drivers/block/cciss.c

   1 /*
   2  *    Disk Array driver for HP SA 5xxx and 6xxx Controllers
   3  *    Copyright 2000, 2006 Hewlett-Packard Development Company, L.P.
   4  *
   5  *    This program is free software; you can redistribute it and/or modify
   6  *    it under the terms of the GNU General Public License as published by
   7  *    the Free Software Foundation; either version 2 of the License, or
   8  *    (at your option) any later version.
   9  *
  10  *    This program is distributed in the hope that it will be useful,
  11  *    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  *    MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
  13  *    NON INFRINGEMENT.  See the GNU General Public License for more details.
  14  *
  15  *    You should have received a copy of the GNU General Public License
  16  *    along with this program; if not, write to the Free Software
  17  *    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  18  *
  19  *    Questions/Comments/Bugfixes to iss_storagedev@hp.com
  20  *
  21  */
  22
  23 #include <linux/module.h>
  24 #include <linux/interrupt.h>
  25 #include <linux/types.h>
  26 #include <linux/pci.h>
  27 #include <linux/kernel.h>
  28 #include <linux/slab.h>
  29 #include <linux/delay.h>
  30 #include <linux/major.h>
  31 #include <linux/fs.h>
  32 #include <linux/bio.h>
  33 #include <linux/blkpg.h>
  34 #include <linux/timer.h>
  35 #include <linux/proc_fs.h>
  36 #include <linux/init.h>
  37 #include <linux/hdreg.h>
  38 #include <linux/spinlock.h>
  39 #include <linux/compat.h>
  40 #include <linux/blktrace_api.h>
  41 #include <asm/uaccess.h>
  42 #include <asm/io.h>
  43
  44 #include <linux/dma-mapping.h>
  45 #include <linux/blkdev.h>
  46 #include <linux/genhd.h>
  47 #include <linux/completion.h>
  48
  49 #define CCISS_DRIVER_VERSION(maj,min,submin) ((maj<<16)|(min<<8)|(submin))
  50 #define DRIVER_NAME "HP CISS Driver (v 3.6.14)"
  51 #define DRIVER_VERSION CCISS_DRIVER_VERSION(3,6,14)
  52
  53 /* Embedded module documentation macros - see modules.h */
  54 MODULE_AUTHOR("Hewlett-Packard Company");
  55 MODULE_DESCRIPTION("Driver for HP Controller SA5xxx SA6xxx version 3.6.14");
  56 MODULE_SUPPORTED_DEVICE("HP SA5i SA5i+ SA532 SA5300 SA5312 SA641 SA642 SA6400"
  57                         " SA6i P600 P800 P400 P400i E200 E200i E500");
  58 MODULE_VERSION("3.6.14");
  59 MODULE_LICENSE("GPL");
  60 MODULE_VERSION("2.6.8");
  61
  62 #include "cciss_cmd.h"
  63 #include "cciss.h"
  64 #include <linux/cciss_ioctl.h>
  65
  66 /* define the PCI info for the cards we can control */
  67 static const struct pci_device_id cciss_pci_device_id[] = {
  68         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISS,  0x0E11, 0x4070},
  69         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSB, 0x0E11, 0x4080},
  70         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSB, 0x0E11, 0x4082},
  71         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSB, 0x0E11, 0x4083},
  72         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x4091},
  73         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x409A},
  74         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x409B},
  75         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x409C},
  76         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x409D},
  77         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSA,     0x103C, 0x3225},
  78         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3223},
  79         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3234},
  80         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3235},
  81         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3211},
  82         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3212},
  83         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3213},
  84         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3214},
  85         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3215},
  86         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3237},
  87         {PCI_VENDOR_ID_HP,     PCI_ANY_ID,      PCI_ANY_ID, PCI_ANY_ID,
  88                 PCI_CLASS_STORAGE_RAID << 8, 0xffff << 8, 0},
  89         {0,}
  90 };
  91
  92 MODULE_DEVICE_TABLE(pci, cciss_pci_device_id);
  93
  94 /*  board_id = Subsystem Device ID & Vendor ID
  95  *  product = Marketing Name for the board
  96  *  access = Address of the struct of function pointers
  97  *  nr_cmds = Number of commands supported by controller
  98  */
  99 static struct board_type products[] = {
 100         {0x40700E11, "Smart Array 5300", &SA5_access, 512},
 101         {0x40800E11, "Smart Array 5i", &SA5B_access, 512},
 102         {0x40820E11, "Smart Array 532", &SA5B_access, 512},
 103         {0x40830E11, "Smart Array 5312", &SA5B_access, 512},
 104         {0x409A0E11, "Smart Array 641", &SA5_access, 512},
 105         {0x409B0E11, "Smart Array 642", &SA5_access, 512},
 106         {0x409C0E11, "Smart Array 6400", &SA5_access, 512},
 107         {0x409D0E11, "Smart Array 6400 EM", &SA5_access, 512},
 108         {0x40910E11, "Smart Array 6i", &SA5_access, 512},
 109         {0x3225103C, "Smart Array P600", &SA5_access, 512},
 110         {0x3223103C, "Smart Array P800", &SA5_access, 512},
 111         {0x3234103C, "Smart Array P400", &SA5_access, 512},
 112         {0x3235103C, "Smart Array P400i", &SA5_access, 512},
 113         {0x3211103C, "Smart Array E200i", &SA5_access, 120},
 114         {0x3212103C, "Smart Array E200", &SA5_access, 120},
 115         {0x3213103C, "Smart Array E200i", &SA5_access, 120},
 116         {0x3214103C, "Smart Array E200i", &SA5_access, 120},
 117         {0x3215103C, "Smart Array E200i", &SA5_access, 120},
 118         {0x3237103C, "Smart Array E500", &SA5_access, 512},
 119         {0xFFFF103C, "Unknown Smart Array", &SA5_access, 120},
 120 };
 121
 122 /* How long to wait (in milliseconds) for board to go into simple mode */
 123 #define MAX_CONFIG_WAIT 30000
 124 #define MAX_IOCTL_CONFIG_WAIT 1000
 125
 126 /*define how many times we will try a command because of bus resets */
 127 #define MAX_CMD_RETRIES 3
 128
 129 #define READ_AHEAD       1024
 130 #define MAX_CTLR        32
 131
 132 /* Originally cciss driver only supports 8 major numbers */
 133 #define MAX_CTLR_ORIG   8
 134
 135 static ctlr_info_t *hba[MAX_CTLR];
 136
 137 static void do_cciss_request(request_queue_t *q);
 138 static irqreturn_t do_cciss_intr(int irq, void *dev_id);
 139 static int cciss_open(struct inode *inode, struct file *filep);
 140 static int cciss_release(struct inode *inode, struct file *filep);
 141 static int cciss_ioctl(struct inode *inode, struct file *filep,
 142                        unsigned int cmd, unsigned long arg);
 143 static int cciss_getgeo(struct block_device *bdev, struct hd_geometry *geo);
 144
 145 static int cciss_revalidate(struct gendisk *disk);
 146 static int rebuild_lun_table(ctlr_info_t *h, struct gendisk *del_disk);
 147 static int deregister_disk(struct gendisk *disk, drive_info_struct *drv,
 148                            int clear_all);
 149
 150 static void cciss_read_capacity(int ctlr, int logvol, int withirq,
 151                         sector_t *total_size, unsigned int *block_size);
 152 static void cciss_read_capacity_16(int ctlr, int logvol, int withirq,
 153                         sector_t *total_size, unsigned int *block_size);
 154 static void cciss_geometry_inquiry(int ctlr, int logvol,
 155                         int withirq, sector_t total_size,
 156                         unsigned int block_size, InquiryData_struct *inq_buff,
 157                                    drive_info_struct *drv);
 158 static void cciss_getgeometry(int cntl_num);
 159 static void __devinit cciss_interrupt_mode(ctlr_info_t *, struct pci_dev *,
 160                                            __u32);
 161 static void start_io(ctlr_info_t *h);
 162 static int sendcmd(__u8 cmd, int ctlr, void *buff, size_t size,
 163                    unsigned int use_unit_num, unsigned int log_unit,
 164                    __u8 page_code, unsigned char *scsi3addr, int cmd_type);
 165 static int sendcmd_withirq(__u8 cmd, int ctlr, void *buff, size_t size,
 166                            unsigned int use_unit_num, unsigned int log_unit,
 167                            __u8 page_code, int cmd_type);
 168
 169 static void fail_all_cmds(unsigned long ctlr);
 170
 171 #ifdef CONFIG_PROC_FS
 172 static int cciss_proc_get_info(char *buffer, char **start, off_t offset,
 173                                int length, int *eof, void *data);
 174 static void cciss_procinit(int i);
 175 #else
 176 static void cciss_procinit(int i)
 177 {
 178 }
 179 #endif                          /* CONFIG_PROC_FS */
 180
 181 #ifdef CONFIG_COMPAT
 182 static long cciss_compat_ioctl(struct file *f, unsigned cmd, unsigned long arg);
 183 #endif
 184
 185 static struct block_device_operations cciss_fops = {
 186         .owner = THIS_MODULE,
 187         .open = cciss_open,
 188         .release = cciss_release,
 189         .ioctl = cciss_ioctl,
 190         .getgeo = cciss_getgeo,
 191 #ifdef CONFIG_COMPAT
 192         .compat_ioctl = cciss_compat_ioctl,
 193 #endif
 194         .revalidate_disk = cciss_revalidate,
 195 };
 196
 197 /*
 198  * Enqueuing and dequeuing functions for cmdlists.
 199  */
 200 static inline void addQ(CommandList_struct **Qptr, CommandList_struct *c)
 201 {
 202         if (*Qptr == NULL) {
 203                 *Qptr = c;
 204                 c->next = c->prev = c;
 205         } else {
 206                 c->prev = (*Qptr)->prev;
 207                 c->next = (*Qptr);
 208                 (*Qptr)->prev->next = c;
 209                 (*Qptr)->prev = c;
 210         }
 211 }
 212
 213 static inline CommandList_struct *removeQ(CommandList_struct **Qptr,
 214                                           CommandList_struct *c)
 215 {
 216         if (c && c->next != c) {
 217                 if (*Qptr == c)
 218                         *Qptr = c->next;
 219                 c->prev->next = c->next;
 220                 c->next->prev = c->prev;
 221         } else {
 222                 *Qptr = NULL;
 223         }
 224         return c;
 225 }
 226
 227 #include "cciss_scsi.c"         /* For SCSI tape support */
 228
 229 #define RAID_UNKNOWN 6
 230
 231 #ifdef CONFIG_PROC_FS
 232
 233 /*
 234  * Report information about this controller.
 235  */
 236 #define ENG_GIG 1000000000
 237 #define ENG_GIG_FACTOR (ENG_GIG/512)
 238 static const char *raid_label[] = { "0", "4", "1(1+0)", "5", "5+1", "ADG",
 239         "UNKNOWN"
 240 };
 241
 242 static struct proc_dir_entry *proc_cciss;
 243
 244 static int cciss_proc_get_info(char *buffer, char **start, off_t offset,
 245                                int length, int *eof, void *data)
 246 {
 247         off_t pos = 0;
 248         off_t len = 0;
 249         int size, i, ctlr;
 250         ctlr_info_t *h = (ctlr_info_t *) data;
 251         drive_info_struct *drv;
 252         unsigned long flags;
 253         sector_t vol_sz, vol_sz_frac;
 254
 255         ctlr = h->ctlr;
 256
 257         /* prevent displaying bogus info during configuration
 258          * or deconfiguration of a logical volume
 259          */
 260         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
 261         if (h->busy_configuring) {
 262                 spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
 263                 return -EBUSY;
 264         }
 265         h->busy_configuring = 1;
 266         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
 267
 268         size = sprintf(buffer, "%s: HP %s Controller\n"
 269                        "Board ID: 0x%08lx\n"
 270                        "Firmware Version: %c%c%c%c\n"
 271                        "IRQ: %d\n"
 272                        "Logical drives: %d\n"
 273                        "Max sectors: %d\n"
 274                        "Current Q depth: %d\n"
 275                        "Current # commands on controller: %d\n"
 276                        "Max Q depth since init: %d\n"
 277                        "Max # commands on controller since init: %d\n"
 278                        "Max SG entries since init: %d\n\n",
 279                        h->devname,
 280                        h->product_name,
 281                        (unsigned long)h->board_id,
 282                        h->firm_ver[0], h->firm_ver[1], h->firm_ver[2],
 283                        h->firm_ver[3], (unsigned int)h->intr[SIMPLE_MODE_INT],
 284                        h->num_luns,
 285                        h->cciss_max_sectors,
 286                        h->Qdepth, h->commands_outstanding,
 287                        h->maxQsinceinit, h->max_outstanding, h->maxSG);
 288
 289         pos += size;
 290         len += size;
 291         cciss_proc_tape_report(ctlr, buffer, &pos, &len);
 292         for (i = 0; i <= h->highest_lun; i++) {
 293
 294                 drv = &h->drv[i];
 295                 if (drv->heads == 0)
 296                         continue;
 297
 298                 vol_sz = drv->nr_blocks;
 299                 vol_sz_frac = sector_div(vol_sz, ENG_GIG_FACTOR);
 300                 vol_sz_frac *= 100;
 301                 sector_div(vol_sz_frac, ENG_GIG_FACTOR);
 302
 303                 if (drv->raid_level > 5)
 304                         drv->raid_level = RAID_UNKNOWN;
 305                 size = sprintf(buffer + len, "cciss/c%dd%d:"
 306                                "\t%4u.%02uGB\tRAID %s\n",
 307                                ctlr, i, (int)vol_sz, (int)vol_sz_frac,
 308                                raid_label[drv->raid_level]);
 309                 pos += size;
 310                 len += size;
 311         }
 312
 313         *eof = 1;
 314         *start = buffer + offset;
 315         len -= offset;
 316         if (len > length)
 317                 len = length;
 318         h->busy_configuring = 0;
 319         return len;
 320 }
 321
 322 static int
 323 cciss_proc_write(struct file *file, const char __user *buffer,
 324                  unsigned long count, void *data)
 325 {
 326         unsigned char cmd[80];
 327         int len;
 328 #ifdef CONFIG_CISS_SCSI_TAPE
 329         ctlr_info_t *h = (ctlr_info_t *) data;
 330         int rc;
 331 #endif
 332
 333         if (count > sizeof(cmd) - 1)
 334                 return -EINVAL;
 335         if (copy_from_user(cmd, buffer, count))
 336                 return -EFAULT;
 337         cmd[count] = '\0';
 338         len = strlen(cmd);      // above 3 lines ensure safety
 339         if (len && cmd[len - 1] == '\n')
 340                 cmd[--len] = '\0';
 341 #       ifdef CONFIG_CISS_SCSI_TAPE
 342         if (strcmp("engage scsi", cmd) == 0) {
 343                 rc = cciss_engage_scsi(h->ctlr);
 344                 if (rc != 0)
 345                         return -rc;
 346                 return count;
 347         }
 348         /* might be nice to have "disengage" too, but it's not
 349            safely possible. (only 1 module use count, lock issues.) */
 350 #       endif
 351         return -EINVAL;
 352 }
 353
 354 /*
 355  * Get us a file in /proc/cciss that says something about each controller.
 356  * Create /proc/cciss if it doesn't exist yet.
 357  */
 358 static void __devinit cciss_procinit(int i)
 359 {
 360         struct proc_dir_entry *pde;
 361
 362         if (proc_cciss == NULL) {
 363                 proc_cciss = proc_mkdir("cciss", proc_root_driver);
 364                 if (!proc_cciss)
 365                         return;
 366         }
 367
 368         pde = create_proc_read_entry(hba[i]->devname,
 369                                      S_IWUSR | S_IRUSR | S_IRGRP | S_IROTH,
 370                                      proc_cciss, cciss_proc_get_info, hba[i]);
 371         pde->write_proc = cciss_proc_write;
 372 }
 373 #endif                          /* CONFIG_PROC_FS */
 374
 375 /*
 376  * For operations that cannot sleep, a command block is allocated at init,
 377  * and managed by cmd_alloc() and cmd_free() using a simple bitmap to track
 378  * which ones are free or in use.  For operations that can wait for kmalloc
 379  * to possible sleep, this routine can be called with get_from_pool set to 0.
 380  * cmd_free() MUST be called with a got_from_pool set to 0 if cmd_alloc was.
 381  */
 382 static CommandList_struct *cmd_alloc(ctlr_info_t *h, int get_from_pool)
 383 {
 384         CommandList_struct *c;
 385         int i;
 386         u64bit temp64;
 387         dma_addr_t cmd_dma_handle, err_dma_handle;
 388
 389         if (!get_from_pool) {
 390                 c = (CommandList_struct *) pci_alloc_consistent(h->pdev,
 391                         sizeof(CommandList_struct), &cmd_dma_handle);
 392                 if (c == NULL)
 393                         return NULL;
 394                 memset(c, 0, sizeof(CommandList_struct));
 395
 396                 c->cmdindex = -1;
 397
 398                 c->err_info = (ErrorInfo_struct *)
 399                     pci_alloc_consistent(h->pdev, sizeof(ErrorInfo_struct),
 400                             &err_dma_handle);
 401
 402                 if (c->err_info == NULL) {
 403                         pci_free_consistent(h->pdev,
 404                                 sizeof(CommandList_struct), c, cmd_dma_handle);
 405                         return NULL;
 406                 }
 407                 memset(c->err_info, 0, sizeof(ErrorInfo_struct));
 408         } else {                /* get it out of the controllers pool */
 409
 410                 do {
 411                         i = find_first_zero_bit(h->cmd_pool_bits, h->nr_cmds);
 412                         if (i == h->nr_cmds)
 413                                 return NULL;
 414                 } while (test_and_set_bit
 415                          (i & (BITS_PER_LONG - 1),
 416                           h->cmd_pool_bits + (i / BITS_PER_LONG)) != 0);
 417 #ifdef CCISS_DEBUG
 418                 printk(KERN_DEBUG "cciss: using command buffer %d\n", i);
 419 #endif
 420                 c = h->cmd_pool + i;
 421                 memset(c, 0, sizeof(CommandList_struct));
 422                 cmd_dma_handle = h->cmd_pool_dhandle
 423                     + i * sizeof(CommandList_struct);
 424                 c->err_info = h->errinfo_pool + i;
 425                 memset(c->err_info, 0, sizeof(ErrorInfo_struct));
 426                 err_dma_handle = h->errinfo_pool_dhandle
 427                     + i * sizeof(ErrorInfo_struct);
 428                 h->nr_allocs++;
 429
 430                 c->cmdindex = i;
 431         }
 432
 433         c->busaddr = (__u32) cmd_dma_handle;
 434         temp64.val = (__u64) err_dma_handle;
 435         c->ErrDesc.Addr.lower = temp64.val32.lower;
 436         c->ErrDesc.Addr.upper = temp64.val32.upper;
 437         c->ErrDesc.Len = sizeof(ErrorInfo_struct);
 438
 439         c->ctlr = h->ctlr;
 440         return c;
 441 }
 442
 443 /*
 444  * Frees a command block that was previously allocated with cmd_alloc().
 445  */
 446 static void cmd_free(ctlr_info_t *h, CommandList_struct *c, int got_from_pool)
 447 {
 448         int i;
 449         u64bit temp64;
 450
 451         if (!got_from_pool) {
 452                 temp64.val32.lower = c->ErrDesc.Addr.lower;
 453                 temp64.val32.upper = c->ErrDesc.Addr.upper;
 454                 pci_free_consistent(h->pdev, sizeof(ErrorInfo_struct),
 455                                     c->err_info, (dma_addr_t) temp64.val);
 456                 pci_free_consistent(h->pdev, sizeof(CommandList_struct),
 457                                     c, (dma_addr_t) c->busaddr);
 458         } else {
 459                 i = c - h->cmd_pool;
 460                 clear_bit(i & (BITS_PER_LONG - 1),
 461                           h->cmd_pool_bits + (i / BITS_PER_LONG));
 462                 h->nr_frees++;
 463         }
 464 }
 465
 466 static inline ctlr_info_t *get_host(struct gendisk *disk)
 467 {
 468         return disk->queue->queuedata;
 469 }
 470
 471 static inline drive_info_struct *get_drv(struct gendisk *disk)
 472 {
 473         return disk->private_data;
 474 }
 475
 476 /*
 477  * Open.  Make sure the device is really there.
 478  */
 479 static int cciss_open(struct inode *inode, struct file *filep)
 480 {
 481         ctlr_info_t *host = get_host(inode->i_bdev->bd_disk);
 482         drive_info_struct *drv = get_drv(inode->i_bdev->bd_disk);
 483
 484 #ifdef CCISS_DEBUG
 485         printk(KERN_DEBUG "cciss_open %s\n", inode->i_bdev->bd_disk->disk_name);
 486 #endif                          /* CCISS_DEBUG */
 487
 488         if (host->busy_initializing || drv->busy_configuring)
 489                 return -EBUSY;
 490         /*
 491          * Root is allowed to open raw volume zero even if it's not configured
 492          * so array config can still work. Root is also allowed to open any
 493          * volume that has a LUN ID, so it can issue IOCTL to reread the
 494          * disk information.  I don't think I really like this
 495          * but I'm already using way to many device nodes to claim another one
 496          * for "raw controller".
 497          */
 498         if (drv->heads == 0) {
 499                 if (iminor(inode) != 0) {       /* not node 0? */
 500                         /* if not node 0 make sure it is a partition = 0 */
 501                         if (iminor(inode) & 0x0f) {
 502                                 return -ENXIO;
 503                                 /* if it is, make sure we have a LUN ID */
 504                         } else if (drv->LunID == 0) {
 505                                 return -ENXIO;
 506                         }
 507                 }
 508                 if (!capable(CAP_SYS_ADMIN))
 509                         return -EPERM;
 510         }
 511         drv->usage_count++;
 512         host->usage_count++;
 513         return 0;
 514 }
 515
 516 /*
 517  * Close.  Sync first.
 518  */
 519 static int cciss_release(struct inode *inode, struct file *filep)
 520 {
 521         ctlr_info_t *host = get_host(inode->i_bdev->bd_disk);
 522         drive_info_struct *drv = get_drv(inode->i_bdev->bd_disk);
 523
 524 #ifdef CCISS_DEBUG
 525         printk(KERN_DEBUG "cciss_release %s\n",
 526                inode->i_bdev->bd_disk->disk_name);
 527 #endif                          /* CCISS_DEBUG */
 528
 529         drv->usage_count--;
 530         host->usage_count--;
 531         return 0;
 532 }
 533
 534 #ifdef CONFIG_COMPAT
 535
 536 static int do_ioctl(struct file *f, unsigned cmd, unsigned long arg)
 537 {
 538         int ret;
 539         lock_kernel();
 540         ret = cciss_ioctl(f->f_path.dentry->d_inode, f, cmd, arg);
 541         unlock_kernel();
 542         return ret;
 543 }
 544
 545 static int cciss_ioctl32_passthru(struct file *f, unsigned cmd,
 546                                   unsigned long arg);
 547 static int cciss_ioctl32_big_passthru(struct file *f, unsigned cmd,
 548                                       unsigned long arg);
 549
 550 static long cciss_compat_ioctl(struct file *f, unsigned cmd, unsigned long arg)
 551 {
 552         switch (cmd) {
 553         case CCISS_GETPCIINFO:
 554         case CCISS_GETINTINFO:
 555         case CCISS_SETINTINFO:
 556         case CCISS_GETNODENAME:
 557         case CCISS_SETNODENAME:
 558         case CCISS_GETHEARTBEAT:
 559         case CCISS_GETBUSTYPES:
 560         case CCISS_GETFIRMVER:
 561         case CCISS_GETDRIVVER:
 562         case CCISS_REVALIDVOLS:
 563         case CCISS_DEREGDISK:
 564         case CCISS_REGNEWDISK:
 565         case CCISS_REGNEWD:
 566         case CCISS_RESCANDISK:
 567         case CCISS_GETLUNINFO:
 568                 return do_ioctl(f, cmd, arg);
 569
 570         case CCISS_PASSTHRU32:
 571                 return cciss_ioctl32_passthru(f, cmd, arg);
 572         case CCISS_BIG_PASSTHRU32:
 573                 return cciss_ioctl32_big_passthru(f, cmd, arg);
 574
 575         default:
 576                 return -ENOIOCTLCMD;
 577         }
 578 }
 579
 580 static int cciss_ioctl32_passthru(struct file *f, unsigned cmd,
 581                                   unsigned long arg)
 582 {
 583         IOCTL32_Command_struct __user *arg32 =
 584             (IOCTL32_Command_struct __user *) arg;
 585         IOCTL_Command_struct arg64;
 586         IOCTL_Command_struct __user *p = compat_alloc_user_space(sizeof(arg64));
 587         int err;
 588         u32 cp;
 589
 590         err = 0;
 591         err |=
 592             copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
 593                            sizeof(arg64.LUN_info));
 594         err |=
 595             copy_from_user(&arg64.Request, &arg32->Request,
 596                            sizeof(arg64.Request));
 597         err |=
 598             copy_from_user(&arg64.error_info, &arg32->error_info,
 599                            sizeof(arg64.error_info));
 600         err |= get_user(arg64.buf_size, &arg32->buf_size);
 601         err |= get_user(cp, &arg32->buf);
 602         arg64.buf = compat_ptr(cp);
 603         err |= copy_to_user(p, &arg64, sizeof(arg64));
 604
 605         if (err)
 606                 return -EFAULT;
 607
 608         err = do_ioctl(f, CCISS_PASSTHRU, (unsigned long)p);
 609         if (err)
 610                 return err;
 611         err |=
 612             copy_in_user(&arg32->error_info, &p->error_info,
 613                          sizeof(arg32->error_info));
 614         if (err)
 615                 return -EFAULT;
 616         return err;
 617 }
 618
 619 static int cciss_ioctl32_big_passthru(struct file *file, unsigned cmd,
 620                                       unsigned long arg)
 621 {
 622         BIG_IOCTL32_Command_struct __user *arg32 =
 623             (BIG_IOCTL32_Command_struct __user *) arg;
 624         BIG_IOCTL_Command_struct arg64;
 625         BIG_IOCTL_Command_struct __user *p =
 626             compat_alloc_user_space(sizeof(arg64));
 627         int err;
 628         u32 cp;
 629
 630         err = 0;
 631         err |=
 632             copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
 633                            sizeof(arg64.LUN_info));
 634         err |=
 635             copy_from_user(&arg64.Request, &arg32->Request,
 636                            sizeof(arg64.Request));
 637         err |=
 638             copy_from_user(&arg64.error_info, &arg32->error_info,
 639                            sizeof(arg64.error_info));
 640         err |= get_user(arg64.buf_size, &arg32->buf_size);
 641         err |= get_user(arg64.malloc_size, &arg32->malloc_size);
 642         err |= get_user(cp, &arg32->buf);
 643         arg64.buf = compat_ptr(cp);
 644         err |= copy_to_user(p, &arg64, sizeof(arg64));
 645
 646         if (err)
 647                 return -EFAULT;
 648
 649         err = do_ioctl(file, CCISS_BIG_PASSTHRU, (unsigned long)p);
 650         if (err)
 651                 return err;
 652         err |=
 653             copy_in_user(&arg32->error_info, &p->error_info,
 654                          sizeof(arg32->error_info));
 655         if (err)
 656                 return -EFAULT;
 657         return err;
 658 }
 659 #endif
 660
 661 static int cciss_getgeo(struct block_device *bdev, struct hd_geometry *geo)
 662 {
 663         drive_info_struct *drv = get_drv(bdev->bd_disk);
 664
 665         if (!drv->cylinders)
 666                 return -ENXIO;
 667
 668         geo->heads = drv->heads;
 669         geo->sectors = drv->sectors;
 670         geo->cylinders = drv->cylinders;
 671         return 0;
 672 }
 673
 674 /*
 675  * ioctl
 676  */
 677 static int cciss_ioctl(struct inode *inode, struct file *filep,
 678                        unsigned int cmd, unsigned long arg)
 679 {
 680         struct block_device *bdev = inode->i_bdev;
 681         struct gendisk *disk = bdev->bd_disk;
 682         ctlr_info_t *host = get_host(disk);
 683         drive_info_struct *drv = get_drv(disk);
 684         int ctlr = host->ctlr;
 685         void __user *argp = (void __user *)arg;
 686
 687 #ifdef CCISS_DEBUG
 688         printk(KERN_DEBUG "cciss_ioctl: Called with cmd=%x %lx\n", cmd, arg);
 689 #endif                          /* CCISS_DEBUG */
 690
 691         switch (cmd) {
 692         case CCISS_GETPCIINFO:
 693                 {
 694                         cciss_pci_info_struct pciinfo;
 695
 696                         if (!arg)
 697                                 return -EINVAL;
 698                         pciinfo.domain = pci_domain_nr(host->pdev->bus);
 699                         pciinfo.bus = host->pdev->bus->number;
 700                         pciinfo.dev_fn = host->pdev->devfn;
 701                         pciinfo.board_id = host->board_id;
 702                         if (copy_to_user
 703                             (argp, &pciinfo, sizeof(cciss_pci_info_struct)))
 704                                 return -EFAULT;
 705                         return 0;
 706                 }
 707         case CCISS_GETINTINFO:
 708                 {
 709                         cciss_coalint_struct intinfo;
 710                         if (!arg)
 711                                 return -EINVAL;
 712                         intinfo.delay =
 713                             readl(&host->cfgtable->HostWrite.CoalIntDelay);
 714                         intinfo.count =
 715                             readl(&host->cfgtable->HostWrite.CoalIntCount);
 716                         if (copy_to_user
 717                             (argp, &intinfo, sizeof(cciss_coalint_struct)))
 718                                 return -EFAULT;
 719                         return 0;
 720                 }
 721         case CCISS_SETINTINFO:
 722                 {
 723                         cciss_coalint_struct intinfo;
 724                         unsigned long flags;
 725                         int i;
 726
 727                         if (!arg)
 728                                 return -EINVAL;
 729                         if (!capable(CAP_SYS_ADMIN))
 730                                 return -EPERM;
 731                         if (copy_from_user
 732                             (&intinfo, argp, sizeof(cciss_coalint_struct)))
 733                                 return -EFAULT;
 734                         if ((intinfo.delay == 0) && (intinfo.count == 0))
 735                         {
 736 //                      printk("cciss_ioctl: delay and count cannot be 0\n");
 737                                 return -EINVAL;
 738                         }
 739                         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
 740                         /* Update the field, and then ring the doorbell */
 741                         writel(intinfo.delay,
 742                                &(host->cfgtable->HostWrite.CoalIntDelay));
 743                         writel(intinfo.count,
 744                                &(host->cfgtable->HostWrite.CoalIntCount));
 745                         writel(CFGTBL_ChangeReq, host->vaddr + SA5_DOORBELL);
 746
 747                         for (i = 0; i < MAX_IOCTL_CONFIG_WAIT; i++) {
 748                                 if (!(readl(host->vaddr + SA5_DOORBELL)
 749                                       & CFGTBL_ChangeReq))
 750                                         break;
 751                                 /* delay and try again */
 752                                 udelay(1000);
 753                         }
 754                         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
 755                         if (i >= MAX_IOCTL_CONFIG_WAIT)
 756                                 return -EAGAIN;
 757                         return 0;
 758                 }
 759         case CCISS_GETNODENAME:
 760                 {
 761                         NodeName_type NodeName;
 762                         int i;
 763
 764                         if (!arg)
 765                                 return -EINVAL;
 766                         for (i = 0; i < 16; i++)
 767                                 NodeName[i] =
 768                                     readb(&host->cfgtable->ServerName[i]);
 769                         if (copy_to_user(argp, NodeName, sizeof(NodeName_type)))
 770                                 return -EFAULT;
 771                         return 0;
 772                 }
 773         case CCISS_SETNODENAME:
 774                 {
 775                         NodeName_type NodeName;
 776                         unsigned long flags;
 777                         int i;
 778
 779                         if (!arg)
 780                                 return -EINVAL;
 781                         if (!capable(CAP_SYS_ADMIN))
 782                                 return -EPERM;
 783
 784                         if (copy_from_user
 785                             (NodeName, argp, sizeof(NodeName_type)))
 786                                 return -EFAULT;
 787
 788                         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
 789
 790                         /* Update the field, and then ring the doorbell */
 791                         for (i = 0; i < 16; i++)
 792                                 writeb(NodeName[i],
 793                                        &host->cfgtable->ServerName[i]);
 794
 795                         writel(CFGTBL_ChangeReq, host->vaddr + SA5_DOORBELL);
 796
 797                         for (i = 0; i < MAX_IOCTL_CONFIG_WAIT; i++) {
 798                                 if (!(readl(host->vaddr + SA5_DOORBELL)
 799                                       & CFGTBL_ChangeReq))
 800                                         break;
 801                                 /* delay and try again */
 802                                 udelay(1000);
 803                         }
 804                         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
 805                         if (i >= MAX_IOCTL_CONFIG_WAIT)
 806                                 return -EAGAIN;
 807                         return 0;
 808                 }
 809
 810         case CCISS_GETHEARTBEAT:
 811                 {
 812                         Heartbeat_type heartbeat;
 813
 814                         if (!arg)
 815                                 return -EINVAL;
 816                         heartbeat = readl(&host->cfgtable->HeartBeat);
 817                         if (copy_to_user
 818                             (argp, &heartbeat, sizeof(Heartbeat_type)))
 819                                 return -EFAULT;
 820                         return 0;
 821                 }
 822         case CCISS_GETBUSTYPES:
 823                 {
 824                         BusTypes_type BusTypes;
 825
 826                         if (!arg)
 827                                 return -EINVAL;
 828                         BusTypes = readl(&host->cfgtable->BusTypes);
 829                         if (copy_to_user
 830                             (argp, &BusTypes, sizeof(BusTypes_type)))
 831                                 return -EFAULT;
 832                         return 0;
 833                 }
 834         case CCISS_GETFIRMVER:
 835                 {
 836                         FirmwareVer_type firmware;
 837
 838                         if (!arg)
 839                                 return -EINVAL;
 840                         memcpy(firmware, host->firm_ver, 4);
 841
 842                         if (copy_to_user
 843                             (argp, firmware, sizeof(FirmwareVer_type)))
 844                                 return -EFAULT;
 845                         return 0;
 846                 }
 847         case CCISS_GETDRIVVER:
 848                 {
 849                         DriverVer_type DriverVer = DRIVER_VERSION;
 850
 851                         if (!arg)
 852                                 return -EINVAL;
 853
 854                         if (copy_to_user
 855                             (argp, &DriverVer, sizeof(DriverVer_type)))
 856                                 return -EFAULT;
 857                         return 0;
 858                 }
 859
 860         case CCISS_REVALIDVOLS:
 861                 return rebuild_lun_table(host, NULL);
 862
 863         case CCISS_GETLUNINFO:{
 864                         LogvolInfo_struct luninfo;
 865
 866                         luninfo.LunID = drv->LunID;
 867                         luninfo.num_opens = drv->usage_count;
 868                         luninfo.num_parts = 0;
 869                         if (copy_to_user(argp, &luninfo,
 870                                          sizeof(LogvolInfo_struct)))
 871                                 return -EFAULT;
 872                         return 0;
 873                 }
 874         case CCISS_DEREGDISK:
 875                 return rebuild_lun_table(host, disk);
 876
 877         case CCISS_REGNEWD:
 878                 return rebuild_lun_table(host, NULL);
 879
 880         case CCISS_PASSTHRU:
 881                 {
 882                         IOCTL_Command_struct iocommand;
 883                         CommandList_struct *c;
 884                         char *buff = NULL;
 885                         u64bit temp64;
 886                         unsigned long flags;
 887                         DECLARE_COMPLETION_ONSTACK(wait);
 888
 889                         if (!arg)
 890                                 return -EINVAL;
 891
 892                         if (!capable(CAP_SYS_RAWIO))
 893                                 return -EPERM;
 894
 895                         if (copy_from_user
 896                             (&iocommand, argp, sizeof(IOCTL_Command_struct)))
 897                                 return -EFAULT;
 898                         if ((iocommand.buf_size < 1) &&
 899                             (iocommand.Request.Type.Direction != XFER_NONE)) {
 900                                 return -EINVAL;
 901                         }
 902 #if 0                           /* 'buf_size' member is 16-bits, and always smaller than kmalloc limit */
 903                         /* Check kmalloc limits */
 904                         if (iocommand.buf_size > 128000)
 905                                 return -EINVAL;
 906 #endif
 907                         if (iocommand.buf_size > 0) {
 908                                 buff = kmalloc(iocommand.buf_size, GFP_KERNEL);
 909                                 if (buff == NULL)
 910                                         return -EFAULT;
 911                         }
 912                         if (iocommand.Request.Type.Direction == XFER_WRITE) {
 913                                 /* Copy the data into the buffer we created */
 914                                 if (copy_from_user
 915                                     (buff, iocommand.buf, iocommand.buf_size)) {
 916                                         kfree(buff);
 917                                         return -EFAULT;
 918                                 }
 919                         } else {
 920                                 memset(buff, 0, iocommand.buf_size);
 921                         }
 922                         if ((c = cmd_alloc(host, 0)) == NULL) {
 923                                 kfree(buff);
 924                                 return -ENOMEM;
 925                         }
 926                         // Fill in the command type
 927                         c->cmd_type = CMD_IOCTL_PEND;
 928                         // Fill in Command Header
 929                         c->Header.ReplyQueue = 0;       // unused in simple mode
 930                         if (iocommand.buf_size > 0)     // buffer to fill
 931                         {
 932                                 c->Header.SGList = 1;
 933                                 c->Header.SGTotal = 1;
 934                         } else  // no buffers to fill
 935                         {
 936                                 c->Header.SGList = 0;
 937                                 c->Header.SGTotal = 0;
 938                         }
 939                         c->Header.LUN = iocommand.LUN_info;
 940                         c->Header.Tag.lower = c->busaddr;       // use the kernel address the cmd block for tag
 941
 942                         // Fill in Request block
 943                         c->Request = iocommand.Request;
 944
 945                         // Fill in the scatter gather information
 946                         if (iocommand.buf_size > 0) {
 947                                 temp64.val = pci_map_single(host->pdev, buff,
 948                                         iocommand.buf_size,
 949                                         PCI_DMA_BIDIRECTIONAL);
 950                                 c->SG[0].Addr.lower = temp64.val32.lower;
 951                                 c->SG[0].Addr.upper = temp64.val32.upper;
 952                                 c->SG[0].Len = iocommand.buf_size;
 953                                 c->SG[0].Ext = 0;       // we are not chaining
 954                         }
 955                         c->waiting = &wait;
 956
 957                         /* Put the request on the tail of the request queue */
 958                         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
 959                         addQ(&host->reqQ, c);
 960                         host->Qdepth++;
 961                         start_io(host);
 962                         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
 963
 964                         wait_for_completion(&wait);
 965
 966                         /* unlock the buffers from DMA */
 967                         temp64.val32.lower = c->SG[0].Addr.lower;
 968                         temp64.val32.upper = c->SG[0].Addr.upper;
 969                         pci_unmap_single(host->pdev, (dma_addr_t) temp64.val,
 970                                          iocommand.buf_size,
 971                                          PCI_DMA_BIDIRECTIONAL);
 972
 973                         /* Copy the error information out */
 974                         iocommand.error_info = *(c->err_info);
 975                         if (copy_to_user
 976                             (argp, &iocommand, sizeof(IOCTL_Command_struct))) {
 977                                 kfree(buff);
 978                                 cmd_free(host, c, 0);
 979                                 return -EFAULT;
 980                         }
 981
 982                         if (iocommand.Request.Type.Direction == XFER_READ) {
 983                                 /* Copy the data out of the buffer we created */
 984                                 if (copy_to_user
 985                                     (iocommand.buf, buff, iocommand.buf_size)) {
 986                                         kfree(buff);
 987                                         cmd_free(host, c, 0);
 988                                         return -EFAULT;
 989                                 }
 990                         }
 991                         kfree(buff);
 992                         cmd_free(host, c, 0);
 993                         return 0;
 994                 }
 995         case CCISS_BIG_PASSTHRU:{
 996                         BIG_IOCTL_Command_struct *ioc;
 997                         CommandList_struct *c;
 998                         unsigned char **buff = NULL;
 999                         int *buff_size = NULL;
1000                         u64bit temp64;
1001                         unsigned long flags;
1002                         BYTE sg_used = 0;
1003                         int status = 0;
1004                         int i;
1005                         DECLARE_COMPLETION_ONSTACK(wait);
1006                         __u32 left;
1007                         __u32 sz;
1008                         BYTE __user *data_ptr;
1009
1010                         if (!arg)
1011                                 return -EINVAL;
1012                         if (!capable(CAP_SYS_RAWIO))
1013                                 return -EPERM;
1014                         ioc = (BIG_IOCTL_Command_struct *)
1015                             kmalloc(sizeof(*ioc), GFP_KERNEL);
1016                         if (!ioc) {
1017                                 status = -ENOMEM;
1018                                 goto cleanup1;
1019                         }
1020                         if (copy_from_user(ioc, argp, sizeof(*ioc))) {
1021                                 status = -EFAULT;
1022                                 goto cleanup1;
1023                         }
1024                         if ((ioc->buf_size < 1) &&
1025                             (ioc->Request.Type.Direction != XFER_NONE)) {
1026                                 status = -EINVAL;
1027                                 goto cleanup1;
1028                         }
1029                         /* Check kmalloc limits  using all SGs */
1030                         if (ioc->malloc_size > MAX_KMALLOC_SIZE) {
1031                                 status = -EINVAL;
1032                                 goto cleanup1;
1033                         }
1034                         if (ioc->buf_size > ioc->malloc_size * MAXSGENTRIES) {
1035                                 status = -EINVAL;
1036                                 goto cleanup1;
1037                         }
1038                         buff =
1039                             kzalloc(MAXSGENTRIES * sizeof(char *), GFP_KERNEL);
1040                         if (!buff) {
1041                                 status = -ENOMEM;
1042                                 goto cleanup1;
1043                         }
1044                         buff_size = kmalloc(MAXSGENTRIES * sizeof(int),
1045                                                    GFP_KERNEL);
1046                         if (!buff_size) {
1047                                 status = -ENOMEM;
1048                                 goto cleanup1;
1049                         }
1050                         left = ioc->buf_size;
1051                         data_ptr = ioc->buf;
1052                         while (left) {
1053                                 sz = (left >
1054                                       ioc->malloc_size) ? ioc->
1055                                     malloc_size : left;
1056                                 buff_size[sg_used] = sz;
1057                                 buff[sg_used] = kmalloc(sz, GFP_KERNEL);
1058                                 if (buff[sg_used] == NULL) {
1059                                         status = -ENOMEM;
1060                                         goto cleanup1;
1061                                 }
1062                                 if (ioc->Request.Type.Direction == XFER_WRITE) {
1063                                         if (copy_from_user
1064                                             (buff[sg_used], data_ptr, sz)) {
1065                                                 status = -ENOMEM;
1066                                                 goto cleanup1;
1067                                         }
1068                                 } else {
1069                                         memset(buff[sg_used], 0, sz);
1070                                 }
1071                                 left -= sz;
1072                                 data_ptr += sz;
1073                                 sg_used++;
1074                         }
1075                         if ((c = cmd_alloc(host, 0)) == NULL) {
1076                                 status = -ENOMEM;
1077                                 goto cleanup1;
1078                         }
1079                         c->cmd_type = CMD_IOCTL_PEND;
1080                         c->Header.ReplyQueue = 0;
1081
1082                         if (ioc->buf_size > 0) {
1083                                 c->Header.SGList = sg_used;
1084                                 c->Header.SGTotal = sg_used;
1085                         } else {
1086                                 c->Header.SGList = 0;
1087                                 c->Header.SGTotal = 0;
1088                         }
1089                         c->Header.LUN = ioc->LUN_info;
1090                         c->Header.Tag.lower = c->busaddr;
1091
1092                         c->Request = ioc->Request;
1093                         if (ioc->buf_size > 0) {
1094                                 int i;
1095                                 for (i = 0; i < sg_used; i++) {
1096                                         temp64.val =
1097                                             pci_map_single(host->pdev, buff[i],
1098                                                     buff_size[i],
1099                                                     PCI_DMA_BIDIRECTIONAL);
1100                                         c->SG[i].Addr.lower =
1101                                             temp64.val32.lower;
1102                                         c->SG[i].Addr.upper =
1103                                             temp64.val32.upper;
1104                                         c->SG[i].Len = buff_size[i];
1105                                         c->SG[i].Ext = 0;       /* we are not chaining */
1106                                 }
1107                         }
1108                         c->waiting = &wait;
1109                         /* Put the request on the tail of the request queue */
1110                         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
1111                         addQ(&host->reqQ, c);
1112                         host->Qdepth++;
1113                         start_io(host);
1114                         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
1115                         wait_for_completion(&wait);
1116                         /* unlock the buffers from DMA */
1117                         for (i = 0; i < sg_used; i++) {
1118                                 temp64.val32.lower = c->SG[i].Addr.lower;
1119                                 temp64.val32.upper = c->SG[i].Addr.upper;
1120                                 pci_unmap_single(host->pdev,
1121                                         (dma_addr_t) temp64.val, buff_size[i],
1122                                         PCI_DMA_BIDIRECTIONAL);
1123                         }
1124                         /* Copy the error information out */
1125                         ioc->error_info = *(c->err_info);
1126                         if (copy_to_user(argp, ioc, sizeof(*ioc))) {
1127                                 cmd_free(host, c, 0);
1128                                 status = -EFAULT;
1129                                 goto cleanup1;
1130                         }
1131                         if (ioc->Request.Type.Direction == XFER_READ) {
1132                                 /* Copy the data out of the buffer we created */
1133                                 BYTE __user *ptr = ioc->buf;
1134                                 for (i = 0; i < sg_used; i++) {
1135                                         if (copy_to_user
1136                                             (ptr, buff[i], buff_size[i])) {
1137                                                 cmd_free(host, c, 0);
1138                                                 status = -EFAULT;
1139                                                 goto cleanup1;
1140                                         }
1141                                         ptr += buff_size[i];
1142                                 }
1143                         }
1144                         cmd_free(host, c, 0);
1145                         status = 0;
1146                       cleanup1:
1147                         if (buff) {
1148                                 for (i = 0; i < sg_used; i++)
1149                                         kfree(buff[i]);
1150                                 kfree(buff);
1151                         }
1152                         kfree(buff_size);
1153                         kfree(ioc);
1154                         return status;
1155                 }
1156         default:
1157                 return -ENOTTY;
1158         }
1159 }
1160
1161 static inline void complete_buffers(struct bio *bio, int status)
1162 {
1163         while (bio) {
1164                 struct bio *xbh = bio->bi_next;
1165                 int nr_sectors = bio_sectors(bio);
1166
1167                 bio->bi_next = NULL;
1168                 bio_endio(bio, nr_sectors << 9, status ? 0 : -EIO);
1169                 bio = xbh;
1170         }
1171 }
1172
1173 static void cciss_check_queues(ctlr_info_t *h)
1174 {
1175         int start_queue = h->next_to_run;
1176         int i;
1177
1178         /* check to see if we have maxed out the number of commands that can
1179          * be placed on the queue.  If so then exit.  We do this check here
1180          * in case the interrupt we serviced was from an ioctl and did not
1181          * free any new commands.
1182          */
1183         if ((find_first_zero_bit(h->cmd_pool_bits, h->nr_cmds)) == h->nr_cmds)
1184                 return;
1185
1186         /* We have room on the queue for more commands.  Now we need to queue
1187          * them up.  We will also keep track of the next queue to run so
1188          * that every queue gets a chance to be started first.
1189          */
1190         for (i = 0; i < h->highest_lun + 1; i++) {
1191                 int curr_queue = (start_queue + i) % (h->highest_lun + 1);
1192                 /* make sure the disk has been added and the drive is real
1193                  * because this can be called from the middle of init_one.
1194                  */
1195                 if (!(h->drv[curr_queue].queue) || !(h->drv[curr_queue].heads))
1196                         continue;
1197                 blk_start_queue(h->gendisk[curr_queue]->queue);
1198
1199                 /* check to see if we have maxed out the number of commands
1200                  * that can be placed on the queue.
1201                  */
1202                 if ((find_first_zero_bit(h->cmd_pool_bits, h->nr_cmds)) == h->nr_cmds) {
1203                         if (curr_queue == start_queue) {
1204                                 h->next_to_run =
1205                                     (start_queue + 1) % (h->highest_lun + 1);
1206                                 break;
1207                         } else {
1208                                 h->next_to_run = curr_queue;
1209                                 break;
1210                         }
1211                 } else {
1212                         curr_queue = (curr_queue + 1) % (h->highest_lun + 1);
1213                 }
1214         }
1215 }
1216
1217 static void cciss_softirq_done(struct request *rq)
1218 {
1219         CommandList_struct *cmd = rq->completion_data;
1220         ctlr_info_t *h = hba[cmd->ctlr];
1221         unsigned long flags;
1222         u64bit temp64;
1223         int i, ddir;
1224
1225         if (cmd->Request.Type.Direction == XFER_READ)
1226                 ddir = PCI_DMA_FROMDEVICE;
1227         else
1228                 ddir = PCI_DMA_TODEVICE;
1229
1230         /* command did not need to be retried */
1231         /* unmap the DMA mapping for all the scatter gather elements */
1232         for (i = 0; i < cmd->Header.SGList; i++) {
1233                 temp64.val32.lower = cmd->SG[i].Addr.lower;
1234                 temp64.val32.upper = cmd->SG[i].Addr.upper;
1235                 pci_unmap_page(h->pdev, temp64.val, cmd->SG[i].Len, ddir);
1236         }
1237
1238         complete_buffers(rq->bio, rq->errors);
1239
1240         if (blk_fs_request(rq)) {
1241                 const int rw = rq_data_dir(rq);
1242
1243                 disk_stat_add(rq->rq_disk, sectors[rw], rq->nr_sectors);
1244         }
1245
1246 #ifdef CCISS_DEBUG
1247         printk("Done with %p\n", rq);
1248 #endif                          /* CCISS_DEBUG */
1249
1250         add_disk_randomness(rq->rq_disk);
1251         spin_lock_irqsave(&h->lock, flags);
1252         end_that_request_last(rq, rq->errors);
1253         cmd_free(h, cmd, 1);
1254         cciss_check_queues(h);
1255         spin_unlock_irqrestore(&h->lock, flags);
1256 }
1257
1258 /* This function will check the usage_count of the drive to be updated/added.
1259  * If the usage_count is zero then the drive information will be updated and
1260  * the disk will be re-registered with the kernel.  If not then it will be
1261  * left alone for the next reboot.  The exception to this is disk 0 which
1262  * will always be left registered with the kernel since it is also the
1263  * controller node.  Any changes to disk 0 will show up on the next
1264  * reboot.
1265  */
1266 static void cciss_update_drive_info(int ctlr, int drv_index)
1267 {
1268         ctlr_info_t *h = hba[ctlr];
1269         struct gendisk *disk;
1270         InquiryData_struct *inq_buff = NULL;
1271         unsigned int block_size;
1272         sector_t total_size;
1273         unsigned long flags = 0;
1274         int ret = 0;
1275
1276         /* if the disk already exists then deregister it before proceeding */
1277         if (h->drv[drv_index].raid_level != -1) {
1278                 spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
1279                 h->drv[drv_index].busy_configuring = 1;
1280                 spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
1281                 ret = deregister_disk(h->gendisk[drv_index],
1282                                       &h->drv[drv_index], 0);
1283                 h->drv[drv_index].busy_configuring = 0;
1284         }
1285
1286         /* If the disk is in use return */
1287         if (ret)
1288                 return;
1289
1290         /* Get information about the disk and modify the driver structure */
1291         inq_buff = kmalloc(sizeof(InquiryData_struct), GFP_KERNEL);
1292         if (inq_buff == NULL)
1293                 goto mem_msg;
1294
1295         cciss_read_capacity(ctlr, drv_index, 1,
1296                             &total_size, &block_size);
1297
1298         /* total size = last LBA + 1 */
1299         /* FFFFFFFF + 1 = 0, cannot have a logical volume of size 0 */
1300         /* so we assume this volume this must be >2TB in size */
1301         if (total_size == (__u32) 0) {
1302                 cciss_read_capacity_16(ctlr, drv_index, 1,
1303                 &total_size, &block_size);
1304                 h->cciss_read = CCISS_READ_16;
1305                 h->cciss_write = CCISS_WRITE_16;
1306         } else {
1307                 h->cciss_read = CCISS_READ_10;
1308                 h->cciss_write = CCISS_WRITE_10;
1309         }
1310         cciss_geometry_inquiry(ctlr, drv_index, 1, total_size, block_size,
1311                                inq_buff, &h->drv[drv_index]);
1312
1313         ++h->num_luns;
1314         disk = h->gendisk[drv_index];
1315         set_capacity(disk, h->drv[drv_index].nr_blocks);
1316
1317         /* if it's the controller it's already added */
1318         if (drv_index) {
1319                 disk->queue = blk_init_queue(do_cciss_request, &h->lock);
1320                 sprintf(disk->disk_name, "cciss/c%dd%d", ctlr, drv_index);
1321                 disk->major = h->major;
1322                 disk->first_minor = drv_index << NWD_SHIFT;
1323                 disk->fops = &cciss_fops;
1324                 disk->private_data = &h->drv[drv_index];
1325
1326                 /* Set up queue information */
1327                 disk->queue->backing_dev_info.ra_pages = READ_AHEAD;
1328                 blk_queue_bounce_limit(disk->queue, hba[ctlr]->pdev->dma_mask);
1329
1330                 /* This is a hardware imposed limit. */
1331                 blk_queue_max_hw_segments(disk->queue, MAXSGENTRIES);
1332
1333                 /* This is a limit in the driver and could be eliminated. */
1334                 blk_queue_max_phys_segments(disk->queue, MAXSGENTRIES);
1335
1336                 blk_queue_max_sectors(disk->queue, h->cciss_max_sectors);
1337
1338                 blk_queue_softirq_done(disk->queue, cciss_softirq_done);
1339
1340                 disk->queue->queuedata = hba[ctlr];
1341
1342                 blk_queue_hardsect_size(disk->queue,
1343                                         hba[ctlr]->drv[drv_index].block_size);
1344
1345                 h->drv[drv_index].queue = disk->queue;
1346                 add_disk(disk);
1347         }
1348
1349       freeret:
1350         kfree(inq_buff);
1351         return;
1352       mem_msg:
1353         printk(KERN_ERR "cciss: out of memory\n");
1354         goto freeret;
1355 }
1356
1357 /* This function will find the first index of the controllers drive array
1358  * that has a -1 for the raid_level and will return that index.  This is
1359  * where new drives will be added.  If the index to be returned is greater
1360  * than the highest_lun index for the controller then highest_lun is set
1361  * to this new index.  If there are no available indexes then -1 is returned.
1362  */
1363 static int cciss_find_free_drive_index(int ctlr)
1364 {
1365         int i;
1366
1367         for (i = 0; i < CISS_MAX_LUN; i++) {
1368                 if (hba[ctlr]->drv[i].raid_level == -1) {
1369                         if (i > hba[ctlr]->highest_lun)
1370                                 hba[ctlr]->highest_lun = i;
1371                         return i;
1372                 }
1373         }
1374         return -1;
1375 }
1376
1377 /* This function will add and remove logical drives from the Logical
1378  * drive array of the controller and maintain persistency of ordering
1379  * so that mount points are preserved until the next reboot.  This allows
1380  * for the removal of logical drives in the middle of the drive array
1381  * without a re-ordering of those drives.
1382  * INPUT
1383  * h            = The controller to perform the operations on
1384  * del_disk     = The disk to remove if specified.  If the value given
1385  *                is NULL then no disk is removed.
1386  */
1387 static int rebuild_lun_table(ctlr_info_t *h, struct gendisk *del_disk)
1388 {
1389         int ctlr = h->ctlr;
1390         int num_luns;
1391         ReportLunData_struct *ld_buff = NULL;
1392         drive_info_struct *drv = NULL;
1393         int return_code;
1394         int listlength = 0;
1395         int i;
1396         int drv_found;
1397         int drv_index = 0;
1398         __u32 lunid = 0;
1399         unsigned long flags;
1400
1401         /* Set busy_configuring flag for this operation */
1402         spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
1403         if (h->busy_configuring) {
1404                 spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
1405                 return -EBUSY;
1406         }
1407         h->busy_configuring = 1;
1408
1409         /* if del_disk is NULL then we are being called to add a new disk
1410          * and update the logical drive table.  If it is not NULL then
1411          * we will check if the disk is in use or not.
1412          */
1413         if (del_disk != NULL) {
1414                 drv = get_drv(del_disk);
1415                 drv->busy_configuring = 1;
1416                 spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
1417                 return_code = deregister_disk(del_disk, drv, 1);
1418                 drv->busy_configuring = 0;
1419                 h->busy_configuring = 0;
1420                 return return_code;
1421         } else {
1422                 spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
1423                 if (!capable(CAP_SYS_RAWIO))
1424                         return -EPERM;
1425
1426                 ld_buff = kzalloc(sizeof(ReportLunData_struct), GFP_KERNEL);
1427                 if (ld_buff == NULL)
1428                         goto mem_msg;
1429
1430                 return_code = sendcmd_withirq(CISS_REPORT_LOG, ctlr, ld_buff,
1431                                               sizeof(ReportLunData_struct), 0,
1432                                               0, 0, TYPE_CMD);
1433
1434                 if (return_code == IO_OK) {
1435                         listlength =
1436                                 be32_to_cpu(*(__u32 *) ld_buff->LUNListLength);
1437                 } else {        /* reading number of logical volumes failed */
1438                         printk(KERN_WARNING "cciss: report logical volume"
1439                                " command failed\n");
1440                         listlength = 0;
1441                         goto freeret;
1442                 }
1443
1444                 num_luns = listlength / 8;      /* 8 bytes per entry */
1445                 if (num_luns > CISS_MAX_LUN) {
1446                         num_luns = CISS_MAX_LUN;
1447                         printk(KERN_WARNING "cciss: more luns configured"
1448                                " on controller than can be handled by"
1449                                " this driver.\n");
1450                 }
1451
1452                 /* Compare controller drive array to drivers drive array.
1453                  * Check for updates in the drive information and any new drives
1454                  * on the controller.
1455                  */
1456                 for (i = 0; i < num_luns; i++) {
1457                         int j;
1458
1459                         drv_found = 0;
1460
1461                         lunid = (0xff &
1462                                  (unsigned int)(ld_buff->LUN[i][3])) << 24;
1463                         lunid |= (0xff &
1464                                   (unsigned int)(ld_buff->LUN[i][2])) << 16;
1465                         lunid |= (0xff &
1466                                   (unsigned int)(ld_buff->LUN[i][1])) << 8;
1467                         lunid |= 0xff & (unsigned int)(ld_buff->LUN[i][0]);
1468
1469                         /* Find if the LUN is already in the drive array
1470                          * of the controller.  If so then update its info
1471                          * if not is use.  If it does not exist then find
1472                          * the first free index and add it.
1473                          */
1474                         for (j = 0; j <= h->highest_lun; j++) {
1475                                 if (h->drv[j].LunID == lunid) {
1476                                         drv_index = j;
1477                                         drv_found = 1;
1478                                 }
1479                         }
1480
1481                         /* check if the drive was found already in the array */
1482                         if (!drv_found) {
1483                                 drv_index = cciss_find_free_drive_index(ctlr);
1484                                 if (drv_index == -1)
1485                                         goto freeret;
1486
1487                                 /*Check if the gendisk needs to be allocated */
1488                                 if (!h->gendisk[drv_index]){
1489                                         h->gendisk[drv_index] = alloc_disk(1 << NWD_SHIFT);
1490                                         if (!h->gendisk[drv_index]){
1491                                                 printk(KERN_ERR "cciss: could not allocate new disk %d\n", drv_index);
1492                                                 goto mem_msg;
1493                                         }
1494                                 }
1495                         }
1496                         h->drv[drv_index].LunID = lunid;
1497                         cciss_update_drive_info(ctlr, drv_index);
1498                 }               /* end for */
1499         }                       /* end else */
1500
1501       freeret:
1502         kfree(ld_buff);
1503         h->busy_configuring = 0;
1504         /* We return -1 here to tell the ACU that we have registered/updated
1505          * all of the drives that we can and to keep it from calling us
1506          * additional times.
1507          */
1508         return -1;
1509       mem_msg:
1510         printk(KERN_ERR "cciss: out of memory\n");
1511         goto freeret;
1512 }
1513
1514 /* This function will deregister the disk and it's queue from the
1515  * kernel.  It must be called with the controller lock held and the
1516  * drv structures busy_configuring flag set.  It's parameters are:
1517  *
1518  * disk = This is the disk to be deregistered
1519  * drv  = This is the drive_info_struct associated with the disk to be
1520  *        deregistered.  It contains information about the disk used
1521  *        by the driver.
1522  * clear_all = This flag determines whether or not the disk information
1523  *             is going to be completely cleared out and the highest_lun
1524  *             reset.  Sometimes we want to clear out information about
1525  *             the disk in preparation for re-adding it.  In this case
1526  *             the highest_lun should be left unchanged and the LunID
1527  *             should not be cleared.
1528 */
1529 static int deregister_disk(struct gendisk *disk, drive_info_struct *drv,
1530                            int clear_all)
1531 {
1532         int i;
1533         ctlr_info_t *h = get_host(disk);
1534
1535         if (!capable(CAP_SYS_RAWIO))
1536                 return -EPERM;
1537
1538         /* make sure logical volume is NOT is use */
1539         if (clear_all || (h->gendisk[0] == disk)) {
1540                 if (drv->usage_count > 1)
1541                         return -EBUSY;
1542         } else if (drv->usage_count > 0)
1543                 return -EBUSY;
1544
1545         /* invalidate the devices and deregister the disk.  If it is disk
1546          * zero do not deregister it but just zero out it's values.  This
1547          * allows us to delete disk zero but keep the controller registered.
1548          */
1549         if (h->gendisk[0] != disk) {
1550                 if (disk) {
1551                         request_queue_t *q = disk->queue;
1552                         if (disk->flags & GENHD_FL_UP)
1553                                 del_gendisk(disk);
1554                         if (q) {
1555                                 blk_cleanup_queue(q);
1556                                 /* Set drv->queue to NULL so that we do not try
1557                                  * to call blk_start_queue on this queue in the
1558                                  * interrupt handler
1559                                  */
1560                                 drv->queue = NULL;
1561                         }
1562                         /* If clear_all is set then we are deleting the logical
1563                          * drive, not just refreshing its info.  For drives
1564                          * other than disk 0 we will call put_disk.  We do not
1565                          * do this for disk 0 as we need it to be able to
1566                          * configure the controller.
1567                         */
1568                         if (clear_all){
1569                                 /* This isn't pretty, but we need to find the
1570                                  * disk in our array and NULL our the pointer.
1571                                  * This is so that we will call alloc_disk if
1572                                  * this index is used again later.
1573                                 */
1574                                 for (i=0; i < CISS_MAX_LUN; i++){
1575                                         if(h->gendisk[i] == disk){
1576                                                 h->gendisk[i] = NULL;
1577                                                 break;
1578                                         }
1579                                 }
1580                                 put_disk(disk);
1581                         }
1582                 }
1583         } else {
1584                 set_capacity(disk, 0);
1585         }
1586
1587         --h->num_luns;
1588         /* zero out the disk size info */
1589         drv->nr_blocks = 0;
1590         drv->block_size = 0;
1591         drv->heads = 0;
1592         drv->sectors = 0;
1593         drv->cylinders = 0;
1594         drv->raid_level = -1;   /* This can be used as a flag variable to
1595                                  * indicate that this element of the drive
1596                                  * array is free.
1597                                  */
1598
1599         if (clear_all) {
1600                 /* check to see if it was the last disk */
1601                 if (drv == h->drv + h->highest_lun) {
1602                         /* if so, find the new hightest lun */
1603                         int i, newhighest = -1;
1604                         for (i = 0; i < h->highest_lun; i++) {
1605                                 /* if the disk has size > 0, it is available */
1606                                 if (h->drv[i].heads)
1607                                         newhighest = i;
1608                         }
1609                         h->highest_lun = newhighest;
1610                 }
1611
1612                 drv->LunID = 0;
1613         }
1614         return 0;
1615 }
1616
1617 static int fill_cmd(CommandList_struct *c, __u8 cmd, int ctlr, void *buff, size_t size, unsigned int use_unit_num,      /* 0: address the controller,
1618                                                                                                                            1: address logical volume log_unit,
1619                                                                                                                            2: periph device address is scsi3addr */
1620                     unsigned int log_unit, __u8 page_code,
1621                     unsigned char *scsi3addr, int cmd_type)
1622 {
1623         ctlr_info_t *h = hba[ctlr];
1624         u64bit buff_dma_handle;
1625         int status = IO_OK;
1626
1627         c->cmd_type = CMD_IOCTL_PEND;
1628         c->Header.ReplyQueue = 0;
1629         if (buff != NULL) {
1630                 c->Header.SGList = 1;
1631                 c->Header.SGTotal = 1;
1632         } else {
1633                 c->Header.SGList = 0;
1634                 c->Header.SGTotal = 0;
1635         }
1636         c->Header.Tag.lower = c->busaddr;
1637
1638         c->Request.Type.Type = cmd_type;
1639         if (cmd_type == TYPE_CMD) {
1640                 switch (cmd) {
1641                 case CISS_INQUIRY:
1642                         /* If the logical unit number is 0 then, this is going
1643                            to controller so It's a physical command
1644                            mode = 0 target = 0.  So we have nothing to write.
1645                            otherwise, if use_unit_num == 1,
1646                            mode = 1(volume set addressing) target = LUNID
1647                            otherwise, if use_unit_num == 2,
1648                            mode = 0(periph dev addr) target = scsi3addr */
1649                         if (use_unit_num == 1) {
1650                                 c->Header.LUN.LogDev.VolId =
1651                                     h->drv[log_unit].LunID;
1652                                 c->Header.LUN.LogDev.Mode = 1;
1653                         } else if (use_unit_num == 2) {
1654                                 memcpy(c->Header.LUN.LunAddrBytes, scsi3addr,
1655                                        8);
1656                                 c->Header.LUN.LogDev.Mode = 0;
1657                         }
1658                         /* are we trying to read a vital product page */
1659                         if (page_code != 0) {
1660                                 c->Request.CDB[1] = 0x01;
1661                                 c->Request.CDB[2] = page_code;
1662                         }
1663                         c->Request.CDBLen = 6;
1664                         c->Request.Type.Attribute = ATTR_SIMPLE;
1665                         c->Request.Type.Direction = XFER_READ;
1666                         c->Request.Timeout = 0;
1667                         c->Request.CDB[0] = CISS_INQUIRY;
1668                         c->Request.CDB[4] = size & 0xFF;
1669                         break;
1670                 case CISS_REPORT_LOG:
1671                 case CISS_REPORT_PHYS:
1672                         /* Talking to controller so It's a physical command
1673                            mode = 00 target = 0.  Nothing to write.
1674                          */
1675                         c->Request.CDBLen = 12;
1676                         c->Request.Type.Attribute = ATTR_SIMPLE;
1677                         c->Request.Type.Direction = XFER_READ;
1678                         c->Request.Timeout = 0;
1679                         c->Request.CDB[0] = cmd;
1680                         c->Request.CDB[6] = (size >> 24) & 0xFF;        //MSB
1681                         c->Request.CDB[7] = (size >> 16) & 0xFF;
1682                         c->Request.CDB[8] = (size >> 8) & 0xFF;
1683                         c->Request.CDB[9] = size & 0xFF;
1684                         break;
1685
1686                 case CCISS_READ_CAPACITY:
1687                         c->Header.LUN.LogDev.VolId = h->drv[log_unit].LunID;
1688                         c->Header.LUN.LogDev.Mode = 1;
1689                         c->Request.CDBLen = 10;
1690                         c->Request.Type.Attribute = ATTR_SIMPLE;
1691                         c->Request.Type.Direction = XFER_READ;
1692                         c->Request.Timeout = 0;
1693                         c->Request.CDB[0] = cmd;
1694                         break;
1695                 case CCISS_READ_CAPACITY_16:
1696                         c->Header.LUN.LogDev.VolId = h->drv[log_unit].LunID;
1697                         c->Header.LUN.LogDev.Mode = 1;
1698                         c->Request.CDBLen = 16;
1699                         c->Request.Type.Attribute = ATTR_SIMPLE;
1700                         c->Request.Type.Direction = XFER_READ;
1701                         c->Request.Timeout = 0;
1702                         c->Request.CDB[0] = cmd;
1703                         c->Request.CDB[1] = 0x10;
1704                         c->Request.CDB[10] = (size >> 24) & 0xFF;
1705                         c->Request.CDB[11] = (size >> 16) & 0xFF;
1706                         c->Request.CDB[12] = (size >> 8) & 0xFF;
1707                         c->Request.CDB[13] = size & 0xFF;
1708                         c->Request.Timeout = 0;
1709                         c->Request.CDB[0] = cmd;
1710                         break;
1711                 case CCISS_CACHE_FLUSH:
1712                         c->Request.CDBLen = 12;
1713                         c->Request.Type.Attribute = ATTR_SIMPLE;
1714                         c->Request.Type.Direction = XFER_WRITE;
1715                         c->Request.Timeout = 0;
1716                         c->Request.CDB[0] = BMIC_WRITE;
1717                         c->Request.CDB[6] = BMIC_CACHE_FLUSH;
1718                         break;
1719                 default:
1720                         printk(KERN_WARNING
1721                                "cciss%d:  Unknown Command 0x%c\n", ctlr, cmd);
1722                         return IO_ERROR;
1723                 }
1724         } else if (cmd_type == TYPE_MSG) {
1725                 switch (cmd) {
1726                 case 0: /* ABORT message */
1727                         c->Request.CDBLen = 12;
1728                         c->Request.Type.Attribute = ATTR_SIMPLE;
1729                         c->Request.Type.Direction = XFER_WRITE;
1730                         c->Request.Timeout = 0;
1731                         c->Request.CDB[0] = cmd;        /* abort */
1732                         c->Request.CDB[1] = 0;  /* abort a command */
1733                         /* buff contains the tag of the command to abort */
1734                         memcpy(&c->Request.CDB[4], buff, 8);
1735                         break;
1736                 case 1: /* RESET message */
1737                         c->Request.CDBLen = 12;
1738                         c->Request.Type.Attribute = ATTR_SIMPLE;
1739                         c->Request.Type.Direction = XFER_WRITE;
1740                         c->Request.Timeout = 0;
1741                         memset(&c->Request.CDB[0], 0, sizeof(c->Request.CDB));
1742                         c->Request.CDB[0] = cmd;        /* reset */
1743                         c->Request.CDB[1] = 0x04;       /* reset a LUN */
1744                         break;
1745                 case 3: /* No-Op message */
1746                         c->Request.CDBLen = 1;
1747                         c->Request.Type.Attribute = ATTR_SIMPLE;
1748                         c->Request.Type.Direction = XFER_WRITE;
1749                         c->Request.Timeout = 0;
1750                         c->Request.CDB[0] = cmd;
1751                         break;
1752                 default:
1753                         printk(KERN_WARNING
1754                                "cciss%d: unknown message type %d\n", ctlr, cmd);
1755                         return IO_ERROR;
1756                 }
1757         } else {
1758                 printk(KERN_WARNING
1759                        "cciss%d: unknown command type %d\n", ctlr, cmd_type);
1760                 return IO_ERROR;
1761         }
1762         /* Fill in the scatter gather information */
1763         if (size > 0) {
1764                 buff_dma_handle.val = (__u64) pci_map_single(h->pdev,
1765                                                              buff, size,
1766                                                              PCI_DMA_BIDIRECTIONAL);
1767                 c->SG[0].Addr.lower = buff_dma_handle.val32.lower;
1768                 c->SG[0].Addr.upper = buff_dma_handle.val32.upper;
1769                 c->SG[0].Len = size;
1770                 c->SG[0].Ext = 0;       /* we are not chaining */
1771         }
1772         return status;
1773 }
1774
1775 static int sendcmd_withirq(__u8 cmd,
1776                            int ctlr,
1777                            void *buff,
1778                            size_t size,
1779                            unsigned int use_unit_num,
1780                            unsigned int log_unit, __u8 page_code, int cmd_type)
1781 {
1782         ctlr_info_t *h = hba[ctlr];
1783         CommandList_struct *c;
1784         u64bit buff_dma_handle;
1785         unsigned long flags;
1786         int return_status;
1787         DECLARE_COMPLETION_ONSTACK(wait);
1788
1789         if ((c = cmd_alloc(h, 0)) == NULL)
1790                 return -ENOMEM;
1791         return_status = fill_cmd(c, cmd, ctlr, buff, size, use_unit_num,
1792                                  log_unit, page_code, NULL, cmd_type);
1793         if (return_status != IO_OK) {
1794                 cmd_free(h, c, 0);
1795                 return return_status;
1796         }
1797       resend_cmd2:
1798         c->waiting = &wait;
1799
1800         /* Put the request on the tail of the queue and send it */
1801         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
1802         addQ(&h->reqQ, c);
1803         h->Qdepth++;
1804         start_io(h);
1805         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
1806
1807         wait_for_completion(&wait);
1808
1809         if (c->err_info->CommandStatus != 0) {  /* an error has occurred */
1810                 switch (c->err_info->CommandStatus) {
1811                 case CMD_TARGET_STATUS:
1812                         printk(KERN_WARNING "cciss: cmd %p has "
1813                                " completed with errors\n", c);
1814                         if (c->err_info->ScsiStatus) {
1815                                 printk(KERN_WARNING "cciss: cmd %p "
1816                                        "has SCSI Status = %x\n",
1817                                        c, c->err_info->ScsiStatus);
1818                         }
1819
1820                         break;
1821                 case CMD_DATA_UNDERRUN:
1822                 case CMD_DATA_OVERRUN:
1823                         /* expected for inquire and report lun commands */
1824                         break;
1825                 case CMD_INVALID:
1826                         printk(KERN_WARNING "cciss: Cmd %p is "
1827                                "reported invalid\n", c);
1828                         return_status = IO_ERROR;
1829                         break;
1830                 case CMD_PROTOCOL_ERR:
1831                         printk(KERN_WARNING "cciss: cmd %p has "
1832                                "protocol error \n", c);
1833                         return_status = IO_ERROR;
1834                         break;
1835                 case CMD_HARDWARE_ERR:
1836                         printk(KERN_WARNING "cciss: cmd %p had "
1837                                " hardware error\n", c);
1838                         return_status = IO_ERROR;
1839                         break;
1840                 case CMD_CONNECTION_LOST:
1841                         printk(KERN_WARNING "cciss: cmd %p had "
1842                                "connection lost\n", c);
1843                         return_status = IO_ERROR;
1844                         break;
1845                 case CMD_ABORTED:
1846                         printk(KERN_WARNING "cciss: cmd %p was "
1847                                "aborted\n", c);
1848                         return_status = IO_ERROR;
1849                         break;
1850                 case CMD_ABORT_FAILED:
1851                         printk(KERN_WARNING "cciss: cmd %p reports "
1852                                "abort failed\n", c);
1853                         return_status = IO_ERROR;
1854                         break;
1855                 case CMD_UNSOLICITED_ABORT:
1856                         printk(KERN_WARNING
1857                                "cciss%d: unsolicited abort %p\n", ctlr, c);
1858                         if (c->retry_count < MAX_CMD_RETRIES) {
1859                                 printk(KERN_WARNING
1860                                        "cciss%d: retrying %p\n", ctlr, c);
1861                                 c->retry_count++;
1862                                 /* erase the old error information */
1863                                 memset(c->err_info, 0,
1864                                        sizeof(ErrorInfo_struct));
1865                                 return_status = IO_OK;
1866                                 INIT_COMPLETION(wait);
1867                                 goto resend_cmd2;
1868                         }
1869                         return_status = IO_ERROR;
1870                         break;
1871                 default:
1872                         printk(KERN_WARNING "cciss: cmd %p returned "
1873                                "unknown status %x\n", c,
1874                                c->err_info->CommandStatus);
1875                         return_status = IO_ERROR;
1876                 }
1877         }
1878         /* unlock the buffers from DMA */
1879         buff_dma_handle.val32.lower = c->SG[0].Addr.lower;
1880         buff_dma_handle.val32.upper = c->SG[0].Addr.upper;
1881         pci_unmap_single(h->pdev, (dma_addr_t) buff_dma_handle.val,
1882                          c->SG[0].Len, PCI_DMA_BIDIRECTIONAL);
1883         cmd_free(h, c, 0);
1884         return return_status;
1885 }
1886
1887 static void cciss_geometry_inquiry(int ctlr, int logvol,
1888                                    int withirq, sector_t total_size,
1889                                    unsigned int block_size,
1890                                    InquiryData_struct *inq_buff,
1891                                    drive_info_struct *drv)
1892 {
1893         int return_code;
1894         unsigned long t;
1895
1896         memset(inq_buff, 0, sizeof(InquiryData_struct));
1897         if (withirq)
1898                 return_code = sendcmd_withirq(CISS_INQUIRY, ctlr,
1899                                               inq_buff, sizeof(*inq_buff), 1,
1900                                               logvol, 0xC1, TYPE_CMD);
1901         else
1902                 return_code = sendcmd(CISS_INQUIRY, ctlr, inq_buff,
1903                                       sizeof(*inq_buff), 1, logvol, 0xC1, NULL,
1904                                       TYPE_CMD);
1905         if (return_code == IO_OK) {
1906                 if (inq_buff->data_byte[8] == 0xFF) {
1907                         printk(KERN_WARNING
1908                                "cciss: reading geometry failed, volume "
1909                                "does not support reading geometry\n");
1910                         drv->heads = 255;
1911                         drv->sectors = 32;      // Sectors per track
1912                         drv->raid_level = RAID_UNKNOWN;
1913                 } else {
1914                         drv->heads = inq_buff->data_byte[6];
1915                         drv->sectors = inq_buff->data_byte[7];
1916                         drv->cylinders = (inq_buff->data_byte[4] & 0xff) << 8;
1917                         drv->cylinders += inq_buff->data_byte[5];
1918                         drv->raid_level = inq_buff->data_byte[8];
1919                 }
1920                 drv->block_size = block_size;
1921                 drv->nr_blocks = total_size;
1922                 t = drv->heads * drv->sectors;
1923                 if (t > 1) {
1924                         unsigned rem = sector_div(total_size, t);
1925                         if (rem)
1926                                 total_size++;
1927                         drv->cylinders = total_size;
1928                 }
1929         } else {                /* Get geometry failed */
1930                 printk(KERN_WARNING "cciss: reading geometry failed\n");
1931         }
1932         printk(KERN_INFO "      heads=%d, sectors=%d, cylinders=%d\n\n",
1933                drv->heads, drv->sectors, drv->cylinders);
1934 }
1935
1936 static void
1937 cciss_read_capacity(int ctlr, int logvol, int withirq, sector_t *total_size,
1938                     unsigned int *block_size)
1939 {
1940         ReadCapdata_struct *buf;
1941         int return_code;
1942         buf = kmalloc(sizeof(ReadCapdata_struct), GFP_KERNEL);
1943         if (buf == NULL) {
1944                 printk(KERN_WARNING "cciss: out of memory\n");
1945                 return;
1946         }
1947         memset(buf, 0, sizeof(ReadCapdata_struct));
1948         if (withirq)
1949                 return_code = sendcmd_withirq(CCISS_READ_CAPACITY,
1950                                 ctlr, buf, sizeof(ReadCapdata_struct),
1951                                         1, logvol, 0, TYPE_CMD);
1952         else
1953                 return_code = sendcmd(CCISS_READ_CAPACITY,
1954                                 ctlr, buf, sizeof(ReadCapdata_struct),
1955                                         1, logvol, 0, NULL, TYPE_CMD);
1956         if (return_code == IO_OK) {
1957                 *total_size = be32_to_cpu(*(__u32 *) buf->total_size)+1;
1958                 *block_size = be32_to_cpu(*(__u32 *) buf->block_size);
1959         } else {                /* read capacity command failed */
1960                 printk(KERN_WARNING "cciss: read capacity failed\n");
1961                 *total_size = 0;
1962                 *block_size = BLOCK_SIZE;
1963         }
1964         if (*total_size != (__u32) 0)
1965                 printk(KERN_INFO "      blocks= %llu block_size= %d\n",
1966                 (unsigned long long)*total_size, *block_size);
1967         kfree(buf);
1968         return;
1969 }
1970
1971 static void
1972 cciss_read_capacity_16(int ctlr, int logvol, int withirq, sector_t *total_size,                                 unsigned int *block_size)
1973 {
1974         ReadCapdata_struct_16 *buf;
1975         int return_code;
1976         buf = kmalloc(sizeof(ReadCapdata_struct_16), GFP_KERNEL);
1977         if (buf == NULL) {
1978                 printk(KERN_WARNING "cciss: out of memory\n");
1979                 return;
1980         }
1981         memset(buf, 0, sizeof(ReadCapdata_struct_16));
1982         if (withirq) {
1983                 return_code = sendcmd_withirq(CCISS_READ_CAPACITY_16,
1984                         ctlr, buf, sizeof(ReadCapdata_struct_16),
1985                                 1, logvol, 0, TYPE_CMD);
1986         }
1987         else {
1988                 return_code = sendcmd(CCISS_READ_CAPACITY_16,
1989                         ctlr, buf, sizeof(ReadCapdata_struct_16),
1990                                 1, logvol, 0, NULL, TYPE_CMD);
1991         }
1992         if (return_code == IO_OK) {
1993                 *total_size = be64_to_cpu(*(__u64 *) buf->total_size)+1;
1994                 *block_size = be32_to_cpu(*(__u32 *) buf->block_size);
1995         } else {                /* read capacity command failed */
1996                 printk(KERN_WARNING "cciss: read capacity failed\n");
1997                 *total_size = 0;
1998                 *block_size = BLOCK_SIZE;
1999         }
2000         printk(KERN_INFO "      blocks= %llu block_size= %d\n",
2001                (unsigned long long)*total_size, *block_size);
2002         kfree(buf);
2003         return;
2004 }
2005
2006 static int cciss_revalidate(struct gendisk *disk)
2007 {
2008         ctlr_info_t *h = get_host(disk);
2009         drive_info_struct *drv = get_drv(disk);
2010         int logvol;
2011         int FOUND = 0;
2012         unsigned int block_size;
2013         sector_t total_size;
2014         InquiryData_struct *inq_buff = NULL;
2015
2016         for (logvol = 0; logvol < CISS_MAX_LUN; logvol++) {
2017                 if (h->drv[logvol].LunID == drv->LunID) {
2018                         FOUND = 1;
2019                         break;
2020                 }
2021         }
2022
2023         if (!FOUND)
2024                 return 1;
2025
2026         inq_buff = kmalloc(sizeof(InquiryData_struct), GFP_KERNEL);
2027         if (inq_buff == NULL) {
2028                 printk(KERN_WARNING "cciss: out of memory\n");
2029                 return 1;
2030         }
2031         if (h->cciss_read == CCISS_READ_10) {
2032                 cciss_read_capacity(h->ctlr, logvol, 1,
2033                                         &total_size, &block_size);
2034         } else {
2035                 cciss_read_capacity_16(h->ctlr, logvol, 1,
2036                                         &total_size, &block_size);
2037         }
2038         cciss_geometry_inquiry(h->ctlr, logvol, 1, total_size, block_size,
2039                                inq_buff, drv);
2040
2041         blk_queue_hardsect_size(drv->queue, drv->block_size);
2042         set_capacity(disk, drv->nr_blocks);
2043
2044         kfree(inq_buff);
2045         return 0;
2046 }
2047
2048 /*
2049  *   Wait polling for a command to complete.
2050  *   The memory mapped FIFO is polled for the completion.
2051  *   Used only at init time, interrupts from the HBA are disabled.
2052  */
2053 static unsigned long pollcomplete(int ctlr)
2054 {
2055         unsigned long done;
2056         int i;
2057
2058         /* Wait (up to 20 seconds) for a command to complete */
2059
2060         for (i = 20 * HZ; i > 0; i--) {
2061                 done = hba[ctlr]->access.command_completed(hba[ctlr]);
2062                 if (done == FIFO_EMPTY)
2063                         schedule_timeout_uninterruptible(1);
2064                 else
2065                         return done;
2066         }
2067         /* Invalid address to tell caller we ran out of time */
2068         return 1;
2069 }
2070
2071 static int add_sendcmd_reject(__u8 cmd, int ctlr, unsigned long complete)
2072 {
2073         /* We get in here if sendcmd() is polling for completions
2074            and gets some command back that it wasn't expecting --
2075            something other than that which it just sent down.
2076            Ordinarily, that shouldn't happen, but it can happen when
2077            the scsi tape stuff gets into error handling mode, and
2078            starts using sendcmd() to try to abort commands and
2079            reset tape drives.  In that case, sendcmd may pick up
2080            completions of commands that were sent to logical drives
2081            through the block i/o system, or cciss ioctls completing, etc.
2082            In that case, we need to save those completions for later
2083            processing by the interrupt handler.
2084          */
2085
2086 #ifdef CONFIG_CISS_SCSI_TAPE
2087         struct sendcmd_reject_list *srl = &hba[ctlr]->scsi_rejects;
2088
2089         /* If it's not the scsi tape stuff doing error handling, (abort */
2090         /* or reset) then we don't expect anything weird. */
2091         if (cmd != CCISS_RESET_MSG && cmd != CCISS_ABORT_MSG) {
2092 #endif
2093                 printk(KERN_WARNING "cciss cciss%d: SendCmd "
2094                        "Invalid command list address returned! (%lx)\n",
2095                        ctlr, complete);
2096                 /* not much we can do. */
2097 #ifdef CONFIG_CISS_SCSI_TAPE
2098                 return 1;
2099         }
2100
2101         /* We've sent down an abort or reset, but something else
2102            has completed */
2103         if (srl->ncompletions >= (hba[ctlr]->nr_cmds + 2)) {
2104                 /* Uh oh.  No room to save it for later... */
2105                 printk(KERN_WARNING "cciss%d: Sendcmd: Invalid command addr, "
2106                        "reject list overflow, command lost!\n", ctlr);
2107                 return 1;
2108         }
2109         /* Save it for later */
2110         srl->complete[srl->ncompletions] = complete;
2111         srl->ncompletions++;
2112 #endif
2113         return 0;
2114 }
2115
2116 /*
2117  * Send a command to the controller, and wait for it to complete.
2118  * Only used at init time.
2119  */
2120 static int sendcmd(__u8 cmd, int ctlr, void *buff, size_t size, unsigned int use_unit_num,      /* 0: address the controller,
2121                                                                                                    1: address logical volume log_unit,
2122                                                                                                    2: periph device address is scsi3addr */
2123                    unsigned int log_unit,
2124                    __u8 page_code, unsigned char *scsi3addr, int cmd_type)
2125 {
2126         CommandList_struct *c;
2127         int i;
2128         unsigned long complete;
2129         ctlr_info_t *info_p = hba[ctlr];
2130         u64bit buff_dma_handle;
2131         int status, done = 0;
2132
2133         if ((c = cmd_alloc(info_p, 1)) == NULL) {
2134                 printk(KERN_WARNING "cciss: unable to get memory");
2135                 return IO_ERROR;
2136         }
2137         status = fill_cmd(c, cmd, ctlr, buff, size, use_unit_num,
2138                           log_unit, page_code, scsi3addr, cmd_type);
2139         if (status != IO_OK) {
2140                 cmd_free(info_p, c, 1);
2141                 return status;
2142         }
2143       resend_cmd1:
2144         /*
2145          * Disable interrupt
2146          */
2147 #ifdef CCISS_DEBUG
2148         printk(KERN_DEBUG "cciss: turning intr off\n");
2149 #endif                          /* CCISS_DEBUG */
2150         info_p->access.set_intr_mask(info_p, CCISS_INTR_OFF);
2151
2152         /* Make sure there is room in the command FIFO */
2153         /* Actually it should be completely empty at this time */
2154         /* unless we are in here doing error handling for the scsi */
2155         /* tape side of the driver. */
2156         for (i = 200000; i > 0; i--) {
2157                 /* if fifo isn't full go */
2158                 if (!(info_p->access.fifo_full(info_p))) {
2159
2160                         break;
2161                 }
2162                 udelay(10);
2163                 printk(KERN_WARNING "cciss cciss%d: SendCmd FIFO full,"
2164                        " waiting!\n", ctlr);
2165         }
2166         /*
2167          * Send the cmd
2168          */
2169         info_p->access.submit_command(info_p, c);
2170         done = 0;
2171         do {
2172                 complete = pollcomplete(ctlr);
2173
2174 #ifdef CCISS_DEBUG
2175                 printk(KERN_DEBUG "cciss: command completed\n");
2176 #endif                          /* CCISS_DEBUG */
2177
2178                 if (complete == 1) {
2179                         printk(KERN_WARNING
2180                                "cciss cciss%d: SendCmd Timeout out, "
2181                                "No command list address returned!\n", ctlr);
2182                         status = IO_ERROR;
2183                         done = 1;
2184                         break;
2185                 }
2186
2187                 /* This will need to change for direct lookup completions */
2188                 if ((complete & CISS_ERROR_BIT)
2189                     && (complete & ~CISS_ERROR_BIT) == c->busaddr) {
2190                         /* if data overrun or underun on Report command
2191                            ignore it
2192                          */
2193                         if (((c->Request.CDB[0] == CISS_REPORT_LOG) ||
2194                              (c->Request.CDB[0] == CISS_REPORT_PHYS) ||
2195                              (c->Request.CDB[0] == CISS_INQUIRY)) &&
2196                             ((c->err_info->CommandStatus ==
2197                               CMD_DATA_OVERRUN) ||
2198                              (c->err_info->CommandStatus == CMD_DATA_UNDERRUN)
2199                             )) {
2200                                 complete = c->busaddr;
2201                         } else {
2202                                 if (c->err_info->CommandStatus ==
2203                                     CMD_UNSOLICITED_ABORT) {
2204                                         printk(KERN_WARNING "cciss%d: "
2205                                                "unsolicited abort %p\n",
2206                                                ctlr, c);
2207                                         if (c->retry_count < MAX_CMD_RETRIES) {
2208                                                 printk(KERN_WARNING
2209                                                        "cciss%d: retrying %p\n",
2210                                                        ctlr, c);
2211                                                 c->retry_count++;
2212                                                 /* erase the old error */
2213                                                 /* information */
2214                                                 memset(c->err_info, 0,
2215                                                        sizeof
2216                                                        (ErrorInfo_struct));
2217                                                 goto resend_cmd1;
2218                                         } else {
2219                                                 printk(KERN_WARNING
2220                                                        "cciss%d: retried %p too "
2221                                                        "many times\n", ctlr, c);
2222                                                 status = IO_ERROR;
2223                                                 goto cleanup1;
2224                                         }
2225                                 } else if (c->err_info->CommandStatus ==
2226                                            CMD_UNABORTABLE) {
2227                                         printk(KERN_WARNING
2228                                                "cciss%d: command could not be aborted.\n",
2229                                                ctlr);
2230                                         status = IO_ERROR;
2231                                         goto cleanup1;
2232                                 }
2233                                 printk(KERN_WARNING "ciss ciss%d: sendcmd"
2234                                        " Error %x \n", ctlr,
2235                                        c->err_info->CommandStatus);
2236                                 printk(KERN_WARNING "ciss ciss%d: sendcmd"
2237                                        " offensive info\n"
2238                                        "  size %x\n   num %x   value %x\n",
2239                                        ctlr,
2240                                        c->err_info->MoreErrInfo.Invalid_Cmd.
2241                                        offense_size,
2242                                        c->err_info->MoreErrInfo.Invalid_Cmd.
2243                                        offense_num,
2244                                        c->err_info->MoreErrInfo.Invalid_Cmd.
2245                                        offense_value);
2246                                 status = IO_ERROR;
2247                                 goto cleanup1;
2248                         }
2249                 }
2250                 /* This will need changing for direct lookup completions */
2251                 if (complete != c->busaddr) {
2252                         if (add_sendcmd_reject(cmd, ctlr, complete) != 0) {
2253                                 BUG();  /* we are pretty much hosed if we get here. */
2254                         }
2255                         continue;
2256                 } else
2257                         done = 1;
2258         } while (!done);
2259
2260       cleanup1:
2261         /* unlock the data buffer from DMA */
2262         buff_dma_handle.val32.lower = c->SG[0].Addr.lower;
2263         buff_dma_handle.val32.upper = c->SG[0].Addr.upper;
2264         pci_unmap_single(info_p->pdev, (dma_addr_t) buff_dma_handle.val,
2265                          c->SG[0].Len, PCI_DMA_BIDIRECTIONAL);
2266 #ifdef CONFIG_CISS_SCSI_TAPE
2267         /* if we saved some commands for later, process them now. */
2268         if (info_p->scsi_rejects.ncompletions > 0)
2269                 do_cciss_intr(0, info_p);
2270 #endif
2271         cmd_free(info_p, c, 1);
2272         return status;
2273 }
2274
2275 /*
2276  * Map (physical) PCI mem into (virtual) kernel space
2277  */
2278 static void __iomem *remap_pci_mem(ulong base, ulong size)
2279 {
2280         ulong page_base = ((ulong) base) & PAGE_MASK;
2281         ulong page_offs = ((ulong) base) - page_base;
2282         void __iomem *page_remapped = ioremap(page_base, page_offs + size);
2283
2284         return page_remapped ? (page_remapped + page_offs) : NULL;
2285 }
2286
2287 /*
2288  * Takes jobs of the Q and sends them to the hardware, then puts it on
2289  * the Q to wait for completion.
2290  */
2291 static void start_io(ctlr_info_t *h)
2292 {
2293         CommandList_struct *c;
2294
2295         while ((c = h->reqQ) != NULL) {
2296                 /* can't do anything if fifo is full */
2297                 if ((h->access.fifo_full(h))) {
2298                         printk(KERN_WARNING "cciss: fifo full\n");
2299                         break;
2300                 }
2301
2302                 /* Get the first entry from the Request Q */
2303                 removeQ(&(h->reqQ), c);
2304                 h->Qdepth--;
2305
2306                 /* Tell the controller execute command */
2307                 h->access.submit_command(h, c);
2308
2309                 /* Put job onto the completed Q */
2310                 addQ(&(h->cmpQ), c);
2311         }
2312 }
2313
2314 /* Assumes that CCISS_LOCK(h->ctlr) is held. */
2315 /* Zeros out the error record and then resends the command back */
2316 /* to the controller */
2317 static inline void resend_cciss_cmd(ctlr_info_t *h, CommandList_struct *c)
2318 {
2319         /* erase the old error information */
2320         memset(c->err_info, 0, sizeof(ErrorInfo_struct));
2321
2322         /* add it to software queue and then send it to the controller */
2323         addQ(&(h->reqQ), c);
2324         h->Qdepth++;
2325         if (h->Qdepth > h->maxQsinceinit)
2326                 h->maxQsinceinit = h->Qdepth;
2327
2328         start_io(h);
2329 }
2330
2331 /* checks the status of the job and calls complete buffers to mark all
2332  * buffers for the completed job. Note that this function does not need
2333  * to hold the hba/queue lock.
2334  */
2335 static inline void complete_command(ctlr_info_t *h, CommandList_struct *cmd,
2336                                     int timeout)
2337 {
2338         int status = 1;
2339         int retry_cmd = 0;
2340
2341         if (timeout)
2342                 status = 0;
2343
2344         if (cmd->err_info->CommandStatus != 0) {        /* an error has occurred */
2345                 switch (cmd->err_info->CommandStatus) {
2346                         unsigned char sense_key;
2347                 case CMD_TARGET_STATUS:
2348                         status = 0;
2349
2350                         if (cmd->err_info->ScsiStatus == 0x02) {
2351                                 printk(KERN_WARNING "cciss: cmd %p "
2352                                        "has CHECK CONDITION "
2353                                        " byte 2 = 0x%x\n", cmd,
2354                                        cmd->err_info->SenseInfo[2]
2355                                     );
2356                                 /* check the sense key */
2357                                 sense_key = 0xf & cmd->err_info->SenseInfo[2];
2358                                 /* no status or recovered error */
2359                                 if ((sense_key == 0x0) || (sense_key == 0x1)) {
2360                                         status = 1;
2361                                 }
2362                         } else {
2363                                 printk(KERN_WARNING "cciss: cmd %p "
2364                                        "has SCSI Status 0x%x\n",
2365                                        cmd, cmd->err_info->ScsiStatus);
2366                         }
2367                         break;
2368                 case CMD_DATA_UNDERRUN:
2369                         printk(KERN_WARNING "cciss: cmd %p has"
2370                                " completed with data underrun "
2371                                "reported\n", cmd);
2372                         break;
2373                 case CMD_DATA_OVERRUN:
2374                         printk(KERN_WARNING "cciss: cmd %p has"
2375                                " completed with data overrun "
2376                                "reported\n", cmd);
2377                         break;
2378                 case CMD_INVALID:
2379                         printk(KERN_WARNING "cciss: cmd %p is "
2380                                "reported invalid\n", cmd);
2381                         status = 0;
2382                         break;
2383                 case CMD_PROTOCOL_ERR:
2384                         printk(KERN_WARNING "cciss: cmd %p has "
2385                                "protocol error \n", cmd);
2386                         status = 0;
2387                         break;
2388                 case CMD_HARDWARE_ERR:
2389                         printk(KERN_WARNING "cciss: cmd %p had "
2390                                " hardware error\n", cmd);
2391                         status = 0;
2392                         break;
2393                 case CMD_CONNECTION_LOST:
2394                         printk(KERN_WARNING "cciss: cmd %p had "
2395                                "connection lost\n", cmd);
2396                         status = 0;
2397                         break;
2398                 case CMD_ABORTED:
2399                         printk(KERN_WARNING "cciss: cmd %p was "
2400                                "aborted\n", cmd);
2401                         status = 0;
2402                         break;
2403                 case CMD_ABORT_FAILED:
2404                         printk(KERN_WARNING "cciss: cmd %p reports "
2405                                "abort failed\n", cmd);
2406                         status = 0;
2407                         break;
2408                 case CMD_UNSOLICITED_ABORT:
2409                         printk(KERN_WARNING "cciss%d: unsolicited "
2410                                "abort %p\n", h->ctlr, cmd);
2411                         if (cmd->retry_count < MAX_CMD_RETRIES) {
2412                                 retry_cmd = 1;
2413                                 printk(KERN_WARNING
2414                                        "cciss%d: retrying %p\n", h->ctlr, cmd);
2415                                 cmd->retry_count++;
2416                         } else
2417                                 printk(KERN_WARNING
2418                                        "cciss%d: %p retried too "
2419                                        "many times\n", h->ctlr, cmd);
2420                         status = 0;
2421                         break;
2422                 case CMD_TIMEOUT:
2423                         printk(KERN_WARNING "cciss: cmd %p timedout\n", cmd);
2424                         status = 0;
2425                         break;
2426                 default:
2427                         printk(KERN_WARNING "cciss: cmd %p returned "
2428                                "unknown status %x\n", cmd,
2429                                cmd->err_info->CommandStatus);
2430                         status = 0;
2431                 }
2432         }
2433         /* We need to return this command */
2434         if (retry_cmd) {
2435                 resend_cciss_cmd(h, cmd);
2436                 return;
2437         }
2438
2439         cmd->rq->completion_data = cmd;
2440         cmd->rq->errors = status;
2441         blk_add_trace_rq(cmd->rq->q, cmd->rq, BLK_TA_COMPLETE);
2442         blk_complete_request(cmd->rq);
2443 }
2444
2445 /*
2446  * Get a request and submit it to the controller.
2447  */
2448 static void do_cciss_request(request_queue_t *q)
2449 {
2450         ctlr_info_t *h = q->queuedata;
2451         CommandList_struct *c;
2452         sector_t start_blk;
2453         int seg;
2454         struct request *creq;
2455         u64bit temp64;
2456         struct scatterlist tmp_sg[MAXSGENTRIES];
2457         drive_info_struct *drv;
2458         int i, dir;
2459
2460         /* We call start_io here in case there is a command waiting on the
2461          * queue that has not been sent.
2462          */
2463         if (blk_queue_plugged(q))
2464                 goto startio;
2465
2466       queue:
2467         creq = elv_next_request(q);
2468         if (!creq)
2469                 goto startio;
2470
2471         BUG_ON(creq->nr_phys_segments > MAXSGENTRIES);
2472
2473         if ((c = cmd_alloc(h, 1)) == NULL)
2474                 goto full;
2475
2476         blkdev_dequeue_request(creq);
2477
2478         spin_unlock_irq(q->queue_lock);
2479
2480         c->cmd_type = CMD_RWREQ;
2481         c->rq = creq;
2482
2483         /* fill in the request */
2484         drv = creq->rq_disk->private_data;
2485         c->Header.ReplyQueue = 0;       // unused in simple mode
2486         /* got command from pool, so use the command block index instead */
2487         /* for direct lookups. */
2488         /* The first 2 bits are reserved for controller error reporting. */
2489         c->Header.Tag.lower = (c->cmdindex << 3);
2490         c->Header.Tag.lower |= 0x04;    /* flag for direct lookup. */
2491         c->Header.LUN.LogDev.VolId = drv->LunID;
2492         c->Header.LUN.LogDev.Mode = 1;
2493         c->Request.CDBLen = 10; // 12 byte commands not in FW yet;
2494         c->Request.Type.Type = TYPE_CMD;        // It is a command.
2495         c->Request.Type.Attribute = ATTR_SIMPLE;
2496         c->Request.Type.Direction =
2497             (rq_data_dir(creq) == READ) ? XFER_READ : XFER_WRITE;
2498         c->Request.Timeout = 0; // Don't time out
2499         c->Request.CDB[0] =
2500             (rq_data_dir(creq) == READ) ? h->cciss_read : h->cciss_write;
2501         start_blk = creq->sector;
2502 #ifdef CCISS_DEBUG
2503         printk(KERN_DEBUG "ciss: sector =%d nr_sectors=%d\n", (int)creq->sector,
2504                (int)creq->nr_sectors);
2505 #endif                          /* CCISS_DEBUG */
2506
2507         seg = blk_rq_map_sg(q, creq, tmp_sg);
2508
2509         /* get the DMA records for the setup */
2510         if (c->Request.Type.Direction == XFER_READ)
2511                 dir = PCI_DMA_FROMDEVICE;
2512         else
2513                 dir = PCI_DMA_TODEVICE;
2514
2515         for (i = 0; i < seg; i++) {
2516                 c->SG[i].Len = tmp_sg[i].length;
2517                 temp64.val = (__u64) pci_map_page(h->pdev, tmp_sg[i].page,
2518                                                   tmp_sg[i].offset,
2519                                                   tmp_sg[i].length, dir);
2520                 c->SG[i].Addr.lower = temp64.val32.lower;
2521                 c->SG[i].Addr.upper = temp64.val32.upper;
2522                 c->SG[i].Ext = 0;       // we are not chaining
2523         }
2524         /* track how many SG entries we are using */
2525         if (seg > h->maxSG)
2526                 h->maxSG = seg;
2527
2528 #ifdef CCISS_DEBUG
2529         printk(KERN_DEBUG "cciss: Submitting %d sectors in %d segments\n",
2530                creq->nr_sectors, seg);
2531 #endif                          /* CCISS_DEBUG */
2532
2533         c->Header.SGList = c->Header.SGTotal = seg;
2534         if(h->cciss_read == CCISS_READ_10) {
2535                 c->Request.CDB[1] = 0;
2536                 c->Request.CDB[2] = (start_blk >> 24) & 0xff;   //MSB
2537                 c->Request.CDB[3] = (start_blk >> 16) & 0xff;
2538                 c->Request.CDB[4] = (start_blk >> 8) & 0xff;
2539                 c->Request.CDB[5] = start_blk & 0xff;
2540                 c->Request.CDB[6] = 0;  // (sect >> 24) & 0xff; MSB
2541                 c->Request.CDB[7] = (creq->nr_sectors >> 8) & 0xff;
2542                 c->Request.CDB[8] = creq->nr_sectors & 0xff;
2543                 c->Request.CDB[9] = c->Request.CDB[11] = c->Request.CDB[12] = 0;
2544         } else {
2545                 c->Request.CDBLen = 16;
2546                 c->Request.CDB[1]= 0;
2547                 c->Request.CDB[2]= (start_blk >> 56) & 0xff;    //MSB
2548                 c->Request.CDB[3]= (start_blk >> 48) & 0xff;
2549                 c->Request.CDB[4]= (start_blk >> 40) & 0xff;
2550                 c->Request.CDB[5]= (start_blk >> 32) & 0xff;
2551                 c->Request.CDB[6]= (start_blk >> 24) & 0xff;
2552                 c->Request.CDB[7]= (start_blk >> 16) & 0xff;
2553                 c->Request.CDB[8]= (start_blk >>  8) & 0xff;
2554                 c->Request.CDB[9]= start_blk & 0xff;
2555                 c->Request.CDB[10]= (creq->nr_sectors >>  24) & 0xff;
2556                 c->Request.CDB[11]= (creq->nr_sectors >>  16) & 0xff;
2557                 c->Request.CDB[12]= (creq->nr_sectors >>  8) & 0xff;
2558                 c->Request.CDB[13]= creq->nr_sectors & 0xff;
2559                 c->Request.CDB[14] = c->Request.CDB[15] = 0;
2560         }
2561
2562         spin_lock_irq(q->queue_lock);
2563
2564         addQ(&(h->reqQ), c);
2565         h->Qdepth++;
2566         if (h->Qdepth > h->maxQsinceinit)
2567                 h->maxQsinceinit = h->Qdepth;
2568
2569         goto queue;
2570 full:
2571         blk_stop_queue(q);
2572 startio:
2573         /* We will already have the driver lock here so not need
2574          * to lock it.
2575          */
2576         start_io(h);
2577 }
2578
2579 static inline unsigned long get_next_completion(ctlr_info_t *h)
2580 {
2581 #ifdef CONFIG_CISS_SCSI_TAPE
2582         /* Any rejects from sendcmd() lying around? Process them first */
2583         if (h->scsi_rejects.ncompletions == 0)
2584                 return h->access.command_completed(h);
2585         else {
2586                 struct sendcmd_reject_list *srl;
2587                 int n;
2588                 srl = &h->scsi_rejects;
2589                 n = --srl->ncompletions;
2590                 /* printk("cciss%d: processing saved reject\n", h->ctlr); */
2591                 printk("p");
2592                 return srl->complete[n];
2593         }
2594 #else
2595         return h->access.command_completed(h);
2596 #endif
2597 }
2598
2599 static inline int interrupt_pending(ctlr_info_t *h)
2600 {
2601 #ifdef CONFIG_CISS_SCSI_TAPE
2602         return (h->access.intr_pending(h)
2603                 || (h->scsi_rejects.ncompletions > 0));
2604 #else
2605         return h->access.intr_pending(h);
2606 #endif
2607 }
2608
2609 static inline long interrupt_not_for_us(ctlr_info_t *h)
2610 {
2611 #ifdef CONFIG_CISS_SCSI_TAPE
2612         return (((h->access.intr_pending(h) == 0) ||
2613                  (h->interrupts_enabled == 0))
2614                 && (h->scsi_rejects.ncompletions == 0));
2615 #else
2616         return (((h->access.intr_pending(h) == 0) ||
2617                  (h->interrupts_enabled == 0)));
2618 #endif
2619 }
2620
2621 static irqreturn_t do_cciss_intr(int irq, void *dev_id)
2622 {
2623         ctlr_info_t *h = dev_id;
2624         CommandList_struct *c;
2625         unsigned long flags;
2626         __u32 a, a1, a2;
2627
2628         if (interrupt_not_for_us(h))
2629                 return IRQ_NONE;
2630         /*
2631          * If there are completed commands in the completion queue,
2632          * we had better do something about it.
2633          */
2634         spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
2635         while (interrupt_pending(h)) {
2636                 while ((a = get_next_completion(h)) != FIFO_EMPTY) {
2637                         a1 = a;
2638                         if ((a & 0x04)) {
2639                                 a2 = (a >> 3);
2640                                 if (a2 >= h->nr_cmds) {
2641                                         printk(KERN_WARNING
2642                                                "cciss: controller cciss%d failed, stopping.\n",
2643                                                h->ctlr);
2644                                         fail_all_cmds(h->ctlr);
2645                                         return IRQ_HANDLED;
2646                                 }
2647
2648                                 c = h->cmd_pool + a2;
2649                                 a = c->busaddr;
2650
2651                         } else {
2652                                 a &= ~3;
2653                                 if ((c = h->cmpQ) == NULL) {
2654                                         printk(KERN_WARNING
2655                                                "cciss: Completion of %08x ignored\n",
2656                                                a1);
2657                                         continue;
2658                                 }
2659                                 while (c->busaddr != a) {
2660                                         c = c->next;
2661                                         if (c == h->cmpQ)
2662                                                 break;
2663                                 }
2664                         }
2665                         /*
2666                          * If we've found the command, take it off the
2667                          * completion Q and free it
2668                          */
2669                         if (c->busaddr == a) {
2670                                 removeQ(&h->cmpQ, c);
2671                                 if (c->cmd_type == CMD_RWREQ) {
2672                                         complete_command(h, c, 0);
2673                                 } else if (c->cmd_type == CMD_IOCTL_PEND) {
2674                                         complete(c->waiting);
2675                                 }
2676 #                               ifdef CONFIG_CISS_SCSI_TAPE
2677                                 else if (c->cmd_type == CMD_SCSI)
2678                                         complete_scsi_command(c, 0, a1);
2679 #                               endif
2680                                 continue;
2681                         }
2682                 }
2683         }
2684
2685         spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
2686         return IRQ_HANDLED;
2687 }
2688
2689 /*
2690  *  We cannot read the structure directly, for portability we must use
2691  *   the io functions.
2692  *   This is for debug only.
2693  */
2694 #ifdef CCISS_DEBUG
2695 static void print_cfg_table(CfgTable_struct *tb)
2696 {
2697         int i;
2698         char temp_name[17];
2699
2700         printk("Controller Configuration information\n");
2701         printk("------------------------------------\n");
2702         for (i = 0; i < 4; i++)
2703                 temp_name[i] = readb(&(tb->Signature[i]));
2704         temp_name[4] = '\0';
2705         printk("   Signature = %s\n", temp_name);
2706         printk("   Spec Number = %d\n", readl(&(tb->SpecValence)));
2707         printk("   Transport methods supported = 0x%x\n",
2708                readl(&(tb->TransportSupport)));
2709         printk("   Transport methods active = 0x%x\n",
2710                readl(&(tb->TransportActive)));
2711         printk("   Requested transport Method = 0x%x\n",
2712                readl(&(tb->HostWrite.TransportRequest)));
2713         printk("   Coalesce Interrupt Delay = 0x%x\n",
2714                readl(&(tb->HostWrite.CoalIntDelay)));
2715         printk("   Coalesce Interrupt Count = 0x%x\n",
2716                readl(&(tb->HostWrite.CoalIntCount)));
2717         printk("   Max outstanding commands = 0x%d\n",
2718                readl(&(tb->CmdsOutMax)));
2719         printk("   Bus Types = 0x%x\n", readl(&(tb->BusTypes)));
2720         for (i = 0; i < 16; i++)
2721                 temp_name[i] = readb(&(tb->ServerName[i]));
2722         temp_name[16] = '\0';
2723         printk("   Server Name = %s\n", temp_name);
2724         printk("   Heartbeat Counter = 0x%x\n\n\n", readl(&(tb->HeartBeat)));
2725 }
2726 #endif                          /* CCISS_DEBUG */
2727
2728 static int find_PCI_BAR_index(struct pci_dev *pdev, unsigned long pci_bar_addr)
2729 {
2730         int i, offset, mem_type, bar_type;
2731         if (pci_bar_addr == PCI_BASE_ADDRESS_0) /* looking for BAR zero? */
2732                 return 0;
2733         offset = 0;
2734         for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
2735                 bar_type = pci_resource_flags(pdev, i) & PCI_BASE_ADDRESS_SPACE;
2736                 if (bar_type == PCI_BASE_ADDRESS_SPACE_IO)
2737                         offset += 4;
2738                 else {
2739                         mem_type = pci_resource_flags(pdev, i) &
2740                             PCI_BASE_ADDRESS_MEM_TYPE_MASK;
2741                         switch (mem_type) {
2742                         case PCI_BASE_ADDRESS_MEM_TYPE_32:
2743                         case PCI_BASE_ADDRESS_MEM_TYPE_1M:
2744                                 offset += 4;    /* 32 bit */
2745                                 break;
2746                         case PCI_BASE_ADDRESS_MEM_TYPE_64:
2747                                 offset += 8;
2748                                 break;
2749                         default:        /* reserved in PCI 2.2 */
2750                                 printk(KERN_WARNING
2751                                        "Base address is invalid\n");
2752                                 return -1;
2753                                 break;
2754                         }
2755                 }
2756                 if (offset == pci_bar_addr - PCI_BASE_ADDRESS_0)
2757                         return i + 1;
2758         }
2759         return -1;
2760 }
2761
2762 /* If MSI/MSI-X is supported by the kernel we will try to enable it on
2763  * controllers that are capable. If not, we use IO-APIC mode.
2764  */
2765
2766 static void __devinit cciss_interrupt_mode(ctlr_info_t *c,
2767                                            struct pci_dev *pdev, __u32 board_id)
2768 {
2769 #ifdef CONFIG_PCI_MSI
2770         int err;
2771         struct msix_entry cciss_msix_entries[4] = { {0, 0}, {0, 1},
2772         {0, 2}, {0, 3}
2773         };
2774
2775         /* Some boards advertise MSI but don't really support it */
2776         if ((board_id == 0x40700E11) ||
2777             (board_id == 0x40800E11) ||
2778             (board_id == 0x40820E11) || (board_id == 0x40830E11))
2779                 goto default_int_mode;
2780
2781         if (pci_find_capability(pdev, PCI_CAP_ID_MSIX)) {
2782                 err = pci_enable_msix(pdev, cciss_msix_entries, 4);
2783                 if (!err) {
2784                         c->intr[0] = cciss_msix_entries[0].vector;
2785                         c->intr[1] = cciss_msix_entries[1].vector;
2786                         c->intr[2] = cciss_msix_entries[2].vector;
2787                         c->intr[3] = cciss_msix_entries[3].vector;
2788                         c->msix_vector = 1;
2789                         return;
2790                 }
2791                 if (err > 0) {
2792                         printk(KERN_WARNING "cciss: only %d MSI-X vectors "
2793                                "available\n", err);
2794                         goto default_int_mode;
2795                 } else {
2796                         printk(KERN_WARNING "cciss: MSI-X init failed %d\n",
2797                                err);
2798                         goto default_int_mode;
2799                 }
2800         }
2801         if (pci_find_capability(pdev, PCI_CAP_ID_MSI)) {
2802                 if (!pci_enable_msi(pdev)) {
2803                         c->msi_vector = 1;
2804                 } else {
2805                         printk(KERN_WARNING "cciss: MSI init failed\n");
2806                 }
2807         }
2808 default_int_mode:
2809 #endif                          /* CONFIG_PCI_MSI */
2810         /* if we get here we're going to use the default interrupt mode */
2811         c->intr[SIMPLE_MODE_INT] = pdev->irq;
2812         return;
2813 }
2814
2815 static int cciss_pci_init(ctlr_info_t *c, struct pci_dev *pdev)
2816 {
2817         ushort subsystem_vendor_id, subsystem_device_id, command;
2818         __u32 board_id, scratchpad = 0;
2819         __u64 cfg_offset;
2820         __u32 cfg_base_addr;
2821         __u64 cfg_base_addr_index;
2822         int i, err;
2823
2824         /* check to see if controller has been disabled */
2825         /* BEFORE trying to enable it */
2826         (void)pci_read_config_word(pdev, PCI_COMMAND, &command);
2827         if (!(command & 0x02)) {
2828                 printk(KERN_WARNING
2829                        "cciss: controller appears to be disabled\n");
2830                 return -ENODEV;
2831         }
2832
2833         err = pci_enable_device(pdev);
2834         if (err) {
2835                 printk(KERN_ERR "cciss: Unable to Enable PCI device\n");
2836                 return err;
2837         }
2838
2839         err = pci_request_regions(pdev, "cciss");
2840         if (err) {
2841                 printk(KERN_ERR "cciss: Cannot obtain PCI resources, "
2842                        "aborting\n");
2843                 return err;
2844         }
2845
2846         subsystem_vendor_id = pdev->subsystem_vendor;
2847         subsystem_device_id = pdev->subsystem_device;
2848         board_id = (((__u32) (subsystem_device_id << 16) & 0xffff0000) |
2849                     subsystem_vendor_id);
2850
2851 #ifdef CCISS_DEBUG
2852         printk("command = %x\n", command);
2853         printk("irq = %x\n", pdev->irq);
2854         printk("board_id = %x\n", board_id);
2855 #endif                          /* CCISS_DEBUG */
2856
2857 /* If the kernel supports MSI/MSI-X we will try to enable that functionality,
2858  * else we use the IO-APIC interrupt assigned to us by system ROM.
2859  */
2860         cciss_interrupt_mode(c, pdev, board_id);
2861
2862         /*
2863          * Memory base addr is first addr , the second points to the config
2864          *   table
2865          */
2866
2867         c->paddr = pci_resource_start(pdev, 0); /* addressing mode bits already removed */
2868 #ifdef CCISS_DEBUG
2869         printk("address 0 = %x\n", c->paddr);
2870 #endif                          /* CCISS_DEBUG */
2871         c->vaddr = remap_pci_mem(c->paddr, 0x250);
2872
2873         /* Wait for the board to become ready.  (PCI hotplug needs this.)
2874          * We poll for up to 120 secs, once per 100ms. */
2875         for (i = 0; i < 1200; i++) {
2876                 scratchpad = readl(c->vaddr + SA5_SCRATCHPAD_OFFSET);
2877                 if (scratchpad == CCISS_FIRMWARE_READY)
2878                         break;
2879                 set_current_state(TASK_INTERRUPTIBLE);
2880                 schedule_timeout(HZ / 10);      /* wait 100ms */
2881         }
2882         if (scratchpad != CCISS_FIRMWARE_READY) {
2883                 printk(KERN_WARNING "cciss: Board not ready.  Timed out.\n");
2884                 err = -ENODEV;
2885                 goto err_out_free_res;
2886         }
2887
2888         /* get the address index number */
2889         cfg_base_addr = readl(c->vaddr + SA5_CTCFG_OFFSET);
2890         cfg_base_addr &= (__u32) 0x0000ffff;
2891 #ifdef CCISS_DEBUG
2892         printk("cfg base address = %x\n", cfg_base_addr);
2893 #endif                          /* CCISS_DEBUG */
2894         cfg_base_addr_index = find_PCI_BAR_index(pdev, cfg_base_addr);
2895 #ifdef CCISS_DEBUG
2896         printk("cfg base address index = %x\n", cfg_base_addr_index);
2897 #endif                          /* CCISS_DEBUG */
2898         if (cfg_base_addr_index == -1) {
2899                 printk(KERN_WARNING "cciss: Cannot find cfg_base_addr_index\n");
2900                 err = -ENODEV;
2901                 goto err_out_free_res;
2902         }
2903
2904         cfg_offset = readl(c->vaddr + SA5_CTMEM_OFFSET);
2905 #ifdef CCISS_DEBUG
2906         printk("cfg offset = %x\n", cfg_offset);
2907 #endif                          /* CCISS_DEBUG */
2908         c->cfgtable = remap_pci_mem(pci_resource_start(pdev,
2909                                                        cfg_base_addr_index) +
2910                                     cfg_offset, sizeof(CfgTable_struct));
2911         c->board_id = board_id;
2912
2913 #ifdef CCISS_DEBUG
2914         print_cfg_table(c->cfgtable);
2915 #endif                          /* CCISS_DEBUG */
2916
2917         for (i = 0; i < ARRAY_SIZE(products); i++) {
2918                 if (board_id == products[i].board_id) {
2919                         c->product_name = products[i].product_name;
2920                         c->access = *(products[i].access);
2921                         c->nr_cmds = products[i].nr_cmds;
2922                         break;
2923                 }
2924         }
2925         if ((readb(&c->cfgtable->Signature[0]) != 'C') ||
2926             (readb(&c->cfgtable->Signature[1]) != 'I') ||
2927             (readb(&c->cfgtable->Signature[2]) != 'S') ||
2928             (readb(&c->cfgtable->Signature[3]) != 'S')) {
2929                 printk("Does not appear to be a valid CISS config table\n");
2930                 err = -ENODEV;
2931                 goto err_out_free_res;
2932         }
2933         /* We didn't find the controller in our list. We know the
2934          * signature is valid. If it's an HP device let's try to
2935          * bind to the device and fire it up. Otherwise we bail.
2936          */
2937         if (i == ARRAY_SIZE(products)) {
2938                 if (subsystem_vendor_id == PCI_VENDOR_ID_HP) {
2939                         c->product_name = products[i-1].product_name;
2940                         c->access = *(products[i-1].access);
2941                         c->nr_cmds = products[i-1].nr_cmds;
2942                         printk(KERN_WARNING "cciss: This is an unknown "
2943                                 "Smart Array controller.\n"
2944                                 "cciss: Please update to the latest driver "
2945                                 "available from www.hp.com.\n");
2946                 } else {
2947                         printk(KERN_WARNING "cciss: Sorry, I don't know how"
2948                                 " to access the Smart Array controller %08lx\n"
2949                                         , (unsigned long)board_id);
2950                         err = -ENODEV;
2951                         goto err_out_free_res;
2952                 }
2953         }
2954 #ifdef CONFIG_X86
2955         {
2956                 /* Need to enable prefetch in the SCSI core for 6400 in x86 */
2957                 __u32 prefetch;
2958                 prefetch = readl(&(c->cfgtable->SCSI_Prefetch));
2959                 prefetch |= 0x100;
2960                 writel(prefetch, &(c->cfgtable->SCSI_Prefetch));
2961         }
2962 #endif
2963
2964         /* Disabling DMA prefetch for the P600
2965          * An ASIC bug may result in a prefetch beyond
2966          * physical memory.
2967          */
2968         if(board_id == 0x3225103C) {
2969                 __u32 dma_prefetch;
2970                 dma_prefetch = readl(c->vaddr + I2O_DMA1_CFG);
2971                 dma_prefetch |= 0x8000;
2972                 writel(dma_prefetch, c->vaddr + I2O_DMA1_CFG);
2973         }
2974
2975 #ifdef CCISS_DEBUG
2976         printk("Trying to put board into Simple mode\n");
2977 #endif                          /* CCISS_DEBUG */
2978         c->max_commands = readl(&(c->cfgtable->CmdsOutMax));
2979         /* Update the field, and then ring the doorbell */
2980         writel(CFGTBL_Trans_Simple, &(c->cfgtable->HostWrite.TransportRequest));
2981         writel(CFGTBL_ChangeReq, c->vaddr + SA5_DOORBELL);
2982
2983         /* under certain very rare conditions, this can take awhile.
2984          * (e.g.: hot replace a failed 144GB drive in a RAID 5 set right
2985          * as we enter this code.) */
2986         for (i = 0; i < MAX_CONFIG_WAIT; i++) {
2987                 if (!(readl(c->vaddr + SA5_DOORBELL) & CFGTBL_ChangeReq))
2988                         break;
2989                 /* delay and try again */
2990                 set_current_state(TASK_INTERRUPTIBLE);
2991                 schedule_timeout(10);
2992         }
2993
2994 #ifdef CCISS_DEBUG
2995         printk(KERN_DEBUG "I counter got to %d %x\n", i,
2996                readl(c->vaddr + SA5_DOORBELL));
2997 #endif                          /* CCISS_DEBUG */
2998 #ifdef CCISS_DEBUG
2999         print_cfg_table(c->cfgtable);
3000 #endif                          /* CCISS_DEBUG */
3001
3002         if (!(readl(&(c->cfgtable->TransportActive)) & CFGTBL_Trans_Simple)) {
3003                 printk(KERN_WARNING "cciss: unable to get board into"
3004                        " simple mode\n");
3005                 err = -ENODEV;
3006                 goto err_out_free_res;
3007         }
3008         return 0;
3009
3010 err_out_free_res:
3011         /*
3012          * Deliberately omit pci_disable_device(): it does something nasty to
3013          * Smart Array controllers that pci_enable_device does not undo
3014          */
3015         pci_release_regions(pdev);
3016         return err;
3017 }
3018
3019 /*
3020  * Gets information about the local volumes attached to the controller.
3021  */
3022 static void cciss_getgeometry(int cntl_num)
3023 {
3024         ReportLunData_struct *ld_buff;
3025         InquiryData_struct *inq_buff;
3026         int return_code;
3027         int i;
3028         int listlength = 0;
3029         __u32 lunid = 0;
3030         int block_size;
3031         sector_t total_size;
3032
3033         ld_buff = kzalloc(sizeof(ReportLunData_struct), GFP_KERNEL);
3034         if (ld_buff == NULL) {
3035                 printk(KERN_ERR "cciss: out of memory\n");
3036                 return;
3037         }
3038         inq_buff = kmalloc(sizeof(InquiryData_struct), GFP_KERNEL);
3039         if (inq_buff == NULL) {
3040                 printk(KERN_ERR "cciss: out of memory\n");
3041                 kfree(ld_buff);
3042                 return;
3043         }
3044         /* Get the firmware version */
3045         return_code = sendcmd(CISS_INQUIRY, cntl_num, inq_buff,
3046                               sizeof(InquiryData_struct), 0, 0, 0, NULL,
3047                               TYPE_CMD);
3048         if (return_code == IO_OK) {
3049                 hba[cntl_num]->firm_ver[0] = inq_buff->data_byte[32];
3050                 hba[cntl_num]->firm_ver[1] = inq_buff->data_byte[33];
3051                 hba[cntl_num]->firm_ver[2] = inq_buff->data_byte[34];
3052                 hba[cntl_num]->firm_ver[3] = inq_buff->data_byte[35];
3053         } else {                /* send command failed */
3054
3055                 printk(KERN_WARNING "cciss: unable to determine firmware"
3056                        " version of controller\n");
3057         }
3058         /* Get the number of logical volumes */
3059         return_code = sendcmd(CISS_REPORT_LOG, cntl_num, ld_buff,
3060                               sizeof(ReportLunData_struct), 0, 0, 0, NULL,
3061                               TYPE_CMD);
3062
3063         if (return_code == IO_OK) {
3064 #ifdef CCISS_DEBUG
3065                 printk("LUN Data\n--------------------------\n");
3066 #endif                          /* CCISS_DEBUG */
3067
3068                 listlength |=
3069                     (0xff & (unsigned int)(ld_buff->LUNListLength[0])) << 24;
3070                 listlength |=
3071                     (0xff & (unsigned int)(ld_buff->LUNListLength[1])) << 16;
3072                 listlength |=
3073                     (0xff & (unsigned int)(ld_buff->LUNListLength[2])) << 8;
3074                 listlength |= 0xff & (unsigned int)(ld_buff->LUNListLength[3]);
3075         } else {                /* reading number of logical volumes failed */
3076
3077                 printk(KERN_WARNING "cciss: report logical volume"
3078                        " command failed\n");
3079                 listlength = 0;
3080         }
3081         hba[cntl_num]->num_luns = listlength / 8;       // 8 bytes pre entry
3082         if (hba[cntl_num]->num_luns > CISS_MAX_LUN) {
3083                 printk(KERN_ERR
3084                        "ciss:  only %d number of logical volumes supported\n",
3085                        CISS_MAX_LUN);
3086                 hba[cntl_num]->num_luns = CISS_MAX_LUN;
3087         }
3088 #ifdef CCISS_DEBUG
3089         printk(KERN_DEBUG "Length = %x %x %x %x = %d\n",
3090                ld_buff->LUNListLength[0], ld_buff->LUNListLength[1],
3091                ld_buff->LUNListLength[2], ld_buff->LUNListLength[3],
3092                hba[cntl_num]->num_luns);
3093 #endif                          /* CCISS_DEBUG */
3094
3095         hba[cntl_num]->highest_lun = hba[cntl_num]->num_luns - 1;
3096         for (i = 0; i < CISS_MAX_LUN; i++) {
3097                 if (i < hba[cntl_num]->num_luns) {
3098                         lunid = (0xff & (unsigned int)(ld_buff->LUN[i][3]))
3099                             << 24;
3100                         lunid |= (0xff & (unsigned int)(ld_buff->LUN[i][2]))
3101                             << 16;
3102                         lunid |= (0xff & (unsigned int)(ld_buff->LUN[i][1]))
3103                             << 8;
3104                         lunid |= 0xff & (unsigned int)(ld_buff->LUN[i][0]);
3105
3106                         hba[cntl_num]->drv[i].LunID = lunid;
3107
3108 #ifdef CCISS_DEBUG
3109                         printk(KERN_DEBUG "LUN[%d]:  %x %x %x %x = %x\n", i,
3110                                ld_buff->LUN[i][0], ld_buff->LUN[i][1],
3111                                ld_buff->LUN[i][2], ld_buff->LUN[i][3],
3112                                hba[cntl_num]->drv[i].LunID);
3113 #endif                          /* CCISS_DEBUG */
3114
3115                 /* testing to see if 16-byte CDBs are already being used */
3116                 if(hba[cntl_num]->cciss_read == CCISS_READ_16) {
3117                         cciss_read_capacity_16(cntl_num, i, 0,
3118                                             &total_size, &block_size);
3119                         goto geo_inq;
3120                 }
3121                 cciss_read_capacity(cntl_num, i, 0, &total_size, &block_size);
3122
3123                 /* total_size = last LBA + 1 */
3124                 if(total_size == (__u32) 0) {
3125                         cciss_read_capacity_16(cntl_num, i, 0,
3126                         &total_size, &block_size);
3127                         hba[cntl_num]->cciss_read = CCISS_READ_16;
3128                         hba[cntl_num]->cciss_write = CCISS_WRITE_16;
3129                 } else {
3130                         hba[cntl_num]->cciss_read = CCISS_READ_10;
3131                         hba[cntl_num]->cciss_write = CCISS_WRITE_10;
3132                 }
3133 geo_inq:
3134                         cciss_geometry_inquiry(cntl_num, i, 0, total_size,
3135                                                block_size, inq_buff,
3136                                                &hba[cntl_num]->drv[i]);
3137                 } else {
3138                         /* initialize raid_level to indicate a free space */
3139                         hba[cntl_num]->drv[i].raid_level = -1;
3140                 }
3141         }
3142         kfree(ld_buff);
3143         kfree(inq_buff);
3144 }
3145
3146 /* Function to find the first free pointer into our hba[] array */
3147 /* Returns -1 if no free entries are left.  */
3148 static int alloc_cciss_hba(void)
3149 {
3150         int i;
3151
3152         for (i = 0; i < MAX_CTLR; i++) {
3153                 if (!hba[i]) {
3154                         ctlr_info_t *p;
3155                         p = kzalloc(sizeof(ctlr_info_t), GFP_KERNEL);
3156                         if (!p)
3157                                 goto Enomem;
3158                         p->gendisk[0] = alloc_disk(1 << NWD_SHIFT);
3159                         if (!p->gendisk[0])
3160                                 goto Enomem;
3161                         hba[i] = p;
3162                         return i;
3163                 }
3164         }
3165         printk(KERN_WARNING "cciss: This driver supports a maximum"
3166                " of %d controllers.\n", MAX_CTLR);
3167         return -1;
3168 Enomem:
3169         printk(KERN_ERR "cciss: out of memory.\n");
3170         return -1;
3171 }
3172
3173 static void free_hba(int i)
3174 {
3175         ctlr_info_t *p = hba[i];
3176         int n;
3177
3178         hba[i] = NULL;
3179         for (n = 0; n < CISS_MAX_LUN; n++)
3180                 put_disk(p->gendisk[n]);
3181         kfree(p);
3182 }
3183
3184 /*
3185  *  This is it.  Find all the controllers and register them.  I really hate
3186  *  stealing all these major device numbers.
3187  *  returns the number of block devices registered.
3188  */
3189 static int __devinit cciss_init_one(struct pci_dev *pdev,
3190                                     const struct pci_device_id *ent)
3191 {
3192         int i;
3193         int j = 0;
3194         int rc;
3195         int dac;
3196
3197         i = alloc_cciss_hba();
3198         if (i < 0)
3199                 return -1;
3200
3201         hba[i]->busy_initializing = 1;
3202
3203         if (cciss_pci_init(hba[i], pdev) != 0)
3204                 goto clean1;
3205
3206         sprintf(hba[i]->devname, "cciss%d", i);
3207         hba[i]->ctlr = i;
3208         hba[i]->pdev = pdev;
3209
3210         /* configure PCI DMA stuff */
3211         if (!pci_set_dma_mask(pdev, DMA_64BIT_MASK))
3212                 dac = 1;
3213         else if (!pci_set_dma_mask(pdev, DMA_32BIT_MASK))
3214                 dac = 0;
3215         else {
3216                 printk(KERN_ERR "cciss: no suitable DMA available\n");
3217                 goto clean1;
3218         }
3219
3220         /*
3221          * register with the major number, or get a dynamic major number
3222          * by passing 0 as argument.  This is done for greater than
3223          * 8 controller support.
3224          */
3225         if (i < MAX_CTLR_ORIG)
3226                 hba[i]->major = COMPAQ_CISS_MAJOR + i;
3227         rc = register_blkdev(hba[i]->major, hba[i]->devname);
3228         if (rc == -EBUSY || rc == -EINVAL) {
3229                 printk(KERN_ERR
3230                        "cciss:  Unable to get major number %d for %s "
3231                        "on hba %d\n", hba[i]->major, hba[i]->devname, i);
3232                 goto clean1;
3233         } else {
3234                 if (i >= MAX_CTLR_ORIG)
3235                         hba[i]->major = rc;
3236         }
3237
3238         /* make sure the board interrupts are off */
3239         hba[i]->access.set_intr_mask(hba[i], CCISS_INTR_OFF);
3240         if (request_irq(hba[i]->intr[SIMPLE_MODE_INT], do_cciss_intr,
3241                         IRQF_DISABLED | IRQF_SHARED, hba[i]->devname, hba[i])) {
3242                 printk(KERN_ERR "cciss: Unable to get irq %d for %s\n",
3243                        hba[i]->intr[SIMPLE_MODE_INT], hba[i]->devname);
3244                 goto clean2;
3245         }
3246
3247         printk(KERN_INFO "%s: <0x%x> at PCI %s IRQ %d%s using DAC\n",
3248                hba[i]->devname, pdev->device, pci_name(pdev),
3249                hba[i]->intr[SIMPLE_MODE_INT], dac ? "" : " not");
3250
3251         hba[i]->cmd_pool_bits =
3252             kmalloc(((hba[i]->nr_cmds + BITS_PER_LONG -
3253                       1) / BITS_PER_LONG) * sizeof(unsigned long), GFP_KERNEL);
3254         hba[i]->cmd_pool = (CommandList_struct *)
3255             pci_alloc_consistent(hba[i]->pdev,
3256                     hba[i]->nr_cmds * sizeof(CommandList_struct),
3257                     &(hba[i]->cmd_pool_dhandle));
3258         hba[i]->errinfo_pool = (ErrorInfo_struct *)
3259             pci_alloc_consistent(hba[i]->pdev,
3260                     hba[i]->nr_cmds * sizeof(ErrorInfo_struct),
3261                     &(hba[i]->errinfo_pool_dhandle));
3262         if ((hba[i]->cmd_pool_bits == NULL)
3263             || (hba[i]->cmd_pool == NULL)
3264             || (hba[i]->errinfo_pool == NULL)) {
3265                 printk(KERN_ERR "cciss: out of memory");
3266                 goto clean4;
3267         }
3268 #ifdef CONFIG_CISS_SCSI_TAPE
3269         hba[i]->scsi_rejects.complete =
3270             kmalloc(sizeof(hba[i]->scsi_rejects.complete[0]) *
3271                     (hba[i]->nr_cmds + 5), GFP_KERNEL);
3272         if (hba[i]->scsi_rejects.complete == NULL) {
3273                 printk(KERN_ERR "cciss: out of memory");
3274                 goto clean4;
3275         }
3276 #endif
3277         spin_lock_init(&hba[i]->lock);
3278
3279         /* Initialize the pdev driver private data.
3280            have it point to hba[i].  */
3281         pci_set_drvdata(pdev, hba[i]);
3282         /* command and error info recs zeroed out before
3283            they are used */
3284         memset(hba[i]->cmd_pool_bits, 0,
3285                ((hba[i]->nr_cmds + BITS_PER_LONG -
3286                  1) / BITS_PER_LONG) * sizeof(unsigned long));
3287
3288 #ifdef CCISS_DEBUG
3289         printk(KERN_DEBUG "Scanning for drives on controller cciss%d\n", i);
3290 #endif                          /* CCISS_DEBUG */
3291
3292         cciss_getgeometry(i);
3293
3294         cciss_scsi_setup(i);
3295
3296         /* Turn the interrupts on so we can service requests */
3297         hba[i]->access.set_intr_mask(hba[i], CCISS_INTR_ON);
3298
3299         cciss_procinit(i);
3300
3301         hba[i]->cciss_max_sectors = 2048;
3302
3303         hba[i]->busy_initializing = 0;
3304
3305         do {
3306                 drive_info_struct *drv = &(hba[i]->drv[j]);
3307                 struct gendisk *disk = hba[i]->gendisk[j];
3308                 request_queue_t *q;
3309
3310                 /* Check if the disk was allocated already */
3311                 if (!disk){
3312                         hba[i]->gendisk[j] = alloc_disk(1 << NWD_SHIFT);
3313                         disk = hba[i]->gendisk[j];
3314                 }
3315
3316                 /* Check that the disk was able to be allocated */
3317                 if (!disk) {
3318                         printk(KERN_ERR "cciss: unable to allocate memory for disk %d\n", j);
3319                         goto clean4;
3320                 }
3321
3322                 q = blk_init_queue(do_cciss_request, &hba[i]->lock);
3323                 if (!q) {
3324                         printk(KERN_ERR
3325                                "cciss:  unable to allocate queue for disk %d\n",
3326                                j);
3327                         goto clean4;
3328                 }
3329                 drv->queue = q;
3330
3331                 q->backing_dev_info.ra_pages = READ_AHEAD;
3332                 blk_queue_bounce_limit(q, hba[i]->pdev->dma_mask);
3333
3334                 /* This is a hardware imposed limit. */
3335                 blk_queue_max_hw_segments(q, MAXSGENTRIES);
3336
3337                 /* This is a limit in the driver and could be eliminated. */
3338                 blk_queue_max_phys_segments(q, MAXSGENTRIES);
3339
3340                 blk_queue_max_sectors(q, hba[i]->cciss_max_sectors);
3341
3342                 blk_queue_softirq_done(q, cciss_softirq_done);
3343
3344                 q->queuedata = hba[i];
3345                 sprintf(disk->disk_name, "cciss/c%dd%d", i, j);
3346                 disk->major = hba[i]->major;
3347                 disk->first_minor = j << NWD_SHIFT;
3348                 disk->fops = &cciss_fops;
3349                 disk->queue = q;
3350                 disk->private_data = drv;
3351                 disk->driverfs_dev = &pdev->dev;
3352                 /* we must register the controller even if no disks exist */
3353                 /* this is for the online array utilities */
3354                 if (!drv->heads && j)
3355                         continue;
3356                 blk_queue_hardsect_size(q, drv->block_size);
3357                 set_capacity(disk, drv->nr_blocks);
3358                 add_disk(disk);
3359                 j++;
3360         } while (j <= hba[i]->highest_lun);
3361
3362         return 1;
3363
3364       clean4:
3365 #ifdef CONFIG_CISS_SCSI_TAPE
3366         kfree(hba[i]->scsi_rejects.complete);
3367 #endif
3368         kfree(hba[i]->cmd_pool_bits);
3369         if (hba[i]->cmd_pool)
3370                 pci_free_consistent(hba[i]->pdev,
3371                                     hba[i]->nr_cmds * sizeof(CommandList_struct),
3372                                     hba[i]->cmd_pool, hba[i]->cmd_pool_dhandle);
3373         if (hba[i]->errinfo_pool)
3374                 pci_free_consistent(hba[i]->pdev,
3375                                     hba[i]->nr_cmds * sizeof(ErrorInfo_struct),
3376                                     hba[i]->errinfo_pool,
3377                                     hba[i]->errinfo_pool_dhandle);
3378         free_irq(hba[i]->intr[SIMPLE_MODE_INT], hba[i]);
3379       clean2:
3380         unregister_blkdev(hba[i]->major, hba[i]->devname);
3381       clean1:
3382         hba[i]->busy_initializing = 0;
3383         /* cleanup any queues that may have been initialized */
3384         for (j=0; j <= hba[i]->highest_lun; j++){
3385                 drive_info_struct *drv = &(hba[i]->drv[j]);
3386                 if (drv->queue)
3387                         blk_cleanup_queue(drv->queue);
3388         }
3389         /*
3390          * Deliberately omit pci_disable_device(): it does something nasty to
3391          * Smart Array controllers that pci_enable_device does not undo
3392          */
3393         pci_release_regions(pdev);
3394         pci_set_drvdata(pdev, NULL);
3395         free_hba(i);
3396         return -1;
3397 }
3398
3399 static void __devexit cciss_remove_one(struct pci_dev *pdev)
3400 {
3401         ctlr_info_t *tmp_ptr;
3402         int i, j;
3403         char flush_buf[4];
3404         int return_code;
3405
3406         if (pci_get_drvdata(pdev) == NULL) {
3407                 printk(KERN_ERR "cciss: Unable to remove device \n");
3408                 return;
3409         }
3410         tmp_ptr = pci_get_drvdata(pdev);
3411         i = tmp_ptr->ctlr;
3412         if (hba[i] == NULL) {
3413                 printk(KERN_ERR "cciss: device appears to "
3414                        "already be removed \n");
3415                 return;
3416         }
3417         /* Turn board interrupts off  and send the flush cache command */
3418         /* sendcmd will turn off interrupt, and send the flush...
3419          * To write all data in the battery backed cache to disks */
3420         memset(flush_buf, 0, 4);
3421         return_code = sendcmd(CCISS_CACHE_FLUSH, i, flush_buf, 4, 0, 0, 0, NULL,
3422                               TYPE_CMD);
3423         if (return_code != IO_OK) {
3424                 printk(KERN_WARNING "Error Flushing cache on controller %d\n",
3425                        i);
3426         }
3427         free_irq(hba[i]->intr[2], hba[i]);
3428
3429 #ifdef CONFIG_PCI_MSI
3430         if (hba[i]->msix_vector)
3431                 pci_disable_msix(hba[i]->pdev);
3432         else if (hba[i]->msi_vector)
3433                 pci_disable_msi(hba[i]->pdev);
3434 #endif                          /* CONFIG_PCI_MSI */
3435
3436         iounmap(hba[i]->vaddr);
3437         cciss_unregister_scsi(i);       /* unhook from SCSI subsystem */
3438         unregister_blkdev(hba[i]->major, hba[i]->devname);
3439         remove_proc_entry(hba[i]->devname, proc_cciss);
3440
3441         /* remove it from the disk list */
3442         for (j = 0; j < CISS_MAX_LUN; j++) {
3443                 struct gendisk *disk = hba[i]->gendisk[j];
3444                 if (disk) {
3445                         request_queue_t *q = disk->queue;
3446
3447                         if (disk->flags & GENHD_FL_UP)
3448                                 del_gendisk(disk);
3449                         if (q)
3450                                 blk_cleanup_queue(q);
3451                 }
3452         }
3453
3454         pci_free_consistent(hba[i]->pdev, hba[i]->nr_cmds * sizeof(CommandList_struct),
3455                             hba[i]->cmd_pool, hba[i]->cmd_pool_dhandle);
3456         pci_free_consistent(hba[i]->pdev, hba[i]->nr_cmds * sizeof(ErrorInfo_struct),
3457                             hba[i]->errinfo_pool, hba[i]->errinfo_pool_dhandle);
3458         kfree(hba[i]->cmd_pool_bits);
3459 #ifdef CONFIG_CISS_SCSI_TAPE
3460         kfree(hba[i]->scsi_rejects.complete);
3461 #endif
3462         /*
3463          * Deliberately omit pci_disable_device(): it does something nasty to
3464          * Smart Array controllers that pci_enable_device does not undo
3465          */
3466         pci_release_regions(pdev);
3467         pci_set_drvdata(pdev, NULL);
3468         free_hba(i);
3469 }
3470
3471 static struct pci_driver cciss_pci_driver = {
3472         .name = "cciss",
3473         .probe = cciss_init_one,
3474         .remove = __devexit_p(cciss_remove_one),
3475         .id_table = cciss_pci_device_id,        /* id_table */
3476 };
3477
3478 /*
3479  *  This is it.  Register the PCI driver information for the cards we control
3480  *  the OS will call our registered routines when it finds one of our cards.
3481  */
3482 static int __init cciss_init(void)
3483 {
3484         printk(KERN_INFO DRIVER_NAME "\n");
3485
3486         /* Register for our PCI devices */
3487         return pci_register_driver(&cciss_pci_driver);
3488 }
3489
3490 static void __exit cciss_cleanup(void)
3491 {
3492         int i;
3493
3494         pci_unregister_driver(&cciss_pci_driver);
3495         /* double check that all controller entrys have been removed */
3496         for (i = 0; i < MAX_CTLR; i++) {
3497                 if (hba[i] != NULL) {
3498                         printk(KERN_WARNING "cciss: had to remove"
3499                                " controller %d\n", i);
3500                         cciss_remove_one(hba[i]->pdev);
3501                 }
3502         }
3503         remove_proc_entry("cciss", proc_root_driver);
3504 }
3505
3506 static void fail_all_cmds(unsigned long ctlr)
3507 {
3508         /* If we get here, the board is apparently dead. */
3509         ctlr_info_t *h = hba[ctlr];
3510         CommandList_struct *c;
3511         unsigned long flags;
3512
3513         printk(KERN_WARNING "cciss%d: controller not responding.\n", h->ctlr);
3514         h->alive = 0;           /* the controller apparently died... */
3515
3516         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
3517
3518         pci_disable_device(h->pdev);    /* Make sure it is really dead. */
3519
3520         /* move everything off the request queue onto the completed queue */
3521         while ((c = h->reqQ) != NULL) {
3522                 removeQ(&(h->reqQ), c);
3523                 h->Qdepth--;
3524                 addQ(&(h->cmpQ), c);
3525         }
3526
3527         /* Now, fail everything on the completed queue with a HW error */
3528         while ((c = h->cmpQ) != NULL) {
3529                 removeQ(&h->cmpQ, c);
3530                 c->err_info->CommandStatus = CMD_HARDWARE_ERR;
3531                 if (c->cmd_type == CMD_RWREQ) {
3532                         complete_command(h, c, 0);
3533                 } else if (c->cmd_type == CMD_IOCTL_PEND)
3534                         complete(c->waiting);
3535 #ifdef CONFIG_CISS_SCSI_TAPE
3536                 else if (c->cmd_type == CMD_SCSI)
3537                         complete_scsi_command(c, 0, 0);
3538 #endif
3539         }
3540         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
3541         return;
3542 }
3543
3544 module_init(cciss_init);
3545 module_exit(cciss_cleanup);