lpfc_bsg.c

   1/*******************************************************************
   2 * This file is part of the Emulex Linux Device Driver for         *
   3 * Fibre Channel Host Bus Adapters.                                *
   4 * Copyright (C) 2017-2024 Broadcom. All Rights Reserved. The term *
   5 * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.     *
   6 * Copyright (C) 2009-2015 Emulex.  All rights reserved.           *
   7 * EMULEX and SLI are trademarks of Emulex.                        *
   8 * www.broadcom.com                                                *
   9 *                                                                 *
  10 * This program is free software; you can redistribute it and/or   *
  11 * modify it under the terms of version 2 of the GNU General       *
  12 * Public License as published by the Free Software Foundation.    *
  13 * This program is distributed in the hope that it will be useful. *
  14 * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND          *
  15 * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,  *
  16 * FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE      *
  17 * DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD *
  18 * TO BE LEGALLY INVALID.  See the GNU General Public License for  *
  19 * more details, a copy of which can be found in the file COPYING  *
  20 * included with this package.                                     *
  21 *******************************************************************/
  22
  23#include <linux/interrupt.h>
  24#include <linux/mempool.h>
  25#include <linux/pci.h>
  26#include <linux/slab.h>
  27#include <linux/delay.h>
  28#include <linux/list.h>
  29#include <linux/bsg-lib.h>
  30#include <linux/vmalloc.h>
  31
  32#include <scsi/scsi.h>
  33#include <scsi/scsi_host.h>
  34#include <scsi/scsi_transport_fc.h>
  35#include <scsi/scsi_bsg_fc.h>
  36#include <scsi/fc/fc_fs.h>
  37
  38#include "lpfc_hw4.h"
  39#include "lpfc_hw.h"
  40#include "lpfc_sli.h"
  41#include "lpfc_sli4.h"
  42#include "lpfc_nl.h"
  43#include "lpfc_bsg.h"
  44#include "lpfc_disc.h"
  45#include "lpfc_scsi.h"
  46#include "lpfc.h"
  47#include "lpfc_logmsg.h"
  48#include "lpfc_crtn.h"
  49#include "lpfc_debugfs.h"
  50#include "lpfc_vport.h"
  51#include "lpfc_version.h"
  52
  53struct lpfc_bsg_event {
  54	struct list_head node;
  55	struct kref kref;
  56	wait_queue_head_t wq;
  57
  58	/* Event type and waiter identifiers */
  59	uint32_t type_mask;
  60	uint32_t req_id;
  61	uint32_t reg_id;
  62
  63	/* next two flags are here for the auto-delete logic */
  64	unsigned long wait_time_stamp;
  65	int waiting;
  66
  67	/* seen and not seen events */
  68	struct list_head events_to_get;
  69	struct list_head events_to_see;
  70
  71	/* driver data associated with the job */
  72	void *dd_data;
  73};
  74
  75struct lpfc_bsg_iocb {
  76	struct lpfc_iocbq *cmdiocbq;
  77	struct lpfc_dmabuf *rmp;
  78	struct lpfc_nodelist *ndlp;
  79};
  80
  81struct lpfc_bsg_mbox {
  82	LPFC_MBOXQ_t *pmboxq;
  83	MAILBOX_t *mb;
  84	struct lpfc_dmabuf *dmabuffers; /* for BIU diags */
  85	uint8_t *ext; /* extended mailbox data */
  86	uint32_t mbOffset; /* from app */
  87	uint32_t inExtWLen; /* from app */
  88	uint32_t outExtWLen; /* from app */
  89};
  90
  91#define TYPE_EVT 	1
  92#define TYPE_IOCB	2
  93#define TYPE_MBOX	3
  94struct bsg_job_data {
  95	uint32_t type;
  96	struct bsg_job *set_job; /* job waiting for this iocb to finish */
  97	union {
  98		struct lpfc_bsg_event *evt;
  99		struct lpfc_bsg_iocb iocb;
 100		struct lpfc_bsg_mbox mbox;
 101	} context_un;
 102};
 103
 104struct event_data {
 105	struct list_head node;
 106	uint32_t type;
 107	uint32_t immed_dat;
 108	void *data;
 109	uint32_t len;
 110};
 111
 112#define BUF_SZ_4K 4096
 113#define SLI_CT_ELX_LOOPBACK 0x10
 114
 115enum ELX_LOOPBACK_CMD {
 116	ELX_LOOPBACK_XRI_SETUP,
 117	ELX_LOOPBACK_DATA,
 118};
 119
 120#define ELX_LOOPBACK_HEADER_SZ \
 121	(size_t)(&((struct lpfc_sli_ct_request *)NULL)->un)
 122
 123/* For non-embedded read object command */
 124#define READ_OBJ_EMB0_SCHEME_0 {1, 10, 256, 128}
 125#define READ_OBJ_EMB0_SCHEME_1 {11, LPFC_EMB0_MAX_RD_OBJ_HBD_CNT, 512, 192}
 126static const struct lpfc_read_object_cmd_scheme {
 127	u32 min_hbd_cnt;
 128	u32 max_hbd_cnt;
 129	u32 cmd_size;
 130	u32 payload_word_offset;
 131}  rd_obj_scheme[2] = {READ_OBJ_EMB0_SCHEME_0, READ_OBJ_EMB0_SCHEME_1};
 132
 133struct lpfc_dmabufext {
 134	struct lpfc_dmabuf dma;
 135	uint32_t size;
 136	uint32_t flag;
 137};
 138
 139static void
 140lpfc_free_bsg_buffers(struct lpfc_hba *phba, struct lpfc_dmabuf *mlist)
 141{
 142	struct lpfc_dmabuf *mlast, *next_mlast;
 143
 144	if (mlist) {
 145		list_for_each_entry_safe(mlast, next_mlast, &mlist->list,
 146					 list) {
 147			list_del(&mlast->list);
 148			lpfc_mbuf_free(phba, mlast->virt, mlast->phys);
 149			kfree(mlast);
 150		}
 151		lpfc_mbuf_free(phba, mlist->virt, mlist->phys);
 152		kfree(mlist);
 153	}
 154	return;
 155}
 156
 157static struct lpfc_dmabuf *
 158lpfc_alloc_bsg_buffers(struct lpfc_hba *phba, unsigned int size,
 159		       int outbound_buffers, struct ulp_bde64 *bpl,
 160		       int *bpl_entries)
 161{
 162	struct lpfc_dmabuf *mlist = NULL;
 163	struct lpfc_dmabuf *mp;
 164	unsigned int bytes_left = size;
 165
 166	/* Verify we can support the size specified */
 167	if (!size || (size > (*bpl_entries * LPFC_BPL_SIZE)))
 168		return NULL;
 169
 170	/* Determine the number of dma buffers to allocate */
 171	*bpl_entries = (size % LPFC_BPL_SIZE ? size/LPFC_BPL_SIZE + 1 :
 172			size/LPFC_BPL_SIZE);
 173
 174	/* Allocate dma buffer and place in BPL passed */
 175	while (bytes_left) {
 176		/* Allocate dma buffer  */
 177		mp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
 178		if (!mp) {
 179			if (mlist)
 180				lpfc_free_bsg_buffers(phba, mlist);
 181			return NULL;
 182		}
 183
 184		INIT_LIST_HEAD(&mp->list);
 185		mp->virt = lpfc_mbuf_alloc(phba, MEM_PRI, &(mp->phys));
 186
 187		if (!mp->virt) {
 188			kfree(mp);
 189			if (mlist)
 190				lpfc_free_bsg_buffers(phba, mlist);
 191			return NULL;
 192		}
 193
 194		/* Queue it to a linked list */
 195		if (!mlist)
 196			mlist = mp;
 197		else
 198			list_add_tail(&mp->list, &mlist->list);
 199
 200		/* Add buffer to buffer pointer list */
 201		if (outbound_buffers)
 202			bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64;
 203		else
 204			bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64I;
 205		bpl->addrLow = le32_to_cpu(putPaddrLow(mp->phys));
 206		bpl->addrHigh = le32_to_cpu(putPaddrHigh(mp->phys));
 207		bpl->tus.f.bdeSize = (uint16_t)
 208			(bytes_left >= LPFC_BPL_SIZE ? LPFC_BPL_SIZE :
 209			 bytes_left);
 210		bytes_left -= bpl->tus.f.bdeSize;
 211		bpl->tus.w = le32_to_cpu(bpl->tus.w);
 212		bpl++;
 213	}
 214	return mlist;
 215}
 216
 217static unsigned int
 218lpfc_bsg_copy_data(struct lpfc_dmabuf *dma_buffers,
 219		   struct bsg_buffer *bsg_buffers,
 220		   unsigned int bytes_to_transfer, int to_buffers)
 221{
 222
 223	struct lpfc_dmabuf *mp;
 224	unsigned int transfer_bytes, bytes_copied = 0;
 225	unsigned int sg_offset, dma_offset;
 226	unsigned char *dma_address, *sg_address;
 227	LIST_HEAD(temp_list);
 228	struct sg_mapping_iter miter;
 229	unsigned long flags;
 230	unsigned int sg_flags = SG_MITER_ATOMIC;
 231	bool sg_valid;
 232
 233	list_splice_init(&dma_buffers->list, &temp_list);
 234	list_add(&dma_buffers->list, &temp_list);
 235	sg_offset = 0;
 236	if (to_buffers)
 237		sg_flags |= SG_MITER_FROM_SG;
 238	else
 239		sg_flags |= SG_MITER_TO_SG;
 240	sg_miter_start(&miter, bsg_buffers->sg_list, bsg_buffers->sg_cnt,
 241		       sg_flags);
 242	local_irq_save(flags);
 243	sg_valid = sg_miter_next(&miter);
 244	list_for_each_entry(mp, &temp_list, list) {
 245		dma_offset = 0;
 246		while (bytes_to_transfer && sg_valid &&
 247		       (dma_offset < LPFC_BPL_SIZE)) {
 248			dma_address = mp->virt + dma_offset;
 249			if (sg_offset) {
 250				/* Continue previous partial transfer of sg */
 251				sg_address = miter.addr + sg_offset;
 252				transfer_bytes = miter.length - sg_offset;
 253			} else {
 254				sg_address = miter.addr;
 255				transfer_bytes = miter.length;
 256			}
 257			if (bytes_to_transfer < transfer_bytes)
 258				transfer_bytes = bytes_to_transfer;
 259			if (transfer_bytes > (LPFC_BPL_SIZE - dma_offset))
 260				transfer_bytes = LPFC_BPL_SIZE - dma_offset;
 261			if (to_buffers)
 262				memcpy(dma_address, sg_address, transfer_bytes);
 263			else
 264				memcpy(sg_address, dma_address, transfer_bytes);
 265			dma_offset += transfer_bytes;
 266			sg_offset += transfer_bytes;
 267			bytes_to_transfer -= transfer_bytes;
 268			bytes_copied += transfer_bytes;
 269			if (sg_offset >= miter.length) {
 270				sg_offset = 0;
 271				sg_valid = sg_miter_next(&miter);
 272			}
 273		}
 274	}
 275	sg_miter_stop(&miter);
 276	local_irq_restore(flags);
 277	list_del_init(&dma_buffers->list);
 278	list_splice(&temp_list, &dma_buffers->list);
 279	return bytes_copied;
 280}
 281
 282/**
 283 * lpfc_bsg_send_mgmt_cmd_cmp - lpfc_bsg_send_mgmt_cmd's completion handler
 284 * @phba: Pointer to HBA context object.
 285 * @cmdiocbq: Pointer to command iocb.
 286 * @rspiocbq: Pointer to response iocb.
 287 *
 288 * This function is the completion handler for iocbs issued using
 289 * lpfc_bsg_send_mgmt_cmd function. This function is called by the
 290 * ring event handler function without any lock held. This function
 291 * can be called from both worker thread context and interrupt
 292 * context. This function also can be called from another thread which
 293 * cleans up the SLI layer objects.
 294 * This function copies the contents of the response iocb to the
 295 * response iocb memory object provided by the caller of
 296 * lpfc_sli_issue_iocb_wait and then wakes up the thread which
 297 * sleeps for the iocb completion.
 298 **/
 299static void
 300lpfc_bsg_send_mgmt_cmd_cmp(struct lpfc_hba *phba,
 301			struct lpfc_iocbq *cmdiocbq,
 302			struct lpfc_iocbq *rspiocbq)
 303{
 304	struct bsg_job_data *dd_data;
 305	struct bsg_job *job;
 306	struct fc_bsg_reply *bsg_reply;
 307	struct lpfc_dmabuf *bmp, *cmp, *rmp;
 308	struct lpfc_nodelist *ndlp;
 309	struct lpfc_bsg_iocb *iocb;
 310	unsigned long flags;
 311	int rc = 0;
 312	u32 ulp_status, ulp_word4, total_data_placed;
 313
 314	dd_data = cmdiocbq->context_un.dd_data;
 315
 316	/* Determine if job has been aborted */
 317	spin_lock_irqsave(&phba->ct_ev_lock, flags);
 318	job = dd_data->set_job;
 319	if (job) {
 320		bsg_reply = job->reply;
 321		/* Prevent timeout handling from trying to abort job */
 322		job->dd_data = NULL;
 323	}
 324	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
 325
 326	/* Close the timeout handler abort window */
 327	spin_lock_irqsave(&phba->hbalock, flags);
 328	cmdiocbq->cmd_flag &= ~LPFC_IO_CMD_OUTSTANDING;
 329	spin_unlock_irqrestore(&phba->hbalock, flags);
 330
 331	iocb = &dd_data->context_un.iocb;
 332	ndlp = iocb->cmdiocbq->ndlp;
 333	rmp = iocb->rmp;
 334	cmp = cmdiocbq->cmd_dmabuf;
 335	bmp = cmdiocbq->bpl_dmabuf;
 336	ulp_status = get_job_ulpstatus(phba, rspiocbq);
 337	ulp_word4 = get_job_word4(phba, rspiocbq);
 338	total_data_placed = get_job_data_placed(phba, rspiocbq);
 339
 340	/* Copy the completed data or set the error status */
 341
 342	if (job) {
 343		if (ulp_status) {
 344			if (ulp_status == IOSTAT_LOCAL_REJECT) {
 345				switch (ulp_word4 & IOERR_PARAM_MASK) {
 346				case IOERR_SEQUENCE_TIMEOUT:
 347					rc = -ETIMEDOUT;
 348					break;
 349				case IOERR_INVALID_RPI:
 350					rc = -EFAULT;
 351					break;
 352				default:
 353					rc = -EACCES;
 354					break;
 355				}
 356			} else {
 357				rc = -EACCES;
 358			}
 359		} else {
 360			bsg_reply->reply_payload_rcv_len =
 361				lpfc_bsg_copy_data(rmp, &job->reply_payload,
 362						   total_data_placed, 0);
 363		}
 364	}
 365
 366	lpfc_free_bsg_buffers(phba, cmp);
 367	lpfc_free_bsg_buffers(phba, rmp);
 368	lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
 369	kfree(bmp);
 370	lpfc_nlp_put(ndlp);
 371	lpfc_sli_release_iocbq(phba, cmdiocbq);
 372	kfree(dd_data);
 373
 374	/* Complete the job if the job is still active */
 375
 376	if (job) {
 377		bsg_reply->result = rc;
 378		bsg_job_done(job, bsg_reply->result,
 379			       bsg_reply->reply_payload_rcv_len);
 380	}
 381	return;
 382}
 383
 384/**
 385 * lpfc_bsg_send_mgmt_cmd - send a CT command from a bsg request
 386 * @job: fc_bsg_job to handle
 387 **/
 388static int
 389lpfc_bsg_send_mgmt_cmd(struct bsg_job *job)
 390{
 391	struct lpfc_vport *vport = shost_priv(fc_bsg_to_shost(job));
 392	struct lpfc_rport_data *rdata = fc_bsg_to_rport(job)->dd_data;
 393	struct lpfc_hba *phba = vport->phba;
 394	struct lpfc_nodelist *ndlp = rdata->pnode;
 395	struct fc_bsg_reply *bsg_reply = job->reply;
 396	struct ulp_bde64 *bpl = NULL;
 397	struct lpfc_iocbq *cmdiocbq = NULL;
 398	struct lpfc_dmabuf *bmp = NULL, *cmp = NULL, *rmp = NULL;
 399	int request_nseg, reply_nseg;
 400	u32 num_entry;
 401	struct bsg_job_data *dd_data;
 402	unsigned long flags;
 403	uint32_t creg_val;
 404	int rc = 0;
 405	int iocb_stat;
 406	u16 ulp_context;
 407
 408	/* in case no data is transferred */
 409	bsg_reply->reply_payload_rcv_len = 0;
 410
 411	if (test_bit(NLP_PLOGI_SND, &ndlp->nlp_flag) ||
 412	    test_bit(NLP_PRLI_SND, &ndlp->nlp_flag) ||
 413	    test_bit(NLP_ADISC_SND, &ndlp->nlp_flag) ||
 414	    test_bit(NLP_LOGO_SND, &ndlp->nlp_flag) ||
 415	    test_bit(NLP_RNID_SND, &ndlp->nlp_flag))
 416		return -ENODEV;
 417
 418	/* allocate our bsg tracking structure */
 419	dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
 420	if (!dd_data) {
 421		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
 422				"2733 Failed allocation of dd_data\n");
 423		rc = -ENOMEM;
 424		goto no_dd_data;
 425	}
 426
 427	cmdiocbq = lpfc_sli_get_iocbq(phba);
 428	if (!cmdiocbq) {
 429		rc = -ENOMEM;
 430		goto free_dd;
 431	}
 432
 433	bmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
 434	if (!bmp) {
 435		rc = -ENOMEM;
 436		goto free_cmdiocbq;
 437	}
 438	bmp->virt = lpfc_mbuf_alloc(phba, 0, &bmp->phys);
 439	if (!bmp->virt) {
 440		rc = -ENOMEM;
 441		goto free_bmp;
 442	}
 443
 444	INIT_LIST_HEAD(&bmp->list);
 445
 446	bpl = (struct ulp_bde64 *) bmp->virt;
 447	request_nseg = LPFC_BPL_SIZE/sizeof(struct ulp_bde64);
 448	cmp = lpfc_alloc_bsg_buffers(phba, job->request_payload.payload_len,
 449				     1, bpl, &request_nseg);
 450	if (!cmp) {
 451		rc = -ENOMEM;
 452		goto free_bmp;
 453	}
 454	lpfc_bsg_copy_data(cmp, &job->request_payload,
 455			   job->request_payload.payload_len, 1);
 456
 457	bpl += request_nseg;
 458	reply_nseg = LPFC_BPL_SIZE/sizeof(struct ulp_bde64) - request_nseg;
 459	rmp = lpfc_alloc_bsg_buffers(phba, job->reply_payload.payload_len, 0,
 460				     bpl, &reply_nseg);
 461	if (!rmp) {
 462		rc = -ENOMEM;
 463		goto free_cmp;
 464	}
 465
 466	num_entry = request_nseg + reply_nseg;
 467
 468	if (phba->sli_rev == LPFC_SLI_REV4)
 469		ulp_context = phba->sli4_hba.rpi_ids[ndlp->nlp_rpi];
 470	else
 471		ulp_context = ndlp->nlp_rpi;
 472
 473	lpfc_sli_prep_gen_req(phba, cmdiocbq, bmp, ulp_context, num_entry,
 474			      phba->fc_ratov * 2);
 475
 476	cmdiocbq->num_bdes = num_entry;
 477	cmdiocbq->vport = phba->pport;
 478	cmdiocbq->cmd_dmabuf = cmp;
 479	cmdiocbq->bpl_dmabuf = bmp;
 480	cmdiocbq->cmd_flag |= LPFC_IO_LIBDFC;
 481
 482	cmdiocbq->cmd_cmpl = lpfc_bsg_send_mgmt_cmd_cmp;
 483	cmdiocbq->context_un.dd_data = dd_data;
 484
 485	dd_data->type = TYPE_IOCB;
 486	dd_data->set_job = job;
 487	dd_data->context_un.iocb.cmdiocbq = cmdiocbq;
 488	dd_data->context_un.iocb.rmp = rmp;
 489	job->dd_data = dd_data;
 490
 491	if (phba->cfg_poll & DISABLE_FCP_RING_INT) {
 492		if (lpfc_readl(phba->HCregaddr, &creg_val)) {
 493			rc = -EIO ;
 494			goto free_rmp;
 495		}
 496		creg_val |= (HC_R0INT_ENA << LPFC_FCP_RING);
 497		writel(creg_val, phba->HCregaddr);
 498		readl(phba->HCregaddr); /* flush */
 499	}
 500
 501	cmdiocbq->ndlp = lpfc_nlp_get(ndlp);
 502	if (!cmdiocbq->ndlp) {
 503		rc = -ENODEV;
 504		goto free_rmp;
 505	}
 506
 507	iocb_stat = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, cmdiocbq, 0);
 508	if (iocb_stat == IOCB_SUCCESS) {
 509		spin_lock_irqsave(&phba->hbalock, flags);
 510		/* make sure the I/O had not been completed yet */
 511		if (cmdiocbq->cmd_flag & LPFC_IO_LIBDFC) {
 512			/* open up abort window to timeout handler */
 513			cmdiocbq->cmd_flag |= LPFC_IO_CMD_OUTSTANDING;
 514		}
 515		spin_unlock_irqrestore(&phba->hbalock, flags);
 516		return 0; /* done for now */
 517	} else if (iocb_stat == IOCB_BUSY) {
 518		rc = -EAGAIN;
 519	} else {
 520		rc = -EIO;
 521	}
 522
 523	/* iocb failed so cleanup */
 524	lpfc_nlp_put(ndlp);
 525
 526free_rmp:
 527	lpfc_free_bsg_buffers(phba, rmp);
 528free_cmp:
 529	lpfc_free_bsg_buffers(phba, cmp);
 530free_bmp:
 531	if (bmp->virt)
 532		lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
 533	kfree(bmp);
 534free_cmdiocbq:
 535	lpfc_sli_release_iocbq(phba, cmdiocbq);
 536free_dd:
 537	kfree(dd_data);
 538no_dd_data:
 539	/* make error code available to userspace */
 540	bsg_reply->result = rc;
 541	job->dd_data = NULL;
 542	return rc;
 543}
 544
 545/**
 546 * lpfc_bsg_rport_els_cmp - lpfc_bsg_rport_els's completion handler
 547 * @phba: Pointer to HBA context object.
 548 * @cmdiocbq: Pointer to command iocb.
 549 * @rspiocbq: Pointer to response iocb.
 550 *
 551 * This function is the completion handler for iocbs issued using
 552 * lpfc_bsg_rport_els_cmp function. This function is called by the
 553 * ring event handler function without any lock held. This function
 554 * can be called from both worker thread context and interrupt
 555 * context. This function also can be called from other thread which
 556 * cleans up the SLI layer objects.
 557 * This function copies the contents of the response iocb to the
 558 * response iocb memory object provided by the caller of
 559 * lpfc_sli_issue_iocb_wait and then wakes up the thread which
 560 * sleeps for the iocb completion.
 561 **/
 562static void
 563lpfc_bsg_rport_els_cmp(struct lpfc_hba *phba,
 564			struct lpfc_iocbq *cmdiocbq,
 565			struct lpfc_iocbq *rspiocbq)
 566{
 567	struct bsg_job_data *dd_data;
 568	struct bsg_job *job;
 569	struct fc_bsg_reply *bsg_reply;
 570	struct lpfc_nodelist *ndlp;
 571	struct lpfc_dmabuf *pcmd = NULL, *prsp = NULL;
 572	struct fc_bsg_ctels_reply *els_reply;
 573	uint8_t *rjt_data;
 574	unsigned long flags;
 575	unsigned int rsp_size;
 576	int rc = 0;
 577	u32 ulp_status, ulp_word4, total_data_placed;
 578
 579	dd_data = cmdiocbq->context_un.dd_data;
 580	ndlp = dd_data->context_un.iocb.ndlp;
 581	cmdiocbq->ndlp = ndlp;
 582
 583	/* Determine if job has been aborted */
 584	spin_lock_irqsave(&phba->ct_ev_lock, flags);
 585	job = dd_data->set_job;
 586	if (job) {
 587		bsg_reply = job->reply;
 588		/* Prevent timeout handling from trying to abort job  */
 589		job->dd_data = NULL;
 590	}
 591	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
 592
 593	/* Close the timeout handler abort window */
 594	spin_lock_irqsave(&phba->hbalock, flags);
 595	cmdiocbq->cmd_flag &= ~LPFC_IO_CMD_OUTSTANDING;
 596	spin_unlock_irqrestore(&phba->hbalock, flags);
 597
 598	ulp_status = get_job_ulpstatus(phba, rspiocbq);
 599	ulp_word4 = get_job_word4(phba, rspiocbq);
 600	total_data_placed = get_job_data_placed(phba, rspiocbq);
 601	pcmd = cmdiocbq->cmd_dmabuf;
 602	prsp = (struct lpfc_dmabuf *)pcmd->list.next;
 603
 604	/* Copy the completed job data or determine the job status if job is
 605	 * still active
 606	 */
 607
 608	if (job) {
 609		if (ulp_status == IOSTAT_SUCCESS) {
 610			rsp_size = total_data_placed;
 611			bsg_reply->reply_payload_rcv_len =
 612				sg_copy_from_buffer(job->reply_payload.sg_list,
 613						    job->reply_payload.sg_cnt,
 614						    prsp->virt,
 615						    rsp_size);
 616		} else if (ulp_status == IOSTAT_LS_RJT) {
 617			bsg_reply->reply_payload_rcv_len =
 618				sizeof(struct fc_bsg_ctels_reply);
 619			/* LS_RJT data returned in word 4 */
 620			rjt_data = (uint8_t *)&ulp_word4;
 621			els_reply = &bsg_reply->reply_data.ctels_reply;
 622			els_reply->status = FC_CTELS_STATUS_REJECT;
 623			els_reply->rjt_data.action = rjt_data[3];
 624			els_reply->rjt_data.reason_code = rjt_data[2];
 625			els_reply->rjt_data.reason_explanation = rjt_data[1];
 626			els_reply->rjt_data.vendor_unique = rjt_data[0];
 627		} else if (ulp_status == IOSTAT_LOCAL_REJECT &&
 628			   (ulp_word4 & IOERR_PARAM_MASK) ==
 629			   IOERR_SEQUENCE_TIMEOUT) {
 630			rc = -ETIMEDOUT;
 631		} else {
 632			rc = -EIO;
 633		}
 634	}
 635
 636	lpfc_els_free_iocb(phba, cmdiocbq);
 637
 638	lpfc_nlp_put(ndlp);
 639	kfree(dd_data);
 640
 641	/* Complete the job if the job is still active */
 642
 643	if (job) {
 644		bsg_reply->result = rc;
 645		bsg_job_done(job, bsg_reply->result,
 646			       bsg_reply->reply_payload_rcv_len);
 647	}
 648	return;
 649}
 650
 651/**
 652 * lpfc_bsg_rport_els - send an ELS command from a bsg request
 653 * @job: fc_bsg_job to handle
 654 **/
 655static int
 656lpfc_bsg_rport_els(struct bsg_job *job)
 657{
 658	struct lpfc_vport *vport = shost_priv(fc_bsg_to_shost(job));
 659	struct lpfc_hba *phba = vport->phba;
 660	struct lpfc_rport_data *rdata = fc_bsg_to_rport(job)->dd_data;
 661	struct lpfc_nodelist *ndlp = rdata->pnode;
 662	struct fc_bsg_request *bsg_request = job->request;
 663	struct fc_bsg_reply *bsg_reply = job->reply;
 664	uint32_t elscmd;
 665	uint32_t cmdsize;
 666	struct lpfc_iocbq *cmdiocbq;
 667	uint16_t rpi = 0;
 668	struct bsg_job_data *dd_data;
 669	unsigned long flags;
 670	uint32_t creg_val;
 671	int rc = 0;
 672
 673	/* in case no data is transferred */
 674	bsg_reply->reply_payload_rcv_len = 0;
 675
 676	/* verify the els command is not greater than the
 677	 * maximum ELS transfer size.
 678	 */
 679
 680	if (job->request_payload.payload_len > FCELSSIZE) {
 681		rc = -EINVAL;
 682		goto no_dd_data;
 683	}
 684
 685	/* allocate our bsg tracking structure */
 686	dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
 687	if (!dd_data) {
 688		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
 689				"2735 Failed allocation of dd_data\n");
 690		rc = -ENOMEM;
 691		goto no_dd_data;
 692	}
 693
 694	elscmd = bsg_request->rqst_data.r_els.els_code;
 695	cmdsize = job->request_payload.payload_len;
 696
 697	if (!lpfc_nlp_get(ndlp)) {
 698		rc = -ENODEV;
 699		goto free_dd_data;
 700	}
 701
 702	/* We will use the allocated dma buffers by prep els iocb for command
 703	 * and response to ensure if the job times out and the request is freed,
 704	 * we won't be dma into memory that is no longer allocated to for the
 705	 * request.
 706	 */
 707	cmdiocbq = lpfc_prep_els_iocb(vport, 1, cmdsize, 0, ndlp,
 708				      ndlp->nlp_DID, elscmd);
 709	if (!cmdiocbq) {
 710		rc = -EIO;
 711		goto release_ndlp;
 712	}
 713
 714	/* Transfer the request payload to allocated command dma buffer */
 715	sg_copy_to_buffer(job->request_payload.sg_list,
 716			  job->request_payload.sg_cnt,
 717			  cmdiocbq->cmd_dmabuf->virt,
 718			  cmdsize);
 719
 720	rpi = ndlp->nlp_rpi;
 721
 722	if (phba->sli_rev == LPFC_SLI_REV4)
 723		bf_set(wqe_ctxt_tag, &cmdiocbq->wqe.generic.wqe_com,
 724		       phba->sli4_hba.rpi_ids[rpi]);
 725	else
 726		cmdiocbq->iocb.ulpContext = rpi;
 727	cmdiocbq->cmd_flag |= LPFC_IO_LIBDFC;
 728	cmdiocbq->context_un.dd_data = dd_data;
 729	cmdiocbq->ndlp = ndlp;
 730	cmdiocbq->cmd_cmpl = lpfc_bsg_rport_els_cmp;
 731	dd_data->type = TYPE_IOCB;
 732	dd_data->set_job = job;
 733	dd_data->context_un.iocb.cmdiocbq = cmdiocbq;
 734	dd_data->context_un.iocb.ndlp = ndlp;
 735	dd_data->context_un.iocb.rmp = NULL;
 736	job->dd_data = dd_data;
 737
 738	if (phba->cfg_poll & DISABLE_FCP_RING_INT) {
 739		if (lpfc_readl(phba->HCregaddr, &creg_val)) {
 740			rc = -EIO;
 741			goto linkdown_err;
 742		}
 743		creg_val |= (HC_R0INT_ENA << LPFC_FCP_RING);
 744		writel(creg_val, phba->HCregaddr);
 745		readl(phba->HCregaddr); /* flush */
 746	}
 747
 748	rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, cmdiocbq, 0);
 749	if (rc == IOCB_SUCCESS) {
 750		spin_lock_irqsave(&phba->hbalock, flags);
 751		/* make sure the I/O had not been completed/released */
 752		if (cmdiocbq->cmd_flag & LPFC_IO_LIBDFC) {
 753			/* open up abort window to timeout handler */
 754			cmdiocbq->cmd_flag |= LPFC_IO_CMD_OUTSTANDING;
 755		}
 756		spin_unlock_irqrestore(&phba->hbalock, flags);
 757		return 0; /* done for now */
 758	} else if (rc == IOCB_BUSY) {
 759		rc = -EAGAIN;
 760	} else {
 761		rc = -EIO;
 762	}
 763
 764	/* I/O issue failed.  Cleanup resources. */
 765
 766linkdown_err:
 767	lpfc_els_free_iocb(phba, cmdiocbq);
 768
 769release_ndlp:
 770	lpfc_nlp_put(ndlp);
 771
 772free_dd_data:
 773	kfree(dd_data);
 774
 775no_dd_data:
 776	/* make error code available to userspace */
 777	bsg_reply->result = rc;
 778	job->dd_data = NULL;
 779	return rc;
 780}
 781
 782/**
 783 * lpfc_bsg_event_free - frees an allocated event structure
 784 * @kref: Pointer to a kref.
 785 *
 786 * Called from kref_put. Back cast the kref into an event structure address.
 787 * Free any events to get, delete associated nodes, free any events to see,
 788 * free any data then free the event itself.
 789 **/
 790static void
 791lpfc_bsg_event_free(struct kref *kref)
 792{
 793	struct lpfc_bsg_event *evt = container_of(kref, struct lpfc_bsg_event,
 794						  kref);
 795	struct event_data *ed;
 796
 797	list_del(&evt->node);
 798
 799	while (!list_empty(&evt->events_to_get)) {
 800		ed = list_entry(evt->events_to_get.next, typeof(*ed), node);
 801		list_del(&ed->node);
 802		kfree(ed->data);
 803		kfree(ed);
 804	}
 805
 806	while (!list_empty(&evt->events_to_see)) {
 807		ed = list_entry(evt->events_to_see.next, typeof(*ed), node);
 808		list_del(&ed->node);
 809		kfree(ed->data);
 810		kfree(ed);
 811	}
 812
 813	kfree(evt->dd_data);
 814	kfree(evt);
 815}
 816
 817/**
 818 * lpfc_bsg_event_ref - increments the kref for an event
 819 * @evt: Pointer to an event structure.
 820 **/
 821static inline void
 822lpfc_bsg_event_ref(struct lpfc_bsg_event *evt)
 823{
 824	kref_get(&evt->kref);
 825}
 826
 827/**
 828 * lpfc_bsg_event_unref - Uses kref_put to free an event structure
 829 * @evt: Pointer to an event structure.
 830 **/
 831static inline void
 832lpfc_bsg_event_unref(struct lpfc_bsg_event *evt)
 833{
 834	kref_put(&evt->kref, lpfc_bsg_event_free);
 835}
 836
 837/**
 838 * lpfc_bsg_event_new - allocate and initialize a event structure
 839 * @ev_mask: Mask of events.
 840 * @ev_reg_id: Event reg id.
 841 * @ev_req_id: Event request id.
 842 **/
 843static struct lpfc_bsg_event *
 844lpfc_bsg_event_new(uint32_t ev_mask, int ev_reg_id, uint32_t ev_req_id)
 845{
 846	struct lpfc_bsg_event *evt = kzalloc(sizeof(*evt), GFP_KERNEL);
 847
 848	if (!evt)
 849		return NULL;
 850
 851	INIT_LIST_HEAD(&evt->events_to_get);
 852	INIT_LIST_HEAD(&evt->events_to_see);
 853	evt->type_mask = ev_mask;
 854	evt->req_id = ev_req_id;
 855	evt->reg_id = ev_reg_id;
 856	evt->wait_time_stamp = jiffies;
 857	evt->dd_data = NULL;
 858	init_waitqueue_head(&evt->wq);
 859	kref_init(&evt->kref);
 860	return evt;
 861}
 862
 863/**
 864 * diag_cmd_data_free - Frees an lpfc dma buffer extension
 865 * @phba: Pointer to HBA context object.
 866 * @mlist: Pointer to an lpfc dma buffer extension.
 867 **/
 868static int
 869diag_cmd_data_free(struct lpfc_hba *phba, struct lpfc_dmabufext *mlist)
 870{
 871	struct lpfc_dmabufext *mlast;
 872	struct pci_dev *pcidev;
 873	struct list_head head, *curr, *next;
 874
 875	if ((!mlist) || (!lpfc_is_link_up(phba) &&
 876		(phba->link_flag & LS_LOOPBACK_MODE))) {
 877		return 0;
 878	}
 879
 880	pcidev = phba->pcidev;
 881	list_add_tail(&head, &mlist->dma.list);
 882
 883	list_for_each_safe(curr, next, &head) {
 884		mlast = list_entry(curr, struct lpfc_dmabufext , dma.list);
 885		if (mlast->dma.virt)
 886			dma_free_coherent(&pcidev->dev,
 887					  mlast->size,
 888					  mlast->dma.virt,
 889					  mlast->dma.phys);
 890		kfree(mlast);
 891	}
 892	return 0;
 893}
 894
 895/*
 896 * lpfc_bsg_ct_unsol_event - process an unsolicited CT command
 897 *
 898 * This function is called when an unsolicited CT command is received.  It
 899 * forwards the event to any processes registered to receive CT events.
 900 **/
 901int
 902lpfc_bsg_ct_unsol_event(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
 903			struct lpfc_iocbq *piocbq)
 904{
 905	uint32_t evt_req_id = 0;
 906	u16 cmd;
 907	struct lpfc_dmabuf *dmabuf = NULL;
 908	struct lpfc_bsg_event *evt;
 909	struct event_data *evt_dat = NULL;
 910	struct lpfc_iocbq *iocbq;
 911	IOCB_t *iocb = NULL;
 912	size_t offset = 0;
 913	struct list_head head;
 914	struct ulp_bde64 *bde;
 915	dma_addr_t dma_addr;
 916	int i;
 917	struct lpfc_dmabuf *bdeBuf1 = piocbq->cmd_dmabuf;
 918	struct lpfc_dmabuf *bdeBuf2 = piocbq->bpl_dmabuf;
 919	struct lpfc_sli_ct_request *ct_req;
 920	struct bsg_job *job = NULL;
 921	struct fc_bsg_reply *bsg_reply;
 922	struct bsg_job_data *dd_data = NULL;
 923	unsigned long flags;
 924	int size = 0;
 925	u32 bde_count = 0;
 926
 927	INIT_LIST_HEAD(&head);
 928	list_add_tail(&head, &piocbq->list);
 929
 930	ct_req = (struct lpfc_sli_ct_request *)bdeBuf1->virt;
 931	evt_req_id = ct_req->FsType;
 932	cmd = be16_to_cpu(ct_req->CommandResponse.bits.CmdRsp);
 933
 934	spin_lock_irqsave(&phba->ct_ev_lock, flags);
 935	list_for_each_entry(evt, &phba->ct_ev_waiters, node) {
 936		if (!(evt->type_mask & FC_REG_CT_EVENT) ||
 937			evt->req_id != evt_req_id)
 938			continue;
 939
 940		lpfc_bsg_event_ref(evt);
 941		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
 942		evt_dat = kzalloc(sizeof(*evt_dat), GFP_KERNEL);
 943		if (evt_dat == NULL) {
 944			spin_lock_irqsave(&phba->ct_ev_lock, flags);
 945			lpfc_bsg_event_unref(evt);
 946			lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
 947					"2614 Memory allocation failed for "
 948					"CT event\n");
 949			break;
 950		}
 951
 952		if (phba->sli3_options & LPFC_SLI3_HBQ_ENABLED) {
 953			/* take accumulated byte count from the last iocbq */
 954			iocbq = list_entry(head.prev, typeof(*iocbq), list);
 955			if (phba->sli_rev == LPFC_SLI_REV4)
 956				evt_dat->len = iocbq->wcqe_cmpl.total_data_placed;
 957			else
 958				evt_dat->len = iocbq->iocb.unsli3.rcvsli3.acc_len;
 959		} else {
 960			list_for_each_entry(iocbq, &head, list) {
 961				iocb = &iocbq->iocb;
 962				for (i = 0; i < iocb->ulpBdeCount;
 963				     i++)
 964					evt_dat->len +=
 965					iocb->un.cont64[i].tus.f.bdeSize;
 966			}
 967		}
 968
 969		evt_dat->data = kzalloc(evt_dat->len, GFP_KERNEL);
 970		if (evt_dat->data == NULL) {
 971			lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
 972					"2615 Memory allocation failed for "
 973					"CT event data, size %d\n",
 974					evt_dat->len);
 975			kfree(evt_dat);
 976			spin_lock_irqsave(&phba->ct_ev_lock, flags);
 977			lpfc_bsg_event_unref(evt);
 978			spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
 979			goto error_ct_unsol_exit;
 980		}
 981
 982		list_for_each_entry(iocbq, &head, list) {
 983			size = 0;
 984			if (phba->sli3_options & LPFC_SLI3_HBQ_ENABLED) {
 985				bdeBuf1 = iocbq->cmd_dmabuf;
 986				bdeBuf2 = iocbq->bpl_dmabuf;
 987			}
 988			if (phba->sli_rev == LPFC_SLI_REV4)
 989				bde_count = iocbq->wcqe_cmpl.word3;
 990			else
 991				bde_count = iocbq->iocb.ulpBdeCount;
 992			for (i = 0; i < bde_count; i++) {
 993				if (phba->sli3_options &
 994				    LPFC_SLI3_HBQ_ENABLED) {
 995					if (i == 0) {
 996						size = iocbq->wqe.gen_req.bde.tus.f.bdeSize;
 997						dmabuf = bdeBuf1;
 998					} else if (i == 1) {
 999						size = iocbq->unsol_rcv_len;
1000						dmabuf = bdeBuf2;
1001					}
1002					if ((offset + size) > evt_dat->len)
1003						size = evt_dat->len - offset;
1004				} else {
1005					size = iocbq->iocb.un.cont64[i].
1006						tus.f.bdeSize;
1007					bde = &iocbq->iocb.un.cont64[i];
1008					dma_addr = getPaddr(bde->addrHigh,
1009							    bde->addrLow);
1010					dmabuf = lpfc_sli_ringpostbuf_get(phba,
1011							pring, dma_addr);
1012				}
1013				if (!dmabuf) {
1014					lpfc_printf_log(phba, KERN_ERR,
1015						LOG_LIBDFC, "2616 No dmabuf "
1016						"found for iocbq x%px\n",
1017						iocbq);
1018					kfree(evt_dat->data);
1019					kfree(evt_dat);
1020					spin_lock_irqsave(&phba->ct_ev_lock,
1021						flags);
1022					lpfc_bsg_event_unref(evt);
1023					spin_unlock_irqrestore(
1024						&phba->ct_ev_lock, flags);
1025					goto error_ct_unsol_exit;
1026				}
1027				memcpy((char *)(evt_dat->data) + offset,
1028				       dmabuf->virt, size);
1029				offset += size;
1030				if (evt_req_id != SLI_CT_ELX_LOOPBACK &&
1031				    !(phba->sli3_options &
1032				      LPFC_SLI3_HBQ_ENABLED)) {
1033					lpfc_sli_ringpostbuf_put(phba, pring,
1034								 dmabuf);
1035				} else {
1036					switch (cmd) {
1037					case ELX_LOOPBACK_DATA:
1038						if (phba->sli_rev <
1039						    LPFC_SLI_REV4)
1040							diag_cmd_data_free(phba,
1041							(struct lpfc_dmabufext
1042							 *)dmabuf);
1043						break;
1044					case ELX_LOOPBACK_XRI_SETUP:
1045						if ((phba->sli_rev ==
1046							LPFC_SLI_REV2) ||
1047							(phba->sli3_options &
1048							LPFC_SLI3_HBQ_ENABLED
1049							)) {
1050							lpfc_in_buf_free(phba,
1051									dmabuf);
1052						} else {
1053							lpfc_sli3_post_buffer(phba,
1054									      pring,
1055									      1);
1056						}
1057						break;
1058					default:
1059						if (!(phba->sli3_options &
1060						      LPFC_SLI3_HBQ_ENABLED))
1061							lpfc_sli3_post_buffer(phba,
1062									      pring,
1063									      1);
1064						break;
1065					}
1066				}
1067			}
1068		}
1069
1070		spin_lock_irqsave(&phba->ct_ev_lock, flags);
1071		if (phba->sli_rev == LPFC_SLI_REV4) {
1072			evt_dat->immed_dat = phba->ctx_idx;
1073			phba->ctx_idx = (phba->ctx_idx + 1) % LPFC_CT_CTX_MAX;
1074			/* Provide warning for over-run of the ct_ctx array */
1075			if (phba->ct_ctx[evt_dat->immed_dat].valid ==
1076			    UNSOL_VALID)
1077				lpfc_printf_log(phba, KERN_WARNING, LOG_ELS,
1078						"2717 CT context array entry "
1079						"[%d] over-run: oxid:x%x, "
1080						"sid:x%x\n", phba->ctx_idx,
1081						phba->ct_ctx[
1082						    evt_dat->immed_dat].oxid,
1083						phba->ct_ctx[
1084						    evt_dat->immed_dat].SID);
1085			phba->ct_ctx[evt_dat->immed_dat].rxid =
1086				get_job_ulpcontext(phba, piocbq);
1087			phba->ct_ctx[evt_dat->immed_dat].oxid =
1088				get_job_rcvoxid(phba, piocbq);
1089			phba->ct_ctx[evt_dat->immed_dat].SID =
1090				bf_get(wqe_els_did,
1091				       &piocbq->wqe.xmit_els_rsp.wqe_dest);
1092			phba->ct_ctx[evt_dat->immed_dat].valid = UNSOL_VALID;
1093		} else
1094			evt_dat->immed_dat = get_job_ulpcontext(phba, piocbq);
1095
1096		evt_dat->type = FC_REG_CT_EVENT;
1097		list_add(&evt_dat->node, &evt->events_to_see);
1098		if (evt_req_id == SLI_CT_ELX_LOOPBACK) {
1099			wake_up_interruptible(&evt->wq);
1100			lpfc_bsg_event_unref(evt);
1101			break;
1102		}
1103
1104		list_move(evt->events_to_see.prev, &evt->events_to_get);
1105
1106		dd_data = (struct bsg_job_data *)evt->dd_data;
1107		job = dd_data->set_job;
1108		dd_data->set_job = NULL;
1109		lpfc_bsg_event_unref(evt);
1110		if (job) {
1111			bsg_reply = job->reply;
1112			bsg_reply->reply_payload_rcv_len = size;
1113			/* make error code available to userspace */
1114			bsg_reply->result = 0;
1115			job->dd_data = NULL;
1116			/* complete the job back to userspace */
1117			spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1118			bsg_job_done(job, bsg_reply->result,
1119				       bsg_reply->reply_payload_rcv_len);
1120			spin_lock_irqsave(&phba->ct_ev_lock, flags);
1121		}
1122	}
1123	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1124
1125error_ct_unsol_exit:
1126	if (!list_empty(&head))
1127		list_del(&head);
1128	if ((phba->sli_rev < LPFC_SLI_REV4) &&
1129	    (evt_req_id == SLI_CT_ELX_LOOPBACK))
1130		return 0;
1131	return 1;
1132}
1133
1134/**
1135 * lpfc_bsg_ct_unsol_abort - handler ct abort to management plane
1136 * @phba: Pointer to HBA context object.
1137 * @dmabuf: pointer to a dmabuf that describes the FC sequence
1138 *
1139 * This function handles abort to the CT command toward management plane
1140 * for SLI4 port.
1141 *
1142 * If the pending context of a CT command to management plane present, clears
1143 * such context and returns 1 for handled; otherwise, it returns 0 indicating
1144 * no context exists.
1145 **/
1146int
1147lpfc_bsg_ct_unsol_abort(struct lpfc_hba *phba, struct hbq_dmabuf *dmabuf)
1148{
1149	struct fc_frame_header fc_hdr;
1150	struct fc_frame_header *fc_hdr_ptr = &fc_hdr;
1151	int ctx_idx, handled = 0;
1152	uint16_t oxid, rxid;
1153	uint32_t sid;
1154
1155	memcpy(fc_hdr_ptr, dmabuf->hbuf.virt, sizeof(struct fc_frame_header));
1156	sid = sli4_sid_from_fc_hdr(fc_hdr_ptr);
1157	oxid = be16_to_cpu(fc_hdr_ptr->fh_ox_id);
1158	rxid = be16_to_cpu(fc_hdr_ptr->fh_rx_id);
1159
1160	for (ctx_idx = 0; ctx_idx < LPFC_CT_CTX_MAX; ctx_idx++) {
1161		if (phba->ct_ctx[ctx_idx].valid != UNSOL_VALID)
1162			continue;
1163		if (phba->ct_ctx[ctx_idx].rxid != rxid)
1164			continue;
1165		if (phba->ct_ctx[ctx_idx].oxid != oxid)
1166			continue;
1167		if (phba->ct_ctx[ctx_idx].SID != sid)
1168			continue;
1169		phba->ct_ctx[ctx_idx].valid = UNSOL_INVALID;
1170		handled = 1;
1171	}
1172	return handled;
1173}
1174
1175/**
1176 * lpfc_bsg_hba_set_event - process a SET_EVENT bsg vendor command
1177 * @job: SET_EVENT fc_bsg_job
1178 **/
1179static int
1180lpfc_bsg_hba_set_event(struct bsg_job *job)
1181{
1182	struct lpfc_vport *vport = shost_priv(fc_bsg_to_shost(job));
1183	struct lpfc_hba *phba = vport->phba;
1184	struct fc_bsg_request *bsg_request = job->request;
1185	struct set_ct_event *event_req;
1186	struct lpfc_bsg_event *evt;
1187	int rc = 0;
1188	struct bsg_job_data *dd_data = NULL;
1189	uint32_t ev_mask;
1190	unsigned long flags;
1191
1192	if (job->request_len <
1193	    sizeof(struct fc_bsg_request) + sizeof(struct set_ct_event)) {
1194		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1195				"2612 Received SET_CT_EVENT below minimum "
1196				"size\n");
1197		rc = -EINVAL;
1198		goto job_error;
1199	}
1200
1201	event_req = (struct set_ct_event *)
1202		bsg_request->rqst_data.h_vendor.vendor_cmd;
1203	ev_mask = ((uint32_t)(unsigned long)event_req->type_mask &
1204				FC_REG_EVENT_MASK);
1205	spin_lock_irqsave(&phba->ct_ev_lock, flags);
1206	list_for_each_entry(evt, &phba->ct_ev_waiters, node) {
1207		if (evt->reg_id == event_req->ev_reg_id) {
1208			lpfc_bsg_event_ref(evt);
1209			evt->wait_time_stamp = jiffies;
1210			dd_data = (struct bsg_job_data *)evt->dd_data;
1211			break;
1212		}
1213	}
1214	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1215
1216	if (&evt->node == &phba->ct_ev_waiters) {
1217		/* no event waiting struct yet - first call */
1218		dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
1219		if (dd_data == NULL) {
1220			lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1221					"2734 Failed allocation of dd_data\n");
1222			rc = -ENOMEM;
1223			goto job_error;
1224		}
1225		evt = lpfc_bsg_event_new(ev_mask, event_req->ev_reg_id,
1226					event_req->ev_req_id);
1227		if (!evt) {
1228			lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1229					"2617 Failed allocation of event "
1230					"waiter\n");
1231			rc = -ENOMEM;
1232			goto job_error;
1233		}
1234		dd_data->type = TYPE_EVT;
1235		dd_data->set_job = NULL;
1236		dd_data->context_un.evt = evt;
1237		evt->dd_data = (void *)dd_data;
1238		spin_lock_irqsave(&phba->ct_ev_lock, flags);
1239		list_add(&evt->node, &phba->ct_ev_waiters);
1240		lpfc_bsg_event_ref(evt);
1241		evt->wait_time_stamp = jiffies;
1242		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1243	}
1244
1245	spin_lock_irqsave(&phba->ct_ev_lock, flags);
1246	evt->waiting = 1;
1247	dd_data->set_job = job; /* for unsolicited command */
1248	job->dd_data = dd_data; /* for fc transport timeout callback*/
1249	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1250	return 0; /* call job done later */
1251
1252job_error:
1253	kfree(dd_data);
1254	job->dd_data = NULL;
1255	return rc;
1256}
1257
1258/**
1259 * lpfc_bsg_hba_get_event - process a GET_EVENT bsg vendor command
1260 * @job: GET_EVENT fc_bsg_job
1261 **/
1262static int
1263lpfc_bsg_hba_get_event(struct bsg_job *job)
1264{
1265	struct lpfc_vport *vport = shost_priv(fc_bsg_to_shost(job));
1266	struct lpfc_hba *phba = vport->phba;
1267	struct fc_bsg_request *bsg_request = job->request;
1268	struct fc_bsg_reply *bsg_reply = job->reply;
1269	struct get_ct_event *event_req;
1270	struct get_ct_event_reply *event_reply;
1271	struct lpfc_bsg_event *evt, *evt_next;
1272	struct event_data *evt_dat = NULL;
1273	unsigned long flags;
1274	uint32_t rc = 0;
1275
1276	if (job->request_len <
1277	    sizeof(struct fc_bsg_request) + sizeof(struct get_ct_event)) {
1278		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1279				"2613 Received GET_CT_EVENT request below "
1280				"minimum size\n");
1281		rc = -EINVAL;
1282		goto job_error;
1283	}
1284
1285	event_req = (struct get_ct_event *)
1286		bsg_request->rqst_data.h_vendor.vendor_cmd;
1287
1288	event_reply = (struct get_ct_event_reply *)
1289		bsg_reply->reply_data.vendor_reply.vendor_rsp;
1290	spin_lock_irqsave(&phba->ct_ev_lock, flags);
1291	list_for_each_entry_safe(evt, evt_next, &phba->ct_ev_waiters, node) {
1292		if (evt->reg_id == event_req->ev_reg_id) {
1293			if (list_empty(&evt->events_to_get))
1294				break;
1295			lpfc_bsg_event_ref(evt);
1296			evt->wait_time_stamp = jiffies;
1297			evt_dat = list_entry(evt->events_to_get.prev,
1298					     struct event_data, node);
1299			list_del(&evt_dat->node);
1300			break;
1301		}
1302	}
1303	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1304
1305	/* The app may continue to ask for event data until it gets
1306	 * an error indicating that there isn't anymore
1307	 */
1308	if (evt_dat == NULL) {
1309		bsg_reply->reply_payload_rcv_len = 0;
1310		rc = -ENOENT;
1311		goto job_error;
1312	}
1313
1314	if (evt_dat->len > job->request_payload.payload_len) {
1315		evt_dat->len = job->request_payload.payload_len;
1316		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1317				"2618 Truncated event data at %d "
1318				"bytes\n",
1319				job->request_payload.payload_len);
1320	}
1321
1322	event_reply->type = evt_dat->type;
1323	event_reply->immed_data = evt_dat->immed_dat;
1324	if (evt_dat->len > 0)
1325		bsg_reply->reply_payload_rcv_len =
1326			sg_copy_from_buffer(job->request_payload.sg_list,
1327					    job->request_payload.sg_cnt,
1328					    evt_dat->data, evt_dat->len);
1329	else
1330		bsg_reply->reply_payload_rcv_len = 0;
1331
1332	if (evt_dat) {
1333		kfree(evt_dat->data);
1334		kfree(evt_dat);
1335	}
1336
1337	spin_lock_irqsave(&phba->ct_ev_lock, flags);
1338	lpfc_bsg_event_unref(evt);
1339	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1340	job->dd_data = NULL;
1341	bsg_reply->result = 0;
1342	bsg_job_done(job, bsg_reply->result,
1343		       bsg_reply->reply_payload_rcv_len);
1344	return 0;
1345
1346job_error:
1347	job->dd_data = NULL;
1348	bsg_reply->result = rc;
1349	return rc;
1350}
1351
1352/**
1353 * lpfc_issue_ct_rsp_cmp - lpfc_issue_ct_rsp's completion handler
1354 * @phba: Pointer to HBA context object.
1355 * @cmdiocbq: Pointer to command iocb.
1356 * @rspiocbq: Pointer to response iocb.
1357 *
1358 * This function is the completion handler for iocbs issued using
1359 * lpfc_issue_ct_rsp_cmp function. This function is called by the
1360 * ring event handler function without any lock held. This function
1361 * can be called from both worker thread context and interrupt
1362 * context. This function also can be called from other thread which
1363 * cleans up the SLI layer objects.
1364 * This function copy the contents of the response iocb to the
1365 * response iocb memory object provided by the caller of
1366 * lpfc_sli_issue_iocb_wait and then wakes up the thread which
1367 * sleeps for the iocb completion.
1368 **/
1369static void
1370lpfc_issue_ct_rsp_cmp(struct lpfc_hba *phba,
1371			struct lpfc_iocbq *cmdiocbq,
1372			struct lpfc_iocbq *rspiocbq)
1373{
1374	struct bsg_job_data *dd_data;
1375	struct bsg_job *job;
1376	struct fc_bsg_reply *bsg_reply;
1377	struct lpfc_dmabuf *bmp, *cmp;
1378	struct lpfc_nodelist *ndlp;
1379	unsigned long flags;
1380	int rc = 0;
1381	u32 ulp_status, ulp_word4;
1382
1383	dd_data = cmdiocbq->context_un.dd_data;
1384
1385	/* Determine if job has been aborted */
1386	spin_lock_irqsave(&phba->ct_ev_lock, flags);
1387	job = dd_data->set_job;
1388	if (job) {
1389		/* Prevent timeout handling from trying to abort job  */
1390		job->dd_data = NULL;
1391	}
1392	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1393
1394	/* Close the timeout handler abort window */
1395	spin_lock_irqsave(&phba->hbalock, flags);
1396	cmdiocbq->cmd_flag &= ~LPFC_IO_CMD_OUTSTANDING;
1397	spin_unlock_irqrestore(&phba->hbalock, flags);
1398
1399	ndlp = dd_data->context_un.iocb.ndlp;
1400	cmp = cmdiocbq->cmd_dmabuf;
1401	bmp = cmdiocbq->bpl_dmabuf;
1402
1403	ulp_status = get_job_ulpstatus(phba, rspiocbq);
1404	ulp_word4 = get_job_word4(phba, rspiocbq);
1405
1406	/* Copy the completed job data or set the error status */
1407
1408	if (job) {
1409		bsg_reply = job->reply;
1410		if (ulp_status) {
1411			if (ulp_status == IOSTAT_LOCAL_REJECT) {
1412				switch (ulp_word4 & IOERR_PARAM_MASK) {
1413				case IOERR_SEQUENCE_TIMEOUT:
1414					rc = -ETIMEDOUT;
1415					break;
1416				case IOERR_INVALID_RPI:
1417					rc = -EFAULT;
1418					break;
1419				default:
1420					rc = -EACCES;
1421					break;
1422				}
1423			} else {
1424				rc = -EACCES;
1425			}
1426		} else {
1427			bsg_reply->reply_payload_rcv_len = 0;
1428		}
1429	}
1430
1431	lpfc_free_bsg_buffers(phba, cmp);
1432	lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
1433	kfree(bmp);
1434	lpfc_sli_release_iocbq(phba, cmdiocbq);
1435	lpfc_nlp_put(ndlp);
1436	kfree(dd_data);
1437
1438	/* Complete the job if the job is still active */
1439
1440	if (job) {
1441		bsg_reply->result = rc;
1442		bsg_job_done(job, bsg_reply->result,
1443			       bsg_reply->reply_payload_rcv_len);
1444	}
1445	return;
1446}
1447
1448/**
1449 * lpfc_issue_ct_rsp - issue a ct response
1450 * @phba: Pointer to HBA context object.
1451 * @job: Pointer to the job object.
1452 * @tag: tag index value into the ports context exchange array.
1453 * @cmp: Pointer to a cmp dma buffer descriptor.
1454 * @bmp: Pointer to a bmp dma buffer descriptor.
1455 * @num_entry: Number of enties in the bde.
1456 **/
1457static int
1458lpfc_issue_ct_rsp(struct lpfc_hba *phba, struct bsg_job *job, uint32_t tag,
1459		  struct lpfc_dmabuf *cmp, struct lpfc_dmabuf *bmp,
1460		  int num_entry)
1461{
1462	struct lpfc_iocbq *ctiocb = NULL;
1463	int rc = 0;
1464	struct lpfc_nodelist *ndlp = NULL;
1465	struct bsg_job_data *dd_data;
1466	unsigned long flags;
1467	uint32_t creg_val;
1468	u16 ulp_context, iotag;
1469
1470	ndlp = lpfc_findnode_did(phba->pport, phba->ct_ctx[tag].SID);
1471	if (!ndlp) {
1472		lpfc_printf_log(phba, KERN_WARNING, LOG_ELS,
1473				"2721 ndlp null for oxid %x SID %x\n",
1474				phba->ct_ctx[tag].rxid,
1475				phba->ct_ctx[tag].SID);
1476		return IOCB_ERROR;
1477	}
1478
1479	/* allocate our bsg tracking structure */
1480	dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
1481	if (!dd_data) {
1482		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1483				"2736 Failed allocation of dd_data\n");
1484		rc = -ENOMEM;
1485		goto no_dd_data;
1486	}
1487
1488	/* Allocate buffer for  command iocb */
1489	ctiocb = lpfc_sli_get_iocbq(phba);
1490	if (!ctiocb) {
1491		rc = -ENOMEM;
1492		goto no_ctiocb;
1493	}
1494
1495	if (phba->sli_rev == LPFC_SLI_REV4) {
1496		/* Do not issue unsol response if oxid not marked as valid */
1497		if (phba->ct_ctx[tag].valid != UNSOL_VALID) {
1498			rc = IOCB_ERROR;
1499			goto issue_ct_rsp_exit;
1500		}
1501
1502		lpfc_sli_prep_xmit_seq64(phba, ctiocb, bmp,
1503					 phba->sli4_hba.rpi_ids[ndlp->nlp_rpi],
1504					 phba->ct_ctx[tag].oxid, num_entry,
1505					 FC_RCTL_DD_SOL_CTL, 1,
1506					 CMD_XMIT_SEQUENCE64_WQE);
1507
1508		/* The exchange is done, mark the entry as invalid */
1509		phba->ct_ctx[tag].valid = UNSOL_INVALID;
1510		iotag = get_wqe_reqtag(ctiocb);
1511	} else {
1512		lpfc_sli_prep_xmit_seq64(phba, ctiocb, bmp, 0, tag, num_entry,
1513					 FC_RCTL_DD_SOL_CTL, 1,
1514					 CMD_XMIT_SEQUENCE64_CX);
1515		ctiocb->num_bdes = num_entry;
1516		iotag = ctiocb->iocb.ulpIoTag;
1517	}
1518
1519	ulp_context = get_job_ulpcontext(phba, ctiocb);
1520
1521	/* Xmit CT response on exchange <xid> */
1522	lpfc_printf_log(phba, KERN_INFO, LOG_ELS,
1523			"2722 Xmit CT response on exchange x%x Data: x%x x%x x%x\n",
1524			ulp_context, iotag, tag, phba->link_state);
1525
1526	ctiocb->cmd_flag |= LPFC_IO_LIBDFC;
1527	ctiocb->vport = phba->pport;
1528	ctiocb->context_un.dd_data = dd_data;
1529	ctiocb->cmd_dmabuf = cmp;
1530	ctiocb->bpl_dmabuf = bmp;
1531	ctiocb->ndlp = ndlp;
1532	ctiocb->cmd_cmpl = lpfc_issue_ct_rsp_cmp;
1533
1534	dd_data->type = TYPE_IOCB;
1535	dd_data->set_job = job;
1536	dd_data->context_un.iocb.cmdiocbq = ctiocb;
1537	dd_data->context_un.iocb.ndlp = lpfc_nlp_get(ndlp);
1538	if (!dd_data->context_un.iocb.ndlp) {
1539		rc = -IOCB_ERROR;
1540		goto issue_ct_rsp_exit;
1541	}
1542	dd_data->context_un.iocb.rmp = NULL;
1543	job->dd_data = dd_data;
1544
1545	if (phba->cfg_poll & DISABLE_FCP_RING_INT) {
1546		if (lpfc_readl(phba->HCregaddr, &creg_val)) {
1547			rc = -IOCB_ERROR;
1548			goto issue_ct_rsp_exit;
1549		}
1550		creg_val |= (HC_R0INT_ENA << LPFC_FCP_RING);
1551		writel(creg_val, phba->HCregaddr);
1552		readl(phba->HCregaddr); /* flush */
1553	}
1554
1555	rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, ctiocb, 0);
1556	if (rc == IOCB_SUCCESS) {
1557		spin_lock_irqsave(&phba->hbalock, flags);
1558		/* make sure the I/O had not been completed/released */
1559		if (ctiocb->cmd_flag & LPFC_IO_LIBDFC) {
1560			/* open up abort window to timeout handler */
1561			ctiocb->cmd_flag |= LPFC_IO_CMD_OUTSTANDING;
1562		}
1563		spin_unlock_irqrestore(&phba->hbalock, flags);
1564		return 0; /* done for now */
1565	}
1566
1567	/* iocb failed so cleanup */
1568	job->dd_data = NULL;
1569	lpfc_nlp_put(ndlp);
1570
1571issue_ct_rsp_exit:
1572	lpfc_sli_release_iocbq(phba, ctiocb);
1573no_ctiocb:
1574	kfree(dd_data);
1575no_dd_data:
1576	return rc;
1577}
1578
1579/**
1580 * lpfc_bsg_send_mgmt_rsp - process a SEND_MGMT_RESP bsg vendor command
1581 * @job: SEND_MGMT_RESP fc_bsg_job
1582 **/
1583static int
1584lpfc_bsg_send_mgmt_rsp(struct bsg_job *job)
1585{
1586	struct lpfc_vport *vport = shost_priv(fc_bsg_to_shost(job));
1587	struct lpfc_hba *phba = vport->phba;
1588	struct fc_bsg_request *bsg_request = job->request;
1589	struct fc_bsg_reply *bsg_reply = job->reply;
1590	struct send_mgmt_resp *mgmt_resp = (struct send_mgmt_resp *)
1591		bsg_request->rqst_data.h_vendor.vendor_cmd;
1592	struct ulp_bde64 *bpl;
1593	struct lpfc_dmabuf *bmp = NULL, *cmp = NULL;
1594	int bpl_entries;
1595	uint32_t tag = mgmt_resp->tag;
1596	unsigned long reqbfrcnt =
1597			(unsigned long)job->request_payload.payload_len;
1598	int rc = 0;
1599
1600	/* in case no data is transferred */
1601	bsg_reply->reply_payload_rcv_len = 0;
1602
1603	if (!reqbfrcnt || (reqbfrcnt > (80 * BUF_SZ_4K))) {
1604		rc = -ERANGE;
1605		goto send_mgmt_rsp_exit;
1606	}
1607
1608	bmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
1609	if (!bmp) {
1610		rc = -ENOMEM;
1611		goto send_mgmt_rsp_exit;
1612	}
1613
1614	bmp->virt = lpfc_mbuf_alloc(phba, 0, &bmp->phys);
1615	if (!bmp->virt) {
1616		rc = -ENOMEM;
1617		goto send_mgmt_rsp_free_bmp;
1618	}
1619
1620	INIT_LIST_HEAD(&bmp->list);
1621	bpl = (struct ulp_bde64 *) bmp->virt;
1622	bpl_entries = (LPFC_BPL_SIZE/sizeof(struct ulp_bde64));
1623	cmp = lpfc_alloc_bsg_buffers(phba, job->request_payload.payload_len,
1624				     1, bpl, &bpl_entries);
1625	if (!cmp) {
1626		rc = -ENOMEM;
1627		goto send_mgmt_rsp_free_bmp;
1628	}
1629	lpfc_bsg_copy_data(cmp, &job->request_payload,
1630			   job->request_payload.payload_len, 1);
1631
1632	rc = lpfc_issue_ct_rsp(phba, job, tag, cmp, bmp, bpl_entries);
1633
1634	if (rc == IOCB_SUCCESS)
1635		return 0; /* done for now */
1636
1637	rc = -EACCES;
1638
1639	lpfc_free_bsg_buffers(phba, cmp);
1640
1641send_mgmt_rsp_free_bmp:
1642	if (bmp->virt)
1643		lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
1644	kfree(bmp);
1645send_mgmt_rsp_exit:
1646	/* make error code available to userspace */
1647	bsg_reply->result = rc;
1648	job->dd_data = NULL;
1649	return rc;
1650}
1651
1652/**
1653 * lpfc_bsg_diag_mode_enter - process preparing into device diag loopback mode
1654 * @phba: Pointer to HBA context object.
1655 *
1656 * This function is responsible for preparing driver for diag loopback
1657 * on device.
1658 */
1659static int
1660lpfc_bsg_diag_mode_enter(struct lpfc_hba *phba)
1661{
1662	struct lpfc_vport **vports;
1663	struct Scsi_Host *shost;
1664	struct lpfc_sli *psli;
1665	struct lpfc_queue *qp = NULL;
1666	struct lpfc_sli_ring *pring;
1667	int i = 0;
1668
1669	psli = &phba->sli;
1670	if (!psli)
1671		return -ENODEV;
1672
1673
1674	if ((phba->link_state == LPFC_HBA_ERROR) ||
1675	    (psli->sli_flag & LPFC_BLOCK_MGMT_IO) ||
1676	    (!(psli->sli_flag & LPFC_SLI_ACTIVE)))
1677		return -EACCES;
1678
1679	vports = lpfc_create_vport_work_array(phba);
1680	if (vports) {
1681		for (i = 0; i <= phba->max_vpi && vports[i] != NULL; i++) {
1682			shost = lpfc_shost_from_vport(vports[i]);
1683			scsi_block_requests(shost);
1684		}
1685		lpfc_destroy_vport_work_array(phba, vports);
1686	} else {
1687		shost = lpfc_shost_from_vport(phba->pport);
1688		scsi_block_requests(shost);
1689	}
1690
1691	if (phba->sli_rev != LPFC_SLI_REV4) {
1692		pring = &psli->sli3_ring[LPFC_FCP_RING];
1693		lpfc_emptyq_wait(phba, &pring->txcmplq, &phba->hbalock);
1694		return 0;
1695	}
1696	list_for_each_entry(qp, &phba->sli4_hba.lpfc_wq_list, wq_list) {
1697		pring = qp->pring;
1698		if (!pring || (pring->ringno != LPFC_FCP_RING))
1699			continue;
1700		if (!lpfc_emptyq_wait(phba, &pring->txcmplq,
1701				      &pring->ring_lock))
1702			break;
1703	}
1704	return 0;
1705}
1706
1707/**
1708 * lpfc_bsg_diag_mode_exit - exit process from device diag loopback mode
1709 * @phba: Pointer to HBA context object.
1710 *
1711 * This function is responsible for driver exit processing of setting up
1712 * diag loopback mode on device.
1713 */
1714static void
1715lpfc_bsg_diag_mode_exit(struct lpfc_hba *phba)
1716{
1717	struct Scsi_Host *shost;
1718	struct lpfc_vport **vports;
1719	int i;
1720
1721	vports = lpfc_create_vport_work_array(phba);
1722	if (vports) {
1723		for (i = 0; i <= phba->max_vpi && vports[i] != NULL; i++) {
1724			shost = lpfc_shost_from_vport(vports[i]);
1725			scsi_unblock_requests(shost);
1726		}
1727		lpfc_destroy_vport_work_array(phba, vports);
1728	} else {
1729		shost = lpfc_shost_from_vport(phba->pport);
1730		scsi_unblock_requests(shost);
1731	}
1732	return;
1733}
1734
1735/**
1736 * lpfc_sli3_bsg_diag_loopback_mode - process an sli3 bsg vendor command
1737 * @phba: Pointer to HBA context object.
1738 * @job: LPFC_BSG_VENDOR_DIAG_MODE
1739 *
1740 * This function is responsible for placing an sli3  port into diagnostic
1741 * loopback mode in order to perform a diagnostic loopback test.
1742 * All new scsi requests are blocked, a small delay is used to allow the
1743 * scsi requests to complete then the link is brought down. If the link is
1744 * is placed in loopback mode then scsi requests are again allowed
1745 * so the scsi mid-layer doesn't give up on the port.
1746 * All of this is done in-line.
1747 */
1748static int
1749lpfc_sli3_bsg_diag_loopback_mode(struct lpfc_hba *phba, struct bsg_job *job)
1750{
1751	struct fc_bsg_request *bsg_request = job->request;
1752	struct fc_bsg_reply *bsg_reply = job->reply;
1753	struct diag_mode_set *loopback_mode;
1754	uint32_t link_flags;
1755	uint32_t timeout;
1756	LPFC_MBOXQ_t *pmboxq  = NULL;
1757	int mbxstatus = MBX_SUCCESS;
1758	int i = 0;
1759	int rc = 0;
1760
1761	/* no data to return just the return code */
1762	bsg_reply->reply_payload_rcv_len = 0;
1763
1764	if (job->request_len < sizeof(struct fc_bsg_request) +
1765	    sizeof(struct diag_mode_set)) {
1766		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1767				"2738 Received DIAG MODE request size:%d "
1768				"below the minimum size:%d\n",
1769				job->request_len,
1770				(int)(sizeof(struct fc_bsg_request) +
1771				sizeof(struct diag_mode_set)));
1772		rc = -EINVAL;
1773		goto job_error;
1774	}
1775
1776	rc = lpfc_bsg_diag_mode_enter(phba);
1777	if (rc)
1778		goto job_error;
1779
1780	/* bring the link to diagnostic mode */
1781	loopback_mode = (struct diag_mode_set *)
1782		bsg_request->rqst_data.h_vendor.vendor_cmd;
1783	link_flags = loopback_mode->type;
1784	timeout = loopback_mode->timeout * 100;
1785
1786	pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
1787	if (!pmboxq) {
1788		rc = -ENOMEM;
1789		goto loopback_mode_exit;
1790	}
1791	memset((void *)pmboxq, 0, sizeof(LPFC_MBOXQ_t));
1792	pmboxq->u.mb.mbxCommand = MBX_DOWN_LINK;
1793	pmboxq->u.mb.mbxOwner = OWN_HOST;
1794
1795	mbxstatus = lpfc_sli_issue_mbox_wait(phba, pmboxq, LPFC_MBOX_TMO);
1796
1797	if ((mbxstatus == MBX_SUCCESS) && (pmboxq->u.mb.mbxStatus == 0)) {
1798		/* wait for link down before proceeding */
1799		i = 0;
1800		while (phba->link_state != LPFC_LINK_DOWN) {
1801			if (i++ > timeout) {
1802				rc = -ETIMEDOUT;
1803				goto loopback_mode_exit;
1804			}
1805			msleep(10);
1806		}
1807
1808		memset((void *)pmboxq, 0, sizeof(LPFC_MBOXQ_t));
1809		if (link_flags == INTERNAL_LOOP_BACK)
1810			pmboxq->u.mb.un.varInitLnk.link_flags = FLAGS_LOCAL_LB;
1811		else
1812			pmboxq->u.mb.un.varInitLnk.link_flags =
1813				FLAGS_TOPOLOGY_MODE_LOOP;
1814
1815		pmboxq->u.mb.mbxCommand = MBX_INIT_LINK;
1816		pmboxq->u.mb.mbxOwner = OWN_HOST;
1817
1818		mbxstatus = lpfc_sli_issue_mbox_wait(phba, pmboxq,
1819						     LPFC_MBOX_TMO);
1820
1821		if ((mbxstatus != MBX_SUCCESS) || (pmboxq->u.mb.mbxStatus))
1822			rc = -ENODEV;
1823		else {
1824			spin_lock_irq(&phba->hbalock);
1825			phba->link_flag |= LS_LOOPBACK_MODE;
1826			spin_unlock_irq(&phba->hbalock);
1827			/* wait for the link attention interrupt */
1828			msleep(100);
1829
1830			i = 0;
1831			while (phba->link_state != LPFC_HBA_READY) {
1832				if (i++ > timeout) {
1833					rc = -ETIMEDOUT;
1834					break;
1835				}
1836
1837				msleep(10);
1838			}
1839		}
1840
1841	} else
1842		rc = -ENODEV;
1843
1844loopback_mode_exit:
1845	lpfc_bsg_diag_mode_exit(phba);
1846
1847	/*
1848	 * Let SLI layer release mboxq if mbox command completed after timeout.
1849	 */
1850	if (pmboxq && mbxstatus != MBX_TIMEOUT)
1851		mempool_free(pmboxq, phba->mbox_mem_pool);
1852
1853job_error:
1854	/* make error code available to userspace */
1855	bsg_reply->result = rc;
1856	/* complete the job back to userspace if no error */
1857	if (rc == 0)
1858		bsg_job_done(job, bsg_reply->result,
1859			       bsg_reply->reply_payload_rcv_len);
1860	return rc;
1861}
1862
1863/**
1864 * lpfc_sli4_bsg_set_link_diag_state - set sli4 link diag state
1865 * @phba: Pointer to HBA context object.
1866 * @diag: Flag for set link to diag or nomral operation state.
1867 *
1868 * This function is responsible for issuing a sli4 mailbox command for setting
1869 * link to either diag state or normal operation state.
1870 */
1871static int
1872lpfc_sli4_bsg_set_link_diag_state(struct lpfc_hba *phba, uint32_t diag)
1873{
1874	LPFC_MBOXQ_t *pmboxq;
1875	struct lpfc_mbx_set_link_diag_state *link_diag_state;
1876	uint32_t req_len, alloc_len;
1877	int mbxstatus = MBX_SUCCESS, rc;
1878
1879	pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
1880	if (!pmboxq)
1881		return -ENOMEM;
1882
1883	req_len = (sizeof(struct lpfc_mbx_set_link_diag_state) -
1884		   sizeof(struct lpfc_sli4_cfg_mhdr));
1885	alloc_len = lpfc_sli4_config(phba, pmboxq, LPFC_MBOX_SUBSYSTEM_FCOE,
1886				LPFC_MBOX_OPCODE_FCOE_LINK_DIAG_STATE,
1887				req_len, LPFC_SLI4_MBX_EMBED);
1888	if (alloc_len != req_len) {
1889		rc = -ENOMEM;
1890		goto link_diag_state_set_out;
1891	}
1892	lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
1893			"3128 Set link to diagnostic state:x%x (x%x/x%x)\n",
1894			diag, phba->sli4_hba.lnk_info.lnk_tp,
1895			phba->sli4_hba.lnk_info.lnk_no);
1896
1897	link_diag_state = &pmboxq->u.mqe.un.link_diag_state;
1898	bf_set(lpfc_mbx_set_diag_state_diag_bit_valid, &link_diag_state->u.req,
1899	       LPFC_DIAG_STATE_DIAG_BIT_VALID_CHANGE);
1900	bf_set(lpfc_mbx_set_diag_state_link_num, &link_diag_state->u.req,
1901	       phba->sli4_hba.lnk_info.lnk_no);
1902	bf_set(lpfc_mbx_set_diag_state_link_type, &link_diag_state->u.req,
1903	       phba->sli4_hba.lnk_info.lnk_tp);
1904	if (diag)
1905		bf_set(lpfc_mbx_set_diag_state_diag,
1906		       &link_diag_state->u.req, 1);
1907	else
1908		bf_set(lpfc_mbx_set_diag_state_diag,
1909		       &link_diag_state->u.req, 0);
1910
1911	mbxstatus = lpfc_sli_issue_mbox_wait(phba, pmboxq, LPFC_MBOX_TMO);
1912
1913	if ((mbxstatus == MBX_SUCCESS) && (pmboxq->u.mb.mbxStatus == 0))
1914		rc = 0;
1915	else
1916		rc = -ENODEV;
1917
1918link_diag_state_set_out:
1919	if (pmboxq && (mbxstatus != MBX_TIMEOUT))
1920		mempool_free(pmboxq, phba->mbox_mem_pool);
1921
1922	return rc;
1923}
1924
1925/**
1926 * lpfc_sli4_bsg_set_loopback_mode - set sli4 internal loopback diagnostic
1927 * @phba: Pointer to HBA context object.
1928 * @mode: loopback mode to set
1929 * @link_no: link number for loopback mode to set
1930 *
1931 * This function is responsible for issuing a sli4 mailbox command for setting
1932 * up loopback diagnostic for a link.
1933 */
1934static int
1935lpfc_sli4_bsg_set_loopback_mode(struct lpfc_hba *phba, int mode,
1936				uint32_t link_no)
1937{
1938	LPFC_MBOXQ_t *pmboxq;
1939	uint32_t req_len, alloc_len;
1940	struct lpfc_mbx_set_link_diag_loopback *link_diag_loopback;
1941	int mbxstatus = MBX_SUCCESS, rc = 0;
1942
1943	pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
1944	if (!pmboxq)
1945		return -ENOMEM;
1946	req_len = (sizeof(struct lpfc_mbx_set_link_diag_loopback) -
1947		   sizeof(struct lpfc_sli4_cfg_mhdr));
1948	alloc_len = lpfc_sli4_config(phba, pmboxq, LPFC_MBOX_SUBSYSTEM_FCOE,
1949				LPFC_MBOX_OPCODE_FCOE_LINK_DIAG_LOOPBACK,
1950				req_len, LPFC_SLI4_MBX_EMBED);
1951	if (alloc_len != req_len) {
1952		mempool_free(pmboxq, phba->mbox_mem_pool);
1953		return -ENOMEM;
1954	}
1955	link_diag_loopback = &pmboxq->u.mqe.un.link_diag_loopback;
1956	bf_set(lpfc_mbx_set_diag_state_link_num,
1957	       &link_diag_loopback->u.req, link_no);
1958
1959	if (phba->sli4_hba.conf_trunk & (1 << link_no)) {
1960		bf_set(lpfc_mbx_set_diag_state_link_type,
1961		       &link_diag_loopback->u.req, LPFC_LNK_FC_TRUNKED);
1962	} else {
1963		bf_set(lpfc_mbx_set_diag_state_link_type,
1964		       &link_diag_loopback->u.req,
1965		       phba->sli4_hba.lnk_info.lnk_tp);
1966	}
1967
1968	bf_set(lpfc_mbx_set_diag_lpbk_type, &link_diag_loopback->u.req,
1969	       mode);
1970
1971	mbxstatus = lpfc_sli_issue_mbox_wait(phba, pmboxq, LPFC_MBOX_TMO);
1972	if ((mbxstatus != MBX_SUCCESS) || (pmboxq->u.mb.mbxStatus)) {
1973		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1974				"3127 Failed setup loopback mode mailbox "
1975				"command, rc:x%x, status:x%x\n", mbxstatus,
1976				pmboxq->u.mb.mbxStatus);
1977		rc = -ENODEV;
1978	}
1979	if (pmboxq && (mbxstatus != MBX_TIMEOUT))
1980		mempool_free(pmboxq, phba->mbox_mem_pool);
1981	return rc;
1982}
1983
1984/**
1985 * lpfc_sli4_diag_fcport_reg_setup - setup port registrations for diagnostic
1986 * @phba: Pointer to HBA context object.
1987 *
1988 * This function set up SLI4 FC port registrations for diagnostic run, which
1989 * includes all the rpis, vfi, and also vpi.
1990 */
1991static int
1992lpfc_sli4_diag_fcport_reg_setup(struct lpfc_hba *phba)
1993{
1994	if (test_bit(FC_VFI_REGISTERED, &phba->pport->fc_flag)) {
1995		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1996				"3136 Port still had vfi registered: "
1997				"mydid:x%x, fcfi:%d, vfi:%d, vpi:%d\n",
1998				phba->pport->fc_myDID, phba->fcf.fcfi,
1999				phba->sli4_hba.vfi_ids[phba->pport->vfi],
2000				phba->vpi_ids[phba->pport->vpi]);
2001		return -EINVAL;
2002	}
2003	return lpfc_issue_reg_vfi(phba->pport);
2004}
2005
2006/**
2007 * lpfc_sli4_bsg_diag_loopback_mode - process an sli4 bsg vendor command
2008 * @phba: Pointer to HBA context object.
2009 * @job: LPFC_BSG_VENDOR_DIAG_MODE
2010 *
2011 * This function is responsible for placing an sli4 port into diagnostic
2012 * loopback mode in order to perform a diagnostic loopback test.
2013 */
2014static int
2015lpfc_sli4_bsg_diag_loopback_mode(struct lpfc_hba *phba, struct bsg_job *job)
2016{
2017	struct fc_bsg_request *bsg_request = job->request;
2018	struct fc_bsg_reply *bsg_reply = job->reply;
2019	struct diag_mode_set *loopback_mode;
2020	uint32_t link_flags, timeout, link_no;
2021	int i, rc = 0;
2022
2023	/* no data to return just the return code */
2024	bsg_reply->reply_payload_rcv_len = 0;
2025
2026	if (job->request_len < sizeof(struct fc_bsg_request) +
2027	    sizeof(struct diag_mode_set)) {
2028		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2029				"3011 Received DIAG MODE request size:%d "
2030				"below the minimum size:%d\n",
2031				job->request_len,
2032				(int)(sizeof(struct fc_bsg_request) +
2033				sizeof(struct diag_mode_set)));
2034		rc = -EINVAL;
2035		goto job_done;
2036	}
2037
2038	loopback_mode = (struct diag_mode_set *)
2039		bsg_request->rqst_data.h_vendor.vendor_cmd;
2040	link_flags = loopback_mode->type;
2041	timeout = loopback_mode->timeout * 100;
2042
2043	if (loopback_mode->physical_link == -1)
2044		link_no = phba->sli4_hba.lnk_info.lnk_no;
2045	else
2046		link_no = loopback_mode->physical_link;
2047
2048	if (link_flags == DISABLE_LOOP_BACK) {
2049		rc = lpfc_sli4_bsg_set_loopback_mode(phba,
2050					LPFC_DIAG_LOOPBACK_TYPE_DISABLE,
2051					link_no);
2052		if (!rc) {
2053			/* Unset the need disable bit */
2054			phba->sli4_hba.conf_trunk &= ~((1 << link_no) << 4);
2055		}
2056		goto job_done;
2057	} else {
2058		/* Check if we need to disable the loopback state */
2059		if (phba->sli4_hba.conf_trunk & ((1 << link_no) << 4)) {
2060			rc = -EPERM;
2061			goto job_done;
2062		}
2063	}
2064
2065	rc = lpfc_bsg_diag_mode_enter(phba);
2066	if (rc)
2067		goto job_done;
2068
2069	/* indicate we are in loobpack diagnostic mode */
2070	spin_lock_irq(&phba->hbalock);
2071	phba->link_flag |= LS_LOOPBACK_MODE;
2072	spin_unlock_irq(&phba->hbalock);
2073
2074	/* reset port to start frome scratch */
2075	rc = lpfc_selective_reset(phba);
2076	if (rc)
2077		goto job_done;
2078
2079	/* bring the link to diagnostic mode */
2080	lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
2081			"3129 Bring link to diagnostic state.\n");
2082
2083	rc = lpfc_sli4_bsg_set_link_diag_state(phba, 1);
2084	if (rc) {
2085		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2086				"3130 Failed to bring link to diagnostic "
2087				"state, rc:x%x\n", rc);
2088		goto loopback_mode_exit;
2089	}
2090
2091	/* wait for link down before proceeding */
2092	i = 0;
2093	while (phba->link_state != LPFC_LINK_DOWN) {
2094		if (i++ > timeout) {
2095			rc = -ETIMEDOUT;
2096			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
2097					"3131 Timeout waiting for link to "
2098					"diagnostic mode, timeout:%d ms\n",
2099					timeout * 10);
2100			goto loopback_mode_exit;
2101		}
2102		msleep(10);
2103	}
2104
2105	/* set up loopback mode */
2106	lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
2107			"3132 Set up loopback mode:x%x\n", link_flags);
2108
2109	switch (link_flags) {
2110	case INTERNAL_LOOP_BACK:
2111		if (phba->sli4_hba.conf_trunk & (1 << link_no)) {
2112			rc = lpfc_sli4_bsg_set_loopback_mode(phba,
2113					LPFC_DIAG_LOOPBACK_TYPE_INTERNAL,
2114					link_no);
2115		} else {
2116			/* Trunk is configured, but link is not in this trunk */
2117			if (phba->sli4_hba.conf_trunk) {
2118				rc = -ELNRNG;
2119				goto loopback_mode_exit;
2120			}
2121
2122			rc = lpfc_sli4_bsg_set_loopback_mode(phba,
2123					LPFC_DIAG_LOOPBACK_TYPE_INTERNAL,
2124					link_no);
2125		}
2126
2127		if (!rc) {
2128			/* Set the need disable bit */
2129			phba->sli4_hba.conf_trunk |= (1 << link_no) << 4;
2130		}
2131
2132		break;
2133	case EXTERNAL_LOOP_BACK:
2134		if (phba->sli4_hba.conf_trunk & (1 << link_no)) {
2135			rc = lpfc_sli4_bsg_set_loopback_mode(phba,
2136				LPFC_DIAG_LOOPBACK_TYPE_EXTERNAL_TRUNKED,
2137				link_no);
2138		} else {
2139			/* Trunk is configured, but link is not in this trunk */
2140			if (phba->sli4_hba.conf_trunk) {
2141				rc = -ELNRNG;
2142				goto loopback_mode_exit;
2143			}
2144
2145			rc = lpfc_sli4_bsg_set_loopback_mode(phba,
2146						LPFC_DIAG_LOOPBACK_TYPE_SERDES,
2147						link_no);
2148		}
2149
2150		if (!rc) {
2151			/* Set the need disable bit */
2152			phba->sli4_hba.conf_trunk |= (1 << link_no) << 4;
2153		}
2154
2155		break;
2156	default:
2157		rc = -EINVAL;
2158		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
2159				"3141 Loopback mode:x%x not supported\n",
2160				link_flags);
2161		goto loopback_mode_exit;
2162	}
2163
2164	if (!rc) {
2165		/* wait for the link attention interrupt */
2166		msleep(100);
2167		i = 0;
2168		while (phba->link_state < LPFC_LINK_UP) {
2169			if (i++ > timeout) {
2170				rc = -ETIMEDOUT;
2171				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
2172					"3137 Timeout waiting for link up "
2173					"in loopback mode, timeout:%d ms\n",
2174					timeout * 10);
2175				break;
2176			}
2177			msleep(10);
2178		}
2179	}
2180
2181	/* port resource registration setup for loopback diagnostic */
2182	if (!rc) {
2183		/* set up a none zero myDID for loopback test */
2184		phba->pport->fc_myDID = 1;
2185		rc = lpfc_sli4_diag_fcport_reg_setup(phba);
2186	} else
2187		goto loopback_mode_exit;
2188
2189	if (!rc) {
2190		/* wait for the port ready */
2191		msleep(100);
2192		i = 0;
2193		while (phba->link_state != LPFC_HBA_READY) {
2194			if (i++ > timeout) {
2195				rc = -ETIMEDOUT;
2196				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
2197					"3133 Timeout waiting for port "
2198					"loopback mode ready, timeout:%d ms\n",
2199					timeout * 10);
2200				break;
2201			}
2202			msleep(10);
2203		}
2204	}
2205
2206loopback_mode_exit:
2207	/* clear loopback diagnostic mode */
2208	if (rc) {
2209		spin_lock_irq(&phba->hbalock);
2210		phba->link_flag &= ~LS_LOOPBACK_MODE;
2211		spin_unlock_irq(&phba->hbalock);
2212	}
2213	lpfc_bsg_diag_mode_exit(phba);
2214
2215job_done:
2216	/* make error code available to userspace */
2217	bsg_reply->result = rc;
2218	/* complete the job back to userspace if no error */
2219	if (rc == 0)
2220		bsg_job_done(job, bsg_reply->result,
2221			       bsg_reply->reply_payload_rcv_len);
2222	return rc;
2223}
2224
2225/**
2226 * lpfc_bsg_diag_loopback_mode - bsg vendor command for diag loopback mode
2227 * @job: LPFC_BSG_VENDOR_DIAG_MODE
2228 *
2229 * This function is responsible for responding to check and dispatch bsg diag
2230 * command from the user to proper driver action routines.
2231 */
2232static int
2233lpfc_bsg_diag_loopback_mode(struct bsg_job *job)
2234{
2235	struct Scsi_Host *shost;
2236	struct lpfc_vport *vport;
2237	struct lpfc_hba *phba;
2238	int rc;
2239
2240	shost = fc_bsg_to_shost(job);
2241	if (!shost)
2242		return -ENODEV;
2243	vport = shost_priv(shost);
2244	if (!vport)
2245		return -ENODEV;
2246	phba = vport->phba;
2247	if (!phba)
2248		return -ENODEV;
2249
2250	if (phba->sli_rev < LPFC_SLI_REV4)
2251		rc = lpfc_sli3_bsg_diag_loopback_mode(phba, job);
2252	else if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) >=
2253		 LPFC_SLI_INTF_IF_TYPE_2)
2254		rc = lpfc_sli4_bsg_diag_loopback_mode(phba, job);
2255	else
2256		rc = -ENODEV;
2257
2258	return rc;
2259}
2260
2261/**
2262 * lpfc_sli4_bsg_diag_mode_end - sli4 bsg vendor command for ending diag mode
2263 * @job: LPFC_BSG_VENDOR_DIAG_MODE_END
2264 *
2265 * This function is responsible for responding to check and dispatch bsg diag
2266 * command from the user to proper driver action routines.
2267 */
2268static int
2269lpfc_sli4_bsg_diag_mode_end(struct bsg_job *job)
2270{
2271	struct fc_bsg_request *bsg_request = job->request;
2272	struct fc_bsg_reply *bsg_reply = job->reply;
2273	struct Scsi_Host *shost;
2274	struct lpfc_vport *vport;
2275	struct lpfc_hba *phba;
2276	struct diag_mode_set *loopback_mode_end_cmd;
2277	uint32_t timeout;
2278	int rc, i;
2279
2280	shost = fc_bsg_to_shost(job);
2281	if (!shost)
2282		return -ENODEV;
2283	vport = shost_priv(shost);
2284	if (!vport)
2285		return -ENODEV;
2286	phba = vport->phba;
2287	if (!phba)
2288		return -ENODEV;
2289
2290	if (phba->sli_rev < LPFC_SLI_REV4)
2291		return -ENODEV;
2292	if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) <
2293	    LPFC_SLI_INTF_IF_TYPE_2)
2294		return -ENODEV;
2295
2296	/* clear loopback diagnostic mode */
2297	spin_lock_irq(&phba->hbalock);
2298	phba->link_flag &= ~LS_LOOPBACK_MODE;
2299	spin_unlock_irq(&phba->hbalock);
2300	loopback_mode_end_cmd = (struct diag_mode_set *)
2301			bsg_request->rqst_data.h_vendor.vendor_cmd;
2302	timeout = loopback_mode_end_cmd->timeout * 100;
2303
2304	rc = lpfc_sli4_bsg_set_link_diag_state(phba, 0);
2305	if (rc) {
2306		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2307				"3139 Failed to bring link to diagnostic "
2308				"state, rc:x%x\n", rc);
2309		goto loopback_mode_end_exit;
2310	}
2311
2312	/* wait for link down before proceeding */
2313	i = 0;
2314	while (phba->link_state != LPFC_LINK_DOWN) {
2315		if (i++ > timeout) {
2316			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
2317					"3140 Timeout waiting for link to "
2318					"diagnostic mode_end, timeout:%d ms\n",
2319					timeout * 10);
2320			/* there is nothing much we can do here */
2321			break;
2322		}
2323		msleep(10);
2324	}
2325
2326	/* reset port resource registrations */
2327	rc = lpfc_selective_reset(phba);
2328	phba->pport->fc_myDID = 0;
2329
2330loopback_mode_end_exit:
2331	/* make return code available to userspace */
2332	bsg_reply->result = rc;
2333	/* complete the job back to userspace if no error */
2334	if (rc == 0)
2335		bsg_job_done(job, bsg_reply->result,
2336			       bsg_reply->reply_payload_rcv_len);
2337	return rc;
2338}
2339
2340/**
2341 * lpfc_sli4_bsg_link_diag_test - sli4 bsg vendor command for diag link test
2342 * @job: LPFC_BSG_VENDOR_DIAG_LINK_TEST
2343 *
2344 * This function is to perform SLI4 diag link test request from the user
2345 * applicaiton.
2346 */
2347static int
2348lpfc_sli4_bsg_link_diag_test(struct bsg_job *job)
2349{
2350	struct fc_bsg_request *bsg_request = job->request;
2351	struct fc_bsg_reply *bsg_reply = job->reply;
2352	struct Scsi_Host *shost;
2353	struct lpfc_vport *vport;
2354	struct lpfc_hba *phba;
2355	LPFC_MBOXQ_t *pmboxq;
2356	struct sli4_link_diag *link_diag_test_cmd;
2357	uint32_t req_len, alloc_len;
2358	struct lpfc_mbx_run_link_diag_test *run_link_diag_test;
2359	union lpfc_sli4_cfg_shdr *shdr;
2360	uint32_t shdr_status, shdr_add_status;
2361	struct diag_status *diag_status_reply;
2362	int mbxstatus, rc = -ENODEV, rc1 = 0;
2363
2364	shost = fc_bsg_to_shost(job);
2365	if (!shost)
2366		goto job_error;
2367
2368	vport = shost_priv(shost);
2369	if (!vport)
2370		goto job_error;
2371
2372	phba = vport->phba;
2373	if (!phba)
2374		goto job_error;
2375
2376
2377	if (phba->sli_rev < LPFC_SLI_REV4)
2378		goto job_error;
2379
2380	if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) <
2381	    LPFC_SLI_INTF_IF_TYPE_2)
2382		goto job_error;
2383
2384	if (job->request_len < sizeof(struct fc_bsg_request) +
2385	    sizeof(struct sli4_link_diag)) {
2386		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2387				"3013 Received LINK DIAG TEST request "
2388				" size:%d below the minimum size:%d\n",
2389				job->request_len,
2390				(int)(sizeof(struct fc_bsg_request) +
2391				sizeof(struct sli4_link_diag)));
2392		rc = -EINVAL;
2393		goto job_error;
2394	}
2395
2396	rc = lpfc_bsg_diag_mode_enter(phba);
2397	if (rc)
2398		goto job_error;
2399
2400	link_diag_test_cmd = (struct sli4_link_diag *)
2401			 bsg_request->rqst_data.h_vendor.vendor_cmd;
2402
2403	rc = lpfc_sli4_bsg_set_link_diag_state(phba, 1);
2404
2405	if (rc)
2406		goto job_error;
2407
2408	pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
2409	if (!pmboxq) {
2410		rc = -ENOMEM;
2411		goto link_diag_test_exit;
2412	}
2413
2414	req_len = (sizeof(struct lpfc_mbx_set_link_diag_state) -
2415		   sizeof(struct lpfc_sli4_cfg_mhdr));
2416	alloc_len = lpfc_sli4_config(phba, pmboxq, LPFC_MBOX_SUBSYSTEM_FCOE,
2417				     LPFC_MBOX_OPCODE_FCOE_LINK_DIAG_STATE,
2418				     req_len, LPFC_SLI4_MBX_EMBED);
2419	if (alloc_len != req_len) {
2420		rc = -ENOMEM;
2421		goto link_diag_test_exit;
2422	}
2423
2424	run_link_diag_test = &pmboxq->u.mqe.un.link_diag_test;
2425	bf_set(lpfc_mbx_run_diag_test_link_num, &run_link_diag_test->u.req,
2426	       phba->sli4_hba.lnk_info.lnk_no);
2427	bf_set(lpfc_mbx_run_diag_test_link_type, &run_link_diag_test->u.req,
2428	       phba->sli4_hba.lnk_info.lnk_tp);
2429	bf_set(lpfc_mbx_run_diag_test_test_id, &run_link_diag_test->u.req,
2430	       link_diag_test_cmd->test_id);
2431	bf_set(lpfc_mbx_run_diag_test_loops, &run_link_diag_test->u.req,
2432	       link_diag_test_cmd->loops);
2433	bf_set(lpfc_mbx_run_diag_test_test_ver, &run_link_diag_test->u.req,
2434	       link_diag_test_cmd->test_version);
2435	bf_set(lpfc_mbx_run_diag_test_err_act, &run_link_diag_test->u.req,
2436	       link_diag_test_cmd->error_action);
2437
2438	mbxstatus = lpfc_sli_issue_mbox(phba, pmboxq, MBX_POLL);
2439
2440	shdr = (union lpfc_sli4_cfg_shdr *)
2441		&pmboxq->u.mqe.un.sli4_config.header.cfg_shdr;
2442	shdr_status = bf_get(lpfc_mbox_hdr_status, &shdr->response);
2443	shdr_add_status = bf_get(lpfc_mbox_hdr_add_status, &shdr->response);
2444	if (shdr_status || shdr_add_status || mbxstatus) {
2445		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
2446				"3010 Run link diag test mailbox failed with "
2447				"mbx_status x%x status x%x, add_status x%x\n",
2448				mbxstatus, shdr_status, shdr_add_status);
2449	}
2450
2451	diag_status_reply = (struct diag_status *)
2452			    bsg_reply->reply_data.vendor_reply.vendor_rsp;
2453
2454	if (job->reply_len < sizeof(*bsg_reply) + sizeof(*diag_status_reply)) {
2455		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2456				"3012 Received Run link diag test reply "
2457				"below minimum size (%d): reply_len:%d\n",
2458				(int)(sizeof(*bsg_reply) +
2459				sizeof(*diag_status_reply)),
2460				job->reply_len);
2461		rc = -EINVAL;
2462		goto job_error;
2463	}
2464
2465	diag_status_reply->mbox_status = mbxstatus;
2466	diag_status_reply->shdr_status = shdr_status;
2467	diag_status_reply->shdr_add_status = shdr_add_status;
2468
2469link_diag_test_exit:
2470	rc1 = lpfc_sli4_bsg_set_link_diag_state(phba, 0);
2471
2472	if (pmboxq)
2473		mempool_free(pmboxq, phba->mbox_mem_pool);
2474
2475	lpfc_bsg_diag_mode_exit(phba);
2476
2477job_error:
2478	/* make error code available to userspace */
2479	if (rc1 && !rc)
2480		rc = rc1;
2481	bsg_reply->result = rc;
2482	/* complete the job back to userspace if no error */
2483	if (rc == 0)
2484		bsg_job_done(job, bsg_reply->result,
2485			       bsg_reply->reply_payload_rcv_len);
2486	return rc;
2487}
2488
2489/**
2490 * lpfcdiag_loop_self_reg - obtains a remote port login id
2491 * @phba: Pointer to HBA context object
2492 * @rpi: Pointer to a remote port login id
2493 *
2494 * This function obtains a remote port login id so the diag loopback test
2495 * can send and receive its own unsolicited CT command.
2496 **/
2497static int lpfcdiag_loop_self_reg(struct lpfc_hba *phba, uint16_t *rpi)
2498{
2499	LPFC_MBOXQ_t *mbox;
2500	struct lpfc_dmabuf *dmabuff;
2501	int status;
2502
2503	mbox = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
2504	if (!mbox)
2505		return -ENOMEM;
2506
2507	if (phba->sli_rev < LPFC_SLI_REV4)
2508		status = lpfc_reg_rpi(phba, 0, phba->pport->fc_myDID,
2509				(uint8_t *)&phba->pport->fc_sparam,
2510				mbox, *rpi);
2511	else {
2512		*rpi = lpfc_sli4_alloc_rpi(phba);
2513		if (*rpi == LPFC_RPI_ALLOC_ERROR) {
2514			mempool_free(mbox, phba->mbox_mem_pool);
2515			return -EBUSY;
2516		}
2517		status = lpfc_reg_rpi(phba, phba->pport->vpi,
2518				phba->pport->fc_myDID,
2519				(uint8_t *)&phba->pport->fc_sparam,
2520				mbox, *rpi);
2521	}
2522
2523	if (status) {
2524		mempool_free(mbox, phba->mbox_mem_pool);
2525		if (phba->sli_rev == LPFC_SLI_REV4)
2526			lpfc_sli4_free_rpi(phba, *rpi);
2527		return -ENOMEM;
2528	}
2529
2530	dmabuff = mbox->ctx_buf;
2531	mbox->ctx_buf = NULL;
2532	mbox->ctx_ndlp = NULL;
2533	status = lpfc_sli_issue_mbox_wait(phba, mbox, LPFC_MBOX_TMO);
2534
2535	if ((status != MBX_SUCCESS) || (mbox->u.mb.mbxStatus)) {
2536		lpfc_mbuf_free(phba, dmabuff->virt, dmabuff->phys);
2537		kfree(dmabuff);
2538		if (status != MBX_TIMEOUT)
2539			mempool_free(mbox, phba->mbox_mem_pool);
2540		if (phba->sli_rev == LPFC_SLI_REV4)
2541			lpfc_sli4_free_rpi(phba, *rpi);
2542		return -ENODEV;
2543	}
2544
2545	if (phba->sli_rev < LPFC_SLI_REV4)
2546		*rpi = mbox->u.mb.un.varWords[0];
2547
2548	lpfc_mbuf_free(phba, dmabuff->virt, dmabuff->phys);
2549	kfree(dmabuff);
2550	mempool_free(mbox, phba->mbox_mem_pool);
2551	return 0;
2552}
2553
2554/**
2555 * lpfcdiag_loop_self_unreg - unregs from the rpi
2556 * @phba: Pointer to HBA context object
2557 * @rpi: Remote port login id
2558 *
2559 * This function unregisters the rpi obtained in lpfcdiag_loop_self_reg
2560 **/
2561static int lpfcdiag_loop_self_unreg(struct lpfc_hba *phba, uint16_t rpi)
2562{
2563	LPFC_MBOXQ_t *mbox;
2564	int status;
2565
2566	/* Allocate mboxq structure */
2567	mbox = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
2568	if (mbox == NULL)
2569		return -ENOMEM;
2570
2571	if (phba->sli_rev < LPFC_SLI_REV4)
2572		lpfc_unreg_login(phba, 0, rpi, mbox);
2573	else
2574		lpfc_unreg_login(phba, phba->pport->vpi,
2575				 phba->sli4_hba.rpi_ids[rpi], mbox);
2576
2577	status = lpfc_sli_issue_mbox_wait(phba, mbox, LPFC_MBOX_TMO);
2578
2579	if ((status != MBX_SUCCESS) || (mbox->u.mb.mbxStatus)) {
2580		if (status != MBX_TIMEOUT)
2581			mempool_free(mbox, phba->mbox_mem_pool);
2582		return -EIO;
2583	}
2584	mempool_free(mbox, phba->mbox_mem_pool);
2585	if (phba->sli_rev == LPFC_SLI_REV4)
2586		lpfc_sli4_free_rpi(phba, rpi);
2587	return 0;
2588}
2589
2590/**
2591 * lpfcdiag_loop_get_xri - obtains the transmit and receive ids
2592 * @phba: Pointer to HBA context object
2593 * @rpi: Remote port login id
2594 * @txxri: Pointer to transmit exchange id
2595 * @rxxri: Pointer to response exchabge id
2596 *
2597 * This function obtains the transmit and receive ids required to send
2598 * an unsolicited ct command with a payload. A special lpfc FsType and CmdRsp
2599 * flags are used to the unsolicited response handler is able to process
2600 * the ct command sent on the same port.
2601 **/
2602static int lpfcdiag_loop_get_xri(struct lpfc_hba *phba, uint16_t rpi,
2603			 uint16_t *txxri, uint16_t * rxxri)
2604{
2605	struct lpfc_bsg_event *evt;
2606	struct lpfc_iocbq *cmdiocbq, *rspiocbq;
2607	struct lpfc_dmabuf *dmabuf;
2608	struct ulp_bde64 *bpl = NULL;
2609	struct lpfc_sli_ct_request *ctreq = NULL;
2610	int ret_val = 0;
2611	int time_left;
2612	int iocb_stat = IOCB_SUCCESS;
2613	unsigned long flags;
2614	u32 status;
2615
2616	*txxri = 0;
2617	*rxxri = 0;
2618	evt = lpfc_bsg_event_new(FC_REG_CT_EVENT, current->pid,
2619				SLI_CT_ELX_LOOPBACK);
2620	if (!evt)
2621		return -ENOMEM;
2622
2623	spin_lock_irqsave(&phba->ct_ev_lock, flags);
2624	list_add(&evt->node, &phba->ct_ev_waiters);
2625	lpfc_bsg_event_ref(evt);
2626	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
2627
2628	cmdiocbq = lpfc_sli_get_iocbq(phba);
2629	rspiocbq = lpfc_sli_get_iocbq(phba);
2630
2631	dmabuf = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
2632	if (dmabuf) {
2633		dmabuf->virt = lpfc_mbuf_alloc(phba, 0, &dmabuf->phys);
2634		if (dmabuf->virt) {
2635			INIT_LIST_HEAD(&dmabuf->list);
2636			bpl = (struct ulp_bde64 *) dmabuf->virt;
2637			memset(bpl, 0, sizeof(*bpl));
2638			ctreq = (struct lpfc_sli_ct_request *)(bpl + 1);
2639			bpl->addrHigh =
2640				le32_to_cpu(putPaddrHigh(dmabuf->phys +
2641					sizeof(*bpl)));
2642			bpl->addrLow =
2643				le32_to_cpu(putPaddrLow(dmabuf->phys +
2644					sizeof(*bpl)));
2645			bpl->tus.f.bdeFlags = 0;
2646			bpl->tus.f.bdeSize = ELX_LOOPBACK_HEADER_SZ;
2647			bpl->tus.w = le32_to_cpu(bpl->tus.w);
2648		}
2649	}
2650
2651	if (cmdiocbq == NULL || rspiocbq == NULL ||
2652	    dmabuf == NULL || bpl == NULL || ctreq == NULL ||
2653		dmabuf->virt == NULL) {
2654		ret_val = -ENOMEM;
2655		goto err_get_xri_exit;
2656	}
2657
2658	memset(ctreq, 0, ELX_LOOPBACK_HEADER_SZ);
2659
2660	ctreq->RevisionId.bits.Revision = SLI_CT_REVISION;
2661	ctreq->RevisionId.bits.InId = 0;
2662	ctreq->FsType = SLI_CT_ELX_LOOPBACK;
2663	ctreq->FsSubType = 0;
2664	ctreq->CommandResponse.bits.CmdRsp = ELX_LOOPBACK_XRI_SETUP;
2665	ctreq->CommandResponse.bits.Size = 0;
2666
2667	cmdiocbq->bpl_dmabuf = dmabuf;
2668	cmdiocbq->cmd_flag |= LPFC_IO_LIBDFC;
2669	cmdiocbq->vport = phba->pport;
2670	cmdiocbq->cmd_cmpl = NULL;
2671
2672	lpfc_sli_prep_xmit_seq64(phba, cmdiocbq, dmabuf, rpi, 0, 1,
2673				 FC_RCTL_DD_SOL_CTL, 0, CMD_XMIT_SEQUENCE64_CR);
2674
2675	iocb_stat = lpfc_sli_issue_iocb_wait(phba, LPFC_ELS_RING, cmdiocbq,
2676					     rspiocbq, (phba->fc_ratov * 2)
2677					     + LPFC_DRVR_TIMEOUT);
2678
2679	status = get_job_ulpstatus(phba, rspiocbq);
2680	if (iocb_stat != IOCB_SUCCESS || status != IOCB_SUCCESS) {
2681		ret_val = -EIO;
2682		goto err_get_xri_exit;
2683	}
2684	*txxri = get_job_ulpcontext(phba, rspiocbq);
2685
2686	evt->waiting = 1;
2687	evt->wait_time_stamp = jiffies;
2688	time_left = wait_event_interruptible_timeout(
2689		evt->wq, !list_empty(&evt->events_to_see),
2690		secs_to_jiffies(phba->fc_ratov * 2 + LPFC_DRVR_TIMEOUT));
2691	if (list_empty(&evt->events_to_see))
2692		ret_val = (time_left) ? -EINTR : -ETIMEDOUT;
2693	else {
2694		spin_lock_irqsave(&phba->ct_ev_lock, flags);
2695		list_move(evt->events_to_see.prev, &evt->events_to_get);
2696		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
2697		*rxxri = (list_entry(evt->events_to_get.prev,
2698				     typeof(struct event_data),
2699				     node))->immed_dat;
2700	}
2701	evt->waiting = 0;
2702
2703err_get_xri_exit:
2704	spin_lock_irqsave(&phba->ct_ev_lock, flags);
2705	lpfc_bsg_event_unref(evt); /* release ref */
2706	lpfc_bsg_event_unref(evt); /* delete */
2707	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
2708
2709	if (dmabuf) {
2710		if (dmabuf->virt)
2711			lpfc_mbuf_free(phba, dmabuf->virt, dmabuf->phys);
2712		kfree(dmabuf);
2713	}
2714
2715	if (cmdiocbq && (iocb_stat != IOCB_TIMEDOUT))
2716		lpfc_sli_release_iocbq(phba, cmdiocbq);
2717	if (rspiocbq)
2718		lpfc_sli_release_iocbq(phba, rspiocbq);
2719	return ret_val;
2720}
2721
2722/**
2723 * lpfc_bsg_dma_page_alloc - allocate a bsg mbox page sized dma buffers
2724 * @phba: Pointer to HBA context object
2725 *
2726 * This function allocates BSG_MBOX_SIZE (4KB) page size dma buffer and
2727 * returns the pointer to the buffer.
2728 **/
2729static struct lpfc_dmabuf *
2730lpfc_bsg_dma_page_alloc(struct lpfc_hba *phba)
2731{
2732	struct lpfc_dmabuf *dmabuf;
2733	struct pci_dev *pcidev = phba->pcidev;
2734
2735	/* allocate dma buffer struct */
2736	dmabuf = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
2737	if (!dmabuf)
2738		return NULL;
2739
2740	INIT_LIST_HEAD(&dmabuf->list);
2741
2742	/* now, allocate dma buffer */
2743	dmabuf->virt = dma_alloc_coherent(&pcidev->dev, BSG_MBOX_SIZE,
2744					  &(dmabuf->phys), GFP_KERNEL);
2745
2746	if (!dmabuf->virt) {
2747		kfree(dmabuf);
2748		return NULL;
2749	}
2750
2751	return dmabuf;
2752}
2753
2754/**
2755 * lpfc_bsg_dma_page_free - free a bsg mbox page sized dma buffer
2756 * @phba: Pointer to HBA context object.
2757 * @dmabuf: Pointer to the bsg mbox page sized dma buffer descriptor.
2758 *
2759 * This routine just simply frees a dma buffer and its associated buffer
2760 * descriptor referred by @dmabuf.
2761 **/
2762static void
2763lpfc_bsg_dma_page_free(struct lpfc_hba *phba, struct lpfc_dmabuf *dmabuf)
2764{
2765	struct pci_dev *pcidev = phba->pcidev;
2766
2767	if (!dmabuf)
2768		return;
2769
2770	if (dmabuf->virt)
2771		dma_free_coherent(&pcidev->dev, BSG_MBOX_SIZE,
2772				  dmabuf->virt, dmabuf->phys);
2773	kfree(dmabuf);
2774	return;
2775}
2776
2777/**
2778 * lpfc_bsg_dma_page_list_free - free a list of bsg mbox page sized dma buffers
2779 * @phba: Pointer to HBA context object.
2780 * @dmabuf_list: Pointer to a list of bsg mbox page sized dma buffer descs.
2781 *
2782 * This routine just simply frees all dma buffers and their associated buffer
2783 * descriptors referred by @dmabuf_list.
2784 **/
2785static void
2786lpfc_bsg_dma_page_list_free(struct lpfc_hba *phba,
2787			    struct list_head *dmabuf_list)
2788{
2789	struct lpfc_dmabuf *dmabuf, *next_dmabuf;
2790
2791	if (list_empty(dmabuf_list))
2792		return;
2793
2794	list_for_each_entry_safe(dmabuf, next_dmabuf, dmabuf_list, list) {
2795		list_del_init(&dmabuf->list);
2796		lpfc_bsg_dma_page_free(phba, dmabuf);
2797	}
2798	return;
2799}
2800
2801/**
2802 * diag_cmd_data_alloc - fills in a bde struct with dma buffers
2803 * @phba: Pointer to HBA context object
2804 * @bpl: Pointer to 64 bit bde structure
2805 * @size: Number of bytes to process
2806 * @nocopydata: Flag to copy user data into the allocated buffer
2807 *
2808 * This function allocates page size buffers and populates an lpfc_dmabufext.
2809 * If allowed the user data pointed to with indataptr is copied into the kernel
2810 * memory. The chained list of page size buffers is returned.
2811 **/
2812static struct lpfc_dmabufext *
2813diag_cmd_data_alloc(struct lpfc_hba *phba,
2814		   struct ulp_bde64 *bpl, uint32_t size,
2815		   int nocopydata)
2816{
2817	struct lpfc_dmabufext *mlist = NULL;
2818	struct lpfc_dmabufext *dmp;
2819	int cnt, offset = 0, i = 0;
2820	struct pci_dev *pcidev;
2821
2822	pcidev = phba->pcidev;
2823
2824	while (size) {
2825		/* We get chunks of 4K */
2826		if (size > BUF_SZ_4K)
2827			cnt = BUF_SZ_4K;
2828		else
2829			cnt = size;
2830
2831		/* allocate struct lpfc_dmabufext buffer header */
2832		dmp = kmalloc(sizeof(struct lpfc_dmabufext), GFP_KERNEL);
2833		if (!dmp)
2834			goto out;
2835
2836		INIT_LIST_HEAD(&dmp->dma.list);
2837
2838		/* Queue it to a linked list */
2839		if (mlist)
2840			list_add_tail(&dmp->dma.list, &mlist->dma.list);
2841		else
2842			mlist = dmp;
2843
2844		/* allocate buffer */
2845		dmp->dma.virt = dma_alloc_coherent(&pcidev->dev,
2846						   cnt,
2847						   &(dmp->dma.phys),
2848						   GFP_KERNEL);
2849
2850		if (!dmp->dma.virt)
2851			goto out;
2852
2853		dmp->size = cnt;
2854
2855		if (nocopydata) {
2856			bpl->tus.f.bdeFlags = 0;
2857		} else {
2858			memset((uint8_t *)dmp->dma.virt, 0, cnt);
2859			bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64I;
2860		}
2861
2862		/* build buffer ptr list for IOCB */
2863		bpl->addrLow = le32_to_cpu(putPaddrLow(dmp->dma.phys));
2864		bpl->addrHigh = le32_to_cpu(putPaddrHigh(dmp->dma.phys));
2865		bpl->tus.f.bdeSize = (ushort) cnt;
2866		bpl->tus.w = le32_to_cpu(bpl->tus.w);
2867		bpl++;
2868
2869		i++;
2870		offset += cnt;
2871		size -= cnt;
2872	}
2873
2874	if (mlist) {
2875		mlist->flag = i;
2876		return mlist;
2877	}
2878out:
2879	diag_cmd_data_free(phba, mlist);
2880	return NULL;
2881}
2882
2883/**
2884 * lpfcdiag_sli3_loop_post_rxbufs - post the receive buffers for an unsol CT cmd
2885 * @phba: Pointer to HBA context object
2886 * @rxxri: Receive exchange id
2887 * @len: Number of data bytes
2888 *
2889 * This function allocates and posts a data buffer of sufficient size to receive
2890 * an unsolicited CT command.
2891 **/
2892static int lpfcdiag_sli3_loop_post_rxbufs(struct lpfc_hba *phba, uint16_t rxxri,
2893					  size_t len)
2894{
2895	struct lpfc_sli_ring *pring;
2896	struct lpfc_iocbq *cmdiocbq;
2897	IOCB_t *cmd = NULL;
2898	struct list_head head, *curr, *next;
2899	struct lpfc_dmabuf *rxbmp;
2900	struct lpfc_dmabuf *dmp;
2901	struct lpfc_dmabuf *mp[2] = {NULL, NULL};
2902	struct ulp_bde64 *rxbpl = NULL;
2903	uint32_t num_bde;
2904	struct lpfc_dmabufext *rxbuffer = NULL;
2905	int ret_val = 0;
2906	int iocb_stat;
2907	int i = 0;
2908
2909	pring = lpfc_phba_elsring(phba);
2910
2911	cmdiocbq = lpfc_sli_get_iocbq(phba);
2912	rxbmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
2913	if (rxbmp != NULL) {
2914		rxbmp->virt = lpfc_mbuf_alloc(phba, 0, &rxbmp->phys);
2915		if (rxbmp->virt) {
2916			INIT_LIST_HEAD(&rxbmp->list);
2917			rxbpl = (struct ulp_bde64 *) rxbmp->virt;
2918			rxbuffer = diag_cmd_data_alloc(phba, rxbpl, len, 0);
2919		}
2920	}
2921
2922	if (!cmdiocbq || !rxbmp || !rxbpl || !rxbuffer || !pring) {
2923		ret_val = -ENOMEM;
2924		goto err_post_rxbufs_exit;
2925	}
2926
2927	/* Queue buffers for the receive exchange */
2928	num_bde = (uint32_t)rxbuffer->flag;
2929	dmp = &rxbuffer->dma;
2930	cmd = &cmdiocbq->iocb;
2931	i = 0;
2932
2933	INIT_LIST_HEAD(&head);
2934	list_add_tail(&head, &dmp->list);
2935	list_for_each_safe(curr, next, &head) {
2936		mp[i] = list_entry(curr, struct lpfc_dmabuf, list);
2937		list_del(curr);
2938
2939		if (phba->sli3_options & LPFC_SLI3_HBQ_ENABLED) {
2940			mp[i]->buffer_tag = lpfc_sli_get_buffer_tag(phba);
2941			cmd->un.quexri64cx.buff.bde.addrHigh =
2942				putPaddrHigh(mp[i]->phys);
2943			cmd->un.quexri64cx.buff.bde.addrLow =
2944				putPaddrLow(mp[i]->phys);
2945			cmd->un.quexri64cx.buff.bde.tus.f.bdeSize =
2946				((struct lpfc_dmabufext *)mp[i])->size;
2947			cmd->un.quexri64cx.buff.buffer_tag = mp[i]->buffer_tag;
2948			cmd->ulpCommand = CMD_QUE_XRI64_CX;
2949			cmd->ulpPU = 0;
2950			cmd->ulpLe = 1;
2951			cmd->ulpBdeCount = 1;
2952			cmd->unsli3.que_xri64cx_ext_words.ebde_count = 0;
2953
2954		} else {
2955			cmd->un.cont64[i].addrHigh = putPaddrHigh(mp[i]->phys);
2956			cmd->un.cont64[i].addrLow = putPaddrLow(mp[i]->phys);
2957			cmd->un.cont64[i].tus.f.bdeSize =
2958				((struct lpfc_dmabufext *)mp[i])->size;
2959			cmd->ulpBdeCount = ++i;
2960
2961			if ((--num_bde > 0) && (i < 2))
2962				continue;
2963
2964			cmd->ulpCommand = CMD_QUE_XRI_BUF64_CX;
2965			cmd->ulpLe = 1;
2966		}
2967
2968		cmd->ulpClass = CLASS3;
2969		cmd->ulpContext = rxxri;
2970
2971		iocb_stat = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, cmdiocbq,
2972						0);
2973		if (iocb_stat == IOCB_ERROR) {
2974			diag_cmd_data_free(phba,
2975				(struct lpfc_dmabufext *)mp[0]);
2976			if (mp[1])
2977				diag_cmd_data_free(phba,
2978					  (struct lpfc_dmabufext *)mp[1]);
2979			dmp = list_entry(next, struct lpfc_dmabuf, list);
2980			ret_val = -EIO;
2981			goto err_post_rxbufs_exit;
2982		}
2983
2984		lpfc_sli_ringpostbuf_put(phba, pring, mp[0]);
2985		if (mp[1]) {
2986			lpfc_sli_ringpostbuf_put(phba, pring, mp[1]);
2987			mp[1] = NULL;
2988		}
2989
2990		/* The iocb was freed by lpfc_sli_issue_iocb */
2991		cmdiocbq = lpfc_sli_get_iocbq(phba);
2992		if (!cmdiocbq) {
2993			dmp = list_entry(next, struct lpfc_dmabuf, list);
2994			ret_val = -EIO;
2995			goto err_post_rxbufs_exit;
2996		}
2997		cmd = &cmdiocbq->iocb;
2998		i = 0;
2999	}
3000	list_del(&head);
3001
3002err_post_rxbufs_exit:
3003
3004	if (rxbmp) {
3005		if (rxbmp->virt)
3006			lpfc_mbuf_free(phba, rxbmp->virt, rxbmp->phys);
3007		kfree(rxbmp);
3008	}
3009
3010	if (cmdiocbq)
3011		lpfc_sli_release_iocbq(phba, cmdiocbq);
3012	return ret_val;
3013}
3014
3015/**
3016 * lpfc_bsg_diag_loopback_run - run loopback on a port by issue ct cmd to itself
3017 * @job: LPFC_BSG_VENDOR_DIAG_TEST fc_bsg_job
3018 *
3019 * This function receives a user data buffer to be transmitted and received on
3020 * the same port, the link must be up and in loopback mode prior
3021 * to being called.
3022 * 1. A kernel buffer is allocated to copy the user data into.
3023 * 2. The port registers with "itself".
3024 * 3. The transmit and receive exchange ids are obtained.
3025 * 4. The receive exchange id is posted.
3026 * 5. A new els loopback event is created.
3027 * 6. The command and response iocbs are allocated.
3028 * 7. The cmd iocb FsType is set to elx loopback and the CmdRsp to looppback.
3029 *
3030 * This function is meant to be called n times while the port is in loopback
3031 * so it is the apps responsibility to issue a reset to take the port out
3032 * of loopback mode.
3033 **/
3034static int
3035lpfc_bsg_diag_loopback_run(struct bsg_job *job)
3036{
3037	struct lpfc_vport *vport = shost_priv(fc_bsg_to_shost(job));
3038	struct fc_bsg_reply *bsg_reply = job->reply;
3039	struct lpfc_hba *phba = vport->phba;
3040	struct lpfc_bsg_event *evt;
3041	struct event_data *evdat;
3042	struct lpfc_sli *psli = &phba->sli;
3043	uint32_t size;
3044	uint32_t full_size;
3045	size_t segment_len = 0, segment_offset = 0, current_offset = 0;
3046	uint16_t rpi = 0;
3047	struct lpfc_iocbq *cmdiocbq, *rspiocbq = NULL;
3048	union lpfc_wqe128 *cmdwqe, *rspwqe;
3049	struct lpfc_sli_ct_request *ctreq;
3050	struct lpfc_dmabuf *txbmp;
3051	struct ulp_bde64 *txbpl = NULL;
3052	struct lpfc_dmabufext *txbuffer = NULL;
3053	struct list_head head;
3054	struct lpfc_dmabuf  *curr;
3055	uint16_t txxri = 0, rxxri;
3056	uint32_t num_bde;
3057	uint8_t *ptr = NULL, *rx_databuf = NULL;
3058	int rc = 0;
3059	int time_left;
3060	int iocb_stat = IOCB_SUCCESS;
3061	unsigned long flags;
3062	void *dataout = NULL;
3063	uint32_t total_mem;
3064
3065	/* in case no data is returned return just the return code */
3066	bsg_reply->reply_payload_rcv_len = 0;
3067
3068	if (job->request_len <
3069	    sizeof(struct fc_bsg_request) + sizeof(struct diag_mode_test)) {
3070		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
3071				"2739 Received DIAG TEST request below minimum "
3072				"size\n");
3073		rc = -EINVAL;
3074		goto loopback_test_exit;
3075	}
3076
3077	if (job->request_payload.payload_len !=
3078		job->reply_payload.payload_len) {
3079		rc = -EINVAL;
3080		goto loopback_test_exit;
3081	}
3082
3083	if ((phba->link_state == LPFC_HBA_ERROR) ||
3084	    (psli->sli_flag & LPFC_BLOCK_MGMT_IO) ||
3085	    (!(psli->sli_flag & LPFC_SLI_ACTIVE))) {
3086		rc = -EACCES;
3087		goto loopback_test_exit;
3088	}
3089
3090	if (!lpfc_is_link_up(phba) || !(phba->link_flag & LS_LOOPBACK_MODE)) {
3091		rc = -EACCES;
3092		goto loopback_test_exit;
3093	}
3094
3095	size = job->request_payload.payload_len;
3096	full_size = size + ELX_LOOPBACK_HEADER_SZ; /* plus the header */
3097
3098	if ((size == 0) || (size > 80 * BUF_SZ_4K)) {
3099		rc = -ERANGE;
3100		goto loopback_test_exit;
3101	}
3102
3103	if (full_size >= BUF_SZ_4K) {
3104		/*
3105		 * Allocate memory for ioctl data. If buffer is bigger than 64k,
3106		 * then we allocate 64k and re-use that buffer over and over to
3107		 * xfer the whole block. This is because Linux kernel has a
3108		 * problem allocating more than 120k of kernel space memory. Saw
3109		 * problem with GET_FCPTARGETMAPPING...
3110		 */
3111		if (size <= (64 * 1024))
3112			total_mem = full_size;
3113		else
3114			total_mem = 64 * 1024;
3115	} else
3116		/* Allocate memory for ioctl data */
3117		total_mem = BUF_SZ_4K;
3118
3119	dataout = kmalloc(total_mem, GFP_KERNEL);
3120	if (dataout == NULL) {
3121		rc = -ENOMEM;
3122		goto loopback_test_exit;
3123	}
3124
3125	ptr = dataout;
3126	ptr += ELX_LOOPBACK_HEADER_SZ;
3127	sg_copy_to_buffer(job->request_payload.sg_list,
3128				job->request_payload.sg_cnt,
3129				ptr, size);
3130	rc = lpfcdiag_loop_self_reg(phba, &rpi);
3131	if (rc)
3132		goto loopback_test_exit;
3133
3134	if (phba->sli_rev < LPFC_SLI_REV4) {
3135		rc = lpfcdiag_loop_get_xri(phba, rpi, &txxri, &rxxri);
3136		if (rc) {
3137			lpfcdiag_loop_self_unreg(phba, rpi);
3138			goto loopback_test_exit;
3139		}
3140
3141		rc = lpfcdiag_sli3_loop_post_rxbufs(phba, rxxri, full_size);
3142		if (rc) {
3143			lpfcdiag_loop_self_unreg(phba, rpi);
3144			goto loopback_test_exit;
3145		}
3146	}
3147	evt = lpfc_bsg_event_new(FC_REG_CT_EVENT, current->pid,
3148				SLI_CT_ELX_LOOPBACK);
3149	if (!evt) {
3150		lpfcdiag_loop_self_unreg(phba, rpi);
3151		rc = -ENOMEM;
3152		goto loopback_test_exit;
3153	}
3154
3155	spin_lock_irqsave(&phba->ct_ev_lock, flags);
3156	list_add(&evt->node, &phba->ct_ev_waiters);
3157	lpfc_bsg_event_ref(evt);
3158	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
3159
3160	cmdiocbq = lpfc_sli_get_iocbq(phba);
3161	if (phba->sli_rev < LPFC_SLI_REV4)
3162		rspiocbq = lpfc_sli_get_iocbq(phba);
3163	txbmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
3164
3165	if (txbmp) {
3166		txbmp->virt = lpfc_mbuf_alloc(phba, 0, &txbmp->phys);
3167		if (txbmp->virt) {
3168			INIT_LIST_HEAD(&txbmp->list);
3169			txbpl = (struct ulp_bde64 *) txbmp->virt;
3170			txbuffer = diag_cmd_data_alloc(phba,
3171							txbpl, full_size, 0);
3172		}
3173	}
3174
3175	if (!cmdiocbq || !txbmp || !txbpl || !txbuffer || !txbmp->virt) {
3176		rc = -ENOMEM;
3177		goto err_loopback_test_exit;
3178	}
3179	if ((phba->sli_rev < LPFC_SLI_REV4) && !rspiocbq) {
3180		rc = -ENOMEM;
3181		goto err_loopback_test_exit;
3182	}
3183
3184	cmdwqe = &cmdiocbq->wqe;
3185	memset(cmdwqe, 0, sizeof(*cmdwqe));
3186	if (phba->sli_rev < LPFC_SLI_REV4) {
3187		rspwqe = &rspiocbq->wqe;
3188		memset(rspwqe, 0, sizeof(*rspwqe));
3189	}
3190
3191	INIT_LIST_HEAD(&head);
3192	list_add_tail(&head, &txbuffer->dma.list);
3193	list_for_each_entry(curr, &head, list) {
3194		segment_len = ((struct lpfc_dmabufext *)curr)->size;
3195		if (current_offset == 0) {
3196			ctreq = curr->virt;
3197			memset(ctreq, 0, ELX_LOOPBACK_HEADER_SZ);
3198			ctreq->RevisionId.bits.Revision = SLI_CT_REVISION;
3199			ctreq->RevisionId.bits.InId = 0;
3200			ctreq->FsType = SLI_CT_ELX_LOOPBACK;
3201			ctreq->FsSubType = 0;
3202			ctreq->CommandResponse.bits.CmdRsp = cpu_to_be16(ELX_LOOPBACK_DATA);
3203			ctreq->CommandResponse.bits.Size   = cpu_to_be16(size);
3204			segment_offset = ELX_LOOPBACK_HEADER_SZ;
3205		} else
3206			segment_offset = 0;
3207
3208		BUG_ON(segment_offset >= segment_len);
3209		memcpy(curr->virt + segment_offset,
3210			ptr + current_offset,
3211			segment_len - segment_offset);
3212
3213		current_offset += segment_len - segment_offset;
3214		BUG_ON(current_offset > size);
3215	}
3216	list_del(&head);
3217
3218	/* Build the XMIT_SEQUENCE iocb */
3219	num_bde = (uint32_t)txbuffer->flag;
3220
3221	cmdiocbq->num_bdes = num_bde;
3222	cmdiocbq->cmd_flag |= LPFC_IO_LIBDFC;
3223	cmdiocbq->cmd_flag |= LPFC_IO_LOOPBACK;
3224	if (phba->cfg_vmid_app_header)
3225		cmdiocbq->cmd_flag |= LPFC_IO_VMID;
3226
3227	cmdiocbq->vport = phba->pport;
3228	cmdiocbq->cmd_cmpl = NULL;
3229	cmdiocbq->bpl_dmabuf = txbmp;
3230
3231	if (phba->sli_rev < LPFC_SLI_REV4) {
3232		lpfc_sli_prep_xmit_seq64(phba, cmdiocbq, txbmp, 0, txxri,
3233					 num_bde, FC_RCTL_DD_UNSOL_CTL, 1,
3234					 CMD_XMIT_SEQUENCE64_CX);
3235
3236	} else {
3237		lpfc_sli_prep_xmit_seq64(phba, cmdiocbq, txbmp,
3238					 phba->sli4_hba.rpi_ids[rpi], 0xffff,
3239					 full_size, FC_RCTL_DD_UNSOL_CTL, 1,
3240					 CMD_XMIT_SEQUENCE64_WQE);
3241		cmdiocbq->sli4_xritag = NO_XRI;
3242	}
3243
3244	iocb_stat = lpfc_sli_issue_iocb_wait(phba, LPFC_ELS_RING, cmdiocbq,
3245					     rspiocbq, (phba->fc_ratov * 2) +
3246					     LPFC_DRVR_TIMEOUT);
3247	if (iocb_stat != IOCB_SUCCESS ||
3248	    (phba->sli_rev < LPFC_SLI_REV4 &&
3249	     (get_job_ulpstatus(phba, rspiocbq) != IOSTAT_SUCCESS))) {
3250		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
3251				"3126 Failed loopback test issue iocb: "
3252				"iocb_stat:x%x\n", iocb_stat);
3253		rc = -EIO;
3254		goto err_loopback_test_exit;
3255	}
3256
3257	evt->waiting = 1;
3258	time_left = wait_event_interruptible_timeout(
3259		evt->wq, !list_empty(&evt->events_to_see),
3260		secs_to_jiffies(phba->fc_ratov * 2 + LPFC_DRVR_TIMEOUT));
3261	evt->waiting = 0;
3262	if (list_empty(&evt->events_to_see)) {
3263		rc = (time_left) ? -EINTR : -ETIMEDOUT;
3264		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
3265				"3125 Not receiving unsolicited event, "
3266				"rc:x%x\n", rc);
3267	} else {
3268		spin_lock_irqsave(&phba->ct_ev_lock, flags);
3269		list_move(evt->events_to_see.prev, &evt->events_to_get);
3270		evdat = list_entry(evt->events_to_get.prev,
3271				   typeof(*evdat), node);
3272		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
3273		rx_databuf = evdat->data;
3274		if (evdat->len != full_size) {
3275			lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
3276				"1603 Loopback test did not receive expected "
3277				"data length. actual length 0x%x expected "
3278				"length 0x%x\n",
3279				evdat->len, full_size);
3280			rc = -EIO;
3281		} else if (rx_databuf == NULL)
3282			rc = -EIO;
3283		else {
3284			rc = IOCB_SUCCESS;
3285			/* skip over elx loopback header */
3286			rx_databuf += ELX_LOOPBACK_HEADER_SZ;
3287			bsg_reply->reply_payload_rcv_len =
3288				sg_copy_from_buffer(job->reply_payload.sg_list,
3289						    job->reply_payload.sg_cnt,
3290						    rx_databuf, size);
3291			bsg_reply->reply_payload_rcv_len = size;
3292		}
3293	}
3294
3295err_loopback_test_exit:
3296	lpfcdiag_loop_self_unreg(phba, rpi);
3297
3298	spin_lock_irqsave(&phba->ct_ev_lock, flags);
3299	lpfc_bsg_event_unref(evt); /* release ref */
3300	lpfc_bsg_event_unref(evt); /* delete */
3301	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
3302
3303	if ((cmdiocbq != NULL) && (iocb_stat != IOCB_TIMEDOUT))
3304		lpfc_sli_release_iocbq(phba, cmdiocbq);
3305
3306	if (rspiocbq != NULL)
3307		lpfc_sli_release_iocbq(phba, rspiocbq);
3308
3309	if (txbmp != NULL) {
3310		if (txbpl != NULL) {
3311			if (txbuffer != NULL)
3312				diag_cmd_data_free(phba, txbuffer);
3313			lpfc_mbuf_free(phba, txbmp->virt, txbmp->phys);
3314		}
3315		kfree(txbmp);
3316	}
3317
3318loopback_test_exit:
3319	kfree(dataout);
3320	/* make error code available to userspace */
3321	bsg_reply->result = rc;
3322	job->dd_data = NULL;
3323	/* complete the job back to userspace if no error */
3324	if (rc == IOCB_SUCCESS)
3325		bsg_job_done(job, bsg_reply->result,
3326			       bsg_reply->reply_payload_rcv_len);
3327	return rc;
3328}
3329
3330/**
3331 * lpfc_bsg_get_dfc_rev - process a GET_DFC_REV bsg vendor command
3332 * @job: GET_DFC_REV fc_bsg_job
3333 **/
3334static int
3335lpfc_bsg_get_dfc_rev(struct bsg_job *job)
3336{
3337	struct lpfc_vport *vport = shost_priv(fc_bsg_to_shost(job));
3338	struct fc_bsg_reply *bsg_reply = job->reply;
3339	struct lpfc_hba *phba = vport->phba;
3340	struct get_mgmt_rev_reply *event_reply;
3341	int rc = 0;
3342
3343	if (job->request_len <
3344	    sizeof(struct fc_bsg_request) + sizeof(struct get_mgmt_rev)) {
3345		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
3346				"2740 Received GET_DFC_REV request below "
3347				"minimum size\n");
3348		rc = -EINVAL;
3349		goto job_error;
3350	}
3351
3352	event_reply = (struct get_mgmt_rev_reply *)
3353		bsg_reply->reply_data.vendor_reply.vendor_rsp;
3354
3355	if (job->reply_len < sizeof(*bsg_reply) + sizeof(*event_reply)) {
3356		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
3357				"2741 Received GET_DFC_REV reply below "
3358				"minimum size\n");
3359		rc = -EINVAL;
3360		goto job_error;
3361	}
3362
3363	event_reply->info.a_Major = MANAGEMENT_MAJOR_REV;
3364	event_reply->info.a_Minor = MANAGEMENT_MINOR_REV;
3365job_error:
3366	bsg_reply->result = rc;
3367	if (rc == 0)
3368		bsg_job_done(job, bsg_reply->result,
3369			       bsg_reply->reply_payload_rcv_len);
3370	return rc;
3371}
3372
3373/**
3374 * lpfc_bsg_issue_mbox_cmpl - lpfc_bsg_issue_mbox mbox completion handler
3375 * @phba: Pointer to HBA context object.
3376 * @pmboxq: Pointer to mailbox command.
3377 *
3378 * This is completion handler function for mailbox commands issued from
3379 * lpfc_bsg_issue_mbox function. This function is called by the
3380 * mailbox event handler function with no lock held. This function
3381 * will wake up thread waiting on the wait queue pointed by dd_data
3382 * of the mailbox.
3383 **/
3384static void
3385lpfc_bsg_issue_mbox_cmpl(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmboxq)
3386{
3387	struct bsg_job_data *dd_data;
3388	struct fc_bsg_reply *bsg_reply;
3389	struct bsg_job *job;
3390	uint32_t size;
3391	unsigned long flags;
3392	uint8_t *pmb, *pmb_buf;
3393
3394	dd_data = pmboxq->ctx_u.dd_data;
3395
3396	/*
3397	 * The outgoing buffer is readily referred from the dma buffer,
3398	 * just need to get header part from mailboxq structure.
3399	 */
3400	pmb = (uint8_t *)&pmboxq->u.mb;
3401	pmb_buf = (uint8_t *)dd_data->context_un.mbox.mb;
3402	memcpy(pmb_buf, pmb, sizeof(MAILBOX_t));
3403
3404	/* Determine if job has been aborted */
3405
3406	spin_lock_irqsave(&phba->ct_ev_lock, flags);
3407	job = dd_data->set_job;
3408	if (job) {
3409		/* Prevent timeout handling from trying to abort job  */
3410		job->dd_data = NULL;
3411	}
3412	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
3413
3414	/* Copy the mailbox data to the job if it is still active */
3415
3416	if (job) {
3417		bsg_reply = job->reply;
3418		size = job->reply_payload.payload_len;
3419		bsg_reply->reply_payload_rcv_len =
3420			sg_copy_from_buffer(job->reply_payload.sg_list,
3421					    job->reply_payload.sg_cnt,
3422					    pmb_buf, size);
3423	}
3424
3425	dd_data->set_job = NULL;
3426	mempool_free(dd_data->context_un.mbox.pmboxq, phba->mbox_mem_pool);
3427	lpfc_bsg_dma_page_free(phba, dd_data->context_un.mbox.dmabuffers);
3428	kfree(dd_data);
3429
3430	/* Complete the job if the job is still active */
3431
3432	if (job) {
3433		bsg_reply->result = 0;
3434		bsg_job_done(job, bsg_reply->result,
3435			       bsg_reply->reply_payload_rcv_len);
3436	}
3437	return;
3438}
3439
3440/**
3441 * lpfc_bsg_check_cmd_access - test for a supported mailbox command
3442 * @phba: Pointer to HBA context object.
3443 * @mb: Pointer to a mailbox object.
3444 * @vport: Pointer to a vport object.
3445 *
3446 * Some commands require the port to be offline, some may not be called from
3447 * the application.
3448 **/
3449static int lpfc_bsg_check_cmd_access(struct lpfc_hba *phba,
3450	MAILBOX_t *mb, struct lpfc_vport *vport)
3451{
3452	/* return negative error values for bsg job */
3453	switch (mb->mbxCommand) {
3454	/* Offline only */
3455	case MBX_INIT_LINK:
3456	case MBX_DOWN_LINK:
3457	case MBX_CONFIG_LINK:
3458	case MBX_CONFIG_RING:
3459	case MBX_RESET_RING:
3460	case MBX_UNREG_LOGIN:
3461	case MBX_CLEAR_LA:
3462	case MBX_DUMP_CONTEXT:
3463	case MBX_RUN_DIAGS:
3464	case MBX_RESTART:
3465	case MBX_SET_MASK:
3466		if (!test_bit(FC_OFFLINE_MODE, &vport->fc_flag)) {
3467			lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
3468				"2743 Command 0x%x is illegal in on-line "
3469				"state\n",
3470				mb->mbxCommand);
3471			return -EPERM;
3472		}
3473		break;
3474	case MBX_WRITE_NV:
3475	case MBX_WRITE_VPARMS:
3476	case MBX_LOAD_SM:
3477	case MBX_READ_NV:
3478	case MBX_READ_CONFIG:
3479	case MBX_READ_RCONFIG:
3480	case MBX_READ_STATUS:
3481	case MBX_READ_XRI:
3482	case MBX_READ_REV:
3483	case MBX_READ_LNK_STAT:
3484	case MBX_DUMP_MEMORY:
3485	case MBX_DOWN_LOAD:
3486	case MBX_UPDATE_CFG:
3487	case MBX_KILL_BOARD:
3488	case MBX_READ_TOPOLOGY:
3489	case MBX_LOAD_AREA:
3490	case MBX_LOAD_EXP_ROM:
3491	case MBX_BEACON:
3492	case MBX_DEL_LD_ENTRY:
3493	case MBX_SET_DEBUG:
3494	case MBX_WRITE_WWN:
3495	case MBX_SLI4_CONFIG:
3496	case MBX_READ_EVENT_LOG:
3497	case MBX_READ_EVENT_LOG_STATUS:
3498	case MBX_WRITE_EVENT_LOG:
3499	case MBX_PORT_CAPABILITIES:
3500	case MBX_PORT_IOV_CONTROL:
3501	case MBX_RUN_BIU_DIAG64:
3502		break;
3503	case MBX_SET_VARIABLE:
3504		lpfc_printf_log(phba, KERN_INFO, LOG_INIT,
3505			"1226 mbox: set_variable 0x%x, 0x%x\n",
3506			mb->un.varWords[0],
3507			mb->un.varWords[1]);
3508		break;
3509	case MBX_READ_SPARM64:
3510	case MBX_REG_LOGIN:
3511	case MBX_REG_LOGIN64:
3512	case MBX_CONFIG_PORT:
3513	case MBX_RUN_BIU_DIAG:
3514	default:
3515		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
3516			"2742 Unknown Command 0x%x\n",
3517			mb->mbxCommand);
3518		return -EPERM;
3519	}
3520
3521	return 0; /* ok */
3522}
3523
3524/**
3525 * lpfc_bsg_mbox_ext_session_reset - clean up context of multi-buffer mbox session
3526 * @phba: Pointer to HBA context object.
3527 *
3528 * This is routine clean up and reset BSG handling of multi-buffer mbox
3529 * command session.
3530 **/
3531static void
3532lpfc_bsg_mbox_ext_session_reset(struct lpfc_hba *phba)
3533{
3534	if (phba->mbox_ext_buf_ctx.state == LPFC_BSG_MBOX_IDLE)
3535		return;
3536
3537	/* free all memory, including dma buffers */
3538	lpfc_bsg_dma_page_list_free(phba,
3539				    &phba->mbox_ext_buf_ctx.ext_dmabuf_list);
3540	lpfc_bsg_dma_page_free(phba, phba->mbox_ext_buf_ctx.mbx_dmabuf);
3541	/* multi-buffer write mailbox command pass-through complete */
3542	memset((char *)&phba->mbox_ext_buf_ctx, 0,
3543	       sizeof(struct lpfc_mbox_ext_buf_ctx));
3544	INIT_LIST_HEAD(&phba->mbox_ext_buf_ctx.ext_dmabuf_list);
3545
3546	return;
3547}
3548
3549/**
3550 * lpfc_rd_obj_emb0_handle_job - Handles completion for non-embedded
3551 *                               READ_OBJECT_V0 mailbox commands
3552 * @phba: pointer to lpfc_hba data struct
3553 * @pmb_buf: pointer to mailbox buffer
3554 * @sli_cfg_mbx: pointer to SLI_CONFIG mailbox memory region
3555 * @job: pointer to bsg_job struct
3556 * @bsg_reply: point to bsg_reply struct
3557 *
3558 * Given a non-embedded READ_OBJECT_V0's HBD_CNT, this routine copies
3559 * a READ_OBJECT_V0 mailbox command's read data payload into a bsg_job
3560 * structure for passing back to application layer.
3561 *
3562 * Return codes
3563 *      0 - successful
3564 *      -EINVAL - invalid HBD_CNT
3565 *      -ENODEV - pointer to bsg_job struct is NULL
3566 **/
3567static int
3568lpfc_rd_obj_emb0_handle_job(struct lpfc_hba *phba, u8 *pmb_buf,
3569			    struct lpfc_sli_config_mbox *sli_cfg_mbx,
3570			    struct bsg_job *job,
3571			    struct fc_bsg_reply *bsg_reply)
3572{
3573	struct lpfc_dmabuf *curr_dmabuf, *next_dmabuf;
3574	struct lpfc_sli_config_emb0_subsys *emb0_subsys;
3575	u32 hbd_cnt;
3576	u32 dma_buf_len;
3577	u8 i = 0;
3578	size_t extra_bytes;
3579	off_t skip = 0;
3580
3581	if (!job) {
3582		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3583				"2496 NULL job\n");
3584		return -ENODEV;
3585	}
3586
3587	if (!bsg_reply) {
3588		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3589				"2498 NULL bsg_reply\n");
3590		return -ENODEV;
3591	}
3592
3593	emb0_subsys = &sli_cfg_mbx->un.sli_config_emb0_subsys;
3594
3595	hbd_cnt = bsg_bf_get(lpfc_emb0_subcmnd_rd_obj_hbd_cnt,
3596			     emb0_subsys);
3597
3598	/* Calculate where the read object's read data payload is located based
3599	 * on HBD count scheme.
3600	 */
3601	if (hbd_cnt >= rd_obj_scheme[0].min_hbd_cnt &&
3602	    hbd_cnt <= rd_obj_scheme[0].max_hbd_cnt) {
3603		skip = rd_obj_scheme[0].payload_word_offset * 4;
3604	} else if (hbd_cnt >= rd_obj_scheme[1].min_hbd_cnt &&
3605		   hbd_cnt <= rd_obj_scheme[1].max_hbd_cnt) {
3606		skip = rd_obj_scheme[1].payload_word_offset * 4;
3607	} else {
3608		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3609				"2497 bad hbd_count 0x%08x\n",
3610				hbd_cnt);
3611		return -EINVAL;
3612	}
3613
3614	/* Copy SLI_CONFIG command and READ_OBJECT response first */
3615	bsg_reply->reply_payload_rcv_len =
3616		sg_copy_from_buffer(job->reply_payload.sg_list,
3617				    job->reply_payload.sg_cnt,
3618				    pmb_buf, skip);
3619
3620	/* Copy data from hbds */
3621	list_for_each_entry_safe(curr_dmabuf, next_dmabuf,
3622				 &phba->mbox_ext_buf_ctx.ext_dmabuf_list,
3623				 list) {
3624		dma_buf_len = emb0_subsys->hbd[i].buf_len;
3625
3626		/* Use sg_copy_buffer to specify a skip offset */
3627		extra_bytes = sg_copy_buffer(job->reply_payload.sg_list,
3628					     job->reply_payload.sg_cnt,
3629					     curr_dmabuf->virt,
3630					     dma_buf_len, skip, false);
3631
3632		bsg_reply->reply_payload_rcv_len += extra_bytes;
3633
3634		skip += extra_bytes;
3635
3636		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3637				"2499 copied hbd[%d] "
3638				"0x%zx bytes\n",
3639				i, extra_bytes);
3640		i++;
3641	}
3642
3643	return 0;
3644}
3645
3646/**
3647 * lpfc_bsg_issue_mbox_ext_handle_job - job handler for multi-buffer mbox cmpl
3648 * @phba: Pointer to HBA context object.
3649 * @pmboxq: Pointer to mailbox command.
3650 *
3651 * This is routine handles BSG job for mailbox commands completions with
3652 * multiple external buffers.
3653 **/
3654static struct bsg_job *
3655lpfc_bsg_issue_mbox_ext_handle_job(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmboxq)
3656{
3657	struct bsg_job_data *dd_data;
3658	struct bsg_job *job;
3659	struct fc_bsg_reply *bsg_reply = NULL;
3660	uint8_t *pmb, *pmb_buf;
3661	unsigned long flags;
3662	u32 size, opcode;
3663	int rc = 0;
3664	struct lpfc_dmabuf *dmabuf;
3665	struct lpfc_sli_config_mbox *sli_cfg_mbx;
3666	uint8_t *pmbx;
3667
3668	dd_data = pmboxq->ctx_u.dd_data;
3669
3670	/* Determine if job has been aborted */
3671	spin_lock_irqsave(&phba->ct_ev_lock, flags);
3672	job = dd_data->set_job;
3673	if (job) {
3674		bsg_reply = job->reply;
3675		/* Prevent timeout handling from trying to abort job  */
3676		job->dd_data = NULL;
3677	}
3678	spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
3679
3680	/*
3681	 * The outgoing buffer is readily referred from the dma buffer,
3682	 * just need to get header part from mailboxq structure.
3683	 */
3684
3685	pmb = (uint8_t *)&pmboxq->u.mb;
3686	pmb_buf = (uint8_t *)dd_data->context_un.mbox.mb;
3687	/* Copy the byte swapped response mailbox back to the user */
3688	memcpy(pmb_buf, pmb, sizeof(MAILBOX_t));
3689	/* if there is any non-embedded extended data copy that too */
3690	dmabuf = phba->mbox_ext_buf_ctx.mbx_dmabuf;
3691	sli_cfg_mbx = (struct lpfc_sli_config_mbox *)dmabuf->virt;
3692	if (!bsg_bf_get(lpfc_mbox_hdr_emb,
3693	    &sli_cfg_mbx->un.sli_config_emb0_subsys.sli_config_hdr)) {
3694		pmbx = (uint8_t *)dmabuf->virt;
3695		/* byte swap the extended data following the mailbox command */
3696		lpfc_sli_pcimem_bcopy(&pmbx[sizeof(MAILBOX_t)],
3697			&pmbx[sizeof(MAILBOX_t)],
3698			sli_cfg_mbx->un.sli_config_emb0_subsys.mse[0].buf_len);
3699
3700		/* Special handling for non-embedded READ_OBJECT */
3701		opcode = bsg_bf_get(lpfc_emb0_subcmnd_opcode,
3702				    &sli_cfg_mbx->un.sli_config_emb0_subsys);
3703		switch (opcode) {
3704		case COMN_OPCODE_READ_OBJECT:
3705			if (job) {
3706				rc = lpfc_rd_obj_emb0_handle_job(phba, pmb_buf,
3707								 sli_cfg_mbx,
3708								 job,
3709								 bsg_reply);
3710				bsg_reply->result = rc;
3711				goto done;
3712			}
3713			break;
3714		default:
3715			break;
3716		}
3717	}
3718
3719	/* Complete the job if the job is still active */
3720
3721	if (job) {
3722		size = job->reply_payload.payload_len;
3723		bsg_reply->reply_payload_rcv_len =
3724			sg_copy_from_buffer(job->reply_payload.sg_list,
3725					    job->reply_payload.sg_cnt,
3726					    pmb_buf, size);
3727
3728		/* result for successful */
3729		bsg_reply->result = 0;
3730done:
3731
3732		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3733				"2937 SLI_CONFIG ext-buffer mailbox command "
3734				"(x%x/x%x) complete bsg job done, bsize:%d\n",
3735				phba->mbox_ext_buf_ctx.nembType,
3736				phba->mbox_ext_buf_ctx.mboxType,
3737				job->reply_payload.payload_len);
3738		lpfc_idiag_mbxacc_dump_bsg_mbox(phba,
3739					phba->mbox_ext_buf_ctx.nembType,
3740					phba->mbox_ext_buf_ctx.mboxType,
3741					dma_ebuf, sta_pos_addr,
3742					phba->mbox_ext_buf_ctx.mbx_dmabuf, 0);
3743	} else {
3744		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
3745				"2938 SLI_CONFIG ext-buffer mailbox "
3746				"command (x%x/x%x) failure, rc:x%x\n",
3747				phba->mbox_ext_buf_ctx.nembType,
3748				phba->mbox_ext_buf_ctx.mboxType, rc);
3749	}
3750
3751
3752	/* state change */
3753	phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_DONE;
3754	kfree(dd_data);
3755	return job;
3756}
3757
3758/**
3759 * lpfc_bsg_issue_read_mbox_ext_cmpl - compl handler for multi-buffer read mbox
3760 * @phba: Pointer to HBA context object.
3761 * @pmboxq: Pointer to mailbox command.
3762 *
3763 * This is completion handler function for mailbox read commands with multiple
3764 * external buffers.
3765 **/
3766static void
3767lpfc_bsg_issue_read_mbox_ext_cmpl(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmboxq)
3768{
3769	struct bsg_job *job;
3770	struct fc_bsg_reply *bsg_reply;
3771
3772	job = lpfc_bsg_issue_mbox_ext_handle_job(phba, pmboxq);
3773
3774	/* handle the BSG job with mailbox command */
3775	if (!job)
3776		pmboxq->u.mb.mbxStatus = MBXERR_ERROR;
3777
3778	lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3779			"2939 SLI_CONFIG ext-buffer rd mailbox command "
3780			"complete, ctxState:x%x, mbxStatus:x%x\n",
3781			phba->mbox_ext_buf_ctx.state, pmboxq->u.mb.mbxStatus);
3782
3783	if (pmboxq->u.mb.mbxStatus || phba->mbox_ext_buf_ctx.numBuf == 1)
3784		lpfc_bsg_mbox_ext_session_reset(phba);
3785
3786	/* free base driver mailbox structure memory */
3787	mempool_free(pmboxq, phba->mbox_mem_pool);
3788
3789	/* if the job is still active, call job done */
3790	if (job) {
3791		bsg_reply = job->reply;
3792		bsg_job_done(job, bsg_reply->result,
3793			       bsg_reply->reply_payload_rcv_len);
3794	}
3795	return;
3796}
3797
3798/**
3799 * lpfc_bsg_issue_write_mbox_ext_cmpl - cmpl handler for multi-buffer write mbox
3800 * @phba: Pointer to HBA context object.
3801 * @pmboxq: Pointer to mailbox command.
3802 *
3803 * This is completion handler function for mailbox write commands with multiple
3804 * external buffers.
3805 **/
3806static void
3807lpfc_bsg_issue_write_mbox_ext_cmpl(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmboxq)
3808{
3809	struct bsg_job *job;
3810	struct fc_bsg_reply *bsg_reply;
3811
3812	job = lpfc_bsg_issue_mbox_ext_handle_job(phba, pmboxq);
3813
3814	/* handle the BSG job with the mailbox command */
3815	if (!job)
3816		pmboxq->u.mb.mbxStatus = MBXERR_ERROR;
3817
3818	lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3819			"2940 SLI_CONFIG ext-buffer wr mailbox command "
3820			"complete, ctxState:x%x, mbxStatus:x%x\n",
3821			phba->mbox_ext_buf_ctx.state, pmboxq->u.mb.mbxStatus);
3822
3823	/* free all memory, including dma buffers */
3824	mempool_free(pmboxq, phba->mbox_mem_pool);
3825	lpfc_bsg_mbox_ext_session_reset(phba);
3826
3827	/* if the job is still active, call job done */
3828	if (job) {
3829		bsg_reply = job->reply;
3830		bsg_job_done(job, bsg_reply->result,
3831			       bsg_reply->reply_payload_rcv_len);
3832	}
3833
3834	return;
3835}
3836
3837static void
3838lpfc_bsg_sli_cfg_dma_desc_setup(struct lpfc_hba *phba, enum nemb_type nemb_tp,
3839				uint32_t index, struct lpfc_dmabuf *mbx_dmabuf,
3840				struct lpfc_dmabuf *ext_dmabuf)
3841{
3842	struct lpfc_sli_config_mbox *sli_cfg_mbx;
3843
3844	/* pointer to the start of mailbox command */
3845	sli_cfg_mbx = (struct lpfc_sli_config_mbox *)mbx_dmabuf->virt;
3846
3847	if (nemb_tp == nemb_mse) {
3848		if (index == 0) {
3849			sli_cfg_mbx->un.sli_config_emb0_subsys.
3850				mse[index].pa_hi =
3851				putPaddrHigh(mbx_dmabuf->phys +
3852					     sizeof(MAILBOX_t));
3853			sli_cfg_mbx->un.sli_config_emb0_subsys.
3854				mse[index].pa_lo =
3855				putPaddrLow(mbx_dmabuf->phys +
3856					    sizeof(MAILBOX_t));
3857			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3858					"2943 SLI_CONFIG(mse)[%d], "
3859					"bufLen:%d, addrHi:x%x, addrLo:x%x\n",
3860					index,
3861					sli_cfg_mbx->un.sli_config_emb0_subsys.
3862					mse[index].buf_len,
3863					sli_cfg_mbx->un.sli_config_emb0_subsys.
3864					mse[index].pa_hi,
3865					sli_cfg_mbx->un.sli_config_emb0_subsys.
3866					mse[index].pa_lo);
3867		} else {
3868			sli_cfg_mbx->un.sli_config_emb0_subsys.
3869				mse[index].pa_hi =
3870				putPaddrHigh(ext_dmabuf->phys);
3871			sli_cfg_mbx->un.sli_config_emb0_subsys.
3872				mse[index].pa_lo =
3873				putPaddrLow(ext_dmabuf->phys);
3874			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3875					"2944 SLI_CONFIG(mse)[%d], "
3876					"bufLen:%d, addrHi:x%x, addrLo:x%x\n",
3877					index,
3878					sli_cfg_mbx->un.sli_config_emb0_subsys.
3879					mse[index].buf_len,
3880					sli_cfg_mbx->un.sli_config_emb0_subsys.
3881					mse[index].pa_hi,
3882					sli_cfg_mbx->un.sli_config_emb0_subsys.
3883					mse[index].pa_lo);
3884		}
3885	} else {
3886		if (index == 0) {
3887			sli_cfg_mbx->un.sli_config_emb1_subsys.
3888				hbd[index].pa_hi =
3889				putPaddrHigh(mbx_dmabuf->phys +
3890					     sizeof(MAILBOX_t));
3891			sli_cfg_mbx->un.sli_config_emb1_subsys.
3892				hbd[index].pa_lo =
3893				putPaddrLow(mbx_dmabuf->phys +
3894					    sizeof(MAILBOX_t));
3895			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3896					"3007 SLI_CONFIG(hbd)[%d], "
3897					"bufLen:%d, addrHi:x%x, addrLo:x%x\n",
3898				index,
3899				bsg_bf_get(lpfc_mbox_sli_config_ecmn_hbd_len,
3900				&sli_cfg_mbx->un.
3901				sli_config_emb1_subsys.hbd[index]),
3902				sli_cfg_mbx->un.sli_config_emb1_subsys.
3903				hbd[index].pa_hi,
3904				sli_cfg_mbx->un.sli_config_emb1_subsys.
3905				hbd[index].pa_lo);
3906
3907		} else {
3908			sli_cfg_mbx->un.sli_config_emb1_subsys.
3909				hbd[index].pa_hi =
3910				putPaddrHigh(ext_dmabuf->phys);
3911			sli_cfg_mbx->un.sli_config_emb1_subsys.
3912				hbd[index].pa_lo =
3913				putPaddrLow(ext_dmabuf->phys);
3914			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3915					"3008 SLI_CONFIG(hbd)[%d], "
3916					"bufLen:%d, addrHi:x%x, addrLo:x%x\n",
3917				index,
3918				bsg_bf_get(lpfc_mbox_sli_config_ecmn_hbd_len,
3919				&sli_cfg_mbx->un.
3920				sli_config_emb1_subsys.hbd[index]),
3921				sli_cfg_mbx->un.sli_config_emb1_subsys.
3922				hbd[index].pa_hi,
3923				sli_cfg_mbx->un.sli_config_emb1_subsys.
3924				hbd[index].pa_lo);
3925		}
3926	}
3927	return;
3928}
3929
3930/**
3931 * lpfc_bsg_sli_cfg_read_cmd_ext - sli_config non-embedded mailbox cmd read
3932 * @phba: Pointer to HBA context object.
3933 * @job: Pointer to the job object.
3934 * @nemb_tp: Enumerate of non-embedded mailbox command type.
3935 * @dmabuf: Pointer to a DMA buffer descriptor.
3936 *
3937 * This routine performs SLI_CONFIG (0x9B) read mailbox command operation with
3938 * non-embedded external buffers.
3939 **/
3940static int
3941lpfc_bsg_sli_cfg_read_cmd_ext(struct lpfc_hba *phba, struct bsg_job *job,
3942			      enum nemb_type nemb_tp,
3943			      struct lpfc_dmabuf *dmabuf)
3944{
3945	struct fc_bsg_request *bsg_request = job->request;
3946	struct lpfc_sli_config_mbox *sli_cfg_mbx;
3947	struct lpfc_sli_config_emb0_subsys *emb0_subsys;
3948	struct list_head *ext_dmabuf_list;
3949	struct dfc_mbox_req *mbox_req;
3950	struct lpfc_dmabuf *curr_dmabuf, *next_dmabuf;
3951	u32 ext_buf_cnt, ext_buf_index, hbd_cnt;
3952	struct lpfc_dmabuf *ext_dmabuf = NULL;
3953	struct bsg_job_data *dd_data = NULL;
3954	LPFC_MBOXQ_t *pmboxq = NULL;
3955	MAILBOX_t *pmb;
3956	u8 *pmbx, opcode;
3957	int rc, i;
3958
3959	mbox_req =
3960	   (struct dfc_mbox_req *)bsg_request->rqst_data.h_vendor.vendor_cmd;
3961
3962	/* pointer to the start of mailbox command */
3963	sli_cfg_mbx = (struct lpfc_sli_config_mbox *)dmabuf->virt;
3964
3965	if (nemb_tp == nemb_mse) {
3966		emb0_subsys = &sli_cfg_mbx->un.sli_config_emb0_subsys;
3967		ext_buf_cnt = bsg_bf_get(lpfc_mbox_hdr_mse_cnt,
3968			&emb0_subsys->sli_config_hdr);
3969		if (ext_buf_cnt > LPFC_MBX_SLI_CONFIG_MAX_MSE) {
3970			lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
3971					"2945 Handled SLI_CONFIG(mse) rd, "
3972					"ext_buf_cnt(%d) out of range(%d)\n",
3973					ext_buf_cnt,
3974					LPFC_MBX_SLI_CONFIG_MAX_MSE);
3975			rc = -ERANGE;
3976			goto job_error;
3977		}
3978
3979		/* Special handling for non-embedded READ_OBJECT */
3980		opcode = bsg_bf_get(lpfc_emb0_subcmnd_opcode, emb0_subsys);
3981		switch (opcode) {
3982		case COMN_OPCODE_READ_OBJECT:
3983			hbd_cnt = bsg_bf_get(lpfc_emb0_subcmnd_rd_obj_hbd_cnt,
3984					     emb0_subsys);
3985			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
3986					"2449 SLI_CONFIG(mse) rd non-embedded "
3987					"hbd count = %d\n",
3988					hbd_cnt);
3989
3990			ext_dmabuf_list =
3991					&phba->mbox_ext_buf_ctx.ext_dmabuf_list;
3992
3993			/* Allocate hbds */
3994			for (i = 0; i < hbd_cnt; i++) {
3995				ext_dmabuf = lpfc_bsg_dma_page_alloc(phba);
3996				if (!ext_dmabuf) {
3997					rc = -ENOMEM;
3998					goto job_error;
3999				}
4000				list_add_tail(&ext_dmabuf->list,
4001					      ext_dmabuf_list);
4002			}
4003
4004			/* Fill out the physical memory addresses for the
4005			 * hbds
4006			 */
4007			i = 0;
4008			list_for_each_entry_safe(curr_dmabuf, next_dmabuf,
4009						 ext_dmabuf_list, list) {
4010				emb0_subsys->hbd[i].pa_hi =
4011					putPaddrHigh(curr_dmabuf->phys);
4012				emb0_subsys->hbd[i].pa_lo =
4013					putPaddrLow(curr_dmabuf->phys);
4014
4015				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4016						"2495 SLI_CONFIG(hbd)[%d], "
4017						"bufLen:%d, addrHi:x%x, "
4018						"addrLo:x%x\n", i,
4019						emb0_subsys->hbd[i].buf_len,
4020						emb0_subsys->hbd[i].pa_hi,
4021						emb0_subsys->hbd[i].pa_lo);
4022				i++;
4023			}
4024			break;
4025		default:
4026			break;
4027		}
4028
4029		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4030				"2941 Handled SLI_CONFIG(mse) rd, "
4031				"ext_buf_cnt:%d\n", ext_buf_cnt);
4032	} else {
4033		/* sanity check on interface type for support */
4034		if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) <
4035		    LPFC_SLI_INTF_IF_TYPE_2) {
4036			rc = -ENODEV;
4037			goto job_error;
4038		}
4039		/* nemb_tp == nemb_hbd */
4040		ext_buf_cnt = sli_cfg_mbx->un.sli_config_emb1_subsys.hbd_count;
4041		if (ext_buf_cnt > LPFC_MBX_SLI_CONFIG_MAX_HBD) {
4042			lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
4043					"2946 Handled SLI_CONFIG(hbd) rd, "
4044					"ext_buf_cnt(%d) out of range(%d)\n",
4045					ext_buf_cnt,
4046					LPFC_MBX_SLI_CONFIG_MAX_HBD);
4047			rc = -ERANGE;
4048			goto job_error;
4049		}
4050		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4051				"2942 Handled SLI_CONFIG(hbd) rd, "
4052				"ext_buf_cnt:%d\n", ext_buf_cnt);
4053	}
4054
4055	/* before dma descriptor setup */
4056	lpfc_idiag_mbxacc_dump_bsg_mbox(phba, nemb_tp, mbox_rd, dma_mbox,
4057					sta_pre_addr, dmabuf, ext_buf_cnt);
4058
4059	/* reject non-embedded mailbox command with none external buffer */
4060	if (ext_buf_cnt == 0) {
4061		rc = -EPERM;
4062		goto job_error;
4063	} else if (ext_buf_cnt > 1) {
4064		/* additional external read buffers */
4065		for (i = 1; i < ext_buf_cnt; i++) {
4066			ext_dmabuf = lpfc_bsg_dma_page_alloc(phba);
4067			if (!ext_dmabuf) {
4068				rc = -ENOMEM;
4069				goto job_error;
4070			}
4071			list_add_tail(&ext_dmabuf->list,
4072				      &phba->mbox_ext_buf_ctx.ext_dmabuf_list);
4073		}
4074	}
4075
4076	/* bsg tracking structure */
4077	dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
4078	if (!dd_data) {
4079		rc = -ENOMEM;
4080		goto job_error;
4081	}
4082
4083	/* mailbox command structure for base driver */
4084	pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
4085	if (!pmboxq) {
4086		rc = -ENOMEM;
4087		goto job_error;
4088	}
4089	memset(pmboxq, 0, sizeof(LPFC_MBOXQ_t));
4090
4091	/* for the first external buffer */
4092	lpfc_bsg_sli_cfg_dma_desc_setup(phba, nemb_tp, 0, dmabuf, dmabuf);
4093
4094	/* for the rest of external buffer descriptors if any */
4095	if (ext_buf_cnt > 1) {
4096		ext_buf_index = 1;
4097		list_for_each_entry_safe(curr_dmabuf, next_dmabuf,
4098				&phba->mbox_ext_buf_ctx.ext_dmabuf_list, list) {
4099			lpfc_bsg_sli_cfg_dma_desc_setup(phba, nemb_tp,
4100						ext_buf_index, dmabuf,
4101						curr_dmabuf);
4102			ext_buf_index++;
4103		}
4104	}
4105
4106	/* after dma descriptor setup */
4107	lpfc_idiag_mbxacc_dump_bsg_mbox(phba, nemb_tp, mbox_rd, dma_mbox,
4108					sta_pos_addr, dmabuf, ext_buf_cnt);
4109
4110	/* construct base driver mbox command */
4111	pmb = &pmboxq->u.mb;
4112	pmbx = (uint8_t *)dmabuf->virt;
4113	memcpy(pmb, pmbx, sizeof(*pmb));
4114	pmb->mbxOwner = OWN_HOST;
4115	pmboxq->vport = phba->pport;
4116
4117	/* multi-buffer handling context */
4118	phba->mbox_ext_buf_ctx.nembType = nemb_tp;
4119	phba->mbox_ext_buf_ctx.mboxType = mbox_rd;
4120	phba->mbox_ext_buf_ctx.numBuf = ext_buf_cnt;
4121	phba->mbox_ext_buf_ctx.mbxTag = mbox_req->extMboxTag;
4122	phba->mbox_ext_buf_ctx.seqNum = mbox_req->extSeqNum;
4123	phba->mbox_ext_buf_ctx.mbx_dmabuf = dmabuf;
4124
4125	/* callback for multi-buffer read mailbox command */
4126	pmboxq->mbox_cmpl = lpfc_bsg_issue_read_mbox_ext_cmpl;
4127
4128	/* context fields to callback function */
4129	pmboxq->ctx_u.dd_data = dd_data;
4130	dd_data->type = TYPE_MBOX;
4131	dd_data->set_job = job;
4132	dd_data->context_un.mbox.pmboxq = pmboxq;
4133	dd_data->context_un.mbox.mb = (MAILBOX_t *)pmbx;
4134	job->dd_data = dd_data;
4135
4136	/* state change */
4137	phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_PORT;
4138
4139	/*
4140	 * Non-embedded mailbox subcommand data gets byte swapped here because
4141	 * the lower level driver code only does the first 64 mailbox words.
4142	 */
4143	if ((!bsg_bf_get(lpfc_mbox_hdr_emb,
4144	    &sli_cfg_mbx->un.sli_config_emb0_subsys.sli_config_hdr)) &&
4145		(nemb_tp == nemb_mse))
4146		lpfc_sli_pcimem_bcopy(&pmbx[sizeof(MAILBOX_t)],
4147			&pmbx[sizeof(MAILBOX_t)],
4148				sli_cfg_mbx->un.sli_config_emb0_subsys.
4149					mse[0].buf_len);
4150
4151	rc = lpfc_sli_issue_mbox(phba, pmboxq, MBX_NOWAIT);
4152	if ((rc == MBX_SUCCESS) || (rc == MBX_BUSY)) {
4153		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4154				"2947 Issued SLI_CONFIG ext-buffer "
4155				"mailbox command, rc:x%x\n", rc);
4156		return SLI_CONFIG_HANDLED;
4157	}
4158	lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
4159			"2948 Failed to issue SLI_CONFIG ext-buffer "
4160			"mailbox command, rc:x%x\n", rc);
4161	rc = -EPIPE;
4162
4163job_error:
4164	if (pmboxq)
4165		mempool_free(pmboxq, phba->mbox_mem_pool);
4166	lpfc_bsg_dma_page_list_free(phba,
4167				    &phba->mbox_ext_buf_ctx.ext_dmabuf_list);
4168	kfree(dd_data);
4169	phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_IDLE;
4170	return rc;
4171}
4172
4173/**
4174 * lpfc_bsg_sli_cfg_write_cmd_ext - sli_config non-embedded mailbox cmd write
4175 * @phba: Pointer to HBA context object.
4176 * @job: Pointer to the job object.
4177 * @nemb_tp: Enumerate of non-embedded mailbox command type.
4178 * @dmabuf: Pointer to a DMA buffer descriptor.
4179 *
4180 * This routine performs SLI_CONFIG (0x9B) write mailbox command operation with
4181 * non-embedded external buffers.
4182 **/
4183static int
4184lpfc_bsg_sli_cfg_write_cmd_ext(struct lpfc_hba *phba, struct bsg_job *job,
4185			       enum nemb_type nemb_tp,
4186			       struct lpfc_dmabuf *dmabuf)
4187{
4188	struct fc_bsg_request *bsg_request = job->request;
4189	struct fc_bsg_reply *bsg_reply = job->reply;
4190	struct dfc_mbox_req *mbox_req;
4191	struct lpfc_sli_config_mbox *sli_cfg_mbx;
4192	uint32_t ext_buf_cnt;
4193	struct bsg_job_data *dd_data = NULL;
4194	LPFC_MBOXQ_t *pmboxq = NULL;
4195	MAILBOX_t *pmb;
4196	uint8_t *mbx;
4197	int rc = SLI_CONFIG_NOT_HANDLED, i;
4198
4199	mbox_req =
4200	   (struct dfc_mbox_req *)bsg_request->rqst_data.h_vendor.vendor_cmd;
4201
4202	/* pointer to the start of mailbox command */
4203	sli_cfg_mbx = (struct lpfc_sli_config_mbox *)dmabuf->virt;
4204
4205	if (nemb_tp == nemb_mse) {
4206		ext_buf_cnt = bsg_bf_get(lpfc_mbox_hdr_mse_cnt,
4207			&sli_cfg_mbx->un.sli_config_emb0_subsys.sli_config_hdr);
4208		if (ext_buf_cnt > LPFC_MBX_SLI_CONFIG_MAX_MSE) {
4209			lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
4210					"2953 Failed SLI_CONFIG(mse) wr, "
4211					"ext_buf_cnt(%d) out of range(%d)\n",
4212					ext_buf_cnt,
4213					LPFC_MBX_SLI_CONFIG_MAX_MSE);
4214			return -ERANGE;
4215		}
4216		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4217				"2949 Handled SLI_CONFIG(mse) wr, "
4218				"ext_buf_cnt:%d\n", ext_buf_cnt);
4219	} else {
4220		/* sanity check on interface type for support */
4221		if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) <
4222		    LPFC_SLI_INTF_IF_TYPE_2)
4223			return -ENODEV;
4224		/* nemb_tp == nemb_hbd */
4225		ext_buf_cnt = sli_cfg_mbx->un.sli_config_emb1_subsys.hbd_count;
4226		if (ext_buf_cnt > LPFC_MBX_SLI_CONFIG_MAX_HBD) {
4227			lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
4228					"2954 Failed SLI_CONFIG(hbd) wr, "
4229					"ext_buf_cnt(%d) out of range(%d)\n",
4230					ext_buf_cnt,
4231					LPFC_MBX_SLI_CONFIG_MAX_HBD);
4232			return -ERANGE;
4233		}
4234		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4235				"2950 Handled SLI_CONFIG(hbd) wr, "
4236				"ext_buf_cnt:%d\n", ext_buf_cnt);
4237	}
4238
4239	/* before dma buffer descriptor setup */
4240	lpfc_idiag_mbxacc_dump_bsg_mbox(phba, nemb_tp, mbox_wr, dma_mbox,
4241					sta_pre_addr, dmabuf, ext_buf_cnt);
4242
4243	if (ext_buf_cnt == 0)
4244		return -EPERM;
4245
4246	/* for the first external buffer */
4247	lpfc_bsg_sli_cfg_dma_desc_setup(phba, nemb_tp, 0, dmabuf, dmabuf);
4248
4249	/* after dma descriptor setup */
4250	lpfc_idiag_mbxacc_dump_bsg_mbox(phba, nemb_tp, mbox_wr, dma_mbox,
4251					sta_pos_addr, dmabuf, ext_buf_cnt);
4252
4253	/* log for looking forward */
4254	for (i = 1; i < ext_buf_cnt; i++) {
4255		if (nemb_tp == nemb_mse)
4256			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4257				"2951 SLI_CONFIG(mse), buf[%d]-length:%d\n",
4258				i, sli_cfg_mbx->un.sli_config_emb0_subsys.
4259				mse[i].buf_len);
4260		else
4261			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4262				"2952 SLI_CONFIG(hbd), buf[%d]-length:%d\n",
4263				i, bsg_bf_get(lpfc_mbox_sli_config_ecmn_hbd_len,
4264				&sli_cfg_mbx->un.sli_config_emb1_subsys.
4265				hbd[i]));
4266	}
4267
4268	/* multi-buffer handling context */
4269	phba->mbox_ext_buf_ctx.nembType = nemb_tp;
4270	phba->mbox_ext_buf_ctx.mboxType = mbox_wr;
4271	phba->mbox_ext_buf_ctx.numBuf = ext_buf_cnt;
4272	phba->mbox_ext_buf_ctx.mbxTag = mbox_req->extMboxTag;
4273	phba->mbox_ext_buf_ctx.seqNum = mbox_req->extSeqNum;
4274	phba->mbox_ext_buf_ctx.mbx_dmabuf = dmabuf;
4275
4276	if (ext_buf_cnt == 1) {
4277		/* bsg tracking structure */
4278		dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
4279		if (!dd_data) {
4280			rc = -ENOMEM;
4281			goto job_error;
4282		}
4283
4284		/* mailbox command structure for base driver */
4285		pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
4286		if (!pmboxq) {
4287			rc = -ENOMEM;
4288			goto job_error;
4289		}
4290		memset(pmboxq, 0, sizeof(LPFC_MBOXQ_t));
4291		pmb = &pmboxq->u.mb;
4292		mbx = (uint8_t *)dmabuf->virt;
4293		memcpy(pmb, mbx, sizeof(*pmb));
4294		pmb->mbxOwner = OWN_HOST;
4295		pmboxq->vport = phba->pport;
4296
4297		/* callback for multi-buffer read mailbox command */
4298		pmboxq->mbox_cmpl = lpfc_bsg_issue_write_mbox_ext_cmpl;
4299
4300		/* context fields to callback function */
4301		pmboxq->ctx_u.dd_data = dd_data;
4302		dd_data->type = TYPE_MBOX;
4303		dd_data->set_job = job;
4304		dd_data->context_un.mbox.pmboxq = pmboxq;
4305		dd_data->context_un.mbox.mb = (MAILBOX_t *)mbx;
4306		job->dd_data = dd_data;
4307
4308		/* state change */
4309
4310		phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_PORT;
4311		rc = lpfc_sli_issue_mbox(phba, pmboxq, MBX_NOWAIT);
4312		if ((rc == MBX_SUCCESS) || (rc == MBX_BUSY)) {
4313			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4314					"2955 Issued SLI_CONFIG ext-buffer "
4315					"mailbox command, rc:x%x\n", rc);
4316			return SLI_CONFIG_HANDLED;
4317		}
4318		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
4319				"2956 Failed to issue SLI_CONFIG ext-buffer "
4320				"mailbox command, rc:x%x\n", rc);
4321		rc = -EPIPE;
4322		goto job_error;
4323	}
4324
4325	/* wait for additional external buffers */
4326
4327	bsg_reply->result = 0;
4328	bsg_job_done(job, bsg_reply->result,
4329		       bsg_reply->reply_payload_rcv_len);
4330	return SLI_CONFIG_HANDLED;
4331
4332job_error:
4333	if (pmboxq)
4334		mempool_free(pmboxq, phba->mbox_mem_pool);
4335	kfree(dd_data);
4336
4337	return rc;
4338}
4339
4340/**
4341 * lpfc_bsg_handle_sli_cfg_mbox - handle sli-cfg mailbox cmd with ext buffer
4342 * @phba: Pointer to HBA context object.
4343 * @job: Pointer to the job object.
4344 * @dmabuf: Pointer to a DMA buffer descriptor.
4345 *
4346 * This routine handles SLI_CONFIG (0x9B) mailbox command with non-embedded
4347 * external buffers, including both 0x9B with non-embedded MSEs and 0x9B
4348 * with embedded subsystem 0x1 and opcodes with external HBDs.
4349 **/
4350static int
4351lpfc_bsg_handle_sli_cfg_mbox(struct lpfc_hba *phba, struct bsg_job *job,
4352			     struct lpfc_dmabuf *dmabuf)
4353{
4354	struct lpfc_sli_config_mbox *sli_cfg_mbx;
4355	uint32_t subsys;
4356	uint32_t opcode;
4357	int rc = SLI_CONFIG_NOT_HANDLED;
4358
4359	/* state change on new multi-buffer pass-through mailbox command */
4360	phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_HOST;
4361
4362	sli_cfg_mbx = (struct lpfc_sli_config_mbox *)dmabuf->virt;
4363
4364	if (!bsg_bf_get(lpfc_mbox_hdr_emb,
4365	    &sli_cfg_mbx->un.sli_config_emb0_subsys.sli_config_hdr)) {
4366		subsys = bsg_bf_get(lpfc_emb0_subcmnd_subsys,
4367				    &sli_cfg_mbx->un.sli_config_emb0_subsys);
4368		opcode = bsg_bf_get(lpfc_emb0_subcmnd_opcode,
4369				    &sli_cfg_mbx->un.sli_config_emb0_subsys);
4370		if (subsys == SLI_CONFIG_SUBSYS_FCOE) {
4371			switch (opcode) {
4372			case FCOE_OPCODE_READ_FCF:
4373			case FCOE_OPCODE_GET_DPORT_RESULTS:
4374				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4375						"2957 Handled SLI_CONFIG "
4376						"subsys_fcoe, opcode:x%x\n",
4377						opcode);
4378				rc = lpfc_bsg_sli_cfg_read_cmd_ext(phba, job,
4379							nemb_mse, dmabuf);
4380				break;
4381			case FCOE_OPCODE_ADD_FCF:
4382			case FCOE_OPCODE_SET_DPORT_MODE:
4383			case LPFC_MBOX_OPCODE_FCOE_LINK_DIAG_STATE:
4384				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4385						"2958 Handled SLI_CONFIG "
4386						"subsys_fcoe, opcode:x%x\n",
4387						opcode);
4388				rc = lpfc_bsg_sli_cfg_write_cmd_ext(phba, job,
4389							nemb_mse, dmabuf);
4390				break;
4391			default:
4392				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4393						"2959 Reject SLI_CONFIG "
4394						"subsys_fcoe, opcode:x%x\n",
4395						opcode);
4396				rc = -EPERM;
4397				break;
4398			}
4399		} else if (subsys == SLI_CONFIG_SUBSYS_COMN) {
4400			switch (opcode) {
4401			case COMN_OPCODE_GET_CNTL_ADDL_ATTRIBUTES:
4402			case COMN_OPCODE_GET_CNTL_ATTRIBUTES:
4403			case COMN_OPCODE_GET_PROFILE_CONFIG:
4404			case COMN_OPCODE_SET_FEATURES:
4405			case COMN_OPCODE_READ_OBJECT:
4406				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4407						"3106 Handled SLI_CONFIG "
4408						"subsys_comn, opcode:x%x\n",
4409						opcode);
4410				rc = lpfc_bsg_sli_cfg_read_cmd_ext(phba, job,
4411							nemb_mse, dmabuf);
4412				break;
4413			default:
4414				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4415						"3107 Reject SLI_CONFIG "
4416						"subsys_comn, opcode:x%x\n",
4417						opcode);
4418				rc = -EPERM;
4419				break;
4420			}
4421		} else {
4422			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4423					"2977 Reject SLI_CONFIG "
4424					"subsys:x%d, opcode:x%x\n",
4425					subsys, opcode);
4426			rc = -EPERM;
4427		}
4428	} else {
4429		subsys = bsg_bf_get(lpfc_emb1_subcmnd_subsys,
4430				    &sli_cfg_mbx->un.sli_config_emb1_subsys);
4431		opcode = bsg_bf_get(lpfc_emb1_subcmnd_opcode,
4432				    &sli_cfg_mbx->un.sli_config_emb1_subsys);
4433		if (subsys == SLI_CONFIG_SUBSYS_COMN) {
4434			switch (opcode) {
4435			case COMN_OPCODE_READ_OBJECT:
4436			case COMN_OPCODE_READ_OBJECT_LIST:
4437				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4438						"2960 Handled SLI_CONFIG "
4439						"subsys_comn, opcode:x%x\n",
4440						opcode);
4441				rc = lpfc_bsg_sli_cfg_read_cmd_ext(phba, job,
4442							nemb_hbd, dmabuf);
4443				break;
4444			case COMN_OPCODE_WRITE_OBJECT:
4445				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4446						"2961 Handled SLI_CONFIG "
4447						"subsys_comn, opcode:x%x\n",
4448						opcode);
4449				rc = lpfc_bsg_sli_cfg_write_cmd_ext(phba, job,
4450							nemb_hbd, dmabuf);
4451				break;
4452			default:
4453				lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4454						"2962 Not handled SLI_CONFIG "
4455						"subsys_comn, opcode:x%x\n",
4456						opcode);
4457				rc = SLI_CONFIG_NOT_HANDLED;
4458				break;
4459			}
4460		} else {
4461			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4462					"2978 Not handled SLI_CONFIG "
4463					"subsys:x%d, opcode:x%x\n",
4464					subsys, opcode);
4465			rc = SLI_CONFIG_NOT_HANDLED;
4466		}
4467	}
4468
4469	/* state reset on not handled new multi-buffer mailbox command */
4470	if (rc != SLI_CONFIG_HANDLED)
4471		phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_IDLE;
4472
4473	return rc;
4474}
4475
4476/**
4477 * lpfc_bsg_mbox_ext_abort - request to abort mbox command with ext buffers
4478 * @phba: Pointer to HBA context object.
4479 *
4480 * This routine is for requesting to abort a pass-through mailbox command with
4481 * multiple external buffers due to error condition.
4482 **/
4483static void
4484lpfc_bsg_mbox_ext_abort(struct lpfc_hba *phba)
4485{
4486	if (phba->mbox_ext_buf_ctx.state == LPFC_BSG_MBOX_PORT)
4487		phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_ABTS;
4488	else
4489		lpfc_bsg_mbox_ext_session_reset(phba);
4490	return;
4491}
4492
4493/**
4494 * lpfc_bsg_read_ebuf_get - get the next mailbox read external buffer
4495 * @phba: Pointer to HBA context object.
4496 * @job: Pointer to the job object.
4497 *
4498 * This routine extracts the next mailbox read external buffer back to
4499 * user space through BSG.
4500 **/
4501static int
4502lpfc_bsg_read_ebuf_get(struct lpfc_hba *phba, struct bsg_job *job)
4503{
4504	struct fc_bsg_reply *bsg_reply = job->reply;
4505	struct lpfc_sli_config_mbox *sli_cfg_mbx;
4506	struct lpfc_dmabuf *dmabuf;
4507	uint8_t *pbuf;
4508	uint32_t size;
4509	uint32_t index;
4510
4511	index = phba->mbox_ext_buf_ctx.seqNum;
4512	phba->mbox_ext_buf_ctx.seqNum++;
4513
4514	sli_cfg_mbx = (struct lpfc_sli_config_mbox *)
4515			phba->mbox_ext_buf_ctx.mbx_dmabuf->virt;
4516
4517	if (phba->mbox_ext_buf_ctx.nembType == nemb_mse) {
4518		size = bsg_bf_get(lpfc_mbox_sli_config_mse_len,
4519			&sli_cfg_mbx->un.sli_config_emb0_subsys.mse[index]);
4520		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4521				"2963 SLI_CONFIG (mse) ext-buffer rd get "
4522				"buffer[%d], size:%d\n", index, size);
4523	} else {
4524		size = bsg_bf_get(lpfc_mbox_sli_config_ecmn_hbd_len,
4525			&sli_cfg_mbx->un.sli_config_emb1_subsys.hbd[index]);
4526		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4527				"2964 SLI_CONFIG (hbd) ext-buffer rd get "
4528				"buffer[%d], size:%d\n", index, size);
4529	}
4530	if (list_empty(&phba->mbox_ext_buf_ctx.ext_dmabuf_list))
4531		return -EPIPE;
4532	dmabuf = list_first_entry(&phba->mbox_ext_buf_ctx.ext_dmabuf_list,
4533				  struct lpfc_dmabuf, list);
4534	list_del_init(&dmabuf->list);
4535
4536	/* after dma buffer descriptor setup */
4537	lpfc_idiag_mbxacc_dump_bsg_mbox(phba, phba->mbox_ext_buf_ctx.nembType,
4538					mbox_rd, dma_ebuf, sta_pos_addr,
4539					dmabuf, index);
4540
4541	pbuf = (uint8_t *)dmabuf->virt;
4542	bsg_reply->reply_payload_rcv_len =
4543		sg_copy_from_buffer(job->reply_payload.sg_list,
4544				    job->reply_payload.sg_cnt,
4545				    pbuf, size);
4546
4547	lpfc_bsg_dma_page_free(phba, dmabuf);
4548
4549	if (phba->mbox_ext_buf_ctx.seqNum == phba->mbox_ext_buf_ctx.numBuf) {
4550		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4551				"2965 SLI_CONFIG (hbd) ext-buffer rd mbox "
4552				"command session done\n");
4553		lpfc_bsg_mbox_ext_session_reset(phba);
4554	}
4555
4556	bsg_reply->result = 0;
4557	bsg_job_done(job, bsg_reply->result,
4558		       bsg_reply->reply_payload_rcv_len);
4559
4560	return SLI_CONFIG_HANDLED;
4561}
4562
4563/**
4564 * lpfc_bsg_write_ebuf_set - set the next mailbox write external buffer
4565 * @phba: Pointer to HBA context object.
4566 * @job: Pointer to the job object.
4567 * @dmabuf: Pointer to a DMA buffer descriptor.
4568 *
4569 * This routine sets up the next mailbox read external buffer obtained
4570 * from user space through BSG.
4571 **/
4572static int
4573lpfc_bsg_write_ebuf_set(struct lpfc_hba *phba, struct bsg_job *job,
4574			struct lpfc_dmabuf *dmabuf)
4575{
4576	struct fc_bsg_reply *bsg_reply = job->reply;
4577	struct bsg_job_data *dd_data = NULL;
4578	LPFC_MBOXQ_t *pmboxq = NULL;
4579	MAILBOX_t *pmb;
4580	enum nemb_type nemb_tp;
4581	uint8_t *pbuf;
4582	uint32_t size;
4583	uint32_t index;
4584	int rc;
4585
4586	index = phba->mbox_ext_buf_ctx.seqNum;
4587	phba->mbox_ext_buf_ctx.seqNum++;
4588	nemb_tp = phba->mbox_ext_buf_ctx.nembType;
4589
4590	pbuf = (uint8_t *)dmabuf->virt;
4591	size = job->request_payload.payload_len;
4592	sg_copy_to_buffer(job->request_payload.sg_list,
4593			  job->request_payload.sg_cnt,
4594			  pbuf, size);
4595
4596	if (phba->mbox_ext_buf_ctx.nembType == nemb_mse) {
4597		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4598				"2966 SLI_CONFIG (mse) ext-buffer wr set "
4599				"buffer[%d], size:%d\n",
4600				phba->mbox_ext_buf_ctx.seqNum, size);
4601
4602	} else {
4603		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4604				"2967 SLI_CONFIG (hbd) ext-buffer wr set "
4605				"buffer[%d], size:%d\n",
4606				phba->mbox_ext_buf_ctx.seqNum, size);
4607
4608	}
4609
4610	/* set up external buffer descriptor and add to external buffer list */
4611	lpfc_bsg_sli_cfg_dma_desc_setup(phba, nemb_tp, index,
4612					phba->mbox_ext_buf_ctx.mbx_dmabuf,
4613					dmabuf);
4614	list_add_tail(&dmabuf->list, &phba->mbox_ext_buf_ctx.ext_dmabuf_list);
4615
4616	/* after write dma buffer */
4617	lpfc_idiag_mbxacc_dump_bsg_mbox(phba, phba->mbox_ext_buf_ctx.nembType,
4618					mbox_wr, dma_ebuf, sta_pos_addr,
4619					dmabuf, index);
4620
4621	if (phba->mbox_ext_buf_ctx.seqNum == phba->mbox_ext_buf_ctx.numBuf) {
4622		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4623				"2968 SLI_CONFIG ext-buffer wr all %d "
4624				"ebuffers received\n",
4625				phba->mbox_ext_buf_ctx.numBuf);
4626
4627		dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
4628		if (!dd_data) {
4629			rc = -ENOMEM;
4630			goto job_error;
4631		}
4632
4633		/* mailbox command structure for base driver */
4634		pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
4635		if (!pmboxq) {
4636			rc = -ENOMEM;
4637			goto job_error;
4638		}
4639		memset(pmboxq, 0, sizeof(LPFC_MBOXQ_t));
4640		pbuf = (uint8_t *)phba->mbox_ext_buf_ctx.mbx_dmabuf->virt;
4641		pmb = &pmboxq->u.mb;
4642		memcpy(pmb, pbuf, sizeof(*pmb));
4643		pmb->mbxOwner = OWN_HOST;
4644		pmboxq->vport = phba->pport;
4645
4646		/* callback for multi-buffer write mailbox command */
4647		pmboxq->mbox_cmpl = lpfc_bsg_issue_write_mbox_ext_cmpl;
4648
4649		/* context fields to callback function */
4650		pmboxq->ctx_u.dd_data = dd_data;
4651		dd_data->type = TYPE_MBOX;
4652		dd_data->set_job = job;
4653		dd_data->context_un.mbox.pmboxq = pmboxq;
4654		dd_data->context_un.mbox.mb = (MAILBOX_t *)pbuf;
4655		job->dd_data = dd_data;
4656
4657		/* state change */
4658		phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_PORT;
4659
4660		rc = lpfc_sli_issue_mbox(phba, pmboxq, MBX_NOWAIT);
4661		if ((rc == MBX_SUCCESS) || (rc == MBX_BUSY)) {
4662			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4663					"2969 Issued SLI_CONFIG ext-buffer "
4664					"mailbox command, rc:x%x\n", rc);
4665			return SLI_CONFIG_HANDLED;
4666		}
4667		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
4668				"2970 Failed to issue SLI_CONFIG ext-buffer "
4669				"mailbox command, rc:x%x\n", rc);
4670		rc = -EPIPE;
4671		goto job_error;
4672	}
4673
4674	/* wait for additional external buffers */
4675	bsg_reply->result = 0;
4676	bsg_job_done(job, bsg_reply->result,
4677		       bsg_reply->reply_payload_rcv_len);
4678	return SLI_CONFIG_HANDLED;
4679
4680job_error:
4681	if (pmboxq)
4682		mempool_free(pmboxq, phba->mbox_mem_pool);
4683	lpfc_bsg_dma_page_free(phba, dmabuf);
4684	kfree(dd_data);
4685
4686	return rc;
4687}
4688
4689/**
4690 * lpfc_bsg_handle_sli_cfg_ebuf - handle ext buffer with sli-cfg mailbox cmd
4691 * @phba: Pointer to HBA context object.
4692 * @job: Pointer to the job object.
4693 * @dmabuf: Pointer to a DMA buffer descriptor.
4694 *
4695 * This routine handles the external buffer with SLI_CONFIG (0x9B) mailbox
4696 * command with multiple non-embedded external buffers.
4697 **/
4698static int
4699lpfc_bsg_handle_sli_cfg_ebuf(struct lpfc_hba *phba, struct bsg_job *job,
4700			     struct lpfc_dmabuf *dmabuf)
4701{
4702	int rc;
4703
4704	lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4705			"2971 SLI_CONFIG buffer (type:x%x)\n",
4706			phba->mbox_ext_buf_ctx.mboxType);
4707
4708	if (phba->mbox_ext_buf_ctx.mboxType == mbox_rd) {
4709		if (phba->mbox_ext_buf_ctx.state != LPFC_BSG_MBOX_DONE) {
4710			lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
4711					"2972 SLI_CONFIG rd buffer state "
4712					"mismatch:x%x\n",
4713					phba->mbox_ext_buf_ctx.state);
4714			lpfc_bsg_mbox_ext_abort(phba);
4715			return -EPIPE;
4716		}
4717		rc = lpfc_bsg_read_ebuf_get(phba, job);
4718		if (rc == SLI_CONFIG_HANDLED)
4719			lpfc_bsg_dma_page_free(phba, dmabuf);
4720	} else { /* phba->mbox_ext_buf_ctx.mboxType == mbox_wr */
4721		if (phba->mbox_ext_buf_ctx.state != LPFC_BSG_MBOX_HOST) {
4722			lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
4723					"2973 SLI_CONFIG wr buffer state "
4724					"mismatch:x%x\n",
4725					phba->mbox_ext_buf_ctx.state);
4726			lpfc_bsg_mbox_ext_abort(phba);
4727			return -EPIPE;
4728		}
4729		rc = lpfc_bsg_write_ebuf_set(phba, job, dmabuf);
4730	}
4731	return rc;
4732}
4733
4734/**
4735 * lpfc_bsg_handle_sli_cfg_ext - handle sli-cfg mailbox with external buffer
4736 * @phba: Pointer to HBA context object.
4737 * @job: Pointer to the job object.
4738 * @dmabuf: Pointer to a DMA buffer descriptor.
4739 *
4740 * This routine checks and handles non-embedded multi-buffer SLI_CONFIG
4741 * (0x9B) mailbox commands and external buffers.
4742 **/
4743static int
4744lpfc_bsg_handle_sli_cfg_ext(struct lpfc_hba *phba, struct bsg_job *job,
4745			    struct lpfc_dmabuf *dmabuf)
4746{
4747	struct fc_bsg_request *bsg_request = job->request;
4748	struct dfc_mbox_req *mbox_req;
4749	int rc = SLI_CONFIG_NOT_HANDLED;
4750
4751	mbox_req =
4752	   (struct dfc_mbox_req *)bsg_request->rqst_data.h_vendor.vendor_cmd;
4753
4754	/* mbox command with/without single external buffer */
4755	if (mbox_req->extMboxTag == 0 && mbox_req->extSeqNum == 0)
4756		return rc;
4757
4758	/* mbox command and first external buffer */
4759	if (phba->mbox_ext_buf_ctx.state == LPFC_BSG_MBOX_IDLE) {
4760		if (mbox_req->extSeqNum == 1) {
4761			lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4762					"2974 SLI_CONFIG mailbox: tag:%d, "
4763					"seq:%d\n", mbox_req->extMboxTag,
4764					mbox_req->extSeqNum);
4765			rc = lpfc_bsg_handle_sli_cfg_mbox(phba, job, dmabuf);
4766			return rc;
4767		} else
4768			goto sli_cfg_ext_error;
4769	}
4770
4771	/*
4772	 * handle additional external buffers
4773	 */
4774
4775	/* check broken pipe conditions */
4776	if (mbox_req->extMboxTag != phba->mbox_ext_buf_ctx.mbxTag)
4777		goto sli_cfg_ext_error;
4778	if (mbox_req->extSeqNum > phba->mbox_ext_buf_ctx.numBuf)
4779		goto sli_cfg_ext_error;
4780	if (mbox_req->extSeqNum != phba->mbox_ext_buf_ctx.seqNum + 1)
4781		goto sli_cfg_ext_error;
4782
4783	lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
4784			"2975 SLI_CONFIG mailbox external buffer: "
4785			"extSta:x%x, tag:%d, seq:%d\n",
4786			phba->mbox_ext_buf_ctx.state, mbox_req->extMboxTag,
4787			mbox_req->extSeqNum);
4788	rc = lpfc_bsg_handle_sli_cfg_ebuf(phba, job, dmabuf);
4789	return rc;
4790
4791sli_cfg_ext_error:
4792	/* all other cases, broken pipe */
4793	lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
4794			"2976 SLI_CONFIG mailbox broken pipe: "
4795			"ctxSta:x%x, ctxNumBuf:%d "
4796			"ctxTag:%d, ctxSeq:%d, tag:%d, seq:%d\n",
4797			phba->mbox_ext_buf_ctx.state,
4798			phba->mbox_ext_buf_ctx.numBuf,
4799			phba->mbox_ext_buf_ctx.mbxTag,
4800			phba->mbox_ext_buf_ctx.seqNum,
4801			mbox_req->extMboxTag, mbox_req->extSeqNum);
4802
4803	lpfc_bsg_mbox_ext_session_reset(phba);
4804
4805	return -EPIPE;
4806}
4807
4808/**
4809 * lpfc_bsg_issue_mbox - issues a mailbox command on behalf of an app
4810 * @phba: Pointer to HBA context object.
4811 * @job: Pointer to the job object.
4812 * @vport: Pointer to a vport object.
4813 *
4814 * Allocate a tracking object, mailbox command memory, get a mailbox
4815 * from the mailbox pool, copy the caller mailbox command.
4816 *
4817 * If offline and the sli is active we need to poll for the command (port is
4818 * being reset) and complete the job, otherwise issue the mailbox command and
4819 * let our completion handler finish the command.
4820 **/
4821static int
4822lpfc_bsg_issue_mbox(struct lpfc_hba *phba, struct bsg_job *job,
4823	struct lpfc_vport *vport)
4824{
4825	struct fc_bsg_request *bsg_request = job->request;
4826	struct fc_bsg_reply *bsg_reply = job->reply;
4827	LPFC_MBOXQ_t *pmboxq = NULL; /* internal mailbox queue */
4828	MAILBOX_t *pmb; /* shortcut to the pmboxq mailbox */
4829	/* a 4k buffer to hold the mb and extended data from/to the bsg */
4830	uint8_t *pmbx = NULL;
4831	struct bsg_job_data *dd_data = NULL; /* bsg data tracking structure */
4832	struct lpfc_dmabuf *dmabuf = NULL;
4833	struct dfc_mbox_req *mbox_req;
4834	struct READ_EVENT_LOG_VAR *rdEventLog;
4835	uint32_t transmit_length, receive_length, mode;
4836	struct lpfc_mbx_sli4_config *sli4_config;
4837	struct lpfc_mbx_nembed_cmd *nembed_sge;
4838	struct ulp_bde64 *bde;
4839	uint8_t *ext = NULL;
4840	int rc = 0;
4841	uint8_t *from;
4842	uint32_t size;
4843
4844	/* in case no data is transferred */
4845	bsg_reply->reply_payload_rcv_len = 0;
4846
4847	/* sanity check to protect driver */
4848	if (job->request_payload.payload_len > BSG_MBOX_SIZE) {
4849		rc = -ERANGE;
4850		goto job_done;
4851	}
4852
4853	/*
4854	 * Don't allow mailbox commands to be sent when blocked or when in
4855	 * the middle of discovery
4856	 */
4857	if (phba->sli.sli_flag & LPFC_BLOCK_MGMT_IO) {
4858		rc = -EAGAIN;
4859		goto job_done;
4860	}
4861
4862	mbox_req =
4863	    (struct dfc_mbox_req *)bsg_request->rqst_data.h_vendor.vendor_cmd;
4864
4865	/* check if requested extended data lengths are valid */
4866	if ((mbox_req->inExtWLen > BSG_MBOX_SIZE/sizeof(uint32_t)) ||
4867	    (mbox_req->outExtWLen > BSG_MBOX_SIZE/sizeof(uint32_t))) {
4868		rc = -ERANGE;
4869		goto job_done;
4870	}
4871
4872	dmabuf = lpfc_bsg_dma_page_alloc(phba);
4873	if (!dmabuf || !dmabuf->virt) {
4874		rc = -ENOMEM;
4875		goto job_done;
4876	}
4877
4878	/* Get the mailbox command or external buffer from BSG */
4879	pmbx = (uint8_t *)dmabuf->virt;
4880	size = job->request_payload.payload_len;
4881	sg_copy_to_buffer(job->request_payload.sg_list,
4882			  job->request_payload.sg_cnt, pmbx, size);
4883
4884	/* Handle possible SLI_CONFIG with non-embedded payloads */
4885	if (phba->sli_rev == LPFC_SLI_REV4) {
4886		rc = lpfc_bsg_handle_sli_cfg_ext(phba, job, dmabuf);
4887		if (rc == SLI_CONFIG_HANDLED)
4888			goto job_cont;
4889		if (rc)
4890			goto job_done;
4891		/* SLI_CONFIG_NOT_HANDLED for other mailbox commands */
4892	}
4893
4894	rc = lpfc_bsg_check_cmd_access(phba, (MAILBOX_t *)pmbx, vport);
4895	if (rc != 0)
4896		goto job_done; /* must be negative */
4897
4898	/* allocate our bsg tracking structure */
4899	dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
4900	if (!dd_data) {
4901		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
4902				"2727 Failed allocation of dd_data\n");
4903		rc = -ENOMEM;
4904		goto job_done;
4905	}
4906
4907	pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
4908	if (!pmboxq) {
4909		rc = -ENOMEM;
4910		goto job_done;
4911	}
4912	memset(pmboxq, 0, sizeof(LPFC_MBOXQ_t));
4913
4914	pmb = &pmboxq->u.mb;
4915	memcpy(pmb, pmbx, sizeof(*pmb));
4916	pmb->mbxOwner = OWN_HOST;
4917	pmboxq->vport = vport;
4918
4919	/* non-embedded SLI_CONFIG requests already parsed, check others */
4920	if (unlikely(job->reply_payload.payload_len > BSG_MBOX_SIZE)) {
4921		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
4922				"2729 Cmd x%x (x%x/x%x) request has "
4923				"out-of-range reply payload length x%x\n",
4924				pmb->mbxCommand,
4925				lpfc_sli_config_mbox_subsys_get(phba, pmboxq),
4926				lpfc_sli_config_mbox_opcode_get(phba, pmboxq),
4927				job->reply_payload.payload_len);
4928		rc = -ERANGE;
4929		goto job_done;
4930	}
4931
4932	/* If HBA encountered an error attention, allow only DUMP
4933	 * or RESTART mailbox commands until the HBA is restarted.
4934	 */
4935	if (phba->pport->stopped &&
4936	    pmb->mbxCommand != MBX_DUMP_MEMORY &&
4937	    pmb->mbxCommand != MBX_RESTART &&
4938	    pmb->mbxCommand != MBX_WRITE_VPARMS &&
4939	    pmb->mbxCommand != MBX_WRITE_WWN)
4940		lpfc_printf_log(phba, KERN_WARNING, LOG_MBOX,
4941				"2797 mbox: Issued mailbox cmd "
4942				"0x%x while in stopped state.\n",
4943				pmb->mbxCommand);
4944
4945	/* extended mailbox commands will need an extended buffer */
4946	if (mbox_req->inExtWLen || mbox_req->outExtWLen) {
4947		from = pmbx;
4948		ext = from + sizeof(MAILBOX_t);
4949		pmboxq->ext_buf = ext;
4950		pmboxq->in_ext_byte_len =
4951			mbox_req->inExtWLen * sizeof(uint32_t);
4952		pmboxq->out_ext_byte_len =
4953			mbox_req->outExtWLen * sizeof(uint32_t);
4954		pmboxq->mbox_offset_word = mbox_req->mbOffset;
4955	}
4956
4957	/* biu diag will need a kernel buffer to transfer the data
4958	 * allocate our own buffer and setup the mailbox command to
4959	 * use ours
4960	 */
4961	if (pmb->mbxCommand == MBX_RUN_BIU_DIAG64) {
4962		transmit_length = pmb->un.varWords[1];
4963		receive_length = pmb->un.varWords[4];
4964		/* transmit length cannot be greater than receive length or
4965		 * mailbox extension size
4966		 */
4967		if ((transmit_length > receive_length) ||
4968			(transmit_length > BSG_MBOX_SIZE - sizeof(MAILBOX_t))) {
4969			rc = -ERANGE;
4970			goto job_done;
4971		}
4972		pmb->un.varBIUdiag.un.s2.xmit_bde64.addrHigh =
4973			putPaddrHigh(dmabuf->phys + sizeof(MAILBOX_t));
4974		pmb->un.varBIUdiag.un.s2.xmit_bde64.addrLow =
4975			putPaddrLow(dmabuf->phys + sizeof(MAILBOX_t));
4976
4977		pmb->un.varBIUdiag.un.s2.rcv_bde64.addrHigh =
4978			putPaddrHigh(dmabuf->phys + sizeof(MAILBOX_t)
4979			  + pmb->un.varBIUdiag.un.s2.xmit_bde64.tus.f.bdeSize);
4980		pmb->un.varBIUdiag.un.s2.rcv_bde64.addrLow =
4981			putPaddrLow(dmabuf->phys + sizeof(MAILBOX_t)
4982			  + pmb->un.varBIUdiag.un.s2.xmit_bde64.tus.f.bdeSize);
4983	} else if (pmb->mbxCommand == MBX_READ_EVENT_LOG) {
4984		rdEventLog = &pmb->un.varRdEventLog;
4985		receive_length = rdEventLog->rcv_bde64.tus.f.bdeSize;
4986		mode = bf_get(lpfc_event_log, rdEventLog);
4987
4988		/* receive length cannot be greater than mailbox
4989		 * extension size
4990		 */
4991		if (receive_length > BSG_MBOX_SIZE - sizeof(MAILBOX_t)) {
4992			rc = -ERANGE;
4993			goto job_done;
4994		}
4995
4996		/* mode zero uses a bde like biu diags command */
4997		if (mode == 0) {
4998			pmb->un.varWords[3] = putPaddrLow(dmabuf->phys
4999							+ sizeof(MAILBOX_t));
5000			pmb->un.varWords[4] = putPaddrHigh(dmabuf->phys
5001							+ sizeof(MAILBOX_t));
5002		}
5003	} else if (phba->sli_rev == LPFC_SLI_REV4) {
5004		/* Let type 4 (well known data) through because the data is
5005		 * returned in varwords[4-8]
5006		 * otherwise check the recieve length and fetch the buffer addr
5007		 */
5008		if ((pmb->mbxCommand == MBX_DUMP_MEMORY) &&
5009			(pmb->un.varDmp.type != DMP_WELL_KNOWN)) {
5010			/* rebuild the command for sli4 using our own buffers
5011			* like we do for biu diags
5012			*/
5013			receive_length = pmb->un.varWords[2];
5014			/* receive length cannot be greater than mailbox
5015			 * extension size
5016			 */
5017			if (receive_length == 0) {
5018				rc = -ERANGE;
5019				goto job_done;
5020			}
5021			pmb->un.varWords[3] = putPaddrLow(dmabuf->phys
5022						+ sizeof(MAILBOX_t));
5023			pmb->un.varWords[4] = putPaddrHigh(dmabuf->phys
5024						+ sizeof(MAILBOX_t));
5025		} else if ((pmb->mbxCommand == MBX_UPDATE_CFG) &&
5026			pmb->un.varUpdateCfg.co) {
5027			bde = (struct ulp_bde64 *)&pmb->un.varWords[4];
5028
5029			/* bde size cannot be greater than mailbox ext size */
5030			if (bde->tus.f.bdeSize >
5031			    BSG_MBOX_SIZE - sizeof(MAILBOX_t)) {
5032				rc = -ERANGE;
5033				goto job_done;
5034			}
5035			bde->addrHigh = putPaddrHigh(dmabuf->phys
5036						+ sizeof(MAILBOX_t));
5037			bde->addrLow = putPaddrLow(dmabuf->phys
5038						+ sizeof(MAILBOX_t));
5039		} else if (pmb->mbxCommand == MBX_SLI4_CONFIG) {
5040			/* Handling non-embedded SLI_CONFIG mailbox command */
5041			sli4_config = &pmboxq->u.mqe.un.sli4_config;
5042			if (!bf_get(lpfc_mbox_hdr_emb,
5043			    &sli4_config->header.cfg_mhdr)) {
5044				/* rebuild the command for sli4 using our
5045				 * own buffers like we do for biu diags
5046				 */
5047				nembed_sge = (struct lpfc_mbx_nembed_cmd *)
5048						&pmb->un.varWords[0];
5049				receive_length = nembed_sge->sge[0].length;
5050
5051				/* receive length cannot be greater than
5052				 * mailbox extension size
5053				 */
5054				if ((receive_length == 0) ||
5055				    (receive_length >
5056				     BSG_MBOX_SIZE - sizeof(MAILBOX_t))) {
5057					rc = -ERANGE;
5058					goto job_done;
5059				}
5060
5061				nembed_sge->sge[0].pa_hi =
5062						putPaddrHigh(dmabuf->phys
5063						   + sizeof(MAILBOX_t));
5064				nembed_sge->sge[0].pa_lo =
5065						putPaddrLow(dmabuf->phys
5066						   + sizeof(MAILBOX_t));
5067			}
5068		}
5069	}
5070
5071	dd_data->context_un.mbox.dmabuffers = dmabuf;
5072
5073	/* setup wake call as IOCB callback */
5074	pmboxq->mbox_cmpl = lpfc_bsg_issue_mbox_cmpl;
5075
5076	/* setup context field to pass wait_queue pointer to wake function */
5077	pmboxq->ctx_u.dd_data = dd_data;
5078	dd_data->type = TYPE_MBOX;
5079	dd_data->set_job = job;
5080	dd_data->context_un.mbox.pmboxq = pmboxq;
5081	dd_data->context_un.mbox.mb = (MAILBOX_t *)pmbx;
5082	dd_data->context_un.mbox.ext = ext;
5083	dd_data->context_un.mbox.mbOffset = mbox_req->mbOffset;
5084	dd_data->context_un.mbox.inExtWLen = mbox_req->inExtWLen;
5085	dd_data->context_un.mbox.outExtWLen = mbox_req->outExtWLen;
5086	job->dd_data = dd_data;
5087
5088	if (test_bit(FC_OFFLINE_MODE, &vport->fc_flag) ||
5089	    (!(phba->sli.sli_flag & LPFC_SLI_ACTIVE))) {
5090		rc = lpfc_sli_issue_mbox(phba, pmboxq, MBX_POLL);
5091		if (rc != MBX_SUCCESS) {
5092			rc = (rc == MBX_TIMEOUT) ? -ETIME : -ENODEV;
5093			goto job_done;
5094		}
5095
5096		/* job finished, copy the data */
5097		memcpy(pmbx, pmb, sizeof(*pmb));
5098		bsg_reply->reply_payload_rcv_len =
5099			sg_copy_from_buffer(job->reply_payload.sg_list,
5100					    job->reply_payload.sg_cnt,
5101					    pmbx, size);
5102		/* not waiting mbox already done */
5103		rc = 0;
5104		goto job_done;
5105	}
5106
5107	rc = lpfc_sli_issue_mbox(phba, pmboxq, MBX_NOWAIT);
5108	if ((rc == MBX_SUCCESS) || (rc == MBX_BUSY))
5109		return 1; /* job started */
5110
5111job_done:
5112	/* common exit for error or job completed inline */
5113	if (pmboxq)
5114		mempool_free(pmboxq, phba->mbox_mem_pool);
5115	lpfc_bsg_dma_page_free(phba, dmabuf);
5116	kfree(dd_data);
5117
5118job_cont:
5119	return rc;
5120}
5121
5122/**
5123 * lpfc_bsg_mbox_cmd - process an fc bsg LPFC_BSG_VENDOR_MBOX command
5124 * @job: MBOX fc_bsg_job for LPFC_BSG_VENDOR_MBOX.
5125 **/
5126static int
5127lpfc_bsg_mbox_cmd(struct bsg_job *job)
5128{
5129	struct lpfc_vport *vport = shost_priv(fc_bsg_to_shost(job));
5130	struct fc_bsg_request *bsg_request = job->request;
5131	struct fc_bsg_reply *bsg_reply = job->reply;
5132	struct lpfc_hba *phba = vport->phba;
5133	struct dfc_mbox_req *mbox_req;
5134	int rc = 0;
5135
5136	/* mix-and-match backward compatibility */
5137	bsg_reply->reply_payload_rcv_len = 0;
5138	if (job->request_len <
5139	    sizeof(struct fc_bsg_request) + sizeof(struct dfc_mbox_req)) {
5140		lpfc_printf_log(phba, KERN_INFO, LOG_LIBDFC,
5141				"2737 Mix-and-match backward compatibility "
5142				"between MBOX_REQ old size:%d and "
5143				"new request size:%d\n",
5144				(int)(job->request_len -
5145				      sizeof(struct fc_bsg_request)),
5146				(int)sizeof(struct dfc_mbox_req));
5147		mbox_req = (struct dfc_mbox_req *)
5148				bsg_request->rqst_data.h_vendor.vendor_cmd;
5149		mbox_req->extMboxTag = 0;
5150		mbox_req->extSeqNum = 0;
5151	}
5152
5153	rc = lpfc_bsg_issue_mbox(phba, job, vport);
5154
5155	if (rc == 0) {
5156		/* job done */
5157		bsg_reply->result = 0;
5158		job->dd_data = NULL;
5159		bsg_job_done(job, bsg_reply->result,
5160			       bsg_reply->reply_payload_rcv_len);
5161	} else if (rc == 1)
5162		/* job submitted, will complete later*/
5163		rc = 0; /* return zero, no error */
5164	else {
5165		/* some error occurred */
5166		bsg_reply->result = rc;
5167		job->dd_data = NULL;
5168	}
5169
5170	return rc;
5171}
5172
5173static int
5174lpfc_forced_link_speed(struct bsg_job *job)
5175{
5176	struct Scsi_Host *shost = fc_bsg_to_shost(job);
5177	struct lpfc_vport *vport = shost_priv(shost);
5178	struct lpfc_hba *phba = vport->phba;
5179	struct fc_bsg_reply *bsg_reply = job->reply;
5180	struct forced_link_speed_support_reply *forced_reply;
5181	int rc = 0;
5182
5183	if (job->request_len <
5184	    sizeof(struct fc_bsg_request) +
5185	    sizeof(struct get_forced_link_speed_support)) {
5186		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
5187				"0048 Received FORCED_LINK_SPEED request "
5188				"below minimum size\n");
5189		rc = -EINVAL;
5190		goto job_error;
5191	}
5192
5193	forced_reply = (struct forced_link_speed_support_reply *)
5194		bsg_reply->reply_data.vendor_reply.vendor_rsp;
5195
5196	if (job->reply_len < sizeof(*bsg_reply) + sizeof(*forced_reply)) {
5197		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
5198				"0049 Received FORCED_LINK_SPEED reply below "
5199				"minimum size\n");
5200		rc = -EINVAL;
5201		goto job_error;
5202	}
5203
5204	forced_reply->supported = test_bit(HBA_FORCED_LINK_SPEED,
5205					   &phba->hba_flag)
5206				   ? LPFC_FORCED_LINK_SPEED_SUPPORTED
5207				   : LPFC_FORCED_LINK_SPEED_NOT_SUPPORTED;
5208job_error:
5209	bsg_reply->result = rc;
5210	if (rc == 0)
5211		bsg_job_done(job, bsg_reply->result,
5212			       bsg_reply->reply_payload_rcv_len);
5213	return rc;
5214}
5215
5216/**
5217 * lpfc_check_fwlog_support: Check FW log support on the adapter
5218 * @phba: Pointer to HBA context object.
5219 *
5220 * Check if FW Logging support by the adapter
5221 **/
5222int
5223lpfc_check_fwlog_support(struct lpfc_hba *phba)
5224{
5225	struct lpfc_ras_fwlog *ras_fwlog = NULL;
5226
5227	ras_fwlog = &phba->ras_fwlog;
5228
5229	if (!ras_fwlog->ras_hwsupport)
5230		return -EACCES;
5231	else if (!ras_fwlog->ras_enabled)
5232		return -EPERM;
5233	else
5234		return 0;
5235}
5236
5237/**
5238 * lpfc_bsg_get_ras_config: Get RAS configuration settings
5239 * @job: fc_bsg_job to handle
5240 *
5241 * Get RAS configuration values set.
5242 **/
5243static int
5244lpfc_bsg_get_ras_config(struct bsg_job *job)
5245{
5246	struct Scsi_Host *shost = fc_bsg_to_shost(job);
5247	struct lpfc_vport *vport = shost_priv(shost);
5248	struct fc_bsg_reply *bsg_reply = job->reply;
5249	struct lpfc_hba *phba = vport->phba;
5250	struct lpfc_bsg_get_ras_config_reply *ras_reply;
5251	struct lpfc_ras_fwlog *ras_fwlog = &phba->ras_fwlog;
5252	int rc = 0;
5253
5254	if (job->request_len <
5255	    sizeof(struct fc_bsg_request) +
5256	    sizeof(struct lpfc_bsg_ras_req)) {
5257		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
5258				"6192 FW_LOG request received "
5259				"below minimum size\n");
5260		rc = -EINVAL;
5261		goto ras_job_error;
5262	}
5263
5264	/* Check FW log status */
5265	rc = lpfc_check_fwlog_support(phba);
5266	if (rc)
5267		goto ras_job_error;
5268
5269	ras_reply = (struct lpfc_bsg_get_ras_config_reply *)
5270		bsg_reply->reply_data.vendor_reply.vendor_rsp;
5271
5272	/* Current logging state */
5273	spin_lock_irq(&phba->ras_fwlog_lock);
5274	if (ras_fwlog->state == ACTIVE)
5275		ras_reply->state = LPFC_RASLOG_STATE_RUNNING;
5276	else
5277		ras_reply->state = LPFC_RASLOG_STATE_STOPPED;
5278	spin_unlock_irq(&phba->ras_fwlog_lock);
5279
5280	ras_reply->log_level = phba->ras_fwlog.fw_loglevel;
5281	ras_reply->log_buff_sz = phba->cfg_ras_fwlog_buffsize;
5282
5283ras_job_error:
5284	/* make error code available to userspace */
5285	bsg_reply->result = rc;
5286
5287	/* complete the job back to userspace */
5288	if (!rc)
5289		bsg_job_done(job, bsg_reply->result,
5290			     bsg_reply->reply_payload_rcv_len);
5291	return rc;
5292}
5293
5294/**
5295 * lpfc_bsg_set_ras_config: Set FW logging parameters
5296 * @job: fc_bsg_job to handle
5297 *
5298 * Set log-level parameters for FW-logging in host memory
5299 **/
5300static int
5301lpfc_bsg_set_ras_config(struct bsg_job *job)
5302{
5303	struct Scsi_Host *shost = fc_bsg_to_shost(job);
5304	struct lpfc_vport *vport = shost_priv(shost);
5305	struct lpfc_hba *phba = vport->phba;
5306	struct lpfc_bsg_set_ras_config_req *ras_req;
5307	struct fc_bsg_request *bsg_request = job->request;
5308	struct lpfc_ras_fwlog *ras_fwlog = &phba->ras_fwlog;
5309	struct fc_bsg_reply *bsg_reply = job->reply;
5310	uint8_t action = 0, log_level = 0;
5311	int rc = 0, action_status = 0;
5312
5313	if (job->request_len <
5314	    sizeof(struct fc_bsg_request) +
5315	    sizeof(struct lpfc_bsg_set_ras_config_req)) {
5316		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
5317				"6182 Received RAS_LOG request "
5318				"below minimum size\n");
5319		rc = -EINVAL;
5320		goto ras_job_error;
5321	}
5322
5323	/* Check FW log status */
5324	rc = lpfc_check_fwlog_support(phba);
5325	if (rc)
5326		goto ras_job_error;
5327
5328	ras_req = (struct lpfc_bsg_set_ras_config_req *)
5329		bsg_request->rqst_data.h_vendor.vendor_cmd;
5330	action = ras_req->action;
5331	log_level = ras_req->log_level;
5332
5333	if (action == LPFC_RASACTION_STOP_LOGGING) {
5334		/* Check if already disabled */
5335		spin_lock_irq(&phba->ras_fwlog_lock);
5336		if (ras_fwlog->state != ACTIVE) {
5337			spin_unlock_irq(&phba->ras_fwlog_lock);
5338			rc = -ESRCH;
5339			goto ras_job_error;
5340		}
5341		spin_unlock_irq(&phba->ras_fwlog_lock);
5342
5343		/* Disable logging */
5344		lpfc_ras_stop_fwlog(phba);
5345	} else {
5346		/*action = LPFC_RASACTION_START_LOGGING*/
5347
5348		/* Even though FW-logging is active re-initialize
5349		 * FW-logging with new log-level. Return status
5350		 * "Logging already Running" to caller.
5351		 **/
5352		spin_lock_irq(&phba->ras_fwlog_lock);
5353		if (ras_fwlog->state != INACTIVE)
5354			action_status = -EINPROGRESS;
5355		spin_unlock_irq(&phba->ras_fwlog_lock);
5356
5357		/* Enable logging */
5358		rc = lpfc_sli4_ras_fwlog_init(phba, log_level,
5359					      LPFC_RAS_ENABLE_LOGGING);
5360		if (rc) {
5361			rc = -EINVAL;
5362			goto ras_job_error;
5363		}
5364
5365		/* Check if FW-logging is re-initialized */
5366		if (action_status == -EINPROGRESS)
5367			rc = action_status;
5368	}
5369ras_job_error:
5370	/* make error code available to userspace */
5371	bsg_reply->result = rc;
5372
5373	/* complete the job back to userspace */
5374	if (!rc)
5375		bsg_job_done(job, bsg_reply->result,
5376			     bsg_reply->reply_payload_rcv_len);
5377
5378	return rc;
5379}
5380
5381/**
5382 * lpfc_bsg_get_ras_lwpd: Get log write position data
5383 * @job: fc_bsg_job to handle
5384 *
5385 * Get Offset/Wrap count of the log message written
5386 * in host memory
5387 **/
5388static int
5389lpfc_bsg_get_ras_lwpd(struct bsg_job *job)
5390{
5391	struct Scsi_Host *shost = fc_bsg_to_shost(job);
5392	struct lpfc_vport *vport = shost_priv(shost);
5393	struct lpfc_bsg_get_ras_lwpd *ras_reply;
5394	struct lpfc_hba *phba = vport->phba;
5395	struct lpfc_ras_fwlog *ras_fwlog = &phba->ras_fwlog;
5396	struct fc_bsg_reply *bsg_reply = job->reply;
5397	u32 *lwpd_ptr = NULL;
5398	int rc = 0;
5399
5400	rc = lpfc_check_fwlog_support(phba);
5401	if (rc)
5402		goto ras_job_error;
5403
5404	if (job->request_len <
5405	    sizeof(struct fc_bsg_request) +
5406	    sizeof(struct lpfc_bsg_ras_req)) {
5407		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
5408				"6183 Received RAS_LOG request "
5409				"below minimum size\n");
5410		rc = -EINVAL;
5411		goto ras_job_error;
5412	}
5413
5414	ras_reply = (struct lpfc_bsg_get_ras_lwpd *)
5415		bsg_reply->reply_data.vendor_reply.vendor_rsp;
5416
5417	if (!ras_fwlog->lwpd.virt) {
5418		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
5419				"6193 Restart FW Logging\n");
5420		rc = -EINVAL;
5421		goto ras_job_error;
5422	}
5423
5424	/* Get lwpd offset */
5425	lwpd_ptr = (uint32_t *)(ras_fwlog->lwpd.virt);
5426	ras_reply->offset = be32_to_cpu(*lwpd_ptr & 0xffffffff);
5427
5428	/* Get wrap count */
5429	ras_reply->wrap_count = be32_to_cpu(*(++lwpd_ptr) & 0xffffffff);
5430
5431ras_job_error:
5432	/* make error code available to userspace */
5433	bsg_reply->result = rc;
5434
5435	/* complete the job back to userspace */
5436	if (!rc)
5437		bsg_job_done(job, bsg_reply->result,
5438			     bsg_reply->reply_payload_rcv_len);
5439
5440	return rc;
5441}
5442
5443/**
5444 * lpfc_bsg_get_ras_fwlog: Read FW log
5445 * @job: fc_bsg_job to handle
5446 *
5447 * Copy the FW log into the passed buffer.
5448 **/
5449static int
5450lpfc_bsg_get_ras_fwlog(struct bsg_job *job)
5451{
5452	struct Scsi_Host *shost = fc_bsg_to_shost(job);
5453	struct lpfc_vport *vport = shost_priv(shost);
5454	struct lpfc_hba *phba = vport->phba;
5455	struct fc_bsg_request *bsg_request = job->request;
5456	struct fc_bsg_reply *bsg_reply = job->reply;
5457	struct lpfc_bsg_get_fwlog_req *ras_req;
5458	u32 rd_offset, rd_index, offset;
5459	void *src, *fwlog_buff;
5460	struct lpfc_ras_fwlog *ras_fwlog = NULL;
5461	struct lpfc_dmabuf *dmabuf, *next;
5462	int rc = 0;
5463
5464	ras_fwlog = &phba->ras_fwlog;
5465
5466	rc = lpfc_check_fwlog_support(phba);
5467	if (rc)
5468		goto ras_job_error;
5469
5470	/* Logging to be stopped before reading */
5471	spin_lock_irq(&phba->ras_fwlog_lock);
5472	if (ras_fwlog->state == ACTIVE) {
5473		spin_unlock_irq(&phba->ras_fwlog_lock);
5474		rc = -EINPROGRESS;
5475		goto ras_job_error;
5476	}
5477	spin_unlock_irq(&phba->ras_fwlog_lock);
5478
5479	if (job->request_len <
5480	    sizeof(struct fc_bsg_request) +
5481	    sizeof(struct lpfc_bsg_get_fwlog_req)) {
5482		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
5483				"6184 Received RAS_LOG request "
5484				"below minimum size\n");
5485		rc = -EINVAL;
5486		goto ras_job_error;
5487	}
5488
5489	ras_req = (struct lpfc_bsg_get_fwlog_req *)
5490		bsg_request->rqst_data.h_vendor.vendor_cmd;
5491	rd_offset = ras_req->read_offset;
5492
5493	/* Allocate memory to read fw log*/
5494	fwlog_buff = vmalloc(ras_req->read_size);
5495	if (!fwlog_buff) {
5496		rc = -ENOMEM;
5497		goto ras_job_error;
5498	}
5499
5500	rd_index = (rd_offset / LPFC_RAS_MAX_ENTRY_SIZE);
5501	offset = (rd_offset % LPFC_RAS_MAX_ENTRY_SIZE);
5502
5503	list_for_each_entry_safe(dmabuf, next,
5504			      &ras_fwlog->fwlog_buff_list, list) {
5505
5506		if (dmabuf->buffer_tag < rd_index)
5507			continue;
5508
5509		src = dmabuf->virt + offset;
5510		memcpy(fwlog_buff, src, ras_req->read_size);
5511		break;
5512	}
5513
5514	bsg_reply->reply_payload_rcv_len =
5515		sg_copy_from_buffer(job->reply_payload.sg_list,
5516				    job->reply_payload.sg_cnt,
5517				    fwlog_buff, ras_req->read_size);
5518
5519	vfree(fwlog_buff);
5520
5521ras_job_error:
5522	bsg_reply->result = rc;
5523	if (!rc)
5524		bsg_job_done(job, bsg_reply->result,
5525			     bsg_reply->reply_payload_rcv_len);
5526
5527	return rc;
5528}
5529
5530static int
5531lpfc_get_trunk_info(struct bsg_job *job)
5532{
5533	struct lpfc_vport *vport = shost_priv(fc_bsg_to_shost(job));
5534	struct lpfc_hba *phba = vport->phba;
5535	struct fc_bsg_reply *bsg_reply = job->reply;
5536	struct lpfc_trunk_info *event_reply;
5537	int rc = 0;
5538
5539	if (job->request_len <
5540	    sizeof(struct fc_bsg_request) + sizeof(struct get_trunk_info_req)) {
5541		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
5542				"2744 Received GET TRUNK _INFO request below "
5543				"minimum size\n");
5544		rc = -EINVAL;
5545		goto job_error;
5546	}
5547
5548	event_reply = (struct lpfc_trunk_info *)
5549		bsg_reply->reply_data.vendor_reply.vendor_rsp;
5550
5551	if (job->reply_len < sizeof(*bsg_reply) + sizeof(*event_reply)) {
5552		lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
5553				"2728 Received GET TRUNK _INFO reply below "
5554				"minimum size\n");
5555		rc = -EINVAL;
5556		goto job_error;
5557	}
5558	if (event_reply == NULL) {
5559		rc = -EINVAL;
5560		goto job_error;
5561	}
5562
5563	bsg_bf_set(lpfc_trunk_info_link_status, event_reply,
5564		   (phba->link_state >= LPFC_LINK_UP) ? 1 : 0);
5565
5566	bsg_bf_set(lpfc_trunk_info_trunk_active0, event_reply,
5567		   (phba->trunk_link.link0.state == LPFC_LINK_UP) ? 1 : 0);
5568
5569	bsg_bf_set(lpfc_trunk_info_trunk_active1, event_reply,
5570		   (phba->trunk_link.link1.state == LPFC_LINK_UP) ? 1 : 0);
5571
5572	bsg_bf_set(lpfc_trunk_info_trunk_active2, event_reply,
5573		   (phba->trunk_link.link2.state == LPFC_LINK_UP) ? 1 : 0);
5574
5575	bsg_bf_set(lpfc_trunk_info_trunk_active3, event_reply,
5576		   (phba->trunk_link.link3.state == LPFC_LINK_UP) ? 1 : 0);
5577
5578	bsg_bf_set(lpfc_trunk_info_trunk_config0, event_reply,
5579		   bf_get(lpfc_conf_trunk_port0, &phba->sli4_hba));
5580
5581	bsg_bf_set(lpfc_trunk_info_trunk_config1, event_reply,
5582		   bf_get(lpfc_conf_trunk_port1, &phba->sli4_hba));
5583
5584	bsg_bf_set(lpfc_trunk_info_trunk_config2, event_reply,
5585		   bf_get(lpfc_conf_trunk_port2, &phba->sli4_hba));
5586
5587	bsg_bf_set(lpfc_trunk_info_trunk_config3, event_reply,
5588		   bf_get(lpfc_conf_trunk_port3, &phba->sli4_hba));
5589
5590	event_reply->port_speed = phba->sli4_hba.link_state.speed / 1000;
5591	event_reply->logical_speed =
5592				phba->sli4_hba.link_state.logical_speed / 1000;
5593job_error:
5594	bsg_reply->result = rc;
5595	if (!rc)
5596		bsg_job_done(job, bsg_reply->result,
5597			     bsg_reply->reply_payload_rcv_len);
5598	return rc;
5599
5600}
5601
5602static int
5603lpfc_get_cgnbuf_info(struct bsg_job *job)
5604{
5605	struct lpfc_vport *vport = shost_priv(fc_bsg_to_shost(job));
5606	struct lpfc_hba *phba = vport->phba;
5607	struct fc_bsg_request *bsg_request = job->request;
5608	struct fc_bsg_reply *bsg_reply = job->reply;
5609	struct get_cgnbuf_info_req *cgnbuf_req;
5610	struct lpfc_cgn_info *cp;
5611	uint8_t *cgn_buff;
5612	size_t size, cinfosz;
5613	int  rc = 0;
5614
5615	if (job->request_len < sizeof(struct fc_bsg_request) +
5616	    sizeof(struct get_cgnbuf_info_req)) {
5617		rc = -ENOMEM;
5618		goto job_exit;
5619	}
5620
5621	if (!phba->sli4_hba.pc_sli4_params.cmf) {
5622		rc = -ENOENT;
5623		goto job_exit;
5624	}
5625
5626	if (!phba->cgn_i || !phba->cgn_i->virt) {
5627		rc = -ENOENT;
5628		goto job_exit;
5629	}
5630
5631	cp = phba->cgn_i->virt;
5632	if (cp->cgn_info_version < LPFC_CGN_INFO_V3) {
5633		rc = -EPERM;
5634		goto job_exit;
5635	}
5636
5637	cgnbuf_req = (struct get_cgnbuf_info_req *)
5638		bsg_request->rqst_data.h_vendor.vendor_cmd;
5639
5640	/* For reset or size == 0 */
5641	bsg_reply->reply_payload_rcv_len = 0;
5642
5643	if (cgnbuf_req->reset == LPFC_BSG_CGN_RESET_STAT) {
5644		lpfc_init_congestion_stat(phba);
5645		goto job_exit;
5646	}
5647
5648	/* We don't want to include the CRC at the end */
5649	cinfosz = sizeof(struct lpfc_cgn_info) - sizeof(uint32_t);
5650
5651	size = cgnbuf_req->read_size;
5652	if (!size)
5653		goto job_exit;
5654
5655	if (size < cinfosz) {
5656		/* Just copy back what we can */
5657		cinfosz = size;
5658		rc = -E2BIG;
5659	}
5660
5661	/* Allocate memory to read congestion info */
5662	cgn_buff = vmalloc(cinfosz);
5663	if (!cgn_buff) {
5664		rc = -ENOMEM;
5665		goto job_exit;
5666	}
5667
5668	memcpy(cgn_buff, cp, cinfosz);
5669
5670	bsg_reply->reply_payload_rcv_len =
5671		sg_copy_from_buffer(job->reply_payload.sg_list,
5672				    job->reply_payload.sg_cnt,
5673				    cgn_buff, cinfosz);
5674
5675	vfree(cgn_buff);
5676
5677job_exit:
5678	bsg_reply->result = rc;
5679	if (!rc)
5680		bsg_job_done(job, bsg_reply->result,
5681			     bsg_reply->reply_payload_rcv_len);
5682	else
5683		lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
5684				"2724 GET CGNBUF error: %d\n", rc);
5685	return rc;
5686}
5687
5688/**
5689 * lpfc_bsg_hst_vendor - process a vendor-specific fc_bsg_job
5690 * @job: fc_bsg_job to handle
5691 **/
5692static int
5693lpfc_bsg_hst_vendor(struct bsg_job *job)
5694{
5695	struct fc_bsg_request *bsg_request = job->request;
5696	struct fc_bsg_reply *bsg_reply = job->reply;
5697	int command = bsg_request->rqst_data.h_vendor.vendor_cmd[0];
5698	int rc;
5699
5700	switch (command) {
5701	case LPFC_BSG_VENDOR_SET_CT_EVENT:
5702		rc = lpfc_bsg_hba_set_event(job);
5703		break;
5704	case LPFC_BSG_VENDOR_GET_CT_EVENT:
5705		rc = lpfc_bsg_hba_get_event(job);
5706		break;
5707	case LPFC_BSG_VENDOR_SEND_MGMT_RESP:
5708		rc = lpfc_bsg_send_mgmt_rsp(job);
5709		break;
5710	case LPFC_BSG_VENDOR_DIAG_MODE:
5711		rc = lpfc_bsg_diag_loopback_mode(job);
5712		break;
5713	case LPFC_BSG_VENDOR_DIAG_MODE_END:
5714		rc = lpfc_sli4_bsg_diag_mode_end(job);
5715		break;
5716	case LPFC_BSG_VENDOR_DIAG_RUN_LOOPBACK:
5717		rc = lpfc_bsg_diag_loopback_run(job);
5718		break;
5719	case LPFC_BSG_VENDOR_LINK_DIAG_TEST:
5720		rc = lpfc_sli4_bsg_link_diag_test(job);
5721		break;
5722	case LPFC_BSG_VENDOR_GET_MGMT_REV:
5723		rc = lpfc_bsg_get_dfc_rev(job);
5724		break;
5725	case LPFC_BSG_VENDOR_MBOX:
5726		rc = lpfc_bsg_mbox_cmd(job);
5727		break;
5728	case LPFC_BSG_VENDOR_FORCED_LINK_SPEED:
5729		rc = lpfc_forced_link_speed(job);
5730		break;
5731	case LPFC_BSG_VENDOR_RAS_GET_LWPD:
5732		rc = lpfc_bsg_get_ras_lwpd(job);
5733		break;
5734	case LPFC_BSG_VENDOR_RAS_GET_FWLOG:
5735		rc = lpfc_bsg_get_ras_fwlog(job);
5736		break;
5737	case LPFC_BSG_VENDOR_RAS_GET_CONFIG:
5738		rc = lpfc_bsg_get_ras_config(job);
5739		break;
5740	case LPFC_BSG_VENDOR_RAS_SET_CONFIG:
5741		rc = lpfc_bsg_set_ras_config(job);
5742		break;
5743	case LPFC_BSG_VENDOR_GET_TRUNK_INFO:
5744		rc = lpfc_get_trunk_info(job);
5745		break;
5746	case LPFC_BSG_VENDOR_GET_CGNBUF_INFO:
5747		rc = lpfc_get_cgnbuf_info(job);
5748		break;
5749	default:
5750		rc = -EINVAL;
5751		bsg_reply->reply_payload_rcv_len = 0;
5752		/* make error code available to userspace */
5753		bsg_reply->result = rc;
5754		break;
5755	}
5756
5757	return rc;
5758}
5759
5760/**
5761 * lpfc_bsg_request - handle a bsg request from the FC transport
5762 * @job: bsg_job to handle
5763 **/
5764int
5765lpfc_bsg_request(struct bsg_job *job)
5766{
5767	struct fc_bsg_request *bsg_request = job->request;
5768	struct fc_bsg_reply *bsg_reply = job->reply;
5769	uint32_t msgcode;
5770	int rc;
5771
5772	msgcode = bsg_request->msgcode;
5773	switch (msgcode) {
5774	case FC_BSG_HST_VENDOR:
5775		rc = lpfc_bsg_hst_vendor(job);
5776		break;
5777	case FC_BSG_RPT_ELS:
5778		rc = lpfc_bsg_rport_els(job);
5779		break;
5780	case FC_BSG_RPT_CT:
5781		rc = lpfc_bsg_send_mgmt_cmd(job);
5782		break;
5783	default:
5784		rc = -EINVAL;
5785		bsg_reply->reply_payload_rcv_len = 0;
5786		/* make error code available to userspace */
5787		bsg_reply->result = rc;
5788		break;
5789	}
5790
5791	return rc;
5792}
5793
5794/**
5795 * lpfc_bsg_timeout - handle timeout of a bsg request from the FC transport
5796 * @job: bsg_job that has timed out
5797 *
5798 * This function just aborts the job's IOCB.  The aborted IOCB will return to
5799 * the waiting function which will handle passing the error back to userspace
5800 **/
5801int
5802lpfc_bsg_timeout(struct bsg_job *job)
5803{
5804	struct lpfc_vport *vport = shost_priv(fc_bsg_to_shost(job));
5805	struct lpfc_hba *phba = vport->phba;
5806	struct lpfc_iocbq *cmdiocb;
5807	struct lpfc_sli_ring *pring;
5808	struct bsg_job_data *dd_data;
5809	unsigned long flags;
5810	int rc = 0;
5811	LIST_HEAD(completions);
5812	struct lpfc_iocbq *check_iocb, *next_iocb;
5813
5814	pring = lpfc_phba_elsring(phba);
5815	if (unlikely(!pring))
5816		return -EIO;
5817
5818	/* if job's driver data is NULL, the command completed or is in the
5819	 * the process of completing.  In this case, return status to request
5820	 * so the timeout is retried.  This avoids double completion issues
5821	 * and the request will be pulled off the timer queue when the
5822	 * command's completion handler executes.  Otherwise, prevent the
5823	 * command's completion handler from executing the job done callback
5824	 * and continue processing to abort the outstanding the command.
5825	 */
5826
5827	spin_lock_irqsave(&phba->ct_ev_lock, flags);
5828	dd_data = (struct bsg_job_data *)job->dd_data;
5829	if (dd_data) {
5830		dd_data->set_job = NULL;
5831		job->dd_data = NULL;
5832	} else {
5833		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
5834		return -EAGAIN;
5835	}
5836
5837	switch (dd_data->type) {
5838	case TYPE_IOCB:
5839		/* Check to see if IOCB was issued to the port or not. If not,
5840		 * remove it from the txq queue and call cancel iocbs.
5841		 * Otherwise, call abort iotag
5842		 */
5843		cmdiocb = dd_data->context_un.iocb.cmdiocbq;
5844		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
5845
5846		spin_lock_irqsave(&phba->hbalock, flags);
5847		/* make sure the I/O abort window is still open */
5848		if (!(cmdiocb->cmd_flag & LPFC_IO_CMD_OUTSTANDING)) {
5849			spin_unlock_irqrestore(&phba->hbalock, flags);
5850			return -EAGAIN;
5851		}
5852		list_for_each_entry_safe(check_iocb, next_iocb, &pring->txq,
5853					 list) {
5854			if (check_iocb == cmdiocb) {
5855				list_move_tail(&check_iocb->list, &completions);
5856				break;
5857			}
5858		}
5859		if (list_empty(&completions))
5860			lpfc_sli_issue_abort_iotag(phba, pring, cmdiocb, NULL);
5861		spin_unlock_irqrestore(&phba->hbalock, flags);
5862		if (!list_empty(&completions)) {
5863			lpfc_sli_cancel_iocbs(phba, &completions,
5864					      IOSTAT_LOCAL_REJECT,
5865					      IOERR_SLI_ABORTED);
5866		}
5867		break;
5868
5869	case TYPE_EVT:
5870		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
5871		break;
5872
5873	case TYPE_MBOX:
5874		/* Update the ext buf ctx state if needed */
5875
5876		if (phba->mbox_ext_buf_ctx.state == LPFC_BSG_MBOX_PORT)
5877			phba->mbox_ext_buf_ctx.state = LPFC_BSG_MBOX_ABTS;
5878		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
5879		break;
5880	default:
5881		spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
5882		break;
5883	}
5884
5885	/* scsi transport fc fc_bsg_job_timeout expects a zero return code,
5886	 * otherwise an error message will be displayed on the console
5887	 * so always return success (zero)
5888	 */
5889	return rc;
5890}