cciss.c revision 983333cb0c445c56808502461bbb34876c63eb2b
1/*
2 *    Disk Array driver for HP Smart Array controllers.
3 *    (C) Copyright 2000, 2007 Hewlett-Packard Development Company, L.P.
4 *
5 *    This program is free software; you can redistribute it and/or modify
6 *    it under the terms of the GNU General Public License as published by
7 *    the Free Software Foundation; version 2 of the License.
8 *
9 *    This program is distributed in the hope that it will be useful,
10 *    but WITHOUT ANY WARRANTY; without even the implied warranty of
11 *    MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 *    General Public License for more details.
13 *
14 *    You should have received a copy of the GNU General Public License
15 *    along with this program; if not, write to the Free Software
16 *    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
17 *    02111-1307, USA.
18 *
19 *    Questions/Comments/Bugfixes to iss_storagedev@hp.com
20 *
21 */
22
23#include <linux/module.h>
24#include <linux/interrupt.h>
25#include <linux/types.h>
26#include <linux/pci.h>
27#include <linux/kernel.h>
28#include <linux/slab.h>
29#include <linux/smp_lock.h>
30#include <linux/delay.h>
31#include <linux/major.h>
32#include <linux/fs.h>
33#include <linux/bio.h>
34#include <linux/blkpg.h>
35#include <linux/timer.h>
36#include <linux/proc_fs.h>
37#include <linux/seq_file.h>
38#include <linux/init.h>
39#include <linux/jiffies.h>
40#include <linux/hdreg.h>
41#include <linux/spinlock.h>
42#include <linux/compat.h>
43#include <linux/mutex.h>
44#include <asm/uaccess.h>
45#include <asm/io.h>
46
47#include <linux/dma-mapping.h>
48#include <linux/blkdev.h>
49#include <linux/genhd.h>
50#include <linux/completion.h>
51#include <scsi/scsi.h>
52#include <scsi/sg.h>
53#include <scsi/scsi_ioctl.h>
54#include <linux/cdrom.h>
55#include <linux/scatterlist.h>
56#include <linux/kthread.h>
57
58#define CCISS_DRIVER_VERSION(maj,min,submin) ((maj<<16)|(min<<8)|(submin))
59#define DRIVER_NAME "HP CISS Driver (v 3.6.20)"
60#define DRIVER_VERSION CCISS_DRIVER_VERSION(3, 6, 20)
61
62/* Embedded module documentation macros - see modules.h */
63MODULE_AUTHOR("Hewlett-Packard Company");
64MODULE_DESCRIPTION("Driver for HP Smart Array Controllers");
65MODULE_SUPPORTED_DEVICE("HP SA5i SA5i+ SA532 SA5300 SA5312 SA641 SA642 SA6400"
66			" SA6i P600 P800 P400 P400i E200 E200i E500 P700m"
67			" Smart Array G2 Series SAS/SATA Controllers");
68MODULE_VERSION("3.6.20");
69MODULE_LICENSE("GPL");
70
71#include "cciss_cmd.h"
72#include "cciss.h"
73#include <linux/cciss_ioctl.h>
74
75/* define the PCI info for the cards we can control */
76static const struct pci_device_id cciss_pci_device_id[] = {
77	{PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISS,  0x0E11, 0x4070},
78	{PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSB, 0x0E11, 0x4080},
79	{PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSB, 0x0E11, 0x4082},
80	{PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSB, 0x0E11, 0x4083},
81	{PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x4091},
82	{PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x409A},
83	{PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x409B},
84	{PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x409C},
85	{PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x409D},
86	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSA,     0x103C, 0x3225},
87	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3223},
88	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3234},
89	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3235},
90	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3211},
91	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3212},
92	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3213},
93	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3214},
94	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3215},
95	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3237},
96	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x323D},
97	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3241},
98	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3243},
99	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3245},
100	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3247},
101	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3249},
102	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x324A},
103	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x324B},
104	{PCI_VENDOR_ID_HP,     PCI_ANY_ID,	PCI_ANY_ID, PCI_ANY_ID,
105		PCI_CLASS_STORAGE_RAID << 8, 0xffff << 8, 0},
106	{0,}
107};
108
109MODULE_DEVICE_TABLE(pci, cciss_pci_device_id);
110
111/*  board_id = Subsystem Device ID & Vendor ID
112 *  product = Marketing Name for the board
113 *  access = Address of the struct of function pointers
114 */
115static struct board_type products[] = {
116	{0x40700E11, "Smart Array 5300", &SA5_access},
117	{0x40800E11, "Smart Array 5i", &SA5B_access},
118	{0x40820E11, "Smart Array 532", &SA5B_access},
119	{0x40830E11, "Smart Array 5312", &SA5B_access},
120	{0x409A0E11, "Smart Array 641", &SA5_access},
121	{0x409B0E11, "Smart Array 642", &SA5_access},
122	{0x409C0E11, "Smart Array 6400", &SA5_access},
123	{0x409D0E11, "Smart Array 6400 EM", &SA5_access},
124	{0x40910E11, "Smart Array 6i", &SA5_access},
125	{0x3225103C, "Smart Array P600", &SA5_access},
126	{0x3223103C, "Smart Array P800", &SA5_access},
127	{0x3234103C, "Smart Array P400", &SA5_access},
128	{0x3235103C, "Smart Array P400i", &SA5_access},
129	{0x3211103C, "Smart Array E200i", &SA5_access},
130	{0x3212103C, "Smart Array E200", &SA5_access},
131	{0x3213103C, "Smart Array E200i", &SA5_access},
132	{0x3214103C, "Smart Array E200i", &SA5_access},
133	{0x3215103C, "Smart Array E200i", &SA5_access},
134	{0x3237103C, "Smart Array E500", &SA5_access},
135	{0x323D103C, "Smart Array P700m", &SA5_access},
136	{0x3241103C, "Smart Array P212", &SA5_access},
137	{0x3243103C, "Smart Array P410", &SA5_access},
138	{0x3245103C, "Smart Array P410i", &SA5_access},
139	{0x3247103C, "Smart Array P411", &SA5_access},
140	{0x3249103C, "Smart Array P812", &SA5_access},
141	{0x324A103C, "Smart Array P712m", &SA5_access},
142	{0x324B103C, "Smart Array P711m", &SA5_access},
143	{0xFFFF103C, "Unknown Smart Array", &SA5_access},
144};
145
146/* How long to wait (in milliseconds) for board to go into simple mode */
147#define MAX_CONFIG_WAIT 30000
148#define MAX_IOCTL_CONFIG_WAIT 1000
149
150/*define how many times we will try a command because of bus resets */
151#define MAX_CMD_RETRIES 3
152
153#define MAX_CTLR	32
154
155/* Originally cciss driver only supports 8 major numbers */
156#define MAX_CTLR_ORIG 	8
157
158static ctlr_info_t *hba[MAX_CTLR];
159
160static struct task_struct *cciss_scan_thread;
161static DEFINE_MUTEX(scan_mutex);
162static LIST_HEAD(scan_q);
163
164static void do_cciss_request(struct request_queue *q);
165static irqreturn_t do_cciss_intr(int irq, void *dev_id);
166static int cciss_open(struct block_device *bdev, fmode_t mode);
167static int cciss_release(struct gendisk *disk, fmode_t mode);
168static int cciss_ioctl(struct block_device *bdev, fmode_t mode,
169		       unsigned int cmd, unsigned long arg);
170static int cciss_getgeo(struct block_device *bdev, struct hd_geometry *geo);
171
172static int cciss_revalidate(struct gendisk *disk);
173static int rebuild_lun_table(ctlr_info_t *h, int first_time, int via_ioctl);
174static int deregister_disk(ctlr_info_t *h, int drv_index,
175			   int clear_all, int via_ioctl);
176
177static void cciss_read_capacity(int ctlr, int logvol, int withirq,
178			sector_t *total_size, unsigned int *block_size);
179static void cciss_read_capacity_16(int ctlr, int logvol, int withirq,
180			sector_t *total_size, unsigned int *block_size);
181static void cciss_geometry_inquiry(int ctlr, int logvol,
182			int withirq, sector_t total_size,
183			unsigned int block_size, InquiryData_struct *inq_buff,
184				   drive_info_struct *drv);
185static void __devinit cciss_interrupt_mode(ctlr_info_t *, struct pci_dev *,
186					   __u32);
187static void start_io(ctlr_info_t *h);
188static int sendcmd(__u8 cmd, int ctlr, void *buff, size_t size,
189		   __u8 page_code, unsigned char *scsi3addr, int cmd_type);
190static int sendcmd_withirq(__u8 cmd, int ctlr, void *buff, size_t size,
191			__u8 page_code, unsigned char scsi3addr[],
192			int cmd_type);
193static int sendcmd_withirq_core(ctlr_info_t *h, CommandList_struct *c,
194	int attempt_retry);
195static int process_sendcmd_error(ctlr_info_t *h, CommandList_struct *c);
196
197static void fail_all_cmds(unsigned long ctlr);
198static int add_to_scan_list(struct ctlr_info *h);
199static int scan_thread(void *data);
200static int check_for_unit_attention(ctlr_info_t *h, CommandList_struct *c);
201static void cciss_hba_release(struct device *dev);
202static void cciss_device_release(struct device *dev);
203static void cciss_free_gendisk(ctlr_info_t *h, int drv_index);
204
205#ifdef CONFIG_PROC_FS
206static void cciss_procinit(int i);
207#else
208static void cciss_procinit(int i)
209{
210}
211#endif				/* CONFIG_PROC_FS */
212
213#ifdef CONFIG_COMPAT
214static int cciss_compat_ioctl(struct block_device *, fmode_t,
215			      unsigned, unsigned long);
216#endif
217
218static const struct block_device_operations cciss_fops = {
219	.owner = THIS_MODULE,
220	.open = cciss_open,
221	.release = cciss_release,
222	.locked_ioctl = cciss_ioctl,
223	.getgeo = cciss_getgeo,
224#ifdef CONFIG_COMPAT
225	.compat_ioctl = cciss_compat_ioctl,
226#endif
227	.revalidate_disk = cciss_revalidate,
228};
229
230/*
231 * Enqueuing and dequeuing functions for cmdlists.
232 */
233static inline void addQ(struct hlist_head *list, CommandList_struct *c)
234{
235	hlist_add_head(&c->list, list);
236}
237
238static inline void removeQ(CommandList_struct *c)
239{
240	/*
241	 * After kexec/dump some commands might still
242	 * be in flight, which the firmware will try
243	 * to complete. Resetting the firmware doesn't work
244	 * with old fw revisions, so we have to mark
245	 * them off as 'stale' to prevent the driver from
246	 * falling over.
247	 */
248	if (WARN_ON(hlist_unhashed(&c->list))) {
249		c->cmd_type = CMD_MSG_STALE;
250		return;
251	}
252
253	hlist_del_init(&c->list);
254}
255
256#include "cciss_scsi.c"		/* For SCSI tape support */
257
258#define RAID_UNKNOWN 6
259
260#ifdef CONFIG_PROC_FS
261
262/*
263 * Report information about this controller.
264 */
265#define ENG_GIG 1000000000
266#define ENG_GIG_FACTOR (ENG_GIG/512)
267#define ENGAGE_SCSI	"engage scsi"
268static const char *raid_label[] = { "0", "4", "1(1+0)", "5", "5+1", "ADG",
269	"UNKNOWN"
270};
271
272static struct proc_dir_entry *proc_cciss;
273
274static void cciss_seq_show_header(struct seq_file *seq)
275{
276	ctlr_info_t *h = seq->private;
277
278	seq_printf(seq, "%s: HP %s Controller\n"
279		"Board ID: 0x%08lx\n"
280		"Firmware Version: %c%c%c%c\n"
281		"IRQ: %d\n"
282		"Logical drives: %d\n"
283		"Current Q depth: %d\n"
284		"Current # commands on controller: %d\n"
285		"Max Q depth since init: %d\n"
286		"Max # commands on controller since init: %d\n"
287		"Max SG entries since init: %d\n",
288		h->devname,
289		h->product_name,
290		(unsigned long)h->board_id,
291		h->firm_ver[0], h->firm_ver[1], h->firm_ver[2],
292		h->firm_ver[3], (unsigned int)h->intr[SIMPLE_MODE_INT],
293		h->num_luns,
294		h->Qdepth, h->commands_outstanding,
295		h->maxQsinceinit, h->max_outstanding, h->maxSG);
296
297#ifdef CONFIG_CISS_SCSI_TAPE
298	cciss_seq_tape_report(seq, h->ctlr);
299#endif /* CONFIG_CISS_SCSI_TAPE */
300}
301
302static void *cciss_seq_start(struct seq_file *seq, loff_t *pos)
303{
304	ctlr_info_t *h = seq->private;
305	unsigned ctlr = h->ctlr;
306	unsigned long flags;
307
308	/* prevent displaying bogus info during configuration
309	 * or deconfiguration of a logical volume
310	 */
311	spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
312	if (h->busy_configuring) {
313		spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
314		return ERR_PTR(-EBUSY);
315	}
316	h->busy_configuring = 1;
317	spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
318
319	if (*pos == 0)
320		cciss_seq_show_header(seq);
321
322	return pos;
323}
324
325static int cciss_seq_show(struct seq_file *seq, void *v)
326{
327	sector_t vol_sz, vol_sz_frac;
328	ctlr_info_t *h = seq->private;
329	unsigned ctlr = h->ctlr;
330	loff_t *pos = v;
331	drive_info_struct *drv = &h->drv[*pos];
332
333	if (*pos > h->highest_lun)
334		return 0;
335
336	if (drv->heads == 0)
337		return 0;
338
339	vol_sz = drv->nr_blocks;
340	vol_sz_frac = sector_div(vol_sz, ENG_GIG_FACTOR);
341	vol_sz_frac *= 100;
342	sector_div(vol_sz_frac, ENG_GIG_FACTOR);
343
344	if (drv->raid_level > 5)
345		drv->raid_level = RAID_UNKNOWN;
346	seq_printf(seq, "cciss/c%dd%d:"
347			"\t%4u.%02uGB\tRAID %s\n",
348			ctlr, (int) *pos, (int)vol_sz, (int)vol_sz_frac,
349			raid_label[drv->raid_level]);
350	return 0;
351}
352
353static void *cciss_seq_next(struct seq_file *seq, void *v, loff_t *pos)
354{
355	ctlr_info_t *h = seq->private;
356
357	if (*pos > h->highest_lun)
358		return NULL;
359	*pos += 1;
360
361	return pos;
362}
363
364static void cciss_seq_stop(struct seq_file *seq, void *v)
365{
366	ctlr_info_t *h = seq->private;
367
368	/* Only reset h->busy_configuring if we succeeded in setting
369	 * it during cciss_seq_start. */
370	if (v == ERR_PTR(-EBUSY))
371		return;
372
373	h->busy_configuring = 0;
374}
375
376static const struct seq_operations cciss_seq_ops = {
377	.start = cciss_seq_start,
378	.show  = cciss_seq_show,
379	.next  = cciss_seq_next,
380	.stop  = cciss_seq_stop,
381};
382
383static int cciss_seq_open(struct inode *inode, struct file *file)
384{
385	int ret = seq_open(file, &cciss_seq_ops);
386	struct seq_file *seq = file->private_data;
387
388	if (!ret)
389		seq->private = PDE(inode)->data;
390
391	return ret;
392}
393
394static ssize_t
395cciss_proc_write(struct file *file, const char __user *buf,
396		 size_t length, loff_t *ppos)
397{
398	int err;
399	char *buffer;
400
401#ifndef CONFIG_CISS_SCSI_TAPE
402	return -EINVAL;
403#endif
404
405	if (!buf || length > PAGE_SIZE - 1)
406		return -EINVAL;
407
408	buffer = (char *)__get_free_page(GFP_KERNEL);
409	if (!buffer)
410		return -ENOMEM;
411
412	err = -EFAULT;
413	if (copy_from_user(buffer, buf, length))
414		goto out;
415	buffer[length] = '\0';
416
417#ifdef CONFIG_CISS_SCSI_TAPE
418	if (strncmp(ENGAGE_SCSI, buffer, sizeof ENGAGE_SCSI - 1) == 0) {
419		struct seq_file *seq = file->private_data;
420		ctlr_info_t *h = seq->private;
421		int rc;
422
423		rc = cciss_engage_scsi(h->ctlr);
424		if (rc != 0)
425			err = -rc;
426		else
427			err = length;
428	} else
429#endif /* CONFIG_CISS_SCSI_TAPE */
430		err = -EINVAL;
431	/* might be nice to have "disengage" too, but it's not
432	   safely possible. (only 1 module use count, lock issues.) */
433
434out:
435	free_page((unsigned long)buffer);
436	return err;
437}
438
439static struct file_operations cciss_proc_fops = {
440	.owner	 = THIS_MODULE,
441	.open    = cciss_seq_open,
442	.read    = seq_read,
443	.llseek  = seq_lseek,
444	.release = seq_release,
445	.write	 = cciss_proc_write,
446};
447
448static void __devinit cciss_procinit(int i)
449{
450	struct proc_dir_entry *pde;
451
452	if (proc_cciss == NULL)
453		proc_cciss = proc_mkdir("driver/cciss", NULL);
454	if (!proc_cciss)
455		return;
456	pde = proc_create_data(hba[i]->devname, S_IWUSR | S_IRUSR | S_IRGRP |
457					S_IROTH, proc_cciss,
458					&cciss_proc_fops, hba[i]);
459}
460#endif				/* CONFIG_PROC_FS */
461
462#define MAX_PRODUCT_NAME_LEN 19
463
464#define to_hba(n) container_of(n, struct ctlr_info, dev)
465
466static ssize_t host_store_rescan(struct device *dev,
467				 struct device_attribute *attr,
468				 const char *buf, size_t count)
469{
470	struct ctlr_info *h = to_hba(dev);
471
472	add_to_scan_list(h);
473	wake_up_process(cciss_scan_thread);
474	wait_for_completion_interruptible(&h->scan_wait);
475
476	return count;
477}
478DEVICE_ATTR(rescan, S_IWUSR, NULL, host_store_rescan);
479
480static ssize_t dev_show_unique_id(struct device *dev,
481				 struct device_attribute *attr,
482				 char *buf)
483{
484	drive_info_struct *drv = dev_get_drvdata(dev);
485	struct ctlr_info *h = to_hba(drv->dev->parent);
486	__u8 sn[16];
487	unsigned long flags;
488	int ret = 0;
489
490	spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
491	if (h->busy_configuring)
492		ret = -EBUSY;
493	else
494		memcpy(sn, drv->serial_no, sizeof(sn));
495	spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
496
497	if (ret)
498		return ret;
499	else
500		return snprintf(buf, 16 * 2 + 2,
501				"%02X%02X%02X%02X%02X%02X%02X%02X"
502				"%02X%02X%02X%02X%02X%02X%02X%02X\n",
503				sn[0], sn[1], sn[2], sn[3],
504				sn[4], sn[5], sn[6], sn[7],
505				sn[8], sn[9], sn[10], sn[11],
506				sn[12], sn[13], sn[14], sn[15]);
507}
508DEVICE_ATTR(unique_id, S_IRUGO, dev_show_unique_id, NULL);
509
510static ssize_t dev_show_vendor(struct device *dev,
511			       struct device_attribute *attr,
512			       char *buf)
513{
514	drive_info_struct *drv = dev_get_drvdata(dev);
515	struct ctlr_info *h = to_hba(drv->dev->parent);
516	char vendor[VENDOR_LEN + 1];
517	unsigned long flags;
518	int ret = 0;
519
520	spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
521	if (h->busy_configuring)
522		ret = -EBUSY;
523	else
524		memcpy(vendor, drv->vendor, VENDOR_LEN + 1);
525	spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
526
527	if (ret)
528		return ret;
529	else
530		return snprintf(buf, sizeof(vendor) + 1, "%s\n", drv->vendor);
531}
532DEVICE_ATTR(vendor, S_IRUGO, dev_show_vendor, NULL);
533
534static ssize_t dev_show_model(struct device *dev,
535			      struct device_attribute *attr,
536			      char *buf)
537{
538	drive_info_struct *drv = dev_get_drvdata(dev);
539	struct ctlr_info *h = to_hba(drv->dev->parent);
540	char model[MODEL_LEN + 1];
541	unsigned long flags;
542	int ret = 0;
543
544	spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
545	if (h->busy_configuring)
546		ret = -EBUSY;
547	else
548		memcpy(model, drv->model, MODEL_LEN + 1);
549	spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
550
551	if (ret)
552		return ret;
553	else
554		return snprintf(buf, sizeof(model) + 1, "%s\n", drv->model);
555}
556DEVICE_ATTR(model, S_IRUGO, dev_show_model, NULL);
557
558static ssize_t dev_show_rev(struct device *dev,
559			    struct device_attribute *attr,
560			    char *buf)
561{
562	drive_info_struct *drv = dev_get_drvdata(dev);
563	struct ctlr_info *h = to_hba(drv->dev->parent);
564	char rev[REV_LEN + 1];
565	unsigned long flags;
566	int ret = 0;
567
568	spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
569	if (h->busy_configuring)
570		ret = -EBUSY;
571	else
572		memcpy(rev, drv->rev, REV_LEN + 1);
573	spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
574
575	if (ret)
576		return ret;
577	else
578		return snprintf(buf, sizeof(rev) + 1, "%s\n", drv->rev);
579}
580DEVICE_ATTR(rev, S_IRUGO, dev_show_rev, NULL);
581
582static struct attribute *cciss_host_attrs[] = {
583	&dev_attr_rescan.attr,
584	NULL
585};
586
587static struct attribute_group cciss_host_attr_group = {
588	.attrs = cciss_host_attrs,
589};
590
591static struct attribute_group *cciss_host_attr_groups[] = {
592	&cciss_host_attr_group,
593	NULL
594};
595
596static struct device_type cciss_host_type = {
597	.name		= "cciss_host",
598	.groups		= cciss_host_attr_groups,
599	.release	= cciss_hba_release,
600};
601
602static struct attribute *cciss_dev_attrs[] = {
603	&dev_attr_unique_id.attr,
604	&dev_attr_model.attr,
605	&dev_attr_vendor.attr,
606	&dev_attr_rev.attr,
607	NULL
608};
609
610static struct attribute_group cciss_dev_attr_group = {
611	.attrs = cciss_dev_attrs,
612};
613
614static const struct attribute_group *cciss_dev_attr_groups[] = {
615	&cciss_dev_attr_group,
616	NULL
617};
618
619static struct device_type cciss_dev_type = {
620	.name		= "cciss_device",
621	.groups		= cciss_dev_attr_groups,
622	.release	= cciss_device_release,
623};
624
625static struct bus_type cciss_bus_type = {
626	.name		= "cciss",
627};
628
629/*
630 * cciss_hba_release is called when the reference count
631 * of h->dev goes to zero.
632 */
633static void cciss_hba_release(struct device *dev)
634{
635	/*
636	 * nothing to do, but need this to avoid a warning
637	 * about not having a release handler from lib/kref.c.
638	 */
639}
640
641/*
642 * Initialize sysfs entry for each controller.  This sets up and registers
643 * the 'cciss#' directory for each individual controller under
644 * /sys/bus/pci/devices/<dev>/.
645 */
646static int cciss_create_hba_sysfs_entry(struct ctlr_info *h)
647{
648	device_initialize(&h->dev);
649	h->dev.type = &cciss_host_type;
650	h->dev.bus = &cciss_bus_type;
651	dev_set_name(&h->dev, "%s", h->devname);
652	h->dev.parent = &h->pdev->dev;
653
654	return device_add(&h->dev);
655}
656
657/*
658 * Remove sysfs entries for an hba.
659 */
660static void cciss_destroy_hba_sysfs_entry(struct ctlr_info *h)
661{
662	device_del(&h->dev);
663	put_device(&h->dev); /* final put. */
664}
665
666/* cciss_device_release is called when the reference count
667 * of h->drv[x].dev goes to zero.
668 */
669static void cciss_device_release(struct device *dev)
670{
671	kfree(dev);
672}
673
674/*
675 * Initialize sysfs for each logical drive.  This sets up and registers
676 * the 'c#d#' directory for each individual logical drive under
677 * /sys/bus/pci/devices/<dev/ccis#/. We also create a link from
678 * /sys/block/cciss!c#d# to this entry.
679 */
680static long cciss_create_ld_sysfs_entry(struct ctlr_info *h,
681				       int drv_index)
682{
683	struct device *dev;
684
685	/* Special case for c*d0, we only create it once. */
686	if (drv_index == 0 && h->drv[drv_index].dev != NULL)
687		return 0;
688
689	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
690	if (!dev)
691		return -ENOMEM;
692	device_initialize(dev);
693	dev->type = &cciss_dev_type;
694	dev->bus = &cciss_bus_type;
695	dev_set_name(dev, "c%dd%d", h->ctlr, drv_index);
696	dev->parent = &h->dev;
697	h->drv[drv_index].dev = dev;
698	dev_set_drvdata(dev, &h->drv[drv_index]);
699	return device_add(dev);
700}
701
702/*
703 * Remove sysfs entries for a logical drive.
704 */
705static void cciss_destroy_ld_sysfs_entry(struct ctlr_info *h, int drv_index,
706	int ctlr_exiting)
707{
708	struct device *dev = h->drv[drv_index].dev;
709
710	/* special case for c*d0, we only destroy it on controller exit */
711	if (drv_index == 0 && !ctlr_exiting)
712		return;
713
714	device_del(dev);
715	put_device(dev); /* the "final" put. */
716	h->drv[drv_index].dev = NULL;
717}
718
719/*
720 * For operations that cannot sleep, a command block is allocated at init,
721 * and managed by cmd_alloc() and cmd_free() using a simple bitmap to track
722 * which ones are free or in use.  For operations that can wait for kmalloc
723 * to possible sleep, this routine can be called with get_from_pool set to 0.
724 * cmd_free() MUST be called with a got_from_pool set to 0 if cmd_alloc was.
725 */
726static CommandList_struct *cmd_alloc(ctlr_info_t *h, int get_from_pool)
727{
728	CommandList_struct *c;
729	int i;
730	u64bit temp64;
731	dma_addr_t cmd_dma_handle, err_dma_handle;
732
733	if (!get_from_pool) {
734		c = (CommandList_struct *) pci_alloc_consistent(h->pdev,
735			sizeof(CommandList_struct), &cmd_dma_handle);
736		if (c == NULL)
737			return NULL;
738		memset(c, 0, sizeof(CommandList_struct));
739
740		c->cmdindex = -1;
741
742		c->err_info = (ErrorInfo_struct *)
743		    pci_alloc_consistent(h->pdev, sizeof(ErrorInfo_struct),
744			    &err_dma_handle);
745
746		if (c->err_info == NULL) {
747			pci_free_consistent(h->pdev,
748				sizeof(CommandList_struct), c, cmd_dma_handle);
749			return NULL;
750		}
751		memset(c->err_info, 0, sizeof(ErrorInfo_struct));
752	} else {		/* get it out of the controllers pool */
753
754		do {
755			i = find_first_zero_bit(h->cmd_pool_bits, h->nr_cmds);
756			if (i == h->nr_cmds)
757				return NULL;
758		} while (test_and_set_bit
759			 (i & (BITS_PER_LONG - 1),
760			  h->cmd_pool_bits + (i / BITS_PER_LONG)) != 0);
761#ifdef CCISS_DEBUG
762		printk(KERN_DEBUG "cciss: using command buffer %d\n", i);
763#endif
764		c = h->cmd_pool + i;
765		memset(c, 0, sizeof(CommandList_struct));
766		cmd_dma_handle = h->cmd_pool_dhandle
767		    + i * sizeof(CommandList_struct);
768		c->err_info = h->errinfo_pool + i;
769		memset(c->err_info, 0, sizeof(ErrorInfo_struct));
770		err_dma_handle = h->errinfo_pool_dhandle
771		    + i * sizeof(ErrorInfo_struct);
772		h->nr_allocs++;
773
774		c->cmdindex = i;
775	}
776
777	INIT_HLIST_NODE(&c->list);
778	c->busaddr = (__u32) cmd_dma_handle;
779	temp64.val = (__u64) err_dma_handle;
780	c->ErrDesc.Addr.lower = temp64.val32.lower;
781	c->ErrDesc.Addr.upper = temp64.val32.upper;
782	c->ErrDesc.Len = sizeof(ErrorInfo_struct);
783
784	c->ctlr = h->ctlr;
785	return c;
786}
787
788/*
789 * Frees a command block that was previously allocated with cmd_alloc().
790 */
791static void cmd_free(ctlr_info_t *h, CommandList_struct *c, int got_from_pool)
792{
793	int i;
794	u64bit temp64;
795
796	if (!got_from_pool) {
797		temp64.val32.lower = c->ErrDesc.Addr.lower;
798		temp64.val32.upper = c->ErrDesc.Addr.upper;
799		pci_free_consistent(h->pdev, sizeof(ErrorInfo_struct),
800				    c->err_info, (dma_addr_t) temp64.val);
801		pci_free_consistent(h->pdev, sizeof(CommandList_struct),
802				    c, (dma_addr_t) c->busaddr);
803	} else {
804		i = c - h->cmd_pool;
805		clear_bit(i & (BITS_PER_LONG - 1),
806			  h->cmd_pool_bits + (i / BITS_PER_LONG));
807		h->nr_frees++;
808	}
809}
810
811static inline ctlr_info_t *get_host(struct gendisk *disk)
812{
813	return disk->queue->queuedata;
814}
815
816static inline drive_info_struct *get_drv(struct gendisk *disk)
817{
818	return disk->private_data;
819}
820
821/*
822 * Open.  Make sure the device is really there.
823 */
824static int cciss_open(struct block_device *bdev, fmode_t mode)
825{
826	ctlr_info_t *host = get_host(bdev->bd_disk);
827	drive_info_struct *drv = get_drv(bdev->bd_disk);
828
829#ifdef CCISS_DEBUG
830	printk(KERN_DEBUG "cciss_open %s\n", bdev->bd_disk->disk_name);
831#endif				/* CCISS_DEBUG */
832
833	if (host->busy_initializing || drv->busy_configuring)
834		return -EBUSY;
835	/*
836	 * Root is allowed to open raw volume zero even if it's not configured
837	 * so array config can still work. Root is also allowed to open any
838	 * volume that has a LUN ID, so it can issue IOCTL to reread the
839	 * disk information.  I don't think I really like this
840	 * but I'm already using way to many device nodes to claim another one
841	 * for "raw controller".
842	 */
843	if (drv->heads == 0) {
844		if (MINOR(bdev->bd_dev) != 0) {	/* not node 0? */
845			/* if not node 0 make sure it is a partition = 0 */
846			if (MINOR(bdev->bd_dev) & 0x0f) {
847				return -ENXIO;
848				/* if it is, make sure we have a LUN ID */
849			} else if (drv->LunID == 0) {
850				return -ENXIO;
851			}
852		}
853		if (!capable(CAP_SYS_ADMIN))
854			return -EPERM;
855	}
856	drv->usage_count++;
857	host->usage_count++;
858	return 0;
859}
860
861/*
862 * Close.  Sync first.
863 */
864static int cciss_release(struct gendisk *disk, fmode_t mode)
865{
866	ctlr_info_t *host = get_host(disk);
867	drive_info_struct *drv = get_drv(disk);
868
869#ifdef CCISS_DEBUG
870	printk(KERN_DEBUG "cciss_release %s\n", disk->disk_name);
871#endif				/* CCISS_DEBUG */
872
873	drv->usage_count--;
874	host->usage_count--;
875	return 0;
876}
877
878#ifdef CONFIG_COMPAT
879
880static int do_ioctl(struct block_device *bdev, fmode_t mode,
881		    unsigned cmd, unsigned long arg)
882{
883	int ret;
884	lock_kernel();
885	ret = cciss_ioctl(bdev, mode, cmd, arg);
886	unlock_kernel();
887	return ret;
888}
889
890static int cciss_ioctl32_passthru(struct block_device *bdev, fmode_t mode,
891				  unsigned cmd, unsigned long arg);
892static int cciss_ioctl32_big_passthru(struct block_device *bdev, fmode_t mode,
893				      unsigned cmd, unsigned long arg);
894
895static int cciss_compat_ioctl(struct block_device *bdev, fmode_t mode,
896			      unsigned cmd, unsigned long arg)
897{
898	switch (cmd) {
899	case CCISS_GETPCIINFO:
900	case CCISS_GETINTINFO:
901	case CCISS_SETINTINFO:
902	case CCISS_GETNODENAME:
903	case CCISS_SETNODENAME:
904	case CCISS_GETHEARTBEAT:
905	case CCISS_GETBUSTYPES:
906	case CCISS_GETFIRMVER:
907	case CCISS_GETDRIVVER:
908	case CCISS_REVALIDVOLS:
909	case CCISS_DEREGDISK:
910	case CCISS_REGNEWDISK:
911	case CCISS_REGNEWD:
912	case CCISS_RESCANDISK:
913	case CCISS_GETLUNINFO:
914		return do_ioctl(bdev, mode, cmd, arg);
915
916	case CCISS_PASSTHRU32:
917		return cciss_ioctl32_passthru(bdev, mode, cmd, arg);
918	case CCISS_BIG_PASSTHRU32:
919		return cciss_ioctl32_big_passthru(bdev, mode, cmd, arg);
920
921	default:
922		return -ENOIOCTLCMD;
923	}
924}
925
926static int cciss_ioctl32_passthru(struct block_device *bdev, fmode_t mode,
927				  unsigned cmd, unsigned long arg)
928{
929	IOCTL32_Command_struct __user *arg32 =
930	    (IOCTL32_Command_struct __user *) arg;
931	IOCTL_Command_struct arg64;
932	IOCTL_Command_struct __user *p = compat_alloc_user_space(sizeof(arg64));
933	int err;
934	u32 cp;
935
936	err = 0;
937	err |=
938	    copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
939			   sizeof(arg64.LUN_info));
940	err |=
941	    copy_from_user(&arg64.Request, &arg32->Request,
942			   sizeof(arg64.Request));
943	err |=
944	    copy_from_user(&arg64.error_info, &arg32->error_info,
945			   sizeof(arg64.error_info));
946	err |= get_user(arg64.buf_size, &arg32->buf_size);
947	err |= get_user(cp, &arg32->buf);
948	arg64.buf = compat_ptr(cp);
949	err |= copy_to_user(p, &arg64, sizeof(arg64));
950
951	if (err)
952		return -EFAULT;
953
954	err = do_ioctl(bdev, mode, CCISS_PASSTHRU, (unsigned long)p);
955	if (err)
956		return err;
957	err |=
958	    copy_in_user(&arg32->error_info, &p->error_info,
959			 sizeof(arg32->error_info));
960	if (err)
961		return -EFAULT;
962	return err;
963}
964
965static int cciss_ioctl32_big_passthru(struct block_device *bdev, fmode_t mode,
966				      unsigned cmd, unsigned long arg)
967{
968	BIG_IOCTL32_Command_struct __user *arg32 =
969	    (BIG_IOCTL32_Command_struct __user *) arg;
970	BIG_IOCTL_Command_struct arg64;
971	BIG_IOCTL_Command_struct __user *p =
972	    compat_alloc_user_space(sizeof(arg64));
973	int err;
974	u32 cp;
975
976	err = 0;
977	err |=
978	    copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
979			   sizeof(arg64.LUN_info));
980	err |=
981	    copy_from_user(&arg64.Request, &arg32->Request,
982			   sizeof(arg64.Request));
983	err |=
984	    copy_from_user(&arg64.error_info, &arg32->error_info,
985			   sizeof(arg64.error_info));
986	err |= get_user(arg64.buf_size, &arg32->buf_size);
987	err |= get_user(arg64.malloc_size, &arg32->malloc_size);
988	err |= get_user(cp, &arg32->buf);
989	arg64.buf = compat_ptr(cp);
990	err |= copy_to_user(p, &arg64, sizeof(arg64));
991
992	if (err)
993		return -EFAULT;
994
995	err = do_ioctl(bdev, mode, CCISS_BIG_PASSTHRU, (unsigned long)p);
996	if (err)
997		return err;
998	err |=
999	    copy_in_user(&arg32->error_info, &p->error_info,
1000			 sizeof(arg32->error_info));
1001	if (err)
1002		return -EFAULT;
1003	return err;
1004}
1005#endif
1006
1007static int cciss_getgeo(struct block_device *bdev, struct hd_geometry *geo)
1008{
1009	drive_info_struct *drv = get_drv(bdev->bd_disk);
1010
1011	if (!drv->cylinders)
1012		return -ENXIO;
1013
1014	geo->heads = drv->heads;
1015	geo->sectors = drv->sectors;
1016	geo->cylinders = drv->cylinders;
1017	return 0;
1018}
1019
1020static void check_ioctl_unit_attention(ctlr_info_t *host, CommandList_struct *c)
1021{
1022	if (c->err_info->CommandStatus == CMD_TARGET_STATUS &&
1023			c->err_info->ScsiStatus != SAM_STAT_CHECK_CONDITION)
1024		(void)check_for_unit_attention(host, c);
1025}
1026/*
1027 * ioctl
1028 */
1029static int cciss_ioctl(struct block_device *bdev, fmode_t mode,
1030		       unsigned int cmd, unsigned long arg)
1031{
1032	struct gendisk *disk = bdev->bd_disk;
1033	ctlr_info_t *host = get_host(disk);
1034	drive_info_struct *drv = get_drv(disk);
1035	int ctlr = host->ctlr;
1036	void __user *argp = (void __user *)arg;
1037
1038#ifdef CCISS_DEBUG
1039	printk(KERN_DEBUG "cciss_ioctl: Called with cmd=%x %lx\n", cmd, arg);
1040#endif				/* CCISS_DEBUG */
1041
1042	switch (cmd) {
1043	case CCISS_GETPCIINFO:
1044		{
1045			cciss_pci_info_struct pciinfo;
1046
1047			if (!arg)
1048				return -EINVAL;
1049			pciinfo.domain = pci_domain_nr(host->pdev->bus);
1050			pciinfo.bus = host->pdev->bus->number;
1051			pciinfo.dev_fn = host->pdev->devfn;
1052			pciinfo.board_id = host->board_id;
1053			if (copy_to_user
1054			    (argp, &pciinfo, sizeof(cciss_pci_info_struct)))
1055				return -EFAULT;
1056			return 0;
1057		}
1058	case CCISS_GETINTINFO:
1059		{
1060			cciss_coalint_struct intinfo;
1061			if (!arg)
1062				return -EINVAL;
1063			intinfo.delay =
1064			    readl(&host->cfgtable->HostWrite.CoalIntDelay);
1065			intinfo.count =
1066			    readl(&host->cfgtable->HostWrite.CoalIntCount);
1067			if (copy_to_user
1068			    (argp, &intinfo, sizeof(cciss_coalint_struct)))
1069				return -EFAULT;
1070			return 0;
1071		}
1072	case CCISS_SETINTINFO:
1073		{
1074			cciss_coalint_struct intinfo;
1075			unsigned long flags;
1076			int i;
1077
1078			if (!arg)
1079				return -EINVAL;
1080			if (!capable(CAP_SYS_ADMIN))
1081				return -EPERM;
1082			if (copy_from_user
1083			    (&intinfo, argp, sizeof(cciss_coalint_struct)))
1084				return -EFAULT;
1085			if ((intinfo.delay == 0) && (intinfo.count == 0))
1086			{
1087//                      printk("cciss_ioctl: delay and count cannot be 0\n");
1088				return -EINVAL;
1089			}
1090			spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
1091			/* Update the field, and then ring the doorbell */
1092			writel(intinfo.delay,
1093			       &(host->cfgtable->HostWrite.CoalIntDelay));
1094			writel(intinfo.count,
1095			       &(host->cfgtable->HostWrite.CoalIntCount));
1096			writel(CFGTBL_ChangeReq, host->vaddr + SA5_DOORBELL);
1097
1098			for (i = 0; i < MAX_IOCTL_CONFIG_WAIT; i++) {
1099				if (!(readl(host->vaddr + SA5_DOORBELL)
1100				      & CFGTBL_ChangeReq))
1101					break;
1102				/* delay and try again */
1103				udelay(1000);
1104			}
1105			spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
1106			if (i >= MAX_IOCTL_CONFIG_WAIT)
1107				return -EAGAIN;
1108			return 0;
1109		}
1110	case CCISS_GETNODENAME:
1111		{
1112			NodeName_type NodeName;
1113			int i;
1114
1115			if (!arg)
1116				return -EINVAL;
1117			for (i = 0; i < 16; i++)
1118				NodeName[i] =
1119				    readb(&host->cfgtable->ServerName[i]);
1120			if (copy_to_user(argp, NodeName, sizeof(NodeName_type)))
1121				return -EFAULT;
1122			return 0;
1123		}
1124	case CCISS_SETNODENAME:
1125		{
1126			NodeName_type NodeName;
1127			unsigned long flags;
1128			int i;
1129
1130			if (!arg)
1131				return -EINVAL;
1132			if (!capable(CAP_SYS_ADMIN))
1133				return -EPERM;
1134
1135			if (copy_from_user
1136			    (NodeName, argp, sizeof(NodeName_type)))
1137				return -EFAULT;
1138
1139			spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
1140
1141			/* Update the field, and then ring the doorbell */
1142			for (i = 0; i < 16; i++)
1143				writeb(NodeName[i],
1144				       &host->cfgtable->ServerName[i]);
1145
1146			writel(CFGTBL_ChangeReq, host->vaddr + SA5_DOORBELL);
1147
1148			for (i = 0; i < MAX_IOCTL_CONFIG_WAIT; i++) {
1149				if (!(readl(host->vaddr + SA5_DOORBELL)
1150				      & CFGTBL_ChangeReq))
1151					break;
1152				/* delay and try again */
1153				udelay(1000);
1154			}
1155			spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
1156			if (i >= MAX_IOCTL_CONFIG_WAIT)
1157				return -EAGAIN;
1158			return 0;
1159		}
1160
1161	case CCISS_GETHEARTBEAT:
1162		{
1163			Heartbeat_type heartbeat;
1164
1165			if (!arg)
1166				return -EINVAL;
1167			heartbeat = readl(&host->cfgtable->HeartBeat);
1168			if (copy_to_user
1169			    (argp, &heartbeat, sizeof(Heartbeat_type)))
1170				return -EFAULT;
1171			return 0;
1172		}
1173	case CCISS_GETBUSTYPES:
1174		{
1175			BusTypes_type BusTypes;
1176
1177			if (!arg)
1178				return -EINVAL;
1179			BusTypes = readl(&host->cfgtable->BusTypes);
1180			if (copy_to_user
1181			    (argp, &BusTypes, sizeof(BusTypes_type)))
1182				return -EFAULT;
1183			return 0;
1184		}
1185	case CCISS_GETFIRMVER:
1186		{
1187			FirmwareVer_type firmware;
1188
1189			if (!arg)
1190				return -EINVAL;
1191			memcpy(firmware, host->firm_ver, 4);
1192
1193			if (copy_to_user
1194			    (argp, firmware, sizeof(FirmwareVer_type)))
1195				return -EFAULT;
1196			return 0;
1197		}
1198	case CCISS_GETDRIVVER:
1199		{
1200			DriverVer_type DriverVer = DRIVER_VERSION;
1201
1202			if (!arg)
1203				return -EINVAL;
1204
1205			if (copy_to_user
1206			    (argp, &DriverVer, sizeof(DriverVer_type)))
1207				return -EFAULT;
1208			return 0;
1209		}
1210
1211	case CCISS_DEREGDISK:
1212	case CCISS_REGNEWD:
1213	case CCISS_REVALIDVOLS:
1214		return rebuild_lun_table(host, 0, 1);
1215
1216	case CCISS_GETLUNINFO:{
1217			LogvolInfo_struct luninfo;
1218
1219			luninfo.LunID = drv->LunID;
1220			luninfo.num_opens = drv->usage_count;
1221			luninfo.num_parts = 0;
1222			if (copy_to_user(argp, &luninfo,
1223					 sizeof(LogvolInfo_struct)))
1224				return -EFAULT;
1225			return 0;
1226		}
1227	case CCISS_PASSTHRU:
1228		{
1229			IOCTL_Command_struct iocommand;
1230			CommandList_struct *c;
1231			char *buff = NULL;
1232			u64bit temp64;
1233			unsigned long flags;
1234			DECLARE_COMPLETION_ONSTACK(wait);
1235
1236			if (!arg)
1237				return -EINVAL;
1238
1239			if (!capable(CAP_SYS_RAWIO))
1240				return -EPERM;
1241
1242			if (copy_from_user
1243			    (&iocommand, argp, sizeof(IOCTL_Command_struct)))
1244				return -EFAULT;
1245			if ((iocommand.buf_size < 1) &&
1246			    (iocommand.Request.Type.Direction != XFER_NONE)) {
1247				return -EINVAL;
1248			}
1249#if 0				/* 'buf_size' member is 16-bits, and always smaller than kmalloc limit */
1250			/* Check kmalloc limits */
1251			if (iocommand.buf_size > 128000)
1252				return -EINVAL;
1253#endif
1254			if (iocommand.buf_size > 0) {
1255				buff = kmalloc(iocommand.buf_size, GFP_KERNEL);
1256				if (buff == NULL)
1257					return -EFAULT;
1258			}
1259			if (iocommand.Request.Type.Direction == XFER_WRITE) {
1260				/* Copy the data into the buffer we created */
1261				if (copy_from_user
1262				    (buff, iocommand.buf, iocommand.buf_size)) {
1263					kfree(buff);
1264					return -EFAULT;
1265				}
1266			} else {
1267				memset(buff, 0, iocommand.buf_size);
1268			}
1269			if ((c = cmd_alloc(host, 0)) == NULL) {
1270				kfree(buff);
1271				return -ENOMEM;
1272			}
1273			// Fill in the command type
1274			c->cmd_type = CMD_IOCTL_PEND;
1275			// Fill in Command Header
1276			c->Header.ReplyQueue = 0;	// unused in simple mode
1277			if (iocommand.buf_size > 0)	// buffer to fill
1278			{
1279				c->Header.SGList = 1;
1280				c->Header.SGTotal = 1;
1281			} else	// no buffers to fill
1282			{
1283				c->Header.SGList = 0;
1284				c->Header.SGTotal = 0;
1285			}
1286			c->Header.LUN = iocommand.LUN_info;
1287			c->Header.Tag.lower = c->busaddr;	// use the kernel address the cmd block for tag
1288
1289			// Fill in Request block
1290			c->Request = iocommand.Request;
1291
1292			// Fill in the scatter gather information
1293			if (iocommand.buf_size > 0) {
1294				temp64.val = pci_map_single(host->pdev, buff,
1295					iocommand.buf_size,
1296					PCI_DMA_BIDIRECTIONAL);
1297				c->SG[0].Addr.lower = temp64.val32.lower;
1298				c->SG[0].Addr.upper = temp64.val32.upper;
1299				c->SG[0].Len = iocommand.buf_size;
1300				c->SG[0].Ext = 0;	// we are not chaining
1301			}
1302			c->waiting = &wait;
1303
1304			/* Put the request on the tail of the request queue */
1305			spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
1306			addQ(&host->reqQ, c);
1307			host->Qdepth++;
1308			start_io(host);
1309			spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
1310
1311			wait_for_completion(&wait);
1312
1313			/* unlock the buffers from DMA */
1314			temp64.val32.lower = c->SG[0].Addr.lower;
1315			temp64.val32.upper = c->SG[0].Addr.upper;
1316			pci_unmap_single(host->pdev, (dma_addr_t) temp64.val,
1317					 iocommand.buf_size,
1318					 PCI_DMA_BIDIRECTIONAL);
1319
1320			check_ioctl_unit_attention(host, c);
1321
1322			/* Copy the error information out */
1323			iocommand.error_info = *(c->err_info);
1324			if (copy_to_user
1325			    (argp, &iocommand, sizeof(IOCTL_Command_struct))) {
1326				kfree(buff);
1327				cmd_free(host, c, 0);
1328				return -EFAULT;
1329			}
1330
1331			if (iocommand.Request.Type.Direction == XFER_READ) {
1332				/* Copy the data out of the buffer we created */
1333				if (copy_to_user
1334				    (iocommand.buf, buff, iocommand.buf_size)) {
1335					kfree(buff);
1336					cmd_free(host, c, 0);
1337					return -EFAULT;
1338				}
1339			}
1340			kfree(buff);
1341			cmd_free(host, c, 0);
1342			return 0;
1343		}
1344	case CCISS_BIG_PASSTHRU:{
1345			BIG_IOCTL_Command_struct *ioc;
1346			CommandList_struct *c;
1347			unsigned char **buff = NULL;
1348			int *buff_size = NULL;
1349			u64bit temp64;
1350			unsigned long flags;
1351			BYTE sg_used = 0;
1352			int status = 0;
1353			int i;
1354			DECLARE_COMPLETION_ONSTACK(wait);
1355			__u32 left;
1356			__u32 sz;
1357			BYTE __user *data_ptr;
1358
1359			if (!arg)
1360				return -EINVAL;
1361			if (!capable(CAP_SYS_RAWIO))
1362				return -EPERM;
1363			ioc = (BIG_IOCTL_Command_struct *)
1364			    kmalloc(sizeof(*ioc), GFP_KERNEL);
1365			if (!ioc) {
1366				status = -ENOMEM;
1367				goto cleanup1;
1368			}
1369			if (copy_from_user(ioc, argp, sizeof(*ioc))) {
1370				status = -EFAULT;
1371				goto cleanup1;
1372			}
1373			if ((ioc->buf_size < 1) &&
1374			    (ioc->Request.Type.Direction != XFER_NONE)) {
1375				status = -EINVAL;
1376				goto cleanup1;
1377			}
1378			/* Check kmalloc limits  using all SGs */
1379			if (ioc->malloc_size > MAX_KMALLOC_SIZE) {
1380				status = -EINVAL;
1381				goto cleanup1;
1382			}
1383			if (ioc->buf_size > ioc->malloc_size * MAXSGENTRIES) {
1384				status = -EINVAL;
1385				goto cleanup1;
1386			}
1387			buff =
1388			    kzalloc(MAXSGENTRIES * sizeof(char *), GFP_KERNEL);
1389			if (!buff) {
1390				status = -ENOMEM;
1391				goto cleanup1;
1392			}
1393			buff_size = kmalloc(MAXSGENTRIES * sizeof(int),
1394						   GFP_KERNEL);
1395			if (!buff_size) {
1396				status = -ENOMEM;
1397				goto cleanup1;
1398			}
1399			left = ioc->buf_size;
1400			data_ptr = ioc->buf;
1401			while (left) {
1402				sz = (left >
1403				      ioc->malloc_size) ? ioc->
1404				    malloc_size : left;
1405				buff_size[sg_used] = sz;
1406				buff[sg_used] = kmalloc(sz, GFP_KERNEL);
1407				if (buff[sg_used] == NULL) {
1408					status = -ENOMEM;
1409					goto cleanup1;
1410				}
1411				if (ioc->Request.Type.Direction == XFER_WRITE) {
1412					if (copy_from_user
1413					    (buff[sg_used], data_ptr, sz)) {
1414						status = -EFAULT;
1415						goto cleanup1;
1416					}
1417				} else {
1418					memset(buff[sg_used], 0, sz);
1419				}
1420				left -= sz;
1421				data_ptr += sz;
1422				sg_used++;
1423			}
1424			if ((c = cmd_alloc(host, 0)) == NULL) {
1425				status = -ENOMEM;
1426				goto cleanup1;
1427			}
1428			c->cmd_type = CMD_IOCTL_PEND;
1429			c->Header.ReplyQueue = 0;
1430
1431			if (ioc->buf_size > 0) {
1432				c->Header.SGList = sg_used;
1433				c->Header.SGTotal = sg_used;
1434			} else {
1435				c->Header.SGList = 0;
1436				c->Header.SGTotal = 0;
1437			}
1438			c->Header.LUN = ioc->LUN_info;
1439			c->Header.Tag.lower = c->busaddr;
1440
1441			c->Request = ioc->Request;
1442			if (ioc->buf_size > 0) {
1443				int i;
1444				for (i = 0; i < sg_used; i++) {
1445					temp64.val =
1446					    pci_map_single(host->pdev, buff[i],
1447						    buff_size[i],
1448						    PCI_DMA_BIDIRECTIONAL);
1449					c->SG[i].Addr.lower =
1450					    temp64.val32.lower;
1451					c->SG[i].Addr.upper =
1452					    temp64.val32.upper;
1453					c->SG[i].Len = buff_size[i];
1454					c->SG[i].Ext = 0;	/* we are not chaining */
1455				}
1456			}
1457			c->waiting = &wait;
1458			/* Put the request on the tail of the request queue */
1459			spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
1460			addQ(&host->reqQ, c);
1461			host->Qdepth++;
1462			start_io(host);
1463			spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
1464			wait_for_completion(&wait);
1465			/* unlock the buffers from DMA */
1466			for (i = 0; i < sg_used; i++) {
1467				temp64.val32.lower = c->SG[i].Addr.lower;
1468				temp64.val32.upper = c->SG[i].Addr.upper;
1469				pci_unmap_single(host->pdev,
1470					(dma_addr_t) temp64.val, buff_size[i],
1471					PCI_DMA_BIDIRECTIONAL);
1472			}
1473			check_ioctl_unit_attention(host, c);
1474			/* Copy the error information out */
1475			ioc->error_info = *(c->err_info);
1476			if (copy_to_user(argp, ioc, sizeof(*ioc))) {
1477				cmd_free(host, c, 0);
1478				status = -EFAULT;
1479				goto cleanup1;
1480			}
1481			if (ioc->Request.Type.Direction == XFER_READ) {
1482				/* Copy the data out of the buffer we created */
1483				BYTE __user *ptr = ioc->buf;
1484				for (i = 0; i < sg_used; i++) {
1485					if (copy_to_user
1486					    (ptr, buff[i], buff_size[i])) {
1487						cmd_free(host, c, 0);
1488						status = -EFAULT;
1489						goto cleanup1;
1490					}
1491					ptr += buff_size[i];
1492				}
1493			}
1494			cmd_free(host, c, 0);
1495			status = 0;
1496		      cleanup1:
1497			if (buff) {
1498				for (i = 0; i < sg_used; i++)
1499					kfree(buff[i]);
1500				kfree(buff);
1501			}
1502			kfree(buff_size);
1503			kfree(ioc);
1504			return status;
1505		}
1506
1507	/* scsi_cmd_ioctl handles these, below, though some are not */
1508	/* very meaningful for cciss.  SG_IO is the main one people want. */
1509
1510	case SG_GET_VERSION_NUM:
1511	case SG_SET_TIMEOUT:
1512	case SG_GET_TIMEOUT:
1513	case SG_GET_RESERVED_SIZE:
1514	case SG_SET_RESERVED_SIZE:
1515	case SG_EMULATED_HOST:
1516	case SG_IO:
1517	case SCSI_IOCTL_SEND_COMMAND:
1518		return scsi_cmd_ioctl(disk->queue, disk, mode, cmd, argp);
1519
1520	/* scsi_cmd_ioctl would normally handle these, below, but */
1521	/* they aren't a good fit for cciss, as CD-ROMs are */
1522	/* not supported, and we don't have any bus/target/lun */
1523	/* which we present to the kernel. */
1524
1525	case CDROM_SEND_PACKET:
1526	case CDROMCLOSETRAY:
1527	case CDROMEJECT:
1528	case SCSI_IOCTL_GET_IDLUN:
1529	case SCSI_IOCTL_GET_BUS_NUMBER:
1530	default:
1531		return -ENOTTY;
1532	}
1533}
1534
1535static void cciss_check_queues(ctlr_info_t *h)
1536{
1537	int start_queue = h->next_to_run;
1538	int i;
1539
1540	/* check to see if we have maxed out the number of commands that can
1541	 * be placed on the queue.  If so then exit.  We do this check here
1542	 * in case the interrupt we serviced was from an ioctl and did not
1543	 * free any new commands.
1544	 */
1545	if ((find_first_zero_bit(h->cmd_pool_bits, h->nr_cmds)) == h->nr_cmds)
1546		return;
1547
1548	/* We have room on the queue for more commands.  Now we need to queue
1549	 * them up.  We will also keep track of the next queue to run so
1550	 * that every queue gets a chance to be started first.
1551	 */
1552	for (i = 0; i < h->highest_lun + 1; i++) {
1553		int curr_queue = (start_queue + i) % (h->highest_lun + 1);
1554		/* make sure the disk has been added and the drive is real
1555		 * because this can be called from the middle of init_one.
1556		 */
1557		if (!(h->drv[curr_queue].queue) || !(h->drv[curr_queue].heads))
1558			continue;
1559		blk_start_queue(h->gendisk[curr_queue]->queue);
1560
1561		/* check to see if we have maxed out the number of commands
1562		 * that can be placed on the queue.
1563		 */
1564		if ((find_first_zero_bit(h->cmd_pool_bits, h->nr_cmds)) == h->nr_cmds) {
1565			if (curr_queue == start_queue) {
1566				h->next_to_run =
1567				    (start_queue + 1) % (h->highest_lun + 1);
1568				break;
1569			} else {
1570				h->next_to_run = curr_queue;
1571				break;
1572			}
1573		}
1574	}
1575}
1576
1577static void cciss_softirq_done(struct request *rq)
1578{
1579	CommandList_struct *cmd = rq->completion_data;
1580	ctlr_info_t *h = hba[cmd->ctlr];
1581	unsigned long flags;
1582	u64bit temp64;
1583	int i, ddir;
1584
1585	if (cmd->Request.Type.Direction == XFER_READ)
1586		ddir = PCI_DMA_FROMDEVICE;
1587	else
1588		ddir = PCI_DMA_TODEVICE;
1589
1590	/* command did not need to be retried */
1591	/* unmap the DMA mapping for all the scatter gather elements */
1592	for (i = 0; i < cmd->Header.SGList; i++) {
1593		temp64.val32.lower = cmd->SG[i].Addr.lower;
1594		temp64.val32.upper = cmd->SG[i].Addr.upper;
1595		pci_unmap_page(h->pdev, temp64.val, cmd->SG[i].Len, ddir);
1596	}
1597
1598#ifdef CCISS_DEBUG
1599	printk("Done with %p\n", rq);
1600#endif				/* CCISS_DEBUG */
1601
1602	/* set the residual count for pc requests */
1603	if (blk_pc_request(rq))
1604		rq->resid_len = cmd->err_info->ResidualCnt;
1605
1606	blk_end_request_all(rq, (rq->errors == 0) ? 0 : -EIO);
1607
1608	spin_lock_irqsave(&h->lock, flags);
1609	cmd_free(h, cmd, 1);
1610	cciss_check_queues(h);
1611	spin_unlock_irqrestore(&h->lock, flags);
1612}
1613
1614static void log_unit_to_scsi3addr(ctlr_info_t *h, unsigned char scsi3addr[],
1615	uint32_t log_unit)
1616{
1617	log_unit = h->drv[log_unit].LunID & 0x03fff;
1618	memset(&scsi3addr[4], 0, 4);
1619	memcpy(&scsi3addr[0], &log_unit, 4);
1620	scsi3addr[3] |= 0x40;
1621}
1622
1623/* This function gets the SCSI vendor, model, and revision of a logical drive
1624 * via the inquiry page 0.  Model, vendor, and rev are set to empty strings if
1625 * they cannot be read.
1626 */
1627static void cciss_get_device_descr(int ctlr, int logvol, int withirq,
1628				   char *vendor, char *model, char *rev)
1629{
1630	int rc;
1631	InquiryData_struct *inq_buf;
1632	unsigned char scsi3addr[8];
1633
1634	*vendor = '\0';
1635	*model = '\0';
1636	*rev = '\0';
1637
1638	inq_buf = kzalloc(sizeof(InquiryData_struct), GFP_KERNEL);
1639	if (!inq_buf)
1640		return;
1641
1642	log_unit_to_scsi3addr(hba[ctlr], scsi3addr, logvol);
1643	if (withirq)
1644		rc = sendcmd_withirq(CISS_INQUIRY, ctlr, inq_buf,
1645			     sizeof(InquiryData_struct), 0,
1646				scsi3addr, TYPE_CMD);
1647	else
1648		rc = sendcmd(CISS_INQUIRY, ctlr, inq_buf,
1649			     sizeof(InquiryData_struct), 0,
1650				scsi3addr, TYPE_CMD);
1651	if (rc == IO_OK) {
1652		memcpy(vendor, &inq_buf->data_byte[8], VENDOR_LEN);
1653		vendor[VENDOR_LEN] = '\0';
1654		memcpy(model, &inq_buf->data_byte[16], MODEL_LEN);
1655		model[MODEL_LEN] = '\0';
1656		memcpy(rev, &inq_buf->data_byte[32], REV_LEN);
1657		rev[REV_LEN] = '\0';
1658	}
1659
1660	kfree(inq_buf);
1661	return;
1662}
1663
1664/* This function gets the serial number of a logical drive via
1665 * inquiry page 0x83.  Serial no. is 16 bytes.  If the serial
1666 * number cannot be had, for whatever reason, 16 bytes of 0xff
1667 * are returned instead.
1668 */
1669static void cciss_get_serial_no(int ctlr, int logvol, int withirq,
1670				unsigned char *serial_no, int buflen)
1671{
1672#define PAGE_83_INQ_BYTES 64
1673	int rc;
1674	unsigned char *buf;
1675	unsigned char scsi3addr[8];
1676
1677	if (buflen > 16)
1678		buflen = 16;
1679	memset(serial_no, 0xff, buflen);
1680	buf = kzalloc(PAGE_83_INQ_BYTES, GFP_KERNEL);
1681	if (!buf)
1682		return;
1683	memset(serial_no, 0, buflen);
1684	log_unit_to_scsi3addr(hba[ctlr], scsi3addr, logvol);
1685	if (withirq)
1686		rc = sendcmd_withirq(CISS_INQUIRY, ctlr, buf,
1687			PAGE_83_INQ_BYTES, 0x83, scsi3addr, TYPE_CMD);
1688	else
1689		rc = sendcmd(CISS_INQUIRY, ctlr, buf,
1690			PAGE_83_INQ_BYTES, 0x83, scsi3addr, TYPE_CMD);
1691	if (rc == IO_OK)
1692		memcpy(serial_no, &buf[8], buflen);
1693	kfree(buf);
1694	return;
1695}
1696
1697/*
1698 * cciss_add_disk sets up the block device queue for a logical drive
1699 */
1700static int cciss_add_disk(ctlr_info_t *h, struct gendisk *disk,
1701				int drv_index)
1702{
1703	disk->queue = blk_init_queue(do_cciss_request, &h->lock);
1704	if (!disk->queue)
1705		goto init_queue_failure;
1706	sprintf(disk->disk_name, "cciss/c%dd%d", h->ctlr, drv_index);
1707	disk->major = h->major;
1708	disk->first_minor = drv_index << NWD_SHIFT;
1709	disk->fops = &cciss_fops;
1710	if (h->drv[drv_index].dev == NULL) {
1711		if (cciss_create_ld_sysfs_entry(h, drv_index))
1712			goto cleanup_queue;
1713	}
1714	disk->private_data = &h->drv[drv_index];
1715	disk->driverfs_dev = h->drv[drv_index].dev;
1716
1717	/* Set up queue information */
1718	blk_queue_bounce_limit(disk->queue, h->pdev->dma_mask);
1719
1720	/* This is a hardware imposed limit. */
1721	blk_queue_max_hw_segments(disk->queue, MAXSGENTRIES);
1722
1723	/* This is a limit in the driver and could be eliminated. */
1724	blk_queue_max_phys_segments(disk->queue, MAXSGENTRIES);
1725
1726	blk_queue_max_sectors(disk->queue, h->cciss_max_sectors);
1727
1728	blk_queue_softirq_done(disk->queue, cciss_softirq_done);
1729
1730	disk->queue->queuedata = h;
1731
1732	blk_queue_logical_block_size(disk->queue,
1733				     h->drv[drv_index].block_size);
1734
1735	/* Make sure all queue data is written out before */
1736	/* setting h->drv[drv_index].queue, as setting this */
1737	/* allows the interrupt handler to start the queue */
1738	wmb();
1739	h->drv[drv_index].queue = disk->queue;
1740	add_disk(disk);
1741	return 0;
1742
1743cleanup_queue:
1744	blk_cleanup_queue(disk->queue);
1745	disk->queue = NULL;
1746init_queue_failure:
1747	return -1;
1748}
1749
1750/* This function will check the usage_count of the drive to be updated/added.
1751 * If the usage_count is zero and it is a heretofore unknown drive, or,
1752 * the drive's capacity, geometry, or serial number has changed,
1753 * then the drive information will be updated and the disk will be
1754 * re-registered with the kernel.  If these conditions don't hold,
1755 * then it will be left alone for the next reboot.  The exception to this
1756 * is disk 0 which will always be left registered with the kernel since it
1757 * is also the controller node.  Any changes to disk 0 will show up on
1758 * the next reboot.
1759 */
1760static void cciss_update_drive_info(int ctlr, int drv_index, int first_time,
1761	int via_ioctl)
1762{
1763	ctlr_info_t *h = hba[ctlr];
1764	struct gendisk *disk;
1765	InquiryData_struct *inq_buff = NULL;
1766	unsigned int block_size;
1767	sector_t total_size;
1768	unsigned long flags = 0;
1769	int ret = 0;
1770	drive_info_struct *drvinfo;
1771
1772	/* Get information about the disk and modify the driver structure */
1773	inq_buff = kmalloc(sizeof(InquiryData_struct), GFP_KERNEL);
1774	drvinfo = kmalloc(sizeof(*drvinfo), GFP_KERNEL);
1775	if (inq_buff == NULL || drvinfo == NULL)
1776		goto mem_msg;
1777
1778	/* testing to see if 16-byte CDBs are already being used */
1779	if (h->cciss_read == CCISS_READ_16) {
1780		cciss_read_capacity_16(h->ctlr, drv_index, 1,
1781			&total_size, &block_size);
1782
1783	} else {
1784		cciss_read_capacity(ctlr, drv_index, 1,
1785				    &total_size, &block_size);
1786
1787		/* if read_capacity returns all F's this volume is >2TB */
1788		/* in size so we switch to 16-byte CDB's for all */
1789		/* read/write ops */
1790		if (total_size == 0xFFFFFFFFULL) {
1791			cciss_read_capacity_16(ctlr, drv_index, 1,
1792			&total_size, &block_size);
1793			h->cciss_read = CCISS_READ_16;
1794			h->cciss_write = CCISS_WRITE_16;
1795		} else {
1796			h->cciss_read = CCISS_READ_10;
1797			h->cciss_write = CCISS_WRITE_10;
1798		}
1799	}
1800
1801	cciss_geometry_inquiry(ctlr, drv_index, 1, total_size, block_size,
1802			       inq_buff, drvinfo);
1803	drvinfo->block_size = block_size;
1804	drvinfo->nr_blocks = total_size + 1;
1805
1806	cciss_get_device_descr(ctlr, drv_index, 1, drvinfo->vendor,
1807				drvinfo->model, drvinfo->rev);
1808	cciss_get_serial_no(ctlr, drv_index, 1, drvinfo->serial_no,
1809			sizeof(drvinfo->serial_no));
1810
1811	/* Is it the same disk we already know, and nothing's changed? */
1812	if (h->drv[drv_index].raid_level != -1 &&
1813		((memcmp(drvinfo->serial_no,
1814				h->drv[drv_index].serial_no, 16) == 0) &&
1815		drvinfo->block_size == h->drv[drv_index].block_size &&
1816		drvinfo->nr_blocks == h->drv[drv_index].nr_blocks &&
1817		drvinfo->heads == h->drv[drv_index].heads &&
1818		drvinfo->sectors == h->drv[drv_index].sectors &&
1819		drvinfo->cylinders == h->drv[drv_index].cylinders))
1820			/* The disk is unchanged, nothing to update */
1821			goto freeret;
1822
1823	/* If we get here it's not the same disk, or something's changed,
1824	 * so we need to * deregister it, and re-register it, if it's not
1825	 * in use.
1826	 * If the disk already exists then deregister it before proceeding
1827	 * (unless it's the first disk (for the controller node).
1828	 */
1829	if (h->drv[drv_index].raid_level != -1 && drv_index != 0) {
1830		printk(KERN_WARNING "disk %d has changed.\n", drv_index);
1831		spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
1832		h->drv[drv_index].busy_configuring = 1;
1833		spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
1834
1835		/* deregister_disk sets h->drv[drv_index].queue = NULL
1836		 * which keeps the interrupt handler from starting
1837		 * the queue.
1838		 */
1839		ret = deregister_disk(h, drv_index, 0, via_ioctl);
1840		h->drv[drv_index].busy_configuring = 0;
1841	}
1842
1843	/* If the disk is in use return */
1844	if (ret)
1845		goto freeret;
1846
1847	/* Save the new information from cciss_geometry_inquiry
1848	 * and serial number inquiry.
1849	 */
1850	h->drv[drv_index].block_size = drvinfo->block_size;
1851	h->drv[drv_index].nr_blocks = drvinfo->nr_blocks;
1852	h->drv[drv_index].heads = drvinfo->heads;
1853	h->drv[drv_index].sectors = drvinfo->sectors;
1854	h->drv[drv_index].cylinders = drvinfo->cylinders;
1855	h->drv[drv_index].raid_level = drvinfo->raid_level;
1856	memcpy(h->drv[drv_index].serial_no, drvinfo->serial_no, 16);
1857	memcpy(h->drv[drv_index].vendor, drvinfo->vendor, VENDOR_LEN + 1);
1858	memcpy(h->drv[drv_index].model, drvinfo->model, MODEL_LEN + 1);
1859	memcpy(h->drv[drv_index].rev, drvinfo->rev, REV_LEN + 1);
1860
1861	++h->num_luns;
1862	disk = h->gendisk[drv_index];
1863	set_capacity(disk, h->drv[drv_index].nr_blocks);
1864
1865	/* If it's not disk 0 (drv_index != 0)
1866	 * or if it was disk 0, but there was previously
1867	 * no actual corresponding configured logical drive
1868	 * (raid_leve == -1) then we want to update the
1869	 * logical drive's information.
1870	 */
1871	if (drv_index || first_time) {
1872		if (cciss_add_disk(h, disk, drv_index) != 0) {
1873			cciss_free_gendisk(h, drv_index);
1874			printk(KERN_WARNING "cciss:%d could not update "
1875				"disk %d\n", h->ctlr, drv_index);
1876			--h->num_luns;
1877		}
1878	}
1879
1880freeret:
1881	kfree(inq_buff);
1882	kfree(drvinfo);
1883	return;
1884mem_msg:
1885	printk(KERN_ERR "cciss: out of memory\n");
1886	goto freeret;
1887}
1888
1889/* This function will find the first index of the controllers drive array
1890 * that has a -1 for the raid_level and will return that index.  This is
1891 * where new drives will be added.  If the index to be returned is greater
1892 * than the highest_lun index for the controller then highest_lun is set
1893 * to this new index.  If there are no available indexes then -1 is returned.
1894 * "controller_node" is used to know if this is a real logical drive, or just
1895 * the controller node, which determines if this counts towards highest_lun.
1896 */
1897static int cciss_find_free_drive_index(int ctlr, int controller_node)
1898{
1899	int i;
1900
1901	for (i = 0; i < CISS_MAX_LUN; i++) {
1902		if (hba[ctlr]->drv[i].raid_level == -1) {
1903			if (i > hba[ctlr]->highest_lun)
1904				if (!controller_node)
1905					hba[ctlr]->highest_lun = i;
1906			return i;
1907		}
1908	}
1909	return -1;
1910}
1911
1912static void cciss_free_gendisk(ctlr_info_t *h, int drv_index)
1913{
1914	put_disk(h->gendisk[drv_index]);
1915	h->gendisk[drv_index] = NULL;
1916}
1917
1918/* cciss_add_gendisk finds a free hba[]->drv structure
1919 * and allocates a gendisk if needed, and sets the lunid
1920 * in the drvinfo structure.   It returns the index into
1921 * the ->drv[] array, or -1 if none are free.
1922 * is_controller_node indicates whether highest_lun should
1923 * count this disk, or if it's only being added to provide
1924 * a means to talk to the controller in case no logical
1925 * drives have yet been configured.
1926 */
1927static int cciss_add_gendisk(ctlr_info_t *h, __u32 lunid, int controller_node)
1928{
1929	int drv_index;
1930
1931	drv_index = cciss_find_free_drive_index(h->ctlr, controller_node);
1932	if (drv_index == -1)
1933		return -1;
1934
1935	/*Check if the gendisk needs to be allocated */
1936	if (!h->gendisk[drv_index]) {
1937		h->gendisk[drv_index] =
1938			alloc_disk(1 << NWD_SHIFT);
1939		if (!h->gendisk[drv_index]) {
1940			printk(KERN_ERR "cciss%d: could not "
1941				"allocate a new disk %d\n",
1942				h->ctlr, drv_index);
1943			return -1;
1944		}
1945	}
1946	h->drv[drv_index].LunID = lunid;
1947	if (h->drv[drv_index].dev == NULL) {
1948		if (cciss_create_ld_sysfs_entry(h, drv_index))
1949			goto err_free_disk;
1950	}
1951	/* Don't need to mark this busy because nobody */
1952	/* else knows about this disk yet to contend */
1953	/* for access to it. */
1954	h->drv[drv_index].busy_configuring = 0;
1955	wmb();
1956	return drv_index;
1957
1958err_free_disk:
1959	cciss_free_gendisk(h, drv_index);
1960	return -1;
1961}
1962
1963/* This is for the special case of a controller which
1964 * has no logical drives.  In this case, we still need
1965 * to register a disk so the controller can be accessed
1966 * by the Array Config Utility.
1967 */
1968static void cciss_add_controller_node(ctlr_info_t *h)
1969{
1970	struct gendisk *disk;
1971	int drv_index;
1972
1973	if (h->gendisk[0] != NULL) /* already did this? Then bail. */
1974		return;
1975
1976	drv_index = cciss_add_gendisk(h, 0, 1);
1977	if (drv_index == -1)
1978		goto error;
1979	h->drv[drv_index].block_size = 512;
1980	h->drv[drv_index].nr_blocks = 0;
1981	h->drv[drv_index].heads = 0;
1982	h->drv[drv_index].sectors = 0;
1983	h->drv[drv_index].cylinders = 0;
1984	h->drv[drv_index].raid_level = -1;
1985	memset(h->drv[drv_index].serial_no, 0, 16);
1986	disk = h->gendisk[drv_index];
1987	if (cciss_add_disk(h, disk, drv_index) == 0)
1988		return;
1989	cciss_free_gendisk(h, drv_index);
1990error:
1991	printk(KERN_WARNING "cciss%d: could not "
1992		"add disk 0.\n", h->ctlr);
1993	return;
1994}
1995
1996/* This function will add and remove logical drives from the Logical
1997 * drive array of the controller and maintain persistency of ordering
1998 * so that mount points are preserved until the next reboot.  This allows
1999 * for the removal of logical drives in the middle of the drive array
2000 * without a re-ordering of those drives.
2001 * INPUT
2002 * h		= The controller to perform the operations on
2003 */
2004static int rebuild_lun_table(ctlr_info_t *h, int first_time,
2005	int via_ioctl)
2006{
2007	int ctlr = h->ctlr;
2008	int num_luns;
2009	ReportLunData_struct *ld_buff = NULL;
2010	int return_code;
2011	int listlength = 0;
2012	int i;
2013	int drv_found;
2014	int drv_index = 0;
2015	__u32 lunid = 0;
2016	unsigned long flags;
2017
2018	if (!capable(CAP_SYS_RAWIO))
2019		return -EPERM;
2020
2021	/* Set busy_configuring flag for this operation */
2022	spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
2023	if (h->busy_configuring) {
2024		spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
2025		return -EBUSY;
2026	}
2027	h->busy_configuring = 1;
2028	spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
2029
2030	ld_buff = kzalloc(sizeof(ReportLunData_struct), GFP_KERNEL);
2031	if (ld_buff == NULL)
2032		goto mem_msg;
2033
2034	return_code = sendcmd_withirq(CISS_REPORT_LOG, ctlr, ld_buff,
2035				      sizeof(ReportLunData_struct),
2036				      0, CTLR_LUNID, TYPE_CMD);
2037
2038	if (return_code == IO_OK)
2039		listlength = be32_to_cpu(*(__be32 *) ld_buff->LUNListLength);
2040	else {	/* reading number of logical volumes failed */
2041		printk(KERN_WARNING "cciss: report logical volume"
2042		       " command failed\n");
2043		listlength = 0;
2044		goto freeret;
2045	}
2046
2047	num_luns = listlength / 8;	/* 8 bytes per entry */
2048	if (num_luns > CISS_MAX_LUN) {
2049		num_luns = CISS_MAX_LUN;
2050		printk(KERN_WARNING "cciss: more luns configured"
2051		       " on controller than can be handled by"
2052		       " this driver.\n");
2053	}
2054
2055	if (num_luns == 0)
2056		cciss_add_controller_node(h);
2057
2058	/* Compare controller drive array to driver's drive array
2059	 * to see if any drives are missing on the controller due
2060	 * to action of Array Config Utility (user deletes drive)
2061	 * and deregister logical drives which have disappeared.
2062	 */
2063	for (i = 0; i <= h->highest_lun; i++) {
2064		int j;
2065		drv_found = 0;
2066
2067		/* skip holes in the array from already deleted drives */
2068		if (h->drv[i].raid_level == -1)
2069			continue;
2070
2071		for (j = 0; j < num_luns; j++) {
2072			memcpy(&lunid, &ld_buff->LUN[j][0], 4);
2073			lunid = le32_to_cpu(lunid);
2074			if (h->drv[i].LunID == lunid) {
2075				drv_found = 1;
2076				break;
2077			}
2078		}
2079		if (!drv_found) {
2080			/* Deregister it from the OS, it's gone. */
2081			spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
2082			h->drv[i].busy_configuring = 1;
2083			spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
2084			return_code = deregister_disk(h, i, 1, via_ioctl);
2085			h->drv[i].busy_configuring = 0;
2086		}
2087	}
2088
2089	/* Compare controller drive array to driver's drive array.
2090	 * Check for updates in the drive information and any new drives
2091	 * on the controller due to ACU adding logical drives, or changing
2092	 * a logical drive's size, etc.  Reregister any new/changed drives
2093	 */
2094	for (i = 0; i < num_luns; i++) {
2095		int j;
2096
2097		drv_found = 0;
2098
2099		memcpy(&lunid, &ld_buff->LUN[i][0], 4);
2100		lunid = le32_to_cpu(lunid);
2101
2102		/* Find if the LUN is already in the drive array
2103		 * of the driver.  If so then update its info
2104		 * if not in use.  If it does not exist then find
2105		 * the first free index and add it.
2106		 */
2107		for (j = 0; j <= h->highest_lun; j++) {
2108			if (h->drv[j].raid_level != -1 &&
2109				h->drv[j].LunID == lunid) {
2110				drv_index = j;
2111				drv_found = 1;
2112				break;
2113			}
2114		}
2115
2116		/* check if the drive was found already in the array */
2117		if (!drv_found) {
2118			drv_index = cciss_add_gendisk(h, lunid, 0);
2119			if (drv_index == -1)
2120				goto freeret;
2121		}
2122		cciss_update_drive_info(ctlr, drv_index, first_time,
2123			via_ioctl);
2124	}		/* end for */
2125
2126freeret:
2127	kfree(ld_buff);
2128	h->busy_configuring = 0;
2129	/* We return -1 here to tell the ACU that we have registered/updated
2130	 * all of the drives that we can and to keep it from calling us
2131	 * additional times.
2132	 */
2133	return -1;
2134mem_msg:
2135	printk(KERN_ERR "cciss: out of memory\n");
2136	h->busy_configuring = 0;
2137	goto freeret;
2138}
2139
2140static void cciss_clear_drive_info(drive_info_struct *drive_info)
2141{
2142	/* zero out the disk size info */
2143	drive_info->nr_blocks = 0;
2144	drive_info->block_size = 0;
2145	drive_info->heads = 0;
2146	drive_info->sectors = 0;
2147	drive_info->cylinders = 0;
2148	drive_info->raid_level = -1;
2149	memset(drive_info->serial_no, 0, sizeof(drive_info->serial_no));
2150	memset(drive_info->model, 0, sizeof(drive_info->model));
2151	memset(drive_info->rev, 0, sizeof(drive_info->rev));
2152	memset(drive_info->vendor, 0, sizeof(drive_info->vendor));
2153	/*
2154	 * don't clear the LUNID though, we need to remember which
2155	 * one this one is.
2156	 */
2157}
2158
2159/* This function will deregister the disk and it's queue from the
2160 * kernel.  It must be called with the controller lock held and the
2161 * drv structures busy_configuring flag set.  It's parameters are:
2162 *
2163 * disk = This is the disk to be deregistered
2164 * drv  = This is the drive_info_struct associated with the disk to be
2165 *        deregistered.  It contains information about the disk used
2166 *        by the driver.
2167 * clear_all = This flag determines whether or not the disk information
2168 *             is going to be completely cleared out and the highest_lun
2169 *             reset.  Sometimes we want to clear out information about
2170 *             the disk in preparation for re-adding it.  In this case
2171 *             the highest_lun should be left unchanged and the LunID
2172 *             should not be cleared.
2173 * via_ioctl
2174 *    This indicates whether we've reached this path via ioctl.
2175 *    This affects the maximum usage count allowed for c0d0 to be messed with.
2176 *    If this path is reached via ioctl(), then the max_usage_count will
2177 *    be 1, as the process calling ioctl() has got to have the device open.
2178 *    If we get here via sysfs, then the max usage count will be zero.
2179*/
2180static int deregister_disk(ctlr_info_t *h, int drv_index,
2181			   int clear_all, int via_ioctl)
2182{
2183	int i;
2184	struct gendisk *disk;
2185	drive_info_struct *drv;
2186
2187	if (!capable(CAP_SYS_RAWIO))
2188		return -EPERM;
2189
2190	drv = &h->drv[drv_index];
2191	disk = h->gendisk[drv_index];
2192
2193	/* make sure logical volume is NOT is use */
2194	if (clear_all || (h->gendisk[0] == disk)) {
2195		if (drv->usage_count > via_ioctl)
2196			return -EBUSY;
2197	} else if (drv->usage_count > 0)
2198		return -EBUSY;
2199
2200	/* invalidate the devices and deregister the disk.  If it is disk
2201	 * zero do not deregister it but just zero out it's values.  This
2202	 * allows us to delete disk zero but keep the controller registered.
2203	 */
2204	if (h->gendisk[0] != disk) {
2205		struct request_queue *q = disk->queue;
2206		if (disk->flags & GENHD_FL_UP) {
2207			cciss_destroy_ld_sysfs_entry(h, drv_index, 0);
2208			del_gendisk(disk);
2209		}
2210		if (q) {
2211			blk_cleanup_queue(q);
2212			/* Set drv->queue to NULL so that we do not try
2213			 * to call blk_start_queue on this queue in the
2214			 * interrupt handler
2215			 */
2216			drv->queue = NULL;
2217		}
2218		/* If clear_all is set then we are deleting the logical
2219		 * drive, not just refreshing its info.  For drives
2220		 * other than disk 0 we will call put_disk.  We do not
2221		 * do this for disk 0 as we need it to be able to
2222		 * configure the controller.
2223		 */
2224		if (clear_all){
2225			/* This isn't pretty, but we need to find the
2226			 * disk in our array and NULL our the pointer.
2227			 * This is so that we will call alloc_disk if
2228			 * this index is used again later.
2229			 */
2230			for (i=0; i < CISS_MAX_LUN; i++){
2231				if (h->gendisk[i] == disk) {
2232					h->gendisk[i] = NULL;
2233					break;
2234				}
2235			}
2236			put_disk(disk);
2237		}
2238	} else {
2239		set_capacity(disk, 0);
2240	}
2241
2242	--h->num_luns;
2243	cciss_clear_drive_info(drv);
2244
2245	if (clear_all) {
2246		/* check to see if it was the last disk */
2247		if (drv == h->drv + h->highest_lun) {
2248			/* if so, find the new hightest lun */
2249			int i, newhighest = -1;
2250			for (i = 0; i <= h->highest_lun; i++) {
2251				/* if the disk has size > 0, it is available */
2252				if (h->drv[i].heads)
2253					newhighest = i;
2254			}
2255			h->highest_lun = newhighest;
2256		}
2257
2258		drv->LunID = 0;
2259	}
2260	return 0;
2261}
2262
2263static int fill_cmd(CommandList_struct *c, __u8 cmd, int ctlr, void *buff,
2264		size_t size, __u8 page_code, unsigned char *scsi3addr,
2265		int cmd_type)
2266{
2267	ctlr_info_t *h = hba[ctlr];
2268	u64bit buff_dma_handle;
2269	int status = IO_OK;
2270
2271	c->cmd_type = CMD_IOCTL_PEND;
2272	c->Header.ReplyQueue = 0;
2273	if (buff != NULL) {
2274		c->Header.SGList = 1;
2275		c->Header.SGTotal = 1;
2276	} else {
2277		c->Header.SGList = 0;
2278		c->Header.SGTotal = 0;
2279	}
2280	c->Header.Tag.lower = c->busaddr;
2281	memcpy(c->Header.LUN.LunAddrBytes, scsi3addr, 8);
2282
2283	c->Request.Type.Type = cmd_type;
2284	if (cmd_type == TYPE_CMD) {
2285		switch (cmd) {
2286		case CISS_INQUIRY:
2287			/* are we trying to read a vital product page */
2288			if (page_code != 0) {
2289				c->Request.CDB[1] = 0x01;
2290				c->Request.CDB[2] = page_code;
2291			}
2292			c->Request.CDBLen = 6;
2293			c->Request.Type.Attribute = ATTR_SIMPLE;
2294			c->Request.Type.Direction = XFER_READ;
2295			c->Request.Timeout = 0;
2296			c->Request.CDB[0] = CISS_INQUIRY;
2297			c->Request.CDB[4] = size & 0xFF;
2298			break;
2299		case CISS_REPORT_LOG:
2300		case CISS_REPORT_PHYS:
2301			/* Talking to controller so It's a physical command
2302			   mode = 00 target = 0.  Nothing to write.
2303			 */
2304			c->Request.CDBLen = 12;
2305			c->Request.Type.Attribute = ATTR_SIMPLE;
2306			c->Request.Type.Direction = XFER_READ;
2307			c->Request.Timeout = 0;
2308			c->Request.CDB[0] = cmd;
2309			c->Request.CDB[6] = (size >> 24) & 0xFF;	//MSB
2310			c->Request.CDB[7] = (size >> 16) & 0xFF;
2311			c->Request.CDB[8] = (size >> 8) & 0xFF;
2312			c->Request.CDB[9] = size & 0xFF;
2313			break;
2314
2315		case CCISS_READ_CAPACITY:
2316			c->Request.CDBLen = 10;
2317			c->Request.Type.Attribute = ATTR_SIMPLE;
2318			c->Request.Type.Direction = XFER_READ;
2319			c->Request.Timeout = 0;
2320			c->Request.CDB[0] = cmd;
2321			break;
2322		case CCISS_READ_CAPACITY_16:
2323			c->Request.CDBLen = 16;
2324			c->Request.Type.Attribute = ATTR_SIMPLE;
2325			c->Request.Type.Direction = XFER_READ;
2326			c->Request.Timeout = 0;
2327			c->Request.CDB[0] = cmd;
2328			c->Request.CDB[1] = 0x10;
2329			c->Request.CDB[10] = (size >> 24) & 0xFF;
2330			c->Request.CDB[11] = (size >> 16) & 0xFF;
2331			c->Request.CDB[12] = (size >> 8) & 0xFF;
2332			c->Request.CDB[13] = size & 0xFF;
2333			c->Request.Timeout = 0;
2334			c->Request.CDB[0] = cmd;
2335			break;
2336		case CCISS_CACHE_FLUSH:
2337			c->Request.CDBLen = 12;
2338			c->Request.Type.Attribute = ATTR_SIMPLE;
2339			c->Request.Type.Direction = XFER_WRITE;
2340			c->Request.Timeout = 0;
2341			c->Request.CDB[0] = BMIC_WRITE;
2342			c->Request.CDB[6] = BMIC_CACHE_FLUSH;
2343			break;
2344		case TEST_UNIT_READY:
2345			c->Request.CDBLen = 6;
2346			c->Request.Type.Attribute = ATTR_SIMPLE;
2347			c->Request.Type.Direction = XFER_NONE;
2348			c->Request.Timeout = 0;
2349			break;
2350		default:
2351			printk(KERN_WARNING
2352			       "cciss%d:  Unknown Command 0x%c\n", ctlr, cmd);
2353			return IO_ERROR;
2354		}
2355	} else if (cmd_type == TYPE_MSG) {
2356		switch (cmd) {
2357		case 0:	/* ABORT message */
2358			c->Request.CDBLen = 12;
2359			c->Request.Type.Attribute = ATTR_SIMPLE;
2360			c->Request.Type.Direction = XFER_WRITE;
2361			c->Request.Timeout = 0;
2362			c->Request.CDB[0] = cmd;	/* abort */
2363			c->Request.CDB[1] = 0;	/* abort a command */
2364			/* buff contains the tag of the command to abort */
2365			memcpy(&c->Request.CDB[4], buff, 8);
2366			break;
2367		case 1:	/* RESET message */
2368			c->Request.CDBLen = 16;
2369			c->Request.Type.Attribute = ATTR_SIMPLE;
2370			c->Request.Type.Direction = XFER_NONE;
2371			c->Request.Timeout = 0;
2372			memset(&c->Request.CDB[0], 0, sizeof(c->Request.CDB));
2373			c->Request.CDB[0] = cmd;	/* reset */
2374			c->Request.CDB[1] = 0x03;	/* reset a target */
2375			break;
2376		case 3:	/* No-Op message */
2377			c->Request.CDBLen = 1;
2378			c->Request.Type.Attribute = ATTR_SIMPLE;
2379			c->Request.Type.Direction = XFER_WRITE;
2380			c->Request.Timeout = 0;
2381			c->Request.CDB[0] = cmd;
2382			break;
2383		default:
2384			printk(KERN_WARNING
2385			       "cciss%d: unknown message type %d\n", ctlr, cmd);
2386			return IO_ERROR;
2387		}
2388	} else {
2389		printk(KERN_WARNING
2390		       "cciss%d: unknown command type %d\n", ctlr, cmd_type);
2391		return IO_ERROR;
2392	}
2393	/* Fill in the scatter gather information */
2394	if (size > 0) {
2395		buff_dma_handle.val = (__u64) pci_map_single(h->pdev,
2396							     buff, size,
2397							     PCI_DMA_BIDIRECTIONAL);
2398		c->SG[0].Addr.lower = buff_dma_handle.val32.lower;
2399		c->SG[0].Addr.upper = buff_dma_handle.val32.upper;
2400		c->SG[0].Len = size;
2401		c->SG[0].Ext = 0;	/* we are not chaining */
2402	}
2403	return status;
2404}
2405
2406static int check_target_status(ctlr_info_t *h, CommandList_struct *c)
2407{
2408	switch (c->err_info->ScsiStatus) {
2409	case SAM_STAT_GOOD:
2410		return IO_OK;
2411	case SAM_STAT_CHECK_CONDITION:
2412		switch (0xf & c->err_info->SenseInfo[2]) {
2413		case 0: return IO_OK; /* no sense */
2414		case 1: return IO_OK; /* recovered error */
2415		default:
2416			printk(KERN_WARNING "cciss%d: cmd 0x%02x "
2417				"check condition, sense key = 0x%02x\n",
2418				h->ctlr, c->Request.CDB[0],
2419				c->err_info->SenseInfo[2]);
2420		}
2421		break;
2422	default:
2423		printk(KERN_WARNING "cciss%d: cmd 0x%02x"
2424			"scsi status = 0x%02x\n", h->ctlr,
2425			c->Request.CDB[0], c->err_info->ScsiStatus);
2426		break;
2427	}
2428	return IO_ERROR;
2429}
2430
2431static int process_sendcmd_error(ctlr_info_t *h, CommandList_struct *c)
2432{
2433	int return_status = IO_OK;
2434
2435	if (c->err_info->CommandStatus == CMD_SUCCESS)
2436		return IO_OK;
2437
2438	switch (c->err_info->CommandStatus) {
2439	case CMD_TARGET_STATUS:
2440		return_status = check_target_status(h, c);
2441		break;
2442	case CMD_DATA_UNDERRUN:
2443	case CMD_DATA_OVERRUN:
2444		/* expected for inquiry and report lun commands */
2445		break;
2446	case CMD_INVALID:
2447		printk(KERN_WARNING "cciss: cmd 0x%02x is "
2448		       "reported invalid\n", c->Request.CDB[0]);
2449		return_status = IO_ERROR;
2450		break;
2451	case CMD_PROTOCOL_ERR:
2452		printk(KERN_WARNING "cciss: cmd 0x%02x has "
2453		       "protocol error \n", c->Request.CDB[0]);
2454		return_status = IO_ERROR;
2455		break;
2456	case CMD_HARDWARE_ERR:
2457		printk(KERN_WARNING "cciss: cmd 0x%02x had "
2458		       " hardware error\n", c->Request.CDB[0]);
2459		return_status = IO_ERROR;
2460		break;
2461	case CMD_CONNECTION_LOST:
2462		printk(KERN_WARNING "cciss: cmd 0x%02x had "
2463		       "connection lost\n", c->Request.CDB[0]);
2464		return_status = IO_ERROR;
2465		break;
2466	case CMD_ABORTED:
2467		printk(KERN_WARNING "cciss: cmd 0x%02x was "
2468		       "aborted\n", c->Request.CDB[0]);
2469		return_status = IO_ERROR;
2470		break;
2471	case CMD_ABORT_FAILED:
2472		printk(KERN_WARNING "cciss: cmd 0x%02x reports "
2473		       "abort failed\n", c->Request.CDB[0]);
2474		return_status = IO_ERROR;
2475		break;
2476	case CMD_UNSOLICITED_ABORT:
2477		printk(KERN_WARNING
2478		       "cciss%d: unsolicited abort 0x%02x\n", h->ctlr,
2479			c->Request.CDB[0]);
2480		return_status = IO_NEEDS_RETRY;
2481		break;
2482	default:
2483		printk(KERN_WARNING "cciss: cmd 0x%02x returned "
2484		       "unknown status %x\n", c->Request.CDB[0],
2485		       c->err_info->CommandStatus);
2486		return_status = IO_ERROR;
2487	}
2488	return return_status;
2489}
2490
2491static int sendcmd_withirq_core(ctlr_info_t *h, CommandList_struct *c,
2492	int attempt_retry)
2493{
2494	DECLARE_COMPLETION_ONSTACK(wait);
2495	u64bit buff_dma_handle;
2496	unsigned long flags;
2497	int return_status = IO_OK;
2498
2499resend_cmd2:
2500	c->waiting = &wait;
2501	/* Put the request on the tail of the queue and send it */
2502	spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
2503	addQ(&h->reqQ, c);
2504	h->Qdepth++;
2505	start_io(h);
2506	spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
2507
2508	wait_for_completion(&wait);
2509
2510	if (c->err_info->CommandStatus == 0 || !attempt_retry)
2511		goto command_done;
2512
2513	return_status = process_sendcmd_error(h, c);
2514
2515	if (return_status == IO_NEEDS_RETRY &&
2516		c->retry_count < MAX_CMD_RETRIES) {
2517		printk(KERN_WARNING "cciss%d: retrying 0x%02x\n", h->ctlr,
2518			c->Request.CDB[0]);
2519		c->retry_count++;
2520		/* erase the old error information */
2521		memset(c->err_info, 0, sizeof(ErrorInfo_struct));
2522		return_status = IO_OK;
2523		INIT_COMPLETION(wait);
2524		goto resend_cmd2;
2525	}
2526
2527command_done:
2528	/* unlock the buffers from DMA */
2529	buff_dma_handle.val32.lower = c->SG[0].Addr.lower;
2530	buff_dma_handle.val32.upper = c->SG[0].Addr.upper;
2531	pci_unmap_single(h->pdev, (dma_addr_t) buff_dma_handle.val,
2532			 c->SG[0].Len, PCI_DMA_BIDIRECTIONAL);
2533	return return_status;
2534}
2535
2536static int sendcmd_withirq(__u8 cmd, int ctlr, void *buff, size_t size,
2537			   __u8 page_code, unsigned char scsi3addr[],
2538			int cmd_type)
2539{
2540	ctlr_info_t *h = hba[ctlr];
2541	CommandList_struct *c;
2542	int return_status;
2543
2544	c = cmd_alloc(h, 0);
2545	if (!c)
2546		return -ENOMEM;
2547	return_status = fill_cmd(c, cmd, ctlr, buff, size, page_code,
2548		scsi3addr, cmd_type);
2549	if (return_status == IO_OK)
2550		return_status = sendcmd_withirq_core(h, c, 1);
2551
2552	cmd_free(h, c, 0);
2553	return return_status;
2554}
2555
2556static void cciss_geometry_inquiry(int ctlr, int logvol,
2557				   int withirq, sector_t total_size,
2558				   unsigned int block_size,
2559				   InquiryData_struct *inq_buff,
2560				   drive_info_struct *drv)
2561{
2562	int return_code;
2563	unsigned long t;
2564	unsigned char scsi3addr[8];
2565
2566	memset(inq_buff, 0, sizeof(InquiryData_struct));
2567	log_unit_to_scsi3addr(hba[ctlr], scsi3addr, logvol);
2568	if (withirq)
2569		return_code = sendcmd_withirq(CISS_INQUIRY, ctlr,
2570					      inq_buff, sizeof(*inq_buff),
2571					      0xC1, scsi3addr, TYPE_CMD);
2572	else
2573		return_code = sendcmd(CISS_INQUIRY, ctlr, inq_buff,
2574				      sizeof(*inq_buff), 0xC1, scsi3addr,
2575				      TYPE_CMD);
2576	if (return_code == IO_OK) {
2577		if (inq_buff->data_byte[8] == 0xFF) {
2578			printk(KERN_WARNING
2579			       "cciss: reading geometry failed, volume "
2580			       "does not support reading geometry\n");
2581			drv->heads = 255;
2582			drv->sectors = 32;	// Sectors per track
2583			drv->cylinders = total_size + 1;
2584			drv->raid_level = RAID_UNKNOWN;
2585		} else {
2586			drv->heads = inq_buff->data_byte[6];
2587			drv->sectors = inq_buff->data_byte[7];
2588			drv->cylinders = (inq_buff->data_byte[4] & 0xff) << 8;
2589			drv->cylinders += inq_buff->data_byte[5];
2590			drv->raid_level = inq_buff->data_byte[8];
2591		}
2592		drv->block_size = block_size;
2593		drv->nr_blocks = total_size + 1;
2594		t = drv->heads * drv->sectors;
2595		if (t > 1) {
2596			sector_t real_size = total_size + 1;
2597			unsigned long rem = sector_div(real_size, t);
2598			if (rem)
2599				real_size++;
2600			drv->cylinders = real_size;
2601		}
2602	} else {		/* Get geometry failed */
2603		printk(KERN_WARNING "cciss: reading geometry failed\n");
2604	}
2605}
2606
2607static void
2608cciss_read_capacity(int ctlr, int logvol, int withirq, sector_t *total_size,
2609		    unsigned int *block_size)
2610{
2611	ReadCapdata_struct *buf;
2612	int return_code;
2613	unsigned char scsi3addr[8];
2614
2615	buf = kzalloc(sizeof(ReadCapdata_struct), GFP_KERNEL);
2616	if (!buf) {
2617		printk(KERN_WARNING "cciss: out of memory\n");
2618		return;
2619	}
2620
2621	log_unit_to_scsi3addr(hba[ctlr], scsi3addr, logvol);
2622	if (withirq)
2623		return_code = sendcmd_withirq(CCISS_READ_CAPACITY,
2624				ctlr, buf, sizeof(ReadCapdata_struct),
2625					0, scsi3addr, TYPE_CMD);
2626	else
2627		return_code = sendcmd(CCISS_READ_CAPACITY,
2628				ctlr, buf, sizeof(ReadCapdata_struct),
2629					0, scsi3addr, TYPE_CMD);
2630	if (return_code == IO_OK) {
2631		*total_size = be32_to_cpu(*(__be32 *) buf->total_size);
2632		*block_size = be32_to_cpu(*(__be32 *) buf->block_size);
2633	} else {		/* read capacity command failed */
2634		printk(KERN_WARNING "cciss: read capacity failed\n");
2635		*total_size = 0;
2636		*block_size = BLOCK_SIZE;
2637	}
2638	kfree(buf);
2639}
2640
2641static void
2642cciss_read_capacity_16(int ctlr, int logvol, int withirq, sector_t *total_size, 				unsigned int *block_size)
2643{
2644	ReadCapdata_struct_16 *buf;
2645	int return_code;
2646	unsigned char scsi3addr[8];
2647
2648	buf = kzalloc(sizeof(ReadCapdata_struct_16), GFP_KERNEL);
2649	if (!buf) {
2650		printk(KERN_WARNING "cciss: out of memory\n");
2651		return;
2652	}
2653
2654	log_unit_to_scsi3addr(hba[ctlr], scsi3addr, logvol);
2655	if (withirq) {
2656		return_code = sendcmd_withirq(CCISS_READ_CAPACITY_16,
2657			ctlr, buf, sizeof(ReadCapdata_struct_16),
2658				0, scsi3addr, TYPE_CMD);
2659	}
2660	else {
2661		return_code = sendcmd(CCISS_READ_CAPACITY_16,
2662			ctlr, buf, sizeof(ReadCapdata_struct_16),
2663				0, scsi3addr, TYPE_CMD);
2664	}
2665	if (return_code == IO_OK) {
2666		*total_size = be64_to_cpu(*(__be64 *) buf->total_size);
2667		*block_size = be32_to_cpu(*(__be32 *) buf->block_size);
2668	} else {		/* read capacity command failed */
2669		printk(KERN_WARNING "cciss: read capacity failed\n");
2670		*total_size = 0;
2671		*block_size = BLOCK_SIZE;
2672	}
2673	printk(KERN_INFO "      blocks= %llu block_size= %d\n",
2674	       (unsigned long long)*total_size+1, *block_size);
2675	kfree(buf);
2676}
2677
2678static int cciss_revalidate(struct gendisk *disk)
2679{
2680	ctlr_info_t *h = get_host(disk);
2681	drive_info_struct *drv = get_drv(disk);
2682	int logvol;
2683	int FOUND = 0;
2684	unsigned int block_size;
2685	sector_t total_size;
2686	InquiryData_struct *inq_buff = NULL;
2687
2688	for (logvol = 0; logvol < CISS_MAX_LUN; logvol++) {
2689		if (h->drv[logvol].LunID == drv->LunID) {
2690			FOUND = 1;
2691			break;
2692		}
2693	}
2694
2695	if (!FOUND)
2696		return 1;
2697
2698	inq_buff = kmalloc(sizeof(InquiryData_struct), GFP_KERNEL);
2699	if (inq_buff == NULL) {
2700		printk(KERN_WARNING "cciss: out of memory\n");
2701		return 1;
2702	}
2703	if (h->cciss_read == CCISS_READ_10) {
2704		cciss_read_capacity(h->ctlr, logvol, 1,
2705					&total_size, &block_size);
2706	} else {
2707		cciss_read_capacity_16(h->ctlr, logvol, 1,
2708					&total_size, &block_size);
2709	}
2710	cciss_geometry_inquiry(h->ctlr, logvol, 1, total_size, block_size,
2711			       inq_buff, drv);
2712
2713	blk_queue_logical_block_size(drv->queue, drv->block_size);
2714	set_capacity(disk, drv->nr_blocks);
2715
2716	kfree(inq_buff);
2717	return 0;
2718}
2719
2720/*
2721 *   Wait polling for a command to complete.
2722 *   The memory mapped FIFO is polled for the completion.
2723 *   Used only at init time, interrupts from the HBA are disabled.
2724 */
2725static unsigned long pollcomplete(int ctlr)
2726{
2727	unsigned long done;
2728	int i;
2729
2730	/* Wait (up to 20 seconds) for a command to complete */
2731
2732	for (i = 20 * HZ; i > 0; i--) {
2733		done = hba[ctlr]->access.command_completed(hba[ctlr]);
2734		if (done == FIFO_EMPTY)
2735			schedule_timeout_uninterruptible(1);
2736		else
2737			return done;
2738	}
2739	/* Invalid address to tell caller we ran out of time */
2740	return 1;
2741}
2742
2743/* Send command c to controller h and poll for it to complete.
2744 * Turns interrupts off on the board.  Used at driver init time
2745 * and during SCSI error recovery.
2746 */
2747static int sendcmd_core(ctlr_info_t *h, CommandList_struct *c)
2748{
2749	int i;
2750	unsigned long complete;
2751	int status = IO_ERROR;
2752	u64bit buff_dma_handle;
2753
2754resend_cmd1:
2755
2756	/* Disable interrupt on the board. */
2757	h->access.set_intr_mask(h, CCISS_INTR_OFF);
2758
2759	/* Make sure there is room in the command FIFO */
2760	/* Actually it should be completely empty at this time */
2761	/* unless we are in here doing error handling for the scsi */
2762	/* tape side of the driver. */
2763	for (i = 200000; i > 0; i--) {
2764		/* if fifo isn't full go */
2765		if (!(h->access.fifo_full(h)))
2766			break;
2767		udelay(10);
2768		printk(KERN_WARNING "cciss cciss%d: SendCmd FIFO full,"
2769		       " waiting!\n", h->ctlr);
2770	}
2771	h->access.submit_command(h, c); /* Send the cmd */
2772	do {
2773		complete = pollcomplete(h->ctlr);
2774
2775#ifdef CCISS_DEBUG
2776		printk(KERN_DEBUG "cciss: command completed\n");
2777#endif				/* CCISS_DEBUG */
2778
2779		if (complete == 1) {
2780			printk(KERN_WARNING
2781			       "cciss cciss%d: SendCmd Timeout out, "
2782			       "No command list address returned!\n", h->ctlr);
2783			status = IO_ERROR;
2784			break;
2785		}
2786
2787		/* Make sure it's the command we're expecting. */
2788		if ((complete & ~CISS_ERROR_BIT) != c->busaddr) {
2789			printk(KERN_WARNING "cciss%d: Unexpected command "
2790				"completion.\n", h->ctlr);
2791			continue;
2792		}
2793
2794		/* It is our command.  If no error, we're done. */
2795		if (!(complete & CISS_ERROR_BIT)) {
2796			status = IO_OK;
2797			break;
2798		}
2799
2800		/* There is an error... */
2801
2802		/* if data overrun or underun on Report command ignore it */
2803		if (((c->Request.CDB[0] == CISS_REPORT_LOG) ||
2804		     (c->Request.CDB[0] == CISS_REPORT_PHYS) ||
2805		     (c->Request.CDB[0] == CISS_INQUIRY)) &&
2806			((c->err_info->CommandStatus == CMD_DATA_OVERRUN) ||
2807			 (c->err_info->CommandStatus == CMD_DATA_UNDERRUN))) {
2808			complete = c->busaddr;
2809			status = IO_OK;
2810			break;
2811		}
2812
2813		if (c->err_info->CommandStatus == CMD_UNSOLICITED_ABORT) {
2814			printk(KERN_WARNING "cciss%d: unsolicited abort %p\n",
2815				h->ctlr, c);
2816			if (c->retry_count < MAX_CMD_RETRIES) {
2817				printk(KERN_WARNING "cciss%d: retrying %p\n",
2818				   h->ctlr, c);
2819				c->retry_count++;
2820				/* erase the old error information */
2821				memset(c->err_info, 0, sizeof(c->err_info));
2822				goto resend_cmd1;
2823			}
2824			printk(KERN_WARNING "cciss%d: retried %p too many "
2825				"times\n", h->ctlr, c);
2826			status = IO_ERROR;
2827			break;
2828		}
2829
2830		if (c->err_info->CommandStatus == CMD_UNABORTABLE) {
2831			printk(KERN_WARNING "cciss%d: command could not be "
2832				"aborted.\n", h->ctlr);
2833			status = IO_ERROR;
2834			break;
2835		}
2836
2837		if (c->err_info->CommandStatus == CMD_TARGET_STATUS) {
2838			status = check_target_status(h, c);
2839			break;
2840		}
2841
2842		printk(KERN_WARNING "cciss%d: sendcmd error\n", h->ctlr);
2843		printk(KERN_WARNING "cmd = 0x%02x, CommandStatus = 0x%02x\n",
2844			c->Request.CDB[0], c->err_info->CommandStatus);
2845		status = IO_ERROR;
2846		break;
2847
2848	} while (1);
2849
2850	/* unlock the data buffer from DMA */
2851	buff_dma_handle.val32.lower = c->SG[0].Addr.lower;
2852	buff_dma_handle.val32.upper = c->SG[0].Addr.upper;
2853	pci_unmap_single(h->pdev, (dma_addr_t) buff_dma_handle.val,
2854			 c->SG[0].Len, PCI_DMA_BIDIRECTIONAL);
2855	return status;
2856}
2857
2858/*
2859 * Send a command to the controller, and wait for it to complete.
2860 * Used at init time, and during SCSI error recovery.
2861 */
2862static int sendcmd(__u8 cmd, int ctlr, void *buff, size_t size,
2863	__u8 page_code, unsigned char *scsi3addr, int cmd_type)
2864{
2865	CommandList_struct *c;
2866	int status;
2867
2868	c = cmd_alloc(hba[ctlr], 1);
2869	if (!c) {
2870		printk(KERN_WARNING "cciss: unable to get memory");
2871		return IO_ERROR;
2872	}
2873	status = fill_cmd(c, cmd, ctlr, buff, size, page_code,
2874		scsi3addr, cmd_type);
2875	if (status == IO_OK)
2876		status = sendcmd_core(hba[ctlr], c);
2877	cmd_free(hba[ctlr], c, 1);
2878	return status;
2879}
2880
2881/*
2882 * Map (physical) PCI mem into (virtual) kernel space
2883 */
2884static void __iomem *remap_pci_mem(ulong base, ulong size)
2885{
2886	ulong page_base = ((ulong) base) & PAGE_MASK;
2887	ulong page_offs = ((ulong) base) - page_base;
2888	void __iomem *page_remapped = ioremap(page_base, page_offs + size);
2889
2890	return page_remapped ? (page_remapped + page_offs) : NULL;
2891}
2892
2893/*
2894 * Takes jobs of the Q and sends them to the hardware, then puts it on
2895 * the Q to wait for completion.
2896 */
2897static void start_io(ctlr_info_t *h)
2898{
2899	CommandList_struct *c;
2900
2901	while (!hlist_empty(&h->reqQ)) {
2902		c = hlist_entry(h->reqQ.first, CommandList_struct, list);
2903		/* can't do anything if fifo is full */
2904		if ((h->access.fifo_full(h))) {
2905			printk(KERN_WARNING "cciss: fifo full\n");
2906			break;
2907		}
2908
2909		/* Get the first entry from the Request Q */
2910		removeQ(c);
2911		h->Qdepth--;
2912
2913		/* Tell the controller execute command */
2914		h->access.submit_command(h, c);
2915
2916		/* Put job onto the completed Q */
2917		addQ(&h->cmpQ, c);
2918	}
2919}
2920
2921/* Assumes that CCISS_LOCK(h->ctlr) is held. */
2922/* Zeros out the error record and then resends the command back */
2923/* to the controller */
2924static inline void resend_cciss_cmd(ctlr_info_t *h, CommandList_struct *c)
2925{
2926	/* erase the old error information */
2927	memset(c->err_info, 0, sizeof(ErrorInfo_struct));
2928
2929	/* add it to software queue and then send it to the controller */
2930	addQ(&h->reqQ, c);
2931	h->Qdepth++;
2932	if (h->Qdepth > h->maxQsinceinit)
2933		h->maxQsinceinit = h->Qdepth;
2934
2935	start_io(h);
2936}
2937
2938static inline unsigned int make_status_bytes(unsigned int scsi_status_byte,
2939	unsigned int msg_byte, unsigned int host_byte,
2940	unsigned int driver_byte)
2941{
2942	/* inverse of macros in scsi.h */
2943	return (scsi_status_byte & 0xff) |
2944		((msg_byte & 0xff) << 8) |
2945		((host_byte & 0xff) << 16) |
2946		((driver_byte & 0xff) << 24);
2947}
2948
2949static inline int evaluate_target_status(ctlr_info_t *h,
2950			CommandList_struct *cmd, int *retry_cmd)
2951{
2952	unsigned char sense_key;
2953	unsigned char status_byte, msg_byte, host_byte, driver_byte;
2954	int error_value;
2955
2956	*retry_cmd = 0;
2957	/* If we get in here, it means we got "target status", that is, scsi status */
2958	status_byte = cmd->err_info->ScsiStatus;
2959	driver_byte = DRIVER_OK;
2960	msg_byte = cmd->err_info->CommandStatus; /* correct?  seems too device specific */
2961
2962	if (blk_pc_request(cmd->rq))
2963		host_byte = DID_PASSTHROUGH;
2964	else
2965		host_byte = DID_OK;
2966
2967	error_value = make_status_bytes(status_byte, msg_byte,
2968		host_byte, driver_byte);
2969
2970	if (cmd->err_info->ScsiStatus != SAM_STAT_CHECK_CONDITION) {
2971		if (!blk_pc_request(cmd->rq))
2972			printk(KERN_WARNING "cciss: cmd %p "
2973			       "has SCSI Status 0x%x\n",
2974			       cmd, cmd->err_info->ScsiStatus);
2975		return error_value;
2976	}
2977
2978	/* check the sense key */
2979	sense_key = 0xf & cmd->err_info->SenseInfo[2];
2980	/* no status or recovered error */
2981	if (((sense_key == 0x0) || (sense_key == 0x1)) && !blk_pc_request(cmd->rq))
2982		error_value = 0;
2983
2984	if (check_for_unit_attention(h, cmd)) {
2985		*retry_cmd = !blk_pc_request(cmd->rq);
2986		return 0;
2987	}
2988
2989	if (!blk_pc_request(cmd->rq)) { /* Not SG_IO or similar? */
2990		if (error_value != 0)
2991			printk(KERN_WARNING "cciss: cmd %p has CHECK CONDITION"
2992			       " sense key = 0x%x\n", cmd, sense_key);
2993		return error_value;
2994	}
2995
2996	/* SG_IO or similar, copy sense data back */
2997	if (cmd->rq->sense) {
2998		if (cmd->rq->sense_len > cmd->err_info->SenseLen)
2999			cmd->rq->sense_len = cmd->err_info->SenseLen;
3000		memcpy(cmd->rq->sense, cmd->err_info->SenseInfo,
3001			cmd->rq->sense_len);
3002	} else
3003		cmd->rq->sense_len = 0;
3004
3005	return error_value;
3006}
3007
3008/* checks the status of the job and calls complete buffers to mark all
3009 * buffers for the completed job. Note that this function does not need
3010 * to hold the hba/queue lock.
3011 */
3012static inline void complete_command(ctlr_info_t *h, CommandList_struct *cmd,
3013				    int timeout)
3014{
3015	int retry_cmd = 0;
3016	struct request *rq = cmd->rq;
3017
3018	rq->errors = 0;
3019
3020	if (timeout)
3021		rq->errors = make_status_bytes(0, 0, 0, DRIVER_TIMEOUT);
3022
3023	if (cmd->err_info->CommandStatus == 0)	/* no error has occurred */
3024		goto after_error_processing;
3025
3026	switch (cmd->err_info->CommandStatus) {
3027	case CMD_TARGET_STATUS:
3028		rq->errors = evaluate_target_status(h, cmd, &retry_cmd);
3029		break;
3030	case CMD_DATA_UNDERRUN:
3031		if (blk_fs_request(cmd->rq)) {
3032			printk(KERN_WARNING "cciss: cmd %p has"
3033			       " completed with data underrun "
3034			       "reported\n", cmd);
3035			cmd->rq->resid_len = cmd->err_info->ResidualCnt;
3036		}
3037		break;
3038	case CMD_DATA_OVERRUN:
3039		if (blk_fs_request(cmd->rq))
3040			printk(KERN_WARNING "cciss: cmd %p has"
3041			       " completed with data overrun "
3042			       "reported\n", cmd);
3043		break;
3044	case CMD_INVALID:
3045		printk(KERN_WARNING "cciss: cmd %p is "
3046		       "reported invalid\n", cmd);
3047		rq->errors = make_status_bytes(SAM_STAT_GOOD,
3048			cmd->err_info->CommandStatus, DRIVER_OK,
3049			blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
3050		break;
3051	case CMD_PROTOCOL_ERR:
3052		printk(KERN_WARNING "cciss: cmd %p has "
3053		       "protocol error \n", cmd);
3054		rq->errors = make_status_bytes(SAM_STAT_GOOD,
3055			cmd->err_info->CommandStatus, DRIVER_OK,
3056			blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
3057		break;
3058	case CMD_HARDWARE_ERR:
3059		printk(KERN_WARNING "cciss: cmd %p had "
3060		       " hardware error\n", cmd);
3061		rq->errors = make_status_bytes(SAM_STAT_GOOD,
3062			cmd->err_info->CommandStatus, DRIVER_OK,
3063			blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
3064		break;
3065	case CMD_CONNECTION_LOST:
3066		printk(KERN_WARNING "cciss: cmd %p had "
3067		       "connection lost\n", cmd);
3068		rq->errors = make_status_bytes(SAM_STAT_GOOD,
3069			cmd->err_info->CommandStatus, DRIVER_OK,
3070			blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
3071		break;
3072	case CMD_ABORTED:
3073		printk(KERN_WARNING "cciss: cmd %p was "
3074		       "aborted\n", cmd);
3075		rq->errors = make_status_bytes(SAM_STAT_GOOD,
3076			cmd->err_info->CommandStatus, DRIVER_OK,
3077			blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ABORT);
3078		break;
3079	case CMD_ABORT_FAILED:
3080		printk(KERN_WARNING "cciss: cmd %p reports "
3081		       "abort failed\n", cmd);
3082		rq->errors = make_status_bytes(SAM_STAT_GOOD,
3083			cmd->err_info->CommandStatus, DRIVER_OK,
3084			blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
3085		break;
3086	case CMD_UNSOLICITED_ABORT:
3087		printk(KERN_WARNING "cciss%d: unsolicited "
3088		       "abort %p\n", h->ctlr, cmd);
3089		if (cmd->retry_count < MAX_CMD_RETRIES) {
3090			retry_cmd = 1;
3091			printk(KERN_WARNING
3092			       "cciss%d: retrying %p\n", h->ctlr, cmd);
3093			cmd->retry_count++;
3094		} else
3095			printk(KERN_WARNING
3096			       "cciss%d: %p retried too "
3097			       "many times\n", h->ctlr, cmd);
3098		rq->errors = make_status_bytes(SAM_STAT_GOOD,
3099			cmd->err_info->CommandStatus, DRIVER_OK,
3100			blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ABORT);
3101		break;
3102	case CMD_TIMEOUT:
3103		printk(KERN_WARNING "cciss: cmd %p timedout\n", cmd);
3104		rq->errors = make_status_bytes(SAM_STAT_GOOD,
3105			cmd->err_info->CommandStatus, DRIVER_OK,
3106			blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
3107		break;
3108	default:
3109		printk(KERN_WARNING "cciss: cmd %p returned "
3110		       "unknown status %x\n", cmd,
3111		       cmd->err_info->CommandStatus);
3112		rq->errors = make_status_bytes(SAM_STAT_GOOD,
3113			cmd->err_info->CommandStatus, DRIVER_OK,
3114			blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
3115	}
3116
3117after_error_processing:
3118
3119	/* We need to return this command */
3120	if (retry_cmd) {
3121		resend_cciss_cmd(h, cmd);
3122		return;
3123	}
3124	cmd->rq->completion_data = cmd;
3125	blk_complete_request(cmd->rq);
3126}
3127
3128/*
3129 * Get a request and submit it to the controller.
3130 */
3131static void do_cciss_request(struct request_queue *q)
3132{
3133	ctlr_info_t *h = q->queuedata;
3134	CommandList_struct *c;
3135	sector_t start_blk;
3136	int seg;
3137	struct request *creq;
3138	u64bit temp64;
3139	struct scatterlist tmp_sg[MAXSGENTRIES];
3140	drive_info_struct *drv;
3141	int i, dir;
3142
3143	/* We call start_io here in case there is a command waiting on the
3144	 * queue that has not been sent.
3145	 */
3146	if (blk_queue_plugged(q))
3147		goto startio;
3148
3149      queue:
3150	creq = blk_peek_request(q);
3151	if (!creq)
3152		goto startio;
3153
3154	BUG_ON(creq->nr_phys_segments > MAXSGENTRIES);
3155
3156	if ((c = cmd_alloc(h, 1)) == NULL)
3157		goto full;
3158
3159	blk_start_request(creq);
3160
3161	spin_unlock_irq(q->queue_lock);
3162
3163	c->cmd_type = CMD_RWREQ;
3164	c->rq = creq;
3165
3166	/* fill in the request */
3167	drv = creq->rq_disk->private_data;
3168	c->Header.ReplyQueue = 0;	// unused in simple mode
3169	/* got command from pool, so use the command block index instead */
3170	/* for direct lookups. */
3171	/* The first 2 bits are reserved for controller error reporting. */
3172	c->Header.Tag.lower = (c->cmdindex << 3);
3173	c->Header.Tag.lower |= 0x04;	/* flag for direct lookup. */
3174	c->Header.LUN.LogDev.VolId = drv->LunID;
3175	c->Header.LUN.LogDev.Mode = 1;
3176	c->Request.CDBLen = 10;	// 12 byte commands not in FW yet;
3177	c->Request.Type.Type = TYPE_CMD;	// It is a command.
3178	c->Request.Type.Attribute = ATTR_SIMPLE;
3179	c->Request.Type.Direction =
3180	    (rq_data_dir(creq) == READ) ? XFER_READ : XFER_WRITE;
3181	c->Request.Timeout = 0;	// Don't time out
3182	c->Request.CDB[0] =
3183	    (rq_data_dir(creq) == READ) ? h->cciss_read : h->cciss_write;
3184	start_blk = blk_rq_pos(creq);
3185#ifdef CCISS_DEBUG
3186	printk(KERN_DEBUG "ciss: sector =%d nr_sectors=%d\n",
3187	       (int)blk_rq_pos(creq), (int)blk_rq_sectors(creq));
3188#endif				/* CCISS_DEBUG */
3189
3190	sg_init_table(tmp_sg, MAXSGENTRIES);
3191	seg = blk_rq_map_sg(q, creq, tmp_sg);
3192
3193	/* get the DMA records for the setup */
3194	if (c->Request.Type.Direction == XFER_READ)
3195		dir = PCI_DMA_FROMDEVICE;
3196	else
3197		dir = PCI_DMA_TODEVICE;
3198
3199	for (i = 0; i < seg; i++) {
3200		c->SG[i].Len = tmp_sg[i].length;
3201		temp64.val = (__u64) pci_map_page(h->pdev, sg_page(&tmp_sg[i]),
3202						  tmp_sg[i].offset,
3203						  tmp_sg[i].length, dir);
3204		c->SG[i].Addr.lower = temp64.val32.lower;
3205		c->SG[i].Addr.upper = temp64.val32.upper;
3206		c->SG[i].Ext = 0;	// we are not chaining
3207	}
3208	/* track how many SG entries we are using */
3209	if (seg > h->maxSG)
3210		h->maxSG = seg;
3211
3212#ifdef CCISS_DEBUG
3213	printk(KERN_DEBUG "cciss: Submitting %u sectors in %d segments\n",
3214	       blk_rq_sectors(creq), seg);
3215#endif				/* CCISS_DEBUG */
3216
3217	c->Header.SGList = c->Header.SGTotal = seg;
3218	if (likely(blk_fs_request(creq))) {
3219		if(h->cciss_read == CCISS_READ_10) {
3220			c->Request.CDB[1] = 0;
3221			c->Request.CDB[2] = (start_blk >> 24) & 0xff;	//MSB
3222			c->Request.CDB[3] = (start_blk >> 16) & 0xff;
3223			c->Request.CDB[4] = (start_blk >> 8) & 0xff;
3224			c->Request.CDB[5] = start_blk & 0xff;
3225			c->Request.CDB[6] = 0;	// (sect >> 24) & 0xff; MSB
3226			c->Request.CDB[7] = (blk_rq_sectors(creq) >> 8) & 0xff;
3227			c->Request.CDB[8] = blk_rq_sectors(creq) & 0xff;
3228			c->Request.CDB[9] = c->Request.CDB[11] = c->Request.CDB[12] = 0;
3229		} else {
3230			u32 upper32 = upper_32_bits(start_blk);
3231
3232			c->Request.CDBLen = 16;
3233			c->Request.CDB[1]= 0;
3234			c->Request.CDB[2]= (upper32 >> 24) & 0xff;	//MSB
3235			c->Request.CDB[3]= (upper32 >> 16) & 0xff;
3236			c->Request.CDB[4]= (upper32 >>  8) & 0xff;
3237			c->Request.CDB[5]= upper32 & 0xff;
3238			c->Request.CDB[6]= (start_blk >> 24) & 0xff;
3239			c->Request.CDB[7]= (start_blk >> 16) & 0xff;
3240			c->Request.CDB[8]= (start_blk >>  8) & 0xff;
3241			c->Request.CDB[9]= start_blk & 0xff;
3242			c->Request.CDB[10]= (blk_rq_sectors(creq) >> 24) & 0xff;
3243			c->Request.CDB[11]= (blk_rq_sectors(creq) >> 16) & 0xff;
3244			c->Request.CDB[12]= (blk_rq_sectors(creq) >>  8) & 0xff;
3245			c->Request.CDB[13]= blk_rq_sectors(creq) & 0xff;
3246			c->Request.CDB[14] = c->Request.CDB[15] = 0;
3247		}
3248	} else if (blk_pc_request(creq)) {
3249		c->Request.CDBLen = creq->cmd_len;
3250		memcpy(c->Request.CDB, creq->cmd, BLK_MAX_CDB);
3251	} else {
3252		printk(KERN_WARNING "cciss%d: bad request type %d\n", h->ctlr, creq->cmd_type);
3253		BUG();
3254	}
3255
3256	spin_lock_irq(q->queue_lock);
3257
3258	addQ(&h->reqQ, c);
3259	h->Qdepth++;
3260	if (h->Qdepth > h->maxQsinceinit)
3261		h->maxQsinceinit = h->Qdepth;
3262
3263	goto queue;
3264full:
3265	blk_stop_queue(q);
3266startio:
3267	/* We will already have the driver lock here so not need
3268	 * to lock it.
3269	 */
3270	start_io(h);
3271}
3272
3273static inline unsigned long get_next_completion(ctlr_info_t *h)
3274{
3275	return h->access.command_completed(h);
3276}
3277
3278static inline int interrupt_pending(ctlr_info_t *h)
3279{
3280	return h->access.intr_pending(h);
3281}
3282
3283static inline long interrupt_not_for_us(ctlr_info_t *h)
3284{
3285	return (((h->access.intr_pending(h) == 0) ||
3286		 (h->interrupts_enabled == 0)));
3287}
3288
3289static irqreturn_t do_cciss_intr(int irq, void *dev_id)
3290{
3291	ctlr_info_t *h = dev_id;
3292	CommandList_struct *c;
3293	unsigned long flags;
3294	__u32 a, a1, a2;
3295
3296	if (interrupt_not_for_us(h))
3297		return IRQ_NONE;
3298	/*
3299	 * If there are completed commands in the completion queue,
3300	 * we had better do something about it.
3301	 */
3302	spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
3303	while (interrupt_pending(h)) {
3304		while ((a = get_next_completion(h)) != FIFO_EMPTY) {
3305			a1 = a;
3306			if ((a & 0x04)) {
3307				a2 = (a >> 3);
3308				if (a2 >= h->nr_cmds) {
3309					printk(KERN_WARNING
3310					       "cciss: controller cciss%d failed, stopping.\n",
3311					       h->ctlr);
3312					fail_all_cmds(h->ctlr);
3313					return IRQ_HANDLED;
3314				}
3315
3316				c = h->cmd_pool + a2;
3317				a = c->busaddr;
3318
3319			} else {
3320				struct hlist_node *tmp;
3321
3322				a &= ~3;
3323				c = NULL;
3324				hlist_for_each_entry(c, tmp, &h->cmpQ, list) {
3325					if (c->busaddr == a)
3326						break;
3327				}
3328			}
3329			/*
3330			 * If we've found the command, take it off the
3331			 * completion Q and free it
3332			 */
3333			if (c && c->busaddr == a) {
3334				removeQ(c);
3335				if (c->cmd_type == CMD_RWREQ) {
3336					complete_command(h, c, 0);
3337				} else if (c->cmd_type == CMD_IOCTL_PEND) {
3338					complete(c->waiting);
3339				}
3340#				ifdef CONFIG_CISS_SCSI_TAPE
3341				else if (c->cmd_type == CMD_SCSI)
3342					complete_scsi_command(c, 0, a1);
3343#				endif
3344				continue;
3345			}
3346		}
3347	}
3348
3349	spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
3350	return IRQ_HANDLED;
3351}
3352
3353/**
3354 * add_to_scan_list() - add controller to rescan queue
3355 * @h:		      Pointer to the controller.
3356 *
3357 * Adds the controller to the rescan queue if not already on the queue.
3358 *
3359 * returns 1 if added to the queue, 0 if skipped (could be on the
3360 * queue already, or the controller could be initializing or shutting
3361 * down).
3362 **/
3363static int add_to_scan_list(struct ctlr_info *h)
3364{
3365	struct ctlr_info *test_h;
3366	int found = 0;
3367	int ret = 0;
3368
3369	if (h->busy_initializing)
3370		return 0;
3371
3372	if (!mutex_trylock(&h->busy_shutting_down))
3373		return 0;
3374
3375	mutex_lock(&scan_mutex);
3376	list_for_each_entry(test_h, &scan_q, scan_list) {
3377		if (test_h == h) {
3378			found = 1;
3379			break;
3380		}
3381	}
3382	if (!found && !h->busy_scanning) {
3383		INIT_COMPLETION(h->scan_wait);
3384		list_add_tail(&h->scan_list, &scan_q);
3385		ret = 1;
3386	}
3387	mutex_unlock(&scan_mutex);
3388	mutex_unlock(&h->busy_shutting_down);
3389
3390	return ret;
3391}
3392
3393/**
3394 * remove_from_scan_list() - remove controller from rescan queue
3395 * @h:			   Pointer to the controller.
3396 *
3397 * Removes the controller from the rescan queue if present. Blocks if
3398 * the controller is currently conducting a rescan.
3399 **/
3400static void remove_from_scan_list(struct ctlr_info *h)
3401{
3402	struct ctlr_info *test_h, *tmp_h;
3403	int scanning = 0;
3404
3405	mutex_lock(&scan_mutex);
3406	list_for_each_entry_safe(test_h, tmp_h, &scan_q, scan_list) {
3407		if (test_h == h) {
3408			list_del(&h->scan_list);
3409			complete_all(&h->scan_wait);
3410			mutex_unlock(&scan_mutex);
3411			return;
3412		}
3413	}
3414	if (&h->busy_scanning)
3415		scanning = 0;
3416	mutex_unlock(&scan_mutex);
3417
3418	if (scanning)
3419		wait_for_completion(&h->scan_wait);
3420}
3421
3422/**
3423 * scan_thread() - kernel thread used to rescan controllers
3424 * @data:	 Ignored.
3425 *
3426 * A kernel thread used scan for drive topology changes on
3427 * controllers. The thread processes only one controller at a time
3428 * using a queue.  Controllers are added to the queue using
3429 * add_to_scan_list() and removed from the queue either after done
3430 * processing or using remove_from_scan_list().
3431 *
3432 * returns 0.
3433 **/
3434static int scan_thread(void *data)
3435{
3436	struct ctlr_info *h;
3437
3438	while (1) {
3439		set_current_state(TASK_INTERRUPTIBLE);
3440		schedule();
3441		if (kthread_should_stop())
3442			break;
3443
3444		while (1) {
3445			mutex_lock(&scan_mutex);
3446			if (list_empty(&scan_q)) {
3447				mutex_unlock(&scan_mutex);
3448				break;
3449			}
3450
3451			h = list_entry(scan_q.next,
3452				       struct ctlr_info,
3453				       scan_list);
3454			list_del(&h->scan_list);
3455			h->busy_scanning = 1;
3456			mutex_unlock(&scan_mutex);
3457
3458			if (h) {
3459				rebuild_lun_table(h, 0, 0);
3460				complete_all(&h->scan_wait);
3461				mutex_lock(&scan_mutex);
3462				h->busy_scanning = 0;
3463				mutex_unlock(&scan_mutex);
3464			}
3465		}
3466	}
3467
3468	return 0;
3469}
3470
3471static int check_for_unit_attention(ctlr_info_t *h, CommandList_struct *c)
3472{
3473	if (c->err_info->SenseInfo[2] != UNIT_ATTENTION)
3474		return 0;
3475
3476	switch (c->err_info->SenseInfo[12]) {
3477	case STATE_CHANGED:
3478		printk(KERN_WARNING "cciss%d: a state change "
3479			"detected, command retried\n", h->ctlr);
3480		return 1;
3481	break;
3482	case LUN_FAILED:
3483		printk(KERN_WARNING "cciss%d: LUN failure "
3484			"detected, action required\n", h->ctlr);
3485		return 1;
3486	break;
3487	case REPORT_LUNS_CHANGED:
3488		printk(KERN_WARNING "cciss%d: report LUN data "
3489			"changed\n", h->ctlr);
3490		add_to_scan_list(h);
3491		wake_up_process(cciss_scan_thread);
3492		return 1;
3493	break;
3494	case POWER_OR_RESET:
3495		printk(KERN_WARNING "cciss%d: a power on "
3496			"or device reset detected\n", h->ctlr);
3497		return 1;
3498	break;
3499	case UNIT_ATTENTION_CLEARED:
3500		printk(KERN_WARNING "cciss%d: unit attention "
3501		    "cleared by another initiator\n", h->ctlr);
3502		return 1;
3503	break;
3504	default:
3505		printk(KERN_WARNING "cciss%d: unknown "
3506			"unit attention detected\n", h->ctlr);
3507				return 1;
3508	}
3509}
3510
3511/*
3512 *  We cannot read the structure directly, for portability we must use
3513 *   the io functions.
3514 *   This is for debug only.
3515 */
3516#ifdef CCISS_DEBUG
3517static void print_cfg_table(CfgTable_struct *tb)
3518{
3519	int i;
3520	char temp_name[17];
3521
3522	printk("Controller Configuration information\n");
3523	printk("------------------------------------\n");
3524	for (i = 0; i < 4; i++)
3525		temp_name[i] = readb(&(tb->Signature[i]));
3526	temp_name[4] = '\0';
3527	printk("   Signature = %s\n", temp_name);
3528	printk("   Spec Number = %d\n", readl(&(tb->SpecValence)));
3529	printk("   Transport methods supported = 0x%x\n",
3530	       readl(&(tb->TransportSupport)));
3531	printk("   Transport methods active = 0x%x\n",
3532	       readl(&(tb->TransportActive)));
3533	printk("   Requested transport Method = 0x%x\n",
3534	       readl(&(tb->HostWrite.TransportRequest)));
3535	printk("   Coalesce Interrupt Delay = 0x%x\n",
3536	       readl(&(tb->HostWrite.CoalIntDelay)));
3537	printk("   Coalesce Interrupt Count = 0x%x\n",
3538	       readl(&(tb->HostWrite.CoalIntCount)));
3539	printk("   Max outstanding commands = 0x%d\n",
3540	       readl(&(tb->CmdsOutMax)));
3541	printk("   Bus Types = 0x%x\n", readl(&(tb->BusTypes)));
3542	for (i = 0; i < 16; i++)
3543		temp_name[i] = readb(&(tb->ServerName[i]));
3544	temp_name[16] = '\0';
3545	printk("   Server Name = %s\n", temp_name);
3546	printk("   Heartbeat Counter = 0x%x\n\n\n", readl(&(tb->HeartBeat)));
3547}
3548#endif				/* CCISS_DEBUG */
3549
3550static int find_PCI_BAR_index(struct pci_dev *pdev, unsigned long pci_bar_addr)
3551{
3552	int i, offset, mem_type, bar_type;
3553	if (pci_bar_addr == PCI_BASE_ADDRESS_0)	/* looking for BAR zero? */
3554		return 0;
3555	offset = 0;
3556	for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
3557		bar_type = pci_resource_flags(pdev, i) & PCI_BASE_ADDRESS_SPACE;
3558		if (bar_type == PCI_BASE_ADDRESS_SPACE_IO)
3559			offset += 4;
3560		else {
3561			mem_type = pci_resource_flags(pdev, i) &
3562			    PCI_BASE_ADDRESS_MEM_TYPE_MASK;
3563			switch (mem_type) {
3564			case PCI_BASE_ADDRESS_MEM_TYPE_32:
3565			case PCI_BASE_ADDRESS_MEM_TYPE_1M:
3566				offset += 4;	/* 32 bit */
3567				break;
3568			case PCI_BASE_ADDRESS_MEM_TYPE_64:
3569				offset += 8;
3570				break;
3571			default:	/* reserved in PCI 2.2 */
3572				printk(KERN_WARNING
3573				       "Base address is invalid\n");
3574				return -1;
3575				break;
3576			}
3577		}
3578		if (offset == pci_bar_addr - PCI_BASE_ADDRESS_0)
3579			return i + 1;
3580	}
3581	return -1;
3582}
3583
3584/* If MSI/MSI-X is supported by the kernel we will try to enable it on
3585 * controllers that are capable. If not, we use IO-APIC mode.
3586 */
3587
3588static void __devinit cciss_interrupt_mode(ctlr_info_t *c,
3589					   struct pci_dev *pdev, __u32 board_id)
3590{
3591#ifdef CONFIG_PCI_MSI
3592	int err;
3593	struct msix_entry cciss_msix_entries[4] = { {0, 0}, {0, 1},
3594	{0, 2}, {0, 3}
3595	};
3596
3597	/* Some boards advertise MSI but don't really support it */
3598	if ((board_id == 0x40700E11) ||
3599	    (board_id == 0x40800E11) ||
3600	    (board_id == 0x40820E11) || (board_id == 0x40830E11))
3601		goto default_int_mode;
3602
3603	if (pci_find_capability(pdev, PCI_CAP_ID_MSIX)) {
3604		err = pci_enable_msix(pdev, cciss_msix_entries, 4);
3605		if (!err) {
3606			c->intr[0] = cciss_msix_entries[0].vector;
3607			c->intr[1] = cciss_msix_entries[1].vector;
3608			c->intr[2] = cciss_msix_entries[2].vector;
3609			c->intr[3] = cciss_msix_entries[3].vector;
3610			c->msix_vector = 1;
3611			return;
3612		}
3613		if (err > 0) {
3614			printk(KERN_WARNING "cciss: only %d MSI-X vectors "
3615			       "available\n", err);
3616			goto default_int_mode;
3617		} else {
3618			printk(KERN_WARNING "cciss: MSI-X init failed %d\n",
3619			       err);
3620			goto default_int_mode;
3621		}
3622	}
3623	if (pci_find_capability(pdev, PCI_CAP_ID_MSI)) {
3624		if (!pci_enable_msi(pdev)) {
3625			c->msi_vector = 1;
3626		} else {
3627			printk(KERN_WARNING "cciss: MSI init failed\n");
3628		}
3629	}
3630default_int_mode:
3631#endif				/* CONFIG_PCI_MSI */
3632	/* if we get here we're going to use the default interrupt mode */
3633	c->intr[SIMPLE_MODE_INT] = pdev->irq;
3634	return;
3635}
3636
3637static int __devinit cciss_pci_init(ctlr_info_t *c, struct pci_dev *pdev)
3638{
3639	ushort subsystem_vendor_id, subsystem_device_id, command;
3640	__u32 board_id, scratchpad = 0;
3641	__u64 cfg_offset;
3642	__u32 cfg_base_addr;
3643	__u64 cfg_base_addr_index;
3644	int i, err;
3645
3646	/* check to see if controller has been disabled */
3647	/* BEFORE trying to enable it */
3648	(void)pci_read_config_word(pdev, PCI_COMMAND, &command);
3649	if (!(command & 0x02)) {
3650		printk(KERN_WARNING
3651		       "cciss: controller appears to be disabled\n");
3652		return -ENODEV;
3653	}
3654
3655	err = pci_enable_device(pdev);
3656	if (err) {
3657		printk(KERN_ERR "cciss: Unable to Enable PCI device\n");
3658		return err;
3659	}
3660
3661	err = pci_request_regions(pdev, "cciss");
3662	if (err) {
3663		printk(KERN_ERR "cciss: Cannot obtain PCI resources, "
3664		       "aborting\n");
3665		return err;
3666	}
3667
3668	subsystem_vendor_id = pdev->subsystem_vendor;
3669	subsystem_device_id = pdev->subsystem_device;
3670	board_id = (((__u32) (subsystem_device_id << 16) & 0xffff0000) |
3671		    subsystem_vendor_id);
3672
3673#ifdef CCISS_DEBUG
3674	printk("command = %x\n", command);
3675	printk("irq = %x\n", pdev->irq);
3676	printk("board_id = %x\n", board_id);
3677#endif				/* CCISS_DEBUG */
3678
3679/* If the kernel supports MSI/MSI-X we will try to enable that functionality,
3680 * else we use the IO-APIC interrupt assigned to us by system ROM.
3681 */
3682	cciss_interrupt_mode(c, pdev, board_id);
3683
3684	/* find the memory BAR */
3685	for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
3686		if (pci_resource_flags(pdev, i) & IORESOURCE_MEM)
3687			break;
3688	}
3689	if (i == DEVICE_COUNT_RESOURCE) {
3690		printk(KERN_WARNING "cciss: No memory BAR found\n");
3691		err = -ENODEV;
3692		goto err_out_free_res;
3693	}
3694
3695	c->paddr = pci_resource_start(pdev, i); /* addressing mode bits
3696						 * already removed
3697						 */
3698
3699#ifdef CCISS_DEBUG
3700	printk("address 0 = %lx\n", c->paddr);
3701#endif				/* CCISS_DEBUG */
3702	c->vaddr = remap_pci_mem(c->paddr, 0x250);
3703
3704	/* Wait for the board to become ready.  (PCI hotplug needs this.)
3705	 * We poll for up to 120 secs, once per 100ms. */
3706	for (i = 0; i < 1200; i++) {
3707		scratchpad = readl(c->vaddr + SA5_SCRATCHPAD_OFFSET);
3708		if (scratchpad == CCISS_FIRMWARE_READY)
3709			break;
3710		set_current_state(TASK_INTERRUPTIBLE);
3711		schedule_timeout(msecs_to_jiffies(100));	/* wait 100ms */
3712	}
3713	if (scratchpad != CCISS_FIRMWARE_READY) {
3714		printk(KERN_WARNING "cciss: Board not ready.  Timed out.\n");
3715		err = -ENODEV;
3716		goto err_out_free_res;
3717	}
3718
3719	/* get the address index number */
3720	cfg_base_addr = readl(c->vaddr + SA5_CTCFG_OFFSET);
3721	cfg_base_addr &= (__u32) 0x0000ffff;
3722#ifdef CCISS_DEBUG
3723	printk("cfg base address = %x\n", cfg_base_addr);
3724#endif				/* CCISS_DEBUG */
3725	cfg_base_addr_index = find_PCI_BAR_index(pdev, cfg_base_addr);
3726#ifdef CCISS_DEBUG
3727	printk("cfg base address index = %llx\n",
3728		(unsigned long long)cfg_base_addr_index);
3729#endif				/* CCISS_DEBUG */
3730	if (cfg_base_addr_index == -1) {
3731		printk(KERN_WARNING "cciss: Cannot find cfg_base_addr_index\n");
3732		err = -ENODEV;
3733		goto err_out_free_res;
3734	}
3735
3736	cfg_offset = readl(c->vaddr + SA5_CTMEM_OFFSET);
3737#ifdef CCISS_DEBUG
3738	printk("cfg offset = %llx\n", (unsigned long long)cfg_offset);
3739#endif				/* CCISS_DEBUG */
3740	c->cfgtable = remap_pci_mem(pci_resource_start(pdev,
3741						       cfg_base_addr_index) +
3742				    cfg_offset, sizeof(CfgTable_struct));
3743	c->board_id = board_id;
3744
3745#ifdef CCISS_DEBUG
3746	print_cfg_table(c->cfgtable);
3747#endif				/* CCISS_DEBUG */
3748
3749	/* Some controllers support Zero Memory Raid (ZMR).
3750	 * When configured in ZMR mode the number of supported
3751	 * commands drops to 64. So instead of just setting an
3752	 * arbitrary value we make the driver a little smarter.
3753	 * We read the config table to tell us how many commands
3754	 * are supported on the controller then subtract 4 to
3755	 * leave a little room for ioctl calls.
3756	 */
3757	c->max_commands = readl(&(c->cfgtable->CmdsOutMax));
3758	for (i = 0; i < ARRAY_SIZE(products); i++) {
3759		if (board_id == products[i].board_id) {
3760			c->product_name = products[i].product_name;
3761			c->access = *(products[i].access);
3762			c->nr_cmds = c->max_commands - 4;
3763			break;
3764		}
3765	}
3766	if ((readb(&c->cfgtable->Signature[0]) != 'C') ||
3767	    (readb(&c->cfgtable->Signature[1]) != 'I') ||
3768	    (readb(&c->cfgtable->Signature[2]) != 'S') ||
3769	    (readb(&c->cfgtable->Signature[3]) != 'S')) {
3770		printk("Does not appear to be a valid CISS config table\n");
3771		err = -ENODEV;
3772		goto err_out_free_res;
3773	}
3774	/* We didn't find the controller in our list. We know the
3775	 * signature is valid. If it's an HP device let's try to
3776	 * bind to the device and fire it up. Otherwise we bail.
3777	 */
3778	if (i == ARRAY_SIZE(products)) {
3779		if (subsystem_vendor_id == PCI_VENDOR_ID_HP) {
3780			c->product_name = products[i-1].product_name;
3781			c->access = *(products[i-1].access);
3782			c->nr_cmds = c->max_commands - 4;
3783			printk(KERN_WARNING "cciss: This is an unknown "
3784				"Smart Array controller.\n"
3785				"cciss: Please update to the latest driver "
3786				"available from www.hp.com.\n");
3787		} else {
3788			printk(KERN_WARNING "cciss: Sorry, I don't know how"
3789				" to access the Smart Array controller %08lx\n"
3790					, (unsigned long)board_id);
3791			err = -ENODEV;
3792			goto err_out_free_res;
3793		}
3794	}
3795#ifdef CONFIG_X86
3796	{
3797		/* Need to enable prefetch in the SCSI core for 6400 in x86 */
3798		__u32 prefetch;
3799		prefetch = readl(&(c->cfgtable->SCSI_Prefetch));
3800		prefetch |= 0x100;
3801		writel(prefetch, &(c->cfgtable->SCSI_Prefetch));
3802	}
3803#endif
3804
3805	/* Disabling DMA prefetch and refetch for the P600.
3806	 * An ASIC bug may result in accesses to invalid memory addresses.
3807	 * We've disabled prefetch for some time now. Testing with XEN
3808	 * kernels revealed a bug in the refetch if dom0 resides on a P600.
3809	 */
3810	if(board_id == 0x3225103C) {
3811		__u32 dma_prefetch;
3812		__u32 dma_refetch;
3813		dma_prefetch = readl(c->vaddr + I2O_DMA1_CFG);
3814		dma_prefetch |= 0x8000;
3815		writel(dma_prefetch, c->vaddr + I2O_DMA1_CFG);
3816		pci_read_config_dword(pdev, PCI_COMMAND_PARITY, &dma_refetch);
3817		dma_refetch |= 0x1;
3818		pci_write_config_dword(pdev, PCI_COMMAND_PARITY, dma_refetch);
3819	}
3820
3821#ifdef CCISS_DEBUG
3822	printk("Trying to put board into Simple mode\n");
3823#endif				/* CCISS_DEBUG */
3824	c->max_commands = readl(&(c->cfgtable->CmdsOutMax));
3825	/* Update the field, and then ring the doorbell */
3826	writel(CFGTBL_Trans_Simple, &(c->cfgtable->HostWrite.TransportRequest));
3827	writel(CFGTBL_ChangeReq, c->vaddr + SA5_DOORBELL);
3828
3829	/* under certain very rare conditions, this can take awhile.
3830	 * (e.g.: hot replace a failed 144GB drive in a RAID 5 set right
3831	 * as we enter this code.) */
3832	for (i = 0; i < MAX_CONFIG_WAIT; i++) {
3833		if (!(readl(c->vaddr + SA5_DOORBELL) & CFGTBL_ChangeReq))
3834			break;
3835		/* delay and try again */
3836		set_current_state(TASK_INTERRUPTIBLE);
3837		schedule_timeout(msecs_to_jiffies(1));
3838	}
3839
3840#ifdef CCISS_DEBUG
3841	printk(KERN_DEBUG "I counter got to %d %x\n", i,
3842	       readl(c->vaddr + SA5_DOORBELL));
3843#endif				/* CCISS_DEBUG */
3844#ifdef CCISS_DEBUG
3845	print_cfg_table(c->cfgtable);
3846#endif				/* CCISS_DEBUG */
3847
3848	if (!(readl(&(c->cfgtable->TransportActive)) & CFGTBL_Trans_Simple)) {
3849		printk(KERN_WARNING "cciss: unable to get board into"
3850		       " simple mode\n");
3851		err = -ENODEV;
3852		goto err_out_free_res;
3853	}
3854	return 0;
3855
3856err_out_free_res:
3857	/*
3858	 * Deliberately omit pci_disable_device(): it does something nasty to
3859	 * Smart Array controllers that pci_enable_device does not undo
3860	 */
3861	pci_release_regions(pdev);
3862	return err;
3863}
3864
3865/* Function to find the first free pointer into our hba[] array
3866 * Returns -1 if no free entries are left.
3867 */
3868static int alloc_cciss_hba(void)
3869{
3870	int i;
3871
3872	for (i = 0; i < MAX_CTLR; i++) {
3873		if (!hba[i]) {
3874			ctlr_info_t *p;
3875
3876			p = kzalloc(sizeof(ctlr_info_t), GFP_KERNEL);
3877			if (!p)
3878				goto Enomem;
3879			hba[i] = p;
3880			return i;
3881		}
3882	}
3883	printk(KERN_WARNING "cciss: This driver supports a maximum"
3884	       " of %d controllers.\n", MAX_CTLR);
3885	return -1;
3886Enomem:
3887	printk(KERN_ERR "cciss: out of memory.\n");
3888	return -1;
3889}
3890
3891static void free_hba(int n)
3892{
3893	ctlr_info_t *h = hba[n];
3894	int i;
3895
3896	hba[n] = NULL;
3897	for (i = 0; i < h->highest_lun + 1; i++)
3898		if (h->gendisk[i] != NULL)
3899			put_disk(h->gendisk[i]);
3900	kfree(h);
3901}
3902
3903/* Send a message CDB to the firmware. */
3904static __devinit int cciss_message(struct pci_dev *pdev, unsigned char opcode, unsigned char type)
3905{
3906	typedef struct {
3907		CommandListHeader_struct CommandHeader;
3908		RequestBlock_struct Request;
3909		ErrDescriptor_struct ErrorDescriptor;
3910	} Command;
3911	static const size_t cmd_sz = sizeof(Command) + sizeof(ErrorInfo_struct);
3912	Command *cmd;
3913	dma_addr_t paddr64;
3914	uint32_t paddr32, tag;
3915	void __iomem *vaddr;
3916	int i, err;
3917
3918	vaddr = ioremap_nocache(pci_resource_start(pdev, 0), pci_resource_len(pdev, 0));
3919	if (vaddr == NULL)
3920		return -ENOMEM;
3921
3922	/* The Inbound Post Queue only accepts 32-bit physical addresses for the
3923	   CCISS commands, so they must be allocated from the lower 4GiB of
3924	   memory. */
3925	err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32));
3926	if (err) {
3927		iounmap(vaddr);
3928		return -ENOMEM;
3929	}
3930
3931	cmd = pci_alloc_consistent(pdev, cmd_sz, &paddr64);
3932	if (cmd == NULL) {
3933		iounmap(vaddr);
3934		return -ENOMEM;
3935	}
3936
3937	/* This must fit, because of the 32-bit consistent DMA mask.  Also,
3938	   although there's no guarantee, we assume that the address is at
3939	   least 4-byte aligned (most likely, it's page-aligned). */
3940	paddr32 = paddr64;
3941
3942	cmd->CommandHeader.ReplyQueue = 0;
3943	cmd->CommandHeader.SGList = 0;
3944	cmd->CommandHeader.SGTotal = 0;
3945	cmd->CommandHeader.Tag.lower = paddr32;
3946	cmd->CommandHeader.Tag.upper = 0;
3947	memset(&cmd->CommandHeader.LUN.LunAddrBytes, 0, 8);
3948
3949	cmd->Request.CDBLen = 16;
3950	cmd->Request.Type.Type = TYPE_MSG;
3951	cmd->Request.Type.Attribute = ATTR_HEADOFQUEUE;
3952	cmd->Request.Type.Direction = XFER_NONE;
3953	cmd->Request.Timeout = 0; /* Don't time out */
3954	cmd->Request.CDB[0] = opcode;
3955	cmd->Request.CDB[1] = type;
3956	memset(&cmd->Request.CDB[2], 0, 14); /* the rest of the CDB is reserved */
3957
3958	cmd->ErrorDescriptor.Addr.lower = paddr32 + sizeof(Command);
3959	cmd->ErrorDescriptor.Addr.upper = 0;
3960	cmd->ErrorDescriptor.Len = sizeof(ErrorInfo_struct);
3961
3962	writel(paddr32, vaddr + SA5_REQUEST_PORT_OFFSET);
3963
3964	for (i = 0; i < 10; i++) {
3965		tag = readl(vaddr + SA5_REPLY_PORT_OFFSET);
3966		if ((tag & ~3) == paddr32)
3967			break;
3968		schedule_timeout_uninterruptible(HZ);
3969	}
3970
3971	iounmap(vaddr);
3972
3973	/* we leak the DMA buffer here ... no choice since the controller could
3974	   still complete the command. */
3975	if (i == 10) {
3976		printk(KERN_ERR "cciss: controller message %02x:%02x timed out\n",
3977			opcode, type);
3978		return -ETIMEDOUT;
3979	}
3980
3981	pci_free_consistent(pdev, cmd_sz, cmd, paddr64);
3982
3983	if (tag & 2) {
3984		printk(KERN_ERR "cciss: controller message %02x:%02x failed\n",
3985			opcode, type);
3986		return -EIO;
3987	}
3988
3989	printk(KERN_INFO "cciss: controller message %02x:%02x succeeded\n",
3990		opcode, type);
3991	return 0;
3992}
3993
3994#define cciss_soft_reset_controller(p) cciss_message(p, 1, 0)
3995#define cciss_noop(p) cciss_message(p, 3, 0)
3996
3997static __devinit int cciss_reset_msi(struct pci_dev *pdev)
3998{
3999/* the #defines are stolen from drivers/pci/msi.h. */
4000#define msi_control_reg(base)		(base + PCI_MSI_FLAGS)
4001#define PCI_MSIX_FLAGS_ENABLE		(1 << 15)
4002
4003	int pos;
4004	u16 control = 0;
4005
4006	pos = pci_find_capability(pdev, PCI_CAP_ID_MSI);
4007	if (pos) {
4008		pci_read_config_word(pdev, msi_control_reg(pos), &control);
4009		if (control & PCI_MSI_FLAGS_ENABLE) {
4010			printk(KERN_INFO "cciss: resetting MSI\n");
4011			pci_write_config_word(pdev, msi_control_reg(pos), control & ~PCI_MSI_FLAGS_ENABLE);
4012		}
4013	}
4014
4015	pos = pci_find_capability(pdev, PCI_CAP_ID_MSIX);
4016	if (pos) {
4017		pci_read_config_word(pdev, msi_control_reg(pos), &control);
4018		if (control & PCI_MSIX_FLAGS_ENABLE) {
4019			printk(KERN_INFO "cciss: resetting MSI-X\n");
4020			pci_write_config_word(pdev, msi_control_reg(pos), control & ~PCI_MSIX_FLAGS_ENABLE);
4021		}
4022	}
4023
4024	return 0;
4025}
4026
4027/* This does a hard reset of the controller using PCI power management
4028 * states. */
4029static __devinit int cciss_hard_reset_controller(struct pci_dev *pdev)
4030{
4031	u16 pmcsr, saved_config_space[32];
4032	int i, pos;
4033
4034	printk(KERN_INFO "cciss: using PCI PM to reset controller\n");
4035
4036	/* This is very nearly the same thing as
4037
4038	   pci_save_state(pci_dev);
4039	   pci_set_power_state(pci_dev, PCI_D3hot);
4040	   pci_set_power_state(pci_dev, PCI_D0);
4041	   pci_restore_state(pci_dev);
4042
4043	   but we can't use these nice canned kernel routines on
4044	   kexec, because they also check the MSI/MSI-X state in PCI
4045	   configuration space and do the wrong thing when it is
4046	   set/cleared.  Also, the pci_save/restore_state functions
4047	   violate the ordering requirements for restoring the
4048	   configuration space from the CCISS document (see the
4049	   comment below).  So we roll our own .... */
4050
4051	for (i = 0; i < 32; i++)
4052		pci_read_config_word(pdev, 2*i, &saved_config_space[i]);
4053
4054	pos = pci_find_capability(pdev, PCI_CAP_ID_PM);
4055	if (pos == 0) {
4056		printk(KERN_ERR "cciss_reset_controller: PCI PM not supported\n");
4057		return -ENODEV;
4058	}
4059
4060	/* Quoting from the Open CISS Specification: "The Power
4061	 * Management Control/Status Register (CSR) controls the power
4062	 * state of the device.  The normal operating state is D0,
4063	 * CSR=00h.  The software off state is D3, CSR=03h.  To reset
4064	 * the controller, place the interface device in D3 then to
4065	 * D0, this causes a secondary PCI reset which will reset the
4066	 * controller." */
4067
4068	/* enter the D3hot power management state */
4069	pci_read_config_word(pdev, pos + PCI_PM_CTRL, &pmcsr);
4070	pmcsr &= ~PCI_PM_CTRL_STATE_MASK;
4071	pmcsr |= PCI_D3hot;
4072	pci_write_config_word(pdev, pos + PCI_PM_CTRL, pmcsr);
4073
4074	schedule_timeout_uninterruptible(HZ >> 1);
4075
4076	/* enter the D0 power management state */
4077	pmcsr &= ~PCI_PM_CTRL_STATE_MASK;
4078	pmcsr |= PCI_D0;
4079	pci_write_config_word(pdev, pos + PCI_PM_CTRL, pmcsr);
4080
4081	schedule_timeout_uninterruptible(HZ >> 1);
4082
4083	/* Restore the PCI configuration space.  The Open CISS
4084	 * Specification says, "Restore the PCI Configuration
4085	 * Registers, offsets 00h through 60h. It is important to
4086	 * restore the command register, 16-bits at offset 04h,
4087	 * last. Do not restore the configuration status register,
4088	 * 16-bits at offset 06h."  Note that the offset is 2*i. */
4089	for (i = 0; i < 32; i++) {
4090		if (i == 2 || i == 3)
4091			continue;
4092		pci_write_config_word(pdev, 2*i, saved_config_space[i]);
4093	}
4094	wmb();
4095	pci_write_config_word(pdev, 4, saved_config_space[2]);
4096
4097	return 0;
4098}
4099
4100/*
4101 *  This is it.  Find all the controllers and register them.  I really hate
4102 *  stealing all these major device numbers.
4103 *  returns the number of block devices registered.
4104 */
4105static int __devinit cciss_init_one(struct pci_dev *pdev,
4106				    const struct pci_device_id *ent)
4107{
4108	int i;
4109	int j = 0;
4110	int rc;
4111	int dac, return_code;
4112	InquiryData_struct *inq_buff;
4113
4114	if (reset_devices) {
4115		/* Reset the controller with a PCI power-cycle */
4116		if (cciss_hard_reset_controller(pdev) || cciss_reset_msi(pdev))
4117			return -ENODEV;
4118
4119		/* Now try to get the controller to respond to a no-op. Some
4120		   devices (notably the HP Smart Array 5i Controller) need
4121		   up to 30 seconds to respond. */
4122		for (i=0; i<30; i++) {
4123			if (cciss_noop(pdev) == 0)
4124				break;
4125
4126			schedule_timeout_uninterruptible(HZ);
4127		}
4128		if (i == 30) {
4129			printk(KERN_ERR "cciss: controller seems dead\n");
4130			return -EBUSY;
4131		}
4132	}
4133
4134	i = alloc_cciss_hba();
4135	if (i < 0)
4136		return -1;
4137
4138	hba[i]->busy_initializing = 1;
4139	INIT_HLIST_HEAD(&hba[i]->cmpQ);
4140	INIT_HLIST_HEAD(&hba[i]->reqQ);
4141	mutex_init(&hba[i]->busy_shutting_down);
4142
4143	if (cciss_pci_init(hba[i], pdev) != 0)
4144		goto clean0;
4145
4146	sprintf(hba[i]->devname, "cciss%d", i);
4147	hba[i]->ctlr = i;
4148	hba[i]->pdev = pdev;
4149
4150	init_completion(&hba[i]->scan_wait);
4151
4152	if (cciss_create_hba_sysfs_entry(hba[i]))
4153		goto clean0;
4154
4155	/* configure PCI DMA stuff */
4156	if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(64)))
4157		dac = 1;
4158	else if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(32)))
4159		dac = 0;
4160	else {
4161		printk(KERN_ERR "cciss: no suitable DMA available\n");
4162		goto clean1;
4163	}
4164
4165	/*
4166	 * register with the major number, or get a dynamic major number
4167	 * by passing 0 as argument.  This is done for greater than
4168	 * 8 controller support.
4169	 */
4170	if (i < MAX_CTLR_ORIG)
4171		hba[i]->major = COMPAQ_CISS_MAJOR + i;
4172	rc = register_blkdev(hba[i]->major, hba[i]->devname);
4173	if (rc == -EBUSY || rc == -EINVAL) {
4174		printk(KERN_ERR
4175		       "cciss:  Unable to get major number %d for %s "
4176		       "on hba %d\n", hba[i]->major, hba[i]->devname, i);
4177		goto clean1;
4178	} else {
4179		if (i >= MAX_CTLR_ORIG)
4180			hba[i]->major = rc;
4181	}
4182
4183	/* make sure the board interrupts are off */
4184	hba[i]->access.set_intr_mask(hba[i], CCISS_INTR_OFF);
4185	if (request_irq(hba[i]->intr[SIMPLE_MODE_INT], do_cciss_intr,
4186			IRQF_DISABLED | IRQF_SHARED, hba[i]->devname, hba[i])) {
4187		printk(KERN_ERR "cciss: Unable to get irq %d for %s\n",
4188		       hba[i]->intr[SIMPLE_MODE_INT], hba[i]->devname);
4189		goto clean2;
4190	}
4191
4192	printk(KERN_INFO "%s: <0x%x> at PCI %s IRQ %d%s using DAC\n",
4193	       hba[i]->devname, pdev->device, pci_name(pdev),
4194	       hba[i]->intr[SIMPLE_MODE_INT], dac ? "" : " not");
4195
4196	hba[i]->cmd_pool_bits =
4197	    kmalloc(DIV_ROUND_UP(hba[i]->nr_cmds, BITS_PER_LONG)
4198			* sizeof(unsigned long), GFP_KERNEL);
4199	hba[i]->cmd_pool = (CommandList_struct *)
4200	    pci_alloc_consistent(hba[i]->pdev,
4201		    hba[i]->nr_cmds * sizeof(CommandList_struct),
4202		    &(hba[i]->cmd_pool_dhandle));
4203	hba[i]->errinfo_pool = (ErrorInfo_struct *)
4204	    pci_alloc_consistent(hba[i]->pdev,
4205		    hba[i]->nr_cmds * sizeof(ErrorInfo_struct),
4206		    &(hba[i]->errinfo_pool_dhandle));
4207	if ((hba[i]->cmd_pool_bits == NULL)
4208	    || (hba[i]->cmd_pool == NULL)
4209	    || (hba[i]->errinfo_pool == NULL)) {
4210		printk(KERN_ERR "cciss: out of memory");
4211		goto clean4;
4212	}
4213	spin_lock_init(&hba[i]->lock);
4214
4215	/* Initialize the pdev driver private data.
4216	   have it point to hba[i].  */
4217	pci_set_drvdata(pdev, hba[i]);
4218	/* command and error info recs zeroed out before
4219	   they are used */
4220	memset(hba[i]->cmd_pool_bits, 0,
4221	       DIV_ROUND_UP(hba[i]->nr_cmds, BITS_PER_LONG)
4222			* sizeof(unsigned long));
4223
4224	hba[i]->num_luns = 0;
4225	hba[i]->highest_lun = -1;
4226	for (j = 0; j < CISS_MAX_LUN; j++) {
4227		hba[i]->drv[j].raid_level = -1;
4228		hba[i]->drv[j].queue = NULL;
4229		hba[i]->gendisk[j] = NULL;
4230	}
4231
4232	cciss_scsi_setup(i);
4233
4234	/* Turn the interrupts on so we can service requests */
4235	hba[i]->access.set_intr_mask(hba[i], CCISS_INTR_ON);
4236
4237	/* Get the firmware version */
4238	inq_buff = kzalloc(sizeof(InquiryData_struct), GFP_KERNEL);
4239	if (inq_buff == NULL) {
4240		printk(KERN_ERR "cciss: out of memory\n");
4241		goto clean4;
4242	}
4243
4244	return_code = sendcmd_withirq(CISS_INQUIRY, i, inq_buff,
4245		sizeof(InquiryData_struct), 0, CTLR_LUNID, TYPE_CMD);
4246	if (return_code == IO_OK) {
4247		hba[i]->firm_ver[0] = inq_buff->data_byte[32];
4248		hba[i]->firm_ver[1] = inq_buff->data_byte[33];
4249		hba[i]->firm_ver[2] = inq_buff->data_byte[34];
4250		hba[i]->firm_ver[3] = inq_buff->data_byte[35];
4251	} else {	 /* send command failed */
4252		printk(KERN_WARNING "cciss: unable to determine firmware"
4253			" version of controller\n");
4254	}
4255	kfree(inq_buff);
4256
4257	cciss_procinit(i);
4258
4259	hba[i]->cciss_max_sectors = 2048;
4260
4261	rebuild_lun_table(hba[i], 1, 0);
4262	hba[i]->busy_initializing = 0;
4263	return 1;
4264
4265clean4:
4266	kfree(hba[i]->cmd_pool_bits);
4267	if (hba[i]->cmd_pool)
4268		pci_free_consistent(hba[i]->pdev,
4269				    hba[i]->nr_cmds * sizeof(CommandList_struct),
4270				    hba[i]->cmd_pool, hba[i]->cmd_pool_dhandle);
4271	if (hba[i]->errinfo_pool)
4272		pci_free_consistent(hba[i]->pdev,
4273				    hba[i]->nr_cmds * sizeof(ErrorInfo_struct),
4274				    hba[i]->errinfo_pool,
4275				    hba[i]->errinfo_pool_dhandle);
4276	free_irq(hba[i]->intr[SIMPLE_MODE_INT], hba[i]);
4277clean2:
4278	unregister_blkdev(hba[i]->major, hba[i]->devname);
4279clean1:
4280	cciss_destroy_hba_sysfs_entry(hba[i]);
4281clean0:
4282	hba[i]->busy_initializing = 0;
4283	/* cleanup any queues that may have been initialized */
4284	for (j=0; j <= hba[i]->highest_lun; j++){
4285		drive_info_struct *drv = &(hba[i]->drv[j]);
4286		if (drv->queue)
4287			blk_cleanup_queue(drv->queue);
4288	}
4289	/*
4290	 * Deliberately omit pci_disable_device(): it does something nasty to
4291	 * Smart Array controllers that pci_enable_device does not undo
4292	 */
4293	pci_release_regions(pdev);
4294	pci_set_drvdata(pdev, NULL);
4295	free_hba(i);
4296	return -1;
4297}
4298
4299static void cciss_shutdown(struct pci_dev *pdev)
4300{
4301	ctlr_info_t *tmp_ptr;
4302	int i;
4303	char flush_buf[4];
4304	int return_code;
4305
4306	tmp_ptr = pci_get_drvdata(pdev);
4307	if (tmp_ptr == NULL)
4308		return;
4309	i = tmp_ptr->ctlr;
4310	if (hba[i] == NULL)
4311		return;
4312
4313	/* Turn board interrupts off  and send the flush cache command */
4314	/* sendcmd will turn off interrupt, and send the flush...
4315	 * To write all data in the battery backed cache to disks */
4316	memset(flush_buf, 0, 4);
4317	return_code = sendcmd(CCISS_CACHE_FLUSH, i, flush_buf, 4, 0,
4318		CTLR_LUNID, TYPE_CMD);
4319	if (return_code == IO_OK) {
4320		printk(KERN_INFO "Completed flushing cache on controller %d\n", i);
4321	} else {
4322		printk(KERN_WARNING "Error flushing cache on controller %d\n", i);
4323	}
4324	free_irq(hba[i]->intr[2], hba[i]);
4325}
4326
4327static void __devexit cciss_remove_one(struct pci_dev *pdev)
4328{
4329	ctlr_info_t *tmp_ptr;
4330	int i, j;
4331
4332	if (pci_get_drvdata(pdev) == NULL) {
4333		printk(KERN_ERR "cciss: Unable to remove device \n");
4334		return;
4335	}
4336
4337	tmp_ptr = pci_get_drvdata(pdev);
4338	i = tmp_ptr->ctlr;
4339	if (hba[i] == NULL) {
4340		printk(KERN_ERR "cciss: device appears to "
4341		       "already be removed \n");
4342		return;
4343	}
4344
4345	mutex_lock(&hba[i]->busy_shutting_down);
4346
4347	remove_from_scan_list(hba[i]);
4348	remove_proc_entry(hba[i]->devname, proc_cciss);
4349	unregister_blkdev(hba[i]->major, hba[i]->devname);
4350
4351	/* remove it from the disk list */
4352	for (j = 0; j < CISS_MAX_LUN; j++) {
4353		struct gendisk *disk = hba[i]->gendisk[j];
4354		if (disk) {
4355			struct request_queue *q = disk->queue;
4356
4357			if (disk->flags & GENHD_FL_UP) {
4358				cciss_destroy_ld_sysfs_entry(hba[i], j, 1);
4359				del_gendisk(disk);
4360			}
4361			if (q)
4362				blk_cleanup_queue(q);
4363		}
4364	}
4365
4366#ifdef CONFIG_CISS_SCSI_TAPE
4367	cciss_unregister_scsi(i);	/* unhook from SCSI subsystem */
4368#endif
4369
4370	cciss_shutdown(pdev);
4371
4372#ifdef CONFIG_PCI_MSI
4373	if (hba[i]->msix_vector)
4374		pci_disable_msix(hba[i]->pdev);
4375	else if (hba[i]->msi_vector)
4376		pci_disable_msi(hba[i]->pdev);
4377#endif				/* CONFIG_PCI_MSI */
4378
4379	iounmap(hba[i]->vaddr);
4380
4381	pci_free_consistent(hba[i]->pdev, hba[i]->nr_cmds * sizeof(CommandList_struct),
4382			    hba[i]->cmd_pool, hba[i]->cmd_pool_dhandle);
4383	pci_free_consistent(hba[i]->pdev, hba[i]->nr_cmds * sizeof(ErrorInfo_struct),
4384			    hba[i]->errinfo_pool, hba[i]->errinfo_pool_dhandle);
4385	kfree(hba[i]->cmd_pool_bits);
4386	/*
4387	 * Deliberately omit pci_disable_device(): it does something nasty to
4388	 * Smart Array controllers that pci_enable_device does not undo
4389	 */
4390	pci_release_regions(pdev);
4391	pci_set_drvdata(pdev, NULL);
4392	cciss_destroy_hba_sysfs_entry(hba[i]);
4393	mutex_unlock(&hba[i]->busy_shutting_down);
4394	free_hba(i);
4395}
4396
4397static struct pci_driver cciss_pci_driver = {
4398	.name = "cciss",
4399	.probe = cciss_init_one,
4400	.remove = __devexit_p(cciss_remove_one),
4401	.id_table = cciss_pci_device_id,	/* id_table */
4402	.shutdown = cciss_shutdown,
4403};
4404
4405/*
4406 *  This is it.  Register the PCI driver information for the cards we control
4407 *  the OS will call our registered routines when it finds one of our cards.
4408 */
4409static int __init cciss_init(void)
4410{
4411	int err;
4412
4413	/*
4414	 * The hardware requires that commands are aligned on a 64-bit
4415	 * boundary. Given that we use pci_alloc_consistent() to allocate an
4416	 * array of them, the size must be a multiple of 8 bytes.
4417	 */
4418	BUILD_BUG_ON(sizeof(CommandList_struct) % 8);
4419
4420	printk(KERN_INFO DRIVER_NAME "\n");
4421
4422	err = bus_register(&cciss_bus_type);
4423	if (err)
4424		return err;
4425
4426	/* Start the scan thread */
4427	cciss_scan_thread = kthread_run(scan_thread, NULL, "cciss_scan");
4428	if (IS_ERR(cciss_scan_thread)) {
4429		err = PTR_ERR(cciss_scan_thread);
4430		goto err_bus_unregister;
4431	}
4432
4433	/* Register for our PCI devices */
4434	err = pci_register_driver(&cciss_pci_driver);
4435	if (err)
4436		goto err_thread_stop;
4437
4438	return err;
4439
4440err_thread_stop:
4441	kthread_stop(cciss_scan_thread);
4442err_bus_unregister:
4443	bus_unregister(&cciss_bus_type);
4444
4445	return err;
4446}
4447
4448static void __exit cciss_cleanup(void)
4449{
4450	int i;
4451
4452	pci_unregister_driver(&cciss_pci_driver);
4453	/* double check that all controller entrys have been removed */
4454	for (i = 0; i < MAX_CTLR; i++) {
4455		if (hba[i] != NULL) {
4456			printk(KERN_WARNING "cciss: had to remove"
4457			       " controller %d\n", i);
4458			cciss_remove_one(hba[i]->pdev);
4459		}
4460	}
4461	kthread_stop(cciss_scan_thread);
4462	remove_proc_entry("driver/cciss", NULL);
4463	bus_unregister(&cciss_bus_type);
4464}
4465
4466static void fail_all_cmds(unsigned long ctlr)
4467{
4468	/* If we get here, the board is apparently dead. */
4469	ctlr_info_t *h = hba[ctlr];
4470	CommandList_struct *c;
4471	unsigned long flags;
4472
4473	printk(KERN_WARNING "cciss%d: controller not responding.\n", h->ctlr);
4474	h->alive = 0;		/* the controller apparently died... */
4475
4476	spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
4477
4478	pci_disable_device(h->pdev);	/* Make sure it is really dead. */
4479
4480	/* move everything off the request queue onto the completed queue */
4481	while (!hlist_empty(&h->reqQ)) {
4482		c = hlist_entry(h->reqQ.first, CommandList_struct, list);
4483		removeQ(c);
4484		h->Qdepth--;
4485		addQ(&h->cmpQ, c);
4486	}
4487
4488	/* Now, fail everything on the completed queue with a HW error */
4489	while (!hlist_empty(&h->cmpQ)) {
4490		c = hlist_entry(h->cmpQ.first, CommandList_struct, list);
4491		removeQ(c);
4492		if (c->cmd_type != CMD_MSG_STALE)
4493			c->err_info->CommandStatus = CMD_HARDWARE_ERR;
4494		if (c->cmd_type == CMD_RWREQ) {
4495			complete_command(h, c, 0);
4496		} else if (c->cmd_type == CMD_IOCTL_PEND)
4497			complete(c->waiting);
4498#ifdef CONFIG_CISS_SCSI_TAPE
4499		else if (c->cmd_type == CMD_SCSI)
4500			complete_scsi_command(c, 0, 0);
4501#endif
4502	}
4503	spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
4504	return;
4505}
4506
4507module_init(cciss_init);
4508module_exit(cciss_cleanup);
4509