xref: /netbsd-src/sys/dev/i2o/dpti.c (revision cd22f25e6f6d1cc1f197fe8c5468a80f51d1c4e1)
1 /*	$NetBSD: dpti.c,v 1.37 2008/04/28 20:23:48 martin Exp $	*/
2 
3 /*-
4  * Copyright (c) 2001, 2007 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Andrew Doran.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29  * POSSIBILITY OF SUCH DAMAGE.
30  */
31 
32 /*
33  * Copyright (c) 1996-2000 Distributed Processing Technology Corporation
34  * Copyright (c) 2000 Adaptec Corporation
35  * All rights reserved.
36  *
37  * TERMS AND CONDITIONS OF USE
38  *
39  * Redistribution and use in source form, with or without modification, are
40  * permitted provided that redistributions of source code must retain the
41  * above copyright notice, this list of conditions and the following disclaimer.
42  *
43  * This software is provided `as is' by Adaptec and any express or implied
44  * warranties, including, but not limited to, the implied warranties of
45  * merchantability and fitness for a particular purpose, are disclaimed. In no
46  * event shall Adaptec be liable for any direct, indirect, incidental, special,
47  * exemplary or consequential damages (including, but not limited to,
48  * procurement of substitute goods or services; loss of use, data, or profits;
49  * or business interruptions) however caused and on any theory of liability,
50  * whether in contract, strict liability, or tort (including negligence or
51  * otherwise) arising in any way out of the use of this driver software, even
52  * if advised of the possibility of such damage.
53  */
54 
55 /*
56  * Adaptec/DPT I2O control interface.
57  */
58 
59 #include <sys/cdefs.h>
60 __KERNEL_RCSID(0, "$NetBSD: dpti.c,v 1.37 2008/04/28 20:23:48 martin Exp $");
61 
62 #include <sys/param.h>
63 #include <sys/systm.h>
64 #include <sys/kernel.h>
65 #include <sys/device.h>
66 #include <sys/queue.h>
67 #include <sys/proc.h>
68 #include <sys/endian.h>
69 #include <sys/malloc.h>
70 #include <sys/conf.h>
71 #include <sys/ioctl.h>
72 #include <sys/kauth.h>
73 
74 #include <uvm/uvm_extern.h>
75 
76 #include <sys/bus.h>
77 #ifdef __i386__
78 #include <machine/pio.h>
79 #endif
80 
81 #include <dev/i2o/i2o.h>
82 #include <dev/i2o/i2odpt.h>
83 #include <dev/i2o/iopio.h>
84 #include <dev/i2o/iopvar.h>
85 #include <dev/i2o/dptivar.h>
86 
87 #ifdef I2ODEBUG
88 #define	DPRINTF(x)		printf x
89 #else
90 #define	DPRINTF(x)
91 #endif
92 
93 static struct dpt_sig dpti_sig = {
94 	{ 'd', 'P', 't', 'S', 'i', 'G'},
95 	SIG_VERSION,
96 #if defined(__i386__)
97 	PROC_INTEL,
98 #elif defined(__powerpc__)
99 	PROC_POWERPC,
100 #elif defined(__alpha__)
101 	PROC_ALPHA,
102 #elif defined(__mips__)
103 	PROC_MIPS,
104 #elif defined(__sparc64__)
105 	PROC_ULTRASPARC,
106 #endif
107 #if defined(__i386__)
108 	PROC_386 | PROC_486 | PROC_PENTIUM | PROC_SEXIUM,
109 #else
110 	0,
111 #endif
112 	FT_HBADRVR,
113 	0,
114 	OEM_DPT,
115 	OS_FREE_BSD,	/* XXX */
116 	CAP_ABOVE16MB,
117 	DEV_ALL,
118 	ADF_ALL_SC5,
119 	0,
120 	0,
121 	DPTI_VERSION,
122 	DPTI_REVISION,
123 	DPTI_SUBREVISION,
124 	DPTI_MONTH,
125 	DPTI_DAY,
126 	DPTI_YEAR,
127 	""		/* Will be filled later */
128 };
129 
130 void	dpti_attach(struct device *, struct device *, void *);
131 int	dpti_blinkled(struct dpti_softc *);
132 int	dpti_ctlrinfo(struct dpti_softc *, int, void *);
133 int	dpti_match(struct device *, struct cfdata *, void *);
134 int	dpti_passthrough(struct dpti_softc *, void *, struct proc *);
135 int	dpti_sysinfo(struct dpti_softc *, int, void *);
136 
137 dev_type_open(dptiopen);
138 dev_type_ioctl(dptiioctl);
139 
140 const struct cdevsw dpti_cdevsw = {
141 	dptiopen, nullclose, noread, nowrite, dptiioctl,
142 	nostop, notty, nopoll, nommap, nokqfilter, D_OTHER,
143 };
144 
145 extern struct cfdriver dpti_cd;
146 
147 CFATTACH_DECL(dpti, sizeof(struct dpti_softc),
148     dpti_match, dpti_attach, NULL, NULL);
149 
150 int
151 dpti_match(struct device *parent, struct cfdata *match, void *aux)
152 {
153 	struct iop_attach_args *ia;
154 	struct iop_softc *iop;
155 
156 	ia = aux;
157 	iop = (struct iop_softc *)parent;
158 
159 	if (ia->ia_class != I2O_CLASS_ANY || ia->ia_tid != I2O_TID_IOP)
160 		return (0);
161 
162 	if (le16toh(iop->sc_status.orgid) != I2O_ORG_DPT)
163 		return (0);
164 
165 	return (1);
166 }
167 
168 void
169 dpti_attach(struct device *parent, struct device *self, void *aux)
170 {
171 	struct iop_softc *iop;
172 	struct dpti_softc *sc;
173 	struct {
174 		struct	i2o_param_op_results pr;
175 		struct	i2o_param_read_results prr;
176 		struct	i2o_dpt_param_exec_iop_buffers dib;
177 	} __attribute__ ((__packed__)) param;
178 	int rv;
179 
180 	sc = device_private(self);
181 	iop = device_private(parent);
182 
183 	/*
184 	 * Tell the world what we are.  The description in the signature
185 	 * must be no more than 46 bytes long (see dptivar.h).
186 	 */
187 	printf(": DPT/Adaptec RAID management interface\n");
188 	snprintf(dpti_sig.dsDescription, sizeof(dpti_sig.dsDescription),
189 	    "NetBSD %s I2O OSM", osrelease);
190 
191 	rv = iop_field_get_all(iop, I2O_TID_IOP,
192 	    I2O_DPT_PARAM_EXEC_IOP_BUFFERS, &param,
193 	    sizeof(param), NULL);
194 	if (rv != 0)
195 		return;
196 
197 	sc->sc_blinkled = le32toh(param.dib.serialoutputoff) + 8;
198 }
199 
200 int
201 dptiopen(dev_t dev, int flag, int mode,
202     struct lwp *l)
203 {
204 
205 	if (device_lookup(&dpti_cd, minor(dev)) == NULL)
206 		return (ENXIO);
207 
208 	return (0);
209 }
210 
211 int
212 dptiioctl(dev_t dev, u_long cmd, void *data, int flag, struct lwp *l)
213 {
214 	struct iop_softc *iop;
215 	struct dpti_softc *sc;
216 	struct ioctl_pt *pt;
217 	int i, size, rv, linux;
218 
219 	sc = device_lookup(&dpti_cd, minor(dev));
220 	iop = (struct iop_softc *)device_parent(&sc->sc_dv);
221 	rv = 0;
222 
223 	if (cmd == PTIOCLINUX) {
224 		pt = (struct ioctl_pt *)data;
225 		size = IOCPARM_LEN(pt->com);
226 		cmd = pt->com & 0xffff;
227 		data = pt->data;
228 		linux = 1;
229 	} else {
230 		size = IOCPARM_LEN(cmd);
231 		cmd = cmd & 0xffff;
232 		linux = 0;
233 	}
234 
235 	switch (cmd) {
236 	case DPT_SIGNATURE:
237 		if (size > sizeof(dpti_sig))
238 			size = sizeof(dpti_sig);
239 		memcpy(data, &dpti_sig, size);
240 		break;
241 
242 	case DPT_CTRLINFO:
243 		rv = dpti_ctlrinfo(sc, size, data);
244 		break;
245 
246 	case DPT_SYSINFO:
247 		rv = dpti_sysinfo(sc, size, data);
248 		break;
249 
250 	case DPT_BLINKLED:
251 		if ((i = dpti_blinkled(sc)) == -1)
252 			i = 0;
253 
254 		if (size == 0) {
255 			rv = copyout(&i, *(void **)data, sizeof(i));
256 			break;
257 		}
258 
259 		*(int *)data = i;
260 		break;
261 
262 	case DPT_TARGET_BUSY:
263 		/*
264 		 * XXX This is here to stop linux_machdepioctl() from
265 		 * whining about an unknown ioctl.
266 		 */
267 		rv = EIO;
268 		break;
269 
270 	case DPT_I2OUSRCMD:
271 		rv = kauth_authorize_device_passthru(l->l_cred, dev,
272 		    KAUTH_REQ_DEVICE_RAWIO_PASSTHRU_ALL, data);
273 		if (rv)
274 			break;
275 
276 		if (sc->sc_nactive++ >= 2)
277 			tsleep(&sc->sc_nactive, PRIBIO, "dptislp", 0);
278 
279 		if (linux)
280 			rv = dpti_passthrough(sc, data, l->l_proc);
281 		else
282 			rv = dpti_passthrough(sc, *(void **)data, l->l_proc);
283 
284 		sc->sc_nactive--;
285 		wakeup_one(&sc->sc_nactive);
286 		break;
287 
288 	case DPT_I2ORESETCMD:
289 		printf("%s: I2ORESETCMD not implemented\n",
290 		    device_xname(&sc->sc_dv));
291 		rv = EOPNOTSUPP;
292 		break;
293 
294 	case DPT_I2ORESCANCMD:
295 		mutex_enter(&iop->sc_conflock);
296 		rv = iop_reconfigure(iop, 0);
297 		mutex_exit(&iop->sc_conflock);
298 		break;
299 
300 	default:
301 		rv = ENOTTY;
302 		break;
303 	}
304 
305 	return (rv);
306 }
307 
308 int
309 dpti_blinkled(struct dpti_softc *sc)
310 {
311 	struct iop_softc *iop;
312 	u_int v;
313 
314 	iop = (struct iop_softc *)device_parent(&sc->sc_dv);
315 
316 	v = bus_space_read_1(iop->sc_iot, iop->sc_ioh, sc->sc_blinkled + 0);
317 	if (v == 0xbc) {
318 		v = bus_space_read_1(iop->sc_iot, iop->sc_ioh,
319 		    sc->sc_blinkled + 1);
320 		return (v);
321 	}
322 
323 	return (-1);
324 }
325 
326 int
327 dpti_ctlrinfo(struct dpti_softc *sc, int size, void *data)
328 {
329 	struct dpt_ctlrinfo info;
330 	struct iop_softc *iop;
331 	int rv, i;
332 
333 	iop = (struct iop_softc *)device_parent(&sc->sc_dv);
334 
335 	memset(&info, 0, sizeof(info));
336 
337 	info.length = sizeof(info) - sizeof(u_int16_t);
338 	info.drvrHBAnum = device_unit(&sc->sc_dv);
339 	info.baseAddr = iop->sc_memaddr;
340 	if ((i = dpti_blinkled(sc)) == -1)
341 		i = 0;
342 	info.blinkState = i;
343 	info.pciBusNum = iop->sc_pcibus;
344 	info.pciDeviceNum = iop->sc_pcidev;
345 	info.hbaFlags = FLG_OSD_PCI_VALID | FLG_OSD_DMA | FLG_OSD_I2O;
346 	info.Interrupt = 10;			/* XXX */
347 
348 	if (size > sizeof(char)) {
349 		memcpy(data, &info, min(sizeof(info), size));
350 		rv = 0;
351 	} else
352 		rv = copyout(&info, *(void **)data, sizeof(info));
353 
354 	return (rv);
355 }
356 
357 int
358 dpti_sysinfo(struct dpti_softc *sc, int size, void *data)
359 {
360 	struct dpt_sysinfo info;
361 	int rv;
362 #ifdef __i386__
363 	int i, j;
364 #endif
365 
366 	memset(&info, 0, sizeof(info));
367 
368 #ifdef __i386__
369 	outb (0x70, 0x12);
370 	i = inb(0x71);
371 	j = i >> 4;
372 	if (i == 0x0f) {
373 		outb (0x70, 0x19);
374 		j = inb (0x71);
375 	}
376 	info.drive0CMOS = j;
377 
378 	j = i & 0x0f;
379 	if (i == 0x0f) {
380 		outb (0x70, 0x1a);
381 		j = inb (0x71);
382 	}
383 	info.drive1CMOS = j;
384 	info.processorFamily = dpti_sig.dsProcessorFamily;
385 
386 	/*
387 	 * Get the conventional memory size from CMOS.
388 	 */
389 	outb(0x70, 0x16);
390 	j = inb(0x71);
391 	j <<= 8;
392 	outb(0x70, 0x15);
393 	j |= inb(0x71);
394 	info.conventionalMemSize = j;
395 
396 	/*
397 	 * Get the extended memory size from CMOS.
398 	 */
399 	outb(0x70, 0x31);
400 	j = inb(0x71);
401 	j <<= 8;
402 	outb(0x70, 0x30);
403 	j |= inb(0x71);
404 	info.extendedMemSize = j;
405 
406 	switch (cpu_class) {
407 	case CPUCLASS_386:
408 		info.processorType = PROC_386;
409 		break;
410 	case CPUCLASS_486:
411 		info.processorType = PROC_486;
412 		break;
413 	case CPUCLASS_586:
414 		info.processorType = PROC_PENTIUM;
415 		break;
416 	case CPUCLASS_686:
417 	default:
418 		info.processorType = PROC_SEXIUM;
419 		break;
420 	}
421 
422 	info.flags = SI_CMOS_Valid | SI_BusTypeValid |
423 	    SI_MemorySizeValid | SI_NO_SmartROM;
424 #else
425 	info.flags = SI_BusTypeValid | SI_NO_SmartROM;
426 #endif
427 
428 	info.busType = SI_PCI_BUS;
429 
430 	/*
431 	 * Copy out the info structure to the user.
432 	 */
433 	if (size > sizeof(char)) {
434 		memcpy(data, &info, min(sizeof(info), size));
435 		rv = 0;
436 	} else
437 		rv = copyout(&info, *(void **)data, sizeof(info));
438 
439 	return (rv);
440 }
441 
442 int
443 dpti_passthrough(struct dpti_softc *sc, void *data, struct proc *proc)
444 {
445 	struct iop_softc *iop;
446 	struct i2o_msg mh, *mf;
447 	struct i2o_reply rh;
448 	struct iop_msg *im;
449 	struct dpti_ptbuf bufs[IOP_MAX_MSG_XFERS];
450 	u_int32_t mbtmp[IOP_MAX_MSG_SIZE / sizeof(u_int32_t)];
451 	u_int32_t rbtmp[IOP_MAX_MSG_SIZE / sizeof(u_int32_t)];
452 	int rv, msgsize, repsize, sgoff, i, mapped, nbuf, nfrag, j, sz;
453 	u_int32_t *p, *pmax;
454 
455 	iop = (struct iop_softc *)device_parent(&sc->sc_dv);
456 	im = NULL;
457 
458 	if ((rv = dpti_blinkled(sc)) != -1) {
459 		if (rv != 0) {
460 			aprint_error_dev(&sc->sc_dv, "adapter blinkled = 0x%02x\n", rv);
461 			return (EIO);
462 		}
463 	}
464 
465 	/*
466 	 * Copy in the message frame header and determine the size of the
467 	 * full message frame.
468 	 */
469 	if ((rv = copyin(data, &mh, sizeof(mh))) != 0) {
470 		DPRINTF(("%s: message copyin failed\n",
471 		    device_xname(&sc->sc_dv)));
472 		return (rv);
473 	}
474 
475 	msgsize = (mh.msgflags >> 14) & ~3;
476 	if (msgsize < sizeof(mh) || msgsize >= IOP_MAX_MSG_SIZE) {
477 		DPRINTF(("%s: bad message frame size\n",
478 		    device_xname(&sc->sc_dv)));
479 		return (EINVAL);
480 	}
481 
482 	/*
483 	 * Handle special commands.
484 	 */
485 	switch (mh.msgfunc >> 24) {
486 	case I2O_EXEC_IOP_RESET:
487 		printf("%s: I2O_EXEC_IOP_RESET not implemented\n",
488 		    device_xname(&sc->sc_dv));
489 		return (EOPNOTSUPP);
490 
491 	case I2O_EXEC_OUTBOUND_INIT:
492 		printf("%s: I2O_EXEC_OUTBOUND_INIT not implemented\n",
493 		    device_xname(&sc->sc_dv));
494 		return (EOPNOTSUPP);
495 
496 	case I2O_EXEC_SYS_TAB_SET:
497 		printf("%s: I2O_EXEC_SYS_TAB_SET not implemented\n",
498 		    device_xname(&sc->sc_dv));
499 		return (EOPNOTSUPP);
500 
501 	case I2O_EXEC_STATUS_GET:
502 		if ((rv = iop_status_get(iop, 0)) == 0)
503 			rv = copyout(&iop->sc_status, (char *)data + msgsize,
504 			    sizeof(iop->sc_status));
505 		return (rv);
506 	}
507 
508 	/*
509 	 * Copy in the full message frame.
510 	 */
511 	if ((rv = copyin(data, mbtmp, msgsize)) != 0) {
512 		DPRINTF(("%s: full message copyin failed\n",
513 		    device_xname(&sc->sc_dv)));
514 		return (rv);
515 	}
516 
517 	/*
518 	 * Determine the size of the reply frame, and copy it in.
519 	 */
520 	if ((rv = copyin((char *)data + msgsize, &rh, sizeof(rh))) != 0) {
521 		DPRINTF(("%s: reply copyin failed\n",
522 		    device_xname(&sc->sc_dv)));
523 		return (rv);
524 	}
525 
526 	repsize = (rh.msgflags >> 14) & ~3;
527 	if (repsize < sizeof(rh) || repsize >= IOP_MAX_MSG_SIZE) {
528 		DPRINTF(("%s: bad reply header size\n",
529 		    device_xname(&sc->sc_dv)));
530 		return (EINVAL);
531 	}
532 
533 	if ((rv = copyin((char *)data + msgsize, rbtmp, repsize)) != 0) {
534 		DPRINTF(("%s: reply too large\n", device_xname(&sc->sc_dv)));
535 		return (rv);
536 	}
537 
538 	/*
539 	 * If the message has a scatter gather list, it must be comprised of
540 	 * simple elements.  If any one transfer contains multiple segments,
541 	 * we allocate a temporary buffer for it; otherwise, the buffer will
542 	 * be mapped directly.
543 	 */
544 	mapped = 0;
545 	if ((sgoff = ((mh.msgflags >> 4) & 15)) != 0) {
546 		if ((sgoff + 2) > (msgsize >> 2)) {
547 			DPRINTF(("%s: invalid message size fields\n",
548 			    device_xname(&sc->sc_dv)));
549 			return (EINVAL);
550 		}
551 
552 		memset(bufs, 0, sizeof(bufs));
553 
554 		p = mbtmp + sgoff;
555 		pmax = mbtmp + (msgsize >> 2) - 2;
556 
557 		for (nbuf = 0; nbuf < IOP_MAX_MSG_XFERS; nbuf++, p += 2) {
558 			if (p > pmax) {
559 				DPRINTF(("%s: invalid SGL (1)\n",
560 				    device_xname(&sc->sc_dv)));
561 				goto bad;
562 			}
563 
564 			if ((p[0] & 0x30000000) != I2O_SGL_SIMPLE) {
565 				DPRINTF(("%s: invalid SGL (2)\n",
566 				    device_xname(&sc->sc_dv)));
567 				goto bad;
568 			}
569 
570 			bufs[nbuf].db_out = (p[0] & I2O_SGL_DATA_OUT) != 0;
571 			bufs[nbuf].db_ptr = NULL;
572 
573 			if ((p[0] & I2O_SGL_END_BUFFER) != 0) {
574 				if ((p[0] & 0x00ffffff) > IOP_MAX_XFER) {
575 					DPRINTF(("%s: buffer too large\n",
576 					    device_xname(&sc->sc_dv)));
577 					goto bad;
578 				}
579 
580 				bufs[nbuf].db_ptr = (void *)p[1];
581 				bufs[nbuf].db_proc = proc;
582 				bufs[nbuf].db_size = p[0] & 0x00ffffff;
583 
584 				if ((p[0] & I2O_SGL_END) != 0)
585 					break;
586 
587 				continue;
588 			}
589 
590 			/*
591 			 * The buffer has multiple segments.  Determine the
592 			 * total size.
593 			 */
594 			nfrag = 0;
595 			sz = 0;
596 			for (; p <= pmax; p += 2) {
597 				if (nfrag == DPTI_MAX_SEGS) {
598 					DPRINTF(("%s: too many segments\n",
599 					    device_xname(&sc->sc_dv)));
600 					goto bad;
601 				}
602 
603 				bufs[nbuf].db_frags[nfrag].iov_len =
604 				    p[0] & 0x00ffffff;
605 				bufs[nbuf].db_frags[nfrag].iov_base =
606 				    (void *)p[1];
607 
608 				sz += p[0] & 0x00ffffff;
609 				nfrag++;
610 
611 				if ((p[0] & I2O_SGL_END) != 0) {
612 					if ((p[0] & I2O_SGL_END_BUFFER) == 0) {
613 						DPRINTF((
614 						    "%s: invalid SGL (3)\n",
615 						    device_xname(&sc->sc_dv)));
616 						goto bad;
617 					}
618 					break;
619 				}
620 				if ((p[0] & I2O_SGL_END_BUFFER) != 0)
621 					break;
622 			}
623 			bufs[nbuf].db_nfrag = nfrag;
624 
625 			if (p > pmax) {
626 				DPRINTF(("%s: invalid SGL (4)\n",
627 				    device_xname(&sc->sc_dv)));
628 				goto bad;
629 			}
630 
631 			if (sz > IOP_MAX_XFER) {
632 				DPRINTF(("%s: buffer too large\n",
633 				    device_xname(&sc->sc_dv)));
634 				goto bad;
635 			}
636 
637 			bufs[nbuf].db_size = sz;
638 			bufs[nbuf].db_ptr = malloc(sz, M_DEVBUF, M_WAITOK);
639 			if (bufs[nbuf].db_ptr == NULL) {
640 				DPRINTF(("%s: allocation failure\n",
641 				    device_xname(&sc->sc_dv)));
642 				rv = ENOMEM;
643 				goto bad;
644 			}
645 
646 			for (i = 0, sz = 0; i < bufs[nbuf].db_nfrag; i++) {
647 				rv = copyin(bufs[nbuf].db_frags[i].iov_base,
648 				    (char *)bufs[nbuf].db_ptr + sz,
649 				    bufs[nbuf].db_frags[i].iov_len);
650 				if (rv != 0) {
651 					DPRINTF(("%s: frag copyin\n",
652 					    device_xname(&sc->sc_dv)));
653 					goto bad;
654 				}
655 				sz += bufs[nbuf].db_frags[i].iov_len;
656 			}
657 
658 			if ((p[0] & I2O_SGL_END) != 0)
659 				break;
660 		}
661 
662 		if (nbuf == IOP_MAX_MSG_XFERS) {
663 			DPRINTF(("%s: too many transfers\n",
664 			    device_xname(&sc->sc_dv)));
665 			goto bad;
666 		}
667 	} else
668 		nbuf = -1;
669 
670 	/*
671 	 * Allocate a wrapper, and adjust the message header fields to
672 	 * indicate that no scatter-gather list is currently present.
673 	 */
674 
675 	im = iop_msg_alloc(iop, IM_WAIT | IM_NOSTATUS);
676 	im->im_rb = (struct i2o_reply *)rbtmp;
677 	mf = (struct i2o_msg *)mbtmp;
678 	mf->msgictx = IOP_ICTX;
679 	mf->msgtctx = im->im_tctx;
680 
681 	if (sgoff != 0)
682 		mf->msgflags = (mf->msgflags & 0xff0f) | (sgoff << 16);
683 
684 	/*
685 	 * Map the data transfer(s).
686 	 */
687 	for (i = 0; i <= nbuf; i++) {
688 		rv = iop_msg_map(iop, im, mbtmp, bufs[i].db_ptr,
689 		    bufs[i].db_size, bufs[i].db_out, bufs[i].db_proc);
690 		if (rv != 0) {
691 			DPRINTF(("%s: msg_map failed, rv = %d\n",
692 			    device_xname(&sc->sc_dv), rv));
693 			goto bad;
694 		}
695 		mapped = 1;
696 	}
697 
698 	/*
699 	 * Start the command and sleep until it completes.
700 	 */
701 	if ((rv = iop_msg_post(iop, im, mbtmp, 5*60*1000)) != 0)
702 		goto bad;
703 
704 	/*
705 	 * Copy out the reply frame.
706 	 */
707 	if ((rv = copyout(rbtmp, (char *)data + msgsize, repsize)) != 0) {
708 		DPRINTF(("%s: reply copyout() failed\n",
709 		    device_xname(&sc->sc_dv)));
710 	}
711 
712  bad:
713 	/*
714 	 * Free resources and return to the caller.
715 	 */
716 	if (im != NULL) {
717 		if (mapped)
718 			iop_msg_unmap(iop, im);
719 		iop_msg_free(iop, im);
720 	}
721 
722 	for (i = 0; i <= nbuf; i++) {
723 		if (bufs[i].db_proc != NULL)
724 			continue;
725 
726 		if (!bufs[i].db_out && rv == 0) {
727 			for (j = 0, sz = 0; j < bufs[i].db_nfrag; j++) {
728 				rv = copyout((char *)bufs[i].db_ptr + sz,
729 				    bufs[i].db_frags[j].iov_base,
730 				    bufs[i].db_frags[j].iov_len);
731 				if (rv != 0)
732 					break;
733 				sz += bufs[i].db_frags[j].iov_len;
734 			}
735 		}
736 
737 		if (bufs[i].db_ptr != NULL)
738 			free(bufs[i].db_ptr, M_DEVBUF);
739 	}
740 
741 	return (rv);
742 }
743