDevices = 0;
1313 	if (ioc->sh) {
1314 		shost_for_each_device(sdev, ioc->sh) {
1315 			vdevice = sdev->hostdata;
1316 			if (vdevice == NULL || vdevice->vtarget == NULL)
1317 				continue;
1318 			if (vdevice->vtarget->tflags &
1319 			    MPT_TARGET_FLAGS_RAID_COMPONENT)
1320 				continue;
1321 			karg->numDevices++;
1322 		}
1323 	}
1324 
1325 	/* Set the BIOS and FW Version
1326 	 */
1327 	karg->FWVersion = ioc->facts.FWVersion.Word;
1328 	karg->BIOSVersion = ioc->biosVersion;
1329 
1330 	/* Set the Version Strings.
1331 	 */
1332 	strncpy (karg->driverVersion, MPT_LINUX_PACKAGE_NAME, MPT_IOCTL_VERSION_LENGTH);
1333 	karg->driverVersion[MPT_IOCTL_VERSION_LENGTH-1]='\0';
1334 
1335 	karg->busChangeEvent = 0;
1336 	karg->hostId = ioc->pfacts[port].PortSCSIID;
1337 	karg->rsvd[0] = karg->rsvd[1] = 0;
1338 
1339 	/* Copy the data from kernel memory to user memory
1340 	 */
1341 	if (copy_to_user((char __user *)arg, karg, data_size)) {
1342 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_getiocinfo - "
1343 			"Unable to write out mpt_ioctl_iocinfo struct @ %p\n",
1344 			ioc->name, __FILE__, __LINE__, uarg);
1345 		kfree(karg);
1346 		return -EFAULT;
1347 	}
1348 
1349 	kfree(karg);
1350 	return 0;
1351 }
1352 
1353 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1354 /*
1355  *	mptctl_gettargetinfo - Query the host adapter for target information.
1356  *	@arg: User space argument
1357  *
1358  * Outputs:	None.
1359  * Return:	0 if successful
1360  *		-EFAULT if data unavailable
1361  *		-ENODEV  if no such device/adapter
1362  */
1363 static int
1364 mptctl_gettargetinfo (MPT_ADAPTER *ioc, unsigned long arg)
1365 {
1366 	struct mpt_ioctl_targetinfo __user *uarg = (void __user *) arg;
1367 	struct mpt_ioctl_targetinfo karg;
1368 	VirtDevice		*vdevice;
1369 	char			*pmem;
1370 	int			*pdata;
1371 	int			numDevices = 0;
1372 	int			lun;
1373 	int			maxWordsLeft;
1374 	int			numBytes;
1375 	struct scsi_device 	*sdev;
1376 
1377 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_targetinfo))) {
1378 		printk(KERN_ERR MYNAM "%s@%d::mptctl_gettargetinfo - "
1379 			"Unable to read in mpt_ioctl_targetinfo struct @ %p\n",
1380 				__FILE__, __LINE__, uarg);
1381 		return -EFAULT;
1382 	}
1383 
1384 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_gettargetinfo called.\n",
1385 	    ioc->name));
1386 	numBytes = karg.hdr.maxDataSize - sizeof(mpt_ioctl_header);
1387 	maxWordsLeft = numBytes/sizeof(int);
1388 
1389 	if (maxWordsLeft <= 0) {
1390 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_gettargetinfo() - no memory available!\n",
1391 			ioc->name, __FILE__, __LINE__);
1392 		return -ENOMEM;
1393 	}
1394 
1395 	/* Fill in the data and return the structure to the calling
1396 	 * program
1397 	 */
1398 
1399 	/* struct mpt_ioctl_targetinfo does not contain sufficient space
1400 	 * for the target structures so when the IOCTL is called, there is
1401 	 * not sufficient stack space for the structure. Allocate memory,
1402 	 * populate the memory, copy back to the user, then free memory.
1403 	 * targetInfo format:
1404 	 * bits 31-24: reserved
1405 	 *      23-16: LUN
1406 	 *      15- 8: Bus Number
1407 	 *       7- 0: Target ID
1408 	 */
1409 	pmem = kzalloc(numBytes, GFP_KERNEL);
1410 	if (!pmem) {
1411 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_gettargetinfo() - no memory available!\n",
1412 			ioc->name, __FILE__, __LINE__);
1413 		return -ENOMEM;
1414 	}
1415 	pdata =  (int *) pmem;
1416 
1417 	/* Get number of devices
1418          */
1419 	if (ioc->sh){
1420 		shost_for_each_device(sdev, ioc->sh) {
1421 			if (!maxWordsLeft)
1422 				continue;
1423 			vdevice = sdev->hostdata;
1424 			if (vdevice == NULL || vdevice->vtarget == NULL)
1425 				continue;
1426 			if (vdevice->vtarget->tflags &
1427 			    MPT_TARGET_FLAGS_RAID_COMPONENT)
1428 				continue;
1429 			lun = (vdevice->vtarget->raidVolume) ? 0x80 : vdevice->lun;
1430 			*pdata = (((u8)lun << 16) + (vdevice->vtarget->channel << 8) +
1431 			    (vdevice->vtarget->id ));
1432 			pdata++;
1433 			numDevices++;
1434 			--maxWordsLeft;
1435 		}
1436 	}
1437 	karg.numDevices = numDevices;
1438 
1439 	/* Copy part of the data from kernel memory to user memory
1440 	 */
1441 	if (copy_to_user((char __user *)arg, &karg,
1442 				sizeof(struct mpt_ioctl_targetinfo))) {
1443 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_gettargetinfo - "
1444 			"Unable to write out mpt_ioctl_targetinfo struct @ %p\n",
1445 			ioc->name, __FILE__, __LINE__, uarg);
1446 		kfree(pmem);
1447 		return -EFAULT;
1448 	}
1449 
1450 	/* Copy the remaining data from kernel memory to user memory
1451 	 */
1452 	if (copy_to_user(uarg->targetInfo, pmem, numBytes)) {
1453 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_gettargetinfo - "
1454 			"Unable to write out mpt_ioctl_targetinfo struct @ %p\n",
1455 			ioc->name, __FILE__, __LINE__, pdata);
1456 		kfree(pmem);
1457 		return -EFAULT;
1458 	}
1459 
1460 	kfree(pmem);
1461 
1462 	return 0;
1463 }
1464 
1465 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1466 /* MPT IOCTL Test function.
1467  *
1468  * Outputs:	None.
1469  * Return:	0 if successful
1470  *		-EFAULT if data unavailable
1471  *		-ENODEV  if no such device/adapter
1472  */
1473 static int
1474 mptctl_readtest (MPT_ADAPTER *ioc, unsigned long arg)
1475 {
1476 	struct mpt_ioctl_test __user *uarg = (void __user *) arg;
1477 	struct mpt_ioctl_test	 karg;
1478 
1479 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_test))) {
1480 		printk(KERN_ERR MYNAM "%s@%d::mptctl_readtest - "
1481 			"Unable to read in mpt_ioctl_test struct @ %p\n",
1482 				__FILE__, __LINE__, uarg);
1483 		return -EFAULT;
1484 	}
1485 
1486 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_readtest called.\n",
1487 	    ioc->name));
1488 	/* Fill in the data and return the structure to the calling
1489 	 * program
1490 	 */
1491 
1492 #ifdef MFCNT
1493 	karg.chip_type = ioc->mfcnt;
1494 #else
1495 	karg.chip_type = ioc->pcidev->device;
1496 #endif
1497 	strncpy (karg.name, ioc->name, MPT_MAX_NAME);
1498 	karg.name[MPT_MAX_NAME-1]='\0';
1499 	strncpy (karg.product, ioc->prod_name, MPT_PRODUCT_LENGTH);
1500 	karg.product[MPT_PRODUCT_LENGTH-1]='\0';
1501 
1502 	/* Copy the data from kernel memory to user memory
1503 	 */
1504 	if (copy_to_user((char __user *)arg, &karg, sizeof(struct mpt_ioctl_test))) {
1505 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_readtest - "
1506 			"Unable to write out mpt_ioctl_test struct @ %p\n",
1507 			ioc->name, __FILE__, __LINE__, uarg);
1508 		return -EFAULT;
1509 	}
1510 
1511 	return 0;
1512 }
1513 
1514 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1515 /*
1516  *	mptctl_eventquery - Query the host adapter for the event types
1517  *	that are being logged.
1518  *	@arg: User space argument
1519  *
1520  * Outputs:	None.
1521  * Return:	0 if successful
1522  *		-EFAULT if data unavailable
1523  *		-ENODEV  if no such device/adapter
1524  */
1525 static int
1526 mptctl_eventquery (MPT_ADAPTER *ioc, unsigned long arg)
1527 {
1528 	struct mpt_ioctl_eventquery __user *uarg = (void __user *) arg;
1529 	struct mpt_ioctl_eventquery	 karg;
1530 
1531 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_eventquery))) {
1532 		printk(KERN_ERR MYNAM "%s@%d::mptctl_eventquery - "
1533 			"Unable to read in mpt_ioctl_eventquery struct @ %p\n",
1534 				__FILE__, __LINE__, uarg);
1535 		return -EFAULT;
1536 	}
1537 
1538 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_eventquery called.\n",
1539 	    ioc->name));
1540 	karg.eventEntries = MPTCTL_EVENT_LOG_SIZE;
1541 	karg.eventTypes = ioc->eventTypes;
1542 
1543 	/* Copy the data from kernel memory to user memory
1544 	 */
1545 	if (copy_to_user((char __user *)arg, &karg, sizeof(struct mpt_ioctl_eventquery))) {
1546 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_eventquery - "
1547 			"Unable to write out mpt_ioctl_eventquery struct @ %p\n",
1548 			ioc->name, __FILE__, __LINE__, uarg);
1549 		return -EFAULT;
1550 	}
1551 	return 0;
1552 }
1553 
1554 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1555 static int
1556 mptctl_eventenable (MPT_ADAPTER *ioc, unsigned long arg)
1557 {
1558 	struct mpt_ioctl_eventenable __user *uarg = (void __user *) arg;
1559 	struct mpt_ioctl_eventenable	 karg;
1560 
1561 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_eventenable))) {
1562 		printk(KERN_ERR MYNAM "%s@%d::mptctl_eventenable - "
1563 			"Unable to read in mpt_ioctl_eventenable struct @ %p\n",
1564 				__FILE__, __LINE__, uarg);
1565 		return -EFAULT;
1566 	}
1567 
1568 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_eventenable called.\n",
1569 	    ioc->name));
1570 	if (ioc->events == NULL) {
1571 		/* Have not yet allocated memory - do so now.
1572 		 */
1573 		int sz = MPTCTL_EVENT_LOG_SIZE * sizeof(MPT_IOCTL_EVENTS);
1574 		ioc->events = kzalloc(sz, GFP_KERNEL);
1575 		if (!ioc->events) {
1576 			printk(MYIOC_s_ERR_FMT
1577 			    ": ERROR - Insufficient memory to add adapter!\n",
1578 			    ioc->name);
1579 			return -ENOMEM;
1580 		}
1581 		ioc->alloc_total += sz;
1582 
1583 		ioc->eventContext = 0;
1584         }
1585 
1586 	/* Update the IOC event logging flag.
1587 	 */
1588 	ioc->eventTypes = karg.eventTypes;
1589 
1590 	return 0;
1591 }
1592 
1593 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1594 static int
1595 mptctl_eventreport (MPT_ADAPTER *ioc, unsigned long arg)
1596 {
1597 	struct mpt_ioctl_eventreport __user *uarg = (void __user *) arg;
1598 	struct mpt_ioctl_eventreport	 karg;
1599 	int			 numBytes, maxEvents, max;
1600 
1601 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_eventreport))) {
1602 		printk(KERN_ERR MYNAM "%s@%d::mptctl_eventreport - "
1603 			"Unable to read in mpt_ioctl_eventreport struct @ %p\n",
1604 				__FILE__, __LINE__, uarg);
1605 		return -EFAULT;
1606 	}
1607 
1608 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_eventreport called.\n",
1609 	    ioc->name));
1610 
1611 	numBytes = karg.hdr.maxDataSize - sizeof(mpt_ioctl_header);
1612 	maxEvents = numBytes/sizeof(MPT_IOCTL_EVENTS);
1613 
1614 
1615 	max = MPTCTL_EVENT_LOG_SIZE < maxEvents ? MPTCTL_EVENT_LOG_SIZE : maxEvents;
1616 
1617 	/* If fewer than 1 event is requested, there must have
1618 	 * been some type of error.
1619 	 */
1620 	if ((max < 1) || !ioc->events)
1621 		return -ENODATA;
1622 
1623 	/* reset this flag so SIGIO can restart */
1624 	ioc->aen_event_read_flag=0;
1625 
1626 	/* Copy the data from kernel memory to user memory
1627 	 */
1628 	numBytes = max * sizeof(MPT_IOCTL_EVENTS);
1629 	if (copy_to_user(uarg->eventData, ioc->events, numBytes)) {
1630 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_eventreport - "
1631 			"Unable to write out mpt_ioctl_eventreport struct @ %p\n",
1632 			ioc->name, __FILE__, __LINE__, ioc->events);
1633 		return -EFAULT;
1634 	}
1635 
1636 	return 0;
1637 }
1638 
1639 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1640 static int
1641 mptctl_replace_fw (MPT_ADAPTER *ioc, unsigned long arg)
1642 {
1643 	struct mpt_ioctl_replace_fw __user *uarg = (void __user *) arg;
1644 	struct mpt_ioctl_replace_fw	 karg;
1645 	int			 newFwSize;
1646 
1647 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_replace_fw))) {
1648 		printk(KERN_ERR MYNAM "%s@%d::mptctl_replace_fw - "
1649 			"Unable to read in mpt_ioctl_replace_fw struct @ %p\n",
1650 				__FILE__, __LINE__, uarg);
1651 		return -EFAULT;
1652 	}
1653 
1654 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_replace_fw called.\n",
1655 	    ioc->name));
1656 	/* If caching FW, Free the old FW image
1657 	 */
1658 	if (ioc->cached_fw == NULL)
1659 		return 0;
1660 
1661 	mpt_free_fw_memory(ioc);
1662 
1663 	/* Allocate memory for the new FW image
1664 	 */
1665 	newFwSize = ALIGN(karg.newImageSize, 4);
1666 
1667 	mpt_alloc_fw_memory(ioc, newFwSize);
1668 	if (ioc->cached_fw == NULL)
1669 		return -ENOMEM;
1670 
1671 	/* Copy the data from user memory to kernel space
1672 	 */
1673 	if (copy_from_user(ioc->cached_fw, uarg->newImage, newFwSize)) {
1674 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_replace_fw - "
1675 				"Unable to read in mpt_ioctl_replace_fw image "
1676 				"@ %p\n", ioc->name, __FILE__, __LINE__, uarg);
1677 		mpt_free_fw_memory(ioc);
1678 		return -EFAULT;
1679 	}
1680 
1681 	/* Update IOCFactsReply
1682 	 */
1683 	ioc->facts.FWImageSize = newFwSize;
1684 	return 0;
1685 }
1686 
1687 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1688 /* MPT IOCTL MPTCOMMAND function.
1689  * Cast the arg into the mpt_ioctl_mpt_command structure.
1690  *
1691  * Outputs:	None.
1692  * Return:	0 if successful
1693  *		-EBUSY  if previous command timeout and IOC reset is not complete.
1694  *		-EFAULT if data unavailable
1695  *		-ENODEV if no such device/adapter
1696  *		-ETIME	if timer expires
1697  *		-ENOMEM if memory allocation error
1698  */
1699 static int
1700 mptctl_mpt_command (MPT_ADAPTER *ioc, unsigned long arg)
1701 {
1702 	struct mpt_ioctl_command __user *uarg = (void __user *) arg;
1703 	struct mpt_ioctl_command  karg;
1704 	int		rc;
1705 
1706 
1707 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_command))) {
1708 		printk(KERN_ERR MYNAM "%s@%d::mptctl_mpt_command - "
1709 			"Unable to read in mpt_ioctl_command struct @ %p\n",
1710 				__FILE__, __LINE__, uarg);
1711 		return -EFAULT;
1712 	}
1713 
1714 	rc = mptctl_do_mpt_command (ioc, karg, &uarg->MF);
1715 
1716 	return rc;
1717 }
1718 
1719 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1720 /* Worker routine for the IOCTL MPTCOMMAND and MPTCOMMAND32 (sparc) commands.
1721  *
1722  * Outputs:	None.
1723  * Return:	0 if successful
1724  *		-EBUSY  if previous command timeout and IOC reset is not complete.
1725  *		-EFAULT if data unavailable
1726  *		-ENODEV if no such device/adapter
1727  *		-ETIME	if timer expires
1728  *		-ENOMEM if memory allocation error
1729  *		-EPERM if SCSI I/O and target is untagged
1730  */
1731 static int
1732 mptctl_do_mpt_command (MPT_ADAPTER *ioc, struct mpt_ioctl_command karg, void __user *mfPtr)
1733 {
1734 	MPT_FRAME_HDR	*mf = NULL;
1735 	MPIHeader_t	*hdr;
1736 	char		*psge;
1737 	struct buflist	bufIn;	/* data In buffer */
1738 	struct buflist	bufOut; /* data Out buffer */
1739 	dma_addr_t	dma_addr_in;
1740 	dma_addr_t	dma_addr_out;
1741 	int		sgSize = 0;	/* Num SG elements */
1742 	int		flagsLength;
1743 	int		sz, rc = 0;
1744 	int		msgContext;
1745 	u16		req_idx;
1746 	ulong 		timeout;
1747 	unsigned long	timeleft;
1748 	struct scsi_device *sdev;
1749 	unsigned long	 flags;
1750 	u8		 function;
1751 
1752 	/* bufIn and bufOut are used for user to kernel space transfers
1753 	 */
1754 	bufIn.kptr = bufOut.kptr = NULL;
1755 	bufIn.len = bufOut.len = 0;
1756 
1757 	spin_lock_irqsave(&ioc->taskmgmt_lock, flags);
1758 	if (ioc->ioc_reset_in_progress) {
1759 		spin_unlock_irqrestore(&ioc->taskmgmt_lock, flags);
1760 		printk(KERN_ERR MYNAM "%s@%d::mptctl_do_mpt_command - "
1761 			"Busy with diagnostic reset\n", __FILE__, __LINE__);
1762 		return -EBUSY;
1763 	}
1764 	spin_unlock_irqrestore(&ioc->taskmgmt_lock, flags);
1765 
1766 	/* Basic sanity checks to prevent underflows or integer overflows */
1767 	if (karg.maxReplyBytes < 0 ||
1768 	    karg.dataInSize < 0 ||
1769 	    karg.dataOutSize < 0 ||
1770 	    karg.dataSgeOffset < 0 ||
1771 	    karg.maxSenseBytes < 0 ||
1772 	    karg.dataSgeOffset > ioc->req_sz / 4)
1773 		return -EINVAL;
1774 
1775 	/* Verify that the final request frame will not be too large.
1776 	 */
1777 	sz = karg.dataSgeOffset * 4;
1778 	if (karg.dataInSize > 0)
1779 		sz += ioc->SGE_size;
1780 	if (karg.dataOutSize > 0)
1781 		sz += ioc->SGE_size;
1782 
1783 	if (sz > ioc->req_sz) {
1784 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
1785 			"Request frame too large (%d) maximum (%d)\n",
1786 			ioc->name, __FILE__, __LINE__, sz, ioc->req_sz);
1787 		return -EFAULT;
1788 	}
1789 
1790 	/* Get a free request frame and save the message context.
1791 	 */
1792         if ((mf = mpt_get_msg_frame(mptctl_id, ioc)) == NULL)
1793                 return -EAGAIN;
1794 
1795 	hdr = (MPIHeader_t *) mf;
1796 	msgContext = le32_to_cpu(hdr->MsgContext);
1797 	req_idx = le16_to_cpu(mf->u.frame.hwhdr.msgctxu.fld.req_idx);
1798 
1799 	/* Copy the request frame
1800 	 * Reset the saved message context.
1801 	 * Request frame in user space
1802 	 */
1803 	if (copy_from_user(mf, mfPtr, karg.dataSgeOffset * 4)) {
1804 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
1805 			"Unable to read MF from mpt_ioctl_command struct @ %p\n",
1806 			ioc->name, __FILE__, __LINE__, mfPtr);
1807 		function = -1;
1808 		rc = -EFAULT;
1809 		goto done_free_mem;
1810 	}
1811 	hdr->MsgContext = cpu_to_le32(msgContext);
1812 	function = hdr->Function;
1813 
1814 
1815 	/* Verify that this request is allowed.
1816 	 */
1817 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sending mpi function (0x%02X), req=%p\n",
1818 	    ioc->name, hdr->Function, mf));
1819 
1820 	switch (function) {
1821 	case MPI_FUNCTION_IOC_FACTS:
1822 	case MPI_FUNCTION_PORT_FACTS:
1823 		karg.dataOutSize  = karg.dataInSize = 0;
1824 		break;
1825 
1826 	case MPI_FUNCTION_CONFIG:
1827 	{
1828 		Config_t *config_frame;
1829 		config_frame = (Config_t *)mf;
1830 		dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "\ttype=0x%02x ext_type=0x%02x "
1831 		    "number=0x%02x action=0x%02x\n", ioc->name,
1832 		    config_frame->Header.PageType,
1833 		    config_frame->ExtPageType,
1834 		    config_frame->Header.PageNumber,
1835 		    config_frame->Action));
1836 		break;
1837 	}
1838 
1839 	case MPI_FUNCTION_FC_COMMON_TRANSPORT_SEND:
1840 	case MPI_FUNCTION_FC_EX_LINK_SRVC_SEND:
1841 	case MPI_FUNCTION_FW_UPLOAD:
1842 	case MPI_FUNCTION_SCSI_ENCLOSURE_PROCESSOR:
1843 	case MPI_FUNCTION_FW_DOWNLOAD:
1844 	case MPI_FUNCTION_FC_PRIMITIVE_SEND:
1845 	case MPI_FUNCTION_TOOLBOX:
1846 	case MPI_FUNCTION_SAS_IO_UNIT_CONTROL:
1847 		break;
1848 
1849 	case MPI_FUNCTION_SCSI_IO_REQUEST:
1850 		if (ioc->sh) {
1851 			SCSIIORequest_t *pScsiReq = (SCSIIORequest_t *) mf;
1852 			int qtag = MPI_SCSIIO_CONTROL_UNTAGGED;
1853 			int scsidir = 0;
1854 			int dataSize;
1855 			u32 id;
1856 
1857 			id = (ioc->devices_per_bus == 0) ? 256 : ioc->devices_per_bus;
1858 			if (pScsiReq->TargetID > id) {
1859 				printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
1860 					"Target ID out of bounds. \n",
1861 					ioc->name, __FILE__, __LINE__);
1862 				rc = -ENODEV;
1863 				goto done_free_mem;
1864 			}
1865 
1866 			if (pScsiReq->Bus >= ioc->number_of_buses) {
1867 				printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
1868 					"Target Bus out of bounds. \n",
1869 					ioc->name, __FILE__, __LINE__);
1870 				rc = -ENODEV;
1871 				goto done_free_mem;
1872 			}
1873 
1874 			pScsiReq->MsgFlags &= ~MPI_SCSIIO_MSGFLGS_SENSE_WIDTH;
1875 			pScsiReq->MsgFlags |= mpt_msg_flags(ioc);
1876 
1877 
1878 			/* verify that app has not requested
1879 			 *	more sense data than driver
1880 			 *	can provide, if so, reset this parameter
1881 			 * set the sense buffer pointer low address
1882 			 * update the control field to specify Q type
1883 			 */
1884 			if (karg.maxSenseBytes > MPT_SENSE_BUFFER_SIZE)
1885 				pScsiReq->SenseBufferLength = MPT_SENSE_BUFFER_SIZE;
1886 			else
1887 				pScsiReq->SenseBufferLength = karg.maxSenseBytes;
1888 
1889 			pScsiReq->SenseBufferLowAddr =
1890 				cpu_to_le32(ioc->sense_buf_low_dma
1891 				   + (req_idx * MPT_SENSE_BUFFER_ALLOC));
1892 
1893 			shost_for_each_device(sdev, ioc->sh) {
1894 				struct scsi_target *starget = scsi_target(sdev);
1895 				VirtTarget *vtarget = starget->hostdata;
1896 
1897 				if (vtarget == NULL)
1898 					continue;
1899 
1900 				if ((pScsiReq->TargetID == vtarget->id) &&
1901 				    (pScsiReq->Bus == vtarget->channel) &&
1902 				    (vtarget->tflags & MPT_TARGET_FLAGS_Q_YES))
1903 					qtag = MPI_SCSIIO_CONTROL_SIMPLEQ;
1904 			}
1905 
1906 			/* Have the IOCTL driver set the direction based
1907 			 * on the dataOutSize (ordering issue with Sparc).
1908 			 */
1909 			if (karg.dataOutSize > 0) {
1910 				scsidir = MPI_SCSIIO_CONTROL_WRITE;
1911 				dataSize = karg.dataOutSize;
1912 			} else {
1913 				scsidir = MPI_SCSIIO_CONTROL_READ;
1914 				dataSize = karg.dataInSize;
1915 			}
1916 
1917 			pScsiReq->Control = cpu_to_le32(scsidir | qtag);
1918 			pScsiReq->DataLength = cpu_to_le32(dataSize);
1919 
1920 
1921 		} else {
1922 			printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
1923 				"SCSI driver is not loaded. \n",
1924 				ioc->name, __FILE__, __LINE__);
1925 			rc = -EFAULT;
1926 			goto done_free_mem;
1927 		}
1928 		break;
1929 
1930 	case MPI_FUNCTION_SMP_PASSTHROUGH:
1931 		/* Check mf->PassthruFlags to determine if
1932 		 * transfer is ImmediateMode or not.
1933 		 * Immediate mode returns data in the ReplyFrame.
1934 		 * Else, we are sending request and response data
1935 		 * in two SGLs at the end of the mf.
1936 		 */
1937 		break;
1938 
1939 	case MPI_FUNCTION_SATA_PASSTHROUGH:
1940 		if (!ioc->sh) {
1941 			printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
1942 				"SCSI driver is not loaded. \n",
1943 				ioc->name, __FILE__, __LINE__);
1944 			rc = -EFAULT;
1945 			goto done_free_mem;
1946 		}
1947 		break;
1948 
1949 	case MPI_FUNCTION_RAID_ACTION:
1950 		/* Just add a SGE
1951 		 */
1952 		break;
1953 
1954 	case MPI_FUNCTION_RAID_SCSI_IO_PASSTHROUGH:
1955 		if (ioc->sh) {
1956 			SCSIIORequest_t *pScsiReq = (SCSIIORequest_t *) mf;
1957 			int qtag = MPI_SCSIIO_CONTROL_SIMPLEQ;
1958 			int scsidir = MPI_SCSIIO_CONTROL_READ;
1959 			int dataSize;
1960 
1961 			pScsiReq->MsgFlags &= ~MPI_SCSIIO_MSGFLGS_SENSE_WIDTH;
1962 			pScsiReq->MsgFlags |= mpt_msg_flags(ioc);
1963 
1964 
1965 			/* verify that app has not requested
1966 			 *	more sense data than driver
1967 			 *	can provide, if so, reset this parameter
1968 			 * set the sense buffer pointer low address
1969 			 * update the control field to specify Q type
1970 			 */
1971 			if (karg.maxSenseBytes > MPT_SENSE_BUFFER_SIZE)
1972 				pScsiReq->SenseBufferLength = MPT_SENSE_BUFFER_SIZE;
1973 			else
1974 				pScsiReq->SenseBufferLength = karg.maxSenseBytes;
1975 
1976 			pScsiReq->SenseBufferLowAddr =
1977 				cpu_to_le32(ioc->sense_buf_low_dma
1978 				   + (req_idx * MPT_SENSE_BUFFER_ALLOC));
1979 
1980 			/* All commands to physical devices are tagged
1981 			 */
1982 
1983 			/* Have the IOCTL driver set the direction based
1984 			 * on the dataOutSize (ordering issue with Sparc).
1985 			 */
1986 			if (karg.dataOutSize > 0) {
1987 				scsidir = MPI_SCSIIO_CONTROL_WRITE;
1988 				dataSize = karg.dataOutSize;
1989 			} else {
1990 				scsidir = MPI_SCSIIO_CONTROL_READ;
1991 				dataSize = karg.dataInSize;
1992 			}
1993 
1994 			pScsiReq->Control = cpu_to_le32(scsidir | qtag);
1995 			pScsiReq->DataLength = cpu_to_le32(dataSize);
1996 
1997 		} else {
1998 			printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
1999 				"SCSI driver is not loaded. \n",
2000 				ioc->name, __FILE__, __LINE__);
2001 			rc = -EFAULT;
2002 			goto done_free_mem;
2003 		}
2004 		break;
2005 
2006 	case MPI_FUNCTION_SCSI_TASK_MGMT:
2007 	{
2008 		SCSITaskMgmt_t	*pScsiTm;
2009 		pScsiTm = (SCSITaskMgmt_t *)mf;
2010 		dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT
2011 			"\tTaskType=0x%x MsgFlags=0x%x "
2012 			"TaskMsgContext=0x%x id=%d channel=%d\n",
2013 			ioc->name, pScsiTm->TaskType, le32_to_cpu
2014 			(pScsiTm->TaskMsgContext), pScsiTm->MsgFlags,
2015 			pScsiTm->TargetID, pScsiTm->Bus));
2016 		break;
2017 	}
2018 
2019 	case MPI_FUNCTION_IOC_INIT:
2020 		{
2021 			IOCInit_t	*pInit = (IOCInit_t *) mf;
2022 			u32		high_addr, sense_high;
2023 
2024 			/* Verify that all entries in the IOC INIT match
2025 			 * existing setup (and in LE format).
2026 			 */
2027 			if (sizeof(dma_addr_t) == sizeof(u64)) {
2028 				high_addr = cpu_to_le32((u32)((u64)ioc->req_frames_dma >> 32));
2029 				sense_high= cpu_to_le32((u32)((u64)ioc->sense_buf_pool_dma >> 32));
2030 			} else {
2031 				high_addr = 0;
2032 				sense_high= 0;
2033 			}
2034 
2035 			if ((pInit->Flags != 0) || (pInit->MaxDevices != ioc->facts.MaxDevices) ||
2036 				(pInit->MaxBuses != ioc->facts.MaxBuses) ||
2037 				(pInit->ReplyFrameSize != cpu_to_le16(ioc->reply_sz)) ||
2038 				(pInit->HostMfaHighAddr != high_addr) ||
2039 				(pInit->SenseBufferHighAddr != sense_high)) {
2040 				printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
2041 					"IOC_INIT issued with 1 or more incorrect parameters. Rejected.\n",
2042 					ioc->name, __FILE__, __LINE__);
2043 				rc = -EFAULT;
2044 				goto done_free_mem;
2045 			}
2046 		}
2047 		break;
2048 	default:
2049 		/*
2050 		 * MPI_FUNCTION_PORT_ENABLE
2051 		 * MPI_FUNCTION_TARGET_CMD_BUFFER_POST
2052 		 * MPI_FUNCTION_TARGET_ASSIST
2053 		 * MPI_FUNCTION_TARGET_STATUS_SEND
2054 		 * MPI_FUNCTION_TARGET_MODE_ABORT
2055 		 * MPI_FUNCTION_IOC_MESSAGE_UNIT_RESET
2056 		 * MPI_FUNCTION_IO_UNIT_RESET
2057 		 * MPI_FUNCTION_HANDSHAKE
2058 		 * MPI_FUNCTION_REPLY_FRAME_REMOVAL
2059 		 * MPI_FUNCTION_EVENT_NOTIFICATION
2060 		 *  (driver handles event notification)
2061 		 * MPI_FUNCTION_EVENT_ACK
2062 		 */
2063 
2064 		/*  What to do with these???  CHECK ME!!!
2065 			MPI_FUNCTION_FC_LINK_SRVC_BUF_POST
2066 			MPI_FUNCTION_FC_LINK_SRVC_RSP
2067 			MPI_FUNCTION_FC_ABORT
2068 			MPI_FUNCTION_LAN_SEND
2069 			MPI_FUNCTION_LAN_RECEIVE
2070 		 	MPI_FUNCTION_LAN_RESET
2071 		*/
2072 
2073 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
2074 			"Illegal request (function 0x%x) \n",
2075 			ioc->name, __FILE__, __LINE__, hdr->Function);
2076 		rc = -EFAULT;
2077 		goto done_free_mem;
2078 	}
2079 
2080 	/* Add the SGL ( at most one data in SGE and one data out SGE )
2081 	 * In the case of two SGE's - the data out (write) will always
2082 	 * preceede the data in (read) SGE. psgList is used to free the
2083 	 * allocated memory.
2084 	 */
2085 	psge = (char *) (((int *) mf) + karg.dataSgeOffset);
2086 	flagsLength = 0;
2087 
2088 	if (karg.dataOutSize > 0)
2089 		sgSize ++;
2090 
2091 	if (karg.dataInSize > 0)
2092 		sgSize ++;
2093 
2094 	if (sgSize > 0) {
2095 
2096 		/* Set up the dataOut memory allocation */
2097 		if (karg.dataOutSize > 0) {
2098 			if (karg.dataInSize > 0) {
2099 				flagsLength = ( MPI_SGE_FLAGS_SIMPLE_ELEMENT |
2100 						MPI_SGE_FLAGS_END_OF_BUFFER |
2101 						MPI_SGE_FLAGS_DIRECTION)
2102 						<< MPI_SGE_FLAGS_SHIFT;
2103 			} else {
2104 				flagsLength = MPT_SGE_FLAGS_SSIMPLE_WRITE;
2105 			}
2106 			flagsLength |= karg.dataOutSize;
2107 			bufOut.len = karg.dataOutSize;
2108 			bufOut.kptr = pci_alloc_consistent(
2109 					ioc->pcidev, bufOut.len, &dma_addr_out);
2110 
2111 			if (bufOut.kptr == NULL) {
2112 				rc = -ENOMEM;
2113 				goto done_free_mem;
2114 			} else {
2115 				/* Set up this SGE.
2116 				 * Copy to MF and to sglbuf
2117 				 */
2118 				ioc->add_sge(psge, flagsLength, dma_addr_out);
2119 				psge += ioc->SGE_size;
2120 
2121 				/* Copy user data to kernel space.
2122 				 */
2123 				if (copy_from_user(bufOut.kptr,
2124 						karg.dataOutBufPtr,
2125 						bufOut.len)) {
2126 					printk(MYIOC_s_ERR_FMT
2127 						"%s@%d::mptctl_do_mpt_command - Unable "
2128 						"to read user data "
2129 						"struct @ %p\n",
2130 						ioc->name, __FILE__, __LINE__,karg.dataOutBufPtr);
2131 					rc =  -EFAULT;
2132 					goto done_free_mem;
2133 				}
2134 			}
2135 		}
2136 
2137 		if (karg.dataInSize > 0) {
2138 			flagsLength = MPT_SGE_FLAGS_SSIMPLE_READ;
2139 			flagsLength |= karg.dataInSize;
2140 
2141 			bufIn.len = karg.dataInSize;
2142 			bufIn.kptr = pci_alloc_consistent(ioc->pcidev,
2143 					bufIn.len, &dma_addr_in);
2144 
2145 			if (bufIn.kptr == NULL) {
2146 				rc = -ENOMEM;
2147 				goto done_free_mem;
2148 			} else {
2149 				/* Set up this SGE
2150 				 * Copy to MF and to sglbuf
2151 				 */
2152 				ioc->add_sge(psge, flagsLength, dma_addr_in);
2153 			}
2154 		}
2155 	} else  {
2156 		/* Add a NULL SGE
2157 		 */
2158 		ioc->add_sge(psge, flagsLength, (dma_addr_t) -1);
2159 	}
2160 
2161 	SET_MGMT_MSG_CONTEXT(ioc->ioctl_cmds.msg_context, hdr->MsgContext);
2162 	INITIALIZE_MGMT_STATUS(ioc->ioctl_cmds.status)
2163 	if (hdr->Function == MPI_FUNCTION_SCSI_TASK_MGMT) {
2164 
2165 		mutex_lock(&ioc->taskmgmt_cmds.mutex);
2166 		if (mpt_set_taskmgmt_in_progress_flag(ioc) != 0) {
2167 			mutex_unlock(&ioc->taskmgmt_cmds.mutex);
2168 			goto done_free_mem;
2169 		}
2170 
2171 		DBG_DUMP_TM_REQUEST_FRAME(ioc, (u32 *)mf);
2172 
2173 		if ((ioc->facts.IOCCapabilities & MPI_IOCFACTS_CAPABILITY_HIGH_PRI_Q) &&
2174 		    (ioc->facts.MsgVersion >= MPI_VERSION_01_05))
2175 			mpt_put_msg_frame_hi_pri(mptctl_id, ioc, mf);
2176 		else {
2177 			rc =mpt_send_handshake_request(mptctl_id, ioc,
2178 				sizeof(SCSITaskMgmt_t), (u32*)mf, CAN_SLEEP);
2179 			if (rc != 0) {
2180 				dfailprintk(ioc, printk(MYIOC_s_ERR_FMT
2181 				    "send_handshake FAILED! (ioc %p, mf %p)\n",
2182 				    ioc->name, ioc, mf));
2183 				mpt_clear_taskmgmt_in_progress_flag(ioc);
2184 				rc = -ENODATA;
2185 				mutex_unlock(&ioc->taskmgmt_cmds.mutex);
2186 				goto done_free_mem;
2187 			}
2188 		}
2189 
2190 	} else
2191 		mpt_put_msg_frame(mptctl_id, ioc, mf);
2192 
2193 	/* Now wait for the command to complete */
2194 	timeout = (karg.timeout > 0) ? karg.timeout : MPT_IOCTL_DEFAULT_TIMEOUT;
2195 retry_wait:
2196 	timeleft = wait_for_completion_timeout(&ioc->ioctl_cmds.done,
2197 				HZ*timeout);
2198 	if (!(ioc->ioctl_cmds.status & MPT_MGMT_STATUS_COMMAND_GOOD)) {
2199 		rc = -ETIME;
2200 		dfailprintk(ioc, printk(MYIOC_s_ERR_FMT "%s: TIMED OUT!\n",
2201 		    ioc->name, __func__));
2202 		if (ioc->ioctl_cmds.status & MPT_MGMT_STATUS_DID_IOCRESET) {
2203 			if (function == MPI_FUNCTION_SCSI_TASK_MGMT)
2204 				mutex_unlock(&ioc->taskmgmt_cmds.mutex);
2205 			goto done_free_mem;
2206 		}
2207 		if (!timeleft) {
2208 			printk(MYIOC_s_WARN_FMT
2209 			       "mpt cmd timeout, doorbell=0x%08x"
2210 			       " function=0x%x\n",
2211 			       ioc->name, mpt_GetIocState(ioc, 0), function);
2212 			if (function == MPI_FUNCTION_SCSI_TASK_MGMT)
2213 				mutex_unlock(&ioc->taskmgmt_cmds.mutex);
2214 			mptctl_timeout_expired(ioc, mf);
2215 			mf = NULL;
2216 		} else
2217 			goto retry_wait;
2218 		goto done_free_mem;
2219 	}
2220 
2221 	if (function == MPI_FUNCTION_SCSI_TASK_MGMT)
2222 		mutex_unlock(&ioc->taskmgmt_cmds.mutex);
2223 
2224 
2225 	mf = NULL;
2226 
2227 	/* If a valid reply frame, copy to the user.
2228 	 * Offset 2: reply length in U32's
2229 	 */
2230 	if (ioc->ioctl_cmds.status & MPT_MGMT_STATUS_RF_VALID) {
2231 		if (karg.maxReplyBytes < ioc->reply_sz) {
2232 			sz = min(karg.maxReplyBytes,
2233 				4*ioc->ioctl_cmds.reply[2]);
2234 		} else {
2235 			 sz = min(ioc->reply_sz, 4*ioc->ioctl_cmds.reply[2]);
2236 		}
2237 		if (sz > 0) {
2238 			if (copy_to_user(karg.replyFrameBufPtr,
2239 				 ioc->ioctl_cmds.reply, sz)){
2240 				 printk(MYIOC_s_ERR_FMT
2241 				     "%s@%d::mptctl_do_mpt_command - "
2242 				 "Unable to write out reply frame %p\n",
2243 				 ioc->name, __FILE__, __LINE__, karg.replyFrameBufPtr);
2244 				 rc =  -ENODATA;
2245 				 goto done_free_mem;
2246 			}
2247 		}
2248 	}
2249 
2250 	/* If valid sense data, copy to user.
2251 	 */
2252 	if (ioc->ioctl_cmds.status & MPT_MGMT_STATUS_SENSE_VALID) {
2253 		sz = min(karg.maxSenseBytes, MPT_SENSE_BUFFER_SIZE);
2254 		if (sz > 0) {
2255 			if (copy_to_user(karg.senseDataPtr,
2256 				ioc->ioctl_cmds.sense, sz)) {
2257 				printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
2258 				"Unable to write sense data to user %p\n",
2259 				ioc->name, __FILE__, __LINE__,
2260 				karg.senseDataPtr);
2261 				rc =  -ENODATA;
2262 				goto done_free_mem;
2263 			}
2264 		}
2265 	}
2266 
2267 	/* If the overall status is _GOOD and data in, copy data
2268 	 * to user.
2269 	 */
2270 	if ((ioc->ioctl_cmds.status & MPT_MGMT_STATUS_COMMAND_GOOD) &&
2271 				(karg.dataInSize > 0) && (bufIn.kptr)) {
2272 
2273 		if (copy_to_user(karg.dataInBufPtr,
2274 				 bufIn.kptr, karg.dataInSize)) {
2275 			printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
2276 				"Unable to write data to user %p\n",
2277 				ioc->name, __FILE__, __LINE__,
2278 				karg.dataInBufPtr);
2279 			rc =  -ENODATA;
2280 		}
2281 	}
2282 
2283 done_free_mem:
2284 
2285 	CLEAR_MGMT_STATUS(ioc->ioctl_cmds.status)
2286 	SET_MGMT_MSG_CONTEXT(ioc->ioctl_cmds.msg_context, 0);
2287 
2288 	/* Free the allocated memory.
2289 	 */
2290 	if (bufOut.kptr != NULL) {
2291 		dma_free_coherent(&ioc->pcidev->dev, bufOut.len,
2292 				  (void *)bufOut.kptr, dma_addr_out);
2293 	}
2294 
2295 	if (bufIn.kptr != NULL) {
2296 		dma_free_coherent(&ioc->pcidev->dev, bufIn.len,
2297 				  (void *)bufIn.kptr, dma_addr_in);
2298 	}
2299 
2300 	/* mf is null if command issued successfully
2301 	 * otherwise, failure occurred after mf acquired.
2302 	 */
2303 	if (mf)
2304 		mpt_free_msg_frame(ioc, mf);
2305 
2306 	return rc;
2307 }
2308 
2309 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2310 /* Prototype Routine for the HOST INFO command.
2311  *
2312  * Outputs:	None.
2313  * Return:	0 if successful
2314  *		-EFAULT if data unavailable
2315  *		-EBUSY  if previous command timeout and IOC reset is not complete.
2316  *		-ENODEV if no such device/adapter
2317  *		-ETIME	if timer expires
2318  *		-ENOMEM if memory allocation error
2319  */
2320 static int
2321 mptctl_hp_hostinfo(MPT_ADAPTER *ioc, unsigned long arg, unsigned int data_size)
2322 {
2323 	hp_host_info_t	__user *uarg = (void __user *) arg;
2324 	struct pci_dev		*pdev;
2325 	char                    *pbuf=NULL;
2326 	dma_addr_t		buf_dma;
2327 	hp_host_info_t		karg;
2328 	CONFIGPARMS		cfg;
2329 	ConfigPageHeader_t	hdr;
2330 	int			rc, cim_rev;
2331 	ToolboxIstwiReadWriteRequest_t	*IstwiRWRequest;
2332 	MPT_FRAME_HDR		*mf = NULL;
2333 	unsigned long		timeleft;
2334 	int			retval;
2335 	u32			msgcontext;
2336 
2337 	/* Reset long to int. Should affect IA64 and SPARC only
2338 	 */
2339 	if (data_size == sizeof(hp_host_info_t))
2340 		cim_rev = 1;
2341 	else if (data_size == sizeof(hp_host_info_rev0_t))
2342 		cim_rev = 0;	/* obsolete */
2343 	else
2344 		return -EFAULT;
2345 
2346 	if (copy_from_user(&karg, uarg, sizeof(hp_host_info_t))) {
2347 		printk(KERN_ERR MYNAM "%s@%d::mptctl_hp_host_info - "
2348 			"Unable to read in hp_host_info struct @ %p\n",
2349 				__FILE__, __LINE__, uarg);
2350 		return -EFAULT;
2351 	}
2352 
2353 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT ": mptctl_hp_hostinfo called.\n",
2354 	    ioc->name));
2355 
2356 	/* Fill in the data and return the structure to the calling
2357 	 * program
2358 	 */
2359 	pdev = (struct pci_dev *) ioc->pcidev;
2360 
2361 	karg.vendor = pdev->vendor;
2362 	karg.device = pdev->device;
2363 	karg.subsystem_id = pdev->subsystem_device;
2364 	karg.subsystem_vendor = pdev->subsystem_vendor;
2365 	karg.devfn = pdev->devfn;
2366 	karg.bus = pdev->bus->number;
2367 
2368 	/* Save the SCSI host no. if
2369 	 * SCSI driver loaded
2370 	 */
2371 	if (ioc->sh != NULL)
2372 		karg.host_no = ioc->sh->host_no;
2373 	else
2374 		karg.host_no =  -1;
2375 
2376 	/* Reformat the fw_version into a string */
2377 	snprintf(karg.fw_version, sizeof(karg.fw_version),
2378 		 "%.2hhu.%.2hhu.%.2hhu.%.2hhu",
2379 		 ioc->facts.FWVersion.Struct.Major,
2380 		 ioc->facts.FWVersion.Struct.Minor,
2381 		 ioc->facts.FWVersion.Struct.Unit,
2382 		 ioc->facts.FWVersion.Struct.Dev);
2383 
2384 	/* Issue a config request to get the device serial number
2385 	 */
2386 	hdr.PageVersion = 0;
2387 	hdr.PageLength = 0;
2388 	hdr.PageNumber = 0;
2389 	hdr.PageType = MPI_CONFIG_PAGETYPE_MANUFACTURING;
2390 	cfg.cfghdr.hdr = &hdr;
2391 	cfg.physAddr = -1;
2392 	cfg.pageAddr = 0;
2393 	cfg.action = MPI_CONFIG_ACTION_PAGE_HEADER;
2394 	cfg.dir = 0;	/* read */
2395 	cfg.timeout = 10;
2396 
2397 	strncpy(karg.serial_number, " ", 24);
2398 	if (mpt_config(ioc, &cfg) == 0) {
2399 		if (cfg.cfghdr.hdr->PageLength > 0) {
2400 			/* Issue the second config page request */
2401 			cfg.action = MPI_CONFIG_ACTION_PAGE_READ_CURRENT;
2402 
2403 			pbuf = pci_alloc_consistent(ioc->pcidev, hdr.PageLength * 4, &buf_dma);
2404 			if (pbuf) {
2405 				cfg.physAddr = buf_dma;
2406 				if (mpt_config(ioc, &cfg) == 0) {
2407 					ManufacturingPage0_t *pdata = (ManufacturingPage0_t *) pbuf;
2408 					if (strlen(pdata->BoardTracerNumber) > 1) {
2409 						strlcpy(karg.serial_number,
2410 							pdata->BoardTracerNumber, 24);
2411 					}
2412 				}
2413 				dma_free_coherent(&ioc->pcidev->dev,
2414 						  hdr.PageLength * 4, pbuf,
2415 						  buf_dma);
2416 				pbuf = NULL;
2417 			}
2418 		}
2419 	}
2420 	rc = mpt_GetIocState(ioc, 1);
2421 	switch (rc) {
2422 	case MPI_IOC_STATE_OPERATIONAL:
2423 		karg.ioc_status =  HP_STATUS_OK;
2424 		break;
2425 
2426 	case MPI_IOC_STATE_FAULT:
2427 		karg.ioc_status =  HP_STATUS_FAILED;
2428 		break;
2429 
2430 	case MPI_IOC_STATE_RESET:
2431 	case MPI_IOC_STATE_READY:
2432 	default:
2433 		karg.ioc_status =  HP_STATUS_OTHER;
2434 		break;
2435 	}
2436 
2437 	karg.base_io_addr = pci_resource_start(pdev, 0);
2438 
2439 	if ((ioc->bus_type == SAS) || (ioc->bus_type == FC))
2440 		karg.bus_phys_width = HP_BUS_WIDTH_UNK;
2441 	else
2442 		karg.bus_phys_width = HP_BUS_WIDTH_16;
2443 
2444 	karg.hard_resets = 0;
2445 	karg.soft_resets = 0;
2446 	karg.timeouts = 0;
2447 	if (ioc->sh != NULL) {
2448 		MPT_SCSI_HOST *hd =  shost_priv(ioc->sh);
2449 
2450 		if (hd && (cim_rev == 1)) {
2451 			karg.hard_resets = ioc->hard_resets;
2452 			karg.soft_resets = ioc->soft_resets;
2453 			karg.timeouts = ioc->timeouts;
2454 		}
2455 	}
2456 
2457 	/*
2458 	 * Gather ISTWI(Industry Standard Two Wire Interface) Data
2459 	 */
2460 	if ((mf = mpt_get_msg_frame(mptctl_id, ioc)) == NULL) {
2461 		dfailprintk(ioc, printk(MYIOC_s_WARN_FMT
2462 			"%s, no msg frames!!\n", ioc->name, __func__));
2463 		goto out;
2464 	}
2465 
2466 	IstwiRWRequest = (ToolboxIstwiReadWriteRequest_t *)mf;
2467 	msgcontext = IstwiRWRequest->MsgContext;
2468 	memset(IstwiRWRequest,0,sizeof(ToolboxIstwiReadWriteRequest_t));
2469 	IstwiRWRequest->MsgContext = msgcontext;
2470 	IstwiRWRequest->Function = MPI_FUNCTION_TOOLBOX;
2471 	IstwiRWRequest->Tool = MPI_TOOLBOX_ISTWI_READ_WRITE_TOOL;
2472 	IstwiRWRequest->Flags = MPI_TB_ISTWI_FLAGS_READ;
2473 	IstwiRWRequest->NumAddressBytes = 0x01;
2474 	IstwiRWRequest->DataLength = cpu_to_le16(0x04);
2475 	if (pdev->devfn & 1)
2476 		IstwiRWRequest->DeviceAddr = 0xB2;
2477 	else
2478 		IstwiRWRequest->DeviceAddr = 0xB0;
2479 
2480 	pbuf = pci_alloc_consistent(ioc->pcidev, 4, &buf_dma);
2481 	if (!pbuf)
2482 		goto out;
2483 	ioc->add_sge((char *)&IstwiRWRequest->SGL,
2484 	    (MPT_SGE_FLAGS_SSIMPLE_READ|4), buf_dma);
2485 
2486 	retval = 0;
2487 	SET_MGMT_MSG_CONTEXT(ioc->ioctl_cmds.msg_context,
2488 				IstwiRWRequest->MsgContext);
2489 	INITIALIZE_MGMT_STATUS(ioc->ioctl_cmds.status)
2490 	mpt_put_msg_frame(mptctl_id, ioc, mf);
2491 
2492 retry_wait:
2493 	timeleft = wait_for_completion_timeout(&ioc->ioctl_cmds.done,
2494 			HZ*MPT_IOCTL_DEFAULT_TIMEOUT);
2495 	if (!(ioc->ioctl_cmds.status & MPT_MGMT_STATUS_COMMAND_GOOD)) {
2496 		retval = -ETIME;
2497 		printk(MYIOC_s_WARN_FMT "%s: failed\n", ioc->name, __func__);
2498 		if (ioc->ioctl_cmds.status & MPT_MGMT_STATUS_DID_IOCRESET) {
2499 			mpt_free_msg_frame(ioc, mf);
2500 			goto out;
2501 		}
2502 		if (!timeleft) {
2503 			printk(MYIOC_s_WARN_FMT
2504 			       "HOST INFO command timeout, doorbell=0x%08x\n",
2505 			       ioc->name, mpt_GetIocState(ioc, 0));
2506 			mptctl_timeout_expired(ioc, mf);
2507 		} else
2508 			goto retry_wait;
2509 		goto out;
2510 	}
2511 
2512 	/*
2513 	 *ISTWI Data Definition
2514 	 * pbuf[0] = FW_VERSION = 0x4
2515 	 * pbuf[1] = Bay Count = 6 or 4 or 2, depending on
2516 	 *  the config, you should be seeing one out of these three values
2517 	 * pbuf[2] = Drive Installed Map = bit pattern depend on which
2518 	 *   bays have drives in them
2519 	 * pbuf[3] = Checksum (0x100 = (byte0 + byte2 + byte3)
2520 	 */
2521 	if (ioc->ioctl_cmds.status & MPT_MGMT_STATUS_RF_VALID)
2522 		karg.rsvd = *(u32 *)pbuf;
2523 
2524  out:
2525 	CLEAR_MGMT_STATUS(ioc->ioctl_cmds.status)
2526 	SET_MGMT_MSG_CONTEXT(ioc->ioctl_cmds.msg_context, 0);
2527 
2528 	if (pbuf)
2529 		dma_free_coherent(&ioc->pcidev->dev, 4, pbuf, buf_dma);
2530 
2531 	/* Copy the data from kernel memory to user memory
2532 	 */
2533 	if (copy_to_user((char __user *)arg, &karg, sizeof(hp_host_info_t))) {
2534 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_hpgethostinfo - "
2535 			"Unable to write out hp_host_info @ %p\n",
2536 			ioc->name, __FILE__, __LINE__, uarg);
2537 		return -EFAULT;
2538 	}
2539 
2540 	return 0;
2541 
2542 }
2543 
2544 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2545 /* Prototype Routine for the TARGET INFO command.
2546  *
2547  * Outputs:	None.
2548  * Return:	0 if successful
2549  *		-EFAULT if data unavailable
2550  *		-EBUSY  if previous command timeout and IOC reset is not complete.
2551  *		-ENODEV if no such device/adapter
2552  *		-ETIME	if timer expires
2553  *		-ENOMEM if memory allocation error
2554  */
2555 static int
2556 mptctl_hp_targetinfo(MPT_ADAPTER *ioc, unsigned long arg)
2557 {
2558 	hp_target_info_t __user *uarg = (void __user *) arg;
2559 	SCSIDevicePage0_t	*pg0_alloc;
2560 	SCSIDevicePage3_t	*pg3_alloc;
2561 	MPT_SCSI_HOST 		*hd = NULL;
2562 	hp_target_info_t	karg;
2563 	int			data_sz;
2564 	dma_addr_t		page_dma;
2565 	CONFIGPARMS	 	cfg;
2566 	ConfigPageHeader_t	hdr;
2567 	int			tmp, np, rc = 0;
2568 
2569 	if (copy_from_user(&karg, uarg, sizeof(hp_target_info_t))) {
2570 		printk(KERN_ERR MYNAM "%s@%d::mptctl_hp_targetinfo - "
2571 			"Unable to read in hp_host_targetinfo struct @ %p\n",
2572 				__FILE__, __LINE__, uarg);
2573 		return -EFAULT;
2574 	}
2575 
2576 	if (karg.hdr.id >= MPT_MAX_FC_DEVICES)
2577 		return -EINVAL;
2578 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_hp_targetinfo called.\n",
2579 	    ioc->name));
2580 
2581 	/*  There is nothing to do for FCP parts.
2582 	 */
2583 	if ((ioc->bus_type == SAS) || (ioc->bus_type == FC))
2584 		return 0;
2585 
2586 	if ((ioc->spi_data.sdp0length == 0) || (ioc->sh == NULL))
2587 		return 0;
2588 
2589 	if (ioc->sh->host_no != karg.hdr.host)
2590 		return -ENODEV;
2591 
2592        /* Get the data transfer speeds
2593         */
2594 	data_sz = ioc->spi_data.sdp0length * 4;
2595 	pg0_alloc = pci_alloc_consistent(ioc->pcidev, data_sz, &page_dma);
2596 	if (pg0_alloc) {
2597 		hdr.PageVersion = ioc->spi_data.sdp0version;
2598 		hdr.PageLength = data_sz;
2599 		hdr.PageNumber = 0;
2600 		hdr.PageType = MPI_CONFIG_PAGETYPE_SCSI_DEVICE;
2601 
2602 		cfg.cfghdr.hdr = &hdr;
2603 		cfg.action = MPI_CONFIG_ACTION_PAGE_READ_CURRENT;
2604 		cfg.dir = 0;
2605 		cfg.timeout = 0;
2606 		cfg.physAddr = page_dma;
2607 
2608 		cfg.pageAddr = (karg.hdr.channel << 8) | karg.hdr.id;
2609 
2610 		if ((rc = mpt_config(ioc, &cfg)) == 0) {
2611 			np = le32_to_cpu(pg0_alloc->NegotiatedParameters);
2612 			karg.negotiated_width = np & MPI_SCSIDEVPAGE0_NP_WIDE ?
2613 					HP_BUS_WIDTH_16 : HP_BUS_WIDTH_8;
2614 
2615 			if (np & MPI_SCSIDEVPAGE0_NP_NEG_SYNC_OFFSET_MASK) {
2616 				tmp = (np & MPI_SCSIDEVPAGE0_NP_NEG_SYNC_PERIOD_MASK) >> 8;
2617 				if (tmp < 0x09)
2618 					karg.negotiated_speed = HP_DEV_SPEED_ULTRA320;
2619 				else if (tmp <= 0x09)
2620 					karg.negotiated_speed = HP_DEV_SPEED_ULTRA160;
2621 				else if (tmp <= 0x0A)
2622 					karg.negotiated_speed = HP_DEV_SPEED_ULTRA2;
2623 				else if (tmp <= 0x0C)
2624 					karg.negotiated_speed = HP_DEV_SPEED_ULTRA;
2625 				else if (tmp <= 0x25)
2626 					karg.negotiated_speed = HP_DEV_SPEED_FAST;
2627 				else
2628 					karg.negotiated_speed = HP_DEV_SPEED_ASYNC;
2629 			} else
2630 				karg.negotiated_speed = HP_DEV_SPEED_ASYNC;
2631 		}
2632 
2633 		dma_free_coherent(&ioc->pcidev->dev, data_sz, (u8 *)pg0_alloc,
2634 				  page_dma);
2635 	}
2636 
2637 	/* Set defaults
2638 	 */
2639 	karg.message_rejects = -1;
2640 	karg.phase_errors = -1;
2641 	karg.parity_errors = -1;
2642 	karg.select_timeouts = -1;
2643 
2644 	/* Get the target error parameters
2645 	 */
2646 	hdr.PageVersion = 0;
2647 	hdr.PageLength = 0;
2648 	hdr.PageNumber = 3;
2649 	hdr.PageType = MPI_CONFIG_PAGETYPE_SCSI_DEVICE;
2650 
2651 	cfg.cfghdr.hdr = &hdr;
2652 	cfg.action = MPI_CONFIG_ACTION_PAGE_HEADER;
2653 	cfg.dir = 0;
2654 	cfg.timeout = 0;
2655 	cfg.physAddr = -1;
2656 	if ((mpt_config(ioc, &cfg) == 0) && (cfg.cfghdr.hdr->PageLength > 0)) {
2657 		/* Issue the second config page request */
2658 		cfg.action = MPI_CONFIG_ACTION_PAGE_READ_CURRENT;
2659 		data_sz = (int) cfg.cfghdr.hdr->PageLength * 4;
2660 		pg3_alloc = pci_alloc_consistent(ioc->pcidev, data_sz, &page_dma);
2661 		if (pg3_alloc) {
2662 			cfg.physAddr = page_dma;
2663 			cfg.pageAddr = (karg.hdr.channel << 8) | karg.hdr.id;
2664 			if ((rc = mpt_config(ioc, &cfg)) == 0) {
2665 				karg.message_rejects = (u32) le16_to_cpu(pg3_alloc->MsgRejectCount);
2666 				karg.phase_errors = (u32) le16_to_cpu(pg3_alloc->PhaseErrorCount);
2667 				karg.parity_errors = (u32) le16_to_cpu(pg3_alloc->ParityErrorCount);
2668 			}
2669 			dma_free_coherent(&ioc->pcidev->dev, data_sz,
2670 					  (u8 *)pg3_alloc, page_dma);
2671 		}
2672 	}
2673 	hd = shost_priv(ioc->sh);
2674 	if (hd != NULL)
2675 		karg.select_timeouts = hd->sel_timeout[karg.hdr.id];
2676 
2677 	/* Copy the data from kernel memory to user memory
2678 	 */
2679 	if (copy_to_user((char __user *)arg, &karg, sizeof(hp_target_info_t))) {
2680 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_hp_target_info - "
2681 			"Unable to write out mpt_ioctl_targetinfo struct @ %p\n",
2682 			ioc->name, __FILE__, __LINE__, uarg);
2683 		return -EFAULT;
2684 	}
2685 
2686 	return 0;
2687 }
2688 
2689 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2690 
2691 static const struct file_operations mptctl_fops = {
2692 	.owner =	THIS_MODULE,
2693 	.llseek =	no_llseek,
2694 	.fasync = 	mptctl_fasync,
2695 	.unlocked_ioctl = mptctl_ioctl,
2696 #ifdef CONFIG_COMPAT
2697 	.compat_ioctl = compat_mpctl_ioctl,
2698 #endif
2699 };
2700 
2701 static struct miscdevice mptctl_miscdev = {
2702 	MPT_MINOR,
2703 	MYNAM,
2704 	&mptctl_fops
2705 };
2706 
2707 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2708 
2709 #ifdef CONFIG_COMPAT
2710 
2711 static int
2712 compat_mptfwxfer_ioctl(struct file *filp, unsigned int cmd,
2713 			unsigned long arg)
2714 {
2715 	struct mpt_fw_xfer32 kfw32;
2716 	struct mpt_fw_xfer kfw;
2717 	MPT_ADAPTER *iocp = NULL;
2718 	int iocnum, iocnumX;
2719 	int nonblock = (filp->f_flags & O_NONBLOCK);
2720 	int ret;
2721 
2722 
2723 	if (copy_from_user(&kfw32, (char __user *)arg, sizeof(kfw32)))
2724 		return -EFAULT;
2725 
2726 	/* Verify intended MPT adapter */
2727 	iocnumX = kfw32.iocnum & 0xFF;
2728 	if (((iocnum = mpt_verify_adapter(iocnumX, &iocp)) < 0) ||
2729 	    (iocp == NULL)) {
2730 		printk(KERN_DEBUG MYNAM "::compat_mptfwxfer_ioctl @%d - ioc%d not found!\n",
2731 			__LINE__, iocnumX);
2732 		return -ENODEV;
2733 	}
2734 
2735 	if ((ret = mptctl_syscall_down(iocp, nonblock)) != 0)
2736 		return ret;
2737 
2738 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "compat_mptfwxfer_ioctl() called\n",
2739 	    iocp->name));
2740 	kfw.iocnum = iocnum;
2741 	kfw.fwlen = kfw32.fwlen;
2742 	kfw.bufp = compat_ptr(kfw32.bufp);
2743 
2744 	ret = mptctl_do_fw_download(iocp, kfw.bufp, kfw.fwlen);
2745 
2746 	mutex_unlock(&iocp->ioctl_cmds.mutex);
2747 
2748 	return ret;
2749 }
2750 
2751 static int
2752 compat_mpt_command(struct file *filp, unsigned int cmd,
2753 			unsigned long arg)
2754 {
2755 	struct mpt_ioctl_command32 karg32;
2756 	struct mpt_ioctl_command32 __user *uarg = (struct mpt_ioctl_command32 __user *) arg;
2757 	struct mpt_ioctl_command karg;
2758 	MPT_ADAPTER *iocp = NULL;
2759 	int iocnum, iocnumX;
2760 	int nonblock = (filp->f_flags & O_NONBLOCK);
2761 	int ret;
2762 
2763 	if (copy_from_user(&karg32, (char __user *)arg, sizeof(karg32)))
2764 		return -EFAULT;
2765 
2766 	/* Verify intended MPT adapter */
2767 	iocnumX = karg32.hdr.iocnum & 0xFF;
2768 	if (((iocnum = mpt_verify_adapter(iocnumX, &iocp)) < 0) ||
2769 	    (iocp == NULL)) {
2770 		printk(KERN_DEBUG MYNAM "::compat_mpt_command @%d - ioc%d not found!\n",
2771 			__LINE__, iocnumX);
2772 		return -ENODEV;
2773 	}
2774 
2775 	if ((ret = mptctl_syscall_down(iocp, nonblock)) != 0)
2776 		return ret;
2777 
2778 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "compat_mpt_command() called\n",
2779 	    iocp->name));
2780 	/* Copy data to karg */
2781 	karg.hdr.iocnum = karg32.hdr.iocnum;
2782 	karg.hdr.port = karg32.hdr.port;
2783 	karg.timeout = karg32.timeout;
2784 	karg.maxReplyBytes = karg32.maxReplyBytes;
2785 
2786 	karg.dataInSize = karg32.dataInSize;
2787 	karg.dataOutSize = karg32.dataOutSize;
2788 	karg.maxSenseBytes = karg32.maxSenseBytes;
2789 	karg.dataSgeOffset = karg32.dataSgeOffset;
2790 
2791 	karg.replyFrameBufPtr = (char __user *)(unsigned long)karg32.replyFrameBufPtr;
2792 	karg.dataInBufPtr = (char __user *)(unsigned long)karg32.dataInBufPtr;
2793 	karg.dataOutBufPtr = (char __user *)(unsigned long)karg32.dataOutBufPtr;
2794 	karg.senseDataPtr = (char __user *)(unsigned long)karg32.senseDataPtr;
2795 
2796 	/* Pass new structure to do_mpt_command
2797 	 */
2798 	ret = mptctl_do_mpt_command (iocp, karg, &uarg->MF);
2799 
2800 	mutex_unlock(&iocp->ioctl_cmds.mutex);
2801 
2802 	return ret;
2803 }
2804 
2805 static long compat_mpctl_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
2806 {
2807 	long ret;
2808 	mutex_lock(&mpctl_mutex);
2809 	switch (cmd) {
2810 	case MPTIOCINFO:
2811 	case MPTIOCINFO1:
2812 	case MPTIOCINFO2:
2813 	case MPTTARGETINFO:
2814 	case MPTEVENTQUERY:
2815 	case MPTEVENTENABLE:
2816 	case MPTEVENTREPORT:
2817 	case MPTHARDRESET:
2818 	case HP_GETHOSTINFO:
2819 	case HP_GETTARGETINFO:
2820 	case MPTTEST:
2821 		ret = __mptctl_ioctl(f, cmd, arg);
2822 		break;
2823 	case MPTCOMMAND32:
2824 		ret = compat_mpt_command(f, cmd, arg);
2825 		break;
2826 	case MPTFWDOWNLOAD32:
2827 		ret = compat_mptfwxfer_ioctl(f, cmd, arg);
2828 		break;
2829 	default:
2830 		ret = -ENOIOCTLCMD;
2831 		break;
2832 	}
2833 	mutex_unlock(&mpctl_mutex);
2834 	return ret;
2835 }
2836 
2837 #endif
2838 
2839 
2840 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2841 /*
2842  *	mptctl_probe - Installs ioctl devices per bus.
2843  *	@pdev: Pointer to pci_dev structure
2844  *
2845  *	Returns 0 for success, non-zero for failure.
2846  *
2847  */
2848 
2849 static int
2850 mptctl_probe(struct pci_dev *pdev)
2851 {
2852 	MPT_ADAPTER *ioc = pci_get_drvdata(pdev);
2853 
2854 	mutex_init(&ioc->ioctl_cmds.mutex);
2855 	init_completion(&ioc->ioctl_cmds.done);
2856 	return 0;
2857 }
2858 
2859 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2860 /*
2861  *	mptctl_remove - Removed ioctl devices
2862  *	@pdev: Pointer to pci_dev structure
2863  *
2864  *
2865  */
2866 static void
2867 mptctl_remove(struct pci_dev *pdev)
2868 {
2869 }
2870 
2871 static struct mpt_pci_driver mptctl_driver = {
2872   .probe		= mptctl_probe,
2873   .remove		= mptctl_remove,
2874 };
2875 
2876 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2877 static int __init mptctl_init(void)
2878 {
2879 	int err;
2880 	int where = 1;
2881 
2882 	show_mptmod_ver(my_NAME, my_VERSION);
2883 
2884 	mpt_device_driver_register(&mptctl_driver, MPTCTL_DRIVER);
2885 
2886 	/* Register this device */
2887 	err = misc_register(&mptctl_miscdev);
2888 	if (err < 0) {
2889 		printk(KERN_ERR MYNAM ": Can't register misc device [minor=%d].\n", MPT_MINOR);
2890 		goto out_fail;
2891 	}
2892 	printk(KERN_INFO MYNAM ": Registered with Fusion MPT base driver\n");
2893 	printk(KERN_INFO MYNAM ": /dev/%s @ (major,minor=%d,%d)\n",
2894 			 mptctl_miscdev.name, MISC_MAJOR, mptctl_miscdev.minor);
2895 
2896 	/*
2897 	 *  Install our handler
2898 	 */
2899 	++where;
2900 	mptctl_id = mpt_register(mptctl_reply, MPTCTL_DRIVER,
2901 	    "mptctl_reply");
2902 	if (!mptctl_id || mptctl_id >= MPT_MAX_PROTOCOL_DRIVERS) {
2903 		printk(KERN_ERR MYNAM ": ERROR: Failed to register with Fusion MPT base driver\n");
2904 		misc_deregister(&mptctl_miscdev);
2905 		err = -EBUSY;
2906 		goto out_fail;
2907 	}
2908 
2909 	mptctl_taskmgmt_id = mpt_register(mptctl_taskmgmt_reply, MPTCTL_DRIVER,
2910 	    "mptctl_taskmgmt_reply");
2911 	if (!mptctl_taskmgmt_id || mptctl_taskmgmt_id >= MPT_MAX_PROTOCOL_DRIVERS) {
2912 		printk(KERN_ERR MYNAM ": ERROR: Failed to register with Fusion MPT base driver\n");
2913 		mpt_deregister(mptctl_id);
2914 		misc_deregister(&mptctl_miscdev);
2915 		err = -EBUSY;
2916 		goto out_fail;
2917 	}
2918 
2919 	mpt_reset_register(mptctl_id, mptctl_ioc_reset);
2920 	mpt_event_register(mptctl_id, mptctl_event_process);
2921 
2922 	return 0;
2923 
2924 out_fail:
2925 
2926 	mpt_device_driver_deregister(MPTCTL_DRIVER);
2927 
2928 	return err;
2929 }
2930 
2931 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2932 static void mptctl_exit(void)
2933 {
2934 	misc_deregister(&mptctl_miscdev);
2935 	printk(KERN_INFO MYNAM ": Deregistered /dev/%s @ (major,minor=%d,%d)\n",
2936 			 mptctl_miscdev.name, MISC_MAJOR, mptctl_miscdev.minor);
2937 
2938 	/* De-register event handler from base module */
2939 	mpt_event_deregister(mptctl_id);
2940 
2941 	/* De-register reset handler from base module */
2942 	mpt_reset_deregister(mptctl_id);
2943 
2944 	/* De-register callback handler from base module */
2945 	mpt_deregister(mptctl_taskmgmt_id);
2946 	mpt_deregister(mptctl_id);
2947 
2948         mpt_device_driver_deregister(MPTCTL_DRIVER);
2949 
2950 }
2951 
2952 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2953 
2954 module_init(mptctl_init);
2955 module_exit(mptctl_exit);
2956