xref: /netbsd/sys/dev/i2o/dpti.c (revision a8a5c538)
1 /*	$NetBSD: dpti.c,v 1.50 2018/09/03 16:29:31 riastradh Exp $	*/
2 
3 /*-
4  * Copyright (c) 2001, 2007 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Andrew Doran.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29  * POSSIBILITY OF SUCH DAMAGE.
30  */
31 
32 /*
33  * Copyright (c) 1996-2000 Distributed Processing Technology Corporation
34  * Copyright (c) 2000 Adaptec Corporation
35  * All rights reserved.
36  *
37  * TERMS AND CONDITIONS OF USE
38  *
39  * Redistribution and use in source form, with or without modification, are
40  * permitted provided that redistributions of source code must retain the
41  * above copyright notice, this list of conditions and the following disclaimer.
42  *
43  * This software is provided `as is' by Adaptec and any express or implied
44  * warranties, including, but not limited to, the implied warranties of
45  * merchantability and fitness for a particular purpose, are disclaimed. In no
46  * event shall Adaptec be liable for any direct, indirect, incidental, special,
47  * exemplary or consequential damages (including, but not limited to,
48  * procurement of substitute goods or services; loss of use, data, or profits;
49  * or business interruptions) however caused and on any theory of liability,
50  * whether in contract, strict liability, or tort (including negligence or
51  * otherwise) arising in any way out of the use of this driver software, even
52  * if advised of the possibility of such damage.
53  */
54 
55 /*
56  * Adaptec/DPT I2O control interface.
57  */
58 
59 #include <sys/cdefs.h>
60 __KERNEL_RCSID(0, "$NetBSD: dpti.c,v 1.50 2018/09/03 16:29:31 riastradh Exp $");
61 
62 #include <sys/param.h>
63 #include <sys/systm.h>
64 #include <sys/kernel.h>
65 #include <sys/device.h>
66 #include <sys/queue.h>
67 #include <sys/proc.h>
68 #include <sys/endian.h>
69 #include <sys/malloc.h>
70 #include <sys/conf.h>
71 #include <sys/ioctl.h>
72 #include <sys/kauth.h>
73 
74 #include <sys/bus.h>
75 #ifdef __i386__
76 #include <machine/pio.h>
77 #include <machine/cputypes.h>
78 #endif
79 
80 #include <dev/i2o/i2o.h>
81 #include <dev/i2o/i2odpt.h>
82 #include <dev/i2o/iopio.h>
83 #include <dev/i2o/iopvar.h>
84 #include <dev/i2o/dptivar.h>
85 
86 #include "ioconf.h"
87 
88 #ifdef I2ODEBUG
89 #define	DPRINTF(x)		printf x
90 #else
91 #define	DPRINTF(x)
92 #endif
93 
94 static struct dpt_sig dpti_sig = {
95 	.dsSignature = { 'd', 'P', 't', 'S', 'i', 'G'},
96 	.dsSigVersion = SIG_VERSION,
97 #if defined(__i386__)
98 	.dsProcessorFamily = PROC_INTEL,
99 #elif defined(__powerpc__)
100 	.dsProcessorFamily = PROC_POWERPC,
101 #elif defined(__alpha__)
102 	.dsProcessorFamily = PROC_ALPHA,
103 #elif defined(__mips__)
104 	.dsProcessorFamily = PROC_MIPS,
105 #elif defined(__sparc64__)
106 	.dsProcessorFamily = PROC_ULTRASPARC,
107 #endif
108 #if defined(__i386__)
109 	.dsProcessor = PROC_386 | PROC_486 | PROC_PENTIUM | PROC_SEXIUM,
110 #else
111 	.dsProcessor = 0,
112 #endif
113 	.dsFiletype = FT_HBADRVR,
114 	.dsFiletypeFlags = 0,
115 	.dsOEM = OEM_DPT,
116 	.dsOS = (uint32_t)OS_FREE_BSD,	/* XXX */
117 	.dsCapabilities = CAP_ABOVE16MB,
118 	.dsDeviceSupp = DEV_ALL,
119 	.dsAdapterSupp = ADF_ALL_SC5,
120 	.dsApplication =  0,
121 	.dsRequirements = 0,
122 	.dsVersion = DPTI_VERSION,
123 	.dsRevision = DPTI_REVISION,
124 	.dsSubRevision = DPTI_SUBREVISION,
125 	.dsMonth = DPTI_MONTH,
126 	.dsDay = DPTI_DAY,
127 	.dsYear = DPTI_YEAR,
128 	.dsDescription = { '\0' },		/* Will be filled later */
129 };
130 
131 void	dpti_attach(device_t, device_t, void *);
132 int	dpti_blinkled(struct dpti_softc *);
133 int	dpti_ctlrinfo(struct dpti_softc *, int, void *);
134 int	dpti_match(device_t, cfdata_t, void *);
135 int	dpti_passthrough(struct dpti_softc *, void *, struct proc *);
136 int	dpti_sysinfo(struct dpti_softc *, int, void *);
137 
138 dev_type_open(dptiopen);
139 dev_type_ioctl(dptiioctl);
140 
141 const struct cdevsw dpti_cdevsw = {
142 	.d_open = dptiopen,
143 	.d_close = nullclose,
144 	.d_read = noread,
145 	.d_write = nowrite,
146 	.d_ioctl = dptiioctl,
147 	.d_stop = nostop,
148 	.d_tty = notty,
149 	.d_poll = nopoll,
150 	.d_mmap = nommap,
151 	.d_kqfilter = nokqfilter,
152 	.d_discard = nodiscard,
153 	.d_flag = D_OTHER,
154 };
155 
156 CFATTACH_DECL_NEW(dpti, sizeof(struct dpti_softc),
157     dpti_match, dpti_attach, NULL, NULL);
158 
159 int
dpti_match(device_t parent,cfdata_t match,void * aux)160 dpti_match(device_t parent, cfdata_t match, void *aux)
161 {
162 	struct iop_attach_args *ia;
163 	struct iop_softc *iop;
164 
165 	ia = aux;
166 	iop = device_private(parent);
167 
168 	if (ia->ia_class != I2O_CLASS_ANY || ia->ia_tid != I2O_TID_IOP)
169 		return (0);
170 
171 	if (le16toh(iop->sc_status.orgid) != I2O_ORG_DPT)
172 		return (0);
173 
174 	return (1);
175 }
176 
177 void
dpti_attach(device_t parent,device_t self,void * aux)178 dpti_attach(device_t parent, device_t self, void *aux)
179 {
180 	struct iop_softc *iop;
181 	struct dpti_softc *sc;
182 	struct {
183 		struct	i2o_param_op_results pr;
184 		struct	i2o_param_read_results prr;
185 		struct	i2o_dpt_param_exec_iop_buffers dib;
186 	} __packed param;
187 	int rv;
188 
189 	sc = device_private(self);
190 	sc->sc_dev = self;
191 	iop = device_private(parent);
192 
193 	/*
194 	 * Tell the world what we are.  The description in the signature
195 	 * must be no more than 46 bytes long (see dptivar.h).
196 	 */
197 	printf(": DPT/Adaptec RAID management interface\n");
198 	snprintf(dpti_sig.dsDescription, sizeof(dpti_sig.dsDescription),
199 	    "NetBSD %s I2O OSM", osrelease);
200 
201 	rv = iop_field_get_all(iop, I2O_TID_IOP,
202 	    I2O_DPT_PARAM_EXEC_IOP_BUFFERS, &param,
203 	    sizeof(param), NULL);
204 	if (rv != 0)
205 		return;
206 
207 	sc->sc_blinkled = le32toh(param.dib.serialoutputoff) + 8;
208 }
209 
210 int
dptiopen(dev_t dev,int flag,int mode,struct lwp * l)211 dptiopen(dev_t dev, int flag, int mode,
212     struct lwp *l)
213 {
214 
215 	if (device_lookup(&dpti_cd, minor(dev)) == NULL)
216 		return (ENXIO);
217 
218 	return (0);
219 }
220 
221 int
dptiioctl(dev_t dev,u_long cmd,void * data,int flag,struct lwp * l)222 dptiioctl(dev_t dev, u_long cmd, void *data, int flag, struct lwp *l)
223 {
224 	struct iop_softc *iop;
225 	struct dpti_softc *sc;
226 	struct ioctl_pt *pt;
227 	int i, size, rv, linux;
228 
229 	sc = device_lookup_private(&dpti_cd, minor(dev));
230 	iop = device_private(device_parent(sc->sc_dev));
231 	rv = 0;
232 
233 	if (cmd == PTIOCLINUX) {
234 		pt = (struct ioctl_pt *)data;
235 		size = IOCPARM_LEN(pt->com);
236 		cmd = pt->com & 0xffff;
237 		data = pt->data;
238 		linux = 1;
239 	} else {
240 		size = IOCPARM_LEN(cmd);
241 		cmd = cmd & 0xffff;
242 		linux = 0;
243 	}
244 
245 	switch (cmd) {
246 	case DPT_SIGNATURE:
247 		if (size > sizeof(dpti_sig))
248 			size = sizeof(dpti_sig);
249 		memcpy(data, &dpti_sig, size);
250 		break;
251 
252 	case DPT_CTRLINFO:
253 		rv = dpti_ctlrinfo(sc, size, data);
254 		break;
255 
256 	case DPT_SYSINFO:
257 		rv = dpti_sysinfo(sc, size, data);
258 		break;
259 
260 	case DPT_BLINKLED:
261 		if ((i = dpti_blinkled(sc)) == -1)
262 			i = 0;
263 
264 		if (size == 0) {
265 			rv = copyout(&i, *(void **)data, sizeof(i));
266 			break;
267 		}
268 
269 		*(int *)data = i;
270 		break;
271 
272 	case DPT_TARGET_BUSY:
273 		/*
274 		 * XXX This is here to stop linux_machdepioctl() from
275 		 * whining about an unknown ioctl.
276 		 */
277 		rv = EIO;
278 		break;
279 
280 	case DPT_I2OUSRCMD:
281 		rv = kauth_authorize_device_passthru(l->l_cred, dev,
282 		    KAUTH_REQ_DEVICE_RAWIO_PASSTHRU_ALL, data);
283 		if (rv)
284 			break;
285 
286 		mutex_enter(&iop->sc_conflock);
287 		if (linux) {
288 			rv = dpti_passthrough(sc, data, l->l_proc);
289 		} else {
290 			rv = dpti_passthrough(sc, *(void **)data, l->l_proc);
291 		}
292 		mutex_exit(&iop->sc_conflock);
293 		break;
294 
295 	case DPT_I2ORESETCMD:
296 		printf("%s: I2ORESETCMD not implemented\n",
297 		    device_xname(sc->sc_dev));
298 		rv = EOPNOTSUPP;
299 		break;
300 
301 	case DPT_I2ORESCANCMD:
302 		mutex_enter(&iop->sc_conflock);
303 		rv = iop_reconfigure(iop, 0);
304 		mutex_exit(&iop->sc_conflock);
305 		break;
306 
307 	default:
308 		rv = ENOTTY;
309 		break;
310 	}
311 
312 	return (rv);
313 }
314 
315 int
dpti_blinkled(struct dpti_softc * sc)316 dpti_blinkled(struct dpti_softc *sc)
317 {
318 	struct iop_softc *iop;
319 	u_int v;
320 
321 	iop = device_private(device_parent(sc->sc_dev));
322 
323 	v = bus_space_read_1(iop->sc_iot, iop->sc_ioh, sc->sc_blinkled + 0);
324 	if (v == 0xbc) {
325 		v = bus_space_read_1(iop->sc_iot, iop->sc_ioh,
326 		    sc->sc_blinkled + 1);
327 		return (v);
328 	}
329 
330 	return (-1);
331 }
332 
333 int
dpti_ctlrinfo(struct dpti_softc * sc,int size,void * data)334 dpti_ctlrinfo(struct dpti_softc *sc, int size, void *data)
335 {
336 	struct dpt_ctlrinfo info;
337 	struct iop_softc *iop;
338 	int rv, i;
339 
340 	iop = device_private(device_parent(sc->sc_dev));
341 
342 	memset(&info, 0, sizeof(info));
343 
344 	info.length = sizeof(info) - sizeof(u_int16_t);
345 	info.drvrHBAnum = device_unit(sc->sc_dev);
346 	info.baseAddr = iop->sc_memaddr;
347 	if ((i = dpti_blinkled(sc)) == -1)
348 		i = 0;
349 	info.blinkState = i;
350 	info.pciBusNum = iop->sc_pcibus;
351 	info.pciDeviceNum = iop->sc_pcidev;
352 	info.hbaFlags = FLG_OSD_PCI_VALID | FLG_OSD_DMA | FLG_OSD_I2O;
353 	info.Interrupt = 10;			/* XXX */
354 
355 	if (size > sizeof(char)) {
356 		memcpy(data, &info, uimin(sizeof(info), size));
357 		rv = 0;
358 	} else
359 		rv = copyout(&info, *(void **)data, sizeof(info));
360 
361 	return (rv);
362 }
363 
364 int
dpti_sysinfo(struct dpti_softc * sc,int size,void * data)365 dpti_sysinfo(struct dpti_softc *sc, int size, void *data)
366 {
367 	struct dpt_sysinfo info;
368 	int rv;
369 #ifdef __i386__
370 	int i, j;
371 #endif
372 
373 	memset(&info, 0, sizeof(info));
374 
375 #ifdef __i386__
376 	outb (0x70, 0x12);
377 	i = inb(0x71);
378 	j = i >> 4;
379 	if (i == 0x0f) {
380 		outb (0x70, 0x19);
381 		j = inb (0x71);
382 	}
383 	info.drive0CMOS = j;
384 
385 	j = i & 0x0f;
386 	if (i == 0x0f) {
387 		outb (0x70, 0x1a);
388 		j = inb (0x71);
389 	}
390 	info.drive1CMOS = j;
391 	info.processorFamily = dpti_sig.dsProcessorFamily;
392 
393 	/*
394 	 * Get the conventional memory size from CMOS.
395 	 */
396 	outb(0x70, 0x16);
397 	j = inb(0x71);
398 	j <<= 8;
399 	outb(0x70, 0x15);
400 	j |= inb(0x71);
401 	info.conventionalMemSize = j;
402 
403 	/*
404 	 * Get the extended memory size from CMOS.
405 	 */
406 	outb(0x70, 0x31);
407 	j = inb(0x71);
408 	j <<= 8;
409 	outb(0x70, 0x30);
410 	j |= inb(0x71);
411 	info.extendedMemSize = j;
412 
413 	switch (cpu_class) {
414 	case CPUCLASS_386:
415 		info.processorType = PROC_386;
416 		break;
417 	case CPUCLASS_486:
418 		info.processorType = PROC_486;
419 		break;
420 	case CPUCLASS_586:
421 		info.processorType = PROC_PENTIUM;
422 		break;
423 	case CPUCLASS_686:
424 	default:
425 		info.processorType = PROC_SEXIUM;
426 		break;
427 	}
428 
429 	info.flags = SI_CMOS_Valid | SI_BusTypeValid |
430 	    SI_MemorySizeValid | SI_NO_SmartROM;
431 #else
432 	info.flags = SI_BusTypeValid | SI_NO_SmartROM;
433 #endif
434 
435 	info.busType = SI_PCI_BUS;
436 
437 	/*
438 	 * Copy out the info structure to the user.
439 	 */
440 	if (size > sizeof(char)) {
441 		memcpy(data, &info, uimin(sizeof(info), size));
442 		rv = 0;
443 	} else
444 		rv = copyout(&info, *(void **)data, sizeof(info));
445 
446 	return (rv);
447 }
448 
449 int
dpti_passthrough(struct dpti_softc * sc,void * data,struct proc * proc)450 dpti_passthrough(struct dpti_softc *sc, void *data, struct proc *proc)
451 {
452 	struct iop_softc *iop;
453 	struct i2o_msg mh, *mf;
454 	struct i2o_reply rh;
455 	struct iop_msg *im;
456 	struct dpti_ptbuf bufs[IOP_MAX_MSG_XFERS];
457 	u_int32_t mbtmp[IOP_MAX_MSG_SIZE / sizeof(u_int32_t)];
458 	u_int32_t rbtmp[IOP_MAX_MSG_SIZE / sizeof(u_int32_t)];
459 	int rv, msgsize, repsize, sgoff, i, mapped, nbuf, nfrag, j, sz;
460 	u_int32_t *p, *pmax;
461 
462 	iop = device_private(device_parent(sc->sc_dev));
463 	im = NULL;
464 
465 	if ((rv = dpti_blinkled(sc)) != -1) {
466 		if (rv != 0) {
467 			aprint_error_dev(sc->sc_dev, "adapter blinkled = 0x%02x\n", rv);
468 			return (EIO);
469 		}
470 	}
471 
472 	/*
473 	 * Copy in the message frame header and determine the size of the
474 	 * full message frame.
475 	 */
476 	if ((rv = copyin(data, &mh, sizeof(mh))) != 0) {
477 		DPRINTF(("%s: message copyin failed\n",
478 		    device_xname(sc->sc_dev)));
479 		return (rv);
480 	}
481 
482 	msgsize = (mh.msgflags >> 14) & ~3;
483 	if (msgsize < sizeof(mh) || msgsize >= IOP_MAX_MSG_SIZE) {
484 		DPRINTF(("%s: bad message frame size\n",
485 		    device_xname(sc->sc_dev)));
486 		return (EINVAL);
487 	}
488 
489 	/*
490 	 * Handle special commands.
491 	 */
492 	switch (mh.msgfunc >> 24) {
493 	case I2O_EXEC_IOP_RESET:
494 		printf("%s: I2O_EXEC_IOP_RESET not implemented\n",
495 		    device_xname(sc->sc_dev));
496 		return (EOPNOTSUPP);
497 
498 	case I2O_EXEC_OUTBOUND_INIT:
499 		printf("%s: I2O_EXEC_OUTBOUND_INIT not implemented\n",
500 		    device_xname(sc->sc_dev));
501 		return (EOPNOTSUPP);
502 
503 	case I2O_EXEC_SYS_TAB_SET:
504 		printf("%s: I2O_EXEC_SYS_TAB_SET not implemented\n",
505 		    device_xname(sc->sc_dev));
506 		return (EOPNOTSUPP);
507 
508 	case I2O_EXEC_STATUS_GET:
509 		if ((rv = iop_status_get(iop, 0)) == 0)
510 			rv = copyout(&iop->sc_status, (char *)data + msgsize,
511 			    sizeof(iop->sc_status));
512 		return (rv);
513 	}
514 
515 	/*
516 	 * Copy in the full message frame.
517 	 */
518 	if ((rv = copyin(data, mbtmp, msgsize)) != 0) {
519 		DPRINTF(("%s: full message copyin failed\n",
520 		    device_xname(sc->sc_dev)));
521 		return (rv);
522 	}
523 
524 	/*
525 	 * Determine the size of the reply frame, and copy it in.
526 	 */
527 	if ((rv = copyin((char *)data + msgsize, &rh, sizeof(rh))) != 0) {
528 		DPRINTF(("%s: reply copyin failed\n",
529 		    device_xname(sc->sc_dev)));
530 		return (rv);
531 	}
532 
533 	repsize = (rh.msgflags >> 14) & ~3;
534 	if (repsize < sizeof(rh) || repsize >= IOP_MAX_MSG_SIZE) {
535 		DPRINTF(("%s: bad reply header size\n",
536 		    device_xname(sc->sc_dev)));
537 		return (EINVAL);
538 	}
539 
540 	if ((rv = copyin((char *)data + msgsize, rbtmp, repsize)) != 0) {
541 		DPRINTF(("%s: reply too large\n", device_xname(sc->sc_dev)));
542 		return (rv);
543 	}
544 
545 	/*
546 	 * If the message has a scatter gather list, it must be comprised of
547 	 * simple elements.  If any one transfer contains multiple segments,
548 	 * we allocate a temporary buffer for it; otherwise, the buffer will
549 	 * be mapped directly.
550 	 */
551 	mapped = 0;
552 	if ((sgoff = ((mh.msgflags >> 4) & 15)) != 0) {
553 		if ((sgoff + 2) > (msgsize >> 2)) {
554 			DPRINTF(("%s: invalid message size fields\n",
555 			    device_xname(sc->sc_dev)));
556 			return (EINVAL);
557 		}
558 
559 		memset(bufs, 0, sizeof(bufs));
560 
561 		p = mbtmp + sgoff;
562 		pmax = mbtmp + (msgsize >> 2) - 2;
563 
564 		for (nbuf = 0; nbuf < IOP_MAX_MSG_XFERS; nbuf++, p += 2) {
565 			if (p > pmax) {
566 				DPRINTF(("%s: invalid SGL (1)\n",
567 				    device_xname(sc->sc_dev)));
568 				goto bad;
569 			}
570 
571 			if ((p[0] & 0x30000000) != I2O_SGL_SIMPLE) {
572 				DPRINTF(("%s: invalid SGL (2)\n",
573 				    device_xname(sc->sc_dev)));
574 				goto bad;
575 			}
576 
577 			bufs[nbuf].db_out = (p[0] & I2O_SGL_DATA_OUT) != 0;
578 			bufs[nbuf].db_ptr = NULL;
579 
580 			if ((p[0] & I2O_SGL_END_BUFFER) != 0) {
581 				if ((p[0] & 0x00ffffff) > IOP_MAX_XFER) {
582 					DPRINTF(("%s: buffer too large\n",
583 					    device_xname(sc->sc_dev)));
584 					goto bad;
585 				}
586 
587 				// XXX: 32 bits
588 				bufs[nbuf].db_ptr = (void *)(intptr_t)p[1];
589 				bufs[nbuf].db_proc = proc;
590 				bufs[nbuf].db_size = p[0] & 0x00ffffff;
591 
592 				if ((p[0] & I2O_SGL_END) != 0)
593 					break;
594 
595 				continue;
596 			}
597 
598 			/*
599 			 * The buffer has multiple segments.  Determine the
600 			 * total size.
601 			 */
602 			nfrag = 0;
603 			sz = 0;
604 			for (; p <= pmax; p += 2) {
605 				if (nfrag == DPTI_MAX_SEGS) {
606 					DPRINTF(("%s: too many segments\n",
607 					    device_xname(sc->sc_dev)));
608 					goto bad;
609 				}
610 
611 				bufs[nbuf].db_frags[nfrag].iov_len =
612 				    p[0] & 0x00ffffff;
613 				// XXX: 32 bits
614 				bufs[nbuf].db_frags[nfrag].iov_base =
615 				    (void *)(intptr_t)p[1];
616 
617 				sz += p[0] & 0x00ffffff;
618 				nfrag++;
619 
620 				if ((p[0] & I2O_SGL_END) != 0) {
621 					if ((p[0] & I2O_SGL_END_BUFFER) == 0) {
622 						DPRINTF((
623 						    "%s: invalid SGL (3)\n",
624 						    device_xname(sc->sc_dev)));
625 						goto bad;
626 					}
627 					break;
628 				}
629 				if ((p[0] & I2O_SGL_END_BUFFER) != 0)
630 					break;
631 			}
632 			bufs[nbuf].db_nfrag = nfrag;
633 
634 			if (p > pmax) {
635 				DPRINTF(("%s: invalid SGL (4)\n",
636 				    device_xname(sc->sc_dev)));
637 				goto bad;
638 			}
639 
640 			if (sz > IOP_MAX_XFER) {
641 				DPRINTF(("%s: buffer too large\n",
642 				    device_xname(sc->sc_dev)));
643 				goto bad;
644 			}
645 
646 			bufs[nbuf].db_size = sz;
647 			bufs[nbuf].db_ptr = malloc(sz, M_DEVBUF, M_WAITOK);
648 			if (bufs[nbuf].db_ptr == NULL) {
649 				DPRINTF(("%s: allocation failure\n",
650 				    device_xname(sc->sc_dev)));
651 				rv = ENOMEM;
652 				goto bad;
653 			}
654 
655 			for (i = 0, sz = 0; i < bufs[nbuf].db_nfrag; i++) {
656 				rv = copyin(bufs[nbuf].db_frags[i].iov_base,
657 				    (char *)bufs[nbuf].db_ptr + sz,
658 				    bufs[nbuf].db_frags[i].iov_len);
659 				if (rv != 0) {
660 					DPRINTF(("%s: frag copyin\n",
661 					    device_xname(sc->sc_dev)));
662 					goto bad;
663 				}
664 				sz += bufs[nbuf].db_frags[i].iov_len;
665 			}
666 
667 			if ((p[0] & I2O_SGL_END) != 0)
668 				break;
669 		}
670 
671 		if (nbuf == IOP_MAX_MSG_XFERS) {
672 			DPRINTF(("%s: too many transfers\n",
673 			    device_xname(sc->sc_dev)));
674 			goto bad;
675 		}
676 	} else
677 		nbuf = -1;
678 
679 	/*
680 	 * Allocate a wrapper, and adjust the message header fields to
681 	 * indicate that no scatter-gather list is currently present.
682 	 */
683 
684 	im = iop_msg_alloc(iop, IM_WAIT | IM_NOSTATUS);
685 	im->im_rb = (struct i2o_reply *)rbtmp;
686 	mf = (struct i2o_msg *)mbtmp;
687 	mf->msgictx = IOP_ICTX;
688 	mf->msgtctx = im->im_tctx;
689 
690 	if (sgoff != 0)
691 		mf->msgflags = (mf->msgflags & 0xff0f) | (sgoff << 16);
692 
693 	/*
694 	 * Map the data transfer(s).
695 	 */
696 	for (i = 0; i <= nbuf; i++) {
697 		rv = iop_msg_map(iop, im, mbtmp, bufs[i].db_ptr,
698 		    bufs[i].db_size, bufs[i].db_out, bufs[i].db_proc);
699 		if (rv != 0) {
700 			DPRINTF(("%s: msg_map failed, rv = %d\n",
701 			    device_xname(sc->sc_dev), rv));
702 			goto bad;
703 		}
704 		mapped = 1;
705 	}
706 
707 	/*
708 	 * Start the command and sleep until it completes.
709 	 */
710 	if ((rv = iop_msg_post(iop, im, mbtmp, 5*60*1000)) != 0)
711 		goto bad;
712 
713 	/*
714 	 * Copy out the reply frame.
715 	 */
716 	if ((rv = copyout(rbtmp, (char *)data + msgsize, repsize)) != 0) {
717 		DPRINTF(("%s: reply copyout() failed\n",
718 		    device_xname(sc->sc_dev)));
719 	}
720 
721  bad:
722 	/*
723 	 * Free resources and return to the caller.
724 	 */
725 	if (im != NULL) {
726 		if (mapped)
727 			iop_msg_unmap(iop, im);
728 		iop_msg_free(iop, im);
729 	}
730 
731 	for (i = 0; i <= nbuf; i++) {
732 		if (bufs[i].db_proc != NULL)
733 			continue;
734 
735 		if (!bufs[i].db_out && rv == 0) {
736 			for (j = 0, sz = 0; j < bufs[i].db_nfrag; j++) {
737 				rv = copyout((char *)bufs[i].db_ptr + sz,
738 				    bufs[i].db_frags[j].iov_base,
739 				    bufs[i].db_frags[j].iov_len);
740 				if (rv != 0)
741 					break;
742 				sz += bufs[i].db_frags[j].iov_len;
743 			}
744 		}
745 
746 		if (bufs[i].db_ptr != NULL)
747 			free(bufs[i].db_ptr, M_DEVBUF);
748 	}
749 
750 	return (rv);
751 }
752