Home | History | Annotate | Line # | Download | only in i2o
dpti.c revision 1.42.4.1
      1 /*	$NetBSD: dpti.c,v 1.42.4.1 2011/03/05 20:53:11 rmind Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 2001, 2007 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This code is derived from software contributed to The NetBSD Foundation
      8  * by Andrew Doran.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  *
     19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     29  * POSSIBILITY OF SUCH DAMAGE.
     30  */
     31 
     32 /*
     33  * Copyright (c) 1996-2000 Distributed Processing Technology Corporation
     34  * Copyright (c) 2000 Adaptec Corporation
     35  * All rights reserved.
     36  *
     37  * TERMS AND CONDITIONS OF USE
     38  *
     39  * Redistribution and use in source form, with or without modification, are
     40  * permitted provided that redistributions of source code must retain the
     41  * above copyright notice, this list of conditions and the following disclaimer.
     42  *
     43  * This software is provided `as is' by Adaptec and any express or implied
     44  * warranties, including, but not limited to, the implied warranties of
     45  * merchantability and fitness for a particular purpose, are disclaimed. In no
     46  * event shall Adaptec be liable for any direct, indirect, incidental, special,
     47  * exemplary or consequential damages (including, but not limited to,
     48  * procurement of substitute goods or services; loss of use, data, or profits;
     49  * or business interruptions) however caused and on any theory of liability,
     50  * whether in contract, strict liability, or tort (including negligence or
     51  * otherwise) arising in any way out of the use of this driver software, even
     52  * if advised of the possibility of such damage.
     53  */
     54 
     55 /*
     56  * Adaptec/DPT I2O control interface.
     57  */
     58 
     59 #include <sys/cdefs.h>
     60 __KERNEL_RCSID(0, "$NetBSD: dpti.c,v 1.42.4.1 2011/03/05 20:53:11 rmind Exp $");
     61 
     62 #include <sys/param.h>
     63 #include <sys/systm.h>
     64 #include <sys/kernel.h>
     65 #include <sys/device.h>
     66 #include <sys/queue.h>
     67 #include <sys/proc.h>
     68 #include <sys/endian.h>
     69 #include <sys/malloc.h>
     70 #include <sys/conf.h>
     71 #include <sys/ioctl.h>
     72 #include <sys/kauth.h>
     73 
     74 #include <sys/bus.h>
     75 #ifdef __i386__
     76 #include <machine/pio.h>
     77 #include <machine/cputypes.h>
     78 #endif
     79 
     80 #include <dev/i2o/i2o.h>
     81 #include <dev/i2o/i2odpt.h>
     82 #include <dev/i2o/iopio.h>
     83 #include <dev/i2o/iopvar.h>
     84 #include <dev/i2o/dptivar.h>
     85 
     86 #ifdef I2ODEBUG
     87 #define	DPRINTF(x)		printf x
     88 #else
     89 #define	DPRINTF(x)
     90 #endif
     91 
     92 static struct dpt_sig dpti_sig = {
     93 	{ 'd', 'P', 't', 'S', 'i', 'G'},
     94 	SIG_VERSION,
     95 #if defined(__i386__)
     96 	PROC_INTEL,
     97 #elif defined(__powerpc__)
     98 	PROC_POWERPC,
     99 #elif defined(__alpha__)
    100 	PROC_ALPHA,
    101 #elif defined(__mips__)
    102 	PROC_MIPS,
    103 #elif defined(__sparc64__)
    104 	PROC_ULTRASPARC,
    105 #endif
    106 #if defined(__i386__)
    107 	PROC_386 | PROC_486 | PROC_PENTIUM | PROC_SEXIUM,
    108 #else
    109 	0,
    110 #endif
    111 	FT_HBADRVR,
    112 	0,
    113 	OEM_DPT,
    114 	OS_FREE_BSD,	/* XXX */
    115 	CAP_ABOVE16MB,
    116 	DEV_ALL,
    117 	ADF_ALL_SC5,
    118 	0,
    119 	0,
    120 	DPTI_VERSION,
    121 	DPTI_REVISION,
    122 	DPTI_SUBREVISION,
    123 	DPTI_MONTH,
    124 	DPTI_DAY,
    125 	DPTI_YEAR,
    126 	""		/* Will be filled later */
    127 };
    128 
    129 void	dpti_attach(device_t, device_t, void *);
    130 int	dpti_blinkled(struct dpti_softc *);
    131 int	dpti_ctlrinfo(struct dpti_softc *, int, void *);
    132 int	dpti_match(device_t, cfdata_t, void *);
    133 int	dpti_passthrough(struct dpti_softc *, void *, struct proc *);
    134 int	dpti_sysinfo(struct dpti_softc *, int, void *);
    135 
    136 dev_type_open(dptiopen);
    137 dev_type_ioctl(dptiioctl);
    138 
    139 const struct cdevsw dpti_cdevsw = {
    140 	dptiopen, nullclose, noread, nowrite, dptiioctl,
    141 	nostop, notty, nopoll, nommap, nokqfilter, D_OTHER,
    142 };
    143 
    144 extern struct cfdriver dpti_cd;
    145 
    146 CFATTACH_DECL(dpti, sizeof(struct dpti_softc),
    147     dpti_match, dpti_attach, NULL, NULL);
    148 
    149 int
    150 dpti_match(device_t parent, cfdata_t match, void *aux)
    151 {
    152 	struct iop_attach_args *ia;
    153 	struct iop_softc *iop;
    154 
    155 	ia = aux;
    156 	iop = (struct iop_softc *)parent;
    157 
    158 	if (ia->ia_class != I2O_CLASS_ANY || ia->ia_tid != I2O_TID_IOP)
    159 		return (0);
    160 
    161 	if (le16toh(iop->sc_status.orgid) != I2O_ORG_DPT)
    162 		return (0);
    163 
    164 	return (1);
    165 }
    166 
    167 void
    168 dpti_attach(device_t parent, device_t self, void *aux)
    169 {
    170 	struct iop_softc *iop;
    171 	struct dpti_softc *sc;
    172 	struct {
    173 		struct	i2o_param_op_results pr;
    174 		struct	i2o_param_read_results prr;
    175 		struct	i2o_dpt_param_exec_iop_buffers dib;
    176 	} __packed param;
    177 	int rv;
    178 
    179 	sc = device_private(self);
    180 	iop = device_private(parent);
    181 
    182 	/*
    183 	 * Tell the world what we are.  The description in the signature
    184 	 * must be no more than 46 bytes long (see dptivar.h).
    185 	 */
    186 	printf(": DPT/Adaptec RAID management interface\n");
    187 	snprintf(dpti_sig.dsDescription, sizeof(dpti_sig.dsDescription),
    188 	    "NetBSD %s I2O OSM", osrelease);
    189 
    190 	rv = iop_field_get_all(iop, I2O_TID_IOP,
    191 	    I2O_DPT_PARAM_EXEC_IOP_BUFFERS, &param,
    192 	    sizeof(param), NULL);
    193 	if (rv != 0)
    194 		return;
    195 
    196 	sc->sc_blinkled = le32toh(param.dib.serialoutputoff) + 8;
    197 }
    198 
    199 int
    200 dptiopen(dev_t dev, int flag, int mode,
    201     struct lwp *l)
    202 {
    203 
    204 	if (device_lookup(&dpti_cd, minor(dev)) == NULL)
    205 		return (ENXIO);
    206 
    207 	return (0);
    208 }
    209 
    210 int
    211 dptiioctl(dev_t dev, u_long cmd, void *data, int flag, struct lwp *l)
    212 {
    213 	struct iop_softc *iop;
    214 	struct dpti_softc *sc;
    215 	struct ioctl_pt *pt;
    216 	int i, size, rv, linux;
    217 
    218 	sc = device_lookup_private(&dpti_cd, minor(dev));
    219 	iop = (struct iop_softc *)device_parent(&sc->sc_dv);
    220 	rv = 0;
    221 
    222 	if (cmd == PTIOCLINUX) {
    223 		pt = (struct ioctl_pt *)data;
    224 		size = IOCPARM_LEN(pt->com);
    225 		cmd = pt->com & 0xffff;
    226 		data = pt->data;
    227 		linux = 1;
    228 	} else {
    229 		size = IOCPARM_LEN(cmd);
    230 		cmd = cmd & 0xffff;
    231 		linux = 0;
    232 	}
    233 
    234 	switch (cmd) {
    235 	case DPT_SIGNATURE:
    236 		if (size > sizeof(dpti_sig))
    237 			size = sizeof(dpti_sig);
    238 		memcpy(data, &dpti_sig, size);
    239 		break;
    240 
    241 	case DPT_CTRLINFO:
    242 		rv = dpti_ctlrinfo(sc, size, data);
    243 		break;
    244 
    245 	case DPT_SYSINFO:
    246 		rv = dpti_sysinfo(sc, size, data);
    247 		break;
    248 
    249 	case DPT_BLINKLED:
    250 		if ((i = dpti_blinkled(sc)) == -1)
    251 			i = 0;
    252 
    253 		if (size == 0) {
    254 			rv = copyout(&i, *(void **)data, sizeof(i));
    255 			break;
    256 		}
    257 
    258 		*(int *)data = i;
    259 		break;
    260 
    261 	case DPT_TARGET_BUSY:
    262 		/*
    263 		 * XXX This is here to stop linux_machdepioctl() from
    264 		 * whining about an unknown ioctl.
    265 		 */
    266 		rv = EIO;
    267 		break;
    268 
    269 	case DPT_I2OUSRCMD:
    270 		rv = kauth_authorize_device_passthru(l->l_cred, dev,
    271 		    KAUTH_REQ_DEVICE_RAWIO_PASSTHRU_ALL, data);
    272 		if (rv)
    273 			break;
    274 
    275 		if (sc->sc_nactive++ >= 2)
    276 			tsleep(&sc->sc_nactive, PRIBIO, "dptislp", 0);
    277 
    278 		if (linux)
    279 			rv = dpti_passthrough(sc, data, l->l_proc);
    280 		else
    281 			rv = dpti_passthrough(sc, *(void **)data, l->l_proc);
    282 
    283 		sc->sc_nactive--;
    284 		wakeup_one(&sc->sc_nactive);
    285 		break;
    286 
    287 	case DPT_I2ORESETCMD:
    288 		printf("%s: I2ORESETCMD not implemented\n",
    289 		    device_xname(&sc->sc_dv));
    290 		rv = EOPNOTSUPP;
    291 		break;
    292 
    293 	case DPT_I2ORESCANCMD:
    294 		mutex_enter(&iop->sc_conflock);
    295 		rv = iop_reconfigure(iop, 0);
    296 		mutex_exit(&iop->sc_conflock);
    297 		break;
    298 
    299 	default:
    300 		rv = ENOTTY;
    301 		break;
    302 	}
    303 
    304 	return (rv);
    305 }
    306 
    307 int
    308 dpti_blinkled(struct dpti_softc *sc)
    309 {
    310 	struct iop_softc *iop;
    311 	u_int v;
    312 
    313 	iop = (struct iop_softc *)device_parent(&sc->sc_dv);
    314 
    315 	v = bus_space_read_1(iop->sc_iot, iop->sc_ioh, sc->sc_blinkled + 0);
    316 	if (v == 0xbc) {
    317 		v = bus_space_read_1(iop->sc_iot, iop->sc_ioh,
    318 		    sc->sc_blinkled + 1);
    319 		return (v);
    320 	}
    321 
    322 	return (-1);
    323 }
    324 
    325 int
    326 dpti_ctlrinfo(struct dpti_softc *sc, int size, void *data)
    327 {
    328 	struct dpt_ctlrinfo info;
    329 	struct iop_softc *iop;
    330 	int rv, i;
    331 
    332 	iop = (struct iop_softc *)device_parent(&sc->sc_dv);
    333 
    334 	memset(&info, 0, sizeof(info));
    335 
    336 	info.length = sizeof(info) - sizeof(u_int16_t);
    337 	info.drvrHBAnum = device_unit(&sc->sc_dv);
    338 	info.baseAddr = iop->sc_memaddr;
    339 	if ((i = dpti_blinkled(sc)) == -1)
    340 		i = 0;
    341 	info.blinkState = i;
    342 	info.pciBusNum = iop->sc_pcibus;
    343 	info.pciDeviceNum = iop->sc_pcidev;
    344 	info.hbaFlags = FLG_OSD_PCI_VALID | FLG_OSD_DMA | FLG_OSD_I2O;
    345 	info.Interrupt = 10;			/* XXX */
    346 
    347 	if (size > sizeof(char)) {
    348 		memcpy(data, &info, min(sizeof(info), size));
    349 		rv = 0;
    350 	} else
    351 		rv = copyout(&info, *(void **)data, sizeof(info));
    352 
    353 	return (rv);
    354 }
    355 
    356 int
    357 dpti_sysinfo(struct dpti_softc *sc, int size, void *data)
    358 {
    359 	struct dpt_sysinfo info;
    360 	int rv;
    361 #ifdef __i386__
    362 	int i, j;
    363 #endif
    364 
    365 	memset(&info, 0, sizeof(info));
    366 
    367 #ifdef __i386__
    368 	outb (0x70, 0x12);
    369 	i = inb(0x71);
    370 	j = i >> 4;
    371 	if (i == 0x0f) {
    372 		outb (0x70, 0x19);
    373 		j = inb (0x71);
    374 	}
    375 	info.drive0CMOS = j;
    376 
    377 	j = i & 0x0f;
    378 	if (i == 0x0f) {
    379 		outb (0x70, 0x1a);
    380 		j = inb (0x71);
    381 	}
    382 	info.drive1CMOS = j;
    383 	info.processorFamily = dpti_sig.dsProcessorFamily;
    384 
    385 	/*
    386 	 * Get the conventional memory size from CMOS.
    387 	 */
    388 	outb(0x70, 0x16);
    389 	j = inb(0x71);
    390 	j <<= 8;
    391 	outb(0x70, 0x15);
    392 	j |= inb(0x71);
    393 	info.conventionalMemSize = j;
    394 
    395 	/*
    396 	 * Get the extended memory size from CMOS.
    397 	 */
    398 	outb(0x70, 0x31);
    399 	j = inb(0x71);
    400 	j <<= 8;
    401 	outb(0x70, 0x30);
    402 	j |= inb(0x71);
    403 	info.extendedMemSize = j;
    404 
    405 	switch (cpu_class) {
    406 	case CPUCLASS_386:
    407 		info.processorType = PROC_386;
    408 		break;
    409 	case CPUCLASS_486:
    410 		info.processorType = PROC_486;
    411 		break;
    412 	case CPUCLASS_586:
    413 		info.processorType = PROC_PENTIUM;
    414 		break;
    415 	case CPUCLASS_686:
    416 	default:
    417 		info.processorType = PROC_SEXIUM;
    418 		break;
    419 	}
    420 
    421 	info.flags = SI_CMOS_Valid | SI_BusTypeValid |
    422 	    SI_MemorySizeValid | SI_NO_SmartROM;
    423 #else
    424 	info.flags = SI_BusTypeValid | SI_NO_SmartROM;
    425 #endif
    426 
    427 	info.busType = SI_PCI_BUS;
    428 
    429 	/*
    430 	 * Copy out the info structure to the user.
    431 	 */
    432 	if (size > sizeof(char)) {
    433 		memcpy(data, &info, min(sizeof(info), size));
    434 		rv = 0;
    435 	} else
    436 		rv = copyout(&info, *(void **)data, sizeof(info));
    437 
    438 	return (rv);
    439 }
    440 
    441 int
    442 dpti_passthrough(struct dpti_softc *sc, void *data, struct proc *proc)
    443 {
    444 	struct iop_softc *iop;
    445 	struct i2o_msg mh, *mf;
    446 	struct i2o_reply rh;
    447 	struct iop_msg *im;
    448 	struct dpti_ptbuf bufs[IOP_MAX_MSG_XFERS];
    449 	u_int32_t mbtmp[IOP_MAX_MSG_SIZE / sizeof(u_int32_t)];
    450 	u_int32_t rbtmp[IOP_MAX_MSG_SIZE / sizeof(u_int32_t)];
    451 	int rv, msgsize, repsize, sgoff, i, mapped, nbuf, nfrag, j, sz;
    452 	u_int32_t *p, *pmax;
    453 
    454 	iop = (struct iop_softc *)device_parent(&sc->sc_dv);
    455 	im = NULL;
    456 
    457 	if ((rv = dpti_blinkled(sc)) != -1) {
    458 		if (rv != 0) {
    459 			aprint_error_dev(&sc->sc_dv, "adapter blinkled = 0x%02x\n", rv);
    460 			return (EIO);
    461 		}
    462 	}
    463 
    464 	/*
    465 	 * Copy in the message frame header and determine the size of the
    466 	 * full message frame.
    467 	 */
    468 	if ((rv = copyin(data, &mh, sizeof(mh))) != 0) {
    469 		DPRINTF(("%s: message copyin failed\n",
    470 		    device_xname(&sc->sc_dv)));
    471 		return (rv);
    472 	}
    473 
    474 	msgsize = (mh.msgflags >> 14) & ~3;
    475 	if (msgsize < sizeof(mh) || msgsize >= IOP_MAX_MSG_SIZE) {
    476 		DPRINTF(("%s: bad message frame size\n",
    477 		    device_xname(&sc->sc_dv)));
    478 		return (EINVAL);
    479 	}
    480 
    481 	/*
    482 	 * Handle special commands.
    483 	 */
    484 	switch (mh.msgfunc >> 24) {
    485 	case I2O_EXEC_IOP_RESET:
    486 		printf("%s: I2O_EXEC_IOP_RESET not implemented\n",
    487 		    device_xname(&sc->sc_dv));
    488 		return (EOPNOTSUPP);
    489 
    490 	case I2O_EXEC_OUTBOUND_INIT:
    491 		printf("%s: I2O_EXEC_OUTBOUND_INIT not implemented\n",
    492 		    device_xname(&sc->sc_dv));
    493 		return (EOPNOTSUPP);
    494 
    495 	case I2O_EXEC_SYS_TAB_SET:
    496 		printf("%s: I2O_EXEC_SYS_TAB_SET not implemented\n",
    497 		    device_xname(&sc->sc_dv));
    498 		return (EOPNOTSUPP);
    499 
    500 	case I2O_EXEC_STATUS_GET:
    501 		if ((rv = iop_status_get(iop, 0)) == 0)
    502 			rv = copyout(&iop->sc_status, (char *)data + msgsize,
    503 			    sizeof(iop->sc_status));
    504 		return (rv);
    505 	}
    506 
    507 	/*
    508 	 * Copy in the full message frame.
    509 	 */
    510 	if ((rv = copyin(data, mbtmp, msgsize)) != 0) {
    511 		DPRINTF(("%s: full message copyin failed\n",
    512 		    device_xname(&sc->sc_dv)));
    513 		return (rv);
    514 	}
    515 
    516 	/*
    517 	 * Determine the size of the reply frame, and copy it in.
    518 	 */
    519 	if ((rv = copyin((char *)data + msgsize, &rh, sizeof(rh))) != 0) {
    520 		DPRINTF(("%s: reply copyin failed\n",
    521 		    device_xname(&sc->sc_dv)));
    522 		return (rv);
    523 	}
    524 
    525 	repsize = (rh.msgflags >> 14) & ~3;
    526 	if (repsize < sizeof(rh) || repsize >= IOP_MAX_MSG_SIZE) {
    527 		DPRINTF(("%s: bad reply header size\n",
    528 		    device_xname(&sc->sc_dv)));
    529 		return (EINVAL);
    530 	}
    531 
    532 	if ((rv = copyin((char *)data + msgsize, rbtmp, repsize)) != 0) {
    533 		DPRINTF(("%s: reply too large\n", device_xname(&sc->sc_dv)));
    534 		return (rv);
    535 	}
    536 
    537 	/*
    538 	 * If the message has a scatter gather list, it must be comprised of
    539 	 * simple elements.  If any one transfer contains multiple segments,
    540 	 * we allocate a temporary buffer for it; otherwise, the buffer will
    541 	 * be mapped directly.
    542 	 */
    543 	mapped = 0;
    544 	if ((sgoff = ((mh.msgflags >> 4) & 15)) != 0) {
    545 		if ((sgoff + 2) > (msgsize >> 2)) {
    546 			DPRINTF(("%s: invalid message size fields\n",
    547 			    device_xname(&sc->sc_dv)));
    548 			return (EINVAL);
    549 		}
    550 
    551 		memset(bufs, 0, sizeof(bufs));
    552 
    553 		p = mbtmp + sgoff;
    554 		pmax = mbtmp + (msgsize >> 2) - 2;
    555 
    556 		for (nbuf = 0; nbuf < IOP_MAX_MSG_XFERS; nbuf++, p += 2) {
    557 			if (p > pmax) {
    558 				DPRINTF(("%s: invalid SGL (1)\n",
    559 				    device_xname(&sc->sc_dv)));
    560 				goto bad;
    561 			}
    562 
    563 			if ((p[0] & 0x30000000) != I2O_SGL_SIMPLE) {
    564 				DPRINTF(("%s: invalid SGL (2)\n",
    565 				    device_xname(&sc->sc_dv)));
    566 				goto bad;
    567 			}
    568 
    569 			bufs[nbuf].db_out = (p[0] & I2O_SGL_DATA_OUT) != 0;
    570 			bufs[nbuf].db_ptr = NULL;
    571 
    572 			if ((p[0] & I2O_SGL_END_BUFFER) != 0) {
    573 				if ((p[0] & 0x00ffffff) > IOP_MAX_XFER) {
    574 					DPRINTF(("%s: buffer too large\n",
    575 					    device_xname(&sc->sc_dv)));
    576 					goto bad;
    577 				}
    578 
    579 				bufs[nbuf].db_ptr = (void *)p[1];
    580 				bufs[nbuf].db_proc = proc;
    581 				bufs[nbuf].db_size = p[0] & 0x00ffffff;
    582 
    583 				if ((p[0] & I2O_SGL_END) != 0)
    584 					break;
    585 
    586 				continue;
    587 			}
    588 
    589 			/*
    590 			 * The buffer has multiple segments.  Determine the
    591 			 * total size.
    592 			 */
    593 			nfrag = 0;
    594 			sz = 0;
    595 			for (; p <= pmax; p += 2) {
    596 				if (nfrag == DPTI_MAX_SEGS) {
    597 					DPRINTF(("%s: too many segments\n",
    598 					    device_xname(&sc->sc_dv)));
    599 					goto bad;
    600 				}
    601 
    602 				bufs[nbuf].db_frags[nfrag].iov_len =
    603 				    p[0] & 0x00ffffff;
    604 				bufs[nbuf].db_frags[nfrag].iov_base =
    605 				    (void *)p[1];
    606 
    607 				sz += p[0] & 0x00ffffff;
    608 				nfrag++;
    609 
    610 				if ((p[0] & I2O_SGL_END) != 0) {
    611 					if ((p[0] & I2O_SGL_END_BUFFER) == 0) {
    612 						DPRINTF((
    613 						    "%s: invalid SGL (3)\n",
    614 						    device_xname(&sc->sc_dv)));
    615 						goto bad;
    616 					}
    617 					break;
    618 				}
    619 				if ((p[0] & I2O_SGL_END_BUFFER) != 0)
    620 					break;
    621 			}
    622 			bufs[nbuf].db_nfrag = nfrag;
    623 
    624 			if (p > pmax) {
    625 				DPRINTF(("%s: invalid SGL (4)\n",
    626 				    device_xname(&sc->sc_dv)));
    627 				goto bad;
    628 			}
    629 
    630 			if (sz > IOP_MAX_XFER) {
    631 				DPRINTF(("%s: buffer too large\n",
    632 				    device_xname(&sc->sc_dv)));
    633 				goto bad;
    634 			}
    635 
    636 			bufs[nbuf].db_size = sz;
    637 			bufs[nbuf].db_ptr = malloc(sz, M_DEVBUF, M_WAITOK);
    638 			if (bufs[nbuf].db_ptr == NULL) {
    639 				DPRINTF(("%s: allocation failure\n",
    640 				    device_xname(&sc->sc_dv)));
    641 				rv = ENOMEM;
    642 				goto bad;
    643 			}
    644 
    645 			for (i = 0, sz = 0; i < bufs[nbuf].db_nfrag; i++) {
    646 				rv = copyin(bufs[nbuf].db_frags[i].iov_base,
    647 				    (char *)bufs[nbuf].db_ptr + sz,
    648 				    bufs[nbuf].db_frags[i].iov_len);
    649 				if (rv != 0) {
    650 					DPRINTF(("%s: frag copyin\n",
    651 					    device_xname(&sc->sc_dv)));
    652 					goto bad;
    653 				}
    654 				sz += bufs[nbuf].db_frags[i].iov_len;
    655 			}
    656 
    657 			if ((p[0] & I2O_SGL_END) != 0)
    658 				break;
    659 		}
    660 
    661 		if (nbuf == IOP_MAX_MSG_XFERS) {
    662 			DPRINTF(("%s: too many transfers\n",
    663 			    device_xname(&sc->sc_dv)));
    664 			goto bad;
    665 		}
    666 	} else
    667 		nbuf = -1;
    668 
    669 	/*
    670 	 * Allocate a wrapper, and adjust the message header fields to
    671 	 * indicate that no scatter-gather list is currently present.
    672 	 */
    673 
    674 	im = iop_msg_alloc(iop, IM_WAIT | IM_NOSTATUS);
    675 	im->im_rb = (struct i2o_reply *)rbtmp;
    676 	mf = (struct i2o_msg *)mbtmp;
    677 	mf->msgictx = IOP_ICTX;
    678 	mf->msgtctx = im->im_tctx;
    679 
    680 	if (sgoff != 0)
    681 		mf->msgflags = (mf->msgflags & 0xff0f) | (sgoff << 16);
    682 
    683 	/*
    684 	 * Map the data transfer(s).
    685 	 */
    686 	for (i = 0; i <= nbuf; i++) {
    687 		rv = iop_msg_map(iop, im, mbtmp, bufs[i].db_ptr,
    688 		    bufs[i].db_size, bufs[i].db_out, bufs[i].db_proc);
    689 		if (rv != 0) {
    690 			DPRINTF(("%s: msg_map failed, rv = %d\n",
    691 			    device_xname(&sc->sc_dv), rv));
    692 			goto bad;
    693 		}
    694 		mapped = 1;
    695 	}
    696 
    697 	/*
    698 	 * Start the command and sleep until it completes.
    699 	 */
    700 	if ((rv = iop_msg_post(iop, im, mbtmp, 5*60*1000)) != 0)
    701 		goto bad;
    702 
    703 	/*
    704 	 * Copy out the reply frame.
    705 	 */
    706 	if ((rv = copyout(rbtmp, (char *)data + msgsize, repsize)) != 0) {
    707 		DPRINTF(("%s: reply copyout() failed\n",
    708 		    device_xname(&sc->sc_dv)));
    709 	}
    710 
    711  bad:
    712 	/*
    713 	 * Free resources and return to the caller.
    714 	 */
    715 	if (im != NULL) {
    716 		if (mapped)
    717 			iop_msg_unmap(iop, im);
    718 		iop_msg_free(iop, im);
    719 	}
    720 
    721 	for (i = 0; i <= nbuf; i++) {
    722 		if (bufs[i].db_proc != NULL)
    723 			continue;
    724 
    725 		if (!bufs[i].db_out && rv == 0) {
    726 			for (j = 0, sz = 0; j < bufs[i].db_nfrag; j++) {
    727 				rv = copyout((char *)bufs[i].db_ptr + sz,
    728 				    bufs[i].db_frags[j].iov_base,
    729 				    bufs[i].db_frags[j].iov_len);
    730 				if (rv != 0)
    731 					break;
    732 				sz += bufs[i].db_frags[j].iov_len;
    733 			}
    734 		}
    735 
    736 		if (bufs[i].db_ptr != NULL)
    737 			free(bufs[i].db_ptr, M_DEVBUF);
    738 	}
    739 
    740 	return (rv);
    741 }
    742