drivers/block/cciss.c

   1 /*
   2  *    Disk Array driver for HP SA 5xxx and 6xxx Controllers
   3  *    Copyright 2000, 2006 Hewlett-Packard Development Company, L.P.
   4  *
   5  *    This program is free software; you can redistribute it and/or modify
   6  *    it under the terms of the GNU General Public License as published by
   7  *    the Free Software Foundation; either version 2 of the License, or
   8  *    (at your option) any later version.
   9  *
  10  *    This program is distributed in the hope that it will be useful,
  11  *    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  *    MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
  13  *    NON INFRINGEMENT.  See the GNU General Public License for more details.
  14  *
  15  *    You should have received a copy of the GNU General Public License
  16  *    along with this program; if not, write to the Free Software
  17  *    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  18  *
  19  *    Questions/Comments/Bugfixes to iss_storagedev@hp.com
  20  *
  21  */
  22
  23 #include <linux/module.h>
  24 #include <linux/interrupt.h>
  25 #include <linux/types.h>
  26 #include <linux/pci.h>
  27 #include <linux/kernel.h>
  28 #include <linux/slab.h>
  29 #include <linux/delay.h>
  30 #include <linux/major.h>
  31 #include <linux/fs.h>
  32 #include <linux/bio.h>
  33 #include <linux/blkpg.h>
  34 #include <linux/timer.h>
  35 #include <linux/proc_fs.h>
  36 #include <linux/init.h>
  37 #include <linux/hdreg.h>
  38 #include <linux/spinlock.h>
  39 #include <linux/compat.h>
  40 #include <linux/blktrace_api.h>
  41 #include <asm/uaccess.h>
  42 #include <asm/io.h>
  43
  44 #include <linux/dma-mapping.h>
  45 #include <linux/blkdev.h>
  46 #include <linux/genhd.h>
  47 #include <linux/completion.h>
  48
  49 #define CCISS_DRIVER_VERSION(maj,min,submin) ((maj<<16)|(min<<8)|(submin))
  50 #define DRIVER_NAME "HP CISS Driver (v 3.6.14)"
  51 #define DRIVER_VERSION CCISS_DRIVER_VERSION(3,6,14)
  52
  53 /* Embedded module documentation macros - see modules.h */
  54 MODULE_AUTHOR("Hewlett-Packard Company");
  55 MODULE_DESCRIPTION("Driver for HP Controller SA5xxx SA6xxx version 3.6.14");
  56 MODULE_SUPPORTED_DEVICE("HP SA5i SA5i+ SA532 SA5300 SA5312 SA641 SA642 SA6400"
  57                         " SA6i P600 P800 P400 P400i E200 E200i E500");
  58 MODULE_VERSION("3.6.14");
  59 MODULE_LICENSE("GPL");
  60
  61 #include "cciss_cmd.h"
  62 #include "cciss.h"
  63 #include <linux/cciss_ioctl.h>
  64
  65 /* define the PCI info for the cards we can control */
  66 static const struct pci_device_id cciss_pci_device_id[] = {
  67         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISS,  0x0E11, 0x4070},
  68         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSB, 0x0E11, 0x4080},
  69         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSB, 0x0E11, 0x4082},
  70         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSB, 0x0E11, 0x4083},
  71         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x4091},
  72         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x409A},
  73         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x409B},
  74         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x409C},
  75         {PCI_VENDOR_ID_COMPAQ, PCI_DEVICE_ID_COMPAQ_CISSC, 0x0E11, 0x409D},
  76         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSA,     0x103C, 0x3225},
  77         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3223},
  78         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3234},
  79         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3235},
  80         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3211},
  81         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3212},
  82         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3213},
  83         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3214},
  84         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSD,     0x103C, 0x3215},
  85         {PCI_VENDOR_ID_HP,     PCI_DEVICE_ID_HP_CISSC,     0x103C, 0x3237},
  86         {PCI_VENDOR_ID_HP,     PCI_ANY_ID,      PCI_ANY_ID, PCI_ANY_ID,
  87                 PCI_CLASS_STORAGE_RAID << 8, 0xffff << 8, 0},
  88         {0,}
  89 };
  90
  91 MODULE_DEVICE_TABLE(pci, cciss_pci_device_id);
  92
  93 /*  board_id = Subsystem Device ID & Vendor ID
  94  *  product = Marketing Name for the board
  95  *  access = Address of the struct of function pointers
  96  *  nr_cmds = Number of commands supported by controller
  97  */
  98 static struct board_type products[] = {
  99         {0x40700E11, "Smart Array 5300", &SA5_access, 512},
 100         {0x40800E11, "Smart Array 5i", &SA5B_access, 512},
 101         {0x40820E11, "Smart Array 532", &SA5B_access, 512},
 102         {0x40830E11, "Smart Array 5312", &SA5B_access, 512},
 103         {0x409A0E11, "Smart Array 641", &SA5_access, 512},
 104         {0x409B0E11, "Smart Array 642", &SA5_access, 512},
 105         {0x409C0E11, "Smart Array 6400", &SA5_access, 512},
 106         {0x409D0E11, "Smart Array 6400 EM", &SA5_access, 512},
 107         {0x40910E11, "Smart Array 6i", &SA5_access, 512},
 108         {0x3225103C, "Smart Array P600", &SA5_access, 512},
 109         {0x3223103C, "Smart Array P800", &SA5_access, 512},
 110         {0x3234103C, "Smart Array P400", &SA5_access, 512},
 111         {0x3235103C, "Smart Array P400i", &SA5_access, 512},
 112         {0x3211103C, "Smart Array E200i", &SA5_access, 120},
 113         {0x3212103C, "Smart Array E200", &SA5_access, 120},
 114         {0x3213103C, "Smart Array E200i", &SA5_access, 120},
 115         {0x3214103C, "Smart Array E200i", &SA5_access, 120},
 116         {0x3215103C, "Smart Array E200i", &SA5_access, 120},
 117         {0x3237103C, "Smart Array E500", &SA5_access, 512},
 118         {0xFFFF103C, "Unknown Smart Array", &SA5_access, 120},
 119 };
 120
 121 /* How long to wait (in milliseconds) for board to go into simple mode */
 122 #define MAX_CONFIG_WAIT 30000
 123 #define MAX_IOCTL_CONFIG_WAIT 1000
 124
 125 /*define how many times we will try a command because of bus resets */
 126 #define MAX_CMD_RETRIES 3
 127
 128 #define READ_AHEAD       1024
 129 #define MAX_CTLR        32
 130
 131 /* Originally cciss driver only supports 8 major numbers */
 132 #define MAX_CTLR_ORIG   8
 133
 134 static ctlr_info_t *hba[MAX_CTLR];
 135
 136 static void do_cciss_request(request_queue_t *q);
 137 static irqreturn_t do_cciss_intr(int irq, void *dev_id);
 138 static int cciss_open(struct inode *inode, struct file *filep);
 139 static int cciss_release(struct inode *inode, struct file *filep);
 140 static int cciss_ioctl(struct inode *inode, struct file *filep,
 141                        unsigned int cmd, unsigned long arg);
 142 static int cciss_getgeo(struct block_device *bdev, struct hd_geometry *geo);
 143
 144 static int revalidate_allvol(ctlr_info_t *host);
 145 static int cciss_revalidate(struct gendisk *disk);
 146 static int rebuild_lun_table(ctlr_info_t *h, struct gendisk *del_disk);
 147 static int deregister_disk(struct gendisk *disk, drive_info_struct *drv,
 148                            int clear_all);
 149
 150 static void cciss_read_capacity(int ctlr, int logvol, int withirq,
 151                         sector_t *total_size, unsigned int *block_size);
 152 static void cciss_read_capacity_16(int ctlr, int logvol, int withirq,
 153                         sector_t *total_size, unsigned int *block_size);
 154 static void cciss_geometry_inquiry(int ctlr, int logvol,
 155                         int withirq, sector_t total_size,
 156                         unsigned int block_size, InquiryData_struct *inq_buff,
 157                                    drive_info_struct *drv);
 158 static void cciss_getgeometry(int cntl_num);
 159 static void __devinit cciss_interrupt_mode(ctlr_info_t *, struct pci_dev *,
 160                                            __u32);
 161 static void start_io(ctlr_info_t *h);
 162 static int sendcmd(__u8 cmd, int ctlr, void *buff, size_t size,
 163                    unsigned int use_unit_num, unsigned int log_unit,
 164                    __u8 page_code, unsigned char *scsi3addr, int cmd_type);
 165 static int sendcmd_withirq(__u8 cmd, int ctlr, void *buff, size_t size,
 166                            unsigned int use_unit_num, unsigned int log_unit,
 167                            __u8 page_code, int cmd_type);
 168
 169 static void fail_all_cmds(unsigned long ctlr);
 170
 171 #ifdef CONFIG_PROC_FS
 172 static int cciss_proc_get_info(char *buffer, char **start, off_t offset,
 173                                int length, int *eof, void *data);
 174 static void cciss_procinit(int i);
 175 #else
 176 static void cciss_procinit(int i)
 177 {
 178 }
 179 #endif                          /* CONFIG_PROC_FS */
 180
 181 #ifdef CONFIG_COMPAT
 182 static long cciss_compat_ioctl(struct file *f, unsigned cmd, unsigned long arg);
 183 #endif
 184
 185 static struct block_device_operations cciss_fops = {
 186         .owner = THIS_MODULE,
 187         .open = cciss_open,
 188         .release = cciss_release,
 189         .ioctl = cciss_ioctl,
 190         .getgeo = cciss_getgeo,
 191 #ifdef CONFIG_COMPAT
 192         .compat_ioctl = cciss_compat_ioctl,
 193 #endif
 194         .revalidate_disk = cciss_revalidate,
 195 };
 196
 197 /*
 198  * Enqueuing and dequeuing functions for cmdlists.
 199  */
 200 static inline void addQ(CommandList_struct **Qptr, CommandList_struct *c)
 201 {
 202         if (*Qptr == NULL) {
 203                 *Qptr = c;
 204                 c->next = c->prev = c;
 205         } else {
 206                 c->prev = (*Qptr)->prev;
 207                 c->next = (*Qptr);
 208                 (*Qptr)->prev->next = c;
 209                 (*Qptr)->prev = c;
 210         }
 211 }
 212
 213 static inline CommandList_struct *removeQ(CommandList_struct **Qptr,
 214                                           CommandList_struct *c)
 215 {
 216         if (c && c->next != c) {
 217                 if (*Qptr == c)
 218                         *Qptr = c->next;
 219                 c->prev->next = c->next;
 220                 c->next->prev = c->prev;
 221         } else {
 222                 *Qptr = NULL;
 223         }
 224         return c;
 225 }
 226
 227 #include "cciss_scsi.c"         /* For SCSI tape support */
 228
 229 #ifdef CONFIG_PROC_FS
 230
 231 /*
 232  * Report information about this controller.
 233  */
 234 #define ENG_GIG 1000000000
 235 #define ENG_GIG_FACTOR (ENG_GIG/512)
 236 #define RAID_UNKNOWN 6
 237 static const char *raid_label[] = { "0", "4", "1(1+0)", "5", "5+1", "ADG",
 238         "UNKNOWN"
 239 };
 240
 241 static struct proc_dir_entry *proc_cciss;
 242
 243 static int cciss_proc_get_info(char *buffer, char **start, off_t offset,
 244                                int length, int *eof, void *data)
 245 {
 246         off_t pos = 0;
 247         off_t len = 0;
 248         int size, i, ctlr;
 249         ctlr_info_t *h = (ctlr_info_t *) data;
 250         drive_info_struct *drv;
 251         unsigned long flags;
 252         sector_t vol_sz, vol_sz_frac;
 253
 254         ctlr = h->ctlr;
 255
 256         /* prevent displaying bogus info during configuration
 257          * or deconfiguration of a logical volume
 258          */
 259         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
 260         if (h->busy_configuring) {
 261                 spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
 262                 return -EBUSY;
 263         }
 264         h->busy_configuring = 1;
 265         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
 266
 267         size = sprintf(buffer, "%s: HP %s Controller\n"
 268                        "Board ID: 0x%08lx\n"
 269                        "Firmware Version: %c%c%c%c\n"
 270                        "IRQ: %d\n"
 271                        "Logical drives: %d\n"
 272                        "Max sectors: %d\n"
 273                        "Current Q depth: %d\n"
 274                        "Current # commands on controller: %d\n"
 275                        "Max Q depth since init: %d\n"
 276                        "Max # commands on controller since init: %d\n"
 277                        "Max SG entries since init: %d\n\n",
 278                        h->devname,
 279                        h->product_name,
 280                        (unsigned long)h->board_id,
 281                        h->firm_ver[0], h->firm_ver[1], h->firm_ver[2],
 282                        h->firm_ver[3], (unsigned int)h->intr[SIMPLE_MODE_INT],
 283                        h->num_luns,
 284                        h->cciss_max_sectors,
 285                        h->Qdepth, h->commands_outstanding,
 286                        h->maxQsinceinit, h->max_outstanding, h->maxSG);
 287
 288         pos += size;
 289         len += size;
 290         cciss_proc_tape_report(ctlr, buffer, &pos, &len);
 291         for (i = 0; i <= h->highest_lun; i++) {
 292
 293                 drv = &h->drv[i];
 294                 if (drv->heads == 0)
 295                         continue;
 296
 297                 vol_sz = drv->nr_blocks;
 298                 vol_sz_frac = sector_div(vol_sz, ENG_GIG_FACTOR);
 299                 vol_sz_frac *= 100;
 300                 sector_div(vol_sz_frac, ENG_GIG_FACTOR);
 301
 302                 if (drv->raid_level > 5)
 303                         drv->raid_level = RAID_UNKNOWN;
 304                 size = sprintf(buffer + len, "cciss/c%dd%d:"
 305                                "\t%4u.%02uGB\tRAID %s\n",
 306                                ctlr, i, (int)vol_sz, (int)vol_sz_frac,
 307                                raid_label[drv->raid_level]);
 308                 pos += size;
 309                 len += size;
 310         }
 311
 312         *eof = 1;
 313         *start = buffer + offset;
 314         len -= offset;
 315         if (len > length)
 316                 len = length;
 317         h->busy_configuring = 0;
 318         return len;
 319 }
 320
 321 static int
 322 cciss_proc_write(struct file *file, const char __user *buffer,
 323                  unsigned long count, void *data)
 324 {
 325         unsigned char cmd[80];
 326         int len;
 327 #ifdef CONFIG_CISS_SCSI_TAPE
 328         ctlr_info_t *h = (ctlr_info_t *) data;
 329         int rc;
 330 #endif
 331
 332         if (count > sizeof(cmd) - 1)
 333                 return -EINVAL;
 334         if (copy_from_user(cmd, buffer, count))
 335                 return -EFAULT;
 336         cmd[count] = '\0';
 337         len = strlen(cmd);      // above 3 lines ensure safety
 338         if (len && cmd[len - 1] == '\n')
 339                 cmd[--len] = '\0';
 340 #       ifdef CONFIG_CISS_SCSI_TAPE
 341         if (strcmp("engage scsi", cmd) == 0) {
 342                 rc = cciss_engage_scsi(h->ctlr);
 343                 if (rc != 0)
 344                         return -rc;
 345                 return count;
 346         }
 347         /* might be nice to have "disengage" too, but it's not
 348            safely possible. (only 1 module use count, lock issues.) */
 349 #       endif
 350         return -EINVAL;
 351 }
 352
 353 /*
 354  * Get us a file in /proc/cciss that says something about each controller.
 355  * Create /proc/cciss if it doesn't exist yet.
 356  */
 357 static void __devinit cciss_procinit(int i)
 358 {
 359         struct proc_dir_entry *pde;
 360
 361         if (proc_cciss == NULL) {
 362                 proc_cciss = proc_mkdir("cciss", proc_root_driver);
 363                 if (!proc_cciss)
 364                         return;
 365         }
 366
 367         pde = create_proc_read_entry(hba[i]->devname,
 368                                      S_IWUSR | S_IRUSR | S_IRGRP | S_IROTH,
 369                                      proc_cciss, cciss_proc_get_info, hba[i]);
 370         pde->write_proc = cciss_proc_write;
 371 }
 372 #endif                          /* CONFIG_PROC_FS */
 373
 374 /*
 375  * For operations that cannot sleep, a command block is allocated at init,
 376  * and managed by cmd_alloc() and cmd_free() using a simple bitmap to track
 377  * which ones are free or in use.  For operations that can wait for kmalloc
 378  * to possible sleep, this routine can be called with get_from_pool set to 0.
 379  * cmd_free() MUST be called with a got_from_pool set to 0 if cmd_alloc was.
 380  */
 381 static CommandList_struct *cmd_alloc(ctlr_info_t *h, int get_from_pool)
 382 {
 383         CommandList_struct *c;
 384         int i;
 385         u64bit temp64;
 386         dma_addr_t cmd_dma_handle, err_dma_handle;
 387
 388         if (!get_from_pool) {
 389                 c = (CommandList_struct *) pci_alloc_consistent(h->pdev,
 390                         sizeof(CommandList_struct), &cmd_dma_handle);
 391                 if (c == NULL)
 392                         return NULL;
 393                 memset(c, 0, sizeof(CommandList_struct));
 394
 395                 c->cmdindex = -1;
 396
 397                 c->err_info = (ErrorInfo_struct *)
 398                     pci_alloc_consistent(h->pdev, sizeof(ErrorInfo_struct),
 399                             &err_dma_handle);
 400
 401                 if (c->err_info == NULL) {
 402                         pci_free_consistent(h->pdev,
 403                                 sizeof(CommandList_struct), c, cmd_dma_handle);
 404                         return NULL;
 405                 }
 406                 memset(c->err_info, 0, sizeof(ErrorInfo_struct));
 407         } else {                /* get it out of the controllers pool */
 408
 409                 do {
 410                         i = find_first_zero_bit(h->cmd_pool_bits, h->nr_cmds);
 411                         if (i == h->nr_cmds)
 412                                 return NULL;
 413                 } while (test_and_set_bit
 414                          (i & (BITS_PER_LONG - 1),
 415                           h->cmd_pool_bits + (i / BITS_PER_LONG)) != 0);
 416 #ifdef CCISS_DEBUG
 417                 printk(KERN_DEBUG "cciss: using command buffer %d\n", i);
 418 #endif
 419                 c = h->cmd_pool + i;
 420                 memset(c, 0, sizeof(CommandList_struct));
 421                 cmd_dma_handle = h->cmd_pool_dhandle
 422                     + i * sizeof(CommandList_struct);
 423                 c->err_info = h->errinfo_pool + i;
 424                 memset(c->err_info, 0, sizeof(ErrorInfo_struct));
 425                 err_dma_handle = h->errinfo_pool_dhandle
 426                     + i * sizeof(ErrorInfo_struct);
 427                 h->nr_allocs++;
 428
 429                 c->cmdindex = i;
 430         }
 431
 432         c->busaddr = (__u32) cmd_dma_handle;
 433         temp64.val = (__u64) err_dma_handle;
 434         c->ErrDesc.Addr.lower = temp64.val32.lower;
 435         c->ErrDesc.Addr.upper = temp64.val32.upper;
 436         c->ErrDesc.Len = sizeof(ErrorInfo_struct);
 437
 438         c->ctlr = h->ctlr;
 439         return c;
 440 }
 441
 442 /*
 443  * Frees a command block that was previously allocated with cmd_alloc().
 444  */
 445 static void cmd_free(ctlr_info_t *h, CommandList_struct *c, int got_from_pool)
 446 {
 447         int i;
 448         u64bit temp64;
 449
 450         if (!got_from_pool) {
 451                 temp64.val32.lower = c->ErrDesc.Addr.lower;
 452                 temp64.val32.upper = c->ErrDesc.Addr.upper;
 453                 pci_free_consistent(h->pdev, sizeof(ErrorInfo_struct),
 454                                     c->err_info, (dma_addr_t) temp64.val);
 455                 pci_free_consistent(h->pdev, sizeof(CommandList_struct),
 456                                     c, (dma_addr_t) c->busaddr);
 457         } else {
 458                 i = c - h->cmd_pool;
 459                 clear_bit(i & (BITS_PER_LONG - 1),
 460                           h->cmd_pool_bits + (i / BITS_PER_LONG));
 461                 h->nr_frees++;
 462         }
 463 }
 464
 465 static inline ctlr_info_t *get_host(struct gendisk *disk)
 466 {
 467         return disk->queue->queuedata;
 468 }
 469
 470 static inline drive_info_struct *get_drv(struct gendisk *disk)
 471 {
 472         return disk->private_data;
 473 }
 474
 475 /*
 476  * Open.  Make sure the device is really there.
 477  */
 478 static int cciss_open(struct inode *inode, struct file *filep)
 479 {
 480         ctlr_info_t *host = get_host(inode->i_bdev->bd_disk);
 481         drive_info_struct *drv = get_drv(inode->i_bdev->bd_disk);
 482
 483 #ifdef CCISS_DEBUG
 484         printk(KERN_DEBUG "cciss_open %s\n", inode->i_bdev->bd_disk->disk_name);
 485 #endif                          /* CCISS_DEBUG */
 486
 487         if (host->busy_initializing || drv->busy_configuring)
 488                 return -EBUSY;
 489         /*
 490          * Root is allowed to open raw volume zero even if it's not configured
 491          * so array config can still work. Root is also allowed to open any
 492          * volume that has a LUN ID, so it can issue IOCTL to reread the
 493          * disk information.  I don't think I really like this
 494          * but I'm already using way to many device nodes to claim another one
 495          * for "raw controller".
 496          */
 497         if (drv->heads == 0) {
 498                 if (iminor(inode) != 0) {       /* not node 0? */
 499                         /* if not node 0 make sure it is a partition = 0 */
 500                         if (iminor(inode) & 0x0f) {
 501                                 return -ENXIO;
 502                                 /* if it is, make sure we have a LUN ID */
 503                         } else if (drv->LunID == 0) {
 504                                 return -ENXIO;
 505                         }
 506                 }
 507                 if (!capable(CAP_SYS_ADMIN))
 508                         return -EPERM;
 509         }
 510         drv->usage_count++;
 511         host->usage_count++;
 512         return 0;
 513 }
 514
 515 /*
 516  * Close.  Sync first.
 517  */
 518 static int cciss_release(struct inode *inode, struct file *filep)
 519 {
 520         ctlr_info_t *host = get_host(inode->i_bdev->bd_disk);
 521         drive_info_struct *drv = get_drv(inode->i_bdev->bd_disk);
 522
 523 #ifdef CCISS_DEBUG
 524         printk(KERN_DEBUG "cciss_release %s\n",
 525                inode->i_bdev->bd_disk->disk_name);
 526 #endif                          /* CCISS_DEBUG */
 527
 528         drv->usage_count--;
 529         host->usage_count--;
 530         return 0;
 531 }
 532
 533 #ifdef CONFIG_COMPAT
 534
 535 static int do_ioctl(struct file *f, unsigned cmd, unsigned long arg)
 536 {
 537         int ret;
 538         lock_kernel();
 539         ret = cciss_ioctl(f->f_dentry->d_inode, f, cmd, arg);
 540         unlock_kernel();
 541         return ret;
 542 }
 543
 544 static int cciss_ioctl32_passthru(struct file *f, unsigned cmd,
 545                                   unsigned long arg);
 546 static int cciss_ioctl32_big_passthru(struct file *f, unsigned cmd,
 547                                       unsigned long arg);
 548
 549 static long cciss_compat_ioctl(struct file *f, unsigned cmd, unsigned long arg)
 550 {
 551         switch (cmd) {
 552         case CCISS_GETPCIINFO:
 553         case CCISS_GETINTINFO:
 554         case CCISS_SETINTINFO:
 555         case CCISS_GETNODENAME:
 556         case CCISS_SETNODENAME:
 557         case CCISS_GETHEARTBEAT:
 558         case CCISS_GETBUSTYPES:
 559         case CCISS_GETFIRMVER:
 560         case CCISS_GETDRIVVER:
 561         case CCISS_REVALIDVOLS:
 562         case CCISS_DEREGDISK:
 563         case CCISS_REGNEWDISK:
 564         case CCISS_REGNEWD:
 565         case CCISS_RESCANDISK:
 566         case CCISS_GETLUNINFO:
 567                 return do_ioctl(f, cmd, arg);
 568
 569         case CCISS_PASSTHRU32:
 570                 return cciss_ioctl32_passthru(f, cmd, arg);
 571         case CCISS_BIG_PASSTHRU32:
 572                 return cciss_ioctl32_big_passthru(f, cmd, arg);
 573
 574         default:
 575                 return -ENOIOCTLCMD;
 576         }
 577 }
 578
 579 static int cciss_ioctl32_passthru(struct file *f, unsigned cmd,
 580                                   unsigned long arg)
 581 {
 582         IOCTL32_Command_struct __user *arg32 =
 583             (IOCTL32_Command_struct __user *) arg;
 584         IOCTL_Command_struct arg64;
 585         IOCTL_Command_struct __user *p = compat_alloc_user_space(sizeof(arg64));
 586         int err;
 587         u32 cp;
 588
 589         err = 0;
 590         err |=
 591             copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
 592                            sizeof(arg64.LUN_info));
 593         err |=
 594             copy_from_user(&arg64.Request, &arg32->Request,
 595                            sizeof(arg64.Request));
 596         err |=
 597             copy_from_user(&arg64.error_info, &arg32->error_info,
 598                            sizeof(arg64.error_info));
 599         err |= get_user(arg64.buf_size, &arg32->buf_size);
 600         err |= get_user(cp, &arg32->buf);
 601         arg64.buf = compat_ptr(cp);
 602         err |= copy_to_user(p, &arg64, sizeof(arg64));
 603
 604         if (err)
 605                 return -EFAULT;
 606
 607         err = do_ioctl(f, CCISS_PASSTHRU, (unsigned long)p);
 608         if (err)
 609                 return err;
 610         err |=
 611             copy_in_user(&arg32->error_info, &p->error_info,
 612                          sizeof(arg32->error_info));
 613         if (err)
 614                 return -EFAULT;
 615         return err;
 616 }
 617
 618 static int cciss_ioctl32_big_passthru(struct file *file, unsigned cmd,
 619                                       unsigned long arg)
 620 {
 621         BIG_IOCTL32_Command_struct __user *arg32 =
 622             (BIG_IOCTL32_Command_struct __user *) arg;
 623         BIG_IOCTL_Command_struct arg64;
 624         BIG_IOCTL_Command_struct __user *p =
 625             compat_alloc_user_space(sizeof(arg64));
 626         int err;
 627         u32 cp;
 628
 629         err = 0;
 630         err |=
 631             copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
 632                            sizeof(arg64.LUN_info));
 633         err |=
 634             copy_from_user(&arg64.Request, &arg32->Request,
 635                            sizeof(arg64.Request));
 636         err |=
 637             copy_from_user(&arg64.error_info, &arg32->error_info,
 638                            sizeof(arg64.error_info));
 639         err |= get_user(arg64.buf_size, &arg32->buf_size);
 640         err |= get_user(arg64.malloc_size, &arg32->malloc_size);
 641         err |= get_user(cp, &arg32->buf);
 642         arg64.buf = compat_ptr(cp);
 643         err |= copy_to_user(p, &arg64, sizeof(arg64));
 644
 645         if (err)
 646                 return -EFAULT;
 647
 648         err = do_ioctl(file, CCISS_BIG_PASSTHRU, (unsigned long)p);
 649         if (err)
 650                 return err;
 651         err |=
 652             copy_in_user(&arg32->error_info, &p->error_info,
 653                          sizeof(arg32->error_info));
 654         if (err)
 655                 return -EFAULT;
 656         return err;
 657 }
 658 #endif
 659
 660 static int cciss_getgeo(struct block_device *bdev, struct hd_geometry *geo)
 661 {
 662         drive_info_struct *drv = get_drv(bdev->bd_disk);
 663
 664         if (!drv->cylinders)
 665                 return -ENXIO;
 666
 667         geo->heads = drv->heads;
 668         geo->sectors = drv->sectors;
 669         geo->cylinders = drv->cylinders;
 670         return 0;
 671 }
 672
 673 /*
 674  * ioctl
 675  */
 676 static int cciss_ioctl(struct inode *inode, struct file *filep,
 677                        unsigned int cmd, unsigned long arg)
 678 {
 679         struct block_device *bdev = inode->i_bdev;
 680         struct gendisk *disk = bdev->bd_disk;
 681         ctlr_info_t *host = get_host(disk);
 682         drive_info_struct *drv = get_drv(disk);
 683         int ctlr = host->ctlr;
 684         void __user *argp = (void __user *)arg;
 685
 686 #ifdef CCISS_DEBUG
 687         printk(KERN_DEBUG "cciss_ioctl: Called with cmd=%x %lx\n", cmd, arg);
 688 #endif                          /* CCISS_DEBUG */
 689
 690         switch (cmd) {
 691         case CCISS_GETPCIINFO:
 692                 {
 693                         cciss_pci_info_struct pciinfo;
 694
 695                         if (!arg)
 696                                 return -EINVAL;
 697                         pciinfo.domain = pci_domain_nr(host->pdev->bus);
 698                         pciinfo.bus = host->pdev->bus->number;
 699                         pciinfo.dev_fn = host->pdev->devfn;
 700                         pciinfo.board_id = host->board_id;
 701                         if (copy_to_user
 702                             (argp, &pciinfo, sizeof(cciss_pci_info_struct)))
 703                                 return -EFAULT;
 704                         return 0;
 705                 }
 706         case CCISS_GETINTINFO:
 707                 {
 708                         cciss_coalint_struct intinfo;
 709                         if (!arg)
 710                                 return -EINVAL;
 711                         intinfo.delay =
 712                             readl(&host->cfgtable->HostWrite.CoalIntDelay);
 713                         intinfo.count =
 714                             readl(&host->cfgtable->HostWrite.CoalIntCount);
 715                         if (copy_to_user
 716                             (argp, &intinfo, sizeof(cciss_coalint_struct)))
 717                                 return -EFAULT;
 718                         return 0;
 719                 }
 720         case CCISS_SETINTINFO:
 721                 {
 722                         cciss_coalint_struct intinfo;
 723                         unsigned long flags;
 724                         int i;
 725
 726                         if (!arg)
 727                                 return -EINVAL;
 728                         if (!capable(CAP_SYS_ADMIN))
 729                                 return -EPERM;
 730                         if (copy_from_user
 731                             (&intinfo, argp, sizeof(cciss_coalint_struct)))
 732                                 return -EFAULT;
 733                         if ((intinfo.delay == 0) && (intinfo.count == 0))
 734                         {
 735 //                      printk("cciss_ioctl: delay and count cannot be 0\n");
 736                                 return -EINVAL;
 737                         }
 738                         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
 739                         /* Update the field, and then ring the doorbell */
 740                         writel(intinfo.delay,
 741                                &(host->cfgtable->HostWrite.CoalIntDelay));
 742                         writel(intinfo.count,
 743                                &(host->cfgtable->HostWrite.CoalIntCount));
 744                         writel(CFGTBL_ChangeReq, host->vaddr + SA5_DOORBELL);
 745
 746                         for (i = 0; i < MAX_IOCTL_CONFIG_WAIT; i++) {
 747                                 if (!(readl(host->vaddr + SA5_DOORBELL)
 748                                       & CFGTBL_ChangeReq))
 749                                         break;
 750                                 /* delay and try again */
 751                                 udelay(1000);
 752                         }
 753                         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
 754                         if (i >= MAX_IOCTL_CONFIG_WAIT)
 755                                 return -EAGAIN;
 756                         return 0;
 757                 }
 758         case CCISS_GETNODENAME:
 759                 {
 760                         NodeName_type NodeName;
 761                         int i;
 762
 763                         if (!arg)
 764                                 return -EINVAL;
 765                         for (i = 0; i < 16; i++)
 766                                 NodeName[i] =
 767                                     readb(&host->cfgtable->ServerName[i]);
 768                         if (copy_to_user(argp, NodeName, sizeof(NodeName_type)))
 769                                 return -EFAULT;
 770                         return 0;
 771                 }
 772         case CCISS_SETNODENAME:
 773                 {
 774                         NodeName_type NodeName;
 775                         unsigned long flags;
 776                         int i;
 777
 778                         if (!arg)
 779                                 return -EINVAL;
 780                         if (!capable(CAP_SYS_ADMIN))
 781                                 return -EPERM;
 782
 783                         if (copy_from_user
 784                             (NodeName, argp, sizeof(NodeName_type)))
 785                                 return -EFAULT;
 786
 787                         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
 788
 789                         /* Update the field, and then ring the doorbell */
 790                         for (i = 0; i < 16; i++)
 791                                 writeb(NodeName[i],
 792                                        &host->cfgtable->ServerName[i]);
 793
 794                         writel(CFGTBL_ChangeReq, host->vaddr + SA5_DOORBELL);
 795
 796                         for (i = 0; i < MAX_IOCTL_CONFIG_WAIT; i++) {
 797                                 if (!(readl(host->vaddr + SA5_DOORBELL)
 798                                       & CFGTBL_ChangeReq))
 799                                         break;
 800                                 /* delay and try again */
 801                                 udelay(1000);
 802                         }
 803                         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
 804                         if (i >= MAX_IOCTL_CONFIG_WAIT)
 805                                 return -EAGAIN;
 806                         return 0;
 807                 }
 808
 809         case CCISS_GETHEARTBEAT:
 810                 {
 811                         Heartbeat_type heartbeat;
 812
 813                         if (!arg)
 814                                 return -EINVAL;
 815                         heartbeat = readl(&host->cfgtable->HeartBeat);
 816                         if (copy_to_user
 817                             (argp, &heartbeat, sizeof(Heartbeat_type)))
 818                                 return -EFAULT;
 819                         return 0;
 820                 }
 821         case CCISS_GETBUSTYPES:
 822                 {
 823                         BusTypes_type BusTypes;
 824
 825                         if (!arg)
 826                                 return -EINVAL;
 827                         BusTypes = readl(&host->cfgtable->BusTypes);
 828                         if (copy_to_user
 829                             (argp, &BusTypes, sizeof(BusTypes_type)))
 830                                 return -EFAULT;
 831                         return 0;
 832                 }
 833         case CCISS_GETFIRMVER:
 834                 {
 835                         FirmwareVer_type firmware;
 836
 837                         if (!arg)
 838                                 return -EINVAL;
 839                         memcpy(firmware, host->firm_ver, 4);
 840
 841                         if (copy_to_user
 842                             (argp, firmware, sizeof(FirmwareVer_type)))
 843                                 return -EFAULT;
 844                         return 0;
 845                 }
 846         case CCISS_GETDRIVVER:
 847                 {
 848                         DriverVer_type DriverVer = DRIVER_VERSION;
 849
 850                         if (!arg)
 851                                 return -EINVAL;
 852
 853                         if (copy_to_user
 854                             (argp, &DriverVer, sizeof(DriverVer_type)))
 855                                 return -EFAULT;
 856                         return 0;
 857                 }
 858
 859         case CCISS_REVALIDVOLS:
 860                 if (bdev != bdev->bd_contains || drv != host->drv)
 861                         return -ENXIO;
 862                 return revalidate_allvol(host);
 863
 864         case CCISS_GETLUNINFO:{
 865                         LogvolInfo_struct luninfo;
 866
 867                         luninfo.LunID = drv->LunID;
 868                         luninfo.num_opens = drv->usage_count;
 869                         luninfo.num_parts = 0;
 870                         if (copy_to_user(argp, &luninfo,
 871                                          sizeof(LogvolInfo_struct)))
 872                                 return -EFAULT;
 873                         return 0;
 874                 }
 875         case CCISS_DEREGDISK:
 876                 return rebuild_lun_table(host, disk);
 877
 878         case CCISS_REGNEWD:
 879                 return rebuild_lun_table(host, NULL);
 880
 881         case CCISS_PASSTHRU:
 882                 {
 883                         IOCTL_Command_struct iocommand;
 884                         CommandList_struct *c;
 885                         char *buff = NULL;
 886                         u64bit temp64;
 887                         unsigned long flags;
 888                         DECLARE_COMPLETION_ONSTACK(wait);
 889
 890                         if (!arg)
 891                                 return -EINVAL;
 892
 893                         if (!capable(CAP_SYS_RAWIO))
 894                                 return -EPERM;
 895
 896                         if (copy_from_user
 897                             (&iocommand, argp, sizeof(IOCTL_Command_struct)))
 898                                 return -EFAULT;
 899                         if ((iocommand.buf_size < 1) &&
 900                             (iocommand.Request.Type.Direction != XFER_NONE)) {
 901                                 return -EINVAL;
 902                         }
 903 #if 0                           /* 'buf_size' member is 16-bits, and always smaller than kmalloc limit */
 904                         /* Check kmalloc limits */
 905                         if (iocommand.buf_size > 128000)
 906                                 return -EINVAL;
 907 #endif
 908                         if (iocommand.buf_size > 0) {
 909                                 buff = kmalloc(iocommand.buf_size, GFP_KERNEL);
 910                                 if (buff == NULL)
 911                                         return -EFAULT;
 912                         }
 913                         if (iocommand.Request.Type.Direction == XFER_WRITE) {
 914                                 /* Copy the data into the buffer we created */
 915                                 if (copy_from_user
 916                                     (buff, iocommand.buf, iocommand.buf_size)) {
 917                                         kfree(buff);
 918                                         return -EFAULT;
 919                                 }
 920                         } else {
 921                                 memset(buff, 0, iocommand.buf_size);
 922                         }
 923                         if ((c = cmd_alloc(host, 0)) == NULL) {
 924                                 kfree(buff);
 925                                 return -ENOMEM;
 926                         }
 927                         // Fill in the command type
 928                         c->cmd_type = CMD_IOCTL_PEND;
 929                         // Fill in Command Header
 930                         c->Header.ReplyQueue = 0;       // unused in simple mode
 931                         if (iocommand.buf_size > 0)     // buffer to fill
 932                         {
 933                                 c->Header.SGList = 1;
 934                                 c->Header.SGTotal = 1;
 935                         } else  // no buffers to fill
 936                         {
 937                                 c->Header.SGList = 0;
 938                                 c->Header.SGTotal = 0;
 939                         }
 940                         c->Header.LUN = iocommand.LUN_info;
 941                         c->Header.Tag.lower = c->busaddr;       // use the kernel address the cmd block for tag
 942
 943                         // Fill in Request block
 944                         c->Request = iocommand.Request;
 945
 946                         // Fill in the scatter gather information
 947                         if (iocommand.buf_size > 0) {
 948                                 temp64.val = pci_map_single(host->pdev, buff,
 949                                         iocommand.buf_size,
 950                                         PCI_DMA_BIDIRECTIONAL);
 951                                 c->SG[0].Addr.lower = temp64.val32.lower;
 952                                 c->SG[0].Addr.upper = temp64.val32.upper;
 953                                 c->SG[0].Len = iocommand.buf_size;
 954                                 c->SG[0].Ext = 0;       // we are not chaining
 955                         }
 956                         c->waiting = &wait;
 957
 958                         /* Put the request on the tail of the request queue */
 959                         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
 960                         addQ(&host->reqQ, c);
 961                         host->Qdepth++;
 962                         start_io(host);
 963                         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
 964
 965                         wait_for_completion(&wait);
 966
 967                         /* unlock the buffers from DMA */
 968                         temp64.val32.lower = c->SG[0].Addr.lower;
 969                         temp64.val32.upper = c->SG[0].Addr.upper;
 970                         pci_unmap_single(host->pdev, (dma_addr_t) temp64.val,
 971                                          iocommand.buf_size,
 972                                          PCI_DMA_BIDIRECTIONAL);
 973
 974                         /* Copy the error information out */
 975                         iocommand.error_info = *(c->err_info);
 976                         if (copy_to_user
 977                             (argp, &iocommand, sizeof(IOCTL_Command_struct))) {
 978                                 kfree(buff);
 979                                 cmd_free(host, c, 0);
 980                                 return -EFAULT;
 981                         }
 982
 983                         if (iocommand.Request.Type.Direction == XFER_READ) {
 984                                 /* Copy the data out of the buffer we created */
 985                                 if (copy_to_user
 986                                     (iocommand.buf, buff, iocommand.buf_size)) {
 987                                         kfree(buff);
 988                                         cmd_free(host, c, 0);
 989                                         return -EFAULT;
 990                                 }
 991                         }
 992                         kfree(buff);
 993                         cmd_free(host, c, 0);
 994                         return 0;
 995                 }
 996         case CCISS_BIG_PASSTHRU:{
 997                         BIG_IOCTL_Command_struct *ioc;
 998                         CommandList_struct *c;
 999                         unsigned char **buff = NULL;
1000                         int *buff_size = NULL;
1001                         u64bit temp64;
1002                         unsigned long flags;
1003                         BYTE sg_used = 0;
1004                         int status = 0;
1005                         int i;
1006                         DECLARE_COMPLETION_ONSTACK(wait);
1007                         __u32 left;
1008                         __u32 sz;
1009                         BYTE __user *data_ptr;
1010
1011                         if (!arg)
1012                                 return -EINVAL;
1013                         if (!capable(CAP_SYS_RAWIO))
1014                                 return -EPERM;
1015                         ioc = (BIG_IOCTL_Command_struct *)
1016                             kmalloc(sizeof(*ioc), GFP_KERNEL);
1017                         if (!ioc) {
1018                                 status = -ENOMEM;
1019                                 goto cleanup1;
1020                         }
1021                         if (copy_from_user(ioc, argp, sizeof(*ioc))) {
1022                                 status = -EFAULT;
1023                                 goto cleanup1;
1024                         }
1025                         if ((ioc->buf_size < 1) &&
1026                             (ioc->Request.Type.Direction != XFER_NONE)) {
1027                                 status = -EINVAL;
1028                                 goto cleanup1;
1029                         }
1030                         /* Check kmalloc limits  using all SGs */
1031                         if (ioc->malloc_size > MAX_KMALLOC_SIZE) {
1032                                 status = -EINVAL;
1033                                 goto cleanup1;
1034                         }
1035                         if (ioc->buf_size > ioc->malloc_size * MAXSGENTRIES) {
1036                                 status = -EINVAL;
1037                                 goto cleanup1;
1038                         }
1039                         buff =
1040                             kzalloc(MAXSGENTRIES * sizeof(char *), GFP_KERNEL);
1041                         if (!buff) {
1042                                 status = -ENOMEM;
1043                                 goto cleanup1;
1044                         }
1045                         buff_size = (int *)kmalloc(MAXSGENTRIES * sizeof(int),
1046                                                    GFP_KERNEL);
1047                         if (!buff_size) {
1048                                 status = -ENOMEM;
1049                                 goto cleanup1;
1050                         }
1051                         left = ioc->buf_size;
1052                         data_ptr = ioc->buf;
1053                         while (left) {
1054                                 sz = (left >
1055                                       ioc->malloc_size) ? ioc->
1056                                     malloc_size : left;
1057                                 buff_size[sg_used] = sz;
1058                                 buff[sg_used] = kmalloc(sz, GFP_KERNEL);
1059                                 if (buff[sg_used] == NULL) {
1060                                         status = -ENOMEM;
1061                                         goto cleanup1;
1062                                 }
1063                                 if (ioc->Request.Type.Direction == XFER_WRITE) {
1064                                         if (copy_from_user
1065                                             (buff[sg_used], data_ptr, sz)) {
1066                                                 status = -ENOMEM;
1067                                                 goto cleanup1;
1068                                         }
1069                                 } else {
1070                                         memset(buff[sg_used], 0, sz);
1071                                 }
1072                                 left -= sz;
1073                                 data_ptr += sz;
1074                                 sg_used++;
1075                         }
1076                         if ((c = cmd_alloc(host, 0)) == NULL) {
1077                                 status = -ENOMEM;
1078                                 goto cleanup1;
1079                         }
1080                         c->cmd_type = CMD_IOCTL_PEND;
1081                         c->Header.ReplyQueue = 0;
1082
1083                         if (ioc->buf_size > 0) {
1084                                 c->Header.SGList = sg_used;
1085                                 c->Header.SGTotal = sg_used;
1086                         } else {
1087                                 c->Header.SGList = 0;
1088                                 c->Header.SGTotal = 0;
1089                         }
1090                         c->Header.LUN = ioc->LUN_info;
1091                         c->Header.Tag.lower = c->busaddr;
1092
1093                         c->Request = ioc->Request;
1094                         if (ioc->buf_size > 0) {
1095                                 int i;
1096                                 for (i = 0; i < sg_used; i++) {
1097                                         temp64.val =
1098                                             pci_map_single(host->pdev, buff[i],
1099                                                     buff_size[i],
1100                                                     PCI_DMA_BIDIRECTIONAL);
1101                                         c->SG[i].Addr.lower =
1102                                             temp64.val32.lower;
1103                                         c->SG[i].Addr.upper =
1104                                             temp64.val32.upper;
1105                                         c->SG[i].Len = buff_size[i];
1106                                         c->SG[i].Ext = 0;       /* we are not chaining */
1107                                 }
1108                         }
1109                         c->waiting = &wait;
1110                         /* Put the request on the tail of the request queue */
1111                         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
1112                         addQ(&host->reqQ, c);
1113                         host->Qdepth++;
1114                         start_io(host);
1115                         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
1116                         wait_for_completion(&wait);
1117                         /* unlock the buffers from DMA */
1118                         for (i = 0; i < sg_used; i++) {
1119                                 temp64.val32.lower = c->SG[i].Addr.lower;
1120                                 temp64.val32.upper = c->SG[i].Addr.upper;
1121                                 pci_unmap_single(host->pdev,
1122                                         (dma_addr_t) temp64.val, buff_size[i],
1123                                         PCI_DMA_BIDIRECTIONAL);
1124                         }
1125                         /* Copy the error information out */
1126                         ioc->error_info = *(c->err_info);
1127                         if (copy_to_user(argp, ioc, sizeof(*ioc))) {
1128                                 cmd_free(host, c, 0);
1129                                 status = -EFAULT;
1130                                 goto cleanup1;
1131                         }
1132                         if (ioc->Request.Type.Direction == XFER_READ) {
1133                                 /* Copy the data out of the buffer we created */
1134                                 BYTE __user *ptr = ioc->buf;
1135                                 for (i = 0; i < sg_used; i++) {
1136                                         if (copy_to_user
1137                                             (ptr, buff[i], buff_size[i])) {
1138                                                 cmd_free(host, c, 0);
1139                                                 status = -EFAULT;
1140                                                 goto cleanup1;
1141                                         }
1142                                         ptr += buff_size[i];
1143                                 }
1144                         }
1145                         cmd_free(host, c, 0);
1146                         status = 0;
1147                       cleanup1:
1148                         if (buff) {
1149                                 for (i = 0; i < sg_used; i++)
1150                                         kfree(buff[i]);
1151                                 kfree(buff);
1152                         }
1153                         kfree(buff_size);
1154                         kfree(ioc);
1155                         return status;
1156                 }
1157         default:
1158                 return -ENOTTY;
1159         }
1160 }
1161
1162 /*
1163  * revalidate_allvol is for online array config utilities.  After a
1164  * utility reconfigures the drives in the array, it can use this function
1165  * (through an ioctl) to make the driver zap any previous disk structs for
1166  * that controller and get new ones.
1167  *
1168  * Right now I'm using the getgeometry() function to do this, but this
1169  * function should probably be finer grained and allow you to revalidate one
1170  * particular logical volume (instead of all of them on a particular
1171  * controller).
1172  */
1173 static int revalidate_allvol(ctlr_info_t *host)
1174 {
1175         int ctlr = host->ctlr, i;
1176         unsigned long flags;
1177
1178         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
1179         if (host->usage_count > 1) {
1180                 spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
1181                 printk(KERN_WARNING "cciss: Device busy for volume"
1182                        " revalidation (usage=%d)\n", host->usage_count);
1183                 return -EBUSY;
1184         }
1185         host->usage_count++;
1186         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
1187
1188         for (i = 0; i < NWD; i++) {
1189                 struct gendisk *disk = host->gendisk[i];
1190                 if (disk) {
1191                         request_queue_t *q = disk->queue;
1192
1193                         if (disk->flags & GENHD_FL_UP)
1194                                 del_gendisk(disk);
1195                         if (q)
1196                                 blk_cleanup_queue(q);
1197                 }
1198         }
1199
1200         /*
1201          * Set the partition and block size structures for all volumes
1202          * on this controller to zero.  We will reread all of this data
1203          */
1204         memset(host->drv, 0, sizeof(drive_info_struct)
1205                * CISS_MAX_LUN);
1206         /*
1207          * Tell the array controller not to give us any interrupts while
1208          * we check the new geometry.  Then turn interrupts back on when
1209          * we're done.
1210          */
1211         host->access.set_intr_mask(host, CCISS_INTR_OFF);
1212         cciss_getgeometry(ctlr);
1213         host->access.set_intr_mask(host, CCISS_INTR_ON);
1214
1215         /* Loop through each real device */
1216         for (i = 0; i < NWD; i++) {
1217                 struct gendisk *disk = host->gendisk[i];
1218                 drive_info_struct *drv = &(host->drv[i]);
1219                 /* we must register the controller even if no disks exist */
1220                 /* this is for the online array utilities */
1221                 if (!drv->heads && i)
1222                         continue;
1223                 blk_queue_hardsect_size(drv->queue, drv->block_size);
1224                 set_capacity(disk, drv->nr_blocks);
1225                 add_disk(disk);
1226         }
1227         host->usage_count--;
1228         return 0;
1229 }
1230
1231 static inline void complete_buffers(struct bio *bio, int status)
1232 {
1233         while (bio) {
1234                 struct bio *xbh = bio->bi_next;
1235                 int nr_sectors = bio_sectors(bio);
1236
1237                 bio->bi_next = NULL;
1238                 bio_endio(bio, nr_sectors << 9, status ? 0 : -EIO);
1239                 bio = xbh;
1240         }
1241 }
1242
1243 static void cciss_check_queues(ctlr_info_t *h)
1244 {
1245         int start_queue = h->next_to_run;
1246         int i;
1247
1248         /* check to see if we have maxed out the number of commands that can
1249          * be placed on the queue.  If so then exit.  We do this check here
1250          * in case the interrupt we serviced was from an ioctl and did not
1251          * free any new commands.
1252          */
1253         if ((find_first_zero_bit(h->cmd_pool_bits, h->nr_cmds)) == h->nr_cmds)
1254                 return;
1255
1256         /* We have room on the queue for more commands.  Now we need to queue
1257          * them up.  We will also keep track of the next queue to run so
1258          * that every queue gets a chance to be started first.
1259          */
1260         for (i = 0; i < h->highest_lun + 1; i++) {
1261                 int curr_queue = (start_queue + i) % (h->highest_lun + 1);
1262                 /* make sure the disk has been added and the drive is real
1263                  * because this can be called from the middle of init_one.
1264                  */
1265                 if (!(h->drv[curr_queue].queue) || !(h->drv[curr_queue].heads))
1266                         continue;
1267                 blk_start_queue(h->gendisk[curr_queue]->queue);
1268
1269                 /* check to see if we have maxed out the number of commands
1270                  * that can be placed on the queue.
1271                  */
1272                 if ((find_first_zero_bit(h->cmd_pool_bits, h->nr_cmds)) == h->nr_cmds) {
1273                         if (curr_queue == start_queue) {
1274                                 h->next_to_run =
1275                                     (start_queue + 1) % (h->highest_lun + 1);
1276                                 break;
1277                         } else {
1278                                 h->next_to_run = curr_queue;
1279                                 break;
1280                         }
1281                 } else {
1282                         curr_queue = (curr_queue + 1) % (h->highest_lun + 1);
1283                 }
1284         }
1285 }
1286
1287 static void cciss_softirq_done(struct request *rq)
1288 {
1289         CommandList_struct *cmd = rq->completion_data;
1290         ctlr_info_t *h = hba[cmd->ctlr];
1291         unsigned long flags;
1292         u64bit temp64;
1293         int i, ddir;
1294
1295         if (cmd->Request.Type.Direction == XFER_READ)
1296                 ddir = PCI_DMA_FROMDEVICE;
1297         else
1298                 ddir = PCI_DMA_TODEVICE;
1299
1300         /* command did not need to be retried */
1301         /* unmap the DMA mapping for all the scatter gather elements */
1302         for (i = 0; i < cmd->Header.SGList; i++) {
1303                 temp64.val32.lower = cmd->SG[i].Addr.lower;
1304                 temp64.val32.upper = cmd->SG[i].Addr.upper;
1305                 pci_unmap_page(h->pdev, temp64.val, cmd->SG[i].Len, ddir);
1306         }
1307
1308         complete_buffers(rq->bio, rq->errors);
1309
1310         if (blk_fs_request(rq)) {
1311                 const int rw = rq_data_dir(rq);
1312
1313                 disk_stat_add(rq->rq_disk, sectors[rw], rq->nr_sectors);
1314         }
1315
1316 #ifdef CCISS_DEBUG
1317         printk("Done with %p\n", rq);
1318 #endif                          /* CCISS_DEBUG */
1319
1320         add_disk_randomness(rq->rq_disk);
1321         spin_lock_irqsave(&h->lock, flags);
1322         end_that_request_last(rq, rq->errors);
1323         cmd_free(h, cmd, 1);
1324         cciss_check_queues(h);
1325         spin_unlock_irqrestore(&h->lock, flags);
1326 }
1327
1328 /* This function will check the usage_count of the drive to be updated/added.
1329  * If the usage_count is zero then the drive information will be updated and
1330  * the disk will be re-registered with the kernel.  If not then it will be
1331  * left alone for the next reboot.  The exception to this is disk 0 which
1332  * will always be left registered with the kernel since it is also the
1333  * controller node.  Any changes to disk 0 will show up on the next
1334  * reboot.
1335  */
1336 static void cciss_update_drive_info(int ctlr, int drv_index)
1337 {
1338         ctlr_info_t *h = hba[ctlr];
1339         struct gendisk *disk;
1340         InquiryData_struct *inq_buff = NULL;
1341         unsigned int block_size;
1342         sector_t total_size;
1343         unsigned long flags = 0;
1344         int ret = 0;
1345
1346         /* if the disk already exists then deregister it before proceeding */
1347         if (h->drv[drv_index].raid_level != -1) {
1348                 spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
1349                 h->drv[drv_index].busy_configuring = 1;
1350                 spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
1351                 ret = deregister_disk(h->gendisk[drv_index],
1352                                       &h->drv[drv_index], 0);
1353                 h->drv[drv_index].busy_configuring = 0;
1354         }
1355
1356         /* If the disk is in use return */
1357         if (ret)
1358                 return;
1359
1360         /* Get information about the disk and modify the driver structure */
1361         inq_buff = kmalloc(sizeof(InquiryData_struct), GFP_KERNEL);
1362         if (inq_buff == NULL)
1363                 goto mem_msg;
1364
1365         cciss_read_capacity(ctlr, drv_index, 1,
1366                             &total_size, &block_size);
1367
1368         /* total size = last LBA + 1 */
1369         /* FFFFFFFF + 1 = 0, cannot have a logical volume of size 0 */
1370         /* so we assume this volume this must be >2TB in size */
1371         if (total_size == (__u32) 0) {
1372                 cciss_read_capacity_16(ctlr, drv_index, 1,
1373                 &total_size, &block_size);
1374                 h->cciss_read = CCISS_READ_16;
1375                 h->cciss_write = CCISS_WRITE_16;
1376         } else {
1377                 h->cciss_read = CCISS_READ_10;
1378                 h->cciss_write = CCISS_WRITE_10;
1379         }
1380         cciss_geometry_inquiry(ctlr, drv_index, 1, total_size, block_size,
1381                                inq_buff, &h->drv[drv_index]);
1382
1383         ++h->num_luns;
1384         disk = h->gendisk[drv_index];
1385         set_capacity(disk, h->drv[drv_index].nr_blocks);
1386
1387         /* if it's the controller it's already added */
1388         if (drv_index) {
1389                 disk->queue = blk_init_queue(do_cciss_request, &h->lock);
1390
1391                 /* Set up queue information */
1392                 disk->queue->backing_dev_info.ra_pages = READ_AHEAD;
1393                 blk_queue_bounce_limit(disk->queue, hba[ctlr]->pdev->dma_mask);
1394
1395                 /* This is a hardware imposed limit. */
1396                 blk_queue_max_hw_segments(disk->queue, MAXSGENTRIES);
1397
1398                 /* This is a limit in the driver and could be eliminated. */
1399                 blk_queue_max_phys_segments(disk->queue, MAXSGENTRIES);
1400
1401                 blk_queue_max_sectors(disk->queue, h->cciss_max_sectors);
1402
1403                 blk_queue_softirq_done(disk->queue, cciss_softirq_done);
1404
1405                 disk->queue->queuedata = hba[ctlr];
1406
1407                 blk_queue_hardsect_size(disk->queue,
1408                                         hba[ctlr]->drv[drv_index].block_size);
1409
1410                 h->drv[drv_index].queue = disk->queue;
1411                 add_disk(disk);
1412         }
1413
1414       freeret:
1415         kfree(inq_buff);
1416         return;
1417       mem_msg:
1418         printk(KERN_ERR "cciss: out of memory\n");
1419         goto freeret;
1420 }
1421
1422 /* This function will find the first index of the controllers drive array
1423  * that has a -1 for the raid_level and will return that index.  This is
1424  * where new drives will be added.  If the index to be returned is greater
1425  * than the highest_lun index for the controller then highest_lun is set
1426  * to this new index.  If there are no available indexes then -1 is returned.
1427  */
1428 static int cciss_find_free_drive_index(int ctlr)
1429 {
1430         int i;
1431
1432         for (i = 0; i < CISS_MAX_LUN; i++) {
1433                 if (hba[ctlr]->drv[i].raid_level == -1) {
1434                         if (i > hba[ctlr]->highest_lun)
1435                                 hba[ctlr]->highest_lun = i;
1436                         return i;
1437                 }
1438         }
1439         return -1;
1440 }
1441
1442 /* This function will add and remove logical drives from the Logical
1443  * drive array of the controller and maintain persistency of ordering
1444  * so that mount points are preserved until the next reboot.  This allows
1445  * for the removal of logical drives in the middle of the drive array
1446  * without a re-ordering of those drives.
1447  * INPUT
1448  * h            = The controller to perform the operations on
1449  * del_disk     = The disk to remove if specified.  If the value given
1450  *                is NULL then no disk is removed.
1451  */
1452 static int rebuild_lun_table(ctlr_info_t *h, struct gendisk *del_disk)
1453 {
1454         int ctlr = h->ctlr;
1455         int num_luns;
1456         ReportLunData_struct *ld_buff = NULL;
1457         drive_info_struct *drv = NULL;
1458         int return_code;
1459         int listlength = 0;
1460         int i;
1461         int drv_found;
1462         int drv_index = 0;
1463         __u32 lunid = 0;
1464         unsigned long flags;
1465
1466         /* Set busy_configuring flag for this operation */
1467         spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
1468         if (h->num_luns >= CISS_MAX_LUN) {
1469                 spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
1470                 return -EINVAL;
1471         }
1472
1473         if (h->busy_configuring) {
1474                 spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
1475                 return -EBUSY;
1476         }
1477         h->busy_configuring = 1;
1478
1479         /* if del_disk is NULL then we are being called to add a new disk
1480          * and update the logical drive table.  If it is not NULL then
1481          * we will check if the disk is in use or not.
1482          */
1483         if (del_disk != NULL) {
1484                 drv = get_drv(del_disk);
1485                 drv->busy_configuring = 1;
1486                 spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
1487                 return_code = deregister_disk(del_disk, drv, 1);
1488                 drv->busy_configuring = 0;
1489                 h->busy_configuring = 0;
1490                 return return_code;
1491         } else {
1492                 spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
1493                 if (!capable(CAP_SYS_RAWIO))
1494                         return -EPERM;
1495
1496                 ld_buff = kzalloc(sizeof(ReportLunData_struct), GFP_KERNEL);
1497                 if (ld_buff == NULL)
1498                         goto mem_msg;
1499
1500                 return_code = sendcmd_withirq(CISS_REPORT_LOG, ctlr, ld_buff,
1501                                               sizeof(ReportLunData_struct), 0,
1502                                               0, 0, TYPE_CMD);
1503
1504                 if (return_code == IO_OK) {
1505                         listlength |=
1506                             (0xff & (unsigned int)(ld_buff->LUNListLength[0]))
1507                             << 24;
1508                         listlength |=
1509                             (0xff & (unsigned int)(ld_buff->LUNListLength[1]))
1510                             << 16;
1511                         listlength |=
1512                             (0xff & (unsigned int)(ld_buff->LUNListLength[2]))
1513                             << 8;
1514                         listlength |=
1515                             0xff & (unsigned int)(ld_buff->LUNListLength[3]);
1516                 } else {        /* reading number of logical volumes failed */
1517                         printk(KERN_WARNING "cciss: report logical volume"
1518                                " command failed\n");
1519                         listlength = 0;
1520                         goto freeret;
1521                 }
1522
1523                 num_luns = listlength / 8;      /* 8 bytes per entry */
1524                 if (num_luns > CISS_MAX_LUN) {
1525                         num_luns = CISS_MAX_LUN;
1526                         printk(KERN_WARNING "cciss: more luns configured"
1527                                " on controller than can be handled by"
1528                                " this driver.\n");
1529                 }
1530
1531                 /* Compare controller drive array to drivers drive array.
1532                  * Check for updates in the drive information and any new drives
1533                  * on the controller.
1534                  */
1535                 for (i = 0; i < num_luns; i++) {
1536                         int j;
1537
1538                         drv_found = 0;
1539
1540                         lunid = (0xff &
1541                                  (unsigned int)(ld_buff->LUN[i][3])) << 24;
1542                         lunid |= (0xff &
1543                                   (unsigned int)(ld_buff->LUN[i][2])) << 16;
1544                         lunid |= (0xff &
1545                                   (unsigned int)(ld_buff->LUN[i][1])) << 8;
1546                         lunid |= 0xff & (unsigned int)(ld_buff->LUN[i][0]);
1547
1548                         /* Find if the LUN is already in the drive array
1549                          * of the controller.  If so then update its info
1550                          * if not is use.  If it does not exist then find
1551                          * the first free index and add it.
1552                          */
1553                         for (j = 0; j <= h->highest_lun; j++) {
1554                                 if (h->drv[j].LunID == lunid) {
1555                                         drv_index = j;
1556                                         drv_found = 1;
1557                                 }
1558                         }
1559
1560                         /* check if the drive was found already in the array */
1561                         if (!drv_found) {
1562                                 drv_index = cciss_find_free_drive_index(ctlr);
1563                                 if (drv_index == -1)
1564                                         goto freeret;
1565
1566                         }
1567                         h->drv[drv_index].LunID = lunid;
1568                         cciss_update_drive_info(ctlr, drv_index);
1569                 }               /* end for */
1570         }                       /* end else */
1571
1572       freeret:
1573         kfree(ld_buff);
1574         h->busy_configuring = 0;
1575         /* We return -1 here to tell the ACU that we have registered/updated
1576          * all of the drives that we can and to keep it from calling us
1577          * additional times.
1578          */
1579         return -1;
1580       mem_msg:
1581         printk(KERN_ERR "cciss: out of memory\n");
1582         goto freeret;
1583 }
1584
1585 /* This function will deregister the disk and it's queue from the
1586  * kernel.  It must be called with the controller lock held and the
1587  * drv structures busy_configuring flag set.  It's parameters are:
1588  *
1589  * disk = This is the disk to be deregistered
1590  * drv  = This is the drive_info_struct associated with the disk to be
1591  *        deregistered.  It contains information about the disk used
1592  *        by the driver.
1593  * clear_all = This flag determines whether or not the disk information
1594  *             is going to be completely cleared out and the highest_lun
1595  *             reset.  Sometimes we want to clear out information about
1596  *             the disk in preparation for re-adding it.  In this case
1597  *             the highest_lun should be left unchanged and the LunID
1598  *             should not be cleared.
1599 */
1600 static int deregister_disk(struct gendisk *disk, drive_info_struct *drv,
1601                            int clear_all)
1602 {
1603         ctlr_info_t *h = get_host(disk);
1604
1605         if (!capable(CAP_SYS_RAWIO))
1606                 return -EPERM;
1607
1608         /* make sure logical volume is NOT is use */
1609         if (clear_all || (h->gendisk[0] == disk)) {
1610                 if (drv->usage_count > 1)
1611                         return -EBUSY;
1612         } else if (drv->usage_count > 0)
1613                 return -EBUSY;
1614
1615         /* invalidate the devices and deregister the disk.  If it is disk
1616          * zero do not deregister it but just zero out it's values.  This
1617          * allows us to delete disk zero but keep the controller registered.
1618          */
1619         if (h->gendisk[0] != disk) {
1620                 if (disk) {
1621                         request_queue_t *q = disk->queue;
1622                         if (disk->flags & GENHD_FL_UP)
1623                                 del_gendisk(disk);
1624                         if (q) {
1625                                 blk_cleanup_queue(q);
1626                                 drv->queue = NULL;
1627                         }
1628                 }
1629         }
1630
1631         --h->num_luns;
1632         /* zero out the disk size info */
1633         drv->nr_blocks = 0;
1634         drv->block_size = 0;
1635         drv->heads = 0;
1636         drv->sectors = 0;
1637         drv->cylinders = 0;
1638         drv->raid_level = -1;   /* This can be used as a flag variable to
1639                                  * indicate that this element of the drive
1640                                  * array is free.
1641                                  */
1642
1643         if (clear_all) {
1644                 /* check to see if it was the last disk */
1645                 if (drv == h->drv + h->highest_lun) {
1646                         /* if so, find the new hightest lun */
1647                         int i, newhighest = -1;
1648                         for (i = 0; i < h->highest_lun; i++) {
1649                                 /* if the disk has size > 0, it is available */
1650                                 if (h->drv[i].heads)
1651                                         newhighest = i;
1652                         }
1653                         h->highest_lun = newhighest;
1654                 }
1655
1656                 drv->LunID = 0;
1657         }
1658         return 0;
1659 }
1660
1661 static int fill_cmd(CommandList_struct *c, __u8 cmd, int ctlr, void *buff, size_t size, unsigned int use_unit_num,      /* 0: address the controller,
1662                                                                                                                            1: address logical volume log_unit,
1663                                                                                                                            2: periph device address is scsi3addr */
1664                     unsigned int log_unit, __u8 page_code,
1665                     unsigned char *scsi3addr, int cmd_type)
1666 {
1667         ctlr_info_t *h = hba[ctlr];
1668         u64bit buff_dma_handle;
1669         int status = IO_OK;
1670
1671         c->cmd_type = CMD_IOCTL_PEND;
1672         c->Header.ReplyQueue = 0;
1673         if (buff != NULL) {
1674                 c->Header.SGList = 1;
1675                 c->Header.SGTotal = 1;
1676         } else {
1677                 c->Header.SGList = 0;
1678                 c->Header.SGTotal = 0;
1679         }
1680         c->Header.Tag.lower = c->busaddr;
1681
1682         c->Request.Type.Type = cmd_type;
1683         if (cmd_type == TYPE_CMD) {
1684                 switch (cmd) {
1685                 case CISS_INQUIRY:
1686                         /* If the logical unit number is 0 then, this is going
1687                            to controller so It's a physical command
1688                            mode = 0 target = 0.  So we have nothing to write.
1689                            otherwise, if use_unit_num == 1,
1690                            mode = 1(volume set addressing) target = LUNID
1691                            otherwise, if use_unit_num == 2,
1692                            mode = 0(periph dev addr) target = scsi3addr */
1693                         if (use_unit_num == 1) {
1694                                 c->Header.LUN.LogDev.VolId =
1695                                     h->drv[log_unit].LunID;
1696                                 c->Header.LUN.LogDev.Mode = 1;
1697                         } else if (use_unit_num == 2) {
1698                                 memcpy(c->Header.LUN.LunAddrBytes, scsi3addr,
1699                                        8);
1700                                 c->Header.LUN.LogDev.Mode = 0;
1701                         }
1702                         /* are we trying to read a vital product page */
1703                         if (page_code != 0) {
1704                                 c->Request.CDB[1] = 0x01;
1705                                 c->Request.CDB[2] = page_code;
1706                         }
1707                         c->Request.CDBLen = 6;
1708                         c->Request.Type.Attribute = ATTR_SIMPLE;
1709                         c->Request.Type.Direction = XFER_READ;
1710                         c->Request.Timeout = 0;
1711                         c->Request.CDB[0] = CISS_INQUIRY;
1712                         c->Request.CDB[4] = size & 0xFF;
1713                         break;
1714                 case CISS_REPORT_LOG:
1715                 case CISS_REPORT_PHYS:
1716                         /* Talking to controller so It's a physical command
1717                            mode = 00 target = 0.  Nothing to write.
1718                          */
1719                         c->Request.CDBLen = 12;
1720                         c->Request.Type.Attribute = ATTR_SIMPLE;
1721                         c->Request.Type.Direction = XFER_READ;
1722                         c->Request.Timeout = 0;
1723                         c->Request.CDB[0] = cmd;
1724                         c->Request.CDB[6] = (size >> 24) & 0xFF;        //MSB
1725                         c->Request.CDB[7] = (size >> 16) & 0xFF;
1726                         c->Request.CDB[8] = (size >> 8) & 0xFF;
1727                         c->Request.CDB[9] = size & 0xFF;
1728                         break;
1729
1730                 case CCISS_READ_CAPACITY:
1731                         c->Header.LUN.LogDev.VolId = h->drv[log_unit].LunID;
1732                         c->Header.LUN.LogDev.Mode = 1;
1733                         c->Request.CDBLen = 10;
1734                         c->Request.Type.Attribute = ATTR_SIMPLE;
1735                         c->Request.Type.Direction = XFER_READ;
1736                         c->Request.Timeout = 0;
1737                         c->Request.CDB[0] = cmd;
1738                         break;
1739                 case CCISS_READ_CAPACITY_16:
1740                         c->Header.LUN.LogDev.VolId = h->drv[log_unit].LunID;
1741                         c->Header.LUN.LogDev.Mode = 1;
1742                         c->Request.CDBLen = 16;
1743                         c->Request.Type.Attribute = ATTR_SIMPLE;
1744                         c->Request.Type.Direction = XFER_READ;
1745                         c->Request.Timeout = 0;
1746                         c->Request.CDB[0] = cmd;
1747                         c->Request.CDB[1] = 0x10;
1748                         c->Request.CDB[10] = (size >> 24) & 0xFF;
1749                         c->Request.CDB[11] = (size >> 16) & 0xFF;
1750                         c->Request.CDB[12] = (size >> 8) & 0xFF;
1751                         c->Request.CDB[13] = size & 0xFF;
1752                         c->Request.Timeout = 0;
1753                         c->Request.CDB[0] = cmd;
1754                         break;
1755                 case CCISS_CACHE_FLUSH:
1756                         c->Request.CDBLen = 12;
1757                         c->Request.Type.Attribute = ATTR_SIMPLE;
1758                         c->Request.Type.Direction = XFER_WRITE;
1759                         c->Request.Timeout = 0;
1760                         c->Request.CDB[0] = BMIC_WRITE;
1761                         c->Request.CDB[6] = BMIC_CACHE_FLUSH;
1762                         break;
1763                 default:
1764                         printk(KERN_WARNING
1765                                "cciss%d:  Unknown Command 0x%c\n", ctlr, cmd);
1766                         return IO_ERROR;
1767                 }
1768         } else if (cmd_type == TYPE_MSG) {
1769                 switch (cmd) {
1770                 case 0: /* ABORT message */
1771                         c->Request.CDBLen = 12;
1772                         c->Request.Type.Attribute = ATTR_SIMPLE;
1773                         c->Request.Type.Direction = XFER_WRITE;
1774                         c->Request.Timeout = 0;
1775                         c->Request.CDB[0] = cmd;        /* abort */
1776                         c->Request.CDB[1] = 0;  /* abort a command */
1777                         /* buff contains the tag of the command to abort */
1778                         memcpy(&c->Request.CDB[4], buff, 8);
1779                         break;
1780                 case 1: /* RESET message */
1781                         c->Request.CDBLen = 12;
1782                         c->Request.Type.Attribute = ATTR_SIMPLE;
1783                         c->Request.Type.Direction = XFER_WRITE;
1784                         c->Request.Timeout = 0;
1785                         memset(&c->Request.CDB[0], 0, sizeof(c->Request.CDB));
1786                         c->Request.CDB[0] = cmd;        /* reset */
1787                         c->Request.CDB[1] = 0x04;       /* reset a LUN */
1788                         break;
1789                 case 3: /* No-Op message */
1790                         c->Request.CDBLen = 1;
1791                         c->Request.Type.Attribute = ATTR_SIMPLE;
1792                         c->Request.Type.Direction = XFER_WRITE;
1793                         c->Request.Timeout = 0;
1794                         c->Request.CDB[0] = cmd;
1795                         break;
1796                 default:
1797                         printk(KERN_WARNING
1798                                "cciss%d: unknown message type %d\n", ctlr, cmd);
1799                         return IO_ERROR;
1800                 }
1801         } else {
1802                 printk(KERN_WARNING
1803                        "cciss%d: unknown command type %d\n", ctlr, cmd_type);
1804                 return IO_ERROR;
1805         }
1806         /* Fill in the scatter gather information */
1807         if (size > 0) {
1808                 buff_dma_handle.val = (__u64) pci_map_single(h->pdev,
1809                                                              buff, size,
1810                                                              PCI_DMA_BIDIRECTIONAL);
1811                 c->SG[0].Addr.lower = buff_dma_handle.val32.lower;
1812                 c->SG[0].Addr.upper = buff_dma_handle.val32.upper;
1813                 c->SG[0].Len = size;
1814                 c->SG[0].Ext = 0;       /* we are not chaining */
1815         }
1816         return status;
1817 }
1818
1819 static int sendcmd_withirq(__u8 cmd,
1820                            int ctlr,
1821                            void *buff,
1822                            size_t size,
1823                            unsigned int use_unit_num,
1824                            unsigned int log_unit, __u8 page_code, int cmd_type)
1825 {
1826         ctlr_info_t *h = hba[ctlr];
1827         CommandList_struct *c;
1828         u64bit buff_dma_handle;
1829         unsigned long flags;
1830         int return_status;
1831         DECLARE_COMPLETION_ONSTACK(wait);
1832
1833         if ((c = cmd_alloc(h, 0)) == NULL)
1834                 return -ENOMEM;
1835         return_status = fill_cmd(c, cmd, ctlr, buff, size, use_unit_num,
1836                                  log_unit, page_code, NULL, cmd_type);
1837         if (return_status != IO_OK) {
1838                 cmd_free(h, c, 0);
1839                 return return_status;
1840         }
1841       resend_cmd2:
1842         c->waiting = &wait;
1843
1844         /* Put the request on the tail of the queue and send it */
1845         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
1846         addQ(&h->reqQ, c);
1847         h->Qdepth++;
1848         start_io(h);
1849         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
1850
1851         wait_for_completion(&wait);
1852
1853         if (c->err_info->CommandStatus != 0) {  /* an error has occurred */
1854                 switch (c->err_info->CommandStatus) {
1855                 case CMD_TARGET_STATUS:
1856                         printk(KERN_WARNING "cciss: cmd %p has "
1857                                " completed with errors\n", c);
1858                         if (c->err_info->ScsiStatus) {
1859                                 printk(KERN_WARNING "cciss: cmd %p "
1860                                        "has SCSI Status = %x\n",
1861                                        c, c->err_info->ScsiStatus);
1862                         }
1863
1864                         break;
1865                 case CMD_DATA_UNDERRUN:
1866                 case CMD_DATA_OVERRUN:
1867                         /* expected for inquire and report lun commands */
1868                         break;
1869                 case CMD_INVALID:
1870                         printk(KERN_WARNING "cciss: Cmd %p is "
1871                                "reported invalid\n", c);
1872                         return_status = IO_ERROR;
1873                         break;
1874                 case CMD_PROTOCOL_ERR:
1875                         printk(KERN_WARNING "cciss: cmd %p has "
1876                                "protocol error \n", c);
1877                         return_status = IO_ERROR;
1878                         break;
1879                 case CMD_HARDWARE_ERR:
1880                         printk(KERN_WARNING "cciss: cmd %p had "
1881                                " hardware error\n", c);
1882                         return_status = IO_ERROR;
1883                         break;
1884                 case CMD_CONNECTION_LOST:
1885                         printk(KERN_WARNING "cciss: cmd %p had "
1886                                "connection lost\n", c);
1887                         return_status = IO_ERROR;
1888                         break;
1889                 case CMD_ABORTED:
1890                         printk(KERN_WARNING "cciss: cmd %p was "
1891                                "aborted\n", c);
1892                         return_status = IO_ERROR;
1893                         break;
1894                 case CMD_ABORT_FAILED:
1895                         printk(KERN_WARNING "cciss: cmd %p reports "
1896                                "abort failed\n", c);
1897                         return_status = IO_ERROR;
1898                         break;
1899                 case CMD_UNSOLICITED_ABORT:
1900                         printk(KERN_WARNING
1901                                "cciss%d: unsolicited abort %p\n", ctlr, c);
1902                         if (c->retry_count < MAX_CMD_RETRIES) {
1903                                 printk(KERN_WARNING
1904                                        "cciss%d: retrying %p\n", ctlr, c);
1905                                 c->retry_count++;
1906                                 /* erase the old error information */
1907                                 memset(c->err_info, 0,
1908                                        sizeof(ErrorInfo_struct));
1909                                 return_status = IO_OK;
1910                                 INIT_COMPLETION(wait);
1911                                 goto resend_cmd2;
1912                         }
1913                         return_status = IO_ERROR;
1914                         break;
1915                 default:
1916                         printk(KERN_WARNING "cciss: cmd %p returned "
1917                                "unknown status %x\n", c,
1918                                c->err_info->CommandStatus);
1919                         return_status = IO_ERROR;
1920                 }
1921         }
1922         /* unlock the buffers from DMA */
1923         buff_dma_handle.val32.lower = c->SG[0].Addr.lower;
1924         buff_dma_handle.val32.upper = c->SG[0].Addr.upper;
1925         pci_unmap_single(h->pdev, (dma_addr_t) buff_dma_handle.val,
1926                          c->SG[0].Len, PCI_DMA_BIDIRECTIONAL);
1927         cmd_free(h, c, 0);
1928         return return_status;
1929 }
1930
1931 static void cciss_geometry_inquiry(int ctlr, int logvol,
1932                                    int withirq, sector_t total_size,
1933                                    unsigned int block_size,
1934                                    InquiryData_struct *inq_buff,
1935                                    drive_info_struct *drv)
1936 {
1937         int return_code;
1938         unsigned long t;
1939
1940         memset(inq_buff, 0, sizeof(InquiryData_struct));
1941         if (withirq)
1942                 return_code = sendcmd_withirq(CISS_INQUIRY, ctlr,
1943                                               inq_buff, sizeof(*inq_buff), 1,
1944                                               logvol, 0xC1, TYPE_CMD);
1945         else
1946                 return_code = sendcmd(CISS_INQUIRY, ctlr, inq_buff,
1947                                       sizeof(*inq_buff), 1, logvol, 0xC1, NULL,
1948                                       TYPE_CMD);
1949         if (return_code == IO_OK) {
1950                 if (inq_buff->data_byte[8] == 0xFF) {
1951                         printk(KERN_WARNING
1952                                "cciss: reading geometry failed, volume "
1953                                "does not support reading geometry\n");
1954                         drv->heads = 255;
1955                         drv->sectors = 32;      // Sectors per track
1956                 } else {
1957                         drv->heads = inq_buff->data_byte[6];
1958                         drv->sectors = inq_buff->data_byte[7];
1959                         drv->cylinders = (inq_buff->data_byte[4] & 0xff) << 8;
1960                         drv->cylinders += inq_buff->data_byte[5];
1961                         drv->raid_level = inq_buff->data_byte[8];
1962                 }
1963                 drv->block_size = block_size;
1964                 drv->nr_blocks = total_size;
1965                 t = drv->heads * drv->sectors;
1966                 if (t > 1) {
1967                         unsigned rem = sector_div(total_size, t);
1968                         if (rem)
1969                                 total_size++;
1970                         drv->cylinders = total_size;
1971                 }
1972         } else {                /* Get geometry failed */
1973                 printk(KERN_WARNING "cciss: reading geometry failed\n");
1974         }
1975         printk(KERN_INFO "      heads=%d, sectors=%d, cylinders=%d\n\n",
1976                drv->heads, drv->sectors, drv->cylinders);
1977 }
1978
1979 static void
1980 cciss_read_capacity(int ctlr, int logvol, int withirq, sector_t *total_size,
1981                     unsigned int *block_size)
1982 {
1983         ReadCapdata_struct *buf;
1984         int return_code;
1985         buf = kmalloc(sizeof(ReadCapdata_struct), GFP_KERNEL);
1986         if (buf == NULL) {
1987                 printk(KERN_WARNING "cciss: out of memory\n");
1988                 return;
1989         }
1990         memset(buf, 0, sizeof(ReadCapdata_struct));
1991         if (withirq)
1992                 return_code = sendcmd_withirq(CCISS_READ_CAPACITY,
1993                                 ctlr, buf, sizeof(ReadCapdata_struct),
1994                                         1, logvol, 0, TYPE_CMD);
1995         else
1996                 return_code = sendcmd(CCISS_READ_CAPACITY,
1997                                 ctlr, buf, sizeof(ReadCapdata_struct),
1998                                         1, logvol, 0, NULL, TYPE_CMD);
1999         if (return_code == IO_OK) {
2000                 *total_size = be32_to_cpu(*(__u32 *) buf->total_size)+1;
2001                 *block_size = be32_to_cpu(*(__u32 *) buf->block_size);
2002         } else {                /* read capacity command failed */
2003                 printk(KERN_WARNING "cciss: read capacity failed\n");
2004                 *total_size = 0;
2005                 *block_size = BLOCK_SIZE;
2006         }
2007         if (*total_size != (__u32) 0)
2008                 printk(KERN_INFO "      blocks= %llu block_size= %d\n",
2009                 (unsigned long long)*total_size, *block_size);
2010         kfree(buf);
2011         return;
2012 }
2013
2014 static void
2015 cciss_read_capacity_16(int ctlr, int logvol, int withirq, sector_t *total_size,                                 unsigned int *block_size)
2016 {
2017         ReadCapdata_struct_16 *buf;
2018         int return_code;
2019         buf = kmalloc(sizeof(ReadCapdata_struct_16), GFP_KERNEL);
2020         if (buf == NULL) {
2021                 printk(KERN_WARNING "cciss: out of memory\n");
2022                 return;
2023         }
2024         memset(buf, 0, sizeof(ReadCapdata_struct_16));
2025         if (withirq) {
2026                 return_code = sendcmd_withirq(CCISS_READ_CAPACITY_16,
2027                         ctlr, buf, sizeof(ReadCapdata_struct_16),
2028                                 1, logvol, 0, TYPE_CMD);
2029         }
2030         else {
2031                 return_code = sendcmd(CCISS_READ_CAPACITY_16,
2032                         ctlr, buf, sizeof(ReadCapdata_struct_16),
2033                                 1, logvol, 0, NULL, TYPE_CMD);
2034         }
2035         if (return_code == IO_OK) {
2036                 *total_size = be64_to_cpu(*(__u64 *) buf->total_size)+1;
2037                 *block_size = be32_to_cpu(*(__u32 *) buf->block_size);
2038         } else {                /* read capacity command failed */
2039                 printk(KERN_WARNING "cciss: read capacity failed\n");
2040                 *total_size = 0;
2041                 *block_size = BLOCK_SIZE;
2042         }
2043         printk(KERN_INFO "      blocks= %llu block_size= %d\n",
2044                (unsigned long long)*total_size, *block_size);
2045         kfree(buf);
2046         return;
2047 }
2048
2049 static int cciss_revalidate(struct gendisk *disk)
2050 {
2051         ctlr_info_t *h = get_host(disk);
2052         drive_info_struct *drv = get_drv(disk);
2053         int logvol;
2054         int FOUND = 0;
2055         unsigned int block_size;
2056         sector_t total_size;
2057         InquiryData_struct *inq_buff = NULL;
2058
2059         for (logvol = 0; logvol < CISS_MAX_LUN; logvol++) {
2060                 if (h->drv[logvol].LunID == drv->LunID) {
2061                         FOUND = 1;
2062                         break;
2063                 }
2064         }
2065
2066         if (!FOUND)
2067                 return 1;
2068
2069         inq_buff = kmalloc(sizeof(InquiryData_struct), GFP_KERNEL);
2070         if (inq_buff == NULL) {
2071                 printk(KERN_WARNING "cciss: out of memory\n");
2072                 return 1;
2073         }
2074         if (h->cciss_read == CCISS_READ_10) {
2075                 cciss_read_capacity(h->ctlr, logvol, 1,
2076                                         &total_size, &block_size);
2077         } else {
2078                 cciss_read_capacity_16(h->ctlr, logvol, 1,
2079                                         &total_size, &block_size);
2080         }
2081         cciss_geometry_inquiry(h->ctlr, logvol, 1, total_size, block_size,
2082                                inq_buff, drv);
2083
2084         blk_queue_hardsect_size(drv->queue, drv->block_size);
2085         set_capacity(disk, drv->nr_blocks);
2086
2087         kfree(inq_buff);
2088         return 0;
2089 }
2090
2091 /*
2092  *   Wait polling for a command to complete.
2093  *   The memory mapped FIFO is polled for the completion.
2094  *   Used only at init time, interrupts from the HBA are disabled.
2095  */
2096 static unsigned long pollcomplete(int ctlr)
2097 {
2098         unsigned long done;
2099         int i;
2100
2101         /* Wait (up to 20 seconds) for a command to complete */
2102
2103         for (i = 20 * HZ; i > 0; i--) {
2104                 done = hba[ctlr]->access.command_completed(hba[ctlr]);
2105                 if (done == FIFO_EMPTY)
2106                         schedule_timeout_uninterruptible(1);
2107                 else
2108                         return done;
2109         }
2110         /* Invalid address to tell caller we ran out of time */
2111         return 1;
2112 }
2113
2114 static int add_sendcmd_reject(__u8 cmd, int ctlr, unsigned long complete)
2115 {
2116         /* We get in here if sendcmd() is polling for completions
2117            and gets some command back that it wasn't expecting --
2118            something other than that which it just sent down.
2119            Ordinarily, that shouldn't happen, but it can happen when
2120            the scsi tape stuff gets into error handling mode, and
2121            starts using sendcmd() to try to abort commands and
2122            reset tape drives.  In that case, sendcmd may pick up
2123            completions of commands that were sent to logical drives
2124            through the block i/o system, or cciss ioctls completing, etc.
2125            In that case, we need to save those completions for later
2126            processing by the interrupt handler.
2127          */
2128
2129 #ifdef CONFIG_CISS_SCSI_TAPE
2130         struct sendcmd_reject_list *srl = &hba[ctlr]->scsi_rejects;
2131
2132         /* If it's not the scsi tape stuff doing error handling, (abort */
2133         /* or reset) then we don't expect anything weird. */
2134         if (cmd != CCISS_RESET_MSG && cmd != CCISS_ABORT_MSG) {
2135 #endif
2136                 printk(KERN_WARNING "cciss cciss%d: SendCmd "
2137                        "Invalid command list address returned! (%lx)\n",
2138                        ctlr, complete);
2139                 /* not much we can do. */
2140 #ifdef CONFIG_CISS_SCSI_TAPE
2141                 return 1;
2142         }
2143
2144         /* We've sent down an abort or reset, but something else
2145            has completed */
2146         if (srl->ncompletions >= (hba[ctlr]->nr_cmds + 2)) {
2147                 /* Uh oh.  No room to save it for later... */
2148                 printk(KERN_WARNING "cciss%d: Sendcmd: Invalid command addr, "
2149                        "reject list overflow, command lost!\n", ctlr);
2150                 return 1;
2151         }
2152         /* Save it for later */
2153         srl->complete[srl->ncompletions] = complete;
2154         srl->ncompletions++;
2155 #endif
2156         return 0;
2157 }
2158
2159 /*
2160  * Send a command to the controller, and wait for it to complete.
2161  * Only used at init time.
2162  */
2163 static int sendcmd(__u8 cmd, int ctlr, void *buff, size_t size, unsigned int use_unit_num,      /* 0: address the controller,
2164                                                                                                    1: address logical volume log_unit,
2165                                                                                                    2: periph device address is scsi3addr */
2166                    unsigned int log_unit,
2167                    __u8 page_code, unsigned char *scsi3addr, int cmd_type)
2168 {
2169         CommandList_struct *c;
2170         int i;
2171         unsigned long complete;
2172         ctlr_info_t *info_p = hba[ctlr];
2173         u64bit buff_dma_handle;
2174         int status, done = 0;
2175
2176         if ((c = cmd_alloc(info_p, 1)) == NULL) {
2177                 printk(KERN_WARNING "cciss: unable to get memory");
2178                 return IO_ERROR;
2179         }
2180         status = fill_cmd(c, cmd, ctlr, buff, size, use_unit_num,
2181                           log_unit, page_code, scsi3addr, cmd_type);
2182         if (status != IO_OK) {
2183                 cmd_free(info_p, c, 1);
2184                 return status;
2185         }
2186       resend_cmd1:
2187         /*
2188          * Disable interrupt
2189          */
2190 #ifdef CCISS_DEBUG
2191         printk(KERN_DEBUG "cciss: turning intr off\n");
2192 #endif                          /* CCISS_DEBUG */
2193         info_p->access.set_intr_mask(info_p, CCISS_INTR_OFF);
2194
2195         /* Make sure there is room in the command FIFO */
2196         /* Actually it should be completely empty at this time */
2197         /* unless we are in here doing error handling for the scsi */
2198         /* tape side of the driver. */
2199         for (i = 200000; i > 0; i--) {
2200                 /* if fifo isn't full go */
2201                 if (!(info_p->access.fifo_full(info_p))) {
2202
2203                         break;
2204                 }
2205                 udelay(10);
2206                 printk(KERN_WARNING "cciss cciss%d: SendCmd FIFO full,"
2207                        " waiting!\n", ctlr);
2208         }
2209         /*
2210          * Send the cmd
2211          */
2212         info_p->access.submit_command(info_p, c);
2213         done = 0;
2214         do {
2215                 complete = pollcomplete(ctlr);
2216
2217 #ifdef CCISS_DEBUG
2218                 printk(KERN_DEBUG "cciss: command completed\n");
2219 #endif                          /* CCISS_DEBUG */
2220
2221                 if (complete == 1) {
2222                         printk(KERN_WARNING
2223                                "cciss cciss%d: SendCmd Timeout out, "
2224                                "No command list address returned!\n", ctlr);
2225                         status = IO_ERROR;
2226                         done = 1;
2227                         break;
2228                 }
2229
2230                 /* This will need to change for direct lookup completions */
2231                 if ((complete & CISS_ERROR_BIT)
2232                     && (complete & ~CISS_ERROR_BIT) == c->busaddr) {
2233                         /* if data overrun or underun on Report command
2234                            ignore it
2235                          */
2236                         if (((c->Request.CDB[0] == CISS_REPORT_LOG) ||
2237                              (c->Request.CDB[0] == CISS_REPORT_PHYS) ||
2238                              (c->Request.CDB[0] == CISS_INQUIRY)) &&
2239                             ((c->err_info->CommandStatus ==
2240                               CMD_DATA_OVERRUN) ||
2241                              (c->err_info->CommandStatus == CMD_DATA_UNDERRUN)
2242                             )) {
2243                                 complete = c->busaddr;
2244                         } else {
2245                                 if (c->err_info->CommandStatus ==
2246                                     CMD_UNSOLICITED_ABORT) {
2247                                         printk(KERN_WARNING "cciss%d: "
2248                                                "unsolicited abort %p\n",
2249                                                ctlr, c);
2250                                         if (c->retry_count < MAX_CMD_RETRIES) {
2251                                                 printk(KERN_WARNING
2252                                                        "cciss%d: retrying %p\n",
2253                                                        ctlr, c);
2254                                                 c->retry_count++;
2255                                                 /* erase the old error */
2256                                                 /* information */
2257                                                 memset(c->err_info, 0,
2258                                                        sizeof
2259                                                        (ErrorInfo_struct));
2260                                                 goto resend_cmd1;
2261                                         } else {
2262                                                 printk(KERN_WARNING
2263                                                        "cciss%d: retried %p too "
2264                                                        "many times\n", ctlr, c);
2265                                                 status = IO_ERROR;
2266                                                 goto cleanup1;
2267                                         }
2268                                 } else if (c->err_info->CommandStatus ==
2269                                            CMD_UNABORTABLE) {
2270                                         printk(KERN_WARNING
2271                                                "cciss%d: command could not be aborted.\n",
2272                                                ctlr);
2273                                         status = IO_ERROR;
2274                                         goto cleanup1;
2275                                 }
2276                                 printk(KERN_WARNING "ciss ciss%d: sendcmd"
2277                                        " Error %x \n", ctlr,
2278                                        c->err_info->CommandStatus);
2279                                 printk(KERN_WARNING "ciss ciss%d: sendcmd"
2280                                        " offensive info\n"
2281                                        "  size %x\n   num %x   value %x\n",
2282                                        ctlr,
2283                                        c->err_info->MoreErrInfo.Invalid_Cmd.
2284                                        offense_size,
2285                                        c->err_info->MoreErrInfo.Invalid_Cmd.
2286                                        offense_num,
2287                                        c->err_info->MoreErrInfo.Invalid_Cmd.
2288                                        offense_value);
2289                                 status = IO_ERROR;
2290                                 goto cleanup1;
2291                         }
2292                 }
2293                 /* This will need changing for direct lookup completions */
2294                 if (complete != c->busaddr) {
2295                         if (add_sendcmd_reject(cmd, ctlr, complete) != 0) {
2296                                 BUG();  /* we are pretty much hosed if we get here. */
2297                         }
2298                         continue;
2299                 } else
2300                         done = 1;
2301         } while (!done);
2302
2303       cleanup1:
2304         /* unlock the data buffer from DMA */
2305         buff_dma_handle.val32.lower = c->SG[0].Addr.lower;
2306         buff_dma_handle.val32.upper = c->SG[0].Addr.upper;
2307         pci_unmap_single(info_p->pdev, (dma_addr_t) buff_dma_handle.val,
2308                          c->SG[0].Len, PCI_DMA_BIDIRECTIONAL);
2309 #ifdef CONFIG_CISS_SCSI_TAPE
2310         /* if we saved some commands for later, process them now. */
2311         if (info_p->scsi_rejects.ncompletions > 0)
2312                 do_cciss_intr(0, info_p);
2313 #endif
2314         cmd_free(info_p, c, 1);
2315         return status;
2316 }
2317
2318 /*
2319  * Map (physical) PCI mem into (virtual) kernel space
2320  */
2321 static void __iomem *remap_pci_mem(ulong base, ulong size)
2322 {
2323         ulong page_base = ((ulong) base) & PAGE_MASK;
2324         ulong page_offs = ((ulong) base) - page_base;
2325         void __iomem *page_remapped = ioremap(page_base, page_offs + size);
2326
2327         return page_remapped ? (page_remapped + page_offs) : NULL;
2328 }
2329
2330 /*
2331  * Takes jobs of the Q and sends them to the hardware, then puts it on
2332  * the Q to wait for completion.
2333  */
2334 static void start_io(ctlr_info_t *h)
2335 {
2336         CommandList_struct *c;
2337
2338         while ((c = h->reqQ) != NULL) {
2339                 /* can't do anything if fifo is full */
2340                 if ((h->access.fifo_full(h))) {
2341                         printk(KERN_WARNING "cciss: fifo full\n");
2342                         break;
2343                 }
2344
2345                 /* Get the first entry from the Request Q */
2346                 removeQ(&(h->reqQ), c);
2347                 h->Qdepth--;
2348
2349                 /* Tell the controller execute command */
2350                 h->access.submit_command(h, c);
2351
2352                 /* Put job onto the completed Q */
2353                 addQ(&(h->cmpQ), c);
2354         }
2355 }
2356
2357 /* Assumes that CCISS_LOCK(h->ctlr) is held. */
2358 /* Zeros out the error record and then resends the command back */
2359 /* to the controller */
2360 static inline void resend_cciss_cmd(ctlr_info_t *h, CommandList_struct *c)
2361 {
2362         /* erase the old error information */
2363         memset(c->err_info, 0, sizeof(ErrorInfo_struct));
2364
2365         /* add it to software queue and then send it to the controller */
2366         addQ(&(h->reqQ), c);
2367         h->Qdepth++;
2368         if (h->Qdepth > h->maxQsinceinit)
2369                 h->maxQsinceinit = h->Qdepth;
2370
2371         start_io(h);
2372 }
2373
2374 /* checks the status of the job and calls complete buffers to mark all
2375  * buffers for the completed job. Note that this function does not need
2376  * to hold the hba/queue lock.
2377  */
2378 static inline void complete_command(ctlr_info_t *h, CommandList_struct *cmd,
2379                                     int timeout)
2380 {
2381         int status = 1;
2382         int retry_cmd = 0;
2383
2384         if (timeout)
2385                 status = 0;
2386
2387         if (cmd->err_info->CommandStatus != 0) {        /* an error has occurred */
2388                 switch (cmd->err_info->CommandStatus) {
2389                         unsigned char sense_key;
2390                 case CMD_TARGET_STATUS:
2391                         status = 0;
2392
2393                         if (cmd->err_info->ScsiStatus == 0x02) {
2394                                 printk(KERN_WARNING "cciss: cmd %p "
2395                                        "has CHECK CONDITION "
2396                                        " byte 2 = 0x%x\n", cmd,
2397                                        cmd->err_info->SenseInfo[2]
2398                                     );
2399                                 /* check the sense key */
2400                                 sense_key = 0xf & cmd->err_info->SenseInfo[2];
2401                                 /* no status or recovered error */
2402                                 if ((sense_key == 0x0) || (sense_key == 0x1)) {
2403                                         status = 1;
2404                                 }
2405                         } else {
2406                                 printk(KERN_WARNING "cciss: cmd %p "
2407                                        "has SCSI Status 0x%x\n",
2408                                        cmd, cmd->err_info->ScsiStatus);
2409                         }
2410                         break;
2411                 case CMD_DATA_UNDERRUN:
2412                         printk(KERN_WARNING "cciss: cmd %p has"
2413                                " completed with data underrun "
2414                                "reported\n", cmd);
2415                         break;
2416                 case CMD_DATA_OVERRUN:
2417                         printk(KERN_WARNING "cciss: cmd %p has"
2418                                " completed with data overrun "
2419                                "reported\n", cmd);
2420                         break;
2421                 case CMD_INVALID:
2422                         printk(KERN_WARNING "cciss: cmd %p is "
2423                                "reported invalid\n", cmd);
2424                         status = 0;
2425                         break;
2426                 case CMD_PROTOCOL_ERR:
2427                         printk(KERN_WARNING "cciss: cmd %p has "
2428                                "protocol error \n", cmd);
2429                         status = 0;
2430                         break;
2431                 case CMD_HARDWARE_ERR:
2432                         printk(KERN_WARNING "cciss: cmd %p had "
2433                                " hardware error\n", cmd);
2434                         status = 0;
2435                         break;
2436                 case CMD_CONNECTION_LOST:
2437                         printk(KERN_WARNING "cciss: cmd %p had "
2438                                "connection lost\n", cmd);
2439                         status = 0;
2440                         break;
2441                 case CMD_ABORTED:
2442                         printk(KERN_WARNING "cciss: cmd %p was "
2443                                "aborted\n", cmd);
2444                         status = 0;
2445                         break;
2446                 case CMD_ABORT_FAILED:
2447                         printk(KERN_WARNING "cciss: cmd %p reports "
2448                                "abort failed\n", cmd);
2449                         status = 0;
2450                         break;
2451                 case CMD_UNSOLICITED_ABORT:
2452                         printk(KERN_WARNING "cciss%d: unsolicited "
2453                                "abort %p\n", h->ctlr, cmd);
2454                         if (cmd->retry_count < MAX_CMD_RETRIES) {
2455                                 retry_cmd = 1;
2456                                 printk(KERN_WARNING
2457                                        "cciss%d: retrying %p\n", h->ctlr, cmd);
2458                                 cmd->retry_count++;
2459                         } else
2460                                 printk(KERN_WARNING
2461                                        "cciss%d: %p retried too "
2462                                        "many times\n", h->ctlr, cmd);
2463                         status = 0;
2464                         break;
2465                 case CMD_TIMEOUT:
2466                         printk(KERN_WARNING "cciss: cmd %p timedout\n", cmd);
2467                         status = 0;
2468                         break;
2469                 default:
2470                         printk(KERN_WARNING "cciss: cmd %p returned "
2471                                "unknown status %x\n", cmd,
2472                                cmd->err_info->CommandStatus);
2473                         status = 0;
2474                 }
2475         }
2476         /* We need to return this command */
2477         if (retry_cmd) {
2478                 resend_cciss_cmd(h, cmd);
2479                 return;
2480         }
2481
2482         cmd->rq->completion_data = cmd;
2483         cmd->rq->errors = status;
2484         blk_add_trace_rq(cmd->rq->q, cmd->rq, BLK_TA_COMPLETE);
2485         blk_complete_request(cmd->rq);
2486 }
2487
2488 /*
2489  * Get a request and submit it to the controller.
2490  */
2491 static void do_cciss_request(request_queue_t *q)
2492 {
2493         ctlr_info_t *h = q->queuedata;
2494         CommandList_struct *c;
2495         sector_t start_blk;
2496         int seg;
2497         struct request *creq;
2498         u64bit temp64;
2499         struct scatterlist tmp_sg[MAXSGENTRIES];
2500         drive_info_struct *drv;
2501         int i, dir;
2502
2503         /* We call start_io here in case there is a command waiting on the
2504          * queue that has not been sent.
2505          */
2506         if (blk_queue_plugged(q))
2507                 goto startio;
2508
2509       queue:
2510         creq = elv_next_request(q);
2511         if (!creq)
2512                 goto startio;
2513
2514         BUG_ON(creq->nr_phys_segments > MAXSGENTRIES);
2515
2516         if ((c = cmd_alloc(h, 1)) == NULL)
2517                 goto full;
2518
2519         blkdev_dequeue_request(creq);
2520
2521         spin_unlock_irq(q->queue_lock);
2522
2523         c->cmd_type = CMD_RWREQ;
2524         c->rq = creq;
2525
2526         /* fill in the request */
2527         drv = creq->rq_disk->private_data;
2528         c->Header.ReplyQueue = 0;       // unused in simple mode
2529         /* got command from pool, so use the command block index instead */
2530         /* for direct lookups. */
2531         /* The first 2 bits are reserved for controller error reporting. */
2532         c->Header.Tag.lower = (c->cmdindex << 3);
2533         c->Header.Tag.lower |= 0x04;    /* flag for direct lookup. */
2534         c->Header.LUN.LogDev.VolId = drv->LunID;
2535         c->Header.LUN.LogDev.Mode = 1;
2536         c->Request.CDBLen = 10; // 12 byte commands not in FW yet;
2537         c->Request.Type.Type = TYPE_CMD;        // It is a command.
2538         c->Request.Type.Attribute = ATTR_SIMPLE;
2539         c->Request.Type.Direction =
2540             (rq_data_dir(creq) == READ) ? h->cciss_read : h->cciss_write;
2541         c->Request.Timeout = 0; // Don't time out
2542         c->Request.CDB[0] =
2543             (rq_data_dir(creq) == READ) ? h->cciss_read : h->cciss_write;
2544         start_blk = creq->sector;
2545 #ifdef CCISS_DEBUG
2546         printk(KERN_DEBUG "ciss: sector =%d nr_sectors=%d\n", (int)creq->sector,
2547                (int)creq->nr_sectors);
2548 #endif                          /* CCISS_DEBUG */
2549
2550         seg = blk_rq_map_sg(q, creq, tmp_sg);
2551
2552         /* get the DMA records for the setup */
2553         if (c->Request.Type.Direction == XFER_READ)
2554                 dir = PCI_DMA_FROMDEVICE;
2555         else
2556                 dir = PCI_DMA_TODEVICE;
2557
2558         for (i = 0; i < seg; i++) {
2559                 c->SG[i].Len = tmp_sg[i].length;
2560                 temp64.val = (__u64) pci_map_page(h->pdev, tmp_sg[i].page,
2561                                                   tmp_sg[i].offset,
2562                                                   tmp_sg[i].length, dir);
2563                 c->SG[i].Addr.lower = temp64.val32.lower;
2564                 c->SG[i].Addr.upper = temp64.val32.upper;
2565                 c->SG[i].Ext = 0;       // we are not chaining
2566         }
2567         /* track how many SG entries we are using */
2568         if (seg > h->maxSG)
2569                 h->maxSG = seg;
2570
2571 #ifdef CCISS_DEBUG
2572         printk(KERN_DEBUG "cciss: Submitting %d sectors in %d segments\n",
2573                creq->nr_sectors, seg);
2574 #endif                          /* CCISS_DEBUG */
2575
2576         c->Header.SGList = c->Header.SGTotal = seg;
2577         if(h->cciss_read == CCISS_READ_10) {
2578                 c->Request.CDB[1] = 0;
2579                 c->Request.CDB[2] = (start_blk >> 24) & 0xff;   //MSB
2580                 c->Request.CDB[3] = (start_blk >> 16) & 0xff;
2581                 c->Request.CDB[4] = (start_blk >> 8) & 0xff;
2582                 c->Request.CDB[5] = start_blk & 0xff;
2583                 c->Request.CDB[6] = 0;  // (sect >> 24) & 0xff; MSB
2584                 c->Request.CDB[7] = (creq->nr_sectors >> 8) & 0xff;
2585                 c->Request.CDB[8] = creq->nr_sectors & 0xff;
2586                 c->Request.CDB[9] = c->Request.CDB[11] = c->Request.CDB[12] = 0;
2587         } else {
2588                 c->Request.CDBLen = 16;
2589                 c->Request.CDB[1]= 0;
2590                 c->Request.CDB[2]= (start_blk >> 56) & 0xff;    //MSB
2591                 c->Request.CDB[3]= (start_blk >> 48) & 0xff;
2592                 c->Request.CDB[4]= (start_blk >> 40) & 0xff;
2593                 c->Request.CDB[5]= (start_blk >> 32) & 0xff;
2594                 c->Request.CDB[6]= (start_blk >> 24) & 0xff;
2595                 c->Request.CDB[7]= (start_blk >> 16) & 0xff;
2596                 c->Request.CDB[8]= (start_blk >>  8) & 0xff;
2597                 c->Request.CDB[9]= start_blk & 0xff;
2598                 c->Request.CDB[10]= (creq->nr_sectors >>  24) & 0xff;
2599                 c->Request.CDB[11]= (creq->nr_sectors >>  16) & 0xff;
2600                 c->Request.CDB[12]= (creq->nr_sectors >>  8) & 0xff;
2601                 c->Request.CDB[13]= creq->nr_sectors & 0xff;
2602                 c->Request.CDB[14] = c->Request.CDB[15] = 0;
2603         }
2604
2605         spin_lock_irq(q->queue_lock);
2606
2607         addQ(&(h->reqQ), c);
2608         h->Qdepth++;
2609         if (h->Qdepth > h->maxQsinceinit)
2610                 h->maxQsinceinit = h->Qdepth;
2611
2612         goto queue;
2613 full:
2614         blk_stop_queue(q);
2615 startio:
2616         /* We will already have the driver lock here so not need
2617          * to lock it.
2618          */
2619         start_io(h);
2620 }
2621
2622 static inline unsigned long get_next_completion(ctlr_info_t *h)
2623 {
2624 #ifdef CONFIG_CISS_SCSI_TAPE
2625         /* Any rejects from sendcmd() lying around? Process them first */
2626         if (h->scsi_rejects.ncompletions == 0)
2627                 return h->access.command_completed(h);
2628         else {
2629                 struct sendcmd_reject_list *srl;
2630                 int n;
2631                 srl = &h->scsi_rejects;
2632                 n = --srl->ncompletions;
2633                 /* printk("cciss%d: processing saved reject\n", h->ctlr); */
2634                 printk("p");
2635                 return srl->complete[n];
2636         }
2637 #else
2638         return h->access.command_completed(h);
2639 #endif
2640 }
2641
2642 static inline int interrupt_pending(ctlr_info_t *h)
2643 {
2644 #ifdef CONFIG_CISS_SCSI_TAPE
2645         return (h->access.intr_pending(h)
2646                 || (h->scsi_rejects.ncompletions > 0));
2647 #else
2648         return h->access.intr_pending(h);
2649 #endif
2650 }
2651
2652 static inline long interrupt_not_for_us(ctlr_info_t *h)
2653 {
2654 #ifdef CONFIG_CISS_SCSI_TAPE
2655         return (((h->access.intr_pending(h) == 0) ||
2656                  (h->interrupts_enabled == 0))
2657                 && (h->scsi_rejects.ncompletions == 0));
2658 #else
2659         return (((h->access.intr_pending(h) == 0) ||
2660                  (h->interrupts_enabled == 0)));
2661 #endif
2662 }
2663
2664 static irqreturn_t do_cciss_intr(int irq, void *dev_id)
2665 {
2666         ctlr_info_t *h = dev_id;
2667         CommandList_struct *c;
2668         unsigned long flags;
2669         __u32 a, a1, a2;
2670
2671         if (interrupt_not_for_us(h))
2672                 return IRQ_NONE;
2673         /*
2674          * If there are completed commands in the completion queue,
2675          * we had better do something about it.
2676          */
2677         spin_lock_irqsave(CCISS_LOCK(h->ctlr), flags);
2678         while (interrupt_pending(h)) {
2679                 while ((a = get_next_completion(h)) != FIFO_EMPTY) {
2680                         a1 = a;
2681                         if ((a & 0x04)) {
2682                                 a2 = (a >> 3);
2683                                 if (a2 >= h->nr_cmds) {
2684                                         printk(KERN_WARNING
2685                                                "cciss: controller cciss%d failed, stopping.\n",
2686                                                h->ctlr);
2687                                         fail_all_cmds(h->ctlr);
2688                                         return IRQ_HANDLED;
2689                                 }
2690
2691                                 c = h->cmd_pool + a2;
2692                                 a = c->busaddr;
2693
2694                         } else {
2695                                 a &= ~3;
2696                                 if ((c = h->cmpQ) == NULL) {
2697                                         printk(KERN_WARNING
2698                                                "cciss: Completion of %08x ignored\n",
2699                                                a1);
2700                                         continue;
2701                                 }
2702                                 while (c->busaddr != a) {
2703                                         c = c->next;
2704                                         if (c == h->cmpQ)
2705                                                 break;
2706                                 }
2707                         }
2708                         /*
2709                          * If we've found the command, take it off the
2710                          * completion Q and free it
2711                          */
2712                         if (c->busaddr == a) {
2713                                 removeQ(&h->cmpQ, c);
2714                                 if (c->cmd_type == CMD_RWREQ) {
2715                                         complete_command(h, c, 0);
2716                                 } else if (c->cmd_type == CMD_IOCTL_PEND) {
2717                                         complete(c->waiting);
2718                                 }
2719 #                               ifdef CONFIG_CISS_SCSI_TAPE
2720                                 else if (c->cmd_type == CMD_SCSI)
2721                                         complete_scsi_command(c, 0, a1);
2722 #                               endif
2723                                 continue;
2724                         }
2725                 }
2726         }
2727
2728         spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
2729         return IRQ_HANDLED;
2730 }
2731
2732 /*
2733  *  We cannot read the structure directly, for portability we must use
2734  *   the io functions.
2735  *   This is for debug only.
2736  */
2737 #ifdef CCISS_DEBUG
2738 static void print_cfg_table(CfgTable_struct *tb)
2739 {
2740         int i;
2741         char temp_name[17];
2742
2743         printk("Controller Configuration information\n");
2744         printk("------------------------------------\n");
2745         for (i = 0; i < 4; i++)
2746                 temp_name[i] = readb(&(tb->Signature[i]));
2747         temp_name[4] = '\0';
2748         printk("   Signature = %s\n", temp_name);
2749         printk("   Spec Number = %d\n", readl(&(tb->SpecValence)));
2750         printk("   Transport methods supported = 0x%x\n",
2751                readl(&(tb->TransportSupport)));
2752         printk("   Transport methods active = 0x%x\n",
2753                readl(&(tb->TransportActive)));
2754         printk("   Requested transport Method = 0x%x\n",
2755                readl(&(tb->HostWrite.TransportRequest)));
2756         printk("   Coalesce Interrupt Delay = 0x%x\n",
2757                readl(&(tb->HostWrite.CoalIntDelay)));
2758         printk("   Coalesce Interrupt Count = 0x%x\n",
2759                readl(&(tb->HostWrite.CoalIntCount)));
2760         printk("   Max outstanding commands = 0x%d\n",
2761                readl(&(tb->CmdsOutMax)));
2762         printk("   Bus Types = 0x%x\n", readl(&(tb->BusTypes)));
2763         for (i = 0; i < 16; i++)
2764                 temp_name[i] = readb(&(tb->ServerName[i]));
2765         temp_name[16] = '\0';
2766         printk("   Server Name = %s\n", temp_name);
2767         printk("   Heartbeat Counter = 0x%x\n\n\n", readl(&(tb->HeartBeat)));
2768 }
2769 #endif                          /* CCISS_DEBUG */
2770
2771 static int find_PCI_BAR_index(struct pci_dev *pdev, unsigned long pci_bar_addr)
2772 {
2773         int i, offset, mem_type, bar_type;
2774         if (pci_bar_addr == PCI_BASE_ADDRESS_0) /* looking for BAR zero? */
2775                 return 0;
2776         offset = 0;
2777         for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
2778                 bar_type = pci_resource_flags(pdev, i) & PCI_BASE_ADDRESS_SPACE;
2779                 if (bar_type == PCI_BASE_ADDRESS_SPACE_IO)
2780                         offset += 4;
2781                 else {
2782                         mem_type = pci_resource_flags(pdev, i) &
2783                             PCI_BASE_ADDRESS_MEM_TYPE_MASK;
2784                         switch (mem_type) {
2785                         case PCI_BASE_ADDRESS_MEM_TYPE_32:
2786                         case PCI_BASE_ADDRESS_MEM_TYPE_1M:
2787                                 offset += 4;    /* 32 bit */
2788                                 break;
2789                         case PCI_BASE_ADDRESS_MEM_TYPE_64:
2790                                 offset += 8;
2791                                 break;
2792                         default:        /* reserved in PCI 2.2 */
2793                                 printk(KERN_WARNING
2794                                        "Base address is invalid\n");
2795                                 return -1;
2796                                 break;
2797                         }
2798                 }
2799                 if (offset == pci_bar_addr - PCI_BASE_ADDRESS_0)
2800                         return i + 1;
2801         }
2802         return -1;
2803 }
2804
2805 /* If MSI/MSI-X is supported by the kernel we will try to enable it on
2806  * controllers that are capable. If not, we use IO-APIC mode.
2807  */
2808
2809 static void __devinit cciss_interrupt_mode(ctlr_info_t *c,
2810                                            struct pci_dev *pdev, __u32 board_id)
2811 {
2812 #ifdef CONFIG_PCI_MSI
2813         int err;
2814         struct msix_entry cciss_msix_entries[4] = { {0, 0}, {0, 1},
2815         {0, 2}, {0, 3}
2816         };
2817
2818         /* Some boards advertise MSI but don't really support it */
2819         if ((board_id == 0x40700E11) ||
2820             (board_id == 0x40800E11) ||
2821             (board_id == 0x40820E11) || (board_id == 0x40830E11))
2822                 goto default_int_mode;
2823
2824         if (pci_find_capability(pdev, PCI_CAP_ID_MSIX)) {
2825                 err = pci_enable_msix(pdev, cciss_msix_entries, 4);
2826                 if (!err) {
2827                         c->intr[0] = cciss_msix_entries[0].vector;
2828                         c->intr[1] = cciss_msix_entries[1].vector;
2829                         c->intr[2] = cciss_msix_entries[2].vector;
2830                         c->intr[3] = cciss_msix_entries[3].vector;
2831                         c->msix_vector = 1;
2832                         return;
2833                 }
2834                 if (err > 0) {
2835                         printk(KERN_WARNING "cciss: only %d MSI-X vectors "
2836                                "available\n", err);
2837                 } else {
2838                         printk(KERN_WARNING "cciss: MSI-X init failed %d\n",
2839                                err);
2840                 }
2841         }
2842         if (pci_find_capability(pdev, PCI_CAP_ID_MSI)) {
2843                 if (!pci_enable_msi(pdev)) {
2844                         c->intr[SIMPLE_MODE_INT] = pdev->irq;
2845                         c->msi_vector = 1;
2846                         return;
2847                 } else {
2848                         printk(KERN_WARNING "cciss: MSI init failed\n");
2849                         c->intr[SIMPLE_MODE_INT] = pdev->irq;
2850                         return;
2851                 }
2852         }
2853       default_int_mode:
2854 #endif                          /* CONFIG_PCI_MSI */
2855         /* if we get here we're going to use the default interrupt mode */
2856         c->intr[SIMPLE_MODE_INT] = pdev->irq;
2857         return;
2858 }
2859
2860 static int cciss_pci_init(ctlr_info_t *c, struct pci_dev *pdev)
2861 {
2862         ushort subsystem_vendor_id, subsystem_device_id, command;
2863         __u32 board_id, scratchpad = 0;
2864         __u64 cfg_offset;
2865         __u32 cfg_base_addr;
2866         __u64 cfg_base_addr_index;
2867         int i, err;
2868
2869         /* check to see if controller has been disabled */
2870         /* BEFORE trying to enable it */
2871         (void)pci_read_config_word(pdev, PCI_COMMAND, &command);
2872         if (!(command & 0x02)) {
2873                 printk(KERN_WARNING
2874                        "cciss: controller appears to be disabled\n");
2875                 return -ENODEV;
2876         }
2877
2878         err = pci_enable_device(pdev);
2879         if (err) {
2880                 printk(KERN_ERR "cciss: Unable to Enable PCI device\n");
2881                 return err;
2882         }
2883
2884         err = pci_request_regions(pdev, "cciss");
2885         if (err) {
2886                 printk(KERN_ERR "cciss: Cannot obtain PCI resources, "
2887                        "aborting\n");
2888                 goto err_out_disable_pdev;
2889         }
2890
2891         subsystem_vendor_id = pdev->subsystem_vendor;
2892         subsystem_device_id = pdev->subsystem_device;
2893         board_id = (((__u32) (subsystem_device_id << 16) & 0xffff0000) |
2894                     subsystem_vendor_id);
2895
2896 #ifdef CCISS_DEBUG
2897         printk("command = %x\n", command);
2898         printk("irq = %x\n", pdev->irq);
2899         printk("board_id = %x\n", board_id);
2900 #endif                          /* CCISS_DEBUG */
2901
2902 /* If the kernel supports MSI/MSI-X we will try to enable that functionality,
2903  * else we use the IO-APIC interrupt assigned to us by system ROM.
2904  */
2905         cciss_interrupt_mode(c, pdev, board_id);
2906
2907         /*
2908          * Memory base addr is first addr , the second points to the config
2909          *   table
2910          */
2911
2912         c->paddr = pci_resource_start(pdev, 0); /* addressing mode bits already removed */
2913 #ifdef CCISS_DEBUG
2914         printk("address 0 = %x\n", c->paddr);
2915 #endif                          /* CCISS_DEBUG */
2916         c->vaddr = remap_pci_mem(c->paddr, 200);
2917
2918         /* Wait for the board to become ready.  (PCI hotplug needs this.)
2919          * We poll for up to 120 secs, once per 100ms. */
2920         for (i = 0; i < 1200; i++) {
2921                 scratchpad = readl(c->vaddr + SA5_SCRATCHPAD_OFFSET);
2922                 if (scratchpad == CCISS_FIRMWARE_READY)
2923                         break;
2924                 set_current_state(TASK_INTERRUPTIBLE);
2925                 schedule_timeout(HZ / 10);      /* wait 100ms */
2926         }
2927         if (scratchpad != CCISS_FIRMWARE_READY) {
2928                 printk(KERN_WARNING "cciss: Board not ready.  Timed out.\n");
2929                 err = -ENODEV;
2930                 goto err_out_free_res;
2931         }
2932
2933         /* get the address index number */
2934         cfg_base_addr = readl(c->vaddr + SA5_CTCFG_OFFSET);
2935         cfg_base_addr &= (__u32) 0x0000ffff;
2936 #ifdef CCISS_DEBUG
2937         printk("cfg base address = %x\n", cfg_base_addr);
2938 #endif                          /* CCISS_DEBUG */
2939         cfg_base_addr_index = find_PCI_BAR_index(pdev, cfg_base_addr);
2940 #ifdef CCISS_DEBUG
2941         printk("cfg base address index = %x\n", cfg_base_addr_index);
2942 #endif                          /* CCISS_DEBUG */
2943         if (cfg_base_addr_index == -1) {
2944                 printk(KERN_WARNING "cciss: Cannot find cfg_base_addr_index\n");
2945                 err = -ENODEV;
2946                 goto err_out_free_res;
2947         }
2948
2949         cfg_offset = readl(c->vaddr + SA5_CTMEM_OFFSET);
2950 #ifdef CCISS_DEBUG
2951         printk("cfg offset = %x\n", cfg_offset);
2952 #endif                          /* CCISS_DEBUG */
2953         c->cfgtable = remap_pci_mem(pci_resource_start(pdev,
2954                                                        cfg_base_addr_index) +
2955                                     cfg_offset, sizeof(CfgTable_struct));
2956         c->board_id = board_id;
2957
2958 #ifdef CCISS_DEBUG
2959         print_cfg_table(c->cfgtable);
2960 #endif                          /* CCISS_DEBUG */
2961
2962         for (i = 0; i < ARRAY_SIZE(products); i++) {
2963                 if (board_id == products[i].board_id) {
2964                         c->product_name = products[i].product_name;
2965                         c->access = *(products[i].access);
2966                         c->nr_cmds = products[i].nr_cmds;
2967                         break;
2968                 }
2969         }
2970         if ((readb(&c->cfgtable->Signature[0]) != 'C') ||
2971             (readb(&c->cfgtable->Signature[1]) != 'I') ||
2972             (readb(&c->cfgtable->Signature[2]) != 'S') ||
2973             (readb(&c->cfgtable->Signature[3]) != 'S')) {
2974                 printk("Does not appear to be a valid CISS config table\n");
2975                 err = -ENODEV;
2976                 goto err_out_free_res;
2977         }
2978         /* We didn't find the controller in our list. We know the
2979          * signature is valid. If it's an HP device let's try to
2980          * bind to the device and fire it up. Otherwise we bail.
2981          */
2982         if (i == ARRAY_SIZE(products)) {
2983                 if (subsystem_vendor_id == PCI_VENDOR_ID_HP) {
2984                         c->product_name = products[i-1].product_name;
2985                         c->access = *(products[i-1].access);
2986                         c->nr_cmds = products[i-1].nr_cmds;
2987                         printk(KERN_WARNING "cciss: This is an unknown "
2988                                 "Smart Array controller.\n"
2989                                 "cciss: Please update to the latest driver "
2990                                 "available from www.hp.com.\n");
2991                 } else {
2992                         printk(KERN_WARNING "cciss: Sorry, I don't know how"
2993                                 " to access the Smart Array controller %08lx\n"
2994                                         , (unsigned long)board_id);
2995                         err = -ENODEV;
2996                         goto err_out_free_res;
2997                 }
2998         }
2999 #ifdef CONFIG_X86
3000         {
3001                 /* Need to enable prefetch in the SCSI core for 6400 in x86 */
3002                 __u32 prefetch;
3003                 prefetch = readl(&(c->cfgtable->SCSI_Prefetch));
3004                 prefetch |= 0x100;
3005                 writel(prefetch, &(c->cfgtable->SCSI_Prefetch));
3006         }
3007 #endif
3008
3009         /* Disabling DMA prefetch for the P600
3010          * An ASIC bug may result in a prefetch beyond
3011          * physical memory.
3012          */
3013         if(board_id == 0x3225103C) {
3014                 __u32 dma_prefetch;
3015                 dma_prefetch = readl(c->vaddr + I2O_DMA1_CFG);
3016                 dma_prefetch |= 0x8000;
3017                 writel(dma_prefetch, c->vaddr + I2O_DMA1_CFG);
3018         }
3019
3020 #ifdef CCISS_DEBUG
3021         printk("Trying to put board into Simple mode\n");
3022 #endif                          /* CCISS_DEBUG */
3023         c->max_commands = readl(&(c->cfgtable->CmdsOutMax));
3024         /* Update the field, and then ring the doorbell */
3025         writel(CFGTBL_Trans_Simple, &(c->cfgtable->HostWrite.TransportRequest));
3026         writel(CFGTBL_ChangeReq, c->vaddr + SA5_DOORBELL);
3027
3028         /* under certain very rare conditions, this can take awhile.
3029          * (e.g.: hot replace a failed 144GB drive in a RAID 5 set right
3030          * as we enter this code.) */
3031         for (i = 0; i < MAX_CONFIG_WAIT; i++) {
3032                 if (!(readl(c->vaddr + SA5_DOORBELL) & CFGTBL_ChangeReq))
3033                         break;
3034                 /* delay and try again */
3035                 set_current_state(TASK_INTERRUPTIBLE);
3036                 schedule_timeout(10);
3037         }
3038
3039 #ifdef CCISS_DEBUG
3040         printk(KERN_DEBUG "I counter got to %d %x\n", i,
3041                readl(c->vaddr + SA5_DOORBELL));
3042 #endif                          /* CCISS_DEBUG */
3043 #ifdef CCISS_DEBUG
3044         print_cfg_table(c->cfgtable);
3045 #endif                          /* CCISS_DEBUG */
3046
3047         if (!(readl(&(c->cfgtable->TransportActive)) & CFGTBL_Trans_Simple)) {
3048                 printk(KERN_WARNING "cciss: unable to get board into"
3049                        " simple mode\n");
3050                 err = -ENODEV;
3051                 goto err_out_free_res;
3052         }
3053         return 0;
3054
3055       err_out_free_res:
3056         pci_release_regions(pdev);
3057
3058       err_out_disable_pdev:
3059         pci_disable_device(pdev);
3060         return err;
3061 }
3062
3063 /*
3064  * Gets information about the local volumes attached to the controller.
3065  */
3066 static void cciss_getgeometry(int cntl_num)
3067 {
3068         ReportLunData_struct *ld_buff;
3069         InquiryData_struct *inq_buff;
3070         int return_code;
3071         int i;
3072         int listlength = 0;
3073         __u32 lunid = 0;
3074         int block_size;
3075         sector_t total_size;
3076
3077         ld_buff = kzalloc(sizeof(ReportLunData_struct), GFP_KERNEL);
3078         if (ld_buff == NULL) {
3079                 printk(KERN_ERR "cciss: out of memory\n");
3080                 return;
3081         }
3082         inq_buff = kmalloc(sizeof(InquiryData_struct), GFP_KERNEL);
3083         if (inq_buff == NULL) {
3084                 printk(KERN_ERR "cciss: out of memory\n");
3085                 kfree(ld_buff);
3086                 return;
3087         }
3088         /* Get the firmware version */
3089         return_code = sendcmd(CISS_INQUIRY, cntl_num, inq_buff,
3090                               sizeof(InquiryData_struct), 0, 0, 0, NULL,
3091                               TYPE_CMD);
3092         if (return_code == IO_OK) {
3093                 hba[cntl_num]->firm_ver[0] = inq_buff->data_byte[32];
3094                 hba[cntl_num]->firm_ver[1] = inq_buff->data_byte[33];
3095                 hba[cntl_num]->firm_ver[2] = inq_buff->data_byte[34];
3096                 hba[cntl_num]->firm_ver[3] = inq_buff->data_byte[35];
3097         } else {                /* send command failed */
3098
3099                 printk(KERN_WARNING "cciss: unable to determine firmware"
3100                        " version of controller\n");
3101         }
3102         /* Get the number of logical volumes */
3103         return_code = sendcmd(CISS_REPORT_LOG, cntl_num, ld_buff,
3104                               sizeof(ReportLunData_struct), 0, 0, 0, NULL,
3105                               TYPE_CMD);
3106
3107         if (return_code == IO_OK) {
3108 #ifdef CCISS_DEBUG
3109                 printk("LUN Data\n--------------------------\n");
3110 #endif                          /* CCISS_DEBUG */
3111
3112                 listlength |=
3113                     (0xff & (unsigned int)(ld_buff->LUNListLength[0])) << 24;
3114                 listlength |=
3115                     (0xff & (unsigned int)(ld_buff->LUNListLength[1])) << 16;
3116                 listlength |=
3117                     (0xff & (unsigned int)(ld_buff->LUNListLength[2])) << 8;
3118                 listlength |= 0xff & (unsigned int)(ld_buff->LUNListLength[3]);
3119         } else {                /* reading number of logical volumes failed */
3120
3121                 printk(KERN_WARNING "cciss: report logical volume"
3122                        " command failed\n");
3123                 listlength = 0;
3124         }
3125         hba[cntl_num]->num_luns = listlength / 8;       // 8 bytes pre entry
3126         if (hba[cntl_num]->num_luns > CISS_MAX_LUN) {
3127                 printk(KERN_ERR
3128                        "ciss:  only %d number of logical volumes supported\n",
3129                        CISS_MAX_LUN);
3130                 hba[cntl_num]->num_luns = CISS_MAX_LUN;
3131         }
3132 #ifdef CCISS_DEBUG
3133         printk(KERN_DEBUG "Length = %x %x %x %x = %d\n",
3134                ld_buff->LUNListLength[0], ld_buff->LUNListLength[1],
3135                ld_buff->LUNListLength[2], ld_buff->LUNListLength[3],
3136                hba[cntl_num]->num_luns);
3137 #endif                          /* CCISS_DEBUG */
3138
3139         hba[cntl_num]->highest_lun = hba[cntl_num]->num_luns - 1;
3140         for (i = 0; i < CISS_MAX_LUN; i++) {
3141                 if (i < hba[cntl_num]->num_luns) {
3142                         lunid = (0xff & (unsigned int)(ld_buff->LUN[i][3]))
3143                             << 24;
3144                         lunid |= (0xff & (unsigned int)(ld_buff->LUN[i][2]))
3145                             << 16;
3146                         lunid |= (0xff & (unsigned int)(ld_buff->LUN[i][1]))
3147                             << 8;
3148                         lunid |= 0xff & (unsigned int)(ld_buff->LUN[i][0]);
3149
3150                         hba[cntl_num]->drv[i].LunID = lunid;
3151
3152 #ifdef CCISS_DEBUG
3153                         printk(KERN_DEBUG "LUN[%d]:  %x %x %x %x = %x\n", i,
3154                                ld_buff->LUN[i][0], ld_buff->LUN[i][1],
3155                                ld_buff->LUN[i][2], ld_buff->LUN[i][3],
3156                                hba[cntl_num]->drv[i].LunID);
3157 #endif                          /* CCISS_DEBUG */
3158
3159                 /* testing to see if 16-byte CDBs are already being used */
3160                 if(hba[cntl_num]->cciss_read == CCISS_READ_16) {
3161                         cciss_read_capacity_16(cntl_num, i, 0,
3162                                             &total_size, &block_size);
3163                         goto geo_inq;
3164                 }
3165                 cciss_read_capacity(cntl_num, i, 0, &total_size, &block_size);
3166
3167                 /* total_size = last LBA + 1 */
3168                 if(total_size == (__u32) 0) {
3169                         cciss_read_capacity_16(cntl_num, i, 0,
3170                         &total_size, &block_size);
3171                         hba[cntl_num]->cciss_read = CCISS_READ_16;
3172                         hba[cntl_num]->cciss_write = CCISS_WRITE_16;
3173                 } else {
3174                         hba[cntl_num]->cciss_read = CCISS_READ_10;
3175                         hba[cntl_num]->cciss_write = CCISS_WRITE_10;
3176                 }
3177 geo_inq:
3178                         cciss_geometry_inquiry(cntl_num, i, 0, total_size,
3179                                                block_size, inq_buff,
3180                                                &hba[cntl_num]->drv[i]);
3181                 } else {
3182                         /* initialize raid_level to indicate a free space */
3183                         hba[cntl_num]->drv[i].raid_level = -1;
3184                 }
3185         }
3186         kfree(ld_buff);
3187         kfree(inq_buff);
3188 }
3189
3190 /* Function to find the first free pointer into our hba[] array */
3191 /* Returns -1 if no free entries are left.  */
3192 static int alloc_cciss_hba(void)
3193 {
3194         struct gendisk *disk[NWD];
3195         int i, n;
3196         for (n = 0; n < NWD; n++) {
3197                 disk[n] = alloc_disk(1 << NWD_SHIFT);
3198                 if (!disk[n])
3199                         goto out;
3200         }
3201
3202         for (i = 0; i < MAX_CTLR; i++) {
3203                 if (!hba[i]) {
3204                         ctlr_info_t *p;
3205                         p = kzalloc(sizeof(ctlr_info_t), GFP_KERNEL);
3206                         if (!p)
3207                                 goto Enomem;
3208                         for (n = 0; n < NWD; n++)
3209                                 p->gendisk[n] = disk[n];
3210                         hba[i] = p;
3211                         return i;
3212                 }
3213         }
3214         printk(KERN_WARNING "cciss: This driver supports a maximum"
3215                " of %d controllers.\n", MAX_CTLR);
3216         goto out;
3217       Enomem:
3218         printk(KERN_ERR "cciss: out of memory.\n");
3219       out:
3220         while (n--)
3221                 put_disk(disk[n]);
3222         return -1;
3223 }
3224
3225 static void free_hba(int i)
3226 {
3227         ctlr_info_t *p = hba[i];
3228         int n;
3229
3230         hba[i] = NULL;
3231         for (n = 0; n < NWD; n++)
3232                 put_disk(p->gendisk[n]);
3233         kfree(p);
3234 }
3235
3236 /*
3237  *  This is it.  Find all the controllers and register them.  I really hate
3238  *  stealing all these major device numbers.
3239  *  returns the number of block devices registered.
3240  */
3241 static int __devinit cciss_init_one(struct pci_dev *pdev,
3242                                     const struct pci_device_id *ent)
3243 {
3244         request_queue_t *q;
3245         int i;
3246         int j;
3247         int rc;
3248         int dac;
3249
3250         i = alloc_cciss_hba();
3251         if (i < 0)
3252                 return -1;
3253
3254         hba[i]->busy_initializing = 1;
3255
3256         if (cciss_pci_init(hba[i], pdev) != 0)
3257                 goto clean1;
3258
3259         sprintf(hba[i]->devname, "cciss%d", i);
3260         hba[i]->ctlr = i;
3261         hba[i]->pdev = pdev;
3262
3263         /* configure PCI DMA stuff */
3264         if (!pci_set_dma_mask(pdev, DMA_64BIT_MASK))
3265                 dac = 1;
3266         else if (!pci_set_dma_mask(pdev, DMA_32BIT_MASK))
3267                 dac = 0;
3268         else {
3269                 printk(KERN_ERR "cciss: no suitable DMA available\n");
3270                 goto clean1;
3271         }
3272
3273         /*
3274          * register with the major number, or get a dynamic major number
3275          * by passing 0 as argument.  This is done for greater than
3276          * 8 controller support.
3277          */
3278         if (i < MAX_CTLR_ORIG)
3279                 hba[i]->major = COMPAQ_CISS_MAJOR + i;
3280         rc = register_blkdev(hba[i]->major, hba[i]->devname);
3281         if (rc == -EBUSY || rc == -EINVAL) {
3282                 printk(KERN_ERR
3283                        "cciss:  Unable to get major number %d for %s "
3284                        "on hba %d\n", hba[i]->major, hba[i]->devname, i);
3285                 goto clean1;
3286         } else {
3287                 if (i >= MAX_CTLR_ORIG)
3288                         hba[i]->major = rc;
3289         }
3290
3291         /* make sure the board interrupts are off */
3292         hba[i]->access.set_intr_mask(hba[i], CCISS_INTR_OFF);
3293         if (request_irq(hba[i]->intr[SIMPLE_MODE_INT], do_cciss_intr,
3294                         IRQF_DISABLED | IRQF_SHARED, hba[i]->devname, hba[i])) {
3295                 printk(KERN_ERR "cciss: Unable to get irq %d for %s\n",
3296                        hba[i]->intr[SIMPLE_MODE_INT], hba[i]->devname);
3297                 goto clean2;
3298         }
3299
3300         printk(KERN_INFO "%s: <0x%x> at PCI %s IRQ %d%s using DAC\n",
3301                hba[i]->devname, pdev->device, pci_name(pdev),
3302                hba[i]->intr[SIMPLE_MODE_INT], dac ? "" : " not");
3303
3304         hba[i]->cmd_pool_bits =
3305             kmalloc(((hba[i]->nr_cmds + BITS_PER_LONG -
3306                       1) / BITS_PER_LONG) * sizeof(unsigned long), GFP_KERNEL);
3307         hba[i]->cmd_pool = (CommandList_struct *)
3308             pci_alloc_consistent(hba[i]->pdev,
3309                     hba[i]->nr_cmds * sizeof(CommandList_struct),
3310                     &(hba[i]->cmd_pool_dhandle));
3311         hba[i]->errinfo_pool = (ErrorInfo_struct *)
3312             pci_alloc_consistent(hba[i]->pdev,
3313                     hba[i]->nr_cmds * sizeof(ErrorInfo_struct),
3314                     &(hba[i]->errinfo_pool_dhandle));
3315         if ((hba[i]->cmd_pool_bits == NULL)
3316             || (hba[i]->cmd_pool == NULL)
3317             || (hba[i]->errinfo_pool == NULL)) {
3318                 printk(KERN_ERR "cciss: out of memory");
3319                 goto clean4;
3320         }
3321 #ifdef CONFIG_CISS_SCSI_TAPE
3322         hba[i]->scsi_rejects.complete =
3323             kmalloc(sizeof(hba[i]->scsi_rejects.complete[0]) *
3324                     (hba[i]->nr_cmds + 5), GFP_KERNEL);
3325         if (hba[i]->scsi_rejects.complete == NULL) {
3326                 printk(KERN_ERR "cciss: out of memory");
3327                 goto clean4;
3328         }
3329 #endif
3330         spin_lock_init(&hba[i]->lock);
3331
3332         /* Initialize the pdev driver private data.
3333            have it point to hba[i].  */
3334         pci_set_drvdata(pdev, hba[i]);
3335         /* command and error info recs zeroed out before
3336            they are used */
3337         memset(hba[i]->cmd_pool_bits, 0,
3338                ((hba[i]->nr_cmds + BITS_PER_LONG -
3339                  1) / BITS_PER_LONG) * sizeof(unsigned long));
3340
3341 #ifdef CCISS_DEBUG
3342         printk(KERN_DEBUG "Scanning for drives on controller cciss%d\n", i);
3343 #endif                          /* CCISS_DEBUG */
3344
3345         cciss_getgeometry(i);
3346
3347         cciss_scsi_setup(i);
3348
3349         /* Turn the interrupts on so we can service requests */
3350         hba[i]->access.set_intr_mask(hba[i], CCISS_INTR_ON);
3351
3352         cciss_procinit(i);
3353
3354         hba[i]->cciss_max_sectors = 2048;
3355
3356         hba[i]->busy_initializing = 0;
3357
3358         for (j = 0; j < NWD; j++) {     /* mfm */
3359                 drive_info_struct *drv = &(hba[i]->drv[j]);
3360                 struct gendisk *disk = hba[i]->gendisk[j];
3361
3362                 q = blk_init_queue(do_cciss_request, &hba[i]->lock);
3363                 if (!q) {
3364                         printk(KERN_ERR
3365                                "cciss:  unable to allocate queue for disk %d\n",
3366                                j);
3367                         break;
3368                 }
3369                 drv->queue = q;
3370
3371                 q->backing_dev_info.ra_pages = READ_AHEAD;
3372                 blk_queue_bounce_limit(q, hba[i]->pdev->dma_mask);
3373
3374                 /* This is a hardware imposed limit. */
3375                 blk_queue_max_hw_segments(q, MAXSGENTRIES);
3376
3377                 /* This is a limit in the driver and could be eliminated. */
3378                 blk_queue_max_phys_segments(q, MAXSGENTRIES);
3379
3380                 blk_queue_max_sectors(q, hba[i]->cciss_max_sectors);
3381
3382                 blk_queue_softirq_done(q, cciss_softirq_done);
3383
3384                 q->queuedata = hba[i];
3385                 sprintf(disk->disk_name, "cciss/c%dd%d", i, j);
3386                 disk->major = hba[i]->major;
3387                 disk->first_minor = j << NWD_SHIFT;
3388                 disk->fops = &cciss_fops;
3389                 disk->queue = q;
3390                 disk->private_data = drv;
3391                 disk->driverfs_dev = &pdev->dev;
3392                 /* we must register the controller even if no disks exist */
3393                 /* this is for the online array utilities */
3394                 if (!drv->heads && j)
3395                         continue;
3396                 blk_queue_hardsect_size(q, drv->block_size);
3397                 set_capacity(disk, drv->nr_blocks);
3398                 add_disk(disk);
3399         }
3400
3401         return 1;
3402
3403       clean4:
3404 #ifdef CONFIG_CISS_SCSI_TAPE
3405         kfree(hba[i]->scsi_rejects.complete);
3406 #endif
3407         kfree(hba[i]->cmd_pool_bits);
3408         if (hba[i]->cmd_pool)
3409                 pci_free_consistent(hba[i]->pdev,
3410                                     hba[i]->nr_cmds * sizeof(CommandList_struct),
3411                                     hba[i]->cmd_pool, hba[i]->cmd_pool_dhandle);
3412         if (hba[i]->errinfo_pool)
3413                 pci_free_consistent(hba[i]->pdev,
3414                                     hba[i]->nr_cmds * sizeof(ErrorInfo_struct),
3415                                     hba[i]->errinfo_pool,
3416                                     hba[i]->errinfo_pool_dhandle);
3417         free_irq(hba[i]->intr[SIMPLE_MODE_INT], hba[i]);
3418       clean2:
3419         unregister_blkdev(hba[i]->major, hba[i]->devname);
3420       clean1:
3421         hba[i]->busy_initializing = 0;
3422         free_hba(i);
3423         return -1;
3424 }
3425
3426 static void __devexit cciss_remove_one(struct pci_dev *pdev)
3427 {
3428         ctlr_info_t *tmp_ptr;
3429         int i, j;
3430         char flush_buf[4];
3431         int return_code;
3432
3433         if (pci_get_drvdata(pdev) == NULL) {
3434                 printk(KERN_ERR "cciss: Unable to remove device \n");
3435                 return;
3436         }
3437         tmp_ptr = pci_get_drvdata(pdev);
3438         i = tmp_ptr->ctlr;
3439         if (hba[i] == NULL) {
3440                 printk(KERN_ERR "cciss: device appears to "
3441                        "already be removed \n");
3442                 return;
3443         }
3444         /* Turn board interrupts off  and send the flush cache command */
3445         /* sendcmd will turn off interrupt, and send the flush...
3446          * To write all data in the battery backed cache to disks */
3447         memset(flush_buf, 0, 4);
3448         return_code = sendcmd(CCISS_CACHE_FLUSH, i, flush_buf, 4, 0, 0, 0, NULL,
3449                               TYPE_CMD);
3450         if (return_code != IO_OK) {
3451                 printk(KERN_WARNING "Error Flushing cache on controller %d\n",
3452                        i);
3453         }
3454         free_irq(hba[i]->intr[2], hba[i]);
3455
3456 #ifdef CONFIG_PCI_MSI
3457         if (hba[i]->msix_vector)
3458                 pci_disable_msix(hba[i]->pdev);
3459         else if (hba[i]->msi_vector)
3460                 pci_disable_msi(hba[i]->pdev);
3461 #endif                          /* CONFIG_PCI_MSI */
3462
3463         iounmap(hba[i]->vaddr);
3464         cciss_unregister_scsi(i);       /* unhook from SCSI subsystem */
3465         unregister_blkdev(hba[i]->major, hba[i]->devname);
3466         remove_proc_entry(hba[i]->devname, proc_cciss);
3467
3468         /* remove it from the disk list */
3469         for (j = 0; j < NWD; j++) {
3470                 struct gendisk *disk = hba[i]->gendisk[j];
3471                 if (disk) {
3472                         request_queue_t *q = disk->queue;
3473
3474                         if (disk->flags & GENHD_FL_UP)
3475                                 del_gendisk(disk);
3476                         if (q)
3477                                 blk_cleanup_queue(q);
3478                 }
3479         }
3480
3481         pci_free_consistent(hba[i]->pdev, hba[i]->nr_cmds * sizeof(CommandList_struct),
3482                             hba[i]->cmd_pool, hba[i]->cmd_pool_dhandle);
3483         pci_free_consistent(hba[i]->pdev, hba[i]->nr_cmds * sizeof(ErrorInfo_struct),
3484                             hba[i]->errinfo_pool, hba[i]->errinfo_pool_dhandle);
3485         kfree(hba[i]->cmd_pool_bits);
3486 #ifdef CONFIG_CISS_SCSI_TAPE
3487         kfree(hba[i]->scsi_rejects.complete);
3488 #endif
3489         pci_release_regions(pdev);
3490         pci_disable_device(pdev);
3491         pci_set_drvdata(pdev, NULL);
3492         free_hba(i);
3493 }
3494
3495 static struct pci_driver cciss_pci_driver = {
3496         .name = "cciss",
3497         .probe = cciss_init_one,
3498         .remove = __devexit_p(cciss_remove_one),
3499         .id_table = cciss_pci_device_id,        /* id_table */
3500 };
3501
3502 /*
3503  *  This is it.  Register the PCI driver information for the cards we control
3504  *  the OS will call our registered routines when it finds one of our cards.
3505  */
3506 static int __init cciss_init(void)
3507 {
3508         printk(KERN_INFO DRIVER_NAME "\n");
3509
3510         /* Register for our PCI devices */
3511         return pci_register_driver(&cciss_pci_driver);
3512 }
3513
3514 static void __exit cciss_cleanup(void)
3515 {
3516         int i;
3517
3518         pci_unregister_driver(&cciss_pci_driver);
3519         /* double check that all controller entrys have been removed */
3520         for (i = 0; i < MAX_CTLR; i++) {
3521                 if (hba[i] != NULL) {
3522                         printk(KERN_WARNING "cciss: had to remove"
3523                                " controller %d\n", i);
3524                         cciss_remove_one(hba[i]->pdev);
3525                 }
3526         }
3527         remove_proc_entry("cciss", proc_root_driver);
3528 }
3529
3530 static void fail_all_cmds(unsigned long ctlr)
3531 {
3532         /* If we get here, the board is apparently dead. */
3533         ctlr_info_t *h = hba[ctlr];
3534         CommandList_struct *c;
3535         unsigned long flags;
3536
3537         printk(KERN_WARNING "cciss%d: controller not responding.\n", h->ctlr);
3538         h->alive = 0;           /* the controller apparently died... */
3539
3540         spin_lock_irqsave(CCISS_LOCK(ctlr), flags);
3541
3542         pci_disable_device(h->pdev);    /* Make sure it is really dead. */
3543
3544         /* move everything off the request queue onto the completed queue */
3545         while ((c = h->reqQ) != NULL) {
3546                 removeQ(&(h->reqQ), c);
3547                 h->Qdepth--;
3548                 addQ(&(h->cmpQ), c);
3549         }
3550
3551         /* Now, fail everything on the completed queue with a HW error */
3552         while ((c = h->cmpQ) != NULL) {
3553                 removeQ(&h->cmpQ, c);
3554                 c->err_info->CommandStatus = CMD_HARDWARE_ERR;
3555                 if (c->cmd_type == CMD_RWREQ) {
3556                         complete_command(h, c, 0);
3557                 } else if (c->cmd_type == CMD_IOCTL_PEND)
3558                         complete(c->waiting);
3559 #ifdef CONFIG_CISS_SCSI_TAPE
3560                 else if (c->cmd_type == CMD_SCSI)
3561                         complete_scsi_command(c, 0, 0);
3562 #endif
3563         }
3564         spin_unlock_irqrestore(CCISS_LOCK(ctlr), flags);
3565         return;
3566 }
3567
3568 module_init(cciss_init);
3569 module_exit(cciss_cleanup);