SAFE public projects git trees. - safe/jmp/linux-2.6/blob - drivers/block/cciss.c

   1 /*
   2  *    Disk Array driver for HP Smart Array controllers.
   3  *    (C) Copyright 2000, 2007 Hewlett-Packard Development Company, L.P.
   4  *
   5  *    This program is free software; you can redistribute it and/or modify
   6  *    it under the terms of the GNU General Public License as published by
   7  *    the Free Software Foundation; version 2 of the License.
   8  *
   9  *    This program is distributed in the hope that it will be useful,
  10  *    but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  *    MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  12  *    General Public License for more details.
  13  *
  14  *    You should have received a copy of the GNU General Public License
  15  *    along with this program; if not, write to the Free Software
  16  *    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
  17  *    02111-1307, USA.
  18  *
  19  *    Questions/Comments/Bugfixes to iss_storagedev@hp.com
  20  *
  21  */
  22
  23 #include <linux/module.h>
  24 #include <linux/interrupt.h>
  25 #include <linux/types.h>
  26 #include <linux/pci.h>
  27 #include <linux/kernel.h>
  28 #include <linux/slab.h>
  29 #include <linux/delay.h>
  30 #include <linux/major.h>
  31 #include <linux/fs.h>
  32 #include <linux/bio.h>
  33 #include <linux/blkpg.h>
  34 #include <linux/timer.h>
  35 #include <linux/proc_fs.h>
  36 #include <linux/seq_file.h>
  37 #include <linux/init.h>
  38 #include <linux/hdreg.h>
  39 #include <linux/spinlock.h>
  40 #include <linux/compat.h>
  41 #include <linux/blktrace_api.h>
  42 #include <asm/uaccess.h>
  43 #include <asm/io.h>
  44
  45 #include <linux/dma-mapping.h>
  46 #include <linux/blkdev.h>
  47 #include <linux/genhd.h>
  48 #include <linux/completion.h>
  49 #include <scsi/scsi.h>
  50 #include <scsi/sg.h>
  51 #include <scsi/scsi_ioctl.h>
  52 #include <linux/cdrom.h>
  53 #include <linux/scatterlist.h>
  54
  55 #define CCISS_DRIVER_VERSION(maj,min,submin) ((maj<<16)|(min<<8)|(submin))
  56 #define DRIVER_NAME "HP CISS Driver (v 3.6.20)"
  57 #define DRIVER_VERSION CCISS_DRIVER_VERSION(3, 6, 20)
  58
  59 /* Embedded module documentation macros - see modules.h */
  60 MODULE_AUTHOR("Hewlett-Packard Company");
  61 MODULE_DESCRIPTION("Driver for HP Smart Array Controllers");
  62 MODULE_SUPPORTED_DEVICE("HP SA5i SA5i+ SA532 SA5300 SA5312 SA641 SA642 SA6400"
  63                         " SA6i P600 P800 P400 P400i E200 E200i E500 P700m"
  64                         " Smart Array G2 Series SAS/SATA Controllers");
  65 MODULE_VERSION("3.6.20");
  66 MODULE_LICENSE("GPL");
  67
  68 #include "cciss_cmd.h"
  69 #include "cciss.h"
  70 #include <linux/cciss_ioctl.h>
  71
  72 /* define the PCI info for the cards we can control */
  73 static const struct pci_device_id cciss_pci_device_id[] = {
  74         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISS,  0x0E11, 0x4070},
  75         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSB, 0x0E11, 0x4080},
  76         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSB, 0x0E11, 0x4082},
  77         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSB, 0x0E11, 0x4083},
  78         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x4091},
  79         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x409A},
  80         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x409B},
  81         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x409C},
  82         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x409D},
  83         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSA,     0x103C, 0x3225},
  84         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3223},
  85         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3234},
  86         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3235},
  87         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3211},
  88         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3212},
  89         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3213},
  90         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3214},
  91         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3215},
  92         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3237},
  93         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x323D},
  94         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3241},
  95         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3243},
  96         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3245},
  97         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3247},
  98         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x3249},
  99         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x324A},
 100         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSE,     0x103C, 0x324B},
 101         {PCI_VENDOR_ID_HP,     PCI_ANY_ID,      PCI_ANY_ID, PCI_ANY_ID,
 102                 PCI_CLASS_STORAGE_RAID << 8, 0xffff << 8, 0},
 103         {0,}
 104 };
 105
 106 MODULE_DEVICE_TABLE(pci, cciss_pci_device_id);
 107
 108 /*  board_id = Subsystem Device ID & Vendor ID
 109  *  product = Marketing Name for the board
 110  *  access = Address of the struct of function pointers
 111  */
 112 static struct board_type products[] = {
 113         {0x40700E11, "Smart Array 5300", &SA5_access},
 114         {0x40800E11, "Smart Array 5i", &SA5B_access},
 115         {0x40820E11, "Smart Array 532", &SA5B_access},
 116         {0x40830E11, "Smart Array 5312", &SA5B_access},
 117         {0x409A0E11, "Smart Array 641", &SA5_access},
 118         {0x409B0E11, "Smart Array 642", &SA5_access},
 119         {0x409C0E11, "Smart Array 6400", &SA5_access},
 120         {0x409D0E11, "Smart Array 6400 EM", &SA5_access},
 121         {0x40910E11, "Smart Array 6i", &SA5_access},
 122         {0x3225103C, "Smart Array P600", &SA5_access},
 123         {0x3223103C, "Smart Array P800", &SA5_access},
 124         {0x3234103C, "Smart Array P400", &SA5_access},
 125         {0x3235103C, "Smart Array P400i", &SA5_access},
 126         {0x3211103C, "Smart Array E200i", &SA5_access},
 127         {0x3212103C, "Smart Array E200", &SA5_access},
 128         {0x3213103C, "Smart Array E200i", &SA5_access},
 129         {0x3214103C, "Smart Array E200i", &SA5_access},
 130         {0x3215103C, "Smart Array E200i", &SA5_access},
 131         {0x3237103C, "Smart Array E500", &SA5_access},
 132         {0x323D103C, "Smart Array P700m", &SA5_access},
 133         {0x3241103C, "Smart Array P212", &SA5_access},
 134         {0x3243103C, "Smart Array P410", &SA5_access},
 135         {0x3245103C, "Smart Array P410i", &SA5_access},
 136         {0x3247103C, "Smart Array P411", &SA5_access},
 137         {0x3249103C, "Smart Array P812", &SA5_access},
 138         {0x324A103C, "Smart Array P712m", &SA5_access},
 139         {0x324B103C, "Smart Array P711m", &SA5_access},
 140         {0xFFFF103C, "Unknown Smart Array", &SA5_access},
 141 };
 142
 143 /* How long to wait (in milliseconds) for board to go into simple mode */
 144 #define MAX_CONFIG_WAIT 30000
 145 #define MAX_IOCTL_CONFIG_WAIT 1000
 146
 147 /*define how many times we will try a command because of bus resets */
 148 #define MAX_CMD_RETRIES 3
 149
 150 #define MAX_CTLR        32
 151
 152 /* Originally cciss driver only supports 8 major numbers */
 153 #define MAX_CTLR_ORIG   8
 154
 155 static ctlr_info_t *hba[MAX_CTLR];
 156
 157 static void do_cciss_request(struct request_queue *q);
 158 static irqreturn_t do_cciss_intr(int irq, void *dev_id);
 159 static int cciss_open(struct block_device *bdev, fmode_t mode);
 160 static int cciss_release(struct gendisk *disk, fmode_t mode);
 161 static int cciss_ioctl(struct block_device *bdev, fmode_t mode,
 162                        unsigned int cmd, unsigned long arg);
 163 static int cciss_getgeo(struct block_device *bdev, struct hd_geometry *geo);
 164
 165 static int cciss_revalidate(struct gendisk *disk);
 166 static int rebuild_lun_table(ctlr_info_t *h, int first_time);
 167 static int deregister_disk(struct gendisk *disk, drive_info_struct *drv,
 168                            int clear_all);
 169
 170 static void cciss_read_capacity(int ctlr, int logvol, int withirq,
 171                         sector_t *total_size, unsigned int *block_size);
 172 static void cciss_read_capacity_16(int ctlr, int logvol, int withirq,
 173                         sector_t *total_size, unsigned int *block_size);
 174 static void cciss_geometry_inquiry(int ctlr, int logvol,
 175                         int withirq, sector_t total_size,
 176                         unsigned int block_size, InquiryData_struct *inq_buff,
 177                                    drive_info_struct *drv);
 178 static void __devinit cciss_interrupt_mode(ctlr_info_t *, struct pci_dev *,
 179                                            __u32);
 180 static void start_io(ctlr_info_t *h);
 181 static int sendcmd(__u8 cmd, int ctlr, void *buff, size_t size,
 182                    unsigned int use_unit_num, unsigned int log_unit,
 183                    __u8 page_code, unsigned char *scsi3addr, int cmd_type);
 184 static int sendcmd_withirq(__u8 cmd, int ctlr, void *buff, size_t size,
 185                            unsigned int use_unit_num, unsigned int log_unit,
 186                            __u8 page_code, int cmd_type);
 187
 188 static void fail_all_cmds(unsigned long ctlr);
 189
 190 #ifdef CONFIG_PROC_FS
 191 static void cciss_procinit(int i);
 192 #else
 193 static void cciss_procinit(int i)
 194 {
 195 }
 196 #endif                          /* CONFIG_PROC_FS */
 197
 198 #ifdef CONFIG_COMPAT
 199 static int cciss_compat_ioctl(struct block_device *, fmode_t,
 200                               unsigned, unsigned long);
 201 #endif
 202
 203 static struct block_device_operations cciss_fops = {
 204         .owner = THIS_MODULE,
 205         .open = cciss_open,
 206         .release = cciss_release,
 207         .locked_ioctl = cciss_ioctl,
 208         .getgeo = cciss_getgeo,
 209 #ifdef CONFIG_COMPAT
 210         .compat_ioctl = cciss_compat_ioctl,
 211 #endif
 212         .revalidate_disk = cciss_revalidate,
 213 };
 214
 215 /*
 216  * Enqueuing and dequeuing functions for cmdlists.
 217  */
 218 static inline void addQ(struct hlist_head *list, CommandList_struct *c)
 219 {
 220         hlist_add_head(&c->list, list);
 221 }
 222
 223 static inline void removeQ(CommandList_struct *c)
 224 {
 225         if (WARN_ON(hlist_unhashed(&c->list)))
 226                 return;
 227
 228         hlist_del_init(&c->list);
 229 }
 230
 231 #include "cciss_scsi.c"         /* For SCSI tape support */
 232
 233 #define RAID_UNKNOWN 6
 234
 235 #ifdef CONFIG_PROC_FS
 236
 237 /*
 238  * Report information about this controller.
 239  */
 240 #define ENG_GIG 1000000000
 241 #define ENG_GIG_FACTOR (ENG_GIG/512)
 242 #define ENGAGE_SCSI     "engage scsi"
 243 static const char *raid_label[] = { "0", "4", "1(1+0)", "5", "5+1", "ADG",
 244         "UNKNOWN"
 245 };
 246
 247 static struct proc_dir_entry *proc_cciss;
 248
 249 static void cciss_seq_show_header(struct seq_file *seq)
 250 {
 251         ctlr_info_t *h = seq->private;
 252
 253         seq_printf(seq, "%s: HP %s Controller\n"
 254                 "Board ID: 0x%08lx\n"
 255                 "Firmware Version: %c%c%c%c\n"
 256                 "IRQ: %d\n"
 257                 "Logical drives: %d\n"
 258                 "Current Q depth: %d\n"
 259                 "Current # commands on controller: %d\n"
 260                 "Max Q depth since init: %d\n"
 261                 "Max # commands on controller since init: %d\n"
 262                 "Max SG entries since init: %d\n",
 263                 h->devname,
 264                 h->product_name,
 265                 (unsigned long)h->board_id,
 266                 h->firm_ver[0], h->firm_ver[1], h->firm_ver[2],
 267                 h->firm_ver[3], (unsigned int)h->intr[SIMPLE_MODE_INT],
 268                 h->num_luns,
 269                 h->Qdepth, h->commands_outstanding,
 270                 h->maxQsinceinit, h->max_outstanding, h->maxSG);
 271
 272 #ifdef CONFIG_CISS_SCSI_TAPE
 273         cciss_seq_tape_report(seq, h->ctlr);
 274 #endif /* CONFIG_CISS_SCSI_TAPE */
 275 }
 276
 277 static void *cciss_seq_start(struct seq_file *seq, loff_t *pos)
 278 {
 279         ctlr_info_t *h = seq->private;
 280         unsigned ctlr = h->ctlr;
 281         unsigned long flags;
 282
 283         /* prevent displaying bogus info during configuration
 284          * or deconfiguration of a logical volume
 285          */
 286         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
 287         if (h->busy_configuring) {
 288                 spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
 289                 return ERR_PTR(-EBUSY);
 290         }
 291         h->busy_configuring = 1;
 292         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
 293
 294         if (*pos == 0)
 295                 cciss_seq_show_header(seq);
 296
 297         return pos;
 298 }
 299
 300 static int cciss_seq_show(struct seq_file *seq, void *v)
 301 {
 302         sector_t vol_sz, vol_sz_frac;
 303         ctlr_info_t *h = seq->private;
 304         unsigned ctlr = h->ctlr;
 305         loff_t *pos = v;
 306         drive_info_struct *drv = &h->drv[*pos];
 307
 308         if (*pos > h->highest_lun)
 309                 return 0;
 310
 311         if (drv->heads == 0)
 312                 return 0;
 313
 314         vol_sz = drv->nr_blocks;
 315         vol_sz_frac = sector_div(vol_sz, ENG_GIG_FACTOR);
 316         vol_sz_frac *= 100;
 317         sector_div(vol_sz_frac, ENG_GIG_FACTOR);
 318
 319         if (drv->raid_level > 5)
 320                 drv->raid_level = RAID_UNKNOWN;
 321         seq_printf(seq, "cciss/c%dd%d:"
 322                         "\t%4u.%02uGB\tRAID %s\n",
 323                         ctlr, (int) *pos, (int)vol_sz, (int)vol_sz_frac,
 324                         raid_label[drv->raid_level]);
 325         return 0;
 326 }
 327
 328 static void *cciss_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 329 {
 330         ctlr_info_t *h = seq->private;
 331
 332         if (*pos > h->highest_lun)
 333                 return NULL;
 334         *pos += 1;
 335
 336         return pos;
 337 }
 338
 339 static void cciss_seq_stop(struct seq_file *seq, void *v)
 340 {
 341         ctlr_info_t *h = seq->private;
 342
 343         /* Only reset h->busy_configuring if we succeeded in setting
 344          * it during cciss_seq_start. */
 345         if (v == ERR_PTR(-EBUSY))
 346                 return;
 347
 348         h->busy_configuring = 0;
 349 }
 350
 351 static struct seq_operations cciss_seq_ops = {
 352         .start = cciss_seq_start,
 353         .show  = cciss_seq_show,
 354         .next  = cciss_seq_next,
 355         .stop  = cciss_seq_stop,
 356 };
 357
 358 static int cciss_seq_open(struct inode *inode, struct file *file)
 359 {
 360         int ret = seq_open(file, &cciss_seq_ops);
 361         struct seq_file *seq = file->private_data;
 362
 363         if (!ret)
 364                 seq->private = PDE(inode)->data;
 365
 366         return ret;
 367 }
 368
 369 static ssize_t
 370 cciss_proc_write(struct file *file, const char __user *buf,
 371                  size_t length, loff_t *ppos)
 372 {
 373         int err;
 374         char *buffer;
 375
 376 #ifndef CONFIG_CISS_SCSI_TAPE
 377         return -EINVAL;
 378 #endif
 379
 380         if (!buf || length > PAGE_SIZE - 1)
 381                 return -EINVAL;
 382
 383         buffer = (char *)__get_free_page(GFP_KERNEL);
 384         if (!buffer)
 385                 return -ENOMEM;
 386
 387         err = -EFAULT;
 388         if (copy_from_user(buffer, buf, length))
 389                 goto out;
 390         buffer[length] = '\0';
 391
 392 #ifdef CONFIG_CISS_SCSI_TAPE
 393         if (strncmp(ENGAGE_SCSI, buffer, sizeof ENGAGE_SCSI - 1) == 0) {
 394                 struct seq_file *seq = file->private_data;
 395                 ctlr_info_t *h = seq->private;
 396                 int rc;
 397
 398                 rc = cciss_engage_scsi(h->ctlr);
 399                 if (rc != 0)
 400                         err = -rc;
 401                 else
 402                         err = length;
 403         } else
 404 #endif /* CONFIG_CISS_SCSI_TAPE */
 405                 err = -EINVAL;
 406         /* might be nice to have "disengage" too, but it's not
 407            safely possible. (only 1 module use count, lock issues.) */
 408
 409 out:
 410         free_page((unsigned long)buffer);
 411         return err;
 412 }
 413
 414 static struct file_operations cciss_proc_fops = {
 415         .owner   = THIS_MODULE,
 416         .open    = cciss_seq_open,
 417         .read    = seq_read,
 418         .llseek  = seq_lseek,
 419         .release = seq_release,
 420         .write   = cciss_proc_write,
 421 };
 422
 423 static void __devinit cciss_procinit(int i)
 424 {
 425         struct proc_dir_entry *pde;
 426
 427         if (proc_cciss == NULL)
 428                 proc_cciss = proc_mkdir("driver/cciss", NULL);
 429         if (!proc_cciss)
 430                 return;
 431         pde = proc_create_data(hba[i]->devname, S_IWUSR | S_IRUSR | S_IRGRP |
 432                                         S_IROTH, proc_cciss,
 433                                         &cciss_proc_fops, hba[i]);
 434 }
 435 #endif                          /* CONFIG_PROC_FS */
 436
 437 /*
 438  * For operations that cannot sleep, a command block is allocated at init,
 439  * and managed by cmd_alloc() and cmd_free() using a simple bitmap to track
 440  * which ones are free or in use.  For operations that can wait for kmalloc
 441  * to possible sleep, this routine can be called with get_from_pool set to 0.
 442  * cmd_free() MUST be called with a got_from_pool set to 0 if cmd_alloc was.
 443  */
 444 static CommandList_struct *cmd_alloc(ctlr_info_t *h, int get_from_pool)
 445 {
 446         CommandList_struct *c;
 447         int i;
 448         u64bit temp64;
 449         dma_addr_t cmd_dma_handle, err_dma_handle;
 450
 451         if (!get_from_pool) {
 452                 c = (CommandList_struct *) pci_alloc_consistent(h->pdev,
 453                         sizeof(CommandList_struct), &cmd_dma_handle);
 454                 if (c == NULL)
 455                         return NULL;
 456                 memset(c, 0, sizeof(CommandList_struct));
 457
 458                 c->cmdindex = -1;
 459
 460                 c->err_info = (ErrorInfo_struct *)
 461                     pci_alloc_consistent(h->pdev, sizeof(ErrorInfo_struct),
 462                             &err_dma_handle);
 463
 464                 if (c->err_info == NULL) {
 465                         pci_free_consistent(h->pdev,
 466                                 sizeof(CommandList_struct), c, cmd_dma_handle);
 467                         return NULL;
 468                 }
 469                 memset(c->err_info, 0, sizeof(ErrorInfo_struct));
 470         } else {                /* get it out of the controllers pool */
 471
 472                 do {
 473                         i = find_first_zero_bit(h->cmd_pool_bits, h->nr_cmds);
 474                         if (i == h->nr_cmds)
 475                                 return NULL;
 476                 } while (test_and_set_bit
 477                          (i & (BITS_PER_LONG - 1),
 478                           h->cmd_pool_bits + (i / BITS_PER_LONG)) != 0);
 479 #ifdef CCISS_DEBUG
 480                 printk(KERN_DEBUG "cciss: using command buffer %d\n", i);
 481 #endif
 482                 c = h->cmd_pool + i;
 483                 memset(c, 0, sizeof(CommandList_struct));
 484                 cmd_dma_handle = h->cmd_pool_dhandle
 485                     + i * sizeof(CommandList_struct);
 486                 c->err_info = h->errinfo_pool + i;
 487                 memset(c->err_info, 0, sizeof(ErrorInfo_struct));
 488                 err_dma_handle = h->errinfo_pool_dhandle
 489                     + i * sizeof(ErrorInfo_struct);
 490                 h->nr_allocs++;
 491
 492                 c->cmdindex = i;
 493         }
 494
 495         INIT_HLIST_NODE(&c->list);
 496         c->busaddr = (__u32) cmd_dma_handle;
 497         temp64.val = (__u64) err_dma_handle;
 498         c->ErrDesc.Addr.lower = temp64.val32.lower;
 499         c->ErrDesc.Addr.upper = temp64.val32.upper;
 500         c->ErrDesc.Len = sizeof(ErrorInfo_struct);
 501
 502         c->ctlr = h->ctlr;
 503         return c;
 504 }
 505
 506 /*
 507  * Frees a command block that was previously allocated with cmd_alloc().
 508  */
 509 static void cmd_free(ctlr_info_t *h, CommandList_struct *c, int got_from_pool)
 510 {
 511         int i;
 512         u64bit temp64;
 513
 514         if (!got_from_pool) {
 515                 temp64.val32.lower = c->ErrDesc.Addr.lower;
 516                 temp64.val32.upper = c->ErrDesc.Addr.upper;
 517                 pci_free_consistent(h->pdev, sizeof(ErrorInfo_struct),
 518                                     c->err_info, (dma_addr_t) temp64.val);
 519                 pci_free_consistent(h->pdev, sizeof(CommandList_struct),
 520                                     c, (dma_addr_t) c->busaddr);
 521         } else {
 522                 i = c - h->cmd_pool;
 523                 clear_bit(i & (BITS_PER_LONG - 1),
 524                           h->cmd_pool_bits + (i / BITS_PER_LONG));
 525                 h->nr_frees++;
 526         }
 527 }
 528
 529 static inline ctlr_info_t *get_host(struct gendisk *disk)
 530 {
 531         return disk->queue->queuedata;
 532 }
 533
 534 static inline drive_info_struct *get_drv(struct gendisk *disk)
 535 {
 536         return disk->private_data;
 537 }
 538
 539 /*
 540  * Open.  Make sure the device is really there.
 541  */
 542 static int cciss_open(struct block_device *bdev, fmode_t mode)
 543 {
 544         ctlr_info_t *host = get_host(bdev->bd_disk);
 545         drive_info_struct *drv = get_drv(bdev->bd_disk);
 546
 547 #ifdef CCISS_DEBUG
 548         printk(KERN_DEBUG "cciss_open %s\n", bdev->bd_disk->disk_name);
 549 #endif                          /* CCISS_DEBUG */
 550
 551         if (host->busy_initializing || drv->busy_configuring)
 552                 return -EBUSY;
 553         /*
 554          * Root is allowed to open raw volume zero even if it's not configured
 555          * so array config can still work. Root is also allowed to open any
 556          * volume that has a LUN ID, so it can issue IOCTL to reread the
 557          * disk information.  I don't think I really like this
 558          * but I'm already using way to many device nodes to claim another one
 559          * for "raw controller".
 560          */
 561         if (drv->heads == 0) {
 562                 if (MINOR(bdev->bd_dev) != 0) { /* not node 0? */
 563                         /* if not node 0 make sure it is a partition = 0 */
 564                         if (MINOR(bdev->bd_dev) & 0x0f) {
 565                                 return -ENXIO;
 566                                 /* if it is, make sure we have a LUN ID */
 567                         } else if (drv->LunID == 0) {
 568                                 return -ENXIO;
 569                         }
 570                 }
 571                 if (!capable(CAP_SYS_ADMIN))
 572                         return -EPERM;
 573         }
 574         drv->usage_count++;
 575         host->usage_count++;
 576         return 0;
 577 }
 578
 579 /*
 580  * Close.  Sync first.
 581  */
 582 static int cciss_release(struct gendisk *disk, fmode_t mode)
 583 {
 584         ctlr_info_t *host = get_host(disk);
 585         drive_info_struct *drv = get_drv(disk);
 586
 587 #ifdef CCISS_DEBUG
 588         printk(KERN_DEBUG "cciss_release %s\n", disk->disk_name);
 589 #endif                          /* CCISS_DEBUG */
 590
 591         drv->usage_count--;
 592         host->usage_count--;
 593         return 0;
 594 }
 595
 596 #ifdef CONFIG_COMPAT
 597
 598 static int do_ioctl(struct block_device *bdev, fmode_t mode,
 599                     unsigned cmd, unsigned long arg)
 600 {
 601         int ret;
 602         lock_kernel();
 603         ret = cciss_ioctl(bdev, mode, cmd, arg);
 604         unlock_kernel();
 605         return ret;
 606 }
 607
 608 static int cciss_ioctl32_passthru(struct block_device *bdev, fmode_t mode,
 609                                   unsigned cmd, unsigned long arg);
 610 static int cciss_ioctl32_big_passthru(struct block_device *bdev, fmode_t mode,
 611                                       unsigned cmd, unsigned long arg);
 612
 613 static int cciss_compat_ioctl(struct block_device *bdev, fmode_t mode,
 614                               unsigned cmd, unsigned long arg)
 615 {
 616         switch (cmd) {
 617         case CCISS_GETPCIINFO:
 618         case CCISS_GETINTINFO:
 619         case CCISS_SETINTINFO:
 620         case CCISS_GETNODENAME:
 621         case CCISS_SETNODENAME:
 622         case CCISS_GETHEARTBEAT:
 623         case CCISS_GETBUSTYPES:
 624         case CCISS_GETFIRMVER:
 625         case CCISS_GETDRIVVER:
 626         case CCISS_REVALIDVOLS:
 627         case CCISS_DEREGDISK:
 628         case CCISS_REGNEWDISK:
 629         case CCISS_REGNEWD:
 630         case CCISS_RESCANDISK:
 631         case CCISS_GETLUNINFO:
 632                 return do_ioctl(bdev, mode, cmd, arg);
 633
 634         case CCISS_PASSTHRU32:
 635                 return cciss_ioctl32_passthru(bdev, mode, cmd, arg);
 636         case CCISS_BIG_PASSTHRU32:
 637                 return cciss_ioctl32_big_passthru(bdev, mode, cmd, arg);
 638
 639         default:
 640                 return -ENOIOCTLCMD;
 641         }
 642 }
 643
 644 static int cciss_ioctl32_passthru(struct block_device *bdev, fmode_t mode,
 645                                   unsigned cmd, unsigned long arg)
 646 {
 647         IOCTL32_Command_struct __user *arg32 =
 648             (IOCTL32_Command_struct __user *) arg;
 649         IOCTL_Command_struct arg64;
 650         IOCTL_Command_struct __user *p = compat_alloc_user_space(sizeof(arg64));
 651         int err;
 652         u32 cp;
 653
 654         err = 0;
 655         err |=
 656             copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
 657                            sizeof(arg64.LUN_info));
 658         err |=
 659             copy_from_user(&arg64.Request, &arg32->Request,
 660                            sizeof(arg64.Request));
 661         err |=
 662             copy_from_user(&arg64.error_info, &arg32->error_info,
 663                            sizeof(arg64.error_info));
 664         err |= get_user(arg64.buf_size, &arg32->buf_size);
 665         err |= get_user(cp, &arg32->buf);
 666         arg64.buf = compat_ptr(cp);
 667         err |= copy_to_user(p, &arg64, sizeof(arg64));
 668
 669         if (err)
 670                 return -EFAULT;
 671
 672         err = do_ioctl(bdev, mode, CCISS_PASSTHRU, (unsigned long)p);
 673         if (err)
 674                 return err;
 675         err |=
 676             copy_in_user(&arg32->error_info, &p->error_info,
 677                          sizeof(arg32->error_info));
 678         if (err)
 679                 return -EFAULT;
 680         return err;
 681 }
 682
 683 static int cciss_ioctl32_big_passthru(struct block_device *bdev, fmode_t mode,
 684                                       unsigned cmd, unsigned long arg)
 685 {
 686         BIG_IOCTL32_Command_struct __user *arg32 =
 687             (BIG_IOCTL32_Command_struct __user *) arg;
 688         BIG_IOCTL_Command_struct arg64;
 689         BIG_IOCTL_Command_struct __user *p =
 690             compat_alloc_user_space(sizeof(arg64));
 691         int err;
 692         u32 cp;
 693
 694         err = 0;
 695         err |=
 696             copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
 697                            sizeof(arg64.LUN_info));
 698         err |=
 699             copy_from_user(&arg64.Request, &arg32->Request,
 700                            sizeof(arg64.Request));
 701         err |=
 702             copy_from_user(&arg64.error_info, &arg32->error_info,
 703                            sizeof(arg64.error_info));
 704         err |= get_user(arg64.buf_size, &arg32->buf_size);
 705         err |= get_user(arg64.malloc_size, &arg32->malloc_size);
 706         err |= get_user(cp, &arg32->buf);
 707         arg64.buf = compat_ptr(cp);
 708         err |= copy_to_user(p, &arg64, sizeof(arg64));
 709
 710         if (err)
 711                 return -EFAULT;
 712
 713         err = do_ioctl(bdev, mode, CCISS_BIG_PASSTHRU, (unsigned long)p);
 714         if (err)
 715                 return err;
 716         err |=
 717             copy_in_user(&arg32->error_info, &p->error_info,
 718                          sizeof(arg32->error_info));
 719         if (err)
 720                 return -EFAULT;
 721         return err;
 722 }
 723 #endif
 724
 725 static int cciss_getgeo(struct block_device *bdev, struct hd_geometry *geo)
 726 {
 727         drive_info_struct *drv = get_drv(bdev->bd_disk);
 728
 729         if (!drv->cylinders)
 730                 return -ENXIO;
 731
 732         geo->heads = drv->heads;
 733         geo->sectors = drv->sectors;
 734         geo->cylinders = drv->cylinders;
 735         return 0;
 736 }
 737
 738 /*
 739  * ioctl
 740  */
 741 static int cciss_ioctl(struct block_device *bdev, fmode_t mode,
 742                        unsigned int cmd, unsigned long arg)
 743 {
 744         struct gendisk *disk = bdev->bd_disk;
 745         ctlr_info_t *host = get_host(disk);
 746         drive_info_struct *drv = get_drv(disk);
 747         int ctlr = host->ctlr;
 748         void __user *argp = (void __user *)arg;
 749
 750 #ifdef CCISS_DEBUG
 751         printk(KERN_DEBUG "cciss_ioctl: Called with cmd=%x %lx\n", cmd, arg);
 752 #endif                          /* CCISS_DEBUG */
 753
 754         switch (cmd) {
 755         case CCISS_GETPCIINFO:
 756                 {
 757                         cciss_pci_info_struct pciinfo;
 758
 759                         if (!arg)
 760                                 return -EINVAL;
 761                         pciinfo.domain = pci_domain_nr(host->pdev->bus);
 762                         pciinfo.bus = host->pdev->bus->number;
 763                         pciinfo.dev_fn = host->pdev->devfn;
 764                         pciinfo.board_id = host->board_id;
 765                         if (copy_to_user
 766                             (argp, &pciinfo, sizeof(cciss_pci_info_struct)))
 767                                 return -EFAULT;
 768                         return 0;
 769                 }
 770         case CCISS_GETINTINFO:
 771                 {
 772                         cciss_coalint_struct intinfo;
 773                         if (!arg)
 774                                 return -EINVAL;
 775                         intinfo.delay =
 776                             readl(&host->cfgtable->HostWrite.CoalIntDelay);
 777                         intinfo.count =
 778                             readl(&host->cfgtable->HostWrite.CoalIntCount);
 779                         if (copy_to_user
 780                             (argp, &intinfo, sizeof(cciss_coalint_struct)))
 781                                 return -EFAULT;
 782                         return 0;
 783                 }
 784         case CCISS_SETINTINFO:
 785                 {
 786                         cciss_coalint_struct intinfo;
 787                         unsigned long flags;
 788                         int i;
 789
 790                         if (!arg)
 791                                 return -EINVAL;
 792                         if (!capable(CAP_SYS_ADMIN))
 793                                 return -EPERM;
 794                         if (copy_from_user
 795                             (&intinfo, argp, sizeof(cciss_coalint_struct)))
 796                                 return -EFAULT;
 797                         if ((intinfo.delay == 0) && (intinfo.count == 0))
 798                         {
 799 //                      printk("cciss_ioctl: delay and count cannot be 0\n");
 800                                 return -EINVAL;
 801                         }
 802                         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
 803                         /* Update the field, and then ring the doorbell */
 804                         writel(intinfo.delay,
 805                                &(host->cfgtable->HostWrite.CoalIntDelay));
 806                         writel(intinfo.count,
 807                                &(host->cfgtable->HostWrite.CoalIntCount));
 808                         writel(CFGTBL_ChangeReq, host->vaddr + SA5_DOORBELL);
 809
 810                         for (i = 0; i < MAX_IOCTL_CONFIG_WAIT; i++) {
 811                                 if (!(readl(host->vaddr + SA5_DOORBELL)
 812                                       & CFGTBL_ChangeReq))
 813                                         break;
 814                                 /* delay and try again */
 815                                 udelay(1000);
 816                         }
 817                         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
 818                         if (i >= MAX_IOCTL_CONFIG_WAIT)
 819                                 return -EAGAIN;
 820                         return 0;
 821                 }
 822         case CCISS_GETNODENAME:
 823                 {
 824                         NodeName_type NodeName;
 825                         int i;
 826
 827                         if (!arg)
 828                                 return -EINVAL;
 829                         for (i = 0; i < 16; i++)
 830                                 NodeName[i] =
 831                                     readb(&host->cfgtable->ServerName[i]);
 832                         if (copy_to_user(argp, NodeName, sizeof(NodeName_type)))
 833                                 return -EFAULT;
 834                         return 0;
 835                 }
 836         case CCISS_SETNODENAME:
 837                 {
 838                         NodeName_type NodeName;
 839                         unsigned long flags;
 840                         int i;
 841
 842                         if (!arg)
 843                                 return -EINVAL;
 844                         if (!capable(CAP_SYS_ADMIN))
 845                                 return -EPERM;
 846
 847                         if (copy_from_user
 848                             (NodeName, argp, sizeof(NodeName_type)))
 849                                 return -EFAULT;
 850
 851                         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
 852
 853                         /* Update the field, and then ring the doorbell */
 854                         for (i = 0; i < 16; i++)
 855                                 writeb(NodeName[i],
 856                                        &host->cfgtable->ServerName[i]);
 857
 858                         writel(CFGTBL_ChangeReq, host->vaddr + SA5_DOORBELL);
 859
 860                         for (i = 0; i < MAX_IOCTL_CONFIG_WAIT; i++) {
 861                                 if (!(readl(host->vaddr + SA5_DOORBELL)
 862                                       & CFGTBL_ChangeReq))
 863                                         break;
 864                                 /* delay and try again */
 865                                 udelay(1000);
 866                         }
 867                         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
 868                         if (i >= MAX_IOCTL_CONFIG_WAIT)
 869                                 return -EAGAIN;
 870                         return 0;
 871                 }
 872
 873         case CCISS_GETHEARTBEAT:
 874                 {
 875                         Heartbeat_type heartbeat;
 876
 877                         if (!arg)
 878                                 return -EINVAL;
 879                         heartbeat = readl(&host->cfgtable->HeartBeat);
 880                         if (copy_to_user
 881                             (argp, &heartbeat, sizeof(Heartbeat_type)))
 882                                 return -EFAULT;
 883                         return 0;
 884                 }
 885         case CCISS_GETBUSTYPES:
 886                 {
 887                         BusTypes_type BusTypes;
 888
 889                         if (!arg)
 890                                 return -EINVAL;
 891                         BusTypes = readl(&host->cfgtable->BusTypes);
 892                         if (copy_to_user
 893                             (argp, &BusTypes, sizeof(BusTypes_type)))
 894                                 return -EFAULT;
 895                         return 0;
 896                 }
 897         case CCISS_GETFIRMVER:
 898                 {
 899                         FirmwareVer_type firmware;
 900
 901                         if (!arg)
 902                                 return -EINVAL;
 903                         memcpy(firmware, host->firm_ver, 4);
 904
 905                         if (copy_to_user
 906                             (argp, firmware, sizeof(FirmwareVer_type)))
 907                                 return -EFAULT;
 908                         return 0;
 909                 }
 910         case CCISS_GETDRIVVER:
 911                 {
 912                         DriverVer_type DriverVer = DRIVER_VERSION;
 913
 914                         if (!arg)
 915                                 return -EINVAL;
 916
 917                         if (copy_to_user
 918                             (argp, &DriverVer, sizeof(DriverVer_type)))
 919                                 return -EFAULT;
 920                         return 0;
 921                 }
 922
 923         case CCISS_DEREGDISK:
 924         case CCISS_REGNEWD:
 925         case CCISS_REVALIDVOLS:
 926                 return rebuild_lun_table(host, 0);
 927
 928         case CCISS_GETLUNINFO:{
 929                         LogvolInfo_struct luninfo;
 930
 931                         luninfo.LunID = drv->LunID;
 932                         luninfo.num_opens = drv->usage_count;
 933                         luninfo.num_parts = 0;
 934                         if (copy_to_user(argp, &luninfo,
 935                                          sizeof(LogvolInfo_struct)))
 936                                 return -EFAULT;
 937                         return 0;
 938                 }
 939         case CCISS_PASSTHRU:
 940                 {
 941                         IOCTL_Command_struct iocommand;
 942                         CommandList_struct *c;
 943                         char *buff = NULL;
 944                         u64bit temp64;
 945                         unsigned long flags;
 946                         DECLARE_COMPLETION_ONSTACK(wait);
 947
 948                         if (!arg)
 949                                 return -EINVAL;
 950
 951                         if (!capable(CAP_SYS_RAWIO))
 952                                 return -EPERM;
 953
 954                         if (copy_from_user
 955                             (&iocommand, argp, sizeof(IOCTL_Command_struct)))
 956                                 return -EFAULT;
 957                         if ((iocommand.buf_size < 1) &&
 958                             (iocommand.Request.Type.Direction != XFER_NONE)) {
 959                                 return -EINVAL;
 960                         }
 961 #if 0                           /* 'buf_size' member is 16-bits, and always smaller than kmalloc limit */
 962                         /* Check kmalloc limits */
 963                         if (iocommand.buf_size > 128000)
 964                                 return -EINVAL;
 965 #endif
 966                         if (iocommand.buf_size > 0) {
 967                                 buff = kmalloc(iocommand.buf_size, GFP_KERNEL);
 968                                 if (buff == NULL)
 969                                         return -EFAULT;
 970                         }
 971                         if (iocommand.Request.Type.Direction == XFER_WRITE) {
 972                                 /* Copy the data into the buffer we created */
 973                                 if (copy_from_user
 974                                     (buff, iocommand.buf, iocommand.buf_size)) {
 975                                         kfree(buff);
 976                                         return -EFAULT;
 977                                 }
 978                         } else {
 979                                 memset(buff, 0, iocommand.buf_size);
 980                         }
 981                         if ((c = cmd_alloc(host, 0)) == NULL) {
 982                                 kfree(buff);
 983                                 return -ENOMEM;
 984                         }
 985                         // Fill in the command type
 986                         c->cmd_type = CMD_IOCTL_PEND;
 987                         // Fill in Command Header
 988                         c->Header.ReplyQueue = 0;       // unused in simple mode
 989                         if (iocommand.buf_size > 0)     // buffer to fill
 990                         {
 991                                 c->Header.SGList = 1;
 992                                 c->Header.SGTotal = 1;
 993                         } else  // no buffers to fill
 994                         {
 995                                 c->Header.SGList = 0;
 996                                 c->Header.SGTotal = 0;
 997                         }
 998                         c->Header.LUN = iocommand.LUN_info;
 999                         c->Header.Tag.lower = c->busaddr;       // use the kernel address the cmd block for tag
1000
1001                         // Fill in Request block
1002                         c->Request = iocommand.Request;
1003
1004                         // Fill in the scatter gather information
1005                         if (iocommand.buf_size > 0) {
1006                                 temp64.val = pci_map_single(host->pdev, buff,
1007                                         iocommand.buf_size,
1008                                         PCI_DMA_BIDIRECTIONAL);
1009                                 c->SG[0].Addr.lower = temp64.val32.lower;
1010                                 c->SG[0].Addr.upper = temp64.val32.upper;
1011                                 c->SG[0].Len = iocommand.buf_size;
1012                                 c->SG[0].Ext = 0;       // we are not chaining
1013                         }
1014                         c->waiting = &wait;
1015
1016                         /* Put the request on the tail of the request queue */
1017                         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
1018                         addQ(&host->reqQ, c);
1019                         host->Qdepth++;
1020                         start_io(host);
1021                         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
1022
1023                         wait_for_completion(&wait);
1024
1025                         /* unlock the buffers from DMA */
1026                         temp64.val32.lower = c->SG[0].Addr.lower;
1027                         temp64.val32.upper = c->SG[0].Addr.upper;
1028                         pci_unmap_single(host->pdev, (dma_addr_t) temp64.val,
1029                                          iocommand.buf_size,
1030                                          PCI_DMA_BIDIRECTIONAL);
1031
1032                         /* Copy the error information out */
1033                         iocommand.error_info = *(c->err_info);
1034                         if (copy_to_user
1035                             (argp, &iocommand, sizeof(IOCTL_Command_struct))) {
1036                                 kfree(buff);
1037                                 cmd_free(host, c, 0);
1038                                 return -EFAULT;
1039                         }
1040
1041                         if (iocommand.Request.Type.Direction == XFER_READ) {
1042                                 /* Copy the data out of the buffer we created */
1043                                 if (copy_to_user
1044                                     (iocommand.buf, buff, iocommand.buf_size)) {
1045                                         kfree(buff);
1046                                         cmd_free(host, c, 0);
1047                                         return -EFAULT;
1048                                 }
1049                         }
1050                         kfree(buff);
1051                         cmd_free(host, c, 0);
1052                         return 0;
1053                 }
1054         case CCISS_BIG_PASSTHRU:{
1055                         BIG_IOCTL_Command_struct *ioc;
1056                         CommandList_struct *c;
1057                         unsigned char **buff = NULL;
1058                         int *buff_size = NULL;
1059                         u64bit temp64;
1060                         unsigned long flags;
1061                         BYTE sg_used = 0;
1062                         int status = 0;
1063                         int i;
1064                         DECLARE_COMPLETION_ONSTACK(wait);
1065                         __u32 left;
1066                         __u32 sz;
1067                         BYTE __user *data_ptr;
1068
1069                         if (!arg)
1070                                 return -EINVAL;
1071                         if (!capable(CAP_SYS_RAWIO))
1072                                 return -EPERM;
1073                         ioc = (BIG_IOCTL_Command_struct *)
1074                             kmalloc(sizeof(*ioc), GFP_KERNEL);
1075                         if (!ioc) {
1076                                 status = -ENOMEM;
1077                                 goto cleanup1;
1078                         }
1079                         if (copy_from_user(ioc, argp, sizeof(*ioc))) {
1080                                 status = -EFAULT;
1081                                 goto cleanup1;
1082                         }
1083                         if ((ioc->buf_size < 1) &&
1084                             (ioc->Request.Type.Direction != XFER_NONE)) {
1085                                 status = -EINVAL;
1086                                 goto cleanup1;
1087                         }
1088                         /* Check kmalloc limits  using all SGs */
1089                         if (ioc->malloc_size > MAX_KMALLOC_SIZE) {
1090                                 status = -EINVAL;
1091                                 goto cleanup1;
1092                         }
1093                         if (ioc->buf_size > ioc->malloc_size * MAXSGENTRIES) {
1094                                 status = -EINVAL;
1095                                 goto cleanup1;
1096                         }
1097                         buff =
1098                             kzalloc(MAXSGENTRIES * sizeof(char *), GFP_KERNEL);
1099                         if (!buff) {
1100                                 status = -ENOMEM;
1101                                 goto cleanup1;
1102                         }
1103                         buff_size = kmalloc(MAXSGENTRIES * sizeof(int),
1104                                                    GFP_KERNEL);
1105                         if (!buff_size) {
1106                                 status = -ENOMEM;
1107                                 goto cleanup1;
1108                         }
1109                         left = ioc->buf_size;
1110                         data_ptr = ioc->buf;
1111                         while (left) {
1112                                 sz = (left >
1113                                       ioc->malloc_size) ? ioc->
1114                                     malloc_size : left;
1115                                 buff_size[sg_used] = sz;
1116                                 buff[sg_used] = kmalloc(sz, GFP_KERNEL);
1117                                 if (buff[sg_used] == NULL) {
1118                                         status = -ENOMEM;
1119                                         goto cleanup1;
1120                                 }
1121                                 if (ioc->Request.Type.Direction == XFER_WRITE) {
1122                                         if (copy_from_user
1123                                             (buff[sg_used], data_ptr, sz)) {
1124                                                 status = -EFAULT;
1125                                                 goto cleanup1;
1126                                         }
1127                                 } else {
1128                                         memset(buff[sg_used], 0, sz);
1129                                 }
1130                                 left -= sz;
1131                                 data_ptr += sz;
1132                                 sg_used++;
1133                         }
1134                         if ((c = cmd_alloc(host, 0)) == NULL) {
1135                                 status = -ENOMEM;
1136                                 goto cleanup1;
1137                         }
1138                         c->cmd_type = CMD_IOCTL_PEND;
1139                         c->Header.ReplyQueue = 0;
1140
1141                         if (ioc->buf_size > 0) {
1142                                 c->Header.SGList = sg_used;
1143                                 c->Header.SGTotal = sg_used;
1144                         } else {
1145                                 c->Header.SGList = 0;
1146                                 c->Header.SGTotal = 0;
1147                         }
1148                         c->Header.LUN = ioc->LUN_info;
1149                         c->Header.Tag.lower = c->busaddr;
1150
1151                         c->Request = ioc->Request;
1152                         if (ioc->buf_size > 0) {
1153                                 int i;
1154                                 for (i = 0; i < sg_used; i++) {
1155                                         temp64.val =
1156                                             pci_map_single(host->pdev, buff[i],
1157                                                     buff_size[i],
1158                                                     PCI_DMA_BIDIRECTIONAL);
1159                                         c->SG[i].Addr.lower =
1160                                             temp64.val32.lower;
1161                                         c->SG[i].Addr.upper =
1162                                             temp64.val32.upper;
1163                                         c->SG[i].Len = buff_size[i];
1164                                         c->SG[i].Ext = 0;       /* we are not chaining */
1165                                 }
1166                         }
1167                         c->waiting = &wait;
1168                         /* Put the request on the tail of the request queue */
1169                         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
1170                         addQ(&host->reqQ, c);
1171                         host->Qdepth++;
1172                         start_io(host);
1173                         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
1174                         wait_for_completion(&wait);
1175                         /* unlock the buffers from DMA */
1176                         for (i = 0; i < sg_used; i++) {
1177                                 temp64.val32.lower = c->SG[i].Addr.lower;
1178                                 temp64.val32.upper = c->SG[i].Addr.upper;
1179                                 pci_unmap_single(host->pdev,
1180                                         (dma_addr_t) temp64.val, buff_size[i],
1181                                         PCI_DMA_BIDIRECTIONAL);
1182                         }
1183                         /* Copy the error information out */
1184                         ioc->error_info = *(c->err_info);
1185                         if (copy_to_user(argp, ioc, sizeof(*ioc))) {
1186                                 cmd_free(host, c, 0);
1187                                 status = -EFAULT;
1188                                 goto cleanup1;
1189                         }
1190                         if (ioc->Request.Type.Direction == XFER_READ) {
1191                                 /* Copy the data out of the buffer we created */
1192                                 BYTE __user *ptr = ioc->buf;
1193                                 for (i = 0; i < sg_used; i++) {
1194                                         if (copy_to_user
1195                                             (ptr, buff[i], buff_size[i])) {
1196                                                 cmd_free(host, c, 0);
1197                                                 status = -EFAULT;
1198                                                 goto cleanup1;
1199                                         }
1200                                         ptr += buff_size[i];
1201                                 }
1202                         }
1203                         cmd_free(host, c, 0);
1204                         status = 0;
1205                       cleanup1:
1206                         if (buff) {
1207                                 for (i = 0; i < sg_used; i++)
1208                                         kfree(buff[i]);
1209                                 kfree(buff);
1210                         }
1211                         kfree(buff_size);
1212                         kfree(ioc);
1213                         return status;
1214                 }
1215
1216         /* scsi_cmd_ioctl handles these, below, though some are not */
1217         /* very meaningful for cciss.  SG_IO is the main one people want. */
1218
1219         case SG_GET_VERSION_NUM:
1220         case SG_SET_TIMEOUT:
1221         case SG_GET_TIMEOUT:
1222         case SG_GET_RESERVED_SIZE:
1223         case SG_SET_RESERVED_SIZE:
1224         case SG_EMULATED_HOST:
1225         case SG_IO:
1226         case SCSI_IOCTL_SEND_COMMAND:
1227                 return scsi_cmd_ioctl(disk->queue, disk, mode, cmd, argp);
1228
1229         /* scsi_cmd_ioctl would normally handle these, below, but */
1230         /* they aren't a good fit for cciss, as CD-ROMs are */
1231         /* not supported, and we don't have any bus/target/lun */
1232         /* which we present to the kernel. */
1233
1234         case CDROM_SEND_PACKET:
1235         case CDROMCLOSETRAY:
1236         case CDROMEJECT:
1237         case SCSI_IOCTL_GET_IDLUN:
1238         case SCSI_IOCTL_GET_BUS_NUMBER:
1239         default:
1240                 return -ENOTTY;
1241         }
1242 }
1243
1244 static void cciss_check_queues(ctlr_info_t *h)
1245 {
1246         int start_queue = h->next_to_run;
1247         int i;
1248
1249         /* check to see if we have maxed out the number of commands that can
1250          * be placed on the queue.  If so then exit.  We do this check here
1251          * in case the interrupt we serviced was from an ioctl and did not
1252          * free any new commands.
1253          */
1254         if ((find_first_zero_bit(h->cmd_pool_bits, h->nr_cmds)) == h->nr_cmds)
1255                 return;
1256
1257         /* We have room on the queue for more commands.  Now we need to queue
1258          * them up.  We will also keep track of the next queue to run so
1259          * that every queue gets a chance to be started first.
1260          */
1261         for (i = 0; i < h->highest_lun + 1; i++) {
1262                 int curr_queue = (start_queue + i) % (h->highest_lun + 1);
1263                 /* make sure the disk has been added and the drive is real
1264                  * because this can be called from the middle of init_one.
1265                  */
1266                 if (!(h->drv[curr_queue].queue) || !(h->drv[curr_queue].heads))
1267                         continue;
1268                 blk_start_queue(h->gendisk[curr_queue]->queue);
1269
1270                 /* check to see if we have maxed out the number of commands
1271                  * that can be placed on the queue.
1272                  */
1273                 if ((find_first_zero_bit(h->cmd_pool_bits, h->nr_cmds)) == h->nr_cmds) {
1274                         if (curr_queue == start_queue) {
1275                                 h->next_to_run =
1276                                     (start_queue + 1) % (h->highest_lun + 1);
1277                                 break;
1278                         } else {
1279                                 h->next_to_run = curr_queue;
1280                                 break;
1281                         }
1282                 }
1283         }
1284 }
1285
1286 static void cciss_softirq_done(struct request *rq)
1287 {
1288         CommandList_struct *cmd = rq->completion_data;
1289         ctlr_info_t *h = hba[cmd->ctlr];
1290         unsigned long flags;
1291         u64bit temp64;
1292         int i, ddir;
1293
1294         if (cmd->Request.Type.Direction == XFER_READ)
1295                 ddir = PCI_DMA_FROMDEVICE;
1296         else
1297                 ddir = PCI_DMA_TODEVICE;
1298
1299         /* command did not need to be retried */
1300         /* unmap the DMA mapping for all the scatter gather elements */
1301         for (i = 0; i < cmd->Header.SGList; i++) {
1302                 temp64.val32.lower = cmd->SG[i].Addr.lower;
1303                 temp64.val32.upper = cmd->SG[i].Addr.upper;
1304                 pci_unmap_page(h->pdev, temp64.val, cmd->SG[i].Len, ddir);
1305         }
1306
1307 #ifdef CCISS_DEBUG
1308         printk("Done with %p\n", rq);
1309 #endif                          /* CCISS_DEBUG */
1310
1311         if (blk_end_request(rq, (rq->errors == 0) ? 0 : -EIO, blk_rq_bytes(rq)))
1312                 BUG();
1313
1314         spin_lock_irqsave(&h->lock, flags);
1315         cmd_free(h, cmd, 1);
1316         cciss_check_queues(h);
1317         spin_unlock_irqrestore(&h->lock, flags);
1318 }
1319
1320 /* This function gets the serial number of a logical drive via
1321  * inquiry page 0x83.  Serial no. is 16 bytes.  If the serial
1322  * number cannot be had, for whatever reason, 16 bytes of 0xff
1323  * are returned instead.
1324  */
1325 static void cciss_get_serial_no(int ctlr, int logvol, int withirq,
1326                                 unsigned char *serial_no, int buflen)
1327 {
1328 #define PAGE_83_INQ_BYTES 64
1329         int rc;
1330         unsigned char *buf;
1331
1332         if (buflen > 16)
1333                 buflen = 16;
1334         memset(serial_no, 0xff, buflen);
1335         buf = kzalloc(PAGE_83_INQ_BYTES, GFP_KERNEL);
1336         if (!buf)
1337                 return;
1338         memset(serial_no, 0, buflen);
1339         if (withirq)
1340                 rc = sendcmd_withirq(CISS_INQUIRY, ctlr, buf,
1341                         PAGE_83_INQ_BYTES, 1, logvol, 0x83, TYPE_CMD);
1342         else
1343                 rc = sendcmd(CISS_INQUIRY, ctlr, buf,
1344                         PAGE_83_INQ_BYTES, 1, logvol, 0x83, NULL, TYPE_CMD);
1345         if (rc == IO_OK)
1346                 memcpy(serial_no, &buf[8], buflen);
1347         kfree(buf);
1348         return;
1349 }
1350
1351 static void cciss_add_disk(ctlr_info_t *h, struct gendisk *disk,
1352                                 int drv_index)
1353 {
1354         disk->queue = blk_init_queue(do_cciss_request, &h->lock);
1355         sprintf(disk->disk_name, "cciss/c%dd%d", h->ctlr, drv_index);
1356         disk->major = h->major;
1357         disk->first_minor = drv_index << NWD_SHIFT;
1358         disk->fops = &cciss_fops;
1359         disk->private_data = &h->drv[drv_index];
1360         disk->driverfs_dev = &h->pdev->dev;
1361
1362         /* Set up queue information */
1363         blk_queue_bounce_limit(disk->queue, h->pdev->dma_mask);
1364
1365         /* This is a hardware imposed limit. */
1366         blk_queue_max_hw_segments(disk->queue, MAXSGENTRIES);
1367
1368         /* This is a limit in the driver and could be eliminated. */
1369         blk_queue_max_phys_segments(disk->queue, MAXSGENTRIES);
1370
1371         blk_queue_max_sectors(disk->queue, h->cciss_max_sectors);
1372
1373         blk_queue_softirq_done(disk->queue, cciss_softirq_done);
1374
1375         disk->queue->queuedata = h;
1376
1377         blk_queue_hardsect_size(disk->queue,
1378                                 h->drv[drv_index].block_size);
1379
1380         /* Make sure all queue data is written out before */
1381         /* setting h->drv[drv_index].queue, as setting this */
1382         /* allows the interrupt handler to start the queue */
1383         wmb();
1384         h->drv[drv_index].queue = disk->queue;
1385         add_disk(disk);
1386 }
1387
1388 /* This function will check the usage_count of the drive to be updated/added.
1389  * If the usage_count is zero and it is a heretofore unknown drive, or,
1390  * the drive's capacity, geometry, or serial number has changed,
1391  * then the drive information will be updated and the disk will be
1392  * re-registered with the kernel.  If these conditions don't hold,
1393  * then it will be left alone for the next reboot.  The exception to this
1394  * is disk 0 which will always be left registered with the kernel since it
1395  * is also the controller node.  Any changes to disk 0 will show up on
1396  * the next reboot.
1397  */
1398 static void cciss_update_drive_info(int ctlr, int drv_index, int first_time)
1399 {
1400         ctlr_info_t *h = hba[ctlr];
1401         struct gendisk *disk;
1402         InquiryData_struct *inq_buff = NULL;
1403         unsigned int block_size;
1404         sector_t total_size;
1405         unsigned long flags = 0;
1406         int ret = 0;
1407         drive_info_struct *drvinfo;
1408         int was_only_controller_node;
1409
1410         /* Get information about the disk and modify the driver structure */
1411         inq_buff = kmalloc(sizeof(InquiryData_struct), GFP_KERNEL);
1412         drvinfo = kmalloc(sizeof(*drvinfo), GFP_KERNEL);
1413         if (inq_buff == NULL || drvinfo == NULL)
1414                 goto mem_msg;
1415
1416         /* See if we're trying to update the "controller node"
1417          * this will happen the when the first logical drive gets
1418          * created by ACU.
1419          */
1420         was_only_controller_node = (drv_index == 0 &&
1421                                 h->drv[0].raid_level == -1);
1422
1423         /* testing to see if 16-byte CDBs are already being used */
1424         if (h->cciss_read == CCISS_READ_16) {
1425                 cciss_read_capacity_16(h->ctlr, drv_index, 1,
1426                         &total_size, &block_size);
1427
1428         } else {
1429                 cciss_read_capacity(ctlr, drv_index, 1,
1430                                     &total_size, &block_size);
1431
1432                 /* if read_capacity returns all F's this volume is >2TB */
1433                 /* in size so we switch to 16-byte CDB's for all */
1434                 /* read/write ops */
1435                 if (total_size == 0xFFFFFFFFULL) {
1436                         cciss_read_capacity_16(ctlr, drv_index, 1,
1437                         &total_size, &block_size);
1438                         h->cciss_read = CCISS_READ_16;
1439                         h->cciss_write = CCISS_WRITE_16;
1440                 } else {
1441                         h->cciss_read = CCISS_READ_10;
1442                         h->cciss_write = CCISS_WRITE_10;
1443                 }
1444         }
1445
1446         cciss_geometry_inquiry(ctlr, drv_index, 1, total_size, block_size,
1447                                inq_buff, drvinfo);
1448         drvinfo->block_size = block_size;
1449         drvinfo->nr_blocks = total_size + 1;
1450
1451         cciss_get_serial_no(ctlr, drv_index, 1, drvinfo->serial_no,
1452                         sizeof(drvinfo->serial_no));
1453
1454         /* Is it the same disk we already know, and nothing's changed? */
1455         if (h->drv[drv_index].raid_level != -1 &&
1456                 ((memcmp(drvinfo->serial_no,
1457                                 h->drv[drv_index].serial_no, 16) == 0) &&
1458                 drvinfo->block_size == h->drv[drv_index].block_size &&
1459                 drvinfo->nr_blocks == h->drv[drv_index].nr_blocks &&
1460                 drvinfo->heads == h->drv[drv_index].heads &&
1461                 drvinfo->sectors == h->drv[drv_index].sectors &&
1462                 drvinfo->cylinders == h->drv[drv_index].cylinders))
1463                         /* The disk is unchanged, nothing to update */
1464                         goto freeret;
1465
1466         /* If we get here it's not the same disk, or something's changed,
1467          * so we need to * deregister it, and re-register it, if it's not
1468          * in use.
1469          * If the disk already exists then deregister it before proceeding
1470          * (unless it's the first disk (for the controller node).
1471          */
1472         if (h->drv[drv_index].raid_level != -1 && drv_index != 0) {
1473                 printk(KERN_WARNING "disk %d has changed.\n", drv_index);
1474                 spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
1475                 h->drv[drv_index].busy_configuring = 1;
1476                 spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
1477
1478                 /* deregister_disk sets h->drv[drv_index].queue = NULL
1479                  * which keeps the interrupt handler from starting
1480                  * the queue.
1481                  */
1482                 ret = deregister_disk(h->gendisk[drv_index],
1483                                       &h->drv[drv_index], 0);
1484                 h->drv[drv_index].busy_configuring = 0;
1485         }
1486
1487         /* If the disk is in use return */
1488         if (ret)
1489                 goto freeret;
1490
1491         /* Save the new information from cciss_geometry_inquiry
1492          * and serial number inquiry.
1493          */
1494         h->drv[drv_index].block_size = drvinfo->block_size;
1495         h->drv[drv_index].nr_blocks = drvinfo->nr_blocks;
1496         h->drv[drv_index].heads = drvinfo->heads;
1497         h->drv[drv_index].sectors = drvinfo->sectors;
1498         h->drv[drv_index].cylinders = drvinfo->cylinders;
1499         h->drv[drv_index].raid_level = drvinfo->raid_level;
1500         memcpy(h->drv[drv_index].serial_no, drvinfo->serial_no, 16);
1501
1502         ++h->num_luns;
1503         disk = h->gendisk[drv_index];
1504         set_capacity(disk, h->drv[drv_index].nr_blocks);
1505
1506         /* If it's not disk 0 (drv_index != 0)
1507          * or if it was disk 0, but there was previously
1508          * no actual corresponding configured logical drive
1509          * (raid_leve == -1) then we want to update the
1510          * logical drive's information.
1511          */
1512         if (drv_index || first_time)
1513                 cciss_add_disk(h, disk, drv_index);
1514
1515 freeret:
1516         kfree(inq_buff);
1517         kfree(drvinfo);
1518         return;
1519 mem_msg:
1520         printk(KERN_ERR "cciss: out of memory\n");
1521         goto freeret;
1522 }
1523
1524 /* This function will find the first index of the controllers drive array
1525  * that has a -1 for the raid_level and will return that index.  This is
1526  * where new drives will be added.  If the index to be returned is greater
1527  * than the highest_lun index for the controller then highest_lun is set
1528  * to this new index.  If there are no available indexes then -1 is returned.
1529  * "controller_node" is used to know if this is a real logical drive, or just
1530  * the controller node, which determines if this counts towards highest_lun.
1531  */
1532 static int cciss_find_free_drive_index(int ctlr, int controller_node)
1533 {
1534         int i;
1535
1536         for (i = 0; i < CISS_MAX_LUN; i++) {
1537                 if (hba[ctlr]->drv[i].raid_level == -1) {
1538                         if (i > hba[ctlr]->highest_lun)
1539                                 if (!controller_node)
1540                                         hba[ctlr]->highest_lun = i;
1541                         return i;
1542                 }
1543         }
1544         return -1;
1545 }
1546
1547 /* cciss_add_gendisk finds a free hba[]->drv structure
1548  * and allocates a gendisk if needed, and sets the lunid
1549  * in the drvinfo structure.   It returns the index into
1550  * the ->drv[] array, or -1 if none are free.
1551  * is_controller_node indicates whether highest_lun should
1552  * count this disk, or if it's only being added to provide
1553  * a means to talk to the controller in case no logical
1554  * drives have yet been configured.
1555  */
1556 static int cciss_add_gendisk(ctlr_info_t *h, __u32 lunid, int controller_node)
1557 {
1558         int drv_index;
1559
1560         drv_index = cciss_find_free_drive_index(h->ctlr, controller_node);
1561         if (drv_index == -1)
1562                 return -1;
1563         /*Check if the gendisk needs to be allocated */
1564         if (!h->gendisk[drv_index]) {
1565                 h->gendisk[drv_index] =
1566                         alloc_disk(1 << NWD_SHIFT);
1567                 if (!h->gendisk[drv_index]) {
1568                         printk(KERN_ERR "cciss%d: could not "
1569                                 "allocate a new disk %d\n",
1570                                 h->ctlr, drv_index);
1571                         return -1;
1572                 }
1573         }
1574         h->drv[drv_index].LunID = lunid;
1575
1576         /* Don't need to mark this busy because nobody */
1577         /* else knows about this disk yet to contend */
1578         /* for access to it. */
1579         h->drv[drv_index].busy_configuring = 0;
1580         wmb();
1581         return drv_index;
1582 }
1583
1584 /* This is for the special case of a controller which
1585  * has no logical drives.  In this case, we still need
1586  * to register a disk so the controller can be accessed
1587  * by the Array Config Utility.
1588  */
1589 static void cciss_add_controller_node(ctlr_info_t *h)
1590 {
1591         struct gendisk *disk;
1592         int drv_index;
1593
1594         if (h->gendisk[0] != NULL) /* already did this? Then bail. */
1595                 return;
1596
1597         drv_index = cciss_add_gendisk(h, 0, 1);
1598         if (drv_index == -1) {
1599                 printk(KERN_WARNING "cciss%d: could not "
1600                         "add disk 0.\n", h->ctlr);
1601                 return;
1602         }
1603         h->drv[drv_index].block_size = 512;
1604         h->drv[drv_index].nr_blocks = 0;
1605         h->drv[drv_index].heads = 0;
1606         h->drv[drv_index].sectors = 0;
1607         h->drv[drv_index].cylinders = 0;
1608         h->drv[drv_index].raid_level = -1;
1609         memset(h->drv[drv_index].serial_no, 0, 16);
1610         disk = h->gendisk[drv_index];
1611         cciss_add_disk(h, disk, drv_index);
1612 }
1613
1614 /* This function will add and remove logical drives from the Logical
1615  * drive array of the controller and maintain persistency of ordering
1616  * so that mount points are preserved until the next reboot.  This allows
1617  * for the removal of logical drives in the middle of the drive array
1618  * without a re-ordering of those drives.
1619  * INPUT
1620  * h            = The controller to perform the operations on
1621  */
1622 static int rebuild_lun_table(ctlr_info_t *h, int first_time)
1623 {
1624         int ctlr = h->ctlr;
1625         int num_luns;
1626         ReportLunData_struct *ld_buff = NULL;
1627         int return_code;
1628         int listlength = 0;
1629         int i;
1630         int drv_found;
1631         int drv_index = 0;
1632         __u32 lunid = 0;
1633         unsigned long flags;
1634
1635         if (!capable(CAP_SYS_RAWIO))
1636                 return -EPERM;
1637
1638         /* Set busy_configuring flag for this operation */
1639         spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
1640         if (h->busy_configuring) {
1641                 spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
1642                 return -EBUSY;
1643         }
1644         h->busy_configuring = 1;
1645         spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
1646
1647         ld_buff = kzalloc(sizeof(ReportLunData_struct), GFP_KERNEL);
1648         if (ld_buff == NULL)
1649                 goto mem_msg;
1650
1651         return_code = sendcmd_withirq(CISS_REPORT_LOG, ctlr, ld_buff,
1652                                       sizeof(ReportLunData_struct), 0,
1653                                       0, 0, TYPE_CMD);
1654
1655         if (return_code == IO_OK)
1656                 listlength = be32_to_cpu(*(__be32 *) ld_buff->LUNListLength);
1657         else {  /* reading number of logical volumes failed */
1658                 printk(KERN_WARNING "cciss: report logical volume"
1659                        " command failed\n");
1660                 listlength = 0;
1661                 goto freeret;
1662         }
1663
1664         num_luns = listlength / 8;      /* 8 bytes per entry */
1665         if (num_luns > CISS_MAX_LUN) {
1666                 num_luns = CISS_MAX_LUN;
1667                 printk(KERN_WARNING "cciss: more luns configured"
1668                        " on controller than can be handled by"
1669                        " this driver.\n");
1670         }
1671
1672         if (num_luns == 0)
1673                 cciss_add_controller_node(h);
1674
1675         /* Compare controller drive array to driver's drive array
1676          * to see if any drives are missing on the controller due
1677          * to action of Array Config Utility (user deletes drive)
1678          * and deregister logical drives which have disappeared.
1679          */
1680         for (i = 0; i <= h->highest_lun; i++) {
1681                 int j;
1682                 drv_found = 0;
1683
1684                 /* skip holes in the array from already deleted drives */
1685                 if (h->drv[i].raid_level == -1)
1686                         continue;
1687
1688                 for (j = 0; j < num_luns; j++) {
1689                         memcpy(&lunid, &ld_buff->LUN[j][0], 4);
1690                         lunid = le32_to_cpu(lunid);
1691                         if (h->drv[i].LunID == lunid) {
1692                                 drv_found = 1;
1693                                 break;
1694                         }
1695                 }
1696                 if (!drv_found) {
1697                         /* Deregister it from the OS, it's gone. */
1698                         spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
1699                         h->drv[i].busy_configuring = 1;
1700                         spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
1701                         return_code = deregister_disk(h->gendisk[i],
1702                                 &h->drv[i], 1);
1703                         h->drv[i].busy_configuring = 0;
1704                 }
1705         }
1706
1707         /* Compare controller drive array to driver's drive array.
1708          * Check for updates in the drive information and any new drives
1709          * on the controller due to ACU adding logical drives, or changing
1710          * a logical drive's size, etc.  Reregister any new/changed drives
1711          */
1712         for (i = 0; i < num_luns; i++) {
1713                 int j;
1714
1715                 drv_found = 0;
1716
1717                 memcpy(&lunid, &ld_buff->LUN[i][0], 4);
1718                 lunid = le32_to_cpu(lunid);
1719
1720                 /* Find if the LUN is already in the drive array
1721                  * of the driver.  If so then update its info
1722                  * if not in use.  If it does not exist then find
1723                  * the first free index and add it.
1724                  */
1725                 for (j = 0; j <= h->highest_lun; j++) {
1726                         if (h->drv[j].raid_level != -1 &&
1727                                 h->drv[j].LunID == lunid) {
1728                                 drv_index = j;
1729                                 drv_found = 1;
1730                                 break;
1731                         }
1732                 }
1733
1734                 /* check if the drive was found already in the array */
1735                 if (!drv_found) {
1736                         drv_index = cciss_add_gendisk(h, lunid, 0);
1737                         if (drv_index == -1)
1738                                 goto freeret;
1739                 }
1740                 cciss_update_drive_info(ctlr, drv_index, first_time);
1741         }               /* end for */
1742
1743 freeret:
1744         kfree(ld_buff);
1745         h->busy_configuring = 0;
1746         /* We return -1 here to tell the ACU that we have registered/updated
1747          * all of the drives that we can and to keep it from calling us
1748          * additional times.
1749          */
1750         return -1;
1751 mem_msg:
1752         printk(KERN_ERR "cciss: out of memory\n");
1753         h->busy_configuring = 0;
1754         goto freeret;
1755 }
1756
1757 /* This function will deregister the disk and it's queue from the
1758  * kernel.  It must be called with the controller lock held and the
1759  * drv structures busy_configuring flag set.  It's parameters are:
1760  *
1761  * disk = This is the disk to be deregistered
1762  * drv  = This is the drive_info_struct associated with the disk to be
1763  *        deregistered.  It contains information about the disk used
1764  *        by the driver.
1765  * clear_all = This flag determines whether or not the disk information
1766  *             is going to be completely cleared out and the highest_lun
1767  *             reset.  Sometimes we want to clear out information about
1768  *             the disk in preparation for re-adding it.  In this case
1769  *             the highest_lun should be left unchanged and the LunID
1770  *             should not be cleared.
1771 */
1772 static int deregister_disk(struct gendisk *disk, drive_info_struct *drv,
1773                            int clear_all)
1774 {
1775         int i;
1776         ctlr_info_t *h = get_host(disk);
1777
1778         if (!capable(CAP_SYS_RAWIO))
1779                 return -EPERM;
1780
1781         /* make sure logical volume is NOT is use */
1782         if (clear_all || (h->gendisk[0] == disk)) {
1783                 if (drv->usage_count > 1)
1784                         return -EBUSY;
1785         } else if (drv->usage_count > 0)
1786                 return -EBUSY;
1787
1788         /* invalidate the devices and deregister the disk.  If it is disk
1789          * zero do not deregister it but just zero out it's values.  This
1790          * allows us to delete disk zero but keep the controller registered.
1791          */
1792         if (h->gendisk[0] != disk) {
1793                 struct request_queue *q = disk->queue;
1794                 if (disk->flags & GENHD_FL_UP)
1795                         del_gendisk(disk);
1796                 if (q) {
1797                         blk_cleanup_queue(q);
1798                         /* Set drv->queue to NULL so that we do not try
1799                          * to call blk_start_queue on this queue in the
1800                          * interrupt handler
1801                          */
1802                         drv->queue = NULL;
1803                 }
1804                 /* If clear_all is set then we are deleting the logical
1805                  * drive, not just refreshing its info.  For drives
1806                  * other than disk 0 we will call put_disk.  We do not
1807                  * do this for disk 0 as we need it to be able to
1808                  * configure the controller.
1809                  */
1810                 if (clear_all){
1811                         /* This isn't pretty, but we need to find the
1812                          * disk in our array and NULL our the pointer.
1813                          * This is so that we will call alloc_disk if
1814                          * this index is used again later.
1815                          */
1816                         for (i=0; i < CISS_MAX_LUN; i++){
1817                                 if (h->gendisk[i] == disk) {
1818                                         h->gendisk[i] = NULL;
1819                                         break;
1820                                 }
1821                         }
1822                         put_disk(disk);
1823                 }
1824         } else {
1825                 set_capacity(disk, 0);
1826         }
1827
1828         --h->num_luns;
1829         /* zero out the disk size info */
1830         drv->nr_blocks = 0;
1831         drv->block_size = 0;
1832         drv->heads = 0;
1833         drv->sectors = 0;
1834         drv->cylinders = 0;
1835         drv->raid_level = -1;   /* This can be used as a flag variable to
1836                                  * indicate that this element of the drive
1837                                  * array is free.
1838                                  */
1839
1840         if (clear_all) {
1841                 /* check to see if it was the last disk */
1842                 if (drv == h->drv + h->highest_lun) {
1843                         /* if so, find the new hightest lun */
1844                         int i, newhighest = -1;
1845                         for (i = 0; i <= h->highest_lun; i++) {
1846                                 /* if the disk has size > 0, it is available */
1847                                 if (h->drv[i].heads)
1848                                         newhighest = i;
1849                         }
1850                         h->highest_lun = newhighest;
1851                 }
1852
1853                 drv->LunID = 0;
1854         }
1855         return 0;
1856 }
1857
1858 static int fill_cmd(CommandList_struct *c, __u8 cmd, int ctlr, void *buff, size_t size, unsigned int use_unit_num,      /* 0: address the controller,
1859                                                                                                                            1: address logical volume log_unit,
1860                                                                                                                            2: periph device address is scsi3addr */
1861                     unsigned int log_unit, __u8 page_code,
1862                     unsigned char *scsi3addr, int cmd_type)
1863 {
1864         ctlr_info_t *h = hba[ctlr];
1865         u64bit buff_dma_handle;
1866         int status = IO_OK;
1867
1868         c->cmd_type = CMD_IOCTL_PEND;
1869         c->Header.ReplyQueue = 0;
1870         if (buff != NULL) {
1871                 c->Header.SGList = 1;
1872                 c->Header.SGTotal = 1;
1873         } else {
1874                 c->Header.SGList = 0;
1875                 c->Header.SGTotal = 0;
1876         }
1877         c->Header.Tag.lower = c->busaddr;
1878
1879         c->Request.Type.Type = cmd_type;
1880         if (cmd_type == TYPE_CMD) {
1881                 switch (cmd) {
1882                 case CISS_INQUIRY:
1883                         /* If the logical unit number is 0 then, this is going
1884                            to controller so It's a physical command
1885                            mode = 0 target = 0.  So we have nothing to write.
1886                            otherwise, if use_unit_num == 1,
1887                            mode = 1(volume set addressing) target = LUNID
1888                            otherwise, if use_unit_num == 2,
1889                            mode = 0(periph dev addr) target = scsi3addr */
1890                         if (use_unit_num == 1) {
1891                                 c->Header.LUN.LogDev.VolId =
1892                                     h->drv[log_unit].LunID;
1893                                 c->Header.LUN.LogDev.Mode = 1;
1894                         } else if (use_unit_num == 2) {
1895                                 memcpy(c->Header.LUN.LunAddrBytes, scsi3addr,
1896                                        8);
1897                                 c->Header.LUN.LogDev.Mode = 0;
1898                         }
1899                         /* are we trying to read a vital product page */
1900                         if (page_code != 0) {
1901                                 c->Request.CDB[1] = 0x01;
1902                                 c->Request.CDB[2] = page_code;
1903                         }
1904                         c->Request.CDBLen = 6;
1905                         c->Request.Type.Attribute = ATTR_SIMPLE;
1906                         c->Request.Type.Direction = XFER_READ;
1907                         c->Request.Timeout = 0;
1908                         c->Request.CDB[0] = CISS_INQUIRY;
1909                         c->Request.CDB[4] = size & 0xFF;
1910                         break;
1911                 case CISS_REPORT_LOG:
1912                 case CISS_REPORT_PHYS:
1913                         /* Talking to controller so It's a physical command
1914                            mode = 00 target = 0.  Nothing to write.
1915                          */
1916                         c->Request.CDBLen = 12;
1917                         c->Request.Type.Attribute = ATTR_SIMPLE;
1918                         c->Request.Type.Direction = XFER_READ;
1919                         c->Request.Timeout = 0;
1920                         c->Request.CDB[0] = cmd;
1921                         c->Request.CDB[6] = (size >> 24) & 0xFF;        //MSB
1922                         c->Request.CDB[7] = (size >> 16) & 0xFF;
1923                         c->Request.CDB[8] = (size >> 8) & 0xFF;
1924                         c->Request.CDB[9] = size & 0xFF;
1925                         break;
1926
1927                 case CCISS_READ_CAPACITY:
1928                         c->Header.LUN.LogDev.VolId = h->drv[log_unit].LunID;
1929                         c->Header.LUN.LogDev.Mode = 1;
1930                         c->Request.CDBLen = 10;
1931                         c->Request.Type.Attribute = ATTR_SIMPLE;
1932                         c->Request.Type.Direction = XFER_READ;
1933                         c->Request.Timeout = 0;
1934                         c->Request.CDB[0] = cmd;
1935                         break;
1936                 case CCISS_READ_CAPACITY_16:
1937                         c->Header.LUN.LogDev.VolId = h->drv[log_unit].LunID;
1938                         c->Header.LUN.LogDev.Mode = 1;
1939                         c->Request.CDBLen = 16;
1940                         c->Request.Type.Attribute = ATTR_SIMPLE;
1941                         c->Request.Type.Direction = XFER_READ;
1942                         c->Request.Timeout = 0;
1943                         c->Request.CDB[0] = cmd;
1944                         c->Request.CDB[1] = 0x10;
1945                         c->Request.CDB[10] = (size >> 24) & 0xFF;
1946                         c->Request.CDB[11] = (size >> 16) & 0xFF;
1947                         c->Request.CDB[12] = (size >> 8) & 0xFF;
1948                         c->Request.CDB[13] = size & 0xFF;
1949                         c->Request.Timeout = 0;
1950                         c->Request.CDB[0] = cmd;
1951                         break;
1952                 case CCISS_CACHE_FLUSH:
1953                         c->Request.CDBLen = 12;
1954                         c->Request.Type.Attribute = ATTR_SIMPLE;
1955                         c->Request.Type.Direction = XFER_WRITE;
1956                         c->Request.Timeout = 0;
1957                         c->Request.CDB[0] = BMIC_WRITE;
1958                         c->Request.CDB[6] = BMIC_CACHE_FLUSH;
1959                         break;
1960                 default:
1961                         printk(KERN_WARNING
1962                                "cciss%d:  Unknown Command 0x%c\n", ctlr, cmd);
1963                         return IO_ERROR;
1964                 }
1965         } else if (cmd_type == TYPE_MSG) {
1966                 switch (cmd) {
1967                 case 0: /* ABORT message */
1968                         c->Request.CDBLen = 12;
1969                         c->Request.Type.Attribute = ATTR_SIMPLE;
1970                         c->Request.Type.Direction = XFER_WRITE;
1971                         c->Request.Timeout = 0;
1972                         c->Request.CDB[0] = cmd;        /* abort */
1973                         c->Request.CDB[1] = 0;  /* abort a command */
1974                         /* buff contains the tag of the command to abort */
1975                         memcpy(&c->Request.CDB[4], buff, 8);
1976                         break;
1977                 case 1: /* RESET message */
1978                         c->Request.CDBLen = 12;
1979                         c->Request.Type.Attribute = ATTR_SIMPLE;
1980                         c->Request.Type.Direction = XFER_WRITE;
1981                         c->Request.Timeout = 0;
1982                         memset(&c->Request.CDB[0], 0, sizeof(c->Request.CDB));
1983                         c->Request.CDB[0] = cmd;        /* reset */
1984                         c->Request.CDB[1] = 0x04;       /* reset a LUN */
1985                         break;
1986                 case 3: /* No-Op message */
1987                         c->Request.CDBLen = 1;
1988                         c->Request.Type.Attribute = ATTR_SIMPLE;
1989                         c->Request.Type.Direction = XFER_WRITE;
1990                         c->Request.Timeout = 0;
1991                         c->Request.CDB[0] = cmd;
1992                         break;
1993                 default:
1994                         printk(KERN_WARNING
1995                                "cciss%d: unknown message type %d\n", ctlr, cmd);
1996                         return IO_ERROR;
1997                 }
1998         } else {
1999                 printk(KERN_WARNING
2000                        "cciss%d: unknown command type %d\n", ctlr, cmd_type);
2001                 return IO_ERROR;
2002         }
2003         /* Fill in the scatter gather information */
2004         if (size > 0) {
2005                 buff_dma_handle.val = (__u64) pci_map_single(h->pdev,
2006                                                              buff, size,
2007                                                              PCI_DMA_BIDIRECTIONAL);
2008                 c->SG[0].Addr.lower = buff_dma_handle.val32.lower;
2009                 c->SG[0].Addr.upper = buff_dma_handle.val32.upper;
2010                 c->SG[0].Len = size;
2011                 c->SG[0].Ext = 0;       /* we are not chaining */
2012         }
2013         return status;
2014 }
2015
2016 static int sendcmd_withirq(__u8 cmd,
2017                            int ctlr,
2018                            void *buff,
2019                            size_t size,
2020                            unsigned int use_unit_num,
2021                            unsigned int log_unit, __u8 page_code, int cmd_type)
2022 {
2023         ctlr_info_t *h = hba[ctlr];
2024         CommandList_struct *c;
2025         u64bit buff_dma_handle;
2026         unsigned long flags;
2027         int return_status;
2028         DECLARE_COMPLETION_ONSTACK(wait);
2029
2030         if ((c = cmd_alloc(h, 0)) == NULL)
2031                 return -ENOMEM;
2032         return_status = fill_cmd(c, cmd, ctlr, buff, size, use_unit_num,
2033                                  log_unit, page_code, NULL, cmd_type);
2034         if (return_status != IO_OK) {
2035                 cmd_free(h, c, 0);
2036                 return return_status;
2037         }
2038       resend_cmd2:
2039         c->waiting = &wait;
2040
2041         /* Put the request on the tail of the queue and send it */
2042         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
2043         addQ(&h->reqQ, c);
2044         h->Qdepth++;
2045         start_io(h);
2046         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
2047
2048         wait_for_completion(&wait);
2049
2050         if (c->err_info->CommandStatus != 0) {  /* an error has occurred */
2051                 switch (c->err_info->CommandStatus) {
2052                 case CMD_TARGET_STATUS:
2053                         printk(KERN_WARNING "cciss: cmd %p has "
2054                                " completed with errors\n", c);
2055                         if (c->err_info->ScsiStatus) {
2056                                 printk(KERN_WARNING "cciss: cmd %p "
2057                                        "has SCSI Status = %x\n",
2058                                        c, c->err_info->ScsiStatus);
2059                         }
2060
2061                         break;
2062                 case CMD_DATA_UNDERRUN:
2063                 case CMD_DATA_OVERRUN:
2064                         /* expected for inquire and report lun commands */
2065                         break;
2066                 case CMD_INVALID:
2067                         printk(KERN_WARNING "cciss: Cmd %p is "
2068                                "reported invalid\n", c);
2069                         return_status = IO_ERROR;
2070                         break;
2071                 case CMD_PROTOCOL_ERR:
2072                         printk(KERN_WARNING "cciss: cmd %p has "
2073                                "protocol error \n", c);
2074                         return_status = IO_ERROR;
2075                         break;
2076                 case CMD_HARDWARE_ERR:
2077                         printk(KERN_WARNING "cciss: cmd %p had "
2078                                " hardware error\n", c);
2079                         return_status = IO_ERROR;
2080                         break;
2081                 case CMD_CONNECTION_LOST:
2082                         printk(KERN_WARNING "cciss: cmd %p had "
2083                                "connection lost\n", c);
2084                         return_status = IO_ERROR;
2085                         break;
2086                 case CMD_ABORTED:
2087                         printk(KERN_WARNING "cciss: cmd %p was "
2088                                "aborted\n", c);
2089                         return_status = IO_ERROR;
2090                         break;
2091                 case CMD_ABORT_FAILED:
2092                         printk(KERN_WARNING "cciss: cmd %p reports "
2093                                "abort failed\n", c);
2094                         return_status = IO_ERROR;
2095                         break;
2096                 case CMD_UNSOLICITED_ABORT:
2097                         printk(KERN_WARNING
2098                                "cciss%d: unsolicited abort %p\n", ctlr, c);
2099                         if (c->retry_count < MAX_CMD_RETRIES) {
2100                                 printk(KERN_WARNING
2101                                        "cciss%d: retrying %p\n", ctlr, c);
2102                                 c->retry_count++;
2103                                 /* erase the old error information */
2104                                 memset(c->err_info, 0,
2105                                        sizeof(ErrorInfo_struct));
2106                                 return_status = IO_OK;
2107                                 INIT_COMPLETION(wait);
2108                                 goto resend_cmd2;
2109                         }
2110                         return_status = IO_ERROR;
2111                         break;
2112                 default:
2113                         printk(KERN_WARNING "cciss: cmd %p returned "
2114                                "unknown status %x\n", c,
2115                                c->err_info->CommandStatus);
2116                         return_status = IO_ERROR;
2117                 }
2118         }
2119         /* unlock the buffers from DMA */
2120         buff_dma_handle.val32.lower = c->SG[0].Addr.lower;
2121         buff_dma_handle.val32.upper = c->SG[0].Addr.upper;
2122         pci_unmap_single(h->pdev, (dma_addr_t) buff_dma_handle.val,
2123                          c->SG[0].Len, PCI_DMA_BIDIRECTIONAL);
2124         cmd_free(h, c, 0);
2125         return return_status;
2126 }
2127
2128 static void cciss_geometry_inquiry(int ctlr, int logvol,
2129                                    int withirq, sector_t total_size,
2130                                    unsigned int block_size,
2131                                    InquiryData_struct *inq_buff,
2132                                    drive_info_struct *drv)
2133 {
2134         int return_code;
2135         unsigned long t;
2136
2137         memset(inq_buff, 0, sizeof(InquiryData_struct));
2138         if (withirq)
2139                 return_code = sendcmd_withirq(CISS_INQUIRY, ctlr,
2140                                               inq_buff, sizeof(*inq_buff), 1,
2141                                               logvol, 0xC1, TYPE_CMD);
2142         else
2143                 return_code = sendcmd(CISS_INQUIRY, ctlr, inq_buff,
2144                                       sizeof(*inq_buff), 1, logvol, 0xC1, NULL,
2145                                       TYPE_CMD);
2146         if (return_code == IO_OK) {
2147                 if (inq_buff->data_byte[8] == 0xFF) {
2148                         printk(KERN_WARNING
2149                                "cciss: reading geometry failed, volume "
2150                                "does not support reading geometry\n");
2151                         drv->heads = 255;
2152                         drv->sectors = 32;      // Sectors per track
2153                         drv->cylinders = total_size + 1;
2154                         drv->raid_level = RAID_UNKNOWN;
2155                 } else {
2156                         drv->heads = inq_buff->data_byte[6];
2157                         drv->sectors = inq_buff->data_byte[7];
2158                         drv->cylinders = (inq_buff->data_byte[4] & 0xff) << 8;
2159                         drv->cylinders += inq_buff->data_byte[5];
2160                         drv->raid_level = inq_buff->data_byte[8];
2161                 }
2162                 drv->block_size = block_size;
2163                 drv->nr_blocks = total_size + 1;
2164                 t = drv->heads * drv->sectors;
2165                 if (t > 1) {
2166                         sector_t real_size = total_size + 1;
2167                         unsigned long rem = sector_div(real_size, t);
2168                         if (rem)
2169                                 real_size++;
2170                         drv->cylinders = real_size;
2171                 }
2172         } else {                /* Get geometry failed */
2173                 printk(KERN_WARNING "cciss: reading geometry failed\n");
2174         }
2175         printk(KERN_INFO "      heads=%d, sectors=%d, cylinders=%d\n\n",
2176                drv->heads, drv->sectors, drv->cylinders);
2177 }
2178
2179 static void
2180 cciss_read_capacity(int ctlr, int logvol, int withirq, sector_t *total_size,
2181                     unsigned int *block_size)
2182 {
2183         ReadCapdata_struct *buf;
2184         int return_code;
2185
2186         buf = kzalloc(sizeof(ReadCapdata_struct), GFP_KERNEL);
2187         if (!buf) {
2188                 printk(KERN_WARNING "cciss: out of memory\n");
2189                 return;
2190         }
2191
2192         if (withirq)
2193                 return_code = sendcmd_withirq(CCISS_READ_CAPACITY,
2194                                 ctlr, buf, sizeof(ReadCapdata_struct),
2195                                         1, logvol, 0, TYPE_CMD);
2196         else
2197                 return_code = sendcmd(CCISS_READ_CAPACITY,
2198                                 ctlr, buf, sizeof(ReadCapdata_struct),
2199                                         1, logvol, 0, NULL, TYPE_CMD);
2200         if (return_code == IO_OK) {
2201                 *total_size = be32_to_cpu(*(__be32 *) buf->total_size);
2202                 *block_size = be32_to_cpu(*(__be32 *) buf->block_size);
2203         } else {                /* read capacity command failed */
2204                 printk(KERN_WARNING "cciss: read capacity failed\n");
2205                 *total_size = 0;
2206                 *block_size = BLOCK_SIZE;
2207         }
2208         if (*total_size != 0)
2209                 printk(KERN_INFO "      blocks= %llu block_size= %d\n",
2210                 (unsigned long long)*total_size+1, *block_size);
2211         kfree(buf);
2212 }
2213
2214 static void
2215 cciss_read_capacity_16(int ctlr, int logvol, int withirq, sector_t *total_size,                                 unsigned int *block_size)
2216 {
2217         ReadCapdata_struct_16 *buf;
2218         int return_code;
2219
2220         buf = kzalloc(sizeof(ReadCapdata_struct_16), GFP_KERNEL);
2221         if (!buf) {
2222                 printk(KERN_WARNING "cciss: out of memory\n");
2223                 return;
2224         }
2225
2226         if (withirq) {
2227                 return_code = sendcmd_withirq(CCISS_READ_CAPACITY_16,
2228                         ctlr, buf, sizeof(ReadCapdata_struct_16),
2229                                 1, logvol, 0, TYPE_CMD);
2230         }
2231         else {
2232                 return_code = sendcmd(CCISS_READ_CAPACITY_16,
2233                         ctlr, buf, sizeof(ReadCapdata_struct_16),
2234                                 1, logvol, 0, NULL, TYPE_CMD);
2235         }
2236         if (return_code == IO_OK) {
2237                 *total_size = be64_to_cpu(*(__be64 *) buf->total_size);
2238                 *block_size = be32_to_cpu(*(__be32 *) buf->block_size);
2239         } else {                /* read capacity command failed */
2240                 printk(KERN_WARNING "cciss: read capacity failed\n");
2241                 *total_size = 0;
2242                 *block_size = BLOCK_SIZE;
2243         }
2244         printk(KERN_INFO "      blocks= %llu block_size= %d\n",
2245                (unsigned long long)*total_size+1, *block_size);
2246         kfree(buf);
2247 }
2248
2249 static int cciss_revalidate(struct gendisk *disk)
2250 {
2251         ctlr_info_t *h = get_host(disk);
2252         drive_info_struct *drv = get_drv(disk);
2253         int logvol;
2254         int FOUND = 0;
2255         unsigned int block_size;
2256         sector_t total_size;
2257         InquiryData_struct *inq_buff = NULL;
2258
2259         for (logvol = 0; logvol < CISS_MAX_LUN; logvol++) {
2260                 if (h->drv[logvol].LunID == drv->LunID) {
2261                         FOUND = 1;
2262                         break;
2263                 }
2264         }
2265
2266         if (!FOUND)
2267                 return 1;
2268
2269         inq_buff = kmalloc(sizeof(InquiryData_struct), GFP_KERNEL);
2270         if (inq_buff == NULL) {
2271                 printk(KERN_WARNING "cciss: out of memory\n");
2272                 return 1;
2273         }
2274         if (h->cciss_read == CCISS_READ_10) {
2275                 cciss_read_capacity(h->ctlr, logvol, 1,
2276                                         &total_size, &block_size);
2277         } else {
2278                 cciss_read_capacity_16(h->ctlr, logvol, 1,
2279                                         &total_size, &block_size);
2280         }
2281         cciss_geometry_inquiry(h->ctlr, logvol, 1, total_size, block_size,
2282                                inq_buff, drv);
2283
2284         blk_queue_hardsect_size(drv->queue, drv->block_size);
2285         set_capacity(disk, drv->nr_blocks);
2286
2287         kfree(inq_buff);
2288         return 0;
2289 }
2290
2291 /*
2292  *   Wait polling for a command to complete.
2293  *   The memory mapped FIFO is polled for the completion.
2294  *   Used only at init time, interrupts from the HBA are disabled.
2295  */
2296 static unsigned long pollcomplete(int ctlr)
2297 {
2298         unsigned long done;
2299         int i;
2300
2301         /* Wait (up to 20 seconds) for a command to complete */
2302
2303         for (i = 20 * HZ; i > 0; i--) {
2304                 done = hba[ctlr]->access.command_completed(hba[ctlr]);
2305                 if (done == FIFO_EMPTY)
2306                         schedule_timeout_uninterruptible(1);
2307                 else
2308                         return done;
2309         }
2310         /* Invalid address to tell caller we ran out of time */
2311         return 1;
2312 }
2313
2314 static int add_sendcmd_reject(__u8 cmd, int ctlr, unsigned long complete)
2315 {
2316         /* We get in here if sendcmd() is polling for completions
2317            and gets some command back that it wasn't expecting --
2318            something other than that which it just sent down.
2319            Ordinarily, that shouldn't happen, but it can happen when
2320            the scsi tape stuff gets into error handling mode, and
2321            starts using sendcmd() to try to abort commands and
2322            reset tape drives.  In that case, sendcmd may pick up
2323            completions of commands that were sent to logical drives
2324            through the block i/o system, or cciss ioctls completing, etc.
2325            In that case, we need to save those completions for later
2326            processing by the interrupt handler.
2327          */
2328
2329 #ifdef CONFIG_CISS_SCSI_TAPE
2330         struct sendcmd_reject_list *srl = &hba[ctlr]->scsi_rejects;
2331
2332         /* If it's not the scsi tape stuff doing error handling, (abort */
2333         /* or reset) then we don't expect anything weird. */
2334         if (cmd != CCISS_RESET_MSG && cmd != CCISS_ABORT_MSG) {
2335 #endif
2336                 printk(KERN_WARNING "cciss cciss%d: SendCmd "
2337                        "Invalid command list address returned! (%lx)\n",
2338                        ctlr, complete);
2339                 /* not much we can do. */
2340 #ifdef CONFIG_CISS_SCSI_TAPE
2341                 return 1;
2342         }
2343
2344         /* We've sent down an abort or reset, but something else
2345            has completed */
2346         if (srl->ncompletions >= (hba[ctlr]->nr_cmds + 2)) {
2347                 /* Uh oh.  No room to save it for later... */
2348                 printk(KERN_WARNING "cciss%d: Sendcmd: Invalid command addr, "
2349                        "reject list overflow, command lost!\n", ctlr);
2350                 return 1;
2351         }
2352         /* Save it for later */
2353         srl->complete[srl->ncompletions] = complete;
2354         srl->ncompletions++;
2355 #endif
2356         return 0;
2357 }
2358
2359 /*
2360  * Send a command to the controller, and wait for it to complete.
2361  * Only used at init time.
2362  */
2363 static int sendcmd(__u8 cmd, int ctlr, void *buff, size_t size, unsigned int use_unit_num,      /* 0: address the controller,
2364                                                                                                    1: address logical volume log_unit,
2365                                                                                                    2: periph device address is scsi3addr */
2366                    unsigned int log_unit,
2367                    __u8 page_code, unsigned char *scsi3addr, int cmd_type)
2368 {
2369         CommandList_struct *c;
2370         int i;
2371         unsigned long complete;
2372         ctlr_info_t *info_p = hba[ctlr];
2373         u64bit buff_dma_handle;
2374         int status, done = 0;
2375
2376         if ((c = cmd_alloc(info_p, 1)) == NULL) {
2377                 printk(KERN_WARNING "cciss: unable to get memory");
2378                 return IO_ERROR;
2379         }
2380         status = fill_cmd(c, cmd, ctlr, buff, size, use_unit_num,
2381                           log_unit, page_code, scsi3addr, cmd_type);
2382         if (status != IO_OK) {
2383                 cmd_free(info_p, c, 1);
2384                 return status;
2385         }
2386       resend_cmd1:
2387         /*
2388          * Disable interrupt
2389          */
2390 #ifdef CCISS_DEBUG
2391         printk(KERN_DEBUG "cciss: turning intr off\n");
2392 #endif                          /* CCISS_DEBUG */
2393         info_p->access.set_intr_mask(info_p, CCISS_INTR_OFF);
2394
2395         /* Make sure there is room in the command FIFO */
2396         /* Actually it should be completely empty at this time */
2397         /* unless we are in here doing error handling for the scsi */
2398         /* tape side of the driver. */
2399         for (i = 200000; i > 0; i--) {
2400                 /* if fifo isn't full go */
2401                 if (!(info_p->access.fifo_full(info_p))) {
2402
2403                         break;
2404                 }
2405                 udelay(10);
2406                 printk(KERN_WARNING "cciss cciss%d: SendCmd FIFO full,"
2407                        " waiting!\n", ctlr);
2408         }
2409         /*
2410          * Send the cmd
2411          */
2412         info_p->access.submit_command(info_p, c);
2413         done = 0;
2414         do {
2415                 complete = pollcomplete(ctlr);
2416
2417 #ifdef CCISS_DEBUG
2418                 printk(KERN_DEBUG "cciss: command completed\n");
2419 #endif                          /* CCISS_DEBUG */
2420
2421                 if (complete == 1) {
2422                         printk(KERN_WARNING
2423                                "cciss cciss%d: SendCmd Timeout out, "
2424                                "No command list address returned!\n", ctlr);
2425                         status = IO_ERROR;
2426                         done = 1;
2427                         break;
2428                 }
2429
2430                 /* This will need to change for direct lookup completions */
2431                 if ((complete & CISS_ERROR_BIT)
2432                     && (complete & ~CISS_ERROR_BIT) == c->busaddr) {
2433                         /* if data overrun or underun on Report command
2434                            ignore it
2435                          */
2436                         if (((c->Request.CDB[0] == CISS_REPORT_LOG) ||
2437                              (c->Request.CDB[0] == CISS_REPORT_PHYS) ||
2438                              (c->Request.CDB[0] == CISS_INQUIRY)) &&
2439                             ((c->err_info->CommandStatus ==
2440                               CMD_DATA_OVERRUN) ||
2441                              (c->err_info->CommandStatus == CMD_DATA_UNDERRUN)
2442                             )) {
2443                                 complete = c->busaddr;
2444                         } else {
2445                                 if (c->err_info->CommandStatus ==
2446                                     CMD_UNSOLICITED_ABORT) {
2447                                         printk(KERN_WARNING "cciss%d: "
2448                                                "unsolicited abort %p\n",
2449                                                ctlr, c);
2450                                         if (c->retry_count < MAX_CMD_RETRIES) {
2451                                                 printk(KERN_WARNING
2452                                                        "cciss%d: retrying %p\n",
2453                                                        ctlr, c);
2454                                                 c->retry_count++;
2455                                                 /* erase the old error */
2456                                                 /* information */
2457                                                 memset(c->err_info, 0,
2458                                                        sizeof
2459                                                        (ErrorInfo_struct));
2460                                                 goto resend_cmd1;
2461                                         } else {
2462                                                 printk(KERN_WARNING
2463                                                        "cciss%d: retried %p too "
2464                                                        "many times\n", ctlr, c);
2465                                                 status = IO_ERROR;
2466                                                 goto cleanup1;
2467                                         }
2468                                 } else if (c->err_info->CommandStatus ==
2469                                            CMD_UNABORTABLE) {
2470                                         printk(KERN_WARNING
2471                                                "cciss%d: command could not be aborted.\n",
2472                                                ctlr);
2473                                         status = IO_ERROR;
2474                                         goto cleanup1;
2475                                 }
2476                                 printk(KERN_WARNING "ciss ciss%d: sendcmd"
2477                                        " Error %x \n", ctlr,
2478                                        c->err_info->CommandStatus);
2479                                 printk(KERN_WARNING "ciss ciss%d: sendcmd"
2480                                        " offensive info\n"
2481                                        "  size %x\n   num %x   value %x\n",
2482                                        ctlr,
2483                                        c->err_info->MoreErrInfo.Invalid_Cmd.
2484                                        offense_size,
2485                                        c->err_info->MoreErrInfo.Invalid_Cmd.
2486                                        offense_num,
2487                                        c->err_info->MoreErrInfo.Invalid_Cmd.
2488                                        offense_value);
2489                                 status = IO_ERROR;
2490                                 goto cleanup1;
2491                         }
2492                 }
2493                 /* This will need changing for direct lookup completions */
2494                 if (complete != c->busaddr) {
2495                         if (add_sendcmd_reject(cmd, ctlr, complete) != 0) {
2496                                 BUG();  /* we are pretty much hosed if we get here. */
2497                         }
2498                         continue;
2499                 } else
2500                         done = 1;
2501         } while (!done);
2502
2503       cleanup1:
2504         /* unlock the data buffer from DMA */
2505         buff_dma_handle.val32.lower = c->SG[0].Addr.lower;
2506         buff_dma_handle.val32.upper = c->SG[0].Addr.upper;
2507         pci_unmap_single(info_p->pdev, (dma_addr_t) buff_dma_handle.val,
2508                          c->SG[0].Len, PCI_DMA_BIDIRECTIONAL);
2509 #ifdef CONFIG_CISS_SCSI_TAPE
2510         /* if we saved some commands for later, process them now. */
2511         if (info_p->scsi_rejects.ncompletions > 0)
2512                 do_cciss_intr(0, info_p);
2513 #endif
2514         cmd_free(info_p, c, 1);
2515         return status;
2516 }
2517
2518 /*
2519  * Map (physical) PCI mem into (virtual) kernel space
2520  */
2521 static void __iomem *remap_pci_mem(ulong base, ulong size)
2522 {
2523         ulong page_base = ((ulong) base) & PAGE_MASK;
2524         ulong page_offs = ((ulong) base) - page_base;
2525         void __iomem *page_remapped = ioremap(page_base, page_offs + size);
2526
2527         return page_remapped ? (page_remapped + page_offs) : NULL;
2528 }
2529
2530 /*
2531  * Takes jobs of the Q and sends them to the hardware, then puts it on
2532  * the Q to wait for completion.
2533  */
2534 static void start_io(ctlr_info_t *h)
2535 {
2536         CommandList_struct *c;
2537
2538         while (!hlist_empty(&h->reqQ)) {
2539                 c = hlist_entry(h->reqQ.first, CommandList_struct, list);
2540                 /* can't do anything if fifo is full */
2541                 if ((h->access.fifo_full(h))) {
2542                         printk(KERN_WARNING "cciss: fifo full\n");
2543                         break;
2544                 }
2545
2546                 /* Get the first entry from the Request Q */
2547                 removeQ(c);
2548                 h->Qdepth--;
2549
2550                 /* Tell the controller execute command */
2551                 h->access.submit_command(h, c);
2552
2553                 /* Put job onto the completed Q */
2554                 addQ(&h->cmpQ, c);
2555         }
2556 }
2557
2558 /* Assumes that CCISS_LOCK(h->ctlr) is held. */
2559 /* Zeros out the error record and then resends the command back */
2560 /* to the controller */
2561 static inline void resend_cciss_cmd(ctlr_info_t *h, CommandList_struct *c)
2562 {
2563         /* erase the old error information */
2564         memset(c->err_info, 0, sizeof(ErrorInfo_struct));
2565
2566         /* add it to software queue and then send it to the controller */
2567         addQ(&h->reqQ, c);
2568         h->Qdepth++;
2569         if (h->Qdepth > h->maxQsinceinit)
2570                 h->maxQsinceinit = h->Qdepth;
2571
2572         start_io(h);
2573 }
2574
2575 static inline unsigned int make_status_bytes(unsigned int scsi_status_byte,
2576         unsigned int msg_byte, unsigned int host_byte,
2577         unsigned int driver_byte)
2578 {
2579         /* inverse of macros in scsi.h */
2580         return (scsi_status_byte & 0xff) |
2581                 ((msg_byte & 0xff) << 8) |
2582                 ((host_byte & 0xff) << 16) |
2583                 ((driver_byte & 0xff) << 24);
2584 }
2585
2586 static inline int evaluate_target_status(CommandList_struct *cmd)
2587 {
2588         unsigned char sense_key;
2589         unsigned char status_byte, msg_byte, host_byte, driver_byte;
2590         int error_value;
2591
2592         /* If we get in here, it means we got "target status", that is, scsi status */
2593         status_byte = cmd->err_info->ScsiStatus;
2594         driver_byte = DRIVER_OK;
2595         msg_byte = cmd->err_info->CommandStatus; /* correct?  seems too device specific */
2596
2597         if (blk_pc_request(cmd->rq))
2598                 host_byte = DID_PASSTHROUGH;
2599         else
2600                 host_byte = DID_OK;
2601
2602         error_value = make_status_bytes(status_byte, msg_byte,
2603                 host_byte, driver_byte);
2604
2605         if (cmd->err_info->ScsiStatus != SAM_STAT_CHECK_CONDITION) {
2606                 if (!blk_pc_request(cmd->rq))
2607                         printk(KERN_WARNING "cciss: cmd %p "
2608                                "has SCSI Status 0x%x\n",
2609                                cmd, cmd->err_info->ScsiStatus);
2610                 return error_value;
2611         }
2612
2613         /* check the sense key */
2614         sense_key = 0xf & cmd->err_info->SenseInfo[2];
2615         /* no status or recovered error */
2616         if (((sense_key == 0x0) || (sense_key == 0x1)) && !blk_pc_request(cmd->rq))
2617                 error_value = 0;
2618
2619         if (!blk_pc_request(cmd->rq)) { /* Not SG_IO or similar? */
2620                 if (error_value != 0)
2621                         printk(KERN_WARNING "cciss: cmd %p has CHECK CONDITION"
2622                                " sense key = 0x%x\n", cmd, sense_key);
2623                 return error_value;
2624         }
2625
2626         /* SG_IO or similar, copy sense data back */
2627         if (cmd->rq->sense) {
2628                 if (cmd->rq->sense_len > cmd->err_info->SenseLen)
2629                         cmd->rq->sense_len = cmd->err_info->SenseLen;
2630                 memcpy(cmd->rq->sense, cmd->err_info->SenseInfo,
2631                         cmd->rq->sense_len);
2632         } else
2633                 cmd->rq->sense_len = 0;
2634
2635         return error_value;
2636 }
2637
2638 /* checks the status of the job and calls complete buffers to mark all
2639  * buffers for the completed job. Note that this function does not need
2640  * to hold the hba/queue lock.
2641  */
2642 static inline void complete_command(ctlr_info_t *h, CommandList_struct *cmd,
2643                                     int timeout)
2644 {
2645         int retry_cmd = 0;
2646         struct request *rq = cmd->rq;
2647
2648         rq->errors = 0;
2649
2650         if (timeout)
2651                 rq->errors = make_status_bytes(0, 0, 0, DRIVER_TIMEOUT);
2652
2653         if (cmd->err_info->CommandStatus == 0)  /* no error has occurred */
2654                 goto after_error_processing;
2655
2656         switch (cmd->err_info->CommandStatus) {
2657         case CMD_TARGET_STATUS:
2658                 rq->errors = evaluate_target_status(cmd);
2659                 break;
2660         case CMD_DATA_UNDERRUN:
2661                 if (blk_fs_request(cmd->rq)) {
2662                         printk(KERN_WARNING "cciss: cmd %p has"
2663                                " completed with data underrun "
2664                                "reported\n", cmd);
2665                         cmd->rq->data_len = cmd->err_info->ResidualCnt;
2666                 }
2667                 break;
2668         case CMD_DATA_OVERRUN:
2669                 if (blk_fs_request(cmd->rq))
2670                         printk(KERN_WARNING "cciss: cmd %p has"
2671                                " completed with data overrun "
2672                                "reported\n", cmd);
2673                 break;
2674         case CMD_INVALID:
2675                 printk(KERN_WARNING "cciss: cmd %p is "
2676                        "reported invalid\n", cmd);
2677                 rq->errors = make_status_bytes(SAM_STAT_GOOD,
2678                         cmd->err_info->CommandStatus, DRIVER_OK,
2679                         blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
2680                 break;
2681         case CMD_PROTOCOL_ERR:
2682                 printk(KERN_WARNING "cciss: cmd %p has "
2683                        "protocol error \n", cmd);
2684                 rq->errors = make_status_bytes(SAM_STAT_GOOD,
2685                         cmd->err_info->CommandStatus, DRIVER_OK,
2686                         blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
2687                 break;
2688         case CMD_HARDWARE_ERR:
2689                 printk(KERN_WARNING "cciss: cmd %p had "
2690                        " hardware error\n", cmd);
2691                 rq->errors = make_status_bytes(SAM_STAT_GOOD,
2692                         cmd->err_info->CommandStatus, DRIVER_OK,
2693                         blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
2694                 break;
2695         case CMD_CONNECTION_LOST:
2696                 printk(KERN_WARNING "cciss: cmd %p had "
2697                        "connection lost\n", cmd);
2698                 rq->errors = make_status_bytes(SAM_STAT_GOOD,
2699                         cmd->err_info->CommandStatus, DRIVER_OK,
2700                         blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
2701                 break;
2702         case CMD_ABORTED:
2703                 printk(KERN_WARNING "cciss: cmd %p was "
2704                        "aborted\n", cmd);
2705                 rq->errors = make_status_bytes(SAM_STAT_GOOD,
2706                         cmd->err_info->CommandStatus, DRIVER_OK,
2707                         blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ABORT);
2708                 break;
2709         case CMD_ABORT_FAILED:
2710                 printk(KERN_WARNING "cciss: cmd %p reports "
2711                        "abort failed\n", cmd);
2712                 rq->errors = make_status_bytes(SAM_STAT_GOOD,
2713                         cmd->err_info->CommandStatus, DRIVER_OK,
2714                         blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
2715                 break;
2716         case CMD_UNSOLICITED_ABORT:
2717                 printk(KERN_WARNING "cciss%d: unsolicited "
2718                        "abort %p\n", h->ctlr, cmd);
2719                 if (cmd->retry_count < MAX_CMD_RETRIES) {
2720                         retry_cmd = 1;
2721                         printk(KERN_WARNING
2722                                "cciss%d: retrying %p\n", h->ctlr, cmd);
2723                         cmd->retry_count++;
2724                 } else
2725                         printk(KERN_WARNING
2726                                "cciss%d: %p retried too "
2727                                "many times\n", h->ctlr, cmd);
2728                 rq->errors = make_status_bytes(SAM_STAT_GOOD,
2729                         cmd->err_info->CommandStatus, DRIVER_OK,
2730                         blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ABORT);
2731                 break;
2732         case CMD_TIMEOUT:
2733                 printk(KERN_WARNING "cciss: cmd %p timedout\n", cmd);
2734                 rq->errors = make_status_bytes(SAM_STAT_GOOD,
2735                         cmd->err_info->CommandStatus, DRIVER_OK,
2736                         blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
2737                 break;
2738         default:
2739                 printk(KERN_WARNING "cciss: cmd %p returned "
2740                        "unknown status %x\n", cmd,
2741                        cmd->err_info->CommandStatus);
2742                 rq->errors = make_status_bytes(SAM_STAT_GOOD,
2743                         cmd->err_info->CommandStatus, DRIVER_OK,
2744                         blk_pc_request(cmd->rq) ? DID_PASSTHROUGH : DID_ERROR);
2745         }
2746
2747 after_error_processing:
2748
2749         /* We need to return this command */
2750         if (retry_cmd) {
2751                 resend_cciss_cmd(h, cmd);
2752                 return;
2753         }
2754         cmd->rq->completion_data = cmd;
2755         blk_complete_request(cmd->rq);
2756 }
2757
2758 /*
2759  * Get a request and submit it to the controller.
2760  */
2761 static void do_cciss_request(struct request_queue *q)
2762 {
2763         ctlr_info_t *h = q->queuedata;
2764         CommandList_struct *c;
2765         sector_t start_blk;
2766         int seg;
2767         struct request *creq;
2768         u64bit temp64;
2769         struct scatterlist tmp_sg[MAXSGENTRIES];
2770         drive_info_struct *drv;
2771         int i, dir;
2772
2773         /* We call start_io here in case there is a command waiting on the
2774          * queue that has not been sent.
2775          */
2776         if (blk_queue_plugged(q))
2777                 goto startio;
2778
2779       queue:
2780         creq = elv_next_request(q);
2781         if (!creq)
2782                 goto startio;
2783
2784         BUG_ON(creq->nr_phys_segments > MAXSGENTRIES);
2785
2786         if ((c = cmd_alloc(h, 1)) == NULL)
2787                 goto full;
2788
2789         blkdev_dequeue_request(creq);
2790
2791         spin_unlock_irq(q->queue_lock);
2792
2793         c->cmd_type = CMD_RWREQ;
2794         c->rq = creq;
2795
2796         /* fill in the request */
2797         drv = creq->rq_disk->private_data;
2798         c->Header.ReplyQueue = 0;       // unused in simple mode
2799         /* got command from pool, so use the command block index instead */
2800         /* for direct lookups. */
2801         /* The first 2 bits are reserved for controller error reporting. */
2802         c->Header.Tag.lower = (c->cmdindex << 3);
2803         c->Header.Tag.lower |= 0x04;    /* flag for direct lookup. */
2804         c->Header.LUN.LogDev.VolId = drv->LunID;
2805         c->Header.LUN.LogDev.Mode = 1;
2806         c->Request.CDBLen = 10; // 12 byte commands not in FW yet;
2807         c->Request.Type.Type = TYPE_CMD;        // It is a command.
2808         c->Request.Type.Attribute = ATTR_SIMPLE;
2809         c->Request.Type.Direction =
2810             (rq_data_dir(creq) == READ) ? XFER_READ : XFER_WRITE;
2811         c->Request.Timeout = 0; // Don't time out
2812         c->Request.CDB[0] =
2813             (rq_data_dir(creq) == READ) ? h->cciss_read : h->cciss_write;
2814         start_blk = creq->sector;
2815 #ifdef CCISS_DEBUG
2816         printk(KERN_DEBUG "ciss: sector =%d nr_sectors=%d\n", (int)creq->sector,
2817                (int)creq->nr_sectors);
2818 #endif                          /* CCISS_DEBUG */
2819
2820         sg_init_table(tmp_sg, MAXSGENTRIES);
2821         seg = blk_rq_map_sg(q, creq, tmp_sg);
2822
2823         /* get the DMA records for the setup */
2824         if (c->Request.Type.Direction == XFER_READ)
2825                 dir = PCI_DMA_FROMDEVICE;
2826         else
2827                 dir = PCI_DMA_TODEVICE;
2828
2829         for (i = 0; i < seg; i++) {
2830                 c->SG[i].Len = tmp_sg[i].length;
2831                 temp64.val = (__u64) pci_map_page(h->pdev, sg_page(&tmp_sg[i]),
2832                                                   tmp_sg[i].offset,
2833                                                   tmp_sg[i].length, dir);
2834                 c->SG[i].Addr.lower = temp64.val32.lower;
2835                 c->SG[i].Addr.upper = temp64.val32.upper;
2836                 c->SG[i].Ext = 0;       // we are not chaining
2837         }
2838         /* track how many SG entries we are using */
2839         if (seg > h->maxSG)
2840                 h->maxSG = seg;
2841
2842 #ifdef CCISS_DEBUG
2843         printk(KERN_DEBUG "cciss: Submitting %lu sectors in %d segments\n",
2844                creq->nr_sectors, seg);
2845 #endif                          /* CCISS_DEBUG */
2846
2847         c->Header.SGList = c->Header.SGTotal = seg;
2848         if (likely(blk_fs_request(creq))) {
2849                 if(h->cciss_read == CCISS_READ_10) {
2850                         c->Request.CDB[1] = 0;
2851                         c->Request.CDB[2] = (start_blk >> 24) & 0xff;   //MSB
2852                         c->Request.CDB[3] = (start_blk >> 16) & 0xff;
2853                         c->Request.CDB[4] = (start_blk >> 8) & 0xff;
2854                         c->Request.CDB[5] = start_blk & 0xff;
2855                         c->Request.CDB[6] = 0;  // (sect >> 24) & 0xff; MSB
2856                         c->Request.CDB[7] = (creq->nr_sectors >> 8) & 0xff;
2857                         c->Request.CDB[8] = creq->nr_sectors & 0xff;
2858                         c->Request.CDB[9] = c->Request.CDB[11] = c->Request.CDB[12] = 0;
2859                 } else {
2860                         u32 upper32 = upper_32_bits(start_blk);
2861
2862                         c->Request.CDBLen = 16;
2863                         c->Request.CDB[1]= 0;
2864                         c->Request.CDB[2]= (upper32 >> 24) & 0xff;      //MSB
2865                         c->Request.CDB[3]= (upper32 >> 16) & 0xff;
2866                         c->Request.CDB[4]= (upper32 >>  8) & 0xff;
2867                         c->Request.CDB[5]= upper32 & 0xff;
2868                         c->Request.CDB[6]= (start_blk >> 24) & 0xff;
2869                         c->Request.CDB[7]= (start_blk >> 16) & 0xff;
2870                         c->Request.CDB[8]= (start_blk >>  8) & 0xff;
2871                         c->Request.CDB[9]= start_blk & 0xff;
2872                         c->Request.CDB[10]= (creq->nr_sectors >>  24) & 0xff;
2873                         c->Request.CDB[11]= (creq->nr_sectors >>  16) & 0xff;
2874                         c->Request.CDB[12]= (creq->nr_sectors >>  8) & 0xff;
2875                         c->Request.CDB[13]= creq->nr_sectors & 0xff;
2876                         c->Request.CDB[14] = c->Request.CDB[15] = 0;
2877                 }
2878         } else if (blk_pc_request(creq)) {
2879                 c->Request.CDBLen = creq->cmd_len;
2880                 memcpy(c->Request.CDB, creq->cmd, BLK_MAX_CDB);
2881         } else {
2882                 printk(KERN_WARNING "cciss%d: bad request type %d\n", h->ctlr, creq->cmd_type);
2883                 BUG();
2884         }
2885
2886         spin_lock_irq(q->queue_lock);
2887
2888         addQ(&h->reqQ, c);
2889         h->Qdepth++;
2890         if (h->Qdepth > h->maxQsinceinit)
2891                 h->maxQsinceinit = h->Qdepth;
2892
2893         goto queue;
2894 full:
2895         blk_stop_queue(q);
2896 startio:
2897         /* We will already have the driver lock here so not need
2898          * to lock it.
2899          */
2900         start_io(h);
2901 }
2902
2903 static inline unsigned long get_next_completion(ctlr_info_t *h)
2904 {
2905 #ifdef CONFIG_CISS_SCSI_TAPE
2906         /* Any rejects from sendcmd() lying around? Process them first */
2907         if (h->scsi_rejects.ncompletions == 0)
2908                 return h->access.command_completed(h);
2909         else {
2910                 struct sendcmd_reject_list *srl;
2911                 int n;
2912                 srl = &h->scsi_rejects;
2913                 n = --srl->ncompletions;
2914                 /* printk("cciss%d: processing saved reject\n", h->ctlr); */
2915                 printk("p");
2916                 return srl->complete[n];
2917         }
2918 #else
2919         return h->access.command_completed(h);
2920 #endif
2921 }
2922
2923 static inline int interrupt_pending(ctlr_info_t *h)
2924 {
2925 #ifdef CONFIG_CISS_SCSI_TAPE
2926         return (h->access.intr_pending(h)
2927                 || (h->scsi_rejects.ncompletions > 0));
2928 #else
2929         return h->access.intr_pending(h);
2930 #endif
2931 }
2932
2933 static inline long interrupt_not_for_us(ctlr_info_t *h)
2934 {
2935 #ifdef CONFIG_CISS_SCSI_TAPE
2936         return (((h->access.intr_pending(h) == 0) ||
2937                  (h->interrupts_enabled == 0))
2938                 && (h->scsi_rejects.ncompletions == 0));
2939 #else
2940         return (((h->access.intr_pending(h) == 0) ||
2941                  (h->interrupts_enabled == 0)));
2942 #endif
2943 }
2944
2945 static irqreturn_t do_cciss_intr(int irq, void *dev_id)
2946 {
2947         ctlr_info_t *h = dev_id;
2948         CommandList_struct *c;
2949         unsigned long flags;
2950         __u32 a, a1, a2;
2951
2952         if (interrupt_not_for_us(h))
2953                 return IRQ_NONE;
2954         /*
2955          * If there are completed commands in the completion queue,
2956          * we had better do something about it.
2957          */
2958         spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
2959         while (interrupt_pending(h)) {
2960                 while ((a = get_next_completion(h)) != FIFO_EMPTY) {
2961                         a1 = a;
2962                         if ((a & 0x04)) {
2963                                 a2 = (a >> 3);
2964                                 if (a2 >= h->nr_cmds) {
2965                                         printk(KERN_WARNING
2966                                                "cciss: controller cciss%d failed, stopping.\n",
2967                                                h->ctlr);
2968                                         fail_all_cmds(h->ctlr);
2969                                         return IRQ_HANDLED;
2970                                 }
2971
2972                                 c = h->cmd_pool + a2;
2973                                 a = c->busaddr;
2974
2975                         } else {
2976                                 struct hlist_node *tmp;
2977
2978                                 a &= ~3;
2979                                 c = NULL;
2980                                 hlist_for_each_entry(c, tmp, &h->cmpQ, list) {
2981                                         if (c->busaddr == a)
2982                                                 break;
2983                                 }
2984                         }
2985                         /*
2986                          * If we've found the command, take it off the
2987                          * completion Q and free it
2988                          */
2989                         if (c && c->busaddr == a) {
2990                                 removeQ(c);
2991                                 if (c->cmd_type == CMD_RWREQ) {
2992                                         complete_command(h, c, 0);
2993                                 } else if (c->cmd_type == CMD_IOCTL_PEND) {
2994                                         complete(c->waiting);
2995                                 }
2996 #                               ifdef CONFIG_CISS_SCSI_TAPE
2997                                 else if (c->cmd_type == CMD_SCSI)
2998                                         complete_scsi_command(c, 0, a1);
2999 #                               endif
3000                                 continue;
3001                         }
3002                 }
3003         }
3004
3005         spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
3006         return IRQ_HANDLED;
3007 }
3008
3009 /*
3010  *  We cannot read the structure directly, for portability we must use
3011  *   the io functions.
3012  *   This is for debug only.
3013  */
3014 #ifdef CCISS_DEBUG
3015 static void print_cfg_table(CfgTable_struct *tb)
3016 {
3017         int i;
3018         char temp_name[17];
3019
3020         printk("Controller Configuration information\n");
3021         printk("------------------------------------\n");
3022         for (i = 0; i < 4; i++)
3023                 temp_name[i] = readb(&(tb->Signature[i]));
3024         temp_name[4] = '\0';
3025         printk("   Signature = %s\n", temp_name);
3026         printk("   Spec Number = %d\n", readl(&(tb->SpecValence)));
3027         printk("   Transport methods supported = 0x%x\n",
3028                readl(&(tb->TransportSupport)));
3029         printk("   Transport methods active = 0x%x\n",
3030                readl(&(tb->TransportActive)));
3031         printk("   Requested transport Method = 0x%x\n",
3032                readl(&(tb->HostWrite.TransportRequest)));
3033         printk("   Coalesce Interrupt Delay = 0x%x\n",
3034                readl(&(tb->HostWrite.CoalIntDelay)));
3035         printk("   Coalesce Interrupt Count = 0x%x\n",
3036                readl(&(tb->HostWrite.CoalIntCount)));
3037         printk("   Max outstanding commands = 0x%d\n",
3038                readl(&(tb->CmdsOutMax)));
3039         printk("   Bus Types = 0x%x\n", readl(&(tb->BusTypes)));
3040         for (i = 0; i < 16; i++)
3041                 temp_name[i] = readb(&(tb->ServerName[i]));
3042         temp_name[16] = '\0';
3043         printk("   Server Name = %s\n", temp_name);
3044         printk("   Heartbeat Counter = 0x%x\n\n\n", readl(&(tb->HeartBeat)));
3045 }
3046 #endif                          /* CCISS_DEBUG */
3047
3048 static int find_PCI_BAR_index(struct pci_dev *pdev, unsigned long pci_bar_addr)
3049 {
3050         int i, offset, mem_type, bar_type;
3051         if (pci_bar_addr == PCI_BASE_ADDRESS_0) /* looking for BAR zero? */
3052                 return 0;
3053         offset = 0;
3054         for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
3055                 bar_type = pci_resource_flags(pdev, i) & PCI_BASE_ADDRESS_SPACE;
3056                 if (bar_type == PCI_BASE_ADDRESS_SPACE_IO)
3057                         offset += 4;
3058                 else {
3059                         mem_type = pci_resource_flags(pdev, i) &
3060                             PCI_BASE_ADDRESS_MEM_TYPE_MASK;
3061                         switch (mem_type) {
3062                         case PCI_BASE_ADDRESS_MEM_TYPE_32:
3063                         case PCI_BASE_ADDRESS_MEM_TYPE_1M:
3064                                 offset += 4;    /* 32 bit */
3065                                 break;
3066                         case PCI_BASE_ADDRESS_MEM_TYPE_64:
3067                                 offset += 8;
3068                                 break;
3069                         default:        /* reserved in PCI 2.2 */
3070                                 printk(KERN_WARNING
3071                                        "Base address is invalid\n");
3072                                 return -1;
3073                                 break;
3074                         }
3075                 }
3076                 if (offset == pci_bar_addr - PCI_BASE_ADDRESS_0)
3077                         return i + 1;
3078         }
3079         return -1;
3080 }
3081
3082 /* If MSI/MSI-X is supported by the kernel we will try to enable it on
3083  * controllers that are capable. If not, we use IO-APIC mode.
3084  */
3085
3086 static void __devinit cciss_interrupt_mode(ctlr_info_t *c,
3087                                            struct pci_dev *pdev, __u32 board_id)
3088 {
3089 #ifdef CONFIG_PCI_MSI
3090         int err;
3091         struct msix_entry cciss_msix_entries[4] = { {0, 0}, {0, 1},
3092         {0, 2}, {0, 3}
3093         };
3094
3095         /* Some boards advertise MSI but don't really support it */
3096         if ((board_id == 0x40700E11) ||
3097             (board_id == 0x40800E11) ||
3098             (board_id == 0x40820E11) || (board_id == 0x40830E11))
3099                 goto default_int_mode;
3100
3101         if (pci_find_capability(pdev, PCI_CAP_ID_MSIX)) {
3102                 err = pci_enable_msix(pdev, cciss_msix_entries, 4);
3103                 if (!err) {
3104                         c->intr[0] = cciss_msix_entries[0].vector;
3105                         c->intr[1] = cciss_msix_entries[1].vector;
3106                         c->intr[2] = cciss_msix_entries[2].vector;
3107                         c->intr[3] = cciss_msix_entries[3].vector;
3108                         c->msix_vector = 1;
3109                         return;
3110                 }
3111                 if (err > 0) {
3112                         printk(KERN_WARNING "cciss: only %d MSI-X vectors "
3113                                "available\n", err);
3114                         goto default_int_mode;
3115                 } else {
3116                         printk(KERN_WARNING "cciss: MSI-X init failed %d\n",
3117                                err);
3118                         goto default_int_mode;
3119                 }
3120         }
3121         if (pci_find_capability(pdev, PCI_CAP_ID_MSI)) {
3122                 if (!pci_enable_msi(pdev)) {
3123                         c->msi_vector = 1;
3124                 } else {
3125                         printk(KERN_WARNING "cciss: MSI init failed\n");
3126                 }
3127         }
3128 default_int_mode:
3129 #endif                          /* CONFIG_PCI_MSI */
3130         /* if we get here we're going to use the default interrupt mode */
3131         c->intr[SIMPLE_MODE_INT] = pdev->irq;
3132         return;
3133 }
3134
3135 static int __devinit cciss_pci_init(ctlr_info_t *c, struct pci_dev *pdev)
3136 {
3137         ushort subsystem_vendor_id, subsystem_device_id, command;
3138         __u32 board_id, scratchpad = 0;
3139         __u64 cfg_offset;
3140         __u32 cfg_base_addr;
3141         __u64 cfg_base_addr_index;
3142         int i, err;
3143
3144         /* check to see if controller has been disabled */
3145         /* BEFORE trying to enable it */
3146         (void)pci_read_config_word(pdev, PCI_COMMAND, &command);
3147         if (!(command & 0x02)) {
3148                 printk(KERN_WARNING
3149                        "cciss: controller appears to be disabled\n");
3150                 return -ENODEV;
3151         }
3152
3153         err = pci_enable_device(pdev);
3154         if (err) {
3155                 printk(KERN_ERR "cciss: Unable to Enable PCI device\n");
3156                 return err;
3157         }
3158
3159         err = pci_request_regions(pdev, "cciss");
3160         if (err) {
3161                 printk(KERN_ERR "cciss: Cannot obtain PCI resources, "
3162                        "aborting\n");
3163                 return err;
3164         }
3165
3166         subsystem_vendor_id = pdev->subsystem_vendor;
3167         subsystem_device_id = pdev->subsystem_device;
3168         board_id = (((__u32) (subsystem_device_id << 16) & 0xffff0000) |
3169                     subsystem_vendor_id);
3170
3171 #ifdef CCISS_DEBUG
3172         printk("command = %x\n", command);
3173         printk("irq = %x\n", pdev->irq);
3174         printk("board_id = %x\n", board_id);
3175 #endif                          /* CCISS_DEBUG */
3176
3177 /* If the kernel supports MSI/MSI-X we will try to enable that functionality,
3178  * else we use the IO-APIC interrupt assigned to us by system ROM.
3179  */
3180         cciss_interrupt_mode(c, pdev, board_id);
3181
3182         /*
3183          * Memory base addr is first addr , the second points to the config
3184          *   table
3185          */
3186
3187         c->paddr = pci_resource_start(pdev, 0); /* addressing mode bits already removed */
3188 #ifdef CCISS_DEBUG
3189         printk("address 0 = %lx\n", c->paddr);
3190 #endif                          /* CCISS_DEBUG */
3191         c->vaddr = remap_pci_mem(c->paddr, 0x250);
3192
3193         /* Wait for the board to become ready.  (PCI hotplug needs this.)
3194          * We poll for up to 120 secs, once per 100ms. */
3195         for (i = 0; i < 1200; i++) {
3196                 scratchpad = readl(c->vaddr + SA5_SCRATCHPAD_OFFSET);
3197                 if (scratchpad == CCISS_FIRMWARE_READY)
3198                         break;
3199                 set_current_state(TASK_INTERRUPTIBLE);
3200                 schedule_timeout(HZ / 10);      /* wait 100ms */
3201         }
3202         if (scratchpad != CCISS_FIRMWARE_READY) {
3203                 printk(KERN_WARNING "cciss: Board not ready.  Timed out.\n");
3204                 err = -ENODEV;
3205                 goto err_out_free_res;
3206         }
3207
3208         /* get the address index number */
3209         cfg_base_addr = readl(c->vaddr + SA5_CTCFG_OFFSET);
3210         cfg_base_addr &= (__u32) 0x0000ffff;
3211 #ifdef CCISS_DEBUG
3212         printk("cfg base address = %x\n", cfg_base_addr);
3213 #endif                          /* CCISS_DEBUG */
3214         cfg_base_addr_index = find_PCI_BAR_index(pdev, cfg_base_addr);
3215 #ifdef CCISS_DEBUG
3216         printk("cfg base address index = %llx\n",
3217                 (unsigned long long)cfg_base_addr_index);
3218 #endif                          /* CCISS_DEBUG */
3219         if (cfg_base_addr_index == -1) {
3220                 printk(KERN_WARNING "cciss: Cannot find cfg_base_addr_index\n");
3221                 err = -ENODEV;
3222                 goto err_out_free_res;
3223         }
3224
3225         cfg_offset = readl(c->vaddr + SA5_CTMEM_OFFSET);
3226 #ifdef CCISS_DEBUG
3227         printk("cfg offset = %llx\n", (unsigned long long)cfg_offset);
3228 #endif                          /* CCISS_DEBUG */
3229         c->cfgtable = remap_pci_mem(pci_resource_start(pdev,
3230                                                        cfg_base_addr_index) +
3231                                     cfg_offset, sizeof(CfgTable_struct));
3232         c->board_id = board_id;
3233
3234 #ifdef CCISS_DEBUG
3235         print_cfg_table(c->cfgtable);
3236 #endif                          /* CCISS_DEBUG */
3237
3238         /* Some controllers support Zero Memory Raid (ZMR).
3239          * When configured in ZMR mode the number of supported
3240          * commands drops to 64. So instead of just setting an
3241          * arbitrary value we make the driver a little smarter.
3242          * We read the config table to tell us how many commands
3243          * are supported on the controller then subtract 4 to
3244          * leave a little room for ioctl calls.
3245          */
3246         c->max_commands = readl(&(c->cfgtable->CmdsOutMax));
3247         for (i = 0; i < ARRAY_SIZE(products); i++) {
3248                 if (board_id == products[i].board_id) {
3249                         c->product_name = products[i].product_name;
3250                         c->access = *(products[i].access);
3251                         c->nr_cmds = c->max_commands - 4;
3252                         break;
3253                 }
3254         }
3255         if ((readb(&c->cfgtable->Signature[0]) != 'C') ||
3256             (readb(&c->cfgtable->Signature[1]) != 'I') ||
3257             (readb(&c->cfgtable->Signature[2]) != 'S') ||
3258             (readb(&c->cfgtable->Signature[3]) != 'S')) {
3259                 printk("Does not appear to be a valid CISS config table\n");
3260                 err = -ENODEV;
3261                 goto err_out_free_res;
3262         }
3263         /* We didn't find the controller in our list. We know the
3264          * signature is valid. If it's an HP device let's try to
3265          * bind to the device and fire it up. Otherwise we bail.
3266          */
3267         if (i == ARRAY_SIZE(products)) {
3268                 if (subsystem_vendor_id == PCI_VENDOR_ID_HP) {
3269                         c->product_name = products[i-1].product_name;
3270                         c->access = *(products[i-1].access);
3271                         c->nr_cmds = c->max_commands - 4;
3272                         printk(KERN_WARNING "cciss: This is an unknown "
3273                                 "Smart Array controller.\n"
3274                                 "cciss: Please update to the latest driver "
3275                                 "available from www.hp.com.\n");
3276                 } else {
3277                         printk(KERN_WARNING "cciss: Sorry, I don't know how"
3278                                 " to access the Smart Array controller %08lx\n"
3279                                         , (unsigned long)board_id);
3280                         err = -ENODEV;
3281                         goto err_out_free_res;
3282                 }
3283         }
3284 #ifdef CONFIG_X86
3285         {
3286                 /* Need to enable prefetch in the SCSI core for 6400 in x86 */
3287                 __u32 prefetch;
3288                 prefetch = readl(&(c->cfgtable->SCSI_Prefetch));
3289                 prefetch |= 0x100;
3290                 writel(prefetch, &(c->cfgtable->SCSI_Prefetch));
3291         }
3292 #endif
3293
3294         /* Disabling DMA prefetch and refetch for the P600.
3295          * An ASIC bug may result in accesses to invalid memory addresses.
3296          * We've disabled prefetch for some time now. Testing with XEN
3297          * kernels revealed a bug in the refetch if dom0 resides on a P600.
3298          */
3299         if(board_id == 0x3225103C) {
3300                 __u32 dma_prefetch;
3301                 __u32 dma_refetch;
3302                 dma_prefetch = readl(c->vaddr + I2O_DMA1_CFG);
3303                 dma_prefetch |= 0x8000;
3304                 writel(dma_prefetch, c->vaddr + I2O_DMA1_CFG);
3305                 pci_read_config_dword(pdev, PCI_COMMAND_PARITY, &dma_refetch);
3306                 dma_refetch |= 0x1;
3307                 pci_write_config_dword(pdev, PCI_COMMAND_PARITY, dma_refetch);
3308         }
3309
3310 #ifdef CCISS_DEBUG
3311         printk("Trying to put board into Simple mode\n");
3312 #endif                          /* CCISS_DEBUG */
3313         c->max_commands = readl(&(c->cfgtable->CmdsOutMax));
3314         /* Update the field, and then ring the doorbell */
3315         writel(CFGTBL_Trans_Simple, &(c->cfgtable->HostWrite.TransportRequest));
3316         writel(CFGTBL_ChangeReq, c->vaddr + SA5_DOORBELL);
3317
3318         /* under certain very rare conditions, this can take awhile.
3319          * (e.g.: hot replace a failed 144GB drive in a RAID 5 set right
3320          * as we enter this code.) */
3321         for (i = 0; i < MAX_CONFIG_WAIT; i++) {
3322                 if (!(readl(c->vaddr + SA5_DOORBELL) & CFGTBL_ChangeReq))
3323                         break;
3324                 /* delay and try again */
3325                 set_current_state(TASK_INTERRUPTIBLE);
3326                 schedule_timeout(10);
3327         }
3328
3329 #ifdef CCISS_DEBUG
3330         printk(KERN_DEBUG "I counter got to %d %x\n", i,
3331                readl(c->vaddr + SA5_DOORBELL));
3332 #endif                          /* CCISS_DEBUG */
3333 #ifdef CCISS_DEBUG
3334         print_cfg_table(c->cfgtable);
3335 #endif                          /* CCISS_DEBUG */
3336
3337         if (!(readl(&(c->cfgtable->TransportActive)) & CFGTBL_Trans_Simple)) {
3338                 printk(KERN_WARNING "cciss: unable to get board into"
3339                        " simple mode\n");
3340                 err = -ENODEV;
3341                 goto err_out_free_res;
3342         }
3343         return 0;
3344
3345 err_out_free_res:
3346         /*
3347          * Deliberately omit pci_disable_device(): it does something nasty to
3348          * Smart Array controllers that pci_enable_device does not undo
3349          */
3350         pci_release_regions(pdev);
3351         return err;
3352 }
3353
3354 /* Function to find the first free pointer into our hba[] array
3355  * Returns -1 if no free entries are left.
3356  */
3357 static int alloc_cciss_hba(void)
3358 {
3359         int i;
3360
3361         for (i = 0; i < MAX_CTLR; i++) {
3362                 if (!hba[i]) {
3363                         ctlr_info_t *p;
3364
3365                         p = kzalloc(sizeof(ctlr_info_t), GFP_KERNEL);
3366                         if (!p)
3367                                 goto Enomem;
3368                         hba[i] = p;
3369                         return i;
3370                 }
3371         }
3372         printk(KERN_WARNING "cciss: This driver supports a maximum"
3373                " of %d controllers.\n", MAX_CTLR);
3374         return -1;
3375 Enomem:
3376         printk(KERN_ERR "cciss: out of memory.\n");
3377         return -1;
3378 }
3379
3380 static void free_hba(int i)
3381 {
3382         ctlr_info_t *p = hba[i];
3383         int n;
3384
3385         hba[i] = NULL;
3386         for (n = 0; n < CISS_MAX_LUN; n++)
3387                 put_disk(p->gendisk[n]);
3388         kfree(p);
3389 }
3390
3391 /*
3392  *  This is it.  Find all the controllers and register them.  I really hate
3393  *  stealing all these major device numbers.
3394  *  returns the number of block devices registered.
3395  */
3396 static int __devinit cciss_init_one(struct pci_dev *pdev,
3397                                     const struct pci_device_id *ent)
3398 {
3399         int i;
3400         int j = 0;
3401         int rc;
3402         int dac, return_code;
3403         InquiryData_struct *inq_buff = NULL;
3404
3405         i = alloc_cciss_hba();
3406         if (i < 0)
3407                 return -1;
3408
3409         hba[i]->busy_initializing = 1;
3410         INIT_HLIST_HEAD(&hba[i]->cmpQ);
3411         INIT_HLIST_HEAD(&hba[i]->reqQ);
3412
3413         if (cciss_pci_init(hba[i], pdev) != 0)
3414                 goto clean1;
3415
3416         sprintf(hba[i]->devname, "cciss%d", i);
3417         hba[i]->ctlr = i;
3418         hba[i]->pdev = pdev;
3419
3420         /* configure PCI DMA stuff */
3421         if (!pci_set_dma_mask(pdev, DMA_64BIT_MASK))
3422                 dac = 1;
3423         else if (!pci_set_dma_mask(pdev, DMA_32BIT_MASK))
3424                 dac = 0;
3425         else {
3426                 printk(KERN_ERR "cciss: no suitable DMA available\n");
3427                 goto clean1;
3428         }
3429
3430         /*
3431          * register with the major number, or get a dynamic major number
3432          * by passing 0 as argument.  This is done for greater than
3433          * 8 controller support.
3434          */
3435         if (i < MAX_CTLR_ORIG)
3436                 hba[i]->major = COMPAQ_CISS_MAJOR + i;
3437         rc = register_blkdev(hba[i]->major, hba[i]->devname);
3438         if (rc == -EBUSY || rc == -EINVAL) {
3439                 printk(KERN_ERR
3440                        "cciss:  Unable to get major number %d for %s "
3441                        "on hba %d\n", hba[i]->major, hba[i]->devname, i);
3442                 goto clean1;
3443         } else {
3444                 if (i >= MAX_CTLR_ORIG)
3445                         hba[i]->major = rc;
3446         }
3447
3448         /* make sure the board interrupts are off */
3449         hba[i]->access.set_intr_mask(hba[i], CCISS_INTR_OFF);
3450         if (request_irq(hba[i]->intr[SIMPLE_MODE_INT], do_cciss_intr,
3451                         IRQF_DISABLED | IRQF_SHARED, hba[i]->devname, hba[i])) {
3452                 printk(KERN_ERR "cciss: Unable to get irq %d for %s\n",
3453                        hba[i]->intr[SIMPLE_MODE_INT], hba[i]->devname);
3454                 goto clean2;
3455         }
3456
3457         printk(KERN_INFO "%s: <0x%x> at PCI %s IRQ %d%s using DAC\n",
3458                hba[i]->devname, pdev->device, pci_name(pdev),
3459                hba[i]->intr[SIMPLE_MODE_INT], dac ? "" : " not");
3460
3461         hba[i]->cmd_pool_bits =
3462             kmalloc(DIV_ROUND_UP(hba[i]->nr_cmds, BITS_PER_LONG)
3463                         * sizeof(unsigned long), GFP_KERNEL);
3464         hba[i]->cmd_pool = (CommandList_struct *)
3465             pci_alloc_consistent(hba[i]->pdev,
3466                     hba[i]->nr_cmds * sizeof(CommandList_struct),
3467                     &(hba[i]->cmd_pool_dhandle));
3468         hba[i]->errinfo_pool = (ErrorInfo_struct *)
3469             pci_alloc_consistent(hba[i]->pdev,
3470                     hba[i]->nr_cmds * sizeof(ErrorInfo_struct),
3471                     &(hba[i]->errinfo_pool_dhandle));
3472         if ((hba[i]->cmd_pool_bits == NULL)
3473             || (hba[i]->cmd_pool == NULL)
3474             || (hba[i]->errinfo_pool == NULL)) {
3475                 printk(KERN_ERR "cciss: out of memory");
3476                 goto clean4;
3477         }
3478 #ifdef CONFIG_CISS_SCSI_TAPE
3479         hba[i]->scsi_rejects.complete =
3480             kmalloc(sizeof(hba[i]->scsi_rejects.complete[0]) *
3481                     (hba[i]->nr_cmds + 5), GFP_KERNEL);
3482         if (hba[i]->scsi_rejects.complete == NULL) {
3483                 printk(KERN_ERR "cciss: out of memory");
3484                 goto clean4;
3485         }
3486 #endif
3487         spin_lock_init(&hba[i]->lock);
3488
3489         /* Initialize the pdev driver private data.
3490            have it point to hba[i].  */
3491         pci_set_drvdata(pdev, hba[i]);
3492         /* command and error info recs zeroed out before
3493            they are used */
3494         memset(hba[i]->cmd_pool_bits, 0,
3495                DIV_ROUND_UP(hba[i]->nr_cmds, BITS_PER_LONG)
3496                         * sizeof(unsigned long));
3497
3498         hba[i]->num_luns = 0;
3499         hba[i]->highest_lun = -1;
3500         for (j = 0; j < CISS_MAX_LUN; j++) {
3501                 hba[i]->drv[j].raid_level = -1;
3502                 hba[i]->drv[j].queue = NULL;
3503                 hba[i]->gendisk[j] = NULL;
3504         }
3505
3506         cciss_scsi_setup(i);
3507
3508         /* Turn the interrupts on so we can service requests */
3509         hba[i]->access.set_intr_mask(hba[i], CCISS_INTR_ON);
3510
3511         /* Get the firmware version */
3512         inq_buff = kzalloc(sizeof(InquiryData_struct), GFP_KERNEL);
3513         if (inq_buff == NULL) {
3514                 printk(KERN_ERR "cciss: out of memory\n");
3515                 goto clean4;
3516         }
3517
3518         return_code = sendcmd_withirq(CISS_INQUIRY, i, inq_buff,
3519                 sizeof(InquiryData_struct), 0, 0 , 0, TYPE_CMD);
3520         if (return_code == IO_OK) {
3521                 hba[i]->firm_ver[0] = inq_buff->data_byte[32];
3522                 hba[i]->firm_ver[1] = inq_buff->data_byte[33];
3523                 hba[i]->firm_ver[2] = inq_buff->data_byte[34];
3524                 hba[i]->firm_ver[3] = inq_buff->data_byte[35];
3525         } else {         /* send command failed */
3526                 printk(KERN_WARNING "cciss: unable to determine firmware"
3527                         " version of controller\n");
3528         }
3529
3530         cciss_procinit(i);
3531
3532         hba[i]->cciss_max_sectors = 2048;
3533
3534         hba[i]->busy_initializing = 0;
3535
3536         rebuild_lun_table(hba[i], 1);
3537         return 1;
3538
3539 clean4:
3540         kfree(inq_buff);
3541 #ifdef CONFIG_CISS_SCSI_TAPE
3542         kfree(hba[i]->scsi_rejects.complete);
3543 #endif
3544         kfree(hba[i]->cmd_pool_bits);
3545         if (hba[i]->cmd_pool)
3546                 pci_free_consistent(hba[i]->pdev,
3547                                     hba[i]->nr_cmds * sizeof(CommandList_struct),
3548                                     hba[i]->cmd_pool, hba[i]->cmd_pool_dhandle);
3549         if (hba[i]->errinfo_pool)
3550                 pci_free_consistent(hba[i]->pdev,
3551                                     hba[i]->nr_cmds * sizeof(ErrorInfo_struct),
3552                                     hba[i]->errinfo_pool,
3553                                     hba[i]->errinfo_pool_dhandle);
3554         free_irq(hba[i]->intr[SIMPLE_MODE_INT], hba[i]);
3555 clean2:
3556         unregister_blkdev(hba[i]->major, hba[i]->devname);
3557 clean1:
3558         hba[i]->busy_initializing = 0;
3559         /* cleanup any queues that may have been initialized */
3560         for (j=0; j <= hba[i]->highest_lun; j++){
3561                 drive_info_struct *drv = &(hba[i]->drv[j]);
3562                 if (drv->queue)
3563                         blk_cleanup_queue(drv->queue);
3564         }
3565         /*
3566          * Deliberately omit pci_disable_device(): it does something nasty to
3567          * Smart Array controllers that pci_enable_device does not undo
3568          */
3569         pci_release_regions(pdev);
3570         pci_set_drvdata(pdev, NULL);
3571         free_hba(i);
3572         return -1;
3573 }
3574
3575 static void cciss_shutdown(struct pci_dev *pdev)
3576 {
3577         ctlr_info_t *tmp_ptr;
3578         int i;
3579         char flush_buf[4];
3580         int return_code;
3581
3582         tmp_ptr = pci_get_drvdata(pdev);
3583         if (tmp_ptr == NULL)
3584                 return;
3585         i = tmp_ptr->ctlr;
3586         if (hba[i] == NULL)
3587                 return;
3588
3589         /* Turn board interrupts off  and send the flush cache command */
3590         /* sendcmd will turn off interrupt, and send the flush...
3591          * To write all data in the battery backed cache to disks */
3592         memset(flush_buf, 0, 4);
3593         return_code = sendcmd(CCISS_CACHE_FLUSH, i, flush_buf, 4, 0, 0, 0, NULL,
3594                               TYPE_CMD);
3595         if (return_code == IO_OK) {
3596                 printk(KERN_INFO "Completed flushing cache on controller %d\n", i);
3597         } else {
3598                 printk(KERN_WARNING "Error flushing cache on controller %d\n", i);
3599         }
3600         free_irq(hba[i]->intr[2], hba[i]);
3601 }
3602
3603 static void __devexit cciss_remove_one(struct pci_dev *pdev)
3604 {
3605         ctlr_info_t *tmp_ptr;
3606         int i, j;
3607
3608         if (pci_get_drvdata(pdev) == NULL) {
3609                 printk(KERN_ERR "cciss: Unable to remove device \n");
3610                 return;
3611         }
3612         tmp_ptr = pci_get_drvdata(pdev);
3613         i = tmp_ptr->ctlr;
3614         if (hba[i] == NULL) {
3615                 printk(KERN_ERR "cciss: device appears to "
3616                        "already be removed \n");
3617                 return;
3618         }
3619
3620         remove_proc_entry(hba[i]->devname, proc_cciss);
3621         unregister_blkdev(hba[i]->major, hba[i]->devname);
3622
3623         /* remove it from the disk list */
3624         for (j = 0; j < CISS_MAX_LUN; j++) {
3625                 struct gendisk *disk = hba[i]->gendisk[j];
3626                 if (disk) {
3627                         struct request_queue *q = disk->queue;
3628
3629                         if (disk->flags & GENHD_FL_UP)
3630                                 del_gendisk(disk);
3631                         if (q)
3632                                 blk_cleanup_queue(q);
3633                 }
3634         }
3635
3636 #ifdef CONFIG_CISS_SCSI_TAPE
3637         cciss_unregister_scsi(i);       /* unhook from SCSI subsystem */
3638 #endif
3639
3640         cciss_shutdown(pdev);
3641
3642 #ifdef CONFIG_PCI_MSI
3643         if (hba[i]->msix_vector)
3644                 pci_disable_msix(hba[i]->pdev);
3645         else if (hba[i]->msi_vector)
3646                 pci_disable_msi(hba[i]->pdev);
3647 #endif                          /* CONFIG_PCI_MSI */
3648
3649         iounmap(hba[i]->vaddr);
3650
3651         pci_free_consistent(hba[i]->pdev, hba[i]->nr_cmds * sizeof(CommandList_struct),
3652                             hba[i]->cmd_pool, hba[i]->cmd_pool_dhandle);
3653         pci_free_consistent(hba[i]->pdev, hba[i]->nr_cmds * sizeof(ErrorInfo_struct),
3654                             hba[i]->errinfo_pool, hba[i]->errinfo_pool_dhandle);
3655         kfree(hba[i]->cmd_pool_bits);
3656 #ifdef CONFIG_CISS_SCSI_TAPE
3657         kfree(hba[i]->scsi_rejects.complete);
3658 #endif
3659         /*
3660          * Deliberately omit pci_disable_device(): it does something nasty to
3661          * Smart Array controllers that pci_enable_device does not undo
3662          */
3663         pci_release_regions(pdev);
3664         pci_set_drvdata(pdev, NULL);
3665         free_hba(i);
3666 }
3667
3668 static struct pci_driver cciss_pci_driver = {
3669         .name = "cciss",
3670         .probe = cciss_init_one,
3671         .remove = __devexit_p(cciss_remove_one),
3672         .id_table = cciss_pci_device_id,        /* id_table */
3673         .shutdown = cciss_shutdown,
3674 };
3675
3676 /*
3677  *  This is it.  Register the PCI driver information for the cards we control
3678  *  the OS will call our registered routines when it finds one of our cards.
3679  */
3680 static int __init cciss_init(void)
3681 {
3682         printk(KERN_INFO DRIVER_NAME "\n");
3683
3684         /* Register for our PCI devices */
3685         return pci_register_driver(&cciss_pci_driver);
3686 }
3687
3688 static void __exit cciss_cleanup(void)
3689 {
3690         int i;
3691
3692         pci_unregister_driver(&cciss_pci_driver);
3693         /* double check that all controller entrys have been removed */
3694         for (i = 0; i < MAX_CTLR; i++) {
3695                 if (hba[i] != NULL) {
3696                         printk(KERN_WARNING "cciss: had to remove"
3697                                " controller %d\n", i);
3698                         cciss_remove_one(hba[i]->pdev);
3699                 }
3700         }
3701         remove_proc_entry("driver/cciss", NULL);
3702 }
3703
3704 static void fail_all_cmds(unsigned long ctlr)
3705 {
3706         /* If we get here, the board is apparently dead. */
3707         ctlr_info_t *h = hba[ctlr];
3708         CommandList_struct *c;
3709         unsigned long flags;
3710
3711         printk(KERN_WARNING "cciss%d: controller not responding.\n", h->ctlr);
3712         h->alive = 0;           /* the controller apparently died... */
3713
3714         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
3715
3716         pci_disable_device(h->pdev);    /* Make sure it is really dead. */
3717
3718         /* move everything off the request queue onto the completed queue */
3719         while (!hlist_empty(&h->reqQ)) {
3720                 c = hlist_entry(h->reqQ.first, CommandList_struct, list);
3721                 removeQ(c);
3722                 h->Qdepth--;
3723                 addQ(&h->cmpQ, c);
3724         }
3725
3726         /* Now, fail everything on the completed queue with a HW error */
3727         while (!hlist_empty(&h->cmpQ)) {
3728                 c = hlist_entry(h->cmpQ.first, CommandList_struct, list);
3729                 removeQ(c);
3730                 c->err_info->CommandStatus = CMD_HARDWARE_ERR;
3731                 if (c->cmd_type == CMD_RWREQ) {
3732                         complete_command(h, c, 0);
3733                 } else if (c->cmd_type == CMD_IOCTL_PEND)
3734                         complete(c->waiting);
3735 #ifdef CONFIG_CISS_SCSI_TAPE
3736                 else if (c->cmd_type == CMD_SCSI)
3737                         complete_scsi_command(c, 0, 0);
3738 #endif
3739         }
3740         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
3741         return;
3742 }
3743
3744 module_init(cciss_init);
3745 module_exit(cciss_cleanup);