1 /*
2  *  linux/drivers/scsi/esas2r/esas2r_ioctl.c
3  *      For use with ATTO ExpressSAS R6xx SAS/SATA RAID controllers
4  *
5  *  Copyright (c) 2001-2013 ATTO Technology, Inc.
6  *  (mailto:linuxdrivers@attotech.com)
7  *
8  * This program is free software; you can redistribute it and/or
9  * modify it under the terms of the GNU General Public License
10  * as published by the Free Software Foundation; either version 2
11  * of the License, or (at your option) any later version.
12  *
13  * This program is distributed in the hope that it will be useful,
14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16  * GNU General Public License for more details.
17  *
18  * NO WARRANTY
19  * THE PROGRAM IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR
20  * CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED INCLUDING, WITHOUT
21  * LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT,
22  * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each Recipient is
23  * solely responsible for determining the appropriateness of using and
24  * distributing the Program and assumes all risks associated with its
25  * exercise of rights under this Agreement, including but not limited to
26  * the risks and costs of program errors, damage to or loss of data,
27  * programs or equipment, and unavailability or interruption of operations.
28  *
29  * DISCLAIMER OF LIABILITY
30  * NEITHER RECIPIENT NOR ANY CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY
31  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
32  * DAMAGES (INCLUDING WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND
33  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
34  * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
35  * USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS GRANTED
36  * HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES
37  *
38  * You should have received a copy of the GNU General Public License
39  * along with this program; if not, write to the Free Software
40  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301,
41  * USA.
42  */
43 
44 #include "esas2r.h"
45 
46 /*
47  * Buffered ioctl handlers.  A buffered ioctl is one which requires that we
48  * allocate a DMA-able memory area to communicate with the firmware.  In
49  * order to prevent continually allocating and freeing consistent memory,
50  * we will allocate a global buffer the first time we need it and re-use
51  * it for subsequent ioctl calls that require it.
52  */
53 
54 u8 *esas2r_buffered_ioctl;
55 dma_addr_t esas2r_buffered_ioctl_addr;
56 u32 esas2r_buffered_ioctl_size;
57 struct pci_dev *esas2r_buffered_ioctl_pcid;
58 
59 static DEFINE_SEMAPHORE(buffered_ioctl_semaphore);
60 typedef int (*BUFFERED_IOCTL_CALLBACK)(struct esas2r_adapter *,
61 				       struct esas2r_request *,
62 				       struct esas2r_sg_context *,
63 				       void *);
64 typedef void (*BUFFERED_IOCTL_DONE_CALLBACK)(struct esas2r_adapter *,
65 					     struct esas2r_request *, void *);
66 
67 struct esas2r_buffered_ioctl {
68 	struct esas2r_adapter *a;
69 	void *ioctl;
70 	u32 length;
71 	u32 control_code;
72 	u32 offset;
73 	BUFFERED_IOCTL_CALLBACK
74 		callback;
75 	void *context;
76 	BUFFERED_IOCTL_DONE_CALLBACK
77 		done_callback;
78 	void *done_context;
79 
80 };
81 
82 static void complete_fm_api_req(struct esas2r_adapter *a,
83 				struct esas2r_request *rq)
84 {
85 	a->fm_api_command_done = 1;
86 	wake_up_interruptible(&a->fm_api_waiter);
87 }
88 
89 /* Callbacks for building scatter/gather lists for FM API requests */
90 static u32 get_physaddr_fm_api(struct esas2r_sg_context *sgc, u64 *addr)
91 {
92 	struct esas2r_adapter *a = (struct esas2r_adapter *)sgc->adapter;
93 	int offset = sgc->cur_offset - a->save_offset;
94 
95 	(*addr) = a->firmware.phys + offset;
96 	return a->firmware.orig_len - offset;
97 }
98 
99 static u32 get_physaddr_fm_api_header(struct esas2r_sg_context *sgc, u64 *addr)
100 {
101 	struct esas2r_adapter *a = (struct esas2r_adapter *)sgc->adapter;
102 	int offset = sgc->cur_offset - a->save_offset;
103 
104 	(*addr) = a->firmware.header_buff_phys + offset;
105 	return sizeof(struct esas2r_flash_img) - offset;
106 }
107 
108 /* Handle EXPRESS_IOCTL_RW_FIRMWARE ioctl with img_type = FW_IMG_FM_API. */
109 static void do_fm_api(struct esas2r_adapter *a, struct esas2r_flash_img *fi)
110 {
111 	struct esas2r_request *rq;
112 
113 	if (mutex_lock_interruptible(&a->fm_api_mutex)) {
114 		fi->status = FI_STAT_BUSY;
115 		return;
116 	}
117 
118 	rq = esas2r_alloc_request(a);
119 	if (rq == NULL) {
120 		fi->status = FI_STAT_BUSY;
121 		goto free_sem;
122 	}
123 
124 	if (fi == &a->firmware.header) {
125 		a->firmware.header_buff = dma_alloc_coherent(&a->pcid->dev,
126 							     (size_t)sizeof(
127 								     struct
128 								     esas2r_flash_img),
129 							     (dma_addr_t *)&a->
130 							     firmware.
131 							     header_buff_phys,
132 							     GFP_KERNEL);
133 
134 		if (a->firmware.header_buff == NULL) {
135 			esas2r_debug("failed to allocate header buffer!");
136 			fi->status = FI_STAT_BUSY;
137 			goto free_req;
138 		}
139 
140 		memcpy(a->firmware.header_buff, fi,
141 		       sizeof(struct esas2r_flash_img));
142 		a->save_offset = a->firmware.header_buff;
143 		a->fm_api_sgc.get_phys_addr =
144 			(PGETPHYSADDR)get_physaddr_fm_api_header;
145 	} else {
146 		a->save_offset = (u8 *)fi;
147 		a->fm_api_sgc.get_phys_addr =
148 			(PGETPHYSADDR)get_physaddr_fm_api;
149 	}
150 
151 	rq->comp_cb = complete_fm_api_req;
152 	a->fm_api_command_done = 0;
153 	a->fm_api_sgc.cur_offset = a->save_offset;
154 
155 	if (!esas2r_fm_api(a, (struct esas2r_flash_img *)a->save_offset, rq,
156 			   &a->fm_api_sgc))
157 		goto all_done;
158 
159 	/* Now wait around for it to complete. */
160 	while (!a->fm_api_command_done)
161 		wait_event_interruptible(a->fm_api_waiter,
162 					 a->fm_api_command_done);
163 all_done:
164 	if (fi == &a->firmware.header) {
165 		memcpy(fi, a->firmware.header_buff,
166 		       sizeof(struct esas2r_flash_img));
167 
168 		dma_free_coherent(&a->pcid->dev,
169 				  (size_t)sizeof(struct esas2r_flash_img),
170 				  a->firmware.header_buff,
171 				  (dma_addr_t)a->firmware.header_buff_phys);
172 	}
173 free_req:
174 	esas2r_free_request(a, (struct esas2r_request *)rq);
175 free_sem:
176 	mutex_unlock(&a->fm_api_mutex);
177 	return;
178 
179 }
180 
181 static void complete_nvr_req(struct esas2r_adapter *a,
182 			     struct esas2r_request *rq)
183 {
184 	a->nvram_command_done = 1;
185 	wake_up_interruptible(&a->nvram_waiter);
186 }
187 
188 /* Callback for building scatter/gather lists for buffered ioctls */
189 static u32 get_physaddr_buffered_ioctl(struct esas2r_sg_context *sgc,
190 				       u64 *addr)
191 {
192 	int offset = (u8 *)sgc->cur_offset - esas2r_buffered_ioctl;
193 
194 	(*addr) = esas2r_buffered_ioctl_addr + offset;
195 	return esas2r_buffered_ioctl_size - offset;
196 }
197 
198 static void complete_buffered_ioctl_req(struct esas2r_adapter *a,
199 					struct esas2r_request *rq)
200 {
201 	a->buffered_ioctl_done = 1;
202 	wake_up_interruptible(&a->buffered_ioctl_waiter);
203 }
204 
205 static u8 handle_buffered_ioctl(struct esas2r_buffered_ioctl *bi)
206 {
207 	struct esas2r_adapter *a = bi->a;
208 	struct esas2r_request *rq;
209 	struct esas2r_sg_context sgc;
210 	u8 result = IOCTL_SUCCESS;
211 
212 	if (down_interruptible(&buffered_ioctl_semaphore))
213 		return IOCTL_OUT_OF_RESOURCES;
214 
215 	/* allocate a buffer or use the existing buffer. */
216 	if (esas2r_buffered_ioctl) {
217 		if (esas2r_buffered_ioctl_size < bi->length) {
218 			/* free the too-small buffer and get a new one */
219 			dma_free_coherent(&a->pcid->dev,
220 					  (size_t)esas2r_buffered_ioctl_size,
221 					  esas2r_buffered_ioctl,
222 					  esas2r_buffered_ioctl_addr);
223 
224 			goto allocate_buffer;
225 		}
226 	} else {
227 allocate_buffer:
228 		esas2r_buffered_ioctl_size = bi->length;
229 		esas2r_buffered_ioctl_pcid = a->pcid;
230 		esas2r_buffered_ioctl = dma_alloc_coherent(&a->pcid->dev,
231 							   (size_t)
232 							   esas2r_buffered_ioctl_size,
233 							   &
234 							   esas2r_buffered_ioctl_addr,
235 							   GFP_KERNEL);
236 	}
237 
238 	if (!esas2r_buffered_ioctl) {
239 		esas2r_log(ESAS2R_LOG_CRIT,
240 			   "could not allocate %d bytes of consistent memory "
241 			   "for a buffered ioctl!",
242 			   bi->length);
243 
244 		esas2r_debug("buffered ioctl alloc failure");
245 		result = IOCTL_OUT_OF_RESOURCES;
246 		goto exit_cleanly;
247 	}
248 
249 	memcpy(esas2r_buffered_ioctl, bi->ioctl, bi->length);
250 
251 	rq = esas2r_alloc_request(a);
252 	if (rq == NULL) {
253 		esas2r_log(ESAS2R_LOG_CRIT,
254 			   "could not allocate an internal request");
255 
256 		result = IOCTL_OUT_OF_RESOURCES;
257 		esas2r_debug("buffered ioctl - no requests");
258 		goto exit_cleanly;
259 	}
260 
261 	a->buffered_ioctl_done = 0;
262 	rq->comp_cb = complete_buffered_ioctl_req;
263 	sgc.cur_offset = esas2r_buffered_ioctl + bi->offset;
264 	sgc.get_phys_addr = (PGETPHYSADDR)get_physaddr_buffered_ioctl;
265 	sgc.length = esas2r_buffered_ioctl_size;
266 
267 	if (!(*bi->callback)(a, rq, &sgc, bi->context)) {
268 		/* completed immediately, no need to wait */
269 		a->buffered_ioctl_done = 0;
270 		goto free_andexit_cleanly;
271 	}
272 
273 	/* now wait around for it to complete. */
274 	while (!a->buffered_ioctl_done)
275 		wait_event_interruptible(a->buffered_ioctl_waiter,
276 					 a->buffered_ioctl_done);
277 
278 free_andexit_cleanly:
279 	if (result == IOCTL_SUCCESS && bi->done_callback)
280 		(*bi->done_callback)(a, rq, bi->done_context);
281 
282 	esas2r_free_request(a, rq);
283 
284 exit_cleanly:
285 	if (result == IOCTL_SUCCESS)
286 		memcpy(bi->ioctl, esas2r_buffered_ioctl, bi->length);
287 
288 	up(&buffered_ioctl_semaphore);
289 	return result;
290 }
291 
292 /* SMP ioctl support */
293 static int smp_ioctl_callback(struct esas2r_adapter *a,
294 			      struct esas2r_request *rq,
295 			      struct esas2r_sg_context *sgc, void *context)
296 {
297 	struct atto_ioctl_smp *si =
298 		(struct atto_ioctl_smp *)esas2r_buffered_ioctl;
299 
300 	esas2r_sgc_init(sgc, a, rq, rq->vrq->ioctl.sge);
301 	esas2r_build_ioctl_req(a, rq, sgc->length, VDA_IOCTL_SMP);
302 
303 	if (!esas2r_build_sg_list(a, rq, sgc)) {
304 		si->status = ATTO_STS_OUT_OF_RSRC;
305 		return false;
306 	}
307 
308 	esas2r_start_request(a, rq);
309 	return true;
310 }
311 
312 static u8 handle_smp_ioctl(struct esas2r_adapter *a, struct atto_ioctl_smp *si)
313 {
314 	struct esas2r_buffered_ioctl bi;
315 
316 	memset(&bi, 0, sizeof(bi));
317 
318 	bi.a = a;
319 	bi.ioctl = si;
320 	bi.length = sizeof(struct atto_ioctl_smp)
321 		    + le32_to_cpu(si->req_length)
322 		    + le32_to_cpu(si->rsp_length);
323 	bi.offset = 0;
324 	bi.callback = smp_ioctl_callback;
325 	return handle_buffered_ioctl(&bi);
326 }
327 
328 
329 /* CSMI ioctl support */
330 static void esas2r_csmi_ioctl_tunnel_comp_cb(struct esas2r_adapter *a,
331 					     struct esas2r_request *rq)
332 {
333 	rq->target_id = le16_to_cpu(rq->func_rsp.ioctl_rsp.csmi.target_id);
334 	rq->vrq->scsi.flags |= cpu_to_le32(rq->func_rsp.ioctl_rsp.csmi.lun);
335 
336 	/* Now call the original completion callback. */
337 	(*rq->aux_req_cb)(a, rq);
338 }
339 
340 /* Tunnel a CSMI IOCTL to the back end driver for processing. */
341 static bool csmi_ioctl_tunnel(struct esas2r_adapter *a,
342 			      union atto_ioctl_csmi *ci,
343 			      struct esas2r_request *rq,
344 			      struct esas2r_sg_context *sgc,
345 			      u32 ctrl_code,
346 			      u16 target_id)
347 {
348 	struct atto_vda_ioctl_req *ioctl = &rq->vrq->ioctl;
349 
350 	if (test_bit(AF_DEGRADED_MODE, &a->flags))
351 		return false;
352 
353 	esas2r_sgc_init(sgc, a, rq, rq->vrq->ioctl.sge);
354 	esas2r_build_ioctl_req(a, rq, sgc->length, VDA_IOCTL_CSMI);
355 	ioctl->csmi.ctrl_code = cpu_to_le32(ctrl_code);
356 	ioctl->csmi.target_id = cpu_to_le16(target_id);
357 	ioctl->csmi.lun = (u8)le32_to_cpu(rq->vrq->scsi.flags);
358 
359 	/*
360 	 * Always usurp the completion callback since the interrupt callback
361 	 * mechanism may be used.
362 	 */
363 	rq->aux_req_cx = ci;
364 	rq->aux_req_cb = rq->comp_cb;
365 	rq->comp_cb = esas2r_csmi_ioctl_tunnel_comp_cb;
366 
367 	if (!esas2r_build_sg_list(a, rq, sgc))
368 		return false;
369 
370 	esas2r_start_request(a, rq);
371 	return true;
372 }
373 
374 static bool check_lun(struct scsi_lun lun)
375 {
376 	bool result;
377 
378 	result = ((lun.scsi_lun[7] == 0) &&
379 		  (lun.scsi_lun[6] == 0) &&
380 		  (lun.scsi_lun[5] == 0) &&
381 		  (lun.scsi_lun[4] == 0) &&
382 		  (lun.scsi_lun[3] == 0) &&
383 		  (lun.scsi_lun[2] == 0) &&
384 /* Byte 1 is intentionally skipped */
385 		  (lun.scsi_lun[0] == 0));
386 
387 	return result;
388 }
389 
390 static int csmi_ioctl_callback(struct esas2r_adapter *a,
391 			       struct esas2r_request *rq,
392 			       struct esas2r_sg_context *sgc, void *context)
393 {
394 	struct atto_csmi *ci = (struct atto_csmi *)context;
395 	union atto_ioctl_csmi *ioctl_csmi =
396 		(union atto_ioctl_csmi *)esas2r_buffered_ioctl;
397 	u8 path = 0;
398 	u8 tid = 0;
399 	u8 lun = 0;
400 	u32 sts = CSMI_STS_SUCCESS;
401 	struct esas2r_target *t;
402 	unsigned long flags;
403 
404 	if (ci->control_code == CSMI_CC_GET_DEV_ADDR) {
405 		struct atto_csmi_get_dev_addr *gda = &ci->data.dev_addr;
406 
407 		path = gda->path_id;
408 		tid = gda->target_id;
409 		lun = gda->lun;
410 	} else if (ci->control_code == CSMI_CC_TASK_MGT) {
411 		struct atto_csmi_task_mgmt *tm = &ci->data.tsk_mgt;
412 
413 		path = tm->path_id;
414 		tid = tm->target_id;
415 		lun = tm->lun;
416 	}
417 
418 	if (path > 0) {
419 		rq->func_rsp.ioctl_rsp.csmi.csmi_status = cpu_to_le32(
420 			CSMI_STS_INV_PARAM);
421 		return false;
422 	}
423 
424 	rq->target_id = tid;
425 	rq->vrq->scsi.flags |= cpu_to_le32(lun);
426 
427 	switch (ci->control_code) {
428 	case CSMI_CC_GET_DRVR_INFO:
429 	{
430 		struct atto_csmi_get_driver_info *gdi = &ioctl_csmi->drvr_info;
431 
432 		strcpy(gdi->description, esas2r_get_model_name(a));
433 		gdi->csmi_major_rev = CSMI_MAJOR_REV;
434 		gdi->csmi_minor_rev = CSMI_MINOR_REV;
435 		break;
436 	}
437 
438 	case CSMI_CC_GET_CNTLR_CFG:
439 	{
440 		struct atto_csmi_get_cntlr_cfg *gcc = &ioctl_csmi->cntlr_cfg;
441 
442 		gcc->base_io_addr = 0;
443 		pci_read_config_dword(a->pcid, PCI_BASE_ADDRESS_2,
444 				      &gcc->base_memaddr_lo);
445 		pci_read_config_dword(a->pcid, PCI_BASE_ADDRESS_3,
446 				      &gcc->base_memaddr_hi);
447 		gcc->board_id = MAKEDWORD(a->pcid->subsystem_device,
448 					  a->pcid->subsystem_vendor);
449 		gcc->slot_num = CSMI_SLOT_NUM_UNKNOWN;
450 		gcc->cntlr_class = CSMI_CNTLR_CLASS_HBA;
451 		gcc->io_bus_type = CSMI_BUS_TYPE_PCI;
452 		gcc->pci_addr.bus_num = a->pcid->bus->number;
453 		gcc->pci_addr.device_num = PCI_SLOT(a->pcid->devfn);
454 		gcc->pci_addr.function_num = PCI_FUNC(a->pcid->devfn);
455 
456 		memset(gcc->serial_num, 0, sizeof(gcc->serial_num));
457 
458 		gcc->major_rev = LOBYTE(LOWORD(a->fw_version));
459 		gcc->minor_rev = HIBYTE(LOWORD(a->fw_version));
460 		gcc->build_rev = LOBYTE(HIWORD(a->fw_version));
461 		gcc->release_rev = HIBYTE(HIWORD(a->fw_version));
462 		gcc->bios_major_rev = HIBYTE(HIWORD(a->flash_ver));
463 		gcc->bios_minor_rev = LOBYTE(HIWORD(a->flash_ver));
464 		gcc->bios_build_rev = LOWORD(a->flash_ver);
465 
466 		if (test_bit(AF2_THUNDERLINK, &a->flags2))
467 			gcc->cntlr_flags = CSMI_CNTLRF_SAS_HBA
468 					   | CSMI_CNTLRF_SATA_HBA;
469 		else
470 			gcc->cntlr_flags = CSMI_CNTLRF_SAS_RAID
471 					   | CSMI_CNTLRF_SATA_RAID;
472 
473 		gcc->rrom_major_rev = 0;
474 		gcc->rrom_minor_rev = 0;
475 		gcc->rrom_build_rev = 0;
476 		gcc->rrom_release_rev = 0;
477 		gcc->rrom_biosmajor_rev = 0;
478 		gcc->rrom_biosminor_rev = 0;
479 		gcc->rrom_biosbuild_rev = 0;
480 		gcc->rrom_biosrelease_rev = 0;
481 		break;
482 	}
483 
484 	case CSMI_CC_GET_CNTLR_STS:
485 	{
486 		struct atto_csmi_get_cntlr_sts *gcs = &ioctl_csmi->cntlr_sts;
487 
488 		if (test_bit(AF_DEGRADED_MODE, &a->flags))
489 			gcs->status = CSMI_CNTLR_STS_FAILED;
490 		else
491 			gcs->status = CSMI_CNTLR_STS_GOOD;
492 
493 		gcs->offline_reason = CSMI_OFFLINE_NO_REASON;
494 		break;
495 	}
496 
497 	case CSMI_CC_FW_DOWNLOAD:
498 	case CSMI_CC_GET_RAID_INFO:
499 	case CSMI_CC_GET_RAID_CFG:
500 
501 		sts = CSMI_STS_BAD_CTRL_CODE;
502 		break;
503 
504 	case CSMI_CC_SMP_PASSTHRU:
505 	case CSMI_CC_SSP_PASSTHRU:
506 	case CSMI_CC_STP_PASSTHRU:
507 	case CSMI_CC_GET_PHY_INFO:
508 	case CSMI_CC_SET_PHY_INFO:
509 	case CSMI_CC_GET_LINK_ERRORS:
510 	case CSMI_CC_GET_SATA_SIG:
511 	case CSMI_CC_GET_CONN_INFO:
512 	case CSMI_CC_PHY_CTRL:
513 
514 		if (!csmi_ioctl_tunnel(a, ioctl_csmi, rq, sgc,
515 				       ci->control_code,
516 				       ESAS2R_TARG_ID_INV)) {
517 			sts = CSMI_STS_FAILED;
518 			break;
519 		}
520 
521 		return true;
522 
523 	case CSMI_CC_GET_SCSI_ADDR:
524 	{
525 		struct atto_csmi_get_scsi_addr *gsa = &ioctl_csmi->scsi_addr;
526 
527 		struct scsi_lun lun;
528 
529 		memcpy(&lun, gsa->sas_lun, sizeof(struct scsi_lun));
530 
531 		if (!check_lun(lun)) {
532 			sts = CSMI_STS_NO_SCSI_ADDR;
533 			break;
534 		}
535 
536 		/* make sure the device is present */
537 		spin_lock_irqsave(&a->mem_lock, flags);
538 		t = esas2r_targ_db_find_by_sas_addr(a, (u64 *)gsa->sas_addr);
539 		spin_unlock_irqrestore(&a->mem_lock, flags);
540 
541 		if (t == NULL) {
542 			sts = CSMI_STS_NO_SCSI_ADDR;
543 			break;
544 		}
545 
546 		gsa->host_index = 0xFF;
547 		gsa->lun = gsa->sas_lun[1];
548 		rq->target_id = esas2r_targ_get_id(t, a);
549 		break;
550 	}
551 
552 	case CSMI_CC_GET_DEV_ADDR:
553 	{
554 		struct atto_csmi_get_dev_addr *gda = &ioctl_csmi->dev_addr;
555 
556 		/* make sure the target is present */
557 		t = a->targetdb + rq->target_id;
558 
559 		if (t >= a->targetdb_end
560 		    || t->target_state != TS_PRESENT
561 		    || t->sas_addr == 0) {
562 			sts = CSMI_STS_NO_DEV_ADDR;
563 			break;
564 		}
565 
566 		/* fill in the result */
567 		*(u64 *)gda->sas_addr = t->sas_addr;
568 		memset(gda->sas_lun, 0, sizeof(gda->sas_lun));
569 		gda->sas_lun[1] = (u8)le32_to_cpu(rq->vrq->scsi.flags);
570 		break;
571 	}
572 
573 	case CSMI_CC_TASK_MGT:
574 
575 		/* make sure the target is present */
576 		t = a->targetdb + rq->target_id;
577 
578 		if (t >= a->targetdb_end
579 		    || t->target_state != TS_PRESENT
580 		    || !(t->flags & TF_PASS_THRU)) {
581 			sts = CSMI_STS_NO_DEV_ADDR;
582 			break;
583 		}
584 
585 		if (!csmi_ioctl_tunnel(a, ioctl_csmi, rq, sgc,
586 				       ci->control_code,
587 				       t->phys_targ_id)) {
588 			sts = CSMI_STS_FAILED;
589 			break;
590 		}
591 
592 		return true;
593 
594 	default:
595 
596 		sts = CSMI_STS_BAD_CTRL_CODE;
597 		break;
598 	}
599 
600 	rq->func_rsp.ioctl_rsp.csmi.csmi_status = cpu_to_le32(sts);
601 
602 	return false;
603 }
604 
605 
606 static void csmi_ioctl_done_callback(struct esas2r_adapter *a,
607 				     struct esas2r_request *rq, void *context)
608 {
609 	struct atto_csmi *ci = (struct atto_csmi *)context;
610 	union atto_ioctl_csmi *ioctl_csmi =
611 		(union atto_ioctl_csmi *)esas2r_buffered_ioctl;
612 
613 	switch (ci->control_code) {
614 	case CSMI_CC_GET_DRVR_INFO:
615 	{
616 		struct atto_csmi_get_driver_info *gdi =
617 			&ioctl_csmi->drvr_info;
618 
619 		strcpy(gdi->name, ESAS2R_VERSION_STR);
620 
621 		gdi->major_rev = ESAS2R_MAJOR_REV;
622 		gdi->minor_rev = ESAS2R_MINOR_REV;
623 		gdi->build_rev = 0;
624 		gdi->release_rev = 0;
625 		break;
626 	}
627 
628 	case CSMI_CC_GET_SCSI_ADDR:
629 	{
630 		struct atto_csmi_get_scsi_addr *gsa = &ioctl_csmi->scsi_addr;
631 
632 		if (le32_to_cpu(rq->func_rsp.ioctl_rsp.csmi.csmi_status) ==
633 		    CSMI_STS_SUCCESS) {
634 			gsa->target_id = rq->target_id;
635 			gsa->path_id = 0;
636 		}
637 
638 		break;
639 	}
640 	}
641 
642 	ci->status = le32_to_cpu(rq->func_rsp.ioctl_rsp.csmi.csmi_status);
643 }
644 
645 
646 static u8 handle_csmi_ioctl(struct esas2r_adapter *a, struct atto_csmi *ci)
647 {
648 	struct esas2r_buffered_ioctl bi;
649 
650 	memset(&bi, 0, sizeof(bi));
651 
652 	bi.a = a;
653 	bi.ioctl = &ci->data;
654 	bi.length = sizeof(union atto_ioctl_csmi);
655 	bi.offset = 0;
656 	bi.callback = csmi_ioctl_callback;
657 	bi.context = ci;
658 	bi.done_callback = csmi_ioctl_done_callback;
659 	bi.done_context = ci;
660 
661 	return handle_buffered_ioctl(&bi);
662 }
663 
664 /* ATTO HBA ioctl support */
665 
666 /* Tunnel an ATTO HBA IOCTL to the back end driver for processing. */
667 static bool hba_ioctl_tunnel(struct esas2r_adapter *a,
668 			     struct atto_ioctl *hi,
669 			     struct esas2r_request *rq,
670 			     struct esas2r_sg_context *sgc)
671 {
672 	esas2r_sgc_init(sgc, a, rq, rq->vrq->ioctl.sge);
673 
674 	esas2r_build_ioctl_req(a, rq, sgc->length, VDA_IOCTL_HBA);
675 
676 	if (!esas2r_build_sg_list(a, rq, sgc)) {
677 		hi->status = ATTO_STS_OUT_OF_RSRC;
678 
679 		return false;
680 	}
681 
682 	esas2r_start_request(a, rq);
683 
684 	return true;
685 }
686 
687 static void scsi_passthru_comp_cb(struct esas2r_adapter *a,
688 				  struct esas2r_request *rq)
689 {
690 	struct atto_ioctl *hi = (struct atto_ioctl *)rq->aux_req_cx;
691 	struct atto_hba_scsi_pass_thru *spt = &hi->data.scsi_pass_thru;
692 	u8 sts = ATTO_SPT_RS_FAILED;
693 
694 	spt->scsi_status = rq->func_rsp.scsi_rsp.scsi_stat;
695 	spt->sense_length = rq->sense_len;
696 	spt->residual_length =
697 		le32_to_cpu(rq->func_rsp.scsi_rsp.residual_length);
698 
699 	switch (rq->req_stat) {
700 	case RS_SUCCESS:
701 	case RS_SCSI_ERROR:
702 		sts = ATTO_SPT_RS_SUCCESS;
703 		break;
704 	case RS_UNDERRUN:
705 		sts = ATTO_SPT_RS_UNDERRUN;
706 		break;
707 	case RS_OVERRUN:
708 		sts = ATTO_SPT_RS_OVERRUN;
709 		break;
710 	case RS_SEL:
711 	case RS_SEL2:
712 		sts = ATTO_SPT_RS_NO_DEVICE;
713 		break;
714 	case RS_NO_LUN:
715 		sts = ATTO_SPT_RS_NO_LUN;
716 		break;
717 	case RS_TIMEOUT:
718 		sts = ATTO_SPT_RS_TIMEOUT;
719 		break;
720 	case RS_DEGRADED:
721 		sts = ATTO_SPT_RS_DEGRADED;
722 		break;
723 	case RS_BUSY:
724 		sts = ATTO_SPT_RS_BUSY;
725 		break;
726 	case RS_ABORTED:
727 		sts = ATTO_SPT_RS_ABORTED;
728 		break;
729 	case RS_RESET:
730 		sts = ATTO_SPT_RS_BUS_RESET;
731 		break;
732 	}
733 
734 	spt->req_status = sts;
735 
736 	/* Update the target ID to the next one present. */
737 	spt->target_id =
738 		esas2r_targ_db_find_next_present(a, (u16)spt->target_id);
739 
740 	/* Done, call the completion callback. */
741 	(*rq->aux_req_cb)(a, rq);
742 }
743 
744 static int hba_ioctl_callback(struct esas2r_adapter *a,
745 			      struct esas2r_request *rq,
746 			      struct esas2r_sg_context *sgc,
747 			      void *context)
748 {
749 	struct atto_ioctl *hi = (struct atto_ioctl *)esas2r_buffered_ioctl;
750 
751 	hi->status = ATTO_STS_SUCCESS;
752 
753 	switch (hi->function) {
754 	case ATTO_FUNC_GET_ADAP_INFO:
755 	{
756 		u8 *class_code = (u8 *)&a->pcid->class;
757 
758 		struct atto_hba_get_adapter_info *gai =
759 			&hi->data.get_adap_info;
760 
761 		if (hi->flags & HBAF_TUNNEL) {
762 			hi->status = ATTO_STS_UNSUPPORTED;
763 			break;
764 		}
765 
766 		if (hi->version > ATTO_VER_GET_ADAP_INFO0) {
767 			hi->status = ATTO_STS_INV_VERSION;
768 			hi->version = ATTO_VER_GET_ADAP_INFO0;
769 			break;
770 		}
771 
772 		memset(gai, 0, sizeof(*gai));
773 
774 		gai->pci.vendor_id = a->pcid->vendor;
775 		gai->pci.device_id = a->pcid->device;
776 		gai->pci.ss_vendor_id = a->pcid->subsystem_vendor;
777 		gai->pci.ss_device_id = a->pcid->subsystem_device;
778 		gai->pci.class_code[0] = class_code[0];
779 		gai->pci.class_code[1] = class_code[1];
780 		gai->pci.class_code[2] = class_code[2];
781 		gai->pci.rev_id = a->pcid->revision;
782 		gai->pci.bus_num = a->pcid->bus->number;
783 		gai->pci.dev_num = PCI_SLOT(a->pcid->devfn);
784 		gai->pci.func_num = PCI_FUNC(a->pcid->devfn);
785 
786 		if (pci_is_pcie(a->pcid)) {
787 			u16 stat;
788 			u32 caps;
789 
790 			pcie_capability_read_word(a->pcid, PCI_EXP_LNKSTA,
791 						  &stat);
792 			pcie_capability_read_dword(a->pcid, PCI_EXP_LNKCAP,
793 						   &caps);
794 
795 			gai->pci.link_speed_curr =
796 				(u8)(stat & PCI_EXP_LNKSTA_CLS);
797 			gai->pci.link_speed_max =
798 				(u8)(caps & PCI_EXP_LNKCAP_SLS);
799 			gai->pci.link_width_curr =
800 				(u8)((stat & PCI_EXP_LNKSTA_NLW)
801 				     >> PCI_EXP_LNKSTA_NLW_SHIFT);
802 			gai->pci.link_width_max =
803 				(u8)((caps & PCI_EXP_LNKCAP_MLW)
804 				     >> 4);
805 		}
806 
807 		gai->pci.msi_vector_cnt = 1;
808 
809 		if (a->pcid->msix_enabled)
810 			gai->pci.interrupt_mode = ATTO_GAI_PCIIM_MSIX;
811 		else if (a->pcid->msi_enabled)
812 			gai->pci.interrupt_mode = ATTO_GAI_PCIIM_MSI;
813 		else
814 			gai->pci.interrupt_mode = ATTO_GAI_PCIIM_LEGACY;
815 
816 		gai->adap_type = ATTO_GAI_AT_ESASRAID2;
817 
818 		if (test_bit(AF2_THUNDERLINK, &a->flags2))
819 			gai->adap_type = ATTO_GAI_AT_TLSASHBA;
820 
821 		if (test_bit(AF_DEGRADED_MODE, &a->flags))
822 			gai->adap_flags |= ATTO_GAI_AF_DEGRADED;
823 
824 		gai->adap_flags |= ATTO_GAI_AF_SPT_SUPP |
825 				   ATTO_GAI_AF_DEVADDR_SUPP;
826 
827 		if (a->pcid->subsystem_device == ATTO_ESAS_R60F
828 		    || a->pcid->subsystem_device == ATTO_ESAS_R608
829 		    || a->pcid->subsystem_device == ATTO_ESAS_R644
830 		    || a->pcid->subsystem_device == ATTO_TSSC_3808E)
831 			gai->adap_flags |= ATTO_GAI_AF_VIRT_SES;
832 
833 		gai->num_ports = ESAS2R_NUM_PHYS;
834 		gai->num_phys = ESAS2R_NUM_PHYS;
835 
836 		strcpy(gai->firmware_rev, a->fw_rev);
837 		strcpy(gai->flash_rev, a->flash_rev);
838 		strcpy(gai->model_name_short, esas2r_get_model_name_short(a));
839 		strcpy(gai->model_name, esas2r_get_model_name(a));
840 
841 		gai->num_targets = ESAS2R_MAX_TARGETS;
842 
843 		gai->num_busses = 1;
844 		gai->num_targsper_bus = gai->num_targets;
845 		gai->num_lunsper_targ = 256;
846 
847 		if (a->pcid->subsystem_device == ATTO_ESAS_R6F0
848 		    || a->pcid->subsystem_device == ATTO_ESAS_R60F)
849 			gai->num_connectors = 4;
850 		else
851 			gai->num_connectors = 2;
852 
853 		gai->adap_flags2 |= ATTO_GAI_AF2_ADAP_CTRL_SUPP;
854 
855 		gai->num_targets_backend = a->num_targets_backend;
856 
857 		gai->tunnel_flags = a->ioctl_tunnel
858 				    & (ATTO_GAI_TF_MEM_RW
859 				       | ATTO_GAI_TF_TRACE
860 				       | ATTO_GAI_TF_SCSI_PASS_THRU
861 				       | ATTO_GAI_TF_GET_DEV_ADDR
862 				       | ATTO_GAI_TF_PHY_CTRL
863 				       | ATTO_GAI_TF_CONN_CTRL
864 				       | ATTO_GAI_TF_GET_DEV_INFO);
865 		break;
866 	}
867 
868 	case ATTO_FUNC_GET_ADAP_ADDR:
869 	{
870 		struct atto_hba_get_adapter_address *gaa =
871 			&hi->data.get_adap_addr;
872 
873 		if (hi->flags & HBAF_TUNNEL) {
874 			hi->status = ATTO_STS_UNSUPPORTED;
875 			break;
876 		}
877 
878 		if (hi->version > ATTO_VER_GET_ADAP_ADDR0) {
879 			hi->status = ATTO_STS_INV_VERSION;
880 			hi->version = ATTO_VER_GET_ADAP_ADDR0;
881 		} else if (gaa->addr_type == ATTO_GAA_AT_PORT
882 			   || gaa->addr_type == ATTO_GAA_AT_NODE) {
883 			if (gaa->addr_type == ATTO_GAA_AT_PORT
884 			    && gaa->port_id >= ESAS2R_NUM_PHYS) {
885 				hi->status = ATTO_STS_NOT_APPL;
886 			} else {
887 				memcpy((u64 *)gaa->address,
888 				       &a->nvram->sas_addr[0], sizeof(u64));
889 				gaa->addr_len = sizeof(u64);
890 			}
891 		} else {
892 			hi->status = ATTO_STS_INV_PARAM;
893 		}
894 
895 		break;
896 	}
897 
898 	case ATTO_FUNC_MEM_RW:
899 	{
900 		if (hi->flags & HBAF_TUNNEL) {
901 			if (hba_ioctl_tunnel(a, hi, rq, sgc))
902 				return true;
903 
904 			break;
905 		}
906 
907 		hi->status = ATTO_STS_UNSUPPORTED;
908 
909 		break;
910 	}
911 
912 	case ATTO_FUNC_TRACE:
913 	{
914 		struct atto_hba_trace *trc = &hi->data.trace;
915 
916 		if (hi->flags & HBAF_TUNNEL) {
917 			if (hba_ioctl_tunnel(a, hi, rq, sgc))
918 				return true;
919 
920 			break;
921 		}
922 
923 		if (hi->version > ATTO_VER_TRACE1) {
924 			hi->status = ATTO_STS_INV_VERSION;
925 			hi->version = ATTO_VER_TRACE1;
926 			break;
927 		}
928 
929 		if (trc->trace_type == ATTO_TRC_TT_FWCOREDUMP
930 		    && hi->version >= ATTO_VER_TRACE1) {
931 			if (trc->trace_func == ATTO_TRC_TF_UPLOAD) {
932 				u32 len = hi->data_length;
933 				u32 offset = trc->current_offset;
934 				u32 total_len = ESAS2R_FWCOREDUMP_SZ;
935 
936 				/* Size is zero if a core dump isn't present */
937 				if (!test_bit(AF2_COREDUMP_SAVED, &a->flags2))
938 					total_len = 0;
939 
940 				if (len > total_len)
941 					len = total_len;
942 
943 				if (offset >= total_len
944 				    || offset + len > total_len
945 				    || len == 0) {
946 					hi->status = ATTO_STS_INV_PARAM;
947 					break;
948 				}
949 
950 				memcpy(trc->contents,
951 				       a->fw_coredump_buff + offset,
952 				       len);
953 				hi->data_length = len;
954 			} else if (trc->trace_func == ATTO_TRC_TF_RESET) {
955 				memset(a->fw_coredump_buff, 0,
956 				       ESAS2R_FWCOREDUMP_SZ);
957 
958 				clear_bit(AF2_COREDUMP_SAVED, &a->flags2);
959 			} else if (trc->trace_func != ATTO_TRC_TF_GET_INFO) {
960 				hi->status = ATTO_STS_UNSUPPORTED;
961 				break;
962 			}
963 
964 			/* Always return all the info we can. */
965 			trc->trace_mask = 0;
966 			trc->current_offset = 0;
967 			trc->total_length = ESAS2R_FWCOREDUMP_SZ;
968 
969 			/* Return zero length buffer if core dump not present */
970 			if (!test_bit(AF2_COREDUMP_SAVED, &a->flags2))
971 				trc->total_length = 0;
972 		} else {
973 			hi->status = ATTO_STS_UNSUPPORTED;
974 		}
975 
976 		break;
977 	}
978 
979 	case ATTO_FUNC_SCSI_PASS_THRU:
980 	{
981 		struct atto_hba_scsi_pass_thru *spt = &hi->data.scsi_pass_thru;
982 		struct scsi_lun lun;
983 
984 		memcpy(&lun, spt->lun, sizeof(struct scsi_lun));
985 
986 		if (hi->flags & HBAF_TUNNEL) {
987 			if (hba_ioctl_tunnel(a, hi, rq, sgc))
988 				return true;
989 
990 			break;
991 		}
992 
993 		if (hi->version > ATTO_VER_SCSI_PASS_THRU0) {
994 			hi->status = ATTO_STS_INV_VERSION;
995 			hi->version = ATTO_VER_SCSI_PASS_THRU0;
996 			break;
997 		}
998 
999 		if (spt->target_id >= ESAS2R_MAX_TARGETS || !check_lun(lun)) {
1000 			hi->status = ATTO_STS_INV_PARAM;
1001 			break;
1002 		}
1003 
1004 		esas2r_sgc_init(sgc, a, rq, NULL);
1005 
1006 		sgc->length = hi->data_length;
1007 		sgc->cur_offset += offsetof(struct atto_ioctl, data.byte)
1008 				   + sizeof(struct atto_hba_scsi_pass_thru);
1009 
1010 		/* Finish request initialization */
1011 		rq->target_id = (u16)spt->target_id;
1012 		rq->vrq->scsi.flags |= cpu_to_le32(spt->lun[1]);
1013 		memcpy(rq->vrq->scsi.cdb, spt->cdb, 16);
1014 		rq->vrq->scsi.length = cpu_to_le32(hi->data_length);
1015 		rq->sense_len = spt->sense_length;
1016 		rq->sense_buf = (u8 *)spt->sense_data;
1017 		/* NOTE: we ignore spt->timeout */
1018 
1019 		/*
1020 		 * always usurp the completion callback since the interrupt
1021 		 * callback mechanism may be used.
1022 		 */
1023 
1024 		rq->aux_req_cx = hi;
1025 		rq->aux_req_cb = rq->comp_cb;
1026 		rq->comp_cb = scsi_passthru_comp_cb;
1027 
1028 		if (spt->flags & ATTO_SPTF_DATA_IN) {
1029 			rq->vrq->scsi.flags |= cpu_to_le32(FCP_CMND_RDD);
1030 		} else if (spt->flags & ATTO_SPTF_DATA_OUT) {
1031 			rq->vrq->scsi.flags |= cpu_to_le32(FCP_CMND_WRD);
1032 		} else {
1033 			if (sgc->length) {
1034 				hi->status = ATTO_STS_INV_PARAM;
1035 				break;
1036 			}
1037 		}
1038 
1039 		if (spt->flags & ATTO_SPTF_ORDERED_Q)
1040 			rq->vrq->scsi.flags |=
1041 				cpu_to_le32(FCP_CMND_TA_ORDRD_Q);
1042 		else if (spt->flags & ATTO_SPTF_HEAD_OF_Q)
1043 			rq->vrq->scsi.flags |= cpu_to_le32(FCP_CMND_TA_HEAD_Q);
1044 
1045 
1046 		if (!esas2r_build_sg_list(a, rq, sgc)) {
1047 			hi->status = ATTO_STS_OUT_OF_RSRC;
1048 			break;
1049 		}
1050 
1051 		esas2r_start_request(a, rq);
1052 
1053 		return true;
1054 	}
1055 
1056 	case ATTO_FUNC_GET_DEV_ADDR:
1057 	{
1058 		struct atto_hba_get_device_address *gda =
1059 			&hi->data.get_dev_addr;
1060 		struct esas2r_target *t;
1061 
1062 		if (hi->flags & HBAF_TUNNEL) {
1063 			if (hba_ioctl_tunnel(a, hi, rq, sgc))
1064 				return true;
1065 
1066 			break;
1067 		}
1068 
1069 		if (hi->version > ATTO_VER_GET_DEV_ADDR0) {
1070 			hi->status = ATTO_STS_INV_VERSION;
1071 			hi->version = ATTO_VER_GET_DEV_ADDR0;
1072 			break;
1073 		}
1074 
1075 		if (gda->target_id >= ESAS2R_MAX_TARGETS) {
1076 			hi->status = ATTO_STS_INV_PARAM;
1077 			break;
1078 		}
1079 
1080 		t = a->targetdb + (u16)gda->target_id;
1081 
1082 		if (t->target_state != TS_PRESENT) {
1083 			hi->status = ATTO_STS_FAILED;
1084 		} else if (gda->addr_type == ATTO_GDA_AT_PORT) {
1085 			if (t->sas_addr == 0) {
1086 				hi->status = ATTO_STS_UNSUPPORTED;
1087 			} else {
1088 				*(u64 *)gda->address = t->sas_addr;
1089 
1090 				gda->addr_len = sizeof(u64);
1091 			}
1092 		} else if (gda->addr_type == ATTO_GDA_AT_NODE) {
1093 			hi->status = ATTO_STS_NOT_APPL;
1094 		} else {
1095 			hi->status = ATTO_STS_INV_PARAM;
1096 		}
1097 
1098 		/* update the target ID to the next one present. */
1099 
1100 		gda->target_id =
1101 			esas2r_targ_db_find_next_present(a,
1102 							 (u16)gda->target_id);
1103 		break;
1104 	}
1105 
1106 	case ATTO_FUNC_PHY_CTRL:
1107 	case ATTO_FUNC_CONN_CTRL:
1108 	{
1109 		if (hba_ioctl_tunnel(a, hi, rq, sgc))
1110 			return true;
1111 
1112 		break;
1113 	}
1114 
1115 	case ATTO_FUNC_ADAP_CTRL:
1116 	{
1117 		struct atto_hba_adap_ctrl *ac = &hi->data.adap_ctrl;
1118 
1119 		if (hi->flags & HBAF_TUNNEL) {
1120 			hi->status = ATTO_STS_UNSUPPORTED;
1121 			break;
1122 		}
1123 
1124 		if (hi->version > ATTO_VER_ADAP_CTRL0) {
1125 			hi->status = ATTO_STS_INV_VERSION;
1126 			hi->version = ATTO_VER_ADAP_CTRL0;
1127 			break;
1128 		}
1129 
1130 		if (ac->adap_func == ATTO_AC_AF_HARD_RST) {
1131 			esas2r_reset_adapter(a);
1132 		} else if (ac->adap_func != ATTO_AC_AF_GET_STATE) {
1133 			hi->status = ATTO_STS_UNSUPPORTED;
1134 			break;
1135 		}
1136 
1137 		if (test_bit(AF_CHPRST_NEEDED, &a->flags))
1138 			ac->adap_state = ATTO_AC_AS_RST_SCHED;
1139 		else if (test_bit(AF_CHPRST_PENDING, &a->flags))
1140 			ac->adap_state = ATTO_AC_AS_RST_IN_PROG;
1141 		else if (test_bit(AF_DISC_PENDING, &a->flags))
1142 			ac->adap_state = ATTO_AC_AS_RST_DISC;
1143 		else if (test_bit(AF_DISABLED, &a->flags))
1144 			ac->adap_state = ATTO_AC_AS_DISABLED;
1145 		else if (test_bit(AF_DEGRADED_MODE, &a->flags))
1146 			ac->adap_state = ATTO_AC_AS_DEGRADED;
1147 		else
1148 			ac->adap_state = ATTO_AC_AS_OK;
1149 
1150 		break;
1151 	}
1152 
1153 	case ATTO_FUNC_GET_DEV_INFO:
1154 	{
1155 		struct atto_hba_get_device_info *gdi = &hi->data.get_dev_info;
1156 		struct esas2r_target *t;
1157 
1158 		if (hi->flags & HBAF_TUNNEL) {
1159 			if (hba_ioctl_tunnel(a, hi, rq, sgc))
1160 				return true;
1161 
1162 			break;
1163 		}
1164 
1165 		if (hi->version > ATTO_VER_GET_DEV_INFO0) {
1166 			hi->status = ATTO_STS_INV_VERSION;
1167 			hi->version = ATTO_VER_GET_DEV_INFO0;
1168 			break;
1169 		}
1170 
1171 		if (gdi->target_id >= ESAS2R_MAX_TARGETS) {
1172 			hi->status = ATTO_STS_INV_PARAM;
1173 			break;
1174 		}
1175 
1176 		t = a->targetdb + (u16)gdi->target_id;
1177 
1178 		/* update the target ID to the next one present. */
1179 
1180 		gdi->target_id =
1181 			esas2r_targ_db_find_next_present(a,
1182 							 (u16)gdi->target_id);
1183 
1184 		if (t->target_state != TS_PRESENT) {
1185 			hi->status = ATTO_STS_FAILED;
1186 			break;
1187 		}
1188 
1189 		hi->status = ATTO_STS_UNSUPPORTED;
1190 		break;
1191 	}
1192 
1193 	default:
1194 
1195 		hi->status = ATTO_STS_INV_FUNC;
1196 		break;
1197 	}
1198 
1199 	return false;
1200 }
1201 
1202 static void hba_ioctl_done_callback(struct esas2r_adapter *a,
1203 				    struct esas2r_request *rq, void *context)
1204 {
1205 	struct atto_ioctl *ioctl_hba =
1206 		(struct atto_ioctl *)esas2r_buffered_ioctl;
1207 
1208 	esas2r_debug("hba_ioctl_done_callback %d", a->index);
1209 
1210 	if (ioctl_hba->function == ATTO_FUNC_GET_ADAP_INFO) {
1211 		struct atto_hba_get_adapter_info *gai =
1212 			&ioctl_hba->data.get_adap_info;
1213 
1214 		esas2r_debug("ATTO_FUNC_GET_ADAP_INFO");
1215 
1216 		gai->drvr_rev_major = ESAS2R_MAJOR_REV;
1217 		gai->drvr_rev_minor = ESAS2R_MINOR_REV;
1218 
1219 		strcpy(gai->drvr_rev_ascii, ESAS2R_VERSION_STR);
1220 		strcpy(gai->drvr_name, ESAS2R_DRVR_NAME);
1221 
1222 		gai->num_busses = 1;
1223 		gai->num_targsper_bus = ESAS2R_MAX_ID + 1;
1224 		gai->num_lunsper_targ = 1;
1225 	}
1226 }
1227 
1228 u8 handle_hba_ioctl(struct esas2r_adapter *a,
1229 		    struct atto_ioctl *ioctl_hba)
1230 {
1231 	struct esas2r_buffered_ioctl bi;
1232 
1233 	memset(&bi, 0, sizeof(bi));
1234 
1235 	bi.a = a;
1236 	bi.ioctl = ioctl_hba;
1237 	bi.length = sizeof(struct atto_ioctl) + ioctl_hba->data_length;
1238 	bi.callback = hba_ioctl_callback;
1239 	bi.context = NULL;
1240 	bi.done_callback = hba_ioctl_done_callback;
1241 	bi.done_context = NULL;
1242 	bi.offset = 0;
1243 
1244 	return handle_buffered_ioctl(&bi);
1245 }
1246 
1247 
1248 int esas2r_write_params(struct esas2r_adapter *a, struct esas2r_request *rq,
1249 			struct esas2r_sas_nvram *data)
1250 {
1251 	int result = 0;
1252 
1253 	a->nvram_command_done = 0;
1254 	rq->comp_cb = complete_nvr_req;
1255 
1256 	if (esas2r_nvram_write(a, rq, data)) {
1257 		/* now wait around for it to complete. */
1258 		while (!a->nvram_command_done)
1259 			wait_event_interruptible(a->nvram_waiter,
1260 						 a->nvram_command_done);
1261 		;
1262 
1263 		/* done, check the status. */
1264 		if (rq->req_stat == RS_SUCCESS)
1265 			result = 1;
1266 	}
1267 	return result;
1268 }
1269 
1270 
1271 /* This function only cares about ATTO-specific ioctls (atto_express_ioctl) */
1272 int esas2r_ioctl_handler(void *hostdata, unsigned int cmd, void __user *arg)
1273 {
1274 	struct atto_express_ioctl *ioctl = NULL;
1275 	struct esas2r_adapter *a;
1276 	struct esas2r_request *rq;
1277 	u16 code;
1278 	int err;
1279 
1280 	esas2r_log(ESAS2R_LOG_DEBG, "ioctl (%p, %x, %p)", hostdata, cmd, arg);
1281 
1282 	if ((arg == NULL)
1283 	    || (cmd < EXPRESS_IOCTL_MIN)
1284 	    || (cmd > EXPRESS_IOCTL_MAX))
1285 		return -ENOTSUPP;
1286 
1287 	ioctl = memdup_user(arg, sizeof(struct atto_express_ioctl));
1288 	if (IS_ERR(ioctl)) {
1289 		esas2r_log(ESAS2R_LOG_WARN,
1290 			   "ioctl_handler access_ok failed for cmd %u, address %p",
1291 			   cmd, arg);
1292 		return PTR_ERR(ioctl);
1293 	}
1294 
1295 	/* verify the signature */
1296 
1297 	if (memcmp(ioctl->header.signature,
1298 		   EXPRESS_IOCTL_SIGNATURE,
1299 		   EXPRESS_IOCTL_SIGNATURE_SIZE) != 0) {
1300 		esas2r_log(ESAS2R_LOG_WARN, "invalid signature");
1301 		kfree(ioctl);
1302 
1303 		return -ENOTSUPP;
1304 	}
1305 
1306 	/* assume success */
1307 
1308 	ioctl->header.return_code = IOCTL_SUCCESS;
1309 	err = 0;
1310 
1311 	/*
1312 	 * handle EXPRESS_IOCTL_GET_CHANNELS
1313 	 * without paying attention to channel
1314 	 */
1315 
1316 	if (cmd == EXPRESS_IOCTL_GET_CHANNELS) {
1317 		int i = 0, k = 0;
1318 
1319 		ioctl->data.chanlist.num_channels = 0;
1320 
1321 		while (i < MAX_ADAPTERS) {
1322 			if (esas2r_adapters[i]) {
1323 				ioctl->data.chanlist.num_channels++;
1324 				ioctl->data.chanlist.channel[k] = i;
1325 				k++;
1326 			}
1327 			i++;
1328 		}
1329 
1330 		goto ioctl_done;
1331 	}
1332 
1333 	/* get the channel */
1334 
1335 	if (ioctl->header.channel == 0xFF) {
1336 		a = (struct esas2r_adapter *)hostdata;
1337 	} else {
1338 		if (ioctl->header.channel >= MAX_ADAPTERS ||
1339 			esas2r_adapters[ioctl->header.channel] == NULL) {
1340 			ioctl->header.return_code = IOCTL_BAD_CHANNEL;
1341 			esas2r_log(ESAS2R_LOG_WARN, "bad channel value");
1342 			kfree(ioctl);
1343 
1344 			return -ENOTSUPP;
1345 		}
1346 		a = esas2r_adapters[ioctl->header.channel];
1347 	}
1348 
1349 	switch (cmd) {
1350 	case EXPRESS_IOCTL_RW_FIRMWARE:
1351 
1352 		if (ioctl->data.fwrw.img_type == FW_IMG_FM_API) {
1353 			err = esas2r_write_fw(a,
1354 					      (char *)ioctl->data.fwrw.image,
1355 					      0,
1356 					      sizeof(struct
1357 						     atto_express_ioctl));
1358 
1359 			if (err >= 0) {
1360 				err = esas2r_read_fw(a,
1361 						     (char *)ioctl->data.fwrw.
1362 						     image,
1363 						     0,
1364 						     sizeof(struct
1365 							    atto_express_ioctl));
1366 			}
1367 		} else if (ioctl->data.fwrw.img_type == FW_IMG_FS_API) {
1368 			err = esas2r_write_fs(a,
1369 					      (char *)ioctl->data.fwrw.image,
1370 					      0,
1371 					      sizeof(struct
1372 						     atto_express_ioctl));
1373 
1374 			if (err >= 0) {
1375 				err = esas2r_read_fs(a,
1376 						     (char *)ioctl->data.fwrw.
1377 						     image,
1378 						     0,
1379 						     sizeof(struct
1380 							    atto_express_ioctl));
1381 			}
1382 		} else {
1383 			ioctl->header.return_code = IOCTL_BAD_FLASH_IMGTYPE;
1384 		}
1385 
1386 		break;
1387 
1388 	case EXPRESS_IOCTL_READ_PARAMS:
1389 
1390 		memcpy(ioctl->data.prw.data_buffer, a->nvram,
1391 		       sizeof(struct esas2r_sas_nvram));
1392 		ioctl->data.prw.code = 1;
1393 		break;
1394 
1395 	case EXPRESS_IOCTL_WRITE_PARAMS:
1396 
1397 		rq = esas2r_alloc_request(a);
1398 		if (rq == NULL) {
1399 			kfree(ioctl);
1400 			esas2r_log(ESAS2R_LOG_WARN,
1401 			   "could not allocate an internal request");
1402 			return -ENOMEM;
1403 		}
1404 
1405 		code = esas2r_write_params(a, rq,
1406 					   (struct esas2r_sas_nvram *)ioctl->data.prw.data_buffer);
1407 		ioctl->data.prw.code = code;
1408 
1409 		esas2r_free_request(a, rq);
1410 
1411 		break;
1412 
1413 	case EXPRESS_IOCTL_DEFAULT_PARAMS:
1414 
1415 		esas2r_nvram_get_defaults(a,
1416 					  (struct esas2r_sas_nvram *)ioctl->data.prw.data_buffer);
1417 		ioctl->data.prw.code = 1;
1418 		break;
1419 
1420 	case EXPRESS_IOCTL_CHAN_INFO:
1421 
1422 		ioctl->data.chaninfo.major_rev = ESAS2R_MAJOR_REV;
1423 		ioctl->data.chaninfo.minor_rev = ESAS2R_MINOR_REV;
1424 		ioctl->data.chaninfo.IRQ = a->pcid->irq;
1425 		ioctl->data.chaninfo.device_id = a->pcid->device;
1426 		ioctl->data.chaninfo.vendor_id = a->pcid->vendor;
1427 		ioctl->data.chaninfo.ven_dev_id = a->pcid->subsystem_device;
1428 		ioctl->data.chaninfo.revision_id = a->pcid->revision;
1429 		ioctl->data.chaninfo.pci_bus = a->pcid->bus->number;
1430 		ioctl->data.chaninfo.pci_dev_func = a->pcid->devfn;
1431 		ioctl->data.chaninfo.core_rev = 0;
1432 		ioctl->data.chaninfo.host_no = a->host->host_no;
1433 		ioctl->data.chaninfo.hbaapi_rev = 0;
1434 		break;
1435 
1436 	case EXPRESS_IOCTL_SMP:
1437 		ioctl->header.return_code = handle_smp_ioctl(a,
1438 							     &ioctl->data.
1439 							     ioctl_smp);
1440 		break;
1441 
1442 	case EXPRESS_CSMI:
1443 		ioctl->header.return_code =
1444 			handle_csmi_ioctl(a, &ioctl->data.csmi);
1445 		break;
1446 
1447 	case EXPRESS_IOCTL_HBA:
1448 		ioctl->header.return_code = handle_hba_ioctl(a,
1449 							     &ioctl->data.
1450 							     ioctl_hba);
1451 		break;
1452 
1453 	case EXPRESS_IOCTL_VDA:
1454 		err = esas2r_write_vda(a,
1455 				       (char *)&ioctl->data.ioctl_vda,
1456 				       0,
1457 				       sizeof(struct atto_ioctl_vda) +
1458 				       ioctl->data.ioctl_vda.data_length);
1459 
1460 		if (err >= 0) {
1461 			err = esas2r_read_vda(a,
1462 					      (char *)&ioctl->data.ioctl_vda,
1463 					      0,
1464 					      sizeof(struct atto_ioctl_vda) +
1465 					      ioctl->data.ioctl_vda.data_length);
1466 		}
1467 
1468 
1469 
1470 
1471 		break;
1472 
1473 	case EXPRESS_IOCTL_GET_MOD_INFO:
1474 
1475 		ioctl->data.modinfo.adapter = a;
1476 		ioctl->data.modinfo.pci_dev = a->pcid;
1477 		ioctl->data.modinfo.scsi_host = a->host;
1478 		ioctl->data.modinfo.host_no = a->host->host_no;
1479 
1480 		break;
1481 
1482 	default:
1483 		esas2r_debug("esas2r_ioctl invalid cmd %p!", cmd);
1484 		ioctl->header.return_code = IOCTL_ERR_INVCMD;
1485 	}
1486 
1487 ioctl_done:
1488 
1489 	if (err < 0) {
1490 		esas2r_log(ESAS2R_LOG_WARN, "err %d on ioctl cmd %u", err,
1491 			   cmd);
1492 
1493 		switch (err) {
1494 		case -ENOMEM:
1495 		case -EBUSY:
1496 			ioctl->header.return_code = IOCTL_OUT_OF_RESOURCES;
1497 			break;
1498 
1499 		case -ENOSYS:
1500 		case -EINVAL:
1501 			ioctl->header.return_code = IOCTL_INVALID_PARAM;
1502 			break;
1503 
1504 		default:
1505 			ioctl->header.return_code = IOCTL_GENERAL_ERROR;
1506 			break;
1507 		}
1508 
1509 	}
1510 
1511 	/* Always copy the buffer back, if only to pick up the status */
1512 	err = copy_to_user(arg, ioctl, sizeof(struct atto_express_ioctl));
1513 	if (err != 0) {
1514 		esas2r_log(ESAS2R_LOG_WARN,
1515 			   "ioctl_handler copy_to_user didn't copy everything (err %d, cmd %u)",
1516 			   err, cmd);
1517 		kfree(ioctl);
1518 
1519 		return -EFAULT;
1520 	}
1521 
1522 	kfree(ioctl);
1523 
1524 	return 0;
1525 }
1526 
1527 int esas2r_ioctl(struct scsi_device *sd, unsigned int cmd, void __user *arg)
1528 {
1529 	return esas2r_ioctl_handler(sd->host->hostdata, cmd, arg);
1530 }
1531 
1532 static void free_fw_buffers(struct esas2r_adapter *a)
1533 {
1534 	if (a->firmware.data) {
1535 		dma_free_coherent(&a->pcid->dev,
1536 				  (size_t)a->firmware.orig_len,
1537 				  a->firmware.data,
1538 				  (dma_addr_t)a->firmware.phys);
1539 
1540 		a->firmware.data = NULL;
1541 	}
1542 }
1543 
1544 static int allocate_fw_buffers(struct esas2r_adapter *a, u32 length)
1545 {
1546 	free_fw_buffers(a);
1547 
1548 	a->firmware.orig_len = length;
1549 
1550 	a->firmware.data = dma_alloc_coherent(&a->pcid->dev,
1551 					      (size_t)length,
1552 					      (dma_addr_t *)&a->firmware.phys,
1553 					      GFP_KERNEL);
1554 
1555 	if (!a->firmware.data) {
1556 		esas2r_debug("buffer alloc failed!");
1557 		return 0;
1558 	}
1559 
1560 	return 1;
1561 }
1562 
1563 /* Handle a call to read firmware. */
1564 int esas2r_read_fw(struct esas2r_adapter *a, char *buf, long off, int count)
1565 {
1566 	esas2r_trace_enter();
1567 	/* if the cached header is a status, simply copy it over and return. */
1568 	if (a->firmware.state == FW_STATUS_ST) {
1569 		int size = min_t(int, count, sizeof(a->firmware.header));
1570 		esas2r_trace_exit();
1571 		memcpy(buf, &a->firmware.header, size);
1572 		esas2r_debug("esas2r_read_fw: STATUS size %d", size);
1573 		return size;
1574 	}
1575 
1576 	/*
1577 	 * if the cached header is a command, do it if at
1578 	 * offset 0, otherwise copy the pieces.
1579 	 */
1580 
1581 	if (a->firmware.state == FW_COMMAND_ST) {
1582 		u32 length = a->firmware.header.length;
1583 		esas2r_trace_exit();
1584 
1585 		esas2r_debug("esas2r_read_fw: COMMAND length %d off %d",
1586 			     length,
1587 			     off);
1588 
1589 		if (off == 0) {
1590 			if (a->firmware.header.action == FI_ACT_UP) {
1591 				if (!allocate_fw_buffers(a, length))
1592 					return -ENOMEM;
1593 
1594 
1595 				/* copy header over */
1596 
1597 				memcpy(a->firmware.data,
1598 				       &a->firmware.header,
1599 				       sizeof(a->firmware.header));
1600 
1601 				do_fm_api(a,
1602 					  (struct esas2r_flash_img *)a->firmware.data);
1603 			} else if (a->firmware.header.action == FI_ACT_UPSZ) {
1604 				int size =
1605 					min((int)count,
1606 					    (int)sizeof(a->firmware.header));
1607 				do_fm_api(a, &a->firmware.header);
1608 				memcpy(buf, &a->firmware.header, size);
1609 				esas2r_debug("FI_ACT_UPSZ size %d", size);
1610 				return size;
1611 			} else {
1612 				esas2r_debug("invalid action %d",
1613 					     a->firmware.header.action);
1614 				return -ENOSYS;
1615 			}
1616 		}
1617 
1618 		if (count + off > length)
1619 			count = length - off;
1620 
1621 		if (count < 0)
1622 			return 0;
1623 
1624 		if (!a->firmware.data) {
1625 			esas2r_debug(
1626 				"read: nonzero offset but no buffer available!");
1627 			return -ENOMEM;
1628 		}
1629 
1630 		esas2r_debug("esas2r_read_fw: off %d count %d length %d ", off,
1631 			     count,
1632 			     length);
1633 
1634 		memcpy(buf, &a->firmware.data[off], count);
1635 
1636 		/* when done, release the buffer */
1637 
1638 		if (length <= off + count) {
1639 			esas2r_debug("esas2r_read_fw: freeing buffer!");
1640 
1641 			free_fw_buffers(a);
1642 		}
1643 
1644 		return count;
1645 	}
1646 
1647 	esas2r_trace_exit();
1648 	esas2r_debug("esas2r_read_fw: invalid firmware state %d",
1649 		     a->firmware.state);
1650 
1651 	return -EINVAL;
1652 }
1653 
1654 /* Handle a call to write firmware. */
1655 int esas2r_write_fw(struct esas2r_adapter *a, const char *buf, long off,
1656 		    int count)
1657 {
1658 	u32 length;
1659 
1660 	if (off == 0) {
1661 		struct esas2r_flash_img *header =
1662 			(struct esas2r_flash_img *)buf;
1663 
1664 		/* assume version 0 flash image */
1665 
1666 		int min_size = sizeof(struct esas2r_flash_img_v0);
1667 
1668 		a->firmware.state = FW_INVALID_ST;
1669 
1670 		/* validate the version field first */
1671 
1672 		if (count < 4
1673 		    ||  header->fi_version > FI_VERSION_1) {
1674 			esas2r_debug(
1675 				"esas2r_write_fw: short header or invalid version");
1676 			return -EINVAL;
1677 		}
1678 
1679 		/* See if its a version 1 flash image */
1680 
1681 		if (header->fi_version == FI_VERSION_1)
1682 			min_size = sizeof(struct esas2r_flash_img);
1683 
1684 		/* If this is the start, the header must be full and valid. */
1685 		if (count < min_size) {
1686 			esas2r_debug("esas2r_write_fw: short header, aborting");
1687 			return -EINVAL;
1688 		}
1689 
1690 		/* Make sure the size is reasonable. */
1691 		length = header->length;
1692 
1693 		if (length > 1024 * 1024) {
1694 			esas2r_debug(
1695 				"esas2r_write_fw: hosed, length %d  fi_version %d",
1696 				length, header->fi_version);
1697 			return -EINVAL;
1698 		}
1699 
1700 		/*
1701 		 * If this is a write command, allocate memory because
1702 		 * we have to cache everything. otherwise, just cache
1703 		 * the header, because the read op will do the command.
1704 		 */
1705 
1706 		if (header->action == FI_ACT_DOWN) {
1707 			if (!allocate_fw_buffers(a, length))
1708 				return -ENOMEM;
1709 
1710 			/*
1711 			 * Store the command, so there is context on subsequent
1712 			 * calls.
1713 			 */
1714 			memcpy(&a->firmware.header,
1715 			       buf,
1716 			       sizeof(*header));
1717 		} else if (header->action == FI_ACT_UP
1718 			   ||  header->action == FI_ACT_UPSZ) {
1719 			/* Save the command, result will be picked up on read */
1720 			memcpy(&a->firmware.header,
1721 			       buf,
1722 			       sizeof(*header));
1723 
1724 			a->firmware.state = FW_COMMAND_ST;
1725 
1726 			esas2r_debug(
1727 				"esas2r_write_fw: COMMAND, count %d, action %d ",
1728 				count, header->action);
1729 
1730 			/*
1731 			 * Pretend we took the whole buffer,
1732 			 * so we don't get bothered again.
1733 			 */
1734 
1735 			return count;
1736 		} else {
1737 			esas2r_debug("esas2r_write_fw: invalid action %d ",
1738 				     a->firmware.header.action);
1739 			return -ENOSYS;
1740 		}
1741 	} else {
1742 		length = a->firmware.header.length;
1743 	}
1744 
1745 	/*
1746 	 * We only get here on a download command, regardless of offset.
1747 	 * the chunks written by the system need to be cached, and when
1748 	 * the final one arrives, issue the fmapi command.
1749 	 */
1750 
1751 	if (off + count > length)
1752 		count = length - off;
1753 
1754 	if (count > 0) {
1755 		esas2r_debug("esas2r_write_fw: off %d count %d length %d", off,
1756 			     count,
1757 			     length);
1758 
1759 		/*
1760 		 * On a full upload, the system tries sending the whole buffer.
1761 		 * there's nothing to do with it, so just drop it here, before
1762 		 * trying to copy over into unallocated memory!
1763 		 */
1764 		if (a->firmware.header.action == FI_ACT_UP)
1765 			return count;
1766 
1767 		if (!a->firmware.data) {
1768 			esas2r_debug(
1769 				"write: nonzero offset but no buffer available!");
1770 			return -ENOMEM;
1771 		}
1772 
1773 		memcpy(&a->firmware.data[off], buf, count);
1774 
1775 		if (length == off + count) {
1776 			do_fm_api(a,
1777 				  (struct esas2r_flash_img *)a->firmware.data);
1778 
1779 			/*
1780 			 * Now copy the header result to be picked up by the
1781 			 * next read
1782 			 */
1783 			memcpy(&a->firmware.header,
1784 			       a->firmware.data,
1785 			       sizeof(a->firmware.header));
1786 
1787 			a->firmware.state = FW_STATUS_ST;
1788 
1789 			esas2r_debug("write completed");
1790 
1791 			/*
1792 			 * Since the system has the data buffered, the only way
1793 			 * this can leak is if a root user writes a program
1794 			 * that writes a shorter buffer than it claims, and the
1795 			 * copyin fails.
1796 			 */
1797 			free_fw_buffers(a);
1798 		}
1799 	}
1800 
1801 	return count;
1802 }
1803 
1804 /* Callback for the completion of a VDA request. */
1805 static void vda_complete_req(struct esas2r_adapter *a,
1806 			     struct esas2r_request *rq)
1807 {
1808 	a->vda_command_done = 1;
1809 	wake_up_interruptible(&a->vda_waiter);
1810 }
1811 
1812 /* Scatter/gather callback for VDA requests */
1813 static u32 get_physaddr_vda(struct esas2r_sg_context *sgc, u64 *addr)
1814 {
1815 	struct esas2r_adapter *a = (struct esas2r_adapter *)sgc->adapter;
1816 	int offset = (u8 *)sgc->cur_offset - (u8 *)a->vda_buffer;
1817 
1818 	(*addr) = a->ppvda_buffer + offset;
1819 	return VDA_MAX_BUFFER_SIZE - offset;
1820 }
1821 
1822 /* Handle a call to read a VDA command. */
1823 int esas2r_read_vda(struct esas2r_adapter *a, char *buf, long off, int count)
1824 {
1825 	if (!a->vda_buffer)
1826 		return -ENOMEM;
1827 
1828 	if (off == 0) {
1829 		struct esas2r_request *rq;
1830 		struct atto_ioctl_vda *vi =
1831 			(struct atto_ioctl_vda *)a->vda_buffer;
1832 		struct esas2r_sg_context sgc;
1833 		bool wait_for_completion;
1834 
1835 		/*
1836 		 * Presumeably, someone has already written to the vda_buffer,
1837 		 * and now they are reading the node the response, so now we
1838 		 * will actually issue the request to the chip and reply.
1839 		 */
1840 
1841 		/* allocate a request */
1842 		rq = esas2r_alloc_request(a);
1843 		if (rq == NULL) {
1844 			esas2r_debug("esas2r_read_vda: out of requests");
1845 			return -EBUSY;
1846 		}
1847 
1848 		rq->comp_cb = vda_complete_req;
1849 
1850 		sgc.first_req = rq;
1851 		sgc.adapter = a;
1852 		sgc.cur_offset = a->vda_buffer + VDA_BUFFER_HEADER_SZ;
1853 		sgc.get_phys_addr = (PGETPHYSADDR)get_physaddr_vda;
1854 
1855 		a->vda_command_done = 0;
1856 
1857 		wait_for_completion =
1858 			esas2r_process_vda_ioctl(a, vi, rq, &sgc);
1859 
1860 		if (wait_for_completion) {
1861 			/* now wait around for it to complete. */
1862 
1863 			while (!a->vda_command_done)
1864 				wait_event_interruptible(a->vda_waiter,
1865 							 a->vda_command_done);
1866 		}
1867 
1868 		esas2r_free_request(a, (struct esas2r_request *)rq);
1869 	}
1870 
1871 	if (off > VDA_MAX_BUFFER_SIZE)
1872 		return 0;
1873 
1874 	if (count + off > VDA_MAX_BUFFER_SIZE)
1875 		count = VDA_MAX_BUFFER_SIZE - off;
1876 
1877 	if (count < 0)
1878 		return 0;
1879 
1880 	memcpy(buf, a->vda_buffer + off, count);
1881 
1882 	return count;
1883 }
1884 
1885 /* Handle a call to write a VDA command. */
1886 int esas2r_write_vda(struct esas2r_adapter *a, const char *buf, long off,
1887 		     int count)
1888 {
1889 	/*
1890 	 * allocate memory for it, if not already done.  once allocated,
1891 	 * we will keep it around until the driver is unloaded.
1892 	 */
1893 
1894 	if (!a->vda_buffer) {
1895 		dma_addr_t dma_addr;
1896 		a->vda_buffer = dma_alloc_coherent(&a->pcid->dev,
1897 						   (size_t)
1898 						   VDA_MAX_BUFFER_SIZE,
1899 						   &dma_addr,
1900 						   GFP_KERNEL);
1901 
1902 		a->ppvda_buffer = dma_addr;
1903 	}
1904 
1905 	if (!a->vda_buffer)
1906 		return -ENOMEM;
1907 
1908 	if (off > VDA_MAX_BUFFER_SIZE)
1909 		return 0;
1910 
1911 	if (count + off > VDA_MAX_BUFFER_SIZE)
1912 		count = VDA_MAX_BUFFER_SIZE - off;
1913 
1914 	if (count < 1)
1915 		return 0;
1916 
1917 	memcpy(a->vda_buffer + off, buf, count);
1918 
1919 	return count;
1920 }
1921 
1922 /* Callback for the completion of an FS_API request.*/
1923 static void fs_api_complete_req(struct esas2r_adapter *a,
1924 				struct esas2r_request *rq)
1925 {
1926 	a->fs_api_command_done = 1;
1927 
1928 	wake_up_interruptible(&a->fs_api_waiter);
1929 }
1930 
1931 /* Scatter/gather callback for VDA requests */
1932 static u32 get_physaddr_fs_api(struct esas2r_sg_context *sgc, u64 *addr)
1933 {
1934 	struct esas2r_adapter *a = (struct esas2r_adapter *)sgc->adapter;
1935 	struct esas2r_ioctl_fs *fs =
1936 		(struct esas2r_ioctl_fs *)a->fs_api_buffer;
1937 	u32 offset = (u8 *)sgc->cur_offset - (u8 *)fs;
1938 
1939 	(*addr) = a->ppfs_api_buffer + offset;
1940 
1941 	return a->fs_api_buffer_size - offset;
1942 }
1943 
1944 /* Handle a call to read firmware via FS_API. */
1945 int esas2r_read_fs(struct esas2r_adapter *a, char *buf, long off, int count)
1946 {
1947 	if (!a->fs_api_buffer)
1948 		return -ENOMEM;
1949 
1950 	if (off == 0) {
1951 		struct esas2r_request *rq;
1952 		struct esas2r_sg_context sgc;
1953 		struct esas2r_ioctl_fs *fs =
1954 			(struct esas2r_ioctl_fs *)a->fs_api_buffer;
1955 
1956 		/* If another flash request is already in progress, return. */
1957 		if (mutex_lock_interruptible(&a->fs_api_mutex)) {
1958 busy:
1959 			fs->status = ATTO_STS_OUT_OF_RSRC;
1960 			return -EBUSY;
1961 		}
1962 
1963 		/*
1964 		 * Presumeably, someone has already written to the
1965 		 * fs_api_buffer, and now they are reading the node the
1966 		 * response, so now we will actually issue the request to the
1967 		 * chip and reply. Allocate a request
1968 		 */
1969 
1970 		rq = esas2r_alloc_request(a);
1971 		if (rq == NULL) {
1972 			esas2r_debug("esas2r_read_fs: out of requests");
1973 			mutex_unlock(&a->fs_api_mutex);
1974 			goto busy;
1975 		}
1976 
1977 		rq->comp_cb = fs_api_complete_req;
1978 
1979 		/* Set up the SGCONTEXT for to build the s/g table */
1980 
1981 		sgc.cur_offset = fs->data;
1982 		sgc.get_phys_addr = (PGETPHYSADDR)get_physaddr_fs_api;
1983 
1984 		a->fs_api_command_done = 0;
1985 
1986 		if (!esas2r_process_fs_ioctl(a, fs, rq, &sgc)) {
1987 			if (fs->status == ATTO_STS_OUT_OF_RSRC)
1988 				count = -EBUSY;
1989 
1990 			goto dont_wait;
1991 		}
1992 
1993 		/* Now wait around for it to complete. */
1994 
1995 		while (!a->fs_api_command_done)
1996 			wait_event_interruptible(a->fs_api_waiter,
1997 						 a->fs_api_command_done);
1998 		;
1999 dont_wait:
2000 		/* Free the request and keep going */
2001 		mutex_unlock(&a->fs_api_mutex);
2002 		esas2r_free_request(a, (struct esas2r_request *)rq);
2003 
2004 		/* Pick up possible error code from above */
2005 		if (count < 0)
2006 			return count;
2007 	}
2008 
2009 	if (off > a->fs_api_buffer_size)
2010 		return 0;
2011 
2012 	if (count + off > a->fs_api_buffer_size)
2013 		count = a->fs_api_buffer_size - off;
2014 
2015 	if (count < 0)
2016 		return 0;
2017 
2018 	memcpy(buf, a->fs_api_buffer + off, count);
2019 
2020 	return count;
2021 }
2022 
2023 /* Handle a call to write firmware via FS_API. */
2024 int esas2r_write_fs(struct esas2r_adapter *a, const char *buf, long off,
2025 		    int count)
2026 {
2027 	if (off == 0) {
2028 		struct esas2r_ioctl_fs *fs = (struct esas2r_ioctl_fs *)buf;
2029 		u32 length = fs->command.length + offsetof(
2030 			struct esas2r_ioctl_fs,
2031 			data);
2032 
2033 		/*
2034 		 * Special case, for BEGIN commands, the length field
2035 		 * is lying to us, so just get enough for the header.
2036 		 */
2037 
2038 		if (fs->command.command == ESAS2R_FS_CMD_BEGINW)
2039 			length = offsetof(struct esas2r_ioctl_fs, data);
2040 
2041 		/*
2042 		 * Beginning a command.  We assume we'll get at least
2043 		 * enough in the first write so we can look at the
2044 		 * header and see how much we need to alloc.
2045 		 */
2046 
2047 		if (count < offsetof(struct esas2r_ioctl_fs, data))
2048 			return -EINVAL;
2049 
2050 		/* Allocate a buffer or use the existing buffer. */
2051 		if (a->fs_api_buffer) {
2052 			if (a->fs_api_buffer_size < length) {
2053 				/* Free too-small buffer and get a new one */
2054 				dma_free_coherent(&a->pcid->dev,
2055 						  (size_t)a->fs_api_buffer_size,
2056 						  a->fs_api_buffer,
2057 						  (dma_addr_t)a->ppfs_api_buffer);
2058 
2059 				goto re_allocate_buffer;
2060 			}
2061 		} else {
2062 re_allocate_buffer:
2063 			a->fs_api_buffer_size = length;
2064 
2065 			a->fs_api_buffer = dma_alloc_coherent(&a->pcid->dev,
2066 							      (size_t)a->fs_api_buffer_size,
2067 							      (dma_addr_t *)&a->ppfs_api_buffer,
2068 							      GFP_KERNEL);
2069 		}
2070 	}
2071 
2072 	if (!a->fs_api_buffer)
2073 		return -ENOMEM;
2074 
2075 	if (off > a->fs_api_buffer_size)
2076 		return 0;
2077 
2078 	if (count + off > a->fs_api_buffer_size)
2079 		count = a->fs_api_buffer_size - off;
2080 
2081 	if (count < 1)
2082 		return 0;
2083 
2084 	memcpy(a->fs_api_buffer + off, buf, count);
2085 
2086 	return count;
2087 }
2088