Home | History | Annotate | Line # | Download | only in i2o
dpti.c revision 1.49
      1 /*	$NetBSD: dpti.c,v 1.49 2017/10/28 04:53:55 riastradh Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 2001, 2007 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This code is derived from software contributed to The NetBSD Foundation
      8  * by Andrew Doran.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  *
     19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     29  * POSSIBILITY OF SUCH DAMAGE.
     30  */
     31 
     32 /*
     33  * Copyright (c) 1996-2000 Distributed Processing Technology Corporation
     34  * Copyright (c) 2000 Adaptec Corporation
     35  * All rights reserved.
     36  *
     37  * TERMS AND CONDITIONS OF USE
     38  *
     39  * Redistribution and use in source form, with or without modification, are
     40  * permitted provided that redistributions of source code must retain the
     41  * above copyright notice, this list of conditions and the following disclaimer.
     42  *
     43  * This software is provided `as is' by Adaptec and any express or implied
     44  * warranties, including, but not limited to, the implied warranties of
     45  * merchantability and fitness for a particular purpose, are disclaimed. In no
     46  * event shall Adaptec be liable for any direct, indirect, incidental, special,
     47  * exemplary or consequential damages (including, but not limited to,
     48  * procurement of substitute goods or services; loss of use, data, or profits;
     49  * or business interruptions) however caused and on any theory of liability,
     50  * whether in contract, strict liability, or tort (including negligence or
     51  * otherwise) arising in any way out of the use of this driver software, even
     52  * if advised of the possibility of such damage.
     53  */
     54 
     55 /*
     56  * Adaptec/DPT I2O control interface.
     57  */
     58 
     59 #include <sys/cdefs.h>
     60 __KERNEL_RCSID(0, "$NetBSD: dpti.c,v 1.49 2017/10/28 04:53:55 riastradh Exp $");
     61 
     62 #include <sys/param.h>
     63 #include <sys/systm.h>
     64 #include <sys/kernel.h>
     65 #include <sys/device.h>
     66 #include <sys/queue.h>
     67 #include <sys/proc.h>
     68 #include <sys/endian.h>
     69 #include <sys/malloc.h>
     70 #include <sys/conf.h>
     71 #include <sys/ioctl.h>
     72 #include <sys/kauth.h>
     73 
     74 #include <sys/bus.h>
     75 #ifdef __i386__
     76 #include <machine/pio.h>
     77 #include <machine/cputypes.h>
     78 #endif
     79 
     80 #include <dev/i2o/i2o.h>
     81 #include <dev/i2o/i2odpt.h>
     82 #include <dev/i2o/iopio.h>
     83 #include <dev/i2o/iopvar.h>
     84 #include <dev/i2o/dptivar.h>
     85 
     86 #include "ioconf.h"
     87 
     88 #ifdef I2ODEBUG
     89 #define	DPRINTF(x)		printf x
     90 #else
     91 #define	DPRINTF(x)
     92 #endif
     93 
     94 static struct dpt_sig dpti_sig = {
     95 	.dsSignature = { 'd', 'P', 't', 'S', 'i', 'G'},
     96 	.dsSigVersion = SIG_VERSION,
     97 #if defined(__i386__)
     98 	.dsProcessorFamily = PROC_INTEL,
     99 #elif defined(__powerpc__)
    100 	.dsProcessorFamily = PROC_POWERPC,
    101 #elif defined(__alpha__)
    102 	.dsProcessorFamily = PROC_ALPHA,
    103 #elif defined(__mips__)
    104 	.dsProcessorFamily = PROC_MIPS,
    105 #elif defined(__sparc64__)
    106 	.dsProcessorFamily = PROC_ULTRASPARC,
    107 #endif
    108 #if defined(__i386__)
    109 	.dsProcessor = PROC_386 | PROC_486 | PROC_PENTIUM | PROC_SEXIUM,
    110 #else
    111 	.dsProcessor = 0,
    112 #endif
    113 	.dsFiletype = FT_HBADRVR,
    114 	.dsFiletypeFlags = 0,
    115 	.dsOEM = OEM_DPT,
    116 	.dsOS = (uint32_t)OS_FREE_BSD,	/* XXX */
    117 	.dsCapabilities = CAP_ABOVE16MB,
    118 	.dsDeviceSupp = DEV_ALL,
    119 	.dsAdapterSupp = ADF_ALL_SC5,
    120 	.dsApplication =  0,
    121 	.dsRequirements = 0,
    122 	.dsVersion = DPTI_VERSION,
    123 	.dsRevision = DPTI_REVISION,
    124 	.dsSubRevision = DPTI_SUBREVISION,
    125 	.dsMonth = DPTI_MONTH,
    126 	.dsDay = DPTI_DAY,
    127 	.dsYear = DPTI_YEAR,
    128 	.dsDescription = { '\0' },		/* Will be filled later */
    129 };
    130 
    131 void	dpti_attach(device_t, device_t, void *);
    132 int	dpti_blinkled(struct dpti_softc *);
    133 int	dpti_ctlrinfo(struct dpti_softc *, int, void *);
    134 int	dpti_match(device_t, cfdata_t, void *);
    135 int	dpti_passthrough(struct dpti_softc *, void *, struct proc *);
    136 int	dpti_sysinfo(struct dpti_softc *, int, void *);
    137 
    138 dev_type_open(dptiopen);
    139 dev_type_ioctl(dptiioctl);
    140 
    141 const struct cdevsw dpti_cdevsw = {
    142 	.d_open = dptiopen,
    143 	.d_close = nullclose,
    144 	.d_read = noread,
    145 	.d_write = nowrite,
    146 	.d_ioctl = dptiioctl,
    147 	.d_stop = nostop,
    148 	.d_tty = notty,
    149 	.d_poll = nopoll,
    150 	.d_mmap = nommap,
    151 	.d_kqfilter = nokqfilter,
    152 	.d_discard = nodiscard,
    153 	.d_flag = D_OTHER,
    154 };
    155 
    156 CFATTACH_DECL_NEW(dpti, sizeof(struct dpti_softc),
    157     dpti_match, dpti_attach, NULL, NULL);
    158 
    159 int
    160 dpti_match(device_t parent, cfdata_t match, void *aux)
    161 {
    162 	struct iop_attach_args *ia;
    163 	struct iop_softc *iop;
    164 
    165 	ia = aux;
    166 	iop = device_private(parent);
    167 
    168 	if (ia->ia_class != I2O_CLASS_ANY || ia->ia_tid != I2O_TID_IOP)
    169 		return (0);
    170 
    171 	if (le16toh(iop->sc_status.orgid) != I2O_ORG_DPT)
    172 		return (0);
    173 
    174 	return (1);
    175 }
    176 
    177 void
    178 dpti_attach(device_t parent, device_t self, void *aux)
    179 {
    180 	struct iop_softc *iop;
    181 	struct dpti_softc *sc;
    182 	struct {
    183 		struct	i2o_param_op_results pr;
    184 		struct	i2o_param_read_results prr;
    185 		struct	i2o_dpt_param_exec_iop_buffers dib;
    186 	} __packed param;
    187 	int rv;
    188 
    189 	sc = device_private(self);
    190 	sc->sc_dev = self;
    191 	iop = device_private(parent);
    192 
    193 	/*
    194 	 * Tell the world what we are.  The description in the signature
    195 	 * must be no more than 46 bytes long (see dptivar.h).
    196 	 */
    197 	printf(": DPT/Adaptec RAID management interface\n");
    198 	snprintf(dpti_sig.dsDescription, sizeof(dpti_sig.dsDescription),
    199 	    "NetBSD %s I2O OSM", osrelease);
    200 
    201 	rv = iop_field_get_all(iop, I2O_TID_IOP,
    202 	    I2O_DPT_PARAM_EXEC_IOP_BUFFERS, &param,
    203 	    sizeof(param), NULL);
    204 	if (rv != 0)
    205 		return;
    206 
    207 	sc->sc_blinkled = le32toh(param.dib.serialoutputoff) + 8;
    208 }
    209 
    210 int
    211 dptiopen(dev_t dev, int flag, int mode,
    212     struct lwp *l)
    213 {
    214 
    215 	if (device_lookup(&dpti_cd, minor(dev)) == NULL)
    216 		return (ENXIO);
    217 
    218 	return (0);
    219 }
    220 
    221 int
    222 dptiioctl(dev_t dev, u_long cmd, void *data, int flag, struct lwp *l)
    223 {
    224 	struct iop_softc *iop;
    225 	struct dpti_softc *sc;
    226 	struct ioctl_pt *pt;
    227 	int i, size, rv, linux;
    228 
    229 	sc = device_lookup_private(&dpti_cd, minor(dev));
    230 	iop = device_private(device_parent(sc->sc_dev));
    231 	rv = 0;
    232 
    233 	if (cmd == PTIOCLINUX) {
    234 		pt = (struct ioctl_pt *)data;
    235 		size = IOCPARM_LEN(pt->com);
    236 		cmd = pt->com & 0xffff;
    237 		data = pt->data;
    238 		linux = 1;
    239 	} else {
    240 		size = IOCPARM_LEN(cmd);
    241 		cmd = cmd & 0xffff;
    242 		linux = 0;
    243 	}
    244 
    245 	switch (cmd) {
    246 	case DPT_SIGNATURE:
    247 		if (size > sizeof(dpti_sig))
    248 			size = sizeof(dpti_sig);
    249 		memcpy(data, &dpti_sig, size);
    250 		break;
    251 
    252 	case DPT_CTRLINFO:
    253 		rv = dpti_ctlrinfo(sc, size, data);
    254 		break;
    255 
    256 	case DPT_SYSINFO:
    257 		rv = dpti_sysinfo(sc, size, data);
    258 		break;
    259 
    260 	case DPT_BLINKLED:
    261 		if ((i = dpti_blinkled(sc)) == -1)
    262 			i = 0;
    263 
    264 		if (size == 0) {
    265 			rv = copyout(&i, *(void **)data, sizeof(i));
    266 			break;
    267 		}
    268 
    269 		*(int *)data = i;
    270 		break;
    271 
    272 	case DPT_TARGET_BUSY:
    273 		/*
    274 		 * XXX This is here to stop linux_machdepioctl() from
    275 		 * whining about an unknown ioctl.
    276 		 */
    277 		rv = EIO;
    278 		break;
    279 
    280 	case DPT_I2OUSRCMD:
    281 		rv = kauth_authorize_device_passthru(l->l_cred, dev,
    282 		    KAUTH_REQ_DEVICE_RAWIO_PASSTHRU_ALL, data);
    283 		if (rv)
    284 			break;
    285 
    286 		mutex_enter(&iop->sc_conflock);
    287 		if (linux) {
    288 			rv = dpti_passthrough(sc, data, l->l_proc);
    289 		} else {
    290 			rv = dpti_passthrough(sc, *(void **)data, l->l_proc);
    291 		}
    292 		mutex_exit(&iop->sc_conflock);
    293 		break;
    294 
    295 	case DPT_I2ORESETCMD:
    296 		printf("%s: I2ORESETCMD not implemented\n",
    297 		    device_xname(sc->sc_dev));
    298 		rv = EOPNOTSUPP;
    299 		break;
    300 
    301 	case DPT_I2ORESCANCMD:
    302 		mutex_enter(&iop->sc_conflock);
    303 		rv = iop_reconfigure(iop, 0);
    304 		mutex_exit(&iop->sc_conflock);
    305 		break;
    306 
    307 	default:
    308 		rv = ENOTTY;
    309 		break;
    310 	}
    311 
    312 	return (rv);
    313 }
    314 
    315 int
    316 dpti_blinkled(struct dpti_softc *sc)
    317 {
    318 	struct iop_softc *iop;
    319 	u_int v;
    320 
    321 	iop = device_private(device_parent(sc->sc_dev));
    322 
    323 	v = bus_space_read_1(iop->sc_iot, iop->sc_ioh, sc->sc_blinkled + 0);
    324 	if (v == 0xbc) {
    325 		v = bus_space_read_1(iop->sc_iot, iop->sc_ioh,
    326 		    sc->sc_blinkled + 1);
    327 		return (v);
    328 	}
    329 
    330 	return (-1);
    331 }
    332 
    333 int
    334 dpti_ctlrinfo(struct dpti_softc *sc, int size, void *data)
    335 {
    336 	struct dpt_ctlrinfo info;
    337 	struct iop_softc *iop;
    338 	int rv, i;
    339 
    340 	iop = device_private(device_parent(sc->sc_dev));
    341 
    342 	memset(&info, 0, sizeof(info));
    343 
    344 	info.length = sizeof(info) - sizeof(u_int16_t);
    345 	info.drvrHBAnum = device_unit(sc->sc_dev);
    346 	info.baseAddr = iop->sc_memaddr;
    347 	if ((i = dpti_blinkled(sc)) == -1)
    348 		i = 0;
    349 	info.blinkState = i;
    350 	info.pciBusNum = iop->sc_pcibus;
    351 	info.pciDeviceNum = iop->sc_pcidev;
    352 	info.hbaFlags = FLG_OSD_PCI_VALID | FLG_OSD_DMA | FLG_OSD_I2O;
    353 	info.Interrupt = 10;			/* XXX */
    354 
    355 	if (size > sizeof(char)) {
    356 		memcpy(data, &info, min(sizeof(info), size));
    357 		rv = 0;
    358 	} else
    359 		rv = copyout(&info, *(void **)data, sizeof(info));
    360 
    361 	return (rv);
    362 }
    363 
    364 int
    365 dpti_sysinfo(struct dpti_softc *sc, int size, void *data)
    366 {
    367 	struct dpt_sysinfo info;
    368 	int rv;
    369 #ifdef __i386__
    370 	int i, j;
    371 #endif
    372 
    373 	memset(&info, 0, sizeof(info));
    374 
    375 #ifdef __i386__
    376 	outb (0x70, 0x12);
    377 	i = inb(0x71);
    378 	j = i >> 4;
    379 	if (i == 0x0f) {
    380 		outb (0x70, 0x19);
    381 		j = inb (0x71);
    382 	}
    383 	info.drive0CMOS = j;
    384 
    385 	j = i & 0x0f;
    386 	if (i == 0x0f) {
    387 		outb (0x70, 0x1a);
    388 		j = inb (0x71);
    389 	}
    390 	info.drive1CMOS = j;
    391 	info.processorFamily = dpti_sig.dsProcessorFamily;
    392 
    393 	/*
    394 	 * Get the conventional memory size from CMOS.
    395 	 */
    396 	outb(0x70, 0x16);
    397 	j = inb(0x71);
    398 	j <<= 8;
    399 	outb(0x70, 0x15);
    400 	j |= inb(0x71);
    401 	info.conventionalMemSize = j;
    402 
    403 	/*
    404 	 * Get the extended memory size from CMOS.
    405 	 */
    406 	outb(0x70, 0x31);
    407 	j = inb(0x71);
    408 	j <<= 8;
    409 	outb(0x70, 0x30);
    410 	j |= inb(0x71);
    411 	info.extendedMemSize = j;
    412 
    413 	switch (cpu_class) {
    414 	case CPUCLASS_386:
    415 		info.processorType = PROC_386;
    416 		break;
    417 	case CPUCLASS_486:
    418 		info.processorType = PROC_486;
    419 		break;
    420 	case CPUCLASS_586:
    421 		info.processorType = PROC_PENTIUM;
    422 		break;
    423 	case CPUCLASS_686:
    424 	default:
    425 		info.processorType = PROC_SEXIUM;
    426 		break;
    427 	}
    428 
    429 	info.flags = SI_CMOS_Valid | SI_BusTypeValid |
    430 	    SI_MemorySizeValid | SI_NO_SmartROM;
    431 #else
    432 	info.flags = SI_BusTypeValid | SI_NO_SmartROM;
    433 #endif
    434 
    435 	info.busType = SI_PCI_BUS;
    436 
    437 	/*
    438 	 * Copy out the info structure to the user.
    439 	 */
    440 	if (size > sizeof(char)) {
    441 		memcpy(data, &info, min(sizeof(info), size));
    442 		rv = 0;
    443 	} else
    444 		rv = copyout(&info, *(void **)data, sizeof(info));
    445 
    446 	return (rv);
    447 }
    448 
    449 int
    450 dpti_passthrough(struct dpti_softc *sc, void *data, struct proc *proc)
    451 {
    452 	struct iop_softc *iop;
    453 	struct i2o_msg mh, *mf;
    454 	struct i2o_reply rh;
    455 	struct iop_msg *im;
    456 	struct dpti_ptbuf bufs[IOP_MAX_MSG_XFERS];
    457 	u_int32_t mbtmp[IOP_MAX_MSG_SIZE / sizeof(u_int32_t)];
    458 	u_int32_t rbtmp[IOP_MAX_MSG_SIZE / sizeof(u_int32_t)];
    459 	int rv, msgsize, repsize, sgoff, i, mapped, nbuf, nfrag, j, sz;
    460 	u_int32_t *p, *pmax;
    461 
    462 	iop = device_private(device_parent(sc->sc_dev));
    463 	im = NULL;
    464 
    465 	if ((rv = dpti_blinkled(sc)) != -1) {
    466 		if (rv != 0) {
    467 			aprint_error_dev(sc->sc_dev, "adapter blinkled = 0x%02x\n", rv);
    468 			return (EIO);
    469 		}
    470 	}
    471 
    472 	/*
    473 	 * Copy in the message frame header and determine the size of the
    474 	 * full message frame.
    475 	 */
    476 	if ((rv = copyin(data, &mh, sizeof(mh))) != 0) {
    477 		DPRINTF(("%s: message copyin failed\n",
    478 		    device_xname(sc->sc_dev)));
    479 		return (rv);
    480 	}
    481 
    482 	msgsize = (mh.msgflags >> 14) & ~3;
    483 	if (msgsize < sizeof(mh) || msgsize >= IOP_MAX_MSG_SIZE) {
    484 		DPRINTF(("%s: bad message frame size\n",
    485 		    device_xname(sc->sc_dev)));
    486 		return (EINVAL);
    487 	}
    488 
    489 	/*
    490 	 * Handle special commands.
    491 	 */
    492 	switch (mh.msgfunc >> 24) {
    493 	case I2O_EXEC_IOP_RESET:
    494 		printf("%s: I2O_EXEC_IOP_RESET not implemented\n",
    495 		    device_xname(sc->sc_dev));
    496 		return (EOPNOTSUPP);
    497 
    498 	case I2O_EXEC_OUTBOUND_INIT:
    499 		printf("%s: I2O_EXEC_OUTBOUND_INIT not implemented\n",
    500 		    device_xname(sc->sc_dev));
    501 		return (EOPNOTSUPP);
    502 
    503 	case I2O_EXEC_SYS_TAB_SET:
    504 		printf("%s: I2O_EXEC_SYS_TAB_SET not implemented\n",
    505 		    device_xname(sc->sc_dev));
    506 		return (EOPNOTSUPP);
    507 
    508 	case I2O_EXEC_STATUS_GET:
    509 		if ((rv = iop_status_get(iop, 0)) == 0)
    510 			rv = copyout(&iop->sc_status, (char *)data + msgsize,
    511 			    sizeof(iop->sc_status));
    512 		return (rv);
    513 	}
    514 
    515 	/*
    516 	 * Copy in the full message frame.
    517 	 */
    518 	if ((rv = copyin(data, mbtmp, msgsize)) != 0) {
    519 		DPRINTF(("%s: full message copyin failed\n",
    520 		    device_xname(sc->sc_dev)));
    521 		return (rv);
    522 	}
    523 
    524 	/*
    525 	 * Determine the size of the reply frame, and copy it in.
    526 	 */
    527 	if ((rv = copyin((char *)data + msgsize, &rh, sizeof(rh))) != 0) {
    528 		DPRINTF(("%s: reply copyin failed\n",
    529 		    device_xname(sc->sc_dev)));
    530 		return (rv);
    531 	}
    532 
    533 	repsize = (rh.msgflags >> 14) & ~3;
    534 	if (repsize < sizeof(rh) || repsize >= IOP_MAX_MSG_SIZE) {
    535 		DPRINTF(("%s: bad reply header size\n",
    536 		    device_xname(sc->sc_dev)));
    537 		return (EINVAL);
    538 	}
    539 
    540 	if ((rv = copyin((char *)data + msgsize, rbtmp, repsize)) != 0) {
    541 		DPRINTF(("%s: reply too large\n", device_xname(sc->sc_dev)));
    542 		return (rv);
    543 	}
    544 
    545 	/*
    546 	 * If the message has a scatter gather list, it must be comprised of
    547 	 * simple elements.  If any one transfer contains multiple segments,
    548 	 * we allocate a temporary buffer for it; otherwise, the buffer will
    549 	 * be mapped directly.
    550 	 */
    551 	mapped = 0;
    552 	if ((sgoff = ((mh.msgflags >> 4) & 15)) != 0) {
    553 		if ((sgoff + 2) > (msgsize >> 2)) {
    554 			DPRINTF(("%s: invalid message size fields\n",
    555 			    device_xname(sc->sc_dev)));
    556 			return (EINVAL);
    557 		}
    558 
    559 		memset(bufs, 0, sizeof(bufs));
    560 
    561 		p = mbtmp + sgoff;
    562 		pmax = mbtmp + (msgsize >> 2) - 2;
    563 
    564 		for (nbuf = 0; nbuf < IOP_MAX_MSG_XFERS; nbuf++, p += 2) {
    565 			if (p > pmax) {
    566 				DPRINTF(("%s: invalid SGL (1)\n",
    567 				    device_xname(sc->sc_dev)));
    568 				goto bad;
    569 			}
    570 
    571 			if ((p[0] & 0x30000000) != I2O_SGL_SIMPLE) {
    572 				DPRINTF(("%s: invalid SGL (2)\n",
    573 				    device_xname(sc->sc_dev)));
    574 				goto bad;
    575 			}
    576 
    577 			bufs[nbuf].db_out = (p[0] & I2O_SGL_DATA_OUT) != 0;
    578 			bufs[nbuf].db_ptr = NULL;
    579 
    580 			if ((p[0] & I2O_SGL_END_BUFFER) != 0) {
    581 				if ((p[0] & 0x00ffffff) > IOP_MAX_XFER) {
    582 					DPRINTF(("%s: buffer too large\n",
    583 					    device_xname(sc->sc_dev)));
    584 					goto bad;
    585 				}
    586 
    587 				// XXX: 32 bits
    588 				bufs[nbuf].db_ptr = (void *)(intptr_t)p[1];
    589 				bufs[nbuf].db_proc = proc;
    590 				bufs[nbuf].db_size = p[0] & 0x00ffffff;
    591 
    592 				if ((p[0] & I2O_SGL_END) != 0)
    593 					break;
    594 
    595 				continue;
    596 			}
    597 
    598 			/*
    599 			 * The buffer has multiple segments.  Determine the
    600 			 * total size.
    601 			 */
    602 			nfrag = 0;
    603 			sz = 0;
    604 			for (; p <= pmax; p += 2) {
    605 				if (nfrag == DPTI_MAX_SEGS) {
    606 					DPRINTF(("%s: too many segments\n",
    607 					    device_xname(sc->sc_dev)));
    608 					goto bad;
    609 				}
    610 
    611 				bufs[nbuf].db_frags[nfrag].iov_len =
    612 				    p[0] & 0x00ffffff;
    613 				// XXX: 32 bits
    614 				bufs[nbuf].db_frags[nfrag].iov_base =
    615 				    (void *)(intptr_t)p[1];
    616 
    617 				sz += p[0] & 0x00ffffff;
    618 				nfrag++;
    619 
    620 				if ((p[0] & I2O_SGL_END) != 0) {
    621 					if ((p[0] & I2O_SGL_END_BUFFER) == 0) {
    622 						DPRINTF((
    623 						    "%s: invalid SGL (3)\n",
    624 						    device_xname(sc->sc_dev)));
    625 						goto bad;
    626 					}
    627 					break;
    628 				}
    629 				if ((p[0] & I2O_SGL_END_BUFFER) != 0)
    630 					break;
    631 			}
    632 			bufs[nbuf].db_nfrag = nfrag;
    633 
    634 			if (p > pmax) {
    635 				DPRINTF(("%s: invalid SGL (4)\n",
    636 				    device_xname(sc->sc_dev)));
    637 				goto bad;
    638 			}
    639 
    640 			if (sz > IOP_MAX_XFER) {
    641 				DPRINTF(("%s: buffer too large\n",
    642 				    device_xname(sc->sc_dev)));
    643 				goto bad;
    644 			}
    645 
    646 			bufs[nbuf].db_size = sz;
    647 			bufs[nbuf].db_ptr = malloc(sz, M_DEVBUF, M_WAITOK);
    648 			if (bufs[nbuf].db_ptr == NULL) {
    649 				DPRINTF(("%s: allocation failure\n",
    650 				    device_xname(sc->sc_dev)));
    651 				rv = ENOMEM;
    652 				goto bad;
    653 			}
    654 
    655 			for (i = 0, sz = 0; i < bufs[nbuf].db_nfrag; i++) {
    656 				rv = copyin(bufs[nbuf].db_frags[i].iov_base,
    657 				    (char *)bufs[nbuf].db_ptr + sz,
    658 				    bufs[nbuf].db_frags[i].iov_len);
    659 				if (rv != 0) {
    660 					DPRINTF(("%s: frag copyin\n",
    661 					    device_xname(sc->sc_dev)));
    662 					goto bad;
    663 				}
    664 				sz += bufs[nbuf].db_frags[i].iov_len;
    665 			}
    666 
    667 			if ((p[0] & I2O_SGL_END) != 0)
    668 				break;
    669 		}
    670 
    671 		if (nbuf == IOP_MAX_MSG_XFERS) {
    672 			DPRINTF(("%s: too many transfers\n",
    673 			    device_xname(sc->sc_dev)));
    674 			goto bad;
    675 		}
    676 	} else
    677 		nbuf = -1;
    678 
    679 	/*
    680 	 * Allocate a wrapper, and adjust the message header fields to
    681 	 * indicate that no scatter-gather list is currently present.
    682 	 */
    683 
    684 	im = iop_msg_alloc(iop, IM_WAIT | IM_NOSTATUS);
    685 	im->im_rb = (struct i2o_reply *)rbtmp;
    686 	mf = (struct i2o_msg *)mbtmp;
    687 	mf->msgictx = IOP_ICTX;
    688 	mf->msgtctx = im->im_tctx;
    689 
    690 	if (sgoff != 0)
    691 		mf->msgflags = (mf->msgflags & 0xff0f) | (sgoff << 16);
    692 
    693 	/*
    694 	 * Map the data transfer(s).
    695 	 */
    696 	for (i = 0; i <= nbuf; i++) {
    697 		rv = iop_msg_map(iop, im, mbtmp, bufs[i].db_ptr,
    698 		    bufs[i].db_size, bufs[i].db_out, bufs[i].db_proc);
    699 		if (rv != 0) {
    700 			DPRINTF(("%s: msg_map failed, rv = %d\n",
    701 			    device_xname(sc->sc_dev), rv));
    702 			goto bad;
    703 		}
    704 		mapped = 1;
    705 	}
    706 
    707 	/*
    708 	 * Start the command and sleep until it completes.
    709 	 */
    710 	if ((rv = iop_msg_post(iop, im, mbtmp, 5*60*1000)) != 0)
    711 		goto bad;
    712 
    713 	/*
    714 	 * Copy out the reply frame.
    715 	 */
    716 	if ((rv = copyout(rbtmp, (char *)data + msgsize, repsize)) != 0) {
    717 		DPRINTF(("%s: reply copyout() failed\n",
    718 		    device_xname(sc->sc_dev)));
    719 	}
    720 
    721  bad:
    722 	/*
    723 	 * Free resources and return to the caller.
    724 	 */
    725 	if (im != NULL) {
    726 		if (mapped)
    727 			iop_msg_unmap(iop, im);
    728 		iop_msg_free(iop, im);
    729 	}
    730 
    731 	for (i = 0; i <= nbuf; i++) {
    732 		if (bufs[i].db_proc != NULL)
    733 			continue;
    734 
    735 		if (!bufs[i].db_out && rv == 0) {
    736 			for (j = 0, sz = 0; j < bufs[i].db_nfrag; j++) {
    737 				rv = copyout((char *)bufs[i].db_ptr + sz,
    738 				    bufs[i].db_frags[j].iov_base,
    739 				    bufs[i].db_frags[j].iov_len);
    740 				if (rv != 0)
    741 					break;
    742 				sz += bufs[i].db_frags[j].iov_len;
    743 			}
    744 		}
    745 
    746 		if (bufs[i].db_ptr != NULL)
    747 			free(bufs[i].db_ptr, M_DEVBUF);
    748 	}
    749 
    750 	return (rv);
    751 }
    752