xref: /netbsd-src/sys/dev/i2o/dpti.c (revision 8a8f936f250a330d54f8a24ed0e92aadf9743a7b)
1 /*	$NetBSD: dpti.c,v 1.2 2001/09/27 18:43:37 ad Exp $	*/
2 
3 /*-
4  * Copyright (c) 2001 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Andrew Doran.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. All advertising materials mentioning features or use of this software
19  *    must display the following acknowledgement:
20  *        This product includes software developed by the NetBSD
21  *        Foundation, Inc. and its contributors.
22  * 4. Neither the name of The NetBSD Foundation nor the names of its
23  *    contributors may be used to endorse or promote products derived
24  *    from this software without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
27  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
28  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
29  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
30  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
31  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
32  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
33  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
34  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
35  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
36  * POSSIBILITY OF SUCH DAMAGE.
37  */
38 
39 /*
40  * Copyright (c) 1996-2000 Distributed Processing Technology Corporation
41  * Copyright (c) 2000 Adaptec Corporation
42  * All rights reserved.
43  *
44  * TERMS AND CONDITIONS OF USE
45  *
46  * Redistribution and use in source form, with or without modification, are
47  * permitted provided that redistributions of source code must retain the
48  * above copyright notice, this list of conditions and the following disclaimer.
49  *
50  * This software is provided `as is' by Adaptec and any express or implied
51  * warranties, including, but not limited to, the implied warranties of
52  * merchantability and fitness for a particular purpose, are disclaimed. In no
53  * event shall Adaptec be liable for any direct, indirect, incidental, special,
54  * exemplary or consequential damages (including, but not limited to,
55  * procurement of substitute goods or services; loss of use, data, or profits;
56  * or business interruptions) however caused and on any theory of liability,
57  * whether in contract, strict liability, or tort (including negligence or
58  * otherwise) arising in any way out of the use of this driver software, even
59  * if advised of the possibility of such damage.
60  */
61 
62 /*
63  * Adaptec/DPT I2O control interface.
64  */
65 
66 #include "opt_i2o.h"
67 
68 #include <sys/param.h>
69 #include <sys/systm.h>
70 #include <sys/kernel.h>
71 #include <sys/device.h>
72 #include <sys/queue.h>
73 #include <sys/proc.h>
74 #include <sys/endian.h>
75 #include <sys/malloc.h>
76 #include <sys/conf.h>
77 #include <sys/ioctl.h>
78 
79 #include <uvm/uvm_extern.h>
80 
81 #include <machine/bus.h>
82 #ifdef i386
83 #include <machine/pio.h>
84 #endif
85 
86 #include <dev/i2o/i2o.h>
87 #include <dev/i2o/i2odpt.h>
88 #include <dev/i2o/iopio.h>
89 #include <dev/i2o/iopvar.h>
90 #include <dev/i2o/dptivar.h>
91 
92 #ifdef I2ODEBUG
93 #define	DPRINTF(x)		printf x
94 #else
95 #define	DPRINTF(x)
96 #endif
97 
98 static struct dpt_sig dpti_sig = {
99 	{ 'd', 'P', 't', 'S', 'i', 'G'},
100 	SIG_VERSION,
101 #if defined(i386)
102 	PROC_INTEL,
103 #elif defined(powerpc)
104 	PROC_POWERPC,
105 #elif defined(alpha)
106 	PROC_ALPHA,
107 #elif defined(mips)
108 	PROC_MIPS,
109 #elif defined(sparc64)
110 	PROC_ULTRASPARC,
111 #endif
112 #if defined(i386)
113 	PROC_386 | PROC_486 | PROC_PENTIUM | PROC_SEXIUM,
114 #else
115 	0,
116 #endif
117 	FT_HBADRVR,
118 	0,
119 	OEM_DPT,
120 	OS_FREE_BSD,	/* XXX */
121 	CAP_ABOVE16MB,
122 	DEV_ALL,
123 	ADF_ALL_SC5,
124 	0,
125 	0,
126 	DPTI_VERSION,
127 	DPTI_REVISION,
128 	DPTI_SUBREVISION,
129 	DPTI_MONTH,
130 	DPTI_DAY,
131 	DPTI_YEAR,
132 	""		/* Will be filled later */
133 };
134 
135 void	dpti_attach(struct device *, struct device *, void *);
136 int	dpti_blinkled(struct dpti_softc *);
137 int	dpti_ctlrinfo(struct dpti_softc *, u_long, caddr_t);
138 int	dpti_match(struct device *, struct cfdata *, void *);
139 int	dpti_passthrough(struct dpti_softc *, caddr_t, struct proc *);
140 int	dpti_sysinfo(struct dpti_softc *, u_long, caddr_t);
141 
142 cdev_decl(dpti);
143 
144 extern struct cfdriver dpti_cd;
145 
146 struct cfattach dpti_ca = {
147 	sizeof(struct dpti_softc), dpti_match, dpti_attach
148 };
149 
150 int
151 dpti_match(struct device *parent, struct cfdata *match, void *aux)
152 {
153 	struct iop_attach_args *ia;
154 	struct iop_softc *iop;
155 
156 	ia = aux;
157 	iop = (struct iop_softc *)parent;
158 
159 	if (ia->ia_class != I2O_CLASS_ANY || ia->ia_tid != I2O_TID_IOP)
160 		return (0);
161 
162 	if (le16toh(iop->sc_status.orgid) != I2O_ORG_DPT)
163 		return (0);
164 
165 	return (1);
166 }
167 
168 void
169 dpti_attach(struct device *parent, struct device *self, void *aux)
170 {
171 	struct iop_softc *iop;
172 	struct dpti_softc *sc;
173 	struct {
174 		struct	i2o_param_op_results pr;
175 		struct	i2o_param_read_results prr;
176 		struct	i2o_dpt_param_exec_iop_buffers dib;
177 	} __attribute__ ((__packed__)) param;
178 	int rv;
179 
180 	sc = (struct dpti_softc *)self;
181 	iop = (struct iop_softc *)parent;
182 
183 	/*
184 	 * Tell the world what we are.  The description in the signature
185 	 * must be no more than 46 bytes long (see dptivar.h).
186 	 */
187 	printf(": DPT/Adaptec RAID management interface\n");
188 	sprintf(dpti_sig.dsDescription, "NetBSD %s I2O OSM", osrelease);
189 
190 	rv = iop_field_get_all(iop, I2O_TID_IOP,
191 	    I2O_DPT_PARAM_EXEC_IOP_BUFFERS, &param,
192 	    sizeof(param), NULL);
193 	if (rv != 0)
194 		return;
195 
196 	sc->sc_blinkled = le32toh(param.dib.serialoutputoff) + 8;
197 }
198 
199 int
200 dptiopen(dev_t dev, int flag, int mode, struct proc *p)
201 {
202 
203 	if (securelevel > 1)
204 		return (EPERM);
205 	if (device_lookup(&dpti_cd, minor(dev)) == NULL)
206 		return (ENXIO);
207 
208 	return (0);
209 }
210 
211 int
212 dpticlose(dev_t dev, int flag, int mode, struct proc *p)
213 {
214 
215 	return (0);
216 }
217 
218 int
219 dptiioctl(dev_t dev, u_long cmd, caddr_t data, int flag, struct proc *p)
220 {
221 	struct iop_softc *iop;
222 	struct dpti_softc *sc;
223 	struct ioctl_pt *pt;
224 	int i, size, rv;
225 
226 	sc = device_lookup(&dpti_cd, minor(dev));
227 	iop = (struct iop_softc *)sc->sc_dv.dv_parent;
228 
229 	/*
230 	 * Currently, we only take ioctls passed down from the Linux
231 	 * emulation layer.
232 	 */
233 	if (cmd == PTIOCLINUX) {
234 		pt = (struct ioctl_pt *)data;
235 		cmd = pt->com;
236 		data = pt->data;
237 	} else
238 		return (ENOTTY);
239 
240 	size = IOCPARM_LEN(cmd);
241 
242 	switch (cmd & 0xffff) {
243 	case DPT_SIGNATURE:
244 		if (size > sizeof(dpti_sig))
245 			size = sizeof(dpti_sig);
246 		memcpy(data, &dpti_sig, size);
247 		return (0);
248 
249 	case DPT_CTRLINFO:
250 		return (dpti_ctlrinfo(sc, cmd, data));
251 
252 	case DPT_SYSINFO:
253 		return (dpti_sysinfo(sc, cmd, data));
254 
255 	case DPT_BLINKLED:
256 		if ((i = dpti_blinkled(sc)) == -1)
257 			i = 0;
258 
259 		if (size == 0)
260 			return (copyout(&i, *(caddr_t *)data, sizeof(i)));
261 
262 		*(int *)data = i;
263 		return (0);
264 
265 	case DPT_TARGET_BUSY:
266 		/*
267 		 * XXX This is here to stop linux_machdepioctl() from
268 		 * whining about an unknown ioctl.  Really, it should be
269 		 * implemented.
270 		 */
271 		return (EIO);
272 
273 	case DPT_I2OUSRCMD:
274 		if (sc->sc_nactive++ >= 2)
275 			tsleep(&sc->sc_nactive, PRIBIO, "dptislp", 0);
276 
277 		rv = dpti_passthrough(sc, data, p);
278 
279 		sc->sc_nactive--;
280 		wakeup_one(&sc->sc_nactive);
281 		return (rv);
282 
283 	case DPT_I2ORESETCMD:
284 		printf("%s: I2ORESETCMD not implemented\n",
285 		    sc->sc_dv.dv_xname);
286 		return (EOPNOTSUPP);
287 
288 	case DPT_I2ORESCANCMD:
289 		return (iop_reconfigure(iop, 0));
290 
291 	default:
292 		return (ENOTTY);
293 	}
294 }
295 
296 int
297 dpti_blinkled(struct dpti_softc *sc)
298 {
299 	struct iop_softc *iop;
300 	u_int v;
301 
302 	iop = (struct iop_softc *)sc->sc_dv.dv_parent;
303 
304 	v = bus_space_read_1(iop->sc_iot, iop->sc_ioh, sc->sc_blinkled + 0);
305 	if (v == 0xbc) {
306 		v = bus_space_read_1(iop->sc_iot, iop->sc_ioh,
307 		    sc->sc_blinkled + 1);
308 		return (v);
309 	}
310 
311 	return (-1);
312 }
313 
314 int
315 dpti_ctlrinfo(struct dpti_softc *sc, u_long cmd, caddr_t data)
316 {
317 	struct dpt_ctlrinfo info;
318 	struct iop_softc *iop;
319 	int rv, i;
320 
321 	iop = (struct iop_softc *)sc->sc_dv.dv_parent;
322 
323 	memset(&info, 0, sizeof(info));
324 
325 	info.length = sizeof(info) - sizeof(u_int16_t);
326 	info.drvrHBAnum = sc->sc_dv.dv_unit;
327 	info.baseAddr = iop->sc_memaddr;
328 	if ((i = dpti_blinkled(sc)) == -1)
329 		i = 0;
330 	info.blinkState = i;
331 	info.pciBusNum = iop->sc_pcibus;
332 	info.pciDeviceNum = iop->sc_pcidev;
333 	info.hbaFlags = FLG_OSD_PCI_VALID | FLG_OSD_DMA | FLG_OSD_I2O;
334 	info.Interrupt = 10;			/* XXX */
335 
336 	if (IOCPARM_LEN(cmd) > sizeof(*data)) {
337 		memcpy(data, &info, min(sizeof(info), IOCPARM_LEN(cmd)));
338 		rv = 0;
339 	} else
340 		rv = copyout(&info, *(caddr_t *)data, sizeof(info));
341 
342 	return (rv);
343 }
344 
345 int
346 dpti_sysinfo(struct dpti_softc *sc, u_long cmd, caddr_t data)
347 {
348 	struct dpt_sysinfo info;
349 	int rv;
350 #ifdef i386
351 	int i, j;
352 #endif
353 
354 	memset(&info, 0, sizeof(info));
355 
356 #ifdef i386
357 	outb (0x70, 0x12);
358 	i = inb(0x71);
359 	j = i >> 4;
360 	if (i == 0x0f) {
361 		outb (0x70, 0x19);
362 		j = inb (0x71);
363 	}
364 	info.drive0CMOS = j;
365 
366 	j = i & 0x0f;
367 	if (i == 0x0f) {
368 		outb (0x70, 0x1a);
369 		j = inb (0x71);
370 	}
371 	info.drive1CMOS = j;
372 	info.processorFamily = dpti_sig.dsProcessorFamily;
373 
374 	/*
375 	 * Get the conventional memory size from CMOS.
376 	 */
377 	outb(0x70, 0x16);
378 	j = inb(0x71);
379 	j <<= 8;
380 	outb(0x70, 0x15);
381 	j |= inb(0x71);
382 	info.conventionalMemSize = j;
383 
384 	/*
385 	 * Get the extended memory size from CMOS.
386 	 */
387 	outb(0x70, 0x31);
388 	j = inb(0x71);
389 	j <<= 8;
390 	outb(0x70, 0x30);
391 	j |= inb(0x71);
392 	info.extendedMemSize = j;
393 
394 	switch (cpu_class) {
395 	case CPUCLASS_386:
396 		info.processorType = PROC_386;
397 		break;
398 	case CPUCLASS_486:
399 		info.processorType = PROC_486;
400 		break;
401 	case CPUCLASS_586:
402 		info.processorType = PROC_PENTIUM;
403 		break;
404 	case CPUCLASS_686:
405 	default:
406 		info.processorType = PROC_SEXIUM;
407 		break;
408 	}
409 
410 	info.flags = SI_CMOS_Valid | SI_BusTypeValid |
411 	    SI_MemorySizeValid | SI_NO_SmartROM;
412 #else
413 	info.flags = SI_BusTypeValid | SI_NO_SmartROM;
414 #endif
415 
416 	info.busType = SI_PCI_BUS;
417 
418 	/*
419 	 * Copy out the info structure to the user.
420 	 */
421 	if (IOCPARM_LEN(cmd) > sizeof(*data)) {
422 		memcpy(data, &info, min(sizeof(info), IOCPARM_LEN(cmd)));
423 		rv = 0;
424 	} else
425 		rv = copyout(&info, *(caddr_t *)data, sizeof(info));
426 
427 	return (rv);
428 }
429 
430 int
431 dpti_passthrough(struct dpti_softc *sc, caddr_t data, struct proc *proc)
432 {
433 	struct iop_softc *iop;
434 	struct i2o_msg mh, *mf;
435 	struct i2o_reply rh;
436 	struct iop_msg *im;
437 	struct dpti_ptbuf bufs[IOP_MAX_MSG_XFERS];
438 	u_int32_t mbtmp[IOP_MAX_MSG_SIZE / sizeof(u_int32_t)];
439 	u_int32_t rbtmp[IOP_MAX_MSG_SIZE / sizeof(u_int32_t)];
440 	int rv, msgsize, repsize, sgoff, i, mapped, nbuf, nfrag, j, sz;
441 	u_int32_t *p, *pmax, *pstart;
442 
443 	iop = (struct iop_softc *)sc->sc_dv.dv_parent;
444 	im = NULL;
445 
446 	if ((rv = dpti_blinkled(sc)) != -1) {
447 		if (rv != 0) {
448 			printf("%s: adapter blinkled = 0x%02x\n",
449 			    sc->sc_dv.dv_xname, rv);
450 			return (EIO);
451 		}
452 	}
453 
454 	/*
455 	 * Copy in the message frame header and determine the size of the
456 	 * full message frame.
457 	 */
458 	if ((rv = copyin(data, &mh, sizeof(mh))) != 0) {
459 		DPRINTF(("%s: message copyin failed\n",
460 		    sc->sc_dv.dv_xname));
461 		return (rv);
462 	}
463 
464 	msgsize = (mh.msgflags >> 14) & ~3;
465 	if (msgsize < sizeof(mh) || msgsize >= IOP_MAX_MSG_SIZE) {
466 		DPRINTF(("%s: bad message frame size\n",
467 		    sc->sc_dv.dv_xname));
468 		return (EINVAL);
469 	}
470 
471 	/*
472 	 * Handle special commands.
473 	 */
474 	switch (mh.msgfunc >> 24) {
475 	case I2O_EXEC_IOP_RESET:
476 		printf("%s: I2O_EXEC_IOP_RESET not implemented\n",
477 		    sc->sc_dv.dv_xname);
478 		return (EOPNOTSUPP);
479 
480 	case I2O_EXEC_OUTBOUND_INIT:
481 		printf("%s: I2O_EXEC_OUTBOUND_INIT not implemented\n",
482 		    sc->sc_dv.dv_xname);
483 		return (EOPNOTSUPP);
484 
485 	case I2O_EXEC_SYS_TAB_SET:
486 		printf("%s: I2O_EXEC_SYS_TAB_SET not implemented\n",
487 		    sc->sc_dv.dv_xname);
488 		return (EOPNOTSUPP);
489 
490 	case I2O_EXEC_STATUS_GET:
491 		if ((rv = iop_status_get(iop, 0)) == 0)
492 			rv = copyout(&iop->sc_status, data + msgsize,
493 			    sizeof(iop->sc_status));
494 		return (rv);
495 	}
496 
497 	/*
498 	 * Copy in the full message frame.
499 	 */
500 	if ((rv = copyin(data, mbtmp, msgsize)) != 0) {
501 		DPRINTF(("%s: full message copyin failed\n",
502 		    sc->sc_dv.dv_xname));
503 		return (rv);
504 	}
505 
506 	/*
507 	 * Determine the size of the reply frame, and copy it in.
508 	 */
509 	if ((rv = copyin(data + msgsize, &rh, sizeof(rh))) != 0) {
510 		DPRINTF(("%s: reply copyin failed\n",
511 		    sc->sc_dv.dv_xname));
512 		return (rv);
513 	}
514 
515 	repsize = (rh.msgflags >> 14) & ~3;
516 	if (repsize < sizeof(rh) || repsize >= IOP_MAX_MSG_SIZE) {
517 		DPRINTF(("%s: bad reply header size\n",
518 		    sc->sc_dv.dv_xname));
519 		return (EINVAL);
520 	}
521 
522 	if ((rv = copyin(data + msgsize, rbtmp, repsize)) != 0) {
523 		DPRINTF(("%s: reply too large\n", sc->sc_dv.dv_xname));
524 		return (rv);
525 	}
526 
527 	/*
528 	 * If the message has a scatter gather list, it must be comprised of
529 	 * simple elements.  If any one transfer contains multiple segments,
530 	 * we allocate a temporary buffer for it; otherwise, the buffer will
531 	 * be mapped directly.
532 	 */
533 	if ((sgoff = ((mh.msgflags >> 4) & 15)) != 0) {
534 		if ((sgoff + 2) > (msgsize >> 2)) {
535 			DPRINTF(("%s: invalid message size fields\n",
536 			    sc->sc_dv.dv_xname));
537 			return (EINVAL);
538 		}
539 
540 		memset(bufs, 0, sizeof(bufs));
541 	} else
542 		nbuf = -1;
543 
544 	rv = EINVAL;
545 
546 	if (sgoff != 0) {
547 		p = mbtmp + sgoff;
548 		pmax = mbtmp + (msgsize >> 2) - 2;
549 
550 		for (nbuf = 0; nbuf < IOP_MAX_MSG_XFERS; nbuf++, p += 2) {
551 			if (p > pmax) {
552 				DPRINTF(("%s: invalid SGL (1)\n",
553 				    sc->sc_dv.dv_xname));
554 				goto bad;
555 			}
556 
557 			if ((p[0] & 0x30000000) != I2O_SGL_SIMPLE) {
558 				DPRINTF(("%s: invalid SGL (2)\n",
559 				    sc->sc_dv.dv_xname));
560 				goto bad;
561 			}
562 
563 			bufs[nbuf].db_out = (p[0] & I2O_SGL_DATA_OUT) != 0;
564 			bufs[nbuf].db_ptr = NULL;
565 
566 			if ((p[0] & I2O_SGL_END_BUFFER) != 0) {
567 				if ((p[0] & 0x00ffffff) > IOP_MAX_XFER) {
568 					DPRINTF(("%s: buffer too large\n",
569 					    sc->sc_dv.dv_xname));
570 					goto bad;
571 				}
572 
573 				bufs[nbuf].db_ptr = (caddr_t)p[1];
574 				bufs[nbuf].db_proc = proc;
575 				bufs[nbuf].db_size = p[0] & 0x00ffffff;
576 
577 				if ((p[0] & I2O_SGL_END) != 0)
578 					break;
579 
580 				continue;
581 			}
582 
583 			/*
584 			 * The buffer has multiple segments.  Determine the
585 			 * total size.
586 			 */
587 			nfrag = 0;
588 			sz = 0;
589 			for (pstart = p; p <= pmax; p += 2) {
590 				if (nfrag == DPTI_MAX_SEGS) {
591 					DPRINTF(("%s: too many segments\n",
592 					    sc->sc_dv.dv_xname));
593 					goto bad;
594 				}
595 
596 				bufs[nbuf].db_frags[nfrag].iov_len =
597 				    p[0] & 0x00ffffff;
598 				bufs[nbuf].db_frags[nfrag].iov_base =
599 				    (void *)p[1];
600 
601 				sz += p[0] & 0x00ffffff;
602 				nfrag++;
603 
604 				if ((p[0] & I2O_SGL_END) != 0) {
605 					if ((p[0] & I2O_SGL_END_BUFFER) == 0) {
606 						DPRINTF((
607 						    "%s: invalid SGL (3)\n",
608 						    sc->sc_dv.dv_xname));
609 						goto bad;
610 					}
611 					break;
612 				}
613 				if ((p[0] & I2O_SGL_END_BUFFER) != 0)
614 					break;
615 			}
616 			bufs[nbuf].db_nfrag = nfrag;
617 
618 			if (p > pmax) {
619 				DPRINTF(("%s: invalid SGL (4)\n",
620 				    sc->sc_dv.dv_xname));
621 				goto bad;
622 			}
623 
624 			if (sz > IOP_MAX_XFER) {
625 				DPRINTF(("%s: buffer too large\n",
626 				    sc->sc_dv.dv_xname));
627 				goto bad;
628 			}
629 
630 			bufs[nbuf].db_size = sz;
631 			bufs[nbuf].db_ptr = malloc(sz, M_DEVBUF, M_WAITOK);
632 			if (bufs[nbuf].db_ptr == NULL) {
633 				DPRINTF(("%s: allocation failure\n",
634 				    sc->sc_dv.dv_xname));
635 				rv = ENOMEM;
636 				goto bad;
637 			}
638 
639 			for (i = 0, sz = 0; i < bufs[nbuf].db_nfrag; i++) {
640 				rv = copyin(bufs[nbuf].db_frags[i].iov_base,
641 				    bufs[nbuf].db_ptr + sz,
642 				    bufs[nbuf].db_frags[i].iov_len);
643 				if (rv != 0) {
644 					DPRINTF(("%s: frag copyin\n",
645 					    sc->sc_dv.dv_xname));
646 					goto bad;
647 				}
648 				sz += bufs[nbuf].db_frags[i].iov_len;
649 			}
650 
651 			if ((p[0] & I2O_SGL_END) != 0)
652 				break;
653 		}
654 
655 		if (nbuf == IOP_MAX_MSG_XFERS) {
656 			DPRINTF(("%s: too many transfers\n",
657 			    sc->sc_dv.dv_xname));
658 			goto bad;
659 		}
660 	}
661 
662 	/*
663 	 * Allocate a wrapper, and adjust the message header fields to
664 	 * indicate that no scatter-gather list is currently present.
665 	 */
666 	mapped = 0;
667 
668 	im = iop_msg_alloc(iop, IM_WAIT | IM_NOSTATUS);
669 	im->im_rb = (struct i2o_reply *)rbtmp;
670 	mf = (struct i2o_msg *)mbtmp;
671 	mf->msgictx = IOP_ICTX;
672 	mf->msgtctx = im->im_tctx;
673 
674 	if (sgoff != 0)
675 		mf->msgflags = (mf->msgflags & 0xff0f) | (sgoff << 16);
676 
677 	/*
678 	 * Map the data transfer(s).
679 	 */
680 	for (i = 0; i <= nbuf; i++) {
681 		rv = iop_msg_map(iop, im, mbtmp, bufs[i].db_ptr,
682 		    bufs[i].db_size, bufs[i].db_out, bufs[i].db_proc);
683 		if (rv != 0) {
684 			DPRINTF(("%s: msg_map failed, rv = %d\n",
685 			    sc->sc_dv.dv_xname, rv));
686 			goto bad;
687 		}
688 		mapped = 1;
689 	}
690 
691 	/*
692 	 * Start the command and sleep until it completes.
693 	 */
694 	if ((rv = iop_msg_post(iop, im, mbtmp, 5*60*1000)) != 0)
695 		goto bad;
696 
697 	/*
698 	 * Copy out the reply frame.
699 	 */
700 	if ((rv = copyout(rbtmp, data + msgsize, repsize)) != 0)
701 		DPRINTF(("%s: reply copyout() failed\n",
702 		    sc->sc_dv.dv_xname));
703 
704  bad:
705 	/*
706 	 * Free resources and return to the caller.
707 	 */
708 	if (im != NULL) {
709 		if (mapped)
710 			iop_msg_unmap(iop, im);
711 		iop_msg_free(iop, im);
712 	}
713 
714 	for (i = 0; i <= nbuf; i++) {
715 		if (bufs[i].db_proc != NULL)
716 			continue;
717 
718 		if (!bufs[i].db_out && rv == 0) {
719 			for (j = 0, sz = 0; j < bufs[i].db_nfrag; j++) {
720 				rv = copyout(bufs[i].db_ptr + sz,
721 				    bufs[i].db_frags[j].iov_base,
722 				    bufs[i].db_frags[j].iov_len);
723 				if (rv != 0)
724 					break;
725 				sz += bufs[i].db_frags[j].iov_len;
726 			}
727 		}
728 
729 		if (bufs[i].db_ptr != NULL)
730 			free(bufs[i].db_ptr, M_DEVBUF);
731 	}
732 
733 	return (rv);
734 }
735