drivers/scsi/lpfc/lpfc_bsg.c

   1 /*******************************************************************
   2  * This file is part of the Emulex Linux Device Driver for         *
   3  * Fibre Channel Host Bus Adapters.                                *
   4  * Copyright (C) 2009-2010 Emulex.  All rights reserved.                *
   5  * EMULEX and SLI are trademarks of Emulex.                        *
   6  * www.emulex.com                                                  *
   7  *                                                                 *
   8  * This program is free software; you can redistribute it and/or   *
   9  * modify it under the terms of version 2 of the GNU General       *
  10  * Public License as published by the Free Software Foundation.    *
  11  * This program is distributed in the hope that it will be useful. *
  12  * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND          *
  13  * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,  *
  14  * FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE      *
  15  * DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD *
  16  * TO BE LEGALLY INVALID.  See the GNU General Public License for  *
  17  * more details, a copy of which can be found in the file COPYING  *
  18  * included with this package.                                     *
  19  *******************************************************************/
  20
  21 #include <linux/interrupt.h>
  22 #include <linux/mempool.h>
  23 #include <linux/pci.h>
  24 #include <linux/delay.h>
  25
  26 #include <scsi/scsi.h>
  27 #include <scsi/scsi_host.h>
  28 #include <scsi/scsi_transport_fc.h>
  29 #include <scsi/scsi_bsg_fc.h>
  30 #include <scsi/fc/fc_fs.h>
  31
  32 #include "lpfc_hw4.h"
  33 #include "lpfc_hw.h"
  34 #include "lpfc_sli.h"
  35 #include "lpfc_sli4.h"
  36 #include "lpfc_nl.h"
  37 #include "lpfc_bsg.h"
  38 #include "lpfc_disc.h"
  39 #include "lpfc_scsi.h"
  40 #include "lpfc.h"
  41 #include "lpfc_logmsg.h"
  42 #include "lpfc_crtn.h"
  43 #include "lpfc_vport.h"
  44 #include "lpfc_version.h"
  45
  46 struct lpfc_bsg_event {
  47         struct list_head node;
  48         struct kref kref;
  49         wait_queue_head_t wq;
  50
  51         /* Event type and waiter identifiers */
  52         uint32_t type_mask;
  53         uint32_t req_id;
  54         uint32_t reg_id;
  55
  56         /* next two flags are here for the auto-delete logic */
  57         unsigned long wait_time_stamp;
  58         int waiting;
  59
  60         /* seen and not seen events */
  61         struct list_head events_to_get;
  62         struct list_head events_to_see;
  63
  64         /* job waiting for this event to finish */
  65         struct fc_bsg_job *set_job;
  66 };
  67
  68 struct lpfc_bsg_iocb {
  69         struct lpfc_iocbq *cmdiocbq;
  70         struct lpfc_iocbq *rspiocbq;
  71         struct lpfc_dmabuf *bmp;
  72         struct lpfc_nodelist *ndlp;
  73
  74         /* job waiting for this iocb to finish */
  75         struct fc_bsg_job *set_job;
  76 };
  77
  78 struct lpfc_bsg_mbox {
  79         LPFC_MBOXQ_t *pmboxq;
  80         MAILBOX_t *mb;
  81
  82         /* job waiting for this mbox command to finish */
  83         struct fc_bsg_job *set_job;
  84 };
  85
  86 #define MENLO_DID 0x0000FC0E
  87
  88 struct lpfc_bsg_menlo {
  89         struct lpfc_iocbq *cmdiocbq;
  90         struct lpfc_iocbq *rspiocbq;
  91         struct lpfc_dmabuf *bmp;
  92
  93         /* job waiting for this iocb to finish */
  94         struct fc_bsg_job *set_job;
  95 };
  96
  97 #define TYPE_EVT        1
  98 #define TYPE_IOCB       2
  99 #define TYPE_MBOX       3
 100 #define TYPE_MENLO      4
 101 struct bsg_job_data {
 102         uint32_t type;
 103         union {
 104                 struct lpfc_bsg_event *evt;
 105                 struct lpfc_bsg_iocb iocb;
 106                 struct lpfc_bsg_mbox mbox;
 107                 struct lpfc_bsg_menlo menlo;
 108         } context_un;
 109 };
 110
 111 struct event_data {
 112         struct list_head node;
 113         uint32_t type;
 114         uint32_t immed_dat;
 115         void *data;
 116         uint32_t len;
 117 };
 118
 119 #define BUF_SZ_4K 4096
 120 #define SLI_CT_ELX_LOOPBACK 0x10
 121
 122 enum ELX_LOOPBACK_CMD {
 123         ELX_LOOPBACK_XRI_SETUP,
 124         ELX_LOOPBACK_DATA,
 125 };
 126
 127 #define ELX_LOOPBACK_HEADER_SZ \
 128         (size_t)(&((struct lpfc_sli_ct_request *)NULL)->un)
 129
 130 struct lpfc_dmabufext {
 131         struct lpfc_dmabuf dma;
 132         uint32_t size;
 133         uint32_t flag;
 134 };
 135
 136 /**
 137  * lpfc_bsg_send_mgmt_cmd_cmp - lpfc_bsg_send_mgmt_cmd's completion handler
 138  * @phba: Pointer to HBA context object.
 139  * @cmdiocbq: Pointer to command iocb.
 140  * @rspiocbq: Pointer to response iocb.
 141  *
 142  * This function is the completion handler for iocbs issued using
 143  * lpfc_bsg_send_mgmt_cmd function. This function is called by the
 144  * ring event handler function without any lock held. This function
 145  * can be called from both worker thread context and interrupt
 146  * context. This function also can be called from another thread which
 147  * cleans up the SLI layer objects.
 148  * This function copies the contents of the response iocb to the
 149  * response iocb memory object provided by the caller of
 150  * lpfc_sli_issue_iocb_wait and then wakes up the thread which
 151  * sleeps for the iocb completion.
 152  **/
 153 static void
 154 lpfc_bsg_send_mgmt_cmd_cmp(struct lpfc_hba *phba,
 155                         struct lpfc_iocbq *cmdiocbq,
 156                         struct lpfc_iocbq *rspiocbq)
 157 {
 158         unsigned long iflags;
 159         struct bsg_job_data *dd_data;
 160         struct fc_bsg_job *job;
 161         IOCB_t *rsp;
 162         struct lpfc_dmabuf *bmp;
 163         struct lpfc_nodelist *ndlp;
 164         struct lpfc_bsg_iocb *iocb;
 165         unsigned long flags;
 166         int rc = 0;
 167
 168         spin_lock_irqsave(&phba->ct_ev_lock, flags);
 169         dd_data = cmdiocbq->context1;
 170         if (!dd_data) {
 171                 spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
 172                 return;
 173         }
 174
 175         iocb = &dd_data->context_un.iocb;
 176         job = iocb->set_job;
 177         job->dd_data = NULL; /* so timeout handler does not reply */
 178
 179         spin_lock_irqsave(&phba->hbalock, iflags);
 180         cmdiocbq->iocb_flag |= LPFC_IO_WAKE;
 181         if (cmdiocbq->context2 && rspiocbq)
 182                 memcpy(&((struct lpfc_iocbq *)cmdiocbq->context2)->iocb,
 183                        &rspiocbq->iocb, sizeof(IOCB_t));
 184         spin_unlock_irqrestore(&phba->hbalock, iflags);
 185
 186         bmp = iocb->bmp;
 187         rspiocbq = iocb->rspiocbq;
 188         rsp = &rspiocbq->iocb;
 189         ndlp = iocb->ndlp;
 190
 191         pci_unmap_sg(phba->pcidev, job->request_payload.sg_list,
 192                      job->request_payload.sg_cnt, DMA_TO_DEVICE);
 193         pci_unmap_sg(phba->pcidev, job->reply_payload.sg_list,
 194                      job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
 195
 196         if (rsp->ulpStatus) {
 197                 if (rsp->ulpStatus == IOSTAT_LOCAL_REJECT) {
 198                         switch (rsp->un.ulpWord[4] & 0xff) {
 199                         case IOERR_SEQUENCE_TIMEOUT:
 200                                 rc = -ETIMEDOUT;
 201                                 break;
 202                         case IOERR_INVALID_RPI:
 203                                 rc = -EFAULT;
 204                                 break;
 205                         default:
 206                                 rc = -EACCES;
 207                                 break;
 208                         }
 209                 } else
 210                         rc = -EACCES;
 211         } else
 212                 job->reply->reply_payload_rcv_len =
 213                         rsp->un.genreq64.bdl.bdeSize;
 214
 215         lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
 216         lpfc_sli_release_iocbq(phba, rspiocbq);
 217         lpfc_sli_release_iocbq(phba, cmdiocbq);
 218         lpfc_nlp_put(ndlp);
 219         kfree(bmp);
 220         kfree(dd_data);
 221         /* make error code available to userspace */
 222         job->reply->result = rc;
 223         /* complete the job back to userspace */
 224         job->job_done(job);
 225         spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
 226         return;
 227 }
 228
 229 /**
 230  * lpfc_bsg_send_mgmt_cmd - send a CT command from a bsg request
 231  * @job: fc_bsg_job to handle
 232  **/
 233 static int
 234 lpfc_bsg_send_mgmt_cmd(struct fc_bsg_job *job)
 235 {
 236         struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
 237         struct lpfc_hba *phba = vport->phba;
 238         struct lpfc_rport_data *rdata = job->rport->dd_data;
 239         struct lpfc_nodelist *ndlp = rdata->pnode;
 240         struct ulp_bde64 *bpl = NULL;
 241         uint32_t timeout;
 242         struct lpfc_iocbq *cmdiocbq = NULL;
 243         struct lpfc_iocbq *rspiocbq = NULL;
 244         IOCB_t *cmd;
 245         IOCB_t *rsp;
 246         struct lpfc_dmabuf *bmp = NULL;
 247         int request_nseg;
 248         int reply_nseg;
 249         struct scatterlist *sgel = NULL;
 250         int numbde;
 251         dma_addr_t busaddr;
 252         struct bsg_job_data *dd_data;
 253         uint32_t creg_val;
 254         int rc = 0;
 255
 256         /* in case no data is transferred */
 257         job->reply->reply_payload_rcv_len = 0;
 258
 259         /* allocate our bsg tracking structure */
 260         dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
 261         if (!dd_data) {
 262                 lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
 263                                 "2733 Failed allocation of dd_data\n");
 264                 rc = -ENOMEM;
 265                 goto no_dd_data;
 266         }
 267
 268         if (!lpfc_nlp_get(ndlp)) {
 269                 rc = -ENODEV;
 270                 goto no_ndlp;
 271         }
 272
 273         bmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
 274         if (!bmp) {
 275                 rc = -ENOMEM;
 276                 goto free_ndlp;
 277         }
 278
 279         if (ndlp->nlp_flag & NLP_ELS_SND_MASK) {
 280                 rc = -ENODEV;
 281                 goto free_bmp;
 282         }
 283
 284         cmdiocbq = lpfc_sli_get_iocbq(phba);
 285         if (!cmdiocbq) {
 286                 rc = -ENOMEM;
 287                 goto free_bmp;
 288         }
 289
 290         cmd = &cmdiocbq->iocb;
 291         rspiocbq = lpfc_sli_get_iocbq(phba);
 292         if (!rspiocbq) {
 293                 rc = -ENOMEM;
 294                 goto free_cmdiocbq;
 295         }
 296
 297         rsp = &rspiocbq->iocb;
 298         bmp->virt = lpfc_mbuf_alloc(phba, 0, &bmp->phys);
 299         if (!bmp->virt) {
 300                 rc = -ENOMEM;
 301                 goto free_rspiocbq;
 302         }
 303
 304         INIT_LIST_HEAD(&bmp->list);
 305         bpl = (struct ulp_bde64 *) bmp->virt;
 306         request_nseg = pci_map_sg(phba->pcidev, job->request_payload.sg_list,
 307                                   job->request_payload.sg_cnt, DMA_TO_DEVICE);
 308         for_each_sg(job->request_payload.sg_list, sgel, request_nseg, numbde) {
 309                 busaddr = sg_dma_address(sgel);
 310                 bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64;
 311                 bpl->tus.f.bdeSize = sg_dma_len(sgel);
 312                 bpl->tus.w = cpu_to_le32(bpl->tus.w);
 313                 bpl->addrLow = cpu_to_le32(putPaddrLow(busaddr));
 314                 bpl->addrHigh = cpu_to_le32(putPaddrHigh(busaddr));
 315                 bpl++;
 316         }
 317
 318         reply_nseg = pci_map_sg(phba->pcidev, job->reply_payload.sg_list,
 319                                 job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
 320         for_each_sg(job->reply_payload.sg_list, sgel, reply_nseg, numbde) {
 321                 busaddr = sg_dma_address(sgel);
 322                 bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64I;
 323                 bpl->tus.f.bdeSize = sg_dma_len(sgel);
 324                 bpl->tus.w = cpu_to_le32(bpl->tus.w);
 325                 bpl->addrLow = cpu_to_le32(putPaddrLow(busaddr));
 326                 bpl->addrHigh = cpu_to_le32(putPaddrHigh(busaddr));
 327                 bpl++;
 328         }
 329
 330         cmd->un.genreq64.bdl.ulpIoTag32 = 0;
 331         cmd->un.genreq64.bdl.addrHigh = putPaddrHigh(bmp->phys);
 332         cmd->un.genreq64.bdl.addrLow = putPaddrLow(bmp->phys);
 333         cmd->un.genreq64.bdl.bdeFlags = BUFF_TYPE_BLP_64;
 334         cmd->un.genreq64.bdl.bdeSize =
 335                 (request_nseg + reply_nseg) * sizeof(struct ulp_bde64);
 336         cmd->ulpCommand = CMD_GEN_REQUEST64_CR;
 337         cmd->un.genreq64.w5.hcsw.Fctl = (SI | LA);
 338         cmd->un.genreq64.w5.hcsw.Dfctl = 0;
 339         cmd->un.genreq64.w5.hcsw.Rctl = FC_RCTL_DD_UNSOL_CTL;
 340         cmd->un.genreq64.w5.hcsw.Type = FC_TYPE_CT;
 341         cmd->ulpBdeCount = 1;
 342         cmd->ulpLe = 1;
 343         cmd->ulpClass = CLASS3;
 344         cmd->ulpContext = ndlp->nlp_rpi;
 345         cmd->ulpOwner = OWN_CHIP;
 346         cmdiocbq->vport = phba->pport;
 347         cmdiocbq->context3 = bmp;
 348         cmdiocbq->iocb_flag |= LPFC_IO_LIBDFC;
 349         timeout = phba->fc_ratov * 2;
 350         cmd->ulpTimeout = timeout;
 351
 352         cmdiocbq->iocb_cmpl = lpfc_bsg_send_mgmt_cmd_cmp;
 353         cmdiocbq->context1 = dd_data;
 354         cmdiocbq->context2 = rspiocbq;
 355         dd_data->type = TYPE_IOCB;
 356         dd_data->context_un.iocb.cmdiocbq = cmdiocbq;
 357         dd_data->context_un.iocb.rspiocbq = rspiocbq;
 358         dd_data->context_un.iocb.set_job = job;
 359         dd_data->context_un.iocb.bmp = bmp;
 360         dd_data->context_un.iocb.ndlp = ndlp;
 361
 362         if (phba->cfg_poll & DISABLE_FCP_RING_INT) {
 363                 creg_val = readl(phba->HCregaddr);
 364                 creg_val |= (HC_R0INT_ENA << LPFC_FCP_RING);
 365                 writel(creg_val, phba->HCregaddr);
 366                 readl(phba->HCregaddr); /* flush */
 367         }
 368
 369         rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, cmdiocbq, 0);
 370
 371         if (rc == IOCB_SUCCESS)
 372                 return 0; /* done for now */
 373
 374         /* iocb failed so cleanup */
 375         pci_unmap_sg(phba->pcidev, job->request_payload.sg_list,
 376                      job->request_payload.sg_cnt, DMA_TO_DEVICE);
 377         pci_unmap_sg(phba->pcidev, job->reply_payload.sg_list,
 378                      job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
 379
 380         lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
 381
 382 free_rspiocbq:
 383         lpfc_sli_release_iocbq(phba, rspiocbq);
 384 free_cmdiocbq:
 385         lpfc_sli_release_iocbq(phba, cmdiocbq);
 386 free_bmp:
 387         kfree(bmp);
 388 free_ndlp:
 389         lpfc_nlp_put(ndlp);
 390 no_ndlp:
 391         kfree(dd_data);
 392 no_dd_data:
 393         /* make error code available to userspace */
 394         job->reply->result = rc;
 395         job->dd_data = NULL;
 396         return rc;
 397 }
 398
 399 /**
 400  * lpfc_bsg_rport_els_cmp - lpfc_bsg_rport_els's completion handler
 401  * @phba: Pointer to HBA context object.
 402  * @cmdiocbq: Pointer to command iocb.
 403  * @rspiocbq: Pointer to response iocb.
 404  *
 405  * This function is the completion handler for iocbs issued using
 406  * lpfc_bsg_rport_els_cmp function. This function is called by the
 407  * ring event handler function without any lock held. This function
 408  * can be called from both worker thread context and interrupt
 409  * context. This function also can be called from other thread which
 410  * cleans up the SLI layer objects.
 411  * This function copies the contents of the response iocb to the
 412  * response iocb memory object provided by the caller of
 413  * lpfc_sli_issue_iocb_wait and then wakes up the thread which
 414  * sleeps for the iocb completion.
 415  **/
 416 static void
 417 lpfc_bsg_rport_els_cmp(struct lpfc_hba *phba,
 418                         struct lpfc_iocbq *cmdiocbq,
 419                         struct lpfc_iocbq *rspiocbq)
 420 {
 421         struct bsg_job_data *dd_data;
 422         struct fc_bsg_job *job;
 423         IOCB_t *rsp;
 424         struct lpfc_nodelist *ndlp;
 425         struct lpfc_dmabuf *pbuflist = NULL;
 426         struct fc_bsg_ctels_reply *els_reply;
 427         uint8_t *rjt_data;
 428         unsigned long flags;
 429         int rc = 0;
 430
 431         spin_lock_irqsave(&phba->ct_ev_lock, flags);
 432         dd_data = cmdiocbq->context1;
 433         /* normal completion and timeout crossed paths, already done */
 434         if (!dd_data) {
 435                 spin_unlock_irqrestore(&phba->hbalock, flags);
 436                 return;
 437         }
 438
 439         cmdiocbq->iocb_flag |= LPFC_IO_WAKE;
 440         if (cmdiocbq->context2 && rspiocbq)
 441                 memcpy(&((struct lpfc_iocbq *)cmdiocbq->context2)->iocb,
 442                        &rspiocbq->iocb, sizeof(IOCB_t));
 443
 444         job = dd_data->context_un.iocb.set_job;
 445         cmdiocbq = dd_data->context_un.iocb.cmdiocbq;
 446         rspiocbq = dd_data->context_un.iocb.rspiocbq;
 447         rsp = &rspiocbq->iocb;
 448         ndlp = dd_data->context_un.iocb.ndlp;
 449
 450         pci_unmap_sg(phba->pcidev, job->request_payload.sg_list,
 451                      job->request_payload.sg_cnt, DMA_TO_DEVICE);
 452         pci_unmap_sg(phba->pcidev, job->reply_payload.sg_list,
 453                      job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
 454
 455         if (job->reply->result == -EAGAIN)
 456                 rc = -EAGAIN;
 457         else if (rsp->ulpStatus == IOSTAT_SUCCESS)
 458                 job->reply->reply_payload_rcv_len =
 459                         rsp->un.elsreq64.bdl.bdeSize;
 460         else if (rsp->ulpStatus == IOSTAT_LS_RJT) {
 461                 job->reply->reply_payload_rcv_len =
 462                         sizeof(struct fc_bsg_ctels_reply);
 463                 /* LS_RJT data returned in word 4 */
 464                 rjt_data = (uint8_t *)&rsp->un.ulpWord[4];
 465                 els_reply = &job->reply->reply_data.ctels_reply;
 466                 els_reply->status = FC_CTELS_STATUS_REJECT;
 467                 els_reply->rjt_data.action = rjt_data[3];
 468                 els_reply->rjt_data.reason_code = rjt_data[2];
 469                 els_reply->rjt_data.reason_explanation = rjt_data[1];
 470                 els_reply->rjt_data.vendor_unique = rjt_data[0];
 471         } else
 472                 rc = -EIO;
 473
 474         pbuflist = (struct lpfc_dmabuf *) cmdiocbq->context3;
 475         lpfc_mbuf_free(phba, pbuflist->virt, pbuflist->phys);
 476         lpfc_sli_release_iocbq(phba, rspiocbq);
 477         lpfc_sli_release_iocbq(phba, cmdiocbq);
 478         lpfc_nlp_put(ndlp);
 479         kfree(dd_data);
 480         /* make error code available to userspace */
 481         job->reply->result = rc;
 482         job->dd_data = NULL;
 483         /* complete the job back to userspace */
 484         job->job_done(job);
 485         spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
 486         return;
 487 }
 488
 489 /**
 490  * lpfc_bsg_rport_els - send an ELS command from a bsg request
 491  * @job: fc_bsg_job to handle
 492  **/
 493 static int
 494 lpfc_bsg_rport_els(struct fc_bsg_job *job)
 495 {
 496         struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
 497         struct lpfc_hba *phba = vport->phba;
 498         struct lpfc_rport_data *rdata = job->rport->dd_data;
 499         struct lpfc_nodelist *ndlp = rdata->pnode;
 500         uint32_t elscmd;
 501         uint32_t cmdsize;
 502         uint32_t rspsize;
 503         struct lpfc_iocbq *rspiocbq;
 504         struct lpfc_iocbq *cmdiocbq;
 505         IOCB_t *rsp;
 506         uint16_t rpi = 0;
 507         struct lpfc_dmabuf *pcmd;
 508         struct lpfc_dmabuf *prsp;
 509         struct lpfc_dmabuf *pbuflist = NULL;
 510         struct ulp_bde64 *bpl;
 511         int request_nseg;
 512         int reply_nseg;
 513         struct scatterlist *sgel = NULL;
 514         int numbde;
 515         dma_addr_t busaddr;
 516         struct bsg_job_data *dd_data;
 517         uint32_t creg_val;
 518         int rc = 0;
 519
 520         /* in case no data is transferred */
 521         job->reply->reply_payload_rcv_len = 0;
 522
 523         /* allocate our bsg tracking structure */
 524         dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
 525         if (!dd_data) {
 526                 lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
 527                                 "2735 Failed allocation of dd_data\n");
 528                 rc = -ENOMEM;
 529                 goto no_dd_data;
 530         }
 531
 532         if (!lpfc_nlp_get(ndlp)) {
 533                 rc = -ENODEV;
 534                 goto free_dd_data;
 535         }
 536
 537         elscmd = job->request->rqst_data.r_els.els_code;
 538         cmdsize = job->request_payload.payload_len;
 539         rspsize = job->reply_payload.payload_len;
 540         rspiocbq = lpfc_sli_get_iocbq(phba);
 541         if (!rspiocbq) {
 542                 lpfc_nlp_put(ndlp);
 543                 rc = -ENOMEM;
 544                 goto free_dd_data;
 545         }
 546
 547         rsp = &rspiocbq->iocb;
 548         rpi = ndlp->nlp_rpi;
 549
 550         cmdiocbq = lpfc_prep_els_iocb(vport, 1, cmdsize, 0, ndlp,
 551                                       ndlp->nlp_DID, elscmd);
 552         if (!cmdiocbq) {
 553                 rc = -EIO;
 554                 goto free_rspiocbq;
 555         }
 556
 557         /* prep els iocb set context1 to the ndlp, context2 to the command
 558          * dmabuf, context3 holds the data dmabuf
 559          */
 560         pcmd = (struct lpfc_dmabuf *) cmdiocbq->context2;
 561         prsp = (struct lpfc_dmabuf *) pcmd->list.next;
 562         lpfc_mbuf_free(phba, pcmd->virt, pcmd->phys);
 563         kfree(pcmd);
 564         lpfc_mbuf_free(phba, prsp->virt, prsp->phys);
 565         kfree(prsp);
 566         cmdiocbq->context2 = NULL;
 567
 568         pbuflist = (struct lpfc_dmabuf *) cmdiocbq->context3;
 569         bpl = (struct ulp_bde64 *) pbuflist->virt;
 570
 571         request_nseg = pci_map_sg(phba->pcidev, job->request_payload.sg_list,
 572                                   job->request_payload.sg_cnt, DMA_TO_DEVICE);
 573         for_each_sg(job->request_payload.sg_list, sgel, request_nseg, numbde) {
 574                 busaddr = sg_dma_address(sgel);
 575                 bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64;
 576                 bpl->tus.f.bdeSize = sg_dma_len(sgel);
 577                 bpl->tus.w = cpu_to_le32(bpl->tus.w);
 578                 bpl->addrLow = cpu_to_le32(putPaddrLow(busaddr));
 579                 bpl->addrHigh = cpu_to_le32(putPaddrHigh(busaddr));
 580                 bpl++;
 581         }
 582
 583         reply_nseg = pci_map_sg(phba->pcidev, job->reply_payload.sg_list,
 584                                 job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
 585         for_each_sg(job->reply_payload.sg_list, sgel, reply_nseg, numbde) {
 586                 busaddr = sg_dma_address(sgel);
 587                 bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64I;
 588                 bpl->tus.f.bdeSize = sg_dma_len(sgel);
 589                 bpl->tus.w = cpu_to_le32(bpl->tus.w);
 590                 bpl->addrLow = cpu_to_le32(putPaddrLow(busaddr));
 591                 bpl->addrHigh = cpu_to_le32(putPaddrHigh(busaddr));
 592                 bpl++;
 593         }
 594         cmdiocbq->iocb.un.elsreq64.bdl.bdeSize =
 595                 (request_nseg + reply_nseg) * sizeof(struct ulp_bde64);
 596         cmdiocbq->iocb.ulpContext = rpi;
 597         cmdiocbq->iocb_flag |= LPFC_IO_LIBDFC;
 598         cmdiocbq->context1 = NULL;
 599         cmdiocbq->context2 = NULL;
 600
 601         cmdiocbq->iocb_cmpl = lpfc_bsg_rport_els_cmp;
 602         cmdiocbq->context1 = dd_data;
 603         cmdiocbq->context2 = rspiocbq;
 604         dd_data->type = TYPE_IOCB;
 605         dd_data->context_un.iocb.cmdiocbq = cmdiocbq;
 606         dd_data->context_un.iocb.rspiocbq = rspiocbq;
 607         dd_data->context_un.iocb.set_job = job;
 608         dd_data->context_un.iocb.bmp = NULL;;
 609         dd_data->context_un.iocb.ndlp = ndlp;
 610
 611         if (phba->cfg_poll & DISABLE_FCP_RING_INT) {
 612                 creg_val = readl(phba->HCregaddr);
 613                 creg_val |= (HC_R0INT_ENA << LPFC_FCP_RING);
 614                 writel(creg_val, phba->HCregaddr);
 615                 readl(phba->HCregaddr); /* flush */
 616         }
 617         rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, cmdiocbq, 0);
 618         lpfc_nlp_put(ndlp);
 619         if (rc == IOCB_SUCCESS)
 620                 return 0; /* done for now */
 621
 622         pci_unmap_sg(phba->pcidev, job->request_payload.sg_list,
 623                      job->request_payload.sg_cnt, DMA_TO_DEVICE);
 624         pci_unmap_sg(phba->pcidev, job->reply_payload.sg_list,
 625                      job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
 626
 627         lpfc_mbuf_free(phba, pbuflist->virt, pbuflist->phys);
 628
 629         lpfc_sli_release_iocbq(phba, cmdiocbq);
 630
 631 free_rspiocbq:
 632         lpfc_sli_release_iocbq(phba, rspiocbq);
 633
 634 free_dd_data:
 635         kfree(dd_data);
 636
 637 no_dd_data:
 638         /* make error code available to userspace */
 639         job->reply->result = rc;
 640         job->dd_data = NULL;
 641         return rc;
 642 }
 643
 644 /**
 645  * lpfc_bsg_event_free - frees an allocated event structure
 646  * @kref: Pointer to a kref.
 647  *
 648  * Called from kref_put. Back cast the kref into an event structure address.
 649  * Free any events to get, delete associated nodes, free any events to see,
 650  * free any data then free the event itself.
 651  **/
 652 static void
 653 lpfc_bsg_event_free(struct kref *kref)
 654 {
 655         struct lpfc_bsg_event *evt = container_of(kref, struct lpfc_bsg_event,
 656                                                   kref);
 657         struct event_data *ed;
 658
 659         list_del(&evt->node);
 660
 661         while (!list_empty(&evt->events_to_get)) {
 662                 ed = list_entry(evt->events_to_get.next, typeof(*ed), node);
 663                 list_del(&ed->node);
 664                 kfree(ed->data);
 665                 kfree(ed);
 666         }
 667
 668         while (!list_empty(&evt->events_to_see)) {
 669                 ed = list_entry(evt->events_to_see.next, typeof(*ed), node);
 670                 list_del(&ed->node);
 671                 kfree(ed->data);
 672                 kfree(ed);
 673         }
 674
 675         kfree(evt);
 676 }
 677
 678 /**
 679  * lpfc_bsg_event_ref - increments the kref for an event
 680  * @evt: Pointer to an event structure.
 681  **/
 682 static inline void
 683 lpfc_bsg_event_ref(struct lpfc_bsg_event *evt)
 684 {
 685         kref_get(&evt->kref);
 686 }
 687
 688 /**
 689  * lpfc_bsg_event_unref - Uses kref_put to free an event structure
 690  * @evt: Pointer to an event structure.
 691  **/
 692 static inline void
 693 lpfc_bsg_event_unref(struct lpfc_bsg_event *evt)
 694 {
 695         kref_put(&evt->kref, lpfc_bsg_event_free);
 696 }
 697
 698 /**
 699  * lpfc_bsg_event_new - allocate and initialize a event structure
 700  * @ev_mask: Mask of events.
 701  * @ev_reg_id: Event reg id.
 702  * @ev_req_id: Event request id.
 703  **/
 704 static struct lpfc_bsg_event *
 705 lpfc_bsg_event_new(uint32_t ev_mask, int ev_reg_id, uint32_t ev_req_id)
 706 {
 707         struct lpfc_bsg_event *evt = kzalloc(sizeof(*evt), GFP_KERNEL);
 708
 709         if (!evt)
 710                 return NULL;
 711
 712         INIT_LIST_HEAD(&evt->events_to_get);
 713         INIT_LIST_HEAD(&evt->events_to_see);
 714         evt->type_mask = ev_mask;
 715         evt->req_id = ev_req_id;
 716         evt->reg_id = ev_reg_id;
 717         evt->wait_time_stamp = jiffies;
 718         init_waitqueue_head(&evt->wq);
 719         kref_init(&evt->kref);
 720         return evt;
 721 }
 722
 723 /**
 724  * diag_cmd_data_free - Frees an lpfc dma buffer extension
 725  * @phba: Pointer to HBA context object.
 726  * @mlist: Pointer to an lpfc dma buffer extension.
 727  **/
 728 static int
 729 diag_cmd_data_free(struct lpfc_hba *phba, struct lpfc_dmabufext *mlist)
 730 {
 731         struct lpfc_dmabufext *mlast;
 732         struct pci_dev *pcidev;
 733         struct list_head head, *curr, *next;
 734
 735         if ((!mlist) || (!lpfc_is_link_up(phba) &&
 736                 (phba->link_flag & LS_LOOPBACK_MODE))) {
 737                 return 0;
 738         }
 739
 740         pcidev = phba->pcidev;
 741         list_add_tail(&head, &mlist->dma.list);
 742
 743         list_for_each_safe(curr, next, &head) {
 744                 mlast = list_entry(curr, struct lpfc_dmabufext , dma.list);
 745                 if (mlast->dma.virt)
 746                         dma_free_coherent(&pcidev->dev,
 747                                           mlast->size,
 748                                           mlast->dma.virt,
 749                                           mlast->dma.phys);
 750                 kfree(mlast);
 751         }
 752         return 0;
 753 }
 754
 755 /**
 756  * lpfc_bsg_ct_unsol_event - process an unsolicited CT command
 757  * @phba:
 758  * @pring:
 759  * @piocbq:
 760  *
 761  * This function is called when an unsolicited CT command is received.  It
 762  * forwards the event to any processes registered to receive CT events.
 763  **/
 764 int
 765 lpfc_bsg_ct_unsol_event(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
 766                         struct lpfc_iocbq *piocbq)
 767 {
 768         uint32_t evt_req_id = 0;
 769         uint32_t cmd;
 770         uint32_t len;
 771         struct lpfc_dmabuf *dmabuf = NULL;
 772         struct lpfc_bsg_event *evt;
 773         struct event_data *evt_dat = NULL;
 774         struct lpfc_iocbq *iocbq;
 775         size_t offset = 0;
 776         struct list_head head;
 777         struct ulp_bde64 *bde;
 778         dma_addr_t dma_addr;
 779         int i;
 780         struct lpfc_dmabuf *bdeBuf1 = piocbq->context2;
 781         struct lpfc_dmabuf *bdeBuf2 = piocbq->context3;
 782         struct lpfc_hbq_entry *hbqe;
 783         struct lpfc_sli_ct_request *ct_req;
 784         struct fc_bsg_job *job = NULL;
 785         unsigned long flags;
 786         int size = 0;
 787
 788         INIT_LIST_HEAD(&head);
 789         list_add_tail(&head, &piocbq->list);
 790
 791         if (piocbq->iocb.ulpBdeCount == 0 ||
 792             piocbq->iocb.un.cont64[0].tus.f.bdeSize == 0)
 793                 goto error_ct_unsol_exit;
 794
 795         if (phba->link_state == LPFC_HBA_ERROR ||
 796                 (!(phba->sli.sli_flag & LPFC_SLI_ACTIVE)))
 797                 goto error_ct_unsol_exit;
 798
 799         if (phba->sli3_options & LPFC_SLI3_HBQ_ENABLED)
 800                 dmabuf = bdeBuf1;
 801         else {
 802                 dma_addr = getPaddr(piocbq->iocb.un.cont64[0].addrHigh,
 803                                     piocbq->iocb.un.cont64[0].addrLow);
 804                 dmabuf = lpfc_sli_ringpostbuf_get(phba, pring, dma_addr);
 805         }
 806         if (dmabuf == NULL)
 807                 goto error_ct_unsol_exit;
 808         ct_req = (struct lpfc_sli_ct_request *)dmabuf->virt;
 809         evt_req_id = ct_req->FsType;
 810         cmd = ct_req->CommandResponse.bits.CmdRsp;
 811         len = ct_req->CommandResponse.bits.Size;
 812         if (!(phba->sli3_options & LPFC_SLI3_HBQ_ENABLED))
 813                 lpfc_sli_ringpostbuf_put(phba, pring, dmabuf);
 814
 815         spin_lock_irqsave(&phba->ct_ev_lock, flags);
 816         list_for_each_entry(evt, &phba->ct_ev_waiters, node) {
 817                 if (!(evt->type_mask & FC_REG_CT_EVENT) ||
 818                         evt->req_id != evt_req_id)
 819                         continue;
 820
 821                 lpfc_bsg_event_ref(evt);
 822                 spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
 823                 evt_dat = kzalloc(sizeof(*evt_dat), GFP_KERNEL);
 824                 if (evt_dat == NULL) {
 825                         spin_lock_irqsave(&phba->ct_ev_lock, flags);
 826                         lpfc_bsg_event_unref(evt);
 827                         lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
 828                                         "2614 Memory allocation failed for "
 829                                         "CT event\n");
 830                         break;
 831                 }
 832
 833                 if (phba->sli3_options & LPFC_SLI3_HBQ_ENABLED) {
 834                         /* take accumulated byte count from the last iocbq */
 835                         iocbq = list_entry(head.prev, typeof(*iocbq), list);
 836                         evt_dat->len = iocbq->iocb.unsli3.rcvsli3.acc_len;
 837                 } else {
 838                         list_for_each_entry(iocbq, &head, list) {
 839                                 for (i = 0; i < iocbq->iocb.ulpBdeCount; i++)
 840                                         evt_dat->len +=
 841                                         iocbq->iocb.un.cont64[i].tus.f.bdeSize;
 842                         }
 843                 }
 844
 845                 evt_dat->data = kzalloc(evt_dat->len, GFP_KERNEL);
 846                 if (evt_dat->data == NULL) {
 847                         lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
 848                                         "2615 Memory allocation failed for "
 849                                         "CT event data, size %d\n",
 850                                         evt_dat->len);
 851                         kfree(evt_dat);
 852                         spin_lock_irqsave(&phba->ct_ev_lock, flags);
 853                         lpfc_bsg_event_unref(evt);
 854                         spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
 855                         goto error_ct_unsol_exit;
 856                 }
 857
 858                 list_for_each_entry(iocbq, &head, list) {
 859                         size = 0;
 860                         if (phba->sli3_options & LPFC_SLI3_HBQ_ENABLED) {
 861                                 bdeBuf1 = iocbq->context2;
 862                                 bdeBuf2 = iocbq->context3;
 863                         }
 864                         for (i = 0; i < iocbq->iocb.ulpBdeCount; i++) {
 865                                 if (phba->sli3_options &
 866                                     LPFC_SLI3_HBQ_ENABLED) {
 867                                         if (i == 0) {
 868                                                 hbqe = (struct lpfc_hbq_entry *)
 869                                                   &iocbq->iocb.un.ulpWord[0];
 870                                                 size = hbqe->bde.tus.f.bdeSize;
 871                                                 dmabuf = bdeBuf1;
 872                                         } else if (i == 1) {
 873                                                 hbqe = (struct lpfc_hbq_entry *)
 874                                                         &iocbq->iocb.unsli3.
 875                                                         sli3Words[4];
 876                                                 size = hbqe->bde.tus.f.bdeSize;
 877                                                 dmabuf = bdeBuf2;
 878                                         }
 879                                         if ((offset + size) > evt_dat->len)
 880                                                 size = evt_dat->len - offset;
 881                                 } else {
 882                                         size = iocbq->iocb.un.cont64[i].
 883                                                 tus.f.bdeSize;
 884                                         bde = &iocbq->iocb.un.cont64[i];
 885                                         dma_addr = getPaddr(bde->addrHigh,
 886                                                             bde->addrLow);
 887                                         dmabuf = lpfc_sli_ringpostbuf_get(phba,
 888                                                         pring, dma_addr);
 889                                 }
 890                                 if (!dmabuf) {
 891                                         lpfc_printf_log(phba, KERN_ERR,
 892                                                 LOG_LIBDFC, "2616 No dmabuf "
 893                                                 "found for iocbq 0x%p\n",
 894                                                 iocbq);
 895                                         kfree(evt_dat->data);
 896                                         kfree(evt_dat);
 897                                         spin_lock_irqsave(&phba->ct_ev_lock,
 898                                                 flags);
 899                                         lpfc_bsg_event_unref(evt);
 900                                         spin_unlock_irqrestore(
 901                                                 &phba->ct_ev_lock, flags);
 902                                         goto error_ct_unsol_exit;
 903                                 }
 904                                 memcpy((char *)(evt_dat->data) + offset,
 905                                        dmabuf->virt, size);
 906                                 offset += size;
 907                                 if (evt_req_id != SLI_CT_ELX_LOOPBACK &&
 908                                     !(phba->sli3_options &
 909                                       LPFC_SLI3_HBQ_ENABLED)) {
 910                                         lpfc_sli_ringpostbuf_put(phba, pring,
 911                                                                  dmabuf);
 912                                 } else {
 913                                         switch (cmd) {
 914                                         case ELX_LOOPBACK_DATA:
 915                                                 diag_cmd_data_free(phba,
 916                                                 (struct lpfc_dmabufext *)
 917                                                         dmabuf);
 918                                                 break;
 919                                         case ELX_LOOPBACK_XRI_SETUP:
 920                                                 if ((phba->sli_rev ==
 921                                                         LPFC_SLI_REV2) ||
 922                                                         (phba->sli3_options &
 923                                                         LPFC_SLI3_HBQ_ENABLED
 924                                                         )) {
 925                                                         lpfc_in_buf_free(phba,
 926                                                                         dmabuf);
 927                                                 } else {
 928                                                         lpfc_post_buffer(phba,
 929                                                                          pring,
 930                                                                          1);
 931                                                 }
 932                                                 break;
 933                                         default:
 934                                                 if (!(phba->sli3_options &
 935                                                       LPFC_SLI3_HBQ_ENABLED))
 936                                                         lpfc_post_buffer(phba,
 937                                                                          pring,
 938                                                                          1);
 939                                                 break;
 940                                         }
 941                                 }
 942                         }
 943                 }
 944
 945                 spin_lock_irqsave(&phba->ct_ev_lock, flags);
 946                 if (phba->sli_rev == LPFC_SLI_REV4) {
 947                         evt_dat->immed_dat = phba->ctx_idx;
 948                         phba->ctx_idx = (phba->ctx_idx + 1) % 64;
 949                         phba->ct_ctx[evt_dat->immed_dat].oxid =
 950                                                 piocbq->iocb.ulpContext;
 951                         phba->ct_ctx[evt_dat->immed_dat].SID =
 952                                 piocbq->iocb.un.rcvels.remoteID;
 953                 } else
 954                         evt_dat->immed_dat = piocbq->iocb.ulpContext;
 955
 956                 evt_dat->type = FC_REG_CT_EVENT;
 957                 list_add(&evt_dat->node, &evt->events_to_see);
 958                 if (evt_req_id == SLI_CT_ELX_LOOPBACK) {
 959                         wake_up_interruptible(&evt->wq);
 960                         lpfc_bsg_event_unref(evt);
 961                         break;
 962                 }
 963
 964                 list_move(evt->events_to_see.prev, &evt->events_to_get);
 965                 lpfc_bsg_event_unref(evt);
 966
 967                 job = evt->set_job;
 968                 evt->set_job = NULL;
 969                 if (job) {
 970                         job->reply->reply_payload_rcv_len = size;
 971                         /* make error code available to userspace */
 972                         job->reply->result = 0;
 973                         job->dd_data = NULL;
 974                         /* complete the job back to userspace */
 975                         spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
 976                         job->job_done(job);
 977                         spin_lock_irqsave(&phba->ct_ev_lock, flags);
 978                 }
 979         }
 980         spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
 981
 982 error_ct_unsol_exit:
 983         if (!list_empty(&head))
 984                 list_del(&head);
 985         if (evt_req_id == SLI_CT_ELX_LOOPBACK)
 986                 return 0;
 987         return 1;
 988 }
 989
 990 /**
 991  * lpfc_bsg_hba_set_event - process a SET_EVENT bsg vendor command
 992  * @job: SET_EVENT fc_bsg_job
 993  **/
 994 static int
 995 lpfc_bsg_hba_set_event(struct fc_bsg_job *job)
 996 {
 997         struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
 998         struct lpfc_hba *phba = vport->phba;
 999         struct set_ct_event *event_req;
1000         struct lpfc_bsg_event *evt;
1001         int rc = 0;
1002         struct bsg_job_data *dd_data = NULL;
1003         uint32_t ev_mask;
1004         unsigned long flags;
1005
1006         if (job->request_len <
1007             sizeof(struct fc_bsg_request) + sizeof(struct set_ct_event)) {
1008                 lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1009                                 "2612 Received SET_CT_EVENT below minimum "
1010                                 "size\n");
1011                 rc = -EINVAL;
1012                 goto job_error;
1013         }
1014
1015         dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
1016         if (dd_data == NULL) {
1017                 lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1018                                 "2734 Failed allocation of dd_data\n");
1019                 rc = -ENOMEM;
1020                 goto job_error;
1021         }
1022
1023         event_req = (struct set_ct_event *)
1024                 job->request->rqst_data.h_vendor.vendor_cmd;
1025         ev_mask = ((uint32_t)(unsigned long)event_req->type_mask &
1026                                 FC_REG_EVENT_MASK);
1027         spin_lock_irqsave(&phba->ct_ev_lock, flags);
1028         list_for_each_entry(evt, &phba->ct_ev_waiters, node) {
1029                 if (evt->reg_id == event_req->ev_reg_id) {
1030                         lpfc_bsg_event_ref(evt);
1031                         evt->wait_time_stamp = jiffies;
1032                         break;
1033                 }
1034         }
1035         spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1036
1037         if (&evt->node == &phba->ct_ev_waiters) {
1038                 /* no event waiting struct yet - first call */
1039                 evt = lpfc_bsg_event_new(ev_mask, event_req->ev_reg_id,
1040                                         event_req->ev_req_id);
1041                 if (!evt) {
1042                         lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1043                                         "2617 Failed allocation of event "
1044                                         "waiter\n");
1045                         rc = -ENOMEM;
1046                         goto job_error;
1047                 }
1048
1049                 spin_lock_irqsave(&phba->ct_ev_lock, flags);
1050                 list_add(&evt->node, &phba->ct_ev_waiters);
1051                 lpfc_bsg_event_ref(evt);
1052                 evt->wait_time_stamp = jiffies;
1053                 spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1054         }
1055
1056         spin_lock_irqsave(&phba->ct_ev_lock, flags);
1057         evt->waiting = 1;
1058         dd_data->type = TYPE_EVT;
1059         dd_data->context_un.evt = evt;
1060         evt->set_job = job; /* for unsolicited command */
1061         job->dd_data = dd_data; /* for fc transport timeout callback*/
1062         spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1063         return 0; /* call job done later */
1064
1065 job_error:
1066         if (dd_data != NULL)
1067                 kfree(dd_data);
1068
1069         job->dd_data = NULL;
1070         return rc;
1071 }
1072
1073 /**
1074  * lpfc_bsg_hba_get_event - process a GET_EVENT bsg vendor command
1075  * @job: GET_EVENT fc_bsg_job
1076  **/
1077 static int
1078 lpfc_bsg_hba_get_event(struct fc_bsg_job *job)
1079 {
1080         struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
1081         struct lpfc_hba *phba = vport->phba;
1082         struct get_ct_event *event_req;
1083         struct get_ct_event_reply *event_reply;
1084         struct lpfc_bsg_event *evt;
1085         struct event_data *evt_dat = NULL;
1086         unsigned long flags;
1087         uint32_t rc = 0;
1088
1089         if (job->request_len <
1090             sizeof(struct fc_bsg_request) + sizeof(struct get_ct_event)) {
1091                 lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1092                                 "2613 Received GET_CT_EVENT request below "
1093                                 "minimum size\n");
1094                 rc = -EINVAL;
1095                 goto job_error;
1096         }
1097
1098         event_req = (struct get_ct_event *)
1099                 job->request->rqst_data.h_vendor.vendor_cmd;
1100
1101         event_reply = (struct get_ct_event_reply *)
1102                 job->reply->reply_data.vendor_reply.vendor_rsp;
1103         spin_lock_irqsave(&phba->ct_ev_lock, flags);
1104         list_for_each_entry(evt, &phba->ct_ev_waiters, node) {
1105                 if (evt->reg_id == event_req->ev_reg_id) {
1106                         if (list_empty(&evt->events_to_get))
1107                                 break;
1108                         lpfc_bsg_event_ref(evt);
1109                         evt->wait_time_stamp = jiffies;
1110                         evt_dat = list_entry(evt->events_to_get.prev,
1111                                              struct event_data, node);
1112                         list_del(&evt_dat->node);
1113                         break;
1114                 }
1115         }
1116         spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1117
1118         /* The app may continue to ask for event data until it gets
1119          * an error indicating that there isn't anymore
1120          */
1121         if (evt_dat == NULL) {
1122                 job->reply->reply_payload_rcv_len = 0;
1123                 rc = -ENOENT;
1124                 goto job_error;
1125         }
1126
1127         if (evt_dat->len > job->request_payload.payload_len) {
1128                 evt_dat->len = job->request_payload.payload_len;
1129                 lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1130                                 "2618 Truncated event data at %d "
1131                                 "bytes\n",
1132                                 job->request_payload.payload_len);
1133         }
1134
1135         event_reply->type = evt_dat->type;
1136         event_reply->immed_data = evt_dat->immed_dat;
1137         if (evt_dat->len > 0)
1138                 job->reply->reply_payload_rcv_len =
1139                         sg_copy_from_buffer(job->request_payload.sg_list,
1140                                             job->request_payload.sg_cnt,
1141                                             evt_dat->data, evt_dat->len);
1142         else
1143                 job->reply->reply_payload_rcv_len = 0;
1144
1145         if (evt_dat) {
1146                 kfree(evt_dat->data);
1147                 kfree(evt_dat);
1148         }
1149
1150         spin_lock_irqsave(&phba->ct_ev_lock, flags);
1151         lpfc_bsg_event_unref(evt);
1152         spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1153         job->dd_data = NULL;
1154         job->reply->result = 0;
1155         job->job_done(job);
1156         return 0;
1157
1158 job_error:
1159         job->dd_data = NULL;
1160         job->reply->result = rc;
1161         return rc;
1162 }
1163
1164 /**
1165  * lpfc_issue_ct_rsp_cmp - lpfc_issue_ct_rsp's completion handler
1166  * @phba: Pointer to HBA context object.
1167  * @cmdiocbq: Pointer to command iocb.
1168  * @rspiocbq: Pointer to response iocb.
1169  *
1170  * This function is the completion handler for iocbs issued using
1171  * lpfc_issue_ct_rsp_cmp function. This function is called by the
1172  * ring event handler function without any lock held. This function
1173  * can be called from both worker thread context and interrupt
1174  * context. This function also can be called from other thread which
1175  * cleans up the SLI layer objects.
1176  * This function copy the contents of the response iocb to the
1177  * response iocb memory object provided by the caller of
1178  * lpfc_sli_issue_iocb_wait and then wakes up the thread which
1179  * sleeps for the iocb completion.
1180  **/
1181 static void
1182 lpfc_issue_ct_rsp_cmp(struct lpfc_hba *phba,
1183                         struct lpfc_iocbq *cmdiocbq,
1184                         struct lpfc_iocbq *rspiocbq)
1185 {
1186         struct bsg_job_data *dd_data;
1187         struct fc_bsg_job *job;
1188         IOCB_t *rsp;
1189         struct lpfc_dmabuf *bmp;
1190         struct lpfc_nodelist *ndlp;
1191         unsigned long flags;
1192         int rc = 0;
1193
1194         spin_lock_irqsave(&phba->ct_ev_lock, flags);
1195         dd_data = cmdiocbq->context1;
1196         /* normal completion and timeout crossed paths, already done */
1197         if (!dd_data) {
1198                 spin_unlock_irqrestore(&phba->hbalock, flags);
1199                 return;
1200         }
1201
1202         job = dd_data->context_un.iocb.set_job;
1203         bmp = dd_data->context_un.iocb.bmp;
1204         rsp = &rspiocbq->iocb;
1205         ndlp = dd_data->context_un.iocb.ndlp;
1206
1207         pci_unmap_sg(phba->pcidev, job->request_payload.sg_list,
1208                      job->request_payload.sg_cnt, DMA_TO_DEVICE);
1209
1210         if (rsp->ulpStatus) {
1211                 if (rsp->ulpStatus == IOSTAT_LOCAL_REJECT) {
1212                         switch (rsp->un.ulpWord[4] & 0xff) {
1213                         case IOERR_SEQUENCE_TIMEOUT:
1214                                 rc = -ETIMEDOUT;
1215                                 break;
1216                         case IOERR_INVALID_RPI:
1217                                 rc = -EFAULT;
1218                                 break;
1219                         default:
1220                                 rc = -EACCES;
1221                                 break;
1222                         }
1223                 } else
1224                         rc = -EACCES;
1225         } else
1226                 job->reply->reply_payload_rcv_len =
1227                         rsp->un.genreq64.bdl.bdeSize;
1228
1229         lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
1230         lpfc_sli_release_iocbq(phba, cmdiocbq);
1231         lpfc_nlp_put(ndlp);
1232         kfree(bmp);
1233         kfree(dd_data);
1234         /* make error code available to userspace */
1235         job->reply->result = rc;
1236         job->dd_data = NULL;
1237         /* complete the job back to userspace */
1238         job->job_done(job);
1239         spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1240         return;
1241 }
1242
1243 /**
1244  * lpfc_issue_ct_rsp - issue a ct response
1245  * @phba: Pointer to HBA context object.
1246  * @job: Pointer to the job object.
1247  * @tag: tag index value into the ports context exchange array.
1248  * @bmp: Pointer to a dma buffer descriptor.
1249  * @num_entry: Number of enties in the bde.
1250  **/
1251 static int
1252 lpfc_issue_ct_rsp(struct lpfc_hba *phba, struct fc_bsg_job *job, uint32_t tag,
1253                   struct lpfc_dmabuf *bmp, int num_entry)
1254 {
1255         IOCB_t *icmd;
1256         struct lpfc_iocbq *ctiocb = NULL;
1257         int rc = 0;
1258         struct lpfc_nodelist *ndlp = NULL;
1259         struct bsg_job_data *dd_data;
1260         uint32_t creg_val;
1261
1262         /* allocate our bsg tracking structure */
1263         dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
1264         if (!dd_data) {
1265                 lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1266                                 "2736 Failed allocation of dd_data\n");
1267                 rc = -ENOMEM;
1268                 goto no_dd_data;
1269         }
1270
1271         /* Allocate buffer for  command iocb */
1272         ctiocb = lpfc_sli_get_iocbq(phba);
1273         if (!ctiocb) {
1274                 rc = ENOMEM;
1275                 goto no_ctiocb;
1276         }
1277
1278         icmd = &ctiocb->iocb;
1279         icmd->un.xseq64.bdl.ulpIoTag32 = 0;
1280         icmd->un.xseq64.bdl.addrHigh = putPaddrHigh(bmp->phys);
1281         icmd->un.xseq64.bdl.addrLow = putPaddrLow(bmp->phys);
1282         icmd->un.xseq64.bdl.bdeFlags = BUFF_TYPE_BLP_64;
1283         icmd->un.xseq64.bdl.bdeSize = (num_entry * sizeof(struct ulp_bde64));
1284         icmd->un.xseq64.w5.hcsw.Fctl = (LS | LA);
1285         icmd->un.xseq64.w5.hcsw.Dfctl = 0;
1286         icmd->un.xseq64.w5.hcsw.Rctl = FC_RCTL_DD_SOL_CTL;
1287         icmd->un.xseq64.w5.hcsw.Type = FC_TYPE_CT;
1288
1289         /* Fill in rest of iocb */
1290         icmd->ulpCommand = CMD_XMIT_SEQUENCE64_CX;
1291         icmd->ulpBdeCount = 1;
1292         icmd->ulpLe = 1;
1293         icmd->ulpClass = CLASS3;
1294         if (phba->sli_rev == LPFC_SLI_REV4) {
1295                 /* Do not issue unsol response if oxid not marked as valid */
1296                 if (!(phba->ct_ctx[tag].flags & UNSOL_VALID)) {
1297                         rc = IOCB_ERROR;
1298                         goto issue_ct_rsp_exit;
1299                 }
1300                 icmd->ulpContext = phba->ct_ctx[tag].oxid;
1301                 ndlp = lpfc_findnode_did(phba->pport, phba->ct_ctx[tag].SID);
1302                 if (!ndlp) {
1303                         lpfc_printf_log(phba, KERN_WARNING, LOG_ELS,
1304                                  "2721 ndlp null for oxid %x SID %x\n",
1305                                         icmd->ulpContext,
1306                                         phba->ct_ctx[tag].SID);
1307                         rc = IOCB_ERROR;
1308                         goto issue_ct_rsp_exit;
1309                 }
1310                 icmd->un.ulpWord[3] = ndlp->nlp_rpi;
1311                 /* The exchange is done, mark the entry as invalid */
1312                 phba->ct_ctx[tag].flags &= ~UNSOL_VALID;
1313         } else
1314                 icmd->ulpContext = (ushort) tag;
1315
1316         icmd->ulpTimeout = phba->fc_ratov * 2;
1317
1318         /* Xmit CT response on exchange <xid> */
1319         lpfc_printf_log(phba, KERN_INFO, LOG_ELS,
1320                         "2722 Xmit CT response on exchange x%x Data: x%x x%x\n",
1321                         icmd->ulpContext, icmd->ulpIoTag, phba->link_state);
1322
1323         ctiocb->iocb_cmpl = NULL;
1324         ctiocb->iocb_flag |= LPFC_IO_LIBDFC;
1325         ctiocb->vport = phba->pport;
1326         ctiocb->context3 = bmp;
1327
1328         ctiocb->iocb_cmpl = lpfc_issue_ct_rsp_cmp;
1329         ctiocb->context1 = dd_data;
1330         ctiocb->context2 = NULL;
1331         dd_data->type = TYPE_IOCB;
1332         dd_data->context_un.iocb.cmdiocbq = ctiocb;
1333         dd_data->context_un.iocb.rspiocbq = NULL;
1334         dd_data->context_un.iocb.set_job = job;
1335         dd_data->context_un.iocb.bmp = bmp;
1336         dd_data->context_un.iocb.ndlp = ndlp;
1337
1338         if (phba->cfg_poll & DISABLE_FCP_RING_INT) {
1339                 creg_val = readl(phba->HCregaddr);
1340                 creg_val |= (HC_R0INT_ENA << LPFC_FCP_RING);
1341                 writel(creg_val, phba->HCregaddr);
1342                 readl(phba->HCregaddr); /* flush */
1343         }
1344
1345         rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, ctiocb, 0);
1346
1347         if (rc == IOCB_SUCCESS)
1348                 return 0; /* done for now */
1349
1350 issue_ct_rsp_exit:
1351         lpfc_sli_release_iocbq(phba, ctiocb);
1352 no_ctiocb:
1353         kfree(dd_data);
1354 no_dd_data:
1355         return rc;
1356 }
1357
1358 /**
1359  * lpfc_bsg_send_mgmt_rsp - process a SEND_MGMT_RESP bsg vendor command
1360  * @job: SEND_MGMT_RESP fc_bsg_job
1361  **/
1362 static int
1363 lpfc_bsg_send_mgmt_rsp(struct fc_bsg_job *job)
1364 {
1365         struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
1366         struct lpfc_hba *phba = vport->phba;
1367         struct send_mgmt_resp *mgmt_resp = (struct send_mgmt_resp *)
1368                 job->request->rqst_data.h_vendor.vendor_cmd;
1369         struct ulp_bde64 *bpl;
1370         struct lpfc_dmabuf *bmp = NULL;
1371         struct scatterlist *sgel = NULL;
1372         int request_nseg;
1373         int numbde;
1374         dma_addr_t busaddr;
1375         uint32_t tag = mgmt_resp->tag;
1376         unsigned long reqbfrcnt =
1377                         (unsigned long)job->request_payload.payload_len;
1378         int rc = 0;
1379
1380         /* in case no data is transferred */
1381         job->reply->reply_payload_rcv_len = 0;
1382
1383         if (!reqbfrcnt || (reqbfrcnt > (80 * BUF_SZ_4K))) {
1384                 rc = -ERANGE;
1385                 goto send_mgmt_rsp_exit;
1386         }
1387
1388         bmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
1389         if (!bmp) {
1390                 rc = -ENOMEM;
1391                 goto send_mgmt_rsp_exit;
1392         }
1393
1394         bmp->virt = lpfc_mbuf_alloc(phba, 0, &bmp->phys);
1395         if (!bmp->virt) {
1396                 rc = -ENOMEM;
1397                 goto send_mgmt_rsp_free_bmp;
1398         }
1399
1400         INIT_LIST_HEAD(&bmp->list);
1401         bpl = (struct ulp_bde64 *) bmp->virt;
1402         request_nseg = pci_map_sg(phba->pcidev, job->request_payload.sg_list,
1403                                   job->request_payload.sg_cnt, DMA_TO_DEVICE);
1404         for_each_sg(job->request_payload.sg_list, sgel, request_nseg, numbde) {
1405                 busaddr = sg_dma_address(sgel);
1406                 bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64;
1407                 bpl->tus.f.bdeSize = sg_dma_len(sgel);
1408                 bpl->tus.w = cpu_to_le32(bpl->tus.w);
1409                 bpl->addrLow = cpu_to_le32(putPaddrLow(busaddr));
1410                 bpl->addrHigh = cpu_to_le32(putPaddrHigh(busaddr));
1411                 bpl++;
1412         }
1413
1414         rc = lpfc_issue_ct_rsp(phba, job, tag, bmp, request_nseg);
1415
1416         if (rc == IOCB_SUCCESS)
1417                 return 0; /* done for now */
1418
1419         /* TBD need to handle a timeout */
1420         pci_unmap_sg(phba->pcidev, job->request_payload.sg_list,
1421                           job->request_payload.sg_cnt, DMA_TO_DEVICE);
1422         rc = -EACCES;
1423         lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
1424
1425 send_mgmt_rsp_free_bmp:
1426         kfree(bmp);
1427 send_mgmt_rsp_exit:
1428         /* make error code available to userspace */
1429         job->reply->result = rc;
1430         job->dd_data = NULL;
1431         return rc;
1432 }
1433
1434 /**
1435  * lpfc_bsg_diag_mode - process a LPFC_BSG_VENDOR_DIAG_MODE bsg vendor command
1436  * @job: LPFC_BSG_VENDOR_DIAG_MODE
1437  *
1438  * This function is responsible for placing a port into diagnostic loopback
1439  * mode in order to perform a diagnostic loopback test.
1440  * All new scsi requests are blocked, a small delay is used to allow the
1441  * scsi requests to complete then the link is brought down. If the link is
1442  * is placed in loopback mode then scsi requests are again allowed
1443  * so the scsi mid-layer doesn't give up on the port.
1444  * All of this is done in-line.
1445  */
1446 static int
1447 lpfc_bsg_diag_mode(struct fc_bsg_job *job)
1448 {
1449         struct Scsi_Host *shost = job->shost;
1450         struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
1451         struct lpfc_hba *phba = vport->phba;
1452         struct diag_mode_set *loopback_mode;
1453         struct lpfc_sli *psli = &phba->sli;
1454         struct lpfc_sli_ring *pring = &psli->ring[LPFC_FCP_RING];
1455         uint32_t link_flags;
1456         uint32_t timeout;
1457         struct lpfc_vport **vports;
1458         LPFC_MBOXQ_t *pmboxq;
1459         int mbxstatus;
1460         int i = 0;
1461         int rc = 0;
1462
1463         /* no data to return just the return code */
1464         job->reply->reply_payload_rcv_len = 0;
1465
1466         if (job->request_len <
1467             sizeof(struct fc_bsg_request) + sizeof(struct diag_mode_set)) {
1468                 lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
1469                                 "2738 Received DIAG MODE request below minimum "
1470                                 "size\n");
1471                 rc = -EINVAL;
1472                 goto job_error;
1473         }
1474
1475         loopback_mode = (struct diag_mode_set *)
1476                 job->request->rqst_data.h_vendor.vendor_cmd;
1477         link_flags = loopback_mode->type;
1478         timeout = loopback_mode->timeout;
1479
1480         if ((phba->link_state == LPFC_HBA_ERROR) ||
1481             (psli->sli_flag & LPFC_BLOCK_MGMT_IO) ||
1482             (!(psli->sli_flag & LPFC_SLI_ACTIVE))) {
1483                 rc = -EACCES;
1484                 goto job_error;
1485         }
1486
1487         pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
1488         if (!pmboxq) {
1489                 rc = -ENOMEM;
1490                 goto job_error;
1491         }
1492
1493         vports = lpfc_create_vport_work_array(phba);
1494         if (vports) {
1495                 for (i = 0; i <= phba->max_vpi && vports[i] != NULL; i++) {
1496                         shost = lpfc_shost_from_vport(vports[i]);
1497                         scsi_block_requests(shost);
1498                 }
1499
1500                 lpfc_destroy_vport_work_array(phba, vports);
1501         } else {
1502                 shost = lpfc_shost_from_vport(phba->pport);
1503                 scsi_block_requests(shost);
1504         }
1505
1506         while (pring->txcmplq_cnt) {
1507                 if (i++ > 500)  /* wait up to 5 seconds */
1508                         break;
1509
1510                 msleep(10);
1511         }
1512
1513         memset((void *)pmboxq, 0, sizeof(LPFC_MBOXQ_t));
1514         pmboxq->u.mb.mbxCommand = MBX_DOWN_LINK;
1515         pmboxq->u.mb.mbxOwner = OWN_HOST;
1516
1517         mbxstatus = lpfc_sli_issue_mbox_wait(phba, pmboxq, LPFC_MBOX_TMO);
1518
1519         if ((mbxstatus == MBX_SUCCESS) && (pmboxq->u.mb.mbxStatus == 0)) {
1520                 /* wait for link down before proceeding */
1521                 i = 0;
1522                 while (phba->link_state != LPFC_LINK_DOWN) {
1523                         if (i++ > timeout) {
1524                                 rc = -ETIMEDOUT;
1525                                 goto loopback_mode_exit;
1526                         }
1527
1528                         msleep(10);
1529                 }
1530
1531                 memset((void *)pmboxq, 0, sizeof(LPFC_MBOXQ_t));
1532                 if (link_flags == INTERNAL_LOOP_BACK)
1533                         pmboxq->u.mb.un.varInitLnk.link_flags = FLAGS_LOCAL_LB;
1534                 else
1535                         pmboxq->u.mb.un.varInitLnk.link_flags =
1536                                 FLAGS_TOPOLOGY_MODE_LOOP;
1537
1538                 pmboxq->u.mb.mbxCommand = MBX_INIT_LINK;
1539                 pmboxq->u.mb.mbxOwner = OWN_HOST;
1540
1541                 mbxstatus = lpfc_sli_issue_mbox_wait(phba, pmboxq,
1542                                                      LPFC_MBOX_TMO);
1543
1544                 if ((mbxstatus != MBX_SUCCESS) || (pmboxq->u.mb.mbxStatus))
1545                         rc = -ENODEV;
1546                 else {
1547                         phba->link_flag |= LS_LOOPBACK_MODE;
1548                         /* wait for the link attention interrupt */
1549                         msleep(100);
1550
1551                         i = 0;
1552                         while (phba->link_state != LPFC_HBA_READY) {
1553                                 if (i++ > timeout) {
1554                                         rc = -ETIMEDOUT;
1555                                         break;
1556                                 }
1557
1558                                 msleep(10);
1559                         }
1560                 }
1561
1562         } else
1563                 rc = -ENODEV;
1564
1565 loopback_mode_exit:
1566         vports = lpfc_create_vport_work_array(phba);
1567         if (vports) {
1568                 for (i = 0; i <= phba->max_vpi && vports[i] != NULL; i++) {
1569                         shost = lpfc_shost_from_vport(vports[i]);
1570                         scsi_unblock_requests(shost);
1571                 }
1572                 lpfc_destroy_vport_work_array(phba, vports);
1573         } else {
1574                 shost = lpfc_shost_from_vport(phba->pport);
1575                 scsi_unblock_requests(shost);
1576         }
1577
1578         /*
1579          * Let SLI layer release mboxq if mbox command completed after timeout.
1580          */
1581         if (mbxstatus != MBX_TIMEOUT)
1582                 mempool_free(pmboxq, phba->mbox_mem_pool);
1583
1584 job_error:
1585         /* make error code available to userspace */
1586         job->reply->result = rc;
1587         /* complete the job back to userspace if no error */
1588         if (rc == 0)
1589                 job->job_done(job);
1590         return rc;
1591 }
1592
1593 /**
1594  * lpfcdiag_loop_self_reg - obtains a remote port login id
1595  * @phba: Pointer to HBA context object
1596  * @rpi: Pointer to a remote port login id
1597  *
1598  * This function obtains a remote port login id so the diag loopback test
1599  * can send and receive its own unsolicited CT command.
1600  **/
1601 static int lpfcdiag_loop_self_reg(struct lpfc_hba *phba, uint16_t * rpi)
1602 {
1603         LPFC_MBOXQ_t *mbox;
1604         struct lpfc_dmabuf *dmabuff;
1605         int status;
1606
1607         mbox = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
1608         if (!mbox)
1609                 return ENOMEM;
1610
1611         status = lpfc_reg_rpi(phba, 0, phba->pport->fc_myDID,
1612                                 (uint8_t *)&phba->pport->fc_sparam, mbox, 0);
1613         if (status) {
1614                 mempool_free(mbox, phba->mbox_mem_pool);
1615                 return ENOMEM;
1616         }
1617
1618         dmabuff = (struct lpfc_dmabuf *) mbox->context1;
1619         mbox->context1 = NULL;
1620         status = lpfc_sli_issue_mbox_wait(phba, mbox, LPFC_MBOX_TMO);
1621
1622         if ((status != MBX_SUCCESS) || (mbox->u.mb.mbxStatus)) {
1623                 lpfc_mbuf_free(phba, dmabuff->virt, dmabuff->phys);
1624                 kfree(dmabuff);
1625                 if (status != MBX_TIMEOUT)
1626                         mempool_free(mbox, phba->mbox_mem_pool);
1627                 return ENODEV;
1628         }
1629
1630         *rpi = mbox->u.mb.un.varWords[0];
1631
1632         lpfc_mbuf_free(phba, dmabuff->virt, dmabuff->phys);
1633         kfree(dmabuff);
1634         mempool_free(mbox, phba->mbox_mem_pool);
1635         return 0;
1636 }
1637
1638 /**
1639  * lpfcdiag_loop_self_unreg - unregs from the rpi
1640  * @phba: Pointer to HBA context object
1641  * @rpi: Remote port login id
1642  *
1643  * This function unregisters the rpi obtained in lpfcdiag_loop_self_reg
1644  **/
1645 static int lpfcdiag_loop_self_unreg(struct lpfc_hba *phba, uint16_t rpi)
1646 {
1647         LPFC_MBOXQ_t *mbox;
1648         int status;
1649
1650         /* Allocate mboxq structure */
1651         mbox = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
1652         if (mbox == NULL)
1653                 return ENOMEM;
1654
1655         lpfc_unreg_login(phba, 0, rpi, mbox);
1656         status = lpfc_sli_issue_mbox_wait(phba, mbox, LPFC_MBOX_TMO);
1657
1658         if ((status != MBX_SUCCESS) || (mbox->u.mb.mbxStatus)) {
1659                 if (status != MBX_TIMEOUT)
1660                         mempool_free(mbox, phba->mbox_mem_pool);
1661                 return EIO;
1662         }
1663
1664         mempool_free(mbox, phba->mbox_mem_pool);
1665         return 0;
1666 }
1667
1668 /**
1669  * lpfcdiag_loop_get_xri - obtains the transmit and receive ids
1670  * @phba: Pointer to HBA context object
1671  * @rpi: Remote port login id
1672  * @txxri: Pointer to transmit exchange id
1673  * @rxxri: Pointer to response exchabge id
1674  *
1675  * This function obtains the transmit and receive ids required to send
1676  * an unsolicited ct command with a payload. A special lpfc FsType and CmdRsp
1677  * flags are used to the unsolicted response handler is able to process
1678  * the ct command sent on the same port.
1679  **/
1680 static int lpfcdiag_loop_get_xri(struct lpfc_hba *phba, uint16_t rpi,
1681                          uint16_t *txxri, uint16_t * rxxri)
1682 {
1683         struct lpfc_bsg_event *evt;
1684         struct lpfc_iocbq *cmdiocbq, *rspiocbq;
1685         IOCB_t *cmd, *rsp;
1686         struct lpfc_dmabuf *dmabuf;
1687         struct ulp_bde64 *bpl = NULL;
1688         struct lpfc_sli_ct_request *ctreq = NULL;
1689         int ret_val = 0;
1690         unsigned long flags;
1691
1692         *txxri = 0;
1693         *rxxri = 0;
1694         evt = lpfc_bsg_event_new(FC_REG_CT_EVENT, current->pid,
1695                                 SLI_CT_ELX_LOOPBACK);
1696         if (!evt)
1697                 return ENOMEM;
1698
1699         spin_lock_irqsave(&phba->ct_ev_lock, flags);
1700         list_add(&evt->node, &phba->ct_ev_waiters);
1701         lpfc_bsg_event_ref(evt);
1702         spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1703
1704         cmdiocbq = lpfc_sli_get_iocbq(phba);
1705         rspiocbq = lpfc_sli_get_iocbq(phba);
1706
1707         dmabuf = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
1708         if (dmabuf) {
1709                 dmabuf->virt = lpfc_mbuf_alloc(phba, 0, &dmabuf->phys);
1710                 INIT_LIST_HEAD(&dmabuf->list);
1711                 bpl = (struct ulp_bde64 *) dmabuf->virt;
1712                 memset(bpl, 0, sizeof(*bpl));
1713                 ctreq = (struct lpfc_sli_ct_request *)(bpl + 1);
1714                 bpl->addrHigh =
1715                         le32_to_cpu(putPaddrHigh(dmabuf->phys + sizeof(*bpl)));
1716                 bpl->addrLow =
1717                         le32_to_cpu(putPaddrLow(dmabuf->phys + sizeof(*bpl)));
1718                 bpl->tus.f.bdeFlags = 0;
1719                 bpl->tus.f.bdeSize = ELX_LOOPBACK_HEADER_SZ;
1720                 bpl->tus.w = le32_to_cpu(bpl->tus.w);
1721         }
1722
1723         if (cmdiocbq == NULL || rspiocbq == NULL ||
1724             dmabuf == NULL || bpl == NULL || ctreq == NULL) {
1725                 ret_val = ENOMEM;
1726                 goto err_get_xri_exit;
1727         }
1728
1729         cmd = &cmdiocbq->iocb;
1730         rsp = &rspiocbq->iocb;
1731
1732         memset(ctreq, 0, ELX_LOOPBACK_HEADER_SZ);
1733
1734         ctreq->RevisionId.bits.Revision = SLI_CT_REVISION;
1735         ctreq->RevisionId.bits.InId = 0;
1736         ctreq->FsType = SLI_CT_ELX_LOOPBACK;
1737         ctreq->FsSubType = 0;
1738         ctreq->CommandResponse.bits.CmdRsp = ELX_LOOPBACK_XRI_SETUP;
1739         ctreq->CommandResponse.bits.Size = 0;
1740
1741
1742         cmd->un.xseq64.bdl.addrHigh = putPaddrHigh(dmabuf->phys);
1743         cmd->un.xseq64.bdl.addrLow = putPaddrLow(dmabuf->phys);
1744         cmd->un.xseq64.bdl.bdeFlags = BUFF_TYPE_BLP_64;
1745         cmd->un.xseq64.bdl.bdeSize = sizeof(*bpl);
1746
1747         cmd->un.xseq64.w5.hcsw.Fctl = LA;
1748         cmd->un.xseq64.w5.hcsw.Dfctl = 0;
1749         cmd->un.xseq64.w5.hcsw.Rctl = FC_RCTL_DD_UNSOL_CTL;
1750         cmd->un.xseq64.w5.hcsw.Type = FC_TYPE_CT;
1751
1752         cmd->ulpCommand = CMD_XMIT_SEQUENCE64_CR;
1753         cmd->ulpBdeCount = 1;
1754         cmd->ulpLe = 1;
1755         cmd->ulpClass = CLASS3;
1756         cmd->ulpContext = rpi;
1757
1758         cmdiocbq->iocb_flag |= LPFC_IO_LIBDFC;
1759         cmdiocbq->vport = phba->pport;
1760
1761         ret_val = lpfc_sli_issue_iocb_wait(phba, LPFC_ELS_RING, cmdiocbq,
1762                                 rspiocbq,
1763                                 (phba->fc_ratov * 2)
1764                                 + LPFC_DRVR_TIMEOUT);
1765         if (ret_val)
1766                 goto err_get_xri_exit;
1767
1768         *txxri =  rsp->ulpContext;
1769
1770         evt->waiting = 1;
1771         evt->wait_time_stamp = jiffies;
1772         ret_val = wait_event_interruptible_timeout(
1773                 evt->wq, !list_empty(&evt->events_to_see),
1774                 ((phba->fc_ratov * 2) + LPFC_DRVR_TIMEOUT) * HZ);
1775         if (list_empty(&evt->events_to_see))
1776                 ret_val = (ret_val) ? EINTR : ETIMEDOUT;
1777         else {
1778                 ret_val = IOCB_SUCCESS;
1779                 spin_lock_irqsave(&phba->ct_ev_lock, flags);
1780                 list_move(evt->events_to_see.prev, &evt->events_to_get);
1781                 spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1782                 *rxxri = (list_entry(evt->events_to_get.prev,
1783                                      typeof(struct event_data),
1784                                      node))->immed_dat;
1785         }
1786         evt->waiting = 0;
1787
1788 err_get_xri_exit:
1789         spin_lock_irqsave(&phba->ct_ev_lock, flags);
1790         lpfc_bsg_event_unref(evt); /* release ref */
1791         lpfc_bsg_event_unref(evt); /* delete */
1792         spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
1793
1794         if (dmabuf) {
1795                 if (dmabuf->virt)
1796                         lpfc_mbuf_free(phba, dmabuf->virt, dmabuf->phys);
1797                 kfree(dmabuf);
1798         }
1799
1800         if (cmdiocbq && (ret_val != IOCB_TIMEDOUT))
1801                 lpfc_sli_release_iocbq(phba, cmdiocbq);
1802         if (rspiocbq)
1803                 lpfc_sli_release_iocbq(phba, rspiocbq);
1804         return ret_val;
1805 }
1806
1807 /**
1808  * diag_cmd_data_alloc - fills in a bde struct with dma buffers
1809  * @phba: Pointer to HBA context object
1810  * @bpl: Pointer to 64 bit bde structure
1811  * @size: Number of bytes to process
1812  * @nocopydata: Flag to copy user data into the allocated buffer
1813  *
1814  * This function allocates page size buffers and populates an lpfc_dmabufext.
1815  * If allowed the user data pointed to with indataptr is copied into the kernel
1816  * memory. The chained list of page size buffers is returned.
1817  **/
1818 static struct lpfc_dmabufext *
1819 diag_cmd_data_alloc(struct lpfc_hba *phba,
1820                    struct ulp_bde64 *bpl, uint32_t size,
1821                    int nocopydata)
1822 {
1823         struct lpfc_dmabufext *mlist = NULL;
1824         struct lpfc_dmabufext *dmp;
1825         int cnt, offset = 0, i = 0;
1826         struct pci_dev *pcidev;
1827
1828         pcidev = phba->pcidev;
1829
1830         while (size) {
1831                 /* We get chunks of 4K */
1832                 if (size > BUF_SZ_4K)
1833                         cnt = BUF_SZ_4K;
1834                 else
1835                         cnt = size;
1836
1837                 /* allocate struct lpfc_dmabufext buffer header */
1838                 dmp = kmalloc(sizeof(struct lpfc_dmabufext), GFP_KERNEL);
1839                 if (!dmp)
1840                         goto out;
1841
1842                 INIT_LIST_HEAD(&dmp->dma.list);
1843
1844                 /* Queue it to a linked list */
1845                 if (mlist)
1846                         list_add_tail(&dmp->dma.list, &mlist->dma.list);
1847                 else
1848                         mlist = dmp;
1849
1850                 /* allocate buffer */
1851                 dmp->dma.virt = dma_alloc_coherent(&pcidev->dev,
1852                                                    cnt,
1853                                                    &(dmp->dma.phys),
1854                                                    GFP_KERNEL);
1855
1856                 if (!dmp->dma.virt)
1857                         goto out;
1858
1859                 dmp->size = cnt;
1860
1861                 if (nocopydata) {
1862                         bpl->tus.f.bdeFlags = 0;
1863                         pci_dma_sync_single_for_device(phba->pcidev,
1864                                 dmp->dma.phys, LPFC_BPL_SIZE, PCI_DMA_TODEVICE);
1865
1866                 } else {
1867                         memset((uint8_t *)dmp->dma.virt, 0, cnt);
1868                         bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64I;
1869                 }
1870
1871                 /* build buffer ptr list for IOCB */
1872                 bpl->addrLow = le32_to_cpu(putPaddrLow(dmp->dma.phys));
1873                 bpl->addrHigh = le32_to_cpu(putPaddrHigh(dmp->dma.phys));
1874                 bpl->tus.f.bdeSize = (ushort) cnt;
1875                 bpl->tus.w = le32_to_cpu(bpl->tus.w);
1876                 bpl++;
1877
1878                 i++;
1879                 offset += cnt;
1880                 size -= cnt;
1881         }
1882
1883         mlist->flag = i;
1884         return mlist;
1885 out:
1886         diag_cmd_data_free(phba, mlist);
1887         return NULL;
1888 }
1889
1890 /**
1891  * lpfcdiag_loop_post_rxbufs - post the receive buffers for an unsol CT cmd
1892  * @phba: Pointer to HBA context object
1893  * @rxxri: Receive exchange id
1894  * @len: Number of data bytes
1895  *
1896  * This function allocates and posts a data buffer of sufficient size to recieve
1897  * an unsolicted CT command.
1898  **/
1899 static int lpfcdiag_loop_post_rxbufs(struct lpfc_hba *phba, uint16_t rxxri,
1900                              size_t len)
1901 {
1902         struct lpfc_sli *psli = &phba->sli;
1903         struct lpfc_sli_ring *pring = &psli->ring[LPFC_ELS_RING];
1904         struct lpfc_iocbq *cmdiocbq;
1905         IOCB_t *cmd = NULL;
1906         struct list_head head, *curr, *next;
1907         struct lpfc_dmabuf *rxbmp;
1908         struct lpfc_dmabuf *dmp;
1909         struct lpfc_dmabuf *mp[2] = {NULL, NULL};
1910         struct ulp_bde64 *rxbpl = NULL;
1911         uint32_t num_bde;
1912         struct lpfc_dmabufext *rxbuffer = NULL;
1913         int ret_val = 0;
1914         int i = 0;
1915
1916         cmdiocbq = lpfc_sli_get_iocbq(phba);
1917         rxbmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
1918         if (rxbmp != NULL) {
1919                 rxbmp->virt = lpfc_mbuf_alloc(phba, 0, &rxbmp->phys);
1920                 INIT_LIST_HEAD(&rxbmp->list);
1921                 rxbpl = (struct ulp_bde64 *) rxbmp->virt;
1922                 rxbuffer = diag_cmd_data_alloc(phba, rxbpl, len, 0);
1923         }
1924
1925         if (!cmdiocbq || !rxbmp || !rxbpl || !rxbuffer) {
1926                 ret_val = ENOMEM;
1927                 goto err_post_rxbufs_exit;
1928         }
1929
1930         /* Queue buffers for the receive exchange */
1931         num_bde = (uint32_t)rxbuffer->flag;
1932         dmp = &rxbuffer->dma;
1933
1934         cmd = &cmdiocbq->iocb;
1935         i = 0;
1936
1937         INIT_LIST_HEAD(&head);
1938         list_add_tail(&head, &dmp->list);
1939         list_for_each_safe(curr, next, &head) {
1940                 mp[i] = list_entry(curr, struct lpfc_dmabuf, list);
1941                 list_del(curr);
1942
1943                 if (phba->sli3_options & LPFC_SLI3_HBQ_ENABLED) {
1944                         mp[i]->buffer_tag = lpfc_sli_get_buffer_tag(phba);
1945                         cmd->un.quexri64cx.buff.bde.addrHigh =
1946                                 putPaddrHigh(mp[i]->phys);
1947                         cmd->un.quexri64cx.buff.bde.addrLow =
1948                                 putPaddrLow(mp[i]->phys);
1949                         cmd->un.quexri64cx.buff.bde.tus.f.bdeSize =
1950                                 ((struct lpfc_dmabufext *)mp[i])->size;
1951                         cmd->un.quexri64cx.buff.buffer_tag = mp[i]->buffer_tag;
1952                         cmd->ulpCommand = CMD_QUE_XRI64_CX;
1953                         cmd->ulpPU = 0;
1954                         cmd->ulpLe = 1;
1955                         cmd->ulpBdeCount = 1;
1956                         cmd->unsli3.que_xri64cx_ext_words.ebde_count = 0;
1957
1958                 } else {
1959                         cmd->un.cont64[i].addrHigh = putPaddrHigh(mp[i]->phys);
1960                         cmd->un.cont64[i].addrLow = putPaddrLow(mp[i]->phys);
1961                         cmd->un.cont64[i].tus.f.bdeSize =
1962                                 ((struct lpfc_dmabufext *)mp[i])->size;
1963                                         cmd->ulpBdeCount = ++i;
1964
1965                         if ((--num_bde > 0) && (i < 2))
1966                                 continue;
1967
1968                         cmd->ulpCommand = CMD_QUE_XRI_BUF64_CX;
1969                         cmd->ulpLe = 1;
1970                 }
1971
1972                 cmd->ulpClass = CLASS3;
1973                 cmd->ulpContext = rxxri;
1974
1975                 ret_val = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, cmdiocbq, 0);
1976
1977                 if (ret_val == IOCB_ERROR) {
1978                         diag_cmd_data_free(phba,
1979                                 (struct lpfc_dmabufext *)mp[0]);
1980                         if (mp[1])
1981                                 diag_cmd_data_free(phba,
1982                                           (struct lpfc_dmabufext *)mp[1]);
1983                         dmp = list_entry(next, struct lpfc_dmabuf, list);
1984                         ret_val = EIO;
1985                         goto err_post_rxbufs_exit;
1986                 }
1987
1988                 lpfc_sli_ringpostbuf_put(phba, pring, mp[0]);
1989                 if (mp[1]) {
1990                         lpfc_sli_ringpostbuf_put(phba, pring, mp[1]);
1991                         mp[1] = NULL;
1992                 }
1993
1994                 /* The iocb was freed by lpfc_sli_issue_iocb */
1995                 cmdiocbq = lpfc_sli_get_iocbq(phba);
1996                 if (!cmdiocbq) {
1997                         dmp = list_entry(next, struct lpfc_dmabuf, list);
1998                         ret_val = EIO;
1999                         goto err_post_rxbufs_exit;
2000                 }
2001
2002                 cmd = &cmdiocbq->iocb;
2003                 i = 0;
2004         }
2005         list_del(&head);
2006
2007 err_post_rxbufs_exit:
2008
2009         if (rxbmp) {
2010                 if (rxbmp->virt)
2011                         lpfc_mbuf_free(phba, rxbmp->virt, rxbmp->phys);
2012                 kfree(rxbmp);
2013         }
2014
2015         if (cmdiocbq)
2016                 lpfc_sli_release_iocbq(phba, cmdiocbq);
2017         return ret_val;
2018 }
2019
2020 /**
2021  * lpfc_bsg_diag_test - with a port in loopback issues a Ct cmd to itself
2022  * @job: LPFC_BSG_VENDOR_DIAG_TEST fc_bsg_job
2023  *
2024  * This function receives a user data buffer to be transmitted and received on
2025  * the same port, the link must be up and in loopback mode prior
2026  * to being called.
2027  * 1. A kernel buffer is allocated to copy the user data into.
2028  * 2. The port registers with "itself".
2029  * 3. The transmit and receive exchange ids are obtained.
2030  * 4. The receive exchange id is posted.
2031  * 5. A new els loopback event is created.
2032  * 6. The command and response iocbs are allocated.
2033  * 7. The cmd iocb FsType is set to elx loopback and the CmdRsp to looppback.
2034  *
2035  * This function is meant to be called n times while the port is in loopback
2036  * so it is the apps responsibility to issue a reset to take the port out
2037  * of loopback mode.
2038  **/
2039 static int
2040 lpfc_bsg_diag_test(struct fc_bsg_job *job)
2041 {
2042         struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
2043         struct lpfc_hba *phba = vport->phba;
2044         struct diag_mode_test *diag_mode;
2045         struct lpfc_bsg_event *evt;
2046         struct event_data *evdat;
2047         struct lpfc_sli *psli = &phba->sli;
2048         uint32_t size;
2049         uint32_t full_size;
2050         size_t segment_len = 0, segment_offset = 0, current_offset = 0;
2051         uint16_t rpi;
2052         struct lpfc_iocbq *cmdiocbq, *rspiocbq;
2053         IOCB_t *cmd, *rsp;
2054         struct lpfc_sli_ct_request *ctreq;
2055         struct lpfc_dmabuf *txbmp;
2056         struct ulp_bde64 *txbpl = NULL;
2057         struct lpfc_dmabufext *txbuffer = NULL;
2058         struct list_head head;
2059         struct lpfc_dmabuf  *curr;
2060         uint16_t txxri, rxxri;
2061         uint32_t num_bde;
2062         uint8_t *ptr = NULL, *rx_databuf = NULL;
2063         int rc = 0;
2064         unsigned long flags;
2065         void *dataout = NULL;
2066         uint32_t total_mem;
2067
2068         /* in case no data is returned return just the return code */
2069         job->reply->reply_payload_rcv_len = 0;
2070
2071         if (job->request_len <
2072             sizeof(struct fc_bsg_request) + sizeof(struct diag_mode_test)) {
2073                 lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2074                                 "2739 Received DIAG TEST request below minimum "
2075                                 "size\n");
2076                 rc = -EINVAL;
2077                 goto loopback_test_exit;
2078         }
2079
2080         if (job->request_payload.payload_len !=
2081                 job->reply_payload.payload_len) {
2082                 rc = -EINVAL;
2083                 goto loopback_test_exit;
2084         }
2085
2086         diag_mode = (struct diag_mode_test *)
2087                 job->request->rqst_data.h_vendor.vendor_cmd;
2088
2089         if ((phba->link_state == LPFC_HBA_ERROR) ||
2090             (psli->sli_flag & LPFC_BLOCK_MGMT_IO) ||
2091             (!(psli->sli_flag & LPFC_SLI_ACTIVE))) {
2092                 rc = -EACCES;
2093                 goto loopback_test_exit;
2094         }
2095
2096         if (!lpfc_is_link_up(phba) || !(phba->link_flag & LS_LOOPBACK_MODE)) {
2097                 rc = -EACCES;
2098                 goto loopback_test_exit;
2099         }
2100
2101         size = job->request_payload.payload_len;
2102         full_size = size + ELX_LOOPBACK_HEADER_SZ; /* plus the header */
2103
2104         if ((size == 0) || (size > 80 * BUF_SZ_4K)) {
2105                 rc = -ERANGE;
2106                 goto loopback_test_exit;
2107         }
2108
2109         if (size >= BUF_SZ_4K) {
2110                 /*
2111                  * Allocate memory for ioctl data. If buffer is bigger than 64k,
2112                  * then we allocate 64k and re-use that buffer over and over to
2113                  * xfer the whole block. This is because Linux kernel has a
2114                  * problem allocating more than 120k of kernel space memory. Saw
2115                  * problem with GET_FCPTARGETMAPPING...
2116                  */
2117                 if (size <= (64 * 1024))
2118                         total_mem = size;
2119                 else
2120                         total_mem = 64 * 1024;
2121         } else
2122                 /* Allocate memory for ioctl data */
2123                 total_mem = BUF_SZ_4K;
2124
2125         dataout = kmalloc(total_mem, GFP_KERNEL);
2126         if (dataout == NULL) {
2127                 rc = -ENOMEM;
2128                 goto loopback_test_exit;
2129         }
2130
2131         ptr = dataout;
2132         ptr += ELX_LOOPBACK_HEADER_SZ;
2133         sg_copy_to_buffer(job->request_payload.sg_list,
2134                                 job->request_payload.sg_cnt,
2135                                 ptr, size);
2136
2137         rc = lpfcdiag_loop_self_reg(phba, &rpi);
2138         if (rc) {
2139                 rc = -ENOMEM;
2140                 goto loopback_test_exit;
2141         }
2142
2143         rc = lpfcdiag_loop_get_xri(phba, rpi, &txxri, &rxxri);
2144         if (rc) {
2145                 lpfcdiag_loop_self_unreg(phba, rpi);
2146                 rc = -ENOMEM;
2147                 goto loopback_test_exit;
2148         }
2149
2150         rc = lpfcdiag_loop_post_rxbufs(phba, rxxri, full_size);
2151         if (rc) {
2152                 lpfcdiag_loop_self_unreg(phba, rpi);
2153                 rc = -ENOMEM;
2154                 goto loopback_test_exit;
2155         }
2156
2157         evt = lpfc_bsg_event_new(FC_REG_CT_EVENT, current->pid,
2158                                 SLI_CT_ELX_LOOPBACK);
2159         if (!evt) {
2160                 lpfcdiag_loop_self_unreg(phba, rpi);
2161                 rc = -ENOMEM;
2162                 goto loopback_test_exit;
2163         }
2164
2165         spin_lock_irqsave(&phba->ct_ev_lock, flags);
2166         list_add(&evt->node, &phba->ct_ev_waiters);
2167         lpfc_bsg_event_ref(evt);
2168         spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
2169
2170         cmdiocbq = lpfc_sli_get_iocbq(phba);
2171         rspiocbq = lpfc_sli_get_iocbq(phba);
2172         txbmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
2173
2174         if (txbmp) {
2175                 txbmp->virt = lpfc_mbuf_alloc(phba, 0, &txbmp->phys);
2176                 INIT_LIST_HEAD(&txbmp->list);
2177                 txbpl = (struct ulp_bde64 *) txbmp->virt;
2178                 if (txbpl)
2179                         txbuffer = diag_cmd_data_alloc(phba,
2180                                                         txbpl, full_size, 0);
2181         }
2182
2183         if (!cmdiocbq || !rspiocbq || !txbmp || !txbpl || !txbuffer) {
2184                 rc = -ENOMEM;
2185                 goto err_loopback_test_exit;
2186         }
2187
2188         cmd = &cmdiocbq->iocb;
2189         rsp = &rspiocbq->iocb;
2190
2191         INIT_LIST_HEAD(&head);
2192         list_add_tail(&head, &txbuffer->dma.list);
2193         list_for_each_entry(curr, &head, list) {
2194                 segment_len = ((struct lpfc_dmabufext *)curr)->size;
2195                 if (current_offset == 0) {
2196                         ctreq = curr->virt;
2197                         memset(ctreq, 0, ELX_LOOPBACK_HEADER_SZ);
2198                         ctreq->RevisionId.bits.Revision = SLI_CT_REVISION;
2199                         ctreq->RevisionId.bits.InId = 0;
2200                         ctreq->FsType = SLI_CT_ELX_LOOPBACK;
2201                         ctreq->FsSubType = 0;
2202                         ctreq->CommandResponse.bits.CmdRsp = ELX_LOOPBACK_DATA;
2203                         ctreq->CommandResponse.bits.Size   = size;
2204                         segment_offset = ELX_LOOPBACK_HEADER_SZ;
2205                 } else
2206                         segment_offset = 0;
2207
2208                 BUG_ON(segment_offset >= segment_len);
2209                 memcpy(curr->virt + segment_offset,
2210                         ptr + current_offset,
2211                         segment_len - segment_offset);
2212
2213                 current_offset += segment_len - segment_offset;
2214                 BUG_ON(current_offset > size);
2215         }
2216         list_del(&head);
2217
2218         /* Build the XMIT_SEQUENCE iocb */
2219
2220         num_bde = (uint32_t)txbuffer->flag;
2221
2222         cmd->un.xseq64.bdl.addrHigh = putPaddrHigh(txbmp->phys);
2223         cmd->un.xseq64.bdl.addrLow = putPaddrLow(txbmp->phys);
2224         cmd->un.xseq64.bdl.bdeFlags = BUFF_TYPE_BLP_64;
2225         cmd->un.xseq64.bdl.bdeSize = (num_bde * sizeof(struct ulp_bde64));
2226
2227         cmd->un.xseq64.w5.hcsw.Fctl = (LS | LA);
2228         cmd->un.xseq64.w5.hcsw.Dfctl = 0;
2229         cmd->un.xseq64.w5.hcsw.Rctl = FC_RCTL_DD_UNSOL_CTL;
2230         cmd->un.xseq64.w5.hcsw.Type = FC_TYPE_CT;
2231
2232         cmd->ulpCommand = CMD_XMIT_SEQUENCE64_CX;
2233         cmd->ulpBdeCount = 1;
2234         cmd->ulpLe = 1;
2235         cmd->ulpClass = CLASS3;
2236         cmd->ulpContext = txxri;
2237
2238         cmdiocbq->iocb_flag |= LPFC_IO_LIBDFC;
2239         cmdiocbq->vport = phba->pport;
2240
2241         rc = lpfc_sli_issue_iocb_wait(phba, LPFC_ELS_RING, cmdiocbq, rspiocbq,
2242                                       (phba->fc_ratov * 2) + LPFC_DRVR_TIMEOUT);
2243
2244         if ((rc != IOCB_SUCCESS) || (rsp->ulpStatus != IOCB_SUCCESS)) {
2245                 rc = -EIO;
2246                 goto err_loopback_test_exit;
2247         }
2248
2249         evt->waiting = 1;
2250         rc = wait_event_interruptible_timeout(
2251                 evt->wq, !list_empty(&evt->events_to_see),
2252                 ((phba->fc_ratov * 2) + LPFC_DRVR_TIMEOUT) * HZ);
2253         evt->waiting = 0;
2254         if (list_empty(&evt->events_to_see))
2255                 rc = (rc) ? -EINTR : -ETIMEDOUT;
2256         else {
2257                 spin_lock_irqsave(&phba->ct_ev_lock, flags);
2258                 list_move(evt->events_to_see.prev, &evt->events_to_get);
2259                 evdat = list_entry(evt->events_to_get.prev,
2260                                    typeof(*evdat), node);
2261                 spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
2262                 rx_databuf = evdat->data;
2263                 if (evdat->len != full_size) {
2264                         lpfc_printf_log(phba, KERN_ERR, LOG_LIBDFC,
2265                                 "1603 Loopback test did not receive expected "
2266                                 "data length. actual length 0x%x expected "
2267                                 "length 0x%x\n",
2268                                 evdat->len, full_size);
2269                         rc = -EIO;
2270                 } else if (rx_databuf == NULL)
2271                         rc = -EIO;
2272                 else {
2273                         rc = IOCB_SUCCESS;
2274                         /* skip over elx loopback header */
2275                         rx_databuf += ELX_LOOPBACK_HEADER_SZ;
2276                         job->reply->reply_payload_rcv_len =
2277                                 sg_copy_from_buffer(job->reply_payload.sg_list,
2278                                                     job->reply_payload.sg_cnt,
2279                                                     rx_databuf, size);
2280                         job->reply->reply_payload_rcv_len = size;
2281                 }
2282         }
2283
2284 err_loopback_test_exit:
2285         lpfcdiag_loop_self_unreg(phba, rpi);
2286
2287         spin_lock_irqsave(&phba->ct_ev_lock, flags);
2288         lpfc_bsg_event_unref(evt); /* release ref */
2289         lpfc_bsg_event_unref(evt); /* delete */
2290         spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
2291
2292         if (cmdiocbq != NULL)
2293                 lpfc_sli_release_iocbq(phba, cmdiocbq);
2294
2295         if (rspiocbq != NULL)
2296                 lpfc_sli_release_iocbq(phba, rspiocbq);
2297
2298         if (txbmp != NULL) {
2299                 if (txbpl != NULL) {
2300                         if (txbuffer != NULL)
2301                                 diag_cmd_data_free(phba, txbuffer);
2302                         lpfc_mbuf_free(phba, txbmp->virt, txbmp->phys);
2303                 }
2304                 kfree(txbmp);
2305         }
2306
2307 loopback_test_exit:
2308         kfree(dataout);
2309         /* make error code available to userspace */
2310         job->reply->result = rc;
2311         job->dd_data = NULL;
2312         /* complete the job back to userspace if no error */
2313         if (rc == 0)
2314                 job->job_done(job);
2315         return rc;
2316 }
2317
2318 /**
2319  * lpfc_bsg_get_dfc_rev - process a GET_DFC_REV bsg vendor command
2320  * @job: GET_DFC_REV fc_bsg_job
2321  **/
2322 static int
2323 lpfc_bsg_get_dfc_rev(struct fc_bsg_job *job)
2324 {
2325         struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
2326         struct lpfc_hba *phba = vport->phba;
2327         struct get_mgmt_rev *event_req;
2328         struct get_mgmt_rev_reply *event_reply;
2329         int rc = 0;
2330
2331         if (job->request_len <
2332             sizeof(struct fc_bsg_request) + sizeof(struct get_mgmt_rev)) {
2333                 lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2334                                 "2740 Received GET_DFC_REV request below "
2335                                 "minimum size\n");
2336                 rc = -EINVAL;
2337                 goto job_error;
2338         }
2339
2340         event_req = (struct get_mgmt_rev *)
2341                 job->request->rqst_data.h_vendor.vendor_cmd;
2342
2343         event_reply = (struct get_mgmt_rev_reply *)
2344                 job->reply->reply_data.vendor_reply.vendor_rsp;
2345
2346         if (job->reply_len <
2347             sizeof(struct fc_bsg_request) + sizeof(struct get_mgmt_rev_reply)) {
2348                 lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2349                                 "2741 Received GET_DFC_REV reply below "
2350                                 "minimum size\n");
2351                 rc = -EINVAL;
2352                 goto job_error;
2353         }
2354
2355         event_reply->info.a_Major = MANAGEMENT_MAJOR_REV;
2356         event_reply->info.a_Minor = MANAGEMENT_MINOR_REV;
2357 job_error:
2358         job->reply->result = rc;
2359         if (rc == 0)
2360                 job->job_done(job);
2361         return rc;
2362 }
2363
2364 /**
2365  * lpfc_bsg_wake_mbox_wait - lpfc_bsg_issue_mbox mbox completion handler
2366  * @phba: Pointer to HBA context object.
2367  * @pmboxq: Pointer to mailbox command.
2368  *
2369  * This is completion handler function for mailbox commands issued from
2370  * lpfc_bsg_issue_mbox function. This function is called by the
2371  * mailbox event handler function with no lock held. This function
2372  * will wake up thread waiting on the wait queue pointed by context1
2373  * of the mailbox.
2374  **/
2375 void
2376 lpfc_bsg_wake_mbox_wait(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmboxq)
2377 {
2378         struct bsg_job_data *dd_data;
2379         MAILBOX_t *pmb;
2380         MAILBOX_t *mb;
2381         struct fc_bsg_job *job;
2382         uint32_t size;
2383         unsigned long flags;
2384
2385         spin_lock_irqsave(&phba->ct_ev_lock, flags);
2386         dd_data = pmboxq->context1;
2387         if (!dd_data) {
2388                 spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
2389                 return;
2390         }
2391
2392         pmb = &dd_data->context_un.mbox.pmboxq->u.mb;
2393         mb = dd_data->context_un.mbox.mb;
2394         job = dd_data->context_un.mbox.set_job;
2395         memcpy(mb, pmb, sizeof(*pmb));
2396         size = job->request_payload.payload_len;
2397         job->reply->reply_payload_rcv_len =
2398                 sg_copy_from_buffer(job->reply_payload.sg_list,
2399                                 job->reply_payload.sg_cnt,
2400                                 mb, size);
2401         job->reply->result = 0;
2402         dd_data->context_un.mbox.set_job = NULL;
2403         job->dd_data = NULL;
2404         job->job_done(job);
2405         spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
2406         mempool_free(dd_data->context_un.mbox.pmboxq, phba->mbox_mem_pool);
2407         kfree(mb);
2408         kfree(dd_data);
2409         return;
2410 }
2411
2412 /**
2413  * lpfc_bsg_check_cmd_access - test for a supported mailbox command
2414  * @phba: Pointer to HBA context object.
2415  * @mb: Pointer to a mailbox object.
2416  * @vport: Pointer to a vport object.
2417  *
2418  * Some commands require the port to be offline, some may not be called from
2419  * the application.
2420  **/
2421 static int lpfc_bsg_check_cmd_access(struct lpfc_hba *phba,
2422         MAILBOX_t *mb, struct lpfc_vport *vport)
2423 {
2424         /* return negative error values for bsg job */
2425         switch (mb->mbxCommand) {
2426         /* Offline only */
2427         case MBX_INIT_LINK:
2428         case MBX_DOWN_LINK:
2429         case MBX_CONFIG_LINK:
2430         case MBX_CONFIG_RING:
2431         case MBX_RESET_RING:
2432         case MBX_UNREG_LOGIN:
2433         case MBX_CLEAR_LA:
2434         case MBX_DUMP_CONTEXT:
2435         case MBX_RUN_DIAGS:
2436         case MBX_RESTART:
2437         case MBX_SET_MASK:
2438                 if (!(vport->fc_flag & FC_OFFLINE_MODE)) {
2439                         lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2440                                 "2743 Command 0x%x is illegal in on-line "
2441                                 "state\n",
2442                                 mb->mbxCommand);
2443                         return -EPERM;
2444                 }
2445         case MBX_WRITE_NV:
2446         case MBX_WRITE_VPARMS:
2447         case MBX_LOAD_SM:
2448         case MBX_READ_NV:
2449         case MBX_READ_CONFIG:
2450         case MBX_READ_RCONFIG:
2451         case MBX_READ_STATUS:
2452         case MBX_READ_XRI:
2453         case MBX_READ_REV:
2454         case MBX_READ_LNK_STAT:
2455         case MBX_DUMP_MEMORY:
2456         case MBX_DOWN_LOAD:
2457         case MBX_UPDATE_CFG:
2458         case MBX_KILL_BOARD:
2459         case MBX_LOAD_AREA:
2460         case MBX_LOAD_EXP_ROM:
2461         case MBX_BEACON:
2462         case MBX_DEL_LD_ENTRY:
2463         case MBX_SET_DEBUG:
2464         case MBX_WRITE_WWN:
2465         case MBX_SLI4_CONFIG:
2466         case MBX_READ_EVENT_LOG_STATUS:
2467         case MBX_WRITE_EVENT_LOG:
2468         case MBX_PORT_CAPABILITIES:
2469         case MBX_PORT_IOV_CONTROL:
2470                 break;
2471         case MBX_SET_VARIABLE:
2472                 lpfc_printf_log(phba, KERN_INFO, LOG_INIT,
2473                         "1226 mbox: set_variable 0x%x, 0x%x\n",
2474                         mb->un.varWords[0],
2475                         mb->un.varWords[1]);
2476                 if ((mb->un.varWords[0] == SETVAR_MLOMNT)
2477                         && (mb->un.varWords[1] == 1)) {
2478                         phba->wait_4_mlo_maint_flg = 1;
2479                 } else if (mb->un.varWords[0] == SETVAR_MLORST) {
2480                         phba->link_flag &= ~LS_LOOPBACK_MODE;
2481                         phba->fc_topology = TOPOLOGY_PT_PT;
2482                 }
2483                 break;
2484         case MBX_RUN_BIU_DIAG64:
2485         case MBX_READ_EVENT_LOG:
2486         case MBX_READ_SPARM64:
2487         case MBX_READ_LA:
2488         case MBX_READ_LA64:
2489         case MBX_REG_LOGIN:
2490         case MBX_REG_LOGIN64:
2491         case MBX_CONFIG_PORT:
2492         case MBX_RUN_BIU_DIAG:
2493         default:
2494                 lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2495                         "2742 Unknown Command 0x%x\n",
2496                         mb->mbxCommand);
2497                 return -EPERM;
2498         }
2499
2500         return 0; /* ok */
2501 }
2502
2503 /**
2504  * lpfc_bsg_issue_mbox - issues a mailbox command on behalf of an app
2505  * @phba: Pointer to HBA context object.
2506  * @mb: Pointer to a mailbox object.
2507  * @vport: Pointer to a vport object.
2508  *
2509  * Allocate a tracking object, mailbox command memory, get a mailbox
2510  * from the mailbox pool, copy the caller mailbox command.
2511  *
2512  * If offline and the sli is active we need to poll for the command (port is
2513  * being reset) and com-plete the job, otherwise issue the mailbox command and
2514  * let our completion handler finish the command.
2515  **/
2516 static uint32_t
2517 lpfc_bsg_issue_mbox(struct lpfc_hba *phba, struct fc_bsg_job *job,
2518         struct lpfc_vport *vport)
2519 {
2520         LPFC_MBOXQ_t *pmboxq;
2521         MAILBOX_t *pmb;
2522         MAILBOX_t *mb;
2523         struct bsg_job_data *dd_data;
2524         uint32_t size;
2525         int rc = 0;
2526
2527         /* allocate our bsg tracking structure */
2528         dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
2529         if (!dd_data) {
2530                 lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2531                                 "2727 Failed allocation of dd_data\n");
2532                 return -ENOMEM;
2533         }
2534
2535         mb = kzalloc(PAGE_SIZE, GFP_KERNEL);
2536         if (!mb) {
2537                 kfree(dd_data);
2538                 return -ENOMEM;
2539         }
2540
2541         pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
2542         if (!pmboxq) {
2543                 kfree(dd_data);
2544                 kfree(mb);
2545                 return -ENOMEM;
2546         }
2547
2548         size = job->request_payload.payload_len;
2549         job->reply->reply_payload_rcv_len =
2550                 sg_copy_to_buffer(job->request_payload.sg_list,
2551                                 job->request_payload.sg_cnt,
2552                                 mb, size);
2553
2554         rc = lpfc_bsg_check_cmd_access(phba, mb, vport);
2555         if (rc != 0) {
2556                 kfree(dd_data);
2557                 kfree(mb);
2558                 mempool_free(pmboxq, phba->mbox_mem_pool);
2559                 return rc; /* must be negative */
2560         }
2561
2562         memset(pmboxq, 0, sizeof(LPFC_MBOXQ_t));
2563         pmb = &pmboxq->u.mb;
2564         memcpy(pmb, mb, sizeof(*pmb));
2565         pmb->mbxOwner = OWN_HOST;
2566         pmboxq->context1 = NULL;
2567         pmboxq->vport = vport;
2568
2569         if ((vport->fc_flag & FC_OFFLINE_MODE) ||
2570             (!(phba->sli.sli_flag & LPFC_SLI_ACTIVE))) {
2571                 rc = lpfc_sli_issue_mbox(phba, pmboxq, MBX_POLL);
2572                 if (rc != MBX_SUCCESS) {
2573                         if (rc != MBX_TIMEOUT) {
2574                                 kfree(dd_data);
2575                                 kfree(mb);
2576                                 mempool_free(pmboxq, phba->mbox_mem_pool);
2577                         }
2578                         return  (rc == MBX_TIMEOUT) ? -ETIME : -ENODEV;
2579                 }
2580
2581                 memcpy(mb, pmb, sizeof(*pmb));
2582                 job->reply->reply_payload_rcv_len =
2583                         sg_copy_from_buffer(job->reply_payload.sg_list,
2584                                         job->reply_payload.sg_cnt,
2585                                         mb, size);
2586                 kfree(dd_data);
2587                 kfree(mb);
2588                 mempool_free(pmboxq, phba->mbox_mem_pool);
2589                 /* not waiting mbox already done */
2590                 return 0;
2591         }
2592
2593         /* setup wake call as IOCB callback */
2594         pmboxq->mbox_cmpl = lpfc_bsg_wake_mbox_wait;
2595         /* setup context field to pass wait_queue pointer to wake function */
2596         pmboxq->context1 = dd_data;
2597         dd_data->type = TYPE_MBOX;
2598         dd_data->context_un.mbox.pmboxq = pmboxq;
2599         dd_data->context_un.mbox.mb = mb;
2600         dd_data->context_un.mbox.set_job = job;
2601         job->dd_data = dd_data;
2602         rc = lpfc_sli_issue_mbox(phba, pmboxq, MBX_NOWAIT);
2603         if ((rc != MBX_SUCCESS) && (rc != MBX_BUSY)) {
2604                 kfree(dd_data);
2605                 kfree(mb);
2606                 mempool_free(pmboxq, phba->mbox_mem_pool);
2607                 return -EIO;
2608         }
2609
2610         return 1;
2611 }
2612
2613 /**
2614  * lpfc_bsg_mbox_cmd - process an fc bsg LPFC_BSG_VENDOR_MBOX command
2615  * @job: MBOX fc_bsg_job for LPFC_BSG_VENDOR_MBOX.
2616  **/
2617 static int
2618 lpfc_bsg_mbox_cmd(struct fc_bsg_job *job)
2619 {
2620         struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
2621         struct lpfc_hba *phba = vport->phba;
2622         int rc = 0;
2623
2624         /* in case no data is transferred */
2625         job->reply->reply_payload_rcv_len = 0;
2626         if (job->request_len <
2627             sizeof(struct fc_bsg_request) + sizeof(struct dfc_mbox_req)) {
2628                 lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2629                                 "2737 Received MBOX_REQ request below "
2630                                 "minimum size\n");
2631                 rc = -EINVAL;
2632                 goto job_error;
2633         }
2634
2635         if (job->request_payload.payload_len != PAGE_SIZE) {
2636                 rc = -EINVAL;
2637                 goto job_error;
2638         }
2639
2640         if (phba->sli.sli_flag & LPFC_BLOCK_MGMT_IO) {
2641                 rc = -EAGAIN;
2642                 goto job_error;
2643         }
2644
2645         rc = lpfc_bsg_issue_mbox(phba, job, vport);
2646
2647 job_error:
2648         if (rc == 0) {
2649                 /* job done */
2650                 job->reply->result = 0;
2651                 job->dd_data = NULL;
2652                 job->job_done(job);
2653         } else if (rc == 1)
2654                 /* job submitted, will complete later*/
2655                 rc = 0; /* return zero, no error */
2656         else {
2657                 /* some error occurred */
2658                 job->reply->result = rc;
2659                 job->dd_data = NULL;
2660         }
2661
2662         return rc;
2663 }
2664
2665 /**
2666  * lpfc_bsg_menlo_cmd_cmp - lpfc_menlo_cmd completion handler
2667  * @phba: Pointer to HBA context object.
2668  * @cmdiocbq: Pointer to command iocb.
2669  * @rspiocbq: Pointer to response iocb.
2670  *
2671  * This function is the completion handler for iocbs issued using
2672  * lpfc_menlo_cmd function. This function is called by the
2673  * ring event handler function without any lock held. This function
2674  * can be called from both worker thread context and interrupt
2675  * context. This function also can be called from another thread which
2676  * cleans up the SLI layer objects.
2677  * This function copies the contents of the response iocb to the
2678  * response iocb memory object provided by the caller of
2679  * lpfc_sli_issue_iocb_wait and then wakes up the thread which
2680  * sleeps for the iocb completion.
2681  **/
2682 static void
2683 lpfc_bsg_menlo_cmd_cmp(struct lpfc_hba *phba,
2684                         struct lpfc_iocbq *cmdiocbq,
2685                         struct lpfc_iocbq *rspiocbq)
2686 {
2687         struct bsg_job_data *dd_data;
2688         struct fc_bsg_job *job;
2689         IOCB_t *rsp;
2690         struct lpfc_dmabuf *bmp;
2691         struct lpfc_bsg_menlo *menlo;
2692         unsigned long flags;
2693         struct menlo_response *menlo_resp;
2694         int rc = 0;
2695
2696         spin_lock_irqsave(&phba->ct_ev_lock, flags);
2697         dd_data = cmdiocbq->context1;
2698         if (!dd_data) {
2699                 spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
2700                 return;
2701         }
2702
2703         menlo = &dd_data->context_un.menlo;
2704         job = menlo->set_job;
2705         job->dd_data = NULL; /* so timeout handler does not reply */
2706
2707         spin_lock_irqsave(&phba->hbalock, flags);
2708         cmdiocbq->iocb_flag |= LPFC_IO_WAKE;
2709         if (cmdiocbq->context2 && rspiocbq)
2710                 memcpy(&((struct lpfc_iocbq *)cmdiocbq->context2)->iocb,
2711                        &rspiocbq->iocb, sizeof(IOCB_t));
2712         spin_unlock_irqrestore(&phba->hbalock, flags);
2713
2714         bmp = menlo->bmp;
2715         rspiocbq = menlo->rspiocbq;
2716         rsp = &rspiocbq->iocb;
2717
2718         pci_unmap_sg(phba->pcidev, job->request_payload.sg_list,
2719                      job->request_payload.sg_cnt, DMA_TO_DEVICE);
2720         pci_unmap_sg(phba->pcidev, job->reply_payload.sg_list,
2721                      job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
2722
2723         /* always return the xri, this would be used in the case
2724          * of a menlo download to allow the data to be sent as a continuation
2725          * of the exchange.
2726          */
2727         menlo_resp = (struct menlo_response *)
2728                 job->reply->reply_data.vendor_reply.vendor_rsp;
2729         menlo_resp->xri = rsp->ulpContext;
2730         if (rsp->ulpStatus) {
2731                 if (rsp->ulpStatus == IOSTAT_LOCAL_REJECT) {
2732                         switch (rsp->un.ulpWord[4] & 0xff) {
2733                         case IOERR_SEQUENCE_TIMEOUT:
2734                                 rc = -ETIMEDOUT;
2735                                 break;
2736                         case IOERR_INVALID_RPI:
2737                                 rc = -EFAULT;
2738                                 break;
2739                         default:
2740                                 rc = -EACCES;
2741                                 break;
2742                         }
2743                 } else
2744                         rc = -EACCES;
2745         } else
2746                 job->reply->reply_payload_rcv_len =
2747                         rsp->un.genreq64.bdl.bdeSize;
2748
2749         lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
2750         lpfc_sli_release_iocbq(phba, rspiocbq);
2751         lpfc_sli_release_iocbq(phba, cmdiocbq);
2752         kfree(bmp);
2753         kfree(dd_data);
2754         /* make error code available to userspace */
2755         job->reply->result = rc;
2756         /* complete the job back to userspace */
2757         job->job_done(job);
2758         spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
2759         return;
2760 }
2761
2762 /**
2763  * lpfc_menlo_cmd - send an ioctl for menlo hardware
2764  * @job: fc_bsg_job to handle
2765  *
2766  * This function issues a gen request 64 CR ioctl for all menlo cmd requests,
2767  * all the command completions will return the xri for the command.
2768  * For menlo data requests a gen request 64 CX is used to continue the exchange
2769  * supplied in the menlo request header xri field.
2770  **/
2771 static int
2772 lpfc_menlo_cmd(struct fc_bsg_job *job)
2773 {
2774         struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
2775         struct lpfc_hba *phba = vport->phba;
2776         struct lpfc_iocbq *cmdiocbq, *rspiocbq;
2777         IOCB_t *cmd, *rsp;
2778         int rc = 0;
2779         struct menlo_command *menlo_cmd;
2780         struct menlo_response *menlo_resp;
2781         struct lpfc_dmabuf *bmp = NULL;
2782         int request_nseg;
2783         int reply_nseg;
2784         struct scatterlist *sgel = NULL;
2785         int numbde;
2786         dma_addr_t busaddr;
2787         struct bsg_job_data *dd_data;
2788         struct ulp_bde64 *bpl = NULL;
2789
2790         /* in case no data is returned return just the return code */
2791         job->reply->reply_payload_rcv_len = 0;
2792
2793         if (job->request_len <
2794             sizeof(struct fc_bsg_request) +
2795                 sizeof(struct menlo_command)) {
2796                 lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2797                                 "2784 Received MENLO_CMD request below "
2798                                 "minimum size\n");
2799                 rc = -ERANGE;
2800                 goto no_dd_data;
2801         }
2802
2803         if (job->reply_len <
2804             sizeof(struct fc_bsg_request) + sizeof(struct menlo_response)) {
2805                 lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2806                                 "2785 Received MENLO_CMD reply below "
2807                                 "minimum size\n");
2808                 rc = -ERANGE;
2809                 goto no_dd_data;
2810         }
2811
2812         if (!(phba->menlo_flag & HBA_MENLO_SUPPORT)) {
2813                 lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2814                                 "2786 Adapter does not support menlo "
2815                                 "commands\n");
2816                 rc = -EPERM;
2817                 goto no_dd_data;
2818         }
2819
2820         menlo_cmd = (struct menlo_command *)
2821                 job->request->rqst_data.h_vendor.vendor_cmd;
2822
2823         menlo_resp = (struct menlo_response *)
2824                 job->reply->reply_data.vendor_reply.vendor_rsp;
2825
2826         /* allocate our bsg tracking structure */
2827         dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
2828         if (!dd_data) {
2829                 lpfc_printf_log(phba, KERN_WARNING, LOG_LIBDFC,
2830                                 "2787 Failed allocation of dd_data\n");
2831                 rc = -ENOMEM;
2832                 goto no_dd_data;
2833         }
2834
2835         bmp = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
2836         if (!bmp) {
2837                 rc = -ENOMEM;
2838                 goto free_dd;
2839         }
2840
2841         cmdiocbq = lpfc_sli_get_iocbq(phba);
2842         if (!cmdiocbq) {
2843                 rc = -ENOMEM;
2844                 goto free_bmp;
2845         }
2846
2847         rspiocbq = lpfc_sli_get_iocbq(phba);
2848         if (!rspiocbq) {
2849                 rc = -ENOMEM;
2850                 goto free_cmdiocbq;
2851         }
2852
2853         rsp = &rspiocbq->iocb;
2854
2855         bmp->virt = lpfc_mbuf_alloc(phba, 0, &bmp->phys);
2856         if (!bmp->virt) {
2857                 rc = -ENOMEM;
2858                 goto free_rspiocbq;
2859         }
2860
2861         INIT_LIST_HEAD(&bmp->list);
2862         bpl = (struct ulp_bde64 *) bmp->virt;
2863         request_nseg = pci_map_sg(phba->pcidev, job->request_payload.sg_list,
2864                                   job->request_payload.sg_cnt, DMA_TO_DEVICE);
2865         for_each_sg(job->request_payload.sg_list, sgel, request_nseg, numbde) {
2866                 busaddr = sg_dma_address(sgel);
2867                 bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64;
2868                 bpl->tus.f.bdeSize = sg_dma_len(sgel);
2869                 bpl->tus.w = cpu_to_le32(bpl->tus.w);
2870                 bpl->addrLow = cpu_to_le32(putPaddrLow(busaddr));
2871                 bpl->addrHigh = cpu_to_le32(putPaddrHigh(busaddr));
2872                 bpl++;
2873         }
2874
2875         reply_nseg = pci_map_sg(phba->pcidev, job->reply_payload.sg_list,
2876                                 job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
2877         for_each_sg(job->reply_payload.sg_list, sgel, reply_nseg, numbde) {
2878                 busaddr = sg_dma_address(sgel);
2879                 bpl->tus.f.bdeFlags = BUFF_TYPE_BDE_64I;
2880                 bpl->tus.f.bdeSize = sg_dma_len(sgel);
2881                 bpl->tus.w = cpu_to_le32(bpl->tus.w);
2882                 bpl->addrLow = cpu_to_le32(putPaddrLow(busaddr));
2883                 bpl->addrHigh = cpu_to_le32(putPaddrHigh(busaddr));
2884                 bpl++;
2885         }
2886
2887         cmd = &cmdiocbq->iocb;
2888         cmd->un.genreq64.bdl.ulpIoTag32 = 0;
2889         cmd->un.genreq64.bdl.addrHigh = putPaddrHigh(bmp->phys);
2890         cmd->un.genreq64.bdl.addrLow = putPaddrLow(bmp->phys);
2891         cmd->un.genreq64.bdl.bdeFlags = BUFF_TYPE_BLP_64;
2892         cmd->un.genreq64.bdl.bdeSize =
2893             (request_nseg + reply_nseg) * sizeof(struct ulp_bde64);
2894         cmd->un.genreq64.w5.hcsw.Fctl = (SI | LA);
2895         cmd->un.genreq64.w5.hcsw.Dfctl = 0;
2896         cmd->un.genreq64.w5.hcsw.Rctl = FC_RCTL_DD_UNSOL_CMD;
2897         cmd->un.genreq64.w5.hcsw.Type = MENLO_TRANSPORT_TYPE; /* 0xfe */
2898         cmd->ulpBdeCount = 1;
2899         cmd->ulpClass = CLASS3;
2900         cmd->ulpOwner = OWN_CHIP;
2901         cmd->ulpLe = 1; /* Limited Edition */
2902         cmdiocbq->iocb_flag |= LPFC_IO_LIBDFC;
2903         cmdiocbq->vport = phba->pport;
2904         /* We want the firmware to timeout before we do */
2905         cmd->ulpTimeout = MENLO_TIMEOUT - 5;
2906         cmdiocbq->context3 = bmp;
2907         cmdiocbq->context2 = rspiocbq;
2908         cmdiocbq->iocb_cmpl = lpfc_bsg_menlo_cmd_cmp;
2909         cmdiocbq->context1 = dd_data;
2910         cmdiocbq->context2 = rspiocbq;
2911         if (menlo_cmd->cmd == LPFC_BSG_VENDOR_MENLO_CMD) {
2912                 cmd->ulpCommand = CMD_GEN_REQUEST64_CR;
2913                 cmd->ulpPU = MENLO_PU; /* 3 */
2914                 cmd->un.ulpWord[4] = MENLO_DID; /* 0x0000FC0E */
2915                 cmd->ulpContext = MENLO_CONTEXT; /* 0 */
2916         } else {
2917                 cmd->ulpCommand = CMD_GEN_REQUEST64_CX;
2918                 cmd->ulpPU = 1;
2919                 cmd->un.ulpWord[4] = 0;
2920                 cmd->ulpContext = menlo_cmd->xri;
2921         }
2922
2923         dd_data->type = TYPE_MENLO;
2924         dd_data->context_un.menlo.cmdiocbq = cmdiocbq;
2925         dd_data->context_un.menlo.rspiocbq = rspiocbq;
2926         dd_data->context_un.menlo.set_job = job;
2927         dd_data->context_un.menlo.bmp = bmp;
2928
2929         rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, cmdiocbq,
2930                 MENLO_TIMEOUT - 5);
2931         if (rc == IOCB_SUCCESS)
2932                 return 0; /* done for now */
2933
2934         /* iocb failed so cleanup */
2935         pci_unmap_sg(phba->pcidev, job->request_payload.sg_list,
2936                      job->request_payload.sg_cnt, DMA_TO_DEVICE);
2937         pci_unmap_sg(phba->pcidev, job->reply_payload.sg_list,
2938                      job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
2939
2940         lpfc_mbuf_free(phba, bmp->virt, bmp->phys);
2941
2942 free_rspiocbq:
2943         lpfc_sli_release_iocbq(phba, rspiocbq);
2944 free_cmdiocbq:
2945         lpfc_sli_release_iocbq(phba, cmdiocbq);
2946 free_bmp:
2947         kfree(bmp);
2948 free_dd:
2949         kfree(dd_data);
2950 no_dd_data:
2951         /* make error code available to userspace */
2952         job->reply->result = rc;
2953         job->dd_data = NULL;
2954         return rc;
2955 }
2956 /**
2957  * lpfc_bsg_hst_vendor - process a vendor-specific fc_bsg_job
2958  * @job: fc_bsg_job to handle
2959  **/
2960 static int
2961 lpfc_bsg_hst_vendor(struct fc_bsg_job *job)
2962 {
2963         int command = job->request->rqst_data.h_vendor.vendor_cmd[0];
2964         int rc;
2965
2966         switch (command) {
2967         case LPFC_BSG_VENDOR_SET_CT_EVENT:
2968                 rc = lpfc_bsg_hba_set_event(job);
2969                 break;
2970         case LPFC_BSG_VENDOR_GET_CT_EVENT:
2971                 rc = lpfc_bsg_hba_get_event(job);
2972                 break;
2973         case LPFC_BSG_VENDOR_SEND_MGMT_RESP:
2974                 rc = lpfc_bsg_send_mgmt_rsp(job);
2975                 break;
2976         case LPFC_BSG_VENDOR_DIAG_MODE:
2977                 rc = lpfc_bsg_diag_mode(job);
2978                 break;
2979         case LPFC_BSG_VENDOR_DIAG_TEST:
2980                 rc = lpfc_bsg_diag_test(job);
2981                 break;
2982         case LPFC_BSG_VENDOR_GET_MGMT_REV:
2983                 rc = lpfc_bsg_get_dfc_rev(job);
2984                 break;
2985         case LPFC_BSG_VENDOR_MBOX:
2986                 rc = lpfc_bsg_mbox_cmd(job);
2987                 break;
2988         case LPFC_BSG_VENDOR_MENLO_CMD:
2989         case LPFC_BSG_VENDOR_MENLO_DATA:
2990                 rc = lpfc_menlo_cmd(job);
2991                 break;
2992         default:
2993                 rc = -EINVAL;
2994                 job->reply->reply_payload_rcv_len = 0;
2995                 /* make error code available to userspace */
2996                 job->reply->result = rc;
2997                 break;
2998         }
2999
3000         return rc;
3001 }
3002
3003 /**
3004  * lpfc_bsg_request - handle a bsg request from the FC transport
3005  * @job: fc_bsg_job to handle
3006  **/
3007 int
3008 lpfc_bsg_request(struct fc_bsg_job *job)
3009 {
3010         uint32_t msgcode;
3011         int rc;
3012
3013         msgcode = job->request->msgcode;
3014         switch (msgcode) {
3015         case FC_BSG_HST_VENDOR:
3016                 rc = lpfc_bsg_hst_vendor(job);
3017                 break;
3018         case FC_BSG_RPT_ELS:
3019                 rc = lpfc_bsg_rport_els(job);
3020                 break;
3021         case FC_BSG_RPT_CT:
3022                 rc = lpfc_bsg_send_mgmt_cmd(job);
3023                 break;
3024         default:
3025                 rc = -EINVAL;
3026                 job->reply->reply_payload_rcv_len = 0;
3027                 /* make error code available to userspace */
3028                 job->reply->result = rc;
3029                 break;
3030         }
3031
3032         return rc;
3033 }
3034
3035 /**
3036  * lpfc_bsg_timeout - handle timeout of a bsg request from the FC transport
3037  * @job: fc_bsg_job that has timed out
3038  *
3039  * This function just aborts the job's IOCB.  The aborted IOCB will return to
3040  * the waiting function which will handle passing the error back to userspace
3041  **/
3042 int
3043 lpfc_bsg_timeout(struct fc_bsg_job *job)
3044 {
3045         struct lpfc_vport *vport = (struct lpfc_vport *)job->shost->hostdata;
3046         struct lpfc_hba *phba = vport->phba;
3047         struct lpfc_iocbq *cmdiocb;
3048         struct lpfc_bsg_event *evt;
3049         struct lpfc_bsg_iocb *iocb;
3050         struct lpfc_bsg_mbox *mbox;
3051         struct lpfc_bsg_menlo *menlo;
3052         struct lpfc_sli_ring *pring = &phba->sli.ring[LPFC_ELS_RING];
3053         struct bsg_job_data *dd_data;
3054         unsigned long flags;
3055
3056         spin_lock_irqsave(&phba->ct_ev_lock, flags);
3057         dd_data = (struct bsg_job_data *)job->dd_data;
3058         /* timeout and completion crossed paths if no dd_data */
3059         if (!dd_data) {
3060                 spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
3061                 return 0;
3062         }
3063
3064         switch (dd_data->type) {
3065         case TYPE_IOCB:
3066                 iocb = &dd_data->context_un.iocb;
3067                 cmdiocb = iocb->cmdiocbq;
3068                 /* hint to completion handler that the job timed out */
3069                 job->reply->result = -EAGAIN;
3070                 spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
3071                 /* this will call our completion handler */
3072                 spin_lock_irq(&phba->hbalock);
3073                 lpfc_sli_issue_abort_iotag(phba, pring, cmdiocb);
3074                 spin_unlock_irq(&phba->hbalock);
3075                 break;
3076         case TYPE_EVT:
3077                 evt = dd_data->context_un.evt;
3078                 /* this event has no job anymore */
3079                 evt->set_job = NULL;
3080                 job->dd_data = NULL;
3081                 job->reply->reply_payload_rcv_len = 0;
3082                 /* Return -EAGAIN which is our way of signallying the
3083                  * app to retry.
3084                  */
3085                 job->reply->result = -EAGAIN;
3086                 spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
3087                 job->job_done(job);
3088                 break;
3089         case TYPE_MBOX:
3090                 mbox = &dd_data->context_un.mbox;
3091                 /* this mbox has no job anymore */
3092                 mbox->set_job = NULL;
3093                 job->dd_data = NULL;
3094                 job->reply->reply_payload_rcv_len = 0;
3095                 job->reply->result = -EAGAIN;
3096                 spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
3097                 job->job_done(job);
3098                 break;
3099         case TYPE_MENLO:
3100                 menlo = &dd_data->context_un.menlo;
3101                 cmdiocb = menlo->cmdiocbq;
3102                 /* hint to completion handler that the job timed out */
3103                 job->reply->result = -EAGAIN;
3104                 spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
3105                 /* this will call our completion handler */
3106                 spin_lock_irq(&phba->hbalock);
3107                 lpfc_sli_issue_abort_iotag(phba, pring, cmdiocb);
3108                 spin_unlock_irq(&phba->hbalock);
3109                 break;
3110         default:
3111                 spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
3112                 break;
3113         }
3114
3115         /* scsi transport fc fc_bsg_job_timeout expects a zero return code,
3116          * otherwise an error message will be displayed on the console
3117          * so always return success (zero)
3118          */
3119         return 0;
3120 }