Home | History | Annotate | Line # | Download | only in i2o
dpti.c revision 1.35.16.1
      1 /*	$NetBSD: dpti.c,v 1.35.16.1 2008/04/05 23:33:21 mjf Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 2001, 2007 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This code is derived from software contributed to The NetBSD Foundation
      8  * by Andrew Doran.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  * 3. All advertising materials mentioning features or use of this software
     19  *    must display the following acknowledgement:
     20  *        This product includes software developed by the NetBSD
     21  *        Foundation, Inc. and its contributors.
     22  * 4. Neither the name of The NetBSD Foundation nor the names of its
     23  *    contributors may be used to endorse or promote products derived
     24  *    from this software without specific prior written permission.
     25  *
     26  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     27  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     28  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     29  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     30  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     31  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     32  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     33  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     34  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     35  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     36  * POSSIBILITY OF SUCH DAMAGE.
     37  */
     38 
     39 /*
     40  * Copyright (c) 1996-2000 Distributed Processing Technology Corporation
     41  * Copyright (c) 2000 Adaptec Corporation
     42  * All rights reserved.
     43  *
     44  * TERMS AND CONDITIONS OF USE
     45  *
     46  * Redistribution and use in source form, with or without modification, are
     47  * permitted provided that redistributions of source code must retain the
     48  * above copyright notice, this list of conditions and the following disclaimer.
     49  *
     50  * This software is provided `as is' by Adaptec and any express or implied
     51  * warranties, including, but not limited to, the implied warranties of
     52  * merchantability and fitness for a particular purpose, are disclaimed. In no
     53  * event shall Adaptec be liable for any direct, indirect, incidental, special,
     54  * exemplary or consequential damages (including, but not limited to,
     55  * procurement of substitute goods or services; loss of use, data, or profits;
     56  * or business interruptions) however caused and on any theory of liability,
     57  * whether in contract, strict liability, or tort (including negligence or
     58  * otherwise) arising in any way out of the use of this driver software, even
     59  * if advised of the possibility of such damage.
     60  */
     61 
     62 /*
     63  * Adaptec/DPT I2O control interface.
     64  */
     65 
     66 #include <sys/cdefs.h>
     67 __KERNEL_RCSID(0, "$NetBSD: dpti.c,v 1.35.16.1 2008/04/05 23:33:21 mjf Exp $");
     68 
     69 #include <sys/param.h>
     70 #include <sys/systm.h>
     71 #include <sys/kernel.h>
     72 #include <sys/device.h>
     73 #include <sys/queue.h>
     74 #include <sys/proc.h>
     75 #include <sys/endian.h>
     76 #include <sys/malloc.h>
     77 #include <sys/conf.h>
     78 #include <sys/ioctl.h>
     79 #include <sys/kauth.h>
     80 
     81 #include <uvm/uvm_extern.h>
     82 
     83 #include <sys/bus.h>
     84 #ifdef __i386__
     85 #include <machine/pio.h>
     86 #endif
     87 
     88 #include <dev/i2o/i2o.h>
     89 #include <dev/i2o/i2odpt.h>
     90 #include <dev/i2o/iopio.h>
     91 #include <dev/i2o/iopvar.h>
     92 #include <dev/i2o/dptivar.h>
     93 
     94 #ifdef I2ODEBUG
     95 #define	DPRINTF(x)		printf x
     96 #else
     97 #define	DPRINTF(x)
     98 #endif
     99 
    100 static struct dpt_sig dpti_sig = {
    101 	{ 'd', 'P', 't', 'S', 'i', 'G'},
    102 	SIG_VERSION,
    103 #if defined(__i386__)
    104 	PROC_INTEL,
    105 #elif defined(__powerpc__)
    106 	PROC_POWERPC,
    107 #elif defined(__alpha__)
    108 	PROC_ALPHA,
    109 #elif defined(__mips__)
    110 	PROC_MIPS,
    111 #elif defined(__sparc64__)
    112 	PROC_ULTRASPARC,
    113 #endif
    114 #if defined(__i386__)
    115 	PROC_386 | PROC_486 | PROC_PENTIUM | PROC_SEXIUM,
    116 #else
    117 	0,
    118 #endif
    119 	FT_HBADRVR,
    120 	0,
    121 	OEM_DPT,
    122 	OS_FREE_BSD,	/* XXX */
    123 	CAP_ABOVE16MB,
    124 	DEV_ALL,
    125 	ADF_ALL_SC5,
    126 	0,
    127 	0,
    128 	DPTI_VERSION,
    129 	DPTI_REVISION,
    130 	DPTI_SUBREVISION,
    131 	DPTI_MONTH,
    132 	DPTI_DAY,
    133 	DPTI_YEAR,
    134 	""		/* Will be filled later */
    135 };
    136 
    137 void	dpti_attach(struct device *, struct device *, void *);
    138 int	dpti_blinkled(struct dpti_softc *);
    139 int	dpti_ctlrinfo(struct dpti_softc *, int, void *);
    140 int	dpti_match(struct device *, struct cfdata *, void *);
    141 int	dpti_passthrough(struct dpti_softc *, void *, struct proc *);
    142 int	dpti_sysinfo(struct dpti_softc *, int, void *);
    143 
    144 dev_type_open(dptiopen);
    145 dev_type_ioctl(dptiioctl);
    146 
    147 const struct cdevsw dpti_cdevsw = {
    148 	dptiopen, nullclose, noread, nowrite, dptiioctl,
    149 	nostop, notty, nopoll, nommap, nokqfilter, D_OTHER,
    150 };
    151 
    152 extern struct cfdriver dpti_cd;
    153 
    154 CFATTACH_DECL(dpti, sizeof(struct dpti_softc),
    155     dpti_match, dpti_attach, NULL, NULL);
    156 
    157 int
    158 dpti_match(struct device *parent, struct cfdata *match, void *aux)
    159 {
    160 	struct iop_attach_args *ia;
    161 	struct iop_softc *iop;
    162 
    163 	ia = aux;
    164 	iop = (struct iop_softc *)parent;
    165 
    166 	if (ia->ia_class != I2O_CLASS_ANY || ia->ia_tid != I2O_TID_IOP)
    167 		return (0);
    168 
    169 	if (le16toh(iop->sc_status.orgid) != I2O_ORG_DPT)
    170 		return (0);
    171 
    172 	return (1);
    173 }
    174 
    175 void
    176 dpti_attach(struct device *parent, struct device *self, void *aux)
    177 {
    178 	struct iop_softc *iop;
    179 	struct dpti_softc *sc;
    180 	struct {
    181 		struct	i2o_param_op_results pr;
    182 		struct	i2o_param_read_results prr;
    183 		struct	i2o_dpt_param_exec_iop_buffers dib;
    184 	} __attribute__ ((__packed__)) param;
    185 	int rv, maj;
    186 
    187 	sc = device_private(self);
    188 	iop = device_private(parent);
    189 
    190 	/*
    191 	 * Tell the world what we are.  The description in the signature
    192 	 * must be no more than 46 bytes long (see dptivar.h).
    193 	 */
    194 	printf(": DPT/Adaptec RAID management interface\n");
    195 	snprintf(dpti_sig.dsDescription, sizeof(dpti_sig.dsDescription),
    196 	    "NetBSD %s I2O OSM", osrelease);
    197 
    198 	rv = iop_field_get_all(iop, I2O_TID_IOP,
    199 	    I2O_DPT_PARAM_EXEC_IOP_BUFFERS, &param,
    200 	    sizeof(param), NULL);
    201 	if (rv != 0)
    202 		return;
    203 
    204 	sc->sc_blinkled = le32toh(param.dib.serialoutputoff) + 8;
    205 
    206 	maj = cdevsw_lookup_major(&dpti_cdevsw);
    207 	device_register_name(makedev(maj, device_unit(self)), self, true,
    208 	    DEV_OTHER, device_xname(self));
    209 }
    210 
    211 int
    212 dptiopen(dev_t dev, int flag, int mode,
    213     struct lwp *l)
    214 {
    215 
    216 	if (device_lookup(&dpti_cd, minor(dev)) == NULL)
    217 		return (ENXIO);
    218 
    219 	return (0);
    220 }
    221 
    222 int
    223 dptiioctl(dev_t dev, u_long cmd, void *data, int flag, struct lwp *l)
    224 {
    225 	struct iop_softc *iop;
    226 	struct dpti_softc *sc;
    227 	struct ioctl_pt *pt;
    228 	int i, size, rv, linux;
    229 
    230 	sc = device_lookup(&dpti_cd, minor(dev));
    231 	iop = (struct iop_softc *)device_parent(&sc->sc_dv);
    232 	rv = 0;
    233 
    234 	if (cmd == PTIOCLINUX) {
    235 		pt = (struct ioctl_pt *)data;
    236 		size = IOCPARM_LEN(pt->com);
    237 		cmd = pt->com & 0xffff;
    238 		data = pt->data;
    239 		linux = 1;
    240 	} else {
    241 		size = IOCPARM_LEN(cmd);
    242 		cmd = cmd & 0xffff;
    243 		linux = 0;
    244 	}
    245 
    246 	switch (cmd) {
    247 	case DPT_SIGNATURE:
    248 		if (size > sizeof(dpti_sig))
    249 			size = sizeof(dpti_sig);
    250 		memcpy(data, &dpti_sig, size);
    251 		break;
    252 
    253 	case DPT_CTRLINFO:
    254 		rv = dpti_ctlrinfo(sc, size, data);
    255 		break;
    256 
    257 	case DPT_SYSINFO:
    258 		rv = dpti_sysinfo(sc, size, data);
    259 		break;
    260 
    261 	case DPT_BLINKLED:
    262 		if ((i = dpti_blinkled(sc)) == -1)
    263 			i = 0;
    264 
    265 		if (size == 0) {
    266 			rv = copyout(&i, *(void **)data, sizeof(i));
    267 			break;
    268 		}
    269 
    270 		*(int *)data = i;
    271 		break;
    272 
    273 	case DPT_TARGET_BUSY:
    274 		/*
    275 		 * XXX This is here to stop linux_machdepioctl() from
    276 		 * whining about an unknown ioctl.
    277 		 */
    278 		rv = EIO;
    279 		break;
    280 
    281 	case DPT_I2OUSRCMD:
    282 		rv = kauth_authorize_device_passthru(l->l_cred, dev,
    283 		    KAUTH_REQ_DEVICE_RAWIO_PASSTHRU_ALL, data);
    284 		if (rv)
    285 			break;
    286 
    287 		if (sc->sc_nactive++ >= 2)
    288 			tsleep(&sc->sc_nactive, PRIBIO, "dptislp", 0);
    289 
    290 		if (linux)
    291 			rv = dpti_passthrough(sc, data, l->l_proc);
    292 		else
    293 			rv = dpti_passthrough(sc, *(void **)data, l->l_proc);
    294 
    295 		sc->sc_nactive--;
    296 		wakeup_one(&sc->sc_nactive);
    297 		break;
    298 
    299 	case DPT_I2ORESETCMD:
    300 		printf("%s: I2ORESETCMD not implemented\n",
    301 		    sc->sc_dv.dv_xname);
    302 		rv = EOPNOTSUPP;
    303 		break;
    304 
    305 	case DPT_I2ORESCANCMD:
    306 		mutex_enter(&iop->sc_conflock);
    307 		rv = iop_reconfigure(iop, 0);
    308 		mutex_exit(&iop->sc_conflock);
    309 		break;
    310 
    311 	default:
    312 		rv = ENOTTY;
    313 		break;
    314 	}
    315 
    316 	return (rv);
    317 }
    318 
    319 int
    320 dpti_blinkled(struct dpti_softc *sc)
    321 {
    322 	struct iop_softc *iop;
    323 	u_int v;
    324 
    325 	iop = (struct iop_softc *)device_parent(&sc->sc_dv);
    326 
    327 	v = bus_space_read_1(iop->sc_iot, iop->sc_ioh, sc->sc_blinkled + 0);
    328 	if (v == 0xbc) {
    329 		v = bus_space_read_1(iop->sc_iot, iop->sc_ioh,
    330 		    sc->sc_blinkled + 1);
    331 		return (v);
    332 	}
    333 
    334 	return (-1);
    335 }
    336 
    337 int
    338 dpti_ctlrinfo(struct dpti_softc *sc, int size, void *data)
    339 {
    340 	struct dpt_ctlrinfo info;
    341 	struct iop_softc *iop;
    342 	int rv, i;
    343 
    344 	iop = (struct iop_softc *)device_parent(&sc->sc_dv);
    345 
    346 	memset(&info, 0, sizeof(info));
    347 
    348 	info.length = sizeof(info) - sizeof(u_int16_t);
    349 	info.drvrHBAnum = device_unit(&sc->sc_dv);
    350 	info.baseAddr = iop->sc_memaddr;
    351 	if ((i = dpti_blinkled(sc)) == -1)
    352 		i = 0;
    353 	info.blinkState = i;
    354 	info.pciBusNum = iop->sc_pcibus;
    355 	info.pciDeviceNum = iop->sc_pcidev;
    356 	info.hbaFlags = FLG_OSD_PCI_VALID | FLG_OSD_DMA | FLG_OSD_I2O;
    357 	info.Interrupt = 10;			/* XXX */
    358 
    359 	if (size > sizeof(char)) {
    360 		memcpy(data, &info, min(sizeof(info), size));
    361 		rv = 0;
    362 	} else
    363 		rv = copyout(&info, *(void **)data, sizeof(info));
    364 
    365 	return (rv);
    366 }
    367 
    368 int
    369 dpti_sysinfo(struct dpti_softc *sc, int size, void *data)
    370 {
    371 	struct dpt_sysinfo info;
    372 	int rv;
    373 #ifdef __i386__
    374 	int i, j;
    375 #endif
    376 
    377 	memset(&info, 0, sizeof(info));
    378 
    379 #ifdef __i386__
    380 	outb (0x70, 0x12);
    381 	i = inb(0x71);
    382 	j = i >> 4;
    383 	if (i == 0x0f) {
    384 		outb (0x70, 0x19);
    385 		j = inb (0x71);
    386 	}
    387 	info.drive0CMOS = j;
    388 
    389 	j = i & 0x0f;
    390 	if (i == 0x0f) {
    391 		outb (0x70, 0x1a);
    392 		j = inb (0x71);
    393 	}
    394 	info.drive1CMOS = j;
    395 	info.processorFamily = dpti_sig.dsProcessorFamily;
    396 
    397 	/*
    398 	 * Get the conventional memory size from CMOS.
    399 	 */
    400 	outb(0x70, 0x16);
    401 	j = inb(0x71);
    402 	j <<= 8;
    403 	outb(0x70, 0x15);
    404 	j |= inb(0x71);
    405 	info.conventionalMemSize = j;
    406 
    407 	/*
    408 	 * Get the extended memory size from CMOS.
    409 	 */
    410 	outb(0x70, 0x31);
    411 	j = inb(0x71);
    412 	j <<= 8;
    413 	outb(0x70, 0x30);
    414 	j |= inb(0x71);
    415 	info.extendedMemSize = j;
    416 
    417 	switch (cpu_class) {
    418 	case CPUCLASS_386:
    419 		info.processorType = PROC_386;
    420 		break;
    421 	case CPUCLASS_486:
    422 		info.processorType = PROC_486;
    423 		break;
    424 	case CPUCLASS_586:
    425 		info.processorType = PROC_PENTIUM;
    426 		break;
    427 	case CPUCLASS_686:
    428 	default:
    429 		info.processorType = PROC_SEXIUM;
    430 		break;
    431 	}
    432 
    433 	info.flags = SI_CMOS_Valid | SI_BusTypeValid |
    434 	    SI_MemorySizeValid | SI_NO_SmartROM;
    435 #else
    436 	info.flags = SI_BusTypeValid | SI_NO_SmartROM;
    437 #endif
    438 
    439 	info.busType = SI_PCI_BUS;
    440 
    441 	/*
    442 	 * Copy out the info structure to the user.
    443 	 */
    444 	if (size > sizeof(char)) {
    445 		memcpy(data, &info, min(sizeof(info), size));
    446 		rv = 0;
    447 	} else
    448 		rv = copyout(&info, *(void **)data, sizeof(info));
    449 
    450 	return (rv);
    451 }
    452 
    453 int
    454 dpti_passthrough(struct dpti_softc *sc, void *data, struct proc *proc)
    455 {
    456 	struct iop_softc *iop;
    457 	struct i2o_msg mh, *mf;
    458 	struct i2o_reply rh;
    459 	struct iop_msg *im;
    460 	struct dpti_ptbuf bufs[IOP_MAX_MSG_XFERS];
    461 	u_int32_t mbtmp[IOP_MAX_MSG_SIZE / sizeof(u_int32_t)];
    462 	u_int32_t rbtmp[IOP_MAX_MSG_SIZE / sizeof(u_int32_t)];
    463 	int rv, msgsize, repsize, sgoff, i, mapped, nbuf, nfrag, j, sz;
    464 	u_int32_t *p, *pmax;
    465 
    466 	iop = (struct iop_softc *)device_parent(&sc->sc_dv);
    467 	im = NULL;
    468 
    469 	if ((rv = dpti_blinkled(sc)) != -1) {
    470 		if (rv != 0) {
    471 			printf("%s: adapter blinkled = 0x%02x\n",
    472 			    sc->sc_dv.dv_xname, rv);
    473 			return (EIO);
    474 		}
    475 	}
    476 
    477 	/*
    478 	 * Copy in the message frame header and determine the size of the
    479 	 * full message frame.
    480 	 */
    481 	if ((rv = copyin(data, &mh, sizeof(mh))) != 0) {
    482 		DPRINTF(("%s: message copyin failed\n",
    483 		    sc->sc_dv.dv_xname));
    484 		return (rv);
    485 	}
    486 
    487 	msgsize = (mh.msgflags >> 14) & ~3;
    488 	if (msgsize < sizeof(mh) || msgsize >= IOP_MAX_MSG_SIZE) {
    489 		DPRINTF(("%s: bad message frame size\n",
    490 		    sc->sc_dv.dv_xname));
    491 		return (EINVAL);
    492 	}
    493 
    494 	/*
    495 	 * Handle special commands.
    496 	 */
    497 	switch (mh.msgfunc >> 24) {
    498 	case I2O_EXEC_IOP_RESET:
    499 		printf("%s: I2O_EXEC_IOP_RESET not implemented\n",
    500 		    sc->sc_dv.dv_xname);
    501 		return (EOPNOTSUPP);
    502 
    503 	case I2O_EXEC_OUTBOUND_INIT:
    504 		printf("%s: I2O_EXEC_OUTBOUND_INIT not implemented\n",
    505 		    sc->sc_dv.dv_xname);
    506 		return (EOPNOTSUPP);
    507 
    508 	case I2O_EXEC_SYS_TAB_SET:
    509 		printf("%s: I2O_EXEC_SYS_TAB_SET not implemented\n",
    510 		    sc->sc_dv.dv_xname);
    511 		return (EOPNOTSUPP);
    512 
    513 	case I2O_EXEC_STATUS_GET:
    514 		if ((rv = iop_status_get(iop, 0)) == 0)
    515 			rv = copyout(&iop->sc_status, (char *)data + msgsize,
    516 			    sizeof(iop->sc_status));
    517 		return (rv);
    518 	}
    519 
    520 	/*
    521 	 * Copy in the full message frame.
    522 	 */
    523 	if ((rv = copyin(data, mbtmp, msgsize)) != 0) {
    524 		DPRINTF(("%s: full message copyin failed\n",
    525 		    sc->sc_dv.dv_xname));
    526 		return (rv);
    527 	}
    528 
    529 	/*
    530 	 * Determine the size of the reply frame, and copy it in.
    531 	 */
    532 	if ((rv = copyin((char *)data + msgsize, &rh, sizeof(rh))) != 0) {
    533 		DPRINTF(("%s: reply copyin failed\n",
    534 		    sc->sc_dv.dv_xname));
    535 		return (rv);
    536 	}
    537 
    538 	repsize = (rh.msgflags >> 14) & ~3;
    539 	if (repsize < sizeof(rh) || repsize >= IOP_MAX_MSG_SIZE) {
    540 		DPRINTF(("%s: bad reply header size\n",
    541 		    sc->sc_dv.dv_xname));
    542 		return (EINVAL);
    543 	}
    544 
    545 	if ((rv = copyin((char *)data + msgsize, rbtmp, repsize)) != 0) {
    546 		DPRINTF(("%s: reply too large\n", sc->sc_dv.dv_xname));
    547 		return (rv);
    548 	}
    549 
    550 	/*
    551 	 * If the message has a scatter gather list, it must be comprised of
    552 	 * simple elements.  If any one transfer contains multiple segments,
    553 	 * we allocate a temporary buffer for it; otherwise, the buffer will
    554 	 * be mapped directly.
    555 	 */
    556 	mapped = 0;
    557 	if ((sgoff = ((mh.msgflags >> 4) & 15)) != 0) {
    558 		if ((sgoff + 2) > (msgsize >> 2)) {
    559 			DPRINTF(("%s: invalid message size fields\n",
    560 			    sc->sc_dv.dv_xname));
    561 			return (EINVAL);
    562 		}
    563 
    564 		memset(bufs, 0, sizeof(bufs));
    565 
    566 		p = mbtmp + sgoff;
    567 		pmax = mbtmp + (msgsize >> 2) - 2;
    568 
    569 		for (nbuf = 0; nbuf < IOP_MAX_MSG_XFERS; nbuf++, p += 2) {
    570 			if (p > pmax) {
    571 				DPRINTF(("%s: invalid SGL (1)\n",
    572 				    sc->sc_dv.dv_xname));
    573 				goto bad;
    574 			}
    575 
    576 			if ((p[0] & 0x30000000) != I2O_SGL_SIMPLE) {
    577 				DPRINTF(("%s: invalid SGL (2)\n",
    578 				    sc->sc_dv.dv_xname));
    579 				goto bad;
    580 			}
    581 
    582 			bufs[nbuf].db_out = (p[0] & I2O_SGL_DATA_OUT) != 0;
    583 			bufs[nbuf].db_ptr = NULL;
    584 
    585 			if ((p[0] & I2O_SGL_END_BUFFER) != 0) {
    586 				if ((p[0] & 0x00ffffff) > IOP_MAX_XFER) {
    587 					DPRINTF(("%s: buffer too large\n",
    588 					    sc->sc_dv.dv_xname));
    589 					goto bad;
    590 				}
    591 
    592 				bufs[nbuf].db_ptr = (void *)p[1];
    593 				bufs[nbuf].db_proc = proc;
    594 				bufs[nbuf].db_size = p[0] & 0x00ffffff;
    595 
    596 				if ((p[0] & I2O_SGL_END) != 0)
    597 					break;
    598 
    599 				continue;
    600 			}
    601 
    602 			/*
    603 			 * The buffer has multiple segments.  Determine the
    604 			 * total size.
    605 			 */
    606 			nfrag = 0;
    607 			sz = 0;
    608 			for (; p <= pmax; p += 2) {
    609 				if (nfrag == DPTI_MAX_SEGS) {
    610 					DPRINTF(("%s: too many segments\n",
    611 					    sc->sc_dv.dv_xname));
    612 					goto bad;
    613 				}
    614 
    615 				bufs[nbuf].db_frags[nfrag].iov_len =
    616 				    p[0] & 0x00ffffff;
    617 				bufs[nbuf].db_frags[nfrag].iov_base =
    618 				    (void *)p[1];
    619 
    620 				sz += p[0] & 0x00ffffff;
    621 				nfrag++;
    622 
    623 				if ((p[0] & I2O_SGL_END) != 0) {
    624 					if ((p[0] & I2O_SGL_END_BUFFER) == 0) {
    625 						DPRINTF((
    626 						    "%s: invalid SGL (3)\n",
    627 						    sc->sc_dv.dv_xname));
    628 						goto bad;
    629 					}
    630 					break;
    631 				}
    632 				if ((p[0] & I2O_SGL_END_BUFFER) != 0)
    633 					break;
    634 			}
    635 			bufs[nbuf].db_nfrag = nfrag;
    636 
    637 			if (p > pmax) {
    638 				DPRINTF(("%s: invalid SGL (4)\n",
    639 				    sc->sc_dv.dv_xname));
    640 				goto bad;
    641 			}
    642 
    643 			if (sz > IOP_MAX_XFER) {
    644 				DPRINTF(("%s: buffer too large\n",
    645 				    sc->sc_dv.dv_xname));
    646 				goto bad;
    647 			}
    648 
    649 			bufs[nbuf].db_size = sz;
    650 			bufs[nbuf].db_ptr = malloc(sz, M_DEVBUF, M_WAITOK);
    651 			if (bufs[nbuf].db_ptr == NULL) {
    652 				DPRINTF(("%s: allocation failure\n",
    653 				    sc->sc_dv.dv_xname));
    654 				rv = ENOMEM;
    655 				goto bad;
    656 			}
    657 
    658 			for (i = 0, sz = 0; i < bufs[nbuf].db_nfrag; i++) {
    659 				rv = copyin(bufs[nbuf].db_frags[i].iov_base,
    660 				    (char *)bufs[nbuf].db_ptr + sz,
    661 				    bufs[nbuf].db_frags[i].iov_len);
    662 				if (rv != 0) {
    663 					DPRINTF(("%s: frag copyin\n",
    664 					    sc->sc_dv.dv_xname));
    665 					goto bad;
    666 				}
    667 				sz += bufs[nbuf].db_frags[i].iov_len;
    668 			}
    669 
    670 			if ((p[0] & I2O_SGL_END) != 0)
    671 				break;
    672 		}
    673 
    674 		if (nbuf == IOP_MAX_MSG_XFERS) {
    675 			DPRINTF(("%s: too many transfers\n",
    676 			    sc->sc_dv.dv_xname));
    677 			goto bad;
    678 		}
    679 	} else
    680 		nbuf = -1;
    681 
    682 	/*
    683 	 * Allocate a wrapper, and adjust the message header fields to
    684 	 * indicate that no scatter-gather list is currently present.
    685 	 */
    686 
    687 	im = iop_msg_alloc(iop, IM_WAIT | IM_NOSTATUS);
    688 	im->im_rb = (struct i2o_reply *)rbtmp;
    689 	mf = (struct i2o_msg *)mbtmp;
    690 	mf->msgictx = IOP_ICTX;
    691 	mf->msgtctx = im->im_tctx;
    692 
    693 	if (sgoff != 0)
    694 		mf->msgflags = (mf->msgflags & 0xff0f) | (sgoff << 16);
    695 
    696 	/*
    697 	 * Map the data transfer(s).
    698 	 */
    699 	for (i = 0; i <= nbuf; i++) {
    700 		rv = iop_msg_map(iop, im, mbtmp, bufs[i].db_ptr,
    701 		    bufs[i].db_size, bufs[i].db_out, bufs[i].db_proc);
    702 		if (rv != 0) {
    703 			DPRINTF(("%s: msg_map failed, rv = %d\n",
    704 			    sc->sc_dv.dv_xname, rv));
    705 			goto bad;
    706 		}
    707 		mapped = 1;
    708 	}
    709 
    710 	/*
    711 	 * Start the command and sleep until it completes.
    712 	 */
    713 	if ((rv = iop_msg_post(iop, im, mbtmp, 5*60*1000)) != 0)
    714 		goto bad;
    715 
    716 	/*
    717 	 * Copy out the reply frame.
    718 	 */
    719 	if ((rv = copyout(rbtmp, (char *)data + msgsize, repsize)) != 0) {
    720 		DPRINTF(("%s: reply copyout() failed\n",
    721 		    sc->sc_dv.dv_xname));
    722 	}
    723 
    724  bad:
    725 	/*
    726 	 * Free resources and return to the caller.
    727 	 */
    728 	if (im != NULL) {
    729 		if (mapped)
    730 			iop_msg_unmap(iop, im);
    731 		iop_msg_free(iop, im);
    732 	}
    733 
    734 	for (i = 0; i <= nbuf; i++) {
    735 		if (bufs[i].db_proc != NULL)
    736 			continue;
    737 
    738 		if (!bufs[i].db_out && rv == 0) {
    739 			for (j = 0, sz = 0; j < bufs[i].db_nfrag; j++) {
    740 				rv = copyout((char *)bufs[i].db_ptr + sz,
    741 				    bufs[i].db_frags[j].iov_base,
    742 				    bufs[i].db_frags[j].iov_len);
    743 				if (rv != 0)
    744 					break;
    745 				sz += bufs[i].db_frags[j].iov_len;
    746 			}
    747 		}
    748 
    749 		if (bufs[i].db_ptr != NULL)
    750 			free(bufs[i].db_ptr, M_DEVBUF);
    751 	}
    752 
    753 	return (rv);
    754 }
    755