/*
 *  linux/drivers/message/fusion/mptctl.c
 *      mpt Ioctl driver.
 *      For use with LSI PCI chip/adapters
 *      running LSI Fusion MPT (Message Passing Technology) firmware.
 *
 *  Copyright (c) 1999-2008 LSI Corporation
 *  (mailto:DL-MPTFusionLinux@lsi.com)
 *
 */
/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
/*
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; version 2 of the License.

    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.

    NO WARRANTY
    THE PROGRAM IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OR
    CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED INCLUDING, WITHOUT
    LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT,
    MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each Recipient is
    solely responsible for determining the appropriateness of using and
    distributing the Program and assumes all risks associated with its
    exercise of rights under this Agreement, including but not limited to
    the risks and costs of program errors, damage to or loss of data,
    programs or equipment, and unavailability or interruption of operations.

    DISCLAIMER OF LIABILITY
    NEITHER RECIPIENT NOR ANY CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY
    DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
    DAMAGES (INCLUDING WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND
    ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
    TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
    USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS GRANTED
    HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES

    You should have received a copy of the GNU General Public License
    along with this program; if not, write to the Free Software
    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
*/
/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/

#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/errno.h>
#include <linux/init.h>
#include <linux/slab.h>
#include <linux/types.h>
#include <linux/pci.h>
#include <linux/delay.h>        /* for mdelay */
#include <linux/miscdevice.h>
#include <linux/smp_lock.h>
#include <linux/compat.h>

#include <asm/io.h>
#include <asm/uaccess.h>

#include <scsi/scsi.h>
#include <scsi/scsi_cmnd.h>
#include <scsi/scsi_device.h>
#include <scsi/scsi_host.h>
#include <scsi/scsi_tcq.h>

#define COPYRIGHT       "Copyright (c) 1999-2008 LSI Corporation"
#define MODULEAUTHOR    "LSI Corporation"
#include "mptbase.h"
#include "mptctl.h"

/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
#define my_NAME         "Fusion MPT misc device (ioctl) driver"
#define my_VERSION      MPT_LINUX_VERSION_COMMON
#define MYNAM           "mptctl"

MODULE_AUTHOR(MODULEAUTHOR);
MODULE_DESCRIPTION(my_NAME);
MODULE_LICENSE("GPL");
MODULE_VERSION(my_VERSION);

/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/

static u8 mptctl_id = MPT_MAX_PROTOCOL_DRIVERS;

static DECLARE_WAIT_QUEUE_HEAD ( mptctl_wait );

/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/

struct buflist {
        u8      *kptr;
        int      len;
};

/*
 * Function prototypes. Called from OS entry point mptctl_ioctl.
 * arg contents specific to function.
 */
static int mptctl_fw_download(unsigned long arg);
static int mptctl_getiocinfo(unsigned long arg, unsigned int cmd);
static int mptctl_gettargetinfo(unsigned long arg);
static int mptctl_readtest(unsigned long arg);
static int mptctl_mpt_command(unsigned long arg);
static int mptctl_eventquery(unsigned long arg);
static int mptctl_eventenable(unsigned long arg);
static int mptctl_eventreport(unsigned long arg);
static int mptctl_replace_fw(unsigned long arg);

static int mptctl_do_reset(unsigned long arg);
static int mptctl_hp_hostinfo(unsigned long arg, unsigned int cmd);
static int mptctl_hp_targetinfo(unsigned long arg);

static int  mptctl_probe(struct pci_dev *, const struct pci_device_id *);
static void mptctl_remove(struct pci_dev *);

#ifdef CONFIG_COMPAT
static long compat_mpctl_ioctl(struct file *f, unsigned cmd, unsigned long arg);
#endif
/*
 * Private function calls.
 */
static int mptctl_do_mpt_command(struct mpt_ioctl_command karg, void __user *mfPtr);
static int mptctl_do_fw_download(int ioc, char __user *ufwbuf, size_t fwlen);
static MptSge_t *kbuf_alloc_2_sgl(int bytes, u32 dir, int sge_offset, int *frags,
                struct buflist **blp, dma_addr_t *sglbuf_dma, MPT_ADAPTER *ioc);
static void kfree_sgl(MptSge_t *sgl, dma_addr_t sgl_dma,
                struct buflist *buflist, MPT_ADAPTER *ioc);
static void mptctl_timeout_expired (MPT_IOCTL *ioctl);
static int  mptctl_bus_reset(MPT_IOCTL *ioctl);
static int mptctl_set_tm_flags(MPT_SCSI_HOST *hd);
static void mptctl_free_tm_flags(MPT_ADAPTER *ioc);

/*
 * Reset Handler cleanup function
 */
static int  mptctl_ioc_reset(MPT_ADAPTER *ioc, int reset_phase);

/*
 * Event Handler function
 */
static int mptctl_event_process(MPT_ADAPTER *ioc, EventNotificationReply_t *pEvReply);
static struct fasync_struct *async_queue=NULL;

/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
/*
 * Scatter gather list (SGL) sizes and limits...
 */
//#define MAX_SCSI_FRAGS        9
#define MAX_FRAGS_SPILL1        9
#define MAX_FRAGS_SPILL2        15
#define FRAGS_PER_BUCKET        (MAX_FRAGS_SPILL2 + 1)

//#define MAX_CHAIN_FRAGS       64
//#define MAX_CHAIN_FRAGS       (15+15+15+16)
#define MAX_CHAIN_FRAGS         (4 * MAX_FRAGS_SPILL2 + 1)

//  Define max sg LIST bytes ( == (#frags + #chains) * 8 bytes each)
//  Works out to: 592d bytes!     (9+1)*8 + 4*(15+1)*8
//                  ^----------------- 80 + 512
#define MAX_SGL_BYTES           ((MAX_FRAGS_SPILL1 + 1 + (4 * FRAGS_PER_BUCKET)) * 8)

/* linux only seems to ever give 128kB MAX contiguous (GFP_USER) mem bytes */
#define MAX_KMALLOC_SZ          (128*1024)

#define MPT_IOCTL_DEFAULT_TIMEOUT 10    /* Default timeout value (seconds) */

/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
/**
 *      mptctl_syscall_down - Down the MPT adapter syscall semaphore.
 *      @ioc: Pointer to MPT adapter
 *      @nonblock: boolean, non-zero if O_NONBLOCK is set
 *
 *      All of the ioctl commands can potentially sleep, which is illegal
 *      with a spinlock held, thus we perform mutual exclusion here.
 *
 *      Returns negative errno on error, or zero for success.
 */
static inline int
mptctl_syscall_down(MPT_ADAPTER *ioc, int nonblock)
{
        int rc = 0;

        if (nonblock) {
                if (!mutex_trylock(&ioc->ioctl->ioctl_mutex))
                        rc = -EAGAIN;
        } else {
                if (mutex_lock_interruptible(&ioc->ioctl->ioctl_mutex))
                        rc = -ERESTARTSYS;
        }
        return rc;
}

/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
/*
 *  This is the callback for any message we have posted. The message itself
 *  will be returned to the message pool when we return from the IRQ
 *
 *  This runs in irq context so be short and sweet.
 */
static int
mptctl_reply(MPT_ADAPTER *ioc, MPT_FRAME_HDR *req, MPT_FRAME_HDR *reply)
{
        char *sense_data;
        int sz, req_index;
        u16 iocStatus;
        u8 cmd;

        if (req)
                 cmd = req->u.hdr.Function;
        else
                return 1;
        dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "\tcompleting mpi function (0x%02X), req=%p, "
            "reply=%p\n", ioc->name,  req->u.hdr.Function, req, reply));

        if (ioc->ioctl) {

                if (reply==NULL) {

                        dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_reply() NULL Reply "
                                "Function=%x!\n", ioc->name, cmd));

                        ioc->ioctl->status |= MPT_IOCTL_STATUS_COMMAND_GOOD;
                        ioc->ioctl->reset &= ~MPTCTL_RESET_OK;

                        /* We are done, issue wake up
                        */
                        ioc->ioctl->wait_done = 1;
                        wake_up (&mptctl_wait);
                        return 1;

                }

                /* Copy the reply frame (which much exist
                 * for non-SCSI I/O) to the IOC structure.
                 */
                memcpy(ioc->ioctl->ReplyFrame, reply,
                        min(ioc->reply_sz, 4*reply->u.reply.MsgLength));
                ioc->ioctl->status |= MPT_IOCTL_STATUS_RF_VALID;

                /* Set the command status to GOOD if IOC Status is GOOD
                 * OR if SCSI I/O cmd and data underrun or recovered error.
                 */
                iocStatus = le16_to_cpu(reply->u.reply.IOCStatus) & MPI_IOCSTATUS_MASK;
                if (iocStatus  == MPI_IOCSTATUS_SUCCESS)
                        ioc->ioctl->status |= MPT_IOCTL_STATUS_COMMAND_GOOD;

                if (iocStatus || reply->u.reply.IOCLogInfo)
                        dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "\tiocstatus (0x%04X), "
                                "loginfo (0x%08X)\n", ioc->name,
                                iocStatus,
                                le32_to_cpu(reply->u.reply.IOCLogInfo)));

                if ((cmd == MPI_FUNCTION_SCSI_IO_REQUEST) ||
                        (cmd == MPI_FUNCTION_RAID_SCSI_IO_PASSTHROUGH)) {

                        if (reply->u.sreply.SCSIStatus || reply->u.sreply.SCSIState)
                                dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT
                                        "\tscsi_status (0x%02x), scsi_state (0x%02x), "
                                        "tag = (0x%04x), transfer_count (0x%08x)\n", ioc->name,
                                        reply->u.sreply.SCSIStatus,
                                        reply->u.sreply.SCSIState,
                                        le16_to_cpu(reply->u.sreply.TaskTag),
                                        le32_to_cpu(reply->u.sreply.TransferCount)));

                        ioc->ioctl->reset &= ~MPTCTL_RESET_OK;

                        if ((iocStatus == MPI_IOCSTATUS_SCSI_DATA_UNDERRUN) ||
                        (iocStatus == MPI_IOCSTATUS_SCSI_RECOVERED_ERROR)) {
                        ioc->ioctl->status |= MPT_IOCTL_STATUS_COMMAND_GOOD;
                        }
                }

                /* Copy the sense data - if present
                 */
                if ((cmd == MPI_FUNCTION_SCSI_IO_REQUEST) &&
                        (reply->u.sreply.SCSIState &
                         MPI_SCSI_STATE_AUTOSENSE_VALID)){
                        sz = req->u.scsireq.SenseBufferLength;
                        req_index =
                            le16_to_cpu(req->u.frame.hwhdr.msgctxu.fld.req_idx);
                        sense_data =
                            ((u8 *)ioc->sense_buf_pool +
                             (req_index * MPT_SENSE_BUFFER_ALLOC));
                        memcpy(ioc->ioctl->sense, sense_data, sz);
                        ioc->ioctl->status |= MPT_IOCTL_STATUS_SENSE_VALID;
                }

                if (cmd == MPI_FUNCTION_SCSI_TASK_MGMT)
                        mptctl_free_tm_flags(ioc);

                /* We are done, issue wake up
                 */
                ioc->ioctl->wait_done = 1;
                wake_up (&mptctl_wait);
        }
        return 1;
}

/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
/* mptctl_timeout_expired
 *
 * Expecting an interrupt, however timed out.
 *
 */
static void mptctl_timeout_expired (MPT_IOCTL *ioctl)
{
        int rc = 1;

        dctlprintk(ioctl->ioc, printk(MYIOC_s_DEBUG_FMT ": Timeout Expired! Host %d\n",
                                ioctl->ioc->name, ioctl->ioc->id));
        if (ioctl == NULL)
                return;

        ioctl->wait_done = 0;
        if (ioctl->reset & MPTCTL_RESET_OK)
                rc = mptctl_bus_reset(ioctl);

        if (rc) {
                /* Issue a reset for this device.
                 * The IOC is not responding.
                 */
                dctlprintk(ioctl->ioc, printk(MYIOC_s_DEBUG_FMT "Calling HardReset! \n",
                         ioctl->ioc->name));
                mpt_HardResetHandler(ioctl->ioc, CAN_SLEEP);
        }
        return;

}

/* mptctl_bus_reset
 *
 * Bus reset code.
 *
 */
static int mptctl_bus_reset(MPT_IOCTL *ioctl)
{
        MPT_FRAME_HDR   *mf;
        SCSITaskMgmt_t  *pScsiTm;
        MPT_SCSI_HOST   *hd;
        int              ii;
        int              retval=0;


        ioctl->reset &= ~MPTCTL_RESET_OK;

        if (ioctl->ioc->sh == NULL)
                return -EPERM;

        hd = shost_priv(ioctl->ioc->sh);
        if (hd == NULL)
                return -EPERM;

        /* Single threading ....
         */
        if (mptctl_set_tm_flags(hd) != 0)
                return -EPERM;

        /* Send request
         */
        if ((mf = mpt_get_msg_frame(mptctl_id, ioctl->ioc)) == NULL) {
                dtmprintk(ioctl->ioc, printk(MYIOC_s_DEBUG_FMT "IssueTaskMgmt, no msg frames!!\n",
                                ioctl->ioc->name));

                mptctl_free_tm_flags(ioctl->ioc);
                return -ENOMEM;
        }

        dtmprintk(ioctl->ioc, printk(MYIOC_s_DEBUG_FMT "IssueTaskMgmt request @ %p\n",
                        ioctl->ioc->name, mf));

        pScsiTm = (SCSITaskMgmt_t *) mf;
        pScsiTm->TargetID = ioctl->id;
        pScsiTm->Bus = hd->port;        /* 0 */
        pScsiTm->ChainOffset = 0;
        pScsiTm->Function = MPI_FUNCTION_SCSI_TASK_MGMT;
        pScsiTm->Reserved = 0;
        pScsiTm->TaskType = MPI_SCSITASKMGMT_TASKTYPE_RESET_BUS;
        pScsiTm->Reserved1 = 0;
        pScsiTm->MsgFlags = MPI_SCSITASKMGMT_MSGFLAGS_LIPRESET_RESET_OPTION;

        for (ii= 0; ii < 8; ii++)
                pScsiTm->LUN[ii] = 0;

        for (ii=0; ii < 7; ii++)
                pScsiTm->Reserved2[ii] = 0;

        pScsiTm->TaskMsgContext = 0;
        dtmprintk(ioctl->ioc, printk(MYIOC_s_DEBUG_FMT
                "mptctl_bus_reset: issued.\n", ioctl->ioc->name));

        DBG_DUMP_TM_REQUEST_FRAME(ioctl->ioc, (u32 *)mf);

        ioctl->wait_done=0;

        if ((ioctl->ioc->facts.IOCCapabilities & MPI_IOCFACTS_CAPABILITY_HIGH_PRI_Q) &&
            (ioctl->ioc->facts.MsgVersion >= MPI_VERSION_01_05))
                mpt_put_msg_frame_hi_pri(mptctl_id, ioctl->ioc, mf);
        else {
                retval = mpt_send_handshake_request(mptctl_id, ioctl->ioc,
                        sizeof(SCSITaskMgmt_t), (u32*)pScsiTm, CAN_SLEEP);
                if (retval != 0) {
                        dfailprintk(ioctl->ioc, printk(MYIOC_s_ERR_FMT "_send_handshake FAILED!"
                                " (hd %p, ioc %p, mf %p) \n", hd->ioc->name, hd,
                                hd->ioc, mf));
                        goto mptctl_bus_reset_done;
                }
        }

        /* Now wait for the command to complete */
        ii = wait_event_timeout(mptctl_wait,
             ioctl->wait_done == 1,
             HZ*5 /* 5 second timeout */);

        if(ii <=0 && (ioctl->wait_done != 1 ))  {
                mpt_free_msg_frame(hd->ioc, mf);
                ioctl->wait_done = 0;
                retval = -1; /* return failure */
        }

mptctl_bus_reset_done:

        mptctl_free_tm_flags(ioctl->ioc);
        return retval;
}

static int
mptctl_set_tm_flags(MPT_SCSI_HOST *hd) {
        unsigned long flags;

        spin_lock_irqsave(&hd->ioc->FreeQlock, flags);

        if (hd->tmState == TM_STATE_NONE) {
                hd->tmState = TM_STATE_IN_PROGRESS;
                hd->tmPending = 1;
                spin_unlock_irqrestore(&hd->ioc->FreeQlock, flags);
        } else {
                spin_unlock_irqrestore(&hd->ioc->FreeQlock, flags);
                return -EBUSY;
        }

        return 0;
}

static void
mptctl_free_tm_flags(MPT_ADAPTER *ioc)
{
        MPT_SCSI_HOST * hd;
        unsigned long flags;

        hd = shost_priv(ioc->sh);
        if (hd == NULL)
                return;

        spin_lock_irqsave(&ioc->FreeQlock, flags);

        hd->tmState = TM_STATE_NONE;
        hd->tmPending = 0;
        spin_unlock_irqrestore(&ioc->FreeQlock, flags);

        return;
}

/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
/* mptctl_ioc_reset
 *
 * Clean-up functionality. Used only if there has been a
 * reload of the FW due.
 *
 */
static int
mptctl_ioc_reset(MPT_ADAPTER *ioc, int reset_phase)
{
        MPT_IOCTL *ioctl = ioc->ioctl;
        dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "IOC %s_reset routed to IOCTL driver!\n", ioc->name,
                reset_phase==MPT_IOC_SETUP_RESET ? "setup" : (
                reset_phase==MPT_IOC_PRE_RESET ? "pre" : "post")));

        if(ioctl == NULL)
                return 1;

        switch(reset_phase) {
        case MPT_IOC_SETUP_RESET:
                ioctl->status |= MPT_IOCTL_STATUS_DID_IOCRESET;
                break;
        case MPT_IOC_POST_RESET:
                ioctl->status &= ~MPT_IOCTL_STATUS_DID_IOCRESET;
                break;
        case MPT_IOC_PRE_RESET:
        default:
                break;
        }

        return 1;
}

/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
/* ASYNC Event Notification Support */
static int
mptctl_event_process(MPT_ADAPTER *ioc, EventNotificationReply_t *pEvReply)
{
        u8 event;

        event = le32_to_cpu(pEvReply->Event) & 0xFF;

        dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "%s() called\n",
            ioc->name, __func__));
        if(async_queue == NULL)
                return 1;

        /* Raise SIGIO for persistent events.
         * TODO - this define is not in MPI spec yet,
         * but they plan to set it to 0x21
         */
         if (event == 0x21 ) {
                ioc->aen_event_read_flag=1;
                dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "Raised SIGIO to application\n",
                    ioc->name));
                devtverboseprintk(ioc, printk(MYIOC_s_DEBUG_FMT
                    "Raised SIGIO to application\n", ioc->name));
                kill_fasync(&async_queue, SIGIO, POLL_IN);
                return 1;
         }

        /* This flag is set after SIGIO was raised, and
         * remains set until the application has read
         * the event log via ioctl=MPTEVENTREPORT
         */
        if(ioc->aen_event_read_flag)
                return 1;

        /* Signal only for the events that are
         * requested for by the application
         */
        if (ioc->events && (ioc->eventTypes & ( 1 << event))) {
                ioc->aen_event_read_flag=1;
                dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT
                    "Raised SIGIO to application\n", ioc->name));
                devtverboseprintk(ioc, printk(MYIOC_s_DEBUG_FMT
                    "Raised SIGIO to application\n", ioc->name));
                kill_fasync(&async_queue, SIGIO, POLL_IN);
        }
        return 1;
}

static int
mptctl_fasync(int fd, struct file *filep, int mode)
{
        MPT_ADAPTER     *ioc;
        int ret;

        lock_kernel();
        list_for_each_entry(ioc, &ioc_list, list)
                ioc->aen_event_read_flag=0;

        ret = fasync_helper(fd, filep, mode, &async_queue);
        unlock_kernel();
        return ret;
}

/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
/*
 *  MPT ioctl handler
 *  cmd - specify the particular IOCTL command to be issued
 *  arg - data specific to the command. Must not be null.
 */
static long
__mptctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
{
        mpt_ioctl_header __user *uhdr = (void __user *) arg;
        mpt_ioctl_header         khdr;
        int iocnum;
        unsigned iocnumX;
        int nonblock = (file->f_flags & O_NONBLOCK);
        int ret;
        MPT_ADAPTER *iocp = NULL;

        if (copy_from_user(&khdr, uhdr, sizeof(khdr))) {
                printk(KERN_ERR MYNAM "%s::mptctl_ioctl() @%d - "
                                "Unable to copy mpt_ioctl_header data @ %p\n",
                                __FILE__, __LINE__, uhdr);
                return -EFAULT;
        }
        ret = -ENXIO;                           /* (-6) No such device or address */

        /* Verify intended MPT adapter - set iocnum and the adapter
         * pointer (iocp)
         */
        iocnumX = khdr.iocnum & 0xFF;
        if (((iocnum = mpt_verify_adapter(iocnumX, &iocp)) < 0) ||
            (iocp == NULL)) {
                printk(KERN_DEBUG MYNAM "%s::mptctl_ioctl() @%d - ioc%d not found!\n",
                                __FILE__, __LINE__, iocnumX);
                return -ENODEV;
        }

        if (!iocp->active) {
                printk(KERN_DEBUG MYNAM "%s::mptctl_ioctl() @%d - Controller disabled.\n",
                                __FILE__, __LINE__);
                return -EFAULT;
        }

        /* Handle those commands that are just returning
         * information stored in the driver.
         * These commands should never time out and are unaffected
         * by TM and FW reloads.
         */
        if ((cmd & ~IOCSIZE_MASK) == (MPTIOCINFO & ~IOCSIZE_MASK)) {
                return mptctl_getiocinfo(arg, _IOC_SIZE(cmd));
        } else if (cmd == MPTTARGETINFO) {
                return mptctl_gettargetinfo(arg);
        } else if (cmd == MPTTEST) {
                return mptctl_readtest(arg);
        } else if (cmd == MPTEVENTQUERY) {
                return mptctl_eventquery(arg);
        } else if (cmd == MPTEVENTENABLE) {
                return mptctl_eventenable(arg);
        } else if (cmd == MPTEVENTREPORT) {
                return mptctl_eventreport(arg);
        } else if (cmd == MPTFWREPLACE) {
                return mptctl_replace_fw(arg);
        }

        /* All of these commands require an interrupt or
         * are unknown/illegal.
         */
        if ((ret = mptctl_syscall_down(iocp, nonblock)) != 0)
                return ret;

        if (cmd == MPTFWDOWNLOAD)
                ret = mptctl_fw_download(arg);
        else if (cmd == MPTCOMMAND)
                ret = mptctl_mpt_command(arg);
        else if (cmd == MPTHARDRESET)
                ret = mptctl_do_reset(arg);
        else if ((cmd & ~IOCSIZE_MASK) == (HP_GETHOSTINFO & ~IOCSIZE_MASK))
                ret = mptctl_hp_hostinfo(arg, _IOC_SIZE(cmd));
        else if (cmd == HP_GETTARGETINFO)
                ret = mptctl_hp_targetinfo(arg);
        else
                ret = -EINVAL;

        mutex_unlock(&iocp->ioctl->ioctl_mutex);

        return ret;
}

static long
mptctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
{
        long ret;
        lock_kernel();
        ret = __mptctl_ioctl(file, cmd, arg);
        unlock_kernel();
        return ret;
}

static int mptctl_do_reset(unsigned long arg)
{
        struct mpt_ioctl_diag_reset __user *urinfo = (void __user *) arg;
        struct mpt_ioctl_diag_reset krinfo;
        MPT_ADAPTER             *iocp;

        if (copy_from_user(&krinfo, urinfo, sizeof(struct mpt_ioctl_diag_reset))) {
                printk(KERN_ERR MYNAM "%s@%d::mptctl_do_reset - "
                                "Unable to copy mpt_ioctl_diag_reset struct @ %p\n",
                                __FILE__, __LINE__, urinfo);
                return -EFAULT;
        }

        if (mpt_verify_adapter(krinfo.hdr.iocnum, &iocp) < 0) {
                printk(KERN_DEBUG MYNAM "%s@%d::mptctl_do_reset - ioc%d not found!\n",
                                __FILE__, __LINE__, krinfo.hdr.iocnum);
                return -ENODEV; /* (-6) No such device or address */
        }

        dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "mptctl_do_reset called.\n",
            iocp->name));

        if (mpt_HardResetHandler(iocp, CAN_SLEEP) != 0) {
                printk (MYIOC_s_ERR_FMT "%s@%d::mptctl_do_reset - reset failed.\n",
                        iocp->name, __FILE__, __LINE__);
                return -1;
        }

        return 0;
}

/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
/*
 * MPT FW download function.  Cast the arg into the mpt_fw_xfer structure.
 * This structure contains: iocnum, firmware length (bytes),
 *      pointer to user space memory where the fw image is stored.
 *
 * Outputs:     None.
 * Return:      0 if successful
 *              -EFAULT if data unavailable
 *              -ENXIO  if no such device
 *              -EAGAIN if resource problem
 *              -ENOMEM if no memory for SGE
 *              -EMLINK if too many chain buffers required
 *              -EBADRQC if adapter does not support FW download
 *              -EBUSY if adapter is busy
 *              -ENOMSG if FW upload returned bad status
 */
static int
mptctl_fw_download(unsigned long arg)
{
        struct mpt_fw_xfer __user *ufwdl = (void __user *) arg;
        struct mpt_fw_xfer       kfwdl;

        if (copy_from_user(&kfwdl, ufwdl, sizeof(struct mpt_fw_xfer))) {
                printk(KERN_ERR MYNAM "%s@%d::_ioctl_fwdl - "
                                "Unable to copy mpt_fw_xfer struct @ %p\n",
                                __FILE__, __LINE__, ufwdl);
                return -EFAULT;
        }

        return mptctl_do_fw_download(kfwdl.iocnum, kfwdl.bufp, kfwdl.fwlen);
}

/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
/*
 * FW Download engine.
 * Outputs:     None.
 * Return:      0 if successful
 *              -EFAULT if data unavailable
 *              -ENXIO  if no such device
 *              -EAGAIN if resource problem
 *              -ENOMEM if no memory for SGE
 *              -EMLINK if too many chain buffers required
 *              -EBADRQC if adapter does not support FW download
 *              -EBUSY if adapter is busy
 *              -ENOMSG if FW upload returned bad status
 */
static int
mptctl_do_fw_download(int ioc, char __user *ufwbuf, size_t fwlen)
{
        FWDownload_t            *dlmsg;
        MPT_FRAME_HDR           *mf;
        MPT_ADAPTER             *iocp;
        FWDownloadTCSGE_t       *ptsge;
        MptSge_t                *sgl, *sgIn;
        char                    *sgOut;
        struct buflist          *buflist;
        struct buflist          *bl;
        dma_addr_t               sgl_dma;
        int                      ret;
        int                      numfrags = 0;
        int                      maxfrags;
        int                      n = 0;
        u32                      sgdir;
        u32                      nib;
        int                      fw_bytes_copied = 0;
        int                      i;
        int                      sge_offset = 0;
        u16                      iocstat;
        pFWDownloadReply_t       ReplyMsg = NULL;

        if (mpt_verify_adapter(ioc, &iocp) < 0) {
                printk(KERN_DEBUG MYNAM "ioctl_fwdl - ioc%d not found!\n",
                                 ioc);
                return -ENODEV; /* (-6) No such device or address */
        } else {

                /*  Valid device. Get a message frame and construct the FW download message.
                */
                if ((mf = mpt_get_msg_frame(mptctl_id, iocp)) == NULL)
                        return -EAGAIN;
        }

        dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT
            "mptctl_do_fwdl called. mptctl_id = %xh.\n", iocp->name, mptctl_id));
        dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "DbG: kfwdl.bufp  = %p\n",
            iocp->name, ufwbuf));
        dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "DbG: kfwdl.fwlen = %d\n",
            iocp->name, (int)fwlen));
        dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "DbG: kfwdl.ioc   = %04xh\n",
            iocp->name, ioc));

        dlmsg = (FWDownload_t*) mf;
        ptsge = (FWDownloadTCSGE_t *) &dlmsg->SGL;
        sgOut = (char *) (ptsge + 1);

        /*
         * Construct f/w download request
         */
        dlmsg->ImageType = MPI_FW_DOWNLOAD_ITYPE_FW;
        dlmsg->Reserved = 0;
        dlmsg->ChainOffset = 0;
        dlmsg->Function = MPI_FUNCTION_FW_DOWNLOAD;
        dlmsg->Reserved1[0] = dlmsg->Reserved1[1] = dlmsg->Reserved1[2] = 0;
        if (iocp->facts.MsgVersion >= MPI_VERSION_01_05)
                dlmsg->MsgFlags = MPI_FW_DOWNLOAD_MSGFLGS_LAST_SEGMENT;
        else
                dlmsg->MsgFlags = 0;


        /* Set up the Transaction SGE.
         */
        ptsge->Reserved = 0;
        ptsge->ContextSize = 0;
        ptsge->DetailsLength = 12;
        ptsge->Flags = MPI_SGE_FLAGS_TRANSACTION_ELEMENT;
        ptsge->Reserved_0100_Checksum = 0;
        ptsge->ImageOffset = 0;
        ptsge->ImageSize = cpu_to_le32(fwlen);

        /* Add the SGL
         */

        /*
         * Need to kmalloc area(s) for holding firmware image bytes.
         * But we need to do it piece meal, using a proper
         * scatter gather list (with 128kB MAX hunks).
         *
         * A practical limit here might be # of sg hunks that fit into
         * a single IOC request frame; 12 or 8 (see below), so:
         * For FC9xx: 12 x 128kB == 1.5 mB (max)
         * For C1030:  8 x 128kB == 1   mB (max)
         * We could support chaining, but things get ugly(ier:)
         *
         * Set the sge_offset to the start of the sgl (bytes).
         */
        sgdir = 0x04000000;             /* IOC will READ from sys mem */
        sge_offset = sizeof(MPIHeader_t) + sizeof(FWDownloadTCSGE_t);
        if ((sgl = kbuf_alloc_2_sgl(fwlen, sgdir, sge_offset,
                                    &numfrags, &buflist, &sgl_dma, iocp)) == NULL)
                return -ENOMEM;

        /*
         * We should only need SGL with 2 simple_32bit entries (up to 256 kB)
         * for FC9xx f/w image, but calculate max number of sge hunks
         * we can fit into a request frame, and limit ourselves to that.
         * (currently no chain support)
         * maxfrags = (Request Size - FWdownload Size ) / Size of 32 bit SGE
         *      Request         maxfrags
         *      128             12
         *      96              8
         *      64              4
         */
        maxfrags = (iocp->req_sz - sizeof(MPIHeader_t) - sizeof(FWDownloadTCSGE_t))
                        / (sizeof(dma_addr_t) + sizeof(u32));
        if (numfrags > maxfrags) {
                ret = -EMLINK;
                goto fwdl_out;
        }

        dctlprintk(iocp, printk(MYIOC_s_DEBUG_FMT "DbG: sgl buffer = %p, sgfrags = %d\n",
            iocp->name, sgl, numfrags));

        /*
         * Parse SG list, copying sgl itself,
         * plus f/w image hunks from user space as we go...
         */
        ret = -EFAULT;
        sgIn = sgl;
        bl = buflist;
        for (i=0; i < numfrags; i++) {

                /* Get the SGE type: 0 - TCSGE, 3 - Chain, 1 - Simple SGE
                 * Skip everything but Simple. If simple, copy from
                 *      user space into kernel space.
                 * Note: we should not have anything but Simple as
                 *      Chain SGE are illegal.
                 */
                nib = (sgIn->FlagsLength & 0x30000000) >> 28;
                if (nib == 0 || nib == 3) {
                        ;
                } else if (sgIn->Address) {
                        mpt_add_sge(sgOut, sgIn->FlagsLength, sgIn->Address);
                        n++;
                        if (copy_from_user(bl->kptr, ufwbuf+fw_bytes_copied, bl->len)) {
                                printk(MYIOC_s_ERR_FMT "%s@%d::_ioctl_fwdl - "
                                        "Unable to copy f/w buffer hunk#%d @ %p\n",
                                        iocp->name, __FILE__, __LINE__, n, ufwbuf);
                                goto fwdl_out;
                        }
                        fw_bytes_copied += bl->len;
                }
                sgIn++;
                bl++;
                sgOut += (sizeof(dma_addr_t) + sizeof(u32));
        }

        DBG_DUMP_FW_DOWNLOAD(iocp, (u32 *)mf, numfrags);

        /*
         * Finally, perform firmware download.
         */
        ReplyMsg = NULL;
        mpt_put_msg_frame(mptctl_id, iocp, mf);

        /* Now wait for the command to complete */
        ret = wait_event_timeout(mptctl_wait,
             iocp->ioctl->wait_done == 1,
             HZ*60);

        if(ret <=0 && (iocp->ioctl->wait_done != 1 )) {
        /* Now we need to reset the board */
                mptctl_timeout_expired(iocp->ioctl);
                ret = -ENODATA;
                goto fwdl_out;
        }

        if (sgl)
                kfree_sgl(sgl, sgl_dma, buflist, iocp);

        ReplyMsg = (pFWDownloadReply_t)iocp->ioctl->ReplyFrame;
        iocstat = le16_to_cpu(ReplyMsg->IOCStatus) & MPI_IOCSTATUS_MASK;
        if (iocstat == MPI_IOCSTATUS_SUCCESS) {
                printk(MYIOC_s_INFO_FMT "F/W update successfull!\n", iocp->name);
                return 0;
        } else if (iocstat == MPI_IOCSTATUS_INVALID_FUNCTION) {
                printk(MYIOC_s_WARN_FMT "Hmmm...  F/W download not supported!?!\n",
                        iocp->name);
                printk(MYIOC_s_WARN_FMT "(time to go bang on somebodies door)\n",
                        iocp->name);
                return -EBADRQC;
        } else if (iocstat == MPI_IOCSTATUS_BUSY) {
                printk(MYIOC_s_WARN_FMT "IOC_BUSY!\n", iocp->name);
                printk(MYIOC_s_WARN_FMT "(try again later?)\n", iocp->name);
                return -EBUSY;
        } else {
                printk(MYIOC_s_WARN_FMT "ioctl_fwdl() returned [bad] status = %04xh\n",
                        iocp->name, iocstat);
                printk(MYIOC_s_WARN_FMT "(bad VooDoo)\n", iocp->name);
                return -ENOMSG;
        }
        return 0;

fwdl_out:
        kfree_sgl(sgl, sgl_dma, buflist, iocp);
        return ret;
}

/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
/*
 * SGE Allocation routine
 *
 * Inputs:      bytes - number of bytes to be transferred
 *              sgdir - data direction
 *              sge_offset - offset (in bytes) from the start of the request
 *                      frame to the first SGE
 *              ioc - pointer to the mptadapter
 * Outputs:     frags - number of scatter gather elements
 *              blp - point to the buflist pointer
 *              sglbuf_dma - pointer to the (dma) sgl
 * Returns:     Null if failes
 *              pointer to the (virtual) sgl if successful.
 */
static MptSge_t *
kbuf_alloc_2_sgl(int bytes, u32 sgdir, int sge_offset, int *frags,
                 struct buflist **blp, dma_addr_t *sglbuf_dma, MPT_ADAPTER *ioc)
{
        MptSge_t        *sglbuf = NULL;         /* pointer to array of SGE */
                                                /* and chain buffers */
        struct buflist  *buflist = NULL;        /* kernel routine */
        MptSge_t        *sgl;
        int              numfrags = 0;
        int              fragcnt = 0;
        int              alloc_sz = min(bytes,MAX_KMALLOC_SZ);  // avoid kernel warning msg!
        int              bytes_allocd = 0;
        int              this_alloc;
        dma_addr_t       pa;                                    // phys addr
        int              i, buflist_ent;
        int              sg_spill = MAX_FRAGS_SPILL1;
        int              dir;
        /* initialization */
        *frags = 0;
        *blp = NULL;

        /* Allocate and initialize an array of kernel
         * structures for the SG elements.
         */
        i = MAX_SGL_BYTES / 8;
        buflist = kzalloc(i, GFP_USER);
        if (!buflist)
                return NULL;
        buflist_ent = 0;

        /* Allocate a single block of memory to store the sg elements and
         * the chain buffers.  The calling routine is responsible for
         * copying the data in this array into the correct place in the
         * request and chain buffers.
         */
        sglbuf = pci_alloc_consistent(ioc->pcidev, MAX_SGL_BYTES, sglbuf_dma);
        if (sglbuf == NULL)
                goto free_and_fail;

        if (sgdir & 0x04000000)
                dir = PCI_DMA_TODEVICE;
        else
                dir = PCI_DMA_FROMDEVICE;

        /* At start:
         *      sgl = sglbuf = point to beginning of sg buffer
         *      buflist_ent = 0 = first kernel structure
         *      sg_spill = number of SGE that can be written before the first

         *              chain element.
         *
         */
        sgl = sglbuf;
        sg_spill = ((ioc->req_sz - sge_offset)/(sizeof(dma_addr_t) + sizeof(u32))) - 1;
        while (bytes_allocd < bytes) {
                this_alloc = min(alloc_sz, bytes-bytes_allocd);
                buflist[buflist_ent].len = this_alloc;
                buflist[buflist_ent].kptr = pci_alloc_consistent(ioc->pcidev,
                                                                 this_alloc,
                                                                 &pa);
                if (buflist[buflist_ent].kptr == NULL) {
                        alloc_sz = alloc_sz / 2;
                        if (alloc_sz == 0) {
                                printk(MYIOC_s_WARN_FMT "-SG: No can do - "
                                    "not enough memory!   :-(\n", ioc->name);
                                printk(MYIOC_s_WARN_FMT "-SG: (freeing %d frags)\n",
                                        ioc->name, numfrags);
                                goto free_and_fail;
                        }
                        continue;
                } else {
                        dma_addr_t dma_addr;

                        bytes_allocd += this_alloc;
                        sgl->FlagsLength = (0x10000000|MPT_SGE_FLAGS_ADDRESSING|sgdir|this_alloc);
                        dma_addr = pci_map_single(ioc->pcidev, buflist[buflist_ent].kptr, this_alloc, dir);
                        sgl->Address = dma_addr;

                        fragcnt++;
                        numfrags++;
                        sgl++;
                        buflist_ent++;
                }

                if (bytes_allocd >= bytes)
                        break;

                /* Need to chain? */
                if (fragcnt == sg_spill) {
                        printk(MYIOC_s_WARN_FMT
                            "-SG: No can do - " "Chain required!   :-(\n", ioc->name);
                        printk(MYIOC_s_WARN_FMT "(freeing %d frags)\n", ioc->name, numfrags);
                        goto free_and_fail;
                }

                /* overflow check... */
                if (numfrags*8 > MAX_SGL_BYTES){
                        /* GRRRRR... */
                        printk(MYIOC_s_WARN_FMT "-SG: No can do - "
                                "too many SG frags!   :-(\n", ioc->name);
                        printk(MYIOC_s_WARN_FMT "-SG: (freeing %d frags)\n",
                                ioc->name, numfrags);
                        goto free_and_fail;
                }
        }

        /* Last sge fixup: set LE+eol+eob bits */
        sgl[-1].FlagsLength |= 0xC1000000;

        *frags = numfrags;
        *blp = buflist;

        dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "-SG: kbuf_alloc_2_sgl() - "
           "%d SG frags generated!\n", ioc->name, numfrags));

        dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "-SG: kbuf_alloc_2_sgl() - "
           "last (big) alloc_sz=%d\n", ioc->name, alloc_sz));

        return sglbuf;

free_and_fail:
        if (sglbuf != NULL) {
                for (i = 0; i < numfrags; i++) {
                        dma_addr_t dma_addr;
                        u8 *kptr;
                        int len;

                        if ((sglbuf[i].FlagsLength >> 24) == 0x30)
                                continue;

                        dma_addr = sglbuf[i].Address;
                        kptr = buflist[i].kptr;
                        len = buflist[i].len;

                        pci_free_consistent(ioc->pcidev, len, kptr, dma_addr);
                }
                pci_free_consistent(ioc->pcidev, MAX_SGL_BYTES, sglbuf, *sglbuf_dma);
        }
        kfree(buflist);
        return NULL;
}

/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
/*
 * Routine to free the SGL elements.
 */
static void
kfree_sgl(MptSge_t *sgl, dma_addr_t sgl_dma, struct buflist *buflist, MPT_ADAPTER *ioc)
{
        MptSge_t        *sg = sgl;
        struct buflist  *bl = buflist;
        u32              nib;
        int              dir;
        int              n = 0;

        if (sg->FlagsLength & 0x04000000)
                dir = PCI_DMA_TODEVICE;
        else
                dir = PCI_DMA_FROMDEVICE;

        nib = (sg->FlagsLength & 0xF0000000) >> 28;
        while (! (nib & 0x4)) { /* eob */
                /* skip ignore/chain. */
                if (nib == 0 || nib == 3) {
                        ;
                } else if (sg->Address) {
                        dma_addr_t dma_addr;
                        void *kptr;
                        int len;

                        dma_addr = sg->Address;
                        kptr = bl->kptr;
                        len = bl->len;
                        pci_unmap_single(ioc->pcidev, dma_addr, len, dir);
                        pci_free_consistent(ioc->pcidev, len, kptr, dma_addr);
                        n++;
                }
                sg++;
                bl++;
                nib = (le32_to_cpu(sg->FlagsLength) & 0xF0000000) >> 28;
        }

        /* we're at eob! */
        if (sg->Address) {
                dma_addr_t dma_addr;
                void *kptr;
                int len;

                dma_addr = sg->Address;
                kptr = bl->kptr;
                len = bl->len;
                pci_unmap_single(ioc->pcidev, dma_addr, len, dir);
                pci_free_consistent(ioc->pcidev, len, kptr, dma_addr);
                n++;
        }

        pci_free_consistent(ioc->pcidev, MAX_SGL_BYTES, sgl, sgl_dma);
        kfree(buflist);
        dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "-SG: Free'd 1 SGL buf + %d kbufs!\n",
            ioc->name, n));
}

/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
/*
 *      mptctl_getiocinfo - Query the host adapter for IOC information.
 *      @arg: User space argument
 *
 * Outputs:     None.
 * Return:      0 if successful
 *              -EFAULT if data unavailable
 *              -ENODEV  if no such device/adapter
 */
static int
mptctl_getiocinfo (unsigned long arg, unsigned int data_size)
{
        struct mpt_ioctl_iocinfo __user *uarg = (void __user *) arg;
        struct mpt_ioctl_iocinfo *karg;
        MPT_ADAPTER             *ioc;
        struct pci_dev          *pdev;
        int                     iocnum;
        unsigned int            port;
        int                     cim_rev;
        u8                      revision;
        struct scsi_device      *sdev;
        VirtDevice              *vdevice;

        /* Add of PCI INFO results in unaligned access for
         * IA64 and Sparc. Reset long to int. Return no PCI
         * data for obsolete format.
         */
        if (data_size == sizeof(struct mpt_ioctl_iocinfo_rev0))
                cim_rev = 0;
        else if (data_size == sizeof(struct mpt_ioctl_iocinfo_rev1))
                cim_rev = 1;
        else if (data_size == sizeof(struct mpt_ioctl_iocinfo))
                cim_rev = 2;
        else if (data_size == (sizeof(struct mpt_ioctl_iocinfo_rev0)+12))
                cim_rev = 0;    /* obsolete */
        else
                return -EFAULT;

        karg = kmalloc(data_size, GFP_KERNEL);
        if (karg == NULL) {
                printk(KERN_ERR MYNAM "%s::mpt_ioctl_iocinfo() @%d - no memory available!\n",
                                __FILE__, __LINE__);
                return -ENOMEM;
        }

        if (copy_from_user(karg, uarg, data_size)) {
                printk(KERN_ERR MYNAM "%s@%d::mptctl_getiocinfo - "
                        "Unable to read in mpt_ioctl_iocinfo struct @ %p\n",
                                __FILE__, __LINE__, uarg);
                kfree(karg);
                return -EFAULT;
        }

        if (((iocnum = mpt_verify_adapter(karg->hdr.iocnum, &ioc)) < 0) ||
            (ioc == NULL)) {
                printk(KERN_DEBUG MYNAM "%s::mptctl_getiocinfo() @%d - ioc%d not found!\n",
                                __FILE__, __LINE__, iocnum);
                kfree(karg);
                return -ENODEV;
        }

        /* Verify the data transfer size is correct. */
        if (karg->hdr.maxDataSize != data_size) {
                printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_getiocinfo - "
                        "Structure size mismatch. Command not completed.\n",
                        ioc->name, __FILE__, __LINE__);
                kfree(karg);
                return -EFAULT;
        }

        dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_getiocinfo called.\n",
            ioc->name));

        /* Fill in the data and return the structure to the calling
         * program
         */
        if (ioc->bus_type == SAS)
                karg->adapterType = MPT_IOCTL_INTERFACE_SAS;
        else if (ioc->bus_type == FC)
                karg->adapterType = MPT_IOCTL_INTERFACE_FC;
        else
                karg->adapterType = MPT_IOCTL_INTERFACE_SCSI;

        if (karg->hdr.port > 1)
                return -EINVAL;
        port = karg->hdr.port;

        karg->port = port;
        pdev = (struct pci_dev *) ioc->pcidev;

        karg->pciId = pdev->device;
        pci_read_config_byte(pdev, PCI_CLASS_REVISION, &revision);
        karg->hwRev = revision;
        karg->subSystemDevice = pdev->subsystem_device;
        karg->subSystemVendor = pdev->subsystem_vendor;

        if (cim_rev == 1) {
                /* Get the PCI bus, device, and function numbers for the IOC
                 */
                karg->pciInfo.u.bits.busNumber = pdev->bus->number;
                karg->pciInfo.u.bits.deviceNumber = PCI_SLOT( pdev->devfn );
                karg->pciInfo.u.bits.functionNumber = PCI_FUNC( pdev->devfn );
        } else if (cim_rev == 2) {
                /* Get the PCI bus, device, function and segment ID numbers
                   for the IOC */
                karg->pciInfo.u.bits.busNumber = pdev->bus->number;
                karg->pciInfo.u.bits.deviceNumber = PCI_SLOT( pdev->devfn );
                karg->pciInfo.u.bits.functionNumber = PCI_FUNC( pdev->devfn );
                karg->pciInfo.segmentID = pci_domain_nr(pdev->bus);
        }

        /* Get number of devices
         */
        karg->numDevices = 0;
        if (ioc->sh) {
                shost_for_each_device(sdev, ioc->sh) {
                        vdevice = sdev->hostdata;
                        if (vdevice->vtarget->tflags &
                            MPT_TARGET_FLAGS_RAID_COMPONENT)
                                continue;
                        karg->numDevices++;
                }
        }

        /* Set the BIOS and FW Version
         */
        karg->FWVersion = ioc->facts.FWVersion.Word;
        karg->BIOSVersion = ioc->biosVersion;

        /* Set the Version Strings.
         */
        strncpy (karg->driverVersion, MPT_LINUX_PACKAGE_NAME, MPT_IOCTL_VERSION_LENGTH);
        karg->driverVersion[MPT_IOCTL_VERSION_LENGTH-1]='\0';

        karg->busChangeEvent = 0;
        karg->hostId = ioc->pfacts[port].PortSCSIID;
        karg->rsvd[0] = karg->rsvd[1] = 0;

        /* Copy the data from kernel memory to user memory
         */
        if (copy_to_user((char __user *)arg, karg, data_size)) {
                printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_getiocinfo - "
                        "Unable to write out mpt_ioctl_iocinfo struct @ %p\n",
                        ioc->name, __FILE__, __LINE__, uarg);
                kfree(karg);
                return -EFAULT;
        }

        kfree(karg);
        return 0;
}

/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
/*
 *      mptctl_gettargetinfo - Query the host adapter for target information.
 *      @arg: User space argument
 *
 * Outputs:     None.
 * Return:      0 if successful
 *              -EFAULT if data unavailable
 *              -ENODEV  if no such device/adapter
 */
static int
mptctl_gettargetinfo (unsigned long arg)
{
        struct mpt_ioctl_targetinfo __user *uarg = (void __user *) arg;
        struct mpt_ioctl_targetinfo karg;
        MPT_ADAPTER             *ioc;
        VirtDevice              *vdevice;
        char                    *pmem;
        int                     *pdata;
        int                     iocnum;
        int                     numDevices = 0;
        int                     lun;
        int                     maxWordsLeft;
        int                     numBytes;
        u8                      port;
        struct scsi_device      *sdev;

        if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_targetinfo))) {
                printk(KERN_ERR MYNAM "%s@%d::mptctl_gettargetinfo - "
                        "Unable to read in mpt_ioctl_targetinfo struct @ %p\n",
                                __FILE__, __LINE__, uarg);
                return -EFAULT;
        }

        if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
            (ioc == NULL)) {
                printk(KERN_DEBUG MYNAM "%s::mptctl_gettargetinfo() @%d - ioc%d not found!\n",
                                __FILE__, __LINE__, iocnum);
                return -ENODEV;
        }

        dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_gettargetinfo called.\n",
            ioc->name));
        /* Get the port number and set the maximum number of bytes
         * in the returned structure.
         * Ignore the port setting.
         */
        numBytes = karg.hdr.maxDataSize - sizeof(mpt_ioctl_header);
        maxWordsLeft = numBytes/sizeof(int);
        port = karg.hdr.port;

        if (maxWordsLeft <= 0) {
                printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_gettargetinfo() - no memory available!\n",
                        ioc->name, __FILE__, __LINE__);
                return -ENOMEM;
        }

        /* Fill in the data and return the structure to the calling
         * program
         */

        /* struct mpt_ioctl_targetinfo does not contain sufficient space
         * for the target structures so when the IOCTL is called, there is
         * not sufficient stack space for the structure. Allocate memory,
         * populate the memory, copy back to the user, then free memory.
         * targetInfo format:
         * bits 31-24: reserved
         *      23-16: LUN
         *      15- 8: Bus Number
         *       7- 0: Target ID
         */
        pmem = kzalloc(numBytes, GFP_KERNEL);
        if (!pmem) {
                printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_gettargetinfo() - no memory available!\n",
                        ioc->name, __FILE__, __LINE__);
                return -ENOMEM;
        }
        pdata =  (int *) pmem;

        /* Get number of devices
         */
        if (ioc->sh){
                shost_for_each_device(sdev, ioc->sh) {
                        if (!maxWordsLeft)
                                continue;
                        vdevice = sdev->hostdata;
                        if (vdevice->vtarget->tflags &
                            MPT_TARGET_FLAGS_RAID_COMPONENT)
                                continue;
                        lun = (vdevice->vtarget->raidVolume) ? 0x80 : vdevice->lun;
                        *pdata = (((u8)lun << 16) + (vdevice->vtarget->channel << 8) +
                            (vdevice->vtarget->id ));
                        pdata++;
                        numDevices++;
                        --maxWordsLeft;
                }
        }
        karg.numDevices = numDevices;

        /* Copy part of the data from kernel memory to user memory
         */
        if (copy_to_user((char __user *)arg, &karg,
                                sizeof(struct mpt_ioctl_targetinfo))) {
                printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_gettargetinfo - "
                        "Unable to write out mpt_ioctl_targetinfo struct @ %p\n",
                        ioc->name, __FILE__, __LINE__, uarg);
                kfree(pmem);
                return -EFAULT;
        }

        /* Copy the remaining data from kernel memory to user memory
         */
        if (copy_to_user(uarg->targetInfo, pmem, numBytes)) {
                printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_gettargetinfo - "
                        "Unable to write out mpt_ioctl_targetinfo struct @ %p\n",
                        ioc->name, __FILE__, __LINE__, pdata);
                kfree(pmem);
                return -EFAULT;
        }

        kfree(pmem);

        return 0;
}

/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
/* MPT IOCTL Test function.
 *
 * Outputs:     None.
 * Return:      0 if successful
 *              -EFAULT if data unavailable
 *              -ENODEV  if no such device/adapter
 */
static int
mptctl_readtest (unsigned long arg)
{
        struct mpt_ioctl_test __user *uarg = (void __user *) arg;
        struct mpt_ioctl_test    karg;
        MPT_ADAPTER *ioc;
        int iocnum;

        if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_test))) {
                printk(KERN_ERR MYNAM "%s@%d::mptctl_readtest - "
                        "Unable to read in mpt_ioctl_test struct @ %p\n",
                                __FILE__, __LINE__, uarg);
                return -EFAULT;
        }

        if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
            (ioc == NULL)) {
                printk(KERN_DEBUG MYNAM "%s::mptctl_readtest() @%d - ioc%d not found!\n",
                                __FILE__, __LINE__, iocnum);
                return -ENODEV;
        }

        dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_readtest called.\n",
            ioc->name));
        /* Fill in the data and return the structure to the calling
         * program
         */

#ifdef MFCNT
        karg.chip_type = ioc->mfcnt;
#else
        karg.chip_type = ioc->pcidev->device;
#endif
        strncpy (karg.name, ioc->name, MPT_MAX_NAME);
        karg.name[MPT_MAX_NAME-1]='\0';
        strncpy (karg.product, ioc->prod_name, MPT_PRODUCT_LENGTH);
        karg.product[MPT_PRODUCT_LENGTH-1]='\0';

        /* Copy the data from kernel memory to user memory
         */
        if (copy_to_user((char __user *)arg, &karg, sizeof(struct mpt_ioctl_test))) {
                printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_readtest - "
                        "Unable to write out mpt_ioctl_test struct @ %p\n",
                        ioc->name, __FILE__, __LINE__, uarg);
                return -EFAULT;
        }

        return 0;
}

/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
/*
 *      mptctl_eventquery - Query the host adapter for the event types
 *      that are being logged.
 *      @arg: User space argument
 *
 * Outputs:     None.
 * Return:      0 if successful
 *              -EFAULT if data unavailable
 *              -ENODEV  if no such device/adapter
 */
static int
mptctl_eventquery (unsigned long arg)
{
        struct mpt_ioctl_eventquery __user *uarg = (void __user *) arg;
        struct mpt_ioctl_eventquery      karg;
        MPT_ADAPTER *ioc;
        int iocnum;

        if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_eventquery))) {
                printk(KERN_ERR MYNAM "%s@%d::mptctl_eventquery - "
                        "Unable to read in mpt_ioctl_eventquery struct @ %p\n",
                                __FILE__, __LINE__, uarg);
                return -EFAULT;
        }

        if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
            (ioc == NULL)) {
                printk(KERN_DEBUG MYNAM "%s::mptctl_eventquery() @%d - ioc%d not found!\n",
                                __FILE__, __LINE__, iocnum);
                return -ENODEV;
        }

        dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_eventquery called.\n",
            ioc->name));
        karg.eventEntries = MPTCTL_EVENT_LOG_SIZE;
        karg.eventTypes = ioc->eventTypes;

        /* Copy the data from kernel memory to user memory
         */
        if (copy_to_user((char __user *)arg, &karg, sizeof(struct mpt_ioctl_eventquery))) {
                printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_eventquery - "
                        "Unable to write out mpt_ioctl_eventquery struct @ %p\n",
                        ioc->name, __FILE__, __LINE__, uarg);
                return -EFAULT;
        }
        return 0;
}

/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
static int
mptctl_eventenable (unsigned long arg)
{
        struct mpt_ioctl_eventenable __user *uarg = (void __user *) arg;
        struct mpt_ioctl_eventenable     karg;
        MPT_ADAPTER *ioc;
        int iocnum;

        if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_eventenable))) {
                printk(KERN_ERR MYNAM "%s@%d::mptctl_eventenable - "
                        "Unable to read in mpt_ioctl_eventenable struct @ %p\n",
                                __FILE__, __LINE__, uarg);
                return -EFAULT;
        }

        if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
            (ioc == NULL)) {
                printk(KERN_DEBUG MYNAM "%s::mptctl_eventenable() @%d - ioc%d not found!\n",
                                __FILE__, __LINE__, iocnum);
                return -ENODEV;
        }

        dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_eventenable called.\n",
            ioc->name));
        if (ioc->events == NULL) {
                /* Have not yet allocated memory - do so now.
                 */
                int sz = MPTCTL_EVENT_LOG_SIZE * sizeof(MPT_IOCTL_EVENTS);
                ioc->events = kzalloc(sz, GFP_KERNEL);
                if (!ioc->events) {
                        printk(MYIOC_s_ERR_FMT
                            ": ERROR - Insufficient memory to add adapter!\n",
                            ioc->name);
                        return -ENOMEM;
                }
                ioc->alloc_total += sz;

                ioc->eventContext = 0;
        }

        /* Update the IOC event logging flag.
         */
        ioc->eventTypes = karg.eventTypes;

        return 0;
}

/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
static int
mptctl_eventreport (unsigned long arg)
{
        struct mpt_ioctl_eventreport __user *uarg = (void __user *) arg;
        struct mpt_ioctl_eventreport     karg;
        MPT_ADAPTER              *ioc;
        int                      iocnum;
        int                      numBytes, maxEvents, max;

        if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_eventreport))) {
                printk(KERN_ERR MYNAM "%s@%d::mptctl_eventreport - "
                        "Unable to read in mpt_ioctl_eventreport struct @ %p\n",
                                __FILE__, __LINE__, uarg);
                return -EFAULT;
        }

        if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
            (ioc == NULL)) {
                printk(KERN_DEBUG MYNAM "%s::mptctl_eventreport() @%d - ioc%d not found!\n",
                                __FILE__, __LINE__, iocnum);
                return -ENODEV;
        }
        dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_eventreport called.\n",
            ioc->name));

        numBytes = karg.hdr.maxDataSize - sizeof(mpt_ioctl_header);
        maxEvents = numBytes/sizeof(MPT_IOCTL_EVENTS);


        max = MPTCTL_EVENT_LOG_SIZE < maxEvents ? MPTCTL_EVENT_LOG_SIZE : maxEvents;

        /* If fewer than 1 event is requested, there must have
         * been some type of error.
         */
        if ((max < 1) || !ioc->events)
                return -ENODATA;

        /* reset this flag so SIGIO can restart */
        ioc->aen_event_read_flag=0;

        /* Copy the data from kernel memory to user memory
         */
        numBytes = max * sizeof(MPT_IOCTL_EVENTS);
        if (copy_to_user(uarg->eventData, ioc->events, numBytes)) {
                printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_eventreport - "
                        "Unable to write out mpt_ioctl_eventreport struct @ %p\n",
                        ioc->name, __FILE__, __LINE__, ioc->events);
                return -EFAULT;
        }

        return 0;
}

/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
static int
mptctl_replace_fw (unsigned long arg)
{
        struct mpt_ioctl_replace_fw __user *uarg = (void __user *) arg;
        struct mpt_ioctl_replace_fw      karg;
        MPT_ADAPTER              *ioc;
        int                      iocnum;
        int                      newFwSize;

        if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_replace_fw))) {
                printk(KERN_ERR MYNAM "%s@%d::mptctl_replace_fw - "
                        "Unable to read in mpt_ioctl_replace_fw struct @ %p\n",
                                __FILE__, __LINE__, uarg);
                return -EFAULT;
        }

        if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
            (ioc == NULL)) {
                printk(KERN_DEBUG MYNAM "%s::mptctl_replace_fw() @%d - ioc%d not found!\n",
                                __FILE__, __LINE__, iocnum);
                return -ENODEV;
        }

        dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_replace_fw called.\n",
            ioc->name));
        /* If caching FW, Free the old FW image
         */
        if (ioc->cached_fw == NULL)
                return 0;

        mpt_free_fw_memory(ioc);

        /* Allocate memory for the new FW image
         */
        newFwSize = karg.newImageSize;

        if (newFwSize & 0x01)
                newFwSize += 1;
        if (newFwSize & 0x02)
                newFwSize += 2;

        mpt_alloc_fw_memory(ioc, newFwSize);
        if (ioc->cached_fw == NULL)
                return -ENOMEM;

        /* Copy the data from user memory to kernel space
         */
        if (copy_from_user(ioc->cached_fw, uarg->newImage, newFwSize)) {
                printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_replace_fw - "
                                "Unable to read in mpt_ioctl_replace_fw image "
                                "@ %p\n", ioc->name, __FILE__, __LINE__, uarg);
                mpt_free_fw_memory(ioc);
                return -EFAULT;
        }

        /* Update IOCFactsReply
         */
        ioc->facts.FWImageSize = newFwSize;
        return 0;
}

/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
/* MPT IOCTL MPTCOMMAND function.
 * Cast the arg into the mpt_ioctl_mpt_command structure.
 *
 * Outputs:     None.
 * Return:      0 if successful
 *              -EBUSY  if previous command timeout and IOC reset is not complete.
 *              -EFAULT if data unavailable
 *              -ENODEV if no such device/adapter
 *              -ETIME  if timer expires
 *              -ENOMEM if memory allocation error
 */
static int
mptctl_mpt_command (unsigned long arg)
{
        struct mpt_ioctl_command __user *uarg = (void __user *) arg;
        struct mpt_ioctl_command  karg;
        MPT_ADAPTER     *ioc;
        int             iocnum;
        int             rc;


        if (copy_from_user(&karg, uarg, sizeof(struct mpt_ioctl_command))) {
                printk(KERN_ERR MYNAM "%s@%d::mptctl_mpt_command - "
                        "Unable to read in mpt_ioctl_command struct @ %p\n",
                                __FILE__, __LINE__, uarg);
                return -EFAULT;
        }

        if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
            (ioc == NULL)) {
                printk(KERN_DEBUG MYNAM "%s::mptctl_mpt_command() @%d - ioc%d not found!\n",
                                __FILE__, __LINE__, iocnum);
                return -ENODEV;
        }

        rc = mptctl_do_mpt_command (karg, &uarg->MF);

        return rc;
}

/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
/* Worker routine for the IOCTL MPTCOMMAND and MPTCOMMAND32 (sparc) commands.
 *
 * Outputs:     None.
 * Return:      0 if successful
 *              -EBUSY  if previous command timeout and IOC reset is not complete.
 *              -EFAULT if data unavailable
 *              -ENODEV if no such device/adapter
 *              -ETIME  if timer expires
 *              -ENOMEM if memory allocation error
 *              -EPERM if SCSI I/O and target is untagged
 */
static int
mptctl_do_mpt_command (struct mpt_ioctl_command karg, void __user *mfPtr)
{
        MPT_ADAPTER     *ioc;
        MPT_FRAME_HDR   *mf = NULL;
        MPIHeader_t     *hdr;
        char            *psge;
        struct buflist  bufIn;  /* data In buffer */
        struct buflist  bufOut; /* data Out buffer */
        dma_addr_t      dma_addr_in;
        dma_addr_t      dma_addr_out;
        int             sgSize = 0;     /* Num SG elements */
        int             iocnum, flagsLength;
        int             sz, rc = 0;
        int             msgContext;
        u16             req_idx;
        ulong           timeout;
        struct scsi_device *sdev;

        /* bufIn and bufOut are used for user to kernel space transfers
         */
        bufIn.kptr = bufOut.kptr = NULL;
        bufIn.len = bufOut.len = 0;

        if (((iocnum = mpt_verify_adapter(karg.hdr.iocnum, &ioc)) < 0) ||
            (ioc == NULL)) {
                printk(KERN_DEBUG MYNAM "%s::mptctl_do_mpt_command() @%d - ioc%d not found!\n",
                                __FILE__, __LINE__, iocnum);
                return -ENODEV;
        }
        if (!ioc->ioctl) {
                printk(KERN_ERR MYNAM "%s@%d::mptctl_do_mpt_command - "
                        "No memory available during driver init.\n",
                                __FILE__, __LINE__);
                return -ENOMEM;
        } else if (ioc->ioctl->status & MPT_IOCTL_STATUS_DID_IOCRESET) {
                printk(KERN_ERR MYNAM "%s@%d::mptctl_do_mpt_command - "
                        "Busy with IOC Reset \n", __FILE__, __LINE__);
                return -EBUSY;
        }

        /* Verify that the final request frame will not be too large.
         */
        sz = karg.dataSgeOffset * 4;
        if (karg.dataInSize > 0)
                sz += sizeof(dma_addr_t) + sizeof(u32);
        if (karg.dataOutSize > 0)
                sz += sizeof(dma_addr_t) + sizeof(u32);

        if (sz > ioc->req_sz) {
                printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
                        "Request frame too large (%d) maximum (%d)\n",
                        ioc->name, __FILE__, __LINE__, sz, ioc->req_sz);
                return -EFAULT;
        }

        /* Get a free request frame and save the message context.
         */
        if ((mf = mpt_get_msg_frame(mptctl_id, ioc)) == NULL)
                return -EAGAIN;

        hdr = (MPIHeader_t *) mf;
        msgContext = le32_to_cpu(hdr->MsgContext);
        req_idx = le16_to_cpu(mf->u.frame.hwhdr.msgctxu.fld.req_idx);

        /* Copy the request frame
         * Reset the saved message context.
         * Request frame in user space
         */
        if (copy_from_user(mf, mfPtr, karg.dataSgeOffset * 4)) {
                printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
                        "Unable to read MF from mpt_ioctl_command struct @ %p\n",
                        ioc->name, __FILE__, __LINE__, mfPtr);
                rc = -EFAULT;
                goto done_free_mem;
        }
        hdr->MsgContext = cpu_to_le32(msgContext);


        /* Verify that this request is allowed.
         */
        dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sending mpi function (0x%02X), req=%p\n",
            ioc->name, hdr->Function, mf));

        switch (hdr->Function) {
        case MPI_FUNCTION_IOC_FACTS:
        case MPI_FUNCTION_PORT_FACTS:
                karg.dataOutSize  = karg.dataInSize = 0;
                break;

        case MPI_FUNCTION_CONFIG:
        {
                Config_t *config_frame;
                config_frame = (Config_t *)mf;
                dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "\ttype=0x%02x ext_type=0x%02x "
                    "number=0x%02x action=0x%02x\n", ioc->name,
                    config_frame->Header.PageType,
                    config_frame->ExtPageType,
                    config_frame->Header.PageNumber,
                    config_frame->Action));
                break;
        }

        case MPI_FUNCTION_FC_COMMON_TRANSPORT_SEND:
        case MPI_FUNCTION_FC_EX_LINK_SRVC_SEND:
        case MPI_FUNCTION_FW_UPLOAD:
        case MPI_FUNCTION_SCSI_ENCLOSURE_PROCESSOR:
        case MPI_FUNCTION_FW_DOWNLOAD:
        case MPI_FUNCTION_FC_PRIMITIVE_SEND:
        case MPI_FUNCTION_TOOLBOX:
        case MPI_FUNCTION_SAS_IO_UNIT_CONTROL:
                break;

        case MPI_FUNCTION_SCSI_IO_REQUEST:
                if (ioc->sh) {
                        SCSIIORequest_t *pScsiReq = (SCSIIORequest_t *) mf;
                        int qtag = MPI_SCSIIO_CONTROL_UNTAGGED;
                        int scsidir = 0;
                        int dataSize;
                        u32 id;

                        id = (ioc->devices_per_bus == 0) ? 256 : ioc->devices_per_bus;
                        if (pScsiReq->TargetID > id) {
                                printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
                                        "Target ID out of bounds. \n",
                                        ioc->name, __FILE__, __LINE__);
                                rc = -ENODEV;
                                goto done_free_mem;
                        }

                        if (pScsiReq->Bus >= ioc->number_of_buses) {
                                printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
                                        "Target Bus out of bounds. \n",
                                        ioc->name, __FILE__, __LINE__);
                                rc = -ENODEV;
                                goto done_free_mem;
                        }

                        pScsiReq->MsgFlags &= ~MPI_SCSIIO_MSGFLGS_SENSE_WIDTH;
                        pScsiReq->MsgFlags |= mpt_msg_flags();


                        /* verify that app has not requested
                         *      more sense data than driver
                         *      can provide, if so, reset this parameter
                         * set the sense buffer pointer low address
                         * update the control field to specify Q type
                         */
                        if (karg.maxSenseBytes > MPT_SENSE_BUFFER_SIZE)
                                pScsiReq->SenseBufferLength = MPT_SENSE_BUFFER_SIZE;
                        else
                                pScsiReq->SenseBufferLength = karg.maxSenseBytes;

                        pScsiReq->SenseBufferLowAddr =
                                cpu_to_le32(ioc->sense_buf_low_dma
                                   + (req_idx * MPT_SENSE_BUFFER_ALLOC));

                        shost_for_each_device(sdev, ioc->sh) {
                                struct scsi_target *starget = scsi_target(sdev);
                                VirtTarget *vtarget = starget->hostdata;

                                if ((pScsiReq->TargetID == vtarget->id) &&
                                    (pScsiReq->Bus == vtarget->channel) &&
                                    (vtarget->tflags & MPT_TARGET_FLAGS_Q_YES))
                                        qtag = MPI_SCSIIO_CONTROL_SIMPLEQ;
                        }

                        /* Have the IOCTL driver set the direction based
                         * on the dataOutSize (ordering issue with Sparc).
                         */
                        if (karg.dataOutSize > 0) {
                                scsidir = MPI_SCSIIO_CONTROL_WRITE;
                                dataSize = karg.dataOutSize;
                        } else {
                                scsidir = MPI_SCSIIO_CONTROL_READ;
                                dataSize = karg.dataInSize;
                        }

                        pScsiReq->Control = cpu_to_le32(scsidir | qtag);
                        pScsiReq->DataLength = cpu_to_le32(dataSize);

                        ioc->ioctl->reset = MPTCTL_RESET_OK;
                        ioc->ioctl->id = pScsiReq->TargetID;

                } else {
                        printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
                                "SCSI driver is not loaded. \n",
                                ioc->name, __FILE__, __LINE__);
                        rc = -EFAULT;
                        goto done_free_mem;
                }
                break;

        case MPI_FUNCTION_SMP_PASSTHROUGH:
                /* Check mf->PassthruFlags to determine if
                 * transfer is ImmediateMode or not.
                 * Immediate mode returns data in the ReplyFrame.
                 * Else, we are sending request and response data
                 * in two SGLs at the end of the mf.
                 */
                break;

        case MPI_FUNCTION_SATA_PASSTHROUGH:
                if (!ioc->sh) {
                        printk(MYIOC_s_ERR_FMT "%s@%d::mptctl_do_mpt_command - "
                                "SCSI driver is not loaded. \n",
                                ioc->name, __FILE__, __LINE__);
                        rc = -EFAULT;
                        goto done_free_mem;
                }
                break;

        case MPI_FUNCTION_RAID_ACTION:
                /* Just add a SGE
                 */
                break;

        case MPI_FUNCTION_RAID_SCSI_IO_PASSTHROUGH:
                if (ioc->sh) {
                        SCSIIORequest_t *pScsiReq = (SCSIIORequest_t *) mf;
                        int qtag = MPI_SCSIIO_CONTROL_SIMPLEQ;
                        int scsidir = MPI_SCSIIO_CONTROL_READ;
                        int dataSize;

                        pScsiReq->MsgFlags &= ~MPI_SCSIIO_MSGFLGS_SENSE_WIDTH;
                        pScsiReq->MsgFlags |= mpt_msg_flags();


                        /* verify that app has not requested
                         *      more sense data than driver
                         *      can provide, if so, reset this parameter
                         * set the sense buffer pointer low address
                         * update the control field to specify Q type
                         */
                        if (karg.maxSenseBytes > MPT_SENSE_BUFFER_SIZE)
                                pScsiReq->SenseBufferLength = MPT_SENSE_BUFFER_SIZE;
                        else
                                pScsiReq->SenseBufferLength = karg.maxSenseBytes;

                        pScsiReq->SenseBufferLowAddr =
                                cpu_to_le32(ioc->sense_buf_low_dma
                                   + (req_idx * MPT_SENSE_BUFFER_ALLOC));

                        /* All commands to physical devices are tagged
                         */