drivers/block/cciss.c

   1 /*
   2  *    Disk Array driver for HP SA 5xxx and 6xxx Controllers
   3  *    Copyright 2000, 2006 Hewlett-Packard Development Company, L.P.
   4  *
   5  *    This program is free software; you can redistribute it and/or modify
   6  *    it under the terms of the GNU General Public License as published by
   7  *    the Free Software Foundation; either version 2 of the License, or
   8  *    (at your option) any later version.
   9  *
  10  *    This program is distributed in the hope that it will be useful,
  11  *    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  *    MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
  13  *    NON INFRINGEMENT.  See the GNU General Public License for more details.
  14  *
  15  *    You should have received a copy of the GNU General Public License
  16  *    along with this program; if not, write to the Free Software
  17  *    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  18  *
  19  *    Questions/Comments/Bugfixes to iss_storagedev@hp.com
  20  *
  21  */
  22
  23 #include <linux/module.h>
  24 #include <linux/interrupt.h>
  25 #include <linux/types.h>
  26 #include <linux/pci.h>
  27 #include <linux/kernel.h>
  28 #include <linux/slab.h>
  29 #include <linux/delay.h>
  30 #include <linux/major.h>
  31 #include <linux/fs.h>
  32 #include <linux/bio.h>
  33 #include <linux/blkpg.h>
  34 #include <linux/timer.h>
  35 #include <linux/proc_fs.h>
  36 #include <linux/init.h>
  37 #include <linux/hdreg.h>
  38 #include <linux/spinlock.h>
  39 #include <linux/compat.h>
  40 #include <linux/blktrace_api.h>
  41 #include <asm/uaccess.h>
  42 #include <asm/io.h>
  43
  44 #include <linux/dma-mapping.h>
  45 #include <linux/blkdev.h>
  46 #include <linux/genhd.h>
  47 #include <linux/completion.h>
  48 #include <scsi/scsi.h>
  49 #include <scsi/sg.h>
  50 #include <scsi/scsi_ioctl.h>
  51 #include <linux/cdrom.h>
  52
  53 #define CCISS_DRIVER_VERSION(maj,min,submin) ((maj<<16)|(min<<8)|(submin))
  54 #define DRIVER_NAME "HP CISS Driver (v 3.6.14)"
  55 #define DRIVER_VERSION CCISS_DRIVER_VERSION(3,6,14)
  56
  57 /* Embedded module documentation macros - see modules.h */
  58 MODULE_AUTHOR("Hewlett-Packard Company");
  59 MODULE_DESCRIPTION("Driver for HP Controller SA5xxx SA6xxx version 3.6.14");
  60 MODULE_SUPPORTED_DEVICE("HP SA5i SA5i+ SA532 SA5300 SA5312 SA641 SA642 SA6400"
  61                         " SA6i P600 P800 P400 P400i E200 E200i E500");
  62 MODULE_VERSION("3.6.14");
  63 MODULE_LICENSE("GPL");
  64
  65 #include "cciss_cmd.h"
  66 #include "cciss.h"
  67 #include <linux/cciss_ioctl.h>
  68
  69 /* define the PCI info for the cards we can control */
  70 static const struct pci_device_id cciss_pci_device_id[] = {
  71         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISS,  0x0E11, 0x4070},
  72         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSB, 0x0E11, 0x4080},
  73         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSB, 0x0E11, 0x4082},
  74         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSB, 0x0E11, 0x4083},
  75         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x4091},
  76         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x409A},
  77         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x409B},
  78         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x409C},
  79         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x409D},
  80         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSA,     0x103C, 0x3225},
  81         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3223},
  82         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3234},
  83         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3235},
  84         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3211},
  85         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3212},
  86         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3213},
  87         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3214},
  88         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3215},
  89         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3237},
  90         {PCI_VENDOR_ID_HP,     PCI_ANY_ID,      PCI_ANY_ID, PCI_ANY_ID,
  91                 PCI_CLASS_STORAGE_RAID << 8, 0xffff << 8, 0},
  92         {0,}
  93 };
  94
  95 MODULE_DEVICE_TABLE(pci, cciss_pci_device_id);
  96
  97 /*  board_id = Subsystem Device ID & Vendor ID
  98  *  product = Marketing Name for the board
  99  *  access = Address of the struct of function pointers
 100  *  nr_cmds = Number of commands supported by controller
 101  */
 102 static struct board_type products[] = {
 103         {0x40700E11, "Smart Array 5300", &SA5_access, 512},
 104         {0x40800E11, "Smart Array 5i", &SA5B_access, 512},
 105         {0x40820E11, "Smart Array 532", &SA5B_access, 512},
 106         {0x40830E11, "Smart Array 5312", &SA5B_access, 512},
 107         {0x409A0E11, "Smart Array 641", &SA5_access, 512},
 108         {0x409B0E11, "Smart Array 642", &SA5_access, 512},
 109         {0x409C0E11, "Smart Array 6400", &SA5_access, 512},
 110         {0x409D0E11, "Smart Array 6400 EM", &SA5_access, 512},
 111         {0x40910E11, "Smart Array 6i", &SA5_access, 512},
 112         {0x3225103C, "Smart Array P600", &SA5_access, 512},
 113         {0x3223103C, "Smart Array P800", &SA5_access, 512},
 114         {0x3234103C, "Smart Array P400", &SA5_access, 512},
 115         {0x3235103C, "Smart Array P400i", &SA5_access, 512},
 116         {0x3211103C, "Smart Array E200i", &SA5_access, 120},
 117         {0x3212103C, "Smart Array E200", &SA5_access, 120},
 118         {0x3213103C, "Smart Array E200i", &SA5_access, 120},
 119         {0x3214103C, "Smart Array E200i", &SA5_access, 120},
 120         {0x3215103C, "Smart Array E200i", &SA5_access, 120},
 121         {0x3237103C, "Smart Array E500", &SA5_access, 512},
 122         {0xFFFF103C, "Unknown Smart Array", &SA5_access, 120},
 123 };
 124
 125 /* How long to wait (in milliseconds) for board to go into simple mode */
 126 #define MAX_CONFIG_WAIT 30000
 127 #define MAX_IOCTL_CONFIG_WAIT 1000
 128
 129 /*define how many times we will try a command because of bus resets */
 130 #define MAX_CMD_RETRIES 3
 131
 132 #define READ_AHEAD       1024
 133 #define MAX_CTLR        32
 134
 135 /* Originally cciss driver only supports 8 major numbers */
 136 #define MAX_CTLR_ORIG   8
 137
 138 static ctlr_info_t *hba[MAX_CTLR];
 139
 140 static void do_cciss_request(request_queue_t *q);
 141 static irqreturn_t do_cciss_intr(int irq, void *dev_id);
 142 static int cciss_open(struct inode *inode, struct file *filep);
 143 static int cciss_release(struct inode *inode, struct file *filep);
 144 static int cciss_ioctl(struct inode *inode, struct file *filep,
 145                        unsigned int cmd, unsigned long arg);
 146 static int cciss_getgeo(struct block_device *bdev, struct hd_geometry *geo);
 147
 148 static int cciss_revalidate(struct gendisk *disk);
 149 static int rebuild_lun_table(ctlr_info_t *h, struct gendisk *del_disk);
 150 static int deregister_disk(struct gendisk *disk, drive_info_struct *drv,
 151                            int clear_all);
 152
 153 static void cciss_read_capacity(int ctlr, int logvol, int withirq,
 154                         sector_t *total_size, unsigned int *block_size);
 155 static void cciss_read_capacity_16(int ctlr, int logvol, int withirq,
 156                         sector_t *total_size, unsigned int *block_size);
 157 static void cciss_geometry_inquiry(int ctlr, int logvol,
 158                         int withirq, sector_t total_size,
 159                         unsigned int block_size, InquiryData_struct *inq_buff,
 160                                    drive_info_struct *drv);
 161 static void cciss_getgeometry(int cntl_num);
 162 static void __devinit cciss_interrupt_mode(ctlr_info_t *, struct pci_dev *,
 163                                            __u32);
 164 static void start_io(ctlr_info_t *h);
 165 static int sendcmd(__u8 cmd, int ctlr, void *buff, size_t size,
 166                    unsigned int use_unit_num, unsigned int log_unit,
 167                    __u8 page_code, unsigned char *scsi3addr, int cmd_type);
 168 static int sendcmd_withirq(__u8 cmd, int ctlr, void *buff, size_t size,
 169                            unsigned int use_unit_num, unsigned int log_unit,
 170                            __u8 page_code, int cmd_type);
 171
 172 static void fail_all_cmds(unsigned long ctlr);
 173
 174 #ifdef CONFIG_PROC_FS
 175 static int cciss_proc_get_info(char *buffer, char **start, off_t offset,
 176                                int length, int *eof, void *data);
 177 static void cciss_procinit(int i);
 178 #else
 179 static void cciss_procinit(int i)
 180 {
 181 }
 182 #endif                          /* CONFIG_PROC_FS */
 183
 184 #ifdef CONFIG_COMPAT
 185 static long cciss_compat_ioctl(struct file *f, unsigned cmd, unsigned long arg);
 186 #endif
 187
 188 static struct block_device_operations cciss_fops = {
 189         .owner = THIS_MODULE,
 190         .open = cciss_open,
 191         .release = cciss_release,
 192         .ioctl = cciss_ioctl,
 193         .getgeo = cciss_getgeo,
 194 #ifdef CONFIG_COMPAT
 195         .compat_ioctl = cciss_compat_ioctl,
 196 #endif
 197         .revalidate_disk = cciss_revalidate,
 198 };
 199
 200 /*
 201  * Enqueuing and dequeuing functions for cmdlists.
 202  */
 203 static inline void addQ(CommandList_struct **Qptr, CommandList_struct *c)
 204 {
 205         if (*Qptr == NULL) {
 206                 *Qptr = c;
 207                 c->next = c->prev = c;
 208         } else {
 209                 c->prev = (*Qptr)->prev;
 210                 c->next = (*Qptr);
 211                 (*Qptr)->prev->next = c;
 212                 (*Qptr)->prev = c;
 213         }
 214 }
 215
 216 static inline CommandList_struct *removeQ(CommandList_struct **Qptr,
 217                                           CommandList_struct *c)
 218 {
 219         if (c && c->next != c) {
 220                 if (*Qptr == c)
 221                         *Qptr = c->next;
 222                 c->prev->next = c->next;
 223                 c->next->prev = c->prev;
 224         } else {
 225                 *Qptr = NULL;
 226         }
 227         return c;
 228 }
 229
 230 #include "cciss_scsi.c"         /* For SCSI tape support */
 231
 232 #define RAID_UNKNOWN 6
 233
 234 #ifdef CONFIG_PROC_FS
 235
 236 /*
 237  * Report information about this controller.
 238  */
 239 #define ENG_GIG 1000000000
 240 #define ENG_GIG_FACTOR (ENG_GIG/512)
 241 static const char *raid_label[] = { "0", "4", "1(1+0)", "5", "5+1", "ADG",
 242         "UNKNOWN"
 243 };
 244
 245 static struct proc_dir_entry *proc_cciss;
 246
 247 static int cciss_proc_get_info(char *buffer, char **start, off_t offset,
 248                                int length, int *eof, void *data)
 249 {
 250         off_t pos = 0;
 251         off_t len = 0;
 252         int size, i, ctlr;
 253         ctlr_info_t *h = (ctlr_info_t *) data;
 254         drive_info_struct *drv;
 255         unsigned long flags;
 256         sector_t vol_sz, vol_sz_frac;
 257
 258         ctlr = h->ctlr;
 259
 260         /* prevent displaying bogus info during configuration
 261          * or deconfiguration of a logical volume
 262          */
 263         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
 264         if (h->busy_configuring) {
 265                 spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
 266                 return -EBUSY;
 267         }
 268         h->busy_configuring = 1;
 269         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
 270
 271         size = sprintf(buffer, "%s: HP %s Controller\n"
 272                        "Board ID: 0x%08lx\n"
 273                        "Firmware Version: %c%c%c%c\n"
 274                        "IRQ: %d\n"
 275                        "Logical drives: %d\n"
 276                        "Max sectors: %d\n"
 277                        "Current Q depth: %d\n"
 278                        "Current # commands on controller: %d\n"
 279                        "Max Q depth since init: %d\n"
 280                        "Max # commands on controller since init: %d\n"
 281                        "Max SG entries since init: %d\n\n",
 282                        h->devname,
 283                        h->product_name,
 284                        (unsigned long)h->board_id,
 285                        h->firm_ver[0], h->firm_ver[1], h->firm_ver[2],
 286                        h->firm_ver[3], (unsigned int)h->intr[SIMPLE_MODE_INT],
 287                        h->num_luns,
 288                        h->cciss_max_sectors,
 289                        h->Qdepth, h->commands_outstanding,
 290                        h->maxQsinceinit, h->max_outstanding, h->maxSG);
 291
 292         pos += size;
 293         len += size;
 294         cciss_proc_tape_report(ctlr, buffer, &pos, &len);
 295         for (i = 0; i <= h->highest_lun; i++) {
 296
 297                 drv = &h->drv[i];
 298                 if (drv->heads == 0)
 299                         continue;
 300
 301                 vol_sz = drv->nr_blocks;
 302                 vol_sz_frac = sector_div(vol_sz, ENG_GIG_FACTOR);
 303                 vol_sz_frac *= 100;
 304                 sector_div(vol_sz_frac, ENG_GIG_FACTOR);
 305
 306                 if (drv->raid_level > 5)
 307                         drv->raid_level = RAID_UNKNOWN;
 308                 size = sprintf(buffer + len, "cciss/c%dd%d:"
 309                                "\t%4u.%02uGB\tRAID %s\n",
 310                                ctlr, i, (int)vol_sz, (int)vol_sz_frac,
 311                                raid_label[drv->raid_level]);
 312                 pos += size;
 313                 len += size;
 314         }
 315
 316         *eof = 1;
 317         *start = buffer + offset;
 318         len -= offset;
 319         if (len > length)
 320                 len = length;
 321         h->busy_configuring = 0;
 322         return len;
 323 }
 324
 325 static int
 326 cciss_proc_write(struct file *file, const char __user *buffer,
 327                  unsigned long count, void *data)
 328 {
 329         unsigned char cmd[80];
 330         int len;
 331 #ifdef CONFIG_CISS_SCSI_TAPE
 332         ctlr_info_t *h = (ctlr_info_t *) data;
 333         int rc;
 334 #endif
 335
 336         if (count > sizeof(cmd) - 1)
 337                 return -EINVAL;
 338         if (copy_from_user(cmd, buffer, count))
 339                 return -EFAULT;
 340         cmd[count] = '\0';
 341         len = strlen(cmd);      // above 3 lines ensure safety
 342         if (len && cmd[len - 1] == '\n')
 343                 cmd[--len] = '\0';
 344 #       ifdef CONFIG_CISS_SCSI_TAPE
 345         if (strcmp("engage scsi", cmd) == 0) {
 346                 rc = cciss_engage_scsi(h->ctlr);
 347                 if (rc != 0)
 348                         return -rc;
 349                 return count;
 350         }
 351         /* might be nice to have "disengage" too, but it's not
 352            safely possible. (only 1 module use count, lock issues.) */
 353 #       endif
 354         return -EINVAL;
 355 }
 356
 357 /*
 358  * Get us a file in /proc/cciss that says something about each controller.
 359  * Create /proc/cciss if it doesn't exist yet.
 360  */
 361 static void __devinit cciss_procinit(int i)
 362 {
 363         struct proc_dir_entry *pde;
 364
 365         if (proc_cciss == NULL) {
 366                 proc_cciss = proc_mkdir("cciss", proc_root_driver);
 367                 if (!proc_cciss)
 368                         return;
 369         }
 370
 371         pde = create_proc_read_entry(hba[i]->devname,
 372                                      S_IWUSR | S_IRUSR | S_IRGRP | S_IROTH,
 373                                      proc_cciss, cciss_proc_get_info, hba[i]);
 374         pde->write_proc = cciss_proc_write;
 375 }
 376 #endif                          /* CONFIG_PROC_FS */
 377
 378 /*
 379  * For operations that cannot sleep, a command block is allocated at init,
 380  * and managed by cmd_alloc() and cmd_free() using a simple bitmap to track
 381  * which ones are free or in use.  For operations that can wait for kmalloc
 382  * to possible sleep, this routine can be called with get_from_pool set to 0.
 383  * cmd_free() MUST be called with a got_from_pool set to 0 if cmd_alloc was.
 384  */
 385 static CommandList_struct *cmd_alloc(ctlr_info_t *h, int get_from_pool)
 386 {
 387         CommandList_struct *c;
 388         int i;
 389         u64bit temp64;
 390         dma_addr_t cmd_dma_handle, err_dma_handle;
 391
 392         if (!get_from_pool) {
 393                 c = (CommandList_struct *) pci_alloc_consistent(h->pdev,
 394                         sizeof(CommandList_struct), &cmd_dma_handle);
 395                 if (c == NULL)
 396                         return NULL;
 397                 memset(c, 0, sizeof(CommandList_struct));
 398
 399                 c->cmdindex = -1;
 400
 401                 c->err_info = (ErrorInfo_struct *)
 402                     pci_alloc_consistent(h->pdev, sizeof(ErrorInfo_struct),
 403                             &err_dma_handle);
 404
 405                 if (c->err_info == NULL) {
 406                         pci_free_consistent(h->pdev,
 407                                 sizeof(CommandList_struct), c, cmd_dma_handle);
 408                         return NULL;
 409                 }
 410                 memset(c->err_info, 0, sizeof(ErrorInfo_struct));
 411         } else {                /* get it out of the controllers pool */
 412
 413                 do {
 414                         i = find_first_zero_bit(h->cmd_pool_bits, h->nr_cmds);
 415                         if (i == h->nr_cmds)
 416                                 return NULL;
 417                 } while (test_and_set_bit
 418                          (i & (BITS_PER_LONG - 1),
 419                           h->cmd_pool_bits + (i / BITS_PER_LONG)) != 0);
 420 #ifdef CCISS_DEBUG
 421                 printk(KERN_DEBUG "cciss: using command buffer %d\n", i);
 422 #endif
 423                 c = h->cmd_pool + i;
 424                 memset(c, 0, sizeof(CommandList_struct));
 425                 cmd_dma_handle = h->cmd_pool_dhandle
 426                     + i * sizeof(CommandList_struct);
 427                 c->err_info = h->errinfo_pool + i;
 428                 memset(c->err_info, 0, sizeof(ErrorInfo_struct));
 429                 err_dma_handle = h->errinfo_pool_dhandle
 430                     + i * sizeof(ErrorInfo_struct);
 431                 h->nr_allocs++;
 432
 433                 c->cmdindex = i;
 434         }
 435
 436         c->busaddr = (__u32) cmd_dma_handle;
 437         temp64.val = (__u64) err_dma_handle;
 438         c->ErrDesc.Addr.lower = temp64.val32.lower;
 439         c->ErrDesc.Addr.upper = temp64.val32.upper;
 440         c->ErrDesc.Len = sizeof(ErrorInfo_struct);
 441
 442         c->ctlr = h->ctlr;
 443         return c;
 444 }
 445
 446 /*
 447  * Frees a command block that was previously allocated with cmd_alloc().
 448  */
 449 static void cmd_free(ctlr_info_t *h, CommandList_struct *c, int got_from_pool)
 450 {
 451         int i;
 452         u64bit temp64;
 453
 454         if (!got_from_pool) {
 455                 temp64.val32.lower = c->ErrDesc.Addr.lower;
 456                 temp64.val32.upper = c->ErrDesc.Addr.upper;
 457                 pci_free_consistent(h->pdev, sizeof(ErrorInfo_struct),
 458                                     c->err_info, (dma_addr_t) temp64.val);
 459                 pci_free_consistent(h->pdev, sizeof(CommandList_struct),
 460                                     c, (dma_addr_t) c->busaddr);
 461         } else {
 462                 i = c - h->cmd_pool;
 463                 clear_bit(i & (BITS_PER_LONG - 1),
 464                           h->cmd_pool_bits + (i / BITS_PER_LONG));
 465                 h->nr_frees++;
 466         }
 467 }
 468
 469 static inline ctlr_info_t *get_host(struct gendisk *disk)
 470 {
 471         return disk->queue->queuedata;
 472 }
 473
 474 static inline drive_info_struct *get_drv(struct gendisk *disk)
 475 {
 476         return disk->private_data;
 477 }
 478
 479 /*
 480  * Open.  Make sure the device is really there.
 481  */
 482 static int cciss_open(struct inode *inode, struct file *filep)
 483 {
 484         ctlr_info_t *host = get_host(inode->i_bdev->bd_disk);
 485         drive_info_struct *drv = get_drv(inode->i_bdev->bd_disk);
 486
 487 #ifdef CCISS_DEBUG
 488         printk(KERN_DEBUG "cciss_open %s\n", inode->i_bdev->bd_disk->disk_name);
 489 #endif                          /* CCISS_DEBUG */
 490
 491         if (host->busy_initializing || drv->busy_configuring)
 492                 return -EBUSY;
 493         /*
 494          * Root is allowed to open raw volume zero even if it's not configured
 495          * so array config can still work. Root is also allowed to open any
 496          * volume that has a LUN ID, so it can issue IOCTL to reread the
 497          * disk information.  I don't think I really like this
 498          * but I'm already using way to many device nodes to claim another one
 499          * for "raw controller".
 500          */
 501         if (drv->heads == 0) {
 502                 if (iminor(inode) != 0) {       /* not node 0? */
 503                         /* if not node 0 make sure it is a partition = 0 */
 504                         if (iminor(inode) & 0x0f) {
 505                                 return -ENXIO;
 506                                 /* if it is, make sure we have a LUN ID */
 507                         } else if (drv->LunID == 0) {
 508                                 return -ENXIO;
 509                         }
 510                 }
 511                 if (!capable(CAP_SYS_ADMIN))
 512                         return -EPERM;
 513         }
 514         drv->usage_count++;
 515         host->usage_count++;
 516         return 0;
 517 }
 518
 519 /*
 520  * Close.  Sync first.
 521  */
 522 static int cciss_release(struct inode *inode, struct file *filep)
 523 {
 524         ctlr_info_t *host = get_host(inode->i_bdev->bd_disk);
 525         drive_info_struct *drv = get_drv(inode->i_bdev->bd_disk);
 526
 527 #ifdef CCISS_DEBUG
 528         printk(KERN_DEBUG "cciss_release %s\n",
 529                inode->i_bdev->bd_disk->disk_name);
 530 #endif                          /* CCISS_DEBUG */
 531
 532         drv->usage_count--;
 533         host->usage_count--;
 534         return 0;
 535 }
 536
 537 #ifdef CONFIG_COMPAT
 538
 539 static int do_ioctl(struct file *f, unsigned cmd, unsigned long arg)
 540 {
 541         int ret;
 542         lock_kernel();
 543         ret = cciss_ioctl(f->f_path.dentry->d_inode, f, cmd, arg);
 544         unlock_kernel();
 545         return ret;
 546 }
 547
 548 static int cciss_ioctl32_passthru(struct file *f, unsigned cmd,
 549                                   unsigned long arg);
 550 static int cciss_ioctl32_big_passthru(struct file *f, unsigned cmd,
 551                                       unsigned long arg);
 552
 553 static long cciss_compat_ioctl(struct file *f, unsigned cmd, unsigned long arg)
 554 {
 555         switch (cmd) {
 556         case CCISS_GETPCIINFO:
 557         case CCISS_GETINTINFO:
 558         case CCISS_SETINTINFO:
 559         case CCISS_GETNODENAME:
 560         case CCISS_SETNODENAME:
 561         case CCISS_GETHEARTBEAT:
 562         case CCISS_GETBUSTYPES:
 563         case CCISS_GETFIRMVER:
 564         case CCISS_GETDRIVVER:
 565         case CCISS_REVALIDVOLS:
 566         case CCISS_DEREGDISK:
 567         case CCISS_REGNEWDISK:
 568         case CCISS_REGNEWD:
 569         case CCISS_RESCANDISK:
 570         case CCISS_GETLUNINFO:
 571                 return do_ioctl(f, cmd, arg);
 572
 573         case CCISS_PASSTHRU32:
 574                 return cciss_ioctl32_passthru(f, cmd, arg);
 575         case CCISS_BIG_PASSTHRU32:
 576                 return cciss_ioctl32_big_passthru(f, cmd, arg);
 577
 578         default:
 579                 return -ENOIOCTLCMD;
 580         }
 581 }
 582
 583 static int cciss_ioctl32_passthru(struct file *f, unsigned cmd,
 584                                   unsigned long arg)
 585 {
 586         IOCTL32_Command_struct __user *arg32 =
 587             (IOCTL32_Command_struct __user *) arg;
 588         IOCTL_Command_struct arg64;
 589         IOCTL_Command_struct __user *p = compat_alloc_user_space(sizeof(arg64));
 590         int err;
 591         u32 cp;
 592
 593         err = 0;
 594         err |=
 595             copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
 596                            sizeof(arg64.LUN_info));
 597         err |=
 598             copy_from_user(&arg64.Request, &arg32->Request,
 599                            sizeof(arg64.Request));
 600         err |=
 601             copy_from_user(&arg64.error_info, &arg32->error_info,
 602                            sizeof(arg64.error_info));
 603         err |= get_user(arg64.buf_size, &arg32->buf_size);
 604         err |= get_user(cp, &arg32->buf);
 605         arg64.buf = compat_ptr(cp);
 606         err |= copy_to_user(p, &arg64, sizeof(arg64));
 607
 608         if (err)
 609                 return -EFAULT;
 610
 611         err = do_ioctl(f, CCISS_PASSTHRU, (unsigned long)p);
 612         if (err)
 613                 return err;
 614         err |=
 615             copy_in_user(&arg32->error_info, &p->error_info,
 616                          sizeof(arg32->error_info));
 617         if (err)
 618                 return -EFAULT;
 619         return err;
 620 }
 621
 622 static int cciss_ioctl32_big_passthru(struct file *file, unsigned cmd,
 623                                       unsigned long arg)
 624 {
 625         BIG_IOCTL32_Command_struct __user *arg32 =
 626             (BIG_IOCTL32_Command_struct __user *) arg;
 627         BIG_IOCTL_Command_struct arg64;
 628         BIG_IOCTL_Command_struct __user *p =
 629             compat_alloc_user_space(sizeof(arg64));
 630         int err;
 631         u32 cp;
 632
 633         err = 0;
 634         err |=
 635             copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
 636                            sizeof(arg64.LUN_info));
 637         err |=
 638             copy_from_user(&arg64.Request, &arg32->Request,
 639                            sizeof(arg64.Request));
 640         err |=
 641             copy_from_user(&arg64.error_info, &arg32->error_info,
 642                            sizeof(arg64.error_info));
 643         err |= get_user(arg64.buf_size, &arg32->buf_size);
 644         err |= get_user(arg64.malloc_size, &arg32->malloc_size);
 645         err |= get_user(cp, &arg32->buf);
 646         arg64.buf = compat_ptr(cp);
 647         err |= copy_to_user(p, &arg64, sizeof(arg64));
 648
 649         if (err)
 650                 return -EFAULT;
 651
 652         err = do_ioctl(file, CCISS_BIG_PASSTHRU, (unsigned long)p);
 653         if (err)
 654                 return err;
 655         err |=
 656             copy_in_user(&arg32->error_info, &p->error_info,
 657                          sizeof(arg32->error_info));
 658         if (err)
 659                 return -EFAULT;
 660         return err;
 661 }
 662 #endif
 663
 664 static int cciss_getgeo(struct block_device *bdev, struct hd_geometry *geo)
 665 {
 666         drive_info_struct *drv = get_drv(bdev->bd_disk);
 667
 668         if (!drv->cylinders)
 669                 return -ENXIO;
 670
 671         geo->heads = drv->heads;
 672         geo->sectors = drv->sectors;
 673         geo->cylinders = drv->cylinders;
 674         return 0;
 675 }
 676
 677 /*
 678  * ioctl
 679  */
 680 static int cciss_ioctl(struct inode *inode, struct file *filep,
 681                        unsigned int cmd, unsigned long arg)
 682 {
 683         struct block_device *bdev = inode->i_bdev;
 684         struct gendisk *disk = bdev->bd_disk;
 685         ctlr_info_t *host = get_host(disk);
 686         drive_info_struct *drv = get_drv(disk);
 687         int ctlr = host->ctlr;
 688         void __user *argp = (void __user *)arg;
 689
 690 #ifdef CCISS_DEBUG
 691         printk(KERN_DEBUG "cciss_ioctl: Called with cmd=%x %lx\n", cmd, arg);
 692 #endif                          /* CCISS_DEBUG */
 693
 694         switch (cmd) {
 695         case CCISS_GETPCIINFO:
 696                 {
 697                         cciss_pci_info_struct pciinfo;
 698
 699                         if (!arg)
 700                                 return -EINVAL;
 701                         pciinfo.domain = pci_domain_nr(host->pdev->bus);
 702                         pciinfo.bus = host->pdev->bus->number;
 703                         pciinfo.dev_fn = host->pdev->devfn;
 704                         pciinfo.board_id = host->board_id;
 705                         if (copy_to_user
 706                             (argp, &pciinfo, sizeof(cciss_pci_info_struct)))
 707                                 return -EFAULT;
 708                         return 0;
 709                 }
 710         case CCISS_GETINTINFO:
 711                 {
 712                         cciss_coalint_struct intinfo;
 713                         if (!arg)
 714                                 return -EINVAL;
 715                         intinfo.delay =
 716                             readl(&host->cfgtable->HostWrite.CoalIntDelay);
 717                         intinfo.count =
 718                             readl(&host->cfgtable->HostWrite.CoalIntCount);
 719                         if (copy_to_user
 720                             (argp, &intinfo, sizeof(cciss_coalint_struct)))
 721                                 return -EFAULT;
 722                         return 0;
 723                 }
 724         case CCISS_SETINTINFO:
 725                 {
 726                         cciss_coalint_struct intinfo;
 727                         unsigned long flags;
 728                         int i;
 729
 730                         if (!arg)
 731                                 return -EINVAL;
 732                         if (!capable(CAP_SYS_ADMIN))
 733                                 return -EPERM;
 734                         if (copy_from_user
 735                             (&intinfo, argp, sizeof(cciss_coalint_struct)))
 736                                 return -EFAULT;
 737                         if ((intinfo.delay == 0) && (intinfo.count == 0))
 738                         {
 739 //                      printk("cciss_ioctl: delay and count cannot be 0\n");
 740                                 return -EINVAL;
 741                         }
 742                         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
 743                         /* Update the field, and then ring the doorbell */
 744                         writel(intinfo.delay,
 745                                &(host->cfgtable->HostWrite.CoalIntDelay));
 746                         writel(intinfo.count,
 747                                &(host->cfgtable->HostWrite.CoalIntCount));
 748                         writel(CFGTBL_ChangeReq, host->vaddr + SA5_DOORBELL);
 749
 750                         for (i = 0; i < MAX_IOCTL_CONFIG_WAIT; i++) {
 751                                 if (!(readl(host->vaddr + SA5_DOORBELL)
 752                                       & CFGTBL_ChangeReq))
 753                                         break;
 754                                 /* delay and try again */
 755                                 udelay(1000);
 756                         }
 757                         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
 758                         if (i >= MAX_IOCTL_CONFIG_WAIT)
 759                                 return -EAGAIN;
 760                         return 0;
 761                 }
 762         case CCISS_GETNODENAME:
 763                 {
 764                         NodeName_type NodeName;
 765                         int i;
 766
 767                         if (!arg)
 768                                 return -EINVAL;
 769                         for (i = 0; i < 16; i++)
 770                                 NodeName[i] =
 771                                     readb(&host->cfgtable->ServerName[i]);
 772                         if (copy_to_user(argp, NodeName, sizeof(NodeName_type)))
 773                                 return -EFAULT;
 774                         return 0;
 775                 }
 776         case CCISS_SETNODENAME:
 777                 {
 778                         NodeName_type NodeName;
 779                         unsigned long flags;
 780                         int i;
 781
 782                         if (!arg)
 783                                 return -EINVAL;
 784                         if (!capable(CAP_SYS_ADMIN))
 785                                 return -EPERM;
 786
 787                         if (copy_from_user
 788                             (NodeName, argp, sizeof(NodeName_type)))
 789                                 return -EFAULT;
 790
 791                         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
 792
 793                         /* Update the field, and then ring the doorbell */
 794                         for (i = 0; i < 16; i++)
 795                                 writeb(NodeName[i],
 796                                        &host->cfgtable->ServerName[i]);
 797
 798                         writel(CFGTBL_ChangeReq, host->vaddr + SA5_DOORBELL);
 799
 800                         for (i = 0; i < MAX_IOCTL_CONFIG_WAIT; i++) {
 801                                 if (!(readl(host->vaddr + SA5_DOORBELL)
 802                                       & CFGTBL_ChangeReq))
 803                                         break;
 804                                 /* delay and try again */
 805                                 udelay(1000);
 806                         }
 807                         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
 808                         if (i >= MAX_IOCTL_CONFIG_WAIT)
 809                                 return -EAGAIN;
 810                         return 0;
 811                 }
 812
 813         case CCISS_GETHEARTBEAT:
 814                 {
 815                         Heartbeat_type heartbeat;
 816
 817                         if (!arg)
 818                                 return -EINVAL;
 819                         heartbeat = readl(&host->cfgtable->HeartBeat);
 820                         if (copy_to_user
 821                             (argp, &heartbeat, sizeof(Heartbeat_type)))
 822                                 return -EFAULT;
 823                         return 0;
 824                 }
 825         case CCISS_GETBUSTYPES:
 826                 {
 827                         BusTypes_type BusTypes;
 828
 829                         if (!arg)
 830                                 return -EINVAL;
 831                         BusTypes = readl(&host->cfgtable->BusTypes);
 832                         if (copy_to_user
 833                             (argp, &BusTypes, sizeof(BusTypes_type)))
 834                                 return -EFAULT;
 835                         return 0;
 836                 }
 837         case CCISS_GETFIRMVER:
 838                 {
 839                         FirmwareVer_type firmware;
 840
 841                         if (!arg)
 842                                 return -EINVAL;
 843                         memcpy(firmware, host->firm_ver, 4);
 844
 845                         if (copy_to_user
 846                             (argp, firmware, sizeof(FirmwareVer_type)))
 847                                 return -EFAULT;
 848                         return 0;
 849                 }
 850         case CCISS_GETDRIVVER:
 851                 {
 852                         DriverVer_type DriverVer = DRIVER_VERSION;
 853
 854                         if (!arg)
 855                                 return -EINVAL;
 856
 857                         if (copy_to_user
 858                             (argp, &DriverVer, sizeof(DriverVer_type)))
 859                                 return -EFAULT;
 860                         return 0;
 861                 }
 862
 863         case CCISS_REVALIDVOLS:
 864                 return rebuild_lun_table(host, NULL);
 865
 866         case CCISS_GETLUNINFO:{
 867                         LogvolInfo_struct luninfo;
 868
 869                         luninfo.LunID = drv->LunID;
 870                         luninfo.num_opens = drv->usage_count;
 871                         luninfo.num_parts = 0;
 872                         if (copy_to_user(argp, &luninfo,
 873                                          sizeof(LogvolInfo_struct)))
 874                                 return -EFAULT;
 875                         return 0;
 876                 }
 877         case CCISS_DEREGDISK:
 878                 return rebuild_lun_table(host, disk);
 879
 880         case CCISS_REGNEWD:
 881                 return rebuild_lun_table(host, NULL);
 882
 883         case CCISS_PASSTHRU:
 884                 {
 885                         IOCTL_Command_struct iocommand;
 886                         CommandList_struct *c;
 887                         char *buff = NULL;
 888                         u64bit temp64;
 889                         unsigned long flags;
 890                         DECLARE_COMPLETION_ONSTACK(wait);
 891
 892                         if (!arg)
 893                                 return -EINVAL;
 894
 895                         if (!capable(CAP_SYS_RAWIO))
 896                                 return -EPERM;
 897
 898                         if (copy_from_user
 899                             (&iocommand, argp, sizeof(IOCTL_Command_struct)))
 900                                 return -EFAULT;
 901                         if ((iocommand.buf_size < 1) &&
 902                             (iocommand.Request.Type.Direction != XFER_NONE)) {
 903                                 return -EINVAL;
 904                         }
 905 #if 0                           /* 'buf_size' member is 16-bits, and always smaller than kmalloc limit */
 906                         /* Check kmalloc limits */
 907                         if (iocommand.buf_size > 128000)
 908                                 return -EINVAL;
 909 #endif
 910                         if (iocommand.buf_size > 0) {
 911                                 buff = kmalloc(iocommand.buf_size, GFP_KERNEL);
 912                                 if (buff == NULL)
 913                                         return -EFAULT;
 914                         }
 915                         if (iocommand.Request.Type.Direction == XFER_WRITE) {
 916                                 /* Copy the data into the buffer we created */
 917                                 if (copy_from_user
 918                                     (buff, iocommand.buf, iocommand.buf_size)) {
 919                                         kfree(buff);
 920                                         return -EFAULT;
 921                                 }
 922                         } else {
 923                                 memset(buff, 0, iocommand.buf_size);
 924                         }
 925                         if ((c = cmd_alloc(host, 0)) == NULL) {
 926                                 kfree(buff);
 927                                 return -ENOMEM;
 928                         }
 929                         // Fill in the command type
 930                         c->cmd_type = CMD_IOCTL_PEND;
 931                         // Fill in Command Header
 932                         c->Header.ReplyQueue = 0;       // unused in simple mode
 933                         if (iocommand.buf_size > 0)     // buffer to fill
 934                         {
 935                                 c->Header.SGList = 1;
 936                                 c->Header.SGTotal = 1;
 937                         } else  // no buffers to fill
 938                         {
 939                                 c->Header.SGList = 0;
 940                                 c->Header.SGTotal = 0;
 941                         }
 942                         c->Header.LUN = iocommand.LUN_info;
 943                         c->Header.Tag.lower = c->busaddr;       // use the kernel address the cmd block for tag
 944
 945                         // Fill in Request block
 946                         c->Request = iocommand.Request;
 947
 948                         // Fill in the scatter gather information
 949                         if (iocommand.buf_size > 0) {
 950                                 temp64.val = pci_map_single(host->pdev, buff,
 951                                         iocommand.buf_size,
 952                                         PCI_DMA_BIDIRECTIONAL);
 953                                 c->SG[0].Addr.lower = temp64.val32.lower;
 954                                 c->SG[0].Addr.upper = temp64.val32.upper;
 955                                 c->SG[0].Len = iocommand.buf_size;
 956                                 c->SG[0].Ext = 0;       // we are not chaining
 957                         }
 958                         c->waiting = &wait;
 959
 960                         /* Put the request on the tail of the request queue */
 961                         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
 962                         addQ(&host->reqQ, c);
 963                         host->Qdepth++;
 964                         start_io(host);
 965                         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
 966
 967                         wait_for_completion(&wait);
 968
 969                         /* unlock the buffers from DMA */
 970                         temp64.val32.lower = c->SG[0].Addr.lower;
 971                         temp64.val32.upper = c->SG[0].Addr.upper;
 972                         pci_unmap_single(host->pdev, (dma_addr_t) temp64.val,
 973                                          iocommand.buf_size,
 974                                          PCI_DMA_BIDIRECTIONAL);
 975
 976                         /* Copy the error information out */
 977                         iocommand.error_info = *(c->err_info);
 978                         if (copy_to_user
 979                             (argp, &iocommand, sizeof(IOCTL_Command_struct))) {
 980                                 kfree(buff);
 981                                 cmd_free(host, c, 0);
 982                                 return -EFAULT;
 983                         }
 984
 985                         if (iocommand.Request.Type.Direction == XFER_READ) {
 986                                 /* Copy the data out of the buffer we created */
 987                                 if (copy_to_user
 988                                     (iocommand.buf, buff, iocommand.buf_size)) {
 989                                         kfree(buff);
 990                                         cmd_free(host, c, 0);
 991                                         return -EFAULT;
 992                                 }
 993                         }
 994                         kfree(buff);
 995                         cmd_free(host, c, 0);
 996                         return 0;
 997                 }
 998         case CCISS_BIG_PASSTHRU:{
 999                         BIG_IOCTL_Command_struct *ioc;
1000                         CommandList_struct *c;
1001                         unsigned char **buff = NULL;
1002                         int *buff_size = NULL;
1003                         u64bit temp64;
1004                         unsigned long flags;
1005                         BYTE sg_used = 0;
1006                         int status = 0;
1007                         int i;
1008                         DECLARE_COMPLETION_ONSTACK(wait);
1009                         __u32 left;
1010                         __u32 sz;
1011                         BYTE __user *data_ptr;
1012
1013                         if (!arg)
1014                                 return -EINVAL;
1015                         if (!capable(CAP_SYS_RAWIO))
1016                                 return -EPERM;
1017                         ioc = (BIG_IOCTL_Command_struct *)
1018                             kmalloc(sizeof(*ioc), GFP_KERNEL);
1019                         if (!ioc) {
1020                                 status = -ENOMEM;
1021                                 goto cleanup1;
1022                         }
1023                         if (copy_from_user(ioc, argp, sizeof(*ioc))) {
1024                                 status = -EFAULT;
1025                                 goto cleanup1;
1026                         }
1027                         if ((ioc->buf_size < 1) &&
1028                             (ioc->Request.Type.Direction != XFER_NONE)) {
1029                                 status = -EINVAL;
1030                                 goto cleanup1;
1031                         }
1032                         /* Check kmalloc limits  using all SGs */
1033                         if (ioc->malloc_size > MAX_KMALLOC_SIZE) {
1034                                 status = -EINVAL;
1035                                 goto cleanup1;
1036                         }
1037                         if (ioc->buf_size > ioc->malloc_size * MAXSGENTRIES) {
1038                                 status = -EINVAL;
1039                                 goto cleanup1;
1040                         }
1041                         buff =
1042                             kzalloc(MAXSGENTRIES * sizeof(char *), GFP_KERNEL);
1043                         if (!buff) {
1044                                 status = -ENOMEM;
1045                                 goto cleanup1;
1046                         }
1047                         buff_size = kmalloc(MAXSGENTRIES * sizeof(int),
1048                                                    GFP_KERNEL);
1049                         if (!buff_size) {
1050                                 status = -ENOMEM;
1051                                 goto cleanup1;
1052                         }
1053                         left = ioc->buf_size;
1054                         data_ptr = ioc->buf;
1055                         while (left) {
1056                                 sz = (left >
1057                                       ioc->malloc_size) ? ioc->
1058                                     malloc_size : left;
1059                                 buff_size[sg_used] = sz;
1060                                 buff[sg_used] = kmalloc(sz, GFP_KERNEL);
1061                                 if (buff[sg_used] == NULL) {
1062                                         status = -ENOMEM;
1063                                         goto cleanup1;
1064                                 }
1065                                 if (ioc->Request.Type.Direction == XFER_WRITE) {
1066                                         if (copy_from_user
1067                                             (buff[sg_used], data_ptr, sz)) {
1068                                                 status = -ENOMEM;
1069                                                 goto cleanup1;
1070                                         }
1071                                 } else {
1072                                         memset(buff[sg_used], 0, sz);
1073                                 }
1074                                 left -= sz;
1075                                 data_ptr += sz;
1076                                 sg_used++;
1077                         }
1078                         if ((c = cmd_alloc(host, 0)) == NULL) {
1079                                 status = -ENOMEM;
1080                                 goto cleanup1;
1081                         }
1082                         c->cmd_type = CMD_IOCTL_PEND;
1083                         c->Header.ReplyQueue = 0;
1084
1085                         if (ioc->buf_size > 0) {
1086                                 c->Header.SGList = sg_used;
1087                                 c->Header.SGTotal = sg_used;
1088                         } else {
1089                                 c->Header.SGList = 0;
1090                                 c->Header.SGTotal = 0;
1091                         }
1092                         c->Header.LUN = ioc->LUN_info;
1093                         c->Header.Tag.lower = c->busaddr;
1094
1095                         c->Request = ioc->Request;
1096                         if (ioc->buf_size > 0) {
1097                                 int i;
1098                                 for (i = 0; i < sg_used; i++) {
1099                                         temp64.val =
1100                                             pci_map_single(host->pdev, buff[i],
1101                                                     buff_size[i],
1102                                                     PCI_DMA_BIDIRECTIONAL);
1103                                         c->SG[i].Addr.lower =
1104                                             temp64.val32.lower;
1105                                         c->SG[i].Addr.upper =
1106                                             temp64.val32.upper;
1107                                         c->SG[i].Len = buff_size[i];
1108                                         c->SG[i].Ext = 0;       /* we are not chaining */
1109                                 }
1110                         }
1111                         c->waiting = &wait;
1112                         /* Put the request on the tail of the request queue */
1113                         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
1114                         addQ(&host->reqQ, c);
1115                         host->Qdepth++;
1116                         start_io(host);
1117                         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
1118                         wait_for_completion(&wait);
1119                         /* unlock the buffers from DMA */
1120                         for (i = 0; i < sg_used; i++) {
1121                                 temp64.val32.lower = c->SG[i].Addr.lower;
1122                                 temp64.val32.upper = c->SG[i].Addr.upper;
1123                                 pci_unmap_single(host->pdev,
1124                                         (dma_addr_t) temp64.val, buff_size[i],
1125                                         PCI_DMA_BIDIRECTIONAL);
1126                         }
1127                         /* Copy the error information out */
1128                         ioc->error_info = *(c->err_info);
1129                         if (copy_to_user(argp, ioc, sizeof(*ioc))) {
1130                                 cmd_free(host, c, 0);
1131                                 status = -EFAULT;
1132                                 goto cleanup1;
1133                         }
1134                         if (ioc->Request.Type.Direction == XFER_READ) {
1135                                 /* Copy the data out of the buffer we created */
1136                                 BYTE __user *ptr = ioc->buf;
1137                                 for (i = 0; i < sg_used; i++) {
1138                                         if (copy_to_user
1139                                             (ptr, buff[i], buff_size[i])) {
1140                                                 cmd_free(host, c, 0);
1141                                                 status = -EFAULT;
1142                                                 goto cleanup1;
1143                                         }
1144                                         ptr += buff_size[i];
1145                                 }
1146                         }
1147                         cmd_free(host, c, 0);
1148                         status = 0;
1149                       cleanup1:
1150                         if (buff) {
1151                                 for (i = 0; i < sg_used; i++)
1152                                         kfree(buff[i]);
1153                                 kfree(buff);
1154                         }
1155                         kfree(buff_size);
1156                         kfree(ioc);
1157                         return status;
1158                 }
1159
1160         /* scsi_cmd_ioctl handles these, below, though some are not */
1161         /* very meaningful for cciss.  SG_IO is the main one people want. */
1162
1163         case SG_GET_VERSION_NUM:
1164         case SG_SET_TIMEOUT:
1165         case SG_GET_TIMEOUT:
1166         case SG_GET_RESERVED_SIZE:
1167         case SG_SET_RESERVED_SIZE:
1168         case SG_EMULATED_HOST:
1169         case SG_IO:
1170         case SCSI_IOCTL_SEND_COMMAND:
1171                 return scsi_cmd_ioctl(filep, disk, cmd, argp);
1172
1173         /* scsi_cmd_ioctl would normally handle these, below, but */
1174         /* they aren't a good fit for cciss, as CD-ROMs are */
1175         /* not supported, and we don't have any bus/target/lun */
1176         /* which we present to the kernel. */
1177
1178         case CDROM_SEND_PACKET:
1179         case CDROMCLOSETRAY:
1180         case CDROMEJECT:
1181         case SCSI_IOCTL_GET_IDLUN:
1182         case SCSI_IOCTL_GET_BUS_NUMBER:
1183         default:
1184                 return -ENOTTY;
1185         }
1186 }
1187
1188 static inline void complete_buffers(struct bio *bio, int status)
1189 {
1190         while (bio) {
1191                 struct bio *xbh = bio->bi_next;
1192                 int nr_sectors = bio_sectors(bio);
1193
1194                 bio->bi_next = NULL;
1195                 bio_endio(bio, nr_sectors << 9, status ? 0 : -EIO);
1196                 bio = xbh;
1197         }
1198 }
1199
1200 static void cciss_check_queues(ctlr_info_t *h)
1201 {
1202         int start_queue = h->next_to_run;
1203         int i;
1204
1205         /* check to see if we have maxed out the number of commands that can
1206          * be placed on the queue.  If so then exit.  We do this check here
1207          * in case the interrupt we serviced was from an ioctl and did not
1208          * free any new commands.
1209          */
1210         if ((find_first_zero_bit(h->cmd_pool_bits, h->nr_cmds)) == h->nr_cmds)
1211                 return;
1212
1213         /* We have room on the queue for more commands.  Now we need to queue
1214          * them up.  We will also keep track of the next queue to run so
1215          * that every queue gets a chance to be started first.
1216          */
1217         for (i = 0; i < h->highest_lun + 1; i++) {
1218                 int curr_queue = (start_queue + i) % (h->highest_lun + 1);
1219                 /* make sure the disk has been added and the drive is real
1220                  * because this can be called from the middle of init_one.
1221                  */
1222                 if (!(h->drv[curr_queue].queue) || !(h->drv[curr_queue].heads))
1223                         continue;
1224                 blk_start_queue(h->gendisk[curr_queue]->queue);
1225
1226                 /* check to see if we have maxed out the number of commands
1227                  * that can be placed on the queue.
1228                  */
1229                 if ((find_first_zero_bit(h->cmd_pool_bits, h->nr_cmds)) == h->nr_cmds) {
1230                         if (curr_queue == start_queue) {
1231                                 h->next_to_run =
1232                                     (start_queue + 1) % (h->highest_lun + 1);
1233                                 break;
1234                         } else {
1235                                 h->next_to_run = curr_queue;
1236                                 break;
1237                         }
1238                 } else {
1239                         curr_queue = (curr_queue + 1) % (h->highest_lun + 1);
1240                 }
1241         }
1242 }
1243
1244 static void cciss_softirq_done(struct request *rq)
1245 {
1246         CommandList_struct *cmd = rq->completion_data;
1247         ctlr_info_t *h = hba[cmd->ctlr];
1248         unsigned long flags;
1249         u64bit temp64;
1250         int i, ddir;
1251
1252         if (cmd->Request.Type.Direction == XFER_READ)
1253                 ddir = PCI_DMA_FROMDEVICE;
1254         else
1255                 ddir = PCI_DMA_TODEVICE;
1256
1257         /* command did not need to be retried */
1258         /* unmap the DMA mapping for all the scatter gather elements */
1259         for (i = 0; i < cmd->Header.SGList; i++) {
1260                 temp64.val32.lower = cmd->SG[i].Addr.lower;
1261                 temp64.val32.upper = cmd->SG[i].Addr.upper;
1262                 pci_unmap_page(h->pdev, temp64.val, cmd->SG[i].Len, ddir);
1263         }
1264
1265         complete_buffers(rq->bio, (rq->errors == 0));
1266
1267         if (blk_fs_request(rq)) {
1268                 const int rw = rq_data_dir(rq);
1269
1270                 disk_stat_add(rq->rq_disk, sectors[rw], rq->nr_sectors);
1271         }
1272
1273 #ifdef CCISS_DEBUG
1274         printk("Done with %p\n", rq);
1275 #endif                          /* CCISS_DEBUG */
1276
1277         add_disk_randomness(rq->rq_disk);
1278         spin_lock_irqsave(&h->lock, flags);
1279         end_that_request_last(rq, (rq->errors == 0));
1280         cmd_free(h, cmd, 1);
1281         cciss_check_queues(h);
1282         spin_unlock_irqrestore(&h->lock, flags);
1283 }
1284
1285 /* This function will check the usage_count of the drive to be updated/added.
1286  * If the usage_count is zero then the drive information will be updated and
1287  * the disk will be re-registered with the kernel.  If not then it will be
1288  * left alone for the next reboot.  The exception to this is disk 0 which
1289  * will always be left registered with the kernel since it is also the
1290  * controller node.  Any changes to disk 0 will show up on the next
1291  * reboot.
1292  */
1293 static void cciss_update_drive_info(int ctlr, int drv_index)
1294 {
1295         ctlr_info_t *h = hba[ctlr];
1296         struct gendisk *disk;
1297         InquiryData_struct *inq_buff = NULL;
1298         unsigned int block_size;
1299         sector_t total_size;
1300         unsigned long flags = 0;
1301         int ret = 0;
1302
1303         /* if the disk already exists then deregister it before proceeding */
1304         if (h->drv[drv_index].raid_level != -1) {
1305                 spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
1306                 h->drv[drv_index].busy_configuring = 1;
1307                 spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
1308                 ret = deregister_disk(h->gendisk[drv_index],
1309                                       &h->drv[drv_index], 0);
1310                 h->drv[drv_index].busy_configuring = 0;
1311         }
1312
1313         /* If the disk is in use return */
1314         if (ret)
1315                 return;
1316
1317         /* Get information about the disk and modify the driver structure */
1318         inq_buff = kmalloc(sizeof(InquiryData_struct), GFP_KERNEL);
1319         if (inq_buff == NULL)
1320                 goto mem_msg;
1321
1322         /* testing to see if 16-byte CDBs are already being used */
1323         if (h->cciss_read == CCISS_READ_16) {
1324                 cciss_read_capacity_16(h->ctlr, drv_index, 1,
1325                         &total_size, &block_size);
1326                 goto geo_inq;
1327         }
1328
1329         cciss_read_capacity(ctlr, drv_index, 1,
1330                             &total_size, &block_size);
1331
1332         /* if read_capacity returns all F's this volume is >2TB in size */
1333         /* so we switch to 16-byte CDB's for all read/write ops */
1334         if (total_size == 0xFFFFFFFFULL) {
1335                 cciss_read_capacity_16(ctlr, drv_index, 1,
1336                 &total_size, &block_size);
1337                 h->cciss_read = CCISS_READ_16;
1338                 h->cciss_write = CCISS_WRITE_16;
1339         } else {
1340                 h->cciss_read = CCISS_READ_10;
1341                 h->cciss_write = CCISS_WRITE_10;
1342         }
1343 geo_inq:
1344         cciss_geometry_inquiry(ctlr, drv_index, 1, total_size, block_size,
1345                                inq_buff, &h->drv[drv_index]);
1346
1347         ++h->num_luns;
1348         disk = h->gendisk[drv_index];
1349         set_capacity(disk, h->drv[drv_index].nr_blocks);
1350
1351         /* if it's the controller it's already added */
1352         if (drv_index) {
1353                 disk->queue = blk_init_queue(do_cciss_request, &h->lock);
1354                 sprintf(disk->disk_name, "cciss/c%dd%d", ctlr, drv_index);
1355                 disk->major = h->major;
1356                 disk->first_minor = drv_index << NWD_SHIFT;
1357                 disk->fops = &cciss_fops;
1358                 disk->private_data = &h->drv[drv_index];
1359
1360                 /* Set up queue information */
1361                 disk->queue->backing_dev_info.ra_pages = READ_AHEAD;
1362                 blk_queue_bounce_limit(disk->queue, hba[ctlr]->pdev->dma_mask);
1363
1364                 /* This is a hardware imposed limit. */
1365                 blk_queue_max_hw_segments(disk->queue, MAXSGENTRIES);
1366
1367                 /* This is a limit in the driver and could be eliminated. */
1368                 blk_queue_max_phys_segments(disk->queue, MAXSGENTRIES);
1369
1370                 blk_queue_max_sectors(disk->queue, h->cciss_max_sectors);
1371
1372                 blk_queue_softirq_done(disk->queue, cciss_softirq_done);
1373
1374                 disk->queue->queuedata = hba[ctlr];
1375
1376                 blk_queue_hardsect_size(disk->queue,
1377                                         hba[ctlr]->drv[drv_index].block_size);
1378
1379                 h->drv[drv_index].queue = disk->queue;
1380                 add_disk(disk);
1381         }
1382
1383       freeret:
1384         kfree(inq_buff);
1385         return;
1386       mem_msg:
1387         printk(KERN_ERR "cciss: out of memory\n");
1388         goto freeret;
1389 }
1390
1391 /* This function will find the first index of the controllers drive array
1392  * that has a -1 for the raid_level and will return that index.  This is
1393  * where new drives will be added.  If the index to be returned is greater
1394  * than the highest_lun index for the controller then highest_lun is set
1395  * to this new index.  If there are no available indexes then -1 is returned.
1396  */
1397 static int cciss_find_free_drive_index(int ctlr)
1398 {
1399         int i;
1400
1401         for (i = 0; i < CISS_MAX_LUN; i++) {
1402                 if (hba[ctlr]->drv[i].raid_level == -1) {
1403                         if (i > hba[ctlr]->highest_lun)
1404                                 hba[ctlr]->highest_lun = i;
1405                         return i;
1406                 }
1407         }
1408         return -1;
1409 }
1410
1411 /* This function will add and remove logical drives from the Logical
1412  * drive array of the controller and maintain persistency of ordering
1413  * so that mount points are preserved until the next reboot.  This allows
1414  * for the removal of logical drives in the middle of the drive array
1415  * without a re-ordering of those drives.
1416  * INPUT
1417  * h            = The controller to perform the operations on
1418  * del_disk     = The disk to remove if specified.  If the value given
1419  *                is NULL then no disk is removed.
1420  */
1421 static int rebuild_lun_table(ctlr_info_t *h, struct gendisk *del_disk)
1422 {
1423         int ctlr = h->ctlr;
1424         int num_luns;
1425         ReportLunData_struct *ld_buff = NULL;
1426         drive_info_struct *drv = NULL;
1427         int return_code;
1428         int listlength = 0;
1429         int i;
1430         int drv_found;
1431         int drv_index = 0;
1432         __u32 lunid = 0;
1433         unsigned long flags;
1434
1435         /* Set busy_configuring flag for this operation */
1436         spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
1437         if (h->busy_configuring) {
1438                 spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
1439                 return -EBUSY;
1440         }
1441         h->busy_configuring = 1;
1442
1443         /* if del_disk is NULL then we are being called to add a new disk
1444          * and update the logical drive table.  If it is not NULL then
1445          * we will check if the disk is in use or not.
1446          */
1447         if (del_disk != NULL) {
1448                 drv = get_drv(del_disk);
1449                 drv->busy_configuring = 1;
1450                 spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
1451                 return_code = deregister_disk(del_disk, drv, 1);
1452                 drv->busy_configuring = 0;
1453                 h->busy_configuring = 0;
1454                 return return_code;
1455         } else {
1456                 spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
1457                 if (!capable(CAP_SYS_RAWIO))
1458                         return -EPERM;
1459
1460                 ld_buff = kzalloc(sizeof(ReportLunData_struct), GFP_KERNEL);
1461                 if (ld_buff == NULL)
1462                         goto mem_msg;
1463
1464                 return_code = sendcmd_withirq(CISS_REPORT_LOG, ctlr, ld_buff,
1465                                               sizeof(ReportLunData_struct), 0,
1466                                               0, 0, TYPE_CMD);
1467
1468                 if (return_code == IO_OK) {
1469                         listlength =
1470                                 be32_to_cpu(*(__be32 *) ld_buff->LUNListLength);
1471                 } else {        /* reading number of logical volumes failed */
1472                         printk(KERN_WARNING "cciss: report logical volume"
1473                                " command failed\n");
1474                         listlength = 0;
1475                         goto freeret;
1476                 }
1477
1478                 num_luns = listlength / 8;      /* 8 bytes per entry */
1479                 if (num_luns > CISS_MAX_LUN) {
1480                         num_luns = CISS_MAX_LUN;
1481                         printk(KERN_WARNING "cciss: more luns configured"
1482                                " on controller than can be handled by"
1483                                " this driver.\n");
1484                 }
1485
1486                 /* Compare controller drive array to drivers drive array.
1487                  * Check for updates in the drive information and any new drives
1488                  * on the controller.
1489                  */
1490                 for (i = 0; i < num_luns; i++) {
1491                         int j;
1492
1493                         drv_found = 0;
1494
1495                         lunid = (0xff &
1496                                  (unsigned int)(ld_buff->LUN[i][3])) << 24;
1497                         lunid |= (0xff &
1498                                   (unsigned int)(ld_buff->LUN[i][2])) << 16;
1499                         lunid |= (0xff &
1500                                   (unsigned int)(ld_buff->LUN[i][1])) << 8;
1501                         lunid |= 0xff & (unsigned int)(ld_buff->LUN[i][0]);
1502
1503                         /* Find if the LUN is already in the drive array
1504                          * of the controller.  If so then update its info
1505                          * if not is use.  If it does not exist then find
1506                          * the first free index and add it.
1507                          */
1508                         for (j = 0; j <= h->highest_lun; j++) {
1509                                 if (h->drv[j].LunID == lunid) {
1510                                         drv_index = j;
1511                                         drv_found = 1;
1512                                 }
1513                         }
1514
1515                         /* check if the drive was found already in the array */
1516                         if (!drv_found) {
1517                                 drv_index = cciss_find_free_drive_index(ctlr);
1518                                 if (drv_index == -1)
1519                                         goto freeret;
1520
1521                                 /*Check if the gendisk needs to be allocated */
1522                                 if (!h->gendisk[drv_index]){
1523                                         h->gendisk[drv_index] = alloc_disk(1 << NWD_SHIFT);
1524                                         if (!h->gendisk[drv_index]){
1525                                                 printk(KERN_ERR "cciss: could not allocate new disk %d\n", drv_index);
1526                                                 goto mem_msg;
1527                                         }
1528                                 }
1529                         }
1530                         h->drv[drv_index].LunID = lunid;
1531                         cciss_update_drive_info(ctlr, drv_index);
1532                 }               /* end for */
1533         }                       /* end else */
1534
1535       freeret:
1536         kfree(ld_buff);
1537         h->busy_configuring = 0;
1538         /* We return -1 here to tell the ACU that we have registered/updated
1539          * all of the drives that we can and to keep it from calling us
1540          * additional times.
1541          */
1542         return -1;
1543       mem_msg:
1544         printk(KERN_ERR "cciss: out of memory\n");
1545         goto freeret;
1546 }
1547
1548 /* This function will deregister the disk and it's queue from the
1549  * kernel.  It must be called with the controller lock held and the
1550  * drv structures busy_configuring flag set.  It's parameters are:
1551  *
1552  * disk = This is the disk to be deregistered
1553  * drv  = This is the drive_info_struct associated with the disk to be
1554  *        deregistered.  It contains information about the disk used
1555  *        by the driver.
1556  * clear_all = This flag determines whether or not the disk information
1557  *             is going to be completely cleared out and the highest_lun
1558  *             reset.  Sometimes we want to clear out information about
1559  *             the disk in preparation for re-adding it.  In this case
1560  *             the highest_lun should be left unchanged and the LunID
1561  *             should not be cleared.
1562 */
1563 static int deregister_disk(struct gendisk *disk, drive_info_struct *drv,
1564                            int clear_all)
1565 {
1566         int i;
1567         ctlr_info_t *h = get_host(disk);
1568
1569         if (!capable(CAP_SYS_RAWIO))
1570                 return -EPERM;
1571
1572         /* make sure logical volume is NOT is use */
1573         if (clear_all || (h->gendisk[0] == disk)) {
1574                 if (drv->usage_count > 1)
1575                         return -EBUSY;
1576         } else if (drv->usage_count > 0)
1577                 return -EBUSY;
1578
1579         /* invalidate the devices and deregister the disk.  If it is disk
1580          * zero do not deregister it but just zero out it's values.  This
1581          * allows us to delete disk zero but keep the controller registered.
1582          */
1583         if (h->gendisk[0] != disk) {
1584                 if (disk) {
1585                         request_queue_t *q = disk->queue;
1586                         if (disk->flags & GENHD_FL_UP)
1587                                 del_gendisk(disk);
1588                         if (q) {
1589                                 blk_cleanup_queue(q);
1590                                 /* Set drv->queue to NULL so that we do not try
1591                                  * to call blk_start_queue on this queue in the
1592                                  * interrupt handler
1593                                  */
1594                                 drv->queue = NULL;
1595                         }
1596                         /* If clear_all is set then we are deleting the logical
1597                          * drive, not just refreshing its info.  For drives
1598                          * other than disk 0 we will call put_disk.  We do not
1599                          * do this for disk 0 as we need it to be able to
1600                          * configure the controller.
1601                         */
1602                         if (clear_all){
1603                                 /* This isn't pretty, but we need to find the
1604                                  * disk in our array and NULL our the pointer.
1605                                  * This is so that we will call alloc_disk if
1606                                  * this index is used again later.
1607                                 */
1608                                 for (i=0; i < CISS_MAX_LUN; i++){
1609                                         if(h->gendisk[i] == disk){
1610                                                 h->gendisk[i] = NULL;
1611                                                 break;
1612                                         }
1613                                 }
1614                                 put_disk(disk);
1615                         }
1616                 }
1617         } else {
1618                 set_capacity(disk, 0);
1619         }
1620
1621         --h->num_luns;
1622         /* zero out the disk size info */
1623         drv->nr_blocks = 0;
1624         drv->block_size = 0;
1625         drv->heads = 0;
1626         drv->sectors = 0;
1627         drv->cylinders = 0;
1628         drv->raid_level = -1;   /* This can be used as a flag variable to
1629                                  * indicate that this element of the drive
1630                                  * array is free.
1631                                  */
1632
1633         if (clear_all) {
1634                 /* check to see if it was the last disk */
1635                 if (drv == h->drv + h->highest_lun) {
1636                         /* if so, find the new hightest lun */
1637                         int i, newhighest = -1;
1638                         for (i = 0; i < h->highest_lun; i++) {
1639                                 /* if the disk has size > 0, it is available */
1640                                 if (h->drv[i].heads)
1641                                         newhighest = i;
1642                         }
1643                         h->highest_lun = newhighest;
1644                 }
1645
1646                 drv->LunID = 0;
1647         }
1648         return 0;
1649 }
1650
1651 static int fill_cmd(CommandList_struct *c, __u8 cmd, int ctlr, void *buff, size_t size, unsigned int use_unit_num,      /* 0: address the controller,
1652                                                                                                                            1: address logical volume log_unit,
1653                                                                                                                            2: periph device address is scsi3addr */
1654                     unsigned int log_unit, __u8 page_code,
1655                     unsigned char *scsi3addr, int cmd_type)
1656 {
1657         ctlr_info_t *h = hba[ctlr];
1658         u64bit buff_dma_handle;
1659         int status = IO_OK;
1660
1661         c->cmd_type = CMD_IOCTL_PEND;
1662         c->Header.ReplyQueue = 0;
1663         if (buff != NULL) {
1664                 c->Header.SGList = 1;
1665                 c->Header.SGTotal = 1;
1666         } else {
1667                 c->Header.SGList = 0;
1668                 c->Header.SGTotal = 0;
1669         }
1670         c->Header.Tag.lower = c->busaddr;
1671
1672         c->Request.Type.Type = cmd_type;
1673         if (cmd_type == TYPE_CMD) {
1674                 switch (cmd) {
1675                 case CISS_INQUIRY:
1676                         /* If the logical unit number is 0 then, this is going
1677                            to controller so It's a physical command
1678                            mode = 0 target = 0.  So we have nothing to write.
1679                            otherwise, if use_unit_num == 1,
1680                            mode = 1(volume set addressing) target = LUNID
1681                            otherwise, if use_unit_num == 2,
1682                            mode = 0(periph dev addr) target = scsi3addr */
1683                         if (use_unit_num == 1) {
1684                                 c->Header.LUN.LogDev.VolId =
1685                                     h->drv[log_unit].LunID;
1686                                 c->Header.LUN.LogDev.Mode = 1;
1687                         } else if (use_unit_num == 2) {
1688                                 memcpy(c->Header.LUN.LunAddrBytes, scsi3addr,
1689                                        8);
1690                                 c->Header.LUN.LogDev.Mode = 0;
1691                         }
1692                         /* are we trying to read a vital product page */
1693                         if (page_code != 0) {
1694                                 c->Request.CDB[1] = 0x01;
1695                                 c->Request.CDB[2] = page_code;
1696                         }
1697                         c->Request.CDBLen = 6;
1698                         c->Request.Type.Attribute = ATTR_SIMPLE;
1699                         c->Request.Type.Direction = XFER_READ;
1700                         c->Request.Timeout = 0;
1701                         c->Request.CDB[0] = CISS_INQUIRY;
1702                         c->Request.CDB[4] = size & 0xFF;
1703                         break;
1704                 case CISS_REPORT_LOG:
1705                 case CISS_REPORT_PHYS:
1706                         /* Talking to controller so It's a physical command
1707                            mode = 00 target = 0.  Nothing to write.
1708                          */
1709                         c->Request.CDBLen = 12;
1710                         c->Request.Type.Attribute = ATTR_SIMPLE;
1711                         c->Request.Type.Direction = XFER_READ;
1712                         c->Request.Timeout = 0;
1713                         c->Request.CDB[0] = cmd;
1714                         c->Request.CDB[6] = (size >> 24) & 0xFF;        //MSB
1715                         c->Request.CDB[7] = (size >> 16) & 0xFF;
1716                         c->Request.CDB[8] = (size >> 8) & 0xFF;
1717                         c->Request.CDB[9] = size & 0xFF;
1718                         break;
1719
1720                 case CCISS_READ_CAPACITY:
1721                         c->Header.LUN.LogDev.VolId = h->drv[log_unit].LunID;
1722                         c->Header.LUN.LogDev.Mode = 1;
1723                         c->Request.CDBLen = 10;
1724                         c->Request.Type.Attribute = ATTR_SIMPLE;
1725                         c->Request.Type.Direction = XFER_READ;
1726                         c->Request.Timeout = 0;
1727                         c->Request.CDB[0] = cmd;
1728                         break;
1729                 case CCISS_READ_CAPACITY_16:
1730                         c->Header.LUN.LogDev.VolId = h->drv[log_unit].LunID;
1731                         c->Header.LUN.LogDev.Mode = 1;
1732                         c->Request.CDBLen = 16;
1733                         c->Request.Type.Attribute = ATTR_SIMPLE;
1734                         c->Request.Type.Direction = XFER_READ;
1735                         c->Request.Timeout = 0;
1736                         c->Request.CDB[0] = cmd;
1737                         c->Request.CDB[1] = 0x10;
1738                         c->Request.CDB[10] = (size >> 24) & 0xFF;
1739                         c->Request.CDB[11] = (size >> 16) & 0xFF;
1740                         c->Request.CDB[12] = (size >> 8) & 0xFF;
1741                         c->Request.CDB[13] = size & 0xFF;
1742                         c->Request.Timeout = 0;
1743                         c->Request.CDB[0] = cmd;
1744                         break;
1745                 case CCISS_CACHE_FLUSH:
1746                         c->Request.CDBLen = 12;
1747                         c->Request.Type.Attribute = ATTR_SIMPLE;
1748                         c->Request.Type.Direction = XFER_WRITE;
1749                         c->Request.Timeout = 0;
1750                         c->Request.CDB[0] = BMIC_WRITE;
1751                         c->Request.CDB[6] = BMIC_CACHE_FLUSH;
1752                         break;
1753                 default:
1754                         printk(KERN_WARNING
1755                                "cciss%d:  Unknown Command 0x%c\n", ctlr, cmd);
1756                         return IO_ERROR;
1757                 }
1758         } else if (cmd_type == TYPE_MSG) {
1759                 switch (cmd) {
1760                 case 0: /* ABORT message */
1761                         c->Request.CDBLen = 12;
1762                         c->Request.Type.Attribute = ATTR_SIMPLE;
1763                         c->Request.Type.Direction = XFER_WRITE;
1764                         c->Request.Timeout = 0;
1765                         c->Request.CDB[0] = cmd;        /* abort */
1766                         c->Request.CDB[1] = 0;  /* abort a command */
1767                         /* buff contains the tag of the command to abort */
1768                         memcpy(&c->Request.CDB[4], buff, 8);
1769                         break;
1770                 case 1: /* RESET message */
1771                         c->Request.CDBLen = 12;
1772                         c->Request.Type.Attribute = ATTR_SIMPLE;
1773                         c->Request.Type.Direction = XFER_WRITE;
1774                         c->Request.Timeout = 0;
1775                         memset(&c->Request.CDB[0], 0, sizeof(c->Request.CDB));
1776                         c->Request.CDB[0] = cmd;        /* reset */
1777                         c->Request.CDB[1] = 0x04;       /* reset a LUN */
1778                         break;
1779                 case 3: /* No-Op message */
1780                         c->Request.CDBLen = 1;
1781                         c->Request.Type.Attribute = ATTR_SIMPLE;
1782                         c->Request.Type.Direction = XFER_WRITE;
1783                         c->Request.Timeout = 0;
1784                         c->Request.CDB[0] = cmd;
1785                         break;
1786                 default:
1787                         printk(KERN_WARNING
1788                                "cciss%d: unknown message type %d\n", ctlr, cmd);
1789                         return IO_ERROR;
1790                 }
1791         } else {
1792                 printk(KERN_WARNING
1793                        "cciss%d: unknown command type %d\n", ctlr, cmd_type);
1794                 return IO_ERROR;
1795         }
1796         /* Fill in the scatter gather information */
1797         if (size > 0) {
1798                 buff_dma_handle.val = (__u64) pci_map_single(h->pdev,
1799                                                              buff, size,
1800                                                              PCI_DMA_BIDIRECTIONAL);
1801                 c->SG[0].Addr.lower = buff_dma_handle.val32.lower;
1802                 c->SG[0].Addr.upper = buff_dma_handle.val32.upper;
1803                 c->SG[0].Len = size;
1804                 c->SG[0].Ext = 0;       /* we are not chaining */
1805         }
1806         return status;
1807 }
1808
1809 static int sendcmd_withirq(__u8 cmd,
1810                            int ctlr,
1811                            void *buff,
1812                            size_t size,
1813                            unsigned int use_unit_num,
1814                            unsigned int log_unit, __u8 page_code, int cmd_type)
1815 {
1816         ctlr_info_t *h = hba[ctlr];
1817         CommandList_struct *c;
1818         u64bit buff_dma_handle;
1819         unsigned long flags;
1820         int return_status;
1821         DECLARE_COMPLETION_ONSTACK(wait);
1822
1823         if ((c = cmd_alloc(h, 0)) == NULL)
1824                 return -ENOMEM;
1825         return_status = fill_cmd(c, cmd, ctlr, buff, size, use_unit_num,
1826                                  log_unit, page_code, NULL, cmd_type);
1827         if (return_status != IO_OK) {
1828                 cmd_free(h, c, 0);
1829                 return return_status;
1830         }
1831       resend_cmd2:
1832         c->waiting = &wait;
1833
1834         /* Put the request on the tail of the queue and send it */
1835         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
1836         addQ(&h->reqQ, c);
1837         h->Qdepth++;
1838         start_io(h);
1839         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
1840
1841         wait_for_completion(&wait);
1842
1843         if (c->err_info->CommandStatus != 0) {  /* an error has occurred */
1844                 switch (c->err_info->CommandStatus) {
1845                 case CMD_TARGET_STATUS:
1846                         printk(KERN_WARNING "cciss: cmd %p has "
1847                                " completed with errors\n", c);
1848                         if (c->err_info->ScsiStatus) {
1849                                 printk(KERN_WARNING "cciss: cmd %p "
1850                                        "has SCSI Status = %x\n",
1851                                        c, c->err_info->ScsiStatus);
1852                         }
1853
1854                         break;
1855                 case CMD_DATA_UNDERRUN:
1856                 case CMD_DATA_OVERRUN:
1857                         /* expected for inquire and report lun commands */
1858                         break;
1859                 case CMD_INVALID:
1860                         printk(KERN_WARNING "cciss: Cmd %p is "
1861                                "reported invalid\n", c);
1862                         return_status = IO_ERROR;
1863                         break;
1864                 case CMD_PROTOCOL_ERR:
1865                         printk(KERN_WARNING "cciss: cmd %p has "
1866                                "protocol error \n", c);
1867                         return_status = IO_ERROR;
1868                         break;
1869                 case CMD_HARDWARE_ERR:
1870                         printk(KERN_WARNING "cciss: cmd %p had "
1871                                " hardware error\n", c);
1872                         return_status = IO_ERROR;
1873                         break;
1874                 case CMD_CONNECTION_LOST:
1875                         printk(KERN_WARNING "cciss: cmd %p had "
1876                                "connection lost\n", c);
1877                         return_status = IO_ERROR;
1878                         break;
1879                 case CMD_ABORTED:
1880                         printk(KERN_WARNING "cciss: cmd %p was "
1881                                "aborted\n", c);
1882                         return_status = IO_ERROR;
1883                         break;
1884                 case CMD_ABORT_FAILED:
1885                         printk(KERN_WARNING "cciss: cmd %p reports "
1886                                "abort failed\n", c);
1887                         return_status = IO_ERROR;
1888                         break;
1889                 case CMD_UNSOLICITED_ABORT:
1890                         printk(KERN_WARNING
1891                                "cciss%d: unsolicited abort %p\n", ctlr, c);
1892                         if (c->retry_count < MAX_CMD_RETRIES) {
1893                                 printk(KERN_WARNING
1894                                        "cciss%d: retrying %p\n", ctlr, c);
1895                                 c->retry_count++;
1896                                 /* erase the old error information */
1897                                 memset(c->err_info, 0,
1898                                        sizeof(ErrorInfo_struct));
1899                                 return_status = IO_OK;
1900                                 INIT_COMPLETION(wait);
1901                                 goto resend_cmd2;
1902                         }
1903                         return_status = IO_ERROR;
1904                         break;
1905                 default:
1906                         printk(KERN_WARNING "cciss: cmd %p returned "
1907                                "unknown status %x\n", c,
1908                                c->err_info->CommandStatus);
1909                         return_status = IO_ERROR;
1910                 }
1911         }
1912         /* unlock the buffers from DMA */
1913         buff_dma_handle.val32.lower = c->SG[0].Addr.lower;
1914         buff_dma_handle.val32.upper = c->SG[0].Addr.upper;
1915         pci_unmap_single(h->pdev, (dma_addr_t) buff_dma_handle.val,
1916                          c->SG[0].Len, PCI_DMA_BIDIRECTIONAL);
1917         cmd_free(h, c, 0);
1918         return return_status;
1919 }
1920
1921 static void cciss_geometry_inquiry(int ctlr, int logvol,
1922                                    int withirq, sector_t total_size,
1923                                    unsigned int block_size,
1924                                    InquiryData_struct *inq_buff,
1925                                    drive_info_struct *drv)
1926 {
1927         int return_code;
1928         unsigned long t;
1929
1930         memset(inq_buff, 0, sizeof(InquiryData_struct));
1931         if (withirq)
1932                 return_code = sendcmd_withirq(CISS_INQUIRY, ctlr,
1933                                               inq_buff, sizeof(*inq_buff), 1,
1934                                               logvol, 0xC1, TYPE_CMD);
1935         else
1936                 return_code = sendcmd(CISS_INQUIRY, ctlr, inq_buff,
1937                                       sizeof(*inq_buff), 1, logvol, 0xC1, NULL,
1938                                       TYPE_CMD);
1939         if (return_code == IO_OK) {
1940                 if (inq_buff->data_byte[8] == 0xFF) {
1941                         printk(KERN_WARNING
1942                                "cciss: reading geometry failed, volume "
1943                                "does not support reading geometry\n");
1944                         drv->heads = 255;
1945                         drv->sectors = 32;      // Sectors per track
1946                         drv->cylinders = total_size + 1;
1947                         drv->raid_level = RAID_UNKNOWN;
1948                 } else {
1949                         drv->heads = inq_buff->data_byte[6];
1950                         drv->sectors = inq_buff->data_byte[7];
1951                         drv->cylinders = (inq_buff->data_byte[4] & 0xff) << 8;
1952                         drv->cylinders += inq_buff->data_byte[5];
1953                         drv->raid_level = inq_buff->data_byte[8];
1954                 }
1955                 drv->block_size = block_size;
1956                 drv->nr_blocks = total_size + 1;
1957                 t = drv->heads * drv->sectors;
1958                 if (t > 1) {
1959                         sector_t real_size = total_size + 1;
1960                         unsigned long rem = sector_div(real_size, t);
1961                         if (rem)
1962                                 real_size++;
1963                         drv->cylinders = real_size;
1964                 }
1965         } else {                /* Get geometry failed */
1966                 printk(KERN_WARNING "cciss: reading geometry failed\n");
1967         }
1968         printk(KERN_INFO "      heads=%d, sectors=%d, cylinders=%d\n\n",
1969                drv->heads, drv->sectors, drv->cylinders);
1970 }
1971
1972 static void
1973 cciss_read_capacity(int ctlr, int logvol, int withirq, sector_t *total_size,
1974                     unsigned int *block_size)
1975 {
1976         ReadCapdata_struct *buf;
1977         int return_code;
1978         buf = kmalloc(sizeof(ReadCapdata_struct), GFP_KERNEL);
1979         if (buf == NULL) {
1980                 printk(KERN_WARNING "cciss: out of memory\n");
1981                 return;
1982         }
1983         memset(buf, 0, sizeof(ReadCapdata_struct));
1984         if (withirq)
1985                 return_code = sendcmd_withirq(CCISS_READ_CAPACITY,
1986                                 ctlr, buf, sizeof(ReadCapdata_struct),
1987                                         1, logvol, 0, TYPE_CMD);
1988         else
1989                 return_code = sendcmd(CCISS_READ_CAPACITY,
1990                                 ctlr, buf, sizeof(ReadCapdata_struct),
1991                                         1, logvol, 0, NULL, TYPE_CMD);
1992         if (return_code == IO_OK) {
1993                 *total_size = be32_to_cpu(*(__be32 *) buf->total_size);
1994                 *block_size = be32_to_cpu(*(__be32 *) buf->block_size);
1995         } else {                /* read capacity command failed */
1996                 printk(KERN_WARNING "cciss: read capacity failed\n");
1997                 *total_size = 0;
1998                 *block_size = BLOCK_SIZE;
1999         }
2000         if (*total_size != 0)
2001                 printk(KERN_INFO "      blocks= %llu block_size= %d\n",
2002                 (unsigned long long)*total_size+1, *block_size);
2003         kfree(buf);
2004         return;
2005 }
2006
2007 static void
2008 cciss_read_capacity_16(int ctlr, int logvol, int withirq, sector_t *total_size,                                 unsigned int *block_size)
2009 {
2010         ReadCapdata_struct_16 *buf;
2011         int return_code;
2012         buf = kmalloc(sizeof(ReadCapdata_struct_16), GFP_KERNEL);
2013         if (buf == NULL) {
2014                 printk(KERN_WARNING "cciss: out of memory\n");
2015                 return;
2016         }
2017         memset(buf, 0, sizeof(ReadCapdata_struct_16));
2018         if (withirq) {
2019                 return_code = sendcmd_withirq(CCISS_READ_CAPACITY_16,
2020                         ctlr, buf, sizeof(ReadCapdata_struct_16),
2021                                 1, logvol, 0, TYPE_CMD);
2022         }
2023         else {
2024                 return_code = sendcmd(CCISS_READ_CAPACITY_16,
2025                         ctlr, buf, sizeof(ReadCapdata_struct_16),
2026                                 1, logvol, 0, NULL, TYPE_CMD);
2027         }
2028         if (return_code == IO_OK) {
2029                 *total_size = be64_to_cpu(*(__be64 *) buf->total_size);
2030                 *block_size = be32_to_cpu(*(__be32 *) buf->block_size);
2031         } else {                /* read capacity command failed */
2032                 printk(KERN_WARNING "cciss: read capacity failed\n");
2033                 *total_size = 0;
2034                 *block_size = BLOCK_SIZE;
2035         }
2036         printk(KERN_INFO "      blocks= %llu block_size= %d\n",
2037                (unsigned long long)*total_size+1, *block_size);
2038         kfree(buf);
2039         return;
2040 }
2041
2042 static int cciss_revalidate(struct gendisk *disk)
2043 {
2044         ctlr_info_t *h = get_host(disk);
2045         drive_info_struct *drv = get_drv(disk);
2046         int logvol;
2047         int FOUND = 0;
2048         unsigned int block_size;
2049         sector_t total_size;
2050         InquiryData_struct *inq_buff = NULL;
2051
2052         for (logvol = 0; logvol < CISS_MAX_LUN; logvol++) {
2053                 if (h->drv[logvol].LunID == drv->LunID) {
2054                         FOUND = 1;
2055                         break;
2056                 }
2057         }
2058
2059         if (!FOUND)
2060                 return 1;
2061
2062         inq_buff = kmalloc(sizeof(InquiryData_struct), GFP_KERNEL);
2063         if (inq_buff == NULL) {
2064                 printk(KERN_WARNING "cciss: out of memory\n");
2065                 return 1;
2066         }
2067         if (h->cciss_read == CCISS_READ_10) {
2068                 cciss_read_capacity(h->ctlr, logvol, 1,
2069                                         &total_size, &block_size);
2070         } else {
2071                 cciss_read_capacity_16(h->ctlr, logvol, 1,
2072                                         &total_size, &block_size);
2073         }
2074         cciss_geometry_inquiry(h->ctlr, logvol, 1, total_size, block_size,
2075                                inq_buff, drv);
2076
2077         blk_queue_hardsect_size(drv->queue, drv->block_size);
2078         set_capacity(disk, drv->nr_blocks);
2079
2080         kfree(inq_buff);
2081         return 0;
2082 }
2083
2084 /*
2085  *   Wait polling for a command to complete.
2086  *   The memory mapped FIFO is polled for the completion.
2087  *   Used only at init time, interrupts from the HBA are disabled.
2088  */
2089 static unsigned long pollcomplete(int ctlr)
2090 {
2091         unsigned long done;
2092         int i;
2093
2094         /* Wait (up to 20 seconds) for a command to complete */
2095
2096         for (i = 20 * HZ; i > 0; i--) {
2097                 done = hba[ctlr]->access.command_completed(hba[ctlr]);
2098                 if (done == FIFO_EMPTY)
2099                         schedule_timeout_uninterruptible(1);
2100                 else
2101                         return done;
2102         }
2103         /* Invalid address to tell caller we ran out of time */
2104         return 1;
2105 }
2106
2107 static int add_sendcmd_reject(__u8 cmd, int ctlr, unsigned long complete)
2108 {
2109         /* We get in here if sendcmd() is polling for completions
2110            and gets some command back that it wasn't expecting --
2111            something other than that which it just sent down.
2112            Ordinarily, that shouldn't happen, but it can happen when
2113            the scsi tape stuff gets into error handling mode, and
2114            starts using sendcmd() to try to abort commands and
2115            reset tape drives.  In that case, sendcmd may pick up
2116            completions of commands that were sent to logical drives
2117            through the block i/o system, or cciss ioctls completing, etc.
2118            In that case, we need to save those completions for later
2119            processing by the interrupt handler.
2120          */
2121
2122 #ifdef CONFIG_CISS_SCSI_TAPE
2123         struct sendcmd_reject_list *srl = &hba[ctlr]->scsi_rejects;
2124
2125         /* If it's not the scsi tape stuff doing error handling, (abort */
2126         /* or reset) then we don't expect anything weird. */
2127         if (cmd != CCISS_RESET_MSG && cmd != CCISS_ABORT_MSG) {
2128 #endif
2129                 printk(KERN_WARNING "cciss cciss%d: SendCmd "
2130                        "Invalid command list address returned! (%lx)\n",
2131                        ctlr, complete);
2132                 /* not much we can do. */
2133 #ifdef CONFIG_CISS_SCSI_TAPE
2134                 return 1;
2135         }
2136
2137         /* We've sent down an abort or reset, but something else
2138            has completed */
2139         if (srl->ncompletions >= (hba[ctlr]->nr_cmds + 2)) {
2140                 /* Uh oh.  No room to save it for later... */
2141                 printk(KERN_WARNING "cciss%d: Sendcmd: Invalid command addr, "
2142                        "reject list overflow, command lost!\n", ctlr);
2143                 return 1;
2144         }
2145         /* Save it for later */
2146         srl->complete[srl->ncompletions] = complete;
2147         srl->ncompletions++;
2148 #endif
2149         return 0;
2150 }
2151
2152 /*
2153  * Send a command to the controller, and wait for it to complete.
2154  * Only used at init time.
2155  */
2156 static int sendcmd(__u8 cmd, int ctlr, void *buff, size_t size, unsigned int use_unit_num,      /* 0: address the controller,
2157                                                                                                    1: address logical volume log_unit,
2158                                                                                                    2: periph device address is scsi3addr */
2159                    unsigned int log_unit,
2160                    __u8 page_code, unsigned char *scsi3addr, int cmd_type)
2161 {
2162         CommandList_struct *c;
2163         int i;
2164         unsigned long complete;
2165         ctlr_info_t *info_p = hba[ctlr];
2166         u64bit buff_dma_handle;
2167         int status, done = 0;
2168
2169         if ((c = cmd_alloc(info_p, 1)) == NULL) {
2170                 printk(KERN_WARNING "cciss: unable to get memory");
2171                 return IO_ERROR;
2172         }
2173         status = fill_cmd(c, cmd, ctlr, buff, size, use_unit_num,
2174                           log_unit, page_code, scsi3addr, cmd_type);
2175         if (status != IO_OK) {
2176                 cmd_free(info_p, c, 1);
2177                 return status;
2178         }
2179       resend_cmd1:
2180         /*
2181          * Disable interrupt
2182          */
2183 #ifdef CCISS_DEBUG
2184         printk(KERN_DEBUG "cciss: turning intr off\n");
2185 #endif                          /* CCISS_DEBUG */
2186         info_p->access.set_intr_mask(info_p, CCISS_INTR_OFF);
2187
2188         /* Make sure there is room in the command FIFO */
2189         /* Actually it should be completely empty at this time */
2190         /* unless we are in here doing error handling for the scsi */
2191         /* tape side of the driver. */
2192         for (i = 200000; i > 0; i--) {
2193                 /* if fifo isn't full go */
2194                 if (!(info_p->access.fifo_full(info_p))) {
2195
2196                         break;
2197                 }
2198                 udelay(10);
2199                 printk(KERN_WARNING "cciss cciss%d: SendCmd FIFO full,"
2200                        " waiting!\n", ctlr);
2201         }
2202         /*
2203          * Send the cmd
2204          */
2205         info_p->access.submit_command(info_p, c);
2206         done = 0;
2207         do {
2208                 complete = pollcomplete(ctlr);
2209
2210 #ifdef CCISS_DEBUG
2211                 printk(KERN_DEBUG "cciss: command completed\n");
2212 #endif                          /* CCISS_DEBUG */
2213
2214                 if (complete == 1) {
2215                         printk(KERN_WARNING
2216                                "cciss cciss%d: SendCmd Timeout out, "
2217                                "No command list address returned!\n", ctlr);
2218                         status = IO_ERROR;
2219                         done = 1;
2220                         break;
2221                 }
2222
2223                 /* This will need to change for direct lookup completions */
2224                 if ((complete & CISS_ERROR_BIT)
2225                     && (complete & ~CISS_ERROR_BIT) == c->busaddr) {
2226                         /* if data overrun or underun on Report command
2227                            ignore it
2228                          */
2229                         if (((c->Request.CDB[0] == CISS_REPORT_LOG) ||
2230                              (c->Request.CDB[0] == CISS_REPORT_PHYS) ||
2231                              (c->Request.CDB[0] == CISS_INQUIRY)) &&
2232                             ((c->err_info->CommandStatus ==
2233                               CMD_DATA_OVERRUN) ||
2234                              (c->err_info->CommandStatus == CMD_DATA_UNDERRUN)
2235                             )) {
2236                                 complete = c->busaddr;
2237                         } else {
2238                                 if (c->err_info->CommandStatus ==
2239                                     CMD_UNSOLICITED_ABORT) {
2240                                         printk(KERN_WARNING "cciss%d: "
2241                                                "unsolicited abort %p\n",
2242                                                ctlr, c);
2243                                         if (c->retry_count < MAX_CMD_RETRIES) {
2244                                                 printk(KERN_WARNING
2245                                                        "cciss%d: retrying %p\n",
2246                                                        ctlr, c);
2247                                                 c->retry_count++;
2248                                                 /* erase the old error */
2249                                                 /* information */
2250                                                 memset(c->err_info, 0,
2251                                                        sizeof
2252                                                        (ErrorInfo_struct));
2253                                                 goto resend_cmd1;
2254                                         } else {
2255                                                 printk(KERN_WARNING
2256                                                        "cciss%d: retried %p too "
2257                                                        "many times\n", ctlr, c);
2258                                                 status = IO_ERROR;
2259                                                 goto cleanup1;
2260                                         }
2261                                 } else if (c->err_info->CommandStatus ==
2262                                            CMD_UNABORTABLE) {
2263                                         printk(KERN_WARNING
2264                                                "cciss%d: command could not be aborted.\n",
2265                                                ctlr);
2266                                         status = IO_ERROR;
2267                                         goto cleanup1;
2268                                 }
2269                                 printk(KERN_WARNING "ciss ciss%d: sendcmd"
2270                                        " Error %x \n", ctlr,
2271                                        c->err_info->CommandStatus);
2272                                 printk(KERN_WARNING "ciss ciss%d: sendcmd"
2273                                        " offensive info\n"
2274                                        "  size %x\n   num %x   value %x\n",
2275                                        ctlr,
2276                                        c->err_info->MoreErrInfo.Invalid_Cmd.
2277                                        offense_size,
2278                                        c->err_info->MoreErrInfo.Invalid_Cmd.
2279                                        offense_num,
2280                                        c->err_info->MoreErrInfo.Invalid_Cmd.
2281                                        offense_value);
2282                                 status = IO_ERROR;
2283                                 goto cleanup1;
2284                         }
2285                 }
2286                 /* This will need changing for direct lookup completions */
2287                 if (complete != c->busaddr) {
2288                         if (add_sendcmd_reject(cmd, ctlr, complete) != 0) {
2289                                 BUG();  /* we are pretty much hosed if we get here. */
2290                         }
2291                         continue;
2292                 } else
2293                         done = 1;
2294         } while (!done);
2295
2296       cleanup1:
2297         /* unlock the data buffer from DMA */
2298         buff_dma_handle.val32.lower = c->SG[0].Addr.lower;
2299         buff_dma_handle.val32.upper = c->SG[0].Addr.upper;
2300         pci_unmap_single(info_p->pdev, (dma_addr_t) buff_dma_handle.val,
2301                          c->SG[0].Len, PCI_DMA_BIDIRECTIONAL);
2302 #ifdef CONFIG_CISS_SCSI_TAPE
2303         /* if we saved some commands for later, process them now. */
2304         if (info_p->scsi_rejects.ncompletions > 0)
2305                 do_cciss_intr(0, info_p);
2306 #endif
2307         cmd_free(info_p, c, 1);
2308         return status;
2309 }
2310
2311 /*
2312  * Map (physical) PCI mem into (virtual) kernel space
2313  */
2314 static void __iomem *remap_pci_mem(ulong base, ulong size)
2315 {
2316         ulong page_base = ((ulong) base) & PAGE_MASK;
2317         ulong page_offs = ((ulong) base) - page_base;
2318         void __iomem *page_remapped = ioremap(page_base, page_offs + size);
2319
2320         return page_remapped ? (page_remapped + page_offs) : NULL;
2321 }
2322
2323 /*
2324  * Takes jobs of the Q and sends them to the hardware, then puts it on
2325  * the Q to wait for completion.
2326  */
2327 static void start_io(ctlr_info_t *h)
2328 {
2329         CommandList_struct *c;
2330
2331         while ((c = h->reqQ) != NULL) {
2332                 /* can't do anything if fifo is full */
2333                 if ((h->access.fifo_full(h))) {
2334                         printk(KERN_WARNING "cciss: fifo full\n");
2335                         break;
2336                 }
2337
2338                 /* Get the first entry from the Request Q */
2339                 removeQ(&(h->reqQ), c);
2340                 h->Qdepth--;
2341
2342                 /* Tell the controller execute command */
2343                 h->access.submit_command(h, c);
2344
2345                 /* Put job onto the completed Q */
2346                 addQ(&(h->cmpQ), c);
2347         }
2348 }
2349
2350 /* Assumes that CCISS_LOCK(h->ctlr) is held. */
2351 /* Zeros out the error record and then resends the command back */
2352 /* to the controller */
2353 static inline void resend_cciss_cmd(ctlr_info_t *h, CommandList_struct *c)
2354 {
2355         /* erase the old error information */
2356         memset(c->err_info, 0, sizeof(ErrorInfo_struct));
2357
2358         /* add it to software queue and then send it to the controller */
2359         addQ(&(h->reqQ), c);
2360         h->Qdepth++;
2361         if (h->Qdepth > h->maxQsinceinit)
2362                 h->maxQsinceinit = h->Qdepth;
2363
2364         start_io(h);
2365 }
2366
2367 static inline int evaluate_target_status(CommandList_struct *cmd)
2368 {
2369         unsigned char sense_key;
2370         int error_count = 1;
2371
2372         if (cmd->err_info->ScsiStatus != 0x02) { /* not check condition? */
2373                 if (!blk_pc_request(cmd->rq))
2374                         printk(KERN_WARNING "cciss: cmd %p "
2375                                "has SCSI Status 0x%x\n",
2376                                cmd, cmd->err_info->ScsiStatus);
2377                 return error_count;
2378         }
2379
2380         /* check the sense key */
2381         sense_key = 0xf & cmd->err_info->SenseInfo[2];
2382         /* no status or recovered error */
2383         if ((sense_key == 0x0) || (sense_key == 0x1))
2384                 error_count = 0;
2385
2386         if (!blk_pc_request(cmd->rq)) { /* Not SG_IO or similar? */
2387                 if (error_count != 0)
2388                         printk(KERN_WARNING "cciss: cmd %p has CHECK CONDITION"
2389                                " sense key = 0x%x\n", cmd, sense_key);
2390                 return error_count;
2391         }
2392
2393         /* SG_IO or similar, copy sense data back */
2394         if (cmd->rq->sense) {
2395                 if (cmd->rq->sense_len > cmd->err_info->SenseLen)
2396                         cmd->rq->sense_len = cmd->err_info->SenseLen;
2397                 memcpy(cmd->rq->sense, cmd->err_info->SenseInfo,
2398                         cmd->rq->sense_len);
2399         } else
2400                 cmd->rq->sense_len = 0;
2401
2402         return error_count;
2403 }
2404
2405 /* checks the status of the job and calls complete buffers to mark all
2406  * buffers for the completed job. Note that this function does not need
2407  * to hold the hba/queue lock.
2408  */
2409 static inline void complete_command(ctlr_info_t *h, CommandList_struct *cmd,
2410                                     int timeout)
2411 {
2412         int retry_cmd = 0;
2413         struct request *rq = cmd->rq;
2414
2415         rq->errors = 0;
2416
2417         if (timeout)
2418                 rq->errors = 1;
2419
2420         if (cmd->err_info->CommandStatus == 0)  /* no error has occurred */
2421                 goto after_error_processing;
2422
2423         switch (cmd->err_info->CommandStatus) {
2424         case CMD_TARGET_STATUS:
2425                 rq->errors = evaluate_target_status(cmd);
2426                 break;
2427         case CMD_DATA_UNDERRUN:
2428                 if (blk_fs_request(cmd->rq)) {
2429                         printk(KERN_WARNING "cciss: cmd %p has"
2430                                " completed with data underrun "
2431                                "reported\n", cmd);
2432                         cmd->rq->data_len = cmd->err_info->ResidualCnt;
2433                 }
2434                 break;
2435         case CMD_DATA_OVERRUN:
2436                 if (blk_fs_request(cmd->rq))
2437                         printk(KERN_WARNING "cciss: cmd %p has"
2438                                " completed with data overrun "
2439                                "reported\n", cmd);
2440                 break;
2441         case CMD_INVALID:
2442                 printk(KERN_WARNING "cciss: cmd %p is "
2443                        "reported invalid\n", cmd);
2444                 rq->errors = 1;
2445                 break;
2446         case CMD_PROTOCOL_ERR:
2447                 printk(KERN_WARNING "cciss: cmd %p has "
2448                        "protocol error \n", cmd);
2449                 rq->errors = 1;
2450                 break;
2451         case CMD_HARDWARE_ERR:
2452                 printk(KERN_WARNING "cciss: cmd %p had "
2453                        " hardware error\n", cmd);
2454                 rq->errors = 1;
2455                 break;
2456         case CMD_CONNECTION_LOST:
2457                 printk(KERN_WARNING "cciss: cmd %p had "
2458                        "connection lost\n", cmd);
2459                 rq->errors = 1;
2460                 break;
2461         case CMD_ABORTED:
2462                 printk(KERN_WARNING "cciss: cmd %p was "
2463                        "aborted\n", cmd);
2464                 rq->errors = 1;
2465                 break;
2466         case CMD_ABORT_FAILED:
2467                 printk(KERN_WARNING "cciss: cmd %p reports "
2468                        "abort failed\n", cmd);
2469                 rq->errors = 1;
2470                 break;
2471         case CMD_UNSOLICITED_ABORT:
2472                 printk(KERN_WARNING "cciss%d: unsolicited "
2473                        "abort %p\n", h->ctlr, cmd);
2474                 if (cmd->retry_count < MAX_CMD_RETRIES) {
2475                         retry_cmd = 1;
2476                         printk(KERN_WARNING
2477                                "cciss%d: retrying %p\n", h->ctlr, cmd);
2478                         cmd->retry_count++;
2479                 } else
2480                         printk(KERN_WARNING
2481                                "cciss%d: %p retried too "
2482                                "many times\n", h->ctlr, cmd);
2483                 rq->errors = 1;
2484                 break;
2485         case CMD_TIMEOUT:
2486                 printk(KERN_WARNING "cciss: cmd %p timedout\n", cmd);
2487                 rq->errors = 1;
2488                 break;
2489         default:
2490                 printk(KERN_WARNING "cciss: cmd %p returned "
2491                        "unknown status %x\n", cmd,
2492                        cmd->err_info->CommandStatus);
2493                 rq->errors = 1;
2494         }
2495
2496 after_error_processing:
2497
2498         /* We need to return this command */
2499         if (retry_cmd) {
2500                 resend_cciss_cmd(h, cmd);
2501                 return;
2502         }
2503         cmd->rq->data_len = 0;
2504         cmd->rq->completion_data = cmd;
2505         blk_add_trace_rq(cmd->rq->q, cmd->rq, BLK_TA_COMPLETE);
2506         blk_complete_request(cmd->rq);
2507 }
2508
2509 /*
2510  * Get a request and submit it to the controller.
2511  */
2512 static void do_cciss_request(request_queue_t *q)
2513 {
2514         ctlr_info_t *h = q->queuedata;
2515         CommandList_struct *c;
2516         sector_t start_blk;
2517         int seg;
2518         struct request *creq;
2519         u64bit temp64;
2520         struct scatterlist tmp_sg[MAXSGENTRIES];
2521         drive_info_struct *drv;
2522         int i, dir;
2523
2524         /* We call start_io here in case there is a command waiting on the
2525          * queue that has not been sent.
2526          */
2527         if (blk_queue_plugged(q))
2528                 goto startio;
2529
2530       queue:
2531         creq = elv_next_request(q);
2532         if (!creq)
2533                 goto startio;
2534
2535         BUG_ON(creq->nr_phys_segments > MAXSGENTRIES);
2536
2537         if ((c = cmd_alloc(h, 1)) == NULL)
2538                 goto full;
2539
2540         blkdev_dequeue_request(creq);
2541
2542         spin_unlock_irq(q->queue_lock);
2543
2544         c->cmd_type = CMD_RWREQ;
2545         c->rq = creq;
2546
2547         /* fill in the request */
2548         drv = creq->rq_disk->private_data;
2549         c->Header.ReplyQueue = 0;       // unused in simple mode
2550         /* got command from pool, so use the command block index instead */
2551         /* for direct lookups. */
2552         /* The first 2 bits are reserved for controller error reporting. */
2553         c->Header.Tag.lower = (c->cmdindex << 3);
2554         c->Header.Tag.lower |= 0x04;    /* flag for direct lookup. */
2555         c->Header.LUN.LogDev.VolId = drv->LunID;
2556         c->Header.LUN.LogDev.Mode = 1;
2557         c->Request.CDBLen = 10; // 12 byte commands not in FW yet;
2558         c->Request.Type.Type = TYPE_CMD;        // It is a command.
2559         c->Request.Type.Attribute = ATTR_SIMPLE;
2560         c->Request.Type.Direction =
2561             (rq_data_dir(creq) == READ) ? XFER_READ : XFER_WRITE;
2562         c->Request.Timeout = 0; // Don't time out
2563         c->Request.CDB[0] =
2564             (rq_data_dir(creq) == READ) ? h->cciss_read : h->cciss_write;
2565         start_blk = creq->sector;
2566 #ifdef CCISS_DEBUG
2567         printk(KERN_DEBUG "ciss: sector =%d nr_sectors=%d\n", (int)creq->sector,
2568                (int)creq->nr_sectors);
2569 #endif                          /* CCISS_DEBUG */
2570
2571         seg = blk_rq_map_sg(q, creq, tmp_sg);
2572
2573         /* get the DMA records for the setup */
2574         if (c->Request.Type.Direction == XFER_READ)
2575                 dir = PCI_DMA_FROMDEVICE;
2576         else
2577                 dir = PCI_DMA_TODEVICE;
2578
2579         for (i = 0; i < seg; i++) {
2580                 c->SG[i].Len = tmp_sg[i].length;
2581                 temp64.val = (__u64) pci_map_page(h->pdev, tmp_sg[i].page,
2582                                                   tmp_sg[i].offset,
2583                                                   tmp_sg[i].length, dir);
2584                 c->SG[i].Addr.lower = temp64.val32.lower;
2585                 c->SG[i].Addr.upper = temp64.val32.upper;
2586                 c->SG[i].Ext = 0;       // we are not chaining
2587         }
2588         /* track how many SG entries we are using */
2589         if (seg > h->maxSG)
2590                 h->maxSG = seg;
2591
2592 #ifdef CCISS_DEBUG
2593         printk(KERN_DEBUG "cciss: Submitting %d sectors in %d segments\n",
2594                creq->nr_sectors, seg);
2595 #endif                          /* CCISS_DEBUG */
2596
2597         c->Header.SGList = c->Header.SGTotal = seg;
2598         if (likely(blk_fs_request(creq))) {
2599                 if(h->cciss_read == CCISS_READ_10) {
2600                         c->Request.CDB[1] = 0;
2601                         c->Request.CDB[2] = (start_blk >> 24) & 0xff;   //MSB
2602                         c->Request.CDB[3] = (start_blk >> 16) & 0xff;
2603                         c->Request.CDB[4] = (start_blk >> 8) & 0xff;
2604                         c->Request.CDB[5] = start_blk & 0xff;
2605                         c->Request.CDB[6] = 0;  // (sect >> 24) & 0xff; MSB
2606                         c->Request.CDB[7] = (creq->nr_sectors >> 8) & 0xff;
2607                         c->Request.CDB[8] = creq->nr_sectors & 0xff;
2608                         c->Request.CDB[9] = c->Request.CDB[11] = c->Request.CDB[12] = 0;
2609                 } else {
2610                         c->Request.CDBLen = 16;
2611                         c->Request.CDB[1]= 0;
2612                         c->Request.CDB[2]= (start_blk >> 56) & 0xff;    //MSB
2613                         c->Request.CDB[3]= (start_blk >> 48) & 0xff;
2614                         c->Request.CDB[4]= (start_blk >> 40) & 0xff;
2615                         c->Request.CDB[5]= (start_blk >> 32) & 0xff;
2616                         c->Request.CDB[6]= (start_blk >> 24) & 0xff;
2617                         c->Request.CDB[7]= (start_blk >> 16) & 0xff;
2618                         c->Request.CDB[8]= (start_blk >>  8) & 0xff;
2619                         c->Request.CDB[9]= start_blk & 0xff;
2620                         c->Request.CDB[10]= (creq->nr_sectors >>  24) & 0xff;
2621                         c->Request.CDB[11]= (creq->nr_sectors >>  16) & 0xff;
2622                         c->Request.CDB[12]= (creq->nr_sectors >>  8) & 0xff;
2623                         c->Request.CDB[13]= creq->nr_sectors & 0xff;
2624                         c->Request.CDB[14] = c->Request.CDB[15] = 0;
2625                 }
2626         } else if (blk_pc_request(creq)) {
2627                 c->Request.CDBLen = creq->cmd_len;
2628                 memcpy(c->Request.CDB, creq->cmd, BLK_MAX_CDB);
2629         } else {
2630                 printk(KERN_WARNING "cciss%d: bad request type %d\n", h->ctlr, creq->cmd_type);
2631                 BUG();
2632         }
2633
2634         spin_lock_irq(q->queue_lock);
2635
2636         addQ(&(h->reqQ), c);
2637         h->Qdepth++;
2638         if (h->Qdepth > h->maxQsinceinit)
2639                 h->maxQsinceinit = h->Qdepth;
2640
2641         goto queue;
2642 full:
2643         blk_stop_queue(q);
2644 startio:
2645         /* We will already have the driver lock here so not need
2646          * to lock it.
2647          */
2648         start_io(h);
2649 }
2650
2651 static inline unsigned long get_next_completion(ctlr_info_t *h)
2652 {
2653 #ifdef CONFIG_CISS_SCSI_TAPE
2654         /* Any rejects from sendcmd() lying around? Process them first */
2655         if (h->scsi_rejects.ncompletions == 0)
2656                 return h->access.command_completed(h);
2657         else {
2658                 struct sendcmd_reject_list *srl;
2659                 int n;
2660                 srl = &h->scsi_rejects;
2661                 n = --srl->ncompletions;
2662                 /* printk("cciss%d: processing saved reject\n", h->ctlr); */
2663                 printk("p");
2664                 return srl->complete[n];
2665         }
2666 #else
2667         return h->access.command_completed(h);
2668 #endif
2669 }
2670
2671 static inline int interrupt_pending(ctlr_info_t *h)
2672 {
2673 #ifdef CONFIG_CISS_SCSI_TAPE
2674         return (h->access.intr_pending(h)
2675                 || (h->scsi_rejects.ncompletions > 0));
2676 #else
2677         return h->access.intr_pending(h);
2678 #endif
2679 }
2680
2681 static inline long interrupt_not_for_us(ctlr_info_t *h)
2682 {
2683 #ifdef CONFIG_CISS_SCSI_TAPE
2684         return (((h->access.intr_pending(h) == 0) ||
2685                  (h->interrupts_enabled == 0))
2686                 && (h->scsi_rejects.ncompletions == 0));
2687 #else
2688         return (((h->access.intr_pending(h) == 0) ||
2689                  (h->interrupts_enabled == 0)));
2690 #endif
2691 }
2692
2693 static irqreturn_t do_cciss_intr(int irq, void *dev_id)
2694 {
2695         ctlr_info_t *h = dev_id;
2696         CommandList_struct *c;
2697         unsigned long flags;
2698         __u32 a, a1, a2;
2699
2700         if (interrupt_not_for_us(h))
2701                 return IRQ_NONE;
2702         /*
2703          * If there are completed commands in the completion queue,
2704          * we had better do something about it.
2705          */
2706         spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
2707         while (interrupt_pending(h)) {
2708                 while ((a = get_next_completion(h)) != FIFO_EMPTY) {
2709                         a1 = a;
2710                         if ((a & 0x04)) {
2711                                 a2 = (a >> 3);
2712                                 if (a2 >= h->nr_cmds) {
2713                                         printk(KERN_WARNING
2714                                                "cciss: controller cciss%d failed, stopping.\n",
2715                                                h->ctlr);
2716                                         fail_all_cmds(h->ctlr);
2717                                         return IRQ_HANDLED;
2718                                 }
2719
2720                                 c = h->cmd_pool + a2;
2721                                 a = c->busaddr;
2722
2723                         } else {
2724                                 a &= ~3;
2725                                 if ((c = h->cmpQ) == NULL) {
2726                                         printk(KERN_WARNING
2727                                                "cciss: Completion of %08x ignored\n",
2728                                                a1);
2729                                         continue;
2730                                 }
2731                                 while (c->busaddr != a) {
2732                                         c = c->next;
2733                                         if (c == h->cmpQ)
2734                                                 break;
2735                                 }
2736                         }
2737                         /*
2738                          * If we've found the command, take it off the
2739                          * completion Q and free it
2740                          */
2741                         if (c->busaddr == a) {
2742                                 removeQ(&h->cmpQ, c);
2743                                 if (c->cmd_type == CMD_RWREQ) {
2744                                         complete_command(h, c, 0);
2745                                 } else if (c->cmd_type == CMD_IOCTL_PEND) {
2746                                         complete(c->waiting);
2747                                 }
2748 #                               ifdef CONFIG_CISS_SCSI_TAPE
2749                                 else if (c->cmd_type == CMD_SCSI)
2750                                         complete_scsi_command(c, 0, a1);
2751 #                               endif
2752                                 continue;
2753                         }
2754                 }
2755         }
2756
2757         spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
2758         return IRQ_HANDLED;
2759 }
2760
2761 /*
2762  *  We cannot read the structure directly, for portability we must use
2763  *   the io functions.
2764  *   This is for debug only.
2765  */
2766 #ifdef CCISS_DEBUG
2767 static void print_cfg_table(CfgTable_struct *tb)
2768 {
2769         int i;
2770         char temp_name[17];
2771
2772         printk("Controller Configuration information\n");
2773         printk("------------------------------------\n");
2774         for (i = 0; i < 4; i++)
2775                 temp_name[i] = readb(&(tb->Signature[i]));
2776         temp_name[4] = '\0';
2777         printk("   Signature = %s\n", temp_name);
2778         printk("   Spec Number = %d\n", readl(&(tb->SpecValence)));
2779         printk("   Transport methods supported = 0x%x\n",
2780                readl(&(tb->TransportSupport)));
2781         printk("   Transport methods active = 0x%x\n",
2782                readl(&(tb->TransportActive)));
2783         printk("   Requested transport Method = 0x%x\n",
2784                readl(&(tb->HostWrite.TransportRequest)));
2785         printk("   Coalesce Interrupt Delay = 0x%x\n",
2786                readl(&(tb->HostWrite.CoalIntDelay)));
2787         printk("   Coalesce Interrupt Count = 0x%x\n",
2788                readl(&(tb->HostWrite.CoalIntCount)));
2789         printk("   Max outstanding commands = 0x%d\n",
2790                readl(&(tb->CmdsOutMax)));
2791         printk("   Bus Types = 0x%x\n", readl(&(tb->BusTypes)));
2792         for (i = 0; i < 16; i++)
2793                 temp_name[i] = readb(&(tb->ServerName[i]));
2794         temp_name[16] = '\0';
2795         printk("   Server Name = %s\n", temp_name);
2796         printk("   Heartbeat Counter = 0x%x\n\n\n", readl(&(tb->HeartBeat)));
2797 }
2798 #endif                          /* CCISS_DEBUG */
2799
2800 static int find_PCI_BAR_index(struct pci_dev *pdev, unsigned long pci_bar_addr)
2801 {
2802         int i, offset, mem_type, bar_type;
2803         if (pci_bar_addr == PCI_BASE_ADDRESS_0) /* looking for BAR zero? */
2804                 return 0;
2805         offset = 0;
2806         for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
2807                 bar_type = pci_resource_flags(pdev, i) & PCI_BASE_ADDRESS_SPACE;
2808                 if (bar_type == PCI_BASE_ADDRESS_SPACE_IO)
2809                         offset += 4;
2810                 else {
2811                         mem_type = pci_resource_flags(pdev, i) &
2812                             PCI_BASE_ADDRESS_MEM_TYPE_MASK;
2813                         switch (mem_type) {
2814                         case PCI_BASE_ADDRESS_MEM_TYPE_32:
2815                         case PCI_BASE_ADDRESS_MEM_TYPE_1M:
2816                                 offset += 4;    /* 32 bit */
2817                                 break;
2818                         case PCI_BASE_ADDRESS_MEM_TYPE_64:
2819                                 offset += 8;
2820                                 break;
2821                         default:        /* reserved in PCI 2.2 */
2822                                 printk(KERN_WARNING
2823                                        "Base address is invalid\n");
2824                                 return -1;
2825                                 break;
2826                         }
2827                 }
2828                 if (offset == pci_bar_addr - PCI_BASE_ADDRESS_0)
2829                         return i + 1;
2830         }
2831         return -1;
2832 }
2833
2834 /* If MSI/MSI-X is supported by the kernel we will try to enable it on
2835  * controllers that are capable. If not, we use IO-APIC mode.
2836  */
2837
2838 static void __devinit cciss_interrupt_mode(ctlr_info_t *c,
2839                                            struct pci_dev *pdev, __u32 board_id)
2840 {
2841 #ifdef CONFIG_PCI_MSI
2842         int err;
2843         struct msix_entry cciss_msix_entries[4] = { {0, 0}, {0, 1},
2844         {0, 2}, {0, 3}
2845         };
2846
2847         /* Some boards advertise MSI but don't really support it */
2848         if ((board_id == 0x40700E11) ||
2849             (board_id == 0x40800E11) ||
2850             (board_id == 0x40820E11) || (board_id == 0x40830E11))
2851                 goto default_int_mode;
2852
2853         if (pci_find_capability(pdev, PCI_CAP_ID_MSIX)) {
2854                 err = pci_enable_msix(pdev, cciss_msix_entries, 4);
2855                 if (!err) {
2856                         c->intr[0] = cciss_msix_entries[0].vector;
2857                         c->intr[1] = cciss_msix_entries[1].vector;
2858                         c->intr[2] = cciss_msix_entries[2].vector;
2859                         c->intr[3] = cciss_msix_entries[3].vector;
2860                         c->msix_vector = 1;
2861                         return;
2862                 }
2863                 if (err > 0) {
2864                         printk(KERN_WARNING "cciss: only %d MSI-X vectors "
2865                                "available\n", err);
2866                         goto default_int_mode;
2867                 } else {
2868                         printk(KERN_WARNING "cciss: MSI-X init failed %d\n",
2869                                err);
2870                         goto default_int_mode;
2871                 }
2872         }
2873         if (pci_find_capability(pdev, PCI_CAP_ID_MSI)) {
2874                 if (!pci_enable_msi(pdev)) {
2875                         c->msi_vector = 1;
2876                 } else {
2877                         printk(KERN_WARNING "cciss: MSI init failed\n");
2878                 }
2879         }
2880 default_int_mode:
2881 #endif                          /* CONFIG_PCI_MSI */
2882         /* if we get here we're going to use the default interrupt mode */
2883         c->intr[SIMPLE_MODE_INT] = pdev->irq;
2884         return;
2885 }
2886
2887 static int cciss_pci_init(ctlr_info_t *c, struct pci_dev *pdev)
2888 {
2889         ushort subsystem_vendor_id, subsystem_device_id, command;
2890         __u32 board_id, scratchpad = 0;
2891         __u64 cfg_offset;
2892         __u32 cfg_base_addr;
2893         __u64 cfg_base_addr_index;
2894         int i, err;
2895
2896         /* check to see if controller has been disabled */
2897         /* BEFORE trying to enable it */
2898         (void)pci_read_config_word(pdev, PCI_COMMAND, &command);
2899         if (!(command & 0x02)) {
2900                 printk(KERN_WARNING
2901                        "cciss: controller appears to be disabled\n");
2902                 return -ENODEV;
2903         }
2904
2905         err = pci_enable_device(pdev);
2906         if (err) {
2907                 printk(KERN_ERR "cciss: Unable to Enable PCI device\n");
2908                 return err;
2909         }
2910
2911         err = pci_request_regions(pdev, "cciss");
2912         if (err) {
2913                 printk(KERN_ERR "cciss: Cannot obtain PCI resources, "
2914                        "aborting\n");
2915                 return err;
2916         }
2917
2918         subsystem_vendor_id = pdev->subsystem_vendor;
2919         subsystem_device_id = pdev->subsystem_device;
2920         board_id = (((__u32) (subsystem_device_id << 16) & 0xffff0000) |
2921                     subsystem_vendor_id);
2922
2923 #ifdef CCISS_DEBUG
2924         printk("command = %x\n", command);
2925         printk("irq = %x\n", pdev->irq);
2926         printk("board_id = %x\n", board_id);
2927 #endif                          /* CCISS_DEBUG */
2928
2929 /* If the kernel supports MSI/MSI-X we will try to enable that functionality,
2930  * else we use the IO-APIC interrupt assigned to us by system ROM.
2931  */
2932         cciss_interrupt_mode(c, pdev, board_id);
2933
2934         /*
2935          * Memory base addr is first addr , the second points to the config
2936          *   table
2937          */
2938
2939         c->paddr = pci_resource_start(pdev, 0); /* addressing mode bits already removed */
2940 #ifdef CCISS_DEBUG
2941         printk("address 0 = %x\n", c->paddr);
2942 #endif                          /* CCISS_DEBUG */
2943         c->vaddr = remap_pci_mem(c->paddr, 0x250);
2944
2945         /* Wait for the board to become ready.  (PCI hotplug needs this.)
2946          * We poll for up to 120 secs, once per 100ms. */
2947         for (i = 0; i < 1200; i++) {
2948                 scratchpad = readl(c->vaddr + SA5_SCRATCHPAD_OFFSET);
2949                 if (scratchpad == CCISS_FIRMWARE_READY)
2950                         break;
2951                 set_current_state(TASK_INTERRUPTIBLE);
2952                 schedule_timeout(HZ / 10);      /* wait 100ms */
2953         }
2954         if (scratchpad != CCISS_FIRMWARE_READY) {
2955                 printk(KERN_WARNING "cciss: Board not ready.  Timed out.\n");
2956                 err = -ENODEV;
2957                 goto err_out_free_res;
2958         }
2959
2960         /* get the address index number */
2961         cfg_base_addr = readl(c->vaddr + SA5_CTCFG_OFFSET);
2962         cfg_base_addr &= (__u32) 0x0000ffff;
2963 #ifdef CCISS_DEBUG
2964         printk("cfg base address = %x\n", cfg_base_addr);
2965 #endif                          /* CCISS_DEBUG */
2966         cfg_base_addr_index = find_PCI_BAR_index(pdev, cfg_base_addr);
2967 #ifdef CCISS_DEBUG
2968         printk("cfg base address index = %x\n", cfg_base_addr_index);
2969 #endif                          /* CCISS_DEBUG */
2970         if (cfg_base_addr_index == -1) {
2971                 printk(KERN_WARNING "cciss: Cannot find cfg_base_addr_index\n");
2972                 err = -ENODEV;
2973                 goto err_out_free_res;
2974         }
2975
2976         cfg_offset = readl(c->vaddr + SA5_CTMEM_OFFSET);
2977 #ifdef CCISS_DEBUG
2978         printk("cfg offset = %x\n", cfg_offset);
2979 #endif                          /* CCISS_DEBUG */
2980         c->cfgtable = remap_pci_mem(pci_resource_start(pdev,
2981                                                        cfg_base_addr_index) +
2982                                     cfg_offset, sizeof(CfgTable_struct));
2983         c->board_id = board_id;
2984
2985 #ifdef CCISS_DEBUG
2986         print_cfg_table(c->cfgtable);
2987 #endif                          /* CCISS_DEBUG */
2988
2989         for (i = 0; i < ARRAY_SIZE(products); i++) {
2990                 if (board_id == products[i].board_id) {
2991                         c->product_name = products[i].product_name;
2992                         c->access = *(products[i].access);
2993                         c->nr_cmds = products[i].nr_cmds;
2994                         break;
2995                 }
2996         }
2997         if ((readb(&c->cfgtable->Signature[0]) != 'C') ||
2998             (readb(&c->cfgtable->Signature[1]) != 'I') ||
2999             (readb(&c->cfgtable->Signature[2]) != 'S') ||
3000             (readb(&c->cfgtable->Signature[3]) != 'S')) {
3001                 printk("Does not appear to be a valid CISS config table\n");
3002                 err = -ENODEV;
3003                 goto err_out_free_res;
3004         }
3005         /* We didn't find the controller in our list. We know the
3006          * signature is valid. If it's an HP device let's try to
3007          * bind to the device and fire it up. Otherwise we bail.
3008          */
3009         if (i == ARRAY_SIZE(products)) {
3010                 if (subsystem_vendor_id == PCI_VENDOR_ID_HP) {
3011                         c->product_name = products[i-1].product_name;
3012                         c->access = *(products[i-1].access);
3013                         c->nr_cmds = products[i-1].nr_cmds;
3014                         printk(KERN_WARNING "cciss: This is an unknown "
3015                                 "Smart Array controller.\n"
3016                                 "cciss: Please update to the latest driver "
3017                                 "available from www.hp.com.\n");
3018                 } else {
3019                         printk(KERN_WARNING "cciss: Sorry, I don't know how"
3020                                 " to access the Smart Array controller %08lx\n"
3021                                         , (unsigned long)board_id);
3022                         err = -ENODEV;
3023                         goto err_out_free_res;
3024                 }
3025         }
3026 #ifdef CONFIG_X86
3027         {
3028                 /* Need to enable prefetch in the SCSI core for 6400 in x86 */
3029                 __u32 prefetch;
3030                 prefetch = readl(&(c->cfgtable->SCSI_Prefetch));
3031                 prefetch |= 0x100;
3032                 writel(prefetch, &(c->cfgtable->SCSI_Prefetch));
3033         }
3034 #endif
3035
3036         /* Disabling DMA prefetch for the P600
3037          * An ASIC bug may result in a prefetch beyond
3038          * physical memory.
3039          */
3040         if(board_id == 0x3225103C) {
3041                 __u32 dma_prefetch;
3042                 dma_prefetch = readl(c->vaddr + I2O_DMA1_CFG);
3043                 dma_prefetch |= 0x8000;
3044                 writel(dma_prefetch, c->vaddr + I2O_DMA1_CFG);
3045         }
3046
3047 #ifdef CCISS_DEBUG
3048         printk("Trying to put board into Simple mode\n");
3049 #endif                          /* CCISS_DEBUG */
3050         c->max_commands = readl(&(c->cfgtable->CmdsOutMax));
3051         /* Update the field, and then ring the doorbell */
3052         writel(CFGTBL_Trans_Simple, &(c->cfgtable->HostWrite.TransportRequest));
3053         writel(CFGTBL_ChangeReq, c->vaddr + SA5_DOORBELL);
3054
3055         /* under certain very rare conditions, this can take awhile.
3056          * (e.g.: hot replace a failed 144GB drive in a RAID 5 set right
3057          * as we enter this code.) */
3058         for (i = 0; i < MAX_CONFIG_WAIT; i++) {
3059                 if (!(readl(c->vaddr + SA5_DOORBELL) & CFGTBL_ChangeReq))
3060                         break;
3061                 /* delay and try again */
3062                 set_current_state(TASK_INTERRUPTIBLE);
3063                 schedule_timeout(10);
3064         }
3065
3066 #ifdef CCISS_DEBUG
3067         printk(KERN_DEBUG "I counter got to %d %x\n", i,
3068                readl(c->vaddr + SA5_DOORBELL));
3069 #endif                          /* CCISS_DEBUG */
3070 #ifdef CCISS_DEBUG
3071         print_cfg_table(c->cfgtable);
3072 #endif                          /* CCISS_DEBUG */
3073
3074         if (!(readl(&(c->cfgtable->TransportActive)) & CFGTBL_Trans_Simple)) {
3075                 printk(KERN_WARNING "cciss: unable to get board into"
3076                        " simple mode\n");
3077                 err = -ENODEV;
3078                 goto err_out_free_res;
3079         }
3080         return 0;
3081
3082 err_out_free_res:
3083         /*
3084          * Deliberately omit pci_disable_device(): it does something nasty to
3085          * Smart Array controllers that pci_enable_device does not undo
3086          */
3087         pci_release_regions(pdev);
3088         return err;
3089 }
3090
3091 /*
3092  * Gets information about the local volumes attached to the controller.
3093  */
3094 static void cciss_getgeometry(int cntl_num)
3095 {
3096         ReportLunData_struct *ld_buff;
3097         InquiryData_struct *inq_buff;
3098         int return_code;
3099         int i;
3100         int listlength = 0;
3101         __u32 lunid = 0;
3102         int block_size;
3103         sector_t total_size;
3104
3105         ld_buff = kzalloc(sizeof(ReportLunData_struct), GFP_KERNEL);
3106         if (ld_buff == NULL) {
3107                 printk(KERN_ERR "cciss: out of memory\n");
3108                 return;
3109         }
3110         inq_buff = kmalloc(sizeof(InquiryData_struct), GFP_KERNEL);
3111         if (inq_buff == NULL) {
3112                 printk(KERN_ERR "cciss: out of memory\n");
3113                 kfree(ld_buff);
3114                 return;
3115         }
3116         /* Get the firmware version */
3117         return_code = sendcmd(CISS_INQUIRY, cntl_num, inq_buff,
3118                               sizeof(InquiryData_struct), 0, 0, 0, NULL,
3119                               TYPE_CMD);
3120         if (return_code == IO_OK) {
3121                 hba[cntl_num]->firm_ver[0] = inq_buff->data_byte[32];
3122                 hba[cntl_num]->firm_ver[1] = inq_buff->data_byte[33];
3123                 hba[cntl_num]->firm_ver[2] = inq_buff->data_byte[34];
3124                 hba[cntl_num]->firm_ver[3] = inq_buff->data_byte[35];
3125         } else {                /* send command failed */
3126
3127                 printk(KERN_WARNING "cciss: unable to determine firmware"
3128                        " version of controller\n");
3129         }
3130         /* Get the number of logical volumes */
3131         return_code = sendcmd(CISS_REPORT_LOG, cntl_num, ld_buff,
3132                               sizeof(ReportLunData_struct), 0, 0, 0, NULL,
3133                               TYPE_CMD);
3134
3135         if (return_code == IO_OK) {
3136 #ifdef CCISS_DEBUG
3137                 printk("LUN Data\n--------------------------\n");
3138 #endif                          /* CCISS_DEBUG */
3139
3140                 listlength |=
3141                     (0xff & (unsigned int)(ld_buff->LUNListLength[0])) << 24;
3142                 listlength |=
3143                     (0xff & (unsigned int)(ld_buff->LUNListLength[1])) << 16;
3144                 listlength |=
3145                     (0xff & (unsigned int)(ld_buff->LUNListLength[2])) << 8;
3146                 listlength |= 0xff & (unsigned int)(ld_buff->LUNListLength[3]);
3147         } else {                /* reading number of logical volumes failed */
3148
3149                 printk(KERN_WARNING "cciss: report logical volume"
3150                        " command failed\n");
3151                 listlength = 0;
3152         }
3153         hba[cntl_num]->num_luns = listlength / 8;       // 8 bytes pre entry
3154         if (hba[cntl_num]->num_luns > CISS_MAX_LUN) {
3155                 printk(KERN_ERR
3156                        "ciss:  only %d number of logical volumes supported\n",
3157                        CISS_MAX_LUN);
3158                 hba[cntl_num]->num_luns = CISS_MAX_LUN;
3159         }
3160 #ifdef CCISS_DEBUG
3161         printk(KERN_DEBUG "Length = %x %x %x %x = %d\n",
3162                ld_buff->LUNListLength[0], ld_buff->LUNListLength[1],
3163                ld_buff->LUNListLength[2], ld_buff->LUNListLength[3],
3164                hba[cntl_num]->num_luns);
3165 #endif                          /* CCISS_DEBUG */
3166
3167         hba[cntl_num]->highest_lun = hba[cntl_num]->num_luns - 1;
3168         for (i = 0; i < CISS_MAX_LUN; i++) {
3169                 if (i < hba[cntl_num]->num_luns) {
3170                         lunid = (0xff & (unsigned int)(ld_buff->LUN[i][3]))
3171                             << 24;
3172                         lunid |= (0xff & (unsigned int)(ld_buff->LUN[i][2]))
3173                             << 16;
3174                         lunid |= (0xff & (unsigned int)(ld_buff->LUN[i][1]))
3175                             << 8;
3176                         lunid |= 0xff & (unsigned int)(ld_buff->LUN[i][0]);
3177
3178                         hba[cntl_num]->drv[i].LunID = lunid;
3179
3180 #ifdef CCISS_DEBUG
3181                         printk(KERN_DEBUG "LUN[%d]:  %x %x %x %x = %x\n", i,
3182                                ld_buff->LUN[i][0], ld_buff->LUN[i][1],
3183                                ld_buff->LUN[i][2], ld_buff->LUN[i][3],
3184                                hba[cntl_num]->drv[i].LunID);
3185 #endif                          /* CCISS_DEBUG */
3186
3187                 /* testing to see if 16-byte CDBs are already being used */
3188                 if(hba[cntl_num]->cciss_read == CCISS_READ_16) {
3189                         cciss_read_capacity_16(cntl_num, i, 0,
3190                                             &total_size, &block_size);
3191                         goto geo_inq;
3192                 }
3193                 cciss_read_capacity(cntl_num, i, 0, &total_size, &block_size);
3194
3195                 /* If read_capacity returns all F's the logical is >2TB */
3196                 /* so we switch to 16-byte CDBs for all read/write ops */
3197                 if(total_size == 0xFFFFFFFFULL) {
3198                         cciss_read_capacity_16(cntl_num, i, 0,
3199                         &total_size, &block_size);
3200                         hba[cntl_num]->cciss_read = CCISS_READ_16;
3201                         hba[cntl_num]->cciss_write = CCISS_WRITE_16;
3202                 } else {
3203                         hba[cntl_num]->cciss_read = CCISS_READ_10;
3204                         hba[cntl_num]->cciss_write = CCISS_WRITE_10;
3205                 }
3206 geo_inq:
3207                         cciss_geometry_inquiry(cntl_num, i, 0, total_size,
3208                                                block_size, inq_buff,
3209                                                &hba[cntl_num]->drv[i]);
3210                 } else {
3211                         /* initialize raid_level to indicate a free space */
3212                         hba[cntl_num]->drv[i].raid_level = -1;
3213                 }
3214         }
3215         kfree(ld_buff);
3216         kfree(inq_buff);
3217 }
3218
3219 /* Function to find the first free pointer into our hba[] array */
3220 /* Returns -1 if no free entries are left.  */
3221 static int alloc_cciss_hba(void)
3222 {
3223         int i;
3224
3225         for (i = 0; i < MAX_CTLR; i++) {
3226                 if (!hba[i]) {
3227                         ctlr_info_t *p;
3228                         p = kzalloc(sizeof(ctlr_info_t), GFP_KERNEL);
3229                         if (!p)
3230                                 goto Enomem;
3231                         p->gendisk[0] = alloc_disk(1 << NWD_SHIFT);
3232                         if (!p->gendisk[0])
3233                                 goto Enomem;
3234                         hba[i] = p;
3235                         return i;
3236                 }
3237         }
3238         printk(KERN_WARNING "cciss: This driver supports a maximum"
3239                " of %d controllers.\n", MAX_CTLR);
3240         return -1;
3241 Enomem:
3242         printk(KERN_ERR "cciss: out of memory.\n");
3243         return -1;
3244 }
3245
3246 static void free_hba(int i)
3247 {
3248         ctlr_info_t *p = hba[i];
3249         int n;
3250
3251         hba[i] = NULL;
3252         for (n = 0; n < CISS_MAX_LUN; n++)
3253                 put_disk(p->gendisk[n]);
3254         kfree(p);
3255 }
3256
3257 /*
3258  *  This is it.  Find all the controllers and register them.  I really hate
3259  *  stealing all these major device numbers.
3260  *  returns the number of block devices registered.
3261  */
3262 static int __devinit cciss_init_one(struct pci_dev *pdev,
3263                                     const struct pci_device_id *ent)
3264 {
3265         int i;
3266         int j = 0;
3267         int rc;
3268         int dac;
3269
3270         i = alloc_cciss_hba();
3271         if (i < 0)
3272                 return -1;
3273
3274         hba[i]->busy_initializing = 1;
3275
3276         if (cciss_pci_init(hba[i], pdev) != 0)
3277                 goto clean1;
3278
3279         sprintf(hba[i]->devname, "cciss%d", i);
3280         hba[i]->ctlr = i;
3281         hba[i]->pdev = pdev;
3282
3283         /* configure PCI DMA stuff */
3284         if (!pci_set_dma_mask(pdev, DMA_64BIT_MASK))
3285                 dac = 1;
3286         else if (!pci_set_dma_mask(pdev, DMA_32BIT_MASK))
3287                 dac = 0;
3288         else {
3289                 printk(KERN_ERR "cciss: no suitable DMA available\n");
3290                 goto clean1;
3291         }
3292
3293         /*
3294          * register with the major number, or get a dynamic major number
3295          * by passing 0 as argument.  This is done for greater than
3296          * 8 controller support.
3297          */
3298         if (i < MAX_CTLR_ORIG)
3299                 hba[i]->major = COMPAQ_CISS_MAJOR + i;
3300         rc = register_blkdev(hba[i]->major, hba[i]->devname);
3301         if (rc == -EBUSY || rc == -EINVAL) {
3302                 printk(KERN_ERR
3303                        "cciss:  Unable to get major number %d for %s "
3304                        "on hba %d\n", hba[i]->major, hba[i]->devname, i);
3305                 goto clean1;
3306         } else {
3307                 if (i >= MAX_CTLR_ORIG)
3308                         hba[i]->major = rc;
3309         }
3310
3311         /* make sure the board interrupts are off */
3312         hba[i]->access.set_intr_mask(hba[i], CCISS_INTR_OFF);
3313         if (request_irq(hba[i]->intr[SIMPLE_MODE_INT], do_cciss_intr,
3314                         IRQF_DISABLED | IRQF_SHARED, hba[i]->devname, hba[i])) {
3315                 printk(KERN_ERR "cciss: Unable to get irq %d for %s\n",
3316                        hba[i]->intr[SIMPLE_MODE_INT], hba[i]->devname);
3317                 goto clean2;
3318         }
3319
3320         printk(KERN_INFO "%s: <0x%x> at PCI %s IRQ %d%s using DAC\n",
3321                hba[i]->devname, pdev->device, pci_name(pdev),
3322                hba[i]->intr[SIMPLE_MODE_INT], dac ? "" : " not");
3323
3324         hba[i]->cmd_pool_bits =
3325             kmalloc(((hba[i]->nr_cmds + BITS_PER_LONG -
3326                       1) / BITS_PER_LONG) * sizeof(unsigned long), GFP_KERNEL);
3327         hba[i]->cmd_pool = (CommandList_struct *)
3328             pci_alloc_consistent(hba[i]->pdev,
3329                     hba[i]->nr_cmds * sizeof(CommandList_struct),
3330                     &(hba[i]->cmd_pool_dhandle));
3331         hba[i]->errinfo_pool = (ErrorInfo_struct *)
3332             pci_alloc_consistent(hba[i]->pdev,
3333                     hba[i]->nr_cmds * sizeof(ErrorInfo_struct),
3334                     &(hba[i]->errinfo_pool_dhandle));
3335         if ((hba[i]->cmd_pool_bits == NULL)
3336             || (hba[i]->cmd_pool == NULL)
3337             || (hba[i]->errinfo_pool == NULL)) {
3338                 printk(KERN_ERR "cciss: out of memory");
3339                 goto clean4;
3340         }
3341 #ifdef CONFIG_CISS_SCSI_TAPE
3342         hba[i]->scsi_rejects.complete =
3343             kmalloc(sizeof(hba[i]->scsi_rejects.complete[0]) *
3344                     (hba[i]->nr_cmds + 5), GFP_KERNEL);
3345         if (hba[i]->scsi_rejects.complete == NULL) {
3346                 printk(KERN_ERR "cciss: out of memory");
3347                 goto clean4;
3348         }
3349 #endif
3350         spin_lock_init(&hba[i]->lock);
3351
3352         /* Initialize the pdev driver private data.
3353            have it point to hba[i].  */
3354         pci_set_drvdata(pdev, hba[i]);
3355         /* command and error info recs zeroed out before
3356            they are used */
3357         memset(hba[i]->cmd_pool_bits, 0,
3358                ((hba[i]->nr_cmds + BITS_PER_LONG -
3359                  1) / BITS_PER_LONG) * sizeof(unsigned long));
3360
3361 #ifdef CCISS_DEBUG
3362         printk(KERN_DEBUG "Scanning for drives on controller cciss%d\n", i);
3363 #endif                          /* CCISS_DEBUG */
3364
3365         cciss_getgeometry(i);
3366
3367         cciss_scsi_setup(i);
3368
3369         /* Turn the interrupts on so we can service requests */
3370         hba[i]->access.set_intr_mask(hba[i], CCISS_INTR_ON);
3371
3372         cciss_procinit(i);
3373
3374         hba[i]->cciss_max_sectors = 2048;
3375
3376         hba[i]->busy_initializing = 0;
3377
3378         do {
3379                 drive_info_struct *drv = &(hba[i]->drv[j]);
3380                 struct gendisk *disk = hba[i]->gendisk[j];
3381                 request_queue_t *q;
3382
3383                 /* Check if the disk was allocated already */
3384                 if (!disk){
3385                         hba[i]->gendisk[j] = alloc_disk(1 << NWD_SHIFT);
3386                         disk = hba[i]->gendisk[j];
3387                 }
3388
3389                 /* Check that the disk was able to be allocated */
3390                 if (!disk) {
3391                         printk(KERN_ERR "cciss: unable to allocate memory for disk %d\n", j);
3392                         goto clean4;
3393                 }
3394
3395                 q = blk_init_queue(do_cciss_request, &hba[i]->lock);
3396                 if (!q) {
3397                         printk(KERN_ERR
3398                                "cciss:  unable to allocate queue for disk %d\n",
3399                                j);
3400                         goto clean4;
3401                 }
3402                 drv->queue = q;
3403
3404                 q->backing_dev_info.ra_pages = READ_AHEAD;
3405                 blk_queue_bounce_limit(q, hba[i]->pdev->dma_mask);
3406
3407                 /* This is a hardware imposed limit. */
3408                 blk_queue_max_hw_segments(q, MAXSGENTRIES);
3409
3410                 /* This is a limit in the driver and could be eliminated. */
3411                 blk_queue_max_phys_segments(q, MAXSGENTRIES);
3412
3413                 blk_queue_max_sectors(q, hba[i]->cciss_max_sectors);
3414
3415                 blk_queue_softirq_done(q, cciss_softirq_done);
3416
3417                 q->queuedata = hba[i];
3418                 sprintf(disk->disk_name, "cciss/c%dd%d", i, j);
3419                 disk->major = hba[i]->major;
3420                 disk->first_minor = j << NWD_SHIFT;
3421                 disk->fops = &cciss_fops;
3422                 disk->queue = q;
3423                 disk->private_data = drv;
3424                 disk->driverfs_dev = &pdev->dev;
3425                 /* we must register the controller even if no disks exist */
3426                 /* this is for the online array utilities */
3427                 if (!drv->heads && j)
3428                         continue;
3429                 blk_queue_hardsect_size(q, drv->block_size);
3430                 set_capacity(disk, drv->nr_blocks);
3431                 add_disk(disk);
3432                 j++;
3433         } while (j <= hba[i]->highest_lun);
3434
3435         return 1;
3436
3437       clean4:
3438 #ifdef CONFIG_CISS_SCSI_TAPE
3439         kfree(hba[i]->scsi_rejects.complete);
3440 #endif
3441         kfree(hba[i]->cmd_pool_bits);
3442         if (hba[i]->cmd_pool)
3443                 pci_free_consistent(hba[i]->pdev,
3444                                     hba[i]->nr_cmds * sizeof(CommandList_struct),
3445                                     hba[i]->cmd_pool, hba[i]->cmd_pool_dhandle);
3446         if (hba[i]->errinfo_pool)
3447                 pci_free_consistent(hba[i]->pdev,
3448                                     hba[i]->nr_cmds * sizeof(ErrorInfo_struct),
3449                                     hba[i]->errinfo_pool,
3450                                     hba[i]->errinfo_pool_dhandle);
3451         free_irq(hba[i]->intr[SIMPLE_MODE_INT], hba[i]);
3452       clean2:
3453         unregister_blkdev(hba[i]->major, hba[i]->devname);
3454       clean1:
3455         hba[i]->busy_initializing = 0;
3456         /* cleanup any queues that may have been initialized */
3457         for (j=0; j <= hba[i]->highest_lun; j++){
3458                 drive_info_struct *drv = &(hba[i]->drv[j]);
3459                 if (drv->queue)
3460                         blk_cleanup_queue(drv->queue);
3461         }
3462         /*
3463          * Deliberately omit pci_disable_device(): it does something nasty to
3464          * Smart Array controllers that pci_enable_device does not undo
3465          */
3466         pci_release_regions(pdev);
3467         pci_set_drvdata(pdev, NULL);
3468         free_hba(i);
3469         return -1;
3470 }
3471
3472 static void cciss_remove_one(struct pci_dev *pdev)
3473 {
3474         ctlr_info_t *tmp_ptr;
3475         int i, j;
3476         char flush_buf[4];
3477         int return_code;
3478
3479         if (pci_get_drvdata(pdev) == NULL) {
3480                 printk(KERN_ERR "cciss: Unable to remove device \n");
3481                 return;
3482         }
3483         tmp_ptr = pci_get_drvdata(pdev);
3484         i = tmp_ptr->ctlr;
3485         if (hba[i] == NULL) {
3486                 printk(KERN_ERR "cciss: device appears to "
3487                        "already be removed \n");
3488                 return;
3489         }
3490
3491         remove_proc_entry(hba[i]->devname, proc_cciss);
3492         unregister_blkdev(hba[i]->major, hba[i]->devname);
3493
3494         /* remove it from the disk list */
3495         for (j = 0; j < CISS_MAX_LUN; j++) {
3496                 struct gendisk *disk = hba[i]->gendisk[j];
3497                 if (disk) {
3498                         request_queue_t *q = disk->queue;
3499
3500                         if (disk->flags & GENHD_FL_UP)
3501                                 del_gendisk(disk);
3502                         if (q)
3503                                 blk_cleanup_queue(q);
3504                 }
3505         }
3506
3507         cciss_unregister_scsi(i);       /* unhook from SCSI subsystem */
3508
3509         /* Turn board interrupts off  and send the flush cache command */
3510         /* sendcmd will turn off interrupt, and send the flush...
3511          * To write all data in the battery backed cache to disks */
3512         memset(flush_buf, 0, 4);
3513         return_code = sendcmd(CCISS_CACHE_FLUSH, i, flush_buf, 4, 0, 0, 0, NULL,
3514                               TYPE_CMD);
3515         if (return_code == IO_OK) {
3516                 printk(KERN_INFO "Completed flushing cache on controller %d\n", i);
3517         } else {
3518                 printk(KERN_WARNING "Error flushing cache on controller %d\n", i);
3519         }
3520         free_irq(hba[i]->intr[2], hba[i]);
3521
3522 #ifdef CONFIG_PCI_MSI
3523         if (hba[i]->msix_vector)
3524                 pci_disable_msix(hba[i]->pdev);
3525         else if (hba[i]->msi_vector)
3526                 pci_disable_msi(hba[i]->pdev);
3527 #endif                          /* CONFIG_PCI_MSI */
3528
3529         iounmap(hba[i]->vaddr);
3530
3531         pci_free_consistent(hba[i]->pdev, hba[i]->nr_cmds * sizeof(CommandList_struct),
3532                             hba[i]->cmd_pool, hba[i]->cmd_pool_dhandle);
3533         pci_free_consistent(hba[i]->pdev, hba[i]->nr_cmds * sizeof(ErrorInfo_struct),
3534                             hba[i]->errinfo_pool, hba[i]->errinfo_pool_dhandle);
3535         kfree(hba[i]->cmd_pool_bits);
3536 #ifdef CONFIG_CISS_SCSI_TAPE
3537         kfree(hba[i]->scsi_rejects.complete);
3538 #endif
3539         /*
3540          * Deliberately omit pci_disable_device(): it does something nasty to
3541          * Smart Array controllers that pci_enable_device does not undo
3542          */
3543         pci_release_regions(pdev);
3544         pci_set_drvdata(pdev, NULL);
3545         free_hba(i);
3546 }
3547
3548 static struct pci_driver cciss_pci_driver = {
3549         .name = "cciss",
3550         .probe = cciss_init_one,
3551         .remove = __devexit_p(cciss_remove_one),
3552         .id_table = cciss_pci_device_id,        /* id_table */
3553         .shutdown = cciss_remove_one,
3554 };
3555
3556 /*
3557  *  This is it.  Register the PCI driver information for the cards we control
3558  *  the OS will call our registered routines when it finds one of our cards.
3559  */
3560 static int __init cciss_init(void)
3561 {
3562         printk(KERN_INFO DRIVER_NAME "\n");
3563
3564         /* Register for our PCI devices */
3565         return pci_register_driver(&cciss_pci_driver);
3566 }
3567
3568 static void __exit cciss_cleanup(void)
3569 {
3570         int i;
3571
3572         pci_unregister_driver(&cciss_pci_driver);
3573         /* double check that all controller entrys have been removed */
3574         for (i = 0; i < MAX_CTLR; i++) {
3575                 if (hba[i] != NULL) {
3576                         printk(KERN_WARNING "cciss: had to remove"
3577                                " controller %d\n", i);
3578                         cciss_remove_one(hba[i]->pdev);
3579                 }
3580         }
3581         remove_proc_entry("cciss", proc_root_driver);
3582 }
3583
3584 static void fail_all_cmds(unsigned long ctlr)
3585 {
3586         /* If we get here, the board is apparently dead. */
3587         ctlr_info_t *h = hba[ctlr];
3588         CommandList_struct *c;
3589         unsigned long flags;
3590
3591         printk(KERN_WARNING "cciss%d: controller not responding.\n", h->ctlr);
3592         h->alive = 0;           /* the controller apparently died... */
3593
3594         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
3595
3596         pci_disable_device(h->pdev);    /* Make sure it is really dead. */
3597
3598         /* move everything off the request queue onto the completed queue */
3599         while ((c = h->reqQ) != NULL) {
3600                 removeQ(&(h->reqQ), c);
3601                 h->Qdepth--;
3602                 addQ(&(h->cmpQ), c);
3603         }
3604
3605         /* Now, fail everything on the completed queue with a HW error */
3606         while ((c = h->cmpQ) != NULL) {
3607                 removeQ(&h->cmpQ, c);
3608                 c->err_info->CommandStatus = CMD_HARDWARE_ERR;
3609                 if (c->cmd_type == CMD_RWREQ) {
3610                         complete_command(h, c, 0);
3611                 } else if (c->cmd_type == CMD_IOCTL_PEND)
3612                         complete(c->waiting);
3613 #ifdef CONFIG_CISS_SCSI_TAPE
3614                 else if (c->cmd_type == CMD_SCSI)
3615                         complete_scsi_command(c, 0, 0);
3616 #endif
3617         }
3618         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
3619         return;
3620 }
3621
3622 module_init(cciss_init);
3623 module_exit(cciss_cleanup);