xref: /netbsd-src/sys/dev/i2o/dpti.c (revision 23c8222edbfb0f0932d88a8351d3a0cf817dfb9e)
1 /*	$NetBSD: dpti.c,v 1.18 2004/04/22 00:17:10 itojun Exp $	*/
2 
3 /*-
4  * Copyright (c) 2001 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Andrew Doran.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. All advertising materials mentioning features or use of this software
19  *    must display the following acknowledgement:
20  *        This product includes software developed by the NetBSD
21  *        Foundation, Inc. and its contributors.
22  * 4. Neither the name of The NetBSD Foundation nor the names of its
23  *    contributors may be used to endorse or promote products derived
24  *    from this software without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
27  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
28  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
29  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
30  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
31  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
32  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
33  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
34  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
35  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
36  * POSSIBILITY OF SUCH DAMAGE.
37  */
38 
39 /*
40  * Copyright (c) 1996-2000 Distributed Processing Technology Corporation
41  * Copyright (c) 2000 Adaptec Corporation
42  * All rights reserved.
43  *
44  * TERMS AND CONDITIONS OF USE
45  *
46  * Redistribution and use in source form, with or without modification, are
47  * permitted provided that redistributions of source code must retain the
48  * above copyright notice, this list of conditions and the following disclaimer.
49  *
50  * This software is provided `as is' by Adaptec and any express or implied
51  * warranties, including, but not limited to, the implied warranties of
52  * merchantability and fitness for a particular purpose, are disclaimed. In no
53  * event shall Adaptec be liable for any direct, indirect, incidental, special,
54  * exemplary or consequential damages (including, but not limited to,
55  * procurement of substitute goods or services; loss of use, data, or profits;
56  * or business interruptions) however caused and on any theory of liability,
57  * whether in contract, strict liability, or tort (including negligence or
58  * otherwise) arising in any way out of the use of this driver software, even
59  * if advised of the possibility of such damage.
60  */
61 
62 /*
63  * Adaptec/DPT I2O control interface.
64  */
65 
66 #include <sys/cdefs.h>
67 __KERNEL_RCSID(0, "$NetBSD: dpti.c,v 1.18 2004/04/22 00:17:10 itojun Exp $");
68 
69 #include "opt_i2o.h"
70 
71 #include <sys/param.h>
72 #include <sys/systm.h>
73 #include <sys/kernel.h>
74 #include <sys/device.h>
75 #include <sys/queue.h>
76 #include <sys/proc.h>
77 #include <sys/endian.h>
78 #include <sys/malloc.h>
79 #include <sys/conf.h>
80 #include <sys/ioctl.h>
81 
82 #include <uvm/uvm_extern.h>
83 
84 #include <machine/bus.h>
85 #ifdef __i386__
86 #include <machine/pio.h>
87 #endif
88 
89 #include <dev/i2o/i2o.h>
90 #include <dev/i2o/i2odpt.h>
91 #include <dev/i2o/iopio.h>
92 #include <dev/i2o/iopvar.h>
93 #include <dev/i2o/dptivar.h>
94 
95 #ifdef I2ODEBUG
96 #define	DPRINTF(x)		printf x
97 #else
98 #define	DPRINTF(x)
99 #endif
100 
101 static struct dpt_sig dpti_sig = {
102 	{ 'd', 'P', 't', 'S', 'i', 'G'},
103 	SIG_VERSION,
104 #if defined(__i386__)
105 	PROC_INTEL,
106 #elif defined(__powerpc__)
107 	PROC_POWERPC,
108 #elif defined(__alpha__)
109 	PROC_ALPHA,
110 #elif defined(__mips__)
111 	PROC_MIPS,
112 #elif defined(__sparc64__)
113 	PROC_ULTRASPARC,
114 #endif
115 #if defined(__i386__)
116 	PROC_386 | PROC_486 | PROC_PENTIUM | PROC_SEXIUM,
117 #else
118 	0,
119 #endif
120 	FT_HBADRVR,
121 	0,
122 	OEM_DPT,
123 	OS_FREE_BSD,	/* XXX */
124 	CAP_ABOVE16MB,
125 	DEV_ALL,
126 	ADF_ALL_SC5,
127 	0,
128 	0,
129 	DPTI_VERSION,
130 	DPTI_REVISION,
131 	DPTI_SUBREVISION,
132 	DPTI_MONTH,
133 	DPTI_DAY,
134 	DPTI_YEAR,
135 	""		/* Will be filled later */
136 };
137 
138 void	dpti_attach(struct device *, struct device *, void *);
139 int	dpti_blinkled(struct dpti_softc *);
140 int	dpti_ctlrinfo(struct dpti_softc *, int, caddr_t);
141 int	dpti_match(struct device *, struct cfdata *, void *);
142 int	dpti_passthrough(struct dpti_softc *, caddr_t, struct proc *);
143 int	dpti_sysinfo(struct dpti_softc *, int, caddr_t);
144 
145 dev_type_open(dptiopen);
146 dev_type_ioctl(dptiioctl);
147 
148 const struct cdevsw dpti_cdevsw = {
149 	dptiopen, nullclose, noread, nowrite, dptiioctl,
150 	nostop, notty, nopoll, nommap, nokqfilter,
151 };
152 
153 extern struct cfdriver dpti_cd;
154 
155 CFATTACH_DECL(dpti, sizeof(struct dpti_softc),
156     dpti_match, dpti_attach, NULL, NULL);
157 
158 int
159 dpti_match(struct device *parent, struct cfdata *match, void *aux)
160 {
161 	struct iop_attach_args *ia;
162 	struct iop_softc *iop;
163 
164 	ia = aux;
165 	iop = (struct iop_softc *)parent;
166 
167 	if (ia->ia_class != I2O_CLASS_ANY || ia->ia_tid != I2O_TID_IOP)
168 		return (0);
169 
170 	if (le16toh(iop->sc_status.orgid) != I2O_ORG_DPT)
171 		return (0);
172 
173 	return (1);
174 }
175 
176 void
177 dpti_attach(struct device *parent, struct device *self, void *aux)
178 {
179 	struct iop_softc *iop;
180 	struct dpti_softc *sc;
181 	struct {
182 		struct	i2o_param_op_results pr;
183 		struct	i2o_param_read_results prr;
184 		struct	i2o_dpt_param_exec_iop_buffers dib;
185 	} __attribute__ ((__packed__)) param;
186 	int rv;
187 
188 	sc = (struct dpti_softc *)self;
189 	iop = (struct iop_softc *)parent;
190 
191 	/*
192 	 * Tell the world what we are.  The description in the signature
193 	 * must be no more than 46 bytes long (see dptivar.h).
194 	 */
195 	printf(": DPT/Adaptec RAID management interface\n");
196 	snprintf(dpti_sig.dsDescription, sizeof(dpti_sig.dsDescription),
197 	    "NetBSD %s I2O OSM", osrelease);
198 
199 	rv = iop_field_get_all(iop, I2O_TID_IOP,
200 	    I2O_DPT_PARAM_EXEC_IOP_BUFFERS, &param,
201 	    sizeof(param), NULL);
202 	if (rv != 0)
203 		return;
204 
205 	sc->sc_blinkled = le32toh(param.dib.serialoutputoff) + 8;
206 }
207 
208 int
209 dptiopen(dev_t dev, int flag, int mode, struct proc *p)
210 {
211 
212 	if (securelevel > 1)
213 		return (EPERM);
214 	if (device_lookup(&dpti_cd, minor(dev)) == NULL)
215 		return (ENXIO);
216 
217 	return (0);
218 }
219 
220 int
221 dptiioctl(dev_t dev, u_long cmd, caddr_t data, int flag, struct proc *p)
222 {
223 	struct iop_softc *iop;
224 	struct dpti_softc *sc;
225 	struct ioctl_pt *pt;
226 	int i, size, rv, linux;
227 
228 	sc = device_lookup(&dpti_cd, minor(dev));
229 	iop = (struct iop_softc *)sc->sc_dv.dv_parent;
230 	rv = 0;
231 
232 	if (cmd == PTIOCLINUX) {
233 		pt = (struct ioctl_pt *)data;
234 		size = IOCPARM_LEN(pt->com);
235 		cmd = pt->com & 0xffff;
236 		data = pt->data;
237 		linux = 1;
238 	} else {
239 		size = IOCPARM_LEN(cmd);
240 		cmd = cmd & 0xffff;
241 		linux = 0;
242 	}
243 
244 	switch (cmd) {
245 	case DPT_SIGNATURE:
246 		if (size > sizeof(dpti_sig))
247 			size = sizeof(dpti_sig);
248 		memcpy(data, &dpti_sig, size);
249 		break;
250 
251 	case DPT_CTRLINFO:
252 		rv = dpti_ctlrinfo(sc, size, data);
253 		break;
254 
255 	case DPT_SYSINFO:
256 		rv = dpti_sysinfo(sc, size, data);
257 		break;
258 
259 	case DPT_BLINKLED:
260 		if ((i = dpti_blinkled(sc)) == -1)
261 			i = 0;
262 
263 		if (size == 0) {
264 			rv = copyout(&i, *(caddr_t *)data, sizeof(i));
265 			break;
266 		}
267 
268 		*(int *)data = i;
269 		break;
270 
271 	case DPT_TARGET_BUSY:
272 		/*
273 		 * XXX This is here to stop linux_machdepioctl() from
274 		 * whining about an unknown ioctl.
275 		 */
276 		rv = EIO;
277 		break;
278 
279 	case DPT_I2OUSRCMD:
280 		if (sc->sc_nactive++ >= 2)
281 			tsleep(&sc->sc_nactive, PRIBIO, "dptislp", 0);
282 
283 		if (linux)
284 			rv = dpti_passthrough(sc, data, p);
285 		else
286 			rv = dpti_passthrough(sc, *(caddr_t *)data, p);
287 
288 		sc->sc_nactive--;
289 		wakeup_one(&sc->sc_nactive);
290 		break;
291 
292 	case DPT_I2ORESETCMD:
293 		printf("%s: I2ORESETCMD not implemented\n",
294 		    sc->sc_dv.dv_xname);
295 		rv = EOPNOTSUPP;
296 		break;
297 
298 	case DPT_I2ORESCANCMD:
299 		if ((rv = lockmgr(&iop->sc_conflock, LK_EXCLUSIVE, NULL)) != 0)
300 			break;
301 		rv = iop_reconfigure(iop, 0);
302 		lockmgr(&iop->sc_conflock, LK_RELEASE, NULL);
303 		break;
304 
305 	default:
306 		rv = ENOTTY;
307 		break;
308 	}
309 
310 	return (rv);
311 }
312 
313 int
314 dpti_blinkled(struct dpti_softc *sc)
315 {
316 	struct iop_softc *iop;
317 	u_int v;
318 
319 	iop = (struct iop_softc *)sc->sc_dv.dv_parent;
320 
321 	v = bus_space_read_1(iop->sc_iot, iop->sc_ioh, sc->sc_blinkled + 0);
322 	if (v == 0xbc) {
323 		v = bus_space_read_1(iop->sc_iot, iop->sc_ioh,
324 		    sc->sc_blinkled + 1);
325 		return (v);
326 	}
327 
328 	return (-1);
329 }
330 
331 int
332 dpti_ctlrinfo(struct dpti_softc *sc, int size, caddr_t data)
333 {
334 	struct dpt_ctlrinfo info;
335 	struct iop_softc *iop;
336 	int rv, i;
337 
338 	iop = (struct iop_softc *)sc->sc_dv.dv_parent;
339 
340 	memset(&info, 0, sizeof(info));
341 
342 	info.length = sizeof(info) - sizeof(u_int16_t);
343 	info.drvrHBAnum = sc->sc_dv.dv_unit;
344 	info.baseAddr = iop->sc_memaddr;
345 	if ((i = dpti_blinkled(sc)) == -1)
346 		i = 0;
347 	info.blinkState = i;
348 	info.pciBusNum = iop->sc_pcibus;
349 	info.pciDeviceNum = iop->sc_pcidev;
350 	info.hbaFlags = FLG_OSD_PCI_VALID | FLG_OSD_DMA | FLG_OSD_I2O;
351 	info.Interrupt = 10;			/* XXX */
352 
353 	if (size > sizeof(*data)) {
354 		memcpy(data, &info, min(sizeof(info), size));
355 		rv = 0;
356 	} else
357 		rv = copyout(&info, *(caddr_t *)data, sizeof(info));
358 
359 	return (rv);
360 }
361 
362 int
363 dpti_sysinfo(struct dpti_softc *sc, int size, caddr_t data)
364 {
365 	struct dpt_sysinfo info;
366 	int rv;
367 #ifdef __i386__
368 	int i, j;
369 #endif
370 
371 	memset(&info, 0, sizeof(info));
372 
373 #ifdef __i386__
374 	outb (0x70, 0x12);
375 	i = inb(0x71);
376 	j = i >> 4;
377 	if (i == 0x0f) {
378 		outb (0x70, 0x19);
379 		j = inb (0x71);
380 	}
381 	info.drive0CMOS = j;
382 
383 	j = i & 0x0f;
384 	if (i == 0x0f) {
385 		outb (0x70, 0x1a);
386 		j = inb (0x71);
387 	}
388 	info.drive1CMOS = j;
389 	info.processorFamily = dpti_sig.dsProcessorFamily;
390 
391 	/*
392 	 * Get the conventional memory size from CMOS.
393 	 */
394 	outb(0x70, 0x16);
395 	j = inb(0x71);
396 	j <<= 8;
397 	outb(0x70, 0x15);
398 	j |= inb(0x71);
399 	info.conventionalMemSize = j;
400 
401 	/*
402 	 * Get the extended memory size from CMOS.
403 	 */
404 	outb(0x70, 0x31);
405 	j = inb(0x71);
406 	j <<= 8;
407 	outb(0x70, 0x30);
408 	j |= inb(0x71);
409 	info.extendedMemSize = j;
410 
411 	switch (cpu_class) {
412 	case CPUCLASS_386:
413 		info.processorType = PROC_386;
414 		break;
415 	case CPUCLASS_486:
416 		info.processorType = PROC_486;
417 		break;
418 	case CPUCLASS_586:
419 		info.processorType = PROC_PENTIUM;
420 		break;
421 	case CPUCLASS_686:
422 	default:
423 		info.processorType = PROC_SEXIUM;
424 		break;
425 	}
426 
427 	info.flags = SI_CMOS_Valid | SI_BusTypeValid |
428 	    SI_MemorySizeValid | SI_NO_SmartROM;
429 #else
430 	info.flags = SI_BusTypeValid | SI_NO_SmartROM;
431 #endif
432 
433 	info.busType = SI_PCI_BUS;
434 
435 	/*
436 	 * Copy out the info structure to the user.
437 	 */
438 	if (size > sizeof(*data)) {
439 		memcpy(data, &info, min(sizeof(info), size));
440 		rv = 0;
441 	} else
442 		rv = copyout(&info, *(caddr_t *)data, sizeof(info));
443 
444 	return (rv);
445 }
446 
447 int
448 dpti_passthrough(struct dpti_softc *sc, caddr_t data, struct proc *proc)
449 {
450 	struct iop_softc *iop;
451 	struct i2o_msg mh, *mf;
452 	struct i2o_reply rh;
453 	struct iop_msg *im;
454 	struct dpti_ptbuf bufs[IOP_MAX_MSG_XFERS];
455 	u_int32_t mbtmp[IOP_MAX_MSG_SIZE / sizeof(u_int32_t)];
456 	u_int32_t rbtmp[IOP_MAX_MSG_SIZE / sizeof(u_int32_t)];
457 	int rv, msgsize, repsize, sgoff, i, mapped, nbuf, nfrag, j, sz;
458 	u_int32_t *p, *pmax;
459 
460 	iop = (struct iop_softc *)sc->sc_dv.dv_parent;
461 	im = NULL;
462 
463 	if ((rv = dpti_blinkled(sc)) != -1) {
464 		if (rv != 0) {
465 			printf("%s: adapter blinkled = 0x%02x\n",
466 			    sc->sc_dv.dv_xname, rv);
467 			return (EIO);
468 		}
469 	}
470 
471 	/*
472 	 * Copy in the message frame header and determine the size of the
473 	 * full message frame.
474 	 */
475 	if ((rv = copyin(data, &mh, sizeof(mh))) != 0) {
476 		DPRINTF(("%s: message copyin failed\n",
477 		    sc->sc_dv.dv_xname));
478 		return (rv);
479 	}
480 
481 	msgsize = (mh.msgflags >> 14) & ~3;
482 	if (msgsize < sizeof(mh) || msgsize >= IOP_MAX_MSG_SIZE) {
483 		DPRINTF(("%s: bad message frame size\n",
484 		    sc->sc_dv.dv_xname));
485 		return (EINVAL);
486 	}
487 
488 	/*
489 	 * Handle special commands.
490 	 */
491 	switch (mh.msgfunc >> 24) {
492 	case I2O_EXEC_IOP_RESET:
493 		printf("%s: I2O_EXEC_IOP_RESET not implemented\n",
494 		    sc->sc_dv.dv_xname);
495 		return (EOPNOTSUPP);
496 
497 	case I2O_EXEC_OUTBOUND_INIT:
498 		printf("%s: I2O_EXEC_OUTBOUND_INIT not implemented\n",
499 		    sc->sc_dv.dv_xname);
500 		return (EOPNOTSUPP);
501 
502 	case I2O_EXEC_SYS_TAB_SET:
503 		printf("%s: I2O_EXEC_SYS_TAB_SET not implemented\n",
504 		    sc->sc_dv.dv_xname);
505 		return (EOPNOTSUPP);
506 
507 	case I2O_EXEC_STATUS_GET:
508 		if ((rv = iop_status_get(iop, 0)) == 0)
509 			rv = copyout(&iop->sc_status, data + msgsize,
510 			    sizeof(iop->sc_status));
511 		return (rv);
512 	}
513 
514 	/*
515 	 * Copy in the full message frame.
516 	 */
517 	if ((rv = copyin(data, mbtmp, msgsize)) != 0) {
518 		DPRINTF(("%s: full message copyin failed\n",
519 		    sc->sc_dv.dv_xname));
520 		return (rv);
521 	}
522 
523 	/*
524 	 * Determine the size of the reply frame, and copy it in.
525 	 */
526 	if ((rv = copyin(data + msgsize, &rh, sizeof(rh))) != 0) {
527 		DPRINTF(("%s: reply copyin failed\n",
528 		    sc->sc_dv.dv_xname));
529 		return (rv);
530 	}
531 
532 	repsize = (rh.msgflags >> 14) & ~3;
533 	if (repsize < sizeof(rh) || repsize >= IOP_MAX_MSG_SIZE) {
534 		DPRINTF(("%s: bad reply header size\n",
535 		    sc->sc_dv.dv_xname));
536 		return (EINVAL);
537 	}
538 
539 	if ((rv = copyin(data + msgsize, rbtmp, repsize)) != 0) {
540 		DPRINTF(("%s: reply too large\n", sc->sc_dv.dv_xname));
541 		return (rv);
542 	}
543 
544 	/*
545 	 * If the message has a scatter gather list, it must be comprised of
546 	 * simple elements.  If any one transfer contains multiple segments,
547 	 * we allocate a temporary buffer for it; otherwise, the buffer will
548 	 * be mapped directly.
549 	 */
550 	if ((sgoff = ((mh.msgflags >> 4) & 15)) != 0) {
551 		if ((sgoff + 2) > (msgsize >> 2)) {
552 			DPRINTF(("%s: invalid message size fields\n",
553 			    sc->sc_dv.dv_xname));
554 			return (EINVAL);
555 		}
556 
557 		memset(bufs, 0, sizeof(bufs));
558 
559 		p = mbtmp + sgoff;
560 		pmax = mbtmp + (msgsize >> 2) - 2;
561 
562 		for (nbuf = 0; nbuf < IOP_MAX_MSG_XFERS; nbuf++, p += 2) {
563 			if (p > pmax) {
564 				DPRINTF(("%s: invalid SGL (1)\n",
565 				    sc->sc_dv.dv_xname));
566 				goto bad;
567 			}
568 
569 			if ((p[0] & 0x30000000) != I2O_SGL_SIMPLE) {
570 				DPRINTF(("%s: invalid SGL (2)\n",
571 				    sc->sc_dv.dv_xname));
572 				goto bad;
573 			}
574 
575 			bufs[nbuf].db_out = (p[0] & I2O_SGL_DATA_OUT) != 0;
576 			bufs[nbuf].db_ptr = NULL;
577 
578 			if ((p[0] & I2O_SGL_END_BUFFER) != 0) {
579 				if ((p[0] & 0x00ffffff) > IOP_MAX_XFER) {
580 					DPRINTF(("%s: buffer too large\n",
581 					    sc->sc_dv.dv_xname));
582 					goto bad;
583 				}
584 
585 				bufs[nbuf].db_ptr = (caddr_t)p[1];
586 				bufs[nbuf].db_proc = proc;
587 				bufs[nbuf].db_size = p[0] & 0x00ffffff;
588 
589 				if ((p[0] & I2O_SGL_END) != 0)
590 					break;
591 
592 				continue;
593 			}
594 
595 			/*
596 			 * The buffer has multiple segments.  Determine the
597 			 * total size.
598 			 */
599 			nfrag = 0;
600 			sz = 0;
601 			for (; p <= pmax; p += 2) {
602 				if (nfrag == DPTI_MAX_SEGS) {
603 					DPRINTF(("%s: too many segments\n",
604 					    sc->sc_dv.dv_xname));
605 					goto bad;
606 				}
607 
608 				bufs[nbuf].db_frags[nfrag].iov_len =
609 				    p[0] & 0x00ffffff;
610 				bufs[nbuf].db_frags[nfrag].iov_base =
611 				    (void *)p[1];
612 
613 				sz += p[0] & 0x00ffffff;
614 				nfrag++;
615 
616 				if ((p[0] & I2O_SGL_END) != 0) {
617 					if ((p[0] & I2O_SGL_END_BUFFER) == 0) {
618 						DPRINTF((
619 						    "%s: invalid SGL (3)\n",
620 						    sc->sc_dv.dv_xname));
621 						goto bad;
622 					}
623 					break;
624 				}
625 				if ((p[0] & I2O_SGL_END_BUFFER) != 0)
626 					break;
627 			}
628 			bufs[nbuf].db_nfrag = nfrag;
629 
630 			if (p > pmax) {
631 				DPRINTF(("%s: invalid SGL (4)\n",
632 				    sc->sc_dv.dv_xname));
633 				goto bad;
634 			}
635 
636 			if (sz > IOP_MAX_XFER) {
637 				DPRINTF(("%s: buffer too large\n",
638 				    sc->sc_dv.dv_xname));
639 				goto bad;
640 			}
641 
642 			bufs[nbuf].db_size = sz;
643 			bufs[nbuf].db_ptr = malloc(sz, M_DEVBUF, M_WAITOK);
644 			if (bufs[nbuf].db_ptr == NULL) {
645 				DPRINTF(("%s: allocation failure\n",
646 				    sc->sc_dv.dv_xname));
647 				rv = ENOMEM;
648 				goto bad;
649 			}
650 
651 			for (i = 0, sz = 0; i < bufs[nbuf].db_nfrag; i++) {
652 				rv = copyin(bufs[nbuf].db_frags[i].iov_base,
653 				    bufs[nbuf].db_ptr + sz,
654 				    bufs[nbuf].db_frags[i].iov_len);
655 				if (rv != 0) {
656 					DPRINTF(("%s: frag copyin\n",
657 					    sc->sc_dv.dv_xname));
658 					goto bad;
659 				}
660 				sz += bufs[nbuf].db_frags[i].iov_len;
661 			}
662 
663 			if ((p[0] & I2O_SGL_END) != 0)
664 				break;
665 		}
666 
667 		if (nbuf == IOP_MAX_MSG_XFERS) {
668 			DPRINTF(("%s: too many transfers\n",
669 			    sc->sc_dv.dv_xname));
670 			goto bad;
671 		}
672 	} else
673 		nbuf = -1;
674 
675 	/*
676 	 * Allocate a wrapper, and adjust the message header fields to
677 	 * indicate that no scatter-gather list is currently present.
678 	 */
679 	mapped = 0;
680 
681 	im = iop_msg_alloc(iop, IM_WAIT | IM_NOSTATUS);
682 	im->im_rb = (struct i2o_reply *)rbtmp;
683 	mf = (struct i2o_msg *)mbtmp;
684 	mf->msgictx = IOP_ICTX;
685 	mf->msgtctx = im->im_tctx;
686 
687 	if (sgoff != 0)
688 		mf->msgflags = (mf->msgflags & 0xff0f) | (sgoff << 16);
689 
690 	/*
691 	 * Map the data transfer(s).
692 	 */
693 	for (i = 0; i <= nbuf; i++) {
694 		rv = iop_msg_map(iop, im, mbtmp, bufs[i].db_ptr,
695 		    bufs[i].db_size, bufs[i].db_out, bufs[i].db_proc);
696 		if (rv != 0) {
697 			DPRINTF(("%s: msg_map failed, rv = %d\n",
698 			    sc->sc_dv.dv_xname, rv));
699 			goto bad;
700 		}
701 		mapped = 1;
702 	}
703 
704 	/*
705 	 * Start the command and sleep until it completes.
706 	 */
707 	if ((rv = iop_msg_post(iop, im, mbtmp, 5*60*1000)) != 0)
708 		goto bad;
709 
710 	/*
711 	 * Copy out the reply frame.
712 	 */
713 	if ((rv = copyout(rbtmp, data + msgsize, repsize)) != 0)
714 		DPRINTF(("%s: reply copyout() failed\n",
715 		    sc->sc_dv.dv_xname));
716 
717  bad:
718 	/*
719 	 * Free resources and return to the caller.
720 	 */
721 	if (im != NULL) {
722 		if (mapped)
723 			iop_msg_unmap(iop, im);
724 		iop_msg_free(iop, im);
725 	}
726 
727 	for (i = 0; i <= nbuf; i++) {
728 		if (bufs[i].db_proc != NULL)
729 			continue;
730 
731 		if (!bufs[i].db_out && rv == 0) {
732 			for (j = 0, sz = 0; j < bufs[i].db_nfrag; j++) {
733 				rv = copyout(bufs[i].db_ptr + sz,
734 				    bufs[i].db_frags[j].iov_base,
735 				    bufs[i].db_frags[j].iov_len);
736 				if (rv != 0)
737 					break;
738 				sz += bufs[i].db_frags[j].iov_len;
739 			}
740 		}
741 
742 		if (bufs[i].db_ptr != NULL)
743 			free(bufs[i].db_ptr, M_DEVBUF);
744 	}
745 
746 	return (rv);
747 }
748