xref: /netbsd-src/sys/dev/i2o/dpti.c (revision 46f5119e40af2e51998f686b2fdcc76b5488f7f3)
1 /*	$NetBSD: dpti.c,v 1.43 2010/11/13 13:51:59 uebayasi Exp $	*/
2 
3 /*-
4  * Copyright (c) 2001, 2007 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Andrew Doran.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29  * POSSIBILITY OF SUCH DAMAGE.
30  */
31 
32 /*
33  * Copyright (c) 1996-2000 Distributed Processing Technology Corporation
34  * Copyright (c) 2000 Adaptec Corporation
35  * All rights reserved.
36  *
37  * TERMS AND CONDITIONS OF USE
38  *
39  * Redistribution and use in source form, with or without modification, are
40  * permitted provided that redistributions of source code must retain the
41  * above copyright notice, this list of conditions and the following disclaimer.
42  *
43  * This software is provided `as is' by Adaptec and any express or implied
44  * warranties, including, but not limited to, the implied warranties of
45  * merchantability and fitness for a particular purpose, are disclaimed. In no
46  * event shall Adaptec be liable for any direct, indirect, incidental, special,
47  * exemplary or consequential damages (including, but not limited to,
48  * procurement of substitute goods or services; loss of use, data, or profits;
49  * or business interruptions) however caused and on any theory of liability,
50  * whether in contract, strict liability, or tort (including negligence or
51  * otherwise) arising in any way out of the use of this driver software, even
52  * if advised of the possibility of such damage.
53  */
54 
55 /*
56  * Adaptec/DPT I2O control interface.
57  */
58 
59 #include <sys/cdefs.h>
60 __KERNEL_RCSID(0, "$NetBSD: dpti.c,v 1.43 2010/11/13 13:51:59 uebayasi Exp $");
61 
62 #include <sys/param.h>
63 #include <sys/systm.h>
64 #include <sys/kernel.h>
65 #include <sys/device.h>
66 #include <sys/queue.h>
67 #include <sys/proc.h>
68 #include <sys/endian.h>
69 #include <sys/malloc.h>
70 #include <sys/conf.h>
71 #include <sys/ioctl.h>
72 #include <sys/kauth.h>
73 
74 #include <sys/bus.h>
75 #ifdef __i386__
76 #include <machine/pio.h>
77 #include <machine/cputypes.h>
78 #endif
79 
80 #include <dev/i2o/i2o.h>
81 #include <dev/i2o/i2odpt.h>
82 #include <dev/i2o/iopio.h>
83 #include <dev/i2o/iopvar.h>
84 #include <dev/i2o/dptivar.h>
85 
86 #ifdef I2ODEBUG
87 #define	DPRINTF(x)		printf x
88 #else
89 #define	DPRINTF(x)
90 #endif
91 
92 static struct dpt_sig dpti_sig = {
93 	{ 'd', 'P', 't', 'S', 'i', 'G'},
94 	SIG_VERSION,
95 #if defined(__i386__)
96 	PROC_INTEL,
97 #elif defined(__powerpc__)
98 	PROC_POWERPC,
99 #elif defined(__alpha__)
100 	PROC_ALPHA,
101 #elif defined(__mips__)
102 	PROC_MIPS,
103 #elif defined(__sparc64__)
104 	PROC_ULTRASPARC,
105 #endif
106 #if defined(__i386__)
107 	PROC_386 | PROC_486 | PROC_PENTIUM | PROC_SEXIUM,
108 #else
109 	0,
110 #endif
111 	FT_HBADRVR,
112 	0,
113 	OEM_DPT,
114 	OS_FREE_BSD,	/* XXX */
115 	CAP_ABOVE16MB,
116 	DEV_ALL,
117 	ADF_ALL_SC5,
118 	0,
119 	0,
120 	DPTI_VERSION,
121 	DPTI_REVISION,
122 	DPTI_SUBREVISION,
123 	DPTI_MONTH,
124 	DPTI_DAY,
125 	DPTI_YEAR,
126 	""		/* Will be filled later */
127 };
128 
129 void	dpti_attach(device_t, device_t, void *);
130 int	dpti_blinkled(struct dpti_softc *);
131 int	dpti_ctlrinfo(struct dpti_softc *, int, void *);
132 int	dpti_match(device_t, cfdata_t, void *);
133 int	dpti_passthrough(struct dpti_softc *, void *, struct proc *);
134 int	dpti_sysinfo(struct dpti_softc *, int, void *);
135 
136 dev_type_open(dptiopen);
137 dev_type_ioctl(dptiioctl);
138 
139 const struct cdevsw dpti_cdevsw = {
140 	dptiopen, nullclose, noread, nowrite, dptiioctl,
141 	nostop, notty, nopoll, nommap, nokqfilter, D_OTHER,
142 };
143 
144 extern struct cfdriver dpti_cd;
145 
146 CFATTACH_DECL(dpti, sizeof(struct dpti_softc),
147     dpti_match, dpti_attach, NULL, NULL);
148 
149 int
150 dpti_match(device_t parent, cfdata_t match, void *aux)
151 {
152 	struct iop_attach_args *ia;
153 	struct iop_softc *iop;
154 
155 	ia = aux;
156 	iop = (struct iop_softc *)parent;
157 
158 	if (ia->ia_class != I2O_CLASS_ANY || ia->ia_tid != I2O_TID_IOP)
159 		return (0);
160 
161 	if (le16toh(iop->sc_status.orgid) != I2O_ORG_DPT)
162 		return (0);
163 
164 	return (1);
165 }
166 
167 void
168 dpti_attach(device_t parent, device_t self, void *aux)
169 {
170 	struct iop_softc *iop;
171 	struct dpti_softc *sc;
172 	struct {
173 		struct	i2o_param_op_results pr;
174 		struct	i2o_param_read_results prr;
175 		struct	i2o_dpt_param_exec_iop_buffers dib;
176 	} __packed param;
177 	int rv;
178 
179 	sc = device_private(self);
180 	iop = device_private(parent);
181 
182 	/*
183 	 * Tell the world what we are.  The description in the signature
184 	 * must be no more than 46 bytes long (see dptivar.h).
185 	 */
186 	printf(": DPT/Adaptec RAID management interface\n");
187 	snprintf(dpti_sig.dsDescription, sizeof(dpti_sig.dsDescription),
188 	    "NetBSD %s I2O OSM", osrelease);
189 
190 	rv = iop_field_get_all(iop, I2O_TID_IOP,
191 	    I2O_DPT_PARAM_EXEC_IOP_BUFFERS, &param,
192 	    sizeof(param), NULL);
193 	if (rv != 0)
194 		return;
195 
196 	sc->sc_blinkled = le32toh(param.dib.serialoutputoff) + 8;
197 }
198 
199 int
200 dptiopen(dev_t dev, int flag, int mode,
201     struct lwp *l)
202 {
203 
204 	if (device_lookup(&dpti_cd, minor(dev)) == NULL)
205 		return (ENXIO);
206 
207 	return (0);
208 }
209 
210 int
211 dptiioctl(dev_t dev, u_long cmd, void *data, int flag, struct lwp *l)
212 {
213 	struct iop_softc *iop;
214 	struct dpti_softc *sc;
215 	struct ioctl_pt *pt;
216 	int i, size, rv, linux;
217 
218 	sc = device_lookup_private(&dpti_cd, minor(dev));
219 	iop = (struct iop_softc *)device_parent(&sc->sc_dv);
220 	rv = 0;
221 
222 	if (cmd == PTIOCLINUX) {
223 		pt = (struct ioctl_pt *)data;
224 		size = IOCPARM_LEN(pt->com);
225 		cmd = pt->com & 0xffff;
226 		data = pt->data;
227 		linux = 1;
228 	} else {
229 		size = IOCPARM_LEN(cmd);
230 		cmd = cmd & 0xffff;
231 		linux = 0;
232 	}
233 
234 	switch (cmd) {
235 	case DPT_SIGNATURE:
236 		if (size > sizeof(dpti_sig))
237 			size = sizeof(dpti_sig);
238 		memcpy(data, &dpti_sig, size);
239 		break;
240 
241 	case DPT_CTRLINFO:
242 		rv = dpti_ctlrinfo(sc, size, data);
243 		break;
244 
245 	case DPT_SYSINFO:
246 		rv = dpti_sysinfo(sc, size, data);
247 		break;
248 
249 	case DPT_BLINKLED:
250 		if ((i = dpti_blinkled(sc)) == -1)
251 			i = 0;
252 
253 		if (size == 0) {
254 			rv = copyout(&i, *(void **)data, sizeof(i));
255 			break;
256 		}
257 
258 		*(int *)data = i;
259 		break;
260 
261 	case DPT_TARGET_BUSY:
262 		/*
263 		 * XXX This is here to stop linux_machdepioctl() from
264 		 * whining about an unknown ioctl.
265 		 */
266 		rv = EIO;
267 		break;
268 
269 	case DPT_I2OUSRCMD:
270 		rv = kauth_authorize_device_passthru(l->l_cred, dev,
271 		    KAUTH_REQ_DEVICE_RAWIO_PASSTHRU_ALL, data);
272 		if (rv)
273 			break;
274 
275 		if (sc->sc_nactive++ >= 2)
276 			tsleep(&sc->sc_nactive, PRIBIO, "dptislp", 0);
277 
278 		if (linux)
279 			rv = dpti_passthrough(sc, data, l->l_proc);
280 		else
281 			rv = dpti_passthrough(sc, *(void **)data, l->l_proc);
282 
283 		sc->sc_nactive--;
284 		wakeup_one(&sc->sc_nactive);
285 		break;
286 
287 	case DPT_I2ORESETCMD:
288 		printf("%s: I2ORESETCMD not implemented\n",
289 		    device_xname(&sc->sc_dv));
290 		rv = EOPNOTSUPP;
291 		break;
292 
293 	case DPT_I2ORESCANCMD:
294 		mutex_enter(&iop->sc_conflock);
295 		rv = iop_reconfigure(iop, 0);
296 		mutex_exit(&iop->sc_conflock);
297 		break;
298 
299 	default:
300 		rv = ENOTTY;
301 		break;
302 	}
303 
304 	return (rv);
305 }
306 
307 int
308 dpti_blinkled(struct dpti_softc *sc)
309 {
310 	struct iop_softc *iop;
311 	u_int v;
312 
313 	iop = (struct iop_softc *)device_parent(&sc->sc_dv);
314 
315 	v = bus_space_read_1(iop->sc_iot, iop->sc_ioh, sc->sc_blinkled + 0);
316 	if (v == 0xbc) {
317 		v = bus_space_read_1(iop->sc_iot, iop->sc_ioh,
318 		    sc->sc_blinkled + 1);
319 		return (v);
320 	}
321 
322 	return (-1);
323 }
324 
325 int
326 dpti_ctlrinfo(struct dpti_softc *sc, int size, void *data)
327 {
328 	struct dpt_ctlrinfo info;
329 	struct iop_softc *iop;
330 	int rv, i;
331 
332 	iop = (struct iop_softc *)device_parent(&sc->sc_dv);
333 
334 	memset(&info, 0, sizeof(info));
335 
336 	info.length = sizeof(info) - sizeof(u_int16_t);
337 	info.drvrHBAnum = device_unit(&sc->sc_dv);
338 	info.baseAddr = iop->sc_memaddr;
339 	if ((i = dpti_blinkled(sc)) == -1)
340 		i = 0;
341 	info.blinkState = i;
342 	info.pciBusNum = iop->sc_pcibus;
343 	info.pciDeviceNum = iop->sc_pcidev;
344 	info.hbaFlags = FLG_OSD_PCI_VALID | FLG_OSD_DMA | FLG_OSD_I2O;
345 	info.Interrupt = 10;			/* XXX */
346 
347 	if (size > sizeof(char)) {
348 		memcpy(data, &info, min(sizeof(info), size));
349 		rv = 0;
350 	} else
351 		rv = copyout(&info, *(void **)data, sizeof(info));
352 
353 	return (rv);
354 }
355 
356 int
357 dpti_sysinfo(struct dpti_softc *sc, int size, void *data)
358 {
359 	struct dpt_sysinfo info;
360 	int rv;
361 #ifdef __i386__
362 	int i, j;
363 #endif
364 
365 	memset(&info, 0, sizeof(info));
366 
367 #ifdef __i386__
368 	outb (0x70, 0x12);
369 	i = inb(0x71);
370 	j = i >> 4;
371 	if (i == 0x0f) {
372 		outb (0x70, 0x19);
373 		j = inb (0x71);
374 	}
375 	info.drive0CMOS = j;
376 
377 	j = i & 0x0f;
378 	if (i == 0x0f) {
379 		outb (0x70, 0x1a);
380 		j = inb (0x71);
381 	}
382 	info.drive1CMOS = j;
383 	info.processorFamily = dpti_sig.dsProcessorFamily;
384 
385 	/*
386 	 * Get the conventional memory size from CMOS.
387 	 */
388 	outb(0x70, 0x16);
389 	j = inb(0x71);
390 	j <<= 8;
391 	outb(0x70, 0x15);
392 	j |= inb(0x71);
393 	info.conventionalMemSize = j;
394 
395 	/*
396 	 * Get the extended memory size from CMOS.
397 	 */
398 	outb(0x70, 0x31);
399 	j = inb(0x71);
400 	j <<= 8;
401 	outb(0x70, 0x30);
402 	j |= inb(0x71);
403 	info.extendedMemSize = j;
404 
405 	switch (cpu_class) {
406 	case CPUCLASS_386:
407 		info.processorType = PROC_386;
408 		break;
409 	case CPUCLASS_486:
410 		info.processorType = PROC_486;
411 		break;
412 	case CPUCLASS_586:
413 		info.processorType = PROC_PENTIUM;
414 		break;
415 	case CPUCLASS_686:
416 	default:
417 		info.processorType = PROC_SEXIUM;
418 		break;
419 	}
420 
421 	info.flags = SI_CMOS_Valid | SI_BusTypeValid |
422 	    SI_MemorySizeValid | SI_NO_SmartROM;
423 #else
424 	info.flags = SI_BusTypeValid | SI_NO_SmartROM;
425 #endif
426 
427 	info.busType = SI_PCI_BUS;
428 
429 	/*
430 	 * Copy out the info structure to the user.
431 	 */
432 	if (size > sizeof(char)) {
433 		memcpy(data, &info, min(sizeof(info), size));
434 		rv = 0;
435 	} else
436 		rv = copyout(&info, *(void **)data, sizeof(info));
437 
438 	return (rv);
439 }
440 
441 int
442 dpti_passthrough(struct dpti_softc *sc, void *data, struct proc *proc)
443 {
444 	struct iop_softc *iop;
445 	struct i2o_msg mh, *mf;
446 	struct i2o_reply rh;
447 	struct iop_msg *im;
448 	struct dpti_ptbuf bufs[IOP_MAX_MSG_XFERS];
449 	u_int32_t mbtmp[IOP_MAX_MSG_SIZE / sizeof(u_int32_t)];
450 	u_int32_t rbtmp[IOP_MAX_MSG_SIZE / sizeof(u_int32_t)];
451 	int rv, msgsize, repsize, sgoff, i, mapped, nbuf, nfrag, j, sz;
452 	u_int32_t *p, *pmax;
453 
454 	iop = (struct iop_softc *)device_parent(&sc->sc_dv);
455 	im = NULL;
456 
457 	if ((rv = dpti_blinkled(sc)) != -1) {
458 		if (rv != 0) {
459 			aprint_error_dev(&sc->sc_dv, "adapter blinkled = 0x%02x\n", rv);
460 			return (EIO);
461 		}
462 	}
463 
464 	/*
465 	 * Copy in the message frame header and determine the size of the
466 	 * full message frame.
467 	 */
468 	if ((rv = copyin(data, &mh, sizeof(mh))) != 0) {
469 		DPRINTF(("%s: message copyin failed\n",
470 		    device_xname(&sc->sc_dv)));
471 		return (rv);
472 	}
473 
474 	msgsize = (mh.msgflags >> 14) & ~3;
475 	if (msgsize < sizeof(mh) || msgsize >= IOP_MAX_MSG_SIZE) {
476 		DPRINTF(("%s: bad message frame size\n",
477 		    device_xname(&sc->sc_dv)));
478 		return (EINVAL);
479 	}
480 
481 	/*
482 	 * Handle special commands.
483 	 */
484 	switch (mh.msgfunc >> 24) {
485 	case I2O_EXEC_IOP_RESET:
486 		printf("%s: I2O_EXEC_IOP_RESET not implemented\n",
487 		    device_xname(&sc->sc_dv));
488 		return (EOPNOTSUPP);
489 
490 	case I2O_EXEC_OUTBOUND_INIT:
491 		printf("%s: I2O_EXEC_OUTBOUND_INIT not implemented\n",
492 		    device_xname(&sc->sc_dv));
493 		return (EOPNOTSUPP);
494 
495 	case I2O_EXEC_SYS_TAB_SET:
496 		printf("%s: I2O_EXEC_SYS_TAB_SET not implemented\n",
497 		    device_xname(&sc->sc_dv));
498 		return (EOPNOTSUPP);
499 
500 	case I2O_EXEC_STATUS_GET:
501 		if ((rv = iop_status_get(iop, 0)) == 0)
502 			rv = copyout(&iop->sc_status, (char *)data + msgsize,
503 			    sizeof(iop->sc_status));
504 		return (rv);
505 	}
506 
507 	/*
508 	 * Copy in the full message frame.
509 	 */
510 	if ((rv = copyin(data, mbtmp, msgsize)) != 0) {
511 		DPRINTF(("%s: full message copyin failed\n",
512 		    device_xname(&sc->sc_dv)));
513 		return (rv);
514 	}
515 
516 	/*
517 	 * Determine the size of the reply frame, and copy it in.
518 	 */
519 	if ((rv = copyin((char *)data + msgsize, &rh, sizeof(rh))) != 0) {
520 		DPRINTF(("%s: reply copyin failed\n",
521 		    device_xname(&sc->sc_dv)));
522 		return (rv);
523 	}
524 
525 	repsize = (rh.msgflags >> 14) & ~3;
526 	if (repsize < sizeof(rh) || repsize >= IOP_MAX_MSG_SIZE) {
527 		DPRINTF(("%s: bad reply header size\n",
528 		    device_xname(&sc->sc_dv)));
529 		return (EINVAL);
530 	}
531 
532 	if ((rv = copyin((char *)data + msgsize, rbtmp, repsize)) != 0) {
533 		DPRINTF(("%s: reply too large\n", device_xname(&sc->sc_dv)));
534 		return (rv);
535 	}
536 
537 	/*
538 	 * If the message has a scatter gather list, it must be comprised of
539 	 * simple elements.  If any one transfer contains multiple segments,
540 	 * we allocate a temporary buffer for it; otherwise, the buffer will
541 	 * be mapped directly.
542 	 */
543 	mapped = 0;
544 	if ((sgoff = ((mh.msgflags >> 4) & 15)) != 0) {
545 		if ((sgoff + 2) > (msgsize >> 2)) {
546 			DPRINTF(("%s: invalid message size fields\n",
547 			    device_xname(&sc->sc_dv)));
548 			return (EINVAL);
549 		}
550 
551 		memset(bufs, 0, sizeof(bufs));
552 
553 		p = mbtmp + sgoff;
554 		pmax = mbtmp + (msgsize >> 2) - 2;
555 
556 		for (nbuf = 0; nbuf < IOP_MAX_MSG_XFERS; nbuf++, p += 2) {
557 			if (p > pmax) {
558 				DPRINTF(("%s: invalid SGL (1)\n",
559 				    device_xname(&sc->sc_dv)));
560 				goto bad;
561 			}
562 
563 			if ((p[0] & 0x30000000) != I2O_SGL_SIMPLE) {
564 				DPRINTF(("%s: invalid SGL (2)\n",
565 				    device_xname(&sc->sc_dv)));
566 				goto bad;
567 			}
568 
569 			bufs[nbuf].db_out = (p[0] & I2O_SGL_DATA_OUT) != 0;
570 			bufs[nbuf].db_ptr = NULL;
571 
572 			if ((p[0] & I2O_SGL_END_BUFFER) != 0) {
573 				if ((p[0] & 0x00ffffff) > IOP_MAX_XFER) {
574 					DPRINTF(("%s: buffer too large\n",
575 					    device_xname(&sc->sc_dv)));
576 					goto bad;
577 				}
578 
579 				bufs[nbuf].db_ptr = (void *)p[1];
580 				bufs[nbuf].db_proc = proc;
581 				bufs[nbuf].db_size = p[0] & 0x00ffffff;
582 
583 				if ((p[0] & I2O_SGL_END) != 0)
584 					break;
585 
586 				continue;
587 			}
588 
589 			/*
590 			 * The buffer has multiple segments.  Determine the
591 			 * total size.
592 			 */
593 			nfrag = 0;
594 			sz = 0;
595 			for (; p <= pmax; p += 2) {
596 				if (nfrag == DPTI_MAX_SEGS) {
597 					DPRINTF(("%s: too many segments\n",
598 					    device_xname(&sc->sc_dv)));
599 					goto bad;
600 				}
601 
602 				bufs[nbuf].db_frags[nfrag].iov_len =
603 				    p[0] & 0x00ffffff;
604 				bufs[nbuf].db_frags[nfrag].iov_base =
605 				    (void *)p[1];
606 
607 				sz += p[0] & 0x00ffffff;
608 				nfrag++;
609 
610 				if ((p[0] & I2O_SGL_END) != 0) {
611 					if ((p[0] & I2O_SGL_END_BUFFER) == 0) {
612 						DPRINTF((
613 						    "%s: invalid SGL (3)\n",
614 						    device_xname(&sc->sc_dv)));
615 						goto bad;
616 					}
617 					break;
618 				}
619 				if ((p[0] & I2O_SGL_END_BUFFER) != 0)
620 					break;
621 			}
622 			bufs[nbuf].db_nfrag = nfrag;
623 
624 			if (p > pmax) {
625 				DPRINTF(("%s: invalid SGL (4)\n",
626 				    device_xname(&sc->sc_dv)));
627 				goto bad;
628 			}
629 
630 			if (sz > IOP_MAX_XFER) {
631 				DPRINTF(("%s: buffer too large\n",
632 				    device_xname(&sc->sc_dv)));
633 				goto bad;
634 			}
635 
636 			bufs[nbuf].db_size = sz;
637 			bufs[nbuf].db_ptr = malloc(sz, M_DEVBUF, M_WAITOK);
638 			if (bufs[nbuf].db_ptr == NULL) {
639 				DPRINTF(("%s: allocation failure\n",
640 				    device_xname(&sc->sc_dv)));
641 				rv = ENOMEM;
642 				goto bad;
643 			}
644 
645 			for (i = 0, sz = 0; i < bufs[nbuf].db_nfrag; i++) {
646 				rv = copyin(bufs[nbuf].db_frags[i].iov_base,
647 				    (char *)bufs[nbuf].db_ptr + sz,
648 				    bufs[nbuf].db_frags[i].iov_len);
649 				if (rv != 0) {
650 					DPRINTF(("%s: frag copyin\n",
651 					    device_xname(&sc->sc_dv)));
652 					goto bad;
653 				}
654 				sz += bufs[nbuf].db_frags[i].iov_len;
655 			}
656 
657 			if ((p[0] & I2O_SGL_END) != 0)
658 				break;
659 		}
660 
661 		if (nbuf == IOP_MAX_MSG_XFERS) {
662 			DPRINTF(("%s: too many transfers\n",
663 			    device_xname(&sc->sc_dv)));
664 			goto bad;
665 		}
666 	} else
667 		nbuf = -1;
668 
669 	/*
670 	 * Allocate a wrapper, and adjust the message header fields to
671 	 * indicate that no scatter-gather list is currently present.
672 	 */
673 
674 	im = iop_msg_alloc(iop, IM_WAIT | IM_NOSTATUS);
675 	im->im_rb = (struct i2o_reply *)rbtmp;
676 	mf = (struct i2o_msg *)mbtmp;
677 	mf->msgictx = IOP_ICTX;
678 	mf->msgtctx = im->im_tctx;
679 
680 	if (sgoff != 0)
681 		mf->msgflags = (mf->msgflags & 0xff0f) | (sgoff << 16);
682 
683 	/*
684 	 * Map the data transfer(s).
685 	 */
686 	for (i = 0; i <= nbuf; i++) {
687 		rv = iop_msg_map(iop, im, mbtmp, bufs[i].db_ptr,
688 		    bufs[i].db_size, bufs[i].db_out, bufs[i].db_proc);
689 		if (rv != 0) {
690 			DPRINTF(("%s: msg_map failed, rv = %d\n",
691 			    device_xname(&sc->sc_dv), rv));
692 			goto bad;
693 		}
694 		mapped = 1;
695 	}
696 
697 	/*
698 	 * Start the command and sleep until it completes.
699 	 */
700 	if ((rv = iop_msg_post(iop, im, mbtmp, 5*60*1000)) != 0)
701 		goto bad;
702 
703 	/*
704 	 * Copy out the reply frame.
705 	 */
706 	if ((rv = copyout(rbtmp, (char *)data + msgsize, repsize)) != 0) {
707 		DPRINTF(("%s: reply copyout() failed\n",
708 		    device_xname(&sc->sc_dv)));
709 	}
710 
711  bad:
712 	/*
713 	 * Free resources and return to the caller.
714 	 */
715 	if (im != NULL) {
716 		if (mapped)
717 			iop_msg_unmap(iop, im);
718 		iop_msg_free(iop, im);
719 	}
720 
721 	for (i = 0; i <= nbuf; i++) {
722 		if (bufs[i].db_proc != NULL)
723 			continue;
724 
725 		if (!bufs[i].db_out && rv == 0) {
726 			for (j = 0, sz = 0; j < bufs[i].db_nfrag; j++) {
727 				rv = copyout((char *)bufs[i].db_ptr + sz,
728 				    bufs[i].db_frags[j].iov_base,
729 				    bufs[i].db_frags[j].iov_len);
730 				if (rv != 0)
731 					break;
732 				sz += bufs[i].db_frags[j].iov_len;
733 			}
734 		}
735 
736 		if (bufs[i].db_ptr != NULL)
737 			free(bufs[i].db_ptr, M_DEVBUF);
738 	}
739 
740 	return (rv);
741 }
742