cciss.c revision d18dfad4e2bf6c2d2c5c104d882b14b9fee71b14
1/*
2 *    Disk Array driver for HP Smart Array controllers.
3 *    (C) Copyright 2000, 2007 Hewlett-Packard Development Company, L.P.
4 *
5 *    This program is free software; you can redistribute it and/or modify
6 *    it under the terms of the GNU General Public License as published by
7 *    the Free Software Foundation; version 2 of the License.
8 *
9 *    This program is distributed in the hope that it will be useful,
10 *    but WITHOUT ANY WARRANTY; without even the implied warranty of
11 *    MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 *    General Public License for more details.
13 *
14 *    You should have received a copy of the GNU General Public License
15 *    along with this program; if not, write to the Free Software
16 *    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
17 *    02111-1307, USA.
18 *
19 *    Questions/Comments/Bugfixes to iss_storagedev@hp.com
20 *
21 */
22
23#include <linux/module.h>
24#include <linux/interrupt.h>
25#include <linux/types.h>
26#include <linux/pci.h>
27#include <linux/kernel.h>
28#include <linux/slab.h>
29#include <linux/smp_lock.h>
30#include <linux/delay.h>
31#include <linux/major.h>
32#include <linux/fs.h>
33#include <linux/bio.h>
34#include <linux/blkpg.h>
35#include <linux/timer.h>
36#include <linux/proc_fs.h>
37#include <linux/seq_file.h>
38#include <linux/init.h>
39#include <linux/jiffies.h>
40#include <linux/hdreg.h>
41#include <linux/spinlock.h>
42#include <linux/compat.h>
43#include <linux/mutex.h>
44#include <asm/uaccess.h>
45#include <asm/io.h>
46
47#include <linux/dma-mapping.h>
48#include <linux/blkdev.h>
49#include <linux/genhd.h>
50#include <linux/completion.h>
51#include <scsi/scsi.h>
52#include <scsi/sg.h>
53#include <scsi/scsi_ioctl.h>
54#include <linux/cdrom.h>
55#include <linux/scatterlist.h>
56#include <linux/kthread.h>
57
58#define CCISS_DRIVER_VERSION(maj,min,submin) ((maj<<16)|(min<<8)|(submin))
59#define DRIVER_NAME "HP CISS Driver (v 3.6.26)"
60#define DRIVER_VERSION CCISS_DRIVER_VERSION(3, 6, 26)
61
62/* Embedded module documentation macros - see modules.h */
63MODULE_AUTHOR("Hewlett-Packard Company");
64MODULE_DESCRIPTION("Driver for HP Smart Array Controllers");
65MODULE_SUPPORTED_DEVICE("HP Smart Array Controllers");
66MODULE_VERSION("3.6.26");
67MODULE_LICENSE("GPL");
68
69static int cciss_allow_hpsa;
70module_param(cciss_allow_hpsa, int, S_IRUGO|S_IWUSR);
71MODULE_PARM_DESC(cciss_allow_hpsa,
72	"Prevent cciss driver from accessing hardware known to be "
73	" supported by the hpsa driver");
74
75#include "cciss_cmd.h"
76#include "cciss.h"
77#include <linux/cciss_ioctl.h>
78
79/* define the PCI info for the cards we can control */
80static const struct pci_device_id cciss_pci_device_id[] = {
81	{PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISS,  0x0E11, 0x4070},
82	{PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSB, 0x0E11, 0x4080},
83	{PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSB, 0x0E11, 0x4082},
84	{PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSB, 0x0E11, 0x4083},
85	{PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x4091},
86	{PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x409A},
87	{PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x409B},
88	{PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x409C},
89	{PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x409D},
90	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSA,     0x103C, 0x3225},
91	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3223},
92	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3234},
93	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3235},
94	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3211},
95	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3212},
96	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3213},
97	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3214},
98	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3215},
99	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3237},
100	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x323D},
101	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3241},
102	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3243},
103	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3245},
104	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3247},
105	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3249},
106	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x324A},
107	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x324B},
108	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3250},
109	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3251},
110	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3252},
111	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3253},
112	{PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3254},
113	{0,}
114};
115
116MODULE_DEVICE_TABLE(pci, cciss_pci_device_id);
117
118/*  board_id = Subsystem Device ID & Vendor ID
119 *  product = Marketing Name for the board
120 *  access = Address of the struct of function pointers
121 */
122static struct board_type products[] = {
123	{0x40700E11, "Smart Array 5300", &SA5_access},
124	{0x40800E11, "Smart Array 5i", &SA5B_access},
125	{0x40820E11, "Smart Array 532", &SA5B_access},
126	{0x40830E11, "Smart Array 5312", &SA5B_access},
127	{0x409A0E11, "Smart Array 641", &SA5_access},
128	{0x409B0E11, "Smart Array 642", &SA5_access},
129	{0x409C0E11, "Smart Array 6400", &SA5_access},
130	{0x409D0E11, "Smart Array 6400 EM", &SA5_access},
131	{0x40910E11, "Smart Array 6i", &SA5_access},
132	{0x3225103C, "Smart Array P600", &SA5_access},
133	{0x3235103C, "Smart Array P400i", &SA5_access},
134	{0x3211103C, "Smart Array E200i", &SA5_access},
135	{0x3212103C, "Smart Array E200", &SA5_access},
136	{0x3213103C, "Smart Array E200i", &SA5_access},
137	{0x3214103C, "Smart Array E200i", &SA5_access},
138	{0x3215103C, "Smart Array E200i", &SA5_access},
139	{0x3237103C, "Smart Array E500", &SA5_access},
140/* controllers below this line are also supported by the hpsa driver. */
141#define HPSA_BOUNDARY 0x3223103C
142	{0x3223103C, "Smart Array P800", &SA5_access},
143	{0x3234103C, "Smart Array P400", &SA5_access},
144	{0x323D103C, "Smart Array P700m", &SA5_access},
145	{0x3241103C, "Smart Array P212", &SA5_access},
146	{0x3243103C, "Smart Array P410", &SA5_access},
147	{0x3245103C, "Smart Array P410i", &SA5_access},
148	{0x3247103C, "Smart Array P411", &SA5_access},
149	{0x3249103C, "Smart Array P812", &SA5_access},
150	{0x324A103C, "Smart Array P712m", &SA5_access},
151	{0x324B103C, "Smart Array P711m", &SA5_access},
152	{0x3250103C, "Smart Array", &SA5_access},
153	{0x3251103C, "Smart Array", &SA5_access},
154	{0x3252103C, "Smart Array", &SA5_access},
155	{0x3253103C, "Smart Array", &SA5_access},
156	{0x3254103C, "Smart Array", &SA5_access},
157};
158
159/* How long to wait (in milliseconds) for board to go into simple mode */
160#define MAX_CONFIG_WAIT 30000
161#define MAX_IOCTL_CONFIG_WAIT 1000
162
163/*define how many times we will try a command because of bus resets */
164#define MAX_CMD_RETRIES 3
165
166#define MAX_CTLR	32
167
168/* Originally cciss driver only supports 8 major numbers */
169#define MAX_CTLR_ORIG 	8
170
171static ctlr_info_t *hba[MAX_CTLR];
172
173static struct task_struct *cciss_scan_thread;
174static DEFINE_MUTEX(scan_mutex);
175static LIST_HEAD(scan_q);
176
177static void do_cciss_request(struct request_queue *q);
178static irqreturn_t do_cciss_intx(int irq, void *dev_id);
179static irqreturn_t do_cciss_msix_intr(int irq, void *dev_id);
180static int cciss_open(struct block_device *bdev, fmode_t mode);
181static int cciss_unlocked_open(struct block_device *bdev, fmode_t mode);
182static int cciss_release(struct gendisk *disk, fmode_t mode);
183static int do_ioctl(struct block_device *bdev, fmode_t mode,
184		    unsigned int cmd, unsigned long arg);
185static int cciss_ioctl(struct block_device *bdev, fmode_t mode,
186		       unsigned int cmd, unsigned long arg);
187static int cciss_getgeo(struct block_device *bdev, struct hd_geometry *geo);
188
189static int cciss_revalidate(struct gendisk *disk);
190static int rebuild_lun_table(ctlr_info_t *h, int first_time, int via_ioctl);
191static int deregister_disk(ctlr_info_t *h, int drv_index,
192			   int clear_all, int via_ioctl);
193
194static void cciss_read_capacity(ctlr_info_t *h, int logvol,
195			sector_t *total_size, unsigned int *block_size);
196static void cciss_read_capacity_16(ctlr_info_t *h, int logvol,
197			sector_t *total_size, unsigned int *block_size);
198static void cciss_geometry_inquiry(ctlr_info_t *h, int logvol,
199			sector_t total_size,
200			unsigned int block_size, InquiryData_struct *inq_buff,
201				   drive_info_struct *drv);
202static void __devinit cciss_interrupt_mode(ctlr_info_t *);
203static void start_io(ctlr_info_t *h);
204static int sendcmd_withirq(ctlr_info_t *h, __u8 cmd, void *buff, size_t size,
205			__u8 page_code, unsigned char scsi3addr[],
206			int cmd_type);
207static int sendcmd_withirq_core(ctlr_info_t *h, CommandList_struct *c,
208	int attempt_retry);
209static int process_sendcmd_error(ctlr_info_t *h, CommandList_struct *c);
210
211static int add_to_scan_list(struct ctlr_info *h);
212static int scan_thread(void *data);
213static int check_for_unit_attention(ctlr_info_t *h, CommandList_struct *c);
214static void cciss_hba_release(struct device *dev);
215static void cciss_device_release(struct device *dev);
216static void cciss_free_gendisk(ctlr_info_t *h, int drv_index);
217static void cciss_free_drive_info(ctlr_info_t *h, int drv_index);
218static inline u32 next_command(ctlr_info_t *h);
219static int __devinit cciss_find_cfg_addrs(struct pci_dev *pdev,
220	void __iomem *vaddr, u32 *cfg_base_addr, u64 *cfg_base_addr_index,
221	u64 *cfg_offset);
222static int __devinit cciss_pci_find_memory_BAR(struct pci_dev *pdev,
223	unsigned long *memory_bar);
224
225
226/* performant mode helper functions */
227static void  calc_bucket_map(int *bucket, int num_buckets, int nsgs,
228				int *bucket_map);
229static void cciss_put_controller_into_performant_mode(ctlr_info_t *h);
230
231#ifdef CONFIG_PROC_FS
232static void cciss_procinit(ctlr_info_t *h);
233#else
234static void cciss_procinit(ctlr_info_t *h)
235{
236}
237#endif				/* CONFIG_PROC_FS */
238
239#ifdef CONFIG_COMPAT
240static int cciss_compat_ioctl(struct block_device *, fmode_t,
241			      unsigned, unsigned long);
242#endif
243
244static const struct block_device_operations cciss_fops = {
245	.owner = THIS_MODULE,
246	.open = cciss_unlocked_open,
247	.release = cciss_release,
248	.ioctl = do_ioctl,
249	.getgeo = cciss_getgeo,
250#ifdef CONFIG_COMPAT
251	.compat_ioctl = cciss_compat_ioctl,
252#endif
253	.revalidate_disk = cciss_revalidate,
254};
255
256/* set_performant_mode: Modify the tag for cciss performant
257 * set bit 0 for pull model, bits 3-1 for block fetch
258 * register number
259 */
260static void set_performant_mode(ctlr_info_t *h, CommandList_struct *c)
261{
262	if (likely(h->transMethod == CFGTBL_Trans_Performant))
263		c->busaddr |= 1 | (h->blockFetchTable[c->Header.SGList] << 1);
264}
265
266/*
267 * Enqueuing and dequeuing functions for cmdlists.
268 */
269static inline void addQ(struct hlist_head *list, CommandList_struct *c)
270{
271	hlist_add_head(&c->list, list);
272}
273
274static inline void removeQ(CommandList_struct *c)
275{
276	/*
277	 * After kexec/dump some commands might still
278	 * be in flight, which the firmware will try
279	 * to complete. Resetting the firmware doesn't work
280	 * with old fw revisions, so we have to mark
281	 * them off as 'stale' to prevent the driver from
282	 * falling over.
283	 */
284	if (WARN_ON(hlist_unhashed(&c->list))) {
285		c->cmd_type = CMD_MSG_STALE;
286		return;
287	}
288
289	hlist_del_init(&c->list);
290}
291
292static void enqueue_cmd_and_start_io(ctlr_info_t *h,
293	CommandList_struct *c)
294{
295	unsigned long flags;
296	set_performant_mode(h, c);
297	spin_lock_irqsave(&h->lock, flags);
298	addQ(&h->reqQ, c);
299	h->Qdepth++;
300	start_io(h);
301	spin_unlock_irqrestore(&h->lock, flags);
302}
303
304static void cciss_free_sg_chain_blocks(SGDescriptor_struct **cmd_sg_list,
305	int nr_cmds)
306{
307	int i;
308
309	if (!cmd_sg_list)
310		return;
311	for (i = 0; i < nr_cmds; i++) {
312		kfree(cmd_sg_list[i]);
313		cmd_sg_list[i] = NULL;
314	}
315	kfree(cmd_sg_list);
316}
317
318static SGDescriptor_struct **cciss_allocate_sg_chain_blocks(
319	ctlr_info_t *h, int chainsize, int nr_cmds)
320{
321	int j;
322	SGDescriptor_struct **cmd_sg_list;
323
324	if (chainsize <= 0)
325		return NULL;
326
327	cmd_sg_list = kmalloc(sizeof(*cmd_sg_list) * nr_cmds, GFP_KERNEL);
328	if (!cmd_sg_list)
329		return NULL;
330
331	/* Build up chain blocks for each command */
332	for (j = 0; j < nr_cmds; j++) {
333		/* Need a block of chainsized s/g elements. */
334		cmd_sg_list[j] = kmalloc((chainsize *
335			sizeof(*cmd_sg_list[j])), GFP_KERNEL);
336		if (!cmd_sg_list[j]) {
337			dev_err(&h->pdev->dev, "Cannot get memory "
338				"for s/g chains.\n");
339			goto clean;
340		}
341	}
342	return cmd_sg_list;
343clean:
344	cciss_free_sg_chain_blocks(cmd_sg_list, nr_cmds);
345	return NULL;
346}
347
348static void cciss_unmap_sg_chain_block(ctlr_info_t *h, CommandList_struct *c)
349{
350	SGDescriptor_struct *chain_sg;
351	u64bit temp64;
352
353	if (c->Header.SGTotal <= h->max_cmd_sgentries)
354		return;
355
356	chain_sg = &c->SG[h->max_cmd_sgentries - 1];
357	temp64.val32.lower = chain_sg->Addr.lower;
358	temp64.val32.upper = chain_sg->Addr.upper;
359	pci_unmap_single(h->pdev, temp64.val, chain_sg->Len, PCI_DMA_TODEVICE);
360}
361
362static void cciss_map_sg_chain_block(ctlr_info_t *h, CommandList_struct *c,
363	SGDescriptor_struct *chain_block, int len)
364{
365	SGDescriptor_struct *chain_sg;
366	u64bit temp64;
367
368	chain_sg = &c->SG[h->max_cmd_sgentries - 1];
369	chain_sg->Ext = CCISS_SG_CHAIN;
370	chain_sg->Len = len;
371	temp64.val = pci_map_single(h->pdev, chain_block, len,
372				PCI_DMA_TODEVICE);
373	chain_sg->Addr.lower = temp64.val32.lower;
374	chain_sg->Addr.upper = temp64.val32.upper;
375}
376
377#include "cciss_scsi.c"		/* For SCSI tape support */
378
379static const char *raid_label[] = { "0", "4", "1(1+0)", "5", "5+1", "ADG",
380	"UNKNOWN"
381};
382#define RAID_UNKNOWN (ARRAY_SIZE(raid_label)-1)
383
384#ifdef CONFIG_PROC_FS
385
386/*
387 * Report information about this controller.
388 */
389#define ENG_GIG 1000000000
390#define ENG_GIG_FACTOR (ENG_GIG/512)
391#define ENGAGE_SCSI	"engage scsi"
392
393static struct proc_dir_entry *proc_cciss;
394
395static void cciss_seq_show_header(struct seq_file *seq)
396{
397	ctlr_info_t *h = seq->private;
398
399	seq_printf(seq, "%s: HP %s Controller\n"
400		"Board ID: 0x%08lx\n"
401		"Firmware Version: %c%c%c%c\n"
402		"IRQ: %d\n"
403		"Logical drives: %d\n"
404		"Current Q depth: %d\n"
405		"Current # commands on controller: %d\n"
406		"Max Q depth since init: %d\n"
407		"Max # commands on controller since init: %d\n"
408		"Max SG entries since init: %d\n",
409		h->devname,
410		h->product_name,
411		(unsigned long)h->board_id,
412		h->firm_ver[0], h->firm_ver[1], h->firm_ver[2],
413		h->firm_ver[3], (unsigned int)h->intr[PERF_MODE_INT],
414		h->num_luns,
415		h->Qdepth, h->commands_outstanding,
416		h->maxQsinceinit, h->max_outstanding, h->maxSG);
417
418#ifdef CONFIG_CISS_SCSI_TAPE
419	cciss_seq_tape_report(seq, h);
420#endif /* CONFIG_CISS_SCSI_TAPE */
421}
422
423static void *cciss_seq_start(struct seq_file *seq, loff_t *pos)
424{
425	ctlr_info_t *h = seq->private;
426	unsigned long flags;
427
428	/* prevent displaying bogus info during configuration
429	 * or deconfiguration of a logical volume
430	 */
431	spin_lock_irqsave(&h->lock, flags);
432	if (h->busy_configuring) {
433		spin_unlock_irqrestore(&h->lock, flags);
434		return ERR_PTR(-EBUSY);
435	}
436	h->busy_configuring = 1;
437	spin_unlock_irqrestore(&h->lock, flags);
438
439	if (*pos == 0)
440		cciss_seq_show_header(seq);
441
442	return pos;
443}
444
445static int cciss_seq_show(struct seq_file *seq, void *v)
446{
447	sector_t vol_sz, vol_sz_frac;
448	ctlr_info_t *h = seq->private;
449	unsigned ctlr = h->ctlr;
450	loff_t *pos = v;
451	drive_info_struct *drv = h->drv[*pos];
452
453	if (*pos > h->highest_lun)
454		return 0;
455
456	if (drv == NULL) /* it's possible for h->drv[] to have holes. */
457		return 0;
458
459	if (drv->heads == 0)
460		return 0;
461
462	vol_sz = drv->nr_blocks;
463	vol_sz_frac = sector_div(vol_sz, ENG_GIG_FACTOR);
464	vol_sz_frac *= 100;
465	sector_div(vol_sz_frac, ENG_GIG_FACTOR);
466
467	if (drv->raid_level < 0 || drv->raid_level > RAID_UNKNOWN)
468		drv->raid_level = RAID_UNKNOWN;
469	seq_printf(seq, "cciss/c%dd%d:"
470			"\t%4u.%02uGB\tRAID %s\n",
471			ctlr, (int) *pos, (int)vol_sz, (int)vol_sz_frac,
472			raid_label[drv->raid_level]);
473	return 0;
474}
475
476static void *cciss_seq_next(struct seq_file *seq, void *v, loff_t *pos)
477{
478	ctlr_info_t *h = seq->private;
479
480	if (*pos > h->highest_lun)
481		return NULL;
482	*pos += 1;
483
484	return pos;
485}
486
487static void cciss_seq_stop(struct seq_file *seq, void *v)
488{
489	ctlr_info_t *h = seq->private;
490
491	/* Only reset h->busy_configuring if we succeeded in setting
492	 * it during cciss_seq_start. */
493	if (v == ERR_PTR(-EBUSY))
494		return;
495
496	h->busy_configuring = 0;
497}
498
499static const struct seq_operations cciss_seq_ops = {
500	.start = cciss_seq_start,
501	.show  = cciss_seq_show,
502	.next  = cciss_seq_next,
503	.stop  = cciss_seq_stop,
504};
505
506static int cciss_seq_open(struct inode *inode, struct file *file)
507{
508	int ret = seq_open(file, &cciss_seq_ops);
509	struct seq_file *seq = file->private_data;
510
511	if (!ret)
512		seq->private = PDE(inode)->data;
513
514	return ret;
515}
516
517static ssize_t
518cciss_proc_write(struct file *file, const char __user *buf,
519		 size_t length, loff_t *ppos)
520{
521	int err;
522	char *buffer;
523
524#ifndef CONFIG_CISS_SCSI_TAPE
525	return -EINVAL;
526#endif
527
528	if (!buf || length > PAGE_SIZE - 1)
529		return -EINVAL;
530
531	buffer = (char *)__get_free_page(GFP_KERNEL);
532	if (!buffer)
533		return -ENOMEM;
534
535	err = -EFAULT;
536	if (copy_from_user(buffer, buf, length))
537		goto out;
538	buffer[length] = '\0';
539
540#ifdef CONFIG_CISS_SCSI_TAPE
541	if (strncmp(ENGAGE_SCSI, buffer, sizeof ENGAGE_SCSI - 1) == 0) {
542		struct seq_file *seq = file->private_data;
543		ctlr_info_t *h = seq->private;
544
545		err = cciss_engage_scsi(h);
546		if (err == 0)
547			err = length;
548	} else
549#endif /* CONFIG_CISS_SCSI_TAPE */
550		err = -EINVAL;
551	/* might be nice to have "disengage" too, but it's not
552	   safely possible. (only 1 module use count, lock issues.) */
553
554out:
555	free_page((unsigned long)buffer);
556	return err;
557}
558
559static const struct file_operations cciss_proc_fops = {
560	.owner	 = THIS_MODULE,
561	.open    = cciss_seq_open,
562	.read    = seq_read,
563	.llseek  = seq_lseek,
564	.release = seq_release,
565	.write	 = cciss_proc_write,
566};
567
568static void __devinit cciss_procinit(ctlr_info_t *h)
569{
570	struct proc_dir_entry *pde;
571
572	if (proc_cciss == NULL)
573		proc_cciss = proc_mkdir("driver/cciss", NULL);
574	if (!proc_cciss)
575		return;
576	pde = proc_create_data(h->devname, S_IWUSR | S_IRUSR | S_IRGRP |
577					S_IROTH, proc_cciss,
578					&cciss_proc_fops, h);
579}
580#endif				/* CONFIG_PROC_FS */
581
582#define MAX_PRODUCT_NAME_LEN 19
583
584#define to_hba(n) container_of(n, struct ctlr_info, dev)
585#define to_drv(n) container_of(n, drive_info_struct, dev)
586
587static ssize_t host_store_rescan(struct device *dev,
588				 struct device_attribute *attr,
589				 const char *buf, size_t count)
590{
591	struct ctlr_info *h = to_hba(dev);
592
593	add_to_scan_list(h);
594	wake_up_process(cciss_scan_thread);
595	wait_for_completion_interruptible(&h->scan_wait);
596
597	return count;
598}
599static DEVICE_ATTR(rescan, S_IWUSR, NULL, host_store_rescan);
600
601static ssize_t dev_show_unique_id(struct device *dev,
602				 struct device_attribute *attr,
603				 char *buf)
604{
605	drive_info_struct *drv = to_drv(dev);
606	struct ctlr_info *h = to_hba(drv->dev.parent);
607	__u8 sn[16];
608	unsigned long flags;
609	int ret = 0;
610
611	spin_lock_irqsave(&h->lock, flags);
612	if (h->busy_configuring)
613		ret = -EBUSY;
614	else
615		memcpy(sn, drv->serial_no, sizeof(sn));
616	spin_unlock_irqrestore(&h->lock, flags);
617
618	if (ret)
619		return ret;
620	else
621		return snprintf(buf, 16 * 2 + 2,
622				"%02X%02X%02X%02X%02X%02X%02X%02X"
623				"%02X%02X%02X%02X%02X%02X%02X%02X\n",
624				sn[0], sn[1], sn[2], sn[3],
625				sn[4], sn[5], sn[6], sn[7],
626				sn[8], sn[9], sn[10], sn[11],
627				sn[12], sn[13], sn[14], sn[15]);
628}
629static DEVICE_ATTR(unique_id, S_IRUGO, dev_show_unique_id, NULL);
630
631static ssize_t dev_show_vendor(struct device *dev,
632			       struct device_attribute *attr,
633			       char *buf)
634{
635	drive_info_struct *drv = to_drv(dev);
636	struct ctlr_info *h = to_hba(drv->dev.parent);
637	char vendor[VENDOR_LEN + 1];
638	unsigned long flags;
639	int ret = 0;
640
641	spin_lock_irqsave(&h->lock, flags);
642	if (h->busy_configuring)
643		ret = -EBUSY;
644	else
645		memcpy(vendor, drv->vendor, VENDOR_LEN + 1);
646	spin_unlock_irqrestore(&h->lock, flags);
647
648	if (ret)
649		return ret;
650	else
651		return snprintf(buf, sizeof(vendor) + 1, "%s\n", drv->vendor);
652}
653static DEVICE_ATTR(vendor, S_IRUGO, dev_show_vendor, NULL);
654
655static ssize_t dev_show_model(struct device *dev,
656			      struct device_attribute *attr,
657			      char *buf)
658{
659	drive_info_struct *drv = to_drv(dev);
660	struct ctlr_info *h = to_hba(drv->dev.parent);
661	char model[MODEL_LEN + 1];
662	unsigned long flags;
663	int ret = 0;
664
665	spin_lock_irqsave(&h->lock, flags);
666	if (h->busy_configuring)
667		ret = -EBUSY;
668	else
669		memcpy(model, drv->model, MODEL_LEN + 1);
670	spin_unlock_irqrestore(&h->lock, flags);
671
672	if (ret)
673		return ret;
674	else
675		return snprintf(buf, sizeof(model) + 1, "%s\n", drv->model);
676}
677static DEVICE_ATTR(model, S_IRUGO, dev_show_model, NULL);
678
679static ssize_t dev_show_rev(struct device *dev,
680			    struct device_attribute *attr,
681			    char *buf)
682{
683	drive_info_struct *drv = to_drv(dev);
684	struct ctlr_info *h = to_hba(drv->dev.parent);
685	char rev[REV_LEN + 1];
686	unsigned long flags;
687	int ret = 0;
688
689	spin_lock_irqsave(&h->lock, flags);
690	if (h->busy_configuring)
691		ret = -EBUSY;
692	else
693		memcpy(rev, drv->rev, REV_LEN + 1);
694	spin_unlock_irqrestore(&h->lock, flags);
695
696	if (ret)
697		return ret;
698	else
699		return snprintf(buf, sizeof(rev) + 1, "%s\n", drv->rev);
700}
701static DEVICE_ATTR(rev, S_IRUGO, dev_show_rev, NULL);
702
703static ssize_t cciss_show_lunid(struct device *dev,
704				struct device_attribute *attr, char *buf)
705{
706	drive_info_struct *drv = to_drv(dev);
707	struct ctlr_info *h = to_hba(drv->dev.parent);
708	unsigned long flags;
709	unsigned char lunid[8];
710
711	spin_lock_irqsave(&h->lock, flags);
712	if (h->busy_configuring) {
713		spin_unlock_irqrestore(&h->lock, flags);
714		return -EBUSY;
715	}
716	if (!drv->heads) {
717		spin_unlock_irqrestore(&h->lock, flags);
718		return -ENOTTY;
719	}
720	memcpy(lunid, drv->LunID, sizeof(lunid));
721	spin_unlock_irqrestore(&h->lock, flags);
722	return snprintf(buf, 20, "0x%02x%02x%02x%02x%02x%02x%02x%02x\n",
723		lunid[0], lunid[1], lunid[2], lunid[3],
724		lunid[4], lunid[5], lunid[6], lunid[7]);
725}
726static DEVICE_ATTR(lunid, S_IRUGO, cciss_show_lunid, NULL);
727
728static ssize_t cciss_show_raid_level(struct device *dev,
729				     struct device_attribute *attr, char *buf)
730{
731	drive_info_struct *drv = to_drv(dev);
732	struct ctlr_info *h = to_hba(drv->dev.parent);
733	int raid;
734	unsigned long flags;
735
736	spin_lock_irqsave(&h->lock, flags);
737	if (h->busy_configuring) {
738		spin_unlock_irqrestore(&h->lock, flags);
739		return -EBUSY;
740	}
741	raid = drv->raid_level;
742	spin_unlock_irqrestore(&h->lock, flags);
743	if (raid < 0 || raid > RAID_UNKNOWN)
744		raid = RAID_UNKNOWN;
745
746	return snprintf(buf, strlen(raid_label[raid]) + 7, "RAID %s\n",
747			raid_label[raid]);
748}
749static DEVICE_ATTR(raid_level, S_IRUGO, cciss_show_raid_level, NULL);
750
751static ssize_t cciss_show_usage_count(struct device *dev,
752				      struct device_attribute *attr, char *buf)
753{
754	drive_info_struct *drv = to_drv(dev);
755	struct ctlr_info *h = to_hba(drv->dev.parent);
756	unsigned long flags;
757	int count;
758
759	spin_lock_irqsave(&h->lock, flags);
760	if (h->busy_configuring) {
761		spin_unlock_irqrestore(&h->lock, flags);
762		return -EBUSY;
763	}
764	count = drv->usage_count;
765	spin_unlock_irqrestore(&h->lock, flags);
766	return snprintf(buf, 20, "%d\n", count);
767}
768static DEVICE_ATTR(usage_count, S_IRUGO, cciss_show_usage_count, NULL);
769
770static struct attribute *cciss_host_attrs[] = {
771	&dev_attr_rescan.attr,
772	NULL
773};
774
775static struct attribute_group cciss_host_attr_group = {
776	.attrs = cciss_host_attrs,
777};
778
779static const struct attribute_group *cciss_host_attr_groups[] = {
780	&cciss_host_attr_group,
781	NULL
782};
783
784static struct device_type cciss_host_type = {
785	.name		= "cciss_host",
786	.groups		= cciss_host_attr_groups,
787	.release	= cciss_hba_release,
788};
789
790static struct attribute *cciss_dev_attrs[] = {
791	&dev_attr_unique_id.attr,
792	&dev_attr_model.attr,
793	&dev_attr_vendor.attr,
794	&dev_attr_rev.attr,
795	&dev_attr_lunid.attr,
796	&dev_attr_raid_level.attr,
797	&dev_attr_usage_count.attr,
798	NULL
799};
800
801static struct attribute_group cciss_dev_attr_group = {
802	.attrs = cciss_dev_attrs,
803};
804
805static const struct attribute_group *cciss_dev_attr_groups[] = {
806	&cciss_dev_attr_group,
807	NULL
808};
809
810static struct device_type cciss_dev_type = {
811	.name		= "cciss_device",
812	.groups		= cciss_dev_attr_groups,
813	.release	= cciss_device_release,
814};
815
816static struct bus_type cciss_bus_type = {
817	.name		= "cciss",
818};
819
820/*
821 * cciss_hba_release is called when the reference count
822 * of h->dev goes to zero.
823 */
824static void cciss_hba_release(struct device *dev)
825{
826	/*
827	 * nothing to do, but need this to avoid a warning
828	 * about not having a release handler from lib/kref.c.
829	 */
830}
831
832/*
833 * Initialize sysfs entry for each controller.  This sets up and registers
834 * the 'cciss#' directory for each individual controller under
835 * /sys/bus/pci/devices/<dev>/.
836 */
837static int cciss_create_hba_sysfs_entry(struct ctlr_info *h)
838{
839	device_initialize(&h->dev);
840	h->dev.type = &cciss_host_type;
841	h->dev.bus = &cciss_bus_type;
842	dev_set_name(&h->dev, "%s", h->devname);
843	h->dev.parent = &h->pdev->dev;
844
845	return device_add(&h->dev);
846}
847
848/*
849 * Remove sysfs entries for an hba.
850 */
851static void cciss_destroy_hba_sysfs_entry(struct ctlr_info *h)
852{
853	device_del(&h->dev);
854	put_device(&h->dev); /* final put. */
855}
856
857/* cciss_device_release is called when the reference count
858 * of h->drv[x]dev goes to zero.
859 */
860static void cciss_device_release(struct device *dev)
861{
862	drive_info_struct *drv = to_drv(dev);
863	kfree(drv);
864}
865
866/*
867 * Initialize sysfs for each logical drive.  This sets up and registers
868 * the 'c#d#' directory for each individual logical drive under
869 * /sys/bus/pci/devices/<dev/ccis#/. We also create a link from
870 * /sys/block/cciss!c#d# to this entry.
871 */
872static long cciss_create_ld_sysfs_entry(struct ctlr_info *h,
873				       int drv_index)
874{
875	struct device *dev;
876
877	if (h->drv[drv_index]->device_initialized)
878		return 0;
879
880	dev = &h->drv[drv_index]->dev;
881	device_initialize(dev);
882	dev->type = &cciss_dev_type;
883	dev->bus = &cciss_bus_type;
884	dev_set_name(dev, "c%dd%d", h->ctlr, drv_index);
885	dev->parent = &h->dev;
886	h->drv[drv_index]->device_initialized = 1;
887	return device_add(dev);
888}
889
890/*
891 * Remove sysfs entries for a logical drive.
892 */
893static void cciss_destroy_ld_sysfs_entry(struct ctlr_info *h, int drv_index,
894	int ctlr_exiting)
895{
896	struct device *dev = &h->drv[drv_index]->dev;
897
898	/* special case for c*d0, we only destroy it on controller exit */
899	if (drv_index == 0 && !ctlr_exiting)
900		return;
901
902	device_del(dev);
903	put_device(dev); /* the "final" put. */
904	h->drv[drv_index] = NULL;
905}
906
907/*
908 * For operations that cannot sleep, a command block is allocated at init,
909 * and managed by cmd_alloc() and cmd_free() using a simple bitmap to track
910 * which ones are free or in use.
911 */
912static CommandList_struct *cmd_alloc(ctlr_info_t *h)
913{
914	CommandList_struct *c;
915	int i;
916	u64bit temp64;
917	dma_addr_t cmd_dma_handle, err_dma_handle;
918
919	do {
920		i = find_first_zero_bit(h->cmd_pool_bits, h->nr_cmds);
921		if (i == h->nr_cmds)
922			return NULL;
923	} while (test_and_set_bit(i & (BITS_PER_LONG - 1),
924		  h->cmd_pool_bits + (i / BITS_PER_LONG)) != 0);
925	c = h->cmd_pool + i;
926	memset(c, 0, sizeof(CommandList_struct));
927	cmd_dma_handle = h->cmd_pool_dhandle + i * sizeof(CommandList_struct);
928	c->err_info = h->errinfo_pool + i;
929	memset(c->err_info, 0, sizeof(ErrorInfo_struct));
930	err_dma_handle = h->errinfo_pool_dhandle
931	    + i * sizeof(ErrorInfo_struct);
932	h->nr_allocs++;
933
934	c->cmdindex = i;
935
936	INIT_HLIST_NODE(&c->list);
937	c->busaddr = (__u32) cmd_dma_handle;
938	temp64.val = (__u64) err_dma_handle;
939	c->ErrDesc.Addr.lower = temp64.val32.lower;
940	c->ErrDesc.Addr.upper = temp64.val32.upper;
941	c->ErrDesc.Len = sizeof(ErrorInfo_struct);
942
943	c->ctlr = h->ctlr;
944	return c;
945}
946
947/* allocate a command using pci_alloc_consistent, used for ioctls,
948 * etc., not for the main i/o path.
949 */
950static CommandList_struct *cmd_special_alloc(ctlr_info_t *h)
951{
952	CommandList_struct *c;
953	u64bit temp64;
954	dma_addr_t cmd_dma_handle, err_dma_handle;
955
956	c = (CommandList_struct *) pci_alloc_consistent(h->pdev,
957		sizeof(CommandList_struct), &cmd_dma_handle);
958	if (c == NULL)
959		return NULL;
960	memset(c, 0, sizeof(CommandList_struct));
961
962	c->cmdindex = -1;
963
964	c->err_info = (ErrorInfo_struct *)
965	    pci_alloc_consistent(h->pdev, sizeof(ErrorInfo_struct),
966		    &err_dma_handle);
967
968	if (c->err_info == NULL) {
969		pci_free_consistent(h->pdev,
970			sizeof(CommandList_struct), c, cmd_dma_handle);
971		return NULL;
972	}
973	memset(c->err_info, 0, sizeof(ErrorInfo_struct));
974
975	INIT_HLIST_NODE(&c->list);
976	c->busaddr = (__u32) cmd_dma_handle;
977	temp64.val = (__u64) err_dma_handle;
978	c->ErrDesc.Addr.lower = temp64.val32.lower;
979	c->ErrDesc.Addr.upper = temp64.val32.upper;
980	c->ErrDesc.Len = sizeof(ErrorInfo_struct);
981
982	c->ctlr = h->ctlr;
983	return c;
984}
985
986static void cmd_free(ctlr_info_t *h, CommandList_struct *c)
987{
988	int i;
989
990	i = c - h->cmd_pool;
991	clear_bit(i & (BITS_PER_LONG - 1),
992		  h->cmd_pool_bits + (i / BITS_PER_LONG));
993	h->nr_frees++;
994}
995
996static void cmd_special_free(ctlr_info_t *h, CommandList_struct *c)
997{
998	u64bit temp64;
999
1000	temp64.val32.lower = c->ErrDesc.Addr.lower;
1001	temp64.val32.upper = c->ErrDesc.Addr.upper;
1002	pci_free_consistent(h->pdev, sizeof(ErrorInfo_struct),
1003			    c->err_info, (dma_addr_t) temp64.val);
1004	pci_free_consistent(h->pdev, sizeof(CommandList_struct),
1005			    c, (dma_addr_t) c->busaddr);
1006}
1007
1008static inline ctlr_info_t *get_host(struct gendisk *disk)
1009{
1010	return disk->queue->queuedata;
1011}
1012
1013static inline drive_info_struct *get_drv(struct gendisk *disk)
1014{
1015	return disk->private_data;
1016}
1017
1018/*
1019 * Open.  Make sure the device is really there.
1020 */
1021static int cciss_open(struct block_device *bdev, fmode_t mode)
1022{
1023	ctlr_info_t *h = get_host(bdev->bd_disk);
1024	drive_info_struct *drv = get_drv(bdev->bd_disk);
1025
1026	dev_dbg(&h->pdev->dev, "cciss_open %s\n", bdev->bd_disk->disk_name);
1027	if (drv->busy_configuring)
1028		return -EBUSY;
1029	/*
1030	 * Root is allowed to open raw volume zero even if it's not configured
1031	 * so array config can still work. Root is also allowed to open any
1032	 * volume that has a LUN ID, so it can issue IOCTL to reread the
1033	 * disk information.  I don't think I really like this
1034	 * but I'm already using way to many device nodes to claim another one
1035	 * for "raw controller".
1036	 */
1037	if (drv->heads == 0) {
1038		if (MINOR(bdev->bd_dev) != 0) {	/* not node 0? */
1039			/* if not node 0 make sure it is a partition = 0 */
1040			if (MINOR(bdev->bd_dev) & 0x0f) {
1041				return -ENXIO;
1042				/* if it is, make sure we have a LUN ID */
1043			} else if (memcmp(drv->LunID, CTLR_LUNID,
1044				sizeof(drv->LunID))) {
1045				return -ENXIO;
1046			}
1047		}
1048		if (!capable(CAP_SYS_ADMIN))
1049			return -EPERM;
1050	}
1051	drv->usage_count++;
1052	h->usage_count++;
1053	return 0;
1054}
1055
1056static int cciss_unlocked_open(struct block_device *bdev, fmode_t mode)
1057{
1058	int ret;
1059
1060	lock_kernel();
1061	ret = cciss_open(bdev, mode);
1062	unlock_kernel();
1063
1064	return ret;
1065}
1066
1067/*
1068 * Close.  Sync first.
1069 */
1070static int cciss_release(struct gendisk *disk, fmode_t mode)
1071{
1072	ctlr_info_t *h;
1073	drive_info_struct *drv;
1074
1075	lock_kernel();
1076	h = get_host(disk);
1077	drv = get_drv(disk);
1078	dev_dbg(&h->pdev->dev, "cciss_release %s\n", disk->disk_name);
1079	drv->usage_count--;
1080	h->usage_count--;
1081	unlock_kernel();
1082	return 0;
1083}
1084
1085static int do_ioctl(struct block_device *bdev, fmode_t mode,
1086		    unsigned cmd, unsigned long arg)
1087{
1088	int ret;
1089	lock_kernel();
1090	ret = cciss_ioctl(bdev, mode, cmd, arg);
1091	unlock_kernel();
1092	return ret;
1093}
1094
1095#ifdef CONFIG_COMPAT
1096
1097static int cciss_ioctl32_passthru(struct block_device *bdev, fmode_t mode,
1098				  unsigned cmd, unsigned long arg);
1099static int cciss_ioctl32_big_passthru(struct block_device *bdev, fmode_t mode,
1100				      unsigned cmd, unsigned long arg);
1101
1102static int cciss_compat_ioctl(struct block_device *bdev, fmode_t mode,
1103			      unsigned cmd, unsigned long arg)
1104{
1105	switch (cmd) {
1106	case CCISS_GETPCIINFO:
1107	case CCISS_GETINTINFO:
1108	case CCISS_SETINTINFO:
1109	case CCISS_GETNODENAME:
1110	case CCISS_SETNODENAME:
1111	case CCISS_GETHEARTBEAT:
1112	case CCISS_GETBUSTYPES:
1113	case CCISS_GETFIRMVER:
1114	case CCISS_GETDRIVVER:
1115	case CCISS_REVALIDVOLS:
1116	case CCISS_DEREGDISK:
1117	case CCISS_REGNEWDISK:
1118	case CCISS_REGNEWD:
1119	case CCISS_RESCANDISK:
1120	case CCISS_GETLUNINFO:
1121		return do_ioctl(bdev, mode, cmd, arg);
1122
1123	case CCISS_PASSTHRU32:
1124		return cciss_ioctl32_passthru(bdev, mode, cmd, arg);
1125	case CCISS_BIG_PASSTHRU32:
1126		return cciss_ioctl32_big_passthru(bdev, mode, cmd, arg);
1127
1128	default:
1129		return -ENOIOCTLCMD;
1130	}
1131}
1132
1133static int cciss_ioctl32_passthru(struct block_device *bdev, fmode_t mode,
1134				  unsigned cmd, unsigned long arg)
1135{
1136	IOCTL32_Command_struct __user *arg32 =
1137	    (IOCTL32_Command_struct __user *) arg;
1138	IOCTL_Command_struct arg64;
1139	IOCTL_Command_struct __user *p = compat_alloc_user_space(sizeof(arg64));
1140	int err;
1141	u32 cp;
1142
1143	err = 0;
1144	err |=
1145	    copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
1146			   sizeof(arg64.LUN_info));
1147	err |=
1148	    copy_from_user(&arg64.Request, &arg32->Request,
1149			   sizeof(arg64.Request));
1150	err |=
1151	    copy_from_user(&arg64.error_info, &arg32->error_info,
1152			   sizeof(arg64.error_info));
1153	err |= get_user(arg64.buf_size, &arg32->buf_size);
1154	err |= get_user(cp, &arg32->buf);
1155	arg64.buf = compat_ptr(cp);
1156	err |= copy_to_user(p, &arg64, sizeof(arg64));
1157
1158	if (err)
1159		return -EFAULT;
1160
1161	err = do_ioctl(bdev, mode, CCISS_PASSTHRU, (unsigned long)p);
1162	if (err)
1163		return err;
1164	err |=
1165	    copy_in_user(&arg32->error_info, &p->error_info,
1166			 sizeof(arg32->error_info));
1167	if (err)
1168		return -EFAULT;
1169	return err;
1170}
1171
1172static int cciss_ioctl32_big_passthru(struct block_device *bdev, fmode_t mode,
1173				      unsigned cmd, unsigned long arg)
1174{
1175	BIG_IOCTL32_Command_struct __user *arg32 =
1176	    (BIG_IOCTL32_Command_struct __user *) arg;
1177	BIG_IOCTL_Command_struct arg64;
1178	BIG_IOCTL_Command_struct __user *p =
1179	    compat_alloc_user_space(sizeof(arg64));
1180	int err;
1181	u32 cp;
1182
1183	err = 0;
1184	err |=
1185	    copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
1186			   sizeof(arg64.LUN_info));
1187	err |=
1188	    copy_from_user(&arg64.Request, &arg32->Request,
1189			   sizeof(arg64.Request));
1190	err |=
1191	    copy_from_user(&arg64.error_info, &arg32->error_info,
1192			   sizeof(arg64.error_info));
1193	err |= get_user(arg64.buf_size, &arg32->buf_size);
1194	err |= get_user(arg64.malloc_size, &arg32->malloc_size);
1195	err |= get_user(cp, &arg32->buf);
1196	arg64.buf = compat_ptr(cp);
1197	err |= copy_to_user(p, &arg64, sizeof(arg64));
1198
1199	if (err)
1200		return -EFAULT;
1201
1202	err = do_ioctl(bdev, mode, CCISS_BIG_PASSTHRU, (unsigned long)p);
1203	if (err)
1204		return err;
1205	err |=
1206	    copy_in_user(&arg32->error_info, &p->error_info,
1207			 sizeof(arg32->error_info));
1208	if (err)
1209		return -EFAULT;
1210	return err;
1211}
1212#endif
1213
1214static int cciss_getgeo(struct block_device *bdev, struct hd_geometry *geo)
1215{
1216	drive_info_struct *drv = get_drv(bdev->bd_disk);
1217
1218	if (!drv->cylinders)
1219		return -ENXIO;
1220
1221	geo->heads = drv->heads;
1222	geo->sectors = drv->sectors;
1223	geo->cylinders = drv->cylinders;
1224	return 0;
1225}
1226
1227static void check_ioctl_unit_attention(ctlr_info_t *h, CommandList_struct *c)
1228{
1229	if (c->err_info->CommandStatus == CMD_TARGET_STATUS &&
1230			c->err_info->ScsiStatus != SAM_STAT_CHECK_CONDITION)
1231		(void)check_for_unit_attention(h, c);
1232}
1233
1234static int cciss_getpciinfo(ctlr_info_t *h, void __user *argp)
1235{
1236	cciss_pci_info_struct pciinfo;
1237
1238	if (!argp)
1239		return -EINVAL;
1240	pciinfo.domain = pci_domain_nr(h->pdev->bus);
1241	pciinfo.bus = h->pdev->bus->number;
1242	pciinfo.dev_fn = h->pdev->devfn;
1243	pciinfo.board_id = h->board_id;
1244	if (copy_to_user(argp, &pciinfo, sizeof(cciss_pci_info_struct)))
1245		return -EFAULT;
1246	return 0;
1247}
1248
1249static int cciss_getintinfo(ctlr_info_t *h, void __user *argp)
1250{
1251	cciss_coalint_struct intinfo;
1252
1253	if (!argp)
1254		return -EINVAL;
1255	intinfo.delay = readl(&h->cfgtable->HostWrite.CoalIntDelay);
1256	intinfo.count = readl(&h->cfgtable->HostWrite.CoalIntCount);
1257	if (copy_to_user
1258	    (argp, &intinfo, sizeof(cciss_coalint_struct)))
1259		return -EFAULT;
1260	return 0;
1261}
1262
1263static int cciss_setintinfo(ctlr_info_t *h, void __user *argp)
1264{
1265	cciss_coalint_struct intinfo;
1266	unsigned long flags;
1267	int i;
1268
1269	if (!argp)
1270		return -EINVAL;
1271	if (!capable(CAP_SYS_ADMIN))
1272		return -EPERM;
1273	if (copy_from_user(&intinfo, argp, sizeof(intinfo)))
1274		return -EFAULT;
1275	if ((intinfo.delay == 0) && (intinfo.count == 0))
1276		return -EINVAL;
1277	spin_lock_irqsave(&h->lock, flags);
1278	/* Update the field, and then ring the doorbell */
1279	writel(intinfo.delay, &(h->cfgtable->HostWrite.CoalIntDelay));
1280	writel(intinfo.count, &(h->cfgtable->HostWrite.CoalIntCount));
1281	writel(CFGTBL_ChangeReq, h->vaddr + SA5_DOORBELL);
1282
1283	for (i = 0; i < MAX_IOCTL_CONFIG_WAIT; i++) {
1284		if (!(readl(h->vaddr + SA5_DOORBELL) & CFGTBL_ChangeReq))
1285			break;
1286		udelay(1000); /* delay and try again */
1287	}
1288	spin_unlock_irqrestore(&h->lock, flags);
1289	if (i >= MAX_IOCTL_CONFIG_WAIT)
1290		return -EAGAIN;
1291	return 0;
1292}
1293
1294static int cciss_getnodename(ctlr_info_t *h, void __user *argp)
1295{
1296	NodeName_type NodeName;
1297	int i;
1298
1299	if (!argp)
1300		return -EINVAL;
1301	for (i = 0; i < 16; i++)
1302		NodeName[i] = readb(&h->cfgtable->ServerName[i]);
1303	if (copy_to_user(argp, NodeName, sizeof(NodeName_type)))
1304		return -EFAULT;
1305	return 0;
1306}
1307
1308static int cciss_setnodename(ctlr_info_t *h, void __user *argp)
1309{
1310	NodeName_type NodeName;
1311	unsigned long flags;
1312	int i;
1313
1314	if (!argp)
1315		return -EINVAL;
1316	if (!capable(CAP_SYS_ADMIN))
1317		return -EPERM;
1318	if (copy_from_user(NodeName, argp, sizeof(NodeName_type)))
1319		return -EFAULT;
1320	spin_lock_irqsave(&h->lock, flags);
1321	/* Update the field, and then ring the doorbell */
1322	for (i = 0; i < 16; i++)
1323		writeb(NodeName[i], &h->cfgtable->ServerName[i]);
1324	writel(CFGTBL_ChangeReq, h->vaddr + SA5_DOORBELL);
1325	for (i = 0; i < MAX_IOCTL_CONFIG_WAIT; i++) {
1326		if (!(readl(h->vaddr + SA5_DOORBELL) & CFGTBL_ChangeReq))
1327			break;
1328		udelay(1000); /* delay and try again */
1329	}
1330	spin_unlock_irqrestore(&h->lock, flags);
1331	if (i >= MAX_IOCTL_CONFIG_WAIT)
1332		return -EAGAIN;
1333	return 0;
1334}
1335
1336static int cciss_getheartbeat(ctlr_info_t *h, void __user *argp)
1337{
1338	Heartbeat_type heartbeat;
1339
1340	if (!argp)
1341		return -EINVAL;
1342	heartbeat = readl(&h->cfgtable->HeartBeat);
1343	if (copy_to_user(argp, &heartbeat, sizeof(Heartbeat_type)))
1344		return -EFAULT;
1345	return 0;
1346}
1347
1348static int cciss_getbustypes(ctlr_info_t *h, void __user *argp)
1349{
1350	BusTypes_type BusTypes;
1351
1352	if (!argp)
1353		return -EINVAL;
1354	BusTypes = readl(&h->cfgtable->BusTypes);
1355	if (copy_to_user(argp, &BusTypes, sizeof(BusTypes_type)))
1356		return -EFAULT;
1357	return 0;
1358}
1359
1360static int cciss_ioctl(struct block_device *bdev, fmode_t mode,
1361		       unsigned int cmd, unsigned long arg)
1362{
1363	struct gendisk *disk = bdev->bd_disk;
1364	ctlr_info_t *h = get_host(disk);
1365	drive_info_struct *drv = get_drv(disk);
1366	void __user *argp = (void __user *)arg;
1367
1368	dev_dbg(&h->pdev->dev, "cciss_ioctl: Called with cmd=%x %lx\n",
1369		cmd, arg);
1370	switch (cmd) {
1371	case CCISS_GETPCIINFO:
1372		return cciss_getpciinfo(h, argp);
1373	case CCISS_GETINTINFO:
1374		return cciss_getintinfo(h, argp);
1375	case CCISS_SETINTINFO:
1376		return cciss_setintinfo(h, argp);
1377	case CCISS_GETNODENAME:
1378		return cciss_getnodename(h, argp);
1379	case CCISS_SETNODENAME:
1380		return cciss_setnodename(h, argp);
1381	case CCISS_GETHEARTBEAT:
1382		return cciss_getheartbeat(h, argp);
1383	case CCISS_GETBUSTYPES:
1384		return cciss_getbustypes(h, argp);
1385	case CCISS_GETFIRMVER:
1386		{
1387			FirmwareVer_type firmware;
1388
1389			if (!arg)
1390				return -EINVAL;
1391			memcpy(firmware, h->firm_ver, 4);
1392
1393			if (copy_to_user
1394			    (argp, firmware, sizeof(FirmwareVer_type)))
1395				return -EFAULT;
1396			return 0;
1397		}
1398	case CCISS_GETDRIVVER:
1399		{
1400			DriverVer_type DriverVer = DRIVER_VERSION;
1401
1402			if (!arg)
1403				return -EINVAL;
1404
1405			if (copy_to_user
1406			    (argp, &DriverVer, sizeof(DriverVer_type)))
1407				return -EFAULT;
1408			return 0;
1409		}
1410
1411	case CCISS_DEREGDISK:
1412	case CCISS_REGNEWD:
1413	case CCISS_REVALIDVOLS:
1414		return rebuild_lun_table(h, 0, 1);
1415
1416	case CCISS_GETLUNINFO:{
1417			LogvolInfo_struct luninfo;
1418
1419			memcpy(&luninfo.LunID, drv->LunID,
1420				sizeof(luninfo.LunID));
1421			luninfo.num_opens = drv->usage_count;
1422			luninfo.num_parts = 0;
1423			if (copy_to_user(argp, &luninfo,
1424					 sizeof(LogvolInfo_struct)))
1425				return -EFAULT;
1426			return 0;
1427		}
1428	case CCISS_PASSTHRU:
1429		{
1430			IOCTL_Command_struct iocommand;
1431			CommandList_struct *c;
1432			char *buff = NULL;
1433			u64bit temp64;
1434			DECLARE_COMPLETION_ONSTACK(wait);
1435
1436			if (!arg)
1437				return -EINVAL;
1438
1439			if (!capable(CAP_SYS_RAWIO))
1440				return -EPERM;
1441
1442			if (copy_from_user
1443			    (&iocommand, argp, sizeof(IOCTL_Command_struct)))
1444				return -EFAULT;
1445			if ((iocommand.buf_size < 1) &&
1446			    (iocommand.Request.Type.Direction != XFER_NONE)) {
1447				return -EINVAL;
1448			}
1449#if 0				/* 'buf_size' member is 16-bits, and always smaller than kmalloc limit */
1450			/* Check kmalloc limits */
1451			if (iocommand.buf_size > 128000)
1452				return -EINVAL;
1453#endif
1454			if (iocommand.buf_size > 0) {
1455				buff = kmalloc(iocommand.buf_size, GFP_KERNEL);
1456				if (buff == NULL)
1457					return -EFAULT;
1458			}
1459			if (iocommand.Request.Type.Direction == XFER_WRITE) {
1460				/* Copy the data into the buffer we created */
1461				if (copy_from_user
1462				    (buff, iocommand.buf, iocommand.buf_size)) {
1463					kfree(buff);
1464					return -EFAULT;
1465				}
1466			} else {
1467				memset(buff, 0, iocommand.buf_size);
1468			}
1469			c = cmd_special_alloc(h);
1470			if (!c) {
1471				kfree(buff);
1472				return -ENOMEM;
1473			}
1474			/* Fill in the command type */
1475			c->cmd_type = CMD_IOCTL_PEND;
1476			/* Fill in Command Header */
1477			c->Header.ReplyQueue = 0;   /* unused in simple mode */
1478			if (iocommand.buf_size > 0) /* buffer to fill */
1479			{
1480				c->Header.SGList = 1;
1481				c->Header.SGTotal = 1;
1482			} else /* no buffers to fill */
1483			{
1484				c->Header.SGList = 0;
1485				c->Header.SGTotal = 0;
1486			}
1487			c->Header.LUN = iocommand.LUN_info;
1488			/* use the kernel address the cmd block for tag */
1489			c->Header.Tag.lower = c->busaddr;
1490
1491			/* Fill in Request block */
1492			c->Request = iocommand.Request;
1493
1494			/* Fill in the scatter gather information */
1495			if (iocommand.buf_size > 0) {
1496				temp64.val = pci_map_single(h->pdev, buff,
1497					iocommand.buf_size,
1498					PCI_DMA_BIDIRECTIONAL);
1499				c->SG[0].Addr.lower = temp64.val32.lower;
1500				c->SG[0].Addr.upper = temp64.val32.upper;
1501				c->SG[0].Len = iocommand.buf_size;
1502				c->SG[0].Ext = 0;  /* we are not chaining */
1503			}
1504			c->waiting = &wait;
1505
1506			enqueue_cmd_and_start_io(h, c);
1507			wait_for_completion(&wait);
1508
1509			/* unlock the buffers from DMA */
1510			temp64.val32.lower = c->SG[0].Addr.lower;
1511			temp64.val32.upper = c->SG[0].Addr.upper;
1512			pci_unmap_single(h->pdev, (dma_addr_t) temp64.val,
1513					 iocommand.buf_size,
1514					 PCI_DMA_BIDIRECTIONAL);
1515
1516			check_ioctl_unit_attention(h, c);
1517
1518			/* Copy the error information out */
1519			iocommand.error_info = *(c->err_info);
1520			if (copy_to_user
1521			    (argp, &iocommand, sizeof(IOCTL_Command_struct))) {
1522				kfree(buff);
1523				cmd_special_free(h, c);
1524				return -EFAULT;
1525			}
1526
1527			if (iocommand.Request.Type.Direction == XFER_READ) {
1528				/* Copy the data out of the buffer we created */
1529				if (copy_to_user
1530				    (iocommand.buf, buff, iocommand.buf_size)) {
1531					kfree(buff);
1532					cmd_special_free(h, c);
1533					return -EFAULT;
1534				}
1535			}
1536			kfree(buff);
1537			cmd_special_free(h, c);
1538			return 0;
1539		}
1540	case CCISS_BIG_PASSTHRU:{
1541			BIG_IOCTL_Command_struct *ioc;
1542			CommandList_struct *c;
1543			unsigned char **buff = NULL;
1544			int *buff_size = NULL;
1545			u64bit temp64;
1546			BYTE sg_used = 0;
1547			int status = 0;
1548			int i;
1549			DECLARE_COMPLETION_ONSTACK(wait);
1550			__u32 left;
1551			__u32 sz;
1552			BYTE __user *data_ptr;
1553
1554			if (!arg)
1555				return -EINVAL;
1556			if (!capable(CAP_SYS_RAWIO))
1557				return -EPERM;
1558			ioc = (BIG_IOCTL_Command_struct *)
1559			    kmalloc(sizeof(*ioc), GFP_KERNEL);
1560			if (!ioc) {
1561				status = -ENOMEM;
1562				goto cleanup1;
1563			}
1564			if (copy_from_user(ioc, argp, sizeof(*ioc))) {
1565				status = -EFAULT;
1566				goto cleanup1;
1567			}
1568			if ((ioc->buf_size < 1) &&
1569			    (ioc->Request.Type.Direction != XFER_NONE)) {
1570				status = -EINVAL;
1571				goto cleanup1;
1572			}
1573			/* Check kmalloc limits  using all SGs */
1574			if (ioc->malloc_size > MAX_KMALLOC_SIZE) {
1575				status = -EINVAL;
1576				goto cleanup1;
1577			}
1578			if (ioc->buf_size > ioc->malloc_size * MAXSGENTRIES) {
1579				status = -EINVAL;
1580				goto cleanup1;
1581			}
1582			buff =
1583			    kzalloc(MAXSGENTRIES * sizeof(char *), GFP_KERNEL);
1584			if (!buff) {
1585				status = -ENOMEM;
1586				goto cleanup1;
1587			}
1588			buff_size = kmalloc(MAXSGENTRIES * sizeof(int),
1589						   GFP_KERNEL);
1590			if (!buff_size) {
1591				status = -ENOMEM;
1592				goto cleanup1;
1593			}
1594			left = ioc->buf_size;
1595			data_ptr = ioc->buf;
1596			while (left) {
1597				sz = (left >
1598				      ioc->malloc_size) ? ioc->
1599				    malloc_size : left;
1600				buff_size[sg_used] = sz;
1601				buff[sg_used] = kmalloc(sz, GFP_KERNEL);
1602				if (buff[sg_used] == NULL) {
1603					status = -ENOMEM;
1604					goto cleanup1;
1605				}
1606				if (ioc->Request.Type.Direction == XFER_WRITE) {
1607					if (copy_from_user
1608					    (buff[sg_used], data_ptr, sz)) {
1609						status = -EFAULT;
1610						goto cleanup1;
1611					}
1612				} else {
1613					memset(buff[sg_used], 0, sz);
1614				}
1615				left -= sz;
1616				data_ptr += sz;
1617				sg_used++;
1618			}
1619			c = cmd_special_alloc(h);
1620			if (!c) {
1621				status = -ENOMEM;
1622				goto cleanup1;
1623			}
1624			c->cmd_type = CMD_IOCTL_PEND;
1625			c->Header.ReplyQueue = 0;
1626
1627			if (ioc->buf_size > 0) {
1628				c->Header.SGList = sg_used;
1629				c->Header.SGTotal = sg_used;
1630			} else {
1631				c->Header.SGList = 0;
1632				c->Header.SGTotal = 0;
1633			}
1634			c->Header.LUN = ioc->LUN_info;
1635			c->Header.Tag.lower = c->busaddr;
1636
1637			c->Request = ioc->Request;
1638			if (ioc->buf_size > 0) {
1639				for (i = 0; i < sg_used; i++) {
1640					temp64.val =
1641					    pci_map_single(h->pdev, buff[i],
1642						    buff_size[i],
1643						    PCI_DMA_BIDIRECTIONAL);
1644					c->SG[i].Addr.lower =
1645					    temp64.val32.lower;
1646					c->SG[i].Addr.upper =
1647					    temp64.val32.upper;
1648					c->SG[i].Len = buff_size[i];
1649					c->SG[i].Ext = 0;	/* we are not chaining */
1650				}
1651			}
1652			c->waiting = &wait;
1653			enqueue_cmd_and_start_io(h, c);
1654			wait_for_completion(&wait);
1655			/* unlock the buffers from DMA */
1656			for (i = 0; i < sg_used; i++) {
1657				temp64.val32.lower = c->SG[i].Addr.lower;
1658				temp64.val32.upper = c->SG[i].Addr.upper;
1659				pci_unmap_single(h->pdev,
1660					(dma_addr_t) temp64.val, buff_size[i],
1661					PCI_DMA_BIDIRECTIONAL);
1662			}
1663			check_ioctl_unit_attention(h, c);
1664			/* Copy the error information out */
1665			ioc->error_info = *(c->err_info);
1666			if (copy_to_user(argp, ioc, sizeof(*ioc))) {
1667				cmd_special_free(h, c);
1668				status = -EFAULT;
1669				goto cleanup1;
1670			}
1671			if (ioc->Request.Type.Direction == XFER_READ) {
1672				/* Copy the data out of the buffer we created */
1673				BYTE __user *ptr = ioc->buf;
1674				for (i = 0; i < sg_used; i++) {
1675					if (copy_to_user
1676					    (ptr, buff[i], buff_size[i])) {
1677						cmd_special_free(h, c);
1678						status = -EFAULT;
1679						goto cleanup1;
1680					}
1681					ptr += buff_size[i];
1682				}
1683			}
1684			cmd_special_free(h, c);
1685			status = 0;
1686		      cleanup1:
1687			if (buff) {
1688				for (i = 0; i < sg_used; i++)
1689					kfree(buff[i]);
1690				kfree(buff);
1691			}
1692			kfree(buff_size);
1693			kfree(ioc);
1694			return status;
1695		}
1696
1697	/* scsi_cmd_ioctl handles these, below, though some are not */
1698	/* very meaningful for cciss.  SG_IO is the main one people want. */
1699
1700	case SG_GET_VERSION_NUM:
1701	case SG_SET_TIMEOUT:
1702	case SG_GET_TIMEOUT:
1703	case SG_GET_RESERVED_SIZE:
1704	case SG_SET_RESERVED_SIZE:
1705	case SG_EMULATED_HOST:
1706	case SG_IO:
1707	case SCSI_IOCTL_SEND_COMMAND:
1708		return scsi_cmd_ioctl(disk->queue, disk, mode, cmd, argp);
1709
1710	/* scsi_cmd_ioctl would normally handle these, below, but */
1711	/* they aren't a good fit for cciss, as CD-ROMs are */
1712	/* not supported, and we don't have any bus/target/lun */
1713	/* which we present to the kernel. */
1714
1715	case CDROM_SEND_PACKET:
1716	case CDROMCLOSETRAY:
1717	case CDROMEJECT:
1718	case SCSI_IOCTL_GET_IDLUN:
1719	case SCSI_IOCTL_GET_BUS_NUMBER:
1720	default:
1721		return -ENOTTY;
1722	}
1723}
1724
1725static void cciss_check_queues(ctlr_info_t *h)
1726{
1727	int start_queue = h->next_to_run;
1728	int i;
1729
1730	/* check to see if we have maxed out the number of commands that can
1731	 * be placed on the queue.  If so then exit.  We do this check here
1732	 * in case the interrupt we serviced was from an ioctl and did not
1733	 * free any new commands.
1734	 */
1735	if ((find_first_zero_bit(h->cmd_pool_bits, h->nr_cmds)) == h->nr_cmds)
1736		return;
1737
1738	/* We have room on the queue for more commands.  Now we need to queue
1739	 * them up.  We will also keep track of the next queue to run so
1740	 * that every queue gets a chance to be started first.
1741	 */
1742	for (i = 0; i < h->highest_lun + 1; i++) {
1743		int curr_queue = (start_queue + i) % (h->highest_lun + 1);
1744		/* make sure the disk has been added and the drive is real
1745		 * because this can be called from the middle of init_one.
1746		 */
1747		if (!h->drv[curr_queue])
1748			continue;
1749		if (!(h->drv[curr_queue]->queue) ||
1750			!(h->drv[curr_queue]->heads))
1751			continue;
1752		blk_start_queue(h->gendisk[curr_queue]->queue);
1753
1754		/* check to see if we have maxed out the number of commands
1755		 * that can be placed on the queue.
1756		 */
1757		if ((find_first_zero_bit(h->cmd_pool_bits, h->nr_cmds)) == h->nr_cmds) {
1758			if (curr_queue == start_queue) {
1759				h->next_to_run =
1760				    (start_queue + 1) % (h->highest_lun + 1);
1761				break;
1762			} else {
1763				h->next_to_run = curr_queue;
1764				break;
1765			}
1766		}
1767	}
1768}
1769
1770static void cciss_softirq_done(struct request *rq)
1771{
1772	CommandList_struct *c = rq->completion_data;
1773	ctlr_info_t *h = hba[c->ctlr];
1774	SGDescriptor_struct *curr_sg = c->SG;
1775	u64bit temp64;
1776	unsigned long flags;
1777	int i, ddir;
1778	int sg_index = 0;
1779
1780	if (c->Request.Type.Direction == XFER_READ)
1781		ddir = PCI_DMA_FROMDEVICE;
1782	else
1783		ddir = PCI_DMA_TODEVICE;
1784
1785	/* command did not need to be retried */
1786	/* unmap the DMA mapping for all the scatter gather elements */
1787	for (i = 0; i < c->Header.SGList; i++) {
1788		if (curr_sg[sg_index].Ext == CCISS_SG_CHAIN) {
1789			cciss_unmap_sg_chain_block(h, c);
1790			/* Point to the next block */
1791			curr_sg = h->cmd_sg_list[c->cmdindex];
1792			sg_index = 0;
1793		}
1794		temp64.val32.lower = curr_sg[sg_index].Addr.lower;
1795		temp64.val32.upper = curr_sg[sg_index].Addr.upper;
1796		pci_unmap_page(h->pdev, temp64.val, curr_sg[sg_index].Len,
1797				ddir);
1798		++sg_index;
1799	}
1800
1801	dev_dbg(&h->pdev->dev, "Done with %p\n", rq);
1802
1803	/* set the residual count for pc requests */
1804	if (rq->cmd_type == REQ_TYPE_BLOCK_PC)
1805		rq->resid_len = c->err_info->ResidualCnt;
1806
1807	blk_end_request_all(rq, (rq->errors == 0) ? 0 : -EIO);
1808
1809	spin_lock_irqsave(&h->lock, flags);
1810	cmd_free(h, c);
1811	cciss_check_queues(h);
1812	spin_unlock_irqrestore(&h->lock, flags);
1813}
1814
1815static inline void log_unit_to_scsi3addr(ctlr_info_t *h,
1816	unsigned char scsi3addr[], uint32_t log_unit)
1817{
1818	memcpy(scsi3addr, h->drv[log_unit]->LunID,
1819		sizeof(h->drv[log_unit]->LunID));
1820}
1821
1822/* This function gets the SCSI vendor, model, and revision of a logical drive
1823 * via the inquiry page 0.  Model, vendor, and rev are set to empty strings if
1824 * they cannot be read.
1825 */
1826static void cciss_get_device_descr(ctlr_info_t *h, int logvol,
1827				   char *vendor, char *model, char *rev)
1828{
1829	int rc;
1830	InquiryData_struct *inq_buf;
1831	unsigned char scsi3addr[8];
1832
1833	*vendor = '\0';
1834	*model = '\0';
1835	*rev = '\0';
1836
1837	inq_buf = kzalloc(sizeof(InquiryData_struct), GFP_KERNEL);
1838	if (!inq_buf)
1839		return;
1840
1841	log_unit_to_scsi3addr(h, scsi3addr, logvol);
1842	rc = sendcmd_withirq(h, CISS_INQUIRY, inq_buf, sizeof(*inq_buf), 0,
1843			scsi3addr, TYPE_CMD);
1844	if (rc == IO_OK) {
1845		memcpy(vendor, &inq_buf->data_byte[8], VENDOR_LEN);
1846		vendor[VENDOR_LEN] = '\0';
1847		memcpy(model, &inq_buf->data_byte[16], MODEL_LEN);
1848		model[MODEL_LEN] = '\0';
1849		memcpy(rev, &inq_buf->data_byte[32], REV_LEN);
1850		rev[REV_LEN] = '\0';
1851	}
1852
1853	kfree(inq_buf);
1854	return;
1855}
1856
1857/* This function gets the serial number of a logical drive via
1858 * inquiry page 0x83.  Serial no. is 16 bytes.  If the serial
1859 * number cannot be had, for whatever reason, 16 bytes of 0xff
1860 * are returned instead.
1861 */
1862static void cciss_get_serial_no(ctlr_info_t *h, int logvol,
1863				unsigned char *serial_no, int buflen)
1864{
1865#define PAGE_83_INQ_BYTES 64
1866	int rc;
1867	unsigned char *buf;
1868	unsigned char scsi3addr[8];
1869
1870	if (buflen > 16)
1871		buflen = 16;
1872	memset(serial_no, 0xff, buflen);
1873	buf = kzalloc(PAGE_83_INQ_BYTES, GFP_KERNEL);
1874	if (!buf)
1875		return;
1876	memset(serial_no, 0, buflen);
1877	log_unit_to_scsi3addr(h, scsi3addr, logvol);
1878	rc = sendcmd_withirq(h, CISS_INQUIRY, buf,
1879		PAGE_83_INQ_BYTES, 0x83, scsi3addr, TYPE_CMD);
1880	if (rc == IO_OK)
1881		memcpy(serial_no, &buf[8], buflen);
1882	kfree(buf);
1883	return;
1884}
1885
1886/*
1887 * cciss_add_disk sets up the block device queue for a logical drive
1888 */
1889static int cciss_add_disk(ctlr_info_t *h, struct gendisk *disk,
1890				int drv_index)
1891{
1892	disk->queue = blk_init_queue(do_cciss_request, &h->lock);
1893	if (!disk->queue)
1894		goto init_queue_failure;
1895	sprintf(disk->disk_name, "cciss/c%dd%d", h->ctlr, drv_index);
1896	disk->major = h->major;
1897	disk->first_minor = drv_index << NWD_SHIFT;
1898	disk->fops = &cciss_fops;
1899	if (cciss_create_ld_sysfs_entry(h, drv_index))
1900		goto cleanup_queue;
1901	disk->private_data = h->drv[drv_index];
1902	disk->driverfs_dev = &h->drv[drv_index]->dev;
1903
1904	/* Set up queue information */
1905	blk_queue_bounce_limit(disk->queue, h->pdev->dma_mask);
1906
1907	/* This is a hardware imposed limit. */
1908	blk_queue_max_segments(disk->queue, h->maxsgentries);
1909
1910	blk_queue_max_hw_sectors(disk->queue, h->cciss_max_sectors);
1911
1912	blk_queue_softirq_done(disk->queue, cciss_softirq_done);
1913
1914	disk->queue->queuedata = h;
1915
1916	blk_queue_logical_block_size(disk->queue,
1917				     h->drv[drv_index]->block_size);
1918
1919	/* Make sure all queue data is written out before */
1920	/* setting h->drv[drv_index]->queue, as setting this */
1921	/* allows the interrupt handler to start the queue */
1922	wmb();
1923	h->drv[drv_index]->queue = disk->queue;
1924	add_disk(disk);
1925	return 0;
1926
1927cleanup_queue:
1928	blk_cleanup_queue(disk->queue);
1929	disk->queue = NULL;
1930init_queue_failure:
1931	return -1;
1932}
1933
1934/* This function will check the usage_count of the drive to be updated/added.
1935 * If the usage_count is zero and it is a heretofore unknown drive, or,
1936 * the drive's capacity, geometry, or serial number has changed,
1937 * then the drive information will be updated and the disk will be
1938 * re-registered with the kernel.  If these conditions don't hold,
1939 * then it will be left alone for the next reboot.  The exception to this
1940 * is disk 0 which will always be left registered with the kernel since it
1941 * is also the controller node.  Any changes to disk 0 will show up on
1942 * the next reboot.
1943 */
1944static void cciss_update_drive_info(ctlr_info_t *h, int drv_index,
1945	int first_time, int via_ioctl)
1946{
1947	struct gendisk *disk;
1948	InquiryData_struct *inq_buff = NULL;
1949	unsigned int block_size;
1950	sector_t total_size;
1951	unsigned long flags = 0;
1952	int ret = 0;
1953	drive_info_struct *drvinfo;
1954
1955	/* Get information about the disk and modify the driver structure */
1956	inq_buff = kmalloc(sizeof(InquiryData_struct), GFP_KERNEL);
1957	drvinfo = kzalloc(sizeof(*drvinfo), GFP_KERNEL);
1958	if (inq_buff == NULL || drvinfo == NULL)
1959		goto mem_msg;
1960
1961	/* testing to see if 16-byte CDBs are already being used */
1962	if (h->cciss_read == CCISS_READ_16) {
1963		cciss_read_capacity_16(h, drv_index,
1964			&total_size, &block_size);
1965
1966	} else {
1967		cciss_read_capacity(h, drv_index, &total_size, &block_size);
1968		/* if read_capacity returns all F's this volume is >2TB */
1969		/* in size so we switch to 16-byte CDB's for all */
1970		/* read/write ops */
1971		if (total_size == 0xFFFFFFFFULL) {
1972			cciss_read_capacity_16(h, drv_index,
1973			&total_size, &block_size);
1974			h->cciss_read = CCISS_READ_16;
1975			h->cciss_write = CCISS_WRITE_16;
1976		} else {
1977			h->cciss_read = CCISS_READ_10;
1978			h->cciss_write = CCISS_WRITE_10;
1979		}
1980	}
1981
1982	cciss_geometry_inquiry(h, drv_index, total_size, block_size,
1983			       inq_buff, drvinfo);
1984	drvinfo->block_size = block_size;
1985	drvinfo->nr_blocks = total_size + 1;
1986
1987	cciss_get_device_descr(h, drv_index, drvinfo->vendor,
1988				drvinfo->model, drvinfo->rev);
1989	cciss_get_serial_no(h, drv_index, drvinfo->serial_no,
1990			sizeof(drvinfo->serial_no));
1991	/* Save the lunid in case we deregister the disk, below. */
1992	memcpy(drvinfo->LunID, h->drv[drv_index]->LunID,
1993		sizeof(drvinfo->LunID));
1994
1995	/* Is it the same disk we already know, and nothing's changed? */
1996	if (h->drv[drv_index]->raid_level != -1 &&
1997		((memcmp(drvinfo->serial_no,
1998				h->drv[drv_index]->serial_no, 16) == 0) &&
1999		drvinfo->block_size == h->drv[drv_index]->block_size &&
2000		drvinfo->nr_blocks == h->drv[drv_index]->nr_blocks &&
2001		drvinfo->heads == h->drv[drv_index]->heads &&
2002		drvinfo->sectors == h->drv[drv_index]->sectors &&
2003		drvinfo->cylinders == h->drv[drv_index]->cylinders))
2004			/* The disk is unchanged, nothing to update */
2005			goto freeret;
2006
2007	/* If we get here it's not the same disk, or something's changed,
2008	 * so we need to * deregister it, and re-register it, if it's not
2009	 * in use.
2010	 * If the disk already exists then deregister it before proceeding
2011	 * (unless it's the first disk (for the controller node).
2012	 */
2013	if (h->drv[drv_index]->raid_level != -1 && drv_index != 0) {
2014		dev_warn(&h->pdev->dev, "disk %d has changed.\n", drv_index);
2015		spin_lock_irqsave(&h->lock, flags);
2016		h->drv[drv_index]->busy_configuring = 1;
2017		spin_unlock_irqrestore(&h->lock, flags);
2018
2019		/* deregister_disk sets h->drv[drv_index]->queue = NULL
2020		 * which keeps the interrupt handler from starting
2021		 * the queue.
2022		 */
2023		ret = deregister_disk(h, drv_index, 0, via_ioctl);
2024	}
2025
2026	/* If the disk is in use return */
2027	if (ret)
2028		goto freeret;
2029
2030	/* Save the new information from cciss_geometry_inquiry
2031	 * and serial number inquiry.  If the disk was deregistered
2032	 * above, then h->drv[drv_index] will be NULL.
2033	 */
2034	if (h->drv[drv_index] == NULL) {
2035		drvinfo->device_initialized = 0;
2036		h->drv[drv_index] = drvinfo;
2037		drvinfo = NULL; /* so it won't be freed below. */
2038	} else {
2039		/* special case for cxd0 */
2040		h->drv[drv_index]->block_size = drvinfo->block_size;
2041		h->drv[drv_index]->nr_blocks = drvinfo->nr_blocks;
2042		h->drv[drv_index]->heads = drvinfo->heads;
2043		h->drv[drv_index]->sectors = drvinfo->sectors;
2044		h->drv[drv_index]->cylinders = drvinfo->cylinders;
2045		h->drv[drv_index]->raid_level = drvinfo->raid_level;
2046		memcpy(h->drv[drv_index]->serial_no, drvinfo->serial_no, 16);
2047		memcpy(h->drv[drv_index]->vendor, drvinfo->vendor,
2048			VENDOR_LEN + 1);
2049		memcpy(h->drv[drv_index]->model, drvinfo->model, MODEL_LEN + 1);
2050		memcpy(h->drv[drv_index]->rev, drvinfo->rev, REV_LEN + 1);
2051	}
2052
2053	++h->num_luns;
2054	disk = h->gendisk[drv_index];
2055	set_capacity(disk, h->drv[drv_index]->nr_blocks);
2056
2057	/* If it's not disk 0 (drv_index != 0)
2058	 * or if it was disk 0, but there was previously
2059	 * no actual corresponding configured logical drive
2060	 * (raid_leve == -1) then we want to update the
2061	 * logical drive's information.
2062	 */
2063	if (drv_index || first_time) {
2064		if (cciss_add_disk(h, disk, drv_index) != 0) {
2065			cciss_free_gendisk(h, drv_index);
2066			cciss_free_drive_info(h, drv_index);
2067			dev_warn(&h->pdev->dev, "could not update disk %d\n",
2068				drv_index);
2069			--h->num_luns;
2070		}
2071	}
2072
2073freeret:
2074	kfree(inq_buff);
2075	kfree(drvinfo);
2076	return;
2077mem_msg:
2078	dev_err(&h->pdev->dev, "out of memory\n");
2079	goto freeret;
2080}
2081
2082/* This function will find the first index of the controllers drive array
2083 * that has a null drv pointer and allocate the drive info struct and
2084 * will return that index   This is where new drives will be added.
2085 * If the index to be returned is greater than the highest_lun index for
2086 * the controller then highest_lun is set * to this new index.
2087 * If there are no available indexes or if tha allocation fails, then -1
2088 * is returned.  * "controller_node" is used to know if this is a real
2089 * logical drive, or just the controller node, which determines if this
2090 * counts towards highest_lun.
2091 */
2092static int cciss_alloc_drive_info(ctlr_info_t *h, int controller_node)
2093{
2094	int i;
2095	drive_info_struct *drv;
2096
2097	/* Search for an empty slot for our drive info */
2098	for (i = 0; i < CISS_MAX_LUN; i++) {
2099
2100		/* if not cxd0 case, and it's occupied, skip it. */
2101		if (h->drv[i] && i != 0)
2102			continue;
2103		/*
2104		 * If it's cxd0 case, and drv is alloc'ed already, and a
2105		 * disk is configured there, skip it.
2106		 */
2107		if (i == 0 && h->drv[i] && h->drv[i]->raid_level != -1)
2108			continue;
2109
2110		/*
2111		 * We've found an empty slot.  Update highest_lun
2112		 * provided this isn't just the fake cxd0 controller node.
2113		 */
2114		if (i > h->highest_lun && !controller_node)
2115			h->highest_lun = i;
2116
2117		/* If adding a real disk at cxd0, and it's already alloc'ed */
2118		if (i == 0 && h->drv[i] != NULL)
2119			return i;
2120
2121		/*
2122		 * Found an empty slot, not already alloc'ed.  Allocate it.
2123		 * Mark it with raid_level == -1, so we know it's new later on.
2124		 */
2125		drv = kzalloc(sizeof(*drv), GFP_KERNEL);
2126		if (!drv)
2127			return -1;
2128		drv->raid_level = -1; /* so we know it's new */
2129		h->drv[i] = drv;
2130		return i;
2131	}
2132	return -1;
2133}
2134
2135static void cciss_free_drive_info(ctlr_info_t *h, int drv_index)
2136{
2137	kfree(h->drv[drv_index]);
2138	h->drv[drv_index] = NULL;
2139}
2140
2141static void cciss_free_gendisk(ctlr_info_t *h, int drv_index)
2142{
2143	put_disk(h->gendisk[drv_index]);
2144	h->gendisk[drv_index] = NULL;
2145}
2146
2147/* cciss_add_gendisk finds a free hba[]->drv structure
2148 * and allocates a gendisk if needed, and sets the lunid
2149 * in the drvinfo structure.   It returns the index into
2150 * the ->drv[] array, or -1 if none are free.
2151 * is_controller_node indicates whether highest_lun should
2152 * count this disk, or if it's only being added to provide
2153 * a means to talk to the controller in case no logical
2154 * drives have yet been configured.
2155 */
2156static int cciss_add_gendisk(ctlr_info_t *h, unsigned char lunid[],
2157	int controller_node)
2158{
2159	int drv_index;
2160
2161	drv_index = cciss_alloc_drive_info(h, controller_node);
2162	if (drv_index == -1)
2163		return -1;
2164
2165	/*Check if the gendisk needs to be allocated */
2166	if (!h->gendisk[drv_index]) {
2167		h->gendisk[drv_index] =
2168			alloc_disk(1 << NWD_SHIFT);
2169		if (!h->gendisk[drv_index]) {
2170			dev_err(&h->pdev->dev,
2171				"could not allocate a new disk %d\n",
2172				drv_index);
2173			goto err_free_drive_info;
2174		}
2175	}
2176	memcpy(h->drv[drv_index]->LunID, lunid,
2177		sizeof(h->drv[drv_index]->LunID));
2178	if (cciss_create_ld_sysfs_entry(h, drv_index))
2179		goto err_free_disk;
2180	/* Don't need to mark this busy because nobody */
2181	/* else knows about this disk yet to contend */
2182	/* for access to it. */
2183	h->drv[drv_index]->busy_configuring = 0;
2184	wmb();
2185	return drv_index;
2186
2187err_free_disk:
2188	cciss_free_gendisk(h, drv_index);
2189err_free_drive_info:
2190	cciss_free_drive_info(h, drv_index);
2191	return -1;
2192}
2193
2194/* This is for the special case of a controller which
2195 * has no logical drives.  In this case, we still need
2196 * to register a disk so the controller can be accessed
2197 * by the Array Config Utility.
2198 */
2199static void cciss_add_controller_node(ctlr_info_t *h)
2200{
2201	struct gendisk *disk;
2202	int drv_index;
2203
2204	if (h->gendisk[0] != NULL) /* already did this? Then bail. */
2205		return;
2206
2207	drv_index = cciss_add_gendisk(h, CTLR_LUNID, 1);
2208	if (drv_index == -1)
2209		goto error;
2210	h->drv[drv_index]->block_size = 512;
2211	h->drv[drv_index]->nr_blocks = 0;
2212	h->drv[drv_index]->heads = 0;
2213	h->drv[drv_index]->sectors = 0;
2214	h->drv[drv_index]->cylinders = 0;
2215	h->drv[drv_index]->raid_level = -1;
2216	memset(h->drv[drv_index]->serial_no, 0, 16);
2217	disk = h->gendisk[drv_index];
2218	if (cciss_add_disk(h, disk, drv_index) == 0)
2219		return;
2220	cciss_free_gendisk(h, drv_index);
2221	cciss_free_drive_info(h, drv_index);
2222error:
2223	dev_warn(&h->pdev->dev, "could not add disk 0.\n");
2224	return;
2225}
2226
2227/* This function will add and remove logical drives from the Logical
2228 * drive array of the controller and maintain persistency of ordering
2229 * so that mount points are preserved until the next reboot.  This allows
2230 * for the removal of logical drives in the middle of the drive array
2231 * without a re-ordering of those drives.
2232 * INPUT
2233 * h		= The controller to perform the operations on
2234 */
2235static int rebuild_lun_table(ctlr_info_t *h, int first_time,
2236	int via_ioctl)
2237{
2238	int num_luns;
2239	ReportLunData_struct *ld_buff = NULL;
2240	int return_code;
2241	int listlength = 0;
2242	int i;
2243	int drv_found;
2244	int drv_index = 0;
2245	unsigned char lunid[8] = CTLR_LUNID;
2246	unsigned long flags;
2247
2248	if (!capable(CAP_SYS_RAWIO))
2249		return -EPERM;
2250
2251	/* Set busy_configuring flag for this operation */
2252	spin_lock_irqsave(&h->lock, flags);
2253	if (h->busy_configuring) {
2254		spin_unlock_irqrestore(&h->lock, flags);
2255		return -EBUSY;
2256	}
2257	h->busy_configuring = 1;
2258	spin_unlock_irqrestore(&h->lock, flags);
2259
2260	ld_buff = kzalloc(sizeof(ReportLunData_struct), GFP_KERNEL);
2261	if (ld_buff == NULL)
2262		goto mem_msg;
2263
2264	return_code = sendcmd_withirq(h, CISS_REPORT_LOG, ld_buff,
2265				      sizeof(ReportLunData_struct),
2266				      0, CTLR_LUNID, TYPE_CMD);
2267
2268	if (return_code == IO_OK)
2269		listlength = be32_to_cpu(*(__be32 *) ld_buff->LUNListLength);
2270	else {	/* reading number of logical volumes failed */
2271		dev_warn(&h->pdev->dev,
2272			"report logical volume command failed\n");
2273		listlength = 0;
2274		goto freeret;
2275	}
2276
2277	num_luns = listlength / 8;	/* 8 bytes per entry */
2278	if (num_luns > CISS_MAX_LUN) {
2279		num_luns = CISS_MAX_LUN;
2280		dev_warn(&h->pdev->dev, "more luns configured"
2281		       " on controller than can be handled by"
2282		       " this driver.\n");
2283	}
2284
2285	if (num_luns == 0)
2286		cciss_add_controller_node(h);
2287
2288	/* Compare controller drive array to driver's drive array
2289	 * to see if any drives are missing on the controller due
2290	 * to action of Array Config Utility (user deletes drive)
2291	 * and deregister logical drives which have disappeared.
2292	 */
2293	for (i = 0; i <= h->highest_lun; i++) {
2294		int j;
2295		drv_found = 0;
2296
2297		/* skip holes in the array from already deleted drives */
2298		if (h->drv[i] == NULL)
2299			continue;
2300
2301		for (j = 0; j < num_luns; j++) {
2302			memcpy(lunid, &ld_buff->LUN[j][0], sizeof(lunid));
2303			if (memcmp(h->drv[i]->LunID, lunid,
2304				sizeof(lunid)) == 0) {
2305				drv_found = 1;
2306				break;
2307			}
2308		}
2309		if (!drv_found) {
2310			/* Deregister it from the OS, it's gone. */
2311			spin_lock_irqsave(&h->lock, flags);
2312			h->drv[i]->busy_configuring = 1;
2313			spin_unlock_irqrestore(&h->lock, flags);
2314			return_code = deregister_disk(h, i, 1, via_ioctl);
2315			if (h->drv[i] != NULL)
2316				h->drv[i]->busy_configuring = 0;
2317		}
2318	}
2319
2320	/* Compare controller drive array to driver's drive array.
2321	 * Check for updates in the drive information and any new drives
2322	 * on the controller due to ACU adding logical drives, or changing
2323	 * a logical drive's size, etc.  Reregister any new/changed drives
2324	 */
2325	for (i = 0; i < num_luns; i++) {
2326		int j;
2327
2328		drv_found = 0;
2329
2330		memcpy(lunid, &ld_buff->LUN[i][0], sizeof(lunid));
2331		/* Find if the LUN is already in the drive array
2332		 * of the driver.  If so then update its info
2333		 * if not in use.  If it does not exist then find
2334		 * the first free index and add it.
2335		 */
2336		for (j = 0; j <= h->highest_lun; j++) {
2337			if (h->drv[j] != NULL &&
2338				memcmp(h->drv[j]->LunID, lunid,
2339					sizeof(h->drv[j]->LunID)) == 0) {
2340				drv_index = j;
2341				drv_found = 1;
2342				break;
2343			}
2344		}
2345
2346		/* check if the drive was found already in the array */
2347		if (!drv_found) {
2348			drv_index = cciss_add_gendisk(h, lunid, 0);
2349			if (drv_index == -1)
2350				goto freeret;
2351		}
2352		cciss_update_drive_info(h, drv_index, first_time, via_ioctl);
2353	}		/* end for */
2354
2355freeret:
2356	kfree(ld_buff);
2357	h->busy_configuring = 0;
2358	/* We return -1 here to tell the ACU that we have registered/updated
2359	 * all of the drives that we can and to keep it from calling us
2360	 * additional times.
2361	 */
2362	return -1;
2363mem_msg:
2364	dev_err(&h->pdev->dev, "out of memory\n");
2365	h->busy_configuring = 0;
2366	goto freeret;
2367}
2368
2369static void cciss_clear_drive_info(drive_info_struct *drive_info)
2370{
2371	/* zero out the disk size info */
2372	drive_info->nr_blocks = 0;
2373	drive_info->block_size = 0;
2374	drive_info->heads = 0;
2375	drive_info->sectors = 0;
2376	drive_info->cylinders = 0;
2377	drive_info->raid_level = -1;
2378	memset(drive_info->serial_no, 0, sizeof(drive_info->serial_no));
2379	memset(drive_info->model, 0, sizeof(drive_info->model));
2380	memset(drive_info->rev, 0, sizeof(drive_info->rev));
2381	memset(drive_info->vendor, 0, sizeof(drive_info->vendor));
2382	/*
2383	 * don't clear the LUNID though, we need to remember which
2384	 * one this one is.
2385	 */
2386}
2387
2388/* This function will deregister the disk and it's queue from the
2389 * kernel.  It must be called with the controller lock held and the
2390 * drv structures busy_configuring flag set.  It's parameters are:
2391 *
2392 * disk = This is the disk to be deregistered
2393 * drv  = This is the drive_info_struct associated with the disk to be
2394 *        deregistered.  It contains information about the disk used
2395 *        by the driver.
2396 * clear_all = This flag determines whether or not the disk information
2397 *             is going to be completely cleared out and the highest_lun
2398 *             reset.  Sometimes we want to clear out information about
2399 *             the disk in preparation for re-adding it.  In this case
2400 *             the highest_lun should be left unchanged and the LunID
2401 *             should not be cleared.
2402 * via_ioctl
2403 *    This indicates whether we've reached this path via ioctl.
2404 *    This affects the maximum usage count allowed for c0d0 to be messed with.
2405 *    If this path is reached via ioctl(), then the max_usage_count will
2406 *    be 1, as the process calling ioctl() has got to have the device open.
2407 *    If we get here via sysfs, then the max usage count will be zero.
2408*/
2409static int deregister_disk(ctlr_info_t *h, int drv_index,
2410			   int clear_all, int via_ioctl)
2411{
2412	int i;
2413	struct gendisk *disk;
2414	drive_info_struct *drv;
2415	int recalculate_highest_lun;
2416
2417	if (!capable(CAP_SYS_RAWIO))
2418		return -EPERM;
2419
2420	drv = h->drv[drv_index];
2421	disk = h->gendisk[drv_index];
2422
2423	/* make sure logical volume is NOT is use */
2424	if (clear_all || (h->gendisk[0] == disk)) {
2425		if (drv->usage_count > via_ioctl)
2426			return -EBUSY;
2427	} else if (drv->usage_count > 0)
2428		return -EBUSY;
2429
2430	recalculate_highest_lun = (drv == h->drv[h->highest_lun]);
2431
2432	/* invalidate the devices and deregister the disk.  If it is disk
2433	 * zero do not deregister it but just zero out it's values.  This
2434	 * allows us to delete disk zero but keep the controller registered.
2435	 */
2436	if (h->gendisk[0] != disk) {
2437		struct request_queue *q = disk->queue;
2438		if (disk->flags & GENHD_FL_UP) {
2439			cciss_destroy_ld_sysfs_entry(h, drv_index, 0);
2440			del_gendisk(disk);
2441		}
2442		if (q)
2443			blk_cleanup_queue(q);
2444		/* If clear_all is set then we are deleting the logical
2445		 * drive, not just refreshing its info.  For drives
2446		 * other than disk 0 we will call put_disk.  We do not
2447		 * do this for disk 0 as we need it to be able to
2448		 * configure the controller.
2449		 */
2450		if (clear_all){
2451			/* This isn't pretty, but we need to find the
2452			 * disk in our array and NULL our the pointer.
2453			 * This is so that we will call alloc_disk if
2454			 * this index is used again later.
2455			 */
2456			for (i=0; i < CISS_MAX_LUN; i++){
2457				if (h->gendisk[i] == disk) {
2458					h->gendisk[i] = NULL;
2459					break;
2460				}
2461			}
2462			put_disk(disk);
2463		}
2464	} else {
2465		set_capacity(disk, 0);
2466		cciss_clear_drive_info(drv);
2467	}
2468
2469	--h->num_luns;
2470
2471	/* if it was the last disk, find the new hightest lun */
2472	if (clear_all && recalculate_highest_lun) {
2473		int newhighest = -1;
2474		for (i = 0; i <= h->highest_lun; i++) {
2475			/* if the disk has size > 0, it is available */
2476			if (h->drv[i] && h->drv[i]->heads)
2477				newhighest = i;
2478		}
2479		h->highest_lun = newhighest;
2480	}
2481	return 0;
2482}
2483
2484static int fill_cmd(ctlr_info_t *h, CommandList_struct *c, __u8 cmd, void *buff,
2485		size_t size, __u8 page_code, unsigned char *scsi3addr,
2486		int cmd_type)
2487{
2488	u64bit buff_dma_handle;
2489	int status = IO_OK;
2490
2491	c->cmd_type = CMD_IOCTL_PEND;
2492	c->Header.ReplyQueue = 0;
2493	if (buff != NULL) {
2494		c->Header.SGList = 1;
2495		c->Header.SGTotal = 1;
2496	} else {
2497		c->Header.SGList = 0;
2498		c->Header.SGTotal = 0;
2499	}
2500	c->Header.Tag.lower = c->busaddr;
2501	memcpy(c->Header.LUN.LunAddrBytes, scsi3addr, 8);
2502
2503	c->Request.Type.Type = cmd_type;
2504	if (cmd_type == TYPE_CMD) {
2505		switch (cmd) {
2506		case CISS_INQUIRY:
2507			/* are we trying to read a vital product page */
2508			if (page_code != 0) {
2509				c->Request.CDB[1] = 0x01;
2510				c->Request.CDB[2] = page_code;
2511			}
2512			c->Request.CDBLen = 6;
2513			c->Request.Type.Attribute = ATTR_SIMPLE;
2514			c->Request.Type.Direction = XFER_READ;
2515			c->Request.Timeout = 0;
2516			c->Request.CDB[0] = CISS_INQUIRY;
2517			c->Request.CDB[4] = size & 0xFF;
2518			break;
2519		case CISS_REPORT_LOG:
2520		case CISS_REPORT_PHYS:
2521			/* Talking to controller so It's a physical command
2522			   mode = 00 target = 0.  Nothing to write.
2523			 */
2524			c->Request.CDBLen = 12;
2525			c->Request.Type.Attribute = ATTR_SIMPLE;
2526			c->Request.Type.Direction = XFER_READ;
2527			c->Request.Timeout = 0;
2528			c->Request.CDB[0] = cmd;
2529			c->Request.CDB[6] = (size >> 24) & 0xFF; /* MSB */
2530			c->Request.CDB[7] = (size >> 16) & 0xFF;
2531			c->Request.CDB[8] = (size >> 8) & 0xFF;
2532			c->Request.CDB[9] = size & 0xFF;
2533			break;
2534
2535		case CCISS_READ_CAPACITY:
2536			c->Request.CDBLen = 10;
2537			c->Request.Type.Attribute = ATTR_SIMPLE;
2538			c->Request.Type.Direction = XFER_READ;
2539			c->Request.Timeout = 0;
2540			c->Request.CDB[0] = cmd;
2541			break;
2542		case CCISS_READ_CAPACITY_16:
2543			c->Request.CDBLen = 16;
2544			c->Request.Type.Attribute = ATTR_SIMPLE;
2545			c->Request.Type.Direction = XFER_READ;
2546			c->Request.Timeout = 0;
2547			c->Request.CDB[0] = cmd;
2548			c->Request.CDB[1] = 0x10;
2549			c->Request.CDB[10] = (size >> 24) & 0xFF;
2550			c->Request.CDB[11] = (size >> 16) & 0xFF;
2551			c->Request.CDB[12] = (size >> 8) & 0xFF;
2552			c->Request.CDB[13] = size & 0xFF;
2553			c->Request.Timeout = 0;
2554			c->Request.CDB[0] = cmd;
2555			break;
2556		case CCISS_CACHE_FLUSH:
2557			c->Request.CDBLen = 12;
2558			c->Request.Type.Attribute = ATTR_SIMPLE;
2559			c->Request.Type.Direction = XFER_WRITE;
2560			c->Request.Timeout = 0;
2561			c->Request.CDB[0] = BMIC_WRITE;
2562			c->Request.CDB[6] = BMIC_CACHE_FLUSH;
2563			break;
2564		case TEST_UNIT_READY:
2565			c->Request.CDBLen = 6;
2566			c->Request.Type.Attribute = ATTR_SIMPLE;
2567			c->Request.Type.Direction = XFER_NONE;
2568			c->Request.Timeout = 0;
2569			break;
2570		default:
2571			dev_warn(&h->pdev->dev, "Unknown Command 0x%c\n", cmd);
2572			return IO_ERROR;
2573		}
2574	} else if (cmd_type == TYPE_MSG) {
2575		switch (cmd) {
2576		case 0:	/* ABORT message */
2577			c->Request.CDBLen = 12;
2578			c->Request.Type.Attribute = ATTR_SIMPLE;
2579			c->Request.Type.Direction = XFER_WRITE;
2580			c->Request.Timeout = 0;
2581			c->Request.CDB[0] = cmd;	/* abort */
2582			c->Request.CDB[1] = 0;	/* abort a command */
2583			/* buff contains the tag of the command to abort */
2584			memcpy(&c->Request.CDB[4], buff, 8);
2585			break;
2586		case 1:	/* RESET message */
2587			c->Request.CDBLen = 16;
2588			c->Request.Type.Attribute = ATTR_SIMPLE;
2589			c->Request.Type.Direction = XFER_NONE;
2590			c->Request.Timeout = 0;
2591			memset(&c->Request.CDB[0], 0, sizeof(c->Request.CDB));
2592			c->Request.CDB[0] = cmd;	/* reset */
2593			c->Request.CDB[1] = 0x03;	/* reset a target */
2594			break;
2595		case 3:	/* No-Op message */
2596			c->Request.CDBLen = 1;
2597			c->Request.Type.Attribute = ATTR_SIMPLE;
2598			c->Request.Type.Direction = XFER_WRITE;
2599			c->Request.Timeout = 0;
2600			c->Request.CDB[0] = cmd;
2601			break;
2602		default:
2603			dev_warn(&h->pdev->dev,
2604				"unknown message type %d\n", cmd);
2605			return IO_ERROR;
2606		}
2607	} else {
2608		dev_warn(&h->pdev->dev, "unknown command type %d\n", cmd_type);
2609		return IO_ERROR;
2610	}
2611	/* Fill in the scatter gather information */
2612	if (size > 0) {
2613		buff_dma_handle.val = (__u64) pci_map_single(h->pdev,
2614							     buff, size,
2615							     PCI_DMA_BIDIRECTIONAL);
2616		c->SG[0].Addr.lower = buff_dma_handle.val32.lower;
2617		c->SG[0].Addr.upper = buff_dma_handle.val32.upper;
2618		c->SG[0].Len = size;
2619		c->SG[0].Ext = 0;	/* we are not chaining */
2620	}
2621	return status;
2622}
2623
2624static int check_target_status(ctlr_info_t *h, CommandList_struct *c)
2625{
2626	switch (c->err_info->ScsiStatus) {
2627	case SAM_STAT_GOOD:
2628		return IO_OK;
2629	case SAM_STAT_CHECK_CONDITION:
2630		switch (0xf & c->err_info->SenseInfo[2]) {
2631		case 0: return IO_OK; /* no sense */
2632		case 1: return IO_OK; /* recovered error */
2633		default:
2634			if (check_for_unit_attention(h, c))
2635				return IO_NEEDS_RETRY;
2636			dev_warn(&h->pdev->dev, "cmd 0x%02x "
2637				"check condition, sense key = 0x%02x\n",
2638				c->Request.CDB[0], c->err_info->SenseInfo[2]);
2639		}
2640		break;
2641	default:
2642		dev_warn(&h->pdev->dev, "cmd 0x%02x"
2643			"scsi status = 0x%02x\n",
2644			c->Request.CDB[0], c->err_info->ScsiStatus);
2645		break;
2646	}
2647	return IO_ERROR;
2648}
2649
2650static int process_sendcmd_error(ctlr_info_t *h, CommandList_struct *c)
2651{
2652	int return_status = IO_OK;
2653
2654	if (c->err_info->CommandStatus == CMD_SUCCESS)
2655		return IO_OK;
2656
2657	switch (c->err_info->CommandStatus) {
2658	case CMD_TARGET_STATUS:
2659		return_status = check_target_status(h, c);
2660		break;
2661	case CMD_DATA_UNDERRUN:
2662	case CMD_DATA_OVERRUN:
2663		/* expected for inquiry and report lun commands */
2664		break;
2665	case CMD_INVALID:
2666		dev_warn(&h->pdev->dev, "cmd 0x%02x is "
2667		       "reported invalid\n", c->Request.CDB[0]);
2668		return_status = IO_ERROR;
2669		break;
2670	case CMD_PROTOCOL_ERR:
2671		dev_warn(&h->pdev->dev, "cmd 0x%02x has "
2672		       "protocol error\n", c->Request.CDB[0]);
2673		return_status = IO_ERROR;
2674		break;
2675	case CMD_HARDWARE_ERR:
2676		dev_warn(&h->pdev->dev, "cmd 0x%02x had "
2677		       " hardware error\n", c->Request.CDB[0]);
2678		return_status = IO_ERROR;
2679		break;
2680	case CMD_CONNECTION_LOST:
2681		dev_warn(&h->pdev->dev, "cmd 0x%02x had "
2682		       "connection lost\n", c->Request.CDB[0]);
2683		return_status = IO_ERROR;
2684		break;
2685	case CMD_ABORTED:
2686		dev_warn(&h->pdev->dev, "cmd 0x%02x was "
2687		       "aborted\n", c->Request.CDB[0]);
2688		return_status = IO_ERROR;
2689		break;
2690	case CMD_ABORT_FAILED:
2691		dev_warn(&h->pdev->dev, "cmd 0x%02x reports "
2692		       "abort failed\n", c->Request.CDB[0]);
2693		return_status = IO_ERROR;
2694		break;
2695	case CMD_UNSOLICITED_ABORT:
2696		dev_warn(&h->pdev->dev, "unsolicited abort 0x%02x\n",
2697			c->Request.CDB[0]);
2698		return_status = IO_NEEDS_RETRY;
2699		break;
2700	default:
2701		dev_warn(&h->pdev->dev, "cmd 0x%02x returned "
2702		       "unknown status %x\n", c->Request.CDB[0],
2703		       c->err_info->CommandStatus);
2704		return_status = IO_ERROR;
2705	}
2706	return return_status;
2707}
2708
2709static int sendcmd_withirq_core(ctlr_info_t *h, CommandList_struct *c,
2710	int attempt_retry)
2711{
2712	DECLARE_COMPLETION_ONSTACK(wait);
2713	u64bit buff_dma_handle;
2714	int return_status = IO_OK;
2715
2716resend_cmd2:
2717	c->waiting = &wait;
2718	enqueue_cmd_and_start_io(h, c);
2719
2720	wait_for_completion(&wait);
2721
2722	if (c->err_info->CommandStatus == 0 || !attempt_retry)
2723		goto command_done;
2724
2725	return_status = process_sendcmd_error(h, c);
2726
2727	if (return_status == IO_NEEDS_RETRY &&
2728		c->retry_count < MAX_CMD_RETRIES) {
2729		dev_warn(&h->pdev->dev, "retrying 0x%02x\n",
2730			c->Request.CDB[0]);
2731		c->retry_count++;
2732		/* erase the old error information */
2733		memset(c->err_info, 0, sizeof(ErrorInfo_struct));
2734		return_status = IO_OK;
2735		INIT_COMPLETION(wait);
2736		goto resend_cmd2;
2737	}
2738
2739command_done:
2740	/* unlock the buffers from DMA */
2741	buff_dma_handle.val32.lower = c->SG[0].Addr.lower;
2742	buff_dma_handle.val32.upper = c->SG[0].Addr.upper;
2743	pci_unmap_single(h->pdev, (dma_addr_t) buff_dma_handle.val,
2744			 c->SG[0].Len, PCI_DMA_BIDIRECTIONAL);
2745	return return_status;
2746}
2747
2748static int sendcmd_withirq(ctlr_info_t *h, __u8 cmd, void *buff, size_t size,
2749			   __u8 page_code, unsigned char scsi3addr[],
2750			int cmd_type)
2751{
2752	CommandList_struct *c;
2753	int return_status;
2754
2755	c = cmd_special_alloc(h);
2756	if (!c)
2757		return -ENOMEM;
2758	return_status = fill_cmd(h, c, cmd, buff, size, page_code,
2759		scsi3addr, cmd_type);
2760	if (return_status == IO_OK)
2761		return_status = sendcmd_withirq_core(h, c, 1);
2762
2763	cmd_special_free(h, c);
2764	return return_status;
2765}
2766
2767static void cciss_geometry_inquiry(ctlr_info_t *h, int logvol,
2768				   sector_t total_size,
2769				   unsigned int block_size,
2770				   InquiryData_struct *inq_buff,
2771				   drive_info_struct *drv)
2772{
2773	int return_code;
2774	unsigned long t;
2775	unsigned char scsi3addr[8];
2776
2777	memset(inq_buff, 0, sizeof(InquiryData_struct));
2778	log_unit_to_scsi3addr(h, scsi3addr, logvol);
2779	return_code = sendcmd_withirq(h, CISS_INQUIRY, inq_buff,
2780			sizeof(*inq_buff), 0xC1, scsi3addr, TYPE_CMD);
2781	if (return_code == IO_OK) {
2782		if (inq_buff->data_byte[8] == 0xFF) {
2783			dev_warn(&h->pdev->dev,
2784			       "reading geometry failed, volume "
2785			       "does not support reading geometry\n");
2786			drv->heads = 255;
2787			drv->sectors = 32;	/* Sectors per track */
2788			drv->cylinders = total_size + 1;
2789			drv->raid_level = RAID_UNKNOWN;
2790		} else {
2791			drv->heads = inq_buff->data_byte[6];
2792			drv->sectors = inq_buff->data_byte[7];
2793			drv->cylinders = (inq_buff->data_byte[4] & 0xff) << 8;
2794			drv->cylinders += inq_buff->data_byte[5];
2795			drv->raid_level = inq_buff->data_byte[8];
2796		}
2797		drv->block_size = block_size;
2798		drv->nr_blocks = total_size + 1;
2799		t = drv->heads * drv->sectors;
2800		if (t > 1) {
2801			sector_t real_size = total_size + 1;
2802			unsigned long rem = sector_div(real_size, t);
2803			if (rem)
2804				real_size++;
2805			drv->cylinders = real_size;
2806		}
2807	} else {		/* Get geometry failed */
2808		dev_warn(&h->pdev->dev, "reading geometry failed\n");
2809	}
2810}
2811
2812static void
2813cciss_read_capacity(ctlr_info_t *h, int logvol, sector_t *total_size,
2814		    unsigned int *block_size)
2815{
2816	ReadCapdata_struct *buf;
2817	int return_code;
2818	unsigned char scsi3addr[8];
2819
2820	buf = kzalloc(sizeof(ReadCapdata_struct), GFP_KERNEL);
2821	if (!buf) {
2822		dev_warn(&h->pdev->dev, "out of memory\n");
2823		return;
2824	}
2825
2826	log_unit_to_scsi3addr(h, scsi3addr, logvol);
2827	return_code = sendcmd_withirq(h, CCISS_READ_CAPACITY, buf,
2828		sizeof(ReadCapdata_struct), 0, scsi3addr, TYPE_CMD);
2829	if (return_code == IO_OK) {
2830		*total_size = be32_to_cpu(*(__be32 *) buf->total_size);
2831		*block_size = be32_to_cpu(*(__be32 *) buf->block_size);
2832	} else {		/* read capacity command failed */
2833		dev_warn(&h->pdev->dev, "read capacity failed\n");
2834		*total_size = 0;
2835		*block_size = BLOCK_SIZE;
2836	}
2837	kfree(buf);
2838}
2839
2840static void cciss_read_capacity_16(ctlr_info_t *h, int logvol,
2841	sector_t *total_size, unsigned int *block_size)
2842{
2843	ReadCapdata_struct_16 *buf;
2844	int return_code;
2845	unsigned char scsi3addr[8];
2846
2847	buf = kzalloc(sizeof(ReadCapdata_struct_16), GFP_KERNEL);
2848	if (!buf) {
2849		dev_warn(&h->pdev->dev, "out of memory\n");
2850		return;
2851	}
2852
2853	log_unit_to_scsi3addr(h, scsi3addr, logvol);
2854	return_code = sendcmd_withirq(h, CCISS_READ_CAPACITY_16,
2855		buf, sizeof(ReadCapdata_struct_16),
2856			0, scsi3addr, TYPE_CMD);
2857	if (return_code == IO_OK) {
2858		*total_size = be64_to_cpu(*(__be64 *) buf->total_size);
2859		*block_size = be32_to_cpu(*(__be32 *) buf->block_size);
2860	} else {		/* read capacity command failed */
2861		dev_warn(&h->pdev->dev, "read capacity failed\n");
2862		*total_size = 0;
2863		*block_size = BLOCK_SIZE;
2864	}
2865	dev_info(&h->pdev->dev, "      blocks= %llu block_size= %d\n",
2866	       (unsigned long long)*total_size+1, *block_size);
2867	kfree(buf);
2868}
2869
2870static int cciss_revalidate(struct gendisk *disk)
2871{
2872	ctlr_info_t *h = get_host(disk);
2873	drive_info_struct *drv = get_drv(disk);
2874	int logvol;
2875	int FOUND = 0;
2876	unsigned int block_size;
2877	sector_t total_size;
2878	InquiryData_struct *inq_buff = NULL;
2879
2880	for (logvol = 0; logvol < CISS_MAX_LUN; logvol++) {
2881		if (memcmp(h->drv[logvol]->LunID, drv->LunID,
2882			sizeof(drv->LunID)) == 0) {
2883			FOUND = 1;
2884			break;
2885		}
2886	}
2887
2888	if (!FOUND)
2889		return 1;
2890
2891	inq_buff = kmalloc(sizeof(InquiryData_struct), GFP_KERNEL);
2892	if (inq_buff == NULL) {
2893		dev_warn(&h->pdev->dev, "out of memory\n");
2894		return 1;
2895	}
2896	if (h->cciss_read == CCISS_READ_10) {
2897		cciss_read_capacity(h, logvol,
2898					&total_size, &block_size);
2899	} else {
2900		cciss_read_capacity_16(h, logvol,
2901					&total_size, &block_size);
2902	}
2903	cciss_geometry_inquiry(h, logvol, total_size, block_size,
2904			       inq_buff, drv);
2905
2906	blk_queue_logical_block_size(drv->queue, drv->block_size);
2907	set_capacity(disk, drv->nr_blocks);
2908
2909	kfree(inq_buff);
2910	return 0;
2911}
2912
2913/*
2914 * Map (physical) PCI mem into (virtual) kernel space
2915 */
2916static void __iomem *remap_pci_mem(ulong base, ulong size)
2917{
2918	ulong page_base = ((ulong) base) & PAGE_MASK;
2919	ulong page_offs = ((ulong) base) - page_base;
2920	void __iomem *page_remapped = ioremap(page_base, page_offs + size);
2921
2922	return page_remapped ? (page_remapped + page_offs) : NULL;
2923}
2924
2925/*
2926 * Takes jobs of the Q and sends them to the hardware, then puts it on
2927 * the Q to wait for completion.
2928 */
2929static void start_io(ctlr_info_t *h)
2930{
2931	CommandList_struct *c;
2932
2933	while (!hlist_empty(&h->reqQ)) {
2934		c = hlist_entry(h->reqQ.first, CommandList_struct, list);
2935		/* can't do anything if fifo is full */
2936		if ((h->access.fifo_full(h))) {
2937			dev_warn(&h->pdev->dev, "fifo full\n");
2938			break;
2939		}
2940
2941		/* Get the first entry from the Request Q */
2942		removeQ(c);
2943		h->Qdepth--;
2944
2945		/* Tell the controller execute command */
2946		h->access.submit_command(h, c);
2947
2948		/* Put job onto the completed Q */
2949		addQ(&h->cmpQ, c);
2950	}
2951}
2952
2953/* Assumes that h->lock is held. */
2954/* Zeros out the error record and then resends the command back */
2955/* to the controller */
2956static inline void resend_cciss_cmd(ctlr_info_t *h, CommandList_struct *c)
2957{
2958	/* erase the old error information */
2959	memset(c->err_info, 0, sizeof(ErrorInfo_struct));
2960
2961	/* add it to software queue and then send it to the controller */
2962	addQ(&h->reqQ, c);
2963	h->Qdepth++;
2964	if (h->Qdepth > h->maxQsinceinit)
2965		h->maxQsinceinit = h->Qdepth;
2966
2967	start_io(h);
2968}
2969
2970static inline unsigned int make_status_bytes(unsigned int scsi_status_byte,
2971	unsigned int msg_byte, unsigned int host_byte,
2972	unsigned int driver_byte)
2973{
2974	/* inverse of macros in scsi.h */
2975	return (scsi_status_byte & 0xff) |
2976		((msg_byte & 0xff) << 8) |
2977		((host_byte & 0xff) << 16) |
2978		((driver_byte & 0xff) << 24);
2979}
2980
2981static inline int evaluate_target_status(ctlr_info_t *h,
2982			CommandList_struct *cmd, int *retry_cmd)
2983{
2984	unsigned char sense_key;
2985	unsigned char status_byte, msg_byte, host_byte, driver_byte;
2986	int error_value;
2987
2988	*retry_cmd = 0;
2989	/* If we get in here, it means we got "target status", that is, scsi status */
2990	status_byte = cmd->err_info->ScsiStatus;
2991	driver_byte = DRIVER_OK;
2992	msg_byte = cmd->err_info->CommandStatus; /* correct?  seems too device specific */
2993
2994	if (cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC)
2995		host_byte = DID_PASSTHROUGH;
2996	else
2997		host_byte = DID_OK;
2998
2999	error_value = make_status_bytes(status_byte, msg_byte,
3000		host_byte, driver_byte);
3001
3002	if (cmd->err_info->ScsiStatus != SAM_STAT_CHECK_CONDITION) {
3003		if (cmd->rq->cmd_type != REQ_TYPE_BLOCK_PC)
3004			dev_warn(&h->pdev->dev, "cmd %p "
3005			       "has SCSI Status 0x%x\n",
3006			       cmd, cmd->err_info->ScsiStatus);
3007		return error_value;
3008	}
3009
3010	/* check the sense key */
3011	sense_key = 0xf & cmd->err_info->SenseInfo[2];
3012	/* no status or recovered error */
3013	if (((sense_key == 0x0) || (sense_key == 0x1)) &&
3014	    (cmd->rq->cmd_type != REQ_TYPE_BLOCK_PC))
3015		error_value = 0;
3016
3017	if (check_for_unit_attention(h, cmd)) {
3018		*retry_cmd = !(cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC);
3019		return 0;
3020	}
3021
3022	/* Not SG_IO or similar? */
3023	if (cmd->rq->cmd_type != REQ_TYPE_BLOCK_PC) {
3024		if (error_value != 0)
3025			dev_warn(&h->pdev->dev, "cmd %p has CHECK CONDITION"
3026			       " sense key = 0x%x\n", cmd, sense_key);
3027		return error_value;
3028	}
3029
3030	/* SG_IO or similar, copy sense data back */
3031	if (cmd->rq->sense) {
3032		if (cmd->rq->sense_len > cmd->err_info->SenseLen)
3033			cmd->rq->sense_len = cmd->err_info->SenseLen;
3034		memcpy(cmd->rq->sense, cmd->err_info->SenseInfo,
3035			cmd->rq->sense_len);
3036	} else
3037		cmd->rq->sense_len = 0;
3038
3039	return error_value;
3040}
3041
3042/* checks the status of the job and calls complete buffers to mark all
3043 * buffers for the completed job. Note that this function does not need
3044 * to hold the hba/queue lock.
3045 */
3046static inline void complete_command(ctlr_info_t *h, CommandList_struct *cmd,
3047				    int timeout)
3048{
3049	int retry_cmd = 0;
3050	struct request *rq = cmd->rq;
3051
3052	rq->errors = 0;
3053
3054	if (timeout)
3055		rq->errors = make_status_bytes(0, 0, 0, DRIVER_TIMEOUT);
3056
3057	if (cmd->err_info->CommandStatus == 0)	/* no error has occurred */
3058		goto after_error_processing;
3059
3060	switch (cmd->err_info->CommandStatus) {
3061	case CMD_TARGET_STATUS:
3062		rq->errors = evaluate_target_status(h, cmd, &retry_cmd);
3063		break;
3064	case CMD_DATA_UNDERRUN:
3065		if (cmd->rq->cmd_type == REQ_TYPE_FS) {
3066			dev_warn(&h->pdev->dev, "cmd %p has"
3067			       " completed with data underrun "
3068			       "reported\n", cmd);
3069			cmd->rq->resid_len = cmd->err_info->ResidualCnt;
3070		}
3071		break;
3072	case CMD_DATA_OVERRUN:
3073		if (cmd->rq->cmd_type == REQ_TYPE_FS)
3074			dev_warn(&h->pdev->dev, "cciss: cmd %p has"
3075			       " completed with data overrun "
3076			       "reported\n", cmd);
3077		break;
3078	case CMD_INVALID:
3079		dev_warn(&h->pdev->dev, "cciss: cmd %p is "
3080		       "reported invalid\n", cmd);
3081		rq->errors = make_status_bytes(SAM_STAT_GOOD,
3082			cmd->err_info->CommandStatus, DRIVER_OK,
3083			(cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
3084				DID_PASSTHROUGH : DID_ERROR);
3085		break;
3086	case CMD_PROTOCOL_ERR:
3087		dev_warn(&h->pdev->dev, "cciss: cmd %p has "
3088		       "protocol error\n", cmd);
3089		rq->errors = make_status_bytes(SAM_STAT_GOOD,
3090			cmd->err_info->CommandStatus, DRIVER_OK,
3091			(cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
3092				DID_PASSTHROUGH : DID_ERROR);
3093		break;
3094	case CMD_HARDWARE_ERR:
3095		dev_warn(&h->pdev->dev, "cciss: cmd %p had "
3096		       " hardware error\n", cmd);
3097		rq->errors = make_status_bytes(SAM_STAT_GOOD,
3098			cmd->err_info->CommandStatus, DRIVER_OK,
3099			(cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
3100				DID_PASSTHROUGH : DID_ERROR);
3101		break;
3102	case CMD_CONNECTION_LOST:
3103		dev_warn(&h->pdev->dev, "cciss: cmd %p had "
3104		       "connection lost\n", cmd);
3105		rq->errors = make_status_bytes(SAM_STAT_GOOD,
3106			cmd->err_info->CommandStatus, DRIVER_OK,
3107			(cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
3108				DID_PASSTHROUGH : DID_ERROR);
3109		break;
3110	case CMD_ABORTED:
3111		dev_warn(&h->pdev->dev, "cciss: cmd %p was "
3112		       "aborted\n", cmd);
3113		rq->errors = make_status_bytes(SAM_STAT_GOOD,
3114			cmd->err_info->CommandStatus, DRIVER_OK,
3115			(cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
3116				DID_PASSTHROUGH : DID_ABORT);
3117		break;
3118	case CMD_ABORT_FAILED:
3119		dev_warn(&h->pdev->dev, "cciss: cmd %p reports "
3120		       "abort failed\n", cmd);
3121		rq->errors = make_status_bytes(SAM_STAT_GOOD,
3122			cmd->err_info->CommandStatus, DRIVER_OK,
3123			(cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
3124				DID_PASSTHROUGH : DID_ERROR);
3125		break;
3126	case CMD_UNSOLICITED_ABORT:
3127		dev_warn(&h->pdev->dev, "cciss%d: unsolicited "
3128		       "abort %p\n", h->ctlr, cmd);
3129		if (cmd->retry_count < MAX_CMD_RETRIES) {
3130			retry_cmd = 1;
3131			dev_warn(&h->pdev->dev, "retrying %p\n", cmd);
3132			cmd->retry_count++;
3133		} else
3134			dev_warn(&h->pdev->dev,
3135				"%p retried too many times\n", cmd);
3136		rq->errors = make_status_bytes(SAM_STAT_GOOD,
3137			cmd->err_info->CommandStatus, DRIVER_OK,
3138			(cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
3139				DID_PASSTHROUGH : DID_ABORT);
3140		break;
3141	case CMD_TIMEOUT:
3142		dev_warn(&h->pdev->dev, "cmd %p timedout\n", cmd);
3143		rq->errors = make_status_bytes(SAM_STAT_GOOD,
3144			cmd->err_info->CommandStatus, DRIVER_OK,
3145			(cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
3146				DID_PASSTHROUGH : DID_ERROR);
3147		break;
3148	default:
3149		dev_warn(&h->pdev->dev, "cmd %p returned "
3150		       "unknown status %x\n", cmd,
3151		       cmd->err_info->CommandStatus);
3152		rq->errors = make_status_bytes(SAM_STAT_GOOD,
3153			cmd->err_info->CommandStatus, DRIVER_OK,
3154			(cmd->rq->cmd_type == REQ_TYPE_BLOCK_PC) ?
3155				DID_PASSTHROUGH : DID_ERROR);
3156	}
3157
3158after_error_processing:
3159
3160	/* We need to return this command */
3161	if (retry_cmd) {
3162		resend_cciss_cmd(h, cmd);
3163		return;
3164	}
3165	cmd->rq->completion_data = cmd;
3166	blk_complete_request(cmd->rq);
3167}
3168
3169static inline u32 cciss_tag_contains_index(u32 tag)
3170{
3171#define DIRECT_LOOKUP_BIT 0x10
3172	return tag & DIRECT_LOOKUP_BIT;
3173}
3174
3175static inline u32 cciss_tag_to_index(u32 tag)
3176{
3177#define DIRECT_LOOKUP_SHIFT 5
3178	return tag >> DIRECT_LOOKUP_SHIFT;
3179}
3180
3181static inline u32 cciss_tag_discard_error_bits(u32 tag)
3182{
3183#define CCISS_ERROR_BITS 0x03
3184	return tag & ~CCISS_ERROR_BITS;
3185}
3186
3187static inline void cciss_mark_tag_indexed(u32 *tag)
3188{
3189	*tag |= DIRECT_LOOKUP_BIT;
3190}
3191
3192static inline void cciss_set_tag_index(u32 *tag, u32 index)
3193{
3194	*tag |= (index << DIRECT_LOOKUP_SHIFT);
3195}
3196
3197/*
3198 * Get a request and submit it to the controller.
3199 */
3200static void do_cciss_request(struct request_queue *q)
3201{
3202	ctlr_info_t *h = q->queuedata;
3203	CommandList_struct *c;
3204	sector_t start_blk;
3205	int seg;
3206	struct request *creq;
3207	u64bit temp64;
3208	struct scatterlist *tmp_sg;
3209	SGDescriptor_struct *curr_sg;
3210	drive_info_struct *drv;
3211	int i, dir;
3212	int sg_index = 0;
3213	int chained = 0;
3214
3215	/* We call start_io here in case there is a command waiting on the
3216	 * queue that has not been sent.
3217	 */
3218	if (blk_queue_plugged(q))
3219		goto startio;
3220
3221      queue:
3222	creq = blk_peek_request(q);
3223	if (!creq)
3224		goto startio;
3225
3226	BUG_ON(creq->nr_phys_segments > h->maxsgentries);
3227
3228	c = cmd_alloc(h);
3229	if (!c)
3230		goto full;
3231
3232	blk_start_request(creq);
3233
3234	tmp_sg = h->scatter_list[c->cmdindex];
3235	spin_unlock_irq(q->queue_lock);
3236
3237	c->cmd_type = CMD_RWREQ;
3238	c->rq = creq;
3239
3240	/* fill in the request */
3241	drv = creq->rq_disk->private_data;
3242	c->Header.ReplyQueue = 0;	/* unused in simple mode */
3243	/* got command from pool, so use the command block index instead */
3244	/* for direct lookups. */
3245	/* The first 2 bits are reserved for controller error reporting. */
3246	cciss_set_tag_index(&c->Header.Tag.lower, c->cmdindex);
3247	cciss_mark_tag_indexed(&c->Header.Tag.lower);
3248	memcpy(&c->Header.LUN, drv->LunID, sizeof(drv->LunID));
3249	c->Request.CDBLen = 10;	/* 12 byte commands not in FW yet; */
3250	c->Request.Type.Type = TYPE_CMD;	/* It is a command. */
3251	c->Request.Type.Attribute = ATTR_SIMPLE;
3252	c->Request.Type.Direction =
3253	    (rq_data_dir(creq) == READ) ? XFER_READ : XFER_WRITE;
3254	c->Request.Timeout = 0;	/* Don't time out */
3255	c->Request.CDB[0] =
3256	    (rq_data_dir(creq) == READ) ? h->cciss_read : h->cciss_write;
3257	start_blk = blk_rq_pos(creq);
3258	dev_dbg(&h->pdev->dev, "sector =%d nr_sectors=%d\n",
3259	       (int)blk_rq_pos(creq), (int)blk_rq_sectors(creq));
3260	sg_init_table(tmp_sg, h->maxsgentries);
3261	seg = blk_rq_map_sg(q, creq, tmp_sg);
3262
3263	/* get the DMA records for the setup */
3264	if (c->Request.Type.Direction == XFER_READ)
3265		dir = PCI_DMA_FROMDEVICE;
3266	else
3267		dir = PCI_DMA_TODEVICE;
3268
3269	curr_sg = c->SG;
3270	sg_index = 0;
3271	chained = 0;
3272
3273	for (i = 0; i < seg; i++) {
3274		if (((sg_index+1) == (h->max_cmd_sgentries)) &&
3275			!chained && ((seg - i) > 1)) {
3276			/* Point to next chain block. */
3277			curr_sg = h->cmd_sg_list[c->cmdindex];
3278			sg_index = 0;
3279			chained = 1;
3280		}
3281		curr_sg[sg_index].Len = tmp_sg[i].length;
3282		temp64.val = (__u64) pci_map_page(h->pdev, sg_page(&tmp_sg[i]),
3283						tmp_sg[i].offset,
3284						tmp_sg[i].length, dir);
3285		curr_sg[sg_index].Addr.lower = temp64.val32.lower;
3286		curr_sg[sg_index].Addr.upper = temp64.val32.upper;
3287		curr_sg[sg_index].Ext = 0;  /* we are not chaining */
3288		++sg_index;
3289	}
3290	if (chained)
3291		cciss_map_sg_chain_block(h, c, h->cmd_sg_list[c->cmdindex],
3292			(seg - (h->max_cmd_sgentries - 1)) *
3293				sizeof(SGDescriptor_struct));
3294
3295	/* track how many SG entries we are using */
3296	if (seg > h->maxSG)
3297		h->maxSG = seg;
3298
3299	dev_dbg(&h->pdev->dev, "Submitting %u sectors in %d segments "
3300			"chained[%d]\n",
3301			blk_rq_sectors(creq), seg, chained);
3302
3303	c->Header.SGTotal = seg + chained;
3304	if (seg <= h->max_cmd_sgentries)
3305		c->Header.SGList = c->Header.SGTotal;
3306	else
3307		c->Header.SGList = h->max_cmd_sgentries;
3308	set_performant_mode(h, c);
3309
3310	if (likely(creq->cmd_type == REQ_TYPE_FS)) {
3311		if(h->cciss_read == CCISS_READ_10) {
3312			c->Request.CDB[1] = 0;
3313			c->Request.CDB[2] = (start_blk >> 24) & 0xff; /* MSB */
3314			c->Request.CDB[3] = (start_blk >> 16) & 0xff;
3315			c->Request.CDB[4] = (start_blk >> 8) & 0xff;
3316			c->Request.CDB[5] = start_blk & 0xff;
3317			c->Request.CDB[6] = 0; /* (sect >> 24) & 0xff; MSB */
3318			c->Request.CDB[7] = (blk_rq_sectors(creq) >> 8) & 0xff;
3319			c->Request.CDB[8] = blk_rq_sectors(creq) & 0xff;
3320			c->Request.CDB[9] = c->Request.CDB[11] = c->Request.CDB[12] = 0;
3321		} else {
3322			u32 upper32 = upper_32_bits(start_blk);
3323
3324			c->Request.CDBLen = 16;
3325			c->Request.CDB[1]= 0;
3326			c->Request.CDB[2]= (upper32 >> 24) & 0xff; /* MSB */
3327			c->Request.CDB[3]= (upper32 >> 16) & 0xff;
3328			c->Request.CDB[4]= (upper32 >>  8) & 0xff;
3329			c->Request.CDB[5]= upper32 & 0xff;
3330			c->Request.CDB[6]= (start_blk >> 24) & 0xff;
3331			c->Request.CDB[7]= (start_blk >> 16) & 0xff;
3332			c->Request.CDB[8]= (start_blk >>  8) & 0xff;
3333			c->Request.CDB[9]= start_blk & 0xff;
3334			c->Request.CDB[10]= (blk_rq_sectors(creq) >> 24) & 0xff;
3335			c->Request.CDB[11]= (blk_rq_sectors(creq) >> 16) & 0xff;
3336			c->Request.CDB[12]= (blk_rq_sectors(creq) >>  8) & 0xff;
3337			c->Request.CDB[13]= blk_rq_sectors(creq) & 0xff;
3338			c->Request.CDB[14] = c->Request.CDB[15] = 0;
3339		}
3340	} else if (creq->cmd_type == REQ_TYPE_BLOCK_PC) {
3341		c->Request.CDBLen = creq->cmd_len;
3342		memcpy(c->Request.CDB, creq->cmd, BLK_MAX_CDB);
3343	} else {
3344		dev_warn(&h->pdev->dev, "bad request type %d\n",
3345			creq->cmd_type);
3346		BUG();
3347	}
3348
3349	spin_lock_irq(q->queue_lock);
3350
3351	addQ(&h->reqQ, c);
3352	h->Qdepth++;
3353	if (h->Qdepth > h->maxQsinceinit)
3354		h->maxQsinceinit = h->Qdepth;
3355
3356	goto queue;
3357full:
3358	blk_stop_queue(q);
3359startio:
3360	/* We will already have the driver lock here so not need
3361	 * to lock it.
3362	 */
3363	start_io(h);
3364}
3365
3366static inline unsigned long get_next_completion(ctlr_info_t *h)
3367{
3368	return h->access.command_completed(h);
3369}
3370
3371static inline int interrupt_pending(ctlr_info_t *h)
3372{
3373	return h->access.intr_pending(h);
3374}
3375
3376static inline long interrupt_not_for_us(ctlr_info_t *h)
3377{
3378	return ((h->access.intr_pending(h) == 0) ||
3379		(h->interrupts_enabled == 0));
3380}
3381
3382static inline int bad_tag(ctlr_info_t *h, u32 tag_index,
3383			u32 raw_tag)
3384{
3385	if (unlikely(tag_index >= h->nr_cmds)) {
3386		dev_warn(&h->pdev->dev, "bad tag 0x%08x ignored.\n", raw_tag);
3387		return 1;
3388	}
3389	return 0;
3390}
3391
3392static inline void finish_cmd(ctlr_info_t *h, CommandList_struct *c,
3393				u32 raw_tag)
3394{
3395	removeQ(c);
3396	if (likely(c->cmd_type == CMD_RWREQ))
3397		complete_command(h, c, 0);
3398	else if (c->cmd_type == CMD_IOCTL_PEND)
3399		complete(c->waiting);
3400#ifdef CONFIG_CISS_SCSI_TAPE
3401	else if (c->cmd_type == CMD_SCSI)
3402		complete_scsi_command(c, 0, raw_tag);
3403#endif
3404}
3405
3406static inline u32 next_command(ctlr_info_t *h)
3407{
3408	u32 a;
3409
3410	if (unlikely(h->transMethod != CFGTBL_Trans_Performant))
3411		return h->access.command_completed(h);
3412
3413	if ((*(h->reply_pool_head) & 1) == (h->reply_pool_wraparound)) {
3414		a = *(h->reply_pool_head); /* Next cmd in ring buffer */
3415		(h->reply_pool_head)++;
3416		h->commands_outstanding--;
3417	} else {
3418		a = FIFO_EMPTY;
3419	}
3420	/* Check for wraparound */
3421	if (h->reply_pool_head == (h->reply_pool + h->max_commands)) {
3422		h->reply_pool_head = h->reply_pool;
3423		h->reply_pool_wraparound ^= 1;
3424	}
3425	return a;
3426}
3427
3428/* process completion of an indexed ("direct lookup") command */
3429static inline u32 process_indexed_cmd(ctlr_info_t *h, u32 raw_tag)
3430{
3431	u32 tag_index;
3432	CommandList_struct *c;
3433
3434	tag_index = cciss_tag_to_index(raw_tag);
3435	if (bad_tag(h, tag_index, raw_tag))
3436		return next_command(h);
3437	c = h->cmd_pool + tag_index;
3438	finish_cmd(h, c, raw_tag);
3439	return next_command(h);
3440}
3441
3442/* process completion of a non-indexed command */
3443static inline u32 process_nonindexed_cmd(ctlr_info_t *h, u32 raw_tag)
3444{
3445	u32 tag;
3446	CommandList_struct *c = NULL;
3447	struct hlist_node *tmp;
3448	__u32 busaddr_masked, tag_masked;
3449
3450	tag = cciss_tag_discard_error_bits(raw_tag);
3451	hlist_for_each_entry(c, tmp, &h->cmpQ, list) {
3452		busaddr_masked = cciss_tag_discard_error_bits(c->busaddr);
3453		tag_masked = cciss_tag_discard_error_bits(tag);
3454		if (busaddr_masked == tag_masked) {
3455			finish_cmd(h, c, raw_tag);
3456			return next_command(h);
3457		}
3458	}
3459	bad_tag(h, h->nr_cmds + 1, raw_tag);
3460	return next_command(h);
3461}
3462
3463static irqreturn_t do_cciss_intx(int irq, void *dev_id)
3464{
3465	ctlr_info_t *h = dev_id;
3466	unsigned long flags;
3467	u32 raw_tag;
3468
3469	if (interrupt_not_for_us(h))
3470		return IRQ_NONE;
3471	spin_lock_irqsave(&h->lock, flags);
3472	while (interrupt_pending(h)) {
3473		raw_tag = get_next_completion(h);
3474		while (raw_tag != FIFO_EMPTY) {
3475			if (cciss_tag_contains_index(raw_tag))
3476				raw_tag = process_indexed_cmd(h, raw_tag);
3477			else
3478				raw_tag = process_nonindexed_cmd(h, raw_tag);
3479		}
3480	}
3481	spin_unlock_irqrestore(&h->lock, flags);
3482	return IRQ_HANDLED;
3483}
3484
3485/* Add a second interrupt handler for MSI/MSI-X mode. In this mode we never
3486 * check the interrupt pending register because it is not set.
3487 */
3488static irqreturn_t do_cciss_msix_intr(int irq, void *dev_id)
3489{
3490	ctlr_info_t *h = dev_id;
3491	unsigned long flags;
3492	u32 raw_tag;
3493
3494	spin_lock_irqsave(&h->lock, flags);
3495	raw_tag = get_next_completion(h);
3496	while (raw_tag != FIFO_EMPTY) {
3497		if (cciss_tag_contains_index(raw_tag))
3498			raw_tag = process_indexed_cmd(h, raw_tag);
3499		else
3500			raw_tag = process_nonindexed_cmd(h, raw_tag);
3501	}
3502	spin_unlock_irqrestore(&h->lock, flags);
3503	return IRQ_HANDLED;
3504}
3505
3506/**
3507 * add_to_scan_list() - add controller to rescan queue
3508 * @h:		      Pointer to the controller.
3509 *
3510 * Adds the controller to the rescan queue if not already on the queue.
3511 *
3512 * returns 1 if added to the queue, 0 if skipped (could be on the
3513 * queue already, or the controller could be initializing or shutting
3514 * down).
3515 **/
3516static int add_to_scan_list(struct ctlr_info *h)
3517{
3518	struct ctlr_info *test_h;
3519	int found = 0;
3520	int ret = 0;
3521
3522	if (h->busy_initializing)
3523		return 0;
3524
3525	if (!mutex_trylock(&h->busy_shutting_down))
3526		return 0;
3527
3528	mutex_lock(&scan_mutex);
3529	list_for_each_entry(test_h, &scan_q, scan_list) {
3530		if (test_h == h) {
3531			found = 1;
3532			break;
3533		}
3534	}
3535	if (!found && !h->busy_scanning) {
3536		INIT_COMPLETION(h->scan_wait);
3537		list_add_tail(&h->scan_list, &scan_q);
3538		ret = 1;
3539	}
3540	mutex_unlock(&scan_mutex);
3541	mutex_unlock(&h->busy_shutting_down);
3542
3543	return ret;
3544}
3545
3546/**
3547 * remove_from_scan_list() - remove controller from rescan queue
3548 * @h:			   Pointer to the controller.
3549 *
3550 * Removes the controller from the rescan queue if present. Blocks if
3551 * the controller is currently conducting a rescan.  The controller
3552 * can be in one of three states:
3553 * 1. Doesn't need a scan
3554 * 2. On the scan list, but not scanning yet (we remove it)
3555 * 3. Busy scanning (and not on the list). In this case we want to wait for
3556 *    the scan to complete to make sure the scanning thread for this
3557 *    controller is completely idle.
3558 **/
3559static void remove_from_scan_list(struct ctlr_info *h)
3560{
3561	struct ctlr_info *test_h, *tmp_h;
3562
3563	mutex_lock(&scan_mutex);
3564	list_for_each_entry_safe(test_h, tmp_h, &scan_q, scan_list) {
3565		if (test_h == h) { /* state 2. */
3566			list_del(&h->scan_list);
3567			complete_all(&h->scan_wait);
3568			mutex_unlock(&scan_mutex);
3569			return;
3570		}
3571	}
3572	if (h->busy_scanning) { /* state 3. */
3573		mutex_unlock(&scan_mutex);
3574		wait_for_completion(&h->scan_wait);
3575	} else { /* state 1, nothing to do. */
3576		mutex_unlock(&scan_mutex);
3577	}
3578}
3579
3580/**
3581 * scan_thread() - kernel thread used to rescan controllers
3582 * @data:	 Ignored.
3583 *
3584 * A kernel thread used scan for drive topology changes on
3585 * controllers. The thread processes only one controller at a time
3586 * using a queue.  Controllers are added to the queue using
3587 * add_to_scan_list() and removed from the queue either after done
3588 * processing or using remove_from_scan_list().
3589 *
3590 * returns 0.
3591 **/
3592static int scan_thread(void *data)
3593{
3594	struct ctlr_info *h;
3595
3596	while (1) {
3597		set_current_state(TASK_INTERRUPTIBLE);
3598		schedule();
3599		if (kthread_should_stop())
3600			break;
3601
3602		while (1) {
3603			mutex_lock(&scan_mutex);
3604			if (list_empty(&scan_q)) {
3605				mutex_unlock(&scan_mutex);
3606				break;
3607			}
3608
3609			h = list_entry(scan_q.next,
3610				       struct ctlr_info,
3611				       scan_list);
3612			list_del(&h->scan_list);
3613			h->busy_scanning = 1;
3614			mutex_unlock(&scan_mutex);
3615
3616			rebuild_lun_table(h, 0, 0);
3617			complete_all(&h->scan_wait);
3618			mutex_lock(&scan_mutex);
3619			h->busy_scanning = 0;
3620			mutex_unlock(&scan_mutex);
3621		}
3622	}
3623
3624	return 0;
3625}
3626
3627static int check_for_unit_attention(ctlr_info_t *h, CommandList_struct *c)
3628{
3629	if (c->err_info->SenseInfo[2] != UNIT_ATTENTION)
3630		return 0;
3631
3632	switch (c->err_info->SenseInfo[12]) {
3633	case STATE_CHANGED:
3634		dev_warn(&h->pdev->dev, "a state change "
3635			"detected, command retried\n");
3636		return 1;
3637	break;
3638	case LUN_FAILED:
3639		dev_warn(&h->pdev->dev, "LUN failure "
3640			"detected, action required\n");
3641		return 1;
3642	break;
3643	case REPORT_LUNS_CHANGED:
3644		dev_warn(&h->pdev->dev, "report LUN data changed\n");
3645	/*
3646	 * Here, we could call add_to_scan_list and wake up the scan thread,
3647	 * except that it's quite likely that we will get more than one
3648	 * REPORT_LUNS_CHANGED condition in quick succession, which means
3649	 * that those which occur after the first one will likely happen
3650	 * *during* the scan_thread's rescan.  And the rescan code is not
3651	 * robust enough to restart in the middle, undoing what it has already
3652	 * done, and it's not clear that it's even possible to do this, since
3653	 * part of what it does is notify the block layer, which starts
3654	 * doing it's own i/o to read partition tables and so on, and the
3655	 * driver doesn't have visibility to know what might need undoing.
3656	 * In any event, if possible, it is horribly complicated to get right
3657	 * so we just don't do it for now.
3658	 *
3659	 * Note: this REPORT_LUNS_CHANGED condition only occurs on the MSA2012.
3660	 */
3661		return 1;
3662	break;
3663	case POWER_OR_RESET:
3664		dev_warn(&h->pdev->dev,
3665			"a power on or device reset detected\n");
3666		return 1;
3667	break;
3668	case UNIT_ATTENTION_CLEARED:
3669		dev_warn(&h->pdev->dev,
3670			"unit attention cleared by another initiator\n");
3671		return 1;
3672	break;
3673	default:
3674		dev_warn(&h->pdev->dev, "unknown unit attention detected\n");
3675		return 1;
3676	}
3677}
3678
3679/*
3680 *  We cannot read the structure directly, for portability we must use
3681 *   the io functions.
3682 *   This is for debug only.
3683 */
3684static void print_cfg_table(ctlr_info_t *h)
3685{
3686	int i;
3687	char temp_name[17];
3688	CfgTable_struct *tb = h->cfgtable;
3689
3690	dev_dbg(&h->pdev->dev, "Controller Configuration information\n");
3691	dev_dbg(&h->pdev->dev, "------------------------------------\n");
3692	for (i = 0; i < 4; i++)
3693		temp_name[i] = readb(&(tb->Signature[i]));
3694	temp_name[4] = '\0';
3695	dev_dbg(&h->pdev->dev, "   Signature = %s\n", temp_name);
3696	dev_dbg(&h->pdev->dev, "   Spec Number = %d\n",
3697		readl(&(tb->SpecValence)));
3698	dev_dbg(&h->pdev->dev, "   Transport methods supported = 0x%x\n",
3699	       readl(&(tb->TransportSupport)));
3700	dev_dbg(&h->pdev->dev, "   Transport methods active = 0x%x\n",
3701	       readl(&(tb->TransportActive)));
3702	dev_dbg(&h->pdev->dev, "   Requested transport Method = 0x%x\n",
3703	       readl(&(tb->HostWrite.TransportRequest)));
3704	dev_dbg(&h->pdev->dev, "   Coalesce Interrupt Delay = 0x%x\n",
3705	       readl(&(tb->HostWrite.CoalIntDelay)));
3706	dev_dbg(&h->pdev->dev, "   Coalesce Interrupt Count = 0x%x\n",
3707	       readl(&(tb->HostWrite.CoalIntCount)));
3708	dev_dbg(&h->pdev->dev, "   Max outstanding commands = 0x%d\n",
3709	       readl(&(tb->CmdsOutMax)));
3710	dev_dbg(&h->pdev->dev, "   Bus Types = 0x%x\n",
3711		readl(&(tb->BusTypes)));
3712	for (i = 0; i < 16; i++)
3713		temp_name[i] = readb(&(tb->ServerName[i]));
3714	temp_name[16] = '\0';
3715	dev_dbg(&h->pdev->dev, "   Server Name = %s\n", temp_name);
3716	dev_dbg(&h->pdev->dev, "   Heartbeat Counter = 0x%x\n\n\n",
3717		readl(&(tb->HeartBeat)));
3718}
3719
3720static int find_PCI_BAR_index(struct pci_dev *pdev, unsigned long pci_bar_addr)
3721{
3722	int i, offset, mem_type, bar_type;
3723	if (pci_bar_addr == PCI_BASE_ADDRESS_0)	/* looking for BAR zero? */
3724		return 0;
3725	offset = 0;
3726	for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
3727		bar_type = pci_resource_flags(pdev, i) & PCI_BASE_ADDRESS_SPACE;
3728		if (bar_type == PCI_BASE_ADDRESS_SPACE_IO)
3729			offset += 4;
3730		else {
3731			mem_type = pci_resource_flags(pdev, i) &
3732			    PCI_BASE_ADDRESS_MEM_TYPE_MASK;
3733			switch (mem_type) {
3734			case PCI_BASE_ADDRESS_MEM_TYPE_32:
3735			case PCI_BASE_ADDRESS_MEM_TYPE_1M:
3736				offset += 4;	/* 32 bit */
3737				break;
3738			case PCI_BASE_ADDRESS_MEM_TYPE_64:
3739				offset += 8;
3740				break;
3741			default:	/* reserved in PCI 2.2 */
3742				dev_warn(&pdev->dev,
3743				       "Base address is invalid\n");
3744				return -1;
3745				break;
3746			}
3747		}
3748		if (offset == pci_bar_addr - PCI_BASE_ADDRESS_0)
3749			return i + 1;
3750	}
3751	return -1;
3752}
3753
3754/* Fill in bucket_map[], given nsgs (the max number of
3755 * scatter gather elements supported) and bucket[],
3756 * which is an array of 8 integers.  The bucket[] array
3757 * contains 8 different DMA transfer sizes (in 16
3758 * byte increments) which the controller uses to fetch
3759 * commands.  This function fills in bucket_map[], which
3760 * maps a given number of scatter gather elements to one of
3761 * the 8 DMA transfer sizes.  The point of it is to allow the
3762 * controller to only do as much DMA as needed to fetch the
3763 * command, with the DMA transfer size encoded in the lower
3764 * bits of the command address.
3765 */
3766static void  calc_bucket_map(int bucket[], int num_buckets,
3767	int nsgs, int *bucket_map)
3768{
3769	int i, j, b, size;
3770
3771	/* even a command with 0 SGs requires 4 blocks */
3772#define MINIMUM_TRANSFER_BLOCKS 4
3773#define NUM_BUCKETS 8
3774	/* Note, bucket_map must have nsgs+1 entries. */
3775	for (i = 0; i <= nsgs; i++) {
3776		/* Compute size of a command with i SG entries */
3777		size = i + MINIMUM_TRANSFER_BLOCKS;
3778		b = num_buckets; /* Assume the biggest bucket */
3779		/* Find the bucket that is just big enough */
3780		for (j = 0; j < 8; j++) {
3781			if (bucket[j] >= size) {
3782				b = j;
3783				break;
3784			}
3785		}
3786		/* for a command with i SG entries, use bucket b. */
3787		bucket_map[i] = b;
3788	}
3789}
3790
3791static void __devinit cciss_wait_for_mode_change_ack(ctlr_info_t *h)
3792{
3793	int i;
3794
3795	/* under certain very rare conditions, this can take awhile.
3796	 * (e.g.: hot replace a failed 144GB drive in a RAID 5 set right
3797	 * as we enter this code.) */
3798	for (i = 0; i < MAX_CONFIG_WAIT; i++) {
3799		if (!(readl(h->vaddr + SA5_DOORBELL) & CFGTBL_ChangeReq))
3800			break;
3801		msleep(10);
3802	}
3803}
3804
3805static __devinit void cciss_enter_performant_mode(ctlr_info_t *h)
3806{
3807	/* This is a bit complicated.  There are 8 registers on
3808	 * the controller which we write to to tell it 8 different
3809	 * sizes of commands which there may be.  It's a way of
3810	 * reducing the DMA done to fetch each command.  Encoded into
3811	 * each command's tag are 3 bits which communicate to the controller
3812	 * which of the eight sizes that command fits within.  The size of
3813	 * each command depends on how many scatter gather entries there are.
3814	 * Each SG entry requires 16 bytes.  The eight registers are programmed
3815	 * with the number of 16-byte blocks a command of that size requires.
3816	 * The smallest command possible requires 5 such 16 byte blocks.
3817	 * the largest command possible requires MAXSGENTRIES + 4 16-byte
3818	 * blocks.  Note, this only extends to the SG entries contained
3819	 * within the command block, and does not extend to chained blocks
3820	 * of SG elements.   bft[] contains the eight values we write to
3821	 * the registers.  They are not evenly distributed, but have more
3822	 * sizes for small commands, and fewer sizes for larger commands.
3823	 */
3824	__u32 trans_offset;
3825	int bft[8] = { 5, 6, 8, 10, 12, 20, 28, MAXSGENTRIES + 4};
3826			/*
3827			 *  5 = 1 s/g entry or 4k
3828			 *  6 = 2 s/g entry or 8k
3829			 *  8 = 4 s/g entry or 16k
3830			 * 10 = 6 s/g entry or 24k
3831			 */
3832	unsigned long register_value;
3833	BUILD_BUG_ON(28 > MAXSGENTRIES + 4);
3834
3835	h->reply_pool_wraparound = 1; /* spec: init to 1 */
3836
3837	/* Controller spec: zero out this buffer. */
3838	memset(h->reply_pool, 0, h->max_commands * sizeof(__u64));
3839	h->reply_pool_head = h->reply_pool;
3840
3841	trans_offset = readl(&(h->cfgtable->TransMethodOffset));
3842	calc_bucket_map(bft, ARRAY_SIZE(bft), h->maxsgentries,
3843				h->blockFetchTable);
3844	writel(bft[0], &h->transtable->BlockFetch0);
3845	writel(bft[1], &h->transtable->BlockFetch1);
3846	writel(bft[2], &h->transtable->BlockFetch2);
3847	writel(bft[3], &h->transtable->BlockFetch3);
3848	writel(bft[4], &h->transtable->BlockFetch4);
3849	writel(bft[5], &h->transtable->BlockFetch5);
3850	writel(bft[6], &h->transtable->BlockFetch6);
3851	writel(bft[7], &h->transtable->BlockFetch7);
3852
3853	/* size of controller ring buffer */
3854	writel(h->max_commands, &h->transtable->RepQSize);
3855	writel(1, &h->transtable->RepQCount);
3856	writel(0, &h->transtable->RepQCtrAddrLow32);
3857	writel(0, &h->transtable->RepQCtrAddrHigh32);
3858	writel(h->reply_pool_dhandle, &h->transtable->RepQAddr0Low32);
3859	writel(0, &h->transtable->RepQAddr0High32);
3860	writel(CFGTBL_Trans_Performant,
3861			&(h->cfgtable->HostWrite.TransportRequest));
3862
3863	writel(CFGTBL_ChangeReq, h->vaddr + SA5_DOORBELL);
3864	cciss_wait_for_mode_change_ack(h);
3865	register_value = readl(&(h->cfgtable->TransportActive));
3866	if (!(register_value & CFGTBL_Trans_Performant))
3867		dev_warn(&h->pdev->dev, "cciss: unable to get board into"
3868					" performant mode\n");
3869}
3870
3871static void __devinit cciss_put_controller_into_performant_mode(ctlr_info_t *h)
3872{
3873	__u32 trans_support;
3874
3875	dev_dbg(&h->pdev->dev, "Trying to put board into Performant mode\n");
3876	/* Attempt to put controller into performant mode if supported */
3877	/* Does board support performant mode? */
3878	trans_support = readl(&(h->cfgtable->TransportSupport));
3879	if (!(trans_support & PERFORMANT_MODE))
3880		return;
3881
3882	dev_dbg(&h->pdev->dev, "Placing controller into performant mode\n");
3883	/* Performant mode demands commands on a 32 byte boundary
3884	 * pci_alloc_consistent aligns on page boundarys already.
3885	 * Just need to check if divisible by 32
3886	 */
3887	if ((sizeof(CommandList_struct) % 32) != 0) {
3888		dev_warn(&h->pdev->dev, "%s %d %s\n",
3889			"cciss info: command size[",
3890			(int)sizeof(CommandList_struct),
3891			"] not divisible by 32, no performant mode..\n");
3892		return;
3893	}
3894
3895	/* Performant mode ring buffer and supporting data structures */
3896	h->reply_pool = (__u64 *)pci_alloc_consistent(
3897		h->pdev, h->max_commands * sizeof(__u64),
3898		&(h->reply_pool_dhandle));
3899
3900	/* Need a block fetch table for performant mode */
3901	h->blockFetchTable = kmalloc(((h->maxsgentries+1) *
3902		sizeof(__u32)), GFP_KERNEL);
3903
3904	if ((h->reply_pool == NULL) || (h->blockFetchTable == NULL))
3905		goto clean_up;
3906
3907	cciss_enter_performant_mode(h);
3908
3909	/* Change the access methods to the performant access methods */
3910	h->access = SA5_performant_access;
3911	h->transMethod = CFGTBL_Trans_Performant;
3912
3913	return;
3914clean_up:
3915	kfree(h->blockFetchTable);
3916	if (h->reply_pool)
3917		pci_free_consistent(h->pdev,
3918				h->max_commands * sizeof(__u64),
3919				h->reply_pool,
3920				h->reply_pool_dhandle);
3921	return;
3922
3923} /* cciss_put_controller_into_performant_mode */
3924
3925/* If MSI/MSI-X is supported by the kernel we will try to enable it on
3926 * controllers that are capable. If not, we use IO-APIC mode.
3927 */
3928
3929static void __devinit cciss_interrupt_mode(ctlr_info_t *h)
3930{
3931#ifdef CONFIG_PCI_MSI
3932	int err;
3933	struct msix_entry cciss_msix_entries[4] = { {0, 0}, {0, 1},
3934	{0, 2}, {0, 3}
3935	};
3936
3937	/* Some boards advertise MSI but don't really support it */
3938	if ((h->board_id == 0x40700E11) || (h->board_id == 0x40800E11) ||
3939	    (h->board_id == 0x40820E11) || (h->board_id == 0x40830E11))
3940		goto default_int_mode;
3941
3942	if (pci_find_capability(h->pdev, PCI_CAP_ID_MSIX)) {
3943		err = pci_enable_msix(h->pdev, cciss_msix_entries, 4);
3944		if (!err) {
3945			h->intr[0] = cciss_msix_entries[0].vector;
3946			h->intr[1] = cciss_msix_entries[1].vector;
3947			h->intr[2] = cciss_msix_entries[2].vector;
3948			h->intr[3] = cciss_msix_entries[3].vector;
3949			h->msix_vector = 1;
3950			return;
3951		}
3952		if (err > 0) {
3953			dev_warn(&h->pdev->dev,
3954				"only %d MSI-X vectors available\n", err);
3955			goto default_int_mode;
3956		} else {
3957			dev_warn(&h->pdev->dev,
3958				"MSI-X init failed %d\n", err);
3959			goto default_int_mode;
3960		}
3961	}
3962	if (pci_find_capability(h->pdev, PCI_CAP_ID_MSI)) {
3963		if (!pci_enable_msi(h->pdev))
3964			h->msi_vector = 1;
3965		else
3966			dev_warn(&h->pdev->dev, "MSI init failed\n");
3967	}
3968default_int_mode:
3969#endif				/* CONFIG_PCI_MSI */
3970	/* if we get here we're going to use the default interrupt mode */
3971	h->intr[PERF_MODE_INT] = h->pdev->irq;
3972	return;
3973}
3974
3975static int __devinit cciss_lookup_board_id(struct pci_dev *pdev, u32 *board_id)
3976{
3977	int i;
3978	u32 subsystem_vendor_id, subsystem_device_id;
3979
3980	subsystem_vendor_id = pdev->subsystem_vendor;
3981	subsystem_device_id = pdev->subsystem_device;
3982	*board_id = ((subsystem_device_id << 16) & 0xffff0000) |
3983			subsystem_vendor_id;
3984
3985	for (i = 0; i < ARRAY_SIZE(products); i++) {
3986		/* Stand aside for hpsa driver on request */
3987		if (cciss_allow_hpsa && products[i].board_id == HPSA_BOUNDARY)
3988			return -ENODEV;
3989		if (*board_id == products[i].board_id)
3990			return i;
3991	}
3992	dev_warn(&pdev->dev, "unrecognized board ID: 0x%08x, ignoring.\n",
3993		*board_id);
3994	return -ENODEV;
3995}
3996
3997static inline bool cciss_board_disabled(ctlr_info_t *h)
3998{
3999	u16 command;
4000
4001	(void) pci_read_config_word(h->pdev, PCI_COMMAND, &command);
4002	return ((command & PCI_COMMAND_MEMORY) == 0);
4003}
4004
4005static int __devinit cciss_pci_find_memory_BAR(struct pci_dev *pdev,
4006	unsigned long *memory_bar)
4007{
4008	int i;
4009
4010	for (i = 0; i < DEVICE_COUNT_RESOURCE; i++)
4011		if (pci_resource_flags(pdev, i) & IORESOURCE_MEM) {
4012			/* addressing mode bits already removed */
4013			*memory_bar = pci_resource_start(pdev, i);
4014			dev_dbg(&pdev->dev, "memory BAR = %lx\n",
4015				*memory_bar);
4016			return 0;
4017		}
4018	dev_warn(&pdev->dev, "no memory BAR found\n");
4019	return -ENODEV;
4020}
4021
4022static int __devinit cciss_wait_for_board_ready(ctlr_info_t *h)
4023{
4024	int i;
4025	u32 scratchpad;
4026
4027	for (i = 0; i < CCISS_BOARD_READY_ITERATIONS; i++) {
4028		scratchpad = readl(h->vaddr + SA5_SCRATCHPAD_OFFSET);
4029		if (scratchpad == CCISS_FIRMWARE_READY)
4030			return 0;
4031		msleep(CCISS_BOARD_READY_POLL_INTERVAL_MSECS);
4032	}
4033	dev_warn(&h->pdev->dev, "board not ready, timed out.\n");
4034	return -ENODEV;
4035}
4036
4037static int __devinit cciss_find_cfg_addrs(struct pci_dev *pdev,
4038	void __iomem *vaddr, u32 *cfg_base_addr, u64 *cfg_base_addr_index,
4039	u64 *cfg_offset)
4040{
4041	*cfg_base_addr = readl(vaddr + SA5_CTCFG_OFFSET);
4042	*cfg_offset = readl(vaddr + SA5_CTMEM_OFFSET);
4043	*cfg_base_addr &= (u32) 0x0000ffff;
4044	*cfg_base_addr_index = find_PCI_BAR_index(pdev, *cfg_base_addr);
4045	if (*cfg_base_addr_index == -1) {
4046		dev_warn(&pdev->dev, "cannot find cfg_base_addr_index, "
4047			"*cfg_base_addr = 0x%08x\n", *cfg_base_addr);
4048		return -ENODEV;
4049	}
4050	return 0;
4051}
4052
4053static int __devinit cciss_find_cfgtables(ctlr_info_t *h)
4054{
4055	u64 cfg_offset;
4056	u32 cfg_base_addr;
4057	u64 cfg_base_addr_index;
4058	u32 trans_offset;
4059	int rc;
4060
4061	rc = cciss_find_cfg_addrs(h->pdev, h->vaddr, &cfg_base_addr,
4062		&cfg_base_addr_index, &cfg_offset);
4063	if (rc)
4064		return rc;
4065	h->cfgtable = remap_pci_mem(pci_resource_start(h->pdev,
4066		cfg_base_addr_index) + cfg_offset, sizeof(h->cfgtable));
4067	if (!h->cfgtable)
4068		return -ENOMEM;
4069	/* Find performant mode table. */
4070	trans_offset = readl(&h->cfgtable->TransMethodOffset);
4071	h->transtable = remap_pci_mem(pci_resource_start(h->pdev,
4072				cfg_base_addr_index)+cfg_offset+trans_offset,
4073				sizeof(*h->transtable));
4074	if (!h->transtable)
4075		return -ENOMEM;
4076	return 0;
4077}
4078
4079static void __devinit cciss_get_max_perf_mode_cmds(struct ctlr_info *h)
4080{
4081	h->max_commands = readl(&(h->cfgtable->MaxPerformantModeCommands));
4082	if (h->max_commands < 16) {
4083		dev_warn(&h->pdev->dev, "Controller reports "
4084			"max supported commands of %d, an obvious lie. "
4085			"Using 16.  Ensure that firmware is up to date.\n",
4086			h->max_commands);
4087		h->max_commands = 16;
4088	}
4089}
4090
4091/* Interrogate the hardware for some limits:
4092 * max commands, max SG elements without chaining, and with chaining,
4093 * SG chain block size, etc.
4094 */
4095static void __devinit cciss_find_board_params(ctlr_info_t *h)
4096{
4097	cciss_get_max_perf_mode_cmds(h);
4098	h->nr_cmds = h->max_commands - 4; /* Allow room for some ioctls */
4099	h->maxsgentries = readl(&(h->cfgtable->MaxSGElements));
4100	/*
4101	 * Limit in-command s/g elements to 32 save dma'able memory.
4102	 * Howvever spec says if 0, use 31
4103	 */
4104	h->max_cmd_sgentries = 31;
4105	if (h->maxsgentries > 512) {
4106		h->max_cmd_sgentries = 32;
4107		h->chainsize = h->maxsgentries - h->max_cmd_sgentries + 1;
4108		h->maxsgentries--; /* save one for chain pointer */
4109	} else {
4110		h->maxsgentries = 31; /* default to traditional values */
4111		h->chainsize = 0;
4112	}
4113}
4114
4115static inline bool CISS_signature_present(ctlr_info_t *h)
4116{
4117	if ((readb(&h->cfgtable->Signature[0]) != 'C') ||
4118	    (readb(&h->cfgtable->Signature[1]) != 'I') ||
4119	    (readb(&h->cfgtable->Signature[2]) != 'S') ||
4120	    (readb(&h->cfgtable->Signature[3]) != 'S')) {
4121		dev_warn(&h->pdev->dev, "not a valid CISS config table\n");
4122		return false;
4123	}
4124	return true;
4125}
4126
4127/* Need to enable prefetch in the SCSI core for 6400 in x86 */
4128static inline void cciss_enable_scsi_prefetch(ctlr_info_t *h)
4129{
4130#ifdef CONFIG_X86
4131	u32 prefetch;
4132
4133	prefetch = readl(&(h->cfgtable->SCSI_Prefetch));
4134	prefetch |= 0x100;
4135	writel(prefetch, &(h->cfgtable->SCSI_Prefetch));
4136#endif
4137}
4138
4139/* Disable DMA prefetch for the P600.  Otherwise an ASIC bug may result
4140 * in a prefetch beyond physical memory.
4141 */
4142static inline void cciss_p600_dma_prefetch_quirk(ctlr_info_t *h)
4143{
4144	u32 dma_prefetch;
4145	__u32 dma_refetch;
4146
4147	if (h->board_id != 0x3225103C)
4148		return;
4149	dma_prefetch = readl(h->vaddr + I2O_DMA1_CFG);
4150	dma_prefetch |= 0x8000;
4151	writel(dma_prefetch, h->vaddr + I2O_DMA1_CFG);
4152	pci_read_config_dword(h->pdev, PCI_COMMAND_PARITY, &dma_refetch);
4153	dma_refetch |= 0x1;
4154	pci_write_config_dword(h->pdev, PCI_COMMAND_PARITY, dma_refetch);
4155}
4156
4157static int __devinit cciss_pci_init(ctlr_info_t *h)
4158{
4159	int prod_index, err;
4160
4161	prod_index = cciss_lookup_board_id(h->pdev, &h->board_id);
4162	if (prod_index < 0)
4163		return -ENODEV;
4164	h->product_name = products[prod_index].product_name;
4165	h->access = *(products[prod_index].access);
4166
4167	if (cciss_board_disabled(h)) {
4168		dev_warn(&h->pdev->dev, "controller appears to be disabled\n");
4169		return -ENODEV;
4170	}
4171	err = pci_enable_device(h->pdev);
4172	if (err) {
4173		dev_warn(&h->pdev->dev, "Unable to Enable PCI device\n");
4174		return err;
4175	}
4176
4177	err = pci_request_regions(h->pdev, "cciss");
4178	if (err) {
4179		dev_warn(&h->pdev->dev,
4180			"Cannot obtain PCI resources, aborting\n");
4181		return err;
4182	}
4183
4184	dev_dbg(&h->pdev->dev, "irq = %x\n", h->pdev->irq);
4185	dev_dbg(&h->pdev->dev, "board_id = %x\n", h->board_id);
4186
4187/* If the kernel supports MSI/MSI-X we will try to enable that functionality,
4188 * else we use the IO-APIC interrupt assigned to us by system ROM.
4189 */
4190	cciss_interrupt_mode(h);
4191	err = cciss_pci_find_memory_BAR(h->pdev, &h->paddr);
4192	if (err)
4193		goto err_out_free_res;
4194	h->vaddr = remap_pci_mem(h->paddr, 0x250);
4195	if (!h->vaddr) {
4196		err = -ENOMEM;
4197		goto err_out_free_res;
4198	}
4199	err = cciss_wait_for_board_ready(h);
4200	if (err)
4201		goto err_out_free_res;
4202	err = cciss_find_cfgtables(h);
4203	if (err)
4204		goto err_out_free_res;
4205	print_cfg_table(h);
4206	cciss_find_board_params(h);
4207
4208	if (!CISS_signature_present(h)) {
4209		err = -ENODEV;
4210		goto err_out_free_res;
4211	}
4212	cciss_enable_scsi_prefetch(h);
4213	cciss_p600_dma_prefetch_quirk(h);
4214	cciss_put_controller_into_performant_mode(h);
4215	return 0;
4216
4217err_out_free_res:
4218	/*
4219	 * Deliberately omit pci_disable_device(): it does something nasty to
4220	 * Smart Array controllers that pci_enable_device does not undo
4221	 */
4222	if (h->transtable)
4223		iounmap(h->transtable);
4224	if (h->cfgtable)
4225		iounmap(h->cfgtable);
4226	if (h->vaddr)
4227		iounmap(h->vaddr);
4228	pci_release_regions(h->pdev);
4229	return err;
4230}
4231
4232/* Function to find the first free pointer into our hba[] array
4233 * Returns -1 if no free entries are left.
4234 */
4235static int alloc_cciss_hba(struct pci_dev *pdev)
4236{
4237	int i;
4238
4239	for (i = 0; i < MAX_CTLR; i++) {
4240		if (!hba[i]) {
4241			ctlr_info_t *h;
4242
4243			h = kzalloc(sizeof(ctlr_info_t), GFP_KERNEL);
4244			if (!h)
4245				goto Enomem;
4246			hba[i] = h;
4247			return i;
4248		}
4249	}
4250	dev_warn(&pdev->dev, "This driver supports a maximum"
4251	       " of %d controllers.\n", MAX_CTLR);
4252	return -1;
4253Enomem:
4254	dev_warn(&pdev->dev, "out of memory.\n");
4255	return -1;
4256}
4257
4258static void free_hba(ctlr_info_t *h)
4259{
4260	int i;
4261
4262	hba[h->ctlr] = NULL;
4263	for (i = 0; i < h->highest_lun + 1; i++)
4264		if (h->gendisk[i] != NULL)
4265			put_disk(h->gendisk[i]);
4266	kfree(h);
4267}
4268
4269/* Send a message CDB to the firmware. */
4270static __devinit int cciss_message(struct pci_dev *pdev, unsigned char opcode, unsigned char type)
4271{
4272	typedef struct {
4273		CommandListHeader_struct CommandHeader;
4274		RequestBlock_struct Request;
4275		ErrDescriptor_struct ErrorDescriptor;
4276	} Command;
4277	static const size_t cmd_sz = sizeof(Command) + sizeof(ErrorInfo_struct);
4278	Command *cmd;
4279	dma_addr_t paddr64;
4280	uint32_t paddr32, tag;
4281	void __iomem *vaddr;
4282	int i, err;
4283
4284	vaddr = ioremap_nocache(pci_resource_start(pdev, 0), pci_resource_len(pdev, 0));
4285	if (vaddr == NULL)
4286		return -ENOMEM;
4287
4288	/* The Inbound Post Queue only accepts 32-bit physical addresses for the
4289	   CCISS commands, so they must be allocated from the lower 4GiB of
4290	   memory. */
4291	err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32));
4292	if (err) {
4293		iounmap(vaddr);
4294		return -ENOMEM;
4295	}
4296
4297	cmd = pci_alloc_consistent(pdev, cmd_sz, &paddr64);
4298	if (cmd == NULL) {
4299		iounmap(vaddr);
4300		return -ENOMEM;
4301	}
4302
4303	/* This must fit, because of the 32-bit consistent DMA mask.  Also,
4304	   although there's no guarantee, we assume that the address is at
4305	   least 4-byte aligned (most likely, it's page-aligned). */
4306	paddr32 = paddr64;
4307
4308	cmd->CommandHeader.ReplyQueue = 0;
4309	cmd->CommandHeader.SGList = 0;
4310	cmd->CommandHeader.SGTotal = 0;
4311	cmd->CommandHeader.Tag.lower = paddr32;
4312	cmd->CommandHeader.Tag.upper = 0;
4313	memset(&cmd->CommandHeader.LUN.LunAddrBytes, 0, 8);
4314
4315	cmd->Request.CDBLen = 16;
4316	cmd->Request.Type.Type = TYPE_MSG;
4317	cmd->Request.Type.Attribute = ATTR_HEADOFQUEUE;
4318	cmd->Request.Type.Direction = XFER_NONE;
4319	cmd->Request.Timeout = 0; /* Don't time out */
4320	cmd->Request.CDB[0] = opcode;
4321	cmd->Request.CDB[1] = type;
4322	memset(&cmd->Request.CDB[2], 0, 14); /* the rest of the CDB is reserved */
4323
4324	cmd->ErrorDescriptor.Addr.lower = paddr32 + sizeof(Command);
4325	cmd->ErrorDescriptor.Addr.upper = 0;
4326	cmd->ErrorDescriptor.Len = sizeof(ErrorInfo_struct);
4327
4328	writel(paddr32, vaddr + SA5_REQUEST_PORT_OFFSET);
4329
4330	for (i = 0; i < 10; i++) {
4331		tag = readl(vaddr + SA5_REPLY_PORT_OFFSET);
4332		if ((tag & ~3) == paddr32)
4333			break;
4334		schedule_timeout_uninterruptible(HZ);
4335	}
4336
4337	iounmap(vaddr);
4338
4339	/* we leak the DMA buffer here ... no choice since the controller could
4340	   still complete the command. */
4341	if (i == 10) {
4342		dev_err(&pdev->dev,
4343			"controller message %02x:%02x timed out\n",
4344			opcode, type);
4345		return -ETIMEDOUT;
4346	}
4347
4348	pci_free_consistent(pdev, cmd_sz, cmd, paddr64);
4349
4350	if (tag & 2) {
4351		dev_err(&pdev->dev, "controller message %02x:%02x failed\n",
4352			opcode, type);
4353		return -EIO;
4354	}
4355
4356	dev_info(&pdev->dev, "controller message %02x:%02x succeeded\n",
4357		opcode, type);
4358	return 0;
4359}
4360
4361#define cciss_soft_reset_controller(p) cciss_message(p, 1, 0)
4362#define cciss_noop(p) cciss_message(p, 3, 0)
4363
4364static __devinit int cciss_reset_msi(struct pci_dev *pdev)
4365{
4366/* the #defines are stolen from drivers/pci/msi.h. */
4367#define msi_control_reg(base)		(base + PCI_MSI_FLAGS)
4368#define PCI_MSIX_FLAGS_ENABLE		(1 << 15)
4369
4370	int pos;
4371	u16 control = 0;
4372
4373	pos = pci_find_capability(pdev, PCI_CAP_ID_MSI);
4374	if (pos) {
4375		pci_read_config_word(pdev, msi_control_reg(pos), &control);
4376		if (control & PCI_MSI_FLAGS_ENABLE) {
4377			dev_info(&pdev->dev, "resetting MSI\n");
4378			pci_write_config_word(pdev, msi_control_reg(pos), control & ~PCI_MSI_FLAGS_ENABLE);
4379		}
4380	}
4381
4382	pos = pci_find_capability(pdev, PCI_CAP_ID_MSIX);
4383	if (pos) {
4384		pci_read_config_word(pdev, msi_control_reg(pos), &control);
4385		if (control & PCI_MSIX_FLAGS_ENABLE) {
4386			dev_info(&pdev->dev, "resetting MSI-X\n");
4387			pci_write_config_word(pdev, msi_control_reg(pos), control & ~PCI_MSIX_FLAGS_ENABLE);
4388		}
4389	}
4390
4391	return 0;
4392}
4393
4394static int cciss_controller_hard_reset(struct pci_dev *pdev,
4395	void * __iomem vaddr, bool use_doorbell)
4396{
4397	u16 pmcsr;
4398	int pos;
4399
4400	if (use_doorbell) {
4401		/* For everything after the P600, the PCI power state method
4402		 * of resetting the controller doesn't work, so we have this
4403		 * other way using the doorbell register.
4404		 */
4405		dev_info(&pdev->dev, "using doorbell to reset controller\n");
4406		writel(DOORBELL_CTLR_RESET, vaddr + SA5_DOORBELL);
4407		msleep(1000);
4408	} else { /* Try to do it the PCI power state way */
4409
4410		/* Quoting from the Open CISS Specification: "The Power
4411		 * Management Control/Status Register (CSR) controls the power
4412		 * state of the device.  The normal operating state is D0,
4413		 * CSR=00h.  The software off state is D3, CSR=03h.  To reset
4414		 * the controller, place the interface device in D3 then to D0,
4415		 * this causes a secondary PCI reset which will reset the
4416		 * controller." */
4417
4418		pos = pci_find_capability(pdev, PCI_CAP_ID_PM);
4419		if (pos == 0) {
4420			dev_err(&pdev->dev,
4421				"cciss_controller_hard_reset: "
4422				"PCI PM not supported\n");
4423			return -ENODEV;
4424		}
4425		dev_info(&pdev->dev, "using PCI PM to reset controller\n");
4426		/* enter the D3hot power management state */
4427		pci_read_config_word(pdev, pos + PCI_PM_CTRL, &pmcsr);
4428		pmcsr &= ~PCI_PM_CTRL_STATE_MASK;
4429		pmcsr |= PCI_D3hot;
4430		pci_write_config_word(pdev, pos + PCI_PM_CTRL, pmcsr);
4431
4432		msleep(500);
4433
4434		/* enter the D0 power management state */
4435		pmcsr &= ~PCI_PM_CTRL_STATE_MASK;
4436		pmcsr |= PCI_D0;
4437		pci_write_config_word(pdev, pos + PCI_PM_CTRL, pmcsr);
4438
4439		msleep(500);
4440	}
4441	return 0;
4442}
4443
4444/* This does a hard reset of the controller using PCI power management
4445 * states or using the doorbell register. */
4446static __devinit int cciss_kdump_hard_reset_controller(struct pci_dev *pdev)
4447{
4448	u16 saved_config_space[32];
4449	u64 cfg_offset;
4450	u32 cfg_base_addr;
4451	u64 cfg_base_addr_index;
4452	void __iomem *vaddr;
4453	unsigned long paddr;
4454	u32 misc_fw_support, active_transport;
4455	int rc, i;
4456	CfgTable_struct __iomem *cfgtable;
4457	bool use_doorbell;
4458	u32 board_id;
4459
4460	/* For controllers as old a the p600, this is very nearly
4461	 * the same thing as
4462	 *
4463	 * pci_save_state(pci_dev);
4464	 * pci_set_power_state(pci_dev, PCI_D3hot);
4465	 * pci_set_power_state(pci_dev, PCI_D0);
4466	 * pci_restore_state(pci_dev);
4467	 *
4468	 * but we can't use these nice canned kernel routines on
4469	 * kexec, because they also check the MSI/MSI-X state in PCI
4470	 * configuration space and do the wrong thing when it is
4471	 * set/cleared.  Also, the pci_save/restore_state functions
4472	 * violate the ordering requirements for restoring the
4473	 * configuration space from the CCISS document (see the
4474	 * comment below).  So we roll our own ....
4475	 *
4476	 * For controllers newer than the P600, the pci power state
4477	 * method of resetting doesn't work so we have another way
4478	 * using the doorbell register.
4479	 */
4480
4481	/* Exclude 640x boards.  These are two pci devices in one slot
4482	 * which share a battery backed cache module.  One controls the
4483	 * cache, the other accesses the cache through the one that controls
4484	 * it.  If we reset the one controlling the cache, the other will
4485	 * likely not be happy.  Just forbid resetting this conjoined mess.
4486	 */
4487	cciss_lookup_board_id(pdev, &board_id);
4488	if (board_id == 0x409C0E11 || board_id == 0x409D0E11) {
4489		dev_warn(&pdev->dev, "Cannot reset Smart Array 640x "
4490				"due to shared cache module.");
4491		return -ENODEV;
4492	}
4493
4494	for (i = 0; i < 32; i++)
4495		pci_read_config_word(pdev, 2*i, &saved_config_space[i]);
4496
4497	/* find the first memory BAR, so we can find the cfg table */
4498	rc = cciss_pci_find_memory_BAR(pdev, &paddr);
4499	if (rc)
4500		return rc;
4501	vaddr = remap_pci_mem(paddr, 0x250);
4502	if (!vaddr)
4503		return -ENOMEM;
4504
4505	/* find cfgtable in order to check if reset via doorbell is supported */
4506	rc = cciss_find_cfg_addrs(pdev, vaddr, &cfg_base_addr,
4507					&cfg_base_addr_index, &cfg_offset);
4508	if (rc)
4509		goto unmap_vaddr;
4510	cfgtable = remap_pci_mem(pci_resource_start(pdev,
4511		       cfg_base_addr_index) + cfg_offset, sizeof(*cfgtable));
4512	if (!cfgtable) {
4513		rc = -ENOMEM;
4514		goto unmap_vaddr;
4515	}
4516
4517	/* If reset via doorbell register is supported, use that. */
4518	misc_fw_support = readl(&cfgtable->misc_fw_support);
4519	use_doorbell = misc_fw_support & MISC_FW_DOORBELL_RESET;
4520
4521	rc = cciss_controller_hard_reset(pdev, vaddr, use_doorbell);
4522	if (rc)
4523		goto unmap_cfgtable;
4524
4525	/* Restore the PCI configuration space.  The Open CISS
4526	 * Specification says, "Restore the PCI Configuration
4527	 * Registers, offsets 00h through 60h. It is important to
4528	 * restore the command register, 16-bits at offset 04h,
4529	 * last. Do not restore the configuration status register,
4530	 * 16-bits at offset 06h."  Note that the offset is 2*i.
4531	 */
4532	for (i = 0; i < 32; i++) {
4533		if (i == 2 || i == 3)
4534			continue;
4535		pci_write_config_word(pdev, 2*i, saved_config_space[i]);
4536	}
4537	wmb();
4538	pci_write_config_word(pdev, 4, saved_config_space[2]);
4539
4540	/* Some devices (notably the HP Smart Array 5i Controller)
4541	   need a little pause here */
4542	msleep(CCISS_POST_RESET_PAUSE_MSECS);
4543
4544	/* Controller should be in simple mode at this point.  If it's not,
4545	 * It means we're on one of those controllers which doesn't support
4546	 * the doorbell reset method and on which the PCI power management reset
4547	 * method doesn't work (P800, for example.)
4548	 * In those cases, don't try to proceed, as it generally doesn't work.
4549	 */
4550	active_transport = readl(&cfgtable->TransportActive);
4551	if (active_transport & PERFORMANT_MODE) {
4552		dev_warn(&pdev->dev, "Unable to successfully reset controller,"
4553			" Ignoring controller.\n");
4554		rc = -ENODEV;
4555	}
4556
4557unmap_cfgtable:
4558	iounmap(cfgtable);
4559
4560unmap_vaddr:
4561	iounmap(vaddr);
4562	return rc;
4563}
4564
4565static __devinit int cciss_init_reset_devices(struct pci_dev *pdev)
4566{
4567	int rc, i;
4568
4569	if (!reset_devices)
4570		return 0;
4571
4572	/* Reset the controller with a PCI power-cycle or via doorbell */
4573	rc = cciss_kdump_hard_reset_controller(pdev);
4574
4575	/* -ENOTSUPP here means we cannot reset the controller
4576	 * but it's already (and still) up and running in
4577	 * "performant mode".  Or, it might be 640x, which can't reset
4578	 * due to concerns about shared bbwc between 6402/6404 pair.
4579	 */
4580	if (rc == -ENOTSUPP)
4581		return 0; /* just try to do the kdump anyhow. */
4582	if (rc)
4583		return -ENODEV;
4584	if (cciss_reset_msi(pdev))
4585		return -ENODEV;
4586
4587	/* Now try to get the controller to respond to a no-op */
4588	for (i = 0; i < CCISS_POST_RESET_NOOP_RETRIES; i++) {
4589		if (cciss_noop(pdev) == 0)
4590			break;
4591		else
4592			dev_warn(&pdev->dev, "no-op failed%s\n",
4593				(i < CCISS_POST_RESET_NOOP_RETRIES - 1 ?
4594					"; re-trying" : ""));
4595		msleep(CCISS_POST_RESET_NOOP_INTERVAL_MSECS);
4596	}
4597	return 0;
4598}
4599
4600/*
4601 *  This is it.  Find all the controllers and register them.  I really hate
4602 *  stealing all these major device numbers.
4603 *  returns the number of block devices registered.
4604 */
4605static int __devinit cciss_init_one(struct pci_dev *pdev,
4606				    const struct pci_device_id *ent)
4607{
4608	int i;
4609	int j = 0;
4610	int k = 0;
4611	int rc;
4612	int dac, return_code;
4613	InquiryData_struct *inq_buff;
4614	ctlr_info_t *h;
4615
4616	rc = cciss_init_reset_devices(pdev);
4617	if (rc)
4618		return rc;
4619	i = alloc_cciss_hba(pdev);
4620	if (i < 0)
4621		return -1;
4622
4623	h = hba[i];
4624	h->pdev = pdev;
4625	h->busy_initializing = 1;
4626	INIT_HLIST_HEAD(&h->cmpQ);
4627	INIT_HLIST_HEAD(&h->reqQ);
4628	mutex_init(&h->busy_shutting_down);
4629
4630	if (cciss_pci_init(h) != 0)
4631		goto clean_no_release_regions;
4632
4633	sprintf(h->devname, "cciss%d", i);
4634	h->ctlr = i;
4635
4636	init_completion(&h->scan_wait);
4637
4638	if (cciss_create_hba_sysfs_entry(h))
4639		goto clean0;
4640
4641	/* configure PCI DMA stuff */
4642	if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(64)))
4643		dac = 1;
4644	else if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(32)))
4645		dac = 0;
4646	else {
4647		dev_err(&h->pdev->dev, "no suitable DMA available\n");
4648		goto clean1;
4649	}
4650
4651	/*
4652	 * register with the major number, or get a dynamic major number
4653	 * by passing 0 as argument.  This is done for greater than
4654	 * 8 controller support.
4655	 */
4656	if (i < MAX_CTLR_ORIG)
4657		h->major = COMPAQ_CISS_MAJOR + i;
4658	rc = register_blkdev(h->major, h->devname);
4659	if (rc == -EBUSY || rc == -EINVAL) {
4660		dev_err(&h->pdev->dev,
4661		       "Unable to get major number %d for %s "
4662		       "on hba %d\n", h->major, h->devname, i);
4663		goto clean1;
4664	} else {
4665		if (i >= MAX_CTLR_ORIG)
4666			h->major = rc;
4667	}
4668
4669	/* make sure the board interrupts are off */
4670	h->access.set_intr_mask(h, CCISS_INTR_OFF);
4671	if (h->msi_vector || h->msix_vector) {
4672		if (request_irq(h->intr[PERF_MODE_INT],
4673				do_cciss_msix_intr,
4674				IRQF_DISABLED, h->devname, h)) {
4675			dev_err(&h->pdev->dev, "Unable to get irq %d for %s\n",
4676			       h->intr[PERF_MODE_INT], h->devname);
4677			goto clean2;
4678		}
4679	} else {
4680		if (request_irq(h->intr[PERF_MODE_INT], do_cciss_intx,
4681				IRQF_DISABLED, h->devname, h)) {
4682			dev_err(&h->pdev->dev, "Unable to get irq %d for %s\n",
4683			       h->intr[PERF_MODE_INT], h->devname);
4684			goto clean2;
4685		}
4686	}
4687
4688	dev_info(&h->pdev->dev, "%s: <0x%x> at PCI %s IRQ %d%s using DAC\n",
4689	       h->devname, pdev->device, pci_name(pdev),
4690	       h->intr[PERF_MODE_INT], dac ? "" : " not");
4691
4692	h->cmd_pool_bits =
4693	    kmalloc(DIV_ROUND_UP(h->nr_cmds, BITS_PER_LONG)
4694			* sizeof(unsigned long), GFP_KERNEL);
4695	h->cmd_pool = (CommandList_struct *)
4696	    pci_alloc_consistent(h->pdev,
4697		    h->nr_cmds * sizeof(CommandList_struct),
4698		    &(h->cmd_pool_dhandle));
4699	h->errinfo_pool = (ErrorInfo_struct *)
4700	    pci_alloc_consistent(h->pdev,
4701		    h->nr_cmds * sizeof(ErrorInfo_struct),
4702		    &(h->errinfo_pool_dhandle));
4703	if ((h->cmd_pool_bits == NULL)
4704	    || (h->cmd_pool == NULL)
4705	    || (h->errinfo_pool == NULL)) {
4706		dev_err(&h->pdev->dev, "out of memory");
4707		goto clean4;
4708	}
4709
4710	/* Need space for temp scatter list */
4711	h->scatter_list = kmalloc(h->max_commands *
4712						sizeof(struct scatterlist *),
4713						GFP_KERNEL);
4714	for (k = 0; k < h->nr_cmds; k++) {
4715		h->scatter_list[k] = kmalloc(sizeof(struct scatterlist) *
4716							h->maxsgentries,
4717							GFP_KERNEL);
4718		if (h->scatter_list[k] == NULL) {
4719			dev_err(&h->pdev->dev,
4720				"could not allocate s/g lists\n");
4721			goto clean4;
4722		}
4723	}
4724	h->cmd_sg_list = cciss_allocate_sg_chain_blocks(h,
4725		h->chainsize, h->nr_cmds);
4726	if (!h->cmd_sg_list && h->chainsize > 0)
4727		goto clean4;
4728
4729	spin_lock_init(&h->lock);
4730
4731	/* Initialize the pdev driver private data.
4732	   have it point to h.  */
4733	pci_set_drvdata(pdev, h);
4734	/* command and error info recs zeroed out before
4735	   they are used */
4736	memset(h->cmd_pool_bits, 0,
4737	       DIV_ROUND_UP(h->nr_cmds, BITS_PER_LONG)
4738			* sizeof(unsigned long));
4739
4740	h->num_luns = 0;
4741	h->highest_lun = -1;
4742	for (j = 0; j < CISS_MAX_LUN; j++) {
4743		h->drv[j] = NULL;
4744		h->gendisk[j] = NULL;
4745	}
4746
4747	cciss_scsi_setup(h);
4748
4749	/* Turn the interrupts on so we can service requests */
4750	h->access.set_intr_mask(h, CCISS_INTR_ON);
4751
4752	/* Get the firmware version */
4753	inq_buff = kzalloc(sizeof(InquiryData_struct), GFP_KERNEL);
4754	if (inq_buff == NULL) {
4755		dev_err(&h->pdev->dev, "out of memory\n");
4756		goto clean4;
4757	}
4758
4759	return_code = sendcmd_withirq(h, CISS_INQUIRY, inq_buff,
4760		sizeof(InquiryData_struct), 0, CTLR_LUNID, TYPE_CMD);
4761	if (return_code == IO_OK) {
4762		h->firm_ver[0] = inq_buff->data_byte[32];
4763		h->firm_ver[1] = inq_buff->data_byte[33];
4764		h->firm_ver[2] = inq_buff->data_byte[34];
4765		h->firm_ver[3] = inq_buff->data_byte[35];
4766	} else {	 /* send command failed */
4767		dev_warn(&h->pdev->dev, "unable to determine firmware"
4768			" version of controller\n");
4769	}
4770	kfree(inq_buff);
4771
4772	cciss_procinit(h);
4773
4774	h->cciss_max_sectors = 8192;
4775
4776	rebuild_lun_table(h, 1, 0);
4777	h->busy_initializing = 0;
4778	return 1;
4779
4780clean4:
4781	kfree(h->cmd_pool_bits);
4782	/* Free up sg elements */
4783	for (k = 0; k < h->nr_cmds; k++)
4784		kfree(h->scatter_list[k]);
4785	kfree(h->scatter_list);
4786	cciss_free_sg_chain_blocks(h->cmd_sg_list, h->nr_cmds);
4787	if (h->cmd_pool)
4788		pci_free_consistent(h->pdev,
4789				    h->nr_cmds * sizeof(CommandList_struct),
4790				    h->cmd_pool, h->cmd_pool_dhandle);
4791	if (h->errinfo_pool)
4792		pci_free_consistent(h->pdev,
4793				    h->nr_cmds * sizeof(ErrorInfo_struct),
4794				    h->errinfo_pool,
4795				    h->errinfo_pool_dhandle);
4796	free_irq(h->intr[PERF_MODE_INT], h);
4797clean2:
4798	unregister_blkdev(h->major, h->devname);
4799clean1:
4800	cciss_destroy_hba_sysfs_entry(h);
4801clean0:
4802	pci_release_regions(pdev);
4803clean_no_release_regions:
4804	h->busy_initializing = 0;
4805
4806	/*
4807	 * Deliberately omit pci_disable_device(): it does something nasty to
4808	 * Smart Array controllers that pci_enable_device does not undo
4809	 */
4810	pci_set_drvdata(pdev, NULL);
4811	free_hba(h);
4812	return -1;
4813}
4814
4815static void cciss_shutdown(struct pci_dev *pdev)
4816{
4817	ctlr_info_t *h;
4818	char *flush_buf;
4819	int return_code;
4820
4821	h = pci_get_drvdata(pdev);
4822	flush_buf = kzalloc(4, GFP_KERNEL);
4823	if (!flush_buf) {
4824		dev_warn(&h->pdev->dev, "cache not flushed, out of memory.\n");
4825		return;
4826	}
4827	/* write all data in the battery backed cache to disk */
4828	memset(flush_buf, 0, 4);
4829	return_code = sendcmd_withirq(h, CCISS_CACHE_FLUSH, flush_buf,
4830		4, 0, CTLR_LUNID, TYPE_CMD);
4831	kfree(flush_buf);
4832	if (return_code != IO_OK)
4833		dev_warn(&h->pdev->dev, "Error flushing cache\n");
4834	h->access.set_intr_mask(h, CCISS_INTR_OFF);
4835	free_irq(h->intr[PERF_MODE_INT], h);
4836}
4837
4838static void __devexit cciss_remove_one(struct pci_dev *pdev)
4839{
4840	ctlr_info_t *h;
4841	int i, j;
4842
4843	if (pci_get_drvdata(pdev) == NULL) {
4844		dev_err(&pdev->dev, "Unable to remove device\n");
4845		return;
4846	}
4847
4848	h = pci_get_drvdata(pdev);
4849	i = h->ctlr;
4850	if (hba[i] == NULL) {
4851		dev_err(&pdev->dev, "device appears to already be removed\n");
4852		return;
4853	}
4854
4855	mutex_lock(&h->busy_shutting_down);
4856
4857	remove_from_scan_list(h);
4858	remove_proc_entry(h->devname, proc_cciss);
4859	unregister_blkdev(h->major, h->devname);
4860
4861	/* remove it from the disk list */
4862	for (j = 0; j < CISS_MAX_LUN; j++) {
4863		struct gendisk *disk = h->gendisk[j];
4864		if (disk) {
4865			struct request_queue *q = disk->queue;
4866
4867			if (disk->flags & GENHD_FL_UP) {
4868				cciss_destroy_ld_sysfs_entry(h, j, 1);
4869				del_gendisk(disk);
4870			}
4871			if (q)
4872				blk_cleanup_queue(q);
4873		}
4874	}
4875
4876#ifdef CONFIG_CISS_SCSI_TAPE
4877	cciss_unregister_scsi(h);	/* unhook from SCSI subsystem */
4878#endif
4879
4880	cciss_shutdown(pdev);
4881
4882#ifdef CONFIG_PCI_MSI
4883	if (h->msix_vector)
4884		pci_disable_msix(h->pdev);
4885	else if (h->msi_vector)
4886		pci_disable_msi(h->pdev);
4887#endif				/* CONFIG_PCI_MSI */
4888
4889	iounmap(h->transtable);
4890	iounmap(h->cfgtable);
4891	iounmap(h->vaddr);
4892
4893	pci_free_consistent(h->pdev, h->nr_cmds * sizeof(CommandList_struct),
4894			    h->cmd_pool, h->cmd_pool_dhandle);
4895	pci_free_consistent(h->pdev, h->nr_cmds * sizeof(ErrorInfo_struct),
4896			    h->errinfo_pool, h->errinfo_pool_dhandle);
4897	kfree(h->cmd_pool_bits);
4898	/* Free up sg elements */
4899	for (j = 0; j < h->nr_cmds; j++)
4900		kfree(h->scatter_list[j]);
4901	kfree(h->scatter_list);
4902	cciss_free_sg_chain_blocks(h->cmd_sg_list, h->nr_cmds);
4903	/*
4904	 * Deliberately omit pci_disable_device(): it does something nasty to
4905	 * Smart Array controllers that pci_enable_device does not undo
4906	 */
4907	pci_release_regions(pdev);
4908	pci_set_drvdata(pdev, NULL);
4909	cciss_destroy_hba_sysfs_entry(h);
4910	mutex_unlock(&h->busy_shutting_down);
4911	free_hba(h);
4912}
4913
4914static struct pci_driver cciss_pci_driver = {
4915	.name = "cciss",
4916	.probe = cciss_init_one,
4917	.remove = __devexit_p(cciss_remove_one),
4918	.id_table = cciss_pci_device_id,	/* id_table */
4919	.shutdown = cciss_shutdown,
4920};
4921
4922/*
4923 *  This is it.  Register the PCI driver information for the cards we control
4924 *  the OS will call our registered routines when it finds one of our cards.
4925 */
4926static int __init cciss_init(void)
4927{
4928	int err;
4929
4930	/*
4931	 * The hardware requires that commands are aligned on a 64-bit
4932	 * boundary. Given that we use pci_alloc_consistent() to allocate an
4933	 * array of them, the size must be a multiple of 8 bytes.
4934	 */
4935	BUILD_BUG_ON(sizeof(CommandList_struct) % COMMANDLIST_ALIGNMENT);
4936	printk(KERN_INFO DRIVER_NAME "\n");
4937
4938	err = bus_register(&cciss_bus_type);
4939	if (err)
4940		return err;
4941
4942	/* Start the scan thread */
4943	cciss_scan_thread = kthread_run(scan_thread, NULL, "cciss_scan");
4944	if (IS_ERR(cciss_scan_thread)) {
4945		err = PTR_ERR(cciss_scan_thread);
4946		goto err_bus_unregister;
4947	}
4948
4949	/* Register for our PCI devices */
4950	err = pci_register_driver(&cciss_pci_driver);
4951	if (err)
4952		goto err_thread_stop;
4953
4954	return err;
4955
4956err_thread_stop:
4957	kthread_stop(cciss_scan_thread);
4958err_bus_unregister:
4959	bus_unregister(&cciss_bus_type);
4960
4961	return err;
4962}
4963
4964static void __exit cciss_cleanup(void)
4965{
4966	int i;
4967
4968	pci_unregister_driver(&cciss_pci_driver);
4969	/* double check that all controller entrys have been removed */
4970	for (i = 0; i < MAX_CTLR; i++) {
4971		if (hba[i] != NULL) {
4972			dev_warn(&hba[i]->pdev->dev,
4973				"had to remove controller\n");
4974			cciss_remove_one(hba[i]->pdev);
4975		}
4976	}
4977	kthread_stop(cciss_scan_thread);
4978	remove_proc_entry("driver/cciss", NULL);
4979	bus_unregister(&cciss_bus_type);
4980}
4981
4982module_init(cciss_init);
4983module_exit(cciss_cleanup);
4984