Home | History | Annotate | Line # | Download | only in i2o
dpti.c revision 1.2
      1 /*	$NetBSD: dpti.c,v 1.2 2001/09/27 18:43:37 ad Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 2001 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This code is derived from software contributed to The NetBSD Foundation
      8  * by Andrew Doran.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  * 3. All advertising materials mentioning features or use of this software
     19  *    must display the following acknowledgement:
     20  *        This product includes software developed by the NetBSD
     21  *        Foundation, Inc. and its contributors.
     22  * 4. Neither the name of The NetBSD Foundation nor the names of its
     23  *    contributors may be used to endorse or promote products derived
     24  *    from this software without specific prior written permission.
     25  *
     26  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     27  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     28  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     29  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     30  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     31  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     32  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     33  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     34  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     35  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     36  * POSSIBILITY OF SUCH DAMAGE.
     37  */
     38 
     39 /*
     40  * Copyright (c) 1996-2000 Distributed Processing Technology Corporation
     41  * Copyright (c) 2000 Adaptec Corporation
     42  * All rights reserved.
     43  *
     44  * TERMS AND CONDITIONS OF USE
     45  *
     46  * Redistribution and use in source form, with or without modification, are
     47  * permitted provided that redistributions of source code must retain the
     48  * above copyright notice, this list of conditions and the following disclaimer.
     49  *
     50  * This software is provided `as is' by Adaptec and any express or implied
     51  * warranties, including, but not limited to, the implied warranties of
     52  * merchantability and fitness for a particular purpose, are disclaimed. In no
     53  * event shall Adaptec be liable for any direct, indirect, incidental, special,
     54  * exemplary or consequential damages (including, but not limited to,
     55  * procurement of substitute goods or services; loss of use, data, or profits;
     56  * or business interruptions) however caused and on any theory of liability,
     57  * whether in contract, strict liability, or tort (including negligence or
     58  * otherwise) arising in any way out of the use of this driver software, even
     59  * if advised of the possibility of such damage.
     60  */
     61 
     62 /*
     63  * Adaptec/DPT I2O control interface.
     64  */
     65 
     66 #include "opt_i2o.h"
     67 
     68 #include <sys/param.h>
     69 #include <sys/systm.h>
     70 #include <sys/kernel.h>
     71 #include <sys/device.h>
     72 #include <sys/queue.h>
     73 #include <sys/proc.h>
     74 #include <sys/endian.h>
     75 #include <sys/malloc.h>
     76 #include <sys/conf.h>
     77 #include <sys/ioctl.h>
     78 
     79 #include <uvm/uvm_extern.h>
     80 
     81 #include <machine/bus.h>
     82 #ifdef i386
     83 #include <machine/pio.h>
     84 #endif
     85 
     86 #include <dev/i2o/i2o.h>
     87 #include <dev/i2o/i2odpt.h>
     88 #include <dev/i2o/iopio.h>
     89 #include <dev/i2o/iopvar.h>
     90 #include <dev/i2o/dptivar.h>
     91 
     92 #ifdef I2ODEBUG
     93 #define	DPRINTF(x)		printf x
     94 #else
     95 #define	DPRINTF(x)
     96 #endif
     97 
     98 static struct dpt_sig dpti_sig = {
     99 	{ 'd', 'P', 't', 'S', 'i', 'G'},
    100 	SIG_VERSION,
    101 #if defined(i386)
    102 	PROC_INTEL,
    103 #elif defined(powerpc)
    104 	PROC_POWERPC,
    105 #elif defined(alpha)
    106 	PROC_ALPHA,
    107 #elif defined(mips)
    108 	PROC_MIPS,
    109 #elif defined(sparc64)
    110 	PROC_ULTRASPARC,
    111 #endif
    112 #if defined(i386)
    113 	PROC_386 | PROC_486 | PROC_PENTIUM | PROC_SEXIUM,
    114 #else
    115 	0,
    116 #endif
    117 	FT_HBADRVR,
    118 	0,
    119 	OEM_DPT,
    120 	OS_FREE_BSD,	/* XXX */
    121 	CAP_ABOVE16MB,
    122 	DEV_ALL,
    123 	ADF_ALL_SC5,
    124 	0,
    125 	0,
    126 	DPTI_VERSION,
    127 	DPTI_REVISION,
    128 	DPTI_SUBREVISION,
    129 	DPTI_MONTH,
    130 	DPTI_DAY,
    131 	DPTI_YEAR,
    132 	""		/* Will be filled later */
    133 };
    134 
    135 void	dpti_attach(struct device *, struct device *, void *);
    136 int	dpti_blinkled(struct dpti_softc *);
    137 int	dpti_ctlrinfo(struct dpti_softc *, u_long, caddr_t);
    138 int	dpti_match(struct device *, struct cfdata *, void *);
    139 int	dpti_passthrough(struct dpti_softc *, caddr_t, struct proc *);
    140 int	dpti_sysinfo(struct dpti_softc *, u_long, caddr_t);
    141 
    142 cdev_decl(dpti);
    143 
    144 extern struct cfdriver dpti_cd;
    145 
    146 struct cfattach dpti_ca = {
    147 	sizeof(struct dpti_softc), dpti_match, dpti_attach
    148 };
    149 
    150 int
    151 dpti_match(struct device *parent, struct cfdata *match, void *aux)
    152 {
    153 	struct iop_attach_args *ia;
    154 	struct iop_softc *iop;
    155 
    156 	ia = aux;
    157 	iop = (struct iop_softc *)parent;
    158 
    159 	if (ia->ia_class != I2O_CLASS_ANY || ia->ia_tid != I2O_TID_IOP)
    160 		return (0);
    161 
    162 	if (le16toh(iop->sc_status.orgid) != I2O_ORG_DPT)
    163 		return (0);
    164 
    165 	return (1);
    166 }
    167 
    168 void
    169 dpti_attach(struct device *parent, struct device *self, void *aux)
    170 {
    171 	struct iop_softc *iop;
    172 	struct dpti_softc *sc;
    173 	struct {
    174 		struct	i2o_param_op_results pr;
    175 		struct	i2o_param_read_results prr;
    176 		struct	i2o_dpt_param_exec_iop_buffers dib;
    177 	} __attribute__ ((__packed__)) param;
    178 	int rv;
    179 
    180 	sc = (struct dpti_softc *)self;
    181 	iop = (struct iop_softc *)parent;
    182 
    183 	/*
    184 	 * Tell the world what we are.  The description in the signature
    185 	 * must be no more than 46 bytes long (see dptivar.h).
    186 	 */
    187 	printf(": DPT/Adaptec RAID management interface\n");
    188 	sprintf(dpti_sig.dsDescription, "NetBSD %s I2O OSM", osrelease);
    189 
    190 	rv = iop_field_get_all(iop, I2O_TID_IOP,
    191 	    I2O_DPT_PARAM_EXEC_IOP_BUFFERS, &param,
    192 	    sizeof(param), NULL);
    193 	if (rv != 0)
    194 		return;
    195 
    196 	sc->sc_blinkled = le32toh(param.dib.serialoutputoff) + 8;
    197 }
    198 
    199 int
    200 dptiopen(dev_t dev, int flag, int mode, struct proc *p)
    201 {
    202 
    203 	if (securelevel > 1)
    204 		return (EPERM);
    205 	if (device_lookup(&dpti_cd, minor(dev)) == NULL)
    206 		return (ENXIO);
    207 
    208 	return (0);
    209 }
    210 
    211 int
    212 dpticlose(dev_t dev, int flag, int mode, struct proc *p)
    213 {
    214 
    215 	return (0);
    216 }
    217 
    218 int
    219 dptiioctl(dev_t dev, u_long cmd, caddr_t data, int flag, struct proc *p)
    220 {
    221 	struct iop_softc *iop;
    222 	struct dpti_softc *sc;
    223 	struct ioctl_pt *pt;
    224 	int i, size, rv;
    225 
    226 	sc = device_lookup(&dpti_cd, minor(dev));
    227 	iop = (struct iop_softc *)sc->sc_dv.dv_parent;
    228 
    229 	/*
    230 	 * Currently, we only take ioctls passed down from the Linux
    231 	 * emulation layer.
    232 	 */
    233 	if (cmd == PTIOCLINUX) {
    234 		pt = (struct ioctl_pt *)data;
    235 		cmd = pt->com;
    236 		data = pt->data;
    237 	} else
    238 		return (ENOTTY);
    239 
    240 	size = IOCPARM_LEN(cmd);
    241 
    242 	switch (cmd & 0xffff) {
    243 	case DPT_SIGNATURE:
    244 		if (size > sizeof(dpti_sig))
    245 			size = sizeof(dpti_sig);
    246 		memcpy(data, &dpti_sig, size);
    247 		return (0);
    248 
    249 	case DPT_CTRLINFO:
    250 		return (dpti_ctlrinfo(sc, cmd, data));
    251 
    252 	case DPT_SYSINFO:
    253 		return (dpti_sysinfo(sc, cmd, data));
    254 
    255 	case DPT_BLINKLED:
    256 		if ((i = dpti_blinkled(sc)) == -1)
    257 			i = 0;
    258 
    259 		if (size == 0)
    260 			return (copyout(&i, *(caddr_t *)data, sizeof(i)));
    261 
    262 		*(int *)data = i;
    263 		return (0);
    264 
    265 	case DPT_TARGET_BUSY:
    266 		/*
    267 		 * XXX This is here to stop linux_machdepioctl() from
    268 		 * whining about an unknown ioctl.  Really, it should be
    269 		 * implemented.
    270 		 */
    271 		return (EIO);
    272 
    273 	case DPT_I2OUSRCMD:
    274 		if (sc->sc_nactive++ >= 2)
    275 			tsleep(&sc->sc_nactive, PRIBIO, "dptislp", 0);
    276 
    277 		rv = dpti_passthrough(sc, data, p);
    278 
    279 		sc->sc_nactive--;
    280 		wakeup_one(&sc->sc_nactive);
    281 		return (rv);
    282 
    283 	case DPT_I2ORESETCMD:
    284 		printf("%s: I2ORESETCMD not implemented\n",
    285 		    sc->sc_dv.dv_xname);
    286 		return (EOPNOTSUPP);
    287 
    288 	case DPT_I2ORESCANCMD:
    289 		return (iop_reconfigure(iop, 0));
    290 
    291 	default:
    292 		return (ENOTTY);
    293 	}
    294 }
    295 
    296 int
    297 dpti_blinkled(struct dpti_softc *sc)
    298 {
    299 	struct iop_softc *iop;
    300 	u_int v;
    301 
    302 	iop = (struct iop_softc *)sc->sc_dv.dv_parent;
    303 
    304 	v = bus_space_read_1(iop->sc_iot, iop->sc_ioh, sc->sc_blinkled + 0);
    305 	if (v == 0xbc) {
    306 		v = bus_space_read_1(iop->sc_iot, iop->sc_ioh,
    307 		    sc->sc_blinkled + 1);
    308 		return (v);
    309 	}
    310 
    311 	return (-1);
    312 }
    313 
    314 int
    315 dpti_ctlrinfo(struct dpti_softc *sc, u_long cmd, caddr_t data)
    316 {
    317 	struct dpt_ctlrinfo info;
    318 	struct iop_softc *iop;
    319 	int rv, i;
    320 
    321 	iop = (struct iop_softc *)sc->sc_dv.dv_parent;
    322 
    323 	memset(&info, 0, sizeof(info));
    324 
    325 	info.length = sizeof(info) - sizeof(u_int16_t);
    326 	info.drvrHBAnum = sc->sc_dv.dv_unit;
    327 	info.baseAddr = iop->sc_memaddr;
    328 	if ((i = dpti_blinkled(sc)) == -1)
    329 		i = 0;
    330 	info.blinkState = i;
    331 	info.pciBusNum = iop->sc_pcibus;
    332 	info.pciDeviceNum = iop->sc_pcidev;
    333 	info.hbaFlags = FLG_OSD_PCI_VALID | FLG_OSD_DMA | FLG_OSD_I2O;
    334 	info.Interrupt = 10;			/* XXX */
    335 
    336 	if (IOCPARM_LEN(cmd) > sizeof(*data)) {
    337 		memcpy(data, &info, min(sizeof(info), IOCPARM_LEN(cmd)));
    338 		rv = 0;
    339 	} else
    340 		rv = copyout(&info, *(caddr_t *)data, sizeof(info));
    341 
    342 	return (rv);
    343 }
    344 
    345 int
    346 dpti_sysinfo(struct dpti_softc *sc, u_long cmd, caddr_t data)
    347 {
    348 	struct dpt_sysinfo info;
    349 	int rv;
    350 #ifdef i386
    351 	int i, j;
    352 #endif
    353 
    354 	memset(&info, 0, sizeof(info));
    355 
    356 #ifdef i386
    357 	outb (0x70, 0x12);
    358 	i = inb(0x71);
    359 	j = i >> 4;
    360 	if (i == 0x0f) {
    361 		outb (0x70, 0x19);
    362 		j = inb (0x71);
    363 	}
    364 	info.drive0CMOS = j;
    365 
    366 	j = i & 0x0f;
    367 	if (i == 0x0f) {
    368 		outb (0x70, 0x1a);
    369 		j = inb (0x71);
    370 	}
    371 	info.drive1CMOS = j;
    372 	info.processorFamily = dpti_sig.dsProcessorFamily;
    373 
    374 	/*
    375 	 * Get the conventional memory size from CMOS.
    376 	 */
    377 	outb(0x70, 0x16);
    378 	j = inb(0x71);
    379 	j <<= 8;
    380 	outb(0x70, 0x15);
    381 	j |= inb(0x71);
    382 	info.conventionalMemSize = j;
    383 
    384 	/*
    385 	 * Get the extended memory size from CMOS.
    386 	 */
    387 	outb(0x70, 0x31);
    388 	j = inb(0x71);
    389 	j <<= 8;
    390 	outb(0x70, 0x30);
    391 	j |= inb(0x71);
    392 	info.extendedMemSize = j;
    393 
    394 	switch (cpu_class) {
    395 	case CPUCLASS_386:
    396 		info.processorType = PROC_386;
    397 		break;
    398 	case CPUCLASS_486:
    399 		info.processorType = PROC_486;
    400 		break;
    401 	case CPUCLASS_586:
    402 		info.processorType = PROC_PENTIUM;
    403 		break;
    404 	case CPUCLASS_686:
    405 	default:
    406 		info.processorType = PROC_SEXIUM;
    407 		break;
    408 	}
    409 
    410 	info.flags = SI_CMOS_Valid | SI_BusTypeValid |
    411 	    SI_MemorySizeValid | SI_NO_SmartROM;
    412 #else
    413 	info.flags = SI_BusTypeValid | SI_NO_SmartROM;
    414 #endif
    415 
    416 	info.busType = SI_PCI_BUS;
    417 
    418 	/*
    419 	 * Copy out the info structure to the user.
    420 	 */
    421 	if (IOCPARM_LEN(cmd) > sizeof(*data)) {
    422 		memcpy(data, &info, min(sizeof(info), IOCPARM_LEN(cmd)));
    423 		rv = 0;
    424 	} else
    425 		rv = copyout(&info, *(caddr_t *)data, sizeof(info));
    426 
    427 	return (rv);
    428 }
    429 
    430 int
    431 dpti_passthrough(struct dpti_softc *sc, caddr_t data, struct proc *proc)
    432 {
    433 	struct iop_softc *iop;
    434 	struct i2o_msg mh, *mf;
    435 	struct i2o_reply rh;
    436 	struct iop_msg *im;
    437 	struct dpti_ptbuf bufs[IOP_MAX_MSG_XFERS];
    438 	u_int32_t mbtmp[IOP_MAX_MSG_SIZE / sizeof(u_int32_t)];
    439 	u_int32_t rbtmp[IOP_MAX_MSG_SIZE / sizeof(u_int32_t)];
    440 	int rv, msgsize, repsize, sgoff, i, mapped, nbuf, nfrag, j, sz;
    441 	u_int32_t *p, *pmax, *pstart;
    442 
    443 	iop = (struct iop_softc *)sc->sc_dv.dv_parent;
    444 	im = NULL;
    445 
    446 	if ((rv = dpti_blinkled(sc)) != -1) {
    447 		if (rv != 0) {
    448 			printf("%s: adapter blinkled = 0x%02x\n",
    449 			    sc->sc_dv.dv_xname, rv);
    450 			return (EIO);
    451 		}
    452 	}
    453 
    454 	/*
    455 	 * Copy in the message frame header and determine the size of the
    456 	 * full message frame.
    457 	 */
    458 	if ((rv = copyin(data, &mh, sizeof(mh))) != 0) {
    459 		DPRINTF(("%s: message copyin failed\n",
    460 		    sc->sc_dv.dv_xname));
    461 		return (rv);
    462 	}
    463 
    464 	msgsize = (mh.msgflags >> 14) & ~3;
    465 	if (msgsize < sizeof(mh) || msgsize >= IOP_MAX_MSG_SIZE) {
    466 		DPRINTF(("%s: bad message frame size\n",
    467 		    sc->sc_dv.dv_xname));
    468 		return (EINVAL);
    469 	}
    470 
    471 	/*
    472 	 * Handle special commands.
    473 	 */
    474 	switch (mh.msgfunc >> 24) {
    475 	case I2O_EXEC_IOP_RESET:
    476 		printf("%s: I2O_EXEC_IOP_RESET not implemented\n",
    477 		    sc->sc_dv.dv_xname);
    478 		return (EOPNOTSUPP);
    479 
    480 	case I2O_EXEC_OUTBOUND_INIT:
    481 		printf("%s: I2O_EXEC_OUTBOUND_INIT not implemented\n",
    482 		    sc->sc_dv.dv_xname);
    483 		return (EOPNOTSUPP);
    484 
    485 	case I2O_EXEC_SYS_TAB_SET:
    486 		printf("%s: I2O_EXEC_SYS_TAB_SET not implemented\n",
    487 		    sc->sc_dv.dv_xname);
    488 		return (EOPNOTSUPP);
    489 
    490 	case I2O_EXEC_STATUS_GET:
    491 		if ((rv = iop_status_get(iop, 0)) == 0)
    492 			rv = copyout(&iop->sc_status, data + msgsize,
    493 			    sizeof(iop->sc_status));
    494 		return (rv);
    495 	}
    496 
    497 	/*
    498 	 * Copy in the full message frame.
    499 	 */
    500 	if ((rv = copyin(data, mbtmp, msgsize)) != 0) {
    501 		DPRINTF(("%s: full message copyin failed\n",
    502 		    sc->sc_dv.dv_xname));
    503 		return (rv);
    504 	}
    505 
    506 	/*
    507 	 * Determine the size of the reply frame, and copy it in.
    508 	 */
    509 	if ((rv = copyin(data + msgsize, &rh, sizeof(rh))) != 0) {
    510 		DPRINTF(("%s: reply copyin failed\n",
    511 		    sc->sc_dv.dv_xname));
    512 		return (rv);
    513 	}
    514 
    515 	repsize = (rh.msgflags >> 14) & ~3;
    516 	if (repsize < sizeof(rh) || repsize >= IOP_MAX_MSG_SIZE) {
    517 		DPRINTF(("%s: bad reply header size\n",
    518 		    sc->sc_dv.dv_xname));
    519 		return (EINVAL);
    520 	}
    521 
    522 	if ((rv = copyin(data + msgsize, rbtmp, repsize)) != 0) {
    523 		DPRINTF(("%s: reply too large\n", sc->sc_dv.dv_xname));
    524 		return (rv);
    525 	}
    526 
    527 	/*
    528 	 * If the message has a scatter gather list, it must be comprised of
    529 	 * simple elements.  If any one transfer contains multiple segments,
    530 	 * we allocate a temporary buffer for it; otherwise, the buffer will
    531 	 * be mapped directly.
    532 	 */
    533 	if ((sgoff = ((mh.msgflags >> 4) & 15)) != 0) {
    534 		if ((sgoff + 2) > (msgsize >> 2)) {
    535 			DPRINTF(("%s: invalid message size fields\n",
    536 			    sc->sc_dv.dv_xname));
    537 			return (EINVAL);
    538 		}
    539 
    540 		memset(bufs, 0, sizeof(bufs));
    541 	} else
    542 		nbuf = -1;
    543 
    544 	rv = EINVAL;
    545 
    546 	if (sgoff != 0) {
    547 		p = mbtmp + sgoff;
    548 		pmax = mbtmp + (msgsize >> 2) - 2;
    549 
    550 		for (nbuf = 0; nbuf < IOP_MAX_MSG_XFERS; nbuf++, p += 2) {
    551 			if (p > pmax) {
    552 				DPRINTF(("%s: invalid SGL (1)\n",
    553 				    sc->sc_dv.dv_xname));
    554 				goto bad;
    555 			}
    556 
    557 			if ((p[0] & 0x30000000) != I2O_SGL_SIMPLE) {
    558 				DPRINTF(("%s: invalid SGL (2)\n",
    559 				    sc->sc_dv.dv_xname));
    560 				goto bad;
    561 			}
    562 
    563 			bufs[nbuf].db_out = (p[0] & I2O_SGL_DATA_OUT) != 0;
    564 			bufs[nbuf].db_ptr = NULL;
    565 
    566 			if ((p[0] & I2O_SGL_END_BUFFER) != 0) {
    567 				if ((p[0] & 0x00ffffff) > IOP_MAX_XFER) {
    568 					DPRINTF(("%s: buffer too large\n",
    569 					    sc->sc_dv.dv_xname));
    570 					goto bad;
    571 				}
    572 
    573 				bufs[nbuf].db_ptr = (caddr_t)p[1];
    574 				bufs[nbuf].db_proc = proc;
    575 				bufs[nbuf].db_size = p[0] & 0x00ffffff;
    576 
    577 				if ((p[0] & I2O_SGL_END) != 0)
    578 					break;
    579 
    580 				continue;
    581 			}
    582 
    583 			/*
    584 			 * The buffer has multiple segments.  Determine the
    585 			 * total size.
    586 			 */
    587 			nfrag = 0;
    588 			sz = 0;
    589 			for (pstart = p; p <= pmax; p += 2) {
    590 				if (nfrag == DPTI_MAX_SEGS) {
    591 					DPRINTF(("%s: too many segments\n",
    592 					    sc->sc_dv.dv_xname));
    593 					goto bad;
    594 				}
    595 
    596 				bufs[nbuf].db_frags[nfrag].iov_len =
    597 				    p[0] & 0x00ffffff;
    598 				bufs[nbuf].db_frags[nfrag].iov_base =
    599 				    (void *)p[1];
    600 
    601 				sz += p[0] & 0x00ffffff;
    602 				nfrag++;
    603 
    604 				if ((p[0] & I2O_SGL_END) != 0) {
    605 					if ((p[0] & I2O_SGL_END_BUFFER) == 0) {
    606 						DPRINTF((
    607 						    "%s: invalid SGL (3)\n",
    608 						    sc->sc_dv.dv_xname));
    609 						goto bad;
    610 					}
    611 					break;
    612 				}
    613 				if ((p[0] & I2O_SGL_END_BUFFER) != 0)
    614 					break;
    615 			}
    616 			bufs[nbuf].db_nfrag = nfrag;
    617 
    618 			if (p > pmax) {
    619 				DPRINTF(("%s: invalid SGL (4)\n",
    620 				    sc->sc_dv.dv_xname));
    621 				goto bad;
    622 			}
    623 
    624 			if (sz > IOP_MAX_XFER) {
    625 				DPRINTF(("%s: buffer too large\n",
    626 				    sc->sc_dv.dv_xname));
    627 				goto bad;
    628 			}
    629 
    630 			bufs[nbuf].db_size = sz;
    631 			bufs[nbuf].db_ptr = malloc(sz, M_DEVBUF, M_WAITOK);
    632 			if (bufs[nbuf].db_ptr == NULL) {
    633 				DPRINTF(("%s: allocation failure\n",
    634 				    sc->sc_dv.dv_xname));
    635 				rv = ENOMEM;
    636 				goto bad;
    637 			}
    638 
    639 			for (i = 0, sz = 0; i < bufs[nbuf].db_nfrag; i++) {
    640 				rv = copyin(bufs[nbuf].db_frags[i].iov_base,
    641 				    bufs[nbuf].db_ptr + sz,
    642 				    bufs[nbuf].db_frags[i].iov_len);
    643 				if (rv != 0) {
    644 					DPRINTF(("%s: frag copyin\n",
    645 					    sc->sc_dv.dv_xname));
    646 					goto bad;
    647 				}
    648 				sz += bufs[nbuf].db_frags[i].iov_len;
    649 			}
    650 
    651 			if ((p[0] & I2O_SGL_END) != 0)
    652 				break;
    653 		}
    654 
    655 		if (nbuf == IOP_MAX_MSG_XFERS) {
    656 			DPRINTF(("%s: too many transfers\n",
    657 			    sc->sc_dv.dv_xname));
    658 			goto bad;
    659 		}
    660 	}
    661 
    662 	/*
    663 	 * Allocate a wrapper, and adjust the message header fields to
    664 	 * indicate that no scatter-gather list is currently present.
    665 	 */
    666 	mapped = 0;
    667 
    668 	im = iop_msg_alloc(iop, IM_WAIT | IM_NOSTATUS);
    669 	im->im_rb = (struct i2o_reply *)rbtmp;
    670 	mf = (struct i2o_msg *)mbtmp;
    671 	mf->msgictx = IOP_ICTX;
    672 	mf->msgtctx = im->im_tctx;
    673 
    674 	if (sgoff != 0)
    675 		mf->msgflags = (mf->msgflags & 0xff0f) | (sgoff << 16);
    676 
    677 	/*
    678 	 * Map the data transfer(s).
    679 	 */
    680 	for (i = 0; i <= nbuf; i++) {
    681 		rv = iop_msg_map(iop, im, mbtmp, bufs[i].db_ptr,
    682 		    bufs[i].db_size, bufs[i].db_out, bufs[i].db_proc);
    683 		if (rv != 0) {
    684 			DPRINTF(("%s: msg_map failed, rv = %d\n",
    685 			    sc->sc_dv.dv_xname, rv));
    686 			goto bad;
    687 		}
    688 		mapped = 1;
    689 	}
    690 
    691 	/*
    692 	 * Start the command and sleep until it completes.
    693 	 */
    694 	if ((rv = iop_msg_post(iop, im, mbtmp, 5*60*1000)) != 0)
    695 		goto bad;
    696 
    697 	/*
    698 	 * Copy out the reply frame.
    699 	 */
    700 	if ((rv = copyout(rbtmp, data + msgsize, repsize)) != 0)
    701 		DPRINTF(("%s: reply copyout() failed\n",
    702 		    sc->sc_dv.dv_xname));
    703 
    704  bad:
    705 	/*
    706 	 * Free resources and return to the caller.
    707 	 */
    708 	if (im != NULL) {
    709 		if (mapped)
    710 			iop_msg_unmap(iop, im);
    711 		iop_msg_free(iop, im);
    712 	}
    713 
    714 	for (i = 0; i <= nbuf; i++) {
    715 		if (bufs[i].db_proc != NULL)
    716 			continue;
    717 
    718 		if (!bufs[i].db_out && rv == 0) {
    719 			for (j = 0, sz = 0; j < bufs[i].db_nfrag; j++) {
    720 				rv = copyout(bufs[i].db_ptr + sz,
    721 				    bufs[i].db_frags[j].iov_base,
    722 				    bufs[i].db_frags[j].iov_len);
    723 				if (rv != 0)
    724 					break;
    725 				sz += bufs[i].db_frags[j].iov_len;
    726 			}
    727 		}
    728 
    729 		if (bufs[i].db_ptr != NULL)
    730 			free(bufs[i].db_ptr, M_DEVBUF);
    731 	}
    732 
    733 	return (rv);
    734 }
    735