[PATCH 0/3] bnx2: Add iSCSI support.

[PATCH 0/3] bnx2: Add iSCSI support.

[Michael Chan]

Please review our new version of the iSCSI drivers for Broadcom BNX2
devices.  We've reworked the bnx2i driver quite a bit with the help
of Mike Christie in the last few months.  It is now one scsi host per
adapter and has a single iscsi transport name.  It is also more
tightly coupled to scsi_transport_iscsi and libiscsi. 

The bnx2i driver depends on the latest patches in Mike Christie's git
tree.

Thanks.

[PATCH 1/3] bnx2: Add support for CNIC driver.

[Michael Chan]

Add interface for a separate CNIC driver to drive additional rings
and other resources for iSCSI.

A probe function is exported so that the CNIC driver can get
information about bnx2 devices.  After calling the probe function,
the CNIC driver can then register with the BNX2 driver before
initializing the hardware for iSCSI.

Signed-off-by: Michael Chan <mchan-dY08KVG/lbpWk0Htik3J/w@public.gmane.org>
---
 drivers/net/bnx2.c |  202 ++++++++++++++++++++++++++++++++++++++++++++++++++--
 drivers/net/bnx2.h |   21 ++++++
 2 files changed, 218 insertions(+), 5 deletions(-)

diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index b32d227..ba12daf 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -48,6 +48,11 @@
 #include <linux/cache.h>
 #include <linux/zlib.h>
 
+#if defined(CONFIG_CNIC) || defined(CONFIG_CNIC_MODULE)
+#define BCM_CNIC	1
+#include "cnic_drv.h"
+#endif
+
 #include "bnx2.h"
 #include "bnx2_fw.h"
 #include "bnx2_fw2.h"
@@ -302,6 +307,170 @@ bnx2_ctx_wr(struct bnx2 *bp, u32 cid_addr, u32 offset, u32 val)
 	spin_unlock_bh(&bp->indirect_lock);
 }
 
+#ifdef BCM_CNIC
+static int
+bnx2_drv_ctl(struct net_device *dev, struct drv_ctl_info *info)
+{
+	struct bnx2 *bp = netdev_priv(dev);
+	struct drv_ctl_io *io = &info->data.io;
+
+	switch (info->cmd) {
+	case DRV_CTL_IO_WR_CMD:
+		bnx2_reg_wr_ind(bp, io->offset, io->data);
+		break;
+	case DRV_CTL_IO_RD_CMD:
+		io->data = bnx2_reg_rd_ind(bp, io->offset);
+		break;
+	case DRV_CTL_CTX_WR_CMD:
+		bnx2_ctx_wr(bp, io->cid_addr, io->offset, io->data);
+		break;
+	default:
+		return -EINVAL;
+	}
+	return 0;
+}
+
+static void bnx2_setup_cnic_irq_info(struct bnx2 *bp)
+{
+	struct cnic_ops *c_ops;
+	struct cnic_eth_dev *cp = &bp->cnic_eth_dev;
+	struct bnx2_napi *bnapi = &bp->bnx2_napi[0];
+	int sb_id;
+
+	rcu_read_lock();
+	c_ops = rcu_dereference(bp->cnic_ops);
+	if (!c_ops)
+		goto done;
+
+	if (bp->flags & BNX2_FLAG_USING_MSIX) {
+		cp->drv_state |= CNIC_DRV_STATE_USING_MSIX;
+		bnapi->cnic_present = 0;
+		sb_id = BNX2_CNIC_VEC;
+		cp->irq_arr[0].irq_flags |= CNIC_IRQ_FL_MSIX;
+	} else {
+		cp->drv_state &= ~CNIC_DRV_STATE_USING_MSIX;
+		bnapi->cnic_tag = bnapi->last_status_idx;
+		bnapi->cnic_present = 1;
+		sb_id = 0;
+		cp->irq_arr[0].irq_flags &= !CNIC_IRQ_FL_MSIX;
+	}
+
+	cp->irq_arr[0].vector = bp->irq_tbl[sb_id].vector;
+	cp->irq_arr[0].status_blk = (void *) ((unsigned long) bp->status_blk +
+		(BNX2_SBLK_MSIX_ALIGN_SIZE * sb_id));
+	cp->irq_arr[0].status_blk_num = sb_id;
+	cp->num_irq = 1;
+
+done:
+	rcu_read_unlock();
+}
+
+static int bnx2_register_cnic(struct net_device *dev, struct cnic_ops *ops,
+			      void *data)
+{
+	struct bnx2 *bp = netdev_priv(dev);
+	struct cnic_eth_dev *cp = &bp->cnic_eth_dev;
+
+	if (ops == NULL)
+		return -EINVAL;
+
+	if (!try_module_get(ops->cnic_owner))
+		return -EBUSY;
+
+	bp->cnic_data = data;
+	rcu_assign_pointer(bp->cnic_ops, ops);
+
+	cp->num_irq = 0;
+	cp->drv_state = CNIC_DRV_STATE_REGD;
+
+	bnx2_setup_cnic_irq_info(bp);
+
+	return 0;
+}
+
+static int bnx2_unregister_cnic(struct net_device *dev)
+{
+	struct bnx2 *bp = netdev_priv(dev);
+	struct bnx2_napi *bnapi = &bp->bnx2_napi[0];
+	struct cnic_eth_dev *cp = &bp->cnic_eth_dev;
+
+	cp->drv_state = 0;
+	module_put(bp->cnic_ops->cnic_owner);
+	bnapi->cnic_present = 0;
+	rcu_assign_pointer(bp->cnic_ops, NULL);
+	synchronize_rcu();
+	return 0;
+}
+
+struct cnic_eth_dev *bnx2_cnic_probe(struct net_device *dev)
+{
+	struct bnx2 *bp = netdev_priv(dev);
+	struct cnic_eth_dev *cp = &bp->cnic_eth_dev;
+
+	cp->chip_id = bp->chip_id;
+	cp->pdev = bp->pdev;
+	cp->io_base = bp->regview;
+	cp->drv_ctl = bnx2_drv_ctl;
+	cp->drv_register_cnic = bnx2_register_cnic;
+	cp->drv_unregister_cnic = bnx2_unregister_cnic;
+
+	return cp;
+}
+EXPORT_SYMBOL(bnx2_cnic_probe);
+
+static void
+bnx2_cnic_stop(struct bnx2 *bp)
+{
+	struct cnic_ops *c_ops;
+	struct cnic_ctl_info info;
+
+	rcu_read_lock();
+	c_ops = rcu_dereference(bp->cnic_ops);
+	if (c_ops) {
+		info.cmd = CNIC_CTL_STOP_CMD;
+		c_ops->cnic_ctl(bp->cnic_data, &info);
+	}
+	rcu_read_unlock();
+}
+
+static void
+bnx2_cnic_start(struct bnx2 *bp)
+{
+	struct cnic_ops *c_ops;
+	struct cnic_ctl_info info;
+
+	rcu_read_lock();
+	c_ops = rcu_dereference(bp->cnic_ops);
+	if (c_ops) {
+		if (!(bp->flags & BNX2_FLAG_USING_MSIX)) {
+			struct bnx2_napi *bnapi = &bp->bnx2_napi[0];
+
+			bnapi->cnic_tag = bnapi->last_status_idx;
+		}
+		info.cmd = CNIC_CTL_START_CMD;
+		c_ops->cnic_ctl(bp->cnic_data, &info);
+	}
+	rcu_read_unlock();
+}
+
+#else
+
+static void bnx2_setup_cnic_irq_info(struct bnx2 *bp)
+{
+}
+
+static void
+bnx2_cnic_stop(struct bnx2 *bp)
+{
+}
+
+static void
+bnx2_cnic_start(struct bnx2 *bp)
+{
+}
+
+#endif
+
 static int
 bnx2_read_phy(struct bnx2 *bp, u32 reg, u32 *val)
 {
@@ -475,6 +644,7 @@ bnx2_napi_enable(struct bnx2 *bp)
 static void
 bnx2_netif_stop(struct bnx2 *bp)
 {
+	bnx2_cnic_stop(bp);
 	bnx2_disable_int_sync(bp);
 	if (netif_running(bp->dev)) {
 		bnx2_napi_disable(bp);
@@ -491,6 +661,7 @@ bnx2_netif_start(struct bnx2 *bp)
 			netif_wake_queue(bp->dev);
 			bnx2_napi_enable(bp);
 			bnx2_enable_int(bp);
+			bnx2_cnic_start(bp);
 		}
 	}
 }
@@ -3007,6 +3178,9 @@ bnx2_has_work(struct bnx2_napi *bnapi)
 	    (sblk->status_attn_bits_ack & STATUS_ATTN_EVENTS))
 		return 1;
 
+	if (bnapi->cnic_present && (bnapi->cnic_tag != sblk->status_idx))
+		return 1;
+
 	return 0;
 }
 
@@ -3059,6 +3233,20 @@ static int bnx2_poll_work(struct bnx2 *bp, struct bnx2_napi *bnapi,
 	if (bnx2_get_hw_rx_cons(bnapi) != bnapi->rx_cons)
 		work_done += bnx2_rx_int(bp, bnapi, budget - work_done);
 
+#ifdef BCM_CNIC
+	if (bnapi->cnic_present) {
+		struct cnic_ops *c_ops;
+
+		rcu_read_lock();
+		c_ops = rcu_dereference(bp->cnic_ops);
+		if (c_ops)
+			bnapi->cnic_tag =
+				c_ops->cnic_handler(bp->cnic_data,
+						    bnapi->status_blk);
+		rcu_read_unlock();
+	}
+#endif
+
 	return work_done;
 }
 
@@ -3100,7 +3288,6 @@ static int bnx2_poll(struct napi_struct *napi, int budget)
 			break;
 		}
 	}
-
 	return work_done;
 }
 
@@ -5517,19 +5704,19 @@ static void
 bnx2_enable_msix(struct bnx2 *bp)
 {
 	int i, rc;
-	struct msix_entry msix_ent[BNX2_MAX_MSIX_VEC];
+	struct msix_entry msix_ent[BNX2_MAX_MSIX_CNIC_VEC];
 
 	bnx2_setup_msix_tbl(bp);
 	REG_WR(bp, BNX2_PCI_MSIX_CONTROL, BNX2_MAX_MSIX_HW_VEC - 1);
 	REG_WR(bp, BNX2_PCI_MSIX_TBL_OFF_BIR, BNX2_PCI_GRC_WINDOW2_BASE);
 	REG_WR(bp, BNX2_PCI_MSIX_PBA_OFF_BIT, BNX2_PCI_GRC_WINDOW3_BASE);
 
-	for (i = 0; i < BNX2_MAX_MSIX_VEC; i++) {
+	for (i = 0; i < BNX2_MAX_MSIX_CNIC_VEC; i++) {
 		msix_ent[i].entry = i;
 		msix_ent[i].vector = 0;
 	}
 
-	rc = pci_enable_msix(bp->pdev, msix_ent, BNX2_MAX_MSIX_VEC);
+	rc = pci_enable_msix(bp->pdev, msix_ent, BNX2_MAX_MSIX_CNIC_VEC);
 	if (rc != 0)
 		return;
 
@@ -5540,10 +5727,14 @@ bnx2_enable_msix(struct bnx2 *bp)
 	strcat(bp->irq_tbl[BNX2_BASE_VEC].name, "-base");
 	strcpy(bp->irq_tbl[BNX2_TX_VEC].name, bp->dev->name);
 	strcat(bp->irq_tbl[BNX2_TX_VEC].name, "-tx");
+#ifdef BCM_CNIC
+	strcpy(bp->irq_tbl[BNX2_CNIC_VEC].name, bp->dev->name);
+	strcat(bp->irq_tbl[BNX2_CNIC_VEC].name, "-cnic");
+#endif
 
 	bp->irq_nvecs = BNX2_MAX_MSIX_VEC;
 	bp->flags |= BNX2_FLAG_USING_MSIX | BNX2_FLAG_ONE_SHOT_MSI;
-	for (i = 0; i < BNX2_MAX_MSIX_VEC; i++)
+	for (i = 0; i < BNX2_MAX_MSIX_CNIC_VEC; i++)
 		bp->irq_tbl[i].vector = msix_ent[i].vector;
 }
 
@@ -5571,6 +5762,7 @@ bnx2_setup_int_mode(struct bnx2 *bp, int dis_msi)
 			bp->irq_tbl[0].vector = bp->pdev->irq;
 		}
 	}
+	bnx2_setup_cnic_irq_info(bp);
 }
 
 /* Called with rtnl_lock */
diff --git a/drivers/net/bnx2.h b/drivers/net/bnx2.h
index 16020a1..a47ee60 100644
--- a/drivers/net/bnx2.h
+++ b/drivers/net/bnx2.h
@@ -6562,6 +6562,15 @@ struct flash_spec {
 #define BNX2_TX_VEC		1
 #define BNX2_TX_INT_NUM	(BNX2_TX_VEC << BNX2_PCICFG_INT_ACK_CMD_INT_NUM_SHIFT)
 
+#ifdef BCM_CNIC
+#define BNX2_MAX_MSIX_CNIC_VEC	(BNX2_MAX_MSIX_VEC + 1)
+#define BNX2_CNIC_VEC		2
+#define BNX2_CNIC_INT_NUM	\
+	(BNX2_CNIC_VEC << BNX2_PCICFG_INT_ACK_CMD_INT_NUM_SHIFT)
+#else
+#define BNX2_MAX_MSIX_CNIC_VEC	BNX2_MAX_MSIX_VEC
+#endif
+
 struct bnx2_irq {
 	irq_handler_t	handler;
 	u16		vector;
@@ -6577,6 +6586,9 @@ struct bnx2_napi {
 	u32 			last_status_idx;
 	u32			int_num;
 
+	u32			cnic_tag;
+	int			cnic_present;
+
 	u16			tx_cons;
 	u16			hw_tx_cons;
 
@@ -6648,6 +6660,11 @@ struct bnx2 {
 	int		tx_ring_size;
 	u32		tx_wake_thresh;
 
+#ifdef BCM_CNIC
+	struct cnic_ops		*cnic_ops;
+	void			*cnic_data;
+#endif
+
 	/* End of fields used in the performance code paths. */
 
 	char			*name;
@@ -6813,6 +6830,10 @@ struct bnx2 {
 
 	struct bnx2_irq		irq_tbl[BNX2_MAX_MSIX_VEC];
 	int			irq_nvecs;
+
+#ifdef BCM_CNIC
+	struct cnic_eth_dev	cnic_eth_dev;
+#endif
 };
 
 #define REG_RD(bp, offset)					\
-- 
1.5.5.GIT

Re: [PATCH 1/3] bnx2: Add support for CNIC driver.

[Paul E. McKenney]

On Wed, May 21, 2008 at 06:06:24PM -0700, Michael Chan wrote:
> Add interface for a separate CNIC driver to drive additional rings
> and other resources for iSCSI.
> 
> A probe function is exported so that the CNIC driver can get
> information about bnx2 devices.  After calling the probe function,
> the CNIC driver can then register with the BNX2 driver before
> initializing the hardware for iSCSI.

Some RCU-related questions interspersed below, for example, how are
updates protected?

							Thanx, Paul

> Signed-off-by: Michael Chan <mchan@broadcom.com>
> ---
>  drivers/net/bnx2.c |  202 ++++++++++++++++++++++++++++++++++++++++++++++++++--
>  drivers/net/bnx2.h |   21 ++++++
>  2 files changed, 218 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
> index b32d227..ba12daf 100644
> --- a/drivers/net/bnx2.c
> +++ b/drivers/net/bnx2.c
> @@ -48,6 +48,11 @@
>  #include <linux/cache.h>
>  #include <linux/zlib.h>
> 
> +#if defined(CONFIG_CNIC) || defined(CONFIG_CNIC_MODULE)
> +#define BCM_CNIC	1
> +#include "cnic_drv.h"
> +#endif
> +
>  #include "bnx2.h"
>  #include "bnx2_fw.h"
>  #include "bnx2_fw2.h"
> @@ -302,6 +307,170 @@ bnx2_ctx_wr(struct bnx2 *bp, u32 cid_addr, u32 offset, u32 val)
>  	spin_unlock_bh(&bp->indirect_lock);
>  }
> 
> +#ifdef BCM_CNIC
> +static int
> +bnx2_drv_ctl(struct net_device *dev, struct drv_ctl_info *info)
> +{
> +	struct bnx2 *bp = netdev_priv(dev);
> +	struct drv_ctl_io *io = &info->data.io;
> +
> +	switch (info->cmd) {
> +	case DRV_CTL_IO_WR_CMD:
> +		bnx2_reg_wr_ind(bp, io->offset, io->data);
> +		break;
> +	case DRV_CTL_IO_RD_CMD:
> +		io->data = bnx2_reg_rd_ind(bp, io->offset);
> +		break;
> +	case DRV_CTL_CTX_WR_CMD:
> +		bnx2_ctx_wr(bp, io->cid_addr, io->offset, io->data);
> +		break;
> +	default:
> +		return -EINVAL;
> +	}
> +	return 0;
> +}
> +
> +static void bnx2_setup_cnic_irq_info(struct bnx2 *bp)
> +{
> +	struct cnic_ops *c_ops;
> +	struct cnic_eth_dev *cp = &bp->cnic_eth_dev;
> +	struct bnx2_napi *bnapi = &bp->bnx2_napi[0];
> +	int sb_id;
> +
> +	rcu_read_lock();
> +	c_ops = rcu_dereference(bp->cnic_ops);
> +	if (!c_ops)
> +		goto done;

Given that c_ops is unused below, what is happening here?  What prevents
bp->cnic_ops from becoming NULL immediately after we test it?  And if
it is OK for bp->cnic_ops to become NULL immediately after we test it,
why are we bothering to test it?

> +
> +	if (bp->flags & BNX2_FLAG_USING_MSIX) {
> +		cp->drv_state |= CNIC_DRV_STATE_USING_MSIX;
> +		bnapi->cnic_present = 0;
> +		sb_id = BNX2_CNIC_VEC;
> +		cp->irq_arr[0].irq_flags |= CNIC_IRQ_FL_MSIX;
> +	} else {
> +		cp->drv_state &= ~CNIC_DRV_STATE_USING_MSIX;
> +		bnapi->cnic_tag = bnapi->last_status_idx;
> +		bnapi->cnic_present = 1;
> +		sb_id = 0;
> +		cp->irq_arr[0].irq_flags &= !CNIC_IRQ_FL_MSIX;
> +	}
> +
> +	cp->irq_arr[0].vector = bp->irq_tbl[sb_id].vector;
> +	cp->irq_arr[0].status_blk = (void *) ((unsigned long) bp->status_blk +
> +		(BNX2_SBLK_MSIX_ALIGN_SIZE * sb_id));
> +	cp->irq_arr[0].status_blk_num = sb_id;
> +	cp->num_irq = 1;
> +
> +done:
> +	rcu_read_unlock();
> +}
> +
> +static int bnx2_register_cnic(struct net_device *dev, struct cnic_ops *ops,
> +			      void *data)
> +{
> +	struct bnx2 *bp = netdev_priv(dev);
> +	struct cnic_eth_dev *cp = &bp->cnic_eth_dev;
> +
> +	if (ops == NULL)
> +		return -EINVAL;
> +
> +	if (!try_module_get(ops->cnic_owner))
> +		return -EBUSY;
> +
> +	bp->cnic_data = data;
> +	rcu_assign_pointer(bp->cnic_ops, ops);

What prevents multiple tasks from doing this assignment concurrently?

> +
> +	cp->num_irq = 0;
> +	cp->drv_state = CNIC_DRV_STATE_REGD;
> +
> +	bnx2_setup_cnic_irq_info(bp);
> +
> +	return 0;
> +}
> +
> +static int bnx2_unregister_cnic(struct net_device *dev)
> +{
> +	struct bnx2 *bp = netdev_priv(dev);
> +	struct bnx2_napi *bnapi = &bp->bnx2_napi[0];
> +	struct cnic_eth_dev *cp = &bp->cnic_eth_dev;
> +
> +	cp->drv_state = 0;
> +	module_put(bp->cnic_ops->cnic_owner);
> +	bnapi->cnic_present = 0;
> +	rcu_assign_pointer(bp->cnic_ops, NULL);

What prevents this from running concurrently with bnx2_register_cnic()?

> +	synchronize_rcu();

The caller is responsible for freeing up the old bp->cnic_ops structure?
Or is this structure statically allocated?

If so, is the idea to delay return until all prior calls through the
old ops structure have completed?

> +	return 0;
> +}
> +
> +struct cnic_eth_dev *bnx2_cnic_probe(struct net_device *dev)
> +{
> +	struct bnx2 *bp = netdev_priv(dev);
> +	struct cnic_eth_dev *cp = &bp->cnic_eth_dev;
> +
> +	cp->chip_id = bp->chip_id;
> +	cp->pdev = bp->pdev;
> +	cp->io_base = bp->regview;
> +	cp->drv_ctl = bnx2_drv_ctl;
> +	cp->drv_register_cnic = bnx2_register_cnic;
> +	cp->drv_unregister_cnic = bnx2_unregister_cnic;
> +
> +	return cp;
> +}
> +EXPORT_SYMBOL(bnx2_cnic_probe);
> +
> +static void
> +bnx2_cnic_stop(struct bnx2 *bp)
> +{
> +	struct cnic_ops *c_ops;
> +	struct cnic_ctl_info info;
> +
> +	rcu_read_lock();
> +	c_ops = rcu_dereference(bp->cnic_ops);
> +	if (c_ops) {
> +		info.cmd = CNIC_CTL_STOP_CMD;
> +		c_ops->cnic_ctl(bp->cnic_data, &info);
> +	}
> +	rcu_read_unlock();
> +}
> +
> +static void
> +bnx2_cnic_start(struct bnx2 *bp)
> +{
> +	struct cnic_ops *c_ops;
> +	struct cnic_ctl_info info;
> +
> +	rcu_read_lock();
> +	c_ops = rcu_dereference(bp->cnic_ops);
> +	if (c_ops) {
> +		if (!(bp->flags & BNX2_FLAG_USING_MSIX)) {
> +			struct bnx2_napi *bnapi = &bp->bnx2_napi[0];
> +
> +			bnapi->cnic_tag = bnapi->last_status_idx;
> +		}
> +		info.cmd = CNIC_CTL_START_CMD;
> +		c_ops->cnic_ctl(bp->cnic_data, &info);
> +	}
> +	rcu_read_unlock();
> +}
> +
> +#else
> +
> +static void bnx2_setup_cnic_irq_info(struct bnx2 *bp)
> +{
> +}
> +
> +static void
> +bnx2_cnic_stop(struct bnx2 *bp)
> +{
> +}
> +
> +static void
> +bnx2_cnic_start(struct bnx2 *bp)
> +{
> +}
> +
> +#endif
> +
>  static int
>  bnx2_read_phy(struct bnx2 *bp, u32 reg, u32 *val)
>  {
> @@ -475,6 +644,7 @@ bnx2_napi_enable(struct bnx2 *bp)
>  static void
>  bnx2_netif_stop(struct bnx2 *bp)
>  {
> +	bnx2_cnic_stop(bp);
>  	bnx2_disable_int_sync(bp);
>  	if (netif_running(bp->dev)) {
>  		bnx2_napi_disable(bp);
> @@ -491,6 +661,7 @@ bnx2_netif_start(struct bnx2 *bp)
>  			netif_wake_queue(bp->dev);
>  			bnx2_napi_enable(bp);
>  			bnx2_enable_int(bp);
> +			bnx2_cnic_start(bp);
>  		}
>  	}
>  }
> @@ -3007,6 +3178,9 @@ bnx2_has_work(struct bnx2_napi *bnapi)
>  	    (sblk->status_attn_bits_ack & STATUS_ATTN_EVENTS))
>  		return 1;
> 
> +	if (bnapi->cnic_present && (bnapi->cnic_tag != sblk->status_idx))
> +		return 1;
> +
>  	return 0;
>  }
> 
> @@ -3059,6 +3233,20 @@ static int bnx2_poll_work(struct bnx2 *bp, struct bnx2_napi *bnapi,
>  	if (bnx2_get_hw_rx_cons(bnapi) != bnapi->rx_cons)
>  		work_done += bnx2_rx_int(bp, bnapi, budget - work_done);
> 
> +#ifdef BCM_CNIC
> +	if (bnapi->cnic_present) {
> +		struct cnic_ops *c_ops;
> +
> +		rcu_read_lock();
> +		c_ops = rcu_dereference(bp->cnic_ops);
> +		if (c_ops)
> +			bnapi->cnic_tag =
> +				c_ops->cnic_handler(bp->cnic_data,
> +						    bnapi->status_blk);
> +		rcu_read_unlock();
> +	}
> +#endif
> +
>  	return work_done;
>  }
> 
> @@ -3100,7 +3288,6 @@ static int bnx2_poll(struct napi_struct *napi, int budget)
>  			break;
>  		}
>  	}
> -
>  	return work_done;
>  }
> 
> @@ -5517,19 +5704,19 @@ static void
>  bnx2_enable_msix(struct bnx2 *bp)
>  {
>  	int i, rc;
> -	struct msix_entry msix_ent[BNX2_MAX_MSIX_VEC];
> +	struct msix_entry msix_ent[BNX2_MAX_MSIX_CNIC_VEC];
> 
>  	bnx2_setup_msix_tbl(bp);
>  	REG_WR(bp, BNX2_PCI_MSIX_CONTROL, BNX2_MAX_MSIX_HW_VEC - 1);
>  	REG_WR(bp, BNX2_PCI_MSIX_TBL_OFF_BIR, BNX2_PCI_GRC_WINDOW2_BASE);
>  	REG_WR(bp, BNX2_PCI_MSIX_PBA_OFF_BIT, BNX2_PCI_GRC_WINDOW3_BASE);
> 
> -	for (i = 0; i < BNX2_MAX_MSIX_VEC; i++) {
> +	for (i = 0; i < BNX2_MAX_MSIX_CNIC_VEC; i++) {
>  		msix_ent[i].entry = i;
>  		msix_ent[i].vector = 0;
>  	}
> 
> -	rc = pci_enable_msix(bp->pdev, msix_ent, BNX2_MAX_MSIX_VEC);
> +	rc = pci_enable_msix(bp->pdev, msix_ent, BNX2_MAX_MSIX_CNIC_VEC);
>  	if (rc != 0)
>  		return;
> 
> @@ -5540,10 +5727,14 @@ bnx2_enable_msix(struct bnx2 *bp)
>  	strcat(bp->irq_tbl[BNX2_BASE_VEC].name, "-base");
>  	strcpy(bp->irq_tbl[BNX2_TX_VEC].name, bp->dev->name);
>  	strcat(bp->irq_tbl[BNX2_TX_VEC].name, "-tx");
> +#ifdef BCM_CNIC
> +	strcpy(bp->irq_tbl[BNX2_CNIC_VEC].name, bp->dev->name);
> +	strcat(bp->irq_tbl[BNX2_CNIC_VEC].name, "-cnic");
> +#endif
> 
>  	bp->irq_nvecs = BNX2_MAX_MSIX_VEC;
>  	bp->flags |= BNX2_FLAG_USING_MSIX | BNX2_FLAG_ONE_SHOT_MSI;
> -	for (i = 0; i < BNX2_MAX_MSIX_VEC; i++)
> +	for (i = 0; i < BNX2_MAX_MSIX_CNIC_VEC; i++)
>  		bp->irq_tbl[i].vector = msix_ent[i].vector;
>  }
> 
> @@ -5571,6 +5762,7 @@ bnx2_setup_int_mode(struct bnx2 *bp, int dis_msi)
>  			bp->irq_tbl[0].vector = bp->pdev->irq;
>  		}
>  	}
> +	bnx2_setup_cnic_irq_info(bp);
>  }
> 
>  /* Called with rtnl_lock */
> diff --git a/drivers/net/bnx2.h b/drivers/net/bnx2.h
> index 16020a1..a47ee60 100644
> --- a/drivers/net/bnx2.h
> +++ b/drivers/net/bnx2.h
> @@ -6562,6 +6562,15 @@ struct flash_spec {
>  #define BNX2_TX_VEC		1
>  #define BNX2_TX_INT_NUM	(BNX2_TX_VEC << BNX2_PCICFG_INT_ACK_CMD_INT_NUM_SHIFT)
> 
> +#ifdef BCM_CNIC
> +#define BNX2_MAX_MSIX_CNIC_VEC	(BNX2_MAX_MSIX_VEC + 1)
> +#define BNX2_CNIC_VEC		2
> +#define BNX2_CNIC_INT_NUM	\
> +	(BNX2_CNIC_VEC << BNX2_PCICFG_INT_ACK_CMD_INT_NUM_SHIFT)
> +#else
> +#define BNX2_MAX_MSIX_CNIC_VEC	BNX2_MAX_MSIX_VEC
> +#endif
> +
>  struct bnx2_irq {
>  	irq_handler_t	handler;
>  	u16		vector;
> @@ -6577,6 +6586,9 @@ struct bnx2_napi {
>  	u32 			last_status_idx;
>  	u32			int_num;
> 
> +	u32			cnic_tag;
> +	int			cnic_present;
> +
>  	u16			tx_cons;
>  	u16			hw_tx_cons;
> 
> @@ -6648,6 +6660,11 @@ struct bnx2 {
>  	int		tx_ring_size;
>  	u32		tx_wake_thresh;
> 
> +#ifdef BCM_CNIC
> +	struct cnic_ops		*cnic_ops;
> +	void			*cnic_data;
> +#endif
> +
>  	/* End of fields used in the performance code paths. */
> 
>  	char			*name;
> @@ -6813,6 +6830,10 @@ struct bnx2 {
> 
>  	struct bnx2_irq		irq_tbl[BNX2_MAX_MSIX_VEC];
>  	int			irq_nvecs;
> +
> +#ifdef BCM_CNIC
> +	struct cnic_eth_dev	cnic_eth_dev;
> +#endif
>  };
> 
>  #define REG_RD(bp, offset)					\
> -- 
> 1.5.5.GIT
> 
> 
> 
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH 1/3] bnx2: Add support for CNIC driver.

[Michael Chan]

On Wed, 2008-05-21 at 23:45 -0700, Paul E. McKenney wrote:

> Some RCU-related questions interspersed below, for example, how are
> updates protected?

Only one CNIC driver will ever register with the BNX2 driver.  The main
purpose of using RCU is so that the fast path can avoid locking when
handling interrupt events from the hardware.

> > +
> > +static void bnx2_setup_cnic_irq_info(struct bnx2 *bp)
> > +{
> > +	struct cnic_ops *c_ops;
> > +	struct cnic_eth_dev *cp = &bp->cnic_eth_dev;
> > +	struct bnx2_napi *bnapi = &bp->bnx2_napi[0];
> > +	int sb_id;
> > +
> > +	rcu_read_lock();
> > +	c_ops = rcu_dereference(bp->cnic_ops);
> > +	if (!c_ops)
> > +		goto done;
> 
> Given that c_ops is unused below, what is happening here?  What prevents
> bp->cnic_ops from becoming NULL immediately after we test it?  And if
> it is OK for bp->cnic_ops to become NULL immediately after we test it,
> why are we bothering to test it?

You are right.  We should just unconditionally set up the IRQ
information without checking for c_ops.  The data structures we set up
below are owned by us.

> 
> > +
> > +	if (bp->flags & BNX2_FLAG_USING_MSIX) {
> > +		cp->drv_state |= CNIC_DRV_STATE_USING_MSIX;
> > +		bnapi->cnic_present = 0;
> > +		sb_id = BNX2_CNIC_VEC;
> > +		cp->irq_arr[0].irq_flags |= CNIC_IRQ_FL_MSIX;
> > +	} else {
> > +		cp->drv_state &= ~CNIC_DRV_STATE_USING_MSIX;
> > +		bnapi->cnic_tag = bnapi->last_status_idx;
> > +		bnapi->cnic_present = 1;
> > +		sb_id = 0;
> > +		cp->irq_arr[0].irq_flags &= !CNIC_IRQ_FL_MSIX;
> > +	}
> > +
> > +	cp->irq_arr[0].vector = bp->irq_tbl[sb_id].vector;
> > +	cp->irq_arr[0].status_blk = (void *) ((unsigned long) bp->status_blk +
> > +		(BNX2_SBLK_MSIX_ALIGN_SIZE * sb_id));
> > +	cp->irq_arr[0].status_blk_num = sb_id;
> > +	cp->num_irq = 1;
> > +
> > +done:
> > +	rcu_read_unlock();
> > +}
> > +
> > +static int bnx2_register_cnic(struct net_device *dev, struct cnic_ops *ops,
> > +			      void *data)
> > +{
> > +	struct bnx2 *bp = netdev_priv(dev);
> > +	struct cnic_eth_dev *cp = &bp->cnic_eth_dev;
> > +
> > +	if (ops == NULL)
> > +		return -EINVAL;
> > +
> > +	if (!try_module_get(ops->cnic_owner))
> > +		return -EBUSY;
> > +
> > +	bp->cnic_data = data;
> > +	rcu_assign_pointer(bp->cnic_ops, ops);
> 
> What prevents multiple tasks from doing this assignment concurrently?

As I said above, only one CNIC driver will ever register.

> 
> > +
> > +	cp->num_irq = 0;
> > +	cp->drv_state = CNIC_DRV_STATE_REGD;
> > +
> > +	bnx2_setup_cnic_irq_info(bp);
> > +
> > +	return 0;
> > +}
> > +
> > +static int bnx2_unregister_cnic(struct net_device *dev)
> > +{
> > +	struct bnx2 *bp = netdev_priv(dev);
> > +	struct bnx2_napi *bnapi = &bp->bnx2_napi[0];
> > +	struct cnic_eth_dev *cp = &bp->cnic_eth_dev;
> > +
> > +	cp->drv_state = 0;
> > +	module_put(bp->cnic_ops->cnic_owner);
> > +	bnapi->cnic_present = 0;
> > +	rcu_assign_pointer(bp->cnic_ops, NULL);
> 
> What prevents this from running concurrently with bnx2_register_cnic()?

We expect the CNIC driver to be well behaved and will only unregister
after successfully registered.

> 
> > +	synchronize_rcu();
> 
> The caller is responsible for freeing up the old bp->cnic_ops structure?
> Or is this structure statically allocated?
> 
> If so, is the idea to delay return until all prior calls through the
> old ops structure have completed?

The cnic_ops contain call back function pointers to the CNIC driver.  We
want to make sure that those calls have completed (in the fast path)
before continuing.

> 
> > +	return 0;
> > +}
> > +

Re: [PATCH 1/3] bnx2: Add support for CNIC driver.

[Paul E. McKenney]

On Thu, May 22, 2008 at 12:23:28PM -0700, Michael Chan wrote:
> On Wed, 2008-05-21 at 23:45 -0700, Paul E. McKenney wrote:
> 
> > Some RCU-related questions interspersed below, for example, how are
> > updates protected?
> 
> Only one CNIC driver will ever register with the BNX2 driver.  The main
> purpose of using RCU is so that the fast path can avoid locking when
> handling interrupt events from the hardware.

So if a second CNIC driver attempts to register, it gets -EBUSY or
something, right?

> > > +
> > > +static void bnx2_setup_cnic_irq_info(struct bnx2 *bp)
> > > +{
> > > +	struct cnic_ops *c_ops;
> > > +	struct cnic_eth_dev *cp = &bp->cnic_eth_dev;
> > > +	struct bnx2_napi *bnapi = &bp->bnx2_napi[0];
> > > +	int sb_id;
> > > +
> > > +	rcu_read_lock();
> > > +	c_ops = rcu_dereference(bp->cnic_ops);
> > > +	if (!c_ops)
> > > +		goto done;
> > 
> > Given that c_ops is unused below, what is happening here?  What prevents
> > bp->cnic_ops from becoming NULL immediately after we test it?  And if
> > it is OK for bp->cnic_ops to become NULL immediately after we test it,
> > why are we bothering to test it?
> 
> You are right.  We should just unconditionally set up the IRQ
> information without checking for c_ops.  The data structures we set up
> below are owned by us.

OK.  Hmmm....  You cannot even get away with sarcasm these days!  ;-)

> > > +
> > > +	if (bp->flags & BNX2_FLAG_USING_MSIX) {
> > > +		cp->drv_state |= CNIC_DRV_STATE_USING_MSIX;
> > > +		bnapi->cnic_present = 0;
> > > +		sb_id = BNX2_CNIC_VEC;
> > > +		cp->irq_arr[0].irq_flags |= CNIC_IRQ_FL_MSIX;
> > > +	} else {
> > > +		cp->drv_state &= ~CNIC_DRV_STATE_USING_MSIX;
> > > +		bnapi->cnic_tag = bnapi->last_status_idx;
> > > +		bnapi->cnic_present = 1;
> > > +		sb_id = 0;
> > > +		cp->irq_arr[0].irq_flags &= !CNIC_IRQ_FL_MSIX;
> > > +	}
> > > +
> > > +	cp->irq_arr[0].vector = bp->irq_tbl[sb_id].vector;
> > > +	cp->irq_arr[0].status_blk = (void *) ((unsigned long) bp->status_blk +
> > > +		(BNX2_SBLK_MSIX_ALIGN_SIZE * sb_id));
> > > +	cp->irq_arr[0].status_blk_num = sb_id;
> > > +	cp->num_irq = 1;
> > > +
> > > +done:
> > > +	rcu_read_unlock();
> > > +}
> > > +
> > > +static int bnx2_register_cnic(struct net_device *dev, struct cnic_ops *ops,
> > > +			      void *data)
> > > +{
> > > +	struct bnx2 *bp = netdev_priv(dev);
> > > +	struct cnic_eth_dev *cp = &bp->cnic_eth_dev;
> > > +
> > > +	if (ops == NULL)
> > > +		return -EINVAL;
> > > +
> > > +	if (!try_module_get(ops->cnic_owner))
> > > +		return -EBUSY;
> > > +
> > > +	bp->cnic_data = data;
> > > +	rcu_assign_pointer(bp->cnic_ops, ops);
> > 
> > What prevents multiple tasks from doing this assignment concurrently?
> 
> As I said above, only one CNIC driver will ever register.

OK.

> > > +
> > > +	cp->num_irq = 0;
> > > +	cp->drv_state = CNIC_DRV_STATE_REGD;
> > > +
> > > +	bnx2_setup_cnic_irq_info(bp);
> > > +
> > > +	return 0;
> > > +}
> > > +
> > > +static int bnx2_unregister_cnic(struct net_device *dev)
> > > +{
> > > +	struct bnx2 *bp = netdev_priv(dev);
> > > +	struct bnx2_napi *bnapi = &bp->bnx2_napi[0];
> > > +	struct cnic_eth_dev *cp = &bp->cnic_eth_dev;
> > > +
> > > +	cp->drv_state = 0;
> > > +	module_put(bp->cnic_ops->cnic_owner);
> > > +	bnapi->cnic_present = 0;
> > > +	rcu_assign_pointer(bp->cnic_ops, NULL);
> > 
> > What prevents this from running concurrently with bnx2_register_cnic()?
> 
> We expect the CNIC driver to be well behaved and will only unregister
> after successfully registered.

Trusting, but fair enough.  ;-)

> > > +	synchronize_rcu();
> > 
> > The caller is responsible for freeing up the old bp->cnic_ops structure?
> > Or is this structure statically allocated?
> > 
> > If so, is the idea to delay return until all prior calls through the
> > old ops structure have completed?
> 
> The cnic_ops contain call back function pointers to the CNIC driver.  We
> want to make sure that those calls have completed (in the fast path)
> before continuing.

Very good.  Could you please add a comment to that effect?  Otherwise
people search for what data structure is being freed up.

							Thanx, Paul

> > > +	return 0;
> > > +}
> > > +
> 
> 

Re: [PATCH 1/3] bnx2: Add support for CNIC driver.

[Michael Chan]

Paul E. McKenney wrote:

> So if a second CNIC driver attempts to register, it gets -EBUSY or
> something, right?

There is only one CNIC driver and it will only register once per
BNX2 netdevice.

> > You are right.  We should just unconditionally set up the IRQ
> > information without checking for c_ops.  The data 
> structures we set up
> > below are owned by us.
> 
> OK.  Hmmm....  You cannot even get away with sarcasm these days!  ;-)

Hmm, not sure what's the sarcasm.  The code here is trying to set up
the IRQ information so that CNIC driver can see it.  Even if the CNIC
driver is deregistering or was never registered, it doesn't hurt to
set up that information.

Anyway, I'll add some comments to the code to explain this better when
I respin.

> Very good.  Could you please add a comment to that effect?  Otherwise
> people search for what data structure is being freed up.
> 

Will do.  Thanks.

Re: [PATCH 1/3] bnx2: Add support for CNIC driver.

[Paul E. McKenney]

On Thu, May 22, 2008 at 09:52:48PM -0700, Michael Chan wrote:
> Paul E. McKenney wrote:
> 
> > So if a second CNIC driver attempts to register, it gets -EBUSY or
> > something, right?
> 
> There is only one CNIC driver and it will only register once per
> BNX2 netdevice.

I would nevertheless recommend keeping an error check...

> > > You are right.  We should just unconditionally set up the IRQ
> > > information without checking for c_ops.  The data 
> > structures we set up
> > > below are owned by us.
> > 
> > OK.  Hmmm....  You cannot even get away with sarcasm these days!  ;-)
> 
> Hmm, not sure what's the sarcasm.  The code here is trying to set up
> the IRQ information so that CNIC driver can see it.  Even if the CNIC
> driver is deregistering or was never registered, it doesn't hurt to
> set up that information.

The sarcasm was that I really didn't expect you to simply be able to
remove the check.  ;-)

> Anyway, I'll add some comments to the code to explain this better when
> I respin.
> 
> > Very good.  Could you please add a comment to that effect?  Otherwise
> > people search for what data structure is being freed up.
> > 
> 
> Will do.  Thanks.

Sounds good!

							Thanx, Paul

Re: [PATCH 1/3] bnx2: Add support for CNIC driver.

[Konrad Rzeszutek]

> +static void
> +bnx2_cnic_stop(struct bnx2 *bp)

The preceding functions follow this format:
static void <fnc name>(<args)

While this and some below follow the
static void
<fnc name>(<args>)

You probably want to follow one style.

[PATCH 3/3] bnx2i: Add bnx2i iSCSI driver.

[Michael Chan]

New iSCSI driver for BNX2 devices.  The driver interfaces with the
CNIC driver to access the hardware.

Signed-off-by: Anil Veerabhadrappa <anilgv-dY08KVG/lbpWk0Htik3J/w@public.gmane.org>
Signed-off-by: Michael Chan <mchan-dY08KVG/lbpWk0Htik3J/w@public.gmane.org>
---
 drivers/scsi/Kconfig                      |    2 +
 drivers/scsi/Makefile                     |    1 +
 drivers/scsi/bnx2i/57xx_iscsi_constants.h |  151 ++
 drivers/scsi/bnx2i/57xx_iscsi_hsi.h       | 1492 ++++++++++++++++++++
 drivers/scsi/bnx2i/Kconfig                |    7 +
 drivers/scsi/bnx2i/Makefile               |    3 +
 drivers/scsi/bnx2i/bnx2i.h                |  745 ++++++++++
 drivers/scsi/bnx2i/bnx2i_hwi.c            | 2112 +++++++++++++++++++++++++++++
 drivers/scsi/bnx2i/bnx2i_init.c           |  452 ++++++
 drivers/scsi/bnx2i/bnx2i_iscsi.c          | 2086 ++++++++++++++++++++++++++++
 drivers/scsi/bnx2i/bnx2i_sysfs.c          |  168 +++
 11 files changed, 7219 insertions(+), 0 deletions(-)
 create mode 100644 drivers/scsi/bnx2i/57xx_iscsi_constants.h
 create mode 100644 drivers/scsi/bnx2i/57xx_iscsi_hsi.h
 create mode 100644 drivers/scsi/bnx2i/Kconfig
 create mode 100644 drivers/scsi/bnx2i/Makefile
 create mode 100644 drivers/scsi/bnx2i/bnx2i.h
 create mode 100644 drivers/scsi/bnx2i/bnx2i_hwi.c
 create mode 100644 drivers/scsi/bnx2i/bnx2i_init.c
 create mode 100644 drivers/scsi/bnx2i/bnx2i_iscsi.c
 create mode 100644 drivers/scsi/bnx2i/bnx2i_sysfs.c

diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index 81ccbd7..22070e9 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -1757,6 +1757,8 @@ config ZFCP
           called zfcp. If you want to compile it as a module, say M here
           and read <file:Documentation/kbuild/modules.txt>.
 
+source "drivers/scsi/bnx2i/Kconfig"
+
 config SCSI_SRP
 	tristate "SCSI RDMA Protocol helper library"
 	depends on SCSI && PCI
diff --git a/drivers/scsi/Makefile b/drivers/scsi/Makefile
index 6c775e3..a3f6866 100644
--- a/drivers/scsi/Makefile
+++ b/drivers/scsi/Makefile
@@ -122,6 +122,7 @@ obj-$(CONFIG_SCSI_HPTIOP)	+= hptiop.o
 obj-$(CONFIG_SCSI_STEX)		+= stex.o
 obj-$(CONFIG_SCSI_MVSAS)	+= mvsas.o
 obj-$(CONFIG_PS3_ROM)		+= ps3rom.o
+obj-$(CONFIG_SCSI_BNX2_ISCSI)	+= bnx2i/
 
 obj-$(CONFIG_ARM)		+= arm/
 
diff --git a/drivers/scsi/bnx2i/57xx_iscsi_constants.h b/drivers/scsi/bnx2i/57xx_iscsi_constants.h
new file mode 100644
index 0000000..fd16b4a
--- /dev/null
+++ b/drivers/scsi/bnx2i/57xx_iscsi_constants.h
@@ -0,0 +1,151 @@
+/* 57xx_iscsi_constants.h: Broadcom NetXtreme II iSCSI HSI
+ *
+ * Copyright (c) 2006 - 2008 Broadcom Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation.
+ *
+ * Written by: Anil Veerabhadrappa (anilgv-dY08KVG/lbpWk0Htik3J/w@public.gmane.org)
+ */
+#ifndef __57XX_ISCSI_CONSTANTS_H_
+#define __57XX_ISCSI_CONSTANTS_H_
+
+/**
+* This file defines HSI constants for the iSCSI flows
+*/
+
+/* iSCSI request op codes */
+#define ISCSI_OPCODE_CLEANUP_REQUEST    (7)
+
+/* iSCSI response/messages op codes */
+#define ISCSI_OPCODE_CLEANUP_RESPONSE 		(0x27)
+#define ISCSI_OPCODE_NOPOUT_LOCAL_COMPLETION    (0)
+
+/* iSCSI task types */
+#define ISCSI_TASK_TYPE_READ    (0)
+#define ISCSI_TASK_TYPE_WRITE   (1)
+#define ISCSI_TASK_TYPE_MPATH   (2)
+
+/* initial CQ sequence numbers */
+#define ISCSI_INITIAL_SN    (1)
+
+/* KWQ (kernel work queue) layer codes */
+#define ISCSI_KWQE_LAYER_CODE   (6)
+
+/* KWQ (kernel work queue) request op codes */
+#define ISCSI_KWQE_OPCODE_OFFLOAD_CONN1 (0)
+#define ISCSI_KWQE_OPCODE_OFFLOAD_CONN2 (1)
+#define ISCSI_KWQE_OPCODE_UPDATE_CONN   (2)
+#define ISCSI_KWQE_OPCODE_DESTROY_CONN  (3)
+#define ISCSI_KWQE_OPCODE_INIT1         (4)
+#define ISCSI_KWQE_OPCODE_INIT2         (5)
+
+/* KCQ (kernel completion queue) response op codes */
+#define ISCSI_KCQE_OPCODE_OFFLOAD_CONN  (0x10)
+#define ISCSI_KCQE_OPCODE_UPDATE_CONN   (0x12)
+#define ISCSI_KCQE_OPCODE_DESTROY_CONN  (0x13)
+#define ISCSI_KCQE_OPCODE_INIT          (0x14)
+#define ISCSI_KCQE_OPCODE_FW_CLEAN_TASK	(0x15)
+#define ISCSI_KCQE_OPCODE_TCP_RESET     (0x16)
+#define ISCSI_KCQE_OPCODE_TCP_SYN       (0x17)
+#define ISCSI_KCQE_OPCODE_TCP_FIN       (0X18)
+#define ISCSI_KCQE_OPCODE_TCP_ERROR     (0x19)
+#define ISCSI_KCQE_OPCODE_CQ_EVENT_NOTIFICATION (0x20)
+#define ISCSI_KCQE_OPCODE_ISCSI_ERROR   (0x21)
+
+/* KCQ (kernel completion queue) completion status */
+#define ISCSI_KCQE_COMPLETION_STATUS_SUCCESS                            (0x0)
+#define ISCSI_KCQE_COMPLETION_STATUS_INVALID_OPCODE                     (0x1)
+#define ISCSI_KCQE_COMPLETION_STATUS_CTX_ALLOC_FAILURE                  (0x2)
+#define ISCSI_KCQE_COMPLETION_STATUS_CTX_FREE_FAILURE                   (0x3)
+#define ISCSI_KCQE_COMPLETION_STATUS_NIC_ERROR                          (0x4)
+
+#define ISCSI_KCQE_COMPLETION_STATUS_HDR_DIG_ERR                        (0x5)
+#define ISCSI_KCQE_COMPLETION_STATUS_DATA_DIG_ERR                       (0x6)
+
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_UNEXPECTED_OPCODE     (0xa)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_OPCODE                (0xb)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_AHS_LEN               (0xc)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_ITT                   (0xd)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_STATSN                (0xe)
+
+/* Response */
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_EXP_DATASN            (0xf)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_PEND_R2T              (0x10)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_DATA_SEG_LEN_IS_ZERO  (0x2c)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_DATA_SEG_LEN_TOO_BIG  (0x2d)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_O_U_0                 (0x11)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_O_U_1                 (0x12)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_O_U_2                 (0x13)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_O_U_3                 (0x14)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_O_U_4                 (0x15)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_O_U_5                 (0x16)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_O_U_6                 (0x17)
+
+/* Data-In */
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_REMAIN_RCV_LEN        (0x18)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_MAX_RCV_PDU_LEN       (0x19)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_F_BIT_ZERO            (0x1a)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_TTT_NOT_RSRV          (0x1b)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_DATASN                (0x1c)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_REMAIN_BURST_LEN      (0x1d)
+
+/* R2T */
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_BUFFER_OFF            (0x1f)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_LUN                   (0x20)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_R2TSN                 (0x21)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_DESIRED_DATA_TRNS_LEN_0 (0x22)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_DESIRED_DATA_TRNS_LEN_1 (0x23)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_PEND_R2T_EXCEED       (0x24)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_TTT_IS_RSRV           (0x25)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_MAX_BURST_LEN         (0x26)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_DATA_SEG_LEN_NOT_ZERO (0x27)
+
+/* TMF */
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_REJECT_PDU_LEN        (0x28)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_ASYNC_PDU_LEN         (0x29)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_NOPIN_PDU_LEN         (0x2a)
+#define ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_PEND_R2T_IN_CLEANUP   (0x2b)
+
+/* IP/TCP processing errors: */
+#define ISCI_KCQE_COMPLETION_STATUS_TCP_ERROR_IP_FRAGMENT               (0x40)
+#define ISCI_KCQE_COMPLETION_STATUS_TCP_ERROR_IP_OPTIONS                (0x41)
+#define ISCI_KCQE_COMPLETION_STATUS_TCP_ERROR_URGENT_FLAG               (0x42)
+#define ISCI_KCQE_COMPLETION_STATUS_TCP_ERROR_MAX_RTRANS                (0x43)
+
+/* iSCSI licensing errors */
+/* general iSCSI license not installed */
+#define ISCSI_KCQE_COMPLETION_STATUS_ISCSI_NOT_SUPPORTED                (0x50)
+/* additional LOM specific iSCSI license not installed */
+#define ISCSI_KCQE_COMPLETION_STATUS_LOM_ISCSI_NOT_ENABLED              (0x51)
+
+/* SQ/RQ/CQ DB structure sizes */
+#define ISCSI_SQ_DB_SIZE    (16)
+#define ISCSI_RQ_DB_SIZE    (16)
+#define ISCSI_CQ_DB_SIZE    (80)
+
+/* Page size codes (for flags field in connection offload request) */
+#define ISCSI_PAGE_SIZE_256     (0)
+#define ISCSI_PAGE_SIZE_512     (1)
+#define ISCSI_PAGE_SIZE_1K      (2)
+#define ISCSI_PAGE_SIZE_2K      (3)
+#define ISCSI_PAGE_SIZE_4K      (4)
+#define ISCSI_PAGE_SIZE_8K      (5)
+#define ISCSI_PAGE_SIZE_16K     (6)
+#define ISCSI_PAGE_SIZE_32K     (7)
+#define ISCSI_PAGE_SIZE_64K     (8)
+#define ISCSI_PAGE_SIZE_128K    (9)
+#define ISCSI_PAGE_SIZE_256K    (10)
+#define ISCSI_PAGE_SIZE_512K    (11)
+#define ISCSI_PAGE_SIZE_1M      (12)
+#define ISCSI_PAGE_SIZE_2M      (13)
+#define ISCSI_PAGE_SIZE_4M      (14)
+#define ISCSI_PAGE_SIZE_8M      (15)
+
+/* Iscsi PDU related defines */
+#define ISCSI_HEADER_SIZE   (48)
+#define ISCSI_DIGEST_SHIFT  (2)
+#define ISCSI_DIGEST_SIZE   (4)
+
+#endif /*__57XX_ISCSI_CONSTANTS_H_ */
diff --git a/drivers/scsi/bnx2i/57xx_iscsi_hsi.h b/drivers/scsi/bnx2i/57xx_iscsi_hsi.h
new file mode 100644
index 0000000..c99512b
--- /dev/null
+++ b/drivers/scsi/bnx2i/57xx_iscsi_hsi.h
@@ -0,0 +1,1492 @@
+/* 57xx_iscsi_hsi.h: Broadcom NetXtreme II iSCSI HSI.
+ *
+ * Copyright (c) 2006 - 2008 Broadcom Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation.
+ *
+ * Written by: Anil Veerabhadrappa (anilgv-dY08KVG/lbpWk0Htik3J/w@public.gmane.org)
+ */
+#ifndef __57XX_ISCSI_HSI_LINUX_LE__
+#define __57XX_ISCSI_HSI_LINUX_LE__
+
+/*
+ * iSCSI Async CQE
+ */
+struct bnx2i_async_msg {
+#if defined(__BIG_ENDIAN)
+	u8 op_code;
+	u8 reserved1;
+	u16 reserved0;
+#elif defined(__LITTLE_ENDIAN)
+	u16 reserved0;
+	u8 reserved1;
+	u8 op_code;
+#endif
+	u32 reserved2;
+	u32 exp_cmd_sn;
+	u32 max_cmd_sn;
+	u32 reserved3[2];
+#if defined(__BIG_ENDIAN)
+	u16 reserved5;
+	u8 err_code;
+	u8 reserved4;
+#elif defined(__LITTLE_ENDIAN)
+	u8 reserved4;
+	u8 err_code;
+	u16 reserved5;
+#endif
+	u32 reserved6;
+	u32 lun[2];
+#if defined(__BIG_ENDIAN)
+	u8 async_event;
+	u8 async_vcode;
+	u16 param1;
+#elif defined(__LITTLE_ENDIAN)
+	u16 param1;
+	u8 async_vcode;
+	u8 async_event;
+#endif
+#if defined(__BIG_ENDIAN)
+	u16 param2;
+	u16 param3;
+#elif defined(__LITTLE_ENDIAN)
+	u16 param3;
+	u16 param2;
+#endif
+	u32 reserved7[3];
+	u32 cq_req_sn;
+};
+
+
+/*
+ * iSCSI Buffer Descriptor (BD)
+ */
+struct iscsi_bd {
+	u32 buffer_addr_hi;
+	u32 buffer_addr_lo;
+#if defined(__BIG_ENDIAN)
+	u16 reserved0;
+	u16 buffer_length;
+#elif defined(__LITTLE_ENDIAN)
+	u16 buffer_length;
+	u16 reserved0;
+#endif
+#if defined(__BIG_ENDIAN)
+	u16 reserved3;
+	u16 flags;
+#define ISCSI_BD_RESERVED1 (0x3F<<0)
+#define ISCSI_BD_RESERVED1_SHIFT 0
+#define ISCSI_BD_LAST_IN_BD_CHAIN (0x1<<6)
+#define ISCSI_BD_LAST_IN_BD_CHAIN_SHIFT 6
+#define ISCSI_BD_FIRST_IN_BD_CHAIN (0x1<<7)
+#define ISCSI_BD_FIRST_IN_BD_CHAIN_SHIFT 7
+#define ISCSI_BD_RESERVED2 (0xFF<<8)
+#define ISCSI_BD_RESERVED2_SHIFT 8
+#elif defined(__LITTLE_ENDIAN)
+	u16 flags;
+#define ISCSI_BD_RESERVED1 (0x3F<<0)
+#define ISCSI_BD_RESERVED1_SHIFT 0
+#define ISCSI_BD_LAST_IN_BD_CHAIN (0x1<<6)
+#define ISCSI_BD_LAST_IN_BD_CHAIN_SHIFT 6
+#define ISCSI_BD_FIRST_IN_BD_CHAIN (0x1<<7)
+#define ISCSI_BD_FIRST_IN_BD_CHAIN_SHIFT 7
+#define ISCSI_BD_RESERVED2 (0xFF<<8)
+#define ISCSI_BD_RESERVED2_SHIFT 8
+	u16 reserved3;
+#endif
+};
+
+
+/*
+ * iSCSI Cleanup SQ WQE
+ */
+struct bnx2i_cleanup_request {
+#if defined(__BIG_ENDIAN)
+	u8 op_code;
+	u8 reserved1;
+	u16 reserved0;
+#elif defined(__LITTLE_ENDIAN)
+	u16 reserved0;
+	u8 reserved1;
+	u8 op_code;
+#endif
+	u32 reserved2[3];
+#if defined(__BIG_ENDIAN)
+	u16 reserved3;
+	u16 itt;
+#define ISCSI_CLEANUP_REQUEST_INDEX (0x3FFF<<0)
+#define ISCSI_CLEANUP_REQUEST_INDEX_SHIFT 0
+#define ISCSI_CLEANUP_REQUEST_TYPE (0x3<<14)
+#define ISCSI_CLEANUP_REQUEST_TYPE_SHIFT 14
+#elif defined(__LITTLE_ENDIAN)
+	u16 itt;
+#define ISCSI_CLEANUP_REQUEST_INDEX (0x3FFF<<0)
+#define ISCSI_CLEANUP_REQUEST_INDEX_SHIFT 0
+#define ISCSI_CLEANUP_REQUEST_TYPE (0x3<<14)
+#define ISCSI_CLEANUP_REQUEST_TYPE_SHIFT 14
+	u16 reserved3;
+#endif
+	u32 reserved4[10];
+#if defined(__BIG_ENDIAN)
+	u8 cq_index;
+	u8 reserved6;
+	u16 reserved5;
+#elif defined(__LITTLE_ENDIAN)
+	u16 reserved5;
+	u8 reserved6;
+	u8 cq_index;
+#endif
+};
+
+
+/*
+ * iSCSI Cleanup CQE
+ */
+struct bnx2i_cleanup_response {
+#if defined(__BIG_ENDIAN)
+	u8 op_code;
+	u8 status;
+	u16 reserved0;
+#elif defined(__LITTLE_ENDIAN)
+	u16 reserved0;
+	u8 status;
+	u8 op_code;
+#endif
+	u32 reserved1[3];
+	u32 reserved2[2];
+#if defined(__BIG_ENDIAN)
+	u16 reserved4;
+	u8 err_code;
+	u8 reserved3;
+#elif defined(__LITTLE_ENDIAN)
+	u8 reserved3;
+	u8 err_code;
+	u16 reserved4;
+#endif
+	u32 reserved5[7];
+#if defined(__BIG_ENDIAN)
+	u16 reserved6;
+	u16 itt;
+#define ISCSI_CLEANUP_RESPONSE_INDEX (0x3FFF<<0)
+#define ISCSI_CLEANUP_RESPONSE_INDEX_SHIFT 0
+#define ISCSI_CLEANUP_RESPONSE_TYPE (0x3<<14)
+#define ISCSI_CLEANUP_RESPONSE_TYPE_SHIFT 14
+#elif defined(__LITTLE_ENDIAN)
+	u16 itt;
+#define ISCSI_CLEANUP_RESPONSE_INDEX (0x3FFF<<0)
+#define ISCSI_CLEANUP_RESPONSE_INDEX_SHIFT 0
+#define ISCSI_CLEANUP_RESPONSE_TYPE (0x3<<14)
+#define ISCSI_CLEANUP_RESPONSE_TYPE_SHIFT 14
+	u16 reserved6;
+#endif
+	u32 cq_req_sn;
+};
+
+
+/*
+ * SCSI read/write SQ WQE
+ */
+struct bnx2i_cmd_request {
+#if defined(__BIG_ENDIAN)
+	u8 op_code;
+	u8 op_attr;
+#define ISCSI_CMD_REQUEST_TASK_ATTR (0x7<<0)
+#define ISCSI_CMD_REQUEST_TASK_ATTR_SHIFT 0
+#define ISCSI_CMD_REQUEST_RESERVED1 (0x3<<3)
+#define ISCSI_CMD_REQUEST_RESERVED1_SHIFT 3
+#define ISCSI_CMD_REQUEST_WRITE (0x1<<5)
+#define ISCSI_CMD_REQUEST_WRITE_SHIFT 5
+#define ISCSI_CMD_REQUEST_READ (0x1<<6)
+#define ISCSI_CMD_REQUEST_READ_SHIFT 6
+#define ISCSI_CMD_REQUEST_FINAL (0x1<<7)
+#define ISCSI_CMD_REQUEST_FINAL_SHIFT 7
+	u16 reserved0;
+#elif defined(__LITTLE_ENDIAN)
+	u16 reserved0;
+	u8 op_attr;
+#define ISCSI_CMD_REQUEST_TASK_ATTR (0x7<<0)
+#define ISCSI_CMD_REQUEST_TASK_ATTR_SHIFT 0
+#define ISCSI_CMD_REQUEST_RESERVED1 (0x3<<3)
+#define ISCSI_CMD_REQUEST_RESERVED1_SHIFT 3
+#define ISCSI_CMD_REQUEST_WRITE (0x1<<5)
+#define ISCSI_CMD_REQUEST_WRITE_SHIFT 5
+#define ISCSI_CMD_REQUEST_READ (0x1<<6)
+#define ISCSI_CMD_REQUEST_READ_SHIFT 6
+#define ISCSI_CMD_REQUEST_FINAL (0x1<<7)
+#define ISCSI_CMD_REQUEST_FINAL_SHIFT 7
+	u8 op_code;
+#endif
+#if defined(__BIG_ENDIAN)
+	u16 ud_buffer_offset;
+	u16 sd_buffer_offset;
+#elif defined(__LITTLE_ENDIAN)
+	u16 sd_buffer_offset;
+	u16 ud_buffer_offset;
+#endif
+	u32 lun[2];
+#if defined(__BIG_ENDIAN)
+	u16 reserved2;
+	u16 itt;
+#define ISCSI_CMD_REQUEST_INDEX (0x3FFF<<0)
+#define ISCSI_CMD_REQUEST_INDEX_SHIFT 0
+#define ISCSI_CMD_REQUEST_TYPE (0x3<<14)
+#define ISCSI_CMD_REQUEST_TYPE_SHIFT 14
+#elif defined(__LITTLE_ENDIAN)
+	u16 itt;
+#define ISCSI_CMD_REQUEST_INDEX (0x3FFF<<0)
+#define ISCSI_CMD_REQUEST_INDEX_SHIFT 0
+#define ISCSI_CMD_REQUEST_TYPE (0x3<<14)
+#define ISCSI_CMD_REQUEST_TYPE_SHIFT 14
+	u16 reserved2;
+#endif
+	u32 total_data_transfer_length;
+	u32 cmd_sn;
+	u32 reserved3;
+	u32 cdb[4];
+	u32 zero_fill;
+	u32 bd_list_addr_lo;
+	u32 bd_list_addr_hi;
+#if defined(__BIG_ENDIAN)
+	u8 cq_index;
+	u8 sd_start_bd_index;
+	u8 ud_start_bd_index;
+	u8 num_bds;
+#elif defined(__LITTLE_ENDIAN)
+	u8 num_bds;
+	u8 ud_start_bd_index;
+	u8 sd_start_bd_index;
+	u8 cq_index;
+#endif
+};
+
+
+/*
+ * task statistics for write response
+ */
+struct bnx2i_write_resp_task_stat {
+	u32 num_data_ins;
+};
+
+/*
+ * task statistics for read response
+ */
+struct bnx2i_read_resp_task_stat {
+#if defined(__BIG_ENDIAN)
+	u16 num_data_outs;
+	u16 num_r2ts;
+#elif defined(__LITTLE_ENDIAN)
+	u16 num_r2ts;
+	u16 num_data_outs;
+#endif
+};
+
+/*
+ * task statistics for iSCSI cmd response
+ */
+union bnx2i_cmd_resp_task_stat {
+	struct bnx2i_write_resp_task_stat write_stat;
+	struct bnx2i_read_resp_task_stat read_stat;
+};
+
+/*
+ * SCSI Command CQE
+ */
+struct bnx2i_cmd_response {
+#if defined(__BIG_ENDIAN)
+	u8 op_code;
+	u8 response_flags;
+#define ISCSI_CMD_RESPONSE_RESERVED0 (0x1<<0)
+#define ISCSI_CMD_RESPONSE_RESERVED0_SHIFT 0
+#define ISCSI_CMD_RESPONSE_RESIDUAL_UNDERFLOW (0x1<<1)
+#define ISCSI_CMD_RESPONSE_RESIDUAL_UNDERFLOW_SHIFT 1
+#define ISCSI_CMD_RESPONSE_RESIDUAL_OVERFLOW (0x1<<2)
+#define ISCSI_CMD_RESPONSE_RESIDUAL_OVERFLOW_SHIFT 2
+#define ISCSI_CMD_RESPONSE_BR_RESIDUAL_UNDERFLOW (0x1<<3)
+#define ISCSI_CMD_RESPONSE_BR_RESIDUAL_UNDERFLOW_SHIFT 3
+#define ISCSI_CMD_RESPONSE_BR_RESIDUAL_OVERFLOW (0x1<<4)
+#define ISCSI_CMD_RESPONSE_BR_RESIDUAL_OVERFLOW_SHIFT 4
+#define ISCSI_CMD_RESPONSE_RESERVED1 (0x7<<5)
+#define ISCSI_CMD_RESPONSE_RESERVED1_SHIFT 5
+	u8 response;
+	u8 status;
+#elif defined(__LITTLE_ENDIAN)
+	u8 status;
+	u8 response;
+	u8 response_flags;
+#define ISCSI_CMD_RESPONSE_RESERVED0 (0x1<<0)
+#define ISCSI_CMD_RESPONSE_RESERVED0_SHIFT 0
+#define ISCSI_CMD_RESPONSE_RESIDUAL_UNDERFLOW (0x1<<1)
+#define ISCSI_CMD_RESPONSE_RESIDUAL_UNDERFLOW_SHIFT 1
+#define ISCSI_CMD_RESPONSE_RESIDUAL_OVERFLOW (0x1<<2)
+#define ISCSI_CMD_RESPONSE_RESIDUAL_OVERFLOW_SHIFT 2
+#define ISCSI_CMD_RESPONSE_BR_RESIDUAL_UNDERFLOW (0x1<<3)
+#define ISCSI_CMD_RESPONSE_BR_RESIDUAL_UNDERFLOW_SHIFT 3
+#define ISCSI_CMD_RESPONSE_BR_RESIDUAL_OVERFLOW (0x1<<4)
+#define ISCSI_CMD_RESPONSE_BR_RESIDUAL_OVERFLOW_SHIFT 4
+#define ISCSI_CMD_RESPONSE_RESERVED1 (0x7<<5)
+#define ISCSI_CMD_RESPONSE_RESERVED1_SHIFT 5
+	u8 op_code;
+#endif
+	u32 data_length;
+	u32 exp_cmd_sn;
+	u32 max_cmd_sn;
+	u32 reserved2;
+	u32 residual_count;
+#if defined(__BIG_ENDIAN)
+	u16 reserved4;
+	u8 err_code;
+	u8 reserved3;
+#elif defined(__LITTLE_ENDIAN)
+	u8 reserved3;
+	u8 err_code;
+	u16 reserved4;
+#endif
+	u32 reserved5[5];
+	union bnx2i_cmd_resp_task_stat task_stat;
+	u32 reserved6;
+#if defined(__BIG_ENDIAN)
+	u16 reserved7;
+	u16 itt;
+#define ISCSI_CMD_RESPONSE_INDEX (0x3FFF<<0)
+#define ISCSI_CMD_RESPONSE_INDEX_SHIFT 0
+#define ISCSI_CMD_RESPONSE_TYPE (0x3<<14)
+#define ISCSI_CMD_RESPONSE_TYPE_SHIFT 14
+#elif defined(__LITTLE_ENDIAN)
+	u16 itt;
+#define ISCSI_CMD_RESPONSE_INDEX (0x3FFF<<0)
+#define ISCSI_CMD_RESPONSE_INDEX_SHIFT 0
+#define ISCSI_CMD_RESPONSE_TYPE (0x3<<14)
+#define ISCSI_CMD_RESPONSE_TYPE_SHIFT 14
+	u16 reserved7;
+#endif
+	u32 cq_req_sn;
+};
+
+
+
+/*
+ * firmware middle-path request SQ WQE
+ */
+struct bnx2i_fw_mp_request {
+#if defined(__BIG_ENDIAN)
+	u8 op_code;
+	u8 op_attr;
+	u16 hdr_opaque1;
+#elif defined(__LITTLE_ENDIAN)
+	u16 hdr_opaque1;
+	u8 op_attr;
+	u8 op_code;
+#endif
+	u32 data_length;
+	u32 hdr_opaque2[2];
+#if defined(__BIG_ENDIAN)
+	u16 reserved0;
+	u16 itt;
+#define ISCSI_FW_MP_REQUEST_INDEX (0x3FFF<<0)
+#define ISCSI_FW_MP_REQUEST_INDEX_SHIFT 0
+#define ISCSI_FW_MP_REQUEST_TYPE (0x3<<14)
+#define ISCSI_FW_MP_REQUEST_TYPE_SHIFT 14
+#elif defined(__LITTLE_ENDIAN)
+	u16 itt;
+#define ISCSI_FW_MP_REQUEST_INDEX (0x3FFF<<0)
+#define ISCSI_FW_MP_REQUEST_INDEX_SHIFT 0
+#define ISCSI_FW_MP_REQUEST_TYPE (0x3<<14)
+#define ISCSI_FW_MP_REQUEST_TYPE_SHIFT 14
+	u16 reserved0;
+#endif
+	u32 hdr_opaque3[4];
+	u32 resp_bd_list_addr_lo;
+	u32 resp_bd_list_addr_hi;
+	u32 resp_buffer;
+#define ISCSI_FW_MP_REQUEST_RESP_BUFFER_LENGTH (0xFFFFFF<<0)
+#define ISCSI_FW_MP_REQUEST_RESP_BUFFER_LENGTH_SHIFT 0
+#define ISCSI_FW_MP_REQUEST_NUM_RESP_BDS (0xFF<<24)
+#define ISCSI_FW_MP_REQUEST_NUM_RESP_BDS_SHIFT 24
+#if defined(__BIG_ENDIAN)
+	u16 reserved4;
+	u8 reserved3;
+	u8 flags;
+#define ISCSI_FW_MP_REQUEST_RESERVED1 (0x1<<0)
+#define ISCSI_FW_MP_REQUEST_RESERVED1_SHIFT 0
+#define ISCSI_FW_MP_REQUEST_LOCAL_COMPLETION (0x1<<1)
+#define ISCSI_FW_MP_REQUEST_LOCAL_COMPLETION_SHIFT 1
+#define ISCSI_FW_MP_REQUEST_UPDATE_EXP_STAT_SN (0x1<<2)
+#define ISCSI_FW_MP_REQUEST_UPDATE_EXP_STAT_SN_SHIFT 2
+#define ISCSI_FW_MP_REQUEST_RESERVED2 (0x1F<<3)
+#define ISCSI_FW_MP_REQUEST_RESERVED2_SHIFT 3
+#elif defined(__LITTLE_ENDIAN)
+	u8 flags;
+#define ISCSI_FW_MP_REQUEST_RESERVED1 (0x1<<0)
+#define ISCSI_FW_MP_REQUEST_RESERVED1_SHIFT 0
+#define ISCSI_FW_MP_REQUEST_LOCAL_COMPLETION (0x1<<1)
+#define ISCSI_FW_MP_REQUEST_LOCAL_COMPLETION_SHIFT 1
+#define ISCSI_FW_MP_REQUEST_UPDATE_EXP_STAT_SN (0x1<<2)
+#define ISCSI_FW_MP_REQUEST_UPDATE_EXP_STAT_SN_SHIFT 2
+#define ISCSI_FW_MP_REQUEST_RESERVED2 (0x1F<<3)
+#define ISCSI_FW_MP_REQUEST_RESERVED2_SHIFT 3
+	u8 reserved3;
+	u16 reserved4;
+#endif
+	u32 bd_list_addr_lo;
+	u32 bd_list_addr_hi;
+#if defined(__BIG_ENDIAN)
+	u8 cq_index;
+	u8 reserved6;
+	u8 reserved5;
+	u8 num_bds;
+#elif defined(__LITTLE_ENDIAN)
+	u8 num_bds;
+	u8 reserved5;
+	u8 reserved6;
+	u8 cq_index;
+#endif
+};
+
+
+/*
+ * firmware response - CQE: used only by firmware
+ */
+struct bnx2i_fw_response {
+	u32 hdr_dword1[2];
+	u32 hdr_exp_cmd_sn;
+	u32 hdr_max_cmd_sn;
+	u32 hdr_ttt;
+	u32 hdr_res_cnt;
+	u32 cqe_flags;
+#define ISCSI_FW_RESPONSE_RESERVED2 (0xFF<<0)
+#define ISCSI_FW_RESPONSE_RESERVED2_SHIFT 0
+#define ISCSI_FW_RESPONSE_ERR_CODE (0xFF<<8)
+#define ISCSI_FW_RESPONSE_ERR_CODE_SHIFT 8
+#define ISCSI_FW_RESPONSE_RESERVED3 (0xFFFF<<16)
+#define ISCSI_FW_RESPONSE_RESERVED3_SHIFT 16
+	u32 stat_sn;
+	u32 hdr_dword2[2];
+	u32 hdr_dword3[2];
+	u32 task_stat;
+	u32 reserved0;
+	u32 hdr_itt;
+	u32 cq_req_sn;
+};
+
+
+/*
+ * iSCSI KCQ CQE parameters
+ */
+union iscsi_kcqe_params {
+	u32 reserved0[4];
+};
+
+/*
+ * iSCSI KCQ CQE
+ */
+struct iscsi_kcqe {
+	u32 iscsi_conn_id;
+	u32 completion_status;
+	u32 iscsi_conn_context_id;
+	union iscsi_kcqe_params params;
+#if defined(__BIG_ENDIAN)
+	u8 flags;
+#define ISCSI_KCQE_RESERVED0 (0xF<<0)
+#define ISCSI_KCQE_RESERVED0_SHIFT 0
+#define ISCSI_KCQE_LAYER_CODE (0x7<<4)
+#define ISCSI_KCQE_LAYER_CODE_SHIFT 4
+#define ISCSI_KCQE_RESERVED1 (0x1<<7)
+#define ISCSI_KCQE_RESERVED1_SHIFT 7
+	u8 op_code;
+	u16 qe_self_seq;
+#elif defined(__LITTLE_ENDIAN)
+	u16 qe_self_seq;
+	u8 op_code;
+	u8 flags;
+#define ISCSI_KCQE_RESERVED0 (0xF<<0)
+#define ISCSI_KCQE_RESERVED0_SHIFT 0
+#define ISCSI_KCQE_LAYER_CODE (0x7<<4)
+#define ISCSI_KCQE_LAYER_CODE_SHIFT 4
+#define ISCSI_KCQE_RESERVED1 (0x1<<7)
+#define ISCSI_KCQE_RESERVED1_SHIFT 7
+#endif
+};
+
+
+
+/*
+ * iSCSI KWQE header
+ */
+struct iscsi_kwqe_header {
+#if defined(__BIG_ENDIAN)
+	u8 flags;
+#define ISCSI_KWQE_HEADER_RESERVED0 (0xF<<0)
+#define ISCSI_KWQE_HEADER_RESERVED0_SHIFT 0
+#define ISCSI_KWQE_HEADER_LAYER_CODE (0x7<<4)
+#define ISCSI_KWQE_HEADER_LAYER_CODE_SHIFT 4
+#define ISCSI_KWQE_HEADER_RESERVED1 (0x1<<7)
+#define ISCSI_KWQE_HEADER_RESERVED1_SHIFT 7
+	u8 op_code;
+#elif defined(__LITTLE_ENDIAN)
+	u8 op_code;
+	u8 flags;
+#define ISCSI_KWQE_HEADER_RESERVED0 (0xF<<0)
+#define ISCSI_KWQE_HEADER_RESERVED0_SHIFT 0
+#define ISCSI_KWQE_HEADER_LAYER_CODE (0x7<<4)
+#define ISCSI_KWQE_HEADER_LAYER_CODE_SHIFT 4
+#define ISCSI_KWQE_HEADER_RESERVED1 (0x1<<7)
+#define ISCSI_KWQE_HEADER_RESERVED1_SHIFT 7
+#endif
+};
+
+/*
+ * iSCSI firmware init request 1
+ */
+struct iscsi_kwqe_init1 {
+#if defined(__BIG_ENDIAN)
+	struct iscsi_kwqe_header hdr;
+	u8 reserved0;
+	u8 num_cqs;
+#elif defined(__LITTLE_ENDIAN)
+	u8 num_cqs;
+	u8 reserved0;
+	struct iscsi_kwqe_header hdr;
+#endif
+	u32 dummy_buffer_addr_lo;
+	u32 dummy_buffer_addr_hi;
+#if defined(__BIG_ENDIAN)
+	u16 num_ccells_per_conn;
+	u16 num_tasks_per_conn;
+#elif defined(__LITTLE_ENDIAN)
+	u16 num_tasks_per_conn;
+	u16 num_ccells_per_conn;
+#endif
+#if defined(__BIG_ENDIAN)
+	u16 sq_wqes_per_page;
+	u16 sq_num_wqes;
+#elif defined(__LITTLE_ENDIAN)
+	u16 sq_num_wqes;
+	u16 sq_wqes_per_page;
+#endif
+#if defined(__BIG_ENDIAN)
+	u8 cq_log_wqes_per_page;
+	u8 flags;
+#define ISCSI_KWQE_INIT1_PAGE_SIZE (0xF<<0)
+#define ISCSI_KWQE_INIT1_PAGE_SIZE_SHIFT 0
+#define ISCSI_KWQE_INIT1_DELAYED_ACK_ENABLE (0x1<<4)
+#define ISCSI_KWQE_INIT1_DELAYED_ACK_ENABLE_SHIFT 4
+#define ISCSI_KWQE_INIT1_KEEP_ALIVE_ENABLE (0x1<<5)
+#define ISCSI_KWQE_INIT1_KEEP_ALIVE_ENABLE_SHIFT 5
+#define ISCSI_KWQE_INIT1_RESERVED1 (0x3<<6)
+#define ISCSI_KWQE_INIT1_RESERVED1_SHIFT 6
+	u16 cq_num_wqes;
+#elif defined(__LITTLE_ENDIAN)
+	u16 cq_num_wqes;
+	u8 flags;
+#define ISCSI_KWQE_INIT1_PAGE_SIZE (0xF<<0)
+#define ISCSI_KWQE_INIT1_PAGE_SIZE_SHIFT 0
+#define ISCSI_KWQE_INIT1_DELAYED_ACK_ENABLE (0x1<<4)
+#define ISCSI_KWQE_INIT1_DELAYED_ACK_ENABLE_SHIFT 4
+#define ISCSI_KWQE_INIT1_KEEP_ALIVE_ENABLE (0x1<<5)
+#define ISCSI_KWQE_INIT1_KEEP_ALIVE_ENABLE_SHIFT 5
+#define ISCSI_KWQE_INIT1_RESERVED1 (0x3<<6)
+#define ISCSI_KWQE_INIT1_RESERVED1_SHIFT 6
+	u8 cq_log_wqes_per_page;
+#endif
+#if defined(__BIG_ENDIAN)
+	u16 cq_num_pages;
+	u16 sq_num_pages;
+#elif defined(__LITTLE_ENDIAN)
+	u16 sq_num_pages;
+	u16 cq_num_pages;
+#endif
+#if defined(__BIG_ENDIAN)
+	u16 rq_buffer_size;
+	u16 rq_num_wqes;
+#elif defined(__LITTLE_ENDIAN)
+	u16 rq_num_wqes;
+	u16 rq_buffer_size;
+#endif
+};
+
+/*
+ * iSCSI firmware init request 2
+ */
+struct iscsi_kwqe_init2 {
+#if defined(__BIG_ENDIAN)
+	struct iscsi_kwqe_header hdr;
+	u16 max_cq_sqn;
+#elif defined(__LITTLE_ENDIAN)
+	u16 max_cq_sqn;
+	struct iscsi_kwqe_header hdr;
+#endif
+	u32 error_bit_map[2];
+	u32 reserved1[5];
+};
+
+/*
+ * Initial iSCSI connection offload request 1
+ */
+struct iscsi_kwqe_conn_offload1 {
+#if defined(__BIG_ENDIAN)
+	struct iscsi_kwqe_header hdr;
+	u16 iscsi_conn_id;
+#elif defined(__LITTLE_ENDIAN)
+	u16 iscsi_conn_id;
+	struct iscsi_kwqe_header hdr;
+#endif
+	u32 sq_page_table_addr_lo;
+	u32 sq_page_table_addr_hi;
+	u32 cq_page_table_addr_lo;
+	u32 cq_page_table_addr_hi;
+	u32 reserved0[3];
+};
+
+/*
+ * iSCSI Page Table Entry (PTE)
+ */
+struct iscsi_pte {
+	u32 hi;
+	u32 lo;
+};
+
+/*
+ * Initial iSCSI connection offload request 2
+ */
+struct iscsi_kwqe_conn_offload2 {
+#if defined(__BIG_ENDIAN)
+	struct iscsi_kwqe_header hdr;
+	u16 reserved0;
+#elif defined(__LITTLE_ENDIAN)
+	u16 reserved0;
+	struct iscsi_kwqe_header hdr;
+#endif
+	u32 rq_page_table_addr_lo;
+	u32 rq_page_table_addr_hi;
+	struct iscsi_pte sq_first_pte;
+	struct iscsi_pte cq_first_pte;
+	u32 reserved1;
+};
+
+/*
+ * iSCSI connection update request
+ */
+struct iscsi_kwqe_conn_update {
+#if defined(__BIG_ENDIAN)
+	struct iscsi_kwqe_header hdr;
+	u16 reserved0;
+#elif defined(__LITTLE_ENDIAN)
+	u16 reserved0;
+	struct iscsi_kwqe_header hdr;
+#endif
+#if defined(__BIG_ENDIAN)
+	u8 session_error_recovery_level;
+	u8 max_outstanding_r2ts;
+	u8 reserved2;
+	u8 conn_flags;
+#define ISCSI_KWQE_CONN_UPDATE_HEADER_DIGEST (0x1<<0)
+#define ISCSI_KWQE_CONN_UPDATE_HEADER_DIGEST_SHIFT 0
+#define ISCSI_KWQE_CONN_UPDATE_DATA_DIGEST (0x1<<1)
+#define ISCSI_KWQE_CONN_UPDATE_DATA_DIGEST_SHIFT 1
+#define ISCSI_KWQE_CONN_UPDATE_INITIAL_R2T (0x1<<2)
+#define ISCSI_KWQE_CONN_UPDATE_INITIAL_R2T_SHIFT 2
+#define ISCSI_KWQE_CONN_UPDATE_IMMEDIATE_DATA (0x1<<3)
+#define ISCSI_KWQE_CONN_UPDATE_IMMEDIATE_DATA_SHIFT 3
+#define ISCSI_KWQE_CONN_UPDATE_RESERVED1 (0xF<<4)
+#define ISCSI_KWQE_CONN_UPDATE_RESERVED1_SHIFT 4
+#elif defined(__LITTLE_ENDIAN)
+	u8 conn_flags;
+#define ISCSI_KWQE_CONN_UPDATE_HEADER_DIGEST (0x1<<0)
+#define ISCSI_KWQE_CONN_UPDATE_HEADER_DIGEST_SHIFT 0
+#define ISCSI_KWQE_CONN_UPDATE_DATA_DIGEST (0x1<<1)
+#define ISCSI_KWQE_CONN_UPDATE_DATA_DIGEST_SHIFT 1
+#define ISCSI_KWQE_CONN_UPDATE_INITIAL_R2T (0x1<<2)
+#define ISCSI_KWQE_CONN_UPDATE_INITIAL_R2T_SHIFT 2
+#define ISCSI_KWQE_CONN_UPDATE_IMMEDIATE_DATA (0x1<<3)
+#define ISCSI_KWQE_CONN_UPDATE_IMMEDIATE_DATA_SHIFT 3
+#define ISCSI_KWQE_CONN_UPDATE_RESERVED1 (0xF<<4)
+#define ISCSI_KWQE_CONN_UPDATE_RESERVED1_SHIFT 4
+	u8 reserved2;
+	u8 max_outstanding_r2ts;
+	u8 session_error_recovery_level;
+#endif
+	u32 context_id;
+	u32 max_send_pdu_length;
+	u32 max_recv_pdu_length;
+	u32 first_burst_length;
+	u32 max_burst_length;
+	u32 exp_stat_sn;
+};
+
+/*
+ * iSCSI destroy connection request
+ */
+struct iscsi_kwqe_conn_destroy {
+#if defined(__BIG_ENDIAN)
+	struct iscsi_kwqe_header hdr;
+	u16 reserved0;
+#elif defined(__LITTLE_ENDIAN)
+	u16 reserved0;
+	struct iscsi_kwqe_header hdr;
+#endif
+	u32 context_id;
+	u32 reserved1[6];
+};
+
+/*
+ * iSCSI KWQ WQE
+ */
+union iscsi_kwqe {
+	struct iscsi_kwqe_init1 init1;
+	struct iscsi_kwqe_init2 init2;
+	struct iscsi_kwqe_conn_offload1 conn_offload1;
+	struct iscsi_kwqe_conn_offload2 conn_offload2;
+	struct iscsi_kwqe_conn_update conn_update;
+	struct iscsi_kwqe_conn_destroy conn_destroy;
+};
+
+/*
+ * iSCSI Login SQ WQE
+ */
+struct bnx2i_login_request {
+#if defined(__BIG_ENDIAN)
+	u8 op_code;
+	u8 op_attr;
+#define ISCSI_LOGIN_REQUEST_NEXT_STAGE (0x3<<0)
+#define ISCSI_LOGIN_REQUEST_NEXT_STAGE_SHIFT 0
+#define ISCSI_LOGIN_REQUEST_CURRENT_STAGE (0x3<<2)
+#define ISCSI_LOGIN_REQUEST_CURRENT_STAGE_SHIFT 2
+#define ISCSI_LOGIN_REQUEST_RESERVED0 (0x3<<4)
+#define ISCSI_LOGIN_REQUEST_RESERVED0_SHIFT 4
+#define ISCSI_LOGIN_REQUEST_CONT (0x1<<6)
+#define ISCSI_LOGIN_REQUEST_CONT_SHIFT 6
+#define ISCSI_LOGIN_REQUEST_TRANSIT (0x1<<7)
+#define ISCSI_LOGIN_REQUEST_TRANSIT_SHIFT 7
+	u8 version_max;
+	u8 version_min;
+#elif defined(__LITTLE_ENDIAN)
+	u8 version_min;
+	u8 version_max;
+	u8 op_attr;
+#define ISCSI_LOGIN_REQUEST_NEXT_STAGE (0x3<<0)
+#define ISCSI_LOGIN_REQUEST_NEXT_STAGE_SHIFT 0
+#define ISCSI_LOGIN_REQUEST_CURRENT_STAGE (0x3<<2)
+#define ISCSI_LOGIN_REQUEST_CURRENT_STAGE_SHIFT 2
+#define ISCSI_LOGIN_REQUEST_RESERVED0 (0x3<<4)
+#define ISCSI_LOGIN_REQUEST_RESERVED0_SHIFT 4
+#define ISCSI_LOGIN_REQUEST_CONT (0x1<<6)
+#define ISCSI_LOGIN_REQUEST_CONT_SHIFT 6
+#define ISCSI_LOGIN_REQUEST_TRANSIT (0x1<<7)
+#define ISCSI_LOGIN_REQUEST_TRANSIT_SHIFT 7
+	u8 op_code;
+#endif
+	u32 data_length;
+	u32 isid_lo;
+#if defined(__BIG_ENDIAN)
+	u16 isid_hi;
+	u16 tsih;
+#elif defined(__LITTLE_ENDIAN)
+	u16 tsih;
+	u16 isid_hi;
+#endif
+#if defined(__BIG_ENDIAN)
+	u16 reserved2;
+	u16 itt;
+#define ISCSI_LOGIN_REQUEST_INDEX (0x3FFF<<0)
+#define ISCSI_LOGIN_REQUEST_INDEX_SHIFT 0
+#define ISCSI_LOGIN_REQUEST_TYPE (0x3<<14)
+#define ISCSI_LOGIN_REQUEST_TYPE_SHIFT 14
+#elif defined(__LITTLE_ENDIAN)
+	u16 itt;
+#define ISCSI_LOGIN_REQUEST_INDEX (0x3FFF<<0)
+#define ISCSI_LOGIN_REQUEST_INDEX_SHIFT 0
+#define ISCSI_LOGIN_REQUEST_TYPE (0x3<<14)
+#define ISCSI_LOGIN_REQUEST_TYPE_SHIFT 14
+	u16 reserved2;
+#endif
+#if defined(__BIG_ENDIAN)
+	u16 cid;
+	u16 reserved3;
+#elif defined(__LITTLE_ENDIAN)
+	u16 reserved3;
+	u16 cid;
+#endif
+	u32 cmd_sn;
+	u32 exp_stat_sn;
+	u32 reserved4;
+	u32 resp_bd_list_addr_lo;
+	u32 resp_bd_list_addr_hi;
+	u32 resp_buffer;
+#define ISCSI_LOGIN_REQUEST_RESP_BUFFER_LENGTH (0xFFFFFF<<0)
+#define ISCSI_LOGIN_REQUEST_RESP_BUFFER_LENGTH_SHIFT 0
+#define ISCSI_LOGIN_REQUEST_NUM_RESP_BDS (0xFF<<24)
+#define ISCSI_LOGIN_REQUEST_NUM_RESP_BDS_SHIFT 24
+#if defined(__BIG_ENDIAN)
+	u16 reserved8;
+	u8 reserved7;
+	u8 flags;
+#define ISCSI_LOGIN_REQUEST_RESERVED5 (0x3<<0)
+#define ISCSI_LOGIN_REQUEST_RESERVED5_SHIFT 0
+#define ISCSI_LOGIN_REQUEST_UPDATE_EXP_STAT_SN (0x1<<2)
+#define ISCSI_LOGIN_REQUEST_UPDATE_EXP_STAT_SN_SHIFT 2
+#define ISCSI_LOGIN_REQUEST_RESERVED6 (0x1F<<3)
+#define ISCSI_LOGIN_REQUEST_RESERVED6_SHIFT 3
+#elif defined(__LITTLE_ENDIAN)
+	u8 flags;
+#define ISCSI_LOGIN_REQUEST_RESERVED5 (0x3<<0)
+#define ISCSI_LOGIN_REQUEST_RESERVED5_SHIFT 0
+#define ISCSI_LOGIN_REQUEST_UPDATE_EXP_STAT_SN (0x1<<2)
+#define ISCSI_LOGIN_REQUEST_UPDATE_EXP_STAT_SN_SHIFT 2
+#define ISCSI_LOGIN_REQUEST_RESERVED6 (0x1F<<3)
+#define ISCSI_LOGIN_REQUEST_RESERVED6_SHIFT 3
+	u8 reserved7;
+	u16 reserved8;
+#endif
+	u32 bd_list_addr_lo;
+	u32 bd_list_addr_hi;
+#if defined(__BIG_ENDIAN)
+	u8 cq_index;
+	u8 reserved10;
+	u8 reserved9;
+	u8 num_bds;
+#elif defined(__LITTLE_ENDIAN)
+	u8 num_bds;
+	u8 reserved9;
+	u8 reserved10;
+	u8 cq_index;
+#endif
+};
+
+
+/*
+ * iSCSI Login CQE
+ */
+struct bnx2i_login_response {
+#if defined(__BIG_ENDIAN)
+	u8 op_code;
+	u8 response_flags;
+#define ISCSI_LOGIN_RESPONSE_NEXT_STAGE (0x3<<0)
+#define ISCSI_LOGIN_RESPONSE_NEXT_STAGE_SHIFT 0
+#define ISCSI_LOGIN_RESPONSE_CURRENT_STAGE (0x3<<2)
+#define ISCSI_LOGIN_RESPONSE_CURRENT_STAGE_SHIFT 2
+#define ISCSI_LOGIN_RESPONSE_RESERVED0 (0x3<<4)
+#define ISCSI_LOGIN_RESPONSE_RESERVED0_SHIFT 4
+#define ISCSI_LOGIN_RESPONSE_CONT (0x1<<6)
+#define ISCSI_LOGIN_RESPONSE_CONT_SHIFT 6
+#define ISCSI_LOGIN_RESPONSE_TRANSIT (0x1<<7)
+#define ISCSI_LOGIN_RESPONSE_TRANSIT_SHIFT 7
+	u8 version_max;
+	u8 version_active;
+#elif defined(__LITTLE_ENDIAN)
+	u8 version_active;
+	u8 version_max;
+	u8 response_flags;
+#define ISCSI_LOGIN_RESPONSE_NEXT_STAGE (0x3<<0)
+#define ISCSI_LOGIN_RESPONSE_NEXT_STAGE_SHIFT 0
+#define ISCSI_LOGIN_RESPONSE_CURRENT_STAGE (0x3<<2)
+#define ISCSI_LOGIN_RESPONSE_CURRENT_STAGE_SHIFT 2
+#define ISCSI_LOGIN_RESPONSE_RESERVED0 (0x3<<4)
+#define ISCSI_LOGIN_RESPONSE_RESERVED0_SHIFT 4
+#define ISCSI_LOGIN_RESPONSE_CONT (0x1<<6)
+#define ISCSI_LOGIN_RESPONSE_CONT_SHIFT 6
+#define ISCSI_LOGIN_RESPONSE_TRANSIT (0x1<<7)
+#define ISCSI_LOGIN_RESPONSE_TRANSIT_SHIFT 7
+	u8 op_code;
+#endif
+	u32 data_length;
+	u32 exp_cmd_sn;
+	u32 max_cmd_sn;
+	u32 reserved1[2];
+#if defined(__BIG_ENDIAN)
+	u16 reserved3;
+	u8 err_code;
+	u8 reserved2;
+#elif defined(__LITTLE_ENDIAN)
+	u8 reserved2;
+	u8 err_code;
+	u16 reserved3;
+#endif
+	u32 stat_sn;
+	u32 isid_lo;
+#if defined(__BIG_ENDIAN)
+	u16 isid_hi;
+	u16 tsih;
+#elif defined(__LITTLE_ENDIAN)
+	u16 tsih;
+	u16 isid_hi;
+#endif
+#if defined(__BIG_ENDIAN)
+	u8 status_class;
+	u8 status_detail;
+	u16 reserved4;
+#elif defined(__LITTLE_ENDIAN)
+	u16 reserved4;
+	u8 status_detail;
+	u8 status_class;
+#endif
+	u32 reserved5[3];
+#if defined(__BIG_ENDIAN)
+	u16 reserved6;
+	u16 itt;
+#define ISCSI_LOGIN_RESPONSE_INDEX (0x3FFF<<0)
+#define ISCSI_LOGIN_RESPONSE_INDEX_SHIFT 0
+#define ISCSI_LOGIN_RESPONSE_TYPE (0x3<<14)
+#define ISCSI_LOGIN_RESPONSE_TYPE_SHIFT 14
+#elif defined(__LITTLE_ENDIAN)
+	u16 itt;
+#define ISCSI_LOGIN_RESPONSE_INDEX (0x3FFF<<0)
+#define ISCSI_LOGIN_RESPONSE_INDEX_SHIFT 0
+#define ISCSI_LOGIN_RESPONSE_TYPE (0x3<<14)
+#define ISCSI_LOGIN_RESPONSE_TYPE_SHIFT 14
+	u16 reserved6;
+#endif
+	u32 cq_req_sn;
+};
+
+
+/*
+ * iSCSI Logout SQ WQE
+ */
+struct bnx2i_logout_request {
+#if defined(__BIG_ENDIAN)
+	u8 op_code;
+	u8 op_attr;
+#define ISCSI_LOGOUT_REQUEST_REASON (0x7F<<0)
+#define ISCSI_LOGOUT_REQUEST_REASON_SHIFT 0
+#define ISCSI_LOGOUT_REQUEST_ALWAYS_ONE (0x1<<7)
+#define ISCSI_LOGOUT_REQUEST_ALWAYS_ONE_SHIFT 7
+	u16 reserved0;
+#elif defined(__LITTLE_ENDIAN)
+	u16 reserved0;
+	u8 op_attr;
+#define ISCSI_LOGOUT_REQUEST_REASON (0x7F<<0)
+#define ISCSI_LOGOUT_REQUEST_REASON_SHIFT 0
+#define ISCSI_LOGOUT_REQUEST_ALWAYS_ONE (0x1<<7)
+#define ISCSI_LOGOUT_REQUEST_ALWAYS_ONE_SHIFT 7
+	u8 op_code;
+#endif
+	u32 data_length;
+	u32 reserved1[2];
+#if defined(__BIG_ENDIAN)
+	u16 reserved2;
+	u16 itt;
+#define ISCSI_LOGOUT_REQUEST_INDEX (0x3FFF<<0)
+#define ISCSI_LOGOUT_REQUEST_INDEX_SHIFT 0
+#define ISCSI_LOGOUT_REQUEST_TYPE (0x3<<14)
+#define ISCSI_LOGOUT_REQUEST_TYPE_SHIFT 14
+#elif defined(__LITTLE_ENDIAN)
+	u16 itt;
+#define ISCSI_LOGOUT_REQUEST_INDEX (0x3FFF<<0)
+#define ISCSI_LOGOUT_REQUEST_INDEX_SHIFT 0
+#define ISCSI_LOGOUT_REQUEST_TYPE (0x3<<14)
+#define ISCSI_LOGOUT_REQUEST_TYPE_SHIFT 14
+	u16 reserved2;
+#endif
+#if defined(__BIG_ENDIAN)
+	u16 cid;
+	u16 reserved3;
+#elif defined(__LITTLE_ENDIAN)
+	u16 reserved3;
+	u16 cid;
+#endif
+	u32 cmd_sn;
+	u32 reserved4[5];
+	u32 zero_fill;
+	u32 bd_list_addr_lo;
+	u32 bd_list_addr_hi;
+#if defined(__BIG_ENDIAN)
+	u8 cq_index;
+	u8 reserved6;
+	u8 reserved5;
+	u8 num_bds;
+#elif defined(__LITTLE_ENDIAN)
+	u8 num_bds;
+	u8 reserved5;
+	u8 reserved6;
+	u8 cq_index;
+#endif
+};
+
+
+/*
+ * iSCSI Logout CQE
+ */
+struct bnx2i_logout_response {
+#if defined(__BIG_ENDIAN)
+	u8 op_code;
+	u8 reserved1;
+	u8 response;
+	u8 reserved0;
+#elif defined(__LITTLE_ENDIAN)
+	u8 reserved0;
+	u8 response;
+	u8 reserved1;
+	u8 op_code;
+#endif
+	u32 reserved2;
+	u32 exp_cmd_sn;
+	u32 max_cmd_sn;
+	u32 reserved3[2];
+#if defined(__BIG_ENDIAN)
+	u16 reserved5;
+	u8 err_code;
+	u8 reserved4;
+#elif defined(__LITTLE_ENDIAN)
+	u8 reserved4;
+	u8 err_code;
+	u16 reserved5;
+#endif
+	u32 reserved6[3];
+#if defined(__BIG_ENDIAN)
+	u16 time_to_wait;
+	u16 time_to_retain;
+#elif defined(__LITTLE_ENDIAN)
+	u16 time_to_retain;
+	u16 time_to_wait;
+#endif
+	u32 reserved7[3];
+#if defined(__BIG_ENDIAN)
+	u16 reserved8;
+	u16 itt;
+#define ISCSI_LOGOUT_RESPONSE_INDEX (0x3FFF<<0)
+#define ISCSI_LOGOUT_RESPONSE_INDEX_SHIFT 0
+#define ISCSI_LOGOUT_RESPONSE_TYPE (0x3<<14)
+#define ISCSI_LOGOUT_RESPONSE_TYPE_SHIFT 14
+#elif defined(__LITTLE_ENDIAN)
+	u16 itt;
+#define ISCSI_LOGOUT_RESPONSE_INDEX (0x3FFF<<0)
+#define ISCSI_LOGOUT_RESPONSE_INDEX_SHIFT 0
+#define ISCSI_LOGOUT_RESPONSE_TYPE (0x3<<14)
+#define ISCSI_LOGOUT_RESPONSE_TYPE_SHIFT 14
+	u16 reserved8;
+#endif
+	u32 cq_req_sn;
+};
+
+
+/*
+ * iSCSI Nop-In CQE
+ */
+struct bnx2i_nop_in_msg {
+#if defined(__BIG_ENDIAN)
+	u8 op_code;
+	u8 reserved1;
+	u16 reserved0;
+#elif defined(__LITTLE_ENDIAN)
+	u16 reserved0;
+	u8 reserved1;
+	u8 op_code;
+#endif
+	u32 data_length;
+	u32 exp_cmd_sn;
+	u32 max_cmd_sn;
+	u32 ttt;
+	u32 reserved2;
+#if defined(__BIG_ENDIAN)
+	u16 reserved4;
+	u8 err_code;
+	u8 reserved3;
+#elif defined(__LITTLE_ENDIAN)
+	u8 reserved3;
+	u8 err_code;
+	u16 reserved4;
+#endif
+	u32 reserved5;
+	u32 lun[2];
+	u32 reserved6[4];
+#if defined(__BIG_ENDIAN)
+	u16 reserved7;
+	u16 itt;
+#define ISCSI_NOP_IN_MSG_INDEX (0x3FFF<<0)
+#define ISCSI_NOP_IN_MSG_INDEX_SHIFT 0
+#define ISCSI_NOP_IN_MSG_TYPE (0x3<<14)
+#define ISCSI_NOP_IN_MSG_TYPE_SHIFT 14
+#elif defined(__LITTLE_ENDIAN)
+	u16 itt;
+#define ISCSI_NOP_IN_MSG_INDEX (0x3FFF<<0)
+#define ISCSI_NOP_IN_MSG_INDEX_SHIFT 0
+#define ISCSI_NOP_IN_MSG_TYPE (0x3<<14)
+#define ISCSI_NOP_IN_MSG_TYPE_SHIFT 14
+	u16 reserved7;
+#endif
+	u32 cq_req_sn;
+};
+
+
+/*
+ * iSCSI NOP-OUT SQ WQE
+ */
+struct bnx2i_nop_out_request {
+#if defined(__BIG_ENDIAN)
+	u8 op_code;
+	u8 op_attr;
+#define ISCSI_NOP_OUT_REQUEST_RESERVED1 (0x7F<<0)
+#define ISCSI_NOP_OUT_REQUEST_RESERVED1_SHIFT 0
+#define ISCSI_NOP_OUT_REQUEST_ALWAYS_ONE (0x1<<7)
+#define ISCSI_NOP_OUT_REQUEST_ALWAYS_ONE_SHIFT 7
+	u16 reserved0;
+#elif defined(__LITTLE_ENDIAN)
+	u16 reserved0;
+	u8 op_attr;
+#define ISCSI_NOP_OUT_REQUEST_RESERVED1 (0x7F<<0)
+#define ISCSI_NOP_OUT_REQUEST_RESERVED1_SHIFT 0
+#define ISCSI_NOP_OUT_REQUEST_ALWAYS_ONE (0x1<<7)
+#define ISCSI_NOP_OUT_REQUEST_ALWAYS_ONE_SHIFT 7
+	u8 op_code;
+#endif
+	u32 data_length;
+	u32 lun[2];
+#if defined(__BIG_ENDIAN)
+	u16 reserved2;
+	u16 itt;
+#define ISCSI_NOP_OUT_REQUEST_INDEX (0x3FFF<<0)
+#define ISCSI_NOP_OUT_REQUEST_INDEX_SHIFT 0
+#define ISCSI_NOP_OUT_REQUEST_TYPE (0x3<<14)
+#define ISCSI_NOP_OUT_REQUEST_TYPE_SHIFT 14
+#elif defined(__LITTLE_ENDIAN)
+	u16 itt;
+#define ISCSI_NOP_OUT_REQUEST_INDEX (0x3FFF<<0)
+#define ISCSI_NOP_OUT_REQUEST_INDEX_SHIFT 0
+#define ISCSI_NOP_OUT_REQUEST_TYPE (0x3<<14)
+#define ISCSI_NOP_OUT_REQUEST_TYPE_SHIFT 14
+	u16 reserved2;
+#endif
+	u32 ttt;
+	u32 cmd_sn;
+	u32 reserved3[2];
+	u32 resp_bd_list_addr_lo;
+	u32 resp_bd_list_addr_hi;
+	u32 resp_buffer;
+#define ISCSI_NOP_OUT_REQUEST_RESP_BUFFER_LENGTH (0xFFFFFF<<0)
+#define ISCSI_NOP_OUT_REQUEST_RESP_BUFFER_LENGTH_SHIFT 0
+#define ISCSI_NOP_OUT_REQUEST_NUM_RESP_BDS (0xFF<<24)
+#define ISCSI_NOP_OUT_REQUEST_NUM_RESP_BDS_SHIFT 24
+#if defined(__BIG_ENDIAN)
+	u16 reserved7;
+	u8 reserved6;
+	u8 flags;
+#define ISCSI_NOP_OUT_REQUEST_RESERVED4 (0x1<<0)
+#define ISCSI_NOP_OUT_REQUEST_RESERVED4_SHIFT 0
+#define ISCSI_NOP_OUT_REQUEST_LOCAL_COMPLETION (0x1<<1)
+#define ISCSI_NOP_OUT_REQUEST_LOCAL_COMPLETION_SHIFT 1
+#define ISCSI_NOP_OUT_REQUEST_ZERO_FILL (0x3F<<2)
+#define ISCSI_NOP_OUT_REQUEST_ZERO_FILL_SHIFT 2
+#elif defined(__LITTLE_ENDIAN)
+	u8 flags;
+#define ISCSI_NOP_OUT_REQUEST_RESERVED4 (0x1<<0)
+#define ISCSI_NOP_OUT_REQUEST_RESERVED4_SHIFT 0
+#define ISCSI_NOP_OUT_REQUEST_LOCAL_COMPLETION (0x1<<1)
+#define ISCSI_NOP_OUT_REQUEST_LOCAL_COMPLETION_SHIFT 1
+#define ISCSI_NOP_OUT_REQUEST_ZERO_FILL (0x3F<<2)
+#define ISCSI_NOP_OUT_REQUEST_ZERO_FILL_SHIFT 2
+	u8 reserved6;
+	u16 reserved7;
+#endif
+	u32 bd_list_addr_lo;
+	u32 bd_list_addr_hi;
+#if defined(__BIG_ENDIAN)
+	u8 cq_index;
+	u8 reserved9;
+	u8 reserved8;
+	u8 num_bds;
+#elif defined(__LITTLE_ENDIAN)
+	u8 num_bds;
+	u8 reserved8;
+	u8 reserved9;
+	u8 cq_index;
+#endif
+};
+
+/*
+ * iSCSI Reject CQE
+ */
+struct bnx2i_reject_msg {
+#if defined(__BIG_ENDIAN)
+	u8 op_code;
+	u8 reserved1;
+	u8 reason;
+	u8 reserved0;
+#elif defined(__LITTLE_ENDIAN)
+	u8 reserved0;
+	u8 reason;
+	u8 reserved1;
+	u8 op_code;
+#endif
+	u32 data_length;
+	u32 exp_cmd_sn;
+	u32 max_cmd_sn;
+	u32 reserved2[2];
+#if defined(__BIG_ENDIAN)
+	u16 reserved4;
+	u8 err_code;
+	u8 reserved3;
+#elif defined(__LITTLE_ENDIAN)
+	u8 reserved3;
+	u8 err_code;
+	u16 reserved4;
+#endif
+	u32 reserved5[8];
+	u32 cq_req_sn;
+};
+
+/*
+ * bnx2i iSCSI TMF SQ WQE
+ */
+struct bnx2i_tmf_request {
+#if defined(__BIG_ENDIAN)
+	u8 op_code;
+	u8 op_attr;
+#define ISCSI_TMF_REQUEST_FUNCTION (0x7F<<0)
+#define ISCSI_TMF_REQUEST_FUNCTION_SHIFT 0
+#define ISCSI_TMF_REQUEST_ALWAYS_ONE (0x1<<7)
+#define ISCSI_TMF_REQUEST_ALWAYS_ONE_SHIFT 7
+	u16 reserved0;
+#elif defined(__LITTLE_ENDIAN)
+	u16 reserved0;
+	u8 op_attr;
+#define ISCSI_TMF_REQUEST_FUNCTION (0x7F<<0)
+#define ISCSI_TMF_REQUEST_FUNCTION_SHIFT 0
+#define ISCSI_TMF_REQUEST_ALWAYS_ONE (0x1<<7)
+#define ISCSI_TMF_REQUEST_ALWAYS_ONE_SHIFT 7
+	u8 op_code;
+#endif
+	u32 data_length;
+	u32 lun[2];
+#if defined(__BIG_ENDIAN)
+	u16 reserved1;
+	u16 itt;
+#define ISCSI_TMF_REQUEST_INDEX (0x3FFF<<0)
+#define ISCSI_TMF_REQUEST_INDEX_SHIFT 0
+#define ISCSI_TMF_REQUEST_TYPE (0x3<<14)
+#define ISCSI_TMF_REQUEST_TYPE_SHIFT 14
+#elif defined(__LITTLE_ENDIAN)
+	u16 itt;
+#define ISCSI_TMF_REQUEST_INDEX (0x3FFF<<0)
+#define ISCSI_TMF_REQUEST_INDEX_SHIFT 0
+#define ISCSI_TMF_REQUEST_TYPE (0x3<<14)
+#define ISCSI_TMF_REQUEST_TYPE_SHIFT 14
+	u16 reserved1;
+#endif
+	u32 ref_itt;
+	u32 cmd_sn;
+	u32 reserved2;
+	u32 ref_cmd_sn;
+	u32 reserved3[3];
+	u32 zero_fill;
+	u32 bd_list_addr_lo;
+	u32 bd_list_addr_hi;
+#if defined(__BIG_ENDIAN)
+	u8 cq_index;
+	u8 reserved5;
+	u8 reserved4;
+	u8 num_bds;
+#elif defined(__LITTLE_ENDIAN)
+	u8 num_bds;
+	u8 reserved4;
+	u8 reserved5;
+	u8 cq_index;
+#endif
+};
+
+/*
+ * iSCSI Text SQ WQE
+ */
+struct bnx2i_text_request {
+#if defined(__BIG_ENDIAN)
+	u8 op_code;
+	u8 op_attr;
+#define ISCSI_TEXT_REQUEST_RESERVED1 (0x3F<<0)
+#define ISCSI_TEXT_REQUEST_RESERVED1_SHIFT 0
+#define ISCSI_TEXT_REQUEST_CONT (0x1<<6)
+#define ISCSI_TEXT_REQUEST_CONT_SHIFT 6
+#define ISCSI_TEXT_REQUEST_FINAL (0x1<<7)
+#define ISCSI_TEXT_REQUEST_FINAL_SHIFT 7
+	u16 reserved0;
+#elif defined(__LITTLE_ENDIAN)
+	u16 reserved0;
+	u8 op_attr;
+#define ISCSI_TEXT_REQUEST_RESERVED1 (0x3F<<0)
+#define ISCSI_TEXT_REQUEST_RESERVED1_SHIFT 0
+#define ISCSI_TEXT_REQUEST_CONT (0x1<<6)
+#define ISCSI_TEXT_REQUEST_CONT_SHIFT 6
+#define ISCSI_TEXT_REQUEST_FINAL (0x1<<7)
+#define ISCSI_TEXT_REQUEST_FINAL_SHIFT 7
+	u8 op_code;
+#endif
+	u32 data_length;
+	u32 lun[2];
+#if defined(__BIG_ENDIAN)
+	u16 reserved3;
+	u16 itt;
+#define ISCSI_TEXT_REQUEST_INDEX (0x3FFF<<0)
+#define ISCSI_TEXT_REQUEST_INDEX_SHIFT 0
+#define ISCSI_TEXT_REQUEST_TYPE (0x3<<14)
+#define ISCSI_TEXT_REQUEST_TYPE_SHIFT 14
+#elif defined(__LITTLE_ENDIAN)
+	u16 itt;
+#define ISCSI_TEXT_REQUEST_INDEX (0x3FFF<<0)
+#define ISCSI_TEXT_REQUEST_INDEX_SHIFT 0
+#define ISCSI_TEXT_REQUEST_TYPE (0x3<<14)
+#define ISCSI_TEXT_REQUEST_TYPE_SHIFT 14
+	u16 reserved3;
+#endif
+	u32 ttt;
+	u32 cmd_sn;
+	u32 reserved4[2];
+	u32 resp_bd_list_addr_lo;
+	u32 resp_bd_list_addr_hi;
+	u32 resp_buffer;
+#define ISCSI_TEXT_REQUEST_RESP_BUFFER_LENGTH (0xFFFFFF<<0)
+#define ISCSI_TEXT_REQUEST_RESP_BUFFER_LENGTH_SHIFT 0
+#define ISCSI_TEXT_REQUEST_NUM_RESP_BDS (0xFF<<24)
+#define ISCSI_TEXT_REQUEST_NUM_RESP_BDS_SHIFT 24
+	u32 zero_fill;
+	u32 bd_list_addr_lo;
+	u32 bd_list_addr_hi;
+#if defined(__BIG_ENDIAN)
+	u8 cq_index;
+	u8 reserved7;
+	u8 reserved6;
+	u8 num_bds;
+#elif defined(__LITTLE_ENDIAN)
+	u8 num_bds;
+	u8 reserved6;
+	u8 reserved7;
+	u8 cq_index;
+#endif
+};
+
+/*
+ * iSCSI SQ WQE
+ */
+union iscsi_request {
+	struct bnx2i_cmd_request cmd;
+	struct bnx2i_tmf_request tmf;
+	struct bnx2i_nop_out_request nop_out;
+	struct bnx2i_login_request login_req;
+	struct bnx2i_text_request text;
+	struct bnx2i_logout_request logout_req;
+	struct bnx2i_cleanup_request cleanup;
+};
+
+
+/*
+ * iSCSI TMF CQE
+ */
+struct bnx2i_tmf_response {
+#if defined(__BIG_ENDIAN)
+	u8 op_code;
+	u8 reserved1;
+	u8 response;
+	u8 reserved0;
+#elif defined(__LITTLE_ENDIAN)
+	u8 reserved0;
+	u8 response;
+	u8 reserved1;
+	u8 op_code;
+#endif
+	u32 reserved2;
+	u32 exp_cmd_sn;
+	u32 max_cmd_sn;
+	u32 reserved3[2];
+#if defined(__BIG_ENDIAN)
+	u16 reserved5;
+	u8 err_code;
+	u8 reserved4;
+#elif defined(__LITTLE_ENDIAN)
+	u8 reserved4;
+	u8 err_code;
+	u16 reserved5;
+#endif
+	u32 reserved6[7];
+#if defined(__BIG_ENDIAN)
+	u16 reserved7;
+	u16 itt;
+#define ISCSI_TMF_RESPONSE_INDEX (0x3FFF<<0)
+#define ISCSI_TMF_RESPONSE_INDEX_SHIFT 0
+#define ISCSI_TMF_RESPONSE_TYPE (0x3<<14)
+#define ISCSI_TMF_RESPONSE_TYPE_SHIFT 14
+#elif defined(__LITTLE_ENDIAN)
+	u16 itt;
+#define ISCSI_TMF_RESPONSE_INDEX (0x3FFF<<0)
+#define ISCSI_TMF_RESPONSE_INDEX_SHIFT 0
+#define ISCSI_TMF_RESPONSE_TYPE (0x3<<14)
+#define ISCSI_TMF_RESPONSE_TYPE_SHIFT 14
+	u16 reserved7;
+#endif
+	u32 cq_req_sn;
+};
+
+/*
+ * iSCSI Text CQE
+ */
+struct bnx2i_text_response {
+#if defined(__BIG_ENDIAN)
+	u8 op_code;
+	u8 response_flags;
+#define ISCSI_TEXT_RESPONSE_RESERVED1 (0x3F<<0)
+#define ISCSI_TEXT_RESPONSE_RESERVED1_SHIFT 0
+#define ISCSI_TEXT_RESPONSE_CONT (0x1<<6)
+#define ISCSI_TEXT_RESPONSE_CONT_SHIFT 6
+#define ISCSI_TEXT_RESPONSE_FINAL (0x1<<7)
+#define ISCSI_TEXT_RESPONSE_FINAL_SHIFT 7
+	u16 reserved0;
+#elif defined(__LITTLE_ENDIAN)
+	u16 reserved0;
+	u8 response_flags;
+#define ISCSI_TEXT_RESPONSE_RESERVED1 (0x3F<<0)
+#define ISCSI_TEXT_RESPONSE_RESERVED1_SHIFT 0
+#define ISCSI_TEXT_RESPONSE_CONT (0x1<<6)
+#define ISCSI_TEXT_RESPONSE_CONT_SHIFT 6
+#define ISCSI_TEXT_RESPONSE_FINAL (0x1<<7)
+#define ISCSI_TEXT_RESPONSE_FINAL_SHIFT 7
+	u8 op_code;
+#endif
+	u32 data_length;
+	u32 exp_cmd_sn;
+	u32 max_cmd_sn;
+	u32 ttt;
+	u32 reserved2;
+#if defined(__BIG_ENDIAN)
+	u16 reserved4;
+	u8 err_code;
+	u8 reserved3;
+#elif defined(__LITTLE_ENDIAN)
+	u8 reserved3;
+	u8 err_code;
+	u16 reserved4;
+#endif
+	u32 reserved5;
+	u32 lun[2];
+	u32 reserved6[4];
+#if defined(__BIG_ENDIAN)
+	u16 reserved7;
+	u16 itt;
+#define ISCSI_TEXT_RESPONSE_INDEX (0x3FFF<<0)
+#define ISCSI_TEXT_RESPONSE_INDEX_SHIFT 0
+#define ISCSI_TEXT_RESPONSE_TYPE (0x3<<14)
+#define ISCSI_TEXT_RESPONSE_TYPE_SHIFT 14
+#elif defined(__LITTLE_ENDIAN)
+	u16 itt;
+#define ISCSI_TEXT_RESPONSE_INDEX (0x3FFF<<0)
+#define ISCSI_TEXT_RESPONSE_INDEX_SHIFT 0
+#define ISCSI_TEXT_RESPONSE_TYPE (0x3<<14)
+#define ISCSI_TEXT_RESPONSE_TYPE_SHIFT 14
+	u16 reserved7;
+#endif
+	u32 cq_req_sn;
+};
+
+/*
+ * iSCSI CQE
+ */
+union iscsi_response {
+	struct bnx2i_cmd_response cmd;
+	struct bnx2i_tmf_response tmf;
+	struct bnx2i_login_response login_resp;
+	struct bnx2i_text_response text;
+	struct bnx2i_logout_response logout_resp;
+	struct bnx2i_cleanup_response cleanup;
+	struct bnx2i_reject_msg reject;
+	struct bnx2i_async_msg async;
+	struct bnx2i_nop_in_msg nop_in;
+};
+
+#endif /* __57XX_ISCSI_HSI_LINUX_LE__ */
diff --git a/drivers/scsi/bnx2i/Kconfig b/drivers/scsi/bnx2i/Kconfig
new file mode 100644
index 0000000..7690eb8
--- /dev/null
+++ b/drivers/scsi/bnx2i/Kconfig
@@ -0,0 +1,7 @@
+config SCSI_BNX2_ISCSI
+	tristate "Broadcom NetXtreme II iSCSI support"
+	select CNIC
+	select SCSI_ISCSI_ATTRS
+	---help---
+	This driver supports iSCSI offload for the Broadcom NetXtreme II
+	devices.
diff --git a/drivers/scsi/bnx2i/Makefile b/drivers/scsi/bnx2i/Makefile
new file mode 100644
index 0000000..b5802bd
--- /dev/null
+++ b/drivers/scsi/bnx2i/Makefile
@@ -0,0 +1,3 @@
+bnx2i-y := bnx2i_init.o bnx2i_hwi.o bnx2i_iscsi.o bnx2i_sysfs.o
+
+obj-$(CONFIG_SCSI_BNX2_ISCSI) += bnx2i.o
diff --git a/drivers/scsi/bnx2i/bnx2i.h b/drivers/scsi/bnx2i/bnx2i.h
new file mode 100644
index 0000000..44ce1d6
--- /dev/null
+++ b/drivers/scsi/bnx2i/bnx2i.h
@@ -0,0 +1,745 @@
+/* bnx2i.h: Broadcom NetXtreme II iSCSI driver.
+ *
+ * Copyright (c) 2006 - 2008 Broadcom Corporation
+ * Copyright (c) 2007, 2008 Red Hat, Inc.  All rights reserved.
+ * Copyright (c) 2007, 2008 Mike Christie
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation.
+ *
+ * Written by: Anil Veerabhadrappa (anilgv-dY08KVG/lbpWk0Htik3J/w@public.gmane.org)
+ */
+
+#ifndef _BNX2I_H_
+#define _BNX2I_H_
+
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+
+#include <linux/errno.h>
+#include <linux/pci.h>
+#include <linux/spinlock.h>
+#include <linux/interrupt.h>
+#include <linux/sched.h>
+#include <linux/in.h>
+#include <linux/in6.h>
+#include <linux/kfifo.h>
+#include <linux/netdevice.h>
+#include <linux/completion.h>
+
+#include <scsi/scsi_cmnd.h>
+#include <scsi/scsi_device.h>
+#include <scsi/scsi_eh.h>
+#include <scsi/scsi_host.h>
+#include <scsi/scsi.h>
+#include <scsi/iscsi_proto.h>
+#include <scsi/libiscsi.h>
+#include <scsi/scsi_transport_iscsi.h>
+
+#include "../../net/cnic_if.h"
+#include "57xx_iscsi_hsi.h"
+#include "57xx_iscsi_constants.h"
+
+#define BNX2_ISCSI_DRIVER_NAME		"bnx2i"
+
+#define BNX2I_MAX_ADAPTERS		8
+
+
+#ifndef PCI_DEVICE_ID_NX2_5709
+#define PCI_DEVICE_ID_NX2_5709			0x1639
+#endif
+
+#ifndef PCI_DEVICE_ID_NX2_5709S
+#define PCI_DEVICE_ID_NX2_5709S			0x163a
+#endif
+
+#ifndef PCI_DEVICE_ID_NX2_57710
+#define PCI_DEVICE_ID_NX2_57710         	0x164e
+#endif
+#define ISCSI_MAX_CONNS_PER_HBA		64
+#define ISCSI_MAX_SESS_PER_HBA		ISCSI_MAX_CONNS_PER_HBA
+#define ISCSI_MAX_CMDS_PER_SESS		128
+
+#define ISCSI_MAX_BDS_PER_CMD		32
+
+#define MAX_PAGES_PER_CTRL_STRUCT_POOL	8
+#define BNX2I_RESERVED_SLOW_PATH_CMD_SLOTS	4
+
+#define BNX2I_STATSN_UPDATE_SIGNATURE	0xFABCAFE
+
+/* 5706/08 hardware has limit on maximum buffer size per BD it can handle */
+#define MAX_BD_LENGTH			65535
+#define BD_SPLIT_SIZE			32768
+
+/* min, max & default values for SQ/RQ/CQ size, configurable via' modparam */
+#define BNX2I_SQ_WQES_MIN 		16
+#define BNX2I_SQ_WQES_MAX 		256
+#define BNX2I_SQ_WQES_DEFAULT 		128
+
+#define BNX2I_CQ_WQES_MIN 		16
+#define BNX2I_CQ_WQES_MAX 		256
+#define BNX2I_CQ_WQES_DEFAULT 		128
+
+#define BNX2I_RQ_WQES_MIN 		16
+#define BNX2I_RQ_WQES_MAX 		32
+#define BNX2I_RQ_WQES_DEFAULT 		16
+
+/* CCELLs per conn */
+#define BNX2I_CCELLS_MIN		16
+#define BNX2I_CCELLS_MAX		96
+#define BNX2I_CCELLS_DEFAULT		64
+
+#define ITT_INVALID_SIGNATURE		0xFFFF
+
+#define ISCSI_CMD_CLEANUP_TIMEOUT	100
+
+#define BNX2I_CONN_CTX_BUF_SIZE		16384
+
+#define BNX2I_SQ_WQE_SIZE		64
+#define BNX2I_RQ_WQE_SIZE		256
+#define BNX2I_CQE_SIZE			64
+
+#define MB_KERNEL_CTX_SHIFT	8
+#define MB_KERNEL_CTX_SIZE	(1 << MB_KERNEL_CTX_SHIFT)
+
+#define CTX_SHIFT		7
+#define GET_CID_NUM(cid_addr)	((cid_addr) >> CTX_SHIFT)
+
+#define CTX_OFFSET 		0x10000
+#define MAX_CID_CNT		0x4000
+
+/* 5709 context registers */
+#define BNX2_MQ_CONFIG2					0x00003d00
+#define BNX2_MQ_CONFIG2_CONT_SZ				(0x7L<<4)
+#define BNX2_MQ_CONFIG2_FIRST_L4L5			(0x1fL<<8)
+
+#define REG_RD(__hba, offset)				\
+		readl(__hba->regview + offset)
+#define REG_WR(__hba, offset, val)			\
+		writel(val, __hba->regview + offset)
+
+
+
+
+/**
+ * struct generic_pdu_resc - login pdu resource structure
+ *
+ * @req_buf:            driver buffer used to stage payload associated with
+ *                      the login request
+ * @req_dma_addr:       dma address for iscsi login request payload buffer
+ * @req_buf_size:       actual login request payload length
+ * @req_wr_ptr:         pointer into login request buffer when next data is
+ *                      to be written
+ * @resp_hdr:           iscsi header where iscsi login response header is to
+ *                      be recreated
+ * @resp_buf:           buffer to stage login response payload
+ * @resp_dma_addr:      login response payload buffer dma address
+ * @resp_buf_size:      login response paylod length
+ * @resp_wr_ptr:        pointer into login response buffer when next data is
+ *                      to be written
+ * @req_bd_tbl:         BD table to indicate login request payload buffer details
+ * @req_bd_dma:         login request BD table dma address
+ * @resp_bd_tbl:        BD table to indicate login response payload buffer details
+ * @resp_bd_dma:        login request BD table dma address
+ *
+ * following structure defines buffer info for generic pdus such as iSCSI Login,
+ *	Logout and NOP
+ */
+struct generic_pdu_resc {
+	char *req_buf;
+	dma_addr_t req_dma_addr;
+	u32 req_buf_size;
+	char *req_wr_ptr;
+	struct iscsi_hdr resp_hdr;
+	char *resp_buf;
+	dma_addr_t resp_dma_addr;
+	u32 resp_buf_size;
+	char *resp_wr_ptr;
+	char *req_bd_tbl;
+	dma_addr_t req_bd_dma;
+	char *resp_bd_tbl;
+	dma_addr_t resp_bd_dma;
+};
+
+
+/**
+ * struct bd_resc_page - tracks DMA'able memory allocated for BD tables
+ *
+ * @link:               list head to link elements
+ * @max_ptrs:           maximun pointers that can be stored in this page
+ * @num_valid:          number of pointer valid in this page
+ * @page:               base addess for page pointer array
+ *
+ * structure to track DMA'able memory allocated for command BD tables
+ */
+struct bd_resc_page {
+	struct list_head link;
+	u32 max_ptrs;
+	u32 num_valid;
+	void *page[1];
+};
+
+
+/**
+ * struct io_bdt - I/O buffer destricptor table
+ *
+ * @bd_tbl:             BD table's virtual address
+ * @bd_tbl_dma:         BD table's dma address
+ * @bd_valid:           num valid BD entries
+ *
+ * IO BD table
+ */
+struct io_bdt {
+	struct iscsi_bd *bd_tbl;
+	dma_addr_t bd_tbl_dma;
+	u16 bd_valid;
+};
+
+
+/**
+ * bnx2i_cmd - iscsi command structure
+ *
+ * @scsi_cmd:           SCSI-ML task pointer corresponding to this iscsi cmd
+ * @sg:                 SG list
+ * @io_tbl:             buffer descriptor (BD) table
+ * @bd_tbl_dma:         buffer descriptor (BD) table's dma address
+ */
+struct bnx2i_cmd {
+	struct iscsi_hdr hdr;
+	struct bnx2i_conn *conn;
+	struct scsi_cmnd *scsi_cmd;
+	struct scatterlist *sg;
+	struct io_bdt io_tbl;
+	dma_addr_t bd_tbl_dma;
+	struct bnx2i_cmd_request req;
+};
+
+/*
+ * TCP port manager
+ */
+struct tcp_port_mngt {
+	int num_required;
+	u32 port_tbl_size;
+	u32 num_free_ports;
+	u32 prod_idx;
+	u32 cons_idx;
+	u32 max_idx;
+	u16 *free_q;
+};
+
+
+/**
+ * struct bnx2i_conn - iscsi connection structure
+ *
+ * @cls_conn:              pointer to iscsi cls conn
+ * @hba:                   adapter structure pointer
+ * @exp_statsn:            iscsi expected statsn
+ * @iscsi_conn_cid:        iscsi conn id
+ * @fw_cid:                firmware iscsi context id
+ * @ep:                    endpoint structure pointer
+ * @gen_pdu:               login/nopout/logout pdu resources
+ * @violation_notified:    bit mask used to track iscsi error/warning messages
+ *                         already printed out
+ *
+ * iSCSI connection structure
+ */
+struct bnx2i_conn {
+	struct iscsi_cls_conn *cls_conn;
+	struct bnx2i_hba *hba;
+	struct completion cmd_cleanup_cmpl;
+	int is_bound;
+
+	u32 exp_statsn;
+	u32 iscsi_conn_cid;
+#define BNX2I_CID_RESERVED	0x5AFF
+	u32 fw_cid;
+
+	struct timer_list poll_timer;
+	/*
+	 * Queue Pair (QP) related structure elements.
+	 */
+	struct bnx2i_endpoint *ep;
+
+	/*
+	 * Buffer for login negotiation process
+	 */
+	struct generic_pdu_resc gen_pdu;
+	u64 violation_notified;
+};
+
+
+
+/**
+ * struct iscsi_cid_queue - Per adapter iscsi cid queue
+ *
+ * @cid_que_base:           queue base memory
+ * @cid_que:                queue memory pointer
+ * @cid_q_prod_idx:         produce index
+ * @cid_q_cons_idx:         consumer index
+ * @cid_q_max_idx:          max index. used to detect wrap around condition
+ * @cid_free_cnt:           queue size
+ * @conn_cid_tbl:           iscsi cid to conn structure mapping table
+ *
+ * Per adapter iSCSI CID Queue
+ */
+struct iscsi_cid_queue {
+	void *cid_que_base;
+	u32 *cid_que;
+	u32 cid_q_prod_idx;
+	u32 cid_q_cons_idx;
+	u32 cid_q_max_idx;
+	u32 cid_free_cnt;
+	struct bnx2i_conn **conn_cid_tbl;
+};
+
+
+/**
+ * struct bnx2i_hba - bnx2i adapter structure
+ *
+ * @link:                  list head to link elements
+ * @cnic:                  pointer to cnic device
+ * @pcidev:                pointer to pci dev
+ * @netdev:                pointer to netdev structure
+ * @regview:               mapped PCI register space
+ * @class_dev:             class dev to operate sysfs node
+ * @age:                   age, incremented by every recovery
+ * @cnic_dev_type:         cnic device type, 5706/5708/5709/57710
+ * @mail_queue_access:     mailbox queue access mode, applicable to 5709 only
+ * @reg_with_cnic:         indicates whether the device is register with CNIC
+ * @adapter_state:         adapter state, UP, GOING_DOWN, LINK_DOWN
+ * @mtu_supported:         Ethernet MTU supported
+ * @shost:                 scsi host pointer
+ * @max_sqes:              SQ size
+ * @max_rqes:              RQ size
+ * @max_cqes:              CQ size
+ * @num_ccell:             number of command cells per connection
+ * @ofld_conns_active:     active connection list
+ * @max_active_conns:      max offload connections supported by this device
+ * @cid_que:               iscsi cid queue
+ * @ep_rdwr_lock:          read / write lock to synchronize various ep lists
+ * @ep_ofld_list:          connection list for pending offload completion
+ * @ep_ofld_prod_idx:      producer index to manage offload pend list
+ * @ep_ofld_cons_idx:      consumer index to manage offload pend list
+ * @ep_ofld_max_idx:       max index to manage offload pend list
+ * @ep_destroy_list:       connection list for pending offload completion
+ * @ep_destroy_prod_idx:   producer index to manage destroy pend list
+ * @ep_destroy_cons_idx:   consumer index to manage destroy pend list
+ * @ep_destroy_max_idx:    max index to manage destroy pend list
+ * @mp_bd_tbl:             BD table to be used with middle path requests
+ * @mp_bd_dma:             DMA address of 'mp_bd_tbl' memory buffer
+ * @dummy_buffer:          Dummy buffer to be used with zero length scsicmd reqs
+ * @dummy_buf_dma:         DMA address of 'dummy_buffer' memory buffer
+ * @lock:              	   lock to synchonize access to hba structure
+ * @mac_addr:              MAC address
+ * @pci_did:               PCI device ID
+ * @pci_vid:               PCI vendor ID
+ * @pci_sdid:              PCI subsystem device ID
+ * @pci_svid:              PCI subsystem vendor ID
+ * @pci_func:              PCI function number in system pci tree
+ * @pci_devno:             PCI device number in system pci tree
+ * @num_wqe_sent:          statistic counter, total wqe's sent
+ * @num_cqe_rcvd:          statistic counter, total cqe's received
+ * @num_intr_claimed:      statistic counter, total interrupts claimed
+ * @link_changed_count:    statistic counter, num of link change notifications
+ *                         received
+ * @ipaddr_changed_count:  statistic counter, num times IP address changed while
+ *                         at least one connection is offloaded
+ * @num_sess_opened:       statistic counter, total num sessions opened
+ * @num_conn_opened:       statistic counter, total num conns opened on this hba
+ * @ctx_ccell_tasks:       captures number of ccells and tasks supported by
+ *                         currently offloaded connection, used to decode
+ *                         context memory
+ *
+ * Adapter Data Structure
+ */
+struct bnx2i_hba {
+	struct list_head link;
+	struct cnic_dev *cnic;
+	struct pci_dev *pcidev;
+	struct net_device *netdev;
+	void __iomem *regview;
+
+	/*
+	struct class_device class_dev;
+	*/
+	u32 age;
+	u32 cnic_dev_type;
+		#define BNX2I_NX2_DEV_5706		0x0
+		#define BNX2I_NX2_DEV_5708		0x1
+		#define BNX2I_NX2_DEV_5709		0x2
+		#define BNX2I_NX2_DEV_57710		0x3
+	u32 mail_queue_access;
+		#define BNX2I_MQ_KERNEL_MODE		0x0
+		#define BNX2I_MQ_KERNEL_BYPASS_MODE	0x1
+		#define BNX2I_MQ_BIN_MODE		0x2
+	unsigned long  reg_with_cnic;
+		#define BNX2I_CNIC_REGISTERED		1
+
+	unsigned long  adapter_state;
+		#define ADAPTER_STATE_UP		0
+		#define ADAPTER_STATE_GOING_DOWN	1
+		#define ADAPTER_STATE_LINK_DOWN		2
+		#define ADAPTER_STATE_INIT_FAILED	31
+	unsigned int mtu_supported;
+		#define BNX2I_MAX_MTU_SUPPORTED		1500
+
+	struct Scsi_Host *shost;
+
+	u32 max_sqes;
+	u32 max_rqes;
+	u32 max_cqes;
+	u32 num_ccell;
+
+	int ofld_conns_active;
+
+	int max_active_conns;
+	struct iscsi_cid_queue cid_que;
+
+	rwlock_t ep_rdwr_lock;
+	struct bnx2i_endpoint **ep_ofld_list;
+	int ep_ofld_prod_idx;
+	int ep_ofld_cons_idx;
+	int ep_ofld_max_idx;
+	struct bnx2i_endpoint **ep_destroy_list;
+	int ep_destroy_prod_idx;
+	int ep_destroy_cons_idx;
+	int ep_destroy_max_idx;
+
+	/*
+	 * BD table to be used with MP (Middle Path requests.
+	 */
+	char *mp_bd_tbl;
+	dma_addr_t mp_bd_dma;
+	char *dummy_buffer;
+	dma_addr_t dummy_buf_dma;
+
+	spinlock_t lock;	/* protects hba structure access */
+	unsigned char mac_addr[MAX_ADDR_LEN];
+
+	/*
+	 * PCI related info.
+	 */
+	u16 pci_did;
+	u16 pci_vid;
+	u16 pci_sdid;
+	u16 pci_svid;
+	u16 pci_func;
+	u16 pci_devno;
+
+	/*
+	 * Following are a bunch of statistics useful during development
+	 * and later stage for score boarding.
+	 */
+	u32 num_wqe_sent;
+	u32 num_cqe_rcvd;
+	u32 num_intr_claimed;
+	u32 link_changed_count;
+	u32 ipaddr_changed_count;
+	u32 num_sess_opened;
+	u32 num_conn_opened;
+	unsigned int ctx_ccell_tasks;
+};
+
+
+/*******************************************************************************
+ * 	QP [ SQ / RQ / CQ ] info.
+ ******************************************************************************/
+
+/*
+ * SQ/RQ/CQ generic structure definition
+ */
+struct 	sqe {
+	u8 sqe_byte[BNX2I_SQ_WQE_SIZE];
+};
+
+struct 	rqe {
+	u8 rqe_byte[BNX2I_RQ_WQE_SIZE];
+};
+
+struct 	cqe {
+	u8 cqe_byte[BNX2I_CQE_SIZE];
+};
+
+
+enum {
+#if defined(__LITTLE_ENDIAN)
+	CNIC_EVENT_COAL_INDEX	= 0x0,
+	CNIC_SEND_DOORBELL	= 0x4,
+	CNIC_EVENT_CQ_ARM	= 0x7,
+	CNIC_RECV_DOORBELL	= 0x8
+#elif defined(__BIG_ENDIAN)
+	CNIC_EVENT_COAL_INDEX	= 0x2,
+	CNIC_SEND_DOORBELL	= 0x6,
+	CNIC_EVENT_CQ_ARM	= 0x4,
+	CNIC_RECV_DOORBELL	= 0xa
+#endif
+};
+
+
+
+/**
+ * struct qp_info - QP (share queue region) atrributes structure
+ *
+ * @ctx_base:           ioremapped pci register base to access doorbell register
+ *                      pertaining to this offloaded connection
+ * @sq_virt:            virtual address of send queue (SQ) region
+ * @sq_phys:            DMA address of SQ memory region
+ * @sq_mem_size:        SQ size
+ * @sq_prod_qe:         SQ producer entry pointer
+ * @sq_cons_qe:         SQ consumer entry pointer
+ * @sq_first_qe:        virtaul address of first entry in SQ
+ * @sq_last_qe:         virtaul address of last entry in SQ
+ * @sq_prod_idx:        SQ producer index
+ * @sq_cons_idx:        SQ consumer index
+ * @sqe_left:           number sq entry left
+ * @sq_pgtbl_virt:      page table describing buffer consituting SQ region
+ * @sq_pgtbl_phys:      dma address of 'sq_pgtbl_virt'
+ * @sq_pgtbl_size:      SQ page table size
+ * @cq_virt:            virtual address of completion queue (CQ) region
+ * @cq_phys:            DMA address of RQ memory region
+ * @cq_mem_size:        CQ size
+ * @cq_prod_qe:         CQ producer entry pointer
+ * @cq_cons_qe:         CQ consumer entry pointer
+ * @cq_first_qe:        virtaul address of first entry in CQ
+ * @cq_last_qe:         virtaul address of last entry in CQ
+ * @cq_prod_idx:        CQ producer index
+ * @cq_cons_idx:        CQ consumer index
+ * @cqe_left:           number cq entry left
+ * @cqe_size:           size of each CQ entry
+ * @cqe_exp_seq_sn:     next expected CQE sequence number
+ * @cq_pgtbl_virt:      page table describing buffer consituting CQ region
+ * @cq_pgtbl_phys:      dma address of 'cq_pgtbl_virt'
+ * @cq_pgtbl_size:    	CQ page table size
+ * @rq_virt:            virtual address of receive queue (RQ) region
+ * @rq_phys:            DMA address of RQ memory region
+ * @rq_mem_size:        RQ size
+ * @rq_prod_qe:         RQ producer entry pointer
+ * @rq_cons_qe:         RQ consumer entry pointer
+ * @rq_first_qe:        virtaul address of first entry in RQ
+ * @rq_last_qe:         virtaul address of last entry in RQ
+ * @rq_prod_idx:        RQ producer index
+ * @rq_cons_idx:        RQ consumer index
+ * @rqe_left:           number rq entry left
+ * @rq_pgtbl_virt:      page table describing buffer consituting RQ region
+ * @rq_pgtbl_phys:      dma address of 'rq_pgtbl_virt'
+ * @rq_pgtbl_size:      RQ page table size
+ *
+ * queue pair (QP) is a per connection shared data structure which is used
+ *	to send work requests (SQ), receive completion notifications (CQ)
+ *	and receive asynchoronous / scsi sense info (RQ). 'qp_info' structure
+ *	below holds queue memory, consumer/producer indexes and page table
+ *	information
+ */
+struct qp_info {
+	void __iomem *ctx_base;
+
+	struct sqe *sq_virt;
+	dma_addr_t sq_phys;
+	u32 sq_mem_size;
+
+	struct sqe *sq_prod_qe;
+	struct sqe *sq_cons_qe;
+	/* struct sqe *sq_first_qe; */
+	struct sqe *sq_last_qe;
+	u16 sq_prod_idx;
+	u16 sq_cons_idx;
+	u32 sqe_left;
+
+	void *sq_pgtbl_virt;
+	dma_addr_t sq_pgtbl_phys;
+	u32 sq_pgtbl_size;	/* set to PAGE_SIZE for 5708 & 5709 */
+
+	struct cqe *cq_virt;
+	dma_addr_t cq_phys;
+	u32 cq_mem_size;
+
+	struct cqe *cq_prod_qe;
+	struct cqe *cq_cons_qe;
+	/* struct cqe *cq_first_qe; */
+	struct cqe *cq_last_qe;
+	u16 cq_prod_idx;
+	u16 cq_cons_idx;
+	u32 cqe_left;
+	u32 cqe_size;
+	u32 cqe_exp_seq_sn;
+
+	void *cq_pgtbl_virt;
+	dma_addr_t cq_pgtbl_phys;
+	u32 cq_pgtbl_size;	/* set to PAGE_SIZE for 5708 & 5709 */
+
+	struct rqe *rq_virt;
+	dma_addr_t rq_phys;
+	u32 rq_mem_size;
+
+	struct rqe *rq_prod_qe;
+	struct rqe *rq_cons_qe;
+	/* struct rqe *rq_first_qe; */
+	struct rqe *rq_last_qe;
+	u16 rq_prod_idx;
+	u16 rq_cons_idx;
+	u32 rqe_left;
+
+	void *rq_pgtbl_virt;
+	dma_addr_t rq_pgtbl_phys;
+	u32 rq_pgtbl_size;	/* set to PAGE_SIZE for 5708 & 5709 */
+};
+
+
+
+/*
+ * CID handles
+ */
+struct ep_handles {
+	u32 fw_cid;
+	u32 drv_iscsi_cid;
+	u16 pg_cid;
+	u16 rsvd;
+};
+
+
+/**
+ * struct bnx2i_endpoint - representation of tcp connection in NX2 world
+ *
+ * @link:               list head to link elements
+ * @hba:                adapter to which this connection belongs
+ * @conn:               iscsi connection this EP is linked to
+ * @sess:               iscsi session this EP is linked to
+ * @cm_sk:              cnic sock struct
+ * @hba_age:            age to detect if 'iscsid' issues ep_disconnect()
+ *                      after HBA reset is completed by bnx2i/cnic/bnx2
+ *                      modules
+ * @state:              tracks offload connection state machine
+ * @tcp_port:           Local TCP port number used in this connection
+ * @qp:                 QP information
+ * @ids:                contains chip allocated *context id* & driver assigned
+ *                      *iscsi cid*
+ * @ofld_timer:         offload timer to detect timeout
+ * @ofld_wait:          wait queue
+ *
+ * Endpoint Structure - equivalent of tcp socket structure
+ */
+struct bnx2i_endpoint {
+	struct list_head link;
+	struct bnx2i_hba *hba;
+	struct bnx2i_conn *conn;
+	struct bnx2i_sess *sess;
+	struct cnic_sock *cm_sk;
+	u32 hba_age;
+	u32 state;
+
+/*
+ * mnc - lookup Jeff Garzack's rule about defining this
+ * type of junk. Base on enum and make it less error prone.
+ *	Anil - these are bit masks, won't enum be little ugly?
+ */
+		#define EP_STATE_IDLE			0x00000000
+		#define EP_STATE_PG_OFLD_START		0x00000001
+		#define EP_STATE_PG_OFLD_COMPL		0x00000002
+		#define EP_STATE_OFLD_START		0x00000004
+		#define EP_STATE_OFLD_COMPL		0x00000008
+		#define EP_STATE_CONNECT_START		0x00000010
+		#define EP_STATE_CONNECT_COMPL		0x00000020
+		#define EP_STATE_ULP_UPDATE_START	0x00000040
+		#define EP_STATE_ULP_UPDATE_COMPL	0x00000080
+		#define EP_STATE_DISCONN_START		0x00000100
+		#define EP_STATE_DISCONN_COMPL		0x00000200
+		#define EP_STATE_CLEANUP_START		0x00000400
+		#define EP_STATE_CLEANUP_CMPL		0x00000800
+		#define EP_STATE_TCP_FIN_RCVD		0x00001000
+		#define EP_STATE_TCP_RST_RCVD		0x00002000
+		#define EP_STATE_PG_OFLD_FAILED		0x01000000
+		#define EP_STATE_ULP_UPDATE_FAILED	0x02000000
+		#define EP_STATE_CLEANUP_FAILED		0x04000000
+		#define EP_STATE_OFLD_FAILED		0x08000000
+		#define EP_STATE_CONNECT_FAILED		0x10000000
+		#define EP_STATE_DISCONN_TIMEDOUT	0x20000000
+
+	u16 tcp_port;
+
+	struct qp_info qp;
+	struct ep_handles ids;
+		#define ep_iscsi_cid	ids.drv_iscsi_cid
+		#define ep_cid		ids.fw_cid
+		#define ep_pg_cid	ids.pg_cid
+	struct timer_list ofld_timer;
+	wait_queue_head_t ofld_wait;
+};
+
+
+
+/*
+ * Function Prototypes
+ */
+void bnx2i_register_device(struct bnx2i_hba *hba);
+void bnx2i_check_nx2_dev_busy(void);
+
+void bnx2i_ulp_init(struct cnic_dev *dev);
+void bnx2i_ulp_exit(struct cnic_dev *dev);
+void bnx2i_start(void *handle);
+void bnx2i_stop(void *handle);
+void bnx2i_reg_dev_all(void);
+void bnx2i_unreg_dev_all(void);
+struct bnx2i_hba *get_adapter_list_head(void);
+
+struct bnx2i_conn *bnx2i_get_conn_from_id(struct bnx2i_hba *hba,
+					  u16 iscsi_cid);
+
+int bnx2i_alloc_ep_pool(void);
+void bnx2i_release_ep_pool(void);
+struct bnx2i_endpoint *bnx2i_ep_ofld_list_next(struct bnx2i_hba *hba);
+struct bnx2i_endpoint *bnx2i_ep_destroy_list_next(struct bnx2i_hba *hba);
+
+struct bnx2i_hba *bnx2i_find_hba_for_cnic(struct cnic_dev *cnic);
+
+struct bnx2i_hba *bnx2i_alloc_hba(struct cnic_dev *cnic);
+void bnx2i_free_hba(struct bnx2i_hba *hba);
+
+void bnx2i_get_rq_buf(struct bnx2i_conn *conn, char *ptr, int len);
+void bnx2i_put_rq_buf(struct bnx2i_conn *conn, int count);
+
+void bnx2i_iscsi_unmap_sg_list(struct bnx2i_cmd *cmd);
+
+void bnx2i_drop_session(struct iscsi_cls_session *session);
+
+int bnx2i_get_tcp_port_requirements(void);
+void bnx2i_cleanup_tcp_port_mngr(void);
+void bnx2i_init_tcp_port_mngr(void);
+
+extern int bnx2i_send_fw_iscsi_init_msg(struct bnx2i_hba *hba);
+extern int bnx2i_send_iscsi_login(struct bnx2i_conn *conn,
+				  struct iscsi_task *mtask);
+extern int bnx2i_send_iscsi_tmf(struct bnx2i_conn *conn,
+				  struct iscsi_task *mtask);
+extern int bnx2i_send_iscsi_scsicmd(struct bnx2i_conn *conn,
+				    struct bnx2i_cmd *cmnd);
+extern int bnx2i_send_iscsi_nopout(struct bnx2i_conn *conn,
+				   struct iscsi_task *mtask, u32 ttt,
+				   char *datap, int data_len, int unsol);
+extern int bnx2i_send_iscsi_logout(struct bnx2i_conn *conn,
+				   struct iscsi_task *mtask);
+extern void bnx2i_send_cmd_cleanup_req(struct bnx2i_hba *hba,
+				       struct bnx2i_cmd *cmd);
+extern void bnx2i_send_conn_ofld_req(struct bnx2i_hba *hba,
+				     struct bnx2i_endpoint *ep);
+extern void bnx2i_update_iscsi_conn(struct iscsi_conn *conn);
+extern void bnx2i_send_conn_destroy(struct bnx2i_hba *hba,
+				    struct bnx2i_endpoint *ep);
+
+extern int bnx2i_alloc_qp_resc(struct bnx2i_hba *hba,
+			       struct bnx2i_endpoint *ep);
+extern void bnx2i_free_qp_resc(struct bnx2i_hba *hba,
+			       struct bnx2i_endpoint *ep);
+extern void bnx2i_ep_ofld_timer(unsigned long data);
+
+extern int bnx2i_map_ep_dbell_regs(struct bnx2i_endpoint *ep);
+
+/* Debug related function prototypes */
+extern void bnx2i_print_pend_cmd_queue(struct bnx2i_conn *conn);
+extern void bnx2i_print_active_cmd_queue(struct bnx2i_conn *conn);
+extern void bnx2i_print_xmit_pdu_queue(struct bnx2i_conn *conn);
+extern void bnx2i_print_recv_state(struct bnx2i_conn *conn);
+
+void bnx2i_tcp_port_new_entry(u16 tcp_port);
+
+#endif
diff --git a/drivers/scsi/bnx2i/bnx2i_hwi.c b/drivers/scsi/bnx2i/bnx2i_hwi.c
new file mode 100644
index 0000000..3d2fa78
--- /dev/null
+++ b/drivers/scsi/bnx2i/bnx2i_hwi.c
@@ -0,0 +1,2112 @@
+/* bnx2i_hwi.c: Broadcom NetXtreme II iSCSI driver.
+ *
+ * Copyright (c) 2006 - 2008 Broadcom Corporation
+ * Copyright (c) 2007, 2008 Red Hat, Inc.  All rights reserved.
+ * Copyright (c) 2007, 2008 Mike Christie
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation.
+ *
+ * Written by: Anil Veerabhadrappa (anilgv-dY08KVG/lbpWk0Htik3J/w@public.gmane.org)
+ */
+
+#include <scsi/scsi_tcq.h>
+#include <scsi/libiscsi.h>
+#include "bnx2i.h"
+
+/**
+ * bnx2i_get_link_state - get network interface link state
+ * @hba:	adapter instance pointer
+ *
+ * updates adapter structure flag based on netdev state
+ */
+static void bnx2i_get_link_state(struct bnx2i_hba *hba)
+{
+	if (test_bit(__LINK_STATE_NOCARRIER, &hba->netdev->state))
+		set_bit(ADAPTER_STATE_LINK_DOWN, &hba->adapter_state);
+	else
+		clear_bit(ADAPTER_STATE_LINK_DOWN, &hba->adapter_state);
+}
+
+
+/**
+ * bnx2i_iscsi_license_error - displays iscsi license related error message
+ * @hba:		adapter instance pointer
+ * @error_code:		error classification
+ *
+ * Puts out an error log when driver is unable to offload iscsi connection
+ *	due to license restrictions
+ */
+static void bnx2i_iscsi_license_error(struct bnx2i_hba *hba, u32 error_code)
+{
+	if (error_code == ISCSI_KCQE_COMPLETION_STATUS_ISCSI_NOT_SUPPORTED)
+		/* iSCSI offload not supported on this device */
+		printk(KERN_ERR "bnx2i: iSCSI not supported, dev=%s\n",
+				hba->netdev->name);
+	if (error_code == ISCSI_KCQE_COMPLETION_STATUS_LOM_ISCSI_NOT_ENABLED)
+		/* iSCSI offload not supported on this LOM device */
+		printk(KERN_ERR "bnx2i: LOM is not enable to "
+				"offload iSCSI connections, dev=%s\n",
+				hba->netdev->name);
+	set_bit(ADAPTER_STATE_INIT_FAILED, &hba->adapter_state);
+}
+
+#ifdef _EVENT_COALESCE_
+#define CNIC_ARM_CQE			1
+#define CNIC_DISARM_CQE			0
+extern unsigned int event_coal_div;
+
+/**
+ * bnx2i_arm_cq_event_coalescing - arms CQ to enable EQ notification
+ * @ep:		endpoint (transport indentifier) structure
+ * @action:	action, ARM or DISARM. For now only ARM_CQE is used
+ *
+ * Arm'ing CQ will enable chip to generate global EQ events inorder to interrupt
+ *	the driver. EQ event is generated CQ index is hit or at least 1 CQ is
+ *	outstanding and on chip timer expires
+ */
+static void bnx2i_arm_cq_event_coalescing(struct bnx2i_endpoint *ep, u8 action)
+{
+	u16 cq_index;
+	if ((action == CNIC_ARM_CQE) && ep->sess) {
+		cq_index = ep->qp.cqe_exp_seq_sn +
+			   ep->sess->num_active_cmds / event_coal_div;
+		cq_index %= (ep->qp.cqe_size * 2 + 1);
+		if (!cq_index)
+			cq_index = 1;
+		writew(cq_index, ep->qp.ctx_base + CNIC_EVENT_COAL_INDEX);
+	}
+	writeb(action, ep->qp.ctx_base + CNIC_EVENT_CQ_ARM);
+
+}
+#endif
+
+/**
+ * bnx2i_get_rq_buf - copy RQ buffer contents to driver buffer
+ * @conn:		iscsi connection on which RQ event occured
+ * @ptr:		driver buffer to which RQ buffer contents is to
+ *			be copied
+ * @len:		length of valid data inside RQ buf
+ *
+ * Copies RQ buffer contents from shared (DMA'able) memory region to
+ *	driver buffer. RQ is used to DMA unsolicitated iscsi pdu's and
+ *	scsi sense info
+ */
+void bnx2i_get_rq_buf(struct bnx2i_conn *bnx2i_conn, char *ptr, int len)
+{
+	if (!bnx2i_conn->ep->qp.rqe_left)
+		return;
+
+	bnx2i_conn->ep->qp.rqe_left--;
+	memcpy(ptr, (u8 *) bnx2i_conn->ep->qp.rq_cons_qe, len);
+	if (bnx2i_conn->ep->qp.rq_cons_qe == bnx2i_conn->ep->qp.rq_last_qe) {
+		bnx2i_conn->ep->qp.rq_cons_qe = bnx2i_conn->ep->qp.rq_virt;
+		bnx2i_conn->ep->qp.rq_cons_idx = 0;
+	} else {
+		bnx2i_conn->ep->qp.rq_cons_qe++;
+		bnx2i_conn->ep->qp.rq_cons_idx++;
+	}
+}
+
+
+/**
+ * bnx2i_put_rq_buf - Replenish RQ buffer, if required ring on chip doorbell
+ * @conn:	iscsi connection on which event to post
+ * @count:	number of RQ buffer being posted to chip
+ *
+ * No need to ring hardware doorbell for 57710 family of devices
+ */
+void bnx2i_put_rq_buf(struct bnx2i_conn *bnx2i_conn, int count)
+{
+	u16 hi_bit = (bnx2i_conn->ep->qp.rq_prod_idx & 0x8000);
+
+	bnx2i_conn->ep->qp.rqe_left += count;
+	bnx2i_conn->ep->qp.rq_prod_idx &= 0x7FFF;
+	bnx2i_conn->ep->qp.rq_prod_idx += count;
+
+	if (bnx2i_conn->ep->qp.rq_prod_idx > bnx2i_conn->hba->max_rqes) {
+			bnx2i_conn->ep->qp.rq_prod_idx %=
+						bnx2i_conn->hba->max_rqes;
+			if (!hi_bit)
+				bnx2i_conn->ep->qp.rq_prod_idx |= 0x8000;
+	} else
+		bnx2i_conn->ep->qp.rq_prod_idx |= hi_bit;
+
+	writew(bnx2i_conn->ep->qp.rq_prod_idx,
+	       bnx2i_conn->ep->qp.ctx_base + CNIC_RECV_DOORBELL);
+	mmiowb();
+}
+
+
+/**
+ * bnx2i_ring_sq_dbell - Ring SQ doorbell to wake-up the processing engine
+ *
+ * @conn: 		iscsi connection to which new SQ entries belong
+ * @count: 		number of SQ WQEs to post
+ *
+ * SQ DB is updated in host memory and TX Doorbell is rung for 57710 family
+ *	of devices. For 5706/5708/5709 new SQ WQE count is written into the
+ *	doorbell register
+ **/
+static void bnx2i_ring_sq_dbell(struct bnx2i_conn *bnx2i_conn, int count)
+{
+	wmb();	/* flush SQ WQE memory before the doorbell is rung */
+	writew(count, bnx2i_conn->ep->qp.ctx_base + CNIC_SEND_DOORBELL);
+	mmiowb(); /* flush posted PCI writes */
+}
+
+
+
+/**
+ * bnx2i_ring_dbell_update_sq_params - update SQ driver parameters
+ * @conn:	iscsi connection to which new SQ entries belong
+ * @count:	number of SQ WQEs to post
+ *
+ * this routine will update SQ driver parameters and ring the doorbell
+ */
+void bnx2i_ring_dbell_update_sq_params(struct bnx2i_conn *bnx2i_conn, int count)
+{
+	int tmp_cnt;
+
+	if (count == 1) {
+		if (bnx2i_conn->ep->qp.sq_prod_qe ==
+		    bnx2i_conn->ep->qp.sq_last_qe)
+			bnx2i_conn->ep->qp.sq_prod_qe =
+						bnx2i_conn->ep->qp.sq_virt;
+		else
+			bnx2i_conn->ep->qp.sq_prod_qe++;
+	} else {
+		if ((bnx2i_conn->ep->qp.sq_prod_qe + count) <=
+		    bnx2i_conn->ep->qp.sq_last_qe)
+			bnx2i_conn->ep->qp.sq_prod_qe += count;
+		else {
+			tmp_cnt = bnx2i_conn->ep->qp.sq_last_qe -
+				bnx2i_conn->ep->qp.sq_prod_qe;
+			bnx2i_conn->ep->qp.sq_prod_qe =
+				&bnx2i_conn->ep->qp.sq_virt[count -
+							    (tmp_cnt + 1)];
+		}
+	}
+	bnx2i_conn->ep->qp.sq_prod_idx += count;
+	/* Ring the doorbell */
+	bnx2i_ring_sq_dbell(bnx2i_conn, bnx2i_conn->ep->qp.sq_prod_idx);
+}
+
+
+/**
+ * bnx2i_send_iscsi_login - post iSCSI login request MP WQE to hardware
+ * @conn:	iscsi connection
+ * @cmd:	driver command structure which is requesting
+ *		a WQE to sent to chip for further processing
+ *
+ * prepare and post an iSCSI Login request WQE to CNIC firmware
+ */
+int bnx2i_send_iscsi_login(struct bnx2i_conn *bnx2i_conn,
+			   struct iscsi_task *task)
+{
+	struct bnx2i_cmd *bnx2i_cmd;
+	struct bnx2i_login_request *login_wqe;
+	struct iscsi_login *login_hdr;
+	u32 dword;
+
+	bnx2i_cmd = (struct bnx2i_cmd *)task->dd_data;
+	login_hdr = (struct iscsi_login *)task->hdr;
+	login_wqe = (struct bnx2i_login_request *)
+						bnx2i_conn->ep->qp.sq_prod_qe;
+
+	login_wqe->op_code = login_hdr->opcode;
+	login_wqe->op_attr = login_hdr->flags;
+	login_wqe->version_max = login_hdr->max_version;
+	login_wqe->version_min = login_hdr->min_version;
+	login_wqe->data_length = ntoh24(login_hdr->dlength);
+	login_wqe->isid_lo = *((u32 *) login_hdr->isid);
+	login_wqe->isid_hi = *((u16 *) login_hdr->isid + 2);
+	login_wqe->tsih = login_hdr->tsih;
+	login_wqe->itt = task->itt |
+		(ISCSI_TASK_TYPE_MPATH << ISCSI_LOGIN_REQUEST_TYPE_SHIFT);
+	login_wqe->cid = login_hdr->cid;
+
+	login_wqe->cmd_sn = be32_to_cpu(login_hdr->cmdsn);
+	login_wqe->exp_stat_sn = be32_to_cpu(login_hdr->exp_statsn);
+
+	login_wqe->resp_bd_list_addr_lo = (u32) bnx2i_conn->gen_pdu.resp_bd_dma;
+	login_wqe->resp_bd_list_addr_hi =
+		(u32) ((u64) bnx2i_conn->gen_pdu.resp_bd_dma >> 32);
+
+	dword = ((1 << ISCSI_LOGIN_REQUEST_NUM_RESP_BDS_SHIFT) |
+		 (bnx2i_conn->gen_pdu.resp_buf_size <<
+		  ISCSI_LOGIN_REQUEST_RESP_BUFFER_LENGTH_SHIFT));
+	login_wqe->resp_buffer = dword;
+	login_wqe->flags = 0;
+	login_wqe->bd_list_addr_lo = (u32) bnx2i_conn->gen_pdu.req_bd_dma;
+	login_wqe->bd_list_addr_hi =
+		(u32) ((u64) bnx2i_conn->gen_pdu.req_bd_dma >> 32);
+	login_wqe->num_bds = 1;
+
+	bnx2i_ring_dbell_update_sq_params(bnx2i_conn, 1);
+	return 0;
+}
+
+/**
+ * bnx2i_send_iscsi_tmf - post iSCSI task management request MP WQE to hardware
+ * @conn:	iscsi connection
+ * @mtask:	driver command structure which is requesting
+ *		a WQE to sent to chip for further processing
+ *
+ * prepare and post an iSCSI Login request WQE to CNIC firmware
+ */
+int bnx2i_send_iscsi_tmf(struct bnx2i_conn *bnx2i_conn,
+			 struct iscsi_task *mtask)
+{
+	struct iscsi_conn *conn = bnx2i_conn->cls_conn->dd_data;
+	struct iscsi_tm *tmfabort_hdr;
+	struct scsi_cmnd *ref_sc;
+	struct iscsi_task *ctask;
+	struct bnx2i_cmd *bnx2i_cmd;
+	struct bnx2i_tmf_request *tmfabort_wqe;
+	u32 dword;
+
+	bnx2i_cmd = (struct bnx2i_cmd *)mtask->dd_data;
+	tmfabort_hdr = (struct iscsi_tm *)mtask->hdr;
+	tmfabort_wqe = (struct bnx2i_tmf_request *)
+						bnx2i_conn->ep->qp.sq_prod_qe;
+
+	tmfabort_wqe->op_code = tmfabort_hdr->opcode;
+	tmfabort_wqe->op_attr = 0;
+	tmfabort_wqe->op_attr =
+		ISCSI_TMF_REQUEST_ALWAYS_ONE | ISCSI_TM_FUNC_ABORT_TASK;
+	tmfabort_wqe->lun[0] = be32_to_cpu(tmfabort_hdr->lun[0]);
+	tmfabort_wqe->lun[1] = be32_to_cpu(tmfabort_hdr->lun[1]);
+
+	tmfabort_wqe->itt = (mtask->itt | (ISCSI_TASK_TYPE_MPATH << 14));
+	tmfabort_wqe->reserved2 = 0;
+	tmfabort_wqe->cmd_sn = be32_to_cpu(tmfabort_hdr->cmdsn);
+
+	ctask = iscsi_itt_to_task(conn, tmfabort_hdr->rtt);
+	if (!ctask || ctask->sc)
+		/*
+		 * the iscsi layer must have completed the cmd while this
+		 * was starting up.
+		 */
+		return 0;
+	ref_sc = ctask->sc;
+
+	if (ref_sc->sc_data_direction == DMA_TO_DEVICE)
+		dword = (ISCSI_TASK_TYPE_WRITE << ISCSI_CMD_REQUEST_TYPE_SHIFT);
+	else
+		dword = (ISCSI_TASK_TYPE_READ << ISCSI_CMD_REQUEST_TYPE_SHIFT);
+	tmfabort_wqe->ref_itt = (dword |= tmfabort_hdr->rtt);
+	tmfabort_wqe->ref_cmd_sn = be32_to_cpu(tmfabort_hdr->refcmdsn);
+
+	tmfabort_wqe->bd_list_addr_lo = (u32) bnx2i_conn->hba->mp_bd_dma;
+	tmfabort_wqe->bd_list_addr_hi = (u32)
+				((u64) bnx2i_conn->hba->mp_bd_dma >> 32);
+	tmfabort_wqe->num_bds = 1;
+
+	bnx2i_ring_dbell_update_sq_params(bnx2i_conn, 1);
+	return 0;
+}
+
+/**
+ * bnx2i_send_iscsi_scsicmd - post iSCSI scsicmd request WQE to hardware
+ * @conn:	iscsi connection
+ * @cmd:	driver command structure which is requesting
+ *		a WQE to sent to chip for further processing
+ *
+ * prepare and post an iSCSI SCSI-CMD request WQE to CNIC firmware
+ */
+int bnx2i_send_iscsi_scsicmd(struct bnx2i_conn *bnx2i_conn,
+			     struct bnx2i_cmd *cmd)
+{
+	struct bnx2i_cmd_request *scsi_cmd_wqe;
+
+	scsi_cmd_wqe = (struct bnx2i_cmd_request *)
+						bnx2i_conn->ep->qp.sq_prod_qe;
+	memcpy(scsi_cmd_wqe, &cmd->req, sizeof(struct bnx2i_cmd_request));
+
+	bnx2i_ring_dbell_update_sq_params(bnx2i_conn, 1);
+	return 0;
+}
+
+/**
+ * bnx2i_send_iscsi_nopout - post iSCSI NOPOUT request WQE to hardware
+ * @conn:		iscsi connection
+ * @cmd:		driver command structure which is requesting
+ *			a WQE to sent to chip for further processing
+ * @ttt:		TTT to be used when building pdu header
+ * @datap:		payload buffer pointer
+ * @data_len:		payload data length
+ * @unsol:		indicated whether nopout pdu is unsolicited pdu or
+ *			in response to target's NOPIN w/ TTT != FFFFFFFF
+ *
+ * prepare and post a nopout request WQE to CNIC firmware
+ */
+int bnx2i_send_iscsi_nopout(struct bnx2i_conn *bnx2i_conn,
+			    struct iscsi_task *task, u32 ttt,
+			    char *datap, int data_len, int unsol)
+{
+	struct bnx2i_cmd *bnx2i_cmd;
+	struct bnx2i_nop_out_request *nopout_wqe;
+	struct iscsi_nopout *nopout_hdr;
+
+	bnx2i_cmd = (struct bnx2i_cmd *)task->dd_data;
+	nopout_hdr = (struct iscsi_nopout *)task->hdr;
+	nopout_wqe = (struct bnx2i_nop_out_request *)
+						bnx2i_conn->ep->qp.sq_prod_qe;
+	nopout_wqe->op_code = nopout_hdr->opcode;
+	nopout_wqe->op_attr = ISCSI_FLAG_CMD_FINAL;
+	memcpy(nopout_wqe->lun, nopout_hdr->lun, 8);
+	nopout_wqe->itt = ((u16)task->itt |
+			   (ISCSI_TASK_TYPE_MPATH <<
+			    ISCSI_TMF_REQUEST_TYPE_SHIFT));
+	nopout_wqe->ttt = ttt;
+	nopout_wqe->flags = 0;
+	if (!unsol)
+		nopout_wqe->flags = ISCSI_NOP_OUT_REQUEST_LOCAL_COMPLETION;
+	else if (nopout_hdr->itt == ISCSI_RESERVED_TAG)
+		nopout_wqe->flags = ISCSI_NOP_OUT_REQUEST_LOCAL_COMPLETION;
+
+	nopout_wqe->cmd_sn = be32_to_cpu(nopout_hdr->cmdsn);
+	nopout_wqe->data_length = data_len;
+	if (data_len) {
+		/* handle payload data, not required in first release */
+		printk(KERN_ALERT "NOPOUT: WARNING!! payload len != 0\n");
+	} else {
+		nopout_wqe->bd_list_addr_lo = (u32)
+					bnx2i_conn->hba->mp_bd_dma;
+		nopout_wqe->bd_list_addr_hi =
+			(u32) ((u64) bnx2i_conn->hba->mp_bd_dma >> 32);
+		nopout_wqe->num_bds = 1;
+	}
+
+	bnx2i_ring_dbell_update_sq_params(bnx2i_conn, 1);
+	return 0;
+}
+
+
+/**
+ * bnx2i_send_iscsi_logout - post iSCSI logout request WQE to hardware
+ * @conn:	iscsi connection
+ * @cmd:	driver command structure which is requesting
+ *		a WQE to sent to chip for further processing
+ *
+ * prepare and post logout request WQE to CNIC firmware
+ */
+int bnx2i_send_iscsi_logout(struct bnx2i_conn *bnx2i_conn,
+			    struct iscsi_task *task)
+{
+	struct bnx2i_cmd *bnx2i_cmd;
+	struct bnx2i_logout_request *logout_wqe;
+	struct iscsi_logout *logout_hdr;
+
+	bnx2i_cmd = (struct bnx2i_cmd *)task->dd_data;
+	logout_hdr = (struct iscsi_logout *)task->hdr;
+
+	logout_wqe = (struct bnx2i_logout_request *)
+						bnx2i_conn->ep->qp.sq_prod_qe;
+	memset(logout_wqe, 0x00, sizeof(struct bnx2i_logout_request));
+
+	logout_wqe->op_code = logout_hdr->opcode;
+	logout_wqe->cmd_sn = be32_to_cpu(logout_hdr->cmdsn);
+	logout_wqe->op_attr =
+			logout_hdr->flags | ISCSI_LOGOUT_REQUEST_ALWAYS_ONE;
+	logout_wqe->itt = ((u16)task->itt |
+			   (ISCSI_TASK_TYPE_MPATH <<
+			    ISCSI_LOGOUT_REQUEST_TYPE_SHIFT));
+	logout_wqe->data_length = 0;
+	logout_wqe->cid = 0;
+
+	logout_wqe->bd_list_addr_lo = (u32) bnx2i_conn->hba->mp_bd_dma;
+	logout_wqe->bd_list_addr_hi = (u32)
+				((u64) bnx2i_conn->hba->mp_bd_dma >> 32);
+	logout_wqe->num_bds = 1;
+
+	bnx2i_ring_dbell_update_sq_params(bnx2i_conn, 1);
+	return 0;
+}
+
+
+/**
+ * bnx2i_update_iscsi_conn - post iSCSI logout request WQE to hardware
+ * @conn:	iscsi connection which requires iscsi parameter update
+ *
+ * sends down iSCSI Conn Update request to move iSCSI conn to FFP
+ */
+void bnx2i_update_iscsi_conn(struct iscsi_conn *conn)
+{
+	struct bnx2i_conn *bnx2i_conn = conn->dd_data;
+	struct bnx2i_hba *hba = bnx2i_conn->hba;
+	struct kwqe *kwqe_arr[2];
+	struct iscsi_kwqe_conn_update *update_wqe;
+	struct iscsi_kwqe_conn_update conn_update_kwqe;
+
+	update_wqe = &conn_update_kwqe;
+
+	update_wqe->hdr.op_code = ISCSI_KWQE_OPCODE_UPDATE_CONN;
+	update_wqe->hdr.flags =
+		(ISCSI_KWQE_LAYER_CODE << ISCSI_KWQE_HEADER_LAYER_CODE_SHIFT);
+
+	update_wqe->context_id = (bnx2i_conn->ep->ep_cid >> 7);
+	update_wqe->conn_flags = 0;
+	if (conn->hdrdgst_en)
+		update_wqe->conn_flags |= ISCSI_KWQE_CONN_UPDATE_HEADER_DIGEST;
+	if (conn->datadgst_en)
+		update_wqe->conn_flags |= ISCSI_KWQE_CONN_UPDATE_DATA_DIGEST;
+	if (conn->session->initial_r2t_en)
+		update_wqe->conn_flags |= ISCSI_KWQE_CONN_UPDATE_INITIAL_R2T;
+	if (conn->session->imm_data_en)
+		update_wqe->conn_flags |= ISCSI_KWQE_CONN_UPDATE_IMMEDIATE_DATA;
+
+	update_wqe->max_send_pdu_length = conn->max_xmit_dlength;
+	update_wqe->max_recv_pdu_length = conn->max_recv_dlength;
+	update_wqe->first_burst_length = conn->session->first_burst;
+	update_wqe->max_burst_length = conn->session->max_burst;
+	update_wqe->exp_stat_sn = bnx2i_conn->exp_statsn;
+	update_wqe->max_outstanding_r2ts = conn->session->max_r2t;
+	update_wqe->session_error_recovery_level = conn->session->erl;
+	iscsi_conn_printk(KERN_ALERT, conn,
+			  "bnx2i: conn update - MBL 0x%x FBL 0x%x"
+			  "MRDSL_I 0x%x MRDSL_T 0x%x \n",
+			  update_wqe->max_burst_length,
+			  update_wqe->first_burst_length,
+			  update_wqe->max_recv_pdu_length,
+			  update_wqe->max_send_pdu_length);
+
+	kwqe_arr[0] = (struct kwqe *) update_wqe;
+	if (hba->cnic && hba->cnic->submit_kwqes)
+		hba->cnic->submit_kwqes(hba->cnic, kwqe_arr, 1);
+}
+
+
+/**
+ * bnx2i_ep_ofld_timer - post iSCSI logout request WQE to hardware
+ * @data:	endpoint (transport handle) structure pointer
+ *
+ * routine to handle connection offload/destroy request timeout
+ */
+void bnx2i_ep_ofld_timer(unsigned long data)
+{
+	struct bnx2i_endpoint *ep = (struct bnx2i_endpoint *) data;
+
+	if (ep->state == EP_STATE_OFLD_START) {
+		printk(KERN_ALERT "ofld_timer: CONN_OFLD timeout\n");
+		ep->state = EP_STATE_OFLD_FAILED;
+	} else if (ep->state == EP_STATE_DISCONN_START) {
+		printk(KERN_ALERT "ofld_timer: CONN_DISCON timeout\n");
+		ep->state = EP_STATE_DISCONN_TIMEDOUT;
+	} else if (ep->state == EP_STATE_CLEANUP_START) {
+		printk(KERN_ALERT "ofld_timer: CONN_CLEANUP timeout\n");
+		ep->state = EP_STATE_CLEANUP_FAILED;
+	}
+
+	wake_up_interruptible(&ep->ofld_wait);
+}
+
+
+static int bnx2i_power_of2(u32 val)
+{
+	u32 power = 0;
+	if (val & (val - 1))
+		return power;
+	val--;
+	while (val) {
+		val = val >> 1;
+		power++;
+	}
+	return power;
+}
+
+
+/**
+ * bnx2i_send_cmd_cleanup_req - send iscsi cmd context clean-up request
+ * @hba:	adapter structure pointer
+ * @cmd:	driver command structure which is requesting
+ *		a WQE to sent to chip for further processing
+ *
+ * prepares and posts CONN_OFLD_REQ1/2 KWQE
+ */
+void bnx2i_send_cmd_cleanup_req(struct bnx2i_hba *hba, struct bnx2i_cmd *cmd)
+{
+	struct bnx2i_cleanup_request *cmd_cleanup;
+
+	cmd_cleanup =
+		(struct bnx2i_cleanup_request *)cmd->conn->ep->qp.sq_prod_qe;
+	memset(cmd_cleanup, 0x00, sizeof(struct bnx2i_cleanup_request));
+
+	cmd_cleanup->op_code = ISCSI_OPCODE_CLEANUP_REQUEST;
+	cmd_cleanup->itt = cmd->req.itt;
+
+	bnx2i_ring_dbell_update_sq_params(cmd->conn, 1);
+}
+
+
+/**
+ * bnx2i_send_conn_destroy - initiates iscsi connection teardown process
+ * @hba:	adapter structure pointer
+ * @ep:		endpoint (transport indentifier) structure
+ *
+ * this routine prepares and posts CONN_OFLD_REQ1/2 KWQE to initiate
+ * 	iscsi connection context clean-up process
+ */
+void bnx2i_send_conn_destroy(struct bnx2i_hba *hba, struct bnx2i_endpoint *ep)
+{
+	struct kwqe *kwqe_arr[2];
+	struct iscsi_kwqe_conn_destroy conn_cleanup;
+
+	memset(&conn_cleanup, 0x00, sizeof(struct iscsi_kwqe_conn_destroy));
+
+	conn_cleanup.hdr.op_code = ISCSI_KWQE_OPCODE_DESTROY_CONN;
+	conn_cleanup.hdr.flags =
+		(ISCSI_KWQE_LAYER_CODE << ISCSI_KWQE_HEADER_LAYER_CODE_SHIFT);
+	conn_cleanup.context_id = (ep->ep_cid >> 7);
+	kwqe_arr[0] = (struct kwqe *) &conn_cleanup;
+	if (hba->cnic && hba->cnic->submit_kwqes)
+		hba->cnic->submit_kwqes(hba->cnic, kwqe_arr, 1);
+}
+
+
+/**
+ * bnx2i_send_conn_ofld_req - initiates iscsi connection context setup process
+ * @hba:	adapter structure pointer
+ * @ep:		endpoint (transport indentifier) structure
+ *
+ * this routine prepares and posts CONN_OFLD_REQ1/2 KWQE
+ */
+void bnx2i_send_conn_ofld_req(struct bnx2i_hba *hba, struct bnx2i_endpoint *ep)
+{
+	struct kwqe *kwqe_arr[2];
+	struct iscsi_kwqe_conn_offload1 ofld_req1;
+	struct iscsi_kwqe_conn_offload2 ofld_req2;
+	u32 *ptbl;
+
+	ofld_req1.hdr.op_code = ISCSI_KWQE_OPCODE_OFFLOAD_CONN1;
+	ofld_req1.hdr.flags =
+		(ISCSI_KWQE_LAYER_CODE << ISCSI_KWQE_HEADER_LAYER_CODE_SHIFT);
+
+	ofld_req1.iscsi_conn_id = (u16) ep->ep_iscsi_cid;
+	ofld_req1.sq_page_table_addr_lo = (u32) ep->qp.sq_pgtbl_phys;
+	ofld_req1.sq_page_table_addr_hi =
+		(u32) ((u64) ep->qp.sq_pgtbl_phys >> 32);
+
+	ofld_req1.cq_page_table_addr_lo = (u32) ep->qp.cq_pgtbl_phys;
+	ofld_req1.cq_page_table_addr_hi =
+		(u32) ((u64) ep->qp.cq_pgtbl_phys >> 32);
+
+	ofld_req2.hdr.op_code = ISCSI_KWQE_OPCODE_OFFLOAD_CONN2;
+	ofld_req2.hdr.flags =
+		(ISCSI_KWQE_LAYER_CODE << ISCSI_KWQE_HEADER_LAYER_CODE_SHIFT);
+
+	ofld_req2.rq_page_table_addr_lo = (u32) ep->qp.rq_pgtbl_phys;
+	ofld_req2.rq_page_table_addr_hi =
+		(u32) ((u64) ep->qp.rq_pgtbl_phys >> 32);
+
+	ptbl = (u32 *) ep->qp.sq_pgtbl_virt;
+	ofld_req2.sq_first_pte.hi = *ptbl++;
+	ofld_req2.sq_first_pte.lo = *ptbl;
+	ptbl = (u32 *) ep->qp.cq_pgtbl_virt;
+	ofld_req2.cq_first_pte.hi = *ptbl++;
+	ofld_req2.cq_first_pte.lo = *ptbl;
+
+	kwqe_arr[0] = (struct kwqe *) &ofld_req1;
+	kwqe_arr[1] = (struct kwqe *) &ofld_req2;
+
+	if (hba->cnic && hba->cnic->submit_kwqes)
+		hba->cnic->submit_kwqes(hba->cnic, kwqe_arr, 2);
+}
+
+
+/**
+ * setup_qp_page_tables - iscsi QP page table setup function
+ * @ep:		endpoint (transport indentifier) structure
+ *
+ * Sets up page tables for SQ/RQ/CQ, 1G/sec (5706/5708/5709) devices requires
+ * 	64-bit address in big endian format. Whereas 10G/sec (57710) requires
+ * 	PT in little endian format
+ */
+void setup_qp_page_tables(struct bnx2i_endpoint *ep)
+{
+	int num_pages;
+	u32 *ptbl;
+	dma_addr_t page;
+
+	/* SQ page table */
+	num_pages = ep->qp.sq_mem_size / PAGE_SIZE;
+	page = ep->qp.sq_phys;
+	ptbl = (u32 *) ep->qp.sq_pgtbl_virt;
+	memset(ptbl, 0, ep->qp.sq_pgtbl_size);
+	while (num_pages--) {
+		/* PTE is always written in big endian format */
+		*ptbl = (u32) ((u64) page >> 32);
+		ptbl++;
+		*ptbl = (u32) page;
+		ptbl++;
+		page += PAGE_SIZE;
+	}
+
+	/* RQ page table */
+	num_pages = ep->qp.rq_mem_size / PAGE_SIZE;
+	page = ep->qp.rq_phys;
+	ptbl = (u32 *) ep->qp.rq_pgtbl_virt;
+	memset(ptbl, 0, ep->qp.rq_pgtbl_size);
+	while (num_pages--) {
+		/* PTE is always written in big endian format */
+		*ptbl = (u32) ((u64) page >> 32);
+		ptbl++;
+		*ptbl = (u32) page;
+		ptbl++;
+		page += PAGE_SIZE;
+	}
+
+	/* CQ page table */
+	num_pages = ep->qp.cq_mem_size / PAGE_SIZE;
+	page = ep->qp.cq_phys;
+	ptbl = (u32 *) ep->qp.cq_pgtbl_virt;
+	memset(ptbl, 0, ep->qp.cq_pgtbl_size);
+	while (num_pages--) {
+		/* PTE is always written in big endian format */
+		*ptbl = (u32) ((u64) page >> 32);
+		ptbl++;
+		*ptbl = (u32) page;
+		ptbl++;
+		page += PAGE_SIZE;
+	}
+}
+
+
+
+/**
+ * bnx2i_alloc_qp_resc - allocates required resources for QP.
+ * @hba:	adapter structure pointer
+ * @ep:		endpoint (transport indentifier) structure
+ *
+ * Allocate QP (transport layer for iSCSI connection) resources, DMA'able
+ *	memory for SQ/RQ/CQ and page tables. EP structure elements such
+ *	as producer/consumer indexes/pointers, queue sizes and page table
+ *	contents are setup
+ */
+int bnx2i_alloc_qp_resc(struct bnx2i_hba *hba, struct bnx2i_endpoint *ep)
+{
+	ep->hba = hba;
+	ep->conn = NULL;
+	ep->ep_cid = ep->ep_iscsi_cid = ep->ep_pg_cid = 0;
+
+	/* Allocate page table memory for SQ which is page aligned */
+	ep->qp.sq_mem_size = hba->max_sqes * BNX2I_SQ_WQE_SIZE;
+	ep->qp.sq_mem_size =
+		(ep->qp.sq_mem_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+	ep->qp.sq_pgtbl_size =
+		(ep->qp.sq_mem_size / PAGE_SIZE) * sizeof(void *);
+	ep->qp.sq_pgtbl_size =
+		(ep->qp.sq_pgtbl_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+
+	ep->qp.sq_pgtbl_virt =
+		dma_alloc_coherent(&hba->pcidev->dev, ep->qp.sq_pgtbl_size,
+				   &ep->qp.sq_pgtbl_phys, GFP_KERNEL);
+	if (!ep->qp.sq_pgtbl_virt) {
+		printk(KERN_ALERT "bnx2i: unable to alloc SQ PT mem (%d)\n",
+				  ep->qp.sq_pgtbl_size);
+		goto mem_alloc_err;
+	}
+
+	/* Allocate memory area for actual SQ element */
+	ep->qp.sq_virt =
+		dma_alloc_coherent(&hba->pcidev->dev, ep->qp.sq_mem_size,
+				   &ep->qp.sq_phys, GFP_KERNEL);
+	if (!ep->qp.sq_virt) {
+		printk(KERN_ALERT "bnx2i: unable to alloc SQ BD memory %d\n",
+				  ep->qp.sq_mem_size);
+		goto mem_alloc_err;
+	}
+
+	memset(ep->qp.sq_virt, 0x00, ep->qp.sq_mem_size);
+	ep->qp.sq_prod_qe = ep->qp.sq_virt;
+	ep->qp.sq_cons_qe = ep->qp.sq_virt;
+	ep->qp.sq_last_qe = &ep->qp.sq_virt[hba->max_sqes - 1];
+	ep->qp.sq_prod_idx = 0;
+	ep->qp.sq_cons_idx = 0;
+	ep->qp.sqe_left = hba->max_sqes;
+
+	/* Allocate page table memory for CQ which is page aligned */
+	ep->qp.cq_mem_size = hba->max_cqes * BNX2I_CQE_SIZE;
+	ep->qp.cq_mem_size =
+		(ep->qp.cq_mem_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+	ep->qp.cq_pgtbl_size =
+		(ep->qp.cq_mem_size / PAGE_SIZE) * sizeof(void *);
+	ep->qp.cq_pgtbl_size =
+		(ep->qp.cq_pgtbl_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+
+	ep->qp.cq_pgtbl_virt =
+		dma_alloc_coherent(&hba->pcidev->dev, ep->qp.cq_pgtbl_size,
+				   &ep->qp.cq_pgtbl_phys, GFP_KERNEL);
+	if (!ep->qp.cq_pgtbl_virt) {
+		printk(KERN_ALERT "bnx2i: unable to alloc CQ PT memory %d\n",
+				  ep->qp.cq_pgtbl_size);
+		goto mem_alloc_err;
+	}
+
+	/* Allocate memory area for actual CQ element */
+	ep->qp.cq_virt =
+		dma_alloc_coherent(&hba->pcidev->dev, ep->qp.cq_mem_size,
+				   &ep->qp.cq_phys, GFP_KERNEL);
+	if (!ep->qp.cq_virt) {
+		printk(KERN_ALERT "bnx2i: unable to alloc CQ BD memory %d\n",
+				  ep->qp.cq_mem_size);
+		goto mem_alloc_err;
+	}
+	memset (ep->qp.cq_virt, 0x00, ep->qp.cq_mem_size);
+
+	ep->qp.cq_prod_qe = ep->qp.cq_virt;
+	ep->qp.cq_cons_qe = ep->qp.cq_virt;
+	ep->qp.cq_last_qe = &ep->qp.cq_virt[hba->max_cqes - 1];
+	ep->qp.cq_prod_idx = 0;
+	ep->qp.cq_cons_idx = 0;
+	ep->qp.cqe_left = hba->max_cqes;
+	ep->qp.cqe_exp_seq_sn = ISCSI_INITIAL_SN;
+	ep->qp.cqe_size = hba->max_cqes;
+
+	/* Allocate page table memory for RQ which is page aligned */
+	ep->qp.rq_mem_size = hba->max_rqes * BNX2I_RQ_WQE_SIZE;
+	ep->qp.rq_mem_size =
+		(ep->qp.rq_mem_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+	ep->qp.rq_pgtbl_size =
+		(ep->qp.rq_mem_size / PAGE_SIZE) * sizeof(void *);
+	ep->qp.rq_pgtbl_size =
+		(ep->qp.rq_pgtbl_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+
+	ep->qp.rq_pgtbl_virt =
+		dma_alloc_coherent(&hba->pcidev->dev, ep->qp.rq_pgtbl_size,
+				   &ep->qp.rq_pgtbl_phys, GFP_KERNEL);
+	if (!ep->qp.rq_pgtbl_virt) {
+		printk(KERN_ALERT "bnx2i: unable to alloc RQ PT mem %d\n",
+				  ep->qp.rq_pgtbl_size);
+		goto mem_alloc_err;
+	}
+
+	/* Allocate memory area for actual RQ element */
+	ep->qp.rq_virt =
+		dma_alloc_coherent(&hba->pcidev->dev, ep->qp.rq_mem_size,
+				   &ep->qp.rq_phys, GFP_KERNEL);
+	if (!ep->qp.rq_virt) {
+		printk(KERN_ALERT "bnx2i: unable to alloc RQ BD memory %d\n",
+				  ep->qp.rq_mem_size);
+		goto mem_alloc_err;
+	}
+
+	ep->qp.rq_prod_qe = ep->qp.rq_virt;
+	ep->qp.rq_cons_qe = ep->qp.rq_virt;
+	ep->qp.rq_last_qe = &ep->qp.rq_virt[hba->max_rqes - 1];
+	ep->qp.rq_prod_idx = 0x8000;
+	ep->qp.rq_cons_idx = 0;
+	ep->qp.rqe_left = hba->max_rqes;
+
+	setup_qp_page_tables(ep);
+
+	return 0;
+
+mem_alloc_err:
+	bnx2i_free_qp_resc(hba, ep);
+	return -ENOMEM;
+}
+
+
+
+/**
+ * bnx2i_free_qp_resc - free memory resources held by QP
+ * @hba:	adapter structure pointer
+ * @ep:	endpoint (transport indentifier) structure
+ *
+ * Free QP resources - SQ/RQ/CQ memory and page tables.
+ */
+void bnx2i_free_qp_resc(struct bnx2i_hba *hba, struct bnx2i_endpoint *ep)
+{
+	if (ep->qp.ctx_base) {
+		iounmap(ep->qp.ctx_base);
+		ep->qp.ctx_base = NULL;
+	}
+	/* Free SQ mem */
+	if (ep->qp.sq_pgtbl_virt) {
+		dma_free_coherent(&hba->pcidev->dev, ep->qp.sq_pgtbl_size,
+				  ep->qp.sq_pgtbl_virt, ep->qp.sq_pgtbl_phys);
+		ep->qp.sq_pgtbl_virt = NULL;
+		ep->qp.sq_pgtbl_phys = 0;
+	}
+	if (ep->qp.sq_virt) {
+		dma_free_coherent(&hba->pcidev->dev, ep->qp.sq_mem_size,
+				  ep->qp.sq_virt, ep->qp.sq_phys);
+		ep->qp.sq_virt = NULL;
+		ep->qp.sq_phys = 0;
+	}
+
+	/* Free RQ mem */
+	if (ep->qp.rq_pgtbl_virt) {
+		dma_free_coherent(&hba->pcidev->dev, ep->qp.rq_pgtbl_size,
+				  ep->qp.rq_pgtbl_virt, ep->qp.rq_pgtbl_phys);
+		ep->qp.rq_pgtbl_virt = NULL;
+		ep->qp.rq_pgtbl_phys = 0;
+	}
+	if (ep->qp.rq_virt) {
+		dma_free_coherent(&hba->pcidev->dev, ep->qp.rq_mem_size,
+				  ep->qp.rq_virt, ep->qp.rq_phys);
+		ep->qp.rq_virt = NULL;
+		ep->qp.rq_phys = 0;
+	}
+
+	/* Free CQ mem */
+	if (ep->qp.cq_pgtbl_virt) {
+		dma_free_coherent(&hba->pcidev->dev, ep->qp.cq_pgtbl_size,
+				  ep->qp.cq_pgtbl_virt, ep->qp.cq_pgtbl_phys);
+		ep->qp.cq_pgtbl_virt = NULL;
+		ep->qp.cq_pgtbl_phys = 0;
+	}
+	if (ep->qp.cq_virt) {
+		dma_free_coherent(&hba->pcidev->dev, ep->qp.cq_mem_size,
+				  ep->qp.cq_virt, ep->qp.cq_phys);
+		ep->qp.cq_virt = NULL;
+		ep->qp.cq_phys = 0;
+	}
+}
+
+extern unsigned int error_mask1, error_mask2;
+extern unsigned int en_tcp_dack;
+extern u64 iscsi_error_mask;
+
+/**
+ * bnx2i_send_fw_iscsi_init_msg - initiates initial handshake with iscsi f/w
+ * @hba:	adapter structure pointer
+ *
+ * Send down iscsi_init KWQEs which initiates the initial handshake with the f/w
+ * 	This results in iSCSi support validation and on-chip context manager
+ * 	initialization.  Firmware completes this handshake with a CQE carrying
+ * 	the result of iscsi support validation. Parameter carried by
+ * 	iscsi init request determines the number of offloaded connection and
+ * 	tolerance level for iscsi protocol violation this hba/chip can support
+ */
+int bnx2i_send_fw_iscsi_init_msg(struct bnx2i_hba *hba)
+{
+	struct kwqe *kwqe_arr[3];
+	struct iscsi_kwqe_init1 iscsi_init;
+	struct iscsi_kwqe_init2 iscsi_init2;
+	int rc = 0;
+	u64 mask64;
+
+	iscsi_init.flags =
+		ISCSI_PAGE_SIZE_4K << ISCSI_KWQE_INIT1_PAGE_SIZE_SHIFT;
+	if (en_tcp_dack)
+		iscsi_init.flags |= ISCSI_KWQE_INIT1_DELAYED_ACK_ENABLE;
+	iscsi_init.reserved0 = 0;
+	iscsi_init.num_cqs = 1;
+	iscsi_init.hdr.op_code = ISCSI_KWQE_OPCODE_INIT1;
+	iscsi_init.hdr.flags =
+		(ISCSI_KWQE_LAYER_CODE << ISCSI_KWQE_HEADER_LAYER_CODE_SHIFT);
+
+	iscsi_init.dummy_buffer_addr_lo = (u32) hba->dummy_buf_dma;
+	iscsi_init.dummy_buffer_addr_hi =
+		(u32) ((u64) hba->dummy_buf_dma >> 32);
+
+	hba->ctx_ccell_tasks =
+			((hba->num_ccell & 0xFFFF) | (hba->max_sqes << 16));
+	iscsi_init.num_ccells_per_conn = hba->num_ccell;
+	iscsi_init.num_tasks_per_conn = hba->max_sqes;
+	iscsi_init.sq_wqes_per_page = PAGE_SIZE / BNX2I_SQ_WQE_SIZE;
+	iscsi_init.sq_num_wqes = hba->max_sqes;
+	iscsi_init.cq_log_wqes_per_page =
+		(u8) bnx2i_power_of2(PAGE_SIZE / BNX2I_CQE_SIZE);
+	iscsi_init.cq_num_wqes = hba->max_cqes;
+	iscsi_init.cq_num_pages = (hba->max_cqes * BNX2I_CQE_SIZE +
+				   (PAGE_SIZE - 1)) / PAGE_SIZE;
+	iscsi_init.sq_num_pages = (hba->max_sqes * BNX2I_SQ_WQE_SIZE +
+				   (PAGE_SIZE - 1)) / PAGE_SIZE;
+	iscsi_init.rq_buffer_size = BNX2I_RQ_WQE_SIZE;
+	iscsi_init.rq_num_wqes = hba->max_rqes;
+
+
+	iscsi_init2.hdr.op_code = ISCSI_KWQE_OPCODE_INIT2;
+	iscsi_init2.hdr.flags =
+		(ISCSI_KWQE_LAYER_CODE << ISCSI_KWQE_HEADER_LAYER_CODE_SHIFT);
+	iscsi_init2.max_cq_sqn = hba->max_cqes * 2 + 1;
+	mask64 = 0x0ULL;
+	mask64 |= (
+		/* CISCO MDS */
+		(1UL <<
+		  ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_TTT_NOT_RSRV) |
+		/* HP MSA1510i */
+		(1UL <<
+		  ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_EXP_DATASN) |
+		/* EMC */
+		(1ULL << ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_LUN));
+	if (error_mask1)
+		iscsi_init2.error_bit_map[0] = error_mask1;
+	else {
+		iscsi_init2.error_bit_map[0] = (u32) mask64;
+	}
+	if (error_mask2)
+		iscsi_init2.error_bit_map[1] = error_mask2;
+	else
+		iscsi_init2.error_bit_map[1] = (u32) (mask64 >> 32);
+
+	iscsi_error_mask = mask64;
+
+	kwqe_arr[0] = (struct kwqe *) &iscsi_init;
+	kwqe_arr[1] = (struct kwqe *) &iscsi_init2;
+
+	if (hba->cnic && hba->cnic->submit_kwqes) {
+		rc = hba->cnic->submit_kwqes(hba->cnic, kwqe_arr, 2);
+	}
+	return rc;
+}
+
+
+/**
+ * bnx2i_process_scsi_cmd_resp - this function handles scsi cmd completion.
+ * @conn:	iscsi connection
+ * @cqe:	pointer to newly DMA'ed CQE entry for processing
+ *
+ * process SCSI CMD Response CQE & complete the request to SCSI-ML
+ */
+static int bnx2i_process_scsi_cmd_resp(struct iscsi_session *session,
+				       struct bnx2i_conn *bnx2i_conn,
+				       struct cqe *cqe)
+{
+	struct iscsi_conn *conn = bnx2i_conn->cls_conn->dd_data;
+	struct bnx2i_cmd_response *resp_cqe;
+	struct bnx2i_cmd *bnx2i_cmd;
+	struct iscsi_task *task;
+	struct iscsi_cmd_rsp *hdr;
+	u32 datalen = 0;
+
+	resp_cqe = (struct bnx2i_cmd_response *)cqe;
+	spin_lock(&session->lock);
+	task = iscsi_itt_to_task(conn,
+				 resp_cqe->itt & ISCSI_CMD_RESPONSE_INDEX);
+	if (!task)
+		goto fail;
+
+	bnx2i_cmd = task->dd_data;
+
+	if (bnx2i_cmd->req.op_attr & ISCSI_CMD_REQUEST_READ) {
+		conn->datain_pdus_cnt +=
+			resp_cqe->task_stat.read_stat.num_data_outs;
+		conn->rxdata_octets +=
+			bnx2i_cmd->req.total_data_transfer_length;
+	} else {
+		conn->dataout_pdus_cnt +=
+			resp_cqe->task_stat.read_stat.num_data_outs;
+		conn->r2t_pdus_cnt +=
+			resp_cqe->task_stat.read_stat.num_r2ts;
+		conn->txdata_octets +=
+			bnx2i_cmd->req.total_data_transfer_length;
+	}
+	bnx2i_iscsi_unmap_sg_list(bnx2i_cmd);
+
+	hdr = (struct iscsi_cmd_rsp *)task->hdr;
+	resp_cqe = (struct bnx2i_cmd_response *)cqe;
+	hdr->opcode = resp_cqe->op_code;
+	hdr->max_cmdsn = cpu_to_be32(resp_cqe->max_cmd_sn);
+	hdr->exp_cmdsn = cpu_to_be32(resp_cqe->exp_cmd_sn);
+	hdr->response = resp_cqe->response;
+	hdr->cmd_status = resp_cqe->status;
+	hdr->flags = resp_cqe->response_flags;
+	hdr->residual_count = cpu_to_be32(resp_cqe->residual_count);
+
+	if (resp_cqe->op_code == ISCSI_OP_SCSI_DATA_IN)
+		goto done;
+
+	if (resp_cqe->status == SAM_STAT_CHECK_CONDITION) {
+		datalen = resp_cqe->data_length;
+		if (datalen < 2)
+			goto done;
+
+		if (datalen > BNX2I_RQ_WQE_SIZE) {
+			iscsi_conn_printk(KERN_ERR, conn,
+					  "sense data len %d > RQ sz\n",
+					  datalen);
+			datalen = BNX2I_RQ_WQE_SIZE;
+		} else if (datalen > ISCSI_DEF_MAX_RECV_SEG_LEN) {
+			iscsi_conn_printk(KERN_ERR, conn,
+					  "sense data len %d > conn data\n",
+					  datalen);
+			datalen = ISCSI_DEF_MAX_RECV_SEG_LEN;
+		}
+
+		bnx2i_get_rq_buf(bnx2i_cmd->conn, conn->data, datalen);
+		bnx2i_put_rq_buf(bnx2i_cmd->conn, 1);
+	}
+
+done:
+	__iscsi_complete_pdu(conn, (struct iscsi_hdr *)hdr,
+			     conn->data, datalen);
+fail:
+	spin_unlock(&session->lock);
+	return 0;
+}
+
+
+/**
+ * bnx2i_process_login_resp - this function handles iscsi login response
+ * @session:		iscsi session pointer
+ * @bnx2i_conn:		iscsi connection pointer
+ * @cqe:		pointer to newly DMA'ed CQE entry for processing
+ *
+ * process Login Response CQE & complete it to open-iscsi user daemon
+ */
+static int bnx2i_process_login_resp(struct iscsi_session *session,
+				    struct bnx2i_conn *bnx2i_conn,
+				    struct cqe *cqe)
+{
+	struct iscsi_conn *conn = bnx2i_conn->cls_conn->dd_data;
+	struct iscsi_task *task;
+	struct bnx2i_login_response *login;
+	struct iscsi_login_rsp *resp_hdr;
+	int pld_len;
+	int pad_len;
+
+	login = (struct bnx2i_login_response *) cqe;
+	spin_lock(&session->lock);
+	task = iscsi_itt_to_task(conn,
+				 login->itt & ISCSI_LOGIN_RESPONSE_INDEX);
+	if (!task)
+		goto done;
+
+	resp_hdr = (struct iscsi_login_rsp *) &bnx2i_conn->gen_pdu.resp_hdr;
+	memset(resp_hdr, 0, sizeof(struct iscsi_hdr));
+	resp_hdr->opcode = login->op_code;
+	resp_hdr->flags = login->response_flags;
+	resp_hdr->max_version = login->version_max;
+	resp_hdr->active_version = login->version_active;;
+	resp_hdr->hlength = 0;
+
+	hton24(resp_hdr->dlength, login->data_length);
+	memcpy(resp_hdr->isid, &login->isid_lo, 6);
+	resp_hdr->tsih = cpu_to_be16(login->tsih);
+	resp_hdr->itt = task->hdr->itt;
+	resp_hdr->statsn = cpu_to_be32(login->stat_sn);
+	resp_hdr->exp_cmdsn = cpu_to_be32(login->exp_cmd_sn);
+	resp_hdr->max_cmdsn = cpu_to_be32(login->max_cmd_sn);
+	resp_hdr->status_class = login->status_class;
+	resp_hdr->status_detail = login->status_detail;
+	pld_len = login->data_length;
+	bnx2i_conn->gen_pdu.resp_wr_ptr =
+					bnx2i_conn->gen_pdu.resp_buf + pld_len;
+
+	pad_len = 0;
+	if (pld_len & 0x3)
+		pad_len = 4 - (pld_len % 4);
+
+	if (pad_len) {
+		int i = 0;
+		for (i = 0; i < pad_len; i++) {
+			bnx2i_conn->gen_pdu.resp_wr_ptr[0] = 0;
+			bnx2i_conn->gen_pdu.resp_wr_ptr++;
+		}
+	}
+
+	/*
+	 * check if this is the first login response for this connection.
+	 * If yes, we need to copy initial StatSN to connection structure.
+	 */
+	if (bnx2i_conn->exp_statsn == BNX2I_STATSN_UPDATE_SIGNATURE)
+		bnx2i_conn->exp_statsn = be32_to_cpu(resp_hdr->statsn) + 1;
+
+	__iscsi_complete_pdu(conn, (struct iscsi_hdr *)resp_hdr,
+		bnx2i_conn->gen_pdu.resp_buf,
+		bnx2i_conn->gen_pdu.resp_wr_ptr - bnx2i_conn->gen_pdu.resp_buf);
+done:
+	spin_unlock(&session->lock);
+	return 0;
+}
+
+/**
+ * bnx2i_process_tmf_resp - this function handles iscsi TMF response
+ * @session:		iscsi session pointer
+ * @bnx2i_conn:		iscsi connection pointer
+ * @cqe:		pointer to newly DMA'ed CQE entry for processing
+ *
+ * process iSCSI TMF Response CQE and wake up the driver eh thread.
+ */
+static int bnx2i_process_tmf_resp(struct iscsi_session *session,
+				  struct bnx2i_conn *bnx2i_conn,
+				  struct cqe *cqe)
+{
+	struct iscsi_conn *conn = bnx2i_conn->cls_conn->dd_data;
+	struct iscsi_task *task;
+	struct bnx2i_tmf_response *tmf_cqe;
+	struct iscsi_tm_rsp *resp_hdr;
+
+	tmf_cqe = (struct bnx2i_tmf_response *)cqe;
+	spin_lock(&session->lock);
+	task = iscsi_itt_to_task(conn,
+				 tmf_cqe->itt & ISCSI_TMF_RESPONSE_INDEX);
+	if (!task)
+		goto done;
+
+	resp_hdr = (struct iscsi_tm_rsp *) &bnx2i_conn->gen_pdu.resp_hdr;
+	memset(resp_hdr, 0, sizeof(struct iscsi_hdr));
+	resp_hdr->opcode = tmf_cqe->op_code;
+	resp_hdr->max_cmdsn = cpu_to_be32(tmf_cqe->max_cmd_sn);
+	resp_hdr->exp_cmdsn = cpu_to_be32(tmf_cqe->exp_cmd_sn);
+	resp_hdr->itt = task->hdr->itt;
+	resp_hdr->response = tmf_cqe->response;
+
+	__iscsi_complete_pdu(conn, (struct iscsi_hdr *)resp_hdr, NULL, 0);
+done:
+	spin_unlock(&session->lock);
+	return 0;
+}
+
+/**
+ * bnx2i_process_logout_resp - this function handles iscsi logout response
+ * @session:		iscsi session pointer
+ * @bnx2i_conn:		iscsi connection pointer
+ * @cqe:		pointer to newly DMA'ed CQE entry for processing
+ *
+ * process iSCSI Logout Response CQE & make function call to
+ * notify the user daemon.
+ */
+static int bnx2i_process_logout_resp(struct iscsi_session *session,
+				     struct bnx2i_conn *bnx2i_conn,
+				     struct cqe *cqe)
+{
+	struct iscsi_conn *conn = bnx2i_conn->cls_conn->dd_data;
+	struct iscsi_task *task;
+	struct bnx2i_logout_response *logout;
+	struct iscsi_logout_rsp *resp_hdr;
+
+	logout = (struct bnx2i_logout_response *) cqe;
+	spin_lock(&session->lock);
+	task = iscsi_itt_to_task(conn,
+				 logout->itt & ISCSI_LOGOUT_RESPONSE_INDEX);
+	if (!task)
+		goto done;
+
+	resp_hdr = (struct iscsi_logout_rsp *) &bnx2i_conn->gen_pdu.resp_hdr;
+	memset(resp_hdr, 0, sizeof(struct iscsi_hdr));
+	resp_hdr->opcode = logout->op_code;
+	resp_hdr->flags = logout->response;
+	resp_hdr->hlength = 0;
+
+	resp_hdr->itt = task->hdr->itt;
+	resp_hdr->statsn = task->hdr->exp_statsn;
+	resp_hdr->exp_cmdsn = cpu_to_be32(logout->exp_cmd_sn);
+	resp_hdr->max_cmdsn = cpu_to_be32(logout->max_cmd_sn);
+
+	resp_hdr->t2wait = cpu_to_be32(logout->time_to_wait);
+	resp_hdr->t2retain = cpu_to_be32(logout->time_to_retain);
+
+	__iscsi_complete_pdu(conn, (struct iscsi_hdr *)resp_hdr, NULL, 0);
+done:
+	spin_unlock(&session->lock);
+	return 0;
+}
+
+/**
+ * bnx2i_process_nopin_local_cmpl - this function handles iscsi nopin CQE
+ * @session:		iscsi session pointer
+ * @bnx2i_conn:		iscsi connection pointer
+ * @cqe:		pointer to newly DMA'ed CQE entry for processing
+ *
+ * process iSCSI NOPIN local completion CQE, frees IIT and command structures
+ */
+static void bnx2i_process_nopin_local_cmpl(struct iscsi_session *session,
+					   struct bnx2i_conn *bnx2i_conn,
+					   struct cqe *cqe)
+{
+	struct iscsi_conn *conn = bnx2i_conn->cls_conn->dd_data;
+	struct bnx2i_nop_in_msg *nop_in;
+	struct iscsi_task *task;
+
+	nop_in = (struct bnx2i_nop_in_msg *)cqe;
+	spin_lock(&session->lock);
+	task = iscsi_itt_to_task(conn,
+				 nop_in->itt & ISCSI_NOP_IN_MSG_INDEX);
+	if (task)
+		iscsi_put_task(task);
+	spin_unlock(&session->lock);
+}
+
+/**
+ * bnx2i_unsol_pdu_adjust_rq - makes adjustments to RQ after unsol pdu is recvd
+ * @conn:	iscsi connection
+ *
+ * Firmware advances RQ producer index for every unsolicited PDU even if
+ *	payload data length is '0'. This function makes corresponding
+ *	adjustments on the driver side to match this f/w behavior
+ */
+static void bnx2i_unsol_pdu_adjust_rq(struct bnx2i_conn *conn)
+{
+	char dummy_rq_data[2];
+	bnx2i_get_rq_buf(conn, dummy_rq_data, 1);
+	bnx2i_put_rq_buf(conn, 1);
+}
+
+
+/**
+ * bnx2i_process_nopin_local_cmpl - this function handles iscsi nopin CQE
+ * @session:		iscsi session pointer
+ * @bnx2i_conn:		iscsi connection pointer
+ * @cqe:		pointer to newly DMA'ed CQE entry for processing
+ *
+ * process iSCSI target's proactive iSCSI NOPIN request
+ */
+static void bnx2i_process_nopin_mesg(struct iscsi_session *session,
+				     struct bnx2i_conn *bnx2i_conn,
+				     struct cqe *cqe)
+{
+	struct iscsi_conn *conn = bnx2i_conn->cls_conn->dd_data;
+	struct iscsi_task *task;
+	struct bnx2i_nop_in_msg *nop_in;
+	struct iscsi_nopin *hdr;
+	u32 itt;
+
+	nop_in = (struct bnx2i_nop_in_msg *)cqe;
+	itt = nop_in->itt & ISCSI_NOP_IN_MSG_INDEX;
+
+	spin_lock(&session->lock);
+	hdr = (struct iscsi_nopin *)&bnx2i_conn->gen_pdu.resp_hdr;
+	memset(hdr, 0, sizeof(struct iscsi_hdr));
+	hdr->opcode = nop_in->op_code;
+	hdr->max_cmdsn = cpu_to_be32(nop_in->max_cmd_sn);
+	hdr->exp_cmdsn = cpu_to_be32(nop_in->exp_cmd_sn);
+	hdr->ttt = cpu_to_be32(nop_in->ttt);
+
+	if (itt == (u16) ISCSI_RESERVED_TAG) {
+		bnx2i_unsol_pdu_adjust_rq(bnx2i_conn);
+		hdr->itt = RESERVED_ITT;
+		goto done;
+	}
+
+	/* this is a response to one of our nop-outs */
+	task = iscsi_itt_to_task(conn, itt);
+	if (task) {
+		hdr->flags = ISCSI_FLAG_CMD_FINAL;
+		hdr->itt = task->hdr->itt;
+		hdr->ttt = cpu_to_be32(nop_in->ttt);
+		memcpy(hdr->lun, nop_in->lun, 8);
+	}
+done:
+	__iscsi_complete_pdu(conn, (struct iscsi_hdr *)hdr, NULL, 0);
+	spin_unlock(&session->lock);
+}
+
+
+/**
+ * bnx2i_process_async_mesg - this function handles iscsi async message
+ * @session:		iscsi session pointer
+ * @bnx2i_conn:		iscsi connection pointer
+ * @cqe:		pointer to newly DMA'ed CQE entry for processing
+ *
+ * process iSCSI ASYNC Message
+ */
+static void bnx2i_process_async_mesg(struct iscsi_session *session,
+				     struct bnx2i_conn *bnx2i_conn,
+				     struct cqe *cqe)
+{
+	struct bnx2i_async_msg *async_cqe;
+	struct iscsi_async *resp_hdr;
+	u8 async_event;
+
+	bnx2i_unsol_pdu_adjust_rq(bnx2i_conn);
+
+	async_cqe = (struct bnx2i_async_msg *)cqe;
+	async_event = async_cqe->async_event;
+
+	if (async_event == ISCSI_ASYNC_MSG_SCSI_EVENT) {
+		/* TODO mnc - can't we just copy the scsi sense buffer
+		 * to the conn->data buffer
+		 * Anil - currently there is no interface to push this
+		 * 	  up to SCSI layer. So far we have not seen any
+		 *	  target generating one. So could be one those
+		 *	  fancy unused feature
+		 *
+		 * For iser/tcp we pass this to libiscsi which does
+		 * iscsi_recv_pdu to send it to userspace.
+		 *
+		 * This event is used by Cisco to signal that a lun
+		 * has been added or removed. It is also used by
+		 * EMC celerra or centerra boxes, and EMC will ping
+		 * you one day :), so we have to do something.
+		 */
+		iscsi_conn_printk(KERN_ALERT, bnx2i_conn->cls_conn->dd_data,
+				  "async: scsi events not supported\n");
+		return;
+	}
+
+	spin_lock(&session->lock);
+	resp_hdr = (struct iscsi_async *) &bnx2i_conn->gen_pdu.resp_hdr;
+	memset(resp_hdr, 0, sizeof(struct iscsi_hdr));
+	resp_hdr->opcode = async_cqe->op_code;
+	resp_hdr->flags = 0x80;
+
+	memcpy(resp_hdr->lun, async_cqe->lun, 8);
+	resp_hdr->exp_cmdsn = cpu_to_be32(async_cqe->exp_cmd_sn);
+	resp_hdr->max_cmdsn = cpu_to_be32(async_cqe->max_cmd_sn);
+
+	resp_hdr->async_event = async_cqe->async_event;
+	resp_hdr->async_vcode = async_cqe->async_vcode;
+
+	resp_hdr->param1 = cpu_to_be16(async_cqe->param1);
+	resp_hdr->param2 = cpu_to_be16(async_cqe->param2);
+	resp_hdr->param3 = cpu_to_be16(async_cqe->param3);
+
+	__iscsi_complete_pdu(bnx2i_conn->cls_conn->dd_data,
+			     (struct iscsi_hdr *)resp_hdr, NULL, 0);
+	spin_unlock(&session->lock);
+}
+
+
+/**
+ * bnx2i_process_reject_mesg - process iscsi reject pdu
+ * @session:		iscsi session pointer
+ * @bnx2i_conn:		iscsi connection pointer
+ * @cqe:		pointer to newly DMA'ed CQE entry for processing
+ *
+ * process iSCSI REJECT message
+ */
+static void bnx2i_process_reject_mesg(struct iscsi_session *session,
+				      struct bnx2i_conn *bnx2i_conn,
+				      struct cqe *cqe)
+{
+	struct iscsi_conn *conn = bnx2i_conn->cls_conn->dd_data;
+	struct bnx2i_reject_msg *reject;
+	struct iscsi_reject *hdr;
+
+	reject = (struct bnx2i_reject_msg *) cqe;
+	if (reject->data_length) {
+		bnx2i_get_rq_buf(bnx2i_conn, conn->data, reject->data_length);
+		bnx2i_put_rq_buf(bnx2i_conn, 1);
+	} else
+		bnx2i_unsol_pdu_adjust_rq(bnx2i_conn);
+
+	spin_lock(&session->lock);
+	hdr = (struct iscsi_reject *) &bnx2i_conn->gen_pdu.resp_hdr;
+	memset(hdr, 0, sizeof(struct iscsi_hdr));
+	hdr->opcode = reject->op_code;
+	hdr->reason = reject->reason;
+	hton24(hdr->dlength, reject->data_length);
+	hdr->max_cmdsn = cpu_to_be32(reject->max_cmd_sn);
+	hdr->exp_cmdsn = cpu_to_be32(reject->exp_cmd_sn);
+	hdr->ffffffff = cpu_to_be32(ISCSI_RESERVED_TAG);
+	__iscsi_complete_pdu(conn, (struct iscsi_hdr *)hdr, conn->data,
+			     reject->data_length);
+	spin_unlock(&session->lock);
+}
+
+/**
+ * bnx2i_process_cmd_cleanup_resp - process scsi command clean-up completion
+ * @session:		iscsi session pointer
+ * @bnx2i_conn:		iscsi connection pointer
+ * @cqe:		pointer to newly DMA'ed CQE entry for processing
+ *
+ * process command cleanup response CQE during conn shutdown or error recovery
+ */
+static void bnx2i_process_cmd_cleanup_resp(struct iscsi_session *session,
+					   struct bnx2i_conn *bnx2i_conn,
+					   struct cqe *cqe)
+{
+	struct bnx2i_cleanup_response *cmd_clean_rsp;
+	struct iscsi_conn *conn = bnx2i_conn->cls_conn->dd_data;
+	struct iscsi_task *task;
+
+	cmd_clean_rsp = (struct bnx2i_cleanup_response *)cqe;
+	spin_lock(&session->lock);
+	task = iscsi_itt_to_task(conn,
+			cmd_clean_rsp->itt & ISCSI_CLEANUP_RESPONSE_INDEX);
+	if (!task)
+		printk(KERN_ALERT "bnx2i: cmd clean ITT %x not active\n",
+			cmd_clean_rsp->itt & ISCSI_CLEANUP_RESPONSE_INDEX);
+	spin_unlock(&session->lock);
+	complete(&bnx2i_conn->cmd_cleanup_cmpl);
+}
+
+
+
+/**
+ * bnx2i_process_new_cqes - process newly DMA'ed CQE's
+ * @bnx2i_conn:		iscsi connection
+ *
+ * this function is called by generic KCQ handler to process all pending CQE's
+ */
+static void bnx2i_process_new_cqes(struct bnx2i_conn *bnx2i_conn)
+{
+	struct iscsi_conn *conn = bnx2i_conn->cls_conn->dd_data;
+	struct iscsi_session *session = conn->session;
+	struct qp_info *qp = &bnx2i_conn->ep->qp;
+	struct bnx2i_nop_in_msg *nopin;
+
+	while (1) {
+		nopin = (struct bnx2i_nop_in_msg *) qp->cq_cons_qe;
+		if (nopin->cq_req_sn != qp->cqe_exp_seq_sn)
+			break;
+
+		if (unlikely(test_bit(ISCSI_SUSPEND_BIT, &conn->suspend_rx)))
+			break;
+
+		switch (nopin->op_code) {
+		case ISCSI_OP_SCSI_CMD_RSP:
+		case ISCSI_OP_SCSI_DATA_IN:
+			bnx2i_process_scsi_cmd_resp(session, bnx2i_conn,
+						    qp->cq_cons_qe);
+			break;
+		case ISCSI_OP_LOGIN_RSP:
+			bnx2i_process_login_resp(session, bnx2i_conn,
+						 qp->cq_cons_qe);
+			break;
+		case ISCSI_OP_SCSI_TMFUNC_RSP:
+			bnx2i_process_tmf_resp(session, bnx2i_conn,
+					       qp->cq_cons_qe);
+			break;
+		case ISCSI_OP_LOGOUT_RSP:
+			bnx2i_process_logout_resp(session, bnx2i_conn,
+						  qp->cq_cons_qe);
+			break;
+		case ISCSI_OP_NOOP_IN:
+			bnx2i_process_nopin_mesg(session, bnx2i_conn,
+						 qp->cq_cons_qe);
+			break;
+		case ISCSI_OPCODE_NOPOUT_LOCAL_COMPLETION:
+			bnx2i_process_nopin_local_cmpl(session, bnx2i_conn,
+						       qp->cq_cons_qe);
+			break;
+		case ISCSI_OP_ASYNC_EVENT:
+			bnx2i_process_async_mesg(session, bnx2i_conn,
+						 qp->cq_cons_qe);
+			break;
+		case ISCSI_OP_REJECT:
+			bnx2i_process_reject_mesg(session, bnx2i_conn,
+						  qp->cq_cons_qe);
+			break;
+		case ISCSI_OPCODE_CLEANUP_RESPONSE:
+			bnx2i_process_cmd_cleanup_resp(session, bnx2i_conn,
+						       qp->cq_cons_qe);
+			break;
+		default:
+			printk(KERN_ALERT "bnx2i: unknown opcode 0x%x\n",
+					  nopin->op_code);
+		}
+		/* clear out in production version only, till beta keep opcode
+		 * field intact, will be helpful in debugging (context dump)
+		 * nopin->op_code = 0;
+		 */
+		qp->cqe_exp_seq_sn++;
+		if (qp->cqe_exp_seq_sn == (qp->cqe_size * 2 + 1))
+			qp->cqe_exp_seq_sn = ISCSI_INITIAL_SN;
+
+		if (qp->cq_cons_qe == qp->cq_last_qe) {
+			qp->cq_cons_qe = qp->cq_virt;
+			qp->cq_cons_idx = 0;
+		} else {
+			qp->cq_cons_qe++;
+			qp->cq_cons_idx++;
+		}
+	}
+#ifdef _EVENT_COALESCE_
+	bnx2i_arm_cq_event_coalescing(conn->ep, CNIC_ARM_CQE);
+#endif
+}
+
+/**
+ * bnx2i_fastpath_notification - process global event queue (KCQ)
+ * @hba:		adapter structure pointer
+ * @new_cqe_kcqe:	pointer to newly DMA'ed KCQE entry
+ *
+ * Fast path event notification handler, KCQ entry carries context id
+ *	of the connection that has 1 or more pending CQ entries
+ */
+static void bnx2i_fastpath_notification(struct bnx2i_hba *hba,
+					struct iscsi_kcqe *new_cqe_kcqe)
+{
+	struct bnx2i_conn *conn;
+	u32 iscsi_cid;
+
+	iscsi_cid = new_cqe_kcqe->iscsi_conn_id;
+	conn = bnx2i_get_conn_from_id(hba, iscsi_cid);
+
+	if (!conn) {
+		printk(KERN_ALERT "cid #%x not valid\n", iscsi_cid);
+		return;
+	}
+	if (!conn->ep) {
+		printk(KERN_ALERT "cid #%x - ep not bound\n", iscsi_cid);
+		return;
+	}
+
+	bnx2i_process_new_cqes(conn);
+}
+
+
+/**
+ * bnx2i_process_update_conn_cmpl - process iscsi conn update completion KCQE
+ * @hba:		adapter structure pointer
+ * @update_kcqe:	kcqe pointer
+ *
+ * CONN_UPDATE completion handler, this completes iSCSI connection FFP migration
+ */
+static void bnx2i_process_update_conn_cmpl(struct bnx2i_hba *hba,
+					   struct iscsi_kcqe *update_kcqe)
+{
+	struct bnx2i_conn *conn;
+	u32 iscsi_cid;
+
+	iscsi_cid = update_kcqe->iscsi_conn_id;
+	conn = bnx2i_get_conn_from_id(hba, iscsi_cid);
+
+	if (!conn) {
+		printk(KERN_ALERT "conn_update: cid %x not valid\n", iscsi_cid);
+		return;
+	}
+	if (!conn->ep) {
+		printk(KERN_ALERT "cid %x does not have ep bound\n", iscsi_cid);
+		return;
+	}
+
+	if (update_kcqe->completion_status) {
+		printk(KERN_ALERT "request failed cid %x\n", iscsi_cid);
+		conn->ep->state = EP_STATE_ULP_UPDATE_FAILED;
+	} else
+		conn->ep->state = EP_STATE_ULP_UPDATE_COMPL;
+
+	wake_up_interruptible(&conn->ep->ofld_wait);
+}
+
+
+/**
+ * bnx2i_recovery_que_add_conn - add connection to recovery queue
+ * @hba:		adapter structure pointer
+ * @bnx2i_conn:		iscsi connection
+ *
+ * Add connection to recovery queue and schedule adapter eh worker
+ */
+void bnx2i_recovery_que_add_conn(struct bnx2i_hba *hba,
+				 struct bnx2i_conn *bnx2i_conn)
+{
+	iscsi_conn_failure(bnx2i_conn->cls_conn->dd_data,
+			   ISCSI_ERR_CONN_FAILED);
+}
+
+
+/**
+ * bnx2i_process_iscsi_error - process error notification on a given connection
+ * @hba:		adapter structure pointer
+ * @iscsi_err:		iscsi error kcqe pointer
+ *
+ * handles iscsi error notifications from the FW. Firmware based in initial
+ *	handshake classifies iscsi protocol / TCP rfc violation into either
+ *	warning or error indications. If indication is of "Error" type, driver
+ *	will initiate session recovery for that connection/session. For
+ *	"Warning" type indication, driver will put out a system log message
+ *	(there will be only one message for each type for the life of the
+ *	session, this is to avoid un-necessarily overloading the system)
+ */
+static void bnx2i_process_iscsi_error(struct bnx2i_hba *hba,
+				      struct iscsi_kcqe *iscsi_err)
+{
+	struct bnx2i_conn *bnx2i_conn;
+	u32 iscsi_cid;
+	char warn_notice[] = "iscsi_warning";
+	char error_notice[] = "iscsi_error";
+	char additional_notice[64];
+	char *message;
+	int need_recovery;
+	u64 err_mask64;
+
+	iscsi_cid = iscsi_err->iscsi_conn_id;
+	bnx2i_conn = bnx2i_get_conn_from_id(hba, iscsi_cid);
+	if (!bnx2i_conn) {
+		printk(KERN_ALERT "bnx2i - cid 0x%x not valid\n", iscsi_cid);
+		return;
+	}
+
+	err_mask64 = (0x1ULL << iscsi_err->completion_status);
+
+	if (err_mask64 & iscsi_error_mask) {
+		need_recovery = 0;
+		message = warn_notice;
+	} else {
+		need_recovery = 1;
+		message = error_notice;
+	}
+
+	switch (iscsi_err->completion_status) {
+	case ISCSI_KCQE_COMPLETION_STATUS_HDR_DIG_ERR:
+		strcpy(additional_notice, "hdr digest err");
+		break;
+	case ISCSI_KCQE_COMPLETION_STATUS_DATA_DIG_ERR:
+		strcpy(additional_notice, "data digest err");
+		break;
+	case ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_OPCODE:
+		strcpy(additional_notice, "wrong opcode rcvd");
+		break;
+	case ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_AHS_LEN:
+		strcpy(additional_notice, "AHS len > 0 rcvd");
+		break;
+	case ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_ITT:
+		strcpy(additional_notice, "invalid ITT rcvd");
+		break;
+	case ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_STATSN:
+		strcpy(additional_notice, "wrong StatSN rcvd");
+		break;
+	case ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_EXP_DATASN:
+		strcpy(additional_notice, "wrong DataSN rcvd");
+		break;
+	case ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_PEND_R2T	:
+		strcpy(additional_notice, "pend R2T violation");
+		break;
+	case ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_O_U_0:
+		strcpy(additional_notice, "ERL0, UO");
+		break;
+	case ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_O_U_1:
+		strcpy(additional_notice, "ERL0, U1");
+		break;
+	case ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_O_U_2:
+		strcpy(additional_notice, "ERL0, U2");
+		break;
+	case ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_O_U_3:
+		strcpy(additional_notice, "ERL0, U3");
+		break;
+	case ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_O_U_4:
+		strcpy(additional_notice, "ERL0, U4");
+		break;
+	case ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_O_U_5:
+		strcpy(additional_notice, "ERL0, U5");
+		break;
+	case ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_O_U_6:
+		strcpy(additional_notice, "ERL0, U6");
+		break;
+	case ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_REMAIN_RCV_LEN:
+		strcpy(additional_notice, "invalid resi len");
+		break;
+	case ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_MAX_RCV_PDU_LEN:
+		strcpy(additional_notice, "MRDSL violation");
+		break;
+	case ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_F_BIT_ZERO:
+		strcpy(additional_notice, "F-bit not set");
+		break;
+	case ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_TTT_NOT_RSRV:
+		strcpy(additional_notice, "invalid TTT");
+		break;
+	case ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_DATASN:
+		strcpy(additional_notice, "invalid DataSN");
+		break;
+	case ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_REMAIN_BURST_LEN:
+		strcpy(additional_notice, "burst len violation");
+		break;
+	case ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_BUFFER_OFF:
+		strcpy(additional_notice, "buf offset violation");
+		break;
+	case ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_LUN:
+		strcpy(additional_notice, "invalid LUN field");
+		break;
+	case ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_R2TSN:
+		strcpy(additional_notice, "invalid R2TSN field");
+		break;
+#define BNX2I_ERR_DESIRED_DATA_TRNS_LEN_0 	\
+	ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_DESIRED_DATA_TRNS_LEN_0
+	case BNX2I_ERR_DESIRED_DATA_TRNS_LEN_0:
+		strcpy(additional_notice, "invalid cmd len1");
+		break;
+#define BNX2I_ERR_DESIRED_DATA_TRNS_LEN_1 	\
+	ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_DESIRED_DATA_TRNS_LEN_1
+	case BNX2I_ERR_DESIRED_DATA_TRNS_LEN_1:
+		strcpy(additional_notice, "invalid cmd len2");
+		break;
+	case ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_PEND_R2T_EXCEED:
+		strcpy(additional_notice,
+		       "pend r2t exceeds MaxOutstandingR2T value");
+		break;
+	case ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_TTT_IS_RSRV:
+		strcpy(additional_notice, "TTT is rsvd");
+		break;
+	case ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_MAX_BURST_LEN:
+		strcpy(additional_notice, "MBL violation");
+		break;
+#define BNX2I_ERR_DATA_SEG_LEN_NOT_ZERO 	\
+	ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_DATA_SEG_LEN_NOT_ZERO
+	case BNX2I_ERR_DATA_SEG_LEN_NOT_ZERO:
+		strcpy(additional_notice, "data seg len != 0");
+		break;
+	case ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_REJECT_PDU_LEN:
+		strcpy(additional_notice, "reject pdu len error");
+		break;
+	case ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_ASYNC_PDU_LEN:
+		strcpy(additional_notice, "async pdu len error");
+		break;
+	case ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_NOPIN_PDU_LEN:
+		strcpy(additional_notice, "nopin pdu len error");
+		break;
+#define BNX2_ERR_PEND_R2T_IN_CLEANUP			\
+	ISCSI_KCQE_COMPLETION_STATUS_PROTOCOL_ERR_PEND_R2T_IN_CLEANUP
+	case BNX2_ERR_PEND_R2T_IN_CLEANUP:
+		strcpy(additional_notice, "pend r2t in cleanup");
+		break;
+
+	case ISCI_KCQE_COMPLETION_STATUS_TCP_ERROR_IP_FRAGMENT:
+		strcpy(additional_notice, "IP fragments rcvd");
+		break;
+	case ISCI_KCQE_COMPLETION_STATUS_TCP_ERROR_IP_OPTIONS:
+		strcpy(additional_notice, "IP options error");
+		break;
+	case ISCI_KCQE_COMPLETION_STATUS_TCP_ERROR_URGENT_FLAG:
+		strcpy(additional_notice, "urgent flag error");
+		break;
+	default:
+		printk(KERN_ALERT "iscsi_err - unknown err %x\n",
+				  iscsi_err->completion_status);
+	}
+
+	if (need_recovery) {
+		iscsi_conn_printk(KERN_ALERT,
+				  bnx2i_conn->cls_conn->dd_data,
+				  "bnx2i: %s - %s\n",
+				  message, additional_notice);
+
+		iscsi_conn_printk(KERN_ALERT,
+				  bnx2i_conn->cls_conn->dd_data,
+				  "conn_err - hostno %d conn %p, "
+				  "iscsi_cid %x cid %x\n",
+				  bnx2i_conn->hba->shost->host_no,
+				  bnx2i_conn, bnx2i_conn->ep->ep_iscsi_cid,
+				  bnx2i_conn->ep->ep_cid);
+		bnx2i_recovery_que_add_conn(bnx2i_conn->hba, bnx2i_conn);
+	} else
+		if (!test_and_set_bit(iscsi_err->completion_status,
+				      (void *) &bnx2i_conn->violation_notified))
+			iscsi_conn_printk(KERN_ALERT,
+					  bnx2i_conn->cls_conn->dd_data,
+					  "bnx2i: %s - %s\n",
+					  message, additional_notice);
+}
+
+
+/**
+ * bnx2i_process_conn_destroy_cmpl - process iscsi conn destroy completion
+ * @hba:		adapter structure pointer
+ * @conn_destroy:	conn destroy kcqe pointer
+ *
+ * handles connection destroy completion request.
+ */
+static void bnx2i_process_conn_destroy_cmpl(struct bnx2i_hba *hba,
+					    struct iscsi_kcqe *conn_destroy)
+{
+	struct bnx2i_endpoint *ep;
+
+	ep = bnx2i_ep_destroy_list_next(hba);
+	if (!ep) {
+		printk(KERN_ALERT "bnx2i_conn_destroy_cmpl: no pending "
+				  "offload request, unexpected complection\n");
+		return;
+	}
+
+	if (hba != ep->hba) {
+		printk(KERN_ALERT "conn destroy- error hba mis-match\n");
+		return;
+	}
+
+	if (conn_destroy->completion_status) {
+		printk(KERN_ALERT "conn_destroy_cmpl: op failed\n");
+		ep->state = EP_STATE_CLEANUP_FAILED;
+	} else
+		ep->state = EP_STATE_CLEANUP_CMPL;
+	wake_up_interruptible(&ep->ofld_wait);
+}
+
+
+/**
+ * bnx2i_process_ofld_cmpl - process initial iscsi conn offload completion
+ * @hba:		adapter structure pointer
+ * @ofld_kcqe:		conn offload kcqe pointer
+ *
+ * handles initial connection offload completion, ep_connect() thread is
+ *	woken-up to continue with LLP connect process
+ */
+static void bnx2i_process_ofld_cmpl(struct bnx2i_hba *hba,
+				    struct iscsi_kcqe *ofld_kcqe)
+{
+	u32 cid_addr;
+	struct bnx2i_endpoint *ep;
+	u32 cid_num;
+
+	ep = bnx2i_ep_ofld_list_next(hba);
+	if (!ep) {
+		printk(KERN_ALERT "ofld_cmpl: no pend offload request\n");
+		return;
+	}
+
+	if (hba != ep->hba) {
+		printk(KERN_ALERT "ofld_cmpl: error hba mis-match\n");
+		return;
+	}
+
+	if (ofld_kcqe->completion_status) {
+		if (ofld_kcqe->completion_status ==
+		    ISCSI_KCQE_COMPLETION_STATUS_CTX_ALLOC_FAILURE)
+			printk(KERN_ALERT "bnx2i: unable to allocate"
+					  " iSCSI context resources\n");
+		ep->state = EP_STATE_OFLD_FAILED;
+	} else {
+		ep->state = EP_STATE_OFLD_COMPL;
+		cid_addr = ofld_kcqe->iscsi_conn_context_id;
+		cid_num = GET_CID_NUM(cid_addr);
+		ep->ep_cid = cid_addr;
+		ep->qp.ctx_base = NULL;
+	}
+	wake_up_interruptible(&ep->ofld_wait);
+}
+
+/**
+ * bnx2i_indicate_kcqe - process iscsi conn update completion KCQE
+ * @hba:		adapter structure pointer
+ * @update_kcqe:	kcqe pointer
+ *
+ * Generic KCQ event handler/dispatcher
+ */
+static void bnx2i_indicate_kcqe(void *context, struct kcqe *kcqe[],
+				u32 num_cqe)
+{
+	struct bnx2i_hba *hba = context;
+	int i = 0;
+	struct iscsi_kcqe *ikcqe = NULL;
+
+	while (i < num_cqe) {
+		ikcqe = (struct iscsi_kcqe *) kcqe[i++];
+
+		if (ikcqe->op_code ==
+		    ISCSI_KCQE_OPCODE_CQ_EVENT_NOTIFICATION)
+			bnx2i_fastpath_notification(hba, ikcqe);
+		else if (ikcqe->op_code == ISCSI_KCQE_OPCODE_OFFLOAD_CONN)
+			bnx2i_process_ofld_cmpl(hba, ikcqe);
+		else if (ikcqe->op_code == ISCSI_KCQE_OPCODE_UPDATE_CONN)
+			bnx2i_process_update_conn_cmpl(hba, ikcqe);
+		else if (ikcqe->op_code == ISCSI_KCQE_OPCODE_INIT) {
+			if (ikcqe->completion_status !=
+			    ISCSI_KCQE_COMPLETION_STATUS_SUCCESS)
+				bnx2i_iscsi_license_error(hba, ikcqe->\
+							  completion_status);
+			else {
+				set_bit(ADAPTER_STATE_UP, &hba->adapter_state);
+				bnx2i_get_link_state(hba);
+				printk(KERN_INFO "bnx2i [%.2x:%.2x.%.2x]: "
+						 "ISCSI_INIT passed\n",
+						 (u8)hba->pcidev->bus->number,
+						 hba->pci_devno,
+						 (u8)hba->pci_func);
+
+
+			}
+		} else if (ikcqe->op_code == ISCSI_KCQE_OPCODE_DESTROY_CONN)
+			bnx2i_process_conn_destroy_cmpl(hba, ikcqe);
+		else if (ikcqe->op_code == ISCSI_KCQE_OPCODE_ISCSI_ERROR)
+			bnx2i_process_iscsi_error(hba, ikcqe);
+		else
+			printk(KERN_ALERT "bnx2i: unknown opcode 0x%x\n",
+					  ikcqe->op_code);
+	}
+}
+
+
+/*
+ * Generic netstack event handler
+ */
+static void bnx2i_indicate_inetevent(void *context, unsigned long event)
+{
+	struct bnx2i_hba *hba = context;
+
+	switch (event) {
+	case NETDEV_UP:
+		iscsi_host_for_each_session(hba->shost,
+					    bnx2i_drop_session);
+		break;
+	case NETDEV_CHANGE:
+		break;
+	default:
+		;
+	}
+}
+
+/**
+ * bnx2i_indicate_netevent - Generic netdev event handler
+ * @context:	adapter structure pointer
+ * @event:	event type
+ *
+ * Handles four netdev events, NETDEV_UP, NETDEV_DOWN,
+ *	NETDEV_GOING_DOWN and NETDEV_CHANGE
+ */
+static void bnx2i_indicate_netevent(void *context, unsigned long event)
+{
+	struct bnx2i_hba *hba = context;
+
+	switch (event) {
+	case NETDEV_UP:
+		if (!test_bit(ADAPTER_STATE_UP, &hba->adapter_state))
+			bnx2i_send_fw_iscsi_init_msg(hba);
+		break;
+	case NETDEV_DOWN:
+		clear_bit(ADAPTER_STATE_GOING_DOWN, &hba->adapter_state);
+		clear_bit(ADAPTER_STATE_UP, &hba->adapter_state);
+		break;
+	case NETDEV_GOING_DOWN:
+		set_bit(ADAPTER_STATE_GOING_DOWN, &hba->adapter_state);
+		iscsi_host_for_each_session(hba->shost,
+					    bnx2i_drop_session);
+		break;
+	case NETDEV_CHANGE:
+		bnx2i_get_link_state(hba);
+		break;
+	default:
+		;
+	}
+}
+
+
+/**
+ * bnx2i_cm_connect_cmpl - process iscsi conn establishment completion
+ *
+ * @cm_sk: 		cnic sock structure pointer
+ *
+ * function callback exported via bnx2i - cnic driver interface to
+ *	indicate completion of option-2 TCP connect request.
+ */
+static void bnx2i_cm_connect_cmpl(struct cnic_sock *cm_sk)
+{
+	struct bnx2i_endpoint *ep = (struct bnx2i_endpoint *) cm_sk->context;
+
+	if (test_bit(SK_F_OFFLD_COMPLETE, &cm_sk->flags))
+		ep->state = EP_STATE_CONNECT_COMPL;
+	else
+		ep->state = EP_STATE_CONNECT_FAILED;
+
+	wake_up_interruptible(&ep->ofld_wait);
+}
+
+
+/**
+ * bnx2i_cm_close_cmpl - process tcp conn close completion
+ * @cm_sk:	cnic sock structure pointer
+ *
+ * function callback exported via bnx2i - cnic driver interface to
+ *	indicate completion of option-2 graceful TCP connect shutdown
+ */
+static void bnx2i_cm_close_cmpl(struct cnic_sock *cm_sk)
+{
+	struct bnx2i_endpoint *ep = (struct bnx2i_endpoint *) cm_sk->context;
+
+	ep->state = EP_STATE_DISCONN_COMPL;
+	wake_up_interruptible(&ep->ofld_wait);
+}
+
+
+/**
+ * bnx2i_cm_abort_cmpl - process abortive tcp conn teardown completion
+ * @cm_sk:	cnic sock structure pointer
+ *
+ * function callback exported via bnx2i - cnic driver interface to
+ *	indicate completion of option-2 abortive TCP connect termination
+ */
+static void bnx2i_cm_abort_cmpl(struct cnic_sock *cm_sk)
+{
+	struct bnx2i_endpoint *ep = (struct bnx2i_endpoint *) cm_sk->context;
+
+	ep->state = EP_STATE_DISCONN_COMPL;
+	wake_up_interruptible(&ep->ofld_wait);
+}
+
+
+/**
+ * bnx2i_cm_remote_close - process received TCP FIN
+ * @hba:		adapter structure pointer
+ * @update_kcqe:	kcqe pointer
+ *
+ * function callback exported via bnx2i - cnic driver interface to indicate
+ *	async TCP events such as FIN
+ */
+static void bnx2i_cm_remote_close(struct cnic_sock *cm_sk)
+{
+	struct bnx2i_endpoint *ep = (struct bnx2i_endpoint *) cm_sk->context;
+
+	ep->state = EP_STATE_TCP_FIN_RCVD;
+	if (ep->conn)
+		bnx2i_recovery_que_add_conn(ep->hba, ep->conn);
+}
+
+/**
+ * bnx2i_cm_remote_abort - process TCP RST and start conn cleanup
+ * @hba:		adapter structure pointer
+ * @update_kcqe:	kcqe pointer
+ *
+ * function callback exported via bnx2i - cnic driver interface to
+ *	indicate async TCP events (RST) sent by the peer.
+ */
+static void bnx2i_cm_remote_abort(struct cnic_sock *cm_sk)
+{
+	struct bnx2i_endpoint *ep = (struct bnx2i_endpoint *) cm_sk->context;
+
+	ep->state = EP_STATE_TCP_RST_RCVD;
+	if (ep->conn)
+		bnx2i_recovery_que_add_conn(ep->hba, ep->conn);
+}
+
+
+/**
+ * bnx2i_cnic_cb - global template of bnx2i - cnic driver interface structure
+ *			carrying callback function pointers
+ *
+ */
+struct cnic_ulp_ops bnx2i_cnic_cb = {
+	.cnic_init = bnx2i_ulp_init,
+	.cnic_exit = bnx2i_ulp_exit,
+	.cnic_start = bnx2i_start,
+	.cnic_stop = bnx2i_stop,
+	.indicate_kcqes = bnx2i_indicate_kcqe,
+	.indicate_netevent = bnx2i_indicate_netevent,
+	.indicate_inetevent = bnx2i_indicate_inetevent,
+	.cm_connect_complete = bnx2i_cm_connect_cmpl,
+	.cm_close_complete = bnx2i_cm_close_cmpl,
+	.cm_abort_complete = bnx2i_cm_abort_cmpl,
+	.cm_remote_close = bnx2i_cm_remote_close,
+	.cm_remote_abort = bnx2i_cm_remote_abort,
+	.owner = THIS_MODULE
+};
+
+
+/**
+ * bnx2i_map_ep_dbell_regs - map connection doorbell registers
+ * @ep: bnx2i endpoint
+ *
+ * maps connection's SQ and RQ doorbell registers, 5706/5708/5709 hosts these
+ *	register in BAR #0. Whereas in 57710 these register are accessed by
+ *	mapping BAR #1
+ */
+int bnx2i_map_ep_dbell_regs(struct bnx2i_endpoint *ep)
+{
+	u32 cid_num;
+	u32 reg_off;
+	u32 first_l4l5;
+	u32 ctx_sz;
+	u32 config2;
+
+	cid_num = GET_CID_NUM(ep->ep_cid);
+
+	if ((test_bit(BNX2I_NX2_DEV_5709, &ep->hba->cnic_dev_type)) &&
+	    (ep->hba->mail_queue_access == BNX2I_MQ_BIN_MODE)) {
+		config2 = REG_RD(ep->hba, BNX2_MQ_CONFIG2);
+		first_l4l5 = config2 & BNX2_MQ_CONFIG2_FIRST_L4L5;
+		ctx_sz = (config2 & BNX2_MQ_CONFIG2_CONT_SZ) >> 3;
+		if (ctx_sz)
+			reg_off = CTX_OFFSET + MAX_CID_CNT * MB_KERNEL_CTX_SIZE
+				  + PAGE_SIZE *
+				  (((cid_num - first_l4l5) / ctx_sz) + 256);
+		else
+			reg_off = CTX_OFFSET + (MB_KERNEL_CTX_SIZE * cid_num);
+	} else
+		/* 5709 device in normal node and 5706/5708 devices */
+		reg_off = CTX_OFFSET + (MB_KERNEL_CTX_SIZE * cid_num);
+
+	ep->qp.ctx_base = ioremap_nocache(ep->hba->netdev->base_addr +
+					  reg_off, MB_KERNEL_CTX_SIZE);
+	if (!ep->qp.ctx_base)
+		return -ENOMEM;
+
+#ifdef _EVENT_COALESCE_
+	bnx2i_arm_cq_event_coalescing(ep, CNIC_ARM_CQE);
+#endif
+	return 0;
+}
diff --git a/drivers/scsi/bnx2i/bnx2i_init.c b/drivers/scsi/bnx2i/bnx2i_init.c
new file mode 100644
index 0000000..a255b6b
--- /dev/null
+++ b/drivers/scsi/bnx2i/bnx2i_init.c
@@ -0,0 +1,452 @@
+/* bnx2i.c: Broadcom NetXtreme II iSCSI driver.
+ *
+ * Copyright (c) 2006 - 2008 Broadcom Corporation
+ * Copyright (c) 2007, 2008 Red Hat, Inc.  All rights reserved.
+ * Copyright (c) 2007, 2008 Mike Christie
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation.
+ *
+ * Written by: Anil Veerabhadrappa (anilgv-dY08KVG/lbpWk0Htik3J/w@public.gmane.org)
+ */
+
+#include "bnx2i.h"
+
+extern struct scsi_transport_template *bnx2i_scsi_xport_template;
+extern struct iscsi_transport bnx2i_iscsi_transport;
+static struct list_head adapter_list = LIST_HEAD_INIT(adapter_list);
+static u32 adapter_count;
+static int bnx2i_reg_device;
+
+#define DRV_MODULE_NAME		"bnx2i"
+#define DRV_MODULE_VERSION	"1.3.0"
+#define DRV_MODULE_RELDATE	"May 21, 2008"
+
+static char version[] __devinitdata =
+		"Broadcom NetXtreme II iSCSI Driver " DRV_MODULE_NAME \
+		" v" DRV_MODULE_VERSION " (" DRV_MODULE_RELDATE ")\n";
+
+
+MODULE_AUTHOR("Anil Veerabhadrappa <anilgv-dY08KVG/lbpWk0Htik3J/w@public.gmane.org>");
+MODULE_DESCRIPTION("Broadcom NetXtreme II BCM5708 iSCSI Driver");
+MODULE_LICENSE("GPL");
+MODULE_VERSION(DRV_MODULE_VERSION);
+
+DEFINE_RWLOCK(bnx2i_dev_lock);
+
+unsigned int event_coal_div = 1;
+module_param(event_coal_div, int, 0664);
+MODULE_PARM_DESC(event_coal_div, "Event Coalescing Divide Factor");
+
+unsigned int en_tcp_dack = 1;
+module_param(en_tcp_dack, int, 0664);
+MODULE_PARM_DESC(en_tcp_dack, "Enable TCP Delayed ACK");
+
+unsigned int error_mask1 = 0x00;
+module_param(error_mask1, int, 0664);
+MODULE_PARM_DESC(error_mask1, "Config FW iSCSI Error Mask #1");
+
+unsigned int error_mask2 = 0x00;
+module_param(error_mask2, int, 0664);
+MODULE_PARM_DESC(error_mask2, "Config FW iSCSI Error Mask #2");
+
+unsigned int sq_size = BNX2I_SQ_WQES_DEFAULT;
+module_param(sq_size, int, 0664);
+MODULE_PARM_DESC(sq_size, "Configure SQ size");
+
+unsigned int rq_size = BNX2I_RQ_WQES_DEFAULT;
+module_param(rq_size, int, 0664);
+MODULE_PARM_DESC(rq_size, "Configure RQ size");
+
+unsigned int cq_size = BNX2I_CQ_WQES_DEFAULT;
+module_param(cq_size, int, 0664);
+MODULE_PARM_DESC(cq_size, "Configure CQ size");
+
+u64 iscsi_error_mask = 0x00;
+
+extern struct cnic_ulp_ops bnx2i_cnic_cb;
+extern spinlock_t bnx2i_resc_lock; /* protects global data structures */
+extern struct tcp_port_mngt bnx2i_tcp_port_tbl;
+
+static void bnx2i_unreg_one_device(struct bnx2i_hba *hba) ;
+
+
+/**
+ * bnx2i_get_tcp_port_requirements - returns num tcp ports to alloc/bind
+ *
+ * driver returns the number of TCP ports to be allocated/bound by 'bnx2id'
+ *	daemon. Return value of '0' means driver has everything to support
+ *	max iscsi connections on enumerated NX2 devices
+ */
+int bnx2i_get_tcp_port_requirements(void)
+{
+	struct bnx2i_hba *hba, *temp;
+	int count = 0;
+
+	read_lock(&bnx2i_dev_lock);
+	list_for_each_entry_safe(hba, temp, &adapter_list, link)
+		count += hba->max_active_conns;
+	read_unlock(&bnx2i_dev_lock);
+	return count;
+}
+
+
+/**
+ * get_adapter_list_head - returns head of adapter list
+ */
+struct bnx2i_hba *get_adapter_list_head(void)
+{
+	struct bnx2i_hba *hba = NULL;
+	struct bnx2i_hba *tmp_hba;
+
+	if (!adapter_count)
+		goto hba_not_found;
+
+	read_lock(&bnx2i_dev_lock);
+	list_for_each_entry(tmp_hba, &adapter_list, link) {
+		if (tmp_hba->cnic && tmp_hba->cnic->cm_select_dev) {
+			hba = tmp_hba;
+			break;
+		}
+	}
+	read_unlock(&bnx2i_dev_lock);
+hba_not_found:
+	return hba;
+}
+
+
+/**
+ * bnx2i_find_hba_for_cnic - maps cnic device instance to bnx2i adapter instance
+ * @cnic:	pointer to cnic device instance
+ *
+ */
+struct bnx2i_hba *bnx2i_find_hba_for_cnic(struct cnic_dev *cnic)
+{
+	struct bnx2i_hba *hba, *temp;
+
+	read_lock(&bnx2i_dev_lock);
+	list_for_each_entry_safe(hba, temp, &adapter_list, link) {
+		if (hba->cnic == cnic) {
+			read_unlock(&bnx2i_dev_lock);
+			return hba;
+		}
+	}
+	read_unlock(&bnx2i_dev_lock);
+	return NULL;
+}
+
+
+/**
+ * bnx2i_start - cnic callback to initialize & start adapter instance
+ * @handle:	transparent handle pointing to adapter structure
+ *
+ * This function maps adapter structure to pcidev structure and initiates
+ *	firmware handshake to enable/initialize on chip iscsi components
+ * 	This bnx2i - cnic interface api callback is issued after following
+ *	2 conditions are met -
+ *	  a) underlying network interface is up (marked by event 'NETDEV_UP'
+ *		from netdev
+ *	  b) bnx2i adapter instance is registered
+ */
+void bnx2i_start(void *handle)
+{
+#define BNX2I_INIT_POLL_TIME	(1000 / HZ)
+	struct bnx2i_hba *hba = handle;
+	int i = HZ;
+
+	bnx2i_send_fw_iscsi_init_msg(hba);
+	while (!test_bit(ADAPTER_STATE_UP, &hba->adapter_state) && i--)
+		msleep(BNX2I_INIT_POLL_TIME);
+}
+
+
+/**
+ * bnx2i_stop - cnic callback to shutdown adapter instance
+ * @handle:	transparent handle pointing to adapter structure
+ *
+ * driver checks if adapter is already in shutdown mode, if not start
+ *	the shutdown process
+ */
+void bnx2i_stop(void *handle)
+{
+	struct bnx2i_hba *hba = handle;
+
+	/* check if cleanup happened in GOING_DOWN context */
+	clear_bit(ADAPTER_STATE_UP, &hba->adapter_state);
+	if (!test_and_clear_bit(ADAPTER_STATE_GOING_DOWN,
+				&hba->adapter_state))
+		iscsi_host_for_each_session(hba->shost,
+					    bnx2i_drop_session);
+}
+
+/**
+ * bnx2i_register_device - register bnx2i adapter instance with the cnic driver
+ * @hba:	Adapter instance to register
+ *
+ * registers bnx2i adapter instance with the cnic driver while holding the
+ *	adapter structure lock
+ */
+void bnx2i_register_device(struct bnx2i_hba *hba)
+{
+	spin_lock(&hba->lock);	/* called from ep_connect context */
+	if (test_bit(ADAPTER_STATE_GOING_DOWN, &hba->adapter_state) ||
+	    test_bit(BNX2I_CNIC_REGISTERED, &hba->reg_with_cnic)) {
+		goto rel_lock;
+	}
+
+	hba->cnic->register_device(hba->cnic, CNIC_ULP_ISCSI, hba);
+	bnx2i_reg_device++;
+	set_bit(BNX2I_CNIC_REGISTERED, &hba->reg_with_cnic);
+rel_lock:
+	spin_unlock(&hba->lock);
+}
+
+
+/**
+ * bnx2i_reg_dev_all - registers all adapter instances with the cnic driver
+ *
+ * registers all bnx2i adapter instances with the cnic driver while holding
+ *	the global resource lock
+ */
+void bnx2i_reg_dev_all(void)
+{
+	struct bnx2i_hba *hba, *temp;
+
+	read_lock(&bnx2i_dev_lock);
+	list_for_each_entry_safe(hba, temp, &adapter_list, link)
+		bnx2i_register_device(hba);
+	read_unlock(&bnx2i_dev_lock);
+}
+
+
+/**
+ * bnx2i_unreg_one_device - unregister adapter instance with the cnic driver
+ * @hba:	Adapter instance to unregister
+ *
+ * registers bnx2i adapter instance with the cnic driver while holding
+ *	the adapter structure lock
+ */
+static void bnx2i_unreg_one_device(struct bnx2i_hba *hba)
+{
+	spin_lock(&hba->lock); /* ep_connect/ep_disconnect() */
+	if (hba->ofld_conns_active ||
+	    !test_bit(BNX2I_CNIC_REGISTERED, &hba->reg_with_cnic) ||
+	    test_bit(ADAPTER_STATE_GOING_DOWN, &hba->adapter_state)) {
+		spin_unlock(&hba->lock);
+		return;
+	}
+
+	hba->cnic->unregister_device(hba->cnic, CNIC_ULP_ISCSI);
+	bnx2i_reg_device--;
+	/* ep_disconnect could come before NETDEV_DOWN, driver won't
+	 * see NETDEV_DOWN as it already unregistered itself.
+	 */
+	hba->adapter_state = 0;
+	clear_bit(BNX2I_CNIC_REGISTERED, &hba->reg_with_cnic);
+	spin_unlock(&hba->lock);
+}
+
+/**
+ * bnx2i_unreg_dev_all - unregisters all bnx2i instances with the cnic driver
+ *
+ * unregisters all bnx2i adapter instances with the cnic driver while holding
+ *	the global resource lock
+ */
+void bnx2i_unreg_dev_all(void)
+{
+	struct bnx2i_hba *hba, *temp;
+
+	read_lock(&bnx2i_dev_lock);
+	list_for_each_entry_safe(hba, temp, &adapter_list, link)
+		bnx2i_unreg_one_device(hba);
+	read_unlock(&bnx2i_dev_lock);
+}
+
+
+/**
+ * bnx2i_init_one - initialize an adapter instance and allocate memory resources
+ * @hba:	bnx2i adapter instance
+ * @cnic:	cnic device handle
+ *
+ * Global resource lock and host adapter lock is held during critical sections
+ *	below. This routine is called from cnic_register_driver() context and
+ *	work horse thread which does majority of device specific initialization
+ */
+static int bnx2i_init_one(struct bnx2i_hba *hba, struct cnic_dev *cnic)
+{
+	int rc;
+
+	read_lock(&bnx2i_dev_lock);
+	if (bnx2i_reg_device &&
+	    !test_bit(BNX2I_CNIC_REGISTERED, &hba->reg_with_cnic)) {
+		spin_lock(&hba->lock);	/* hot plug */
+		rc = cnic->register_device(cnic, CNIC_ULP_ISCSI, hba);
+		if (rc)		/* duplicate registration */
+			printk(KERN_ERR "bnx2i- dev reg failed\n");
+		bnx2i_reg_device++;
+		hba->age++;
+		set_bit(BNX2I_CNIC_REGISTERED, &hba->reg_with_cnic);
+		spin_unlock(&hba->lock);
+	}
+	read_unlock(&bnx2i_dev_lock);
+
+	if (cnic->netdev)
+		memcpy(hba->mac_addr, cnic->netdev->dev_addr, MAX_ADDR_LEN);
+
+	bnx2i_tcp_port_tbl.num_required += hba->max_active_conns;
+
+	write_lock(&bnx2i_dev_lock);
+	list_add_tail(&hba->link, &adapter_list);
+	adapter_count++;
+	write_unlock(&bnx2i_dev_lock);
+	return 0;
+}
+
+
+/**
+ * bnx2i_ulp_init - initialize an adapter instance
+ * @dev:	cnic device handle
+ *
+ * Called from cnic_register_driver() context to initialize all enumerated
+ *	cnic devices. This routine allocate adapter structure and other
+ *	device specific resources.
+ */
+void bnx2i_ulp_init(struct cnic_dev *dev)
+{
+	struct bnx2i_hba *hba;
+
+	/* Allocate a HBA structure for this device */
+	hba = bnx2i_alloc_hba(dev);
+	if (!hba) {
+		printk(KERN_ERR "bnx2i init: hba initialization failed\n");
+		return;
+	}
+
+	/* Get PCI related information and update hba struct members */
+	clear_bit(BNX2I_CNIC_REGISTERED, &hba->reg_with_cnic);
+	if (bnx2i_init_one(hba, dev)) {
+		printk(KERN_ERR "bnx2i - hba %p init failed\n", hba);
+		bnx2i_free_hba(hba);
+	} else
+		hba->cnic = dev;
+}
+
+
+/**
+ * bnx2i_ulp_exit - shuts down adapter instance and frees all resources
+ * @dev:	cnic device handle
+ *
+ */
+void bnx2i_ulp_exit(struct cnic_dev *dev)
+{
+	struct bnx2i_hba *hba;
+
+	hba = bnx2i_find_hba_for_cnic(dev);
+	if (!hba) {
+		printk(KERN_INFO "bnx2i_ulp_exit: hba not "
+				 "found, dev 0x%p\n", dev);
+		return;
+	}
+	write_lock(&bnx2i_dev_lock);
+	list_del_init(&hba->link);
+	bnx2i_tcp_port_tbl.num_required -= hba->max_active_conns;
+	adapter_count--;
+
+	if (test_bit(BNX2I_CNIC_REGISTERED, &hba->reg_with_cnic)) {
+		spin_lock(&hba->lock);	/* hot remove */
+		hba->cnic->unregister_device(hba->cnic, CNIC_ULP_ISCSI);
+		clear_bit(BNX2I_CNIC_REGISTERED, &hba->reg_with_cnic);
+		bnx2i_reg_device--;
+		spin_unlock(&hba->lock);
+	}
+	write_unlock(&bnx2i_dev_lock);
+
+	bnx2i_free_hba(hba);
+}
+
+
+/**
+ * bnx2i_mod_init - module init entry point
+ *
+ * initialize any driver wide global data structures such as endpoint pool,
+ *	tcp port manager/queue, sysfs. finally driver will register itself
+ *	with the cnic module
+ */
+static int __init bnx2i_mod_init(void)
+{
+	int err;
+
+	printk(KERN_INFO "%s", version);
+
+	if (!is_power_of_2(sq_size))
+		sq_size = roundup_pow_of_two(sq_size);
+	if (sq_size < BNX2I_SQ_WQES_MIN)
+		sq_size = BNX2I_SQ_WQES_MIN;
+	if (sq_size > BNX2I_SQ_WQES_MAX)
+		sq_size = BNX2I_SQ_WQES_MAX;
+
+	bnx2i_init_tcp_port_mngr();
+
+	bnx2i_scsi_xport_template =
+			iscsi_register_transport(&bnx2i_iscsi_transport);
+	if (!bnx2i_scsi_xport_template) {
+		printk(KERN_ERR "Could not register bnx2i transport.\n");
+		err = -ENOMEM;
+		goto cleanup_port_mgr;
+	}
+
+	err = cnic_register_driver(CNIC_ULP_ISCSI, &bnx2i_cnic_cb);
+	if (err) {
+		printk(KERN_ERR "Could not register bnx2i cnic driver.\n");
+		goto unreg_xport;
+	}
+
+	return 0;
+
+unreg_xport:
+	iscsi_unregister_transport(&bnx2i_iscsi_transport);
+cleanup_port_mgr:
+	bnx2i_cleanup_tcp_port_mngr();
+	return err;
+}
+
+
+/**
+ * bnx2i_mod_exit - module cleanup/exit entry point
+ *
+ * Global resource lock and host adapter lock is held during critical sections
+ *	in this function. Driver will browse through the adapter list, cleans-up
+ *	each instance, unregisters iscsi transport name and finally driver will
+ *	unregister itself with the cnic module
+ */
+static void __exit bnx2i_mod_exit(void)
+{
+	struct bnx2i_hba *hba;
+
+	write_lock(&bnx2i_dev_lock);
+	while (!list_empty(&adapter_list)) {
+		hba = list_entry(adapter_list.next, struct bnx2i_hba, link);
+		list_del(&hba->link);
+		adapter_count--;
+
+		if (test_bit(BNX2I_CNIC_REGISTERED, &hba->reg_with_cnic)) {
+			hba->cnic->unregister_device(hba->cnic, CNIC_ULP_ISCSI);
+			clear_bit(BNX2I_CNIC_REGISTERED, &hba->reg_with_cnic);
+			bnx2i_reg_device--;
+		}
+
+		write_unlock(&bnx2i_dev_lock);
+		bnx2i_free_hba(hba);
+		write_lock(&bnx2i_dev_lock);
+	}
+	write_unlock(&bnx2i_dev_lock);
+
+	iscsi_unregister_transport(&bnx2i_iscsi_transport);
+	cnic_unregister_driver(CNIC_ULP_ISCSI);
+
+	bnx2i_cleanup_tcp_port_mngr();
+}
+
+module_init(bnx2i_mod_init);
+module_exit(bnx2i_mod_exit);
diff --git a/drivers/scsi/bnx2i/bnx2i_iscsi.c b/drivers/scsi/bnx2i/bnx2i_iscsi.c
new file mode 100644
index 0000000..2286832
--- /dev/null
+++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c
@@ -0,0 +1,2086 @@
+/*
+ * bnx2i_iscsi.c: Broadcom NetXtreme II iSCSI driver.
+ *
+ * Copyright (c) 2006 - 2008 Broadcom Corporation
+ * Copyright (c) 2007, 2008 Red Hat, Inc.  All rights reserved.
+ * Copyright (c) 2007, 2008 Mike Christie
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation.
+ *
+ * Written by: Anil Veerabhadrappa (anilgv-dY08KVG/lbpWk0Htik3J/w@public.gmane.org)
+ */
+
+#include <scsi/scsi_tcq.h>
+#include <scsi/libiscsi.h>
+#include "bnx2i.h"
+
+struct scsi_transport_template *bnx2i_scsi_xport_template;
+struct iscsi_transport bnx2i_iscsi_transport;
+static struct scsi_host_template bnx2i_host_template;
+
+/*
+ * Global endpoint resource info
+ */
+static DEFINE_SPINLOCK(bnx2i_resc_lock); /* protects global resources */
+struct tcp_port_mngt bnx2i_tcp_port_tbl;
+
+extern unsigned int sq_size;
+extern unsigned int rq_size;
+extern unsigned int cq_size;
+
+extern struct device_attribute *bnx2i_dev_attributes[];
+
+
+/**
+ * bnx2i_identify_device - identifies NetXtreme II device type
+ * @hba:	Adapter structure pointer
+ *
+ * This function identifies the NX2 device type and sets appropriate
+ *	queue mailbox register access method, 5709 requires driver to
+ *	access MBOX regs using *bin* mode
+ */
+static void bnx2i_identify_device(struct bnx2i_hba *hba)
+{
+	hba->cnic_dev_type = 0;
+	if ((hba->pci_did == PCI_DEVICE_ID_NX2_5706) ||
+	    (hba->pci_did == PCI_DEVICE_ID_NX2_5706S))
+		set_bit(BNX2I_NX2_DEV_5706, &hba->cnic_dev_type);
+	else if ((hba->pci_did == PCI_DEVICE_ID_NX2_5708) ||
+	    (hba->pci_did == PCI_DEVICE_ID_NX2_5708S))
+		set_bit(BNX2I_NX2_DEV_5708, &hba->cnic_dev_type);
+	else if ((hba->pci_did == PCI_DEVICE_ID_NX2_5709) ||
+	    (hba->pci_did == PCI_DEVICE_ID_NX2_5709S)) {
+		set_bit(BNX2I_NX2_DEV_5709, &hba->cnic_dev_type);
+		hba->mail_queue_access = BNX2I_MQ_BIN_MODE;
+	}
+}
+
+
+/**
+ * bnx2i_alloc_tcp_port - allocates a tcp port from the free list
+ *
+ * Assumes this function is called with 'bnx2i_resc_lock' held.
+ */
+static u16 bnx2i_alloc_tcp_port(void)
+{
+	u16 tcp_port;
+
+	if (!bnx2i_tcp_port_tbl.num_free_ports || !bnx2i_tcp_port_tbl.free_q)
+		return 0;
+
+	tcp_port = bnx2i_tcp_port_tbl.free_q[bnx2i_tcp_port_tbl.cons_idx];
+	bnx2i_tcp_port_tbl.cons_idx++;
+	bnx2i_tcp_port_tbl.cons_idx %= bnx2i_tcp_port_tbl.max_idx;
+	bnx2i_tcp_port_tbl.num_free_ports--;
+
+	return tcp_port;
+}
+
+
+/**
+ * bnx2i_free_tcp_port - Frees the given tcp port back to free pool
+ * @port: tcp port number being freed
+ *
+ * assumes this function is called with 'bnx2i_resc_lock' held
+ */
+static void bnx2i_free_tcp_port(u16 port)
+{
+	if (!bnx2i_tcp_port_tbl.free_q)
+		return;
+
+	bnx2i_tcp_port_tbl.free_q[bnx2i_tcp_port_tbl.prod_idx] = port;
+	bnx2i_tcp_port_tbl.prod_idx++;
+	bnx2i_tcp_port_tbl.prod_idx %= bnx2i_tcp_port_tbl.max_idx;
+	bnx2i_tcp_port_tbl.num_free_ports++;
+}
+
+/**
+ * bnx2i_tcp_port_new_entry - setup new port
+ * @port:	tcp port number being added to free pool
+ *
+ * 'bnx2i_resc_lock' is held while operating on global tcp port table
+ */
+void bnx2i_tcp_port_new_entry(u16 tcp_port)
+{
+	u32 idx = bnx2i_tcp_port_tbl.prod_idx;
+
+	spin_lock(&bnx2i_resc_lock);
+	bnx2i_tcp_port_tbl.free_q[idx] = tcp_port;
+	bnx2i_tcp_port_tbl.prod_idx++;
+	bnx2i_tcp_port_tbl.prod_idx %= bnx2i_tcp_port_tbl.max_idx;
+	bnx2i_tcp_port_tbl.num_free_ports++;
+	bnx2i_tcp_port_tbl.num_required--;
+	spin_unlock(&bnx2i_resc_lock);
+}
+
+/**
+ * bnx2i_init_tcp_port_mngr - initializes tcp port manager
+ */
+void bnx2i_init_tcp_port_mngr(void)
+{
+	int mem_size;
+
+	bnx2i_tcp_port_tbl.num_free_ports = 0;
+	bnx2i_tcp_port_tbl.prod_idx = 0;
+	bnx2i_tcp_port_tbl.cons_idx = 0;
+	bnx2i_tcp_port_tbl.max_idx = 0;
+	bnx2i_tcp_port_tbl.num_required = 0;
+
+#define BNX2I_MAX_TCP_PORTS	1024
+
+	bnx2i_tcp_port_tbl.port_tbl_size = BNX2I_MAX_TCP_PORTS;
+
+	mem_size = sizeof(u16) * bnx2i_tcp_port_tbl.port_tbl_size;
+	if (bnx2i_tcp_port_tbl.port_tbl_size) {
+		bnx2i_tcp_port_tbl.free_q = kmalloc(mem_size, GFP_KERNEL);
+
+		if (bnx2i_tcp_port_tbl.free_q)
+			bnx2i_tcp_port_tbl.max_idx =
+				bnx2i_tcp_port_tbl.port_tbl_size;
+	}
+}
+
+
+/**
+ * bnx2i_cleanup_tcp_port_mngr - frees memory held by global tcp port table
+ */
+void bnx2i_cleanup_tcp_port_mngr(void)
+{
+	kfree(bnx2i_tcp_port_tbl.free_q);
+	bnx2i_tcp_port_tbl.free_q = NULL;
+	bnx2i_tcp_port_tbl.num_free_ports = 0;
+}
+
+
+
+
+static int bnx2i_adapter_ready(struct bnx2i_hba *hba)
+{
+	int retval = 0;
+
+	if (!hba || !test_bit(ADAPTER_STATE_UP, &hba->adapter_state) ||
+	    test_bit(ADAPTER_STATE_GOING_DOWN, &hba->adapter_state))
+		retval = -EPERM;
+	return retval;
+}
+
+/**
+ * bnx2i_get_write_cmd_bd_idx - identifies various BD bookmarks
+ * @cmd:		iscsi cmd struct pointer
+ * @buf_off:		absolute buffer offset
+ * @start_bd_off:	u32 pointer to return the offset within the BD
+ *			indicated by 'start_bd_idx' on which 'buf_off' falls
+ * @start_bd_idx:	index of the BD on which 'buf_off' falls
+ *
+ * identifies & marks various bd info for scsi command's imm data,
+ * unsolicited data and the first solicited data seq.
+ */
+static void bnx2i_get_write_cmd_bd_idx(struct bnx2i_cmd *cmd, u32 buf_off,
+				       u32 *start_bd_off, u32 *start_bd_idx)
+{
+	struct iscsi_bd *bd_tbl = cmd->io_tbl.bd_tbl;
+	u32 cur_offset = 0;
+	u32 cur_bd_idx = 0;
+
+	if (buf_off) {
+		while (buf_off >= (cur_offset + bd_tbl->buffer_length)) {
+			cur_offset += bd_tbl->buffer_length;
+			cur_bd_idx++;
+			bd_tbl++;
+		}
+	}
+
+	*start_bd_off = buf_off - cur_offset;
+	*start_bd_idx = cur_bd_idx;
+}
+
+/**
+ * bnx2i_setup_write_cmd_bd_info - sets up BD various information
+ * @task:	transport layer's cmd struct pointer
+ *
+ * identifies & marks various bd info for scsi command's immediate data,
+ * unsolicited data and first solicited data seq which includes BD start
+ * index & BD buf off. his function takes into account iscsi parameter such
+ * as immediate data and unsolicited data is support on this connection.
+ */
+static void bnx2i_setup_write_cmd_bd_info(struct iscsi_task *task)
+{
+	struct bnx2i_cmd *cmd = task->dd_data;
+	u32 start_bd_offset;
+	u32 start_bd_idx;
+	u32 buffer_offset = 0;
+	u32 cmd_len = cmd->req.total_data_transfer_length;
+
+	/* if ImmediateData is turned off & IntialR2T is turned on,
+	 * there will be no immediate or unsolicited data, just return.
+	 */
+	if (!task->unsol_count && !task->imm_count)
+		return;
+
+	/* Immediate data */
+	buffer_offset += task->imm_count;
+	if (task->imm_count == cmd_len)
+		return;
+
+	if (task->unsol_count) {
+		bnx2i_get_write_cmd_bd_idx(cmd, buffer_offset,
+					   &start_bd_offset, &start_bd_idx);
+		cmd->req.ud_buffer_offset = start_bd_offset;
+		cmd->req.ud_start_bd_index = start_bd_idx;
+		buffer_offset += task->unsol_count;
+	}
+
+	if (buffer_offset != cmd_len) {
+		bnx2i_get_write_cmd_bd_idx(cmd, buffer_offset,
+					   &start_bd_offset, &start_bd_idx);
+		if ((start_bd_offset > task->conn->session->first_burst) ||
+		    (start_bd_idx > scsi_sg_count(cmd->scsi_cmd))) {
+			int i = 0;
+
+			iscsi_conn_printk(KERN_ALERT, task->conn,
+					  "bnx2i- error, buf offset 0x%x "
+					  "bd_valid %d use_sg %d\n",
+					  buffer_offset, cmd->io_tbl.bd_valid,
+					  scsi_sg_count(cmd->scsi_cmd));
+			for (i = 0; i < cmd->io_tbl.bd_valid; i++)
+				iscsi_conn_printk(KERN_ALERT, task->conn,
+						  "bnx2i err, bd[%d]: len %x\n",
+						  i, cmd->io_tbl.bd_tbl[i].\
+						  buffer_length);
+		}
+		cmd->req.sd_buffer_offset = start_bd_offset;
+		cmd->req.sd_start_bd_index = start_bd_idx;
+	}
+}
+
+
+
+/**
+ * bnx2i_map_scsi_sg - maps IO buffer and prepares the BD table
+ * @hba:	adapter instance
+ * @cmd:	iscsi cmd struct pointer
+ *
+ * map SG list
+ */
+static int bnx2i_map_scsi_sg(struct bnx2i_hba *hba, struct bnx2i_cmd *cmd)
+{
+	struct scsi_cmnd *sc = cmd->scsi_cmd;
+	struct iscsi_bd *bd = cmd->io_tbl.bd_tbl;
+	struct scatterlist *sg;
+	int byte_count = 0;
+	int bd_count = 0;
+	int sg_count;
+	int sg_len;
+	u64 addr;
+	int i;
+
+	BUG_ON(scsi_sg_count(sc) > ISCSI_MAX_BDS_PER_CMD);
+
+	sg_count = scsi_dma_map(sc);
+
+	scsi_for_each_sg(sc, sg, sg_count, i) {
+		sg_len = sg_dma_len(sg);
+		addr = (u64) sg_dma_address(sg);
+		bd[bd_count].buffer_addr_lo = addr & 0xffffffff;
+		bd[bd_count].buffer_addr_hi = addr >> 32;
+		bd[bd_count].buffer_length = sg_len;
+		bd[bd_count].flags = 0;
+		if (bd_count == 0)
+			bd[bd_count].flags = ISCSI_BD_FIRST_IN_BD_CHAIN;
+
+		byte_count += sg_len;
+		bd_count++;
+	}
+
+	if (bd_count)
+		bd[bd_count - 1].flags |= ISCSI_BD_LAST_IN_BD_CHAIN;
+
+	BUG_ON(byte_count != scsi_bufflen(sc));
+	return bd_count;
+}
+
+/**
+ * bnx2i_iscsi_map_sg_list - maps SG list
+ * @cmd:	iscsi cmd struct pointer
+ *
+ * creates BD list table for the command
+ */
+static void bnx2i_iscsi_map_sg_list(struct bnx2i_cmd *cmd)
+{
+	int bd_count;
+
+	bd_count  = bnx2i_map_scsi_sg(cmd->conn->hba, cmd);
+	if (!bd_count) {
+		struct iscsi_bd *bd = cmd->io_tbl.bd_tbl;
+
+		bd[0].buffer_addr_lo = bd[0].buffer_addr_hi = 0;
+		bd[0].buffer_length = bd[0].flags = 0;
+	}
+	cmd->io_tbl.bd_valid = bd_count;
+}
+
+
+/**
+ * bnx2i_iscsi_unmap_sg_list - unmaps SG list
+ * @cmd:	iscsi cmd struct pointer
+ *
+ * unmap IO buffers and invalidate the BD table
+ */
+void bnx2i_iscsi_unmap_sg_list(struct bnx2i_cmd *cmd)
+{
+	struct scsi_cmnd *sc = cmd->scsi_cmd;
+
+	if (cmd->io_tbl.bd_valid && sc) {
+		scsi_dma_unmap(sc);
+		cmd->io_tbl.bd_valid = 0;
+	}
+}
+
+static void bnx2i_setup_cmd_wqe_template(struct bnx2i_cmd *cmd)
+{
+	memset(&cmd->req, 0x00, sizeof(cmd->req));
+	cmd->req.op_code = 0xFF;
+	cmd->req.bd_list_addr_lo = (u32) cmd->io_tbl.bd_tbl_dma;
+	cmd->req.bd_list_addr_hi =
+		(u32) ((u64) cmd->io_tbl.bd_tbl_dma >> 32);
+
+}
+
+
+/**
+ * bnx2i_bind_conn_to_iscsi_cid - bind conn structure to 'iscsi_cid'
+ * @hba:	pointer to adapter instance
+ * @conn:	pointer to iscsi connection
+ * @iscsi_cid:	iscsi context ID, range 0 - (MAX_CONN - 1)
+ *
+ * update iscsi cid table entry with connection pointer. This enables
+ *	driver to quickly get hold of connection structure pointer in
+ *	completion/interrupt thread using iscsi context ID
+ */
+static int bnx2i_bind_conn_to_iscsi_cid(struct bnx2i_hba *hba,
+					struct bnx2i_conn *bnx2i_conn,
+					u32 iscsi_cid)
+{
+	if (hba && hba->cid_que.conn_cid_tbl[iscsi_cid]) {
+		iscsi_conn_printk(KERN_ALERT, bnx2i_conn->cls_conn->dd_data,
+				 "conn bind - entry #%d not free\n", iscsi_cid);
+		return -EBUSY;
+	}
+
+	hba->cid_que.conn_cid_tbl[iscsi_cid] = bnx2i_conn;
+	return 0;
+}
+
+
+/**
+ * bnx2i_get_conn_from_id - maps an iscsi cid to corresponding conn ptr
+ * @hba:	pointer to adapter instance
+ * @iscsi_cid:	iscsi context ID, range 0 - (MAX_CONN - 1)
+ */
+struct bnx2i_conn *bnx2i_get_conn_from_id(struct bnx2i_hba *hba,
+					  u16 iscsi_cid)
+{
+	if (!hba->cid_que.conn_cid_tbl) {
+		printk(KERN_ERR "bnx2i: ERROR - missing conn<->cid table\n");
+		return NULL;
+
+	} else if (iscsi_cid >= hba->max_active_conns) {
+		printk(KERN_ERR "bnx2i: wrong cid #%d\n", iscsi_cid);
+		return NULL;
+	}
+	return hba->cid_que.conn_cid_tbl[iscsi_cid];
+}
+
+
+/**
+ * bnx2i_alloc_iscsi_cid - allocates a iscsi_cid from free pool
+ * @hba:	pointer to adapter instance
+ */
+static u32 bnx2i_alloc_iscsi_cid(struct bnx2i_hba *hba)
+{
+	int idx;
+
+	if (!hba->cid_que.cid_free_cnt)
+		return ISCSI_RESERVED_TAG;
+
+	idx = hba->cid_que.cid_q_cons_idx;
+	hba->cid_que.cid_q_cons_idx++;
+	if (hba->cid_que.cid_q_cons_idx == hba->cid_que.cid_q_max_idx)
+		hba->cid_que.cid_q_cons_idx = 0;
+
+	hba->cid_que.cid_free_cnt--;
+	return hba->cid_que.cid_que[idx];
+}
+
+
+/**
+ * bnx2i_free_iscsi_cid - returns tcp port to free list
+ * @hba: 		pointer to adapter instance
+ * @iscsi_cid:		iscsi context ID to free
+ */
+static void bnx2i_free_iscsi_cid(struct bnx2i_hba *hba, u16 iscsi_cid)
+{
+	int idx;
+
+	if (iscsi_cid == (u16)ISCSI_RESERVED_TAG)
+		return;
+
+	hba->cid_que.cid_free_cnt++;
+
+	idx = hba->cid_que.cid_q_prod_idx;
+	hba->cid_que.cid_que[idx] = iscsi_cid;
+	hba->cid_que.conn_cid_tbl[iscsi_cid] = NULL;
+	hba->cid_que.cid_q_prod_idx++;
+	if (hba->cid_que.cid_q_prod_idx == hba->cid_que.cid_q_max_idx)
+		hba->cid_que.cid_q_prod_idx = 0;
+}
+
+
+/**
+ * bnx2i_setup_free_cid_que - sets up free iscsi cid queue
+ * @hba:	pointer to adapter instance
+ *
+ * allocates memory for iscsi cid queue & 'cid - conn ptr' mapping table,
+ * 	and initialize table attributes
+ */
+static int bnx2i_setup_free_cid_que(struct bnx2i_hba *hba)
+{
+	int mem_size;
+	int i;
+
+	mem_size = hba->max_active_conns * sizeof(u16);
+	mem_size = (mem_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+
+	hba->cid_que.cid_que_base = kmalloc(mem_size, GFP_KERNEL);
+	if (!hba->cid_que.cid_que_base)
+		return -ENOMEM;
+
+	mem_size = hba->max_active_conns * sizeof(struct bnx2i_conn *);
+	mem_size = (mem_size + (PAGE_SIZE - 1)) & PAGE_MASK;
+	hba->cid_que.conn_cid_tbl = kmalloc(mem_size, GFP_KERNEL);
+	if (!hba->cid_que.conn_cid_tbl) {
+		kfree(hba->cid_que.cid_que_base);
+		hba->cid_que.cid_que_base = NULL;
+		return -ENOMEM;
+	}
+
+	hba->cid_que.cid_que = (u32 *)hba->cid_que.cid_que_base;
+	hba->cid_que.cid_q_prod_idx = 0;
+	hba->cid_que.cid_q_cons_idx = 0;
+	hba->cid_que.cid_q_max_idx = hba->max_active_conns;
+	hba->cid_que.cid_free_cnt = hba->max_active_conns;
+
+	for (i = 0; i < hba->max_active_conns; i++) {
+		hba->cid_que.cid_que[i] = i;
+		hba->cid_que.conn_cid_tbl[i] = NULL;
+	}
+	return 0;
+}
+
+
+/**
+ * bnx2i_release_free_cid_que - releases 'iscsi_cid' queue resources
+ * @hba:	pointer to adapter instance
+ */
+static void bnx2i_release_free_cid_que(struct bnx2i_hba *hba)
+{
+	kfree(hba->cid_que.cid_que_base);
+	hba->cid_que.cid_que_base = NULL;
+
+	kfree(hba->cid_que.conn_cid_tbl);
+	hba->cid_que.conn_cid_tbl = NULL;
+}
+
+
+/**
+ * bnx2i_alloc_ep - allocates ep structure from global pool
+ * @hba:	pointer to adapter instance
+ *
+ * routine allocates a free endpoint structure from global pool and
+ *	a tcp port to be used for this connection.  Global resource lock,
+ *	'bnx2i_resc_lock' is held while accessing shared global data structures
+ */
+static struct iscsi_endpoint *bnx2i_alloc_ep(struct bnx2i_hba *hba)
+{
+	struct iscsi_endpoint *ep;
+	struct bnx2i_endpoint *bnx2i_ep;
+	u16 tcp_port;
+	u32 flags;
+
+	ep = iscsi_create_endpoint(sizeof(*bnx2i_ep));
+	if (!ep) {
+		printk(KERN_ERR "bnx2i: Could not allocate ep\n");
+		return NULL;
+	}
+
+	spin_lock_irqsave(&bnx2i_resc_lock, flags);
+	tcp_port = bnx2i_alloc_tcp_port();
+	if (!tcp_port) {
+		printk(KERN_ERR "bnx2i: run 'bnx2id' to alloc tcp ports\n");
+		spin_unlock_irqrestore(&bnx2i_resc_lock, flags);
+		iscsi_destroy_endpoint(ep);
+		return NULL;
+	}
+	spin_unlock_irqrestore(&bnx2i_resc_lock, flags);
+
+	bnx2i_ep = ep->dd_data;
+	INIT_LIST_HEAD(&bnx2i_ep->link);
+	bnx2i_ep->state = EP_STATE_IDLE;
+	bnx2i_ep->hba = hba;
+	bnx2i_ep->hba_age = hba->age;
+	hba->ofld_conns_active++;
+	bnx2i_ep->tcp_port = tcp_port;
+	init_waitqueue_head(&bnx2i_ep->ofld_wait);
+	return ep;
+}
+
+
+/**
+ * bnx2i_free_ep - free endpoint
+ * @ep:		pointer to iscsi endpoint structure
+ */
+static void bnx2i_free_ep(struct iscsi_endpoint *ep)
+{
+	struct bnx2i_endpoint *bnx2i_ep = ep->dd_data;
+	u32 flags;
+
+	spin_lock_irqsave(&bnx2i_resc_lock, flags);
+	bnx2i_ep->state = EP_STATE_IDLE;
+	bnx2i_ep->hba->ofld_conns_active--;
+
+	bnx2i_free_iscsi_cid(bnx2i_ep->hba, bnx2i_ep->ep_iscsi_cid);
+	if (bnx2i_ep->conn) {
+		bnx2i_ep->conn->ep = NULL;
+		bnx2i_ep->conn = NULL;
+	}
+
+	if (bnx2i_ep->tcp_port)
+		bnx2i_free_tcp_port(bnx2i_ep->tcp_port);
+
+	bnx2i_ep->hba = NULL;
+	spin_unlock_irqrestore(&bnx2i_resc_lock, flags);
+	iscsi_destroy_endpoint(ep);
+}
+
+
+/**
+ * bnx2i_alloc_bdt - allocates buffer descriptor (BD) table for the command
+ * @hba:	adapter instance pointer
+ * @session:	iscsi session pointer
+ * @cmd:	iscsi command structure
+ */
+static int bnx2i_alloc_bdt(struct bnx2i_hba *hba, struct iscsi_session *session,
+			   struct bnx2i_cmd *cmd)
+{
+	struct io_bdt *io = &cmd->io_tbl;
+	struct iscsi_bd *bd;
+
+	io->bd_tbl = dma_alloc_coherent(&hba->pcidev->dev,
+					ISCSI_MAX_BDS_PER_CMD * sizeof(*bd),
+					&io->bd_tbl_dma, GFP_KERNEL);
+	if (!io->bd_tbl) {
+		iscsi_session_printk(KERN_ERR, session, "Could not "
+				     "allocate bdt.\n");
+		return -ENOMEM;
+	}
+	io->bd_valid = 0;
+	return 0;
+}
+
+/**
+ * bnx2i_destroy_cmd_pool - destroys iscsi command pool and release BD table
+ * @hba:	adapter instance pointer
+ * @session:	iscsi session pointer
+ * @cmd:	iscsi command structure
+ */
+static void bnx2i_destroy_cmd_pool(struct bnx2i_hba *hba,
+				   struct iscsi_session *session)
+{
+	int i;
+
+	for (i = 0; i < session->cmds_max; i++) {
+		struct iscsi_task *task = session->cmds[i];
+		struct bnx2i_cmd *cmd = task->dd_data;
+
+		if (cmd->io_tbl.bd_tbl)
+			dma_free_coherent(&hba->pcidev->dev,
+					  ISCSI_MAX_BDS_PER_CMD *
+					  sizeof(struct iscsi_bd),
+					  cmd->io_tbl.bd_tbl,
+					  cmd->io_tbl.bd_tbl_dma);
+	}
+
+}
+
+
+/**
+ * bnx2i_setup_cmd_pool - sets up iscsi command pool for the session
+ * @hba:	adapter instance pointer
+ * @session:	iscsi session pointer
+ */
+static int bnx2i_setup_cmd_pool(struct bnx2i_hba *hba,
+				struct iscsi_session *session)
+{
+	int i;
+
+	for (i = 0; i < session->cmds_max; i++) {
+		struct iscsi_task *task = session->cmds[i];
+		struct bnx2i_cmd *cmd = task->dd_data;
+
+		task->hdr = (struct iscsi_cmd *)&cmd->hdr;
+		task->hdr_max = sizeof(struct iscsi_hdr);
+
+		if (bnx2i_alloc_bdt(hba, session, cmd))
+			goto free_bdts;
+	}
+
+	return 0;
+
+free_bdts:
+	bnx2i_destroy_cmd_pool(hba, session);
+	return -ENOMEM;
+}
+
+
+/**
+ * bnx2i_setup_mp_bdt - allocate BD table resources
+ * @hba:	pointer to adapter structure
+ *
+ * Allocate memory for dummy buffer and associated BD
+ * table to be used by middle path (MP) requests
+ */
+static int bnx2i_setup_mp_bdt(struct bnx2i_hba *hba)
+{
+	int rc = 0;
+	struct iscsi_bd *mp_bdt;
+	u64 addr;
+
+	hba->mp_bd_tbl = dma_alloc_coherent(&hba->pcidev->dev, PAGE_SIZE,
+					    &hba->mp_bd_dma, GFP_KERNEL);
+	if (!hba->mp_bd_tbl) {
+		printk(KERN_ERR "unable to allocate Middle Path BDT\n");
+		rc = -1;
+		goto out;
+	}
+
+	hba->dummy_buffer = dma_alloc_coherent(&hba->pcidev->dev, PAGE_SIZE,
+					       &hba->dummy_buf_dma, GFP_KERNEL);
+	if (!hba->dummy_buffer) {
+		printk(KERN_ERR "unable to alloc Middle Path Dummy Buffer\n");
+		dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+				  hba->mp_bd_tbl, hba->mp_bd_dma);
+		hba->mp_bd_tbl = NULL;
+		rc = -1;
+		goto out;
+	}
+
+	mp_bdt = (struct iscsi_bd *) hba->mp_bd_tbl;
+	addr = (unsigned long) hba->dummy_buf_dma;
+	mp_bdt->buffer_addr_lo = addr & 0xffffffff;
+	mp_bdt->buffer_addr_hi = addr >> 32;
+	mp_bdt->buffer_length = PAGE_SIZE;
+	mp_bdt->flags = ISCSI_BD_LAST_IN_BD_CHAIN |
+			ISCSI_BD_FIRST_IN_BD_CHAIN;
+out:
+	return rc;
+}
+
+
+/**
+ * bnx2i_free_mp_bdt - releases ITT back to free pool
+ * @hba:	pointer to adapter instance
+ *
+ * free MP dummy buffer and associated BD table
+ */
+static void bnx2i_free_mp_bdt(struct bnx2i_hba *hba)
+{
+	if (hba->mp_bd_tbl) {
+		dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+				  hba->mp_bd_tbl, hba->mp_bd_dma);
+		hba->mp_bd_tbl = NULL;
+	}
+	if (hba->dummy_buffer) {
+		dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+				  hba->dummy_buffer, hba->dummy_buf_dma);
+		hba->dummy_buffer = NULL;
+	}
+		return;
+}
+
+/**
+ * bnx2i_drop_session - notifies iscsid of connection error.
+ * @hba:	adapter instance pointer
+ * @session:	iscsi session pointer
+ *
+ * This notifies iscsid that there is a error, so it can initiate
+ * recovery.
+ *
+ * This relies on caller using the iscsi class iterator so the object
+ * is refcounted and does not disapper from under us.
+ */
+void bnx2i_drop_session(struct iscsi_cls_session *cls_session)
+{
+	iscsi_session_failure(cls_session, ISCSI_ERR_CONN_FAILED);
+}
+
+/**
+ * bnx2i_ep_destroy_list_add - add an entry to EP destroy list
+ * @hba:	pointer to adapter instance
+ * @ep:		pointer to endpoint (transport indentifier) structure
+ *
+ * EP destroy queue manager
+ */
+static int bnx2i_ep_destroy_list_add(struct bnx2i_hba *hba,
+				     struct bnx2i_endpoint *ep)
+{
+	int cur_idx;
+
+	write_lock_bh(&hba->ep_rdwr_lock);
+	cur_idx = hba->ep_destroy_prod_idx++;
+	hba->ep_destroy_list[cur_idx] = ep;
+	hba->ep_destroy_prod_idx %= hba->ep_destroy_max_idx;
+	write_unlock_bh(&hba->ep_rdwr_lock);
+	return 0;
+}
+
+/**
+ * bnx2i_ep_destroy_list_next - returns head of destroy EP list
+ * @hba:	pointer to adapter instance
+ * @ep:		pointer to endpoint (transport indentifier) structure
+ *
+ * EP destroy queue manager
+ */
+struct bnx2i_endpoint *bnx2i_ep_destroy_list_next(struct bnx2i_hba *hba)
+{
+	int cur_idx;
+
+	read_lock(&hba->ep_rdwr_lock);
+	if (hba->ep_destroy_prod_idx == hba->ep_destroy_cons_idx) {
+		read_unlock(&hba->ep_rdwr_lock);
+		return NULL;
+	}
+	cur_idx = hba->ep_destroy_cons_idx++;
+	hba->ep_destroy_cons_idx %= hba->ep_destroy_max_idx;
+	read_unlock(&hba->ep_rdwr_lock);
+
+	return hba->ep_destroy_list[cur_idx];
+}
+
+/**
+ * bnx2i_ep_ofld_list_add - add an entry to ep offload pending list
+ * @hba:	pointer to adapter instance
+ * @ep:		pointer to endpoint (transport indentifier) structure
+ *
+ * pending conn offload completion queue manager
+ */
+static int bnx2i_ep_ofld_list_add(struct bnx2i_hba *hba,
+				  struct bnx2i_endpoint *ep)
+{
+	int cur_idx;
+
+	write_lock_bh(&hba->ep_rdwr_lock);
+	cur_idx = hba->ep_ofld_prod_idx++;
+	hba->ep_ofld_list[cur_idx] = ep;
+	hba->ep_ofld_prod_idx %= hba->ep_ofld_max_idx;
+	write_unlock_bh(&hba->ep_rdwr_lock);
+	return 0;
+}
+
+/**
+ * bnx2i_ep_ofld_list_next - get head of pending conn offload list
+ * @hba:	pointer to adapter instance
+ *
+ * pending conn offload completion queue manager
+ */
+struct bnx2i_endpoint *bnx2i_ep_ofld_list_next(struct bnx2i_hba *hba)
+{
+	int cur_idx;
+
+	read_lock(&hba->ep_rdwr_lock);
+	if (hba->ep_ofld_prod_idx == hba->ep_ofld_cons_idx) {
+		read_unlock(&hba->ep_rdwr_lock);
+		return NULL;
+	}
+	cur_idx = hba->ep_ofld_cons_idx++;
+	hba->ep_ofld_cons_idx %= hba->ep_ofld_max_idx;
+	read_unlock(&hba->ep_rdwr_lock);
+
+	return (hba->ep_ofld_list[cur_idx]);
+}
+
+/**
+ * bnx2i_init_ep_ofld_destroy_que - init EP destroy queue
+ * @hba:	pointer to adapter instance
+ *
+ * EP destroy queue manager
+ */
+static int bnx2i_init_ep_ofld_destroy_que(struct bnx2i_hba *hba)
+{
+	rwlock_init(&hba->ep_rdwr_lock);
+	hba->ep_ofld_list = kmalloc(PAGE_SIZE, GFP_KERNEL);
+	if (!hba->ep_ofld_list)
+		return -ENOMEM;
+
+	hba->ep_ofld_prod_idx = 0;
+	hba->ep_ofld_cons_idx = 0;
+	hba->ep_ofld_max_idx =
+		PAGE_SIZE / sizeof(struct bnx2i_endpoint *) - 1;
+
+	hba->ep_destroy_list = kmalloc(PAGE_SIZE, GFP_KERNEL);
+	if (!hba->ep_destroy_list) {
+		kfree(hba->ep_ofld_list);
+		hba->ep_ofld_list = NULL;
+		return -ENOMEM;
+	}
+
+	hba->ep_destroy_prod_idx = 0;
+	hba->ep_destroy_cons_idx = 0;
+	hba->ep_destroy_max_idx =
+		PAGE_SIZE / sizeof(struct bnx2i_endpoint *) - 1;
+	return 0;
+}
+
+
+/**
+ * bnx2i_free_ep_ofld_destroy_que - free resources held by EP destroy queue
+ * @hba:	pointer to adapter instance
+ *
+ * EP destroy queue manager
+ */
+static void bnx2i_free_ep_ofld_destroy_que(struct bnx2i_hba *hba)
+{
+	kfree(hba->ep_ofld_list);
+	hba->ep_ofld_list = NULL;
+
+	kfree(hba->ep_destroy_list);
+	hba->ep_destroy_list = NULL;
+}
+
+/**
+ * bnx2i_alloc_hba - allocate and init adapter instance
+ * @cnic:	cnic device pointer
+ *
+ * allocate & initialize adapter structure and call other
+ *	support routines to do per adapter initialization
+ */
+struct bnx2i_hba *bnx2i_alloc_hba(struct cnic_dev *cnic)
+{
+	struct Scsi_Host *shost;
+	struct bnx2i_hba *hba;
+
+	shost = iscsi_host_alloc(&bnx2i_host_template, sizeof(*hba), 32);
+	if (!shost)
+		return NULL;
+	shost->dma_boundary = cnic->pcidev->dma_mask;
+	shost->transportt = bnx2i_scsi_xport_template;
+	shost->max_id = ISCSI_MAX_CONNS_PER_HBA;
+	shost->max_channel = 0;
+	/* TODO: mnc - make this the to_scsilun limit
+	 *	Anil - ?
+	 */
+	shost->max_lun = 512;
+	shost->max_cmd_len = 16;
+
+	hba = iscsi_host_priv(shost);
+	hba->shost = shost;
+	hba->netdev = cnic->netdev;
+	/* Get PCI related information and update hba struct members */
+	hba->pcidev = cnic->pcidev;
+	pci_dev_get(hba->pcidev);
+	hba->pci_did = hba->pcidev->device;
+	hba->pci_vid = hba->pcidev->vendor;
+	hba->pci_sdid = hba->pcidev->subsystem_device;
+	hba->pci_svid = hba->pcidev->subsystem_vendor;
+	hba->pci_func = PCI_FUNC(hba->pcidev->devfn);
+	hba->pci_devno = PCI_SLOT(hba->pcidev->devfn);
+
+	bnx2i_identify_device(hba);
+
+	if (test_bit(BNX2I_NX2_DEV_5709, &hba->cnic_dev_type)) {
+		hba->regview = ioremap_nocache(hba->netdev->base_addr,
+					       BNX2_MQ_CONFIG2);
+		if (!hba->regview)
+			goto ioreg_map_err;
+	}
+
+	if (bnx2i_init_ep_ofld_destroy_que(hba))
+		goto ep_ofld_que_err;
+
+	hba->mtu_supported = BNX2I_MAX_MTU_SUPPORTED;
+
+	/* different values for 5708/5709/57710 */
+	hba->max_active_conns = ISCSI_MAX_CONNS_PER_HBA;
+
+	if (bnx2i_setup_free_cid_que(hba))
+		goto cid_que_err;
+
+	/* SQ/RQ/CQ size can be changed via sysfx interface */
+	hba->max_sqes = sq_size;
+	hba->max_rqes = rq_size;
+	hba->max_cqes = cq_size;
+	hba->num_ccell = hba->max_sqes / 2;
+
+	if (bnx2i_setup_mp_bdt(hba))
+		goto mp_bdt_err;
+
+	spin_lock_init(&hba->lock);
+
+	if (iscsi_host_add(shost, &hba->pcidev->dev))
+		goto free_dump_mem;
+	return hba;
+
+free_dump_mem:
+	bnx2i_free_mp_bdt(hba);
+mp_bdt_err:
+	bnx2i_release_free_cid_que(hba);
+cid_que_err:
+	bnx2i_free_ep_ofld_destroy_que(hba);
+ep_ofld_que_err:
+	if (hba->regview) {
+		iounmap(hba->regview);
+		hba->regview = NULL;
+	}
+ioreg_map_err:
+	pci_dev_put(hba->pcidev);
+	scsi_host_put(shost);
+	return NULL;
+}
+
+/**
+ * bnx2i_free_hba- releases hba structure and resources held by the adapter
+ * @hba:	pointer to adapter instance
+ *
+ * free adapter structure and call various cleanup routines.
+ */
+void bnx2i_free_hba(struct bnx2i_hba *hba)
+{
+	struct Scsi_Host *shost = hba->shost;
+
+	iscsi_host_remove(shost);
+	pci_dev_put(hba->pcidev);
+
+	if (hba->regview) {
+		iounmap(hba->regview);
+		hba->regview = NULL;
+	}
+	bnx2i_free_mp_bdt(hba);
+	bnx2i_release_free_cid_que(hba);
+	bnx2i_free_ep_ofld_destroy_que(hba);
+	iscsi_host_free(shost);
+}
+
+/**
+ * bnx2i_conn_free_login_resources - free DMA resources used for login process
+ * @hba:		pointer to adapter instance
+ * @bnx2i_conn:		iscsi connection pointer
+ *
+ * Login related resources, mostly BDT & payload DMA memory is freed
+ */
+static void bnx2i_conn_free_login_resources(struct bnx2i_hba *hba,
+					    struct bnx2i_conn *bnx2i_conn)
+{
+	if (bnx2i_conn->gen_pdu.resp_bd_tbl) {
+		dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+				  bnx2i_conn->gen_pdu.resp_bd_tbl,
+				  bnx2i_conn->gen_pdu.resp_bd_dma);
+		bnx2i_conn->gen_pdu.resp_bd_tbl = NULL;
+	}
+
+	if (bnx2i_conn->gen_pdu.req_bd_tbl) {
+		dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+				  bnx2i_conn->gen_pdu.req_bd_tbl,
+				  bnx2i_conn->gen_pdu.req_bd_dma);
+		bnx2i_conn->gen_pdu.req_bd_tbl = NULL;
+	}
+
+	if (bnx2i_conn->gen_pdu.resp_buf) {
+		dma_free_coherent(&hba->pcidev->dev,
+				  ISCSI_DEF_MAX_RECV_SEG_LEN,
+				  bnx2i_conn->gen_pdu.resp_buf,
+				  bnx2i_conn->gen_pdu.resp_dma_addr);
+		bnx2i_conn->gen_pdu.resp_buf = NULL;
+	}
+
+	if (bnx2i_conn->gen_pdu.req_buf) {
+		dma_free_coherent(&hba->pcidev->dev,
+				  ISCSI_DEF_MAX_RECV_SEG_LEN,
+				  bnx2i_conn->gen_pdu.req_buf,
+				  bnx2i_conn->gen_pdu.req_dma_addr);
+		bnx2i_conn->gen_pdu.req_buf = NULL;
+	}
+}
+
+/**
+ * bnx2i_conn_alloc_login_resources - alloc DMA resources for login/nop.
+ * @hba:		pointer to adapter instance
+ * @bnx2i_conn:		iscsi connection pointer
+ *
+ * Mgmt task DNA resources are allocated in this routine.
+ */
+static int bnx2i_conn_alloc_login_resources(struct bnx2i_hba *hba,
+					    struct bnx2i_conn *bnx2i_conn)
+{
+	/* Allocate memory for login request/response buffers */
+	bnx2i_conn->gen_pdu.req_buf =
+		dma_alloc_coherent(&hba->pcidev->dev,
+				   ISCSI_DEF_MAX_RECV_SEG_LEN,
+				   &bnx2i_conn->gen_pdu.req_dma_addr,
+				   GFP_KERNEL);
+	if (bnx2i_conn->gen_pdu.req_buf == NULL)
+		goto login_req_buf_failure;
+
+	bnx2i_conn->gen_pdu.req_buf_size = 0;
+	bnx2i_conn->gen_pdu.req_wr_ptr = bnx2i_conn->gen_pdu.req_buf;
+
+	bnx2i_conn->gen_pdu.resp_buf =
+		dma_alloc_coherent(&hba->pcidev->dev,
+				   ISCSI_DEF_MAX_RECV_SEG_LEN,
+				   &bnx2i_conn->gen_pdu.resp_dma_addr,
+				   GFP_KERNEL);
+	if (bnx2i_conn->gen_pdu.resp_buf == NULL)
+		goto login_resp_buf_failure;
+
+	bnx2i_conn->gen_pdu.resp_buf_size = ISCSI_DEF_MAX_RECV_SEG_LEN;
+	bnx2i_conn->gen_pdu.resp_wr_ptr = bnx2i_conn->gen_pdu.resp_buf;
+
+	bnx2i_conn->gen_pdu.req_bd_tbl =
+		dma_alloc_coherent(&hba->pcidev->dev, PAGE_SIZE,
+				   &bnx2i_conn->gen_pdu.req_bd_dma, GFP_KERNEL);
+	if (bnx2i_conn->gen_pdu.req_bd_tbl == NULL)
+		goto login_req_bd_tbl_failure;
+
+	bnx2i_conn->gen_pdu.resp_bd_tbl =
+		dma_alloc_coherent(&hba->pcidev->dev, PAGE_SIZE,
+				   &bnx2i_conn->gen_pdu.resp_bd_dma,
+				   GFP_KERNEL);
+	if (bnx2i_conn->gen_pdu.resp_bd_tbl == NULL)
+		goto login_resp_bd_tbl_failure;
+
+	return 0;
+
+login_resp_bd_tbl_failure:
+	dma_free_coherent(&hba->pcidev->dev, PAGE_SIZE,
+			  bnx2i_conn->gen_pdu.req_bd_tbl,
+			  bnx2i_conn->gen_pdu.req_bd_dma);
+	bnx2i_conn->gen_pdu.req_bd_tbl = NULL;
+
+login_req_bd_tbl_failure:
+	dma_free_coherent(&hba->pcidev->dev, ISCSI_DEF_MAX_RECV_SEG_LEN,
+			  bnx2i_conn->gen_pdu.resp_buf,
+			  bnx2i_conn->gen_pdu.resp_dma_addr);
+	bnx2i_conn->gen_pdu.resp_buf = NULL;
+login_resp_buf_failure:
+	dma_free_coherent(&hba->pcidev->dev, ISCSI_DEF_MAX_RECV_SEG_LEN,
+			  bnx2i_conn->gen_pdu.req_buf,
+			  bnx2i_conn->gen_pdu.req_dma_addr);
+	bnx2i_conn->gen_pdu.req_buf = NULL;
+login_req_buf_failure:
+	iscsi_conn_printk(KERN_ERR, bnx2i_conn->cls_conn->dd_data,
+			  "login resource alloc failed!!\n");
+	return -ENOMEM;
+
+}
+
+
+/**
+ * bnx2i_iscsi_prep_generic_pdu_bd - prepares BD table.
+ * @bnx2i_conn:		iscsi connection pointer
+ *
+ * Allocates buffers and BD tables before shipping requests to cnic
+ *	for PDUs prepared by 'iscsid' daemon
+ */
+static void bnx2i_iscsi_prep_generic_pdu_bd(struct bnx2i_conn *bnx2i_conn)
+{
+	struct iscsi_bd *bd_tbl;
+
+	bd_tbl = (struct iscsi_bd *) bnx2i_conn->gen_pdu.req_bd_tbl;
+
+	bd_tbl->buffer_addr_hi =
+		(u32) ((u64) bnx2i_conn->gen_pdu.req_dma_addr >> 32);
+	bd_tbl->buffer_addr_lo = (u32) bnx2i_conn->gen_pdu.req_dma_addr;
+	bd_tbl->buffer_length = bnx2i_conn->gen_pdu.req_wr_ptr -
+				bnx2i_conn->gen_pdu.req_buf;
+	bd_tbl->reserved0 = 0;
+	bd_tbl->flags = ISCSI_BD_LAST_IN_BD_CHAIN |
+			ISCSI_BD_FIRST_IN_BD_CHAIN;
+
+	bd_tbl = (struct iscsi_bd  *) bnx2i_conn->gen_pdu.resp_bd_tbl;
+	bd_tbl->buffer_addr_hi = (u64) bnx2i_conn->gen_pdu.resp_dma_addr >> 32;
+	bd_tbl->buffer_addr_lo = (u32) bnx2i_conn->gen_pdu.resp_dma_addr;
+	bd_tbl->buffer_length = ISCSI_DEF_MAX_RECV_SEG_LEN;
+	bd_tbl->reserved0 = 0;
+	bd_tbl->flags = ISCSI_BD_LAST_IN_BD_CHAIN |
+			ISCSI_BD_FIRST_IN_BD_CHAIN;
+}
+
+
+/**
+ * bnx2i_iscsi_send_generic_request - called to send mgmt tasks.
+ * @task:	transport layer task pointer
+ *
+ * called to transmit PDUs prepared by the 'iscsid' daemon. iSCSI login,
+ *	Nop-out and Logout requests flow through this path.
+ */
+static int bnx2i_iscsi_send_generic_request(struct iscsi_task *task)
+{
+	struct bnx2i_cmd *cmd = task->dd_data;
+	struct bnx2i_conn *bnx2i_conn = cmd->conn;
+	int rc = 0;
+	char *buf;
+	int data_len;
+
+	bnx2i_iscsi_prep_generic_pdu_bd(bnx2i_conn);
+	switch (task->hdr->opcode & ISCSI_OPCODE_MASK) {
+	case ISCSI_OP_LOGIN:
+		bnx2i_send_iscsi_login(bnx2i_conn, task);
+		break;
+	case ISCSI_OP_NOOP_OUT:
+		data_len = bnx2i_conn->gen_pdu.req_buf_size;
+		buf = bnx2i_conn->gen_pdu.req_buf;
+		if (data_len)
+			rc = bnx2i_send_iscsi_nopout(bnx2i_conn, task,
+						     ISCSI_RESERVED_TAG,
+						     buf, data_len, 1);
+		else
+			rc = bnx2i_send_iscsi_nopout(bnx2i_conn, task,
+						     ISCSI_RESERVED_TAG,
+						     NULL, 0, 1);
+		break;
+	case ISCSI_OP_LOGOUT:
+		rc = bnx2i_send_iscsi_logout(bnx2i_conn, task);
+		break;
+	case ISCSI_OP_SCSI_TMFUNC:
+		rc = bnx2i_send_iscsi_tmf(bnx2i_conn, task);
+		break;
+	default:
+		iscsi_conn_printk(KERN_ALERT, bnx2i_conn->cls_conn->dd_data,
+				  "send_gen: unsupported op 0x%x\n",
+				  task->hdr->opcode);
+	}
+	return rc;
+}
+
+
+/**********************************************************************
+ *		SCSI-ML Interface
+ **********************************************************************/
+
+/**
+ * bnx2i_cpy_scsi_cdb - copies LUN & CDB fields in required format to sq wqe
+ * @sc:		SCSI-ML command pointer
+ * @cmd:	iscsi cmd pointer
+ */
+static void bnx2i_cpy_scsi_cdb(struct scsi_cmnd *sc, struct bnx2i_cmd *cmd)
+{
+	u32 dword;
+	int lpcnt;
+	u8 *srcp;
+	u32 *dstp;
+	u32 scsi_lun[2];
+
+	int_to_scsilun(sc->device->lun, (struct scsi_lun *) scsi_lun);
+	cmd->req.lun[0] = be32_to_cpu(scsi_lun[0]);
+	cmd->req.lun[1] = be32_to_cpu(scsi_lun[1]);
+
+	lpcnt = cmd->scsi_cmd->cmd_len / sizeof(dword);
+	srcp = (u8 *) sc->cmnd;
+	dstp = (u32 *) cmd->req.cdb;
+	while (lpcnt--) {
+		memcpy(&dword, (const void *) srcp, 4);
+		*dstp = cpu_to_be32(dword);
+		srcp += 4;
+		dstp++;
+	}
+	if (sc->cmd_len & 0x3) {
+		dword = (u32) srcp[0] | ((u32) srcp[1] << 8);
+		*dstp = cpu_to_be32(dword);
+	}
+}
+
+static void bnx2i_cleanup_task(struct iscsi_conn *conn,
+			       struct iscsi_task *task)
+{
+	struct bnx2i_conn *bnx2i_conn = conn->dd_data;
+	struct bnx2i_hba *hba = bnx2i_conn->hba;
+
+	/*
+	 * mgmt task or cmd completed while tmf in progress.
+	 */
+	if (!task->sc)
+		return;
+	/*
+	 * ANIL
+	 * do we have to do this for other tmfs?
+	 */
+	if (conn->tmf_state == TMF_SUCCESS) {
+		bnx2i_send_cmd_cleanup_req(hba, task->dd_data);
+
+		spin_unlock_bh(&conn->session->lock);
+		wait_for_completion_timeout(&bnx2i_conn->cmd_cleanup_cmpl,
+				msecs_to_jiffies(ISCSI_CMD_CLEANUP_TIMEOUT));
+		spin_lock_bh(&conn->session->lock);
+		/*
+		 * ANIL
+		 * the original driver would free the cmd even if
+		 * we had not got a response yet. Is this ok?
+		 * We are also going to unmap the sg list. Is this ok?
+		 */
+	}
+	/*
+	 * check task again incase the command completed while we were
+	 * cleaning it up and session lock was dropped.
+	 */
+	if (!task->sc)
+		bnx2i_iscsi_unmap_sg_list(task->dd_data);
+}
+
+/**
+ * bnx2i_mtask_xmit - transmit mtask to chip for further processing
+ * @conn:	transport layer conn structure pointer
+ * @task:	transport layer command structure pointer
+ */
+static int
+bnx2i_mtask_xmit(struct iscsi_conn *conn, struct iscsi_task *task)
+{
+	struct bnx2i_conn *bnx2i_conn = conn->dd_data;
+	struct bnx2i_cmd *cmd = task->dd_data;
+
+	memset(bnx2i_conn->gen_pdu.req_buf, 0, ISCSI_DEF_MAX_RECV_SEG_LEN);
+
+	bnx2i_setup_cmd_wqe_template(cmd);
+	bnx2i_conn->gen_pdu.req_buf_size = task->data_count;
+	if (task->data_count) {
+		memcpy(bnx2i_conn->gen_pdu.req_buf, task->data,
+		       task->data_count);
+		bnx2i_conn->gen_pdu.req_wr_ptr =
+			bnx2i_conn->gen_pdu.req_buf + task->data_count;
+	}
+	cmd->conn = conn->dd_data;
+	cmd->scsi_cmd = NULL;
+	return bnx2i_iscsi_send_generic_request(task);
+}
+
+/**
+ * bnx2i_task_xmit - transmit iscsi command to chip for further processing
+ * @task:	transport layer command structure pointer
+ *
+ * maps SG buffers and send request to chip/firmware in the form of SQ WQE
+ */
+static int bnx2i_task_xmit(struct iscsi_task *task)
+{
+	struct iscsi_conn *conn = task->conn;
+	struct iscsi_session *session = conn->session;
+	struct Scsi_Host *shost = iscsi_session_to_shost(session->cls_session);
+	struct bnx2i_hba *hba = iscsi_host_priv(shost);
+	struct bnx2i_conn *bnx2i_conn = conn->dd_data;
+	struct scsi_cmnd *sc = task->sc;
+	struct bnx2i_cmd *cmd = task->dd_data;
+
+	if (test_bit(ADAPTER_STATE_LINK_DOWN, &hba->adapter_state))
+		return -ENOTCONN;
+
+	if (!bnx2i_conn->is_bound)
+		return -ENOTCONN;
+
+	/*
+	 * If there is no scsi_cmnd this must be a mgmt task
+	 */
+	if (!sc)
+		return bnx2i_mtask_xmit(conn, task);
+
+	bnx2i_setup_cmd_wqe_template(cmd);
+	cmd->req.op_code = ISCSI_OP_SCSI_CMD;
+	cmd->conn = bnx2i_conn;
+	cmd->scsi_cmd = sc;
+	cmd->req.total_data_transfer_length = scsi_bufflen(sc);
+	cmd->req.cmd_sn = be32_to_cpu(task->hdr->cmdsn);
+
+	bnx2i_iscsi_map_sg_list(cmd);
+	bnx2i_cpy_scsi_cdb(sc, cmd);
+
+	cmd->req.op_attr = ISCSI_ATTR_SIMPLE;
+	if (sc->sc_data_direction == DMA_TO_DEVICE) {
+		cmd->req.op_attr |= ISCSI_CMD_REQUEST_WRITE;
+		cmd->req.itt = task->itt |
+			(ISCSI_TASK_TYPE_WRITE << ISCSI_CMD_REQUEST_TYPE_SHIFT);
+		bnx2i_setup_write_cmd_bd_info(task);
+	} else {
+		if (scsi_bufflen(sc))
+			cmd->req.op_attr |= ISCSI_CMD_REQUEST_READ;
+		cmd->req.itt = task->itt |
+			(ISCSI_TASK_TYPE_READ << ISCSI_CMD_REQUEST_TYPE_SHIFT);
+	}
+
+	cmd->req.num_bds = cmd->io_tbl.bd_valid;
+	if (!cmd->io_tbl.bd_valid) {
+		cmd->req.bd_list_addr_lo = (u32) hba->mp_bd_dma;
+		cmd->req.bd_list_addr_hi = (u32) ((u64) hba->mp_bd_dma >> 32);
+		cmd->req.num_bds = 1;
+	}
+
+	bnx2i_send_iscsi_scsicmd(bnx2i_conn, cmd);
+	return 0;
+}
+
+/**
+ * bnx2i_session_create - create a new iscsi session
+ * @cmds_max:		max commands supported
+ * @qdepth:		scsi queue depth to support
+ * @initial_cmdsn:	initial iscsi CMDSN to be used for this session
+ * @host_no:		pointer to u32 to return host no
+ *
+ * Creates a new iSCSI session instance on given device.
+ */
+static struct iscsi_cls_session *
+bnx2i_session_create(struct iscsi_endpoint *ep,
+		     uint16_t cmds_max, uint16_t qdepth,
+		     uint32_t initial_cmdsn, uint32_t *host_no)
+{
+	struct Scsi_Host *shost;
+	struct iscsi_cls_session *cls_session;
+	struct bnx2i_hba *hba;
+	struct bnx2i_endpoint *bnx2i_ep;
+	if (!ep) {
+		printk(KERN_ERR "bnx2i: missing ep.\n");
+		return NULL;
+	}
+
+	bnx2i_ep = ep->dd_data;
+	shost = bnx2i_ep->hba->shost;
+	hba = iscsi_host_priv(shost);
+	if (bnx2i_adapter_ready(hba))
+		return NULL;
+	*host_no = shost->host_no;
+
+	/*
+	 * user can override hw limit as long as it is within
+	 * the min/max.
+	 */
+	if (cmds_max > hba->max_sqes)
+		cmds_max = hba->max_sqes;
+	else if (cmds_max < BNX2I_SQ_WQES_MIN)
+		cmds_max = BNX2I_SQ_WQES_MIN;
+
+	cls_session = iscsi_session_setup(&bnx2i_iscsi_transport, shost,
+					  cmds_max, sizeof(struct bnx2i_cmd),
+					  initial_cmdsn, ISCSI_MAX_TARGET);
+	if (!cls_session)
+		return NULL;
+
+	if (bnx2i_setup_cmd_pool(hba, cls_session->dd_data))
+		goto session_teardown;
+	return cls_session;
+
+session_teardown:
+	iscsi_session_teardown(cls_session);
+	return NULL;
+}
+
+
+/**
+ * bnx2i_session_destroy - destroys iscsi session
+ * @cls_session:	pointer to iscsi cls session
+ *
+ * Destroys previously created iSCSI session instance and releases
+ *	all resources held by it
+ */
+static void bnx2i_session_destroy(struct iscsi_cls_session *cls_session)
+{
+	struct iscsi_session *session = cls_session->dd_data;
+	struct Scsi_Host *shost = iscsi_session_to_shost(cls_session);
+	struct bnx2i_hba *hba = iscsi_host_priv(shost);
+
+	bnx2i_destroy_cmd_pool(hba, session);
+	iscsi_session_teardown(cls_session);
+}
+
+
+/**
+ * bnx2i_conn_create - create iscsi connection instance
+ * @cls_session:	pointer to iscsi cls session
+ * @cid:		iscsi cid as per rfc (not NX2's CID terminology)
+ *
+ * Creates a new iSCSI connection instance for a given session
+ */
+static struct iscsi_cls_conn *
+bnx2i_conn_create(struct iscsi_cls_session *cls_session, uint32_t cid)
+{
+	struct Scsi_Host *shost = iscsi_session_to_shost(cls_session);
+	struct bnx2i_hba *hba = iscsi_host_priv(shost);
+	struct bnx2i_conn *bnx2i_conn;
+	struct iscsi_cls_conn *cls_conn;
+	struct iscsi_conn *conn;
+
+	cls_conn = iscsi_conn_setup(cls_session, sizeof(*bnx2i_conn),
+				    cid);
+	if (!cls_conn)
+		return NULL;
+	conn = cls_conn->dd_data;
+
+	bnx2i_conn = conn->dd_data;
+	bnx2i_conn->cls_conn = cls_conn;
+	bnx2i_conn->hba = hba;
+	/* 'ep' ptr will be assigned in bind() call */
+	bnx2i_conn->ep = NULL;
+	bnx2i_conn->exp_statsn = BNX2I_STATSN_UPDATE_SIGNATURE;
+	init_completion(&bnx2i_conn->cmd_cleanup_cmpl);
+
+	if (bnx2i_conn_alloc_login_resources(hba, bnx2i_conn)) {
+		iscsi_conn_printk(KERN_ALERT, conn,
+				  "conn_new: login resc alloc failed!!\n");
+		goto free_conn;
+	}
+
+	return cls_conn;
+
+free_conn:
+	iscsi_conn_teardown(cls_conn);
+	return NULL;
+}
+
+/**
+ * bnx2i_conn_bind - binds iscsi sess, conn and ep objects together
+ * @cls_session:	pointer to iscsi cls session
+ * @cls_conn:		pointer to iscsi cls conn
+ * @transport_fd:	64-bit EP handle
+ * @is_leading:		leading connection on this session?
+ *
+ * Binds together iSCSI session instance, iSCSI connection instance
+ *	and the TCP connection. This routine returns error code if
+ *	TCP connection does not belong on the device iSCSI sess/conn
+ *	is bound
+ */
+static int bnx2i_conn_bind(struct iscsi_cls_session *cls_session,
+			   struct iscsi_cls_conn *cls_conn,
+			   uint64_t transport_fd, int is_leading)
+{
+	struct iscsi_conn *conn = cls_conn->dd_data;
+	struct bnx2i_conn *bnx2i_conn = conn->dd_data;
+	struct Scsi_Host *shost = iscsi_session_to_shost(cls_session);
+	struct bnx2i_hba *hba = iscsi_host_priv(shost);
+	struct bnx2i_endpoint *bnx2i_ep;
+	struct iscsi_endpoint *ep;
+
+	ep = iscsi_lookup_endpoint(transport_fd);
+	if (!ep)
+		return -EINVAL;
+
+	bnx2i_ep = ep->dd_data;
+	if ((bnx2i_ep->state == EP_STATE_TCP_FIN_RCVD) ||
+	    (bnx2i_ep->state == EP_STATE_TCP_RST_RCVD))
+		/* Peer disconnect via' FIN or RST */
+		return -EINVAL;
+
+	if (iscsi_conn_bind(cls_session, cls_conn, is_leading))
+		return -EINVAL;
+
+	if (bnx2i_ep->hba != hba) {
+		/* Error - TCP connection does not belong to this device
+		 */
+		iscsi_conn_printk(KERN_ALERT, cls_conn->dd_data,
+				  "conn bind, ep=0x%p (%s) does not",
+				  bnx2i_ep, bnx2i_ep->hba->netdev->name);
+		iscsi_conn_printk(KERN_ALERT, cls_conn->dd_data,
+				  "belong to hba (%s)\n",
+				  hba->netdev->name);
+		return -EEXIST;
+	}
+
+	bnx2i_ep->conn = bnx2i_conn;
+	bnx2i_conn->ep = bnx2i_ep;
+	bnx2i_conn->iscsi_conn_cid = bnx2i_ep->ep_iscsi_cid;
+	bnx2i_conn->fw_cid = bnx2i_ep->ep_cid;
+	bnx2i_conn->is_bound = 1;
+
+	return bnx2i_bind_conn_to_iscsi_cid(hba, bnx2i_conn,
+					    bnx2i_ep->ep_iscsi_cid);
+}
+
+
+/**
+ * bnx2i_conn_destroy - destroy iscsi connection instance & release resources
+ * @cls_conn:	pointer to iscsi cls conn
+ *
+ * Destroy an iSCSI connection instance and release memory resources held by
+ *	this connection
+ */
+static void bnx2i_conn_destroy(struct iscsi_cls_conn *cls_conn)
+{
+	struct iscsi_conn *conn = cls_conn->dd_data;
+	struct bnx2i_conn *bnx2i_conn = conn->dd_data;
+	struct Scsi_Host *shost;
+	struct bnx2i_hba *hba;
+
+	shost = iscsi_session_to_shost(iscsi_conn_to_session(cls_conn));
+	hba = iscsi_host_priv(shost);
+
+	bnx2i_conn_free_login_resources(hba, bnx2i_conn);
+	iscsi_conn_teardown(cls_conn);
+}
+
+
+/**
+ * bnx2i_conn_get_param - return iscsi connection parameter to caller
+ * @cls_conn:	pointer to iscsi cls conn
+ * @param:	parameter type identifier
+ * @buf: 	buffer pointer
+ *
+ * returns iSCSI connection parameters
+ */
+static int bnx2i_conn_get_param(struct iscsi_cls_conn *cls_conn,
+				enum iscsi_param param, char *buf)
+{
+	struct iscsi_conn *conn = cls_conn->dd_data;
+	struct bnx2i_conn *bnx2i_conn = conn->dd_data;
+	int len = 0;
+
+	switch (param) {
+	case ISCSI_PARAM_CONN_PORT:
+		if (bnx2i_conn->ep)
+			len = sprintf(buf, "%hu\n",
+				      bnx2i_conn->ep->cm_sk->dst_port);
+		break;
+	case ISCSI_PARAM_CONN_ADDRESS:
+		if (bnx2i_conn->ep)
+			len = sprintf(buf, NIPQUAD_FMT "\n",
+				      NIPQUAD(bnx2i_conn->ep->cm_sk->dst_ip));
+		break;
+	default:
+		return iscsi_conn_get_param(cls_conn, param, buf);
+	}
+
+	return len;
+}
+
+
+static ssize_t format_addr(char *buf, const unsigned char *addr, int len)
+{
+	int i;
+	char *cp = buf;
+
+	for (i = 0; i < len; i++)
+		cp += sprintf(cp, "%02x%c", addr[i],
+			      i == (len - 1) ? '\n' : ':');
+	return cp - buf;
+}
+
+
+/**
+ * bnx2i_host_get_param - returns host (adapter) related parameters
+ * @shost:	scsi host pointer
+ * @param:	parameter type identifier
+ * @buf:	buffer pointer
+ */
+static int bnx2i_host_get_param(struct Scsi_Host *shost,
+				enum iscsi_host_param param, char *buf)
+{
+	struct bnx2i_hba *hba = iscsi_host_priv(shost);
+	int len = 0;
+
+	switch (param) {
+	case ISCSI_HOST_PARAM_HWADDRESS:
+		len = format_addr(buf, hba->mac_addr, 6);
+		break;
+	case ISCSI_HOST_PARAM_NETDEV_NAME:
+		len = sprintf(buf, "%s\n", hba->netdev->name);
+		break;
+	default:
+		return iscsi_host_get_param(shost, param, buf);
+	}
+	return len;
+}
+
+
+/**
+ * bnx2i_conn_start - completes iscsi connection migration to FFP
+ * @cls_conn:	pointer to iscsi cls conn
+ *
+ * last call in FFP migration to handover iscsi conn to the driver
+ */
+static int bnx2i_conn_start(struct iscsi_cls_conn *cls_conn)
+{
+	struct iscsi_conn *conn = cls_conn->dd_data;
+	struct bnx2i_conn *bnx2i_conn = conn->dd_data;
+
+	bnx2i_conn->ep->state = EP_STATE_ULP_UPDATE_START;
+	bnx2i_update_iscsi_conn(conn);
+
+	/*
+	 * this should normally not sleep for a long time so it should
+	 * not disrupt the caller.
+	 */
+	bnx2i_conn->ep->ofld_timer.expires = 1 * HZ + jiffies;
+	bnx2i_conn->ep->ofld_timer.function = bnx2i_ep_ofld_timer;
+	bnx2i_conn->ep->ofld_timer.data = (unsigned long) bnx2i_conn->ep;
+	add_timer(&bnx2i_conn->ep->ofld_timer);
+	/* update iSCSI context for this conn, wait for CNIC to complete */
+	wait_event_interruptible(bnx2i_conn->ep->ofld_wait,
+			bnx2i_conn->ep->state != EP_STATE_ULP_UPDATE_START);
+
+	if (signal_pending(current))
+		flush_signals(current);
+	del_timer_sync(&bnx2i_conn->ep->ofld_timer);
+
+	iscsi_conn_start(cls_conn);
+	return 0;
+}
+
+
+/**
+ * bnx2i_conn_get_stats - returns iSCSI stats
+ * @cls_conn:	pointer to iscsi cls conn
+ * @stats:	pointer to iscsi statistic struct
+ */
+static void bnx2i_conn_get_stats(struct iscsi_cls_conn *cls_conn,
+				 struct iscsi_stats *stats)
+{
+	struct iscsi_conn *conn = cls_conn->dd_data;
+
+	stats->txdata_octets = conn->txdata_octets;
+	stats->rxdata_octets = conn->rxdata_octets;
+	stats->scsicmd_pdus = conn->scsicmd_pdus_cnt;
+	stats->dataout_pdus = conn->dataout_pdus_cnt;
+	stats->scsirsp_pdus = conn->scsirsp_pdus_cnt;
+	stats->datain_pdus = conn->datain_pdus_cnt;
+	stats->r2t_pdus = conn->r2t_pdus_cnt;
+	stats->tmfcmd_pdus = conn->tmfcmd_pdus_cnt;
+	stats->tmfrsp_pdus = conn->tmfrsp_pdus_cnt;
+	stats->custom_length = 3;
+	strcpy(stats->custom[2].desc, "eh_abort_cnt");
+	stats->custom[2].value = conn->eh_abort_cnt;
+	stats->digest_err = 0;
+	stats->timeout_err = 0;
+	stats->custom_length = 0;
+}
+
+
+
+/**
+ * bnx2i_check_nx2_dev_busy - this routine unregister devices.
+ *
+ * This should only unregister if there are no active conns.
+ */
+void bnx2i_check_nx2_dev_busy(void)
+{
+	bnx2i_unreg_dev_all();
+}
+
+
+/**
+ * bnx2i_check_route - checks if target IP route belongs to one of NX2 devices
+ * @dst_addr:	target IP address
+ *
+ * check if route resolves to BNX2 device
+ */
+static struct bnx2i_hba *bnx2i_check_route(struct sockaddr *dst_addr)
+{
+	struct sockaddr_in *desti = (struct sockaddr_in *) dst_addr;
+	struct bnx2i_hba *hba;
+	struct cnic_dev *cnic = NULL;
+
+	bnx2i_reg_dev_all();
+
+	hba = get_adapter_list_head();
+	if (hba && hba->cnic)
+		cnic = hba->cnic->cm_select_dev(desti, CNIC_ULP_ISCSI);
+	if (!cnic) {
+		printk(KERN_ALERT "bnx2i: check route, can't connect using cnic\n");
+		goto no_nx2_route;
+	}
+	hba = bnx2i_find_hba_for_cnic(cnic);
+	if (!hba) {
+		goto no_nx2_route;
+	}
+
+	if (bnx2i_adapter_ready(hba)) {
+		printk(KERN_ALERT "bnx2i: check route, hba not found\n");
+		goto no_nx2_route;
+	}
+	if (hba->netdev->mtu > hba->mtu_supported) {
+		printk(KERN_ALERT "bnx2i: %s network i/f mtu is set to %d\n",
+				  hba->netdev->name, hba->netdev->mtu);
+		printk(KERN_ALERT "bnx2i: iSCSI HBA can support mtu of %d\n",
+				  hba->mtu_supported);
+		goto no_nx2_route;
+	}
+	return hba;
+no_nx2_route:
+	return NULL;
+}
+
+
+/**
+ * bnx2i_tear_down_conn - tear down iscsi/tcp connection and free resources
+ * @hba:	pointer to adapter instance
+ * @ep:		endpoint (transport indentifier) structure
+ *
+ * destroys cm_sock structure and on chip iscsi context
+ */
+static void bnx2i_tear_down_conn(struct bnx2i_hba *hba,
+				 struct bnx2i_endpoint *ep)
+{
+	if (test_bit(BNX2I_CNIC_REGISTERED, &hba->reg_with_cnic))
+		hba->cnic->cm_destroy(ep->cm_sk);
+
+	ep->state = EP_STATE_CLEANUP_START;
+	init_timer(&ep->ofld_timer);
+	ep->ofld_timer.expires = 10*HZ + jiffies;
+	ep->ofld_timer.function = bnx2i_ep_ofld_timer;
+	ep->ofld_timer.data = (unsigned long) ep;
+	add_timer(&ep->ofld_timer);
+
+	bnx2i_ep_destroy_list_add(hba, ep);
+
+	/* destroy iSCSI context, wait for it to complete */
+	bnx2i_send_conn_destroy(hba, ep);
+	wait_event_interruptible(ep->ofld_wait,
+				 (ep->state != EP_STATE_CLEANUP_START));
+
+	if (signal_pending(current))
+		flush_signals(current);
+	del_timer_sync(&ep->ofld_timer);
+	if (ep->state != EP_STATE_CLEANUP_CMPL)
+		/* should never happen */
+		printk(KERN_ALERT "bnx2i - conn destroy failed\n");
+}
+
+
+/**
+ * bnx2i_ep_connect - establish TCP connection to target portal
+ * @dst_addr:		target IP address
+ * @non_blocking:	blocking or non-blocking call
+ *
+ * this routine initiates the TCP/IP connection by invoking Option-2 i/f
+ *	with l5_core and the CNIC. This is a multi-step process of resolving
+ *	route to target, create a iscsi connection context, handshaking with
+ *	CNIC module to create/initialize the socket struct and finally
+ *	sending down option-2 request to complete TCP 3-way handshake
+ */
+static struct iscsi_endpoint *bnx2i_ep_connect(struct sockaddr *dst_addr,
+					       int non_blocking)
+{
+	u32 iscsi_cid = BNX2I_CID_RESERVED;
+	struct sockaddr_in *desti;
+	struct sockaddr_in6 *desti6;
+	struct bnx2i_endpoint *bnx2i_ep;
+	struct bnx2i_hba *hba;
+	struct cnic_dev *cnic;
+	struct cnic_sockaddr saddr;
+	struct iscsi_endpoint *ep;
+	int rc = 0;
+
+	/*
+	 * check if the given destination can be reached through NX2 device
+	 */
+
+	hba = bnx2i_check_route(dst_addr);
+	if (!hba) {
+		rc = -ENOMEM;
+		goto check_busy;
+	}
+
+	cnic = hba->cnic;
+	ep = bnx2i_alloc_ep(hba);
+	if (!ep) {
+		rc = -ENOMEM;
+		goto check_busy;
+	}
+	bnx2i_ep = ep->dd_data;
+
+	bnx2i_ep->state = EP_STATE_IDLE;
+	bnx2i_ep->ep_iscsi_cid = (u16)ISCSI_RESERVED_TAG;
+	iscsi_cid = bnx2i_alloc_iscsi_cid(hba);
+	if (iscsi_cid == (u16) ISCSI_RESERVED_TAG) {
+		printk(KERN_ALERT "alloc_ep: unable to allocate iscsi cid\n");
+		rc = -ENOMEM;
+		goto iscsi_cid_err;
+	}
+	bnx2i_ep->hba_age = hba->age;
+
+	rc = bnx2i_alloc_qp_resc(hba, bnx2i_ep);
+	if (rc != 0) {
+		printk(KERN_ALERT "bnx2i: ep_conn, alloc QP resc error\n");
+		rc = -ENOMEM;
+		goto qp_resc_err;
+	}
+
+	bnx2i_ep->ep_iscsi_cid = iscsi_cid;
+	bnx2i_ep->state = EP_STATE_OFLD_START;
+	bnx2i_ep_ofld_list_add(hba, bnx2i_ep);
+
+	bnx2i_send_conn_ofld_req(hba, bnx2i_ep);
+
+	init_timer(&bnx2i_ep->ofld_timer);
+	bnx2i_ep->ofld_timer.expires = 2 * HZ + jiffies;
+	bnx2i_ep->ofld_timer.function = bnx2i_ep_ofld_timer;
+	bnx2i_ep->ofld_timer.data = (unsigned long) bnx2i_ep;
+	add_timer(&bnx2i_ep->ofld_timer);
+	/* Wait for CNIC hardware to setup conn context and return 'cid' */
+	wait_event_interruptible(bnx2i_ep->ofld_wait,
+				 bnx2i_ep->state != EP_STATE_OFLD_START);
+
+	if (signal_pending(current))
+		flush_signals(current);
+	del_timer_sync(&bnx2i_ep->ofld_timer);
+	list_del_init(&bnx2i_ep->link);
+
+	if (bnx2i_ep->state != EP_STATE_OFLD_COMPL) {
+		rc = -ENOSPC;
+		goto conn_failed;
+	}
+
+	if (!test_bit(BNX2I_CNIC_REGISTERED, &hba->reg_with_cnic)) {
+		rc = -EINVAL;
+		goto conn_failed;
+	} else
+		rc = cnic->cm_create(cnic, CNIC_ULP_ISCSI, bnx2i_ep->ep_cid,
+				     iscsi_cid, &bnx2i_ep->cm_sk, bnx2i_ep);
+	if (rc) {
+		rc = -EINVAL;
+		goto conn_failed;
+	}
+
+	memset(&saddr, 0, sizeof(saddr));
+
+	if (dst_addr->sa_family == AF_INET) {
+		desti = (struct sockaddr_in *) dst_addr;
+		saddr.remote.v4 = *desti;
+		saddr.local.v4.sin_port = cpu_to_le16(bnx2i_ep->tcp_port);
+		saddr.local.v4.sin_family = desti->sin_family;
+	} else if (dst_addr->sa_family == AF_INET6) {
+		desti6 = (struct sockaddr_in6 *) dst_addr;
+		saddr.remote.v6 = *desti6;
+		saddr.local.v6.sin6_port = cpu_to_le16(bnx2i_ep->tcp_port);
+		saddr.local.v6.sin6_family = desti6->sin6_family;
+	}
+
+	bnx2i_ep->state = EP_STATE_CONNECT_START;
+	if (!test_bit(BNX2I_CNIC_REGISTERED, &hba->reg_with_cnic)) {
+		rc = -EINVAL;
+		goto conn_failed;
+	} else
+		rc = cnic->cm_connect(bnx2i_ep->cm_sk, &saddr);
+
+	if (rc)
+		goto release_ep;
+
+	if (bnx2i_map_ep_dbell_regs(bnx2i_ep))
+		goto release_ep;
+	return ep;
+
+release_ep:
+	bnx2i_tear_down_conn(hba, bnx2i_ep);
+conn_failed:
+iscsi_cid_err:
+	bnx2i_free_qp_resc(hba, bnx2i_ep);
+qp_resc_err:
+	bnx2i_free_ep(ep);
+check_busy:
+	bnx2i_check_nx2_dev_busy();
+	return ERR_PTR(rc);
+}
+
+
+/**
+ * bnx2i_ep_poll - polls for TCP connection establishement
+ * @ep:			TCP connection (endpoint) handle
+ * @timeout_ms:		timeout value in milli secs
+ *
+ * polls for TCP connect request to complete
+ */
+static int bnx2i_ep_poll(struct iscsi_endpoint *ep, int timeout_ms)
+{
+	struct bnx2i_endpoint *bnx2i_ep;
+	int rc = 0;
+
+	bnx2i_ep = ep->dd_data;
+	if (bnx2i_ep->state == EP_STATE_IDLE)
+		return -1;
+	if (bnx2i_ep->state == EP_STATE_CONNECT_COMPL)
+		return 1;
+
+	rc = wait_event_interruptible_timeout(bnx2i_ep->ofld_wait,
+					      (bnx2i_ep->state ==
+					       EP_STATE_CONNECT_COMPL),
+					      msecs_to_jiffies(timeout_ms));
+	if (!rc || (bnx2i_ep->state == EP_STATE_OFLD_FAILED))
+		rc = -1;
+
+	if (rc > 0)
+		return 1;
+	else if (!rc)
+		return 0;	/* timeout */
+	else
+		return rc;
+}
+
+
+/**
+ * bnx2i_ep_disconnect - executes TCP connection teardown process
+ * @ep:		TCP connection (endpoint) handle
+ *
+ * executes  TCP connection teardown process
+ */
+static void bnx2i_ep_disconnect(struct iscsi_endpoint *ep)
+{
+	struct bnx2i_endpoint *bnx2i_ep;
+	struct bnx2i_conn *bnx2i_conn = NULL;
+	struct iscsi_session *session = NULL;
+	struct iscsi_conn *conn;
+	struct cnic_dev *cnic;
+	struct bnx2i_hba *hba;
+
+	bnx2i_ep = ep->dd_data;
+	if (bnx2i_ep->conn) {
+		bnx2i_conn = bnx2i_ep->conn;
+		conn = bnx2i_conn->cls_conn->dd_data;
+		session = conn->session;
+
+		spin_lock_bh(&session->lock);
+		bnx2i_conn->is_bound = 0;
+		spin_unlock_bh(&session->lock);
+	}
+
+	hba = bnx2i_ep->hba;
+	if (bnx2i_ep->state == EP_STATE_IDLE)
+		goto return_bnx2i_ep;
+	cnic = hba->cnic;
+
+	if (bnx2i_ep->state == EP_STATE_TCP_RST_RCVD) {
+		bnx2i_ep->state = EP_STATE_DISCONN_COMPL;
+		goto peer_reset;
+	}
+
+	if (!test_bit(ADAPTER_STATE_UP, &hba->adapter_state))
+		goto free_resc;
+	if (bnx2i_ep->hba_age != hba->age)
+		goto free_resc;
+
+	bnx2i_ep->state = EP_STATE_DISCONN_START;
+
+	init_timer(&bnx2i_ep->ofld_timer);
+	bnx2i_ep->ofld_timer.expires = 10*HZ + jiffies;
+	bnx2i_ep->ofld_timer.function = bnx2i_ep_ofld_timer;
+	bnx2i_ep->ofld_timer.data = (unsigned long) bnx2i_ep;
+	add_timer(&bnx2i_ep->ofld_timer);
+
+	if (test_bit(BNX2I_CNIC_REGISTERED, &hba->reg_with_cnic)) {
+		int close = 0;
+
+		if (session) {
+			spin_lock_bh(&session->lock);
+			if (session->state == ISCSI_STATE_LOGGING_OUT)
+				close = 1;
+			spin_unlock_bh(&session->lock);
+		}
+		if (close)
+			cnic->cm_close(bnx2i_ep->cm_sk);
+		else
+			cnic->cm_abort(bnx2i_ep->cm_sk);
+	} else
+		goto free_resc;
+
+	/* wait for option-2 conn teardown */
+	wait_event_interruptible(bnx2i_ep->ofld_wait,
+				 bnx2i_ep->state != EP_STATE_DISCONN_START);
+
+	if (signal_pending(current))
+		flush_signals(current);
+	del_timer_sync(&bnx2i_ep->ofld_timer);
+
+peer_reset:
+	bnx2i_tear_down_conn(hba, bnx2i_ep);
+free_resc:
+	bnx2i_free_qp_resc(hba, bnx2i_ep);
+return_bnx2i_ep:
+	if (bnx2i_conn)
+		bnx2i_conn->ep = NULL;
+	bnx2i_free_ep(ep);
+	bnx2i_check_nx2_dev_busy();
+}
+
+
+/*
+ * 'Scsi_Host_Template' structure and 'iscsi_tranport' structure template
+ * used while registering with the scsi host and iSCSI transport module.
+ */
+static struct scsi_host_template bnx2i_host_template = {
+	.module			= THIS_MODULE,
+	.name			= "Broadcom Offload iSCSI Initiator",
+	.proc_name		= "bnx2i",
+	.queuecommand		= iscsi_queuecommand,
+	.slave_alloc		= iscsi_slave_alloc,
+	.eh_abort_handler	= iscsi_eh_abort,
+/*
+ * Anil
+ * uncomment this when we know if we need to do a
+ * ISCSI_OPCODE_CLEANUP_REQUEST on tasks that are affected by
+ * the lu reset.
+	.eh_device_reset_handler = iscsi_eh_device_reset,
+*/
+	.eh_target_reset_handler = iscsi_eh_target_reset,
+	/* TODO - just make this the max sessions * max_cmds_per_session */
+	.can_queue		= 1024,
+	.max_sectors		= 127,
+	.cmd_per_lun		= 32,
+	.this_id		= -1,
+	.use_clustering		= ENABLE_CLUSTERING,
+	.sg_tablesize		= ISCSI_MAX_BDS_PER_CMD,
+	.shost_attrs		= bnx2i_dev_attributes,
+};
+
+struct iscsi_transport bnx2i_iscsi_transport = {
+	.owner			= THIS_MODULE,
+	.name			= "bnx2i",
+	.caps			= CAP_RECOVERY_L0 | CAP_HDRDGST |
+				  CAP_MULTI_R2T | CAP_DATADGST |
+				  CAP_DATA_PATH_OFFLOAD,
+	.param_mask		= ISCSI_MAX_RECV_DLENGTH |
+				  ISCSI_MAX_XMIT_DLENGTH |
+				  ISCSI_HDRDGST_EN |
+				  ISCSI_DATADGST_EN |
+				  ISCSI_INITIAL_R2T_EN |
+				  ISCSI_MAX_R2T |
+				  ISCSI_IMM_DATA_EN |
+				  ISCSI_FIRST_BURST |
+				  ISCSI_MAX_BURST |
+				  ISCSI_PDU_INORDER_EN |
+				  ISCSI_DATASEQ_INORDER_EN |
+				  ISCSI_ERL |
+				  ISCSI_CONN_PORT |
+				  ISCSI_CONN_ADDRESS |
+				  ISCSI_EXP_STATSN |
+				  ISCSI_PERSISTENT_PORT |
+				  ISCSI_PERSISTENT_ADDRESS |
+				  ISCSI_TARGET_NAME | ISCSI_TPGT |
+				  ISCSI_USERNAME | ISCSI_PASSWORD |
+				  ISCSI_USERNAME_IN | ISCSI_PASSWORD_IN |
+				  ISCSI_FAST_ABORT | ISCSI_ABORT_TMO |
+				  ISCSI_LU_RESET_TMO |
+				  ISCSI_PING_TMO | ISCSI_RECV_TMO |
+				  ISCSI_IFACE_NAME | ISCSI_INITIATOR_NAME,
+	.host_param_mask	= ISCSI_HOST_HWADDRESS | ISCSI_HOST_NETDEV_NAME,
+	.create_session		= bnx2i_session_create,
+	.destroy_session	= bnx2i_session_destroy,
+	.create_conn		= bnx2i_conn_create,
+	.bind_conn		= bnx2i_conn_bind,
+	.destroy_conn		= bnx2i_conn_destroy,
+	.set_param		= iscsi_set_param,
+	.get_conn_param		= bnx2i_conn_get_param,
+	.get_session_param	= iscsi_session_get_param,
+	.get_host_param		= bnx2i_host_get_param,
+	.start_conn		= bnx2i_conn_start,
+	.stop_conn		= iscsi_conn_stop,
+	.send_pdu		= iscsi_conn_send_pdu,
+	.xmit_task		= bnx2i_task_xmit,
+	.get_stats		= bnx2i_conn_get_stats,
+	/* TCP connect - disconnect - option-2 interface calls */
+	.ep_connect		= bnx2i_ep_connect,
+	.ep_poll		= bnx2i_ep_poll,
+	.ep_disconnect		= bnx2i_ep_disconnect,
+	/* Error recovery timeout call */
+	.session_recovery_timedout = iscsi_session_recovery_timedout,
+	.cleanup_task		= bnx2i_cleanup_task,
+};
diff --git a/drivers/scsi/bnx2i/bnx2i_sysfs.c b/drivers/scsi/bnx2i/bnx2i_sysfs.c
new file mode 100644
index 0000000..5b34316
--- /dev/null
+++ b/drivers/scsi/bnx2i/bnx2i_sysfs.c
@@ -0,0 +1,168 @@
+/* bnx2i_sysfs.c: Broadcom NetXtreme II iSCSI driver.
+ *
+ * Copyright (c) 2004 - 2008 Broadcom Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation.
+ *
+ * Written by: Anil Veerabhadrappa (anilgv-dY08KVG/lbpWk0Htik3J/w@public.gmane.org)
+ */
+
+#include "bnx2i.h"
+
+/**
+ * bnx2i_dev_to_hba - maps class dev pointer to adapter struct
+ * @dev:	class device pointer
+ *
+ * Map class device to hba structure
+ */
+static inline struct bnx2i_hba *bnx2i_dev_to_hba(struct device *dev)
+{
+	struct Scsi_Host *shost = class_to_shost(dev);
+	return iscsi_host_priv(shost);
+}
+
+
+/**
+ * bnx2i_show_sq_info - return(s currently configured send queue (SQ) size
+ * @dev:	class device pointer
+ * @buf:	buffer to return current SQ size parameter
+ *
+ * Returns current SQ size parameter, this paramater determines the number
+ * outstanding iSCSI commands supported on a connection
+ */
+static ssize_t bnx2i_show_sq_info(struct device *dev,
+				  struct device_attribute *attr, char *buf)
+{
+	struct bnx2i_hba *hba = bnx2i_dev_to_hba(dev);
+
+	return sprintf(buf, "0x%x\n", hba->max_sqes);
+}
+
+
+/**
+ * bnx2i_set_sq_info - update send queue (SQ) size parameter
+ * @dev:	class device pointer
+ * @buf:	buffer to return current SQ size parameter
+ * @count:	parameter buffer size
+ *
+ * Interface for user to change shared queue size allocated for each conn
+ * Must be within SQ limits and a power of 2. For the latter this is needed
+ * because of how libiscsi preallocates tasks.
+ */
+static ssize_t bnx2i_set_sq_info(struct device *dev,
+				 struct device_attribute *attr,
+				 const char *buf, size_t count)
+{
+	struct bnx2i_hba *hba = bnx2i_dev_to_hba(dev);
+	u32 val;
+
+	if (sscanf(buf, " 0x%x ", &val) > 0) {
+		if ((val >= BNX2I_SQ_WQES_MIN) &&
+		    (val <= BNX2I_SQ_WQES_MAX) &&
+		    (is_power_of_2(val)))
+			hba->max_sqes = val;
+	}
+	return count;
+}
+
+
+/**
+ * bnx2i_show_ccell_info - returns command cell (HQ) size
+ * @dev:	class device pointer
+ * @buf:	buffer to return current SQ size parameter
+ *
+ * returns per-connection TCP history queue size parameter
+ */
+static ssize_t bnx2i_show_ccell_info(struct device *dev,
+				     struct device_attribute *attr, char *buf)
+{
+	struct bnx2i_hba *hba = bnx2i_dev_to_hba(dev);
+
+	return sprintf(buf, "0x%x\n", hba->num_ccell);
+}
+
+
+/**
+ * bnx2i_get_link_state - set command cell (HQ) size
+ * @dev:	class device pointer
+ * @buf:	buffer to return current SQ size parameter
+ * @count:	parameter buffer size
+ *
+ * updates per-connection TCP history queue size parameter
+ */
+static ssize_t bnx2i_set_ccell_info(struct device *dev,
+				    struct device_attribute *attr,
+				    const char *buf, size_t count)
+{
+	u32 val;
+	struct bnx2i_hba *hba = bnx2i_dev_to_hba(dev);
+
+	if (sscanf(buf, " 0x%x ", &val) > 0) {
+		if ((val >= BNX2I_CCELLS_MIN) &&
+		    (val <= BNX2I_CCELLS_MAX)) {
+			hba->num_ccell = val;
+		}
+	}
+	return count;
+}
+
+
+/**
+ * bnx2i_read_tcp_portd_options - returns number of tcp port to be allocated
+ * @dev:	class device pointer
+ * @buf:	buffer to return current SQ size parameter
+ *
+ * Interface between user daemon and driver inorder to reserve tcp ports.
+ */
+static ssize_t bnx2i_read_tcp_portd_options(struct device *dev,
+					    struct device_attribute *attr,
+					    char *buf)
+{
+	extern struct tcp_port_mngt bnx2i_tcp_port_tbl;
+	return sprintf(buf, "0x%x\n", bnx2i_tcp_port_tbl.num_required);
+}
+
+
+/**
+ * bnx2i_write_tcp_portd_results - assign newly allocated TCP ports to driver
+ * @dev:	class device pointer
+ * @buf:	buffer to return current SQ size parameter
+ * @count:	parameter buffer size
+ *
+ * Interface between user daemon and driver inorder to reserve tcp ports.
+ */
+static ssize_t bnx2i_write_tcp_portd_results(struct device *dev,
+					     struct device_attribute *attr,
+					     const char *buf, size_t count)
+{
+	extern struct tcp_port_mngt bnx2i_tcp_port_tbl;
+	u32 tcp_port, bind_stat;
+
+	if (!bnx2i_tcp_port_tbl.free_q)
+		return count;
+
+	if (sscanf(buf, "%d,%d", &tcp_port, &bind_stat) > 0) {
+		if (bind_stat && tcp_port) {
+			bnx2i_tcp_port_new_entry(tcp_port);
+		}
+	}
+	return count;
+}
+
+
+static DEVICE_ATTR(sq_size, S_IRUGO | S_IWUSR,
+		   bnx2i_show_sq_info, bnx2i_set_sq_info);
+static DEVICE_ATTR(num_ccell, S_IRUGO | S_IWUSR,
+		   bnx2i_show_ccell_info, bnx2i_set_ccell_info);
+static DEVICE_ATTR(port_bind, S_IRUGO | S_IWUSR, bnx2i_read_tcp_portd_options,
+		   bnx2i_write_tcp_portd_results);
+
+
+struct device_attribute *bnx2i_dev_attributes[] = {
+	&dev_attr_port_bind,
+	&dev_attr_sq_size,
+	&dev_attr_num_ccell,
+	NULL
+};
-- 
1.5.5.GIT

Re: [PATCH 3/3] bnx2i: Add bnx2i iSCSI driver.

[Konrad Rzeszutek]

A cursory glance..

.. snip..
> +struct bnx2i_cleanup_request {
> +#if defined(__BIG_ENDIAN)
> +	u8 op_code;
> +	u8 reserved1;
> +	u16 reserved0;
> +#elif defined(__LITTLE_ENDIAN)
> +	u16 reserved0;
> +	u8 reserved1;
> +	u8 op_code;
> +#endif
> +	u32 reserved2[3];
> +#if defined(__BIG_ENDIAN)
> +	u16 reserved3;
> +	u16 itt;
> +#define ISCSI_CLEANUP_REQUEST_INDEX (0x3FFF<<0)
> +#define ISCSI_CLEANUP_REQUEST_INDEX_SHIFT 0
> +#define ISCSI_CLEANUP_REQUEST_TYPE (0x3<<14)
> +#define ISCSI_CLEANUP_REQUEST_TYPE_SHIFT 14
> +#elif defined(__LITTLE_ENDIAN)
> +	u16 itt;
> +#define ISCSI_CLEANUP_REQUEST_INDEX (0x3FFF<<0)
> +#define ISCSI_CLEANUP_REQUEST_INDEX_SHIFT 0
> +#define ISCSI_CLEANUP_REQUEST_TYPE (0x3<<14)
> +#define ISCSI_CLEANUP_REQUEST_TYPE_SHIFT 14
> +	u16 reserved3;
> +#endif


Why the duplication of the #define values? They look the same.


.. snip ..
> +/*
> + * mnc - lookup Jeff Garzack's rule about defining this

Has this TODO been completed?

> + * type of junk. Base on enum and make it less error prone.
> + *	Anil - these are bit masks, won't enum be little ugly?
> + */
.. snip ..

> + * bnx2i_iscsi_license_error - displays iscsi license related error message

Doesn't look very license related. Just says 'not supported'.

> + * @hba:		adapter instance pointer
> + * @error_code:		error classification
> + *
> + * Puts out an error log when driver is unable to offload iscsi connection
> + *	due to license restrictions

Maybe adding in some extra information to the error, such as: "Due to
GPL restrictions, etc.." .. What does 'LOM' stand for?

> + */
> +static void bnx2i_iscsi_license_error(struct bnx2i_hba *hba, u32 error_code)
> +{
> +	if (error_code == ISCSI_KCQE_COMPLETION_STATUS_ISCSI_NOT_SUPPORTED)
> +		/* iSCSI offload not supported on this device */
> +		printk(KERN_ERR "bnx2i: iSCSI not supported, dev=%s\n",
> +				hba->netdev->name);
> +	if (error_code == ISCSI_KCQE_COMPLETION_STATUS_LOM_ISCSI_NOT_ENABLED)
> +		/* iSCSI offload not supported on this LOM device */
> +		printk(KERN_ERR "bnx2i: LOM is not enable to "
                                            ^^^^-enabled.
> +				"offload iSCSI connections, dev=%s\n",
> +				hba->netdev->name);
> +	set_bit(ADAPTER_STATE_INIT_FAILED, &hba->adapter_state);
> +}
> +
> +#ifdef _EVENT_COALESCE_
> +#define CNIC_ARM_CQE			1
> +#define CNIC_DISARM_CQE			0
> +extern unsigned int event_coal_div;
> +
> +/**
> + * bnx2i_arm_cq_event_coalescing - arms CQ to enable EQ notification
> + * @ep:		endpoint (transport indentifier) structure
> + * @action:	action, ARM or DISARM. For now only ARM_CQE is used
> + *
> + * Arm'ing CQ will enable chip to generate global EQ events inorder to interrupt
> + *	the driver. EQ event is generated CQ index is hit or at least 1 CQ is
> + *	outstanding and on chip timer expires
> + */
> +static void bnx2i_arm_cq_event_coalescing(struct bnx2i_endpoint *ep, u8 action)
> +{
> +	u16 cq_index;
> +	if ((action == CNIC_ARM_CQE) && ep->sess) {
> +		cq_index = ep->qp.cqe_exp_seq_sn +
> +			   ep->sess->num_active_cmds / event_coal_div;
> +		cq_index %= (ep->qp.cqe_size * 2 + 1);
> +		if (!cq_index)
> +			cq_index = 1;
> +		writew(cq_index, ep->qp.ctx_base + CNIC_EVENT_COAL_INDEX);
> +	}
> +	writeb(action, ep->qp.ctx_base + CNIC_EVENT_CQ_ARM);

This code looks to be outside the function. Did you try to compile with the
_EVENT_COALESCE_ define?

.. snip ..
> +int bnx2i_send_iscsi_tmf(struct bnx2i_conn *bnx2i_conn,
> +			 struct iscsi_task *mtask)
.. snip
> +	tmfabort_wqe->op_attr = 0;
> +	tmfabort_wqe->op_attr =
> +		ISCSI_TMF_REQUEST_ALWAYS_ONE | ISCSI_TM_FUNC_ABORT_TASK;

Is the first assigment neccessary?

.. snip ..
> +static int bnx2i_power_of2(u32 val)

There are no macros for this?

.. snip ..
> +static void bnx2i_process_async_mesg(struct iscsi_session *session,
> +				     struct bnx2i_conn *bnx2i_conn,
> +				     struct cqe *cqe)
> +{
> +	struct bnx2i_async_msg *async_cqe;
> +	struct iscsi_async *resp_hdr;
> +	u8 async_event;
> +
> +	bnx2i_unsol_pdu_adjust_rq(bnx2i_conn);
> +
> +	async_cqe = (struct bnx2i_async_msg *)cqe;
> +	async_event = async_cqe->async_event;
> +
> +	if (async_event == ISCSI_ASYNC_MSG_SCSI_EVENT) {
> +		/* TODO mnc - can't we just copy the scsi sense buffer
> +		 * to the conn->data buffer
> +		 * Anil - currently there is no interface to push this
> +		 * 	  up to SCSI layer. So far we have not seen any
> +		 *	  target generating one. So could be one those
> +		 *	  fancy unused feature
> +		 *
> +		 * For iser/tcp we pass this to libiscsi which does
> +		 * iscsi_recv_pdu to send it to userspace.
> +		 *
> +		 * This event is used by Cisco to signal that a lun
> +		 * has been added or removed. It is also used by
> +		 * EMC celerra or centerra boxes, and EMC will ping
> +		 * you one day :), so we have to do something.

Yes. This would be really nice if it was passed to the
userspace.  Especially since the iscsi daemon re-scans
the SCSI blk device when this is triggered.

> +		 */
> +		iscsi_conn_printk(KERN_ALERT, bnx2i_conn->cls_conn->dd_data,
> +				  "async: scsi events not supported\n");

You might want to include the SCSI sense buffer as well in the
printk.

.. snip ..
> +static void bnx2i_process_iscsi_error(struct bnx2i_hba *hba,
> +				      struct iscsi_kcqe *iscsi_err)
> +{
.. snip ..
> +	char additional_notice[64];
.. snip ..
> +	switch (iscsi_err->completion_status) {
> +	case ISCSI_KCQE_COMPLETION_STATUS_HDR_DIG_ERR:
> +		strcpy(additional_notice, "hdr digest err");

You don't want to memset the 'additional_notice' so that you are
guaranteed to have the \0 at the end?
.. snip ..

> +
> +unsigned int event_coal_div = 1;
> +module_param(event_coal_div, int, 0664);
> +MODULE_PARM_DESC(event_coal_div, "Event Coalescing Divide Factor");

Should that have an #ifdef around it? You are not using it except
in the code that has the #ifdef _EVENT_COALESCE_
.. snip..
> +static struct iscsi_endpoint *bnx2i_alloc_ep(struct bnx2i_hba *hba)
> +{
.. snip ..
> +	tcp_port = bnx2i_alloc_tcp_port();
> +	if (!tcp_port) {
> +		printk(KERN_ERR "bnx2i: run 'bnx2id' to alloc tcp ports\n");

Is that correct? Or will this be handled by iscsid?

.. snip ..
> +static void bnx2i_cleanup_task(struct iscsi_conn *conn,
> +			       struct iscsi_task *task)
> +{
> +	struct bnx2i_conn *bnx2i_conn = conn->dd_data;
> +	struct bnx2i_hba *hba = bnx2i_conn->hba;
> +
> +	/*
> +	 * mgmt task or cmd completed while tmf in progress.
> +	 */
> +	if (!task->sc)
> +		return;
> +	/*
> +	 * ANIL
> +	 * do we have to do this for other tmfs?
> +	 */

Not finished TODO?
.. snip ..

> + */
> +static struct scsi_host_template bnx2i_host_template = {
> +	.module			= THIS_MODULE,
> +	.name			= "Broadcom Offload iSCSI Initiator",
> +	.proc_name		= "bnx2i",
> +	.queuecommand		= iscsi_queuecommand,
> +	.slave_alloc		= iscsi_slave_alloc,
> +	.eh_abort_handler	= iscsi_eh_abort,
> +/*
> + * Anil
> + * uncomment this when we know if we need to do a
> + * ISCSI_OPCODE_CLEANUP_REQUEST on tasks that are affected by
> + * the lu reset.

What is the verdict?
> +	.eh_device_reset_handler = iscsi_eh_device_reset,
> +*/
> +	.eh_target_reset_handler = iscsi_eh_target_reset,
> +	/* TODO - just make this the max sessions * max_cmds_per_session */

And is 1024 the right value?

Re: [PATCH 3/3] bnx2i: Add bnx2i iSCSI driver.

[Ben Hutchings]

Konrad Rzeszutek wrote:
> > + * bnx2i_iscsi_license_error - displays iscsi license related error message
> 
> Doesn't look very license related. Just says 'not supported'.

Could be that some hardware strap pin is being used as a dongle.  This
doesn't seem entirely in the spirit of GPL, and would be rather easy to
remove...

> > + * @hba:		adapter instance pointer
> > + * @error_code:		error classification
> > + *
> > + * Puts out an error log when driver is unable to offload iscsi connection
> > + *	due to license restrictions
> 
> Maybe adding in some extra information to the error, such as: "Due to
> GPL restrictions, etc.." .. What does 'LOM' stand for?

LOM is a common abbreviation for "LAN on motherboard" as opposed to an
expansion card.

Ben.

-- 
Ben Hutchings, Senior Software Engineer, Solarflare Communications
Not speaking for my employer; that's the marketing department's job.

Re: [PATCH 3/3] bnx2i: Add bnx2i iSCSI driver.

[Anil Veerabhadrappa]

On Thu, 2008-05-22 at 11:15 -0400, Konrad Rzeszutek wrote:
> A cursory glance..
> 
> .. snip..
> > +struct bnx2i_cleanup_request {
> > +#if defined(__BIG_ENDIAN)
> > +	u8 op_code;
> > +	u8 reserved1;
> > +	u16 reserved0;
> > +#elif defined(__LITTLE_ENDIAN)
> > +	u16 reserved0;
> > +	u8 reserved1;
> > +	u8 op_code;
> > +#endif
> > +	u32 reserved2[3];
> > +#if defined(__BIG_ENDIAN)
> > +	u16 reserved3;
> > +	u16 itt;
> > +#define ISCSI_CLEANUP_REQUEST_INDEX (0x3FFF<<0)
> > +#define ISCSI_CLEANUP_REQUEST_INDEX_SHIFT 0
> > +#define ISCSI_CLEANUP_REQUEST_TYPE (0x3<<14)
> > +#define ISCSI_CLEANUP_REQUEST_TYPE_SHIFT 14
> > +#elif defined(__LITTLE_ENDIAN)
> > +	u16 itt;
> > +#define ISCSI_CLEANUP_REQUEST_INDEX (0x3FFF<<0)
> > +#define ISCSI_CLEANUP_REQUEST_INDEX_SHIFT 0
> > +#define ISCSI_CLEANUP_REQUEST_TYPE (0x3<<14)
> > +#define ISCSI_CLEANUP_REQUEST_TYPE_SHIFT 14
> > +	u16 reserved3;
> > +#endif
> 
> 
> Why the duplication of the #define values? They look the same.
> 
Sure we can take care of that by moving macros outside of #ifdef

> 
> .. snip ..
> > +/*
> > + * mnc - lookup Jeff Garzack's rule about defining this
> 
> Has this TODO been completed?
> 
> > + * type of junk. Base on enum and make it less error prone.
> > + *	Anil - these are bit masks, won't enum be little ugly?
> > + */
> .. snip ..
> 
> > + * bnx2i_iscsi_license_error - displays iscsi license related error message
> 
> Doesn't look very license related. Just says 'not supported'.
> 
> > + * @hba:		adapter instance pointer
> > + * @error_code:		error classification
> > + *
> > + * Puts out an error log when driver is unable to offload iscsi connection
> > + *	due to license restrictions
> 
> Maybe adding in some extra information to the error, such as: "Due to
> GPL restrictions, etc.." .. What does 'LOM' stand for?

This has nothing to do with code licensing but related to whether iSCSI
functionality is enabled on the device or not. iSCSI feature can be
controlled through NVRAM configuration and some OEM's do not enable
iscsi
 

> 
> > + */
> > +static void bnx2i_iscsi_license_error(struct bnx2i_hba *hba, u32 error_code)
> > +{
> > +	if (error_code == ISCSI_KCQE_COMPLETION_STATUS_ISCSI_NOT_SUPPORTED)
> > +		/* iSCSI offload not supported on this device */
> > +		printk(KERN_ERR "bnx2i: iSCSI not supported, dev=%s\n",
> > +				hba->netdev->name);
> > +	if (error_code == ISCSI_KCQE_COMPLETION_STATUS_LOM_ISCSI_NOT_ENABLED)
> > +		/* iSCSI offload not supported on this LOM device */
> > +		printk(KERN_ERR "bnx2i: LOM is not enable to "
>                                             ^^^^-enabled.
> > +				"offload iSCSI connections, dev=%s\n",
> > +				hba->netdev->name);
> > +	set_bit(ADAPTER_STATE_INIT_FAILED, &hba->adapter_state);
> > +}
> > +
> > +#ifdef _EVENT_COALESCE_
> > +#define CNIC_ARM_CQE			1
> > +#define CNIC_DISARM_CQE			0
> > +extern unsigned int event_coal_div;
> > +
> > +/**
> > + * bnx2i_arm_cq_event_coalescing - arms CQ to enable EQ notification
> > + * @ep:		endpoint (transport indentifier) structure
> > + * @action:	action, ARM or DISARM. For now only ARM_CQE is used
> > + *
> > + * Arm'ing CQ will enable chip to generate global EQ events inorder to interrupt
> > + *	the driver. EQ event is generated CQ index is hit or at least 1 CQ is
> > + *	outstanding and on chip timer expires
> > + */
> > +static void bnx2i_arm_cq_event_coalescing(struct bnx2i_endpoint *ep, u8 action)
> > +{
> > +	u16 cq_index;
> > +	if ((action == CNIC_ARM_CQE) && ep->sess) {
> > +		cq_index = ep->qp.cqe_exp_seq_sn +
> > +			   ep->sess->num_active_cmds / event_coal_div;
> > +		cq_index %= (ep->qp.cqe_size * 2 + 1);
> > +		if (!cq_index)
> > +			cq_index = 1;
> > +		writew(cq_index, ep->qp.ctx_base + CNIC_EVENT_COAL_INDEX);
> > +	}
> > +	writeb(action, ep->qp.ctx_base + CNIC_EVENT_CQ_ARM);
> 
> This code looks to be outside the function. Did you try to compile with the
> _EVENT_COALESCE_ define?

function construction is ok, may be an additional blank line after
writeb() the reason for confusion
 
> 
> .. snip ..
> > +int bnx2i_send_iscsi_tmf(struct bnx2i_conn *bnx2i_conn,
> > +			 struct iscsi_task *mtask)
> .. snip
> > +	tmfabort_wqe->op_attr = 0;
> > +	tmfabort_wqe->op_attr =
> > +		ISCSI_TMF_REQUEST_ALWAYS_ONE | ISCSI_TM_FUNC_ABORT_TASK;
> 
> Is the first assigment neccessary?
> 
> .. snip ..
> > +static int bnx2i_power_of2(u32 val)
> 
> There are no macros for this?

Did not find one. But there is is_power_of_2() to check if the given
integer is an exact power of 2

> 
> .. snip ..
> > +static void bnx2i_process_async_mesg(struct iscsi_session *session,
> > +				     struct bnx2i_conn *bnx2i_conn,
> > +				     struct cqe *cqe)
> > +{
> > +	struct bnx2i_async_msg *async_cqe;
> > +	struct iscsi_async *resp_hdr;
> > +	u8 async_event;
> > +
> > +	bnx2i_unsol_pdu_adjust_rq(bnx2i_conn);
> > +
> > +	async_cqe = (struct bnx2i_async_msg *)cqe;
> > +	async_event = async_cqe->async_event;
> > +
> > +	if (async_event == ISCSI_ASYNC_MSG_SCSI_EVENT) {
> > +		/* TODO mnc - can't we just copy the scsi sense buffer
> > +		 * to the conn->data buffer
> > +		 * Anil - currently there is no interface to push this
> > +		 * 	  up to SCSI layer. So far we have not seen any
> > +		 *	  target generating one. So could be one those
> > +		 *	  fancy unused feature
> > +		 *
> > +		 * For iser/tcp we pass this to libiscsi which does
> > +		 * iscsi_recv_pdu to send it to userspace.
> > +		 *
> > +		 * This event is used by Cisco to signal that a lun
> > +		 * has been added or removed. It is also used by
> > +		 * EMC celerra or centerra boxes, and EMC will ping
> > +		 * you one day :), so we have to do something.
> 
> Yes. This would be really nice if it was passed to the
> userspace.  Especially since the iscsi daemon re-scans
> the SCSI blk device when this is triggered.

yes, we will include this in later revision


> 
> > +		 */
> > +		iscsi_conn_printk(KERN_ALERT, bnx2i_conn->cls_conn->dd_data,
> > +				  "async: scsi events not supported\n");
> 
> You might want to include the SCSI sense buffer as well in the
> printk.
> 
> .. snip ..
> > +static void bnx2i_process_iscsi_error(struct bnx2i_hba *hba,
> > +				      struct iscsi_kcqe *iscsi_err)
> > +{
> .. snip ..
> > +	char additional_notice[64];
> .. snip ..
> > +	switch (iscsi_err->completion_status) {
> > +	case ISCSI_KCQE_COMPLETION_STATUS_HDR_DIG_ERR:
> > +		strcpy(additional_notice, "hdr digest err");
> 
> You don't want to memset the 'additional_notice' so that you are
> guaranteed to have the \0 at the end?
> .. snip ..
> 
> > +
> > +unsigned int event_coal_div = 1;
> > +module_param(event_coal_div, int, 0664);
> > +MODULE_PARM_DESC(event_coal_div, "Event Coalescing Divide Factor");
> 
> Should that have an #ifdef around it? You are not using it except
> in the code that has the #ifdef _EVENT_COALESCE_
> .. snip..

Thanks. Will make this change in the next revision

> > +static struct iscsi_endpoint *bnx2i_alloc_ep(struct bnx2i_hba *hba)
> > +{
> .. snip ..
> > +	tcp_port = bnx2i_alloc_tcp_port();
> > +	if (!tcp_port) {
> > +		printk(KERN_ERR "bnx2i: run 'bnx2id' to alloc tcp ports\n");
> 
> Is that correct? Or will this be handled by iscsid?
> 

This will be handled by a separate user daemon, bnx2id
 

> .. snip ..
> > +static void bnx2i_cleanup_task(struct iscsi_conn *conn,
> > +			       struct iscsi_task *task)
> > +{
> > +	struct bnx2i_conn *bnx2i_conn = conn->dd_data;
> > +	struct bnx2i_hba *hba = bnx2i_conn->hba;
> > +
> > +	/*
> > +	 * mgmt task or cmd completed while tmf in progress.
> > +	 */
> > +	if (!task->sc)
> > +		return;
> > +	/*
> > +	 * ANIL
> > +	 * do we have to do this for other tmfs?
> > +	 */
> 
> Not finished TODO?
> .. snip ..

We just forgot to remove the comments


> 
> > + */
> > +static struct scsi_host_template bnx2i_host_template = {
> > +	.module			= THIS_MODULE,
> > +	.name			= "Broadcom Offload iSCSI Initiator",
> > +	.proc_name		= "bnx2i",
> > +	.queuecommand		= iscsi_queuecommand,
> > +	.slave_alloc		= iscsi_slave_alloc,
> > +	.eh_abort_handler	= iscsi_eh_abort,
> > +/*
> > + * Anil
> > + * uncomment this when we know if we need to do a
> > + * ISCSI_OPCODE_CLEANUP_REQUEST on tasks that are affected by
> > + * the lu reset.
> 
> What is the verdict?

Will remove these old notes between Mike & myself. This has to do with
reclaiming task resources which got affected by lun reset and it
correctly handled by the driver set


> > +	.eh_device_reset_handler = iscsi_eh_device_reset,
> > +*/
> > +	.eh_target_reset_handler = iscsi_eh_target_reset,
> > +	/* TODO - just make this the max sessions * max_cmds_per_session */
> 
> And is 1024 the right value?
> 

Because the same driver handles multiple devices with different hardware
capabilities, we recently changed the driver to assign 'can_queue' value
based on the device type. This change got missed out in this revision as
Mike Christie merged this change a couple of days back. 

Re: [PATCH 3/3] bnx2i: Add bnx2i iSCSI driver.

[Christoph Hellwig]

> +struct bnx2i_async_msg {
> +#if defined(__BIG_ENDIAN)
> +	u8 op_code;
> +	u8 reserved1;
> +	u16 reserved0;
> +#elif defined(__LITTLE_ENDIAN)
> +	u16 reserved0;
> +	u8 reserved1;
> +	u8 op_code;
> +#endif
> +	u32 reserved2;
> +	u32 exp_cmd_sn;
> +	u32 max_cmd_sn;
> +	u32 reserved3[2];

Please don't do the ifdef big endian mess.  Just read the whole
32bit word and do mask and shift operations to extract the actual value.

Re: [PATCH 3/3] bnx2i: Add bnx2i iSCSI driver.

[Michael Chan]

On Thu, 2008-05-22 at 17:15 -0400, Christoph Hellwig wrote:
> > +struct bnx2i_async_msg {
> > +#if defined(__BIG_ENDIAN)
> > +	u8 op_code;
> > +	u8 reserved1;
> > +	u16 reserved0;
> > +#elif defined(__LITTLE_ENDIAN)
> > +	u16 reserved0;
> > +	u8 reserved1;
> > +	u8 op_code;
> > +#endif
> > +	u32 reserved2;
> > +	u32 exp_cmd_sn;
> > +	u32 max_cmd_sn;
> > +	u32 reserved3[2];
> 
> Please don't do the ifdef big endian mess.  Just read the whole
> 32bit word and do mask and shift operations to extract the actual value.
> 
> 

I agree with you that u32 is cleaner in some cases.  We can just change
it to u32 op_code and we just need a OP_CODE_MASK of 0xff.

We'll go through this .h file and remove some of this big endian stuff
and also the duplicate constants pointed out earlier.

Re: [PATCH 3/3] bnx2i: Add bnx2i iSCSI driver.

[Roland Dreier]

Hi Michael, I was reading over the driver to try and figure out how you
handle allocating source ports for the offloaded TCP connections you
make so that they don't collide with the main network stack.  It looks
like you have:

 > +/**
 > + * bnx2i_alloc_tcp_port - allocates a tcp port from the free list
 > + *
 > + * Assumes this function is called with 'bnx2i_resc_lock' held.
 > + */
 > +static u16 bnx2i_alloc_tcp_port(void)

that has some failure code:

 > +	if (!tcp_port) {
 > +		printk(KERN_ERR "bnx2i: run 'bnx2id' to alloc tcp ports\n");

but I don't know what bnx2id is?

and I didn't see anywhere that bnx2i_get_tcp_port_requirements() is
actually called, and it's not exported?

 > +/**
 > + * bnx2i_get_tcp_port_requirements - returns num tcp ports to alloc/bind
 > + *
 > + * driver returns the number of TCP ports to be allocated/bound by 'bnx2id'
 > + *	daemon. Return value of '0' means driver has everything to support
 > + *	max iscsi connections on enumerated NX2 devices
 > + */
 > +int bnx2i_get_tcp_port_requirements(void)

Re: [PATCH 3/3] bnx2i: Add bnx2i iSCSI driver.

[Anil Veerabhadrappa]

On Fri, 2008-05-23 at 13:23 -0700, Roland Dreier wrote: 
> Hi Michael, I was reading over the driver to try and figure out how you
> handle allocating source ports for the offloaded TCP connections you
> make so that they don't collide with the main network stack.  It looks
> like you have:
> 
>  > +/**
>  > + * bnx2i_alloc_tcp_port - allocates a tcp port from the free list
>  > + *
>  > + * Assumes this function is called with 'bnx2i_resc_lock' held.
>  > + */
>  > +static u16 bnx2i_alloc_tcp_port(void)
> 
> that has some failure code:
> 
>  > +	if (!tcp_port) {
>  > +		printk(KERN_ERR "bnx2i: run 'bnx2id' to alloc tcp ports\n");
> 
> but I don't know what bnx2id is?

'bnx2id' is the user component in this solution. bnx2id daemon uses
socket calls to bind tcp ports in high range and hands them over to
driver. This is how iscsi driver tries to solve tcp port collision
issue. User daemon communicates with the driver using sysfs and tcp port
related functions are bnx2i_read_tcp_portd_*/bnx2i_write_tcp_portd_*
(reference: bnx2i_sysfs.c)

> 
> and I didn't see anywhere that bnx2i_get_tcp_port_requirements() is
> actually called, and it's not exported?
> 
>  > +/**
>  > + * bnx2i_get_tcp_port_requirements - returns num tcp ports to alloc/bind
>  > + *
>  > + * driver returns the number of TCP ports to be allocated/bound by 'bnx2id'
>  > + *	daemon. Return value of '0' means driver has everything to support
>  > + *	max iscsi connections on enumerated NX2 devices
>  > + */
>  > +int bnx2i_get_tcp_port_requirements(void)
> 
Actually this logic was simplified by adding a new member,
'num_required' to 'tcp_port_mgmt' structure. This call is no more
required, will remove bnx2i_get_tcp_port_requirements() in the next
driver revision

Re: [PATCH 3/3] bnx2i: Add bnx2i iSCSI driver.

[Roland Dreier]

 > 'bnx2id' is the user component in this solution. bnx2id daemon uses
 > socket calls to bind tcp ports in high range and hands them over to
 > driver. This is how iscsi driver tries to solve tcp port collision
 > issue. User daemon communicates with the driver using sysfs and tcp port
 > related functions are bnx2i_read_tcp_portd_*/bnx2i_write_tcp_portd_*
 > (reference: bnx2i_sysfs.c)

So you are creating sockets just to reserve TCP ports to avoid host
stack clashes with your offload engine?  Wasn't this approach strongly
rejected (in the context of iWARP) in the past?

 - R.

Re: [PATCH 3/3] bnx2i: Add bnx2i iSCSI driver.

[Michael Chan]

On Tue, 2008-05-27 at 07:38 -0700, Roland Dreier wrote:
>  > 'bnx2id' is the user component in this solution. bnx2id daemon uses
>  > socket calls to bind tcp ports in high range and hands them over to
>  > driver. This is how iscsi driver tries to solve tcp port collision
>  > issue. User daemon communicates with the driver using sysfs and tcp port
>  > related functions are bnx2i_read_tcp_portd_*/bnx2i_write_tcp_portd_*
>  > (reference: bnx2i_sysfs.c)
> 
> So you are creating sockets just to reserve TCP ports to avoid host
> stack clashes with your offload engine?  Wasn't this approach strongly
> rejected (in the context of iWARP) in the past?
> 

We're doing it in userspace, so I don't if that makes it any better or
any worse.

Roland, what do you suggest?  We can do it like cma_alloc_any_port() in
cma.c.

Re: [PATCH 3/3] bnx2i: Add bnx2i iSCSI driver.

[Roland Dreier]

 > We're doing it in userspace, so I don't if that makes it any better or
 > any worse.

How do you do it in userspace?  With a bind()?  That is a little
wasteful in that you are reserving a local addr/port when all you really
need to reserve is the actual local/remote 4-tuple that you are going to
use for the connection, but that's not horrible.

 > Roland, what do you suggest?  We can do it like cma_alloc_any_port() in
 > cma.c.

Actually cma.c still has the problem of host/offload port space collisions.

The whole port sharing thing is a mess -- I was hoping you had come up
with a good solution that cma.c could steal to be honest, so I don't
have any better ideas at the moment.

 - R.

Re: [PATCH 3/3] bnx2i: Add bnx2i iSCSI driver.

[David Miller]

From: Roland Dreier <rdreier@cisco.com>
Date: Tue, 27 May 2008 07:38:19 -0700

> So you are creating sockets just to reserve TCP ports to avoid host
> stack clashes with your offload engine?  Wasn't this approach strongly
> rejected (in the context of iWARP) in the past?

Yes, it was, and likewise similar hacks in other areas will
be rejected similarly.

Re: [PATCH 3/3] bnx2i: Add bnx2i iSCSI driver.

[Michael Chan]

On Tue, 2008-05-27 at 12:52 -0700, David Miller wrote:
> From: Roland Dreier <rdreier@cisco.com>
> Date: Tue, 27 May 2008 07:38:19 -0700
> 
> > So you are creating sockets just to reserve TCP ports to avoid host
> > stack clashes with your offload engine?  Wasn't this approach strongly
> > rejected (in the context of iWARP) in the past?
> 
> Yes, it was, and likewise similar hacks in other areas will
> be rejected similarly.
> 

If we change the implementation to use a separate IP address and
separate MAC address for iSCSI, will it be acceptable?  The iSCSI IP/MAC
addresses will be unknown to the Linux TCP stack and so no sharing of
the 4-tuple space will be needed.

The patches will be very similar, except that all inet calls and
notifiers will be removed.

Re: [PATCH 3/3] bnx2i: Add bnx2i iSCSI driver.

[Jeff Garzik]

Michael Chan wrote:
> If we change the implementation to use a separate IP address and
> separate MAC address for iSCSI, will it be acceptable?  The iSCSI IP/MAC
> addresses will be unknown to the Linux TCP stack and so no sharing of
> the 4-tuple space will be needed.
> 
> The patches will be very similar, except that all inet calls and
> notifiers will be removed.


IMO a totally separate MAC and IP would definitely be preferred...

	Jeff

Re: [PATCH 3/3] bnx2i: Add bnx2i iSCSI driver.

[Hannes Reinecke]

Hi all,

Jeff Garzik wrote:
> Michael Chan wrote:
>> If we change the implementation to use a separate IP address and
>> separate MAC address for iSCSI, will it be acceptable?  The iSCSI IP/MAC
>> addresses will be unknown to the Linux TCP stack and so no sharing of
>> the 4-tuple space will be needed.
>>
>> The patches will be very similar, except that all inet calls and
>> notifiers will be removed.
> 
> 
> IMO a totally separate MAC and IP would definitely be preferred...
> 
And as it happens, the machines I have here claim to use a different
MAC address for iSCSI anyway. So we should be using them.

Cheers,

Hannes
-- 
Dr. Hannes Reinecke		      zSeries & Storage
hare@suse.de			      +49 911 74053 688
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg
GF: Markus Rex, HRB 16746 (AG Nürnberg)

[PATCH 2/3] cnic: Add CNIC driver.

[Michael Chan]

The CNIC driver controls BNX2 hardware rings and resources used by
iSCSI.  It depends on the BNX2 driver to reset the chip and set up
the proper link speed.

All hardware resources for iSCSI are separate from those used for
ethernet networking.  If MSI-X is used, the CNIC driver will
register its own MSI-X vector for iSCSI interrupts.  If MSI-X is
not used, the single interrupt will be shared between the BNX2
driver and the CNIC driver.

Signed-off-by: Michael Chan <mchan@broadcom.com>
---
 drivers/net/Kconfig     |   10 +
 drivers/net/Makefile    |    1 +
 drivers/net/cnic.c      | 2439 +++++++++++++++++++++++++++++++++++++++++++++++
 drivers/net/cnic.h      |  221 +++++
 drivers/net/cnic_defs.h |  553 +++++++++++
 drivers/net/cnic_drv.h  |  112 +++
 drivers/net/cnic_if.h   |  171 ++++
 7 files changed, 3507 insertions(+), 0 deletions(-)
 create mode 100644 drivers/net/cnic.c
 create mode 100644 drivers/net/cnic.h
 create mode 100644 drivers/net/cnic_defs.h
 create mode 100644 drivers/net/cnic_drv.h
 create mode 100644 drivers/net/cnic_if.h

diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 9f6cc8a..f7f51f2 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -2245,6 +2245,16 @@ config BNX2
 	  To compile this driver as a module, choose M here: the module
 	  will be called bnx2.  This is recommended.
 
+config CNIC
+	tristate "Broadcom CNIC support"
+	depends on BNX2
+	help
+	  This driver supports offload features of Broadcom NetXtremeII
+	  gigabit Ethernet cards.
+
+	  To compile this driver as a module, choose M here: the module
+	  will be called cnic.  This is recommended.
+
 config SPIDER_NET
 	tristate "Spider Gigabit Ethernet driver"
 	depends on PCI && (PPC_IBM_CELL_BLADE || PPC_CELLEB)
diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index dcbfe84..39ec0db 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -67,6 +67,7 @@ obj-$(CONFIG_FEALNX) += fealnx.o
 obj-$(CONFIG_TIGON3) += tg3.o
 obj-$(CONFIG_BNX2) += bnx2.o
 obj-$(CONFIG_BNX2X) += bnx2x.o
+obj-$(CONFIG_CNIC) += cnic.o
 spidernet-y += spider_net.o spider_net_ethtool.o
 obj-$(CONFIG_SPIDER_NET) += spidernet.o sungem_phy.o
 obj-$(CONFIG_GELIC_NET) += ps3_gelic.o
diff --git a/drivers/net/cnic.c b/drivers/net/cnic.c
new file mode 100644
index 0000000..fbeb3a8
--- /dev/null
+++ b/drivers/net/cnic.c
@@ -0,0 +1,2439 @@
+/* cnic.c: Broadcom CNIC core network driver.
+ *
+ * Copyright (c) 2006-2007 Broadcom Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation.
+ *
+ * Written by: John(Zongxi) Chen (zongxi@broadcom.com)
+ * Modified and maintained by: Michael Chan <mchan@broadcom.com>
+ */
+
+#include <linux/module.h>
+
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/list.h>
+#include <linux/slab.h>
+#include <linux/pci.h>
+#include <linux/init.h>
+#include <linux/netdevice.h>
+#include <linux/inetdevice.h>
+#include <linux/in.h>
+#include <linux/dma-mapping.h>
+#include <asm/byteorder.h>
+#include <linux/delay.h>
+#include <linux/ethtool.h>
+#include <linux/if_vlan.h>
+#define BCM_VLAN 1
+#include <net/ip.h>
+#include <net/tcp.h>
+#include <net/arp.h>
+#include <net/neighbour.h>
+#include <net/route.h>
+#include <net/ipv6.h>
+#include <net/ip6_route.h>
+#include <net/addrconf.h>
+#include <net/netevent.h>
+
+#define BCM_CNIC 1
+#include "cnic_drv.h"
+#include "bnx2.h"
+#include "cnic_if.h"
+#include "cnic.h"
+#include "cnic_defs.h"
+
+#define DRV_MODULE_NAME 	"cnic"
+#define PFX DRV_MODULE_NAME ": "
+
+static char version[] __devinitdata =
+	"Broadcom NetXtreme II CNIC Driver " DRV_MODULE_NAME " v" CNIC_MODULE_VERSION " (" CNIC_MODULE_RELDATE ")\n";
+
+MODULE_AUTHOR("John(Zongxi) Chen <zongxic@broadcom.com>");
+MODULE_DESCRIPTION("Broadcom NetXtreme II CNIC Driver");
+MODULE_LICENSE("GPL");
+MODULE_VERSION(CNIC_MODULE_VERSION);
+
+static LIST_HEAD(cnic_dev_list);
+static DEFINE_RWLOCK(cnic_dev_lock);
+static DEFINE_MUTEX(cnic_lock);
+
+struct cnic_ulp_ops *cnic_ulp_tbl[MAX_CNIC_ULP_TYPE];
+
+static int cnic_service_bnx2(void *, void *);
+static int cnic_ctl(void *, struct cnic_ctl_info *);
+
+static struct cnic_ops cnic_bnx2_ops = {
+	.cnic_owner	= THIS_MODULE,
+	.cnic_handler	= cnic_service_bnx2,
+	.cnic_ctl	= cnic_ctl,
+};
+
+static inline void cnic_hold(struct cnic_dev *dev)
+{
+	atomic_inc(&dev->ref_count);
+}
+
+static inline void cnic_put(struct cnic_dev *dev)
+{
+	atomic_dec(&dev->ref_count);
+}
+
+static inline void csk_hold(struct cnic_sock *csk)
+{
+	atomic_inc(&csk->ref_count);
+}
+
+static inline void csk_put(struct cnic_sock *csk)
+{
+	atomic_dec(&csk->ref_count);
+}
+
+static void cnic_bnx2_ctx_wr(struct cnic_dev *dev, u32 cid_addr, u32 off,
+			     u32 val)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+	struct cnic_eth_dev *ethdev = cp->ethdev;
+	struct drv_ctl_info info;
+	struct drv_ctl_io *io = &info.data.io;
+
+	info.cmd = DRV_CTL_CTX_WR_CMD;
+	io->cid_addr = cid_addr;
+	io->offset = off;
+	io->data = val;
+	ethdev->drv_ctl(dev->netdev, &info);
+}
+
+static void cnic_bnx2_reg_wr_ind(struct cnic_dev *dev, u32 off, u32 val)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+	struct cnic_eth_dev *ethdev = cp->ethdev;
+	struct drv_ctl_info info;
+	struct drv_ctl_io *io = &info.data.io;
+
+	info.cmd = DRV_CTL_IO_WR_CMD;
+	io->offset = off;
+	io->data = val;
+	ethdev->drv_ctl(dev->netdev, &info);
+}
+
+static u32 cnic_bnx2_reg_rd_ind(struct cnic_dev *dev, u32 off)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+	struct cnic_eth_dev *ethdev = cp->ethdev;
+	struct drv_ctl_info info;
+	struct drv_ctl_io *io = &info.data.io;
+
+	info.cmd = DRV_CTL_IO_WR_CMD;
+	io->offset = off;
+	ethdev->drv_ctl(dev->netdev, &info);
+	return io->data;
+}
+
+static int cnic_in_use(struct cnic_sock *csk)
+{
+	return (test_bit(SK_F_INUSE, &csk->flags));
+}
+
+static int cnic_offld_prep(struct cnic_sock *csk)
+{
+	if (!test_bit(SK_F_CONNECT_START, &csk->flags))
+		return 0;
+
+	if (test_and_set_bit(SK_F_OFFLD_SCHED, &csk->flags))
+		return 0;
+
+	return 1;
+}
+
+static int cnic_abort_prep(struct cnic_sock *csk)
+{
+	while (test_and_set_bit(SK_F_OFFLD_SCHED, &csk->flags))
+		msleep(1);
+
+	if (test_bit(SK_F_OFFLD_COMPLETE, &csk->flags))
+		return 1;
+
+	return 0;
+}
+
+static void cnic_abort_done(struct cnic_sock *csk)
+{
+	smp_mb__before_clear_bit();
+	clear_bit(SK_F_OFFLD_SCHED, &csk->flags);
+}
+
+int cnic_register_driver(int ulp_type, struct cnic_ulp_ops *ulp_ops)
+{
+	struct cnic_dev *dev;
+
+	if (ulp_type >= MAX_CNIC_ULP_TYPE) {
+		printk(KERN_ERR PFX "cnic_register_driver: Bad type %d\n",
+		       ulp_type);
+		return -EINVAL;
+	}
+	mutex_lock(&cnic_lock);
+	if (cnic_ulp_tbl[ulp_type]) {
+		printk(KERN_ERR PFX "cnic_register_driver: Type %d has already "
+				    "been registered\n", ulp_type);
+		mutex_unlock(&cnic_lock);
+		return -EBUSY;
+	}
+
+	read_lock(&cnic_dev_lock);
+	list_for_each_entry(dev, &cnic_dev_list, list) {
+		struct cnic_local *cp = dev->cnic_priv;
+
+		clear_bit(ULP_F_INIT, &cp->ulp_flags[ulp_type]);
+	}
+	read_unlock(&cnic_dev_lock);
+
+	rcu_assign_pointer(cnic_ulp_tbl[ulp_type], ulp_ops);
+	mutex_unlock(&cnic_lock);
+
+	/* Prevent race conditions with netdev_event */
+	rtnl_lock();
+	read_lock(&cnic_dev_lock);
+	list_for_each_entry(dev, &cnic_dev_list, list) {
+		struct cnic_local *cp = dev->cnic_priv;
+
+		if (!test_and_set_bit(ULP_F_INIT, &cp->ulp_flags[ulp_type]))
+			ulp_ops->cnic_init(dev);
+	}
+	read_unlock(&cnic_dev_lock);
+	rtnl_unlock();
+
+	return 0;
+}
+
+int cnic_unregister_driver(int ulp_type)
+{
+	struct cnic_dev *dev;
+
+	if (ulp_type >= MAX_CNIC_ULP_TYPE) {
+		printk(KERN_ERR PFX "cnic_unregister_driver: Bad type %d\n",
+		       ulp_type);
+		return -EINVAL;
+	}
+	mutex_lock(&cnic_lock);
+	if (!cnic_ulp_tbl[ulp_type]) {
+		printk(KERN_ERR PFX "cnic_unregister_driver: Type %d has not "
+				    "been registered\n", ulp_type);
+		goto out_unlock;
+	}
+	read_lock(&cnic_dev_lock);
+	list_for_each_entry(dev, &cnic_dev_list, list) {
+		struct cnic_local *cp = dev->cnic_priv;
+		
+		if (rcu_dereference(cp->ulp_ops[ulp_type])) {
+			printk(KERN_ERR PFX "cnic_unregister_driver: Type %d "
+			       "still has devices registered\n", ulp_type);
+			read_unlock(&cnic_dev_lock);
+			goto out_unlock;
+		}
+	}
+	read_unlock(&cnic_dev_lock);
+
+	rcu_assign_pointer(cnic_ulp_tbl[ulp_type], NULL);
+
+	mutex_unlock(&cnic_lock);
+	synchronize_rcu();
+	return 0;
+
+out_unlock:
+	mutex_unlock(&cnic_lock);
+	return -EINVAL;
+}
+
+EXPORT_SYMBOL(cnic_register_driver);
+EXPORT_SYMBOL(cnic_unregister_driver);
+
+static int cnic_start_hw(struct cnic_dev *);
+static void cnic_stop_hw(struct cnic_dev *);
+
+static int cnic_register_device(struct cnic_dev *dev, int ulp_type,
+				void *ulp_ctx)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+	struct cnic_ulp_ops *ulp_ops;
+
+	if (ulp_type >= MAX_CNIC_ULP_TYPE) {
+		printk(KERN_ERR PFX "cnic_register_device: Bad type %d\n",
+		       ulp_type);
+		return -EINVAL;
+	}
+	mutex_lock(&cnic_lock);
+	if (cnic_ulp_tbl[ulp_type] == NULL) {
+		printk(KERN_ERR PFX "cnic_register_device: Driver with type %d "
+				    "has not been registered\n", ulp_type);
+		mutex_unlock(&cnic_lock);
+		return -EAGAIN;
+	}
+	if (rcu_dereference(cp->ulp_ops[ulp_type])) {
+		printk(KERN_ERR PFX "cnic_register_device: Type %d has already "
+		       "been registered to this device\n", ulp_type);
+		mutex_unlock(&cnic_lock);
+		return -EBUSY;
+	}
+	if (!try_module_get(cnic_ulp_tbl[ulp_type]->owner)) {
+		mutex_unlock(&cnic_lock);
+		return -EBUSY;
+	}
+
+	clear_bit(ULP_F_START, &cp->ulp_flags[ulp_type]);
+	cp->ulp_handle[ulp_type] = ulp_ctx;
+	ulp_ops = cnic_ulp_tbl[ulp_type];
+	rcu_assign_pointer(cp->ulp_ops[ulp_type], ulp_ops);
+	cnic_hold(dev);
+	if (!dev->use_count) {
+		if (!test_bit(CNIC_F_IF_GOING_DOWN, &dev->flags)) {
+			if (dev->netdev->flags & IFF_UP)
+				set_bit(CNIC_F_IF_UP, &dev->flags);
+		}
+	}
+	dev->use_count++;
+
+	if (dev->use_count == 1) {
+		if (test_bit(CNIC_F_IF_UP, &dev->flags))
+			cnic_start_hw(dev);
+	}
+
+	if (test_bit(CNIC_F_CNIC_UP, &dev->flags))
+		if (!test_and_set_bit(ULP_F_START, &cp->ulp_flags[ulp_type]))
+			ulp_ops->cnic_start(cp->ulp_handle[ulp_type]);
+
+	mutex_unlock(&cnic_lock);
+
+	return 0;
+
+}
+
+static int cnic_unregister_device(struct cnic_dev *dev, int ulp_type)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+
+	if (ulp_type >= MAX_CNIC_ULP_TYPE) {
+		printk(KERN_ERR PFX "cnic_unregister_device: Bad type %d\n",
+		       ulp_type);
+		return -EINVAL;
+	}
+	mutex_lock(&cnic_lock);
+	if (rcu_dereference(cp->ulp_ops[ulp_type])) {
+		dev->use_count--;
+		module_put(cp->ulp_ops[ulp_type]->owner);
+		rcu_assign_pointer(cp->ulp_ops[ulp_type], NULL);
+		if (dev->use_count == 0)
+			cnic_stop_hw(dev);
+		cnic_put(dev);
+	} else {
+		printk(KERN_ERR PFX "cnic_unregister_device: device not "
+		       "registered to this ulp type %d\n", ulp_type);
+		mutex_unlock(&cnic_lock);
+		return -EINVAL;
+	}
+	mutex_unlock(&cnic_lock);
+
+	synchronize_rcu();
+
+	return 0;
+}
+
+static void cnic_free_dma(struct cnic_dev *dev, struct cnic_dma *dma)
+{
+	int i;
+
+	if (!dma->pg_arr)
+		return;
+
+	for (i = 0; i < dma->num_pages; i++) {
+		if (dma->pg_arr[i]) {
+			pci_free_consistent(dev->pcidev, BCM_PAGE_SIZE,
+					    dma->pg_arr[i], dma->pg_map_arr[i]);
+			dma->pg_arr[i] = NULL;
+		}
+	}
+	if (dma->pgtbl) {
+		pci_free_consistent(dev->pcidev, dma->pgtbl_size,
+				    dma->pgtbl, dma->pgtbl_map);
+		dma->pgtbl = NULL;
+	}
+	kfree(dma->pg_arr);
+	dma->pg_arr = NULL;
+	dma->num_pages = 0;
+}
+
+static void cnic_setup_page_tbl(struct cnic_dev *dev, struct cnic_dma *dma)
+{
+	int i;
+	u32 *page_table = dma->pgtbl;
+
+	for (i = 0; i < dma->num_pages; i++) {
+		/* Each entry needs to be in big endian format. */
+		*page_table = (u32) ((u64) dma->pg_map_arr[i] >> 32);
+		page_table++;
+		*page_table = (u32) dma->pg_map_arr[i];
+		page_table++;
+	}
+}
+
+static int cnic_alloc_dma(struct cnic_dev *dev, struct cnic_dma *dma,
+			  int pages, int use_pg_tbl)
+{
+	int i, size;
+	struct cnic_local *cp = dev->cnic_priv;
+
+	size = pages * (sizeof(void *) + sizeof(dma_addr_t));
+	dma->pg_arr = kzalloc(size, GFP_ATOMIC);
+	if (dma->pg_arr == NULL)
+		return -ENOMEM;
+
+	dma->pg_map_arr = (dma_addr_t *) (dma->pg_arr + pages);
+	dma->num_pages = pages;
+
+	for (i = 0; i < pages; i++) {
+		dma->pg_arr[i] = pci_alloc_consistent(dev->pcidev,
+						      BCM_PAGE_SIZE,
+						      &dma->pg_map_arr[i]);
+		if (dma->pg_arr[i] == NULL)
+			goto error;
+	}
+	if (!use_pg_tbl)
+		return 0;
+
+	dma->pgtbl_size = ((pages * 8) + BCM_PAGE_SIZE - 1) &
+			  (BCM_PAGE_SIZE - 1);
+	dma->pgtbl = pci_alloc_consistent(dev->pcidev, dma->pgtbl_size,
+					  &dma->pgtbl_map);
+	if (dma->pgtbl == NULL)
+		goto error;
+
+	cp->setup_pgtbl(dev, dma);
+
+	return 0;
+
+error:
+	cnic_free_dma(dev, dma);
+	return -ENOMEM;
+}
+
+static void cnic_free_resc(struct cnic_dev *dev)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+	int i;
+
+	for (i = 0; i < cp->ctx_blks; i++) {
+		if (cp->ctx_arr[i].ctx) {
+			pci_free_consistent(dev->pcidev, cp->ctx_blk_size,
+					    cp->ctx_arr[i].ctx,
+					    cp->ctx_arr[i].mapping);
+			cp->ctx_arr[i].ctx = NULL;
+		}
+	}
+	kfree(cp->ctx_arr);
+	cp->ctx_arr = NULL;
+	cp->ctx_blks = 0;
+
+	cnic_free_dma(dev, &cp->kwq_info);
+	cnic_free_dma(dev, &cp->kcq_info);
+	return;
+}
+
+static int cnic_alloc_context(struct cnic_dev *dev)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+
+	if (CHIP_NUM(cp) == CHIP_NUM_5709) {
+		int i, k, arr_size;
+
+		cp->ctx_blk_size = BCM_PAGE_SIZE;
+		cp->cids_per_blk = BCM_PAGE_SIZE / 128;
+		arr_size = BNX2_MAX_CID / cp->cids_per_blk *
+			   sizeof(struct cnic_ctx);
+		cp->ctx_arr = kmalloc(arr_size, GFP_KERNEL);
+		if (cp->ctx_arr == NULL)
+			return -ENOMEM;
+
+		memset(cp->ctx_arr, 0, arr_size);
+
+		k = 0;
+		for (i = 0; i < 2; i++) {
+			u32 j, reg, off, lo, hi;
+
+			if (i == 0)
+				off = BNX2_PG_CTX_MAP;
+			else
+				off = BNX2_ISCSI_CTX_MAP;
+
+			reg = cnic_bnx2_reg_rd_ind(dev, off);
+			lo = reg >> 16;
+			hi = reg & 0xffff;
+			for (j = lo; j < hi; j += cp->cids_per_blk, k++)
+				cp->ctx_arr[k].cid = j;
+		}
+
+		cp->ctx_blks = k;
+
+		for (i = 0; i < cp->ctx_blks; i++) {
+			cp->ctx_arr[i].ctx =
+				pci_alloc_consistent(dev->pcidev, BCM_PAGE_SIZE,
+						     &cp->ctx_arr[i].mapping);
+			if (cp->ctx_arr[i].ctx == NULL)
+				return -ENOMEM;
+		}
+	}
+	return 0;
+}
+
+static int cnic_alloc_bnx2_resc(struct cnic_dev *dev)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+	int ret;
+
+	ret = cnic_alloc_dma(dev, &cp->kwq_info, KWQ_PAGE_CNT, 1);
+	if (ret)
+		goto error;
+	cp->kwq = (struct kwqe **) cp->kwq_info.pg_arr;
+
+	ret = cnic_alloc_dma(dev, &cp->kcq_info, KCQ_PAGE_CNT, 1);
+	if (ret)
+		goto error;
+	cp->kcq = (struct kcqe **) cp->kcq_info.pg_arr;
+
+	ret = cnic_alloc_context(dev);
+	if (ret)
+		goto error;
+
+	return 0;
+	
+error:
+	cnic_free_resc(dev);
+	return ret;
+}
+
+static inline u32 cnic_kwq_avail(struct cnic_local *cp)
+{
+	return (cp->max_kwq_idx -
+		((cp->kwq_prod_idx - cp->kwq_con_idx) & cp->max_kwq_idx));
+}
+
+static int cnic_submit_bnx2_kwqes(struct cnic_dev *dev, struct kwqe *wqes[],
+				  u32 num_wqes)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+	struct kwqe *prod_qe;
+	u16 prod, sw_prod, i;
+
+	if (!test_bit(CNIC_F_CNIC_UP, &dev->flags))
+		return -EAGAIN;		/* bnx2 is down */
+
+	spin_lock_bh(&cp->cnic_ulp_lock);
+	if (num_wqes > cnic_kwq_avail(cp) &&
+	    !(cp->cnic_local_flags & CNIC_LCL_FL_KWQ_INIT)) {
+		spin_unlock_bh(&cp->cnic_ulp_lock);
+		return -EAGAIN;
+	}
+
+	cp->cnic_local_flags &= ~CNIC_LCL_FL_KWQ_INIT;
+
+	prod = cp->kwq_prod_idx;
+	sw_prod = prod & MAX_KWQ_IDX;
+	for (i = 0; i < num_wqes; i++) {
+		prod_qe = &cp->kwq[KWQ_PG(sw_prod)][KWQ_IDX(sw_prod)];
+		memcpy(prod_qe, wqes[i], sizeof(struct kwqe));
+		prod++;
+		sw_prod = prod & MAX_KWQ_IDX;
+	}
+	cp->kwq_prod_idx = prod;
+
+	CNIC_WR16(dev, cp->kwq_io_addr, cp->kwq_prod_idx);
+
+	spin_unlock_bh(&cp->cnic_ulp_lock);
+	return 0;
+}
+
+static void service_kcqes(struct cnic_dev *dev, int num_cqes)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+	int i, j;
+
+	i = 0;
+	j = 1;
+	while (num_cqes) {
+		struct cnic_ulp_ops *ulp_ops;
+		int ulp_type;
+		u32 kcqe_op_flag = cp->completed_kcq[i]->kcqe_op_flag;
+		u32 kcqe_layer = kcqe_op_flag & KCQE_FLAGS_LAYER_MASK;
+
+		while (j < num_cqes) {
+			u32 next_op = cp->completed_kcq[i + j]->kcqe_op_flag;
+
+			if ((next_op & KCQE_FLAGS_LAYER_MASK) != kcqe_layer)
+				break;
+			j++;
+		}
+
+		if (kcqe_layer == KCQE_FLAGS_LAYER_MASK_L5_RDMA)
+			ulp_type = CNIC_ULP_RDMA;
+		else if (kcqe_layer == KCQE_FLAGS_LAYER_MASK_L5_ISCSI)
+			ulp_type = CNIC_ULP_ISCSI;
+		else if (kcqe_layer == KCQE_FLAGS_LAYER_MASK_L4)
+			ulp_type = CNIC_ULP_L4;
+		else {
+			printk(KERN_ERR PFX "%s: Unknown type of KCQE(0x%x)\n",
+			       dev->netdev->name, kcqe_op_flag);
+			goto end;
+		}
+
+		rcu_read_lock();
+		ulp_ops = rcu_dereference(cp->ulp_ops[ulp_type]);
+		if (likely(ulp_ops)) {
+			ulp_ops->indicate_kcqes(cp->ulp_handle[ulp_type],
+						  cp->completed_kcq + i, j);
+		}
+		rcu_read_unlock();
+end:
+		num_cqes -= j;
+		i += j;
+		j = 1;
+	}
+	return;
+}
+
+static int cnic_get_kcqes(struct cnic_dev *dev, u16 hw_prod, u16 sw_prod)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+	u16 i, max;
+	struct kcqe *kcqe;
+	int kcqe_cnt = 0;
+
+	i = sw_prod & MAX_KCQ_IDX;
+	max = hw_prod & MAX_KCQ_IDX;
+	while ((i != max) && (kcqe_cnt < MAX_COMPLETED_KCQE)) {
+		cp->completed_kcq[kcqe_cnt++] = &cp->kcq[KCQ_PG(i)][KCQ_IDX(i)];
+		i = (i + 1) & MAX_KCQ_IDX;
+	}
+
+	kcqe = cp->completed_kcq[kcqe_cnt - 1];
+	while (kcqe->kcqe_op_flag & KCQE_FLAGS_NEXT) {
+		kcqe_cnt--;
+		if (kcqe_cnt == 0)
+			goto done;
+		kcqe = cp->completed_kcq[kcqe_cnt - 1];
+	}
+done:
+	return kcqe_cnt;
+}
+
+static int cnic_service_bnx2(void *data, void *status_blk)
+{
+	struct cnic_dev *dev = data;
+	struct status_block *sblk = status_blk;
+	struct cnic_local *cp = dev->cnic_priv;
+	u32 status_idx = sblk->status_idx;
+	u16 hw_prod, sw_prod;
+	int kcqe_cnt;
+
+	if (unlikely(!test_bit(CNIC_F_CNIC_UP, &dev->flags)))
+		return status_idx;
+
+	cp->kwq_con_idx = sblk->status_rx_quick_consumer_index15;
+
+	hw_prod = sblk->status_completion_producer_index;
+	sw_prod = cp->kcq_prod_idx;
+	while (sw_prod != hw_prod) {
+		kcqe_cnt = cnic_get_kcqes(dev, hw_prod, sw_prod);
+		if (kcqe_cnt == 0)
+			goto done;
+		sw_prod += kcqe_cnt;
+
+		service_kcqes(dev, kcqe_cnt);
+
+		/* Tell compiler that status_blk fields can change. */
+		barrier();
+		if (status_idx != sblk->status_idx) {
+			status_idx = sblk->status_idx;
+			cp->kwq_con_idx =
+				sblk->status_rx_quick_consumer_index15;
+			hw_prod = sblk->status_completion_producer_index;
+		} else
+			break;
+	}
+
+done:
+	CNIC_WR16(dev, cp->kcq_io_addr, sw_prod);
+
+	cp->kcq_prod_idx = sw_prod;
+	return status_idx;
+}
+
+static void cnic_service_bnx2_msix(unsigned long data)
+{
+	struct cnic_dev *dev = (struct cnic_dev *) data;
+	struct cnic_local *cp = dev->cnic_priv;
+	struct status_block_msix *status_blk = cp->bnx2_status_blk;
+	u32 status_idx = status_blk->status_idx;
+	u16 hw_prod, sw_prod;
+	int kcqe_cnt;
+
+	cp->kwq_con_idx = status_blk->status_cmd_consumer_index;
+
+	hw_prod = status_blk->status_completion_producer_index;
+	sw_prod = cp->kcq_prod_idx;
+	while (sw_prod != hw_prod) {
+		kcqe_cnt = cnic_get_kcqes(dev, hw_prod, sw_prod);
+		if (kcqe_cnt == 0)
+			goto done;
+		sw_prod += kcqe_cnt;
+
+		service_kcqes(dev, kcqe_cnt);
+
+		/* Tell compiler that status_blk fields can change. */
+		barrier();
+		if (status_idx != status_blk->status_idx) {
+			status_idx = status_blk->status_idx;
+			cp->kwq_con_idx = status_blk->status_cmd_consumer_index;
+			hw_prod = status_blk->status_completion_producer_index;
+		} else
+			break;
+	}
+
+done:
+	CNIC_WR16(dev, cp->kcq_io_addr, sw_prod);
+
+	cp->kcq_prod_idx = sw_prod;
+	cp->last_status_idx = status_idx;
+	CNIC_WR(dev, BNX2_PCICFG_INT_ACK_CMD, BNX2_CNIC_INT_NUM |
+		BNX2_PCICFG_INT_ACK_CMD_INDEX_VALID | cp->last_status_idx);
+}
+
+static irqreturn_t cnic_irq(int irq, void *dev_instance)
+{
+	struct cnic_dev *dev = dev_instance;
+	struct cnic_local *cp = dev->cnic_priv;
+	u16 prod = cp->kcq_prod_idx & MAX_KCQ_IDX;
+
+	if (cp->ack_int)
+		cp->ack_int(dev);
+
+	prefetch(cp->status_blk);
+	prefetch(&cp->kcq[KCQ_PG(prod)][KCQ_IDX(prod)]);
+
+	if (likely(test_bit(CNIC_F_CNIC_UP, &dev->flags)))
+		tasklet_schedule(&cp->cnic_irq_task);
+
+	return IRQ_HANDLED;
+}
+
+static void cnic_ulp_stop(struct cnic_dev *dev)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+	int if_type;
+
+	rcu_read_lock();
+	for (if_type = 0; if_type < MAX_CNIC_ULP_TYPE; if_type++) {
+		struct cnic_ulp_ops *ulp_ops;
+
+		ulp_ops = rcu_dereference(cp->ulp_ops[if_type]);
+		if (!ulp_ops)
+			continue;
+
+		if (test_and_clear_bit(ULP_F_START, &cp->ulp_flags[if_type]))
+			ulp_ops->cnic_stop(cp->ulp_handle[if_type]);
+	}
+	rcu_read_unlock();
+}
+
+static void cnic_ulp_start(struct cnic_dev *dev)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+	int if_type;
+
+	rcu_read_lock();
+	for (if_type = 0; if_type < MAX_CNIC_ULP_TYPE; if_type++) {
+		struct cnic_ulp_ops *ulp_ops;
+
+		ulp_ops = rcu_dereference(cp->ulp_ops[if_type]);
+		if (!ulp_ops)
+			continue;
+
+		if (!test_and_set_bit(ULP_F_START, &cp->ulp_flags[if_type]))
+			ulp_ops->cnic_start(cp->ulp_handle[if_type]);
+	}
+	rcu_read_unlock();
+}
+
+static int cnic_ctl(void *data, struct cnic_ctl_info *info)
+{
+	struct cnic_dev *dev = data;
+
+	switch (info->cmd) {
+	case CNIC_CTL_STOP_CMD:
+		cnic_hold(dev);
+		mutex_lock(&cnic_lock);
+
+		clear_bit(CNIC_F_IF_UP, &dev->flags);
+		cnic_ulp_stop(dev);
+		cnic_stop_hw(dev);
+
+		mutex_unlock(&cnic_lock);
+		cnic_put(dev);
+		break;
+	case CNIC_CTL_START_CMD:
+		cnic_hold(dev);
+		mutex_lock(&cnic_lock);
+
+		set_bit(CNIC_F_IF_UP, &dev->flags);
+		if (dev->use_count) {
+			if (!cnic_start_hw(dev))
+				cnic_ulp_start(dev);
+		}
+		mutex_unlock(&cnic_lock);
+		cnic_put(dev);
+		break;
+	default:
+		return -EINVAL;
+	}
+	return 0;
+}
+
+
+static void cnic_ulp_init(struct cnic_dev *dev)
+{
+	int i;
+	struct cnic_local *cp = dev->cnic_priv;
+
+	rcu_read_lock();
+	for (i = 0; i < MAX_CNIC_ULP_TYPE_EXT; i++) {
+		struct cnic_ulp_ops *ulp_ops;
+
+		ulp_ops = rcu_dereference(cnic_ulp_tbl[i]);
+		if (!ulp_ops || !try_module_get(ulp_ops->owner))
+			continue;
+
+		if (!test_and_set_bit(ULP_F_INIT, &cp->ulp_flags[i]))
+			ulp_ops->cnic_init(dev);
+
+		module_put(ulp_ops->owner);
+	}
+	rcu_read_unlock();
+}
+
+static void cnic_ulp_exit(struct cnic_dev *dev)
+{
+	int i;
+	struct cnic_local *cp = dev->cnic_priv;
+
+	rcu_read_lock();
+	for (i = 0; i < MAX_CNIC_ULP_TYPE_EXT; i++) {
+		struct cnic_ulp_ops *ulp_ops;
+
+		ulp_ops = rcu_dereference(cnic_ulp_tbl[i]);
+		if (!ulp_ops || !try_module_get(ulp_ops->owner))
+			continue;
+
+		if (test_and_clear_bit(ULP_F_INIT, &cp->ulp_flags[i]))
+			ulp_ops->cnic_exit(dev);
+
+		module_put(ulp_ops->owner);
+	}
+	rcu_read_unlock();
+}
+
+static int cnic_queue_work(struct cnic_local *cp, u32 work_type, void *data)
+{
+	struct cnic_work_node *node;
+	int bytes = sizeof(u32 *);
+
+	spin_lock_bh(&cp->wr_lock);
+
+	node = &cp->cnic_work_ring[cp->cnic_wr_prod];
+	node->work_type = work_type;
+	if (work_type == WORK_TYPE_KCQE)
+		bytes = sizeof(struct kcqe);
+	if (work_type == WORK_TYPE_REDIRECT)
+		bytes = sizeof(struct cnic_redirect_entry);
+	memcpy(&node->work_data, data, bytes);
+	cp->cnic_wr_prod++;
+	cp->cnic_wr_prod &= WORK_RING_SIZE_MASK;
+
+	spin_unlock_bh(&cp->wr_lock);
+	return 0;
+}
+
+static int cnic_cm_offload_pg(struct cnic_sock *csk)
+{
+	struct cnic_dev *dev = csk->dev;
+	struct l4_kwq_offload_pg *l4kwqe;
+	struct kwqe *wqes[1];
+	struct neighbour *neigh = csk->dst->neighbour;
+	struct net_device *netdev = neigh->dev;
+
+	l4kwqe = (struct l4_kwq_offload_pg *) &csk->kwqe1;
+	memset(l4kwqe, 0, sizeof(*l4kwqe));
+	wqes[0] = (struct kwqe *) l4kwqe;
+
+	l4kwqe->op_code = L4_KWQE_OPCODE_VALUE_OFFLOAD_PG;
+	l4kwqe->flags =
+		L4_LAYER_CODE << L4_KWQ_OFFLOAD_PG_LAYER_CODE_SHIFT;
+	l4kwqe->l2hdr_nbytes = ETH_HLEN;
+	l4kwqe->da0 = neigh->ha[0];
+	l4kwqe->da1 = neigh->ha[1];
+	l4kwqe->da2 = neigh->ha[2];
+	l4kwqe->da3 = neigh->ha[3];
+	l4kwqe->da4 = neigh->ha[4];
+	l4kwqe->da5 = neigh->ha[5];
+
+	l4kwqe->sa0 = netdev->dev_addr[0];
+	l4kwqe->sa1 = netdev->dev_addr[1];
+	l4kwqe->sa2 = netdev->dev_addr[2];
+	l4kwqe->sa3 = netdev->dev_addr[3];
+	l4kwqe->sa4 = netdev->dev_addr[4];
+	l4kwqe->sa5 = netdev->dev_addr[5];
+
+	l4kwqe->etype = ETH_P_IP;
+	l4kwqe->ipid_count = DEF_IPID_COUNT;
+	l4kwqe->host_opaque = csk->l5_cid;
+
+	if (csk->vlan_id) {
+		l4kwqe->pg_flags |= L4_KWQ_OFFLOAD_PG_VLAN_TAGGING;
+		l4kwqe->vlan_tag = csk->vlan_id;
+		l4kwqe->l2hdr_nbytes += 4;
+	}
+
+	return (dev->submit_kwqes(dev, wqes, 1));
+}
+
+static int cnic_cm_update_pg(struct cnic_sock *csk)
+{
+	struct cnic_dev *dev = csk->dev;
+	struct l4_kwq_update_pg *l4kwqe;
+	struct kwqe *wqes[1];
+	struct neighbour *neigh = csk->dst->neighbour;
+
+	l4kwqe = (struct l4_kwq_update_pg *) &csk->kwqe1;
+	memset(l4kwqe, 0, sizeof(*l4kwqe));
+	wqes[0] = (struct kwqe *) l4kwqe;
+
+	l4kwqe->opcode = L4_KWQE_OPCODE_VALUE_UPDATE_PG;
+	l4kwqe->flags =
+		L4_LAYER_CODE << L4_KWQ_UPDATE_PG_LAYER_CODE_SHIFT;
+	l4kwqe->pg_cid = csk->pg_cid;
+	l4kwqe->da0 = neigh->ha[0];
+	l4kwqe->da1 = neigh->ha[1];
+	l4kwqe->da2 = neigh->ha[2];
+	l4kwqe->da3 = neigh->ha[3];
+	l4kwqe->da4 = neigh->ha[4];
+	l4kwqe->da5 = neigh->ha[5];
+
+	l4kwqe->pg_host_opaque = 0;
+	l4kwqe->pg_valids = L4_KWQ_UPDATE_PG_VALIDS_DA;
+
+	return (dev->submit_kwqes(dev, wqes, 1));
+}
+
+static int cnic_cm_upload_pg(struct cnic_sock *csk)
+{
+	struct cnic_dev *dev = csk->dev;
+	struct l4_kwq_upload *l4kwqe;
+	struct kwqe *wqes[1];
+
+	l4kwqe = (struct l4_kwq_upload *) &csk->kwqe1;
+	memset(l4kwqe, 0, sizeof(*l4kwqe));
+	wqes[0] = (struct kwqe *) l4kwqe;
+
+	l4kwqe->opcode = L4_KWQE_OPCODE_VALUE_UPLOAD_PG;
+	l4kwqe->flags =
+		L4_LAYER_CODE << L4_KWQ_UPLOAD_LAYER_CODE_SHIFT;
+	l4kwqe->cid = csk->pg_cid;
+
+	return (dev->submit_kwqes(dev, wqes, 1));
+}
+
+static void cnic_redirect(struct cnic_local *cp, struct dst_entry *new,
+			  struct dst_entry *old)
+{
+	int i, found = 0;
+
+	for (i = 0; i < MAX_CM_SK_TBL_SZ && !found; i++) {
+		struct cnic_sock *csk;
+		struct cnic_redirect_entry cnic_redir;
+
+		csk = &cp->csk_tbl[i];
+		csk_hold(csk);
+		if (cnic_in_use(csk) && csk->dst == old) {
+			found = 1;
+			dst_hold(new);
+			dst_hold(old);
+
+			cnic_redir.old_dst = old;
+			cnic_redir.new_dst = new;
+			cnic_queue_work(cp, WORK_TYPE_REDIRECT, &cnic_redir);
+			tasklet_schedule(&cp->cnic_task);
+		}
+		csk_put(csk);
+	}
+}
+
+static void cnic_update_neigh(struct cnic_local *cp, struct neighbour *neigh)
+{
+	int i, found = 0;
+
+	for (i = 0; i < MAX_CM_SK_TBL_SZ && !found; i++) {
+		struct cnic_sock *csk;
+
+		csk = &cp->csk_tbl[i];
+		csk_hold(csk);
+		if (cnic_in_use(csk) && csk->dst) {
+			if (csk->dst->neighbour == neigh) {
+				found = 1;
+				neigh_hold(neigh);
+
+				cnic_queue_work(cp, WORK_TYPE_NEIGH_UPDATE,
+						&neigh);
+				tasklet_schedule(&cp->cnic_task);
+			}
+		}
+		csk_put(csk);
+	}
+}
+
+static int cnic_net_callback(struct notifier_block *this, unsigned long event,
+	void *ptr)
+{
+	struct cnic_local *cp = container_of(this, struct cnic_local, cm_nb);
+
+	if (event == NETEVENT_NEIGH_UPDATE) {
+		struct neighbour *neigh = ptr;
+
+		cnic_update_neigh(cp, neigh);
+
+	} else if (event == NETEVENT_REDIRECT) {
+		struct netevent_redirect *netevent = ptr;
+		struct dst_entry *old_dst = netevent->old;
+		struct dst_entry *new_dst = netevent->new;
+
+		cnic_redirect(cp, new_dst, old_dst);
+	}
+	return 0;
+}
+
+static int cnic_cm_conn_req(struct cnic_sock *csk)
+{
+	struct cnic_dev *dev = csk->dev;
+	struct l4_kwq_connect_req1 *l4kwqe1;
+	struct l4_kwq_connect_req2 *l4kwqe2;
+	struct l4_kwq_connect_req3 *l4kwqe3;
+	struct kwqe *wqes[3];
+	u8 tcp_flags = 0;
+	int num_wqes = 2;
+
+	l4kwqe1 = (struct l4_kwq_connect_req1 *) &csk->kwqe1;
+	l4kwqe2 = (struct l4_kwq_connect_req2 *) &csk->kwqe2;
+	l4kwqe3 = (struct l4_kwq_connect_req3 *) &csk->kwqe3;
+	memset(l4kwqe1, 0, sizeof(*l4kwqe1));
+	memset(l4kwqe2, 0, sizeof(*l4kwqe2));
+	memset(l4kwqe3, 0, sizeof(*l4kwqe3));
+
+	l4kwqe3->op_code = L4_KWQE_OPCODE_VALUE_CONNECT3;
+	l4kwqe3->flags =
+		L4_LAYER_CODE << L4_KWQ_CONNECT_REQ3_LAYER_CODE_SHIFT;
+	l4kwqe3->ka_timeout = csk->ka_timeout;
+	l4kwqe3->ka_interval = csk->ka_interval;
+	l4kwqe3->ka_max_probe_count = csk->ka_max_probe_count;
+	l4kwqe3->tos = csk->tos;
+	l4kwqe3->ttl = csk->ttl;
+	l4kwqe3->snd_seq_scale = csk->snd_seq_scale;
+	l4kwqe3->pmtu = dst_mtu(csk->dst);
+	l4kwqe3->rcv_buf = csk->rcv_buf;
+	l4kwqe3->snd_buf = csk->snd_buf;
+	l4kwqe3->seed = csk->seed;
+
+	wqes[0] = (struct kwqe *) l4kwqe1;
+	if (test_bit(SK_F_IPV6, &csk->flags)) {
+		wqes[1] = (struct kwqe *) l4kwqe2;
+		wqes[2] = (struct kwqe *) l4kwqe3;
+		num_wqes = 3;
+
+		l4kwqe1->conn_flags = L4_KWQ_CONNECT_REQ1_IP_V6;
+		l4kwqe2->op_code = L4_KWQE_OPCODE_VALUE_CONNECT2;
+		l4kwqe2->flags =
+			L4_KWQ_CONNECT_REQ2_LINKED_WITH_NEXT |
+			L4_LAYER_CODE << L4_KWQ_CONNECT_REQ2_LAYER_CODE_SHIFT;
+		l4kwqe2->src_ip_v6_2 = be32_to_cpu(csk->src_ip[1]);
+		l4kwqe2->src_ip_v6_3 = be32_to_cpu(csk->src_ip[2]);
+		l4kwqe2->src_ip_v6_4 = be32_to_cpu(csk->src_ip[3]);
+		l4kwqe2->dst_ip_v6_2 = be32_to_cpu(csk->dst_ip[1]);
+		l4kwqe2->dst_ip_v6_3 = be32_to_cpu(csk->dst_ip[2]);
+		l4kwqe2->dst_ip_v6_4 = be32_to_cpu(csk->dst_ip[3]);
+		l4kwqe3->mss = l4kwqe3->pmtu - sizeof(struct ipv6hdr) -
+			       sizeof(struct tcphdr);
+	} else {
+		wqes[1] = (struct kwqe *) l4kwqe3;
+		l4kwqe3->mss = l4kwqe3->pmtu - sizeof(struct iphdr) -
+			       sizeof(struct tcphdr);
+	}
+
+	l4kwqe1->op_code = L4_KWQE_OPCODE_VALUE_CONNECT1;
+	l4kwqe1->flags =
+		(L4_LAYER_CODE << L4_KWQ_CONNECT_REQ1_LAYER_CODE_SHIFT) |
+		 L4_KWQ_CONNECT_REQ3_LINKED_WITH_NEXT;
+	l4kwqe1->cid = csk->cid;
+	l4kwqe1->pg_cid = csk->pg_cid;
+	l4kwqe1->src_ip = be32_to_cpu(csk->src_ip[0]);
+	l4kwqe1->dst_ip = be32_to_cpu(csk->dst_ip[0]);
+	l4kwqe1->src_port = be16_to_cpu(csk->src_port);
+	l4kwqe1->dst_port = be16_to_cpu(csk->dst_port);
+	if (csk->tcp_flags & SK_TCP_NO_DELAY_ACK)
+		tcp_flags |= L4_KWQ_CONNECT_REQ1_NO_DELAY_ACK;
+	if (csk->tcp_flags & SK_TCP_KEEP_ALIVE)
+		tcp_flags |= L4_KWQ_CONNECT_REQ1_KEEP_ALIVE;
+	if (csk->tcp_flags & SK_TCP_NAGLE)
+		tcp_flags |= L4_KWQ_CONNECT_REQ1_NAGLE_ENABLE;
+	if (csk->tcp_flags & SK_TCP_TIMESTAMP)
+		tcp_flags |= L4_KWQ_CONNECT_REQ1_TIME_STAMP;
+	if (csk->tcp_flags & SK_TCP_SACK)
+		tcp_flags |= L4_KWQ_CONNECT_REQ1_SACK;
+	if (csk->tcp_flags & SK_TCP_SEG_SCALING)
+		tcp_flags |= L4_KWQ_CONNECT_REQ1_SEG_SCALING;
+	
+	l4kwqe1->tcp_flags = tcp_flags;
+
+	return (dev->submit_kwqes(dev, wqes, num_wqes));
+}
+
+static int cnic_cm_close_req(struct cnic_sock *csk)
+{
+	struct cnic_dev *dev = csk->dev;
+	struct l4_kwq_close_req *l4kwqe;
+	struct kwqe *wqes[1];
+
+	l4kwqe = (struct l4_kwq_close_req *) &csk->kwqe2;
+	memset(l4kwqe, 0, sizeof(*l4kwqe));
+	wqes[0] = (struct kwqe *) l4kwqe;
+
+	l4kwqe->op_code = L4_KWQE_OPCODE_VALUE_CLOSE;
+	l4kwqe->flags = L4_LAYER_CODE << L4_KWQ_CLOSE_REQ_LAYER_CODE_SHIFT;
+	l4kwqe->cid = csk->cid;
+
+	return (dev->submit_kwqes(dev, wqes, 1));
+}
+
+static int cnic_cm_abort_req(struct cnic_sock *csk)
+{
+	struct cnic_dev *dev = csk->dev;
+	struct l4_kwq_reset_req *l4kwqe;
+	struct kwqe *wqes[1];
+
+	l4kwqe = (struct l4_kwq_reset_req *) &csk->kwqe2;
+	memset(l4kwqe, 0, sizeof(*l4kwqe));
+	wqes[0] = (struct kwqe *) l4kwqe;
+
+	l4kwqe->op_code = L4_KWQE_OPCODE_VALUE_RESET;
+	l4kwqe->flags = L4_LAYER_CODE << L4_KWQ_RESET_REQ_LAYER_CODE_SHIFT;
+	l4kwqe->cid = csk->cid;
+
+	return (dev->submit_kwqes(dev, wqes, 1));
+}
+
+static int cnic_cm_create(struct cnic_dev *dev, int ulp_type, u32 cid,
+			  u32 l5_cid, struct cnic_sock **csk, void *context)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+	struct cnic_sock *csk1;
+
+	if (l5_cid >= MAX_CM_SK_TBL_SZ)
+		return -EINVAL;
+		
+	csk1 = &cp->csk_tbl[l5_cid];
+	if (test_and_set_bit(SK_F_INUSE, &csk1->flags))
+		return -EINVAL;
+
+	csk1->dev = dev;
+	csk1->cid = cid;
+	csk1->l5_cid = l5_cid;
+	csk1->ulp_type = ulp_type;
+	csk1->context = context;
+
+	csk1->ka_timeout = DEF_KA_TIMEOUT;
+	csk1->ka_interval = DEF_KA_INTERVAL;
+	csk1->ka_max_probe_count = DEF_KA_MAX_PROBE_COUNT;
+	csk1->tos = DEF_TOS;
+	csk1->ttl = DEF_TTL;
+	csk1->snd_seq_scale = DEF_SND_SEQ_SCALE;
+	csk1->rcv_buf = DEF_RCV_BUF;
+	csk1->snd_buf = DEF_SND_BUF;
+	csk1->seed = DEF_SEED;
+
+	*csk = csk1;
+
+	return 0;
+}
+
+static void cnic_close_conn(struct cnic_sock *csk)
+{
+	clear_bit(SK_F_OFFLD_COMPLETE, &csk->flags);
+	cnic_cm_upload_pg(csk);
+	clear_bit(SK_F_PG_OFFLD_COMPLETE, &csk->flags);
+	clear_bit(SK_F_OFFLD_SCHED, &csk->flags);
+}
+
+static void cnic_cm_cleanup(struct cnic_sock *csk)
+{
+	if (csk->dst) {
+		if (csk->dst->neighbour)
+			neigh_release(csk->dst->neighbour);
+		dst_release(csk->dst);
+		csk->dst = NULL;
+	}
+}
+
+static int cnic_cm_destroy(struct cnic_sock *csk)
+{
+	if (!cnic_in_use(csk))
+		return -EINVAL;
+
+	clear_bit(SK_F_INUSE, &csk->flags);
+	smp_mb__after_clear_bit();
+	while (atomic_read(&csk->ref_count) != 0)
+		msleep(1);
+	cnic_cm_cleanup(csk);
+
+	csk->flags = 0;
+	return 0;
+}
+
+static inline u16 cnic_get_vlan(struct net_device *dev,
+				struct net_device **vlan_dev)
+{
+	if (dev->priv_flags & IFF_802_1Q_VLAN) {
+		*vlan_dev = vlan_dev_info(dev)->real_dev;
+		return vlan_dev_info(dev)->vlan_id;
+	}
+	*vlan_dev = dev;
+	return 0;
+}
+
+static int cnic_get_v4_route(struct sockaddr_in *dst_addr,
+			     struct sockaddr_in *src_addr,
+			     struct dst_entry **dst)
+{
+	struct flowi fl;
+	int err;
+	struct rtable *rt;
+
+	memset(&fl, 0, sizeof(fl));
+	fl.nl_u.ip4_u.daddr = dst_addr->sin_addr.s_addr;
+	if (src_addr)
+		fl.nl_u.ip4_u.saddr = src_addr->sin_addr.s_addr;
+
+	err = ip_route_output_key(&init_net, &rt, &fl);
+	if (!err)
+		*dst = &rt->u.dst;
+	return err;
+}
+
+static int cnic_get_v6_route(struct sockaddr_in6 *dst_addr,
+			     struct sockaddr_in6 *src_addr,
+			     struct dst_entry **dst)
+{
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+	struct flowi fl;
+
+	memset(&fl, 0, sizeof(fl));
+	ipv6_addr_copy(&fl.fl6_dst, &dst_addr->sin6_addr);
+	if (ipv6_addr_type(&fl.fl6_dst) & IPV6_ADDR_LINKLOCAL)
+		fl.oif = dst_addr->sin6_scope_id;
+
+	if (src_addr)
+		ipv6_addr_copy(&fl.fl6_src, &src_addr->sin6_addr);
+
+	*dst = ip6_route_output(NULL, &fl);
+	if (*dst)
+		return 0;
+#endif
+
+	return -ENETUNREACH;
+}
+
+static struct cnic_dev *cnic_cm_select_dev(struct sockaddr_in *dst_addr,
+					   int ulp_type)
+{
+	struct cnic_dev *dev = NULL;
+	struct dst_entry *dst;
+	struct net_device *netdev = NULL;
+	int err = -ENETUNREACH, found = 0;
+
+	if (dst_addr->sin_family == AF_INET)
+		err = cnic_get_v4_route(dst_addr, NULL, &dst);
+	else if (dst_addr->sin_family == AF_INET6) {
+		struct sockaddr_in6 *dst_addr6 =
+			(struct sockaddr_in6 *) dst_addr;
+
+		err = cnic_get_v6_route(dst_addr6, NULL, &dst);
+	} else
+		return NULL;
+
+	if (err)
+		return NULL;
+
+	if (!dst->dev)
+		goto done;
+
+	cnic_get_vlan(dst->dev, &netdev);
+
+	read_lock(&cnic_dev_lock);
+	list_for_each_entry(dev, &cnic_dev_list, list) {
+		if (netdev == dev->netdev) {
+			found = 1;
+			break;
+		}
+	}
+	read_unlock(&cnic_dev_lock);
+
+done:
+	dst_release(dst);
+	if (!found)
+		dev = NULL;
+	return dev;
+}
+
+static int cnic_resolve_addr(struct cnic_sock *csk)
+{
+	struct neighbour *neigh = csk->dst->neighbour;
+	int err = 0;
+
+	if (neigh->nud_state & NUD_VALID) {
+		err = -EINVAL;
+		if (cnic_offld_prep(csk))
+			err = cnic_cm_offload_pg(csk);
+		goto done;
+	}
+
+	set_bit(SK_F_NDISC_WAITING, &csk->flags);
+	neigh_event_send(neigh, NULL);
+done:
+	return err;
+}
+
+static int cnic_get_route(struct cnic_sock *csk, struct cnic_sockaddr *saddr)
+{
+	struct cnic_dev *dev = csk->dev;
+	int is_v6, err;
+	struct dst_entry *dst;
+	struct net_device *realdev;
+
+	if (saddr->local.v6.sin6_family == AF_INET6 &&
+	    saddr->remote.v6.sin6_family == AF_INET6)
+		is_v6 = 1;
+	else if (saddr->local.v4.sin_family == AF_INET &&
+		 saddr->remote.v4.sin_family == AF_INET)
+		is_v6 = 0;
+	else
+		return -EINVAL;
+
+	clear_bit(SK_F_IPV6, &csk->flags);
+
+	if (is_v6) {
+		set_bit(SK_F_IPV6, &csk->flags);
+		err = cnic_get_v6_route(&saddr->remote.v6,
+					&saddr->local.v6, &dst);
+		if (err)
+			return err;
+
+		if (!dst || dst->error || !dst->dev)
+			goto err_out;
+
+		ipv6_get_saddr(dst, &saddr->remote.v6.sin6_addr,
+			       &saddr->local.v6.sin6_addr);
+
+		memcpy(&csk->src_ip[0], &saddr->local.v6.sin6_addr,
+		       sizeof(struct in6_addr));
+		memcpy(&csk->dst_ip[0], &saddr->remote.v6.sin6_addr,
+		       sizeof(struct in6_addr));
+		csk->src_port = saddr->local.v6.sin6_port;
+		csk->dst_port = saddr->remote.v6.sin6_port;
+
+	} else {
+		err = cnic_get_v4_route(&saddr->remote.v4, &saddr->local.v4,
+					&dst);
+		if (err)
+			return err;
+
+		if (!dst || dst->error || !dst->dev)
+			goto err_out;
+
+		csk->dst_ip[0] = saddr->remote.v4.sin_addr.s_addr;
+		csk->src_ip[0] = saddr->local.v4.sin_addr.s_addr;
+		csk->src_port = saddr->local.v4.sin_port;
+		csk->dst_port = saddr->remote.v4.sin_port;
+
+		if (csk->src_ip[0] == 0) {
+			csk->src_ip[0] =
+				inet_select_addr(dst->dev, csk->dst_ip[0],
+						 RT_SCOPE_LINK);
+		}
+	}
+
+	csk->vlan_id = cnic_get_vlan(dst->dev, &realdev);
+	if (realdev != dev->netdev)
+		goto err_out;
+
+	csk->dst = dst;
+	return 0;
+
+err_out:
+	dst_release(dst);
+	return -ENETUNREACH;
+}
+
+static int cnic_cm_connect(struct cnic_sock *csk, struct cnic_sockaddr *saddr)
+{
+	struct neighbour *neigh;
+	int err = 0;
+
+	if (!cnic_in_use(csk))
+		return -EINVAL;
+
+	if (test_and_set_bit(SK_F_CONNECT_START, &csk->flags))
+		return -EINVAL;
+
+	clear_bit(SK_F_OFFLD_SCHED, &csk->flags);
+
+	err = cnic_get_route(csk, saddr);
+	if (err)
+		goto err_out;
+
+	neigh = csk->dst->neighbour;
+	if (!neigh)
+		goto err_out;
+
+	neigh_hold(neigh);
+
+	err = cnic_resolve_addr(csk);
+	if (!err)
+		return 0;
+
+	neigh_release(neigh);
+
+err_out:
+	if (csk->dst) {
+		dst_release(csk->dst);
+		csk->dst = NULL;
+	}
+	clear_bit(SK_F_CONNECT_START, &csk->flags);
+	return err;
+}
+
+static int cnic_cm_abort(struct cnic_sock *csk)
+{
+	if (!cnic_in_use(csk))
+		return -EINVAL;
+
+	clear_bit(SK_F_NDISC_WAITING, &csk->flags);
+	clear_bit(SK_F_CONNECT_START, &csk->flags);
+	smp_mb__after_clear_bit();
+	if (cnic_abort_prep(csk))
+		return (cnic_cm_abort_req(csk));
+
+	/* Getting here means that we haven't started connect, or
+	 * connect was not successful.
+	 */
+
+	if (test_bit(SK_F_PG_OFFLD_COMPLETE, &csk->flags))
+		cnic_close_conn(csk);
+
+	cnic_cm_cleanup(csk);
+	cnic_abort_done(csk);
+
+	return 0;
+}
+
+static int cnic_cm_close(struct cnic_sock *csk)
+{
+	if (!cnic_in_use(csk))
+		return -EINVAL;
+
+	if (test_bit(SK_F_OFFLD_COMPLETE, &csk->flags))
+		return (cnic_cm_close_req(csk));
+
+	return -EINVAL;
+}
+
+static void cnic_cm_upcall(struct cnic_local *cp, struct cnic_sock *csk,
+			   u8 opcode)
+{
+	struct cnic_ulp_ops *ulp_ops;
+	int ulp_type = csk->ulp_type;
+
+	rcu_read_lock();
+	ulp_ops = rcu_dereference(cp->ulp_ops[ulp_type]);
+	if (ulp_ops) {
+		if (opcode == L4_KCQE_OPCODE_VALUE_CONNECT_COMPLETE)
+			ulp_ops->cm_connect_complete(csk);
+		else if (opcode == L4_KCQE_OPCODE_VALUE_CLOSE_COMP)
+			ulp_ops->cm_close_complete(csk);
+		else if (opcode == L4_KCQE_OPCODE_VALUE_RESET_RECEIVED)
+			ulp_ops->cm_remote_abort(csk);
+		else if (opcode == L4_KCQE_OPCODE_VALUE_RESET_COMP)
+			ulp_ops->cm_abort_complete(csk);
+		else if (opcode == L4_KCQE_OPCODE_VALUE_CLOSE_RECEIVED)
+			ulp_ops->cm_remote_close(csk);
+	}
+	rcu_read_unlock();
+}
+
+static int cnic_cm_set_pg(struct cnic_sock *csk)
+{
+	struct neighbour *neigh = csk->dst->neighbour;
+	int valid = neigh->nud_state & NUD_VALID;
+
+	if (!valid) {
+		if (test_and_clear_bit(SK_F_NDISC_WAITING, &csk->flags)) {
+			clear_bit(SK_F_CONNECT_START, &csk->flags);
+			cnic_cm_cleanup(csk);
+			return -ETIMEDOUT;
+		}
+	}
+
+	if (cnic_offld_prep(csk)) {
+		if (test_bit(SK_F_PG_OFFLD_COMPLETE, &csk->flags))
+			cnic_cm_update_pg(csk);
+		else
+			cnic_cm_offload_pg(csk);
+	}
+	clear_bit(SK_F_NDISC_WAITING, &csk->flags);
+	return 0;
+}
+
+static void cnic_cm_process_neigh(struct cnic_dev *dev, struct neighbour *neigh)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+	int i;
+
+	for (i = 0; i < MAX_CM_SK_TBL_SZ; i++) {
+		struct cnic_sock *csk;
+		int abort = 0;
+
+		csk = &cp->csk_tbl[i];
+		csk_hold(csk);
+		if (cnic_in_use(csk) && csk->dst &&
+		    csk->dst->neighbour == neigh) {
+			if (cnic_cm_set_pg(csk))
+				abort = 1;
+		}
+		if (abort)
+			cnic_cm_upcall(cp, csk,
+				L4_KCQE_OPCODE_VALUE_CONNECT_COMPLETE);
+		csk_put(csk);
+	}
+	neigh_release(neigh);
+}
+
+static void cnic_cm_process_redirect(struct cnic_dev *dev,
+				     struct cnic_redirect_entry *redir)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+	int i;
+
+	for (i = 0; i < MAX_CM_SK_TBL_SZ; i++) {
+		struct cnic_sock *csk;
+		int abort = 0;
+
+		csk = &cp->csk_tbl[i];
+		csk_hold(csk);
+		if (cnic_in_use(csk) &&
+		    csk->dst == redir->old_dst) {
+			csk->dst = redir->new_dst;
+			dst_hold(csk->dst);
+			neigh_hold(csk->dst->neighbour);
+			if (redir->old_dst->neighbour);
+				neigh_release(redir->old_dst->neighbour);
+			dst_release(redir->old_dst);
+			if (cnic_cm_set_pg(csk))
+				abort = 1;
+		}
+		if (abort)
+			cnic_cm_upcall(cp, csk,
+				L4_KCQE_OPCODE_VALUE_CONNECT_COMPLETE);
+		csk_put(csk);
+	}
+
+	dst_release(redir->new_dst);
+	dst_release(redir->old_dst);
+}
+
+static void cnic_cm_process_offld_pg(struct cnic_dev *dev, struct l4_kcq *kcqe)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+	u32 l5_cid = kcqe->pg_host_opaque;
+	u8 opcode = kcqe->op_code;
+	struct cnic_sock *csk = &cp->csk_tbl[l5_cid];
+
+	if (!cnic_in_use(csk))
+		return;
+
+	csk->pg_cid = kcqe->pg_cid;
+	if (opcode == L4_KCQE_OPCODE_VALUE_UPDATE_PG) {
+		clear_bit(SK_F_OFFLD_SCHED, &csk->flags);
+		return;
+	}
+	set_bit(SK_F_PG_OFFLD_COMPLETE, &csk->flags);
+	cnic_cm_conn_req(csk);
+}
+
+static void cnic_cm_process_kcqe(struct cnic_dev *dev, struct kcqe *kcqe)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+	struct l4_kcq *l4kcqe = (struct l4_kcq *) kcqe;
+	u8 opcode = l4kcqe->op_code;
+	u32 l5_cid;
+	struct cnic_sock *csk;
+
+	if (opcode == L4_KCQE_OPCODE_VALUE_OFFLOAD_PG ||
+	    opcode == L4_KCQE_OPCODE_VALUE_UPDATE_PG) {
+		cnic_cm_process_offld_pg(dev, l4kcqe);
+		return;
+	}
+
+	l5_cid = l4kcqe->conn_id;
+	if (l5_cid >= MAX_CM_SK_TBL_SZ)
+		return;
+
+	csk = &cp->csk_tbl[l5_cid];
+
+	if (!cnic_in_use(csk))
+		return;
+
+	if (opcode == L4_KCQE_OPCODE_VALUE_CONNECT_COMPLETE) {
+
+		if (l4kcqe->status == 0)
+			set_bit(SK_F_OFFLD_COMPLETE, &csk->flags);
+
+		smp_mb__before_clear_bit();
+		clear_bit(SK_F_OFFLD_SCHED, &csk->flags);
+		cnic_cm_upcall(cp, csk, opcode);
+
+	} else if (opcode == L4_KCQE_OPCODE_VALUE_CLOSE_COMP ||
+		   opcode == L4_KCQE_OPCODE_VALUE_RESET_COMP ||
+		   opcode == L4_KCQE_OPCODE_VALUE_RESET_RECEIVED) {
+
+		clear_bit(SK_F_CONNECT_START, &csk->flags);
+		cnic_close_conn(csk);
+		cnic_cm_cleanup(csk);
+		cnic_abort_done(csk);
+		cnic_cm_upcall(cp, csk, opcode);
+
+	} else if (opcode == L4_KCQE_OPCODE_VALUE_CLOSE_RECEIVED) {
+		cnic_cm_upcall(cp, csk, opcode);
+	}
+}
+
+static void cnic_cm_indicate_kcqe(void *data, struct kcqe *kcqe[], u32 num_cqe)
+{
+	struct cnic_dev *dev = data;
+	int i;
+	struct cnic_local *cp = dev->cnic_priv;
+
+	for (i = 0; i < num_cqe; i++)
+		cnic_queue_work(cp, WORK_TYPE_KCQE, kcqe[i]);
+
+	tasklet_schedule(&cp->cnic_task);
+}
+
+static void cnic_cm_indicate_event(void *data, unsigned long event)
+{
+}
+
+static void cnic_cm_dummy(void *data)
+{
+}
+
+static struct cnic_ulp_ops cm_ulp_ops = {
+	.cnic_start		= cnic_cm_dummy,
+	.cnic_stop		= cnic_cm_dummy,
+	.indicate_kcqes		= cnic_cm_indicate_kcqe,
+	.indicate_netevent	= cnic_cm_indicate_event,
+	.indicate_inetevent	= cnic_cm_indicate_event,
+};
+
+static void cnic_task(unsigned long data)
+{
+	struct cnic_local *cp = (struct cnic_local *) data;
+	struct cnic_dev *dev = cp->dev;
+	u32 cons = cp->cnic_wr_cons;
+	u32 prod = cp->cnic_wr_prod;
+
+	while (cons != prod) {
+		struct cnic_work_node *node;
+
+		node = &cp->cnic_work_ring[cons];
+		if (node->work_type == WORK_TYPE_KCQE)
+			cnic_cm_process_kcqe(dev, &node->work_data.kcqe);
+		else if (node->work_type == WORK_TYPE_NEIGH_UPDATE)
+			cnic_cm_process_neigh(dev, node->work_data.neigh);
+		else if (node->work_type == WORK_TYPE_REDIRECT)
+			cnic_cm_process_redirect(dev,
+				&node->work_data.cnic_redir);
+		cons++;
+		cons &= WORK_RING_SIZE_MASK;
+	}
+	cp->cnic_wr_cons = cons;
+}
+
+static void cnic_free_dev(struct cnic_dev *dev)
+{
+	int i = 0;
+
+	while ((atomic_read(&dev->ref_count) != 0) && i < 10) {
+		msleep(100);
+		i++;
+	}
+	if (atomic_read(&dev->ref_count) != 0)
+		printk(KERN_ERR PFX "%s: Failed waiting for ref count to go"
+				    " to zero.\n", dev->netdev->name);
+
+	printk(KERN_INFO PFX "Removed CNIC device: %s\n", dev->netdev->name);
+	dev_put(dev->netdev);
+	kfree(dev);
+}
+
+static void cnic_cm_free_mem(struct cnic_dev *dev)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+
+	kfree(cp->csk_tbl);
+	cp->csk_tbl = NULL;
+}
+
+static int cnic_cm_alloc_mem(struct cnic_dev *dev)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+
+	cp->csk_tbl = kmalloc(sizeof(struct cnic_sock) * MAX_CM_SK_TBL_SZ,
+			      GFP_KERNEL);
+	if (!cp->csk_tbl)
+		return -ENOMEM;
+	memset(cp->csk_tbl, 0, sizeof(struct cnic_sock) * MAX_CM_SK_TBL_SZ);
+	return 0;
+}
+
+static void cnic_cm_stop_bnx2_hw(struct cnic_dev *dev)
+{
+}
+
+static int cnic_cm_init_bnx2_hw(struct cnic_dev *dev)
+{
+	u32 seed;
+
+	get_random_bytes(&seed, 4);
+	cnic_bnx2_ctx_wr(dev, 45, 0, seed);
+	return 0;
+}
+
+static int cnic_cm_open(struct cnic_dev *dev)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+	int err;
+
+	err = cnic_cm_alloc_mem(dev);
+	if (err)
+		return err;
+
+	err = cp->start_cm(dev);
+
+	if (err)
+		goto err_out;
+
+	spin_lock_init(&cp->wr_lock);
+
+	tasklet_init(&cp->cnic_task, &cnic_task, (unsigned long) cp);
+
+	cp->cm_nb.notifier_call = cnic_net_callback;
+	register_netevent_notifier(&cp->cm_nb);
+
+	dev->cm_create = cnic_cm_create;
+	dev->cm_destroy = cnic_cm_destroy;
+	dev->cm_connect = cnic_cm_connect;
+	dev->cm_abort = cnic_cm_abort;
+	dev->cm_close = cnic_cm_close;
+	dev->cm_select_dev = cnic_cm_select_dev;
+
+	cp->ulp_handle[CNIC_ULP_L4] = dev;
+	rcu_assign_pointer(cp->ulp_ops[CNIC_ULP_L4], &cm_ulp_ops);
+	return 0;
+
+err_out:
+	cnic_cm_free_mem(dev);
+	return err;
+}
+
+static int cnic_cm_shutdown(struct cnic_dev *dev)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+	int i;
+
+	cp->stop_cm(dev);
+
+	unregister_netevent_notifier(&cp->cm_nb);
+
+	tasklet_disable(&cp->cnic_task);
+
+	if (!cp->csk_tbl)
+		return 0;
+
+	for (i = 0; i < MAX_CM_SK_TBL_SZ; i++) {
+		struct cnic_sock *csk = &cp->csk_tbl[i];
+
+		clear_bit(SK_F_INUSE, &csk->flags);
+		cnic_cm_cleanup(csk);
+	}
+	cnic_cm_free_mem(dev);
+
+	return 0;
+}
+
+static void cnic_init_context(struct cnic_dev *dev, u32 cid)
+{
+	u32 cid_addr;
+	int i;
+
+	cid_addr = GET_CID_ADDR(cid);
+
+	for (i = 0; i < CTX_SIZE; i += 4)
+		cnic_bnx2_ctx_wr(dev, cid_addr, i, 0);
+}
+
+static int cnic_setup_5709_context(struct cnic_dev *dev, int valid)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+	int ret = 0, i;
+	u32 valid_bit = valid ? BNX2_CTX_HOST_PAGE_TBL_DATA0_VALID : 0;
+
+	if (CHIP_NUM(cp) != CHIP_NUM_5709)
+		return 0;
+
+	for (i = 0; i < cp->ctx_blks; i++) {
+		int j;
+		u32 idx = cp->ctx_arr[i].cid / cp->cids_per_blk;
+		u32 val;
+
+		memset(cp->ctx_arr[i].ctx, 0, BCM_PAGE_SIZE);
+
+		CNIC_WR(dev, BNX2_CTX_HOST_PAGE_TBL_DATA0,
+			(cp->ctx_arr[i].mapping & 0xffffffff) | valid_bit);
+		CNIC_WR(dev, BNX2_CTX_HOST_PAGE_TBL_DATA1,
+			(u64) cp->ctx_arr[i].mapping >> 32);
+		CNIC_WR(dev, BNX2_CTX_HOST_PAGE_TBL_CTRL, idx |
+			BNX2_CTX_HOST_PAGE_TBL_CTRL_WRITE_REQ);
+		for (j = 0; j < 10; j++) {
+
+			val = CNIC_RD(dev, BNX2_CTX_HOST_PAGE_TBL_CTRL);
+			if (!(val & BNX2_CTX_HOST_PAGE_TBL_CTRL_WRITE_REQ))
+				break;
+			udelay(5);
+		}
+		if (val & BNX2_CTX_HOST_PAGE_TBL_CTRL_WRITE_REQ) {
+			ret = -EBUSY;
+			break;
+		}
+	}
+	return ret;
+}
+
+static void cnic_free_irq(struct cnic_dev *dev)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+	struct cnic_eth_dev *ethdev = cp->ethdev;
+
+	if (ethdev->drv_state & CNIC_DRV_STATE_USING_MSIX) {
+		cp->disable_int_sync(dev);
+		tasklet_disable(&cp->cnic_irq_task);
+		free_irq(ethdev->irq_arr[0].vector, dev);
+	}
+}
+
+static int cnic_init_bnx2_irq(struct cnic_dev *dev)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+	struct cnic_eth_dev *ethdev = cp->ethdev;
+
+	if (ethdev->drv_state & CNIC_DRV_STATE_USING_MSIX) {
+		int err, i = 0;
+		int sblk_num = cp->status_blk_num;
+		u32 base = ((sblk_num - 1) * BNX2_HC_SB_CONFIG_SIZE) +
+			   BNX2_HC_SB_CONFIG_1;
+
+		CNIC_WR(dev, base, BNX2_HC_SB_CONFIG_1_ONE_SHOT);
+
+		CNIC_WR(dev, base + BNX2_HC_COMP_PROD_TRIP_OFF, (2 << 16) | 8);
+		CNIC_WR(dev, base + BNX2_HC_COM_TICKS_OFF, (64 << 16) | 220);
+		CNIC_WR(dev, base + BNX2_HC_CMD_TICKS_OFF, (64 << 16) | 220);
+
+		cp->bnx2_status_blk = cp->status_blk;
+		cp->last_status_idx = cp->bnx2_status_blk->status_idx;
+		tasklet_init(&cp->cnic_irq_task, &cnic_service_bnx2_msix,
+			     (unsigned long) dev);
+		err = request_irq(ethdev->irq_arr[0].vector, cnic_irq, 0,
+				  "cnic", dev);
+		if (err) {
+			tasklet_disable(&cp->cnic_irq_task);
+			return err;
+		}
+		while (cp->bnx2_status_blk->status_completion_producer_index &&
+		       i < 10) {
+			CNIC_WR(dev, BNX2_HC_COALESCE_NOW,
+				1 << (11 + sblk_num));
+			udelay(10);
+			i++;
+			barrier();
+		}
+		if (cp->bnx2_status_blk->status_completion_producer_index) {
+			cnic_free_irq(dev);
+			goto failed;
+		}
+
+	} else {
+		struct status_block *sblk = cp->status_blk;
+		u32 hc_cmd = CNIC_RD(dev, BNX2_HC_COMMAND);
+		int i = 0;
+
+		while (sblk->status_completion_producer_index && i < 10) {
+			CNIC_WR(dev, BNX2_HC_COMMAND,
+				hc_cmd | BNX2_HC_COMMAND_COAL_NOW_WO_INT);
+			udelay(10);
+			i++;
+			barrier();
+		}
+		if (sblk->status_completion_producer_index)
+			goto failed;
+
+	}
+	return 0;
+
+failed:
+	printk(KERN_ERR PFX "%s: " "KCQ index not resetting to 0.\n",
+	       dev->netdev->name);
+	return -EBUSY;
+}
+
+static void cnic_enable_bnx2_int(struct cnic_dev *dev)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+	struct cnic_eth_dev *ethdev = cp->ethdev;
+
+	if (!(ethdev->drv_state & CNIC_DRV_STATE_USING_MSIX))
+		return;
+
+	CNIC_WR(dev, BNX2_PCICFG_INT_ACK_CMD, BNX2_CNIC_INT_NUM |
+		BNX2_PCICFG_INT_ACK_CMD_INDEX_VALID | cp->last_status_idx);
+}
+
+static void cnic_disable_bnx2_int_sync(struct cnic_dev *dev)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+	struct cnic_eth_dev *ethdev = cp->ethdev;
+
+	if (!(ethdev->drv_state & CNIC_DRV_STATE_USING_MSIX))
+		return;
+
+	CNIC_WR(dev, BNX2_PCICFG_INT_ACK_CMD, BNX2_CNIC_INT_NUM |
+		BNX2_PCICFG_INT_ACK_CMD_MASK_INT);
+	CNIC_RD(dev, BNX2_PCICFG_INT_ACK_CMD);
+	synchronize_irq(ethdev->irq_arr[0].vector);
+}
+
+static int cnic_start_bnx2_hw(struct cnic_dev *dev)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+	struct cnic_eth_dev *ethdev = cp->ethdev;
+	u32 val;
+	int err;
+
+	val = CNIC_RD(dev, BNX2_MQ_CONFIG);
+	val &= ~BNX2_MQ_CONFIG_KNL_BYP_BLK_SIZE;
+	if (BCM_PAGE_BITS > 12)
+		val |= (12 - 8)  << 4;
+	else
+		val |= (BCM_PAGE_BITS - 8)  << 4;
+
+	CNIC_WR(dev, BNX2_MQ_CONFIG, val);
+
+	CNIC_WR(dev, BNX2_HC_COMP_PROD_TRIP, (2 << 16) | 8);
+	CNIC_WR(dev, BNX2_HC_COM_TICKS, (64 << 16) | 220);
+	CNIC_WR(dev, BNX2_HC_CMD_TICKS, (64 << 16) | 220);
+
+	err = cnic_setup_5709_context(dev, 1);
+	if (err)
+		return err;
+
+	cnic_init_context(dev, KWQ_CID);
+	cnic_init_context(dev, KCQ_CID);
+
+	cp->kwq_cid_addr = GET_CID_ADDR(KWQ_CID);
+	cp->kwq_io_addr = MB_GET_CID_ADDR(KWQ_CID) + L5_KRNLQ_HOST_QIDX;
+
+	cp->max_kwq_idx = MAX_KWQ_IDX;
+	cp->kwq_prod_idx = 0;
+	cp->kwq_con_idx = 0;
+	cp->cnic_local_flags |= CNIC_LCL_FL_KWQ_INIT;
+	
+	/* Initialize the kernel work queue context. */
+	val = KRNLQ_TYPE_TYPE_KRNLQ | KRNLQ_SIZE_TYPE_SIZE |
+	      (BCM_PAGE_BITS - 8) | KRNLQ_FLAGS_QE_SELF_SEQ;
+	cnic_bnx2_ctx_wr(dev, cp->kwq_cid_addr, L5_KRNLQ_TYPE, val);
+	
+	val = (BCM_PAGE_SIZE / sizeof(struct kwqe) - 1) << 16;
+	cnic_bnx2_ctx_wr(dev, cp->kwq_cid_addr, L5_KRNLQ_QE_SELF_SEQ_MAX, val);
+	
+	val = ((BCM_PAGE_SIZE / sizeof(struct kwqe)) << 16) | KWQ_PAGE_CNT;
+	cnic_bnx2_ctx_wr(dev, cp->kwq_cid_addr, L5_KRNLQ_PGTBL_NPAGES, val);
+	
+	val = (u32) ((u64) cp->kwq_info.pgtbl_map >> 32);
+	cnic_bnx2_ctx_wr(dev, cp->kwq_cid_addr, L5_KRNLQ_PGTBL_HADDR_HI, val);
+	
+	val = (u32) cp->kwq_info.pgtbl_map;
+	cnic_bnx2_ctx_wr(dev, cp->kwq_cid_addr, L5_KRNLQ_PGTBL_HADDR_LO, val);
+
+	cp->kcq_cid_addr = GET_CID_ADDR(KCQ_CID);
+	cp->kcq_io_addr = MB_GET_CID_ADDR(KCQ_CID) + L5_KRNLQ_HOST_QIDX;
+	
+	cp->kcq_prod_idx = 0;
+	
+	/* Initialize the kernel complete queue context. */
+	val = KRNLQ_TYPE_TYPE_KRNLQ | KRNLQ_SIZE_TYPE_SIZE |
+	      (BCM_PAGE_BITS - 8) | KRNLQ_FLAGS_QE_SELF_SEQ;
+	cnic_bnx2_ctx_wr(dev, cp->kcq_cid_addr, L5_KRNLQ_TYPE, val);
+	
+	val = (BCM_PAGE_SIZE / sizeof(struct kcqe) - 1) << 16;
+	cnic_bnx2_ctx_wr(dev, cp->kcq_cid_addr, L5_KRNLQ_QE_SELF_SEQ_MAX, val);
+	
+	val = ((BCM_PAGE_SIZE / sizeof(struct kcqe)) << 16) | KCQ_PAGE_CNT;
+	cnic_bnx2_ctx_wr(dev, cp->kcq_cid_addr, L5_KRNLQ_PGTBL_NPAGES, val);
+	
+	val = (u32) ((u64) cp->kcq_info.pgtbl_map >> 32);
+	cnic_bnx2_ctx_wr(dev, cp->kcq_cid_addr, L5_KRNLQ_PGTBL_HADDR_HI, val);
+	
+	val = (u32) cp->kcq_info.pgtbl_map;
+	cnic_bnx2_ctx_wr(dev, cp->kcq_cid_addr, L5_KRNLQ_PGTBL_HADDR_LO, val);
+
+	if (ethdev->drv_state & CNIC_DRV_STATE_USING_MSIX) {
+		u32 sb_id = cp->status_blk_num;
+		u32 sb = KRNLQ_STATUSB_NUM_CNIC_MSIX(sb_id);
+
+		cnic_bnx2_ctx_wr(dev, cp->kwq_cid_addr, L5_KRNLQ_HOST_QIDX, sb);
+		cnic_bnx2_ctx_wr(dev, cp->kcq_cid_addr, L5_KRNLQ_HOST_QIDX, sb);
+	}
+
+	/* Enable Commnad Scheduler notification when we write to the
+	 * host producer index of the kernel contexts. */
+	CNIC_WR(dev, BNX2_MQ_KNL_CMD_MASK1, 2);
+
+	/* Enable Command Scheduler notification when we write to either
+	 * the Send Queue or Receive Queue producer indexes of the kernel
+	 * bypass contexts. */
+	CNIC_WR(dev, BNX2_MQ_KNL_BYP_CMD_MASK1, 7);
+	CNIC_WR(dev, BNX2_MQ_KNL_BYP_WRITE_MASK1, 7);
+
+	/* Notify COM when the driver post an application buffer. */
+	CNIC_WR(dev, BNX2_MQ_KNL_RX_V2P_MASK2, 0x2000);
+
+	/* Set the CP and COM doorbells.  These two processors polls the
+	 * doorbell for a non zero value before running.  This must be done
+	 * after setting up the kernel queue contexts. */
+	cnic_bnx2_reg_wr_ind(dev, BNX2_CP_SCRATCH + 0x20, 1);
+	cnic_bnx2_reg_wr_ind(dev, BNX2_COM_SCRATCH + 0x20, 1);
+
+	err = cnic_init_bnx2_irq(dev);
+	if (err) {
+		printk(KERN_ERR PFX "%s: cnic_init_irq failed\n",
+		       dev->netdev->name);
+		cnic_bnx2_reg_wr_ind(dev, BNX2_CP_SCRATCH + 0x20, 0);
+		cnic_bnx2_reg_wr_ind(dev, BNX2_COM_SCRATCH + 0x20, 0);
+		return err;
+	}
+
+	return 0;
+}
+
+static int cnic_start_hw(struct cnic_dev *dev)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+	struct cnic_eth_dev *ethdev = cp->ethdev;
+	int err;
+
+	if (test_bit(CNIC_F_CNIC_UP, &dev->flags))
+		return -EALREADY;
+
+	err = ethdev->drv_register_cnic(dev->netdev, cp->cnic_ops, dev);
+	if (err) {
+		printk(KERN_ERR PFX "%s: register_cnic failed\n",
+		       dev->netdev->name);
+		return err;
+	}
+
+	dev->regview = ethdev->io_base;
+	cp->chip_id = ethdev->chip_id;
+	pci_dev_get(dev->pcidev);
+	cp->func = PCI_FUNC(dev->pcidev->devfn);
+	cp->status_blk = ethdev->irq_arr[0].status_blk;
+	cp->status_blk_num = ethdev->irq_arr[0].status_blk_num;
+
+	err = cp->alloc_resc(dev);
+	if (err) {
+		printk(KERN_ERR PFX "%s: allocate resource failure\n",
+		       dev->netdev->name);
+		goto err1;
+	}
+
+	err = cp->start_hw(dev);
+	if (err)
+		goto err1;
+
+	err = cnic_cm_open(dev);
+	if (err)
+		goto err1;
+
+	set_bit(CNIC_F_CNIC_UP, &dev->flags);
+
+	cp->enable_int(dev);
+
+	return 0;
+
+err1:
+	ethdev->drv_unregister_cnic(dev->netdev);
+	cp->free_resc(dev);
+	pci_dev_put(dev->pcidev);
+	return err;
+}
+
+static void cnic_stop_bnx2_hw(struct cnic_dev *dev)
+{
+	struct cnic_local *cp = dev->cnic_priv;
+	struct cnic_eth_dev *ethdev = cp->ethdev;
+
+	cnic_disable_bnx2_int_sync(dev);
+
+	cnic_bnx2_reg_wr_ind(dev, BNX2_CP_SCRATCH + 0x20, 0);
+	cnic_bnx2_reg_wr_ind(dev, BNX2_COM_SCRATCH + 0x20, 0);
+
+	cnic_init_context(dev, KWQ_CID);
+	cnic_init_context(dev, KCQ_CID);
+
+	cnic_setup_5709_context(dev, 0);
+	cnic_free_irq(dev);
+
+	ethdev->drv_unregister_cnic(dev->netdev);
+
+	cnic_free_resc(dev);
+}
+
+static void cnic_stop_hw(struct cnic_dev *dev)
+{
+	if (test_bit(CNIC_F_CNIC_UP, &dev->flags)) {
+		struct cnic_local *cp = dev->cnic_priv;
+
+		clear_bit(CNIC_F_CNIC_UP, &dev->flags);
+		rcu_assign_pointer(cp->ulp_ops[CNIC_ULP_L4], NULL);
+		synchronize_rcu();
+		cnic_cm_shutdown(dev);
+		cp->stop_hw(dev);
+		pci_dev_put(dev->pcidev);
+	}
+}
+
+static struct cnic_dev *alloc_cnic(struct net_device *dev)
+{
+	struct cnic_dev *cdev;
+	struct cnic_local *cp;
+	int alloc_size;
+
+	alloc_size = sizeof(struct cnic_dev) + sizeof(struct cnic_local);
+
+	cdev = kmalloc(alloc_size , GFP_KERNEL);
+	if (cdev == NULL) {
+		printk(KERN_ERR PFX "%s: allocate dev struct failure\n",
+		       dev->name);
+		return NULL;
+	}
+	memset(cdev, 0, alloc_size);
+
+	cdev->netdev = dev;
+	cdev->cnic_priv = (char *)cdev + sizeof(struct cnic_dev);
+	cdev->register_device = cnic_register_device;
+	cdev->unregister_device = cnic_unregister_device;
+	cp = cdev->cnic_priv;
+	cp->dev = cdev;
+
+	spin_lock_init(&cp->cnic_ulp_lock);
+	printk(KERN_INFO PFX "Added CNIC device: %s\n", dev->name);
+
+	return cdev;
+}
+
+static struct cnic_dev *init_bnx2_cnic(struct net_device *dev)
+{
+	struct pci_dev *pdev;
+	struct cnic_dev *cdev;
+	struct cnic_local *cp;
+	struct cnic_eth_dev *ethdev;
+
+	ethdev = bnx2_cnic_probe(dev);
+	if (!ethdev)
+		return NULL;
+
+	pdev = ethdev->pdev;
+	if (!pdev)
+		return NULL;
+
+	dev_hold(dev);
+	pci_dev_get(pdev);
+	if (pdev->device == PCI_DEVICE_ID_NX2_5709 ||
+	    pdev->device == PCI_DEVICE_ID_NX2_5709S) {
+		u8 rev;
+
+		pci_read_config_byte(pdev, PCI_REVISION_ID, &rev);
+		if (rev < 0x10) {
+			pci_dev_put(pdev);
+			dev_put(dev);
+			return NULL;
+		}
+	}
+	pci_dev_put(pdev);
+
+	cdev = alloc_cnic(dev);
+	if (cdev == NULL) {
+		dev_put(dev);
+		return NULL;
+	}
+
+	set_bit(CNIC_F_BNX2_CLASS, &cdev->flags);
+	cdev->submit_kwqes = cnic_submit_bnx2_kwqes;
+
+	cp = cdev->cnic_priv;
+	cp->ethdev = ethdev;
+	cdev->pcidev = pdev;
+
+	cp->cnic_ops = &cnic_bnx2_ops;
+	cp->start_hw = cnic_start_bnx2_hw;
+	cp->stop_hw = cnic_stop_bnx2_hw;
+	cp->setup_pgtbl = cnic_setup_page_tbl;
+	cp->alloc_resc = cnic_alloc_bnx2_resc;
+	cp->free_resc = cnic_free_resc;
+	cp->start_cm = cnic_cm_init_bnx2_hw;
+	cp->stop_cm = cnic_cm_stop_bnx2_hw;
+	cp->enable_int = cnic_enable_bnx2_int;
+	cp->disable_int_sync = cnic_disable_bnx2_int_sync;
+	return cdev;
+}
+
+static struct cnic_dev *is_cnic_dev(struct net_device *dev)
+{
+	struct ethtool_drvinfo drvinfo;
+	struct cnic_dev *cdev = NULL;
+
+	if (dev->ethtool_ops && dev->ethtool_ops->get_drvinfo) {
+		memset(&drvinfo, 0, sizeof(drvinfo));
+		dev->ethtool_ops->get_drvinfo(dev, &drvinfo);
+		
+		if (!strcmp(drvinfo.driver, "bnx2"))
+			cdev = init_bnx2_cnic(dev);
+		if (cdev) {
+			write_lock(&cnic_dev_lock);
+			list_add(&cdev->list, &cnic_dev_list);
+			write_unlock(&cnic_dev_lock);
+		}
+	}
+	return cdev;
+}
+
+/**
+ * IP event handler
+ */
+static int cnic_ip_event(struct notifier_block *this, unsigned long event,
+						 void *ptr)
+{
+	struct in_ifaddr *ifa = (struct in_ifaddr *) ptr;
+	struct net_device *netdev = (struct net_device *) ifa->ifa_dev->dev;
+	struct cnic_dev *dev;
+	int if_type;
+	u32 my_dev = 0;
+
+	read_lock(&cnic_dev_lock);
+	list_for_each_entry(dev, &cnic_dev_list, list) {
+		if (netdev == dev->netdev) {
+			my_dev = 1;
+			cnic_hold(dev);
+			break;
+		}
+	}
+	read_unlock(&cnic_dev_lock);
+
+	if (my_dev) {
+		struct cnic_local *cp = dev->cnic_priv;
+
+		rcu_read_lock();
+		for (if_type = 0; if_type < MAX_CNIC_ULP_TYPE; if_type++) {
+			struct cnic_ulp_ops *ulp_ops;
+
+			ulp_ops = rcu_dereference(cp->ulp_ops[if_type]);
+			if (ulp_ops) {
+				void *ctx = cp->ulp_handle[if_type];
+
+				ulp_ops->indicate_inetevent(ctx, event);
+			}
+		}
+		rcu_read_unlock();
+
+		cnic_put(dev);
+	}
+
+	return NOTIFY_DONE;
+}
+
+/**
+ * netdev event handler
+ */
+static int cnic_netdev_event(struct notifier_block *this, unsigned long event,
+							 void *ptr)
+{
+	struct net_device *netdev = ptr;
+	struct cnic_dev *dev;
+	int if_type;
+	u32 my_dev = 0;
+
+	read_lock(&cnic_dev_lock);
+	list_for_each_entry(dev, &cnic_dev_list, list) {
+		if (netdev == dev->netdev) {
+			my_dev = 1;
+			cnic_hold(dev);
+			break;
+		}
+	}
+	read_unlock(&cnic_dev_lock);
+
+	if (!my_dev && event == NETDEV_REGISTER) {
+		/* Check for the hot-plug device */
+		dev = is_cnic_dev(netdev);
+		if (dev) {
+			my_dev = 1;
+			cnic_hold(dev);
+		}
+	}
+	if (my_dev) {
+		struct cnic_local *cp = dev->cnic_priv;
+
+		if (event == NETDEV_REGISTER)
+			cnic_ulp_init(dev);
+		else if (event == NETDEV_UNREGISTER)
+			cnic_ulp_exit(dev);
+		else if (event == NETDEV_UP) {
+			mutex_lock(&cnic_lock);
+			set_bit(CNIC_F_IF_UP, &dev->flags);
+			if (dev->use_count) {
+				if (!cnic_start_hw(dev))
+					cnic_ulp_start(dev);
+			}
+			mutex_unlock(&cnic_lock);
+		}
+
+		rcu_read_lock();
+		for (if_type = 0; if_type < MAX_CNIC_ULP_TYPE; if_type++) {
+			struct cnic_ulp_ops *ulp_ops;
+			void *ctx;
+
+			ulp_ops = rcu_dereference(cp->ulp_ops[if_type]);
+			if (!ulp_ops)
+				continue;
+
+			ctx = cp->ulp_handle[if_type];
+
+			ulp_ops->indicate_netevent(ctx, event);
+		}
+		rcu_read_unlock();
+
+		if (event == NETDEV_GOING_DOWN) {
+			mutex_lock(&cnic_lock);
+			clear_bit(CNIC_F_IF_UP, &dev->flags);
+			set_bit(CNIC_F_IF_GOING_DOWN, &dev->flags);
+			cnic_ulp_stop(dev);
+			cnic_stop_hw(dev);
+			mutex_unlock(&cnic_lock);
+		} else if (event == NETDEV_DOWN) {
+			mutex_lock(&cnic_lock);
+			clear_bit(CNIC_F_IF_GOING_DOWN, &dev->flags);
+			mutex_unlock(&cnic_lock);
+		} else if (event == NETDEV_UNREGISTER) {
+			write_lock(&cnic_dev_lock);
+			list_del_init(&dev->list);
+			write_unlock(&cnic_dev_lock);
+
+			cnic_put(dev);
+			cnic_free_dev(dev);
+			goto done;
+		}
+		cnic_put(dev);
+	}
+done:
+	return NOTIFY_DONE;
+}
+
+static struct notifier_block cnic_ip_notifier = {
+	cnic_ip_event,
+	0
+};
+
+static struct notifier_block cnic_netdev_notifier = {
+	cnic_netdev_event,
+	0
+};
+
+static void cnic_release(void)
+{
+	struct cnic_dev *dev;
+
+	while (!list_empty(&cnic_dev_list)) {
+		dev = list_entry(cnic_dev_list.next, struct cnic_dev, list);
+		if (test_bit(CNIC_F_CNIC_UP, &dev->flags))
+			cnic_stop_hw(dev);
+
+		list_del_init(&dev->list);
+		cnic_free_dev(dev);
+	}
+}
+
+static int __init cnic_init(void)
+{
+	int rc = 0;
+	struct net_device *dev;
+
+	printk(KERN_INFO "%s", version);
+
+	rtnl_lock();
+	/* Find Teton devices */
+	for_each_netdev(&init_net, dev)
+		is_cnic_dev(dev);
+
+	rtnl_unlock();
+
+	rc = register_inetaddr_notifier(&cnic_ip_notifier);
+	if (rc)
+		cnic_release();
+	rc = register_netdevice_notifier(&cnic_netdev_notifier);
+	if (rc) {
+		unregister_inetaddr_notifier(&cnic_ip_notifier);
+		cnic_release();
+	}
+	return rc;
+}
+
+static void __exit cnic_exit(void)
+{
+	unregister_inetaddr_notifier(&cnic_ip_notifier);
+	unregister_netdevice_notifier(&cnic_netdev_notifier);
+	cnic_release();
+	return;
+}
+
+module_init(cnic_init);
+module_exit(cnic_exit);
diff --git a/drivers/net/cnic.h b/drivers/net/cnic.h
new file mode 100644
index 0000000..e81e895
--- /dev/null
+++ b/drivers/net/cnic.h
@@ -0,0 +1,221 @@
+/* cnic.h: Broadcom CNIC core network driver.
+ *
+ * Copyright (c) 2006 Broadcom Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation.
+ *
+ * Written by: John(Zongxi) Chen (zongxic@broadcom.com)
+ */
+
+
+#ifndef CNIC_H
+#define CNIC_H
+
+#if !defined(__LITTLE_ENDIAN) && !defined(__BIG_ENDIAN)
+	#error "Missing either LITTLE_ENDIAN or BIG_ENDIAN definition."
+#endif
+
+#define KWQ_PAGE_CNT	4
+#define KCQ_PAGE_CNT	16
+
+#define KWQ_CID 		24
+#define KCQ_CID 		25
+
+/*
+ *	krnlq_context definition
+ */
+#define L5_KRNLQ_FLAGS	0x00000000
+#define L5_KRNLQ_SIZE	0x00000000
+#define L5_KRNLQ_TYPE	0x00000000
+#define KRNLQ_FLAGS_PG_SZ					(0xf<<0)
+#define KRNLQ_FLAGS_PG_SZ_256					(0<<0)
+#define KRNLQ_FLAGS_PG_SZ_512					(1<<0)
+#define KRNLQ_FLAGS_PG_SZ_1K					(2<<0)
+#define KRNLQ_FLAGS_PG_SZ_2K					(3<<0)
+#define KRNLQ_FLAGS_PG_SZ_4K					(4<<0)
+#define KRNLQ_FLAGS_PG_SZ_8K					(5<<0)
+#define KRNLQ_FLAGS_PG_SZ_16K					(6<<0)
+#define KRNLQ_FLAGS_PG_SZ_32K					(7<<0)
+#define KRNLQ_FLAGS_PG_SZ_64K					(8<<0)
+#define KRNLQ_FLAGS_PG_SZ_128K					(9<<0)
+#define KRNLQ_FLAGS_PG_SZ_256K					(10<<0)
+#define KRNLQ_FLAGS_PG_SZ_512K					(11<<0)
+#define KRNLQ_FLAGS_PG_SZ_1M					(12<<0)
+#define KRNLQ_FLAGS_PG_SZ_2M					(13<<0)
+#define KRNLQ_FLAGS_QE_SELF_SEQ					(1<<15)
+#define KRNLQ_SIZE_TYPE_SIZE	((((0x28 + 0x1f) & ~0x1f) / 0x20) << 16)
+#define KRNLQ_TYPE_TYPE						(0xf<<28)
+#define KRNLQ_TYPE_TYPE_EMPTY					(0<<28)
+#define KRNLQ_TYPE_TYPE_KRNLQ					(6<<28)
+
+#define L5_KRNLQ_HOST_QIDX		0x00000004
+#define KRNLQ_STATUSB_NUM_SHIFT		16
+#define KRNLQ_STATUSB_NUM_CNIC_MSIX(sb_id)	(((sb_id) + 7) <<	\
+	KRNLQ_STATUSB_NUM_SHIFT)
+#define L5_KRNLQ_HOST_FW_QIDX		0x00000008
+#define L5_KRNLQ_NX_QE_SELF_SEQ 	0x0000000c
+#define L5_KRNLQ_QE_SELF_SEQ_MAX	0x0000000c
+#define L5_KRNLQ_NX_QE_HADDR_HI 	0x00000010
+#define L5_KRNLQ_NX_QE_HADDR_LO 	0x00000014
+#define L5_KRNLQ_PGTBL_PGIDX		0x00000018
+#define L5_KRNLQ_NX_PG_QIDX 		0x00000018
+#define L5_KRNLQ_PGTBL_NPAGES		0x0000001c
+#define L5_KRNLQ_QIDX_INCR		0x0000001c
+#define L5_KRNLQ_PGTBL_HADDR_HI 	0x00000020
+#define L5_KRNLQ_PGTBL_HADDR_LO 	0x00000024
+
+#define BNX2_PG_CTX_MAP			0x1a0034
+#define BNX2_ISCSI_CTX_MAP		0x1a0074
+
+struct cnic_redirect_entry {
+	struct dst_entry *old_dst;
+	struct dst_entry *new_dst;
+};
+
+struct cnic_work_node {
+	u32			work_type;
+#define	WORK_TYPE_KCQE			1
+#define	WORK_TYPE_NEIGH_UPDATE		2
+#define	WORK_TYPE_REDIRECT		3
+	union {
+		struct kcqe		kcqe;
+		struct neighbour	*neigh;
+		struct cnic_redirect_entry cnic_redir;
+	} work_data;
+};
+
+#define WORK_RING_SIZE		128
+#define WORK_RING_SIZE_MASK	127
+#define MAX_CM_SK_TBL_SZ	128
+#define MAX_COMPLETED_KCQE	64
+
+#define KWQE_CNT (BCM_PAGE_SIZE / sizeof(struct kwqe))
+#define KCQE_CNT (BCM_PAGE_SIZE / sizeof(struct kcqe))
+#define MAX_KWQE_CNT (KWQE_CNT - 1)
+#define MAX_KCQE_CNT (KCQE_CNT - 1)
+
+#define MAX_KWQ_IDX	((KWQ_PAGE_CNT * KWQE_CNT) - 1)
+#define MAX_KCQ_IDX	((KCQ_PAGE_CNT * KCQE_CNT) - 1)
+
+#define KWQ_PG(x) (((x) & ~MAX_KWQE_CNT) >> (BCM_PAGE_BITS - 5))
+#define KWQ_IDX(x) ((x) & MAX_KWQE_CNT)
+
+#define KCQ_PG(x) (((x) & ~MAX_KCQE_CNT) >> (BCM_PAGE_BITS - 5))
+#define KCQ_IDX(x) ((x) & MAX_KCQE_CNT)
+
+#define DEF_IPID_COUNT		0xc001
+
+#define DEF_KA_TIMEOUT		10000
+#define DEF_KA_INTERVAL		300000
+#define DEF_KA_MAX_PROBE_COUNT	3
+#define DEF_TOS			0
+#define DEF_TTL			0xfe
+#define DEF_SND_SEQ_SCALE	0
+#define DEF_RCV_BUF		0xffff
+#define DEF_SND_BUF		0xffff
+#define DEF_SEED		0
+
+struct cnic_ctx {
+	u32		cid;
+	void		*ctx;
+	dma_addr_t	mapping;
+};
+
+#define BNX2_MAX_CID		0x2000
+
+struct cnic_dma {
+	int		num_pages;
+	void		**pg_arr;
+	dma_addr_t	*pg_map_arr;
+	int		pgtbl_size;
+	u32		*pgtbl;
+	dma_addr_t	pgtbl_map;
+};
+
+struct cnic_local {
+
+	spinlock_t cnic_ulp_lock;
+	void *ulp_handle[MAX_CNIC_ULP_TYPE];
+	unsigned long ulp_flags[MAX_CNIC_ULP_TYPE];
+#define ULP_F_INIT	0
+#define ULP_F_START	1
+	struct cnic_ulp_ops *ulp_ops[MAX_CNIC_ULP_TYPE];
+
+	/* protected by ulp_lock */
+	u32 cnic_local_flags;
+#define	CNIC_LCL_FL_KWQ_INIT	0x00000001
+
+	struct cnic_dev *dev;
+
+	struct cnic_eth_dev *ethdev;
+
+	u32 kwq_cid_addr;
+	u32 kcq_cid_addr;
+
+	struct cnic_dma		kwq_info;
+	struct kwqe		**kwq;
+
+	u16		max_kwq_idx;
+
+	u16		kwq_prod_idx;
+	u32		kwq_io_addr;
+
+	u16		kwq_con_idx;
+
+	struct cnic_dma	kcq_info;
+	struct kcqe	**kcq;
+
+	u16		kcq_prod_idx;
+	u32		kcq_io_addr;
+
+	void				*status_blk;
+	struct status_block_msix	*bnx2_status_blk;
+
+	u32				status_blk_num;
+	u32				last_status_idx;
+	struct tasklet_struct		cnic_irq_task;
+
+	struct kcqe	*completed_kcq[MAX_COMPLETED_KCQE];
+
+	struct cnic_sock *csk_tbl;
+
+	struct notifier_block cm_nb;
+
+	struct cnic_work_node	cnic_work_ring[WORK_RING_SIZE];
+	int			cnic_wr_cons;
+	int			cnic_wr_prod;
+	spinlock_t		wr_lock;
+
+	struct tasklet_struct	cnic_task;
+
+	struct cnic_ctx		*ctx_arr;
+	int			ctx_blks;
+	int			ctx_blk_size;
+	int			cids_per_blk;
+
+	u32			chip_id;
+	int			func;
+
+	struct cnic_ops		*cnic_ops;
+	int			(*start_hw)(struct cnic_dev *);
+	void			(*stop_hw)(struct cnic_dev *);
+	void			(*setup_pgtbl)(struct cnic_dev *,
+					       struct cnic_dma *);
+	int			(*alloc_resc)(struct cnic_dev *);
+	void			(*free_resc)(struct cnic_dev *);
+	int			(*start_cm)(struct cnic_dev *);
+	void			(*stop_cm)(struct cnic_dev *);
+	void			(*enable_int)(struct cnic_dev *);
+	void			(*disable_int_sync)(struct cnic_dev *);
+	void			(*ack_int)(struct cnic_dev *);
+};
+
+struct bnx2x_bd_chain_next {
+	u32	addr_lo;
+	u32	addr_hi;
+	u8	reserved[8];
+};
+
+#endif
diff --git a/drivers/net/cnic_defs.h b/drivers/net/cnic_defs.h
new file mode 100644
index 0000000..21cbbaa
--- /dev/null
+++ b/drivers/net/cnic_defs.h
@@ -0,0 +1,553 @@
+#ifndef __57XX_L5CM_HSI_LINUX_LE__
+#define __57XX_L5CM_HSI_LINUX_LE__
+
+/* KWQ (kernel work queue) request op codes */
+#define L4_KWQE_OPCODE_VALUE_CONNECT1               (50)
+#define L4_KWQE_OPCODE_VALUE_CONNECT2               (51)
+#define L4_KWQE_OPCODE_VALUE_CONNECT3               (52)
+#define L4_KWQE_OPCODE_VALUE_RESET                  (53)
+#define L4_KWQE_OPCODE_VALUE_CLOSE                  (54)
+#define L4_KWQE_OPCODE_VALUE_UPDATE_SECRET          (60)
+#define L4_KWQE_OPCODE_VALUE_INIT_ULP               (61)
+
+#define L4_KWQE_OPCODE_VALUE_OFFLOAD_PG             (1)
+#define L4_KWQE_OPCODE_VALUE_UPDATE_PG              (9)
+#define L4_KWQE_OPCODE_VALUE_UPLOAD_PG              (14)
+
+/* KCQ (kernel completion queue) response op codes */
+#define L4_KCQE_OPCODE_VALUE_CLOSE_COMP             (53)
+#define L4_KCQE_OPCODE_VALUE_RESET_COMP             (54)
+#define L4_KCQE_OPCODE_VALUE_FW_TCP_UPDATE          (55)
+#define L4_KCQE_OPCODE_VALUE_CONNECT_COMPLETE       (56)
+#define L4_KCQE_OPCODE_VALUE_RESET_RECEIVED         (57)
+#define L4_KCQE_OPCODE_VALUE_CLOSE_RECEIVED         (58)
+#define L4_KCQE_OPCODE_VALUE_INIT_ULP               (61)
+
+#define L4_KCQE_OPCODE_VALUE_OFFLOAD_PG             (1)
+#define L4_KCQE_OPCODE_VALUE_UPDATE_PG              (9)
+#define L4_KCQE_OPCODE_VALUE_UPLOAD_PG              (14)
+
+/* KCQ (kernel completion queue) completion status */
+#define L4_KCQE_COMPLETION_STATUS_SUCCESS		    (0)
+#define L4_KCQE_COMPLETION_STATUS_TIMEOUT        (0x93)
+
+#define L4_LAYER_CODE (4)
+
+/*
+ * L4 KCQ CQE
+ */
+struct l4_kcq {
+	u32 cid;
+	u32 pg_cid;
+	u32 conn_id;
+	u32 pg_host_opaque;
+#if defined(__BIG_ENDIAN)
+	u16 status;
+	u16 reserved1;
+#elif defined(__LITTLE_ENDIAN)
+	u16 reserved1;
+	u16 status;
+#endif
+	u32 reserved2[2];
+#if defined(__BIG_ENDIAN)
+	u8 flags;
+#define L4_KCQ_RESERVED3 (0xF<<0)
+#define L4_KCQ_RESERVED3_SHIFT 0
+#define L4_KCQ_LAYER_CODE (0x7<<4)
+#define L4_KCQ_LAYER_CODE_SHIFT 4
+#define L4_KCQ_RESERVED4 (0x1<<7)
+#define L4_KCQ_RESERVED4_SHIFT 7
+	u8 op_code;
+	u16 qe_self_seq;
+#elif defined(__LITTLE_ENDIAN)
+	u16 qe_self_seq;
+	u8 op_code;
+	u8 flags;
+#define L4_KCQ_RESERVED3 (0xF<<0)
+#define L4_KCQ_RESERVED3_SHIFT 0
+#define L4_KCQ_LAYER_CODE (0x7<<4)
+#define L4_KCQ_LAYER_CODE_SHIFT 4
+#define L4_KCQ_RESERVED4 (0x1<<7)
+#define L4_KCQ_RESERVED4_SHIFT 7
+#endif
+};
+
+
+/*
+ * L4 KCQ CQE PG upload
+ */
+struct l4_kcq_upload_pg {
+	u32 pg_cid;
+#if defined(__BIG_ENDIAN)
+	u16 pg_status;
+	u16 pg_ipid_count;
+#elif defined(__LITTLE_ENDIAN)
+	u16 pg_ipid_count;
+	u16 pg_status;
+#endif
+	u32 reserved1[5];
+#if defined(__BIG_ENDIAN)
+	u8 flags;
+#define L4_KCQ_UPLOAD_PG_RESERVED3 (0xF<<0)
+#define L4_KCQ_UPLOAD_PG_RESERVED3_SHIFT 0
+#define L4_KCQ_UPLOAD_PG_LAYER_CODE (0x7<<4)
+#define L4_KCQ_UPLOAD_PG_LAYER_CODE_SHIFT 4
+#define L4_KCQ_UPLOAD_PG_RESERVED4 (0x1<<7)
+#define L4_KCQ_UPLOAD_PG_RESERVED4_SHIFT 7
+	u8 op_code;
+	u16 qe_self_seq;
+#elif defined(__LITTLE_ENDIAN)
+	u16 qe_self_seq;
+	u8 op_code;
+	u8 flags;
+#define L4_KCQ_UPLOAD_PG_RESERVED3 (0xF<<0)
+#define L4_KCQ_UPLOAD_PG_RESERVED3_SHIFT 0
+#define L4_KCQ_UPLOAD_PG_LAYER_CODE (0x7<<4)
+#define L4_KCQ_UPLOAD_PG_LAYER_CODE_SHIFT 4
+#define L4_KCQ_UPLOAD_PG_RESERVED4 (0x1<<7)
+#define L4_KCQ_UPLOAD_PG_RESERVED4_SHIFT 7
+#endif
+};
+
+
+/*
+ * Gracefully close the connection request
+ */
+struct l4_kwq_close_req {
+#if defined(__BIG_ENDIAN)
+	u8 flags;
+#define L4_KWQ_CLOSE_REQ_RESERVED1 (0xF<<0)
+#define L4_KWQ_CLOSE_REQ_RESERVED1_SHIFT 0
+#define L4_KWQ_CLOSE_REQ_LAYER_CODE (0x7<<4)
+#define L4_KWQ_CLOSE_REQ_LAYER_CODE_SHIFT 4
+#define L4_KWQ_CLOSE_REQ_LINKED_WITH_NEXT (0x1<<7)
+#define L4_KWQ_CLOSE_REQ_LINKED_WITH_NEXT_SHIFT 7
+	u8 op_code;
+	u16 reserved0;
+#elif defined(__LITTLE_ENDIAN)
+	u16 reserved0;
+	u8 op_code;
+	u8 flags;
+#define L4_KWQ_CLOSE_REQ_RESERVED1 (0xF<<0)
+#define L4_KWQ_CLOSE_REQ_RESERVED1_SHIFT 0
+#define L4_KWQ_CLOSE_REQ_LAYER_CODE (0x7<<4)
+#define L4_KWQ_CLOSE_REQ_LAYER_CODE_SHIFT 4
+#define L4_KWQ_CLOSE_REQ_LINKED_WITH_NEXT (0x1<<7)
+#define L4_KWQ_CLOSE_REQ_LINKED_WITH_NEXT_SHIFT 7
+#endif
+	u32 cid;
+	u32 reserved2[6];
+};
+
+
+/*
+ * The first request to be passed in order to establish connection
+ */
+struct l4_kwq_connect_req1 {
+#if defined(__BIG_ENDIAN)
+	u8 flags;
+#define L4_KWQ_CONNECT_REQ1_RESERVED1 (0xF<<0)
+#define L4_KWQ_CONNECT_REQ1_RESERVED1_SHIFT 0
+#define L4_KWQ_CONNECT_REQ1_LAYER_CODE (0x7<<4)
+#define L4_KWQ_CONNECT_REQ1_LAYER_CODE_SHIFT 4
+#define L4_KWQ_CONNECT_REQ1_LINKED_WITH_NEXT (0x1<<7)
+#define L4_KWQ_CONNECT_REQ1_LINKED_WITH_NEXT_SHIFT 7
+	u8 op_code;
+	u8 reserved0;
+	u8 conn_flags;
+#define L4_KWQ_CONNECT_REQ1_IS_PG_HOST_OPAQUE (0x1<<0)
+#define L4_KWQ_CONNECT_REQ1_IS_PG_HOST_OPAQUE_SHIFT 0
+#define L4_KWQ_CONNECT_REQ1_IP_V6 (0x1<<1)
+#define L4_KWQ_CONNECT_REQ1_IP_V6_SHIFT 1
+#define L4_KWQ_CONNECT_REQ1_PASSIVE_FLAG (0x1<<2)
+#define L4_KWQ_CONNECT_REQ1_PASSIVE_FLAG_SHIFT 2
+#define L4_KWQ_CONNECT_REQ1_RSRV (0x1F<<3)
+#define L4_KWQ_CONNECT_REQ1_RSRV_SHIFT 3
+#elif defined(__LITTLE_ENDIAN)
+	u8 conn_flags;
+#define L4_KWQ_CONNECT_REQ1_IS_PG_HOST_OPAQUE (0x1<<0)
+#define L4_KWQ_CONNECT_REQ1_IS_PG_HOST_OPAQUE_SHIFT 0
+#define L4_KWQ_CONNECT_REQ1_IP_V6 (0x1<<1)
+#define L4_KWQ_CONNECT_REQ1_IP_V6_SHIFT 1
+#define L4_KWQ_CONNECT_REQ1_PASSIVE_FLAG (0x1<<2)
+#define L4_KWQ_CONNECT_REQ1_PASSIVE_FLAG_SHIFT 2
+#define L4_KWQ_CONNECT_REQ1_RSRV (0x1F<<3)
+#define L4_KWQ_CONNECT_REQ1_RSRV_SHIFT 3
+	u8 reserved0;
+	u8 op_code;
+	u8 flags;
+#define L4_KWQ_CONNECT_REQ1_RESERVED1 (0xF<<0)
+#define L4_KWQ_CONNECT_REQ1_RESERVED1_SHIFT 0
+#define L4_KWQ_CONNECT_REQ1_LAYER_CODE (0x7<<4)
+#define L4_KWQ_CONNECT_REQ1_LAYER_CODE_SHIFT 4
+#define L4_KWQ_CONNECT_REQ1_LINKED_WITH_NEXT (0x1<<7)
+#define L4_KWQ_CONNECT_REQ1_LINKED_WITH_NEXT_SHIFT 7
+#endif
+	u32 cid;
+	u32 pg_cid;
+	u32 src_ip;
+	u32 dst_ip;
+#if defined(__BIG_ENDIAN)
+	u16 dst_port;
+	u16 src_port;
+#elif defined(__LITTLE_ENDIAN)
+	u16 src_port;
+	u16 dst_port;
+#endif
+#if defined(__BIG_ENDIAN)
+	u8 rsrv1[3];
+	u8 tcp_flags;
+#define L4_KWQ_CONNECT_REQ1_NO_DELAY_ACK (0x1<<0)
+#define L4_KWQ_CONNECT_REQ1_NO_DELAY_ACK_SHIFT 0
+#define L4_KWQ_CONNECT_REQ1_KEEP_ALIVE (0x1<<1)
+#define L4_KWQ_CONNECT_REQ1_KEEP_ALIVE_SHIFT 1
+#define L4_KWQ_CONNECT_REQ1_NAGLE_ENABLE (0x1<<2)
+#define L4_KWQ_CONNECT_REQ1_NAGLE_ENABLE_SHIFT 2
+#define L4_KWQ_CONNECT_REQ1_TIME_STAMP (0x1<<3)
+#define L4_KWQ_CONNECT_REQ1_TIME_STAMP_SHIFT 3
+#define L4_KWQ_CONNECT_REQ1_SACK (0x1<<4)
+#define L4_KWQ_CONNECT_REQ1_SACK_SHIFT 4
+#define L4_KWQ_CONNECT_REQ1_SEG_SCALING (0x1<<5)
+#define L4_KWQ_CONNECT_REQ1_SEG_SCALING_SHIFT 5
+#define L4_KWQ_CONNECT_REQ1_RESERVED2 (0x3<<6)
+#define L4_KWQ_CONNECT_REQ1_RESERVED2_SHIFT 6
+#elif defined(__LITTLE_ENDIAN)
+	u8 tcp_flags;
+#define L4_KWQ_CONNECT_REQ1_NO_DELAY_ACK (0x1<<0)
+#define L4_KWQ_CONNECT_REQ1_NO_DELAY_ACK_SHIFT 0
+#define L4_KWQ_CONNECT_REQ1_KEEP_ALIVE (0x1<<1)
+#define L4_KWQ_CONNECT_REQ1_KEEP_ALIVE_SHIFT 1
+#define L4_KWQ_CONNECT_REQ1_NAGLE_ENABLE (0x1<<2)
+#define L4_KWQ_CONNECT_REQ1_NAGLE_ENABLE_SHIFT 2
+#define L4_KWQ_CONNECT_REQ1_TIME_STAMP (0x1<<3)
+#define L4_KWQ_CONNECT_REQ1_TIME_STAMP_SHIFT 3
+#define L4_KWQ_CONNECT_REQ1_SACK (0x1<<4)
+#define L4_KWQ_CONNECT_REQ1_SACK_SHIFT 4
+#define L4_KWQ_CONNECT_REQ1_SEG_SCALING (0x1<<5)
+#define L4_KWQ_CONNECT_REQ1_SEG_SCALING_SHIFT 5
+#define L4_KWQ_CONNECT_REQ1_RESERVED2 (0x3<<6)
+#define L4_KWQ_CONNECT_REQ1_RESERVED2_SHIFT 6
+	u8 rsrv1[3];
+#endif
+	u32 rsrv2;
+};
+
+
+/*
+ * The second ( optional )request to be passed in order to establish connection - for IPv6 only
+ */
+struct l4_kwq_connect_req2 {
+#if defined(__BIG_ENDIAN)
+	u8 flags;
+#define L4_KWQ_CONNECT_REQ2_RESERVED1 (0xF<<0)
+#define L4_KWQ_CONNECT_REQ2_RESERVED1_SHIFT 0
+#define L4_KWQ_CONNECT_REQ2_LAYER_CODE (0x7<<4)
+#define L4_KWQ_CONNECT_REQ2_LAYER_CODE_SHIFT 4
+#define L4_KWQ_CONNECT_REQ2_LINKED_WITH_NEXT (0x1<<7)
+#define L4_KWQ_CONNECT_REQ2_LINKED_WITH_NEXT_SHIFT 7
+	u8 op_code;
+	u8 reserved0;
+	u8 rsrv;
+#elif defined(__LITTLE_ENDIAN)
+	u8 rsrv;
+	u8 reserved0;
+	u8 op_code;
+	u8 flags;
+#define L4_KWQ_CONNECT_REQ2_RESERVED1 (0xF<<0)
+#define L4_KWQ_CONNECT_REQ2_RESERVED1_SHIFT 0
+#define L4_KWQ_CONNECT_REQ2_LAYER_CODE (0x7<<4)
+#define L4_KWQ_CONNECT_REQ2_LAYER_CODE_SHIFT 4
+#define L4_KWQ_CONNECT_REQ2_LINKED_WITH_NEXT (0x1<<7)
+#define L4_KWQ_CONNECT_REQ2_LINKED_WITH_NEXT_SHIFT 7
+#endif
+	u32 reserved2;
+	u32 src_ip_v6_2;
+	u32 src_ip_v6_3;
+	u32 src_ip_v6_4;
+	u32 dst_ip_v6_2;
+	u32 dst_ip_v6_3;
+	u32 dst_ip_v6_4;
+};
+
+
+/*
+ * The third ( and last )request to be passed in order to establish connection
+ */
+struct l4_kwq_connect_req3 {
+#if defined(__BIG_ENDIAN)
+	u8 flags;
+#define L4_KWQ_CONNECT_REQ3_RESERVED1 (0xF<<0)
+#define L4_KWQ_CONNECT_REQ3_RESERVED1_SHIFT 0
+#define L4_KWQ_CONNECT_REQ3_LAYER_CODE (0x7<<4)
+#define L4_KWQ_CONNECT_REQ3_LAYER_CODE_SHIFT 4
+#define L4_KWQ_CONNECT_REQ3_LINKED_WITH_NEXT (0x1<<7)
+#define L4_KWQ_CONNECT_REQ3_LINKED_WITH_NEXT_SHIFT 7
+	u8 op_code;
+	u16 reserved0;
+#elif defined(__LITTLE_ENDIAN)
+	u16 reserved0;
+	u8 op_code;
+	u8 flags;
+#define L4_KWQ_CONNECT_REQ3_RESERVED1 (0xF<<0)
+#define L4_KWQ_CONNECT_REQ3_RESERVED1_SHIFT 0
+#define L4_KWQ_CONNECT_REQ3_LAYER_CODE (0x7<<4)
+#define L4_KWQ_CONNECT_REQ3_LAYER_CODE_SHIFT 4
+#define L4_KWQ_CONNECT_REQ3_LINKED_WITH_NEXT (0x1<<7)
+#define L4_KWQ_CONNECT_REQ3_LINKED_WITH_NEXT_SHIFT 7
+#endif
+	u32 ka_timeout;
+	u32 ka_interval ;
+#if defined(__BIG_ENDIAN)
+	u8 snd_seq_scale;
+	u8 ttl;
+	u8 tos;
+	u8 ka_max_probe_count;
+#elif defined(__LITTLE_ENDIAN)
+	u8 ka_max_probe_count;
+	u8 tos;
+	u8 ttl;
+	u8 snd_seq_scale;
+#endif
+#if defined(__BIG_ENDIAN)
+	u16 pmtu;
+	u16 mss;
+#elif defined(__LITTLE_ENDIAN)
+	u16 mss;
+	u16 pmtu;
+#endif
+	u32 rcv_buf;
+	u32 snd_buf;
+	u32 seed;
+};
+
+
+/*
+ * a KWQE request to offload a PG connection
+ */
+struct l4_kwq_offload_pg {
+#if defined(__BIG_ENDIAN)
+	u8 flags;
+#define L4_KWQ_OFFLOAD_PG_RESERVED1 (0xF<<0)
+#define L4_KWQ_OFFLOAD_PG_RESERVED1_SHIFT 0
+#define L4_KWQ_OFFLOAD_PG_LAYER_CODE (0x7<<4)
+#define L4_KWQ_OFFLOAD_PG_LAYER_CODE_SHIFT 4
+#define L4_KWQ_OFFLOAD_PG_LINKED_WITH_NEXT (0x1<<7)
+#define L4_KWQ_OFFLOAD_PG_LINKED_WITH_NEXT_SHIFT 7
+	u8 op_code;
+	u16 reserved0;
+#elif defined(__LITTLE_ENDIAN)
+	u16 reserved0;
+	u8 op_code;
+	u8 flags;
+#define L4_KWQ_OFFLOAD_PG_RESERVED1 (0xF<<0)
+#define L4_KWQ_OFFLOAD_PG_RESERVED1_SHIFT 0
+#define L4_KWQ_OFFLOAD_PG_LAYER_CODE (0x7<<4)
+#define L4_KWQ_OFFLOAD_PG_LAYER_CODE_SHIFT 4
+#define L4_KWQ_OFFLOAD_PG_LINKED_WITH_NEXT (0x1<<7)
+#define L4_KWQ_OFFLOAD_PG_LINKED_WITH_NEXT_SHIFT 7
+#endif
+#if defined(__BIG_ENDIAN)
+	u8 l2hdr_nbytes;
+	u8 pg_flags;
+#define L4_KWQ_OFFLOAD_PG_SNAP_ENCAP (0x1<<0)
+#define L4_KWQ_OFFLOAD_PG_SNAP_ENCAP_SHIFT 0
+#define L4_KWQ_OFFLOAD_PG_VLAN_TAGGING (0x1<<1)
+#define L4_KWQ_OFFLOAD_PG_VLAN_TAGGING_SHIFT 1
+#define L4_KWQ_OFFLOAD_PG_RESERVED2 (0x3F<<2)
+#define L4_KWQ_OFFLOAD_PG_RESERVED2_SHIFT 2
+	u8 da0;
+	u8 da1;
+#elif defined(__LITTLE_ENDIAN)
+	u8 da1;
+	u8 da0;
+	u8 pg_flags;
+#define L4_KWQ_OFFLOAD_PG_SNAP_ENCAP (0x1<<0)
+#define L4_KWQ_OFFLOAD_PG_SNAP_ENCAP_SHIFT 0
+#define L4_KWQ_OFFLOAD_PG_VLAN_TAGGING (0x1<<1)
+#define L4_KWQ_OFFLOAD_PG_VLAN_TAGGING_SHIFT 1
+#define L4_KWQ_OFFLOAD_PG_RESERVED2 (0x3F<<2)
+#define L4_KWQ_OFFLOAD_PG_RESERVED2_SHIFT 2
+	u8 l2hdr_nbytes;
+#endif
+#if defined(__BIG_ENDIAN)
+	u8 da2;
+	u8 da3;
+	u8 da4;
+	u8 da5;
+#elif defined(__LITTLE_ENDIAN)
+	u8 da5;
+	u8 da4;
+	u8 da3;
+	u8 da2;
+#endif
+#if defined(__BIG_ENDIAN)
+	u8 sa0;
+	u8 sa1;
+	u8 sa2;
+	u8 sa3;
+#elif defined(__LITTLE_ENDIAN)
+	u8 sa3;
+	u8 sa2;
+	u8 sa1;
+	u8 sa0;
+#endif
+#if defined(__BIG_ENDIAN)
+	u8 sa4;
+	u8 sa5;
+	u16 etype;
+#elif defined(__LITTLE_ENDIAN)
+	u16 etype;
+	u8 sa5;
+	u8 sa4;
+#endif
+#if defined(__BIG_ENDIAN)
+	u16 vlan_tag;
+	u16 ipid_start;
+#elif defined(__LITTLE_ENDIAN)
+	u16 ipid_start;
+	u16 vlan_tag;
+#endif
+#if defined(__BIG_ENDIAN)
+	u16 ipid_count;
+	u16 reserved3;
+#elif defined(__LITTLE_ENDIAN)
+	u16 reserved3;
+	u16 ipid_count;
+#endif
+	u32 host_opaque;
+};
+
+
+/*
+ * Abortively close the connection request
+ */
+struct l4_kwq_reset_req {
+#if defined(__BIG_ENDIAN)
+	u8 flags;
+#define L4_KWQ_RESET_REQ_RESERVED1 (0xF<<0)
+#define L4_KWQ_RESET_REQ_RESERVED1_SHIFT 0
+#define L4_KWQ_RESET_REQ_LAYER_CODE (0x7<<4)
+#define L4_KWQ_RESET_REQ_LAYER_CODE_SHIFT 4
+#define L4_KWQ_RESET_REQ_LINKED_WITH_NEXT (0x1<<7)
+#define L4_KWQ_RESET_REQ_LINKED_WITH_NEXT_SHIFT 7
+	u8 op_code;
+	u16 reserved0;
+#elif defined(__LITTLE_ENDIAN)
+	u16 reserved0;
+	u8 op_code;
+	u8 flags;
+#define L4_KWQ_RESET_REQ_RESERVED1 (0xF<<0)
+#define L4_KWQ_RESET_REQ_RESERVED1_SHIFT 0
+#define L4_KWQ_RESET_REQ_LAYER_CODE (0x7<<4)
+#define L4_KWQ_RESET_REQ_LAYER_CODE_SHIFT 4
+#define L4_KWQ_RESET_REQ_LINKED_WITH_NEXT (0x1<<7)
+#define L4_KWQ_RESET_REQ_LINKED_WITH_NEXT_SHIFT 7
+#endif
+	u32 cid;
+	u32 reserved2[6];
+};
+
+
+/*
+ * a KWQE request to update a PG connection
+ */
+struct l4_kwq_update_pg {
+#if defined(__BIG_ENDIAN)
+	u8 flags;
+#define L4_KWQ_UPDATE_PG_RESERVED1 (0xF<<0)
+#define L4_KWQ_UPDATE_PG_RESERVED1_SHIFT 0
+#define L4_KWQ_UPDATE_PG_LAYER_CODE (0x7<<4)
+#define L4_KWQ_UPDATE_PG_LAYER_CODE_SHIFT 4
+#define L4_KWQ_UPDATE_PG_LINKED_WITH_NEXT (0x1<<7)
+#define L4_KWQ_UPDATE_PG_LINKED_WITH_NEXT_SHIFT 7
+	u8 opcode;
+	u16 oper16;
+#elif defined(__LITTLE_ENDIAN)
+	u16 oper16;
+	u8 opcode;
+	u8 flags;
+#define L4_KWQ_UPDATE_PG_RESERVED1 (0xF<<0)
+#define L4_KWQ_UPDATE_PG_RESERVED1_SHIFT 0
+#define L4_KWQ_UPDATE_PG_LAYER_CODE (0x7<<4)
+#define L4_KWQ_UPDATE_PG_LAYER_CODE_SHIFT 4
+#define L4_KWQ_UPDATE_PG_LINKED_WITH_NEXT (0x1<<7)
+#define L4_KWQ_UPDATE_PG_LINKED_WITH_NEXT_SHIFT 7
+#endif
+	u32 pg_cid;
+	u32 pg_host_opaque;
+#if defined(__BIG_ENDIAN)
+	u8 pg_valids;
+#define L4_KWQ_UPDATE_PG_VALIDS_IPID_COUNT (0x1<<0)
+#define L4_KWQ_UPDATE_PG_VALIDS_IPID_COUNT_SHIFT 0
+#define L4_KWQ_UPDATE_PG_VALIDS_DA (0x1<<1)
+#define L4_KWQ_UPDATE_PG_VALIDS_DA_SHIFT 1
+#define L4_KWQ_UPDATE_PG_RESERVERD2 (0x3F<<2)
+#define L4_KWQ_UPDATE_PG_RESERVERD2_SHIFT 2
+	u8 pg_unused_a;
+	u16 pg_ipid_count;
+#elif defined(__LITTLE_ENDIAN)
+	u16 pg_ipid_count;
+	u8 pg_unused_a;
+	u8 pg_valids;
+#define L4_KWQ_UPDATE_PG_VALIDS_IPID_COUNT (0x1<<0)
+#define L4_KWQ_UPDATE_PG_VALIDS_IPID_COUNT_SHIFT 0
+#define L4_KWQ_UPDATE_PG_VALIDS_DA (0x1<<1)
+#define L4_KWQ_UPDATE_PG_VALIDS_DA_SHIFT 1
+#define L4_KWQ_UPDATE_PG_RESERVERD2 (0x3F<<2)
+#define L4_KWQ_UPDATE_PG_RESERVERD2_SHIFT 2
+#endif
+#if defined(__BIG_ENDIAN)
+	u16 reserverd3;
+	u8 da0;
+	u8 da1;
+#elif defined(__LITTLE_ENDIAN)
+	u8 da1;
+	u8 da0;
+	u16 reserverd3;
+#endif
+#if defined(__BIG_ENDIAN)
+	u8 da2;
+	u8 da3;
+	u8 da4;
+	u8 da5;
+#elif defined(__LITTLE_ENDIAN)
+	u8 da5;
+	u8 da4;
+	u8 da3;
+	u8 da2;
+#endif
+	u32 reserved4;
+	u32 reserved5;
+};
+
+
+/*
+ * a KWQE request to upload a PG or L4 context
+ */
+struct l4_kwq_upload {
+#if defined(__BIG_ENDIAN)
+	u8 flags;
+#define L4_KWQ_UPLOAD_RESERVED1 (0xF<<0)
+#define L4_KWQ_UPLOAD_RESERVED1_SHIFT 0
+#define L4_KWQ_UPLOAD_LAYER_CODE (0x7<<4)
+#define L4_KWQ_UPLOAD_LAYER_CODE_SHIFT 4
+#define L4_KWQ_UPLOAD_LINKED_WITH_NEXT (0x1<<7)
+#define L4_KWQ_UPLOAD_LINKED_WITH_NEXT_SHIFT 7
+	u8 opcode;
+	u16 oper16;
+#elif defined(__LITTLE_ENDIAN)
+	u16 oper16;
+	u8 opcode;
+	u8 flags;
+#define L4_KWQ_UPLOAD_RESERVED1 (0xF<<0)
+#define L4_KWQ_UPLOAD_RESERVED1_SHIFT 0
+#define L4_KWQ_UPLOAD_LAYER_CODE (0x7<<4)
+#define L4_KWQ_UPLOAD_LAYER_CODE_SHIFT 4
+#define L4_KWQ_UPLOAD_LINKED_WITH_NEXT (0x1<<7)
+#define L4_KWQ_UPLOAD_LINKED_WITH_NEXT_SHIFT 7
+#endif
+	u32 cid;
+	u32 reserved2[6];
+};
+
+#endif /* __57XX_L5CM_HSI_LINUX_LE__ */
diff --git a/drivers/net/cnic_drv.h b/drivers/net/cnic_drv.h
new file mode 100644
index 0000000..ab6431f
--- /dev/null
+++ b/drivers/net/cnic_drv.h
@@ -0,0 +1,112 @@
+/* cnic_drv.h: Broadcom CNIC core network driver.
+ *
+ * Copyright (c) 2008 Broadcom Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation.
+ *
+ */
+
+
+#ifndef CNIC_DRV_H
+#define CNIC_DRV_H
+
+struct kwqe;
+struct kcqe;
+struct kwqe_16;
+
+#define MAX_CNIC_CTL_DATA	64
+#define MAX_DRV_CTL_DATA	64
+
+#define CNIC_CTL_STOP_CMD		1
+#define CNIC_CTL_START_CMD		2
+#define CNIC_CTL_COMPLETION_CMD		3
+
+#define DRV_CTL_IO_WR_CMD		0x101
+#define DRV_CTL_IO_RD_CMD		0x102
+#define DRV_CTL_CTX_WR_CMD		0x103
+#define DRV_CTL_CTXTBL_WR_CMD		0x104
+#define DRV_CTL_COMPLETION_CMD		0x105
+
+struct cnic_ctl_completion {
+	u32	cid;
+};
+
+struct drv_ctl_completion {
+	u32	comp_count;
+};
+
+struct cnic_ctl_info {
+	int	cmd;
+	union {
+		struct cnic_ctl_completion comp;
+		char bytes[MAX_CNIC_CTL_DATA];
+	} data;
+};
+
+struct drv_ctl_io {
+	u32		cid_addr;
+	u32		slot;
+	u32		offset;
+	u32		data;
+	dma_addr_t	dma_addr;
+};
+
+struct drv_ctl_info {
+	int	cmd;
+	union {
+		struct drv_ctl_completion comp;
+		struct drv_ctl_io io;
+		char bytes[MAX_DRV_CTL_DATA];
+	} data;
+};
+
+struct cnic_ops {
+	struct module	*cnic_owner;
+	int		(*cnic_handler)(void *, void *);
+	int		(*cnic_ctl)(void *, struct cnic_ctl_info *);
+	unsigned long	reserved[2];
+};
+
+#define MAX_CNIC_VEC	8
+
+struct cnic_irq {
+	unsigned int	vector;
+	void		*status_blk;
+	u32		status_blk_num;
+	u32		irq_flags;
+#define CNIC_IRQ_FL_MSIX		0x00000001
+};
+
+struct cnic_eth_dev {
+	u32		drv_state;
+#define CNIC_DRV_STATE_REGD		0x00000001
+#define CNIC_DRV_STATE_USING_MSIX	0x00000002
+	u32		chip_id;
+	u32		max_kwqe_pending;
+	struct pci_dev	*pdev;
+	void __iomem	*io_base;
+
+	u32		ctx_tbl_offset;
+	u32		ctx_tbl_len;
+	int		ctx_blk_size;
+	u32		starting_cid;
+
+	int		num_irq;
+	struct cnic_irq	irq_arr[MAX_CNIC_VEC];
+	int		(*drv_register_cnic)(struct net_device *,
+					     struct cnic_ops *, void *);
+	int		(*drv_unregister_cnic)(struct net_device *);
+	int		(*drv_submit_kwqes_32)(struct net_device *,
+					       struct kwqe *[], u32);
+	int		(*drv_submit_kwqes_16)(struct net_device *,
+					       struct kwqe_16 *[], u32);
+	int		(*drv_ctl)(struct net_device *, struct drv_ctl_info *);
+	unsigned long	reserved[2];
+};
+
+extern struct cnic_eth_dev *bnx2_cnic_probe(struct net_device *)
+	__attribute__((weak));
+
+#endif
diff --git a/drivers/net/cnic_if.h b/drivers/net/cnic_if.h
new file mode 100644
index 0000000..e77b6ac
--- /dev/null
+++ b/drivers/net/cnic_if.h
@@ -0,0 +1,171 @@
+/* cnic_if.h: Broadcom CNIC core network driver.
+ *
+ * Copyright (c) 2006 Broadcom Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation.
+ *
+ * Written by: John(Zongxi) Chen  (zongxic@broadcom.com)
+ */
+
+
+#ifndef CNIC_IF_H
+#define CNIC_IF_H
+
+#define CNIC_MODULE_VERSION	"1.4.0"
+#define CNIC_MODULE_RELDATE	"May 14, 2008"
+
+#define CNIC_ULP_RDMA		0
+#define CNIC_ULP_ISCSI		1
+#define CNIC_ULP_L4		2
+#define MAX_CNIC_ULP_TYPE_EXT	2
+#define MAX_CNIC_ULP_TYPE	3
+
+struct kwqe {
+	u32 kwqe_op_flag;
+
+	u32 kwqe_info0;
+	u32 kwqe_info1;
+	u32 kwqe_info2;
+	u32 kwqe_info3;
+	u32 kwqe_info4;
+	u32 kwqe_info5;
+	u32 kwqe_info6;
+};
+
+struct kcqe {
+	u32 kcqe_info0;
+	u32 kcqe_info1;
+	u32 kcqe_info2;
+	u32 kcqe_info3;
+	u32 kcqe_info4;
+	u32 kcqe_info5;
+	u32 kcqe_info6;
+	u32 kcqe_op_flag;
+		#define KCQE_FLAGS_LAYER_MASK		(0x7<<28)
+		#define KCQE_FLAGS_LAYER_MASK_MISC	(0<<28)
+		#define KCQE_FLAGS_LAYER_MASK_L2	(2<<28)
+		#define KCQE_FLAGS_LAYER_MASK_L3	(3<<28)
+		#define KCQE_FLAGS_LAYER_MASK_L4	(4<<28)
+		#define KCQE_FLAGS_LAYER_MASK_L5_RDMA	(5<<28)
+		#define KCQE_FLAGS_LAYER_MASK_L5_ISCSI	(6<<28)
+		#define KCQE_FLAGS_NEXT 		(1<<31)
+};
+
+struct cnic_sockaddr {
+	union {
+		struct sockaddr_in	v4;
+		struct sockaddr_in6	v6;
+	} local;
+	union {
+		struct sockaddr_in	v4;
+		struct sockaddr_in6	v6;
+	} remote;
+};
+
+struct cnic_sock {
+	struct cnic_dev *dev;
+	void	*context;
+	u32	src_ip[4];
+	u32	dst_ip[4];
+	u16	src_port;
+	u16	dst_port;
+	u16	vlan_id;
+	unsigned char old_ha[6];
+	struct dst_entry *dst;
+	u32	cid;
+	u32	l5_cid;
+	u32	pg_cid;
+	int	ulp_type;
+
+	u32	ka_timeout;
+	u32	ka_interval;
+	u8	ka_max_probe_count;
+	u8	tos;
+	u8	ttl;
+	u8	snd_seq_scale;
+	u32	rcv_buf;
+	u32	snd_buf;
+	u32	seed;
+
+	unsigned long	tcp_flags;
+#define SK_TCP_NO_DELAY_ACK	0
+#define SK_TCP_KEEP_ALIVE	1
+#define SK_TCP_NAGLE		2
+#define SK_TCP_TIMESTAMP	3
+#define SK_TCP_SACK		4
+#define SK_TCP_SEG_SCALING	5
+	unsigned long	flags;
+#define SK_F_INUSE		0
+#define SK_F_OFFLD_COMPLETE	1
+#define SK_F_OFFLD_SCHED	2
+#define SK_F_PG_OFFLD_COMPLETE	3
+#define SK_F_CONNECT_START	4
+#define SK_F_IPV6		5
+#define SK_F_NDISC_WAITING	6
+
+	atomic_t ref_count;
+
+	struct kwqe kwqe1;
+	struct kwqe kwqe2;
+	struct kwqe kwqe3;
+};
+
+struct cnic_dev {
+	struct net_device	*netdev;
+	struct pci_dev		*pcidev;
+	void __iomem		*regview;
+	struct list_head	list;
+
+	int (*register_device)(struct cnic_dev *dev, int ulp_type,
+			       void *ulp_ctx);
+	int (*unregister_device)(struct cnic_dev *dev, int ulp_type);
+	int (*submit_kwqes)(struct cnic_dev *dev, struct kwqe *wqes[],
+				u32 num_wqes);
+
+	int (*cm_create)(struct cnic_dev *, int, u32, u32, struct cnic_sock **,
+			 void *);
+	int (*cm_destroy)(struct cnic_sock *);
+	int (*cm_connect)(struct cnic_sock *, struct cnic_sockaddr *);
+	int (*cm_abort)(struct cnic_sock *);
+	int (*cm_close)(struct cnic_sock *);
+	struct cnic_dev *(*cm_select_dev)(struct sockaddr_in *, int ulp_type);
+	unsigned long flags;
+#define CNIC_F_IF_UP		0
+#define CNIC_F_CNIC_UP		1
+#define CNIC_F_IF_GOING_DOWN	2
+#define CNIC_F_BNX2_CLASS	3
+#define CNIC_F_BNX2X_CLASS	4
+	atomic_t ref_count;
+	int use_count;
+	void *cnic_priv;
+};
+
+#define CNIC_WR(dev, off, val)		writel(val, dev->regview + off)
+#define CNIC_WR16(dev, off, val)	writew(val, dev->regview + off)
+#define CNIC_WR8(dev, off, val)		writeb(val, dev->regview + off)
+#define CNIC_RD(dev, off)		readl(dev->regview + off)
+
+struct cnic_ulp_ops {
+	void (*cnic_init)(struct cnic_dev *dev);
+	void (*cnic_exit)(struct cnic_dev *dev);
+	void (*cnic_start)(void *ulp_ctx);
+	void (*cnic_stop)(void *ulp_ctx);
+	void (*indicate_kcqes)(void *ulp_ctx, struct kcqe *cqes[],
+				u32 num_cqes);
+	void (*indicate_netevent)(void *ulp_ctx, unsigned long event);
+	void (*indicate_inetevent)(void *ulp_ctx, unsigned long event);
+	void (*cm_connect_complete)(struct cnic_sock *);
+	void (*cm_close_complete)(struct cnic_sock *);
+	void (*cm_abort_complete)(struct cnic_sock *);
+	void (*cm_remote_close)(struct cnic_sock *);
+	void (*cm_remote_abort)(struct cnic_sock *);
+	struct module *owner;
+};
+
+extern int cnic_register_driver(int ulp_type, struct cnic_ulp_ops *ulp_ops);
+
+extern int cnic_unregister_driver(int ulp_type);
+
+#endif
-- 
1.5.5.GIT

Re: [PATCH 2/3] cnic: Add CNIC driver.

[Paul E. McKenney]

On Wed, May 21, 2008 at 06:06:25PM -0700, Michael Chan wrote:
> The CNIC driver controls BNX2 hardware rings and resources used by
> iSCSI.  It depends on the BNX2 driver to reset the chip and set up
> the proper link speed.
> 
> All hardware resources for iSCSI are separate from those used for
> ethernet networking.  If MSI-X is used, the CNIC driver will
> register its own MSI-X vector for iSCSI interrupts.  If MSI-X is
> not used, the single interrupt will be shared between the BNX2
> driver and the CNIC driver.

Some questions interspersed below.

							Thanx, Paul

> Signed-off-by: Michael Chan <mchan@broadcom.com>
> ---
>  drivers/net/Kconfig     |   10 +
>  drivers/net/Makefile    |    1 +
>  drivers/net/cnic.c      | 2439 +++++++++++++++++++++++++++++++++++++++++++++++
>  drivers/net/cnic.h      |  221 +++++
>  drivers/net/cnic_defs.h |  553 +++++++++++
>  drivers/net/cnic_drv.h  |  112 +++
>  drivers/net/cnic_if.h   |  171 ++++
>  7 files changed, 3507 insertions(+), 0 deletions(-)
>  create mode 100644 drivers/net/cnic.c
>  create mode 100644 drivers/net/cnic.h
>  create mode 100644 drivers/net/cnic_defs.h
>  create mode 100644 drivers/net/cnic_drv.h
>  create mode 100644 drivers/net/cnic_if.h
> 
> diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
> index 9f6cc8a..f7f51f2 100644
> --- a/drivers/net/Kconfig
> +++ b/drivers/net/Kconfig
> @@ -2245,6 +2245,16 @@ config BNX2
>  	  To compile this driver as a module, choose M here: the module
>  	  will be called bnx2.  This is recommended.
> 
> +config CNIC
> +	tristate "Broadcom CNIC support"
> +	depends on BNX2
> +	help
> +	  This driver supports offload features of Broadcom NetXtremeII
> +	  gigabit Ethernet cards.
> +
> +	  To compile this driver as a module, choose M here: the module
> +	  will be called cnic.  This is recommended.
> +
>  config SPIDER_NET
>  	tristate "Spider Gigabit Ethernet driver"
>  	depends on PCI && (PPC_IBM_CELL_BLADE || PPC_CELLEB)
> diff --git a/drivers/net/Makefile b/drivers/net/Makefile
> index dcbfe84..39ec0db 100644
> --- a/drivers/net/Makefile
> +++ b/drivers/net/Makefile
> @@ -67,6 +67,7 @@ obj-$(CONFIG_FEALNX) += fealnx.o
>  obj-$(CONFIG_TIGON3) += tg3.o
>  obj-$(CONFIG_BNX2) += bnx2.o
>  obj-$(CONFIG_BNX2X) += bnx2x.o
> +obj-$(CONFIG_CNIC) += cnic.o
>  spidernet-y += spider_net.o spider_net_ethtool.o
>  obj-$(CONFIG_SPIDER_NET) += spidernet.o sungem_phy.o
>  obj-$(CONFIG_GELIC_NET) += ps3_gelic.o
> diff --git a/drivers/net/cnic.c b/drivers/net/cnic.c
> new file mode 100644
> index 0000000..fbeb3a8
> --- /dev/null
> +++ b/drivers/net/cnic.c
> @@ -0,0 +1,2439 @@
> +/* cnic.c: Broadcom CNIC core network driver.
> + *
> + * Copyright (c) 2006-2007 Broadcom Corporation
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU General Public License as published by
> + * the Free Software Foundation.
> + *
> + * Written by: John(Zongxi) Chen (zongxi@broadcom.com)
> + * Modified and maintained by: Michael Chan <mchan@broadcom.com>
> + */
> +
> +#include <linux/module.h>
> +
> +#include <linux/kernel.h>
> +#include <linux/errno.h>
> +#include <linux/list.h>
> +#include <linux/slab.h>
> +#include <linux/pci.h>
> +#include <linux/init.h>
> +#include <linux/netdevice.h>
> +#include <linux/inetdevice.h>
> +#include <linux/in.h>
> +#include <linux/dma-mapping.h>
> +#include <asm/byteorder.h>
> +#include <linux/delay.h>
> +#include <linux/ethtool.h>
> +#include <linux/if_vlan.h>
> +#define BCM_VLAN 1
> +#include <net/ip.h>
> +#include <net/tcp.h>
> +#include <net/arp.h>
> +#include <net/neighbour.h>
> +#include <net/route.h>
> +#include <net/ipv6.h>
> +#include <net/ip6_route.h>
> +#include <net/addrconf.h>
> +#include <net/netevent.h>
> +
> +#define BCM_CNIC 1
> +#include "cnic_drv.h"
> +#include "bnx2.h"
> +#include "cnic_if.h"
> +#include "cnic.h"
> +#include "cnic_defs.h"
> +
> +#define DRV_MODULE_NAME 	"cnic"
> +#define PFX DRV_MODULE_NAME ": "
> +
> +static char version[] __devinitdata =
> +	"Broadcom NetXtreme II CNIC Driver " DRV_MODULE_NAME " v" CNIC_MODULE_VERSION " (" CNIC_MODULE_RELDATE ")\n";
> +
> +MODULE_AUTHOR("John(Zongxi) Chen <zongxic@broadcom.com>");
> +MODULE_DESCRIPTION("Broadcom NetXtreme II CNIC Driver");
> +MODULE_LICENSE("GPL");
> +MODULE_VERSION(CNIC_MODULE_VERSION);
> +
> +static LIST_HEAD(cnic_dev_list);
> +static DEFINE_RWLOCK(cnic_dev_lock);
> +static DEFINE_MUTEX(cnic_lock);
> +
> +struct cnic_ulp_ops *cnic_ulp_tbl[MAX_CNIC_ULP_TYPE];
> +
> +static int cnic_service_bnx2(void *, void *);
> +static int cnic_ctl(void *, struct cnic_ctl_info *);
> +
> +static struct cnic_ops cnic_bnx2_ops = {
> +	.cnic_owner	= THIS_MODULE,
> +	.cnic_handler	= cnic_service_bnx2,
> +	.cnic_ctl	= cnic_ctl,
> +};
> +
> +static inline void cnic_hold(struct cnic_dev *dev)
> +{
> +	atomic_inc(&dev->ref_count);
> +}
> +
> +static inline void cnic_put(struct cnic_dev *dev)
> +{
> +	atomic_dec(&dev->ref_count);
> +}
> +
> +static inline void csk_hold(struct cnic_sock *csk)
> +{
> +	atomic_inc(&csk->ref_count);
> +}
> +
> +static inline void csk_put(struct cnic_sock *csk)
> +{
> +	atomic_dec(&csk->ref_count);
> +}
> +
> +static void cnic_bnx2_ctx_wr(struct cnic_dev *dev, u32 cid_addr, u32 off,
> +			     u32 val)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +	struct cnic_eth_dev *ethdev = cp->ethdev;
> +	struct drv_ctl_info info;
> +	struct drv_ctl_io *io = &info.data.io;
> +
> +	info.cmd = DRV_CTL_CTX_WR_CMD;
> +	io->cid_addr = cid_addr;
> +	io->offset = off;
> +	io->data = val;
> +	ethdev->drv_ctl(dev->netdev, &info);
> +}
> +
> +static void cnic_bnx2_reg_wr_ind(struct cnic_dev *dev, u32 off, u32 val)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +	struct cnic_eth_dev *ethdev = cp->ethdev;
> +	struct drv_ctl_info info;
> +	struct drv_ctl_io *io = &info.data.io;
> +
> +	info.cmd = DRV_CTL_IO_WR_CMD;
> +	io->offset = off;
> +	io->data = val;
> +	ethdev->drv_ctl(dev->netdev, &info);
> +}
> +
> +static u32 cnic_bnx2_reg_rd_ind(struct cnic_dev *dev, u32 off)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +	struct cnic_eth_dev *ethdev = cp->ethdev;
> +	struct drv_ctl_info info;
> +	struct drv_ctl_io *io = &info.data.io;
> +
> +	info.cmd = DRV_CTL_IO_WR_CMD;
> +	io->offset = off;
> +	ethdev->drv_ctl(dev->netdev, &info);
> +	return io->data;
> +}
> +
> +static int cnic_in_use(struct cnic_sock *csk)
> +{
> +	return (test_bit(SK_F_INUSE, &csk->flags));
> +}
> +
> +static int cnic_offld_prep(struct cnic_sock *csk)
> +{
> +	if (!test_bit(SK_F_CONNECT_START, &csk->flags))
> +		return 0;
> +
> +	if (test_and_set_bit(SK_F_OFFLD_SCHED, &csk->flags))
> +		return 0;
> +
> +	return 1;
> +}
> +
> +static int cnic_abort_prep(struct cnic_sock *csk)
> +{
> +	while (test_and_set_bit(SK_F_OFFLD_SCHED, &csk->flags))
> +		msleep(1);
> +
> +	if (test_bit(SK_F_OFFLD_COMPLETE, &csk->flags))
> +		return 1;
> +
> +	return 0;
> +}
> +
> +static void cnic_abort_done(struct cnic_sock *csk)
> +{
> +	smp_mb__before_clear_bit();
> +	clear_bit(SK_F_OFFLD_SCHED, &csk->flags);
> +}
> +
> +int cnic_register_driver(int ulp_type, struct cnic_ulp_ops *ulp_ops)
> +{
> +	struct cnic_dev *dev;
> +
> +	if (ulp_type >= MAX_CNIC_ULP_TYPE) {
> +		printk(KERN_ERR PFX "cnic_register_driver: Bad type %d\n",
> +		       ulp_type);
> +		return -EINVAL;
> +	}
> +	mutex_lock(&cnic_lock);
> +	if (cnic_ulp_tbl[ulp_type]) {
> +		printk(KERN_ERR PFX "cnic_register_driver: Type %d has already "
> +				    "been registered\n", ulp_type);
> +		mutex_unlock(&cnic_lock);
> +		return -EBUSY;
> +	}
> +
> +	read_lock(&cnic_dev_lock);
> +	list_for_each_entry(dev, &cnic_dev_list, list) {
> +		struct cnic_local *cp = dev->cnic_priv;
> +
> +		clear_bit(ULP_F_INIT, &cp->ulp_flags[ulp_type]);
> +	}
> +	read_unlock(&cnic_dev_lock);
> +
> +	rcu_assign_pointer(cnic_ulp_tbl[ulp_type], ulp_ops);

OK, protected by cnic_lock.

> +	mutex_unlock(&cnic_lock);
> +
> +	/* Prevent race conditions with netdev_event */
> +	rtnl_lock();
> +	read_lock(&cnic_dev_lock);
> +	list_for_each_entry(dev, &cnic_dev_list, list) {
> +		struct cnic_local *cp = dev->cnic_priv;
> +
> +		if (!test_and_set_bit(ULP_F_INIT, &cp->ulp_flags[ulp_type]))
> +			ulp_ops->cnic_init(dev);
> +	}
> +	read_unlock(&cnic_dev_lock);
> +	rtnl_unlock();
> +
> +	return 0;
> +}
> +
> +int cnic_unregister_driver(int ulp_type)
> +{
> +	struct cnic_dev *dev;
> +
> +	if (ulp_type >= MAX_CNIC_ULP_TYPE) {
> +		printk(KERN_ERR PFX "cnic_unregister_driver: Bad type %d\n",
> +		       ulp_type);
> +		return -EINVAL;
> +	}
> +	mutex_lock(&cnic_lock);
> +	if (!cnic_ulp_tbl[ulp_type]) {
> +		printk(KERN_ERR PFX "cnic_unregister_driver: Type %d has not "
> +				    "been registered\n", ulp_type);
> +		goto out_unlock;
> +	}
> +	read_lock(&cnic_dev_lock);
> +	list_for_each_entry(dev, &cnic_dev_list, list) {
> +		struct cnic_local *cp = dev->cnic_priv;
> +		
> +		if (rcu_dereference(cp->ulp_ops[ulp_type])) {

The rcu_dereference() is redundant because we hold cnic_lock.
(Which is OK, just wanting to make sure I understand the code.)

> +			printk(KERN_ERR PFX "cnic_unregister_driver: Type %d "
> +			       "still has devices registered\n", ulp_type);
> +			read_unlock(&cnic_dev_lock);
> +			goto out_unlock;
> +		}
> +	}
> +	read_unlock(&cnic_dev_lock);
> +
> +	rcu_assign_pointer(cnic_ulp_tbl[ulp_type], NULL);

OK, protected by cnic_lock.

> +
> +	mutex_unlock(&cnic_lock);
> +	synchronize_rcu();

The caller is responsible for freeing up cnic_ulp_tbl[ulp_type]?  If so,
the caller had better have kept a pointer to it...

But the caller would need to snapshot the pointer before the cnic_lock
was acquired, which means that some other pointer might in fact be
in place by the time this function returns.

So, is this data element statically allocated?  Or is there some other
trick being used?

Or is the whole point of this code simply to ensure that any calls to
the old cnic_ulp_tbl[ulp_type] functions have completed before this
function returns?  If so, please add a comment to this effect.

> +	return 0;
> +
> +out_unlock:
> +	mutex_unlock(&cnic_lock);
> +	return -EINVAL;
> +}
> +
> +EXPORT_SYMBOL(cnic_register_driver);
> +EXPORT_SYMBOL(cnic_unregister_driver);
> +
> +static int cnic_start_hw(struct cnic_dev *);
> +static void cnic_stop_hw(struct cnic_dev *);
> +
> +static int cnic_register_device(struct cnic_dev *dev, int ulp_type,
> +				void *ulp_ctx)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +	struct cnic_ulp_ops *ulp_ops;
> +
> +	if (ulp_type >= MAX_CNIC_ULP_TYPE) {
> +		printk(KERN_ERR PFX "cnic_register_device: Bad type %d\n",
> +		       ulp_type);
> +		return -EINVAL;
> +	}
> +	mutex_lock(&cnic_lock);
> +	if (cnic_ulp_tbl[ulp_type] == NULL) {
> +		printk(KERN_ERR PFX "cnic_register_device: Driver with type %d "
> +				    "has not been registered\n", ulp_type);
> +		mutex_unlock(&cnic_lock);
> +		return -EAGAIN;
> +	}
> +	if (rcu_dereference(cp->ulp_ops[ulp_type])) {

Again, the rcu_dereference() is redundant due to the cnic_lock being
held, and again, this is OK, just checking to make sure I understand it.

> +		printk(KERN_ERR PFX "cnic_register_device: Type %d has already "
> +		       "been registered to this device\n", ulp_type);
> +		mutex_unlock(&cnic_lock);
> +		return -EBUSY;
> +	}
> +	if (!try_module_get(cnic_ulp_tbl[ulp_type]->owner)) {
> +		mutex_unlock(&cnic_lock);
> +		return -EBUSY;
> +	}
> +
> +	clear_bit(ULP_F_START, &cp->ulp_flags[ulp_type]);
> +	cp->ulp_handle[ulp_type] = ulp_ctx;
> +	ulp_ops = cnic_ulp_tbl[ulp_type];
> +	rcu_assign_pointer(cp->ulp_ops[ulp_type], ulp_ops);

Good, protected by cnic_lock.

> +	cnic_hold(dev);
> +	if (!dev->use_count) {
> +		if (!test_bit(CNIC_F_IF_GOING_DOWN, &dev->flags)) {
> +			if (dev->netdev->flags & IFF_UP)
> +				set_bit(CNIC_F_IF_UP, &dev->flags);
> +		}
> +	}
> +	dev->use_count++;
> +
> +	if (dev->use_count == 1) {
> +		if (test_bit(CNIC_F_IF_UP, &dev->flags))
> +			cnic_start_hw(dev);
> +	}
> +
> +	if (test_bit(CNIC_F_CNIC_UP, &dev->flags))
> +		if (!test_and_set_bit(ULP_F_START, &cp->ulp_flags[ulp_type]))
> +			ulp_ops->cnic_start(cp->ulp_handle[ulp_type]);
> +
> +	mutex_unlock(&cnic_lock);
> +
> +	return 0;
> +
> +}
> +
> +static int cnic_unregister_device(struct cnic_dev *dev, int ulp_type)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +
> +	if (ulp_type >= MAX_CNIC_ULP_TYPE) {
> +		printk(KERN_ERR PFX "cnic_unregister_device: Bad type %d\n",
> +		       ulp_type);
> +		return -EINVAL;
> +	}
> +	mutex_lock(&cnic_lock);
> +	if (rcu_dereference(cp->ulp_ops[ulp_type])) {

Ditto...

> +		dev->use_count--;
> +		module_put(cp->ulp_ops[ulp_type]->owner);
> +		rcu_assign_pointer(cp->ulp_ops[ulp_type], NULL);

OK, cnic_lock held...

> +		if (dev->use_count == 0)
> +			cnic_stop_hw(dev);
> +		cnic_put(dev);
> +	} else {
> +		printk(KERN_ERR PFX "cnic_unregister_device: device not "
> +		       "registered to this ulp type %d\n", ulp_type);
> +		mutex_unlock(&cnic_lock);
> +		return -EINVAL;
> +	}
> +	mutex_unlock(&cnic_lock);
> +
> +	synchronize_rcu();

Caller is again responsible for freeing up cp->ulp_ops[ulp_type]?
If so, the caller had better have obtained a reference to it beforehand.
But it might have changed in the meantime.  So, how is this freed?

Or is this statically allocated with the only purpose of the
synchronize_rcu() being to ensure that calls though the old ops vector
have completed before this function returns?  If so, please add a
comment to this effect.

> +
> +	return 0;
> +}
> +
> +static void cnic_free_dma(struct cnic_dev *dev, struct cnic_dma *dma)
> +{
> +	int i;
> +
> +	if (!dma->pg_arr)
> +		return;
> +
> +	for (i = 0; i < dma->num_pages; i++) {
> +		if (dma->pg_arr[i]) {
> +			pci_free_consistent(dev->pcidev, BCM_PAGE_SIZE,
> +					    dma->pg_arr[i], dma->pg_map_arr[i]);
> +			dma->pg_arr[i] = NULL;
> +		}
> +	}
> +	if (dma->pgtbl) {
> +		pci_free_consistent(dev->pcidev, dma->pgtbl_size,
> +				    dma->pgtbl, dma->pgtbl_map);
> +		dma->pgtbl = NULL;
> +	}
> +	kfree(dma->pg_arr);
> +	dma->pg_arr = NULL;
> +	dma->num_pages = 0;
> +}
> +
> +static void cnic_setup_page_tbl(struct cnic_dev *dev, struct cnic_dma *dma)
> +{
> +	int i;
> +	u32 *page_table = dma->pgtbl;
> +
> +	for (i = 0; i < dma->num_pages; i++) {
> +		/* Each entry needs to be in big endian format. */
> +		*page_table = (u32) ((u64) dma->pg_map_arr[i] >> 32);
> +		page_table++;
> +		*page_table = (u32) dma->pg_map_arr[i];
> +		page_table++;
> +	}
> +}
> +
> +static int cnic_alloc_dma(struct cnic_dev *dev, struct cnic_dma *dma,
> +			  int pages, int use_pg_tbl)
> +{
> +	int i, size;
> +	struct cnic_local *cp = dev->cnic_priv;
> +
> +	size = pages * (sizeof(void *) + sizeof(dma_addr_t));
> +	dma->pg_arr = kzalloc(size, GFP_ATOMIC);
> +	if (dma->pg_arr == NULL)
> +		return -ENOMEM;
> +
> +	dma->pg_map_arr = (dma_addr_t *) (dma->pg_arr + pages);
> +	dma->num_pages = pages;
> +
> +	for (i = 0; i < pages; i++) {
> +		dma->pg_arr[i] = pci_alloc_consistent(dev->pcidev,
> +						      BCM_PAGE_SIZE,
> +						      &dma->pg_map_arr[i]);
> +		if (dma->pg_arr[i] == NULL)
> +			goto error;
> +	}
> +	if (!use_pg_tbl)
> +		return 0;
> +
> +	dma->pgtbl_size = ((pages * 8) + BCM_PAGE_SIZE - 1) &
> +			  (BCM_PAGE_SIZE - 1);
> +	dma->pgtbl = pci_alloc_consistent(dev->pcidev, dma->pgtbl_size,
> +					  &dma->pgtbl_map);
> +	if (dma->pgtbl == NULL)
> +		goto error;
> +
> +	cp->setup_pgtbl(dev, dma);
> +
> +	return 0;
> +
> +error:
> +	cnic_free_dma(dev, dma);
> +	return -ENOMEM;
> +}
> +
> +static void cnic_free_resc(struct cnic_dev *dev)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +	int i;
> +
> +	for (i = 0; i < cp->ctx_blks; i++) {
> +		if (cp->ctx_arr[i].ctx) {
> +			pci_free_consistent(dev->pcidev, cp->ctx_blk_size,
> +					    cp->ctx_arr[i].ctx,
> +					    cp->ctx_arr[i].mapping);
> +			cp->ctx_arr[i].ctx = NULL;
> +		}
> +	}
> +	kfree(cp->ctx_arr);
> +	cp->ctx_arr = NULL;
> +	cp->ctx_blks = 0;
> +
> +	cnic_free_dma(dev, &cp->kwq_info);
> +	cnic_free_dma(dev, &cp->kcq_info);
> +	return;
> +}
> +
> +static int cnic_alloc_context(struct cnic_dev *dev)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +
> +	if (CHIP_NUM(cp) == CHIP_NUM_5709) {
> +		int i, k, arr_size;
> +
> +		cp->ctx_blk_size = BCM_PAGE_SIZE;
> +		cp->cids_per_blk = BCM_PAGE_SIZE / 128;
> +		arr_size = BNX2_MAX_CID / cp->cids_per_blk *
> +			   sizeof(struct cnic_ctx);
> +		cp->ctx_arr = kmalloc(arr_size, GFP_KERNEL);
> +		if (cp->ctx_arr == NULL)
> +			return -ENOMEM;
> +
> +		memset(cp->ctx_arr, 0, arr_size);
> +
> +		k = 0;
> +		for (i = 0; i < 2; i++) {
> +			u32 j, reg, off, lo, hi;
> +
> +			if (i == 0)
> +				off = BNX2_PG_CTX_MAP;
> +			else
> +				off = BNX2_ISCSI_CTX_MAP;
> +
> +			reg = cnic_bnx2_reg_rd_ind(dev, off);
> +			lo = reg >> 16;
> +			hi = reg & 0xffff;
> +			for (j = lo; j < hi; j += cp->cids_per_blk, k++)
> +				cp->ctx_arr[k].cid = j;
> +		}
> +
> +		cp->ctx_blks = k;
> +
> +		for (i = 0; i < cp->ctx_blks; i++) {
> +			cp->ctx_arr[i].ctx =
> +				pci_alloc_consistent(dev->pcidev, BCM_PAGE_SIZE,
> +						     &cp->ctx_arr[i].mapping);
> +			if (cp->ctx_arr[i].ctx == NULL)
> +				return -ENOMEM;
> +		}
> +	}
> +	return 0;
> +}
> +
> +static int cnic_alloc_bnx2_resc(struct cnic_dev *dev)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +	int ret;
> +
> +	ret = cnic_alloc_dma(dev, &cp->kwq_info, KWQ_PAGE_CNT, 1);
> +	if (ret)
> +		goto error;
> +	cp->kwq = (struct kwqe **) cp->kwq_info.pg_arr;
> +
> +	ret = cnic_alloc_dma(dev, &cp->kcq_info, KCQ_PAGE_CNT, 1);
> +	if (ret)
> +		goto error;
> +	cp->kcq = (struct kcqe **) cp->kcq_info.pg_arr;
> +
> +	ret = cnic_alloc_context(dev);
> +	if (ret)
> +		goto error;
> +
> +	return 0;
> +	
> +error:
> +	cnic_free_resc(dev);
> +	return ret;
> +}
> +
> +static inline u32 cnic_kwq_avail(struct cnic_local *cp)
> +{
> +	return (cp->max_kwq_idx -
> +		((cp->kwq_prod_idx - cp->kwq_con_idx) & cp->max_kwq_idx));
> +}
> +
> +static int cnic_submit_bnx2_kwqes(struct cnic_dev *dev, struct kwqe *wqes[],
> +				  u32 num_wqes)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +	struct kwqe *prod_qe;
> +	u16 prod, sw_prod, i;
> +
> +	if (!test_bit(CNIC_F_CNIC_UP, &dev->flags))
> +		return -EAGAIN;		/* bnx2 is down */
> +
> +	spin_lock_bh(&cp->cnic_ulp_lock);
> +	if (num_wqes > cnic_kwq_avail(cp) &&
> +	    !(cp->cnic_local_flags & CNIC_LCL_FL_KWQ_INIT)) {
> +		spin_unlock_bh(&cp->cnic_ulp_lock);
> +		return -EAGAIN;
> +	}
> +
> +	cp->cnic_local_flags &= ~CNIC_LCL_FL_KWQ_INIT;
> +
> +	prod = cp->kwq_prod_idx;
> +	sw_prod = prod & MAX_KWQ_IDX;
> +	for (i = 0; i < num_wqes; i++) {
> +		prod_qe = &cp->kwq[KWQ_PG(sw_prod)][KWQ_IDX(sw_prod)];
> +		memcpy(prod_qe, wqes[i], sizeof(struct kwqe));
> +		prod++;
> +		sw_prod = prod & MAX_KWQ_IDX;
> +	}
> +	cp->kwq_prod_idx = prod;
> +
> +	CNIC_WR16(dev, cp->kwq_io_addr, cp->kwq_prod_idx);
> +
> +	spin_unlock_bh(&cp->cnic_ulp_lock);
> +	return 0;
> +}
> +
> +static void service_kcqes(struct cnic_dev *dev, int num_cqes)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +	int i, j;
> +
> +	i = 0;
> +	j = 1;
> +	while (num_cqes) {
> +		struct cnic_ulp_ops *ulp_ops;
> +		int ulp_type;
> +		u32 kcqe_op_flag = cp->completed_kcq[i]->kcqe_op_flag;
> +		u32 kcqe_layer = kcqe_op_flag & KCQE_FLAGS_LAYER_MASK;
> +
> +		while (j < num_cqes) {
> +			u32 next_op = cp->completed_kcq[i + j]->kcqe_op_flag;
> +
> +			if ((next_op & KCQE_FLAGS_LAYER_MASK) != kcqe_layer)
> +				break;
> +			j++;
> +		}
> +
> +		if (kcqe_layer == KCQE_FLAGS_LAYER_MASK_L5_RDMA)
> +			ulp_type = CNIC_ULP_RDMA;
> +		else if (kcqe_layer == KCQE_FLAGS_LAYER_MASK_L5_ISCSI)
> +			ulp_type = CNIC_ULP_ISCSI;
> +		else if (kcqe_layer == KCQE_FLAGS_LAYER_MASK_L4)
> +			ulp_type = CNIC_ULP_L4;
> +		else {
> +			printk(KERN_ERR PFX "%s: Unknown type of KCQE(0x%x)\n",
> +			       dev->netdev->name, kcqe_op_flag);
> +			goto end;
> +		}
> +
> +		rcu_read_lock();
> +		ulp_ops = rcu_dereference(cp->ulp_ops[ulp_type]);
> +		if (likely(ulp_ops)) {
> +			ulp_ops->indicate_kcqes(cp->ulp_handle[ulp_type],
> +						  cp->completed_kcq + i, j);
> +		}
> +		rcu_read_unlock();
> +end:
> +		num_cqes -= j;
> +		i += j;
> +		j = 1;
> +	}
> +	return;
> +}
> +
> +static int cnic_get_kcqes(struct cnic_dev *dev, u16 hw_prod, u16 sw_prod)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +	u16 i, max;
> +	struct kcqe *kcqe;
> +	int kcqe_cnt = 0;
> +
> +	i = sw_prod & MAX_KCQ_IDX;
> +	max = hw_prod & MAX_KCQ_IDX;
> +	while ((i != max) && (kcqe_cnt < MAX_COMPLETED_KCQE)) {
> +		cp->completed_kcq[kcqe_cnt++] = &cp->kcq[KCQ_PG(i)][KCQ_IDX(i)];
> +		i = (i + 1) & MAX_KCQ_IDX;
> +	}
> +
> +	kcqe = cp->completed_kcq[kcqe_cnt - 1];
> +	while (kcqe->kcqe_op_flag & KCQE_FLAGS_NEXT) {
> +		kcqe_cnt--;
> +		if (kcqe_cnt == 0)
> +			goto done;
> +		kcqe = cp->completed_kcq[kcqe_cnt - 1];
> +	}
> +done:
> +	return kcqe_cnt;
> +}
> +
> +static int cnic_service_bnx2(void *data, void *status_blk)
> +{
> +	struct cnic_dev *dev = data;
> +	struct status_block *sblk = status_blk;
> +	struct cnic_local *cp = dev->cnic_priv;
> +	u32 status_idx = sblk->status_idx;
> +	u16 hw_prod, sw_prod;
> +	int kcqe_cnt;
> +
> +	if (unlikely(!test_bit(CNIC_F_CNIC_UP, &dev->flags)))
> +		return status_idx;
> +
> +	cp->kwq_con_idx = sblk->status_rx_quick_consumer_index15;
> +
> +	hw_prod = sblk->status_completion_producer_index;
> +	sw_prod = cp->kcq_prod_idx;
> +	while (sw_prod != hw_prod) {
> +		kcqe_cnt = cnic_get_kcqes(dev, hw_prod, sw_prod);
> +		if (kcqe_cnt == 0)
> +			goto done;
> +		sw_prod += kcqe_cnt;
> +
> +		service_kcqes(dev, kcqe_cnt);
> +
> +		/* Tell compiler that status_blk fields can change. */
> +		barrier();
> +		if (status_idx != sblk->status_idx) {
> +			status_idx = sblk->status_idx;
> +			cp->kwq_con_idx =
> +				sblk->status_rx_quick_consumer_index15;
> +			hw_prod = sblk->status_completion_producer_index;
> +		} else
> +			break;
> +	}
> +
> +done:
> +	CNIC_WR16(dev, cp->kcq_io_addr, sw_prod);
> +
> +	cp->kcq_prod_idx = sw_prod;
> +	return status_idx;
> +}
> +
> +static void cnic_service_bnx2_msix(unsigned long data)
> +{
> +	struct cnic_dev *dev = (struct cnic_dev *) data;
> +	struct cnic_local *cp = dev->cnic_priv;
> +	struct status_block_msix *status_blk = cp->bnx2_status_blk;
> +	u32 status_idx = status_blk->status_idx;
> +	u16 hw_prod, sw_prod;
> +	int kcqe_cnt;
> +
> +	cp->kwq_con_idx = status_blk->status_cmd_consumer_index;
> +
> +	hw_prod = status_blk->status_completion_producer_index;
> +	sw_prod = cp->kcq_prod_idx;
> +	while (sw_prod != hw_prod) {
> +		kcqe_cnt = cnic_get_kcqes(dev, hw_prod, sw_prod);
> +		if (kcqe_cnt == 0)
> +			goto done;
> +		sw_prod += kcqe_cnt;
> +
> +		service_kcqes(dev, kcqe_cnt);
> +
> +		/* Tell compiler that status_blk fields can change. */
> +		barrier();
> +		if (status_idx != status_blk->status_idx) {
> +			status_idx = status_blk->status_idx;
> +			cp->kwq_con_idx = status_blk->status_cmd_consumer_index;
> +			hw_prod = status_blk->status_completion_producer_index;
> +		} else
> +			break;
> +	}
> +
> +done:
> +	CNIC_WR16(dev, cp->kcq_io_addr, sw_prod);
> +
> +	cp->kcq_prod_idx = sw_prod;
> +	cp->last_status_idx = status_idx;
> +	CNIC_WR(dev, BNX2_PCICFG_INT_ACK_CMD, BNX2_CNIC_INT_NUM |
> +		BNX2_PCICFG_INT_ACK_CMD_INDEX_VALID | cp->last_status_idx);
> +}
> +
> +static irqreturn_t cnic_irq(int irq, void *dev_instance)
> +{
> +	struct cnic_dev *dev = dev_instance;
> +	struct cnic_local *cp = dev->cnic_priv;
> +	u16 prod = cp->kcq_prod_idx & MAX_KCQ_IDX;
> +
> +	if (cp->ack_int)
> +		cp->ack_int(dev);
> +
> +	prefetch(cp->status_blk);
> +	prefetch(&cp->kcq[KCQ_PG(prod)][KCQ_IDX(prod)]);
> +
> +	if (likely(test_bit(CNIC_F_CNIC_UP, &dev->flags)))
> +		tasklet_schedule(&cp->cnic_irq_task);
> +
> +	return IRQ_HANDLED;
> +}
> +
> +static void cnic_ulp_stop(struct cnic_dev *dev)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +	int if_type;
> +
> +	rcu_read_lock();
> +	for (if_type = 0; if_type < MAX_CNIC_ULP_TYPE; if_type++) {
> +		struct cnic_ulp_ops *ulp_ops;
> +
> +		ulp_ops = rcu_dereference(cp->ulp_ops[if_type]);
> +		if (!ulp_ops)
> +			continue;
> +
> +		if (test_and_clear_bit(ULP_F_START, &cp->ulp_flags[if_type]))
> +			ulp_ops->cnic_stop(cp->ulp_handle[if_type]);
> +	}
> +	rcu_read_unlock();
> +}
> +
> +static void cnic_ulp_start(struct cnic_dev *dev)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +	int if_type;
> +
> +	rcu_read_lock();
> +	for (if_type = 0; if_type < MAX_CNIC_ULP_TYPE; if_type++) {
> +		struct cnic_ulp_ops *ulp_ops;
> +
> +		ulp_ops = rcu_dereference(cp->ulp_ops[if_type]);
> +		if (!ulp_ops)
> +			continue;
> +
> +		if (!test_and_set_bit(ULP_F_START, &cp->ulp_flags[if_type]))
> +			ulp_ops->cnic_start(cp->ulp_handle[if_type]);
> +	}
> +	rcu_read_unlock();
> +}
> +
> +static int cnic_ctl(void *data, struct cnic_ctl_info *info)
> +{
> +	struct cnic_dev *dev = data;
> +
> +	switch (info->cmd) {
> +	case CNIC_CTL_STOP_CMD:
> +		cnic_hold(dev);
> +		mutex_lock(&cnic_lock);
> +
> +		clear_bit(CNIC_F_IF_UP, &dev->flags);
> +		cnic_ulp_stop(dev);
> +		cnic_stop_hw(dev);
> +
> +		mutex_unlock(&cnic_lock);
> +		cnic_put(dev);
> +		break;
> +	case CNIC_CTL_START_CMD:
> +		cnic_hold(dev);
> +		mutex_lock(&cnic_lock);
> +
> +		set_bit(CNIC_F_IF_UP, &dev->flags);
> +		if (dev->use_count) {
> +			if (!cnic_start_hw(dev))
> +				cnic_ulp_start(dev);
> +		}
> +		mutex_unlock(&cnic_lock);
> +		cnic_put(dev);
> +		break;
> +	default:
> +		return -EINVAL;
> +	}
> +	return 0;
> +}
> +
> +
> +static void cnic_ulp_init(struct cnic_dev *dev)
> +{
> +	int i;
> +	struct cnic_local *cp = dev->cnic_priv;
> +
> +	rcu_read_lock();
> +	for (i = 0; i < MAX_CNIC_ULP_TYPE_EXT; i++) {
> +		struct cnic_ulp_ops *ulp_ops;
> +
> +		ulp_ops = rcu_dereference(cnic_ulp_tbl[i]);
> +		if (!ulp_ops || !try_module_get(ulp_ops->owner))
> +			continue;
> +
> +		if (!test_and_set_bit(ULP_F_INIT, &cp->ulp_flags[i]))
> +			ulp_ops->cnic_init(dev);
> +
> +		module_put(ulp_ops->owner);
> +	}
> +	rcu_read_unlock();
> +}
> +
> +static void cnic_ulp_exit(struct cnic_dev *dev)
> +{
> +	int i;
> +	struct cnic_local *cp = dev->cnic_priv;
> +
> +	rcu_read_lock();
> +	for (i = 0; i < MAX_CNIC_ULP_TYPE_EXT; i++) {
> +		struct cnic_ulp_ops *ulp_ops;
> +
> +		ulp_ops = rcu_dereference(cnic_ulp_tbl[i]);
> +		if (!ulp_ops || !try_module_get(ulp_ops->owner))
> +			continue;
> +
> +		if (test_and_clear_bit(ULP_F_INIT, &cp->ulp_flags[i]))
> +			ulp_ops->cnic_exit(dev);
> +
> +		module_put(ulp_ops->owner);
> +	}
> +	rcu_read_unlock();
> +}
> +
> +static int cnic_queue_work(struct cnic_local *cp, u32 work_type, void *data)
> +{
> +	struct cnic_work_node *node;
> +	int bytes = sizeof(u32 *);
> +
> +	spin_lock_bh(&cp->wr_lock);
> +
> +	node = &cp->cnic_work_ring[cp->cnic_wr_prod];
> +	node->work_type = work_type;
> +	if (work_type == WORK_TYPE_KCQE)
> +		bytes = sizeof(struct kcqe);
> +	if (work_type == WORK_TYPE_REDIRECT)
> +		bytes = sizeof(struct cnic_redirect_entry);
> +	memcpy(&node->work_data, data, bytes);
> +	cp->cnic_wr_prod++;
> +	cp->cnic_wr_prod &= WORK_RING_SIZE_MASK;
> +
> +	spin_unlock_bh(&cp->wr_lock);
> +	return 0;
> +}
> +
> +static int cnic_cm_offload_pg(struct cnic_sock *csk)
> +{
> +	struct cnic_dev *dev = csk->dev;
> +	struct l4_kwq_offload_pg *l4kwqe;
> +	struct kwqe *wqes[1];
> +	struct neighbour *neigh = csk->dst->neighbour;
> +	struct net_device *netdev = neigh->dev;
> +
> +	l4kwqe = (struct l4_kwq_offload_pg *) &csk->kwqe1;
> +	memset(l4kwqe, 0, sizeof(*l4kwqe));
> +	wqes[0] = (struct kwqe *) l4kwqe;
> +
> +	l4kwqe->op_code = L4_KWQE_OPCODE_VALUE_OFFLOAD_PG;
> +	l4kwqe->flags =
> +		L4_LAYER_CODE << L4_KWQ_OFFLOAD_PG_LAYER_CODE_SHIFT;
> +	l4kwqe->l2hdr_nbytes = ETH_HLEN;
> +	l4kwqe->da0 = neigh->ha[0];
> +	l4kwqe->da1 = neigh->ha[1];
> +	l4kwqe->da2 = neigh->ha[2];
> +	l4kwqe->da3 = neigh->ha[3];
> +	l4kwqe->da4 = neigh->ha[4];
> +	l4kwqe->da5 = neigh->ha[5];
> +
> +	l4kwqe->sa0 = netdev->dev_addr[0];
> +	l4kwqe->sa1 = netdev->dev_addr[1];
> +	l4kwqe->sa2 = netdev->dev_addr[2];
> +	l4kwqe->sa3 = netdev->dev_addr[3];
> +	l4kwqe->sa4 = netdev->dev_addr[4];
> +	l4kwqe->sa5 = netdev->dev_addr[5];
> +
> +	l4kwqe->etype = ETH_P_IP;
> +	l4kwqe->ipid_count = DEF_IPID_COUNT;
> +	l4kwqe->host_opaque = csk->l5_cid;
> +
> +	if (csk->vlan_id) {
> +		l4kwqe->pg_flags |= L4_KWQ_OFFLOAD_PG_VLAN_TAGGING;
> +		l4kwqe->vlan_tag = csk->vlan_id;
> +		l4kwqe->l2hdr_nbytes += 4;
> +	}
> +
> +	return (dev->submit_kwqes(dev, wqes, 1));
> +}
> +
> +static int cnic_cm_update_pg(struct cnic_sock *csk)
> +{
> +	struct cnic_dev *dev = csk->dev;
> +	struct l4_kwq_update_pg *l4kwqe;
> +	struct kwqe *wqes[1];
> +	struct neighbour *neigh = csk->dst->neighbour;
> +
> +	l4kwqe = (struct l4_kwq_update_pg *) &csk->kwqe1;
> +	memset(l4kwqe, 0, sizeof(*l4kwqe));
> +	wqes[0] = (struct kwqe *) l4kwqe;
> +
> +	l4kwqe->opcode = L4_KWQE_OPCODE_VALUE_UPDATE_PG;
> +	l4kwqe->flags =
> +		L4_LAYER_CODE << L4_KWQ_UPDATE_PG_LAYER_CODE_SHIFT;
> +	l4kwqe->pg_cid = csk->pg_cid;
> +	l4kwqe->da0 = neigh->ha[0];
> +	l4kwqe->da1 = neigh->ha[1];
> +	l4kwqe->da2 = neigh->ha[2];
> +	l4kwqe->da3 = neigh->ha[3];
> +	l4kwqe->da4 = neigh->ha[4];
> +	l4kwqe->da5 = neigh->ha[5];
> +
> +	l4kwqe->pg_host_opaque = 0;
> +	l4kwqe->pg_valids = L4_KWQ_UPDATE_PG_VALIDS_DA;
> +
> +	return (dev->submit_kwqes(dev, wqes, 1));
> +}
> +
> +static int cnic_cm_upload_pg(struct cnic_sock *csk)
> +{
> +	struct cnic_dev *dev = csk->dev;
> +	struct l4_kwq_upload *l4kwqe;
> +	struct kwqe *wqes[1];
> +
> +	l4kwqe = (struct l4_kwq_upload *) &csk->kwqe1;
> +	memset(l4kwqe, 0, sizeof(*l4kwqe));
> +	wqes[0] = (struct kwqe *) l4kwqe;
> +
> +	l4kwqe->opcode = L4_KWQE_OPCODE_VALUE_UPLOAD_PG;
> +	l4kwqe->flags =
> +		L4_LAYER_CODE << L4_KWQ_UPLOAD_LAYER_CODE_SHIFT;
> +	l4kwqe->cid = csk->pg_cid;
> +
> +	return (dev->submit_kwqes(dev, wqes, 1));
> +}
> +
> +static void cnic_redirect(struct cnic_local *cp, struct dst_entry *new,
> +			  struct dst_entry *old)
> +{
> +	int i, found = 0;
> +
> +	for (i = 0; i < MAX_CM_SK_TBL_SZ && !found; i++) {
> +		struct cnic_sock *csk;
> +		struct cnic_redirect_entry cnic_redir;
> +
> +		csk = &cp->csk_tbl[i];
> +		csk_hold(csk);
> +		if (cnic_in_use(csk) && csk->dst == old) {
> +			found = 1;
> +			dst_hold(new);
> +			dst_hold(old);
> +
> +			cnic_redir.old_dst = old;
> +			cnic_redir.new_dst = new;
> +			cnic_queue_work(cp, WORK_TYPE_REDIRECT, &cnic_redir);
> +			tasklet_schedule(&cp->cnic_task);
> +		}
> +		csk_put(csk);
> +	}
> +}
> +
> +static void cnic_update_neigh(struct cnic_local *cp, struct neighbour *neigh)
> +{
> +	int i, found = 0;
> +
> +	for (i = 0; i < MAX_CM_SK_TBL_SZ && !found; i++) {
> +		struct cnic_sock *csk;
> +
> +		csk = &cp->csk_tbl[i];
> +		csk_hold(csk);
> +		if (cnic_in_use(csk) && csk->dst) {
> +			if (csk->dst->neighbour == neigh) {
> +				found = 1;
> +				neigh_hold(neigh);
> +
> +				cnic_queue_work(cp, WORK_TYPE_NEIGH_UPDATE,
> +						&neigh);
> +				tasklet_schedule(&cp->cnic_task);
> +			}
> +		}
> +		csk_put(csk);
> +	}
> +}
> +
> +static int cnic_net_callback(struct notifier_block *this, unsigned long event,
> +	void *ptr)
> +{
> +	struct cnic_local *cp = container_of(this, struct cnic_local, cm_nb);
> +
> +	if (event == NETEVENT_NEIGH_UPDATE) {
> +		struct neighbour *neigh = ptr;
> +
> +		cnic_update_neigh(cp, neigh);
> +
> +	} else if (event == NETEVENT_REDIRECT) {
> +		struct netevent_redirect *netevent = ptr;
> +		struct dst_entry *old_dst = netevent->old;
> +		struct dst_entry *new_dst = netevent->new;
> +
> +		cnic_redirect(cp, new_dst, old_dst);
> +	}
> +	return 0;
> +}
> +
> +static int cnic_cm_conn_req(struct cnic_sock *csk)
> +{
> +	struct cnic_dev *dev = csk->dev;
> +	struct l4_kwq_connect_req1 *l4kwqe1;
> +	struct l4_kwq_connect_req2 *l4kwqe2;
> +	struct l4_kwq_connect_req3 *l4kwqe3;
> +	struct kwqe *wqes[3];
> +	u8 tcp_flags = 0;
> +	int num_wqes = 2;
> +
> +	l4kwqe1 = (struct l4_kwq_connect_req1 *) &csk->kwqe1;
> +	l4kwqe2 = (struct l4_kwq_connect_req2 *) &csk->kwqe2;
> +	l4kwqe3 = (struct l4_kwq_connect_req3 *) &csk->kwqe3;
> +	memset(l4kwqe1, 0, sizeof(*l4kwqe1));
> +	memset(l4kwqe2, 0, sizeof(*l4kwqe2));
> +	memset(l4kwqe3, 0, sizeof(*l4kwqe3));
> +
> +	l4kwqe3->op_code = L4_KWQE_OPCODE_VALUE_CONNECT3;
> +	l4kwqe3->flags =
> +		L4_LAYER_CODE << L4_KWQ_CONNECT_REQ3_LAYER_CODE_SHIFT;
> +	l4kwqe3->ka_timeout = csk->ka_timeout;
> +	l4kwqe3->ka_interval = csk->ka_interval;
> +	l4kwqe3->ka_max_probe_count = csk->ka_max_probe_count;
> +	l4kwqe3->tos = csk->tos;
> +	l4kwqe3->ttl = csk->ttl;
> +	l4kwqe3->snd_seq_scale = csk->snd_seq_scale;
> +	l4kwqe3->pmtu = dst_mtu(csk->dst);
> +	l4kwqe3->rcv_buf = csk->rcv_buf;
> +	l4kwqe3->snd_buf = csk->snd_buf;
> +	l4kwqe3->seed = csk->seed;
> +
> +	wqes[0] = (struct kwqe *) l4kwqe1;
> +	if (test_bit(SK_F_IPV6, &csk->flags)) {
> +		wqes[1] = (struct kwqe *) l4kwqe2;
> +		wqes[2] = (struct kwqe *) l4kwqe3;
> +		num_wqes = 3;
> +
> +		l4kwqe1->conn_flags = L4_KWQ_CONNECT_REQ1_IP_V6;
> +		l4kwqe2->op_code = L4_KWQE_OPCODE_VALUE_CONNECT2;
> +		l4kwqe2->flags =
> +			L4_KWQ_CONNECT_REQ2_LINKED_WITH_NEXT |
> +			L4_LAYER_CODE << L4_KWQ_CONNECT_REQ2_LAYER_CODE_SHIFT;
> +		l4kwqe2->src_ip_v6_2 = be32_to_cpu(csk->src_ip[1]);
> +		l4kwqe2->src_ip_v6_3 = be32_to_cpu(csk->src_ip[2]);
> +		l4kwqe2->src_ip_v6_4 = be32_to_cpu(csk->src_ip[3]);
> +		l4kwqe2->dst_ip_v6_2 = be32_to_cpu(csk->dst_ip[1]);
> +		l4kwqe2->dst_ip_v6_3 = be32_to_cpu(csk->dst_ip[2]);
> +		l4kwqe2->dst_ip_v6_4 = be32_to_cpu(csk->dst_ip[3]);
> +		l4kwqe3->mss = l4kwqe3->pmtu - sizeof(struct ipv6hdr) -
> +			       sizeof(struct tcphdr);
> +	} else {
> +		wqes[1] = (struct kwqe *) l4kwqe3;
> +		l4kwqe3->mss = l4kwqe3->pmtu - sizeof(struct iphdr) -
> +			       sizeof(struct tcphdr);
> +	}
> +
> +	l4kwqe1->op_code = L4_KWQE_OPCODE_VALUE_CONNECT1;
> +	l4kwqe1->flags =
> +		(L4_LAYER_CODE << L4_KWQ_CONNECT_REQ1_LAYER_CODE_SHIFT) |
> +		 L4_KWQ_CONNECT_REQ3_LINKED_WITH_NEXT;
> +	l4kwqe1->cid = csk->cid;
> +	l4kwqe1->pg_cid = csk->pg_cid;
> +	l4kwqe1->src_ip = be32_to_cpu(csk->src_ip[0]);
> +	l4kwqe1->dst_ip = be32_to_cpu(csk->dst_ip[0]);
> +	l4kwqe1->src_port = be16_to_cpu(csk->src_port);
> +	l4kwqe1->dst_port = be16_to_cpu(csk->dst_port);
> +	if (csk->tcp_flags & SK_TCP_NO_DELAY_ACK)
> +		tcp_flags |= L4_KWQ_CONNECT_REQ1_NO_DELAY_ACK;
> +	if (csk->tcp_flags & SK_TCP_KEEP_ALIVE)
> +		tcp_flags |= L4_KWQ_CONNECT_REQ1_KEEP_ALIVE;
> +	if (csk->tcp_flags & SK_TCP_NAGLE)
> +		tcp_flags |= L4_KWQ_CONNECT_REQ1_NAGLE_ENABLE;
> +	if (csk->tcp_flags & SK_TCP_TIMESTAMP)
> +		tcp_flags |= L4_KWQ_CONNECT_REQ1_TIME_STAMP;
> +	if (csk->tcp_flags & SK_TCP_SACK)
> +		tcp_flags |= L4_KWQ_CONNECT_REQ1_SACK;
> +	if (csk->tcp_flags & SK_TCP_SEG_SCALING)
> +		tcp_flags |= L4_KWQ_CONNECT_REQ1_SEG_SCALING;
> +	
> +	l4kwqe1->tcp_flags = tcp_flags;
> +
> +	return (dev->submit_kwqes(dev, wqes, num_wqes));
> +}
> +
> +static int cnic_cm_close_req(struct cnic_sock *csk)
> +{
> +	struct cnic_dev *dev = csk->dev;
> +	struct l4_kwq_close_req *l4kwqe;
> +	struct kwqe *wqes[1];
> +
> +	l4kwqe = (struct l4_kwq_close_req *) &csk->kwqe2;
> +	memset(l4kwqe, 0, sizeof(*l4kwqe));
> +	wqes[0] = (struct kwqe *) l4kwqe;
> +
> +	l4kwqe->op_code = L4_KWQE_OPCODE_VALUE_CLOSE;
> +	l4kwqe->flags = L4_LAYER_CODE << L4_KWQ_CLOSE_REQ_LAYER_CODE_SHIFT;
> +	l4kwqe->cid = csk->cid;
> +
> +	return (dev->submit_kwqes(dev, wqes, 1));
> +}
> +
> +static int cnic_cm_abort_req(struct cnic_sock *csk)
> +{
> +	struct cnic_dev *dev = csk->dev;
> +	struct l4_kwq_reset_req *l4kwqe;
> +	struct kwqe *wqes[1];
> +
> +	l4kwqe = (struct l4_kwq_reset_req *) &csk->kwqe2;
> +	memset(l4kwqe, 0, sizeof(*l4kwqe));
> +	wqes[0] = (struct kwqe *) l4kwqe;
> +
> +	l4kwqe->op_code = L4_KWQE_OPCODE_VALUE_RESET;
> +	l4kwqe->flags = L4_LAYER_CODE << L4_KWQ_RESET_REQ_LAYER_CODE_SHIFT;
> +	l4kwqe->cid = csk->cid;
> +
> +	return (dev->submit_kwqes(dev, wqes, 1));
> +}
> +
> +static int cnic_cm_create(struct cnic_dev *dev, int ulp_type, u32 cid,
> +			  u32 l5_cid, struct cnic_sock **csk, void *context)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +	struct cnic_sock *csk1;
> +
> +	if (l5_cid >= MAX_CM_SK_TBL_SZ)
> +		return -EINVAL;
> +		
> +	csk1 = &cp->csk_tbl[l5_cid];
> +	if (test_and_set_bit(SK_F_INUSE, &csk1->flags))
> +		return -EINVAL;
> +
> +	csk1->dev = dev;
> +	csk1->cid = cid;
> +	csk1->l5_cid = l5_cid;
> +	csk1->ulp_type = ulp_type;
> +	csk1->context = context;
> +
> +	csk1->ka_timeout = DEF_KA_TIMEOUT;
> +	csk1->ka_interval = DEF_KA_INTERVAL;
> +	csk1->ka_max_probe_count = DEF_KA_MAX_PROBE_COUNT;
> +	csk1->tos = DEF_TOS;
> +	csk1->ttl = DEF_TTL;
> +	csk1->snd_seq_scale = DEF_SND_SEQ_SCALE;
> +	csk1->rcv_buf = DEF_RCV_BUF;
> +	csk1->snd_buf = DEF_SND_BUF;
> +	csk1->seed = DEF_SEED;
> +
> +	*csk = csk1;
> +
> +	return 0;
> +}
> +
> +static void cnic_close_conn(struct cnic_sock *csk)
> +{
> +	clear_bit(SK_F_OFFLD_COMPLETE, &csk->flags);
> +	cnic_cm_upload_pg(csk);
> +	clear_bit(SK_F_PG_OFFLD_COMPLETE, &csk->flags);
> +	clear_bit(SK_F_OFFLD_SCHED, &csk->flags);
> +}
> +
> +static void cnic_cm_cleanup(struct cnic_sock *csk)
> +{
> +	if (csk->dst) {
> +		if (csk->dst->neighbour)
> +			neigh_release(csk->dst->neighbour);
> +		dst_release(csk->dst);
> +		csk->dst = NULL;
> +	}
> +}
> +
> +static int cnic_cm_destroy(struct cnic_sock *csk)
> +{
> +	if (!cnic_in_use(csk))
> +		return -EINVAL;
> +
> +	clear_bit(SK_F_INUSE, &csk->flags);
> +	smp_mb__after_clear_bit();
> +	while (atomic_read(&csk->ref_count) != 0)
> +		msleep(1);
> +	cnic_cm_cleanup(csk);
> +
> +	csk->flags = 0;
> +	return 0;
> +}
> +
> +static inline u16 cnic_get_vlan(struct net_device *dev,
> +				struct net_device **vlan_dev)
> +{
> +	if (dev->priv_flags & IFF_802_1Q_VLAN) {
> +		*vlan_dev = vlan_dev_info(dev)->real_dev;
> +		return vlan_dev_info(dev)->vlan_id;
> +	}
> +	*vlan_dev = dev;
> +	return 0;
> +}
> +
> +static int cnic_get_v4_route(struct sockaddr_in *dst_addr,
> +			     struct sockaddr_in *src_addr,
> +			     struct dst_entry **dst)
> +{
> +	struct flowi fl;
> +	int err;
> +	struct rtable *rt;
> +
> +	memset(&fl, 0, sizeof(fl));
> +	fl.nl_u.ip4_u.daddr = dst_addr->sin_addr.s_addr;
> +	if (src_addr)
> +		fl.nl_u.ip4_u.saddr = src_addr->sin_addr.s_addr;
> +
> +	err = ip_route_output_key(&init_net, &rt, &fl);
> +	if (!err)
> +		*dst = &rt->u.dst;
> +	return err;
> +}
> +
> +static int cnic_get_v6_route(struct sockaddr_in6 *dst_addr,
> +			     struct sockaddr_in6 *src_addr,
> +			     struct dst_entry **dst)
> +{
> +#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
> +	struct flowi fl;
> +
> +	memset(&fl, 0, sizeof(fl));
> +	ipv6_addr_copy(&fl.fl6_dst, &dst_addr->sin6_addr);
> +	if (ipv6_addr_type(&fl.fl6_dst) & IPV6_ADDR_LINKLOCAL)
> +		fl.oif = dst_addr->sin6_scope_id;
> +
> +	if (src_addr)
> +		ipv6_addr_copy(&fl.fl6_src, &src_addr->sin6_addr);
> +
> +	*dst = ip6_route_output(NULL, &fl);
> +	if (*dst)
> +		return 0;
> +#endif
> +
> +	return -ENETUNREACH;
> +}
> +
> +static struct cnic_dev *cnic_cm_select_dev(struct sockaddr_in *dst_addr,
> +					   int ulp_type)
> +{
> +	struct cnic_dev *dev = NULL;
> +	struct dst_entry *dst;
> +	struct net_device *netdev = NULL;
> +	int err = -ENETUNREACH, found = 0;
> +
> +	if (dst_addr->sin_family == AF_INET)
> +		err = cnic_get_v4_route(dst_addr, NULL, &dst);
> +	else if (dst_addr->sin_family == AF_INET6) {
> +		struct sockaddr_in6 *dst_addr6 =
> +			(struct sockaddr_in6 *) dst_addr;
> +
> +		err = cnic_get_v6_route(dst_addr6, NULL, &dst);
> +	} else
> +		return NULL;
> +
> +	if (err)
> +		return NULL;
> +
> +	if (!dst->dev)
> +		goto done;
> +
> +	cnic_get_vlan(dst->dev, &netdev);
> +
> +	read_lock(&cnic_dev_lock);
> +	list_for_each_entry(dev, &cnic_dev_list, list) {
> +		if (netdev == dev->netdev) {
> +			found = 1;
> +			break;
> +		}
> +	}
> +	read_unlock(&cnic_dev_lock);
> +
> +done:
> +	dst_release(dst);
> +	if (!found)
> +		dev = NULL;
> +	return dev;
> +}
> +
> +static int cnic_resolve_addr(struct cnic_sock *csk)
> +{
> +	struct neighbour *neigh = csk->dst->neighbour;
> +	int err = 0;
> +
> +	if (neigh->nud_state & NUD_VALID) {
> +		err = -EINVAL;
> +		if (cnic_offld_prep(csk))
> +			err = cnic_cm_offload_pg(csk);
> +		goto done;
> +	}
> +
> +	set_bit(SK_F_NDISC_WAITING, &csk->flags);
> +	neigh_event_send(neigh, NULL);
> +done:
> +	return err;
> +}
> +
> +static int cnic_get_route(struct cnic_sock *csk, struct cnic_sockaddr *saddr)
> +{
> +	struct cnic_dev *dev = csk->dev;
> +	int is_v6, err;
> +	struct dst_entry *dst;
> +	struct net_device *realdev;
> +
> +	if (saddr->local.v6.sin6_family == AF_INET6 &&
> +	    saddr->remote.v6.sin6_family == AF_INET6)
> +		is_v6 = 1;
> +	else if (saddr->local.v4.sin_family == AF_INET &&
> +		 saddr->remote.v4.sin_family == AF_INET)
> +		is_v6 = 0;
> +	else
> +		return -EINVAL;
> +
> +	clear_bit(SK_F_IPV6, &csk->flags);
> +
> +	if (is_v6) {
> +		set_bit(SK_F_IPV6, &csk->flags);
> +		err = cnic_get_v6_route(&saddr->remote.v6,
> +					&saddr->local.v6, &dst);
> +		if (err)
> +			return err;
> +
> +		if (!dst || dst->error || !dst->dev)
> +			goto err_out;
> +
> +		ipv6_get_saddr(dst, &saddr->remote.v6.sin6_addr,
> +			       &saddr->local.v6.sin6_addr);
> +
> +		memcpy(&csk->src_ip[0], &saddr->local.v6.sin6_addr,
> +		       sizeof(struct in6_addr));
> +		memcpy(&csk->dst_ip[0], &saddr->remote.v6.sin6_addr,
> +		       sizeof(struct in6_addr));
> +		csk->src_port = saddr->local.v6.sin6_port;
> +		csk->dst_port = saddr->remote.v6.sin6_port;
> +
> +	} else {
> +		err = cnic_get_v4_route(&saddr->remote.v4, &saddr->local.v4,
> +					&dst);
> +		if (err)
> +			return err;
> +
> +		if (!dst || dst->error || !dst->dev)
> +			goto err_out;
> +
> +		csk->dst_ip[0] = saddr->remote.v4.sin_addr.s_addr;
> +		csk->src_ip[0] = saddr->local.v4.sin_addr.s_addr;
> +		csk->src_port = saddr->local.v4.sin_port;
> +		csk->dst_port = saddr->remote.v4.sin_port;
> +
> +		if (csk->src_ip[0] == 0) {
> +			csk->src_ip[0] =
> +				inet_select_addr(dst->dev, csk->dst_ip[0],
> +						 RT_SCOPE_LINK);
> +		}
> +	}
> +
> +	csk->vlan_id = cnic_get_vlan(dst->dev, &realdev);
> +	if (realdev != dev->netdev)
> +		goto err_out;
> +
> +	csk->dst = dst;
> +	return 0;
> +
> +err_out:
> +	dst_release(dst);
> +	return -ENETUNREACH;
> +}
> +
> +static int cnic_cm_connect(struct cnic_sock *csk, struct cnic_sockaddr *saddr)
> +{
> +	struct neighbour *neigh;
> +	int err = 0;
> +
> +	if (!cnic_in_use(csk))
> +		return -EINVAL;
> +
> +	if (test_and_set_bit(SK_F_CONNECT_START, &csk->flags))
> +		return -EINVAL;
> +
> +	clear_bit(SK_F_OFFLD_SCHED, &csk->flags);
> +
> +	err = cnic_get_route(csk, saddr);
> +	if (err)
> +		goto err_out;
> +
> +	neigh = csk->dst->neighbour;
> +	if (!neigh)
> +		goto err_out;
> +
> +	neigh_hold(neigh);
> +
> +	err = cnic_resolve_addr(csk);
> +	if (!err)
> +		return 0;
> +
> +	neigh_release(neigh);
> +
> +err_out:
> +	if (csk->dst) {
> +		dst_release(csk->dst);
> +		csk->dst = NULL;
> +	}
> +	clear_bit(SK_F_CONNECT_START, &csk->flags);
> +	return err;
> +}
> +
> +static int cnic_cm_abort(struct cnic_sock *csk)
> +{
> +	if (!cnic_in_use(csk))
> +		return -EINVAL;
> +
> +	clear_bit(SK_F_NDISC_WAITING, &csk->flags);
> +	clear_bit(SK_F_CONNECT_START, &csk->flags);
> +	smp_mb__after_clear_bit();
> +	if (cnic_abort_prep(csk))
> +		return (cnic_cm_abort_req(csk));
> +
> +	/* Getting here means that we haven't started connect, or
> +	 * connect was not successful.
> +	 */
> +
> +	if (test_bit(SK_F_PG_OFFLD_COMPLETE, &csk->flags))
> +		cnic_close_conn(csk);
> +
> +	cnic_cm_cleanup(csk);
> +	cnic_abort_done(csk);
> +
> +	return 0;
> +}
> +
> +static int cnic_cm_close(struct cnic_sock *csk)
> +{
> +	if (!cnic_in_use(csk))
> +		return -EINVAL;
> +
> +	if (test_bit(SK_F_OFFLD_COMPLETE, &csk->flags))
> +		return (cnic_cm_close_req(csk));
> +
> +	return -EINVAL;
> +}
> +
> +static void cnic_cm_upcall(struct cnic_local *cp, struct cnic_sock *csk,
> +			   u8 opcode)
> +{
> +	struct cnic_ulp_ops *ulp_ops;
> +	int ulp_type = csk->ulp_type;
> +
> +	rcu_read_lock();
> +	ulp_ops = rcu_dereference(cp->ulp_ops[ulp_type]);
> +	if (ulp_ops) {
> +		if (opcode == L4_KCQE_OPCODE_VALUE_CONNECT_COMPLETE)
> +			ulp_ops->cm_connect_complete(csk);
> +		else if (opcode == L4_KCQE_OPCODE_VALUE_CLOSE_COMP)
> +			ulp_ops->cm_close_complete(csk);
> +		else if (opcode == L4_KCQE_OPCODE_VALUE_RESET_RECEIVED)
> +			ulp_ops->cm_remote_abort(csk);
> +		else if (opcode == L4_KCQE_OPCODE_VALUE_RESET_COMP)
> +			ulp_ops->cm_abort_complete(csk);
> +		else if (opcode == L4_KCQE_OPCODE_VALUE_CLOSE_RECEIVED)
> +			ulp_ops->cm_remote_close(csk);
> +	}
> +	rcu_read_unlock();
> +}
> +
> +static int cnic_cm_set_pg(struct cnic_sock *csk)
> +{
> +	struct neighbour *neigh = csk->dst->neighbour;
> +	int valid = neigh->nud_state & NUD_VALID;
> +
> +	if (!valid) {
> +		if (test_and_clear_bit(SK_F_NDISC_WAITING, &csk->flags)) {
> +			clear_bit(SK_F_CONNECT_START, &csk->flags);
> +			cnic_cm_cleanup(csk);
> +			return -ETIMEDOUT;
> +		}
> +	}
> +
> +	if (cnic_offld_prep(csk)) {
> +		if (test_bit(SK_F_PG_OFFLD_COMPLETE, &csk->flags))
> +			cnic_cm_update_pg(csk);
> +		else
> +			cnic_cm_offload_pg(csk);
> +	}
> +	clear_bit(SK_F_NDISC_WAITING, &csk->flags);
> +	return 0;
> +}
> +
> +static void cnic_cm_process_neigh(struct cnic_dev *dev, struct neighbour *neigh)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +	int i;
> +
> +	for (i = 0; i < MAX_CM_SK_TBL_SZ; i++) {
> +		struct cnic_sock *csk;
> +		int abort = 0;
> +
> +		csk = &cp->csk_tbl[i];
> +		csk_hold(csk);
> +		if (cnic_in_use(csk) && csk->dst &&
> +		    csk->dst->neighbour == neigh) {
> +			if (cnic_cm_set_pg(csk))
> +				abort = 1;
> +		}
> +		if (abort)
> +			cnic_cm_upcall(cp, csk,
> +				L4_KCQE_OPCODE_VALUE_CONNECT_COMPLETE);
> +		csk_put(csk);
> +	}
> +	neigh_release(neigh);
> +}
> +
> +static void cnic_cm_process_redirect(struct cnic_dev *dev,
> +				     struct cnic_redirect_entry *redir)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +	int i;
> +
> +	for (i = 0; i < MAX_CM_SK_TBL_SZ; i++) {
> +		struct cnic_sock *csk;
> +		int abort = 0;
> +
> +		csk = &cp->csk_tbl[i];
> +		csk_hold(csk);
> +		if (cnic_in_use(csk) &&
> +		    csk->dst == redir->old_dst) {
> +			csk->dst = redir->new_dst;
> +			dst_hold(csk->dst);
> +			neigh_hold(csk->dst->neighbour);
> +			if (redir->old_dst->neighbour);
> +				neigh_release(redir->old_dst->neighbour);
> +			dst_release(redir->old_dst);
> +			if (cnic_cm_set_pg(csk))
> +				abort = 1;
> +		}
> +		if (abort)
> +			cnic_cm_upcall(cp, csk,
> +				L4_KCQE_OPCODE_VALUE_CONNECT_COMPLETE);
> +		csk_put(csk);
> +	}
> +
> +	dst_release(redir->new_dst);
> +	dst_release(redir->old_dst);
> +}
> +
> +static void cnic_cm_process_offld_pg(struct cnic_dev *dev, struct l4_kcq *kcqe)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +	u32 l5_cid = kcqe->pg_host_opaque;
> +	u8 opcode = kcqe->op_code;
> +	struct cnic_sock *csk = &cp->csk_tbl[l5_cid];
> +
> +	if (!cnic_in_use(csk))
> +		return;
> +
> +	csk->pg_cid = kcqe->pg_cid;
> +	if (opcode == L4_KCQE_OPCODE_VALUE_UPDATE_PG) {
> +		clear_bit(SK_F_OFFLD_SCHED, &csk->flags);
> +		return;
> +	}
> +	set_bit(SK_F_PG_OFFLD_COMPLETE, &csk->flags);
> +	cnic_cm_conn_req(csk);
> +}
> +
> +static void cnic_cm_process_kcqe(struct cnic_dev *dev, struct kcqe *kcqe)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +	struct l4_kcq *l4kcqe = (struct l4_kcq *) kcqe;
> +	u8 opcode = l4kcqe->op_code;
> +	u32 l5_cid;
> +	struct cnic_sock *csk;
> +
> +	if (opcode == L4_KCQE_OPCODE_VALUE_OFFLOAD_PG ||
> +	    opcode == L4_KCQE_OPCODE_VALUE_UPDATE_PG) {
> +		cnic_cm_process_offld_pg(dev, l4kcqe);
> +		return;
> +	}
> +
> +	l5_cid = l4kcqe->conn_id;
> +	if (l5_cid >= MAX_CM_SK_TBL_SZ)
> +		return;
> +
> +	csk = &cp->csk_tbl[l5_cid];
> +
> +	if (!cnic_in_use(csk))
> +		return;
> +
> +	if (opcode == L4_KCQE_OPCODE_VALUE_CONNECT_COMPLETE) {
> +
> +		if (l4kcqe->status == 0)
> +			set_bit(SK_F_OFFLD_COMPLETE, &csk->flags);
> +
> +		smp_mb__before_clear_bit();
> +		clear_bit(SK_F_OFFLD_SCHED, &csk->flags);
> +		cnic_cm_upcall(cp, csk, opcode);
> +
> +	} else if (opcode == L4_KCQE_OPCODE_VALUE_CLOSE_COMP ||
> +		   opcode == L4_KCQE_OPCODE_VALUE_RESET_COMP ||
> +		   opcode == L4_KCQE_OPCODE_VALUE_RESET_RECEIVED) {
> +
> +		clear_bit(SK_F_CONNECT_START, &csk->flags);
> +		cnic_close_conn(csk);
> +		cnic_cm_cleanup(csk);
> +		cnic_abort_done(csk);
> +		cnic_cm_upcall(cp, csk, opcode);
> +
> +	} else if (opcode == L4_KCQE_OPCODE_VALUE_CLOSE_RECEIVED) {
> +		cnic_cm_upcall(cp, csk, opcode);
> +	}
> +}
> +
> +static void cnic_cm_indicate_kcqe(void *data, struct kcqe *kcqe[], u32 num_cqe)
> +{
> +	struct cnic_dev *dev = data;
> +	int i;
> +	struct cnic_local *cp = dev->cnic_priv;
> +
> +	for (i = 0; i < num_cqe; i++)
> +		cnic_queue_work(cp, WORK_TYPE_KCQE, kcqe[i]);
> +
> +	tasklet_schedule(&cp->cnic_task);
> +}
> +
> +static void cnic_cm_indicate_event(void *data, unsigned long event)
> +{
> +}
> +
> +static void cnic_cm_dummy(void *data)
> +{
> +}
> +
> +static struct cnic_ulp_ops cm_ulp_ops = {
> +	.cnic_start		= cnic_cm_dummy,
> +	.cnic_stop		= cnic_cm_dummy,
> +	.indicate_kcqes		= cnic_cm_indicate_kcqe,
> +	.indicate_netevent	= cnic_cm_indicate_event,
> +	.indicate_inetevent	= cnic_cm_indicate_event,
> +};
> +
> +static void cnic_task(unsigned long data)
> +{
> +	struct cnic_local *cp = (struct cnic_local *) data;
> +	struct cnic_dev *dev = cp->dev;
> +	u32 cons = cp->cnic_wr_cons;
> +	u32 prod = cp->cnic_wr_prod;
> +
> +	while (cons != prod) {
> +		struct cnic_work_node *node;
> +
> +		node = &cp->cnic_work_ring[cons];
> +		if (node->work_type == WORK_TYPE_KCQE)
> +			cnic_cm_process_kcqe(dev, &node->work_data.kcqe);
> +		else if (node->work_type == WORK_TYPE_NEIGH_UPDATE)
> +			cnic_cm_process_neigh(dev, node->work_data.neigh);
> +		else if (node->work_type == WORK_TYPE_REDIRECT)
> +			cnic_cm_process_redirect(dev,
> +				&node->work_data.cnic_redir);
> +		cons++;
> +		cons &= WORK_RING_SIZE_MASK;
> +	}
> +	cp->cnic_wr_cons = cons;
> +}
> +
> +static void cnic_free_dev(struct cnic_dev *dev)
> +{
> +	int i = 0;
> +
> +	while ((atomic_read(&dev->ref_count) != 0) && i < 10) {
> +		msleep(100);
> +		i++;
> +	}
> +	if (atomic_read(&dev->ref_count) != 0)
> +		printk(KERN_ERR PFX "%s: Failed waiting for ref count to go"
> +				    " to zero.\n", dev->netdev->name);
> +
> +	printk(KERN_INFO PFX "Removed CNIC device: %s\n", dev->netdev->name);
> +	dev_put(dev->netdev);
> +	kfree(dev);
> +}
> +
> +static void cnic_cm_free_mem(struct cnic_dev *dev)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +
> +	kfree(cp->csk_tbl);
> +	cp->csk_tbl = NULL;
> +}
> +
> +static int cnic_cm_alloc_mem(struct cnic_dev *dev)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +
> +	cp->csk_tbl = kmalloc(sizeof(struct cnic_sock) * MAX_CM_SK_TBL_SZ,
> +			      GFP_KERNEL);
> +	if (!cp->csk_tbl)
> +		return -ENOMEM;
> +	memset(cp->csk_tbl, 0, sizeof(struct cnic_sock) * MAX_CM_SK_TBL_SZ);
> +	return 0;
> +}
> +
> +static void cnic_cm_stop_bnx2_hw(struct cnic_dev *dev)
> +{
> +}
> +
> +static int cnic_cm_init_bnx2_hw(struct cnic_dev *dev)
> +{
> +	u32 seed;
> +
> +	get_random_bytes(&seed, 4);
> +	cnic_bnx2_ctx_wr(dev, 45, 0, seed);
> +	return 0;
> +}
> +
> +static int cnic_cm_open(struct cnic_dev *dev)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +	int err;
> +
> +	err = cnic_cm_alloc_mem(dev);
> +	if (err)
> +		return err;
> +
> +	err = cp->start_cm(dev);
> +
> +	if (err)
> +		goto err_out;
> +
> +	spin_lock_init(&cp->wr_lock);
> +
> +	tasklet_init(&cp->cnic_task, &cnic_task, (unsigned long) cp);
> +
> +	cp->cm_nb.notifier_call = cnic_net_callback;
> +	register_netevent_notifier(&cp->cm_nb);
> +
> +	dev->cm_create = cnic_cm_create;
> +	dev->cm_destroy = cnic_cm_destroy;
> +	dev->cm_connect = cnic_cm_connect;
> +	dev->cm_abort = cnic_cm_abort;
> +	dev->cm_close = cnic_cm_close;
> +	dev->cm_select_dev = cnic_cm_select_dev;
> +
> +	cp->ulp_handle[CNIC_ULP_L4] = dev;
> +	rcu_assign_pointer(cp->ulp_ops[CNIC_ULP_L4], &cm_ulp_ops);

The cnic_lock is not held due to this being initialization time, and
that no one else can be messing with this until initialization is
complete?

> +	return 0;
> +
> +err_out:
> +	cnic_cm_free_mem(dev);
> +	return err;
> +}
> +
> +static int cnic_cm_shutdown(struct cnic_dev *dev)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +	int i;
> +
> +	cp->stop_cm(dev);
> +
> +	unregister_netevent_notifier(&cp->cm_nb);
> +
> +	tasklet_disable(&cp->cnic_task);
> +
> +	if (!cp->csk_tbl)
> +		return 0;
> +
> +	for (i = 0; i < MAX_CM_SK_TBL_SZ; i++) {
> +		struct cnic_sock *csk = &cp->csk_tbl[i];
> +
> +		clear_bit(SK_F_INUSE, &csk->flags);
> +		cnic_cm_cleanup(csk);
> +	}
> +	cnic_cm_free_mem(dev);
> +
> +	return 0;
> +}
> +
> +static void cnic_init_context(struct cnic_dev *dev, u32 cid)
> +{
> +	u32 cid_addr;
> +	int i;
> +
> +	cid_addr = GET_CID_ADDR(cid);
> +
> +	for (i = 0; i < CTX_SIZE; i += 4)
> +		cnic_bnx2_ctx_wr(dev, cid_addr, i, 0);
> +}
> +
> +static int cnic_setup_5709_context(struct cnic_dev *dev, int valid)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +	int ret = 0, i;
> +	u32 valid_bit = valid ? BNX2_CTX_HOST_PAGE_TBL_DATA0_VALID : 0;
> +
> +	if (CHIP_NUM(cp) != CHIP_NUM_5709)
> +		return 0;
> +
> +	for (i = 0; i < cp->ctx_blks; i++) {
> +		int j;
> +		u32 idx = cp->ctx_arr[i].cid / cp->cids_per_blk;
> +		u32 val;
> +
> +		memset(cp->ctx_arr[i].ctx, 0, BCM_PAGE_SIZE);
> +
> +		CNIC_WR(dev, BNX2_CTX_HOST_PAGE_TBL_DATA0,
> +			(cp->ctx_arr[i].mapping & 0xffffffff) | valid_bit);
> +		CNIC_WR(dev, BNX2_CTX_HOST_PAGE_TBL_DATA1,
> +			(u64) cp->ctx_arr[i].mapping >> 32);
> +		CNIC_WR(dev, BNX2_CTX_HOST_PAGE_TBL_CTRL, idx |
> +			BNX2_CTX_HOST_PAGE_TBL_CTRL_WRITE_REQ);
> +		for (j = 0; j < 10; j++) {
> +
> +			val = CNIC_RD(dev, BNX2_CTX_HOST_PAGE_TBL_CTRL);
> +			if (!(val & BNX2_CTX_HOST_PAGE_TBL_CTRL_WRITE_REQ))
> +				break;
> +			udelay(5);
> +		}
> +		if (val & BNX2_CTX_HOST_PAGE_TBL_CTRL_WRITE_REQ) {
> +			ret = -EBUSY;
> +			break;
> +		}
> +	}
> +	return ret;
> +}
> +
> +static void cnic_free_irq(struct cnic_dev *dev)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +	struct cnic_eth_dev *ethdev = cp->ethdev;
> +
> +	if (ethdev->drv_state & CNIC_DRV_STATE_USING_MSIX) {
> +		cp->disable_int_sync(dev);
> +		tasklet_disable(&cp->cnic_irq_task);
> +		free_irq(ethdev->irq_arr[0].vector, dev);
> +	}
> +}
> +
> +static int cnic_init_bnx2_irq(struct cnic_dev *dev)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +	struct cnic_eth_dev *ethdev = cp->ethdev;
> +
> +	if (ethdev->drv_state & CNIC_DRV_STATE_USING_MSIX) {
> +		int err, i = 0;
> +		int sblk_num = cp->status_blk_num;
> +		u32 base = ((sblk_num - 1) * BNX2_HC_SB_CONFIG_SIZE) +
> +			   BNX2_HC_SB_CONFIG_1;
> +
> +		CNIC_WR(dev, base, BNX2_HC_SB_CONFIG_1_ONE_SHOT);
> +
> +		CNIC_WR(dev, base + BNX2_HC_COMP_PROD_TRIP_OFF, (2 << 16) | 8);
> +		CNIC_WR(dev, base + BNX2_HC_COM_TICKS_OFF, (64 << 16) | 220);
> +		CNIC_WR(dev, base + BNX2_HC_CMD_TICKS_OFF, (64 << 16) | 220);
> +
> +		cp->bnx2_status_blk = cp->status_blk;
> +		cp->last_status_idx = cp->bnx2_status_blk->status_idx;
> +		tasklet_init(&cp->cnic_irq_task, &cnic_service_bnx2_msix,
> +			     (unsigned long) dev);
> +		err = request_irq(ethdev->irq_arr[0].vector, cnic_irq, 0,
> +				  "cnic", dev);
> +		if (err) {
> +			tasklet_disable(&cp->cnic_irq_task);
> +			return err;
> +		}
> +		while (cp->bnx2_status_blk->status_completion_producer_index &&
> +		       i < 10) {
> +			CNIC_WR(dev, BNX2_HC_COALESCE_NOW,
> +				1 << (11 + sblk_num));
> +			udelay(10);
> +			i++;
> +			barrier();
> +		}
> +		if (cp->bnx2_status_blk->status_completion_producer_index) {
> +			cnic_free_irq(dev);
> +			goto failed;
> +		}
> +
> +	} else {
> +		struct status_block *sblk = cp->status_blk;
> +		u32 hc_cmd = CNIC_RD(dev, BNX2_HC_COMMAND);
> +		int i = 0;
> +
> +		while (sblk->status_completion_producer_index && i < 10) {
> +			CNIC_WR(dev, BNX2_HC_COMMAND,
> +				hc_cmd | BNX2_HC_COMMAND_COAL_NOW_WO_INT);
> +			udelay(10);
> +			i++;
> +			barrier();
> +		}
> +		if (sblk->status_completion_producer_index)
> +			goto failed;
> +
> +	}
> +	return 0;
> +
> +failed:
> +	printk(KERN_ERR PFX "%s: " "KCQ index not resetting to 0.\n",
> +	       dev->netdev->name);
> +	return -EBUSY;
> +}
> +
> +static void cnic_enable_bnx2_int(struct cnic_dev *dev)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +	struct cnic_eth_dev *ethdev = cp->ethdev;
> +
> +	if (!(ethdev->drv_state & CNIC_DRV_STATE_USING_MSIX))
> +		return;
> +
> +	CNIC_WR(dev, BNX2_PCICFG_INT_ACK_CMD, BNX2_CNIC_INT_NUM |
> +		BNX2_PCICFG_INT_ACK_CMD_INDEX_VALID | cp->last_status_idx);
> +}
> +
> +static void cnic_disable_bnx2_int_sync(struct cnic_dev *dev)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +	struct cnic_eth_dev *ethdev = cp->ethdev;
> +
> +	if (!(ethdev->drv_state & CNIC_DRV_STATE_USING_MSIX))
> +		return;
> +
> +	CNIC_WR(dev, BNX2_PCICFG_INT_ACK_CMD, BNX2_CNIC_INT_NUM |
> +		BNX2_PCICFG_INT_ACK_CMD_MASK_INT);
> +	CNIC_RD(dev, BNX2_PCICFG_INT_ACK_CMD);
> +	synchronize_irq(ethdev->irq_arr[0].vector);
> +}
> +
> +static int cnic_start_bnx2_hw(struct cnic_dev *dev)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +	struct cnic_eth_dev *ethdev = cp->ethdev;
> +	u32 val;
> +	int err;
> +
> +	val = CNIC_RD(dev, BNX2_MQ_CONFIG);
> +	val &= ~BNX2_MQ_CONFIG_KNL_BYP_BLK_SIZE;
> +	if (BCM_PAGE_BITS > 12)
> +		val |= (12 - 8)  << 4;
> +	else
> +		val |= (BCM_PAGE_BITS - 8)  << 4;
> +
> +	CNIC_WR(dev, BNX2_MQ_CONFIG, val);
> +
> +	CNIC_WR(dev, BNX2_HC_COMP_PROD_TRIP, (2 << 16) | 8);
> +	CNIC_WR(dev, BNX2_HC_COM_TICKS, (64 << 16) | 220);
> +	CNIC_WR(dev, BNX2_HC_CMD_TICKS, (64 << 16) | 220);
> +
> +	err = cnic_setup_5709_context(dev, 1);
> +	if (err)
> +		return err;
> +
> +	cnic_init_context(dev, KWQ_CID);
> +	cnic_init_context(dev, KCQ_CID);
> +
> +	cp->kwq_cid_addr = GET_CID_ADDR(KWQ_CID);
> +	cp->kwq_io_addr = MB_GET_CID_ADDR(KWQ_CID) + L5_KRNLQ_HOST_QIDX;
> +
> +	cp->max_kwq_idx = MAX_KWQ_IDX;
> +	cp->kwq_prod_idx = 0;
> +	cp->kwq_con_idx = 0;
> +	cp->cnic_local_flags |= CNIC_LCL_FL_KWQ_INIT;
> +	
> +	/* Initialize the kernel work queue context. */
> +	val = KRNLQ_TYPE_TYPE_KRNLQ | KRNLQ_SIZE_TYPE_SIZE |
> +	      (BCM_PAGE_BITS - 8) | KRNLQ_FLAGS_QE_SELF_SEQ;
> +	cnic_bnx2_ctx_wr(dev, cp->kwq_cid_addr, L5_KRNLQ_TYPE, val);
> +	
> +	val = (BCM_PAGE_SIZE / sizeof(struct kwqe) - 1) << 16;
> +	cnic_bnx2_ctx_wr(dev, cp->kwq_cid_addr, L5_KRNLQ_QE_SELF_SEQ_MAX, val);
> +	
> +	val = ((BCM_PAGE_SIZE / sizeof(struct kwqe)) << 16) | KWQ_PAGE_CNT;
> +	cnic_bnx2_ctx_wr(dev, cp->kwq_cid_addr, L5_KRNLQ_PGTBL_NPAGES, val);
> +	
> +	val = (u32) ((u64) cp->kwq_info.pgtbl_map >> 32);
> +	cnic_bnx2_ctx_wr(dev, cp->kwq_cid_addr, L5_KRNLQ_PGTBL_HADDR_HI, val);
> +	
> +	val = (u32) cp->kwq_info.pgtbl_map;
> +	cnic_bnx2_ctx_wr(dev, cp->kwq_cid_addr, L5_KRNLQ_PGTBL_HADDR_LO, val);
> +
> +	cp->kcq_cid_addr = GET_CID_ADDR(KCQ_CID);
> +	cp->kcq_io_addr = MB_GET_CID_ADDR(KCQ_CID) + L5_KRNLQ_HOST_QIDX;
> +	
> +	cp->kcq_prod_idx = 0;
> +	
> +	/* Initialize the kernel complete queue context. */
> +	val = KRNLQ_TYPE_TYPE_KRNLQ | KRNLQ_SIZE_TYPE_SIZE |
> +	      (BCM_PAGE_BITS - 8) | KRNLQ_FLAGS_QE_SELF_SEQ;
> +	cnic_bnx2_ctx_wr(dev, cp->kcq_cid_addr, L5_KRNLQ_TYPE, val);
> +	
> +	val = (BCM_PAGE_SIZE / sizeof(struct kcqe) - 1) << 16;
> +	cnic_bnx2_ctx_wr(dev, cp->kcq_cid_addr, L5_KRNLQ_QE_SELF_SEQ_MAX, val);
> +	
> +	val = ((BCM_PAGE_SIZE / sizeof(struct kcqe)) << 16) | KCQ_PAGE_CNT;
> +	cnic_bnx2_ctx_wr(dev, cp->kcq_cid_addr, L5_KRNLQ_PGTBL_NPAGES, val);
> +	
> +	val = (u32) ((u64) cp->kcq_info.pgtbl_map >> 32);
> +	cnic_bnx2_ctx_wr(dev, cp->kcq_cid_addr, L5_KRNLQ_PGTBL_HADDR_HI, val);
> +	
> +	val = (u32) cp->kcq_info.pgtbl_map;
> +	cnic_bnx2_ctx_wr(dev, cp->kcq_cid_addr, L5_KRNLQ_PGTBL_HADDR_LO, val);
> +
> +	if (ethdev->drv_state & CNIC_DRV_STATE_USING_MSIX) {
> +		u32 sb_id = cp->status_blk_num;
> +		u32 sb = KRNLQ_STATUSB_NUM_CNIC_MSIX(sb_id);
> +
> +		cnic_bnx2_ctx_wr(dev, cp->kwq_cid_addr, L5_KRNLQ_HOST_QIDX, sb);
> +		cnic_bnx2_ctx_wr(dev, cp->kcq_cid_addr, L5_KRNLQ_HOST_QIDX, sb);
> +	}
> +
> +	/* Enable Commnad Scheduler notification when we write to the
> +	 * host producer index of the kernel contexts. */
> +	CNIC_WR(dev, BNX2_MQ_KNL_CMD_MASK1, 2);
> +
> +	/* Enable Command Scheduler notification when we write to either
> +	 * the Send Queue or Receive Queue producer indexes of the kernel
> +	 * bypass contexts. */
> +	CNIC_WR(dev, BNX2_MQ_KNL_BYP_CMD_MASK1, 7);
> +	CNIC_WR(dev, BNX2_MQ_KNL_BYP_WRITE_MASK1, 7);
> +
> +	/* Notify COM when the driver post an application buffer. */
> +	CNIC_WR(dev, BNX2_MQ_KNL_RX_V2P_MASK2, 0x2000);
> +
> +	/* Set the CP and COM doorbells.  These two processors polls the
> +	 * doorbell for a non zero value before running.  This must be done
> +	 * after setting up the kernel queue contexts. */
> +	cnic_bnx2_reg_wr_ind(dev, BNX2_CP_SCRATCH + 0x20, 1);
> +	cnic_bnx2_reg_wr_ind(dev, BNX2_COM_SCRATCH + 0x20, 1);
> +
> +	err = cnic_init_bnx2_irq(dev);
> +	if (err) {
> +		printk(KERN_ERR PFX "%s: cnic_init_irq failed\n",
> +		       dev->netdev->name);
> +		cnic_bnx2_reg_wr_ind(dev, BNX2_CP_SCRATCH + 0x20, 0);
> +		cnic_bnx2_reg_wr_ind(dev, BNX2_COM_SCRATCH + 0x20, 0);
> +		return err;
> +	}
> +
> +	return 0;
> +}
> +
> +static int cnic_start_hw(struct cnic_dev *dev)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +	struct cnic_eth_dev *ethdev = cp->ethdev;
> +	int err;
> +
> +	if (test_bit(CNIC_F_CNIC_UP, &dev->flags))
> +		return -EALREADY;
> +
> +	err = ethdev->drv_register_cnic(dev->netdev, cp->cnic_ops, dev);
> +	if (err) {
> +		printk(KERN_ERR PFX "%s: register_cnic failed\n",
> +		       dev->netdev->name);
> +		return err;
> +	}
> +
> +	dev->regview = ethdev->io_base;
> +	cp->chip_id = ethdev->chip_id;
> +	pci_dev_get(dev->pcidev);
> +	cp->func = PCI_FUNC(dev->pcidev->devfn);
> +	cp->status_blk = ethdev->irq_arr[0].status_blk;
> +	cp->status_blk_num = ethdev->irq_arr[0].status_blk_num;
> +
> +	err = cp->alloc_resc(dev);
> +	if (err) {
> +		printk(KERN_ERR PFX "%s: allocate resource failure\n",
> +		       dev->netdev->name);
> +		goto err1;
> +	}
> +
> +	err = cp->start_hw(dev);
> +	if (err)
> +		goto err1;
> +
> +	err = cnic_cm_open(dev);
> +	if (err)
> +		goto err1;
> +
> +	set_bit(CNIC_F_CNIC_UP, &dev->flags);
> +
> +	cp->enable_int(dev);
> +
> +	return 0;
> +
> +err1:
> +	ethdev->drv_unregister_cnic(dev->netdev);
> +	cp->free_resc(dev);
> +	pci_dev_put(dev->pcidev);
> +	return err;
> +}
> +
> +static void cnic_stop_bnx2_hw(struct cnic_dev *dev)
> +{
> +	struct cnic_local *cp = dev->cnic_priv;
> +	struct cnic_eth_dev *ethdev = cp->ethdev;
> +
> +	cnic_disable_bnx2_int_sync(dev);
> +
> +	cnic_bnx2_reg_wr_ind(dev, BNX2_CP_SCRATCH + 0x20, 0);
> +	cnic_bnx2_reg_wr_ind(dev, BNX2_COM_SCRATCH + 0x20, 0);
> +
> +	cnic_init_context(dev, KWQ_CID);
> +	cnic_init_context(dev, KCQ_CID);
> +
> +	cnic_setup_5709_context(dev, 0);
> +	cnic_free_irq(dev);
> +
> +	ethdev->drv_unregister_cnic(dev->netdev);
> +
> +	cnic_free_resc(dev);
> +}
> +
> +static void cnic_stop_hw(struct cnic_dev *dev)
> +{
> +	if (test_bit(CNIC_F_CNIC_UP, &dev->flags)) {
> +		struct cnic_local *cp = dev->cnic_priv;
> +
> +		clear_bit(CNIC_F_CNIC_UP, &dev->flags);
> +		rcu_assign_pointer(cp->ulp_ops[CNIC_ULP_L4], NULL);

Given that the cnic_lock does not appear to be held, what prevents
other CPUs from manipulating cp->ulp_ops[CNIC_ULP_L4] concurrently
with this function?

> +		synchronize_rcu();
> +		cnic_cm_shutdown(dev);
> +		cp->stop_hw(dev);
> +		pci_dev_put(dev->pcidev);
> +	}
> +}
> +
> +static struct cnic_dev *alloc_cnic(struct net_device *dev)
> +{
> +	struct cnic_dev *cdev;
> +	struct cnic_local *cp;
> +	int alloc_size;
> +
> +	alloc_size = sizeof(struct cnic_dev) + sizeof(struct cnic_local);
> +
> +	cdev = kmalloc(alloc_size , GFP_KERNEL);
> +	if (cdev == NULL) {
> +		printk(KERN_ERR PFX "%s: allocate dev struct failure\n",
> +		       dev->name);
> +		return NULL;
> +	}
> +	memset(cdev, 0, alloc_size);
> +
> +	cdev->netdev = dev;
> +	cdev->cnic_priv = (char *)cdev + sizeof(struct cnic_dev);
> +	cdev->register_device = cnic_register_device;
> +	cdev->unregister_device = cnic_unregister_device;
> +	cp = cdev->cnic_priv;
> +	cp->dev = cdev;
> +
> +	spin_lock_init(&cp->cnic_ulp_lock);
> +	printk(KERN_INFO PFX "Added CNIC device: %s\n", dev->name);
> +
> +	return cdev;
> +}
> +
> +static struct cnic_dev *init_bnx2_cnic(struct net_device *dev)
> +{
> +	struct pci_dev *pdev;
> +	struct cnic_dev *cdev;
> +	struct cnic_local *cp;
> +	struct cnic_eth_dev *ethdev;
> +
> +	ethdev = bnx2_cnic_probe(dev);
> +	if (!ethdev)
> +		return NULL;
> +
> +	pdev = ethdev->pdev;
> +	if (!pdev)
> +		return NULL;
> +
> +	dev_hold(dev);
> +	pci_dev_get(pdev);
> +	if (pdev->device == PCI_DEVICE_ID_NX2_5709 ||
> +	    pdev->device == PCI_DEVICE_ID_NX2_5709S) {
> +		u8 rev;
> +
> +		pci_read_config_byte(pdev, PCI_REVISION_ID, &rev);
> +		if (rev < 0x10) {
> +			pci_dev_put(pdev);
> +			dev_put(dev);
> +			return NULL;
> +		}
> +	}
> +	pci_dev_put(pdev);
> +
> +	cdev = alloc_cnic(dev);
> +	if (cdev == NULL) {
> +		dev_put(dev);
> +		return NULL;
> +	}
> +
> +	set_bit(CNIC_F_BNX2_CLASS, &cdev->flags);
> +	cdev->submit_kwqes = cnic_submit_bnx2_kwqes;
> +
> +	cp = cdev->cnic_priv;
> +	cp->ethdev = ethdev;
> +	cdev->pcidev = pdev;
> +
> +	cp->cnic_ops = &cnic_bnx2_ops;
> +	cp->start_hw = cnic_start_bnx2_hw;
> +	cp->stop_hw = cnic_stop_bnx2_hw;
> +	cp->setup_pgtbl = cnic_setup_page_tbl;
> +	cp->alloc_resc = cnic_alloc_bnx2_resc;
> +	cp->free_resc = cnic_free_resc;
> +	cp->start_cm = cnic_cm_init_bnx2_hw;
> +	cp->stop_cm = cnic_cm_stop_bnx2_hw;
> +	cp->enable_int = cnic_enable_bnx2_int;
> +	cp->disable_int_sync = cnic_disable_bnx2_int_sync;
> +	return cdev;
> +}
> +
> +static struct cnic_dev *is_cnic_dev(struct net_device *dev)
> +{
> +	struct ethtool_drvinfo drvinfo;
> +	struct cnic_dev *cdev = NULL;
> +
> +	if (dev->ethtool_ops && dev->ethtool_ops->get_drvinfo) {
> +		memset(&drvinfo, 0, sizeof(drvinfo));
> +		dev->ethtool_ops->get_drvinfo(dev, &drvinfo);
> +		
> +		if (!strcmp(drvinfo.driver, "bnx2"))
> +			cdev = init_bnx2_cnic(dev);
> +		if (cdev) {
> +			write_lock(&cnic_dev_lock);
> +			list_add(&cdev->list, &cnic_dev_list);
> +			write_unlock(&cnic_dev_lock);
> +		}
> +	}
> +	return cdev;
> +}
> +
> +/**
> + * IP event handler
> + */
> +static int cnic_ip_event(struct notifier_block *this, unsigned long event,
> +						 void *ptr)
> +{
> +	struct in_ifaddr *ifa = (struct in_ifaddr *) ptr;
> +	struct net_device *netdev = (struct net_device *) ifa->ifa_dev->dev;
> +	struct cnic_dev *dev;
> +	int if_type;
> +	u32 my_dev = 0;
> +
> +	read_lock(&cnic_dev_lock);
> +	list_for_each_entry(dev, &cnic_dev_list, list) {
> +		if (netdev == dev->netdev) {
> +			my_dev = 1;
> +			cnic_hold(dev);
> +			break;
> +		}
> +	}
> +	read_unlock(&cnic_dev_lock);
> +
> +	if (my_dev) {
> +		struct cnic_local *cp = dev->cnic_priv;
> +
> +		rcu_read_lock();
> +		for (if_type = 0; if_type < MAX_CNIC_ULP_TYPE; if_type++) {
> +			struct cnic_ulp_ops *ulp_ops;
> +
> +			ulp_ops = rcu_dereference(cp->ulp_ops[if_type]);
> +			if (ulp_ops) {
> +				void *ctx = cp->ulp_handle[if_type];
> +
> +				ulp_ops->indicate_inetevent(ctx, event);
> +			}
> +		}
> +		rcu_read_unlock();
> +
> +		cnic_put(dev);
> +	}
> +
> +	return NOTIFY_DONE;
> +}
> +
> +/**
> + * netdev event handler
> + */
> +static int cnic_netdev_event(struct notifier_block *this, unsigned long event,
> +							 void *ptr)
> +{
> +	struct net_device *netdev = ptr;
> +	struct cnic_dev *dev;
> +	int if_type;
> +	u32 my_dev = 0;
> +
> +	read_lock(&cnic_dev_lock);
> +	list_for_each_entry(dev, &cnic_dev_list, list) {
> +		if (netdev == dev->netdev) {
> +			my_dev = 1;
> +			cnic_hold(dev);
> +			break;
> +		}
> +	}
> +	read_unlock(&cnic_dev_lock);
> +
> +	if (!my_dev && event == NETDEV_REGISTER) {
> +		/* Check for the hot-plug device */
> +		dev = is_cnic_dev(netdev);
> +		if (dev) {
> +			my_dev = 1;
> +			cnic_hold(dev);
> +		}
> +	}
> +	if (my_dev) {
> +		struct cnic_local *cp = dev->cnic_priv;
> +
> +		if (event == NETDEV_REGISTER)
> +			cnic_ulp_init(dev);
> +		else if (event == NETDEV_UNREGISTER)
> +			cnic_ulp_exit(dev);
> +		else if (event == NETDEV_UP) {
> +			mutex_lock(&cnic_lock);
> +			set_bit(CNIC_F_IF_UP, &dev->flags);
> +			if (dev->use_count) {
> +				if (!cnic_start_hw(dev))
> +					cnic_ulp_start(dev);
> +			}
> +			mutex_unlock(&cnic_lock);
> +		}
> +
> +		rcu_read_lock();
> +		for (if_type = 0; if_type < MAX_CNIC_ULP_TYPE; if_type++) {
> +			struct cnic_ulp_ops *ulp_ops;
> +			void *ctx;
> +
> +			ulp_ops = rcu_dereference(cp->ulp_ops[if_type]);
> +			if (!ulp_ops)
> +				continue;
> +
> +			ctx = cp->ulp_handle[if_type];
> +
> +			ulp_ops->indicate_netevent(ctx, event);
> +		}
> +		rcu_read_unlock();
> +
> +		if (event == NETDEV_GOING_DOWN) {
> +			mutex_lock(&cnic_lock);
> +			clear_bit(CNIC_F_IF_UP, &dev->flags);
> +			set_bit(CNIC_F_IF_GOING_DOWN, &dev->flags);
> +			cnic_ulp_stop(dev);
> +			cnic_stop_hw(dev);
> +			mutex_unlock(&cnic_lock);
> +		} else if (event == NETDEV_DOWN) {
> +			mutex_lock(&cnic_lock);
> +			clear_bit(CNIC_F_IF_GOING_DOWN, &dev->flags);
> +			mutex_unlock(&cnic_lock);
> +		} else if (event == NETDEV_UNREGISTER) {
> +			write_lock(&cnic_dev_lock);
> +			list_del_init(&dev->list);
> +			write_unlock(&cnic_dev_lock);
> +
> +			cnic_put(dev);
> +			cnic_free_dev(dev);
> +			goto done;
> +		}
> +		cnic_put(dev);
> +	}
> +done:
> +	return NOTIFY_DONE;
> +}
> +
> +static struct notifier_block cnic_ip_notifier = {
> +	cnic_ip_event,
> +	0
> +};
> +
> +static struct notifier_block cnic_netdev_notifier = {
> +	cnic_netdev_event,
> +	0
> +};
> +
> +static void cnic_release(void)
> +{
> +	struct cnic_dev *dev;
> +
> +	while (!list_empty(&cnic_dev_list)) {
> +		dev = list_entry(cnic_dev_list.next, struct cnic_dev, list);
> +		if (test_bit(CNIC_F_CNIC_UP, &dev->flags))
> +			cnic_stop_hw(dev);
> +
> +		list_del_init(&dev->list);
> +		cnic_free_dev(dev);
> +	}
> +}
> +
> +static int __init cnic_init(void)
> +{
> +	int rc = 0;
> +	struct net_device *dev;
> +
> +	printk(KERN_INFO "%s", version);
> +
> +	rtnl_lock();
> +	/* Find Teton devices */
> +	for_each_netdev(&init_net, dev)
> +		is_cnic_dev(dev);
> +
> +	rtnl_unlock();
> +
> +	rc = register_inetaddr_notifier(&cnic_ip_notifier);
> +	if (rc)
> +		cnic_release();
> +	rc = register_netdevice_notifier(&cnic_netdev_notifier);
> +	if (rc) {
> +		unregister_inetaddr_notifier(&cnic_ip_notifier);
> +		cnic_release();
> +	}
> +	return rc;
> +}
> +
> +static void __exit cnic_exit(void)
> +{
> +	unregister_inetaddr_notifier(&cnic_ip_notifier);
> +	unregister_netdevice_notifier(&cnic_netdev_notifier);
> +	cnic_release();
> +	return;
> +}
> +
> +module_init(cnic_init);
> +module_exit(cnic_exit);
> diff --git a/drivers/net/cnic.h b/drivers/net/cnic.h
> new file mode 100644
> index 0000000..e81e895
> --- /dev/null
> +++ b/drivers/net/cnic.h
> @@ -0,0 +1,221 @@
> +/* cnic.h: Broadcom CNIC core network driver.
> + *
> + * Copyright (c) 2006 Broadcom Corporation
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU General Public License as published by
> + * the Free Software Foundation.
> + *
> + * Written by: John(Zongxi) Chen (zongxic@broadcom.com)
> + */
> +
> +
> +#ifndef CNIC_H
> +#define CNIC_H
> +
> +#if !defined(__LITTLE_ENDIAN) && !defined(__BIG_ENDIAN)
> +	#error "Missing either LITTLE_ENDIAN or BIG_ENDIAN definition."
> +#endif
> +
> +#define KWQ_PAGE_CNT	4
> +#define KCQ_PAGE_CNT	16
> +
> +#define KWQ_CID 		24
> +#define KCQ_CID 		25
> +
> +/*
> + *	krnlq_context definition
> + */
> +#define L5_KRNLQ_FLAGS	0x00000000
> +#define L5_KRNLQ_SIZE	0x00000000
> +#define L5_KRNLQ_TYPE	0x00000000
> +#define KRNLQ_FLAGS_PG_SZ					(0xf<<0)
> +#define KRNLQ_FLAGS_PG_SZ_256					(0<<0)
> +#define KRNLQ_FLAGS_PG_SZ_512					(1<<0)
> +#define KRNLQ_FLAGS_PG_SZ_1K					(2<<0)
> +#define KRNLQ_FLAGS_PG_SZ_2K					(3<<0)
> +#define KRNLQ_FLAGS_PG_SZ_4K					(4<<0)
> +#define KRNLQ_FLAGS_PG_SZ_8K					(5<<0)
> +#define KRNLQ_FLAGS_PG_SZ_16K					(6<<0)
> +#define KRNLQ_FLAGS_PG_SZ_32K					(7<<0)
> +#define KRNLQ_FLAGS_PG_SZ_64K					(8<<0)
> +#define KRNLQ_FLAGS_PG_SZ_128K					(9<<0)
> +#define KRNLQ_FLAGS_PG_SZ_256K					(10<<0)
> +#define KRNLQ_FLAGS_PG_SZ_512K					(11<<0)
> +#define KRNLQ_FLAGS_PG_SZ_1M					(12<<0)
> +#define KRNLQ_FLAGS_PG_SZ_2M					(13<<0)
> +#define KRNLQ_FLAGS_QE_SELF_SEQ					(1<<15)
> +#define KRNLQ_SIZE_TYPE_SIZE	((((0x28 + 0x1f) & ~0x1f) / 0x20) << 16)
> +#define KRNLQ_TYPE_TYPE						(0xf<<28)
> +#define KRNLQ_TYPE_TYPE_EMPTY					(0<<28)
> +#define KRNLQ_TYPE_TYPE_KRNLQ					(6<<28)
> +
> +#define L5_KRNLQ_HOST_QIDX		0x00000004
> +#define KRNLQ_STATUSB_NUM_SHIFT		16
> +#define KRNLQ_STATUSB_NUM_CNIC_MSIX(sb_id)	(((sb_id) + 7) <<	\
> +	KRNLQ_STATUSB_NUM_SHIFT)
> +#define L5_KRNLQ_HOST_FW_QIDX		0x00000008
> +#define L5_KRNLQ_NX_QE_SELF_SEQ 	0x0000000c
> +#define L5_KRNLQ_QE_SELF_SEQ_MAX	0x0000000c
> +#define L5_KRNLQ_NX_QE_HADDR_HI 	0x00000010
> +#define L5_KRNLQ_NX_QE_HADDR_LO 	0x00000014
> +#define L5_KRNLQ_PGTBL_PGIDX		0x00000018
> +#define L5_KRNLQ_NX_PG_QIDX 		0x00000018
> +#define L5_KRNLQ_PGTBL_NPAGES		0x0000001c
> +#define L5_KRNLQ_QIDX_INCR		0x0000001c
> +#define L5_KRNLQ_PGTBL_HADDR_HI 	0x00000020
> +#define L5_KRNLQ_PGTBL_HADDR_LO 	0x00000024
> +
> +#define BNX2_PG_CTX_MAP			0x1a0034
> +#define BNX2_ISCSI_CTX_MAP		0x1a0074
> +
> +struct cnic_redirect_entry {
> +	struct dst_entry *old_dst;
> +	struct dst_entry *new_dst;
> +};
> +
> +struct cnic_work_node {
> +	u32			work_type;
> +#define	WORK_TYPE_KCQE			1
> +#define	WORK_TYPE_NEIGH_UPDATE		2
> +#define	WORK_TYPE_REDIRECT		3
> +	union {
> +		struct kcqe		kcqe;
> +		struct neighbour	*neigh;
> +		struct cnic_redirect_entry cnic_redir;
> +	} work_data;
> +};
> +
> +#define WORK_RING_SIZE		128
> +#define WORK_RING_SIZE_MASK	127
> +#define MAX_CM_SK_TBL_SZ	128
> +#define MAX_COMPLETED_KCQE	64
> +
> +#define KWQE_CNT (BCM_PAGE_SIZE / sizeof(struct kwqe))
> +#define KCQE_CNT (BCM_PAGE_SIZE / sizeof(struct kcqe))
> +#define MAX_KWQE_CNT (KWQE_CNT - 1)
> +#define MAX_KCQE_CNT (KCQE_CNT - 1)
> +
> +#define MAX_KWQ_IDX	((KWQ_PAGE_CNT * KWQE_CNT) - 1)
> +#define MAX_KCQ_IDX	((KCQ_PAGE_CNT * KCQE_CNT) - 1)
> +
> +#define KWQ_PG(x) (((x) & ~MAX_KWQE_CNT) >> (BCM_PAGE_BITS - 5))
> +#define KWQ_IDX(x) ((x) & MAX_KWQE_CNT)
> +
> +#define KCQ_PG(x) (((x) & ~MAX_KCQE_CNT) >> (BCM_PAGE_BITS - 5))
> +#define KCQ_IDX(x) ((x) & MAX_KCQE_CNT)
> +
> +#define DEF_IPID_COUNT		0xc001
> +
> +#define DEF_KA_TIMEOUT		10000
> +#define DEF_KA_INTERVAL		300000
> +#define DEF_KA_MAX_PROBE_COUNT	3
> +#define DEF_TOS			0
> +#define DEF_TTL			0xfe
> +#define DEF_SND_SEQ_SCALE	0
> +#define DEF_RCV_BUF		0xffff
> +#define DEF_SND_BUF		0xffff
> +#define DEF_SEED		0
> +
> +struct cnic_ctx {
> +	u32		cid;
> +	void		*ctx;
> +	dma_addr_t	mapping;
> +};
> +
> +#define BNX2_MAX_CID		0x2000
> +
> +struct cnic_dma {
> +	int		num_pages;
> +	void		**pg_arr;
> +	dma_addr_t	*pg_map_arr;
> +	int		pgtbl_size;
> +	u32		*pgtbl;
> +	dma_addr_t	pgtbl_map;
> +};
> +
> +struct cnic_local {
> +
> +	spinlock_t cnic_ulp_lock;
> +	void *ulp_handle[MAX_CNIC_ULP_TYPE];
> +	unsigned long ulp_flags[MAX_CNIC_ULP_TYPE];
> +#define ULP_F_INIT	0
> +#define ULP_F_START	1
> +	struct cnic_ulp_ops *ulp_ops[MAX_CNIC_ULP_TYPE];
> +
> +	/* protected by ulp_lock */
> +	u32 cnic_local_flags;
> +#define	CNIC_LCL_FL_KWQ_INIT	0x00000001
> +
> +	struct cnic_dev *dev;
> +
> +	struct cnic_eth_dev *ethdev;
> +
> +	u32 kwq_cid_addr;
> +	u32 kcq_cid_addr;
> +
> +	struct cnic_dma		kwq_info;
> +	struct kwqe		**kwq;
> +
> +	u16		max_kwq_idx;
> +
> +	u16		kwq_prod_idx;
> +	u32		kwq_io_addr;
> +
> +	u16		kwq_con_idx;
> +
> +	struct cnic_dma	kcq_info;
> +	struct kcqe	**kcq;
> +
> +	u16		kcq_prod_idx;
> +	u32		kcq_io_addr;
> +
> +	void				*status_blk;
> +	struct status_block_msix	*bnx2_status_blk;
> +
> +	u32				status_blk_num;
> +	u32				last_status_idx;
> +	struct tasklet_struct		cnic_irq_task;
> +
> +	struct kcqe	*completed_kcq[MAX_COMPLETED_KCQE];
> +
> +	struct cnic_sock *csk_tbl;
> +
> +	struct notifier_block cm_nb;
> +
> +	struct cnic_work_node	cnic_work_ring[WORK_RING_SIZE];
> +	int			cnic_wr_cons;
> +	int			cnic_wr_prod;
> +	spinlock_t		wr_lock;
> +
> +	struct tasklet_struct	cnic_task;
> +
> +	struct cnic_ctx		*ctx_arr;
> +	int			ctx_blks;
> +	int			ctx_blk_size;
> +	int			cids_per_blk;
> +
> +	u32			chip_id;
> +	int			func;
> +
> +	struct cnic_ops		*cnic_ops;
> +	int			(*start_hw)(struct cnic_dev *);
> +	void			(*stop_hw)(struct cnic_dev *);
> +	void			(*setup_pgtbl)(struct cnic_dev *,
> +					       struct cnic_dma *);
> +	int			(*alloc_resc)(struct cnic_dev *);
> +	void			(*free_resc)(struct cnic_dev *);
> +	int			(*start_cm)(struct cnic_dev *);
> +	void			(*stop_cm)(struct cnic_dev *);
> +	void			(*enable_int)(struct cnic_dev *);
> +	void			(*disable_int_sync)(struct cnic_dev *);
> +	void			(*ack_int)(struct cnic_dev *);
> +};
> +
> +struct bnx2x_bd_chain_next {
> +	u32	addr_lo;
> +	u32	addr_hi;
> +	u8	reserved[8];
> +};
> +
> +#endif
> diff --git a/drivers/net/cnic_defs.h b/drivers/net/cnic_defs.h
> new file mode 100644
> index 0000000..21cbbaa
> --- /dev/null
> +++ b/drivers/net/cnic_defs.h
> @@ -0,0 +1,553 @@
> +#ifndef __57XX_L5CM_HSI_LINUX_LE__
> +#define __57XX_L5CM_HSI_LINUX_LE__
> +
> +/* KWQ (kernel work queue) request op codes */
> +#define L4_KWQE_OPCODE_VALUE_CONNECT1               (50)
> +#define L4_KWQE_OPCODE_VALUE_CONNECT2               (51)
> +#define L4_KWQE_OPCODE_VALUE_CONNECT3               (52)
> +#define L4_KWQE_OPCODE_VALUE_RESET                  (53)
> +#define L4_KWQE_OPCODE_VALUE_CLOSE                  (54)
> +#define L4_KWQE_OPCODE_VALUE_UPDATE_SECRET          (60)
> +#define L4_KWQE_OPCODE_VALUE_INIT_ULP               (61)
> +
> +#define L4_KWQE_OPCODE_VALUE_OFFLOAD_PG             (1)
> +#define L4_KWQE_OPCODE_VALUE_UPDATE_PG              (9)
> +#define L4_KWQE_OPCODE_VALUE_UPLOAD_PG              (14)
> +
> +/* KCQ (kernel completion queue) response op codes */
> +#define L4_KCQE_OPCODE_VALUE_CLOSE_COMP             (53)
> +#define L4_KCQE_OPCODE_VALUE_RESET_COMP             (54)
> +#define L4_KCQE_OPCODE_VALUE_FW_TCP_UPDATE          (55)
> +#define L4_KCQE_OPCODE_VALUE_CONNECT_COMPLETE       (56)
> +#define L4_KCQE_OPCODE_VALUE_RESET_RECEIVED         (57)
> +#define L4_KCQE_OPCODE_VALUE_CLOSE_RECEIVED         (58)
> +#define L4_KCQE_OPCODE_VALUE_INIT_ULP               (61)
> +
> +#define L4_KCQE_OPCODE_VALUE_OFFLOAD_PG             (1)
> +#define L4_KCQE_OPCODE_VALUE_UPDATE_PG              (9)
> +#define L4_KCQE_OPCODE_VALUE_UPLOAD_PG              (14)
> +
> +/* KCQ (kernel completion queue) completion status */
> +#define L4_KCQE_COMPLETION_STATUS_SUCCESS		    (0)
> +#define L4_KCQE_COMPLETION_STATUS_TIMEOUT        (0x93)
> +
> +#define L4_LAYER_CODE (4)
> +
> +/*
> + * L4 KCQ CQE
> + */
> +struct l4_kcq {
> +	u32 cid;
> +	u32 pg_cid;
> +	u32 conn_id;
> +	u32 pg_host_opaque;
> +#if defined(__BIG_ENDIAN)
> +	u16 status;
> +	u16 reserved1;
> +#elif defined(__LITTLE_ENDIAN)
> +	u16 reserved1;
> +	u16 status;
> +#endif
> +	u32 reserved2[2];
> +#if defined(__BIG_ENDIAN)
> +	u8 flags;
> +#define L4_KCQ_RESERVED3 (0xF<<0)
> +#define L4_KCQ_RESERVED3_SHIFT 0
> +#define L4_KCQ_LAYER_CODE (0x7<<4)
> +#define L4_KCQ_LAYER_CODE_SHIFT 4
> +#define L4_KCQ_RESERVED4 (0x1<<7)
> +#define L4_KCQ_RESERVED4_SHIFT 7
> +	u8 op_code;
> +	u16 qe_self_seq;
> +#elif defined(__LITTLE_ENDIAN)
> +	u16 qe_self_seq;
> +	u8 op_code;
> +	u8 flags;
> +#define L4_KCQ_RESERVED3 (0xF<<0)
> +#define L4_KCQ_RESERVED3_SHIFT 0
> +#define L4_KCQ_LAYER_CODE (0x7<<4)
> +#define L4_KCQ_LAYER_CODE_SHIFT 4
> +#define L4_KCQ_RESERVED4 (0x1<<7)
> +#define L4_KCQ_RESERVED4_SHIFT 7
> +#endif
> +};
> +
> +
> +/*
> + * L4 KCQ CQE PG upload
> + */
> +struct l4_kcq_upload_pg {
> +	u32 pg_cid;
> +#if defined(__BIG_ENDIAN)
> +	u16 pg_status;
> +	u16 pg_ipid_count;
> +#elif defined(__LITTLE_ENDIAN)
> +	u16 pg_ipid_count;
> +	u16 pg_status;
> +#endif
> +	u32 reserved1[5];
> +#if defined(__BIG_ENDIAN)
> +	u8 flags;
> +#define L4_KCQ_UPLOAD_PG_RESERVED3 (0xF<<0)
> +#define L4_KCQ_UPLOAD_PG_RESERVED3_SHIFT 0
> +#define L4_KCQ_UPLOAD_PG_LAYER_CODE (0x7<<4)
> +#define L4_KCQ_UPLOAD_PG_LAYER_CODE_SHIFT 4
> +#define L4_KCQ_UPLOAD_PG_RESERVED4 (0x1<<7)
> +#define L4_KCQ_UPLOAD_PG_RESERVED4_SHIFT 7
> +	u8 op_code;
> +	u16 qe_self_seq;
> +#elif defined(__LITTLE_ENDIAN)
> +	u16 qe_self_seq;
> +	u8 op_code;
> +	u8 flags;
> +#define L4_KCQ_UPLOAD_PG_RESERVED3 (0xF<<0)
> +#define L4_KCQ_UPLOAD_PG_RESERVED3_SHIFT 0
> +#define L4_KCQ_UPLOAD_PG_LAYER_CODE (0x7<<4)
> +#define L4_KCQ_UPLOAD_PG_LAYER_CODE_SHIFT 4
> +#define L4_KCQ_UPLOAD_PG_RESERVED4 (0x1<<7)
> +#define L4_KCQ_UPLOAD_PG_RESERVED4_SHIFT 7
> +#endif
> +};
> +
> +
> +/*
> + * Gracefully close the connection request
> + */
> +struct l4_kwq_close_req {
> +#if defined(__BIG_ENDIAN)
> +	u8 flags;
> +#define L4_KWQ_CLOSE_REQ_RESERVED1 (0xF<<0)
> +#define L4_KWQ_CLOSE_REQ_RESERVED1_SHIFT 0
> +#define L4_KWQ_CLOSE_REQ_LAYER_CODE (0x7<<4)
> +#define L4_KWQ_CLOSE_REQ_LAYER_CODE_SHIFT 4
> +#define L4_KWQ_CLOSE_REQ_LINKED_WITH_NEXT (0x1<<7)
> +#define L4_KWQ_CLOSE_REQ_LINKED_WITH_NEXT_SHIFT 7
> +	u8 op_code;
> +	u16 reserved0;
> +#elif defined(__LITTLE_ENDIAN)
> +	u16 reserved0;
> +	u8 op_code;
> +	u8 flags;
> +#define L4_KWQ_CLOSE_REQ_RESERVED1 (0xF<<0)
> +#define L4_KWQ_CLOSE_REQ_RESERVED1_SHIFT 0
> +#define L4_KWQ_CLOSE_REQ_LAYER_CODE (0x7<<4)
> +#define L4_KWQ_CLOSE_REQ_LAYER_CODE_SHIFT 4
> +#define L4_KWQ_CLOSE_REQ_LINKED_WITH_NEXT (0x1<<7)
> +#define L4_KWQ_CLOSE_REQ_LINKED_WITH_NEXT_SHIFT 7
> +#endif
> +	u32 cid;
> +	u32 reserved2[6];
> +};
> +
> +
> +/*
> + * The first request to be passed in order to establish connection
> + */
> +struct l4_kwq_connect_req1 {
> +#if defined(__BIG_ENDIAN)
> +	u8 flags;
> +#define L4_KWQ_CONNECT_REQ1_RESERVED1 (0xF<<0)
> +#define L4_KWQ_CONNECT_REQ1_RESERVED1_SHIFT 0
> +#define L4_KWQ_CONNECT_REQ1_LAYER_CODE (0x7<<4)
> +#define L4_KWQ_CONNECT_REQ1_LAYER_CODE_SHIFT 4
> +#define L4_KWQ_CONNECT_REQ1_LINKED_WITH_NEXT (0x1<<7)
> +#define L4_KWQ_CONNECT_REQ1_LINKED_WITH_NEXT_SHIFT 7
> +	u8 op_code;
> +	u8 reserved0;
> +	u8 conn_flags;
> +#define L4_KWQ_CONNECT_REQ1_IS_PG_HOST_OPAQUE (0x1<<0)
> +#define L4_KWQ_CONNECT_REQ1_IS_PG_HOST_OPAQUE_SHIFT 0
> +#define L4_KWQ_CONNECT_REQ1_IP_V6 (0x1<<1)
> +#define L4_KWQ_CONNECT_REQ1_IP_V6_SHIFT 1
> +#define L4_KWQ_CONNECT_REQ1_PASSIVE_FLAG (0x1<<2)
> +#define L4_KWQ_CONNECT_REQ1_PASSIVE_FLAG_SHIFT 2
> +#define L4_KWQ_CONNECT_REQ1_RSRV (0x1F<<3)
> +#define L4_KWQ_CONNECT_REQ1_RSRV_SHIFT 3
> +#elif defined(__LITTLE_ENDIAN)
> +	u8 conn_flags;
> +#define L4_KWQ_CONNECT_REQ1_IS_PG_HOST_OPAQUE (0x1<<0)
> +#define L4_KWQ_CONNECT_REQ1_IS_PG_HOST_OPAQUE_SHIFT 0
> +#define L4_KWQ_CONNECT_REQ1_IP_V6 (0x1<<1)
> +#define L4_KWQ_CONNECT_REQ1_IP_V6_SHIFT 1
> +#define L4_KWQ_CONNECT_REQ1_PASSIVE_FLAG (0x1<<2)
> +#define L4_KWQ_CONNECT_REQ1_PASSIVE_FLAG_SHIFT 2
> +#define L4_KWQ_CONNECT_REQ1_RSRV (0x1F<<3)
> +#define L4_KWQ_CONNECT_REQ1_RSRV_SHIFT 3
> +	u8 reserved0;
> +	u8 op_code;
> +	u8 flags;
> +#define L4_KWQ_CONNECT_REQ1_RESERVED1 (0xF<<0)
> +#define L4_KWQ_CONNECT_REQ1_RESERVED1_SHIFT 0
> +#define L4_KWQ_CONNECT_REQ1_LAYER_CODE (0x7<<4)
> +#define L4_KWQ_CONNECT_REQ1_LAYER_CODE_SHIFT 4
> +#define L4_KWQ_CONNECT_REQ1_LINKED_WITH_NEXT (0x1<<7)
> +#define L4_KWQ_CONNECT_REQ1_LINKED_WITH_NEXT_SHIFT 7
> +#endif
> +	u32 cid;
> +	u32 pg_cid;
> +	u32 src_ip;
> +	u32 dst_ip;
> +#if defined(__BIG_ENDIAN)
> +	u16 dst_port;
> +	u16 src_port;
> +#elif defined(__LITTLE_ENDIAN)
> +	u16 src_port;
> +	u16 dst_port;
> +#endif
> +#if defined(__BIG_ENDIAN)
> +	u8 rsrv1[3];
> +	u8 tcp_flags;
> +#define L4_KWQ_CONNECT_REQ1_NO_DELAY_ACK (0x1<<0)
> +#define L4_KWQ_CONNECT_REQ1_NO_DELAY_ACK_SHIFT 0
> +#define L4_KWQ_CONNECT_REQ1_KEEP_ALIVE (0x1<<1)
> +#define L4_KWQ_CONNECT_REQ1_KEEP_ALIVE_SHIFT 1
> +#define L4_KWQ_CONNECT_REQ1_NAGLE_ENABLE (0x1<<2)
> +#define L4_KWQ_CONNECT_REQ1_NAGLE_ENABLE_SHIFT 2
> +#define L4_KWQ_CONNECT_REQ1_TIME_STAMP (0x1<<3)
> +#define L4_KWQ_CONNECT_REQ1_TIME_STAMP_SHIFT 3
> +#define L4_KWQ_CONNECT_REQ1_SACK (0x1<<4)
> +#define L4_KWQ_CONNECT_REQ1_SACK_SHIFT 4
> +#define L4_KWQ_CONNECT_REQ1_SEG_SCALING (0x1<<5)
> +#define L4_KWQ_CONNECT_REQ1_SEG_SCALING_SHIFT 5
> +#define L4_KWQ_CONNECT_REQ1_RESERVED2 (0x3<<6)
> +#define L4_KWQ_CONNECT_REQ1_RESERVED2_SHIFT 6
> +#elif defined(__LITTLE_ENDIAN)
> +	u8 tcp_flags;
> +#define L4_KWQ_CONNECT_REQ1_NO_DELAY_ACK (0x1<<0)
> +#define L4_KWQ_CONNECT_REQ1_NO_DELAY_ACK_SHIFT 0
> +#define L4_KWQ_CONNECT_REQ1_KEEP_ALIVE (0x1<<1)
> +#define L4_KWQ_CONNECT_REQ1_KEEP_ALIVE_SHIFT 1
> +#define L4_KWQ_CONNECT_REQ1_NAGLE_ENABLE (0x1<<2)
> +#define L4_KWQ_CONNECT_REQ1_NAGLE_ENABLE_SHIFT 2
> +#define L4_KWQ_CONNECT_REQ1_TIME_STAMP (0x1<<3)
> +#define L4_KWQ_CONNECT_REQ1_TIME_STAMP_SHIFT 3
> +#define L4_KWQ_CONNECT_REQ1_SACK (0x1<<4)
> +#define L4_KWQ_CONNECT_REQ1_SACK_SHIFT 4
> +#define L4_KWQ_CONNECT_REQ1_SEG_SCALING (0x1<<5)
> +#define L4_KWQ_CONNECT_REQ1_SEG_SCALING_SHIFT 5
> +#define L4_KWQ_CONNECT_REQ1_RESERVED2 (0x3<<6)
> +#define L4_KWQ_CONNECT_REQ1_RESERVED2_SHIFT 6
> +	u8 rsrv1[3];
> +#endif
> +	u32 rsrv2;
> +};
> +
> +
> +/*
> + * The second ( optional )request to be passed in order to establish connection - for IPv6 only
> + */
> +struct l4_kwq_connect_req2 {
> +#if defined(__BIG_ENDIAN)
> +	u8 flags;
> +#define L4_KWQ_CONNECT_REQ2_RESERVED1 (0xF<<0)
> +#define L4_KWQ_CONNECT_REQ2_RESERVED1_SHIFT 0
> +#define L4_KWQ_CONNECT_REQ2_LAYER_CODE (0x7<<4)
> +#define L4_KWQ_CONNECT_REQ2_LAYER_CODE_SHIFT 4
> +#define L4_KWQ_CONNECT_REQ2_LINKED_WITH_NEXT (0x1<<7)
> +#define L4_KWQ_CONNECT_REQ2_LINKED_WITH_NEXT_SHIFT 7
> +	u8 op_code;
> +	u8 reserved0;
> +	u8 rsrv;
> +#elif defined(__LITTLE_ENDIAN)
> +	u8 rsrv;
> +	u8 reserved0;
> +	u8 op_code;
> +	u8 flags;
> +#define L4_KWQ_CONNECT_REQ2_RESERVED1 (0xF<<0)
> +#define L4_KWQ_CONNECT_REQ2_RESERVED1_SHIFT 0
> +#define L4_KWQ_CONNECT_REQ2_LAYER_CODE (0x7<<4)
> +#define L4_KWQ_CONNECT_REQ2_LAYER_CODE_SHIFT 4
> +#define L4_KWQ_CONNECT_REQ2_LINKED_WITH_NEXT (0x1<<7)
> +#define L4_KWQ_CONNECT_REQ2_LINKED_WITH_NEXT_SHIFT 7
> +#endif
> +	u32 reserved2;
> +	u32 src_ip_v6_2;
> +	u32 src_ip_v6_3;
> +	u32 src_ip_v6_4;
> +	u32 dst_ip_v6_2;
> +	u32 dst_ip_v6_3;
> +	u32 dst_ip_v6_4;
> +};
> +
> +
> +/*
> + * The third ( and last )request to be passed in order to establish connection
> + */
> +struct l4_kwq_connect_req3 {
> +#if defined(__BIG_ENDIAN)
> +	u8 flags;
> +#define L4_KWQ_CONNECT_REQ3_RESERVED1 (0xF<<0)
> +#define L4_KWQ_CONNECT_REQ3_RESERVED1_SHIFT 0
> +#define L4_KWQ_CONNECT_REQ3_LAYER_CODE (0x7<<4)
> +#define L4_KWQ_CONNECT_REQ3_LAYER_CODE_SHIFT 4
> +#define L4_KWQ_CONNECT_REQ3_LINKED_WITH_NEXT (0x1<<7)
> +#define L4_KWQ_CONNECT_REQ3_LINKED_WITH_NEXT_SHIFT 7
> +	u8 op_code;
> +	u16 reserved0;
> +#elif defined(__LITTLE_ENDIAN)
> +	u16 reserved0;
> +	u8 op_code;
> +	u8 flags;
> +#define L4_KWQ_CONNECT_REQ3_RESERVED1 (0xF<<0)
> +#define L4_KWQ_CONNECT_REQ3_RESERVED1_SHIFT 0
> +#define L4_KWQ_CONNECT_REQ3_LAYER_CODE (0x7<<4)
> +#define L4_KWQ_CONNECT_REQ3_LAYER_CODE_SHIFT 4
> +#define L4_KWQ_CONNECT_REQ3_LINKED_WITH_NEXT (0x1<<7)
> +#define L4_KWQ_CONNECT_REQ3_LINKED_WITH_NEXT_SHIFT 7
> +#endif
> +	u32 ka_timeout;
> +	u32 ka_interval ;
> +#if defined(__BIG_ENDIAN)
> +	u8 snd_seq_scale;
> +	u8 ttl;
> +	u8 tos;
> +	u8 ka_max_probe_count;
> +#elif defined(__LITTLE_ENDIAN)
> +	u8 ka_max_probe_count;
> +	u8 tos;
> +	u8 ttl;
> +	u8 snd_seq_scale;
> +#endif
> +#if defined(__BIG_ENDIAN)
> +	u16 pmtu;
> +	u16 mss;
> +#elif defined(__LITTLE_ENDIAN)
> +	u16 mss;
> +	u16 pmtu;
> +#endif
> +	u32 rcv_buf;
> +	u32 snd_buf;
> +	u32 seed;
> +};
> +
> +
> +/*
> + * a KWQE request to offload a PG connection
> + */
> +struct l4_kwq_offload_pg {
> +#if defined(__BIG_ENDIAN)
> +	u8 flags;
> +#define L4_KWQ_OFFLOAD_PG_RESERVED1 (0xF<<0)
> +#define L4_KWQ_OFFLOAD_PG_RESERVED1_SHIFT 0
> +#define L4_KWQ_OFFLOAD_PG_LAYER_CODE (0x7<<4)
> +#define L4_KWQ_OFFLOAD_PG_LAYER_CODE_SHIFT 4
> +#define L4_KWQ_OFFLOAD_PG_LINKED_WITH_NEXT (0x1<<7)
> +#define L4_KWQ_OFFLOAD_PG_LINKED_WITH_NEXT_SHIFT 7
> +	u8 op_code;
> +	u16 reserved0;
> +#elif defined(__LITTLE_ENDIAN)
> +	u16 reserved0;
> +	u8 op_code;
> +	u8 flags;
> +#define L4_KWQ_OFFLOAD_PG_RESERVED1 (0xF<<0)
> +#define L4_KWQ_OFFLOAD_PG_RESERVED1_SHIFT 0
> +#define L4_KWQ_OFFLOAD_PG_LAYER_CODE (0x7<<4)
> +#define L4_KWQ_OFFLOAD_PG_LAYER_CODE_SHIFT 4
> +#define L4_KWQ_OFFLOAD_PG_LINKED_WITH_NEXT (0x1<<7)
> +#define L4_KWQ_OFFLOAD_PG_LINKED_WITH_NEXT_SHIFT 7
> +#endif
> +#if defined(__BIG_ENDIAN)
> +	u8 l2hdr_nbytes;
> +	u8 pg_flags;
> +#define L4_KWQ_OFFLOAD_PG_SNAP_ENCAP (0x1<<0)
> +#define L4_KWQ_OFFLOAD_PG_SNAP_ENCAP_SHIFT 0
> +#define L4_KWQ_OFFLOAD_PG_VLAN_TAGGING (0x1<<1)
> +#define L4_KWQ_OFFLOAD_PG_VLAN_TAGGING_SHIFT 1
> +#define L4_KWQ_OFFLOAD_PG_RESERVED2 (0x3F<<2)
> +#define L4_KWQ_OFFLOAD_PG_RESERVED2_SHIFT 2
> +	u8 da0;
> +	u8 da1;
> +#elif defined(__LITTLE_ENDIAN)
> +	u8 da1;
> +	u8 da0;
> +	u8 pg_flags;
> +#define L4_KWQ_OFFLOAD_PG_SNAP_ENCAP (0x1<<0)
> +#define L4_KWQ_OFFLOAD_PG_SNAP_ENCAP_SHIFT 0
> +#define L4_KWQ_OFFLOAD_PG_VLAN_TAGGING (0x1<<1)
> +#define L4_KWQ_OFFLOAD_PG_VLAN_TAGGING_SHIFT 1
> +#define L4_KWQ_OFFLOAD_PG_RESERVED2 (0x3F<<2)
> +#define L4_KWQ_OFFLOAD_PG_RESERVED2_SHIFT 2
> +	u8 l2hdr_nbytes;
> +#endif
> +#if defined(__BIG_ENDIAN)
> +	u8 da2;
> +	u8 da3;
> +	u8 da4;
> +	u8 da5;
> +#elif defined(__LITTLE_ENDIAN)
> +	u8 da5;
> +	u8 da4;
> +	u8 da3;
> +	u8 da2;
> +#endif
> +#if defined(__BIG_ENDIAN)
> +	u8 sa0;
> +	u8 sa1;
> +	u8 sa2;
> +	u8 sa3;
> +#elif defined(__LITTLE_ENDIAN)
> +	u8 sa3;
> +	u8 sa2;
> +	u8 sa1;
> +	u8 sa0;
> +#endif
> +#if defined(__BIG_ENDIAN)
> +	u8 sa4;
> +	u8 sa5;
> +	u16 etype;
> +#elif defined(__LITTLE_ENDIAN)
> +	u16 etype;
> +	u8 sa5;
> +	u8 sa4;
> +#endif
> +#if defined(__BIG_ENDIAN)
> +	u16 vlan_tag;
> +	u16 ipid_start;
> +#elif defined(__LITTLE_ENDIAN)
> +	u16 ipid_start;
> +	u16 vlan_tag;
> +#endif
> +#if defined(__BIG_ENDIAN)
> +	u16 ipid_count;
> +	u16 reserved3;
> +#elif defined(__LITTLE_ENDIAN)
> +	u16 reserved3;
> +	u16 ipid_count;
> +#endif
> +	u32 host_opaque;
> +};
> +
> +
> +/*
> + * Abortively close the connection request
> + */
> +struct l4_kwq_reset_req {
> +#if defined(__BIG_ENDIAN)
> +	u8 flags;
> +#define L4_KWQ_RESET_REQ_RESERVED1 (0xF<<0)
> +#define L4_KWQ_RESET_REQ_RESERVED1_SHIFT 0
> +#define L4_KWQ_RESET_REQ_LAYER_CODE (0x7<<4)
> +#define L4_KWQ_RESET_REQ_LAYER_CODE_SHIFT 4
> +#define L4_KWQ_RESET_REQ_LINKED_WITH_NEXT (0x1<<7)
> +#define L4_KWQ_RESET_REQ_LINKED_WITH_NEXT_SHIFT 7
> +	u8 op_code;
> +	u16 reserved0;
> +#elif defined(__LITTLE_ENDIAN)
> +	u16 reserved0;
> +	u8 op_code;
> +	u8 flags;
> +#define L4_KWQ_RESET_REQ_RESERVED1 (0xF<<0)
> +#define L4_KWQ_RESET_REQ_RESERVED1_SHIFT 0
> +#define L4_KWQ_RESET_REQ_LAYER_CODE (0x7<<4)
> +#define L4_KWQ_RESET_REQ_LAYER_CODE_SHIFT 4
> +#define L4_KWQ_RESET_REQ_LINKED_WITH_NEXT (0x1<<7)
> +#define L4_KWQ_RESET_REQ_LINKED_WITH_NEXT_SHIFT 7
> +#endif
> +	u32 cid;
> +	u32 reserved2[6];
> +};
> +
> +
> +/*
> + * a KWQE request to update a PG connection
> + */
> +struct l4_kwq_update_pg {
> +#if defined(__BIG_ENDIAN)
> +	u8 flags;
> +#define L4_KWQ_UPDATE_PG_RESERVED1 (0xF<<0)
> +#define L4_KWQ_UPDATE_PG_RESERVED1_SHIFT 0
> +#define L4_KWQ_UPDATE_PG_LAYER_CODE (0x7<<4)
> +#define L4_KWQ_UPDATE_PG_LAYER_CODE_SHIFT 4
> +#define L4_KWQ_UPDATE_PG_LINKED_WITH_NEXT (0x1<<7)
> +#define L4_KWQ_UPDATE_PG_LINKED_WITH_NEXT_SHIFT 7
> +	u8 opcode;
> +	u16 oper16;
> +#elif defined(__LITTLE_ENDIAN)
> +	u16 oper16;
> +	u8 opcode;
> +	u8 flags;
> +#define L4_KWQ_UPDATE_PG_RESERVED1 (0xF<<0)
> +#define L4_KWQ_UPDATE_PG_RESERVED1_SHIFT 0
> +#define L4_KWQ_UPDATE_PG_LAYER_CODE (0x7<<4)
> +#define L4_KWQ_UPDATE_PG_LAYER_CODE_SHIFT 4
> +#define L4_KWQ_UPDATE_PG_LINKED_WITH_NEXT (0x1<<7)
> +#define L4_KWQ_UPDATE_PG_LINKED_WITH_NEXT_SHIFT 7
> +#endif
> +	u32 pg_cid;
> +	u32 pg_host_opaque;
> +#if defined(__BIG_ENDIAN)
> +	u8 pg_valids;
> +#define L4_KWQ_UPDATE_PG_VALIDS_IPID_COUNT (0x1<<0)
> +#define L4_KWQ_UPDATE_PG_VALIDS_IPID_COUNT_SHIFT 0
> +#define L4_KWQ_UPDATE_PG_VALIDS_DA (0x1<<1)
> +#define L4_KWQ_UPDATE_PG_VALIDS_DA_SHIFT 1
> +#define L4_KWQ_UPDATE_PG_RESERVERD2 (0x3F<<2)
> +#define L4_KWQ_UPDATE_PG_RESERVERD2_SHIFT 2
> +	u8 pg_unused_a;
> +	u16 pg_ipid_count;
> +#elif defined(__LITTLE_ENDIAN)
> +	u16 pg_ipid_count;
> +	u8 pg_unused_a;
> +	u8 pg_valids;
> +#define L4_KWQ_UPDATE_PG_VALIDS_IPID_COUNT (0x1<<0)
> +#define L4_KWQ_UPDATE_PG_VALIDS_IPID_COUNT_SHIFT 0
> +#define L4_KWQ_UPDATE_PG_VALIDS_DA (0x1<<1)
> +#define L4_KWQ_UPDATE_PG_VALIDS_DA_SHIFT 1
> +#define L4_KWQ_UPDATE_PG_RESERVERD2 (0x3F<<2)
> +#define L4_KWQ_UPDATE_PG_RESERVERD2_SHIFT 2
> +#endif
> +#if defined(__BIG_ENDIAN)
> +	u16 reserverd3;
> +	u8 da0;
> +	u8 da1;
> +#elif defined(__LITTLE_ENDIAN)
> +	u8 da1;
> +	u8 da0;
> +	u16 reserverd3;
> +#endif
> +#if defined(__BIG_ENDIAN)
> +	u8 da2;
> +	u8 da3;
> +	u8 da4;
> +	u8 da5;
> +#elif defined(__LITTLE_ENDIAN)
> +	u8 da5;
> +	u8 da4;
> +	u8 da3;
> +	u8 da2;
> +#endif
> +	u32 reserved4;
> +	u32 reserved5;
> +};
> +
> +
> +/*
> + * a KWQE request to upload a PG or L4 context
> + */
> +struct l4_kwq_upload {
> +#if defined(__BIG_ENDIAN)
> +	u8 flags;
> +#define L4_KWQ_UPLOAD_RESERVED1 (0xF<<0)
> +#define L4_KWQ_UPLOAD_RESERVED1_SHIFT 0
> +#define L4_KWQ_UPLOAD_LAYER_CODE (0x7<<4)
> +#define L4_KWQ_UPLOAD_LAYER_CODE_SHIFT 4
> +#define L4_KWQ_UPLOAD_LINKED_WITH_NEXT (0x1<<7)
> +#define L4_KWQ_UPLOAD_LINKED_WITH_NEXT_SHIFT 7
> +	u8 opcode;
> +	u16 oper16;
> +#elif defined(__LITTLE_ENDIAN)
> +	u16 oper16;
> +	u8 opcode;
> +	u8 flags;
> +#define L4_KWQ_UPLOAD_RESERVED1 (0xF<<0)
> +#define L4_KWQ_UPLOAD_RESERVED1_SHIFT 0
> +#define L4_KWQ_UPLOAD_LAYER_CODE (0x7<<4)
> +#define L4_KWQ_UPLOAD_LAYER_CODE_SHIFT 4
> +#define L4_KWQ_UPLOAD_LINKED_WITH_NEXT (0x1<<7)
> +#define L4_KWQ_UPLOAD_LINKED_WITH_NEXT_SHIFT 7
> +#endif
> +	u32 cid;
> +	u32 reserved2[6];
> +};
> +
> +#endif /* __57XX_L5CM_HSI_LINUX_LE__ */
> diff --git a/drivers/net/cnic_drv.h b/drivers/net/cnic_drv.h
> new file mode 100644
> index 0000000..ab6431f
> --- /dev/null
> +++ b/drivers/net/cnic_drv.h
> @@ -0,0 +1,112 @@
> +/* cnic_drv.h: Broadcom CNIC core network driver.
> + *
> + * Copyright (c) 2008 Broadcom Corporation
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU General Public License as published by
> + * the Free Software Foundation.
> + *
> + */
> +
> +
> +#ifndef CNIC_DRV_H
> +#define CNIC_DRV_H
> +
> +struct kwqe;
> +struct kcqe;
> +struct kwqe_16;
> +
> +#define MAX_CNIC_CTL_DATA	64
> +#define MAX_DRV_CTL_DATA	64
> +
> +#define CNIC_CTL_STOP_CMD		1
> +#define CNIC_CTL_START_CMD		2
> +#define CNIC_CTL_COMPLETION_CMD		3
> +
> +#define DRV_CTL_IO_WR_CMD		0x101
> +#define DRV_CTL_IO_RD_CMD		0x102
> +#define DRV_CTL_CTX_WR_CMD		0x103
> +#define DRV_CTL_CTXTBL_WR_CMD		0x104
> +#define DRV_CTL_COMPLETION_CMD		0x105
> +
> +struct cnic_ctl_completion {
> +	u32	cid;
> +};
> +
> +struct drv_ctl_completion {
> +	u32	comp_count;
> +};
> +
> +struct cnic_ctl_info {
> +	int	cmd;
> +	union {
> +		struct cnic_ctl_completion comp;
> +		char bytes[MAX_CNIC_CTL_DATA];
> +	} data;
> +};
> +
> +struct drv_ctl_io {
> +	u32		cid_addr;
> +	u32		slot;
> +	u32		offset;
> +	u32		data;
> +	dma_addr_t	dma_addr;
> +};
> +
> +struct drv_ctl_info {
> +	int	cmd;
> +	union {
> +		struct drv_ctl_completion comp;
> +		struct drv_ctl_io io;
> +		char bytes[MAX_DRV_CTL_DATA];
> +	} data;
> +};
> +
> +struct cnic_ops {
> +	struct module	*cnic_owner;
> +	int		(*cnic_handler)(void *, void *);
> +	int		(*cnic_ctl)(void *, struct cnic_ctl_info *);
> +	unsigned long	reserved[2];
> +};
> +
> +#define MAX_CNIC_VEC	8
> +
> +struct cnic_irq {
> +	unsigned int	vector;
> +	void		*status_blk;
> +	u32		status_blk_num;
> +	u32		irq_flags;
> +#define CNIC_IRQ_FL_MSIX		0x00000001
> +};
> +
> +struct cnic_eth_dev {
> +	u32		drv_state;
> +#define CNIC_DRV_STATE_REGD		0x00000001
> +#define CNIC_DRV_STATE_USING_MSIX	0x00000002
> +	u32		chip_id;
> +	u32		max_kwqe_pending;
> +	struct pci_dev	*pdev;
> +	void __iomem	*io_base;
> +
> +	u32		ctx_tbl_offset;
> +	u32		ctx_tbl_len;
> +	int		ctx_blk_size;
> +	u32		starting_cid;
> +
> +	int		num_irq;
> +	struct cnic_irq	irq_arr[MAX_CNIC_VEC];
> +	int		(*drv_register_cnic)(struct net_device *,
> +					     struct cnic_ops *, void *);
> +	int		(*drv_unregister_cnic)(struct net_device *);
> +	int		(*drv_submit_kwqes_32)(struct net_device *,
> +					       struct kwqe *[], u32);
> +	int		(*drv_submit_kwqes_16)(struct net_device *,
> +					       struct kwqe_16 *[], u32);
> +	int		(*drv_ctl)(struct net_device *, struct drv_ctl_info *);
> +	unsigned long	reserved[2];
> +};
> +
> +extern struct cnic_eth_dev *bnx2_cnic_probe(struct net_device *)
> +	__attribute__((weak));
> +
> +#endif
> diff --git a/drivers/net/cnic_if.h b/drivers/net/cnic_if.h
> new file mode 100644
> index 0000000..e77b6ac
> --- /dev/null
> +++ b/drivers/net/cnic_if.h
> @@ -0,0 +1,171 @@
> +/* cnic_if.h: Broadcom CNIC core network driver.
> + *
> + * Copyright (c) 2006 Broadcom Corporation
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU General Public License as published by
> + * the Free Software Foundation.
> + *
> + * Written by: John(Zongxi) Chen  (zongxic@broadcom.com)
> + */
> +
> +
> +#ifndef CNIC_IF_H
> +#define CNIC_IF_H
> +
> +#define CNIC_MODULE_VERSION	"1.4.0"
> +#define CNIC_MODULE_RELDATE	"May 14, 2008"
> +
> +#define CNIC_ULP_RDMA		0
> +#define CNIC_ULP_ISCSI		1
> +#define CNIC_ULP_L4		2
> +#define MAX_CNIC_ULP_TYPE_EXT	2
> +#define MAX_CNIC_ULP_TYPE	3
> +
> +struct kwqe {
> +	u32 kwqe_op_flag;
> +
> +	u32 kwqe_info0;
> +	u32 kwqe_info1;
> +	u32 kwqe_info2;
> +	u32 kwqe_info3;
> +	u32 kwqe_info4;
> +	u32 kwqe_info5;
> +	u32 kwqe_info6;
> +};
> +
> +struct kcqe {
> +	u32 kcqe_info0;
> +	u32 kcqe_info1;
> +	u32 kcqe_info2;
> +	u32 kcqe_info3;
> +	u32 kcqe_info4;
> +	u32 kcqe_info5;
> +	u32 kcqe_info6;
> +	u32 kcqe_op_flag;
> +		#define KCQE_FLAGS_LAYER_MASK		(0x7<<28)
> +		#define KCQE_FLAGS_LAYER_MASK_MISC	(0<<28)
> +		#define KCQE_FLAGS_LAYER_MASK_L2	(2<<28)
> +		#define KCQE_FLAGS_LAYER_MASK_L3	(3<<28)
> +		#define KCQE_FLAGS_LAYER_MASK_L4	(4<<28)
> +		#define KCQE_FLAGS_LAYER_MASK_L5_RDMA	(5<<28)
> +		#define KCQE_FLAGS_LAYER_MASK_L5_ISCSI	(6<<28)
> +		#define KCQE_FLAGS_NEXT 		(1<<31)
> +};
> +
> +struct cnic_sockaddr {
> +	union {
> +		struct sockaddr_in	v4;
> +		struct sockaddr_in6	v6;
> +	} local;
> +	union {
> +		struct sockaddr_in	v4;
> +		struct sockaddr_in6	v6;
> +	} remote;
> +};
> +
> +struct cnic_sock {
> +	struct cnic_dev *dev;
> +	void	*context;
> +	u32	src_ip[4];
> +	u32	dst_ip[4];
> +	u16	src_port;
> +	u16	dst_port;
> +	u16	vlan_id;
> +	unsigned char old_ha[6];
> +	struct dst_entry *dst;
> +	u32	cid;
> +	u32	l5_cid;
> +	u32	pg_cid;
> +	int	ulp_type;
> +
> +	u32	ka_timeout;
> +	u32	ka_interval;
> +	u8	ka_max_probe_count;
> +	u8	tos;
> +	u8	ttl;
> +	u8	snd_seq_scale;
> +	u32	rcv_buf;
> +	u32	snd_buf;
> +	u32	seed;
> +
> +	unsigned long	tcp_flags;
> +#define SK_TCP_NO_DELAY_ACK	0
> +#define SK_TCP_KEEP_ALIVE	1
> +#define SK_TCP_NAGLE		2
> +#define SK_TCP_TIMESTAMP	3
> +#define SK_TCP_SACK		4
> +#define SK_TCP_SEG_SCALING	5
> +	unsigned long	flags;
> +#define SK_F_INUSE		0
> +#define SK_F_OFFLD_COMPLETE	1
> +#define SK_F_OFFLD_SCHED	2
> +#define SK_F_PG_OFFLD_COMPLETE	3
> +#define SK_F_CONNECT_START	4
> +#define SK_F_IPV6		5
> +#define SK_F_NDISC_WAITING	6
> +
> +	atomic_t ref_count;
> +
> +	struct kwqe kwqe1;
> +	struct kwqe kwqe2;
> +	struct kwqe kwqe3;
> +};
> +
> +struct cnic_dev {
> +	struct net_device	*netdev;
> +	struct pci_dev		*pcidev;
> +	void __iomem		*regview;
> +	struct list_head	list;
> +
> +	int (*register_device)(struct cnic_dev *dev, int ulp_type,
> +			       void *ulp_ctx);
> +	int (*unregister_device)(struct cnic_dev *dev, int ulp_type);
> +	int (*submit_kwqes)(struct cnic_dev *dev, struct kwqe *wqes[],
> +				u32 num_wqes);
> +
> +	int (*cm_create)(struct cnic_dev *, int, u32, u32, struct cnic_sock **,
> +			 void *);
> +	int (*cm_destroy)(struct cnic_sock *);
> +	int (*cm_connect)(struct cnic_sock *, struct cnic_sockaddr *);
> +	int (*cm_abort)(struct cnic_sock *);
> +	int (*cm_close)(struct cnic_sock *);
> +	struct cnic_dev *(*cm_select_dev)(struct sockaddr_in *, int ulp_type);
> +	unsigned long flags;
> +#define CNIC_F_IF_UP		0
> +#define CNIC_F_CNIC_UP		1
> +#define CNIC_F_IF_GOING_DOWN	2
> +#define CNIC_F_BNX2_CLASS	3
> +#define CNIC_F_BNX2X_CLASS	4
> +	atomic_t ref_count;
> +	int use_count;
> +	void *cnic_priv;
> +};
> +
> +#define CNIC_WR(dev, off, val)		writel(val, dev->regview + off)
> +#define CNIC_WR16(dev, off, val)	writew(val, dev->regview + off)
> +#define CNIC_WR8(dev, off, val)		writeb(val, dev->regview + off)
> +#define CNIC_RD(dev, off)		readl(dev->regview + off)
> +
> +struct cnic_ulp_ops {
> +	void (*cnic_init)(struct cnic_dev *dev);
> +	void (*cnic_exit)(struct cnic_dev *dev);
> +	void (*cnic_start)(void *ulp_ctx);
> +	void (*cnic_stop)(void *ulp_ctx);
> +	void (*indicate_kcqes)(void *ulp_ctx, struct kcqe *cqes[],
> +				u32 num_cqes);
> +	void (*indicate_netevent)(void *ulp_ctx, unsigned long event);
> +	void (*indicate_inetevent)(void *ulp_ctx, unsigned long event);
> +	void (*cm_connect_complete)(struct cnic_sock *);
> +	void (*cm_close_complete)(struct cnic_sock *);
> +	void (*cm_abort_complete)(struct cnic_sock *);
> +	void (*cm_remote_close)(struct cnic_sock *);
> +	void (*cm_remote_abort)(struct cnic_sock *);
> +	struct module *owner;
> +};
> +
> +extern int cnic_register_driver(int ulp_type, struct cnic_ulp_ops *ulp_ops);
> +
> +extern int cnic_unregister_driver(int ulp_type);
> +
> +#endif
> -- 
> 1.5.5.GIT
> 
> 
> 
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH 2/3] cnic: Add CNIC driver.

[Michael Chan]

On Thu, 2008-05-22 at 00:44 -0700, Paul E. McKenney wrote:

> > +
> > +int cnic_register_driver(int ulp_type, struct cnic_ulp_ops *ulp_ops)
> > +{
> > +	struct cnic_dev *dev;
> > +
> > +	if (ulp_type >= MAX_CNIC_ULP_TYPE) {
> > +		printk(KERN_ERR PFX "cnic_register_driver: Bad type %d\n",
> > +		       ulp_type);
> > +		return -EINVAL;
> > +	}
> > +	mutex_lock(&cnic_lock);
> > +	if (cnic_ulp_tbl[ulp_type]) {
> > +		printk(KERN_ERR PFX "cnic_register_driver: Type %d has already "
> > +				    "been registered\n", ulp_type);
> > +		mutex_unlock(&cnic_lock);
> > +		return -EBUSY;
> > +	}
> > +
> > +	read_lock(&cnic_dev_lock);
> > +	list_for_each_entry(dev, &cnic_dev_list, list) {
> > +		struct cnic_local *cp = dev->cnic_priv;
> > +
> > +		clear_bit(ULP_F_INIT, &cp->ulp_flags[ulp_type]);
> > +	}
> > +	read_unlock(&cnic_dev_lock);
> > +
> > +	rcu_assign_pointer(cnic_ulp_tbl[ulp_type], ulp_ops);
> 
> OK, protected by cnic_lock.
> 
> > +	mutex_unlock(&cnic_lock);
> > +
> > +	/* Prevent race conditions with netdev_event */
> > +	rtnl_lock();
> > +	read_lock(&cnic_dev_lock);
> > +	list_for_each_entry(dev, &cnic_dev_list, list) {
> > +		struct cnic_local *cp = dev->cnic_priv;
> > +
> > +		if (!test_and_set_bit(ULP_F_INIT, &cp->ulp_flags[ulp_type]))
> > +			ulp_ops->cnic_init(dev);
> > +	}
> > +	read_unlock(&cnic_dev_lock);
> > +	rtnl_unlock();
> > +
> > +	return 0;
> > +}
> > +
> > +int cnic_unregister_driver(int ulp_type)
> > +{
> > +	struct cnic_dev *dev;
> > +
> > +	if (ulp_type >= MAX_CNIC_ULP_TYPE) {
> > +		printk(KERN_ERR PFX "cnic_unregister_driver: Bad type %d\n",
> > +		       ulp_type);
> > +		return -EINVAL;
> > +	}
> > +	mutex_lock(&cnic_lock);
> > +	if (!cnic_ulp_tbl[ulp_type]) {
> > +		printk(KERN_ERR PFX "cnic_unregister_driver: Type %d has not "
> > +				    "been registered\n", ulp_type);
> > +		goto out_unlock;
> > +	}
> > +	read_lock(&cnic_dev_lock);
> > +	list_for_each_entry(dev, &cnic_dev_list, list) {
> > +		struct cnic_local *cp = dev->cnic_priv;
> > +		
> > +		if (rcu_dereference(cp->ulp_ops[ulp_type])) {
> 
> The rcu_dereference() is redundant because we hold cnic_lock.
> (Which is OK, just wanting to make sure I understand the code.)

Yes, I wanted to access these RCU protected pointers in a uniform way.

> 
> > +			printk(KERN_ERR PFX "cnic_unregister_driver: Type %d "
> > +			       "still has devices registered\n", ulp_type);
> > +			read_unlock(&cnic_dev_lock);
> > +			goto out_unlock;
> > +		}
> > +	}
> > +	read_unlock(&cnic_dev_lock);
> > +
> > +	rcu_assign_pointer(cnic_ulp_tbl[ulp_type], NULL);
> 
> OK, protected by cnic_lock.
> 
> > +
> > +	mutex_unlock(&cnic_lock);
> > +	synchronize_rcu();
> 
> The caller is responsible for freeing up cnic_ulp_tbl[ulp_type]?  If so,
> the caller had better have kept a pointer to it...
> 
> But the caller would need to snapshot the pointer before the cnic_lock
> was acquired, which means that some other pointer might in fact be
> in place by the time this function returns.
> 
> So, is this data element statically allocated?  Or is there some other
> trick being used?
> 
> Or is the whole point of this code simply to ensure that any calls to
> the old cnic_ulp_tbl[ulp_type] functions have completed before this
> function returns?  If so, please add a comment to this effect.

Yes, once again to ensure that any calls have completed before
continuing.  I will document the use of RCU more in the next version.

> 
> > +	return 0;
> > +
> > +out_unlock:
> > +	mutex_unlock(&cnic_lock);
> > +	return -EINVAL;
> > +}
> > +
> > +EXPORT_SYMBOL(cnic_register_driver);
> > +EXPORT_SYMBOL(cnic_unregister_driver);
> > +
> > +static int cnic_start_hw(struct cnic_dev *);
> > +static void cnic_stop_hw(struct cnic_dev *);
> > +
> > +static int cnic_register_device(struct cnic_dev *dev, int ulp_type,
> > +				void *ulp_ctx)
> > +{
> > +	struct cnic_local *cp = dev->cnic_priv;
> > +	struct cnic_ulp_ops *ulp_ops;
> > +
> > +	if (ulp_type >= MAX_CNIC_ULP_TYPE) {
> > +		printk(KERN_ERR PFX "cnic_register_device: Bad type %d\n",
> > +		       ulp_type);
> > +		return -EINVAL;
> > +	}
> > +	mutex_lock(&cnic_lock);
> > +	if (cnic_ulp_tbl[ulp_type] == NULL) {
> > +		printk(KERN_ERR PFX "cnic_register_device: Driver with type %d "
> > +				    "has not been registered\n", ulp_type);
> > +		mutex_unlock(&cnic_lock);
> > +		return -EAGAIN;
> > +	}
> > +	if (rcu_dereference(cp->ulp_ops[ulp_type])) {
> 
> Again, the rcu_dereference() is redundant due to the cnic_lock being
> held, and again, this is OK, just checking to make sure I understand it.
> 
> > +		printk(KERN_ERR PFX "cnic_register_device: Type %d has already "
> > +		       "been registered to this device\n", ulp_type);
> > +		mutex_unlock(&cnic_lock);
> > +		return -EBUSY;
> > +	}
> > +	if (!try_module_get(cnic_ulp_tbl[ulp_type]->owner)) {
> > +		mutex_unlock(&cnic_lock);
> > +		return -EBUSY;
> > +	}
> > +
> > +	clear_bit(ULP_F_START, &cp->ulp_flags[ulp_type]);
> > +	cp->ulp_handle[ulp_type] = ulp_ctx;
> > +	ulp_ops = cnic_ulp_tbl[ulp_type];
> > +	rcu_assign_pointer(cp->ulp_ops[ulp_type], ulp_ops);
> 
> Good, protected by cnic_lock.
> 
> > +	cnic_hold(dev);
> > +	if (!dev->use_count) {
> > +		if (!test_bit(CNIC_F_IF_GOING_DOWN, &dev->flags)) {
> > +			if (dev->netdev->flags & IFF_UP)
> > +				set_bit(CNIC_F_IF_UP, &dev->flags);
> > +		}
> > +	}
> > +	dev->use_count++;
> > +
> > +	if (dev->use_count == 1) {
> > +		if (test_bit(CNIC_F_IF_UP, &dev->flags))
> > +			cnic_start_hw(dev);
> > +	}
> > +
> > +	if (test_bit(CNIC_F_CNIC_UP, &dev->flags))
> > +		if (!test_and_set_bit(ULP_F_START, &cp->ulp_flags[ulp_type]))
> > +			ulp_ops->cnic_start(cp->ulp_handle[ulp_type]);
> > +
> > +	mutex_unlock(&cnic_lock);
> > +
> > +	return 0;
> > +
> > +}
> > +
> > +static int cnic_unregister_device(struct cnic_dev *dev, int ulp_type)
> > +{
> > +	struct cnic_local *cp = dev->cnic_priv;
> > +
> > +	if (ulp_type >= MAX_CNIC_ULP_TYPE) {
> > +		printk(KERN_ERR PFX "cnic_unregister_device: Bad type %d\n",
> > +		       ulp_type);
> > +		return -EINVAL;
> > +	}
> > +	mutex_lock(&cnic_lock);
> > +	if (rcu_dereference(cp->ulp_ops[ulp_type])) {
> 
> Ditto...
> 
> > +		dev->use_count--;
> > +		module_put(cp->ulp_ops[ulp_type]->owner);
> > +		rcu_assign_pointer(cp->ulp_ops[ulp_type], NULL);
> 
> OK, cnic_lock held...
> 
> > +		if (dev->use_count == 0)
> > +			cnic_stop_hw(dev);
> > +		cnic_put(dev);
> > +	} else {
> > +		printk(KERN_ERR PFX "cnic_unregister_device: device not "
> > +		       "registered to this ulp type %d\n", ulp_type);
> > +		mutex_unlock(&cnic_lock);
> > +		return -EINVAL;
> > +	}
> > +	mutex_unlock(&cnic_lock);
> > +
> > +	synchronize_rcu();
> 
> Caller is again responsible for freeing up cp->ulp_ops[ulp_type]?
> If so, the caller had better have obtained a reference to it beforehand.
> But it might have changed in the meantime.  So, how is this freed?
> 
> Or is this statically allocated with the only purpose of the
> synchronize_rcu() being to ensure that calls though the old ops vector
> have completed before this function returns?  If so, please add a
> comment to this effect.

Yes same as above.

> > +
> > +static int cnic_cm_open(struct cnic_dev *dev)
> > +{
> > +	struct cnic_local *cp = dev->cnic_priv;
> > +	int err;
> > +
> > +	err = cnic_cm_alloc_mem(dev);
> > +	if (err)
> > +		return err;
> > +
> > +	err = cp->start_cm(dev);
> > +
> > +	if (err)
> > +		goto err_out;
> > +
> > +	spin_lock_init(&cp->wr_lock);
> > +
> > +	tasklet_init(&cp->cnic_task, &cnic_task, (unsigned long) cp);
> > +
> > +	cp->cm_nb.notifier_call = cnic_net_callback;
> > +	register_netevent_notifier(&cp->cm_nb);
> > +
> > +	dev->cm_create = cnic_cm_create;
> > +	dev->cm_destroy = cnic_cm_destroy;
> > +	dev->cm_connect = cnic_cm_connect;
> > +	dev->cm_abort = cnic_cm_abort;
> > +	dev->cm_close = cnic_cm_close;
> > +	dev->cm_select_dev = cnic_cm_select_dev;
> > +
> > +	cp->ulp_handle[CNIC_ULP_L4] = dev;
> > +	rcu_assign_pointer(cp->ulp_ops[CNIC_ULP_L4], &cm_ulp_ops);
> 
> The cnic_lock is not held due to this being initialization time, and
> that no one else can be messing with this until initialization is
> complete?

Yes, this is actually the CNIC driver registering with itself.  Only the
CNIC driver will be using the CNIC_ULP_L4 ID.

> 
> > +	return 0;
> > +
> > +err_out:
> > +	cnic_cm_free_mem(dev);
> > +	return err;
> > +}
> > +

> > +static void cnic_stop_bnx2_hw(struct cnic_dev *dev)
> > +{
> > +	struct cnic_local *cp = dev->cnic_priv;
> > +	struct cnic_eth_dev *ethdev = cp->ethdev;
> > +
> > +	cnic_disable_bnx2_int_sync(dev);
> > +
> > +	cnic_bnx2_reg_wr_ind(dev, BNX2_CP_SCRATCH + 0x20, 0);
> > +	cnic_bnx2_reg_wr_ind(dev, BNX2_COM_SCRATCH + 0x20, 0);
> > +
> > +	cnic_init_context(dev, KWQ_CID);
> > +	cnic_init_context(dev, KCQ_CID);
> > +
> > +	cnic_setup_5709_context(dev, 0);
> > +	cnic_free_irq(dev);
> > +
> > +	ethdev->drv_unregister_cnic(dev->netdev);
> > +
> > +	cnic_free_resc(dev);
> > +}
> > +
> > +static void cnic_stop_hw(struct cnic_dev *dev)
> > +{
> > +	if (test_bit(CNIC_F_CNIC_UP, &dev->flags)) {
> > +		struct cnic_local *cp = dev->cnic_priv;
> > +
> > +		clear_bit(CNIC_F_CNIC_UP, &dev->flags);
> > +		rcu_assign_pointer(cp->ulp_ops[CNIC_ULP_L4], NULL);
> 
> Given that the cnic_lock does not appear to be held, what prevents
> other CPUs from manipulating cp->ulp_ops[CNIC_ULP_L4] concurrently
> with this function?
> 

This is again the CNIC driver unregistering with itself.  Only the CNIC
driver will be using the CNIC_ULP_L4 ID.

> > +		synchronize_rcu();
> > +		cnic_cm_shutdown(dev);
> > +		cp->stop_hw(dev);
> > +		pci_dev_put(dev->pcidev);
> > +	}
> > +}
> > +

Re: [PATCH 2/3] cnic: Add CNIC driver.

[Paul E. McKenney]

On Thu, May 22, 2008 at 12:46:11PM -0700, Michael Chan wrote:
> On Thu, 2008-05-22 at 00:44 -0700, Paul E. McKenney wrote:
> 
> > > +
> > > +int cnic_register_driver(int ulp_type, struct cnic_ulp_ops *ulp_ops)
> > > +{
> > > +	struct cnic_dev *dev;
> > > +
> > > +	if (ulp_type >= MAX_CNIC_ULP_TYPE) {
> > > +		printk(KERN_ERR PFX "cnic_register_driver: Bad type %d\n",
> > > +		       ulp_type);
> > > +		return -EINVAL;
> > > +	}
> > > +	mutex_lock(&cnic_lock);
> > > +	if (cnic_ulp_tbl[ulp_type]) {
> > > +		printk(KERN_ERR PFX "cnic_register_driver: Type %d has already "
> > > +				    "been registered\n", ulp_type);
> > > +		mutex_unlock(&cnic_lock);
> > > +		return -EBUSY;
> > > +	}
> > > +
> > > +	read_lock(&cnic_dev_lock);
> > > +	list_for_each_entry(dev, &cnic_dev_list, list) {
> > > +		struct cnic_local *cp = dev->cnic_priv;
> > > +
> > > +		clear_bit(ULP_F_INIT, &cp->ulp_flags[ulp_type]);
> > > +	}
> > > +	read_unlock(&cnic_dev_lock);
> > > +
> > > +	rcu_assign_pointer(cnic_ulp_tbl[ulp_type], ulp_ops);
> > 
> > OK, protected by cnic_lock.
> > 
> > > +	mutex_unlock(&cnic_lock);
> > > +
> > > +	/* Prevent race conditions with netdev_event */
> > > +	rtnl_lock();
> > > +	read_lock(&cnic_dev_lock);
> > > +	list_for_each_entry(dev, &cnic_dev_list, list) {
> > > +		struct cnic_local *cp = dev->cnic_priv;
> > > +
> > > +		if (!test_and_set_bit(ULP_F_INIT, &cp->ulp_flags[ulp_type]))
> > > +			ulp_ops->cnic_init(dev);
> > > +	}
> > > +	read_unlock(&cnic_dev_lock);
> > > +	rtnl_unlock();
> > > +
> > > +	return 0;
> > > +}
> > > +
> > > +int cnic_unregister_driver(int ulp_type)
> > > +{
> > > +	struct cnic_dev *dev;
> > > +
> > > +	if (ulp_type >= MAX_CNIC_ULP_TYPE) {
> > > +		printk(KERN_ERR PFX "cnic_unregister_driver: Bad type %d\n",
> > > +		       ulp_type);
> > > +		return -EINVAL;
> > > +	}
> > > +	mutex_lock(&cnic_lock);
> > > +	if (!cnic_ulp_tbl[ulp_type]) {
> > > +		printk(KERN_ERR PFX "cnic_unregister_driver: Type %d has not "
> > > +				    "been registered\n", ulp_type);
> > > +		goto out_unlock;
> > > +	}
> > > +	read_lock(&cnic_dev_lock);
> > > +	list_for_each_entry(dev, &cnic_dev_list, list) {
> > > +		struct cnic_local *cp = dev->cnic_priv;
> > > +		
> > > +		if (rcu_dereference(cp->ulp_ops[ulp_type])) {
> > 
> > The rcu_dereference() is redundant because we hold cnic_lock.
> > (Which is OK, just wanting to make sure I understand the code.)
> 
> Yes, I wanted to access these RCU protected pointers in a uniform way.

Very good.

> > 
> > > +			printk(KERN_ERR PFX "cnic_unregister_driver: Type %d "
> > > +			       "still has devices registered\n", ulp_type);
> > > +			read_unlock(&cnic_dev_lock);
> > > +			goto out_unlock;
> > > +		}
> > > +	}
> > > +	read_unlock(&cnic_dev_lock);
> > > +
> > > +	rcu_assign_pointer(cnic_ulp_tbl[ulp_type], NULL);
> > 
> > OK, protected by cnic_lock.
> > 
> > > +
> > > +	mutex_unlock(&cnic_lock);
> > > +	synchronize_rcu();
> > 
> > The caller is responsible for freeing up cnic_ulp_tbl[ulp_type]?  If so,
> > the caller had better have kept a pointer to it...
> > 
> > But the caller would need to snapshot the pointer before the cnic_lock
> > was acquired, which means that some other pointer might in fact be
> > in place by the time this function returns.
> > 
> > So, is this data element statically allocated?  Or is there some other
> > trick being used?
> > 
> > Or is the whole point of this code simply to ensure that any calls to
> > the old cnic_ulp_tbl[ulp_type] functions have completed before this
> > function returns?  If so, please add a comment to this effect.
> 
> Yes, once again to ensure that any calls have completed before
> continuing.  I will document the use of RCU more in the next version.

Very good!

> > > +	return 0;
> > > +
> > > +out_unlock:
> > > +	mutex_unlock(&cnic_lock);
> > > +	return -EINVAL;
> > > +}
> > > +
> > > +EXPORT_SYMBOL(cnic_register_driver);
> > > +EXPORT_SYMBOL(cnic_unregister_driver);
> > > +
> > > +static int cnic_start_hw(struct cnic_dev *);
> > > +static void cnic_stop_hw(struct cnic_dev *);
> > > +
> > > +static int cnic_register_device(struct cnic_dev *dev, int ulp_type,
> > > +				void *ulp_ctx)
> > > +{
> > > +	struct cnic_local *cp = dev->cnic_priv;
> > > +	struct cnic_ulp_ops *ulp_ops;
> > > +
> > > +	if (ulp_type >= MAX_CNIC_ULP_TYPE) {
> > > +		printk(KERN_ERR PFX "cnic_register_device: Bad type %d\n",
> > > +		       ulp_type);
> > > +		return -EINVAL;
> > > +	}
> > > +	mutex_lock(&cnic_lock);
> > > +	if (cnic_ulp_tbl[ulp_type] == NULL) {
> > > +		printk(KERN_ERR PFX "cnic_register_device: Driver with type %d "
> > > +				    "has not been registered\n", ulp_type);
> > > +		mutex_unlock(&cnic_lock);
> > > +		return -EAGAIN;
> > > +	}
> > > +	if (rcu_dereference(cp->ulp_ops[ulp_type])) {
> > 
> > Again, the rcu_dereference() is redundant due to the cnic_lock being
> > held, and again, this is OK, just checking to make sure I understand it.
> > 
> > > +		printk(KERN_ERR PFX "cnic_register_device: Type %d has already "
> > > +		       "been registered to this device\n", ulp_type);
> > > +		mutex_unlock(&cnic_lock);
> > > +		return -EBUSY;
> > > +	}
> > > +	if (!try_module_get(cnic_ulp_tbl[ulp_type]->owner)) {
> > > +		mutex_unlock(&cnic_lock);
> > > +		return -EBUSY;
> > > +	}
> > > +
> > > +	clear_bit(ULP_F_START, &cp->ulp_flags[ulp_type]);
> > > +	cp->ulp_handle[ulp_type] = ulp_ctx;
> > > +	ulp_ops = cnic_ulp_tbl[ulp_type];
> > > +	rcu_assign_pointer(cp->ulp_ops[ulp_type], ulp_ops);
> > 
> > Good, protected by cnic_lock.
> > 
> > > +	cnic_hold(dev);
> > > +	if (!dev->use_count) {
> > > +		if (!test_bit(CNIC_F_IF_GOING_DOWN, &dev->flags)) {
> > > +			if (dev->netdev->flags & IFF_UP)
> > > +				set_bit(CNIC_F_IF_UP, &dev->flags);
> > > +		}
> > > +	}
> > > +	dev->use_count++;
> > > +
> > > +	if (dev->use_count == 1) {
> > > +		if (test_bit(CNIC_F_IF_UP, &dev->flags))
> > > +			cnic_start_hw(dev);
> > > +	}
> > > +
> > > +	if (test_bit(CNIC_F_CNIC_UP, &dev->flags))
> > > +		if (!test_and_set_bit(ULP_F_START, &cp->ulp_flags[ulp_type]))
> > > +			ulp_ops->cnic_start(cp->ulp_handle[ulp_type]);
> > > +
> > > +	mutex_unlock(&cnic_lock);
> > > +
> > > +	return 0;
> > > +
> > > +}
> > > +
> > > +static int cnic_unregister_device(struct cnic_dev *dev, int ulp_type)
> > > +{
> > > +	struct cnic_local *cp = dev->cnic_priv;
> > > +
> > > +	if (ulp_type >= MAX_CNIC_ULP_TYPE) {
> > > +		printk(KERN_ERR PFX "cnic_unregister_device: Bad type %d\n",
> > > +		       ulp_type);
> > > +		return -EINVAL;
> > > +	}
> > > +	mutex_lock(&cnic_lock);
> > > +	if (rcu_dereference(cp->ulp_ops[ulp_type])) {
> > 
> > Ditto...
> > 
> > > +		dev->use_count--;
> > > +		module_put(cp->ulp_ops[ulp_type]->owner);
> > > +		rcu_assign_pointer(cp->ulp_ops[ulp_type], NULL);
> > 
> > OK, cnic_lock held...
> > 
> > > +		if (dev->use_count == 0)
> > > +			cnic_stop_hw(dev);
> > > +		cnic_put(dev);
> > > +	} else {
> > > +		printk(KERN_ERR PFX "cnic_unregister_device: device not "
> > > +		       "registered to this ulp type %d\n", ulp_type);
> > > +		mutex_unlock(&cnic_lock);
> > > +		return -EINVAL;
> > > +	}
> > > +	mutex_unlock(&cnic_lock);
> > > +
> > > +	synchronize_rcu();
> > 
> > Caller is again responsible for freeing up cp->ulp_ops[ulp_type]?
> > If so, the caller had better have obtained a reference to it beforehand.
> > But it might have changed in the meantime.  So, how is this freed?
> > 
> > Or is this statically allocated with the only purpose of the
> > synchronize_rcu() being to ensure that calls though the old ops vector
> > have completed before this function returns?  If so, please add a
> > comment to this effect.
> 
> Yes same as above.

Good!

> > > +
> > > +static int cnic_cm_open(struct cnic_dev *dev)
> > > +{
> > > +	struct cnic_local *cp = dev->cnic_priv;
> > > +	int err;
> > > +
> > > +	err = cnic_cm_alloc_mem(dev);
> > > +	if (err)
> > > +		return err;
> > > +
> > > +	err = cp->start_cm(dev);
> > > +
> > > +	if (err)
> > > +		goto err_out;
> > > +
> > > +	spin_lock_init(&cp->wr_lock);
> > > +
> > > +	tasklet_init(&cp->cnic_task, &cnic_task, (unsigned long) cp);
> > > +
> > > +	cp->cm_nb.notifier_call = cnic_net_callback;
> > > +	register_netevent_notifier(&cp->cm_nb);
> > > +
> > > +	dev->cm_create = cnic_cm_create;
> > > +	dev->cm_destroy = cnic_cm_destroy;
> > > +	dev->cm_connect = cnic_cm_connect;
> > > +	dev->cm_abort = cnic_cm_abort;
> > > +	dev->cm_close = cnic_cm_close;
> > > +	dev->cm_select_dev = cnic_cm_select_dev;
> > > +
> > > +	cp->ulp_handle[CNIC_ULP_L4] = dev;
> > > +	rcu_assign_pointer(cp->ulp_ops[CNIC_ULP_L4], &cm_ulp_ops);
> > 
> > The cnic_lock is not held due to this being initialization time, and
> > that no one else can be messing with this until initialization is
> > complete?
> 
> Yes, this is actually the CNIC driver registering with itself.  Only the
> CNIC driver will be using the CNIC_ULP_L4 ID.

Very good!  I will leave it to you as to whether you should add a comment
to this effect.

> > 
> > > +	return 0;
> > > +
> > > +err_out:
> > > +	cnic_cm_free_mem(dev);
> > > +	return err;
> > > +}
> > > +
> 
> > > +static void cnic_stop_bnx2_hw(struct cnic_dev *dev)
> > > +{
> > > +	struct cnic_local *cp = dev->cnic_priv;
> > > +	struct cnic_eth_dev *ethdev = cp->ethdev;
> > > +
> > > +	cnic_disable_bnx2_int_sync(dev);
> > > +
> > > +	cnic_bnx2_reg_wr_ind(dev, BNX2_CP_SCRATCH + 0x20, 0);
> > > +	cnic_bnx2_reg_wr_ind(dev, BNX2_COM_SCRATCH + 0x20, 0);
> > > +
> > > +	cnic_init_context(dev, KWQ_CID);
> > > +	cnic_init_context(dev, KCQ_CID);
> > > +
> > > +	cnic_setup_5709_context(dev, 0);
> > > +	cnic_free_irq(dev);
> > > +
> > > +	ethdev->drv_unregister_cnic(dev->netdev);
> > > +
> > > +	cnic_free_resc(dev);
> > > +}
> > > +
> > > +static void cnic_stop_hw(struct cnic_dev *dev)
> > > +{
> > > +	if (test_bit(CNIC_F_CNIC_UP, &dev->flags)) {
> > > +		struct cnic_local *cp = dev->cnic_priv;
> > > +
> > > +		clear_bit(CNIC_F_CNIC_UP, &dev->flags);
> > > +		rcu_assign_pointer(cp->ulp_ops[CNIC_ULP_L4], NULL);
> > 
> > Given that the cnic_lock does not appear to be held, what prevents
> > other CPUs from manipulating cp->ulp_ops[CNIC_ULP_L4] concurrently
> > with this function?
> > 
> 
> This is again the CNIC driver unregistering with itself.  Only the CNIC
> driver will be using the CNIC_ULP_L4 ID.

Very good -- could you please add a comment to this effect?

							Thanx, Paul

> > > +		synchronize_rcu();
> > > +		cnic_cm_shutdown(dev);
> > > +		cp->stop_hw(dev);
> > > +		pci_dev_put(dev->pcidev);
> > > +	}
> > > +}
> > > +
> 
> 
> 
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH 2/3] cnic: Add CNIC driver.

[Roland Dreier]

 > +config CNIC
 > +	tristate "Broadcom CNIC support"
 > +	depends on BNX2

I suspect you'll need a "depends on INET" somewhere (probably here, but
maybe only for the iSCSI part).

 - R.

Re: [PATCH 2/3] cnic: Add CNIC driver.

[Roland Dreier]

 > +		/* Tell compiler that status_blk fields can change. */
 > +		barrier();
 > +		if (status_idx != sblk->status_idx) {

Is a compiler barrier sufficient here?  It seems an out-of-order CPU
could still mess things up, so an rmb() or smp_rmb() would be required.

Re: [PATCH 2/3] cnic: Add CNIC driver.

[Michael Chan]

On Fri, 2008-05-23 at 13:14 -0700, Roland Dreier wrote:
>  > +		/* Tell compiler that status_blk fields can change. */
>  > +		barrier();
>  > +		if (status_idx != sblk->status_idx) {
> 
> Is a compiler barrier sufficient here?  It seems an out-of-order CPU
> could still mess things up, so an rmb() or smp_rmb() would be required.
> 

The purpose of this compiler barrier is to make sure that the compiled
code will get the sblk->status_idx from memory which may change if the
chip DMAs a new status_idx.

This code is inside a while loop, so it is possible that the compiler
can optimize it to not load status_idx from memory.

Thanks.