xref: /linux/drivers/message/fusion/mptctl.c (revision b3b77c8caef1750ebeea1054e39e358550ea9f55)
1 /*
2  *  linux/drivers/message/fusion/mptctl.c
3  *      mpt Ioctl driver.
4  *      For use with LSI PCI chip/adapters
5  *      running LSI Fusion MPT (Message Passing Technology) firmware.
6  *
7  *  Copyright (c) 1999-2008 LSI Corporation
8  *  (mailto:DL-MPTFusionLinux@lsi.com)
9  *
10  */
11 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
12 /*
13     This program is free software; you can redistribute it and/or modify
14     it under the terms of the GNU General Public License as published by
15     the Free Software Foundation; version 2 of the License.
16 
17     This program is distributed in the hope that it will be useful,
18     but WITHOUT ANY WARRANTY; without even the implied warranty of
19     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
20     GNU General Public License for more details.
21 
22     NO WARRANTY
23     THE PROGRAM IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR
24     CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED INCLUDING, WITHOUT
25     LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT,
26     MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each Recipient is
27     solely responsible for determining the appropriateness of using and
28     distributing the Program and assumes all risks associated with its
29     exercise of rights under this Agreement, including but not limited to
30     the risks and costs of program errors, damage to or loss of data,
31     programs or equipment, and unavailability or interruption of operations.
32 
33     DISCLAIMER OF LIABILITY
34     NEITHER RECIPIENT NOR ANY CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY
35     DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
36     DAMAGES (INCLUDING WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND
37     ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
38     TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
39     USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS GRANTED
40     HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES
41 
42     You should have received a copy of the GNU General Public License
43     along with this program; if not, write to the Free Software
44     Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
45 */
46 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
47 
48 #include <linux/kernel.h>
49 #include <linux/module.h>
50 #include <linux/errno.h>
51 #include <linux/init.h>
52 #include <linux/slab.h>
53 #include <linux/types.h>
54 #include <linux/pci.h>
55 #include <linux/delay.h>	/* for mdelay */
56 #include <linux/miscdevice.h>
57 #include <linux/smp_lock.h>
58 #include <linux/compat.h>
59 
60 #include <asm/io.h>
61 #include <asm/uaccess.h>
62 
63 #include <scsi/scsi.h>
64 #include <scsi/scsi_cmnd.h>
65 #include <scsi/scsi_device.h>
66 #include <scsi/scsi_host.h>
67 #include <scsi/scsi_tcq.h>
68 
69 #define COPYRIGHT	"Copyright (c) 1999-2008 LSI Corporation"
70 #define MODULEAUTHOR	"LSI Corporation"
71 #include "mptbase.h"
72 #include "mptctl.h"
73 
74 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
75 #define my_NAME		"Fusion MPT misc device (ioctl) driver"
76 #define my_VERSION	MPT_LINUX_VERSION_COMMON
77 #define MYNAM		"mptctl"
78 
79 MODULE_AUTHOR(MODULEAUTHOR);
80 MODULE_DESCRIPTION(my_NAME);
81 MODULE_LICENSE("GPL");
82 MODULE_VERSION(my_VERSION);
83 
84 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
85 
86 static u8 mptctl_id = MPT_MAX_PROTOCOL_DRIVERS;
87 static u8 mptctl_taskmgmt_id = MPT_MAX_PROTOCOL_DRIVERS;
88 
89 static DECLARE_WAIT_QUEUE_HEAD ( mptctl_wait );
90 
91 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
92 
93 struct buflist {
94 	u8	*kptr;
95 	int	 len;
96 };
97 
98 /*
99  * Function prototypes. Called from OS entry point mptctl_ioctl.
100  * arg contents specific to function.
101  */
102 static int mptctl_fw_download(unsigned long arg);
103 static int mptctl_getiocinfo(unsigned long arg, unsigned int cmd);
104 static int mptctl_gettargetinfo(unsigned long arg);
105 static int mptctl_readtest(unsigned long arg);
106 static int mptctl_mpt_command(unsigned long arg);
107 static int mptctl_eventquery(unsigned long arg);
108 static int mptctl_eventenable(unsigned long arg);
109 static int mptctl_eventreport(unsigned long arg);
110 static int mptctl_replace_fw(unsigned long arg);
111 
112 static int mptctl_do_reset(unsigned long arg);
113 static int mptctl_hp_hostinfo(unsigned long arg, unsigned int cmd);
114 static int mptctl_hp_targetinfo(unsigned long arg);
115 
116 static int  mptctl_probe(struct pci_dev *, const struct pci_device_id *);
117 static void mptctl_remove(struct pci_dev *);
118 
119 #ifdef CONFIG_COMPAT
120 static long compat_mpctl_ioctl(struct file *f, unsigned cmd, unsigned long arg);
121 #endif
122 /*
123  * Private function calls.
124  */
125 static int mptctl_do_mpt_command(struct mpt_ioctl_command karg, void __user *mfPtr);
126 static int mptctl_do_fw_download(int ioc, char __user *ufwbuf, size_t fwlen);
127 static MptSge_t *kbuf_alloc_2_sgl(int bytes, u32 dir, int sge_offset, int *frags,
128 		struct buflist **blp, dma_addr_t *sglbuf_dma, MPT_ADAPTER *ioc);
129 static void kfree_sgl(MptSge_t *sgl, dma_addr_t sgl_dma,
130 		struct buflist *buflist, MPT_ADAPTER *ioc);
131 
132 /*
133  * Reset Handler cleanup function
134  */
135 static int  mptctl_ioc_reset(MPT_ADAPTER *ioc, int reset_phase);
136 
137 /*
138  * Event Handler function
139  */
140 static int mptctl_event_process(MPT_ADAPTER *ioc, EventNotificationReply_t *pEvReply);
141 static struct fasync_struct *async_queue=NULL;
142 
143 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
144 /*
145  * Scatter gather list (SGL) sizes and limits...
146  */
147 //#define MAX_SCSI_FRAGS	9
148 #define MAX_FRAGS_SPILL1	9
149 #define MAX_FRAGS_SPILL2	15
150 #define FRAGS_PER_BUCKET	(MAX_FRAGS_SPILL2 + 1)
151 
152 //#define MAX_CHAIN_FRAGS	64
153 //#define MAX_CHAIN_FRAGS	(15+15+15+16)
154 #define MAX_CHAIN_FRAGS		(4 * MAX_FRAGS_SPILL2 + 1)
155 
156 //  Define max sg LIST bytes ( == (#frags + #chains) * 8 bytes each)
157 //  Works out to: 592d bytes!     (9+1)*8 + 4*(15+1)*8
158 //                  ^----------------- 80 + 512
159 #define MAX_SGL_BYTES		((MAX_FRAGS_SPILL1 + 1 + (4 * FRAGS_PER_BUCKET)) * 8)
160 
161 /* linux only seems to ever give 128kB MAX contiguous (GFP_USER) mem bytes */
162 #define MAX_KMALLOC_SZ		(128*1024)
163 
164 #define MPT_IOCTL_DEFAULT_TIMEOUT 10	/* Default timeout value (seconds) */
165 
166 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
167 /**
168  *	mptctl_syscall_down - Down the MPT adapter syscall semaphore.
169  *	@ioc: Pointer to MPT adapter
170  *	@nonblock: boolean, non-zero if O_NONBLOCK is set
171  *
172  *	All of the ioctl commands can potentially sleep, which is illegal
173  *	with a spinlock held, thus we perform mutual exclusion here.
174  *
175  *	Returns negative errno on error, or zero for success.
176  */
177 static inline int
178 mptctl_syscall_down(MPT_ADAPTER *ioc, int nonblock)
179 {
180 	int rc = 0;
181 
182 	if (nonblock) {
183 		if (!mutex_trylock(&ioc->ioctl_cmds.mutex))
184 			rc = -EAGAIN;
185 	} else {
186 		if (mutex_lock_interruptible(&ioc->ioctl_cmds.mutex))
187 			rc = -ERESTARTSYS;
188 	}
189 	return rc;
190 }
191 
192 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
193 /*
194  *  This is the callback for any message we have posted. The message itself
195  *  will be returned to the message pool when we return from the IRQ
196  *
197  *  This runs in irq context so be short and sweet.
198  */
199 static int
200 mptctl_reply(MPT_ADAPTER *ioc, MPT_FRAME_HDR *req, MPT_FRAME_HDR *reply)
201 {
202 	char	*sense_data;
203 	int	req_index;
204 	int	sz;
205 
206 	if (!req)
207 		return 0;
208 
209 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "completing mpi function "
210 	    "(0x%02X), req=%p, reply=%p\n", ioc->name,  req->u.hdr.Function,
211 	    req, reply));
212 
213 	/*
214 	 * Handling continuation of the same reply. Processing the first
215 	 * reply, and eating the other replys that come later.
216 	 */
217 	if (ioc->ioctl_cmds.msg_context != req->u.hdr.MsgContext)
218 		goto out_continuation;
219 
220 	ioc->ioctl_cmds.status |= MPT_MGMT_STATUS_COMMAND_GOOD;
221 
222 	if (!reply)
223 		goto out;
224 
225 	ioc->ioctl_cmds.status |= MPT_MGMT_STATUS_RF_VALID;
226 	sz = min(ioc->reply_sz, 4*reply->u.reply.MsgLength);
227 	memcpy(ioc->ioctl_cmds.reply, reply, sz);
228 
229 	if (reply->u.reply.IOCStatus || reply->u.reply.IOCLogInfo)
230 		dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT
231 		    "iocstatus (0x%04X), loginfo (0x%08X)\n", ioc->name,
232 		    le16_to_cpu(reply->u.reply.IOCStatus),
233 		    le32_to_cpu(reply->u.reply.IOCLogInfo)));
234 
235 	if ((req->u.hdr.Function == MPI_FUNCTION_SCSI_IO_REQUEST) ||
236 		(req->u.hdr.Function ==
237 		 MPI_FUNCTION_RAID_SCSI_IO_PASSTHROUGH)) {
238 
239 		if (reply->u.sreply.SCSIStatus || reply->u.sreply.SCSIState)
240 			dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT
241 			"scsi_status (0x%02x), scsi_state (0x%02x), "
242 			"tag = (0x%04x), transfer_count (0x%08x)\n", ioc->name,
243 			reply->u.sreply.SCSIStatus,
244 			reply->u.sreply.SCSIState,
245 			le16_to_cpu(reply->u.sreply.TaskTag),
246 			le32_to_cpu(reply->u.sreply.TransferCount)));
247 
248 		if (reply->u.sreply.SCSIState &
249 			MPI_SCSI_STATE_AUTOSENSE_VALID) {
250 			sz = req->u.scsireq.SenseBufferLength;
251 			req_index =
252 			    le16_to_cpu(req->u.frame.hwhdr.msgctxu.fld.req_idx);
253 			sense_data = ((u8 *)ioc->sense_buf_pool +
254 			     (req_index * MPT_SENSE_BUFFER_ALLOC));
255 			memcpy(ioc->ioctl_cmds.sense, sense_data, sz);
256 			ioc->ioctl_cmds.status |= MPT_MGMT_STATUS_SENSE_VALID;
257 		}
258 	}
259 
260  out:
261 	/* We are done, issue wake up
262 	 */
263 	if (ioc->ioctl_cmds.status & MPT_MGMT_STATUS_PENDING) {
264 		if (req->u.hdr.Function == MPI_FUNCTION_SCSI_TASK_MGMT)
265 			mpt_clear_taskmgmt_in_progress_flag(ioc);
266 		ioc->ioctl_cmds.status &= ~MPT_MGMT_STATUS_PENDING;
267 		complete(&ioc->ioctl_cmds.done);
268 	}
269 
270  out_continuation:
271 	if (reply && (reply->u.reply.MsgFlags &
272 	    MPI_MSGFLAGS_CONTINUATION_REPLY))
273 		return 0;
274 	return 1;
275 }
276 
277 
278 static int
279 mptctl_taskmgmt_reply(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *mr)
280 {
281 	if (!mf)
282 		return 0;
283 
284 	dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
285 		"TaskMgmt completed (mf=%p, mr=%p)\n",
286 		ioc->name, mf, mr));
287 
288 	ioc->taskmgmt_cmds.status |= MPT_MGMT_STATUS_COMMAND_GOOD;
289 
290 	if (!mr)
291 		goto out;
292 
293 	ioc->taskmgmt_cmds.status |= MPT_MGMT_STATUS_RF_VALID;
294 	memcpy(ioc->taskmgmt_cmds.reply, mr,
295 	    min(MPT_DEFAULT_FRAME_SIZE, 4 * mr->u.reply.MsgLength));
296  out:
297 	if (ioc->taskmgmt_cmds.status & MPT_MGMT_STATUS_PENDING) {
298 		mpt_clear_taskmgmt_in_progress_flag(ioc);
299 		ioc->taskmgmt_cmds.status &= ~MPT_MGMT_STATUS_PENDING;
300 		complete(&ioc->taskmgmt_cmds.done);
301 		return 1;
302 	}
303 	return 0;
304 }
305 
306 static int
307 mptctl_do_taskmgmt(MPT_ADAPTER *ioc, u8 tm_type, u8 bus_id, u8 target_id)
308 {
309 	MPT_FRAME_HDR	*mf;
310 	SCSITaskMgmt_t	*pScsiTm;
311 	SCSITaskMgmtReply_t *pScsiTmReply;
312 	int		 ii;
313 	int		 retval;
314 	unsigned long	 timeout;
315 	unsigned long	 time_count;
316 	u16		 iocstatus;
317 
318 
319 	mutex_lock(&ioc->taskmgmt_cmds.mutex);
320 	if (mpt_set_taskmgmt_in_progress_flag(ioc) != 0) {
321 		mutex_unlock(&ioc->taskmgmt_cmds.mutex);
322 		return -EPERM;
323 	}
324 
325 	retval = 0;
326 
327 	mf = mpt_get_msg_frame(mptctl_taskmgmt_id, ioc);
328 	if (mf == NULL) {
329 		dtmprintk(ioc,
330 			printk(MYIOC_s_WARN_FMT "TaskMgmt, no msg frames!!\n",
331 			ioc->name));
332 		mpt_clear_taskmgmt_in_progress_flag(ioc);
333 		retval = -ENOMEM;
334 		goto tm_done;
335 	}
336 
337 	dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT "TaskMgmt request (mf=%p)\n",
338 		ioc->name, mf));
339 
340 	pScsiTm = (SCSITaskMgmt_t *) mf;
341 	memset(pScsiTm, 0, sizeof(SCSITaskMgmt_t));
342 	pScsiTm->Function = MPI_FUNCTION_SCSI_TASK_MGMT;
343 	pScsiTm->TaskType = tm_type;
344 	if ((tm_type == MPI_SCSITASKMGMT_TASKTYPE_RESET_BUS) &&
345 		(ioc->bus_type == FC))
346 		pScsiTm->MsgFlags =
347 				MPI_SCSITASKMGMT_MSGFLAGS_LIPRESET_RESET_OPTION;
348 	pScsiTm->TargetID = target_id;
349 	pScsiTm->Bus = bus_id;
350 	pScsiTm->ChainOffset = 0;
351 	pScsiTm->Reserved = 0;
352 	pScsiTm->Reserved1 = 0;
353 	pScsiTm->TaskMsgContext = 0;
354 	for (ii= 0; ii < 8; ii++)
355 		pScsiTm->LUN[ii] = 0;
356 	for (ii=0; ii < 7; ii++)
357 		pScsiTm->Reserved2[ii] = 0;
358 
359 	switch (ioc->bus_type) {
360 	case FC:
361 		timeout = 40;
362 		break;
363 	case SAS:
364 		timeout = 30;
365 		break;
366 	case SPI:
367 		default:
368 		timeout = 10;
369 		break;
370 	}
371 
372 	dtmprintk(ioc,
373 		printk(MYIOC_s_DEBUG_FMT "TaskMgmt type=%d timeout=%ld\n",
374 		ioc->name, tm_type, timeout));
375 
376 	INITIALIZE_MGMT_STATUS(ioc->taskmgmt_cmds.status)
377 	time_count = jiffies;
378 	if ((ioc->facts.IOCCapabilities & MPI_IOCFACTS_CAPABILITY_HIGH_PRI_Q) &&
379 	    (ioc->facts.MsgVersion >= MPI_VERSION_01_05))
380 		mpt_put_msg_frame_hi_pri(mptctl_taskmgmt_id, ioc, mf);
381 	else {
382 		retval = mpt_send_handshake_request(mptctl_taskmgmt_id, ioc,
383 		    sizeof(SCSITaskMgmt_t), (u32 *)pScsiTm, CAN_SLEEP);
384 		if (retval != 0) {
385 			dfailprintk(ioc,
386 				printk(MYIOC_s_ERR_FMT
387 				"TaskMgmt send_handshake FAILED!"
388 				" (ioc %p, mf %p, rc=%d) \n", ioc->name,
389 				ioc, mf, retval));
390 			mpt_free_msg_frame(ioc, mf);
391 			mpt_clear_taskmgmt_in_progress_flag(ioc);
392 			goto tm_done;
393 		}
394 	}
395 
396 	/* Now wait for the command to complete */
397 	ii = wait_for_completion_timeout(&ioc->taskmgmt_cmds.done, timeout*HZ);
398 
399 	if (!(ioc->taskmgmt_cmds.status & MPT_MGMT_STATUS_COMMAND_GOOD)) {
400 		dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
401 		    "TaskMgmt failed\n", ioc->name));
402 		mpt_free_msg_frame(ioc, mf);
403 		mpt_clear_taskmgmt_in_progress_flag(ioc);
404 		if (ioc->taskmgmt_cmds.status & MPT_MGMT_STATUS_DID_IOCRESET)
405 			retval = 0;
406 		else
407 			retval = -1; /* return failure */
408 		goto tm_done;
409 	}
410 
411 	if (!(ioc->taskmgmt_cmds.status & MPT_MGMT_STATUS_RF_VALID)) {
412 		dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
413 		    "TaskMgmt failed\n", ioc->name));
414 		retval = -1; /* return failure */
415 		goto tm_done;
416 	}
417 
418 	pScsiTmReply = (SCSITaskMgmtReply_t *) ioc->taskmgmt_cmds.reply;
419 	dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
420 	    "TaskMgmt fw_channel = %d, fw_id = %d, task_type=0x%02X, "
421 	    "iocstatus=0x%04X\n\tloginfo=0x%08X, response_code=0x%02X, "
422 	    "term_cmnds=%d\n", ioc->name, pScsiTmReply->Bus,
423 	    pScsiTmReply->TargetID, tm_type,
424 	    le16_to_cpu(pScsiTmReply->IOCStatus),
425 	    le32_to_cpu(pScsiTmReply->IOCLogInfo),
426 	    pScsiTmReply->ResponseCode,
427 	    le32_to_cpu(pScsiTmReply->TerminationCount)));
428 
429 	iocstatus = le16_to_cpu(pScsiTmReply->IOCStatus) & MPI_IOCSTATUS_MASK;
430 
431 	if (iocstatus == MPI_IOCSTATUS_SCSI_TASK_TERMINATED ||
432 	   iocstatus == MPI_IOCSTATUS_SCSI_IOC_TERMINATED ||
433 	   iocstatus == MPI_IOCSTATUS_SUCCESS)
434 		retval = 0;
435 	else {
436 		dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
437 		    "TaskMgmt failed\n", ioc->name));
438 		retval = -1; /* return failure */
439 	}
440 
441  tm_done:
442 	mutex_unlock(&ioc->taskmgmt_cmds.mutex);
443 	CLEAR_MGMT_STATUS(ioc->taskmgmt_cmds.status)
444 	return retval;
445 }
446 
447 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
448 /* mptctl_timeout_expired
449  *
450  * Expecting an interrupt, however timed out.
451  *
452  */
453 static void
454 mptctl_timeout_expired(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf)
455 {
456 	unsigned long flags;
457 	int ret_val = -1;
458 	SCSIIORequest_t *scsi_req = (SCSIIORequest_t *) mf;
459 	u8 function = mf->u.hdr.Function;
460 
461 	dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT ": %s\n",
462 		ioc->name, __func__));
463 
464 	if (mpt_fwfault_debug)
465 		mpt_halt_firmware(ioc);
466 
467 	spin_lock_irqsave(&ioc->taskmgmt_lock, flags);
468 	if (ioc->ioc_reset_in_progress) {
469 		spin_unlock_irqrestore(&ioc->taskmgmt_lock, flags);
470 		CLEAR_MGMT_PENDING_STATUS(ioc->ioctl_cmds.status)
471 		mpt_free_msg_frame(ioc, mf);
472 		return;
473 	}
474 	spin_unlock_irqrestore(&ioc->taskmgmt_lock, flags);
475 
476 
477 	CLEAR_MGMT_PENDING_STATUS(ioc->ioctl_cmds.status)
478 
479 	if (ioc->bus_type == SAS) {
480 		if (function == MPI_FUNCTION_SCSI_IO_REQUEST)
481 			ret_val = mptctl_do_taskmgmt(ioc,
482 				MPI_SCSITASKMGMT_TASKTYPE_TARGET_RESET,
483 				scsi_req->Bus, scsi_req->TargetID);
484 		else if (function == MPI_FUNCTION_RAID_SCSI_IO_PASSTHROUGH)
485 			ret_val = mptctl_do_taskmgmt(ioc,
486 				MPI_SCSITASKMGMT_TASKTYPE_RESET_BUS,
487 				scsi_req->Bus, 0);
488 		if (!ret_val)
489 			return;
490 	} else {
491 		if ((function == MPI_FUNCTION_SCSI_IO_REQUEST) ||
492 			(function == MPI_FUNCTION_RAID_SCSI_IO_PASSTHROUGH))
493 			ret_val = mptctl_do_taskmgmt(ioc,
494 				MPI_SCSITASKMGMT_TASKTYPE_RESET_BUS,
495 				scsi_req->Bus, 0);
496 		if (!ret_val)
497 			return;
498 	}
499 
500 	dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT "Calling Reset! \n",
501 		 ioc->name));
502 	mpt_Soft_Hard_ResetHandler(ioc, CAN_SLEEP);
503 	mpt_free_msg_frame(ioc, mf);
504 }
505 
506 
507 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
508 /* mptctl_ioc_reset
509  *
510  * Clean-up functionality. Used only if there has been a
511  * reload of the FW due.
512  *
513  */
514 static int
515 mptctl_ioc_reset(MPT_ADAPTER *ioc, int reset_phase)
516 {
517 	switch(reset_phase) {
518 	case MPT_IOC_SETUP_RESET:
519 		dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
520 		    "%s: MPT_IOC_SETUP_RESET\n", ioc->name, __func__));
521 		break;
522 	case MPT_IOC_PRE_RESET:
523 		dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
524 		    "%s: MPT_IOC_PRE_RESET\n", ioc->name, __func__));
525 		break;
526 	case MPT_IOC_POST_RESET:
527 		dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT
528 		    "%s: MPT_IOC_POST_RESET\n", ioc->name, __func__));
529 		if (ioc->ioctl_cmds.status & MPT_MGMT_STATUS_PENDING) {
530 			ioc->ioctl_cmds.status |= MPT_MGMT_STATUS_DID_IOCRESET;
531 			complete(&ioc->ioctl_cmds.done);
532 		}
533 		break;
534 	default:
535 		break;
536 	}
537 
538 	return 1;
539 }
540 
541 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
542 /* ASYNC Event Notification Support */
543 static int
544 mptctl_event_process(MPT_ADAPTER *ioc, EventNotificationReply_t *pEvReply)
545 {
546 	u8 event;
547 
548 	event = le32_to_cpu(pEvReply->Event) & 0xFF;
549 
550 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "%s() called\n",
551 	    ioc->name, __func__));
552 	if(async_queue == NULL)
553 		return 1;
554 
555 	/* Raise SIGIO for persistent events.
556 	 * TODO - this define is not in MPI spec yet,
557 	 * but they plan to set it to 0x21
558 	 */
559 	 if (event == 0x21 ) {
560 		ioc->aen_event_read_flag=1;
561 		dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "Raised SIGIO to application\n",
562 		    ioc->name));
563 		devtverboseprintk(ioc, printk(MYIOC_s_DEBUG_FMT
564 		    "Raised SIGIO to application\n", ioc->name));
565 		kill_fasync(&async_queue, SIGIO, POLL_IN);
566 		return 1;
567 	 }
568 
569 	/* This flag is set after SIGIO was raised, and
570 	 * remains set until the application has read
571 	 * the event log via ioctl=MPTEVENTREPORT
572 	 */
573 	if(ioc->aen_event_read_flag)
574 		return 1;
575 
576 	/* Signal only for the events that are
577 	 * requested for by the application
578 	 */
579 	if (ioc->events && (ioc->eventTypes & ( 1 << event))) {
580 		ioc->aen_event_read_flag=1;
581 		dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT
582 		    "Raised SIGIO to application\n", ioc->name));
583 		devtverboseprintk(ioc, printk(MYIOC_s_DEBUG_FMT
584 		    "Raised SIGIO to application\n", ioc->name));
585 		kill_fasync(&async_queue, SIGIO, POLL_IN);
586 	}
587 	return 1;
588 }
589 
590 static int
591 mptctl_fasync(int fd, struct file *filep, int mode)
592 {
593 	MPT_ADAPTER	*ioc;
594 	int ret;
595 
596 	lock_kernel();
597 	list_for_each_entry(ioc, &ioc_list, list)
598 		ioc->aen_event_read_flag=0;
599 
600 	ret = fasync_helper(fd, filep, mode, &async_queue);
601 	unlock_kernel();
602 	return ret;
603 }
604 
605 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
606 /*
607  *  MPT ioctl handler
608  *  cmd - specify the particular IOCTL command to be issued
609  *  arg - data specific to the command. Must not be null.
610  */
611 static long
612 __mptctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
613 {
614 	mpt_ioctl_header __user *uhdr = (void __user *) arg;
615 	mpt_ioctl_header	 khdr;
616 	int iocnum;
617 	unsigned iocnumX;
618 	int nonblock = (file->f_flags & O_NONBLOCK);
619 	int ret;
620 	MPT_ADAPTER *iocp = NULL;
621 
622 	if (copy_from_user(&khdr, uhdr, sizeof(khdr))) {
623 		printk(KERN_ERR MYNAM "%s::mptctl_ioctl() @%d - "
624 				"Unable to copy mpt_ioctl_header data @ %p\n",
625 				__FILE__, __LINE__, uhdr);
626 		return -EFAULT;
627 	}
628 	ret = -ENXIO;				/* (-6) No such device or address */
629 
630 	/* Verify intended MPT adapter - set iocnum and the adapter
631 	 * pointer (iocp)
632 	 */
633 	iocnumX = khdr.iocnum & 0xFF;
634 	if (((iocnum = mpt_verify_adapter(iocnumX, &iocp)) < 0) ||
635 	    (iocp == NULL))
636 		return -ENODEV;
637 
638 	if (!iocp->active) {
639 		printk(KERN_DEBUG MYNAM "%s::mptctl_ioctl() @%d - Controller disabled.\n",
640 				__FILE__, __LINE__);
641 		return -EFAULT;
642 	}
643 
644 	/* Handle those commands that are just returning
645 	 * information stored in the driver.
646 	 * These commands should never time out and are unaffected
647 	 * by TM and FW reloads.
648 	 */
649 	if ((cmd & ~IOCSIZE_MASK) == (MPTIOCINFO & ~IOCSIZE_MASK)) {
650 		return mptctl_getiocinfo(arg, _IOC_SIZE(cmd));
651 	} else if (cmd == MPTTARGETINFO) {
652 		return mptctl_gettargetinfo(arg);
653 	} else if (cmd == MPTTEST) {
654 		return mptctl_readtest(arg);
655 	} else if (cmd == MPTEVENTQUERY) {
656 		return mptctl_eventquery(arg);
657 	} else if (cmd == MPTEVENTENABLE) {
658 		return mptctl_eventenable(arg);
659 	} else if (cmd == MPTEVENTREPORT) {
660 		return mptctl_eventreport(arg);
661 	} else if (cmd == MPTFWREPLACE) {
662 		return mptctl_replace_fw(arg);
663 	}
664 
665 	/* All of these commands require an interrupt or
666 	 * are unknown/illegal.
667 	 */
668 	if ((ret = mptctl_syscall_down(iocp, nonblock)) != 0)
669 		return ret;
670 
671 	if (cmd == MPTFWDOWNLOAD)
672 		ret = mptctl_fw_download(arg);
673 	else if (cmd == MPTCOMMAND)
674 		ret = mptctl_mpt_command(arg);
675 	else if (cmd == MPTHARDRESET)
676 		ret = mptctl_do_reset(arg);
677 	else if ((cmd & ~IOCSIZE_MASK) == (HP_GETHOSTINFO & ~IOCSIZE_MASK))
678 		ret = mptctl_hp_hostinfo(arg, _IOC_SIZE(cmd));
679 	else if (cmd == HP_GETTARGETINFO)
680 		ret = mptctl_hp_targetinfo(arg);
681 	else
682 		ret = -EINVAL;
683 
684 	mutex_unlock(&iocp->ioctl_cmds.mutex);
685 
686 	return ret;
687 }
688 
689 static long
690 mptctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
691 {
692 	long ret;
693 	lock_kernel();
694 	ret = __mptctl_ioctl(file, cmd, arg);
695 	unlock_kernel();
696 	return ret;
697 }
698 
699 static int mptctl_do_reset(unsigned long arg)
700 {
701 	struct mpt_ioctl_diag_reset __user *urinfo = (void __user *) arg;
702 	struct mpt_ioctl_diag_reset krinfo;
703 	MPT_ADAPTER		*iocp;
704 
705 	if (copy_from_user(&krinfo, urinfo, sizeof(struct mpt_ioctl_diag_reset))) {
706 		printk(KERN_ERR MYNAM "%s@%d::mptctl_do_reset - "
707 				"Unable to copy mpt_ioctl_diag_reset struct @ %p\n",
708 				__FILE__, __LINE__, urinfo);
709 		return -EFAULT;
710 	}
711 
712 	if (mpt_verify_adapter(krinfo.hdr.iocnum, &iocp) < 0) {
713 		printk(KERN_DEBUG MYNAM "%s@%d::mptctl_do_reset - ioc%d not found!\n",
714 				__FILE__, __LINE__, krinfo.hdr.iocnum);
715 		return -ENODEV; /* (-6) No such device or address */
716 	}
717 
718 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "mptctl_do_reset called.\n",
719 	    iocp->name));
720 
721 	if (mpt_HardResetHandler(iocp, CAN_SLEEP) != 0) {
722 		printk (MYIOC_s_ERR_FMT "%s@%d::mptctl_do_reset - reset failed.\n",
723 			iocp->name, __FILE__, __LINE__);
724 		return -1;
725 	}
726 
727 	return 0;
728 }
729 
730 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
731 /*
732  * MPT FW download function.  Cast the arg into the mpt_fw_xfer structure.
733  * This structure contains: iocnum, firmware length (bytes),
734  *      pointer to user space memory where the fw image is stored.
735  *
736  * Outputs:	None.
737  * Return:	0 if successful
738  *		-EFAULT if data unavailable
739  *		-ENXIO  if no such device
740  *		-EAGAIN if resource problem
741  *		-ENOMEM if no memory for SGE
742  *		-EMLINK if too many chain buffers required
743  *		-EBADRQC if adapter does not support FW download
744  *		-EBUSY if adapter is busy
745  *		-ENOMSG if FW upload returned bad status
746  */
747 static int
748 mptctl_fw_download(unsigned long arg)
749 {
750 	struct mpt_fw_xfer __user *ufwdl = (void __user *) arg;
751 	struct mpt_fw_xfer	 kfwdl;
752 
753 	if (copy_from_user(&kfwdl, ufwdl, sizeof(struct mpt_fw_xfer))) {
754 		printk(KERN_ERR MYNAM "%s@%d::_ioctl_fwdl - "
755 				"Unable to copy mpt_fw_xfer struct @ %p\n",
756 				__FILE__, __LINE__, ufwdl);
757 		return -EFAULT;
758 	}
759 
760 	return mptctl_do_fw_download(kfwdl.iocnum, kfwdl.bufp, kfwdl.fwlen);
761 }
762 
763 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
764 /*
765  * FW Download engine.
766  * Outputs:	None.
767  * Return:	0 if successful
768  *		-EFAULT if data unavailable
769  *		-ENXIO  if no such device
770  *		-EAGAIN if resource problem
771  *		-ENOMEM if no memory for SGE
772  *		-EMLINK if too many chain buffers required
773  *		-EBADRQC if adapter does not support FW download
774  *		-EBUSY if adapter is busy
775  *		-ENOMSG if FW upload returned bad status
776  */
777 static int
778 mptctl_do_fw_download(int ioc, char __user *ufwbuf, size_t fwlen)
779 {
780 	FWDownload_t		*dlmsg;
781 	MPT_FRAME_HDR		*mf;
782 	MPT_ADAPTER		*iocp;
783 	FWDownloadTCSGE_t	*ptsge;
784 	MptSge_t		*sgl, *sgIn;
785 	char			*sgOut;
786 	struct buflist		*buflist;
787 	struct buflist		*bl;
788 	dma_addr_t		 sgl_dma;
789 	int			 ret;
790 	int			 numfrags = 0;
791 	int			 maxfrags;
792 	int			 n = 0;
793 	u32			 sgdir;
794 	u32			 nib;
795 	int			 fw_bytes_copied = 0;
796 	int			 i;
797 	int			 sge_offset = 0;
798 	u16			 iocstat;
799 	pFWDownloadReply_t	 ReplyMsg = NULL;
800 	unsigned long		 timeleft;
801 
802 	if (mpt_verify_adapter(ioc, &iocp) < 0) {
803 		printk(KERN_DEBUG MYNAM "ioctl_fwdl - ioc%d not found!\n",
804 				 ioc);
805 		return -ENODEV; /* (-6) No such device or address */
806 	} else {
807 
808 		/*  Valid device. Get a message frame and construct the FW download message.
809 	 	*/
810 		if ((mf = mpt_get_msg_frame(mptctl_id, iocp)) == NULL)
811 			return -EAGAIN;
812 	}
813 
814 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT
815 	    "mptctl_do_fwdl called. mptctl_id = %xh.\n", iocp->name, mptctl_id));
816 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "DbG: kfwdl.bufp  = %p\n",
817 	    iocp->name, ufwbuf));
818 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "DbG: kfwdl.fwlen = %d\n",
819 	    iocp->name, (int)fwlen));
820 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "DbG: kfwdl.ioc   = %04xh\n",
821 	    iocp->name, ioc));
822 
823 	dlmsg = (FWDownload_t*) mf;
824 	ptsge = (FWDownloadTCSGE_t *) &dlmsg->SGL;
825 	sgOut = (char *) (ptsge + 1);
826 
827 	/*
828 	 * Construct f/w download request
829 	 */
830 	dlmsg->ImageType = MPI_FW_DOWNLOAD_ITYPE_FW;
831 	dlmsg->Reserved = 0;
832 	dlmsg->ChainOffset = 0;
833 	dlmsg->Function = MPI_FUNCTION_FW_DOWNLOAD;
834 	dlmsg->Reserved1[0] = dlmsg->Reserved1[1] = dlmsg->Reserved1[2] = 0;
835 	if (iocp->facts.MsgVersion >= MPI_VERSION_01_05)
836 		dlmsg->MsgFlags = MPI_FW_DOWNLOAD_MSGFLGS_LAST_SEGMENT;
837 	else
838 		dlmsg->MsgFlags = 0;
839 
840 
841 	/* Set up the Transaction SGE.
842 	 */
843 	ptsge->Reserved = 0;
844 	ptsge->ContextSize = 0;
845 	ptsge->DetailsLength = 12;
846 	ptsge->Flags = MPI_SGE_FLAGS_TRANSACTION_ELEMENT;
847 	ptsge->Reserved_0100_Checksum = 0;
848 	ptsge->ImageOffset = 0;
849 	ptsge->ImageSize = cpu_to_le32(fwlen);
850 
851 	/* Add the SGL
852 	 */
853 
854 	/*
855 	 * Need to kmalloc area(s) for holding firmware image bytes.
856 	 * But we need to do it piece meal, using a proper
857 	 * scatter gather list (with 128kB MAX hunks).
858 	 *
859 	 * A practical limit here might be # of sg hunks that fit into
860 	 * a single IOC request frame; 12 or 8 (see below), so:
861 	 * For FC9xx: 12 x 128kB == 1.5 mB (max)
862 	 * For C1030:  8 x 128kB == 1   mB (max)
863 	 * We could support chaining, but things get ugly(ier:)
864 	 *
865 	 * Set the sge_offset to the start of the sgl (bytes).
866 	 */
867 	sgdir = 0x04000000;		/* IOC will READ from sys mem */
868 	sge_offset = sizeof(MPIHeader_t) + sizeof(FWDownloadTCSGE_t);
869 	if ((sgl = kbuf_alloc_2_sgl(fwlen, sgdir, sge_offset,
870 				    &numfrags, &buflist, &sgl_dma, iocp)) == NULL)
871 		return -ENOMEM;
872 
873 	/*
874 	 * We should only need SGL with 2 simple_32bit entries (up to 256 kB)
875 	 * for FC9xx f/w image, but calculate max number of sge hunks
876 	 * we can fit into a request frame, and limit ourselves to that.
877 	 * (currently no chain support)
878 	 * maxfrags = (Request Size - FWdownload Size ) / Size of 32 bit SGE
879 	 *	Request		maxfrags
880 	 *	128		12
881 	 *	96		8
882 	 *	64		4
883 	 */
884 	maxfrags = (iocp->req_sz - sizeof(MPIHeader_t) -
885 			sizeof(FWDownloadTCSGE_t))
886 			/ iocp->SGE_size;
887 	if (numfrags > maxfrags) {
888 		ret = -EMLINK;
889 		goto fwdl_out;
890 	}
891 
892 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "DbG: sgl buffer = %p, sgfrags = %d\n",
893 	    iocp->name, sgl, numfrags));
894 
895 	/*
896 	 * Parse SG list, copying sgl itself,
897 	 * plus f/w image hunks from user space as we go...
898 	 */
899 	ret = -EFAULT;
900 	sgIn = sgl;
901 	bl = buflist;
902 	for (i=0; i < numfrags; i++) {
903 
904 		/* Get the SGE type: 0 - TCSGE, 3 - Chain, 1 - Simple SGE
905 		 * Skip everything but Simple. If simple, copy from
906 		 *	user space into kernel space.
907 		 * Note: we should not have anything but Simple as
908 		 *	Chain SGE are illegal.
909 		 */
910 		nib = (sgIn->FlagsLength & 0x30000000) >> 28;
911 		if (nib == 0 || nib == 3) {
912 			;
913 		} else if (sgIn->Address) {
914 			iocp->add_sge(sgOut, sgIn->FlagsLength, sgIn->Address);
915 			n++;
916 			if (copy_from_user(bl->kptr, ufwbuf+fw_bytes_copied, bl->len)) {
917 				printk(MYIOC_s_ERR_FMT "%s@%d::_ioctl_fwdl - "
918 					"Unable to copy f/w buffer hunk#%d @ %p\n",
919 					iocp->name, __FILE__, __LINE__, n, ufwbuf);
920 				goto fwdl_out;
921 			}
922 			fw_bytes_copied += bl->len;
923 		}
924 		sgIn++;
925 		bl++;
926 		sgOut += iocp->SGE_size;
927 	}
928 
929 	DBG_DUMP_FW_DOWNLOAD(iocp, (u32 *)mf, numfrags);
930 
931 	/*
932 	 * Finally, perform firmware download.
933 	 */
934 	ReplyMsg = NULL;
935 	SET_MGMT_MSG_CONTEXT(iocp->ioctl_cmds.msg_context, dlmsg->MsgContext);
936 	INITIALIZE_MGMT_STATUS(iocp->ioctl_cmds.status)
937 	mpt_put_msg_frame(mptctl_id, iocp, mf);
938 
939 	/* Now wait for the command to complete */
940 retry_wait:
941 	timeleft = wait_for_completion_timeout(&iocp->ioctl_cmds.done, HZ*60);
942 	if (!(iocp->ioctl_cmds.status & MPT_MGMT_STATUS_COMMAND_GOOD)) {
943 		ret = -ETIME;
944 		printk(MYIOC_s_WARN_FMT "%s: failed\n", iocp->name, __func__);
945 		if (iocp->ioctl_cmds.status & MPT_MGMT_STATUS_DID_IOCRESET) {
946 			mpt_free_msg_frame(iocp, mf);
947 			goto fwdl_out;
948 		}
949 		if (!timeleft)
950 			mptctl_timeout_expired(iocp, mf);
951 		else
952 			goto retry_wait;
953 		goto fwdl_out;
954 	}
955 
956 	if (!(iocp->ioctl_cmds.status & MPT_MGMT_STATUS_RF_VALID)) {
957 		printk(MYIOC_s_WARN_FMT "%s: failed\n", iocp->name, __func__);
958 		mpt_free_msg_frame(iocp, mf);
959 		ret = -ENODATA;
960 		goto fwdl_out;
961 	}
962 
963 	if (sgl)
964 		kfree_sgl(sgl, sgl_dma, buflist, iocp);
965 
966 	ReplyMsg = (pFWDownloadReply_t)iocp->ioctl_cmds.reply;
967 	iocstat = le16_to_cpu(ReplyMsg->IOCStatus) & MPI_IOCSTATUS_MASK;
968 	if (iocstat == MPI_IOCSTATUS_SUCCESS) {
969 		printk(MYIOC_s_INFO_FMT "F/W update successfull!\n", iocp->name);
970 		return 0;
971 	} else if (iocstat == MPI_IOCSTATUS_INVALID_FUNCTION) {
972 		printk(MYIOC_s_WARN_FMT "Hmmm...  F/W download not supported!?!\n",
973 			iocp->name);
974 		printk(MYIOC_s_WARN_FMT "(time to go bang on somebodies door)\n",
975 			iocp->name);
976 		return -EBADRQC;
977 	} else if (iocstat == MPI_IOCSTATUS_BUSY) {
978 		printk(MYIOC_s_WARN_FMT "IOC_BUSY!\n", iocp->name);
979 		printk(MYIOC_s_WARN_FMT "(try again later?)\n", iocp->name);
980 		return -EBUSY;
981 	} else {
982 		printk(MYIOC_s_WARN_FMT "ioctl_fwdl() returned [bad] status = %04xh\n",
983 			iocp->name, iocstat);
984 		printk(MYIOC_s_WARN_FMT "(bad VooDoo)\n", iocp->name);
985 		return -ENOMSG;
986 	}
987 	return 0;
988 
989 fwdl_out:
990 
991 	CLEAR_MGMT_STATUS(iocp->ioctl_cmds.status);
992 	SET_MGMT_MSG_CONTEXT(iocp->ioctl_cmds.msg_context, 0);
993         kfree_sgl(sgl, sgl_dma, buflist, iocp);
994 	return ret;
995 }
996 
997 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
998 /*
999  * SGE Allocation routine
1000  *
1001  * Inputs:	bytes - number of bytes to be transferred
1002  *		sgdir - data direction
1003  *		sge_offset - offset (in bytes) from the start of the request
1004  *			frame to the first SGE
1005  *		ioc - pointer to the mptadapter
1006  * Outputs:	frags - number of scatter gather elements
1007  *		blp - point to the buflist pointer
1008  *		sglbuf_dma - pointer to the (dma) sgl
1009  * Returns:	Null if failes
1010  *		pointer to the (virtual) sgl if successful.
1011  */
1012 static MptSge_t *
1013 kbuf_alloc_2_sgl(int bytes, u32 sgdir, int sge_offset, int *frags,
1014 		 struct buflist **blp, dma_addr_t *sglbuf_dma, MPT_ADAPTER *ioc)
1015 {
1016 	MptSge_t	*sglbuf = NULL;		/* pointer to array of SGE */
1017 						/* and chain buffers */
1018 	struct buflist	*buflist = NULL;	/* kernel routine */
1019 	MptSge_t	*sgl;
1020 	int		 numfrags = 0;
1021 	int		 fragcnt = 0;
1022 	int		 alloc_sz = min(bytes,MAX_KMALLOC_SZ);	// avoid kernel warning msg!
1023 	int		 bytes_allocd = 0;
1024 	int		 this_alloc;
1025 	dma_addr_t	 pa;					// phys addr
1026 	int		 i, buflist_ent;
1027 	int		 sg_spill = MAX_FRAGS_SPILL1;
1028 	int		 dir;
1029 	/* initialization */
1030 	*frags = 0;
1031 	*blp = NULL;
1032 
1033 	/* Allocate and initialize an array of kernel
1034 	 * structures for the SG elements.
1035 	 */
1036 	i = MAX_SGL_BYTES / 8;
1037 	buflist = kzalloc(i, GFP_USER);
1038 	if (!buflist)
1039 		return NULL;
1040 	buflist_ent = 0;
1041 
1042 	/* Allocate a single block of memory to store the sg elements and
1043 	 * the chain buffers.  The calling routine is responsible for
1044 	 * copying the data in this array into the correct place in the
1045 	 * request and chain buffers.
1046 	 */
1047 	sglbuf = pci_alloc_consistent(ioc->pcidev, MAX_SGL_BYTES, sglbuf_dma);
1048 	if (sglbuf == NULL)
1049 		goto free_and_fail;
1050 
1051 	if (sgdir & 0x04000000)
1052 		dir = PCI_DMA_TODEVICE;
1053 	else
1054 		dir = PCI_DMA_FROMDEVICE;
1055 
1056 	/* At start:
1057 	 *	sgl = sglbuf = point to beginning of sg buffer
1058 	 *	buflist_ent = 0 = first kernel structure
1059 	 *	sg_spill = number of SGE that can be written before the first
1060 	 *		chain element.
1061 	 *
1062 	 */
1063 	sgl = sglbuf;
1064 	sg_spill = ((ioc->req_sz - sge_offset)/ioc->SGE_size) - 1;
1065 	while (bytes_allocd < bytes) {
1066 		this_alloc = min(alloc_sz, bytes-bytes_allocd);
1067 		buflist[buflist_ent].len = this_alloc;
1068 		buflist[buflist_ent].kptr = pci_alloc_consistent(ioc->pcidev,
1069 								 this_alloc,
1070 								 &pa);
1071 		if (buflist[buflist_ent].kptr == NULL) {
1072 			alloc_sz = alloc_sz / 2;
1073 			if (alloc_sz == 0) {
1074 				printk(MYIOC_s_WARN_FMT "-SG: No can do - "
1075 				    "not enough memory!   :-(\n", ioc->name);
1076 				printk(MYIOC_s_WARN_FMT "-SG: (freeing %d frags)\n",
1077 					ioc->name, numfrags);
1078 				goto free_and_fail;
1079 			}
1080 			continue;
1081 		} else {
1082 			dma_addr_t dma_addr;
1083 
1084 			bytes_allocd += this_alloc;
1085 			sgl->FlagsLength = (0x10000000|sgdir|this_alloc);
1086 			dma_addr = pci_map_single(ioc->pcidev,
1087 				buflist[buflist_ent].kptr, this_alloc, dir);
1088 			sgl->Address = dma_addr;
1089 
1090 			fragcnt++;
1091 			numfrags++;
1092 			sgl++;
1093 			buflist_ent++;
1094 		}
1095 
1096 		if (bytes_allocd >= bytes)
1097 			break;
1098 
1099 		/* Need to chain? */
1100 		if (fragcnt == sg_spill) {
1101 			printk(MYIOC_s_WARN_FMT
1102 			    "-SG: No can do - " "Chain required!   :-(\n", ioc->name);
1103 			printk(MYIOC_s_WARN_FMT "(freeing %d frags)\n", ioc->name, numfrags);
1104 			goto free_and_fail;
1105 		}
1106 
1107 		/* overflow check... */
1108 		if (numfrags*8 > MAX_SGL_BYTES){
1109 			/* GRRRRR... */
1110 			printk(MYIOC_s_WARN_FMT "-SG: No can do - "
1111 				"too many SG frags!   :-(\n", ioc->name);
1112 			printk(MYIOC_s_WARN_FMT "-SG: (freeing %d frags)\n",
1113 				ioc->name, numfrags);
1114 			goto free_and_fail;
1115 		}
1116 	}
1117 
1118 	/* Last sge fixup: set LE+eol+eob bits */
1119 	sgl[-1].FlagsLength |= 0xC1000000;
1120 
1121 	*frags = numfrags;
1122 	*blp = buflist;
1123 
1124 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "-SG: kbuf_alloc_2_sgl() - "
1125 	   "%d SG frags generated!\n", ioc->name, numfrags));
1126 
1127 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "-SG: kbuf_alloc_2_sgl() - "
1128 	   "last (big) alloc_sz=%d\n", ioc->name, alloc_sz));
1129 
1130 	return sglbuf;
1131 
1132 free_and_fail:
1133 	if (sglbuf != NULL) {
1134 		for (i = 0; i < numfrags; i++) {
1135 			dma_addr_t dma_addr;
1136 			u8 *kptr;
1137 			int len;
1138 
1139 			if ((sglbuf[i].FlagsLength >> 24) == 0x30)
1140 				continue;
1141 
1142 			dma_addr = sglbuf[i].Address;
1143 			kptr = buflist[i].kptr;
1144 			len = buflist[i].len;
1145 
1146 			pci_free_consistent(ioc->pcidev, len, kptr, dma_addr);
1147 		}
1148 		pci_free_consistent(ioc->pcidev, MAX_SGL_BYTES, sglbuf, *sglbuf_dma);
1149 	}
1150 	kfree(buflist);
1151 	return NULL;
1152 }
1153 
1154 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1155 /*
1156  * Routine to free the SGL elements.
1157  */
1158 static void
1159 kfree_sgl(MptSge_t *sgl, dma_addr_t sgl_dma, struct buflist *buflist, MPT_ADAPTER *ioc)
1160 {
1161 	MptSge_t	*sg = sgl;
1162 	struct buflist	*bl = buflist;
1163 	u32		 nib;
1164 	int		 dir;
1165 	int		 n = 0;
1166 
1167 	if (sg->FlagsLength & 0x04000000)
1168 		dir = PCI_DMA_TODEVICE;
1169 	else
1170 		dir = PCI_DMA_FROMDEVICE;
1171 
1172 	nib = (sg->FlagsLength & 0xF0000000) >> 28;
1173 	while (! (nib & 0x4)) { /* eob */
1174 		/* skip ignore/chain. */
1175 		if (nib == 0 || nib == 3) {
1176 			;
1177 		} else if (sg->Address) {
1178 			dma_addr_t dma_addr;
1179 			void *kptr;
1180 			int len;
1181 
1182 			dma_addr = sg->Address;
1183 			kptr = bl->kptr;
1184 			len = bl->len;
1185 			pci_unmap_single(ioc->pcidev, dma_addr, len, dir);
1186 			pci_free_consistent(ioc->pcidev, len, kptr, dma_addr);
1187 			n++;
1188 		}
1189 		sg++;
1190 		bl++;
1191 		nib = (le32_to_cpu(sg->FlagsLength) & 0xF0000000) >> 28;
1192 	}
1193 
1194 	/* we're at eob! */
1195 	if (sg->Address) {
1196 		dma_addr_t dma_addr;
1197 		void *kptr;
1198 		int len;
1199 
1200 		dma_addr = sg->Address;
1201 		kptr = bl->kptr;
1202 		len = bl->len;
1203 		pci_unmap_single(ioc->pcidev, dma_addr, len, dir);
1204 		pci_free_consistent(ioc->pcidev, len, kptr, dma_addr);
1205 		n++;
1206 	}
1207 
1208 	pci_free_consistent(ioc->pcidev, MAX_SGL_BYTES, sgl, sgl_dma);
1209 	kfree(buflist);
1210 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "-SG: Free'd 1 SGL buf + %d kbufs!\n",
1211 	    ioc->name, n));
1212 }
1213 
1214 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1215 /*
1216  *	mptctl_getiocinfo - Query the host adapter for IOC information.
1217  *	@arg: User space argument
1218  *
1219  * Outputs:	None.
1220  * Return:	0 if successful
1221  *		-EFAULT if data unavailable
1222  *		-ENODEV  if no such device/adapter
1223  */
1224 static int
1225 mptctl_getiocinfo (unsigned long arg, unsigned int data_size)
1226 {
1227 	struct mpt_ioctl_iocinfo __user *uarg = (void __user *) arg;
1228 	struct mpt_ioctl_iocinfo *karg;
1229 	MPT_ADAPTER		*ioc;
1230 	struct pci_dev		*pdev;
1231 	int			iocnum;
1232 	unsigned int		port;
1233 	int			cim_rev;
1234 	u8			revision;
1235 	struct scsi_device 	*sdev;
1236 	VirtDevice		*vdevice;
1237 
1238 	/* Add of PCI INFO results in unaligned access for
1239 	 * IA64 and Sparc. Reset long to int. Return no PCI
1240 	 * data for obsolete format.
1241 	 */
1242 	if (data_size == sizeof(struct mpt_ioctl_iocinfo_rev0))
1243 		cim_rev = 0;
1244 	else if (data_size == sizeof(struct mpt_ioctl_iocinfo_rev1))
1245 		cim_rev = 1;
1246 	else if (data_size == sizeof(struct mpt_ioctl_iocinfo))
1247 		cim_rev = 2;
1248 	else if (data_size == (sizeof(struct mpt_ioctl_iocinfo_rev0)+12))
1249 		cim_rev = 0;	/* obsolete */
1250 	else
1251 		return -EFAULT;
1252 
1253 	karg = kmalloc(data_size, GFP_KERNEL);
1254 	if (karg == NULL) {
1255 		printk(KERN_ERR MYNAM "%s::mpt_ioctl_iocinfo() @%d - no memory available!\n",
1256 				__FILE__, __LINE__);
1257 		return -ENOMEM;
1258 	}
1259 
1260 	if (copy_from_user(karg, uarg, data_size)) {
1261 		printk(KERN_ERR MYNAM "%s@%d::mptctl_getiocinfo - "
1262 			"Unable to read in mpt_ioctl_iocinfo struct @ %p\n",
1263 				__FILE__, __LINE__, uarg);
1264 		kfree(karg);
1265 		return -EFAULT;
1266 	}
1267 
1268 	if (((iocnum = mpt_verify_adapter(karg->hdr.iocnum, &ioc)) < 0) ||
1269 	    (ioc == NULL)) {
1270 		printk(KERN_DEBUG MYNAM "%s::mptctl_getiocinfo() @%d - ioc%d not found!\n",
1271 				__FILE__, __LINE__, iocnum);
1272 		kfree(karg);
1273 		return -ENODEV;
1274 	}
1275 
1276 	/* Verify the data transfer size is correct. */
1277 	if (karg->hdr.maxDataSize != data_size) {
1278 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_getiocinfo - "
1279 			"Structure size mismatch. Command not completed.\n",
1280 			ioc->name, __FILE__, __LINE__);
1281 		kfree(karg);
1282 		return -EFAULT;
1283 	}
1284 
1285 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_getiocinfo called.\n",
1286 	    ioc->name));
1287 
1288 	/* Fill in the data and return the structure to the calling
1289 	 * program
1290 	 */
1291 	if (ioc->bus_type == SAS)
1292 		karg->adapterType = MPT_IOCTL_INTERFACE_SAS;
1293 	else if (ioc->bus_type == FC)
1294 		karg->adapterType = MPT_IOCTL_INTERFACE_FC;
1295 	else
1296 		karg->adapterType = MPT_IOCTL_INTERFACE_SCSI;
1297 
1298 	if (karg->hdr.port > 1)
1299 		return -EINVAL;
1300 	port = karg->hdr.port;
1301 
1302 	karg->port = port;
1303 	pdev = (struct pci_dev *) ioc->pcidev;
1304 
1305 	karg->pciId = pdev->device;
1306 	pci_read_config_byte(pdev, PCI_CLASS_REVISION, &revision);
1307 	karg->hwRev = revision;
1308 	karg->subSystemDevice = pdev->subsystem_device;
1309 	karg->subSystemVendor = pdev->subsystem_vendor;
1310 
1311 	if (cim_rev == 1) {
1312 		/* Get the PCI bus, device, and function numbers for the IOC
1313 		 */
1314 		karg->pciInfo.u.bits.busNumber = pdev->bus->number;
1315 		karg->pciInfo.u.bits.deviceNumber = PCI_SLOT( pdev->devfn );
1316 		karg->pciInfo.u.bits.functionNumber = PCI_FUNC( pdev->devfn );
1317 	} else if (cim_rev == 2) {
1318 		/* Get the PCI bus, device, function and segment ID numbers
1319 		   for the IOC */
1320 		karg->pciInfo.u.bits.busNumber = pdev->bus->number;
1321 		karg->pciInfo.u.bits.deviceNumber = PCI_SLOT( pdev->devfn );
1322 		karg->pciInfo.u.bits.functionNumber = PCI_FUNC( pdev->devfn );
1323 		karg->pciInfo.segmentID = pci_domain_nr(pdev->bus);
1324 	}
1325 
1326 	/* Get number of devices
1327          */
1328 	karg->numDevices = 0;
1329 	if (ioc->sh) {
1330 		shost_for_each_device(sdev, ioc->sh) {
1331 			vdevice = sdev->hostdata;
1332 			if (vdevice == NULL || vdevice->vtarget == NULL)
1333 				continue;
1334 			if (vdevice->vtarget->tflags &
1335 			    MPT_TARGET_FLAGS_RAID_COMPONENT)
1336 				continue;
1337 			karg->numDevices++;
1338 		}
1339 	}
1340 
1341 	/* Set the BIOS and FW Version
1342 	 */
1343 	karg->FWVersion = ioc->facts.FWVersion.Word;
1344 	karg->BIOSVersion = ioc->biosVersion;
1345 
1346 	/* Set the Version Strings.
1347 	 */
1348 	strncpy (karg->driverVersion, MPT_LINUX_PACKAGE_NAME, MPT_IOCTL_VERSION_LENGTH);
1349 	karg->driverVersion[MPT_IOCTL_VERSION_LENGTH-1]='\0';
1350 
1351 	karg->busChangeEvent = 0;
1352 	karg->hostId = ioc->pfacts[port].PortSCSIID;
1353 	karg->rsvd[0] = karg->rsvd[1] = 0;
1354 
1355 	/* Copy the data from kernel memory to user memory
1356 	 */
1357 	if (copy_to_user((char __user *)arg, karg, data_size)) {
1358 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_getiocinfo - "
1359 			"Unable to write out mpt_ioctl_iocinfo struct @ %p\n",
1360 			ioc->name, __FILE__, __LINE__, uarg);
1361 		kfree(karg);
1362 		return -EFAULT;
1363 	}
1364 
1365 	kfree(karg);
1366 	return 0;
1367 }
1368 
1369 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1370 /*
1371  *	mptctl_gettargetinfo - Query the host adapter for target information.
1372  *	@arg: User space argument
1373  *
1374  * Outputs:	None.
1375  * Return:	0 if successful
1376  *		-EFAULT if data unavailable
1377  *		-ENODEV  if no such device/adapter
1378  */
1379 static int
1380 mptctl_gettargetinfo (unsigned long arg)
1381 {
1382 	struct mpt_ioctl_targetinfo __user *uarg = (void __user *) arg;
1383 	struct mpt_ioctl_targetinfo karg;
1384 	MPT_ADAPTER		*ioc;
1385 	VirtDevice		*vdevice;
1386 	char			*pmem;
1387 	int			*pdata;
1388 	int			iocnum;
1389 	int			numDevices = 0;
1390 	int			lun;
1391 	int			maxWordsLeft;
1392 	int			numBytes;
1393 	u8			port;
1394 	struct scsi_device 	*sdev;
1395 
1396 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_targetinfo))) {
1397 		printk(KERN_ERR MYNAM "%s@%d::mptctl_gettargetinfo - "
1398 			"Unable to read in mpt_ioctl_targetinfo struct @ %p\n",
1399 				__FILE__, __LINE__, uarg);
1400 		return -EFAULT;
1401 	}
1402 
1403 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
1404 	    (ioc == NULL)) {
1405 		printk(KERN_DEBUG MYNAM "%s::mptctl_gettargetinfo() @%d - ioc%d not found!\n",
1406 				__FILE__, __LINE__, iocnum);
1407 		return -ENODEV;
1408 	}
1409 
1410 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_gettargetinfo called.\n",
1411 	    ioc->name));
1412 	/* Get the port number and set the maximum number of bytes
1413 	 * in the returned structure.
1414 	 * Ignore the port setting.
1415 	 */
1416 	numBytes = karg.hdr.maxDataSize - sizeof(mpt_ioctl_header);
1417 	maxWordsLeft = numBytes/sizeof(int);
1418 	port = karg.hdr.port;
1419 
1420 	if (maxWordsLeft <= 0) {
1421 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_gettargetinfo() - no memory available!\n",
1422 			ioc->name, __FILE__, __LINE__);
1423 		return -ENOMEM;
1424 	}
1425 
1426 	/* Fill in the data and return the structure to the calling
1427 	 * program
1428 	 */
1429 
1430 	/* struct mpt_ioctl_targetinfo does not contain sufficient space
1431 	 * for the target structures so when the IOCTL is called, there is
1432 	 * not sufficient stack space for the structure. Allocate memory,
1433 	 * populate the memory, copy back to the user, then free memory.
1434 	 * targetInfo format:
1435 	 * bits 31-24: reserved
1436 	 *      23-16: LUN
1437 	 *      15- 8: Bus Number
1438 	 *       7- 0: Target ID
1439 	 */
1440 	pmem = kzalloc(numBytes, GFP_KERNEL);
1441 	if (!pmem) {
1442 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_gettargetinfo() - no memory available!\n",
1443 			ioc->name, __FILE__, __LINE__);
1444 		return -ENOMEM;
1445 	}
1446 	pdata =  (int *) pmem;
1447 
1448 	/* Get number of devices
1449          */
1450 	if (ioc->sh){
1451 		shost_for_each_device(sdev, ioc->sh) {
1452 			if (!maxWordsLeft)
1453 				continue;
1454 			vdevice = sdev->hostdata;
1455 			if (vdevice == NULL || vdevice->vtarget == NULL)
1456 				continue;
1457 			if (vdevice->vtarget->tflags &
1458 			    MPT_TARGET_FLAGS_RAID_COMPONENT)
1459 				continue;
1460 			lun = (vdevice->vtarget->raidVolume) ? 0x80 : vdevice->lun;
1461 			*pdata = (((u8)lun << 16) + (vdevice->vtarget->channel << 8) +
1462 			    (vdevice->vtarget->id ));
1463 			pdata++;
1464 			numDevices++;
1465 			--maxWordsLeft;
1466 		}
1467 	}
1468 	karg.numDevices = numDevices;
1469 
1470 	/* Copy part of the data from kernel memory to user memory
1471 	 */
1472 	if (copy_to_user((char __user *)arg, &karg,
1473 				sizeof(struct mpt_ioctl_targetinfo))) {
1474 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_gettargetinfo - "
1475 			"Unable to write out mpt_ioctl_targetinfo struct @ %p\n",
1476 			ioc->name, __FILE__, __LINE__, uarg);
1477 		kfree(pmem);
1478 		return -EFAULT;
1479 	}
1480 
1481 	/* Copy the remaining data from kernel memory to user memory
1482 	 */
1483 	if (copy_to_user(uarg->targetInfo, pmem, numBytes)) {
1484 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_gettargetinfo - "
1485 			"Unable to write out mpt_ioctl_targetinfo struct @ %p\n",
1486 			ioc->name, __FILE__, __LINE__, pdata);
1487 		kfree(pmem);
1488 		return -EFAULT;
1489 	}
1490 
1491 	kfree(pmem);
1492 
1493 	return 0;
1494 }
1495 
1496 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1497 /* MPT IOCTL Test function.
1498  *
1499  * Outputs:	None.
1500  * Return:	0 if successful
1501  *		-EFAULT if data unavailable
1502  *		-ENODEV  if no such device/adapter
1503  */
1504 static int
1505 mptctl_readtest (unsigned long arg)
1506 {
1507 	struct mpt_ioctl_test __user *uarg = (void __user *) arg;
1508 	struct mpt_ioctl_test	 karg;
1509 	MPT_ADAPTER *ioc;
1510 	int iocnum;
1511 
1512 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_test))) {
1513 		printk(KERN_ERR MYNAM "%s@%d::mptctl_readtest - "
1514 			"Unable to read in mpt_ioctl_test struct @ %p\n",
1515 				__FILE__, __LINE__, uarg);
1516 		return -EFAULT;
1517 	}
1518 
1519 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
1520 	    (ioc == NULL)) {
1521 		printk(KERN_DEBUG MYNAM "%s::mptctl_readtest() @%d - ioc%d not found!\n",
1522 				__FILE__, __LINE__, iocnum);
1523 		return -ENODEV;
1524 	}
1525 
1526 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_readtest called.\n",
1527 	    ioc->name));
1528 	/* Fill in the data and return the structure to the calling
1529 	 * program
1530 	 */
1531 
1532 #ifdef MFCNT
1533 	karg.chip_type = ioc->mfcnt;
1534 #else
1535 	karg.chip_type = ioc->pcidev->device;
1536 #endif
1537 	strncpy (karg.name, ioc->name, MPT_MAX_NAME);
1538 	karg.name[MPT_MAX_NAME-1]='\0';
1539 	strncpy (karg.product, ioc->prod_name, MPT_PRODUCT_LENGTH);
1540 	karg.product[MPT_PRODUCT_LENGTH-1]='\0';
1541 
1542 	/* Copy the data from kernel memory to user memory
1543 	 */
1544 	if (copy_to_user((char __user *)arg, &karg, sizeof(struct mpt_ioctl_test))) {
1545 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_readtest - "
1546 			"Unable to write out mpt_ioctl_test struct @ %p\n",
1547 			ioc->name, __FILE__, __LINE__, uarg);
1548 		return -EFAULT;
1549 	}
1550 
1551 	return 0;
1552 }
1553 
1554 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1555 /*
1556  *	mptctl_eventquery - Query the host adapter for the event types
1557  *	that are being logged.
1558  *	@arg: User space argument
1559  *
1560  * Outputs:	None.
1561  * Return:	0 if successful
1562  *		-EFAULT if data unavailable
1563  *		-ENODEV  if no such device/adapter
1564  */
1565 static int
1566 mptctl_eventquery (unsigned long arg)
1567 {
1568 	struct mpt_ioctl_eventquery __user *uarg = (void __user *) arg;
1569 	struct mpt_ioctl_eventquery	 karg;
1570 	MPT_ADAPTER *ioc;
1571 	int iocnum;
1572 
1573 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_eventquery))) {
1574 		printk(KERN_ERR MYNAM "%s@%d::mptctl_eventquery - "
1575 			"Unable to read in mpt_ioctl_eventquery struct @ %p\n",
1576 				__FILE__, __LINE__, uarg);
1577 		return -EFAULT;
1578 	}
1579 
1580 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
1581 	    (ioc == NULL)) {
1582 		printk(KERN_DEBUG MYNAM "%s::mptctl_eventquery() @%d - ioc%d not found!\n",
1583 				__FILE__, __LINE__, iocnum);
1584 		return -ENODEV;
1585 	}
1586 
1587 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_eventquery called.\n",
1588 	    ioc->name));
1589 	karg.eventEntries = MPTCTL_EVENT_LOG_SIZE;
1590 	karg.eventTypes = ioc->eventTypes;
1591 
1592 	/* Copy the data from kernel memory to user memory
1593 	 */
1594 	if (copy_to_user((char __user *)arg, &karg, sizeof(struct mpt_ioctl_eventquery))) {
1595 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_eventquery - "
1596 			"Unable to write out mpt_ioctl_eventquery struct @ %p\n",
1597 			ioc->name, __FILE__, __LINE__, uarg);
1598 		return -EFAULT;
1599 	}
1600 	return 0;
1601 }
1602 
1603 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1604 static int
1605 mptctl_eventenable (unsigned long arg)
1606 {
1607 	struct mpt_ioctl_eventenable __user *uarg = (void __user *) arg;
1608 	struct mpt_ioctl_eventenable	 karg;
1609 	MPT_ADAPTER *ioc;
1610 	int iocnum;
1611 
1612 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_eventenable))) {
1613 		printk(KERN_ERR MYNAM "%s@%d::mptctl_eventenable - "
1614 			"Unable to read in mpt_ioctl_eventenable struct @ %p\n",
1615 				__FILE__, __LINE__, uarg);
1616 		return -EFAULT;
1617 	}
1618 
1619 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
1620 	    (ioc == NULL)) {
1621 		printk(KERN_DEBUG MYNAM "%s::mptctl_eventenable() @%d - ioc%d not found!\n",
1622 				__FILE__, __LINE__, iocnum);
1623 		return -ENODEV;
1624 	}
1625 
1626 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_eventenable called.\n",
1627 	    ioc->name));
1628 	if (ioc->events == NULL) {
1629 		/* Have not yet allocated memory - do so now.
1630 		 */
1631 		int sz = MPTCTL_EVENT_LOG_SIZE * sizeof(MPT_IOCTL_EVENTS);
1632 		ioc->events = kzalloc(sz, GFP_KERNEL);
1633 		if (!ioc->events) {
1634 			printk(MYIOC_s_ERR_FMT
1635 			    ": ERROR - Insufficient memory to add adapter!\n",
1636 			    ioc->name);
1637 			return -ENOMEM;
1638 		}
1639 		ioc->alloc_total += sz;
1640 
1641 		ioc->eventContext = 0;
1642         }
1643 
1644 	/* Update the IOC event logging flag.
1645 	 */
1646 	ioc->eventTypes = karg.eventTypes;
1647 
1648 	return 0;
1649 }
1650 
1651 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1652 static int
1653 mptctl_eventreport (unsigned long arg)
1654 {
1655 	struct mpt_ioctl_eventreport __user *uarg = (void __user *) arg;
1656 	struct mpt_ioctl_eventreport	 karg;
1657 	MPT_ADAPTER		 *ioc;
1658 	int			 iocnum;
1659 	int			 numBytes, maxEvents, max;
1660 
1661 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_eventreport))) {
1662 		printk(KERN_ERR MYNAM "%s@%d::mptctl_eventreport - "
1663 			"Unable to read in mpt_ioctl_eventreport struct @ %p\n",
1664 				__FILE__, __LINE__, uarg);
1665 		return -EFAULT;
1666 	}
1667 
1668 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
1669 	    (ioc == NULL)) {
1670 		printk(KERN_DEBUG MYNAM "%s::mptctl_eventreport() @%d - ioc%d not found!\n",
1671 				__FILE__, __LINE__, iocnum);
1672 		return -ENODEV;
1673 	}
1674 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_eventreport called.\n",
1675 	    ioc->name));
1676 
1677 	numBytes = karg.hdr.maxDataSize - sizeof(mpt_ioctl_header);
1678 	maxEvents = numBytes/sizeof(MPT_IOCTL_EVENTS);
1679 
1680 
1681 	max = MPTCTL_EVENT_LOG_SIZE < maxEvents ? MPTCTL_EVENT_LOG_SIZE : maxEvents;
1682 
1683 	/* If fewer than 1 event is requested, there must have
1684 	 * been some type of error.
1685 	 */
1686 	if ((max < 1) || !ioc->events)
1687 		return -ENODATA;
1688 
1689 	/* reset this flag so SIGIO can restart */
1690 	ioc->aen_event_read_flag=0;
1691 
1692 	/* Copy the data from kernel memory to user memory
1693 	 */
1694 	numBytes = max * sizeof(MPT_IOCTL_EVENTS);
1695 	if (copy_to_user(uarg->eventData, ioc->events, numBytes)) {
1696 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_eventreport - "
1697 			"Unable to write out mpt_ioctl_eventreport struct @ %p\n",
1698 			ioc->name, __FILE__, __LINE__, ioc->events);
1699 		return -EFAULT;
1700 	}
1701 
1702 	return 0;
1703 }
1704 
1705 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1706 static int
1707 mptctl_replace_fw (unsigned long arg)
1708 {
1709 	struct mpt_ioctl_replace_fw __user *uarg = (void __user *) arg;
1710 	struct mpt_ioctl_replace_fw	 karg;
1711 	MPT_ADAPTER		 *ioc;
1712 	int			 iocnum;
1713 	int			 newFwSize;
1714 
1715 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_replace_fw))) {
1716 		printk(KERN_ERR MYNAM "%s@%d::mptctl_replace_fw - "
1717 			"Unable to read in mpt_ioctl_replace_fw struct @ %p\n",
1718 				__FILE__, __LINE__, uarg);
1719 		return -EFAULT;
1720 	}
1721 
1722 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
1723 	    (ioc == NULL)) {
1724 		printk(KERN_DEBUG MYNAM "%s::mptctl_replace_fw() @%d - ioc%d not found!\n",
1725 				__FILE__, __LINE__, iocnum);
1726 		return -ENODEV;
1727 	}
1728 
1729 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_replace_fw called.\n",
1730 	    ioc->name));
1731 	/* If caching FW, Free the old FW image
1732 	 */
1733 	if (ioc->cached_fw == NULL)
1734 		return 0;
1735 
1736 	mpt_free_fw_memory(ioc);
1737 
1738 	/* Allocate memory for the new FW image
1739 	 */
1740 	newFwSize = karg.newImageSize;
1741 
1742 	if (newFwSize & 0x01)
1743 		newFwSize += 1;
1744 	if (newFwSize & 0x02)
1745 		newFwSize += 2;
1746 
1747 	mpt_alloc_fw_memory(ioc, newFwSize);
1748 	if (ioc->cached_fw == NULL)
1749 		return -ENOMEM;
1750 
1751 	/* Copy the data from user memory to kernel space
1752 	 */
1753 	if (copy_from_user(ioc->cached_fw, uarg->newImage, newFwSize)) {
1754 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_replace_fw - "
1755 				"Unable to read in mpt_ioctl_replace_fw image "
1756 				"@ %p\n", ioc->name, __FILE__, __LINE__, uarg);
1757 		mpt_free_fw_memory(ioc);
1758 		return -EFAULT;
1759 	}
1760 
1761 	/* Update IOCFactsReply
1762 	 */
1763 	ioc->facts.FWImageSize = newFwSize;
1764 	return 0;
1765 }
1766 
1767 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1768 /* MPT IOCTL MPTCOMMAND function.
1769  * Cast the arg into the mpt_ioctl_mpt_command structure.
1770  *
1771  * Outputs:	None.
1772  * Return:	0 if successful
1773  *		-EBUSY  if previous command timeout and IOC reset is not complete.
1774  *		-EFAULT if data unavailable
1775  *		-ENODEV if no such device/adapter
1776  *		-ETIME	if timer expires
1777  *		-ENOMEM if memory allocation error
1778  */
1779 static int
1780 mptctl_mpt_command (unsigned long arg)
1781 {
1782 	struct mpt_ioctl_command __user *uarg = (void __user *) arg;
1783 	struct mpt_ioctl_command  karg;
1784 	MPT_ADAPTER	*ioc;
1785 	int		iocnum;
1786 	int		rc;
1787 
1788 
1789 	if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_command))) {
1790 		printk(KERN_ERR MYNAM "%s@%d::mptctl_mpt_command - "
1791 			"Unable to read in mpt_ioctl_command struct @ %p\n",
1792 				__FILE__, __LINE__, uarg);
1793 		return -EFAULT;
1794 	}
1795 
1796 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
1797 	    (ioc == NULL)) {
1798 		printk(KERN_DEBUG MYNAM "%s::mptctl_mpt_command() @%d - ioc%d not found!\n",
1799 				__FILE__, __LINE__, iocnum);
1800 		return -ENODEV;
1801 	}
1802 
1803 	rc = mptctl_do_mpt_command (karg, &uarg->MF);
1804 
1805 	return rc;
1806 }
1807 
1808 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
1809 /* Worker routine for the IOCTL MPTCOMMAND and MPTCOMMAND32 (sparc) commands.
1810  *
1811  * Outputs:	None.
1812  * Return:	0 if successful
1813  *		-EBUSY  if previous command timeout and IOC reset is not complete.
1814  *		-EFAULT if data unavailable
1815  *		-ENODEV if no such device/adapter
1816  *		-ETIME	if timer expires
1817  *		-ENOMEM if memory allocation error
1818  *		-EPERM if SCSI I/O and target is untagged
1819  */
1820 static int
1821 mptctl_do_mpt_command (struct mpt_ioctl_command karg, void __user *mfPtr)
1822 {
1823 	MPT_ADAPTER	*ioc;
1824 	MPT_FRAME_HDR	*mf = NULL;
1825 	MPIHeader_t	*hdr;
1826 	char		*psge;
1827 	struct buflist	bufIn;	/* data In buffer */
1828 	struct buflist	bufOut; /* data Out buffer */
1829 	dma_addr_t	dma_addr_in;
1830 	dma_addr_t	dma_addr_out;
1831 	int		sgSize = 0;	/* Num SG elements */
1832 	int		iocnum, flagsLength;
1833 	int		sz, rc = 0;
1834 	int		msgContext;
1835 	u16		req_idx;
1836 	ulong 		timeout;
1837 	unsigned long	timeleft;
1838 	struct scsi_device *sdev;
1839 	unsigned long	 flags;
1840 	u8		 function;
1841 
1842 	/* bufIn and bufOut are used for user to kernel space transfers
1843 	 */
1844 	bufIn.kptr = bufOut.kptr = NULL;
1845 	bufIn.len = bufOut.len = 0;
1846 
1847 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
1848 	    (ioc == NULL)) {
1849 		printk(KERN_DEBUG MYNAM "%s::mptctl_do_mpt_command() @%d - ioc%d not found!\n",
1850 				__FILE__, __LINE__, iocnum);
1851 		return -ENODEV;
1852 	}
1853 
1854 	spin_lock_irqsave(&ioc->taskmgmt_lock, flags);
1855 	if (ioc->ioc_reset_in_progress) {
1856 		spin_unlock_irqrestore(&ioc->taskmgmt_lock, flags);
1857 		printk(KERN_ERR MYNAM "%s@%d::mptctl_do_mpt_command - "
1858 			"Busy with diagnostic reset\n", __FILE__, __LINE__);
1859 		return -EBUSY;
1860 	}
1861 	spin_unlock_irqrestore(&ioc->taskmgmt_lock, flags);
1862 
1863 	/* Verify that the final request frame will not be too large.
1864 	 */
1865 	sz = karg.dataSgeOffset * 4;
1866 	if (karg.dataInSize > 0)
1867 		sz += ioc->SGE_size;
1868 	if (karg.dataOutSize > 0)
1869 		sz += ioc->SGE_size;
1870 
1871 	if (sz > ioc->req_sz) {
1872 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
1873 			"Request frame too large (%d) maximum (%d)\n",
1874 			ioc->name, __FILE__, __LINE__, sz, ioc->req_sz);
1875 		return -EFAULT;
1876 	}
1877 
1878 	/* Get a free request frame and save the message context.
1879 	 */
1880         if ((mf = mpt_get_msg_frame(mptctl_id, ioc)) == NULL)
1881                 return -EAGAIN;
1882 
1883 	hdr = (MPIHeader_t *) mf;
1884 	msgContext = le32_to_cpu(hdr->MsgContext);
1885 	req_idx = le16_to_cpu(mf->u.frame.hwhdr.msgctxu.fld.req_idx);
1886 
1887 	/* Copy the request frame
1888 	 * Reset the saved message context.
1889 	 * Request frame in user space
1890 	 */
1891 	if (copy_from_user(mf, mfPtr, karg.dataSgeOffset * 4)) {
1892 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
1893 			"Unable to read MF from mpt_ioctl_command struct @ %p\n",
1894 			ioc->name, __FILE__, __LINE__, mfPtr);
1895 		function = -1;
1896 		rc = -EFAULT;
1897 		goto done_free_mem;
1898 	}
1899 	hdr->MsgContext = cpu_to_le32(msgContext);
1900 	function = hdr->Function;
1901 
1902 
1903 	/* Verify that this request is allowed.
1904 	 */
1905 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sending mpi function (0x%02X), req=%p\n",
1906 	    ioc->name, hdr->Function, mf));
1907 
1908 	switch (function) {
1909 	case MPI_FUNCTION_IOC_FACTS:
1910 	case MPI_FUNCTION_PORT_FACTS:
1911 		karg.dataOutSize  = karg.dataInSize = 0;
1912 		break;
1913 
1914 	case MPI_FUNCTION_CONFIG:
1915 	{
1916 		Config_t *config_frame;
1917 		config_frame = (Config_t *)mf;
1918 		dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "\ttype=0x%02x ext_type=0x%02x "
1919 		    "number=0x%02x action=0x%02x\n", ioc->name,
1920 		    config_frame->Header.PageType,
1921 		    config_frame->ExtPageType,
1922 		    config_frame->Header.PageNumber,
1923 		    config_frame->Action));
1924 		break;
1925 	}
1926 
1927 	case MPI_FUNCTION_FC_COMMON_TRANSPORT_SEND:
1928 	case MPI_FUNCTION_FC_EX_LINK_SRVC_SEND:
1929 	case MPI_FUNCTION_FW_UPLOAD:
1930 	case MPI_FUNCTION_SCSI_ENCLOSURE_PROCESSOR:
1931 	case MPI_FUNCTION_FW_DOWNLOAD:
1932 	case MPI_FUNCTION_FC_PRIMITIVE_SEND:
1933 	case MPI_FUNCTION_TOOLBOX:
1934 	case MPI_FUNCTION_SAS_IO_UNIT_CONTROL:
1935 		break;
1936 
1937 	case MPI_FUNCTION_SCSI_IO_REQUEST:
1938 		if (ioc->sh) {
1939 			SCSIIORequest_t *pScsiReq = (SCSIIORequest_t *) mf;
1940 			int qtag = MPI_SCSIIO_CONTROL_UNTAGGED;
1941 			int scsidir = 0;
1942 			int dataSize;
1943 			u32 id;
1944 
1945 			id = (ioc->devices_per_bus == 0) ? 256 : ioc->devices_per_bus;
1946 			if (pScsiReq->TargetID > id) {
1947 				printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
1948 					"Target ID out of bounds. \n",
1949 					ioc->name, __FILE__, __LINE__);
1950 				rc = -ENODEV;
1951 				goto done_free_mem;
1952 			}
1953 
1954 			if (pScsiReq->Bus >= ioc->number_of_buses) {
1955 				printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
1956 					"Target Bus out of bounds. \n",
1957 					ioc->name, __FILE__, __LINE__);
1958 				rc = -ENODEV;
1959 				goto done_free_mem;
1960 			}
1961 
1962 			pScsiReq->MsgFlags &= ~MPI_SCSIIO_MSGFLGS_SENSE_WIDTH;
1963 			pScsiReq->MsgFlags |= mpt_msg_flags(ioc);
1964 
1965 
1966 			/* verify that app has not requested
1967 			 *	more sense data than driver
1968 			 *	can provide, if so, reset this parameter
1969 			 * set the sense buffer pointer low address
1970 			 * update the control field to specify Q type
1971 			 */
1972 			if (karg.maxSenseBytes > MPT_SENSE_BUFFER_SIZE)
1973 				pScsiReq->SenseBufferLength = MPT_SENSE_BUFFER_SIZE;
1974 			else
1975 				pScsiReq->SenseBufferLength = karg.maxSenseBytes;
1976 
1977 			pScsiReq->SenseBufferLowAddr =
1978 				cpu_to_le32(ioc->sense_buf_low_dma
1979 				   + (req_idx * MPT_SENSE_BUFFER_ALLOC));
1980 
1981 			shost_for_each_device(sdev, ioc->sh) {
1982 				struct scsi_target *starget = scsi_target(sdev);
1983 				VirtTarget *vtarget = starget->hostdata;
1984 
1985 				if (vtarget == NULL)
1986 					continue;
1987 
1988 				if ((pScsiReq->TargetID == vtarget->id) &&
1989 				    (pScsiReq->Bus == vtarget->channel) &&
1990 				    (vtarget->tflags & MPT_TARGET_FLAGS_Q_YES))
1991 					qtag = MPI_SCSIIO_CONTROL_SIMPLEQ;
1992 			}
1993 
1994 			/* Have the IOCTL driver set the direction based
1995 			 * on the dataOutSize (ordering issue with Sparc).
1996 			 */
1997 			if (karg.dataOutSize > 0) {
1998 				scsidir = MPI_SCSIIO_CONTROL_WRITE;
1999 				dataSize = karg.dataOutSize;
2000 			} else {
2001 				scsidir = MPI_SCSIIO_CONTROL_READ;
2002 				dataSize = karg.dataInSize;
2003 			}
2004 
2005 			pScsiReq->Control = cpu_to_le32(scsidir | qtag);
2006 			pScsiReq->DataLength = cpu_to_le32(dataSize);
2007 
2008 
2009 		} else {
2010 			printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
2011 				"SCSI driver is not loaded. \n",
2012 				ioc->name, __FILE__, __LINE__);
2013 			rc = -EFAULT;
2014 			goto done_free_mem;
2015 		}
2016 		break;
2017 
2018 	case MPI_FUNCTION_SMP_PASSTHROUGH:
2019 		/* Check mf->PassthruFlags to determine if
2020 		 * transfer is ImmediateMode or not.
2021 		 * Immediate mode returns data in the ReplyFrame.
2022 		 * Else, we are sending request and response data
2023 		 * in two SGLs at the end of the mf.
2024 		 */
2025 		break;
2026 
2027 	case MPI_FUNCTION_SATA_PASSTHROUGH:
2028 		if (!ioc->sh) {
2029 			printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
2030 				"SCSI driver is not loaded. \n",
2031 				ioc->name, __FILE__, __LINE__);
2032 			rc = -EFAULT;
2033 			goto done_free_mem;
2034 		}
2035 		break;
2036 
2037 	case MPI_FUNCTION_RAID_ACTION:
2038 		/* Just add a SGE
2039 		 */
2040 		break;
2041 
2042 	case MPI_FUNCTION_RAID_SCSI_IO_PASSTHROUGH:
2043 		if (ioc->sh) {
2044 			SCSIIORequest_t *pScsiReq = (SCSIIORequest_t *) mf;
2045 			int qtag = MPI_SCSIIO_CONTROL_SIMPLEQ;
2046 			int scsidir = MPI_SCSIIO_CONTROL_READ;
2047 			int dataSize;
2048 
2049 			pScsiReq->MsgFlags &= ~MPI_SCSIIO_MSGFLGS_SENSE_WIDTH;
2050 			pScsiReq->MsgFlags |= mpt_msg_flags(ioc);
2051 
2052 
2053 			/* verify that app has not requested
2054 			 *	more sense data than driver
2055 			 *	can provide, if so, reset this parameter
2056 			 * set the sense buffer pointer low address
2057 			 * update the control field to specify Q type
2058 			 */
2059 			if (karg.maxSenseBytes > MPT_SENSE_BUFFER_SIZE)
2060 				pScsiReq->SenseBufferLength = MPT_SENSE_BUFFER_SIZE;
2061 			else
2062 				pScsiReq->SenseBufferLength = karg.maxSenseBytes;
2063 
2064 			pScsiReq->SenseBufferLowAddr =
2065 				cpu_to_le32(ioc->sense_buf_low_dma
2066 				   + (req_idx * MPT_SENSE_BUFFER_ALLOC));
2067 
2068 			/* All commands to physical devices are tagged
2069 			 */
2070 
2071 			/* Have the IOCTL driver set the direction based
2072 			 * on the dataOutSize (ordering issue with Sparc).
2073 			 */
2074 			if (karg.dataOutSize > 0) {
2075 				scsidir = MPI_SCSIIO_CONTROL_WRITE;
2076 				dataSize = karg.dataOutSize;
2077 			} else {
2078 				scsidir = MPI_SCSIIO_CONTROL_READ;
2079 				dataSize = karg.dataInSize;
2080 			}
2081 
2082 			pScsiReq->Control = cpu_to_le32(scsidir | qtag);
2083 			pScsiReq->DataLength = cpu_to_le32(dataSize);
2084 
2085 		} else {
2086 			printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
2087 				"SCSI driver is not loaded. \n",
2088 				ioc->name, __FILE__, __LINE__);
2089 			rc = -EFAULT;
2090 			goto done_free_mem;
2091 		}
2092 		break;
2093 
2094 	case MPI_FUNCTION_SCSI_TASK_MGMT:
2095 	{
2096 		SCSITaskMgmt_t	*pScsiTm;
2097 		pScsiTm = (SCSITaskMgmt_t *)mf;
2098 		dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT
2099 			"\tTaskType=0x%x MsgFlags=0x%x "
2100 			"TaskMsgContext=0x%x id=%d channel=%d\n",
2101 			ioc->name, pScsiTm->TaskType, le32_to_cpu
2102 			(pScsiTm->TaskMsgContext), pScsiTm->MsgFlags,
2103 			pScsiTm->TargetID, pScsiTm->Bus));
2104 		break;
2105 	}
2106 
2107 	case MPI_FUNCTION_IOC_INIT:
2108 		{
2109 			IOCInit_t	*pInit = (IOCInit_t *) mf;
2110 			u32		high_addr, sense_high;
2111 
2112 			/* Verify that all entries in the IOC INIT match
2113 			 * existing setup (and in LE format).
2114 			 */
2115 			if (sizeof(dma_addr_t) == sizeof(u64)) {
2116 				high_addr = cpu_to_le32((u32)((u64)ioc->req_frames_dma >> 32));
2117 				sense_high= cpu_to_le32((u32)((u64)ioc->sense_buf_pool_dma >> 32));
2118 			} else {
2119 				high_addr = 0;
2120 				sense_high= 0;
2121 			}
2122 
2123 			if ((pInit->Flags != 0) || (pInit->MaxDevices != ioc->facts.MaxDevices) ||
2124 				(pInit->MaxBuses != ioc->facts.MaxBuses) ||
2125 				(pInit->ReplyFrameSize != cpu_to_le16(ioc->reply_sz)) ||
2126 				(pInit->HostMfaHighAddr != high_addr) ||
2127 				(pInit->SenseBufferHighAddr != sense_high)) {
2128 				printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
2129 					"IOC_INIT issued with 1 or more incorrect parameters. Rejected.\n",
2130 					ioc->name, __FILE__, __LINE__);
2131 				rc = -EFAULT;
2132 				goto done_free_mem;
2133 			}
2134 		}
2135 		break;
2136 	default:
2137 		/*
2138 		 * MPI_FUNCTION_PORT_ENABLE
2139 		 * MPI_FUNCTION_TARGET_CMD_BUFFER_POST
2140 		 * MPI_FUNCTION_TARGET_ASSIST
2141 		 * MPI_FUNCTION_TARGET_STATUS_SEND
2142 		 * MPI_FUNCTION_TARGET_MODE_ABORT
2143 		 * MPI_FUNCTION_IOC_MESSAGE_UNIT_RESET
2144 		 * MPI_FUNCTION_IO_UNIT_RESET
2145 		 * MPI_FUNCTION_HANDSHAKE
2146 		 * MPI_FUNCTION_REPLY_FRAME_REMOVAL
2147 		 * MPI_FUNCTION_EVENT_NOTIFICATION
2148 		 *  (driver handles event notification)
2149 		 * MPI_FUNCTION_EVENT_ACK
2150 		 */
2151 
2152 		/*  What to do with these???  CHECK ME!!!
2153 			MPI_FUNCTION_FC_LINK_SRVC_BUF_POST
2154 			MPI_FUNCTION_FC_LINK_SRVC_RSP
2155 			MPI_FUNCTION_FC_ABORT
2156 			MPI_FUNCTION_LAN_SEND
2157 			MPI_FUNCTION_LAN_RECEIVE
2158 		 	MPI_FUNCTION_LAN_RESET
2159 		*/
2160 
2161 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
2162 			"Illegal request (function 0x%x) \n",
2163 			ioc->name, __FILE__, __LINE__, hdr->Function);
2164 		rc = -EFAULT;
2165 		goto done_free_mem;
2166 	}
2167 
2168 	/* Add the SGL ( at most one data in SGE and one data out SGE )
2169 	 * In the case of two SGE's - the data out (write) will always
2170 	 * preceede the data in (read) SGE. psgList is used to free the
2171 	 * allocated memory.
2172 	 */
2173 	psge = (char *) (((int *) mf) + karg.dataSgeOffset);
2174 	flagsLength = 0;
2175 
2176 	if (karg.dataOutSize > 0)
2177 		sgSize ++;
2178 
2179 	if (karg.dataInSize > 0)
2180 		sgSize ++;
2181 
2182 	if (sgSize > 0) {
2183 
2184 		/* Set up the dataOut memory allocation */
2185 		if (karg.dataOutSize > 0) {
2186 			if (karg.dataInSize > 0) {
2187 				flagsLength = ( MPI_SGE_FLAGS_SIMPLE_ELEMENT |
2188 						MPI_SGE_FLAGS_END_OF_BUFFER |
2189 						MPI_SGE_FLAGS_DIRECTION)
2190 						<< MPI_SGE_FLAGS_SHIFT;
2191 			} else {
2192 				flagsLength = MPT_SGE_FLAGS_SSIMPLE_WRITE;
2193 			}
2194 			flagsLength |= karg.dataOutSize;
2195 			bufOut.len = karg.dataOutSize;
2196 			bufOut.kptr = pci_alloc_consistent(
2197 					ioc->pcidev, bufOut.len, &dma_addr_out);
2198 
2199 			if (bufOut.kptr == NULL) {
2200 				rc = -ENOMEM;
2201 				goto done_free_mem;
2202 			} else {
2203 				/* Set up this SGE.
2204 				 * Copy to MF and to sglbuf
2205 				 */
2206 				ioc->add_sge(psge, flagsLength, dma_addr_out);
2207 				psge += ioc->SGE_size;
2208 
2209 				/* Copy user data to kernel space.
2210 				 */
2211 				if (copy_from_user(bufOut.kptr,
2212 						karg.dataOutBufPtr,
2213 						bufOut.len)) {
2214 					printk(MYIOC_s_ERR_FMT
2215 						"%s@%d::mptctl_do_mpt_command - Unable "
2216 						"to read user data "
2217 						"struct @ %p\n",
2218 						ioc->name, __FILE__, __LINE__,karg.dataOutBufPtr);
2219 					rc =  -EFAULT;
2220 					goto done_free_mem;
2221 				}
2222 			}
2223 		}
2224 
2225 		if (karg.dataInSize > 0) {
2226 			flagsLength = MPT_SGE_FLAGS_SSIMPLE_READ;
2227 			flagsLength |= karg.dataInSize;
2228 
2229 			bufIn.len = karg.dataInSize;
2230 			bufIn.kptr = pci_alloc_consistent(ioc->pcidev,
2231 					bufIn.len, &dma_addr_in);
2232 
2233 			if (bufIn.kptr == NULL) {
2234 				rc = -ENOMEM;
2235 				goto done_free_mem;
2236 			} else {
2237 				/* Set up this SGE
2238 				 * Copy to MF and to sglbuf
2239 				 */
2240 				ioc->add_sge(psge, flagsLength, dma_addr_in);
2241 			}
2242 		}
2243 	} else  {
2244 		/* Add a NULL SGE
2245 		 */
2246 		ioc->add_sge(psge, flagsLength, (dma_addr_t) -1);
2247 	}
2248 
2249 	SET_MGMT_MSG_CONTEXT(ioc->ioctl_cmds.msg_context, hdr->MsgContext);
2250 	INITIALIZE_MGMT_STATUS(ioc->ioctl_cmds.status)
2251 	if (hdr->Function == MPI_FUNCTION_SCSI_TASK_MGMT) {
2252 
2253 		mutex_lock(&ioc->taskmgmt_cmds.mutex);
2254 		if (mpt_set_taskmgmt_in_progress_flag(ioc) != 0) {
2255 			mutex_unlock(&ioc->taskmgmt_cmds.mutex);
2256 			goto done_free_mem;
2257 		}
2258 
2259 		DBG_DUMP_TM_REQUEST_FRAME(ioc, (u32 *)mf);
2260 
2261 		if ((ioc->facts.IOCCapabilities & MPI_IOCFACTS_CAPABILITY_HIGH_PRI_Q) &&
2262 		    (ioc->facts.MsgVersion >= MPI_VERSION_01_05))
2263 			mpt_put_msg_frame_hi_pri(mptctl_id, ioc, mf);
2264 		else {
2265 			rc =mpt_send_handshake_request(mptctl_id, ioc,
2266 				sizeof(SCSITaskMgmt_t), (u32*)mf, CAN_SLEEP);
2267 			if (rc != 0) {
2268 				dfailprintk(ioc, printk(MYIOC_s_ERR_FMT
2269 				    "send_handshake FAILED! (ioc %p, mf %p)\n",
2270 				    ioc->name, ioc, mf));
2271 				mpt_clear_taskmgmt_in_progress_flag(ioc);
2272 				rc = -ENODATA;
2273 				mutex_unlock(&ioc->taskmgmt_cmds.mutex);
2274 				goto done_free_mem;
2275 			}
2276 		}
2277 
2278 	} else
2279 		mpt_put_msg_frame(mptctl_id, ioc, mf);
2280 
2281 	/* Now wait for the command to complete */
2282 	timeout = (karg.timeout > 0) ? karg.timeout : MPT_IOCTL_DEFAULT_TIMEOUT;
2283 retry_wait:
2284 	timeleft = wait_for_completion_timeout(&ioc->ioctl_cmds.done,
2285 				HZ*timeout);
2286 	if (!(ioc->ioctl_cmds.status & MPT_MGMT_STATUS_COMMAND_GOOD)) {
2287 		rc = -ETIME;
2288 		dfailprintk(ioc, printk(MYIOC_s_ERR_FMT "%s: TIMED OUT!\n",
2289 		    ioc->name, __func__));
2290 		if (ioc->ioctl_cmds.status & MPT_MGMT_STATUS_DID_IOCRESET) {
2291 			if (function == MPI_FUNCTION_SCSI_TASK_MGMT)
2292 				mutex_unlock(&ioc->taskmgmt_cmds.mutex);
2293 			goto done_free_mem;
2294 		}
2295 		if (!timeleft) {
2296 			if (function == MPI_FUNCTION_SCSI_TASK_MGMT)
2297 				mutex_unlock(&ioc->taskmgmt_cmds.mutex);
2298 			mptctl_timeout_expired(ioc, mf);
2299 			mf = NULL;
2300 		} else
2301 			goto retry_wait;
2302 		goto done_free_mem;
2303 	}
2304 
2305 	if (function == MPI_FUNCTION_SCSI_TASK_MGMT)
2306 		mutex_unlock(&ioc->taskmgmt_cmds.mutex);
2307 
2308 
2309 	mf = NULL;
2310 
2311 	/* If a valid reply frame, copy to the user.
2312 	 * Offset 2: reply length in U32's
2313 	 */
2314 	if (ioc->ioctl_cmds.status & MPT_MGMT_STATUS_RF_VALID) {
2315 		if (karg.maxReplyBytes < ioc->reply_sz) {
2316 			sz = min(karg.maxReplyBytes,
2317 				4*ioc->ioctl_cmds.reply[2]);
2318 		} else {
2319 			 sz = min(ioc->reply_sz, 4*ioc->ioctl_cmds.reply[2]);
2320 		}
2321 		if (sz > 0) {
2322 			if (copy_to_user(karg.replyFrameBufPtr,
2323 				 ioc->ioctl_cmds.reply, sz)){
2324 				 printk(MYIOC_s_ERR_FMT
2325 				     "%s@%d::mptctl_do_mpt_command - "
2326 				 "Unable to write out reply frame %p\n",
2327 				 ioc->name, __FILE__, __LINE__, karg.replyFrameBufPtr);
2328 				 rc =  -ENODATA;
2329 				 goto done_free_mem;
2330 			}
2331 		}
2332 	}
2333 
2334 	/* If valid sense data, copy to user.
2335 	 */
2336 	if (ioc->ioctl_cmds.status & MPT_MGMT_STATUS_SENSE_VALID) {
2337 		sz = min(karg.maxSenseBytes, MPT_SENSE_BUFFER_SIZE);
2338 		if (sz > 0) {
2339 			if (copy_to_user(karg.senseDataPtr,
2340 				ioc->ioctl_cmds.sense, sz)) {
2341 				printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
2342 				"Unable to write sense data to user %p\n",
2343 				ioc->name, __FILE__, __LINE__,
2344 				karg.senseDataPtr);
2345 				rc =  -ENODATA;
2346 				goto done_free_mem;
2347 			}
2348 		}
2349 	}
2350 
2351 	/* If the overall status is _GOOD and data in, copy data
2352 	 * to user.
2353 	 */
2354 	if ((ioc->ioctl_cmds.status & MPT_MGMT_STATUS_COMMAND_GOOD) &&
2355 				(karg.dataInSize > 0) && (bufIn.kptr)) {
2356 
2357 		if (copy_to_user(karg.dataInBufPtr,
2358 				 bufIn.kptr, karg.dataInSize)) {
2359 			printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
2360 				"Unable to write data to user %p\n",
2361 				ioc->name, __FILE__, __LINE__,
2362 				karg.dataInBufPtr);
2363 			rc =  -ENODATA;
2364 		}
2365 	}
2366 
2367 done_free_mem:
2368 
2369 	CLEAR_MGMT_STATUS(ioc->ioctl_cmds.status)
2370 	SET_MGMT_MSG_CONTEXT(ioc->ioctl_cmds.msg_context, 0);
2371 
2372 	/* Free the allocated memory.
2373 	 */
2374 	if (bufOut.kptr != NULL) {
2375 		pci_free_consistent(ioc->pcidev,
2376 			bufOut.len, (void *) bufOut.kptr, dma_addr_out);
2377 	}
2378 
2379 	if (bufIn.kptr != NULL) {
2380 		pci_free_consistent(ioc->pcidev,
2381 			bufIn.len, (void *) bufIn.kptr, dma_addr_in);
2382 	}
2383 
2384 	/* mf is null if command issued successfully
2385 	 * otherwise, failure occured after mf acquired.
2386 	 */
2387 	if (mf)
2388 		mpt_free_msg_frame(ioc, mf);
2389 
2390 	return rc;
2391 }
2392 
2393 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2394 /* Prototype Routine for the HOST INFO command.
2395  *
2396  * Outputs:	None.
2397  * Return:	0 if successful
2398  *		-EFAULT if data unavailable
2399  *		-EBUSY  if previous command timeout and IOC reset is not complete.
2400  *		-ENODEV if no such device/adapter
2401  *		-ETIME	if timer expires
2402  *		-ENOMEM if memory allocation error
2403  */
2404 static int
2405 mptctl_hp_hostinfo(unsigned long arg, unsigned int data_size)
2406 {
2407 	hp_host_info_t	__user *uarg = (void __user *) arg;
2408 	MPT_ADAPTER		*ioc;
2409 	struct pci_dev		*pdev;
2410 	char                    *pbuf=NULL;
2411 	dma_addr_t		buf_dma;
2412 	hp_host_info_t		karg;
2413 	CONFIGPARMS		cfg;
2414 	ConfigPageHeader_t	hdr;
2415 	int			iocnum;
2416 	int			rc, cim_rev;
2417 	ToolboxIstwiReadWriteRequest_t	*IstwiRWRequest;
2418 	MPT_FRAME_HDR		*mf = NULL;
2419 	MPIHeader_t		*mpi_hdr;
2420 	unsigned long		timeleft;
2421 	int			retval;
2422 
2423 	/* Reset long to int. Should affect IA64 and SPARC only
2424 	 */
2425 	if (data_size == sizeof(hp_host_info_t))
2426 		cim_rev = 1;
2427 	else if (data_size == sizeof(hp_host_info_rev0_t))
2428 		cim_rev = 0;	/* obsolete */
2429 	else
2430 		return -EFAULT;
2431 
2432 	if (copy_from_user(&karg, uarg, sizeof(hp_host_info_t))) {
2433 		printk(KERN_ERR MYNAM "%s@%d::mptctl_hp_host_info - "
2434 			"Unable to read in hp_host_info struct @ %p\n",
2435 				__FILE__, __LINE__, uarg);
2436 		return -EFAULT;
2437 	}
2438 
2439 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
2440 	    (ioc == NULL)) {
2441 		printk(KERN_DEBUG MYNAM "%s::mptctl_hp_hostinfo() @%d - ioc%d not found!\n",
2442 				__FILE__, __LINE__, iocnum);
2443 		return -ENODEV;
2444 	}
2445 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT ": mptctl_hp_hostinfo called.\n",
2446 	    ioc->name));
2447 
2448 	/* Fill in the data and return the structure to the calling
2449 	 * program
2450 	 */
2451 	pdev = (struct pci_dev *) ioc->pcidev;
2452 
2453 	karg.vendor = pdev->vendor;
2454 	karg.device = pdev->device;
2455 	karg.subsystem_id = pdev->subsystem_device;
2456 	karg.subsystem_vendor = pdev->subsystem_vendor;
2457 	karg.devfn = pdev->devfn;
2458 	karg.bus = pdev->bus->number;
2459 
2460 	/* Save the SCSI host no. if
2461 	 * SCSI driver loaded
2462 	 */
2463 	if (ioc->sh != NULL)
2464 		karg.host_no = ioc->sh->host_no;
2465 	else
2466 		karg.host_no =  -1;
2467 
2468 	/* Reformat the fw_version into a string
2469 	 */
2470 	karg.fw_version[0] = ioc->facts.FWVersion.Struct.Major >= 10 ?
2471 		((ioc->facts.FWVersion.Struct.Major / 10) + '0') : '0';
2472 	karg.fw_version[1] = (ioc->facts.FWVersion.Struct.Major % 10 ) + '0';
2473 	karg.fw_version[2] = '.';
2474 	karg.fw_version[3] = ioc->facts.FWVersion.Struct.Minor >= 10 ?
2475 		((ioc->facts.FWVersion.Struct.Minor / 10) + '0') : '0';
2476 	karg.fw_version[4] = (ioc->facts.FWVersion.Struct.Minor % 10 ) + '0';
2477 	karg.fw_version[5] = '.';
2478 	karg.fw_version[6] = ioc->facts.FWVersion.Struct.Unit >= 10 ?
2479 		((ioc->facts.FWVersion.Struct.Unit / 10) + '0') : '0';
2480 	karg.fw_version[7] = (ioc->facts.FWVersion.Struct.Unit % 10 ) + '0';
2481 	karg.fw_version[8] = '.';
2482 	karg.fw_version[9] = ioc->facts.FWVersion.Struct.Dev >= 10 ?
2483 		((ioc->facts.FWVersion.Struct.Dev / 10) + '0') : '0';
2484 	karg.fw_version[10] = (ioc->facts.FWVersion.Struct.Dev % 10 ) + '0';
2485 	karg.fw_version[11] = '\0';
2486 
2487 	/* Issue a config request to get the device serial number
2488 	 */
2489 	hdr.PageVersion = 0;
2490 	hdr.PageLength = 0;
2491 	hdr.PageNumber = 0;
2492 	hdr.PageType = MPI_CONFIG_PAGETYPE_MANUFACTURING;
2493 	cfg.cfghdr.hdr = &hdr;
2494 	cfg.physAddr = -1;
2495 	cfg.pageAddr = 0;
2496 	cfg.action = MPI_CONFIG_ACTION_PAGE_HEADER;
2497 	cfg.dir = 0;	/* read */
2498 	cfg.timeout = 10;
2499 
2500 	strncpy(karg.serial_number, " ", 24);
2501 	if (mpt_config(ioc, &cfg) == 0) {
2502 		if (cfg.cfghdr.hdr->PageLength > 0) {
2503 			/* Issue the second config page request */
2504 			cfg.action = MPI_CONFIG_ACTION_PAGE_READ_CURRENT;
2505 
2506 			pbuf = pci_alloc_consistent(ioc->pcidev, hdr.PageLength * 4, &buf_dma);
2507 			if (pbuf) {
2508 				cfg.physAddr = buf_dma;
2509 				if (mpt_config(ioc, &cfg) == 0) {
2510 					ManufacturingPage0_t *pdata = (ManufacturingPage0_t *) pbuf;
2511 					if (strlen(pdata->BoardTracerNumber) > 1) {
2512 						strncpy(karg.serial_number, 									    pdata->BoardTracerNumber, 24);
2513 						karg.serial_number[24-1]='\0';
2514 					}
2515 				}
2516 				pci_free_consistent(ioc->pcidev, hdr.PageLength * 4, pbuf, buf_dma);
2517 				pbuf = NULL;
2518 			}
2519 		}
2520 	}
2521 	rc = mpt_GetIocState(ioc, 1);
2522 	switch (rc) {
2523 	case MPI_IOC_STATE_OPERATIONAL:
2524 		karg.ioc_status =  HP_STATUS_OK;
2525 		break;
2526 
2527 	case MPI_IOC_STATE_FAULT:
2528 		karg.ioc_status =  HP_STATUS_FAILED;
2529 		break;
2530 
2531 	case MPI_IOC_STATE_RESET:
2532 	case MPI_IOC_STATE_READY:
2533 	default:
2534 		karg.ioc_status =  HP_STATUS_OTHER;
2535 		break;
2536 	}
2537 
2538 	karg.base_io_addr = pci_resource_start(pdev, 0);
2539 
2540 	if ((ioc->bus_type == SAS) || (ioc->bus_type == FC))
2541 		karg.bus_phys_width = HP_BUS_WIDTH_UNK;
2542 	else
2543 		karg.bus_phys_width = HP_BUS_WIDTH_16;
2544 
2545 	karg.hard_resets = 0;
2546 	karg.soft_resets = 0;
2547 	karg.timeouts = 0;
2548 	if (ioc->sh != NULL) {
2549 		MPT_SCSI_HOST *hd =  shost_priv(ioc->sh);
2550 
2551 		if (hd && (cim_rev == 1)) {
2552 			karg.hard_resets = ioc->hard_resets;
2553 			karg.soft_resets = ioc->soft_resets;
2554 			karg.timeouts = ioc->timeouts;
2555 		}
2556 	}
2557 
2558 	/*
2559 	 * Gather ISTWI(Industry Standard Two Wire Interface) Data
2560 	 */
2561 	if ((mf = mpt_get_msg_frame(mptctl_id, ioc)) == NULL) {
2562 		dfailprintk(ioc, printk(MYIOC_s_WARN_FMT
2563 			"%s, no msg frames!!\n", ioc->name, __func__));
2564 		goto out;
2565 	}
2566 
2567 	IstwiRWRequest = (ToolboxIstwiReadWriteRequest_t *)mf;
2568 	mpi_hdr = (MPIHeader_t *) mf;
2569 	memset(IstwiRWRequest,0,sizeof(ToolboxIstwiReadWriteRequest_t));
2570 	IstwiRWRequest->Function = MPI_FUNCTION_TOOLBOX;
2571 	IstwiRWRequest->Tool = MPI_TOOLBOX_ISTWI_READ_WRITE_TOOL;
2572 	IstwiRWRequest->MsgContext = mpi_hdr->MsgContext;
2573 	IstwiRWRequest->Flags = MPI_TB_ISTWI_FLAGS_READ;
2574 	IstwiRWRequest->NumAddressBytes = 0x01;
2575 	IstwiRWRequest->DataLength = cpu_to_le16(0x04);
2576 	if (pdev->devfn & 1)
2577 		IstwiRWRequest->DeviceAddr = 0xB2;
2578 	else
2579 		IstwiRWRequest->DeviceAddr = 0xB0;
2580 
2581 	pbuf = pci_alloc_consistent(ioc->pcidev, 4, &buf_dma);
2582 	if (!pbuf)
2583 		goto out;
2584 	ioc->add_sge((char *)&IstwiRWRequest->SGL,
2585 	    (MPT_SGE_FLAGS_SSIMPLE_READ|4), buf_dma);
2586 
2587 	retval = 0;
2588 	SET_MGMT_MSG_CONTEXT(ioc->ioctl_cmds.msg_context,
2589 				IstwiRWRequest->MsgContext);
2590 	INITIALIZE_MGMT_STATUS(ioc->ioctl_cmds.status)
2591 	mpt_put_msg_frame(mptctl_id, ioc, mf);
2592 
2593 retry_wait:
2594 	timeleft = wait_for_completion_timeout(&ioc->ioctl_cmds.done,
2595 			HZ*MPT_IOCTL_DEFAULT_TIMEOUT);
2596 	if (!(ioc->ioctl_cmds.status & MPT_MGMT_STATUS_COMMAND_GOOD)) {
2597 		retval = -ETIME;
2598 		printk(MYIOC_s_WARN_FMT "%s: failed\n", ioc->name, __func__);
2599 		if (ioc->ioctl_cmds.status & MPT_MGMT_STATUS_DID_IOCRESET) {
2600 			mpt_free_msg_frame(ioc, mf);
2601 			goto out;
2602 		}
2603 		if (!timeleft)
2604 			mptctl_timeout_expired(ioc, mf);
2605 		else
2606 			goto retry_wait;
2607 		goto out;
2608 	}
2609 
2610 	/*
2611 	 *ISTWI Data Definition
2612 	 * pbuf[0] = FW_VERSION = 0x4
2613 	 * pbuf[1] = Bay Count = 6 or 4 or 2, depending on
2614 	 *  the config, you should be seeing one out of these three values
2615 	 * pbuf[2] = Drive Installed Map = bit pattern depend on which
2616 	 *   bays have drives in them
2617 	 * pbuf[3] = Checksum (0x100 = (byte0 + byte2 + byte3)
2618 	 */
2619 	if (ioc->ioctl_cmds.status & MPT_MGMT_STATUS_RF_VALID)
2620 		karg.rsvd = *(u32 *)pbuf;
2621 
2622  out:
2623 	CLEAR_MGMT_STATUS(ioc->ioctl_cmds.status)
2624 	SET_MGMT_MSG_CONTEXT(ioc->ioctl_cmds.msg_context, 0);
2625 
2626 	if (pbuf)
2627 		pci_free_consistent(ioc->pcidev, 4, pbuf, buf_dma);
2628 
2629 	/* Copy the data from kernel memory to user memory
2630 	 */
2631 	if (copy_to_user((char __user *)arg, &karg, sizeof(hp_host_info_t))) {
2632 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_hpgethostinfo - "
2633 			"Unable to write out hp_host_info @ %p\n",
2634 			ioc->name, __FILE__, __LINE__, uarg);
2635 		return -EFAULT;
2636 	}
2637 
2638 	return 0;
2639 
2640 }
2641 
2642 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2643 /* Prototype Routine for the TARGET INFO command.
2644  *
2645  * Outputs:	None.
2646  * Return:	0 if successful
2647  *		-EFAULT if data unavailable
2648  *		-EBUSY  if previous command timeout and IOC reset is not complete.
2649  *		-ENODEV if no such device/adapter
2650  *		-ETIME	if timer expires
2651  *		-ENOMEM if memory allocation error
2652  */
2653 static int
2654 mptctl_hp_targetinfo(unsigned long arg)
2655 {
2656 	hp_target_info_t __user *uarg = (void __user *) arg;
2657 	SCSIDevicePage0_t	*pg0_alloc;
2658 	SCSIDevicePage3_t	*pg3_alloc;
2659 	MPT_ADAPTER		*ioc;
2660 	MPT_SCSI_HOST 		*hd = NULL;
2661 	hp_target_info_t	karg;
2662 	int			iocnum;
2663 	int			data_sz;
2664 	dma_addr_t		page_dma;
2665 	CONFIGPARMS	 	cfg;
2666 	ConfigPageHeader_t	hdr;
2667 	int			tmp, np, rc = 0;
2668 
2669 	if (copy_from_user(&karg, uarg, sizeof(hp_target_info_t))) {
2670 		printk(KERN_ERR MYNAM "%s@%d::mptctl_hp_targetinfo - "
2671 			"Unable to read in hp_host_targetinfo struct @ %p\n",
2672 				__FILE__, __LINE__, uarg);
2673 		return -EFAULT;
2674 	}
2675 
2676 	if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
2677 		(ioc == NULL)) {
2678 		printk(KERN_DEBUG MYNAM "%s::mptctl_hp_targetinfo() @%d - ioc%d not found!\n",
2679 				__FILE__, __LINE__, iocnum);
2680 		return -ENODEV;
2681 	}
2682 	dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_hp_targetinfo called.\n",
2683 	    ioc->name));
2684 
2685 	/*  There is nothing to do for FCP parts.
2686 	 */
2687 	if ((ioc->bus_type == SAS) || (ioc->bus_type == FC))
2688 		return 0;
2689 
2690 	if ((ioc->spi_data.sdp0length == 0) || (ioc->sh == NULL))
2691 		return 0;
2692 
2693 	if (ioc->sh->host_no != karg.hdr.host)
2694 		return -ENODEV;
2695 
2696        /* Get the data transfer speeds
2697         */
2698 	data_sz = ioc->spi_data.sdp0length * 4;
2699 	pg0_alloc = (SCSIDevicePage0_t *) pci_alloc_consistent(ioc->pcidev, data_sz, &page_dma);
2700 	if (pg0_alloc) {
2701 		hdr.PageVersion = ioc->spi_data.sdp0version;
2702 		hdr.PageLength = data_sz;
2703 		hdr.PageNumber = 0;
2704 		hdr.PageType = MPI_CONFIG_PAGETYPE_SCSI_DEVICE;
2705 
2706 		cfg.cfghdr.hdr = &hdr;
2707 		cfg.action = MPI_CONFIG_ACTION_PAGE_READ_CURRENT;
2708 		cfg.dir = 0;
2709 		cfg.timeout = 0;
2710 		cfg.physAddr = page_dma;
2711 
2712 		cfg.pageAddr = (karg.hdr.channel << 8) | karg.hdr.id;
2713 
2714 		if ((rc = mpt_config(ioc, &cfg)) == 0) {
2715 			np = le32_to_cpu(pg0_alloc->NegotiatedParameters);
2716 			karg.negotiated_width = np & MPI_SCSIDEVPAGE0_NP_WIDE ?
2717 					HP_BUS_WIDTH_16 : HP_BUS_WIDTH_8;
2718 
2719 			if (np & MPI_SCSIDEVPAGE0_NP_NEG_SYNC_OFFSET_MASK) {
2720 				tmp = (np & MPI_SCSIDEVPAGE0_NP_NEG_SYNC_PERIOD_MASK) >> 8;
2721 				if (tmp < 0x09)
2722 					karg.negotiated_speed = HP_DEV_SPEED_ULTRA320;
2723 				else if (tmp <= 0x09)
2724 					karg.negotiated_speed = HP_DEV_SPEED_ULTRA160;
2725 				else if (tmp <= 0x0A)
2726 					karg.negotiated_speed = HP_DEV_SPEED_ULTRA2;
2727 				else if (tmp <= 0x0C)
2728 					karg.negotiated_speed = HP_DEV_SPEED_ULTRA;
2729 				else if (tmp <= 0x25)
2730 					karg.negotiated_speed = HP_DEV_SPEED_FAST;
2731 				else
2732 					karg.negotiated_speed = HP_DEV_SPEED_ASYNC;
2733 			} else
2734 				karg.negotiated_speed = HP_DEV_SPEED_ASYNC;
2735 		}
2736 
2737 		pci_free_consistent(ioc->pcidev, data_sz, (u8 *) pg0_alloc, page_dma);
2738 	}
2739 
2740 	/* Set defaults
2741 	 */
2742 	karg.message_rejects = -1;
2743 	karg.phase_errors = -1;
2744 	karg.parity_errors = -1;
2745 	karg.select_timeouts = -1;
2746 
2747 	/* Get the target error parameters
2748 	 */
2749 	hdr.PageVersion = 0;
2750 	hdr.PageLength = 0;
2751 	hdr.PageNumber = 3;
2752 	hdr.PageType = MPI_CONFIG_PAGETYPE_SCSI_DEVICE;
2753 
2754 	cfg.cfghdr.hdr = &hdr;
2755 	cfg.action = MPI_CONFIG_ACTION_PAGE_HEADER;
2756 	cfg.dir = 0;
2757 	cfg.timeout = 0;
2758 	cfg.physAddr = -1;
2759 	if ((mpt_config(ioc, &cfg) == 0) && (cfg.cfghdr.hdr->PageLength > 0)) {
2760 		/* Issue the second config page request */
2761 		cfg.action = MPI_CONFIG_ACTION_PAGE_READ_CURRENT;
2762 		data_sz = (int) cfg.cfghdr.hdr->PageLength * 4;
2763 		pg3_alloc = (SCSIDevicePage3_t *) pci_alloc_consistent(
2764 							ioc->pcidev, data_sz, &page_dma);
2765 		if (pg3_alloc) {
2766 			cfg.physAddr = page_dma;
2767 			cfg.pageAddr = (karg.hdr.channel << 8) | karg.hdr.id;
2768 			if ((rc = mpt_config(ioc, &cfg)) == 0) {
2769 				karg.message_rejects = (u32) le16_to_cpu(pg3_alloc->MsgRejectCount);
2770 				karg.phase_errors = (u32) le16_to_cpu(pg3_alloc->PhaseErrorCount);
2771 				karg.parity_errors = (u32) le16_to_cpu(pg3_alloc->ParityErrorCount);
2772 			}
2773 			pci_free_consistent(ioc->pcidev, data_sz, (u8 *) pg3_alloc, page_dma);
2774 		}
2775 	}
2776 	hd = shost_priv(ioc->sh);
2777 	if (hd != NULL)
2778 		karg.select_timeouts = hd->sel_timeout[karg.hdr.id];
2779 
2780 	/* Copy the data from kernel memory to user memory
2781 	 */
2782 	if (copy_to_user((char __user *)arg, &karg, sizeof(hp_target_info_t))) {
2783 		printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_hp_target_info - "
2784 			"Unable to write out mpt_ioctl_targetinfo struct @ %p\n",
2785 			ioc->name, __FILE__, __LINE__, uarg);
2786 		return -EFAULT;
2787 	}
2788 
2789 	return 0;
2790 }
2791 
2792 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2793 
2794 static const struct file_operations mptctl_fops = {
2795 	.owner =	THIS_MODULE,
2796 	.llseek =	no_llseek,
2797 	.fasync = 	mptctl_fasync,
2798 	.unlocked_ioctl = mptctl_ioctl,
2799 #ifdef CONFIG_COMPAT
2800 	.compat_ioctl = compat_mpctl_ioctl,
2801 #endif
2802 };
2803 
2804 static struct miscdevice mptctl_miscdev = {
2805 	MPT_MINOR,
2806 	MYNAM,
2807 	&mptctl_fops
2808 };
2809 
2810 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2811 
2812 #ifdef CONFIG_COMPAT
2813 
2814 static int
2815 compat_mptfwxfer_ioctl(struct file *filp, unsigned int cmd,
2816 			unsigned long arg)
2817 {
2818 	struct mpt_fw_xfer32 kfw32;
2819 	struct mpt_fw_xfer kfw;
2820 	MPT_ADAPTER *iocp = NULL;
2821 	int iocnum, iocnumX;
2822 	int nonblock = (filp->f_flags & O_NONBLOCK);
2823 	int ret;
2824 
2825 
2826 	if (copy_from_user(&kfw32, (char __user *)arg, sizeof(kfw32)))
2827 		return -EFAULT;
2828 
2829 	/* Verify intended MPT adapter */
2830 	iocnumX = kfw32.iocnum & 0xFF;
2831 	if (((iocnum = mpt_verify_adapter(iocnumX, &iocp)) < 0) ||
2832 	    (iocp == NULL)) {
2833 		printk(KERN_DEBUG MYNAM "::compat_mptfwxfer_ioctl @%d - ioc%d not found!\n",
2834 			__LINE__, iocnumX);
2835 		return -ENODEV;
2836 	}
2837 
2838 	if ((ret = mptctl_syscall_down(iocp, nonblock)) != 0)
2839 		return ret;
2840 
2841 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "compat_mptfwxfer_ioctl() called\n",
2842 	    iocp->name));
2843 	kfw.iocnum = iocnum;
2844 	kfw.fwlen = kfw32.fwlen;
2845 	kfw.bufp = compat_ptr(kfw32.bufp);
2846 
2847 	ret = mptctl_do_fw_download(kfw.iocnum, kfw.bufp, kfw.fwlen);
2848 
2849 	mutex_unlock(&iocp->ioctl_cmds.mutex);
2850 
2851 	return ret;
2852 }
2853 
2854 static int
2855 compat_mpt_command(struct file *filp, unsigned int cmd,
2856 			unsigned long arg)
2857 {
2858 	struct mpt_ioctl_command32 karg32;
2859 	struct mpt_ioctl_command32 __user *uarg = (struct mpt_ioctl_command32 __user *) arg;
2860 	struct mpt_ioctl_command karg;
2861 	MPT_ADAPTER *iocp = NULL;
2862 	int iocnum, iocnumX;
2863 	int nonblock = (filp->f_flags & O_NONBLOCK);
2864 	int ret;
2865 
2866 	if (copy_from_user(&karg32, (char __user *)arg, sizeof(karg32)))
2867 		return -EFAULT;
2868 
2869 	/* Verify intended MPT adapter */
2870 	iocnumX = karg32.hdr.iocnum & 0xFF;
2871 	if (((iocnum = mpt_verify_adapter(iocnumX, &iocp)) < 0) ||
2872 	    (iocp == NULL)) {
2873 		printk(KERN_DEBUG MYNAM "::compat_mpt_command @%d - ioc%d not found!\n",
2874 			__LINE__, iocnumX);
2875 		return -ENODEV;
2876 	}
2877 
2878 	if ((ret = mptctl_syscall_down(iocp, nonblock)) != 0)
2879 		return ret;
2880 
2881 	dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "compat_mpt_command() called\n",
2882 	    iocp->name));
2883 	/* Copy data to karg */
2884 	karg.hdr.iocnum = karg32.hdr.iocnum;
2885 	karg.hdr.port = karg32.hdr.port;
2886 	karg.timeout = karg32.timeout;
2887 	karg.maxReplyBytes = karg32.maxReplyBytes;
2888 
2889 	karg.dataInSize = karg32.dataInSize;
2890 	karg.dataOutSize = karg32.dataOutSize;
2891 	karg.maxSenseBytes = karg32.maxSenseBytes;
2892 	karg.dataSgeOffset = karg32.dataSgeOffset;
2893 
2894 	karg.replyFrameBufPtr = (char __user *)(unsigned long)karg32.replyFrameBufPtr;
2895 	karg.dataInBufPtr = (char __user *)(unsigned long)karg32.dataInBufPtr;
2896 	karg.dataOutBufPtr = (char __user *)(unsigned long)karg32.dataOutBufPtr;
2897 	karg.senseDataPtr = (char __user *)(unsigned long)karg32.senseDataPtr;
2898 
2899 	/* Pass new structure to do_mpt_command
2900 	 */
2901 	ret = mptctl_do_mpt_command (karg, &uarg->MF);
2902 
2903 	mutex_unlock(&iocp->ioctl_cmds.mutex);
2904 
2905 	return ret;
2906 }
2907 
2908 static long compat_mpctl_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
2909 {
2910 	long ret;
2911 	lock_kernel();
2912 	switch (cmd) {
2913 	case MPTIOCINFO:
2914 	case MPTIOCINFO1:
2915 	case MPTIOCINFO2:
2916 	case MPTTARGETINFO:
2917 	case MPTEVENTQUERY:
2918 	case MPTEVENTENABLE:
2919 	case MPTEVENTREPORT:
2920 	case MPTHARDRESET:
2921 	case HP_GETHOSTINFO:
2922 	case HP_GETTARGETINFO:
2923 	case MPTTEST:
2924 		ret = __mptctl_ioctl(f, cmd, arg);
2925 		break;
2926 	case MPTCOMMAND32:
2927 		ret = compat_mpt_command(f, cmd, arg);
2928 		break;
2929 	case MPTFWDOWNLOAD32:
2930 		ret = compat_mptfwxfer_ioctl(f, cmd, arg);
2931 		break;
2932 	default:
2933 		ret = -ENOIOCTLCMD;
2934 		break;
2935 	}
2936 	unlock_kernel();
2937 	return ret;
2938 }
2939 
2940 #endif
2941 
2942 
2943 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2944 /*
2945  *	mptctl_probe - Installs ioctl devices per bus.
2946  *	@pdev: Pointer to pci_dev structure
2947  *
2948  *	Returns 0 for success, non-zero for failure.
2949  *
2950  */
2951 
2952 static int
2953 mptctl_probe(struct pci_dev *pdev, const struct pci_device_id *id)
2954 {
2955 	MPT_ADAPTER *ioc = pci_get_drvdata(pdev);
2956 
2957 	mutex_init(&ioc->ioctl_cmds.mutex);
2958 	init_completion(&ioc->ioctl_cmds.done);
2959 	return 0;
2960 }
2961 
2962 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2963 /*
2964  *	mptctl_remove - Removed ioctl devices
2965  *	@pdev: Pointer to pci_dev structure
2966  *
2967  *
2968  */
2969 static void
2970 mptctl_remove(struct pci_dev *pdev)
2971 {
2972 }
2973 
2974 static struct mpt_pci_driver mptctl_driver = {
2975   .probe		= mptctl_probe,
2976   .remove		= mptctl_remove,
2977 };
2978 
2979 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
2980 static int __init mptctl_init(void)
2981 {
2982 	int err;
2983 	int where = 1;
2984 
2985 	show_mptmod_ver(my_NAME, my_VERSION);
2986 
2987 	mpt_device_driver_register(&mptctl_driver, MPTCTL_DRIVER);
2988 
2989 	/* Register this device */
2990 	err = misc_register(&mptctl_miscdev);
2991 	if (err < 0) {
2992 		printk(KERN_ERR MYNAM ": Can't register misc device [minor=%d].\n", MPT_MINOR);
2993 		goto out_fail;
2994 	}
2995 	printk(KERN_INFO MYNAM ": Registered with Fusion MPT base driver\n");
2996 	printk(KERN_INFO MYNAM ": /dev/%s @ (major,minor=%d,%d)\n",
2997 			 mptctl_miscdev.name, MISC_MAJOR, mptctl_miscdev.minor);
2998 
2999 	/*
3000 	 *  Install our handler
3001 	 */
3002 	++where;
3003 	mptctl_id = mpt_register(mptctl_reply, MPTCTL_DRIVER);
3004 	if (!mptctl_id || mptctl_id >= MPT_MAX_PROTOCOL_DRIVERS) {
3005 		printk(KERN_ERR MYNAM ": ERROR: Failed to register with Fusion MPT base driver\n");
3006 		misc_deregister(&mptctl_miscdev);
3007 		err = -EBUSY;
3008 		goto out_fail;
3009 	}
3010 
3011 	mptctl_taskmgmt_id = mpt_register(mptctl_taskmgmt_reply, MPTCTL_DRIVER);
3012 	if (!mptctl_taskmgmt_id || mptctl_taskmgmt_id >= MPT_MAX_PROTOCOL_DRIVERS) {
3013 		printk(KERN_ERR MYNAM ": ERROR: Failed to register with Fusion MPT base driver\n");
3014 		mpt_deregister(mptctl_id);
3015 		misc_deregister(&mptctl_miscdev);
3016 		err = -EBUSY;
3017 		goto out_fail;
3018 	}
3019 
3020 	mpt_reset_register(mptctl_id, mptctl_ioc_reset);
3021 	mpt_event_register(mptctl_id, mptctl_event_process);
3022 
3023 	return 0;
3024 
3025 out_fail:
3026 
3027 	mpt_device_driver_deregister(MPTCTL_DRIVER);
3028 
3029 	return err;
3030 }
3031 
3032 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
3033 static void mptctl_exit(void)
3034 {
3035 	misc_deregister(&mptctl_miscdev);
3036 	printk(KERN_INFO MYNAM ": Deregistered /dev/%s @ (major,minor=%d,%d)\n",
3037 			 mptctl_miscdev.name, MISC_MAJOR, mptctl_miscdev.minor);
3038 
3039 	/* De-register event handler from base module */
3040 	mpt_event_deregister(mptctl_id);
3041 
3042 	/* De-register reset handler from base module */
3043 	mpt_reset_deregister(mptctl_id);
3044 
3045 	/* De-register callback handler from base module */
3046 	mpt_deregister(mptctl_taskmgmt_id);
3047 	mpt_deregister(mptctl_id);
3048 
3049         mpt_device_driver_deregister(MPTCTL_DRIVER);
3050 
3051 }
3052 
3053 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
3054 
3055 module_init(mptctl_init);
3056 module_exit(mptctl_exit);
3057