xref: /netbsd-src/sys/dev/i2o/dpti.c (revision b1c86f5f087524e68db12794ee9c3e3da1ab17a0)
1 /*	$NetBSD: dpti.c,v 1.42 2009/05/12 14:23:47 cegger Exp $	*/
2 
3 /*-
4  * Copyright (c) 2001, 2007 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Andrew Doran.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29  * POSSIBILITY OF SUCH DAMAGE.
30  */
31 
32 /*
33  * Copyright (c) 1996-2000 Distributed Processing Technology Corporation
34  * Copyright (c) 2000 Adaptec Corporation
35  * All rights reserved.
36  *
37  * TERMS AND CONDITIONS OF USE
38  *
39  * Redistribution and use in source form, with or without modification, are
40  * permitted provided that redistributions of source code must retain the
41  * above copyright notice, this list of conditions and the following disclaimer.
42  *
43  * This software is provided `as is' by Adaptec and any express or implied
44  * warranties, including, but not limited to, the implied warranties of
45  * merchantability and fitness for a particular purpose, are disclaimed. In no
46  * event shall Adaptec be liable for any direct, indirect, incidental, special,
47  * exemplary or consequential damages (including, but not limited to,
48  * procurement of substitute goods or services; loss of use, data, or profits;
49  * or business interruptions) however caused and on any theory of liability,
50  * whether in contract, strict liability, or tort (including negligence or
51  * otherwise) arising in any way out of the use of this driver software, even
52  * if advised of the possibility of such damage.
53  */
54 
55 /*
56  * Adaptec/DPT I2O control interface.
57  */
58 
59 #include <sys/cdefs.h>
60 __KERNEL_RCSID(0, "$NetBSD: dpti.c,v 1.42 2009/05/12 14:23:47 cegger Exp $");
61 
62 #include <sys/param.h>
63 #include <sys/systm.h>
64 #include <sys/kernel.h>
65 #include <sys/device.h>
66 #include <sys/queue.h>
67 #include <sys/proc.h>
68 #include <sys/endian.h>
69 #include <sys/malloc.h>
70 #include <sys/conf.h>
71 #include <sys/ioctl.h>
72 #include <sys/kauth.h>
73 
74 #include <uvm/uvm_extern.h>
75 
76 #include <sys/bus.h>
77 #ifdef __i386__
78 #include <machine/pio.h>
79 #include <machine/cputypes.h>
80 #endif
81 
82 #include <dev/i2o/i2o.h>
83 #include <dev/i2o/i2odpt.h>
84 #include <dev/i2o/iopio.h>
85 #include <dev/i2o/iopvar.h>
86 #include <dev/i2o/dptivar.h>
87 
88 #ifdef I2ODEBUG
89 #define	DPRINTF(x)		printf x
90 #else
91 #define	DPRINTF(x)
92 #endif
93 
94 static struct dpt_sig dpti_sig = {
95 	{ 'd', 'P', 't', 'S', 'i', 'G'},
96 	SIG_VERSION,
97 #if defined(__i386__)
98 	PROC_INTEL,
99 #elif defined(__powerpc__)
100 	PROC_POWERPC,
101 #elif defined(__alpha__)
102 	PROC_ALPHA,
103 #elif defined(__mips__)
104 	PROC_MIPS,
105 #elif defined(__sparc64__)
106 	PROC_ULTRASPARC,
107 #endif
108 #if defined(__i386__)
109 	PROC_386 | PROC_486 | PROC_PENTIUM | PROC_SEXIUM,
110 #else
111 	0,
112 #endif
113 	FT_HBADRVR,
114 	0,
115 	OEM_DPT,
116 	OS_FREE_BSD,	/* XXX */
117 	CAP_ABOVE16MB,
118 	DEV_ALL,
119 	ADF_ALL_SC5,
120 	0,
121 	0,
122 	DPTI_VERSION,
123 	DPTI_REVISION,
124 	DPTI_SUBREVISION,
125 	DPTI_MONTH,
126 	DPTI_DAY,
127 	DPTI_YEAR,
128 	""		/* Will be filled later */
129 };
130 
131 void	dpti_attach(device_t, device_t, void *);
132 int	dpti_blinkled(struct dpti_softc *);
133 int	dpti_ctlrinfo(struct dpti_softc *, int, void *);
134 int	dpti_match(device_t, cfdata_t, void *);
135 int	dpti_passthrough(struct dpti_softc *, void *, struct proc *);
136 int	dpti_sysinfo(struct dpti_softc *, int, void *);
137 
138 dev_type_open(dptiopen);
139 dev_type_ioctl(dptiioctl);
140 
141 const struct cdevsw dpti_cdevsw = {
142 	dptiopen, nullclose, noread, nowrite, dptiioctl,
143 	nostop, notty, nopoll, nommap, nokqfilter, D_OTHER,
144 };
145 
146 extern struct cfdriver dpti_cd;
147 
148 CFATTACH_DECL(dpti, sizeof(struct dpti_softc),
149     dpti_match, dpti_attach, NULL, NULL);
150 
151 int
152 dpti_match(device_t parent, cfdata_t match, void *aux)
153 {
154 	struct iop_attach_args *ia;
155 	struct iop_softc *iop;
156 
157 	ia = aux;
158 	iop = (struct iop_softc *)parent;
159 
160 	if (ia->ia_class != I2O_CLASS_ANY || ia->ia_tid != I2O_TID_IOP)
161 		return (0);
162 
163 	if (le16toh(iop->sc_status.orgid) != I2O_ORG_DPT)
164 		return (0);
165 
166 	return (1);
167 }
168 
169 void
170 dpti_attach(device_t parent, device_t self, void *aux)
171 {
172 	struct iop_softc *iop;
173 	struct dpti_softc *sc;
174 	struct {
175 		struct	i2o_param_op_results pr;
176 		struct	i2o_param_read_results prr;
177 		struct	i2o_dpt_param_exec_iop_buffers dib;
178 	} __packed param;
179 	int rv;
180 
181 	sc = device_private(self);
182 	iop = device_private(parent);
183 
184 	/*
185 	 * Tell the world what we are.  The description in the signature
186 	 * must be no more than 46 bytes long (see dptivar.h).
187 	 */
188 	printf(": DPT/Adaptec RAID management interface\n");
189 	snprintf(dpti_sig.dsDescription, sizeof(dpti_sig.dsDescription),
190 	    "NetBSD %s I2O OSM", osrelease);
191 
192 	rv = iop_field_get_all(iop, I2O_TID_IOP,
193 	    I2O_DPT_PARAM_EXEC_IOP_BUFFERS, &param,
194 	    sizeof(param), NULL);
195 	if (rv != 0)
196 		return;
197 
198 	sc->sc_blinkled = le32toh(param.dib.serialoutputoff) + 8;
199 }
200 
201 int
202 dptiopen(dev_t dev, int flag, int mode,
203     struct lwp *l)
204 {
205 
206 	if (device_lookup(&dpti_cd, minor(dev)) == NULL)
207 		return (ENXIO);
208 
209 	return (0);
210 }
211 
212 int
213 dptiioctl(dev_t dev, u_long cmd, void *data, int flag, struct lwp *l)
214 {
215 	struct iop_softc *iop;
216 	struct dpti_softc *sc;
217 	struct ioctl_pt *pt;
218 	int i, size, rv, linux;
219 
220 	sc = device_lookup_private(&dpti_cd, minor(dev));
221 	iop = (struct iop_softc *)device_parent(&sc->sc_dv);
222 	rv = 0;
223 
224 	if (cmd == PTIOCLINUX) {
225 		pt = (struct ioctl_pt *)data;
226 		size = IOCPARM_LEN(pt->com);
227 		cmd = pt->com & 0xffff;
228 		data = pt->data;
229 		linux = 1;
230 	} else {
231 		size = IOCPARM_LEN(cmd);
232 		cmd = cmd & 0xffff;
233 		linux = 0;
234 	}
235 
236 	switch (cmd) {
237 	case DPT_SIGNATURE:
238 		if (size > sizeof(dpti_sig))
239 			size = sizeof(dpti_sig);
240 		memcpy(data, &dpti_sig, size);
241 		break;
242 
243 	case DPT_CTRLINFO:
244 		rv = dpti_ctlrinfo(sc, size, data);
245 		break;
246 
247 	case DPT_SYSINFO:
248 		rv = dpti_sysinfo(sc, size, data);
249 		break;
250 
251 	case DPT_BLINKLED:
252 		if ((i = dpti_blinkled(sc)) == -1)
253 			i = 0;
254 
255 		if (size == 0) {
256 			rv = copyout(&i, *(void **)data, sizeof(i));
257 			break;
258 		}
259 
260 		*(int *)data = i;
261 		break;
262 
263 	case DPT_TARGET_BUSY:
264 		/*
265 		 * XXX This is here to stop linux_machdepioctl() from
266 		 * whining about an unknown ioctl.
267 		 */
268 		rv = EIO;
269 		break;
270 
271 	case DPT_I2OUSRCMD:
272 		rv = kauth_authorize_device_passthru(l->l_cred, dev,
273 		    KAUTH_REQ_DEVICE_RAWIO_PASSTHRU_ALL, data);
274 		if (rv)
275 			break;
276 
277 		if (sc->sc_nactive++ >= 2)
278 			tsleep(&sc->sc_nactive, PRIBIO, "dptislp", 0);
279 
280 		if (linux)
281 			rv = dpti_passthrough(sc, data, l->l_proc);
282 		else
283 			rv = dpti_passthrough(sc, *(void **)data, l->l_proc);
284 
285 		sc->sc_nactive--;
286 		wakeup_one(&sc->sc_nactive);
287 		break;
288 
289 	case DPT_I2ORESETCMD:
290 		printf("%s: I2ORESETCMD not implemented\n",
291 		    device_xname(&sc->sc_dv));
292 		rv = EOPNOTSUPP;
293 		break;
294 
295 	case DPT_I2ORESCANCMD:
296 		mutex_enter(&iop->sc_conflock);
297 		rv = iop_reconfigure(iop, 0);
298 		mutex_exit(&iop->sc_conflock);
299 		break;
300 
301 	default:
302 		rv = ENOTTY;
303 		break;
304 	}
305 
306 	return (rv);
307 }
308 
309 int
310 dpti_blinkled(struct dpti_softc *sc)
311 {
312 	struct iop_softc *iop;
313 	u_int v;
314 
315 	iop = (struct iop_softc *)device_parent(&sc->sc_dv);
316 
317 	v = bus_space_read_1(iop->sc_iot, iop->sc_ioh, sc->sc_blinkled + 0);
318 	if (v == 0xbc) {
319 		v = bus_space_read_1(iop->sc_iot, iop->sc_ioh,
320 		    sc->sc_blinkled + 1);
321 		return (v);
322 	}
323 
324 	return (-1);
325 }
326 
327 int
328 dpti_ctlrinfo(struct dpti_softc *sc, int size, void *data)
329 {
330 	struct dpt_ctlrinfo info;
331 	struct iop_softc *iop;
332 	int rv, i;
333 
334 	iop = (struct iop_softc *)device_parent(&sc->sc_dv);
335 
336 	memset(&info, 0, sizeof(info));
337 
338 	info.length = sizeof(info) - sizeof(u_int16_t);
339 	info.drvrHBAnum = device_unit(&sc->sc_dv);
340 	info.baseAddr = iop->sc_memaddr;
341 	if ((i = dpti_blinkled(sc)) == -1)
342 		i = 0;
343 	info.blinkState = i;
344 	info.pciBusNum = iop->sc_pcibus;
345 	info.pciDeviceNum = iop->sc_pcidev;
346 	info.hbaFlags = FLG_OSD_PCI_VALID | FLG_OSD_DMA | FLG_OSD_I2O;
347 	info.Interrupt = 10;			/* XXX */
348 
349 	if (size > sizeof(char)) {
350 		memcpy(data, &info, min(sizeof(info), size));
351 		rv = 0;
352 	} else
353 		rv = copyout(&info, *(void **)data, sizeof(info));
354 
355 	return (rv);
356 }
357 
358 int
359 dpti_sysinfo(struct dpti_softc *sc, int size, void *data)
360 {
361 	struct dpt_sysinfo info;
362 	int rv;
363 #ifdef __i386__
364 	int i, j;
365 #endif
366 
367 	memset(&info, 0, sizeof(info));
368 
369 #ifdef __i386__
370 	outb (0x70, 0x12);
371 	i = inb(0x71);
372 	j = i >> 4;
373 	if (i == 0x0f) {
374 		outb (0x70, 0x19);
375 		j = inb (0x71);
376 	}
377 	info.drive0CMOS = j;
378 
379 	j = i & 0x0f;
380 	if (i == 0x0f) {
381 		outb (0x70, 0x1a);
382 		j = inb (0x71);
383 	}
384 	info.drive1CMOS = j;
385 	info.processorFamily = dpti_sig.dsProcessorFamily;
386 
387 	/*
388 	 * Get the conventional memory size from CMOS.
389 	 */
390 	outb(0x70, 0x16);
391 	j = inb(0x71);
392 	j <<= 8;
393 	outb(0x70, 0x15);
394 	j |= inb(0x71);
395 	info.conventionalMemSize = j;
396 
397 	/*
398 	 * Get the extended memory size from CMOS.
399 	 */
400 	outb(0x70, 0x31);
401 	j = inb(0x71);
402 	j <<= 8;
403 	outb(0x70, 0x30);
404 	j |= inb(0x71);
405 	info.extendedMemSize = j;
406 
407 	switch (cpu_class) {
408 	case CPUCLASS_386:
409 		info.processorType = PROC_386;
410 		break;
411 	case CPUCLASS_486:
412 		info.processorType = PROC_486;
413 		break;
414 	case CPUCLASS_586:
415 		info.processorType = PROC_PENTIUM;
416 		break;
417 	case CPUCLASS_686:
418 	default:
419 		info.processorType = PROC_SEXIUM;
420 		break;
421 	}
422 
423 	info.flags = SI_CMOS_Valid | SI_BusTypeValid |
424 	    SI_MemorySizeValid | SI_NO_SmartROM;
425 #else
426 	info.flags = SI_BusTypeValid | SI_NO_SmartROM;
427 #endif
428 
429 	info.busType = SI_PCI_BUS;
430 
431 	/*
432 	 * Copy out the info structure to the user.
433 	 */
434 	if (size > sizeof(char)) {
435 		memcpy(data, &info, min(sizeof(info), size));
436 		rv = 0;
437 	} else
438 		rv = copyout(&info, *(void **)data, sizeof(info));
439 
440 	return (rv);
441 }
442 
443 int
444 dpti_passthrough(struct dpti_softc *sc, void *data, struct proc *proc)
445 {
446 	struct iop_softc *iop;
447 	struct i2o_msg mh, *mf;
448 	struct i2o_reply rh;
449 	struct iop_msg *im;
450 	struct dpti_ptbuf bufs[IOP_MAX_MSG_XFERS];
451 	u_int32_t mbtmp[IOP_MAX_MSG_SIZE / sizeof(u_int32_t)];
452 	u_int32_t rbtmp[IOP_MAX_MSG_SIZE / sizeof(u_int32_t)];
453 	int rv, msgsize, repsize, sgoff, i, mapped, nbuf, nfrag, j, sz;
454 	u_int32_t *p, *pmax;
455 
456 	iop = (struct iop_softc *)device_parent(&sc->sc_dv);
457 	im = NULL;
458 
459 	if ((rv = dpti_blinkled(sc)) != -1) {
460 		if (rv != 0) {
461 			aprint_error_dev(&sc->sc_dv, "adapter blinkled = 0x%02x\n", rv);
462 			return (EIO);
463 		}
464 	}
465 
466 	/*
467 	 * Copy in the message frame header and determine the size of the
468 	 * full message frame.
469 	 */
470 	if ((rv = copyin(data, &mh, sizeof(mh))) != 0) {
471 		DPRINTF(("%s: message copyin failed\n",
472 		    device_xname(&sc->sc_dv)));
473 		return (rv);
474 	}
475 
476 	msgsize = (mh.msgflags >> 14) & ~3;
477 	if (msgsize < sizeof(mh) || msgsize >= IOP_MAX_MSG_SIZE) {
478 		DPRINTF(("%s: bad message frame size\n",
479 		    device_xname(&sc->sc_dv)));
480 		return (EINVAL);
481 	}
482 
483 	/*
484 	 * Handle special commands.
485 	 */
486 	switch (mh.msgfunc >> 24) {
487 	case I2O_EXEC_IOP_RESET:
488 		printf("%s: I2O_EXEC_IOP_RESET not implemented\n",
489 		    device_xname(&sc->sc_dv));
490 		return (EOPNOTSUPP);
491 
492 	case I2O_EXEC_OUTBOUND_INIT:
493 		printf("%s: I2O_EXEC_OUTBOUND_INIT not implemented\n",
494 		    device_xname(&sc->sc_dv));
495 		return (EOPNOTSUPP);
496 
497 	case I2O_EXEC_SYS_TAB_SET:
498 		printf("%s: I2O_EXEC_SYS_TAB_SET not implemented\n",
499 		    device_xname(&sc->sc_dv));
500 		return (EOPNOTSUPP);
501 
502 	case I2O_EXEC_STATUS_GET:
503 		if ((rv = iop_status_get(iop, 0)) == 0)
504 			rv = copyout(&iop->sc_status, (char *)data + msgsize,
505 			    sizeof(iop->sc_status));
506 		return (rv);
507 	}
508 
509 	/*
510 	 * Copy in the full message frame.
511 	 */
512 	if ((rv = copyin(data, mbtmp, msgsize)) != 0) {
513 		DPRINTF(("%s: full message copyin failed\n",
514 		    device_xname(&sc->sc_dv)));
515 		return (rv);
516 	}
517 
518 	/*
519 	 * Determine the size of the reply frame, and copy it in.
520 	 */
521 	if ((rv = copyin((char *)data + msgsize, &rh, sizeof(rh))) != 0) {
522 		DPRINTF(("%s: reply copyin failed\n",
523 		    device_xname(&sc->sc_dv)));
524 		return (rv);
525 	}
526 
527 	repsize = (rh.msgflags >> 14) & ~3;
528 	if (repsize < sizeof(rh) || repsize >= IOP_MAX_MSG_SIZE) {
529 		DPRINTF(("%s: bad reply header size\n",
530 		    device_xname(&sc->sc_dv)));
531 		return (EINVAL);
532 	}
533 
534 	if ((rv = copyin((char *)data + msgsize, rbtmp, repsize)) != 0) {
535 		DPRINTF(("%s: reply too large\n", device_xname(&sc->sc_dv)));
536 		return (rv);
537 	}
538 
539 	/*
540 	 * If the message has a scatter gather list, it must be comprised of
541 	 * simple elements.  If any one transfer contains multiple segments,
542 	 * we allocate a temporary buffer for it; otherwise, the buffer will
543 	 * be mapped directly.
544 	 */
545 	mapped = 0;
546 	if ((sgoff = ((mh.msgflags >> 4) & 15)) != 0) {
547 		if ((sgoff + 2) > (msgsize >> 2)) {
548 			DPRINTF(("%s: invalid message size fields\n",
549 			    device_xname(&sc->sc_dv)));
550 			return (EINVAL);
551 		}
552 
553 		memset(bufs, 0, sizeof(bufs));
554 
555 		p = mbtmp + sgoff;
556 		pmax = mbtmp + (msgsize >> 2) - 2;
557 
558 		for (nbuf = 0; nbuf < IOP_MAX_MSG_XFERS; nbuf++, p += 2) {
559 			if (p > pmax) {
560 				DPRINTF(("%s: invalid SGL (1)\n",
561 				    device_xname(&sc->sc_dv)));
562 				goto bad;
563 			}
564 
565 			if ((p[0] & 0x30000000) != I2O_SGL_SIMPLE) {
566 				DPRINTF(("%s: invalid SGL (2)\n",
567 				    device_xname(&sc->sc_dv)));
568 				goto bad;
569 			}
570 
571 			bufs[nbuf].db_out = (p[0] & I2O_SGL_DATA_OUT) != 0;
572 			bufs[nbuf].db_ptr = NULL;
573 
574 			if ((p[0] & I2O_SGL_END_BUFFER) != 0) {
575 				if ((p[0] & 0x00ffffff) > IOP_MAX_XFER) {
576 					DPRINTF(("%s: buffer too large\n",
577 					    device_xname(&sc->sc_dv)));
578 					goto bad;
579 				}
580 
581 				bufs[nbuf].db_ptr = (void *)p[1];
582 				bufs[nbuf].db_proc = proc;
583 				bufs[nbuf].db_size = p[0] & 0x00ffffff;
584 
585 				if ((p[0] & I2O_SGL_END) != 0)
586 					break;
587 
588 				continue;
589 			}
590 
591 			/*
592 			 * The buffer has multiple segments.  Determine the
593 			 * total size.
594 			 */
595 			nfrag = 0;
596 			sz = 0;
597 			for (; p <= pmax; p += 2) {
598 				if (nfrag == DPTI_MAX_SEGS) {
599 					DPRINTF(("%s: too many segments\n",
600 					    device_xname(&sc->sc_dv)));
601 					goto bad;
602 				}
603 
604 				bufs[nbuf].db_frags[nfrag].iov_len =
605 				    p[0] & 0x00ffffff;
606 				bufs[nbuf].db_frags[nfrag].iov_base =
607 				    (void *)p[1];
608 
609 				sz += p[0] & 0x00ffffff;
610 				nfrag++;
611 
612 				if ((p[0] & I2O_SGL_END) != 0) {
613 					if ((p[0] & I2O_SGL_END_BUFFER) == 0) {
614 						DPRINTF((
615 						    "%s: invalid SGL (3)\n",
616 						    device_xname(&sc->sc_dv)));
617 						goto bad;
618 					}
619 					break;
620 				}
621 				if ((p[0] & I2O_SGL_END_BUFFER) != 0)
622 					break;
623 			}
624 			bufs[nbuf].db_nfrag = nfrag;
625 
626 			if (p > pmax) {
627 				DPRINTF(("%s: invalid SGL (4)\n",
628 				    device_xname(&sc->sc_dv)));
629 				goto bad;
630 			}
631 
632 			if (sz > IOP_MAX_XFER) {
633 				DPRINTF(("%s: buffer too large\n",
634 				    device_xname(&sc->sc_dv)));
635 				goto bad;
636 			}
637 
638 			bufs[nbuf].db_size = sz;
639 			bufs[nbuf].db_ptr = malloc(sz, M_DEVBUF, M_WAITOK);
640 			if (bufs[nbuf].db_ptr == NULL) {
641 				DPRINTF(("%s: allocation failure\n",
642 				    device_xname(&sc->sc_dv)));
643 				rv = ENOMEM;
644 				goto bad;
645 			}
646 
647 			for (i = 0, sz = 0; i < bufs[nbuf].db_nfrag; i++) {
648 				rv = copyin(bufs[nbuf].db_frags[i].iov_base,
649 				    (char *)bufs[nbuf].db_ptr + sz,
650 				    bufs[nbuf].db_frags[i].iov_len);
651 				if (rv != 0) {
652 					DPRINTF(("%s: frag copyin\n",
653 					    device_xname(&sc->sc_dv)));
654 					goto bad;
655 				}
656 				sz += bufs[nbuf].db_frags[i].iov_len;
657 			}
658 
659 			if ((p[0] & I2O_SGL_END) != 0)
660 				break;
661 		}
662 
663 		if (nbuf == IOP_MAX_MSG_XFERS) {
664 			DPRINTF(("%s: too many transfers\n",
665 			    device_xname(&sc->sc_dv)));
666 			goto bad;
667 		}
668 	} else
669 		nbuf = -1;
670 
671 	/*
672 	 * Allocate a wrapper, and adjust the message header fields to
673 	 * indicate that no scatter-gather list is currently present.
674 	 */
675 
676 	im = iop_msg_alloc(iop, IM_WAIT | IM_NOSTATUS);
677 	im->im_rb = (struct i2o_reply *)rbtmp;
678 	mf = (struct i2o_msg *)mbtmp;
679 	mf->msgictx = IOP_ICTX;
680 	mf->msgtctx = im->im_tctx;
681 
682 	if (sgoff != 0)
683 		mf->msgflags = (mf->msgflags & 0xff0f) | (sgoff << 16);
684 
685 	/*
686 	 * Map the data transfer(s).
687 	 */
688 	for (i = 0; i <= nbuf; i++) {
689 		rv = iop_msg_map(iop, im, mbtmp, bufs[i].db_ptr,
690 		    bufs[i].db_size, bufs[i].db_out, bufs[i].db_proc);
691 		if (rv != 0) {
692 			DPRINTF(("%s: msg_map failed, rv = %d\n",
693 			    device_xname(&sc->sc_dv), rv));
694 			goto bad;
695 		}
696 		mapped = 1;
697 	}
698 
699 	/*
700 	 * Start the command and sleep until it completes.
701 	 */
702 	if ((rv = iop_msg_post(iop, im, mbtmp, 5*60*1000)) != 0)
703 		goto bad;
704 
705 	/*
706 	 * Copy out the reply frame.
707 	 */
708 	if ((rv = copyout(rbtmp, (char *)data + msgsize, repsize)) != 0) {
709 		DPRINTF(("%s: reply copyout() failed\n",
710 		    device_xname(&sc->sc_dv)));
711 	}
712 
713  bad:
714 	/*
715 	 * Free resources and return to the caller.
716 	 */
717 	if (im != NULL) {
718 		if (mapped)
719 			iop_msg_unmap(iop, im);
720 		iop_msg_free(iop, im);
721 	}
722 
723 	for (i = 0; i <= nbuf; i++) {
724 		if (bufs[i].db_proc != NULL)
725 			continue;
726 
727 		if (!bufs[i].db_out && rv == 0) {
728 			for (j = 0, sz = 0; j < bufs[i].db_nfrag; j++) {
729 				rv = copyout((char *)bufs[i].db_ptr + sz,
730 				    bufs[i].db_frags[j].iov_base,
731 				    bufs[i].db_frags[j].iov_len);
732 				if (rv != 0)
733 					break;
734 				sz += bufs[i].db_frags[j].iov_len;
735 			}
736 		}
737 
738 		if (bufs[i].db_ptr != NULL)
739 			free(bufs[i].db_ptr, M_DEVBUF);
740 	}
741 
742 	return (rv);
743 }
744