• Home
  • History
  • Annotate
  • Line#
  • Navigate
  • Raw
  • Download
  • only in /asuswrt-rt-n18u-9.0.0.4.380.2695/release/src-rt-6.x.4708/linux/linux-2.6.36/drivers/scsi/lpfc/
1/*******************************************************************
2 * This file is part of the Emulex Linux Device Driver for         *
3 * Fibre Channel Host Bus Adapters.                                *
4 * Copyright (C) 2009-2010 Emulex.  All rights reserved.                *
5 * EMULEX and SLI are trademarks of Emulex.                        *
6 * www.emulex.com                                                  *
7 *                                                                 *
8 * This program is free software; you can redistribute it and/or   *
9 * modify it under the terms of version 2 of the GNU General       *
10 * Public License as published by the Free Software Foundation.    *
11 * This program is distributed in the hope that it will be useful. *
12 * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND          *
13 * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,  *
14 * FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE      *
15 * DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD *
16 * TO BE LEGALLY INVALID.  See the GNU General Public License for  *
17 * more details, a copy of which can be found in the file COPYING  *
18 * included with this package.                                     *
19 *******************************************************************/
20
21#include <linux/interrupt.h>
22#include <linux/mempool.h>
23#include <linux/pci.h>
24#include <linux/slab.h>
25#include <linux/delay.h>
26
27#include <scsi/scsi.h>
28#include <scsi/scsi_host.h>
29#include <scsi/scsi_transport_fc.h>
30#include <scsi/scsi_bsg_fc.h>
31#include <scsi/fc/fc_fs.h>
32
33#include "lpfc_hw4.h"
34#include "lpfc_hw.h"
35#include "lpfc_sli.h"
36#include "lpfc_sli4.h"
37#include "lpfc_nl.h"
38#include "lpfc_bsg.h"
39#include "lpfc_disc.h"
40#include "lpfc_scsi.h"
41#include "lpfc.h"
42#include "lpfc_logmsg.h"
43#include "lpfc_crtn.h"
44#include "lpfc_vport.h"
45#include "lpfc_version.h"
46
47struct lpfc_bsg_event {
48	struct list_head node;
49	struct kref kref;
50	wait_queue_head_t wq;
51
52	/* Event type and waiter identifiers */
53	uint32_t type_mask;
54	uint32_t req_id;
55	uint32_t reg_id;
56
57	/* next two flags are here for the auto-delete logic */
58	unsigned long wait_time_stamp;
59	int waiting;
60
61	/* seen and not seen events */
62	struct list_head events_to_get;
63	struct list_head events_to_see;
64
65	/* job waiting for this event to finish */
66	struct fc_bsg_job *set_job;
67};
68
69struct lpfc_bsg_iocb {
70	struct lpfc_iocbq *cmdiocbq;
71	struct lpfc_iocbq *rspiocbq;
72	struct lpfc_dmabuf *bmp;
73	struct lpfc_nodelist *ndlp;
74
75	/* job waiting for this iocb to finish */
76	struct fc_bsg_job *set_job;
77};
78
79struct lpfc_bsg_mbox {
80	LPFC_MBOXQ_t *pmboxq;
81	MAILBOX_t *mb;
82	struct lpfc_dmabuf *rxbmp; /* for BIU diags */
83	struct lpfc_dmabufext *dmp; /* for BIU diags */
84	uint8_t *ext; /* extended mailbox data */
85	uint32_t mbOffset; /* from app */
86	uint32_t inExtWLen; /* from app */
87	uint32_t outExtWLen; /* from app */
88
89	/* job waiting for this mbox command to finish */
90	struct fc_bsg_job *set_job;
91};
92
93#define MENLO_DID 0x0000FC0E
94
95struct lpfc_bsg_menlo {
96	struct lpfc_iocbq *cmdiocbq;
97	struct lpfc_iocbq *rspiocbq;
98	struct lpfc_dmabuf *bmp;
99
100	/* job waiting for this iocb to finish */
101	struct fc_bsg_job *set_job;
102};
103
104#define TYPE_EVT 	1
105#define TYPE_IOCB	2
106#define TYPE_MBOX	3
107#define TYPE_MENLO	4
108struct bsg_job_data {
109	uint32_t type;
110	union {
111		struct lpfc_bsg_event *evt;
112		struct lpfc_bsg_iocb iocb;
113		struct lpfc_bsg_mbox mbox;
114		struct lpfc_bsg_menlo menlo;
115	} context_un;
116};
117
118struct event_data {
119	struct list_head node;
120	uint32_t type;
121	uint32_t immed_dat;
122	void *data;
123	uint32_t len;
124};
125
126#define BUF_SZ_4K 4096
127#define SLI_CT_ELX_LOOPBACK 0x10
128
129enum ELX_LOOPBACK_CMD {
130	ELX_LOOPBACK_XRI_SETUP,
131	ELX_LOOPBACK_DATA,
132};
133
134#define ELX_LOOPBACK_HEADER_SZ \
135	(size_t)(&((struct lpfc_sli_ct_request *)NULL)->un)
136
137struct lpfc_dmabufext {
138	struct lpfc_dmabuf dma;
139	uint32_t size;
140	uint32_t flag;
141};
142
143/**
144 * lpfc_bsg_send_mgmt_cmd_cmp - lpfc_bsg_send_mgmt_cmd's completion handler
145 * @phba: Pointer to HBA context object.
146 * @cmdiocbq: Pointer to command iocb.
147 * @rspiocbq: Pointer to response iocb.
148 *
149 * This function is the completion handler for iocbs issued using
150 * lpfc_bsg_send_mgmt_cmd function. This function is called by the
151 * ring event handler function without any lock held. This function
152 * can be called from both worker thread context and interrupt
153 * context. This function also can be called from another thread which
154 * cleans up the SLI layer objects.
155 * This function copies the contents of the response iocb to the
156 * response iocb memory object provided by the caller of
157 * lpfc_sli_issue_iocb_wait and then wakes up the thread which
158 * sleeps for the iocb completion.
159 **/
160static void
161lpfc_bsg_send_mgmt_cmd_cmp(struct lpfc_hba *phba,
162			struct lpfc_iocbq *cmdiocbq,
163			struct lpfc_iocbq *rspiocbq)
164{
165	unsigned long iflags;
166	struct bsg_job_data *dd_data;
167	struct fc_bsg_job *job;
168	IOCB_t *rsp;
169	struct lpfc_dmabuf *bmp;
170	struct lpfc_nodelist *ndlp;
171	struct lpfc_bsg_iocb *iocb;
172	unsigned long flags;
173	int rc = 0;
174
175	spin_lock_irqsave(&phba->ct_ev_lock, flags);
176	dd_data = cmdiocbq->context1;
177	if (!dd_data) {
178		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
179		return;
180	}
181
182	iocb = &dd_data->context_un.iocb;
183	job = iocb->set_job;
184	job->dd_data = NULL; /* so timeout handler does not reply */
185
186	spin_lock_irqsave(&phba->hbalock, iflags);
187	cmdiocbq->iocb_flag |= LPFC_IO_WAKE;
188	if (cmdiocbq->context2 && rspiocbq)
189		memcpy(&((struct lpfc_iocbq *)cmdiocbq->context2)->iocb,
190		       &rspiocbq->iocb, sizeof(IOCB_t));
191	spin_unlock_irqrestore(&phba->hbalock, iflags);
192
193	bmp = iocb->bmp;
194	rspiocbq = iocb->rspiocbq;
195	rsp = &rspiocbq->iocb;
196	ndlp = iocb->ndlp;
197
198	pci_unmap_sg(phba->pcidev, job->request_payload.sg_list,
199		     job->request_payload.sg_cnt, DMA_TO_DEVICE);
200	pci_unmap_sg(phba->pcidev, job->reply_payload.sg_list,
201		     job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
202
203	if (rsp->ulpStatus) {
204		if (rsp->ulpStatus == IOSTAT_LOCAL_REJECT) {
205			switch (rsp->un.ulpWord[4] & 0xff) {
206			case IOERR_SEQUENCE_TIMEOUT:
207				rc = -ETIMEDOUT;
208				break;
209			case IOERR_INVALID_RPI:
210				rc = -EFAULT;
211				break;
212			default:
213				rc = -EACCES;
214				break;
215			}
216		} else
217			rc = -EACCES;
218	} else
219		job->reply->reply_payload_rcv_len =
220			rsp->un.genreq64.bdl.bdeSize;
221
222	lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
223	lpfc_sli_release_iocbq(phba, rspiocbq);
224	lpfc_sli_release_iocbq(phba, cmdiocbq);
225	lpfc_nlp_put(ndlp);
226	kfree(bmp);
227	kfree(dd_data);
228	/* make error code available to userspace */
229	job->reply->result = rc;
230	/* complete the job back to userspace */
231	job->job_done(job);
232	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
233	return;
234}
235
236/**
237 * lpfc_bsg_send_mgmt_cmd - send a CT command from a bsg request
238 * @job: fc_bsg_job to handle
239 **/
240static int
241lpfc_bsg_send_mgmt_cmd(struct fc_bsg_job *job)
242{
243	struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
244	struct lpfc_hba *phba = vport->phba;
245	struct lpfc_rport_data *rdata = job->rport->dd_data;
246	struct lpfc_nodelist *ndlp = rdata->pnode;
247	struct ulp_bde64 *bpl = NULL;
248	uint32_t timeout;
249	struct lpfc_iocbq *cmdiocbq = NULL;
250	struct lpfc_iocbq *rspiocbq = NULL;
251	IOCB_t *cmd;
252	IOCB_t *rsp;
253	struct lpfc_dmabuf *bmp = NULL;
254	int request_nseg;
255	int reply_nseg;
256	struct scatterlist *sgel = NULL;
257	int numbde;
258	dma_addr_t busaddr;
259	struct bsg_job_data *dd_data;
260	uint32_t creg_val;
261	int rc = 0;
262
263	/* in case no data is transferred */
264	job->reply->reply_payload_rcv_len = 0;
265
266	/* allocate our bsg tracking structure */
267	dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
268	if (!dd_data) {
269		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
270				"2733 Failed allocation of dd_data\n");
271		rc = -ENOMEM;
272		goto no_dd_data;
273	}
274
275	if (!lpfc_nlp_get(ndlp)) {
276		rc = -ENODEV;
277		goto no_ndlp;
278	}
279
280	bmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
281	if (!bmp) {
282		rc = -ENOMEM;
283		goto free_ndlp;
284	}
285
286	if (ndlp->nlp_flag & NLP_ELS_SND_MASK) {
287		rc = -ENODEV;
288		goto free_bmp;
289	}
290
291	cmdiocbq = lpfc_sli_get_iocbq(phba);
292	if (!cmdiocbq) {
293		rc = -ENOMEM;
294		goto free_bmp;
295	}
296
297	cmd = &cmdiocbq->iocb;
298	rspiocbq = lpfc_sli_get_iocbq(phba);
299	if (!rspiocbq) {
300		rc = -ENOMEM;
301		goto free_cmdiocbq;
302	}
303
304	rsp = &rspiocbq->iocb;
305	bmp->virt = lpfc_mbuf_alloc(phba, 0, &bmp->phys);
306	if (!bmp->virt) {
307		rc = -ENOMEM;
308		goto free_rspiocbq;
309	}
310
311	INIT_LIST_HEAD(&bmp->list);
312	bpl = (struct ulp_bde64 *) bmp->virt;
313	request_nseg = pci_map_sg(phba->pcidev, job->request_payload.sg_list,
314				  job->request_payload.sg_cnt, DMA_TO_DEVICE);
315	for_each_sg(job->request_payload.sg_list, sgel, request_nseg, numbde) {
316		busaddr = sg_dma_address(sgel);
317		bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64;
318		bpl->tus.f.bdeSize = sg_dma_len(sgel);
319		bpl->tus.w = cpu_to_le32(bpl->tus.w);
320		bpl->addrLow = cpu_to_le32(putPaddrLow(busaddr));
321		bpl->addrHigh = cpu_to_le32(putPaddrHigh(busaddr));
322		bpl++;
323	}
324
325	reply_nseg = pci_map_sg(phba->pcidev, job->reply_payload.sg_list,
326				job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
327	for_each_sg(job->reply_payload.sg_list, sgel, reply_nseg, numbde) {
328		busaddr = sg_dma_address(sgel);
329		bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64I;
330		bpl->tus.f.bdeSize = sg_dma_len(sgel);
331		bpl->tus.w = cpu_to_le32(bpl->tus.w);
332		bpl->addrLow = cpu_to_le32(putPaddrLow(busaddr));
333		bpl->addrHigh = cpu_to_le32(putPaddrHigh(busaddr));
334		bpl++;
335	}
336
337	cmd->un.genreq64.bdl.ulpIoTag32 = 0;
338	cmd->un.genreq64.bdl.addrHigh = putPaddrHigh(bmp->phys);
339	cmd->un.genreq64.bdl.addrLow = putPaddrLow(bmp->phys);
340	cmd->un.genreq64.bdl.bdeFlags = BUFF_TYPE_BLP_64;
341	cmd->un.genreq64.bdl.bdeSize =
342		(request_nseg + reply_nseg) * sizeof(struct ulp_bde64);
343	cmd->ulpCommand = CMD_GEN_REQUEST64_CR;
344	cmd->un.genreq64.w5.hcsw.Fctl = (SI | LA);
345	cmd->un.genreq64.w5.hcsw.Dfctl = 0;
346	cmd->un.genreq64.w5.hcsw.Rctl = FC_RCTL_DD_UNSOL_CTL;
347	cmd->un.genreq64.w5.hcsw.Type = FC_TYPE_CT;
348	cmd->ulpBdeCount = 1;
349	cmd->ulpLe = 1;
350	cmd->ulpClass = CLASS3;
351	cmd->ulpContext = ndlp->nlp_rpi;
352	cmd->ulpOwner = OWN_CHIP;
353	cmdiocbq->vport = phba->pport;
354	cmdiocbq->context3 = bmp;
355	cmdiocbq->iocb_flag |= LPFC_IO_LIBDFC;
356	timeout = phba->fc_ratov * 2;
357	cmd->ulpTimeout = timeout;
358
359	cmdiocbq->iocb_cmpl = lpfc_bsg_send_mgmt_cmd_cmp;
360	cmdiocbq->context1 = dd_data;
361	cmdiocbq->context2 = rspiocbq;
362	dd_data->type = TYPE_IOCB;
363	dd_data->context_un.iocb.cmdiocbq = cmdiocbq;
364	dd_data->context_un.iocb.rspiocbq = rspiocbq;
365	dd_data->context_un.iocb.set_job = job;
366	dd_data->context_un.iocb.bmp = bmp;
367	dd_data->context_un.iocb.ndlp = ndlp;
368
369	if (phba->cfg_poll & DISABLE_FCP_RING_INT) {
370		creg_val = readl(phba->HCregaddr);
371		creg_val |= (HC_R0INT_ENA << LPFC_FCP_RING);
372		writel(creg_val, phba->HCregaddr);
373		readl(phba->HCregaddr); /* flush */
374	}
375
376	rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, cmdiocbq, 0);
377
378	if (rc == IOCB_SUCCESS)
379		return 0; /* done for now */
380	else if (rc == IOCB_BUSY)
381		rc = EAGAIN;
382	else
383		rc = EIO;
384
385
386	/* iocb failed so cleanup */
387	pci_unmap_sg(phba->pcidev, job->request_payload.sg_list,
388		     job->request_payload.sg_cnt, DMA_TO_DEVICE);
389	pci_unmap_sg(phba->pcidev, job->reply_payload.sg_list,
390		     job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
391
392	lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
393
394free_rspiocbq:
395	lpfc_sli_release_iocbq(phba, rspiocbq);
396free_cmdiocbq:
397	lpfc_sli_release_iocbq(phba, cmdiocbq);
398free_bmp:
399	kfree(bmp);
400free_ndlp:
401	lpfc_nlp_put(ndlp);
402no_ndlp:
403	kfree(dd_data);
404no_dd_data:
405	/* make error code available to userspace */
406	job->reply->result = rc;
407	job->dd_data = NULL;
408	return rc;
409}
410
411/**
412 * lpfc_bsg_rport_els_cmp - lpfc_bsg_rport_els's completion handler
413 * @phba: Pointer to HBA context object.
414 * @cmdiocbq: Pointer to command iocb.
415 * @rspiocbq: Pointer to response iocb.
416 *
417 * This function is the completion handler for iocbs issued using
418 * lpfc_bsg_rport_els_cmp function. This function is called by the
419 * ring event handler function without any lock held. This function
420 * can be called from both worker thread context and interrupt
421 * context. This function also can be called from other thread which
422 * cleans up the SLI layer objects.
423 * This function copies the contents of the response iocb to the
424 * response iocb memory object provided by the caller of
425 * lpfc_sli_issue_iocb_wait and then wakes up the thread which
426 * sleeps for the iocb completion.
427 **/
428static void
429lpfc_bsg_rport_els_cmp(struct lpfc_hba *phba,
430			struct lpfc_iocbq *cmdiocbq,
431			struct lpfc_iocbq *rspiocbq)
432{
433	struct bsg_job_data *dd_data;
434	struct fc_bsg_job *job;
435	IOCB_t *rsp;
436	struct lpfc_nodelist *ndlp;
437	struct lpfc_dmabuf *pbuflist = NULL;
438	struct fc_bsg_ctels_reply *els_reply;
439	uint8_t *rjt_data;
440	unsigned long flags;
441	int rc = 0;
442
443	spin_lock_irqsave(&phba->ct_ev_lock, flags);
444	dd_data = cmdiocbq->context1;
445	/* normal completion and timeout crossed paths, already done */
446	if (!dd_data) {
447		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
448		return;
449	}
450
451	cmdiocbq->iocb_flag |= LPFC_IO_WAKE;
452	if (cmdiocbq->context2 && rspiocbq)
453		memcpy(&((struct lpfc_iocbq *)cmdiocbq->context2)->iocb,
454		       &rspiocbq->iocb, sizeof(IOCB_t));
455
456	job = dd_data->context_un.iocb.set_job;
457	cmdiocbq = dd_data->context_un.iocb.cmdiocbq;
458	rspiocbq = dd_data->context_un.iocb.rspiocbq;
459	rsp = &rspiocbq->iocb;
460	ndlp = dd_data->context_un.iocb.ndlp;
461
462	pci_unmap_sg(phba->pcidev, job->request_payload.sg_list,
463		     job->request_payload.sg_cnt, DMA_TO_DEVICE);
464	pci_unmap_sg(phba->pcidev, job->reply_payload.sg_list,
465		     job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
466
467	if (job->reply->result == -EAGAIN)
468		rc = -EAGAIN;
469	else if (rsp->ulpStatus == IOSTAT_SUCCESS)
470		job->reply->reply_payload_rcv_len =
471			rsp->un.elsreq64.bdl.bdeSize;
472	else if (rsp->ulpStatus == IOSTAT_LS_RJT) {
473		job->reply->reply_payload_rcv_len =
474			sizeof(struct fc_bsg_ctels_reply);
475		/* LS_RJT data returned in word 4 */
476		rjt_data = (uint8_t *)&rsp->un.ulpWord[4];
477		els_reply = &job->reply->reply_data.ctels_reply;
478		els_reply->status = FC_CTELS_STATUS_REJECT;
479		els_reply->rjt_data.action = rjt_data[3];
480		els_reply->rjt_data.reason_code = rjt_data[2];
481		els_reply->rjt_data.reason_explanation = rjt_data[1];
482		els_reply->rjt_data.vendor_unique = rjt_data[0];
483	} else
484		rc = -EIO;
485
486	pbuflist = (struct lpfc_dmabuf *) cmdiocbq->context3;
487	lpfc_mbuf_free(phba, pbuflist->virt, pbuflist->phys);
488	lpfc_sli_release_iocbq(phba, rspiocbq);
489	lpfc_sli_release_iocbq(phba, cmdiocbq);
490	lpfc_nlp_put(ndlp);
491	kfree(dd_data);
492	/* make error code available to userspace */
493	job->reply->result = rc;
494	job->dd_data = NULL;
495	/* complete the job back to userspace */
496	job->job_done(job);
497	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
498	return;
499}
500
501/**
502 * lpfc_bsg_rport_els - send an ELS command from a bsg request
503 * @job: fc_bsg_job to handle
504 **/
505static int
506lpfc_bsg_rport_els(struct fc_bsg_job *job)
507{
508	struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
509	struct lpfc_hba *phba = vport->phba;
510	struct lpfc_rport_data *rdata = job->rport->dd_data;
511	struct lpfc_nodelist *ndlp = rdata->pnode;
512	uint32_t elscmd;
513	uint32_t cmdsize;
514	uint32_t rspsize;
515	struct lpfc_iocbq *rspiocbq;
516	struct lpfc_iocbq *cmdiocbq;
517	IOCB_t *rsp;
518	uint16_t rpi = 0;
519	struct lpfc_dmabuf *pcmd;
520	struct lpfc_dmabuf *prsp;
521	struct lpfc_dmabuf *pbuflist = NULL;
522	struct ulp_bde64 *bpl;
523	int request_nseg;
524	int reply_nseg;
525	struct scatterlist *sgel = NULL;
526	int numbde;
527	dma_addr_t busaddr;
528	struct bsg_job_data *dd_data;
529	uint32_t creg_val;
530	int rc = 0;
531
532	/* in case no data is transferred */
533	job->reply->reply_payload_rcv_len = 0;
534
535	/* allocate our bsg tracking structure */
536	dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
537	if (!dd_data) {
538		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
539				"2735 Failed allocation of dd_data\n");
540		rc = -ENOMEM;
541		goto no_dd_data;
542	}
543
544	if (!lpfc_nlp_get(ndlp)) {
545		rc = -ENODEV;
546		goto free_dd_data;
547	}
548
549	elscmd = job->request->rqst_data.r_els.els_code;
550	cmdsize = job->request_payload.payload_len;
551	rspsize = job->reply_payload.payload_len;
552	rspiocbq = lpfc_sli_get_iocbq(phba);
553	if (!rspiocbq) {
554		lpfc_nlp_put(ndlp);
555		rc = -ENOMEM;
556		goto free_dd_data;
557	}
558
559	rsp = &rspiocbq->iocb;
560	rpi = ndlp->nlp_rpi;
561
562	cmdiocbq = lpfc_prep_els_iocb(vport, 1, cmdsize, 0, ndlp,
563				      ndlp->nlp_DID, elscmd);
564	if (!cmdiocbq) {
565		rc = -EIO;
566		goto free_rspiocbq;
567	}
568
569	/* prep els iocb set context1 to the ndlp, context2 to the command
570	 * dmabuf, context3 holds the data dmabuf
571	 */
572	pcmd = (struct lpfc_dmabuf *) cmdiocbq->context2;
573	prsp = (struct lpfc_dmabuf *) pcmd->list.next;
574	lpfc_mbuf_free(phba, pcmd->virt, pcmd->phys);
575	kfree(pcmd);
576	lpfc_mbuf_free(phba, prsp->virt, prsp->phys);
577	kfree(prsp);
578	cmdiocbq->context2 = NULL;
579
580	pbuflist = (struct lpfc_dmabuf *) cmdiocbq->context3;
581	bpl = (struct ulp_bde64 *) pbuflist->virt;
582
583	request_nseg = pci_map_sg(phba->pcidev, job->request_payload.sg_list,
584				  job->request_payload.sg_cnt, DMA_TO_DEVICE);
585	for_each_sg(job->request_payload.sg_list, sgel, request_nseg, numbde) {
586		busaddr = sg_dma_address(sgel);
587		bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64;
588		bpl->tus.f.bdeSize = sg_dma_len(sgel);
589		bpl->tus.w = cpu_to_le32(bpl->tus.w);
590		bpl->addrLow = cpu_to_le32(putPaddrLow(busaddr));
591		bpl->addrHigh = cpu_to_le32(putPaddrHigh(busaddr));
592		bpl++;
593	}
594
595	reply_nseg = pci_map_sg(phba->pcidev, job->reply_payload.sg_list,
596				job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
597	for_each_sg(job->reply_payload.sg_list, sgel, reply_nseg, numbde) {
598		busaddr = sg_dma_address(sgel);
599		bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64I;
600		bpl->tus.f.bdeSize = sg_dma_len(sgel);
601		bpl->tus.w = cpu_to_le32(bpl->tus.w);
602		bpl->addrLow = cpu_to_le32(putPaddrLow(busaddr));
603		bpl->addrHigh = cpu_to_le32(putPaddrHigh(busaddr));
604		bpl++;
605	}
606	cmdiocbq->iocb.un.elsreq64.bdl.bdeSize =
607		(request_nseg + reply_nseg) * sizeof(struct ulp_bde64);
608	cmdiocbq->iocb.ulpContext = rpi;
609	cmdiocbq->iocb_flag |= LPFC_IO_LIBDFC;
610	cmdiocbq->context1 = NULL;
611	cmdiocbq->context2 = NULL;
612
613	cmdiocbq->iocb_cmpl = lpfc_bsg_rport_els_cmp;
614	cmdiocbq->context1 = dd_data;
615	cmdiocbq->context2 = rspiocbq;
616	dd_data->type = TYPE_IOCB;
617	dd_data->context_un.iocb.cmdiocbq = cmdiocbq;
618	dd_data->context_un.iocb.rspiocbq = rspiocbq;
619	dd_data->context_un.iocb.set_job = job;
620	dd_data->context_un.iocb.bmp = NULL;;
621	dd_data->context_un.iocb.ndlp = ndlp;
622
623	if (phba->cfg_poll & DISABLE_FCP_RING_INT) {
624		creg_val = readl(phba->HCregaddr);
625		creg_val |= (HC_R0INT_ENA << LPFC_FCP_RING);
626		writel(creg_val, phba->HCregaddr);
627		readl(phba->HCregaddr); /* flush */
628	}
629	rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, cmdiocbq, 0);
630	lpfc_nlp_put(ndlp);
631	if (rc == IOCB_SUCCESS)
632		return 0; /* done for now */
633	else if (rc == IOCB_BUSY)
634		rc = EAGAIN;
635	else
636		rc = EIO;
637
638	pci_unmap_sg(phba->pcidev, job->request_payload.sg_list,
639		     job->request_payload.sg_cnt, DMA_TO_DEVICE);
640	pci_unmap_sg(phba->pcidev, job->reply_payload.sg_list,
641		     job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
642
643	lpfc_mbuf_free(phba, pbuflist->virt, pbuflist->phys);
644
645	lpfc_sli_release_iocbq(phba, cmdiocbq);
646
647free_rspiocbq:
648	lpfc_sli_release_iocbq(phba, rspiocbq);
649
650free_dd_data:
651	kfree(dd_data);
652
653no_dd_data:
654	/* make error code available to userspace */
655	job->reply->result = rc;
656	job->dd_data = NULL;
657	return rc;
658}
659
660/**
661 * lpfc_bsg_event_free - frees an allocated event structure
662 * @kref: Pointer to a kref.
663 *
664 * Called from kref_put. Back cast the kref into an event structure address.
665 * Free any events to get, delete associated nodes, free any events to see,
666 * free any data then free the event itself.
667 **/
668static void
669lpfc_bsg_event_free(struct kref *kref)
670{
671	struct lpfc_bsg_event *evt = container_of(kref, struct lpfc_bsg_event,
672						  kref);
673	struct event_data *ed;
674
675	list_del(&evt->node);
676
677	while (!list_empty(&evt->events_to_get)) {
678		ed = list_entry(evt->events_to_get.next, typeof(*ed), node);
679		list_del(&ed->node);
680		kfree(ed->data);
681		kfree(ed);
682	}
683
684	while (!list_empty(&evt->events_to_see)) {
685		ed = list_entry(evt->events_to_see.next, typeof(*ed), node);
686		list_del(&ed->node);
687		kfree(ed->data);
688		kfree(ed);
689	}
690
691	kfree(evt);
692}
693
694/**
695 * lpfc_bsg_event_ref - increments the kref for an event
696 * @evt: Pointer to an event structure.
697 **/
698static inline void
699lpfc_bsg_event_ref(struct lpfc_bsg_event *evt)
700{
701	kref_get(&evt->kref);
702}
703
704/**
705 * lpfc_bsg_event_unref - Uses kref_put to free an event structure
706 * @evt: Pointer to an event structure.
707 **/
708static inline void
709lpfc_bsg_event_unref(struct lpfc_bsg_event *evt)
710{
711	kref_put(&evt->kref, lpfc_bsg_event_free);
712}
713
714/**
715 * lpfc_bsg_event_new - allocate and initialize a event structure
716 * @ev_mask: Mask of events.
717 * @ev_reg_id: Event reg id.
718 * @ev_req_id: Event request id.
719 **/
720static struct lpfc_bsg_event *
721lpfc_bsg_event_new(uint32_t ev_mask, int ev_reg_id, uint32_t ev_req_id)
722{
723	struct lpfc_bsg_event *evt = kzalloc(sizeof(*evt), GFP_KERNEL);
724
725	if (!evt)
726		return NULL;
727
728	INIT_LIST_HEAD(&evt->events_to_get);
729	INIT_LIST_HEAD(&evt->events_to_see);
730	evt->type_mask = ev_mask;
731	evt->req_id = ev_req_id;
732	evt->reg_id = ev_reg_id;
733	evt->wait_time_stamp = jiffies;
734	init_waitqueue_head(&evt->wq);
735	kref_init(&evt->kref);
736	return evt;
737}
738
739/**
740 * diag_cmd_data_free - Frees an lpfc dma buffer extension
741 * @phba: Pointer to HBA context object.
742 * @mlist: Pointer to an lpfc dma buffer extension.
743 **/
744static int
745diag_cmd_data_free(struct lpfc_hba *phba, struct lpfc_dmabufext *mlist)
746{
747	struct lpfc_dmabufext *mlast;
748	struct pci_dev *pcidev;
749	struct list_head head, *curr, *next;
750
751	if ((!mlist) || (!lpfc_is_link_up(phba) &&
752		(phba->link_flag & LS_LOOPBACK_MODE))) {
753		return 0;
754	}
755
756	pcidev = phba->pcidev;
757	list_add_tail(&head, &mlist->dma.list);
758
759	list_for_each_safe(curr, next, &head) {
760		mlast = list_entry(curr, struct lpfc_dmabufext , dma.list);
761		if (mlast->dma.virt)
762			dma_free_coherent(&pcidev->dev,
763					  mlast->size,
764					  mlast->dma.virt,
765					  mlast->dma.phys);
766		kfree(mlast);
767	}
768	return 0;
769}
770
771/**
772 * lpfc_bsg_ct_unsol_event - process an unsolicited CT command
773 * @phba:
774 * @pring:
775 * @piocbq:
776 *
777 * This function is called when an unsolicited CT command is received.  It
778 * forwards the event to any processes registered to receive CT events.
779 **/
780int
781lpfc_bsg_ct_unsol_event(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
782			struct lpfc_iocbq *piocbq)
783{
784	uint32_t evt_req_id = 0;
785	uint32_t cmd;
786	uint32_t len;
787	struct lpfc_dmabuf *dmabuf = NULL;
788	struct lpfc_bsg_event *evt;
789	struct event_data *evt_dat = NULL;
790	struct lpfc_iocbq *iocbq;
791	size_t offset = 0;
792	struct list_head head;
793	struct ulp_bde64 *bde;
794	dma_addr_t dma_addr;
795	int i;
796	struct lpfc_dmabuf *bdeBuf1 = piocbq->context2;
797	struct lpfc_dmabuf *bdeBuf2 = piocbq->context3;
798	struct lpfc_hbq_entry *hbqe;
799	struct lpfc_sli_ct_request *ct_req;
800	struct fc_bsg_job *job = NULL;
801	unsigned long flags;
802	int size = 0;
803
804	INIT_LIST_HEAD(&head);
805	list_add_tail(&head, &piocbq->list);
806
807	if (piocbq->iocb.ulpBdeCount == 0 ||
808	    piocbq->iocb.un.cont64[0].tus.f.bdeSize == 0)
809		goto error_ct_unsol_exit;
810
811	if (phba->link_state == LPFC_HBA_ERROR ||
812		(!(phba->sli.sli_flag & LPFC_SLI_ACTIVE)))
813		goto error_ct_unsol_exit;
814
815	if (phba->sli3_options & LPFC_SLI3_HBQ_ENABLED)
816		dmabuf = bdeBuf1;
817	else {
818		dma_addr = getPaddr(piocbq->iocb.un.cont64[0].addrHigh,
819				    piocbq->iocb.un.cont64[0].addrLow);
820		dmabuf = lpfc_sli_ringpostbuf_get(phba, pring, dma_addr);
821	}
822	if (dmabuf == NULL)
823		goto error_ct_unsol_exit;
824	ct_req = (struct lpfc_sli_ct_request *)dmabuf->virt;
825	evt_req_id = ct_req->FsType;
826	cmd = ct_req->CommandResponse.bits.CmdRsp;
827	len = ct_req->CommandResponse.bits.Size;
828	if (!(phba->sli3_options & LPFC_SLI3_HBQ_ENABLED))
829		lpfc_sli_ringpostbuf_put(phba, pring, dmabuf);
830
831	spin_lock_irqsave(&phba->ct_ev_lock, flags);
832	list_for_each_entry(evt, &phba->ct_ev_waiters, node) {
833		if (!(evt->type_mask & FC_REG_CT_EVENT) ||
834			evt->req_id != evt_req_id)
835			continue;
836
837		lpfc_bsg_event_ref(evt);
838		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
839		evt_dat = kzalloc(sizeof(*evt_dat), GFP_KERNEL);
840		if (evt_dat == NULL) {
841			spin_lock_irqsave(&phba->ct_ev_lock, flags);
842			lpfc_bsg_event_unref(evt);
843			lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
844					"2614 Memory allocation failed for "
845					"CT event\n");
846			break;
847		}
848
849		if (phba->sli3_options & LPFC_SLI3_HBQ_ENABLED) {
850			/* take accumulated byte count from the last iocbq */
851			iocbq = list_entry(head.prev, typeof(*iocbq), list);
852			evt_dat->len = iocbq->iocb.unsli3.rcvsli3.acc_len;
853		} else {
854			list_for_each_entry(iocbq, &head, list) {
855				for (i = 0; i < iocbq->iocb.ulpBdeCount; i++)
856					evt_dat->len +=
857					iocbq->iocb.un.cont64[i].tus.f.bdeSize;
858			}
859		}
860
861		evt_dat->data = kzalloc(evt_dat->len, GFP_KERNEL);
862		if (evt_dat->data == NULL) {
863			lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
864					"2615 Memory allocation failed for "
865					"CT event data, size %d\n",
866					evt_dat->len);
867			kfree(evt_dat);
868			spin_lock_irqsave(&phba->ct_ev_lock, flags);
869			lpfc_bsg_event_unref(evt);
870			spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
871			goto error_ct_unsol_exit;
872		}
873
874		list_for_each_entry(iocbq, &head, list) {
875			size = 0;
876			if (phba->sli3_options & LPFC_SLI3_HBQ_ENABLED) {
877				bdeBuf1 = iocbq->context2;
878				bdeBuf2 = iocbq->context3;
879			}
880			for (i = 0; i < iocbq->iocb.ulpBdeCount; i++) {
881				if (phba->sli3_options &
882				    LPFC_SLI3_HBQ_ENABLED) {
883					if (i == 0) {
884						hbqe = (struct lpfc_hbq_entry *)
885						  &iocbq->iocb.un.ulpWord[0];
886						size = hbqe->bde.tus.f.bdeSize;
887						dmabuf = bdeBuf1;
888					} else if (i == 1) {
889						hbqe = (struct lpfc_hbq_entry *)
890							&iocbq->iocb.unsli3.
891							sli3Words[4];
892						size = hbqe->bde.tus.f.bdeSize;
893						dmabuf = bdeBuf2;
894					}
895					if ((offset + size) > evt_dat->len)
896						size = evt_dat->len - offset;
897				} else {
898					size = iocbq->iocb.un.cont64[i].
899						tus.f.bdeSize;
900					bde = &iocbq->iocb.un.cont64[i];
901					dma_addr = getPaddr(bde->addrHigh,
902							    bde->addrLow);
903					dmabuf = lpfc_sli_ringpostbuf_get(phba,
904							pring, dma_addr);
905				}
906				if (!dmabuf) {
907					lpfc_printf_log(phba, KERN_ERR,
908						LOG_LIBDFC, "2616 No dmabuf "
909						"found for iocbq 0x%p\n",
910						iocbq);
911					kfree(evt_dat->data);
912					kfree(evt_dat);
913					spin_lock_irqsave(&phba->ct_ev_lock,
914						flags);
915					lpfc_bsg_event_unref(evt);
916					spin_unlock_irqrestore(
917						&phba->ct_ev_lock, flags);
918					goto error_ct_unsol_exit;
919				}
920				memcpy((char *)(evt_dat->data) + offset,
921				       dmabuf->virt, size);
922				offset += size;
923				if (evt_req_id != SLI_CT_ELX_LOOPBACK &&
924				    !(phba->sli3_options &
925				      LPFC_SLI3_HBQ_ENABLED)) {
926					lpfc_sli_ringpostbuf_put(phba, pring,
927								 dmabuf);
928				} else {
929					switch (cmd) {
930					case ELX_LOOPBACK_DATA:
931						diag_cmd_data_free(phba,
932						(struct lpfc_dmabufext *)
933							dmabuf);
934						break;
935					case ELX_LOOPBACK_XRI_SETUP:
936						if ((phba->sli_rev ==
937							LPFC_SLI_REV2) ||
938							(phba->sli3_options &
939							LPFC_SLI3_HBQ_ENABLED
940							)) {
941							lpfc_in_buf_free(phba,
942									dmabuf);
943						} else {
944							lpfc_post_buffer(phba,
945									 pring,
946									 1);
947						}
948						break;
949					default:
950						if (!(phba->sli3_options &
951						      LPFC_SLI3_HBQ_ENABLED))
952							lpfc_post_buffer(phba,
953									 pring,
954									 1);
955						break;
956					}
957				}
958			}
959		}
960
961		spin_lock_irqsave(&phba->ct_ev_lock, flags);
962		if (phba->sli_rev == LPFC_SLI_REV4) {
963			evt_dat->immed_dat = phba->ctx_idx;
964			phba->ctx_idx = (phba->ctx_idx + 1) % 64;
965			/* Provide warning for over-run of the ct_ctx array */
966			if (phba->ct_ctx[evt_dat->immed_dat].flags &
967			    UNSOL_VALID)
968				lpfc_printf_log(phba, KERN_WARNING, LOG_ELS,
969						"2717 CT context array entry "
970						"[%d] over-run: oxid:x%x, "
971						"sid:x%x\n", phba->ctx_idx,
972						phba->ct_ctx[
973						    evt_dat->immed_dat].oxid,
974						phba->ct_ctx[
975						    evt_dat->immed_dat].SID);
976			phba->ct_ctx[evt_dat->immed_dat].oxid =
977						piocbq->iocb.ulpContext;
978			phba->ct_ctx[evt_dat->immed_dat].SID =
979				piocbq->iocb.un.rcvels.remoteID;
980			phba->ct_ctx[evt_dat->immed_dat].flags = UNSOL_VALID;
981		} else
982			evt_dat->immed_dat = piocbq->iocb.ulpContext;
983
984		evt_dat->type = FC_REG_CT_EVENT;
985		list_add(&evt_dat->node, &evt->events_to_see);
986		if (evt_req_id == SLI_CT_ELX_LOOPBACK) {
987			wake_up_interruptible(&evt->wq);
988			lpfc_bsg_event_unref(evt);
989			break;
990		}
991
992		list_move(evt->events_to_see.prev, &evt->events_to_get);
993		lpfc_bsg_event_unref(evt);
994
995		job = evt->set_job;
996		evt->set_job = NULL;
997		if (job) {
998			job->reply->reply_payload_rcv_len = size;
999			/* make error code available to userspace */
1000			job->reply->result = 0;
1001			job->dd_data = NULL;
1002			/* complete the job back to userspace */
1003			spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1004			job->job_done(job);
1005			spin_lock_irqsave(&phba->ct_ev_lock, flags);
1006		}
1007	}
1008	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1009
1010error_ct_unsol_exit:
1011	if (!list_empty(&head))
1012		list_del(&head);
1013	if (evt_req_id == SLI_CT_ELX_LOOPBACK)
1014		return 0;
1015	return 1;
1016}
1017
1018/**
1019 * lpfc_bsg_hba_set_event - process a SET_EVENT bsg vendor command
1020 * @job: SET_EVENT fc_bsg_job
1021 **/
1022static int
1023lpfc_bsg_hba_set_event(struct fc_bsg_job *job)
1024{
1025	struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
1026	struct lpfc_hba *phba = vport->phba;
1027	struct set_ct_event *event_req;
1028	struct lpfc_bsg_event *evt;
1029	int rc = 0;
1030	struct bsg_job_data *dd_data = NULL;
1031	uint32_t ev_mask;
1032	unsigned long flags;
1033
1034	if (job->request_len <
1035	    sizeof(struct fc_bsg_request) + sizeof(struct set_ct_event)) {
1036		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1037				"2612 Received SET_CT_EVENT below minimum "
1038				"size\n");
1039		rc = -EINVAL;
1040		goto job_error;
1041	}
1042
1043	dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
1044	if (dd_data == NULL) {
1045		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1046				"2734 Failed allocation of dd_data\n");
1047		rc = -ENOMEM;
1048		goto job_error;
1049	}
1050
1051	event_req = (struct set_ct_event *)
1052		job->request->rqst_data.h_vendor.vendor_cmd;
1053	ev_mask = ((uint32_t)(unsigned long)event_req->type_mask &
1054				FC_REG_EVENT_MASK);
1055	spin_lock_irqsave(&phba->ct_ev_lock, flags);
1056	list_for_each_entry(evt, &phba->ct_ev_waiters, node) {
1057		if (evt->reg_id == event_req->ev_reg_id) {
1058			lpfc_bsg_event_ref(evt);
1059			evt->wait_time_stamp = jiffies;
1060			break;
1061		}
1062	}
1063	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1064
1065	if (&evt->node == &phba->ct_ev_waiters) {
1066		/* no event waiting struct yet - first call */
1067		evt = lpfc_bsg_event_new(ev_mask, event_req->ev_reg_id,
1068					event_req->ev_req_id);
1069		if (!evt) {
1070			lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1071					"2617 Failed allocation of event "
1072					"waiter\n");
1073			rc = -ENOMEM;
1074			goto job_error;
1075		}
1076
1077		spin_lock_irqsave(&phba->ct_ev_lock, flags);
1078		list_add(&evt->node, &phba->ct_ev_waiters);
1079		lpfc_bsg_event_ref(evt);
1080		evt->wait_time_stamp = jiffies;
1081		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1082	}
1083
1084	spin_lock_irqsave(&phba->ct_ev_lock, flags);
1085	evt->waiting = 1;
1086	dd_data->type = TYPE_EVT;
1087	dd_data->context_un.evt = evt;
1088	evt->set_job = job; /* for unsolicited command */
1089	job->dd_data = dd_data; /* for fc transport timeout callback*/
1090	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1091	return 0; /* call job done later */
1092
1093job_error:
1094	if (dd_data != NULL)
1095		kfree(dd_data);
1096
1097	job->dd_data = NULL;
1098	return rc;
1099}
1100
1101/**
1102 * lpfc_bsg_hba_get_event - process a GET_EVENT bsg vendor command
1103 * @job: GET_EVENT fc_bsg_job
1104 **/
1105static int
1106lpfc_bsg_hba_get_event(struct fc_bsg_job *job)
1107{
1108	struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
1109	struct lpfc_hba *phba = vport->phba;
1110	struct get_ct_event *event_req;
1111	struct get_ct_event_reply *event_reply;
1112	struct lpfc_bsg_event *evt;
1113	struct event_data *evt_dat = NULL;
1114	unsigned long flags;
1115	uint32_t rc = 0;
1116
1117	if (job->request_len <
1118	    sizeof(struct fc_bsg_request) + sizeof(struct get_ct_event)) {
1119		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1120				"2613 Received GET_CT_EVENT request below "
1121				"minimum size\n");
1122		rc = -EINVAL;
1123		goto job_error;
1124	}
1125
1126	event_req = (struct get_ct_event *)
1127		job->request->rqst_data.h_vendor.vendor_cmd;
1128
1129	event_reply = (struct get_ct_event_reply *)
1130		job->reply->reply_data.vendor_reply.vendor_rsp;
1131	spin_lock_irqsave(&phba->ct_ev_lock, flags);
1132	list_for_each_entry(evt, &phba->ct_ev_waiters, node) {
1133		if (evt->reg_id == event_req->ev_reg_id) {
1134			if (list_empty(&evt->events_to_get))
1135				break;
1136			lpfc_bsg_event_ref(evt);
1137			evt->wait_time_stamp = jiffies;
1138			evt_dat = list_entry(evt->events_to_get.prev,
1139					     struct event_data, node);
1140			list_del(&evt_dat->node);
1141			break;
1142		}
1143	}
1144	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1145
1146	/* The app may continue to ask for event data until it gets
1147	 * an error indicating that there isn't anymore
1148	 */
1149	if (evt_dat == NULL) {
1150		job->reply->reply_payload_rcv_len = 0;
1151		rc = -ENOENT;
1152		goto job_error;
1153	}
1154
1155	if (evt_dat->len > job->request_payload.payload_len) {
1156		evt_dat->len = job->request_payload.payload_len;
1157		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1158				"2618 Truncated event data at %d "
1159				"bytes\n",
1160				job->request_payload.payload_len);
1161	}
1162
1163	event_reply->type = evt_dat->type;
1164	event_reply->immed_data = evt_dat->immed_dat;
1165	if (evt_dat->len > 0)
1166		job->reply->reply_payload_rcv_len =
1167			sg_copy_from_buffer(job->request_payload.sg_list,
1168					    job->request_payload.sg_cnt,
1169					    evt_dat->data, evt_dat->len);
1170	else
1171		job->reply->reply_payload_rcv_len = 0;
1172
1173	if (evt_dat) {
1174		kfree(evt_dat->data);
1175		kfree(evt_dat);
1176	}
1177
1178	spin_lock_irqsave(&phba->ct_ev_lock, flags);
1179	lpfc_bsg_event_unref(evt);
1180	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1181	job->dd_data = NULL;
1182	job->reply->result = 0;
1183	job->job_done(job);
1184	return 0;
1185
1186job_error:
1187	job->dd_data = NULL;
1188	job->reply->result = rc;
1189	return rc;
1190}
1191
1192/**
1193 * lpfc_issue_ct_rsp_cmp - lpfc_issue_ct_rsp's completion handler
1194 * @phba: Pointer to HBA context object.
1195 * @cmdiocbq: Pointer to command iocb.
1196 * @rspiocbq: Pointer to response iocb.
1197 *
1198 * This function is the completion handler for iocbs issued using
1199 * lpfc_issue_ct_rsp_cmp function. This function is called by the
1200 * ring event handler function without any lock held. This function
1201 * can be called from both worker thread context and interrupt
1202 * context. This function also can be called from other thread which
1203 * cleans up the SLI layer objects.
1204 * This function copy the contents of the response iocb to the
1205 * response iocb memory object provided by the caller of
1206 * lpfc_sli_issue_iocb_wait and then wakes up the thread which
1207 * sleeps for the iocb completion.
1208 **/
1209static void
1210lpfc_issue_ct_rsp_cmp(struct lpfc_hba *phba,
1211			struct lpfc_iocbq *cmdiocbq,
1212			struct lpfc_iocbq *rspiocbq)
1213{
1214	struct bsg_job_data *dd_data;
1215	struct fc_bsg_job *job;
1216	IOCB_t *rsp;
1217	struct lpfc_dmabuf *bmp;
1218	struct lpfc_nodelist *ndlp;
1219	unsigned long flags;
1220	int rc = 0;
1221
1222	spin_lock_irqsave(&phba->ct_ev_lock, flags);
1223	dd_data = cmdiocbq->context1;
1224	/* normal completion and timeout crossed paths, already done */
1225	if (!dd_data) {
1226		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1227		return;
1228	}
1229
1230	job = dd_data->context_un.iocb.set_job;
1231	bmp = dd_data->context_un.iocb.bmp;
1232	rsp = &rspiocbq->iocb;
1233	ndlp = dd_data->context_un.iocb.ndlp;
1234
1235	pci_unmap_sg(phba->pcidev, job->request_payload.sg_list,
1236		     job->request_payload.sg_cnt, DMA_TO_DEVICE);
1237
1238	if (rsp->ulpStatus) {
1239		if (rsp->ulpStatus == IOSTAT_LOCAL_REJECT) {
1240			switch (rsp->un.ulpWord[4] & 0xff) {
1241			case IOERR_SEQUENCE_TIMEOUT:
1242				rc = -ETIMEDOUT;
1243				break;
1244			case IOERR_INVALID_RPI:
1245				rc = -EFAULT;
1246				break;
1247			default:
1248				rc = -EACCES;
1249				break;
1250			}
1251		} else
1252			rc = -EACCES;
1253	} else
1254		job->reply->reply_payload_rcv_len =
1255			rsp->un.genreq64.bdl.bdeSize;
1256
1257	lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
1258	lpfc_sli_release_iocbq(phba, cmdiocbq);
1259	lpfc_nlp_put(ndlp);
1260	kfree(bmp);
1261	kfree(dd_data);
1262	/* make error code available to userspace */
1263	job->reply->result = rc;
1264	job->dd_data = NULL;
1265	/* complete the job back to userspace */
1266	job->job_done(job);
1267	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1268	return;
1269}
1270
1271/**
1272 * lpfc_issue_ct_rsp - issue a ct response
1273 * @phba: Pointer to HBA context object.
1274 * @job: Pointer to the job object.
1275 * @tag: tag index value into the ports context exchange array.
1276 * @bmp: Pointer to a dma buffer descriptor.
1277 * @num_entry: Number of enties in the bde.
1278 **/
1279static int
1280lpfc_issue_ct_rsp(struct lpfc_hba *phba, struct fc_bsg_job *job, uint32_t tag,
1281		  struct lpfc_dmabuf *bmp, int num_entry)
1282{
1283	IOCB_t *icmd;
1284	struct lpfc_iocbq *ctiocb = NULL;
1285	int rc = 0;
1286	struct lpfc_nodelist *ndlp = NULL;
1287	struct bsg_job_data *dd_data;
1288	uint32_t creg_val;
1289
1290	/* allocate our bsg tracking structure */
1291	dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
1292	if (!dd_data) {
1293		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1294				"2736 Failed allocation of dd_data\n");
1295		rc = -ENOMEM;
1296		goto no_dd_data;
1297	}
1298
1299	/* Allocate buffer for  command iocb */
1300	ctiocb = lpfc_sli_get_iocbq(phba);
1301	if (!ctiocb) {
1302		rc = ENOMEM;
1303		goto no_ctiocb;
1304	}
1305
1306	icmd = &ctiocb->iocb;
1307	icmd->un.xseq64.bdl.ulpIoTag32 = 0;
1308	icmd->un.xseq64.bdl.addrHigh = putPaddrHigh(bmp->phys);
1309	icmd->un.xseq64.bdl.addrLow = putPaddrLow(bmp->phys);
1310	icmd->un.xseq64.bdl.bdeFlags = BUFF_TYPE_BLP_64;
1311	icmd->un.xseq64.bdl.bdeSize = (num_entry * sizeof(struct ulp_bde64));
1312	icmd->un.xseq64.w5.hcsw.Fctl = (LS | LA);
1313	icmd->un.xseq64.w5.hcsw.Dfctl = 0;
1314	icmd->un.xseq64.w5.hcsw.Rctl = FC_RCTL_DD_SOL_CTL;
1315	icmd->un.xseq64.w5.hcsw.Type = FC_TYPE_CT;
1316
1317	/* Fill in rest of iocb */
1318	icmd->ulpCommand = CMD_XMIT_SEQUENCE64_CX;
1319	icmd->ulpBdeCount = 1;
1320	icmd->ulpLe = 1;
1321	icmd->ulpClass = CLASS3;
1322	if (phba->sli_rev == LPFC_SLI_REV4) {
1323		/* Do not issue unsol response if oxid not marked as valid */
1324		if (!(phba->ct_ctx[tag].flags & UNSOL_VALID)) {
1325			rc = IOCB_ERROR;
1326			goto issue_ct_rsp_exit;
1327		}
1328		icmd->ulpContext = phba->ct_ctx[tag].oxid;
1329		ndlp = lpfc_findnode_did(phba->pport, phba->ct_ctx[tag].SID);
1330		if (!ndlp) {
1331			lpfc_printf_log(phba, KERN_WARNING, LOG_ELS,
1332				 "2721 ndlp null for oxid %x SID %x\n",
1333					icmd->ulpContext,
1334					phba->ct_ctx[tag].SID);
1335			rc = IOCB_ERROR;
1336			goto issue_ct_rsp_exit;
1337		}
1338
1339		/* Check if the ndlp is active */
1340		if (!ndlp || !NLP_CHK_NODE_ACT(ndlp)) {
1341			rc = -IOCB_ERROR;
1342			goto issue_ct_rsp_exit;
1343		}
1344
1345		/* get a refernece count so the ndlp doesn't go away while
1346		 * we respond
1347		 */
1348		if (!lpfc_nlp_get(ndlp)) {
1349			rc = -IOCB_ERROR;
1350			goto issue_ct_rsp_exit;
1351		}
1352
1353		icmd->un.ulpWord[3] = ndlp->nlp_rpi;
1354		/* The exchange is done, mark the entry as invalid */
1355		phba->ct_ctx[tag].flags &= ~UNSOL_VALID;
1356	} else
1357		icmd->ulpContext = (ushort) tag;
1358
1359	icmd->ulpTimeout = phba->fc_ratov * 2;
1360
1361	/* Xmit CT response on exchange <xid> */
1362	lpfc_printf_log(phba, KERN_INFO, LOG_ELS,
1363			"2722 Xmit CT response on exchange x%x Data: x%x x%x\n",
1364			icmd->ulpContext, icmd->ulpIoTag, phba->link_state);
1365
1366	ctiocb->iocb_cmpl = NULL;
1367	ctiocb->iocb_flag |= LPFC_IO_LIBDFC;
1368	ctiocb->vport = phba->pport;
1369	ctiocb->context3 = bmp;
1370
1371	ctiocb->iocb_cmpl = lpfc_issue_ct_rsp_cmp;
1372	ctiocb->context1 = dd_data;
1373	ctiocb->context2 = NULL;
1374	dd_data->type = TYPE_IOCB;
1375	dd_data->context_un.iocb.cmdiocbq = ctiocb;
1376	dd_data->context_un.iocb.rspiocbq = NULL;
1377	dd_data->context_un.iocb.set_job = job;
1378	dd_data->context_un.iocb.bmp = bmp;
1379	dd_data->context_un.iocb.ndlp = ndlp;
1380
1381	if (phba->cfg_poll & DISABLE_FCP_RING_INT) {
1382		creg_val = readl(phba->HCregaddr);
1383		creg_val |= (HC_R0INT_ENA << LPFC_FCP_RING);
1384		writel(creg_val, phba->HCregaddr);
1385		readl(phba->HCregaddr); /* flush */
1386	}
1387
1388	rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, ctiocb, 0);
1389
1390	if (rc == IOCB_SUCCESS)
1391		return 0; /* done for now */
1392
1393issue_ct_rsp_exit:
1394	lpfc_sli_release_iocbq(phba, ctiocb);
1395no_ctiocb:
1396	kfree(dd_data);
1397no_dd_data:
1398	return rc;
1399}
1400
1401/**
1402 * lpfc_bsg_send_mgmt_rsp - process a SEND_MGMT_RESP bsg vendor command
1403 * @job: SEND_MGMT_RESP fc_bsg_job
1404 **/
1405static int
1406lpfc_bsg_send_mgmt_rsp(struct fc_bsg_job *job)
1407{
1408	struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
1409	struct lpfc_hba *phba = vport->phba;
1410	struct send_mgmt_resp *mgmt_resp = (struct send_mgmt_resp *)
1411		job->request->rqst_data.h_vendor.vendor_cmd;
1412	struct ulp_bde64 *bpl;
1413	struct lpfc_dmabuf *bmp = NULL;
1414	struct scatterlist *sgel = NULL;
1415	int request_nseg;
1416	int numbde;
1417	dma_addr_t busaddr;
1418	uint32_t tag = mgmt_resp->tag;
1419	unsigned long reqbfrcnt =
1420			(unsigned long)job->request_payload.payload_len;
1421	int rc = 0;
1422
1423	/* in case no data is transferred */
1424	job->reply->reply_payload_rcv_len = 0;
1425
1426	if (!reqbfrcnt || (reqbfrcnt > (80 * BUF_SZ_4K))) {
1427		rc = -ERANGE;
1428		goto send_mgmt_rsp_exit;
1429	}
1430
1431	bmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
1432	if (!bmp) {
1433		rc = -ENOMEM;
1434		goto send_mgmt_rsp_exit;
1435	}
1436
1437	bmp->virt = lpfc_mbuf_alloc(phba, 0, &bmp->phys);
1438	if (!bmp->virt) {
1439		rc = -ENOMEM;
1440		goto send_mgmt_rsp_free_bmp;
1441	}
1442
1443	INIT_LIST_HEAD(&bmp->list);
1444	bpl = (struct ulp_bde64 *) bmp->virt;
1445	request_nseg = pci_map_sg(phba->pcidev, job->request_payload.sg_list,
1446				  job->request_payload.sg_cnt, DMA_TO_DEVICE);
1447	for_each_sg(job->request_payload.sg_list, sgel, request_nseg, numbde) {
1448		busaddr = sg_dma_address(sgel);
1449		bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64;
1450		bpl->tus.f.bdeSize = sg_dma_len(sgel);
1451		bpl->tus.w = cpu_to_le32(bpl->tus.w);
1452		bpl->addrLow = cpu_to_le32(putPaddrLow(busaddr));
1453		bpl->addrHigh = cpu_to_le32(putPaddrHigh(busaddr));
1454		bpl++;
1455	}
1456
1457	rc = lpfc_issue_ct_rsp(phba, job, tag, bmp, request_nseg);
1458
1459	if (rc == IOCB_SUCCESS)
1460		return 0; /* done for now */
1461
1462	/* TBD need to handle a timeout */
1463	pci_unmap_sg(phba->pcidev, job->request_payload.sg_list,
1464			  job->request_payload.sg_cnt, DMA_TO_DEVICE);
1465	rc = -EACCES;
1466	lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
1467
1468send_mgmt_rsp_free_bmp:
1469	kfree(bmp);
1470send_mgmt_rsp_exit:
1471	/* make error code available to userspace */
1472	job->reply->result = rc;
1473	job->dd_data = NULL;
1474	return rc;
1475}
1476
1477/**
1478 * lpfc_bsg_diag_mode - process a LPFC_BSG_VENDOR_DIAG_MODE bsg vendor command
1479 * @job: LPFC_BSG_VENDOR_DIAG_MODE
1480 *
1481 * This function is responsible for placing a port into diagnostic loopback
1482 * mode in order to perform a diagnostic loopback test.
1483 * All new scsi requests are blocked, a small delay is used to allow the
1484 * scsi requests to complete then the link is brought down. If the link is
1485 * is placed in loopback mode then scsi requests are again allowed
1486 * so the scsi mid-layer doesn't give up on the port.
1487 * All of this is done in-line.
1488 */
1489static int
1490lpfc_bsg_diag_mode(struct fc_bsg_job *job)
1491{
1492	struct Scsi_Host *shost = job->shost;
1493	struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
1494	struct lpfc_hba *phba = vport->phba;
1495	struct diag_mode_set *loopback_mode;
1496	struct lpfc_sli *psli = &phba->sli;
1497	struct lpfc_sli_ring *pring = &psli->ring[LPFC_FCP_RING];
1498	uint32_t link_flags;
1499	uint32_t timeout;
1500	struct lpfc_vport **vports;
1501	LPFC_MBOXQ_t *pmboxq;
1502	int mbxstatus;
1503	int i = 0;
1504	int rc = 0;
1505
1506	/* no data to return just the return code */
1507	job->reply->reply_payload_rcv_len = 0;
1508
1509	if (job->request_len <
1510	    sizeof(struct fc_bsg_request) + sizeof(struct diag_mode_set)) {
1511		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1512				"2738 Received DIAG MODE request below minimum "
1513				"size\n");
1514		rc = -EINVAL;
1515		goto job_error;
1516	}
1517
1518	loopback_mode = (struct diag_mode_set *)
1519		job->request->rqst_data.h_vendor.vendor_cmd;
1520	link_flags = loopback_mode->type;
1521	timeout = loopback_mode->timeout;
1522
1523	if ((phba->link_state == LPFC_HBA_ERROR) ||
1524	    (psli->sli_flag & LPFC_BLOCK_MGMT_IO) ||
1525	    (!(psli->sli_flag & LPFC_SLI_ACTIVE))) {
1526		rc = -EACCES;
1527		goto job_error;
1528	}
1529
1530	pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
1531	if (!pmboxq) {
1532		rc = -ENOMEM;
1533		goto job_error;
1534	}
1535
1536	vports = lpfc_create_vport_work_array(phba);
1537	if (vports) {
1538		for (i = 0; i <= phba->max_vpi && vports[i] != NULL; i++) {
1539			shost = lpfc_shost_from_vport(vports[i]);
1540			scsi_block_requests(shost);
1541		}
1542
1543		lpfc_destroy_vport_work_array(phba, vports);
1544	} else {
1545		shost = lpfc_shost_from_vport(phba->pport);
1546		scsi_block_requests(shost);
1547	}
1548
1549	while (pring->txcmplq_cnt) {
1550		if (i++ > 500)	/* wait up to 5 seconds */
1551			break;
1552
1553		msleep(10);
1554	}
1555
1556	memset((void *)pmboxq, 0, sizeof(LPFC_MBOXQ_t));
1557	pmboxq->u.mb.mbxCommand = MBX_DOWN_LINK;
1558	pmboxq->u.mb.mbxOwner = OWN_HOST;
1559
1560	mbxstatus = lpfc_sli_issue_mbox_wait(phba, pmboxq, LPFC_MBOX_TMO);
1561
1562	if ((mbxstatus == MBX_SUCCESS) && (pmboxq->u.mb.mbxStatus == 0)) {
1563		/* wait for link down before proceeding */
1564		i = 0;
1565		while (phba->link_state != LPFC_LINK_DOWN) {
1566			if (i++ > timeout) {
1567				rc = -ETIMEDOUT;
1568				goto loopback_mode_exit;
1569			}
1570
1571			msleep(10);
1572		}
1573
1574		memset((void *)pmboxq, 0, sizeof(LPFC_MBOXQ_t));
1575		if (link_flags == INTERNAL_LOOP_BACK)
1576			pmboxq->u.mb.un.varInitLnk.link_flags = FLAGS_LOCAL_LB;
1577		else
1578			pmboxq->u.mb.un.varInitLnk.link_flags =
1579				FLAGS_TOPOLOGY_MODE_LOOP;
1580
1581		pmboxq->u.mb.mbxCommand = MBX_INIT_LINK;
1582		pmboxq->u.mb.mbxOwner = OWN_HOST;
1583
1584		mbxstatus = lpfc_sli_issue_mbox_wait(phba, pmboxq,
1585						     LPFC_MBOX_TMO);
1586
1587		if ((mbxstatus != MBX_SUCCESS) || (pmboxq->u.mb.mbxStatus))
1588			rc = -ENODEV;
1589		else {
1590			phba->link_flag |= LS_LOOPBACK_MODE;
1591			/* wait for the link attention interrupt */
1592			msleep(100);
1593
1594			i = 0;
1595			while (phba->link_state != LPFC_HBA_READY) {
1596				if (i++ > timeout) {
1597					rc = -ETIMEDOUT;
1598					break;
1599				}
1600
1601				msleep(10);
1602			}
1603		}
1604
1605	} else
1606		rc = -ENODEV;
1607
1608loopback_mode_exit:
1609	vports = lpfc_create_vport_work_array(phba);
1610	if (vports) {
1611		for (i = 0; i <= phba->max_vpi && vports[i] != NULL; i++) {
1612			shost = lpfc_shost_from_vport(vports[i]);
1613			scsi_unblock_requests(shost);
1614		}
1615		lpfc_destroy_vport_work_array(phba, vports);
1616	} else {
1617		shost = lpfc_shost_from_vport(phba->pport);
1618		scsi_unblock_requests(shost);
1619	}
1620
1621	/*
1622	 * Let SLI layer release mboxq if mbox command completed after timeout.
1623	 */
1624	if (mbxstatus != MBX_TIMEOUT)
1625		mempool_free(pmboxq, phba->mbox_mem_pool);
1626
1627job_error:
1628	/* make error code available to userspace */
1629	job->reply->result = rc;
1630	/* complete the job back to userspace if no error */
1631	if (rc == 0)
1632		job->job_done(job);
1633	return rc;
1634}
1635
1636/**
1637 * lpfcdiag_loop_self_reg - obtains a remote port login id
1638 * @phba: Pointer to HBA context object
1639 * @rpi: Pointer to a remote port login id
1640 *
1641 * This function obtains a remote port login id so the diag loopback test
1642 * can send and receive its own unsolicited CT command.
1643 **/
1644static int lpfcdiag_loop_self_reg(struct lpfc_hba *phba, uint16_t * rpi)
1645{
1646	LPFC_MBOXQ_t *mbox;
1647	struct lpfc_dmabuf *dmabuff;
1648	int status;
1649
1650	mbox = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
1651	if (!mbox)
1652		return ENOMEM;
1653
1654	status = lpfc_reg_rpi(phba, 0, phba->pport->fc_myDID,
1655				(uint8_t *)&phba->pport->fc_sparam, mbox, 0);
1656	if (status) {
1657		mempool_free(mbox, phba->mbox_mem_pool);
1658		return ENOMEM;
1659	}
1660
1661	dmabuff = (struct lpfc_dmabuf *) mbox->context1;
1662	mbox->context1 = NULL;
1663	status = lpfc_sli_issue_mbox_wait(phba, mbox, LPFC_MBOX_TMO);
1664
1665	if ((status != MBX_SUCCESS) || (mbox->u.mb.mbxStatus)) {
1666		lpfc_mbuf_free(phba, dmabuff->virt, dmabuff->phys);
1667		kfree(dmabuff);
1668		if (status != MBX_TIMEOUT)
1669			mempool_free(mbox, phba->mbox_mem_pool);
1670		return ENODEV;
1671	}
1672
1673	*rpi = mbox->u.mb.un.varWords[0];
1674
1675	lpfc_mbuf_free(phba, dmabuff->virt, dmabuff->phys);
1676	kfree(dmabuff);
1677	mempool_free(mbox, phba->mbox_mem_pool);
1678	return 0;
1679}
1680
1681/**
1682 * lpfcdiag_loop_self_unreg - unregs from the rpi
1683 * @phba: Pointer to HBA context object
1684 * @rpi: Remote port login id
1685 *
1686 * This function unregisters the rpi obtained in lpfcdiag_loop_self_reg
1687 **/
1688static int lpfcdiag_loop_self_unreg(struct lpfc_hba *phba, uint16_t rpi)
1689{
1690	LPFC_MBOXQ_t *mbox;
1691	int status;
1692
1693	/* Allocate mboxq structure */
1694	mbox = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
1695	if (mbox == NULL)
1696		return ENOMEM;
1697
1698	lpfc_unreg_login(phba, 0, rpi, mbox);
1699	status = lpfc_sli_issue_mbox_wait(phba, mbox, LPFC_MBOX_TMO);
1700
1701	if ((status != MBX_SUCCESS) || (mbox->u.mb.mbxStatus)) {
1702		if (status != MBX_TIMEOUT)
1703			mempool_free(mbox, phba->mbox_mem_pool);
1704		return EIO;
1705	}
1706
1707	mempool_free(mbox, phba->mbox_mem_pool);
1708	return 0;
1709}
1710
1711/**
1712 * lpfcdiag_loop_get_xri - obtains the transmit and receive ids
1713 * @phba: Pointer to HBA context object
1714 * @rpi: Remote port login id
1715 * @txxri: Pointer to transmit exchange id
1716 * @rxxri: Pointer to response exchabge id
1717 *
1718 * This function obtains the transmit and receive ids required to send
1719 * an unsolicited ct command with a payload. A special lpfc FsType and CmdRsp
1720 * flags are used to the unsolicted response handler is able to process
1721 * the ct command sent on the same port.
1722 **/
1723static int lpfcdiag_loop_get_xri(struct lpfc_hba *phba, uint16_t rpi,
1724			 uint16_t *txxri, uint16_t * rxxri)
1725{
1726	struct lpfc_bsg_event *evt;
1727	struct lpfc_iocbq *cmdiocbq, *rspiocbq;
1728	IOCB_t *cmd, *rsp;
1729	struct lpfc_dmabuf *dmabuf;
1730	struct ulp_bde64 *bpl = NULL;
1731	struct lpfc_sli_ct_request *ctreq = NULL;
1732	int ret_val = 0;
1733	unsigned long flags;
1734
1735	*txxri = 0;
1736	*rxxri = 0;
1737	evt = lpfc_bsg_event_new(FC_REG_CT_EVENT, current->pid,
1738				SLI_CT_ELX_LOOPBACK);
1739	if (!evt)
1740		return ENOMEM;
1741
1742	spin_lock_irqsave(&phba->ct_ev_lock, flags);
1743	list_add(&evt->node, &phba->ct_ev_waiters);
1744	lpfc_bsg_event_ref(evt);
1745	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1746
1747	cmdiocbq = lpfc_sli_get_iocbq(phba);
1748	rspiocbq = lpfc_sli_get_iocbq(phba);
1749
1750	dmabuf = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
1751	if (dmabuf) {
1752		dmabuf->virt = lpfc_mbuf_alloc(phba, 0, &dmabuf->phys);
1753		if (dmabuf->virt) {
1754			INIT_LIST_HEAD(&dmabuf->list);
1755			bpl = (struct ulp_bde64 *) dmabuf->virt;
1756			memset(bpl, 0, sizeof(*bpl));
1757			ctreq = (struct lpfc_sli_ct_request *)(bpl + 1);
1758			bpl->addrHigh =
1759				le32_to_cpu(putPaddrHigh(dmabuf->phys +
1760					sizeof(*bpl)));
1761			bpl->addrLow =
1762				le32_to_cpu(putPaddrLow(dmabuf->phys +
1763					sizeof(*bpl)));
1764			bpl->tus.f.bdeFlags = 0;
1765			bpl->tus.f.bdeSize = ELX_LOOPBACK_HEADER_SZ;
1766			bpl->tus.w = le32_to_cpu(bpl->tus.w);
1767		}
1768	}
1769
1770	if (cmdiocbq == NULL || rspiocbq == NULL ||
1771	    dmabuf == NULL || bpl == NULL || ctreq == NULL ||
1772		dmabuf->virt == NULL) {
1773		ret_val = ENOMEM;
1774		goto err_get_xri_exit;
1775	}
1776
1777	cmd = &cmdiocbq->iocb;
1778	rsp = &rspiocbq->iocb;
1779
1780	memset(ctreq, 0, ELX_LOOPBACK_HEADER_SZ);
1781
1782	ctreq->RevisionId.bits.Revision = SLI_CT_REVISION;
1783	ctreq->RevisionId.bits.InId = 0;
1784	ctreq->FsType = SLI_CT_ELX_LOOPBACK;
1785	ctreq->FsSubType = 0;
1786	ctreq->CommandResponse.bits.CmdRsp = ELX_LOOPBACK_XRI_SETUP;
1787	ctreq->CommandResponse.bits.Size = 0;
1788
1789
1790	cmd->un.xseq64.bdl.addrHigh = putPaddrHigh(dmabuf->phys);
1791	cmd->un.xseq64.bdl.addrLow = putPaddrLow(dmabuf->phys);
1792	cmd->un.xseq64.bdl.bdeFlags = BUFF_TYPE_BLP_64;
1793	cmd->un.xseq64.bdl.bdeSize = sizeof(*bpl);
1794
1795	cmd->un.xseq64.w5.hcsw.Fctl = LA;
1796	cmd->un.xseq64.w5.hcsw.Dfctl = 0;
1797	cmd->un.xseq64.w5.hcsw.Rctl = FC_RCTL_DD_UNSOL_CTL;
1798	cmd->un.xseq64.w5.hcsw.Type = FC_TYPE_CT;
1799
1800	cmd->ulpCommand = CMD_XMIT_SEQUENCE64_CR;
1801	cmd->ulpBdeCount = 1;
1802	cmd->ulpLe = 1;
1803	cmd->ulpClass = CLASS3;
1804	cmd->ulpContext = rpi;
1805
1806	cmdiocbq->iocb_flag |= LPFC_IO_LIBDFC;
1807	cmdiocbq->vport = phba->pport;
1808
1809	ret_val = lpfc_sli_issue_iocb_wait(phba, LPFC_ELS_RING, cmdiocbq,
1810				rspiocbq,
1811				(phba->fc_ratov * 2)
1812				+ LPFC_DRVR_TIMEOUT);
1813	if (ret_val)
1814		goto err_get_xri_exit;
1815
1816	*txxri =  rsp->ulpContext;
1817
1818	evt->waiting = 1;
1819	evt->wait_time_stamp = jiffies;
1820	ret_val = wait_event_interruptible_timeout(
1821		evt->wq, !list_empty(&evt->events_to_see),
1822		((phba->fc_ratov * 2) + LPFC_DRVR_TIMEOUT) * HZ);
1823	if (list_empty(&evt->events_to_see))
1824		ret_val = (ret_val) ? EINTR : ETIMEDOUT;
1825	else {
1826		ret_val = IOCB_SUCCESS;
1827		spin_lock_irqsave(&phba->ct_ev_lock, flags);
1828		list_move(evt->events_to_see.prev, &evt->events_to_get);
1829		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1830		*rxxri = (list_entry(evt->events_to_get.prev,
1831				     typeof(struct event_data),
1832				     node))->immed_dat;
1833	}
1834	evt->waiting = 0;
1835
1836err_get_xri_exit:
1837	spin_lock_irqsave(&phba->ct_ev_lock, flags);
1838	lpfc_bsg_event_unref(evt); /* release ref */
1839	lpfc_bsg_event_unref(evt); /* delete */
1840	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1841
1842	if (dmabuf) {
1843		if (dmabuf->virt)
1844			lpfc_mbuf_free(phba, dmabuf->virt, dmabuf->phys);
1845		kfree(dmabuf);
1846	}
1847
1848	if (cmdiocbq && (ret_val != IOCB_TIMEDOUT))
1849		lpfc_sli_release_iocbq(phba, cmdiocbq);
1850	if (rspiocbq)
1851		lpfc_sli_release_iocbq(phba, rspiocbq);
1852	return ret_val;
1853}
1854
1855/**
1856 * diag_cmd_data_alloc - fills in a bde struct with dma buffers
1857 * @phba: Pointer to HBA context object
1858 * @bpl: Pointer to 64 bit bde structure
1859 * @size: Number of bytes to process
1860 * @nocopydata: Flag to copy user data into the allocated buffer
1861 *
1862 * This function allocates page size buffers and populates an lpfc_dmabufext.
1863 * If allowed the user data pointed to with indataptr is copied into the kernel
1864 * memory. The chained list of page size buffers is returned.
1865 **/
1866static struct lpfc_dmabufext *
1867diag_cmd_data_alloc(struct lpfc_hba *phba,
1868		   struct ulp_bde64 *bpl, uint32_t size,
1869		   int nocopydata)
1870{
1871	struct lpfc_dmabufext *mlist = NULL;
1872	struct lpfc_dmabufext *dmp;
1873	int cnt, offset = 0, i = 0;
1874	struct pci_dev *pcidev;
1875
1876	pcidev = phba->pcidev;
1877
1878	while (size) {
1879		/* We get chunks of 4K */
1880		if (size > BUF_SZ_4K)
1881			cnt = BUF_SZ_4K;
1882		else
1883			cnt = size;
1884
1885		/* allocate struct lpfc_dmabufext buffer header */
1886		dmp = kmalloc(sizeof(struct lpfc_dmabufext), GFP_KERNEL);
1887		if (!dmp)
1888			goto out;
1889
1890		INIT_LIST_HEAD(&dmp->dma.list);
1891
1892		/* Queue it to a linked list */
1893		if (mlist)
1894			list_add_tail(&dmp->dma.list, &mlist->dma.list);
1895		else
1896			mlist = dmp;
1897
1898		/* allocate buffer */
1899		dmp->dma.virt = dma_alloc_coherent(&pcidev->dev,
1900						   cnt,
1901						   &(dmp->dma.phys),
1902						   GFP_KERNEL);
1903
1904		if (!dmp->dma.virt)
1905			goto out;
1906
1907		dmp->size = cnt;
1908
1909		if (nocopydata) {
1910			bpl->tus.f.bdeFlags = 0;
1911			pci_dma_sync_single_for_device(phba->pcidev,
1912				dmp->dma.phys, LPFC_BPL_SIZE, PCI_DMA_TODEVICE);
1913
1914		} else {
1915			memset((uint8_t *)dmp->dma.virt, 0, cnt);
1916			bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64I;
1917		}
1918
1919		/* build buffer ptr list for IOCB */
1920		bpl->addrLow = le32_to_cpu(putPaddrLow(dmp->dma.phys));
1921		bpl->addrHigh = le32_to_cpu(putPaddrHigh(dmp->dma.phys));
1922		bpl->tus.f.bdeSize = (ushort) cnt;
1923		bpl->tus.w = le32_to_cpu(bpl->tus.w);
1924		bpl++;
1925
1926		i++;
1927		offset += cnt;
1928		size -= cnt;
1929	}
1930
1931	mlist->flag = i;
1932	return mlist;
1933out:
1934	diag_cmd_data_free(phba, mlist);
1935	return NULL;
1936}
1937
1938/**
1939 * lpfcdiag_loop_post_rxbufs - post the receive buffers for an unsol CT cmd
1940 * @phba: Pointer to HBA context object
1941 * @rxxri: Receive exchange id
1942 * @len: Number of data bytes
1943 *
1944 * This function allocates and posts a data buffer of sufficient size to recieve
1945 * an unsolicted CT command.
1946 **/
1947static int lpfcdiag_loop_post_rxbufs(struct lpfc_hba *phba, uint16_t rxxri,
1948			     size_t len)
1949{
1950	struct lpfc_sli *psli = &phba->sli;
1951	struct lpfc_sli_ring *pring = &psli->ring[LPFC_ELS_RING];
1952	struct lpfc_iocbq *cmdiocbq;
1953	IOCB_t *cmd = NULL;
1954	struct list_head head, *curr, *next;
1955	struct lpfc_dmabuf *rxbmp;
1956	struct lpfc_dmabuf *dmp;
1957	struct lpfc_dmabuf *mp[2] = {NULL, NULL};
1958	struct ulp_bde64 *rxbpl = NULL;
1959	uint32_t num_bde;
1960	struct lpfc_dmabufext *rxbuffer = NULL;
1961	int ret_val = 0;
1962	int i = 0;
1963
1964	cmdiocbq = lpfc_sli_get_iocbq(phba);
1965	rxbmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
1966	if (rxbmp != NULL) {
1967		rxbmp->virt = lpfc_mbuf_alloc(phba, 0, &rxbmp->phys);
1968		if (rxbmp->virt) {
1969			INIT_LIST_HEAD(&rxbmp->list);
1970			rxbpl = (struct ulp_bde64 *) rxbmp->virt;
1971			rxbuffer = diag_cmd_data_alloc(phba, rxbpl, len, 0);
1972		}
1973	}
1974
1975	if (!cmdiocbq || !rxbmp || !rxbpl || !rxbuffer) {
1976		ret_val = ENOMEM;
1977		goto err_post_rxbufs_exit;
1978	}
1979
1980	/* Queue buffers for the receive exchange */
1981	num_bde = (uint32_t)rxbuffer->flag;
1982	dmp = &rxbuffer->dma;
1983
1984	cmd = &cmdiocbq->iocb;
1985	i = 0;
1986
1987	INIT_LIST_HEAD(&head);
1988	list_add_tail(&head, &dmp->list);
1989	list_for_each_safe(curr, next, &head) {
1990		mp[i] = list_entry(curr, struct lpfc_dmabuf, list);
1991		list_del(curr);
1992
1993		if (phba->sli3_options & LPFC_SLI3_HBQ_ENABLED) {
1994			mp[i]->buffer_tag = lpfc_sli_get_buffer_tag(phba);
1995			cmd->un.quexri64cx.buff.bde.addrHigh =
1996				putPaddrHigh(mp[i]->phys);
1997			cmd->un.quexri64cx.buff.bde.addrLow =
1998				putPaddrLow(mp[i]->phys);
1999			cmd->un.quexri64cx.buff.bde.tus.f.bdeSize =
2000				((struct lpfc_dmabufext *)mp[i])->size;
2001			cmd->un.quexri64cx.buff.buffer_tag = mp[i]->buffer_tag;
2002			cmd->ulpCommand = CMD_QUE_XRI64_CX;
2003			cmd->ulpPU = 0;
2004			cmd->ulpLe = 1;
2005			cmd->ulpBdeCount = 1;
2006			cmd->unsli3.que_xri64cx_ext_words.ebde_count = 0;
2007
2008		} else {
2009			cmd->un.cont64[i].addrHigh = putPaddrHigh(mp[i]->phys);
2010			cmd->un.cont64[i].addrLow = putPaddrLow(mp[i]->phys);
2011			cmd->un.cont64[i].tus.f.bdeSize =
2012				((struct lpfc_dmabufext *)mp[i])->size;
2013					cmd->ulpBdeCount = ++i;
2014
2015			if ((--num_bde > 0) && (i < 2))
2016				continue;
2017
2018			cmd->ulpCommand = CMD_QUE_XRI_BUF64_CX;
2019			cmd->ulpLe = 1;
2020		}
2021
2022		cmd->ulpClass = CLASS3;
2023		cmd->ulpContext = rxxri;
2024
2025		ret_val = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, cmdiocbq, 0);
2026
2027		if (ret_val == IOCB_ERROR) {
2028			diag_cmd_data_free(phba,
2029				(struct lpfc_dmabufext *)mp[0]);
2030			if (mp[1])
2031				diag_cmd_data_free(phba,
2032					  (struct lpfc_dmabufext *)mp[1]);
2033			dmp = list_entry(next, struct lpfc_dmabuf, list);
2034			ret_val = EIO;
2035			goto err_post_rxbufs_exit;
2036		}
2037
2038		lpfc_sli_ringpostbuf_put(phba, pring, mp[0]);
2039		if (mp[1]) {
2040			lpfc_sli_ringpostbuf_put(phba, pring, mp[1]);
2041			mp[1] = NULL;
2042		}
2043
2044		/* The iocb was freed by lpfc_sli_issue_iocb */
2045		cmdiocbq = lpfc_sli_get_iocbq(phba);
2046		if (!cmdiocbq) {
2047			dmp = list_entry(next, struct lpfc_dmabuf, list);
2048			ret_val = EIO;
2049			goto err_post_rxbufs_exit;
2050		}
2051
2052		cmd = &cmdiocbq->iocb;
2053		i = 0;
2054	}
2055	list_del(&head);
2056
2057err_post_rxbufs_exit:
2058
2059	if (rxbmp) {
2060		if (rxbmp->virt)
2061			lpfc_mbuf_free(phba, rxbmp->virt, rxbmp->phys);
2062		kfree(rxbmp);
2063	}
2064
2065	if (cmdiocbq)
2066		lpfc_sli_release_iocbq(phba, cmdiocbq);
2067	return ret_val;
2068}
2069
2070/**
2071 * lpfc_bsg_diag_test - with a port in loopback issues a Ct cmd to itself
2072 * @job: LPFC_BSG_VENDOR_DIAG_TEST fc_bsg_job
2073 *
2074 * This function receives a user data buffer to be transmitted and received on
2075 * the same port, the link must be up and in loopback mode prior
2076 * to being called.
2077 * 1. A kernel buffer is allocated to copy the user data into.
2078 * 2. The port registers with "itself".
2079 * 3. The transmit and receive exchange ids are obtained.
2080 * 4. The receive exchange id is posted.
2081 * 5. A new els loopback event is created.
2082 * 6. The command and response iocbs are allocated.
2083 * 7. The cmd iocb FsType is set to elx loopback and the CmdRsp to looppback.
2084 *
2085 * This function is meant to be called n times while the port is in loopback
2086 * so it is the apps responsibility to issue a reset to take the port out
2087 * of loopback mode.
2088 **/
2089static int
2090lpfc_bsg_diag_test(struct fc_bsg_job *job)
2091{
2092	struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
2093	struct lpfc_hba *phba = vport->phba;
2094	struct diag_mode_test *diag_mode;
2095	struct lpfc_bsg_event *evt;
2096	struct event_data *evdat;
2097	struct lpfc_sli *psli = &phba->sli;
2098	uint32_t size;
2099	uint32_t full_size;
2100	size_t segment_len = 0, segment_offset = 0, current_offset = 0;
2101	uint16_t rpi;
2102	struct lpfc_iocbq *cmdiocbq, *rspiocbq;
2103	IOCB_t *cmd, *rsp;
2104	struct lpfc_sli_ct_request *ctreq;
2105	struct lpfc_dmabuf *txbmp;
2106	struct ulp_bde64 *txbpl = NULL;
2107	struct lpfc_dmabufext *txbuffer = NULL;
2108	struct list_head head;
2109	struct lpfc_dmabuf  *curr;
2110	uint16_t txxri, rxxri;
2111	uint32_t num_bde;
2112	uint8_t *ptr = NULL, *rx_databuf = NULL;
2113	int rc = 0;
2114	unsigned long flags;
2115	void *dataout = NULL;
2116	uint32_t total_mem;
2117
2118	/* in case no data is returned return just the return code */
2119	job->reply->reply_payload_rcv_len = 0;
2120
2121	if (job->request_len <
2122	    sizeof(struct fc_bsg_request) + sizeof(struct diag_mode_test)) {
2123		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2124				"2739 Received DIAG TEST request below minimum "
2125				"size\n");
2126		rc = -EINVAL;
2127		goto loopback_test_exit;
2128	}
2129
2130	if (job->request_payload.payload_len !=
2131		job->reply_payload.payload_len) {
2132		rc = -EINVAL;
2133		goto loopback_test_exit;
2134	}
2135
2136	diag_mode = (struct diag_mode_test *)
2137		job->request->rqst_data.h_vendor.vendor_cmd;
2138
2139	if ((phba->link_state == LPFC_HBA_ERROR) ||
2140	    (psli->sli_flag & LPFC_BLOCK_MGMT_IO) ||
2141	    (!(psli->sli_flag & LPFC_SLI_ACTIVE))) {
2142		rc = -EACCES;
2143		goto loopback_test_exit;
2144	}
2145
2146	if (!lpfc_is_link_up(phba) || !(phba->link_flag & LS_LOOPBACK_MODE)) {
2147		rc = -EACCES;
2148		goto loopback_test_exit;
2149	}
2150
2151	size = job->request_payload.payload_len;
2152	full_size = size + ELX_LOOPBACK_HEADER_SZ; /* plus the header */
2153
2154	if ((size == 0) || (size > 80 * BUF_SZ_4K)) {
2155		rc = -ERANGE;
2156		goto loopback_test_exit;
2157	}
2158
2159	if (size >= BUF_SZ_4K) {
2160		/*
2161		 * Allocate memory for ioctl data. If buffer is bigger than 64k,
2162		 * then we allocate 64k and re-use that buffer over and over to
2163		 * xfer the whole block. This is because Linux kernel has a
2164		 * problem allocating more than 120k of kernel space memory. Saw
2165		 * problem with GET_FCPTARGETMAPPING...
2166		 */
2167		if (size <= (64 * 1024))
2168			total_mem = size;
2169		else
2170			total_mem = 64 * 1024;
2171	} else
2172		/* Allocate memory for ioctl data */
2173		total_mem = BUF_SZ_4K;
2174
2175	dataout = kmalloc(total_mem, GFP_KERNEL);
2176	if (dataout == NULL) {
2177		rc = -ENOMEM;
2178		goto loopback_test_exit;
2179	}
2180
2181	ptr = dataout;
2182	ptr += ELX_LOOPBACK_HEADER_SZ;
2183	sg_copy_to_buffer(job->request_payload.sg_list,
2184				job->request_payload.sg_cnt,
2185				ptr, size);
2186
2187	rc = lpfcdiag_loop_self_reg(phba, &rpi);
2188	if (rc) {
2189		rc = -ENOMEM;
2190		goto loopback_test_exit;
2191	}
2192
2193	rc = lpfcdiag_loop_get_xri(phba, rpi, &txxri, &rxxri);
2194	if (rc) {
2195		lpfcdiag_loop_self_unreg(phba, rpi);
2196		rc = -ENOMEM;
2197		goto loopback_test_exit;
2198	}
2199
2200	rc = lpfcdiag_loop_post_rxbufs(phba, rxxri, full_size);
2201	if (rc) {
2202		lpfcdiag_loop_self_unreg(phba, rpi);
2203		rc = -ENOMEM;
2204		goto loopback_test_exit;
2205	}
2206
2207	evt = lpfc_bsg_event_new(FC_REG_CT_EVENT, current->pid,
2208				SLI_CT_ELX_LOOPBACK);
2209	if (!evt) {
2210		lpfcdiag_loop_self_unreg(phba, rpi);
2211		rc = -ENOMEM;
2212		goto loopback_test_exit;
2213	}
2214
2215	spin_lock_irqsave(&phba->ct_ev_lock, flags);
2216	list_add(&evt->node, &phba->ct_ev_waiters);
2217	lpfc_bsg_event_ref(evt);
2218	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
2219
2220	cmdiocbq = lpfc_sli_get_iocbq(phba);
2221	rspiocbq = lpfc_sli_get_iocbq(phba);
2222	txbmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
2223
2224	if (txbmp) {
2225		txbmp->virt = lpfc_mbuf_alloc(phba, 0, &txbmp->phys);
2226		if (txbmp->virt) {
2227			INIT_LIST_HEAD(&txbmp->list);
2228			txbpl = (struct ulp_bde64 *) txbmp->virt;
2229			txbuffer = diag_cmd_data_alloc(phba,
2230							txbpl, full_size, 0);
2231		}
2232	}
2233
2234	if (!cmdiocbq || !rspiocbq || !txbmp || !txbpl || !txbuffer ||
2235		!txbmp->virt) {
2236		rc = -ENOMEM;
2237		goto err_loopback_test_exit;
2238	}
2239
2240	cmd = &cmdiocbq->iocb;
2241	rsp = &rspiocbq->iocb;
2242
2243	INIT_LIST_HEAD(&head);
2244	list_add_tail(&head, &txbuffer->dma.list);
2245	list_for_each_entry(curr, &head, list) {
2246		segment_len = ((struct lpfc_dmabufext *)curr)->size;
2247		if (current_offset == 0) {
2248			ctreq = curr->virt;
2249			memset(ctreq, 0, ELX_LOOPBACK_HEADER_SZ);
2250			ctreq->RevisionId.bits.Revision = SLI_CT_REVISION;
2251			ctreq->RevisionId.bits.InId = 0;
2252			ctreq->FsType = SLI_CT_ELX_LOOPBACK;
2253			ctreq->FsSubType = 0;
2254			ctreq->CommandResponse.bits.CmdRsp = ELX_LOOPBACK_DATA;
2255			ctreq->CommandResponse.bits.Size   = size;
2256			segment_offset = ELX_LOOPBACK_HEADER_SZ;
2257		} else
2258			segment_offset = 0;
2259
2260		BUG_ON(segment_offset >= segment_len);
2261		memcpy(curr->virt + segment_offset,
2262			ptr + current_offset,
2263			segment_len - segment_offset);
2264
2265		current_offset += segment_len - segment_offset;
2266		BUG_ON(current_offset > size);
2267	}
2268	list_del(&head);
2269
2270	/* Build the XMIT_SEQUENCE iocb */
2271
2272	num_bde = (uint32_t)txbuffer->flag;
2273
2274	cmd->un.xseq64.bdl.addrHigh = putPaddrHigh(txbmp->phys);
2275	cmd->un.xseq64.bdl.addrLow = putPaddrLow(txbmp->phys);
2276	cmd->un.xseq64.bdl.bdeFlags = BUFF_TYPE_BLP_64;
2277	cmd->un.xseq64.bdl.bdeSize = (num_bde * sizeof(struct ulp_bde64));
2278
2279	cmd->un.xseq64.w5.hcsw.Fctl = (LS | LA);
2280	cmd->un.xseq64.w5.hcsw.Dfctl = 0;
2281	cmd->un.xseq64.w5.hcsw.Rctl = FC_RCTL_DD_UNSOL_CTL;
2282	cmd->un.xseq64.w5.hcsw.Type = FC_TYPE_CT;
2283
2284	cmd->ulpCommand = CMD_XMIT_SEQUENCE64_CX;
2285	cmd->ulpBdeCount = 1;
2286	cmd->ulpLe = 1;
2287	cmd->ulpClass = CLASS3;
2288	cmd->ulpContext = txxri;
2289
2290	cmdiocbq->iocb_flag |= LPFC_IO_LIBDFC;
2291	cmdiocbq->vport = phba->pport;
2292
2293	rc = lpfc_sli_issue_iocb_wait(phba, LPFC_ELS_RING, cmdiocbq, rspiocbq,
2294				      (phba->fc_ratov * 2) + LPFC_DRVR_TIMEOUT);
2295
2296	if ((rc != IOCB_SUCCESS) || (rsp->ulpStatus != IOCB_SUCCESS)) {
2297		rc = -EIO;
2298		goto err_loopback_test_exit;
2299	}
2300
2301	evt->waiting = 1;
2302	rc = wait_event_interruptible_timeout(
2303		evt->wq, !list_empty(&evt->events_to_see),
2304		((phba->fc_ratov * 2) + LPFC_DRVR_TIMEOUT) * HZ);
2305	evt->waiting = 0;
2306	if (list_empty(&evt->events_to_see))
2307		rc = (rc) ? -EINTR : -ETIMEDOUT;
2308	else {
2309		spin_lock_irqsave(&phba->ct_ev_lock, flags);
2310		list_move(evt->events_to_see.prev, &evt->events_to_get);
2311		evdat = list_entry(evt->events_to_get.prev,
2312				   typeof(*evdat), node);
2313		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
2314		rx_databuf = evdat->data;
2315		if (evdat->len != full_size) {
2316			lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
2317				"1603 Loopback test did not receive expected "
2318				"data length. actual length 0x%x expected "
2319				"length 0x%x\n",
2320				evdat->len, full_size);
2321			rc = -EIO;
2322		} else if (rx_databuf == NULL)
2323			rc = -EIO;
2324		else {
2325			rc = IOCB_SUCCESS;
2326			/* skip over elx loopback header */
2327			rx_databuf += ELX_LOOPBACK_HEADER_SZ;
2328			job->reply->reply_payload_rcv_len =
2329				sg_copy_from_buffer(job->reply_payload.sg_list,
2330						    job->reply_payload.sg_cnt,
2331						    rx_databuf, size);
2332			job->reply->reply_payload_rcv_len = size;
2333		}
2334	}
2335
2336err_loopback_test_exit:
2337	lpfcdiag_loop_self_unreg(phba, rpi);
2338
2339	spin_lock_irqsave(&phba->ct_ev_lock, flags);
2340	lpfc_bsg_event_unref(evt); /* release ref */
2341	lpfc_bsg_event_unref(evt); /* delete */
2342	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
2343
2344	if (cmdiocbq != NULL)
2345		lpfc_sli_release_iocbq(phba, cmdiocbq);
2346
2347	if (rspiocbq != NULL)
2348		lpfc_sli_release_iocbq(phba, rspiocbq);
2349
2350	if (txbmp != NULL) {
2351		if (txbpl != NULL) {
2352			if (txbuffer != NULL)
2353				diag_cmd_data_free(phba, txbuffer);
2354			lpfc_mbuf_free(phba, txbmp->virt, txbmp->phys);
2355		}
2356		kfree(txbmp);
2357	}
2358
2359loopback_test_exit:
2360	kfree(dataout);
2361	/* make error code available to userspace */
2362	job->reply->result = rc;
2363	job->dd_data = NULL;
2364	/* complete the job back to userspace if no error */
2365	if (rc == 0)
2366		job->job_done(job);
2367	return rc;
2368}
2369
2370/**
2371 * lpfc_bsg_get_dfc_rev - process a GET_DFC_REV bsg vendor command
2372 * @job: GET_DFC_REV fc_bsg_job
2373 **/
2374static int
2375lpfc_bsg_get_dfc_rev(struct fc_bsg_job *job)
2376{
2377	struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
2378	struct lpfc_hba *phba = vport->phba;
2379	struct get_mgmt_rev *event_req;
2380	struct get_mgmt_rev_reply *event_reply;
2381	int rc = 0;
2382
2383	if (job->request_len <
2384	    sizeof(struct fc_bsg_request) + sizeof(struct get_mgmt_rev)) {
2385		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2386				"2740 Received GET_DFC_REV request below "
2387				"minimum size\n");
2388		rc = -EINVAL;
2389		goto job_error;
2390	}
2391
2392	event_req = (struct get_mgmt_rev *)
2393		job->request->rqst_data.h_vendor.vendor_cmd;
2394
2395	event_reply = (struct get_mgmt_rev_reply *)
2396		job->reply->reply_data.vendor_reply.vendor_rsp;
2397
2398	if (job->reply_len <
2399	    sizeof(struct fc_bsg_request) + sizeof(struct get_mgmt_rev_reply)) {
2400		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2401				"2741 Received GET_DFC_REV reply below "
2402				"minimum size\n");
2403		rc = -EINVAL;
2404		goto job_error;
2405	}
2406
2407	event_reply->info.a_Major = MANAGEMENT_MAJOR_REV;
2408	event_reply->info.a_Minor = MANAGEMENT_MINOR_REV;
2409job_error:
2410	job->reply->result = rc;
2411	if (rc == 0)
2412		job->job_done(job);
2413	return rc;
2414}
2415
2416/**
2417 * lpfc_bsg_wake_mbox_wait - lpfc_bsg_issue_mbox mbox completion handler
2418 * @phba: Pointer to HBA context object.
2419 * @pmboxq: Pointer to mailbox command.
2420 *
2421 * This is completion handler function for mailbox commands issued from
2422 * lpfc_bsg_issue_mbox function. This function is called by the
2423 * mailbox event handler function with no lock held. This function
2424 * will wake up thread waiting on the wait queue pointed by context1
2425 * of the mailbox.
2426 **/
2427void
2428lpfc_bsg_wake_mbox_wait(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmboxq)
2429{
2430	struct bsg_job_data *dd_data;
2431	struct fc_bsg_job *job;
2432	uint32_t size;
2433	unsigned long flags;
2434	uint8_t *to;
2435	uint8_t *from;
2436
2437	spin_lock_irqsave(&phba->ct_ev_lock, flags);
2438	dd_data = pmboxq->context1;
2439	/* job already timed out? */
2440	if (!dd_data) {
2441		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
2442		return;
2443	}
2444
2445	/* build the outgoing buffer to do an sg copy
2446	 * the format is the response mailbox followed by any extended
2447	 * mailbox data
2448	 */
2449	from = (uint8_t *)&pmboxq->u.mb;
2450	to = (uint8_t *)dd_data->context_un.mbox.mb;
2451	memcpy(to, from, sizeof(MAILBOX_t));
2452	if (pmboxq->u.mb.mbxStatus == MBX_SUCCESS) {
2453		/* copy the extended data if any, count is in words */
2454		if (dd_data->context_un.mbox.outExtWLen) {
2455			from = (uint8_t *)dd_data->context_un.mbox.ext;
2456			to += sizeof(MAILBOX_t);
2457			size = dd_data->context_un.mbox.outExtWLen *
2458					sizeof(uint32_t);
2459			memcpy(to, from, size);
2460		} else if (pmboxq->u.mb.mbxCommand == MBX_RUN_BIU_DIAG64) {
2461			from = (uint8_t *)dd_data->context_un.mbox.
2462						dmp->dma.virt;
2463			to += sizeof(MAILBOX_t);
2464			size = dd_data->context_un.mbox.dmp->size;
2465			memcpy(to, from, size);
2466		} else if ((phba->sli_rev == LPFC_SLI_REV4) &&
2467			(pmboxq->u.mb.mbxCommand == MBX_DUMP_MEMORY)) {
2468			from = (uint8_t *)dd_data->context_un.mbox.dmp->dma.
2469						virt;
2470			to += sizeof(MAILBOX_t);
2471			size = pmboxq->u.mb.un.varWords[5];
2472			memcpy(to, from, size);
2473		} else if (pmboxq->u.mb.mbxCommand == MBX_READ_EVENT_LOG) {
2474			from = (uint8_t *)dd_data->context_un.
2475						mbox.dmp->dma.virt;
2476			to += sizeof(MAILBOX_t);
2477			size = dd_data->context_un.mbox.dmp->size;
2478			memcpy(to, from, size);
2479		}
2480	}
2481
2482	from = (uint8_t *)dd_data->context_un.mbox.mb;
2483	job = dd_data->context_un.mbox.set_job;
2484	size = job->reply_payload.payload_len;
2485	job->reply->reply_payload_rcv_len =
2486		sg_copy_from_buffer(job->reply_payload.sg_list,
2487				job->reply_payload.sg_cnt,
2488				from, size);
2489	job->reply->result = 0;
2490
2491	dd_data->context_un.mbox.set_job = NULL;
2492	job->dd_data = NULL;
2493	job->job_done(job);
2494	/* need to hold the lock until we call job done to hold off
2495	 * the timeout handler returning to the midlayer while
2496	 * we are stillprocessing the job
2497	 */
2498	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
2499
2500	kfree(dd_data->context_un.mbox.mb);
2501	mempool_free(dd_data->context_un.mbox.pmboxq, phba->mbox_mem_pool);
2502	kfree(dd_data->context_un.mbox.ext);
2503	if (dd_data->context_un.mbox.dmp) {
2504		dma_free_coherent(&phba->pcidev->dev,
2505			dd_data->context_un.mbox.dmp->size,
2506			dd_data->context_un.mbox.dmp->dma.virt,
2507			dd_data->context_un.mbox.dmp->dma.phys);
2508		kfree(dd_data->context_un.mbox.dmp);
2509	}
2510	if (dd_data->context_un.mbox.rxbmp) {
2511		lpfc_mbuf_free(phba, dd_data->context_un.mbox.rxbmp->virt,
2512			dd_data->context_un.mbox.rxbmp->phys);
2513		kfree(dd_data->context_un.mbox.rxbmp);
2514	}
2515	kfree(dd_data);
2516	return;
2517}
2518
2519/**
2520 * lpfc_bsg_check_cmd_access - test for a supported mailbox command
2521 * @phba: Pointer to HBA context object.
2522 * @mb: Pointer to a mailbox object.
2523 * @vport: Pointer to a vport object.
2524 *
2525 * Some commands require the port to be offline, some may not be called from
2526 * the application.
2527 **/
2528static int lpfc_bsg_check_cmd_access(struct lpfc_hba *phba,
2529	MAILBOX_t *mb, struct lpfc_vport *vport)
2530{
2531	/* return negative error values for bsg job */
2532	switch (mb->mbxCommand) {
2533	/* Offline only */
2534	case MBX_INIT_LINK:
2535	case MBX_DOWN_LINK:
2536	case MBX_CONFIG_LINK:
2537	case MBX_CONFIG_RING:
2538	case MBX_RESET_RING:
2539	case MBX_UNREG_LOGIN:
2540	case MBX_CLEAR_LA:
2541	case MBX_DUMP_CONTEXT:
2542	case MBX_RUN_DIAGS:
2543	case MBX_RESTART:
2544	case MBX_SET_MASK:
2545		if (!(vport->fc_flag & FC_OFFLINE_MODE)) {
2546			lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2547				"2743 Command 0x%x is illegal in on-line "
2548				"state\n",
2549				mb->mbxCommand);
2550			return -EPERM;
2551		}
2552	case MBX_WRITE_NV:
2553	case MBX_WRITE_VPARMS:
2554	case MBX_LOAD_SM:
2555	case MBX_READ_NV:
2556	case MBX_READ_CONFIG:
2557	case MBX_READ_RCONFIG:
2558	case MBX_READ_STATUS:
2559	case MBX_READ_XRI:
2560	case MBX_READ_REV:
2561	case MBX_READ_LNK_STAT:
2562	case MBX_DUMP_MEMORY:
2563	case MBX_DOWN_LOAD:
2564	case MBX_UPDATE_CFG:
2565	case MBX_KILL_BOARD:
2566	case MBX_LOAD_AREA:
2567	case MBX_LOAD_EXP_ROM:
2568	case MBX_BEACON:
2569	case MBX_DEL_LD_ENTRY:
2570	case MBX_SET_DEBUG:
2571	case MBX_WRITE_WWN:
2572	case MBX_SLI4_CONFIG:
2573	case MBX_READ_EVENT_LOG:
2574	case MBX_READ_EVENT_LOG_STATUS:
2575	case MBX_WRITE_EVENT_LOG:
2576	case MBX_PORT_CAPABILITIES:
2577	case MBX_PORT_IOV_CONTROL:
2578	case MBX_RUN_BIU_DIAG64:
2579		break;
2580	case MBX_SET_VARIABLE:
2581		lpfc_printf_log(phba, KERN_INFO, LOG_INIT,
2582			"1226 mbox: set_variable 0x%x, 0x%x\n",
2583			mb->un.varWords[0],
2584			mb->un.varWords[1]);
2585		if ((mb->un.varWords[0] == SETVAR_MLOMNT)
2586			&& (mb->un.varWords[1] == 1)) {
2587			phba->wait_4_mlo_maint_flg = 1;
2588		} else if (mb->un.varWords[0] == SETVAR_MLORST) {
2589			phba->link_flag &= ~LS_LOOPBACK_MODE;
2590			phba->fc_topology = TOPOLOGY_PT_PT;
2591		}
2592		break;
2593	case MBX_READ_SPARM64:
2594	case MBX_READ_LA:
2595	case MBX_READ_LA64:
2596	case MBX_REG_LOGIN:
2597	case MBX_REG_LOGIN64:
2598	case MBX_CONFIG_PORT:
2599	case MBX_RUN_BIU_DIAG:
2600	default:
2601		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2602			"2742 Unknown Command 0x%x\n",
2603			mb->mbxCommand);
2604		return -EPERM;
2605	}
2606
2607	return 0; /* ok */
2608}
2609
2610/**
2611 * lpfc_bsg_issue_mbox - issues a mailbox command on behalf of an app
2612 * @phba: Pointer to HBA context object.
2613 * @mb: Pointer to a mailbox object.
2614 * @vport: Pointer to a vport object.
2615 *
2616 * Allocate a tracking object, mailbox command memory, get a mailbox
2617 * from the mailbox pool, copy the caller mailbox command.
2618 *
2619 * If offline and the sli is active we need to poll for the command (port is
2620 * being reset) and com-plete the job, otherwise issue the mailbox command and
2621 * let our completion handler finish the command.
2622 **/
2623static uint32_t
2624lpfc_bsg_issue_mbox(struct lpfc_hba *phba, struct fc_bsg_job *job,
2625	struct lpfc_vport *vport)
2626{
2627	LPFC_MBOXQ_t *pmboxq = NULL; /* internal mailbox queue */
2628	MAILBOX_t *pmb; /* shortcut to the pmboxq mailbox */
2629	/* a 4k buffer to hold the mb and extended data from/to the bsg */
2630	MAILBOX_t *mb = NULL;
2631	struct bsg_job_data *dd_data = NULL; /* bsg data tracking structure */
2632	uint32_t size;
2633	struct lpfc_dmabuf *rxbmp = NULL; /* for biu diag */
2634	struct lpfc_dmabufext *dmp = NULL; /* for biu diag */
2635	struct ulp_bde64 *rxbpl = NULL;
2636	struct dfc_mbox_req *mbox_req = (struct dfc_mbox_req *)
2637		job->request->rqst_data.h_vendor.vendor_cmd;
2638	uint8_t *ext = NULL;
2639	int rc = 0;
2640	uint8_t *from;
2641
2642	/* in case no data is transferred */
2643	job->reply->reply_payload_rcv_len = 0;
2644
2645	/* check if requested extended data lengths are valid */
2646	if ((mbox_req->inExtWLen > MAILBOX_EXT_SIZE) ||
2647		(mbox_req->outExtWLen > MAILBOX_EXT_SIZE)) {
2648		rc = -ERANGE;
2649		goto job_done;
2650	}
2651
2652	/* allocate our bsg tracking structure */
2653	dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
2654	if (!dd_data) {
2655		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2656				"2727 Failed allocation of dd_data\n");
2657		rc = -ENOMEM;
2658		goto job_done;
2659	}
2660
2661	mb = kzalloc(BSG_MBOX_SIZE, GFP_KERNEL);
2662	if (!mb) {
2663		rc = -ENOMEM;
2664		goto job_done;
2665	}
2666
2667	pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
2668	if (!pmboxq) {
2669		rc = -ENOMEM;
2670		goto job_done;
2671	}
2672	memset(pmboxq, 0, sizeof(LPFC_MBOXQ_t));
2673
2674	size = job->request_payload.payload_len;
2675	sg_copy_to_buffer(job->request_payload.sg_list,
2676			job->request_payload.sg_cnt,
2677			mb, size);
2678
2679	rc = lpfc_bsg_check_cmd_access(phba, mb, vport);
2680	if (rc != 0)
2681		goto job_done; /* must be negative */
2682
2683	pmb = &pmboxq->u.mb;
2684	memcpy(pmb, mb, sizeof(*pmb));
2685	pmb->mbxOwner = OWN_HOST;
2686	pmboxq->vport = vport;
2687
2688	/* If HBA encountered an error attention, allow only DUMP
2689	 * or RESTART mailbox commands until the HBA is restarted.
2690	 */
2691	if (phba->pport->stopped &&
2692	    pmb->mbxCommand != MBX_DUMP_MEMORY &&
2693	    pmb->mbxCommand != MBX_RESTART &&
2694	    pmb->mbxCommand != MBX_WRITE_VPARMS &&
2695	    pmb->mbxCommand != MBX_WRITE_WWN)
2696		lpfc_printf_log(phba, KERN_WARNING, LOG_MBOX,
2697				"2797 mbox: Issued mailbox cmd "
2698				"0x%x while in stopped state.\n",
2699				pmb->mbxCommand);
2700
2701	/* Don't allow mailbox commands to be sent when blocked
2702	 * or when in the middle of discovery
2703	 */
2704	if (phba->sli.sli_flag & LPFC_BLOCK_MGMT_IO) {
2705		rc = -EAGAIN;
2706		goto job_done;
2707	}
2708
2709	/* extended mailbox commands will need an extended buffer */
2710	if (mbox_req->inExtWLen || mbox_req->outExtWLen) {
2711		ext = kzalloc(MAILBOX_EXT_SIZE, GFP_KERNEL);
2712		if (!ext) {
2713			rc = -ENOMEM;
2714			goto job_done;
2715		}
2716
2717		/* any data for the device? */
2718		if (mbox_req->inExtWLen) {
2719			from = (uint8_t *)mb;
2720			from += sizeof(MAILBOX_t);
2721			memcpy((uint8_t *)ext, from,
2722				mbox_req->inExtWLen * sizeof(uint32_t));
2723		}
2724
2725		pmboxq->context2 = ext;
2726		pmboxq->in_ext_byte_len =
2727			mbox_req->inExtWLen * sizeof(uint32_t);
2728		pmboxq->out_ext_byte_len =
2729			mbox_req->outExtWLen * sizeof(uint32_t);
2730		pmboxq->mbox_offset_word = mbox_req->mbOffset;
2731	}
2732
2733	/* biu diag will need a kernel buffer to transfer the data
2734	 * allocate our own buffer and setup the mailbox command to
2735	 * use ours
2736	 */
2737	if (pmb->mbxCommand == MBX_RUN_BIU_DIAG64) {
2738		uint32_t transmit_length = pmb->un.varWords[1];
2739		uint32_t receive_length = pmb->un.varWords[4];
2740		/* transmit length cannot be greater than receive length or
2741		 * mailbox extension size
2742		 */
2743		if ((transmit_length > receive_length) ||
2744			(transmit_length > MAILBOX_EXT_SIZE)) {
2745			rc = -ERANGE;
2746			goto job_done;
2747		}
2748
2749		rxbmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
2750		if (!rxbmp) {
2751			rc = -ENOMEM;
2752			goto job_done;
2753		}
2754
2755		rxbmp->virt = lpfc_mbuf_alloc(phba, 0, &rxbmp->phys);
2756		if (!rxbmp->virt) {
2757			rc = -ENOMEM;
2758			goto job_done;
2759		}
2760
2761		INIT_LIST_HEAD(&rxbmp->list);
2762		rxbpl = (struct ulp_bde64 *) rxbmp->virt;
2763		dmp = diag_cmd_data_alloc(phba, rxbpl, transmit_length, 0);
2764		if (!dmp) {
2765			rc = -ENOMEM;
2766			goto job_done;
2767		}
2768
2769		INIT_LIST_HEAD(&dmp->dma.list);
2770		pmb->un.varBIUdiag.un.s2.xmit_bde64.addrHigh =
2771			putPaddrHigh(dmp->dma.phys);
2772		pmb->un.varBIUdiag.un.s2.xmit_bde64.addrLow =
2773			putPaddrLow(dmp->dma.phys);
2774
2775		pmb->un.varBIUdiag.un.s2.rcv_bde64.addrHigh =
2776			putPaddrHigh(dmp->dma.phys +
2777				pmb->un.varBIUdiag.un.s2.
2778					xmit_bde64.tus.f.bdeSize);
2779		pmb->un.varBIUdiag.un.s2.rcv_bde64.addrLow =
2780			putPaddrLow(dmp->dma.phys +
2781				pmb->un.varBIUdiag.un.s2.
2782					xmit_bde64.tus.f.bdeSize);
2783
2784		/* copy the transmit data found in the mailbox extension area */
2785		from = (uint8_t *)mb;
2786		from += sizeof(MAILBOX_t);
2787		memcpy((uint8_t *)dmp->dma.virt, from, transmit_length);
2788	} else if (pmb->mbxCommand == MBX_READ_EVENT_LOG) {
2789		struct READ_EVENT_LOG_VAR *rdEventLog =
2790			&pmb->un.varRdEventLog ;
2791		uint32_t receive_length = rdEventLog->rcv_bde64.tus.f.bdeSize;
2792		uint32_t mode =	 bf_get(lpfc_event_log, rdEventLog);
2793
2794		/* receive length cannot be greater than mailbox
2795		 * extension size
2796		 */
2797		if (receive_length > MAILBOX_EXT_SIZE) {
2798			rc = -ERANGE;
2799			goto job_done;
2800		}
2801
2802		/* mode zero uses a bde like biu diags command */
2803		if (mode == 0) {
2804
2805			/* rebuild the command for sli4 using our own buffers
2806			* like we do for biu diags
2807			*/
2808
2809			rxbmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
2810			if (!rxbmp) {
2811				rc = -ENOMEM;
2812				goto job_done;
2813			}
2814
2815			rxbmp->virt = lpfc_mbuf_alloc(phba, 0, &rxbmp->phys);
2816			rxbpl = (struct ulp_bde64 *) rxbmp->virt;
2817			if (rxbpl) {
2818				INIT_LIST_HEAD(&rxbmp->list);
2819				dmp = diag_cmd_data_alloc(phba, rxbpl,
2820					receive_length, 0);
2821			}
2822
2823			if (!dmp) {
2824				rc = -ENOMEM;
2825				goto job_done;
2826			}
2827
2828			INIT_LIST_HEAD(&dmp->dma.list);
2829			pmb->un.varWords[3] = putPaddrLow(dmp->dma.phys);
2830			pmb->un.varWords[4] = putPaddrHigh(dmp->dma.phys);
2831		}
2832	} else if (phba->sli_rev == LPFC_SLI_REV4) {
2833		if (pmb->mbxCommand == MBX_DUMP_MEMORY) {
2834			/* rebuild the command for sli4 using our own buffers
2835			* like we do for biu diags
2836			*/
2837			uint32_t receive_length = pmb->un.varWords[2];
2838			/* receive length cannot be greater than mailbox
2839			 * extension size
2840			 */
2841			if ((receive_length == 0) ||
2842				(receive_length > MAILBOX_EXT_SIZE)) {
2843				rc = -ERANGE;
2844				goto job_done;
2845			}
2846
2847			rxbmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
2848			if (!rxbmp) {
2849				rc = -ENOMEM;
2850				goto job_done;
2851			}
2852
2853			rxbmp->virt = lpfc_mbuf_alloc(phba, 0, &rxbmp->phys);
2854			if (!rxbmp->virt) {
2855				rc = -ENOMEM;
2856				goto job_done;
2857			}
2858
2859			INIT_LIST_HEAD(&rxbmp->list);
2860			rxbpl = (struct ulp_bde64 *) rxbmp->virt;
2861			dmp = diag_cmd_data_alloc(phba, rxbpl, receive_length,
2862						0);
2863			if (!dmp) {
2864				rc = -ENOMEM;
2865				goto job_done;
2866			}
2867
2868			INIT_LIST_HEAD(&dmp->dma.list);
2869			pmb->un.varWords[3] = putPaddrLow(dmp->dma.phys);
2870			pmb->un.varWords[4] = putPaddrHigh(dmp->dma.phys);
2871		} else if ((pmb->mbxCommand == MBX_UPDATE_CFG) &&
2872			pmb->un.varUpdateCfg.co) {
2873			struct ulp_bde64 *bde =
2874				(struct ulp_bde64 *)&pmb->un.varWords[4];
2875
2876			/* bde size cannot be greater than mailbox ext size */
2877			if (bde->tus.f.bdeSize > MAILBOX_EXT_SIZE) {
2878				rc = -ERANGE;
2879				goto job_done;
2880			}
2881
2882			rxbmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
2883			if (!rxbmp) {
2884				rc = -ENOMEM;
2885				goto job_done;
2886			}
2887
2888			rxbmp->virt = lpfc_mbuf_alloc(phba, 0, &rxbmp->phys);
2889			if (!rxbmp->virt) {
2890				rc = -ENOMEM;
2891				goto job_done;
2892			}
2893
2894			INIT_LIST_HEAD(&rxbmp->list);
2895			rxbpl = (struct ulp_bde64 *) rxbmp->virt;
2896			dmp = diag_cmd_data_alloc(phba, rxbpl,
2897					bde->tus.f.bdeSize, 0);
2898			if (!dmp) {
2899				rc = -ENOMEM;
2900				goto job_done;
2901			}
2902
2903			INIT_LIST_HEAD(&dmp->dma.list);
2904			bde->addrHigh = putPaddrHigh(dmp->dma.phys);
2905			bde->addrLow = putPaddrLow(dmp->dma.phys);
2906
2907			/* copy the transmit data found in the mailbox
2908			 * extension area
2909			 */
2910			from = (uint8_t *)mb;
2911			from += sizeof(MAILBOX_t);
2912			memcpy((uint8_t *)dmp->dma.virt, from,
2913				bde->tus.f.bdeSize);
2914		}
2915	}
2916
2917	dd_data->context_un.mbox.rxbmp = rxbmp;
2918	dd_data->context_un.mbox.dmp = dmp;
2919
2920	/* setup wake call as IOCB callback */
2921	pmboxq->mbox_cmpl = lpfc_bsg_wake_mbox_wait;
2922
2923	/* setup context field to pass wait_queue pointer to wake function */
2924	pmboxq->context1 = dd_data;
2925	dd_data->type = TYPE_MBOX;
2926	dd_data->context_un.mbox.pmboxq = pmboxq;
2927	dd_data->context_un.mbox.mb = mb;
2928	dd_data->context_un.mbox.set_job = job;
2929	dd_data->context_un.mbox.ext = ext;
2930	dd_data->context_un.mbox.mbOffset = mbox_req->mbOffset;
2931	dd_data->context_un.mbox.inExtWLen = mbox_req->inExtWLen;
2932	dd_data->context_un.mbox.outExtWLen = mbox_req->outExtWLen;
2933	job->dd_data = dd_data;
2934
2935	if ((vport->fc_flag & FC_OFFLINE_MODE) ||
2936	    (!(phba->sli.sli_flag & LPFC_SLI_ACTIVE))) {
2937		rc = lpfc_sli_issue_mbox(phba, pmboxq, MBX_POLL);
2938		if (rc != MBX_SUCCESS) {
2939			rc = (rc == MBX_TIMEOUT) ? -ETIME : -ENODEV;
2940			goto job_done;
2941		}
2942
2943		/* job finished, copy the data */
2944		memcpy(mb, pmb, sizeof(*pmb));
2945		job->reply->reply_payload_rcv_len =
2946			sg_copy_from_buffer(job->reply_payload.sg_list,
2947					job->reply_payload.sg_cnt,
2948					mb, size);
2949		/* not waiting mbox already done */
2950		rc = 0;
2951		goto job_done;
2952	}
2953
2954	rc = lpfc_sli_issue_mbox(phba, pmboxq, MBX_NOWAIT);
2955	if ((rc == MBX_SUCCESS) || (rc == MBX_BUSY))
2956		return 1; /* job started */
2957
2958job_done:
2959	/* common exit for error or job completed inline */
2960	kfree(mb);
2961	if (pmboxq)
2962		mempool_free(pmboxq, phba->mbox_mem_pool);
2963	kfree(ext);
2964	if (dmp) {
2965		dma_free_coherent(&phba->pcidev->dev,
2966			dmp->size, dmp->dma.virt,
2967				dmp->dma.phys);
2968		kfree(dmp);
2969	}
2970	if (rxbmp) {
2971		lpfc_mbuf_free(phba, rxbmp->virt, rxbmp->phys);
2972		kfree(rxbmp);
2973	}
2974	kfree(dd_data);
2975
2976	return rc;
2977}
2978
2979/**
2980 * lpfc_bsg_mbox_cmd - process an fc bsg LPFC_BSG_VENDOR_MBOX command
2981 * @job: MBOX fc_bsg_job for LPFC_BSG_VENDOR_MBOX.
2982 **/
2983static int
2984lpfc_bsg_mbox_cmd(struct fc_bsg_job *job)
2985{
2986	struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
2987	struct lpfc_hba *phba = vport->phba;
2988	int rc = 0;
2989
2990	/* in case no data is transferred */
2991	job->reply->reply_payload_rcv_len = 0;
2992	if (job->request_len <
2993	    sizeof(struct fc_bsg_request) + sizeof(struct dfc_mbox_req)) {
2994		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2995				"2737 Received MBOX_REQ request below "
2996				"minimum size\n");
2997		rc = -EINVAL;
2998		goto job_error;
2999	}
3000
3001	if (job->request_payload.payload_len != BSG_MBOX_SIZE) {
3002		rc = -EINVAL;
3003		goto job_error;
3004	}
3005
3006	if (job->reply_payload.payload_len != BSG_MBOX_SIZE) {
3007		rc = -EINVAL;
3008		goto job_error;
3009	}
3010
3011	if (phba->sli.sli_flag & LPFC_BLOCK_MGMT_IO) {
3012		rc = -EAGAIN;
3013		goto job_error;
3014	}
3015
3016	rc = lpfc_bsg_issue_mbox(phba, job, vport);
3017
3018job_error:
3019	if (rc == 0) {
3020		/* job done */
3021		job->reply->result = 0;
3022		job->dd_data = NULL;
3023		job->job_done(job);
3024	} else if (rc == 1)
3025		/* job submitted, will complete later*/
3026		rc = 0; /* return zero, no error */
3027	else {
3028		/* some error occurred */
3029		job->reply->result = rc;
3030		job->dd_data = NULL;
3031	}
3032
3033	return rc;
3034}
3035
3036/**
3037 * lpfc_bsg_menlo_cmd_cmp - lpfc_menlo_cmd completion handler
3038 * @phba: Pointer to HBA context object.
3039 * @cmdiocbq: Pointer to command iocb.
3040 * @rspiocbq: Pointer to response iocb.
3041 *
3042 * This function is the completion handler for iocbs issued using
3043 * lpfc_menlo_cmd function. This function is called by the
3044 * ring event handler function without any lock held. This function
3045 * can be called from both worker thread context and interrupt
3046 * context. This function also can be called from another thread which
3047 * cleans up the SLI layer objects.
3048 * This function copies the contents of the response iocb to the
3049 * response iocb memory object provided by the caller of
3050 * lpfc_sli_issue_iocb_wait and then wakes up the thread which
3051 * sleeps for the iocb completion.
3052 **/
3053static void
3054lpfc_bsg_menlo_cmd_cmp(struct lpfc_hba *phba,
3055			struct lpfc_iocbq *cmdiocbq,
3056			struct lpfc_iocbq *rspiocbq)
3057{
3058	struct bsg_job_data *dd_data;
3059	struct fc_bsg_job *job;
3060	IOCB_t *rsp;
3061	struct lpfc_dmabuf *bmp;
3062	struct lpfc_bsg_menlo *menlo;
3063	unsigned long flags;
3064	struct menlo_response *menlo_resp;
3065	int rc = 0;
3066
3067	spin_lock_irqsave(&phba->ct_ev_lock, flags);
3068	dd_data = cmdiocbq->context1;
3069	if (!dd_data) {
3070		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
3071		return;
3072	}
3073
3074	menlo = &dd_data->context_un.menlo;
3075	job = menlo->set_job;
3076	job->dd_data = NULL; /* so timeout handler does not reply */
3077
3078	spin_lock_irqsave(&phba->hbalock, flags);
3079	cmdiocbq->iocb_flag |= LPFC_IO_WAKE;
3080	if (cmdiocbq->context2 && rspiocbq)
3081		memcpy(&((struct lpfc_iocbq *)cmdiocbq->context2)->iocb,
3082		       &rspiocbq->iocb, sizeof(IOCB_t));
3083	spin_unlock_irqrestore(&phba->hbalock, flags);
3084
3085	bmp = menlo->bmp;
3086	rspiocbq = menlo->rspiocbq;
3087	rsp = &rspiocbq->iocb;
3088
3089	pci_unmap_sg(phba->pcidev, job->request_payload.sg_list,
3090		     job->request_payload.sg_cnt, DMA_TO_DEVICE);
3091	pci_unmap_sg(phba->pcidev, job->reply_payload.sg_list,
3092		     job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
3093
3094	/* always return the xri, this would be used in the case
3095	 * of a menlo download to allow the data to be sent as a continuation
3096	 * of the exchange.
3097	 */
3098	menlo_resp = (struct menlo_response *)
3099		job->reply->reply_data.vendor_reply.vendor_rsp;
3100	menlo_resp->xri = rsp->ulpContext;
3101	if (rsp->ulpStatus) {
3102		if (rsp->ulpStatus == IOSTAT_LOCAL_REJECT) {
3103			switch (rsp->un.ulpWord[4] & 0xff) {
3104			case IOERR_SEQUENCE_TIMEOUT:
3105				rc = -ETIMEDOUT;
3106				break;
3107			case IOERR_INVALID_RPI:
3108				rc = -EFAULT;
3109				break;
3110			default:
3111				rc = -EACCES;
3112				break;
3113			}
3114		} else
3115			rc = -EACCES;
3116	} else
3117		job->reply->reply_payload_rcv_len =
3118			rsp->un.genreq64.bdl.bdeSize;
3119
3120	lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
3121	lpfc_sli_release_iocbq(phba, rspiocbq);
3122	lpfc_sli_release_iocbq(phba, cmdiocbq);
3123	kfree(bmp);
3124	kfree(dd_data);
3125	/* make error code available to userspace */
3126	job->reply->result = rc;
3127	/* complete the job back to userspace */
3128	job->job_done(job);
3129	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
3130	return;
3131}
3132
3133/**
3134 * lpfc_menlo_cmd - send an ioctl for menlo hardware
3135 * @job: fc_bsg_job to handle
3136 *
3137 * This function issues a gen request 64 CR ioctl for all menlo cmd requests,
3138 * all the command completions will return the xri for the command.
3139 * For menlo data requests a gen request 64 CX is used to continue the exchange
3140 * supplied in the menlo request header xri field.
3141 **/
3142static int
3143lpfc_menlo_cmd(struct fc_bsg_job *job)
3144{
3145	struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
3146	struct lpfc_hba *phba = vport->phba;
3147	struct lpfc_iocbq *cmdiocbq, *rspiocbq;
3148	IOCB_t *cmd, *rsp;
3149	int rc = 0;
3150	struct menlo_command *menlo_cmd;
3151	struct menlo_response *menlo_resp;
3152	struct lpfc_dmabuf *bmp = NULL;
3153	int request_nseg;
3154	int reply_nseg;
3155	struct scatterlist *sgel = NULL;
3156	int numbde;
3157	dma_addr_t busaddr;
3158	struct bsg_job_data *dd_data;
3159	struct ulp_bde64 *bpl = NULL;
3160
3161	/* in case no data is returned return just the return code */
3162	job->reply->reply_payload_rcv_len = 0;
3163
3164	if (job->request_len <
3165	    sizeof(struct fc_bsg_request) +
3166		sizeof(struct menlo_command)) {
3167		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
3168				"2784 Received MENLO_CMD request below "
3169				"minimum size\n");
3170		rc = -ERANGE;
3171		goto no_dd_data;
3172	}
3173
3174	if (job->reply_len <
3175	    sizeof(struct fc_bsg_request) + sizeof(struct menlo_response)) {
3176		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
3177				"2785 Received MENLO_CMD reply below "
3178				"minimum size\n");
3179		rc = -ERANGE;
3180		goto no_dd_data;
3181	}
3182
3183	if (!(phba->menlo_flag & HBA_MENLO_SUPPORT)) {
3184		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
3185				"2786 Adapter does not support menlo "
3186				"commands\n");
3187		rc = -EPERM;
3188		goto no_dd_data;
3189	}
3190
3191	menlo_cmd = (struct menlo_command *)
3192		job->request->rqst_data.h_vendor.vendor_cmd;
3193
3194	menlo_resp = (struct menlo_response *)
3195		job->reply->reply_data.vendor_reply.vendor_rsp;
3196
3197	/* allocate our bsg tracking structure */
3198	dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
3199	if (!dd_data) {
3200		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
3201				"2787 Failed allocation of dd_data\n");
3202		rc = -ENOMEM;
3203		goto no_dd_data;
3204	}
3205
3206	bmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
3207	if (!bmp) {
3208		rc = -ENOMEM;
3209		goto free_dd;
3210	}
3211
3212	cmdiocbq = lpfc_sli_get_iocbq(phba);
3213	if (!cmdiocbq) {
3214		rc = -ENOMEM;
3215		goto free_bmp;
3216	}
3217
3218	rspiocbq = lpfc_sli_get_iocbq(phba);
3219	if (!rspiocbq) {
3220		rc = -ENOMEM;
3221		goto free_cmdiocbq;
3222	}
3223
3224	rsp = &rspiocbq->iocb;
3225
3226	bmp->virt = lpfc_mbuf_alloc(phba, 0, &bmp->phys);
3227	if (!bmp->virt) {
3228		rc = -ENOMEM;
3229		goto free_rspiocbq;
3230	}
3231
3232	INIT_LIST_HEAD(&bmp->list);
3233	bpl = (struct ulp_bde64 *) bmp->virt;
3234	request_nseg = pci_map_sg(phba->pcidev, job->request_payload.sg_list,
3235				  job->request_payload.sg_cnt, DMA_TO_DEVICE);
3236	for_each_sg(job->request_payload.sg_list, sgel, request_nseg, numbde) {
3237		busaddr = sg_dma_address(sgel);
3238		bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64;
3239		bpl->tus.f.bdeSize = sg_dma_len(sgel);
3240		bpl->tus.w = cpu_to_le32(bpl->tus.w);
3241		bpl->addrLow = cpu_to_le32(putPaddrLow(busaddr));
3242		bpl->addrHigh = cpu_to_le32(putPaddrHigh(busaddr));
3243		bpl++;
3244	}
3245
3246	reply_nseg = pci_map_sg(phba->pcidev, job->reply_payload.sg_list,
3247				job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
3248	for_each_sg(job->reply_payload.sg_list, sgel, reply_nseg, numbde) {
3249		busaddr = sg_dma_address(sgel);
3250		bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64I;
3251		bpl->tus.f.bdeSize = sg_dma_len(sgel);
3252		bpl->tus.w = cpu_to_le32(bpl->tus.w);
3253		bpl->addrLow = cpu_to_le32(putPaddrLow(busaddr));
3254		bpl->addrHigh = cpu_to_le32(putPaddrHigh(busaddr));
3255		bpl++;
3256	}
3257
3258	cmd = &cmdiocbq->iocb;
3259	cmd->un.genreq64.bdl.ulpIoTag32 = 0;
3260	cmd->un.genreq64.bdl.addrHigh = putPaddrHigh(bmp->phys);
3261	cmd->un.genreq64.bdl.addrLow = putPaddrLow(bmp->phys);
3262	cmd->un.genreq64.bdl.bdeFlags = BUFF_TYPE_BLP_64;
3263	cmd->un.genreq64.bdl.bdeSize =
3264	    (request_nseg + reply_nseg) * sizeof(struct ulp_bde64);
3265	cmd->un.genreq64.w5.hcsw.Fctl = (SI | LA);
3266	cmd->un.genreq64.w5.hcsw.Dfctl = 0;
3267	cmd->un.genreq64.w5.hcsw.Rctl = FC_RCTL_DD_UNSOL_CMD;
3268	cmd->un.genreq64.w5.hcsw.Type = MENLO_TRANSPORT_TYPE; /* 0xfe */
3269	cmd->ulpBdeCount = 1;
3270	cmd->ulpClass = CLASS3;
3271	cmd->ulpOwner = OWN_CHIP;
3272	cmd->ulpLe = 1; /* Limited Edition */
3273	cmdiocbq->iocb_flag |= LPFC_IO_LIBDFC;
3274	cmdiocbq->vport = phba->pport;
3275	/* We want the firmware to timeout before we do */
3276	cmd->ulpTimeout = MENLO_TIMEOUT - 5;
3277	cmdiocbq->context3 = bmp;
3278	cmdiocbq->context2 = rspiocbq;
3279	cmdiocbq->iocb_cmpl = lpfc_bsg_menlo_cmd_cmp;
3280	cmdiocbq->context1 = dd_data;
3281	cmdiocbq->context2 = rspiocbq;
3282	if (menlo_cmd->cmd == LPFC_BSG_VENDOR_MENLO_CMD) {
3283		cmd->ulpCommand = CMD_GEN_REQUEST64_CR;
3284		cmd->ulpPU = MENLO_PU; /* 3 */
3285		cmd->un.ulpWord[4] = MENLO_DID; /* 0x0000FC0E */
3286		cmd->ulpContext = MENLO_CONTEXT; /* 0 */
3287	} else {
3288		cmd->ulpCommand = CMD_GEN_REQUEST64_CX;
3289		cmd->ulpPU = 1;
3290		cmd->un.ulpWord[4] = 0;
3291		cmd->ulpContext = menlo_cmd->xri;
3292	}
3293
3294	dd_data->type = TYPE_MENLO;
3295	dd_data->context_un.menlo.cmdiocbq = cmdiocbq;
3296	dd_data->context_un.menlo.rspiocbq = rspiocbq;
3297	dd_data->context_un.menlo.set_job = job;
3298	dd_data->context_un.menlo.bmp = bmp;
3299
3300	rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, cmdiocbq,
3301		MENLO_TIMEOUT - 5);
3302	if (rc == IOCB_SUCCESS)
3303		return 0; /* done for now */
3304
3305	/* iocb failed so cleanup */
3306	pci_unmap_sg(phba->pcidev, job->request_payload.sg_list,
3307		     job->request_payload.sg_cnt, DMA_TO_DEVICE);
3308	pci_unmap_sg(phba->pcidev, job->reply_payload.sg_list,
3309		     job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
3310
3311	lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
3312
3313free_rspiocbq:
3314	lpfc_sli_release_iocbq(phba, rspiocbq);
3315free_cmdiocbq:
3316	lpfc_sli_release_iocbq(phba, cmdiocbq);
3317free_bmp:
3318	kfree(bmp);
3319free_dd:
3320	kfree(dd_data);
3321no_dd_data:
3322	/* make error code available to userspace */
3323	job->reply->result = rc;
3324	job->dd_data = NULL;
3325	return rc;
3326}
3327/**
3328 * lpfc_bsg_hst_vendor - process a vendor-specific fc_bsg_job
3329 * @job: fc_bsg_job to handle
3330 **/
3331static int
3332lpfc_bsg_hst_vendor(struct fc_bsg_job *job)
3333{
3334	int command = job->request->rqst_data.h_vendor.vendor_cmd[0];
3335	int rc;
3336
3337	switch (command) {
3338	case LPFC_BSG_VENDOR_SET_CT_EVENT:
3339		rc = lpfc_bsg_hba_set_event(job);
3340		break;
3341	case LPFC_BSG_VENDOR_GET_CT_EVENT:
3342		rc = lpfc_bsg_hba_get_event(job);
3343		break;
3344	case LPFC_BSG_VENDOR_SEND_MGMT_RESP:
3345		rc = lpfc_bsg_send_mgmt_rsp(job);
3346		break;
3347	case LPFC_BSG_VENDOR_DIAG_MODE:
3348		rc = lpfc_bsg_diag_mode(job);
3349		break;
3350	case LPFC_BSG_VENDOR_DIAG_TEST:
3351		rc = lpfc_bsg_diag_test(job);
3352		break;
3353	case LPFC_BSG_VENDOR_GET_MGMT_REV:
3354		rc = lpfc_bsg_get_dfc_rev(job);
3355		break;
3356	case LPFC_BSG_VENDOR_MBOX:
3357		rc = lpfc_bsg_mbox_cmd(job);
3358		break;
3359	case LPFC_BSG_VENDOR_MENLO_CMD:
3360	case LPFC_BSG_VENDOR_MENLO_DATA:
3361		rc = lpfc_menlo_cmd(job);
3362		break;
3363	default:
3364		rc = -EINVAL;
3365		job->reply->reply_payload_rcv_len = 0;
3366		/* make error code available to userspace */
3367		job->reply->result = rc;
3368		break;
3369	}
3370
3371	return rc;
3372}
3373
3374/**
3375 * lpfc_bsg_request - handle a bsg request from the FC transport
3376 * @job: fc_bsg_job to handle
3377 **/
3378int
3379lpfc_bsg_request(struct fc_bsg_job *job)
3380{
3381	uint32_t msgcode;
3382	int rc;
3383
3384	msgcode = job->request->msgcode;
3385	switch (msgcode) {
3386	case FC_BSG_HST_VENDOR:
3387		rc = lpfc_bsg_hst_vendor(job);
3388		break;
3389	case FC_BSG_RPT_ELS:
3390		rc = lpfc_bsg_rport_els(job);
3391		break;
3392	case FC_BSG_RPT_CT:
3393		rc = lpfc_bsg_send_mgmt_cmd(job);
3394		break;
3395	default:
3396		rc = -EINVAL;
3397		job->reply->reply_payload_rcv_len = 0;
3398		/* make error code available to userspace */
3399		job->reply->result = rc;
3400		break;
3401	}
3402
3403	return rc;
3404}
3405
3406/**
3407 * lpfc_bsg_timeout - handle timeout of a bsg request from the FC transport
3408 * @job: fc_bsg_job that has timed out
3409 *
3410 * This function just aborts the job's IOCB.  The aborted IOCB will return to
3411 * the waiting function which will handle passing the error back to userspace
3412 **/
3413int
3414lpfc_bsg_timeout(struct fc_bsg_job *job)
3415{
3416	struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
3417	struct lpfc_hba *phba = vport->phba;
3418	struct lpfc_iocbq *cmdiocb;
3419	struct lpfc_bsg_event *evt;
3420	struct lpfc_bsg_iocb *iocb;
3421	struct lpfc_bsg_mbox *mbox;
3422	struct lpfc_bsg_menlo *menlo;
3423	struct lpfc_sli_ring *pring = &phba->sli.ring[LPFC_ELS_RING];
3424	struct bsg_job_data *dd_data;
3425	unsigned long flags;
3426
3427	spin_lock_irqsave(&phba->ct_ev_lock, flags);
3428	dd_data = (struct bsg_job_data *)job->dd_data;
3429	/* timeout and completion crossed paths if no dd_data */
3430	if (!dd_data) {
3431		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
3432		return 0;
3433	}
3434
3435	switch (dd_data->type) {
3436	case TYPE_IOCB:
3437		iocb = &dd_data->context_un.iocb;
3438		cmdiocb = iocb->cmdiocbq;
3439		/* hint to completion handler that the job timed out */
3440		job->reply->result = -EAGAIN;
3441		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
3442		/* this will call our completion handler */
3443		spin_lock_irq(&phba->hbalock);
3444		lpfc_sli_issue_abort_iotag(phba, pring, cmdiocb);
3445		spin_unlock_irq(&phba->hbalock);
3446		break;
3447	case TYPE_EVT:
3448		evt = dd_data->context_un.evt;
3449		/* this event has no job anymore */
3450		evt->set_job = NULL;
3451		job->dd_data = NULL;
3452		job->reply->reply_payload_rcv_len = 0;
3453		/* Return -EAGAIN which is our way of signallying the
3454		 * app to retry.
3455		 */
3456		job->reply->result = -EAGAIN;
3457		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
3458		job->job_done(job);
3459		break;
3460	case TYPE_MBOX:
3461		mbox = &dd_data->context_un.mbox;
3462		/* this mbox has no job anymore */
3463		mbox->set_job = NULL;
3464		job->dd_data = NULL;
3465		job->reply->reply_payload_rcv_len = 0;
3466		job->reply->result = -EAGAIN;
3467		/* the mbox completion handler can now be run */
3468		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
3469		job->job_done(job);
3470		break;
3471	case TYPE_MENLO:
3472		menlo = &dd_data->context_un.menlo;
3473		cmdiocb = menlo->cmdiocbq;
3474		/* hint to completion handler that the job timed out */
3475		job->reply->result = -EAGAIN;
3476		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
3477		/* this will call our completion handler */
3478		spin_lock_irq(&phba->hbalock);
3479		lpfc_sli_issue_abort_iotag(phba, pring, cmdiocb);
3480		spin_unlock_irq(&phba->hbalock);
3481		break;
3482	default:
3483		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
3484		break;
3485	}
3486
3487	/* scsi transport fc fc_bsg_job_timeout expects a zero return code,
3488	 * otherwise an error message will be displayed on the console
3489	 * so always return success (zero)
3490	 */
3491	return 0;
3492}
3493