xref: /netbsd/sys/dev/i2o/dpti.c (revision bf9ec67e)
1 /*	$NetBSD: dpti.c,v 1.3 2001/11/13 12:24:58 lukem Exp $	*/
2 
3 /*-
4  * Copyright (c) 2001 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Andrew Doran.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. All advertising materials mentioning features or use of this software
19  *    must display the following acknowledgement:
20  *        This product includes software developed by the NetBSD
21  *        Foundation, Inc. and its contributors.
22  * 4. Neither the name of The NetBSD Foundation nor the names of its
23  *    contributors may be used to endorse or promote products derived
24  *    from this software without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
27  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
28  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
29  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
30  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
31  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
32  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
33  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
34  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
35  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
36  * POSSIBILITY OF SUCH DAMAGE.
37  */
38 
39 /*
40  * Copyright (c) 1996-2000 Distributed Processing Technology Corporation
41  * Copyright (c) 2000 Adaptec Corporation
42  * All rights reserved.
43  *
44  * TERMS AND CONDITIONS OF USE
45  *
46  * Redistribution and use in source form, with or without modification, are
47  * permitted provided that redistributions of source code must retain the
48  * above copyright notice, this list of conditions and the following disclaimer.
49  *
50  * This software is provided `as is' by Adaptec and any express or implied
51  * warranties, including, but not limited to, the implied warranties of
52  * merchantability and fitness for a particular purpose, are disclaimed. In no
53  * event shall Adaptec be liable for any direct, indirect, incidental, special,
54  * exemplary or consequential damages (including, but not limited to,
55  * procurement of substitute goods or services; loss of use, data, or profits;
56  * or business interruptions) however caused and on any theory of liability,
57  * whether in contract, strict liability, or tort (including negligence or
58  * otherwise) arising in any way out of the use of this driver software, even
59  * if advised of the possibility of such damage.
60  */
61 
62 /*
63  * Adaptec/DPT I2O control interface.
64  */
65 
66 #include <sys/cdefs.h>
67 __KERNEL_RCSID(0, "$NetBSD: dpti.c,v 1.3 2001/11/13 12:24:58 lukem Exp $");
68 
69 #include "opt_i2o.h"
70 
71 #include <sys/param.h>
72 #include <sys/systm.h>
73 #include <sys/kernel.h>
74 #include <sys/device.h>
75 #include <sys/queue.h>
76 #include <sys/proc.h>
77 #include <sys/endian.h>
78 #include <sys/malloc.h>
79 #include <sys/conf.h>
80 #include <sys/ioctl.h>
81 
82 #include <uvm/uvm_extern.h>
83 
84 #include <machine/bus.h>
85 #ifdef i386
86 #include <machine/pio.h>
87 #endif
88 
89 #include <dev/i2o/i2o.h>
90 #include <dev/i2o/i2odpt.h>
91 #include <dev/i2o/iopio.h>
92 #include <dev/i2o/iopvar.h>
93 #include <dev/i2o/dptivar.h>
94 
95 #ifdef I2ODEBUG
96 #define	DPRINTF(x)		printf x
97 #else
98 #define	DPRINTF(x)
99 #endif
100 
101 static struct dpt_sig dpti_sig = {
102 	{ 'd', 'P', 't', 'S', 'i', 'G'},
103 	SIG_VERSION,
104 #if defined(i386)
105 	PROC_INTEL,
106 #elif defined(powerpc)
107 	PROC_POWERPC,
108 #elif defined(alpha)
109 	PROC_ALPHA,
110 #elif defined(mips)
111 	PROC_MIPS,
112 #elif defined(sparc64)
113 	PROC_ULTRASPARC,
114 #endif
115 #if defined(i386)
116 	PROC_386 | PROC_486 | PROC_PENTIUM | PROC_SEXIUM,
117 #else
118 	0,
119 #endif
120 	FT_HBADRVR,
121 	0,
122 	OEM_DPT,
123 	OS_FREE_BSD,	/* XXX */
124 	CAP_ABOVE16MB,
125 	DEV_ALL,
126 	ADF_ALL_SC5,
127 	0,
128 	0,
129 	DPTI_VERSION,
130 	DPTI_REVISION,
131 	DPTI_SUBREVISION,
132 	DPTI_MONTH,
133 	DPTI_DAY,
134 	DPTI_YEAR,
135 	""		/* Will be filled later */
136 };
137 
138 void	dpti_attach(struct device *, struct device *, void *);
139 int	dpti_blinkled(struct dpti_softc *);
140 int	dpti_ctlrinfo(struct dpti_softc *, u_long, caddr_t);
141 int	dpti_match(struct device *, struct cfdata *, void *);
142 int	dpti_passthrough(struct dpti_softc *, caddr_t, struct proc *);
143 int	dpti_sysinfo(struct dpti_softc *, u_long, caddr_t);
144 
145 cdev_decl(dpti);
146 
147 extern struct cfdriver dpti_cd;
148 
149 struct cfattach dpti_ca = {
150 	sizeof(struct dpti_softc), dpti_match, dpti_attach
151 };
152 
153 int
154 dpti_match(struct device *parent, struct cfdata *match, void *aux)
155 {
156 	struct iop_attach_args *ia;
157 	struct iop_softc *iop;
158 
159 	ia = aux;
160 	iop = (struct iop_softc *)parent;
161 
162 	if (ia->ia_class != I2O_CLASS_ANY || ia->ia_tid != I2O_TID_IOP)
163 		return (0);
164 
165 	if (le16toh(iop->sc_status.orgid) != I2O_ORG_DPT)
166 		return (0);
167 
168 	return (1);
169 }
170 
171 void
172 dpti_attach(struct device *parent, struct device *self, void *aux)
173 {
174 	struct iop_softc *iop;
175 	struct dpti_softc *sc;
176 	struct {
177 		struct	i2o_param_op_results pr;
178 		struct	i2o_param_read_results prr;
179 		struct	i2o_dpt_param_exec_iop_buffers dib;
180 	} __attribute__ ((__packed__)) param;
181 	int rv;
182 
183 	sc = (struct dpti_softc *)self;
184 	iop = (struct iop_softc *)parent;
185 
186 	/*
187 	 * Tell the world what we are.  The description in the signature
188 	 * must be no more than 46 bytes long (see dptivar.h).
189 	 */
190 	printf(": DPT/Adaptec RAID management interface\n");
191 	sprintf(dpti_sig.dsDescription, "NetBSD %s I2O OSM", osrelease);
192 
193 	rv = iop_field_get_all(iop, I2O_TID_IOP,
194 	    I2O_DPT_PARAM_EXEC_IOP_BUFFERS, &param,
195 	    sizeof(param), NULL);
196 	if (rv != 0)
197 		return;
198 
199 	sc->sc_blinkled = le32toh(param.dib.serialoutputoff) + 8;
200 }
201 
202 int
203 dptiopen(dev_t dev, int flag, int mode, struct proc *p)
204 {
205 
206 	if (securelevel > 1)
207 		return (EPERM);
208 	if (device_lookup(&dpti_cd, minor(dev)) == NULL)
209 		return (ENXIO);
210 
211 	return (0);
212 }
213 
214 int
215 dpticlose(dev_t dev, int flag, int mode, struct proc *p)
216 {
217 
218 	return (0);
219 }
220 
221 int
222 dptiioctl(dev_t dev, u_long cmd, caddr_t data, int flag, struct proc *p)
223 {
224 	struct iop_softc *iop;
225 	struct dpti_softc *sc;
226 	struct ioctl_pt *pt;
227 	int i, size, rv;
228 
229 	sc = device_lookup(&dpti_cd, minor(dev));
230 	iop = (struct iop_softc *)sc->sc_dv.dv_parent;
231 
232 	/*
233 	 * Currently, we only take ioctls passed down from the Linux
234 	 * emulation layer.
235 	 */
236 	if (cmd == PTIOCLINUX) {
237 		pt = (struct ioctl_pt *)data;
238 		cmd = pt->com;
239 		data = pt->data;
240 	} else
241 		return (ENOTTY);
242 
243 	size = IOCPARM_LEN(cmd);
244 
245 	switch (cmd & 0xffff) {
246 	case DPT_SIGNATURE:
247 		if (size > sizeof(dpti_sig))
248 			size = sizeof(dpti_sig);
249 		memcpy(data, &dpti_sig, size);
250 		return (0);
251 
252 	case DPT_CTRLINFO:
253 		return (dpti_ctlrinfo(sc, cmd, data));
254 
255 	case DPT_SYSINFO:
256 		return (dpti_sysinfo(sc, cmd, data));
257 
258 	case DPT_BLINKLED:
259 		if ((i = dpti_blinkled(sc)) == -1)
260 			i = 0;
261 
262 		if (size == 0)
263 			return (copyout(&i, *(caddr_t *)data, sizeof(i)));
264 
265 		*(int *)data = i;
266 		return (0);
267 
268 	case DPT_TARGET_BUSY:
269 		/*
270 		 * XXX This is here to stop linux_machdepioctl() from
271 		 * whining about an unknown ioctl.  Really, it should be
272 		 * implemented.
273 		 */
274 		return (EIO);
275 
276 	case DPT_I2OUSRCMD:
277 		if (sc->sc_nactive++ >= 2)
278 			tsleep(&sc->sc_nactive, PRIBIO, "dptislp", 0);
279 
280 		rv = dpti_passthrough(sc, data, p);
281 
282 		sc->sc_nactive--;
283 		wakeup_one(&sc->sc_nactive);
284 		return (rv);
285 
286 	case DPT_I2ORESETCMD:
287 		printf("%s: I2ORESETCMD not implemented\n",
288 		    sc->sc_dv.dv_xname);
289 		return (EOPNOTSUPP);
290 
291 	case DPT_I2ORESCANCMD:
292 		return (iop_reconfigure(iop, 0));
293 
294 	default:
295 		return (ENOTTY);
296 	}
297 }
298 
299 int
300 dpti_blinkled(struct dpti_softc *sc)
301 {
302 	struct iop_softc *iop;
303 	u_int v;
304 
305 	iop = (struct iop_softc *)sc->sc_dv.dv_parent;
306 
307 	v = bus_space_read_1(iop->sc_iot, iop->sc_ioh, sc->sc_blinkled + 0);
308 	if (v == 0xbc) {
309 		v = bus_space_read_1(iop->sc_iot, iop->sc_ioh,
310 		    sc->sc_blinkled + 1);
311 		return (v);
312 	}
313 
314 	return (-1);
315 }
316 
317 int
318 dpti_ctlrinfo(struct dpti_softc *sc, u_long cmd, caddr_t data)
319 {
320 	struct dpt_ctlrinfo info;
321 	struct iop_softc *iop;
322 	int rv, i;
323 
324 	iop = (struct iop_softc *)sc->sc_dv.dv_parent;
325 
326 	memset(&info, 0, sizeof(info));
327 
328 	info.length = sizeof(info) - sizeof(u_int16_t);
329 	info.drvrHBAnum = sc->sc_dv.dv_unit;
330 	info.baseAddr = iop->sc_memaddr;
331 	if ((i = dpti_blinkled(sc)) == -1)
332 		i = 0;
333 	info.blinkState = i;
334 	info.pciBusNum = iop->sc_pcibus;
335 	info.pciDeviceNum = iop->sc_pcidev;
336 	info.hbaFlags = FLG_OSD_PCI_VALID | FLG_OSD_DMA | FLG_OSD_I2O;
337 	info.Interrupt = 10;			/* XXX */
338 
339 	if (IOCPARM_LEN(cmd) > sizeof(*data)) {
340 		memcpy(data, &info, min(sizeof(info), IOCPARM_LEN(cmd)));
341 		rv = 0;
342 	} else
343 		rv = copyout(&info, *(caddr_t *)data, sizeof(info));
344 
345 	return (rv);
346 }
347 
348 int
349 dpti_sysinfo(struct dpti_softc *sc, u_long cmd, caddr_t data)
350 {
351 	struct dpt_sysinfo info;
352 	int rv;
353 #ifdef i386
354 	int i, j;
355 #endif
356 
357 	memset(&info, 0, sizeof(info));
358 
359 #ifdef i386
360 	outb (0x70, 0x12);
361 	i = inb(0x71);
362 	j = i >> 4;
363 	if (i == 0x0f) {
364 		outb (0x70, 0x19);
365 		j = inb (0x71);
366 	}
367 	info.drive0CMOS = j;
368 
369 	j = i & 0x0f;
370 	if (i == 0x0f) {
371 		outb (0x70, 0x1a);
372 		j = inb (0x71);
373 	}
374 	info.drive1CMOS = j;
375 	info.processorFamily = dpti_sig.dsProcessorFamily;
376 
377 	/*
378 	 * Get the conventional memory size from CMOS.
379 	 */
380 	outb(0x70, 0x16);
381 	j = inb(0x71);
382 	j <<= 8;
383 	outb(0x70, 0x15);
384 	j |= inb(0x71);
385 	info.conventionalMemSize = j;
386 
387 	/*
388 	 * Get the extended memory size from CMOS.
389 	 */
390 	outb(0x70, 0x31);
391 	j = inb(0x71);
392 	j <<= 8;
393 	outb(0x70, 0x30);
394 	j |= inb(0x71);
395 	info.extendedMemSize = j;
396 
397 	switch (cpu_class) {
398 	case CPUCLASS_386:
399 		info.processorType = PROC_386;
400 		break;
401 	case CPUCLASS_486:
402 		info.processorType = PROC_486;
403 		break;
404 	case CPUCLASS_586:
405 		info.processorType = PROC_PENTIUM;
406 		break;
407 	case CPUCLASS_686:
408 	default:
409 		info.processorType = PROC_SEXIUM;
410 		break;
411 	}
412 
413 	info.flags = SI_CMOS_Valid | SI_BusTypeValid |
414 	    SI_MemorySizeValid | SI_NO_SmartROM;
415 #else
416 	info.flags = SI_BusTypeValid | SI_NO_SmartROM;
417 #endif
418 
419 	info.busType = SI_PCI_BUS;
420 
421 	/*
422 	 * Copy out the info structure to the user.
423 	 */
424 	if (IOCPARM_LEN(cmd) > sizeof(*data)) {
425 		memcpy(data, &info, min(sizeof(info), IOCPARM_LEN(cmd)));
426 		rv = 0;
427 	} else
428 		rv = copyout(&info, *(caddr_t *)data, sizeof(info));
429 
430 	return (rv);
431 }
432 
433 int
434 dpti_passthrough(struct dpti_softc *sc, caddr_t data, struct proc *proc)
435 {
436 	struct iop_softc *iop;
437 	struct i2o_msg mh, *mf;
438 	struct i2o_reply rh;
439 	struct iop_msg *im;
440 	struct dpti_ptbuf bufs[IOP_MAX_MSG_XFERS];
441 	u_int32_t mbtmp[IOP_MAX_MSG_SIZE / sizeof(u_int32_t)];
442 	u_int32_t rbtmp[IOP_MAX_MSG_SIZE / sizeof(u_int32_t)];
443 	int rv, msgsize, repsize, sgoff, i, mapped, nbuf, nfrag, j, sz;
444 	u_int32_t *p, *pmax, *pstart;
445 
446 	iop = (struct iop_softc *)sc->sc_dv.dv_parent;
447 	im = NULL;
448 
449 	if ((rv = dpti_blinkled(sc)) != -1) {
450 		if (rv != 0) {
451 			printf("%s: adapter blinkled = 0x%02x\n",
452 			    sc->sc_dv.dv_xname, rv);
453 			return (EIO);
454 		}
455 	}
456 
457 	/*
458 	 * Copy in the message frame header and determine the size of the
459 	 * full message frame.
460 	 */
461 	if ((rv = copyin(data, &mh, sizeof(mh))) != 0) {
462 		DPRINTF(("%s: message copyin failed\n",
463 		    sc->sc_dv.dv_xname));
464 		return (rv);
465 	}
466 
467 	msgsize = (mh.msgflags >> 14) & ~3;
468 	if (msgsize < sizeof(mh) || msgsize >= IOP_MAX_MSG_SIZE) {
469 		DPRINTF(("%s: bad message frame size\n",
470 		    sc->sc_dv.dv_xname));
471 		return (EINVAL);
472 	}
473 
474 	/*
475 	 * Handle special commands.
476 	 */
477 	switch (mh.msgfunc >> 24) {
478 	case I2O_EXEC_IOP_RESET:
479 		printf("%s: I2O_EXEC_IOP_RESET not implemented\n",
480 		    sc->sc_dv.dv_xname);
481 		return (EOPNOTSUPP);
482 
483 	case I2O_EXEC_OUTBOUND_INIT:
484 		printf("%s: I2O_EXEC_OUTBOUND_INIT not implemented\n",
485 		    sc->sc_dv.dv_xname);
486 		return (EOPNOTSUPP);
487 
488 	case I2O_EXEC_SYS_TAB_SET:
489 		printf("%s: I2O_EXEC_SYS_TAB_SET not implemented\n",
490 		    sc->sc_dv.dv_xname);
491 		return (EOPNOTSUPP);
492 
493 	case I2O_EXEC_STATUS_GET:
494 		if ((rv = iop_status_get(iop, 0)) == 0)
495 			rv = copyout(&iop->sc_status, data + msgsize,
496 			    sizeof(iop->sc_status));
497 		return (rv);
498 	}
499 
500 	/*
501 	 * Copy in the full message frame.
502 	 */
503 	if ((rv = copyin(data, mbtmp, msgsize)) != 0) {
504 		DPRINTF(("%s: full message copyin failed\n",
505 		    sc->sc_dv.dv_xname));
506 		return (rv);
507 	}
508 
509 	/*
510 	 * Determine the size of the reply frame, and copy it in.
511 	 */
512 	if ((rv = copyin(data + msgsize, &rh, sizeof(rh))) != 0) {
513 		DPRINTF(("%s: reply copyin failed\n",
514 		    sc->sc_dv.dv_xname));
515 		return (rv);
516 	}
517 
518 	repsize = (rh.msgflags >> 14) & ~3;
519 	if (repsize < sizeof(rh) || repsize >= IOP_MAX_MSG_SIZE) {
520 		DPRINTF(("%s: bad reply header size\n",
521 		    sc->sc_dv.dv_xname));
522 		return (EINVAL);
523 	}
524 
525 	if ((rv = copyin(data + msgsize, rbtmp, repsize)) != 0) {
526 		DPRINTF(("%s: reply too large\n", sc->sc_dv.dv_xname));
527 		return (rv);
528 	}
529 
530 	/*
531 	 * If the message has a scatter gather list, it must be comprised of
532 	 * simple elements.  If any one transfer contains multiple segments,
533 	 * we allocate a temporary buffer for it; otherwise, the buffer will
534 	 * be mapped directly.
535 	 */
536 	if ((sgoff = ((mh.msgflags >> 4) & 15)) != 0) {
537 		if ((sgoff + 2) > (msgsize >> 2)) {
538 			DPRINTF(("%s: invalid message size fields\n",
539 			    sc->sc_dv.dv_xname));
540 			return (EINVAL);
541 		}
542 
543 		memset(bufs, 0, sizeof(bufs));
544 	} else
545 		nbuf = -1;
546 
547 	rv = EINVAL;
548 
549 	if (sgoff != 0) {
550 		p = mbtmp + sgoff;
551 		pmax = mbtmp + (msgsize >> 2) - 2;
552 
553 		for (nbuf = 0; nbuf < IOP_MAX_MSG_XFERS; nbuf++, p += 2) {
554 			if (p > pmax) {
555 				DPRINTF(("%s: invalid SGL (1)\n",
556 				    sc->sc_dv.dv_xname));
557 				goto bad;
558 			}
559 
560 			if ((p[0] & 0x30000000) != I2O_SGL_SIMPLE) {
561 				DPRINTF(("%s: invalid SGL (2)\n",
562 				    sc->sc_dv.dv_xname));
563 				goto bad;
564 			}
565 
566 			bufs[nbuf].db_out = (p[0] & I2O_SGL_DATA_OUT) != 0;
567 			bufs[nbuf].db_ptr = NULL;
568 
569 			if ((p[0] & I2O_SGL_END_BUFFER) != 0) {
570 				if ((p[0] & 0x00ffffff) > IOP_MAX_XFER) {
571 					DPRINTF(("%s: buffer too large\n",
572 					    sc->sc_dv.dv_xname));
573 					goto bad;
574 				}
575 
576 				bufs[nbuf].db_ptr = (caddr_t)p[1];
577 				bufs[nbuf].db_proc = proc;
578 				bufs[nbuf].db_size = p[0] & 0x00ffffff;
579 
580 				if ((p[0] & I2O_SGL_END) != 0)
581 					break;
582 
583 				continue;
584 			}
585 
586 			/*
587 			 * The buffer has multiple segments.  Determine the
588 			 * total size.
589 			 */
590 			nfrag = 0;
591 			sz = 0;
592 			for (pstart = p; p <= pmax; p += 2) {
593 				if (nfrag == DPTI_MAX_SEGS) {
594 					DPRINTF(("%s: too many segments\n",
595 					    sc->sc_dv.dv_xname));
596 					goto bad;
597 				}
598 
599 				bufs[nbuf].db_frags[nfrag].iov_len =
600 				    p[0] & 0x00ffffff;
601 				bufs[nbuf].db_frags[nfrag].iov_base =
602 				    (void *)p[1];
603 
604 				sz += p[0] & 0x00ffffff;
605 				nfrag++;
606 
607 				if ((p[0] & I2O_SGL_END) != 0) {
608 					if ((p[0] & I2O_SGL_END_BUFFER) == 0) {
609 						DPRINTF((
610 						    "%s: invalid SGL (3)\n",
611 						    sc->sc_dv.dv_xname));
612 						goto bad;
613 					}
614 					break;
615 				}
616 				if ((p[0] & I2O_SGL_END_BUFFER) != 0)
617 					break;
618 			}
619 			bufs[nbuf].db_nfrag = nfrag;
620 
621 			if (p > pmax) {
622 				DPRINTF(("%s: invalid SGL (4)\n",
623 				    sc->sc_dv.dv_xname));
624 				goto bad;
625 			}
626 
627 			if (sz > IOP_MAX_XFER) {
628 				DPRINTF(("%s: buffer too large\n",
629 				    sc->sc_dv.dv_xname));
630 				goto bad;
631 			}
632 
633 			bufs[nbuf].db_size = sz;
634 			bufs[nbuf].db_ptr = malloc(sz, M_DEVBUF, M_WAITOK);
635 			if (bufs[nbuf].db_ptr == NULL) {
636 				DPRINTF(("%s: allocation failure\n",
637 				    sc->sc_dv.dv_xname));
638 				rv = ENOMEM;
639 				goto bad;
640 			}
641 
642 			for (i = 0, sz = 0; i < bufs[nbuf].db_nfrag; i++) {
643 				rv = copyin(bufs[nbuf].db_frags[i].iov_base,
644 				    bufs[nbuf].db_ptr + sz,
645 				    bufs[nbuf].db_frags[i].iov_len);
646 				if (rv != 0) {
647 					DPRINTF(("%s: frag copyin\n",
648 					    sc->sc_dv.dv_xname));
649 					goto bad;
650 				}
651 				sz += bufs[nbuf].db_frags[i].iov_len;
652 			}
653 
654 			if ((p[0] & I2O_SGL_END) != 0)
655 				break;
656 		}
657 
658 		if (nbuf == IOP_MAX_MSG_XFERS) {
659 			DPRINTF(("%s: too many transfers\n",
660 			    sc->sc_dv.dv_xname));
661 			goto bad;
662 		}
663 	}
664 
665 	/*
666 	 * Allocate a wrapper, and adjust the message header fields to
667 	 * indicate that no scatter-gather list is currently present.
668 	 */
669 	mapped = 0;
670 
671 	im = iop_msg_alloc(iop, IM_WAIT | IM_NOSTATUS);
672 	im->im_rb = (struct i2o_reply *)rbtmp;
673 	mf = (struct i2o_msg *)mbtmp;
674 	mf->msgictx = IOP_ICTX;
675 	mf->msgtctx = im->im_tctx;
676 
677 	if (sgoff != 0)
678 		mf->msgflags = (mf->msgflags & 0xff0f) | (sgoff << 16);
679 
680 	/*
681 	 * Map the data transfer(s).
682 	 */
683 	for (i = 0; i <= nbuf; i++) {
684 		rv = iop_msg_map(iop, im, mbtmp, bufs[i].db_ptr,
685 		    bufs[i].db_size, bufs[i].db_out, bufs[i].db_proc);
686 		if (rv != 0) {
687 			DPRINTF(("%s: msg_map failed, rv = %d\n",
688 			    sc->sc_dv.dv_xname, rv));
689 			goto bad;
690 		}
691 		mapped = 1;
692 	}
693 
694 	/*
695 	 * Start the command and sleep until it completes.
696 	 */
697 	if ((rv = iop_msg_post(iop, im, mbtmp, 5*60*1000)) != 0)
698 		goto bad;
699 
700 	/*
701 	 * Copy out the reply frame.
702 	 */
703 	if ((rv = copyout(rbtmp, data + msgsize, repsize)) != 0)
704 		DPRINTF(("%s: reply copyout() failed\n",
705 		    sc->sc_dv.dv_xname));
706 
707  bad:
708 	/*
709 	 * Free resources and return to the caller.
710 	 */
711 	if (im != NULL) {
712 		if (mapped)
713 			iop_msg_unmap(iop, im);
714 		iop_msg_free(iop, im);
715 	}
716 
717 	for (i = 0; i <= nbuf; i++) {
718 		if (bufs[i].db_proc != NULL)
719 			continue;
720 
721 		if (!bufs[i].db_out && rv == 0) {
722 			for (j = 0, sz = 0; j < bufs[i].db_nfrag; j++) {
723 				rv = copyout(bufs[i].db_ptr + sz,
724 				    bufs[i].db_frags[j].iov_base,
725 				    bufs[i].db_frags[j].iov_len);
726 				if (rv != 0)
727 					break;
728 				sz += bufs[i].db_frags[j].iov_len;
729 			}
730 		}
731 
732 		if (bufs[i].db_ptr != NULL)
733 			free(bufs[i].db_ptr, M_DEVBUF);
734 	}
735 
736 	return (rv);
737 }
738